3 # Copyright (c) 2005-2011 The OpenSSL Project.
5 # Depending on output file name, the script either embeds fingerprint
6 # into libcrypto.so or static application. "Static" refers to static
7 # libcrypto.a, not [necessarily] application per se.
9 # Even though this script is called fipsld, it expects C compiler
10 # command line syntax and $FIPSLD_CC or $CC environment variable set
11 # and can even be used to compile source files.
15 CC=${FIPSLD_CC:-${CC}}
16 [ -n "${CC}" ] || { echo '$CC is not defined'; exit 1; }
18 # Initially -c wasn't intended to be interpreted here, but it might
19 # make life easier for those who want to build FIPS-ified applications
20 # with minimal [if any] modifications to their Makefiles...
21 ( while [ "x$1" != "x" -a "x$1" != "x-c" -a "x$1" != "x-E" ]; do shift; done;
25 TARGET=`(while [ "x$1" != "x" -a "x$1" != "x-o" ]; do shift; done; echo $2)`
27 # If using an auto-tooled (autoconf/automake/libtool) project,
28 # configure will fail when testing the compiler or even performing
29 # simple checks. Pass-through to compiler directly if application is
30 # is not being linked with libcrypto, allowing auto-tooled applications
31 # to utilize fipsld (e.g. CC=/usr/local/ssl/bin/fipsld FIPSLD_CC=gcc
32 # ./configure && make). But keep in mind[!] that if certified code
33 # resides in a shared library, then fipsld *may not* be used and
34 # end-developer should not modify application configuration and build
35 # procedures. This is because in-core fingerprint and associated
36 # procedures are already embedded into and executed in shared library
38 case `basename "${TARGET}"` in
39 libcrypto*|libfips*|*.dll) ;;
41 *libcrypto.a*|*-lcrypto*|*fipscanister.o*) ;;
46 [ -n "${TARGET}" ] || { echo 'no -o specified'; exit 1; }
48 # Turn on debugging output?
49 ( while [ "x$1" != "x" -a "x$1" != "x-DDEBUG_FINGERPRINT_PREMAIN" ]; do shift; done;
53 THERE="`echo $0 | sed -e 's|[^/]*$||'`"..
55 # fipscanister.o can appear in command line
56 CANISTER_O=`(while [ "x$1" != "x" ]; do case "$1" in *fipscanister.o) echo $1; exit;; esac; shift; done)`
57 if [ -z "${CANISTER_O}" ]; then
58 # If set, FIPSLIBDIR is location of installed validated FIPS module
59 if [ -n "${FIPSLIBDIR}" ]; then
60 CANISTER_O="${FIPSLIBDIR}/fipscanister.o"
61 elif [ -f "${THERE}/fips/fipscanister.o" ]; then
62 CANISTER_O="${THERE}/fips/fipscanister.o"
63 elif [ -f "${THERE}/lib/fipscanister.o" ]; then
64 CANISTER_O="${THERE}/lib/fipscanister.o"
66 CANISTER_O_CMD="${CANISTER_O}"
68 [ -f ${CANISTER_O} ] || { echo "unable to find ${CANISTER_O}"; exit 1; }
70 PREMAIN_C=`dirname "${CANISTER_O}"`/fips_premain.c
72 HMAC_KEY="etaonrishdlcupfm"
74 case "${CROSS_COMPILE:-`(uname -s) 2>/dev/null`}" in
75 OSF1|IRIX*) _WL_PREMAIN="-Wl,-init,FINGERPRINT_premain" ;;
76 HP-UX) _WL_PREMAIN="-Wl,+init,FINGERPRINT_premain" ;;
77 AIX) _WL_PREMAIN="-Wl,-binitfini:FINGERPRINT_premain,-bnoobjreorder";;
78 Darwin) ( while [ "x$1" != "x" -a "x$1" != "x-dynamiclib" ]; do shift; done;
80 ) && _WL_PREMAIN="-Wl,-init,_FINGERPRINT_premain" ;;
84 [!/]*) TARGET=./${TARGET} ;;
87 case `basename "${TARGET}"` in
88 lib*|*.dll) # must be linking a shared lib...
89 # Shared lib creation can be taking place in the source
90 # directory only, but fipscanister.o can reside elsewhere...
92 if [ -x "${THERE}/fips/fips_standalone_sha1" ]; then
93 FINGERTYPE="${THERE}/fips/fips_standalone_sha1"
94 PREMAIN_DSO="${THERE}/fips/fips_premain_dso"
95 elif [ -x "${THERE}/bin/fips_standalone_sha1" ]; then
96 FINGERTYPE="${THERE}/bin/fips_standalone_sha1"
97 PREMAIN_DSO="./fips_premain_dso"
100 # verify fipspremain.c against its detached signature...
101 ${FINGERTYPE} "${PREMAIN_C}" | sed "s/(.*\//(/" | \
102 diff -w "${PREMAIN_C}.sha1" - || \
103 { echo "${PREMAIN_C} fingerprint mismatch"; exit 1; }
104 # verify fipscanister.o against its detached signature...
105 ${FINGERTYPE} "${CANISTER_O}" | sed "s/(.*\//(/" | \
106 diff -w "${CANISTER_O}.sha1" - || \
107 { echo "${CANISTER_O} fingerprint mismatch"; exit 1; }
109 [ -z "${FIPSLD_LIBCRYPTO}" -a -f "${THERE}/libcrypto.a" ] && \
110 FIPSLD_LIBCRYPTO="${THERE}/libcrypto.a"
113 # Temporarily remove fipscanister.o from libcrypto.a!
114 # We are required to use the standalone copy...
115 if [ -n "${FIPSLD_LIBCRYPTO}" ]; then
116 if ${CROSS_COMPILE}ar d "${FIPSLD_LIBCRYPTO}" fipscanister.o; then
117 (${CROSS_COMPILE}ranlib "${FIPSLD_LIBCRYPTO}") 2>/dev/null || :
118 trap '${CROSS_COMPILE}ar r "${FIPSLD_LIBCRYPTO}" "${CANISTER_O}";
119 (${CROSS_COMPILE}ranlib "${FIPSLD_LIBCRYPTO}") 2>/dev/null || :;
121 touch -c "${TARGET}"' 0
125 /bin/rm -f "${TARGET}"
126 ${CC} ${CANISTER_O_CMD:+"${CANISTER_O_CMD}"} \
130 if [ "x${FIPS_SIG}" != "x" ]; then
132 "${FIPS_SIG}" "${TARGET}"
133 [ $? -ne 42 ] && exit $?
136 # generate signature...
137 SIG=`"${PREMAIN_DSO}" "${TARGET}"`
139 /bin/rm -f "${TARGET}"
140 if [ -z "${SIG}" ]; then
141 echo "unable to collect signature"; exit 1
144 # recompile with signature...
145 ${CC} ${CANISTER_O_CMD:+"${CANISTER_O_CMD}"} \
146 -DHMAC_SHA1_SIG=\"${SIG}\" "${PREMAIN_C}" \
150 *) # must be linking statically...
151 # Static linking can be taking place either in the source
152 # directory or off the installed binary target destination.
153 if [ -x "${THERE}/fips/fips_standalone_sha1" ]; then
154 FINGERTYPE="${THERE}/fips/fips_standalone_sha1"
155 elif [ -x "${THERE}/bin/fips_standalone_sha1" ]; then
156 FINGERTYPE="${THERE}/bin/fips_standalone_sha1"
157 else # Installed tree is expected to contain
158 # lib/fipscanister.o, lib/fipscanister.o.sha1 and
159 # lib/fips_premain.c [not to mention bin/openssl].
160 FINGERTYPE="${THERE}/bin/openssl sha1 -hmac ${HMAC_KEY}"
163 # verify fipscanister.o against its detached signature...
164 ${FINGERTYPE} "${CANISTER_O}" | sed "s/(.*\//(/" | \
165 diff -w "${CANISTER_O}.sha1" - || \
166 { echo "${CANISTER_O} fingerprint mismatch"; exit 1; }
168 # verify fips_premain.c against its detached signature...
169 ${FINGERTYPE} "${PREMAIN_C}" | sed "s/(.*\//(/" | \
170 diff -w "${PREMAIN_C}.sha1" - || \
171 { echo "${PREMAIN_C} fingerprint mismatch"; exit 1; }
173 /bin/rm -f "${TARGET}"
174 ${CC} ${CANISTER_O_CMD:+"${CANISTER_O_CMD}"} \
178 if [ "x${FIPS_SIG}" != "x" ]; then
180 "${FIPS_SIG}" "${TARGET}"
181 [ $? -ne 42 ] && exit $?
184 # generate signature...
187 /bin/rm -f "${TARGET}"
188 if [ -z "${SIG}" ]; then
189 echo "unable to collect signature"; exit 1
192 # recompile with signature...
193 ${CC} ${CANISTER_O_CMD:+"${CANISTER_O_CMD}"} \
194 -DHMAC_SHA1_SIG=\"${SIG}\" "${PREMAIN_C}" \