title: Unable to build a working FIPS capable OpenSSL on HP-UX
body: <p>I am building <em>openssl-1.0.2f</em> with <em>openssl-fips-2.0.12</em> (I am going to talk about this configuration in the following lines, but at the end of the post I'll specify all the configurations that I tried), on <em>HP-UX11.31</em> (<em>pa-risc2</em> (<a href="http://community.hpe.com/t5/HP-9000/pa-risc1-1-pa-risc2-0/td-p/4098749" rel="nofollow noreferrer">[HPE]: pa-risc1.1 pa-risc2.0</a>)). Everything is good, but when I try using it (<strong>in FIPS mode</strong>), it doesn't work.</p>
  
  <p><strong>Note</strong>: Given the fact that <code>cwd</code> is set to the <strong>build</strong> folder (not the <em>installation</em> folder where <strong>RPATH</strong> points to), I need to instruct the linker where to search for libs (<code>SHLIB_PATH</code>):</p>
  
  <blockquote>
  <pre><code>[%__OPENSSL_MACHINE_PROMPT%]&gt; OPENSSL_FIPS=1 SHLIB_PATH=./lib ./bin/openssl version -a
  2063867464:error:2D06B071:FIPS routines:FIPS_check_incore_fingerprint:fingerprint does not match segment aliasing:fips.c:224:
  </code></pre>
  </blockquote>
  
  <p><strong>Note</strong>: Instead of displaying any path, I'm replacing it by a meaningful placeholder (name starting with <em>__OPENSSL</em>) surrounded by <code>%</code> signs (the equivalent of <em>Win</em> env vars - don't want to create confusion if any actual <em>Ux</em> env vars might be involved).</p>
  
  <p>Here's the output of the "same" command without setting FIPS (<code>OPENSSL_FIPS=1</code>) mode:</p>
  
  <blockquote>
  <pre><code>[%__OPENSSL_MACHINE_PROMPT%]&gt; SHLIB_PATH=./lib ./bin/openssl version -a
  OpenSSL 1.0.2f-fips  28 Jan 2016
    built on: Fri Feb 26 09:53:34 2016
    platform: hpux-parisc2-gcc
    options:  bn(64,64) rc4(ptr,char) des(ptr,risc1,16,long) blowfish(idx)
    compiler: gcc -I. -I.. -I../include  -fPIC -DOPENSSL_PIC -DOPENSSL_THREADS  -DDSO_DL -fPIC -D_REENTRANT -march=2.0 -O3 -DB_ENDIAN -D_REENTRANT -I%__OPENSSL_BUILD_PATH%/include
    OPENSSLDIR: "%__OPENSSL_PREFIX_DIR%"
  </code></pre>
  </blockquote>
  
  <p>This occurs on all the machines I've tried running it (including the very machine I've built it on):</p>
  
  <blockquote>
  <pre><code>[%__OPENSSL_BUILD_MACHINE_PROMPT%]&gt; uname -a
  HP-UX hpux1131 B.11.31 U 9000/800 629887774 unlimited-user license
  </code></pre>
  </blockquote>
  
  <p><em>gcc</em> version (native linker (<em>ld_pa</em>) used):</p>
  
  <blockquote>
  <pre><code>[%__OPENSSL_BUILD_MACHINE_PROMPT%]&gt; gcc -v
    Using built-in specs.
    Target: hppa2.0w-hp-hpux11.31
    Configured with: ../gcc-4.2.4/configure --disable-shared --with-gnu-as --with-as=%__GCC_PREFIX_PATH%/bin/as --with-ld=/bin/ld --disable-nls --enable-threads=posix --prefix=%__GCC_PREFIX_PATH% --with-local-prefix=%__GCC_PREFIX_PATH%
    Thread model: posix
    gcc version 4.2.4`
  </code></pre>
  </blockquote>
  
  <ul>
  <li><p>Here's the <em>openssl-fips-2.1.12</em> configurator's output:</p>
  
  <blockquote>
  <pre><code>./config no-asm
  Operating system: 9000/800-hp-hpux1x
    Auto Configuring fipsonly
    Auto Configuring fipsonly
    Configuring for hpux-parisc2-gcc
    Auto Configuring fipsonly
    Configuring for hpux-parisc2-gcc
        no-asm          [option]   OPENSSL_NO_ASM
        no-bf           [option]   OPENSSL_NO_BF (skip dir)
        no-camellia     [option]   OPENSSL_NO_CAMELLIA (skip dir)
        no-cast         [option]   OPENSSL_NO_CAST (skip dir)
        no-ec_nistp_64_gcc_128 [default]  OPENSSL_NO_EC_NISTP_64_GCC_128 (skip dir)
        no-gmp          [default]  OPENSSL_NO_GMP (skip dir)
        no-idea         [option]   OPENSSL_NO_IDEA (skip dir)
        no-jpake        [experimental] OPENSSL_NO_JPAKE (skip dir)
        no-krb5         [krb5-flavor not specified] OPENSSL_NO_KRB5
        no-md2          [option]   OPENSSL_NO_MD2 (skip dir)
        no-md5          [option]   OPENSSL_NO_MD5 (skip dir)
        no-mdc2         [option]   OPENSSL_NO_MDC2 (skip dir)
        no-rc2          [option]   OPENSSL_NO_RC2 (skip dir)
        no-rc4          [option]   OPENSSL_NO_RC4 (skip dir)
        no-rc5          [option]   OPENSSL_NO_RC5 (skip dir)
        no-rfc3779      [default]  OPENSSL_NO_RFC3779 (skip dir)
        no-ripemd       [option]   OPENSSL_NO_RIPEMD (skip dir)
        no-seed         [option]   OPENSSL_NO_SEED (skip dir)
        no-srp          [forced]   OPENSSL_NO_SRP (skip dir)
        no-ssl2         [forced]   OPENSSL_NO_SSL2 (skip dir)
        no-ssl3         [forced]   OPENSSL_NO_SSL3 (skip dir)
        no-store        [experimental] OPENSSL_NO_STORE (skip dir)
        no-tls1         [forced]   OPENSSL_NO_TLS1 (skip dir)
        no-tlsext       [forced]   OPENSSL_NO_TLSEXT (skip dir)
        no-zlib         [default]
        no-zlib-dynamic [default]
  </code></pre>
  </blockquote></li>
  <li><p>And here's <em>openssl-1.0.2f</em>'s:</p>
  
  <blockquote>
  <pre><code>./config fips shared --prefix=%__OPENSSL_PREFIX_DIR% no-rc5 no-mdc2 no-idea -fPIC no-asm --openssldir=%__OPENSSL_PREFIX_DIR%/openssl
  Operating system: 9000/800-hp-hpux1x
    Configuring for hpux-parisc2-gcc
    Configuring for hpux-parisc2-gcc
        no-asm          [option]   OPENSSL_NO_ASM
        no-ec_nistp_64_gcc_128 [default]  OPENSSL_NO_EC_NISTP_64_GCC_128 (skip dir)
        no-gmp          [default]  OPENSSL_NO_GMP (skip dir)
        no-idea         [option]   OPENSSL_NO_IDEA (skip dir)
        no-jpake        [experimental] OPENSSL_NO_JPAKE (skip dir)
        no-krb5         [krb5-flavor not specified] OPENSSL_NO_KRB5
        no-libunbound   [experimental] OPENSSL_NO_LIBUNBOUND (skip dir)
        no-md2          [default]  OPENSSL_NO_MD2 (skip dir)
        no-mdc2         [option]   OPENSSL_NO_MDC2 (skip dir)
        no-rc5          [option]   OPENSSL_NO_RC5 (skip dir)
        no-rfc3779      [default]  OPENSSL_NO_RFC3779 (skip dir)
        no-rsax         [forced]   OPENSSL_NO_RSAX (skip dir)
        no-sctp         [default]  OPENSSL_NO_SCTP (skip dir)
        no-ssl-trace    [default]  OPENSSL_NO_SSL_TRACE (skip dir)
        no-store        [experimental] OPENSSL_NO_STORE (skip dir)
        no-unit-test    [default]  OPENSSL_NO_UNIT_TEST (skip dir)
        no-zlib         [default]
        no-zlib-dynamic [default]
  </code></pre>
  </blockquote></li>
  </ul>
  
  <p><strong>Important note</strong>:
  I've stated the problem that I have using <em>openssl-1.0.2f</em> + <em>openssl-fips-2.0.12</em> on <em>HP-UX11.31</em> om <em>PA-RISC2</em>. What else I've tried:</p>
  
  <ul>
  <li><em>openssl-1.0.1</em><strong>X</strong> (where <strong>X</strong> = <em>[e..p]</em>) + <em>openssl-fips-2.0.5</em></li>
  <li><em>HP-UX11.31</em> or <em>HP-UX11.11</em> on <em>PA-RISC2</em></li>
  <li><strong>no-asm</strong> <em>configure</em> flag specified/unspecified</li>
  </ul>
  
  <p><strong>Note</strong>: During debug, I've also modified <em>fips_premain.c</em> (and others), and (<em>shocking</em> :) ), the fingerprint produced by <em>fips_premain_dso</em> (compiled with <code>-DFINGERPRINT_PREMAIN_DSO_LOAD</code>) and the one computed at runtime don't match! I've also dumped the memory zone (in original or hex format) that the fingerprint is being computed on, and (of course) it differs (but so for I can't tell why).</p>
  
  <p>Given the fact that it works (or it is supposed to work) - even if not being tested on <em>pa-risc</em>, but only on <em>IA64</em> -, and extensive <em>Google</em> search didn't reveal anything truly relevant, I am 99.99 sure that it is related to the machine(s) in my environment.</p>
  
  <p>However, can anyone give me some pointers?</p>
  
  <p><strong><em>@EDIT0</em></strong>: I mentioned that I reproduced the same problem on <em>IA64</em>; it was most likely a mistake. I recently (got a machine and) built it on <em>HP-UX11.23 IA64</em> and it worked fine. The only problem is that cross architecture compatibility (build/run) is one way only: <em>PA-RISC</em> -> <em>IA64</em>.</p>