Skip to content

[fips] Agent reports FIPS status #2587

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nishanttotla merged 2 commits into from
Apr 10, 2018
Merged

[fips] Agent reports FIPS status #2587

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6847b6c
Add a fips boolean to the node config.
cyli Apr 3, 2018
7c61add
The agent now reports its FIPS status as part of the node description.
cyli Mar 7, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions agent/agent.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -579,6 +579,7 @@ func (a *Agent) nodeDescriptionWithHostname(ctx context.Context, tlsInfo *api.No
desc.Hostname = a.config.Hostname
}
desc.TLSInfo = tlsInfo
desc.FIPS = a.config.FIPS
}
return desc, err
}
Expand Down
7 changes: 6 additions & 1 deletion agent/agent_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -232,17 +232,20 @@ func TestHandleSessionMessageNodeChanges(t *testing.T) {
require.Empty(t, closedSessions)
}

// when the node description changes, the session is restarted and propagated up to the dispatcher
// when the node description changes, the session is restarted and propagated up to the dispatcher.
// the node description includes the FIPSness of the agent.
func TestSessionRestartedOnNodeDescriptionChange(t *testing.T) {
tlsCh := make(chan events.Event, 1)
defer close(tlsCh)
tester := agentTestEnv(t, nil, tlsCh)
tester.agent.config.FIPS = true // start out with the agent in FIPS-enabled mode
defer tester.cleanup()
defer tester.StartAgent(t)()

currSession, closedSessions := tester.dispatcher.GetSessions()
require.NotNil(t, currSession)
require.NotNil(t, currSession.Description)
require.True(t, currSession.Description.FIPS)
require.Empty(t, closedSessions)

tester.executor.UpdateNodeDescription(&api.NodeDescription{
Expand All @@ -262,6 +265,7 @@ func TestSessionRestartedOnNodeDescriptionChange(t *testing.T) {
require.NotEqual(t, currSession, gotSession)
require.NotNil(t, gotSession.Description)
require.Equal(t, "testAgent", gotSession.Description.Hostname)
require.True(t, gotSession.Description.FIPS)
currSession = gotSession

// If nothing changes, the session is not re-established
Expand Down Expand Up @@ -291,6 +295,7 @@ func TestSessionRestartedOnNodeDescriptionChange(t *testing.T) {
require.NotNil(t, gotSession.Description)
require.Equal(t, "testAgent", gotSession.Description.Hostname)
require.Equal(t, newTLSInfo, gotSession.Description.TLSInfo)
require.True(t, gotSession.Description.FIPS)
}

// If the dispatcher returns an error, if it times out, or if it's unreachable, no matter
Expand Down
3 changes: 3 additions & 0 deletions agent/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,9 @@ type Config struct {
// SessionTracker, if provided, will have its SessionClosed and SessionError methods called
// when sessions close and error.
SessionTracker SessionTracker

// FIPS returns whether the node is FIPS-enabled
FIPS bool
}

func (c *Config) validate() error {
Expand Down
10 changes: 10 additions & 0 deletions api/api.pb.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2171,6 +2171,16 @@ file {
}
json_name: "tlsInfo"
}
field {
name: "fips"
number: 6
label: LABEL_OPTIONAL
type: TYPE_BOOL
options {
65004: "FIPS"
}
json_name: "fips"
}
}
message_type {
name: "NodeTLSInfo"
Expand Down
673 changes: 355 additions & 318 deletions api/types.pb.go
View file
Open in desktop

Large diffs are not rendered by default.

3 changes: 3 additions & 0 deletions api/types.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -125,6 +125,9 @@ message NodeDescription {

// Information on the node's TLS setup
NodeTLSInfo tls_info = 5 [(gogoproto.customname) = "TLSInfo"];

// FIPS indicates whether the node has FIPS-enabled
bool fips = 6 [(gogoproto.customname) = "FIPS"];
}

message NodeTLSInfo {
Expand Down
4 changes: 4 additions & 0 deletions node/node.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -123,6 +123,9 @@ type Config struct {

// PluginGetter provides access to docker's plugin inventory.
PluginGetter plugingetter.PluginGetter

// FIPS is a boolean stating whether the node is FIPS enabled
FIPS bool
}

// Node implements the primary node functionality for a member of a swarm
Expand Down Expand Up @@ -609,6 +612,7 @@ waitPeer:
CertIssuerPublicKey: issuer.PublicKey,
CertIssuerSubject: issuer.Subject,
},
FIPS: n.config.FIPS,
Copy link
Copy Markdown
Contributor

@nishanttotla nishanttotla Apr 10, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

While this doesn't really affect this PR, I'd like for us to make sure that users know to set this in the node config.

Copy link
Copy Markdown
Contributor Author

@cyli cyli Apr 10, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@nishanttotla I agree - where would you suggest this be documented?

Copy link
Copy Markdown
Contributor

@nishanttotla nishanttotla Apr 10, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@cyli I'm not sure, but let me look this up. My hunch is that this would go into the Docker API documentation. cc @thaJeztah

Copy link
Copy Markdown
Member

@thaJeztah thaJeztah Apr 11, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Trying to grasp where / when it needs to be set; @cyli @nishanttotla feel free to ping me on Slack / drop by my desk to explain 😅

}
// if a join address has been specified, then if the agent fails to connect
// due to a TLS error, fail fast - don't keep re-trying to join
Expand Down