Skip to content

GitLab

  • Menu
Projects Groups Snippets
    • Loading...
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Sign in / Register
  • BIND BIND
  • Project information
    • Project information
    • Activity
    • Labels
    • Planning hierarchy
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
  • Issues 532
    • Issues 532
    • List
    • Boards
    • Service Desk
    • Milestones
  • Merge requests 99
    • Merge requests 99
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
  • Deployments
    • Deployments
    • Environments
    • Releases
  • Monitor
    • Monitor
    • Incidents
  • Packages & Registries
    • Packages & Registries
    • Container Registry
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Repository
  • Wiki
    • Wiki
  • Snippets
    • Snippets
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • ISC Open Source Projects
  • BINDBIND
  • Issues
  • #946

Closed
Open
Created Mar 19, 2019 by Ghost User@ghost

--enable-fips-mode option breaks build of hmacmd5.c and md5.c

Summary

When specifying the "--enable-fips-mode=yes" option with./configure command, the build fails on lib/isc/hmacmd5.c and lib/isc/md5.c.

Building on CentOS7.

BIND version used

9.12.4

Steps to reproduce

-unpack 9.12.4 tarball -run "./configure --enable-fips-mode=yes" -run "make" command

What is the current bug behavior?

./make command produces the following output (the build breaks similarly when the build process reaches lib/isc/md5.c): ... gcc -std=gnu99 -I/tmp/bind-test/bind-9.12.4 -I../.. -I./unix/include -I./pthreads/include -I./x86_32/include -I./include -I./include -I/tmp/bind-test/bind-9.12.4/lib/dns/include -I../../lib/dns/include -D_REENTRANT -DOPENSSL -DPK11_LIB_LOCATION="undefined" -D_GNU_SOURCE -g -O2 -I/usr/include/libxml2 -fPIC -W -Wall -Wmissing-prototypes -Wcast-qual -Wwrite-strings -Wformat -Wpointer-arith -fno-strict-aliasing -fno-delete-null-pointer-checks -c hmacmd5.c hmacmd5.c:409:1: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘attribute’ at end of input EMPTY_TRANSLATION_UNIT ^ make[2]: *** [hmacmd5.o] Error 1 make[2]: Leaving directory /tmp/bind-test/bind-9.12.4/lib/isc' make[1]: *** [subdirs] Error 1 make[1]: Leaving directory /tmp/bind-test/bind-9.12.4/lib' make: *** [subdirs] Error 1

What is the expected correct behavior?

The build completes successfully.

Relevant configuration files

When the "--enable-fips-mode=yes" option is specified, the following value is set in config.h: /* Disable MD5 functions (for FIPSmode) */ #define PK11_MD5_DISABLE 1

Thus, the PK11_MD5_DISABLE C preprocessor value has been defined. The following C preprocessor logic is found in both hmacmd5.c and md5.c:

#include "config.h" #include <pk11/site.h>

#ifndef PK11_MD5_DISABLE

#include <isc/util.h>

//body of code here #else /* !PK11_MD5_DISABLE / EMPTY_TRANSLATION_UNIT #endif / PK11_MD5_DISABLE */

The problem (I think), is that the "EMPTY_TRANSLATION_UNIT" macro is defined in the lib/isc/util.h file. So, when PK11_MD5_DISABLE is defined, isc/util.h is never included and thus EMPTY_TRANSLATION_UNIT is never set. This causes the pre-processor failure as seen in the compile snippet.

Relevant logs and/or screenshots

(Paste any relevant logs - please use code blocks (```) to format console output, logs, and code, as it's very hard to read otherwise.)

Possible fixes

If you move the "#include <isc/util.h>" directive such that it preceeds the "#ifndef PK11_MD5_DISABLE" directive, then the build completes successfully. For example:

#include "config.h" #include <pk11/site.h>

#include <isc/util.h>

#ifndef PK11_MD5_DISABLE ...

Assignee
Assign to
Time tracking