From c3f0ce58ea714f74807ef32831042dc7326f9d17 Mon Sep 17 00:00:00 2001 From: Colton Willey Date: Fri, 14 Aug 2026 13:05:27 -0700 Subject: [PATCH] Supply the FIPS build settings Windows has no configure to derive configure sets a group of macros on Linux that a Windows FIPS build silently omits. Nothing fails at build time; the results are malformed PKCS#8, RSA-PSS interop failures against OpenSSL, and a struct sp_int layout mismatch. Ship them as IDE/WINVS/user_settings-fips.h, included at the end of the bundle's IDE/WIN10/user_settings.h so wolfSSL and wolfProvider compile against the same one. WOLFSSL_SP_INT_NEGATIVE is ABI-affecting, so the two builds disagreeing on it is silent and fatal. The README gains the FIPS procedure: enabling FIPS in the bundle, the v143 retarget, naming the .vcxproj rather than the .sln MSBuild 17 cannot load, building the test app that reports the in-core hash, and the overrides the unit tests need. It also records that DLL Release|x64 and DLL Debug|x64 are the approved FIPS configurations and that their project settings are correct as shipped. No source or project files change. --- IDE/WINVS/README.md | 67 +++++++++++++++++++++++++++++----- IDE/WINVS/include.am | 1 + IDE/WINVS/user_settings-fips.h | 51 ++++++++++++++++++++++++++ 3 files changed, 109 insertions(+), 10 deletions(-) create mode 100644 IDE/WINVS/user_settings-fips.h diff --git a/IDE/WINVS/README.md b/IDE/WINVS/README.md index 68d42656..0474550a 100644 --- a/IDE/WINVS/README.md +++ b/IDE/WINVS/README.md @@ -15,8 +15,7 @@ Four configurations, x64 only: | `Static Debug\|x64` | same, debug CRT | The static library exists only so the unit tests can link wolfProvider -internals. A `.lib` cannot act as a provider: OpenSSL loads one with -`LoadLibraryA` followed by a lookup of `OSSL_provider_init`. +internals. A `.lib` cannot act as a provider. Prerequisites @@ -25,6 +24,9 @@ Prerequisites - Visual Studio 2022 with the C++ toolset (v143) and MASM (`ml64.exe`). - Perl, NASM and git, to build OpenSSL. Strawberry Perl includes NASM. +Run everything below from a Developer Command Prompt, or after `vcvars64.bat`. +`msbuild` and `nmake` are not on `PATH` otherwise. + No `configure` step is involved anywhere on Windows. @@ -52,6 +54,9 @@ Building perl Configure VC-WIN64A shared no-tests --prefix=C:\out\openssl --openssldir=C:\out\openssl\ssl nmake nmake install_sw + nmake install_ssldirs + +`install_sw` alone does not write `openssl.cnf`. Two paths come out of this and they are not interchangeable. The **build tree** (`C:\src\openssl`) is `openSslDir` and must hold `libcrypto.lib` directly. The @@ -89,9 +94,21 @@ does not add the module's own directory to the search path, so **putting `wolfssl.dll` beside `libwolfprov.dll` does not work.** Put it on the loading process's `PATH`: - $env:PATH = "C:\src\wolfssl\DLL Release\x64;$env:PATH" + $env:PATH = "C:\src\wolfssl\DLL Release\x64;C:\out\openssl\bin;$env:PATH" openssl list -providers -provider-path "C:\src\wolfProvider\IDE\WINVS\DLL Release\x64" -provider libwolfprov +Under FIPS the dependency is `wolfssl-fips.dll`, inside the bundle: + + $env:PATH = "C:\src\wolfssl-fips\IDE\WIN10\DLL Release\x64;$env:PATH" + +In `openssl.cnf`, use forward slashes in the `module` path. + +The module is `libwolfprov` but the property it registers is `provider=wolfprov` +(plus `fips=yes` under FIPS): + + openssl dgst -sha256 -provider-path "...\DLL Release\x64" ^ + -provider libwolfprov -propquery "provider=wolfprov" file.bin + User macros ----------- @@ -113,25 +130,56 @@ FIPS ---- A FIPS build is wolfSSL's standard Windows FIPS procedure, then wolfProvider -pointed at the bundle. wolfSSL is linked **shared**, including FIPS; the module -passes its in-core integrity check that way. +pointed at the bundle. Unpack it alongside the other trees; the commands below +assume `C:\src\wolfssl-fips`. `DLL Release|x64` and `DLL Debug|x64` are the +approved FIPS configurations. + +Enable FIPS near the top of the bundle's `IDE\WIN10\user_settings.h`: for a +commercial bundle set the `#if 0` over `HAVE_FIPS_VERSION 5` to `#if 1`, for +FIPS-Ready uncomment `/* #define WOLFSSL_FIPS_READY */`. Each is tested on the +line below it, so define it there and nowhere else in the file. +Copy `user_settings-fips.h` from this directory next to it and include it after +the `#endif` closing `_WIN_USER_SETTINGS_H_`: + + #include "user_settings-fips.h" + +Build the FIPS DLL and the test app that reports its hash. Both are pinned to +`v110`, so retarget on the command line, and name the `.vcxproj` files rather +than `wolfssl-fips.sln`, which MSBuild 17 cannot load (`MSB4025`). + + cd C:\src\wolfssl-fips\IDE\WIN10 + msbuild wolfssl-fips.vcxproj /p:Configuration="DLL Release" /p:Platform=x64 ^ + /p:PlatformToolset=v143 /p:WindowsTargetPlatformVersion=10.0 + msbuild test.vcxproj /p:Configuration="DLL Release" /p:Platform=x64 ^ + /p:PlatformToolset=v143 /p:WindowsTargetPlatformVersion=10.0 + +Leave the project's optimiser and linker settings as shipped. + +Run `test.exe` from `DLL Release\x64\` and follow wolfSSL's `verifyCore` +procedure with the hash it prints. The hash covers only the wolfSSL DLL, so +rebuilding wolfProvider never invalidates it. + +Then build wolfProvider against the bundle, from the wolfProvider root: + + cd C:\src\wolfProvider msbuild IDE\WINVS\wolfprovider.sln /p:Configuration="DLL Release" /p:Platform=x64 ^ /p:wolfCryptDir="C:\src\wolfssl-fips" ^ /p:userSettingsDir="C:\src\wolfssl-fips\IDE\WIN10" ^ /p:wolfCryptDllRelease64="C:\src\wolfssl-fips\IDE\WIN10\DLL Release\x64" ^ /p:wolfSslLib=wolfssl-fips.lib -wolfSSL and wolfProvider must compile against the **same** `user_settings.h`, so -`userSettingsDir` points at the bundle's copy. A layout-changing macro going -asymmetric between the two builds is silent and fatal. +Both builds must compile against the same `user_settings.h`, which is why +`userSettingsDir` points at the bundle's copy. Unit tests ---------- Build `Static Release|x64` and run `IDE\WINVS\Static Release\x64\unit-test.exe` -with the wolfSSL and OpenSSL DLL directories on `PATH`. `WP_UNIT_STATIC_PROVIDER` +with the wolfSSL DLL directory and `C:\out\openssl\bin` on `PATH`. Against a +FIPS bundle pass the same overrides as the provider build, `wolfCryptDllRelease64` +included — the Static configurations link it too. `WP_UNIT_STATIC_PROVIDER` is defined in the Static configurations only, so the test registers the linked-in provider instead of loading the DLL; defining it elsewhere would put two copies of wolfProvider in one process. @@ -150,4 +198,3 @@ Known limitations - SEED-SRC is not supported on Windows. - A `WOLFPROV_DEBUG` unit-test build does not compile; `test_logging.c` uses `setenv()`. -- No automated Windows CI yet. diff --git a/IDE/WINVS/include.am b/IDE/WINVS/include.am index 5c7ae370..d7a28c1f 100644 --- a/IDE/WINVS/include.am +++ b/IDE/WINVS/include.am @@ -4,6 +4,7 @@ EXTRA_DIST+= IDE/WINVS/README.md EXTRA_DIST+= IDE/WINVS/user_settings.h +EXTRA_DIST+= IDE/WINVS/user_settings-fips.h EXTRA_DIST+= IDE/WINVS/wolfprovider.sln EXTRA_DIST+= IDE/WINVS/wolfprovider.props EXTRA_DIST+= IDE/WINVS/wolfprovider/wolfprovider.vcxproj diff --git a/IDE/WINVS/user_settings-fips.h b/IDE/WINVS/user_settings-fips.h new file mode 100644 index 00000000..1f390c42 --- /dev/null +++ b/IDE/WINVS/user_settings-fips.h @@ -0,0 +1,51 @@ +/* user_settings-fips.h + * + * Copyright (C) 2006-2026 wolfSSL Inc. + * + * This file is part of wolfProvider. + * + * wolfProvider is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * wolfProvider is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with wolfProvider. If not, see . + */ + +/* What configure supplies for a wolfSSL FIPS build on Linux. Include this at the + * end of the bundle's IDE\WIN10\user_settings.h -- wolfSSL and wolfProvider must + * compile against the same one. */ + +#ifndef WOLFPROV_USER_SETTINGS_FIPS_H +#define WOLFPROV_USER_SETTINGS_FIPS_H + +/* --enable-opensslcoexist */ +#undef OPENSSL_EXTRA +#define OPENSSL_COEXIST +#define NO_OLD_WC_NAMES +#define NO_OLD_SSL_NAMES +#define NO_OLD_SHA_NAMES +#define NO_OLD_MD5_NAME + +/* wolfProvider hardcodes the old OID values. */ +#define WOLFSSL_OLD_OID_SUM + +/* wc_DhParamsToDer, wc_DhPublicKeyDecode. */ +#define WOLFSSL_DH_EXTRA + +/* Required for RSA_PSS_SALTLEN_MAX. */ +#define WOLFSSL_PSS_LONG_SALT + +/* Adds a sign field to struct sp_int -- an ABI change. The bundle derives it + * from OPENSSL_EXTRA, which the undef above removes. */ +#define WOLFSSL_SP_INT_NEGATIVE + +#define WOLFSSL_X86_64_BUILD + +#endif /* WOLFPROV_USER_SETTINGS_FIPS_H */