fips-check.sh 13 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405
  1. #!/usr/bin/env bash
  2. # fips-check.sh
  3. # This script checks the current revision of the code against the
  4. # previous release of the FIPS code. While wolfSSL and wolfCrypt
  5. # may be advancing, they must work correctly with the last tested
  6. # copy of our FIPS approved code.
  7. #
  8. # This should check out all the approved flavors. The command line
  9. # option selects the flavor. The keep option keeps the output
  10. # directory.
  11. # These variables may be overridden on the command line.
  12. MAKE="${MAKE:-make}"
  13. GIT="${GIT:-git -c advice.detachedHead=false}"
  14. TEST_DIR="${TEST_DIR:-XXX-fips-test}"
  15. FLAVOR="${FLAVOR:-linux}"
  16. KEEP="${KEEP:-no}"
  17. MAKECHECK=${MAKECHECK:-yes}
  18. FIPS_REPO="${FIPS_REPO:-git@github.com:wolfssl/fips.git}"
  19. Usage() {
  20. cat <<usageText
  21. Usage: $0 [flavor] [keep]
  22. Flavor is one of:
  23. linuxv2 (FIPSv2, use for Win10)
  24. fipsv2-OE-ready (ready FIPSv2)
  25. solaris
  26. netbsd-selftest
  27. marvell-linux-selftest
  28. linuxv5 (current FIPS 140-3)
  29. fips-ready (ready FIPS 140-3)
  30. fips-dev (dev FIPS 140-3)
  31. wolfrand
  32. wolfentropy
  33. Keep (default off) retains the temp dir $TEST_DIR for inspection.
  34. Example:
  35. $0 windows keep
  36. usageText
  37. }
  38. while [ "$1" ]; do
  39. if [ "$1" = 'keep' ]; then KEEP='yes';
  40. elif [ "$1" = 'nomakecheck' ]; then MAKECHECK='no';
  41. else FLAVOR="$1"; fi
  42. shift
  43. done
  44. case "$FLAVOR" in
  45. linuxv2|fipsv2-OE-ready|solaris)
  46. FIPS_OPTION='v2'
  47. FIPS_FILES=(
  48. 'wolfcrypt/src/fips.c:WCv4-stable'
  49. 'wolfcrypt/src/fips_test.c:WCv4-stable'
  50. 'wolfcrypt/src/wolfcrypt_first.c:WCv4-stable'
  51. 'wolfcrypt/src/wolfcrypt_last.c:WCv4-stable'
  52. 'wolfssl/wolfcrypt/fips.h:WCv4-stable'
  53. )
  54. WOLFCRYPT_FILES=(
  55. 'wolfcrypt/src/aes.c:WCv4-stable'
  56. 'wolfcrypt/src/aes_asm.asm:WCv4-stable'
  57. 'wolfcrypt/src/aes_asm.S:WCv4-stable'
  58. 'wolfcrypt/src/cmac.c:WCv4-stable'
  59. 'wolfcrypt/src/des3.c:WCv4-stable'
  60. 'wolfcrypt/src/dh.c:WCv4-stable'
  61. 'wolfcrypt/src/ecc.c:WCv4-stable'
  62. 'wolfcrypt/src/hmac.c:WCv4-stable'
  63. 'wolfcrypt/src/random.c:WCv4-rng-stable'
  64. 'wolfcrypt/src/rsa.c:WCv4-stable'
  65. 'wolfcrypt/src/sha.c:WCv4-stable'
  66. 'wolfcrypt/src/sha256.c:WCv4-stable'
  67. 'wolfcrypt/src/sha3.c:WCv4-stable'
  68. 'wolfcrypt/src/sha512.c:WCv4-stable'
  69. 'wolfssl/wolfcrypt/aes.h:WCv4-stable'
  70. 'wolfssl/wolfcrypt/cmac.h:WCv4-stable'
  71. 'wolfssl/wolfcrypt/des3.h:WCv4-stable'
  72. 'wolfssl/wolfcrypt/dh.h:WCv4-stable'
  73. 'wolfssl/wolfcrypt/ecc.h:WCv4-stable'
  74. 'wolfssl/wolfcrypt/hmac.h:WCv4-stable'
  75. 'wolfssl/wolfcrypt/random.h:WCv4-rng-stable'
  76. 'wolfssl/wolfcrypt/rsa.h:WCv4-stable'
  77. 'wolfssl/wolfcrypt/sha.h:WCv4-stable'
  78. 'wolfssl/wolfcrypt/sha256.h:WCv4-stable'
  79. 'wolfssl/wolfcrypt/sha3.h:WCv4-stable'
  80. 'wolfssl/wolfcrypt/sha512.h:WCv4-stable'
  81. )
  82. if [ "$FLAVOR" = 'solaris' ]; then MAKE='gmake'; fi
  83. ;;
  84. netbsd-selftest)
  85. # non-FIPS, CAVP only but pull in selftest
  86. FIPS_OPTION='cavp-selftest'
  87. FIPS_FILES=('wolfcrypt/src/selftest.c:v3.14.2b')
  88. WOLFCRYPT_FILES=(
  89. 'wolfcrypt/src/aes.c:v3.14.2'
  90. 'wolfcrypt/src/dh.c:v3.14.2'
  91. 'wolfcrypt/src/dsa.c:v3.14.2'
  92. 'wolfcrypt/src/ecc.c:v3.14.2'
  93. 'wolfcrypt/src/hmac.c:v3.14.2'
  94. 'wolfcrypt/src/random.c:v3.14.2'
  95. 'wolfcrypt/src/rsa.c:v3.14.2'
  96. 'wolfcrypt/src/sha.c:v3.14.2'
  97. 'wolfcrypt/src/sha256.c:v3.14.2'
  98. 'wolfcrypt/src/sha512.c:v3.14.2'
  99. 'wolfssl/wolfcrypt/aes.h:v3.14.2'
  100. 'wolfssl/wolfcrypt/dh.h:v3.14.2'
  101. 'wolfssl/wolfcrypt/dsa.h:v3.14.2'
  102. 'wolfssl/wolfcrypt/ecc.h:v3.14.2'
  103. 'wolfssl/wolfcrypt/hmac.h:v3.14.2'
  104. 'wolfssl/wolfcrypt/random.h:v3.14.2'
  105. 'wolfssl/wolfcrypt/rsa.h:v3.14.2'
  106. 'wolfssl/wolfcrypt/sha.h:v3.14.2'
  107. 'wolfssl/wolfcrypt/sha256.h:v3.14.2'
  108. 'wolfssl/wolfcrypt/sha512.h:v3.14.2'
  109. )
  110. ;;
  111. marvell-linux-selftest)
  112. # non-FIPS, CAVP only but pull in selftest
  113. FIPS_OPTION='cavp-selftest-v2'
  114. FIPS_FILES=('wolfcrypt/src/selftest.c:v3.14.2b')
  115. WOLFCRYPT_FILES=(
  116. 'wolfcrypt/src/aes.c:v4.1.0-stable'
  117. 'wolfcrypt/src/dh.c:v4.1.0-stable'
  118. 'wolfcrypt/src/dsa.c:v4.1.0-stable'
  119. 'wolfcrypt/src/ecc.c:v4.1.0-stable'
  120. 'wolfcrypt/src/hmac.c:v4.1.0-stable'
  121. 'wolfcrypt/src/random.c:v4.1.0-stable'
  122. 'wolfcrypt/src/rsa.c:v4.1.0-stable'
  123. 'wolfcrypt/src/sha.c:v4.1.0-stable'
  124. 'wolfcrypt/src/sha256.c:v4.1.0-stable'
  125. 'wolfcrypt/src/sha512.c:v4.1.0-stable'
  126. 'wolfssl/wolfcrypt/aes.h:v4.1.0-stable'
  127. 'wolfssl/wolfcrypt/dh.h:v4.1.0-stable'
  128. 'wolfssl/wolfcrypt/dsa.h:v4.1.0-stable'
  129. 'wolfssl/wolfcrypt/ecc.h:v4.1.0-stable'
  130. 'wolfssl/wolfcrypt/hmac.h:v4.1.0-stable'
  131. 'wolfssl/wolfcrypt/random.h:v4.1.0-stable'
  132. 'wolfssl/wolfcrypt/rsa.h:v4.1.0-stable'
  133. 'wolfssl/wolfcrypt/sha.h:v4.1.0-stable'
  134. 'wolfssl/wolfcrypt/sha256.h:v4.1.0-stable'
  135. 'wolfssl/wolfcrypt/sha512.h:v4.1.0-stable'
  136. )
  137. ;;
  138. linuxv5)
  139. FIPS_OPTION='v5'
  140. FIPS_FILES=(
  141. 'wolfcrypt/src/fips.c:WCv5.2.0.1-RC01'
  142. 'wolfcrypt/src/fips_test.c:WCv5.0-RC12'
  143. 'wolfcrypt/src/wolfcrypt_first.c:WCv5.0-RC12'
  144. 'wolfcrypt/src/wolfcrypt_last.c:WCv5.0-RC12'
  145. 'wolfssl/wolfcrypt/fips.h:WCv5.0-RC12'
  146. )
  147. WOLFCRYPT_FILES=(
  148. 'wolfcrypt/src/aes.c:WCv5.0-RC12'
  149. 'wolfcrypt/src/aes_asm.asm:WCv5.0-RC12'
  150. 'wolfcrypt/src/aes_asm.S:WCv5.0-RC12'
  151. 'wolfcrypt/src/aes_gcm_asm.S:WCv5.0-RC12'
  152. 'wolfcrypt/src/cmac.c:WCv5.0-RC12'
  153. 'wolfcrypt/src/dh.c:WCv5.0-RC12'
  154. 'wolfcrypt/src/ecc.c:WCv5.0-RC12'
  155. 'wolfcrypt/src/hmac.c:WCv5.0-RC12'
  156. 'wolfcrypt/src/kdf.c:WCv5.0-RC12'
  157. 'wolfcrypt/src/random.c:WCv5.0-RC12'
  158. 'wolfcrypt/src/rsa.c:WCv5.0-RC12'
  159. 'wolfcrypt/src/sha.c:WCv5.0-RC12'
  160. 'wolfcrypt/src/sha256.c:WCv5.0-RC12'
  161. 'wolfcrypt/src/sha256_asm.S:WCv5.0-RC12'
  162. 'wolfcrypt/src/sha3.c:WCv5.0-RC12'
  163. 'wolfcrypt/src/sha512.c:WCv5.0-RC12'
  164. 'wolfcrypt/src/sha512_asm.S:WCv5.0-RC12'
  165. 'wolfssl/wolfcrypt/aes.h:WCv5.0-RC12'
  166. 'wolfssl/wolfcrypt/cmac.h:WCv5.0-RC12'
  167. 'wolfssl/wolfcrypt/dh.h:WCv5.0-RC12'
  168. 'wolfssl/wolfcrypt/ecc.h:WCv5.0-RC12'
  169. 'wolfssl/wolfcrypt/fips_test.h:WCv5.0-RC12'
  170. 'wolfssl/wolfcrypt/hmac.h:WCv5.0-RC12'
  171. 'wolfssl/wolfcrypt/kdf.h:WCv5.0-RC12'
  172. 'wolfssl/wolfcrypt/random.h:WCv5.0-RC12'
  173. 'wolfssl/wolfcrypt/rsa.h:WCv5.0-RC12'
  174. 'wolfssl/wolfcrypt/sha.h:WCv5.0-RC12'
  175. 'wolfssl/wolfcrypt/sha256.h:WCv5.0-RC12'
  176. 'wolfssl/wolfcrypt/sha3.h:WCv5.0-RC12'
  177. 'wolfssl/wolfcrypt/sha512.h:WCv5.0-RC12'
  178. )
  179. ;;
  180. linuxv5.2.1)
  181. FIPS_OPTION='v5'
  182. FIPS_FILES=(
  183. 'wolfcrypt/src/fips.c:v5.2.1-stable'
  184. 'wolfcrypt/src/fips_test.c:v5.2.1-stable'
  185. 'wolfcrypt/src/wolfcrypt_first.c:v5.2.1-stable'
  186. 'wolfcrypt/src/wolfcrypt_last.c:v5.2.1-stable'
  187. 'wolfssl/wolfcrypt/fips.h:v5.2.1-stable'
  188. )
  189. WOLFCRYPT_FILES=(
  190. 'wolfcrypt/src/aes.c:v5.2.1-stable'
  191. 'wolfcrypt/src/aes_asm.asm:v5.2.1-stable'
  192. 'wolfcrypt/src/aes_asm.S:v5.2.1-stable'
  193. 'wolfcrypt/src/aes_gcm_asm.S:v5.2.1-stable'
  194. 'wolfcrypt/src/cmac.c:v5.2.1-stable'
  195. 'wolfcrypt/src/dh.c:v5.2.1-stable'
  196. 'wolfcrypt/src/ecc.c:v5.2.1-stable'
  197. 'wolfcrypt/src/hmac.c:v5.2.1-stable'
  198. 'wolfcrypt/src/kdf.c:v5.2.1-stable'
  199. 'wolfcrypt/src/random.c:v5.2.1-stable'
  200. 'wolfcrypt/src/rsa.c:v5.2.1-stable'
  201. 'wolfcrypt/src/sha.c:v5.2.1-stable'
  202. 'wolfcrypt/src/sha256.c:v5.2.1-stable'
  203. 'wolfcrypt/src/sha256_asm.S:v5.2.1-stable'
  204. 'wolfcrypt/src/sha3.c:v5.2.1-stable'
  205. 'wolfcrypt/src/sha512.c:v5.2.1-stable'
  206. 'wolfcrypt/src/sha512_asm.S:v5.2.1-stable'
  207. 'wolfssl/wolfcrypt/aes.h:v5.2.1-stable'
  208. 'wolfssl/wolfcrypt/cmac.h:v5.2.1-stable'
  209. 'wolfssl/wolfcrypt/dh.h:v5.2.1-stable'
  210. 'wolfssl/wolfcrypt/ecc.h:v5.2.1-stable'
  211. 'wolfssl/wolfcrypt/fips_test.h:v5.2.1-stable'
  212. 'wolfssl/wolfcrypt/hmac.h:v5.2.1-stable'
  213. 'wolfssl/wolfcrypt/kdf.h:v5.2.1-stable'
  214. 'wolfssl/wolfcrypt/random.h:v5.2.1-stable'
  215. 'wolfssl/wolfcrypt/rsa.h:v5.2.1-stable'
  216. 'wolfssl/wolfcrypt/sha.h:v5.2.1-stable'
  217. 'wolfssl/wolfcrypt/sha256.h:v5.2.1-stable'
  218. 'wolfssl/wolfcrypt/sha3.h:v5.2.1-stable'
  219. 'wolfssl/wolfcrypt/sha512.h:v5.2.1-stable'
  220. )
  221. ;;
  222. fips-ready|fips-dev)
  223. FIPS_OPTION='ready'
  224. FIPS_FILES=(
  225. 'wolfcrypt/src/fips.c:master'
  226. 'wolfcrypt/src/fips_test.c:master'
  227. 'wolfcrypt/src/wolfcrypt_first.c:master'
  228. 'wolfcrypt/src/wolfcrypt_last.c:master'
  229. 'wolfssl/wolfcrypt/fips.h:master'
  230. )
  231. WOLFCRYPT_FILES=()
  232. if [ "$FLAVOR" = 'fips-dev' ]; then FIPS_OPTION='dev'; fi
  233. ;;
  234. wolfrand)
  235. FIPS_OPTION='rand'
  236. FIPS_FILES=(
  237. 'wolfcrypt/src/fips.c:WRv4-stable'
  238. 'wolfcrypt/src/fips_test.c:WRv4-stable'
  239. 'wolfcrypt/src/wolfcrypt_first.c:WRv4-stable'
  240. 'wolfcrypt/src/wolfcrypt_last.c:WRv4-stable'
  241. 'wolfssl/wolfcrypt/fips.h:WRv4-stable'
  242. )
  243. WOLFCRYPT_FILES=(
  244. 'wolfcrypt/src/hmac.c:WCv4-stable'
  245. 'wolfcrypt/src/random.c:WCv4-rng-stable'
  246. 'wolfcrypt/src/sha256.c:WCv4-stable'
  247. 'wolfssl/wolfcrypt/hmac.h:WCv4-stable'
  248. 'wolfssl/wolfcrypt/random.h:WCv4-rng-stable'
  249. 'wolfssl/wolfcrypt/sha256.h:WCv4-stable'
  250. )
  251. ;;
  252. wolfentropy)
  253. FIPS_OPTION='v6'
  254. FIPS_FILES=(
  255. 'wolfcrypt/src/fips.c:wolfEntropy1'
  256. 'wolfcrypt/src/fips_test.c:wolfEntropy1'
  257. 'wolfcrypt/src/wolfcrypt_first.c:wolfEntropy1'
  258. 'wolfcrypt/src/wolfcrypt_last.c:wolfEntropy1'
  259. 'wolfssl/wolfcrypt/fips.h:wolfEntropy1'
  260. )
  261. WOLFCRYPT_FILES=(
  262. 'wolfcrypt/src/aes.c:wolfEntropy1'
  263. 'wolfcrypt/src/aes_asm.asm:wolfEntropy1'
  264. 'wolfcrypt/src/aes_asm.S:wolfEntropy1'
  265. 'wolfcrypt/src/aes_gcm_asm.S:wolfEntropy1'
  266. 'wolfcrypt/src/ecc.c:wolfEntropy1'
  267. 'wolfcrypt/src/hmac.c:wolfEntropy1'
  268. 'wolfcrypt/src/kdf.c:wolfEntropy1'
  269. 'wolfcrypt/src/random.c:wolfEntropy1'
  270. 'wolfcrypt/src/sha256.c:wolfEntropy1'
  271. 'wolfcrypt/src/sha256_asm.S:wolfEntropy1'
  272. 'wolfcrypt/src/sha3.c:wolfEntropy1'
  273. 'wolfcrypt/src/sha512.c:wolfEntropy1'
  274. 'wolfcrypt/src/sha512_asm.S:wolfEntropy1'
  275. 'wolfssl/wolfcrypt/aes.h:wolfEntropy1'
  276. 'wolfssl/wolfcrypt/ecc.h:wolfEntropy1'
  277. 'wolfssl/wolfcrypt/fips_test.h:wolfEntropy1'
  278. 'wolfssl/wolfcrypt/hmac.h:wolfEntropy1'
  279. 'wolfssl/wolfcrypt/kdf.h:wolfEntropy1'
  280. 'wolfssl/wolfcrypt/random.h:wolfEntropy1'
  281. 'wolfssl/wolfcrypt/sha256.h:wolfEntropy1'
  282. 'wolfssl/wolfcrypt/sha3.h:wolfEntropy1'
  283. 'wolfssl/wolfcrypt/sha512.h:wolfEntropy1'
  284. )
  285. ;;
  286. *)
  287. Usage
  288. exit 1
  289. esac
  290. # checkout_files takes an array of pairs of file paths and git tags to
  291. # checkout. It will check to see if mytag exists and if not will make that
  292. # tag a branch.
  293. function checkout_files() {
  294. local name
  295. local tag
  296. for file_entry in "$@"; do
  297. name=${file_entry%%:*}
  298. tag=${file_entry#*:}
  299. if ! $GIT rev-parse -q --verify "my$tag" >/dev/null
  300. then
  301. $GIT branch --no-track "my$tag" "$tag" || exit $?
  302. fi
  303. $GIT checkout "my$tag" -- "$name" || exit $?
  304. done
  305. }
  306. # copy_fips_files takes an array of pairs of file paths and git tags to
  307. # checkout. It will check to see if mytag exists and if now will make that
  308. # tag a branch. It breaks the filepath apart into file name and path, then
  309. # copies it from the file from the fips directory to the path.
  310. function copy_fips_files() {
  311. local name
  312. local bname
  313. local dname
  314. local tag
  315. for file_entry in "$@"; do
  316. name=${file_entry%%:*}
  317. tag=${file_entry#*:}
  318. bname=$(basename "$name")
  319. dname=$(dirname "$name")
  320. if ! $GIT rev-parse -q --verify "my$tag" >/dev/null; then
  321. $GIT branch --no-track "my$tag" "$tag" || exit $?
  322. fi
  323. $GIT checkout "my$tag" -- "$bname" || exit $?
  324. cp "$bname" "../$dname"
  325. done
  326. }
  327. if ! $GIT clone . "$TEST_DIR"; then
  328. echo "fips-check: Couldn't duplicate current working directory."
  329. exit 1
  330. fi
  331. pushd "$TEST_DIR" || exit 2
  332. if ! $GIT clone "$FIPS_REPO" fips; then
  333. echo "fips-check: Couldn't check out FIPS repository."
  334. exit 1
  335. fi
  336. checkout_files "${WOLFCRYPT_FILES[@]}" || exit 3
  337. pushd fips || exit 2
  338. copy_fips_files "${FIPS_FILES[@]}" || exit 3
  339. popd || exit 2
  340. # When checking out cert 3389 ready code, NIST will no longer perform
  341. # new certifications on 140-2 modules. If we were to use the latest files from
  342. # master that would require re-cert due to changes in the module boundary.
  343. # Since OE additions can still be processed for cert3389 we will call 140-2
  344. # ready "fipsv2-OE-ready" indicating it is ready to use for an OE addition but
  345. # would not be good for a new certification effort with the latest files.
  346. if [ "$FLAVOR" = 'fipsv2-OE-ready' ] && [ -s wolfcrypt/src/fips.c ]; then
  347. cp wolfcrypt/src/fips.c wolfcrypt/src/fips.c.bak
  348. sed "s/v4.0.0-alpha/fipsv2-OE-ready/" wolfcrypt/src/fips.c.bak >wolfcrypt/src/fips.c
  349. fi
  350. # run the make test
  351. ./autogen.sh
  352. case "$FIPS_OPTION" in
  353. cavp-selftest)
  354. ./configure --enable-selftest
  355. ;;
  356. cavp-selftest-v2)
  357. ./configure --enable-selftest=v2
  358. ;;
  359. *)
  360. ./configure --enable-fips=$FIPS_OPTION
  361. ;;
  362. esac
  363. if ! $MAKE; then
  364. echo 'fips-check: Make failed. Debris left for analysis.'
  365. exit 3
  366. fi
  367. if [ -s wolfcrypt/src/fips_test.c ]; then
  368. NEWHASH=$(./wolfcrypt/test/testwolfcrypt | sed -n 's/hash = \(.*\)/\1/p')
  369. if [ -n "$NEWHASH" ]; then
  370. cp wolfcrypt/src/fips_test.c wolfcrypt/src/fips_test.c.bak
  371. sed "s/^\".*\";/\"${NEWHASH}\";/" wolfcrypt/src/fips_test.c.bak >wolfcrypt/src/fips_test.c
  372. make clean
  373. fi
  374. fi
  375. if [ "$MAKECHECK" = "yes" ]; then
  376. if ! $MAKE check; then
  377. echo 'fips-check: Test failed. Debris left for analysis.'
  378. exit 3
  379. fi
  380. fi
  381. # Clean up
  382. popd || exit 2
  383. if [ "$KEEP" = 'no' ]; then
  384. rm -rf "$TEST_DIR"
  385. fi