Skip to content

Support keystore tests on FIPS JVM#66846

Merged
tvernum merged 2 commits intoelastic:masterfrom
tvernum:fips/keystore-tests-password-len
Dec 30, 2020
Merged

Support keystore tests on FIPS JVM#66846
tvernum merged 2 commits intoelastic:masterfrom
tvernum:fips/keystore-tests-password-len

Conversation

@tvernum
Copy link
Copy Markdown
Contributor

@tvernum tvernum commented Dec 29, 2020

As of #64024 we run FIPS CI on a true, FIPS approved only mode JVM.
This mandates that any passwords that are fed into PBKDF2 must have at
least 112 bits of entropy (that is, be 14 characters long).

This commit updates our Keystore CLI tests so that tests either:

  1. Use a 14+ character password when in FIPS mode, or
  2. Are skipped on FIPS mode (because they explicitly test empty
    passwords)

Resolves: #66845

As of elastic#64024 we run FIPS CI on a true, FIPS approved only mode JVM.
This mandates that any passwords that are fed into PBKDF2 must have at
least 112 bits of entropy (that is, be 14 characters long).

This commit updates our Keystore CLI tests so that tests either:
1. Use a 14+ character password when in FIPS mode, _or_
2. Are skipped on FIPS mode (because they explicitly test empty
   passwords)

Resolves: elastic#66845
@tvernum tvernum added >test Issues or PRs that are addressing/adding tests v8.0.0 v7.12.0 v7.11.1 :Security/FIPS Running ES in FIPS 140-2 mode labels Dec 29, 2020
@elasticmachine elasticmachine added the Team:Security Meta label for security team label Dec 29, 2020
@elasticmachine
Copy link
Copy Markdown
Collaborator

Pinging @elastic/es-security (Team:Security)

String password = randomFrom("", "keystorepassword");
terminal.addSecretInput(password);
terminal.addSecretInput(password);
execute();
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This actually never tested with the password, because it didn't pass --password on the command line.

When testing with an incorrect password, make sure it is longer than
the original password so that we trigger "incorrect password"
behaviour rather than "password too short" behaviour.
Copy link
Copy Markdown
Contributor

@BigPandaToo BigPandaToo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I left one comment. LGTM otherwise. Feel free to merge after addressing it.

terminal.addSecretInput("the-better-password");
terminal.addSecretInput("the-better-password");
// Prompted thrice: Once for the existing and twice for the new password
execute();
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we need to execute(randomFrom("-p", "--password")) here as well?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, it's calling the ChangeKeyStorePasswordCommand (elasticsearch-keystore passwd) which doesn 't have a "--password" option (because it always deals with passwords).

}

public void testDefaultNotPromptForPassword() throws Exception {
assumeFalse("Cannot open unprotected keystore on FIPS JVM", inFipsJvm());
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ideally, when not firefighting, I think we should assert the behavior from the FIPS JVM in circumstances such as this one. For regular JVMs, the tests assert all kinds of behaviors, but since some are skipped in the FIPS JVM we condone unspecified behavior.
@jkakavas Is #65464 supposed to handle some/all cases like this one?

Granted, this assumes the FIPS provider implementation (different ones might fail differently), and maybe the JVMs as well. I see this as an argument for more clearly specifying and documenting the FIPS environments we test (and support).

Should I open a separate GH issue regarding negative testing in the FIPS JVM?

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is not covered in 65454. We can add tests for certain cases with assumeTrue in fips mode, but only for ones we can anticipate the behavior, i.e. short passwords. As you say its tricky.

I see this as an argument for more clearly specifying and documenting the FIPS environments we test (and support).

Agreed, there is an ongoing separate discussion around this

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If there are specific cases in this PR where it feels like we're skipping a test for something that should work on FIPS, then definitely point it out because I tried hard to resolve all of those (which increased coverage on non-FIPS as well, since there were scenarios that we never tested with a password).

However, in this case, this is simply something that is not supported on FIPS. The test is that we don't prompt for a password if there isn't one, and that's not a valid scenario to test of FIPS. We simply cannot read a keystore without a password.
I could write a test to check that unprotected keystores fail on FIPS, except that's not really a requirement per se, it's just a consequence of the JVM being in FIPS mode.

One could make an argument that we should have a test testThatReadingUnprotectedKeystoreInFipsModeFailsWithUsefulMessageAndDoesntCorruptKeystore (maybe a shorter test name) but it's probably not a super high priority.

@tvernum tvernum merged commit f05da6b into elastic:master Dec 30, 2020
tvernum added a commit to tvernum/elasticsearch that referenced this pull request Dec 31, 2020
As of elastic#64024 we run FIPS CI on a true, FIPS approved only mode JVM.
This mandates that any passwords that are fed into PBKDF2 must have at
least 112 bits of entropy (that is, be 14 characters long).

This commit updates our Keystore CLI tests so that tests either:
1. Use a 14+ character password when in FIPS mode, _or_
2. Are skipped on FIPS mode (because they explicitly test empty
   passwords)

Backport of: elastic#66846
@ywangd
Copy link
Copy Markdown
Member

ywangd commented Jan 4, 2021

The failures no longer exist since this PR is merged. I am going to merge the pending backport to 7.x and also backport it to 7.11.

ywangd pushed a commit that referenced this pull request Jan 4, 2021
As of #64024 we run FIPS CI on a true, FIPS approved only mode JVM.
This mandates that any passwords that are fed into PBKDF2 must have at
least 112 bits of entropy (that is, be 14 characters long).

This commit updates our Keystore CLI tests so that tests either:
1. Use a 14+ character password when in FIPS mode, _or_
2. Are skipped on FIPS mode (because they explicitly test empty
   passwords)

Backport of: #66846
ywangd pushed a commit to ywangd/elasticsearch that referenced this pull request Jan 4, 2021
As of elastic#64024 we run FIPS CI on a true, FIPS approved only mode JVM.
This mandates that any passwords that are fed into PBKDF2 must have at
least 112 bits of entropy (that is, be 14 characters long).

This commit updates our Keystore CLI tests so that tests either:
1. Use a 14+ character password when in FIPS mode, _or_
2. Are skipped on FIPS mode (because they explicitly test empty
   passwords)

Backport of: elastic#66846
ywangd added a commit that referenced this pull request Jan 4, 2021
As of #64024 we run FIPS CI on a true, FIPS approved only mode JVM.
This mandates that any passwords that are fed into PBKDF2 must have at
least 112 bits of entropy (that is, be 14 characters long).

This commit updates our Keystore CLI tests so that tests either:
1. Use a 14+ character password when in FIPS mode, _or_
2. Are skipped on FIPS mode (because they explicitly test empty
   passwords)

Backport of: #66846

Co-authored-by: Tim Vernum <tim.vernum@elastic.co>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

:Security/FIPS Running ES in FIPS 140-2 mode Team:Security Meta label for security team >test Issues or PRs that are addressing/adding tests v7.11.1 v7.12.0 v8.0.0-alpha1

Projects

None yet

Development

Successfully merging this pull request may close these issues.

distribution:tools:keystore-cli failures in fips mode

7 participants