Skip to content

Commit 45babbf

Browse files
dmathieurockdaboot
dmathieu
and
rockdaboot
authored
Run ci with fips check (#1691)
* run ci with fips check * disable custom certificate path in fips mode * prevent disabling certificate verification in fips mode * fix goimports * remove fips disabled checks from non-fips tests * Update Makefile Co-authored-by: Tim Rühsen <[email protected]> * Revert "Update Makefile" This reverts commit e585f00. * Update Makefile Co-authored-by: Tim Rühsen <[email protected]> --------- Co-authored-by: Tim Rühsen <[email protected]>
1 parent c9f2257 commit 45babbf

File tree

7 files changed

+384
-244
lines changed

7 files changed

+384
-244
lines changed

‎.github/workflows/ci.yml

+15
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,21 @@ jobs:
5151
- name: Unit tests
5252
run: make test
5353

54+
test-fips:
55+
runs-on: ubuntu-latest
56+
timeout-minutes: 30
57+
steps:
58+
- uses: actions/checkout@v4
59+
- uses: actions/setup-go@v5
60+
with:
61+
# TODO switch to go.mod once we update to 1.24+
62+
go-version: 1.24
63+
cache: true
64+
- env:
65+
GOFIPS140: "latest"
66+
GODEBUG: "fips141=only"
67+
run: make test-fips
68+
5469
check-update-modules:
5570
runs-on: ubuntu-latest
5671
timeout-minutes: 30

‎Makefile

+4-2
Original file line numberDiff line numberDiff line change
@@ -36,9 +36,11 @@ check-vet:
3636
docker-test:
3737
scripts/docker-compose-testing run -T --rm go-agent-tests make test
3838

39-
.PHONY: test
39+
.PHONY: test-fips test
40+
test-fips: ARGS=-tags=requirefips
41+
test-fips: test
4042
test:
41-
@for dir in $(shell scripts/moduledirs.sh); do (cd $$dir && go test -race -v -timeout=$(TEST_TIMEOUT) ./...) || exit $$?; done
43+
@for dir in $(shell scripts/moduledirs.sh); do (cd "$$dir" && go test -race -v -timeout=$(TEST_TIMEOUT) $(ARGS) ./...) || exit $$?; done
4244

4345
.PHONY: coverage
4446
coverage:

‎transport/crypto.go

+97
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
// Licensed to Elasticsearch B.V. under one or more contributor
2+
// license agreements. See the NOTICE file distributed with
3+
// this work for additional information regarding copyright
4+
// ownership. Elasticsearch B.V. licenses this file to you under
5+
// the Apache License, Version 2.0 (the "License"); you may
6+
// not use this file except in compliance with the License.
7+
// You may obtain a copy of the License at
8+
//
9+
// http://www.apache.org/licenses/LICENSE-2.0
10+
//
11+
// Unless required by applicable law or agreed to in writing,
12+
// software distributed under the License is distributed on an
13+
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
14+
// KIND, either express or implied. See the License for the
15+
// specific language governing permissions and limitations
16+
// under the License.
17+
18+
//go:build !requirefips
19+
20+
package transport // import "go.elastic.co/apm/v2/transport"
21+
22+
import (
23+
"crypto/tls"
24+
"crypto/x509"
25+
"encoding/pem"
26+
"fmt"
27+
"os"
28+
29+
"github.com/pkg/errors"
30+
31+
"go.elastic.co/apm/v2/internal/configutil"
32+
)
33+
34+
const envVerifyServerCert = "ELASTIC_APM_VERIFY_SERVER_CERT"
35+
36+
func checkVerifyServerCert() (bool, error) {
37+
return configutil.ParseBoolEnv(envVerifyServerCert, true)
38+
}
39+
40+
func addCertPath(tlsClientConfig *tls.Config) error {
41+
if serverCertPath := os.Getenv(envServerCert); serverCertPath != "" {
42+
serverCert, err := loadCertificate(serverCertPath)
43+
if err != nil {
44+
return errors.Wrapf(err, "failed to load certificate from %s", serverCertPath)
45+
}
46+
// Disable standard verification, we'll check that the
47+
// server supplies the exact certificate provided.
48+
tlsClientConfig.InsecureSkipVerify = true
49+
tlsClientConfig.VerifyPeerCertificate = func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {
50+
return verifyPeerCertificate(rawCerts, serverCert)
51+
}
52+
}
53+
if serverCACertPath := os.Getenv(envServerCACert); serverCACertPath != "" {
54+
rootCAs := x509.NewCertPool()
55+
additionalCerts, err := os.ReadFile(serverCACertPath)
56+
if err != nil {
57+
return errors.Wrapf(err, "failed to load root CA file from %s", serverCACertPath)
58+
}
59+
if !rootCAs.AppendCertsFromPEM(additionalCerts) {
60+
return fmt.Errorf("failed to load CA certs from %s", serverCACertPath)
61+
}
62+
tlsClientConfig.RootCAs = rootCAs
63+
}
64+
65+
return nil
66+
}
67+
68+
func loadCertificate(path string) (*x509.Certificate, error) {
69+
pemBytes, err := os.ReadFile(path)
70+
if err != nil {
71+
return nil, err
72+
}
73+
for {
74+
var certBlock *pem.Block
75+
certBlock, pemBytes = pem.Decode(pemBytes)
76+
if certBlock == nil {
77+
return nil, errors.New("missing or invalid certificate")
78+
}
79+
if certBlock.Type == "CERTIFICATE" {
80+
return x509.ParseCertificate(certBlock.Bytes)
81+
}
82+
}
83+
}
84+
85+
func verifyPeerCertificate(rawCerts [][]byte, trusted *x509.Certificate) error {
86+
if len(rawCerts) == 0 {
87+
return errors.New("missing leaf certificate")
88+
}
89+
cert, err := x509.ParseCertificate(rawCerts[0])
90+
if err != nil {
91+
return errors.Wrap(err, "failed to parse certificate from server")
92+
}
93+
if !cert.Equal(trusted) {
94+
return errors.New("failed to verify server certificate")
95+
}
96+
return nil
97+
}

‎transport/crypto_fips.go

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
// Licensed to Elasticsearch B.V. under one or more contributor
2+
// license agreements. See the NOTICE file distributed with
3+
// this work for additional information regarding copyright
4+
// ownership. Elasticsearch B.V. licenses this file to you under
5+
// the Apache License, Version 2.0 (the "License"); you may
6+
// not use this file except in compliance with the License.
7+
// You may obtain a copy of the License at
8+
//
9+
// http://www.apache.org/licenses/LICENSE-2.0
10+
//
11+
// Unless required by applicable law or agreed to in writing,
12+
// software distributed under the License is distributed on an
13+
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
14+
// KIND, either express or implied. See the License for the
15+
// specific language governing permissions and limitations
16+
// under the License.
17+
18+
//go:build requirefips
19+
20+
package transport // import "go.elastic.co/apm/v2/transport"
21+
22+
import "crypto/tls"
23+
24+
func checkVerifyServerCert() (bool, error) {
25+
return true, nil
26+
}
27+
28+
func addCertPath(tlsClientConfig *tls.Config) error {
29+
return nil
30+
}

‎transport/crypto_test.go

+216
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,216 @@
1+
// Licensed to Elasticsearch B.V. under one or more contributor
2+
// license agreements. See the NOTICE file distributed with
3+
// this work for additional information regarding copyright
4+
// ownership. Elasticsearch B.V. licenses this file to you under
5+
// the Apache License, Version 2.0 (the "License"); you may
6+
// not use this file except in compliance with the License.
7+
// You may obtain a copy of the License at
8+
//
9+
// http://www.apache.org/licenses/LICENSE-2.0
10+
//
11+
// Unless required by applicable law or agreed to in writing,
12+
// software distributed under the License is distributed on an
13+
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
14+
// KIND, either express or implied. See the License for the
15+
// specific language governing permissions and limitations
16+
// under the License.
17+
18+
//go:build !requirefips
19+
20+
package transport_test
21+
22+
import (
23+
"context"
24+
"encoding/pem"
25+
"fmt"
26+
"io/ioutil"
27+
"log"
28+
"net/http"
29+
"net/http/httptest"
30+
"os"
31+
"strings"
32+
"testing"
33+
34+
"github.com/stretchr/testify/assert"
35+
"github.com/stretchr/testify/require"
36+
37+
"go.elastic.co/apm/v2/transport"
38+
)
39+
40+
func TestHTTPTransportEnvVerifyServerCert(t *testing.T) {
41+
var h recordingHandler
42+
server := httptest.NewTLSServer(&h)
43+
defer server.Close()
44+
defer patchEnv("ELASTIC_APM_SERVER_URL", server.URL)()
45+
defer patchEnv("ELASTIC_APM_VERIFY_SERVER_CERT", "false")()
46+
47+
transport, err := transport.NewHTTPTransport(transport.HTTPTransportOptions{})
48+
assert.NoError(t, err)
49+
50+
assert.NotNil(t, transport.Client)
51+
assert.IsType(t, &http.Transport{}, transport.Client.Transport)
52+
httpTransport := transport.Client.Transport.(*http.Transport)
53+
assert.NotNil(t, httpTransport.TLSClientConfig)
54+
assert.True(t, httpTransport.TLSClientConfig.InsecureSkipVerify)
55+
56+
err = transport.SendStream(context.Background(), strings.NewReader(""))
57+
assert.NoError(t, err)
58+
}
59+
60+
func TestHTTPTransportServerFailover(t *testing.T) {
61+
defer patchEnv("ELASTIC_APM_VERIFY_SERVER_CERT", "false")()
62+
63+
var hosts []string
64+
errorHandler := http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
65+
hosts = append(hosts, req.Host)
66+
http.Error(w, "error-message", http.StatusInternalServerError)
67+
})
68+
server1 := httptest.NewServer(errorHandler)
69+
defer server1.Close()
70+
server2 := httptest.NewTLSServer(errorHandler)
71+
defer server2.Close()
72+
73+
transport, err := transport.NewHTTPTransport(transport.HTTPTransportOptions{})
74+
require.NoError(t, err)
75+
err = transport.SetServerURL(mustParseURL(server1.URL), mustParseURL(server2.URL))
76+
require.NoError(t, err)
77+
78+
for i := 0; i < 4; i++ {
79+
err := transport.SendStream(context.Background(), strings.NewReader(""))
80+
assert.EqualError(t, err, "request failed with 500 Internal Server Error: error-message")
81+
}
82+
assert.Len(t, hosts, 4)
83+
84+
// Each time SendStream returns an error, the transport should switch
85+
// to the next URL in the list. The list is shuffled so we only compare
86+
// the output values to each other, rather than to the original input.
87+
assert.NotEqual(t, hosts[0], hosts[1])
88+
assert.Equal(t, hosts[0], hosts[2])
89+
assert.Equal(t, hosts[1], hosts[3])
90+
}
91+
92+
func TestHTTPTransportServerCert(t *testing.T) {
93+
var h recordingHandler
94+
server := httptest.NewUnstartedServer(&h)
95+
server.Config.ErrorLog = log.New(ioutil.Discard, "", 0)
96+
server.StartTLS()
97+
defer server.Close()
98+
defer patchEnv("ELASTIC_APM_SERVER_URL", server.URL)()
99+
100+
p := strings.NewReader("")
101+
102+
newTransport := func() *transport.HTTPTransport {
103+
transport, err := transport.NewHTTPTransport(transport.HTTPTransportOptions{})
104+
require.NoError(t, err)
105+
return transport
106+
}
107+
108+
// SendStream should fail, because we haven't told the client about
109+
// the server certificate, nor disabled certificate verification.
110+
transport := newTransport()
111+
err := transport.SendStream(context.Background(), p)
112+
assert.Error(t, err)
113+
114+
// Set a certificate that doesn't match, SendStream should still fail.
115+
defer patchEnv("ELASTIC_APM_SERVER_CERT", "./testdata/cert.pem")()
116+
transport = newTransport()
117+
err = transport.SendStream(context.Background(), p)
118+
assert.Error(t, err)
119+
120+
f, err := ioutil.TempFile("", "apm-test")
121+
require.NoError(t, err)
122+
defer os.Remove(f.Name())
123+
defer f.Close()
124+
defer patchEnv("ELASTIC_APM_SERVER_CERT", f.Name())()
125+
126+
// Reconfigure the transport so that it knows about the
127+
// server certificate. We avoid using server.Client here, as
128+
// it is not available in older versions of Go.
129+
err = pem.Encode(f, &pem.Block{
130+
Type: "CERTIFICATE",
131+
Bytes: server.TLS.Certificates[0].Certificate[0],
132+
})
133+
require.NoError(t, err)
134+
135+
transport = newTransport()
136+
err = transport.SendStream(context.Background(), p)
137+
assert.NoError(t, err)
138+
}
139+
140+
func TestHTTPTransportServerCertInvalid(t *testing.T) {
141+
f, err := ioutil.TempFile("", "apm-test")
142+
require.NoError(t, err)
143+
defer os.Remove(f.Name())
144+
defer f.Close()
145+
defer patchEnv("ELASTIC_APM_SERVER_CERT", f.Name())()
146+
147+
fmt.Fprintln(f, `
148+
-----BEGIN GARBAGE-----
149+
garbage
150+
-----END GARBAGE-----
151+
`[1:])
152+
153+
_, err = transport.NewHTTPTransport(transport.HTTPTransportOptions{})
154+
assert.EqualError(t, err, fmt.Sprintf("failed to load certificate from %s: missing or invalid certificate", f.Name()))
155+
}
156+
157+
func TestHTTPTransportCACert(t *testing.T) {
158+
var h recordingHandler
159+
server := httptest.NewUnstartedServer(&h)
160+
server.Config.ErrorLog = log.New(ioutil.Discard, "", 0)
161+
server.StartTLS()
162+
defer server.Close()
163+
defer patchEnv("ELASTIC_APM_SERVER_URL", server.URL)()
164+
165+
p := strings.NewReader("")
166+
167+
// SendStream should fail, because we haven't told the client about
168+
// the server certificate, nor disabled certificate verification.
169+
trans, err := transport.NewHTTPTransport(transport.HTTPTransportOptions{})
170+
assert.NoError(t, err)
171+
assert.NotNil(t, trans)
172+
err = trans.SendStream(context.Background(), p)
173+
assert.Error(t, err)
174+
175+
// Set the env var to a file that doesn't exist, should get an error
176+
defer patchEnv("ELASTIC_APM_SERVER_CA_CERT_FILE", "./testdata/file_that_doesnt_exist.pem")()
177+
trans, err = transport.NewHTTPTransport(transport.HTTPTransportOptions{})
178+
assert.Error(t, err)
179+
assert.Nil(t, trans)
180+
181+
// Set the env var to a file that has no cert, should get an error
182+
f, err := ioutil.TempFile("", "apm-test-1")
183+
require.NoError(t, err)
184+
defer os.Remove(f.Name())
185+
defer f.Close()
186+
defer patchEnv("ELASTIC_APM_SERVER_CA_CERT_FILE", f.Name())()
187+
trans, err = transport.NewHTTPTransport(transport.HTTPTransportOptions{})
188+
assert.Error(t, err)
189+
assert.Nil(t, trans)
190+
191+
// Set a certificate that doesn't match, SendStream should still fail
192+
defer patchEnv("ELASTIC_APM_SERVER_CA_CERT_FILE", "./testdata/cert.pem")()
193+
trans, err = transport.NewHTTPTransport(transport.HTTPTransportOptions{})
194+
assert.NoError(t, err)
195+
assert.NotNil(t, trans)
196+
err = trans.SendStream(context.Background(), p)
197+
assert.Error(t, err)
198+
199+
f, err = ioutil.TempFile("", "apm-test-2")
200+
require.NoError(t, err)
201+
defer os.Remove(f.Name())
202+
defer f.Close()
203+
defer patchEnv("ELASTIC_APM_SERVER_CA_CERT_FILE", f.Name())()
204+
205+
err = pem.Encode(f, &pem.Block{
206+
Type: "CERTIFICATE",
207+
Bytes: server.TLS.Certificates[0].Certificate[0],
208+
})
209+
require.NoError(t, err)
210+
211+
trans, err = transport.NewHTTPTransport(transport.HTTPTransportOptions{})
212+
assert.NoError(t, err)
213+
assert.NotNil(t, trans)
214+
err = trans.SendStream(context.Background(), p)
215+
assert.NoError(t, err)
216+
}

0 commit comments

Comments
 (0)