fips-check.sh 14 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464
  1. #!/bin/bash
  2. # fips-check.sh
  3. # This script checks the current revision of the code against the
  4. # previous release of the FIPS code. While wolfSSL and wolfCrypt
  5. # may be advancing, they must work correctly with the last tested
  6. # copy of our FIPS approved code.
  7. #
  8. # This should check out all the approved flavors. The command line
  9. # option selects the flavor.
  10. #
  11. # $ ./fips-check [flavor] [keep]
  12. #
  13. # - flavor: linux (default), ios, android, windows, freertos, linux-ecc, netbsd-selftest, linuxv2, fipsv2-OE-ready, fips-ready, stm32l4-v2, linuxv5, linuxv5-ready, linuxv5-dev
  14. #
  15. # - keep: (default off) XXX-fips-test temp dir around for inspection
  16. #
  17. Usage() {
  18. cat <<usageText
  19. Usage: $0 [flavor [keep]]
  20. Flavor is one of:
  21. linux (default)
  22. ios
  23. android
  24. windows
  25. freertos
  26. openrtos-3.9.2
  27. linux-ecc
  28. netbsd-selftest
  29. marvell-linux-selftest
  30. sgx
  31. netos-7.6
  32. linuxv2 (FIPSv2, use for Win10)
  33. fips-ready
  34. stm32l4-v2 (FIPSv2, use for STM32L4)
  35. wolfrand
  36. solaris
  37. linuxv5 (current FIPS 140-3)
  38. linuxv5-ready (ready FIPS 140-3)
  39. linuxv5-dev (dev FIPS 140-3)
  40. Keep (default off) retains the XXX-fips-test temp dir for inspection.
  41. Example:
  42. $0 windows keep
  43. usageText
  44. }
  45. MAKE='make'
  46. LINUX_FIPS_VERSION=v3.2.6
  47. LINUX_FIPS_REPO=git@github.com:wolfSSL/fips.git
  48. LINUX_CRYPT_VERSION=v3.2.6
  49. LINUX_CRYPT_REPO=git@github.com:cyassl/cyassl.git
  50. LINUX_ECC_FIPS_VERSION=v3.10.3
  51. LINUX_ECC_FIPS_REPO=git@github.com:wolfSSL/fips.git
  52. LINUX_ECC_CRYPT_VERSION=v3.2.6
  53. LINUX_ECC_CRYPT_REPO=git@github.com:cyassl/cyassl.git
  54. IOS_FIPS_VERSION=v3.4.8a
  55. IOS_FIPS_REPO=git@github.com:wolfSSL/fips.git
  56. IOS_CRYPT_VERSION=v3.4.8.fips
  57. IOS_CRYPT_REPO=git@github.com:cyassl/cyassl.git
  58. ANDROID_FIPS_VERSION=v3.5.0
  59. ANDROID_FIPS_REPO=git@github.com:wolfSSL/fips.git
  60. ANDROID_CRYPT_VERSION=v3.5.0
  61. ANDROID_CRYPT_REPO=git@github.com:cyassl/cyassl.git
  62. WINDOWS_FIPS_VERSION=v3.6.6
  63. WINDOWS_FIPS_REPO=git@github.com:wolfSSL/fips.git
  64. WINDOWS_CRYPT_VERSION=v3.6.6
  65. WINDOWS_CRYPT_REPO=git@github.com:cyassl/cyassl.git
  66. FREERTOS_FIPS_VERSION=v3.6.1-FreeRTOS
  67. FREERTOS_FIPS_REPO=git@github.com:wolfSSL/fips.git
  68. FREERTOS_CRYPT_VERSION=v3.6.1
  69. FREERTOS_CRYPT_REPO=git@github.com:cyassl/cyassl.git
  70. OPENRTOS_3_9_2_FIPS_VERSION=v3.9.2-OpenRTOS
  71. OPENRTOS_3_9_2_FIPS_REPO=git@github.com:wolfSSL/fips.git
  72. OPENRTOS_3_9_2_CRYPT_VERSION=v3.6.1
  73. OPENRTOS_3_9_2_CRYPT_REPO=git@github.com:cyassl/cyassl.git
  74. #NOTE: Does not include the SGX examples yet, update version once fipsv2 is
  75. # finished and merge conflicts can be resolved. This will be tagged as
  76. # v3.12.4.sgx-examples
  77. #SGX_FIPS_VERSION=v3.12.4.sgx-examples
  78. SGX_FIPS_VERSION=v3.6.6
  79. SGX_FIPS_REPO=git@github.com:wolfSSL/fips.git
  80. SGX_CRYPT_VERSION=v3.12.4
  81. SGX_CRYPT_REPO=git@github.com:cyassl/cyassl.git
  82. NETOS_7_6_FIPS_VERSION=v3.12.6
  83. NETOS_7_6_FIPS_REPO=git@github.com:wolfSSL/fips.git
  84. NETOS_7_6_CRYPT_VERSION=v3.12.4
  85. NETOS_7_6_CRYPT_REPO=git@github.com:cyassl/cyassl.git
  86. # non-FIPS, CAVP only but pull in selftest
  87. # will reset above variables below in flavor switch
  88. NETBSD_FIPS_VERSION=v3.14.2b
  89. NETBSD_FIPS_REPO=git@github.com:wolfssl/fips.git
  90. NETBSD_CRYPT_VERSION=v3.14.2
  91. NETBSD_CRYPT_REPO=git@github.com:wolfssl/wolfssl.git
  92. # non-FIPS, CAVP only but pull in selftest
  93. # will reset above variables below in flavor switch
  94. MARVELL_LINUX_FIPS_VERSION=v3.14.2b
  95. MARVELL_LINUX_FIPS_REPO=git@github.com:wolfssl/fips.git
  96. MARVELL_LINUX_CRYPT_VERSION=v4.1.0-stable
  97. MARVELL_LINUX_CRYPT_REPO=git@github.com:wolfssl/wolfssl.git
  98. STM32L4_V2_FIPS_VERSION=WCv4.0.1-stable
  99. STM32L4_V2_FIPS_REPO=git@github.com:wolfSSL/fips.git
  100. STM32L4_V2_CRYPT_VERSION=WCv4.0.1-stable
  101. FIPS_SRCS=( fips.c fips_test.c )
  102. WC_MODS=( aes des3 sha sha256 sha512 rsa hmac random )
  103. TEST_DIR=XXX-fips-test
  104. CRYPT_INC_PATH=cyassl/ctaocrypt
  105. CRYPT_SRC_PATH=ctaocrypt/src
  106. RNG_VERSION=v3.6.0
  107. FIPS_OPTION=v1
  108. CAVP_SELFTEST_ONLY="no"
  109. GIT="git -c advice.detachedHead=false"
  110. if [ "$1" == "" ]; then FLAVOR="linux"; else FLAVOR="$1"; fi
  111. if [ "$2" == "keep" ]; then KEEP="yes"; else KEEP="no"; fi
  112. case "$FLAVOR" in
  113. ios)
  114. FIPS_VERSION=$IOS_FIPS_VERSION
  115. FIPS_REPO=$IOS_FIPS_REPO
  116. CRYPT_VERSION=$IOS_CRYPT_VERSION
  117. CRYPT_REPO=$IOS_CRYPT_REPO
  118. ;;
  119. android)
  120. FIPS_VERSION=$ANDROID_FIPS_VERSION
  121. FIPS_REPO=$ANDROID_FIPS_REPO
  122. CRYPT_VERSION=$ANDROID_CRYPT_VERSION
  123. CRYPT_REPO=$ANDROID_CRYPT_REPO
  124. ;;
  125. windows)
  126. FIPS_VERSION=$WINDOWS_FIPS_VERSION
  127. FIPS_REPO=$WINDOWS_FIPS_REPO
  128. CRYPT_VERSION=$WINDOWS_CRYPT_VERSION
  129. CRYPT_REPO=$WINDOWS_CRYPT_REPO
  130. ;;
  131. freertos)
  132. FIPS_VERSION=$FREERTOS_FIPS_VERSION
  133. FIPS_REPO=$FREERTOS_FIPS_REPO
  134. CRYPT_VERSION=$FREERTOS_CRYPT_VERSION
  135. CRYPT_REPO=$FREERTOS_CRYPT_REPO
  136. ;;
  137. openrtos-3.9.2)
  138. FIPS_VERSION=$OPENRTOS_3_9_2_FIPS_VERSION
  139. FIPS_REPO=$OPENRTOS_3_9_2_FIPS_REPO
  140. CRYPT_VERSION=$OPENRTOS_3_9_2_CRYPT_VERSION
  141. CRYPT_REPO=$OPENRTOS_3_9_2_CRYPT_REPO
  142. FIPS_CONFLICTS=( aes hmac random sha256 )
  143. ;;
  144. linux)
  145. FIPS_VERSION=$LINUX_FIPS_VERSION
  146. FIPS_REPO=$LINUX_FIPS_REPO
  147. CRYPT_VERSION=$LINUX_CRYPT_VERSION
  148. CRYPT_REPO=$LINUX_CRYPT_REPO
  149. ;;
  150. linux-ecc)
  151. FIPS_VERSION=$LINUX_ECC_FIPS_VERSION
  152. FIPS_REPO=$LINUX_ECC_FIPS_REPO
  153. CRYPT_VERSION=$LINUX_ECC_CRYPT_VERSION
  154. CRYPT_REPO=$LINUX_ECC_CRYPT_REPO
  155. ;;
  156. linuxv2 | fipsv2-OE-ready)
  157. FIPS_VERSION=WCv4-stable
  158. FIPS_REPO=git@github.com:wolfssl/fips.git
  159. CRYPT_VERSION=WCv4-stable
  160. CRYPT_INC_PATH=wolfssl/wolfcrypt
  161. CRYPT_SRC_PATH=wolfcrypt/src
  162. WC_MODS+=( cmac dh ecc sha3 )
  163. RNG_VERSION=WCv4-rng-stable
  164. FIPS_SRCS+=( wolfcrypt_first.c wolfcrypt_last.c )
  165. FIPS_INCS=( fips.h )
  166. FIPS_OPTION=v2
  167. COPY_DIRECT=( wolfcrypt/src/aes_asm.S wolfcrypt/src/aes_asm.asm )
  168. ;;
  169. netbsd-selftest)
  170. FIPS_VERSION=$NETBSD_FIPS_VERSION
  171. FIPS_REPO=$NETBSD_FIPS_REPO
  172. CRYPT_VERSION=$NETBSD_CRYPT_VERSION
  173. CRYPT_REPO=$NETBSD_CRYPT_REPO
  174. FIPS_SRCS=( selftest.c )
  175. WC_MODS=( dh ecc rsa dsa aes sha sha256 sha512 hmac random )
  176. CRYPT_INC_PATH=wolfssl/wolfcrypt
  177. CRYPT_SRC_PATH=wolfcrypt/src
  178. CAVP_SELFTEST_ONLY="yes"
  179. ;;
  180. marvell-linux-selftest)
  181. FIPS_VERSION=$MARVELL_LINUX_FIPS_VERSION
  182. FIPS_REPO=$MARVELL_LINUX_FIPS_REPO
  183. CRYPT_VERSION=$MARVELL_LINUX_CRYPT_VERSION
  184. CRYPT_REPO=$MARVELL_LINUX_CRYPT_REPO
  185. FIPS_SRCS=( selftest.c )
  186. WC_MODS=( dh ecc rsa dsa aes sha sha256 sha512 hmac random )
  187. CRYPT_INC_PATH=wolfssl/wolfcrypt
  188. CRYPT_SRC_PATH=wolfcrypt/src
  189. CAVP_SELFTEST_ONLY="yes"
  190. CAVP_SELFTEST_OPTION=v2
  191. ;;
  192. sgx)
  193. FIPS_VERSION=$SGX_FIPS_VERSION
  194. FIPS_REPO=$SGX_FIPS_REPO
  195. CRYPT_VERSION=$SGX_CRYPT_VERSION
  196. CRYPT_REPO=$SGX_CRYPT_REPO
  197. ;;
  198. netos-7.6)
  199. FIPS_VERSION=$NETOS_7_6_FIPS_VERSION
  200. FIPS_REPO=$NETOS_7_6_FIPS_REPO
  201. CRYPT_VERSION=$NETOS_7_6_CRYPT_VERSION
  202. CRYPT_REPO=$NETOS_7_6_CRYPT_REPO
  203. ;;
  204. linuxv5)
  205. FIPS_REPO="git@github.com:wolfSSL/fips.git"
  206. FIPS_VERSION="WCv5.0-RC12"
  207. CRYPT_REPO="git@github.com:wolfSSL/wolfssl.git"
  208. CRYPT_VERSION="WCv5.0-RC12"
  209. CRYPT_INC_PATH="wolfssl/wolfcrypt"
  210. CRYPT_SRC_PATH="wolfcrypt/src"
  211. WC_MODS=( aes sha sha256 sha512 rsa hmac random cmac dh ecc sha3 kdf )
  212. RNG_VERSION="WCv5.0-RC12"
  213. FIPS_SRCS=( fips.c fips_test.c wolfcrypt_first.c wolfcrypt_last.c )
  214. FIPS_INCS=( fips.h )
  215. FIPS_OPTION="v5-RC12"
  216. COPY_DIRECT=( wolfcrypt/src/aes_asm.S wolfcrypt/src/aes_asm.asm
  217. wolfcrypt/src/aes_gcm_asm.S
  218. wolfcrypt/src/sha256_asm.S wolfcrypt/src/sha512_asm.S )
  219. ;;
  220. linuxv5-ready|fips-ready|fips-v5-ready)
  221. FIPS_REPO="git@github.com:wolfSSL/fips.git"
  222. FIPS_VERSION="master"
  223. CRYPT_INC_PATH=wolfssl/wolfcrypt
  224. CRYPT_SRC_PATH=wolfcrypt/src
  225. FIPS_SRCS=( fips.c fips_test.c wolfcrypt_first.c wolfcrypt_last.c )
  226. FIPS_INCS=( fips.h )
  227. FIPS_OPTION=v5-ready
  228. ;;
  229. linuxv5-dev|fips-dev)
  230. FIPS_REPO="git@github.com:wolfSSL/fips.git"
  231. FIPS_VERSION="master"
  232. CRYPT_INC_PATH=wolfssl/wolfcrypt
  233. CRYPT_SRC_PATH=wolfcrypt/src
  234. FIPS_SRCS+=( wolfcrypt_first.c wolfcrypt_last.c )
  235. FIPS_INCS=( fips.h )
  236. FIPS_OPTION=v5-dev
  237. ;;
  238. stm32l4-v2)
  239. FIPS_VERSION=$STM32L4_V2_FIPS_VERSION
  240. FIPS_REPO=$STM32L4_V2_FIPS_REPO
  241. CRYPT_VERSION=$STM32L4_V2_CRYPT_VERSION
  242. CRYPT_INC_PATH=wolfssl/wolfcrypt
  243. CRYPT_SRC_PATH=wolfcrypt/src
  244. # Replace the WC_MODS list for now. Do not want to copy over random.c yet.
  245. WC_MODS=( aes des3 sha sha256 sha512 rsa hmac )
  246. WC_MODS+=( cmac dh ecc )
  247. FIPS_SRCS+=( wolfcrypt_first.c wolfcrypt_last.c )
  248. FIPS_INCS=( fips.h )
  249. FIPS_OPTION=v2
  250. ;;
  251. wolfrand)
  252. FIPS_REPO=git@github.com:wolfssl/fips.git
  253. FIPS_VERSION=WRv4-stable
  254. CRYPT_REPO=git@github.com:wolfssl/wolfssl.git
  255. CRYPT_VERSION=WCv4-stable
  256. CRYPT_INC_PATH=wolfssl/wolfcrypt
  257. CRYPT_SRC_PATH=wolfcrypt/src
  258. RNG_VERSION=WCv4-rng-stable
  259. WC_MODS=( hmac sha256 random )
  260. FIPS_SRCS+=( wolfcrypt_first.c wolfcrypt_last.c )
  261. FIPS_INCS=( fips.h )
  262. FIPS_OPTION=rand
  263. ;;
  264. solaris)
  265. FIPS_VERSION=WCv4-stable
  266. FIPS_REPO=git@github.com:wolfssl/fips.git
  267. CRYPT_VERSION=WCv4-stable
  268. CRYPT_INC_PATH=wolfssl/wolfcrypt
  269. CRYPT_SRC_PATH=wolfcrypt/src
  270. WC_MODS+=( cmac dh ecc sha3 )
  271. RNG_VERSION=WCv4-rng-stable
  272. FIPS_SRCS+=( wolfcrypt_first.c wolfcrypt_last.c )
  273. FIPS_INCS=( fips.h )
  274. FIPS_OPTION=v2
  275. MAKE=gmake
  276. ;;
  277. *)
  278. Usage
  279. exit 1
  280. esac
  281. if ! $GIT clone . "$TEST_DIR"; then
  282. echo "fips-check: Couldn't duplicate current working directory."
  283. exit 1
  284. fi
  285. pushd "$TEST_DIR" || exit 2
  286. case "$FIPS_OPTION" in
  287. *dev)
  288. echo "Don't need to copy in tagged wolfCrypt files for fips-dev."
  289. ;;
  290. *ready)
  291. echo "Don't need to copy in tagged wolfCrypt files for FIPS Ready."
  292. ;;
  293. v1)
  294. # make a clone of the last FIPS release tag
  295. if ! $GIT clone --depth 1 -b "$CRYPT_VERSION" "$CRYPT_REPO" old-tree; then
  296. echo "fips-check: Couldn't checkout the FIPS release."
  297. exit 1
  298. fi
  299. for MOD in "${WC_MODS[@]}"
  300. do
  301. cp "old-tree/$CRYPT_SRC_PATH/${MOD}.c" "$CRYPT_SRC_PATH"
  302. cp "old-tree/$CRYPT_INC_PATH/${MOD}.h" "$CRYPT_INC_PATH"
  303. done
  304. # We are using random.c from a separate release.
  305. # This is forcefully overwriting any other checkout of the cyassl sources.
  306. # Removing this as default behavior for SGX and netos projects.
  307. if [ "$CAVP_SELFTEST_ONLY" == "no" ] && [ "$FLAVOR" != "sgx" ] && \
  308. [ "$FLAVOR" != "netos-7.6" ];
  309. then
  310. pushd old-tree || exit 2
  311. $GIT fetch origin "$RNG_VERSION" || exit $?
  312. $GIT checkout FETCH_HEAD || exit $?
  313. popd || exit 2
  314. cp "old-tree/$CRYPT_SRC_PATH/random.c" "$CRYPT_SRC_PATH"
  315. cp "old-tree/$CRYPT_INC_PATH/random.h" "$CRYPT_INC_PATH"
  316. fi
  317. ;;
  318. v2|rand|v5*)
  319. $GIT branch --no-track "my$CRYPT_VERSION" "$CRYPT_VERSION" || exit $?
  320. # Checkout the fips versions of the wolfCrypt files from the repo.
  321. for MOD in "${WC_MODS[@]}"
  322. do
  323. $GIT checkout "my$CRYPT_VERSION" -- "$CRYPT_SRC_PATH/$MOD.c" "$CRYPT_INC_PATH/$MOD.h" || exit $?
  324. done
  325. for MOD in "${COPY_DIRECT[@]}"
  326. do
  327. $GIT checkout "my$CRYPT_VERSION" -- "$MOD" || exit $?
  328. done
  329. $GIT branch --no-track "myrng$RNG_VERSION" "$RNG_VERSION" || exit $?
  330. # Checkout the fips versions of the wolfCrypt files from the repo.
  331. $GIT checkout "myrng$RNG_VERSION" -- "$CRYPT_SRC_PATH/random.c" "$CRYPT_INC_PATH/random.h" || exit $?
  332. ;;
  333. *)
  334. echo "fips-check: Invalid FIPS option \"${FIPS_OPTION}\"."
  335. exit 1
  336. ;;
  337. esac
  338. # clone the FIPS repository
  339. case "$FIPS_OPTION" in
  340. *dev)
  341. if ! $GIT clone --depth 1 "$FIPS_REPO" fips; then
  342. echo "fips-check: Couldn't check out the FIPS repository for fips-dev."
  343. exit 1
  344. fi
  345. ;;
  346. *)
  347. if ! $GIT clone --depth 1 -b "$FIPS_VERSION" "$FIPS_REPO" fips; then
  348. echo "fips-check: Couldn't check out ${FIPS_VERSION} from repository ${FIPS_REPO}."
  349. exit 1
  350. fi
  351. ;;
  352. esac
  353. for SRC in "${FIPS_SRCS[@]}"
  354. do
  355. cp "fips/$SRC" "$CRYPT_SRC_PATH"
  356. done
  357. for INC in "${FIPS_INCS[@]}"
  358. do
  359. cp "fips/$INC" "$CRYPT_INC_PATH"
  360. done
  361. # When checking out cert 3389 ready code, NIST will no longer perform
  362. # new certifications on 140-2 modules. If we were to use the latest files from
  363. # master that would require re-cert due to changes in the module boundary.
  364. # Since OE additions can still be processed for cert3389 we will call 140-2
  365. # ready "fipsv2-OE-ready" indicating it is ready to use for an OE addition but
  366. # would not be good for a new certification effort with the latest files.
  367. if [ "$FLAVOR" = "fipsv2-OE-ready" ]; then
  368. OLD_VERSION=" return \"v4.0.0-alpha\";"
  369. OE_READY_VERSION=" return \"fipsv2-OE-ready\";"
  370. cp "${CRYPT_SRC_PATH}/fips.c" "${CRYPT_SRC_PATH}/fips.c.bak"
  371. sed "s/^${OLD_VERSION}/${OE_READY_VERSION}/" "${CRYPT_SRC_PATH}/fips.c.bak" >"${CRYPT_SRC_PATH}/fips.c"
  372. fi
  373. # run the make test
  374. ./autogen.sh
  375. if [ "$CAVP_SELFTEST_ONLY" == "yes" ];
  376. then
  377. if [ "$CAVP_SELFTEST_OPTION" == "v2" ]
  378. then
  379. ./configure --enable-selftest=v2
  380. else
  381. ./configure --enable-selftest
  382. fi
  383. else
  384. ./configure --enable-fips=$FIPS_OPTION
  385. fi
  386. if ! $MAKE; then
  387. echo "fips-check: Make failed. Debris left for analysis."
  388. exit 3
  389. fi
  390. if [ "$CAVP_SELFTEST_ONLY" == "no" ];
  391. then
  392. NEWHASH=$(./wolfcrypt/test/testwolfcrypt | sed -n 's/hash = \(.*\)/\1/p')
  393. if [ -n "$NEWHASH" ]; then
  394. cp "${CRYPT_SRC_PATH}/fips_test.c" "${CRYPT_SRC_PATH}/fips_test.c.bak"
  395. sed "s/^\".*\";/\"${NEWHASH}\";/" "${CRYPT_SRC_PATH}/fips_test.c.bak" >"${CRYPT_SRC_PATH}/fips_test.c"
  396. make clean
  397. fi
  398. fi
  399. if ! $MAKE test; then
  400. echo "fips-check: Test failed. Debris left for analysis."
  401. exit 3
  402. fi
  403. if [ ${#FIPS_CONFLICTS[@]} -ne 0 ];
  404. then
  405. echo "Due to the way this package is compiled by the customer duplicate"
  406. echo "source file names are an issue, renaming:"
  407. for FNAME in "${FIPS_CONFLICTS[@]}"
  408. do
  409. echo "wolfcrypt/src/$FNAME.c to wolfcrypt/src/wc_$FNAME.c"
  410. mv "./wolfcrypt/src/$FNAME.c" "./wolfcrypt/src/wc_$FNAME.c"
  411. done
  412. echo "Confirming files were renamed..."
  413. ls -la ./wolfcrypt/src/wc_*.c
  414. fi
  415. # Clean up
  416. popd || exit 2
  417. if [ "$KEEP" == "no" ];
  418. then
  419. rm -rf "$TEST_DIR"
  420. fi