Skip to content

Commit 0482776

Browse files
xumiaxumia
committed
Support OpenSSL 3.0 SymCrypt provider for bookworm
1 parent ff5efe8 commit 0482776

File tree

7 files changed

+44
-25
lines changed

7 files changed

+44
-25
lines changed

‎Makefile.work

+3-12
Original file line numberDiff line numberDiff line change
@@ -144,6 +144,7 @@ rules/config.user:
144144

145145
include rules/config
146146
-include rules/config.user
147+
include rules/sonic-fips.mk
147148

148149
ifneq ($(DEFAULT_CONTAINER_REGISTRY),)
149150
override DEFAULT_CONTAINER_REGISTRY := $(DEFAULT_CONTAINER_REGISTRY)/
@@ -184,18 +185,6 @@ endif
184185
SLAVE_IMAGE = $(SLAVE_BASE_IMAGE)-$(USER_LC)
185186
DOCKER_ROOT = $(PWD)/fsroot.docker.$(BLDENV)
186187

187-
# Support FIPS feature, armhf not supported yet
188-
ifeq ($(PLATFORM_ARCH),armhf)
189-
INCLUDE_FIPS := n
190-
ENABLE_FIPS := n
191-
endif
192-
193-
# FIPS not yet available on Bookworm
194-
ifeq ($(BLDENV),bookworm)
195-
$(warning FIPS support not yet available on Bookworm)
196-
INCLUDE_FIPS := n
197-
endif
198-
199188
ifeq ($(INCLUDE_FIPS), n)
200189
ifeq ($(ENABLE_FIPS), y)
201190
$(error Cannot set fips config ENABLE_FIPS=y when INCLUDE_FIPS=n)
@@ -230,6 +219,8 @@ $(shell CONFIGURED_ARCH=$(CONFIGURED_ARCH) \
230219
DOCKER_EXTRA_OPTS=$(DOCKER_EXTRA_OPTS) \
231220
DEFAULT_CONTAINER_REGISTRY=$(DEFAULT_CONTAINER_REGISTRY) \
232221
GZ_COMPRESS_PROGRAM=$(GZ_COMPRESS_PROGRAM) \
222+
FIPS_VERSION=$(FIPS_VERSION) \
223+
FIPS_GOLANG_VERSION=$(FIPS_GOLANG_VERSION) \
233224
j2 $(SLAVE_DIR)/Dockerfile.j2 > $(SLAVE_DIR)/Dockerfile)
234225

235226
$(shell CONFIGURED_ARCH=$(CONFIGURED_ARCH) \

‎dockers/docker-base-bookworm/Dockerfile.j2

+2-1
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,8 @@ RUN apt update && \
6060
jq \
6161
# for sairedis zmq rpc channel
6262
libzmq5 \
63-
libwrap0
63+
libwrap0 \
64+
libatomic1
6465

6566
# Add a config file to allow pip to install packages outside of apt/the Debian repos
6667
COPY ["pip.conf", "/etc/pip.conf"]

‎files/build_templates/sonic_debian_extension.j2

+7
Original file line numberDiff line numberDiff line change
@@ -673,6 +673,13 @@ exit 101
673673
EOF
674674
sudo chmod a+x $FILESYSTEM_ROOT/usr/sbin/policy-rc.d
675675

676+
if [ "$INCLUDE_FIPS" == y ]; then
677+
sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y install libatomic1
678+
# The package openssh-client 9.2 is conflict with FIPS, the line below can be removed when the openssh-client version>=9.4
679+
# The package will be reinstalled when isntalling the FIPS packages
680+
sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y remove openssh-client
681+
fi
682+
676683
{% if installer_debs.strip() -%}
677684
{% for deb in installer_debs.strip().split(' ') -%}
678685
sudo dpkg --root=$FILESYSTEM_ROOT -i {{deb}} || sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y install -f

‎rules/sonic-fips.mk

+26-4
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,48 @@
11
# fips packages
22

3-
FIPS_VERSION = 0.10
3+
ifeq ($(BLDENV), bookworm)
4+
FIPS_VERSION = 1.1-preview
5+
FIPS_OPENSSL_VERSION = 3.0.11-1~deb12u2+fips
6+
FIPS_OPENSSH_VERSION = 9.2p1-2+deb12u2+fips
7+
FIPS_PYTHON_MAIN_VERSION = 3.11
8+
FIPS_PYTHON_VERSION = 3.11.2-6+fips
9+
FIPS_GOLANG_MAIN_VERSION = 1.19
10+
FIPS_GOLANG_VERSION = 1.19.8-2+fips
11+
FIPS_KRB5_VERSION = 1.20.1-2+deb12u1+fips
12+
endif
13+
14+
ifeq ($(BLDENV), bullseye)
15+
FIPS_VERSION = 0.11-preview
416
FIPS_OPENSSL_VERSION = 1.1.1n-0+deb11u5+fips
517
FIPS_OPENSSH_VERSION = 8.4p1-5+deb11u2+fips
618
FIPS_PYTHON_MAIN_VERSION = 3.9
719
FIPS_PYTHON_VERSION = 3.9.2-1+fips
820
FIPS_GOLANG_MAIN_VERSION = 1.15
921
FIPS_GOLANG_VERSION = 1.15.15-1~deb11u4+fips
1022
FIPS_KRB5_VERSION = 1.18.3-6+deb11u4+fips
23+
endif
24+
1125
FIPS_URL_PREFIX = https://sonicstorage.blob.core.windows.net/public/fips/$(BLDENV)/$(FIPS_VERSION)/$(CONFIGURED_ARCH)
1226

1327
SYMCRYPT_OPENSSL_NAME = symcrypt-openssl
1428
SYMCRYPT_OPENSSL = $(SYMCRYPT_OPENSSL_NAME)_$(FIPS_VERSION)_$(CONFIGURED_ARCH).deb
1529
$(SYMCRYPT_OPENSSL)_SRC_PATH = $(SRC_PATH)/sonic-fips
1630

1731
FIPS_OPENSSL = openssl_$(FIPS_OPENSSL_VERSION)_$(CONFIGURED_ARCH).deb
32+
ifeq ($(BLDENV), bookworm)
33+
FIPS_OPENSSL_LIBSSL = libssl3_$(FIPS_OPENSSL_VERSION)_$(CONFIGURED_ARCH).deb
34+
else
1835
FIPS_OPENSSL_LIBSSL = libssl1.1_$(FIPS_OPENSSL_VERSION)_$(CONFIGURED_ARCH).deb
36+
endif
1937
FIPS_OPENSSL_LIBSSL_DEV = libssl-dev_$(FIPS_OPENSSL_VERSION)_$(CONFIGURED_ARCH).deb
2038
FIPS_OPENSSL_LIBSSL_DOC = libssl-doc_$(FIPS_OPENSSL_VERSION)_all.deb
2139
FIPS_OPENSSL_ALL = $(FIPS_OPENSSL) $(FIPS_OPENSSL_LIBSSL) $(FIPS_OPENSSL_LIBSSL_DEV) $(FIPS_OPENSSL_LIBSSL_DOC)
2240

23-
FIPS_OPENSSH = ssh_$(FIPS_OPENSSH_VERSION)_$(CONFIGURED_ARCH).deb
41+
FIPS_OPENSSH = ssh_$(FIPS_OPENSSH_VERSION)_all.deb
2442
FIPS_OPENSSH_CLIENT = openssh-client_$(FIPS_OPENSSH_VERSION)_$(CONFIGURED_ARCH).deb
2543
FIPS_OPENSSH_SFTP_SERVER = openssh-sftp-server_$(FIPS_OPENSSH_VERSION)_$(CONFIGURED_ARCH).deb
2644
FIPS_OPENSSH_SERVER = openssh-server_$(FIPS_OPENSSH_VERSION)_$(CONFIGURED_ARCH).deb
27-
FIPS_OPENSSH_ALL = $(FIPS_SSH) $(FIPS_OPENSSH_CLIENT) $(FIPS_OPENSSH_SFTP_SERVER) $(FIPS_OPENSSH_SERVER)
45+
FIPS_OPENSSH_ALL = $(FIPS_OPENSSH_CLIENT) $(FIPS_OPENSSH_SFTP_SERVER) $(FIPS_OPENSSH_SERVER) $(FIPS_OPENSSH)
2846

2947
FIPS_PYTHON = python$(FIPS_PYTHON_MAIN_VERSION)_$(FIPS_PYTHON_VERSION)_$(CONFIGURED_ARCH).deb
3048
FIPS_PYTHON_MINIMAL = python$(FIPS_PYTHON_MAIN_VERSION)-minimal_$(FIPS_PYTHON_VERSION)_$(CONFIGURED_ARCH).deb
@@ -35,7 +53,11 @@ FIPS_PYTHON_ALL = $(FIPS_PYTHON) $(FIPS_PYTHON_MINIMAL) $(FIPS_LIBPYTHON) $(FIPS
3553

3654
FIPS_GOLANG = golang-$(FIPS_GOLANG_MAIN_VERSION)_$(FIPS_GOLANG_VERSION)_all.deb
3755
FIPS_GOLANG_GO = golang-$(FIPS_GOLANG_MAIN_VERSION)-go_$(FIPS_GOLANG_VERSION)_$(CONFIGURED_ARCH).deb
56+
ifeq ($(BLDENV), bookworm)
57+
FIPS_GOLANG_SRC = golang-$(FIPS_GOLANG_MAIN_VERSION)-src_$(FIPS_GOLANG_VERSION)_all.deb
58+
else
3859
FIPS_GOLANG_SRC = golang-$(FIPS_GOLANG_MAIN_VERSION)-src_$(FIPS_GOLANG_VERSION)_$(CONFIGURED_ARCH).deb
60+
endif
3961
FIPS_GOLANG_DOC = golang-$(FIPS_GOLANG_MAIN_VERSION)-doc_$(FIPS_GOLANG_VERSION)_all.deb
4062
FIPS_GOLANG_ALL = $(FIPS_GOLANG) $(FIPS_GOLANG_GO) $(FIPS_GOLANG_SRC) $(FIPS_GOLANG_DOC)
4163

@@ -56,6 +78,6 @@ FIPS_PACKAGE_ALL = $(SYMCRYPT_OPENSSL) $(FIPS_DERIVED_TARGET)
5678
$(foreach package,$(FIPS_DERIVED_TARGET),$(eval $(call add_extra_package,$(SYMCRYPT_OPENSSL),$(package))))
5779

5880
ifeq ($(INCLUDE_FIPS), y)
59-
FIPS_BASEIMAGE_INSTALLERS = $(FIPS_OPENSSL_LIBSSL) $(FIPS_OPENSSL_LIBSSL_DEV) $(FIPS_OPENSSL) $(SYMCRYPT_OPENSSL) $(FIPS_OPENSSH) $(FIPS_OPENSSH_CLIENT) $(FIPS_OPENSSH_SFTP_SERVER) $(FIPS_OPENSSH_SERVER) $(FIPS_KRB5)
81+
FIPS_BASEIMAGE_INSTALLERS = $(FIPS_OPENSSL_LIBSSL) $(FIPS_OPENSSL_LIBSSL_DEV) $(FIPS_OPENSSL) $(SYMCRYPT_OPENSSL) $(FIPS_OPENSSH_CLIENT) $(FIPS_OPENSSH) $(FIPS_OPENSSH_SFTP_SERVER) $(FIPS_OPENSSH_SERVER) $(FIPS_KRB5)
6082
SONIC_MAKE_DEBS += $(SYMCRYPT_OPENSSL)
6183
endif

‎slave.mk

+1-1
Original file line numberDiff line numberDiff line change
@@ -443,7 +443,7 @@ $(info "INCLUDE_TEAMD" : "$(INCLUDE_TEAMD)")
443443
$(info "INCLUDE_ROUTER_ADVERTISER" : "$(INCLUDE_ROUTER_ADVERTISER)")
444444
$(info "INCLUDE_BOOTCHART : "$(INCLUDE_BOOTCHART)")
445445
$(info "ENABLE_BOOTCHART : "$(ENABLE_BOOTCHART)")
446-
$(info "INCLUDE_FIPS" : "$(INCLUDE_FIPS)")
446+
$(info "INCLUDE_FIPS" : "$(INCLUDE_FIPS)")
447447
$(info "ENABLE_TRANSLIB_WRITE" : "$(ENABLE_TRANSLIB_WRITE)")
448448
$(info "ENABLE_NATIVE_WRITE" : "$(ENABLE_NATIVE_WRITE)")
449449
$(info "ENABLE_DIALOUT" : "$(ENABLE_DIALOUT)")

‎sonic-slave-bookworm/Dockerfile.j2

+3-5
Original file line numberDiff line numberDiff line change
@@ -451,12 +451,10 @@ RUN apt-get install -y kernel-wedge
451451
# For gobgp and telemetry build
452452
RUN apt-get install -y golang
453453
{%- if INCLUDE_FIPS == "y" %}
454-
# FIPS not yet available
455-
RUN false
456-
RUN wget -O golang-go.deb 'https://sonicstorage.blob.core.windows.net/public/fips/bookworm/0.1/{{ CONFIGURED_ARCH }}/golang-1.15-go_1.15.15-1~deb11u4%2Bfips_{{ CONFIGURED_ARCH }}.deb' \
457-
&& wget -O golang-src.deb 'https://sonicstorage.blob.core.windows.net/public/fips/bookworm/0.1/{{ CONFIGURED_ARCH }}/golang-1.15-src_1.15.15-1~deb11u4%2Bfips_{{ CONFIGURED_ARCH }}.deb' \
454+
RUN wget -O golang-go.deb 'https://sonicstorage.blob.core.windows.net/public/fips/bookworm/{{ FIPS_VERSION }}/{{ CONFIGURED_ARCH }}/golang-1.19-go_{{ FIPS_GOLANG_VERSION }}_{{ CONFIGURED_ARCH }}.deb' \
455+
&& wget -O golang-src.deb 'https://sonicstorage.blob.core.windows.net/public/fips/bookworm/{{ FIPS_VERSION }}/{{ CONFIGURED_ARCH }}/golang-1.19-src_{{ FIPS_GOLANG_VERSION }}_all.deb' \
458456
&& dpkg -i golang-go.deb golang-src.deb \
459-
&& ln -sf /usr/lib/go-1.15 /usr/local/go \
457+
&& ln -sf /usr/lib/go-1.19 /usr/local/go \
460458
&& rm golang-go.deb golang-src.deb
461459
{%- else %}
462460
RUN apt-get install -y golang-go \

‎sonic-slave-bullseye/Dockerfile.j2

+2-2
Original file line numberDiff line numberDiff line change
@@ -481,8 +481,8 @@ RUN eatmydata apt-get install -y kernel-wedge
481481
# For gobgp and telemetry build
482482
RUN eatmydata apt-get install -y golang-1.15 && ln -s /usr/lib/go-1.15 /usr/local/go
483483
{%- if INCLUDE_FIPS == "y" %}
484-
RUN wget -O golang-go.deb 'https://sonicstorage.blob.core.windows.net/public/fips/bullseye/0.1/{{ CONFIGURED_ARCH }}/golang-1.15-go_1.15.15-1~deb11u4%2Bfips_{{ CONFIGURED_ARCH }}.deb' \
485-
&& wget -O golang-src.deb 'https://sonicstorage.blob.core.windows.net/public/fips/bullseye/0.1/{{ CONFIGURED_ARCH }}/golang-1.15-src_1.15.15-1~deb11u4%2Bfips_{{ CONFIGURED_ARCH }}.deb' \
484+
RUN wget -O golang-go.deb 'https://sonicstorage.blob.core.windows.net/public/fips/bullseye/{{ FIPS_VERSION }}/{{ CONFIGURED_ARCH }}/golang-1.15-go_{{ FIPS_GOLANG_VERSION }}_{{ CONFIGURED_ARCH }}.deb' \
485+
&& wget -O golang-src.deb 'https://sonicstorage.blob.core.windows.net/public/fips/bullseye/{{ FIPS_VERSION }}/{{ CONFIGURED_ARCH }}/golang-1.15-src_{{ FIPS_GOLANG_VERSION }}_{{ CONFIGURED_ARCH }}.deb' \
486486
&& eatmydata dpkg -i golang-go.deb golang-src.deb \
487487
&& ln -sf /usr/lib/go-1.15 /usr/local/go \
488488
&& rm golang-go.deb golang-src.deb

0 commit comments

Comments
 (0)