pbirk wrote:
I'm getting the following error after following the steps in the FIPS users guide to compile on Windows at this link: http://openssl.org/docs/fips/UserGuide-1.1.1.pdf. I'm using FIPS 1.1.2 with OpenSSL 0.9.7m. I do ms\do_ms (tried with ms\do_nasm as well), then nmake -f ms\ntdll.mak. The contents of out32dll are as follows after the failure. If I do the compile again, it can successfully build ssleay32.dll, but libeay32.dll is corrupted when trying to add in the manifest. Any ideas why this failed?Directory of C:\downloads\OpenSSL\openssl-0.9.7m\out32dll 10/09/2008 11:28 AM <DIR> . 10/09/2008 11:28 AM <DIR> .. 10/09/2008 11:27 AM 651,264 fips_premain_dso.exe 10/09/2008 11:27 AM 380 fips_premain_dso.exe.manifest 10/09/2008 11:27 AM 29,696 fips_standalone_sha1.exe 10/09/2008 11:27 AM 380 fips_standalone_sha1.exe.manifest 10/09/2008 11:28 AM 2,097,152 libeay32.dll 10/09/2008 11:28 AM 380 libeay32.dll.manifest 10/09/2008 11:28 AM 343,847 libeay32.exp 10/09/2008 11:28 AM 566,392 libeay32.lib cl /Fotmp32dll\fips_premain_dso.obj -DFINGERPRINT_PREMAIN_DSO_LOAD -Iinc 32 -Itmp32dll /MD /W3 /WX /Ox /O2 /Ob2 /Gs0 /GF /Gy /nologo -DOPENSSL_SYSNAME_WI N32 -DWIN32_LEAN_AND_MEAN -DL_ENDIAN -DDSO_WIN32 -D_CRT_SECURE_NO_DEPRECATE -D_C RT_NONSTDC_NO_DEPRECATE /Fdout32dll -DOPENSSL_NO_KRB5 -DOPENSSL_FIPS -D_WINDLL -c .\fips-1.0\fips_premain.c fips_premain.c link /nologo /subsystem:console /machine:I386 /opt:ref /out:out32dll\fip s_premain_dso.exe @C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nm50D.tmp SET FIPS_LINK=link SET FIPS_CC=cl SET FIPS_CC_ARGS=/Fotmp32dll\fips_premain.obj -Iinc32 -Itmp32dll /MD /W3 /WX /Ox /O2 /Ob2 /Gs0 /GF /Gy /nologo -DOPENSSL_SYSNAME_WIN32 -DWIN32_LEAN_AND_ MEAN -DL_ENDIAN -DDSO_WIN32 -D_CRT_SECURE_NO_DEPRECATE -D_CRT_NONSTDC_NO_DEPRECA TE /Fdout32dll -DOPENSSL_NO_KRB5 -DOPENSSL_FIPS -D_WINDLL -c SET PREMAIN_DSO_EXE=out32dll\fips_premain_dso.exe SET FIPS_SHA1_EXE=out32dll\fips_standalone_sha1.exe SET FIPS_TARGET=out32dll\libeay32.dll SET FIPSLIB_D=c:\downloads\openssl_fips/ perl util\fipslink.pl /nologo /subsystem:console /machine:I386 /opt:ref /dll /base:0xFB00000 /out:out32dll\libeay32.dll /def:ms/LIBEAY32.def @C:\DOCUME ~1\ADMINI~1\LOCALS~1\Temp\nm50F.tmp Integrity check OK cl /Fotmp32dll\fips_premain.obj -Iinc32 -Itmp32dll /MD /W3 /WX /Ox /O2 /Ob2 /Gs0 /GF /Gy /nologo -DOPENSSL_SYSNAME_WIN32 -DWIN32_LEAN_AND_MEAN -DL_ENDIAN -DDSO_ WIN32 -D_CRT_SECURE_NO_DEPRECATE -D_CRT_NONSTDC_NO_DEPRECATE /Fdout32dll -DOPENS SL_NO_KRB5 -DOPENSSL_FIPS -D_WINDLL -c c:\downloads\openssl_fips//fips_premain. c fips_premain.c link /nologo /subsystem:console /machine:I386 /opt:ref /dll /base:0xFB00000 /out :out32dll\libeay32.dll /def:ms/LIBEAY32.def @C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ nm50F.tmp ms/LIBEAY32.def(7) : warning LNK4017: DESCRIPTION statement not supported for th e target platform; ignored Creating library out32dll\libeay32.lib and object out32dll\libeay32.exp LINK : fatal error LNK1000: Internal error during IMAGE::BuildImage Version 8.00.50727.42 ExceptionCode = C0000005 ExceptionFlags = 00000000 ExceptionAddress = 0046563C (00400000) "c:\PROGRA~1\MID05A~1\VC\bin\li nk.exe" NumberParameters = 00000002 ExceptionInformation[ 0] = 00000001 ExceptionInformation[ 1] = 00000008 CONTEXT: Eax = 00000008 Esp = 0012EEA8 Ebx = 00000000 Ebp = 0111B008 Ecx = 00000000 Esi = 015B002C Edx = 000EC028 Edi = 015AFFF0 Eip = 0046563C EFlags = 00010202 SegCs = 0000001B SegDs = 00000023 SegSs = 00000023 SegEs = 00000023 SegFs = 0000003B SegGs = 00000000 Dr0 = 00000000 Dr3 = 00000000 Dr1 = 00000000 Dr6 = 00000000 Dr2 = 00000000 Dr7 = 00000000 First stage Link failure at util\fipslink.pl line 42. NMAKE : fatal error U1077: 'C:\Perl\bin\perl.EXE' : return code '0x9' Stop.
Search this list's archives. The discussion is also indexed by Google. The versions of MinGW and MSYS are apparently VERY specific. The fact the instructions work at all is a miracle. The instructions require mixing two completely different compiler suites, which is not just a bad idea, it is a horrifically terrible idea.
A VERY recent discussion thread happened last week entitled "FIPS fail" is worth reading. I managed to get past the linking stage only to discover the output DLL was completely hosed. I'm waiting on FIPS 1.2.0, which could take a while but definitely worth the wait as it will only require ONE compiler suite.
-- Thomas Hruska Shining Light Productions Home of BMP2AVI, Nuclear Vision, ProtoNova, and Win32 OpenSSL. http://www.slproweb.com/ ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List openssl-users@openssl.org Automated List Manager [EMAIL PROTECTED]
