fips/fipsld

   1 #!/bin/sh -e
   2 #
   3 # Copyright (c) 2005-2011 The OpenSSL Project.
   4 #
   5 # Depending on output file name, the script either embeds fingerprint
   6 # into libcrypto.so or static application. "Static" refers to static
   7 # libcrypto.a, not [necessarily] application per se.
   8 #
   9 # Even though this script is called fipsld, it expects C compiler
  10 # command line syntax and $FIPSLD_CC or $CC environment variable set
  11 # and can even be used to compile source files.
  12
  13 #set -x
  14
  15 CC=${FIPSLD_CC:-${CC}}
  16 [ -n "${CC}" ] || { echo '$CC is not defined'; exit 1; }
  17
  18 # Initially -c wasn't intended to be interpreted here, but it might
  19 # make life easier for those who want to build FIPS-ified applications
  20 # with minimal [if any] modifications to their Makefiles...
  21 (   while [ "x$1" != "x" -a "x$1" != "x-c" -a "x$1" != "x-E" ]; do shift; done;
  22     [ $# -ge 1 ]
  23 ) && exec ${CC} "$@"
  24
  25 TARGET=`(while [ "x$1" != "x" -a "x$1" != "x-o" ]; do shift; done; echo $2)`
  26
  27 # If using an auto-tooled (autoconf/automake/libtool) project,
  28 # configure will fail when testing the compiler or even performing
  29 # simple checks. Pass-through to compiler directly if application is
  30 # is not being linked with libcrypto, allowing auto-tooled applications
  31 # to utilize fipsld (e.g. CC=/usr/local/ssl/bin/fipsld FIPSLD_CC=gcc
  32 # ./configure && make). But keep in mind[!] that if certified code
  33 # resides in a shared library, then fipsld *may not* be used and
  34 # end-developer should not modify application configuration and build
  35 # procedures. This is because in-core fingerprint and associated
  36 # procedures are already embedded into and executed in shared library
  37 # context.
  38 case `basename "${TARGET}"` in
  39 libcrypto*|libfips*|*.dll)              ;;
  40 *)      case "$*" in
  41         *libcrypto.a*|*-lcrypto*|*fipscanister.o*)      ;;
  42         *)      exec ${CC} "$@"         ;;
  43         esac
  44 esac
  45
  46 [ -n "${TARGET}" ] || { echo 'no -o specified'; exit 1; }
  47
  48 # Turn on debugging output?
  49 (   while [ "x$1" != "x" -a "x$1" != "x-DDEBUG_FINGERPRINT_PREMAIN" ]; do shift; done;
  50     [ $# -ge 1 ]
  51 ) && set -x
  52
  53 THERE="`echo $0 | sed -e 's|[^/]*$||'`"..
  54
  55 # fipscanister.o can appear in command line
  56 CANISTER_O=`(while [ "x$1" != "x" ]; do case "$1" in *fipscanister.o) echo $1; exit;; esac; shift; done)`
  57 if [ -z "${CANISTER_O}" ]; then
  58         # If set, FIPSLIBDIR is location of installed validated FIPS module
  59         if [ -n "${FIPSLIBDIR}" ]; then
  60                 CANISTER_O="${FIPSLIBDIR}/fipscanister.o"
  61         elif [ -f "${THERE}/fips/fipscanister.o" ]; then
  62                 CANISTER_O="${THERE}/fips/fipscanister.o"
  63         elif [ -f "${THERE}/lib/fipscanister.o" ]; then
  64                 CANISTER_O="${THERE}/lib/fipscanister.o"
  65         fi
  66         CANISTER_O_CMD="${CANISTER_O}"
  67 fi
  68 [ -f ${CANISTER_O} ] || { echo "unable to find ${CANISTER_O}"; exit 1; }
  69
  70 PREMAIN_C=`dirname "${CANISTER_O}"`/fips_premain.c
  71
  72 HMAC_KEY="etaonrishdlcupfm"
  73
  74 case "${CROSS_COMPILE:-`(uname -s) 2>/dev/null`}" in
  75 OSF1|IRIX*)     _WL_PREMAIN="-Wl,-init,FINGERPRINT_premain"     ;;
  76 HP-UX)          _WL_PREMAIN="-Wl,+init,FINGERPRINT_premain"     ;;
  77 AIX)            _WL_PREMAIN="-Wl,-binitfini:FINGERPRINT_premain,-bnoobjreorder";;
  78 Darwin)         (   while [ "x$1" != "x" -a "x$1" != "x-dynamiclib" ]; do shift; done;
  79                     [ $# -ge 1 ]
  80                 ) && _WL_PREMAIN="-Wl,-init,_FINGERPRINT_premain" ;;
  81 esac
  82
  83 case "${TARGET}" in
  84 [!/]*)  TARGET=./${TARGET} ;;
  85 esac
  86
  87 case `basename "${TARGET}"` in
  88 lib*|*.dll)     # must be linking a shared lib...
  89         # Shared lib creation can be taking place in the source
  90         # directory only, but fipscanister.o can reside elsewhere...
  91
  92         if [ -x "${THERE}/fips/fips_standalone_sha1" ]; then
  93                 FINGERTYPE="${THERE}/fips/fips_standalone_sha1"
  94                 PREMAIN_DSO="${THERE}/fips/fips_premain_dso"
  95         elif [ -x "${THERE}/bin/fips_standalone_sha1" ]; then
  96                 FINGERTYPE="${THERE}/bin/fips_standalone_sha1"
  97                 PREMAIN_DSO="./fips_premain_dso"
  98         fi
  99
 100         # verify fipspremain.c against its detached signature...
 101         ${FINGERTYPE} "${PREMAIN_C}" | sed "s/(.*\//(/" | \
 102                 diff -w "${PREMAIN_C}.sha1" - || \
 103         { echo "${PREMAIN_C} fingerprint mismatch"; exit 1; }
 104         # verify fipscanister.o against its detached signature...
 105         ${FINGERTYPE} "${CANISTER_O}" | sed "s/(.*\//(/" | \
 106                 diff -w "${CANISTER_O}.sha1" - || \
 107         { echo "${CANISTER_O} fingerprint mismatch"; exit 1; }
 108
 109         [ -z "${FIPSLD_LIBCRYPTO}" -a -f "${THERE}/libcrypto.a" ] && \
 110                 FIPSLD_LIBCRYPTO="${THERE}/libcrypto.a"
 111
 112
 113         # Temporarily remove fipscanister.o from libcrypto.a!
 114         # We are required to use the standalone copy...
 115         if [ -n  "${FIPSLD_LIBCRYPTO}" ]; then
 116             if ${CROSS_COMPILE}ar d "${FIPSLD_LIBCRYPTO}" fipscanister.o; then
 117                 (${CROSS_COMPILE}ranlib "${FIPSLD_LIBCRYPTO}") 2>/dev/null || :
 118                 trap    '${CROSS_COMPILE}ar r "${FIPSLD_LIBCRYPTO}" "${CANISTER_O}";
 119                          (${CROSS_COMPILE}ranlib "${FIPSLD_LIBCRYPTO}") 2>/dev/null || :;
 120                          sleep 1;
 121                          touch -c "${TARGET}"' 0
 122             fi
 123         fi
 124
 125         /bin/rm -f "${TARGET}"
 126         ${CC}   ${CANISTER_O_CMD:+"${CANISTER_O_CMD}"} \
 127                 "${PREMAIN_C}" \
 128                 ${_WL_PREMAIN} "$@"
 129
 130         if [ "x${FIPS_SIG}" != "x" ]; then
 131                 # embed signature
 132                 "${FIPS_SIG}" "${TARGET}"
 133                 [ $? -ne 42 ] && exit $?
 134         fi
 135
 136         # generate signature...
 137         SIG=`"${PREMAIN_DSO}" "${TARGET}"`
 138
 139         /bin/rm -f "${TARGET}"
 140         if [ -z "${SIG}" ]; then
 141            echo "unable to collect signature"; exit 1
 142         fi
 143
 144         # recompile with signature...
 145         ${CC}   ${CANISTER_O_CMD:+"${CANISTER_O_CMD}"} \
 146                 -DHMAC_SHA1_SIG=\"${SIG}\" "${PREMAIN_C}" \
 147                 ${_WL_PREMAIN} "$@"
 148         ;;
 149
 150 *)      # must be linking statically...
 151         # Static linking can be taking place either in the source
 152         # directory or off the installed binary target destination.
 153         if [ -x "${THERE}/fips/fips_standalone_sha1" ]; then
 154                 FINGERTYPE="${THERE}/fips/fips_standalone_sha1"
 155         elif [ -x "${THERE}/bin/fips_standalone_sha1" ]; then
 156                 FINGERTYPE="${THERE}/bin/fips_standalone_sha1"
 157         else    # Installed tree is expected to contain
 158                 # lib/fipscanister.o, lib/fipscanister.o.sha1 and
 159                 # lib/fips_premain.c [not to mention bin/openssl].
 160                 FINGERTYPE="${THERE}/bin/openssl sha1 -hmac ${HMAC_KEY}"
 161         fi
 162
 163         # verify fipscanister.o against its detached signature...
 164         ${FINGERTYPE} "${CANISTER_O}" | sed "s/(.*\//(/" | \
 165                 diff -w "${CANISTER_O}.sha1" - || \
 166         { echo "${CANISTER_O} fingerprint mismatch"; exit 1; }
 167
 168         # verify fips_premain.c against its detached signature...
 169         ${FINGERTYPE} "${PREMAIN_C}" | sed "s/(.*\//(/" | \
 170                 diff -w "${PREMAIN_C}.sha1" - || \
 171         { echo "${PREMAIN_C} fingerprint mismatch"; exit 1; }
 172
 173         /bin/rm -f "${TARGET}"
 174         ${CC}   ${CANISTER_O_CMD:+"${CANISTER_O_CMD}"} \
 175                 "${PREMAIN_C}" \
 176                 ${_WL_PREMAIN} "$@"
 177
 178         if [ "x${FIPS_SIG}" != "x" ]; then
 179                 # embed signature
 180                 "${FIPS_SIG}" "${TARGET}"
 181                 [ $? -ne 42 ] && exit $?
 182         fi
 183
 184         # generate signature...
 185         SIG=`"${TARGET}"`
 186
 187         /bin/rm -f "${TARGET}"
 188         if [ -z "${SIG}" ]; then
 189            echo "unable to collect signature"; exit 1
 190         fi
 191
 192         # recompile with signature...
 193         ${CC}   ${CANISTER_O_CMD:+"${CANISTER_O_CMD}"} \
 194                 -DHMAC_SHA1_SIG=\"${SIG}\" "${PREMAIN_C}" \
 195                 ${_WL_PREMAIN} "$@"
 196         ;;
 197 esac