Skip to content

Commit 9fe1e15

Browse files
elad-solomonjustsmth
elad-solomon
and
justsmth
authored
Set the correct runtime flags for FIPS binaries (#930)
* Set the correct runtime flags for FIPS binaries Signed-off-by: Elad Solomon <[email protected]> * Some environments don't have CARGO_CFG_TARGET_FEATURE? * Add MSVC +crt-static for FIPS in CI --------- Signed-off-by: Elad Solomon <[email protected]> Co-authored-by: Justin Smith <[email protected]>
1 parent 4817764 commit 9fe1e15

File tree

6 files changed

+77
-13
lines changed

6 files changed

+77
-13
lines changed

‎.github/workflows/cross.yml‎

Lines changed: 17 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -272,18 +272,26 @@ jobs:
272272

273273
aws-lc-rs-windows-msvc:
274274
if: ${{ github.repository_owner == 'aws' }}
275-
name: ${{ matrix.target }} - ${{ (matrix.crt_static == '1' && 'crt-static and /WX') || '/WX' }}
275+
name: ${{ matrix.target }} ${{ (matrix.fips == '1' && '(FIPS)') || '' }} - ${{ (matrix.crt_static == '1' && 'crt-static and /WX') || '/WX' }}
276276
runs-on: windows-latest
277277
strategy:
278278
fail-fast: false
279279
matrix:
280280
target:
281-
- "x86_64-pc-windows-msvc"
282-
- "i686-pc-windows-msvc"
283-
- "aarch64-pc-windows-msvc"
281+
- 'x86_64-pc-windows-msvc'
282+
- 'i686-pc-windows-msvc'
283+
- 'aarch64-pc-windows-msvc'
284284
crt_static:
285-
- "0"
286-
- "1"
285+
- '0'
286+
- '1'
287+
fips:
288+
- '0'
289+
- '1'
290+
exclude:
291+
- target: "i686-pc-windows-msvc"
292+
fips: '1'
293+
- target: "aarch64-pc-windows-msvc"
294+
fips: '1'
287295
steps:
288296
- name: Install NASM
289297
if: ${{ matrix.target == 'x86_64-pc-windows-msvc' || matrix.target == 'i686-pc-windows-msvc' }}
@@ -311,9 +319,10 @@ jobs:
311319
echo "RUSTFLAGS=-Clink-arg=/WX" | Out-File -FilePath $env:GITHUB_ENV -Append
312320
}
313321
- name: Debug build
314-
run: cargo ${{ env.ACTION_CARGO }} -p aws-lc-rs --all-targets --target ${{ matrix.target }} --features bindgen
322+
run: cargo ${{ env.ACTION_CARGO }} -p aws-lc-rs --all-targets --target ${{ matrix.target }} --features bindgen${{ (matrix.fips == '1' && ',fips') || '' }}
315323
- name: Release Build for ${{ matrix.target }}
316-
run: cargo ${{ env.ACTION_CARGO }} --release -p aws-lc-rs --all-targets --target ${{ matrix.target }}
324+
run: cargo ${{ env.ACTION_CARGO }} --release -p aws-lc-rs --all-targets --target ${{ matrix.target }}${{ (matrix.fips == '1' && ' --features fips') || '' }}
325+
317326
freebsd:
318327
if: github.repository_owner == 'aws'
319328
name: aws-lc-rs freebsd test

‎.github/workflows/integration.yml‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -72,8 +72,14 @@ jobs:
7272
7373
windows-debug-crt-static-test:
7474
if: github.repository_owner == 'aws'
75-
name: "Windows debug w/ crt-static Test"
75+
name: "Windows debug ${{ matrix.cli }} w/ crt-static Test"
7676
runs-on: windows-latest
77+
strategy:
78+
fail-fast: false
79+
matrix:
80+
cli:
81+
- ''
82+
- '--fips'
7783
steps:
7884
- uses: actions/checkout@v3
7985
with:
@@ -86,7 +92,7 @@ jobs:
8692
working-directory: ./aws-lc-rs
8793
shell: bash
8894
run: |
89-
./scripts/run-windows-debug-crt-static-test.sh
95+
./scripts/run-windows-debug-crt-static-test.sh ${{ matrix.cli }}
9096
9197
ssl-test:
9298
if: github.repository_owner == 'aws'

‎aws-lc-fips-sys/CMakeLists.txt‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,11 +20,25 @@ function(set_my_target_properties ...)
2020
endif()
2121
endfunction()
2222

23+
option(AWS_LC_FIPS_SYS_STATIC_RUNTIME "Enable static MSVC runtime for FIPS binaries" OFF)
24+
2325
if (BUILD_SHARED_LIBS AND FIPS)
2426
# FIPS_SHARED does not support unique function or data sections, but we can't set this from Rust
2527
# as cmake crate will postfix the C/CXX flags after our disablement nullifying them.
2628
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -fno-function-sections -fno-data-sections")
2729
set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -fno-function-sections -fno-data-sections")
30+
31+
# FIPS_SHARED requires setting the static runtime flags manually due to limitations in cmake-rs and ninja generator.
32+
if (MSVC AND AWS_LC_FIPS_SYS_STATIC_RUNTIME)
33+
message(STATUS "Setting static MSVC runtime for FIPS binaries")
34+
string(TOUPPER "${CMAKE_BUILD_TYPE}" CMAKE_BUILD_TYPE_UPPER)
35+
set(STATIC_RUNTIME_FLAG "/MT")
36+
if(CMAKE_BUILD_TYPE_UPPER STREQUAL "DEBUG")
37+
set(STATIC_RUNTIME_FLAG "/MTd")
38+
endif()
39+
set(CMAKE_C_FLAGS_${CMAKE_BUILD_TYPE_UPPER} "${CMAKE_C_FLAGS_${CMAKE_BUILD_TYPE_UPPER}} ${STATIC_RUNTIME_FLAG}")
40+
set(CMAKE_CXX_FLAGS_${CMAKE_BUILD_TYPE_UPPER} "${CMAKE_CXX_FLAGS_${CMAKE_BUILD_TYPE_UPPER}} ${STATIC_RUNTIME_FLAG}")
41+
endif()
2842
add_definitions(-DBORINGSSL_SHARED_LIBRARY)
2943
endif()
3044

‎aws-lc-fips-sys/builder/cmake_builder.rs‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,8 @@
44
use crate::OutputLib::{Crypto, RustWrapper, Ssl};
55
use crate::{
66
cargo_env, effective_target, emit_rustc_cfg, emit_warning, execute_command,
7-
is_cpu_jitter_entropy, is_no_asm, option_env, target_arch, target_env, target_family,
8-
target_os, target_underscored, target_vendor, OutputLibType, TestCommandResult,
7+
is_cpu_jitter_entropy, is_crt_static, is_no_asm, option_env, target_arch, target_env,
8+
target_family, target_os, target_underscored, target_vendor, OutputLibType, TestCommandResult,
99
};
1010
use std::collections::HashMap;
1111
use std::env;
@@ -163,6 +163,11 @@ impl CmakeBuilder {
163163
cmake_cfg.define("CMAKE_BUILD_TYPE", "debug");
164164
}
165165

166+
if is_crt_static() {
167+
// Need to set this flag to enable static runtime for FIPS binaries due to limitations in cmake-rs and ninja generator.
168+
cmake_cfg.define("AWS_LC_FIPS_SYS_STATIC_RUNTIME", "ON");
169+
}
170+
166171
Self::verify_compiler_support(&cc_build.get_compiler());
167172

168173
if let Some(prefix) = &self.build_prefix {

‎aws-lc-fips-sys/builder/main.rs‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -474,6 +474,15 @@ fn prepare_cargo_cfg() {
474474
}
475475
}
476476

477+
fn is_crt_static() -> bool {
478+
// Some cross-compilation environment apparently don't have this defined.
479+
if let Some(features) = option_env("CARGO_CFG_TARGET_FEATURE") {
480+
features.contains("crt-static")
481+
} else {
482+
false
483+
}
484+
}
485+
477486
bindgen_available!(
478487
fn handle_bindgen(manifest_dir: &Path, prefix: &Option<String>) -> bool {
479488
if internal_bindgen_supported() && !is_external_bindgen() {

‎aws-lc-rs/scripts/run-windows-debug-crt-static-test.sh‎

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,19 @@
22
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
33
# SPDX-License-Identifier: Apache-2.0 OR ISC
44

5+
# Parse command line arguments
6+
FIPS_MODE=false
7+
for arg in "$@"; do
8+
case $arg in
9+
--fips)
10+
FIPS_MODE=true
11+
shift
12+
;;
13+
*)
14+
;;
15+
esac
16+
done
17+
518
SRC_ROOT="${GITHUB_WORKSPACE:-$(git rev-parse --show-toplevel)}/aws-lc-rs"
619

720
case `uname -s` in
@@ -17,7 +30,15 @@ pushd "${TMP_DIR}"
1730
cargo new --bin aws-lc-rs-test
1831
pushd aws-lc-rs-test
1932

20-
cargo add aws-lc-rs rustls rustls-platform-verifier
33+
# Add aws-lc-rs with or without fips feature
34+
if [ "$FIPS_MODE" = true ]; then
35+
cargo add aws-lc-rs --features fips
36+
else
37+
cargo add aws-lc-rs
38+
fi
39+
40+
cargo add rustls rustls-platform-verifier
41+
2142
cat << EOF >> Cargo.toml
2243
[profile.release]
2344
debug = "limited"

0 commit comments

Comments
 (0)