Support SONiC OpenSSL FIPS 140-3 based on SymCrypt engine #9573

xumia · 2021-12-17T02:25:48Z

Why I did it

Support OpenSSL FIPS 140-3, see design doc: https://github.com/Azure/SONiC/blob/master/doc/fips/SONiC-OpenSSL-FIPS-140-3.md.

How I did it

Install the fips packages.
To build the fips packages, see https://github.com/Azure/sonic-fips
Azure pipelines: https://dev.azure.com/mssonic/build/_build?definitionId=412

How to verify it

Validate the SymCrypt engine:

admin@sonic:~$ dpkg-query -W | grep openssl
openssl 1.1.1k-1+deb11u1+fips
symcrypt-openssl        0.1

admin@sonic:~$ openssl engine -v | grep -i symcrypt
(symcrypt) SCOSSL (SymCrypt engine for OpenSSL)
admin@sonic:~$

Install debug version of symcrypt and validate:

$ gdb --args openssl rand 10 
(gdb) b scossl_rand_bytes
(gdb) r
Starting program: /usr/bin/openssl rand 10

Breakpoint 1, scossl_rand_bytes (buf=0x7ffd81ce49f0 "200\024\t\300\004X\020\211\263!", num=10)
    at /src/SymCrypt-OpenSSL/SymCryptEngine/src/scossl_rand.c:23
23          SymCryptRandom(buf, num);

Test golang: when the fips is enabled, the test.go will call go boring api, call openssl api, and then call symcrypt api.

test.go:
import (
    "crypto/rand"
    "crypto/rsa"
)
func main() {
    rsa.GenerateKey(rand.Reader, 2048)
}

$ gdb test
(gdb) b scossl_rsa_keygen
(gdb) r
Thread 1 "test" hit Breakpoint 1, scossl_rsa_keygen (rsa=0x12299b0, bits=2048, e=0x122e490, cb=0x0) at /src/SymCrypt-OpenSSL/SymCryptEngine/src/scossl_rsa.c:638
638         PBYTE   ppbPrimes[2] = { 0 };

(gdb) bt
#0  scossl_rsa_keygen (rsa=0x12299b0, bits=2048, e=0x122e490, cb=0x0) at /src/SymCrypt-OpenSSL/SymCryptEngine/src/scossl_rsa.c:638
#1  0x00007f4e966a8446 in RSA_generate_key_ex (rsa=0x12299b0, bits=2048, e_value=0x122e490, cb=0x0) at ../crypto/rsa/rsa_gen.c:35
#2  0x00000000004025aa in crypto/internal/boring(.text) ()
...
#8  0x0000000000401c0e in _cgo_b67541c0c44c_Cfunc__goboringcrypto_RSA_generate_key_fips ()

Which release branch to backport (provide reason below if selected)

Description for the changelog

A picture of a cute animal (not mandatory but encouraged)

files/build_templates/sonic_debian_extension.j2

rules/sonic-fips.mk

qiluo-msft · 2021-12-21T08:00:07Z

rules/sonic-fips.mk

+
+SYMCRYPT_OPENSSL_NAME = symcrypt-openssl
+SYMCRYPT_OPENSSL = fips/$(SYMCRYPT_OPENSSL_NAME)_$(FIPS_VERSION)_$(CONFIGURED_ARCH).deb
+$(SYMCRYPT_OPENSSL)_SRC_PATH = $(SRC_PATH)/sonic-fips


sonic-fips

Do you want to add a new submodule in this PR? #Closed

No, we will use binaries only, it will take long time to build it.
And the module SymCryptDependencies is microsoft only (to test only), not available by public, see https://github.com/microsoft/SymCrypt/blob/0f83207858253be11f473dced88b146895004419/.gitmodules#L3
We do not have hard the dependency on the submodule, it can be skipped during the build. We will have a trouble if using it, cannot checkout code recursively.

If these packages need to be updated (for fixing security issues, or features/functionality), is there an easy way to rebuild the FIPS packages?

Yes, see https://github.com/Azure/sonic-fips.
I will add the artifacts publish automation later, currently, copy the artifacts to storage container manually.

which storage? Do you mean FIPS_URL_PREFIX? I notice the name difference: sonic-fips vs fips.

Yes, the same some of the other artifacts, sonicstorage.

Makefile.work

slave.mk

qiluo-msft · 2021-12-21T18:48:09Z

sonic-slave-bullseye/Dockerfile.j2

@@ -397,6 +397,13 @@ RUN sudo augtool --autosave "set /files/etc/dpkg/dpkg.cfg/force-confold"
 RUN apt-get -y build-dep linux

 # For gobgp and telemetry build
+{%- if INCLUDE_FIPS == "y" %}
+RUN wget -O golang-go.deb 'https://sonicstorage.blob.core.windows.net/public/fips/bullseye/0.1/golang-1.15-go_1.15.15-1~deb11u2%2Bfips_{{ CONFIGURED_ARCH }}.deb' \


1.15

RUN wget -O golang-go.deb 'https://sonicstorage.blob.core.windows.net/public/fips/bullseye/0.1/golang-1.15-go_1.15.15-1~deb11u2%2Bfips_{{ CONFIGURED_ARCH }}.deb' \

Can we use the same version as in else branch? Ideally, we should share the version constant, and build any version specified with FIPS. #Closed

Change all to use 1.15 for bullseye, align to the default one in bullseye.
And change to use the debian packages, not to download from google web site.

xumia · 2021-12-24T02:23:27Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2021-12-24T02:23:38Z

Azure Pipelines successfully started running 1 pipeline(s).

xumia · 2021-12-25T00:49:28Z

/azp run

azure-pipelines · 2021-12-25T00:49:33Z

You have several pipelines (over 10) configured to build pull requests in this repository. Specify which pipelines you would like to run by using /azp run [pipelines] command. You can specify multiple pipelines using a comma separated list.

xumia · 2021-12-25T00:50:58Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2021-12-25T00:51:11Z

Azure Pipelines successfully started running 1 pipeline(s).

xumia · 2022-02-18T00:15:38Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2022-02-18T00:15:50Z

Azure Pipelines successfully started running 1 pipeline(s).

xumia · 2022-02-18T01:34:51Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2022-02-18T01:35:03Z

Azure Pipelines successfully started running 1 pipeline(s).

xumia · 2022-04-29T03:19:33Z

@qiluo-msft , @saiarcot895 , could you please help review again?

slave.mk

rules/config

qiluo-msft · 2022-04-29T23:46:53Z

files/build_templates/sonic_debian_extension.j2

+# Remove sshd host keys, and will regenerate on first sshd start. This needs to be
+# done again here because our custom version of sshd is being installed, which
+# will regenerate the sshd host keys.
+sudo rm -f $FILESYSTEM_ROOT/etc/ssh/ssh_host_*_key*


Why move this statement? #Closed

When installing openssl/openssh for fips, the ssh key will be generated again, so moving the removal step after all installing steps are complete.

As my understanding, in original code, removal step is after all openssl/openssh installing steps.

If you have a good reason, is it a general bug fix?

It is not a bug, there is an additional installation step to install debian packages, the FIPS packages are installed in the step, see https://github.com/Azure/sonic-buildimage/blob/53e5fe6a93b051c8319d51e109d317beb5166e77/files/build_templates/sonic_debian_extension.j2#L598

We move the removal step, because the FIPS packages will generate the ssh keys again.

qiluo-msft · 2022-04-30T00:16:07Z

installer/x86_64/install.sh

+# Add extra linux command line
+extra_cmdline_linux=%%EXTRA_CMDLINE_LINUX%%
+echo "EXTRA_CMDLINE_LINUX=$extra_cmdline_linux"
+ONIE_PLATFORM_EXTRA_CMDLINE_LINUX="$ONIE_PLATFORM_EXTRA_CMDLINE_LINUX $extra_cmdline_linux"


ONIE_PLATFORM_EXTRA_CMDLINE_LINUX

ONIE_PLATFORM_EXTRA_CMDLINE_LINUX="$ONIE_PLATFORM_EXTRA_CMDLINE_LINUX $extra_cmdline_linux"

Do not combine %%EXTRA_CMDLINE_LINUX%% with ONIE_PLATFORM_EXTRA_CMDLINE_LINUX. Just add %%EXTRA_CMDLINE_LINUX%% to below menuentry template. #Closed

Sorry, by semantics, GRUB_CMDLINE_LINUX should include %%EXTRA_CMDLINE_LINUX%%

Thanks, fixed, better to use GRUB_CMDLINE_LINUX .

1. Fix type issue 2. Support build from source for fips 3. Use GRUB_CMDLINE_LINUX

rules/config

xumia · 2022-05-01T03:16:13Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2022-05-01T03:16:26Z

Azure Pipelines successfully started running 1 pipeline(s).

qiluo-msft

LGTM. Please check with other reviewers.

xumia · 2022-05-05T08:04:29Z

@saiarcot895 , could you please help review it again? Thanks.

…9573) Why I did it Support OpenSSL FIPS 140-3, see design doc: https://github.com/Azure/SONiC/blob/master/doc/fips/SONiC-OpenSSL-FIPS-140-3.md. How I did it Install the fips packages. To build the fips packages, see https://github.com/Azure/sonic-fips Azure pipelines: https://dev.azure.com/mssonic/build/_build?definitionId=412 How to verify it Validate the SymCrypt engine: admin@sonic:~$ dpkg-query -W | grep openssl openssl 1.1.1k-1+deb11u1+fips symcrypt-openssl 0.1 admin@sonic:~$ openssl engine -v | grep -i symcrypt (symcrypt) SCOSSL (SymCrypt engine for OpenSSL) admin@sonic:~$

xumia force-pushed the support-symcrypt-fips-1 branch from 0ac0151 to 9e7189c Compare December 17, 2021 16:04

qiluo-msft requested review from lguohan and saiarcot895 December 21, 2021 07:53

qiluo-msft reviewed Dec 21, 2021

View reviewed changes

files/build_templates/sonic_debian_extension.j2 Outdated Show resolved Hide resolved

qiluo-msft reviewed Dec 21, 2021

View reviewed changes

rules/sonic-fips.mk Outdated Show resolved Hide resolved

qiluo-msft reviewed Dec 21, 2021

View reviewed changes

Makefile.work Outdated Show resolved Hide resolved

qiluo-msft reviewed Dec 21, 2021

View reviewed changes

slave.mk Outdated Show resolved Hide resolved

qiluo-msft reviewed Dec 21, 2021

View reviewed changes

xumia force-pushed the support-symcrypt-fips-1 branch from e62514f to 5302bb5 Compare December 23, 2021 02:40

xumia force-pushed the support-symcrypt-fips-1 branch from 706d421 to 0ef2083 Compare December 24, 2021 02:29

xumia force-pushed the support-symcrypt-fips-1 branch 2 times, most recently from e5e9ac3 to 1905773 Compare January 21, 2022 05:53

xumia force-pushed the support-symcrypt-fips-1 branch from 1905773 to 91b6d03 Compare February 9, 2022 11:35

xumia force-pushed the support-symcrypt-fips-1 branch 4 times, most recently from 1a76fd6 to 34d2e14 Compare April 2, 2022 15:01

xumia force-pushed the support-symcrypt-fips-1 branch 2 times, most recently from 39bb11b to a970b1e Compare April 22, 2022 23:37

xumia changed the title ~~Support symcrypt crypto module for fips~~ Support SONiC OpenSSL FIPS 140-3 based on SymCrypt engine Apr 22, 2022

xumia force-pushed the support-symcrypt-fips-1 branch 2 times, most recently from 4619899 to 152115f Compare April 27, 2022 09:06

xumia marked this pull request as ready for review April 28, 2022 14:21

saiarcot895 reviewed Apr 29, 2022

View reviewed changes

slave.mk Outdated Show resolved Hide resolved

saiarcot895 reviewed Apr 29, 2022

View reviewed changes

rules/config Show resolved Hide resolved

qiluo-msft reviewed Apr 29, 2022

View reviewed changes

qiluo-msft reviewed Apr 30, 2022

View reviewed changes

xumia added 6 commits April 30, 2022 01:55

Support SONiC OpenSSL FIPS 140-3 based on SymCrypt engine

cb08169

Fix the shell command line format issue

23ba9a5

Change the grub sonic fips config

e88931e

Add the fips config in the EXTRA_CMDLINE_LINUX

b001bb2

Fix ssh key generate again issue

13acc89

Fix some issues as comments

e446ccc

1. Fix type issue 2. Support build from source for fips 3. Use GRUB_CMDLINE_LINUX

xumia force-pushed the support-symcrypt-fips-1 branch from 152115f to e446ccc Compare April 30, 2022 01:55

qiluo-msft reviewed Apr 30, 2022

View reviewed changes

rules/config Outdated Show resolved Hide resolved

Make the rule/config simple

d21c0d3

Change FIPS config

b96e04a

qiluo-msft approved these changes May 5, 2022

View reviewed changes

saiarcot895 approved these changes May 5, 2022

View reviewed changes

xumia merged commit 8ec8900 into sonic-net:master May 5, 2022

xumia deleted the support-symcrypt-fips-1 branch May 5, 2022 23:21

xumia mentioned this pull request May 7, 2022

SONIC OpenSSL FIPS 140-3 HLD sonic-net/SONiC#955

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support SONiC OpenSSL FIPS 140-3 based on SymCrypt engine #9573

Support SONiC OpenSSL FIPS 140-3 based on SymCrypt engine #9573

xumia commented Dec 17, 2021 •

edited

Loading

qiluo-msft Dec 21, 2021 •

edited

Loading

xumia Dec 21, 2021 •

edited

Loading

saiarcot895 Dec 21, 2021

xumia Dec 23, 2021

qiluo-msft Jan 4, 2022

xumia Jan 21, 2022

qiluo-msft Dec 21, 2021 •

edited

Loading

xumia Dec 23, 2021

xumia commented Dec 24, 2021

azure-pipelines bot commented Dec 24, 2021

xumia commented Dec 25, 2021

azure-pipelines bot commented Dec 25, 2021

xumia commented Dec 25, 2021

azure-pipelines bot commented Dec 25, 2021

xumia commented Feb 18, 2022

azure-pipelines bot commented Feb 18, 2022

xumia commented Feb 18, 2022

azure-pipelines bot commented Feb 18, 2022

xumia commented Apr 29, 2022 •

edited

Loading

qiluo-msft Apr 29, 2022 •

edited

Loading

xumia Apr 29, 2022

qiluo-msft Apr 29, 2022

xumia Apr 30, 2022

qiluo-msft Apr 30, 2022 •

edited

Loading

qiluo-msft Apr 30, 2022

xumia Apr 30, 2022

xumia commented May 1, 2022

azure-pipelines bot commented May 1, 2022

qiluo-msft left a comment

xumia commented May 5, 2022

Support SONiC OpenSSL FIPS 140-3 based on SymCrypt engine #9573

Support SONiC OpenSSL FIPS 140-3 based on SymCrypt engine #9573

Conversation

xumia commented Dec 17, 2021 • edited Loading

Why I did it

How I did it

How to verify it

Which release branch to backport (provide reason below if selected)

Description for the changelog

A picture of a cute animal (not mandatory but encouraged)

qiluo-msft Dec 21, 2021 • edited Loading

Choose a reason for hiding this comment

xumia Dec 21, 2021 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

qiluo-msft Dec 21, 2021 • edited Loading

Choose a reason for hiding this comment

RUN wget -O golang-go.deb 'https://sonicstorage.blob.core.windows.net/public/fips/bullseye/0.1/golang-1.15-go_1.15.15-1~deb11u2%2Bfips_{{ CONFIGURED_ARCH }}.deb' \

Choose a reason for hiding this comment

xumia commented Dec 24, 2021

azure-pipelines bot commented Dec 24, 2021

xumia commented Dec 25, 2021

azure-pipelines bot commented Dec 25, 2021

xumia commented Dec 25, 2021

azure-pipelines bot commented Dec 25, 2021

xumia commented Feb 18, 2022

azure-pipelines bot commented Feb 18, 2022

xumia commented Feb 18, 2022

azure-pipelines bot commented Feb 18, 2022

xumia commented Apr 29, 2022 • edited Loading

qiluo-msft Apr 29, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

qiluo-msft Apr 30, 2022 • edited Loading

Choose a reason for hiding this comment

ONIE_PLATFORM_EXTRA_CMDLINE_LINUX="$ONIE_PLATFORM_EXTRA_CMDLINE_LINUX $extra_cmdline_linux"

Choose a reason for hiding this comment

Choose a reason for hiding this comment

xumia commented May 1, 2022

azure-pipelines bot commented May 1, 2022

qiluo-msft left a comment

Choose a reason for hiding this comment

xumia commented May 5, 2022

xumia commented Dec 17, 2021 •

edited

Loading

qiluo-msft Dec 21, 2021 •

edited

Loading

xumia Dec 21, 2021 •

edited

Loading

qiluo-msft Dec 21, 2021 •

edited

Loading

xumia commented Apr 29, 2022 •

edited

Loading

qiluo-msft Apr 29, 2022 •

edited

Loading

qiluo-msft Apr 30, 2022 •

edited

Loading