Support for FIPS compliance mode #14912

beanuwave · 2024-07-23T15:34:16Z

Description

FIPS gradle build script is removed.
All BC dependencies are replaces by BCFIPS.
Password matcher inside Identity-Shiro that replies on BC to check if hashed passwords matches with OpenBSDBCrypt, is replaced by password4j implementation.
Adds support for BCFKS format (*.bks) for Key & Truststores.
Refactor parsing private keys with formats EC, PKCS8, PKCS1, DSA, w/wo encryption, w/wo parameters.
FIPS approved-only mode can be configured over opensearch.yml file.
java security file is added to the build.
java policy file is altered to grant neccessary security permissions.

This PR provides FIPS 140-2 support by replacing all BC dependencies with BCFIPS dependencies and making FIPS approved-only mode configurable at launch. Running application in approved-only mode restricts BCFIPS provoder to rely solely on FIPS certified cyphers. Due to replacement of BC libraries, BCrypt password matching and private-key loading from file were replaced by alternative implementations.

Reasons for refactoring PemUtils.java that is used by Reindex API, in case of migrating data from a remote cluster that is TLS protected:

PKCS#8 implementation was not supported by BCFIPS library.
java type security.
Password Based Key Derivation Functions such as PKCS#12 and OpenSSL are not supported in BCFIPS approved-only mode, because only PBKDF2 standard is approved for use in FIPS.
generally good idea to let ASN1 annotation parsing be done by external security libraries.

Related Issues

opensearch-project/security#3420

Check List

Functionality includes testing.
API changes companion pull request created, if applicable.
Public documentation issue/PR created, if applicable.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

github-actions · 2024-07-23T15:41:17Z

❌ Gradle check result for 6016d5d: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

github-actions · 2024-07-24T08:51:58Z

❌ Gradle check result for 8e8ed47: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

github-actions · 2024-07-24T08:54:08Z

❌ Gradle check result for 6016d5d: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

.../identity-shiro/src/main/java/org/opensearch/identity/shiro/realm/BCryptPasswordMatcher.java

dblock · 2024-07-24T15:11:32Z

Could use some help maybe from @cwperks or @peternied reviewing this, please.

terryquigleysas · 2024-07-24T15:53:07Z

buildSrc/src/main/java/org/opensearch/gradle/testclusters/OpenSearchNode.java

@@ -1182,6 +1182,7 @@ private void createConfiguration() {
 baseConfig.put("indices.breaker.total.use_real_memory", "false");
 // Don't wait for state, just start up quickly. This will also allow new and old nodes in the BWC case to become the master
 baseConfig.put("discovery.initial_state_timeout", "0s");
+ baseConfig.put("fips.approved", "true");


When we proposed a similar flag previously we were encouraged not to use boolean flags to control behaviour like this opensearch-project/security#3420 (comment)

I am of the opinion that this is fine, in this case, I am not sure what greater configuration would make sense. Unless you can provide different approvers or something, there is no reason for this not to be a boolean.

I might have missed the part of the thread where that issue came up - I'd rather see crypto.standard=FIPS-140-2 & cypto.standard=any-supported to help understand what state the server is in when viewing a configuration file. I am definately open to other ideas that clarify what state the cluster is running it, as I think it could be useful to support FIPS-140-3 seperately or other standards/restrictions as they are addopted.

This isn't a blocker - it could be circled back on when we need to support a 3rd mode, the question is if that is a potential near term issue vs later on (or never).

github-actions · 2024-09-23T09:27:52Z

❌ Gradle check result for 7e202a2: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

github-actions · 2024-09-25T16:37:32Z

❌ Gradle check result for bbbafa9: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

beanuwave · 2024-09-26T16:09:50Z

Previously, my main focus was on running the entire test suite without the BC non-FIPS libraries, which was successfully achieved. Now, the latest changes affect FIPS compatibility by running all tests again with the additional VM parameter -Dtests.fips.enabled=true. This has resulted in several code modifications:

Introduced an additional test parameter: tests.fips.enabled.
Added support for the .bcfips keystore file format.
Keystores now require strict type matching.
Recreated some cryptographic keys, as they are no longer maintainable with newer versions of keytool and OpenSSL.
Keystores without a passphrase are no longer supported because BC FIPS requires passwords with at least 112 bits strength.

Currently, the AWS S3 plugin is the remaining component that needs adjustment for FIPS mode. However, applying FIPS mode to every security-relevant thread using CryptoServicesRegistrar#setApprovedOnlyMode seems unsustainable. Setting the VM parameter org.bouncycastle.fips.approved_only=true accomplishes the same goal for the entire application and eliminates the need for FIPS-specific code snippets in core classes like AbstractRunnable or ThreadContext.

Another topic to consider is how to extend the Jenkins pipeline to run tasks like gradle check in FIPS mode. Should we implement an additional downstream process that runs on every build, even if it might almost double the execution time? Or is a separate pipeline which runs at the higher stages and can be manually triggered the way to go?

beanuwave · 2024-09-30T10:15:54Z

@peternied Are we moving in the right direction?

peternied · 2024-10-01T19:33:24Z

@beanuwave Thanks for making these updates - I'll need a little time to digest them. While I do so could you please address all unresolved comment threads and look into the GitHub action failures?

modules/reindex/src/test/resources/org/opensearch/index/reindex/README.md

peternied

Directionally this is looking solid, I've got some background questions to make sure I understand some of the tradeoffs.

beanuwave · 2024-10-07T10:24:27Z

Directionally this is looking solid, I've got some background questions to make sure I understand some of the tradeoffs.

Definitely, can we set up a direct call? I've contacted you on slack to find a suitable timeslot.

peternied · 2024-10-07T17:25:34Z

Directionally this is looking solid, I've got some background questions to make sure I understand some of the tradeoffs.

Definitely, can we set up a direct call? I've contacted you on slack to find a suitable timeslot.

Sorry I might have been unclear, I've put those questions in comments on this PR, I don't need to schedule a call, please review the unresolved comment threads for the open questions I have, one for example #14912 (comment)

Signed-off-by: Iwan Igonin <[email protected]> # Conflicts: # server/build.gradle

Signed-off-by: Iwan Igonin <[email protected]> # Conflicts: # client/rest/build.gradle # distribution/tools/plugin-cli/build.gradle # server/src/main/resources/org/opensearch/bootstrap/test-framework.policy

Signed-off-by: Iwan Igonin <[email protected]>

…ional tests. Signed-off-by: Iwan Igonin <[email protected]>

Signed-off-by: Iwan Igonin <[email protected]>

peternied

This is looking much closer

There are still ~7 comment threads that are open, some of these might impact the scope of this change.
Looks like there are failures from the gradle-check workflow.

@beanuwave are there other items that you can see need to be invested in before this is merged? Trying to get a sense of how close we are to the finish line, thanks for the hard work!

Signed-off-by: Iwan Igonin <[email protected]>

github-actions · 2024-10-18T13:52:49Z

❌ Gradle check result for 8228037: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

beanuwave changed the title ~~Draft to allow run in FIPS compliace mode~~ Draft to allow run in FIPS compliance mode Jul 24, 2024

beanuwave force-pushed the fips_compliance2 branch from 8e8ed47 to 6016d5d Compare July 24, 2024 08:46

beanuwave marked this pull request as ready for review July 24, 2024 10:02

beanuwave requested review from peternied, anasalkouz, andrross, ashking94, Bukhtawar, CEHENKLE, dblock, dbwiddis, gbbafna, kotwanikunal, mch2, msfroh, nknize, owaiskazi19, reta, Rishikesh1159, sachinpkale, saratvemulapalli, shwetathareja, sohami and VachaShah as code owners July 24, 2024 10:02

dancristiancecoi reviewed Jul 24, 2024

View reviewed changes

.../identity-shiro/src/main/java/org/opensearch/identity/shiro/realm/BCryptPasswordMatcher.java Outdated Show resolved Hide resolved

terryquigleysas reviewed Jul 24, 2024

View reviewed changes

beanuwave force-pushed the fips_compliance2 branch from 8e5237f to 7e202a2 Compare September 23, 2024 09:15

beanuwave force-pushed the fips_compliance2 branch from 7e202a2 to bbbafa9 Compare September 25, 2024 16:09

beanuwave marked this pull request as ready for review September 26, 2024 16:10

beanuwave requested review from jainankitk and linuxpi as code owners September 26, 2024 16:10

peternied reviewed Oct 3, 2024

View reviewed changes

modules/reindex/src/test/resources/org/opensearch/index/reindex/README.md Outdated Show resolved Hide resolved

peternied reviewed Oct 3, 2024

View reviewed changes

kaimst mentioned this pull request Oct 7, 2024

[RFC] FIPS-140 Compliance Roadmap for OpenSearch opensearch-project/security#4254

Open

iigonin added 7 commits October 11, 2024 09:50

Draft to allow run in FIPS compliace mode

4eb8f22

Signed-off-by: Iwan Igonin <[email protected]> # Conflicts: # server/build.gradle

make tests run without BC (not BCFIPS) libraries.

54cea25

Signed-off-by: Iwan Igonin <[email protected]> # Conflicts: # client/rest/build.gradle # distribution/tools/plugin-cli/build.gradle # server/src/main/resources/org/opensearch/bootstrap/test-framework.policy

disable approved-only mode for launch configuration of testcluster

8081b1d

Signed-off-by: Iwan Igonin <[email protected]>

update all BC libraries to support JAVA 21

75b1cfe

Signed-off-by: Iwan Igonin <[email protected]>

try to pass bwc staged build by adding expected version

8655812

Signed-off-by: Iwan Igonin <[email protected]>

ensure FIPS-mode can be enabled by fixing existent and creating addit…

117f22a

…ional tests. Signed-off-by: Iwan Igonin <[email protected]>

fixing additional tests.

0054804

Signed-off-by: Iwan Igonin <[email protected]>

peternied reviewed Oct 15, 2024

View reviewed changes

Configure FIPS mode through global ENV VAR instead of thread-based.

8228037

Signed-off-by: Iwan Igonin <[email protected]>

beanuwave force-pushed the fips_compliance2 branch from bbbafa9 to 8228037 Compare October 18, 2024 12:56

opensearch-ci-bot mentioned this pull request Oct 18, 2024

[AUTOCUT] Gradle Check Flaky Test Report for DeleteSnapshotV2IT #15835

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support for FIPS compliance mode #14912

Support for FIPS compliance mode #14912

beanuwave commented Jul 23, 2024

github-actions bot commented Jul 23, 2024

github-actions bot commented Jul 24, 2024

github-actions bot commented Jul 24, 2024

dblock commented Jul 24, 2024

terryquigleysas Jul 24, 2024

stephen-crawford Jul 24, 2024

peternied Oct 3, 2024

github-actions bot commented Sep 23, 2024

github-actions bot commented Sep 25, 2024

beanuwave commented Sep 26, 2024

beanuwave commented Sep 30, 2024

peternied commented Oct 1, 2024

peternied left a comment

beanuwave commented Oct 7, 2024

peternied commented Oct 7, 2024

peternied left a comment

github-actions bot commented Oct 18, 2024

Support for FIPS compliance mode #14912

Are you sure you want to change the base?

Support for FIPS compliance mode #14912

Conversation

beanuwave commented Jul 23, 2024

Description

Related Issues

Check List

github-actions bot commented Jul 23, 2024

github-actions bot commented Jul 24, 2024

github-actions bot commented Jul 24, 2024

dblock commented Jul 24, 2024

terryquigleysas Jul 24, 2024

Choose a reason for hiding this comment

stephen-crawford Jul 24, 2024

Choose a reason for hiding this comment

peternied Oct 3, 2024

Choose a reason for hiding this comment

github-actions bot commented Sep 23, 2024

github-actions bot commented Sep 25, 2024

beanuwave commented Sep 26, 2024

beanuwave commented Sep 30, 2024

peternied commented Oct 1, 2024

peternied left a comment

Choose a reason for hiding this comment

beanuwave commented Oct 7, 2024

peternied commented Oct 7, 2024

peternied left a comment

Choose a reason for hiding this comment

github-actions bot commented Oct 18, 2024