Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Do No Merge]test contrib build with fips #33786

Closed
wants to merge 10 commits into from
Closed

[Do No Merge]test contrib build with fips #33786

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
ed26217
cryptomb: fix the fips build
soulxu Apr 24, 2024
5c67fea
force the ci compile_time_options job build with contrib extension
soulxu Apr 24, 2024
6b73895
Revert "force the ci compile_time_options job build with contrib exte…
soulxu Apr 24, 2024
63fb743
fix format
soulxu Apr 24, 2024
8e56fde
Merge branch 'main' into test_contrib
soulxu Apr 28, 2024
b5322e3
test contrib build with fips
soulxu Apr 25, 2024
994931b
update
soulxu Apr 26, 2024
1e88dba
update env
soulxu Apr 28, 2024
bbc47f3
change env var
soulxu Apr 28, 2024
7ddc289
update
soulxu Apr 29, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 19 additions & 0 deletions bazel/foreign_cc/ipp-crypto-bn2lebinpad.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
diff --git a/sources/ippcp/crypto_mb/src/common/ifma_cvt52.c b/sources/ippcp/crypto_mb/src/common/ifma_cvt52.c
index e6db178c..0a1ecc49 100644
--- a/sources/ippcp/crypto_mb/src/common/ifma_cvt52.c
+++ b/sources/ippcp/crypto_mb/src/common/ifma_cvt52.c
@@ -16,9 +16,14 @@

#include <internal/common/ifma_defs.h>
#include <internal/common/ifma_math.h>
+#include <openssl/bn.h>

#include <assert.h>

+static int BN_bn2lebinpad(const BIGNUM *a, unsigned char *to, int tolen) {
+ return BN_bn2le_padded(to, tolen, a);
+}
+
#if defined(_MSC_VER) && (_MSC_VER < 1920)
// Disable optimization for VS2017 due to AVX512 masking bug
#define DISABLE_OPTIMIZATION __pragma(optimize( "", off ))
14 changes: 14 additions & 0 deletions bazel/repositories.bzl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -310,6 +310,7 @@ def envoy_dependencies(skip_targets = []):
_com_github_rules_proto_grpc()
_com_github_unicode_org_icu()
_com_github_intel_ipp_crypto_crypto_mb()
_com_github_intel_ipp_crypto_crypto_mb_fips()
_com_github_intel_qatlib()
_com_github_intel_qatzip()
_com_github_qat_zstd()
Expand Down Expand Up @@ -549,6 +550,19 @@ def _com_github_intel_ipp_crypto_crypto_mb():
build_file_content = BUILD_ALL_CONTENT,
)

def _com_github_intel_ipp_crypto_crypto_mb_fips():
# Temporary fix for building ipp-crypto when boringssl-fips is used.
# Build will fail if bn2lebinpad patch is applied. Remove this archive
# when upstream dependency fixes this issue.
external_http_archive(
name = "com_github_intel_ipp_crypto_crypto_mb_fips",
patches = ["@envoy//bazel/foreign_cc:ipp-crypto-bn2lebinpad.patch"],
patch_args = ["-p1"],
build_file_content = BUILD_ALL_CONTENT,
# Use existing ipp-crypto repository location name to avoid redefinition.
location_name = "com_github_intel_ipp_crypto_crypto_mb",
)

def _com_github_intel_qatlib():
external_http_archive(
name = "com_github_intel_qatlib",
Expand Down
5 changes: 3 additions & 2 deletions ci/do_ci.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -461,13 +461,14 @@ case $CI_TARGET in
@envoy//test/common/common:assert_test \
--define log_fast_debug_assert_in_release=enabled \
--define log_debug_assert_in_release=disabled
echo "Building binary with wasm=wasmtime... and logging disabled"
echo "Building contrib binary and DIABLE cache with wasm=wasmtime... and logging disabled"
bazel build "${BAZEL_BUILD_OPTIONS[@]}" \
--action_env=ARBITRARY_TEST=TEST7 \
--config=compile-time-options \
--define wasm=wasmtime \
--define enable_logging=disabled \
-c fastbuild \
@envoy//source/exe:envoy-static \
@envoy//contrib/exe:envoy-static \
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we kinda want the test with the 2 following conditions to compare:

  • existing - ie //source
  • proposed change - ie both

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok, let me try to build those two in c-t-o

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cool - was wondering whether we would need to separate as you have done

the benefit of this is that we only need to run the ci once to get the timings, and can see exactly how long the contrib build takes

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I run two bazel cmds, suppose we can get the timings separately. Let me trigger the CI it seems the CI broken friday.

--build_tag_filters=-nofips
collect_build_profile build
;;
Expand Down
5 changes: 4 additions & 1 deletion contrib/cryptomb/private_key_providers/source/BUILD
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,10 @@ envoy_cmake(
defines = [
"OPENSSL_USE_STATIC_LIBS=TRUE",
],
lib_source = "@com_github_intel_ipp_crypto_crypto_mb//:all",
lib_source = select({
"//bazel:boringssl_fips": "@com_github_intel_ipp_crypto_crypto_mb_fips//:all",
"//conditions:default": "@com_github_intel_ipp_crypto_crypto_mb//:all",
}),
out_lib_dir = "lib/intel64",
out_static_libs = ["libcrypto_mb.a"],
tags = ["skip_on_windows"],
Expand Down
Loading