Skip to content

Commit 4cb7e26

Browse files
ghedoghedo
committed
Clean-up legacy FIPS options
Per BoringSSL's FIPS policy, its `main` branch is the "update branch" for FedRAMP compliance's purposes. This means that we can stop using a specific BoringSSL branch when enabling FIPS, as well as a number of hacks that allowed us to build more recent BoringSSL versions with an older pre-compiled FIPS modules. This also required slightly updating the main BoringSSL submodule, as the previous version had an issue when building with the FIPS option enabled. This is turn required some changes to the PQ patch as well as some APIs that don't seem to be exposed publicly, as well as changing some paths in the other patches. In order to allow a smooth upgrade of internal projects, the `fips-compat` feature is reduced in scope and renamed to `legacy-compat-deprecated` so that we can incrementally upgrade internal BoringSSL forks. In practice this shouldn't really be something anyone else would need, since in order to work it requires a specific mix of BoringSSL version and backported patches.
1 parent 78b8cea commit 4cb7e26

File tree

20 files changed

+1464
-2048
lines changed

20 files changed

+1464
-2048
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -202,6 +202,10 @@ jobs:
202202
run: rustup update ${{ matrix.rust }} --no-self-update && rustup default ${{ matrix.rust }}
203203
shell: bash
204204
- run: rustup target add ${{ matrix.target }}
205+
- name: Install golang
206+
uses: actions/setup-go@v5
207+
with:
208+
go-version: '>=1.22.0'
205209
- name: Install target-specific APT dependencies
206210
if: "matrix.apt_packages != ''"
207211
run: sudo apt update && sudo apt install -y ${{ matrix.apt_packages }}
@@ -255,18 +259,10 @@ jobs:
255259
- name: Install Rust (rustup)
256260
run: rustup update stable --no-self-update && rustup default stable
257261
shell: bash
258-
- name: Install Clang-12
259-
uses: KyleMayes/install-llvm-action@v1
260-
with:
261-
version: "12.0.0"
262-
directory: ${{ runner.temp }}/llvm
263262
- name: Install golang
264263
uses: actions/setup-go@v5
265264
with:
266265
go-version: '>=1.22.0'
267-
- name: Add clang++-12 link
268-
working-directory: ${{ runner.temp }}/llvm/bin
269-
run: ln -s clang clang++-12
270266
- name: Run tests
271267
run: cargo test --features fips
272268
- name: Test boring-sys cargo publish (FIPS)
@@ -296,6 +292,10 @@ jobs:
296292
- name: Install Rust (rustup)
297293
run: rustup update stable --no-self-update && rustup default stable && rustup target add ${{ matrix.target }}
298294
shell: bash
295+
- name: Install golang
296+
uses: actions/setup-go@v5
297+
with:
298+
go-version: '>=1.22.0'
299299
- name: Install ${{ matrix.target }} toolchain
300300
run: brew tap messense/macos-cross-toolchains && brew install ${{ matrix.target }}
301301
- name: Set BORING_BSSL_SYSROOT

‎.gitmodules‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,3 @@
22
path = boring-sys/deps/boringssl
33
url = https://github.com/google/boringssl.git
44
ignore = dirty
5-
[submodule "boring-sys/deps/boringssl-fips"]
6-
path = boring-sys/deps/boringssl-fips
7-
url = https://github.com/google/boringssl.git

‎boring-sys/Cargo.toml‎

Lines changed: 10 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -19,35 +19,22 @@ include = [
1919
"/*.toml",
2020
"/LICENSE-MIT",
2121
"/cmake/*.cmake",
22-
# boringssl (non-FIPS)
23-
"/deps/boringssl/src/util/32-bit-toolchain.cmake",
2422
"/deps/boringssl/**/*.[chS]",
2523
"/deps/boringssl/**/*.asm",
26-
"/deps/boringssl/sources.json",
27-
"/deps/boringssl/src/crypto/obj/obj_mac.num",
28-
"/deps/boringssl/src/crypto/obj/objects.txt",
24+
"/deps/boringssl/**/*.pl",
25+
"/deps/boringssl/**/*.go",
26+
"/deps/boringssl/**/*.cmake",
27+
"/deps/boringssl/**/go.mod",
28+
"/deps/boringssl/**/go.sum",
29+
"/deps/boringssl/crypto/obj/obj_mac.num",
30+
"/deps/boringssl/crypto/obj/objects.txt",
31+
"/deps/boringssl/crypto/err/*.errordata",
2932
"/deps/boringssl/**/*.bzl",
30-
"/deps/boringssl/src/**/*.cc",
33+
"/deps/boringssl/**/*.cc",
3134
"/deps/boringssl/**/CMakeLists.txt",
3235
"/deps/boringssl/**/sources.cmake",
36+
"/deps/boringssl/**/util/go_tests.txt",
3337
"/deps/boringssl/LICENSE",
34-
# boringssl (FIPS)
35-
"/deps/boringssl-fips/src/util/32-bit-toolchain.cmake",
36-
"/deps/boringssl-fips/**/*.[chS]",
37-
"/deps/boringssl-fips/**/*.asm",
38-
"/deps/boringssl-fips/**/*.pl",
39-
"/deps/boringssl-fips/**/*.go",
40-
"/deps/boringssl-fips/**/go.mod",
41-
"/deps/boringssl-fips/**/go.sum",
42-
"/deps/boringssl-fips/sources.json",
43-
"/deps/boringssl-fips/crypto/obj/obj_mac.num",
44-
"/deps/boringssl-fips/crypto/obj/objects.txt",
45-
"/deps/boringssl-fips/crypto/err/*.errordata",
46-
"/deps/boringssl-fips/**/*.bzl",
47-
"/deps/boringssl-fips/**/*.cc",
48-
"/deps/boringssl-fips/**/CMakeLists.txt",
49-
"/deps/boringssl-fips/**/sources.cmake",
50-
"/deps/boringssl-fips/LICENSE",
5138
"/build/*",
5239
"/src",
5340
"/patches",
@@ -66,14 +53,6 @@ rustdoc-args = ["--cfg", "docsrs"]
6653
# for instructions and more details on the boringssl FIPS flag.
6754
fips = []
6855

69-
# Use a precompiled FIPS-validated version of BoringSSL. Meant to be used with
70-
# FIPS-20230428 or newer. Users must set `BORING_BSSL_FIPS_PATH` to use this
71-
# feature, or else the build will fail.
72-
fips-precompiled = []
73-
74-
# Link with precompiled FIPS-validated `bcm.o` module.
75-
fips-link-precompiled = []
76-
7756
# Enables Raw public key API (https://datatracker.ietf.org/doc/html/rfc7250)
7857
rpk = []
7958

‎boring-sys/build/config.rs‎

Lines changed: 1 addition & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,6 @@ pub(crate) struct Config {
1616

1717
pub(crate) struct Features {
1818
pub(crate) fips: bool,
19-
pub(crate) fips_precompiled: bool,
20-
pub(crate) fips_link_precompiled: bool,
2119
pub(crate) pq_experimental: bool,
2220
pub(crate) rpk: bool,
2321
pub(crate) underscore_wildcards: bool,
@@ -27,7 +25,6 @@ pub(crate) struct Env {
2725
pub(crate) path: Option<PathBuf>,
2826
pub(crate) include_path: Option<PathBuf>,
2927
pub(crate) source_path: Option<PathBuf>,
30-
pub(crate) precompiled_bcm_o: Option<PathBuf>,
3128
pub(crate) assume_patched: bool,
3229
pub(crate) sysroot: Option<PathBuf>,
3330
pub(crate) compiler_external_toolchain: Option<PathBuf>,
@@ -81,10 +78,6 @@ impl Config {
8178
panic!("`fips` and `rpk` features are mutually exclusive");
8279
}
8380

84-
if self.features.fips_precompiled && self.features.rpk {
85-
panic!("`fips-precompiled` and `rpk` features are mutually exclusive");
86-
}
87-
8881
let is_precompiled_native_lib = self.env.path.is_some();
8982
let is_external_native_lib_source =
9083
!is_precompiled_native_lib && self.env.source_path.is_none();
@@ -107,40 +100,26 @@ impl Config {
107100
"cargo:warning=precompiled BoringSSL was provided, so patches will be ignored"
108101
);
109102
}
110-
111-
// todo(rmehra): should this even be a restriction? why not let people link a custom bcm.o?
112-
// precompiled boringssl will include libcrypto.a
113-
if is_precompiled_native_lib && self.features.fips_link_precompiled {
114-
panic!("precompiled BoringSSL was provided, so FIPS configuration can't be applied");
115-
}
116-
117-
if !is_precompiled_native_lib && self.features.fips_precompiled {
118-
panic!("`fips-precompiled` feature requires `BORING_BSSL_FIPS_PATH` to be set");
119-
}
120103
}
121104
}
122105

123106
impl Features {
124107
fn from_env() -> Self {
125108
let fips = env::var_os("CARGO_FEATURE_FIPS").is_some();
126-
let fips_precompiled = env::var_os("CARGO_FEATURE_FIPS_PRECOMPILED").is_some();
127-
let fips_link_precompiled = env::var_os("CARGO_FEATURE_FIPS_LINK_PRECOMPILED").is_some();
128109
let pq_experimental = env::var_os("CARGO_FEATURE_PQ_EXPERIMENTAL").is_some();
129110
let rpk = env::var_os("CARGO_FEATURE_RPK").is_some();
130111
let underscore_wildcards = env::var_os("CARGO_FEATURE_UNDERSCORE_WILDCARDS").is_some();
131112

132113
Self {
133114
fips,
134-
fips_precompiled,
135-
fips_link_precompiled,
136115
pq_experimental,
137116
rpk,
138117
underscore_wildcards,
139118
}
140119
}
141120

142121
pub(crate) fn is_fips_like(&self) -> bool {
143-
self.fips || self.fips_precompiled || self.fips_link_precompiled
122+
self.fips
144123
}
145124
}
146125

@@ -175,7 +154,6 @@ impl Env {
175154
path: boringssl_var("BORING_BSSL_PATH").map(PathBuf::from),
176155
include_path: boringssl_var("BORING_BSSL_INCLUDE_PATH").map(PathBuf::from),
177156
source_path: boringssl_var("BORING_BSSL_SOURCE_PATH").map(PathBuf::from),
178-
precompiled_bcm_o: boringssl_var("BORING_BSSL_PRECOMPILED_BCM_O").map(PathBuf::from),
179157
assume_patched: boringssl_var("BORING_BSSL_ASSUME_PATCHED")
180158
.is_some_and(|v| !v.is_empty()),
181159
sysroot: boringssl_var("BORING_BSSL_SYSROOT").map(PathBuf::from),

‎boring-sys/build/main.rs‎

Lines changed: 8 additions & 112 deletions
Original file line numberDiff line numberDiff line change
@@ -50,20 +50,23 @@ const CMAKE_PARAMS_APPLE: &[(&str, &[(&str, &str)])] = &[
5050
&[
5151
("CMAKE_OSX_ARCHITECTURES", "arm64"),
5252
("CMAKE_OSX_SYSROOT", "iphoneos"),
53+
("CMAKE_MACOSX_BUNDLE", "OFF"),
5354
],
5455
),
5556
(
5657
"aarch64-apple-ios-sim",
5758
&[
5859
("CMAKE_OSX_ARCHITECTURES", "arm64"),
5960
("CMAKE_OSX_SYSROOT", "iphonesimulator"),
61+
("CMAKE_MACOSX_BUNDLE", "OFF"),
6062
],
6163
),
6264
(
6365
"x86_64-apple-ios",
6466
&[
6567
("CMAKE_OSX_ARCHITECTURES", "x86_64"),
6668
("CMAKE_OSX_SYSROOT", "iphonesimulator"),
69+
("CMAKE_MACOSX_BUNDLE", "OFF"),
6770
],
6871
),
6972
// macOS
@@ -114,11 +117,7 @@ fn get_boringssl_source_path(config: &Config) -> &PathBuf {
114117
static SOURCE_PATH: OnceLock<PathBuf> = OnceLock::new();
115118

116119
SOURCE_PATH.get_or_init(|| {
117-
let submodule_dir = if config.features.fips {
118-
"boringssl-fips"
119-
} else {
120-
"boringssl"
121-
};
120+
let submodule_dir = "boringssl";
122121

123122
let src_path = config.out_dir.join(submodule_dir);
124123

@@ -304,7 +303,7 @@ fn get_boringssl_cmake_config(config: &Config) -> cmake::Config {
304303
config
305304
.manifest_dir
306305
.join(src_path)
307-
.join("src/util/32-bit-toolchain.cmake")
306+
.join("util/32-bit-toolchain.cmake")
308307
.as_os_str(),
309308
);
310309
}
@@ -340,55 +339,6 @@ fn get_boringssl_cmake_config(config: &Config) -> cmake::Config {
340339
boringssl_cmake
341340
}
342341

343-
/// Verify that the toolchains match <https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp3678.pdf>
344-
/// See "Installation Instructions" under section 12.1.
345-
// TODO: maybe this should also verify the Go and Ninja versions? But those haven't been an issue in practice ...
346-
fn verify_fips_clang_version() -> (&'static str, &'static str) {
347-
fn version(tool: &str) -> Option<String> {
348-
let output = match Command::new(tool).arg("--version").output() {
349-
Ok(o) => o,
350-
Err(e) => {
351-
println!("cargo:warning=missing {tool}, trying other compilers: {e}");
352-
// NOTE: hard-codes that the loop below checks the version
353-
return None;
354-
}
355-
};
356-
if !output.status.success() {
357-
return Some(String::new());
358-
}
359-
let output = std::str::from_utf8(&output.stdout).expect("invalid utf8 output");
360-
Some(output.lines().next().expect("empty output").to_string())
361-
}
362-
363-
const REQUIRED_CLANG_VERSION: &str = "12.0.0";
364-
for (cc, cxx) in [
365-
("clang-12", "clang++-12"),
366-
("clang", "clang++"),
367-
("cc", "c++"),
368-
] {
369-
let (Some(cc_version), Some(cxx_version)) = (version(cc), version(cxx)) else {
370-
continue;
371-
};
372-
373-
if cc_version.contains(REQUIRED_CLANG_VERSION) {
374-
assert!(
375-
cxx_version.contains(REQUIRED_CLANG_VERSION),
376-
"mismatched versions of cc and c++"
377-
);
378-
return (cc, cxx);
379-
} else if cc == "cc" {
380-
panic!(
381-
"unsupported clang version \"{cc_version}\": FIPS requires clang {REQUIRED_CLANG_VERSION}"
382-
);
383-
} else if !cc_version.is_empty() {
384-
println!(
385-
"cargo:warning=FIPS requires clang version {REQUIRED_CLANG_VERSION}, skipping incompatible version \"{cc_version}\""
386-
);
387-
}
388-
}
389-
unreachable!()
390-
}
391-
392342
fn pick_best_android_ndk_toolchain(toolchains_dir: &Path) -> std::io::Result<OsString> {
393343
let toolchains = std::fs::read_dir(toolchains_dir)?.collect::<Result<Vec<_>, _>>()?;
394344
// First look for one of the toolchains that Google has documented.
@@ -591,66 +541,17 @@ fn built_boring_source_path(config: &Config) -> &PathBuf {
591541
}
592542

593543
if config.features.fips {
594-
let (clang, clangxx) = verify_fips_clang_version();
595-
cfg.define("CMAKE_C_COMPILER", clang)
596-
.define("CMAKE_CXX_COMPILER", clangxx)
597-
.define("CMAKE_ASM_COMPILER", clang)
544+
cfg.define("CMAKE_C_COMPILER", "clang")
545+
.define("CMAKE_CXX_COMPILER", "clang++")
546+
.define("CMAKE_ASM_COMPILER", "clang")
598547
.define("FIPS", "1");
599548
}
600549

601-
if config.features.fips_link_precompiled {
602-
cfg.define("FIPS", "1");
603-
}
604-
605550
cfg.build_target("ssl").build();
606551
cfg.build_target("crypto").build()
607552
})
608553
}
609554

610-
fn link_in_precompiled_bcm_o(config: &Config) {
611-
println!("cargo:warning=linking in precompiled `bcm.o` module");
612-
613-
let bssl_dir = built_boring_source_path(config);
614-
let bcm_o_src_path = config.env.precompiled_bcm_o.as_ref()
615-
.expect("`fips-link-precompiled` requires `BORING_BSSL_FIPS_PRECOMPILED_BCM_O` env variable to be specified");
616-
617-
let libcrypto_path = bssl_dir
618-
.join("build/crypto/libcrypto.a")
619-
.canonicalize()
620-
.unwrap();
621-
622-
let bcm_o_dst_path = bssl_dir.join("build/bcm-fips.o");
623-
624-
fs::copy(bcm_o_src_path, &bcm_o_dst_path).unwrap();
625-
626-
// check that fips module is named as expected
627-
let out = run_command(
628-
Command::new("ar")
629-
.arg("t")
630-
.arg(&libcrypto_path)
631-
.arg("bcm.o"),
632-
)
633-
.unwrap();
634-
635-
assert_eq!(
636-
String::from_utf8(out.stdout).unwrap().trim(),
637-
"bcm.o",
638-
"failed to verify FIPS module name"
639-
);
640-
641-
// insert fips bcm.o before bcm.o into libcrypto.a,
642-
// so for all duplicate symbols the older fips bcm.o is used
643-
// (this causes the need for extra linker flags to deal with duplicate symbols)
644-
// (as long as the newer module does not define new symbols, one may also remove it,
645-
// but once there are new symbols it would cause missing symbols at linking stage)
646-
run_command(
647-
Command::new("ar")
648-
.args(["rb", "bcm.o"])
649-
.args([&libcrypto_path, &bcm_o_dst_path]),
650-
)
651-
.unwrap();
652-
}
653-
654555
fn get_cpp_runtime_lib(config: &Config) -> Option<String> {
655556
if let Some(ref cpp_lib) = config.env.cpp_runtime_lib {
656557
return cpp_lib.clone().into_string().ok();
@@ -709,10 +610,6 @@ fn emit_link_directives(config: &Config) {
709610
);
710611
}
711612

712-
if config.features.fips_link_precompiled {
713-
link_in_precompiled_bcm_o(config);
714-
}
715-
716613
if let Some(cpp_lib) = get_cpp_runtime_lib(config) {
717614
println!("cargo:rustc-link-lib={cpp_lib}");
718615
}
@@ -785,7 +682,6 @@ fn generate_bindings(config: &Config) {
785682
"des.h",
786683
"dtls1.h",
787684
"hkdf.h",
788-
#[cfg(not(feature = "fips"))]
789685
"hpke.h",
790686
"hmac.h",
791687
"hrss.h",

‎boring-sys/deps/boringssl‎

Submodule boringssl updated 9548 files

‎boring-sys/deps/boringssl-fips‎

Lines changed: 0 additions & 1 deletion
This file was deleted.

0 commit comments

Comments
 (0)