Skip to content

Commit f146f06

Browse files
lrstewartlrstewart
authored
Revert "ci: remove openssl-1.0.2-fips builds (#4995)" (#5060)
1 parent eab019f commit f146f06

9 files changed

Lines changed: 128 additions & 2 deletions

‎codebuild/bin/install_default_dependencies.sh‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,10 @@ if [[ "$S2N_LIBCRYPTO" == "openssl-1.0.2" && ! -d "$OPENSSL_1_0_2_INSTALL_DIR" ]
4343
codebuild/bin/install_openssl_1_0_2.sh "$(mktemp -d)" "$OPENSSL_1_0_2_INSTALL_DIR" "$OS_NAME" > /dev/null ;
4444
fi
4545

46+
# Download and Install the Openssl FIPS module and Openssl 1.0.2-fips
47+
if [[ "$S2N_LIBCRYPTO" == "openssl-1.0.2-fips" ]] && [[ ! -d "$OPENSSL_1_0_2_FIPS_INSTALL_DIR" ]]; then
48+
codebuild/bin/install_openssl_1_0_2_fips.sh "$(mktemp -d)" "$OPENSSL_1_0_2_FIPS_INSTALL_DIR" "$OS_NAME" ; fi
49+
4650
# Download and Install LibreSSL
4751
if [[ "$S2N_LIBCRYPTO" == "libressl" && ! -d "$LIBRESSL_INSTALL_DIR" ]]; then
4852
mkdir -p "$LIBRESSL_INSTALL_DIR"||true

‎codebuild/bin/install_openssl_1_0_2_fips.sh‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
#!/usr/bin/env bash
2+
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
3+
#
4+
# Licensed under the Apache License, Version 2.0 (the "License").
5+
# You may not use this file except in compliance with the License.
6+
# A copy of the License is located at
7+
#
8+
# http://aws.amazon.com/apache2.0
9+
#
10+
# or in the "license" file accompanying this file. This file is distributed
11+
# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
12+
# express or implied. See the License for the specific language governing
13+
# permissions and limitations under the License.
14+
#
15+
16+
set -ex
17+
pushd "$(pwd)"
18+
19+
usage() {
20+
echo "install_openssl_1_0_2_fips.sh build_dir install_dir os_name"
21+
exit 1
22+
}
23+
24+
if [ "$#" -ne "3" ]; then
25+
usage
26+
fi
27+
28+
BUILD_DIR=$1
29+
INSTALL_DIR=$2
30+
OS_NAME=$3
31+
32+
if [ "$OS_NAME" == "linux" ]; then
33+
CONFIGURE="./config -d"
34+
elif [ "$OS_NAME" == "osx" ]; then
35+
echo "WARNING: FIPS and MacOS is not officially supported. This build should only be used for local debugging."
36+
echo "See: http://openssl.6102.n7.nabble.com/Openssl-Fips-build-for-Mac-OSX-64-bit-td44716.html"
37+
CONFIGURE="./Configure darwin64-x86_64-cc"
38+
else
39+
echo "Invalid platform! $OS_NAME"
40+
usage
41+
fi
42+
43+
# Install the FIPS object module in accordance with OpenSSL FIPS 140-2 Security Policy Annex A.
44+
# https://www.openssl.org/docs/fips/SecurityPolicy-2.0.pdf
45+
# This installation is not FIPS compliant as we do not own the build system architecture.
46+
# It may only be used for testing purposes.
47+
#
48+
# There is no 'latest' download URL for the FIPS object modules
49+
cd "$BUILD_DIR"
50+
# Originally from: http://www.openssl.org/source/openssl-fips-2.0.13.tar.gz
51+
curl --retry 3 https://s3-us-west-2.amazonaws.com/s2n-public-test-dependencies/2017-08-31_openssl-fips-2.0.13.tar.gz --output openssl-fips-2.0.13.tar.gz
52+
gunzip -c openssl-fips-2.0.13.tar.gz | tar xf -
53+
rm openssl-fips-2.0.13.tar.gz
54+
cd openssl-fips-2.0.13
55+
mkdir ../OpensslFipsModule
56+
FIPSDIR="$(pwd)/../OpensslFipsModule"
57+
export FIPSDIR
58+
chmod +x ./Configure
59+
$CONFIGURE
60+
make
61+
make install
62+
63+
cd "$BUILD_DIR"
64+
curl --retry 3 -L https://github.com/openssl/openssl/archive/OpenSSL_1_0_2-stable.zip --output openssl-OpenSSL_1_0_2-stable.zip
65+
unzip openssl-OpenSSL_1_0_2-stable.zip
66+
cd openssl-OpenSSL_1_0_2-stable
67+
68+
FIPS_OPTIONS="fips --with-fipsdir=$FIPSDIR shared"
69+
70+
$CONFIGURE $FIPS_OPTIONS -g3 -fPIC no-libunbound no-gmp no-jpake no-krb5 no-md2 no-rc5 \
71+
no-rfc3779 no-sctp no-ssl-trace no-store no-zlib no-hw no-mdc2 no-seed no-idea \
72+
enable-ec_nistp_64_gcc_128 no-camellia no-bf no-ripemd no-dsa no-ssl2 no-capieng -DSSL_FORBID_ENULL \
73+
-DOPENSSL_NO_DTLS1 -DOPENSSL_NO_HEARTBEATS --prefix="$INSTALL_DIR"
74+
75+
make depend
76+
make
77+
make install_sw
78+
79+
popd
80+
81+
exit 0
82+

‎codebuild/bin/s2n_set_build_preset.sh‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,10 @@ case "${S2N_BUILD_PRESET-default}" in
4949
: "${S2N_LIBCRYPTO:=openssl-1.0.2}"
5050
: "${GCC_VERSION:=6}"
5151
;;
52+
"openssl-1.0.2-fips")
53+
: "${S2N_LIBCRYPTO:=openssl-1.0.2-fips}"
54+
: "${GCC_VERSION:=6}"
55+
;;
5256
"openssl-1.1.1_gcc4-8")
5357
: "${S2N_LIBCRYPTO:=openssl-1.1.1}"
5458
: "${GCC_VERSION:=4.8}"

‎codebuild/bin/s2n_setup_env.sh‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@ source codebuild/bin/s2n_set_build_preset.sh
4242
: "${OPENSSL_3_0_INSTALL_DIR:=$TEST_DEPS_DIR/openssl-3.0}"
4343
: "${OPENSSL_1_0_2_INSTALL_DIR:=$TEST_DEPS_DIR/openssl-1.0.2}"
4444
: "${OQS_OPENSSL_1_1_1_INSTALL_DIR:=$TEST_DEPS_DIR/oqs_openssl-1.1.1}"
45+
: "${OPENSSL_1_0_2_FIPS_INSTALL_DIR:=$TEST_DEPS_DIR/openssl-1.0.2-fips}"
4546
: "${BORINGSSL_INSTALL_DIR:=$TEST_DEPS_DIR/boringssl}"
4647
: "${AWSLC_INSTALL_DIR:=$TEST_DEPS_DIR/awslc}"
4748
: "${AWSLC_FIPS_INSTALL_DIR:=$TEST_DEPS_DIR/awslc-fips}"
@@ -98,6 +99,7 @@ export SCAN_BUILD_INSTALL_DIR
9899
export OPENSSL_1_1_1_INSTALL_DIR
99100
export OPENSSL_3_0_INSTALL_DIR
100101
export OPENSSL_1_0_2_INSTALL_DIR
102+
export OPENSSL_1_0_2_FIPS_INSTALL_DIR
101103
export OQS_OPENSSL_1_1_1_INSTALL_DIR
102104
export BORINGSSL_INSTALL_DIR
103105
export AWSLC_INSTALL_DIR
@@ -126,6 +128,10 @@ if [[ -z $S2N_LIBCRYPTO ]]; then export LIBCRYPTO_ROOT=$OPENSSL_1_1_1_INSTALL_DI
126128
if [[ "$S2N_LIBCRYPTO" == "openssl-1.1.1" ]]; then export LIBCRYPTO_ROOT=$OPENSSL_1_1_1_INSTALL_DIR ; fi
127129
if [[ "$S2N_LIBCRYPTO" == "openssl-3.0" ]]; then export LIBCRYPTO_ROOT=$OPENSSL_3_0_INSTALL_DIR ; fi
128130
if [[ "$S2N_LIBCRYPTO" == "openssl-1.0.2" ]]; then export LIBCRYPTO_ROOT=$OPENSSL_1_0_2_INSTALL_DIR ; fi
131+
if [[ "$S2N_LIBCRYPTO" == "openssl-1.0.2-fips" ]]; then
132+
export LIBCRYPTO_ROOT=$OPENSSL_1_0_2_FIPS_INSTALL_DIR ;
133+
export S2N_TEST_IN_FIPS_MODE=1 ;
134+
fi
129135
if [[ "$S2N_LIBCRYPTO" == "boringssl" ]]; then export LIBCRYPTO_ROOT=$BORINGSSL_INSTALL_DIR ; fi
130136
if [[ "$S2N_LIBCRYPTO" == "awslc" ]]; then export LIBCRYPTO_ROOT=$AWSLC_INSTALL_DIR ; fi
131137
if [[ "$S2N_LIBCRYPTO" == "awslc-fips" ]]; then export LIBCRYPTO_ROOT=$AWSLC_FIPS_INSTALL_DIR ; fi

‎codebuild/spec/buildspec_fuzz_batch.yml‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,4 +68,14 @@ batch:
6868
privileged-mode: true
6969
variables:
7070
S2N_LIBCRYPTO: openssl-3.0
71-
COMPILER: clang
71+
COMPILER: clang
72+
- identifier: clang_openssl_1_0_2_fips
73+
buildspec: codebuild/spec/buildspec_fuzz.yml
74+
debug-session: true
75+
env:
76+
compute-type: BUILD_GENERAL1_XLARGE
77+
image: 024603541914.dkr.ecr.us-west-2.amazonaws.com/docker:ubuntu22codebuild
78+
privileged-mode: true
79+
variables:
80+
S2N_LIBCRYPTO: openssl-1.0.2-fips
81+
COMPILER: clang

‎codebuild/spec/buildspec_valgrind.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,13 @@ batch:
5050
variables:
5151
S2N_LIBCRYPTO: openssl-1.0.2
5252
COMPILER: gcc
53+
- identifier: gcc_openssl_1_0_2_fips
54+
env:
55+
compute-type: BUILD_GENERAL1_LARGE
56+
image: 024603541914.dkr.ecr.us-west-2.amazonaws.com/docker:ubuntu22codebuild
57+
variables:
58+
S2N_LIBCRYPTO: openssl-1.0.2-fips
59+
COMPILER: gcc
5360

5461
phases:
5562
pre_build:

‎tests/integrationv2/conftest.py‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,9 @@ def pytest_configure(config: pytest.Config):
6161
config.stash[PATH_CONFIGURATION_KEY] = available_providers()
6262

6363
provider_version = config.getoption('provider-version', None)
64-
if "fips" in provider_version:
64+
# By default, any libcrypto with "fips" in its name should be in fips mode.
65+
# However, s2n-tls no longer supports fips mode with openssl-1.0.2-fips.
66+
if "fips" in provider_version and "openssl-1.0.2-fips" not in provider_version:
6567
set_flag(S2N_FIPS_MODE, True)
6668
set_flag(S2N_PROVIDER_VERSION, provider_version)
6769

‎tests/integrationv2/test_sslyze.py‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -227,6 +227,11 @@ def invalid_sslyze_scan_parameters(*args, **kwargs):
227227
sslyze.ScanCommand.SESSION_RENEGOTIATION
228228
]:
229229
return True
230+
# BUG_IN_SSLYZE error for session resumption scan with openssl 1.0.2 fips
231+
if "openssl-1.0.2-fips" in get_flag(S2N_PROVIDER_VERSION):
232+
if scan_command == sslyze.ScanCommand.SESSION_RESUMPTION:
233+
return True
234+
230235
return invalid_test_parameters(*args, **kwargs)
231236

232237

@@ -308,6 +313,11 @@ def invalid_certificate_scans_parameters(*args, **kwargs):
308313
# SSLyze curves scan errors when given ECDSA certs
309314
if "ECDSA" in certificate.name:
310315
return True
316+
317+
# SSLyze curves scan fails to validate with openssl 1.0.2 fips
318+
if "openssl-1.0.2-fips" in get_flag(S2N_PROVIDER_VERSION):
319+
return True
320+
311321
return invalid_test_parameters(*args, **kwargs)
312322

313323

‎tests/unit/s2n_build_test.c‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,7 @@ S2N_RESULT s2n_check_supported_libcrypto(const char *s2n_libcrypto)
8080
{ .libcrypto = "boringssl", .is_openssl = false },
8181
{ .libcrypto = "libressl", .is_openssl = false },
8282
{ .libcrypto = "openssl-1.0.2", .is_openssl = true },
83+
{ .libcrypto = "openssl-1.0.2-fips", .is_openssl = true },
8384
{ .libcrypto = "openssl-1.1.1", .is_openssl = true },
8485
{ .libcrypto = "openssl-3.0", .is_openssl = true },
8586
{ .libcrypto = "openssl-3.4", .is_openssl = true },

0 commit comments

Comments
 (0)