Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add FIPS test #19404

Closed
wants to merge 71 commits into from
Closed

Add FIPS test #19404

wants to merge 71 commits into from

Conversation

dkirov-dd
Copy link
Contributor

@dkirov-dd dkirov-dd commented Jan 15, 2025

What does this PR do?

Adds a workflow testing primitive FIPS functionality using custom Agent checks.

This workflow tests the following:

  • HTTPS connections
  • SSH connections
  • ssl library
  • cryptography library

This workflow does not test:

  • JMX integrations: JMXFetch already has FIPS tests on the Agent side (here)
  • Sockets: we use TLS wrappers for secure sockets, these wrappers use the same algorithms as the HTTPS connections

Motivation

Developing FIPS E2E tests for each integration would be too cumbersome due to the need to control the TLS parameters of each endpoint.

Review checklist (to be filled by reviewers)

  • Feature or bugfix MUST have appropriate tests (unit, integration, e2e)
  • Add the qa/skip-qa label if the PR doesn't need to be tested during QA.
  • If you need to backport this PR to another branch, you can add the backport/<branch-name> label to the PR and it will automatically open a backport PR once this one is merged

Copy link

codecov bot commented Jan 15, 2025

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 88.57%. Comparing base (18d32c1) to head (4c0e24e).
Report is 15 commits behind head on master.

Additional details and impacted files
Flag Coverage Δ
activemq ?
cassandra ?
hive ?
hivemq ?
hudi ?
ignite ?
jboss_wildfly ?
kafka ?
presto ?
solr ?

Flags with carried forward coverage won't be shown. Click here to find out more.

@dkirov-dd dkirov-dd force-pushed the david.kirov/fips-tests branch 29 times, most recently from 03741a1 to a8c2465 Compare January 21, 2025 13:22
@dkirov-dd dkirov-dd force-pushed the david.kirov/fips-tests branch from 2dd4a0c to 95a188e Compare February 4, 2025 14:28
@dkirov-dd dkirov-dd force-pushed the david.kirov/fips-tests branch from 9e052b9 to 9edbbe1 Compare February 4, 2025 16:27
@dkirov-dd dkirov-dd marked this pull request as ready for review February 10, 2025 10:17
@dkirov-dd dkirov-dd requested a review from a team as a code owner February 10, 2025 10:17
@dkirov-dd
Copy link
Contributor Author

dkirov-dd commented Mar 10, 2025

DataDog/datadog-agent#33521 ports the FIPS implementation to the Agent.
It also ports the tests concerning ssl and cryptography.
The rest of the tests should be ported in a subsequent PR, which would require adding SSH functionality to the FIPS server.

@dkirov-dd
Copy link
Contributor Author

Closing because tests in datadog-agent should be prioritized

@dkirov-dd dkirov-dd closed this Mar 13, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants