From e0562937dcf4260651b0bbd882ce5235dd96546d Mon Sep 17 00:00:00 2001 From: Paul Adelsbach Date: Thu, 21 Aug 2025 15:59:26 -0700 Subject: [PATCH 1/4] Default stub build updates --- default_stub/wp_default_stub.c | 18 ++++++++---------- scripts/build-wolfprovider.sh | 4 ---- scripts/utils-openssl.sh | 6 ++---- scripts/utils-wolfprovider.sh | 32 ++++++++++++++++++++++++++------ 4 files changed, 36 insertions(+), 24 deletions(-) diff --git a/default_stub/wp_default_stub.c b/default_stub/wp_default_stub.c index 52d9ea28..34b0bc88 100644 --- a/default_stub/wp_default_stub.c +++ b/default_stub/wp_default_stub.c @@ -17,24 +17,22 @@ * along with wolfProvider. If not, see . */ -#include +/* Note: to simplify the build process, we are not using the OpenSSL headers. + * Instead, we are using functions that don't specify parameters. This + * allows us to build the stub without having to clone OpenSSL first, + * nor use the system OpenSSL headers. + */ /* Prototype of public function that initializes the wolfSSL provider. */ -OSSL_provider_init_fn wolfssl_provider_init; +int wolfssl_provider_init(); /* Prototype for the wolfprov_provider_init function */ -int wolfprov_provider_init(const OSSL_CORE_HANDLE* handle, - const OSSL_DISPATCH* in, - const OSSL_DISPATCH** out, - void** provCtx); +int wolfprov_provider_init(); /* * Provider implementation stub */ -int wolfprov_provider_init(const OSSL_CORE_HANDLE* handle, - const OSSL_DISPATCH* in, - const OSSL_DISPATCH** out, - void** provCtx) +int wolfprov_provider_init() { return 0; } diff --git a/scripts/build-wolfprovider.sh b/scripts/build-wolfprovider.sh index 79c8c274..ad25d106 100755 --- a/scripts/build-wolfprovider.sh +++ b/scripts/build-wolfprovider.sh @@ -160,10 +160,6 @@ source ${SCRIPT_DIR}/utils-wolfprovider.sh echo "Using openssl: $OPENSSL_TAG, wolfssl: $WOLFSSL_TAG" -if [ "$WOLFPROV_REPLACE_DEFAULT" = "1" ]; then - build_default_stub -fi - init_wolfprov exit $? diff --git a/scripts/utils-openssl.sh b/scripts/utils-openssl.sh index cd3d5780..89703aac 100755 --- a/scripts/utils-openssl.sh +++ b/scripts/utils-openssl.sh @@ -63,8 +63,6 @@ clone_openssl() { if [ ! -d ${OPENSSL_SOURCE_DIR} ]; then printf "\tOpenSSL source directory not found: ${OPENSSL_SOURCE_DIR}\n" - printf "\tParent directory:\n" - tree -L 2 $(dirname ${OPENSSL_SOURCE_DIR}/..) || true CLONE_TAG=${USE_CUR_TAG:+${OPENSSL_TAG_CUR}} CLONE_TAG=${CLONE_TAG:-${OPENSSL_TAG}} @@ -165,7 +163,7 @@ install_openssl() { clone_openssl patch_openssl check_openssl_replace_default_mismatch - cd ${OPENSSL_SOURCE_DIR} + pushd ${OPENSSL_SOURCE_DIR} &> /dev/null if [ ! -d ${OPENSSL_INSTALL_DIR} ]; then printf "\tConfigure OpenSSL ${OPENSSL_TAG} ... " @@ -223,7 +221,7 @@ install_openssl() { printf "Done.\n" fi - cd .. + popd &> /dev/null } init_openssl() { diff --git a/scripts/utils-wolfprovider.sh b/scripts/utils-wolfprovider.sh index e3dc5696..0b7a1163 100644 --- a/scripts/utils-wolfprovider.sh +++ b/scripts/utils-wolfprovider.sh @@ -25,6 +25,7 @@ source ${SCRIPT_DIR}/utils-general.sh WOLFPROV_SOURCE_DIR=${SCRIPT_DIR}/.. WOLFPROV_INSTALL_DIR=${SCRIPT_DIR}/../wolfprov-install +LIBDEFAULT_STUB_SOURCE_DIR=${SCRIPT_DIR}/../default_stub LIBDEFAULT_STUB_INSTALL_DIR=${SCRIPT_DIR}/../libdefault-stub-install WOLFPROV_WITH_WOLFSSL=--with-wolfssl=${WOLFSSL_INSTALL_DIR} @@ -58,9 +59,12 @@ WOLFPROV_DEBUG=${WOLFPROV_DEBUG:-0} WOLFPROV_CLEAN=${WOLFPROV_CLEAN:-0} WOLFPROV_DISTCLEAN=${WOLFPROV_DISTCLEAN:-0} -build_default_stub() { +install_default_stub() { printf "\nBuilding default stub library ...\n" - cd ${SCRIPT_DIR}/../default_stub + pushd ${LIBDEFAULT_STUB_SOURCE_DIR} &> /dev/null + + # Ensure openssl is present for header files + clone_openssl printf "\tGenerate build system ... " if [ ! -e "configure" ]; then @@ -104,7 +108,7 @@ build_default_stub() { fi printf "Done.\n" - cd ${SCRIPT_DIR}/.. + popd &> /dev/null } clean_wolfprov() { @@ -116,12 +120,21 @@ clean_wolfprov() { make clean >>$LOG_FILE 2>&1 fi # Clean default_stub build artifacts - if [ -f "default_stub/Makefile" ]; then + if [ -f "${LIBDEFAULT_STUB_SOURCE_DIR}/Makefile" ]; then printf "Cleaning default stub ...\n" - make -C default_stub clean >>$LOG_FILE 2>&1 + make -C ${LIBDEFAULT_STUB_SOURCE_DIR} clean >>$LOG_FILE 2>&1 fi # Remove root libdefault.la file rm -f libdefault.la + # Remove autoconf files in default_stub + rm -f ${LIBDEFAULT_STUB_SOURCE_DIR}/aclocal.m4 + rm -f ${LIBDEFAULT_STUB_SOURCE_DIR}/config.h + rm -f ${LIBDEFAULT_STUB_SOURCE_DIR}/config.log + rm -f ${LIBDEFAULT_STUB_SOURCE_DIR}/config.status + rm -f ${LIBDEFAULT_STUB_SOURCE_DIR}/configure + rm -f ${LIBDEFAULT_STUB_SOURCE_DIR}/depcomp + rm -f ${LIBDEFAULT_STUB_SOURCE_DIR}/install-sh + # Remove entire wolfProvider install directory rm -rf ${WOLFPROV_INSTALL_DIR} fi if [ "$WOLFPROV_DISTCLEAN" -eq "1" ]; then @@ -132,7 +145,7 @@ clean_wolfprov() { } install_wolfprov() { - cd ${WOLFPROV_SOURCE_DIR} + pushd ${WOLFPROV_SOURCE_DIR} &> /dev/null # Add stub library path for replace-default functionality after dependencies are installed if [ "$WOLFPROV_REPLACE_DEFAULT" = "1" ]; then @@ -143,6 +156,11 @@ install_wolfprov() { fi fi + # Build stub first so we can link OpenSSL against it + if [ "$WOLFPROV_REPLACE_DEFAULT" = "1" ]; then + install_default_stub + fi + init_openssl init_wolfssl @@ -209,6 +227,8 @@ install_wolfprov() { exit 1 fi printf "Done.\n" + + popd &> /dev/null } init_wolfprov() { From 860ced44b224a2f993a9b72c76d401cb154947bd Mon Sep 17 00:00:00 2001 From: Paul Adelsbach Date: Tue, 5 Aug 2025 21:03:09 -0700 Subject: [PATCH 2/4] Add FIPS support for Debian package build --- .github/workflows/debian-package.yml | 37 +++++++++++++++++++++++++++- 1 file changed, 36 insertions(+), 1 deletion(-) diff --git a/.github/workflows/debian-package.yml b/.github/workflows/debian-package.yml index 74fa7f46..12c4b30b 100644 --- a/.github/workflows/debian-package.yml +++ b/.github/workflows/debian-package.yml @@ -9,7 +9,18 @@ on: jobs: bookworm: runs-on: ubuntu-22.04 +<<<<<<< HEAD # Important: use Debian Bookworm for compatibility +======= + strategy: + matrix: + include: + - fips_mode: true + description: "FIPS Mode" + - fips_mode: false + description: "Non-FIPS Mode" + # Important: use Debian Bookwork for compatibility +>>>>>>> 08f4141 (Add FIPS support for Debian package build) container: image: debian:bookworm # or debian:bookworm-slim env: @@ -61,9 +72,21 @@ jobs: mkdir -p "$RUNNER_TEMP/wolfssl-pkg" cd "$RUNNER_TEMP/wolfssl-pkg" +<<<<<<< HEAD echo "Using standard wolfSSL package" tar -xvf $GITHUB_WORKSPACE/.github/packages/debian-wolfssl.tar.gz +======= + # Use FIPS tarball if fips_flag is not empty, otherwise use standard tarball + if [ "${{ matrix.fips_mode }}" = "true" ]; then + echo "Using FIPS wolfSSL package" + tar -xvf $GITHUB_WORKSPACE/.github/packages/debian-wolfssl-fips.tar.gz + else + echo "Using standard wolfSSL package" + tar -xvf $GITHUB_WORKSPACE/.github/packages/debian-wolfssl.tar.gz + fi + +>>>>>>> 08f4141 (Add FIPS support for Debian package build) # Get current architecture CURRENT_ARCH=$(dpkg --print-architecture) echo "Current architecture: $CURRENT_ARCH" @@ -87,8 +110,16 @@ jobs: - name: Build Debian package run: | +<<<<<<< HEAD +======= + # Run the build script with or without FIPS based on matrix + FIPS_FLAG="" + if [ "${{ matrix.fips_mode }}" = "true" ]; then + FIPS_FLAG="--enable-fips" + fi +>>>>>>> 08f4141 (Add FIPS support for Debian package build) # Bypass the warning prompt with 'yes Y' - yes Y | ./scripts/build-wolfprovider.sh --debian + yes Y | ./scripts/build-wolfprovider.sh --debian $FIPS_FLAG # List generated packages echo "Generated Packages:" @@ -204,7 +235,11 @@ jobs: if: always() uses: actions/upload-artifact@v4 with: +<<<<<<< HEAD name: wolfprovider-debian-packages +======= + name: wolfprovider-debian-packages${{ matrix.fips_mode && '-fips' }} +>>>>>>> 08f4141 (Add FIPS support for Debian package build) path: | ${{ runner.temp }}/*.deb ${{ runner.temp }}/*.dsc From e6c51e789df03bd6d59f9f84c10bedbe38ef4edc Mon Sep 17 00:00:00 2001 From: Paul Adelsbach Date: Fri, 15 Aug 2025 14:18:43 -0700 Subject: [PATCH 3/4] Add packaging for custom openssl --- .github/workflows/debian-package.yml | 332 ++++++++++++++---- .github/workflows/replace-default.yml | 66 ---- .gitignore | 15 + Makefile.am | 10 +- README-packaging.md | 88 +++++ README.md | 6 - debian/clean | 1 + debian/compat | 1 - debian/control | 57 ++- debian/install-wolfssl.sh | 126 +++++++ debian/libssl-dev.install | 7 + debian/libssl3.install | 2 + debian/libwolfprov.install | 4 +- debian/libwolfprov.postinst | 38 +- debian/libwolfprov.postrm | 9 +- debian/openssl.install | 2 + debian/openssl.postinst | 19 + debian/openssl.postrm | 11 + debian/rules | 101 +++++- default_stub/.gitignore | 15 - default_stub/Makefile.am | 2 - default_stub/README.md | 21 -- default_stub/autogen.sh | 5 - default_stub/configure.ac | 7 - default_stub/wp_default_stub.c | 38 -- patches/openssl3-replace-default.patch | 63 +++- scripts/build-debian.sh | 2 +- scripts/env-setup | 2 +- scripts/utils-openssl.sh | 136 +++++-- scripts/utils-wolfprovider.sh | 116 +----- scripts/utils-wolfssl.sh | 15 +- src/wp_default_replace.c | 59 ---- .../tests/.libs/test_sha256_simple.standalone | Bin 36176 -> 0 bytes 33 files changed, 891 insertions(+), 485 deletions(-) delete mode 100644 .github/workflows/replace-default.yml create mode 100644 README-packaging.md create mode 100644 debian/clean delete mode 100644 debian/compat create mode 100755 debian/install-wolfssl.sh create mode 100755 debian/libssl-dev.install create mode 100644 debian/libssl3.install create mode 100644 debian/openssl.install create mode 100644 debian/openssl.postinst create mode 100644 debian/openssl.postrm delete mode 100644 default_stub/.gitignore delete mode 100644 default_stub/Makefile.am delete mode 100644 default_stub/README.md delete mode 100755 default_stub/autogen.sh delete mode 100644 default_stub/configure.ac delete mode 100644 default_stub/wp_default_stub.c delete mode 100644 src/wp_default_replace.c delete mode 100755 test/standalone/tests/.libs/test_sha256_simple.standalone diff --git a/.github/workflows/debian-package.yml b/.github/workflows/debian-package.yml index 12c4b30b..5e5bb868 100644 --- a/.github/workflows/debian-package.yml +++ b/.github/workflows/debian-package.yml @@ -7,20 +7,9 @@ on: branches: [ '*' ] jobs: - bookworm: + libwolfprov-standalone: runs-on: ubuntu-22.04 -<<<<<<< HEAD # Important: use Debian Bookworm for compatibility -======= - strategy: - matrix: - include: - - fips_mode: true - description: "FIPS Mode" - - fips_mode: false - description: "Non-FIPS Mode" - # Important: use Debian Bookwork for compatibility ->>>>>>> 08f4141 (Add FIPS support for Debian package build) container: image: debian:bookworm # or debian:bookworm-slim env: @@ -46,6 +35,7 @@ jobs: dpkg-dev \ lintian \ fakeroot \ + dh-exec\ equivs # Install additional tools for testing apt-get install -y \ @@ -62,62 +52,37 @@ jobs: with: fetch-depth: 1 - run: | - # Fetch tags + # Fetch tags, needed for the Debian versioning git fetch --tags # List all tags git tag -l - name: Install wolfssl debian package run: | - mkdir -p "$RUNNER_TEMP/wolfssl-pkg" - cd "$RUNNER_TEMP/wolfssl-pkg" + mkdir -p "/tmp/wolfssl-pkg" + cd "/tmp/wolfssl-pkg" -<<<<<<< HEAD - echo "Using standard wolfSSL package" - tar -xvf $GITHUB_WORKSPACE/.github/packages/debian-wolfssl.tar.gz + # Install wolfssl packages + chmod +x $GITHUB_WORKSPACE/debian/install-wolfssl.sh + $GITHUB_WORKSPACE/debian/install-wolfssl.sh \ + $GITHUB_WORKSPACE/.github/packages/debian-wolfssl.tar.gz \ + "/tmp/wolfssl-pkg" -======= - # Use FIPS tarball if fips_flag is not empty, otherwise use standard tarball - if [ "${{ matrix.fips_mode }}" = "true" ]; then - echo "Using FIPS wolfSSL package" - tar -xvf $GITHUB_WORKSPACE/.github/packages/debian-wolfssl-fips.tar.gz - else - echo "Using standard wolfSSL package" - tar -xvf $GITHUB_WORKSPACE/.github/packages/debian-wolfssl.tar.gz - fi + # Create wolfprov-packages directory and move wolfssl files there + mkdir -p "/tmp/wolfprov-packages" + echo "Moving wolfssl files to artifacts directory..." ->>>>>>> 08f4141 (Add FIPS support for Debian package build) - # Get current architecture - CURRENT_ARCH=$(dpkg --print-architecture) - echo "Current architecture: $CURRENT_ARCH" + # Copy all wolfssl-related files (source and binary packages) + find /tmp/wolfssl-pkg -name "*wolfssl*" -type f -name "*.deb" -exec cp {} /tmp/wolfprov-packages/ \; + find /tmp/wolfssl-pkg -name "*wolfssl*" -type f -name "*.dsc" -exec cp {} /tmp/wolfprov-packages/ \; + find /tmp/wolfssl-pkg -name "*wolfssl*" -type f -name "*.tar.gz" -exec cp {} /tmp/wolfprov-packages/ \; + find /tmp/wolfssl-pkg -name "*wolfssl*" -type f -name "*.orig.tar.gz" -exec cp {} /tmp/wolfprov-packages/ \; - # Look for existing .deb files that match the current architecture - cd debian-packages - MATCHING_DEB_FILES=$(find . -name "*_${CURRENT_ARCH}.deb" -o -name "*_${CURRENT_ARCH}_*.deb" 2>/dev/null || true) - - if [ -n "$MATCHING_DEB_FILES" ]; then - echo "Found matching .deb files for architecture $CURRENT_ARCH:" - echo "$MATCHING_DEB_FILES" - echo "Installing existing .deb files..." - dpkg -i $MATCHING_DEB_FILES - else - echo "No matching .deb files found for architecture $CURRENT_ARCH, rebuilding from source..." - dpkg-source -x wolfssl*.dsc - cd wolfssl*/ - dpkg-buildpackage -b -us -uc - dpkg -i ../libwolfssl*.deb - fi + echo "WolfSSL files in artifacts directory:" + ls -la /tmp/wolfprov-packages/*wolfssl* || true - name: Build Debian package run: | -<<<<<<< HEAD -======= - # Run the build script with or without FIPS based on matrix - FIPS_FLAG="" - if [ "${{ matrix.fips_mode }}" = "true" ]; then - FIPS_FLAG="--enable-fips" - fi ->>>>>>> 08f4141 (Add FIPS support for Debian package build) # Bypass the warning prompt with 'yes Y' yes Y | ./scripts/build-wolfprovider.sh --debian $FIPS_FLAG @@ -125,7 +90,7 @@ jobs: echo "Generated Packages:" ls -la ../*.deb ../*.dsc ../*.tar.gz || true - - name: Install package + - name: Install package without custom openssl run: | # Find the package file PACKAGE_FILE=$(find ../ -name "libwolfprov_*.deb" | head -n1) @@ -145,11 +110,11 @@ jobs: - name: Test OpenSSL provider functionality run: | - PROVIDER_CONF="/etc/ssl/openssl.cnf.d/wolfprovider.conf" + PROVIDER_CONF="/usr/lib/ssl/openssl.cnf.d/wolfprovider.conf" PROVIDER_CONF_BACKUP="/tmp/wolfprovider.conf.backup" # Temporarily move wolfprovider config so we can toggle between providers - echo "3. Temporarily disabling wolfprovider for default provider tests:" + echo "Temporarily disabling wolfprovider for default provider tests:" mkdir -p /tmp/openssl-test if [ -f $PROVIDER_CONF ]; then mv $PROVIDER_CONF $PROVIDER_CONF_BACKUP @@ -164,7 +129,7 @@ jobs: OPENSSL_BIN=$(eval which openssl) ./scripts/cmd_test/do-cmd-tests.sh # Restore wolfprovider configuration - echo "5. Restoring wolfprovider configuration:" + echo "Restoring wolfprovider configuration:" if [ -f $PROVIDER_CONF_BACKUP ]; then mv $PROVIDER_CONF_BACKUP $PROVIDER_CONF echo " - Restored $PROVIDER_CONF from $PROVIDER_CONF_BACKUP" @@ -187,9 +152,9 @@ jobs: fi # Check if the config file is removed - if [ -f /etc/ssl/openssl.cnf.d/wolfprovider.conf ]; then + if [ -f /usr/lib/ssl/openssl.cnf.d/wolfprovider.conf ]; then echo "wolfprovider.conf still exists after package removal" - ls -la /etc/ssl/openssl.cnf.d/ + ls -la /usr/lib/ssl/openssl.cnf.d/ exit 1 else echo "wolfprovider.conf successfully removed" @@ -225,23 +190,246 @@ jobs: - name: Move package artifacts run: | - # Move the generated packages to the temp directory - mv ../*.deb $RUNNER_TEMP/ || true - mv ../*.dsc $RUNNER_TEMP/ || true - mv ../*.tar.gz $RUNNER_TEMP/ || true + # Create a clean artifacts directory + mkdir -p "/tmp/wolfprov-packages" + # Move the generated packages to the artifacts directory + mv ../*.deb /tmp/wolfprov-packages/ || true + mv ../*.dsc /tmp/wolfprov-packages/ || true + mv ../*.tar.gz /tmp/wolfprov-packages/ || true # Save the build outputs which for use in release packages - name: Upload package artifacts if: always() uses: actions/upload-artifact@v4 with: -<<<<<<< HEAD name: wolfprovider-debian-packages -======= - name: wolfprovider-debian-packages${{ matrix.fips_mode && '-fips' }} ->>>>>>> 08f4141 (Add FIPS support for Debian package build) path: | - ${{ runner.temp }}/*.deb - ${{ runner.temp }}/*.dsc - ${{ runner.temp }}/*.tar.gz + /tmp/wolfprov-packages/*.deb + /tmp/wolfprov-packages/*.dsc + /tmp/wolfprov-packages/*.tar.gz retention-days: 7 + + libwolfprov-with-openssl: + runs-on: ubuntu-22.04 + needs: libwolfprov-standalone + container: + image: debian:bookworm + env: + DEBIAN_FRONTEND: noninteractive + steps: + - name: Download artifacts from previous job + uses: actions/download-artifact@v4 + with: + name: wolfprovider-debian-packages + path: /tmp/artifacts + + - name: Set up environment + run: | + # Update package lists + apt-get update + # Install build dependencies + apt-get install -y \ + build-essential \ + devscripts \ + debhelper \ + dh-autoreconf \ + libtool \ + pkg-config \ + git \ + wget \ + curl \ + ca-certificates \ + openssl \ + dpkg-dev \ + lintian \ + fakeroot \ + dh-exec\ + equivs + # Install additional tools for testing + apt-get install -y \ + expect \ + xxd + + - name: Unpack artifacts + run: | + echo "Downloaded artifacts:" + ls -la /tmp/artifacts/ + + # Create working directory + mkdir -p /tmp/test-installation + cd /tmp/test-installation + + # Copy all artifacts to working directory + cp /tmp/artifacts/* ./ + + echo "Unpacked artifacts in working directory:" + ls -la + + - name: Remove packages needed for artifact retrieval + run: | + # Remove packages that were needed for artifact download but shouldn't interfere with testing + apt-get remove -y wget curl ca-certificates || true + apt-get autoremove -y + + - name: Install libwolfssl and openssl packages + run: | + cd /tmp/test-installation + + # Find and install libwolfssl packages + wolfssl_debs=$(find . -name "*libwolfssl*.deb") + echo "Installing libwolfssl packages: $wolfssl_debs" + if [ -n "$wolfssl_debs" ]; then + apt install -y $wolfssl_debs + fi + + # Find and install openssl packages + openssl_debs=$(find . -name "*openssl*.deb") + libssl3_debs=$(find . -name "*libssl3*.deb") + echo "Installing openssl packages: $openssl_debs $libssl3_debs" + if [ -n "$openssl_debs" ] || [ -n "$libssl3_debs" ]; then + apt install -y $openssl_debs $libssl3_debs + fi + + echo "Installed packages:" + dpkg -l | grep -E "(wolfssl|openssl|libssl)" + + - name: Show OpenSSL version + run: | + echo "OpenSSL version:" + openssl version -a || true + + - name: Test OpenSSL providers before wolfprov installation + run: | + echo "Testing OpenSSL providers before wolfprov installation..." + echo "Expected: This should work normally with default providers" + + # Test openssl list -providers + if openssl list -providers; then + echo "SUCCESS: openssl list -providers works before wolfprov installation" + else + echo "FAILURE: openssl list -providers failed before wolfprov installation" + exit 1 + fi + + echo "Provider list before wolfprov installation:" + openssl list -providers + + - name: Install libwolfprov package + run: | + cd /tmp/test-installation + + # Find and install libwolfprov package + wolfprov_debs=$(find . -name "*libwolfprov*.deb" | head -n1) + echo "Installing libwolfprov package: $wolfprov_debs" + + if [ -z "$wolfprov_debs" ]; then + echo "ERROR: No libwolfprov package found!" + ls -la + exit 1 + fi + + echo "Installing: $wolfprov_debs" + apt install -y ./"$wolfprov_debs" + + echo "Installed packages after wolfprov:" + dpkg -l | grep -E "(wolfprov|wolfssl|openssl|libssl)" + + - name: Test OpenSSL providers after wolfprov installation + run: | + echo "Testing OpenSSL providers after wolfprov installation..." + echo "Expected: This should show wolfprov as an available provider" + + # Test openssl list -providers + if openssl list -providers; then + echo "SUCCESS: openssl list -providers works after wolfprov installation" + else + echo "FAILURE: openssl list -providers failed after wolfprov installation" + exit 1 + fi + + echo "Provider list after wolfprov installation:" + openssl list -providers + + # Check if wolfprov provider is available + if openssl list -providers | grep -i "wolfprov"; then + echo "SUCCESS: wolfprov provider is available" + else + echo "WARNING: wolfprov provider not found in provider list" + echo "This might be expected if the provider needs to be explicitly loaded" + fi + + - name: Verify wolfprov configuration + run: | + echo "Verifying wolfprov configuration..." + + # Check if configuration file exists + if [ -f /usr/lib/ssl/openssl.cnf.d/wolfprovider.conf ]; then + echo "SUCCESS: wolfprovider.conf exists" + cat /usr/lib/ssl/openssl.cnf.d/wolfprovider.conf + else + echo "WARNING: wolfprovider.conf not found" + fi + + # Check if library file exists + if [ -f /usr/lib/*/ossl-modules/libwolfprov.so ]; then + echo "SUCCESS: libwolfprov.so exists" + find /usr/lib -name "libwolfprov.so*" 2>/dev/null + else + echo "WARNING: libwolfprov.so not found" + fi + + - name: Test basic OpenSSL functionality (digests, AES, ECDH, ECC) + shell: bash + run: | + set -e + echo "Testing OpenSSL digests..." + echo "test" | openssl dgst -sha256 + echo "test" | openssl dgst -sha512 + + echo "Testing OpenSSL AES encryption/decryption..." + echo "secret" | openssl enc -aes-128-cbc -pass pass:mykey -out secret.enc + openssl enc -d -aes-128-cbc -pass pass:mykey -in secret.enc + + echo "Testing OpenSSL ECDH key generation and shared secret..." + openssl ecparam -name prime256v1 -genkey -noout -out ec1.pem + openssl ecparam -name prime256v1 -genkey -noout -out ec2.pem + openssl pkey -in ec1.pem -pubout -out ec1.pub + openssl pkey -in ec2.pem -pubout -out ec2.pub + openssl pkeyutl -derive -inkey ec1.pem -peerkey ec2.pub -out secret1.bin + openssl pkeyutl -derive -inkey ec2.pem -peerkey ec1.pub -out secret2.bin + cmp secret1.bin secret2.bin && echo "ECDH shared secrets match" + + echo "Testing OpenSSL ECC sign/verify..." + openssl ecparam -name prime256v1 -genkey -noout -out ecc_key.pem + echo "message" > msg.txt + openssl dgst -sha256 -sign ecc_key.pem -out msg.sig msg.txt + openssl dgst -sha256 -verify <(openssl pkey -in ecc_key.pem -pubout) -signature msg.sig msg.txt + + - name: Save artifacts + run: | + echo "Saving artifacts..." + ls -la /tmp/test-installation + cp -r /tmp/test-installation /tmp/artifacts + + # Save the build outputs which for use in release packages + - name: Upload package artifacts + if: always() + uses: actions/upload-artifact@v4 + with: + name: ossl-debian-packages + path: | + /tmp/test-installation/*.deb + /tmp/test-installation/*.dsc + /tmp/test-installation/*.tar.gz + retention-days: 1 + + - name: Cleanup test environment + run: | + echo "Cleaning up test environment..." + + # Uninstall test packages + apt-get remove --purge -y libwolfprov || true + apt-get autoremove -y + + echo "Cleanup completed" + diff --git a/.github/workflows/replace-default.yml b/.github/workflows/replace-default.yml deleted file mode 100644 index 4a9860e8..00000000 --- a/.github/workflows/replace-default.yml +++ /dev/null @@ -1,66 +0,0 @@ -name: Replace Default Tests - -# START OF COMMON SECTION -on: - push: - branches: [ 'master', 'main', 'release/**' ] - pull_request: - branches: [ '*' ] - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true -# END OF COMMON SECTION - -jobs: - replace_default_test: - name: Replace Default Test - runs-on: ubuntu-22.04 - timeout-minutes: 30 - strategy: - matrix: - # Test both standard and replace-default builds - replace_default: ['', '--replace-default'] - # Test with stable versions - wolfssl_ref: ['v5.8.0-stable'] - openssl_ref: ['openssl-3.5.0'] - steps: - - name: Checkout wolfProvider - uses: actions/checkout@v4 - with: - fetch-depth: 1 - - - name: Build wolfProvider ${{ matrix.replace_default && 'with replace-default' || 'standard' }} - run: | - OPENSSL_TAG=${{ matrix.openssl_ref }} \ - WOLFSSL_TAG=${{ matrix.wolfssl_ref }} \ - ./scripts/build-wolfprovider.sh ${{ matrix.replace_default }} - - - name: Run standalone test suite - run: | - ./test/standalone/runners/run_standalone_tests.sh - - - name: Print errors on failure - if: ${{ failure() }} - run: | - # Build failure log - if [ -f scripts/build-release.log ]; then - echo "=== Build log (last 50 lines) ===" - tail -n 50 scripts/build-release.log - fi - - # Test suite failure log - if [ -f test-suite.log ]; then - echo "=== Test suite log ===" - cat test-suite.log - fi - - # Standalone test failures - if [ -d test/standalone/runners/test_results ]; then - for log in test/standalone/runners/test_results/*.log; do - if [ -f "$log" ]; then - echo "=== $log ===" - cat "$log" - fi - done - fi diff --git a/.gitignore b/.gitignore index 483d9a6c..2b2f58b9 100644 --- a/.gitignore +++ b/.gitignore @@ -109,8 +109,23 @@ debian/*.deb debian/*.buildinfo debian/files debian/libwolfprov* +debian/libssl-dev* +debian/openssl* +debian/libssl3* !debian/libwolfprov.install !debian/libwolfprov.postinst !debian/libwolfprov.postrm !debian/libwolfprov-dev.docs !debian/libwolfprov-dev.install +!debian/openssl.cnf +!debian/openssl.install +!debian/openssl.postinst +!debian/openssl.postrm +!debian/libssl3.postinst +!debian/libssl3.postrm +!debian/libssl3.install +!debian/libssl3.docs +!debian/libssl3.install +!debian/libssl3.postinst +!debian/libssl3.postrm + diff --git a/Makefile.am b/Makefile.am index 6d3e43af..d1b28091 100644 --- a/Makefile.am +++ b/Makefile.am @@ -14,14 +14,8 @@ AM_CPPFLAGS = -I$(top_srcdir)/include lib_LTLIBRARIES = libwolfprov.la -# Conditionally build libdefault.so when --replace-default is enabled -if BUILD_REPLACE_DEFAULT -# Install libdefault.la directly to OpenSSL lib directory -openssldir = $(OPENSSL_LIB_DIR) -openssl_LTLIBRARIES = libdefault.la -libdefault_la_SOURCES = src/wp_default_replace.c -libdefault_la_LIBADD = libwolfprov.la -endif +# Create only libwolfprov.so, and not .so.X.Y.Z +libwolfprov_la_LDFLAGS = -avoid-version EXTRA_DIST+=ChangeLog.md EXTRA_DIST+=README.md diff --git a/README-packaging.md b/README-packaging.md new file mode 100644 index 00000000..41581fe0 --- /dev/null +++ b/README-packaging.md @@ -0,0 +1,88 @@ +# WolfProvider Debian Packaging +This is the flow for building and installing + +## Local build + +From the repo root, run the following command: +``` +./scripts/build-wolfprovider.sh --debian +``` + +For a FIPS build, run the following: +``` +./scripts/build-wolfprovider.sh --debian --enable-fips +``` + +The Debian packages are placed in the parent directory, which should be one level above the repo root. + +## CI build +Instead of doing a local build as outlined above, we can alternatively use packages generated from CI. + +To use a build from CI for local install, download the artifacts from the Debian CI job. Then install the .deb's from the zip file with `apt` as shown below rather than from the build. + +## Install + +If not already done, install the WolfSSL Debian package. The non-FIPS version is available in this repo and is installed by the script below. This step is only needed once, and can be done prior to the `build-wolfprovider.sh` step above. +``` +./debian/install-wolfssl.sh ./.github/packages/debian-wolfssl.tar.gz +``` + +For the script above, some systems may require additional packages: +``` +apt install build-essential devscripts dh-exec +``` + +### Optionally install custom OpenSSL + +**Important**: before proceeding with the wolfProvider install, make sure packages are not present: +``` +apt purge -y libwolfprov ; apt purge -y openssl-config ; apt purge -y openssl ; apt purge -y libssl3 +``` + +Get the system architecture which determines the library paths for the following steps: +``` +export CURRENT_ARCH=$(dpkg --print-architecture) +``` + +Then install the wolfProvider-specific OpenSSL. From the repo root: +``` +apt install ../openssl*${CURRENT_ARCH}*.deb ../libssl3*${CURRENT_ARCH}*.deb +``` + +Check that the provider API is disabled since wolfProvider is not installed: +``` +$ openssl list -providers +Could not load libwolfprov.so. Is the libwolfprov package installed? + libwolfprov.so: cannot open shared object file: No such file or directory +``` + +### Install wolfProvider + +Then install wolfProvider: +``` +apt install ../libwolfprov*${CURRENT_ARCH}*.deb +``` + +Confirm that wolfProvider is installed: +``` +$ openssl list -providers +``` + +Output should look like this: +``` +Providers: + default + name: wolfSSL Provider + version: 1.0.2 + status: active +``` + +## Release process +Always use CI to perform the release build to avoid potential errors from building locally. + +* Tag the wolfProvider repo in the format `vX.Y.Z` + * The changelog is generated by the Debian scripts +* Run the Debian job in CI +* Download the artifacts zip file which contains the .deb's +* Generate release archives as needed + diff --git a/README.md b/README.md index 99f6fe6a..342a1b27 100644 --- a/README.md +++ b/README.md @@ -78,12 +78,6 @@ To remove all source directories, use the following: ./scripts/build-wolfprovider.sh --distclean ``` -To build a Debian package file, use the following command. -Note this will remove all ignored files in the repo, and there must be no staged changes. -``` -./scripts/build-wolfprovider.sh --debian -``` - Alternatively, you can manually compile each component using the following guide. ### OpenSSL diff --git a/debian/clean b/debian/clean new file mode 100644 index 00000000..fb82819e --- /dev/null +++ b/debian/clean @@ -0,0 +1 @@ +wolfProvider/scripts/build-release.log diff --git a/debian/compat b/debian/compat deleted file mode 100644 index 48082f72..00000000 --- a/debian/compat +++ /dev/null @@ -1 +0,0 @@ -12 diff --git a/debian/control b/debian/control index 1f0a18d8..992b65e4 100644 --- a/debian/control +++ b/debian/control @@ -3,23 +3,25 @@ Section: libs Priority: optional Maintainer: WolfSSL Standards-Version: 4.6.2 -Build-Depends: debhelper (>= 12), - devscripts, - pkgconf, - openssl, - libwolfssl, - libwolfssl-dev - +Rules-Requires-Root: no +Build-Depends: + debhelper-compat (= 13), + devscripts, + dh-exec, + openssl, + git, + pkgconf, + libwolfssl-dev Package: libwolfprov Architecture: any +Multi-Arch: same Depends: ${shlibs:Depends}, ${misc:Depends}, libssl3 (>= 3.0.3), libwolfssl (>= 5.8.2), openssl Provides: ${variant:provides} XB-Variant: ${variant} Description: wolfProvider library for OpenSSL — ${variant:desc} wolfProvider is a library that can be used as a Provider in OpenSSL. It provides cryptographic functionality through wolfSSL including: - . * Hash functions (MD5, SHA-1, SHA-2, SHA-3) * Symmetric encryption (AES, DES) * Asymmetric cryptography (RSA, ECC, DH) @@ -31,7 +33,40 @@ Description: wolfProvider library for OpenSSL — ${variant:desc} Package: libwolfprov-dev Architecture: any Section: libdevel +Multi-Arch: same Depends: libwolfprov (= ${binary:Version}), ${misc:Depends} -Description: Development files for wolfProvider - This package contains the header files and development libraries - needed to build applications using wolfProvider. +XB-Variant: ${variant} +Description: Development files for wolfProvider — ${variant:desc} + This package contains the headers and development files + for applications using wolfProvider. + +Package: openssl +Architecture: any +Section: utils +Multi-Arch: foreign +Depends: ${shlibs:Depends}, ${misc:Depends} +Description: Secure Sockets Layer toolkit - command line interface + This package contains the OpenSSL command line utility. + Built for use with wolfProvider. + +Package: libssl3 +Architecture: any +Multi-Arch: same +Depends: libssl3 (= ${binary:Version}), ${misc:Depends} +Breaks: libssl3 (<< 3.0.0) +Replaces: libssl3 +Recommends: openssl +Description: OpenSSL shared libraries (wolfProvider build) + This package contains the OpenSSL shared libraries built + for use with wolfProvider. + +Package: libssl-dev +Architecture: any +Section: libdevel +Multi-Arch: same +Depends: libssl3 (= ${binary:Version}), ${misc:Depends} +Breaks: libssl-dev (<< 3.0.0) +Replaces: libssl-dev +Description: OpenSSL development files (wolfProvider build) + This package contains headers, pkg-config files and linker symlinks + for the OpenSSL version built for wolfProvider. diff --git a/debian/install-wolfssl.sh b/debian/install-wolfssl.sh new file mode 100755 index 00000000..440a9c79 --- /dev/null +++ b/debian/install-wolfssl.sh @@ -0,0 +1,126 @@ +#!/bin/bash + +# Script to install wolfSSL packages for Debian +# Checks if packages are already installed and installs appropriate architecture-specific packages + +set -e + +# Function to check if packages are installed +check_packages_installed() { + if dpkg -l | grep -q "^ii.*libwolfssl " && dpkg -l | grep -q "^ii.*libwolfssl-dev "; then + echo "libwolfssl and libwolfssl-dev packages are already installed" + dpkg -l | grep wolfssl + return 0 + else + return 1 + fi +} + +# Function to install wolfSSL packages +install_wolfssl_packages() { + local wolfssl_tar_path="$1" + local dest_dir="$2" + + if [ ! -f "$wolfssl_tar_path" ]; then + echo "Error: wolfSSL package archive not found at $wolfssl_tar_path" + exit 1 + fi + + # If no destination directory specified, create one using mktemp + if [ -z "$dest_dir" ]; then + dest_dir=$(mktemp -d) + echo "No destination directory specified, created temporary directory: $dest_dir" + else + echo "Using specified destination directory: $dest_dir" + # Create the directory if it doesn't exist + mkdir -p "$dest_dir" + fi + + echo "Extracting wolfSSL package to: $dest_dir" + tar -xvf "$wolfssl_tar_path" -C "$dest_dir" + + # Get current architecture + CURRENT_ARCH=$(dpkg --print-architecture) + echo "Current architecture: $CURRENT_ARCH" + + # Look for existing .deb files that match the current architecture + cd "$dest_dir/debian-packages" + MATCHING_DEB_FILES=$(find . -name "*_${CURRENT_ARCH}.deb" -o -name "*_${CURRENT_ARCH}_*.deb" 2>/dev/null || true) + + if [ -n "$MATCHING_DEB_FILES" ]; then + echo "Found matching .deb files for architecture $CURRENT_ARCH:" + echo "$MATCHING_DEB_FILES" + echo "Installing existing .deb files..." + + # Install both libwolfssl and libwolfssl-dev packages for the current architecture + LIBWOLFSSL_DEB=$(echo "$MATCHING_DEB_FILES" | grep "libwolfssl_[^-]" | head -n1) + LIBWOLFSSL_DEV_DEB=$(echo "$MATCHING_DEB_FILES" | grep "libwolfssl-dev_" | head -n1) + + if [ -n "$LIBWOLFSSL_DEB" ]; then + echo "Installing libwolfssl package: $LIBWOLFSSL_DEB" + dpkg -i "$LIBWOLFSSL_DEB" + else + echo "No libwolfssl package found for architecture $CURRENT_ARCH" + exit 1 + fi + + if [ -n "$LIBWOLFSSL_DEV_DEB" ]; then + echo "Installing libwolfssl-dev package: $LIBWOLFSSL_DEV_DEB" + dpkg -i "$LIBWOLFSSL_DEV_DEB" + else + echo "No libwolfssl-dev package found for architecture $CURRENT_ARCH" + exit 1 + fi + else + echo "No matching .deb files found for architecture $CURRENT_ARCH, rebuilding from source..." + dpkg-source -x wolfssl*.dsc + cd wolfssl*/ + dpkg-buildpackage -b -us -uc + + # Install both libwolfssl and libwolfssl-dev packages + LIBWOLFSSL_DEB=$(find .. -name "libwolfssl_*${CURRENT_ARCH}.deb" | grep -v "dev" | head -n1) + LIBWOLFSSL_DEV_DEB=$(find .. -name "libwolfssl-dev*_${CURRENT_ARCH}.deb" | head -n1) + + if [ -n "$LIBWOLFSSL_DEB" ]; then + echo "Installing libwolfssl package: $LIBWOLFSSL_DEB" + dpkg -i "$LIBWOLFSSL_DEB" + else + echo "No libwolfssl package found after building for architecture $CURRENT_ARCH" + exit 1 + fi + + if [ -n "$LIBWOLFSSL_DEV_DEB" ]; then + echo "Installing libwolfssl-dev package: $LIBWOLFSSL_DEV_DEB" + dpkg -i "$LIBWOLFSSL_DEV_DEB" + else + echo "No libwolfssl-dev package found after building for architecture $CURRENT_ARCH" + exit 1 + fi + fi +} + +# Main execution +main() { + local wolfssl_tar_path="$1" + local dest_dir="$2" + + if [ -z "$wolfssl_tar_path" ]; then + echo "Usage: $0 [destination-directory]" + echo " If destination-directory is not specified, a temporary directory will be created using mktemp" + exit 1 + fi + + echo "Checking if wolfSSL packages are already installed..." + if check_packages_installed; then + echo "Packages already installed, exiting successfully" + exit 0 + fi + + echo "Installing wolfSSL packages..." + install_wolfssl_packages "$wolfssl_tar_path" "$dest_dir" + + echo "WolfSSL installation completed successfully" +} + +# Run main function with all arguments +main "$@" diff --git a/debian/libssl-dev.install b/debian/libssl-dev.install new file mode 100755 index 00000000..94f97e6c --- /dev/null +++ b/debian/libssl-dev.install @@ -0,0 +1,7 @@ +#!/usr/bin/dh-exec +usr/include/openssl/* +usr/lib/${DEB_HOST_MULTIARCH}/libcrypto.so +usr/lib/${DEB_HOST_MULTIARCH}/libssl.so +usr/lib/${DEB_HOST_MULTIARCH}/pkgconfig/openssl.pc +usr/lib/${DEB_HOST_MULTIARCH}/pkgconfig/libcrypto.pc +usr/lib/${DEB_HOST_MULTIARCH}/pkgconfig/libssl.pc \ No newline at end of file diff --git a/debian/libssl3.install b/debian/libssl3.install new file mode 100644 index 00000000..fcc40907 --- /dev/null +++ b/debian/libssl3.install @@ -0,0 +1,2 @@ +usr/lib/*/libcrypto.so.3 +usr/lib/*/libssl.so.3 diff --git a/debian/libwolfprov.install b/debian/libwolfprov.install index d2e32928..e0f5fd99 100644 --- a/debian/libwolfprov.install +++ b/debian/libwolfprov.install @@ -1,3 +1,3 @@ usr/lib/*/ossl-modules/libwolfprov.so* -etc/ssl/openssl.cnf.d/ -etc/ssl/openssl.cnf.d/wolfprovider.conf +usr/lib/ssl/openssl.cnf.d +usr/lib/ssl/openssl.cnf.d/wolfprovider.conf diff --git a/debian/libwolfprov.postinst b/debian/libwolfprov.postinst index 4755e4ba..49ad68f2 100755 --- a/debian/libwolfprov.postinst +++ b/debian/libwolfprov.postinst @@ -1,12 +1,42 @@ #!/bin/sh set -e -CONF_FILE="/etc/ssl/openssl.cnf" -INCLUDE_LINE=".include /etc/ssl/openssl.cnf.d/" +INCLUDE_LINE=".include /usr/lib/ssl/openssl.cnf.d/wolfprovider.conf" +CONF_FILE="/usr/lib/ssl/openssl.cnf" +CONF_DEFAULT="/usr/share/openssl-defaults/openssl.cnf" -if ! grep -qF "$INCLUDE_LINE" "$CONF_FILE"; then - echo "Adding include for wolfprovider..." +# Copy from our template if it doesn't exist +if [ ! -f "$CONF_FILE" ]; then + echo "Config file does not exist: $CONF_FILE" + if [ -f "$CONF_DEFAULT" ]; then + install -Dm644 "$CONF_DEFAULT" "$CONF_FILE" + else + echo "Default config file does not exist: $CONF_DEFAULT" + exit 1 + fi +fi + +# Add include for wolfprovider config file if not already present +if grep -qF "$INCLUDE_LINE" "$CONF_FILE"; then + echo "Include line already exists in $CONF_FILE" +else + echo "Adding include for wolfprovider to $CONF_FILE..." sed -i "/^openssl_conf/ a $INCLUDE_LINE" "$CONF_FILE" fi +# Link /usr/lib/$(DEB_HOST_MULTIARCH)/ossl-modules/libwolfprov.so to /usr/lib/$(DEB_HOST_MULTIARCH)/ +# This is needed for the custom openssl build where libwolfprov is a normal module +# Todo: this could possibly be done with a .links file in debian/ +DEB_HOST_MULTIARCH=$(dpkg-architecture -qDEB_HOST_MULTIARCH) +# Loop through /usr/lib/$(DEB_HOST_MULTIARCH)/ossl-modules/libwolfprov.so* and create the link +for file in "/usr/lib/${DEB_HOST_MULTIARCH}/ossl-modules/libwolfprov.so"*; do + # use the same extension as the original file + extension="${file##*.}" + if [ -f "$file" ]; then + echo "Linking $file to /usr/lib/${DEB_HOST_MULTIARCH}/ossl-modules/libwolfprov.$extension" + ln -sf "$file" "/usr/lib/${DEB_HOST_MULTIARCH}/libwolfprov.$extension" + fi +done + +#DEBHELPER# exit 0 diff --git a/debian/libwolfprov.postrm b/debian/libwolfprov.postrm index 48e6e07b..9c12481b 100755 --- a/debian/libwolfprov.postrm +++ b/debian/libwolfprov.postrm @@ -3,7 +3,12 @@ set -e case "$1" in remove|purge) - rm -f /etc/ssl/openssl.cnf.d/wolfprovider.conf - rmdir /etc/ssl/openssl.cnf.d 2>/dev/null || true + DEB_HOST_MULTIARCH=$(dpkg-architecture -qDEB_HOST_MULTIARCH) + rm -f /usr/lib/ssl/openssl.cnf.d/wolfprovider.conf + rm -f /usr/lib/${DEB_HOST_MULTIARCH}/ossl-modules/libwolfprov.so* + rm -f /usr/lib/${DEB_HOST_MULTIARCH}/libwolfprov.so* ;; esac + +#DEBHELPER# +exit 0 diff --git a/debian/openssl.install b/debian/openssl.install new file mode 100644 index 00000000..dc8bc1fc --- /dev/null +++ b/debian/openssl.install @@ -0,0 +1,2 @@ +usr/bin/openssl +usr/share/openssl-defaults/openssl.cnf diff --git a/debian/openssl.postinst b/debian/openssl.postinst new file mode 100644 index 00000000..6b12047c --- /dev/null +++ b/debian/openssl.postinst @@ -0,0 +1,19 @@ +#!/bin/sh +set -e + +CONF_FILE="/usr/lib/ssl/openssl.cnf" +CONF_DEFAULT="/usr/share/openssl-defaults/openssl.cnf" + +# Copy from our template if it doesn't exist +if [ ! -f "$CONF_FILE" ]; then + echo "Config file does not exist: $CONF_FILE" + if [ -f "$CONF_DEFAULT" ]; then + install -Dm644 "$CONF_DEFAULT" "$CONF_FILE" + else + echo "Default config file does not exist: $CONF_DEFAULT" + exit 1 + fi +fi + +#DEBHELPER# +exit 0 \ No newline at end of file diff --git a/debian/openssl.postrm b/debian/openssl.postrm new file mode 100644 index 00000000..ffb449dd --- /dev/null +++ b/debian/openssl.postrm @@ -0,0 +1,11 @@ +#!/bin/sh +set -e + +case "$1" in + remove|purge) + rm -rf /usr/share/openssl-defaults + ;; +esac + +#DEBHELPER# +exit 0 diff --git a/debian/rules b/debian/rules index 763638ee..3f08179d 100755 --- a/debian/rules +++ b/debian/rules @@ -1,7 +1,7 @@ #!/usr/bin/make -f %: - dh $@ --with autoreconf + dh $@ # Multiarch triplet DEB_HOST_MULTIARCH := $(shell dpkg-architecture -qDEB_HOST_MULTIARCH) @@ -11,6 +11,9 @@ DESTDIR=debian/tmp # Grab the base version from debian/changelog BASEVER := $(shell dpkg-parsechangelog -SVersion) +# Get OpenSSL version from the build (this will be set after build) +OPENSSL_VERSION ?= 3.5.0 + # Check if FIPS build is requested WOLFSSL_ISFIPS?=0 # Variant-specific metadata @@ -30,44 +33,108 @@ else FIPS_FLAG := endif -# Override just the control-file generation to inject our values -override_dh_gencontrol: - dh_gencontrol -- \ - -v$(VERSION) \ - -Vvariant=$(VARIANT) \ - -Vvariant:desc="$(VARIANT_DESC)" \ - -Vvariant:provides="$(VARIANT_PROVIDES)" - override_dh_auto_configure: # None, handled below override_dh_auto_build: - ./scripts/build-wolfprovider.sh $(FIPS_FLAG) + # Always build OpenSSL with wolfProvider as the default provider + WOLFPROV_BUILD_DEBIAN=1 ./scripts/build-wolfprovider.sh --replace-default $(FIPS_FLAG) override_dh_auto_install: - # Install library + # Detect OpenSSL library directory (lib or lib64) + $(eval OPENSSL_LIB_DIR := $(shell if test -d ./openssl-install/lib; then echo lib; elif test -d ./openssl-install/lib64; then echo lib64; else echo "ERROR: Neither ./openssl-install/lib nor ./openssl-install/lib64 found"; exit 1; fi)) + + # Install OpenSSL binary for openssl package + install -d $(DESTDIR)/usr/bin + install -m755 ./openssl-install/bin/openssl \ + $(DESTDIR)/usr/bin/ + + # Install OpenSSL shared libraries for libssl3 package + install -d $(DESTDIR)/usr/lib/$(DEB_HOST_MULTIARCH) + install -m755 ./openssl-install/$(OPENSSL_LIB_DIR)/libssl.so* \ + ./openssl-install/$(OPENSSL_LIB_DIR)/libcrypto.so* \ + $(DESTDIR)/usr/lib/$(DEB_HOST_MULTIARCH)/ + + # Install OpenSSL headers and dev files for libssl-dev package + install -d $(DESTDIR)/usr/include + find ./openssl-install/include/openssl -type d -exec install -d "$(DESTDIR)/usr/include/openssl/{}" \; + find ./openssl-install/include/openssl -type f -exec install -m644 "{}" "$(DESTDIR)/usr/include/openssl/{}" \; + + # Install wolfProvider library install -d $(DESTDIR)/usr/lib/$(DEB_HOST_MULTIARCH)/ossl-modules install -m755 ./.libs/libwolfprov.so* \ $(DESTDIR)/usr/lib/$(DEB_HOST_MULTIARCH)/ossl-modules/ - # Install headers + # Install wolfProvider headers install -d $(DESTDIR)/usr/include/wolfprovider install -m644 ./include/wolfprovider/*.h \ $(DESTDIR)/usr/include/wolfprovider/ # Install provider config file - install -d $(DESTDIR)/etc/ssl/openssl.cnf.d + install -d $(DESTDIR)/usr/lib/ssl/openssl.cnf.d install -m644 ./$(PROVIDER_CONF) \ - $(DESTDIR)/etc/ssl/openssl.cnf.d/wolfprovider.conf + $(DESTDIR)/usr/lib/ssl/openssl.cnf.d/wolfprovider.conf + + # Install default openssl.cnf template (do NOT ship it directly in /usr/lib/ssl) + # The postinstall script will handle copying it to the system location + install -d $(DESTDIR)/usr/share/openssl-defaults + install -m 0644 ./openssl-source/apps/openssl.cnf \ + $(DESTDIR)/usr/share/openssl-defaults/openssl.cnf + + # Install pkg-config files for libssl-dev + install -d $(DESTDIR)/usr/lib/$(DEB_HOST_MULTIARCH)/pkgconfig + install -m644 ./openssl-install/$(OPENSSL_LIB_DIR)/pkgconfig/*.pc \ + $(DESTDIR)/usr/lib/$(DEB_HOST_MULTIARCH)/pkgconfig/ + # Normalize .pc to system paths + sed -i -e 's|^prefix=.*|prefix=/usr|' \ + -e 's|^exec_prefix=.*|exec_prefix=${prefix}|' \ + -e 's|^libdir=.*|libdir=/usr/lib/$(DEB_HOST_MULTIARCH)|' \ + -e 's|^includedir=.*|includedir=/usr/include|' \ + -e 's|^enginesdir=.*|enginesdir=/usr/lib/$(DEB_HOST_MULTIARCH)/engines-3|' \ + -e 's|^modulesdir=.*|modulesdir=/usr/lib/$(DEB_HOST_MULTIARCH)/ossl-modules|' \ + $(DESTDIR)/usr/lib/$(DEB_HOST_MULTIARCH)/pkgconfig/*.pc + +override_dh_makeshlibs: + # Create shlibs only for real SONAME’d libs; skip provider modules under ossl-modules/ + dh_makeshlibs -V -p libssl3 + # do NOT run on libwolfprov (plugin-only, no SONAME) + +override_dh_gencontrol: + # Generate control for wolfProvider packages + dh_gencontrol -- \ + -v$(VERSION) \ + -Vvariant=$(VARIANT) \ + -Vvariant:desc="$(VARIANT_DESC)" \ + -Vvariant:provides="$(VARIANT_PROVIDES)" + + # Detect OpenSSL library directory (lib or lib64) + $(eval OPENSSL_LIB_DIR := $(shell if test -d ./openssl-install/lib; then echo lib; elif test -d ./openssl-install/lib64; then echo lib64; else echo "ERROR: Neither ./openssl-install/lib nor ./openssl-install/lib64 found"; exit 1; fi)) + + # Extract OpenSSL version from the current build + $(eval OPENSSL_VERSION := $(shell LD_LIBRARY_PATH=./openssl-install/$(OPENSSL_LIB_DIR):./wolfprovider-install/lib ./openssl-install/bin/openssl version | cut -d' ' -f2)) + + # Generate control for OpenSSL packages with OpenSSL version + dh_gencontrol -popenssl -- \ + -v$(OPENSSL_VERSION)-1 \ + -Vopenssl:Version=$(OPENSSL_VERSION) + dh_gencontrol -plibssl3 -- \ + -v$(OPENSSL_VERSION)-1 \ + -Vopenssl:Version=$(OPENSSL_VERSION) + dh_gencontrol -plibssl-dev -- \ + -v$(OPENSSL_VERSION)-1 \ + -Vopenssl:Version=$(OPENSSL_VERSION) override_dh_auto_clean: dh_auto_clean + rm -rf test/standalone/tests/.libs ./scripts/build-wolfprovider.sh --clean --distclean override_dh_auto_test: @echo "Skipping dh_auto_test (tests already run during build phase)" -# Avoid warnings of the form package-has-unnecessary-activation-of-ldconfig-trigger -override_dh_makeshlibs: - dh_makeshlibs -n +override_dh_install: + dh_install +# Fail the build if anything in debian/tmp (or elsewhere) wasn’t picked up +override_dh_missing: + dh_missing --fail-missing diff --git a/default_stub/.gitignore b/default_stub/.gitignore deleted file mode 100644 index f13db083..00000000 --- a/default_stub/.gitignore +++ /dev/null @@ -1,15 +0,0 @@ -Makefile -Makefile.in -.deps/ -.libs/ -*.la -*.lo -*.o -aclocal.m4 -autom4te.cache/ -config.log -config.status -configure -libtool -*.so -*.so.* diff --git a/default_stub/Makefile.am b/default_stub/Makefile.am deleted file mode 100644 index e31303de..00000000 --- a/default_stub/Makefile.am +++ /dev/null @@ -1,2 +0,0 @@ -lib_LTLIBRARIES = libdefault.la -libdefault_la_SOURCES = wp_default_stub.c diff --git a/default_stub/README.md b/default_stub/README.md deleted file mode 100644 index 3bf15917..00000000 --- a/default_stub/README.md +++ /dev/null @@ -1,21 +0,0 @@ -# libdefault - Default Provider Stub Library - -Minimal autotools build for a stub version of the default provider. - -## Building - -```bash -# Generate build system -./autogen.sh - -# Configure and build -./configure -make - -# Clean build artifacts -make clean -``` - -## Output - -The build produces `libdefault.so` in the `.libs/` directory. diff --git a/default_stub/autogen.sh b/default_stub/autogen.sh deleted file mode 100755 index c350c05b..00000000 --- a/default_stub/autogen.sh +++ /dev/null @@ -1,5 +0,0 @@ -#!/bin/bash - -set -e - -autoreconf -fiv diff --git a/default_stub/configure.ac b/default_stub/configure.ac deleted file mode 100644 index 5c44872c..00000000 --- a/default_stub/configure.ac +++ /dev/null @@ -1,7 +0,0 @@ -AC_INIT([libdefault], [1.0], [support@wolfssl.com]) -AM_INIT_AUTOMAKE([-Wall -Werror foreign]) -AC_PROG_CC -AM_PROG_AR -LT_INIT -AC_CONFIG_FILES([Makefile]) -AC_OUTPUT diff --git a/default_stub/wp_default_stub.c b/default_stub/wp_default_stub.c deleted file mode 100644 index 34b0bc88..00000000 --- a/default_stub/wp_default_stub.c +++ /dev/null @@ -1,38 +0,0 @@ -/* - * Copyright (C) 2006-2024 wolfSSL Inc. - * - * This file is part of wolfProvider. - * - * wolfProvider is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 3 of the License, or - * (at your option) any later version. - * - * wolfProvider is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with wolfProvider. If not, see . - */ - -/* Note: to simplify the build process, we are not using the OpenSSL headers. - * Instead, we are using functions that don't specify parameters. This - * allows us to build the stub without having to clone OpenSSL first, - * nor use the system OpenSSL headers. - */ - -/* Prototype of public function that initializes the wolfSSL provider. */ -int wolfssl_provider_init(); - -/* Prototype for the wolfprov_provider_init function */ -int wolfprov_provider_init(); - -/* - * Provider implementation stub - */ -int wolfprov_provider_init() -{ - return 0; -} diff --git a/patches/openssl3-replace-default.patch b/patches/openssl3-replace-default.patch index 37aa2578..511e761a 100644 --- a/patches/openssl3-replace-default.patch +++ b/patches/openssl3-replace-default.patch @@ -1,30 +1,69 @@ diff --git a/crypto/provider_predefined.c b/crypto/provider_predefined.c -index 068e0b7..499a9ca 100644 +index 068e0b7..7bc4ddb 100644 --- a/crypto/provider_predefined.c +++ b/crypto/provider_predefined.c -@@ -10,21 +10,15 @@ +@@ -5,23 +5,56 @@ + * this file except in compliance with the License. You can obtain a copy + * in the file LICENSE in the source distribution or at + * https://www.openssl.org/source/license.html +- */ ++*/ + #include ++#include ++#include ++#include "internal/dso.h" #include "provider_local.h" -OSSL_provider_init_fn ossl_default_provider_init; -+OSSL_provider_init_fn wolfprov_provider_init; ++static DSO *d = NULL; ++ ++/* Common function to dynamically load libwolfprov and call wolfssl_provider_init */ ++static int load_wolfprov_and_init(const OSSL_CORE_HANDLE *handle, ++ const OSSL_DISPATCH *in, const OSSL_DISPATCH **out, ++ void **provctx) { ++ int ret = 0; ++ OSSL_provider_init_fn *wolfssl_provider_init_fn = NULL; ++ ++ d = DSO_new(); ++ if (!d) { ++ fprintf(stderr, "DSO_new() failed\n"); ++ return 1; ++ } ++ ++ if (!DSO_load(d, "wolfprov", NULL, 0)) { ++ fprintf(stderr, "Could not load libwolfprov.so. Is the libwolfprov package installed?\n"); ++ DSO_free(d); ++ return 1; ++ } ++ ++ wolfssl_provider_init_fn = (OSSL_provider_init_fn*)DSO_bind_func(d, "wolfssl_provider_init"); ++ if (!wolfssl_provider_init_fn) { ++ fprintf(stderr, "Failed to find wolfssl_provider_init symbol\n"); ++ DSO_free(d); ++ return 1; ++ } ++ ++ // Intentionally preserve the DSO 'd' here, since it needs to stay loaded ++ ret = wolfssl_provider_init_fn(handle, in, out, provctx); ++ ++ return ret; ++} ++ OSSL_provider_init_fn ossl_base_provider_init; OSSL_provider_init_fn ossl_null_provider_init; -OSSL_provider_init_fn ossl_fips_intern_provider_init; -#ifdef STATIC_LEGACY -OSSL_provider_init_fn ossl_legacy_provider_init; -#endif ++ const OSSL_PROVIDER_INFO ossl_predefined_providers[] = { #ifdef FIPS_MODULE - { "fips", NULL, ossl_fips_intern_provider_init, NULL, 1 }, -+ { "fips", NULL, wolfprov_provider_init, NULL, 1 }, ++ { "fips", NULL, load_wolfprov_and_init, NULL, 1 }, #else - { "default", NULL, ossl_default_provider_init, NULL, 1 }, --# ifdef STATIC_LEGACY -- { "legacy", NULL, ossl_legacy_provider_init, NULL, 0 }, --# endif -+ { "default", NULL, wolfprov_provider_init, NULL, 1 }, -+ { "legacy", NULL, wolfprov_provider_init, NULL, 0 }, - { "base", NULL, ossl_base_provider_init, NULL, 0 }, - { "null", NULL, ossl_null_provider_init, NULL, 0 }, - #endif ++ { "default", NULL, load_wolfprov_and_init, NULL, 1 }, + # ifdef STATIC_LEGACY + { "legacy", NULL, ossl_legacy_provider_init, NULL, 0 }, + # endif diff --git a/scripts/build-debian.sh b/scripts/build-debian.sh index 2a73d9a0..6c6bbc1b 100755 --- a/scripts/build-debian.sh +++ b/scripts/build-debian.sh @@ -111,6 +111,6 @@ git archive --format=tar.gz --prefix="${TARBALL_PREFIX}/" \ # Step 10: Build package echo "⚙️ Building package..." WOLFSSL_ISFIPS=${WOLFSSL_ISFIPS:-0} -debuild --set-envvar WOLFSSL_ISFIPS=${WOLFSSL_ISFIPS} -us -uc +debuild -e WOLFSSL_ISFIPS -us -uc echo "✅ Build completed for version $VERSION" diff --git a/scripts/env-setup b/scripts/env-setup index c7e84302..7fe7e724 100755 --- a/scripts/env-setup +++ b/scripts/env-setup @@ -46,7 +46,7 @@ WOLFPROV_LIB_PATH="$REPO_ROOT/wolfprov-install/lib" # Always reconstruct LD_LIBRARY_PATH with correctly detected OPENSSL_LIB_PATH # ${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH} expands to :$LD_LIBRARY_PATH only if LD_LIBRARY_PATH was already set -export LD_LIBRARY_PATH="$WOLFSSL_LIB_PATH:$OPENSSL_LIB_PATH${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}" +export LD_LIBRARY_PATH="$WOLFPROV_LIB_PATH:$WOLFSSL_LIB_PATH:$OPENSSL_LIB_PATH${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}" # Auto-detect FIPS mode and use appropriate config if [ "${WOLFSSL_ISFIPS:-0}" = "1" ]; then diff --git a/scripts/utils-openssl.sh b/scripts/utils-openssl.sh index 89703aac..932eeaf5 100755 --- a/scripts/utils-openssl.sh +++ b/scripts/utils-openssl.sh @@ -47,6 +47,7 @@ clean_openssl() { make -C "${OPENSSL_SOURCE_DIR}" clean >>$LOG_FILE 2>&1 fi rm -rf "${OPENSSL_INSTALL_DIR}" + rm -rf "${OPENSSL_STUB_INSTALL_DIR}" fi if [ "$WOLFPROV_DISTCLEAN" -eq "1" ]; then printf "Removing OpenSSL source ...\n" @@ -70,7 +71,7 @@ clone_openssl() { DEPTH_ARG=${DEPTH_ARG:---depth=1} printf "\tClone OpenSSL ${CLONE_TAG} from ${OPENSSL_GIT_URL} ... " - git clone ${DEPTH_ARG} -b ${CLONE_TAG} ${OPENSSL_GIT_URL} ${OPENSSL_SOURCE_DIR} + git clone ${DEPTH_ARG} -b ${CLONE_TAG} ${OPENSSL_GIT_URL} ${OPENSSL_SOURCE_DIR} >>$LOG_FILE 2>&1 RET=$? if [ $RET != 0 ]; then @@ -94,15 +95,24 @@ clone_openssl() { fi } +is_openssl_patched() { + if [ ! -f "${OPENSSL_SOURCE_DIR}/crypto/provider_predefined.c" ]; then + return 0 + fi + + pushd ${OPENSSL_SOURCE_DIR} &> /dev/null + patch_applied=$(git diff --quiet "crypto/provider_predefined.c" 2>/dev/null && echo 1 || echo 0) + popd &> /dev/null + return $patch_applied +} + check_openssl_replace_default_mismatch() { local openssl_is_patched=0 # Check if the source was patched for --replace-default - if [ -f "${OPENSSL_SOURCE_DIR}/crypto/provider_predefined.c" ]; then - if grep -q "wolfprov_provider_init" "${OPENSSL_SOURCE_DIR}/crypto/provider_predefined.c" 2>/dev/null; then - openssl_is_patched=1 - printf "INFO: OpenSSL source modified - wolfProvider integrated as default provider (non-stock build).\n" - fi + if is_openssl_patched; then + openssl_is_patched=1 + printf "INFO: OpenSSL source modified - wolfProvider integrated as default provider (non-stock build).\n" fi # Check for mismatch @@ -123,6 +133,19 @@ check_openssl_replace_default_mismatch() { fi } +patch_openssl_version() { + # Patch the OpenSSL version (wolfProvider/openssl-source/VERSION.dat) + # with our BUILD_METADATA, depending on the FIPS flag. Either "wolfProvider" or "wolfProvider-fips". + if [ "$WOLFSSL_ISFIPS" = "1" ]; then + sed -i 's/BUILD_METADATA=.*/BUILD_METADATA=wolfProvider-fips/g' ${OPENSSL_SOURCE_DIR}/VERSION.dat + else + sed -i 's/BUILD_METADATA=.*/BUILD_METADATA=wolfProvider-nonfips/g' ${OPENSSL_SOURCE_DIR}/VERSION.dat + fi + + # Patch the OpenSSL RELEASE_DATE field with the current date in the format DD MMM YYYY + sed -i "s/RELEASE_DATE=.*/RELEASE_DATE=$(date '+%d %b %Y')/g" ${OPENSSL_SOURCE_DIR}/VERSION.dat +} + patch_openssl() { if [ "$WOLFPROV_REPLACE_DEFAULT" = "1" ]; then @@ -135,10 +158,10 @@ patch_openssl() { fi printf "\tApplying OpenSSL default provider patch ... " - cd ${OPENSSL_SOURCE_DIR} + pushd ${OPENSSL_SOURCE_DIR} &> /dev/null # Check if patch is already applied - if grep -q "wolfprov_provider_init" crypto/provider_predefined.c 2>/dev/null; then + if is_openssl_patched; then printf "Already applied.\n" return 0 fi @@ -152,17 +175,86 @@ patch_openssl() { do_cleanup exit 1 fi + patch_openssl_version printf "Done.\n" - cd ${SCRIPT_DIR}/.. + popd &> /dev/null fi } +install_openssl_deb() { + printf "\nInstalling OpenSSL ${OPENSSL_TAG} for Debian packaging ...\n" + clone_openssl + patch_openssl + check_openssl_replace_default_mismatch + + pushd ${OPENSSL_SOURCE_DIR} &> /dev/null + + if [ -d ${OPENSSL_INSTALL_DIR} ]; then + printf "\tOpenSSL install directory already exists: ${OPENSSL_INSTALL_DIR}\n" + printf "\tRemoving existing install directory...\n" + rm -rf ${OPENSSL_INSTALL_DIR} + fi + + # Build configure command + CONFIG_CMD="./config shared" + + # Determine the install paths for Debian Bookworm + DEB_HOST_MULTIARCH=$(dpkg-architecture -qDEB_HOST_MULTIARCH) + CONFIG_CMD+=" --prefix=/usr --openssldir=/usr/lib/ssl --libdir=lib/${DEB_HOST_MULTIARCH} " + + if [ "$WOLFPROV_DEBUG" = "1" ]; then + CONFIG_CMD+=" enable-trace --debug" + fi + + if [ "$WOLFPROV_REPLACE_DEFAULT" = "1" ]; then + CONFIG_CMD+=" no-external-tests no-tests" + fi + + printf "\tConfigure OpenSSL ${OPENSSL_TAG} ... " + $CONFIG_CMD >>$LOG_FILE 2>&1 + RET=$? + if [ $RET != 0 ]; then + printf "ERROR.\n" + rm -rf ${OPENSSL_INSTALL_DIR} + do_cleanup + exit 1 + fi + printf "Done.\n" + + printf "\tBuild OpenSSL ${OPENSSL_TAG} ... " + make -j$NUMCPU >>$LOG_FILE 2>&1 + if [ $? != 0 ]; then + printf "ERROR.\n" + rm -rf ${OPENSSL_INSTALL_DIR} + do_cleanup + exit 1 + fi + printf "Done.\n" + + # Manually set up the install directory rather than running 'make install' + # so that we don't modify the system OpenSSL installation + printf "\tCopying outputs to ${OPENSSL_INSTALL_DIR} for OpenSSL ${OPENSSL_TAG} ... " + mkdir -p ${OPENSSL_INSTALL_DIR}/bin + mkdir -p ${OPENSSL_INSTALL_DIR}/lib + mkdir -p ${OPENSSL_INSTALL_DIR}/include/openssl + mkdir -p ${OPENSSL_INSTALL_DIR}/lib/pkgconfig + cp -r apps/openssl ${OPENSSL_INSTALL_DIR}/bin/openssl + cp -r libcrypto.so* libcrypto.a ${OPENSSL_INSTALL_DIR}/lib/ + cp -r libssl.so* libssl.a ${OPENSSL_INSTALL_DIR}/lib/ + cp -r include/openssl/* ${OPENSSL_INSTALL_DIR}/include/openssl/ + cp -r *.pc ${OPENSSL_INSTALL_DIR}/lib/pkgconfig/ + printf "Done.\n" + + popd &> /dev/null +} + install_openssl() { printf "\nInstalling OpenSSL ${OPENSSL_TAG} ...\n" clone_openssl patch_openssl check_openssl_replace_default_mismatch + pushd ${OPENSSL_SOURCE_DIR} &> /dev/null if [ ! -d ${OPENSSL_INSTALL_DIR} ]; then @@ -175,19 +267,6 @@ install_openssl() { fi if [ "$WOLFPROV_REPLACE_DEFAULT" = "1" ]; then CONFIG_CMD+=" no-external-tests no-tests" - - # Set up library paths to find the stub libdefault - if [ -d "${OPENSSL_STUB_INSTALL_DIR}" ]; then - # Link the stub library directly into libcrypto using LDFLAGS and LDLIBS - CONFIGURE_LDFLAGS="-L${OPENSSL_STUB_INSTALL_DIR}/lib" - CONFIGURE_LDLIBS="-ldefault" - else - printf "ERROR - stub libdefault not found in: ${OPENSSL_STUB_INSTALL_DIR}\n" - do_cleanup - exit 1 - fi - - CONFIG_CMD+=" LDFLAGS=${CONFIGURE_LDFLAGS} LDLIBS=${CONFIGURE_LDLIBS}" fi $CONFIG_CMD >>$LOG_FILE 2>&1 @@ -228,19 +307,6 @@ init_openssl() { install_openssl printf "\tOpenSSL ${OPENSSL_TAG} installed in: ${OPENSSL_INSTALL_DIR}\n" - # Skip version check for replace-default mode since we only build libraries - if [ "$WOLFPROV_REPLACE_DEFAULT" != "1" ]; then - OSSL_VER=`LD_LIBRARY_PATH=${OPENSSL_LIB_DIRS} $OPENSSL_BIN version | tail -n1` - case $OSSL_VER in - OpenSSL\ 3.*) ;; - *) - echo "OpenSSL ($OPENSSL_BIN) has wrong version: $OSSL_VER" - echo "Set: OPENSSL_DIR" - exit 1 - ;; - esac - fi - if [ -z $LD_LIBRARY_PATH ]; then export LD_LIBRARY_PATH=${OPENSSL_LIB_DIRS} else diff --git a/scripts/utils-wolfprovider.sh b/scripts/utils-wolfprovider.sh index 0b7a1163..4f46a2d9 100644 --- a/scripts/utils-wolfprovider.sh +++ b/scripts/utils-wolfprovider.sh @@ -25,14 +25,13 @@ source ${SCRIPT_DIR}/utils-general.sh WOLFPROV_SOURCE_DIR=${SCRIPT_DIR}/.. WOLFPROV_INSTALL_DIR=${SCRIPT_DIR}/../wolfprov-install -LIBDEFAULT_STUB_SOURCE_DIR=${SCRIPT_DIR}/../default_stub +LIBDEFAULT_INSTALL_DIR=${WOLFPROV_INSTALL_DIR} LIBDEFAULT_STUB_INSTALL_DIR=${SCRIPT_DIR}/../libdefault-stub-install WOLFPROV_WITH_WOLFSSL=--with-wolfssl=${WOLFSSL_INSTALL_DIR} # Check if using system wolfSSL installation if command -v dpkg >/dev/null 2>&1; then if dpkg -l | grep -q "^ii.*libwolfssl[[:space:]]" && dpkg -l | grep -q "^ii.*libwolfssl-dev[[:space:]]"; then - printf "\nSkipping wolfSSL installation - libwolfssl and libwolfssl-dev packages are already installed.\n" WOLFPROV_WITH_WOLFSSL= fi fi @@ -40,7 +39,6 @@ fi WOLFPROV_CONFIG_OPTS=${WOLFPROV_CONFIG_OPTS:-"--with-openssl=${OPENSSL_INSTALL_DIR} ${WOLFPROV_WITH_WOLFSSL} --prefix=${WOLFPROV_INSTALL_DIR}"} WOLFPROV_CONFIG_CFLAGS=${WOLFPROV_CONFIG_CFLAGS:-''} - if [ "${WOLFPROV_QUICKTEST}" = "1" ]; then WOLFPROV_CONFIG_CFLAGS="${WOLFPROV_CONFIG_CFLAGS} -DWOLFPROV_QUICKTEST" fi @@ -59,58 +57,6 @@ WOLFPROV_DEBUG=${WOLFPROV_DEBUG:-0} WOLFPROV_CLEAN=${WOLFPROV_CLEAN:-0} WOLFPROV_DISTCLEAN=${WOLFPROV_DISTCLEAN:-0} -install_default_stub() { - printf "\nBuilding default stub library ...\n" - pushd ${LIBDEFAULT_STUB_SOURCE_DIR} &> /dev/null - - # Ensure openssl is present for header files - clone_openssl - - printf "\tGenerate build system ... " - if [ ! -e "configure" ]; then - ./autogen.sh >>$LOG_FILE 2>&1 - if [ $? != 0 ]; then - printf "\n\n...\n" - tail -n 40 $LOG_FILE - do_cleanup - exit 1 - fi - fi - printf "Done.\n" - - printf "\tConfigure default stub ... " - ./configure --prefix=${LIBDEFAULT_STUB_INSTALL_DIR} >>$LOG_FILE 2>&1 - if [ $? != 0 ]; then - printf "\n\n...\n" - tail -n 40 $LOG_FILE - do_cleanup - exit 1 - fi - printf "Done.\n" - - printf "\tBuild default stub ... " - make >>$LOG_FILE 2>&1 - if [ $? != 0 ]; then - printf "\n\n...\n" - tail -n 40 $LOG_FILE - do_cleanup - exit 1 - fi - printf "Done.\n" - - printf "\tInstall default stub ... " - make install >>$LOG_FILE 2>&1 - if [ $? != 0 ]; then - printf "\n\n...\n" - tail -n 40 $LOG_FILE - do_cleanup - exit 1 - fi - printf "Done.\n" - - popd &> /dev/null -} - clean_wolfprov() { printf "\n" @@ -119,56 +65,23 @@ clean_wolfprov() { if [ -f "Makefile" ]; then make clean >>$LOG_FILE 2>&1 fi - # Clean default_stub build artifacts - if [ -f "${LIBDEFAULT_STUB_SOURCE_DIR}/Makefile" ]; then - printf "Cleaning default stub ...\n" - make -C ${LIBDEFAULT_STUB_SOURCE_DIR} clean >>$LOG_FILE 2>&1 - fi - # Remove root libdefault.la file - rm -f libdefault.la - # Remove autoconf files in default_stub - rm -f ${LIBDEFAULT_STUB_SOURCE_DIR}/aclocal.m4 - rm -f ${LIBDEFAULT_STUB_SOURCE_DIR}/config.h - rm -f ${LIBDEFAULT_STUB_SOURCE_DIR}/config.log - rm -f ${LIBDEFAULT_STUB_SOURCE_DIR}/config.status - rm -f ${LIBDEFAULT_STUB_SOURCE_DIR}/configure - rm -f ${LIBDEFAULT_STUB_SOURCE_DIR}/depcomp - rm -f ${LIBDEFAULT_STUB_SOURCE_DIR}/install-sh # Remove entire wolfProvider install directory rm -rf ${WOLFPROV_INSTALL_DIR} + rm -rf ${LOG_FILE} fi if [ "$WOLFPROV_DISTCLEAN" -eq "1" ]; then printf "Removing wolfProvider install ...\n" rm -rf ${WOLFPROV_INSTALL_DIR} - rm -rf ${LIBDEFAULT_STUB_INSTALL_DIR} fi } install_wolfprov() { pushd ${WOLFPROV_SOURCE_DIR} &> /dev/null - # Add stub library path for replace-default functionality after dependencies are installed - if [ "$WOLFPROV_REPLACE_DEFAULT" = "1" ]; then - if [ -z "$LD_LIBRARY_PATH" ]; then - export LD_LIBRARY_PATH="${LIBDEFAULT_STUB_INSTALL_DIR}/lib" - else - export LD_LIBRARY_PATH="${LIBDEFAULT_STUB_INSTALL_DIR}/lib:$LD_LIBRARY_PATH" - fi - fi - - # Build stub first so we can link OpenSSL against it - if [ "$WOLFPROV_REPLACE_DEFAULT" = "1" ]; then - install_default_stub - fi - init_openssl init_wolfssl - printf "\nConsolidating wolfProvider ...\n" - unset OPENSSL_MODULES - unset OPENSSL_CONF - - printf "LD_LIBRARY_PATH: $LD_LIBRARY_PATH\n" + printf "\nInstalling wolfProvider ...\n" printf "\tConfigure wolfProvider ... " if [ ! -e "${WOLFPROV_SOURCE_DIR}/configure" ]; then @@ -189,7 +102,6 @@ install_wolfprov() { ./configure ${WOLFPROV_CONFIG_OPTS} CFLAGS="${WOLFPROV_CONFIG_CFLAGS}" >>$LOG_FILE 2>&1 RET=$? - if [ $RET != 0 ]; then printf "\n\n...\n" tail -n 40 $LOG_FILE @@ -208,15 +120,21 @@ install_wolfprov() { fi printf "Done.\n" - printf "\tTest wolfProvider ... " - make test >>$LOG_FILE 2>&1 - if [ $? != 0 ]; then - printf "\n\n...\n" - tail -n 40 $LOG_FILE - do_cleanup - exit 1 + # Build the replacement default library after wolfprov to avoid linker errors + # but before testing so that the library is present if needed + if [ "$WOLFPROV_REPLACE_DEFAULT" = "1" ]; then + printf "\tWARNING: Skipping tests in replace mode...\n" + else + printf "\tTest wolfProvider ... " + make test >>$LOG_FILE 2>&1 + if [ $? != 0 ]; then + printf "\n\n...\n" + tail -n 40 $LOG_FILE + do_cleanup + exit 1 + fi + printf "Done.\n" fi - printf "Done.\n" printf "\tInstall wolfProvider ... " make install >>$LOG_FILE 2>&1 diff --git a/scripts/utils-wolfssl.sh b/scripts/utils-wolfssl.sh index 481929d9..fab16ec6 100644 --- a/scripts/utils-wolfssl.sh +++ b/scripts/utils-wolfssl.sh @@ -98,10 +98,23 @@ install_wolfssl() { # use the custom OpenSSL built with wolfProvider. if command -v dpkg >/dev/null 2>&1; then if dpkg -l | grep -q "^ii.*libwolfssl[[:space:]]" && dpkg -l | grep -q "^ii.*libwolfssl-dev[[:space:]]"; then + # Check if there is a FIPS mismatch + # If the system wolfSSL is FIPS, we need to be doing a FIPS build + dpkg -l | grep "^ii.*libwolfssl[[:space:]]" | grep -q "fips" + if [ $? -eq 0 ] && [ "$WOLFSSL_ISFIPS" != "1" ]; then + printf "ERROR: System wolfSSL is FIPS, but WOLFSSL_ISFIPS is not set to 1\n" + do_cleanup + exit 1 + elif [ $? -eq 0 ] && [ "$WOLFSSL_ISFIPS" != "0" ]; then + printf "ERROR: System wolfSSL is non-FIPS, but WOLFSSL_ISFIPS is set to 1\n" + do_cleanup + exit 1 + fi + printf "\nSkipping wolfSSL installation - libwolfssl and libwolfssl-dev packages are already installed.\n" # Set WOLFSSL_INSTALL_DIR to system installation directory WOLFSSL_INSTALL_DIR="/usr" - return 0 + return fi fi diff --git a/src/wp_default_replace.c b/src/wp_default_replace.c deleted file mode 100644 index 046a48ec..00000000 --- a/src/wp_default_replace.c +++ /dev/null @@ -1,59 +0,0 @@ -/* - * Copyright (C) 2006-2024 wolfSSL Inc. - * - * This file is part of wolfProvider. - * - * wolfProvider is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 3 of the License, or - * (at your option) any later version. - * - * wolfProvider is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with wolfProvider. If not, see . - */ - -/* - * wolfProvider Real Implementation for libdefault.so - * - * This is the real implementation of wolfprov_provider_init that bridges - * OpenSSL's default provider interface to wolfProvider by dynamically - * loading libwolfprov.so and calling wolfssl_provider_init. - * - * This replaces the stub implementation after wolfProvider is fully built. - */ - -#include - -/* Prototype of public function that initializes the wolfSSL provider. */ -OSSL_provider_init_fn wolfssl_provider_init; - -/* Prototype for the wolfprov_provider_init function */ -int wolfprov_provider_init(const OSSL_CORE_HANDLE* handle, - const OSSL_DISPATCH* in, - const OSSL_DISPATCH** out, - void** provCtx); - -/* - * Real implementation of wolfprov_provider_init. - * - * This function dynamically loads libwolfprov.so and calls its - * wolfssl_provider_init function to provide full wolfProvider functionality. - * - * @param [in] handle Handle to the core. - * @param [in] in Dispatch table from previous provider. - * @param [out] out Dispatch table of wolfSSL provider. - * @param [out] provCtx New provider context. - * @return 1 on success, 0 on failure. - */ -int wolfprov_provider_init(const OSSL_CORE_HANDLE* handle, - const OSSL_DISPATCH* in, - const OSSL_DISPATCH** out, - void** provCtx) -{ - return wolfssl_provider_init(handle, in, out, provCtx); -} diff --git a/test/standalone/tests/.libs/test_sha256_simple.standalone b/test/standalone/tests/.libs/test_sha256_simple.standalone deleted file mode 100755 index e47d2b431a74c4015ceb4b41ddef248a535b4527..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 36176 zcmeHwd3aRS`Tt$!&YDa@5+GrnK!RaONJ2oi)C3ZoVAw*?AmWf^vS>1inF)ebKmjGi zRIsiU0lR6f3$?Z)wF=t0d}}RQ^ovWCx^+@FYSn7B=J$Eea_7z@>9^1K`Tg;GeoyZ_ z_nz~<=Y8Mvp7*@x+;h&obMDs4>Lr@0D)P{kZzu$Hjpmp#k+5gGh#)9a<|@g!o}o-p z?0{_y$J5JrfK+~*)Z#;@!0QN!FOwoegyT3`k)hO(LgE|l*p|#wWT>QanD`8e3OF$w zpTg;6DAUdSd^}xA2p76JUWQgavdz;oc>2=|<3qnFcdG~`ADN5zP71!0f=`A%VNV%K zdy-A)oGaudhJ{F@LxzcbQjf&2g0m?yq&(8g9wvEG59;Ic7bfUknwqyUgeUJD3X;;NX7rEbkzMcPZrN-oE$-+7V_F=B1Fs_(3V+2g^uHel z|H3eGDu>Qo9lbp zK_9H|Zfp&7)kj(x-?ECp;@Y}ED0rz-SyL0}>TU}`LU(s(cR0}8B}tltkw#9>^I6gs zs&A)^C~Jsl?hXcdrqxx8n83jpmW8S5ny#k$2zW$U8ry^Qp`NY;#oIgUn`9QGWlX49 zww@3p>gtJvVL=$L@!~*Z>&1cQ`nGl;Sb3TWql6>f?ZFTcS&#t~l8Vep0s(ZejiL%V z>f1tKLTz<}sc}<%pqWbDc3Dtq2}XjUjY>zbqp_n4iEZJ|#(DEl7mf9yW~KSk?lu$+ zqEI>1InSbaWB2B+NM{VB*c`L`vkD3e3YD{Ay~Tmzf)X=!rWu{J<=JPd1+^RGrO$p?%dc0?PrD?yW6@V;h6;m3=gI9+d{BZdpq4v$U`;s=r;Ux z_9KY@41{*Yp*Rszs*O>qh^hE-9=bme^Z|UH?h`&br+48tU{})U#(;y;zZjIRTha~1 z30ir7%xG)Fh{>t=1a35g9m+HTKe+cM$TyS{0r!k)bJ0lSECENd2-cKy0MjAIIkFwD z%;fmvVjLs!sRHjT3N3gxP8A7rEqJnpJjyJ1 z(n%hE3trlk(pFmVs4(-Wv*5*0mZfd5;5{a_qO@A@NfvyU1@E=sH(Bsvh|N;BS@6;q zDPfldKf)qsj|FeNZ`@+Rr(5U`TJSXPlE+;Z{78vJc*ueuWx*e|;Kh`Pr5?55vn=#a zTkzIF*l`PNi5b%6a3#9-?9`o9;0sl)5P zJ_b`q*MC(ErVg&ZI|ft7*543=sYC0piNVy7^)HIS)PeOE$6)HX`X|L;x{>s!#bD~d z`n4EL9asOyUz_En4y*so7)%{i{|hmgI;j4~V=#40{SU-o>X7=s7lWxI>c2h)QwP+4 zRSc$%r@uP}(+#e_!Gs5Ly{Mh$l!+AztDk|~Ir;H$K>|D_0iKWmk4k{O39vl@{u;x4 zYyO`lz#k^S?RCcwW)fbUCyf0O|4Pk?VqfWMspU!4GNNq{%T z!R6=r`$}(1Qk3#F<+W>8`>%ZeG%B#kzuT6Zhlsy-M@|%B(b1{sP&IPZ( z_X)J^lpQyMEBfDX9e?j{7~(QCR*?3-?(cmnx&;Z_qiV{|GLTjG<$nb&s{3*saNz3R zkD~VzA9{$f50eL1_rCcUwe+H+$mkI$9^LxSfq^4D>0LkQ-w@(ao$L{-Z!Eh1n;IoQjwyMqNjLo1|$VR%!C}FbtFi- z0c||Gl}R$G_kfzI1BMdG0NO1mRrw>NLUbA9;P!9wPv;eqvU3H><-hXRR81AVr`D}6 zzo2}5`GrqF&im6KlWI*C;XQOVQG0yGqe;!3pnjC7b1c*yq~=LhsM0%-7`^AKfq{NE zRnYF_Jw!d#Lj7lweK)5L6ZIBQTg-7k>b!ppn5+Ama(w>2+MFa9ue$f$=uQx_ihKs* zV85hlc*=(A-akKlB@orUA4k8BPPM%E*W@x|VG2=`NI_+$qQi?m@FnD;DvnT|sPr-Z zzLEFAa!5}?x?qUz23f^!IPT&;o3j1$vXq@4B8T$rpZg+PP^*uiJQcmi9+i$V@|$FV zo2b+o%xKBq1x1{VvZ>S$vXYiwfyC%8WYPa2GedGaQBShi=r*Fhnp3YJ>hp>EFsPZQ zLECcVD7F3LKTsGHYBn*zzmh@BT#H#XdLiyqaFC_A0Yu*V5t~fA5?A?Qfr6SzB3jwCEY+ z`aB2*MxFyfpEMVwOxyusOq(`f{C!3P1@k_SjKr2(O4GC}#oZ|hqN zeYp60b(AD!2d#Wn_sy)pSq$C39)+toaP<^f6v5MlBIesMg#q5N`k9C>H?LEG~ZqN0urNt z{G17h?nKy+{L$3@9^GWg=0W1P#>{3FWz!nVCS}Jj1=C^+(|;3F4G={~&Av$1_wMAi zq*XE4WS6wZ3Gy(=52NhLd(YCijr2H8%AvTUs(b%}BEAeV*)D$bccyoB?}yR(pn}0t zcK#OavwtD0$};M`|C)<@iY)nTpnN>Y=e?WYM8aQpCqF}UtIqz;2=#vqmRUf%;1S037ab z(Nqo^Xz%1vDnN8#xY0#FW0~-ZK0;a>M2cMf+ZGh{EZ+7_ctk0AiG#dE>1ji8H7dp& zOEG>-jN^zAqhn@TUKwzIvhPRHJ(gVhpi}e!LwpdilPmTtBtBV#vb_;so!~oxJ1XjB zGxCx3lK&a3`v~ktbcKTMAwR1>KeCW?2GJcb?b}znifqz1zKqn!B)-1VedI;&gAjR~ zBYEKu{@%y^DHVSxIvRcKQ%1O*2%q4DXAVht6DPcl2*1k-Cl5*3!3iHE(_I2WrZ4h$ zfI2Sg3QjlxiR=1XKxyqi&Z8crs`u0K+N$0YYy7?cT#YG9rey$CkpsgMekYK)R>=pPwF^u1TfU*KSOKo%Rm$aZoFBfID?A?m%KMRO3y`BphAe|c?nU(TF0 zRecpXDwW^qpLeXg6;`S0eaVm3R0g~Fd;d_~SNa*OU8SC2^MQ(#U!ec$eWSYf3#POG zsmIZx(UG968VasP=YN7`GViUP7Z*Qi3&8|2A1%KSD#!Ynzh*<<@s!A0=bb{RVYW4}Ge8{}ii=&kYD!03pAkes5iGl+$hlK=ehRuj+lKs`oUw zaGSmr+93rGrf=*H;xUJBS%t5$GZYDK ziZIf_bfyA9UlV(h!|5t27p*yay>D@62Oe-(EYR6J-!~~YJjs`rds&aKVKYoI6&!=* z_OQn+R+(gh!F2M`Mm*(UI+Oy2jR-QbNNaGDEWRn1KP2+uaZ5|2)z{G$?x@G}BVS%{ zQ&+Gt5^VB8>lwb5&WJC!$EtT#Xd^12N!piNLWr3UT8o5P#bA{F!QG;fS&7$RxTmo( z7!Ei0wEOZ!M$Ak@mrv%~Ro`9TfoD72VJaE<7k|jsB_5@OMM;OS3$N!DUBM6@z4`E5 zrMtd+b6lm9-9>$_4n|mQc62uNz>)bgIUhZfLn)ETVEOcr%SVrPq|3(nM>SH(JH$gi zpVXIo`%v}GQU$^GYiKW2r4gT+xE>o2U)Ijsm*OBO~`gWJR_6MQP7EYdftla zCG-R@P`SK(QFUc$k*}dA;*-w;m#wH+Q(d{*7lMD_(IvE!@~sB&!FWMbF1KOWV!c>- z{lQH>JoY1nq%ZbBuZEy6xG@-t*;&>^8kmF25fS5}zXGTf5#s_M!Lw~|m*<^xMnNoLhZ z7qnIpJ@zD++))wEW(rumV)+u2yMjNRHXWB$u9+%Z6>Qhs*1}7dC%j{-Qd(N-V=7yF ze;^Z8=X?oH7LO#II3{Le4ny9Mhg-=l-eg*i{H=leMWnOShil+0_GH>;$vzGU9)dGm@I z&YU~DxMA+>*>S=E_=D~3oipP42MjAP3m&U4Xh(?ooN_WcFmMpzroRjf(3oNu!czz{ z-yazG9AVz+fq`8F|8-!17TWSKve|~P4&gq8yD%7epI{8F=vi$YhQqZ8X&nC`zg@F; zi6BBzFRM}1O{wbGB!_bkcxd&Fo;%(0(ZB%ag;;!XV9iERXc4LeXCdhZI>np1#GAP^ z#dE21n{w8edDCX)OahkiUx4tg{(%9;NJtzcmxcfbfv0@rQGv*{I5XcH81UKjFo zwpQiM?9&%{eb?H`y?Iv~<=(>W_OrbQHT_Q2?JcbE=9PPWi@ceOys3-4PFkN)7UDdC z^EmWQrZO@)ps~uSAUXOX$cPi*hk#75WI(TjuxTFRN~Je-yLO@1iD)&>LZm&2w0zPX zvir1^-pp%t=y5gaxZQwk?Q#fS;`NnF%_=>uz$~_4C@Yp1)z=Ll4-7m5nCGQEMw$5m zQXTqHmtRpD^14n#IlfKy=(AON^RA`5uC`Zr=WcgYcvot7xxI5?A!q>#(<+NS3e`gt zvc7_>hlh~0h-6igtR-AlnYI?P77vo;_tbmmE*XTL3z>e{`U3ddy+Z!AT7@_BYO>3A zo3_O5%`9hiRN-kvd@+kN8xZ+_j{jKT{}l_!_e|t_CDhF6pm$~HkTAU)V}+@IrGw_R zbetz(>c`n3Izg;ba&RIKzm@; zWWXmetnV@qEZCIKzd=y!9nw0%PyIO^SiN9}e77M_ z2$uMjB4erdNkNZQ6n4n`Mfo89Ea&O|5zCpZy!-fGvqb}NdW*ImyccBAqtt`i%}8C(bhu0V0`Uu76}TSK9!6@wJq_{0 z+L@r=!1Ot)WkSyeCk=Xktt9mzusgEoRq^acKx9n!CVvE+Z5&+)okBH2+N6>T0GWY! z@->uPMzQn3Wm}3EBWyy15vHSdK|PufHmb+bAzUWWJIKj5dnpdDpgRbh>PrN+n}M3_ zQnibro{ehQm1=th2}x6t;Fy;E5Q5~#fKQqQ3P;zN-vKe=5yBn>BFT>=$0ZY9C&X$Z zO9r#!i7`}~c5lM;bQv)Nj7p`+cLU5O<*ZvDWrJ;C|F4{lo1mU_wGkQ zGt&v}(hJW31rA18Cn?L65%k{^FWum>(h2R-PfcNjO8Q2yJByOYkH3QyJ&fFRg7h}T zGL-ZMh&xLd!Tm(Q(#U)nm|=j~waoq`;SIV_OtJk0sUuI|;{K=hM?%v@v5`?mo`b0S zr1lA+>7v+P06P6{L|v;4575TCJDsxB_io$b z{Q%&kH1bV-@B3GH>7NUe-F9^1`re~krgjG-ikjmhwQ?zMoYM|t1zx>EojwXgcZ$1* zixgI;8q@7)=s8GO3CiU-?e_?Ztw5^k8kg?$fs`E%k}yY%X;c}JW3m;-E-9=Df*MHJ zDnU$c4qme!fVwc%7OG}!XK2vWkd=uaV>HP;Wt1q{fUDMe?C$82FRiV#Sp^J5W-Ih zQcXrCb4sPxwO8p$r<)=6lMZk+ZBA~D_*rs`viySfQJW}TGr#eQn-vr;pe-qkix0= zyT}y&Ux~su2z8}*YtBi+-mgmGG9qU?ml`jUaO$3RK=4&K?SB)*@%5MoS#+4~o%|zB z%(gTck%RVYT$3>WVsiIE=66Z%1VLl<+d<<_6CEJk;xFO? zwT;wKYGJAt(7THS2@Mmj5+qlEwO-(9eDT9LR=PW^LOAkWXw0+*cV$>k6qIR8 zcV!I11ko4Ba}$>?Tq!_%BsD()%5mB}1?1r5yMyi4Gj9xqt{_m={of zLvUIi=D3v^^v_-P@7=|yPnxpQjB^s3veK&vG-ch8Fxe%&<+OD^(&MMCljXEEb19__ zHEqp_pSJ!5O~;l$mPE-ZY&XTl6qe$SJ8{Xn9Tzc=%_KywoX3ub&SD;WG4OI8OZ0Lc zOK~}mrMR5OQrsuzu@sl{Sc=PeEXCzKmf~_AOK~}mrMR5OQe4hs=Rh?%kEL0joX3)$ zavn?Zh~~p}sb?pyavpmw;@iYLc0J;99$N-Eavr-9aXF9O3mQ3(Js)^EkENlzoX3(5 zavtjky`0AuATH;zq>r4(lHRs)jHikOaw_7fG>>(x zp%~3$9Rb7`;bue_VY=eD57b$Na8NyFZO7#dn#ZQz?4@}8Jl1g!P!rD_r--FJOKH0(OGdB- zu@TCI{glBx?R83|X}L0irg_OPsHX`-R#m+JO?hXfQkEXbV{}|U?#8Egt>u+&(tmYFE& zPa%4kin2j0%ifDP9qPVzh;$E7`b;mf_!v_Dg3~<#`5sHKM$qTDEQR%IlM^2hPC(Fh^7$3UY|L2&B# z3F7O(9h;1u&S4C|h{+i4*O2}!I1fwdGBTc%Dv!I!jco6LW+Wu1lI zkB?NJHnXU~d`}3EO5rjxSqT4?YZ?m6gy%sp)hZY65u>7b;kU#ISJgT;-dL-DU#-C% zZi~nzD;+H!VriK3eN03#%=tb>7AP}HtM3t1oyZFmE`36-P=>FP+)1^3P?Y{*k)-bX zt^+j_1<#!`sQ$>w=HVPk|H{5|KGk0cAZ_3=5-(yXcUF=EeGeclaKJOcxQeJw0DKnb z#5U!}1k?J&-*F~?44a-3*{U}o<)^MPbNh#+;O0O{%(?6!h`H(~^}y_C`c2^W); z#v!G2#Y@>KrF22cZsSfVWg8@HAt~1mDdnnoDUwM0CZt?z{25ZR$*}f=qbC6~^Hw3m zwCnXIzx@+obLy7ts43Pp?al=o9rp2pm6CI1@@;1F5=(N0Onyx!>z$TlCfL&F)kFNn z7vpkp4CREjg*zY}>b@~vG{!aIQ1_Dv1y(|lLa-uMU9qzDjRDJ05{OmkvN!ZckYh0BQ4^qa0jQqvp=o?2Cag}LwG~1V9PhX#dB04KIo=zViW*oxL;W4#M>v^}+Qo=Zl@aNqRj%3; z;a2Im!HvMFrwL-yM}HFYQ5q9Wlfq;~`cifBZW2bVX%YnaaI)5&5=I4F4MD4L@}A|7g2U`tTB(P} z5$josg{GfM;W9FcQ!0yHBe6=!iroysO{A$um^Z#NIB5!BMa_YChk3FlWJD@m>gp!B zq%{5U=~7eaO2J_&ebAIEM;S$E6K9^qFac{#X$$CEW@ z8JVR}$#`5O((u`?3d2x79}CJYz-J3QO$tY#5a4y`PfPF3SS^xi7MZb50Mt9_B)2yBo7Pe_6G+bwLDS=dfn@Yl!i`Y2&Wnyo-LRwEAfl$ko0v1~PsdIj<< zv6{x`zhl{I8YR(SU#zClBw4Jc397wl{o{y=CNf3X@=4Lgsow+4$i}IhY&5L`e28=O zOx$g0I5}Fbsuj!Cvy^fB$KcK1A>S}|E9~Wt8IYSYe*f4ZUl0b;?N(A~c~88LJ^V}Z zpv&GrQPK_hPBch-`zJ_}px_;YFSi zYMP@iTV3lp&!Zy2=~p;~D@XBozTwg7_QSa-*+asx05OWP_3&IV4o?TT5dP&YVd|(n zL4$%Rs#=v!oT=H+YbF#NF@-6ZR-m4h#e^91JZEH8r7z4PvUC%T62;IN)Y3+pX~w*4 z`x#lBV-$AAf(bOK%;+&t~cGIPaHdO&FB$oD$F|pMn?%J3e%yd@};Y~*W=-)qVi?O zEQcEs(?*z)zMq zYB*(W3PVkEn>CE}Y13QQjIQ%YSD6vB33UEfE-AeZYgeW#!Y#==g-4QU9Hz@U&HNI) z)9RG6ewpVBt%q?>QykQfxw<#eCfv>`yv9?dPmdtiOB>2>q_1X^zh@idH&(M|$fktl z64;kf#XND4+s3RpKYIl8uuR@kvbaM_FZC>lYcON~h4YS+jc>ecd=tzvTbs~C<^a4H zNoHH|Ny)5uXm8fSVf_YG3DZo9H3LegW-ysIgPd41$W3epc!0!Q8I=cr9o!7^s2NPP zDC-G%W4*yN)4`c3$ib(_qo_NF7W zNVO;8MXUnN?yfjiRnYRcxJzQoJmnf{1giR_H<<#Ob>c*1qH{XpH8@*w?#B5b&OhSB zHUmlpPEDPtrKHd}N@bT-ggYM>y^&%U<6`Tk3xURF!d-)lowjN*Zo|d#1B%i68IA{V zQ4AH2gyg$F`dHPj+BCzh&u@;{R72I5s81V)-8s`pvyV2?uRwgSkzrRUOs69wJp=Tr zK3z5R48v_#>%eB%^;&hE;R2l#3$tn+FuP*l+YIzFDbBTqlSOVelEI9WQWIhFlL|NC z&!sli?yO@$9c4ONWa->bc>=H7_08(YSVkWsx|gYUnN-ht1hg*u=wBL!J{7Ta*bUKf z6g7+;{Q9op((l_^z&NuKIQ3?te@0P9js)3AMpGeaw8?3__@%I&Jslb8cWl+Bkx5m3 zqNEZ!=o?7V?}a42g5@_-mWk`>B|VFoo{wy0h1Sy&#dN4dbd1T-SJ%ag?_3JI-E4vH z0elV9rPCB5>MIpqNcO!dW?nsH677i@I28t-MHRcpSYW@&Fh;WKa@kv$-1AKquD_m3 zWpuLwRB-(Pa8HqD=wbTLql!z{>o`$3ktm4~P2$z0Z{k$zO)7F$cwH_NVy(w?rq(h^ zc!Y|JTJi8IX_t7XOc=`(;1oj1mpH?CDhEstFH!Bfw+?R?sA?sqr_`LUr{*|Rb9PX3 zeiO|su{oPfIqd{eRdyM+DbwE!G}fM-7%|&N;KEz>IEu0MoJ%ok-gau)c1z2qI}#3k z8d^3?bPm)XagQ;%G_p1fu+*5$(C4#SOm^lP#wPoB(+v;9?p$Z2Ad*ZzVQrc>fjVMj zN%RAZc^n5BHUb-OAM8*bX;tPNphtrZtLerFWRgPcZ-eg~BZ=~~ucey9ONFdgaZ&{* z+XKJc&Uzoz;AM4#NV6(WAb)O?fcdmlesVWNbLEB zZ$3nQgO|zD-BM4@r`vDYfBu<2y`^BXxDm&7kz_P#TtYv7%B_a@ETv?%qA*=s_%{wkjaYeM1jFhI=U?kz(9d^ zOr3xp<~H7AGDMmeMueF^;%3$~+&TkQD+2ffb|4sPQsib6fpBX*b`1&8Gvz>MdsCpZ zxf$CEVB7A7p0;-E!w?Xghg&uR7u%X+&v7NVu`AHg6ljcW!oJ{2g!Y7BTZ?Q)Cb8`e zDC2Pb#vsc%+}epPGU)$1VeA$jKvuMId3P|3?ZqL3Z7faS@lJMoX`0`g2`|`1cd41PLUw%H@5u-F5 z?#k!?YtN?=VZVm_=KApFP-820Tj}fx=l6szZ3{K!M`$DaFcR55?D;531p9q-cIRUg zhE8n4AQKwf>%*-wnYLHRZ*FY1zzW~_gH;*!5Fi_1pM30Z(b+>g<%><(8H!!V)G??h z6mDw?VK)Rq$M(h-JI)8%I~y;K-)CM4H1>1{uzz|_M@SL-!CM%s#HRYODq|H<-`%p2 zRl*YNlpuGh=Nsh{Wh1tyXxtc4Ol@dm35!&73w_9Ggfn*4H_iT+Tkz8s`!T;{JN8pP z+#M8nIh>AapY8oGw&6#~T4@{mKu@SA9Be9%ISqLo+n0fh6c$&oV@q2oNUmqeify~k zd=r%+TS8z_XD98jFB_5A^`12l){^4d2XBM2G0BF+Hm(UoI$1^YR%4orDi6E!ci?I^ z6>8Q2YQJ+z(5i%!(CZ`Enjb+YZ=T{?0%k*^4+DUQ+95S0d?BEx3jwty*6d&v+Djy6 z8=kh2d9&GDkP_HVKY-5`)H71n+&O8&M+63ag#hj!tnc93F@9zx+VjV%Byu3%gq|#! zwzH}44pM)HjYh&8iB62{#SCXLzW5RWNQ>g?pLq%KP_tEFq9UaeThvfDLz`(Ra(52Y z75fGSt7N7ZdPv%$CQPpI?|n@oo=SX|L40e0vM!F-jDO1^;qwoPpHdLtY={?4d)J`s zJ@63b2eL$BCm3^w5nc{_9|Kb8I}Kz9<}9Yq#(xV!ZVghkys9>^y0W&mYWdl#71*>G zo0o(eSq02Q-G-X#(b)uNQZ0qqRo-Iw##9B3Lwu2;V{>;9yUE0TnPF&&%FLc{_sq6X zV|!0ia3(tDz?>5Cy`Pp)&&-B4eCdLbpfS#DX>1%!QZ!4l{~NMqMmBc^A#u<*B!<#> zrm(g70ST$5zz$R*K*O1tLrrhUo5Tj0C7><;kGSM}OK* zG;|B*;sD|H%qd_E0=v68*w%?~A?uu=>^BA}#s%=&6T$}9uuz)x3`O$E;X+J0?I?tZ zyi+48zV3md;FBM%$}2RD#)MuTcDXQSQnfqH)*sX~$UXz@Uu@aF&6-1-I|Lj$kH{^Bs%t;_$EF?#dwV{X0Bq=y{y zpI>hMlofCOY0Itevf|DETe)@l2P!7t{J)f2mw$j_c=L}=Zu3t|3~&BZ$*mu@$~XUH zgmPKSYyLmTt>;Zr*ulyx|K^ZnKe(6K5;idZrUTtg8Ni$WutAG>ph$n!}rCV{K=fbGSkFA4D_ z7X!qV;D^)14zS*uq^`2vN*UJ53|A55fn?wh@C;Y+*2Vd_b~Tc?hKO%T#yg3(B;TE^ zuC?9Gd1|aY#L4;Uz;_}^y})*Yt64{CZc7GYTQVyx5LYJOn2d?ojil`b@HX4elb%aL z1?F%C4iM_aq)&m8ulF+4mB~LzcI)z`+*tOuqwX)=u-=#MV;*kKW1drZhG0A8`GO<3 zTz2KewIF`Pqpr6-;$b|n-7(M09+>E5&VxQBc5t3m;Ca-eUTAxi^T3M7JSRM`;t9@U zu_EWFkt)H4$2`CHz=pr)q|$hr?Oo_j?fpyl9UjL<1wGxk1GYOnKk_&c^=(upv7&$J z{*lM6KSvK;a1e?PFx~Ef1KjTUAr<$B;L^ie7{f8oJ7AD6(#99Y`H>UUA31M!p-a2j zb%UE5?FRQlZXh0VKf)0#3zp4M;;02juNx-ob$^=(V6tz6R9&Ayw+eLExKZENa5|WY z(OtmkY^R+APV{y+xF2+@E2$isZM*Ac7n$H@*I!)lUR3_Gh`Dw7J}fKH4ep=2-MV~F zm7zYd?{e4=o)%5bcDLiF4!17f`lKS;{@{28DESH}Lw)7g?sV(&eN2Y>q4OS~TePn~KAK6|vVCA{;L9EdKuzgKLU)%mG~7N55%SzyX~ zo^D&uYcFfuLtfVUAS70F{0F?&HvR<-WqE-U!6_Kgxq`@+Hv`3SgUK4Zsc^^4F6=exyF2+7DhSi~C>do2pw^CUdE*xP98Kn*HGSCB@^~a{!-_ z;LF-SH8>Chd3&+lsQ*NVQLU(_^>=`hZzUa2sQ;0Dwb6`cjC9x(hpl{x;*g^fywcqR zw4}4Wss35DordPv>B0Vq-S#PN$hPf{T@J-|gX5rsxus(JmE#!)b4SJYuH$2ejoc9R z?!3)uBllBm_c(v%v_0s27}0~SAGmCHx$bq@9zr`%Y}-7ydRUi0>I{2Omta%=I*>?! zx24IV%C&e5N{5eK@gfJpq3H8~SMg;(x%q_nx1mxj@N%n(av^8QFmhG_uPLd@LGj-} zL9USh5dL@qzFFYq{!fzrazs?@#*|maF;q@EcHvZ&QHtE3i6L>hA1BF|`$DK^@Tp1`{^%9YLL0*PfL9Xmt)L%4Irum|$k=fy@S@QO3=ggcekgr@ zI1HY4*G_{*i7&4{I}APj_iZToE=|Z0?Ne@6eahAoWl?pir$8r2u zB6-Cya@vN$-#!ffQ7K=%z9-*ve`y%{PYJJ$P*Nwx>-ps{^jT=nL)mA}F!*yB9_>-Q zxB0NhhQ1d(l$>jZ!LNX0P(8};ON%jya>p?Av|m%2hSz2BW~=phoY6y$un+Y+bi6!_ zoX>!#dQ2^2WafqbgEo}@^zX5u@NU*PAz*Bos66BxD@MDz11pGRI_a)$4fFCN~ zO$-nJ7yk~rSCjxZjv?vq90vcmkdye2o0oz237OX5(_!SKV`4HC{iI>=3xOZ1Tp)XaN5^KcSRlTuwUyMms6wmJOKQrORbqSQ3i=Xl0FMv?m41QrSJWthinYtjmsKrR z0%upRSX5peSg~XYR?Gsmw4F0?#Ga*;$&Z@O!mCf#wQ2UqqD(Hj@eiN|g0baQT677} zsx`z}zrJb;q|c!81;RKKUki;xvC<_hw~F;`T82zeB7U`zFJvZ=utzx9+?kg%_PyK$ zGSpKTi`!T+#8V5VM8f*5Hw_I1L8hiY?71rNY|#1HYe!9Bn^H%^RK>3ZL!S|jpg6| zYIV##`GdFw#rWeRvlwJpr69by0}o*kM!I>}Dq~oR4R&`a1=s~VSb$~m0<6V$;ll)* zEht+2ZOU(J5~%V;Rd_(zqA>DSJb+XRnl^`!1rPB&jHRG~gz-o+4hSHvJJ?=N3?kOm z9#IO&Ka~PR3-B!i9tj5++EgHk~KF{nFPmsSvL6+Lik6QoIq%iz5>=a6w^Ro~GD zVVoV_p%l=1G`e=+f(<<_psWw!tKSlA3pIDjczr`dcW|SG+VM&CQg4n!_XIV7=F-3igd_O3|Bc4SE98ZlL6orIg@{`;Fn>cl^Ahn z0z3z>m7m6kbjUD=gXR^(i@2i-kdyc>xOOQx=<4Q8QAFd3` z1hdp%(#a72AW~?rT?rqe2|NxN9%K-=G3hDw7igsq5wfY|m;3+9@T4G=`AdFT{+k8= zB0(qj6PBUef0+1*Cz1aS;K(LYzB%p}K14vHte~ZRPg~J{cZNFu0sn$neet z{-gM-7acN`bQ~L-mPq^|Bv|u5F8F0=-8-LTNIn_TyvoWi*NtR&FFB{>kbDyL7$R1F zIUkfE{=OP_B--ycf?w9Z;uGW|r1xj7hd`UC-yuf%OMba-A;Wf)l1CEre>H*s@EM#= zhC8HSAxHX;0F`$Tp(ib(nVRc0Pt#w=a3s=8ScZQE4gMu+^2_z1S5Et@L<|9Q&J_#p* znQ$_HUl~tH9fse>lg;Z0k-s1}@sgk3uC^YeD;+W%BltNsc3mI@Zit~+O!7(e)M5B< z6a4>}Bq@2A$Ul1+{u^oG5y!QduUd~p{>8)aXRqa4nF;MTk$;8YPqg2>CeFX!>=-#L z`DIA|E1`HI|4kQhdfL9(dPqJQUL^RfG!#E38t%6e97gg<`pbslKZjPmaooWJ^P0#{ zaDs}A_O#%?OO!tsSXx__>d5;K-R`9CGDdN^<#HYg{SWm=-StrX_NzGmw-OXi0G0m( DvP`U3 From ece6ca59bda7a1d1d91ce29c264b4c6b59d3e6fc Mon Sep 17 00:00:00 2001 From: Paul Adelsbach Date: Mon, 1 Sep 2025 16:03:31 -0700 Subject: [PATCH 4/4] Add standalone test scripts --- debian/libssl-dev.install | 2 +- debian/rules | 6 +- debian/tests/bind9.sh | 54 ++++++++++++ debian/tests/cjose.sh | 2 + debian/tests/cjose_smoke.c | 31 +++++++ debian/tests/curl.sh | 75 +++++++++++++++++ debian/tests/iperf.sh | 65 +++++++++++++++ debian/tests/kmod.sh | 112 +++++++++++++++++++++++++ debian/tests/oaep.sh | 73 +++++++++++++++++ debian/tests/ppp.sh | 24 ++++++ debian/tests/ppp_smoke.c | 164 +++++++++++++++++++++++++++++++++++++ debian/tests/rsa.sh | 13 +++ debian/tests/snmp.sh | 64 +++++++++++++++ 13 files changed, 681 insertions(+), 4 deletions(-) create mode 100755 debian/tests/bind9.sh create mode 100755 debian/tests/cjose.sh create mode 100644 debian/tests/cjose_smoke.c create mode 100755 debian/tests/curl.sh create mode 100755 debian/tests/iperf.sh create mode 100755 debian/tests/kmod.sh create mode 100755 debian/tests/oaep.sh create mode 100755 debian/tests/ppp.sh create mode 100644 debian/tests/ppp_smoke.c create mode 100755 debian/tests/rsa.sh create mode 100755 debian/tests/snmp.sh diff --git a/debian/libssl-dev.install b/debian/libssl-dev.install index 94f97e6c..049ee3ed 100755 --- a/debian/libssl-dev.install +++ b/debian/libssl-dev.install @@ -1,5 +1,5 @@ #!/usr/bin/dh-exec -usr/include/openssl/* +usr/include/openssl/** usr/lib/${DEB_HOST_MULTIARCH}/libcrypto.so usr/lib/${DEB_HOST_MULTIARCH}/libssl.so usr/lib/${DEB_HOST_MULTIARCH}/pkgconfig/openssl.pc diff --git a/debian/rules b/debian/rules index 3f08179d..284884b5 100755 --- a/debian/rules +++ b/debian/rules @@ -56,9 +56,9 @@ override_dh_auto_install: $(DESTDIR)/usr/lib/$(DEB_HOST_MULTIARCH)/ # Install OpenSSL headers and dev files for libssl-dev package - install -d $(DESTDIR)/usr/include - find ./openssl-install/include/openssl -type d -exec install -d "$(DESTDIR)/usr/include/openssl/{}" \; - find ./openssl-install/include/openssl -type f -exec install -m644 "{}" "$(DESTDIR)/usr/include/openssl/{}" \; + # Copy directly to the destination directory + install -d $(DESTDIR)/usr/include/openssl + cp -a $(CURDIR)/openssl-install/include/openssl/. $(DESTDIR)/usr/include/openssl # Install wolfProvider library install -d $(DESTDIR)/usr/lib/$(DEB_HOST_MULTIARCH)/ossl-modules diff --git a/debian/tests/bind9.sh b/debian/tests/bind9.sh new file mode 100755 index 00000000..ea59e6ab --- /dev/null +++ b/debian/tests/bind9.sh @@ -0,0 +1,54 @@ +#!/usr/bin/env bash +set -Eeuo pipefail + +ALG="${1:-ecdsa}" # ecdsa | rsa | both +ZONENAME="smoke.test" # no trailing dot for args +ZFILE="zone.db" + +mk_zone_dir() { + local dir="$1" + mkdir -p "$dir" + cat >"$dir/$ZFILE" <<'ZONE' +$ORIGIN smoke.test. +$TTL 300 +@ IN SOA ns.smoke.test. hostmaster.smoke.test. ( 1 3600 600 604800 300 ) + IN NS ns.smoke.test. +ns IN A 127.0.0.1 +www IN A 127.0.0.1 +ZONE +} + +sign_one() { + local algo="$1" dir + dir="$(mktemp -d)"; echo "work dir: $dir" + mk_zone_dir "$dir" + pushd "$dir" >/dev/null + + case "$algo" in + ecdsa) + dnssec-keygen -a ECDSAP256SHA256 -b 256 -n ZONE -f KSK "$ZONENAME" >/dev/null + dnssec-keygen -a ECDSAP256SHA256 -b 256 -n ZONE "$ZONENAME" >/dev/null + ;; + rsa) + dnssec-keygen -a RSASHA256 -b 2048 -n ZONE -f KSK "$ZONENAME" >/dev/null + dnssec-keygen -a RSASHA256 -b 2048 -n ZONE "$ZONENAME" >/dev/null + ;; + esac + + # Import/publish keys and sign (no need to $INCLUDE) + dnssec-signzone -v 5 -S -K "$PWD" -o "$ZONENAME" "$ZFILE" >"sign-$algo.log" 2>&1 || { + echo "FAIL: [$algo] signing failed"; sed -n '1,200p' "sign-$algo.log"; exit 1; } + + dnssec-verify -o "$ZONENAME" "$ZFILE.signed" >"verify-$algo.log" 2>&1 && \ + echo "PASS: [$algo] sign+verify OK" || { echo "FAIL verify"; sed -n '1,200p' "verify-$algo.log"; exit 1; } + + popd >/dev/null + echo "kept: $dir" +} + +case "${ALG,,}" in + ecdsa) sign_one ecdsa ;; + rsa) sign_one rsa ;; + both) sign_one ecdsa; sign_one rsa ;; + *) echo "usage: $0 [ecdsa|rsa|both]"; exit 2 ;; +esac diff --git a/debian/tests/cjose.sh b/debian/tests/cjose.sh new file mode 100755 index 00000000..0d04ec75 --- /dev/null +++ b/debian/tests/cjose.sh @@ -0,0 +1,2 @@ +cc -O2 -o cjose_smoke cjose_smoke.c $(pkg-config --cflags --libs cjose) && \ +./cjose_smoke; rm -f cjose_smoke || true diff --git a/debian/tests/cjose_smoke.c b/debian/tests/cjose_smoke.c new file mode 100644 index 00000000..5397190d --- /dev/null +++ b/debian/tests/cjose_smoke.c @@ -0,0 +1,31 @@ +#include +#include +#include + +int main(void) { + cjose_err err = {0}; + // 32-byte HMAC key (octet JWK) + uint8_t key[32]; for (int i=0;i<32;i++) key[i]=(uint8_t)i; + cjose_jwk_t *jwk = cjose_jwk_create_oct_spec(key, sizeof(key), &err); + + cjose_header_t *hdr = cjose_header_new(&err); + cjose_header_set(hdr, CJOSE_HDR_ALG, CJOSE_HDR_ALG_HS256, &err); + + const char *msg = "hello cjose"; + cjose_jws_t *jws = cjose_jws_sign(jwk, hdr, (const uint8_t*)msg, strlen(msg), &err); + + const char *compact = NULL; + cjose_jws_export(jws, &compact, &err); + + cjose_jws_t *parsed = cjose_jws_import(compact, strlen(compact), &err); + if (!cjose_jws_verify(parsed, jwk, &err)) return 2; + + uint8_t *pt = NULL; size_t pt_len = 0; + cjose_jws_get_plaintext(parsed, &pt, &pt_len, &err); + + int ok = (pt_len == strlen(msg) && memcmp(pt, msg, pt_len) == 0); + cjose_jws_release(parsed); cjose_jws_release(jws); cjose_header_release(hdr); cjose_jwk_release(jwk); + if (!ok) return 3; + puts("OK: cjose JWS HS256 sign+verify"); + return 0; +} diff --git a/debian/tests/curl.sh b/debian/tests/curl.sh new file mode 100755 index 00000000..f63d61c8 --- /dev/null +++ b/debian/tests/curl.sh @@ -0,0 +1,75 @@ +#!/usr/bin/env bash +set -Eeuo pipefail + +URL="https://example.com" +INCLUDE_LEGACY=0 # add CBC-only suites if requested + +# --- args: [--legacy] [URL] --- +for a in "$@"; do + case "$a" in + --legacy) INCLUDE_LEGACY=1 ;; + http://*|https://*) URL="$a" ;; + *) URL="$a" ;; + esac +done + +# Require curl linked with OpenSSL +if ! curl -V | grep -q 'OpenSSL'; then + echo "SKIP: this curl is not OpenSSL-backed"; exit 2 +fi + +run_case() { + local name="$1"; shift + local tls_line verify rc + if tls_line="$(curl -q -fsS -o /dev/null -v "$URL" "$@" 2>&1 | awk '/SSL connection using/{sub(/.*using /,""); print; exit}')"; then + verify="$(curl -q -fsS -o /dev/null -w '%{ssl_verify_result}' "$URL" "$@")" + if [ "$verify" = "0" ]; then + printf 'PASS %-30s %s\n' "[$name]" "$tls_line" + else + printf 'FAIL %-30s verify=%s (%s)\n' "[$name]" "$verify" "$tls_line" + return 1 + fi + else + rc=$? + printf 'FAIL %-30s curl exit=%s (likely no overlap)\n' "[$name]" "$rc" + return "$rc" + fi +} + +echo "Target: $URL" +echo "curl: $(curl -V | head -n1)" +echo "(CHACHA20 suites intentionally excluded)" + +# 0) Default handshake (server's choice) +run_case "default" || true + +# 1) TLS 1.3 (all TLS1.3 suites use (EC)DHE KEX; choose AES-GCM only) +run_case "tls13 AES128-GCM" --tlsv1.3 --tls-max 1.3 \ + --tls13-ciphers TLS_AES_128_GCM_SHA256 || true +run_case "tls13 AES256-GCM" --tlsv1.3 --tls-max 1.3 \ + --tls13-ciphers TLS_AES_256_GCM_SHA384 || true + +# 2) TLS 1.2 ECDHE (Elliptic-Curve Diffie-Hellman Ephemeral) — AES-GCM +run_case "tls12 ECDHE AES128-GCM" --tlsv1.2 --tls-max 1.2 \ + --ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256' || true +run_case "tls12 ECDHE AES256-GCM" --tlsv1.2 --tls-max 1.2 \ + --ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384' || true + +# 3) TLS 1.2 classic DHE (finite-field Diffie-Hellman) — AES-GCM +run_case "tls12 DHE AES128-GCM" --tlsv1.2 --tls-max 1.2 \ + --ciphers 'DHE-RSA-AES128-GCM-SHA256' || true +run_case "tls12 DHE AES256-GCM" --tlsv1.2 --tls-max 1.2 \ + --ciphers 'DHE-RSA-AES256-GCM-SHA384' || true + +# 4) Optional legacy CBC (often disabled server-side) +if [ "$INCLUDE_LEGACY" -eq 1 ]; then + run_case "tls12 ECDHE AES128-CBC" --tlsv1.2 --tls-max 1.2 \ + --ciphers 'ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA' || true + run_case "tls12 ECDHE AES256-CBC" --tlsv1.2 --tls-max 1.2 \ + --ciphers 'ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA' || true + run_case "tls12 DHE AES128-CBC" --tlsv1.2 --tls-max 1.2 \ + --ciphers 'DHE-RSA-AES128-SHA' || true + run_case "tls12 DHE AES256-CBC" --tlsv1.2 --tls-max 1.2 \ + --ciphers 'DHE-RSA-AES256-SHA' || true +fi + diff --git a/debian/tests/iperf.sh b/debian/tests/iperf.sh new file mode 100755 index 00000000..5d4c2e3d --- /dev/null +++ b/debian/tests/iperf.sh @@ -0,0 +1,65 @@ +#!/usr/bin/env bash + +# iperf3-auth-smoke.sh +set -Eeuo pipefail + +PORT="$(shuf -i 42000-49000 -n1)" +tmp="$(mktemp -d)"; srv= +cleanup(){ [[ -n "$srv" ]] && kill "$srv" 2>/dev/null || true; rm -rf "$tmp"; } +trap cleanup EXIT + +echo "tmp: $tmp port: $PORT" + +# 1) Keys and user DB +openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out "$tmp/priv.pem" >/dev/null +openssl pkey -in "$tmp/priv.pem" -pubout > "$tmp/pub.pem" 2>/dev/null + +user=alice; pass=secret +hash="$(printf "{%s}%s" "$user" "$pass" | sha256sum | awk '{print $1}')" +printf "# username,sha256\n%s,%s\n" "$user" "$hash" > "$tmp/users.csv" + +# 2) Start server (debug so it logs auth) and wait for it to bind +iperf3 -s -1 -d -p "$PORT" \ + --rsa-private-key-path "$tmp/priv.pem" \ + --authorized-users-path "$tmp/users.csv" \ + >"$tmp/server.log" 2>&1 & +srv=$! + +for i in {1..20}; do + sleep 0.1 + ss -Huan | awk '{print $5}' | grep -qE "127\.0\.0\.1:$PORT" && break || true +done + +# helper: run a client once and return exit code +run_client() { + local pw="$1" + IPERF3_PASSWORD="$pw" \ + iperf3 -c 127.0.0.1 -p "$PORT" -t 1 \ + --username "$user" --rsa-public-key-path "$tmp/pub.pem" \ + --json >"$tmp/client.json" 2>"$tmp/client.err" || return $? +} + +# 3) Positive case (correct password) +if run_client "$pass"; then + echo "PASS(positive): client completed with correct password" +else + echo "FAIL: client failed with correct password" + echo "--- server.log (tail) ---"; tail -n 50 "$tmp/server.log" + echo "--- client.err ---"; cat "$tmp/client.err" + exit 1 +fi + +# 4) Negative case (wrong password must fail) +if run_client "WRONG-password"; then + echo "FAIL: client unexpectedly succeeded with wrong password" + echo "--- server.log (tail) ---"; tail -n 50 "$tmp/server.log" + exit 1 +else + echo "PASS(negative): client failed with wrong password (auth enforced)" +fi + +# 5) Optional: show explicit auth lines from server debug +echo "--- auth lines from server.log ---" +grep -i 'auth' "$tmp/server.log" || echo "(no explicit lines; depends on build verbosity)" + +echo "OK: iperf3 auth smoke test completed." diff --git a/debian/tests/kmod.sh b/debian/tests/kmod.sh new file mode 100755 index 00000000..fc68b3d1 --- /dev/null +++ b/debian/tests/kmod.sh @@ -0,0 +1,112 @@ +#!/usr/bin/env bash +set -Eeuo pipefail + +# kmod/OpenSSL signature smoke test +# Builds a tiny .ko, signs it with your OpenSSL, and has modinfo parse the signature. +# Assumes your provider/config is already selected outside this script (OPENSSL_CONF, LD_LIBRARY_PATH, etc). + +# --- Options you can override --- +: "${OPENSSL_DIR:=}" # e.g. /usr/local/openssl/bin (prepends to PATH so sign-file uses your openssl) +: "${KEY_BITS:=2048}" # RSA key size +: "${HASH_ALGO:=sha256}" # sign-file hash (sha256/sha384/sha512) +: "${CN:=kmod-smoke}" # x509 CN for the self-signed cert +: "${KEEP:=0}" # set KEEP=1 to keep the temp workdir + +# --- Setup workspace --- +work="$(mktemp -d)" +cleanup(){ [[ "${KEEP}" = "1" ]] && { echo "Keeping workdir: $work"; return; }; rm -rf "$work"; } +trap cleanup EXIT + +[[ -n "$OPENSSL_DIR" ]] && export PATH="$OPENSSL_DIR:$PATH" + +echo "=== kmod signature smoke ===" +echo "workdir: $work" +echo "OPENSSL in use: $(command -v openssl || true)" +openssl version || true +echo + +# --- Preconditions --- +need() { command -v "$1" >/dev/null 2>&1 || { echo "Missing: $1"; exit 1; }; } +need make +need modinfo + +build_dir="/lib/modules/$(uname -r)/build" +if [[ ! -e "$build_dir" ]]; then + echo "ERROR: kernel headers not found at $build_dir." + echo "Debian/Ubuntu: sudo apt-get install build-essential linux-headers-$(uname -r)" + exit 1 +fi + +sign_file="$build_dir/scripts/sign-file" +if [[ ! -x "$sign_file" ]]; then + echo "ERROR: sign-file not found at $sign_file" + echo "Install proper kernel headers; sign-file ships with the kernel tree." + exit 1 +fi + +# --- Create module sources --- +cat > "$work/kmod_smoke.c" <<'EOF' +#include +#include +MODULE_LICENSE("GPL"); +MODULE_AUTHOR("kmod-smoke"); +MODULE_DESCRIPTION("kmod signature smoke test module"); +MODULE_VERSION("1.0"); +static int __init kmod_smoke_init(void) { return 0; } +static void __exit kmod_smoke_exit(void) {} +module_init(kmod_smoke_init); +module_exit(kmod_smoke_exit); +EOF + +cat > "$work/Makefile" <<'EOF' +obj-m += kmod_smoke.o +all: + $(MAKE) -C /lib/modules/$(shell uname -r)/build M=$(PWD) modules +clean: + $(MAKE) -C /lib/modules/$(shell uname -r)/build M=$(PWD) clean +EOF + +# --- Build the module (no insert) --- +echo "Building module..." +make -C "$work" -s + +ko="$work/kmod_smoke.ko" +[[ -f "$ko" ]] || { echo "Build failed: $ko not found"; exit 1; } + +# --- Generate key + self-signed cert (DER) with your OpenSSL --- +echo "Generating self-signed keypair..." +openssl req -new -x509 -newkey "rsa:${KEY_BITS}" -nodes \ + -keyout "$work/MOK.priv" -out "$work/MOK.der" -outform DER \ + -subj "/CN=${CN}/" + +# --- Sign the module (CMS if available, else PKCS#7; handled by sign-file) --- +echo "Signing module with $HASH_ALGO ..." +"$sign_file" "$HASH_ALGO" "$work/MOK.priv" "$work/MOK.der" "$ko" + +# --- Have kmod parse the signature block via OpenSSL --- +echo +echo "modinfo signature fields:" +modinfo -F sig_id "$ko" || true +modinfo -F signer "$ko" || true +modinfo -F sig_key "$ko" || true +modinfo -F sig_hashalgo "$ko" || true +sig_hex="$(modinfo -F signature "$ko" || true)" +echo "signature (hex): ${sig_hex:0:64}..." + +# --- Basic assertions (tolerant) --- +fail=0 +signer="$(modinfo -F signer "$ko" || true)" +algo="$(modinfo -F sig_hashalgo "$ko" || true)" +[[ -n "$signer" ]] || { echo "ASSERT: signer is empty"; fail=1; } +[[ "$algo" == "$HASH_ALGO" ]] || { echo "ASSERT: sig_hashalgo expected $HASH_ALGO, got $algo"; fail=1; } +if [[ -z "$sig_hex" ]]; then + echo "ASSERT: signature blob is empty"; fail=1; +fi + +echo +if [[ "$fail" -eq 0 ]]; then + echo "=== Summary: PASS (kmod+OpenSSL can parse module signature) ===" +else + echo "=== Summary: FAIL ===" + exit 1 +fi diff --git a/debian/tests/oaep.sh b/debian/tests/oaep.sh new file mode 100755 index 00000000..e023a917 --- /dev/null +++ b/debian/tests/oaep.sh @@ -0,0 +1,73 @@ +#!/usr/bin/env bash +set -Eeuo pipefail + +# OAEP (RSA-2048, SHA-256/MGF1-SHA-256) smoke test using your default OpenSSL provider. +# Usage: +# ./oaep.sh # uses a mktemp dir, cleans it up on exit +# KEEP=1 ./oaep.sh # keep the temp dir for debugging +# ./oaep.sh /path/dir # use a specific directory (no auto-clean) + +DIR="${1:-}" +CLEANUP=0 + +if [[ -n "$DIR" ]]; then + DIR="${DIR%/}" + mkdir -p "$DIR" +else + DIR="$(mktemp -d)" + CLEANUP=1 +fi + +if [[ "${KEEP:-0}" == "1" ]]; then + CLEANUP=0 +fi + +cleanup() { + if (( CLEANUP )); then rm -rf "$DIR"; fi +} +trap cleanup EXIT + +PRIV="$DIR/priv.pem" +PUB="$DIR/pub.pem" +PT="$DIR/pt.bin" +CT="$DIR/ct.bin" +PT2="$DIR/pt2.bin" + +echo "work dir: $DIR" + +# 1) Ensure a known-good keypair exists (RSA-2048, e=65537) +if [[ ! -s "$PRIV" || ! -s "$PUB" ]]; then + echo "Generating RSA-2048 keypair..." + openssl genpkey -algorithm RSA \ + -pkeyopt rsa_keygen_bits:2048 \ + -pkeyopt rsa_keygen_pubexp:65537 \ + -out "$PRIV" + chmod 600 "$PRIV" + openssl pkey -in "$PRIV" -pubout > "$PUB" +fi + +# 2) Quick sanity on the keys (will throw if invalid) +openssl pkey -in "$PRIV" -check -noout >/dev/null +openssl pkey -pubin -in "$PUB" -text -noout >/dev/null + +# 3) Tiny plaintext +printf 'test123' > "$PT" + +# 4) Encrypt with RSA-OAEP using SHA-256 (MGF1=SHA-256) +openssl pkeyutl -encrypt -pubin -inkey "$PUB" -in "$PT" -out "$CT" \ + -pkeyopt rsa_padding_mode:oaep \ + -pkeyopt rsa_oaep_md:sha256 \ + -pkeyopt rsa_mgf1_md:sha256 + +# 5) Decrypt and compare +openssl pkeyutl -decrypt -inkey "$PRIV" -in "$CT" -out "$PT2" \ + -pkeyopt rsa_padding_mode:oaep \ + -pkeyopt rsa_oaep_md:sha256 \ + -pkeyopt rsa_mgf1_md:sha256 + +if diff -u "$PT" "$PT2" >/dev/null; then + echo "OK: OAEP-SHA256 works" +else + echo "FAIL: decrypted plaintext mismatch" + exit 1 +fi diff --git a/debian/tests/ppp.sh b/debian/tests/ppp.sh new file mode 100755 index 00000000..db463ebc --- /dev/null +++ b/debian/tests/ppp.sh @@ -0,0 +1,24 @@ +#!/usr/bin/env bash +set -Eeuo pipefail + +# This wrapper assumes your provider/config is already set up externally. +# If needed, you can still point at custom libs/modules via env before running: +# export LD_LIBRARY_PATH=/path/to/your/lib:$LD_LIBRARY_PATH +# export OPENSSL_MODULES=/path/to/your/ossl-modules +# Optional: PROP_QUERY='provider=wolfprov' to constrain fetches. + +: "${CC:=gcc}" + +echo "Compiling ppp_crypto_smoke.c..." +CFLAGS="-O2 -Wall -Wextra" +if pkg-config --exists openssl 2>/dev/null; then + $CC $CFLAGS -o ppp_crypto_smoke ppp_smoke.c $(pkg-config --cflags --libs openssl) +else + echo "NOTE: pkg-config openssl not found; falling back to -lcrypto" + $CC $CFLAGS -o ppp_crypto_smoke ppp_smoke.c -lcrypto +fi + +echo +echo "Running..." +./ppp_crypto_smoke +rm -f ppp_crypto_smoke diff --git a/debian/tests/ppp_smoke.c b/debian/tests/ppp_smoke.c new file mode 100644 index 00000000..0bead6ea --- /dev/null +++ b/debian/tests/ppp_smoke.c @@ -0,0 +1,164 @@ +// PPP crypto smoke test (no provider loading/listing) +// Checks SHA1, MD4 (NT hash), HMAC-MD5, DES-ECB, RC4 via OpenSSL 3 EVP fetch. +// Prints which provider actually serviced each algorithm (informational). +#include +#include +#include +#include +#include +#include + +static void hex(const unsigned char *b, size_t n, char *out) { + static const char d[] = "0123456789abcdef"; + for (size_t i=0;i>4]; out[2*i+1]=d[b[i]&0xF]; } + out[2*n]='\0'; +} +static const char* prov_name_from_md(const EVP_MD *md){ + const OSSL_PROVIDER *p = EVP_MD_get0_provider(md); + return p ? OSSL_PROVIDER_get0_name(p) : ""; +} +static const char* prov_name_from_cipher(const EVP_CIPHER *c){ + const OSSL_PROVIDER *p = EVP_CIPHER_get0_provider(c); + return p ? OSSL_PROVIDER_get0_name(p) : ""; +} + +static int check_digest(const char *name, const char *propq, + const unsigned char *msg, size_t msglen, + const char *expect_hex) { + int rc = -1; + unsigned char out[EVP_MAX_MD_SIZE]; + unsigned int outlen = 0; + EVP_MD_CTX *ctx = EVP_MD_CTX_new(); + if (!ctx) { fprintf(stderr, "EVP_MD_CTX_new failed\n"); return rc; } + EVP_MD *md = EVP_MD_fetch(NULL, name, propq); + if (!md) { printf("SKIP %-10s (unavailable)\n", name); EVP_MD_CTX_free(ctx); return -2; } + if (!EVP_DigestInit_ex(ctx, md, NULL) || + !EVP_DigestUpdate(ctx, msg, msglen) || + !EVP_DigestFinal_ex(ctx, out, &outlen)) { + fprintf(stderr, "EVP_Digest* failed for %s\n", name); + EVP_MD_free(md); EVP_MD_CTX_free(ctx); return rc; + } + char got[2*EVP_MAX_MD_SIZE+1]; hex(out, outlen, got); + printf("OK %-10s provider=%s digest=%s\n", name, prov_name_from_md(md), got); + rc = (0 == strcasecmp(got, expect_hex)) ? 0 : 1; + if (rc) fprintf(stderr, "MISMATCH %s\n expected: %s\n got: %s\n", name, expect_hex, got); + EVP_MD_free(md); EVP_MD_CTX_free(ctx); + return rc; +} + +static int check_hmac(const char *mdname, const char *propq, + const unsigned char *key, size_t klen, + const unsigned char *msg, size_t mlen, + const char *expect_hex) { + int rc = -1; + unsigned char out[EVP_MAX_MD_SIZE]; + unsigned int outlen = 0; + EVP_MD *md = EVP_MD_fetch(NULL, mdname, propq); + if (!md) { printf("SKIP HMAC-%-6s (unavailable)\n", mdname); return -2; } + if (!HMAC(md, key, (int)klen, msg, mlen, out, &outlen)) { + fprintf(stderr, "HMAC(%s) failed\n", mdname); + EVP_MD_free(md); + return rc; + } + char got[2*EVP_MAX_MD_SIZE+1]; hex(out, outlen, got); + printf("OK HMAC-%-6s provider=%s mac=%s\n", mdname, prov_name_from_md(md), got); + rc = (0 == strcasecmp(got, expect_hex)) ? 0 : 1; + if (rc) fprintf(stderr, "MISMATCH HMAC-%s\n expected: %s\n got: %s\n", mdname, expect_hex, got); + EVP_MD_free(md); + return rc; +} + +static int check_cipher_block(const char *cname, const char *propq, + const unsigned char *key, size_t klen, + const unsigned char *in, size_t ilen, + const char *expect_hex, int disable_pad) { + (void)klen; + int rc = -1; + EVP_CIPHER *ciph = EVP_CIPHER_fetch(NULL, cname, propq); + if (!ciph) { printf("SKIP %-10s (unavailable)\n", cname); return -2; } + EVP_CIPHER_CTX *ctx = EVP_CIPHER_CTX_new(); + if (!ctx) { fprintf(stderr, "EVP_CIPHER_CTX_new failed\n"); EVP_CIPHER_free(ciph); return rc; } + if (!EVP_EncryptInit_ex2(ctx, ciph, key, NULL, NULL)) { fprintf(stderr, "EncryptInit %s failed\n", cname); goto done; } + if (disable_pad) EVP_CIPHER_CTX_set_padding(ctx, 0); + + unsigned char out[128]; int outl1=0, outl2=0; + if (!EVP_EncryptUpdate(ctx, out, &outl1, in, (int)ilen)) { fprintf(stderr, "EncryptUpdate %s failed\n", cname); goto done; } + if (!EVP_EncryptFinal_ex(ctx, out+outl1, &outl2)) { fprintf(stderr, "EncryptFinal %s failed\n", cname); goto done; } + + char got[2*128+1]; hex(out, outl1+outl2, got); + printf("OK %-10s provider=%s ct=%s\n", cname, prov_name_from_cipher(ciph), got); + rc = (0 == strcasecmp(got, expect_hex)) ? 0 : 1; + if (rc) fprintf(stderr, "MISMATCH %s\n expected: %s\n got: %s\n", cname, expect_hex, got); + +done: + EVP_CIPHER_free(ciph); + EVP_CIPHER_CTX_free(ctx); + return rc; +} + +static int check_stream_rc4(const char *propq, + const unsigned char *key, size_t klen, + size_t nbytes, const char *expect_hex) { + (void)klen; + int rc = -1; + EVP_CIPHER *ciph = EVP_CIPHER_fetch(NULL, "RC4", propq); + if (!ciph) { printf("SKIP RC4 (unavailable)\n"); return -2; } + EVP_CIPHER_CTX *ctx = EVP_CIPHER_CTX_new(); + if (!ctx) { fprintf(stderr, "EVP_CIPHER_CTX_new failed\n"); EVP_CIPHER_free(ciph); return rc; } + if (!EVP_EncryptInit_ex2(ctx, ciph, key, NULL, NULL)) { fprintf(stderr, "EncryptInit RC4 failed\n"); goto done; } + + unsigned char in[64]={0}, out[64]={0}; int outl=0, tmp=0; + if (nbytes > sizeof(in)) nbytes = sizeof(in); + if (!EVP_EncryptUpdate(ctx, out, &outl, in, (int)nbytes)) { fprintf(stderr, "RC4 update failed\n"); goto done; } + if (!EVP_EncryptFinal_ex(ctx, out+outl, &tmp)) { fprintf(stderr, "RC4 final failed\n"); goto done; } outl += tmp; + + char got[2*64+1]; hex(out, outl, got); + printf("OK RC4 provider=%s keystream=%s\n", prov_name_from_cipher(ciph), got); + rc = (0 == strncasecmp(got, expect_hex, (int)strlen(expect_hex))) ? 0 : 1; + if (rc) fprintf(stderr, "MISMATCH RC4\n expected: %s\n got: %s\n", expect_hex, got); + +done: + EVP_CIPHER_free(ciph); + EVP_CIPHER_CTX_free(ctx); + return rc; +} + +int main(void){ + const char *propq = getenv("PROP_QUERY"); // optional (e.g., "provider=wolfprov") + int failures = 0; + + // SHA1("abc") + { const unsigned char msg[] = "abc"; + int rc = check_digest("SHA1", propq, msg, 3, "a9993e364706816aba3e25717850c26c9cd0d89d"); + if (rc > 0) failures++; } + + // MD4(UTF16LE("password")) -> NT hash + { const char *pw = "password"; size_t n = strlen(pw); + unsigned char utf16le[128]; + for (size_t i=0;i 0) failures++; } + + // HMAC-MD5("Jefe", "what do ya want for nothing?") + { const unsigned char key[] = "Jefe"; + const unsigned char msg[] = "what do ya want for nothing?"; + int rc = check_hmac("MD5", propq, key, strlen((char*)key), msg, strlen((char*)msg), + "750c783e6ab0b503eaa86e310a5db738"); + if (rc > 0) failures++; } + + // DES-ECB: K=133457799BBCDFF1, P=0123456789ABCDEF -> C=85E813540F0AB405 + { const unsigned char key[8] = {0x13,0x34,0x57,0x79,0x9b,0xbc,0xdf,0xf1}; + const unsigned char pt [8] = {0x01,0x23,0x45,0x67,0x89,0xab,0xcd,0xef}; + int rc = check_cipher_block("DES-ECB", propq, key, sizeof(key), pt, sizeof(pt), + "85e813540f0ab405", 1); + if (rc > 0) failures++; } + + // RC4 keystream for key="Key" (first 16 bytes per RFC 6229) + { const unsigned char key[] = {0x4b,0x65,0x79}; // "Key" + int rc = check_stream_rc4(propq, key, sizeof(key), 16, + "eb9f7781b734ca72a7190ec8792e513f"); + if (rc > 0) failures++; } + + printf("\n=== Summary: %s ===\n", failures ? "FAIL" : "PASS"); + return failures ? 1 : 0; +} diff --git a/debian/tests/rsa.sh b/debian/tests/rsa.sh new file mode 100755 index 00000000..533aec2e --- /dev/null +++ b/debian/tests/rsa.sh @@ -0,0 +1,13 @@ +#!/bin/bash + + +# Generates a temp RSA key, signs "hello", verifies the signature. +# Success prints "OK: OpenSSL RSA SHA-256 sign+verify". +set -euo pipefail +tmp="$(mktemp -d)"; trap 'rm -rf "$tmp"' EXIT +printf "hello" >"$tmp/msg" +openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out "$tmp/priv.pem" >/dev/null +openssl pkey -in "$tmp/priv.pem" -pubout -out "$tmp/pub.pem" >/dev/null +openssl dgst -sha256 -sign "$tmp/priv.pem" -out "$tmp/sig" "$tmp/msg" >/dev/null +openssl dgst -sha256 -verify "$tmp/pub.pem" -signature "$tmp/sig" "$tmp/msg" >/dev/null +echo "OK: OpenSSL RSA SHA-256 sign+verify" diff --git a/debian/tests/snmp.sh b/debian/tests/snmp.sh new file mode 100755 index 00000000..a0d00838 --- /dev/null +++ b/debian/tests/snmp.sh @@ -0,0 +1,64 @@ +#!/usr/bin/env bash +# snmp-openssl-smoke.sh (numeric OID; no MIBs needed) +set -Eeuo pipefail + +USER="${USER:-smokeuser}" +AUTHPASS="${AUTHPASS:-authpass123}" # ≥8 chars +PRIVPASS="${PRIVPASS:-privpass123}" # ≥8 chars +OID_NUM="${OID_NUM:-.1.3.6.1.2.1.1.3.0}" # sysUpTime.0 numeric +PORT="$(shuf -i 16100-16999 -n1)" + +need() { command -v "$1" >/dev/null || { echo "ERR: '$1' not found"; exit 2; }; } +need snmpd; need snmpget + +# Ensure the client will hit OpenSSL/libcrypto +if ! ldd "$(command -v snmpget)" | grep -Eq 'libcrypto\.so|libssl\.so'; then + echo "SKIP: snmpget not linked with OpenSSL/libcrypto on this host"; exit 2 +fi + +tmp="$(mktemp -d)"; srv='' +cleanup(){ [ -n "$srv" ] && kill "$srv" 2>/dev/null || true; rm -rf "$tmp"; } +trap cleanup EXIT + +# Minimal agent config: localhost only, v3 user with SHA auth + AES privacy +cat >"$tmp/snmpd.conf" <"$tmp/snmpd.log" 2>&1 & +srv=$! + +# Quick readiness: attempt the real v3 GET a few times +tries=20 +ok=0 +while (( tries-- > 0 )); do + if snmpget -v3 -l authPriv -u "$USER" -a SHA -A "$AUTHPASS" -x AES -X "$PRIVPASS" \ + -On -Oqv -r 0 -t 0.5 udp:127.0.0.1:$PORT "$OID_NUM" >/dev/null 2>&1; then + ok=1; break + fi + sleep 0.1 +done + +# Now run once for output + verify +if (( ok )); then + val="$(snmpget -v3 -l authPriv -u "$USER" -a SHA -A "$AUTHPASS" -x AES -X "$PRIVPASS" \ + -On -Oqv udp:127.0.0.1:$PORT "$OID_NUM" 2>"$tmp/client.err" || true)" + if [ -n "$val" ]; then + # Pull auth/priv hints from debug (optional) + hint="$(snmpget -v3 -l authPriv -u "$USER" -a SHA -A "$AUTHPASS" -x AES -X "$PRIVPASS" \ + -On -Oqv -Dtemp:usm udp:127.0.0.1:$PORT "$OID_NUM" 2>&1 \ + | awk '/usm/ && /authProtocol:|privProtocol:/ {print $0}' \ + | sed -n 's/.*authProtocol: \([^ ]*\).*/auth=\1/p; s/.*privProtocol: \([^ ]*\).*/ priv=\1/p' \ + | tr -d '\n')" + echo "PASS: SNMPv3 authPriv succeeded — $OID_NUM = $val ${hint:+($hint)}" + exit 0 + fi +fi + +echo "FAIL: SNMPv3 authPriv GET failed" +echo "--- snmpd.log (tail) ---"; tail -n 20 "$tmp/snmpd.log" || true +echo "--- client.err ---"; cat "$tmp/client.err" 2>/dev/null || true +exit 1