Fix extension delivery bug fix Windows extension paths to .ext.ext (#13986)

Found these bugs while testing the extensions feature for #13287.

- [X] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- ~[ ] Documented any API changes (docs/Using-Fleet/REST-API.md or
docs/Contributing/API-for-contributors.md)~
- ~[ ] Documented any permissions changes (docs/Using
Fleet/manage-access.md)~
- ~[ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)~
- ~[ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for
new osquery data ingestion features.~
- [x] Added/updated tests
- [X] Manual QA for all new/changed functionality
  - For Orbit and Fleet Desktop changes:
- [x] Manual QA must be performed in the three main OSs, macOS, Windows
and Linux.
- [x] Auto-update manual QA, from released version of component to new
version (see [tools/tuf/test](../tools/tuf/test/README.md)).

.gitignore

@@ -95,3 +95,8 @@ osquery_worker_*.jpg
 
 # Residual files when building fleetd_tables extension.
 fleetd_tables_*
+
+# Location of test extensions executables
+tools/test_extensions/hello_world/macos
+tools/test_extensions/hello_world/windows
+tools/test_extensions/hello_world/linux

changes/13287-fix-bugs-in-fleetd-extensions

@@ -0,0 +1,2 @@
+* Change fleetd Windows extensions file extension from `.ext` to `.ext.exe` to allow their execution on Windows devices (executables on Windows must end with `.exe`).
+* Fixed delivery of fleetd extensions to devices to only send extensions for the host's platform.

ee/fleetctl/updates.go

@@ -262,6 +262,10 @@ func updatesAddFunc(c *cli.Context) error {
 		case name == "desktop" && platform == "linux":
 			// This is a special case for the desktop target on Linux.
 			dstPath += ".tar.gz"
+		// The convention for Windows extensions is to use the extension `.ext.exe`
+		// All Windows executables must end with `.exe`.
+		case strings.HasSuffix(target, ".ext.exe"):
+			dstPath += ".ext.exe"
 		case strings.HasSuffix(target, ".exe"):
 			dstPath += ".exe"
 		case strings.HasSuffix(target, ".app.tar.gz"):

orbit/pkg/update/flag_runner.go

@@ -7,12 +7,14 @@ import (
 	"os"
 	"path/filepath"
 	"reflect"
+	"runtime"
 	"strconv"
 	"strings"
 	"time"
 
 	"github.com/fleetdm/fleet/v4/orbit/pkg/constant"
 	"github.com/fleetdm/fleet/v4/orbit/pkg/logging"
+	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/rs/zerolog/log"
 )
 
@@ -231,25 +233,28 @@ func (r *ExtensionRunner) DoExtensionConfigUpdate() (bool, error) {
 		}
 	}
 
-	type ExtensionInfo struct {
-		Platform string `json:"platform"`
-		Channel  string `json:"channel"`
-	}
-
-	var data map[string]ExtensionInfo
-	err = json.Unmarshal(config.Extensions, &data)
+	var extensions fleet.Extensions
+	err = json.Unmarshal(config.Extensions, &extensions)
 	if err != nil {
 		// we do not want orbit to restart
 		return false, fmt.Errorf("error unmarshing json extensions config from fleet: %w", err)
 	}
 
+	// Filter out extensions not targeted to this OS.
+	extensions.FilterByHostPlatform(runtime.GOOS)
+
 	var sb strings.Builder
-	for extensionName, extensionInfo := range data {
+	for extensionName, extensionInfo := range extensions {
 		// infer filename from extension name
 		// osquery enforces .ext, so we just add that
 		// we expect filename to match extension name
 		filename := extensionName + ".ext"
 
+		// All Windows executables must end with `.exe`.
+		if runtime.GOOS == "windows" {
+			filename = filename + ".exe"
+		}
+
 		// we don't want path traversal and the like in the filename
 		if strings.Contains(filename, "..") || strings.Contains(filename, "/") || strings.Contains(filename, "\\") {
 			log.Info().Msgf("invalid characters found in filename (%s) for extension (%s): skipping", filename, extensionName)
@@ -268,7 +273,8 @@ func (r *ExtensionRunner) DoExtensionConfigUpdate() (bool, error) {
 		r.updateRunner.updater.SetTargetInfo(targetName, TargetInfo{Platform: platform, Channel: channel, TargetFile: filename})
 
 		// the full path to where the extension would be on disk, for e.g. for extension name "hello_world"
-		// the path is: <root-dir>/bin/extensions/hello_world/<platform>/<channel>/hello_world.ext
+		// the path is: <root-dir>/bin/extensions/hello_world/<platform>/<channel>/hello_world.ext on macOS/Linux
+		// and <root-dir>/bin/extensions/hello_world/<platform>/<channel>/hello_world.ext.exe on Windows.
 		path := filepath.Join(rootDir, "bin", "extensions", extensionName, platform, channel, filename)
 
 		if err := r.updateRunner.updater.UpdateMetadata(); err != nil {

server/fleet/orbit.go

@@ -50,3 +50,32 @@ type OrbitHostInfo struct {
 	// Platform is the device's platform as defined by osquery.
 	Platform string
 }
+
+// ExtensionInfo holds the data of a osquery extension to apply to an Orbit client.
+type ExtensionInfo struct {
+	// Platform is one of "windows", "linux" or "macos".
+	Platform string `json:"platform"`
+	// Channel is the select TUF channel to listen for updates.
+	Channel string `json:"channel"`
+}
+
+// Extensions holds a set of extensions to apply to an Orbit client.
+// The key of the map is the extension name (as defined on the TUF server).
+type Extensions map[string]ExtensionInfo
+
+// FilterByHostPlatform filters out extensions that are not targeted for hostPlatform.
+// It supports host platforms reported by osquery and by Go's runtime.GOOS.
+func (es *Extensions) FilterByHostPlatform(hostPlatform string) {
+	switch {
+	case IsLinux(hostPlatform):
+		hostPlatform = "linux"
+	case hostPlatform == "darwin":
+		// Osquery uses "darwin", whereas the extensions feature uses "macos".
+		hostPlatform = "macos"
+	}
+	for extensionName, extensionInfo := range *es {
+		if hostPlatform != extensionInfo.Platform {
+			delete(*es, extensionName)
+		}
+	}
+}

server/fleet/orbit_test.go

@@ -0,0 +1,72 @@
+package fleet
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestFilterByHostPlatform(t *testing.T) {
+	var extensions Extensions
+	extensions.FilterByHostPlatform("darwin")
+	require.Len(t, extensions, 0)
+
+	extensions = Extensions{
+		"hello_world": ExtensionInfo{
+			Platform: "macos",
+			Channel:  "stable",
+		},
+	}
+
+	extensions.FilterByHostPlatform("darwin")
+	require.Contains(t, extensions, "hello_world")
+
+	extensions.FilterByHostPlatform("macos")
+	require.Contains(t, extensions, "hello_world")
+
+	extensions.FilterByHostPlatform("ubuntu")
+	require.Len(t, extensions, 0)
+
+	extensions = Extensions{
+		"hello_world": ExtensionInfo{
+			Platform: "linux",
+			Channel:  "stable",
+		},
+	}
+
+	extensions.FilterByHostPlatform("ubuntu")
+	require.Contains(t, extensions, "hello_world")
+
+	extensions = Extensions{
+		"hello_world": ExtensionInfo{
+			Platform: "windows",
+			Channel:  "stable",
+		},
+		"hello_world_2": ExtensionInfo{
+			Platform: "windows",
+			Channel:  "edge",
+		},
+	}
+
+	extensions.FilterByHostPlatform("darwin")
+	require.Len(t, extensions, 0)
+
+	extensions = Extensions{
+		"hello_world_0": ExtensionInfo{
+			Platform: "macos",
+			Channel:  "stable",
+		},
+		"hello_world_1": ExtensionInfo{
+			Platform: "windows",
+			Channel:  "stable",
+		},
+		"hello_world_2": ExtensionInfo{
+			Platform: "linux",
+			Channel:  "stable",
+		},
+	}
+
+	extensions.FilterByHostPlatform("linux")
+	require.Len(t, extensions, 1)
+	require.Contains(t, extensions, "hello_world_2")
+}

server/service/orbit.go

@@ -172,12 +172,12 @@ func (svc *Service) GetOrbitConfig(ctx context.Context) (fleet.OrbitConfig, erro
 
 	host, ok := hostctx.FromContext(ctx)
 	if !ok {
-		return fleet.OrbitConfig{Notifications: notifs}, fleet.OrbitError{Message: "internal error: missing host from request context"}
+		return fleet.OrbitConfig{}, fleet.OrbitError{Message: "internal error: missing host from request context"}
 	}
 
 	appConfig, err := svc.ds.AppConfig(ctx)
 	if err != nil {
-		return fleet.OrbitConfig{Notifications: notifs}, err
+		return fleet.OrbitConfig{}, err
 	}
 
 	// set the host's orbit notifications for macOS MDM
@@ -201,7 +201,7 @@ func (svc *Service) GetOrbitConfig(ctx context.Context) (fleet.OrbitConfig, erro
 			// Since this is an user initiated action, we disable
 			// the flag when we deliver the notification to Orbit
 			if err := svc.ds.SetDiskEncryptionResetStatus(ctx, host.ID, false); err != nil {
-				return fleet.OrbitConfig{Notifications: notifs}, err
+				return fleet.OrbitConfig{}, err
 			}
 		}
 	}
@@ -211,7 +211,7 @@ func (svc *Service) GetOrbitConfig(ctx context.Context) (fleet.OrbitConfig, erro
 		if host.IsEligibleForWindowsMDMEnrollment() {
 			discoURL, err := microsoft_mdm.ResolveWindowsMDMDiscovery(appConfig.ServerSettings.ServerURL)
 			if err != nil {
-				return fleet.OrbitConfig{Notifications: notifs}, err
+				return fleet.OrbitConfig{}, err
 			}
 			notifs.WindowsMDMDiscoveryEndpoint = discoURL
 			notifs.NeedsProgrammaticWindowsMDMEnrollment = true
@@ -226,7 +226,7 @@ func (svc *Service) GetOrbitConfig(ctx context.Context) (fleet.OrbitConfig, erro
 	// load the pending script executions for that host
 	pending, err := svc.ds.ListPendingHostScriptExecutions(ctx, host.ID, pendingScriptMaxAge)
 	if err != nil {
-		return fleet.OrbitConfig{Notifications: notifs}, err
+		return fleet.OrbitConfig{}, err
 	}
 	if len(pending) > 0 {
 		execIDs := make([]string, 0, len(pending))
@@ -240,19 +240,24 @@ func (svc *Service) GetOrbitConfig(ctx context.Context) (fleet.OrbitConfig, erro
 	if host.TeamID != nil {
 		teamAgentOptions, err := svc.ds.TeamAgentOptions(ctx, *host.TeamID)
 		if err != nil {
-			return fleet.OrbitConfig{Notifications: notifs}, err
+			return fleet.OrbitConfig{}, err
 		}
 
 		var opts fleet.AgentOptions
 		if teamAgentOptions != nil && len(*teamAgentOptions) > 0 {
 			if err := json.Unmarshal(*teamAgentOptions, &opts); err != nil {
-				return fleet.OrbitConfig{Notifications: notifs}, err
+				return fleet.OrbitConfig{}, err
 			}
 		}
 
+		extensionsFiltered, err := filterExtensionsByPlatform(opts.Extensions, host.Platform)
+		if err != nil {
+			return fleet.OrbitConfig{}, err
+		}
+
 		mdmConfig, err := svc.ds.TeamMDMConfig(ctx, *host.TeamID)
 		if err != nil {
-			return fleet.OrbitConfig{Notifications: notifs}, err
+			return fleet.OrbitConfig{}, err
 		}
 
 		var nudgeConfig *fleet.NudgeConfig
@@ -261,13 +266,13 @@ func (svc *Service) GetOrbitConfig(ctx context.Context) (fleet.OrbitConfig, erro
 			mdmConfig.MacOSUpdates.EnabledForHost(host) {
 			nudgeConfig, err = fleet.NewNudgeConfig(mdmConfig.MacOSUpdates)
 			if err != nil {
-				return fleet.OrbitConfig{Notifications: notifs}, err
+				return fleet.OrbitConfig{}, err
 			}
 		}
 
 		return fleet.OrbitConfig{
 			Flags:         opts.CommandLineStartUpFlags,
-			Extensions:    opts.Extensions,
+			Extensions:    extensionsFiltered,
 			Notifications: notifs,
 			NudgeConfig:   nudgeConfig,
 		}, nil
@@ -277,27 +282,50 @@ func (svc *Service) GetOrbitConfig(ctx context.Context) (fleet.OrbitConfig, erro
 	var opts fleet.AgentOptions
 	if appConfig.AgentOptions != nil {
 		if err := json.Unmarshal(*appConfig.AgentOptions, &opts); err != nil {
-			return fleet.OrbitConfig{Notifications: notifs}, err
+			return fleet.OrbitConfig{}, err
 		}
 	}
 
+	extensionsFiltered, err := filterExtensionsByPlatform(opts.Extensions, host.Platform)
+	if err != nil {
+		return fleet.OrbitConfig{}, err
+	}
+
 	var nudgeConfig *fleet.NudgeConfig
 	if appConfig.MDM.EnabledAndConfigured &&
 		appConfig.MDM.MacOSUpdates.EnabledForHost(host) {
 		nudgeConfig, err = fleet.NewNudgeConfig(appConfig.MDM.MacOSUpdates)
 		if err != nil {
-			return fleet.OrbitConfig{Notifications: notifs}, err
+			return fleet.OrbitConfig{}, err
 		}
 	}
 
 	return fleet.OrbitConfig{
 		Flags:         opts.CommandLineStartUpFlags,
-		Extensions:    opts.Extensions,
+		Extensions:    extensionsFiltered,
 		Notifications: notifs,
 		NudgeConfig:   nudgeConfig,
 	}, nil
 }
 
+// filterExtensionsByPlatform filters a extensions configuration depending on the host platform.
+// (to not send extensions targeted to other operating systems).
+func filterExtensionsByPlatform(extensions json.RawMessage, hostPlatform string) (json.RawMessage, error) {
+	if len(extensions) == 0 {
+		return extensions, nil
+	}
+	var extensionsInfo fleet.Extensions
+	if err := json.Unmarshal(extensions, &extensionsInfo); err != nil {
+		return nil, err
+	}
+	extensionsInfo.FilterByHostPlatform(hostPlatform)
+	extensionsFiltered, err := json.Marshal(extensionsInfo)
+	if err != nil {
+		return nil, err
+	}
+	return extensionsFiltered, nil
+}
+
 /////////////////////////////////////////////////////////////////////////////////
 // Ping orbit endpoint
 /////////////////////////////////////////////////////////////////////////////////

tools/test_extensions/hello_world/build.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+
+mkdir -p $SCRIPT_DIR/macos $SCRIPT_DIR/windows $SCRIPT_DIR/linux
+GOOS=darwin GOARCH=amd64 go build -o $SCRIPT_DIR/macos/hello_world_macos.ext $SCRIPT_DIR
+GOOS=windows GOARCH=amd64 go build -o $SCRIPT_DIR/windows/hello_world_windows.ext.exe $SCRIPT_DIR
+GOOS=linux GOARCH=amd64 go build -o $SCRIPT_DIR/linux/hello_world_linux.ext $SCRIPT_DIR
+
+GOOS=darwin GOARCH=amd64 go build -ldflags '-X "main.extensionName=test_extensions.hello_mars" -X "main.tableName=hello_mars" -X "main.columnValue=mars"' -o $SCRIPT_DIR/macos/hello_mars_macos.ext $SCRIPT_DIR
+GOOS=windows GOARCH=amd64 go build -ldflags '-X "main.extensionName=test_extensions.hello_mars" -X "main.tableName=hello_mars" -X "main.columnValue=mars"' -o $SCRIPT_DIR/windows/hello_mars_windows.ext.exe $SCRIPT_DIR
+GOOS=linux GOARCH=amd64 go build -ldflags '-X "main.extensionName=test_extensions.hello_mars" -X "main.tableName=hello_mars" -X "main.columnValue=mars"' -o $SCRIPT_DIR/linux/hello_mars_linux.ext $SCRIPT_DIR

tools/test_extensions/hello_world/hello_world.go

@@ -0,0 +1,77 @@
+package main
+
+import (
+	"context"
+	"flag"
+	"fmt"
+	"log"
+	"os"
+	"time"
+
+	"github.com/cenkalti/backoff/v4"
+	"github.com/osquery/osquery-go"
+	"github.com/osquery/osquery-go/plugin/table"
+)
+
+var (
+	socket   = flag.String("socket", "", "Path to the extensions UNIX domain socket")
+	timeout  = flag.Int("timeout", 3, "Seconds to wait for autoloaded extensions")
+	interval = flag.Int("interval", 3, "Seconds delay between connectivity checks")
+	// verbose must be set because osqueryd will set it on the extension when running in verbose mode.
+	_ = flag.Bool("verbose", false, "Enable verbose informational messages")
+
+	extensionName = "test_extensions.hello_world"
+	tableName     = "hello_world"
+	columnName    = "hello"
+	columnValue   = "world"
+)
+
+func main() {
+	flag.Parse()
+
+	if *socket == "" {
+		log.Fatalf(`Usage: %s -socket SOCKET_PATH`, os.Args[0])
+	}
+
+	serverTimeout := osquery.ServerTimeout(
+		time.Second * time.Duration(*timeout),
+	)
+	serverPingInterval := osquery.ServerPingInterval(
+		time.Second * time.Duration(*interval),
+	)
+
+	var server *osquery.ExtensionManagerServer
+	backOff := backoff.WithMaxRetries(backoff.NewConstantBackOff(time.Millisecond*200), 25) // retry once per 200ms for 25 times == 5 seconds
+	op := func() error {
+		s, err := osquery.NewExtensionManagerServer(extensionName, *socket, serverTimeout, serverPingInterval)
+		if err != nil {
+			return fmt.Errorf("error creating extension: %w", err)
+		}
+		server = s
+		return nil
+	}
+
+	err := backoff.Retry(op, backOff)
+	if err != nil {
+		log.Fatalln(err)
+	}
+
+	server.RegisterPlugin(
+		table.NewPlugin(
+			tableName,
+			[]table.ColumnDefinition{
+				table.TextColumn(columnName),
+			},
+			func(ctx context.Context, queryContext table.QueryContext) ([]map[string]string, error) {
+				return []map[string]string{
+					{
+						columnName: columnValue,
+					},
+				}, nil
+			},
+		),
+	)
+	if err := server.Run(); err != nil {
+		log.Fatalln(err)
+	}
+}

tools/tuf/test/README.md

@@ -38,6 +38,20 @@ USE_FLEET_SERVER_CERTIFICATE=1 \
 
 > Separate `*_FLEET_URL` and `*_TUF_URL` variables are defined for each package type to support different setups.
 
+To publish test extensions you can set comma-separated executable paths in the `{MACOS|WINDOWS|LINUX}_TEST_EXTENSIONS` environment variables:
+Here's a sample to use the `hello_world` and `hello_mars` test extensions:
+```sh
+# Build `hello_word` and `hello_mars` test extensions.
+./tools/test_extensions/hello_world/build.sh
+
+[...]
+MACOS_TEST_EXTENSIONS="./tools/test_extensions/hello_world/macos/hello_world_macos.ext,./tools/test_extensions/hello_world/macos/hello_mars_macos.ext" \
+WINDOWS_TEST_EXTENSIONS="./tools/test_extensions/hello_world/windows/hello_world_windows.ext.exe,./tools/test_extensions/hello_world/windows/hello_mars_windows.ext.exe" \
+LINUX_TEST_EXTENSIONS="./tools/test_extensions/hello_world/linux/hello_world_linux.ext,./tools/test_extensions/hello_world/linux/hello_mars_linux.ext" \
+[...]
+./tools/tuf/test/main.sh
+```
+
 # Add new updates
 
 To add new updates (osqueryd or orbit), use `push_target.sh`.

tools/tuf/test/create_repository.sh

@@ -140,7 +140,7 @@ for system in $SYSTEMS; do
         rm fleet-desktop.exe
     fi
 
-    # Add Fleet Desktop application on  (if enabled).
+    # Add Fleet Desktop application on linux (if enabled).
     if [[ $system == "linux" && -n "$FLEET_DESKTOP" ]]; then
         FLEET_DESKTOP_VERSION=42.0.0 \
         make desktop-linux
@@ -152,4 +152,50 @@ for system in $SYSTEMS; do
         --version 42.0.0 -t 42.0 -t 42 -t stable
         rm desktop.tar.gz
     fi
+
+    # Add extensions on macos (if set).
+    if [[ $system == "macos" && -n "$MACOS_TEST_EXTENSIONS" ]]; then
+        for extension in ${MACOS_TEST_EXTENSIONS//,/ }
+        do
+            extensionName=$(basename $extension)
+            extensionName=$(echo "$extensionName" | cut -d'.' -f1)
+            ./build/fleetctl updates add \
+                --path $TUF_PATH \
+                --target $extension \
+                --platform macos \
+                --name "extensions/$extensionName" \
+                --version 42.0.0 -t 42.0 -t 42 -t stable
+        done
+    fi
+
+    # Add extensions on linux (if set).
+    if [[ $system == "linux" && -n "$LINUX_TEST_EXTENSIONS" ]]; then
+        for extension in ${LINUX_TEST_EXTENSIONS//,/ }
+        do
+            extensionName=$(basename $extension)
+            extensionName=$(echo "$extensionName" | cut -d'.' -f1)
+            ./build/fleetctl updates add \
+                --path $TUF_PATH \
+                --target $extension \
+                --platform linux \
+                --name "extensions/$extensionName" \
+                --version 42.0.0 -t 42.0 -t 42 -t stable
+        done
+    fi
+
+    # Add extensions on windows (if set).
+    if [[ $system == "windows" && -n "$WINDOWS_TEST_EXTENSIONS" ]]; then
+        for extension in ${WINDOWS_TEST_EXTENSIONS//,/ }
+        do
+            extensionName=$(basename $extension)
+            extensionName=$(echo "$extensionName" | cut -d'.' -f1)
+            echo "$FILE" | cut -d'.' -f2
+            ./build/fleetctl updates add \
+                --path $TUF_PATH \
+                --target $extension \
+                --platform windows \
+                --name "extensions/$extensionName" \
+                --version 42.0.0 -t 42.0 -t 42 -t stable
+        done
+    fi
 done