support fips-compliant build for arm

[zhaohuabing]

Commit Message: support fips-compliant build for arm
Additional Description: related issue: #27620
Risk Level:
Testing:
Docs Changes:
Release Notes:
Platform Specific Features:
[Optional Runtime guard:]
[Optional Fixes #Issue]
[Optional Fixes commit #PR or SHA]
[Optional Deprecated:]
[Optional API Considerations:]

[phlax]

hi @zhaohuabing thanks for working on this

looking at ci and doing a quick review here im wondering how this should work, atm its failing due to trying to use non-hermetic binaries

not entirely clear how fips is expected to build wrt versions, but i think we dont want to be installing cmake/ninja etc in the host, and not sure it will work (current non-hermetic issue in ci is python afaict)

[phlax]

@zhaohuabing i confirmed offline that the current build is not affected by the switch to the toolchain/vendored tooling
(apologies for any confusion)

this lgtm, my one concern is that we dont have any testing for it, maybe thats ok

would be good to get a signoff from someone with better knowledge of fips

[kyessenov]

This looks fine to me. Did you try to run the ARM build and validate that fips_mode is reported in the admin? I am not sure if the CI tries this build.

Re: @phlax: FIPS mode performs a self-test so if envoy self-reports FIPS mode, it should be correct.

[phlax]

FIPS mode performs a self-test so if envoy self-reports FIPS mode

i more meant in ci

[kyessenov]

@phlax Yeah, I'm a bit concerned about the lack of testing for compile time options for ARM. Should we create a CI pipelne similar to x86 one?

[phlax]

Should we create a CI pipelne similar to x86 one?

the only problem is that it doesnt use a free azp host, so there is a ~cost implication - i was wondering about adding a fips build in the main release stage, but not sure

[kyessenov]

I think it's OK to verify manually right now since there is no logic change. Can we get a confirmation that the ARM build reports fips_mode correctly?

[zhaohuabing]

I think it's OK to verify manually right now since there is no logic change. Can we get a confirmation that the ARM build reports fips_mode correctly?

@kyessenov Verified on my arm machine.

➜  envoy git:(boringssl-fips-arm) ✗ lscpu|grep arc                                                          
Architecture:                    aarch64
➜  envoy git:(boringssl-fips-arm) ✗  echo "build --define boringssl=fips" >> .bazelrc
➜  envoy git:(boringssl-fips-arm) ✗ ./ci/run_envoy_docker.sh ' ./ci/do_ci.sh bazel.release.server_only' 
➜  envoy git:(boringssl-fips-arm) ✗ /tmp/envoy-docker-build/envoy/arm64/source/exe/envoy/envoy --version|grep FIPS
/tmp/envoy-docker-build/envoy/arm64/source/exe/envoy/envoy  version: 2a4c291b281ecc9fad3a28868da4618eb2a6e0f2/1.27.0-dev/Modified/RELEASE/BoringSSL-FIPS

[wbpcode]

cc @kyessenov If this ready to merge or need a second review from other maintainers?

[phlax]

i guess we will have to just go with this for now but there is no guarantee of any python in an environment

we could use the hermetic python provided by rules_python, but then im thinking rather just use rules_foreign_cc and avoid these problems altogether

either way, we can address the non-hermetic fips build subsequently - i appreciate this is mostly just doing for arm what is currently done for x86

[phlax]

one small nit, and i think this should be good to land @zhaohuabing

[phlax]

lgtm, thanks @zhaohuabing

[kyessenov]

@zhaohuabing A better test is to run envoy and query server stats for fips_mode. Can you try that?

[zhaohuabing]

@zhaohuabing A better test is to run envoy and query server stats for fips_mode. Can you try that?

@kyessenov Sure I can try that. Below is the output:

➜  ~ /tmp/envoy-docker-build/envoy/arm64/source/exe/envoy/envoy --config-path test.yml>/dev/null 2>&1 &
[1] 1513328
➜  ~ curl 127.0.0.1:9901/stats|grep fips                                                               
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 31898    0 31898    0     0  15.2M      0 --:--:-- --:--:-- --:--:-- 15.2M
server.compilation_settings.fips_mode: 1