Skip to content

Commit 0a8ac3b

Browse files
EnmkEnmk
authored
Merge pull request #373 from Altinity/customizations/23.3.19-fips
23.3.19 FIPS Pre-release
2 parents 19a57e6 + c5978a0 commit 0a8ac3b

File tree

19 files changed

+338
-54
lines changed

19 files changed

+338
-54
lines changed

‎.github/workflows/release_branches.yml‎

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -140,7 +140,7 @@ jobs:
140140
timeout_minutes: 180
141141
runner_type: altinity-on-demand, altinity-type-ccx53, altinity-in-ash, altinity-image-x86-app-docker-ce
142142
additional_envs: |
143-
CLICKHOUSE_STABLE_VERSION_SUFFIX=altinitystable
143+
CLICKHOUSE_STABLE_VERSION_SUFFIX=altinityfips
144144
145145
BuilderDebAarch64:
146146
needs: [DockerHubPush]
@@ -152,7 +152,7 @@ jobs:
152152
timeout_minutes: 180
153153
runner_type: altinity-on-demand, altinity-type-ccx53, altinity-in-ash, altinity-image-x86-app-docker-ce
154154
additional_envs: |
155-
CLICKHOUSE_STABLE_VERSION_SUFFIX=altinitystable
155+
CLICKHOUSE_STABLE_VERSION_SUFFIX=altinityfips
156156
157157
BuilderDebAsan:
158158
needs: [DockerHubPush]
@@ -177,7 +177,7 @@ jobs:
177177
runner_type: altinity-on-demand, altinity-type-ccx53, altinity-in-ash, altinity-image-x86-app-docker-ce
178178
additional_envs: |
179179
CLICKHOUSE_STABLE_VERSION_SUFFIX=altinitystable
180-
180+
181181
BuilderDebTsan:
182182
needs: [DockerHubPush]
183183
uses: ./.github/workflows/reusable_build.yml
@@ -353,7 +353,7 @@ jobs:
353353
run_command: |
354354
cd "$REPO_COPY/tests/ci"
355355
python3 functional_test_check.py "$CHECK_NAME" "$KILL_TIMEOUT"
356-
356+
357357
FunctionalStatelessTestTsan:
358358
needs: [BuilderDebTsan]
359359
uses: ./.github/workflows/reusable_test.yml
@@ -367,7 +367,7 @@ jobs:
367367
run_command: |
368368
cd "$REPO_COPY/tests/ci"
369369
python3 functional_test_check.py "$CHECK_NAME" "$KILL_TIMEOUT"
370-
370+
371371
FunctionalStatelessTestUBsan:
372372
needs: [BuilderDebUBsan]
373373
uses: ./.github/workflows/reusable_test.yml
@@ -381,7 +381,7 @@ jobs:
381381
run_command: |
382382
cd "$REPO_COPY/tests/ci"
383383
python3 functional_test_check.py "$CHECK_NAME" "$KILL_TIMEOUT"
384-
384+
385385
FunctionalStatelessTestMsan:
386386
needs: [BuilderDebMsan]
387387
uses: ./.github/workflows/reusable_test.yml
@@ -395,7 +395,7 @@ jobs:
395395
run_command: |
396396
cd "$REPO_COPY/tests/ci"
397397
python3 functional_test_check.py "$CHECK_NAME" "$KILL_TIMEOUT"
398-
398+
399399
FunctionalStatelessTestDebug:
400400
needs: [BuilderDebDebug]
401401
uses: ./.github/workflows/reusable_test.yml
@@ -451,7 +451,7 @@ jobs:
451451
run_command: |
452452
cd "$REPO_COPY/tests/ci"
453453
python3 functional_test_check.py "$CHECK_NAME" "$KILL_TIMEOUT"
454-
454+
455455
FunctionalStatefulTestTsan:
456456
needs: [BuilderDebTsan]
457457
uses: ./.github/workflows/reusable_test.yml
@@ -464,7 +464,7 @@ jobs:
464464
run_command: |
465465
cd "$REPO_COPY/tests/ci"
466466
python3 functional_test_check.py "$CHECK_NAME" "$KILL_TIMEOUT"
467-
467+
468468
FunctionalStatefulTestMsan:
469469
needs: [BuilderDebMsan]
470470
uses: ./.github/workflows/reusable_test.yml
@@ -477,7 +477,7 @@ jobs:
477477
run_command: |
478478
cd "$REPO_COPY/tests/ci"
479479
python3 functional_test_check.py "$CHECK_NAME" "$KILL_TIMEOUT"
480-
480+
481481
FunctionalStatefulTestUBsan:
482482
needs: [BuilderDebUBsan]
483483
uses: ./.github/workflows/reusable_test.yml
@@ -490,7 +490,7 @@ jobs:
490490
run_command: |
491491
cd "$REPO_COPY/tests/ci"
492492
python3 functional_test_check.py "$CHECK_NAME" "$KILL_TIMEOUT"
493-
493+
494494
FunctionalStatefulTestDebug:
495495
needs: [BuilderDebDebug]
496496
uses: ./.github/workflows/reusable_test.yml
@@ -503,7 +503,7 @@ jobs:
503503
run_command: |
504504
cd "$REPO_COPY/tests/ci"
505505
python3 functional_test_check.py "$CHECK_NAME" "$KILL_TIMEOUT"
506-
506+
507507
##############################################################################################
508508
######################################### STRESS TESTS #######################################
509509
##############################################################################################
@@ -517,7 +517,7 @@ jobs:
517517
run_command: |
518518
cd "$REPO_COPY/tests/ci"
519519
python3 stress_check.py "$CHECK_NAME"
520-
520+
521521
StressTestTsan:
522522
needs: [BuilderDebTsan]
523523
uses: ./.github/workflows/reusable_test.yml
@@ -528,7 +528,7 @@ jobs:
528528
run_command: |
529529
cd "$REPO_COPY/tests/ci"
530530
python3 stress_check.py "$CHECK_NAME"
531-
531+
532532
StressTestMsan:
533533
needs: [BuilderDebMsan]
534534
uses: ./.github/workflows/reusable_test.yml
@@ -539,7 +539,7 @@ jobs:
539539
run_command: |
540540
cd "$REPO_COPY/tests/ci"
541541
python3 stress_check.py "$CHECK_NAME"
542-
542+
543543
StressTestUBsan:
544544
needs: [BuilderDebUBsan]
545545
uses: ./.github/workflows/reusable_test.yml
@@ -550,7 +550,7 @@ jobs:
550550
run_command: |
551551
cd "$REPO_COPY/tests/ci"
552552
python3 stress_check.py "$CHECK_NAME"
553-
553+
554554
StressTestDebug:
555555
needs: [BuilderDebDebug]
556556
uses: ./.github/workflows/reusable_test.yml
@@ -577,7 +577,7 @@ jobs:
577577
run_command: |
578578
cd "$REPO_COPY/tests/ci"
579579
python3 integration_test_check.py "$CHECK_NAME"
580-
580+
581581
IntegrationTestsAnalyzerAsan:
582582
needs: [BuilderDebAsan]
583583
uses: ./.github/workflows/reusable_test.yml
@@ -590,7 +590,7 @@ jobs:
590590
run_command: |
591591
cd "$REPO_COPY/tests/ci"
592592
python3 integration_test_check.py "$CHECK_NAME"
593-
593+
594594
IntegrationTestsTsan:
595595
needs: [BuilderDebTsan]
596596
uses: ./.github/workflows/reusable_test.yml
@@ -627,7 +627,7 @@ jobs:
627627
with:
628628
runner_type: altinity-on-demand, altinity-type-cpx51, altinity-image-x86-app-docker-ce, altinity-setup-regression
629629
commit: 6da94b78dc53cb8965ab56c04a89ebf54ed04cbc
630-
arch: release
630+
arch: release
631631
build_sha: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.event_name == 'release' && github.sha }}
632632

633633
RegressionTestsAarch64:

‎CMakeLists.txt‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,10 @@ option(FAIL_ON_UNSUPPORTED_OPTIONS_COMBINATION
77
"Stop/Fail CMake configuration if some ENABLE_XXX option is defined (either ON or OFF)
88
but is not possible to satisfy" ON)
99

10+
option(FIPS_CLICKHOUSE
11+
"Build ClickHouse in FIPS mode: that is both BoringSSL and Poco are build in FIPS mode"
12+
ON)
13+
1014
if(FAIL_ON_UNSUPPORTED_OPTIONS_COMBINATION)
1115
set(RECONFIGURE_MESSAGE_LEVEL FATAL_ERROR)
1216
else()

‎cmake/autogenerated_versions.txt‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,9 @@ SET(VERSION_MINOR 3)
88
SET(VERSION_PATCH 19)
99
SET(VERSION_GITHASH 7228475d77afaf8a59d489694343593d3b650170)
1010

11-
SET(VERSION_TWEAK 33)
12-
SET(VERSION_FLAVOUR altinitystable)
11+
SET(VERSION_TWEAK 34)
12+
SET(VERSION_FLAVOUR altinityfips)
1313

14-
SET(VERSION_DESCRIBE v23.3.19.33.altinitystable)
15-
SET(VERSION_STRING 23.3.19.33.altinitystable)
14+
SET(VERSION_DESCRIBE v23.3.19.34.altinityfips)
15+
SET(VERSION_STRING 23.3.19.34.altinityfips)
1616
# end of autochange

‎cmake/split_debug_symbols.cmake‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,19 @@ macro(clickhouse_split_debug_symbols)
1515
message(FATAL_ERROR "Destination directory for stripped binary must be provided")
1616
endif()
1717

18+
set(STRIP_EXTRA_ARGS "")
19+
if (FIPS_CHLICKHOUSE)
20+
# For FIPS tests (hash-break and to run properly, we need to keep some symbols
21+
foreach(symbol_name IN ITEMS
22+
BORINGSSL_bcm_rodata_start
23+
BORINGSSL_bcm_rodata_end
24+
BORINGSSL_bcm_text_start
25+
BORINGSSL_bcm_text_end
26+
)
27+
set(STRIP_EXTRA_ARGS "${STRIP_EXTRA_ARGS} -K ${symbol_name}")
28+
endforeach()
29+
endif()
30+
1831
add_custom_command(TARGET ${STRIP_TARGET} POST_BUILD
1932
COMMAND mkdir -p "${STRIP_DESTINATION_DIR}/lib/debug/bin"
2033
COMMAND mkdir -p "${STRIP_DESTINATION_DIR}/bin"
@@ -23,7 +36,7 @@ macro(clickhouse_split_debug_symbols)
2336
COMMAND "${OBJCOPY_PATH}" --only-keep-debug "${STRIP_DESTINATION_DIR}/bin/${STRIP_TARGET}" "${STRIP_DESTINATION_DIR}/lib/debug/bin/${STRIP_TARGET}.debug"
2437
COMMAND chmod 0644 "${STRIP_DESTINATION_DIR}/lib/debug/bin/${STRIP_TARGET}.debug"
2538
# Strips binary, sections '.note' & '.comment' are removed in line with Debian's stripping policy: www.debian.org/doc/debian-policy/ch-files.html, section '.clickhouse.hash' is needed for integrity check:
26-
COMMAND "${STRIP_PATH}" --remove-section=.comment --remove-section=.note --keep-section=.clickhouse.hash "${STRIP_DESTINATION_DIR}/bin/${STRIP_TARGET}"
39+
COMMAND "${STRIP_PATH}" --remove-section=.comment --remove-section=.note --keep-section=.clickhouse.hash ${STRIP_EXTRA_ARGS} "${STRIP_DESTINATION_DIR}/bin/${STRIP_TARGET}"
2740
# Associate stripped binary with debug symbols:
2841
COMMAND "${OBJCOPY_PATH}" --add-gnu-debuglink "${STRIP_DESTINATION_DIR}/lib/debug/bin/${STRIP_TARGET}.debug" "${STRIP_DESTINATION_DIR}/bin/${STRIP_TARGET}"
2942
COMMENT "Stripping clickhouse binary" VERBATIM

‎contrib/boringssl-cmake/CMakeLists.txt‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,124 @@ if(NOT ENABLE_SSL)
1313
return()
1414
endif()
1515

16+
if(FIPS_CLICKHOUSE)
17+
18+
set(BORINGSSL_BUILD_DIR "${CMAKE_BINARY_DIR}/go1.19-boringssl-build")
19+
set(BORINGSSL_BINARIES_DIR "${BORINGSSL_BUILD_DIR}/output")
20+
21+
message("Will build BoringSSL in FIPS mode according to go1.19 recipe...")
22+
# build BoringSSL in FIPS mode accoring to the Security Policy:
23+
# https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp3678.pdf
24+
# We re-use golang-1.19 routine, for that we need only 3 files from golang repo, so no need to checkout a full repository:
25+
# - src/crypto/internal/boring/Dockerfile - build environment
26+
# - src/crypto/internal/boring/build.sh - build and test script
27+
# - src/crypto/internal/boring/goboringcrypto.h - required for producing golangs syso (whuch we do not need), but build will fail without it.
28+
# hashsums were calculated on 28 Dec 2022
29+
30+
message("Downloading build files from go1.19 github...")
31+
file(DOWNLOAD
32+
https://raw.githubusercontent.com/golang/go/go1.19/src/crypto/internal/boring/goboringcrypto.h
33+
${BORINGSSL_BUILD_DIR}/goboringcrypto.h
34+
EXPECTED_HASH SHA256=2bea41082e0cc2bdfc6d5fccc64544cb52cc889e6e99330a6b423f04fef48a57
35+
SHOW_PROGRESS
36+
)
37+
38+
file(DOWNLOAD
39+
https://raw.githubusercontent.com/golang/go/go1.19/src/crypto/internal/boring/Dockerfile
40+
${BORINGSSL_BUILD_DIR}/Dockerfile
41+
EXPECTED_HASH SHA256=c7d3d13d028f542af5dd9f173ad7b7a29bc398f61bb5dd228e6da48b05ea5487
42+
SHOW_PROGRESS
43+
)
44+
45+
file(DOWNLOAD
46+
https://raw.githubusercontent.com/golang/go/go1.19/src/crypto/internal/boring/build.sh
47+
${BORINGSSL_BUILD_DIR}/build.sh
48+
EXPECTED_HASH SHA256=b4daa2ee2c1ce735c8720eb22d4ef21f9a7a03c737230bddf3582b0fed1b3728
49+
SHOW_PROGRESS
50+
)
51+
52+
# Build driver - the script that triggers the build and pulls out results from docker container
53+
file(WRITE ${BORINGSSL_BUILD_DIR}/build_boringssl_fips.sh
54+
"#!/bin/bash
55+
set -ex
56+
57+
OUTPUT_DIR=$1
58+
shift
59+
60+
docker build . -t boringssl-builder
61+
readonly id=$(docker create boringssl-builder)
62+
63+
docker start -a $id #| tr -dc \\\\x0-\\\\x9
64+
65+
mkdir -p $OUTPUT_DIR
66+
67+
# Copy build artifacts
68+
docker cp $id:/boring/boringssl/build/ssl/libssl.a $OUTPUT_DIR
69+
docker cp $id:/boring/boringssl/build/crypto/libcrypto.a $OUTPUT_DIR
70+
docker cp $id:/boring/boringssl/build/decrepit/libdecrepit.a $OUTPUT_DIR
71+
docker cp $id:/boring/boringssl/include $OUTPUT_DIR
72+
73+
docker rm $id"
74+
)
75+
76+
# patch a single file in krb5 that relies on file missing from this version of BoringSSL
77+
SET(krb5_filb_to_patch ${PROJECT_SOURCE_DIR}/contrib/krb5/src/lib/crypto/openssl/enc_provider/aes.c)
78+
message("Patching ${krb5_filb_to_patch} to allow building against older version of BoringSSL")
79+
file(READ ${krb5_filb_to_patch} FILE_CONTENTS)
80+
string(REPLACE "#include <openssl/modes.h>" "//#include <openssl/modes.h>" FILE_CONTENTS "${FILE_CONTENTS}")
81+
file(WRITE ${krb5_filb_to_patch} "${FILE_CONTENTS}")
82+
83+
message("Creating directory for BoringSSL binaries and includes in ${BORINGSSL_BINARIES_DIR}")
84+
execute_process(COMMAND ${CMAKE_COMMAND} -E make_directory "${BORINGSSL_BINARIES_DIR}/include")
85+
86+
add_custom_target(build-boringssl
87+
# COMMENT "Build BoringSSL in FIPS mode with docker (using go1.19 build suite)"
88+
DEPENDS ${BORINGSSL_BINARIES_DIR}/libssl.a ${BORINGSSL_BINARIES_DIR}/libcrypto.a
89+
)
90+
91+
add_custom_command(
92+
OUTPUT
93+
"${BORINGSSL_BUILD_DIR}/output/libssl.a"
94+
"${BORINGSSL_BUILD_DIR}/output/libcrypto.a"
95+
"${BORINGSSL_BUILD_DIR}/output/libdecrepit.a"
96+
COMMENT "Building BoringSSL in FIPS mode using Docker"
97+
COMMAND bash -c "chmod +x ${BORINGSSL_BUILD_DIR}/build_boringssl_fips.sh ${BORINGSSL_BUILD_DIR}/build.sh"
98+
COMMAND bash -c "${BORINGSSL_BUILD_DIR}/build_boringssl_fips.sh ${BORINGSSL_BINARIES_DIR}"
99+
WORKING_DIRECTORY ${BORINGSSL_BUILD_DIR}
100+
USES_TERMINAL # To stream output
101+
DEPENDS
102+
${BORINGSSL_BUILD_DIR}/build.sh
103+
${BORINGSSL_BUILD_DIR}/goboringcrypto.h
104+
${BORINGSSL_BUILD_DIR}/Dockerfile
105+
)
106+
107+
add_library(_crypto UNKNOWN IMPORTED GLOBAL)
108+
add_dependencies(_crypto build-boringssl)
109+
set_target_properties(_crypto PROPERTIES
110+
IMPORTED_LINK_INTERFACE_LANGUAGES "CXX"
111+
IMPORTED_LOCATION "${BORINGSSL_BINARIES_DIR}/libcrypto.a"
112+
INTERFACE_INCLUDE_DIRECTORIES "${BORINGSSL_BINARIES_DIR}/include"
113+
)
114+
115+
add_library(_decrepit UNKNOWN IMPORTED)
116+
add_dependencies(_decrepit build-boringssl)
117+
set_target_properties(_decrepit PROPERTIES
118+
IMPORTED_LINK_INTERFACE_LANGUAGES "CXX"
119+
IMPORTED_LOCATION "${BORINGSSL_BINARIES_DIR}/libdecrepit.a"
120+
INTERFACE_INCLUDE_DIRECTORIES "${BORINGSSL_BINARIES_DIR}/include"
121+
)
122+
123+
add_library(_ssl UNKNOWN IMPORTED GLOBAL)
124+
add_dependencies(_ssl _crypto)
125+
set_target_properties(_ssl PROPERTIES
126+
IMPORTED_LINK_INTERFACE_LANGUAGES "CXX"
127+
IMPORTED_LOCATION "${BORINGSSL_BINARIES_DIR}/libssl.a"
128+
INTERFACE_INCLUDE_DIRECTORIES "${BORINGSSL_BINARIES_DIR}/include"
129+
INTERFACE_LINK_LIBRARIES _decrepit
130+
)
131+
132+
else() # FIPS_CLICKHOUSE
133+
16134
# Copyright (c) 2019 The Chromium Authors. All rights reserved.
17135
# Use of this source code is governed by a BSD-style license that can be
18136
# found in the LICENSE file.
@@ -687,6 +805,8 @@ target_include_directories(_ssl SYSTEM PUBLIC "${BORINGSSL_SOURCE_DIR}/include")
687805

688806
target_compile_options(_crypto PRIVATE -Wno-gnu-anonymous-struct)
689807

808+
endif() # FIPS_CLICKHOUSE
809+
690810
add_library(OpenSSL::Crypto ALIAS _crypto)
691811
add_library(OpenSSL::SSL ALIAS _ssl)
692812

0 commit comments

Comments
 (0)