Introduce fips_mode setting and associated checks (#32326)

* Introduce fips_mode setting and associated checks

Introduce xpack.security.fips_mode.enabled setting ( default false)
When it is set to true, a number of Bootstrap checks are performed:
- Check that Secure Settings are of the latest version (3)
- Check that no JKS keystores are configured
- Check that compliant algorithms ( PBKDF2 family ) are used for
  password hashing

server/src/main/java/org/elasticsearch/common/settings/KeyStoreWrapper.java

@@ -166,6 +166,13 @@ private KeyStoreWrapper(int formatVersion, boolean hasPassword, byte[] dataBytes
         this.dataBytes = dataBytes;
     }
 
+    /**
+     * Get the metadata format version for the keystore
+     **/
+    public int getFormatVersion() {
+        return formatVersion;
+    }
+
     /** Returns a path representing the ES keystore in the given config dir. */
     public static Path keystorePath(Path configDir) {
         return configDir.resolve(KEYSTORE_FILENAME);
@@ -593,8 +600,10 @@ private void ensureOpen() {
     @Override
     public synchronized void close() {
         this.closed = true;
-        for (Entry entry : entries.get().values()) {
-            Arrays.fill(entry.bytes, (byte)0);
+        if (null != entries.get() && entries.get().isEmpty() == false) {
+            for (Entry entry : entries.get().values()) {
+                Arrays.fill(entry.bytes, (byte) 0);
+            }
         }
     }
 }

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/FIPS140JKSKeystoreBootstrapCheck.java

@@ -0,0 +1,54 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+package org.elasticsearch.xpack.security;
+
+import org.elasticsearch.bootstrap.BootstrapCheck;
+import org.elasticsearch.bootstrap.BootstrapContext;
+import org.elasticsearch.common.settings.Settings;
+
+
+public class FIPS140JKSKeystoreBootstrapCheck implements BootstrapCheck {
+
+    private final boolean fipsModeEnabled;
+
+    FIPS140JKSKeystoreBootstrapCheck(Settings settings) {
+        this.fipsModeEnabled = Security.FIPS_MODE_ENABLED.get(settings);
+    }
+
+    /**
+     * Test if the node fails the check.
+     *
+     * @param context the bootstrap context
+     * @return the result of the bootstrap check
+     */
+    @Override
+    public BootstrapCheckResult check(BootstrapContext context) {
+
+        if (fipsModeEnabled) {
+            final Settings settings = context.settings;
+            Settings keystoreTypeSettings = settings.filter(k -> k.endsWith("keystore.type"))
+                .filter(k -> settings.get(k).equalsIgnoreCase("jks"));
+            if (keystoreTypeSettings.isEmpty() == false) {
+                return BootstrapCheckResult.failure("JKS Keystores cannot be used in a FIPS 140 compliant JVM. Please " +
+                    "revisit [" + keystoreTypeSettings.toDelimitedString(',') + "] settings");
+            }
+            // Default Keystore type is JKS if not explicitly set
+            Settings keystorePathSettings = settings.filter(k -> k.endsWith("keystore.path"))
+                .filter(k -> settings.hasValue(k.replace(".path", ".type")) == false);
+            if (keystorePathSettings.isEmpty() == false) {
+                return BootstrapCheckResult.failure("JKS Keystores cannot be used in a FIPS 140 compliant JVM. Please " +
+                    "revisit [" + keystorePathSettings.toDelimitedString(',') + "] settings");
+            }
+
+        }
+        return BootstrapCheckResult.success();
+    }
+
+    @Override
+    public boolean alwaysEnforce() {
+        return fipsModeEnabled;
+    }
+}

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/FIPS140PasswordHashingAlgorithmBootstrapCheck.java

@@ -0,0 +1,43 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+package org.elasticsearch.xpack.security;
+
+import org.elasticsearch.bootstrap.BootstrapCheck;
+import org.elasticsearch.bootstrap.BootstrapContext;
+import org.elasticsearch.common.settings.Settings;
+import org.elasticsearch.xpack.core.XPackSettings;
+
+import java.util.Locale;
+
+public class FIPS140PasswordHashingAlgorithmBootstrapCheck implements BootstrapCheck {
+
+    private final boolean fipsModeEnabled;
+
+    FIPS140PasswordHashingAlgorithmBootstrapCheck(Settings settings) {
+        this.fipsModeEnabled = Security.FIPS_MODE_ENABLED.get(settings);
+    }
+
+    /**
+     * Test if the node fails the check.
+     *
+     * @param context the bootstrap context
+     * @return the result of the bootstrap check
+     */
+    @Override
+    public BootstrapCheckResult check(BootstrapContext context) {
+        final String selectedAlgorithm = XPackSettings.PASSWORD_HASHING_ALGORITHM.get(context.settings);
+        if (selectedAlgorithm.toLowerCase(Locale.ROOT).startsWith("pbkdf2") == false) {
+            return BootstrapCheckResult.failure("Only PBKDF2 is allowed for password hashing in a FIPS-140 JVM. Please set the " +
+                "appropriate value for [ " + XPackSettings.PASSWORD_HASHING_ALGORITHM.getKey() + " ] setting.");
+        }
+        return BootstrapCheckResult.success();
+    }
+
+    @Override
+    public boolean alwaysEnforce() {
+        return fipsModeEnabled;
+    }
+}

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/FIPS140SecureSettingsBootstrapCheck.java

@@ -0,0 +1,52 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+package org.elasticsearch.xpack.security;
+
+import org.elasticsearch.bootstrap.BootstrapCheck;
+import org.elasticsearch.bootstrap.BootstrapContext;
+import org.elasticsearch.common.settings.KeyStoreWrapper;
+import org.elasticsearch.common.settings.Settings;
+import org.elasticsearch.env.Environment;
+
+import java.io.IOException;
+import java.io.UncheckedIOException;
+
+public class FIPS140SecureSettingsBootstrapCheck implements BootstrapCheck {
+
+    private final boolean fipsModeEnabled;
+    private final Environment environment;
+
+    FIPS140SecureSettingsBootstrapCheck(Settings settings, Environment environment) {
+        this.fipsModeEnabled = Security.FIPS_MODE_ENABLED.get(settings);
+        this.environment = environment;
+    }
+
+    /**
+     * Test if the node fails the check.
+     *
+     * @param context the bootstrap context
+     * @return the result of the bootstrap check
+     */
+    @Override
+    public BootstrapCheckResult check(BootstrapContext context) {
+        if (fipsModeEnabled) {
+            try (KeyStoreWrapper secureSettings = KeyStoreWrapper.load(environment.configFile())) {
+                if (secureSettings != null && secureSettings.getFormatVersion() < 3) {
+                    return BootstrapCheckResult.failure("Secure settings store is not of the latest version. Please use " +
+                        "bin/elasticsearch-keystore create to generate a new secure settings store and migrate the secure settings there.");
+                }
+            } catch (IOException e) {
+                throw new UncheckedIOException(e);
+            }
+        }
+        return BootstrapCheckResult.success();
+    }
+
+    @Override
+    public boolean alwaysEnforce() {
+        return fipsModeEnabled;
+    }
+}

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/Security.java

@@ -256,6 +256,8 @@ public class Security extends Plugin implements ActionPlugin, IngestPlugin, Netw
         ExtensiblePlugin {
 
     private static final Logger logger = Loggers.getLogger(Security.class);
+    static final Setting<Boolean> FIPS_MODE_ENABLED =
+        Setting.boolSetting("xpack.security.fips_mode.enabled", false, Property.NodeScope);
 
     public static final String NAME4 = XPackField.SECURITY + "4";
     public static final Setting<Optional<String>> USER_SETTING =
@@ -311,6 +313,9 @@ public Security(Settings settings, final Path configPath) {
                 new PkiRealmBootstrapCheck(getSslService()),
                 new TLSLicenseBootstrapCheck(),
                 new PasswordHashingAlgorithmBootstrapCheck(),
+                new FIPS140SecureSettingsBootstrapCheck(settings, env),
+                new FIPS140JKSKeystoreBootstrapCheck(settings),
+                new FIPS140PasswordHashingAlgorithmBootstrapCheck(settings),
                 new KerberosRealmBootstrapCheck(env)));
             checks.addAll(InternalRealms.getBootstrapChecks(settings, env));
             this.bootstrapChecks = Collections.unmodifiableList(checks);
@@ -613,6 +618,7 @@ public static List<Setting<?>> getSettings(boolean transportClientMode, List<Sec
         }
 
         // The following just apply in node mode
+        settingsList.add(FIPS_MODE_ENABLED);
 
         // IP Filter settings
         IPFilter.addSettings(settingsList);

x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/FIPS140JKSKeystoreBootstrapCheckTests.java

@@ -0,0 +1,66 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+package org.elasticsearch.xpack.security;
+
+import org.elasticsearch.bootstrap.BootstrapContext;
+import org.elasticsearch.common.settings.Settings;
+import org.elasticsearch.test.ESTestCase;
+
+public class FIPS140JKSKeystoreBootstrapCheckTests extends ESTestCase {
+
+    public void testNoKeystoreIsAllowed() {
+        final Settings.Builder settings = Settings.builder()
+            .put("xpack.security.fips_mode.enabled", "true");
+        assertFalse(new FIPS140JKSKeystoreBootstrapCheck(settings.build()).check(new BootstrapContext(settings.build(), null)).isFailure());
+    }
+
+    public void testSSLKeystoreTypeIsNotAllowed() {
+        final Settings.Builder settings = Settings.builder()
+            .put("xpack.security.fips_mode.enabled", "true")
+            .put("xpack.ssl.keystore.path", "/this/is/the/path")
+            .put("xpack.ssl.keystore.type", "JKS");
+        assertTrue(new FIPS140JKSKeystoreBootstrapCheck(settings.build()).check(new BootstrapContext(settings.build(), null)).isFailure());
+    }
+
+    public void testSSLImplicitKeystoreTypeIsNotAllowed() {
+        final Settings.Builder settings = Settings.builder()
+            .put("xpack.security.fips_mode.enabled", "true")
+            .put("xpack.ssl.keystore.path", "/this/is/the/path")
+            .put("xpack.ssl.keystore.type", "JKS");
+        assertTrue(new FIPS140JKSKeystoreBootstrapCheck(settings.build()).check(new BootstrapContext(settings.build(), null)).isFailure());
+    }
+
+    public void testTransportSSLKeystoreTypeIsNotAllowed() {
+        final Settings.Builder settings = Settings.builder()
+            .put("xpack.security.fips_mode.enabled", "true")
+            .put("xpack.security.transport.ssl.keystore.path", "/this/is/the/path")
+            .put("xpack.security.transport.ssl.keystore.type", "JKS");
+        assertTrue(new FIPS140JKSKeystoreBootstrapCheck(settings.build()).check(new BootstrapContext(settings.build(), null)).isFailure());
+    }
+
+    public void testHttpSSLKeystoreTypeIsNotAllowed() {
+        final Settings.Builder settings = Settings.builder()
+            .put("xpack.security.fips_mode.enabled", "true")
+            .put("xpack.security.http.ssl.keystore.path", "/this/is/the/path")
+            .put("xpack.security.http.ssl.keystore.type", "JKS");
+        assertTrue(new FIPS140JKSKeystoreBootstrapCheck(settings.build()).check(new BootstrapContext(settings.build(), null)).isFailure());
+    }
+
+    public void testRealmKeystoreTypeIsNotAllowed() {
+        final Settings.Builder settings = Settings.builder()
+            .put("xpack.security.fips_mode.enabled", "true")
+            .put("xpack.security.authc.realms.ldap.ssl.keystore.path", "/this/is/the/path")
+            .put("xpack.security.authc.realms.ldap.ssl.keystore.type", "JKS");
+        assertTrue(new FIPS140JKSKeystoreBootstrapCheck(settings.build()).check(new BootstrapContext(settings.build(), null)).isFailure());
+    }
+
+    public void testImplicitRealmKeystoreTypeIsNotAllowed() {
+        final Settings.Builder settings = Settings.builder()
+            .put("xpack.security.fips_mode.enabled", "true")
+            .put("xpack.security.authc.realms.ldap.ssl.keystore.path", "/this/is/the/path");
+        assertTrue(new FIPS140JKSKeystoreBootstrapCheck(settings.build()).check(new BootstrapContext(settings.build(), null)).isFailure());
+    }
+}

x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/FIPS140PasswordHashingAlgorithmBootstrapCheckTests.java

@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+package org.elasticsearch.xpack.security;
+
+import org.elasticsearch.bootstrap.BootstrapContext;
+import org.elasticsearch.common.settings.Settings;
+import org.elasticsearch.test.ESTestCase;
+import org.elasticsearch.xpack.core.XPackSettings;
+
+public class FIPS140PasswordHashingAlgorithmBootstrapCheckTests extends ESTestCase {
+
+    public void testPBKDF2AlgorithmIsAllowed() {
+        Settings settings = Settings.builder().put("xpack.security.fips_mode.enabled", "true").build();
+
+        settings = Settings.builder().put(XPackSettings.PASSWORD_HASHING_ALGORITHM.getKey(), "PBKDF2_10000").build();
+        assertFalse(new FIPS140PasswordHashingAlgorithmBootstrapCheck(settings).check(new BootstrapContext(settings, null)).isFailure());
+
+        settings = Settings.builder().put(XPackSettings.PASSWORD_HASHING_ALGORITHM.getKey(), "PBKDF2").build();
+        assertFalse(new FIPS140PasswordHashingAlgorithmBootstrapCheck(settings).check(new BootstrapContext(settings, null)).isFailure());
+    }
+
+    public void testBCRYPTAlgorithmIsNotAllowed() {
+        Settings settings = Settings.builder().put("xpack.security.fips_mode.enabled", "true").build();
+        assertTrue(new FIPS140PasswordHashingAlgorithmBootstrapCheck(settings).check(new BootstrapContext(settings, null)).isFailure());
+        settings = Settings.builder().put(XPackSettings.PASSWORD_HASHING_ALGORITHM.getKey(), "BCRYPT").build();
+        assertTrue(new FIPS140PasswordHashingAlgorithmBootstrapCheck(settings).check(new BootstrapContext(settings, null)).isFailure());
+
+        settings = Settings.builder().put(XPackSettings.PASSWORD_HASHING_ALGORITHM.getKey(), "BCRYPT11").build();
+        assertTrue(new FIPS140PasswordHashingAlgorithmBootstrapCheck(settings).check(new BootstrapContext(settings, null)).isFailure());
+    }
+}