aws-crt 0.1.9 → 0.2.0

data/aws-crt-ffi/crt/aws-lc/ssl/test/test_config.cc

@@ -46,12 +46,18 @@ namespace {
 struct Flag {
   const char *name;
   bool has_param;
+  // skip_handshaker, if true, causes this flag to be skipped when
+  // forwarding flags to the handshaker. This should be used with flags
+  // that only impact connecting to the runner.
+  bool skip_handshaker;
   // If |has_param| is false, |param| will be nullptr.
   std::function<bool(TestConfig *config, const char *param)> set_param;
 };
 
-Flag BoolFlag(const char *name, bool TestConfig::*field) {
-  return Flag{name, false, [=](TestConfig *config, const char *) -> bool {
+Flag BoolFlag(const char *name, bool TestConfig::*field,
+              bool skip_handshaker = false) {
+  return Flag{name, false, skip_handshaker,
+              [=](TestConfig *config, const char *) -> bool {
                 config->*field = true;
                 return true;
               }};
@@ -60,7 +66,7 @@ Flag BoolFlag(const char *name, bool TestConfig::*field) {
 template <typename T>
 bool StringToInt(T *out, const char *str) {
   static_assert(std::is_integral<T>::value, "not an integral type");
-  static_assert(sizeof(T) <= sizeof(long long), "type too large for long long");
+
   // |strtoull| allows leading '-' with wraparound. Additionally, both
   // functions accept empty strings and leading whitespace.
   if (!OPENSSL_isdigit(static_cast<unsigned char>(*str)) &&
@@ -71,15 +77,20 @@ bool StringToInt(T *out, const char *str) {
   errno = 0;
   char *end;
   if (std::is_signed<T>::value) {
+    static_assert(sizeof(T) <= sizeof(long long),
+                  "type too large for long long");
     long long value = strtoll(str, &end, 10);
-    if (value < std::numeric_limits<T>::min() ||
-        value > std::numeric_limits<T>::max()) {
+    if (value < static_cast<long long>(std::numeric_limits<T>::min()) ||
+        value > static_cast<long long>(std::numeric_limits<T>::max())) {
       return false;
     }
     *out = static_cast<T>(value);
   } else {
+    static_assert(sizeof(T) <= sizeof(unsigned long long),
+                  "type too large for unsigned long long");
     unsigned long long value = strtoull(str, &end, 10);
-    if (value > std::numeric_limits<T>::max()) {
+    if (value >
+        static_cast<unsigned long long>(std::numeric_limits<T>::max())) {
       return false;
     }
     *out = static_cast<T>(value);
@@ -90,15 +101,19 @@ bool StringToInt(T *out, const char *str) {
 }
 
 template <typename T>
-Flag IntFlag(const char *name, T TestConfig::*field) {
-  return Flag{name, true, [=](TestConfig *config, const char *param) -> bool {
+Flag IntFlag(const char *name, T TestConfig::*field,
+             bool skip_handshaker = false) {
+  return Flag{name, true, skip_handshaker,
+              [=](TestConfig *config, const char *param) -> bool {
                 return StringToInt(&(config->*field), param);
               }};
 }
 
 template <typename T>
-Flag IntVectorFlag(const char *name, std::vector<T> TestConfig::*field) {
-  return Flag{name, true, [=](TestConfig *config, const char *param) -> bool {
+Flag IntVectorFlag(const char *name, std::vector<T> TestConfig::*field,
+                   bool skip_handshaker = false) {
+  return Flag{name, true, skip_handshaker,
+              [=](TestConfig *config, const char *param) -> bool {
                 T value;
                 if (!StringToInt(&value, param)) {
                   return false;
@@ -108,8 +123,10 @@ Flag IntVectorFlag(const char *name, std::vector<T> TestConfig::*field) {
               }};
 }
 
-Flag StringFlag(const char *name, std::string TestConfig::*field) {
-  return Flag{name, true, [=](TestConfig *config, const char *param) -> bool {
+Flag StringFlag(const char *name, std::string TestConfig::*field,
+                bool skip_handshaker = false) {
+  return Flag{name, true, skip_handshaker,
+              [=](TestConfig *config, const char *param) -> bool {
                 config->*field = param;
                 return true;
               }};
@@ -118,8 +135,10 @@ Flag StringFlag(const char *name, std::string TestConfig::*field) {
 // TODO(davidben): When we can depend on C++17 or Abseil, switch this to
 // std::optional or absl::optional.
 Flag OptionalStringFlag(const char *name,
-                        std::unique_ptr<std::string> TestConfig::*field) {
-  return Flag{name, true, [=](TestConfig *config, const char *param) -> bool {
+                        std::unique_ptr<std::string> TestConfig::*field,
+                        bool skip_handshaker = false) {
+  return Flag{name, true, skip_handshaker,
+              [=](TestConfig *config, const char *param) -> bool {
                 (config->*field).reset(new std::string(param));
                 return true;
               }};
@@ -142,15 +161,19 @@ bool DecodeBase64(std::string *out, const std::string &in) {
   return true;
 }
 
-Flag Base64Flag(const char *name, std::string TestConfig::*field) {
-  return Flag{name, true, [=](TestConfig *config, const char *param) -> bool {
+Flag Base64Flag(const char *name, std::string TestConfig::*field,
+                bool skip_handshaker = false) {
+  return Flag{name, true, skip_handshaker,
+              [=](TestConfig *config, const char *param) -> bool {
                 return DecodeBase64(&(config->*field), param);
               }};
 }
 
 Flag Base64VectorFlag(const char *name,
-                      std::vector<std::string> TestConfig::*field) {
-  return Flag{name, true, [=](TestConfig *config, const char *param) -> bool {
+                      std::vector<std::string> TestConfig::*field,
+                      bool skip_handshaker = false) {
+  return Flag{name, true, skip_handshaker,
+              [=](TestConfig *config, const char *param) -> bool {
                 std::string value;
                 if (!DecodeBase64(&value, param)) {
                   return false;
@@ -162,8 +185,10 @@ Flag Base64VectorFlag(const char *name,
 
 Flag StringPairVectorFlag(
     const char *name,
-    std::vector<std::pair<std::string, std::string>> TestConfig::*field) {
-  return Flag{name, true, [=](TestConfig *config, const char *param) -> bool {
+    std::vector<std::pair<std::string, std::string>> TestConfig::*field,
+    bool skip_handshaker = false) {
+  return Flag{name, true, skip_handshaker,
+              [=](TestConfig *config, const char *param) -> bool {
                 const char *comma = strchr(param, ',');
                 if (!comma) {
                   return false;
@@ -177,7 +202,9 @@ Flag StringPairVectorFlag(
 
 std::vector<Flag> SortedFlags() {
   std::vector<Flag> flags = {
-      IntFlag("-port", &TestConfig::port),
+      IntFlag("-port", &TestConfig::port, /*skip_handshaker=*/true),
+      BoolFlag("-ipv6", &TestConfig::ipv6, /*skip_handshaker=*/true),
+      IntFlag("-shim-id", &TestConfig::shim_id, /*skip_handshaker=*/true),
       BoolFlag("-server", &TestConfig::is_server),
       BoolFlag("-dtls", &TestConfig::is_dtls),
       BoolFlag("-quic", &TestConfig::is_quic),
@@ -434,11 +461,10 @@ bool ParseConfig(int argc, char **argv, bool is_shim,
                  TestConfig *out_initial,
                  TestConfig *out_resume,
                  TestConfig *out_retry) {
-  out_initial->argc = out_resume->argc = out_retry->argc = argc;
-  out_initial->argv = out_resume->argv = out_retry->argv = argv;
   for (int i = 0; i < argc; i++) {
     bool skip = false;
-    const char *name = argv[i];
+    const char *arg = argv[i];
+    const char *name = arg;
 
     // -on-shim and -on-handshaker prefixes enable flags only on the shim or
     // handshaker.
@@ -479,6 +505,13 @@ bool ParseConfig(int argc, char **argv, bool is_shim,
       param = argv[i];
     }
 
+    if (!flag->skip_handshaker) {
+      out_initial->handshaker_args.push_back(arg);
+      if (flag->has_param) {
+        out_initial->handshaker_args.push_back(param);
+      }
+    }
+
     if (!skip) {
       if (out != nullptr) {
         if (!flag->set_param(out, param)) {
@@ -497,6 +530,8 @@ bool ParseConfig(int argc, char **argv, bool is_shim,
     }
   }
 
+  out_resume->handshaker_args = out_initial->handshaker_args;
+  out_retry->handshaker_args = out_initial->handshaker_args;
   return true;
 }
 

data/aws-crt-ffi/crt/aws-lc/ssl/test/test_config.h

@@ -26,6 +26,8 @@
 
 struct TestConfig {
   int port = 0;
+  bool ipv6 = false;
+  uint64_t shim_id = 0;
   bool is_server = false;
   bool is_dtls = false;
   bool is_quic = false;
@@ -215,8 +217,7 @@ struct TestConfig {
   // prioritized over certs defined with |cert_file| and |key_file|.
   std::vector<std::pair<std::string, std::string>> multiple_certs_slot;
 
-  int argc;
-  char **argv;
+  std::vector<const char*> handshaker_args;
 
   bssl::UniquePtr<SSL_CTX> SetupCtx(SSL_CTX *old_ctx) const;
 

data/aws-crt-ffi/crt/aws-lc/ssl/tls13_server.cc

@@ -108,14 +108,7 @@ static int ssl_ext_supported_versions_add_serverhello(SSL_HANDSHAKE *hs,
   return 1;
 }
 
-static const SSL_CIPHER *choose_tls13_cipher(
-    const SSL *ssl, const SSL_CLIENT_HELLO *client_hello, uint16_t group_id) {
-  CBS cipher_suites;
-  CBS_init(&cipher_suites, client_hello->cipher_suites,
-           client_hello->cipher_suites_len);
-
-  const uint16_t version = ssl_protocol_version(ssl);
-
+static const SSL_CIPHER *choose_tls13_cipher(const SSL *ssl, uint16_t group_id) {
   STACK_OF(SSL_CIPHER) *tls13_ciphers = nullptr;
   if (ssl->ctx->tls13_cipher_list &&
       ssl->ctx->tls13_cipher_list.get()->ciphers &&
@@ -123,11 +116,11 @@ static const SSL_CIPHER *choose_tls13_cipher(
     tls13_ciphers = ssl->ctx->tls13_cipher_list.get()->ciphers.get();
   }
 
-  return ssl_choose_tls13_cipher(cipher_suites,
+  return ssl_choose_tls13_cipher(ssl->client_cipher_suites.get(),
                                  ssl->config->aes_hw_override
                                      ? ssl->config->aes_hw_override_value
                                      : EVP_has_aes_hardware(),
-                                 version, group_id, tls13_ciphers);
+                                 ssl_protocol_version(ssl), group_id, tls13_ciphers);
 }
 
 static bool add_new_session_tickets(SSL_HANDSHAKE *hs, bool *out_sent_tickets) {
@@ -239,8 +232,14 @@ static enum ssl_hs_wait_t do_select_parameters(SSL_HANDSHAKE *hs) {
     return ssl_hs_error;
   }
 
+  if (!ssl_parse_client_cipher_list(&client_hello, &ssl->client_cipher_suites)) {
+    OPENSSL_PUT_ERROR(SSL, SSL_R_NO_SHARED_CIPHER);
+    ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE);
+    return ssl_hs_error;
+  }
+
   // Negotiate the cipher suite.
-  hs->new_cipher = choose_tls13_cipher(ssl, &client_hello, group_id);
+  hs->new_cipher = choose_tls13_cipher(ssl, group_id);
   if (hs->new_cipher == NULL) {
     OPENSSL_PUT_ERROR(SSL, SSL_R_NO_SHARED_CIPHER);
     ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE);

data/aws-crt-ffi/crt/aws-lc/tests/ci/cdk/app.py

@@ -6,11 +6,11 @@
 from aws_cdk import Environment, App
 
 # from cdk.bm_framework_stack import BmFrameworkStack
-from cdk.aws_lc_mac_arm_ci_stack import AwsLcMacArmCIStack
 from cdk.aws_lc_analytics_stack import  AwsLcGitHubAnalyticsStack
+from cdk.aws_lc_android_ci_stack import AwsLcAndroidCIStack
 from cdk.aws_lc_github_ci_stack import AwsLcGitHubCIStack
 from cdk.aws_lc_github_fuzz_ci_stack import  AwsLcGitHubFuzzCIStack
-from cdk.aws_lc_android_ci_stack import AwsLcAndroidCIStack
+from cdk.aws_lc_ec2_test_framework_ci_stack import AwsLcEC2TestingCIStack
 from cdk.linux_docker_image_batch_build_stack import LinuxDockerImageBatchBuildStack
 from cdk.windows_docker_image_build_stack import WindowsDockerImageBuildStack
 from cdk.ecr_stack import EcrStack
@@ -50,8 +50,8 @@ analytics_build_spec_file = "cdk/codebuild/github_ci_analytics_omnibus.yaml"
 AwsLcGitHubAnalyticsStack(app, "aws-lc-ci-analytics", analytics_build_spec_file, env=env)
 # bm_framework_build_spec_file = "cdk/codebuild/bm_framework_omnibus.yaml"
 # BmFrameworkStack(app, "aws-lc-ci-bm-framework", bm_framework_build_spec_file, env=env)
-mac_arm_build_spec_file = "cdk/codebuild/github_ci_macos_m1_omnibus.yaml"
-AwsLcMacArmCIStack(app, "aws-lc-ci-macos-arm", mac_arm_build_spec_file, env=env)
+ec2_test_framework_build_spec_file = "cdk/codebuild/ec2_test_framework_omnibus.yaml"
+AwsLcEC2TestingCIStack(app, "aws-lc-ci-ec2-test-framework", ec2_test_framework_build_spec_file, env=env)
 android_build_spec_file = "cdk/codebuild/github_ci_android_omnibus.yaml"
 AwsLcAndroidCIStack(app, "aws-lc-ci-devicefarm-android", android_build_spec_file, env=env)
 

data/aws-crt-ffi/crt/aws-lc/tests/ci/cdk/cdk/{aws_lc_mac_arm_ci_stack.py → aws_lc_ec2_test_framework_ci_stack.py}

@@ -9,13 +9,14 @@ from aws_cdk import CfnTag, Duration, Stack, Tags, aws_ec2 as ec2, aws_codebuild
 from constructs import Construct
 
 from cdk.components import PruneStaleGitHubBuilds
-from util.metadata import AWS_ACCOUNT, AWS_REGION, GITHUB_PUSH_CI_BRANCH_TARGETS, GITHUB_REPO_OWNER, GITHUB_REPO_NAME
-from util.iam_policies import code_build_batch_policy_in_json, ec2_policies_in_json, ssm_policies_in_json, s3_read_write_policy_in_json
+from util.metadata import AWS_ACCOUNT, AWS_REGION, GITHUB_PUSH_CI_BRANCH_TARGETS, GITHUB_REPO_OWNER, GITHUB_REPO_NAME, LINUX_AARCH_ECR_REPO, \
+    LINUX_X86_ECR_REPO
+from util.iam_policies import code_build_batch_policy_in_json, ec2_policies_in_json, ssm_policies_in_json, s3_read_write_policy_in_json, ecr_power_user_policy_in_json
 from util.build_spec_loader import BuildSpecLoader
 
 # detailed documentation can be found here: https://docs.aws.amazon.com/cdk/api/latest/docs/aws-ec2-readme.html
 
-class AwsLcMacArmCIStack(Stack):
+class AwsLcEC2TestingCIStack(Stack):
     """Define a stack used to create a CodeBuild instance on which to execute the AWS-LC m1 ci ec2 instance"""
 
     def __init__(self,
@@ -25,9 +26,6 @@ class AwsLcMacArmCIStack(Stack):
                  **kwargs) -> None:
         super().__init__(scope, id, **kwargs)
 
-        # Define some variables that will be commonly used
-        CLOUDWATCH_LOGS = "{}-cw-logs".format(id)
-
         # Define CodeBuild resource.
         git_hub_source = codebuild.Source.git_hub(
             owner=GITHUB_REPO_OWNER,
@@ -76,7 +74,8 @@ class AwsLcMacArmCIStack(Stack):
 
         # S3 bucket for testing internal fixes.
         s3_read_write_policy = iam.PolicyDocument.from_json(s3_read_write_policy_in_json("aws-lc-codebuild"))
-        ec2_inline_policies = {"s3_read_write_policy": s3_read_write_policy}
+        ecr_power_user_policy = iam.PolicyDocument.from_json(ecr_power_user_policy_in_json([LINUX_X86_ECR_REPO, LINUX_AARCH_ECR_REPO]))
+        ec2_inline_policies = {"s3_read_write_policy": s3_read_write_policy, "ecr_power_user_policy": ecr_power_user_policy}
         ec2_role = iam.Role(scope=self, id="{}-ec2-role".format(id),
                             role_name="{}-ec2-role".format(id),
                             assumed_by=iam.ServicePrincipal("ec2.amazonaws.com"),
@@ -97,27 +96,12 @@ class AwsLcMacArmCIStack(Stack):
         security_group = ec2.SecurityGroup(self, id="{}-ec2-sg".format(id),
                           allow_all_outbound=True,
                           vpc=vpc,
-                          security_group_name='macos_arm_ec2_sg')
-
-        # Dedicated Hosts are required for Mac ec2 instances.
-        cfn_host = ec2.CfnHost(self, id="{}-dedicated-host".format(id),
-                                availability_zone="us-west-2a",
-                                auto_placement="off",
-                                instance_type="mac2.metal")
-        Tags.of(cfn_host).add("Name", "{}-dedicated-host".format(id))
-
-        # AMI is for M1 MacOS Monterey.
-        ami_id="ami-084c6ab9d03ad4d46"
-        cfn_instance = ec2.CfnInstance(self, "{}-ec2-instance".format(id),
-                        availability_zone="us-west-2a",
-                        tenancy="host",
-                        host_id=cfn_host.attr_host_id,
-                        iam_instance_profile="{}-ec2-profile".format(id),
-                        image_id=ami_id,
-                        instance_type="mac2.metal",
-                        security_group_ids=[security_group.security_group_id],
-                        subnet_id=selection.subnet_ids[0],
-                        tags=[CfnTag(key="Name",value="aws-lc-ci-macos-arm-ec2-instance")])
+                          security_group_name='codebuild_ec2_sg')
 
         # Define logs for SSM.
-        logs.LogGroup(self, "{}-cw-logs".format(id), log_group_name=CLOUDWATCH_LOGS)
+        log_group_name = "{}-cw-logs".format(id)
+        log_group = logs.CfnLogGroup(self, log_group_name,
+            log_group_name=log_group_name,
+            retention_in_days=365,
+        )
+

data/aws-crt-ffi/crt/aws-lc/tests/ci/cdk/cdk/ssm/general_test_run_ssm_document.yaml

@@ -0,0 +1,43 @@
+# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+# SPDX-License-Identifier: Apache-2.0 OR ISC
+
+---
+schemaVersion: '2.2'
+description: aws-lc:bmFrameworkEc2Benchmark
+mainSteps:
+  - action: aws:runShellScript
+    name: runShellScript
+    inputs:
+      timeoutSeconds: '7200'
+      runCommand:
+        # Fallback plan to shut down the ec2 instance in 60 minutes in case it's not terminated.
+        # Codebuild just "stops" the instance calling the script, so "trap cleanup" is not executed.
+        - shutdown -P +60
+        - sudo -i
+        - export DEBIAN_FRONTEND=noninteractive
+        - export CPU_TYPE=$(dpkg --print-architecture)
+        # if we have a cpu type of x86, we want linux-x86
+        - if [ "${CPU_TYPE}" = amd64 ]; then export CPU_ARCH=linux-x86; export AWS_CLI_PREFIX=x86_; sudo sh -c "echo 1 > /sys/devices/system/cpu/intel_pstate/no_turbo"; fi
+        # if we have a cpu type of arm, we want linux-aarch
+        - if [ "${CPU_TYPE}" = arm64 ]; then export CPU_ARCH=linux-aarch; export AWS_CLI_PREFIX=aarch; fi
+        # install aws-cli
+        - apt-get -y install unzip
+        - curl "https://awscli.amazonaws.com/awscli-exe-linux-${AWS_CLI_PREFIX}64.zip" -o "awscliv2.zip"
+        - unzip awscliv2.zip
+        - ./aws/install
+        - git clone {GITHUB_REPO} aws-lc-pr
+        - cd aws-lc-pr
+        - git checkout {COMMIT_ID}
+        # install docker if its not already installed
+        - chmod +x ./tests/ci/benchmark_framework/install_docker.sh
+        - ./tests/ci/benchmark_framework/install_docker.sh
+        # log into docker and get needed docker image from ecr
+        - export ECR_REPO="{AWS_ACCOUNT_ID}.dkr.ecr.us-west-2.amazonaws.com/aws-lc-docker-images-${CPU_ARCH}"
+        - aws ecr get-login-password --region us-west-2 | docker login -u AWS --password-stdin "${ECR_REPO}"
+        - docker pull "${ECR_REPO}:{ECR_DOCKER_TAG}"
+        - # start the container and run the bm script
+        - exec_docker="docker run --env AWS_ACCOUNT_ID={AWS_ACCOUNT_ID} --env PR_NUM={PR_NUM} --env COMMIT_ID={COMMIT_ID} --env CPU_TYPE=${CPU_TYPE} -v `pwd`:`pwd` -w `pwd` ${ECR_REPO}:{ECR_DOCKER_TAG}_latest"
+        - chmod +x ./tests/ci/run_posix_sanitizers.sh
+        - $exec_docker ./tests/ci/run_posix_sanitizers.sh
+        - chmod +x ./tests/ci/run_fips_tests.sh
+        - $exec_docker ./tests/ci/run_fips_tests.sh

data/aws-crt-ffi/crt/aws-lc/tests/ci/common_posix_setup.sh

@@ -221,6 +221,16 @@ function print_executable_information {
   fi
 }
 
+function sde_getenforce_check {
+  # Based on Intel SDE README, SELinux should be turned off to allow pin to work.
+  # https://software.intel.com/content/www/us/en/develop/articles/intel-software-development-emulator.html#system-configuration
+  if [[ "$(getenforce)" == 'Disabled' ]]; then
+    echo "SELinux is disabled. Disabling SELinux is needed by sde to allow pin work.";
+  else
+    echo "SELinux should be turned off to allow sde pin to work." && exit 1;
+  fi
+}
+
 print_executable_information "cmake" "--version" "CMake version"
 print_executable_information "cmake3" "--version" "CMake version (cmake3 executable)"
 print_executable_information "go" "version" "Go version"

data/aws-crt-ffi/crt/aws-lc/tests/ci/docker_images/linux-aarch/amazonlinux-2023_base/Dockerfile

@@ -20,9 +20,13 @@ RUN set -ex && \
     git \
     ca-certificates \
     tar \
+    automake \
+    autoconf \
+    diffutils \
     wget \
     valgrind \
-    unzip && \
+    unzip \
+    zlib-devel && \
     # Based on https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html \
     curl "https://awscli.amazonaws.com/awscli-exe-linux-aarch64.zip" -o "awscliv2.zip" && \
     unzip awscliv2.zip && \

data/aws-crt-ffi/crt/aws-lc/tests/ci/docker_images/linux-aarch/ubuntu-22.04_base/Dockerfile

@@ -7,6 +7,9 @@ SHELL ["/bin/bash", "-c"]
 
 ENV DEBIAN_FRONTEND=noninteractive
 
+ENV BOOST_PACKAGE_NAME=boost_1_77_0
+ENV BOOST_TARBALL="${BOOST_PACKAGE_NAME}.tar.bz2"
+ENV BOOST_SRC_URL="https://boostorg.jfrog.io/artifactory/main/release/1.77.0/source/${BOOST_TARBALL}"
 ENV DEPENDENCIES_DIR=/home/dependencies
 ENV LLVM_PROJECT_HOME=${DEPENDENCIES_DIR}/llvm-project
 ENV ASAN_SYMBOLIZER_PATH=/usr/bin/llvm-symbolizer
@@ -21,7 +24,10 @@ RUN set -ex && \
     apt-get -y --no-install-recommends upgrade && \
     apt-get -y --no-install-recommends install \
     software-properties-common \
+    automake \
+    check \
     cmake \
+    curl \
     make \
     ninja-build \
     patch \
@@ -38,14 +44,23 @@ RUN set -ex && \
     libicu-dev \
     libio-socket-ssl-perl \
     libipc-run-perl \
+    libjson-perl \
+    liblua5.4-dev \
+    libnet-dev \
     libnet-ssleay-perl \
+    libpcap-dev \
     libperl-dev \
     libpcre2-dev \
     libreadline-dev \
+    libsqlite3-dev \
+    libtool \
+    libudev-dev \
+    socat \
     zlib1g-dev \
+    dpkg-dev \
     flex \
     bison \
-    curl \
+    jq \
     unzip && \
     # Based on https://docs.aws.amazon.com/cli/latest/userguide/install-cliv2-linux.html
     # The awscli is used to publish data to CloudWatch Metrics in some jobs. This requires additional IAM permission
@@ -53,12 +68,13 @@ RUN set -ex && \
     unzip awscliv2.zip && \
     ./aws/install --bin-dir /usr/bin && \
     rm -rf awscliv2.zip aws/ && \
-    # Download a copy of LLVM's libcxx which is required for building and running with Memory Sanitizer
     mkdir -p ${DEPENDENCIES_DIR} && \
     cd ${DEPENDENCIES_DIR} && \
+    # Extract and install Boost 1.77.0. mySQL 8.33 depends on this specific version.
+    wget ${BOOST_SRC_URL} && tar xfj ${BOOST_TARBALL} && mv ./${BOOST_PACKAGE_NAME} ./boost && rm ${BOOST_TARBALL} && \
+    # Download a copy of LLVM's libcxx which is required for building and running with Memory Sanitizer
     git clone https://github.com/llvm/llvm-project.git --branch llvmorg-11.1.0  --depth 1 && \
     cd llvm-project && rm -rf $(ls -A | grep -Ev "(libcxx|libcxxabi)") && \
-    apt-get --purge remove -y curl unzip && \
     apt-get autoremove --purge -y && \
     apt-get clean && \
     apt-get autoclean && \

data/aws-crt-ffi/crt/aws-lc/tests/ci/docker_images/linux-x86/amazonlinux-2_gcc-7x-intel-sde/Dockerfile

@@ -5,6 +5,9 @@ FROM amazonlinux-2:gcc-7x
 
 SHELL ["/bin/bash", "-c"]
 
+ENV SDE_VERSION_TAG=sde-external-9.21.1-2023-04-24-lin
+ENV SDE_MIRROR_URL="https://downloadmirror.intel.com/777395/sde-external-9.21.1-2023-04-24-lin.tar.xz"
+
 # Enable the EPEL repository on Amazon Linux 2 before installing packages
 # https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/add-repositories.html
 
@@ -23,9 +26,7 @@ RUN set -ex && \
     # Install Intel® Software Development Emulator
     # This emulator is needed when running BoringSSL/AWS-LC code under Intel's SDE for each supported chip (like ice lake).
     # https://software.intel.com/content/www/us/en/develop/articles/intel-software-development-emulator.html#system-configuration
-    wget https://downloadmirror.intel.com/684899/sde-external-9.0.0-2021-11-07-lin.tar.xz && \
-    tar -xf sde-external-9.0.0-2021-11-07-lin.tar.xz && \
-    rm sde-external-9.0.0-2021-11-07-lin.tar.xz && \
+    wget ${SDE_MIRROR_URL} && tar -xf "${SDE_VERSION_TAG}.tar.xz" && rm "${SDE_VERSION_TAG}.tar.xz" && \
     yum clean packages && \
     yum clean metadata && \
     yum clean all && \
@@ -34,5 +35,5 @@ RUN set -ex && \
 
 ENV CC=gcc
 ENV CXX=g++
-ENV SDEROOT=/sde-external-9.0.0-2021-11-07-lin
+ENV SDEROOT="/${SDE_VERSION_TAG}"
 ENV PATH="$SDEROOT:$PATH"

data/aws-crt-ffi/crt/aws-lc/tests/ci/docker_images/linux-x86/build_images.sh

@@ -25,6 +25,7 @@ docker build -t ubuntu-20.04:clang-10x ubuntu-20.04_clang-10x
 docker build -t ubuntu-20.04:android -f ubuntu-20.04_android/Dockerfile ../
 docker build -t ubuntu-20.04:clang-7x-bm-framework ubuntu-20.04_clang-7x-bm-framework
 docker build -t ubuntu-22.04:base -f ubuntu-22.04_base/Dockerfile ../dependencies
+docker build -t ubuntu-22.04:clang-14x-sde ubuntu-22.04_clang-14x-sde
 docker build -t ubuntu-22.04:gcc-11x ubuntu-22.04_gcc-11x
 docker build -t ubuntu-22.04:gcc-12x ubuntu-22.04_gcc-12x
 docker build -t amazonlinux-2:base -f amazonlinux-2_base/Dockerfile ../dependencies

data/aws-crt-ffi/crt/aws-lc/tests/ci/docker_images/linux-x86/push_images.sh

@@ -27,13 +27,14 @@ tag_and_push_img 'ubuntu-20.04:clang-7x-bm-framework' "${ECS_REPO}:ubuntu-20.04_
 tag_and_push_img 'ubuntu-20.04:clang-10x_formal-verification' "${ECS_REPO}:ubuntu-20.04_clang-10x_formal-verification"
 tag_and_push_img 'ubuntu-20.04:gcc-7x' "${ECS_REPO}:ubuntu-20.04_gcc-7x"
 tag_and_push_img 'ubuntu-20.04:gcc-8x' "${ECS_REPO}:ubuntu-20.04_gcc-8x"
+tag_and_push_img 'ubuntu-22.04:clang-14x-sde' "${ECS_REPO}:ubuntu-22.04_clang-14x-sde"
 tag_and_push_img 'ubuntu-22.04:gcc-11x' "${ECS_REPO}:ubuntu-22.04_gcc-11x"
 tag_and_push_img 'ubuntu-22.04:gcc-12x' "${ECS_REPO}:ubuntu-22.04_gcc-12x"
 tag_and_push_img 'centos-7:gcc-4x' "${ECS_REPO}:centos-7_gcc-4x"
 tag_and_push_img 'centos-8:gcc-8x' "${ECS_REPO}:centos-8_gcc-8x"
 tag_and_push_img 'amazonlinux-2:gcc-7x' "${ECS_REPO}:amazonlinux-2_gcc-7x"
-tag_and_push_img 'amazonlinux-2:clang-7x' "${ECS_REPO}:amazonlinux-2_clang-7x"
 tag_and_push_img 'amazonlinux-2:gcc-7x-intel-sde' "${ECS_REPO}:amazonlinux-2_gcc-7x_intel-sde"
+tag_and_push_img 'amazonlinux-2:clang-7x' "${ECS_REPO}:amazonlinux-2_clang-7x"
 tag_and_push_img 'amazonlinux-2023:gcc-11x' "${ECS_REPO}:amazonlinux-2023_gcc-11x"
 tag_and_push_img 'amazonlinux-2023:clang-15x' "${ECS_REPO}:amazonlinux-2023_clang-15x"
 tag_and_push_img 'amazonlinux-2023:clang-15x-sanitizer' "${ECS_REPO}:amazonlinux-2023_clang-15x_sanitizer"

data/aws-crt-ffi/crt/aws-lc/tests/ci/docker_images/linux-x86/ubuntu-20.04_clang-10x_formal-verification/create_image.sh

@@ -10,6 +10,6 @@ fi
 rm -rf aws-lc-verification
 git clone https://github.com/awslabs/aws-lc-verification.git
 cd aws-lc-verification
-docker build --pull --no-cache -t ${docker_tag} .
+docker build --pull --no-cache -f Dockerfile.saw -t ${docker_tag} .
 cd ..
 rm -rf aws-lc-verification

data/aws-crt-ffi/crt/aws-lc/tests/ci/docker_images/linux-x86/ubuntu-22.04_base/Dockerfile

@@ -48,6 +48,7 @@ RUN set -ex && \
     liblua5.4-dev \
     libnet-dev \
     libnet-ssleay-perl \
+    libpam0g-dev \
     libpcap-dev \
     libperl-dev \
     libpcre2-dev \

data/aws-crt-ffi/crt/aws-lc/tests/ci/docker_images/linux-x86/ubuntu-22.04_clang-14x-sde/Dockerfile

@@ -0,0 +1,42 @@
+# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+# SPDX-License-Identifier: Apache-2.0 OR ISC
+
+FROM ubuntu-22.04:base
+
+SHELL ["/bin/bash", "-c"]
+
+ENV SDE_VERSION_TAG=sde-external-9.21.1-2023-04-24-lin
+ENV SDE_MIRROR_URL="https://downloadmirror.intel.com/777395/sde-external-9.21.1-2023-04-24-lin.tar.xz"
+
+RUN set -ex && \
+    apt-get update && \
+    apt-get -y --no-install-recommends upgrade && \
+    apt-get -y --no-install-recommends install \
+    clang-14 clang++-14 \
+    # This provides command `getenforce`, which can tell the current status of SELinux.
+    # Based on Interl SDE README, SELinux should be turned off to allow pin to work.
+    selinux-basics \
+    wget \
+    xz-utils \
+    tar && \
+    # Install Intel® Software Development Emulator
+    # This emulator is needed when running BoringSSL/AWS-LC code under Intel's SDE for each supported chip (like ice lake).
+    # https://software.intel.com/content/www/us/en/develop/articles/intel-software-development-emulator.html#system-configuration
+    wget ${SDE_MIRROR_URL} && tar -xf "${SDE_VERSION_TAG}.tar.xz" && rm "${SDE_VERSION_TAG}.tar.xz" && \
+    apt-get autoremove --purge -y && \
+    apt-get clean && \
+    apt-get autoclean && \
+    rm -rf /var/lib/apt/lists/* && \
+    rm -rf /tmp/*
+
+ENV CC=clang-14
+ENV CXX=clang++-14
+
+# Notes: There are two SDE executables for Linux, sde64 and sde.
+#
+# Intel SDE supports running applications in their native mode. This means if the application is 64 bit application then SDE
+# will run it in 64 bit mode, but if the application is compiled to 32 bits then SDE will run it in 32 bit mode.
+# The executable sde64 is available only in Linux because most Linux distributions do not include the 32 bit runtime. It is
+# used only when 32 bit applications are not supported on the host system.
+ENV SDEROOT="/${SDE_VERSION_TAG}"
+ENV PATH="$SDEROOT:$PATH"

data/aws-crt-ffi/crt/aws-lc/tests/ci/docker_images/windows/vs2017/Dockerfile

@@ -6,6 +6,9 @@
 # Keep parity with the upstream tags at https://hub.docker.com/_/microsoft-windows-servercore
 FROM aws-lc/windows_base:2019
 
+ENV SDE_VERSION_TAG=sde-external-9.21.1-2023-04-24-win
+ENV SDE_MIRROR_URL="https://downloadmirror.intel.com/777395/sde-external-9.21.1-2023-04-24-win.tar.xz"
+
 SHELL ["cmd", "/S", "/C"]
 RUN `
     # Download the Build Tools bootstrapper.
@@ -22,7 +25,18 @@ RUN `
     # Cleanup
     && del /q vs_buildtools.exe
 
+RUN `
+    # Install Windows Intel SDE.
+    curl -SL --output temp.tar.xz %SDE_MIRROR_URL% `
+    `
+    && 7z x temp.tar.xz `
+    && 7z x temp.tar `
+    && ren %SDE_VERSION_TAG% windows-sde `
+    && del temp.tar.xz `
+    && del temp.tar
 
 RUN setx /M PATH "%PATH%;C:\Program Files (x86)\Microsoft Visual Studio\2017\BuildTools\MSBuild\15.0\Bin"
 
+RUN setx /M SDEROOT C:/windows-sde
+
 CMD [ "cmd.exe" ]

data/aws-crt-ffi/crt/aws-lc/tests/ci/docker_images/windows/windows_base/Dockerfile

@@ -9,10 +9,13 @@ ADD https://download.microsoft.com/download/6/A/A/6AA4EDFF-645B-48C5-81CC-ED5963
 RUN start /wait C:\vc_redist.x64.exe /quiet /norestart
 
 # Install chocolatey
+# https://stackoverflow.com/questions/76470752/chocolatey-installation-in-docker-started-to-fail-restart-due-to-net-framework
+ENV chocolateyVersion=1.4.0
 # https://chocolatey.org/docs/troubleshooting#the-request-was-aborted-could-not-create-ssltls-secure-channel
 RUN @powershell Set-ExecutionPolicy Bypass -Scope Process -Force; [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12; $env:chocolateyUseWindowsCompression = 'true'; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))
 
 RUN choco install git --version 2.23.0 -y && `
+choco install 7zip.install -y && `
 choco install ninja --version 1.9.0.20190208 -y && `
 choco install strawberryperl --version 5.32.0.1 -y && `
 choco install nasm --version 2.14.02 -y && `