Skip to content

Commit 95137f9

Browse files
JacobBarthelmehJacobBarthelmeh
authored
Merge pull request #6856 from dgarske/fips_win32
Fixes for wolfCrypt FIPS DLL win32
2 parents dd1459e + c05aea7 commit 95137f9

6 files changed

Lines changed: 60 additions & 14 deletions

File tree

‎IDE/WIN/README.txt‎

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
First, if you did not get the FIPS files with your archive, you must contact
44
wolfSSL to obtain them.
55

6-
The IDE/WIN/wolfssl-fips.sln solution is for the original FIPS #2425 certificate.
6+
The IDE/WIN/wolfssl-fips.sln solution is for the original FIPS #2425 certificate.
77
See IDE/WIN10/wolfssl-fips.sln for the FIPS v2 #3389 or later Visual Studio solution.
88

99
# Building the wolfssl-fips project
@@ -30,11 +30,13 @@ The In Core Memory test calculates a checksum (HMAC-SHA256) of the wolfCrypt
3030
FIPS library code and constant data and compares it with a known value in
3131
the code.
3232

33-
The Randomized Base Address setting needs to be disabled on the 32-bit builds
34-
but can be enabled on the 64-bit builds. In the 32-bit mode the addresses
35-
being different throws off the in-core memory calculation. It looks like in
36-
64-bit mode the library uses all offsets, so the core hash calculation
37-
is the same every time.
33+
The following wolfCrypt FIPS project linker settings are required for the DLL Win32 configuration:
34+
1) The [Randomized Base Address setting (ASLR)](https://learn.microsoft.com/en-us/cpp/build/reference/dynamicbase-use-address-space-layout-randomization?view=msvc-170)
35+
needs to be disabled on all builds as the feature throws off the in-core memory calculation causing the test to fail.
36+
2) The [Incremental Link](https://learn.microsoft.com/en-us/cpp/build/reference/incremental-link-incrementally?view=msvc-170)
37+
option need turned off so function pointers go to actual code, not a jump instruction.
38+
3) The [FixedBaseAddress](https://learn.microsoft.com/en-us/cpp/build/reference/fixed-fixed-base-address?view=msvc-170)
39+
option to YES, which disables the support for ASLR.
3840

3941
The "verifyCore" check value in the source fips_test.c needs to be updated when
4042
building the code. The POS performs this check and the default failure callback
@@ -71,13 +73,13 @@ These settings are defined in IDE/WIN/user_settings.h.
7173

7274
# Notes on enabling DTLS including DTLS version 1.3
7375

74-
The file IDE/WIN/user_settings_dtls.h contains the needed build options for
76+
The file IDE/WIN/user_settings_dtls.h contains the needed build options for
7577
enabling DTLS and DTLS version 1.3.
7678

7779
To incorporate the build options:
7880

7981
* Rename IDE/WIN/user_settings.h to IDE/WIN/user_settings.h.bak
8082
* Rename IDE/WIN/user_settings_dtls.h to IDE/WIN/user_settings.h
81-
83+
8284
Alternatively, copy the DTLS labeled section from IDE/WIN/user_settings_dtls.h
8385
in to IDE/WIN/user_settings.h.

‎IDE/WIN/wolfssl-fips.vcxproj‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,18 @@
117117
<OutDir>$(SolutionDir)$(Configuration)\$(Platform)\</OutDir>
118118
<IntDir>$(Configuration)\$(Platform)\obj\</IntDir>
119119
</PropertyGroup>
120+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">
121+
<LinkIncremental>false</LinkIncremental>
122+
</PropertyGroup>
123+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">
124+
<LinkIncremental>false</LinkIncremental>
125+
</PropertyGroup>
126+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">
127+
<LinkIncremental>false</LinkIncremental>
128+
</PropertyGroup>
129+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">
130+
<LinkIncremental>false</LinkIncremental>
131+
</PropertyGroup>
120132
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
121133
<ClCompile>
122134
<Optimization>Disabled</Optimization>
@@ -146,6 +158,7 @@
146158
<BaseAddress>0x5A000000</BaseAddress>
147159
<RandomizedBaseAddress>false</RandomizedBaseAddress>
148160
<DataExecutionPrevention>false</DataExecutionPrevention>
161+
<FixedBaseAddress>true</FixedBaseAddress>
149162
</Link>
150163
</ItemDefinitionGroup>
151164
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
@@ -174,7 +187,7 @@
174187
</ClCompile>
175188
<Link>
176189
<AdditionalDependencies>ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
177-
<RandomizedBaseAddress>true</RandomizedBaseAddress>
190+
<RandomizedBaseAddress>false</RandomizedBaseAddress>
178191
<DataExecutionPrevention>false</DataExecutionPrevention>
179192
</Link>
180193
</ItemDefinitionGroup>
@@ -206,6 +219,7 @@
206219
<AdditionalDependencies>ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
207220
<RandomizedBaseAddress>false</RandomizedBaseAddress>
208221
<BaseAddress>0x5A000000</BaseAddress>
222+
<FixedBaseAddress>true</FixedBaseAddress>
209223
</Link>
210224
</ItemDefinitionGroup>
211225
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
@@ -234,7 +248,7 @@
234248
</ClCompile>
235249
<Link>
236250
<AdditionalDependencies>ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
237-
<RandomizedBaseAddress>true</RandomizedBaseAddress>
251+
<RandomizedBaseAddress>false</RandomizedBaseAddress>
238252
</Link>
239253
</ItemDefinitionGroup>
240254
<ItemGroup>

‎IDE/WIN10/README.txt‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,13 @@ The In Core Memory test calculates a checksum (HMAC-SHA256) of the wolfCrypt
2929
FIPS library code and constant data and compares it with a known value in
3030
the code.
3131

32-
The Randomized Base Address setting needs to be disabled on all builds as the
33-
feature throws off the in-core memory calculation causing the test to fail.
32+
The following wolfCrypt FIPS project linker settings are required for the DLL Win32 configuration:
33+
1) The [Randomized Base Address setting (ASLR)](https://learn.microsoft.com/en-us/cpp/build/reference/dynamicbase-use-address-space-layout-randomization?view=msvc-170)
34+
needs to be disabled on all builds as the feature throws off the in-core memory calculation causing the test to fail.
35+
2) The [Incremental Link](https://learn.microsoft.com/en-us/cpp/build/reference/incremental-link-incrementally?view=msvc-170)
36+
option need turned off so function pointers go to actual code, not a jump instruction.
37+
3) The [FixedBaseAddress](https://learn.microsoft.com/en-us/cpp/build/reference/fixed-fixed-base-address?view=msvc-170)
38+
option to YES, which disables the support for ASLR.
3439

3540
The "verifyCore" check value in the source fips_test.c needs to be updated when
3641
building the code. The POS performs this check and the default failure callback
@@ -39,7 +44,6 @@ value and paste it back into your code in the verifyCore initializer then
3944
rebuild the code. When statically linking, you may have to recalculate your
4045
check value when changing your application.
4146

42-
4347
# Build Options
4448

4549
The default build options should be the proper default set of options:

‎IDE/WIN10/user_settings.h‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,16 @@
11
#ifndef _WIN_USER_SETTINGS_H_
22
#define _WIN_USER_SETTINGS_H_
33

4+
/* For FIPS 140-2 3389 build set to "#if 1" */
5+
#if 0
6+
#undef HAVE_FIPS
7+
#define HAVE_FIPS
8+
#undef HAVE_FIPS_VERSION
9+
#define HAVE_FIPS_VERSION 2
10+
#undef HAVE_FIPS_VERSION_MINOR
11+
#define HAVE_FIPS_VERSION_MINOR 0
12+
#endif
13+
414
/* Set the following to 1 for WCv5.0-RC12 build. */
515
#if 0
616
#undef HAVE_FIPS
@@ -67,8 +77,10 @@
6777
#define WOLFSSL_VALIDATE_FFC_IMPORT
6878
#define HAVE_FFDHE_Q
6979
#define HAVE_PUBLIC_FFDHE
80+
#ifdef _WIN64
7081
#define WOLFSSL_AESNI
7182
#define HAVE_INTEL_RDSEED
83+
#endif
7284
#define FORCE_FAILURE_RDSEED
7385
#endif /* FIPS v2 */
7486
#if defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 5)

‎IDE/WIN10/wolfssl-fips.vcxproj‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,18 @@
117117
<OutDir>$(SolutionDir)$(Configuration)\$(Platform)\</OutDir>
118118
<IntDir>$(Configuration)\$(Platform)\$(ProjectName)_obj\</IntDir>
119119
</PropertyGroup>
120+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">
121+
<LinkIncremental>false</LinkIncremental>
122+
</PropertyGroup>
123+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">
124+
<LinkIncremental>false</LinkIncremental>
125+
</PropertyGroup>
126+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">
127+
<LinkIncremental>false</LinkIncremental>
128+
</PropertyGroup>
129+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">
130+
<LinkIncremental>false</LinkIncremental>
131+
</PropertyGroup>
120132
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
121133
<ClCompile>
122134
<Optimization>Disabled</Optimization>
@@ -146,6 +158,7 @@
146158
<BaseAddress>0x5A000000</BaseAddress>
147159
<RandomizedBaseAddress>false</RandomizedBaseAddress>
148160
<DataExecutionPrevention>false</DataExecutionPrevention>
161+
<FixedBaseAddress>true</FixedBaseAddress>
149162
</Link>
150163
</ItemDefinitionGroup>
151164
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
@@ -206,6 +219,7 @@
206219
<AdditionalDependencies>ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
207220
<RandomizedBaseAddress>false</RandomizedBaseAddress>
208221
<BaseAddress>0x5A000000</BaseAddress>
222+
<FixedBaseAddress>true</FixedBaseAddress>
209223
</Link>
210224
</ItemDefinitionGroup>
211225
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">

‎src/pk.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2110,7 +2110,7 @@ int wolfSSL_PEM_write_RSAPrivateKey(XFILE fp, WOLFSSL_RSA *rsa,
21102110
{
21112111
int ret = 1;
21122112
byte* pem = NULL;
2113-
int pLen;
2113+
int pLen = 0;
21142114

21152115
(void)cb;
21162116
(void)arg;

0 commit comments

Comments
 (0)