Skip to content

Backport Prefix Build Changes to fips-2022-11-02 #1192

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Sep 14, 2023
Merged

Backport Prefix Build Changes to fips-2022-11-02 #1192

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
6f5616e
Simplify the Kyber prefix build (#1131)
andrewhop Aug 9, 2023
dc6f471
Simplify Prefix Build Support (#1178)
skmcgrail Sep 13, 2023
3e7f77d
Add prefix symbols for Windows FIPS Shared Build (#1191)
skmcgrail Sep 14, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
74 changes: 47 additions & 27 deletions CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,9 @@ endif()
install(DIRECTORY include/openssl
DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}
COMPONENT Development
PATTERN boringssl_prefix_symbols.h EXCLUDE
PATTERN boringssl_prefix_symbols_asm.h EXCLUDE
PATTERN boringssl_prefix_symbols_nasm.inc EXCLUDE
)

if(ANDROID)
Expand Down Expand Up @@ -124,47 +127,41 @@ foreach(VAR CMAKE_C_FLAGS CMAKE_CXX_FLAGS CMAKE_ASM_FLAGS)
"${${VAR}_RELEASE}")
endforeach()

if(BORINGSSL_PREFIX)
add_definitions(-DBORINGSSL_PREFIX=${BORINGSSL_PREFIX})
# CMake automatically connects include_directories to the NASM command-line,
# but not add_definitions.
set(CMAKE_ASM_NASM_FLAGS "${CMAKE_ASM_NASM_FLAGS} -DBORINGSSL_PREFIX=${BORINGSSL_PREFIX}")
set(CMAKE_ASM_FLAGS "${CMAKE_ASM_FLAGS} -DBORINGSSL_PREFIX=${BORINGSSL_PREFIX}")
endif()

if(BORINGSSL_PREFIX AND BORINGSSL_PREFIX_SYMBOLS AND GO_EXECUTABLE)

# Use "symbol_prefix_include" to store generated header files
include_directories(${CMAKE_CURRENT_BINARY_DIR}/symbol_prefix_include)

if(IS_ABSOLUTE ${BORINGSSL_PREFIX_SYMBOLS})
set(BORINGSSL_PREFIX_SYMBOLS_PATH ${BORINGSSL_PREFIX_SYMBOLS})
else()
set(BORINGSSL_PREFIX_SYMBOLS_PATH ${PROJECT_BINARY_DIR}/${BORINGSSL_PREFIX_SYMBOLS})
endif()

add_custom_command(
OUTPUT symbol_prefix_include/boringssl_prefix_symbols.h
symbol_prefix_include/boringssl_prefix_symbols_asm.h
symbol_prefix_include/boringssl_prefix_symbols_nasm.inc
COMMAND ${CMAKE_COMMAND} -E make_directory ${CMAKE_CURRENT_BINARY_DIR}/symbol_prefix_include
COMMAND ${GO_EXECUTABLE} run ${CMAKE_CURRENT_SOURCE_DIR}/util/make_prefix_headers.go -out ${CMAKE_CURRENT_BINARY_DIR}/symbol_prefix_include ${BORINGSSL_PREFIX_SYMBOLS_PATH}
# Temporary exclude all Kyber symbols.
# TODO(dkostic): fix the prefix build to work with Kyber source code.
COMMAND sed -i.bak '/pqcrystals/d' ${CMAKE_CURRENT_BINARY_DIR}/symbol_prefix_include/boringssl_prefix_symbols.h
COMMAND sed -i.bak '/ bignum_/d' ${CMAKE_CURRENT_BINARY_DIR}/symbol_prefix_include/boringssl_prefix_symbols.h
COMMAND sed -i.bak '/ bignum_/d' ${CMAKE_CURRENT_BINARY_DIR}/symbol_prefix_include/boringssl_prefix_symbols_asm.h
COMMAND sed -i.bak '/ bignum_/d' ${CMAKE_CURRENT_BINARY_DIR}/symbol_prefix_include/boringssl_prefix_symbols_nasm.inc
OUTPUT symbol_prefix_include/openssl/boringssl_prefix_symbols.h
symbol_prefix_include/openssl/boringssl_prefix_symbols_asm.h
symbol_prefix_include/openssl/boringssl_prefix_symbols_nasm.inc
COMMAND ${CMAKE_COMMAND} -E make_directory ${CMAKE_CURRENT_BINARY_DIR}/symbol_prefix_include/openssl
COMMAND ${GO_EXECUTABLE} run ${CMAKE_CURRENT_SOURCE_DIR}/util/make_prefix_headers.go -out ${CMAKE_CURRENT_BINARY_DIR}/symbol_prefix_include/openssl -prefix ${BORINGSSL_PREFIX} ${BORINGSSL_PREFIX_SYMBOLS_PATH}
COMMAND sed -i.bak '/ bignum_/d' ${CMAKE_CURRENT_BINARY_DIR}/symbol_prefix_include/openssl/boringssl_prefix_symbols.h
COMMAND sed -i.bak '/ bignum_/d' ${CMAKE_CURRENT_BINARY_DIR}/symbol_prefix_include/openssl/boringssl_prefix_symbols_asm.h
COMMAND sed -i.bak '/ bignum_/d' ${CMAKE_CURRENT_BINARY_DIR}/symbol_prefix_include/openssl/boringssl_prefix_symbols_nasm.inc
COMMAND ${CMAKE_COMMAND} -E remove
${CMAKE_CURRENT_BINARY_DIR}/symbol_prefix_include/openssl/boringssl_prefix_symbols.h.bak
${CMAKE_CURRENT_BINARY_DIR}/symbol_prefix_include/openssl/boringssl_prefix_symbols_asm.h.bak
${CMAKE_CURRENT_BINARY_DIR}/symbol_prefix_include/openssl/boringssl_prefix_symbols_nasm.inc.bak
DEPENDS util/make_prefix_headers.go
${BORINGSSL_PREFIX_SYMBOLS_PATH})

# add_dependencies needs a target, not a file, so we add an intermediate
# target.
add_custom_target(
boringssl_prefix_symbols
DEPENDS symbol_prefix_include/boringssl_prefix_symbols.h
symbol_prefix_include/boringssl_prefix_symbols_asm.h
symbol_prefix_include/boringssl_prefix_symbols_nasm.inc)
DEPENDS symbol_prefix_include/openssl/boringssl_prefix_symbols.h
symbol_prefix_include/openssl/boringssl_prefix_symbols_asm.h
symbol_prefix_include/openssl/boringssl_prefix_symbols_nasm.inc)

install(DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/symbol_prefix_include/openssl
DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}
COMPONENT Development
)
add_dependencies(global_target boringssl_prefix_symbols)
elseif(BORINGSSL_PREFIX AND BORINGSSL_PREFIX_HEADERS)

Expand All @@ -174,11 +171,30 @@ elseif(BORINGSSL_PREFIX AND BORINGSSL_PREFIX_HEADERS)
set(BORINGSSL_PREFIX_HEADERS_PATH ${PROJECT_BINARY_DIR}/${BORINGSSL_PREFIX_HEADERS})
endif()

include_directories(${BORINGSSL_PREFIX_HEADERS_PATH})
file(COPY ${BORINGSSL_PREFIX_HEADERS_PATH}/openssl/boringssl_prefix_symbols.h DESTINATION ${CMAKE_CURRENT_BINARY_DIR}/symbol_prefix_include/openssl)
file(COPY ${BORINGSSL_PREFIX_HEADERS_PATH}/openssl/boringssl_prefix_symbols_asm.h DESTINATION ${CMAKE_CURRENT_BINARY_DIR}/symbol_prefix_include/openssl)
file(COPY ${BORINGSSL_PREFIX_HEADERS_PATH}/openssl/boringssl_prefix_symbols_nasm.inc DESTINATION ${CMAKE_CURRENT_BINARY_DIR}/symbol_prefix_include/openssl)

add_custom_target(boringssl_prefix_symbols)

install(DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/symbol_prefix_include/openssl
DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}
COMPONENT Development
)
elseif(BORINGSSL_PREFIX OR BORINGSSL_PREFIX_SYMBOLS)
message(FATAL_ERROR "Must specify both or neither of BORINGSSL_PREFIX and BORINGSSL_PREFIX_SYMBOLS")
elseif((BORINGSSL_PREFIX AND BORINGSSL_PREFIX_SYMBOLS) AND NOT GO_EXECUTABLE)
message(FATAL_ERROR "Must have Go installed when using BORINGSSL_PREFIX and BORINGSSL_PREFIX_SYMBOLS")
else()
add_custom_target(boringssl_prefix_symbols)

install(DIRECTORY include/openssl
DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}
COMPONENT Development
PATTERN boringssl_prefix_symbols.h
PATTERN boringssl_prefix_symbols_asm.h
PATTERN boringssl_prefix_symbols_nasm.inc
)
endif()

if("${CMAKE_SYSTEM_NAME}" STREQUAL "Emscripten")
Expand Down Expand Up @@ -596,6 +612,10 @@ if(FIPS)
message(FATAL_ERROR "Static FIPS build of AWS-LC is suported only on Linux")
endif()

if(WIN32 AND CMAKE_BUILD_TYPE_LOWER STREQUAL "debug")
message(FATAL_ERROR "Windows Debug build is not supported with FIPS, use Release or RelWithDebInfo")
endif()

add_subdirectory(third_party/jitterentropy)

add_definitions(-DBORINGSSL_FIPS)
Expand Down
20 changes: 17 additions & 3 deletions crypto/CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -502,9 +502,10 @@ add_library(
)

target_compile_definitions(crypto_objects PRIVATE BORINGSSL_IMPLEMENTATION)

# For the prefix build, the object files need the prefix header files to build.
add_dependencies(crypto_objects global_target)
target_include_directories(crypto_objects BEFORE PRIVATE ${PROJECT_BINARY_DIR}/symbol_prefix_include)
target_include_directories(crypto_objects PRIVATE ${PROJECT_SOURCE_DIR}/include)

function(build_libcrypto name module_source)
if(FIPS)
Expand All @@ -526,8 +527,11 @@ function(build_libcrypto name module_source)
target_link_libraries(${name} PUBLIC pthread)
endif()

add_dependencies(${name} boringssl_prefix_symbols)
target_include_directories(${name} BEFORE PRIVATE ${PROJECT_BINARY_DIR}/symbol_prefix_include)

target_include_directories(${name} PUBLIC
$<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/../include>
$<BUILD_INTERFACE:${PROJECT_SOURCE_DIR}/include>
$<INSTALL_INTERFACE:include>)
endfunction()

Expand All @@ -540,6 +544,8 @@ if(FIPS_SHARED)
build_libcrypto(precrypto $<TARGET_OBJECTS:fipsmodule>)
add_executable(fips_empty_main fipsmodule/fips_empty_main.c)
target_link_libraries(fips_empty_main PUBLIC precrypto)
target_include_directories(fips_empty_main PRIVATE ${PROJECT_SOURCE_DIR}/include)
target_include_directories(fips_empty_main BEFORE PRIVATE ${PROJECT_BINARY_DIR}/symbol_prefix_include)
add_custom_command(OUTPUT generated_fips_shared_support.c
COMMAND ${GO_EXECUTABLE} run
${PROJECT_SOURCE_DIR}/util/fipstools/capture_hash/capture_hash.go
Expand All @@ -555,6 +561,10 @@ if(FIPS_SHARED)
generated_fips_shared_support.c
${PROJECT_SOURCE_DIR}/crypto/fipsmodule/cpucap/cpucap.c
)
add_dependencies(generated_fipsmodule boringssl_prefix_symbols)
target_include_directories(generated_fipsmodule PRIVATE ${PROJECT_SOURCE_DIR}/include)
target_include_directories(generated_fipsmodule BEFORE PRIVATE ${PROJECT_BINARY_DIR}/symbol_prefix_include)

build_libcrypto(crypto $<TARGET_OBJECTS:generated_fipsmodule>)
else()
# On Apple and Linux platforms inject_hash.go can parse libcrypto and inject
Expand Down Expand Up @@ -629,6 +639,8 @@ if(BUILD_TESTING)
target_compile_definitions(${executable_name} PRIVATE BORINGSSL_IMPLEMENTATION)
add_dependencies(${executable_name} global_target)
target_link_libraries(${executable_name} test_support_lib boringssl_gtest crypto)
add_dependencies(${executable_name} boringssl_prefix_symbols)
target_include_directories(${executable_name} BEFORE PRIVATE ${PROJECT_BINARY_DIR}/symbol_prefix_include)
add_dependencies(all_tests ${executable_name})
endmacro()

Expand All @@ -654,7 +666,9 @@ if(BUILD_TESTING)
target_compile_options(${RANDOM_TEST_EXEC} PUBLIC -DJITTER_ENTROPY)
endif()

add_dependencies(${RANDOM_TEST_EXEC} boringssl_prefix_symbols)
target_link_libraries(${RANDOM_TEST_EXEC} test_support_lib boringssl_gtest crypto)
target_include_directories(${RANDOM_TEST_EXEC} BEFORE PRIVATE ${PROJECT_BINARY_DIR}/symbol_prefix_include)

add_dependencies(${RANDOM_TEST_EXEC} global_target)
add_dependencies(all_tests ${RANDOM_TEST_EXEC})
Expand Down Expand Up @@ -744,8 +758,8 @@ if(BUILD_TESTING)
)

add_dependencies(${CRYPTO_TEST_EXEC} global_target)

target_link_libraries(${CRYPTO_TEST_EXEC} test_support_lib boringssl_gtest crypto)
target_include_directories(${CRYPTO_TEST_EXEC} BEFORE PRIVATE ${PROJECT_BINARY_DIR}/symbol_prefix_include)
if(WIN32)
target_link_libraries(${CRYPTO_TEST_EXEC} ws2_32)
endif()
Expand Down
25 changes: 20 additions & 5 deletions crypto/fipsmodule/CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -207,15 +207,14 @@ function(cpreprocess dest src)
set(TARGET "--target=${CMAKE_ASM_COMPILER_TARGET}")
endif()

set(PREFIX_INCLUDE "")
if(BORINGSSL_PREFIX)
set(PREFIX_INCLUDE "-I${BORINGSSL_PREFIX_HEADERS_PATH}")
set(PREFIX_INCLUDE "-I${PROJECT_BINARY_DIR}/symbol_prefix_include")
endif()

string(REGEX REPLACE "[ ]+" ";" CMAKE_ASM_FLAGS "${CMAKE_ASM_FLAGS}")
add_custom_command(
OUTPUT ${dest}
COMMAND ${CMAKE_ASM_COMPILER} ${TARGET} ${CMAKE_ASM_FLAGS} -E ${src} -I${PROJECT_SOURCE_DIR}/include ${PREFIX_INCLUDE} > ${dest}
COMMAND ${CMAKE_ASM_COMPILER} ${TARGET} ${CMAKE_ASM_FLAGS} -E ${src} ${PREFIX_INCLUDE} -I${PROJECT_SOURCE_DIR}/include > ${dest}
DEPENDS
${src}
${PROJECT_SOURCE_DIR}/include/openssl/arm_arch.h
Expand Down Expand Up @@ -290,7 +289,9 @@ if(FIPS_DELOCATE)
endif()

add_dependencies(bcm_c_generated_asm global_target)

add_dependencies(bcm_c_generated_asm boringssl_prefix_symbols)
target_include_directories(bcm_c_generated_asm BEFORE PRIVATE ${PROJECT_BINARY_DIR}/symbol_prefix_include)
target_include_directories(bcm_c_generated_asm PRIVATE ${PROJECT_SOURCE_DIR}/include)
set_target_properties(bcm_c_generated_asm PROPERTIES COMPILE_OPTIONS "-S")
set_target_properties(bcm_c_generated_asm PROPERTIES POSITION_INDEPENDENT_CODE ON)

Expand All @@ -312,6 +313,8 @@ if(FIPS_DELOCATE)
target_compile_definitions(bcm_hashunset PRIVATE BORINGSSL_IMPLEMENTATION)

add_dependencies(bcm_hashunset global_target)
target_include_directories(bcm_hashunset BEFORE PRIVATE ${PROJECT_BINARY_DIR}/symbol_prefix_include)
target_include_directories(bcm_hashunset PRIVATE ${PROJECT_SOURCE_DIR}/include)

set_target_properties(bcm_hashunset PROPERTIES POSITION_INDEPENDENT_CODE ON)
set_target_properties(bcm_hashunset PROPERTIES LINKER_LANGUAGE C)
Expand Down Expand Up @@ -342,6 +345,9 @@ if(FIPS_DELOCATE)
target_compile_definitions(fipsmodule PRIVATE BORINGSSL_IMPLEMENTATION)

add_dependencies(fipsmodule global_target)
add_dependencies(fipsmodule boringssl_prefix_symbols)
target_include_directories(fipsmodule BEFORE PRIVATE ${PROJECT_BINARY_DIR}/symbol_prefix_include)
target_include_directories(fipsmodule PRIVATE ${PROJECT_SOURCE_DIR}/include)

set_target_properties(fipsmodule PROPERTIES LINKER_LANGUAGE C)
elseif(FIPS_SHARED)
Expand All @@ -360,6 +366,9 @@ elseif(FIPS_SHARED)
target_compile_definitions(fipsmodule PRIVATE BORINGSSL_IMPLEMENTATION)

add_dependencies(fipsmodule global_target)
add_dependencies(fipsmodule boringssl_prefix_symbols)
target_include_directories(fipsmodule BEFORE PRIVATE ${PROJECT_BINARY_DIR}/symbol_prefix_include)
target_include_directories(fipsmodule PRIVATE ${PROJECT_SOURCE_DIR}/include)

add_library(
bcm_library
Expand All @@ -371,9 +380,12 @@ elseif(FIPS_SHARED)
${BCM_ASM_SOURCES}
)
target_compile_definitions(bcm_library PRIVATE BORINGSSL_IMPLEMENTATION)
target_include_directories(bcm_library PRIVATE ../../include)
target_include_directories(bcm_library PRIVATE ${PROJECT_SOURCE_DIR}/include)

add_dependencies(bcm_library global_target)
add_dependencies(bcm_library boringssl_prefix_symbols)
target_include_directories(bcm_library BEFORE PRIVATE ${PROJECT_BINARY_DIR}/symbol_prefix_include)
target_include_directories(bcm_library PRIVATE ${PROJECT_SOURCE_DIR}/include)
if (APPLE)
set(BCM_NAME bcm.o)
# The linker on macOS doesn't have the ability to process linker scripts,
Expand Down Expand Up @@ -468,4 +480,7 @@ else()
target_compile_definitions(fipsmodule PRIVATE BORINGSSL_IMPLEMENTATION)

add_dependencies(fipsmodule global_target)
add_dependencies(fipsmodule boringssl_prefix_symbols)
target_include_directories(fipsmodule BEFORE PRIVATE ${PROJECT_BINARY_DIR}/symbol_prefix_include)
target_include_directories(fipsmodule PRIVATE ${PROJECT_SOURCE_DIR}/include)
endif()
4 changes: 1 addition & 3 deletions crypto/hrss/asm/poly_rq_mul.S
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,9 +15,7 @@
#if !defined(OPENSSL_NO_ASM) && !defined(OPENSSL_SMALL) && \
defined(__linux__) && !defined(MY_ASSEMBLER_IS_TOO_OLD_FOR_AVX)

#if defined(BORINGSSL_PREFIX)
#include <boringssl_prefix_symbols_asm.h>
#endif
#include <openssl/boringssl_prefix_symbols_asm.h>

// This is the polynomial multiplication function from [HRSS], provided by kind
// permission of the authors.
Expand Down
Loading