Skip to content

server: fix fips_mode stat #16140

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jmarantz merged 16 commits into from
Apr 29, 2021
Merged

server: fix fips_mode stat #16140

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
16 commits
Select commit Hold shift + click to select a range
ad9176f
fix fips_mode stat
raakella Apr 23, 2021
8406245
change to bool
raakella Apr 23, 2021
bd10cca
change method name
raakella Apr 23, 2021
8ea6d96
fix condition
raakella Apr 23, 2021
839463c
debug fips build in CI
raakella Apr 26, 2021
bc0247f
debug fips stat in ci
raakella Apr 26, 2021
3c9ad43
debug fips stat in ci
raakella Apr 26, 2021
ff44858
debug fips stat in ci- change debug msg
raakella Apr 26, 2021
7724905
use versioninfo.sslversion to generate fips_mode stat
raakella Apr 27, 2021
8bd10d2
use ENVOY_SSL_FIPS as compiletime option
raakella Apr 27, 2021
597455e
fix build options for fips
raakella Apr 27, 2021
8a4fb1a
set ENVOY_SSL_FIPS in bazel build for test/common
raakella Apr 28, 2021
58410ee
fix ENVOY_SSL_FIPS argument
raakella Apr 28, 2021
ba2eb67
fix copts in test/common bazel build file
raakella Apr 28, 2021
7228d96
fix format error
raakella Apr 28, 2021
09a4926
remove static variable
raakella Apr 28, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion source/common/version/BUILD
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,10 @@ envoy_cc_library(
name = "version_lib",
srcs = ["version.cc"],
copts = envoy_select_boringssl(
["-DENVOY_SSL_VERSION=\\\"BoringSSL-FIPS\\\""],
[
"-DENVOY_SSL_VERSION=\\\"BoringSSL-FIPS\\\"",
"-DENVOY_SSL_FIPS",
],
["-DENVOY_SSL_VERSION=\\\"BoringSSL\\\""],
),
deps = [
Expand Down
8 changes: 4 additions & 4 deletions source/common/version/version.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,11 +37,11 @@ const envoy::config::core::v3::BuildVersion& VersionInfo::buildVersion() {
}

bool VersionInfo::sslFipsCompliant() {
bool fipsCompliant = false;
#ifdef BORINGSSL_FIPS
fipsCompliant = true;
#ifdef ENVOY_SSL_FIPS
return true;
#else
return false;
#endif
return fipsCompliant;
}

const std::string& VersionInfo::buildType() {
Expand Down
2 changes: 2 additions & 0 deletions test/common/common/BUILD
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ load(
"envoy_cc_fuzz_test",
"envoy_cc_test",
"envoy_package",
"envoy_select_boringssl",
)

licenses(["notice"]) # Apache 2
Expand Down Expand Up @@ -389,6 +390,7 @@ envoy_cc_test(
envoy_cc_test(
name = "version_test",
srcs = ["version_test.cc"],
copts = envoy_select_boringssl(["-DENVOY_SSL_FIPS"]),
external_deps = [
"abseil_strings",
],
Expand Down
11 changes: 11 additions & 0 deletions test/common/common/version_test.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@ class VersionInfoTestPeer {
public:
static const std::string& buildType() { return VersionInfo::buildType(); }
static const std::string& sslVersion() { return VersionInfo::sslVersion(); }
static bool sslFipsCompliant() { return VersionInfo::sslFipsCompliant(); }
static envoy::config::core::v3::BuildVersion makeBuildVersion(const char* version) {
return VersionInfo::makeBuildVersion(version);
}
Expand All @@ -34,6 +35,11 @@ TEST(VersionTest, BuildVersion) {
fields.at(BuildVersionMetadataKeys::get().RevisionStatus).string_value());
EXPECT_EQ(VersionInfoTestPeer::buildType(),
fields.at(BuildVersionMetadataKeys::get().BuildType).string_value());
#ifdef ENVOY_SSL_FIPS
EXPECT_TRUE(VersionInfoTestPeer::sslFipsCompliant());
#else
EXPECT_FALSE(VersionInfoTestPeer::sslFipsCompliant());
Comment thread
PiotrSikora marked this conversation as resolved.
#endif
EXPECT_EQ(VersionInfoTestPeer::sslVersion(),
fields.at(BuildVersionMetadataKeys::get().SslVersion).string_value());
}
Expand All @@ -45,6 +51,11 @@ TEST(VersionTest, MakeBuildVersionWithLabel) {
EXPECT_EQ(3, build_version.version().patch());
const auto& fields = build_version.metadata().fields();
EXPECT_GE(fields.size(), 1);
#ifdef ENVOY_SSL_FIPS
EXPECT_TRUE(VersionInfoTestPeer::sslFipsCompliant());
#else
EXPECT_FALSE(VersionInfoTestPeer::sslFipsCompliant());
#endif
EXPECT_EQ("foo-bar", fields.at(BuildVersionMetadataKeys::get().BuildLabel).string_value());
}

Expand Down