Skip to content

Commit f3af454

Browse files
ejohnstownejohnstown
committed
FIPS Check Update
1. Whitespace changes. 2. Deleted the stm32l4 build. The fips-check-2.0.sh script handles it. 3. Removed the CAVP_SELFTEST_* variables, used the FIPS_OPTIONS for it. 4. Removed the v1 style code checkout. The current method works for all available cases. 5. Removed the FIPS_CONFLICTS case rename case.
1 parent aa69b2f commit f3af454

1 file changed

Lines changed: 49 additions & 123 deletions

File tree

‎fips-check.sh‎

Lines changed: 49 additions & 123 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,6 @@ Flavor is one of:
1919
netbsd-selftest
2020
marvell-linux-selftest
2121
linuxv2 (FIPSv2, use for Win10)
22-
stm32l4-v2 (FIPSv2, use for STM32L4)
2322
wolfrand
2423
solaris
2524
linuxv5 (current FIPS 140-3)
@@ -44,113 +43,77 @@ while [ "x$1" != 'x' ]; do
4443
shift
4544
done
4645

46+
FIPS_REPO='git@github.com:wolfssl/fips.git'
47+
CRYPT_INC_PATH='wolfssl/wolfcrypt'
48+
CRYPT_SRC_PATH='wolfcrypt/src'
49+
4750
case "$FLAVOR" in
48-
linuxv2 | fipsv2-OE-ready)
51+
linuxv2|fipsv2-OE-ready)
52+
FIPS_OPTION='v2'
4953
FIPS_VERSION='WCv4-stable'
50-
FIPS_REPO='git@github.com:wolfssl/fips.git'
5154
CRYPT_VERSION='WCv4-stable'
52-
CRYPT_INC_PATH='wolfssl/wolfcrypt'
53-
CRYPT_SRC_PATH='wolfcrypt/src'
54-
WC_MODS=('aes' 'aes_asm' 'cmac' 'des3' 'dh' 'ecc' 'hmac' 'random' 'rsa' 'sha' 'sha256' 'sha3' 'sha512')
5555
RNG_VERSION='WCv4-rng-stable'
56+
WC_MODS=('aes' 'aes_asm' 'cmac' 'des3' 'dh' 'ecc' 'hmac' 'random' 'rsa' 'sha' 'sha256' 'sha3' 'sha512')
5657
FIPS_SRCS=('fips.c' 'fips_test.c' 'wolfcrypt_first.c' 'wolfcrypt_last.c')
5758
FIPS_INCS=('fips.h')
58-
FIPS_OPTION='v2'
5959
;;
6060
netbsd-selftest)
6161
# non-FIPS, CAVP only but pull in selftest
62+
FIPS_OPTION='cavp-selftest'
6263
FIPS_VERSION='v3.14.2b'
63-
FIPS_REPO='git@github.com:wolfssl/fips.git'
6464
CRYPT_VERSION='v3.14.2'
65-
CRYPT_REPO='git@github.com:wolfssl/wolfssl.git'
66-
FIPS_SRCS=('selftest.c')
65+
RNG_VERSION='v3.14.2'
6766
WC_MODS=('aes' 'dh' 'dsa' 'ecc' 'hmac' 'random' 'rsa' 'sha' 'sha256' 'sha512')
68-
CRYPT_INC_PATH='wolfssl/wolfcrypt'
69-
CRYPT_SRC_PATH='wolfcrypt/src'
70-
CAVP_SELFTEST_ONLY='yes'
71-
FIPS_OPTION='v1'
67+
FIPS_SRCS=('selftest.c')
7268
;;
7369
marvell-linux-selftest)
7470
# non-FIPS, CAVP only but pull in selftest
71+
FIPS_OPTION='cavp-selftest-v2'
7572
FIPS_VERSION='v3.14.2b'
76-
FIPS_REPO='git@github.com:wolfssl/fips.git'
7773
CRYPT_VERSION='v4.1.0-stable'
78-
CRYPT_REPO='git@github.com:wolfssl/wolfssl.git'
79-
FIPS_SRCS=('selftest.c')
80-
CRYPT_INC_PATH='wolfssl/wolfcrypt'
81-
CRYPT_SRC_PATH='wolfcrypt/src'
74+
RNG_VERSION='v4.1.0-stable'
8275
WC_MODS=('aes' 'dh' 'dsa' 'ecc' 'hmac' 'random' 'rsa' 'sha' 'sha256' 'sha512')
83-
CAVP_SELFTEST_ONLY='yes'
84-
CAVP_SELFTEST_OPTION='v2'
85-
FIPS_OPTION='v1'
76+
FIPS_SRCS=('selftest.c')
8677
;;
8778
linuxv5)
88-
FIPS_REPO='git@github.com:wolfSSL/fips.git'
79+
FIPS_OPTION='v5'
8980
FIPS_VERSION='WCv5.0-RC12'
90-
CRYPT_REPO='git@github.com:wolfSSL/wolfssl.git'
9181
CRYPT_VERSION='WCv5.0-RC12'
92-
CRYPT_INC_PATH='wolfssl/wolfcrypt'
93-
CRYPT_SRC_PATH='wolfcrypt/src'
94-
WC_MODS=('aes' 'aes_asm' 'cmac' 'dh' 'ecc' 'hmac' 'kdf' 'random' 'rsa' 'sha' 'sha256' 'sha256_asm' 'sha3' 'sha512' 'sha512_asm')
9582
RNG_VERSION='WCv5.0-RC12'
83+
WC_MODS=('aes' 'aes_asm' 'cmac' 'dh' 'ecc' 'hmac' 'kdf' 'random' 'rsa' 'sha' 'sha256' 'sha256_asm' 'sha3' 'sha512' 'sha512_asm')
9684
FIPS_SRCS=('fips.c' 'fips_test.c' 'wolfcrypt_first.c' 'wolfcrypt_last.c')
9785
FIPS_INCS=('fips.h')
98-
FIPS_OPTION='v5'
9986
COPY_DIRECT=('wolfcrypt/src/aes_gcm_asm.S')
10087
;;
10188
fips-ready)
102-
FIPS_REPO='git@github.com:wolfSSL/fips.git'
89+
FIPS_OPTION='ready'
10390
FIPS_VERSION='master'
104-
CRYPT_INC_PATH='wolfssl/wolfcrypt'
105-
CRYPT_SRC_PATH='wolfcrypt/src'
10691
FIPS_SRCS=('fips.c' 'fips_test.c' 'wolfcrypt_first.c' 'wolfcrypt_last.c')
10792
FIPS_INCS=('fips.h')
108-
FIPS_OPTION='ready'
10993
;;
11094
fips-dev)
111-
FIPS_REPO='git@github.com:wolfSSL/fips.git'
112-
FIPS_VERSION='master'
113-
CRYPT_INC_PATH='wolfssl/wolfcrypt'
114-
CRYPT_SRC_PATH='wolfcrypt/src'
115-
FIPS_SRCS=('fips.c' 'fips_test.c' 'wolfcrypt_first.c' 'wolfcrypt_last.c')
116-
FIPS_INCS=('fips.h')
11795
FIPS_OPTION='dev'
118-
;;
119-
stm32l4-v2)
120-
FIPS_VERSION='WCv4.0.1-stable'
121-
FIPS_REPO='git@github.com:wolfSSL/fips.git'
122-
CRYPT_VERSION='WCv4.0.1-stable'
123-
CRYPT_INC_PATH='wolfssl/wolfcrypt'
124-
CRYPT_SRC_PATH='wolfcrypt/src'
125-
WC_MODS=('aes' 'cmac' 'des3' 'dh' 'ecc' 'hmac' 'rsa' 'sha' 'sha256' 'sha512')
96+
FIPS_VERSION='master'
12697
FIPS_SRCS=('fips.c' 'fips_test.c' 'wolfcrypt_first.c' 'wolfcrypt_last.c')
12798
FIPS_INCS=('fips.h')
128-
FIPS_OPTION='v2'
12999
;;
130100
wolfrand)
131-
FIPS_REPO='git@github.com:wolfssl/fips.git'
101+
FIPS_OPTION='rand'
132102
FIPS_VERSION='WRv4-stable'
133-
CRYPT_REPO='git@github.com:wolfssl/wolfssl.git'
134103
CRYPT_VERSION='WCv4-stable'
135-
CRYPT_INC_PATH='wolfssl/wolfcrypt'
136-
CRYPT_SRC_PATH='wolfcrypt/src'
137-
WC_MODS=('hmac' 'random' 'sha256')
138104
RNG_VERSION='WCv4-rng-stable'
105+
WC_MODS=('hmac' 'random' 'sha256')
139106
FIPS_SRCS=('fips.c' 'fips_test.c' 'wolfcrypt_first.c' 'wolfcrypt_last.c')
140107
FIPS_INCS=('fips.h')
141-
FIPS_OPTION='rand'
142108
;;
143109
solaris)
110+
FIPS_OPTION='v2'
144111
FIPS_VERSION='WCv4-stable'
145-
FIPS_REPO='git@github.com:wolfssl/fips.git'
146112
CRYPT_VERSION='WCv4-stable'
147-
CRYPT_INC_PATH='wolfssl/wolfcrypt'
148-
CRYPT_SRC_PATH='wolfcrypt/src'
149-
WC_MODS=('aes' 'aes_asm' 'cmac' 'des3' 'dh' 'ecc' 'hmac' 'random' 'rsa' 'sha' 'sha256' 'sha3' 'sha512')
150113
RNG_VERSION='WCv4-rng-stable'
114+
WC_MODS=('aes' 'aes_asm' 'cmac' 'des3' 'dh' 'ecc' 'hmac' 'random' 'rsa' 'sha' 'sha256' 'sha3' 'sha512')
151115
FIPS_SRCS=('fips.c' 'fips_test.c' 'wolfcrypt_first.c' 'wolfcrypt_last.c')
152116
FIPS_INCS=('fips.h')
153-
FIPS_OPTION='v2'
154117
MAKE='gmake'
155118
;;
156119
*)
@@ -174,35 +137,8 @@ case "$FIPS_OPTION" in
174137
*ready)
175138
echo "Don't need to copy in tagged wolfCrypt files for FIPS Ready."
176139
;;
177-
v1)
178-
# make a clone of the last FIPS release tag
179-
if ! $GIT clone --depth 1 -b "$CRYPT_VERSION" "$CRYPT_REPO" old-tree; then
180-
echo "fips-check: Couldn't checkout the FIPS release."
181-
exit 1
182-
fi
183-
184-
for MOD in "${WC_MODS[@]}"
185-
do
186-
cp "old-tree/$CRYPT_SRC_PATH/${MOD}.c" "$CRYPT_SRC_PATH"
187-
cp "old-tree/$CRYPT_INC_PATH/${MOD}.h" "$CRYPT_INC_PATH"
188-
done
189-
190-
# We are using random.c from a separate release.
191-
# This is forcefully overwriting any other checkout of the cyassl sources.
192-
# Removing this as default behavior for SGX and netos projects.
193-
if [ "x$CAVP_SELFTEST_ONLY" != "xyes" ] && [ "$FLAVOR" != 'sgx' ] && \
194-
[ "$FLAVOR" != "netos-7.6" ];
195-
then
196-
pushd old-tree || exit 2
197-
$GIT fetch origin "$RNG_VERSION" || exit $?
198-
$GIT checkout FETCH_HEAD || exit $?
199-
popd || exit 2
200-
cp "old-tree/$CRYPT_SRC_PATH/random.c" "$CRYPT_SRC_PATH"
201-
cp "old-tree/$CRYPT_INC_PATH/random.h" "$CRYPT_INC_PATH"
202-
fi
203-
;;
204140

205-
v2|rand|v5*)
141+
cavp-selftest*|v2|rand|v5*)
206142
$GIT branch --no-track "my$CRYPT_VERSION" "$CRYPT_VERSION" || exit $?
207143
# Checkout the fips versions of the wolfCrypt files from the repo.
208144
for MOD in "${WC_MODS[@]}"
@@ -243,18 +179,18 @@ esac
243179

244180
# clone the FIPS repository
245181
case "$FIPS_OPTION" in
246-
*dev)
247-
if ! $GIT clone --depth 1 "$FIPS_REPO" fips; then
248-
echo "fips-check: Couldn't check out the FIPS repository for fips-dev."
249-
exit 1
250-
fi
251-
;;
252-
*)
253-
if ! $GIT clone --depth 1 -b "$FIPS_VERSION" "$FIPS_REPO" fips; then
254-
echo "fips-check: Couldn't check out ${FIPS_VERSION} from repository ${FIPS_REPO}."
255-
exit 1
256-
fi
257-
;;
182+
*dev)
183+
if ! $GIT clone --depth 1 "$FIPS_REPO" fips; then
184+
echo "fips-check: Couldn't check out the FIPS repository for fips-dev."
185+
exit 1
186+
fi
187+
;;
188+
*)
189+
if ! $GIT clone --depth 1 -b "$FIPS_VERSION" "$FIPS_REPO" fips; then
190+
echo "fips-check: Couldn't check out ${FIPS_VERSION} from repository ${FIPS_REPO}."
191+
exit 1
192+
fi
193+
;;
258194
esac
259195

260196
for SRC in "${FIPS_SRCS[@]}"
@@ -282,24 +218,26 @@ fi
282218

283219
# run the make test
284220
./autogen.sh
285-
if [ "x$CAVP_SELFTEST_ONLY" = 'xyes' ];
286-
then
287-
if [ "x$CAVP_SELFTEST_OPTION" = "xv2" ]
288-
then
289-
./configure --enable-selftest=v2
290-
else
221+
222+
case "$FIPS_OPTION" in
223+
cavp-selftest)
291224
./configure --enable-selftest
292-
fi
293-
else
225+
;;
226+
cavp-selftest-v2)
227+
./configure --enable-selftest=v2
228+
;;
229+
*)
294230
./configure --enable-fips=$FIPS_OPTION
295-
fi
231+
;;
232+
esac
296233

297-
if ! $MAKE; then
234+
if ! $MAKE
235+
then
298236
echo "fips-check: Make failed. Debris left for analysis."
299237
exit 3
300238
fi
301239

302-
if [ "x$CAVP_SELFTEST_ONLY" != 'xyes' ];
240+
if [ -s "${CRYPT_SRC_PATH}/fips_test.c" ]
303241
then
304242
NEWHASH=$(./wolfcrypt/test/testwolfcrypt | sed -n 's/hash = \(.*\)/\1/p')
305243
if [ -n "$NEWHASH" ]; then
@@ -309,24 +247,12 @@ then
309247
fi
310248
fi
311249

312-
if ! $MAKE test; then
250+
if ! $MAKE check
251+
then
313252
echo "fips-check: Test failed. Debris left for analysis."
314253
exit 3
315254
fi
316255

317-
if [ ${#FIPS_CONFLICTS[@]} -ne 0 ];
318-
then
319-
echo "Due to the way this package is compiled by the customer duplicate"
320-
echo "source file names are an issue, renaming:"
321-
for FNAME in "${FIPS_CONFLICTS[@]}"
322-
do
323-
echo "wolfcrypt/src/$FNAME.c to wolfcrypt/src/wc_$FNAME.c"
324-
mv "./wolfcrypt/src/$FNAME.c" "./wolfcrypt/src/wc_$FNAME.c"
325-
done
326-
echo "Confirming files were renamed..."
327-
ls -la ./wolfcrypt/src/wc_*.c
328-
fi
329-
330256
# Clean up
331257
popd || exit 2
332258
if [ "$KEEP" = "no" ];

0 commit comments

Comments
 (0)