diff --git a/x-pack/distributions/internal/observabilitySRE/plugin-allow-list.txt b/x-pack/distributions/internal/observabilitySRE/plugin-allow-list.txt index 47bf7fad16..3e41f22a3d 100644 --- a/x-pack/distributions/internal/observabilitySRE/plugin-allow-list.txt +++ b/x-pack/distributions/internal/observabilitySRE/plugin-allow-list.txt @@ -14,6 +14,7 @@ logstash-input-beats logstash-input-generator logstash-input-pipeline logstash-output-elasticsearch +logstash-output-http logstash-output-pipeline logstash-output-stdout logstash-patterns-core diff --git a/x-pack/distributions/internal/observabilitySRE/qa/acceptance/spec/acceptance_tests_spec.rb b/x-pack/distributions/internal/observabilitySRE/qa/acceptance/spec/acceptance_tests_spec.rb index 00035ae2fa..224b331a86 100644 --- a/x-pack/distributions/internal/observabilitySRE/qa/acceptance/spec/acceptance_tests_spec.rb +++ b/x-pack/distributions/internal/observabilitySRE/qa/acceptance/spec/acceptance_tests_spec.rb @@ -64,6 +64,66 @@ end end + context "when running LS to the HTTP output with FIPS-compliant configuration" do + before(:all) do + work_dir = File.expand_path("../docker", __dir__) + docker_compose_up({"LOGSTASH_PIPELINE" => "logstash-to-http.conf"}, work_dir) + wait_for_elasticsearch + end + + after(:all) do + work_dir = File.expand_path("../docker", __dir__) + docker_compose_down({}, work_dir) + end + + it "data flows from Logstash to Elasticsearch via the HTTP output using FIPS-approved SSL" do + # Wait for index to appear, indicating data is flowing over the HTTP output + wait_until(timeout: 30, message: "Index logstash-http-fips-test not found") do + response = es_request("/_cat/indices?v") + response.code == "200" && response.body.include?("logstash-http-fips-test") + end + # Wait until specific data added by the mutate filter is observed + query = { query: { match_all: {} } }.to_json + result = nil + wait_until(timeout: 30, message: "No documents in logstash-http-fips-test") do + response = es_request("/logstash-http-fips-test/_search", query) + result = JSON.parse(response.body) + response.code == "200" && result["hits"]["total"]["value"] > 0 + end + expect(result["hits"]["hits"].first["_source"]).to include("fips_test") + end + end + + context "when running LS to the HTTP output with non-FIPS compliant configuration" do + before(:all) do + work_dir = File.expand_path("../docker", __dir__) + docker_compose_up({"LOGSTASH_PIPELINE" => "logstash-to-http-weak.conf"}, work_dir) + wait_for_elasticsearch + end + + after(:all) do + work_dir = File.expand_path("../docker", __dir__) + docker_compose_down({}, work_dir) + end + + it "prevents data flow when using TLSv1.1 which is not FIPS-compliant" do + # Allow time for Logstash to attempt connections (and fail) + sleep 15 + + # Verify that no index has been created that would indicate successful data flow + response = es_request("/_cat/indices?v") + expect(response.body).not_to include("logstash-http-weak-ssl-test") + + # Check logs for the specific BouncyCastle FIPS error we expect + logs = `docker logs fips_test_logstash 2>&1` + + # Verify the logs contain the FIPS-mode TLS protocol error + expect(logs).to include("No usable protocols enabled") + expect(logs).to include("IllegalStateException") + expect(logs).to include("org.bouncycastle") + end + end + context "When running Filebeat through LS to ES in a FIPS compliant configuration" do before(:all) do work_dir = File.expand_path("../docker", __dir__)