Building fips compliant dll on Windows targets from an Ubuntu machine
- Dominant language
- Assembly
- Stars
- 834
- Forks
- 219
- Avg merge
- 2d 22h
- Merged PRs (30d)
- 61
Description
I've been playing with my team's CI, currently we cross-build windows from Ubuntu with a few exceptions running on a Windows VM. One blocker I've had is transferring aws-lc-fips.dll build from being in the windows side to the ubuntu side. There were a few approaches but i think - supporting cross compilation is the best one so far.
Clearly it is not supported atm - you have to run the .exe in order to get the correct hash via capture_hash.go.
I have a solution that doesn't require running anything, it is actually quite elegant!
Could use:
https://learn.microsoft.com/en-us/cpp/build/reference/map-generate-mapfile?view=msvc-170
This generates a mapping between symbols names to .dll file offsets as an output of the build, then you can just use this map to get the offsets of:
BORINGSSL_bcm_text_start, BORINGSSL_bcm_text_end
BORINGSSL_bcm_rodata_start, BORINGSSL_bcm_rodata_end
and calculate the hashes without ever having to run fips_empty_main against the fips dll!
The solution is both elegant and more widely supported - it will require adding .dll parsing code in inject_hash.go like other platforms do!
I was able to vibe a solution pretty quickly, i think after going over dead code i'd be able to wipe deleting more code than the newly added code - but before continuing to a pull request with a full solution i'd like to get your approval - is that a step in the right direction for you? Do you accept such pull requests at a basic level?
Contributor guide
Research direction
Read capture_hash.go and inject_hash.go to understand the current Windows FIPS hashing path and how other platforms parse outputs. Investigate the proposed map-file symbol offsets for the four BORINGSSL_bcm symbols; done means cross-building the Windows DLL from Ubuntu and calculating its hashes without running fips_empty_main.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- build-system, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 28/100