Fipsld and C++ - Revision history

Jwalton: Added ellipses...

2014-03-17T19:02:49Z

Added ellipses...

Jwalton: Added FIPS category.

2014-03-12T11:39:20Z

Added FIPS category.

Jwalton: fipsld -> fipsld++

2014-03-10T16:09:00Z

fipsld -> fipsld++

Jwalton: Added "same basic steps"

2014-03-10T16:04:02Z

Added "same basic steps"

Jwalton: Improved flow.

2014-03-10T13:22:50Z

Improved flow.

Jwalton: Fixed typo.

2014-03-10T06:47:55Z

Fixed typo.

Jwalton: Added info on PREMAIN_DSO and fips_premain_dso.

2014-03-10T05:52:58Z

Added info on PREMAIN_DSO and fips_premain_dso.

Jwalton: Explained the diff a little more.

2014-03-10T05:27:30Z

Explained the diff a little more.

Jwalton: Added emphasis.

2014-03-10T05:05:31Z

Added emphasis.

Jwalton: It -> the second instance

2014-03-10T05:04:35Z

It -> the second instance

@@ Line 67: / Line 67: @@
 $ pgp openssl-1.0.1f.tar.gz.asc
 pgp: Signature made Mon 06 Jan 2014 09:36:10 AM EST using RSA key ID F295C759
 # Build and install the FIPS Capable Library

← Older revision		Revision as of 11:39, 12 March 2014
Line 351:		Line 351:

	[[Media:fipsld++.tar.gz\|fipsld++.tar.gz]] - The modified fipsld++ to create stand alone EXEs.		[[Media:fipsld++.tar.gz\|fipsld++.tar.gz]] - The modified fipsld++ to create stand alone EXEs.
		+
		+	[[Category:FIPS 140]]

@@ Line 148: / Line 148: @@
 CXX=/usr/local/bin/clang++
-CFLAGS="-Wall -Wextra"
+CFLAGS="-Os -g3 -Wall -Wextra"
-CXXFLAGS="-Wall -Wextra"
+CXXFLAGS="-Os -g3 -Wall -Wextra"
 CXXSTD="-std=c++11"
 CXXSTDLIB="-stdlib=libstdc++"
@@ Line 176: / Line 177: @@
 if [ -z "$CXX" ]; then
-   echo "Could not locate 'fipsld' in $OPENSSLDIR/fips-2.0"
+   echo "Could not locate 'fipsld++' in $OPENSSLDIR/fips-2.0"
 fi

@@ Line 3: / Line 3: @@
 <tt>fisld</tt> will take the place of the linker (or compiler if invoking via a compiler driver). If you use <tt>fisld</tt> to compile a source file, <tt>fisld</tt> will do nothing and simply invoke the compiler you specify through <tt>FIPSLD_CC</tt>. When it comes time to link, <tt>fisld</tt> will compile <tt>fips_premain.c</tt>, add <tt>fipscanister.o</tt>, and then perform the final link of your program. Once your program is linked, <tt>fisld</tt> will then invoke <tt>incore</tt> to embed the FIPS signature in your program.
-The procedure requires three minor modifications to <tt>fipsld</tt>. The modifications will produce <tt>fipsld++</tt> that follows the exiting procedures and re-uses the existing components. After <tt>fipsld++</tt> is modified, its copied into <tt>fips-2.0</tt> with the other FIPS binary components. According to Dr. Henson on the [https://groups.google.com/d/msg/mailing.openssl.users/ms0U4svnokc/dIgMgkxGy88J OpenSSL user list], <tt>fipsld</tt> is ''not'' sequestered and can be changed within reason as long as it does not negatively affect the FIPS Object Module or resulting binary.
+The procedure requires three minor modifications to <tt>fipsld</tt>. The modifications will produce <tt>fipsld++</tt> that follows the exiting procedures and re-uses the existing components. After <tt>fipsld++</tt> is modified, its copied into <tt>fips-2.0</tt> with the other FIPS binary components. According to Dr. Henson on the [https://groups.google.com/d/msg/mailing.openssl.users/ms0U4svnokc/dIgMgkxGy88J OpenSSL user list], <tt>fipsld</tt> is ''not'' sequestered and can be changed within reason as long as it performs the same basic steps and does not negatively affect the FIPS Object Module or resulting binary.
 The example below demonstrates the procedures on Debian 7.3 (x64) using OpenSSL FIPS Capable 1.0.1f and the FIPS Object Module 2.0.5. The example demonstrates Clang and Clang++ with <tt>-stdlib=libstdc++</tt>. However, the procedures work equally well with GCC and G++ (you omit the <tt>-stdlib=libstdc++</tt> for GNU compilers). The modified <tt>fisld</tt> script also works on Mac OS X 10.8 (be sure to use <tt>-stdlib=libc++</tt> rather than <tt>libstdc++</tt>).

@@ Line 200: / Line 200: @@
 == fipsld Modifications ==
-Painting with a broad brush, there are roughly three sections to <tt>fipsld</tt>. The first one-third or so is configuration, and it does things like locate <tt>fipscanister.o</tt> and <tt>fips_premain.c</tt>. The second one-third are steps to build a library or share object. The third  one-third are steps to build a stand alone executable.
+Painting with a broad brush, there are three sections to <tt>fipsld</tt>. The first one-third or so is configuration, and it does things like locate <tt>fipscanister.o</tt> and <tt>fips_premain.c</tt>. The second one-third are steps to build a library or share object. The last  one-third are steps to build a stand alone executable.
 You have to make three modifications to <tt>fipsld</tt>, and the modifications generally apply to the last one-third of the <tt>fipsld</tt> since you are building a executable. If you are building a C++ shared object that statically links to OpenSSL, then you may have to fix the second one-third of <tt>fipsld</tt> too. Building a shared object that statically links to OpenSSL will encounter additional hardships due to <tt>{PREMAIN_DSO}</tt> and <tt>fips_premain_dso</tt>.

← Older revision		Revision as of 06:47, 10 March 2014
Line 1:		Line 1:
−	This wiki page will cover building a C++ ~~project~~ from the command line that statically links to <tt>libssl.a</tt> and <tt>libcrypto.a</tt>. When performing a static link against the OpenSSL library, you have to embed the expected FIPS signature in your executable after final linking. Embedding the FIPS signature in your executable is most of accomplished with <tt>fisld</tt>.	+	This wiki page will cover building a C++ executable program from the command line that statically links to <tt>libssl.a</tt> and <tt>libcrypto.a</tt>. When performing a static link against the OpenSSL library, you have to embed the expected FIPS signature in your executable after final linking. Embedding the FIPS signature in your executable is most often accomplished with <tt>fisld</tt>.

	<tt>fisld</tt> will take the place of the linker (or compiler if invoking via a compiler driver). If you use <tt>fisld</tt> to compile a source file, <tt>fisld</tt> will do nothing and simply invoke the compiler you specify through <tt>FIPSLD_CC</tt>. When it comes time to link, <tt>fisld</tt> will compile <tt>fips_premain.c</tt>, add <tt>fipscanister.o</tt>, and then perform the final link of your program. Once your program is linked, <tt>fisld</tt> will then invoke <tt>incore</tt> to embed the FIPS signature in your program.		<tt>fisld</tt> will take the place of the linker (or compiler if invoking via a compiler driver). If you use <tt>fisld</tt> to compile a source file, <tt>fisld</tt> will do nothing and simply invoke the compiler you specify through <tt>FIPSLD_CC</tt>. When it comes time to link, <tt>fisld</tt> will compile <tt>fips_premain.c</tt>, add <tt>fipscanister.o</tt>, and then perform the final link of your program. Once your program is linked, <tt>fisld</tt> will then invoke <tt>incore</tt> to embed the FIPS signature in your program.

@@ Line 202: / Line 202: @@
 Painting with a broad brush, there are roughly three sections to <tt>fipsld</tt>. The first one-third or so is configuration, and it does things like locate <tt>fipscanister.o</tt> and <tt>fips_premain.c</tt>. The second one-third are steps to build a library or share object. The third  one-third are steps to build a stand alone executable.
-You have to make three modifications to <tt>fipsld</tt>, and the modifications generally apply to the last one-third of the <tt>fipsld</tt> since you are building a executable. You may have to fix the second one-third of <tt>fipsld</tt> too if you are building a C++ shared object, but that was not tested.
+You have to make three modifications to <tt>fipsld</tt>, and the modifications generally apply to the last one-third of the <tt>fipsld</tt> since you are building a executable. If you are building a C++ shared object that statically links to OpenSSL, then you may have to fix the second one-third of <tt>fipsld</tt> too. Building a shared object that statically links to OpenSSL will encounter additional hardships due to <tt>{PREMAIN_DSO}</tt> and <tt>fips_premain_dso</tt>.
 To begin, make a copy of ''<tt>fipsld</tt>'' and name it ''<tt>fipsld++</tt>''.

@@ Line 273: / Line 273: @@
 === Unified Diff ===
-The unified diff between <tt>fipsld</tt> and <tt>fipsld++</tt> is shown below.
+The unified diff between <tt>fipsld</tt> and <tt>fipsld++</tt> is shown below. The lines around 125 and 145 are the one-third of the script that applies to libraries and shared objects. The lines around 170 and 190 are the one-third of the script that applies to executable programs. If you are building a C++ shared object, then you might need to make the changes to both sections of <tt>fipsld++</tt> (a C++ shared object was not tested, so the guidance was not provided).
 <pre>/usr/local/ssl/fips-2.0/bin$ diff -u fipsld fipsld++

@@ Line 204: / Line 204: @@
 You have to make three modifications to <tt>fipsld</tt>, and the modifications generally apply to the last one-third of the <tt>fipsld</tt> since you are building a executable. You may have to fix the second one-third of <tt>fipsld</tt> too if you are building a C++ shared object, but that was not tested.
-To begin, make a copy of <tt>fipsld</tt> and name it <tt>fipsld++</tt>.
+To begin, make a copy of ''<tt>fipsld</tt>'' and name it ''<tt>fipsld++</tt>''.
 === First Change ===

@@ Line 262: / Line 262: @@
 === Third Change ===
-To fix the early exit of <tt>fipsld++</tt>, find the '''second''' occurrence of <tt>[ $? -ne 42 ] && exit $?</tt> and delete it. It happens around line 180 (you may have to fix the first instance too if building a C++ shared object, but that was not tested):
+To fix the early exit of <tt>fipsld++</tt>, find the '''second''' occurrence of <tt>[ $? -ne 42 ] && exit $?</tt> and delete it. The second instance occurs around line 180 (you may have to fix the first instance too if building a C++ shared object, but that was not tested):
 <pre>if [ "x${FIPS_SIG}" != "x" ]; then