mirror of
https://github.com/jmcorgan/fips.git
synced 2026-10-05 19:18:25 +00:00
Johnathan Corgan
ce19d5bd23
On Windows the config directory, the key directory and the peer ACL defaults disagreed. SYSTEM_CONFIG_DIR and the ACL defaults resolved to /etc/fips on the current drive, the search path never probed the directory the service installer writes to, and fipsctl keygen wrote to the per-user %APPDATA%\fips. A service started before a reboot found none of the installed files and ran on defaults, and a peers.deny placed beside the hosts file in C:\ProgramData\fips was never read, so the ACL failed open. Windows now uses C:\ProgramData\fips for all of them, the directory the hosts file and the service installer already use, and the search path probes it before the per-user config. A key left in %APPDATA%\fips is still picked up when the new directory has none, by the daemon and by fipsctl address, with a note to move it. The daemon warns when it ran on a config found only in %APPDATA%\fips, which the service never reads. fipsctl keygen points at a key left in %APPDATA%\fips, and --install-service names the file the service reads. A peers.allow or peers.deny left at the old /etc/fips location would otherwise be dropped on upgrade, and a dropped deny list fails open. For one release the daemon keeps reading each file from /etc/fips, resolved against the current drive exactly as before, when it is not at the new location, and warns naming both paths and asking for it to be moved. When both exist the new file is read and the warning says the old one is ignored. The choice is made per file and re-checked on every ACL reload, so moving, adding or removing a file takes effect without a restart, including a copy that keeps the old file's modification time. The fallback is meant to be removed in a later release. Linux, macOS and FreeBSD paths are unchanged. The Windows ZIP's README told users to put fips.yaml beside fips.exe or in %APPDATA%\fips, neither of which the service reads, and the reference docs gave %APPDATA%\fips as fipsctl keygen's default. The README now says the service reads C:\ProgramData\fips\fips.yaml and keeps the key, hosts and peer ACL files beside it, and describes the per-user files a foreground run also reads. The reference docs list C:\ProgramData\fips as the Windows system config directory and keygen default.
132 lines
3.7 KiB
PowerShell
132 lines
3.7 KiB
PowerShell
# Build a Windows ZIP package for FIPS.
|
|
#
|
|
# Usage: powershell -File packaging/windows/build-zip.ps1 [-Version <version>] [-NoBuild]
|
|
# Output: deploy/fips-<version>-windows-x86_64.zip
|
|
#
|
|
# Prerequisites: Rust toolchain installed
|
|
|
|
param(
|
|
[string]$Version = "",
|
|
[switch]$NoBuild
|
|
)
|
|
|
|
$ErrorActionPreference = "Stop"
|
|
|
|
$ScriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
|
|
$PackagingDir = Split-Path -Parent $ScriptDir
|
|
$ProjectRoot = Split-Path -Parent $PackagingDir
|
|
|
|
# Derive version from Cargo.toml if not provided
|
|
if (-not $Version) {
|
|
$cargoToml = Get-Content "$ProjectRoot\Cargo.toml" -Raw
|
|
if ($cargoToml -match 'version\s*=\s*"([^"]+)"') {
|
|
$Version = $Matches[1]
|
|
} else {
|
|
Write-Error "Could not determine version from Cargo.toml"
|
|
exit 1
|
|
}
|
|
}
|
|
|
|
$Arch = "x86_64"
|
|
$PkgName = "fips-$Version-windows-$Arch"
|
|
$DeployDir = "$ProjectRoot\deploy"
|
|
$StagingDir = "$env:TEMP\fips-staging-$([guid]::NewGuid().ToString('N'))"
|
|
$BinaryDir = "$ProjectRoot\target\release"
|
|
|
|
Write-Host "Building FIPS v$Version for Windows $Arch..."
|
|
|
|
# Build release binaries
|
|
if (-not $NoBuild) {
|
|
Push-Location $ProjectRoot
|
|
cargo build --release
|
|
if ($LASTEXITCODE -ne 0) {
|
|
Write-Error "cargo build failed"
|
|
exit 1
|
|
}
|
|
Pop-Location
|
|
}
|
|
|
|
# Verify binaries exist
|
|
$Binaries = @("fips.exe", "fipsctl.exe", "fipstop.exe")
|
|
foreach ($bin in $Binaries) {
|
|
if (-not (Test-Path "$BinaryDir\$bin")) {
|
|
Write-Error "Missing binary: $BinaryDir\$bin"
|
|
exit 1
|
|
}
|
|
}
|
|
|
|
# Create staging directory
|
|
New-Item -ItemType Directory -Force -Path $StagingDir | Out-Null
|
|
|
|
# Copy binaries
|
|
foreach ($bin in $Binaries) {
|
|
Copy-Item "$BinaryDir\$bin" "$StagingDir\$bin"
|
|
}
|
|
|
|
# Copy config
|
|
Copy-Item "$PackagingDir\common\fips.yaml" "$StagingDir\fips.yaml"
|
|
Copy-Item "$PackagingDir\common\hosts" "$StagingDir\hosts"
|
|
|
|
# Copy helper scripts
|
|
Copy-Item "$ScriptDir\install-service.ps1" "$StagingDir\install-service.ps1"
|
|
Copy-Item "$ScriptDir\uninstall-service.ps1" "$StagingDir\uninstall-service.ps1"
|
|
|
|
# Create README
|
|
@"
|
|
FIPS v$Version for Windows
|
|
==========================
|
|
|
|
Quick Start (foreground mode):
|
|
.\fips.exe -c fips.yaml
|
|
|
|
Windows Service:
|
|
# Install (requires Administrator)
|
|
powershell -File install-service.ps1
|
|
|
|
# Manage
|
|
sc start fips
|
|
sc stop fips
|
|
|
|
# Uninstall
|
|
powershell -File uninstall-service.ps1
|
|
|
|
TUN Support:
|
|
Download wintun.dll from https://www.wintun.net/ and place it
|
|
in the same directory as fips.exe. Running the daemon requires
|
|
Administrator privileges for TUN creation.
|
|
|
|
Control Socket:
|
|
The control socket uses TCP on localhost:21210.
|
|
fipsctl and fipstop connect to this port automatically.
|
|
|
|
Configuration:
|
|
The service reads C:\ProgramData\fips\fips.yaml, where
|
|
install-service.ps1 puts it, and keeps fips.key, hosts,
|
|
peers.allow and peers.deny beside it. Edit fips.yaml there
|
|
before starting the service.
|
|
|
|
A foreground run takes -c <file>, or reads
|
|
C:\ProgramData\fips\fips.yaml and then, as per-user overrides
|
|
the service does not read, %APPDATA%\fips\fips.yaml,
|
|
%USERPROFILE%\.fips.yaml and .\fips.yaml. The key file sits
|
|
beside the last config loaded.
|
|
|
|
fipsctl keygen writes to C:\ProgramData\fips by default and
|
|
needs an elevated prompt.
|
|
"@ | Out-File -FilePath "$StagingDir\README.txt" -Encoding UTF8
|
|
|
|
# Create ZIP
|
|
New-Item -ItemType Directory -Force -Path $DeployDir | Out-Null
|
|
$ZipPath = "$DeployDir\$PkgName.zip"
|
|
if (Test-Path $ZipPath) { Remove-Item $ZipPath }
|
|
Compress-Archive -Path "$StagingDir\*" -DestinationPath $ZipPath
|
|
|
|
# Cleanup
|
|
Remove-Item -Recurse -Force $StagingDir
|
|
|
|
Write-Host ""
|
|
Write-Host "Package built: deploy\$PkgName.zip"
|
|
Write-Host " Size: $([math]::Round((Get-Item $ZipPath).Length / 1MB, 2)) MB"
|
|
Write-Host ""
|
|
Write-Host "Extract and run: .\fips.exe -c fips.yaml"
|