Skip to content

Commit 60aed1c

Browse files
Jenkins-JJenkins-J
authored
Build Envoy with aws_lc on Power (ppc64le) (envoyproxy#38403)
Signed-off-by: James Jenkins <[email protected]>
1 parent e51b31e commit 60aed1c

18 files changed

+483
-12
lines changed

‎README.md

+4
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,10 @@ positively or negatively.
9494

9595
For further details please see our complete [security release process](SECURITY.md).
9696

97+
### ppc64le builds
98+
99+
Builds for the ppc64le architecture or using aws-lc are not covered by the envoy security policy. The ppc64le architecture is currently best-effort and not maintained by the Envoy maintainers.
100+
97101
## Releases
98102

99103
For further details please see our [release process](https://github.com/envoyproxy/envoy/blob/main/RELEASES.md).

‎bazel/BUILD

+62-2
Original file line numberDiff line numberDiff line change
@@ -310,6 +310,22 @@ selects.config_setting_group(
310310
],
311311
)
312312

313+
selects.config_setting_group(
314+
name = "disable_http3_on_linux_ppc64le",
315+
match_all = [
316+
":disable_http3",
317+
":linux_ppc64le",
318+
],
319+
)
320+
321+
selects.config_setting_group(
322+
name = "disable_http3_on_not_x86_ppc",
323+
match_all = [
324+
":disable_http3",
325+
":not_x86_ppc",
326+
],
327+
)
328+
313329
selects.config_setting_group(
314330
name = "disable_http3_on_windows_x86_64",
315331
match_all = [
@@ -352,6 +368,14 @@ selects.config_setting_group(
352368
],
353369
)
354370

371+
selects.config_setting_group(
372+
name = "enable_http3_on_linux_ppc64le",
373+
match_all = [
374+
":enable_http3",
375+
":linux_ppc64le",
376+
],
377+
)
378+
355379
selects.config_setting_group(
356380
name = "enable_http3_on_windows_x86_64",
357381
match_all = [
@@ -503,6 +527,14 @@ selects.config_setting_group(
503527
],
504528
)
505529

530+
selects.config_setting_group(
531+
name = "boringssl_fips_ppc",
532+
match_all = [
533+
":boringssl_fips",
534+
":linux_ppc64le",
535+
],
536+
)
537+
506538
config_setting(
507539
name = "zlib_ng",
508540
constraint_values = [
@@ -544,18 +576,21 @@ config_setting(
544576
# Alias pointing to the selected version of BoringSSL:
545577
# - BoringSSL FIPS from @boringssl_fips//:ssl,
546578
# - non-FIPS BoringSSL from @boringssl//:ssl.
579+
# - aws-lc from @aws_lc//:ssl
547580
alias(
548581
name = "boringssl",
549582
actual = select({
550-
"//bazel:boringssl_fips": "@boringssl_fips//:ssl",
583+
"//bazel:boringssl_fips_ppc": "@aws_lc//:ssl",
584+
"//bazel:boringssl_fips_x86": "@boringssl_fips//:ssl",
551585
"//conditions:default": "@boringssl//:ssl",
552586
}),
553587
)
554588

555589
alias(
556590
name = "boringcrypto",
557591
actual = select({
558-
"//bazel:boringssl_fips": "@boringssl_fips//:crypto",
592+
"//bazel:boringssl_fips_ppc": "@aws_lc//:crypto",
593+
"//bazel:boringssl_fips_x86": "@boringssl_fips//:crypto",
559594
"//conditions:default": "@boringssl//:crypto",
560595
}),
561596
)
@@ -584,6 +619,14 @@ config_setting(
584619
],
585620
)
586621

622+
config_setting(
623+
name = "linux_ppc64le",
624+
constraint_values = [
625+
"@platforms//cpu:ppc64le",
626+
"@platforms//os:linux",
627+
],
628+
)
629+
587630
config_setting(
588631
name = "linux_s390x",
589632
constraint_values = [
@@ -793,6 +836,22 @@ selects.config_setting_group(
793836
],
794837
)
795838

839+
selects.config_setting_group(
840+
name = "not_x86_ppc",
841+
match_any = [
842+
":darwin_arm64",
843+
":ios_arm64",
844+
":ios_arm64e",
845+
":ios_armv7",
846+
":ios_armv7s",
847+
":ios_i386",
848+
":ios_sim_arm64",
849+
":linux_aarch64",
850+
":linux_mips64",
851+
":linux_s390x",
852+
],
853+
)
854+
796855
selects.config_setting_group(
797856
name = "not_x86",
798857
match_any = [
@@ -806,6 +865,7 @@ selects.config_setting_group(
806865
":linux_aarch64",
807866
":linux_mips64",
808867
":linux_ppc",
868+
":linux_ppc64le",
809869
":linux_s390x",
810870
],
811871
)

‎bazel/external/BUILD

+4-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,9 @@
11
licenses(["notice"]) # Apache 2
22

3-
exports_files(["boringssl_fips.genrule_cmd"])
3+
exports_files([
4+
"aws_lc.genrule_cmd",
5+
"boringssl_fips.genrule_cmd",
6+
])
47

58
# Use a wrapper cc_library with an empty source source file to force
69
# compilation of other cc_library targets that only list *.a sources.

‎bazel/external/aws_lc.BUILD

+34
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
licenses(["notice"]) # Apache 2
2+
3+
cc_library(
4+
name = "crypto",
5+
srcs = [
6+
"crypto/libcrypto.a",
7+
],
8+
hdrs = glob(["include/openssl/*.h"]),
9+
defines = ["BORINGSSL_FIPS"],
10+
includes = ["include"],
11+
visibility = ["//visibility:public"],
12+
)
13+
14+
cc_library(
15+
name = "ssl",
16+
srcs = [
17+
"ssl/libssl.a",
18+
],
19+
hdrs = glob(["include/openssl/*.h"]),
20+
includes = ["include"],
21+
visibility = ["//visibility:public"],
22+
deps = [":crypto"],
23+
)
24+
25+
genrule(
26+
name = "build",
27+
srcs = glob(["**"]),
28+
outs = [
29+
"crypto/libcrypto.a",
30+
"ssl/libssl.a",
31+
],
32+
cmd = "$(location {}) $(location crypto/libcrypto.a) $(location ssl/libssl.a)".format("@envoy//bazel/external:aws_lc.genrule_cmd"),
33+
tools = ["@envoy//bazel/external:aws_lc.genrule_cmd"],
34+
)

‎bazel/external/aws_lc.genrule_cmd

+166
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,166 @@
1+
#!/usr/bin/env bash
2+
3+
set -e
4+
5+
export CXXFLAGS=''
6+
export LDFLAGS=''
7+
8+
# BoringSSL build as described in the Security Policy for BoringCrypto module (2022-05-06):
9+
# https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp4407.pdf
10+
11+
OS=`uname`
12+
ARCH=`uname -m`
13+
# This works only on Linux-x86_64, Linux-ppc64le, and Linux-aarch64.
14+
15+
if [[ "$OS" != "Linux" || ("$ARCH" != "x86_64" && "$ARCH" != "aarch64" && "$ARCH" != "ppc64le") ]]; then
16+
echo "ERROR: AWS-LC FIPS is currently supported only on Linux-x86_64, Linux-ppc64le, and Linux-aarch64."
17+
exit 1
18+
fi
19+
20+
21+
# Bazel magic.
22+
# ROOT=$(dirname $(rootpath boringssl/BUILDING.md))/..
23+
ROOT=./external
24+
pushd "$ROOT"
25+
26+
# Build tools requirements (from section 12.1 of https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp4407.pdf):
27+
# - Clang compiler version 12.0.0 (https://releases.llvm.org/download.html)
28+
# - Go programming language version 1.16.5 (https://golang.org/dl/)
29+
# - Ninja build system version 1.10.2 (https://github.com/ninja-build/ninja/releases)
30+
# - Cmake version 3.20.1 (https://cmake.org/download/)
31+
32+
# Override $PATH for build tools, to avoid picking up anything else.
33+
export PATH="$(dirname `which cmake`):/usr/bin:/bin"
34+
35+
# Clang
36+
VERSION=14.0.0
37+
if [[ "$ARCH" == "x86_64" ]]; then
38+
PLATFORM="x86_64-linux-gnu-ubuntu-20.04"
39+
SHA256=61582215dafafb7b576ea30cc136be92c877ba1f1c31ddbbd372d6d65622fef5
40+
elif [[ "$ARCH" == "ppc64le" ]]; then
41+
PLATFORM="powerpc64le-linux-ubuntu-18.04"
42+
SHA256=2d504c4920885c86b306358846178bc2232dfac83b47c3b1d05861a8162980e6
43+
else
44+
PLATFORM="aarch64-linux-gnu"
45+
SHA256=1792badcd44066c79148ffeb1746058422cc9d838462be07e3cb19a4b724a1ee
46+
fi
47+
48+
curl -sLO https://github.com/llvm/llvm-project/releases/download/llvmorg-"$VERSION"/clang+llvm-"$VERSION"-"$PLATFORM".tar.xz
49+
tar xf clang+llvm-"$VERSION"-"$PLATFORM".tar.xz
50+
51+
export HOME="$PWD"
52+
printf "set(CMAKE_C_COMPILER \"clang\")\nset(CMAKE_CXX_COMPILER \"clang++\")\n" > ${HOME}/toolchain
53+
export PATH="$PWD/clang+llvm-$VERSION-$PLATFORM/bin:$PATH"
54+
55+
if [[ `clang --version | head -1 | awk '{print $3}'` != "$VERSION" ]]; then
56+
echo "ERROR: Clang version doesn't match. Expected: ${VERSION}, Got: $(clang --version)"
57+
exit 1
58+
fi
59+
60+
# Go
61+
VERSION=1.18.1
62+
if [[ "$ARCH" == "x86_64" ]]; then
63+
PLATFORM="linux-amd64"
64+
SHA256=b3b815f47ababac13810fc6021eb73d65478e0b2db4b09d348eefad9581a2334
65+
elif [[ "$ARCH" == "ppc64le" ]]; then
66+
PLATFORM="linux-ppc64le"
67+
SHA256=33db623d1eecf362fe365107c12efc90eff0b9609e0b3345e258388019cb552a
68+
else
69+
PLATFORM="linux-arm64"
70+
SHA256=56a91851c97fb4697077abbca38860f735c32b38993ff79b088dac46e4735633
71+
fi
72+
73+
curl -sLO https://dl.google.com/go/go"$VERSION"."$PLATFORM".tar.gz \
74+
&& echo "$SHA256" go"$VERSION"."$PLATFORM".tar.gz | sha256sum --check
75+
tar xf go"$VERSION"."$PLATFORM".tar.gz
76+
77+
export GOPATH="$PWD/gopath"
78+
export GOROOT="$PWD/go"
79+
export PATH="$GOPATH/bin:$GOROOT/bin:$PATH"
80+
81+
if [[ `go version | awk '{print $3}'` != "go$VERSION" ]]; then
82+
echo "ERROR: Go version doesn't match."
83+
exit 1
84+
fi
85+
86+
# Ninja
87+
VERSION=1.10.2
88+
SHA256=ce35865411f0490368a8fc383f29071de6690cbadc27704734978221f25e2bed
89+
curl -sLO https://github.com/ninja-build/ninja/archive/refs/tags/v"$VERSION".tar.gz \
90+
&& echo "$SHA256" v"$VERSION".tar.gz | sha256sum --check
91+
tar -xvf v"$VERSION".tar.gz
92+
cd ninja-"$VERSION"
93+
python3 ./configure.py --bootstrap
94+
95+
export PATH="$PWD:$PATH"
96+
97+
if [[ `ninja --version` != "$VERSION" ]]; then
98+
echo "ERROR: Ninja version doesn't match."
99+
exit 1
100+
fi
101+
cd ..
102+
103+
# CMake
104+
VERSION=3.22.1
105+
if [[ "$ARCH" != "ppc64le" ]]; then
106+
if [[ "$ARCH" == "x86_64" ]]; then
107+
PLATFORM="linux-x86_64"
108+
SHA256=73565c72355c6652e9db149249af36bcab44d9d478c5546fd926e69ad6b43640
109+
else
110+
PLATFORM="linux-aarch64"
111+
SHA256=601443375aa1a48a1a076bda7e3cca73af88400463e166fffc3e1da3ce03540b
112+
fi
113+
114+
curl -sLO https://github.com/Kitware/CMake/releases/download/v"$VERSION"/cmake-"$VERSION"-"$PLATFORM".tar.gz \
115+
&& echo "$SHA256" cmake-"$VERSION"-"$PLATFORM".tar.gz | sha256sum --check
116+
tar xf cmake-"$VERSION"-"$PLATFORM".tar.gz
117+
export PATH="$PWD/cmake-$VERSION-$PLATFORM/bin:$PATH"
118+
else
119+
PLATFORM="linux-ppc64le"
120+
echo "Building cmake for ppc64le"
121+
122+
curl -sL -o cmake-$VERSION-$PLATFORM.tar.gz https://github.com/Kitware/CMake/releases/download/v"$VERSION"/cmake-"$VERSION".tar.gz
123+
tar xf cmake-"$VERSION"-"$PLATFORM".tar.gz
124+
125+
cd cmake-"$VERSION"
126+
./bootstrap && make
127+
export PATH="$PWD/bin:$PATH"
128+
cd ..
129+
fi
130+
131+
if [[ `cmake --version | head -n1` != "cmake version $VERSION" ]]; then
132+
echo "PATH: $PATH"
133+
echo "PLATFORM: $PLATFORM"
134+
echo "ERROR: CMake version doesn't match. Expected: ${VERSION}, Got: $(cmake --version | head -n1)"
135+
exit 1
136+
fi
137+
138+
echo "Cmake installed successfully"
139+
echo "PWD: $PWD"
140+
141+
# Clean after previous build.
142+
rm -rf aws_lc/build
143+
144+
# Build BoringSSL.
145+
cd aws_lc
146+
147+
# Setting -fPIC only affects the compilation of the non-module code in libcrypto.a,
148+
# because the FIPS module itself is already built with -fPIC.
149+
mkdir build && cd build && cmake -GNinja -DCMAKE_TOOLCHAIN_FILE=${HOME}/toolchain -DFIPS=1 -DCMAKE_BUILD_TYPE=Release -DCMAKE_C_FLAGS="-fPIC" -DCMAKE_CXX_FLAGS="-fPIC" ..
150+
ninja
151+
export GTEST_FILTER="-SSLTest.HostMatching"
152+
#ninja run_tests
153+
./crypto/crypto_test
154+
155+
echo "created build directory and built aws_lc with ninja"
156+
157+
# Verify correctness of the FIPS build.
158+
if [[ `tool/bssl isfips` != "1" ]]; then
159+
echo "ERROR: BoringSSL tool didn't report FIPS build."
160+
exit 1
161+
fi
162+
163+
# Move compiled libraries to the expected destinations.
164+
popd
165+
mv $ROOT/aws_lc/build/crypto/libcrypto.a $1
166+
mv $ROOT/aws_lc/build/ssl/libssl.a $2

‎bazel/protobuf.patch

+11-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
diff --git a/BUILD.bazel b/BUILD.bazel
2-
index 32b26cbdc..e28b8e387 100644
2+
index 32b26cbdc..a5e7a554c 100644
33
--- a/BUILD.bazel
44
+++ b/BUILD.bazel
5-
@@ -229,14 +229,79 @@ alias(
5+
@@ -229,14 +229,88 @@ alias(
66
visibility = ["//visibility:public"],
77
)
88

@@ -35,6 +35,14 @@ index 32b26cbdc..e28b8e387 100644
3535
+)
3636
+
3737
+config_setting(
38+
+ name = "linux-ppcle_64",
39+
+ constraint_values = [
40+
+ "@platforms//os:linux",
41+
+ "@platforms//cpu:ppc64le",
42+
+ ],
43+
+)
44+
+
45+
+config_setting(
3846
+ name = "osx-aarch_64",
3947
+ constraint_values = [
4048
+ "@platforms//os:osx",
@@ -64,6 +72,7 @@ index 32b26cbdc..e28b8e387 100644
6472
+ actual = select({
6573
+ ":linux-aarch_64": "@com_google_protobuf_protoc_linux_aarch_64//:protoc",
6674
+ ":linux-x86_64": "@com_google_protobuf_protoc_linux_x86_64//:protoc",
75+
+ ":linux-ppcle_64": "@com_google_protobuf_protoc_linux_ppcle_64//:protoc",
6776
+ ":osx-aarch_64": "@com_google_protobuf_protoc_osx_aarch_64//:protoc",
6877
+ ":osx-x86_64": "@com_google_protobuf_protoc_osx_x86_64//:protoc",
6978
+ ":win64": "@com_google_protobuf_protoc_win64//:protoc",

0 commit comments

Comments
 (0)