aws / aws/aws-lc

Building fips compliant dll on Windows targets from an Ubuntu machine

Open
#3,021 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Assembly
Stars
834
Forks
219
Avg merge
2d 22h
Merged PRs (30d)
61

Description

I've been playing with my team's CI, currently we cross-build windows from Ubuntu with a few exceptions running on a Windows VM. One blocker I've had is transferring aws-lc-fips.dll build from being in the windows side to the ubuntu side. There were a few approaches but i think - supporting cross compilation is the best one so far.

Clearly it is not supported atm - you have to run the .exe in order to get the correct hash via capture_hash.go.

I have a solution that doesn't require running anything, it is actually quite elegant!
Could use:
https://learn.microsoft.com/en-us/cpp/build/reference/map-generate-mapfile?view=msvc-170
This generates a mapping between symbols names to .dll file offsets as an output of the build, then you can just use this map to get the offsets of:
BORINGSSL_bcm_text_start, BORINGSSL_bcm_text_end
BORINGSSL_bcm_rodata_start, BORINGSSL_bcm_rodata_end
and calculate the hashes without ever having to run fips_empty_main against the fips dll!

The solution is both elegant and more widely supported - it will require adding .dll parsing code in inject_hash.go like other platforms do!

I was able to vibe a solution pretty quickly, i think after going over dead code i'd be able to wipe deleting more code than the newly added code - but before continuing to a pull request with a full solution i'd like to get your approval - is that a step in the right direction for you? Do you accept such pull requests at a basic level?

Contributor guide

Open the contributing guide

Research direction

Read capture_hash.go and inject_hash.go to understand the current Windows FIPS hashing path and how other platforms parse outputs. Investigate the proposed map-file symbol offsets for the four BORINGSSL_bcm symbols; done means cross-building the Windows DLL from Ubuntu and calculating its hashes without running fips_empty_main.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
build-system, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
28/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.