Skip to content

Commit dde9ffb

Browse files
authored
Merge pull request #1805 from skmcgrail/aws-lc-support-final
Add support for AWS-LC to openssl and openssl-sys crates
2 parents a5419bc + 71a9ac9 commit dde9ffb

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

48 files changed

+693
-411
lines changed

.github/workflows/ci.yml

+36-5
Original file line numberDiff line numberDiff line change
@@ -151,6 +151,10 @@ jobs:
151151
- true
152152
- false
153153
library:
154+
- name: aws-lc
155+
version: v1.48.2
156+
- name: aws-lc
157+
version: vendored
154158
- name: boringssl
155159
version: e23fe9b6eecc10e4f9ea1f0027fea5eaee7bd6b6
156160
- name: openssl
@@ -276,18 +280,25 @@ jobs:
276280
url="https://boringssl.googlesource.com/boringssl/+archive/${{ matrix.library.version }}.tar.gz"
277281
tar_flags=""
278282
;;
283+
"aws-lc")
284+
url="https://github.com/aws/aws-lc/archive/refs/tags/${{ matrix.library.version }}.tar.gz"
285+
tar_flags="--strip-components=1"
286+
;;
279287
esac
280288
281289
case "${{ matrix.target}}" in
282290
"x86_64-unknown-linux-gnu")
291+
CPU=x86_64
283292
OS_COMPILER=linux-x86_64
284293
OS_FLAGS=""
285294
;;
286295
"i686-unknown-linux-gnu")
296+
CPU=i686
287297
OS_COMPILER=linux-elf
288298
OS_FLAGS="-m32 -msse2"
289299
;;
290300
"arm-unknown-linux-gnueabihf")
301+
CPU=armv4
291302
OS_COMPILER=linux-armv4
292303
OS_FLAGS=""
293304
export AR=arm-linux-gnueabihf-ar
@@ -317,7 +328,7 @@ jobs:
317328
cd build
318329
319330
echo "set(CMAKE_SYSTEM_NAME Linux)" > toolchain.cmake
320-
echo "set(CMAKE_SYSTEM_PROCESSOR $cpu)" >> toolchain.cmake
331+
echo "set(CMAKE_SYSTEM_PROCESSOR $CPU)" >> toolchain.cmake
321332
echo "set(triple ${{ matrix.target }})" >> toolchain.cmake
322333
echo 'set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} '$OS_FLAGS '" CACHE STRING "c++ flags")' >> toolchain.cmake
323334
echo 'set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} '$OS_FLAGS '" CACHE STRING "c flags")' >> toolchain.cmake
@@ -330,6 +341,22 @@ jobs:
330341
# Copy stuff around so it's all as the build system expects.
331342
cp -r ../rust/ "$OPENSSL_DIR/rust"
332343
cp -r ./ "$OPENSSL_DIR/build"
344+
;;
345+
"aws-lc")
346+
mkdir build
347+
cd build
348+
349+
echo "set(CMAKE_SYSTEM_NAME Linux)" > toolchain.cmake
350+
echo "set(CMAKE_SYSTEM_PROCESSOR $CPU)" >> toolchain.cmake
351+
echo "set(triple ${{ matrix.target }})" >> toolchain.cmake
352+
echo 'set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} '$OS_FLAGS '" CACHE STRING "c++ flags")' >> toolchain.cmake
353+
echo 'set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} '$OS_FLAGS '" CACHE STRING "c flags")' >> toolchain.cmake
354+
echo 'set(CMAKE_ASM_FLAGS "${CMAKE_ASM_FLAGS} '$OS_FLAGS '" CACHE STRING "asm flags")' >> toolchain.cmake
355+
356+
cmake .. -DCMAKE_INSTALL_PREFIX="${OPENSSL_DIR}" -DCMAKE_TOOLCHAIN_FILE=toolchain.cmake
357+
make -j "$(nproc)"
358+
make install
359+
;;
333360
esac
334361
335362
if: matrix.library.version != 'vendored' && !steps.openssl-cache.outputs.cache-hit
@@ -359,19 +386,23 @@ jobs:
359386
if [[ "${{ matrix.library.version }}" == "vendored" ]]; then
360387
features="--features vendored"
361388
fi
362-
if [[ "${{ matrix.bindgen }}" == "true" && "${{ matrix.library.name }}" != "boringssl" ]]; then
389+
if [[ "${{ matrix.bindgen }}" == "true" ]]; then
363390
features="$features --features bindgen"
364391
fi
365392
cargo run --manifest-path=systest/Cargo.toml --target ${{ matrix.target }} $features
366-
if: matrix.library.name != 'boringssl'
393+
if: ${{ !(matrix.library.name == 'boringssl' || matrix.library.name == 'aws-lc') }}
367394
- name: Test openssl
368395
run: |
369396
if [[ "${{ matrix.library.name }}" == "boringssl" && "${{ matrix.bindgen }}" != "true" ]]; then
370397
features="--features unstable_boringssl"
371398
BORINGSSL_BUILD_DIR="$OPENSSL_DIR/build/"
372399
fi
373400
if [[ "${{ matrix.library.version }}" == "vendored" ]]; then
374-
features="--features vendored"
401+
if [[ "${{ matrix.library.name }}" == "aws-lc" ]]; then
402+
features="--features aws-lc"
403+
else
404+
features="--features vendored"
405+
fi
375406
fi
376407
if [[ "${{ matrix.bindgen }}" == "true" ]]; then
377408
features="$features --features bindgen"
@@ -386,4 +417,4 @@ jobs:
386417
features="$features --features openssl-sys/bindgen"
387418
fi
388419
cargo test --manifest-path=openssl-errors/Cargo.toml --target ${{ matrix.target }} $features
389-
if: matrix.library.name != 'boringssl'
420+
if: ${{ !(matrix.library.name == 'boringssl' || matrix.library.name == 'aws-lc') }}

openssl-sys/Cargo.toml

+2
Original file line numberDiff line numberDiff line change
@@ -18,10 +18,12 @@ rust-version = "1.63.0"
1818
[features]
1919
vendored = ['openssl-src']
2020
unstable_boringssl = ['bssl-sys']
21+
aws-lc = ['dep:aws-lc-sys']
2122

2223
[dependencies]
2324
libc = "0.2"
2425
bssl-sys = { version = "0.1.0", optional = true }
26+
aws-lc-sys = { version = "0.27", features = ["ssl"], optional = true }
2527

2628
[build-dependencies]
2729
bindgen = { version = "0.69.0", optional = true, features = ["experimental"] }

openssl-sys/build/expando.c

+10
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,10 @@ VERSION(OPENSSL, OPENSSL_VERSION_NUMBER)
1919
RUST_OPENSSL_IS_BORINGSSL
2020
#endif
2121

22+
#ifdef OPENSSL_IS_AWSLC
23+
RUST_OPENSSL_IS_AWSLC
24+
#endif
25+
2226
#ifdef OPENSSL_NO_BF
2327
RUST_CONF_OPENSSL_NO_BF
2428
#endif
@@ -142,3 +146,9 @@ RUST_CONF_OPENSSL_NO_SEED
142146
#ifdef OPENSSL_NO_SCRYPT
143147
RUST_CONF_OPENSSL_NO_SCRYPT
144148
#endif
149+
150+
#define SYMBOL_PREFIX2(X) RUST_BINDGEN_SYMBOL_PREFIX_##X##_
151+
#define SYMBOL_PREFIX(X) SYMBOL_PREFIX2(X)
152+
#if defined(OPENSSL_IS_AWSLC) && defined(BORINGSSL_PREFIX)
153+
SYMBOL_PREFIX(BORINGSSL_PREFIX)
154+
#endif

openssl-sys/build/main.rs

+69-3
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ enum Version {
2424
Openssl10x,
2525
Libressl,
2626
Boringssl,
27+
AwsLc,
2728
}
2829

2930
fn env_inner(name: &str) -> Option<OsString> {
@@ -71,6 +72,51 @@ fn check_ssl_kind() {
7172
// BoringSSL does not have any build logic, exit early
7273
std::process::exit(0);
7374
}
75+
76+
let is_aws_lc = cfg!(feature = "aws-lc");
77+
78+
if is_aws_lc {
79+
println!("cargo:rustc-cfg=awslc");
80+
println!("cargo:awslc=true");
81+
82+
// The aws-lc-sys crate uses a link name that embeds
83+
// the version number of crate. Examples (crate-name => links name):
84+
// * aws-lc-sys => aws_lc_0_26_0
85+
// This is done to avoid issues if the cargo dependency graph for an application
86+
// were to resolve to multiple versions for the same crate.
87+
//
88+
// Due to this we need to determine what version of the AWS-LC has been selected (fips or non-fips)
89+
// and then need to parse out the pieces we are interested in ignoring the version componenet of the name.
90+
const AWS_LC_ENV_VAR_PREFIX: &str = "DEP_AWS_LC_";
91+
92+
let mut version = None;
93+
for (name, _) in std::env::vars() {
94+
if let Some(name) = name.strip_prefix(AWS_LC_ENV_VAR_PREFIX) {
95+
if let Some(name) = name.strip_suffix("_INCLUDE") {
96+
version = Some(name.to_owned());
97+
break;
98+
}
99+
}
100+
}
101+
let version = version.expect("aws-lc version detected");
102+
103+
// Read the OpenSSL configuration statements and emit rust-cfg for each.
104+
if let Ok(vars) = std::env::var(format!("{AWS_LC_ENV_VAR_PREFIX}{version}_CONF")) {
105+
for var in vars.split(',') {
106+
println!("cargo:rustc-cfg=osslconf=\"{var}\"");
107+
}
108+
println!("cargo:conf={vars}");
109+
}
110+
111+
// Emit the include header directory from the aws-lc(-fips)-sys crate so that it can be used if needed
112+
// by crates consuming openssl-sys.
113+
if let Ok(val) = std::env::var(format!("{AWS_LC_ENV_VAR_PREFIX}{version}_INCLUDE")) {
114+
println!("cargo:include={val}");
115+
}
116+
117+
// AWS-LC does not have any build logic, exit early
118+
std::process::exit(0);
119+
}
74120
}
75121

76122
fn main() {
@@ -79,6 +125,7 @@ fn main() {
79125
println!("cargo:rustc-check-cfg=cfg(openssl)");
80126
println!("cargo:rustc-check-cfg=cfg(libressl)");
81127
println!("cargo:rustc-check-cfg=cfg(boringssl)");
128+
println!("cargo:rustc-check-cfg=cfg(awslc)");
82129

83130
println!("cargo:rustc-check-cfg=cfg(libressl250)");
84131
println!("cargo:rustc-check-cfg=cfg(libressl251)");
@@ -201,7 +248,10 @@ fn main() {
201248
// try to match the behavior for common platforms. For a more robust option,
202249
// this likely needs to be deferred to the caller with an environment
203250
// variable.
204-
if version == Version::Boringssl && kind == "static" && env::var("CARGO_CFG_UNIX").is_ok() {
251+
if (version == Version::Boringssl || version == Version::AwsLc)
252+
&& kind == "static"
253+
&& env::var("CARGO_CFG_UNIX").is_ok()
254+
{
205255
let cpp_lib = match env::var("CARGO_CFG_TARGET_OS").unwrap().as_ref() {
206256
"macos" => "c++",
207257
_ => "stdc++",
@@ -231,8 +281,8 @@ fn main() {
231281
fn postprocess(include_dirs: &[PathBuf]) -> Version {
232282
let version = validate_headers(include_dirs);
233283

234-
// Never run bindgen for BoringSSL, if it was needed we already ran it.
235-
if version != Version::Boringssl {
284+
// Never run bindgen for BoringSSL or AWS-LC, if it was needed we already ran it.
285+
if !(version == Version::Boringssl || version == Version::AwsLc) {
236286
#[cfg(feature = "bindgen")]
237287
run_bindgen::run(&include_dirs);
238288
}
@@ -296,14 +346,18 @@ See rust-openssl documentation for more information:
296346
let mut openssl_version = None;
297347
let mut libressl_version = None;
298348
let mut is_boringssl = false;
349+
let mut is_awslc = false;
350+
let mut bindgen_symbol_prefix: Option<String> = None;
299351
for line in expanded.lines() {
300352
let line = line.trim();
301353

302354
let openssl_prefix = "RUST_VERSION_OPENSSL_";
303355
let new_openssl_prefix = "RUST_VERSION_NEW_OPENSSL_";
304356
let libressl_prefix = "RUST_VERSION_LIBRESSL_";
305357
let boringssl_prefix = "RUST_OPENSSL_IS_BORINGSSL";
358+
let awslc_prefix = "RUST_OPENSSL_IS_AWSLC";
306359
let conf_prefix = "RUST_CONF_";
360+
let symbol_prefix = "RUST_BINDGEN_SYMBOL_PREFIX_";
307361
if let Some(version) = line.strip_prefix(openssl_prefix) {
308362
openssl_version = Some(parse_version(version));
309363
} else if let Some(version) = line.strip_prefix(new_openssl_prefix) {
@@ -314,6 +368,11 @@ See rust-openssl documentation for more information:
314368
enabled.push(conf);
315369
} else if line.starts_with(boringssl_prefix) {
316370
is_boringssl = true;
371+
} else if line.starts_with(awslc_prefix) {
372+
is_awslc = true;
373+
} else if line.starts_with(symbol_prefix) {
374+
let sym_prefix = String::from(line.strip_prefix(symbol_prefix).unwrap());
375+
bindgen_symbol_prefix = Some(sym_prefix);
317376
}
318377
}
319378

@@ -329,6 +388,13 @@ See rust-openssl documentation for more information:
329388
return Version::Boringssl;
330389
}
331390

391+
if is_awslc {
392+
println!("cargo:rustc-cfg=awslc");
393+
println!("cargo:awslc=true");
394+
run_bindgen::run_awslc(include_dirs, bindgen_symbol_prefix);
395+
return Version::AwsLc;
396+
}
397+
332398
// We set this for any non-BoringSSL lib.
333399
println!("cargo:rustc-cfg=openssl");
334400

0 commit comments

Comments
 (0)