Compile FIPS rust binaries #173

arnaldo2792 · 2024-10-01T23:51:23Z

Issue number:
Related: bottlerocket-os/bottlerocket#1667

Description of changes:

The first commit in the series adds rustls and aws-smithy-experimental to the workspace dependencies, so that crates that depend on these libraries can enforce the FIPS flags each expose.

The subsequent commits add a fips flag to the binaries flagged by the check-fips script in the Bottlerocket SDK. In #191, the check-fips was disabled in Rust programs that required the FIPS treatment but in this series the checks are re-enabled.

The spec files for os was updated to provide the fips-bin package for any binary that needs it. This resembles what's already done for Go packages so that the correct binaries are installed in the image when the fips image flag is used while building a variant.

pluto was modified to split the HTTP Proxy support, given that aws-smithy-experimental doesn't expose the same APIs as the "stable" aws-smithy.

Testing done:

I enabled the fips image flag in aws-k8s-1.30, and confirmed the fips-bin packages were installed:

[root@admin]# cat /.bottlerocket/rootfs/x86_64-bottlerocket-linux-gnu/sys-root/usr/share/bottlerocket/application-inventory.json | jq '.Content[].Name' -r | grep fips-bin
apiclient-fips-bin
aws-iam-authenticator-fips-bin
aws-signing-helper-fips-bin
cfsignal-fips-bin
cni-plugins-fips-bin
containerd-fips-bin
early-boot-config-aws-fips-bin
ecr-credential-provider-1.30-fips-bin
host-ctr-fips-bin
hostname-imds-fips-bin
kubelet-1.30-fips-bin
logdog-fips-bin
metricdog-fips-bin
migration-fips-bin
pluto-fips-bin
runc-fips-bin
shibaken-fips-bin
updog-fips-bin

The instance joined the cluster:

└─> ❯ k get nodes
NAME                                          STATUS   ROLES    AGE     VERSION
ip-192-168-81-52.us-west-2.compute.internal   Ready    <none>   3h18m   v1.30.1-eks-e564799

I checked the FIPS binaries in /usr/bin/ and /usr/libexec are actually the FIPS binaries and not their non-FIPS counterpart.

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.

arnaldo2792 · 2024-10-08T23:41:11Z

Forced push includes:

Add feature flags to the crates that require fips treatment
Compile additional fips binaries for the crates that require them

bcressey

Nice. The os.spec changes are large but look good.

Curious to see what this does to build times 😟 but overall it's clean and lines up with what we've done for Go.

sources/api/migration/migrator/Cargo.toml

sources/api/apiclient/Cargo.toml

sources/imdsclient/Cargo.toml

sources/logdog/Cargo.toml

sources/api/pluto/src/eks.rs

packages/os/os.spec

arnaldo2792 · 2024-10-15T15:23:35Z

(Forced push includes a rebase)

arnaldo2792 · 2024-10-15T17:16:43Z

(Forced push includes a rebase onto develop and #197 )

arnaldo2792 · 2024-10-16T19:38:59Z

Forced push includes:

For pluto, split the Proxy support since aws-smithy-experimental doesn't expose a property to override the HttpConnector in the client as we do today
For cfsignal, migrate to aws-smithy-experimental but unlike pluto we don't support Proxies in it. There is a tracking issue for that (Missing support for HTTP Proxy in cfsignal #187)
Provide *-fips-bin packages for early-boot-config and netdog
Addressed comments in previous revision

I'll keep it as a draft until I remove my hack commit to increase the Twoliter version.

arnaldo2792 · 2024-10-16T20:24:00Z

(forced update removes hack commit to bump twoliter's version)

packages/netdog/netdog.spec

packages/early-boot-config/early-boot-config.spec

sources/api/pluto/src/ec2.rs

sources/api/pluto/src/eks.rs

packages/os/os.spec

arnaldo2792 · 2024-10-19T01:20:27Z

Forced push includes:

Drop early-boot-config and netdog FIPS binaries
Add additional tls flags for imdsclient and apiclient to turn on and off TLS support whenever needed
Rename HyperClientBuilder to Hyper10ClientBuilder
Add missing Requires to logdog subpackages

packages/os/os.spec

sources/api/pluto/src/eks.rs

arnaldo2792 · 2024-10-22T04:17:33Z

Forced push includes:

Separate Conflicts for updog
Drop fips feature flag for imdsclient since for the time being it is an HTTP-only client
Install rustls crypto provider in pluto, cfsignal and shibaken. This last one doesn't really requires it but due to feature unification, the check-fips script flags shibaken as required to be built with aws-lc-rs

arnaldo2792 · 2024-10-22T04:19:23Z

(Forced push updates commit messages to drop extra Signed-off-by comment)

arnaldo2792 · 2024-10-22T04:21:28Z

(Forced push updates commit message for shibaken changes)

arnaldo2792 · 2024-10-22T21:42:30Z

(Forced push fixes nits in commit messages)

arnaldo2792 · 2024-10-23T03:53:53Z

Forced push includes:

Vend aws-smithy-experimental
Fix commit messages as suggested

bcressey

CI is failing and has a suggested fix for Cargo.toml:

error: unexpected `cfg` condition name: `crypto_unstable`
   --> aws-smithy-experimental/src/hyper_1_0.rs:687:11
    |
687 |     #[cfg(crypto_unstable)]
    |           ^^^^^^^^^^^^^^^
    |
    = help: expected names are: `clippy`, `debug_assertions`, `doc`, `docsrs`, `doctest`, `feature`, `miri`, `overflow_checks`, `panic`, `proc_macro`, `relocation_model`, `rustfmt`, `sanitize`, `sanitizer_cfi_generalize_pointers`, `sanitizer_cfi_normalize_integers`, `target_abi`, `target_arch`, `target_endian`, `target_env`, `target_family`, `target_feature`, `target_has_atomic`, `target_has_atomic_equal_alignment`, `target_has_atomic_load_store`, `target_os`, `target_pointer_width`, `target_thread_local`, `target_vendor`, `test`, `ub_checks`, `unix`, and `windows`
    = help: consider using a Cargo feature instead
    = help: or consider adding in `Cargo.toml` the `check-cfg` lint config for the lint:
             [lints.rust]
             unexpected_cfgs = { level = "warn", check-cfg = ['cfg(crypto_unstable)'] }

bcressey · 2024-10-23T15:19:00Z

sources/aws-smithy-experimental/external-types.toml

+allowed_external_types = [
+    "aws_smithy_runtime_api::*",
+    "aws_smithy_async::*"
+]


nit: we can exclude this

bcressey · 2024-10-23T15:21:11Z

COPYRIGHT

+
+=^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=
+
+Contains modified aws-smithy-experimental files [README.md, Cargo.toml] from


I would drop this specific list and update this in a PR that actually adds source code changes:

Contains aws-smithy-experimental files from

bcressey · 2024-10-23T15:21:33Z

COPYRIGHT

+=^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=
+
+Contains modified aws-smithy-experimental files [README.md, Cargo.toml] from
+https://github.com/smithy-lang/smithy-rs/tree/HEAD/rust-runtime/aws-smithy-experimental 2024-10-22.


This should point to a stable commit or release tag of some kind.

arnaldo2792 · 2024-10-23T18:20:05Z

Forced push includes:

Use release-2024-10-09 in COPYRIGHT for aws-smithy-experimental
Remove external-types.toml
Add linting rule to warn instead of fail for the missing crypto_unstable flag

packages/os/os.spec

sources/api/pluto/Cargo.toml

ginglis13 · 2024-10-23T19:00:28Z

sources/logdog/src/log_request.rs

@@ -286,6 +286,8 @@ where

 /// Uses the reqwest library to send a GET request to `URL` and returns the response.
 fn send_get_request(url: &str) -> Result<Response> {
+    let _ = rustls::crypto::aws_lc_rs::default_provider().install_default();


do we want to install_default() in respective main / run functions for our sources ?

https://docs.rs/rustls/latest/rustls/crypto/struct.CryptoProvider.html#using-the-per-process-default-cryptoprovider

applications should call CryptoProvider::install_default() early in their fn main(). If applications uses a custom provider based on the one built-in, they can activate the custom-provider feature to ensure its usage.

I see that's done for other cases of install_default() in this PR

I didn't want to install the default provider unless really necessary. For logdog, that's only when the request type is http or https.

bcressey · 2024-10-23T19:29:41Z

sources/aws-smithy-experimental/Cargo.toml

+description = "Experiments for the smithy-rs ecosystem"
+edition = "2021"
+license = "Apache-2.0"
+repository = "https://github.com/smithy-lang/smithy-rs"


nit: we should set publish = false here, and remove the repo URL, since we don't want to ever publish this fork of the crate

Vend `aws-smithy-experimental` so that we can use the APIs required to support Proxies in AWS SDK clients Signed-off-by: Arnaldo Garcia Rincon <[email protected]>

Add `tls` feature flag to allow consumers of the crate opt-in to TLS connections when required. Additionally, add `fips` feature flag to constrain any TLS connection to FIPS ciphers. Signed-off-by: Arnaldo Garcia Rincon <[email protected]> Signed-off-by: Ben Cressey <[email protected]>

Force the `aws-lc-rs` crypto provider and expose the `fips` feature flag to constrain the binary to FIPS ciphers. Signed-off-by: Arnaldo Garcia Rincon <[email protected]> Signed-off-by: Ben Cressey <[email protected]>

Force the `aws-lc-rs` rustls' crypto provider and expose the `fips` feature flag to constrain the binary to FIPS ciphers. Signed-off-by: Arnaldo Garcia Rincon <[email protected]>

Force the `aws-lc-rs` rustls crypto provider and expose the `fips` feature flag to constrain the binary to FIPS ciphers. Signed-off-by: Arnaldo Garcia Rincon <[email protected]>

Force the `aws-lc-rs` rustls' crypto provider and expose the `fips` feature flag to constrain the binary to FIPS ciphers. Signed-off-by: Arnaldo Garcia Rincon <[email protected]>

Force the `aws-lc-rs` rustls' crypto provider and expose the `fips` feature flag to constrain the binary to FIPS ciphers. Also migrate to HyperClientBuilder exposed by `aws-smithy-experiment` Signed-off-by: Arnaldo Garcia Rincon <[email protected]>

Force the `aws-lc-rs` crypto provider and expose the `fips` feature flag to constrain the binary to FIPS ciphers. Initial migration to HyperClientBuilder provided by `aws-smithy-experimental` Signed-off-by: Arnaldo Garcia Rincon <[email protected]> Signed-off-by: Ben Cressey <[email protected]>

Refactor how the Rust binaries that require FIPS treatment are provided and installed. Signed-off-by: Arnaldo Garcia Rincon <[email protected]>

Now all Rust builds should pass the check-fips check Signed-off-by: Arnaldo Garcia Rincon <[email protected]>

arnaldo2792 · 2024-10-23T20:34:52Z

Forced push includes:

Fix format in pluto/Cargo.toml for imdsclient dependency
Prevent aws-smithy-experimental copy from being published
Address other nits

sources/api/migration/migrator/Cargo.toml

arnaldo2792 requested a review from bcressey October 1, 2024 23:51

arnaldo2792 force-pushed the fips branch from f93bb84 to f226faf Compare October 8, 2024 23:39

bcressey reviewed Oct 9, 2024

View reviewed changes

arnaldo2792 force-pushed the fips branch from f226faf to 5178e61 Compare October 15, 2024 15:22

arnaldo2792 force-pushed the fips branch from 5178e61 to c4ae476 Compare October 15, 2024 17:16

arnaldo2792 force-pushed the fips branch from c4ae476 to 51ac247 Compare October 16, 2024 19:34

arnaldo2792 force-pushed the fips branch from 51ac247 to f7c2f43 Compare October 16, 2024 20:23

arnaldo2792 marked this pull request as ready for review October 16, 2024 22:01

arnaldo2792 requested review from bcressey, ginglis13 and cbgbt October 16, 2024 22:01

bcressey reviewed Oct 17, 2024

View reviewed changes

arnaldo2792 force-pushed the fips branch from f7c2f43 to e638a9e Compare October 19, 2024 01:17

ginglis13 reviewed Oct 21, 2024

View reviewed changes

packages/os/os.spec Show resolved Hide resolved

ginglis13 approved these changes Oct 21, 2024

View reviewed changes

bcressey reviewed Oct 21, 2024

View reviewed changes

sources/api/pluto/src/eks.rs Show resolved Hide resolved

arnaldo2792 force-pushed the fips branch from e638a9e to e2b11a2 Compare October 22, 2024 04:13

arnaldo2792 force-pushed the fips branch from e2b11a2 to 3288703 Compare October 22, 2024 04:18

arnaldo2792 force-pushed the fips branch from 3288703 to 78f57ba Compare October 22, 2024 04:21

arnaldo2792 requested review from bcressey and ginglis13 October 22, 2024 04:21

arnaldo2792 force-pushed the fips branch from 78f57ba to 523f099 Compare October 22, 2024 21:41

arnaldo2792 force-pushed the fips branch from 523f099 to 4b5d638 Compare October 23, 2024 03:53

bcressey reviewed Oct 23, 2024

View reviewed changes

arnaldo2792 force-pushed the fips branch from 4b5d638 to d27c57b Compare October 23, 2024 18:18

arnaldo2792 requested review from bcressey and jpculp October 23, 2024 18:20

ginglis13 reviewed Oct 23, 2024

View reviewed changes

bcressey approved these changes Oct 23, 2024

View reviewed changes

arnaldo2792 added 11 commits October 23, 2024 20:33

sources: vend aws-smithy-experimental

8590dcf

Vend `aws-smithy-experimental` so that we can use the APIs required to support Proxies in AWS SDK clients Signed-off-by: Arnaldo Garcia Rincon <[email protected]>

shibaken: add FIPS feature flag

da1d97b

Force the `aws-lc-rs` crypto provider and expose the `fips` feature flag to constrain the binary to FIPS ciphers. Signed-off-by: Arnaldo Garcia Rincon <[email protected]> Signed-off-by: Ben Cressey <[email protected]>

logdog: add FIPS flag

4c8e6fe

Force the `aws-lc-rs` rustls' crypto provider and expose the `fips` feature flag to constrain the binary to FIPS ciphers. Signed-off-by: Arnaldo Garcia Rincon <[email protected]>

metricdog: add FIPS flag

d3f1774

Force the `aws-lc-rs` rustls crypto provider and expose the `fips` feature flag to constrain the binary to FIPS ciphers. Signed-off-by: Arnaldo Garcia Rincon <[email protected]>

migrator: add FIPS feature flag

2942d58

Force the `aws-lc-rs` rustls crypto provider and expose the `fips` feature flag to constrain the binary to FIPS ciphers. Signed-off-by: Arnaldo Garcia Rincon <[email protected]>

updog: add FIPS feature flag

08a7117

Force the `aws-lc-rs` rustls' crypto provider and expose the `fips` feature flag to constrain the binary to FIPS ciphers. Signed-off-by: Arnaldo Garcia Rincon <[email protected]>

cfsignal: add FIPS feature flag

661ba12

Force the `aws-lc-rs` rustls' crypto provider and expose the `fips` feature flag to constrain the binary to FIPS ciphers. Also migrate to HyperClientBuilder exposed by `aws-smithy-experiment` Signed-off-by: Arnaldo Garcia Rincon <[email protected]>

os: package Rust FIPS binaries

24f3ee2

Refactor how the Rust binaries that require FIPS treatment are provided and installed. Signed-off-by: Arnaldo Garcia Rincon <[email protected]>

packages: enable check-fips script for Rust builds

6dbf2f5

Now all Rust builds should pass the check-fips check Signed-off-by: Arnaldo Garcia Rincon <[email protected]>

arnaldo2792 force-pushed the fips branch from d27c57b to 6dbf2f5 Compare October 23, 2024 20:33

ginglis13 approved these changes Oct 23, 2024

View reviewed changes

jpculp reviewed Oct 23, 2024

View reviewed changes

sources/api/migration/migrator/Cargo.toml Show resolved Hide resolved

bcressey approved these changes Oct 23, 2024

View reviewed changes

jpculp mentioned this pull request Oct 24, 2024

pluto: add proxy support for FIPS #213

Merged

arnaldo2792 merged commit 957af11 into bottlerocket-os:develop Oct 24, 2024
2 checks passed

arnaldo2792 mentioned this pull request Oct 29, 2024

Portback apiclient feature flags bottlerocket-os/bottlerocket#4272

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Compile FIPS rust binaries #173

Compile FIPS rust binaries #173

arnaldo2792 commented Oct 1, 2024 •

edited by bcressey

Loading

arnaldo2792 commented Oct 8, 2024

bcressey left a comment

arnaldo2792 commented Oct 15, 2024

arnaldo2792 commented Oct 15, 2024

arnaldo2792 commented Oct 16, 2024

arnaldo2792 commented Oct 16, 2024

arnaldo2792 commented Oct 19, 2024

arnaldo2792 commented Oct 22, 2024

arnaldo2792 commented Oct 22, 2024

arnaldo2792 commented Oct 22, 2024

arnaldo2792 commented Oct 22, 2024

arnaldo2792 commented Oct 23, 2024

bcressey left a comment

bcressey Oct 23, 2024

bcressey Oct 23, 2024

bcressey Oct 23, 2024

arnaldo2792 commented Oct 23, 2024

ginglis13 Oct 23, 2024

arnaldo2792 Oct 23, 2024

bcressey Oct 23, 2024

arnaldo2792 commented Oct 23, 2024


		=^..^= =^..^= =^..^= =^..^= =^..^= =^..^= =^..^= =^..^= =^..^= =^..^= =^..^=

		Contains modified aws-smithy-experimental files [README.md, Cargo.toml] from

Compile FIPS rust binaries #173

Compile FIPS rust binaries #173

Conversation

arnaldo2792 commented Oct 1, 2024 • edited by bcressey Loading

arnaldo2792 commented Oct 8, 2024

bcressey left a comment

Choose a reason for hiding this comment

arnaldo2792 commented Oct 15, 2024

arnaldo2792 commented Oct 15, 2024

arnaldo2792 commented Oct 16, 2024

arnaldo2792 commented Oct 16, 2024

arnaldo2792 commented Oct 19, 2024

arnaldo2792 commented Oct 22, 2024

arnaldo2792 commented Oct 22, 2024

arnaldo2792 commented Oct 22, 2024

arnaldo2792 commented Oct 22, 2024

arnaldo2792 commented Oct 23, 2024

bcressey left a comment

Choose a reason for hiding this comment

bcressey Oct 23, 2024

Choose a reason for hiding this comment

bcressey Oct 23, 2024

Choose a reason for hiding this comment

bcressey Oct 23, 2024

Choose a reason for hiding this comment

arnaldo2792 commented Oct 23, 2024

ginglis13 Oct 23, 2024

Choose a reason for hiding this comment

arnaldo2792 Oct 23, 2024

Choose a reason for hiding this comment

bcressey Oct 23, 2024

Choose a reason for hiding this comment

arnaldo2792 commented Oct 23, 2024

arnaldo2792 commented Oct 1, 2024 •

edited by bcressey

Loading