diff --git a/.github/workflows/debian-package.yml b/.github/workflows/debian-package.yml index 74fa7f46..5e5bb868 100644 --- a/.github/workflows/debian-package.yml +++ b/.github/workflows/debian-package.yml @@ -7,7 +7,7 @@ on: branches: [ '*' ] jobs: - bookworm: + libwolfprov-standalone: runs-on: ubuntu-22.04 # Important: use Debian Bookworm for compatibility container: @@ -35,6 +35,7 @@ jobs: dpkg-dev \ lintian \ fakeroot \ + dh-exec\ equivs # Install additional tools for testing apt-get install -y \ @@ -51,50 +52,45 @@ jobs: with: fetch-depth: 1 - run: | - # Fetch tags + # Fetch tags, needed for the Debian versioning git fetch --tags # List all tags git tag -l - name: Install wolfssl debian package run: | - mkdir -p "$RUNNER_TEMP/wolfssl-pkg" - cd "$RUNNER_TEMP/wolfssl-pkg" + mkdir -p "/tmp/wolfssl-pkg" + cd "/tmp/wolfssl-pkg" - echo "Using standard wolfSSL package" - tar -xvf $GITHUB_WORKSPACE/.github/packages/debian-wolfssl.tar.gz + # Install wolfssl packages + chmod +x $GITHUB_WORKSPACE/debian/install-wolfssl.sh + $GITHUB_WORKSPACE/debian/install-wolfssl.sh \ + $GITHUB_WORKSPACE/.github/packages/debian-wolfssl.tar.gz \ + "/tmp/wolfssl-pkg" - # Get current architecture - CURRENT_ARCH=$(dpkg --print-architecture) - echo "Current architecture: $CURRENT_ARCH" + # Create wolfprov-packages directory and move wolfssl files there + mkdir -p "/tmp/wolfprov-packages" + echo "Moving wolfssl files to artifacts directory..." - # Look for existing .deb files that match the current architecture - cd debian-packages - MATCHING_DEB_FILES=$(find . -name "*_${CURRENT_ARCH}.deb" -o -name "*_${CURRENT_ARCH}_*.deb" 2>/dev/null || true) + # Copy all wolfssl-related files (source and binary packages) + find /tmp/wolfssl-pkg -name "*wolfssl*" -type f -name "*.deb" -exec cp {} /tmp/wolfprov-packages/ \; + find /tmp/wolfssl-pkg -name "*wolfssl*" -type f -name "*.dsc" -exec cp {} /tmp/wolfprov-packages/ \; + find /tmp/wolfssl-pkg -name "*wolfssl*" -type f -name "*.tar.gz" -exec cp {} /tmp/wolfprov-packages/ \; + find /tmp/wolfssl-pkg -name "*wolfssl*" -type f -name "*.orig.tar.gz" -exec cp {} /tmp/wolfprov-packages/ \; - if [ -n "$MATCHING_DEB_FILES" ]; then - echo "Found matching .deb files for architecture $CURRENT_ARCH:" - echo "$MATCHING_DEB_FILES" - echo "Installing existing .deb files..." - dpkg -i $MATCHING_DEB_FILES - else - echo "No matching .deb files found for architecture $CURRENT_ARCH, rebuilding from source..." - dpkg-source -x wolfssl*.dsc - cd wolfssl*/ - dpkg-buildpackage -b -us -uc - dpkg -i ../libwolfssl*.deb - fi + echo "WolfSSL files in artifacts directory:" + ls -la /tmp/wolfprov-packages/*wolfssl* || true - name: Build Debian package run: | # Bypass the warning prompt with 'yes Y' - yes Y | ./scripts/build-wolfprovider.sh --debian + yes Y | ./scripts/build-wolfprovider.sh --debian $FIPS_FLAG # List generated packages echo "Generated Packages:" ls -la ../*.deb ../*.dsc ../*.tar.gz || true - - name: Install package + - name: Install package without custom openssl run: | # Find the package file PACKAGE_FILE=$(find ../ -name "libwolfprov_*.deb" | head -n1) @@ -114,11 +110,11 @@ jobs: - name: Test OpenSSL provider functionality run: | - PROVIDER_CONF="/etc/ssl/openssl.cnf.d/wolfprovider.conf" + PROVIDER_CONF="/usr/lib/ssl/openssl.cnf.d/wolfprovider.conf" PROVIDER_CONF_BACKUP="/tmp/wolfprovider.conf.backup" # Temporarily move wolfprovider config so we can toggle between providers - echo "3. Temporarily disabling wolfprovider for default provider tests:" + echo "Temporarily disabling wolfprovider for default provider tests:" mkdir -p /tmp/openssl-test if [ -f $PROVIDER_CONF ]; then mv $PROVIDER_CONF $PROVIDER_CONF_BACKUP @@ -133,7 +129,7 @@ jobs: OPENSSL_BIN=$(eval which openssl) ./scripts/cmd_test/do-cmd-tests.sh # Restore wolfprovider configuration - echo "5. Restoring wolfprovider configuration:" + echo "Restoring wolfprovider configuration:" if [ -f $PROVIDER_CONF_BACKUP ]; then mv $PROVIDER_CONF_BACKUP $PROVIDER_CONF echo " - Restored $PROVIDER_CONF from $PROVIDER_CONF_BACKUP" @@ -156,9 +152,9 @@ jobs: fi # Check if the config file is removed - if [ -f /etc/ssl/openssl.cnf.d/wolfprovider.conf ]; then + if [ -f /usr/lib/ssl/openssl.cnf.d/wolfprovider.conf ]; then echo "wolfprovider.conf still exists after package removal" - ls -la /etc/ssl/openssl.cnf.d/ + ls -la /usr/lib/ssl/openssl.cnf.d/ exit 1 else echo "wolfprovider.conf successfully removed" @@ -194,10 +190,12 @@ jobs: - name: Move package artifacts run: | - # Move the generated packages to the temp directory - mv ../*.deb $RUNNER_TEMP/ || true - mv ../*.dsc $RUNNER_TEMP/ || true - mv ../*.tar.gz $RUNNER_TEMP/ || true + # Create a clean artifacts directory + mkdir -p "/tmp/wolfprov-packages" + # Move the generated packages to the artifacts directory + mv ../*.deb /tmp/wolfprov-packages/ || true + mv ../*.dsc /tmp/wolfprov-packages/ || true + mv ../*.tar.gz /tmp/wolfprov-packages/ || true # Save the build outputs which for use in release packages - name: Upload package artifacts @@ -206,7 +204,232 @@ jobs: with: name: wolfprovider-debian-packages path: | - ${{ runner.temp }}/*.deb - ${{ runner.temp }}/*.dsc - ${{ runner.temp }}/*.tar.gz + /tmp/wolfprov-packages/*.deb + /tmp/wolfprov-packages/*.dsc + /tmp/wolfprov-packages/*.tar.gz retention-days: 7 + + libwolfprov-with-openssl: + runs-on: ubuntu-22.04 + needs: libwolfprov-standalone + container: + image: debian:bookworm + env: + DEBIAN_FRONTEND: noninteractive + steps: + - name: Download artifacts from previous job + uses: actions/download-artifact@v4 + with: + name: wolfprovider-debian-packages + path: /tmp/artifacts + + - name: Set up environment + run: | + # Update package lists + apt-get update + # Install build dependencies + apt-get install -y \ + build-essential \ + devscripts \ + debhelper \ + dh-autoreconf \ + libtool \ + pkg-config \ + git \ + wget \ + curl \ + ca-certificates \ + openssl \ + dpkg-dev \ + lintian \ + fakeroot \ + dh-exec\ + equivs + # Install additional tools for testing + apt-get install -y \ + expect \ + xxd + + - name: Unpack artifacts + run: | + echo "Downloaded artifacts:" + ls -la /tmp/artifacts/ + + # Create working directory + mkdir -p /tmp/test-installation + cd /tmp/test-installation + + # Copy all artifacts to working directory + cp /tmp/artifacts/* ./ + + echo "Unpacked artifacts in working directory:" + ls -la + + - name: Remove packages needed for artifact retrieval + run: | + # Remove packages that were needed for artifact download but shouldn't interfere with testing + apt-get remove -y wget curl ca-certificates || true + apt-get autoremove -y + + - name: Install libwolfssl and openssl packages + run: | + cd /tmp/test-installation + + # Find and install libwolfssl packages + wolfssl_debs=$(find . -name "*libwolfssl*.deb") + echo "Installing libwolfssl packages: $wolfssl_debs" + if [ -n "$wolfssl_debs" ]; then + apt install -y $wolfssl_debs + fi + + # Find and install openssl packages + openssl_debs=$(find . -name "*openssl*.deb") + libssl3_debs=$(find . -name "*libssl3*.deb") + echo "Installing openssl packages: $openssl_debs $libssl3_debs" + if [ -n "$openssl_debs" ] || [ -n "$libssl3_debs" ]; then + apt install -y $openssl_debs $libssl3_debs + fi + + echo "Installed packages:" + dpkg -l | grep -E "(wolfssl|openssl|libssl)" + + - name: Show OpenSSL version + run: | + echo "OpenSSL version:" + openssl version -a || true + + - name: Test OpenSSL providers before wolfprov installation + run: | + echo "Testing OpenSSL providers before wolfprov installation..." + echo "Expected: This should work normally with default providers" + + # Test openssl list -providers + if openssl list -providers; then + echo "SUCCESS: openssl list -providers works before wolfprov installation" + else + echo "FAILURE: openssl list -providers failed before wolfprov installation" + exit 1 + fi + + echo "Provider list before wolfprov installation:" + openssl list -providers + + - name: Install libwolfprov package + run: | + cd /tmp/test-installation + + # Find and install libwolfprov package + wolfprov_debs=$(find . -name "*libwolfprov*.deb" | head -n1) + echo "Installing libwolfprov package: $wolfprov_debs" + + if [ -z "$wolfprov_debs" ]; then + echo "ERROR: No libwolfprov package found!" + ls -la + exit 1 + fi + + echo "Installing: $wolfprov_debs" + apt install -y ./"$wolfprov_debs" + + echo "Installed packages after wolfprov:" + dpkg -l | grep -E "(wolfprov|wolfssl|openssl|libssl)" + + - name: Test OpenSSL providers after wolfprov installation + run: | + echo "Testing OpenSSL providers after wolfprov installation..." + echo "Expected: This should show wolfprov as an available provider" + + # Test openssl list -providers + if openssl list -providers; then + echo "SUCCESS: openssl list -providers works after wolfprov installation" + else + echo "FAILURE: openssl list -providers failed after wolfprov installation" + exit 1 + fi + + echo "Provider list after wolfprov installation:" + openssl list -providers + + # Check if wolfprov provider is available + if openssl list -providers | grep -i "wolfprov"; then + echo "SUCCESS: wolfprov provider is available" + else + echo "WARNING: wolfprov provider not found in provider list" + echo "This might be expected if the provider needs to be explicitly loaded" + fi + + - name: Verify wolfprov configuration + run: | + echo "Verifying wolfprov configuration..." + + # Check if configuration file exists + if [ -f /usr/lib/ssl/openssl.cnf.d/wolfprovider.conf ]; then + echo "SUCCESS: wolfprovider.conf exists" + cat /usr/lib/ssl/openssl.cnf.d/wolfprovider.conf + else + echo "WARNING: wolfprovider.conf not found" + fi + + # Check if library file exists + if [ -f /usr/lib/*/ossl-modules/libwolfprov.so ]; then + echo "SUCCESS: libwolfprov.so exists" + find /usr/lib -name "libwolfprov.so*" 2>/dev/null + else + echo "WARNING: libwolfprov.so not found" + fi + + - name: Test basic OpenSSL functionality (digests, AES, ECDH, ECC) + shell: bash + run: | + set -e + echo "Testing OpenSSL digests..." + echo "test" | openssl dgst -sha256 + echo "test" | openssl dgst -sha512 + + echo "Testing OpenSSL AES encryption/decryption..." + echo "secret" | openssl enc -aes-128-cbc -pass pass:mykey -out secret.enc + openssl enc -d -aes-128-cbc -pass pass:mykey -in secret.enc + + echo "Testing OpenSSL ECDH key generation and shared secret..." + openssl ecparam -name prime256v1 -genkey -noout -out ec1.pem + openssl ecparam -name prime256v1 -genkey -noout -out ec2.pem + openssl pkey -in ec1.pem -pubout -out ec1.pub + openssl pkey -in ec2.pem -pubout -out ec2.pub + openssl pkeyutl -derive -inkey ec1.pem -peerkey ec2.pub -out secret1.bin + openssl pkeyutl -derive -inkey ec2.pem -peerkey ec1.pub -out secret2.bin + cmp secret1.bin secret2.bin && echo "ECDH shared secrets match" + + echo "Testing OpenSSL ECC sign/verify..." + openssl ecparam -name prime256v1 -genkey -noout -out ecc_key.pem + echo "message" > msg.txt + openssl dgst -sha256 -sign ecc_key.pem -out msg.sig msg.txt + openssl dgst -sha256 -verify <(openssl pkey -in ecc_key.pem -pubout) -signature msg.sig msg.txt + + - name: Save artifacts + run: | + echo "Saving artifacts..." + ls -la /tmp/test-installation + cp -r /tmp/test-installation /tmp/artifacts + + # Save the build outputs which for use in release packages + - name: Upload package artifacts + if: always() + uses: actions/upload-artifact@v4 + with: + name: ossl-debian-packages + path: | + /tmp/test-installation/*.deb + /tmp/test-installation/*.dsc + /tmp/test-installation/*.tar.gz + retention-days: 1 + + - name: Cleanup test environment + run: | + echo "Cleaning up test environment..." + + # Uninstall test packages + apt-get remove --purge -y libwolfprov || true + apt-get autoremove -y + + echo "Cleanup completed" + diff --git a/.github/workflows/replace-default.yml b/.github/workflows/replace-default.yml deleted file mode 100644 index 4a9860e8..00000000 --- a/.github/workflows/replace-default.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: Replace Default Tests - -# START OF COMMON SECTION -on: - push: - branches: [ 'master', 'main', 'release/**' ] - pull_request: - branches: [ '*' ] - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true -# END OF COMMON SECTION - -jobs: - replace_default_test: - name: Replace Default Test - runs-on: ubuntu-22.04 - timeout-minutes: 30 - strategy: - matrix: - # Test both standard and replace-default builds - replace_default: ['', '--replace-default'] - # Test with stable versions - wolfssl_ref: ['v5.8.0-stable'] - openssl_ref: ['openssl-3.5.0'] - steps: - - name: Checkout wolfProvider - uses: actions/checkout@v4 - with: - fetch-depth: 1 - - - name: Build wolfProvider ${{ matrix.replace_default && 'with replace-default' || 'standard' }} - run: | - OPENSSL_TAG=${{ matrix.openssl_ref }} \ - WOLFSSL_TAG=${{ matrix.wolfssl_ref }} \ - ./scripts/build-wolfprovider.sh ${{ matrix.replace_default }} - - - name: Run standalone test suite - run: | - ./test/standalone/runners/run_standalone_tests.sh - - - name: Print errors on failure - if: ${{ failure() }} - run: | - # Build failure log - if [ -f scripts/build-release.log ]; then - echo "=== Build log (last 50 lines) ===" - tail -n 50 scripts/build-release.log - fi - - # Test suite failure log - if [ -f test-suite.log ]; then - echo "=== Test suite log ===" - cat test-suite.log - fi - - # Standalone test failures - if [ -d test/standalone/runners/test_results ]; then - for log in test/standalone/runners/test_results/*.log; do - if [ -f "$log" ]; then - echo "=== $log ===" - cat "$log" - fi - done - fi diff --git a/.gitignore b/.gitignore index 483d9a6c..2b2f58b9 100644 --- a/.gitignore +++ b/.gitignore @@ -109,8 +109,23 @@ debian/*.deb debian/*.buildinfo debian/files debian/libwolfprov* +debian/libssl-dev* +debian/openssl* +debian/libssl3* !debian/libwolfprov.install !debian/libwolfprov.postinst !debian/libwolfprov.postrm !debian/libwolfprov-dev.docs !debian/libwolfprov-dev.install +!debian/openssl.cnf +!debian/openssl.install +!debian/openssl.postinst +!debian/openssl.postrm +!debian/libssl3.postinst +!debian/libssl3.postrm +!debian/libssl3.install +!debian/libssl3.docs +!debian/libssl3.install +!debian/libssl3.postinst +!debian/libssl3.postrm + diff --git a/Makefile.am b/Makefile.am index 6d3e43af..d1b28091 100644 --- a/Makefile.am +++ b/Makefile.am @@ -14,14 +14,8 @@ AM_CPPFLAGS = -I$(top_srcdir)/include lib_LTLIBRARIES = libwolfprov.la -# Conditionally build libdefault.so when --replace-default is enabled -if BUILD_REPLACE_DEFAULT -# Install libdefault.la directly to OpenSSL lib directory -openssldir = $(OPENSSL_LIB_DIR) -openssl_LTLIBRARIES = libdefault.la -libdefault_la_SOURCES = src/wp_default_replace.c -libdefault_la_LIBADD = libwolfprov.la -endif +# Create only libwolfprov.so, and not .so.X.Y.Z +libwolfprov_la_LDFLAGS = -avoid-version EXTRA_DIST+=ChangeLog.md EXTRA_DIST+=README.md diff --git a/README-packaging.md b/README-packaging.md new file mode 100644 index 00000000..41581fe0 --- /dev/null +++ b/README-packaging.md @@ -0,0 +1,88 @@ +# WolfProvider Debian Packaging +This is the flow for building and installing + +## Local build + +From the repo root, run the following command: +``` +./scripts/build-wolfprovider.sh --debian +``` + +For a FIPS build, run the following: +``` +./scripts/build-wolfprovider.sh --debian --enable-fips +``` + +The Debian packages are placed in the parent directory, which should be one level above the repo root. + +## CI build +Instead of doing a local build as outlined above, we can alternatively use packages generated from CI. + +To use a build from CI for local install, download the artifacts from the Debian CI job. Then install the .deb's from the zip file with `apt` as shown below rather than from the build. + +## Install + +If not already done, install the WolfSSL Debian package. The non-FIPS version is available in this repo and is installed by the script below. This step is only needed once, and can be done prior to the `build-wolfprovider.sh` step above. +``` +./debian/install-wolfssl.sh ./.github/packages/debian-wolfssl.tar.gz +``` + +For the script above, some systems may require additional packages: +``` +apt install build-essential devscripts dh-exec +``` + +### Optionally install custom OpenSSL + +**Important**: before proceeding with the wolfProvider install, make sure packages are not present: +``` +apt purge -y libwolfprov ; apt purge -y openssl-config ; apt purge -y openssl ; apt purge -y libssl3 +``` + +Get the system architecture which determines the library paths for the following steps: +``` +export CURRENT_ARCH=$(dpkg --print-architecture) +``` + +Then install the wolfProvider-specific OpenSSL. From the repo root: +``` +apt install ../openssl*${CURRENT_ARCH}*.deb ../libssl3*${CURRENT_ARCH}*.deb +``` + +Check that the provider API is disabled since wolfProvider is not installed: +``` +$ openssl list -providers +Could not load libwolfprov.so. Is the libwolfprov package installed? + libwolfprov.so: cannot open shared object file: No such file or directory +``` + +### Install wolfProvider + +Then install wolfProvider: +``` +apt install ../libwolfprov*${CURRENT_ARCH}*.deb +``` + +Confirm that wolfProvider is installed: +``` +$ openssl list -providers +``` + +Output should look like this: +``` +Providers: + default + name: wolfSSL Provider + version: 1.0.2 + status: active +``` + +## Release process +Always use CI to perform the release build to avoid potential errors from building locally. + +* Tag the wolfProvider repo in the format `vX.Y.Z` + * The changelog is generated by the Debian scripts +* Run the Debian job in CI +* Download the artifacts zip file which contains the .deb's +* Generate release archives as needed + diff --git a/README.md b/README.md index 99f6fe6a..342a1b27 100644 --- a/README.md +++ b/README.md @@ -78,12 +78,6 @@ To remove all source directories, use the following: ./scripts/build-wolfprovider.sh --distclean ``` -To build a Debian package file, use the following command. -Note this will remove all ignored files in the repo, and there must be no staged changes. -``` -./scripts/build-wolfprovider.sh --debian -``` - Alternatively, you can manually compile each component using the following guide. ### OpenSSL diff --git a/debian/clean b/debian/clean new file mode 100644 index 00000000..fb82819e --- /dev/null +++ b/debian/clean @@ -0,0 +1 @@ +wolfProvider/scripts/build-release.log diff --git a/debian/compat b/debian/compat deleted file mode 100644 index 48082f72..00000000 --- a/debian/compat +++ /dev/null @@ -1 +0,0 @@ -12 diff --git a/debian/control b/debian/control index 1f0a18d8..992b65e4 100644 --- a/debian/control +++ b/debian/control @@ -3,23 +3,25 @@ Section: libs Priority: optional Maintainer: WolfSSL Standards-Version: 4.6.2 -Build-Depends: debhelper (>= 12), - devscripts, - pkgconf, - openssl, - libwolfssl, - libwolfssl-dev - +Rules-Requires-Root: no +Build-Depends: + debhelper-compat (= 13), + devscripts, + dh-exec, + openssl, + git, + pkgconf, + libwolfssl-dev Package: libwolfprov Architecture: any +Multi-Arch: same Depends: ${shlibs:Depends}, ${misc:Depends}, libssl3 (>= 3.0.3), libwolfssl (>= 5.8.2), openssl Provides: ${variant:provides} XB-Variant: ${variant} Description: wolfProvider library for OpenSSL — ${variant:desc} wolfProvider is a library that can be used as a Provider in OpenSSL. It provides cryptographic functionality through wolfSSL including: - . * Hash functions (MD5, SHA-1, SHA-2, SHA-3) * Symmetric encryption (AES, DES) * Asymmetric cryptography (RSA, ECC, DH) @@ -31,7 +33,40 @@ Description: wolfProvider library for OpenSSL — ${variant:desc} Package: libwolfprov-dev Architecture: any Section: libdevel +Multi-Arch: same Depends: libwolfprov (= ${binary:Version}), ${misc:Depends} -Description: Development files for wolfProvider - This package contains the header files and development libraries - needed to build applications using wolfProvider. +XB-Variant: ${variant} +Description: Development files for wolfProvider — ${variant:desc} + This package contains the headers and development files + for applications using wolfProvider. + +Package: openssl +Architecture: any +Section: utils +Multi-Arch: foreign +Depends: ${shlibs:Depends}, ${misc:Depends} +Description: Secure Sockets Layer toolkit - command line interface + This package contains the OpenSSL command line utility. + Built for use with wolfProvider. + +Package: libssl3 +Architecture: any +Multi-Arch: same +Depends: libssl3 (= ${binary:Version}), ${misc:Depends} +Breaks: libssl3 (<< 3.0.0) +Replaces: libssl3 +Recommends: openssl +Description: OpenSSL shared libraries (wolfProvider build) + This package contains the OpenSSL shared libraries built + for use with wolfProvider. + +Package: libssl-dev +Architecture: any +Section: libdevel +Multi-Arch: same +Depends: libssl3 (= ${binary:Version}), ${misc:Depends} +Breaks: libssl-dev (<< 3.0.0) +Replaces: libssl-dev +Description: OpenSSL development files (wolfProvider build) + This package contains headers, pkg-config files and linker symlinks + for the OpenSSL version built for wolfProvider. diff --git a/debian/install-wolfssl.sh b/debian/install-wolfssl.sh new file mode 100755 index 00000000..440a9c79 --- /dev/null +++ b/debian/install-wolfssl.sh @@ -0,0 +1,126 @@ +#!/bin/bash + +# Script to install wolfSSL packages for Debian +# Checks if packages are already installed and installs appropriate architecture-specific packages + +set -e + +# Function to check if packages are installed +check_packages_installed() { + if dpkg -l | grep -q "^ii.*libwolfssl " && dpkg -l | grep -q "^ii.*libwolfssl-dev "; then + echo "libwolfssl and libwolfssl-dev packages are already installed" + dpkg -l | grep wolfssl + return 0 + else + return 1 + fi +} + +# Function to install wolfSSL packages +install_wolfssl_packages() { + local wolfssl_tar_path="$1" + local dest_dir="$2" + + if [ ! -f "$wolfssl_tar_path" ]; then + echo "Error: wolfSSL package archive not found at $wolfssl_tar_path" + exit 1 + fi + + # If no destination directory specified, create one using mktemp + if [ -z "$dest_dir" ]; then + dest_dir=$(mktemp -d) + echo "No destination directory specified, created temporary directory: $dest_dir" + else + echo "Using specified destination directory: $dest_dir" + # Create the directory if it doesn't exist + mkdir -p "$dest_dir" + fi + + echo "Extracting wolfSSL package to: $dest_dir" + tar -xvf "$wolfssl_tar_path" -C "$dest_dir" + + # Get current architecture + CURRENT_ARCH=$(dpkg --print-architecture) + echo "Current architecture: $CURRENT_ARCH" + + # Look for existing .deb files that match the current architecture + cd "$dest_dir/debian-packages" + MATCHING_DEB_FILES=$(find . -name "*_${CURRENT_ARCH}.deb" -o -name "*_${CURRENT_ARCH}_*.deb" 2>/dev/null || true) + + if [ -n "$MATCHING_DEB_FILES" ]; then + echo "Found matching .deb files for architecture $CURRENT_ARCH:" + echo "$MATCHING_DEB_FILES" + echo "Installing existing .deb files..." + + # Install both libwolfssl and libwolfssl-dev packages for the current architecture + LIBWOLFSSL_DEB=$(echo "$MATCHING_DEB_FILES" | grep "libwolfssl_[^-]" | head -n1) + LIBWOLFSSL_DEV_DEB=$(echo "$MATCHING_DEB_FILES" | grep "libwolfssl-dev_" | head -n1) + + if [ -n "$LIBWOLFSSL_DEB" ]; then + echo "Installing libwolfssl package: $LIBWOLFSSL_DEB" + dpkg -i "$LIBWOLFSSL_DEB" + else + echo "No libwolfssl package found for architecture $CURRENT_ARCH" + exit 1 + fi + + if [ -n "$LIBWOLFSSL_DEV_DEB" ]; then + echo "Installing libwolfssl-dev package: $LIBWOLFSSL_DEV_DEB" + dpkg -i "$LIBWOLFSSL_DEV_DEB" + else + echo "No libwolfssl-dev package found for architecture $CURRENT_ARCH" + exit 1 + fi + else + echo "No matching .deb files found for architecture $CURRENT_ARCH, rebuilding from source..." + dpkg-source -x wolfssl*.dsc + cd wolfssl*/ + dpkg-buildpackage -b -us -uc + + # Install both libwolfssl and libwolfssl-dev packages + LIBWOLFSSL_DEB=$(find .. -name "libwolfssl_*${CURRENT_ARCH}.deb" | grep -v "dev" | head -n1) + LIBWOLFSSL_DEV_DEB=$(find .. -name "libwolfssl-dev*_${CURRENT_ARCH}.deb" | head -n1) + + if [ -n "$LIBWOLFSSL_DEB" ]; then + echo "Installing libwolfssl package: $LIBWOLFSSL_DEB" + dpkg -i "$LIBWOLFSSL_DEB" + else + echo "No libwolfssl package found after building for architecture $CURRENT_ARCH" + exit 1 + fi + + if [ -n "$LIBWOLFSSL_DEV_DEB" ]; then + echo "Installing libwolfssl-dev package: $LIBWOLFSSL_DEV_DEB" + dpkg -i "$LIBWOLFSSL_DEV_DEB" + else + echo "No libwolfssl-dev package found after building for architecture $CURRENT_ARCH" + exit 1 + fi + fi +} + +# Main execution +main() { + local wolfssl_tar_path="$1" + local dest_dir="$2" + + if [ -z "$wolfssl_tar_path" ]; then + echo "Usage: $0 [destination-directory]" + echo " If destination-directory is not specified, a temporary directory will be created using mktemp" + exit 1 + fi + + echo "Checking if wolfSSL packages are already installed..." + if check_packages_installed; then + echo "Packages already installed, exiting successfully" + exit 0 + fi + + echo "Installing wolfSSL packages..." + install_wolfssl_packages "$wolfssl_tar_path" "$dest_dir" + + echo "WolfSSL installation completed successfully" +} + +# Run main function with all arguments +main "$@" diff --git a/debian/libssl-dev.install b/debian/libssl-dev.install new file mode 100755 index 00000000..049ee3ed --- /dev/null +++ b/debian/libssl-dev.install @@ -0,0 +1,7 @@ +#!/usr/bin/dh-exec +usr/include/openssl/** +usr/lib/${DEB_HOST_MULTIARCH}/libcrypto.so +usr/lib/${DEB_HOST_MULTIARCH}/libssl.so +usr/lib/${DEB_HOST_MULTIARCH}/pkgconfig/openssl.pc +usr/lib/${DEB_HOST_MULTIARCH}/pkgconfig/libcrypto.pc +usr/lib/${DEB_HOST_MULTIARCH}/pkgconfig/libssl.pc \ No newline at end of file diff --git a/debian/libssl3.install b/debian/libssl3.install new file mode 100644 index 00000000..fcc40907 --- /dev/null +++ b/debian/libssl3.install @@ -0,0 +1,2 @@ +usr/lib/*/libcrypto.so.3 +usr/lib/*/libssl.so.3 diff --git a/debian/libwolfprov.install b/debian/libwolfprov.install index d2e32928..e0f5fd99 100644 --- a/debian/libwolfprov.install +++ b/debian/libwolfprov.install @@ -1,3 +1,3 @@ usr/lib/*/ossl-modules/libwolfprov.so* -etc/ssl/openssl.cnf.d/ -etc/ssl/openssl.cnf.d/wolfprovider.conf +usr/lib/ssl/openssl.cnf.d +usr/lib/ssl/openssl.cnf.d/wolfprovider.conf diff --git a/debian/libwolfprov.postinst b/debian/libwolfprov.postinst index 4755e4ba..49ad68f2 100755 --- a/debian/libwolfprov.postinst +++ b/debian/libwolfprov.postinst @@ -1,12 +1,42 @@ #!/bin/sh set -e -CONF_FILE="/etc/ssl/openssl.cnf" -INCLUDE_LINE=".include /etc/ssl/openssl.cnf.d/" +INCLUDE_LINE=".include /usr/lib/ssl/openssl.cnf.d/wolfprovider.conf" +CONF_FILE="/usr/lib/ssl/openssl.cnf" +CONF_DEFAULT="/usr/share/openssl-defaults/openssl.cnf" -if ! grep -qF "$INCLUDE_LINE" "$CONF_FILE"; then - echo "Adding include for wolfprovider..." +# Copy from our template if it doesn't exist +if [ ! -f "$CONF_FILE" ]; then + echo "Config file does not exist: $CONF_FILE" + if [ -f "$CONF_DEFAULT" ]; then + install -Dm644 "$CONF_DEFAULT" "$CONF_FILE" + else + echo "Default config file does not exist: $CONF_DEFAULT" + exit 1 + fi +fi + +# Add include for wolfprovider config file if not already present +if grep -qF "$INCLUDE_LINE" "$CONF_FILE"; then + echo "Include line already exists in $CONF_FILE" +else + echo "Adding include for wolfprovider to $CONF_FILE..." sed -i "/^openssl_conf/ a $INCLUDE_LINE" "$CONF_FILE" fi +# Link /usr/lib/$(DEB_HOST_MULTIARCH)/ossl-modules/libwolfprov.so to /usr/lib/$(DEB_HOST_MULTIARCH)/ +# This is needed for the custom openssl build where libwolfprov is a normal module +# Todo: this could possibly be done with a .links file in debian/ +DEB_HOST_MULTIARCH=$(dpkg-architecture -qDEB_HOST_MULTIARCH) +# Loop through /usr/lib/$(DEB_HOST_MULTIARCH)/ossl-modules/libwolfprov.so* and create the link +for file in "/usr/lib/${DEB_HOST_MULTIARCH}/ossl-modules/libwolfprov.so"*; do + # use the same extension as the original file + extension="${file##*.}" + if [ -f "$file" ]; then + echo "Linking $file to /usr/lib/${DEB_HOST_MULTIARCH}/ossl-modules/libwolfprov.$extension" + ln -sf "$file" "/usr/lib/${DEB_HOST_MULTIARCH}/libwolfprov.$extension" + fi +done + +#DEBHELPER# exit 0 diff --git a/debian/libwolfprov.postrm b/debian/libwolfprov.postrm index 48e6e07b..9c12481b 100755 --- a/debian/libwolfprov.postrm +++ b/debian/libwolfprov.postrm @@ -3,7 +3,12 @@ set -e case "$1" in remove|purge) - rm -f /etc/ssl/openssl.cnf.d/wolfprovider.conf - rmdir /etc/ssl/openssl.cnf.d 2>/dev/null || true + DEB_HOST_MULTIARCH=$(dpkg-architecture -qDEB_HOST_MULTIARCH) + rm -f /usr/lib/ssl/openssl.cnf.d/wolfprovider.conf + rm -f /usr/lib/${DEB_HOST_MULTIARCH}/ossl-modules/libwolfprov.so* + rm -f /usr/lib/${DEB_HOST_MULTIARCH}/libwolfprov.so* ;; esac + +#DEBHELPER# +exit 0 diff --git a/debian/openssl.install b/debian/openssl.install new file mode 100644 index 00000000..dc8bc1fc --- /dev/null +++ b/debian/openssl.install @@ -0,0 +1,2 @@ +usr/bin/openssl +usr/share/openssl-defaults/openssl.cnf diff --git a/debian/openssl.postinst b/debian/openssl.postinst new file mode 100644 index 00000000..6b12047c --- /dev/null +++ b/debian/openssl.postinst @@ -0,0 +1,19 @@ +#!/bin/sh +set -e + +CONF_FILE="/usr/lib/ssl/openssl.cnf" +CONF_DEFAULT="/usr/share/openssl-defaults/openssl.cnf" + +# Copy from our template if it doesn't exist +if [ ! -f "$CONF_FILE" ]; then + echo "Config file does not exist: $CONF_FILE" + if [ -f "$CONF_DEFAULT" ]; then + install -Dm644 "$CONF_DEFAULT" "$CONF_FILE" + else + echo "Default config file does not exist: $CONF_DEFAULT" + exit 1 + fi +fi + +#DEBHELPER# +exit 0 \ No newline at end of file diff --git a/debian/openssl.postrm b/debian/openssl.postrm new file mode 100644 index 00000000..ffb449dd --- /dev/null +++ b/debian/openssl.postrm @@ -0,0 +1,11 @@ +#!/bin/sh +set -e + +case "$1" in + remove|purge) + rm -rf /usr/share/openssl-defaults + ;; +esac + +#DEBHELPER# +exit 0 diff --git a/debian/rules b/debian/rules index 763638ee..284884b5 100755 --- a/debian/rules +++ b/debian/rules @@ -1,7 +1,7 @@ #!/usr/bin/make -f %: - dh $@ --with autoreconf + dh $@ # Multiarch triplet DEB_HOST_MULTIARCH := $(shell dpkg-architecture -qDEB_HOST_MULTIARCH) @@ -11,6 +11,9 @@ DESTDIR=debian/tmp # Grab the base version from debian/changelog BASEVER := $(shell dpkg-parsechangelog -SVersion) +# Get OpenSSL version from the build (this will be set after build) +OPENSSL_VERSION ?= 3.5.0 + # Check if FIPS build is requested WOLFSSL_ISFIPS?=0 # Variant-specific metadata @@ -30,44 +33,108 @@ else FIPS_FLAG := endif -# Override just the control-file generation to inject our values -override_dh_gencontrol: - dh_gencontrol -- \ - -v$(VERSION) \ - -Vvariant=$(VARIANT) \ - -Vvariant:desc="$(VARIANT_DESC)" \ - -Vvariant:provides="$(VARIANT_PROVIDES)" - override_dh_auto_configure: # None, handled below override_dh_auto_build: - ./scripts/build-wolfprovider.sh $(FIPS_FLAG) + # Always build OpenSSL with wolfProvider as the default provider + WOLFPROV_BUILD_DEBIAN=1 ./scripts/build-wolfprovider.sh --replace-default $(FIPS_FLAG) override_dh_auto_install: - # Install library + # Detect OpenSSL library directory (lib or lib64) + $(eval OPENSSL_LIB_DIR := $(shell if test -d ./openssl-install/lib; then echo lib; elif test -d ./openssl-install/lib64; then echo lib64; else echo "ERROR: Neither ./openssl-install/lib nor ./openssl-install/lib64 found"; exit 1; fi)) + + # Install OpenSSL binary for openssl package + install -d $(DESTDIR)/usr/bin + install -m755 ./openssl-install/bin/openssl \ + $(DESTDIR)/usr/bin/ + + # Install OpenSSL shared libraries for libssl3 package + install -d $(DESTDIR)/usr/lib/$(DEB_HOST_MULTIARCH) + install -m755 ./openssl-install/$(OPENSSL_LIB_DIR)/libssl.so* \ + ./openssl-install/$(OPENSSL_LIB_DIR)/libcrypto.so* \ + $(DESTDIR)/usr/lib/$(DEB_HOST_MULTIARCH)/ + + # Install OpenSSL headers and dev files for libssl-dev package + # Copy directly to the destination directory + install -d $(DESTDIR)/usr/include/openssl + cp -a $(CURDIR)/openssl-install/include/openssl/. $(DESTDIR)/usr/include/openssl + + # Install wolfProvider library install -d $(DESTDIR)/usr/lib/$(DEB_HOST_MULTIARCH)/ossl-modules install -m755 ./.libs/libwolfprov.so* \ $(DESTDIR)/usr/lib/$(DEB_HOST_MULTIARCH)/ossl-modules/ - # Install headers + # Install wolfProvider headers install -d $(DESTDIR)/usr/include/wolfprovider install -m644 ./include/wolfprovider/*.h \ $(DESTDIR)/usr/include/wolfprovider/ # Install provider config file - install -d $(DESTDIR)/etc/ssl/openssl.cnf.d + install -d $(DESTDIR)/usr/lib/ssl/openssl.cnf.d install -m644 ./$(PROVIDER_CONF) \ - $(DESTDIR)/etc/ssl/openssl.cnf.d/wolfprovider.conf + $(DESTDIR)/usr/lib/ssl/openssl.cnf.d/wolfprovider.conf + + # Install default openssl.cnf template (do NOT ship it directly in /usr/lib/ssl) + # The postinstall script will handle copying it to the system location + install -d $(DESTDIR)/usr/share/openssl-defaults + install -m 0644 ./openssl-source/apps/openssl.cnf \ + $(DESTDIR)/usr/share/openssl-defaults/openssl.cnf + + # Install pkg-config files for libssl-dev + install -d $(DESTDIR)/usr/lib/$(DEB_HOST_MULTIARCH)/pkgconfig + install -m644 ./openssl-install/$(OPENSSL_LIB_DIR)/pkgconfig/*.pc \ + $(DESTDIR)/usr/lib/$(DEB_HOST_MULTIARCH)/pkgconfig/ + # Normalize .pc to system paths + sed -i -e 's|^prefix=.*|prefix=/usr|' \ + -e 's|^exec_prefix=.*|exec_prefix=${prefix}|' \ + -e 's|^libdir=.*|libdir=/usr/lib/$(DEB_HOST_MULTIARCH)|' \ + -e 's|^includedir=.*|includedir=/usr/include|' \ + -e 's|^enginesdir=.*|enginesdir=/usr/lib/$(DEB_HOST_MULTIARCH)/engines-3|' \ + -e 's|^modulesdir=.*|modulesdir=/usr/lib/$(DEB_HOST_MULTIARCH)/ossl-modules|' \ + $(DESTDIR)/usr/lib/$(DEB_HOST_MULTIARCH)/pkgconfig/*.pc + +override_dh_makeshlibs: + # Create shlibs only for real SONAME’d libs; skip provider modules under ossl-modules/ + dh_makeshlibs -V -p libssl3 + # do NOT run on libwolfprov (plugin-only, no SONAME) + +override_dh_gencontrol: + # Generate control for wolfProvider packages + dh_gencontrol -- \ + -v$(VERSION) \ + -Vvariant=$(VARIANT) \ + -Vvariant:desc="$(VARIANT_DESC)" \ + -Vvariant:provides="$(VARIANT_PROVIDES)" + + # Detect OpenSSL library directory (lib or lib64) + $(eval OPENSSL_LIB_DIR := $(shell if test -d ./openssl-install/lib; then echo lib; elif test -d ./openssl-install/lib64; then echo lib64; else echo "ERROR: Neither ./openssl-install/lib nor ./openssl-install/lib64 found"; exit 1; fi)) + + # Extract OpenSSL version from the current build + $(eval OPENSSL_VERSION := $(shell LD_LIBRARY_PATH=./openssl-install/$(OPENSSL_LIB_DIR):./wolfprovider-install/lib ./openssl-install/bin/openssl version | cut -d' ' -f2)) + + # Generate control for OpenSSL packages with OpenSSL version + dh_gencontrol -popenssl -- \ + -v$(OPENSSL_VERSION)-1 \ + -Vopenssl:Version=$(OPENSSL_VERSION) + dh_gencontrol -plibssl3 -- \ + -v$(OPENSSL_VERSION)-1 \ + -Vopenssl:Version=$(OPENSSL_VERSION) + dh_gencontrol -plibssl-dev -- \ + -v$(OPENSSL_VERSION)-1 \ + -Vopenssl:Version=$(OPENSSL_VERSION) override_dh_auto_clean: dh_auto_clean + rm -rf test/standalone/tests/.libs ./scripts/build-wolfprovider.sh --clean --distclean override_dh_auto_test: @echo "Skipping dh_auto_test (tests already run during build phase)" -# Avoid warnings of the form package-has-unnecessary-activation-of-ldconfig-trigger -override_dh_makeshlibs: - dh_makeshlibs -n +override_dh_install: + dh_install +# Fail the build if anything in debian/tmp (or elsewhere) wasn’t picked up +override_dh_missing: + dh_missing --fail-missing diff --git a/debian/tests/bind9.sh b/debian/tests/bind9.sh new file mode 100755 index 00000000..ea59e6ab --- /dev/null +++ b/debian/tests/bind9.sh @@ -0,0 +1,54 @@ +#!/usr/bin/env bash +set -Eeuo pipefail + +ALG="${1:-ecdsa}" # ecdsa | rsa | both +ZONENAME="smoke.test" # no trailing dot for args +ZFILE="zone.db" + +mk_zone_dir() { + local dir="$1" + mkdir -p "$dir" + cat >"$dir/$ZFILE" <<'ZONE' +$ORIGIN smoke.test. +$TTL 300 +@ IN SOA ns.smoke.test. hostmaster.smoke.test. ( 1 3600 600 604800 300 ) + IN NS ns.smoke.test. +ns IN A 127.0.0.1 +www IN A 127.0.0.1 +ZONE +} + +sign_one() { + local algo="$1" dir + dir="$(mktemp -d)"; echo "work dir: $dir" + mk_zone_dir "$dir" + pushd "$dir" >/dev/null + + case "$algo" in + ecdsa) + dnssec-keygen -a ECDSAP256SHA256 -b 256 -n ZONE -f KSK "$ZONENAME" >/dev/null + dnssec-keygen -a ECDSAP256SHA256 -b 256 -n ZONE "$ZONENAME" >/dev/null + ;; + rsa) + dnssec-keygen -a RSASHA256 -b 2048 -n ZONE -f KSK "$ZONENAME" >/dev/null + dnssec-keygen -a RSASHA256 -b 2048 -n ZONE "$ZONENAME" >/dev/null + ;; + esac + + # Import/publish keys and sign (no need to $INCLUDE) + dnssec-signzone -v 5 -S -K "$PWD" -o "$ZONENAME" "$ZFILE" >"sign-$algo.log" 2>&1 || { + echo "FAIL: [$algo] signing failed"; sed -n '1,200p' "sign-$algo.log"; exit 1; } + + dnssec-verify -o "$ZONENAME" "$ZFILE.signed" >"verify-$algo.log" 2>&1 && \ + echo "PASS: [$algo] sign+verify OK" || { echo "FAIL verify"; sed -n '1,200p' "verify-$algo.log"; exit 1; } + + popd >/dev/null + echo "kept: $dir" +} + +case "${ALG,,}" in + ecdsa) sign_one ecdsa ;; + rsa) sign_one rsa ;; + both) sign_one ecdsa; sign_one rsa ;; + *) echo "usage: $0 [ecdsa|rsa|both]"; exit 2 ;; +esac diff --git a/debian/tests/cjose.sh b/debian/tests/cjose.sh new file mode 100755 index 00000000..0d04ec75 --- /dev/null +++ b/debian/tests/cjose.sh @@ -0,0 +1,2 @@ +cc -O2 -o cjose_smoke cjose_smoke.c $(pkg-config --cflags --libs cjose) && \ +./cjose_smoke; rm -f cjose_smoke || true diff --git a/debian/tests/cjose_smoke.c b/debian/tests/cjose_smoke.c new file mode 100644 index 00000000..5397190d --- /dev/null +++ b/debian/tests/cjose_smoke.c @@ -0,0 +1,31 @@ +#include +#include +#include + +int main(void) { + cjose_err err = {0}; + // 32-byte HMAC key (octet JWK) + uint8_t key[32]; for (int i=0;i<32;i++) key[i]=(uint8_t)i; + cjose_jwk_t *jwk = cjose_jwk_create_oct_spec(key, sizeof(key), &err); + + cjose_header_t *hdr = cjose_header_new(&err); + cjose_header_set(hdr, CJOSE_HDR_ALG, CJOSE_HDR_ALG_HS256, &err); + + const char *msg = "hello cjose"; + cjose_jws_t *jws = cjose_jws_sign(jwk, hdr, (const uint8_t*)msg, strlen(msg), &err); + + const char *compact = NULL; + cjose_jws_export(jws, &compact, &err); + + cjose_jws_t *parsed = cjose_jws_import(compact, strlen(compact), &err); + if (!cjose_jws_verify(parsed, jwk, &err)) return 2; + + uint8_t *pt = NULL; size_t pt_len = 0; + cjose_jws_get_plaintext(parsed, &pt, &pt_len, &err); + + int ok = (pt_len == strlen(msg) && memcmp(pt, msg, pt_len) == 0); + cjose_jws_release(parsed); cjose_jws_release(jws); cjose_header_release(hdr); cjose_jwk_release(jwk); + if (!ok) return 3; + puts("OK: cjose JWS HS256 sign+verify"); + return 0; +} diff --git a/debian/tests/curl.sh b/debian/tests/curl.sh new file mode 100755 index 00000000..f63d61c8 --- /dev/null +++ b/debian/tests/curl.sh @@ -0,0 +1,75 @@ +#!/usr/bin/env bash +set -Eeuo pipefail + +URL="https://example.com" +INCLUDE_LEGACY=0 # add CBC-only suites if requested + +# --- args: [--legacy] [URL] --- +for a in "$@"; do + case "$a" in + --legacy) INCLUDE_LEGACY=1 ;; + http://*|https://*) URL="$a" ;; + *) URL="$a" ;; + esac +done + +# Require curl linked with OpenSSL +if ! curl -V | grep -q 'OpenSSL'; then + echo "SKIP: this curl is not OpenSSL-backed"; exit 2 +fi + +run_case() { + local name="$1"; shift + local tls_line verify rc + if tls_line="$(curl -q -fsS -o /dev/null -v "$URL" "$@" 2>&1 | awk '/SSL connection using/{sub(/.*using /,""); print; exit}')"; then + verify="$(curl -q -fsS -o /dev/null -w '%{ssl_verify_result}' "$URL" "$@")" + if [ "$verify" = "0" ]; then + printf 'PASS %-30s %s\n' "[$name]" "$tls_line" + else + printf 'FAIL %-30s verify=%s (%s)\n' "[$name]" "$verify" "$tls_line" + return 1 + fi + else + rc=$? + printf 'FAIL %-30s curl exit=%s (likely no overlap)\n' "[$name]" "$rc" + return "$rc" + fi +} + +echo "Target: $URL" +echo "curl: $(curl -V | head -n1)" +echo "(CHACHA20 suites intentionally excluded)" + +# 0) Default handshake (server's choice) +run_case "default" || true + +# 1) TLS 1.3 (all TLS1.3 suites use (EC)DHE KEX; choose AES-GCM only) +run_case "tls13 AES128-GCM" --tlsv1.3 --tls-max 1.3 \ + --tls13-ciphers TLS_AES_128_GCM_SHA256 || true +run_case "tls13 AES256-GCM" --tlsv1.3 --tls-max 1.3 \ + --tls13-ciphers TLS_AES_256_GCM_SHA384 || true + +# 2) TLS 1.2 ECDHE (Elliptic-Curve Diffie-Hellman Ephemeral) — AES-GCM +run_case "tls12 ECDHE AES128-GCM" --tlsv1.2 --tls-max 1.2 \ + --ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256' || true +run_case "tls12 ECDHE AES256-GCM" --tlsv1.2 --tls-max 1.2 \ + --ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384' || true + +# 3) TLS 1.2 classic DHE (finite-field Diffie-Hellman) — AES-GCM +run_case "tls12 DHE AES128-GCM" --tlsv1.2 --tls-max 1.2 \ + --ciphers 'DHE-RSA-AES128-GCM-SHA256' || true +run_case "tls12 DHE AES256-GCM" --tlsv1.2 --tls-max 1.2 \ + --ciphers 'DHE-RSA-AES256-GCM-SHA384' || true + +# 4) Optional legacy CBC (often disabled server-side) +if [ "$INCLUDE_LEGACY" -eq 1 ]; then + run_case "tls12 ECDHE AES128-CBC" --tlsv1.2 --tls-max 1.2 \ + --ciphers 'ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA' || true + run_case "tls12 ECDHE AES256-CBC" --tlsv1.2 --tls-max 1.2 \ + --ciphers 'ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA' || true + run_case "tls12 DHE AES128-CBC" --tlsv1.2 --tls-max 1.2 \ + --ciphers 'DHE-RSA-AES128-SHA' || true + run_case "tls12 DHE AES256-CBC" --tlsv1.2 --tls-max 1.2 \ + --ciphers 'DHE-RSA-AES256-SHA' || true +fi + diff --git a/debian/tests/iperf.sh b/debian/tests/iperf.sh new file mode 100755 index 00000000..5d4c2e3d --- /dev/null +++ b/debian/tests/iperf.sh @@ -0,0 +1,65 @@ +#!/usr/bin/env bash + +# iperf3-auth-smoke.sh +set -Eeuo pipefail + +PORT="$(shuf -i 42000-49000 -n1)" +tmp="$(mktemp -d)"; srv= +cleanup(){ [[ -n "$srv" ]] && kill "$srv" 2>/dev/null || true; rm -rf "$tmp"; } +trap cleanup EXIT + +echo "tmp: $tmp port: $PORT" + +# 1) Keys and user DB +openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out "$tmp/priv.pem" >/dev/null +openssl pkey -in "$tmp/priv.pem" -pubout > "$tmp/pub.pem" 2>/dev/null + +user=alice; pass=secret +hash="$(printf "{%s}%s" "$user" "$pass" | sha256sum | awk '{print $1}')" +printf "# username,sha256\n%s,%s\n" "$user" "$hash" > "$tmp/users.csv" + +# 2) Start server (debug so it logs auth) and wait for it to bind +iperf3 -s -1 -d -p "$PORT" \ + --rsa-private-key-path "$tmp/priv.pem" \ + --authorized-users-path "$tmp/users.csv" \ + >"$tmp/server.log" 2>&1 & +srv=$! + +for i in {1..20}; do + sleep 0.1 + ss -Huan | awk '{print $5}' | grep -qE "127\.0\.0\.1:$PORT" && break || true +done + +# helper: run a client once and return exit code +run_client() { + local pw="$1" + IPERF3_PASSWORD="$pw" \ + iperf3 -c 127.0.0.1 -p "$PORT" -t 1 \ + --username "$user" --rsa-public-key-path "$tmp/pub.pem" \ + --json >"$tmp/client.json" 2>"$tmp/client.err" || return $? +} + +# 3) Positive case (correct password) +if run_client "$pass"; then + echo "PASS(positive): client completed with correct password" +else + echo "FAIL: client failed with correct password" + echo "--- server.log (tail) ---"; tail -n 50 "$tmp/server.log" + echo "--- client.err ---"; cat "$tmp/client.err" + exit 1 +fi + +# 4) Negative case (wrong password must fail) +if run_client "WRONG-password"; then + echo "FAIL: client unexpectedly succeeded with wrong password" + echo "--- server.log (tail) ---"; tail -n 50 "$tmp/server.log" + exit 1 +else + echo "PASS(negative): client failed with wrong password (auth enforced)" +fi + +# 5) Optional: show explicit auth lines from server debug +echo "--- auth lines from server.log ---" +grep -i 'auth' "$tmp/server.log" || echo "(no explicit lines; depends on build verbosity)" + +echo "OK: iperf3 auth smoke test completed." diff --git a/debian/tests/kmod.sh b/debian/tests/kmod.sh new file mode 100755 index 00000000..fc68b3d1 --- /dev/null +++ b/debian/tests/kmod.sh @@ -0,0 +1,112 @@ +#!/usr/bin/env bash +set -Eeuo pipefail + +# kmod/OpenSSL signature smoke test +# Builds a tiny .ko, signs it with your OpenSSL, and has modinfo parse the signature. +# Assumes your provider/config is already selected outside this script (OPENSSL_CONF, LD_LIBRARY_PATH, etc). + +# --- Options you can override --- +: "${OPENSSL_DIR:=}" # e.g. /usr/local/openssl/bin (prepends to PATH so sign-file uses your openssl) +: "${KEY_BITS:=2048}" # RSA key size +: "${HASH_ALGO:=sha256}" # sign-file hash (sha256/sha384/sha512) +: "${CN:=kmod-smoke}" # x509 CN for the self-signed cert +: "${KEEP:=0}" # set KEEP=1 to keep the temp workdir + +# --- Setup workspace --- +work="$(mktemp -d)" +cleanup(){ [[ "${KEEP}" = "1" ]] && { echo "Keeping workdir: $work"; return; }; rm -rf "$work"; } +trap cleanup EXIT + +[[ -n "$OPENSSL_DIR" ]] && export PATH="$OPENSSL_DIR:$PATH" + +echo "=== kmod signature smoke ===" +echo "workdir: $work" +echo "OPENSSL in use: $(command -v openssl || true)" +openssl version || true +echo + +# --- Preconditions --- +need() { command -v "$1" >/dev/null 2>&1 || { echo "Missing: $1"; exit 1; }; } +need make +need modinfo + +build_dir="/lib/modules/$(uname -r)/build" +if [[ ! -e "$build_dir" ]]; then + echo "ERROR: kernel headers not found at $build_dir." + echo "Debian/Ubuntu: sudo apt-get install build-essential linux-headers-$(uname -r)" + exit 1 +fi + +sign_file="$build_dir/scripts/sign-file" +if [[ ! -x "$sign_file" ]]; then + echo "ERROR: sign-file not found at $sign_file" + echo "Install proper kernel headers; sign-file ships with the kernel tree." + exit 1 +fi + +# --- Create module sources --- +cat > "$work/kmod_smoke.c" <<'EOF' +#include +#include +MODULE_LICENSE("GPL"); +MODULE_AUTHOR("kmod-smoke"); +MODULE_DESCRIPTION("kmod signature smoke test module"); +MODULE_VERSION("1.0"); +static int __init kmod_smoke_init(void) { return 0; } +static void __exit kmod_smoke_exit(void) {} +module_init(kmod_smoke_init); +module_exit(kmod_smoke_exit); +EOF + +cat > "$work/Makefile" <<'EOF' +obj-m += kmod_smoke.o +all: + $(MAKE) -C /lib/modules/$(shell uname -r)/build M=$(PWD) modules +clean: + $(MAKE) -C /lib/modules/$(shell uname -r)/build M=$(PWD) clean +EOF + +# --- Build the module (no insert) --- +echo "Building module..." +make -C "$work" -s + +ko="$work/kmod_smoke.ko" +[[ -f "$ko" ]] || { echo "Build failed: $ko not found"; exit 1; } + +# --- Generate key + self-signed cert (DER) with your OpenSSL --- +echo "Generating self-signed keypair..." +openssl req -new -x509 -newkey "rsa:${KEY_BITS}" -nodes \ + -keyout "$work/MOK.priv" -out "$work/MOK.der" -outform DER \ + -subj "/CN=${CN}/" + +# --- Sign the module (CMS if available, else PKCS#7; handled by sign-file) --- +echo "Signing module with $HASH_ALGO ..." +"$sign_file" "$HASH_ALGO" "$work/MOK.priv" "$work/MOK.der" "$ko" + +# --- Have kmod parse the signature block via OpenSSL --- +echo +echo "modinfo signature fields:" +modinfo -F sig_id "$ko" || true +modinfo -F signer "$ko" || true +modinfo -F sig_key "$ko" || true +modinfo -F sig_hashalgo "$ko" || true +sig_hex="$(modinfo -F signature "$ko" || true)" +echo "signature (hex): ${sig_hex:0:64}..." + +# --- Basic assertions (tolerant) --- +fail=0 +signer="$(modinfo -F signer "$ko" || true)" +algo="$(modinfo -F sig_hashalgo "$ko" || true)" +[[ -n "$signer" ]] || { echo "ASSERT: signer is empty"; fail=1; } +[[ "$algo" == "$HASH_ALGO" ]] || { echo "ASSERT: sig_hashalgo expected $HASH_ALGO, got $algo"; fail=1; } +if [[ -z "$sig_hex" ]]; then + echo "ASSERT: signature blob is empty"; fail=1; +fi + +echo +if [[ "$fail" -eq 0 ]]; then + echo "=== Summary: PASS (kmod+OpenSSL can parse module signature) ===" +else + echo "=== Summary: FAIL ===" + exit 1 +fi diff --git a/debian/tests/oaep.sh b/debian/tests/oaep.sh new file mode 100755 index 00000000..e023a917 --- /dev/null +++ b/debian/tests/oaep.sh @@ -0,0 +1,73 @@ +#!/usr/bin/env bash +set -Eeuo pipefail + +# OAEP (RSA-2048, SHA-256/MGF1-SHA-256) smoke test using your default OpenSSL provider. +# Usage: +# ./oaep.sh # uses a mktemp dir, cleans it up on exit +# KEEP=1 ./oaep.sh # keep the temp dir for debugging +# ./oaep.sh /path/dir # use a specific directory (no auto-clean) + +DIR="${1:-}" +CLEANUP=0 + +if [[ -n "$DIR" ]]; then + DIR="${DIR%/}" + mkdir -p "$DIR" +else + DIR="$(mktemp -d)" + CLEANUP=1 +fi + +if [[ "${KEEP:-0}" == "1" ]]; then + CLEANUP=0 +fi + +cleanup() { + if (( CLEANUP )); then rm -rf "$DIR"; fi +} +trap cleanup EXIT + +PRIV="$DIR/priv.pem" +PUB="$DIR/pub.pem" +PT="$DIR/pt.bin" +CT="$DIR/ct.bin" +PT2="$DIR/pt2.bin" + +echo "work dir: $DIR" + +# 1) Ensure a known-good keypair exists (RSA-2048, e=65537) +if [[ ! -s "$PRIV" || ! -s "$PUB" ]]; then + echo "Generating RSA-2048 keypair..." + openssl genpkey -algorithm RSA \ + -pkeyopt rsa_keygen_bits:2048 \ + -pkeyopt rsa_keygen_pubexp:65537 \ + -out "$PRIV" + chmod 600 "$PRIV" + openssl pkey -in "$PRIV" -pubout > "$PUB" +fi + +# 2) Quick sanity on the keys (will throw if invalid) +openssl pkey -in "$PRIV" -check -noout >/dev/null +openssl pkey -pubin -in "$PUB" -text -noout >/dev/null + +# 3) Tiny plaintext +printf 'test123' > "$PT" + +# 4) Encrypt with RSA-OAEP using SHA-256 (MGF1=SHA-256) +openssl pkeyutl -encrypt -pubin -inkey "$PUB" -in "$PT" -out "$CT" \ + -pkeyopt rsa_padding_mode:oaep \ + -pkeyopt rsa_oaep_md:sha256 \ + -pkeyopt rsa_mgf1_md:sha256 + +# 5) Decrypt and compare +openssl pkeyutl -decrypt -inkey "$PRIV" -in "$CT" -out "$PT2" \ + -pkeyopt rsa_padding_mode:oaep \ + -pkeyopt rsa_oaep_md:sha256 \ + -pkeyopt rsa_mgf1_md:sha256 + +if diff -u "$PT" "$PT2" >/dev/null; then + echo "OK: OAEP-SHA256 works" +else + echo "FAIL: decrypted plaintext mismatch" + exit 1 +fi diff --git a/debian/tests/ppp.sh b/debian/tests/ppp.sh new file mode 100755 index 00000000..db463ebc --- /dev/null +++ b/debian/tests/ppp.sh @@ -0,0 +1,24 @@ +#!/usr/bin/env bash +set -Eeuo pipefail + +# This wrapper assumes your provider/config is already set up externally. +# If needed, you can still point at custom libs/modules via env before running: +# export LD_LIBRARY_PATH=/path/to/your/lib:$LD_LIBRARY_PATH +# export OPENSSL_MODULES=/path/to/your/ossl-modules +# Optional: PROP_QUERY='provider=wolfprov' to constrain fetches. + +: "${CC:=gcc}" + +echo "Compiling ppp_crypto_smoke.c..." +CFLAGS="-O2 -Wall -Wextra" +if pkg-config --exists openssl 2>/dev/null; then + $CC $CFLAGS -o ppp_crypto_smoke ppp_smoke.c $(pkg-config --cflags --libs openssl) +else + echo "NOTE: pkg-config openssl not found; falling back to -lcrypto" + $CC $CFLAGS -o ppp_crypto_smoke ppp_smoke.c -lcrypto +fi + +echo +echo "Running..." +./ppp_crypto_smoke +rm -f ppp_crypto_smoke diff --git a/debian/tests/ppp_smoke.c b/debian/tests/ppp_smoke.c new file mode 100644 index 00000000..0bead6ea --- /dev/null +++ b/debian/tests/ppp_smoke.c @@ -0,0 +1,164 @@ +// PPP crypto smoke test (no provider loading/listing) +// Checks SHA1, MD4 (NT hash), HMAC-MD5, DES-ECB, RC4 via OpenSSL 3 EVP fetch. +// Prints which provider actually serviced each algorithm (informational). +#include +#include +#include +#include +#include +#include + +static void hex(const unsigned char *b, size_t n, char *out) { + static const char d[] = "0123456789abcdef"; + for (size_t i=0;i>4]; out[2*i+1]=d[b[i]&0xF]; } + out[2*n]='\0'; +} +static const char* prov_name_from_md(const EVP_MD *md){ + const OSSL_PROVIDER *p = EVP_MD_get0_provider(md); + return p ? OSSL_PROVIDER_get0_name(p) : ""; +} +static const char* prov_name_from_cipher(const EVP_CIPHER *c){ + const OSSL_PROVIDER *p = EVP_CIPHER_get0_provider(c); + return p ? OSSL_PROVIDER_get0_name(p) : ""; +} + +static int check_digest(const char *name, const char *propq, + const unsigned char *msg, size_t msglen, + const char *expect_hex) { + int rc = -1; + unsigned char out[EVP_MAX_MD_SIZE]; + unsigned int outlen = 0; + EVP_MD_CTX *ctx = EVP_MD_CTX_new(); + if (!ctx) { fprintf(stderr, "EVP_MD_CTX_new failed\n"); return rc; } + EVP_MD *md = EVP_MD_fetch(NULL, name, propq); + if (!md) { printf("SKIP %-10s (unavailable)\n", name); EVP_MD_CTX_free(ctx); return -2; } + if (!EVP_DigestInit_ex(ctx, md, NULL) || + !EVP_DigestUpdate(ctx, msg, msglen) || + !EVP_DigestFinal_ex(ctx, out, &outlen)) { + fprintf(stderr, "EVP_Digest* failed for %s\n", name); + EVP_MD_free(md); EVP_MD_CTX_free(ctx); return rc; + } + char got[2*EVP_MAX_MD_SIZE+1]; hex(out, outlen, got); + printf("OK %-10s provider=%s digest=%s\n", name, prov_name_from_md(md), got); + rc = (0 == strcasecmp(got, expect_hex)) ? 0 : 1; + if (rc) fprintf(stderr, "MISMATCH %s\n expected: %s\n got: %s\n", name, expect_hex, got); + EVP_MD_free(md); EVP_MD_CTX_free(ctx); + return rc; +} + +static int check_hmac(const char *mdname, const char *propq, + const unsigned char *key, size_t klen, + const unsigned char *msg, size_t mlen, + const char *expect_hex) { + int rc = -1; + unsigned char out[EVP_MAX_MD_SIZE]; + unsigned int outlen = 0; + EVP_MD *md = EVP_MD_fetch(NULL, mdname, propq); + if (!md) { printf("SKIP HMAC-%-6s (unavailable)\n", mdname); return -2; } + if (!HMAC(md, key, (int)klen, msg, mlen, out, &outlen)) { + fprintf(stderr, "HMAC(%s) failed\n", mdname); + EVP_MD_free(md); + return rc; + } + char got[2*EVP_MAX_MD_SIZE+1]; hex(out, outlen, got); + printf("OK HMAC-%-6s provider=%s mac=%s\n", mdname, prov_name_from_md(md), got); + rc = (0 == strcasecmp(got, expect_hex)) ? 0 : 1; + if (rc) fprintf(stderr, "MISMATCH HMAC-%s\n expected: %s\n got: %s\n", mdname, expect_hex, got); + EVP_MD_free(md); + return rc; +} + +static int check_cipher_block(const char *cname, const char *propq, + const unsigned char *key, size_t klen, + const unsigned char *in, size_t ilen, + const char *expect_hex, int disable_pad) { + (void)klen; + int rc = -1; + EVP_CIPHER *ciph = EVP_CIPHER_fetch(NULL, cname, propq); + if (!ciph) { printf("SKIP %-10s (unavailable)\n", cname); return -2; } + EVP_CIPHER_CTX *ctx = EVP_CIPHER_CTX_new(); + if (!ctx) { fprintf(stderr, "EVP_CIPHER_CTX_new failed\n"); EVP_CIPHER_free(ciph); return rc; } + if (!EVP_EncryptInit_ex2(ctx, ciph, key, NULL, NULL)) { fprintf(stderr, "EncryptInit %s failed\n", cname); goto done; } + if (disable_pad) EVP_CIPHER_CTX_set_padding(ctx, 0); + + unsigned char out[128]; int outl1=0, outl2=0; + if (!EVP_EncryptUpdate(ctx, out, &outl1, in, (int)ilen)) { fprintf(stderr, "EncryptUpdate %s failed\n", cname); goto done; } + if (!EVP_EncryptFinal_ex(ctx, out+outl1, &outl2)) { fprintf(stderr, "EncryptFinal %s failed\n", cname); goto done; } + + char got[2*128+1]; hex(out, outl1+outl2, got); + printf("OK %-10s provider=%s ct=%s\n", cname, prov_name_from_cipher(ciph), got); + rc = (0 == strcasecmp(got, expect_hex)) ? 0 : 1; + if (rc) fprintf(stderr, "MISMATCH %s\n expected: %s\n got: %s\n", cname, expect_hex, got); + +done: + EVP_CIPHER_free(ciph); + EVP_CIPHER_CTX_free(ctx); + return rc; +} + +static int check_stream_rc4(const char *propq, + const unsigned char *key, size_t klen, + size_t nbytes, const char *expect_hex) { + (void)klen; + int rc = -1; + EVP_CIPHER *ciph = EVP_CIPHER_fetch(NULL, "RC4", propq); + if (!ciph) { printf("SKIP RC4 (unavailable)\n"); return -2; } + EVP_CIPHER_CTX *ctx = EVP_CIPHER_CTX_new(); + if (!ctx) { fprintf(stderr, "EVP_CIPHER_CTX_new failed\n"); EVP_CIPHER_free(ciph); return rc; } + if (!EVP_EncryptInit_ex2(ctx, ciph, key, NULL, NULL)) { fprintf(stderr, "EncryptInit RC4 failed\n"); goto done; } + + unsigned char in[64]={0}, out[64]={0}; int outl=0, tmp=0; + if (nbytes > sizeof(in)) nbytes = sizeof(in); + if (!EVP_EncryptUpdate(ctx, out, &outl, in, (int)nbytes)) { fprintf(stderr, "RC4 update failed\n"); goto done; } + if (!EVP_EncryptFinal_ex(ctx, out+outl, &tmp)) { fprintf(stderr, "RC4 final failed\n"); goto done; } outl += tmp; + + char got[2*64+1]; hex(out, outl, got); + printf("OK RC4 provider=%s keystream=%s\n", prov_name_from_cipher(ciph), got); + rc = (0 == strncasecmp(got, expect_hex, (int)strlen(expect_hex))) ? 0 : 1; + if (rc) fprintf(stderr, "MISMATCH RC4\n expected: %s\n got: %s\n", expect_hex, got); + +done: + EVP_CIPHER_free(ciph); + EVP_CIPHER_CTX_free(ctx); + return rc; +} + +int main(void){ + const char *propq = getenv("PROP_QUERY"); // optional (e.g., "provider=wolfprov") + int failures = 0; + + // SHA1("abc") + { const unsigned char msg[] = "abc"; + int rc = check_digest("SHA1", propq, msg, 3, "a9993e364706816aba3e25717850c26c9cd0d89d"); + if (rc > 0) failures++; } + + // MD4(UTF16LE("password")) -> NT hash + { const char *pw = "password"; size_t n = strlen(pw); + unsigned char utf16le[128]; + for (size_t i=0;i 0) failures++; } + + // HMAC-MD5("Jefe", "what do ya want for nothing?") + { const unsigned char key[] = "Jefe"; + const unsigned char msg[] = "what do ya want for nothing?"; + int rc = check_hmac("MD5", propq, key, strlen((char*)key), msg, strlen((char*)msg), + "750c783e6ab0b503eaa86e310a5db738"); + if (rc > 0) failures++; } + + // DES-ECB: K=133457799BBCDFF1, P=0123456789ABCDEF -> C=85E813540F0AB405 + { const unsigned char key[8] = {0x13,0x34,0x57,0x79,0x9b,0xbc,0xdf,0xf1}; + const unsigned char pt [8] = {0x01,0x23,0x45,0x67,0x89,0xab,0xcd,0xef}; + int rc = check_cipher_block("DES-ECB", propq, key, sizeof(key), pt, sizeof(pt), + "85e813540f0ab405", 1); + if (rc > 0) failures++; } + + // RC4 keystream for key="Key" (first 16 bytes per RFC 6229) + { const unsigned char key[] = {0x4b,0x65,0x79}; // "Key" + int rc = check_stream_rc4(propq, key, sizeof(key), 16, + "eb9f7781b734ca72a7190ec8792e513f"); + if (rc > 0) failures++; } + + printf("\n=== Summary: %s ===\n", failures ? "FAIL" : "PASS"); + return failures ? 1 : 0; +} diff --git a/debian/tests/rsa.sh b/debian/tests/rsa.sh new file mode 100755 index 00000000..533aec2e --- /dev/null +++ b/debian/tests/rsa.sh @@ -0,0 +1,13 @@ +#!/bin/bash + + +# Generates a temp RSA key, signs "hello", verifies the signature. +# Success prints "OK: OpenSSL RSA SHA-256 sign+verify". +set -euo pipefail +tmp="$(mktemp -d)"; trap 'rm -rf "$tmp"' EXIT +printf "hello" >"$tmp/msg" +openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out "$tmp/priv.pem" >/dev/null +openssl pkey -in "$tmp/priv.pem" -pubout -out "$tmp/pub.pem" >/dev/null +openssl dgst -sha256 -sign "$tmp/priv.pem" -out "$tmp/sig" "$tmp/msg" >/dev/null +openssl dgst -sha256 -verify "$tmp/pub.pem" -signature "$tmp/sig" "$tmp/msg" >/dev/null +echo "OK: OpenSSL RSA SHA-256 sign+verify" diff --git a/debian/tests/snmp.sh b/debian/tests/snmp.sh new file mode 100755 index 00000000..a0d00838 --- /dev/null +++ b/debian/tests/snmp.sh @@ -0,0 +1,64 @@ +#!/usr/bin/env bash +# snmp-openssl-smoke.sh (numeric OID; no MIBs needed) +set -Eeuo pipefail + +USER="${USER:-smokeuser}" +AUTHPASS="${AUTHPASS:-authpass123}" # ≥8 chars +PRIVPASS="${PRIVPASS:-privpass123}" # ≥8 chars +OID_NUM="${OID_NUM:-.1.3.6.1.2.1.1.3.0}" # sysUpTime.0 numeric +PORT="$(shuf -i 16100-16999 -n1)" + +need() { command -v "$1" >/dev/null || { echo "ERR: '$1' not found"; exit 2; }; } +need snmpd; need snmpget + +# Ensure the client will hit OpenSSL/libcrypto +if ! ldd "$(command -v snmpget)" | grep -Eq 'libcrypto\.so|libssl\.so'; then + echo "SKIP: snmpget not linked with OpenSSL/libcrypto on this host"; exit 2 +fi + +tmp="$(mktemp -d)"; srv='' +cleanup(){ [ -n "$srv" ] && kill "$srv" 2>/dev/null || true; rm -rf "$tmp"; } +trap cleanup EXIT + +# Minimal agent config: localhost only, v3 user with SHA auth + AES privacy +cat >"$tmp/snmpd.conf" <"$tmp/snmpd.log" 2>&1 & +srv=$! + +# Quick readiness: attempt the real v3 GET a few times +tries=20 +ok=0 +while (( tries-- > 0 )); do + if snmpget -v3 -l authPriv -u "$USER" -a SHA -A "$AUTHPASS" -x AES -X "$PRIVPASS" \ + -On -Oqv -r 0 -t 0.5 udp:127.0.0.1:$PORT "$OID_NUM" >/dev/null 2>&1; then + ok=1; break + fi + sleep 0.1 +done + +# Now run once for output + verify +if (( ok )); then + val="$(snmpget -v3 -l authPriv -u "$USER" -a SHA -A "$AUTHPASS" -x AES -X "$PRIVPASS" \ + -On -Oqv udp:127.0.0.1:$PORT "$OID_NUM" 2>"$tmp/client.err" || true)" + if [ -n "$val" ]; then + # Pull auth/priv hints from debug (optional) + hint="$(snmpget -v3 -l authPriv -u "$USER" -a SHA -A "$AUTHPASS" -x AES -X "$PRIVPASS" \ + -On -Oqv -Dtemp:usm udp:127.0.0.1:$PORT "$OID_NUM" 2>&1 \ + | awk '/usm/ && /authProtocol:|privProtocol:/ {print $0}' \ + | sed -n 's/.*authProtocol: \([^ ]*\).*/auth=\1/p; s/.*privProtocol: \([^ ]*\).*/ priv=\1/p' \ + | tr -d '\n')" + echo "PASS: SNMPv3 authPriv succeeded — $OID_NUM = $val ${hint:+($hint)}" + exit 0 + fi +fi + +echo "FAIL: SNMPv3 authPriv GET failed" +echo "--- snmpd.log (tail) ---"; tail -n 20 "$tmp/snmpd.log" || true +echo "--- client.err ---"; cat "$tmp/client.err" 2>/dev/null || true +exit 1 diff --git a/default_stub/.gitignore b/default_stub/.gitignore deleted file mode 100644 index f13db083..00000000 --- a/default_stub/.gitignore +++ /dev/null @@ -1,15 +0,0 @@ -Makefile -Makefile.in -.deps/ -.libs/ -*.la -*.lo -*.o -aclocal.m4 -autom4te.cache/ -config.log -config.status -configure -libtool -*.so -*.so.* diff --git a/default_stub/Makefile.am b/default_stub/Makefile.am deleted file mode 100644 index e31303de..00000000 --- a/default_stub/Makefile.am +++ /dev/null @@ -1,2 +0,0 @@ -lib_LTLIBRARIES = libdefault.la -libdefault_la_SOURCES = wp_default_stub.c diff --git a/default_stub/README.md b/default_stub/README.md deleted file mode 100644 index 3bf15917..00000000 --- a/default_stub/README.md +++ /dev/null @@ -1,21 +0,0 @@ -# libdefault - Default Provider Stub Library - -Minimal autotools build for a stub version of the default provider. - -## Building - -```bash -# Generate build system -./autogen.sh - -# Configure and build -./configure -make - -# Clean build artifacts -make clean -``` - -## Output - -The build produces `libdefault.so` in the `.libs/` directory. diff --git a/default_stub/autogen.sh b/default_stub/autogen.sh deleted file mode 100755 index c350c05b..00000000 --- a/default_stub/autogen.sh +++ /dev/null @@ -1,5 +0,0 @@ -#!/bin/bash - -set -e - -autoreconf -fiv diff --git a/default_stub/configure.ac b/default_stub/configure.ac deleted file mode 100644 index 5c44872c..00000000 --- a/default_stub/configure.ac +++ /dev/null @@ -1,7 +0,0 @@ -AC_INIT([libdefault], [1.0], [support@wolfssl.com]) -AM_INIT_AUTOMAKE([-Wall -Werror foreign]) -AC_PROG_CC -AM_PROG_AR -LT_INIT -AC_CONFIG_FILES([Makefile]) -AC_OUTPUT diff --git a/default_stub/wp_default_stub.c b/default_stub/wp_default_stub.c deleted file mode 100644 index 52d9ea28..00000000 --- a/default_stub/wp_default_stub.c +++ /dev/null @@ -1,40 +0,0 @@ -/* - * Copyright (C) 2006-2024 wolfSSL Inc. - * - * This file is part of wolfProvider. - * - * wolfProvider is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 3 of the License, or - * (at your option) any later version. - * - * wolfProvider is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with wolfProvider. If not, see . - */ - -#include - -/* Prototype of public function that initializes the wolfSSL provider. */ -OSSL_provider_init_fn wolfssl_provider_init; - -/* Prototype for the wolfprov_provider_init function */ -int wolfprov_provider_init(const OSSL_CORE_HANDLE* handle, - const OSSL_DISPATCH* in, - const OSSL_DISPATCH** out, - void** provCtx); - -/* - * Provider implementation stub - */ -int wolfprov_provider_init(const OSSL_CORE_HANDLE* handle, - const OSSL_DISPATCH* in, - const OSSL_DISPATCH** out, - void** provCtx) -{ - return 0; -} diff --git a/patches/openssl3-replace-default.patch b/patches/openssl3-replace-default.patch index 37aa2578..511e761a 100644 --- a/patches/openssl3-replace-default.patch +++ b/patches/openssl3-replace-default.patch @@ -1,30 +1,69 @@ diff --git a/crypto/provider_predefined.c b/crypto/provider_predefined.c -index 068e0b7..499a9ca 100644 +index 068e0b7..7bc4ddb 100644 --- a/crypto/provider_predefined.c +++ b/crypto/provider_predefined.c -@@ -10,21 +10,15 @@ +@@ -5,23 +5,56 @@ + * this file except in compliance with the License. You can obtain a copy + * in the file LICENSE in the source distribution or at + * https://www.openssl.org/source/license.html +- */ ++*/ + #include ++#include ++#include ++#include "internal/dso.h" #include "provider_local.h" -OSSL_provider_init_fn ossl_default_provider_init; -+OSSL_provider_init_fn wolfprov_provider_init; ++static DSO *d = NULL; ++ ++/* Common function to dynamically load libwolfprov and call wolfssl_provider_init */ ++static int load_wolfprov_and_init(const OSSL_CORE_HANDLE *handle, ++ const OSSL_DISPATCH *in, const OSSL_DISPATCH **out, ++ void **provctx) { ++ int ret = 0; ++ OSSL_provider_init_fn *wolfssl_provider_init_fn = NULL; ++ ++ d = DSO_new(); ++ if (!d) { ++ fprintf(stderr, "DSO_new() failed\n"); ++ return 1; ++ } ++ ++ if (!DSO_load(d, "wolfprov", NULL, 0)) { ++ fprintf(stderr, "Could not load libwolfprov.so. Is the libwolfprov package installed?\n"); ++ DSO_free(d); ++ return 1; ++ } ++ ++ wolfssl_provider_init_fn = (OSSL_provider_init_fn*)DSO_bind_func(d, "wolfssl_provider_init"); ++ if (!wolfssl_provider_init_fn) { ++ fprintf(stderr, "Failed to find wolfssl_provider_init symbol\n"); ++ DSO_free(d); ++ return 1; ++ } ++ ++ // Intentionally preserve the DSO 'd' here, since it needs to stay loaded ++ ret = wolfssl_provider_init_fn(handle, in, out, provctx); ++ ++ return ret; ++} ++ OSSL_provider_init_fn ossl_base_provider_init; OSSL_provider_init_fn ossl_null_provider_init; -OSSL_provider_init_fn ossl_fips_intern_provider_init; -#ifdef STATIC_LEGACY -OSSL_provider_init_fn ossl_legacy_provider_init; -#endif ++ const OSSL_PROVIDER_INFO ossl_predefined_providers[] = { #ifdef FIPS_MODULE - { "fips", NULL, ossl_fips_intern_provider_init, NULL, 1 }, -+ { "fips", NULL, wolfprov_provider_init, NULL, 1 }, ++ { "fips", NULL, load_wolfprov_and_init, NULL, 1 }, #else - { "default", NULL, ossl_default_provider_init, NULL, 1 }, --# ifdef STATIC_LEGACY -- { "legacy", NULL, ossl_legacy_provider_init, NULL, 0 }, --# endif -+ { "default", NULL, wolfprov_provider_init, NULL, 1 }, -+ { "legacy", NULL, wolfprov_provider_init, NULL, 0 }, - { "base", NULL, ossl_base_provider_init, NULL, 0 }, - { "null", NULL, ossl_null_provider_init, NULL, 0 }, - #endif ++ { "default", NULL, load_wolfprov_and_init, NULL, 1 }, + # ifdef STATIC_LEGACY + { "legacy", NULL, ossl_legacy_provider_init, NULL, 0 }, + # endif diff --git a/scripts/build-debian.sh b/scripts/build-debian.sh index 2a73d9a0..6c6bbc1b 100755 --- a/scripts/build-debian.sh +++ b/scripts/build-debian.sh @@ -111,6 +111,6 @@ git archive --format=tar.gz --prefix="${TARBALL_PREFIX}/" \ # Step 10: Build package echo "⚙️ Building package..." WOLFSSL_ISFIPS=${WOLFSSL_ISFIPS:-0} -debuild --set-envvar WOLFSSL_ISFIPS=${WOLFSSL_ISFIPS} -us -uc +debuild -e WOLFSSL_ISFIPS -us -uc echo "✅ Build completed for version $VERSION" diff --git a/scripts/build-wolfprovider.sh b/scripts/build-wolfprovider.sh index 79c8c274..ad25d106 100755 --- a/scripts/build-wolfprovider.sh +++ b/scripts/build-wolfprovider.sh @@ -160,10 +160,6 @@ source ${SCRIPT_DIR}/utils-wolfprovider.sh echo "Using openssl: $OPENSSL_TAG, wolfssl: $WOLFSSL_TAG" -if [ "$WOLFPROV_REPLACE_DEFAULT" = "1" ]; then - build_default_stub -fi - init_wolfprov exit $? diff --git a/scripts/env-setup b/scripts/env-setup index c7e84302..7fe7e724 100755 --- a/scripts/env-setup +++ b/scripts/env-setup @@ -46,7 +46,7 @@ WOLFPROV_LIB_PATH="$REPO_ROOT/wolfprov-install/lib" # Always reconstruct LD_LIBRARY_PATH with correctly detected OPENSSL_LIB_PATH # ${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH} expands to :$LD_LIBRARY_PATH only if LD_LIBRARY_PATH was already set -export LD_LIBRARY_PATH="$WOLFSSL_LIB_PATH:$OPENSSL_LIB_PATH${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}" +export LD_LIBRARY_PATH="$WOLFPROV_LIB_PATH:$WOLFSSL_LIB_PATH:$OPENSSL_LIB_PATH${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}" # Auto-detect FIPS mode and use appropriate config if [ "${WOLFSSL_ISFIPS:-0}" = "1" ]; then diff --git a/scripts/utils-openssl.sh b/scripts/utils-openssl.sh index cd3d5780..932eeaf5 100755 --- a/scripts/utils-openssl.sh +++ b/scripts/utils-openssl.sh @@ -47,6 +47,7 @@ clean_openssl() { make -C "${OPENSSL_SOURCE_DIR}" clean >>$LOG_FILE 2>&1 fi rm -rf "${OPENSSL_INSTALL_DIR}" + rm -rf "${OPENSSL_STUB_INSTALL_DIR}" fi if [ "$WOLFPROV_DISTCLEAN" -eq "1" ]; then printf "Removing OpenSSL source ...\n" @@ -63,8 +64,6 @@ clone_openssl() { if [ ! -d ${OPENSSL_SOURCE_DIR} ]; then printf "\tOpenSSL source directory not found: ${OPENSSL_SOURCE_DIR}\n" - printf "\tParent directory:\n" - tree -L 2 $(dirname ${OPENSSL_SOURCE_DIR}/..) || true CLONE_TAG=${USE_CUR_TAG:+${OPENSSL_TAG_CUR}} CLONE_TAG=${CLONE_TAG:-${OPENSSL_TAG}} @@ -72,7 +71,7 @@ clone_openssl() { DEPTH_ARG=${DEPTH_ARG:---depth=1} printf "\tClone OpenSSL ${CLONE_TAG} from ${OPENSSL_GIT_URL} ... " - git clone ${DEPTH_ARG} -b ${CLONE_TAG} ${OPENSSL_GIT_URL} ${OPENSSL_SOURCE_DIR} + git clone ${DEPTH_ARG} -b ${CLONE_TAG} ${OPENSSL_GIT_URL} ${OPENSSL_SOURCE_DIR} >>$LOG_FILE 2>&1 RET=$? if [ $RET != 0 ]; then @@ -96,15 +95,24 @@ clone_openssl() { fi } +is_openssl_patched() { + if [ ! -f "${OPENSSL_SOURCE_DIR}/crypto/provider_predefined.c" ]; then + return 0 + fi + + pushd ${OPENSSL_SOURCE_DIR} &> /dev/null + patch_applied=$(git diff --quiet "crypto/provider_predefined.c" 2>/dev/null && echo 1 || echo 0) + popd &> /dev/null + return $patch_applied +} + check_openssl_replace_default_mismatch() { local openssl_is_patched=0 # Check if the source was patched for --replace-default - if [ -f "${OPENSSL_SOURCE_DIR}/crypto/provider_predefined.c" ]; then - if grep -q "wolfprov_provider_init" "${OPENSSL_SOURCE_DIR}/crypto/provider_predefined.c" 2>/dev/null; then - openssl_is_patched=1 - printf "INFO: OpenSSL source modified - wolfProvider integrated as default provider (non-stock build).\n" - fi + if is_openssl_patched; then + openssl_is_patched=1 + printf "INFO: OpenSSL source modified - wolfProvider integrated as default provider (non-stock build).\n" fi # Check for mismatch @@ -125,6 +133,19 @@ check_openssl_replace_default_mismatch() { fi } +patch_openssl_version() { + # Patch the OpenSSL version (wolfProvider/openssl-source/VERSION.dat) + # with our BUILD_METADATA, depending on the FIPS flag. Either "wolfProvider" or "wolfProvider-fips". + if [ "$WOLFSSL_ISFIPS" = "1" ]; then + sed -i 's/BUILD_METADATA=.*/BUILD_METADATA=wolfProvider-fips/g' ${OPENSSL_SOURCE_DIR}/VERSION.dat + else + sed -i 's/BUILD_METADATA=.*/BUILD_METADATA=wolfProvider-nonfips/g' ${OPENSSL_SOURCE_DIR}/VERSION.dat + fi + + # Patch the OpenSSL RELEASE_DATE field with the current date in the format DD MMM YYYY + sed -i "s/RELEASE_DATE=.*/RELEASE_DATE=$(date '+%d %b %Y')/g" ${OPENSSL_SOURCE_DIR}/VERSION.dat +} + patch_openssl() { if [ "$WOLFPROV_REPLACE_DEFAULT" = "1" ]; then @@ -137,10 +158,10 @@ patch_openssl() { fi printf "\tApplying OpenSSL default provider patch ... " - cd ${OPENSSL_SOURCE_DIR} + pushd ${OPENSSL_SOURCE_DIR} &> /dev/null # Check if patch is already applied - if grep -q "wolfprov_provider_init" crypto/provider_predefined.c 2>/dev/null; then + if is_openssl_patched; then printf "Already applied.\n" return 0 fi @@ -154,10 +175,78 @@ patch_openssl() { do_cleanup exit 1 fi + patch_openssl_version printf "Done.\n" - cd ${SCRIPT_DIR}/.. + popd &> /dev/null + fi +} + +install_openssl_deb() { + printf "\nInstalling OpenSSL ${OPENSSL_TAG} for Debian packaging ...\n" + clone_openssl + patch_openssl + check_openssl_replace_default_mismatch + + pushd ${OPENSSL_SOURCE_DIR} &> /dev/null + + if [ -d ${OPENSSL_INSTALL_DIR} ]; then + printf "\tOpenSSL install directory already exists: ${OPENSSL_INSTALL_DIR}\n" + printf "\tRemoving existing install directory...\n" + rm -rf ${OPENSSL_INSTALL_DIR} + fi + + # Build configure command + CONFIG_CMD="./config shared" + + # Determine the install paths for Debian Bookworm + DEB_HOST_MULTIARCH=$(dpkg-architecture -qDEB_HOST_MULTIARCH) + CONFIG_CMD+=" --prefix=/usr --openssldir=/usr/lib/ssl --libdir=lib/${DEB_HOST_MULTIARCH} " + + if [ "$WOLFPROV_DEBUG" = "1" ]; then + CONFIG_CMD+=" enable-trace --debug" fi + + if [ "$WOLFPROV_REPLACE_DEFAULT" = "1" ]; then + CONFIG_CMD+=" no-external-tests no-tests" + fi + + printf "\tConfigure OpenSSL ${OPENSSL_TAG} ... " + $CONFIG_CMD >>$LOG_FILE 2>&1 + RET=$? + if [ $RET != 0 ]; then + printf "ERROR.\n" + rm -rf ${OPENSSL_INSTALL_DIR} + do_cleanup + exit 1 + fi + printf "Done.\n" + + printf "\tBuild OpenSSL ${OPENSSL_TAG} ... " + make -j$NUMCPU >>$LOG_FILE 2>&1 + if [ $? != 0 ]; then + printf "ERROR.\n" + rm -rf ${OPENSSL_INSTALL_DIR} + do_cleanup + exit 1 + fi + printf "Done.\n" + + # Manually set up the install directory rather than running 'make install' + # so that we don't modify the system OpenSSL installation + printf "\tCopying outputs to ${OPENSSL_INSTALL_DIR} for OpenSSL ${OPENSSL_TAG} ... " + mkdir -p ${OPENSSL_INSTALL_DIR}/bin + mkdir -p ${OPENSSL_INSTALL_DIR}/lib + mkdir -p ${OPENSSL_INSTALL_DIR}/include/openssl + mkdir -p ${OPENSSL_INSTALL_DIR}/lib/pkgconfig + cp -r apps/openssl ${OPENSSL_INSTALL_DIR}/bin/openssl + cp -r libcrypto.so* libcrypto.a ${OPENSSL_INSTALL_DIR}/lib/ + cp -r libssl.so* libssl.a ${OPENSSL_INSTALL_DIR}/lib/ + cp -r include/openssl/* ${OPENSSL_INSTALL_DIR}/include/openssl/ + cp -r *.pc ${OPENSSL_INSTALL_DIR}/lib/pkgconfig/ + printf "Done.\n" + + popd &> /dev/null } install_openssl() { @@ -165,7 +254,8 @@ install_openssl() { clone_openssl patch_openssl check_openssl_replace_default_mismatch - cd ${OPENSSL_SOURCE_DIR} + + pushd ${OPENSSL_SOURCE_DIR} &> /dev/null if [ ! -d ${OPENSSL_INSTALL_DIR} ]; then printf "\tConfigure OpenSSL ${OPENSSL_TAG} ... " @@ -177,19 +267,6 @@ install_openssl() { fi if [ "$WOLFPROV_REPLACE_DEFAULT" = "1" ]; then CONFIG_CMD+=" no-external-tests no-tests" - - # Set up library paths to find the stub libdefault - if [ -d "${OPENSSL_STUB_INSTALL_DIR}" ]; then - # Link the stub library directly into libcrypto using LDFLAGS and LDLIBS - CONFIGURE_LDFLAGS="-L${OPENSSL_STUB_INSTALL_DIR}/lib" - CONFIGURE_LDLIBS="-ldefault" - else - printf "ERROR - stub libdefault not found in: ${OPENSSL_STUB_INSTALL_DIR}\n" - do_cleanup - exit 1 - fi - - CONFIG_CMD+=" LDFLAGS=${CONFIGURE_LDFLAGS} LDLIBS=${CONFIGURE_LDLIBS}" fi $CONFIG_CMD >>$LOG_FILE 2>&1 @@ -223,26 +300,13 @@ install_openssl() { printf "Done.\n" fi - cd .. + popd &> /dev/null } init_openssl() { install_openssl printf "\tOpenSSL ${OPENSSL_TAG} installed in: ${OPENSSL_INSTALL_DIR}\n" - # Skip version check for replace-default mode since we only build libraries - if [ "$WOLFPROV_REPLACE_DEFAULT" != "1" ]; then - OSSL_VER=`LD_LIBRARY_PATH=${OPENSSL_LIB_DIRS} $OPENSSL_BIN version | tail -n1` - case $OSSL_VER in - OpenSSL\ 3.*) ;; - *) - echo "OpenSSL ($OPENSSL_BIN) has wrong version: $OSSL_VER" - echo "Set: OPENSSL_DIR" - exit 1 - ;; - esac - fi - if [ -z $LD_LIBRARY_PATH ]; then export LD_LIBRARY_PATH=${OPENSSL_LIB_DIRS} else diff --git a/scripts/utils-wolfprovider.sh b/scripts/utils-wolfprovider.sh index e3dc5696..4f46a2d9 100644 --- a/scripts/utils-wolfprovider.sh +++ b/scripts/utils-wolfprovider.sh @@ -25,13 +25,13 @@ source ${SCRIPT_DIR}/utils-general.sh WOLFPROV_SOURCE_DIR=${SCRIPT_DIR}/.. WOLFPROV_INSTALL_DIR=${SCRIPT_DIR}/../wolfprov-install +LIBDEFAULT_INSTALL_DIR=${WOLFPROV_INSTALL_DIR} LIBDEFAULT_STUB_INSTALL_DIR=${SCRIPT_DIR}/../libdefault-stub-install WOLFPROV_WITH_WOLFSSL=--with-wolfssl=${WOLFSSL_INSTALL_DIR} # Check if using system wolfSSL installation if command -v dpkg >/dev/null 2>&1; then if dpkg -l | grep -q "^ii.*libwolfssl[[:space:]]" && dpkg -l | grep -q "^ii.*libwolfssl-dev[[:space:]]"; then - printf "\nSkipping wolfSSL installation - libwolfssl and libwolfssl-dev packages are already installed.\n" WOLFPROV_WITH_WOLFSSL= fi fi @@ -39,7 +39,6 @@ fi WOLFPROV_CONFIG_OPTS=${WOLFPROV_CONFIG_OPTS:-"--with-openssl=${OPENSSL_INSTALL_DIR} ${WOLFPROV_WITH_WOLFSSL} --prefix=${WOLFPROV_INSTALL_DIR}"} WOLFPROV_CONFIG_CFLAGS=${WOLFPROV_CONFIG_CFLAGS:-''} - if [ "${WOLFPROV_QUICKTEST}" = "1" ]; then WOLFPROV_CONFIG_CFLAGS="${WOLFPROV_CONFIG_CFLAGS} -DWOLFPROV_QUICKTEST" fi @@ -58,55 +57,6 @@ WOLFPROV_DEBUG=${WOLFPROV_DEBUG:-0} WOLFPROV_CLEAN=${WOLFPROV_CLEAN:-0} WOLFPROV_DISTCLEAN=${WOLFPROV_DISTCLEAN:-0} -build_default_stub() { - printf "\nBuilding default stub library ...\n" - cd ${SCRIPT_DIR}/../default_stub - - printf "\tGenerate build system ... " - if [ ! -e "configure" ]; then - ./autogen.sh >>$LOG_FILE 2>&1 - if [ $? != 0 ]; then - printf "\n\n...\n" - tail -n 40 $LOG_FILE - do_cleanup - exit 1 - fi - fi - printf "Done.\n" - - printf "\tConfigure default stub ... " - ./configure --prefix=${LIBDEFAULT_STUB_INSTALL_DIR} >>$LOG_FILE 2>&1 - if [ $? != 0 ]; then - printf "\n\n...\n" - tail -n 40 $LOG_FILE - do_cleanup - exit 1 - fi - printf "Done.\n" - - printf "\tBuild default stub ... " - make >>$LOG_FILE 2>&1 - if [ $? != 0 ]; then - printf "\n\n...\n" - tail -n 40 $LOG_FILE - do_cleanup - exit 1 - fi - printf "Done.\n" - - printf "\tInstall default stub ... " - make install >>$LOG_FILE 2>&1 - if [ $? != 0 ]; then - printf "\n\n...\n" - tail -n 40 $LOG_FILE - do_cleanup - exit 1 - fi - printf "Done.\n" - - cd ${SCRIPT_DIR}/.. -} - clean_wolfprov() { printf "\n" @@ -115,42 +65,23 @@ clean_wolfprov() { if [ -f "Makefile" ]; then make clean >>$LOG_FILE 2>&1 fi - # Clean default_stub build artifacts - if [ -f "default_stub/Makefile" ]; then - printf "Cleaning default stub ...\n" - make -C default_stub clean >>$LOG_FILE 2>&1 - fi - # Remove root libdefault.la file - rm -f libdefault.la + # Remove entire wolfProvider install directory rm -rf ${WOLFPROV_INSTALL_DIR} + rm -rf ${LOG_FILE} fi if [ "$WOLFPROV_DISTCLEAN" -eq "1" ]; then printf "Removing wolfProvider install ...\n" rm -rf ${WOLFPROV_INSTALL_DIR} - rm -rf ${LIBDEFAULT_STUB_INSTALL_DIR} fi } install_wolfprov() { - cd ${WOLFPROV_SOURCE_DIR} - - # Add stub library path for replace-default functionality after dependencies are installed - if [ "$WOLFPROV_REPLACE_DEFAULT" = "1" ]; then - if [ -z "$LD_LIBRARY_PATH" ]; then - export LD_LIBRARY_PATH="${LIBDEFAULT_STUB_INSTALL_DIR}/lib" - else - export LD_LIBRARY_PATH="${LIBDEFAULT_STUB_INSTALL_DIR}/lib:$LD_LIBRARY_PATH" - fi - fi + pushd ${WOLFPROV_SOURCE_DIR} &> /dev/null init_openssl init_wolfssl - printf "\nConsolidating wolfProvider ...\n" - unset OPENSSL_MODULES - unset OPENSSL_CONF - - printf "LD_LIBRARY_PATH: $LD_LIBRARY_PATH\n" + printf "\nInstalling wolfProvider ...\n" printf "\tConfigure wolfProvider ... " if [ ! -e "${WOLFPROV_SOURCE_DIR}/configure" ]; then @@ -171,7 +102,6 @@ install_wolfprov() { ./configure ${WOLFPROV_CONFIG_OPTS} CFLAGS="${WOLFPROV_CONFIG_CFLAGS}" >>$LOG_FILE 2>&1 RET=$? - if [ $RET != 0 ]; then printf "\n\n...\n" tail -n 40 $LOG_FILE @@ -190,15 +120,21 @@ install_wolfprov() { fi printf "Done.\n" - printf "\tTest wolfProvider ... " - make test >>$LOG_FILE 2>&1 - if [ $? != 0 ]; then - printf "\n\n...\n" - tail -n 40 $LOG_FILE - do_cleanup - exit 1 + # Build the replacement default library after wolfprov to avoid linker errors + # but before testing so that the library is present if needed + if [ "$WOLFPROV_REPLACE_DEFAULT" = "1" ]; then + printf "\tWARNING: Skipping tests in replace mode...\n" + else + printf "\tTest wolfProvider ... " + make test >>$LOG_FILE 2>&1 + if [ $? != 0 ]; then + printf "\n\n...\n" + tail -n 40 $LOG_FILE + do_cleanup + exit 1 + fi + printf "Done.\n" fi - printf "Done.\n" printf "\tInstall wolfProvider ... " make install >>$LOG_FILE 2>&1 @@ -209,6 +145,8 @@ install_wolfprov() { exit 1 fi printf "Done.\n" + + popd &> /dev/null } init_wolfprov() { diff --git a/scripts/utils-wolfssl.sh b/scripts/utils-wolfssl.sh index 481929d9..fab16ec6 100644 --- a/scripts/utils-wolfssl.sh +++ b/scripts/utils-wolfssl.sh @@ -98,10 +98,23 @@ install_wolfssl() { # use the custom OpenSSL built with wolfProvider. if command -v dpkg >/dev/null 2>&1; then if dpkg -l | grep -q "^ii.*libwolfssl[[:space:]]" && dpkg -l | grep -q "^ii.*libwolfssl-dev[[:space:]]"; then + # Check if there is a FIPS mismatch + # If the system wolfSSL is FIPS, we need to be doing a FIPS build + dpkg -l | grep "^ii.*libwolfssl[[:space:]]" | grep -q "fips" + if [ $? -eq 0 ] && [ "$WOLFSSL_ISFIPS" != "1" ]; then + printf "ERROR: System wolfSSL is FIPS, but WOLFSSL_ISFIPS is not set to 1\n" + do_cleanup + exit 1 + elif [ $? -eq 0 ] && [ "$WOLFSSL_ISFIPS" != "0" ]; then + printf "ERROR: System wolfSSL is non-FIPS, but WOLFSSL_ISFIPS is set to 1\n" + do_cleanup + exit 1 + fi + printf "\nSkipping wolfSSL installation - libwolfssl and libwolfssl-dev packages are already installed.\n" # Set WOLFSSL_INSTALL_DIR to system installation directory WOLFSSL_INSTALL_DIR="/usr" - return 0 + return fi fi diff --git a/src/wp_default_replace.c b/src/wp_default_replace.c deleted file mode 100644 index 046a48ec..00000000 --- a/src/wp_default_replace.c +++ /dev/null @@ -1,59 +0,0 @@ -/* - * Copyright (C) 2006-2024 wolfSSL Inc. - * - * This file is part of wolfProvider. - * - * wolfProvider is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 3 of the License, or - * (at your option) any later version. - * - * wolfProvider is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with wolfProvider. If not, see . - */ - -/* - * wolfProvider Real Implementation for libdefault.so - * - * This is the real implementation of wolfprov_provider_init that bridges - * OpenSSL's default provider interface to wolfProvider by dynamically - * loading libwolfprov.so and calling wolfssl_provider_init. - * - * This replaces the stub implementation after wolfProvider is fully built. - */ - -#include - -/* Prototype of public function that initializes the wolfSSL provider. */ -OSSL_provider_init_fn wolfssl_provider_init; - -/* Prototype for the wolfprov_provider_init function */ -int wolfprov_provider_init(const OSSL_CORE_HANDLE* handle, - const OSSL_DISPATCH* in, - const OSSL_DISPATCH** out, - void** provCtx); - -/* - * Real implementation of wolfprov_provider_init. - * - * This function dynamically loads libwolfprov.so and calls its - * wolfssl_provider_init function to provide full wolfProvider functionality. - * - * @param [in] handle Handle to the core. - * @param [in] in Dispatch table from previous provider. - * @param [out] out Dispatch table of wolfSSL provider. - * @param [out] provCtx New provider context. - * @return 1 on success, 0 on failure. - */ -int wolfprov_provider_init(const OSSL_CORE_HANDLE* handle, - const OSSL_DISPATCH* in, - const OSSL_DISPATCH** out, - void** provCtx) -{ - return wolfssl_provider_init(handle, in, out, provCtx); -} diff --git a/test/standalone/tests/.libs/test_sha256_simple.standalone b/test/standalone/tests/.libs/test_sha256_simple.standalone deleted file mode 100755 index e47d2b43..00000000 Binary files a/test/standalone/tests/.libs/test_sha256_simple.standalone and /dev/null differ