Skip to content

Commit 9cbc890

Browse files
ColtonWilleyColtonWilley
committed
Fix new tests for FIPS, new option to build from FIPS bundle
1 parent 5eeba61 commit 9cbc890

6 files changed

Lines changed: 114 additions & 27 deletions

File tree

‎.github/workflows/fips.yml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
name: Fips simple tests
2+
3+
# START OF COMMON SECTION
4+
on:
5+
push:
6+
branches: [ 'master', 'main', 'release/**' ]
7+
pull_request:
8+
branches: [ '*' ]
9+
10+
concurrency:
11+
group: ${{ github.workflow }}-${{ github.ref }}
12+
cancel-in-progress: true
13+
# END OF COMMON SECTION
14+
15+
jobs:
16+
fips_make_check:
17+
strategy:
18+
matrix:
19+
config: [
20+
# Add new configs here
21+
'OPENSSL_TAG=openssl-3.2.0 WOLFSSL_TAG=v5.7.4-stable WOLFSSL_ISFIPS=1',
22+
]
23+
name: fips make check
24+
runs-on: ubuntu-latest
25+
# This should be a safe limit for the tests to run.
26+
timeout-minutes: 10
27+
steps:
28+
- uses: actions/checkout@v4
29+
name: Checkout wolfProvider
30+
31+
- name: Test wolfProvider
32+
run: |
33+
${{ matrix.config }} ./scripts/build-wolfprovider.sh
34+
make check
35+
36+
- name: Print errors
37+
if: ${{ failure() }}
38+
run: |
39+
if [ -f test-suite.log ] ; then
40+
cat test-suite.log
41+
fi

‎README.md‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -50,8 +50,17 @@ wolfProvider is a library that can be used as a Provider in OpenSSL.
5050
* TLS1 PRF
5151

5252
## Building
53-
The quickest method is to use the `scripts/build-wolfprovider.sh` script. It will retreive the dependencies and compile them as necessary. To use other than the default (such as different releases) you can set various environment variables prior to calling the script. An example is:
54-
OPENSSL_TAG=openssl-3.2.0 WOLFSSL_TAG=v5.7.2-stable WOLFPROV_DEBUG=1 scripts/build-wolfprovider.sh
53+
The quickest method is to use the `scripts/build-wolfprovider.sh` script as follows:
54+
55+
```
56+
./scripts/build-wolfprovider.sh
57+
```
58+
59+
It will retreive the dependencies and compile them as necessary. To use other than the default (such as different releases) you can set various environment variables prior to calling the script:
60+
61+
```
62+
OPENSSL_TAG=openssl-3.2.0 WOLFSSL_TAG=v5.7.2-stable WOLFPROV_DEBUG=1 scripts/build-wolfprovider.sh
63+
```
5564

5665
Alternatively, you can manually compile each component using the following guide.
5766

‎scripts/build-wolfprovider.sh‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,23 @@ SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
66
LOG_FILE=${SCRIPT_DIR}/build-release.log
77
source ${SCRIPT_DIR}/utils-wolfprovider.sh
88

9+
show_help() {
10+
echo "Usage: $0"
11+
echo ""
12+
echo "Environment Variables:"
13+
echo " OPENSSL_TAG OpenSSL tag to use (e.g., openssl-3.2.0)"
14+
echo " WOLFSSL_TAG wolfSSL tag to use (e.g., v5.7.4-stable)"
15+
echo " WOLFPROV_DEBUG If set to 1, builds OpenSSL, wolfSSL, and wolfProvider with debug options enabled"
16+
echo " WOLFSSL_FIPS_BUNDLE Directory containing the wolfSSL FIPS bundle to use instead of cloning from GitHub"
17+
echo " WOLFSSL_FIPS_VERSION Version of wolfSSL FIPS bundle (v5, v6, ready), used as an argument for --enable-fips when configuring wolfSSL"
18+
echo ""
19+
}
20+
21+
if [[ "$1" == "--help" || "$1" == "-h" || "$1" == "-help" ]]; then
22+
show_help
23+
exit 0
24+
fi
25+
926
echo "Using openssl: $OPENSSL_TAG, wolfssl: $WOLFSSL_TAG"
1027

1128
init_wolfprov

‎scripts/utils-wolfprovider.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ source ${SCRIPT_DIR}/utils-wolfssl.sh
2424

2525
WOLFPROV_SOURCE_DIR=${SCRIPT_DIR}/..
2626
WOLFPROV_INSTALL_DIR=${SCRIPT_DIR}/../wolfprov-install
27-
if [ "$WOLFSSL_ISFIPS" -eq "1" ]; then
27+
if [ "$WOLFSSL_ISFIPS" -eq "1" ] || [ -n "$WOLFSSL_FIPS_BUNDLE" ]; then
2828
WOLFPROV_CONFIG=${WOLFPROV_CONFIG:-"$WOLFPROV_SOURCE_DIR/provider-fips.conf"}
2929
else
3030
WOLFPROV_CONFIG=${WOLFPROV_CONFIG:-"$WOLFPROV_SOURCE_DIR/provider.conf"}

‎scripts/utils-wolfssl.sh‎

Lines changed: 42 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -33,32 +33,38 @@ WOLFPROV_DEBUG=${WOLFPROV_DEBUG:-0}
3333

3434
# Depends on OPENSSL_INSTALL_DIR
3535
clone_wolfssl() {
36-
if [ -d ${WOLFSSL_SOURCE_DIR} ]; then
37-
WOLFSSL_TAG_CUR=$(cd ${WOLFSSL_SOURCE_DIR} && (git describe --tags 2>/dev/null || git branch --show-current))
38-
if [ "${WOLFSSL_TAG_CUR}" != "${WOLFSSL_TAG}" ]; then # force a rebuild
39-
printf "Version inconsistency. Please fix ${WOLFSSL_SOURCE_DIR} (expected: ${WOLFSSL_TAG}, got: ${WOLFSSL_TAG_CUR})\n"
40-
do_cleanup
41-
exit 1
36+
if [ -n "$WOLFSSL_FIPS_BUNDLE" ]; then
37+
rm -rf ${WOLFSSL_SOURCE_DIR}
38+
mkdir ${WOLFSSL_SOURCE_DIR}
39+
cp -pr ${WOLFSSL_FIPS_BUNDLE}/* ${WOLFSSL_SOURCE_DIR}/
40+
else
41+
if [ -d ${WOLFSSL_SOURCE_DIR} ]; then
42+
WOLFSSL_TAG_CUR=$(cd ${WOLFSSL_SOURCE_DIR} && (git describe --tags 2>/dev/null || git branch --show-current))
43+
if [ "${WOLFSSL_TAG_CUR}" != "${WOLFSSL_TAG}" ]; then # force a rebuild
44+
printf "Version inconsistency. Please fix ${WOLFSSL_SOURCE_DIR} (expected: ${WOLFSSL_TAG}, got: ${WOLFSSL_TAG_CUR})\n"
45+
do_cleanup
46+
exit 1
47+
fi
4248
fi
43-
fi
4449

45-
if [ ! -d ${WOLFSSL_SOURCE_DIR} ]; then
46-
printf "\tClone wolfSSL ${WOLFSSL_TAG} ... "
47-
if [ "$WOLFPROV_DEBUG" = "1" ]; then
48-
git clone -b ${WOLFSSL_TAG} ${WOLFSSL_GIT} \
49-
${WOLFSSL_SOURCE_DIR} >>$LOG_FILE 2>&1
50-
RET=$?
51-
else
52-
git clone --depth=1 -b ${WOLFSSL_TAG} ${WOLFSSL_GIT} \
53-
${WOLFSSL_SOURCE_DIR} >>$LOG_FILE 2>&1
54-
RET=$?
55-
fi
56-
if [ $RET != 0 ]; then
57-
printf "ERROR cloning\n"
58-
do_cleanup
59-
exit 1
50+
if [ ! -d ${WOLFSSL_SOURCE_DIR} ]; then
51+
printf "\tClone wolfSSL ${WOLFSSL_TAG} ... "
52+
if [ "$WOLFPROV_DEBUG" = "1" ]; then
53+
git clone -b ${WOLFSSL_TAG} ${WOLFSSL_GIT} \
54+
${WOLFSSL_SOURCE_DIR} >>$LOG_FILE 2>&1
55+
RET=$?
56+
else
57+
git clone --depth=1 -b ${WOLFSSL_TAG} ${WOLFSSL_GIT} \
58+
${WOLFSSL_SOURCE_DIR} >>$LOG_FILE 2>&1
59+
RET=$?
60+
fi
61+
if [ $RET != 0 ]; then
62+
printf "ERROR cloning\n"
63+
do_cleanup
64+
exit 1
65+
fi
66+
printf "Done.\n"
6067
fi
61-
printf "Done.\n"
6268
fi
6369
}
6470

@@ -76,7 +82,15 @@ install_wolfssl() {
7682
CONF_ARGS+=" --enable-debug --enable-debug-trace-errcodes=backtrace --enable-keylog-export"
7783
WOLFSSL_CONFIG_CFLAGS+=" -DWOLFSSL_LOGGINGENABLED_DEFAULT=1"
7884
fi
79-
if [ "$WOLFSSL_ISFIPS" = "1" ]; then
85+
if [ -n "$WOLFSSL_FIPS_BUNDLE" ]; then
86+
if [ ! -n "$WOLFSSL_FIPS_VERSION" ]; then
87+
printf "ERROR, must specify version if using FIPS bundle (v5, v6, ready)"
88+
do_cleanup
89+
exit 1
90+
fi
91+
printf "using FIPS bundle ... "
92+
CONF_ARGS+=" --enable-fips=$WOLFSSL_FIPS_VERSION"
93+
elif [ "$WOLFSSL_ISFIPS" = "1" ]; then
8094
printf "with FIPS ... "
8195
CONF_ARGS+=" --enable-fips=v5"
8296
if [ ! -e "XXX-fips-test" ]; then
@@ -118,6 +132,10 @@ install_wolfssl() {
118132
fi
119133
printf "Done.\n"
120134

135+
if [ -n "$WOLFSSL_FIPS_BUNDLE" ]; then
136+
./fips-hash.sh
137+
fi
138+
121139
printf "\tInstalling wolfSSL ${WOLFSSL_TAG} ... "
122140
make install >>$LOG_FILE 2>&1
123141
if [ $? != 0 ]; then

‎test/test_rsa.c‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -462,8 +462,10 @@ int test_rsa_sign_verify_x931(void *data)
462462

463463
(void)data;
464464

465+
#ifndef HAVE_FIPS
465466
/* Use SHA-1 (default) for MD and MGF1 MD. */
466467
err = test_rsa_sign_verify_pad(RSA_X931_PADDING, EVP_sha1(), NULL) == 1;
468+
#endif
467469
#ifdef WP_HAVE_SHA256
468470
if (err == 0) {
469471
/* Use SHA-256 for MD. */

0 commit comments

Comments
 (0)