Skip to content

Commit c05aea7

Browse files
dgarskedgarske
committed
Improvements to the wolfCrypt FIPS Visual Studio project link settings to resolve ASLR (Randomized Base Address) issue on some platforms. ZD 16615
1 parent 3cebf35 commit c05aea7

4 files changed

Lines changed: 47 additions & 13 deletions

File tree

‎IDE/WIN/README.txt‎

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
First, if you did not get the FIPS files with your archive, you must contact
44
wolfSSL to obtain them.
55

6-
The IDE/WIN/wolfssl-fips.sln solution is for the original FIPS #2425 certificate.
6+
The IDE/WIN/wolfssl-fips.sln solution is for the original FIPS #2425 certificate.
77
See IDE/WIN10/wolfssl-fips.sln for the FIPS v2 #3389 or later Visual Studio solution.
88

99
# Building the wolfssl-fips project
@@ -30,11 +30,13 @@ The In Core Memory test calculates a checksum (HMAC-SHA256) of the wolfCrypt
3030
FIPS library code and constant data and compares it with a known value in
3131
the code.
3232

33-
The Randomized Base Address setting needs to be disabled on the 32-bit builds
34-
but can be enabled on the 64-bit builds. In the 32-bit mode the addresses
35-
being different throws off the in-core memory calculation. It looks like in
36-
64-bit mode the library uses all offsets, so the core hash calculation
37-
is the same every time.
33+
The following wolfCrypt FIPS project linker settings are required for the DLL Win32 configuration:
34+
1) The [Randomized Base Address setting (ASLR)](https://learn.microsoft.com/en-us/cpp/build/reference/dynamicbase-use-address-space-layout-randomization?view=msvc-170)
35+
needs to be disabled on all builds as the feature throws off the in-core memory calculation causing the test to fail.
36+
2) The [Incremental Link](https://learn.microsoft.com/en-us/cpp/build/reference/incremental-link-incrementally?view=msvc-170)
37+
option need turned off so function pointers go to actual code, not a jump instruction.
38+
3) The [FixedBaseAddress](https://learn.microsoft.com/en-us/cpp/build/reference/fixed-fixed-base-address?view=msvc-170)
39+
option to YES, which disables the support for ASLR.
3840

3941
The "verifyCore" check value in the source fips_test.c needs to be updated when
4042
building the code. The POS performs this check and the default failure callback
@@ -71,13 +73,13 @@ These settings are defined in IDE/WIN/user_settings.h.
7173

7274
# Notes on enabling DTLS including DTLS version 1.3
7375

74-
The file IDE/WIN/user_settings_dtls.h contains the needed build options for
76+
The file IDE/WIN/user_settings_dtls.h contains the needed build options for
7577
enabling DTLS and DTLS version 1.3.
7678

7779
To incorporate the build options:
7880

7981
* Rename IDE/WIN/user_settings.h to IDE/WIN/user_settings.h.bak
8082
* Rename IDE/WIN/user_settings_dtls.h to IDE/WIN/user_settings.h
81-
83+
8284
Alternatively, copy the DTLS labeled section from IDE/WIN/user_settings_dtls.h
8385
in to IDE/WIN/user_settings.h.

‎IDE/WIN/wolfssl-fips.vcxproj‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,18 @@
117117
<OutDir>$(SolutionDir)$(Configuration)\$(Platform)\</OutDir>
118118
<IntDir>$(Configuration)\$(Platform)\obj\</IntDir>
119119
</PropertyGroup>
120+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">
121+
<LinkIncremental>false</LinkIncremental>
122+
</PropertyGroup>
123+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">
124+
<LinkIncremental>false</LinkIncremental>
125+
</PropertyGroup>
126+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">
127+
<LinkIncremental>false</LinkIncremental>
128+
</PropertyGroup>
129+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">
130+
<LinkIncremental>false</LinkIncremental>
131+
</PropertyGroup>
120132
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
121133
<ClCompile>
122134
<Optimization>Disabled</Optimization>
@@ -146,6 +158,7 @@
146158
<BaseAddress>0x5A000000</BaseAddress>
147159
<RandomizedBaseAddress>false</RandomizedBaseAddress>
148160
<DataExecutionPrevention>false</DataExecutionPrevention>
161+
<FixedBaseAddress>true</FixedBaseAddress>
149162
</Link>
150163
</ItemDefinitionGroup>
151164
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
@@ -174,7 +187,7 @@
174187
</ClCompile>
175188
<Link>
176189
<AdditionalDependencies>ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
177-
<RandomizedBaseAddress>true</RandomizedBaseAddress>
190+
<RandomizedBaseAddress>false</RandomizedBaseAddress>
178191
<DataExecutionPrevention>false</DataExecutionPrevention>
179192
</Link>
180193
</ItemDefinitionGroup>
@@ -206,6 +219,7 @@
206219
<AdditionalDependencies>ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
207220
<RandomizedBaseAddress>false</RandomizedBaseAddress>
208221
<BaseAddress>0x5A000000</BaseAddress>
222+
<FixedBaseAddress>true</FixedBaseAddress>
209223
</Link>
210224
</ItemDefinitionGroup>
211225
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
@@ -234,7 +248,7 @@
234248
</ClCompile>
235249
<Link>
236250
<AdditionalDependencies>ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
237-
<RandomizedBaseAddress>true</RandomizedBaseAddress>
251+
<RandomizedBaseAddress>false</RandomizedBaseAddress>
238252
</Link>
239253
</ItemDefinitionGroup>
240254
<ItemGroup>

‎IDE/WIN10/README.txt‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,13 @@ The In Core Memory test calculates a checksum (HMAC-SHA256) of the wolfCrypt
2929
FIPS library code and constant data and compares it with a known value in
3030
the code.
3131

32-
The Randomized Base Address setting needs to be disabled on all builds as the
33-
feature throws off the in-core memory calculation causing the test to fail.
32+
The following wolfCrypt FIPS project linker settings are required for the DLL Win32 configuration:
33+
1) The [Randomized Base Address setting (ASLR)](https://learn.microsoft.com/en-us/cpp/build/reference/dynamicbase-use-address-space-layout-randomization?view=msvc-170)
34+
needs to be disabled on all builds as the feature throws off the in-core memory calculation causing the test to fail.
35+
2) The [Incremental Link](https://learn.microsoft.com/en-us/cpp/build/reference/incremental-link-incrementally?view=msvc-170)
36+
option need turned off so function pointers go to actual code, not a jump instruction.
37+
3) The [FixedBaseAddress](https://learn.microsoft.com/en-us/cpp/build/reference/fixed-fixed-base-address?view=msvc-170)
38+
option to YES, which disables the support for ASLR.
3439

3540
The "verifyCore" check value in the source fips_test.c needs to be updated when
3641
building the code. The POS performs this check and the default failure callback
@@ -39,7 +44,6 @@ value and paste it back into your code in the verifyCore initializer then
3944
rebuild the code. When statically linking, you may have to recalculate your
4045
check value when changing your application.
4146

42-
4347
# Build Options
4448

4549
The default build options should be the proper default set of options:

‎IDE/WIN10/wolfssl-fips.vcxproj‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,18 @@
117117
<OutDir>$(SolutionDir)$(Configuration)\$(Platform)\</OutDir>
118118
<IntDir>$(Configuration)\$(Platform)\$(ProjectName)_obj\</IntDir>
119119
</PropertyGroup>
120+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|Win32'">
121+
<LinkIncremental>false</LinkIncremental>
122+
</PropertyGroup>
123+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|Win32'">
124+
<LinkIncremental>false</LinkIncremental>
125+
</PropertyGroup>
126+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Release|x64'">
127+
<LinkIncremental>false</LinkIncremental>
128+
</PropertyGroup>
129+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='DLL Debug|x64'">
130+
<LinkIncremental>false</LinkIncremental>
131+
</PropertyGroup>
120132
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
121133
<ClCompile>
122134
<Optimization>Disabled</Optimization>
@@ -146,6 +158,7 @@
146158
<BaseAddress>0x5A000000</BaseAddress>
147159
<RandomizedBaseAddress>false</RandomizedBaseAddress>
148160
<DataExecutionPrevention>false</DataExecutionPrevention>
161+
<FixedBaseAddress>true</FixedBaseAddress>
149162
</Link>
150163
</ItemDefinitionGroup>
151164
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
@@ -206,6 +219,7 @@
206219
<AdditionalDependencies>ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
207220
<RandomizedBaseAddress>false</RandomizedBaseAddress>
208221
<BaseAddress>0x5A000000</BaseAddress>
222+
<FixedBaseAddress>true</FixedBaseAddress>
209223
</Link>
210224
</ItemDefinitionGroup>
211225
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">

0 commit comments

Comments
 (0)