Skip to content

[Filebeat] Allow v2 inputs to opt out of FIPS distributions#45036

Merged
ycombinator merged 6 commits intoelastic:mainfrom
ycombinator:fips-fb-inputs
Jun 25, 2025
Merged

[Filebeat] Allow v2 inputs to opt out of FIPS distributions#45036
ycombinator merged 6 commits intoelastic:mainfrom
ycombinator:fips-fb-inputs

Conversation

@ycombinator
Copy link
Copy Markdown
Contributor

@ycombinator ycombinator commented Jun 25, 2025 •
edited
Loading

Proposed commit message

This PR adds a new boolean field, ExcludeFromFIPS to the v2.Plugin struct for optional use by v2 inputs. Inputs that set this field to true are indicating that they should NOT be usable in FIPS-capable distributions of Filebeat. If an input that sets this field to true is configured in a FIPS-capable Filebeat distribution, Filebeat will exit with an error like so:

{"log.level":"error","@timestamp":"2025-06-25T11:22:14.686-0700","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/cmd/instance.handleError","file.name":"instance/beat.go","file.line":1355},"message":"Exiting: Failed to start crawler: starting input failed: error while initializing input: running a FIPS-capable distribution but input [o365audit] is not FIPS capable","service.name":"filebeat","ecs.version":"1.6.0"}
Exiting: Failed to start crawler: starting input failed: error while initializing input: running a FIPS-capable distribution but input [o365audit] is not FIPS capable

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works~
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Disruptive User Impact

None; the changes in this PR merely allow for Filebeat v2 inputs to be excluded from FIPS-capable Filebeat artifacts; there are no inputs actually being excluded in this PR.

How to test this PR locally

$ go test ./filebeat/input/v2/ -test.run TestLoader_ConfigureFIPS -test.count 1 -test.v
=== RUN   TestLoader_ConfigureFIPS
    loader_test.go:209: FIPS mode = false; err = <nil>
--- PASS: TestLoader_ConfigureFIPS (0.00s)
PASS
ok  	github.com/elastic/beats/v7/filebeat/input/v2	0.006s

In an environment configured for FIPS, i.e. with the Microsoft Go fork installed and with the OpenSSL FIPS provider installed:

$ GOEXPERIMENT=systemcrypto go test -tags requirefips ./filebeat/input/v2/ -test.run TestLoader_ConfigureFIPS -test.count 1 -test.v
=== RUN   TestLoader_ConfigureFIPS
    loader_test.go:209: FIPS mode = true; err = running a FIPS-capable distribution but input [a] is not FIPS capable
--- PASS: TestLoader_ConfigureFIPS (0.00s)
PASS
ok  	github.com/elastic/beats/v7/filebeat/input/v2	0.014s

Related issues

This PR replaces the implementation done in #44920

@ycombinator ycombinator requested a review from a team as a code owner June 25, 2025 18:32
@ycombinator ycombinator added release-note:skip The PR should be ignored when processing the changelog Team:Elastic-Agent-Data-Plane Label for the Agent Data Plane team >enhancement backport-8.19 Automated backport to the 8.19 branch labels Jun 25, 2025
@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Jun 25, 2025
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Jun 25, 2025

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

@botelastic botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Jun 25, 2025
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Jun 25, 2025

🤖 GitHub comments

Expand to view the GitHub comments

Just comment with:

  • run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

This was referenced Jun 25, 2025
Merged
Merged
belimawr
belimawr approved these changes Jun 25, 2025
View reviewed changes
@ycombinator ycombinator enabled auto-merge (squash) June 25, 2025 20:10
@ycombinator ycombinator merged commit 9d79db0 into elastic:main Jun 25, 2025
202 checks passed
mergify bot pushed a commit that referenced this pull request Jun 25, 2025
@ycombinator @mergify
[Filebeat] Allow v2 inputs to opt out of FIPS distributions (#45036)
7a8a8f2 
* Add constant for FIPS mode

* Add ability for v2 inputs to opt out of FIPS distributions

* Return error in FIPS mode if input wants to opt-out of FIPS distributions

* Fixing typo

* Adding missing license header

* Running mage fmt

(cherry picked from commit 9d79db0)
@mergify mergify bot mentioned this pull request Jun 25, 2025
Merged
6 tasks
@ycombinator ycombinator deleted the fips-fb-inputs branch June 25, 2025 20:52
This was referenced Jun 25, 2025
Merged
Merged
@mergify mergify bot mentioned this pull request Jun 25, 2025
Merged
6 tasks
@mergify mergify bot mentioned this pull request Jun 25, 2025
Merged
6 tasks
ycombinator added a commit that referenced this pull request Jun 25, 2025
@mergify @ycombinator
[Filebeat] Allow v2 inputs to opt out of FIPS distributions (#45036) (#…
1eec383 
…45039)

* Add constant for FIPS mode

* Add ability for v2 inputs to opt out of FIPS distributions

* Return error in FIPS mode if input wants to opt-out of FIPS distributions

* Fixing typo

* Adding missing license header

* Running mage fmt

(cherry picked from commit 9d79db0)

Co-authored-by: Shaunak Kashyap <ycombinator@gmail.com>
@ycombinator ycombinator mentioned this pull request Jun 26, 2025
Merged
6 tasks
@mergify mergify bot mentioned this pull request Jun 26, 2025
Merged
6 tasks
@ycombinator ycombinator added the backport-9.1 Automated backport to the 9.1 branch label Jun 28, 2025
@mergify mergify bot mentioned this pull request Jun 28, 2025
Merged
6 tasks
@ycombinator
Copy link
Copy Markdown
Contributor Author

ycombinator commented Jun 28, 2025

@Mergifyio backport 9.1

@mergify
Copy link
Copy Markdown
Contributor

mergify bot commented Jun 28, 2025 •
edited
Loading

backport 9.1

✅ Backports have been created

Details
  • Backport to branch 9.1 not needed, change already in branch 9.1

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@belimawr belimawr belimawr approved these changes

@leehinman leehinman leehinman approved these changes

Assignees

@ycombinator ycombinator

Labels

backport-8.19 Automated backport to the 8.19 branch backport-9.1 Automated backport to the 9.1 branch >enhancement release-note:skip The PR should be ignored when processing the changelog Team:Elastic-Agent-Data-Plane Label for the Agent Data Plane team

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@ycombinator @elasticmachine @belimawr @leehinman