[openssl-users] Compiling OpenSSL 1.0.2l static library with FIPS -2.0.16 on Windows

[naveen gupta]

FYI, I came up with following manual solution to correctly build 1.0.2l static library with FIPS - 2.0.16 on Windows, using Visual Studio 2015. This seems towork, and I no longer need to carry run time DLLs along with the application. I feel this should be an acceptable solution. Does anyone see any problems with editing the switch from /MD to /MT in the generated Makefiles?


 
-         FIPS module:

o   Set VS environment on the Windows terminal, and change directory to  to unarchived FIPS module directory.

o   SETMFILE=nt.mak

o   SETTARGET=VC-WIN64A

o   SETASM=nasm

o   perlConfigure %TARGET% fipscheck

o   perlutil\mkfiles.pl >MINFO

o   perlutil\mk1mf.pl %ASM% %TARGET% >ms\%MFILE%

o   editnt.mak to link static runtime library libcmt.lib to the executables that itgenerates. 


 
-EX_LIBS=ws2_32.libgdi32.lib advapi32.lib crypt32.lib user32.lib

+EX_LIBS=ws2_32.libgdi32.lib advapi32.lib crypt32.lib user32.lib libcmt.lib


 
o   nmake-f ms\%MFILE% clean

o   nmake-f ms\%MFILE%

o   nmake-f ms\%MFILE% install


 
-         OpenSSL


 
o   perlConfigure       VC-WIN64A no-shared zlib no-ideano-mdc2 no-rc5 no-ssl2 no-ssl3

o   editms\nt.mak


 
-CFLAG= /MD /Ox /O2 /Ob2 -DZLIB-DOPENSSL_THREADS  -DDSO_WIN32 -W3 -Gs0 ……………….

+CFLAG= /MT /Ox /O2 /Ob2 -DZLIB-DOPENSSL_THREADS  -DDSO_WIN32 -W3 -Gs0 ……………….

o     nmake-f ms\nt.mak all


 
-          Follow additional linking step 5.3.2 describedin the document https://www.openssl.org/docs/fips/UserGuide-2.0.pdf, page #74 in the final executable.  

Thanks,Naveen

    On Monday, October 30, 2017 3:37 PM, naveen gupta via openssl-users <openssl-users at openssl.org> wrote:
 

 Hi,
I have am trying to compile OpenSSL 1.0.2l static library using FIPS - 2.0.16 on Windows 2012 R2, Visual Studio 2015,  using reference from https://www.openssl.org/docs/fips/UserGuide-2.0.pdf , page #68.
Step 1:
- cd openssl-fips-2.0.16
- ms\do_fips
Step 2:
- cd openssl-1.0.2l
- set FIPSDIR=C:\usr\local\ssl\fips-2.0
- perl Configure       VC-WIN64A fips --with-fipsdir=%FIPSDIR% no-shared zlib no-idea no-mdc2 no-rc5 no-ssl2 no-ssl3
- nmake -f ms\nt.mak all

I see that ms\do_fips compile the code with /MD, and somehow step 2 (nmake -f ms\nt.mak all) also ends up compiling with /MD switch. The application now requires the dynamic runt time libraries and compile and run time. OpenSSL static libraries builds fine with /MT switch without FIPS module, so there's something with FIPS module that ends up setting /MD switch.
Has anyone else faced this problem? As per user guide, the FIPS module should build fine with static libraries, but looks like there is some issue with it. Is there any option that can be supplied to do_fips.bat, or a different build script that needs to be run?
Appreciate any help on this.
Thanks,NG  -- 
openssl-users mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users


   
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mta.openssl.org/pipermail/openssl-users/attachments/20171114/bfe27084/attachment-0002.html>