feedc0de/wolfssl
1
0
Fork 0
forked from wolfSSL/wolfssl
Code Pull Requests Activity

fips-check.sh: update+streamline flavors -- add linuxv5-dev (checks out fips master same as old linuxv5-ready) , drop linuxv5-RC8, linuxv5-RC9, linuxv5-RC10, and the desupported/unbuildable fips-v3-ready; update linuxv5 and linuxv5-ready to use WCv5.0-RC11; use the term "flavor" consistently for the fips key (versus "version" or "platform"); cleanup to satisfy shellcheck.

Browse Source
This commit is contained in:
Daniel Pouzzner
2021-12-22 17:30:20 -06:00
parent a6ed5dc92d
commit 951eb72ecb
1 changed files with 80 additions and 105 deletions
Download Patch File Download Diff File Expand all files Collapse all files

185
fips-check.sh
View File

@ -6,20 +6,20 @@
# may be advancing, they must work correctly with the last tested # may be advancing, they must work correctly with the last tested
# copy of our FIPS approved code. # copy of our FIPS approved code.
# #
# This should check out all the approved versions. The command line # This should check out all the approved flavors. The command line
# option selects the version. # option selects the flavor.
# #
# $ ./fips-check [version] [keep] # $ ./fips-check [flavor] [keep]
# #
# - version: linux (default), ios, android, windows, freertos, linux-ecc, netbsd-selftest, linuxv2, fips-ready, stm32l4-v2 # - flavor: linux (default), ios, android, windows, freertos, linux-ecc, netbsd-selftest, linuxv2, fips-ready, stm32l4-v2, linuxv5, linuxv5-ready, linuxv5-dev
# #
# - keep: (default off) XXX-fips-test temp dir around for inspection # - keep: (default off) XXX-fips-test temp dir around for inspection
# #
Usage() { Usage() {
cat <<usageText cat <<usageText
Usage: $0 [platform [keep]] Usage: $0 [flavor [keep]]
Platform is one of: Flavor is one of:
linux (default) linux (default)
ios ios
android android
@ -36,10 +36,9 @@ Platform is one of:
stm32l4-v2 (FIPSv2, use for STM32L4) stm32l4-v2 (FIPSv2, use for STM32L4)
wolfrand wolfrand
solaris solaris
linuxv5-RC8 (old FIPS 140-3)
linuxv5 (current FIPS 140-3) linuxv5 (current FIPS 140-3)
linuxv5-ready (ready FIPS 140-3) linuxv5-ready (ready FIPS 140-3)
linuxv5-RC10 linuxv5-dev (dev FIPS 140-3)
Keep (default off) retains the XXX-fips-test temp dir for inspection. Keep (default off) retains the XXX-fips-test temp dir for inspection.
Example: Example:
@ -47,7 +46,7 @@ Example:
usageText usageText
} }
MAKE=make MAKE='make'
LINUX_FIPS_VERSION=v3.2.6 LINUX_FIPS_VERSION=v3.2.6
LINUX_FIPS_REPO=git@github.com:wolfSSL/fips.git LINUX_FIPS_REPO=git@github.com:wolfSSL/fips.git
@ -99,14 +98,14 @@ NETOS_7_6_CRYPT_VERSION=v3.12.4
NETOS_7_6_CRYPT_REPO=git@github.com:cyassl/cyassl.git NETOS_7_6_CRYPT_REPO=git@github.com:cyassl/cyassl.git
# non-FIPS, CAVP only but pull in selftest # non-FIPS, CAVP only but pull in selftest
# will reset above variables below in platform switch # will reset above variables below in flavor switch
NETBSD_FIPS_VERSION=v3.14.2b NETBSD_FIPS_VERSION=v3.14.2b
NETBSD_FIPS_REPO=git@github.com:wolfssl/fips.git NETBSD_FIPS_REPO=git@github.com:wolfssl/fips.git
NETBSD_CRYPT_VERSION=v3.14.2 NETBSD_CRYPT_VERSION=v3.14.2
NETBSD_CRYPT_REPO=git@github.com:wolfssl/wolfssl.git NETBSD_CRYPT_REPO=git@github.com:wolfssl/wolfssl.git
# non-FIPS, CAVP only but pull in selftest # non-FIPS, CAVP only but pull in selftest
# will reset above variables below in platform switch # will reset above variables below in flavor switch
MARVELL_LINUX_FIPS_VERSION=v3.14.2b MARVELL_LINUX_FIPS_VERSION=v3.14.2b
MARVELL_LINUX_FIPS_REPO=git@github.com:wolfssl/fips.git MARVELL_LINUX_FIPS_REPO=git@github.com:wolfssl/fips.git
MARVELL_LINUX_CRYPT_VERSION=v4.1.0-stable MARVELL_LINUX_CRYPT_VERSION=v4.1.0-stable
@ -126,11 +125,11 @@ FIPS_OPTION=v1
CAVP_SELFTEST_ONLY="no" CAVP_SELFTEST_ONLY="no"
GIT="git -c advice.detachedHead=false" GIT="git -c advice.detachedHead=false"
if [ "x$1" == "x" ]; then PLATFORM="linux"; else PLATFORM=$1; fi if [ "$1" == "" ]; then FLAVOR="linux"; else FLAVOR="$1"; fi
if [ "x$2" == "xkeep" ]; then KEEP="yes"; else KEEP="no"; fi if [ "$2" == "keep" ]; then KEEP="yes"; else KEEP="no"; fi
case $PLATFORM in case "$FLAVOR" in
ios) ios)
FIPS_VERSION=$IOS_FIPS_VERSION FIPS_VERSION=$IOS_FIPS_VERSION
FIPS_REPO=$IOS_FIPS_REPO FIPS_REPO=$IOS_FIPS_REPO
@ -221,23 +220,39 @@ netos-7.6)
CRYPT_VERSION=$NETOS_7_6_CRYPT_VERSION CRYPT_VERSION=$NETOS_7_6_CRYPT_VERSION
CRYPT_REPO=$NETOS_7_6_CRYPT_REPO CRYPT_REPO=$NETOS_7_6_CRYPT_REPO
;; ;;
fips-v3-ready)
FIPS_REPO="git@github.com:wolfssl/fips.git" linuxv5)
FIPS_VERSION="v4.1.1" FIPS_REPO="git@github.com:wolfSSL/fips.git"
FIPS_VERSION="WCv5.0-RC11"
CRYPT_REPO="git@github.com:wolfSSL/wolfssl.git"
CRYPT_VERSION="WCv5.0-RC11"
CRYPT_INC_PATH="wolfssl/wolfcrypt"
CRYPT_SRC_PATH="wolfcrypt/src"
WC_MODS=( aes sha sha256 sha512 rsa hmac random cmac dh ecc sha3 kdf )
RNG_VERSION="WCv5.0-RC11"
FIPS_SRCS=( fips.c fips_test.c wolfcrypt_first.c wolfcrypt_last.c )
FIPS_INCS=( fips.h )
FIPS_OPTION="v5-RC11"
COPY_DIRECT=( wolfcrypt/src/aes_asm.S wolfcrypt/src/aes_asm.asm
wolfcrypt/src/sha256_asm.S wolfcrypt/src/sha512_asm.S )
;;
linuxv5-ready|fips-ready|fips-v5-ready)
FIPS_REPO="git@github.com:wolfSSL/fips.git"
FIPS_VERSION="WCv5.0-RC11"
CRYPT_INC_PATH=wolfssl/wolfcrypt CRYPT_INC_PATH=wolfssl/wolfcrypt
CRYPT_SRC_PATH=wolfcrypt/src CRYPT_SRC_PATH=wolfcrypt/src
FIPS_SRCS+=( wolfcrypt_first.c wolfcrypt_last.c ) FIPS_SRCS=( fips.c fips_test.c wolfcrypt_first.c wolfcrypt_last.c )
FIPS_INCS=( fips.h ) FIPS_INCS=( fips.h )
FIPS_OPTION=v3-ready FIPS_OPTION=v5-ready
;; ;;
fips-ready|fips-v5-ready|linuxv5-ready) linuxv5-dev|fips-dev)
FIPS_REPO="git@github.com:wolfSSL/fips.git" FIPS_REPO="git@github.com:wolfSSL/fips.git"
FIPS_VERSION="master" FIPS_VERSION="master"
CRYPT_INC_PATH=wolfssl/wolfcrypt CRYPT_INC_PATH=wolfssl/wolfcrypt
CRYPT_SRC_PATH=wolfcrypt/src CRYPT_SRC_PATH=wolfcrypt/src
FIPS_SRCS+=( wolfcrypt_first.c wolfcrypt_last.c ) FIPS_SRCS+=( wolfcrypt_first.c wolfcrypt_last.c )
FIPS_INCS=( fips.h ) FIPS_INCS=( fips.h )
FIPS_OPTION=v5-ready FIPS_OPTION=v5-dev
;; ;;
stm32l4-v2) stm32l4-v2)
@ -279,97 +294,59 @@ solaris)
FIPS_OPTION=v2 FIPS_OPTION=v2
MAKE=gmake MAKE=gmake
;; ;;
linuxv5-RC8)
FIPS_REPO="git@github.com:wolfSSL/fips.git"
FIPS_VERSION="WCv5.0-RC8"
CRYPT_REPO="git@github.com:wolfSSL/wolfssl.git"
CRYPT_VERSION="WCv5.0-RC8"
CRYPT_INC_PATH="wolfssl/wolfcrypt"
CRYPT_SRC_PATH="wolfcrypt/src"
WC_MODS=( aes sha sha256 sha512 rsa hmac random cmac dh ecc sha3 kdf )
RNG_VERSION="WCv5.0-RC8"
FIPS_SRCS=( fips.c fips_test.c wolfcrypt_first.c wolfcrypt_last.c )
FIPS_INCS=( fips.h )
FIPS_OPTION="v5-RC8"
COPY_DIRECT=( wolfcrypt/src/aes_asm.S wolfcrypt/src/aes_asm.asm
wolfcrypt/src/sha256_asm.S wolfcrypt/src/sha512_asm.S )
;;
linuxv5|linuxv5-RC9)
FIPS_REPO="git@github.com:wolfSSL/fips.git"
FIPS_VERSION="WCv5.0-RC9"
CRYPT_REPO="git@github.com:wolfSSL/wolfssl.git"
CRYPT_VERSION="WCv5.0-RC9"
CRYPT_INC_PATH="wolfssl/wolfcrypt"
CRYPT_SRC_PATH="wolfcrypt/src"
WC_MODS=( aes sha sha256 sha512 rsa hmac random cmac dh ecc sha3 kdf )
RNG_VERSION="WCv5.0-RC9"
FIPS_SRCS=( fips.c fips_test.c wolfcrypt_first.c wolfcrypt_last.c )
FIPS_INCS=( fips.h )
FIPS_OPTION="v5-RC9"
COPY_DIRECT=( wolfcrypt/src/aes_asm.S wolfcrypt/src/aes_asm.asm
wolfcrypt/src/sha256_asm.S wolfcrypt/src/sha512_asm.S )
;;
linuxv5-RC10)
FIPS_REPO="git@github.com:wolfSSL/fips.git"
FIPS_VERSION="WCv5.0-RC10"
CRYPT_REPO="git@github.com:wolfSSL/wolfssl.git"
CRYPT_VERSION="WCv5.0-RC10"
CRYPT_INC_PATH="wolfssl/wolfcrypt"
CRYPT_SRC_PATH="wolfcrypt/src"
WC_MODS=( aes sha sha256 sha512 rsa hmac random cmac dh ecc sha3 kdf )
RNG_VERSION="WCv5.0-RC10"
FIPS_SRCS=( fips.c fips_test.c wolfcrypt_first.c wolfcrypt_last.c )
FIPS_INCS=( fips.h )
FIPS_OPTION="v5-RC10"
COPY_DIRECT=( wolfcrypt/src/aes_asm.S wolfcrypt/src/aes_asm.asm
wolfcrypt/src/sha256_asm.S wolfcrypt/src/sha512_asm.S )
;;
*) *)
Usage Usage
exit 1 exit 1
esac esac
if ! $GIT clone . $TEST_DIR; then if ! $GIT clone . "$TEST_DIR"; then
echo "fips-check: Couldn't duplicate current working directory." echo "fips-check: Couldn't duplicate current working directory."
exit 1 exit 1
fi fi
pushd $TEST_DIR || exit 2 pushd "$TEST_DIR" || exit 2
case "$FIPS_OPTION" in case "$FIPS_OPTION" in
*dev)
echo "Don't need to copy in tagged wolfCrypt files for fips-dev."
;;
*ready)
echo "Don't need to copy in tagged wolfCrypt files for FIPS Ready."
;;
v1) v1)
# make a clone of the last FIPS release tag # make a clone of the last FIPS release tag
if ! $GIT clone --depth 1 -b $CRYPT_VERSION $CRYPT_REPO old-tree; then if ! $GIT clone --depth 1 -b "$CRYPT_VERSION" "$CRYPT_REPO" old-tree; then
echo "fips-check: Couldn't checkout the FIPS release." echo "fips-check: Couldn't checkout the FIPS release."
exit 1 exit 1
fi fi
for MOD in "${WC_MODS[@]}" for MOD in "${WC_MODS[@]}"
do do
cp "old-tree/$CRYPT_SRC_PATH/${MOD}.c" $CRYPT_SRC_PATH cp "old-tree/$CRYPT_SRC_PATH/${MOD}.c" "$CRYPT_SRC_PATH"
cp "old-tree/$CRYPT_INC_PATH/${MOD}.h" $CRYPT_INC_PATH cp "old-tree/$CRYPT_INC_PATH/${MOD}.h" "$CRYPT_INC_PATH"
done done
# We are using random.c from a separate release. # We are using random.c from a separate release.
# This is forcefully overwriting any other checkout of the cyassl sources. # This is forcefully overwriting any other checkout of the cyassl sources.
# Removing this as default behavior for SGX and netos projects. # Removing this as default behavior for SGX and netos projects.
if [ "x$CAVP_SELFTEST_ONLY" == "xno" ] && [ "x$PLATFORM" != "xsgx" ] && \ if [ "$CAVP_SELFTEST_ONLY" == "no" ] && [ "$FLAVOR" != "sgx" ] && \
[ "x$PLATFORM" != "xnetos-7.6" ]; [ "$FLAVOR" != "netos-7.6" ];
then then
pushd old-tree || exit 2 pushd old-tree || exit 2
$GIT fetch origin $RNG_VERSION || exit $? $GIT fetch origin "$RNG_VERSION" || exit $?
$GIT checkout FETCH_HEAD || exit $? $GIT checkout FETCH_HEAD || exit $?
popd || exit 2 popd || exit 2
cp "old-tree/$CRYPT_SRC_PATH/random.c" $CRYPT_SRC_PATH cp "old-tree/$CRYPT_SRC_PATH/random.c" "$CRYPT_SRC_PATH"
cp "old-tree/$CRYPT_INC_PATH/random.h" $CRYPT_INC_PATH cp "old-tree/$CRYPT_INC_PATH/random.h" "$CRYPT_INC_PATH"
fi fi
;; ;;
v2|rand|v5*)
v2|rand|v5-RC8|v5-RC9|v5-RC10) $GIT branch --no-track "my$CRYPT_VERSION" "$CRYPT_VERSION" || exit $?
$GIT branch --no-track "my$CRYPT_VERSION" $CRYPT_VERSION || exit $?
# Checkout the fips versions of the wolfCrypt files from the repo. # Checkout the fips versions of the wolfCrypt files from the repo.
for MOD in "${WC_MODS[@]}" for MOD in "${WC_MODS[@]}"
do do
@ -381,15 +358,11 @@ v2|rand|v5-RC8|v5-RC9|v5-RC10)
$GIT checkout "my$CRYPT_VERSION" -- "$MOD" || exit $? $GIT checkout "my$CRYPT_VERSION" -- "$MOD" || exit $?
done done
$GIT branch --no-track "myrng$RNG_VERSION" $RNG_VERSION || exit $? $GIT branch --no-track "myrng$RNG_VERSION" "$RNG_VERSION" || exit $?
# Checkout the fips versions of the wolfCrypt files from the repo. # Checkout the fips versions of the wolfCrypt files from the repo.
$GIT checkout "myrng$RNG_VERSION" -- "$CRYPT_SRC_PATH/random.c" "$CRYPT_INC_PATH/random.h" || exit $? $GIT checkout "myrng$RNG_VERSION" -- "$CRYPT_SRC_PATH/random.c" "$CRYPT_INC_PATH/random.h" || exit $?
;; ;;
*ready*)
echo "Don't need to copy anything in particular for FIPS Ready."
;;
*) *)
echo "fips-check: Invalid FIPS option \"${FIPS_OPTION}\"." echo "fips-check: Invalid FIPS option \"${FIPS_OPTION}\"."
exit 1 exit 1
@ -397,34 +370,36 @@ v2|rand|v5-RC8|v5-RC9|v5-RC10)
esac esac
# clone the FIPS repository # clone the FIPS repository
if [ "x$FIPS_OPTION" = "xready" ] case "$FIPS_OPTION" in
then *dev)
if ! $GIT clone --depth 1 $FIPS_REPO fips; then if ! $GIT clone --depth 1 "$FIPS_REPO" fips; then
echo "fips-check: Couldn't checkout the FIPS repository for FIPS Ready." echo "fips-check: Couldn't check out the FIPS repository for fips-dev."
exit 1 exit 1
fi fi
else ;;
if ! $GIT clone --depth 1 -b $FIPS_VERSION $FIPS_REPO fips; then *)
echo "fips-check: Couldn't checkout the FIPS repository." if ! $GIT clone --depth 1 -b "$FIPS_VERSION" "$FIPS_REPO" fips; then
exit 1 echo "fips-check: Couldn't check out ${FIPS_VERSION} from repository ${FIPS_REPO}."
fi exit 1
fi fi
;;
esac
for SRC in "${FIPS_SRCS[@]}" for SRC in "${FIPS_SRCS[@]}"
do do
cp "fips/$SRC" $CRYPT_SRC_PATH cp "fips/$SRC" "$CRYPT_SRC_PATH"
done done
for INC in "${FIPS_INCS[@]}" for INC in "${FIPS_INCS[@]}"
do do
cp "fips/$INC" $CRYPT_INC_PATH cp "fips/$INC" "$CRYPT_INC_PATH"
done done
# run the make test # run the make test
./autogen.sh ./autogen.sh
if [ "x$CAVP_SELFTEST_ONLY" == "xyes" ]; if [ "$CAVP_SELFTEST_ONLY" == "yes" ];
then then
if [ "x$CAVP_SELFTEST_OPTION" == "xv2" ] if [ "$CAVP_SELFTEST_OPTION" == "v2" ]
then then
./configure --enable-selftest=v2 ./configure --enable-selftest=v2
else else
@ -438,12 +413,12 @@ if ! $MAKE; then
exit 3 exit 3
fi fi
if [ "x$CAVP_SELFTEST_ONLY" == "xno" ]; if [ "$CAVP_SELFTEST_ONLY" == "no" ];
then then
NEWHASH=$(./wolfcrypt/test/testwolfcrypt | sed -n 's/hash = \(.*\)/\1/p') NEWHASH=$(./wolfcrypt/test/testwolfcrypt | sed -n 's/hash = \(.*\)/\1/p')
if [ -n "$NEWHASH" ]; then if [ -n "$NEWHASH" ]; then
cp $CRYPT_SRC_PATH/fips_test.c $CRYPT_SRC_PATH/fips_test.c.bak cp "${CRYPT_SRC_PATH}/fips_test.c" "${CRYPT_SRC_PATH}/fips_test.c.bak"
sed "s/^\".*\";/\"${NEWHASH}\";/" $CRYPT_SRC_PATH/fips_test.c.bak >$CRYPT_SRC_PATH/fips_test.c sed "s/^\".*\";/\"${NEWHASH}\";/" "${CRYPT_SRC_PATH}/fips_test.c.bak" >"${CRYPT_SRC_PATH}/fips_test.c"
make clean make clean
fi fi
fi fi
@ -468,7 +443,7 @@ fi
# Clean up # Clean up
popd || exit 2 popd || exit 2
if [ "x$KEEP" == "xno" ]; if [ "$KEEP" == "no" ];
then then
rm -rf $TEST_DIR rm -rf "$TEST_DIR"
fi fi