Skip to content

Commit 62b0a1a

Browse files
k-rainanormanmaurer
k-raina
and
normanmaurer
authored
FIPS: Add pom profile to build fips compliant boringSSL netty-tcnative (#821)
### Motivation: As discussed in [issue](#799), considering the growing demand for FIPS compliance in security-sensitive environments, an official netty-tcnative release supporting FIPS validation would greatly benefit the open-source community. This would simplify integration and provide a reliable, community-supported solution. ### Setup Configurations: Tools: cmake 3.20, ninja build 1.10.0, clang-12, golang, java 11, maven 3.6.3, libapr1, automake, autoconf, libtool, libunwind-dev, pkg-config Fips validated BoringSSL commit used is 853ca1ea1168dff08011e5d42d94609cc0ca2e27 ### Build Steps: - Run Maven ``` mvn clean install -f boringssl-static/pom.xml -Pfips-boringssl-static ``` - While build is running you should see in logs: ``` ... Boringssl is fips compliant ... ``` - After build steps are completed you should see Jars eg. ``` .m2/repository/io/netty/netty-tcnative-boringssl-static/2.0.61.Final/netty-tcnative-boringssl-static-2.0.61.Final.jar .m2/repository/io/netty/netty-tcnative-boringssl-static/2.0.61.Final/netty-tcnative-boringssl-static-2.0.61.Final-linux-x86_64.jar ``` ### Modifications: - Added pom profile `fips-boringssl-static` for fips compliant ### Tested on: Tested on linux AMD and ARM machine, which are supported as per FIPS security document attached in reference. Output: https://drive.google.com/file/d/1eAFUIrHLbB7xiTpxHPs__N3Ha_Ltli76/view?usp=sharing ### Reference: Guidance on how to build FIPS validated modules: https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp4407.pdf --------- Co-authored-by: Norman Maurer <[email protected]>
1 parent 442f312 commit 62b0a1a

File tree

1 file changed

+277
-1
lines changed

1 file changed

+277
-1
lines changed

‎boringssl-static/pom.xml‎

Lines changed: 277 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,282 @@
7575
</dependencies>
7676

7777
<profiles>
78+
79+
<!-- The profile that builds a fips-boringssl-static jar -->
80+
<profile>
81+
<id>fips-boringssl-static</id>
82+
<properties>
83+
<boringsslCheckoutDir>${project.build.directory}/boringssl-${boringsslBranch}/boringssl</boringsslCheckoutDir>
84+
<boringsslBuildDir>${boringsslCheckoutDir}/build</boringsslBuildDir>
85+
<!-- Latest FIPS compliant boringSSL commit -->
86+
<boringsslBranch>853ca1ea1168dff08011e5d42d94609cc0ca2e27</boringsslBranch>
87+
<linkStatic>true</linkStatic>
88+
<msvcSslIncludeDirs>${boringsslCheckoutDir}/include</msvcSslIncludeDirs>
89+
<msvcSslLibDirs>${boringsslBuildDir}/ssl;${boringsslBuildDir}/crypto;${boringsslBuildDir}/decrepit</msvcSslLibDirs>
90+
<msvcSslLibs>ssl.lib;crypto.lib;decrepit.lib</msvcSslLibs>
91+
<jniArch>${os.detected.arch}</jniArch>
92+
</properties>
93+
94+
<build>
95+
<plugins>
96+
97+
<!-- Download the BoringSSL source -->
98+
<plugin>
99+
<groupId>com.googlecode.maven-download-plugin</groupId>
100+
<artifactId>download-maven-plugin</artifactId>
101+
<version>1.6.8</version>
102+
<executions>
103+
<execution>
104+
<id>install-fips-boringssl</id>
105+
<phase>process-sources</phase>
106+
<goals>
107+
<goal>wget</goal>
108+
</goals>
109+
</execution>
110+
</executions>
111+
<configuration>
112+
<url>https://commondatastorage.googleapis.com/chromium-boringssl-fips/boringssl-${boringsslBranch}.tar.xz</url>
113+
<unpack>true</unpack>
114+
<outputDirectory>${project.build.directory}/boringssl-${boringsslBranch}</outputDirectory>
115+
</configuration>
116+
</plugin>
117+
118+
<plugin>
119+
<groupId>org.codehaus.mojo</groupId>
120+
<artifactId>build-helper-maven-plugin</artifactId>
121+
<executions>
122+
<execution>
123+
<phase>generate-sources</phase>
124+
<goals>
125+
<goal>add-source</goal>
126+
</goals>
127+
<configuration>
128+
<sources>
129+
<source>${generatedSourcesDir}/java</source>
130+
</sources>
131+
</configuration>
132+
</execution>
133+
</executions>
134+
</plugin>
135+
136+
<!-- Add the commit ID and branch to the manifest. -->
137+
<plugin>
138+
<groupId>org.apache.felix</groupId>
139+
<artifactId>maven-bundle-plugin</artifactId>
140+
<configuration>
141+
<instructions>
142+
<Apr-Version>${aprVersion}</Apr-Version>
143+
<BoringSSL-Revision>${boringsslBuildNumber}</BoringSSL-Revision>
144+
<BoringSSL-Branch>${boringsslBranch}</BoringSSL-Branch>
145+
</instructions>
146+
</configuration>
147+
</plugin>
148+
149+
<plugin>
150+
<artifactId>maven-antrun-plugin</artifactId>
151+
<executions>
152+
<!-- Build the BoringSSL static libs -->
153+
<execution>
154+
<id>build-boringssl</id>
155+
<phase>compile</phase>
156+
<goals>
157+
<goal>run</goal>
158+
</goals>
159+
<configuration>
160+
<target>
161+
<!-- Add the ant tasks from ant-contrib -->
162+
<taskdef resource="net/sf/antcontrib/antcontrib.properties" />
163+
<property environment="env" />
164+
<if>
165+
<available file="${boringsslBuildDir}" />
166+
<then>
167+
<echo message="BoringSSL was already build, skipping the build step." />
168+
</then>
169+
<else>
170+
<echo message="Building BoringSSL" />
171+
172+
<mkdir dir="${boringsslBuildDir}" />
173+
174+
<if>
175+
<equals arg1="${os.detected.name}" arg2="windows" />
176+
<then>
177+
<!-- On Windows, build with /MT for static linking -->
178+
<property name="cmakeAsmFlags" value="" />
179+
<property name="cmakeCFlags" value="/MT" />
180+
<!-- Disable one warning to be able to build on windows -->
181+
<property name="cmakeCxxFlags" value="/MT /wd4091" />
182+
</then>
183+
<elseif>
184+
<equals arg1="${os.detected.name}" arg2="linux" />
185+
<then>
186+
<!-- On *nix, add ASM flags to disable executable stack -->
187+
<property name="cmakeAsmFlags" value="-Wa,--noexecstack" />
188+
<property name="cmakeCFlags" value="-std=c99 -O3 -fno-omit-frame-pointer" />
189+
<!-- We need to define __STDC_CONSTANT_MACROS and __STDC_FORMAT_MACROS when building boringssl on centos 6 -->
190+
<property name="cmakeCxxFlags" value="-O3 -fno-omit-frame-pointer -Wno-error=maybe-uninitialized -D__STDC_CONSTANT_MACROS -D__STDC_FORMAT_MACROS" />
191+
</then>
192+
</elseif>
193+
<else>
194+
<!-- On *nix, add ASM flags to disable executable stack -->
195+
<property name="cmakeAsmFlags" value="-Wa,--noexecstack" />
196+
<property name="cmakeCFlags" value="-std=c99 -O3 -fno-omit-frame-pointer" />
197+
<property name="cmakeCxxFlags" value="-O3 -fno-omit-frame-pointer" />
198+
</else>
199+
</if>
200+
<exec executable="cmake" failonerror="true" dir="${boringsslBuildDir}" resolveexecutable="true">
201+
<arg value="-DCMAKE_BUILD_TYPE=Release" />
202+
<arg value="-DCMAKE_POSITION_INDEPENDENT_CODE=TRUE" />
203+
<arg value="-DCMAKE_C_COMPILER=clang" />
204+
<arg value="-DCMAKE_CXX_COMPILER=clang++" />
205+
<arg value="-DFIPS=1" />
206+
<arg value="-GNinja" />
207+
<arg value="${boringsslCheckoutDir}" />
208+
</exec>
209+
<if>
210+
<!-- may be called ninja-build or ninja -->
211+
<!-- See https://github.com/netty/netty-tcnative/issues/475 -->
212+
<available file="ninja-build" filepath="${env.PATH}" />
213+
<then>
214+
<property name="ninjaExecutable" value="ninja-build" />
215+
</then>
216+
<else>
217+
<property name="ninjaExecutable" value="ninja" />
218+
</else>
219+
</if>
220+
<if>
221+
<equals arg1="${os.detected.name}" arg2="linux" />
222+
<then>
223+
<!-- This is needed to generate bssl execute file to verify isfips property-->
224+
<exec executable="${ninjaExecutable}" failonerror="true" dir="${boringsslBuildDir}" resolveexecutable="true">
225+
</exec>
226+
<exec executable="./tool/bssl" failonerror="false" dir="${boringsslBuildDir}" outputproperty="boringssl.isfips.result">
227+
<arg value="isfips" />
228+
</exec>
229+
<if>
230+
<equals arg1="${boringssl.isfips.result}" arg2="1"/>
231+
<then>
232+
<echo message="Boringssl is fips compliant" />
233+
</then>
234+
</if>
235+
<fail message="The boringssl is not fips">
236+
<condition>
237+
<not>
238+
<equals arg1="${boringssl.isfips.result}" arg2="1"/>
239+
</not>
240+
</condition>
241+
</fail>
242+
</then>
243+
<else>
244+
<exec executable="${ninjaExecutable}" failonerror="true" dir="${boringsslBuildDir}" resolveexecutable="true" />
245+
</else>
246+
</if>
247+
</else>
248+
</if>
249+
</target>
250+
</configuration>
251+
</execution>
252+
253+
<!-- Build the additional JAR that contains the native library. -->
254+
<execution>
255+
<id>native-jar</id>
256+
<phase>package</phase>
257+
<goals>
258+
<goal>run</goal>
259+
</goals>
260+
<configuration>
261+
<target>
262+
<!-- Add the ant tasks from ant-contrib -->
263+
<taskdef resource="net/sf/antcontrib/antcontrib.properties" />
264+
265+
<!-- Strip on linux. See https://github.com/netty/netty-tcnative/issues/129 -->
266+
<if>
267+
<and>
268+
<equals arg1="${os.detected.name}" arg2="linux" />
269+
<equals arg1="${strip.skip}" arg2="false" />
270+
</and>
271+
<then>
272+
<exec executable="strip" failonerror="true" dir="${nativeLibOnlyDir}/META-INF/native/linux${archBits}/" resolveexecutable="true">
273+
<arg value="--strip-debug" />
274+
<arg value="libnetty_tcnative.so" />
275+
</exec>
276+
</then>
277+
</if>
278+
279+
<copy todir="${nativeJarWorkdir}">
280+
<zipfileset src="${defaultJarFile}" />
281+
</copy>
282+
<copy todir="${nativeJarWorkdir}" includeEmptyDirs="false">
283+
<zipfileset dir="${nativeLibOnlyDir}/META-INF/native" />
284+
<regexpmapper handledirsep="yes" from="^(?:[^/]+/)*([^/]+)$" to="META-INF/native/\1" />
285+
</copy>
286+
287+
<!-- linux / osx -->
288+
<move todir="${nativeJarWorkdir}/META-INF/native/" flatten="true">
289+
<fileset dir="${nativeJarWorkdir}/META-INF/native/" />
290+
<globmapper from="libnetty_tcnative.*" to="libnetty_tcnative_${os.detected.name}_${jniArch}.*" />
291+
</move>
292+
<!-- windows-->
293+
<move todir="${nativeJarWorkdir}/META-INF/native/" flatten="true">
294+
<fileset dir="${nativeJarWorkdir}/META-INF/native/" />
295+
<globmapper from="netty_tcnative.*" to="netty_tcnative_${os.detected.name}_${jniArch}.*" />
296+
</move>
297+
<!-- Copy license material for attribution-->
298+
<copy file="../NOTICE.txt" todir="${nativeJarWorkdir}/META-INF/" />
299+
<copy file="../LICENSE.txt" todir="${nativeJarWorkdir}/META-INF/" />
300+
<copy todir="${nativeJarWorkdir}/META-INF/license">
301+
<fileset dir="../license" />
302+
</copy>
303+
<!-- Append the Bundle-NativeCode section -->
304+
<manifest file="${nativeJarWorkdir}/META-INF/MANIFEST.MF" mode="update">
305+
<attribute name="Bundle-NativeCode" value="${tcnativeManifest}" />
306+
</manifest>
307+
308+
<jar destfile="${nativeJarFile}" manifest="${nativeJarWorkdir}/META-INF/MANIFEST.MF" basedir="${nativeJarWorkdir}" index="true" excludes="META-INF/MANIFEST.MF,META-INF/INDEX.LIST" />
309+
<attachartifact file="${nativeJarFile}" classifier="${os.detected.classifier}" type="jar" />
310+
</target>
311+
</configuration>
312+
</execution>
313+
</executions>
314+
</plugin>
315+
316+
<!-- Configure the distribution statically linked against OpenSSL and APR -->
317+
<plugin>
318+
<groupId>org.fusesource.hawtjni</groupId>
319+
<artifactId>maven-hawtjni-plugin</artifactId>
320+
<executions>
321+
<execution>
322+
<id>build-native-lib</id>
323+
<goals>
324+
<goal>generate</goal>
325+
<goal>build</goal>
326+
</goals>
327+
<phase>compile</phase>
328+
<configuration>
329+
<name>netty_tcnative</name>
330+
<nativeSourceDirectory>${generatedSourcesDir}/c</nativeSourceDirectory>
331+
<customPackageDirectory>${generatedSourcesDir}/native-package</customPackageDirectory>
332+
<libDirectory>${nativeLibOnlyDir}</libDirectory>
333+
<forceAutogen>${forceAutogen}</forceAutogen>
334+
<forceConfigure>${forceConfigure}</forceConfigure>
335+
<windowsBuildTool>msbuild</windowsBuildTool>
336+
<!-- <verbose>true</verbose> -->
337+
<configureArgs>
338+
<configureArg>--with-ssl=no</configureArg>
339+
<configureArg>--with-apr=${aprHome}</configureArg>
340+
<configureArg>--with-static-libs</configureArg>
341+
<configureArg>--libdir=${project.build.directory}/native-build/target/lib</configureArg>
342+
<configureArg>CFLAGS=-O3 -Werror -fno-omit-frame-pointer -fvisibility=hidden -Wunused -Wno-unused-value</configureArg>
343+
<configureArg>CPPFLAGS=-DHAVE_OPENSSL -I${boringsslCheckoutDir}/include</configureArg>
344+
<configureArg>LDFLAGS=-L${boringsslBuildDir}/ssl -L${boringsslBuildDir}/crypto -L${boringsslBuildDir}/decrepit -ldecrepit -lssl -lcrypto</configureArg>
345+
</configureArgs>
346+
</configuration>
347+
</execution>
348+
</executions>
349+
</plugin>
350+
</plugins>
351+
</build>
352+
</profile>
353+
78354
<!-- Default profile that builds a platform-specific jar -->
79355
<profile>
80356
<id>boringssl-static-default</id>
@@ -285,7 +561,7 @@
285561
<zipfileset dir="${nativeLibOnlyDir}/META-INF/native" />
286562
<regexpmapper handledirsep="yes" from="^(?:[^/]+/)*([^/]+)$" to="META-INF/native/\1" />
287563
</copy>
288-
564+
289565
<!-- linux / osx -->
290566
<move todir="${nativeJarWorkdir}/META-INF/native/" flatten="true">
291567
<fileset dir="${nativeJarWorkdir}/META-INF/native/" />

0 commit comments

Comments
 (0)