mirror of
https://github.com/zitadel/zitadel.git
synced 2026-07-25 18:28:00 +00:00
Tim MöhlmannandGitHub
e94d4c3986
# Which Problems Are Solved Enable FIPS 140-3 compliant build. # How the Problems Are Solved - Add runtime config validation, if the FIPS flag is enabled fail the application when a non-compliant hasher is used, or throw a warning when a legacy verifier is used - Add a build matrix for FIPS certified build: - Go binary is built with `GOFIPS140=certified` - Login container uses a separate base: [ubi9](https://catalog.redhat.com/en/software/containers/ubi9/ubi/615bcf606feffc5384e8452e) from redhat which provides a FIPS certified OpenSSL (used by NodeJS TLS stack) - Non-FIPS images where already pushed to both Github Container Registry and Google Artifact Repository (GAR). Fips images are only pushed to the GAR. - Tag versions are suffixed `-fips`. So on release the following images will be additionally available: ``` europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel-login:vX.Y.Z-fips europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel:vX.Y.Z-fips-debug europe-docker.pkg.dev/zitadel-common/zitadel-repo/zitadel:vX.Y.Z-fips ``` # Other changes - Bumb Go toolchain. At least v1.25.10 is required for a GOFIPS140=certified setting. # Additional Context - Closes https://github.com/zitadel/zitadel/issues/4335 - Build [test run](https://github.com/zitadel/zitadel/actions/runs/27253916052) pushing FIPS and non-FIPS images
76 lines
2.4 KiB
Go
76 lines
2.4 KiB
Go
package cmd
|
|
|
|
import (
|
|
"bytes"
|
|
"testing"
|
|
|
|
"github.com/spf13/viper"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
|
|
"github.com/zitadel/zitadel/internal/crypto"
|
|
)
|
|
|
|
func testViper(t *testing.T) *viper.Viper {
|
|
t.Helper()
|
|
v := viper.New()
|
|
v.SetConfigType("yaml")
|
|
return v
|
|
}
|
|
|
|
func loadAndUnmarshalHashConfig(t *testing.T, v *viper.Viper, key string) crypto.HashConfig {
|
|
t.Helper()
|
|
var cfg crypto.HashConfig
|
|
require.NoError(t, v.UnmarshalKey(key, &cfg))
|
|
return cfg
|
|
}
|
|
|
|
func loadBaseDefaultConfig(t *testing.T, v *viper.Viper) {
|
|
t.Helper()
|
|
require.NoError(t, v.ReadConfig(bytes.NewBuffer(defaultConfig)))
|
|
}
|
|
|
|
func TestLoadDefaultConfig_NonFIPSPasswordHasher(t *testing.T) {
|
|
v := testViper(t)
|
|
require.NoError(t, loadDefaultConfigInto(v))
|
|
cfg := loadAndUnmarshalHashConfig(t, v, "SystemDefaults.PasswordHasher")
|
|
assert.Equal(t, crypto.HashNameBcrypt, cfg.Hasher.Algorithm)
|
|
}
|
|
|
|
func TestLoadDefaultConfig_NonFIPSSecretHasher(t *testing.T) {
|
|
v := testViper(t)
|
|
require.NoError(t, loadDefaultConfigInto(v))
|
|
cfg := loadAndUnmarshalHashConfig(t, v, "SystemDefaults.SecretHasher")
|
|
assert.Equal(t, crypto.HashNameBcrypt, cfg.Hasher.Algorithm)
|
|
}
|
|
|
|
func TestLoadDefaultConfig_FIPSPasswordHasher(t *testing.T) {
|
|
v := testViper(t)
|
|
loadBaseDefaultConfig(t, v)
|
|
require.NoError(t, applyFipsDefaultOverlay(v))
|
|
cfg := loadAndUnmarshalHashConfig(t, v, "SystemDefaults.PasswordHasher")
|
|
assert.Equal(t, crypto.HashNamePBKDF2, cfg.Hasher.Algorithm)
|
|
assert.Equal(t, 290000, v.GetInt("SystemDefaults.PasswordHasher.Hasher.Rounds"))
|
|
assert.Equal(t, "sha256", v.GetString("SystemDefaults.PasswordHasher.Hasher.Hash"))
|
|
assert.Empty(t, cfg.Verifiers)
|
|
}
|
|
|
|
func TestLoadDefaultConfig_FIPSSecretHasher(t *testing.T) {
|
|
v := testViper(t)
|
|
loadBaseDefaultConfig(t, v)
|
|
require.NoError(t, applyFipsDefaultOverlay(v))
|
|
cfg := loadAndUnmarshalHashConfig(t, v, "SystemDefaults.SecretHasher")
|
|
assert.Equal(t, crypto.HashNamePBKDF2, cfg.Hasher.Algorithm)
|
|
assert.Equal(t, 290000, v.GetInt("SystemDefaults.SecretHasher.Hasher.Rounds"))
|
|
assert.Equal(t, "sha256", v.GetString("SystemDefaults.SecretHasher.Hasher.Hash"))
|
|
assert.Empty(t, cfg.Verifiers)
|
|
}
|
|
|
|
func TestLoadDefaultConfig_FIPSVerifierKeysEmpty(t *testing.T) {
|
|
v := testViper(t)
|
|
loadBaseDefaultConfig(t, v)
|
|
require.NoError(t, applyFipsDefaultOverlay(v))
|
|
assert.Empty(t, v.GetStringSlice("SystemDefaults.PasswordHasher.Verifiers"))
|
|
assert.Empty(t, v.GetStringSlice("SystemDefaults.SecretHasher.Verifiers"))
|
|
}
|