#!/bin/bash # fips-check.sh # This script checks the current revision of the code against the # previous release of the FIPS code. While wolfSSL and wolfCrypt # may be advancing, they must work correctly with the last tested # copy of our FIPS approved code. # # This should check out all the approved flavors. The command line # option selects the flavor. The keep option keeps the output # directory. # These variables may be overridden on the command line. MAKE="${MAKE:-make}" GIT="${GIT:-git -c advice.detachedHead=false}" TEST_DIR="${TEST_DIR:-XXX-fips-test}" FLAVOR="${FLAVOR:-linux}" KEEP="${KEEP:-no}" MAKECHECK=${MAKECHECK:-yes} FIPS_REPO="${FIPS_REPO:-git@github.com:wolfssl/fips.git}" Usage() { cat </dev/null then $GIT branch --no-track "my$tag" "$tag" || exit $? fi $GIT checkout "my$tag" -- "$name" || exit $? done } # copy_fips_files takes an array of pairs of file paths and git tags to # checkout. It will check to see if mytag exists and if now will make that # tag a branch. It breaks the filepath apart into file name and path, then # copies it from the file from the fips directory to the path. function copy_fips_files() { local name local bname local dname local tag for file_entry in "$@"; do name=${file_entry%%:*} tag=${file_entry#*:} bname=$(basename "$name") dname=$(dirname "$name") if ! $GIT rev-parse -q --verify "my$tag" >/dev/null; then $GIT branch --no-track "my$tag" "$tag" || exit $? fi $GIT checkout "my$tag" -- "$bname" || exit $? cp "$bname" "../$dname" done } if ! $GIT clone . "$TEST_DIR"; then echo "fips-check: Couldn't duplicate current working directory." exit 1 fi pushd "$TEST_DIR" || exit 2 if ! $GIT clone "$FIPS_REPO" fips; then echo "fips-check: Couldn't check out FIPS repository." exit 1 fi checkout_files "${WOLFCRYPT_FILES[@]}" || exit 3 pushd fips || exit 2 copy_fips_files "${FIPS_FILES[@]}" || exit 3 popd || exit 2 # When checking out cert 3389 ready code, NIST will no longer perform # new certifications on 140-2 modules. If we were to use the latest files from # master that would require re-cert due to changes in the module boundary. # Since OE additions can still be processed for cert3389 we will call 140-2 # ready "fipsv2-OE-ready" indicating it is ready to use for an OE addition but # would not be good for a new certification effort with the latest files. if [ "$FLAVOR" = 'fipsv2-OE-ready' ] && [ -s wolfcrypt/src/fips.c ]; then cp wolfcrypt/src/fips.c wolfcrypt/src/fips.c.bak sed "s/v4.0.0-alpha/fipsv2-OE-ready/" wolfcrypt/src/fips.c.bak >wolfcrypt/src/fips.c fi # run the make test ./autogen.sh case "$FIPS_OPTION" in cavp-selftest) ./configure --enable-selftest ;; cavp-selftest-v2) ./configure --enable-selftest=v2 ;; *) ./configure --enable-fips=$FIPS_OPTION ;; esac if ! $MAKE; then echo 'fips-check: Make failed. Debris left for analysis.' exit 3 fi if [ -s wolfcrypt/src/fips_test.c ]; then NEWHASH=$(./wolfcrypt/test/testwolfcrypt | sed -n 's/hash = \(.*\)/\1/p') if [ -n "$NEWHASH" ]; then cp wolfcrypt/src/fips_test.c wolfcrypt/src/fips_test.c.bak sed "s/^\".*\";/\"${NEWHASH}\";/" wolfcrypt/src/fips_test.c.bak >wolfcrypt/src/fips_test.c make clean fi fi if [ "$MAKECHECK" = "yes" ]; then if ! $MAKE check; then echo 'fips-check: Test failed. Debris left for analysis.' exit 3 fi fi # Clean up popd || exit 2 if [ "$KEEP" = 'no' ]; then rm -rf "$TEST_DIR" fi