Add license check for FIPS

src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker

@@ -386,6 +386,7 @@ kibana_vars=(
     xpack.security.authc.selector.enabled
     xpack.security.cookieName
     xpack.security.encryptionKey
+    xpack.security.fipsMode.enabled
     xpack.security.loginAssistanceMessage
     xpack.security.loginHelp
     xpack.security.sameSiteCookies

x-pack/packages/security/plugin_types_common/src/licensing/license.ts

@@ -13,6 +13,7 @@ import type { SecurityLicenseFeatures } from './license_features';
 
 export interface SecurityLicense {
   isLicenseAvailable(): boolean;
+  getLicenseType(): string | undefined;
   getUnavailableReason: () => string | undefined;
   isEnabled(): boolean;
   getFeatures(): SecurityLicenseFeatures;

x-pack/packages/security/plugin_types_common/src/licensing/license_features.ts

@@ -78,4 +78,10 @@ export interface SecurityLicenseFeatures {
    * Describes the layout of the login form if it's displayed.
    */
   readonly layout?: LoginLayout;
+
+  /**
+   * Indicates whether we allow FIPS mode
+   */
+
+  readonly allowFips: boolean;
 }

x-pack/plugins/security/common/licensing/index.mock.ts

@@ -14,12 +14,33 @@ import type { SecurityLicense, SecurityLicenseFeatures } from '@kbn/security-plu
 export const licenseMock = {
   create: (
     features: Partial<SecurityLicenseFeatures> | Observable<Partial<SecurityLicenseFeatures>> = {},
-    licenseType: LicenseType = 'basic' // default to basic if this is not specified
+    licenseType: LicenseType = 'basic', // default to basic if this is not specified,
+    isAvailable: Observable<boolean> = of(true)
   ): jest.Mocked<SecurityLicense> => ({
-    isLicenseAvailable: jest.fn().mockReturnValue(true),
+    isLicenseAvailable: jest.fn().mockImplementation(() => {
+      let result = true;
+
+      isAvailable.subscribe((next) => {
+        result = next;
+      });
+
+      return result;
+    }),
+    getLicenseType: jest.fn().mockReturnValue(licenseType),
     getUnavailableReason: jest.fn(),
     isEnabled: jest.fn().mockReturnValue(true),
-    getFeatures: jest.fn().mockReturnValue(features),
+    getFeatures:
+      features instanceof Observable
+        ? jest.fn().mockImplementation(() => {
+            let subbedFeatures: Partial<SecurityLicenseFeatures> = {};
+
+            features.subscribe((next) => {
+              subbedFeatures = next;
+            });
+
+            return subbedFeatures;
+          })
+        : jest.fn().mockReturnValue(features),
     hasAtLeast: jest
       .fn()
       .mockImplementation(

x-pack/plugins/security/common/licensing/license_service.test.ts

@@ -31,6 +31,7 @@ describe('license features', function () {
       allowSubFeaturePrivileges: false,
       allowAuditLogging: false,
       allowUserProfileCollaboration: false,
+      allowFips: false,
     });
   });
 
@@ -55,6 +56,7 @@ describe('license features', function () {
       allowSubFeaturePrivileges: false,
       allowAuditLogging: false,
       allowUserProfileCollaboration: false,
+      allowFips: false,
     });
   });
 
@@ -76,6 +78,7 @@ describe('license features', function () {
           Object {
             "allowAccessAgreement": false,
             "allowAuditLogging": false,
+            "allowFips": false,
             "allowLogin": false,
             "allowRbac": false,
             "allowRoleDocumentLevelSecurity": false,
@@ -99,6 +102,7 @@ describe('license features', function () {
           Object {
             "allowAccessAgreement": true,
             "allowAuditLogging": true,
+            "allowFips": true,
             "allowLogin": true,
             "allowRbac": true,
             "allowRoleDocumentLevelSecurity": true,
@@ -141,6 +145,7 @@ describe('license features', function () {
       allowSubFeaturePrivileges: false,
       allowAuditLogging: false,
       allowUserProfileCollaboration: false,
+      allowFips: false,
     });
     expect(getFeatureSpy).toHaveBeenCalledTimes(1);
     expect(getFeatureSpy).toHaveBeenCalledWith('security');
@@ -168,6 +173,7 @@ describe('license features', function () {
       allowSubFeaturePrivileges: false,
       allowAuditLogging: false,
       allowUserProfileCollaboration: false,
+      allowFips: false,
     });
   });
 
@@ -194,6 +200,7 @@ describe('license features', function () {
       allowSubFeaturePrivileges: false,
       allowAuditLogging: false,
       allowUserProfileCollaboration: true,
+      allowFips: false,
     });
   });
 
@@ -220,6 +227,7 @@ describe('license features', function () {
       allowSubFeaturePrivileges: true,
       allowAuditLogging: true,
       allowUserProfileCollaboration: true,
+      allowFips: false,
     });
   });
 
@@ -246,6 +254,7 @@ describe('license features', function () {
       allowSubFeaturePrivileges: true,
       allowAuditLogging: true,
       allowUserProfileCollaboration: true,
+      allowFips: true,
     });
   });
 });

x-pack/plugins/security/common/licensing/license_service.ts

@@ -28,6 +28,8 @@ export class SecurityLicenseService {
       license: Object.freeze({
         isLicenseAvailable: () => rawLicense?.isAvailable ?? false,
 
+        getLicenseType: () => rawLicense?.type ?? undefined,
+
         getUnavailableReason: () => rawLicense?.getUnavailableReason(),
 
         isEnabled: () => this.isSecurityEnabledFromRawLicense(rawLicense),
@@ -80,6 +82,7 @@ export class SecurityLicenseService {
         allowRbac: false,
         allowSubFeaturePrivileges: false,
         allowUserProfileCollaboration: false,
+        allowFips: false,
         layout:
           rawLicense !== undefined && !rawLicense?.isAvailable
             ? 'error-xpack-unavailable'
@@ -101,6 +104,7 @@ export class SecurityLicenseService {
         allowRbac: false,
         allowSubFeaturePrivileges: false,
         allowUserProfileCollaboration: false,
+        allowFips: false,
       };
     }
 
@@ -121,6 +125,7 @@ export class SecurityLicenseService {
       allowRoleRemoteIndexPrivileges: isLicensePlatinumOrBetter,
       allowRbac: true,
       allowUserProfileCollaboration: isLicenseStandardOrBetter,
+      allowFips: isLicensePlatinumOrBetter,
     };
   }
 }

x-pack/plugins/security/public/plugin.test.tsx

@@ -43,6 +43,7 @@ describe('Security Plugin', () => {
         authz: { isRoleManagementEnabled: expect.any(Function) },
         license: {
           isLicenseAvailable: expect.any(Function),
+          getLicenseType: expect.any(Function),
           isEnabled: expect.any(Function),
           getUnavailableReason: expect.any(Function),
           getFeatures: expect.any(Function),
@@ -71,6 +72,7 @@ describe('Security Plugin', () => {
         authc: { getCurrentUser: expect.any(Function), areAPIKeysEnabled: expect.any(Function) },
         license: {
           isLicenseAvailable: expect.any(Function),
+          getLicenseType: expect.any(Function),
           isEnabled: expect.any(Function),
           getUnavailableReason: expect.any(Function),
           getFeatures: expect.any(Function),

x-pack/plugins/security/server/config.test.ts

@@ -5,9 +5,13 @@
  * 2.0.
  */
 
+const mockGetFipsFn = jest.fn();
 jest.mock('crypto', () => ({
   randomBytes: jest.fn(),
   constants: jest.requireActual('crypto').constants,
+  get getFips() {
+    return mockGetFipsFn;
+  },
 }));
 
 jest.mock('@kbn/utils', () => ({
@@ -61,6 +65,9 @@ describe('config schema', () => {
         },
         "cookieName": "sid",
         "encryptionKey": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+        "fipsMode": Object {
+          "enabled": false,
+        },
         "loginAssistanceMessage": "",
         "public": Object {},
         "secureCookies": false,
@@ -115,6 +122,9 @@ describe('config schema', () => {
         },
         "cookieName": "sid",
         "encryptionKey": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+        "fipsMode": Object {
+          "enabled": false,
+        },
         "loginAssistanceMessage": "",
         "public": Object {},
         "secureCookies": false,
@@ -168,6 +178,9 @@ describe('config schema', () => {
           "selector": Object {},
         },
         "cookieName": "sid",
+        "fipsMode": Object {
+          "enabled": false,
+        },
         "loginAssistanceMessage": "",
         "public": Object {},
         "secureCookies": false,
@@ -224,6 +237,9 @@ describe('config schema', () => {
           "selector": Object {},
         },
         "cookieName": "sid",
+        "fipsMode": Object {
+          "enabled": false,
+        },
         "loginAssistanceMessage": "",
         "public": Object {},
         "roleManagementEnabled": false,
@@ -2446,3 +2462,84 @@ describe('createConfig()', () => {
     });
   });
 });
+
+describe('checkFipsConfig', () => {
+  let mockExit: jest.SpyInstance;
+  beforeAll(() => {
+    mockExit = jest.spyOn(process, 'exit').mockImplementation((exitCode) => {
+      throw new Error(`Fake Exit: ${exitCode}`);
+    });
+  });
+
+  afterAll(() => {
+    mockExit.mockRestore();
+  });
+
+  it('should log an error message if FIPS mode is misconfigured - xpack.security.fipsMode.enabled true, Nodejs FIPS mode false', async () => {
+    const logger = loggingSystemMock.create().get();
+
+    try {
+      createConfig(ConfigSchema.validate({ fipsMode: { enabled: true } }), logger, {
+        isTLSEnabled: true,
+      });
+    } catch (e) {
+      expect(mockExit).toHaveBeenNthCalledWith(1, 78);
+    }
+
+    expect(loggingSystemMock.collect(logger).error).toMatchInlineSnapshot(`
+                        Array [
+                          Array [
+                            "Configuration mismatch error. xpack.security.fipsMode.enabled is set to true and the configured Node.js environment has FIPS disabled",
+                          ],
+                        ]
+                `);
+  });
+
+  it('should log an error message if FIPS mode is misconfigured - xpack.security.fipsMode.enabled false, Nodejs FIPS mode true', async () => {
+    mockGetFipsFn.mockImplementationOnce(() => {
+      return 1;
+    });
+
+    const logger = loggingSystemMock.create().get();
+
+    try {
+      createConfig(ConfigSchema.validate({ fipsMode: { enabled: false } }), logger, {
+        isTLSEnabled: true,
+      });
+    } catch (e) {
+      expect(mockExit).toHaveBeenNthCalledWith(1, 78);
+    }
+
+    expect(loggingSystemMock.collect(logger).error).toMatchInlineSnapshot(`
+                        Array [
+                          Array [
+                            "Configuration mismatch error. xpack.security.fipsMode.enabled is set to false and the configured Node.js environment has FIPS enabled",
+                          ],
+                        ]
+                `);
+  });
+
+  it('should log an info message if FIPS mode is properly configured - xpack.security.fipsMode.enabled true, Nodejs FIPS mode true', async () => {
+    mockGetFipsFn.mockImplementationOnce(() => {
+      return 1;
+    });
+
+    const logger = loggingSystemMock.create().get();
+
+    try {
+      createConfig(ConfigSchema.validate({ fipsMode: { enabled: true } }), logger, {
+        isTLSEnabled: true,
+      });
+    } catch (e) {
+      logger.error('Should not throw error!');
+    }
+
+    expect(loggingSystemMock.collect(logger).info).toMatchInlineSnapshot(`
+                        Array [
+                          Array [
+                            "Kibana is running in FIPS mode.",
+                          ],
+                        ]
+                `);
+  });
+});

x-pack/plugins/security/server/config.ts

@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import crypto from 'crypto';
+import crypto, { getFips } from 'crypto';
 import type { Duration } from 'moment';
 import path from 'path';
 
@@ -313,13 +313,38 @@ export const ConfigSchema = schema.object({
       roleMappingManagementEnabled: schema.boolean({ defaultValue: true }),
     }),
   }),
+  fipsMode: schema.object({
+    enabled: schema.boolean({ defaultValue: false }),
+  }),
 });
 
+function checkFipsConfig(config: RawConfigType, logger: Logger) {
+  const isFipsEnabled = config.fipsMode.enabled;
+  const isNodeRunningWithFipsEnabled = getFips() === 1;
+
+  // Check if FIPS is enabled in either setting
+  if (isFipsEnabled || isNodeRunningWithFipsEnabled) {
+    // FIPS must be enabled on both or log and error an exit Kibana
+    if (isFipsEnabled !== isNodeRunningWithFipsEnabled) {
+      logger.error(
+        `Configuration mismatch error. xpack.security.fipsMode.enabled is set to ${isFipsEnabled} and the configured Node.js environment has FIPS ${
+          isNodeRunningWithFipsEnabled ? 'enabled' : 'disabled'
+        }`
+      );
+      process.exit(78);
+    } else {
+      logger.info('Kibana is running in FIPS mode.');
+    }
+  }
+}
+
 export function createConfig(
   config: RawConfigType,
   logger: Logger,
   { isTLSEnabled }: { isTLSEnabled: boolean }
 ) {
+  checkFipsConfig(config, logger);
+
   let encryptionKey = config.encryptionKey;
   if (encryptionKey === undefined) {
     logger.warn(