Skip to content

Reinstall Ruby grpc gem with system OpenSSL for FIPS builds

Stan Hu requested to merge sh-grpc-use-system-ssl into master

What does this MR do?

By default, the Ruby grpc gem installs itself as a native gem and bundles its own copy of BoringSSL. BoringSSL is a fork of OpenSSL, and while there are FIPS-validated versions available, a BoringSSL FIPS library is not generally available. However, we can ensure FIPS compliance by building and linking against the system OpenSSL.

Unfortunately, the gRPC upstream has not made it possible to configure the Ruby compilation options (https://github.com/grpc/grpc/pull/27881).

To work around this, we patch the Ruby extconf.rb to link against the system OpenSSL. This is done via a separate ruby-grpc software Omnibus component. We do this for two reasons:

  1. Since both GitLab Rails and Gitaly attempt to install the grpc gem, it's possible for bundle install to install both the Ruby and the native platform versions at the same time.

  2. There is also the possibility that different gem versions get installed by different components, such as GitLab Rails and Gitaly, and we should allow for that.

This commit:

  1. Determines which grpc gems have been installed in the system.
  2. Uninstalls all versions.
  3. For each version, download the gem, patch it with the handy gem-patch tool, and reinstall the patched gem.

On my local test, the rebuild of the gem added 150 seconds to the build time.

Related issues

Relates to #6687 (closed)

Test dev.gitlab.org merge request: https://dev.gitlab.org/gitlab/omnibus-gitlab/-/merge_requests/222

QA

Before

ubuntu@gl-fips-testenv1-gitaly-1:/opt/gitlab/embedded/lib/ruby/gems/2.7.0/gems/grpc-1.42.0-x86_64-linux$ sudo lsof -p 463078 | grep grpc
ruby    463078  git  mem       REG              259,1  6496784 4359810 /opt/gitlab/embedded/lib/ruby/gems/2.7.0/gems/grpc-1.42.0-x86_64-linux/src/ruby/lib/grpc/2.7/grpc_c.so

ubuntu@gl-fips-testenv1-gitaly-1:/$ ldd /opt/gitlab/embedded/lib/ruby/gems/2.7.0/gems/grpc-1.42.0-x86_64-linux/src/ruby/lib/grpc/2.7/grpc_c.so
	linux-vdso.so.1 (0x00007fffc3dee000)
	libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007ff2ce3ce000)
	libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007ff2ce1dc000)
	/lib64/ld-linux-x86-64.so.2 (0x00007ff2ceb69000)

ubuntu@gl-fips-testenv1-gitaly-1:/$ ls -al /opt/gitlab/embedded/lib/ruby/gems/2.7.0/gems/grpc-1.42.0-x86_64-linux/src/ruby/lib/grpc/2.7/grpc_c.so
-rwxr-xr-x 1 root root 6496784 Jun 18 02:16 /opt/gitlab/embedded/lib/ruby/gems/2.7.0/gems/grpc-1.42.0-x86_64-linux/src/ruby/lib/grpc/2.7/

After

ubuntu@gl-fips-testenv1-gitaly-1:/$ sudo lsof -p 481895 | grep grpc
ruby    481895  git  mem       REG              259,1  5289496 5377807 /opt/gitlab/embedded/lib/ruby/gems/2.7.0/gems/grpc-1.42.0/src/ruby/lib/grpc/grpc_c.so

ubuntu@gl-fips-testenv1-gitaly-1:/$ ldd /opt/gitlab/embedded/lib/ruby/gems/2.7.0/gems/grpc-1.42.0/src/ruby/lib/grpc/grpc_c.so
	linux-vdso.so.1 (0x00007ffec6fbc000)
	libssl.so.1.1 => /lib/x86_64-linux-gnu/libssl.so.1.1 (0x00007fe42db2a000)
	libruby.so.2.7 => /opt/gitlab/embedded/lib/libruby.so.2.7 (0x00007fe42d762000)
	libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007fe42d613000)
	libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007fe42d421000)
	/lib64/ld-linux-x86-64.so.2 (0x00007fe42e0dc000)
	libcrypto.so.1.1 => /lib/x86_64-linux-gnu/libcrypto.so.1.1 (0x00007fe42d13c000)
	libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007fe42d117000)
	libz.so.1 => /opt/gitlab/embedded/lib/libz.so.1 (0x00007fe42d0f9000)
	librt.so.1 => /lib/x86_64-linux-gnu/librt.so.1 (0x00007fe42d0ef000)
	libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007fe42d0e9000)
	libcrypt.so.1 => /lib/x86_64-linux-gnu/libcrypt.so.1 (0x00007fe42d0ae000)

ubuntu@gl-fips-testenv1-gitaly-1:/$ ls -al /opt/gitlab/embedded/lib/ruby/gems/2.7.0/gems/grpc-1.42.0/src/ruby/lib/grpc/grpc_c.so
-rwxr-xr-x 1 root root 5289496 Jun 21 05:48 /opt/gitlab/embedded/lib/ruby/gems/2.7.0/gems/grpc-1.42.0/src/ruby/lib/grpc/grpc_c.so

ubuntu@gl-fips-testenv1-gitaly-1:/$ objdump -t /opt/gitlab/embedded/lib/ruby/gems/2.7.0/extensions/x86_64-linux/2.7.0/grpc-1.42.0/grpc/grpc_c.so | grep SSL | tail
0000000000000000       F *UND*	0000000000000000              SSL_set_bio@@OPENSSL_1_1_0
0000000000000000       F *UND*	0000000000000000              SSL_CTX_set_next_proto_select_cb@@OPENSSL_1_1_0
0000000000000000       F *UND*	0000000000000000              SSL_state_string@@OPENSSL_1_1_0
0000000000000000       F *UND*	0000000000000000              SSL_CTX_get_cert_store@@OPENSSL_1_1_0
0000000000000000       F *UND*	0000000000000000              SSL_CTX_use_certificate@@OPENSSL_1_1_0
0000000000000000       F *UND*	0000000000000000              SSL_CTX_use_PrivateKey@@OPENSSL_1_1_0
0000000000000000       F *UND*	0000000000000000              SSL_CTX_set_verify@@OPENSSL_1_1_0
0000000000000000       F *UND*	0000000000000000              SSL_free@@OPENSSL_1_1_0
0000000000000000       F *UND*	0000000000000000              SSL_CTX_set_session_id_context@@OPENSSL_1_1_0
0000000000000000       F *UND*	0000000000000000              SSL_CTX_free@@OPENSSL_1_1_0

Checklist

See Definition of done.

For anything in this list which will not be completed, please provide a reason in the MR discussion

Required

  • Merge Request Title, and Description are up to date, accurate, and descriptive
  • MR targeting the appropriate branch
  • MR has a green pipeline on GitLab.com
  • Pipeline is green on dev.gitlab.org if the change is touching anything besides documentation or internal cookbooks
  • trigger-package has a green pipeline running against latest commit

Expected (please provide an explanation if not completing)

  • Test plan indicating conditions for success has been posted and passes
  • Documentation created/updated
  • Tests added
  • Integration tests added to GitLab QA
  • Equivalent MR/issue for the GitLab Chart opened
Edited by Stan Hu

Merge request reports