Skip to content

[8.19](backport #44902) [Filebeat] Do not run azure-eventhub input and azure module in FIPS builds#45041

Merged
ycombinator merged 1 commit into8.19from
mergify/bp/8.19/pr-44902
Jun 26, 2025
Merged

[8.19](backport #44902) [Filebeat] Do not run azure-eventhub input and azure module in FIPS builds#45041
ycombinator merged 1 commit into8.19from
mergify/bp/8.19/pr-44902

Conversation

@mergify
Copy link
Copy Markdown
Contributor

@mergify mergify bot commented Jun 25, 2025

Proposed commit message

This PR ensures that the Filebeat azure-eventhub input will not start in FIPS-capable distributions of Filebeat, as the input indirectly depends on code that is not FIPS-compliant. Specifically, the azure-eventhub input depends on the github.com/Azure/azure-sdk-for-go/sdk/azidentity package. This package, in turn, depends on the golang.org/x/crypto/pkcs12 package, which is not FIPS-compliant. Further, the SDK doesn't plan to offer a way to disable the use of this package at compile time (see Azure/azure-sdk-for-go#24336).

In addition to the azure-eventhub input, the azure module will also not start in FIPS-capable distributions of Filebeat, as this module uses the azure-eventhub input.

Attempting to run a FIPS-capable distribution of Filebeat with either the azure-eventhub input or the azure module configured will result in Filebeat not starting up and an error in the Filebeat logs like so:

{"log.level":"info","@timestamp":"2025-06-25T14:19:46.212-0700","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/cmd/instance.(*Beat).launch","file.name":"instance/beat.go","file.line":542},"message":"filebeat stopped.","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2025-06-25T14:19:46.212-0700","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/cmd/instance.handleError","file.name":"instance/beat.go","file.line":1355},"message":"Exiting: Failed to start crawler: starting input failed: error while initializing input: running a FIPS-capable distribution but input [azure-eventhub] is not FIPS capable","service.name":"filebeat","ecs.version":"1.6.0"}
Exiting: Failed to start crawler: starting input failed: error while initializing input: running a FIPS-capable distribution but input [azure-eventhub] is not FIPS capable

The o365audit input declares itself as not being FIPS-capable by setting the ExcludeFromFIPS field on the v2.Plugin struct to true (see also: #45036).

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Disruptive User Impact

FIPS-capable artifacts of Filebeat will not start the azure module or the azure-eventhub input.

$ mage clean && FIPS=true mage build
$ cat <<EOF > filebeat-test-input.yml
filebeat.inputs:
- type: azure-eventhub
  id: id-nofips
  enabled: true
  eventhub: foo
  connection_string: bar
  storage_account: baz
  storage_account_key: qux

output.console:
  enabled: true
EOF
$ ./filebeat -c ./filebeat-test-input.yml -e
$ cat <<EOF > filebeat-test-module.yml
filebeat.modules:
- module: azure
  activitylogs:
    enabled: true
    var.connection_string: foo
    var.storage_account: bar
    var.storage_account_key: baz

output.console:
  enabled: true
EOF
$ ./filebeat -c ./filebeat-test-module.yml -e
```<hr>This is an automatic backport of pull request #44902 done by [Mergify](https://mergify.com).

@mergify mergify bot added the backport label Jun 25, 2025
@mergify mergify bot requested a review from a team as a code owner June 25, 2025 23:11
@mergify mergify bot added the backport label Jun 25, 2025
@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Jun 25, 2025
@github-actions github-actions bot added Team:obs-ds-hosted-services Label for the Observability Hosted Services team Team:Elastic-Agent-Data-Plane Label for the Agent Data Plane team labels Jun 25, 2025
@elasticmachine
Copy link
Copy Markdown
Contributor

Pinging @elastic/obs-ds-hosted-services (Team:obs-ds-hosted-services)

@elasticmachine
Copy link
Copy Markdown
Contributor

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

@botelastic botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Jun 25, 2025
…PS builds (#44902)

* Add doc about module availability

* Make azure-eventhub input use FIPSAwareInput interface

* Reimplement

* Fix typo

(cherry picked from commit 2019007)
@ycombinator ycombinator force-pushed the mergify/bp/8.19/pr-44902 branch from 0b0189c to 353ed35 Compare June 26, 2025 00:32
@ycombinator ycombinator enabled auto-merge (squash) June 26, 2025 00:33
@ycombinator ycombinator merged commit b850448 into 8.19 Jun 26, 2025
31 of 32 checks passed
@ycombinator ycombinator deleted the mergify/bp/8.19/pr-44902 branch June 26, 2025 02:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport Team:Elastic-Agent-Data-Plane Label for the Agent Data Plane team Team:obs-ds-hosted-services Label for the Observability Hosted Services team

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants