mirror of
https://github.com/openssl/openssl.git
synced 2024-12-21 06:09:35 +08:00
b28b312804
This entropy source can be used instead of SEED-SRC. Sample openssl.cnf configuration is provided. It is built as a separate provider, because it is likely to require less frequent updates than fips provider. The same build likely can span multiple generations of FIPS 140 standard revisions. Note that rand-instances currently chain from public/private instances to primary, prior to consuming the seed. Thus currently a unique ESV needs to be obtained, and resue of jitterentropy.a certificate is not possible as is. Separately a patch will be sent to allow for unchaining public/private RAND instances for the purpose of reusing ESV. Also I do wonder if it makes sense to create a fips variant of stock SEED-SRC entropy source, which in addition to using getrandom() also verifies that the kernel is operating in FIPS mode and thus is likely a validated entropy source. As in on Linux, check that /proc/sys/crypto/fips_enabled is set to 1, and similar checks on Windows / MacOS and so on. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/24844)
202 lines
6.7 KiB
Perl
202 lines
6.7 KiB
Perl
# -*- Mode: perl -*-
|
|
my %targets=(
|
|
DEFAULTS => {
|
|
template => 1,
|
|
|
|
cflags => "",
|
|
cppflags => "",
|
|
lflags => "",
|
|
defines => [],
|
|
includes => [],
|
|
lib_cflags => "",
|
|
lib_cppflags => "",
|
|
lib_defines => [],
|
|
thread_scheme => "(unknown)", # Assume we don't know
|
|
thread_defines => [],
|
|
|
|
unistd => "<unistd.h>",
|
|
shared_target => "",
|
|
shared_cflag => "",
|
|
shared_defines => [],
|
|
shared_ldflag => "",
|
|
shared_rcflag => "",
|
|
|
|
#### Defaults for the benefit of the config targets who don't inherit
|
|
#### a BASE and assume Unix defaults
|
|
#### THESE WILL DISAPPEAR IN OpenSSL 1.2
|
|
build_scheme => [ "unified", "unix" ],
|
|
build_file => "Makefile",
|
|
|
|
AR => "(unused)",
|
|
ARFLAGS => "(unused)",
|
|
CC => "cc",
|
|
HASHBANGPERL => "/usr/bin/env perl",
|
|
RANLIB => sub { which("$config{cross_compile_prefix}ranlib")
|
|
? "ranlib" : "" },
|
|
RC => "windres",
|
|
|
|
#### THESE WILL BE ENABLED IN OpenSSL 1.2
|
|
#HASHBANGPERL => "PERL", # Only Unix actually cares
|
|
},
|
|
|
|
BASE_common => {
|
|
template => 1,
|
|
|
|
enable => [],
|
|
disable => [],
|
|
|
|
defines =>
|
|
sub {
|
|
my @defs = ( 'OPENSSL_BUILDING_OPENSSL' );
|
|
push @defs, "BROTLI" unless $disabled{brotli};
|
|
push @defs, "BROTLI_SHARED" unless $disabled{"brotli-dynamic"};
|
|
push @defs, "ZLIB" unless $disabled{zlib};
|
|
push @defs, "ZLIB_SHARED" unless $disabled{"zlib-dynamic"};
|
|
push @defs, "ZSTD" unless $disabled{zstd};
|
|
push @defs, "ZSTD_SHARED" unless $disabled{"zstd-dynamic"};
|
|
return [ @defs ];
|
|
},
|
|
includes =>
|
|
sub {
|
|
my @incs = ();
|
|
push @incs, $withargs{jitter_include}
|
|
if !$disabled{jitter} && $withargs{jitter_include};
|
|
push @incs, $withargs{brotli_include}
|
|
if !$disabled{brotli} && $withargs{brotli_include};
|
|
push @incs, $withargs{zlib_include}
|
|
if !$disabled{zlib} && $withargs{zlib_include};
|
|
push @incs, $withargs{zstd_include}
|
|
if !$disabled{zstd} && $withargs{zstd_include};
|
|
return [ @incs ];
|
|
},
|
|
},
|
|
|
|
BASE_unix => {
|
|
inherit_from => [ "BASE_common" ],
|
|
template => 1,
|
|
|
|
AR => "ar",
|
|
ARFLAGS => "qc",
|
|
CC => "cc",
|
|
bin_cflags =>
|
|
sub {
|
|
my @flags = ();
|
|
if (!defined($disabled{pie})) {
|
|
push(@flags, "-fPIE");
|
|
}
|
|
return join(" ", @flags);
|
|
},
|
|
bin_lflags =>
|
|
sub {
|
|
my @flags = ();
|
|
if (!defined($disabled{pie})) {
|
|
push(@flags, "-pie");
|
|
}
|
|
return join(" ", @flags);
|
|
},
|
|
lflags =>
|
|
sub {
|
|
my @libs = ();
|
|
push(@libs, "-L".$withargs{jitter_lib}) if $withargs{jitter_lib};
|
|
push(@libs, "-L".$withargs{zlib_lib}) if $withargs{zlib_lib};
|
|
push(@libs, "-L".$withargs{brotli_lib}) if $withargs{brotli_lib};
|
|
push(@libs, "-L".$withargs{zstd_lib}) if $withargs{zstd_lib};
|
|
return join(" ", @libs);
|
|
},
|
|
ex_libs =>
|
|
sub {
|
|
my @libs = ();
|
|
push(@libs, "-l:libjitterentropy.a") if !defined($disabled{jitter});
|
|
push(@libs, "-lz") if !defined($disabled{zlib}) && defined($disabled{"zlib-dynamic"});
|
|
if (!defined($disabled{brotli}) && defined($disabled{"brotli-dynamic"})) {
|
|
push(@libs, "-lbrotlienc");
|
|
push(@libs, "-lbrotlidec");
|
|
push(@libs, "-lbrotlicommon");
|
|
push(@libs, "-lm");
|
|
}
|
|
push(@libs, "-lzstd") if !defined($disabled{zstd}) && defined($disabled{"zstd-dynamic"});
|
|
return join(" ", @libs);
|
|
},
|
|
HASHBANGPERL => "/usr/bin/env perl", # Only Unix actually cares
|
|
RANLIB => sub { which("$config{cross_compile_prefix}ranlib")
|
|
? "ranlib" : "" },
|
|
RC => "windres",
|
|
|
|
build_scheme => [ "unified", "unix" ],
|
|
build_file => "Makefile",
|
|
|
|
perl_platform => 'Unix',
|
|
},
|
|
|
|
BASE_Windows => {
|
|
inherit_from => [ "BASE_common" ],
|
|
template => 1,
|
|
|
|
lib_defines =>
|
|
sub {
|
|
my @defs = ();
|
|
unless ($disabled{"zlib-dynamic"}) {
|
|
my $zlib = $withargs{zlib_lib} // "ZLIB1";
|
|
push @defs, 'LIBZ=' . (quotify("perl", $zlib))[0];
|
|
}
|
|
return [ @defs ];
|
|
},
|
|
ex_libs =>
|
|
sub {
|
|
my @libs = ();
|
|
unless ($disabled{zlib}) {
|
|
if (defined($disabled{"zlib-dynamic"})) {
|
|
push(@libs, $withargs{zlib_lib} // "ZLIB1");
|
|
}
|
|
}
|
|
unless ($disabled{zstd}) {
|
|
if (defined($disabled{"zstd-dynamic"})) {
|
|
push(@libs, $withargs{zstd_lib} // "libzstd");
|
|
}
|
|
}
|
|
unless ($disabled{brotli}) {
|
|
if (defined($disabled{"brotli-dynamic"})) {
|
|
my $path = "";
|
|
if (defined($withargs{brotli_lib})) {
|
|
$path = $withargs{brotli_lib} . "\\";
|
|
}
|
|
push(@libs, $path . "brotlicommon.lib");
|
|
push(@libs, $path . "brotlidec.lib");
|
|
push(@libs, $path . "brotlienc.lib");
|
|
}
|
|
}
|
|
return join(" ", @libs);
|
|
},
|
|
|
|
MT => "mt",
|
|
MTFLAGS => "-nologo",
|
|
mtinflag => "-manifest ",
|
|
mtoutflag => "-outputresource:",
|
|
|
|
build_file => "makefile",
|
|
build_scheme => [ "unified", "windows" ],
|
|
|
|
perl_platform => 'Windows',
|
|
},
|
|
|
|
BASE_VMS => {
|
|
inherit_from => [ "BASE_common" ],
|
|
template => 1,
|
|
|
|
includes =>
|
|
add(sub {
|
|
my @incs = ();
|
|
# GNV$ZLIB_INCLUDE is the standard logical name for later
|
|
# zlib incarnations.
|
|
push @incs, 'GNV$ZLIB_INCLUDE:'
|
|
if !$disabled{zlib} && !$withargs{zlib_include};
|
|
return [ @incs ];
|
|
}),
|
|
|
|
build_file => "descrip.mms",
|
|
build_scheme => [ "unified", "VMS" ],
|
|
|
|
perl_platform => 'VMS',
|
|
},
|
|
);
|