1 NOTES FOR THE HPE NONSTOP PLATFORM
2 ==============================
7 In addition to the requirements and instructions listed
8 in [INSTALL.md](INSTALL.md), the following are required as well:
10 * The TNS/X platform supports hardware randomization.
11 Specify the `--with-rand-seed=rdcpu` option to the `./Configure` script.
12 This is recommended but not required. `egd` is supported at 3.0 but cannot
13 be used if FIPS is selected.
14 * The TNS/E platform does not support hardware randomization, so
15 specify the `--with-rand-seed=egd` option to the `./Configure` script.
20 The c99 compiler is required for building OpenSSL from source. While c11
21 may work, it has not been broadly tested. c99 is the only compiler
22 prerequisite needed to build OpenSSL 3.0 on this platform. You should also
23 have the FLOSS package installed on your system. The ITUGLIB FLOSS package
24 is the only FLOSS variant that has been broadly tested.
29 OpenSSL can be built using unthreaded, POSIX User Threads (PUT), or Standard
30 POSIX Threads (SPT). Select the following build configuration for each on
31 the TNS/X (L-Series) platform:
33 * `nonstop-nsx` or default will select an unthreaded build.
34 * `nonstop-nsx_put` selects the PUT build.
35 * `nonstop-nsx_64_put` selects the 64 bit file length PUT build.
36 * `nonstop-nsx_spt_floss` selects the SPT build with FLOSS. FLOSS is
37 required for SPT builds because of a known hang when using SPT on its own.
39 ### TNS/E Considerations
41 The TNS/E platform is build using the same set of builds specifying `nse`
42 instead of `nsx` in the set above.
44 You cannot build for TNS/E for FIPS, so you must specify the `no-fips`
45 option to `./Configure`.
47 About Prefix and OpenSSLDir
48 ---------------------------
50 Because there are many potential builds that must co-exist on any given
51 NonStop node, managing the location of your build distribution is crucial.
52 Keep each destination separate and distinct. Mixing any mode described in
53 this document can cause application instability. The recommended approach
54 is to specify the OpenSSL version and threading model in your configuration
55 options, and keeping your memory and float options consistent, for example:
57 * For 1.1 `--prefix=/usr/local-ssl1.1 --openssldir=/usr/local-ssl1.1/ssl`
58 * For 1.1 PUT `--prefix=/usr/local-ssl1.1_put --openssldir=/usr/local-ssl1.1_put/ssl`
59 * For 3.0 `--prefix=/usr/local-ssl3.0 --openssldir=/usr/local-ssl3.0/ssl`
60 * For 3.0 PUT `--prefix=/usr/local-ssl3.0_put --openssldir=/usr/local-ssl3.0_put/ssl`
62 Use the `_RLD_LIB_PATH` environment variable in OSS to select the appropriate
63 directory containing `libcrypto.so` and `libssl.so`. In GUARDIAN, use the
64 `=_RLD_LIB_PATH` search define to locate the GUARDIAN subvolume where OpenSSL
70 OpenSSL is built using IEEE Float mode by default. If you need a different
71 IEEE mode, create a new configuration specifying `tfloat-x86-64` (for Tandem
72 Float) or `nfloat-x86-64` (for Neutral Float).
77 The current OpenSSL default memory model uses the default platform address
78 model. If you need a different address model, you must specify the appropriate
79 c99 options for compile (`CFLAGS`) and linkers (`LDFLAGS`).
81 Cross Compiling on Windows
82 --------------------------
84 To configure and compile OpenSSL, you will need to set up a Cygwin environment.
85 The Cygwin tools should include bash, make, and any other normal tools required
86 for building programs.
88 Your `PATH` must include the bin directory for the c99 cross-compiler, as in:
90 export PATH=/cygdrive/c/Program\ Files\ \(x86\)/HPE\ NonStop/L16.05/usr/bin:$PATH
92 This should be set before Configure is run. For the c99 cross-compiler to work
93 correctly, you also need the `COMP_ROOT` set, as in:
95 export COMP_ROOT="C:\Program Files (x86)\HPE NonStop\L16.05"
97 `COMP_ROOT` needs to be in Windows form.
99 `Configure` must specify the `no-makedepend` option otherwise errors will
100 result when running the build because the c99 cross-compiler does not support
101 the `gcc -MT` option. An example of a `Configure` command to be run from the
102 OpenSSL directory is:
104 ./Configure nonstop-nsx_64 no-makedepend --with-rand-seed=rdcpu
106 Do not forget to include any OpenSSL cross-compiling prefix and certificate
107 options when creating your libraries.
109 The OpenSSL test suite will not run on your workstation. In order to verify the
110 build, you will need to perform the build and test steps in OSS in your NonStop
111 server. You can also build under gcc and run the test suite for Windows but that
114 **Note:** In the event that you are attempting a FIPS-compliant cross-compile,
115 be aware that signatures may not match between builds done under OSS and under
116 cross-compiles as the compilers do not necessarily generate identical objects.
117 Anything and everything to do with FIPS is outside the scope of this document.
118 Refer to the FIPS security policy for more information.
120 The following build configurations have been successfully attempted at one
121 point or another. If you are successful in your cross-compile efforts, please
127 **Note:** Cross-compile builds for TNS/E have not been attempted, but should
128 follow the same considerations as for TNS/X above. SPT builds generally require
129 FLOSS, which is not available for workstation builds. As a result, SPT builds
130 of OpenSSL cannot be cross-compiled.
132 Also see the NSDEE discussion below for more historical information.
134 Cross Compiling with NSDEE
135 --------------------------
137 **Note:** None of these builds have been tested by the platform maintainer and
138 are supplied for historical value. Please submit a Pull Request to OpenSSL
139 should these need to be adjusted.
141 If you are attempting to build OpenSSL with NSDEE, you will need to specify
142 the following variables. The following set of compiler defines are required:
144 # COMP_ROOT must be a full path for the build system (e.g. windows)
145 COMP_ROOT=$(cygpath -w /path/to/comp_root)
146 # CC must be executable by your shell
149 ### Optional Build Variables
152 CIPHENABLES="enable-ssl3 enable-ssl3-method enable-weak-ssl-ciphers enable-rc4"
154 ### Internal Known TNS/X to TNS/E Cross Compile Variables
156 The following definition is required if you are building on TNS/X for TNS/E
157 and have access to a TNS/E machine on your EXPAND network - with an example
160 SYSTEMLIBS="-L/E/cs3/usr/local/lib"
162 Version Procedure (VPROC) Considerations
163 ----------------------------------------
165 If you require a VPROC entry for platform version identification, use the
170 OPENSSL_VPROC_PREFIX=T0085H06
174 OPENSSL_VPROC_PREFIX=T0085L01
176 ### Common Definition
178 export OPENSSL_VPROC=${OPENSSL_VPROC_PREFIX}_$(
180 if [ -n "$PRE_RELEASE_TAG" ]; then
181 PRE_RELEASE_TAG="-$PRE_RELEASE_TAG"
183 echo "$MAJOR.$MINOR.$PATCH$PRE_RELEASE_TAG$BUILD_METADATA" |\
187 Example Configure Targets
188 -------------------------
190 For OSS targets, the main DLL names will be `libssl.so` and `libcrypto.so`.
191 For GUARDIAN targets, DLL names will be `ssl` and `crypto`. The following
192 assumes that your PWD is set according to your installation standards.
194 ./Configure nonstop-nsx --prefix=${PWD} \
195 --openssldir=${PWD}/ssl no-threads \
196 --with-rand-seed=rdcpu ${CIPHENABLES} ${DBGFLAG} ${SYSTEMLIBS}
197 ./Configure nonstop-nsx_g --prefix=${PWD} \
198 --openssldir=${PWD}/ssl no-threads \
199 --with-rand-seed=rdcpu ${CIPHENABLES} ${DBGFLAG} ${SYSTEMLIBS}
200 ./Configure nonstop-nsx_put --prefix=${PWD} \
201 --openssldir=${PWD}/ssl threads "-D_REENTRANT" \
202 --with-rand-seed=rdcpu ${CIPHENABLES} ${DBGFLAG} ${SYSTEMLIBS}
203 ./Configure nonstop-nsx_spt_floss --prefix=${PWD} \
204 --openssldir=${PWD}/ssl threads "-D_REENTRANT" \
205 --with-rand-seed=rdcpu ${CIPHENABLES} ${DBGFLAG} ${SYSTEMLIBS}
206 ./Configure nonstop-nsx_64 --prefix=${PWD} \
207 --openssldir=${PWD}/ssl no-threads \
208 --with-rand-seed=rdcpu ${CIPHENABLES} ${DBGFLAG} ${SYSTEMLIBS}
209 ./Configure nonstop-nsx_64_put --prefix=${PWD} \
210 --openssldir=${PWD}/ssl threads "-D_REENTRANT" \
211 --with-rand-seed=rdcpu ${CIPHENABLES} ${DBGFLAG} ${SYSTEMLIBS}
212 ./Configure nonstop-nsx_g_tandem --prefix=${PWD} \
213 --openssldir=${PWD}/ssl no-threads \
214 --with-rand-seed=rdcpu ${CIPHENABLES} ${DBGFLAG} ${SYSTEMLIBS}
216 ./Configure nonstop-nse --prefix=${PWD} \
217 --openssldir=${PWD}/ssl no-threads \
218 --with-rand-seed=egd ${CIPHENABLES} ${DBGFLAG} ${SYSTEMLIBS}
219 ./Configure nonstop-nse_g --prefix=${PWD} \
220 --openssldir=${PWD}/ssl no-threads \
221 --with-rand-seed=egd ${CIPHENABLES} ${DBGFLAG} ${SYSTEMLIBS}
222 ./Configure nonstop-nse_put --prefix=${PWD} \
223 --openssldir=${PWD}/ssl threads "-D_REENTRANT" \
224 --with-rand-seed=egd ${CIPHENABLES} ${DBGFLAG} ${SYSTEMLIBS}
225 ./Configure nonstop-nse_spt_floss --prefix=${PWD} \
226 --openssldir=${PWD}/ssl threads "-D_REENTRANT" \
227 --with-rand-seed=egd ${CIPHENABLES} ${DBGFLAG} ${SYSTEMLIBS}
228 ./Configure nonstop-nse_64 --prefix=${PWD} \
229 --openssldir=${PWD}/ssl no-threads \
230 --with-rand-seed=egd ${CIPHENABLES} ${DBGFLAG} ${SYSTEMLIBS}
231 ./Configure nonstop-nse_64_put --prefix=${PWD} \
232 --openssldir=${PWD}/ssl threads "-D_REENTRANT"
233 --with-rand-seed=egd ${CIPHENABLES} ${DBGFLAG} ${SYSTEMLIBS}
234 ./Configure nonstop-nse_g_tandem --prefix=${PWD} \
235 --openssldir=${PWD}/ssl no-threads \
236 --with-rand-seed=egd ${CIPHENABLES} ${DBGFLAG} ${SYSTEMLIBS}