Support symcrypt fips config for aboot/uboot by xumia · Pull Request #10729 · sonic-net/sonic-buildimage

xumia · 2022-05-03T00:18:21Z

Why I did it

Support symcrypt fips config for aboot/uboot

How I did it

For uboot, use fw_setenv to variable linuxargs to change the boot options.

fw_setenv linuxargs "$OTHER_OPTIONS sonic_fips=1"

For Aboot, add the config in /host/image-{version}/kernel-cmdline, example:

reboot=p console=ttyS0 acpi=on Aboot=Aboot-norcal7-7.2.0-pcie2x4-6128821 <other parameters...> sonic_fips=1

How to verify it

Download the image sonic-aboot-broadcom.swi from the pipeline in the PR checks. The sonic_fips=1 can be found in /proc/cmdline

Aboot# boot sonic-aboot-broadcom.swi
448.25: Cleaning flash content /mnt/flash
448.25: Generating boot-config, machine.conf and cmdline
448.41: Installing image under /mnt/flash/image-master-10729.100664-f781129cc
...
oot@sonic:/host/image-master-10729.100664-f781129cc# cat kernel-cmdline 
reboot=p console=ttyS0 acpi=on Aboot=Aboot-norcal6-6.1.2-4757975 block_flash=pci0000:00/0000:00:14.7/mmc_host/.*$ block_usb1=pci0000:00/0000:00:12.0/usb1/1-1/1-1.1/.*$ block_usb2=pci0000:00/0000:00:12.0/usb1/1-1/1-1.4/.*$ block_drive=pci0000:00/0000:00:11.0/.*host./target.:0:0/.*$ net_ma1=pci0000:00/0000:00:02.4/.*$ platform=crow sid=Upperlake cmdline-aboot-end modprobe.blacklist=radeon,sp5100_tco amd_iommu=off modprobe.blacklist=snd_hda_intel,hdaudio logs_inram=on varlog_size=256 sonic.mode=fixed security=apparmor apparmor=1 rw net.ifnames=0 systemd.unified_cgroup_hierarchy=0 quiet systemd.show_status=auto hwaddr_ma1=28:99:3a:17:1c:08 root=UUID=805ffc5b-0cf7-4abb-a1f4-f7424699fff7 loop=image-master-10729.100664-f781129cc/fs.squashfs loopfstype=squashfs sonic_fips=1

admin@sonic:~$ cat /proc/cmdline 
reboot=p console=ttyS0 acpi=on Aboot=Aboot-norcal6-6.1.2-4757975 block_flash=pci0000:00/0000:00:14.7/mmc_host/.*$ block_usb1=pci0000:00/0000:00:12.0/usb1/1-1/1-1.1/.*$ block_usb2=pci0000:00/0000:00:12.0/usb1/1-1/1-1.4/.*$ block_drive=pci0000:00/0000:00:11.0/.*host./target.:0:0/.*$ net_ma1=pci0000:00/0000:00:02.4/.*$ platform=crow sid=Upperlake cmdline-aboot-end modprobe.blacklist=radeon,sp5100_tco amd_iommu=off modprobe.blacklist=snd_hda_intel,hdaudio logs_inram=on varlog_size=256 sonic.mode=fixed security=apparmor apparmor=1 rw net.ifnames=0 systemd.unified_cgroup_hierarchy=0 quiet systemd.show_status=auto hwaddr_ma1=28:99:3a:17:1c:08 root=UUID=805ffc5b-0cf7-4abb-a1f4-f7424699fff7 loop=image-master-10729.100664-f781129cc/fs.squashfs loopfstype=squashfs sonic_fips=1  kexec_jump_back_entry=0xffffffff
admin@sonic:~$ 
admin@sonic:~$ sudo openssl engine -vv | grep symcrypt
(symcrypt) SCOSSL (SymCrypt engine for OpenSSL)
admin@sonic:~$

Which release branch to backport (provide reason below if selected)

Description for the changelog

Link to config_db schema for YANG module changes

A picture of a cute animal (not mandatory but encouraged)

xumia · 2022-05-06T03:24:19Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2022-05-06T03:24:30Z

Azure Pipelines successfully started running 1 pipeline(s).

qiluo-msft · 2022-05-06T21:05:38Z

files/Aboot/boot0.j2

sonic_fips fips

Do you have document to explain both? #Closed

I will add in the Design doc, the option fips is taken by linux kernel option, we are not ready for it now, so use sonic_fips instead.

See sonic-net/SONiC#997

qiluo-msft · 2022-05-06T21:06:07Z

files/Aboot/boot0.j2

sonic_fips

How about fips? #Closed

installer/armhf/install.sh

qiluo-msft · 2022-05-06T21:12:36Z

platform/centec-arm64/platform.conf

linuxargs

Use extra_cmdline_linux directly? Like your changes in other platform.conf files.

Currently, marvell arm64/armhf has already used the parameter linuxargs, we do not want to define another parameter for centec-arm64.
And it will be easy to add a Cli for FIPS setting for uboot, without considering different platforms.
Only the uboot boodloader uses it, the other platforms do not use it.

I am proposing

fw_setenv -f sonic_image_1 "ext4load mmc 0:1 \$loadaddr \$sonic_dir_1/boot/sonic_arm64.fit && setenv bootargs quiet console=\$consoledev,\$baudrate root=/dev/mmcblk0p1 rw rootwait rootfstype=ext4 loopfstype=squashfs loop=\$sonic_dir_1/fs.squashfs systemd.unified_cgroup_hierarchy=0 \${extra_cmdline_linux} && bootm \$loadaddr"

It makes the centec uboot config the same as marvell when adding a command line support, see uboot.py in https://github.com/Azure/sonic-utilities/pull/2154/files

qiluo-msft · 2022-05-06T21:14:17Z

@Staphylo Could you check Aboot change?

xumia · 2022-05-15T00:02:17Z

@Staphylo , could you please help review it? Thanks.

Staphylo

Sorry for the late review, I had a wrong filter. Please feel free to shoot me an email directly if this happens again.

Staphylo · 2022-05-20T09:50:56Z

build_image.sh

+    echo "sonic_fips=0" > kernel-cmdline
+    [ "$ENABLE_FIPS" == "y" ] && echo "sonic_fips=1" > kernel-cmdline
+    zip -g $OUTPUT_ABOOT_IMAGE kernel-cmdline
+    rm kernel-cmdline


Your solution using kernel-cmdline will work.
One note, even though the kernel handles multiple definitions of the same parameter properly, it's probably not worth crowding the cmdline when enabling fips (will append sonic_fips=0 sonic_fips=1 which can be confusing)

If the plan is to configure FIPS only at build time I would suggest making a modification to boot0.j2 and add a new variable enable_fips set via Jinja templating to true or false.
Then adding some logic in the boot0 code to call cmdline_add in the write_image_specific_config function
https://github.com/Azure/sonic-buildimage/blob/f6927606b3720d4f526b9e734b4431f012d21ee3/files/Aboot/boot0.j2#L617
This would prevent anyone from disabling sonic_fips by changing the cmdline in the context of secureboot.
However if the plan is to be able to disable fips at runtime or for a next reboot, your solution works better.

@Staphylo , it makes the user have chance to enable or disable it in the next reboot. ENABLE_FIPS=1 will enable the fips by default, the default value is "n", not enabled. If want to enable it, we need to set the sonic_fips=1 in kernel-cmdline after installed or upgraded.

Fair enough, your solution is probably the best then.
I still think you should change the code that crafts the kernel-cmdline content.
I'm thinking of something like the following (Note that the test equality sign is = and not == as you currently have, so there's a bug here)

if [ "$ENABLE_FIPS" = "y" ]; then echo sonic_fips=1 > kernel-cmdline else echo sonic_fips=0 > kernel-cmdline fi

@Staphylo , thanks for your comment.
The shell bash supports "==", but it makes sense to use the same way with the others in the script, I have changed it.

xumia · 2022-05-25T00:19:30Z

@Staphylo, could you please help approve it, if you do not have more comments, thanks.

xumia · 2022-05-31T14:20:02Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2022-05-31T14:20:16Z

Azure Pipelines successfully started running 1 pipeline(s).

Why I did it Support symcrypt fips config for aboot/uboot

xumia marked this pull request as ready for review May 6, 2022 03:25

xumia requested review from lguohan and qiluo-msft as code owners May 6, 2022 03:25

qiluo-msft requested a review from Staphylo May 6, 2022 21:04

qiluo-msft reviewed May 6, 2022

View reviewed changes

files/Aboot/boot0.j2 Outdated

Copy link
Copy Markdown

Collaborator

qiluo-msft May 6, 2022 •

edited

Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sonic_fips

How about fips? #Closed

qiluo-msft reviewed May 6, 2022

View reviewed changes

installer/armhf/install.sh Outdated Show resolved Hide resolved

qiluo-msft reviewed May 6, 2022

View reviewed changes

xumia force-pushed the support-symcrypt-fips-config branch from ea69fcd to ec22e67 Compare May 7, 2022 14:33

xumia added 3 commits May 18, 2022 13:13

Support symcrypt fips config for aboot/uboot

3367dbd

Fix image not found issue

004371e

Remove the fips options

3b89cf7

xumia force-pushed the support-symcrypt-fips-config branch from f75f0ce to 3b89cf7 Compare May 18, 2022 13:14

Staphylo reviewed May 20, 2022

View reviewed changes

Use the same bash comparing way

004d19c

Staphylo approved these changes May 25, 2022

View reviewed changes

qiluo-msft approved these changes May 26, 2022

View reviewed changes

xumia mentioned this pull request Jun 2, 2022

SONIC OpenSSL FIPS 140-3 HLD sonic-net/SONiC#955

Merged

xumia added the Request for 202205 Branch label Jun 2, 2022

xumia merged commit 0552d6b into sonic-net:master Jun 2, 2022

xumia deleted the support-symcrypt-fips-config branch June 2, 2022 07:35

yxieca pushed a commit that referenced this pull request Jun 5, 2022

Support symcrypt fips config for aboot/uboot (#10729)

043656d

Why I did it Support symcrypt fips config for aboot/uboot

yxieca added the Included in 202205 Branch label Jun 5, 2022

xumia mentioned this pull request Jul 7, 2022

Add the SONiC FIPS configure introduction sonic-net/SONiC#997

Merged

Conversation

xumia commented May 3, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why I did it

How I did it

How to verify it

Which release branch to backport (provide reason below if selected)

Description for the changelog

Link to config_db schema for YANG module changes

A picture of a cute animal (not mandatory but encouraged)

Uh oh!

xumia commented May 6, 2022

Uh oh!

azure-pipelines bot commented May 6, 2022

Uh oh!

qiluo-msft May 6, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

qiluo-msft May 6, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

xumia May 7, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

xumia May 7, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

qiluo-msft commented May 6, 2022

Uh oh!

xumia commented May 15, 2022

Uh oh!

Staphylo left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

xumia commented May 25, 2022

Uh oh!

xumia commented May 31, 2022

Uh oh!

azure-pipelines bot commented May 31, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

xumia commented May 3, 2022 •

edited

Loading

qiluo-msft May 6, 2022 •

edited

Loading

qiluo-msft May 6, 2022 •

edited

Loading

xumia May 7, 2022 •

edited

Loading

xumia May 7, 2022 •

edited

Loading