opt-in rustls-ffi FIPS support, Linux CI coverage by cpu · Pull Request #478 · rustls/rustls-ffi

cpu · 2024-10-21T19:02:00Z

FIPS feature

Using make FIPS=true with the Makefiles, or cmake -DFIPS="true" -S . -B build with the Windows cmake build will activate the aws-lc-rs feature of rustls-ffi, and the rustls/fips feature of Rustls.

On Linux our test client/server binaries Just Work thanks to the magic of static linking. On MacOS/Windows life is more complicated. For now we'll land support without CI testing on these platforms since the dynamic linking setup required for the end-user application is tricky. I have tested manually with success.

See the rustls manual and the aws-lc-rs-fips-sys crate for more information and further FIPS related caveats.

API additions

Ability to instantiate the FIPS default crypto_provider using a new function rustls_default_fips_provider(), available only when the fips feature is activated.
Ability to determine if a given crypto_provider is in FIPS mode using a new function rustls_crypto_provider_fips().
Ability to determine if a given rustls_client_config would create connections that are FIPS compatible with a new function
rustls_client_config_fips().
Ability to determine if a given rustls_server_config would create connections that are FIPS compatible with a new function
rustls_server_config_fips().
Ability to determine if a given rustls_connection was created from a rustls_client_config or rustls_server_config that was FIPS enabled with a new function rustls_connection_fips().

Future work

Windows and MacOS client/server testing in CI. I've verified these working manually but arranging the dynamic linking requirements is tricky to get right. I'd like to land some unrelated cmake tidying before further investing in this direction.

cpu · 2024-10-21T19:03:48Z

update rustls 0.23.13 -> 0.23.15

Pulling this out into a separate PR since I have some TODOs for this one: #479

cpu · 2024-10-21T19:12:29Z

presently the Mac and Windows FIPS-enabled builds fail with unresolved symbol errors when building the client/server examples

The Ubuntu FIPS CI works great, and so do my local test builds on x86_64-unknown-linux.

Both MacOS and Windows build the Rust rustls-ffi lib and the aws-lc-rs/aws-lc-sys-fips crates without error, but fail to build/link the example C programs:

The MacOS builds fail to compile the client/server example .c programs with errors like:

cc -o target/client target/client.o target/common.o target/release/librustls_ffi.a -Wl,-dead_strip -framework Security -framework Foundation
Undefined symbols for architecture arm64:
  "_aws_lc_fips_0_12_13_AES_ecb_encrypt", referenced from:
      rustls::crypto::aws_lc_rs::quic::HeaderProtectionKey::xor_in_place::h57084e5b13308bb1 in librustls_ffi.a[72](rustls-c38d2f20cf176c7d.rustls.1215cb8b128a8c54-cgu.12.rcgu.o)

Similar failures for the cmake builds on Windows:

  Generating Code...
rustls_ffi.lib(rustls-c4ef5bb999bbcf41.rustls.dd57a86e5d66d92f-cgu.08.rcgu.o) : error LNK2001: unresolved external symbol aws_lc_fips_0_12_13_EVP_PKEY_free [D:\a\rustls-ffi\rustls-ffi\build\tests\client.vcxproj]

Probably missing some extra linker arguments for the C programs (?) - have to put a pin in this for today but will debug further when time permits.

cpu · 2024-10-31T15:07:16Z

I believe the root cause of the trouble here is that I didn't realize the aws-lc FIPS module only supports static linking on Linux. On macOS the module .dylib needs to be used (aws/aws-lc-rs#495). On Windows, there are two .dll's that need to be distributed with the application.

Both are limitations we can surmount for the CI integration testing of a FIPS-enabled client/server test binary, but I need to think about the best way to pull out a predictable file path for both the .dylib and .dll's produced by the cargo build of rustsl-ffi with the dependent crates in fips-mode.

Taking Windows as an example, right now they're under paths like:

./target/release/build/aws-lc-fips-sys-7dc15b55e6834182/out/build/artifacts/aws_lc_fips_0_12_13_rust_wrapper.dll
./target/release/build/aws-lc-fips-sys-7dc15b55e6834182/out/build/artifacts/aws_lc_fips_0_12_13_crypto.dll

I'm not sure the right way to jig a target_link_libraries cmake rule for the test binary CMakeList.txt that could predict the right paths for the .lib artifacts 🤔

@ctz Do you have any experience with this?

cpu · 2024-10-31T16:47:10Z

I'm not sure the right way to jig a target_link_libraries cmake rule for the test binary CMakeList.txt that could predict the right paths for the .lib artifacts 🤔

Some progress in 6732976 - mostly struggling with cmake now (ugh).

The solution in that commit works without too much hardcoding, but it assumes you've run a cargo build before running cmake -S . -B build or otherwise it errors because the path expansions to find the built .lib/.dll's fail. I'm struggling to find the right way to "defer" this until the result of the add_dependencies(client rustls-ffi) expressions ensures the cargo build was run.

More iteration (and probably an attempt to properly learn cmake) are required...

ctz · 2024-10-31T17:11:02Z

@ctz Do you have any experience with this?

I'm afraid not :(

cpu · 2024-10-31T17:17:44Z

I'm afraid not :(

Np! I will keep plugging away at this, more because I'm overdue to better understand the existing Windows build than because I think it's super important to get working.

Worst case I'll land Linux in CI and we can circle back on MacOS/Windows testing of the FIPS builds later on.

cpu · 2024-11-04T20:33:49Z

cpu marked this pull request as ready for review now

I backed out the CI bits for MacOS and Windows. You can still build rustls-ffi in FIPS mode on those platforms, but since linking the client/server binaries to the FIPS module is more involved on those platforms it's untested in CI at the moment (but verified to work manually).

I've learned a lot (some would say: too much) about cmake over the weekend and I think I'd prefer to:

Land this as-is
Rework the build system using what I've learned about cmake (I have Mac/Linux building w/ cmake on a separate branch so we can avoid Windows being the special duck).
Add back the FIPS coverage for MacOS/Windows after the build rework makes it a bit more tractable.

WDYT? @jsha @ctz

Alternatively we could table this PR, do the build bits, and then rebase it and land it with full CI coverage.

src/connection.rs

cpu · 2024-11-11T18:54:43Z

@jsha Is this a branch I should hold for your review? 🙇

Using `make FIPS=true` with the Makefiles, or `cmake -DFIPS="true" -S . -B build` with the Windows cmake build will activate the `aws-lc-rs` feature of `rustls-ffi`, and the `rustls/fips` feature of Rustls. On Linux our test client/server binaries Just Work thanks to the magic of static linking. On MacOS/Windows life is more complicated. For now we'll land support without testing on these platforms since the dynamic linking setup required for the end-user application is tricky. See the rustls manual[0] and the aws-lc-rs-fips-sys crate[1] for more information and further FIPS related caveats. [0]: https://docs.rs/rustls/latest/rustls/manual/_06_fips/index.html [1]: https://crates.io/crates/aws-lc-fips-sys

* Ability to instantiate the FIPS default `crypto_provider` using a new function `rustls_default_fips_provider()`, available only when the fips feature is activated. * Ability to determine if a given `crypto_provider` is in FIPS mode using a new function `rustls_crypto_provider_fips()`. * Ability to determine if a given `rustls_client_config` would create connections that are FIPS compatible with a new function `rustls_client_config_fips()`. * Ability to determine if a given `rustls_server_config` would create connections that are FIPS compatible with a new function `rustls_server_config_fips()`. * Ability to determine if a given `rustls_connection` was created from a `rustls_client_config` or `rustls_server_config` that was FIPS enabled with a new function `rustls_connection_fips()`.

cpu · 2024-11-25T15:37:21Z

jsha Is this a branch I should hold for your review?

last time we chatted on this subject you mentioned being OK with merges that get a review from another team member if you don't get to them within a few weeks. I think this branch falls into that category so I'm going to merge it. Let me know if I should adjust my heuristics in the future!

cpu self-assigned this Oct 21, 2024

cpu marked this pull request as draft October 21, 2024 19:02

cpu mentioned this pull request Oct 21, 2024

Features from rustls not yet in rustls-ffi #214

Open

17 tasks

This comment was marked as outdated.

Sign in to view

cpu force-pushed the cpu-fips-wip branch from 660480d to 70fc1a3 Compare October 29, 2024 19:30

cpu force-pushed the cpu-fips-wip branch 2 times, most recently from 93c09f3 to 365823d Compare November 4, 2024 20:23

cpu changed the title ~~WIP: opt-in rustls-ffi FIPS support~~ opt-in rustls-ffi FIPS support, Linux CI coverage Nov 4, 2024

cpu marked this pull request as ready for review November 4, 2024 20:30

ctz reviewed Nov 6, 2024

View reviewed changes

src/connection.rs Outdated Show resolved Hide resolved

cpu force-pushed the cpu-fips-wip branch from 365823d to eaa227f Compare November 6, 2024 14:33

ctz approved these changes Nov 6, 2024

View reviewed changes

cpu mentioned this pull request Nov 25, 2024

aws-lc-rs fails to build fips feature when building rustls-ffi aws/aws-lc-rs#615

Closed

cpu added 2 commits November 25, 2024 10:33

cpu force-pushed the cpu-fips-wip branch from eaa227f to 9df87dc Compare November 25, 2024 15:35

cpu merged commit 73d34fd into rustls:main Nov 25, 2024

cpu deleted the cpu-fips-wip branch November 25, 2024 15:41

BrewTestBot mentioned this pull request Mar 25, 2025

rustls-ffi 0.15.0 Homebrew/homebrew-core#216575

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

opt-in rustls-ffi FIPS support, Linux CI coverage#478

opt-in rustls-ffi FIPS support, Linux CI coverage#478
cpu merged 2 commits intorustls:mainfrom
cpu:cpu-fips-wip

cpu commented Oct 21, 2024 •

edited

Loading

Uh oh!

cpu commented Oct 21, 2024

Uh oh!

cpu commented Oct 21, 2024

Uh oh!

This comment was marked as outdated.

cpu commented Oct 31, 2024 •

edited

Loading

Uh oh!

cpu commented Oct 31, 2024

Uh oh!

ctz commented Oct 31, 2024

Uh oh!

cpu commented Oct 31, 2024

Uh oh!

cpu commented Nov 4, 2024 •

edited

Loading

Uh oh!

Uh oh!

cpu commented Nov 11, 2024

Uh oh!

cpu commented Nov 25, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

cpu commented Oct 21, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

FIPS feature

API additions

Future work

Uh oh!

cpu commented Oct 21, 2024

Uh oh!

cpu commented Oct 21, 2024

Uh oh!

This comment was marked as outdated.

cpu commented Oct 31, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cpu commented Oct 31, 2024

Uh oh!

ctz commented Oct 31, 2024

Uh oh!

cpu commented Oct 31, 2024

Uh oh!

cpu commented Nov 4, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

cpu commented Nov 11, 2024

Uh oh!

cpu commented Nov 25, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

cpu commented Oct 21, 2024 •

edited

Loading

cpu commented Oct 31, 2024 •

edited

Loading

cpu commented Nov 4, 2024 •

edited

Loading