Add FIPS test

.github/workflows/fips-test.yml

@@ -0,0 +1,70 @@
+name: Test FIPS
+
+on:
+  pull_request:
+    paths:
+    - datadog_checks_base/datadog_checks/**
+    - .github/workflows/fips/**
+  schedule:
+    - cron: '0 0,8,16 * * *'
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  run:
+    strategy:
+      matrix:
+        platform: [linux, windows]
+        agent-type: [fips-agent, standard-agent]
+    runs-on: ${{ matrix.platform == 'linux' && 'ubuntu-22.04' || 'windows-2022' }}
+    name: "Test FIPS"
+
+    env:
+      FORCE_COLOR: "1"
+      PYTHON_VERSION: "3.12"
+      AGENT_TYPE: "${{ matrix.agent-type }}"
+
+    steps:
+
+    - uses: actions/checkout@v4
+
+    - name: Set up Python ${{ env.PYTHON_VERSION }}
+      uses: actions/setup-python@v5
+      with:
+        python-version: "${{ env.PYTHON_VERSION }}"
+        cache: 'pip'
+
+    - name: Install pytest
+      run: |
+        pip install pytest
+
+    - name: Cache Docker layers
+      uses: actions/cache@v3
+      with:
+        path: ~/.docker
+        key: ${{ runner.os }}-docker-${{ matrix.platform }}-${{ matrix.agent-type }}
+        restore-keys: |
+          ${{ runner.os }}-docker-${{ matrix.platform }}-
+
+    - name: Set up Linux containers
+      if: matrix.platform == 'linux'
+      env:
+        AGENT_IMAGE: "${{ matrix.agent-type == 'fips-agent' && 'datadog/agent-dev:master-fips' || 'datadog/agent-dev:master-py3' }}"
+        DD_API_KEY: ${{ secrets.DD_API_KEY }}
+      run: |
+        docker compose -f .github/workflows/fips/compose/compose-linux.yml up -d
+
+    - name: Set up Windows containers
+      if: matrix.platform == 'windows'
+      env:
+        AGENT_IMAGE: "${{ matrix.agent-type == 'fips-agent' && 'datadog/agent-dev:main-py3-fips-win-servercore-ltsc2022' || 'datadog/agent-dev:master-py3-win-servercore' }}"
+        DD_API_KEY: ${{ secrets.DD_API_KEY }}
+      run: |
+        docker compose -f .github/workflows/fips/compose/compose-windows.yml up --wait -d --no-deps --build
+
+    - name: Run tests
+      run: |
+        pytest -s -vv .github/workflows/fips/tests/
+

.github/workflows/fips/compose/agent/checks.d/connections.py

@@ -0,0 +1,35 @@
+from checks import AgentCheck
+from requests.exceptions import SSLError
+import paramiko
+
+
+class HelloCheck(AgentCheck):
+    def check(self, instance):
+        host = instance.get('host')
+        http_port = instance.get('http_port')
+        ssh_port = instance.get('ssh_port')
+
+        http_endpoint = f"https://{host}:{http_port}"
+        ssh_endpoint = f"ssh://{host}:{ssh_port}"
+
+        # Test connection with the HTTPS endpoint
+        try:
+            self.http.get(http_endpoint, verify=False)
+        except SSLError as e:
+            self.gauge('http_status', 0)
+            self.log.warn(f"Exception when trying to connect to {http_endpoint}: {e}")
+        else:
+            self.gauge('http_status', 1)
+
+        # Test connection with the SSH endpoint
+        try:
+            transport = paramiko.Transport(host, int(ssh_port))
+            transport.connect()
+        except paramiko.ssh_exception.SSHException as e:
+            self.gauge('ssh_status', 0)
+            self.log.info(f"Exception when trying to connect to {ssh_endpoint}: {e}")
+        except paramiko.ssh_exception.IncompatiblePeer as e:
+            self.gauge('ssh_status', 0)
+            self.log.info(f"Exception when trying to connect to {ssh_endpoint}: {e}")
+        else:
+            self.gauge('ssh_status', 1)

.github/workflows/fips/compose/agent/checks.d/libraries.py

@@ -0,0 +1,23 @@
+from checks import AgentCheck
+
+
+class HelloCheck(AgentCheck):
+    def check(self, instance):
+        from cryptography.exceptions import InternalError
+        from cryptography.hazmat.primitives import hashes
+        try:
+            hashes.Hash(hashes.MD5())
+        except InternalError:
+            self.gauge('cryptography_status', 0)
+        else:
+            self.gauge('cryptography_status', 1)
+
+        import ssl
+        ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+        try:
+            ctx.set_ciphers("MD5")
+        except ssl.SSLError as e:
+            self.gauge('ssl_status', 0)
+            self.log.warn(f"Exception: {e}")
+        else:
+            self.gauge('ssl_status', 1)

.github/workflows/fips/compose/agent/conf.d/connections.yaml

@@ -0,0 +1,10 @@
+init_config:
+
+instances:
+  - host: server
+    http_port: 443
+    ssh_port: 22
+  - host: server-fips
+    http_port: 443
+    ssh_port: 22
+

.github/workflows/fips/compose/agent/conf.d/libraries.yaml

@@ -0,0 +1,3 @@
+init_config:
+instances:
+  [{}]

.github/workflows/fips/compose/compose-linux.yml

@@ -0,0 +1,44 @@
+services:
+  agent:
+    image: $AGENT_IMAGE
+    pid: host
+    environment:
+      - DD_API_KEY=$DD_API_KEY
+      - DD_SITE=datad0g.com
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /proc/:/host/proc/:ro
+      - /sys/fs/cgroup:/host/sys/fs/cgroup:ro
+      - ./agent/conf.d/:/etc/datadog-agent/conf.d/
+      - ./agent/checks.d/:/etc/datadog-agent/checks.d/
+    healthcheck:
+      test: ["CMD", "agent", "status"]
+      interval: 5s
+      timeout: 2s
+      retries: 3
+  server-fips:
+    build:
+      context: server
+      dockerfile: Dockerfile-nix
+      args:
+        BUILD_TARGET: server
+    command: ["./server", "fips"]
+    healthcheck:
+      test: "curl -kf https://localhost:443"
+      start_period: 5s
+      interval: 10s
+      timeout: 5s
+      retries: 3
+  server:
+    build:
+      context: server
+      dockerfile: Dockerfile-nix
+      args:
+        BUILD_TARGET: server
+    command: ["./server", "non-fips"]
+    healthcheck:
+      test: "curl -kf https://localhost:443"
+      start_period: 5s
+      interval: 10s
+      timeout: 5s
+      retries: 3

.github/workflows/fips/compose/compose-windows.yml

@@ -0,0 +1,38 @@
+services:
+  agent:
+    image: $AGENT_IMAGE
+    pid: host
+    environment:
+      - DD_API_KEY=$DD_API_KEY
+      - DD_SITE=datad0g.com
+      # TODO remove: GOFIPS is not set on the Windows FIPS image
+      # Set it to 1 for the tests to pass
+      - GOFIPS=1
+    volumes:
+      - \\.\pipe\docker_engine:\\.\pipe\docker_engine
+      - "./agent/conf.d:C:/ProgramData/Datadog/conf.d"
+      - "./agent/checks.d:C:/ProgramData/Datadog/checks.d"
+  server-fips:
+    build:
+      context: server
+      dockerfile: Dockerfile-win
+      args:
+        BUILD_TARGET: server.exe
+    command: ["C:/app/server.exe", "fips"]
+    healthcheck:
+      test: ["CMD", "powershell", "-Command", "if ((Test-NetConnection -ComputerName localhost -Port 443).TcpTestSucceeded) { exit 0 } else { exit 1 }"]
+      interval: 5s
+      timeout: 15s
+      retries: 3
+  server:
+    build:
+      context: server
+      dockerfile: Dockerfile-win
+      args:
+        BUILD_TARGET: server.exe
+    command: ["C:/app/server.exe", "non-fips"]
+    healthcheck:
+      test: ["CMD", "powershell", "-Command", "if ((Test-NetConnection -ComputerName localhost -Port 443).TcpTestSucceeded) { exit 0 } else { exit 1 }"]
+      interval: 5s
+      timeout: 15s
+      retries: 3

.github/workflows/fips/compose/server/Dockerfile-nix

@@ -0,0 +1,12 @@
+FROM golang:1.23
+
+WORKDIR /app
+
+# Copy all files
+COPY . ./
+
+# Build the server
+RUN go build 
+
+# Expose port 443
+EXPOSE 443

.github/workflows/fips/compose/server/Dockerfile-win

@@ -0,0 +1,15 @@
+FROM golang:1.23
+
+WORKDIR /app
+
+# Copy all files
+COPY . ./
+
+ENV WORKDIR=C:/app
+
+# Build the server
+ARG BUILD_TARGET
+RUN go build -o $env:BUILD_TARGET main.go
+
+# Expose port 443
+EXPOSE 443

.github/workflows/fips/compose/server/ca.crt

@@ -0,0 +1,33 @@
+-----BEGIN CERTIFICATE-----
+MIIFwzCCA6ugAwIBAgIULsStz9lSmEN4m9GOJbAcvBD26qMwDQYJKoZIhvcNAQEL
+BQAwcDELMAkGA1UEBhMCVVMxDDAKBgNVBAgMA2ZvbzEMMAoGA1UEBwwDZm9vMQww
+CgYDVQQKDANmb28xDDAKBgNVBAsMA2ZvbzEVMBMGA1UEAwwMZXhwaXJlZC5tb2Nr
+MRIwEAYJKoZIhvcNAQkBFgNmb28wIBcNMjAwMzA1MTEwNDIyWhgPOTk5OTEyMzEx
+MTA0MjJaMHAxCzAJBgNVBAYTAlVTMQwwCgYDVQQIDANmb28xDDAKBgNVBAcMA2Zv
+bzEMMAoGA1UECgwDZm9vMQwwCgYDVQQLDANmb28xFTATBgNVBAMMDGV4cGlyZWQu
+bW9jazESMBAGCSqGSIb3DQEJARYDZm9vMIICIjANBgkqhkiG9w0BAQEFAAOCAg8A
+MIICCgKCAgEA5Ws3yh++mg+fnvwp2UbW1jpO8MslpdudgPkaZOtdO40lg4teYTqA
+rc770P+sfNha/0Gv1eel9LtdgsvyoHhABQfWoUYDUAU5ZbCalOHWOgZulZuw8Ff8
+zEiS+7ccBQs2ayGclIUVZo7PR3eURwmsCfd1CgJw60DQVegJhD/G4p0UhJRfArZ3
+OYvsYziE20QmoRNubntlR7gyzF30378pp8tP6661rFoZMuDx1ajvD+ExBCzUCiwV
+5ly/21FdXaEOVqmjxkn6nYQX35SH7ypyVJCYLe7sSW+ExT5FrvSsVOU+0GzAO291
+b+xJQf82/wWbwXgcauzpZYidkhmJahlNKUSGvHQBIvzSbSe198PFWug99Evs/Ux6
+xacyPCxdZ90xYVqah1zoeCsJgi+xa+4zRSk+OreP+TOe6Ph78Ne9+rn/R6eTKzPY
+JTNWgi6nt5os8rKijTMpTHx24BjekFOTtIfMC9geNGYWnamTfEplMq7M86d6kgiq
+UOeLdXywVvoyMkbVg7oAMU2wbwycu3HTgP4P41esWjNp1Z36YUzRVJoavcZtEJtO
+3ii1Elz/SFlqktLDwl27kh4GzvGEXwgFYjW+ucY4FrinTYmmZBCHQwuD3ZPPFVAu
+n1XEdYJf/suIqInH7eN2x/0RTsJbVodtMmke+XO5DdynUWEuK+/bmjMCAwEAAaNT
+MFEwHQYDVR0OBBYEFBEJJjHmDC+yd7Dem4SQg25HJ/mIMB8GA1UdIwQYMBaAFBEJ
+JjHmDC+yd7Dem4SQg25HJ/mIMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEL
+BQADggIBAGfXMDCJ3IpnLl3CF6zDkV8Jvv8MPx/61iQ5nNikuMEkP7smImfGx7bh
+WJhPiOQPaWU67Cr29WQ0bt0lKneBAcfvqLQ2Ub6wV4QCldhc95MfOo1ReqqDQkA+
+mi9ILwlaDevYEpBlpqa6v3L/EtaDof/Q8dpGm0jX+8yKqAZShpRVWRZUZch9iJOF
+XDS2Kee8wFP04jtt3isgXu6j+0JMytd834CoBHCGdjQsNFBnfTCKogg7iSweUoEa
+jnfYfRzxAzFachM/kB3CSpDifKtQabagKNfkEw2gyJDdaj3q3LO7jFCwySu6K/7n
+MeJSA6PJNSXouImUweNUjG+NJKFcXLHMW7s4lqbfnnaQVGq+n3nofhm11uasAOF1
+HdQRmyJQPKcZKTN19fz6ageJqJI6hCol2OENuTcmVH++KlJAK4R4z/S9/Er/9yOn
+UIOvwuBbcfS9uxoRlUge8jXWCVTFzolq6DVGvCOwgLlNsQDT4oEsh7unAXE7E2w9
+blkFskCImPaUpKqXwdLXPtESyJK6ri5nC5qY72cE3MndQ/HsrdbpjyvliYBXxcAP
+HxBgKj1HzUdME4OIHd7tIlndsBoaGnAwGdR018EkxaYZj4OhdbVSUwZop+NvtA8q
+MutrU4WG95lqaWnhnt6UnL/rbf3zbxzP9xyJIp3NYW8p7juYUeik
+-----END CERTIFICATE-----

.github/workflows/fips/compose/server/ca.key

@@ -0,0 +1,51 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIJKgIBAAKCAgEA5Ws3yh++mg+fnvwp2UbW1jpO8MslpdudgPkaZOtdO40lg4te
+YTqArc770P+sfNha/0Gv1eel9LtdgsvyoHhABQfWoUYDUAU5ZbCalOHWOgZulZuw
+8Ff8zEiS+7ccBQs2ayGclIUVZo7PR3eURwmsCfd1CgJw60DQVegJhD/G4p0UhJRf
+ArZ3OYvsYziE20QmoRNubntlR7gyzF30378pp8tP6661rFoZMuDx1ajvD+ExBCzU
+CiwV5ly/21FdXaEOVqmjxkn6nYQX35SH7ypyVJCYLe7sSW+ExT5FrvSsVOU+0GzA
+O291b+xJQf82/wWbwXgcauzpZYidkhmJahlNKUSGvHQBIvzSbSe198PFWug99Evs
+/Ux6xacyPCxdZ90xYVqah1zoeCsJgi+xa+4zRSk+OreP+TOe6Ph78Ne9+rn/R6eT
+KzPYJTNWgi6nt5os8rKijTMpTHx24BjekFOTtIfMC9geNGYWnamTfEplMq7M86d6
+kgiqUOeLdXywVvoyMkbVg7oAMU2wbwycu3HTgP4P41esWjNp1Z36YUzRVJoavcZt
+EJtO3ii1Elz/SFlqktLDwl27kh4GzvGEXwgFYjW+ucY4FrinTYmmZBCHQwuD3ZPP
+FVAun1XEdYJf/suIqInH7eN2x/0RTsJbVodtMmke+XO5DdynUWEuK+/bmjMCAwEA
+AQKCAgBiqhbHNZnKNffm7vmsePvCDDeQ9T0OtIFrSzZfup1RFCXTCeggFoHqvf6s
+Zpiu5HlWF9DgRIyp0L6plr6U5sJZp4JVv3+DNYv2wNnqN6njMIr0io2w/5Y34Opd
+mOVTAfx4XG8zrHyEq9xXFwVM+8riSmsqT9xyQGCY4X7eQnNtWDLPxeOKjiB+Pj/+
+d/sjNY8LbQjsOONY0c3++FVsuJDYmeaYLH3zTphRuk4nHk0Z3jYvXnwel9EfTjow
+vzBRKQe6m6BUkdJXVczSmdVQNUgQOFNKRduWxYArN9nOIWnP5Pt7tZmCti+iX9Mt
+r+3eBXJz5Q0LqzHBOdzSTWs8lv8IdLNIrzxuiWlBqlBNrnIkyzzvcT0XZzk3ZILT
+MTW+j0HCEsaVOdG7T1l664BMHC+9EEbUnwdqZoQFntu9ja8+xBFOzmbAcCCxQhJT
+W7sF0WKtwOaByoJK07XJT97JQD0nd1LdQ0bkuiN9JFjSPdKaBW3NpzYiwfC5pv0c
+L8jQbLwNYnjywlabHks0Pg3daXRutefydr42dhWe8/5108If/OyFRLVDfepeRP7J
+K4lH05IZeZWvh/DifW0e0hepl0AGeN9s8KR4PcOgKd5r2EOBhK9FguEewL5Mr2Ab
+xlmsb06q2l2t5IDeQlIa2ElHxeWTGGsrUDt2/PfZMqmIo0a08QKCAQEA/3/ORQqI
+1rlSIgSxJKfKrgmnAJYEJVAWTpiIdbeEKWn8Z7PXHQNB15b4e8snm8W4yG3IJcFT
+t4ZtJ8Hbwwc8xYdLmbiTO1l8+fCWgT2JUG4+XtaKeG0/cTyQJebRb4QN8BpH8A02
+zoE71Wa7GV6coUZYggPNYj0foWezG+TQ6+MIF7zILA+3iALRt7MUUX4bRvlB5zEC
+hHmo9gExPypaxsolkgCzVgPUsY84hFbWULNDZPp15hyHGzCXhYg5M7xmSZjHasV+
+Zziqm9Yh465i7aCmadUysJfmx08frPcW0panzGpqISNNW4NycwwbExltlgfL8W2k
+J0cikpiLX3EvWQKCAQEA5d5Tm1teih7IGYnt1HXrTC6E4TX/J2WzHjIbE3BdyOcX
+KJMk+ooE7sZqYEyLEq1DIkxIsuxFUPLC6Gli+LaXtEnj6iBAXiPC91xMSDN/Qgdy
+mT3y3I7u885/rGlMXXMeot0A3DY67/d7wLOX3ie/wHyYk2VBuF6uicEp1SoXo8yp
+T9GvPEpT/16WxYMDL+cqmdhBX3j6p3ZWOQXOLwXnKzkaxMNXAHuVRjx5jl/XzLKB
+SZb4N9sc8BM97Fbev2g49ck7EJVGO/rNtriCa8dt5fK+0J0EONoqjufAIpUo40Eq
+4kFGFbxspEs6MhRrl4UkrQfwbqjT9vuLHH2QY6lQawKCAQEA7KFYz7au/3eJqvn/
+ejxwyXklE7TcyBYBYu+ASs4ZeCWx3/W+wB8ZJuuq3TRNTcb0maSbXuRLfcjhZZX0
+zA7y6NqiWQ+KRMhfqDh7m9z7ROOlnj5C5r//pwd5VbENvaNnKT2d7KTAYsdsO/u2
+QwvOMsutA1U0Lc0Ac4NQbgAgwqd1Ak8UcUJpL220/9a6dbM+3h/SOqW4eCsZIiX+
+j0rR4hSscSl27q4DmiNUK7UlLn6oZ2hUMzeupa7+VmzQ1aqibX0zDB83L7BaypOq
+tWz4MK6+EXykQsucsHEGnDIIECf55qeT/XbtmVkHcaf/l1PQm8hCySpLgxkt2umv
+A0kXmQKCAQEAwoGZH2l2GsunKC0VKOVK4CCw4dyN9ilRImjljlJTmW8ponS4IqPt
+Ppp4YtoCCCDCIOCJ15SjprZ0hLLAQ5JF1hF8IJ1/uejqzeK0zZd9xEKHDvJjcYwk
+1/rQ//Pt4VlLACaf1rawsmMovUt6Y0ohMGB9vqM8tCSx7fCcVDqU3E6OqfLVI+AF
+KZ5BWAnfBYbG/n0F/CJjfpZcqU2nRRTqoiFk7EAae1cXXeJIPVgOQ7B8Q+fSS3lG
+CENP748mVrJ7GEdZilO1pYU40rdX7JlI/f2kxuNGMlExF9E0PE8Y1QtMnTz8b+IL
+0A2zxbKPxBuuiBeitBB5o5EACnCZYCth1wKCAQEAj8wpxR7HKE51Bl6a48il1Lhj
+5g6/wXa1a3lGbos4DaJ5YzGREjnxFzt9EjoAKvebsxJ+ScC/s1b0IKitfzfPu+U3
+6ukR7zL+X18QbL2WYouVBd99SZ6FF+EUFgrYNfM+3ZKTNQpUZt3K4D2l6WCzcjkO
+qU8/QRdl4a4AXO4czGn3qQXiTVdr7T31vFryhAbSJhOhIEaIo41NLzr7s3vEKz4j
+ir7bP7YYYx+LXD0kROa6nCUO66U/FCMHWXQvp7MrxxJVwBN6nePL7dVOSc82OaYW
+Le+VcKGfLbE5Othruf12kbfWg8Pu5xU3KPA73VtrZ/BzWYbbelsPj8TtJ9T8Aw==
+-----END RSA PRIVATE KEY-----

.github/workflows/fips/compose/server/go.mod

@@ -0,0 +1,13 @@
+module server
+
+go 1.23.5
+
+require (
+	github.com/gliderlabs/ssh v0.3.8
+	golang.org/x/crypto v0.32.0
+)
+
+require (
+	github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be // indirect
+	golang.org/x/sys v0.29.0 // indirect
+)

.github/workflows/fips/compose/server/go.sum

@@ -0,0 +1,10 @@
+github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
+github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4=
+github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=
+github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU=
+golang.org/x/crypto v0.32.0 h1:euUpcYgM8WcP71gNpTqQCn6rC2t6ULUPiOzfWaXVVfc=
+golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc=
+golang.org/x/sys v0.29.0 h1:TPYlXGxvx1MGTn2GiZDhnjPA9wZzZeGKHHmKhHYvgaU=
+golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/term v0.28.0 h1:/Ts8HFuMR2E6IP/jlo7QVLZHggjKQbhu/7H0LJFr3Gg=
+golang.org/x/term v0.28.0/go.mod h1:Sw/lC2IAUZ92udQNf3WodGtn4k/XoLyZoh8v/8uiwek=