1

我正在尝试为 FIPS 强制模式构建boringssl,但构建失败。到目前为止,我在 cmake 命令中启用了两个标志“FIPS”和“FIPS_DELOCATE”,然后是 ninja build。

我正在使用奥利奥 8.1。代码库,我已经为此苦苦挣扎了一段时间。这是我遵循的步骤。

external/boringssl/src$ cmake -DANDROID_ABI=arm64-v8a -DCMAKE_TOOLCHAIN_FILE=${ANDROID_NDK}/build/cmake/android.toolchain.cmake -DANDROID_NATIVE_API_LEVEL=27  -DFIPS=1 -DFIPS_DELOCATE=1
// This command executes successfully, and all config files are generated 

external/boringssl/src$ ninja 

// This command giving below error

siyachin@pcz-siyachin:/u/siyachin/Project_O3/external/boringssl/src$ ninja
[244/388] Building C object crypto/fipsmodule/CMakeFiles/bcm_c_generated_asm.dir/bcm.c.o
clang: warning: argument unused during compilation: '-Wa,--noexecstack' [-Wunused-command-line-argument]
[252/388] Generating bcm-delocated.S
FAILED: cd /u/siyachin/Project_O3/external/boringssl/src && go run util/fipstools/delocate.go util/fipstools/delocate.peg.go util/fipstools/ar.go util/fipstools/const.go -a /u/siyachin/Project_O3/external/boringssl/src/crypto/fipsmodule/libbcm_c_generated_asm.a -o /u/siyachin/Project_O3/external/boringssl/src/crypto/fipsmodule/bcm-delocated.S /u/siyachin/Project_O3/external/boringssl/src/crypto/fipsmodule/aesv8-armx.S /u/siyachin/Project_O3/external/boringssl/src/crypto/fipsmodule/armv8-mont.S /u/siyachin/Project_O3/external/boringssl/src/crypto/fipsmodule/ghashv8-armx.S /u/siyachin/Project_O3/external/boringssl/src/crypto/fipsmodule/sha1-armv8.S /u/siyachin/Project_O3/external/boringssl/src/crypto/fipsmodule/sha256-armv8.S /u/siyachin/Project_O3/external/boringssl/src/crypto/fipsmodule/sha512-armv8.S
error while parsing "/u/siyachin/Project_O3/external/boringssl/src/crypto/fipsmodule/libbcm_c_generated_asm.a":
parse error near WS (line 57 symbol 29 - line 57 symbol 34):
"     "

exit status 1
ninja: build stopped: subcommand failed.

我认为,util/fipstools/delocate.go 的构建失败。我尝试放置一些调试日志,但在尝试从 delocate.go 解析 libbcm_c_generated_asm.a 时失败。

另外,有什么办法,我可以从 Android.bp 运行 go 文件吗?因为 FIPS 松弛模式正在使用我的 Android.bp 正确构建?

4

1 回答 1

1

我遇到了同样的问题。我试图在 fips 模式下为 x86 编译boringssl(x86_64 有效)。我能够通过修改“delocate.peg”,重新生成“delocate.peg.go”(使用https://github.com/pointlander/peg)来解决“解析”问题,但最终卡住了。如果您查看文件https://boringssl.googlesource.com/boringssl/+/refs/tags/fips-20180730/util/fipstools/delocate.go中的第 141 行,您将看到 FIPS 模式仅支持x86_64 和 ppc64le,目前不支持 ARM 或 x86。

请参阅https://csrc.nist.gov/csrc/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp2964.pdf上支持的架构

于 2019-04-10T16:22:37.787 回答