Merge branch 'main' into mysql-ci-tests

CMakeLists.txt

@@ -449,6 +449,8 @@ elseif(MSVC)
       "C4191" # unsafe conversion from 'type of expression' to 'type required'
               # TODO remove once https://github.com/openssl/openssl/issues/18957 is resolved
       "C4996" # deprecated warnings using low level functions in OpenSSL 3.0
+      "C4746" # consider using __iso_volatile_load/store intrinsic functions
+      "C5264" # 'variable-name': 'const' variable is not used
           )
   set(MSVC_LEVEL4_WARNINGS_LIST
       # See https://connect.microsoft.com/VisualStudio/feedback/details/1217660/warning-c4265-when-using-functional-header

crypto/fipsmodule/service_indicator/service_indicator_test.cc

@@ -4036,7 +4036,7 @@ TEST(ServiceIndicatorTest, DRBG) {
 // Since this is running in FIPS mode it should end in FIPS
 // Update this when the AWS-LC version number is modified
 TEST(ServiceIndicatorTest, AWSLCVersionString) {
-  ASSERT_STREQ(awslc_version_string(), "AWS-LC FIPS 1.11.0");
+  ASSERT_STREQ(awslc_version_string(), "AWS-LC FIPS 1.12.0");
 }
 
 #else
@@ -4079,6 +4079,6 @@ TEST(ServiceIndicatorTest, BasicTest) {
 // Since this is not running in FIPS mode it shouldn't end in FIPS
 // Update this when the AWS-LC version number is modified
 TEST(ServiceIndicatorTest, AWSLCVersionString) {
-  ASSERT_STREQ(awslc_version_string(), "AWS-LC 1.11.0");
+  ASSERT_STREQ(awslc_version_string(), "AWS-LC 1.12.0");
 }
 #endif // AWSLC_FIPS

include/openssl/base.h

@@ -216,7 +216,7 @@ extern "C" {
 // ServiceIndicatorTest.AWSLCVersionString
 // Note: there are two versions of this test. Only one test is compiled
 // depending on FIPS mode.
-#define AWSLC_VERSION_NUMBER_STRING "1.11.0"
+#define AWSLC_VERSION_NUMBER_STRING "1.12.0"
 
 #if defined(BORINGSSL_SHARED_LIBRARY)
 

tests/ci/cdk/cdk/codebuild/github_ci_integration_omnibus.yaml

@@ -7,20 +7,25 @@ version: 0.2
 batch:
   build-list:
     - identifier: s2n_integration
-      buildspec: ./tests/ci/codebuild/integration/s2n_integration.yml
+      buildspec: tests/ci/codebuild/common/run_simple_target.yml
       env:
         type: LINUX_CONTAINER
         privileged-mode: false
         compute-type: BUILD_GENERAL1_SMALL
         image: 620771051181.dkr.ecr.us-west-2.amazonaws.com/aws-lc-docker-images-linux-x86:ubuntu-20.04_clang-9x_latest
+        variables:
+          AWS_LC_CI_TARGET: "tests/ci/integration/run_s2n_integration.sh"
+
 
     - identifier: openssh_integration
-      buildspec: ./tests/ci/codebuild/integration/openssh_integration.yml
+      buildspec: tests/ci/codebuild/common/run_simple_target.yml
       env:
         type: LINUX_CONTAINER
         privileged-mode: false
         compute-type: BUILD_GENERAL1_SMALL
         image: 620771051181.dkr.ecr.us-west-2.amazonaws.com/aws-lc-docker-images-linux-x86:amazonlinux-2023_clang-15x_sanitizer_latest
+        variables:
+          AWS_LC_CI_TARGET: "tests/ci/integration/run_openssh_integration.sh"
 
     - identifier: postgres_integration
       buildspec: ./tests/ci/codebuild/integration/postgres_integration.yml
@@ -32,17 +37,32 @@ batch:
 
     # MySQL build is bloated without any obvious build configurations we can use to speed up the build, so we use a larger instance here.
     - identifier: mysql_integration
-      buildspec: ./tests/ci/codebuild/integration/mysql_integration.yml
+      buildspec: tests/ci/codebuild/common/run_simple_target.yml
       env:
         type: LINUX_CONTAINER
         privileged-mode: false
         compute-type: BUILD_GENERAL1_2XLARGE
         image: 620771051181.dkr.ecr.us-west-2.amazonaws.com/aws-lc-docker-images-linux-x86:ubuntu-22.04_gcc-12x_latest
+        variables:
+          AWS_LC_CI_TARGET: "tests/ci/integration/run_mysql_integration.sh"
+
 
     - identifier: mariadb_integration
-      buildspec: ./tests/ci/codebuild/integration/mariadb_integration.yml
+      buildspec: tests/ci/codebuild/common/run_simple_target.yml
       env:
         type: LINUX_CONTAINER
         privileged-mode: false
         compute-type: BUILD_GENERAL1_LARGE
-        image: 620771051181.dkr.ecr.us-west-2.amazonaws.com/aws-lc-docker-images-linux-x86:ubuntu-22.04_gcc-12x_latest
+        image: 620771051181.dkr.ecr.us-west-2.amazonaws.com/aws-lc-docker-images-linux-x86:ubuntu-22.04_gcc-12x_latest
+        variables:
+          AWS_LC_CI_TARGET: "tests/ci/integration/run_mariadb_integration.sh"
+
+    - identifier: haproxy_integration
+      buildspec: tests/ci/codebuild/common/run_simple_target.yml
+      env:
+        type: LINUX_CONTAINER
+        privileged-mode: false
+        compute-type: BUILD_GENERAL1_MEDIUM
+        image: 620771051181.dkr.ecr.us-west-2.amazonaws.com/aws-lc-docker-images-linux-x86:ubuntu-22.04_gcc-12x_latest
+        variables:
+          AWS_LC_CI_TARGET: "tests/ci/integration/run_haproxy_integration.sh"

tests/ci/codebuild/integration/s2n_integration.yml → tests/ci/codebuild/common/run_simple_target.yml

@@ -10,4 +10,4 @@ env:
 phases:
   build:
     commands:
-      - ./tests/ci/integration/run_s2n_integration.sh
+      - "./${AWS_LC_CI_TARGET}"

tests/ci/docker_images/linux-x86/ubuntu-22.04_base/Dockerfile

@@ -25,6 +25,7 @@ RUN set -ex && \
     apt-get -y --no-install-recommends install \
     software-properties-common \
     cmake \
+    curl \
     make \
     ninja-build \
     patch \
@@ -40,6 +41,7 @@ RUN set -ex && \
     libicu-dev \
     libipc-run-perl \
     libjson-perl \
+    libpcre2-dev \
     libreadline-dev \
     libudev-dev \
     zlib1g-dev \

tests/ci/integration/run_haproxy_integration.sh

@@ -0,0 +1,52 @@
+#!/bin/bash -exu
+# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+# SPDX-License-Identifier: Apache-2.0 OR ISC
+
+source tests/ci/common_posix_setup.sh
+
+# Set up environment.
+
+# SYS_ROOT
+#  |
+#  - SRC_ROOT(aws-lc)
+#  |
+#  - SCRATCH_FOLDER
+#    |
+#    - HAPROXY_SRC
+#    - AWS_LC_BUILD_FOLDER
+#    - AWS_LC_INSTALL_FOLDER
+
+# Assumes script is executed from the root of aws-lc directory
+SCRATCH_FOLDER=${SYS_ROOT}/"scratch"
+AWS_LC_BUILD_FOLDER="${SCRATCH_FOLDER}/aws-lc-build"
+AWS_LC_INSTALL_FOLDER="${SCRATCH_FOLDER}/aws-lc-install"
+HAPROXY_SRC="${SCRATCH_FOLDER}/haproxy"
+
+# Make script execution idempotent.
+mkdir -p ${SCRATCH_FOLDER}
+rm -rf ${SCRATCH_FOLDER}/*
+cd ${SCRATCH_FOLDER}
+
+mkdir -p ${AWS_LC_BUILD_FOLDER} ${AWS_LC_INSTALL_FOLDER}
+git clone --depth 1 https://github.com/haproxy/haproxy.git
+ls
+
+aws_lc_build ${SRC_ROOT} ${AWS_LC_BUILD_FOLDER} ${AWS_LC_INSTALL_FOLDER}
+
+cd ${HAPROXY_SRC}
+
+make CC="${CC}" -j ${NUM_CPU_THREADS} TARGET=generic USE_OPENSSL=1 SSL_INC="${AWS_LC_INSTALL_FOLDER}/include" SSL_LIB="${AWS_LC_INSTALL_FOLDER}/lib/"
+./scripts/build-vtest.sh
+export VTEST_PROGRAM=$(realpath ../vtest/vtest)
+
+# These tests pass when run local but are not supported in CodeBuild CryptoAlg-1965
+excluded_tests=("mcli_show_info.vtc" "mcli_start_progs.vtc" "tls_basic_sync.vtc" "tls_basic_sync_wo_stkt_backend.vtc" "acl_cli_spaces.vtc" "http_reuse_always.vtc")
+test_paths=""
+
+for test in reg-tests/**/*; do
+    if [[ "$test" == *.vtc ]] && [[ ! " ${excluded_tests[*]} " =~ $(basename "$test") ]]; then
+        test_paths+="$(realpath "$test") "
+    fi
+done
+
+./scripts/run-regtests.sh "$test_paths"