Only enforce password hashing check if FIPS enabled (#32383)

This commit modifies the FIPS password hashing algorithm check to only be executed if FIPS mode is enabled.
elastic · Jul 26, 2018 · 4c2fbcf · 4c2fbcf
1 parent a5b5812
commit 4c2fbcf
Show file tree

Hide file tree

Showing 2 changed files with 49 additions and 23 deletions.
diff --git a/.../java/org/elasticsearch/xpack/security/FIPS140PasswordHashingAlgorithmBootstrapCheck.java b/.../java/org/elasticsearch/xpack/security/FIPS140PasswordHashingAlgorithmBootstrapCheck.java
@@ -16,7 +16,7 @@ public class FIPS140PasswordHashingAlgorithmBootstrapCheck implements BootstrapC
 
     private final boolean fipsModeEnabled;
 
-    FIPS140PasswordHashingAlgorithmBootstrapCheck(Settings settings) {
+    FIPS140PasswordHashingAlgorithmBootstrapCheck(final Settings settings) {
         this.fipsModeEnabled = Security.FIPS_MODE_ENABLED.get(settings);
     }
 
@@ -27,17 +27,15 @@ public class FIPS140PasswordHashingAlgorithmBootstrapCheck implements BootstrapC
      * @return the result of the bootstrap check
      */
     @Override
-    public BootstrapCheckResult check(BootstrapContext context) {
-        final String selectedAlgorithm = XPackSettings.PASSWORD_HASHING_ALGORITHM.get(context.settings);
-        if (selectedAlgorithm.toLowerCase(Locale.ROOT).startsWith("pbkdf2") == false) {
-            return BootstrapCheckResult.failure("Only PBKDF2 is allowed for password hashing in a FIPS-140 JVM. Please set the " +
-                "appropriate value for [ " + XPackSettings.PASSWORD_HASHING_ALGORITHM.getKey() + " ] setting.");
+    public BootstrapCheckResult check(final BootstrapContext context) {
+        if (fipsModeEnabled) {
+            final String selectedAlgorithm = XPackSettings.PASSWORD_HASHING_ALGORITHM.get(context.settings);
+            if (selectedAlgorithm.toLowerCase(Locale.ROOT).startsWith("pbkdf2") == false) {
+                return BootstrapCheckResult.failure("Only PBKDF2 is allowed for password hashing in a FIPS-140 JVM. Please set the " +
+                        "appropriate value for [ " + XPackSettings.PASSWORD_HASHING_ALGORITHM.getKey() + " ] setting.");
+            }
         }
         return BootstrapCheckResult.success();
     }
 
-    @Override
-    public boolean alwaysEnforce() {
-        return fipsModeEnabled;
-    }
 }
diff --git a/.../org/elasticsearch/xpack/security/FIPS140PasswordHashingAlgorithmBootstrapCheckTests.java b/.../org/elasticsearch/xpack/security/FIPS140PasswordHashingAlgorithmBootstrapCheckTests.java
@@ -3,32 +3,60 @@
  * or more contributor license agreements. Licensed under the Elastic License;
  * you may not use this file except in compliance with the Elastic License.
  */
+
 package org.elasticsearch.xpack.security;
 
+import org.elasticsearch.bootstrap.BootstrapCheck;
 import org.elasticsearch.bootstrap.BootstrapContext;
 import org.elasticsearch.common.settings.Settings;
 import org.elasticsearch.test.ESTestCase;
 import org.elasticsearch.xpack.core.XPackSettings;
 
+import java.util.Arrays;
+
+import static org.hamcrest.Matchers.equalTo;
+
 public class FIPS140PasswordHashingAlgorithmBootstrapCheckTests extends ESTestCase {
 
     public void testPBKDF2AlgorithmIsAllowed() {
-        Settings settings = Settings.builder().put("xpack.security.fips_mode.enabled", "true").build();
+        {
+            final Settings settings = Settings.builder()
+                    .put(Security.FIPS_MODE_ENABLED.getKey(), true)
+                    .put(XPackSettings.PASSWORD_HASHING_ALGORITHM.getKey(), "PBKDF2_10000")
+                    .build();
+            final BootstrapCheck.BootstrapCheckResult result =
+                    new FIPS140PasswordHashingAlgorithmBootstrapCheck(settings).check(new BootstrapContext(settings, null));
+            assertFalse(result.isFailure());
+        }
 
-        settings = Settings.builder().put(XPackSettings.PASSWORD_HASHING_ALGORITHM.getKey(), "PBKDF2_10000").build();
-        assertFalse(new FIPS140PasswordHashingAlgorithmBootstrapCheck(settings).check(new BootstrapContext(settings, null)).isFailure());
-
-        settings = Settings.builder().put(XPackSettings.PASSWORD_HASHING_ALGORITHM.getKey(), "PBKDF2").build();
-        assertFalse(new FIPS140PasswordHashingAlgorithmBootstrapCheck(settings).check(new BootstrapContext(settings, null)).isFailure());
+        {
+            final Settings settings = Settings.builder()
+                    .put(Security.FIPS_MODE_ENABLED.getKey(), true)
+                    .put(XPackSettings.PASSWORD_HASHING_ALGORITHM.getKey(), "PBKDF2")
+                    .build();
+            final BootstrapCheck.BootstrapCheckResult result =
+                    new FIPS140PasswordHashingAlgorithmBootstrapCheck(settings).check(new BootstrapContext(settings, null));
+            assertFalse(result.isFailure());
+        }
     }
 
-    public void testBCRYPTAlgorithmIsNotAllowed() {
-        Settings settings = Settings.builder().put("xpack.security.fips_mode.enabled", "true").build();
-        assertTrue(new FIPS140PasswordHashingAlgorithmBootstrapCheck(settings).check(new BootstrapContext(settings, null)).isFailure());
-        settings = Settings.builder().put(XPackSettings.PASSWORD_HASHING_ALGORITHM.getKey(), "BCRYPT").build();
-        assertTrue(new FIPS140PasswordHashingAlgorithmBootstrapCheck(settings).check(new BootstrapContext(settings, null)).isFailure());
+    public void testBCRYPTAlgorithmDependsOnFipsMode() {
+        for (final Boolean fipsModeEnabled : Arrays.asList(true, false)) {
+            for (final String passwordHashingAlgorithm : Arrays.asList(null, "BCRYPT", "BCRYPT11")) {
+                runBCRYPTTest(fipsModeEnabled, passwordHashingAlgorithm);
+            }
+        }
+    }
 
-        settings = Settings.builder().put(XPackSettings.PASSWORD_HASHING_ALGORITHM.getKey(), "BCRYPT11").build();
-        assertTrue(new FIPS140PasswordHashingAlgorithmBootstrapCheck(settings).check(new BootstrapContext(settings, null)).isFailure());
+    private void runBCRYPTTest(final boolean fipsModeEnabled, final String passwordHashingAlgorithm) {
+        final Settings.Builder builder = Settings.builder().put(Security.FIPS_MODE_ENABLED.getKey(), fipsModeEnabled);
+        if (passwordHashingAlgorithm != null) {
+            builder.put(XPackSettings.PASSWORD_HASHING_ALGORITHM.getKey(), passwordHashingAlgorithm);
+        }
+        final Settings settings = builder.build();
+        final BootstrapCheck.BootstrapCheckResult result =
+                new FIPS140PasswordHashingAlgorithmBootstrapCheck(settings).check(new BootstrapContext(settings, null));
+        assertThat(result.isFailure(), equalTo(fipsModeEnabled));
     }
+
 }