Commit 7207eca1 authored by Dr. Stephen Henson's avatar Dr. Stephen Henson
Browse files

The first of many changes to make OpenSSL 1.0.1 FIPS capable. 

Add static build support to openssl utility.

Add new "fips" option to Configure.

Make use of installed fipsld and fips_standalone_sha1

Initialise FIPS error callbacks, locking and DRBG.

Doesn't do anything much yet: no crypto is redirected to the FIPS module.

Doesn't completely build either but the openssl utility can enter FIPS mode:
which doesn't do anything much either.
parent 9c347824

Configure

+37 −0
Original line number Diff line number Diff line
@@ -628,6 +628,9 @@ my $openssldir=""; 
my $exe_ext="";

my $install_prefix= "$ENV{'INSTALL_PREFIX'}";

my $cross_compile_prefix="";

my $fipsdir="/usr/local/ssl/fips-2.0/";

my $fipslibdir="";

my $baseaddr="0xFB00000";

my $no_threads=0;

my $threads=0;

my $no_shared=0; # but "no-shared" is default
@@ -662,6 +665,7 @@ my $cmll_enc="camellia.o cmll_misc.o cmll_cbc.o"; 
my $processor="";

my $default_ranlib;

my $perl;

my $fips=0;





# All of the following is disabled by default (RC5 was enabled before 0.9.8):
@@ -809,6 +813,10 @@ PROCESS_ARGS: 
			}

		elsif (/^386$/)

			{ $processor=386; }

		elsif (/^fips$/)

			{

			$fips=1;

		        }

		elsif (/^rsaref$/)

			{

			# No RSAref support any more since it's not needed.
@@ -853,6 +861,18 @@ PROCESS_ARGS: 
				{

				$withargs{"zlib-include"}="-I$1";

				}

			elsif (/^--with-fipsdir=(.*)$/)

				{

				$fipsdir="$1/";

				}

			elsif (/^--with-fipslibdir=(.*)$/)

				{

				$fipslibdir="$1/";

				}

			elsif (/^--with-baseaddr=(.*)$/)

				{

				$baseaddr="$1";

				}

			elsif (/^--cross-compile-prefix=(.*)$/)

				{

				$cross_compile_prefix=$1;
@@ -927,6 +947,11 @@ if (defined($disabled{"md5"}) || defined($disabled{"rsa"})) 
	$disabled{"ssl2"} = "forced";

	}



if ($fips && $fipslibdir eq "")

	{

	$fipslibdir = $fipsdir . "lib/";

	}



# SSL 3.0 and TLS requires MD5 and SHA and either RSA or DSA+DH

if (defined($disabled{"md5"}) || defined($disabled{"sha"})

    || (defined($disabled{"rsa"})
@@ -1385,6 +1410,12 @@ $cflags.=" -DOPENSSL_IA32_SSE2" if (!$no_sse2 && $bn_obj =~ /86/); 


$cflags.=" -DOPENSSL_BN_ASM_MONT" if ($bn_obj =~ /-mont/);



if ($fips)

	{

	$openssl_other_defines.="#define OPENSSL_FIPS\n";

	$cflags .= " -I\$(FIPSDIR)include";

	}



$cpuid_obj="mem_clr.o"	unless ($cpuid_obj =~ /\.o$/);

$des_obj=$des_enc	unless ($des_obj =~ /\.o$/);

$bf_obj=$bf_enc		unless ($bf_obj =~ /\.o$/);
@@ -1552,6 +1583,12 @@ while (<IN>) 
	s/^LIBKRB5=.*/LIBKRB5=$withargs{"krb5-lib"}/;

	s/^LIBZLIB=.*/LIBZLIB=$withargs{"zlib-lib"}/;

	s/^ZLIB_INCLUDE=.*/ZLIB_INCLUDE=$withargs{"zlib-include"}/;



	s/^FIPSDIR=.*/FIPSDIR=$fipsdir/;

	s/^FIPSLIBDIR=.*/FIPSLIBDIR=$fipslibdir/;

	s/^FIPSCANLIB=.*/FIPSCANLIB=libcrypto/ if $fips;

	s/^BASEADDR=.*/BASEADDR=$baseaddr/;



	s/^SHLIB_TARGET=.*/SHLIB_TARGET=$shared_target/;

	s/^SHLIB_MARK=.*/SHLIB_MARK=$shared_mark/;

	s/^SHARED_LIBS=.*/SHARED_LIBS=\$(SHARED_CRYPTO) \$(SHARED_SSL)/ if (!$no_shared);

Makefile.org

+27 −0
Original line number Diff line number Diff line
@@ -109,6 +109,30 @@ LIBKRB5= 
ZLIB_INCLUDE=

LIBZLIB=



# TOP level FIPS install directory.

FIPSDIR=



# This is the location of fipscanister.o and friends.

# The FIPS module build will place it $(INSTALLTOP)/lib

# but since $(INSTALLTOP) can only take the default value

# when the module is built it will be in /usr/local/ssl/lib

# $(INSTALLTOP) for this build may be different so hard

# code the path.



FIPSLIBDIR=



# The location of the library which contains fipscanister.o

# normally it will be libcrypto unless fipsdso is set in which

# case it will be libfips. If not compiling in FIPS mode at all

# this is empty making it a useful test for a FIPS compile.



FIPSCANLIB=



# Shared library base address. Currently only used on Windows.

#



BASEADDR=



DIRS=   crypto ssl engines apps test tools

ENGDIRS= ccgost

SHLIBDIRS= crypto ssl
@@ -205,6 +229,9 @@ BUILDENV= PLATFORM='$(PLATFORM)' PROCESSOR='$(PROCESSOR)' \ 
		RMD160_ASM_OBJ='$(RMD160_ASM_OBJ)'		\

		WP_ASM_OBJ='$(WP_ASM_OBJ)'			\

		PERLASM_SCHEME='$(PERLASM_SCHEME)'		\

		FIPSLIBDIR='${FIPSLIBDIR}'			\

		FIPSDIR='${FIPSDIR}'				\

		FIPSCANLIB="$${FIPSCANLIB:-$(FIPSCANLIB)}"	\

		THIS=$${THIS:-$@} MAKEFILE=Makefile MAKEOVERRIDES=

# MAKEOVERRIDES= effectively "equalizes" GNU-ish and SysV-ish make flavors,

# which in turn eliminates ambiguities in variable treatment with -e.

apps/Makefile

+2 −0
Original line number Diff line number Diff line
@@ -153,6 +153,8 @@ $(EXE): progs.h $(E_OBJ) $(PROGRAM).o $(DLIBCRYPTO) $(DLIBSSL) 
	$(RM) $(EXE)

	shlib_target=; if [ -n "$(SHARED_LIBS)" ]; then \

		shlib_target="$(SHLIB_TARGET)"; \

	elif [ -n "$(FIPSCANLIB)" ]; then \

	  FIPSLD_CC="$(CC)"; CC=$(FIPSDIR)bin/fipsld; export CC FIPSLD_CC; \

	fi; \

	LIBRARIES="$(LIBSSL) $(LIBKRB5) $(LIBCRYPTO)" ; \

	$(MAKE) -f $(TOP)/Makefile.shared -e \

crypto/Makefile

+2 −2
Original line number Diff line number Diff line
@@ -34,8 +34,8 @@ GENERAL=Makefile README crypto-lib.com install.com 


LIB= $(TOP)/libcrypto.a

SHARED_LIB= libcrypto$(SHLIB_EXT)

LIBSRC=	cryptlib.c mem.c mem_clr.c mem_dbg.c cversion.c ex_data.c cpt_err.c ebcdic.c uid.c o_time.c o_str.c o_dir.c o_fips.c

LIBOBJ= cryptlib.o mem.o mem_dbg.o cversion.o ex_data.o cpt_err.o ebcdic.o uid.o o_time.o o_str.o o_dir.o o_fips.o $(CPUID_OBJ)

LIBSRC=	cryptlib.c mem.c mem_clr.c mem_dbg.c cversion.c ex_data.c cpt_err.c ebcdic.c uid.c o_time.c o_str.c o_dir.c o_fips.c o_init.c

LIBOBJ= cryptlib.o mem.o mem_dbg.o cversion.o ex_data.o cpt_err.o ebcdic.o uid.o o_time.o o_str.o o_dir.o o_fips.o o_init.o $(CPUID_OBJ)



SRC= $(LIBSRC)

crypto/cryptlib.c

+4 −0
Original line number Diff line number Diff line
@@ -409,6 +409,10 @@ int (*CRYPTO_get_add_lock_callback(void))(int *num,int mount,int type, 
void CRYPTO_set_locking_callback(void (*func)(int mode,int type,

					      const char *file,int line))

	{

	/* Calling this here ensures initialisation before any threads

	 * are started.

	 */

	OPENSSL_init();

	locking_callback=func;

	}