generated from amazon-archives/__template_Apache-2.0
-
Notifications
You must be signed in to change notification settings - Fork 169
[DRAFT] Fix Windows ARM64 FIPS build; add Clang support for Windows FIPS #3013
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Draft
justsmth
wants to merge
1
commit into
aws:main
Choose a base branch
from
justsmth:fix-ci-windows-arm-fips
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
+182
−39
Draft
Changes from all commits
Commits
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,73 +1,165 @@ | ||
| // Copyright Amazon.com Inc. or its affiliates. All Rights Reserved. | ||
| // SPDX-License-Identifier: Apache-2.0 OR ISC | ||
|
|
||
| // capture_hash runs another executable that has been linked with libcrypto. It expects the libcrypto to run the | ||
| // power-on self-tests and fail due to a fingerprint mismatch. capture_hash parses the output, takes the correct | ||
| // fingerprint value, and generates a new C file that contains the correct fingerprint which is used to build the | ||
| // final libcrypto. | ||
| // capture_hash runs another executable that has been linked with libcrypto. It | ||
| // expects the libcrypto to run the power-on self-tests and fail due to a | ||
| // fingerprint mismatch. capture_hash parses the output to extract the correct | ||
| // fingerprint value. | ||
| // | ||
| // By default it generates a C source file on stdout containing the correct | ||
| // hash, which is used to build the final libcrypto (the two-DLL approach used | ||
| // on Windows x64). | ||
| // | ||
| // When -patch-dll is specified, it instead reads the given DLL, finds the | ||
| // placeholder hash value, replaces it with the captured hash, and writes the | ||
| // patched DLL back. This single-DLL approach avoids building two separate | ||
| // DLLs whose linker output might differ (as happens on ARM64 Windows where | ||
| // mandatory ASLR causes ADRP immediate differences between DLLs). | ||
|
|
||
| package main | ||
|
|
||
| import ( | ||
| "bytes" | ||
| "encoding/hex" | ||
| "flag" | ||
| "fmt" | ||
| "os" | ||
| "os/exec" | ||
| "strings" | ||
|
|
||
| "github.com/aws/aws-lc/util/fipstools/fipscommon" | ||
| ) | ||
|
|
||
| const line0 = "AWS-LC FIPS failure caused by:" | ||
| const line1 = "FIPS integrity test failed." | ||
| const expectedFailureMsg = "FIPS integrity test failed." | ||
|
|
||
| // This must match what is in crypto/fipsmodule/fips_shared_support.c | ||
| const line2 = "Expected: ae2cea2abda6f3ec977f9bf6949afc836827cba0a09f6b6fde52cde2cdff3180" | ||
| const hash_len = 64 | ||
| const expectedHashLine = "Expected: ae2cea2abda6f3ec977f9bf6949afc836827cba0a09f6b6fde52cde2cdff3180" | ||
| const calculatedPrefix = "Calculated: " | ||
| const hashHexLen = 64 | ||
|
|
||
| func main() { | ||
| executable := flag.String("in-executable", "", "Path to the executable file") | ||
| patchDll := flag.String("patch-dll", "", "Path to a DLL to binary-patch with the captured hash (single-DLL mode)") | ||
| flag.Parse() | ||
|
|
||
| if *executable == "" { | ||
| fmt.Fprintf(os.Stderr, "capture_hash: -in-executable is required\n") | ||
| os.Exit(1) | ||
| } | ||
|
|
||
| cmd := exec.Command(*executable) | ||
| out, err := cmd.CombinedOutput() | ||
| if err == nil { | ||
| fmt.Fprintf(os.Stderr, string(out)) | ||
| panic("Executable did not fail as expected") | ||
| fmt.Fprintf(os.Stderr, "%s", out) | ||
| fmt.Fprintf(os.Stderr, "capture_hash: executable did not fail as expected\n") | ||
| os.Exit(1) | ||
| } | ||
|
|
||
| // Search for the expected lines by content rather than by strict line | ||
| // numbers. This makes the parser tolerant of additional diagnostic output | ||
| // that may be printed before or between the FIPS integrity test messages. | ||
| lines := strings.Split(string(out), "\r\n") | ||
| if len(lines) != 6 { | ||
| fmt.Fprintf(os.Stderr, string(out)) | ||
| panic(fmt.Sprintf("Expected 6 lines in output but got %d", len(lines))) | ||
|
|
||
| foundFailureMsg := false | ||
| foundExpectedHash := false | ||
| hashHex := "" | ||
|
|
||
| for _, line := range lines { | ||
| line = strings.TrimSpace(line) | ||
| if line == expectedFailureMsg { | ||
| foundFailureMsg = true | ||
| } | ||
| if line == expectedHashLine { | ||
| foundExpectedHash = true | ||
| } | ||
| if strings.HasPrefix(line, calculatedPrefix) { | ||
| parts := strings.Fields(line) | ||
| if len(parts) >= 2 { | ||
| hashHex = parts[1] | ||
| } | ||
| } | ||
| } | ||
|
|
||
| if lines[0] != line0 { | ||
| fmt.Fprintf(os.Stderr, string(out)) | ||
| panic(fmt.Sprintf("Expected \"%s\" got \"%s\"", line0, lines[0])) | ||
| if !foundFailureMsg { | ||
| fmt.Fprintf(os.Stderr, "%s", out) | ||
| fmt.Fprintf(os.Stderr, "capture_hash: did not find %q in output\n", expectedFailureMsg) | ||
| os.Exit(1) | ||
| } | ||
|
|
||
| if lines[1] != line1 { | ||
| fmt.Fprintf(os.Stderr, string(out)) | ||
| panic(fmt.Sprintf("Expected \"%s\" got \"%s\"", line1, lines[1])) | ||
| if !foundExpectedHash { | ||
| fmt.Fprintf(os.Stderr, "%s", out) | ||
| fmt.Fprintf(os.Stderr, "capture_hash: did not find %q in output\n", expectedHashLine) | ||
| os.Exit(1) | ||
| } | ||
| if lines[2] != line2 { | ||
| fmt.Fprintf(os.Stderr, string(out)) | ||
| panic(fmt.Sprintf("Expected \"%s\" got \"%s\"", line1, lines[1])) | ||
|
|
||
| if hashHex == "" { | ||
| fmt.Fprintf(os.Stderr, "%s", out) | ||
| fmt.Fprintf(os.Stderr, "capture_hash: did not find %q line in output\n", calculatedPrefix) | ||
| os.Exit(1) | ||
| } | ||
| hash := strings.Split(lines[3], " ")[1] | ||
|
|
||
| if len(hash) != hash_len { | ||
| fmt.Fprintf(os.Stderr, string(out)) | ||
| panic(fmt.Sprintf("Hash \"%s\" is %d long, expected %d", hash, len(hash), hash_len)) | ||
| if len(hashHex) != hashHexLen { | ||
| fmt.Fprintf(os.Stderr, "%s", out) | ||
| fmt.Fprintf(os.Stderr, "capture_hash: hash %q is %d chars, expected %d\n", hashHex, len(hashHex), hashHexLen) | ||
| os.Exit(1) | ||
| } | ||
|
|
||
| fmt.Printf(`// Copyright Amazon.com Inc. or its affiliates. All Rights Reserved. | ||
| fmt.Fprintf(os.Stderr, "capture_hash: captured hash = %s\n", hashHex) | ||
|
|
||
| if *patchDll != "" { | ||
| // Single-DLL mode: binary-patch the placeholder hash in the DLL. | ||
| hashBytes, err := hex.DecodeString(hashHex) | ||
| if err != nil { | ||
| fmt.Fprintf(os.Stderr, "capture_hash: failed to decode hash hex: %v\n", err) | ||
| os.Exit(1) | ||
| } | ||
|
|
||
| fi, err := os.Stat(*patchDll) | ||
| if err != nil { | ||
| fmt.Fprintf(os.Stderr, "capture_hash: %v\n", err) | ||
| os.Exit(1) | ||
| } | ||
| perm := fi.Mode() & 0777 | ||
|
|
||
| dllBytes, err := os.ReadFile(*patchDll) | ||
| if err != nil { | ||
| fmt.Fprintf(os.Stderr, "capture_hash: failed to read DLL: %v\n", err) | ||
| os.Exit(1) | ||
| } | ||
|
|
||
| offset := bytes.Index(dllBytes, fipscommon.UninitHashValue[:]) | ||
| if offset < 0 { | ||
| fmt.Fprintf(os.Stderr, "capture_hash: placeholder hash not found in %s\n", *patchDll) | ||
| os.Exit(1) | ||
| } | ||
|
|
||
| // Verify uniqueness — the placeholder must appear exactly once. | ||
| if bytes.Index(dllBytes[offset+len(fipscommon.UninitHashValue):], fipscommon.UninitHashValue[:]) >= 0 { | ||
| fmt.Fprintf(os.Stderr, "capture_hash: found multiple occurrences of placeholder hash in %s\n", *patchDll) | ||
| os.Exit(1) | ||
| } | ||
|
|
||
| copy(dllBytes[offset:], hashBytes) | ||
|
|
||
| if err := os.WriteFile(*patchDll, dllBytes, perm); err != nil { | ||
| fmt.Fprintf(os.Stderr, "capture_hash: failed to write patched DLL: %v\n", err) | ||
| os.Exit(1) | ||
| } | ||
|
|
||
| fmt.Fprintf(os.Stderr, "capture_hash: patched %s at offset 0x%x\n", *patchDll, offset) | ||
| } else { | ||
| // Two-DLL mode: generate a C source file with the correct hash on stdout. | ||
| fmt.Printf(`// Copyright Amazon.com Inc. or its affiliates. All Rights Reserved. | ||
| // SPDX-License-Identifier: Apache-2.0 OR ISC | ||
| // This file is generated by: 'go run util/fipstools/capture_hash/capture_hash.go -in-executable %s' | ||
| #include <stdint.h> | ||
| const uint8_t BORINGSSL_bcm_text_hash[32] = { | ||
| `, *executable) | ||
| for i := 0; i < len(hash); i += 2 { | ||
| fmt.Printf("0x%s, ", hash[i:i+2]) | ||
| } | ||
| fmt.Printf(` | ||
| for i := 0; i < len(hashHex); i += 2 { | ||
| fmt.Printf("0x%s, ", hashHex[i:i+2]) | ||
| } | ||
| fmt.Printf(` | ||
| }; | ||
| `) | ||
| } | ||
| } |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
warning: "This file should be compiled only as part of the Shared FIPS build on macOS/iOS/Windows." [clang-diagnostic-error]
#error "This file should be compiled only as part of the Shared FIPS build on macOS/iOS/Windows." ^