Hello,
I am working on a validation with a FIPS lab including algorithm testing
etc. and not claim any OpenSSL 2.0.5 FIPS certs.
For this, i have made minor changes to the fips-openssl-2.0.5 source
including the fips_test_suite.c file.
This (modified) fips_test_suite binary with fipscanister.o static linkage
runs fine on MIPS.
A cloned binary (my_fips_test_suite) linked via a FIPS capable libcrypto.so
(openssl-1.0.1j) fails.
This behavior is seen when compiled natively on MIPS or via a mipscross
toolchain (mipsisa32-xlr-linux).
The configure env on my (x86) build machine provides the necessary ARCH and
CC so CROSS_COMPILE isn't specified.
The incore allows the binary creation to compute the hmac-sha1 for
fipscanister and fips_premain.
The fipsopenssl objects get installed in /usr/local/ssl/fips-2.0 fine.
The fipscanister.o, fips_premain.c and their .sha1 files are copied to
/myinstall/usr/lib as the fipslibdir path prior to building openssl 1.0.1j.
-------- begin script for fipsopenssl
> cd openssl-fips-2.0.5
> export MACHINE=mips
> export SYSTEM=Linux
> export ARCH=mips
> export CROSS_COMPILE=
> export FIPS_SIG=/mysrc/openssl-fips-2.0.5/util/incore
> export HOSTCC=gcc
> ./config
> make
> make build_tests
> make build_algvs
-------- end script for fipsopenssl
-------- begin script for openssl
./config no-asm threads shared fips
--prefix=/usr --install_prefix=/myinstall \
--with-fipslibdir=/myinstall/usr/lib/
-------- end script for openssl
-------- begin cross compilation output for fipsopenssl
+ cd /mysrc/openssl-fips-2.0.5
+ export MACHINE=mips
+ MACHINE=mips
+ export SYSTEM=Linux
+ SYSTEM=Linux
+ export ARCH=mips
+ ARCH=mips
+ export CROSS_COMPILE=
+ CROSS_COMPILE=
+ export FIPS_SIG=/mysrc/openssl-fips-2.0.5/util/incore
+ FIPS_SIG=/mysrc/openssl-fips-2.0.5/util/incore
+ export HOSTCC=gcc
+ HOSTCC=gcc
+ /mysrc/openssl-fips-2.0.5/config
Operating system: mips-whatever-linux2
Auto Configuring fipsonly
Configuring for linux-generic32
CC
=/opt/mipscross/crosstool/gcc-3.4.3-glibc-2.3.6/mipsisa32-xlr-linux/bin/mipsisa32-xlr-linux-gcc
CFLAG =-DOPENSSL_FIPSCANISTER -fPIC -DOPENSSL_PIC -DOPENSSL_THREADS
-D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -Wa,--noexecstack -DTERMIO -O3
-fomit-frame-
pointer -Wall
------- end cross compilation output for fipsopenssl
------- begin objdump on x86 build machine with MIPS cross compiler
-bash-3.2$ objdump -t fipscanister.o | grep FIPS_ro
00000000 g O .rodata 00000010 FIPS_rodata_start
0000ca40 g O .rodata 00000010 FIPS_rodata_end
-bash-3.2$ objdump -t fipscanister.o | grep FIPS_text
00000000 l F .text 00000000 FIPS_text_startX
000578e0 l F .text 00000000 FIPS_text_endX
00057900 g F .text 00000000 FIPS_text_end
00000020 g F .text 00000000 FIPS_text_start
-bash-3.2$ objdump -t libcrypto.so.1.0.1 | grep FIPS_ro
001c4770 g O .rodata 00000010 FIPS_rodata_start
001d11b0 g O .rodata 00000010 FIPS_rodata_end
-bash-3.2$ objdump -t libcrypto.so.1.0.1 | grep FIPS_text
0004a800 l F .text 00000000 FIPS_text_startX
000a20e0 l F .text 00000000 FIPS_text_endX
000a2100 g F .text 00000000 FIPS_text_end
0004a820 g F .text 00000000 FIPS_text_start
The .text offset differs by 0x0004a800 b/w libcrypto and fispcanister.o
The .rodata offset differs by 0x001c4770 b/w libcrypto and fispcanister.o
-bash-3.2$ objdump -t fipscanister.o | grep -i FIPS | wc
776 4654 42131
-bash-3.2$ objdump -t libcrypto.so.1.0.1 | grep -i FIPS | wc
787 4722 52864
The additional objdump output for libcrypto.so are...
00000000 l df *ABS* 00000000 o_fips.c
00000000 l df *ABS* 00000000 fips_ers.c
00200190 l O .data 000001b0 FIPS_str_reasons
00200340 l O .data 00000200 FIPS_str_functs
0020b540 l O .data 00000004 fips_drbg_flags
0020b544 l O .data 00000004 fips_drbg_type
00000000 l df *ABS* 00000000 evp_fips.c
001359c4 g F .text 00000000 RAND_set_fips_drbg_type
0004a6f0 g F .text 00000000 ERR_load_FIPS_strings
0004a5b8 g F .text 00000000 FIPS_mode_set
0004a580 g F .text 00000000 FIPS_mode
001359e4 g F .text 00000000 RAND_init_fips
0004a580 g F .text 00000000 FIPS_mode
--------- end objdump on x86 build machine with MIPS cross compiler
--------- begin runtime output on MIPS target
bash>./my_fips_test_suite
1. Non-Approved cryptographic operation test...
DRBG AES-256-CTR DF test started
DRBG AES-256-CTR DF test OK
a. Included algorithm (D-H)......successful
POST started
Integrity test started
Integrity test Failed Incorrectly!!
...
POST Failed
2. Automatic power-up self test...Failed!
--------- end runtime output on MIPS target
Happy to provide any details to get some guidance on what to debug or edit
for MIPS configure/incore ?
Thank you.
Best,
rk
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mta.opensslfoundation.net/pipermail/openssl-users/attachments/20150105/5fea9533/attachment.html>
