mirror of
https://github.com/netbirdio/netbird.git
synced 2026-09-20 21:59:07 +02:00
117 lines
4.2 KiB
Go
117 lines
4.2 KiB
Go
//go:build windows
|
|
|
|
package mdm
|
|
|
|
import (
|
|
"errors"
|
|
"fmt"
|
|
"strings"
|
|
|
|
log "github.com/sirupsen/logrus"
|
|
"golang.org/x/sys/windows/registry"
|
|
)
|
|
|
|
// policyRegistryPath is the well-known MDM policy registry key for NetBird.
|
|
// Admins push values here through Group Policy, Intune ADMX ingestion, an
|
|
// Intune custom Registry CSP profile, or `reg add` during MSI deployment.
|
|
// Listed in the project's docs/mdm/netbird.admx schema.
|
|
const policyRegistryPath = `Software\Policies\NetBird`
|
|
|
|
// readRegistryValue reads a single value under policyRegistryPath and,
|
|
// on success, stores the type-coerced result in out[canonical]. Type
|
|
// coercion mirrors loadPlatformPolicy's documented mapping:
|
|
// - REG_SZ / REG_EXPAND_SZ -> string (REG_EXPAND_SZ is expanded by the API)
|
|
// - REG_DWORD / REG_QWORD -> int64
|
|
// - REG_MULTI_SZ -> []string
|
|
//
|
|
// Unsupported value types and per-value read failures are logged at
|
|
// warn level and skipped — one malformed value must not block the
|
|
// surrounding loop. Extracted from loadPlatformPolicy to keep that
|
|
// function's cognitive complexity in check.
|
|
func readRegistryValue(k registry.Key, name, canonical string, out map[string]any) {
|
|
_, valType, err := k.GetValue(name, nil)
|
|
if err != nil {
|
|
log.Warnf("MDM stat %s\\%s: %v", policyRegistryPath, name, err)
|
|
return
|
|
}
|
|
switch valType {
|
|
case registry.SZ, registry.EXPAND_SZ:
|
|
if v, _, err := k.GetStringValue(name); err == nil {
|
|
out[canonical] = v
|
|
} else {
|
|
log.Warnf("MDM read string %s\\%s: %v", policyRegistryPath, name, err)
|
|
}
|
|
case registry.DWORD, registry.QWORD:
|
|
if v, _, err := k.GetIntegerValue(name); err == nil {
|
|
// uint64 from the registry API; Policy.GetBool / GetInt
|
|
// helpers consume int64, so narrow safely.
|
|
out[canonical] = int64(v)
|
|
} else {
|
|
log.Warnf("MDM read int %s\\%s: %v", policyRegistryPath, name, err)
|
|
}
|
|
case registry.MULTI_SZ:
|
|
if v, _, err := k.GetStringsValue(name); err == nil {
|
|
out[canonical] = v
|
|
} else {
|
|
log.Warnf("MDM read multi-string %s\\%s: %v", policyRegistryPath, name, err)
|
|
}
|
|
default:
|
|
log.Warnf("MDM ignoring unsupported registry value type %d at %s\\%s",
|
|
valType, policyRegistryPath, name)
|
|
}
|
|
}
|
|
|
|
// loadPlatform reads the MDM-managed configuration from the Windows
|
|
// registry under HKLM\Software\Policies\NetBird. The Loader's fetcher
|
|
// field is unused on this platform — the registry is the
|
|
// authoritative source. Returns:
|
|
// - (nil, nil) when the key is absent (device not MDM-enrolled for NetBird)
|
|
// - (map, nil) with N entries when N managed values are set (N may be 0)
|
|
// - (nil, err) on open / enumerate registry errors
|
|
//
|
|
// Per-value type coercion + skip-on-error is delegated to
|
|
// readRegistryValue. Unknown value names are logged and skipped so a
|
|
// malformed deployment does not block startup.
|
|
func (l *Loader) loadPlatform() (map[string]any, error) {
|
|
// Honour the injected fetcher when present so tests (and any
|
|
// future non-Windows MDM channel) can short-circuit the registry
|
|
// read with a scripted policy.
|
|
if l != nil && l.fetcher != nil {
|
|
return l.fetcher.Fetch(), nil
|
|
}
|
|
k, err := registry.OpenKey(registry.LOCAL_MACHINE, policyRegistryPath, registry.QUERY_VALUE)
|
|
if err != nil {
|
|
if errors.Is(err, registry.ErrNotExist) {
|
|
// Not enrolled. Caller treats nil as "no MDM source present".
|
|
//nolint:nilnil // (nil, nil) is the documented platform-absent sentinel; see LoadPolicy.
|
|
return nil, nil
|
|
}
|
|
return nil, fmt.Errorf("open %s: %w", policyRegistryPath, err)
|
|
}
|
|
defer func() {
|
|
if closeErr := k.Close(); closeErr != nil {
|
|
log.Warnf("MDM close registry key %s: %v", policyRegistryPath, closeErr)
|
|
}
|
|
}()
|
|
|
|
names, err := k.ReadValueNames(-1)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("enumerate values of %s: %w", policyRegistryPath, err)
|
|
}
|
|
|
|
out := make(map[string]any, len(names))
|
|
for _, name := range names {
|
|
// Canonicalize the registry value name against the known MDM key
|
|
// set so Policy.HasKey lookups (which use the canonical names)
|
|
// succeed regardless of the casing used by the admin's ADMX or
|
|
// `reg add` command.
|
|
canonical, known := canonicalKey[strings.ToLower(name)]
|
|
if !known {
|
|
log.Warnf("MDM ignoring unknown registry value %s\\%s", policyRegistryPath, name)
|
|
continue
|
|
}
|
|
readRegistryValue(k, name, canonical, out)
|
|
}
|
|
return out, nil
|
|
}
|