SSL/ACVP Test Integration for FIPS - second try#1560
Open
Enmk wants to merge 13 commits intoreleases/25.3.8-fipsfrom
Open
SSL/ACVP Test Integration for FIPS - second try#1560Enmk wants to merge 13 commits intoreleases/25.3.8-fipsfrom
Enmk wants to merge 13 commits intoreleases/25.3.8-fipsfrom
Conversation
Made-with: Cursor Signed-off-by: Julian Huang <jhuang@altinity.com>
Signed-off-by: Julian Huang <jhuang@altinity.com>
…ndshaker Move the identical glibc_compat.c files from ssl-shim/ and ssl-handshaker/ into a shared programs/ssl-common/ directory. Also add the gtest include path required by test_util.cc to both CMakeLists. Signed-off-by: Julian Huang <jhuang@altinity.com>
The FIPS 2.0.0 shim sources do not include any gtest headers, so this include path is not needed. Signed-off-by: Julian Huang <jhuang@altinity.com>
Signed-off-by: Julian Huang <jhuang@altinity.com>
Gate ssl-shim/ssl-handshaker/acvp-server declarations in main.cpp with per-target ENABLE_CLICKHOUSE_* defines (via config_tools.h) that match the exact CMake conditions under which targets are created, preventing unresolved symbols when FIPS_CLICKHOUSE is set without AWSLC_SRC_DIR or on non-Linux platforms. Move the --allow-multiple-definition linker flag from the global clickhouse target into each of the three library targets as an INTERFACE property, so the flag only enters the link when those specific libraries are actually consumed. Signed-off-by: Julian Huang <jhuang@altinity.com> Made-with: Cursor
Replace the partial posix_spawn with the complete upstream musl implementation (https://git.musl-libc.org/cgit/musl/tree/src/process/posix_spawn.c), adapted for the glibc sysroot headers used by ClickHouse. Key safety improvements from upstream: - Pipe fd clobbering protection: if a file action targets the error-reporting pipe fd, dup it to an unoccupied fd first - Close-on-exec set after file actions (pipe may have been moved) - Block all signals before pipe2/clone; unblock after exec - EPIPE-aware error reporting back to parent - Support for POSIX_SPAWN_SETSID, SETPGROUP, RESETIDS, SETSIGDEF - Larger stack (1024 + PATH_MAX) Adaptations from upstream musl: - Uses glibc sysroot field names (__ss/__sd vs __mask/__def) - Keeps __posix_spawnx exec-function parameter (glibc attr has no __fn) - Omits LOCK(__abort_lock) (musl-internal, not available) - Omits __get_handler_set (musl-internal; signals are blocked for the child's brief pre-exec window so parent handlers cannot fire) - Uses clone() instead of musl-internal __clone() Signed-off-by: Julian Huang <jhuang@altinity.com> Made-with: Cursor
…2, used only for ssl/acvp tests Signed-off-by: Julian Huang <jhuang@altinity.com>
…t the rest of CH Signed-off-by: Julian Huang <jhuang@altinity.com>
Signed-off-by: Julian Huang <jhuang@altinity.com>
…ading source twice Signed-off-by: Julian Huang <jhuang@altinity.com>
Compile ssl-shim, ssl-handshaker, and acvp-server test harness code inside the Docker build rather than with manual /usr/bin/c++ invocations in CMake. A new build_test_harness.sh script does partial linking (ld -r) with libstdc++ and then uses objcopy --prefix-symbols to namespace all internal symbols, avoiding collisions with ClickHouse's libc++. This eliminates --allow-multiple-definition, hardcoded x86 library paths, and the AWSLC_SRC_DIR configure-time requirement. The three per-program CMakeLists.txt are replaced by IMPORTED library targets in contrib/openssl-cmake/CMakeLists.txt. posix_spawn_2.c gains aarch64 raw-syscall wrappers so both Dockerfiles work natively. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changelog category (leave one):
Changelog entry (a user-readable short description of the changes that goes to CHANGELOG.md):
Added three sub-commands to
clickhousebinary that facilitate verification of builtin ssl library:ssl-handshaker,ssl-shim, andacvp-server.Documentation entry for user-facing changes
...
CI/CD Options
Exclude tests:
Regression jobs to run:
Basically same code as in #1503, but compiled in a safer way (no more
--allow-multiple-definition, hardcoded compiler paths, etc).Closes #1503