Add openssh ptest patch for wolfprovider
Paul Adelsbach
night1rider
parent
d8bdf0c876
commit
d4e0576285
|
|
@ -0,0 +1,70 @@
|
|||
#!/bin/sh
|
||||
|
||||
export TEST_SHELL=sh
|
||||
# Enable unit tests - don't skip them
|
||||
# export SKIP_UNIT=1
|
||||
|
||||
# Required for test environment permissions
|
||||
export TEST_SSH_UNSAFE_PERMISSIONS=1
|
||||
|
||||
# Enable FIPS mode for tests (used by openssh-FIPS-wolfprov.patch)
|
||||
export FIPS_MODE=1
|
||||
|
||||
cd regress
|
||||
|
||||
# copied from openssh-portable/.github/run_test.sh
|
||||
output_failed_logs() {
|
||||
for i in failed*.log; do
|
||||
if [ -f "$i" ]; then
|
||||
echo -------------------------------------------------------------------------
|
||||
echo LOGFILE $i
|
||||
cat $i
|
||||
echo -------------------------------------------------------------------------
|
||||
fi
|
||||
done
|
||||
}
|
||||
trap output_failed_logs 0
|
||||
|
||||
sed -i "/\t\tagent-ptrace /d" Makefile
|
||||
|
||||
# wolfProvider CI style: run file-tests, interop-tests, extra-tests, and unit
|
||||
# Skip t-exec as it takes too long
|
||||
make -k BUILDDIR=`pwd`/.. .OBJDIR=`pwd` .CURDIR=`pwd` SUDO="" FIPS_MODE=1 \
|
||||
file-tests interop-tests extra-tests unit \
|
||||
| sed -u -e 's/^skipped/SKIP: /g' -e 's/^ok /PASS: /g' -e 's/^failed/FAIL: /g'
|
||||
|
||||
SSHAGENT=`which ssh-agent`
|
||||
GDB=`which gdb`
|
||||
|
||||
if [ -z "${SSHAGENT}" -o -z "${GDB}" ]; then
|
||||
echo "SKIP: agent-ptrace"
|
||||
exit
|
||||
fi
|
||||
|
||||
useradd openssh-test
|
||||
|
||||
eval `su -c "${SSHAGENT} -s" openssh-test` > /dev/null
|
||||
r=$?
|
||||
if [ $r -ne 0 ]; then
|
||||
echo "FAIL: could not start ssh-agent: exit code $r"
|
||||
else
|
||||
su -c "gdb -p ${SSH_AGENT_PID}" openssh-test > /tmp/gdb.out 2>&1 << EOF
|
||||
quit
|
||||
EOF
|
||||
r=$?
|
||||
if [ $r -ne 0 ]; then
|
||||
echo "gdb failed: exit code $r"
|
||||
fi
|
||||
egrep 'ptrace: Operation not permitted.|procfs:.*Permission denied.|ttrace.*Permission denied.|procfs:.*: Invalid argument.|Unable to access task ' >/dev/null /tmp/gdb.out
|
||||
r=$?
|
||||
rm -f /tmp/gdb.out
|
||||
if [ $r -ne 0 ]; then
|
||||
echo "FAIL: ptrace agent"
|
||||
else
|
||||
echo "PASS: ptrace agent"
|
||||
fi
|
||||
|
||||
${SSHAGENT} -k > /dev/null
|
||||
fi
|
||||
userdel openssh-test
|
||||
|
||||
|
|
@ -0,0 +1,40 @@
|
|||
# OpenSSH wolfProvider FIPS mode configuration
|
||||
# Include this file for standard wolfProvider integration as a provider plugin
|
||||
|
||||
# Bring in the openssh patch from the OSP repository (target only)
|
||||
# TODO: Use the official OSP repository when the patch is merged
|
||||
# https://github.com/wolfSSL/osp/pull/311
|
||||
SRC_URI:append:class-target = " \
|
||||
git://github.com/padelsbach/osp.git;protocol=https;branch=wp-openssh-fips-patch;name=osp;destsuffix=git/osp \
|
||||
"
|
||||
|
||||
# Track the revision for the OSP auxiliary repo fetch
|
||||
SRCREV_osp = "${AUTOREV}"
|
||||
|
||||
# Ensure BitBake can locate the updated run-ptest script in this include's files directory
|
||||
FILESEXTRAPATHS:prepend := "${WOLFSSL_LAYERDIR}/inc/wolfprovider/openssh/files:"
|
||||
SRC_URI:append:class-target = " file://run-ptest"
|
||||
|
||||
# Apply the patch for the correct version of OpenSSH
|
||||
python do_patch:append:class-target () {
|
||||
import os, subprocess
|
||||
# Only run this when FIPS is enabled
|
||||
if not bb.utils.contains('IMAGE_FEATURES', 'fips', True, False, d):
|
||||
bb.note("FIPS not enabled; skipping openssh-V_9_6_P1-FIPS-wolfprov.patch")
|
||||
return
|
||||
patch_path = os.path.join(d.getVar("WORKDIR"), "git/osp/wolfProvider/openssh/openssh-V_9_6_P1-FIPS-wolfprov.patch")
|
||||
s = d.getVar("S")
|
||||
|
||||
# Try to apply the patch; if it fails with "already applied", log it and continue
|
||||
try:
|
||||
result = subprocess.run(["patch", "-d", s, "-p1", "-i", patch_path, "--dry-run"],
|
||||
capture_output=True, text=True, check=False)
|
||||
if result.returncode == 0:
|
||||
bb.note(f"{patch_path} can be applied, applying now...")
|
||||
subprocess.run(["patch", "-d", s, "-p1", "-i", patch_path], check=True)
|
||||
else:
|
||||
bb.note(f"{patch_path} already applied or cannot apply, skipping")
|
||||
bb.debug(1, f"Patch check output: {result.stderr}")
|
||||
except Exception as e:
|
||||
bb.warn(f"{patch_path}: Error applying patch: {e}")
|
||||
}
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
# OpenSSH ptest modifications for wolfProvider FIPS testing
|
||||
|
||||
require ${WOLFSSL_LAYERDIR}/inc/wolfprovider/openssh/openssh-enable-wolfprovider.inc
|
||||
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
# OpenSSH ptest modifications for wolfProvider FIPS testing
|
||||
|
||||
require ${WOLFSSL_LAYERDIR}/inc/wolfprovider/openssh/openssh-enable-wolfprovider.inc
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
# OpenSSH ptest modifications for wolfProvider FIPS testing
|
||||
|
||||
require ${WOLFSSL_LAYERDIR}/inc/wolfprovider/openssh/openssh-enable-wolfprovider.inc
|
||||
|
||||
|
|
@ -29,6 +29,7 @@ IMAGE_INSTALL:append = " \
|
|||
wolfprovider \
|
||||
openssl \
|
||||
openssl-bin \
|
||||
openssh \
|
||||
wolfprovidercmd \
|
||||
wolfproviderenv \
|
||||
pkgconfig \
|
||||
|
|
|
|||
|
|
@ -0,0 +1,4 @@
|
|||
# OpenSSH ptest modifications for wolfProvider FIPS testing
|
||||
|
||||
require ${WOLFSSL_LAYERDIR}/inc/wolfprovider/openssh/openssh-enable-wolfprovider.inc
|
||||
|
||||
Loading…
Reference in New Issue