ci: add openssl-3.0-fips builds (aws#5037)

codebuild/bin/install_openssl_3_0.sh

@@ -17,27 +17,46 @@ set -ex
 pushd "$(pwd)"
 
 usage() {
-    echo "install_openssl_3_0.sh build_dir install_dir os_name"
+    echo "install_openssl_3_0.sh build_dir install_dir os_name [fips]"
     exit 1
 }
 
-if [ "$#" -ne "3" ]; then
+if [ "$#" -eq "3" ]; then
+    FIPS=false
+elif [ "$#" -eq "4" ] && [ "$4" = "fips" ]; then
+    FIPS=true
+else
     usage
 fi
 
 BUILD_DIR=$1
 INSTALL_DIR=$2
 OS_NAME=$3
 source codebuild/bin/jobs.sh
-RELEASE=3.0.7
+config=$(cat codebuild/bin/s2n_fips_openssl.cnf)
+
+# Only some versions of Openssl-3 are FIPS validated.
+# The list can be found at https://openssl-library.org/source/
+# Maintain separate release versions so that we can change the non-FIPS version
+# without worrying about whether or not the new version is FIPS validated.
+if $FIPS; then
+    RELEASE=3.0.9
+else
+    RELEASE=3.0.7
+fi
 
 mkdir -p $BUILD_DIR
 cd "$BUILD_DIR"
-curl --retry 3 -L https://github.com/openssl/openssl/archive/refs/tags/openssl-${RELEASE}.zip --output OpenSSL_${RELEASE}.zip
+curl --retry 3 -L --output OpenSSL_${RELEASE}.zip \
+    https://github.com/openssl/openssl/archive/refs/tags/openssl-${RELEASE}.zip
 unzip OpenSSL_${RELEASE}.zip
 cd openssl-openssl-${RELEASE}
 
-CONFIGURE="./Configure "
+if $FIPS; then
+    CONFIGURE="./Configure enable-fips"
+else
+    CONFIGURE="./Configure"
+fi
 
 mkdir -p $INSTALL_DIR
 # Use g3 to get debug symbols in libcrypto to chase memory leaks
@@ -59,4 +78,17 @@ pushd $INSTALL_DIR
 ln -s lib64 lib
 popd
 
+# Openssl3 uses the openssl config file to enable fips
+# See https://docs.openssl.org/master/man7/fips_module/#making-all-applications-use-the-fips-module-by-default
+if $FIPS; then
+    # We assume that the configs are in the /ssl directory of $INSTALL_DIR
+    pushd $INSTALL_DIR
+    config_path=./ssl/openssl.cnf
+    # We need an absolute path for the fips config
+    fips_config_path=$(pwd)/ssl/fipsmodule.cnf
+    config=$(echo "$config" | sed "s,S2N_FIPS_CONFIG_PATH,$fips_config_path,")
+    echo "$config" > $config_path
+    popd
+fi
+
 exit 0