From d4e0576285327e2273336afdd341bdf770268ab6 Mon Sep 17 00:00:00 2001 From: Paul Adelsbach Date: Wed, 10 Dec 2025 11:10:00 -0800 Subject: [PATCH] Add openssh ptest patch for wolfprovider --- inc/wolfprovider/openssh/files/run-ptest | 70 +++++++++++++++++++ .../openssh/openssh-enable-wolfprovider.inc | 40 +++++++++++ .../openssh_%.bbappend | 4 ++ .../openssh_%.bbappend | 3 + .../openssh_%.bbappend | 4 ++ .../fips-image-minimal/fips-image-minimal.bb | 1 + .../fips-image-minimal/openssh_%.bbappend | 4 ++ 7 files changed, 126 insertions(+) create mode 100644 inc/wolfprovider/openssh/files/run-ptest create mode 100644 inc/wolfprovider/openssh/openssh-enable-wolfprovider.inc create mode 100644 recipes-core/images/wolfprovider-images/wolfprovider-image-minimal/openssh_%.bbappend create mode 100644 recipes-core/images/wolfprovider-images/wolfprovider-replace-default-image-minimal/openssh_%.bbappend create mode 100644 recipes-core/images/wolfssl-combined-image-minimal/openssh_%.bbappend create mode 100644 recipes-core/images/wolfssl-linux-fips-images/fips-image-minimal/openssh_%.bbappend diff --git a/inc/wolfprovider/openssh/files/run-ptest b/inc/wolfprovider/openssh/files/run-ptest new file mode 100644 index 0000000..0b9db9d --- /dev/null +++ b/inc/wolfprovider/openssh/files/run-ptest @@ -0,0 +1,70 @@ +#!/bin/sh + +export TEST_SHELL=sh +# Enable unit tests - don't skip them +# export SKIP_UNIT=1 + +# Required for test environment permissions +export TEST_SSH_UNSAFE_PERMISSIONS=1 + +# Enable FIPS mode for tests (used by openssh-FIPS-wolfprov.patch) +export FIPS_MODE=1 + +cd regress + +# copied from openssh-portable/.github/run_test.sh +output_failed_logs() { + for i in failed*.log; do + if [ -f "$i" ]; then + echo ------------------------------------------------------------------------- + echo LOGFILE $i + cat $i + echo ------------------------------------------------------------------------- + fi + done +} +trap output_failed_logs 0 + +sed -i "/\t\tagent-ptrace /d" Makefile + +# wolfProvider CI style: run file-tests, interop-tests, extra-tests, and unit +# Skip t-exec as it takes too long +make -k BUILDDIR=`pwd`/.. .OBJDIR=`pwd` .CURDIR=`pwd` SUDO="" FIPS_MODE=1 \ + file-tests interop-tests extra-tests unit \ + | sed -u -e 's/^skipped/SKIP: /g' -e 's/^ok /PASS: /g' -e 's/^failed/FAIL: /g' + +SSHAGENT=`which ssh-agent` +GDB=`which gdb` + +if [ -z "${SSHAGENT}" -o -z "${GDB}" ]; then + echo "SKIP: agent-ptrace" + exit +fi + +useradd openssh-test + +eval `su -c "${SSHAGENT} -s" openssh-test` > /dev/null +r=$? +if [ $r -ne 0 ]; then + echo "FAIL: could not start ssh-agent: exit code $r" +else + su -c "gdb -p ${SSH_AGENT_PID}" openssh-test > /tmp/gdb.out 2>&1 << EOF + quit +EOF + r=$? + if [ $r -ne 0 ]; then + echo "gdb failed: exit code $r" + fi + egrep 'ptrace: Operation not permitted.|procfs:.*Permission denied.|ttrace.*Permission denied.|procfs:.*: Invalid argument.|Unable to access task ' >/dev/null /tmp/gdb.out + r=$? + rm -f /tmp/gdb.out + if [ $r -ne 0 ]; then + echo "FAIL: ptrace agent" + else + echo "PASS: ptrace agent" + fi + + ${SSHAGENT} -k > /dev/null +fi +userdel openssh-test + diff --git a/inc/wolfprovider/openssh/openssh-enable-wolfprovider.inc b/inc/wolfprovider/openssh/openssh-enable-wolfprovider.inc new file mode 100644 index 0000000..930344a --- /dev/null +++ b/inc/wolfprovider/openssh/openssh-enable-wolfprovider.inc @@ -0,0 +1,40 @@ +# OpenSSH wolfProvider FIPS mode configuration +# Include this file for standard wolfProvider integration as a provider plugin + +# Bring in the openssh patch from the OSP repository (target only) +# TODO: Use the official OSP repository when the patch is merged +# https://github.com/wolfSSL/osp/pull/311 +SRC_URI:append:class-target = " \ + git://github.com/padelsbach/osp.git;protocol=https;branch=wp-openssh-fips-patch;name=osp;destsuffix=git/osp \ +" + +# Track the revision for the OSP auxiliary repo fetch +SRCREV_osp = "${AUTOREV}" + +# Ensure BitBake can locate the updated run-ptest script in this include's files directory +FILESEXTRAPATHS:prepend := "${WOLFSSL_LAYERDIR}/inc/wolfprovider/openssh/files:" +SRC_URI:append:class-target = " file://run-ptest" + +# Apply the patch for the correct version of OpenSSH +python do_patch:append:class-target () { + import os, subprocess + # Only run this when FIPS is enabled + if not bb.utils.contains('IMAGE_FEATURES', 'fips', True, False, d): + bb.note("FIPS not enabled; skipping openssh-V_9_6_P1-FIPS-wolfprov.patch") + return + patch_path = os.path.join(d.getVar("WORKDIR"), "git/osp/wolfProvider/openssh/openssh-V_9_6_P1-FIPS-wolfprov.patch") + s = d.getVar("S") + + # Try to apply the patch; if it fails with "already applied", log it and continue + try: + result = subprocess.run(["patch", "-d", s, "-p1", "-i", patch_path, "--dry-run"], + capture_output=True, text=True, check=False) + if result.returncode == 0: + bb.note(f"{patch_path} can be applied, applying now...") + subprocess.run(["patch", "-d", s, "-p1", "-i", patch_path], check=True) + else: + bb.note(f"{patch_path} already applied or cannot apply, skipping") + bb.debug(1, f"Patch check output: {result.stderr}") + except Exception as e: + bb.warn(f"{patch_path}: Error applying patch: {e}") +} diff --git a/recipes-core/images/wolfprovider-images/wolfprovider-image-minimal/openssh_%.bbappend b/recipes-core/images/wolfprovider-images/wolfprovider-image-minimal/openssh_%.bbappend new file mode 100644 index 0000000..6f1cbb9 --- /dev/null +++ b/recipes-core/images/wolfprovider-images/wolfprovider-image-minimal/openssh_%.bbappend @@ -0,0 +1,4 @@ +# OpenSSH ptest modifications for wolfProvider FIPS testing + +require ${WOLFSSL_LAYERDIR}/inc/wolfprovider/openssh/openssh-enable-wolfprovider.inc + diff --git a/recipes-core/images/wolfprovider-images/wolfprovider-replace-default-image-minimal/openssh_%.bbappend b/recipes-core/images/wolfprovider-images/wolfprovider-replace-default-image-minimal/openssh_%.bbappend new file mode 100644 index 0000000..66577a1 --- /dev/null +++ b/recipes-core/images/wolfprovider-images/wolfprovider-replace-default-image-minimal/openssh_%.bbappend @@ -0,0 +1,3 @@ +# OpenSSH ptest modifications for wolfProvider FIPS testing + +require ${WOLFSSL_LAYERDIR}/inc/wolfprovider/openssh/openssh-enable-wolfprovider.inc diff --git a/recipes-core/images/wolfssl-combined-image-minimal/openssh_%.bbappend b/recipes-core/images/wolfssl-combined-image-minimal/openssh_%.bbappend new file mode 100644 index 0000000..6f1cbb9 --- /dev/null +++ b/recipes-core/images/wolfssl-combined-image-minimal/openssh_%.bbappend @@ -0,0 +1,4 @@ +# OpenSSH ptest modifications for wolfProvider FIPS testing + +require ${WOLFSSL_LAYERDIR}/inc/wolfprovider/openssh/openssh-enable-wolfprovider.inc + diff --git a/recipes-core/images/wolfssl-linux-fips-images/fips-image-minimal/fips-image-minimal.bb b/recipes-core/images/wolfssl-linux-fips-images/fips-image-minimal/fips-image-minimal.bb index 122226f..9a0338d 100644 --- a/recipes-core/images/wolfssl-linux-fips-images/fips-image-minimal/fips-image-minimal.bb +++ b/recipes-core/images/wolfssl-linux-fips-images/fips-image-minimal/fips-image-minimal.bb @@ -29,6 +29,7 @@ IMAGE_INSTALL:append = " \ wolfprovider \ openssl \ openssl-bin \ + openssh \ wolfprovidercmd \ wolfproviderenv \ pkgconfig \ diff --git a/recipes-core/images/wolfssl-linux-fips-images/fips-image-minimal/openssh_%.bbappend b/recipes-core/images/wolfssl-linux-fips-images/fips-image-minimal/openssh_%.bbappend new file mode 100644 index 0000000..6f1cbb9 --- /dev/null +++ b/recipes-core/images/wolfssl-linux-fips-images/fips-image-minimal/openssh_%.bbappend @@ -0,0 +1,4 @@ +# OpenSSH ptest modifications for wolfProvider FIPS testing + +require ${WOLFSSL_LAYERDIR}/inc/wolfprovider/openssh/openssh-enable-wolfprovider.inc +