feat(fips): return an error when validating kerberos cfg (#42887) (#4…

…2954)

* feat(fips): return an error when validating kerberos cfg

setting kerberos config options should return an error

* Update config.go

* Update config_nofips.go

* Update client_nofips.go

(cherry picked from commit e532bbe)

# Conflicts:
#	libbeat/common/transport/kerberos/client_nofips.go

Co-authored-by: kruskall <[email protected]>

libbeat/common/transport/kerberos/client_nofips.go

@@ -46,7 +46,7 @@ func NewClient(config *Config, httpClient *http.Client, esurl string) (Client, e
 	case authPassword:
 		krbClient = krbclient.NewWithPassword(config.Username, config.Realm, config.Password, krbConf)
 	default:
-		return nil, InvalidAuthType
+		return nil, ErrInvalidAuthType
 	}
 
 	return spnego.NewClient(krbClient, httpClient, ""), nil

libbeat/common/transport/kerberos/config.go

@@ -33,7 +33,7 @@ const (
 )
 
 var (
-	InvalidAuthType = errors.New("invalid authentication type")
+	ErrInvalidAuthType = errors.New("invalid authentication type")
 
 	authTypes = map[string]AuthType{
 		authPasswordStr: authPassword,
@@ -69,24 +69,3 @@ func (t *AuthType) Unpack(value string) error {
 
 	return nil
 }
-
-func (c *Config) Validate() error {
-	switch c.AuthType {
-	case authPassword:
-		if c.Username == "" {
-			return fmt.Errorf("password authentication is selected for Kerberos, but username is not configured")
-		}
-		if c.Password == "" {
-			return fmt.Errorf("password authentication is selected for Kerberos, but password is not configured")
-		}
-
-	case authKeytab:
-		if c.KeyTabPath == "" {
-			return fmt.Errorf("keytab authentication is selected for Kerberos, but path to keytab is not configured")
-		}
-	default:
-		return InvalidAuthType
-	}
-
-	return nil
-}

libbeat/common/transport/kerberos/config_fips.go

@@ -0,0 +1,28 @@
+// Licensed to Elasticsearch B.V. under one or more contributor
+// license agreements. See the NOTICE file distributed with
+// this work for additional information regarding copyright
+// ownership. Elasticsearch B.V. licenses this file to you under
+// the Apache License, Version 2.0 (the "License"); you may
+// not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+//go:build requirefips
+
+package kerberos
+
+import (
+	"errors"
+)
+
+func (c *Config) Validate() error {
+	return errors.New("kerberos is not supported in fips mode")
+}

libbeat/common/transport/kerberos/config_fips_test.go

@@ -0,0 +1,32 @@
+// Licensed to Elasticsearch B.V. under one or more contributor
+// license agreements. See the NOTICE file distributed with
+// this work for additional information regarding copyright
+// ownership. Elasticsearch B.V. licenses this file to you under
+// the Apache License, Version 2.0 (the "License"); you may
+// not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+//go:build requirefips
+
+package kerberos
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestConfigValidate(t *testing.T) {
+	cfg := &Config{}
+	err := cfg.Validate()
+	require.EqualError(t, err, "kerberos is not supported in fips mode")
+}

libbeat/common/transport/kerberos/config_nofips.go

@@ -0,0 +1,43 @@
+// Licensed to Elasticsearch B.V. under one or more contributor
+// license agreements. See the NOTICE file distributed with
+// this work for additional information regarding copyright
+// ownership. Elasticsearch B.V. licenses this file to you under
+// the Apache License, Version 2.0 (the "License"); you may
+// not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+//go:build !requirefips
+
+package kerberos
+
+import "fmt"
+
+func (c *Config) Validate() error {
+	switch c.AuthType {
+	case authPassword:
+		if c.Username == "" {
+			return fmt.Errorf("password authentication is selected for Kerberos, but username is not configured")
+		}
+		if c.Password == "" {
+			return fmt.Errorf("password authentication is selected for Kerberos, but password is not configured")
+		}
+
+	case authKeytab:
+		if c.KeyTabPath == "" {
+			return fmt.Errorf("keytab authentication is selected for Kerberos, but path to keytab is not configured")
+		}
+	default:
+		return ErrInvalidAuthType
+	}
+
+	return nil
+}

libbeat/common/transport/kerberos/config_nofips_test.go

@@ -0,0 +1,36 @@
+// Licensed to Elasticsearch B.V. under one or more contributor
+// license agreements. See the NOTICE file distributed with
+// this work for additional information regarding copyright
+// ownership. Elasticsearch B.V. licenses this file to you under
+// the Apache License, Version 2.0 (the "License"); you may
+// not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+//go:build !requirefips
+
+package kerberos
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestConfigValidate(t *testing.T) {
+	cfg := &Config{
+		AuthType: authPassword,
+		Username: "username",
+		Password: "password",
+	}
+	err := cfg.Validate()
+	require.NoError(t, err)
+}