feat(fips): disable usage of flowhash/communityid in fips mode

libbeat/common/flowhash/communityid.go

@@ -19,8 +19,6 @@ package flowhash
 
 import (
 	"crypto"
-	// import crypto/sha1 so that the SHA1 algorithm is available.
-	_ "crypto/sha1"
 	"encoding/binary"
 	"net"
 )
@@ -31,10 +29,6 @@ type communityIDHasher struct {
 	hash    crypto.Hash
 }
 
-// CommunityID is a flow hasher instance using the default values
-// in the community ID specification.
-var CommunityID = NewCommunityID(0, Base64Encoding, crypto.SHA1)
-
 // NewCommunityID allows to instantiate a flow hasher with custom settings.
 func NewCommunityID(seed uint16, encoder Encoding, hash crypto.Hash) Hasher {
 	h := &communityIDHasher{

libbeat/common/flowhash/communityid_fips.go

@@ -0,0 +1,34 @@
+// Licensed to Elasticsearch B.V. under one or more contributor
+// license agreements. See the NOTICE file distributed with
+// this work for additional information regarding copyright
+// ownership. Elasticsearch B.V. licenses this file to you under
+// the Apache License, Version 2.0 (the "License"); you may
+// not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+//go:build requirefips
+
+package flowhash
+
+var CommunityID = NewCommunityID()
+
+type communityIDHasher struct{}
+
+// NewCommunityID allows to instantiate a flow hasher with custom settings.
+func NewCommunityID() Hasher {
+	return &communityIDHasher{}
+}
+
+// Hash returns the hash for the given flow.
+func (h *communityIDHasher) Hash(flow Flow) string {
+	return ""
+}

libbeat/common/flowhash/communityid_fips_test.go

@@ -0,0 +1,31 @@
+// Licensed to Elasticsearch B.V. under one or more contributor
+// license agreements. See the NOTICE file distributed with
+// this work for additional information regarding copyright
+// ownership. Elasticsearch B.V. licenses this file to you under
+// the Apache License, Version 2.0 (the "License"); you may
+// not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+//go:build requirefips
+
+package flowhash
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestCommunityID(t *testing.T) {
+	s := CommunityID.Hash(Flow{SourcePort: 1})
+	require.Empty(t, s)
+}

libbeat/common/flowhash/communityid_nofips.go

@@ -0,0 +1,24 @@
+// Licensed to Elasticsearch B.V. under one or more contributor
+// license agreements. See the NOTICE file distributed with
+// this work for additional information regarding copyright
+// ownership. Elasticsearch B.V. licenses this file to you under
+// the Apache License, Version 2.0 (the "License"); you may
+// not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+//go:build !requirefips
+
+package flowhash
+
+import "crypto"
+
+var CommunityID = NewCommunityID(0, Base64Encoding, crypto.SHA1)

libbeat/common/flowhash/communityid_test.go

@@ -15,6 +15,8 @@
 // specific language governing permissions and limitations
 // under the License.
 
+//go:build !requirefips
+
 package flowhash
 
 import (

libbeat/processors/communityid/communityid.go

@@ -15,6 +15,8 @@
 // specific language governing permissions and limitations
 // under the License.
 
+//go:build !requirefips
+
 package communityid
 
 import (
@@ -66,10 +68,7 @@ func New(cfg *cfg.C) (beat.Processor, error) {
 }
 
 func newFromConfig(c config) (*processor, error) {
-	hasher := flowhash.CommunityID
-	if c.Seed != 0 {
-		hasher = flowhash.NewCommunityID(c.Seed, flowhash.Base64Encoding, crypto.SHA1)
-	}
+	hasher := flowhash.NewCommunityID(c.Seed, flowhash.Base64Encoding, crypto.SHA1)
 
 	return &processor{
 		config: c,

libbeat/processors/communityid/communityid_test.go

@@ -15,6 +15,8 @@
 // specific language governing permissions and limitations
 // under the License.
 
+//go:build !requirefips
+
 package communityid
 
 import (

packetbeat/flows/worker.go

@@ -443,9 +443,11 @@ func createEvent(watcher *procs.ProcessesWatcher, ts time.Time, f *biFlow, isOve
 		}
 
 		if v, found := stats["bytes"]; found {
+			//nolint:errcheck // ignore
 			totalBytes += v.(uint64)
 		}
 		if v, found := stats["packets"]; found {
+			//nolint:errcheck // ignore
 			totalPackets += v.(uint64)
 		}
 	}
@@ -461,15 +463,18 @@ func createEvent(watcher *procs.ProcessesWatcher, ts time.Time, f *biFlow, isOve
 		}
 
 		if v, found := stats["bytes"]; found {
+			//nolint:errcheck // ignore
 			totalBytes += v.(uint64)
 		}
 		if v, found := stats["packets"]; found {
+			//nolint:errcheck // ignore
 			totalPackets += v.(uint64)
 		}
 	}
 	if communityID.Protocol > 0 && len(communityID.SourceIP) > 0 && len(communityID.DestinationIP) > 0 {
-		hash := flowhash.CommunityID.Hash(communityID)
-		network["community_id"] = hash
+		if hash := flowhash.CommunityID.Hash(communityID); hash != "" {
+			network["community_id"] = hash
+		}
 	}
 	network["bytes"] = totalBytes
 	network["packets"] = totalPackets

x-pack/auditbeat/module/system/socket/state.go

@@ -962,13 +962,6 @@ func (f *flow) toEvent(final bool) (ev mb.Event, err error) {
 			"transport": f.proto.String(),
 			"packets":   f.local.packets + f.remote.packets,
 			"bytes":     f.local.bytes + f.remote.bytes,
-			"community_id": flowhash.CommunityID.Hash(flowhash.Flow{
-				SourceIP:        localAddr.IP,
-				SourcePort:      uint16(localAddr.Port),
-				DestinationIP:   remoteAddr.IP,
-				DestinationPort: uint16(remoteAddr.Port),
-				Protocol:        uint8(f.proto),
-			}),
 		},
 		"event": mapstr.M{
 			"kind":     "event",
@@ -984,6 +977,16 @@ func (f *flow) toEvent(final bool) (ev mb.Event, err error) {
 			"complete": f.complete,
 		},
 	}
+	if communityid := flowhash.CommunityID.Hash(flowhash.Flow{
+		SourceIP:        localAddr.IP,
+		SourcePort:      uint16(localAddr.Port),
+		DestinationIP:   remoteAddr.IP,
+		DestinationPort: uint16(remoteAddr.Port),
+		Protocol:        uint8(f.proto),
+	}); communityid != "" {
+		(root["network"].(mapstr.M))["community_id"] = communityid
+	}
+
 	var errs multierror.Errors
 	rootPut := func(key string, value interface{}) {
 		if _, err := root.Put(key, value); err != nil {

x-pack/filebeat/input/netflow/convert.go

@@ -327,13 +327,15 @@ func flowToBeatEvent(flow record.Record, internalNetworks []string) beat.Event {
 		ecsNetwork["name"] = ssid
 	}
 
-	ecsNetwork["community_id"] = flowhash.CommunityID.Hash(flowhash.Flow{
+	if communityid := flowhash.CommunityID.Hash(flowhash.Flow{
 		SourceIP:        srcIP,
 		SourcePort:      srcPort,
 		DestinationIP:   dstIP,
 		DestinationPort: dstPort,
 		Protocol:        uint8(protocol),
-	})
+	}); communityid != "" {
+		ecsNetwork["community_id"] = communityid
+	}
 
 	if len(ecsFlow) > 0 {
 		event.Fields["flow"] = ecsFlow