Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[tests] enable FIPS mode for Windows MSBuild tests #3728

Closed
wants to merge 2 commits into from
Closed

[tests] enable FIPS mode for Windows MSBuild tests #3728

wants to merge 2 commits into from

Conversation

jonathanpeppers
Copy link
Member

Fixes: #1580

If this works out, this would run our MSBuild test suite while the
Use FIPS compliant algorithms group policy setting is enabled.

This would validate that Xamarin.Android works as expected going
forward.

@jonathanpeppers jonathanpeppers force-pushed the validate-fips branch 2 times, most recently from aff6f4e to 65eade2 Compare October 3, 2019 02:47
@jonathanpeppers
Copy link
Member Author

jonathanpeppers commented Oct 3, 2019 •
edited
Loading

Failures we'll have to deal with to merge this:

  1. Xamarin.Build.Download:
Xamarin.Build.Download.targets(135,3): error MSB4018: The "XamarinBuildAndroidAarProguardConfigs" task failed unexpectedly.
System.InvalidOperationException: This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms.
   at System.Security.Cryptography.MD5CryptoServiceProvider..ctor()
  1. mkbundle
[mkbundle] C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\MSBuild\Xamarin\Android\mkbundle.exe --dos2unix=false --nomain --i18n none --bundled-header --mono-api-struct-path "C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\MSBuild\Xamarin\Android\\mkbundle-api.h" --style linux -c -o obj\Release\bundles\x86_64\temp.c -oo obj\Release\bundles\x86_64\assemblies.o -z obj\Release\android\assets\UnnamedProject.dll obj\Release\android\assets\shrunk\Java.Interop.dll obj\Release\android\assets\shrunk\Mono.Android.dll obj\Release\android\assets\shrunk\mscorlib.dll obj\Release\android\assets\shrunk\System.Core.dll obj\Release\android\assets\shrunk\System.dll obj\Release\android\assets\shrunk\System.Runtime.Serialization.dll (TaskId:215)
  [mkbundle stderr]  (TaskId:215)
  [mkbundle stderr] Unhandled Exception: System.InvalidOperationException: This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms. (TaskId:215)
  [mkbundle stderr]    at System.Security.Cryptography.SHA1Managed..ctor() (TaskId:215)
  [mkbundle stderr]    at IKVM.Reflection.AssemblyName.ComputePublicKeyToken(Byte[] publicKey) (TaskId:215)
  [mkbundle stderr]    at IKVM.Reflection.AssemblyName.get_FullName() (TaskId:215)
  [mkbundle stderr]    at IKVM.Reflection.Universe.LoadAssembly(RawModule module) (TaskId:215)
  [mkbundle stderr]    at IKVM.Reflection.Universe.LoadFile(String path) (TaskId:215)
  [mkbundle stderr]    at MakeBundle.LoadAssemblyFile(String assembly) (TaskId:215)
  [mkbundle stderr]    at MakeBundle.LoadAssemblies(List`1 sources) (TaskId:215)
  [mkbundle stderr]    at MakeBundle.Main(String[] args) (TaskId:215)
  [mkbundle stderr]  (TaskId:215)
  [mkbundle stdout]  (TaskId:215)
C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\MSBuild\Xamarin\Android\Xamarin.Android.Common.targets(2869,3): error XA5102: Conversion from assembly to native code failed. Exit code 255 [E:\A\_work\237\s\bin\TestRelease\temp\BuildAotApplicationAndBundle AndÜmläüts_x86_64_True_True\UnnamedProject.csproj]

Not sure what to do about this: https://github.com/mono/ikvm-fork/blob/f9c1e2fec05127bb840488482b6aff1a0a942f3c/reflect/AssemblyName.cs#L405

jonathanpeppers added a commit to jonathanpeppers/ikvm-fork that referenced this pull request Oct 3, 2019
@jonathanpeppers
[reflect] use SHA1CryptoServiceProvider to support FIPS
e2b1c9b 
Context: dotnet/android#3728 (comment)

On Windows 10 machines with the [Use FIPS compliant algorithms][0] group
policy enabled, `mkbundle` fails with:

    C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\MSBuild\Xamarin\Android\mkbundle.exe --dos2unix=false --nomain --i18n none --bundled-header --mono-api-struct-path "C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\MSBuild\Xamarin\Android\\mkbundle-api.h" --style linux -c -o obj\Release\bundles\x86_64\temp.c -oo obj\Release\bundles\x86_64\assemblies.o -z obj\Release\android\assets\UnnamedProject.dll obj\Release\android\assets\shrunk\Java.Interop.dll obj\Release\android\assets\shrunk\Mono.Android.dll obj\Release\android\assets\shrunk\mscorlib.dll obj\Release\android\assets\shrunk\System.Core.dll obj\Release\android\assets\shrunk\System.dll obj\Release\android\assets\shrunk\System.Runtime.Serialization.dll (TaskId:215)
    Unhandled Exception: System.InvalidOperationException: This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms. (TaskId:215)
       at System.Security.Cryptography.SHA1Managed..ctor() (TaskId:215)
       at IKVM.Reflection.AssemblyName.ComputePublicKeyToken(Byte[] publicKey) (TaskId:215)
       at IKVM.Reflection.AssemblyName.get_FullName() (TaskId:215)
       at IKVM.Reflection.Universe.LoadAssembly(RawModule module) (TaskId:215)
       at IKVM.Reflection.Universe.LoadFile(String path) (TaskId:215)
       at MakeBundle.LoadAssemblyFile(String assembly) (TaskId:215)
       at MakeBundle.LoadAssemblies(List`1 sources) (TaskId:215)
       at MakeBundle.Main(String[] args) (TaskId:215)

On a FIPS-enabled machine, these code examples:

    var sha1 = new SHA1Managed ()
    var sha1 = SHA1.Create ()

Will throw:

    System.InvalidOperationException:
        This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms.

But this one works:

    var sha1 = new SHA1CryptoServiceProvider ()

Since the `PublicKeyToken` of a .NET assembly is a SHA1 value, there
is not really another option--we have to make this change for
`mkbundle.exe` to work.

[0]: https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing
@jonathanpeppers jonathanpeppers mentioned this pull request Oct 3, 2019
Merged
@pjcollins
Copy link
Member

👍 nice, looks like this is working as expected!

jonathanpeppers added a commit to jonathanpeppers/ikvm-fork that referenced this pull request Oct 3, 2019
@jonathanpeppers
[reflect] use SHA1.Create() to support FIPS
f840a5e 
Context: dotnet/android#3728 (comment)

On Windows 10 machines with the [Use FIPS compliant algorithms][0] group
policy enabled, `mkbundle` fails with:

    C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\MSBuild\Xamarin\Android\mkbundle.exe --dos2unix=false --nomain --i18n none --bundled-header --mono-api-struct-path "C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\MSBuild\Xamarin\Android\\mkbundle-api.h" --style linux -c -o obj\Release\bundles\x86_64\temp.c -oo obj\Release\bundles\x86_64\assemblies.o -z obj\Release\android\assets\UnnamedProject.dll obj\Release\android\assets\shrunk\Java.Interop.dll obj\Release\android\assets\shrunk\Mono.Android.dll obj\Release\android\assets\shrunk\mscorlib.dll obj\Release\android\assets\shrunk\System.Core.dll obj\Release\android\assets\shrunk\System.dll obj\Release\android\assets\shrunk\System.Runtime.Serialization.dll (TaskId:215)
    Unhandled Exception: System.InvalidOperationException: This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms. (TaskId:215)
       at System.Security.Cryptography.SHA1Managed..ctor() (TaskId:215)
       at IKVM.Reflection.AssemblyName.ComputePublicKeyToken(Byte[] publicKey) (TaskId:215)
       at IKVM.Reflection.AssemblyName.get_FullName() (TaskId:215)
       at IKVM.Reflection.Universe.LoadAssembly(RawModule module) (TaskId:215)
       at IKVM.Reflection.Universe.LoadFile(String path) (TaskId:215)
       at MakeBundle.LoadAssemblyFile(String assembly) (TaskId:215)
       at MakeBundle.LoadAssemblies(List`1 sources) (TaskId:215)
       at MakeBundle.Main(String[] args) (TaskId:215)

On a FIPS-enabled machine, these code examples:

    var sha1 = new SHA1Managed();

Will throw:

    System.InvalidOperationException:
        This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms.

But these three options work:

    var sha1 = SHA1.Create();
    var sha1 = new SHA1CryptoServiceProvider();
    var sha1 = new SHA1Cng();

We should use `SHA1.Create()` which will use the appropriate
implementation if FIPS is enabled or not.

Since the `PublicKeyToken` of a .NET assembly is a SHA1 value, there
is not really another option--we have to make this change for
`mkbundle.exe` to work.

[0]: https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing
akoeplinger pushed a commit to mono/ikvm-fork that referenced this pull request Oct 3, 2019
@jonathanpeppers @akoeplinger
[reflect] use SHA1.Create() to support FIPS (#13)
e994668 
Context: dotnet/android#3728 (comment)

On Windows 10 machines with the [Use FIPS compliant algorithms][0] group
policy enabled, `mkbundle` fails with:

    C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\MSBuild\Xamarin\Android\mkbundle.exe --dos2unix=false --nomain --i18n none --bundled-header --mono-api-struct-path "C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\MSBuild\Xamarin\Android\\mkbundle-api.h" --style linux -c -o obj\Release\bundles\x86_64\temp.c -oo obj\Release\bundles\x86_64\assemblies.o -z obj\Release\android\assets\UnnamedProject.dll obj\Release\android\assets\shrunk\Java.Interop.dll obj\Release\android\assets\shrunk\Mono.Android.dll obj\Release\android\assets\shrunk\mscorlib.dll obj\Release\android\assets\shrunk\System.Core.dll obj\Release\android\assets\shrunk\System.dll obj\Release\android\assets\shrunk\System.Runtime.Serialization.dll (TaskId:215)
    Unhandled Exception: System.InvalidOperationException: This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms. (TaskId:215)
       at System.Security.Cryptography.SHA1Managed..ctor() (TaskId:215)
       at IKVM.Reflection.AssemblyName.ComputePublicKeyToken(Byte[] publicKey) (TaskId:215)
       at IKVM.Reflection.AssemblyName.get_FullName() (TaskId:215)
       at IKVM.Reflection.Universe.LoadAssembly(RawModule module) (TaskId:215)
       at IKVM.Reflection.Universe.LoadFile(String path) (TaskId:215)
       at MakeBundle.LoadAssemblyFile(String assembly) (TaskId:215)
       at MakeBundle.LoadAssemblies(List`1 sources) (TaskId:215)
       at MakeBundle.Main(String[] args) (TaskId:215)

On a FIPS-enabled machine, these code examples:

    var sha1 = new SHA1Managed();

Will throw:

    System.InvalidOperationException:
        This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms.

But these three options work:

    var sha1 = SHA1.Create();
    var sha1 = new SHA1CryptoServiceProvider();
    var sha1 = new SHA1Cng();

We should use `SHA1.Create()` which will use the appropriate
implementation if FIPS is enabled or not.

Since the `PublicKeyToken` of a .NET assembly is a SHA1 value, there
is not really another option--we have to make this change for
`mkbundle.exe` to work.

[0]: https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing
@jonathanpeppers jonathanpeppers mentioned this pull request Oct 15, 2019
Merged
@jonathanpeppers
Copy link
Member Author

/azp run

@azure-pipelines
Copy link

Pull request contains merge conflicts.

@jonathanpeppers
[tests] enable FIPS mode for Windows MSBuild tests
6a6b326 
Fixes: dotnet#1580

If this works out, this would run our MSBuild test suite while the
[Use FIPS compliant algorithms][0] group policy setting is enabled.

This would validate that Xamarin.Android works as expected going
forward.

[0]: https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing
@jonathanpeppers
Bump Mono
2d48fec 
This commit eventually replaced by: dotnet#3770
@jonpryor
Copy link
Member

The mkbundle-related FIPS failure is fixed in:

@jonathanpeppers
Copy link
Member Author

This hasn't come up again, as we removed all MD5 and SHA1. Closing for now.

@kealist
Copy link

kealist commented Nov 2, 2020

I believe this is resolved on my side (from being a reporter), as our CI can build Xamarin now without the FIPS error

@github-actions github-actions bot locked and limited conversation to collaborators Jan 24, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers

@pjcollins pjcollins Awaiting requested review from pjcollins

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
4 participants
@jonathanpeppers @pjcollins @jonpryor @kealist