Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Backport: Fix AppleClang 15 FIPS Shared Build (#1224) #1400

Merged
merged 2 commits into from
Jan 13, 2024
Merged

Backport: Fix AppleClang 15 FIPS Shared Build (#1224) #1400

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5c0e956
Fix AppleClang 15 FIPS Shared Build (#1224)
skmcgrail Oct 9, 2023
824e1a2
Slight build fix and migrate to GHA for MacOS ARM CI (#1245)
samuel40791765 Oct 17, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 5 additions & 3 deletions crypto/fipsmodule/CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -417,17 +417,19 @@ elseif(FIPS_SHARED)
# generate the output object file where all the code in the __text section
# and all the read-only data in the __const section are between the
# respective start and end markers.
if (CMAKE_OSX_DEPLOYMENT_TARGET)
set(OSX_VERSION_MIN_FLAG "-mmacosx-version-min=${CMAKE_OSX_DEPLOYMENT_TARGET}")
endif()
add_custom_command(
OUTPUT fips_apple_start.o
COMMAND ${CMAKE_C_COMPILER} -arch ${CMAKE_SYSTEM_PROCESSOR} -isysroot ${CMAKE_OSX_SYSROOT} -c ${CMAKE_CURRENT_SOURCE_DIR}/fips_shared_library_marker.c -DAWSLC_FIPS_SHARED_START -o fips_apple_start.o
COMMAND ${CMAKE_C_COMPILER} -arch ${CMAKE_SYSTEM_PROCESSOR} -isysroot ${CMAKE_OSX_SYSROOT} ${OSX_VERSION_MIN_FLAG} -c ${CMAKE_CURRENT_SOURCE_DIR}/fips_shared_library_marker.c -DAWSLC_FIPS_SHARED_START -o fips_apple_start.o
DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/fips_shared_library_marker.c
)
add_custom_command(
OUTPUT fips_apple_end.o
COMMAND ${CMAKE_C_COMPILER} -arch ${CMAKE_SYSTEM_PROCESSOR} -isysroot ${CMAKE_OSX_SYSROOT} -c ${CMAKE_CURRENT_SOURCE_DIR}/fips_shared_library_marker.c -DAWSLC_FIPS_SHARED_END -o fips_apple_end.o
COMMAND ${CMAKE_C_COMPILER} -arch ${CMAKE_SYSTEM_PROCESSOR} -isysroot ${CMAKE_OSX_SYSROOT} ${OSX_VERSION_MIN_FLAG} -c ${CMAKE_CURRENT_SOURCE_DIR}/fips_shared_library_marker.c -DAWSLC_FIPS_SHARED_END -o fips_apple_end.o
DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/fips_shared_library_marker.c
)

add_custom_command(
OUTPUT bcm.o
COMMAND ${CMAKE_LINKER} -r fips_apple_start.o -force_load $<TARGET_FILE:bcm_library> fips_apple_end.o -keep_private_externs -o bcm.o
Expand Down
17 changes: 13 additions & 4 deletions util/fipstools/inject_hash/inject_hash.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -168,7 +168,6 @@ func doLinux(objectBytes []byte, isStatic bool) ([]byte, []byte, error) {
return moduleText, moduleROData, nil
}


func doAppleOS(objectBytes []byte) ([]byte, []byte, error) {

object, err := macho.NewFile(bytes.NewReader(objectBytes))
Expand Down Expand Up @@ -221,6 +220,19 @@ func doAppleOS(objectBytes []byte) ([]byte, []byte, error) {
return nil, nil, fmt.Errorf("symbol %q at %x, which is below base of %x\n", symbol.Name, symbol.Value, base)
}

// Skip debugging symbols
//
// #define N_STAB 0xe0 /* if any of these bits set, a symbolic debugging entry */
//
// "Only symbolic debugging entries have some of the N_STAB bits set and if any of these bits are set then it is
// a symbolic debugging entry (a stab). In which case then the values of the n_type field (the entire field)
// are given in <mach-o/stab.h>"
//
// https://github.com/apple-oss-distributions/xnu/blob/main/EXTERNAL_HEADERS/mach-o/nlist.h
if symbol.Type&0xe0 != 0 {
continue
}

value := symbol.Value - base
switch symbol.Name {
case "_BORINGSSL_bcm_text_start":
Expand Down Expand Up @@ -296,8 +308,6 @@ func doAppleOS(objectBytes []byte) ([]byte, []byte, error) {
return moduleText, moduleROData, nil
}



func do(outPath, oInput string, arInput string, appleOS bool) error {
var objectBytes []byte
var isStatic bool
Expand Down Expand Up @@ -365,7 +375,6 @@ func do(outPath, oInput string, arInput string, appleOS bool) error {
return err
}


var zeroKey [64]byte
mac := hmac.New(sha256.New, zeroKey[:])

Expand Down
Loading