Compare commits
2 commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
6ba672ad4a | ||
|
|
016bcc3e54 |
26 changed files with 6464 additions and 2623 deletions
|
|
@ -1 +0,0 @@
|
|||
1
|
||||
24
.gitignore
vendored
24
.gitignore
vendored
|
|
@ -18,27 +18,3 @@ libgcrypt-1.4.5-hobbled.tar.bz2
|
|||
/libgcrypt-1.8.0-hobbled.tar.xz
|
||||
/libgcrypt-1.8.1-hobbled.tar.xz
|
||||
/libgcrypt-1.8.2-hobbled.tar.xz
|
||||
/libgcrypt-1.8.3-hobbled.tar.xz
|
||||
/libgcrypt-1.8.4-hobbled.tar.xz
|
||||
/libgcrypt-1.8.5-hobbled.tar.xz
|
||||
/libgcrypt-1.8.6-hobbled.tar.xz
|
||||
/libgcrypt-1.8.7-hobbled.tar.xz
|
||||
/libgcrypt-1.9.0-hobbled.tar.xz
|
||||
/libgcrypt-1.9.1-hobbled.tar.xz
|
||||
/libgcrypt-1.9.2-hobbled.tar.xz
|
||||
/libgcrypt-1.9.3-hobbled.tar.xz
|
||||
/libgcrypt-1.9.4-hobbled.tar.xz
|
||||
/libgcrypt-1.10.0.tar.bz2
|
||||
/libgcrypt-1.10.0.tar.bz2.sig
|
||||
/libgcrypt-1.10.1.tar.bz2
|
||||
/libgcrypt-1.10.1.tar.bz2.sig
|
||||
/libgcrypt-1.10.2.tar.bz2
|
||||
/libgcrypt-1.10.2.tar.bz2.sig
|
||||
/libgcrypt-1.10.3.tar.bz2
|
||||
/libgcrypt-1.10.3.tar.bz2.sig
|
||||
/libgcrypt-1.11.0.tar.bz2
|
||||
/libgcrypt-1.11.0.tar.bz2.sig
|
||||
/libgcrypt-1.11.1.tar.bz2
|
||||
/libgcrypt-1.11.1.tar.bz2.sig
|
||||
/libgcrypt-1.11.2.tar.bz2
|
||||
/libgcrypt-1.11.2.tar.bz2.sig
|
||||
|
|
|
|||
144
curves.c
Normal file
144
curves.c
Normal file
|
|
@ -0,0 +1,144 @@
|
|||
/* curves.c - ECC curves regression tests
|
||||
* Copyright (C) 2011 Free Software Foundation, Inc.
|
||||
*
|
||||
* This file is part of Libgcrypt.
|
||||
*
|
||||
* Libgcrypt is free software; you can redistribute it and/or modify
|
||||
* it under the terms of the GNU Lesser General Public License as
|
||||
* published by the Free Software Foundation; either version 2.1 of
|
||||
* the License, or (at your option) any later version.
|
||||
*
|
||||
* Libgcrypt is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU Lesser General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU Lesser General Public
|
||||
* License along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA
|
||||
*/
|
||||
|
||||
#ifdef HAVE_CONFIG_H
|
||||
#include <config.h>
|
||||
#endif
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <stdarg.h>
|
||||
|
||||
#include "../src/gcrypt-int.h"
|
||||
|
||||
|
||||
#define PGM "curves"
|
||||
#include "t-common.h"
|
||||
|
||||
/* Number of curves defined in ../cipger/ecc.c */
|
||||
#define N_CURVES 14
|
||||
|
||||
/* A real world sample public key. */
|
||||
static char const sample_key_1[] =
|
||||
"(public-key\n"
|
||||
" (ecdsa\n"
|
||||
" (p #00FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF#)\n"
|
||||
" (a #00FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFC#)\n"
|
||||
" (b #5AC635D8AA3A93E7B3EBBD55769886BC651D06B0CC53B0F63BCE3C3E27D2604B#)\n"
|
||||
" (g #046B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C296"
|
||||
"4FE342E2FE1A7F9B8EE7EB4A7C0F9E162BCE33576B315ECECBB6406837BF51F5#)\n"
|
||||
" (n #00FFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551#)\n"
|
||||
" (h #000000000000000000000000000000000000000000000000000000000000000001#)\n"
|
||||
" (q #0442B927242237639A36CE9221B340DB1A9AB76DF2FE3E171277F6A4023DED146EE"
|
||||
"86525E38CCECFF3FB8D152CC6334F70D23A525175C1BCBDDE6E023B2228770E#)\n"
|
||||
" ))";
|
||||
static char const sample_key_1_curve[] = "NIST P-256";
|
||||
static unsigned int sample_key_1_nbits = 256;
|
||||
|
||||
|
||||
|
||||
static void
|
||||
list_curves (void)
|
||||
{
|
||||
int idx;
|
||||
const char *name;
|
||||
unsigned int nbits;
|
||||
|
||||
for (idx=0; (name = gcry_pk_get_curve (NULL, idx, &nbits)); idx++)
|
||||
{
|
||||
if (verbose)
|
||||
printf ("%s - %u bits\n", name, nbits);
|
||||
}
|
||||
if (idx != N_CURVES)
|
||||
fail ("expected %d curves but got %d\n", N_CURVES, idx);
|
||||
if (gcry_pk_get_curve (NULL, -1, NULL))
|
||||
fail ("curve iteration failed\n");
|
||||
}
|
||||
|
||||
|
||||
static void
|
||||
check_matching (void)
|
||||
{
|
||||
gpg_error_t err;
|
||||
gcry_sexp_t key;
|
||||
const char *name;
|
||||
unsigned int nbits;
|
||||
|
||||
err = gcry_sexp_new (&key, sample_key_1, 0, 1);
|
||||
if (err)
|
||||
die ("parsing s-expression string failed: %s\n", gpg_strerror (err));
|
||||
name = gcry_pk_get_curve (key, 0, &nbits);
|
||||
if (!name)
|
||||
fail ("curve name not found for sample_key_1\n");
|
||||
else if (strcmp (name, sample_key_1_curve))
|
||||
fail ("expected curve name %s but got %s for sample_key_1\n",
|
||||
sample_key_1_curve, name);
|
||||
else if (nbits != sample_key_1_nbits)
|
||||
fail ("expected curve size %u but got %u for sample_key_1\n",
|
||||
sample_key_1_nbits, nbits);
|
||||
|
||||
gcry_sexp_release (key);
|
||||
|
||||
}
|
||||
|
||||
|
||||
static void
|
||||
check_get_params (void)
|
||||
{
|
||||
gcry_sexp_t param;
|
||||
const char *name;
|
||||
|
||||
param = gcry_pk_get_param (GCRY_PK_ECDSA, sample_key_1_curve);
|
||||
if (!param)
|
||||
fail ("error gerring parameters for `%s'\n", sample_key_1_curve);
|
||||
|
||||
name = gcry_pk_get_curve (param, 0, NULL);
|
||||
if (!name)
|
||||
fail ("get_param: curve name not found for sample_key_1\n");
|
||||
else if (strcmp (name, sample_key_1_curve))
|
||||
fail ("get_param: expected curve name %s but got %s for sample_key_1\n",
|
||||
sample_key_1_curve, name);
|
||||
|
||||
gcry_sexp_release (param);
|
||||
|
||||
}
|
||||
|
||||
|
||||
int
|
||||
main (int argc, char **argv)
|
||||
{
|
||||
if (argc > 1 && !strcmp (argv[1], "--verbose"))
|
||||
verbose = 1;
|
||||
else if (argc > 1 && !strcmp (argv[1], "--debug"))
|
||||
verbose = debug = 1;
|
||||
|
||||
if (!gcry_check_version (GCRYPT_VERSION))
|
||||
die ("version mismatch\n");
|
||||
|
||||
xgcry_control (GCRYCTL_DISABLE_SECMEM, 0);
|
||||
xgcry_control (GCRYCTL_INITIALIZATION_FINISHED, 0);
|
||||
if (debug)
|
||||
xgcry_control (GCRYCTL_SET_DEBUG_FLAGS, 1u, 0);
|
||||
list_curves ();
|
||||
check_matching ();
|
||||
check_get_params ();
|
||||
|
||||
return error_count ? 1 : 0;
|
||||
}
|
||||
1207
ecc-curves.c
Normal file
1207
ecc-curves.c
Normal file
File diff suppressed because it is too large
Load diff
11
hobble-libgcrypt
Executable file
11
hobble-libgcrypt
Executable file
|
|
@ -0,0 +1,11 @@
|
|||
#!/bin/sh
|
||||
|
||||
# Quit out if anything fails.
|
||||
set -e -x
|
||||
|
||||
# Clean out patent-or-otherwise-encumbered code.
|
||||
# EC: ????????? ??/??/2015
|
||||
|
||||
rm -f cipher/ecc-curves.c
|
||||
rm -f tests/curves.c
|
||||
rm -f tests/t-mpi-point.c
|
||||
|
|
@ -1,22 +0,0 @@
|
|||
diff -rup libgcrypt.orig/src/Makefile.am libgcrypt-1.8.3/src/Makefile.am
|
||||
--- libgcrypt.orig/src/Makefile.am 2021-10-18 16:36:20.914025497 +0100
|
||||
+++ libgcrypt-1.8.3/src/Makefile.am 2021-10-19 12:23:08.652960618 +0100
|
||||
@@ -108,6 +108,7 @@ endif !HAVE_W32_SYSTEM
|
||||
|
||||
|
||||
libgcrypt_la_LDFLAGS = $(no_undefined) $(export_symbols) $(extra_ltoptions) \
|
||||
+ -Wc,-fplugin=annobin \
|
||||
$(libgcrypt_version_script_cmd) -version-info \
|
||||
@LIBGCRYPT_LT_CURRENT@:@LIBGCRYPT_LT_REVISION@:@LIBGCRYPT_LT_AGE@
|
||||
libgcrypt_la_DEPENDENCIES = \
|
||||
Only in libgcrypt-1.8.3/src: Makefile.am.annobin
|
||||
diff -rup libgcrypt.orig/src/Makefile.in libgcrypt-1.8.3/src/Makefile.in
|
||||
--- libgcrypt.orig/src/Makefile.in 2021-10-18 16:36:20.914025497 +0100
|
||||
+++ libgcrypt-1.8.3/src/Makefile.in 2021-10-19 12:23:37.791875325 +0100
|
||||
@@ -483,6 +483,7 @@ gcrypt_hwf_modules = @GCRYPT_HWF_MODULES
|
||||
@HAVE_W32_SYSTEM_TRUE@gcrypt_deps = $(gcrypt_res) libgcrypt.def
|
||||
@HAVE_W32_SYSTEM_FALSE@gcrypt_res_ldflag =
|
||||
libgcrypt_la_LDFLAGS = $(no_undefined) $(export_symbols) $(extra_ltoptions) \
|
||||
+ -Wc,-fplugin=annobin \
|
||||
$(libgcrypt_version_script_cmd) -version-info \
|
||||
@LIBGCRYPT_LT_CURRENT@:@LIBGCRYPT_LT_REVISION@:@LIBGCRYPT_LT_AGE@
|
||||
File diff suppressed because it is too large
Load diff
104
libgcrypt-1.6.1-mpicoder-gccopt.patch
Normal file
104
libgcrypt-1.6.1-mpicoder-gccopt.patch
Normal file
|
|
@ -0,0 +1,104 @@
|
|||
diff -up libgcrypt-1.6.1/mpi/mpicoder.c.gccopt libgcrypt-1.6.1/mpi/mpicoder.c
|
||||
--- libgcrypt-1.6.1/mpi/mpicoder.c.gccopt 2014-02-28 15:37:53.983139821 +0100
|
||||
+++ libgcrypt-1.6.1/mpi/mpicoder.c 2014-02-28 15:47:35.312576387 +0100
|
||||
@@ -627,16 +627,16 @@ _gcry_mpi_print (enum gcry_mpi_format fo
|
||||
extra = 1;
|
||||
}
|
||||
|
||||
- if (buffer && n > len)
|
||||
- {
|
||||
- /* The provided buffer is too short. */
|
||||
- xfree (tmp);
|
||||
- return GPG_ERR_TOO_SHORT;
|
||||
- }
|
||||
if (buffer)
|
||||
{
|
||||
unsigned char *s = buffer;
|
||||
|
||||
+ if (n > len)
|
||||
+ {
|
||||
+ /* The provided buffer is too short. */
|
||||
+ xfree (tmp);
|
||||
+ return GPG_ERR_TOO_SHORT;
|
||||
+ }
|
||||
if (extra == 1)
|
||||
*s++ = 0;
|
||||
else if (extra)
|
||||
@@ -654,13 +654,12 @@ _gcry_mpi_print (enum gcry_mpi_format fo
|
||||
/* Note: We ignore the sign for this format. */
|
||||
/* FIXME: for performance reasons we should put this into
|
||||
mpi_aprint because we can then use the buffer directly. */
|
||||
-
|
||||
- if (buffer && n > len)
|
||||
- return GPG_ERR_TOO_SHORT;
|
||||
if (buffer)
|
||||
{
|
||||
unsigned char *tmp;
|
||||
|
||||
+ if (n > len)
|
||||
+ return GPG_ERR_TOO_SHORT;
|
||||
tmp = _gcry_mpi_get_buffer (a, 0, &n, NULL);
|
||||
if (!tmp)
|
||||
return gpg_err_code_from_syserror ();
|
||||
@@ -678,14 +677,14 @@ _gcry_mpi_print (enum gcry_mpi_format fo
|
||||
if (negative)
|
||||
return GPG_ERR_INV_ARG;
|
||||
|
||||
- if (buffer && n+2 > len)
|
||||
- return GPG_ERR_TOO_SHORT;
|
||||
-
|
||||
if (buffer)
|
||||
{
|
||||
unsigned char *tmp;
|
||||
unsigned char *s = buffer;
|
||||
|
||||
+ if (n+2 > len)
|
||||
+ return GPG_ERR_TOO_SHORT;
|
||||
+
|
||||
s[0] = nbits >> 8;
|
||||
s[1] = nbits;
|
||||
|
||||
@@ -724,16 +723,16 @@ _gcry_mpi_print (enum gcry_mpi_format fo
|
||||
extra=1;
|
||||
}
|
||||
|
||||
- if (buffer && n+4 > len)
|
||||
- {
|
||||
- xfree(tmp);
|
||||
- return GPG_ERR_TOO_SHORT;
|
||||
- }
|
||||
-
|
||||
if (buffer)
|
||||
{
|
||||
unsigned char *s = buffer;
|
||||
|
||||
+ if (n+4 > len)
|
||||
+ {
|
||||
+ xfree(tmp);
|
||||
+ return GPG_ERR_TOO_SHORT;
|
||||
+ }
|
||||
+
|
||||
*s++ = n >> 24;
|
||||
*s++ = n >> 16;
|
||||
*s++ = n >> 8;
|
||||
@@ -761,15 +760,15 @@ _gcry_mpi_print (enum gcry_mpi_format fo
|
||||
if (!n || (*tmp & 0x80))
|
||||
extra = 2;
|
||||
|
||||
- if (buffer && 2*n + extra + negative + 1 > len)
|
||||
- {
|
||||
- xfree(tmp);
|
||||
- return GPG_ERR_TOO_SHORT;
|
||||
- }
|
||||
if (buffer)
|
||||
{
|
||||
unsigned char *s = buffer;
|
||||
|
||||
+ if (2*n + extra + negative + 1 > len)
|
||||
+ {
|
||||
+ xfree(tmp);
|
||||
+ return GPG_ERR_TOO_SHORT;
|
||||
+ }
|
||||
if (negative)
|
||||
*s++ = '-';
|
||||
if (extra)
|
||||
74
libgcrypt-1.6.2-fips-ctor.patch
Normal file
74
libgcrypt-1.6.2-fips-ctor.patch
Normal file
|
|
@ -0,0 +1,74 @@
|
|||
diff -up libgcrypt-1.6.2/cipher/md.c.fips-ctor libgcrypt-1.6.2/cipher/md.c
|
||||
--- libgcrypt-1.6.2/cipher/md.c.fips-ctor 2014-08-21 14:50:39.000000000 +0200
|
||||
+++ libgcrypt-1.6.2/cipher/md.c 2015-02-25 13:57:21.175704866 +0100
|
||||
@@ -413,11 +413,8 @@ md_enable (gcry_md_hd_t hd, int algorith
|
||||
|
||||
if (!err && algorithm == GCRY_MD_MD5 && fips_mode ())
|
||||
{
|
||||
- _gcry_inactivate_fips_mode ("MD5 used");
|
||||
if (_gcry_enforced_fips_mode () )
|
||||
{
|
||||
- /* We should never get to here because we do not register
|
||||
- MD5 in enforced fips mode. But better throw an error. */
|
||||
err = GPG_ERR_DIGEST_ALGO;
|
||||
}
|
||||
}
|
||||
diff -up libgcrypt-1.6.2/src/global.c.fips-ctor libgcrypt-1.6.2/src/global.c
|
||||
--- libgcrypt-1.6.2/src/global.c.fips-ctor 2015-02-25 13:57:21.174704842 +0100
|
||||
+++ libgcrypt-1.6.2/src/global.c 2015-02-25 14:03:07.066864208 +0100
|
||||
@@ -132,6 +132,36 @@ global_init (void)
|
||||
}
|
||||
|
||||
|
||||
+#ifndef FIPS_MODULE_PATH
|
||||
+#define FIPS_MODULE_PATH "/etc/system-fips"
|
||||
+#endif
|
||||
+
|
||||
+void __attribute__ ((constructor)) _gcry_global_constructor (void)
|
||||
+{
|
||||
+ int rv;
|
||||
+
|
||||
+ rv = access (FIPS_MODULE_PATH, F_OK);
|
||||
+ if (rv < 0 && errno != ENOENT)
|
||||
+ rv = 0;
|
||||
+
|
||||
+ if (!rv)
|
||||
+ {
|
||||
+ int no_secmem_save;
|
||||
+
|
||||
+ /* it should be always 0 at this point but let's keep on the safe side */
|
||||
+ no_secmem_save = no_secure_memory;
|
||||
+ no_secure_memory = 1;
|
||||
+ /* force selftests */
|
||||
+ global_init ();
|
||||
+ if (fips_mode ())
|
||||
+ _gcry_random_initialize (1);
|
||||
+ _gcry_fips_run_selftests (0);
|
||||
+ if (!fips_mode())
|
||||
+ _gcry_random_close_fds ();
|
||||
+ no_secure_memory = no_secmem_save;
|
||||
+ }
|
||||
+}
|
||||
+
|
||||
/* This function is called by the macro fips_is_operational and makes
|
||||
sure that the minimal initialization has been done. This is far
|
||||
from a perfect solution and hides problems with an improper
|
||||
@@ -542,8 +572,7 @@ _gcry_vcontrol (enum gcry_ctl_cmds cmd,
|
||||
|
||||
case GCRYCTL_FIPS_MODE_P:
|
||||
if (fips_mode ()
|
||||
- && !_gcry_is_fips_mode_inactive ()
|
||||
- && !no_secure_memory)
|
||||
+ && !_gcry_is_fips_mode_inactive ())
|
||||
rc = GPG_ERR_GENERAL; /* Used as TRUE value */
|
||||
break;
|
||||
|
||||
@@ -635,7 +664,7 @@ _gcry_vcontrol (enum gcry_ctl_cmds cmd,
|
||||
break;
|
||||
|
||||
case GCRYCTL_SET_ENFORCED_FIPS_FLAG:
|
||||
- if (!any_init_done)
|
||||
+ if (fips_mode ())
|
||||
{
|
||||
/* Not yet initialized at all. Set the enforced fips mode flag */
|
||||
_gcry_set_preferred_rng_type (0);
|
||||
89
libgcrypt-1.6.2-use-fipscheck.patch
Normal file
89
libgcrypt-1.6.2-use-fipscheck.patch
Normal file
|
|
@ -0,0 +1,89 @@
|
|||
diff -up libgcrypt-1.6.2/src/fips.c.use-fipscheck libgcrypt-1.6.2/src/fips.c
|
||||
--- libgcrypt-1.6.2/src/fips.c.use-fipscheck 2014-08-21 14:50:39.000000000 +0200
|
||||
+++ libgcrypt-1.6.2/src/fips.c 2014-09-26 11:42:20.999588282 +0200
|
||||
@@ -578,23 +578,50 @@ run_random_selftests (void)
|
||||
return !!err;
|
||||
}
|
||||
|
||||
+#ifdef ENABLE_HMAC_BINARY_CHECK
|
||||
+static int
|
||||
+get_library_path(const char *libname, const char *symbolname, char *path, size_t pathlen)
|
||||
+{
|
||||
+ Dl_info info;
|
||||
+ void *dl, *sym;
|
||||
+ int rv = -1;
|
||||
+
|
||||
+ dl = dlopen(libname, RTLD_LAZY);
|
||||
+ if (dl == NULL) {
|
||||
+ return -1;
|
||||
+ }
|
||||
+
|
||||
+ sym = dlsym(dl, symbolname);
|
||||
+
|
||||
+ if (sym != NULL && dladdr(sym, &info)) {
|
||||
+ strncpy(path, info.dli_fname, pathlen-1);
|
||||
+ path[pathlen-1] = '\0';
|
||||
+ rv = 0;
|
||||
+ }
|
||||
+
|
||||
+ dlclose(dl);
|
||||
+
|
||||
+ return rv;
|
||||
+}
|
||||
+#endif
|
||||
+
|
||||
/* Run an integrity check on the binary. Returns 0 on success. */
|
||||
static int
|
||||
check_binary_integrity (void)
|
||||
{
|
||||
#ifdef ENABLE_HMAC_BINARY_CHECK
|
||||
gpg_error_t err;
|
||||
- Dl_info info;
|
||||
+ char libpath[4096];
|
||||
unsigned char digest[32];
|
||||
int dlen;
|
||||
char *fname = NULL;
|
||||
- const char key[] = "What am I, a doctor or a moonshuttle conductor?";
|
||||
-
|
||||
- if (!dladdr ("gcry_check_version", &info))
|
||||
+ const char key[] = "orboDeJITITejsirpADONivirpUkvarP";
|
||||
+
|
||||
+ if (get_library_path ("libgcrypt.so.20", "gcry_check_version", libpath, sizeof(libpath)))
|
||||
err = gpg_error_from_syserror ();
|
||||
else
|
||||
{
|
||||
- dlen = _gcry_hmac256_file (digest, sizeof digest, info.dli_fname,
|
||||
+ dlen = _gcry_hmac256_file (digest, sizeof digest, libpath,
|
||||
key, strlen (key));
|
||||
if (dlen < 0)
|
||||
err = gpg_error_from_syserror ();
|
||||
@@ -602,7 +629,7 @@ check_binary_integrity (void)
|
||||
err = gpg_error (GPG_ERR_INTERNAL);
|
||||
else
|
||||
{
|
||||
- fname = xtrymalloc (strlen (info.dli_fname) + 1 + 5 + 1 );
|
||||
+ fname = xtrymalloc (strlen (libpath) + 1 + 5 + 1 );
|
||||
if (!fname)
|
||||
err = gpg_error_from_syserror ();
|
||||
else
|
||||
@@ -611,7 +638,7 @@ check_binary_integrity (void)
|
||||
char *p;
|
||||
|
||||
/* Prefix the basename with a dot. */
|
||||
- strcpy (fname, info.dli_fname);
|
||||
+ strcpy (fname, libpath);
|
||||
p = strrchr (fname, '/');
|
||||
if (p)
|
||||
p++;
|
||||
diff -up libgcrypt-1.6.2/src/Makefile.in.use-fipscheck libgcrypt-1.6.2/src/Makefile.in
|
||||
--- libgcrypt-1.6.2/src/Makefile.in.use-fipscheck 2014-08-21 15:14:08.000000000 +0200
|
||||
+++ libgcrypt-1.6.2/src/Makefile.in 2014-09-26 11:41:13.271059281 +0200
|
||||
@@ -449,7 +449,7 @@ libgcrypt_la_LIBADD = $(gcrypt_res) \
|
||||
../cipher/libcipher.la \
|
||||
../random/librandom.la \
|
||||
../mpi/libmpi.la \
|
||||
- ../compat/libcompat.la $(GPG_ERROR_LIBS)
|
||||
+ ../compat/libcompat.la $(GPG_ERROR_LIBS) -ldl
|
||||
|
||||
dumpsexp_SOURCES = dumpsexp.c
|
||||
dumpsexp_CFLAGS = $(arch_gpg_error_cflags)
|
||||
122
libgcrypt-1.7.3-ecc-test-fix.patch
Normal file
122
libgcrypt-1.7.3-ecc-test-fix.patch
Normal file
|
|
@ -0,0 +1,122 @@
|
|||
diff -up libgcrypt-1.7.3/tests/benchmark.c.eccfix libgcrypt-1.7.3/tests/benchmark.c
|
||||
--- libgcrypt-1.7.3/tests/benchmark.c.eccfix 2016-07-14 11:19:17.000000000 +0200
|
||||
+++ libgcrypt-1.7.3/tests/benchmark.c 2016-11-22 16:21:00.109004197 +0100
|
||||
@@ -1412,7 +1412,7 @@ ecc_bench (int iterations, int print_hea
|
||||
{
|
||||
#if USE_ECC
|
||||
gpg_error_t err;
|
||||
- const char *p_sizes[] = { "192", "224", "256", "384", "521", "Ed25519",
|
||||
+ const char *p_sizes[] = { "224", "256", "384", "521", "Ed25519",
|
||||
"gost256", "gost512" };
|
||||
int testno;
|
||||
|
||||
diff -up libgcrypt-1.7.3/tests/dsa-rfc6979.c.eccfix libgcrypt-1.7.3/tests/dsa-rfc6979.c
|
||||
--- libgcrypt-1.7.3/tests/dsa-rfc6979.c.eccfix 2016-02-18 09:38:03.000000000 +0100
|
||||
+++ libgcrypt-1.7.3/tests/dsa-rfc6979.c 2016-11-22 16:22:11.804674008 +0100
|
||||
@@ -210,16 +210,6 @@ check_dsa_rfc6979 (void)
|
||||
" ))"
|
||||
},
|
||||
{
|
||||
- "ECDSA, 192 bits (prime field)",
|
||||
- "(private-key"
|
||||
- " (ecdsa"
|
||||
- " (curve \"NIST P-192\")"
|
||||
- " (q #04AC2C77F529F91689FEA0EA5EFEC7F210D8EEA0B9E047ED56"
|
||||
- " 3BC723E57670BD4887EBC732C523063D0A7C957BC97C1C43#)"
|
||||
- " (d #6FAB034934E4C0FC9AE67F5B5659A9D7D1FEFD187EE09FD4#)"
|
||||
- " ))"
|
||||
- },
|
||||
- {
|
||||
"ECDSA, 224 bits (prime field)",
|
||||
"(private-key"
|
||||
" (ecdsa"
|
||||
@@ -443,89 +433,6 @@ check_dsa_rfc6979 (void)
|
||||
"C9F0BDABCC0D880BB137A994CC7F3980CE91CC10FAF529FC46565B15CEA854E1"
|
||||
},
|
||||
{
|
||||
- "ECDSA, 192 bits (prime field)",
|
||||
- "With SHA-1, message = \"sample\"",
|
||||
- "sha1", "sample",
|
||||
- "37D7CA00D2C7B0E5E412AC03BD44BA837FDD5B28CD3B0021",
|
||||
- "98C6BD12B23EAF5E2A2045132086BE3EB8EBD62ABF6698FF",
|
||||
- "57A22B07DEA9530F8DE9471B1DC6624472E8E2844BC25B64"
|
||||
- },
|
||||
- {
|
||||
- "ECDSA, 192 bits (prime field)",
|
||||
- "With SHA-224, message = \"sample\"",
|
||||
- "sha224", "sample",
|
||||
- "4381526B3FC1E7128F202E194505592F01D5FF4C5AF015D8",
|
||||
- "A1F00DAD97AEEC91C95585F36200C65F3C01812AA60378F5",
|
||||
- "E07EC1304C7C6C9DEBBE980B9692668F81D4DE7922A0F97A"
|
||||
- },
|
||||
- {
|
||||
- "ECDSA, 192 bits (prime field)",
|
||||
- "With SHA-256, message = \"sample\"",
|
||||
- "sha256", "sample",
|
||||
- "32B1B6D7D42A05CB449065727A84804FB1A3E34D8F261496",
|
||||
- "4B0B8CE98A92866A2820E20AA6B75B56382E0F9BFD5ECB55",
|
||||
- "CCDB006926EA9565CBADC840829D8C384E06DE1F1E381B85"
|
||||
- },
|
||||
- {
|
||||
- "ECDSA, 192 bits (prime field)",
|
||||
- "With SHA-384, message = \"sample\"",
|
||||
- "sha384", "sample",
|
||||
- "4730005C4FCB01834C063A7B6760096DBE284B8252EF4311",
|
||||
- "DA63BF0B9ABCF948FBB1E9167F136145F7A20426DCC287D5",
|
||||
- "C3AA2C960972BD7A2003A57E1C4C77F0578F8AE95E31EC5E"
|
||||
- },
|
||||
- {
|
||||
- "ECDSA, 192 bits (prime field)",
|
||||
- "With SHA-512, message = \"sample\"",
|
||||
- "sha512", "sample",
|
||||
- "A2AC7AB055E4F20692D49209544C203A7D1F2C0BFBC75DB1",
|
||||
- "4D60C5AB1996BD848343B31C00850205E2EA6922DAC2E4B8",
|
||||
- "3F6E837448F027A1BF4B34E796E32A811CBB4050908D8F67"
|
||||
- },
|
||||
- {
|
||||
- "ECDSA, 192 bits (prime field)",
|
||||
- "With SHA-1, message = \"test\"",
|
||||
- "sha1", "test",
|
||||
- "D9CF9C3D3297D3260773A1DA7418DB5537AB8DD93DE7FA25",
|
||||
- "0F2141A0EBBC44D2E1AF90A50EBCFCE5E197B3B7D4DE036D",
|
||||
- "EB18BC9E1F3D7387500CB99CF5F7C157070A8961E38700B7"
|
||||
- },
|
||||
- {
|
||||
- "ECDSA, 192 bits (prime field)",
|
||||
- "With SHA-224, message = \"test\"",
|
||||
- "sha224", "test",
|
||||
- "F5DC805F76EF851800700CCE82E7B98D8911B7D510059FBE",
|
||||
- "6945A1C1D1B2206B8145548F633BB61CEF04891BAF26ED34",
|
||||
- "B7FB7FDFC339C0B9BD61A9F5A8EAF9BE58FC5CBA2CB15293"
|
||||
- },
|
||||
- {
|
||||
- "ECDSA, 192 bits (prime field)",
|
||||
- "With SHA-256, message = \"test\"",
|
||||
- "sha256", "test",
|
||||
- "5C4CE89CF56D9E7C77C8585339B006B97B5F0680B4306C6C",
|
||||
- "3A718BD8B4926C3B52EE6BBE67EF79B18CB6EB62B1AD97AE",
|
||||
- "5662E6848A4A19B1F1AE2F72ACD4B8BBE50F1EAC65D9124F"
|
||||
- },
|
||||
- {
|
||||
- "ECDSA, 192 bits (prime field)",
|
||||
- "With SHA-384, message = \"test\"",
|
||||
- "sha384", "test",
|
||||
- "5AFEFB5D3393261B828DB6C91FBC68C230727B030C975693",
|
||||
- "B234B60B4DB75A733E19280A7A6034BD6B1EE88AF5332367",
|
||||
- "7994090B2D59BB782BE57E74A44C9A1C700413F8ABEFE77A"
|
||||
- },
|
||||
- {
|
||||
- "ECDSA, 192 bits (prime field)",
|
||||
- "With SHA-512, message = \"test\"",
|
||||
- "sha512", "test",
|
||||
- "0758753A5254759C7CFBAD2E2D9B0792EEE44136C9480527",
|
||||
- "FE4F4AE86A58B6507946715934FE2D8FF9D95B6B098FE739",
|
||||
- "74CF5605C98FBA0E1EF34D4B5A1577A7DCF59457CAE52290"
|
||||
- },
|
||||
-
|
||||
-
|
||||
-
|
||||
- {
|
||||
"ECDSA, 224 bits (prime field)",
|
||||
"With SHA-1, message = \"sample\"",
|
||||
"sha1", "sample",
|
||||
1311
libgcrypt-1.7.3-fips-cavs.patch
Normal file
1311
libgcrypt-1.7.3-fips-cavs.patch
Normal file
File diff suppressed because it is too large
Load diff
35
libgcrypt-1.7.3-fips-reqs.patch
Normal file
35
libgcrypt-1.7.3-fips-reqs.patch
Normal file
|
|
@ -0,0 +1,35 @@
|
|||
diff -up libgcrypt-1.7.3/src/visibility.c.fips-reqs libgcrypt-1.7.3/src/visibility.c
|
||||
--- libgcrypt-1.7.3/src/visibility.c.fips-reqs 2016-03-23 12:59:34.000000000 +0100
|
||||
+++ libgcrypt-1.7.3/src/visibility.c 2016-11-22 16:29:36.992042480 +0100
|
||||
@@ -1288,6 +1288,8 @@ gcry_kdf_derive (const void *passphrase,
|
||||
unsigned long iterations,
|
||||
size_t keysize, void *keybuffer)
|
||||
{
|
||||
+ if (!fips_is_operational ())
|
||||
+ return gpg_error (fips_not_operational ());
|
||||
return gpg_error (_gcry_kdf_derive (passphrase, passphraselen, algo, hashalgo,
|
||||
salt, saltlen, iterations,
|
||||
keysize, keybuffer));
|
||||
@@ -1343,6 +1345,13 @@ void
|
||||
gcry_mpi_randomize (gcry_mpi_t w,
|
||||
unsigned int nbits, enum gcry_random_level level)
|
||||
{
|
||||
+ if (!fips_is_operational ())
|
||||
+ {
|
||||
+ (void)fips_not_operational ();
|
||||
+ fips_signal_fatal_error ("called in non-operational state");
|
||||
+ fips_noreturn ();
|
||||
+ }
|
||||
+
|
||||
_gcry_mpi_randomize (w, nbits, level);
|
||||
}
|
||||
|
||||
@@ -1368,6 +1377,8 @@ gcry_prime_generate (gcry_mpi_t *prime,
|
||||
gcry_random_level_t random_level,
|
||||
unsigned int flags)
|
||||
{
|
||||
+ if (!fips_is_operational ())
|
||||
+ return gpg_error (fips_not_operational ());
|
||||
return gpg_error (_gcry_prime_generate (prime, prime_bits, factor_bits,
|
||||
factors, cb_func, cb_arg,
|
||||
random_level, flags));
|
||||
115
libgcrypt-1.8.0-tests.patch
Normal file
115
libgcrypt-1.8.0-tests.patch
Normal file
|
|
@ -0,0 +1,115 @@
|
|||
diff -up libgcrypt-1.8.0/cipher/dsa.c.tests libgcrypt-1.8.0/cipher/dsa.c
|
||||
--- libgcrypt-1.8.0/cipher/dsa.c.tests 2016-04-07 17:30:08.000000000 +0200
|
||||
+++ libgcrypt-1.8.0/cipher/dsa.c 2017-08-15 15:10:39.551600227 +0200
|
||||
@@ -457,11 +457,22 @@ generate_fips186 (DSA_secret_key *sk, un
|
||||
&prime_q, &prime_p,
|
||||
r_counter,
|
||||
r_seed, r_seedlen);
|
||||
- else
|
||||
- ec = _gcry_generate_fips186_3_prime (nbits, qbits, NULL, 0,
|
||||
+ else if (!domain->p || !domain->q)
|
||||
+ ec = _gcry_generate_fips186_3_prime (nbits, qbits,
|
||||
+ initial_seed.seed,
|
||||
+ initial_seed.seedlen,
|
||||
&prime_q, &prime_p,
|
||||
r_counter,
|
||||
r_seed, r_seedlen, NULL);
|
||||
+ else
|
||||
+ {
|
||||
+ /* Domain parameters p and q are given; use them. */
|
||||
+ prime_p = mpi_copy (domain->p);
|
||||
+ prime_q = mpi_copy (domain->q);
|
||||
+ gcry_assert (mpi_get_nbits (prime_p) == nbits);
|
||||
+ gcry_assert (mpi_get_nbits (prime_q) == qbits);
|
||||
+ ec = 0;
|
||||
+ }
|
||||
sexp_release (initial_seed.sexp);
|
||||
if (ec)
|
||||
goto leave;
|
||||
@@ -855,13 +866,12 @@ dsa_generate (const gcry_sexp_t genparms
|
||||
sexp_release (l1);
|
||||
sexp_release (domainsexp);
|
||||
|
||||
- /* Check that all domain parameters are available. */
|
||||
- if (!domain.p || !domain.q || !domain.g)
|
||||
+ /* Check that p and q domain parameters are available. */
|
||||
+ if (!domain.p || !domain.q || (!domain.g && !(flags & PUBKEY_FLAG_USE_FIPS186)))
|
||||
{
|
||||
_gcry_mpi_release (domain.p);
|
||||
_gcry_mpi_release (domain.q);
|
||||
_gcry_mpi_release (domain.g);
|
||||
- sexp_release (deriveparms);
|
||||
return GPG_ERR_MISSING_VALUE;
|
||||
}
|
||||
|
||||
diff -up libgcrypt-1.8.0/cipher/rsa.c.tests libgcrypt-1.8.0/cipher/rsa.c
|
||||
--- libgcrypt-1.8.0/cipher/rsa.c.tests 2017-07-06 10:21:36.000000000 +0200
|
||||
+++ libgcrypt-1.8.0/cipher/rsa.c 2017-08-15 15:10:39.551600227 +0200
|
||||
@@ -696,7 +696,7 @@ generate_x931 (RSA_secret_key *sk, unsig
|
||||
|
||||
*swapped = 0;
|
||||
|
||||
- if (e_value == 1) /* Alias for a secure value. */
|
||||
+ if (e_value == 1 || e_value == 0) /* Alias for a secure value. */
|
||||
e_value = 65537;
|
||||
|
||||
/* Point 1 of section 4.1: k = 1024 + 256s with S >= 0 */
|
||||
diff -up libgcrypt-1.8.0/tests/keygen.c.tests libgcrypt-1.8.0/tests/keygen.c
|
||||
--- libgcrypt-1.8.0/tests/keygen.c.tests 2017-08-15 15:10:39.551600227 +0200
|
||||
+++ libgcrypt-1.8.0/tests/keygen.c 2017-08-15 15:16:05.433176171 +0200
|
||||
@@ -200,11 +200,11 @@ check_rsa_keys (void)
|
||||
|
||||
|
||||
if (verbose)
|
||||
- info ("creating 512 bit RSA key with e=257\n");
|
||||
+ info ("creating 1024 bit RSA key with e=257\n");
|
||||
rc = gcry_sexp_new (&keyparm,
|
||||
"(genkey\n"
|
||||
" (rsa\n"
|
||||
- " (nbits 3:512)\n"
|
||||
+ " (nbits 4:1024)\n"
|
||||
" (rsa-use-e 3:257)\n"
|
||||
" ))", 0, 1);
|
||||
if (rc)
|
||||
@@ -225,11 +225,11 @@ check_rsa_keys (void)
|
||||
gcry_sexp_release (key);
|
||||
|
||||
if (verbose)
|
||||
- info ("creating 512 bit RSA key with default e\n");
|
||||
+ info ("creating 1024 bit RSA key with default e\n");
|
||||
rc = gcry_sexp_new (&keyparm,
|
||||
"(genkey\n"
|
||||
" (rsa\n"
|
||||
- " (nbits 3:512)\n"
|
||||
+ " (nbits 4:1024)\n"
|
||||
" (rsa-use-e 1:0)\n"
|
||||
" ))", 0, 1);
|
||||
if (rc)
|
||||
@@ -309,12 +309,12 @@ check_dsa_keys (void)
|
||||
}
|
||||
|
||||
if (verbose)
|
||||
- info ("creating 1536 bit DSA key\n");
|
||||
+ info ("creating 2048 bit DSA key\n");
|
||||
rc = gcry_sexp_new (&keyparm,
|
||||
"(genkey\n"
|
||||
" (dsa\n"
|
||||
- " (nbits 4:1536)\n"
|
||||
- " (qbits 3:224)\n"
|
||||
+ " (nbits 4:2048)\n"
|
||||
+ " (qbits 3:256)\n"
|
||||
" ))", 0, 1);
|
||||
if (rc)
|
||||
die ("error creating S-expression: %s\n", gpg_strerror (rc));
|
||||
diff -up libgcrypt-1.8.0/tests/pubkey.c.tests libgcrypt-1.8.0/tests/pubkey.c
|
||||
--- libgcrypt-1.8.0/tests/pubkey.c.tests 2017-01-18 15:24:25.000000000 +0100
|
||||
+++ libgcrypt-1.8.0/tests/pubkey.c 2017-08-15 15:10:39.552600207 +0200
|
||||
@@ -595,7 +595,7 @@ get_dsa_key_fips186_with_seed_new (gcry_
|
||||
" (use-fips186)"
|
||||
" (transient-key)"
|
||||
" (derive-parms"
|
||||
- " (seed #0cb1990c1fd3626055d7a0096f8fa99807399871#))))",
|
||||
+ " (seed #8b4c4d671fff82e8ed932260206d0571e3a1c2cee8cd94cb73fe58f9b67488fa#))))",
|
||||
0, 1);
|
||||
if (rc)
|
||||
die ("error creating S-expression: %s\n", gcry_strerror (rc));
|
||||
77
libgcrypt-1.8.0-use-poll.patch
Normal file
77
libgcrypt-1.8.0-use-poll.patch
Normal file
|
|
@ -0,0 +1,77 @@
|
|||
diff -up libgcrypt-1.8.0/random/rndlinux.c.use-poll libgcrypt-1.8.0/random/rndlinux.c
|
||||
--- libgcrypt-1.8.0/random/rndlinux.c.use-poll 2017-06-24 13:34:29.000000000 +0200
|
||||
+++ libgcrypt-1.8.0/random/rndlinux.c 2017-08-15 15:37:37.604629377 +0200
|
||||
@@ -32,6 +32,7 @@
|
||||
#include <string.h>
|
||||
#include <unistd.h>
|
||||
#include <fcntl.h>
|
||||
+#include <poll.h>
|
||||
#if defined(__linux__) && defined(HAVE_SYSCALL)
|
||||
# include <sys/syscall.h>
|
||||
#endif
|
||||
@@ -216,9 +217,8 @@ _gcry_rndlinux_gather_random (void (*add
|
||||
return with something we will actually use 100ms. */
|
||||
while (length)
|
||||
{
|
||||
- fd_set rfds;
|
||||
- struct timeval tv;
|
||||
int rc;
|
||||
+ struct pollfd pfd;
|
||||
|
||||
/* If we have a modern Linux kernel and we want to read from the
|
||||
* the non-blocking /dev/urandom, we first try to use the new
|
||||
@@ -276,36 +276,25 @@ _gcry_rndlinux_gather_random (void (*add
|
||||
any_need_entropy = 1;
|
||||
}
|
||||
|
||||
- /* If the system has no limit on the number of file descriptors
|
||||
- and we encounter an fd which is larger than the fd_set size,
|
||||
- we don't use the select at all. The select code is only used
|
||||
- to emit progress messages. A better solution would be to
|
||||
- fall back to poll() if available. */
|
||||
-#ifdef FD_SETSIZE
|
||||
- if (fd < FD_SETSIZE)
|
||||
-#endif
|
||||
+ pfd.fd = fd;
|
||||
+ pfd.events = POLLIN;
|
||||
+
|
||||
+ _gcry_pre_syscall ();
|
||||
+ rc = poll(&pfd, 1, delay);
|
||||
+ _gcry_post_syscall ();
|
||||
+ if (!rc)
|
||||
{
|
||||
- FD_ZERO(&rfds);
|
||||
- FD_SET(fd, &rfds);
|
||||
- tv.tv_sec = delay;
|
||||
- tv.tv_usec = delay? 0 : 100000;
|
||||
- _gcry_pre_syscall ();
|
||||
- rc = select (fd+1, &rfds, NULL, NULL, &tv);
|
||||
- _gcry_post_syscall ();
|
||||
- if (!rc)
|
||||
- {
|
||||
- any_need_entropy = 1;
|
||||
- delay = 3; /* Use 3 seconds henceforth. */
|
||||
- continue;
|
||||
- }
|
||||
- else if( rc == -1 )
|
||||
- {
|
||||
- log_error ("select() error: %s\n", strerror(errno));
|
||||
- if (!delay)
|
||||
- delay = 1; /* Use 1 second if we encounter an error before
|
||||
- we have ever blocked. */
|
||||
- continue;
|
||||
- }
|
||||
+ any_need_entropy = 1;
|
||||
+ delay = 3000; /* Use 3 seconds henceforth. */
|
||||
+ continue;
|
||||
+ }
|
||||
+ else if( rc == -1 )
|
||||
+ {
|
||||
+ log_error ("poll() error: %s\n", strerror(errno));
|
||||
+ if (!delay)
|
||||
+ delay = 1000; /* Use 1 second if we encounter an error before
|
||||
+ we have ever blocked. */
|
||||
+ continue;
|
||||
}
|
||||
|
||||
do
|
||||
76
libgcrypt-1.8.1-getrandom.patch
Normal file
76
libgcrypt-1.8.1-getrandom.patch
Normal file
|
|
@ -0,0 +1,76 @@
|
|||
diff -up libgcrypt-1.8.1/random/random-csprng.c.getrandom libgcrypt-1.8.1/random/random-csprng.c
|
||||
--- libgcrypt-1.8.1/random/random-csprng.c.getrandom 2017-08-27 09:05:36.000000000 +0200
|
||||
+++ libgcrypt-1.8.1/random/random-csprng.c 2017-12-05 11:49:06.609801947 +0100
|
||||
@@ -55,6 +55,10 @@
|
||||
#ifdef __MINGW32__
|
||||
#include <process.h>
|
||||
#endif
|
||||
+#if defined(__linux__) && defined(HAVE_SYSCALL)
|
||||
+# include <sys/syscall.h>
|
||||
+# include <linux/random.h>
|
||||
+#endif
|
||||
#include "g10lib.h"
|
||||
#include "random.h"
|
||||
#include "rand-internal.h"
|
||||
@@ -1116,6 +1120,22 @@ getfnc_gather_random (void))(void (*)(co
|
||||
enum random_origins, size_t, int);
|
||||
|
||||
#if USE_RNDLINUX
|
||||
+#if defined(__linux__) && defined(HAVE_SYSCALL) && defined(__NR_getrandom)
|
||||
+ long ret;
|
||||
+ char buffer[1];
|
||||
+
|
||||
+ _gcry_pre_syscall ();
|
||||
+ ret = syscall (__NR_getrandom,
|
||||
+ (void*)buffer, (size_t)1, (unsigned int)GRND_NONBLOCK);
|
||||
+ _gcry_post_syscall ();
|
||||
+ if (ret != -1 || errno != ENOSYS)
|
||||
+ {
|
||||
+ fnc = _gcry_rndlinux_gather_random;
|
||||
+ return fnc;
|
||||
+ }
|
||||
+ else
|
||||
+ /* The syscall is not supported - fallback to /dev/urandom. */
|
||||
+#endif
|
||||
if ( !access (NAME_OF_DEV_RANDOM, R_OK)
|
||||
&& !access (NAME_OF_DEV_URANDOM, R_OK))
|
||||
{
|
||||
diff -up libgcrypt-1.8.1/random/rndlinux.c.getrandom libgcrypt-1.8.1/random/rndlinux.c
|
||||
--- libgcrypt-1.8.1/random/rndlinux.c.getrandom 2017-09-05 14:34:28.003872675 +0200
|
||||
+++ libgcrypt-1.8.1/random/rndlinux.c 2017-12-04 09:48:38.704845838 +0100
|
||||
@@ -35,6 +35,7 @@
|
||||
#include <poll.h>
|
||||
#if defined(__linux__) && defined(HAVE_SYSCALL)
|
||||
# include <sys/syscall.h>
|
||||
+# include <linux/random.h>
|
||||
#endif
|
||||
|
||||
#include "types.h"
|
||||
@@ -204,6 +205,16 @@ _gcry_rndlinux_gather_random (void (*add
|
||||
{
|
||||
if (fd_urandom == -1)
|
||||
{
|
||||
+#if defined(__linux__) && defined(HAVE_SYSCALL) && defined(__NR_getrandom)
|
||||
+ long ret;
|
||||
+
|
||||
+ _gcry_pre_syscall ();
|
||||
+ ret = syscall (__NR_getrandom,
|
||||
+ (void*)buffer, (size_t)1, (unsigned int)GRND_NONBLOCK);
|
||||
+ _gcry_post_syscall ();
|
||||
+ if (ret == -1 && errno == ENOSYS)
|
||||
+ /* The syscall is not supported - fallback to /dev/urandom. */
|
||||
+#endif
|
||||
fd_urandom = open_device (NAME_OF_DEV_URANDOM, (ever_opened & 2));
|
||||
ever_opened |= 2;
|
||||
}
|
||||
@@ -246,9 +257,7 @@ _gcry_rndlinux_gather_random (void (*add
|
||||
_gcry_post_syscall ();
|
||||
}
|
||||
while (ret == -1 && errno == EINTR);
|
||||
- if (ret == -1 && errno == ENOSYS)
|
||||
- ; /* The syscall is not supported - fallback to /dev/urandom. */
|
||||
- else
|
||||
+ if (1)
|
||||
{ /* The syscall is supported. Some sanity checks. */
|
||||
if (ret == -1)
|
||||
log_fatal ("unexpected error from getrandom: %s\n",
|
||||
334
libgcrypt.spec
334
libgcrypt.spec
|
|
@ -1,50 +1,62 @@
|
|||
# This is taken from gnutls.spec
|
||||
%define srpmhash() %{lua:
|
||||
local files = rpm.expand("%_specdir/libgcrypt.spec")
|
||||
for i, p in ipairs(patches) do
|
||||
files = files.." "..p
|
||||
end
|
||||
for i, p in ipairs(sources) do
|
||||
files = files.." "..p
|
||||
end
|
||||
local sha256sum = assert(io.popen("cat "..files.."| sha256sum"))
|
||||
local hash = sha256sum:read("*a")
|
||||
sha256sum:close()
|
||||
print(string.sub(hash, 0, 16))
|
||||
}
|
||||
|
||||
Name: libgcrypt
|
||||
Version: 1.11.2
|
||||
Version: 1.8.2
|
||||
Release: 1%{?dist}
|
||||
URL: https://www.gnupg.org/
|
||||
Source0: https://www.gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2
|
||||
Source1: https://www.gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2.sig
|
||||
Source2: https://gnupg.org/signature_key.asc
|
||||
# Pass the annobin flags to the libgcrypt.so (#2016349)
|
||||
Patch1: libgcrypt-1.10.1-annobin.patch
|
||||
# https://gitlab.com/redhat-crypto/libgcrypt/libgcrypt-mirror/-/merge_requests/19/
|
||||
Patch5: libgcrypt-1.11.0-marvin.patch
|
||||
URL: http://www.gnupg.org/
|
||||
Source0: libgcrypt-%{version}-hobbled.tar.xz
|
||||
# The original libgcrypt sources now contain potentially patented ECC
|
||||
# cipher support. We have to remove it in the tarball we ship with
|
||||
# the hobble-libgcrypt script.
|
||||
# (We replace it with RH approved ECC in Source4-5)
|
||||
#Source0: ftp://ftp.gnupg.org/gcrypt/libgcrypt/libgcrypt-{version}.tar.bz2
|
||||
#Source1: ftp://ftp.gnupg.org/gcrypt/libgcrypt/libgcrypt-{version}.tar.bz2.sig
|
||||
Source2: wk@g10code.com
|
||||
Source3: hobble-libgcrypt
|
||||
# Approved ECC support (from 1.6.1)
|
||||
Source4: ecc-curves.c
|
||||
Source5: curves.c
|
||||
Source6: t-mpi-point.c
|
||||
Source7: random.conf
|
||||
# make FIPS hmac compatible with fipscheck - non upstreamable
|
||||
# update on soname bump
|
||||
Patch2: libgcrypt-1.6.2-use-fipscheck.patch
|
||||
# fix tests in the FIPS mode, allow CAVS testing of DSA keygen
|
||||
Patch5: libgcrypt-1.8.0-tests.patch
|
||||
# update the CAVS tests
|
||||
Patch7: libgcrypt-1.7.3-fips-cavs.patch
|
||||
# use poll instead of select when gathering randomness
|
||||
Patch11: libgcrypt-1.8.0-use-poll.patch
|
||||
# slight optimalization of mpicoder.c to silence Valgrind (#968288)
|
||||
Patch13: libgcrypt-1.6.1-mpicoder-gccopt.patch
|
||||
# fix tests to work with approved ECC
|
||||
Patch14: libgcrypt-1.7.3-ecc-test-fix.patch
|
||||
# Run the FIPS mode initialization in the shared library constructor
|
||||
Patch18: libgcrypt-1.6.2-fips-ctor.patch
|
||||
# Block some operations if in FIPS non-operational state
|
||||
Patch22: libgcrypt-1.7.3-fips-reqs.patch
|
||||
# Do not try to open /dev/urandom if getrandom() works
|
||||
Patch24: libgcrypt-1.8.1-getrandom.patch
|
||||
|
||||
%global gcrylibdir %{_libdir}
|
||||
%global gcrysoname libgcrypt.so.20
|
||||
%global hmackey orboDeJITITejsirpADONivirpUkvarP
|
||||
%define gcrylibdir %{_libdir}
|
||||
|
||||
License: BSD-3-Clause AND (BSD-3-Clause OR GPL-2.0-only) AND GPL-2.0-or-later AND LGPL-2.1-or-later AND LGPL-2.0-or-later AND MIT-Modern-Variant
|
||||
# Technically LGPLv2.1+, but Fedora's table doesn't draw a distinction.
|
||||
# Documentation and some utilities are GPLv2+ licensed. These files
|
||||
# are in the devel subpackage.
|
||||
License: LGPLv2+
|
||||
Summary: A general-purpose cryptography library
|
||||
BuildRequires: gcc
|
||||
BuildRequires: gawk, libgpg-error-devel >= 1.11, pkgconfig
|
||||
BuildRequires: fipscheck
|
||||
# This is needed only when patching the .texi doc.
|
||||
BuildRequires: texinfo
|
||||
BuildRequires: autoconf, automake, libtool
|
||||
BuildRequires: make
|
||||
BuildRequires: gnupg2
|
||||
BuildRequires: annobin-annocheck binutils
|
||||
Group: System Environment/Libraries
|
||||
|
||||
%package devel
|
||||
Summary: Development files for the %{name} package
|
||||
License: LGPLv2+ and GPLv2+
|
||||
Group: Development/Libraries
|
||||
Requires(pre): /sbin/install-info
|
||||
Requires(post): /sbin/install-info
|
||||
Requires: libgpg-error-devel
|
||||
Requires: %{name}%{?_isa} = %{version}-%{release}
|
||||
Requires: pkgconfig
|
||||
Requires: %{name} = %{version}-%{release}
|
||||
|
||||
%description
|
||||
Libgcrypt is a general purpose crypto library based on the code used
|
||||
|
|
@ -56,59 +68,47 @@ in GNU Privacy Guard. This package contains files needed to develop
|
|||
applications using libgcrypt.
|
||||
|
||||
%prep
|
||||
%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
|
||||
%setup -q
|
||||
%patch 1 -p1
|
||||
%patch 5 -p1
|
||||
%{SOURCE3}
|
||||
%patch2 -p1 -b .use-fipscheck
|
||||
%patch5 -p1 -b .tests
|
||||
%patch7 -p1 -b .cavs
|
||||
%patch11 -p1 -b .use-poll
|
||||
%patch13 -p1 -b .gccopt
|
||||
%patch14 -p1 -b .eccfix
|
||||
%patch18 -p1 -b .fips-ctor
|
||||
%patch22 -p1 -b .fips-reqs
|
||||
%patch24 -p1 -b .getrandom
|
||||
|
||||
cp %{SOURCE4} cipher/
|
||||
cp %{SOURCE5} %{SOURCE6} tests/
|
||||
|
||||
%build
|
||||
# should be all algorithms except SM3 and SM4, aria
|
||||
export DIGESTS='crc gostr3411-94 md4 md5 rmd160 sha1 sha256 sha512 sha3 tiger whirlpool stribog blake2'
|
||||
export CIPHERS='arcfour blowfish cast5 des aes twofish serpent rfc2268 seed camellia idea salsa20 gost28147 chacha20'
|
||||
|
||||
eval $(sed -n 's/^\(\(NAME\|VERSION_ID\)=.*\)/OS_\1/p' /etc/os-release)
|
||||
export FIPS_MODULE_NAME="$OS_NAME ${OS_VERSION_ID%%.*} %name"
|
||||
|
||||
autoreconf -f
|
||||
%configure --disable-static \
|
||||
%ifarch sparc64
|
||||
--disable-asm \
|
||||
%endif
|
||||
--enable-noexecstack \
|
||||
--enable-hmac-binary-check=%{hmackey} \
|
||||
--disable-jent-support \
|
||||
--disable-O-flag-munging \
|
||||
--enable-digests="$DIGESTS" \
|
||||
--enable-ciphers="$CIPHERS" \
|
||||
--enable-marvin-workaround \
|
||||
--with-fips-module-version="$FIPS_MODULE_NAME %{version}-%{srpmhash}"
|
||||
--enable-hmac-binary-check \
|
||||
--enable-pubkey-ciphers='dsa elgamal rsa ecc' \
|
||||
--disable-O-flag-munging
|
||||
sed -i -e '/^sys_lib_dlsearch_path_spec/s,/lib /usr/lib,/usr/lib /lib64 /usr/lib64 /lib,g' libtool
|
||||
%make_build
|
||||
make %{?_smp_mflags}
|
||||
|
||||
%check
|
||||
fipshmac src/.libs/libgcrypt.so.??
|
||||
make check
|
||||
# try in faked FIPS mode too
|
||||
LIBGCRYPT_FORCE_FIPS_MODE=1 make check
|
||||
|
||||
%define libpath $RPM_BUILD_ROOT%{gcrylibdir}/%{gcrysoname}.?.?
|
||||
|
||||
PROFILE=%{?dist} annocheck --ignore-unknown --verbose --profile=${PROFILE:1} %{libpath}
|
||||
|
||||
# Add generation of HMAC checksums of the final stripped binaries
|
||||
%define __spec_install_post \
|
||||
%{?__debug_package:%{__debug_install_post}} \
|
||||
%{__arch_install_post} \
|
||||
%{__os_install_post} \
|
||||
cd src \
|
||||
sed -i -e 's|FILE=.*|FILE=\\\$1|' gen-note-integrity.sh \
|
||||
READELF=readelf AWK=awk ECHO_N="-n" bash gen-note-integrity.sh %{libpath} > %{libpath}.hmac \
|
||||
objcopy --update-section .note.fdo.integrity=%{libpath}.hmac %{libpath} %{libpath}.new \
|
||||
mv -f %{libpath}.new %{libpath} \
|
||||
rm -f %{libpath}.hmac
|
||||
fipshmac $RPM_BUILD_ROOT%{gcrylibdir}/*.so.?? \
|
||||
%{nil}
|
||||
|
||||
%install
|
||||
%make_install
|
||||
make install DESTDIR=$RPM_BUILD_ROOT
|
||||
|
||||
# Change /usr/lib64 back to /usr/lib. This saves us from having to patch the
|
||||
# script to "know" that -L/usr/lib64 should be suppressed, and also removes
|
||||
|
|
@ -149,205 +149,49 @@ popd
|
|||
# Create /etc/gcrypt (hardwired, not dependent on the configure invocation) so
|
||||
# that _someone_ owns it.
|
||||
mkdir -p -m 755 $RPM_BUILD_ROOT/etc/gcrypt
|
||||
install -m644 %{SOURCE7} $RPM_BUILD_ROOT/etc/gcrypt/random.conf
|
||||
|
||||
%ldconfig_scriptlets
|
||||
%post -p /sbin/ldconfig
|
||||
|
||||
%postun -p /sbin/ldconfig
|
||||
|
||||
%post devel
|
||||
[ -f %{_infodir}/gcrypt.info.gz ] && \
|
||||
/sbin/install-info %{_infodir}/gcrypt.info.gz %{_infodir}/dir
|
||||
exit 0
|
||||
|
||||
%preun devel
|
||||
if [ $1 = 0 -a -f %{_infodir}/gcrypt.info.gz ]; then
|
||||
/sbin/install-info --delete %{_infodir}/gcrypt.info.gz %{_infodir}/dir
|
||||
fi
|
||||
exit 0
|
||||
|
||||
%files
|
||||
%defattr(-,root,root,-)
|
||||
%dir /etc/gcrypt
|
||||
%{gcrylibdir}/libgcrypt.so.*.*
|
||||
%{gcrylibdir}/%{gcrysoname}
|
||||
%config(noreplace) /etc/gcrypt/random.conf
|
||||
%{gcrylibdir}/libgcrypt.so.*
|
||||
%{gcrylibdir}/.libgcrypt.so.*.hmac
|
||||
%{!?_licensedir:%global license %%doc}
|
||||
%license COPYING.LIB
|
||||
%doc AUTHORS NEWS THANKS
|
||||
|
||||
%files devel
|
||||
%defattr(-,root,root,-)
|
||||
%{_bindir}/%{name}-config
|
||||
%{_bindir}/dumpsexp
|
||||
%{_bindir}/hmac256
|
||||
%{_bindir}/mpicalc
|
||||
%{_includedir}/*
|
||||
%{_libdir}/*.so
|
||||
%{_libdir}/pkgconfig/libgcrypt.pc
|
||||
%{_datadir}/aclocal/*
|
||||
%{_mandir}/man1/*
|
||||
|
||||
%{_infodir}/gcrypt.info*
|
||||
%{!?_licensedir:%global license %%doc}
|
||||
%license COPYING
|
||||
|
||||
%changelog
|
||||
* Mon Nov 03 2025 Jakub Jelen <jjelen@redhat.com> - 1.11.2-1
|
||||
- New upstream release (#2406804)
|
||||
|
||||
* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.11.1-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
|
||||
|
||||
* Tue May 13 2025 Jakub Jelen <jjelen@redhat.com> - 1.11.1-1
|
||||
- New upstream release (#2364878)
|
||||
|
||||
* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.11.0-5
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
|
||||
|
||||
* Tue Oct 29 2024 Jakub Jelen <jjelen@redhat.com> - 1.11.0-4
|
||||
- Run annocheck as part of the build
|
||||
- Use upstream CF protection patches
|
||||
- Fix PAC/BTI protection for Aarch64
|
||||
- Fix CVE-2024-2236 (#2274128)
|
||||
|
||||
* Thu Jul 25 2024 Jakub Jelen <jjelen@redhat.com> - 1.11.0-3
|
||||
- Disable -O flag munging and remove needles modification of LTO flags.
|
||||
|
||||
* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.11.0-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
|
||||
|
||||
* Wed Jun 19 2024 Jakub Jelen <jjelen@redhat.com> - 1.11.0-1
|
||||
- New upstream release (#2293064)
|
||||
|
||||
* Tue Mar 26 2024 Jakub Jelen <jjelen@redhat.com> - 1.10.3-4
|
||||
- Replace deprecated fgrep (#2271503)
|
||||
|
||||
* Thu Jan 25 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.3-3
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
|
||||
|
||||
* Sun Jan 21 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.3-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
|
||||
|
||||
* Tue Nov 14 2023 Jakub Jelen <jjelen@redhat.com> - 1.10.3-1
|
||||
- New upstream release (#2249639)
|
||||
|
||||
* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.2-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
|
||||
|
||||
* Tue Apr 11 2023 Jakub Jelen <jjelen@redhat.com> - 1.10.2-1
|
||||
- New upstream release (#2185084)
|
||||
|
||||
* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.1-7
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
|
||||
|
||||
* Sat Dec 3 2022 Florian Weimer <fweimer@redhat.com> - 1.10.1-6
|
||||
- Port configure script to C99
|
||||
|
||||
* Tue Nov 08 2022 Todd Zullinger <tmz@pobox.com> - 1.10.1-5
|
||||
- enable brainpool by default (#1413618)
|
||||
- fix sporadic failures generating RSA keys in FIPS mode
|
||||
|
||||
* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.10.1-4
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
|
||||
|
||||
* Sun May 29 2022 Todd Zullinger <tmz@pobox.com> - 1.10.1-3
|
||||
- improve --disable-brainpool configure output
|
||||
- use %%bcond_with to disable brainpool curves
|
||||
|
||||
* Fri Apr 08 2022 Jakub Jelen <jjelen@redhat.com> - 1.10.1-2
|
||||
- Adjust integrity check creation to match upstream (#2073018)
|
||||
|
||||
* Tue Mar 29 2022 Jakub Jelen <jjelen@redhat.com> - 1.10.1-1
|
||||
- Final release (#2069263)
|
||||
|
||||
* Wed Feb 02 2022 Jakub Jelen <jjelen@redhat.com> - 1.10.0-1
|
||||
- New upstream release (#2049322)
|
||||
|
||||
* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.9.4-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
|
||||
|
||||
* Mon Aug 23 2021 Jakub Jelen <jjelen@redhat.com> - 1.9.4-1
|
||||
- New upstream release (#1996467)
|
||||
|
||||
* Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.9.3-4
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
|
||||
|
||||
* Tue Jun 15 2021 Jakub Jelen <jjelen@redhat.com> - 1.9.3-3
|
||||
- Fix for CVE-2021-33560 (#1970098)
|
||||
|
||||
* Wed Apr 28 2021 Jakub Jelen <jjelen@redhat.com> - 1.9.3-2
|
||||
- Restore the CET protection (#1954049)
|
||||
|
||||
* Tue Apr 20 2021 Jakub Jelen <jjelen@redhat.com> - 1.9.3-1
|
||||
- New upstream release (#1951325)
|
||||
|
||||
* Thu Apr 15 2021 Jakub Jelen <jjelen@redhat.com> - 1.9.2-3
|
||||
- Fix issues reported by coverity
|
||||
|
||||
* Mon Mar 29 2021 Jakub Jelen <jjelen@redhat.com> - 1.9.2-2
|
||||
- Fix OCB tag creation on s390x (failing gnupg2 tests)
|
||||
|
||||
* Wed Feb 17 2021 Jakub Jelen <jjelen@redhat.com> - 1.9.2-1
|
||||
- New upstream release (#1929630)
|
||||
|
||||
* Fri Jan 29 2021 Jakub Jelen <jjelen@redhat.com> - 1.9.1-1
|
||||
- New upstream release (#1922156, #1922097)
|
||||
|
||||
* Wed Jan 20 2021 Jakub Jelen <jjelen@redhat.com> - 1.9.0-1
|
||||
- New upstream release (#1917878)
|
||||
|
||||
* Tue Nov 24 2020 Jakub Jelen <jjelen@redhat.com> - 1.8.7-1
|
||||
- new upstream release (#1891123)
|
||||
|
||||
* Fri Aug 21 2020 Jeff Law <law@redhat.com> - 1.8.6-4
|
||||
- Re-enable LTO
|
||||
|
||||
* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.6-3
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
|
||||
|
||||
* Tue Jul 21 2020 Tom Stellard <tstellar@redhat.com> - 1.8.6-2
|
||||
- Use make macros
|
||||
- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
|
||||
|
||||
* Mon Jul 20 2020 Tomáš Mráz <tmraz@redhat.com> 1.8.6-1
|
||||
- new upstream version 1.8.6
|
||||
|
||||
* Wed Jul 1 2020 Tomáš Mráz <tmraz@redhat.com> 1.8.5-7
|
||||
- use the hmac256 tool to calculate the library hmac
|
||||
|
||||
* Tue Jun 30 2020 Jeff Law <law@redhat.com>
|
||||
- Disable LTO
|
||||
|
||||
* Thu Apr 23 2020 Tomáš Mráz <tmraz@redhat.com> 1.8.5-6
|
||||
- Fix regression - missing -ldl linkage
|
||||
|
||||
* Wed Apr 22 2020 Tomáš Mráz <tmraz@redhat.com> 1.8.5-5
|
||||
- AES performance improvements backported from master branch
|
||||
|
||||
* Mon Apr 20 2020 Tomáš Mráz <tmraz@redhat.com> 1.8.5-4
|
||||
- FIPS selftest is run directly from the constructor
|
||||
- FIPS module is implicit with kernel FIPS flag
|
||||
|
||||
* Thu Jan 30 2020 Tomáš Mráz <tmraz@redhat.com> 1.8.5-3
|
||||
- fix the build on ARMv7
|
||||
|
||||
* Thu Jan 23 2020 Tomáš Mráz <tmraz@redhat.com> 1.8.5-2
|
||||
- Intel CET support by H. J. Lu
|
||||
|
||||
* Tue Sep 3 2019 Tomáš Mráz <tmraz@redhat.com> 1.8.5-1
|
||||
- new upstream version 1.8.5
|
||||
- add CMAC selftest for FIPS POST
|
||||
- add continuous FIPS entropy test
|
||||
- disable non-approved FIPS hashes in the enforced FIPS mode
|
||||
|
||||
* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.4-4
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
|
||||
|
||||
* Tue Feb 12 2019 Tomáš Mráz <tmraz@redhat.com> 1.8.4-3
|
||||
- fix the build tests to pass in the FIPS mode
|
||||
|
||||
* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.4-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
|
||||
|
||||
* Tue Nov 20 2018 Tomáš Mráz <tmraz@redhat.com> 1.8.4-1
|
||||
- new upstream version 1.8.4
|
||||
|
||||
* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.3-3
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
|
||||
|
||||
* Thu Jul 12 2018 Tomáš Mráz <tmraz@redhat.com> 1.8.3-2
|
||||
- make only_urandom a default in non-presence of configuration file
|
||||
- run the full FIPS selftests only when the library is called from
|
||||
application
|
||||
|
||||
* Thu Jun 14 2018 Tomáš Mráz <tmraz@redhat.com> 1.8.3-1
|
||||
- new upstream version 1.8.3
|
||||
|
||||
* Tue Feb 6 2018 Tomáš Mráz <tmraz@redhat.com> 1.8.2-2
|
||||
- fix behavior when getrandom syscall is not present (#1542453)
|
||||
|
||||
* Thu Dec 21 2017 Tomáš Mráz <tmraz@redhat.com> 1.8.2-1
|
||||
- new upstream version 1.8.2
|
||||
|
||||
|
|
|
|||
4
random.conf
Normal file
4
random.conf
Normal file
|
|
@ -0,0 +1,4 @@
|
|||
# use only /dev/urandom - see https://www.2uo.de/myths-about-urandom/
|
||||
only-urandom
|
||||
# Keep jitter entropy generator enabled (should do no harm)
|
||||
#disable-jent
|
||||
|
|
@ -1,86 +0,0 @@
|
|||
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
||||
|
||||
mQGNBFjLuq4BDACnM7zNSIaVMAacTwjXa5TGYe13i6ilHe4VL0NShzrgzjcQg531
|
||||
3cRgiiiNA7OSOypMqVs73Jez6ZUctn2GVsHBrS/io9NcuC9pVwf8a61WlcEa+EtB
|
||||
a3G7HlBmEWnwaUdAtWKNuAi9Xn+Ir7H2xEdksmmd5a0/QnL+sX705boVPF/tpYtb
|
||||
LGpPxa78tNrtxDkSwy8Wmi0IADYLI5yI7/yUGeJd8RSCU/fLRKC9fG7YOZRq0tsO
|
||||
MhVNWmtUjbG6e73Lu8LKnCZgs1/fC8hvPyARieSV5mdN8s1oWd7oYctfgL4uBleD
|
||||
ItAA8GhjKejutzHN8Ei/APw6AiiSyEjnPg+cTX8OgvLGJWjks0H6mPZeB1v/kGyZ
|
||||
hBS9vm540h2/MmlVN2ntiCK5TZGeSWpqddiqusfVXotMRpN4HeLKoZh4RAncaCbZ
|
||||
F/S+YLeN+kMXY4k3Fqt1fjTX6veFCbthI9pDdHzU9LfUVNp9D/5ktC/tYMORMegV
|
||||
+wSMxi9G2YWKJkMAEQEAAYkBzgQfAQgAOBYhBFuAxXVCmPDLVdjtarzvfilLCS4o
|
||||
BQJYy8DdFwyAAZSlyaA8L+XKOwldjh/fcjz0YraxAgcAAAoJELzvfilLCS4oNgoL
|
||||
/0+K1xIx8JW7Lk5M6bYCvNA4fdlEcwQIT4UidJFM9m+suxYFWIGfebvHpRlEuJTg
|
||||
dBjkEit8uLAoJXU0BRkKTLrzTF+qDUE79Wfx/R+0nOgJ7aMykQOi0AvuwzMYz4dg
|
||||
xIVS2Daou4DF7bh/KF8+fqrmq8P8W1ZrkuFDanMWpHeAPx1uj2skYbo7uPqFdvlJ
|
||||
hlNHrcxlcCkjf1InAt0Xt5lMvEsCRUPf9xAH4mNEhs0lh9c+200YPRmtnLWAzc1K
|
||||
ckLIC8Q+mUR3DjZDqBlDBEPegXkrI0+MlvRA+9AnAm4YPqTMUfpZ6ZOAWeFjC/6Z
|
||||
QYxG/AdWGkb4WFindzklQfybEuiekP8vU07ACQwSwH8PYe0UCom1YrlRUjX7QLkn
|
||||
ZLWoeZg8BZy9GTM1Ut7Q1Q2uTw6mxxISuef+RFgYOHjWwLpFWZpqC88xERl7o/iz
|
||||
iERJRt/593IctbjO9wenWt2peIAwzR4nz7LqM6ZFTdRAETmcdSvYRhg2Qt8hUE47
|
||||
CbQkQW5kcmUgSGVpbmVja2UgKFJlbGVhc2UgU2lnbmluZyBLZXkpiQHUBBMBCAA+
|
||||
FiEEW4DFdUKY8MtV2O1qvO9+KUsJLigFAljLuq4CGwMFCRLMAwAFCwkIBwIGFQgJ
|
||||
CgsCBBYCAwECHgECF4AACgkQvO9+KUsJLihC/QwAhCC+SEvcFLcutgZ8HfcCtoZs
|
||||
IoVzZEy7DjqIvGgnTssD8HCLnIAHCDvnP7dJW3uMuLCdSqym3cjlEIiQMsaGywkl
|
||||
fzJISAwJrGQdWSKRd535jXpEXQlXDKal/IwMKAUt0PZtlCc9S3gwixQryxdJ28lJ
|
||||
6h2T9fVDr8ZswMmTAFG91uctfhjKOMgPt8UhSPGW484WsIsQgkbOvf+Kfswl0eHu
|
||||
ywX+pKAB5ZQ/9GVC6Ug4xfrdiJL0azJTPnvjMY5JYp6/L9RURs5hP5AnHR2j/PPo
|
||||
sAtsFCjmbRbOMiASzklnUJPbSz5kfLloDWZmrUScjbzmsXehGyt433JGyRhZJl4x
|
||||
/jPbzKhaaAHsGd+fRao6vlLOwFywDDVMp6JuyK7UeUb7I8ekTbSkGFA+l2Oa3O6/
|
||||
Y7PYhq7hwwAFuZckYI98IpHNCG1fS9W07FyKdvQbK1PbF1JFRKfsUCWYMKqDnbqE
|
||||
o5jivPEHZImw6iYhhXcyEYl8fjcb9T6/S+wOP7aviQGzBBABCAAdFiEElKXJoDwv
|
||||
5co7CV2OH99yPPRitrEFAljLv5sACgkQH99yPPRitrFw4gv/XFMFN+/LHsn9hJOP
|
||||
4rCwl1yUuxXuYmZgc0sRoY3EpeQkJVyKurQuqqKoy2VuoMiF0O1kAQmGoFtVPUk7
|
||||
b8hCoutqB5GyeyKcoLP+WINgVhB2gXg7TSp3MPLBKkgqvSDvPitgRxBqFb4LW8LJ
|
||||
bDbfwGrzIvXfDV3WvsrHVPbc2fhlWdL8d+3AE6mFiXF3eTpgmV3ApSBQV12MkkCk
|
||||
icLIPmp+ZxZON+OP52ZXkRtfMgOy4Oa/41agrViDAZdMOGeGkhPertQheQZgXzmo
|
||||
GF5Wz498HPM80Kv35X91l3iGzL+icEtO+tWea2YscsZ6qpRe2lfVPHk3B+anlmCj
|
||||
m4kM4cBd39xa4HHSVh/bRHbZNtgVr7slQCKxlHgQOGVI5vCxPCwEsgJ2KBk03Nk/
|
||||
IA9EKO+czfh3/bHW6uMbEqrYDCnt+hmzZrpKDSGcwS/KOhvMUIMlb7/8vDKum6mp
|
||||
/8xAtVZ6IAxYZNt3qg7Y7aLRtzCTyqm8rJQrZPtRaQcgLoEimDMEX0PliRYJKwYB
|
||||
BAHaRw8BAQdAz75Hlekc16JhhfI0MKdEVxLdkxhcMCO0ZG6WMBAmNpe0H1dlcm5l
|
||||
ciBLb2NoIChkaXN0IHNpZ25pbmcgMjAyMCmImgQTFgoAQhYhBG2qbmSnbShAVxtJ
|
||||
AlKIl7gmQDraBQJfQ+w1AhsDBQkShccRBQsJCAcCAyICAQYVCgkICwIEFgIDAQIe
|
||||
BwIXgAAKCRBSiJe4JkA62nmuAP9uL/HOdB0gvwWrH+FpURJLs4bnaZaPIk9ARrU0
|
||||
EXRgJgD/YCGfHQXpIPT0ZaXuwJexK04Z+qMFR/bM1q1Leo5CjgaIbQQQEQsAHRYh
|
||||
BIBhWHD1utaQMzaG0PKthaweQrNnBQJfQ/HmAAoJEPKthaweQrNnIZkA3jG6LcZv
|
||||
V/URn8Y8OJqsyYa4C3NI4nN+OhEvYhgA4PHzMnALeXIpA2gblvjFIPJPAhDBAU37
|
||||
c5PA6+6IdQQQFggAHRYhBK6oTtzwGthsRwHIXGMROuhmWH0KBQJfQ/IlAAoJEGMR
|
||||
OuhmWH0K1+MA/0uJ5AHcnSfIBEWHNJwwVVLGyrxAWtS2U+zeymp/UvlPAQDErCLZ
|
||||
l0dBiPG3vlowFx5TNep7tanBs6ZJn8F1ao1tAIkBMwQQAQgAHRYhBNhpISPEBl3q
|
||||
Xg86tSSbOdJPJeO2BQJfQ/OuAAoJECSbOdJPJeO2DVoH/0o9if66ph6FJrgr+A/W
|
||||
HNVeHxmM5tUQhpL1wpRS70SKcsJgolf5CxO5iTQf3HlZe544xGbIU/aCTJsWw9zi
|
||||
UE8KmhAtKV4eL/7oQ7xx4nxPnABLpudtM8A44nsM1x/XiYrJnnDm29QjYEGd2Hi8
|
||||
7npc7VWKzLoj+I/WcXquynJi5O9TUxW9Bknd1pjpxFkf8v+msjBzCD5VKJgr0CR8
|
||||
wA6peQBWeGZX2HacosMIZH4TfL0r0TFla6LJIkNBz9DyIm1yL4L8oRH0950hQljP
|
||||
C7TM3L7aRpX+4Kph6llFz6g7MALGFP95kyJ6o+XED9ORuuQVZMBMIkNC0tXOu10V
|
||||
bdqIdQQQFgoAHRYhBMHTS2khnkruwLocIeP9/yGORbcrBQJfQ/P8AAoJEOP9/yGO
|
||||
Rbcr3lQBAMas8Vl3Hdl3g2I283lz1uHiGvlwcnk2TLeB+U4zIwC9AQCy0nnazVNt
|
||||
VQPID1ZCMoaOX7AzOjaqQDLf4j+dVTxgBJgzBGCkgocWCSsGAQQB2kcPAQEHQJmd
|
||||
fwp8jEN5P3eEjhQiWk6zQi8utvgOvYD57XmE+H8+tCBOaWliZSBZdXRha2EgKEdu
|
||||
dVBHIFJlbGVhc2UgS2V5KYiaBBMWCgBCFiEErI4RW/c+LY1H+pkI6Y6bLRnGyL0F
|
||||
AmCkgocCGwMFCQsNBpkFCwkIBwIDIgIBBhUKCQgLAgQWAgMBAh4HAheAAAoJEOmO
|
||||
my0Zxsi9/4IA/1rvSr3MU+Sv4jhNDzD+CeC3gmHkPew6pi9VHEsEwdgmAQD2BtiX
|
||||
7w1sJL/CBylGWv5jxj4345mP9YfZm0RsgzPjDIh1BBAWCAAdFiEEJJyzdxdQdF1c
|
||||
3TI84mewUjZPAo0FAmFAQ54ACgkQ4mewUjZPAo1CiAD+KTT1UVdQTGHMyvHwZocS
|
||||
QjU8xhcZrTet+dvvjrE5+4MA/RBdJPZgFevUKu68NEy0Lo+RbkeCtmQJ/c8v5ieF
|
||||
vW0AiQEzBBABCAAdFiEEEkEkvTtIYq96CkLxALRevUynur4FAmFAQ7cACgkQALRe
|
||||
vUynur4kaAgAolPR8TNWVS0vXMKrr0k0l2M/8QkZTaLZx1GT9Nx1yb4WJKY7ElPM
|
||||
YkhGDxetvFBETx0pH/6R3jtj6Crmur+NKHVSRY+rCYpFPDn6ciIOryssRx2G4kCZ
|
||||
t+nFB9JyDbBOZAR8DK4pN1mAxG/yLDt4oKcUQsP2xlEFum+phxyR8KyYCpkwKRxY
|
||||
eK+6lfilQuveoUwp/Xx5wXPNUy6q4eOOovCW7gS7I7288NGHCa2ul8sD6vA9C4mM
|
||||
4Zxaole9P9wwJe1zZFtCIy88zHM9vqv+YM9DxMCaW24+rUztr7eD4bCRdG+QlSh+
|
||||
7R/TaqSxY1eAAd1J5tma9CNJO73pTKU+/JhTBGFpSqMTCSskAwMCCAEBBwIDBF6X
|
||||
D9NmUQDgiyYNbhs1DMJ14mIw812wY1HVx/4QWYWiBunhrvSFxVbzsjD7/Wv+v3bm
|
||||
MPrL+M2DLyFiSewNmcS0JEdudVBHLmNvbSAoUmVsZWFzZSBTaWduaW5nIEtleSAy
|
||||
MDIxKYiaBBMTCABCFiEEAvON/3Mf+XywOaHaVJ5pXpBboggFAmFpSqMCGwMFCQ9x
|
||||
14oFCwkIBwIDIgIBBhUKCQgLAgQWAgMBAh4HAheAAAoJEFSeaV6QW6IITkoA/RYa
|
||||
jaTl1eEBU/Gdm12o3jrI55N5xZK2XTqSx25clVyjAP0XwMW/Og5+ND1ri3bAqADV
|
||||
WlBDUswz8wYxsb0C4kYBkoh1BBAWCgAdFiEEbapuZKdtKEBXG0kCUoiXuCZAOtoF
|
||||
AmFpTvEACgkQUoiXuCZAOtrJQAEAh7YyykjAy/Qs1yC3ji8iBfIVnPXvblrIx3SR
|
||||
RyDwRC8BAKtZbEuKTtPlgkLUgMleTcZJ/vEhJE+GvfQ9o5gWCqEFiHUEEBYKAB0W
|
||||
IQTB00tpIZ5K7sC6HCHj/f8hjkW3KwUCYWlPWgAKCRDj/f8hjkW3Kx4eAQDp6aGS
|
||||
N/fU4xLl8RSvQUVjVA+aCTrMQR3hRwqw8liF2wEA3O3ECxz6e1+DoItYoJBBLKLw
|
||||
eiInsGZ/+h5XYrpXTgA=
|
||||
=4+Sn
|
||||
-----END PGP PUBLIC KEY BLOCK-----
|
||||
3
sources
3
sources
|
|
@ -1,2 +1 @@
|
|||
SHA512 (libgcrypt-1.11.2.tar.bz2) = b706cea602cc8f0896e57ce979643bf78974b05faec27c1b053b773c57d8b04250e30e95a4ef5899e1df981d01d8d08f0a36e10b5820a5ec4183e74c02e5f1f0
|
||||
SHA512 (libgcrypt-1.11.2.tar.bz2.sig) = e63d240a9b97aa218c98c5baa72a30321ae85412d4a8748e36578bd9498fe8c8ee2ba84835d1783cdfc1e5dfb66b0a89409d6263e9c06f4cd11e919d4bce0cd2
|
||||
SHA512 (libgcrypt-1.8.2-hobbled.tar.xz) = a44a5fc1205e9d9eaaabd07be1a079a5a1d59c729cd13310e9bbd30da0c24ad98c40e23ea8a2db22c43aca818745e95004e51f6eb1d63ae4e259506aeecfb692
|
||||
|
|
|
|||
959
t-mpi-point.c
Normal file
959
t-mpi-point.c
Normal file
|
|
@ -0,0 +1,959 @@
|
|||
/* t-mpi-point.c - Tests for mpi point functions
|
||||
* Copyright (C) 2013 g10 Code GmbH
|
||||
*
|
||||
* This file is part of Libgcrypt.
|
||||
*
|
||||
* Libgcrypt is free software; you can redistribute it and/or modify
|
||||
* it under the terms of the GNU Lesser General Public License as
|
||||
* published by the Free Software Foundation; either version 2.1 of
|
||||
* the License, or (at your option) any later version.
|
||||
*
|
||||
* Libgcrypt is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU Lesser General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU Lesser General Public
|
||||
* License along with this program; if not, see <http://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
#ifdef HAVE_CONFIG_H
|
||||
# include <config.h>
|
||||
#endif
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <assert.h>
|
||||
#include <stdarg.h>
|
||||
|
||||
#define PGM "t-mpi-point"
|
||||
#include "t-common.h"
|
||||
|
||||
static struct
|
||||
{
|
||||
const char *desc; /* Description of the curve. */
|
||||
const char *p; /* Order of the prime field. */
|
||||
const char *a, *b; /* The coefficients. */
|
||||
const char *n; /* The order of the base point. */
|
||||
const char *g_x, *g_y; /* Base point. */
|
||||
const char *h; /* Cofactor. */
|
||||
} test_curve[] =
|
||||
{
|
||||
{
|
||||
"NIST P-224",
|
||||
"0xffffffffffffffffffffffffffffffff000000000000000000000001",
|
||||
"0xfffffffffffffffffffffffffffffffefffffffffffffffffffffffe",
|
||||
"0xb4050a850c04b3abf54132565044b0b7d7bfd8ba270b39432355ffb4",
|
||||
"0xffffffffffffffffffffffffffff16a2e0b8f03e13dd29455c5c2a3d" ,
|
||||
|
||||
"0xb70e0cbd6bb4bf7f321390b94a03c1d356c21122343280d6115c1d21",
|
||||
"0xbd376388b5f723fb4c22dfe6cd4375a05a07476444d5819985007e34",
|
||||
"0x01"
|
||||
},
|
||||
{
|
||||
"NIST P-256",
|
||||
"0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff",
|
||||
"0xffffffff00000001000000000000000000000000fffffffffffffffffffffffc",
|
||||
"0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b",
|
||||
"0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551",
|
||||
|
||||
"0x6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296",
|
||||
"0x4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5",
|
||||
"0x01"
|
||||
},
|
||||
{
|
||||
"NIST P-384",
|
||||
"0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffe"
|
||||
"ffffffff0000000000000000ffffffff",
|
||||
"0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffe"
|
||||
"ffffffff0000000000000000fffffffc",
|
||||
"0xb3312fa7e23ee7e4988e056be3f82d19181d9c6efe8141120314088f5013875a"
|
||||
"c656398d8a2ed19d2a85c8edd3ec2aef",
|
||||
"0xffffffffffffffffffffffffffffffffffffffffffffffffc7634d81f4372ddf"
|
||||
"581a0db248b0a77aecec196accc52973",
|
||||
|
||||
"0xaa87ca22be8b05378eb1c71ef320ad746e1d3b628ba79b9859f741e082542a38"
|
||||
"5502f25dbf55296c3a545e3872760ab7",
|
||||
"0x3617de4a96262c6f5d9e98bf9292dc29f8f41dbd289a147ce9da3113b5f0b8c0"
|
||||
"0a60b1ce1d7e819d7a431d7c90ea0e5f",
|
||||
"0x01"
|
||||
},
|
||||
{
|
||||
"NIST P-521",
|
||||
"0x01ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
|
||||
"ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
|
||||
"0x01ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
|
||||
"fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc",
|
||||
"0x051953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8b489918ef10"
|
||||
"9e156193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef451fd46b503f00",
|
||||
"0x1fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
|
||||
"ffa51868783bf2f966b7fcc0148f709a5d03bb5c9b8899c47aebb6fb71e91386409",
|
||||
|
||||
"0xc6858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d3d"
|
||||
"baa14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd66",
|
||||
"0x11839296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e6"
|
||||
"62c97ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd16650",
|
||||
"0x01"
|
||||
},
|
||||
{
|
||||
"Ed25519",
|
||||
"0x7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFED",
|
||||
"0x7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEC",
|
||||
"0x52036CEE2B6FFE738CC740797779E89800700A4D4141D8AB75EB4DCA135978A3",
|
||||
"0x1000000000000000000000000000000014DEF9DEA2F79CD65812631A5CF5D3ED",
|
||||
"0x216936D3CD6E53FEC0A4E231FDD6DC5C692CC7609525A7B2C9562D608F25D51A",
|
||||
"0x6666666666666666666666666666666666666666666666666666666666666658",
|
||||
"0x08"
|
||||
},
|
||||
{ NULL, NULL, NULL, NULL, NULL, NULL }
|
||||
};
|
||||
|
||||
/* A sample public key for NIST P-256. */
|
||||
static const char sample_p256_q[] =
|
||||
"04"
|
||||
"42B927242237639A36CE9221B340DB1A9AB76DF2FE3E171277F6A4023DED146E"
|
||||
"E86525E38CCECFF3FB8D152CC6334F70D23A525175C1BCBDDE6E023B2228770E";
|
||||
static const char sample_p256_q_x[] =
|
||||
"42B927242237639A36CE9221B340DB1A9AB76DF2FE3E171277F6A4023DED146E";
|
||||
static const char sample_p256_q_y[] =
|
||||
"00E86525E38CCECFF3FB8D152CC6334F70D23A525175C1BCBDDE6E023B2228770E";
|
||||
|
||||
|
||||
/* A sample public key for Ed25519. */
|
||||
static const char sample_ed25519_q[] =
|
||||
"04"
|
||||
"55d0e09a2b9d34292297e08d60d0f620c513d47253187c24b12786bd777645ce"
|
||||
"1a5107f7681a02af2523a6daf372e10e3a0764c9d3fe4bd5b70ab18201985ad7";
|
||||
static const char sample_ed25519_q_x[] =
|
||||
"55d0e09a2b9d34292297e08d60d0f620c513d47253187c24b12786bd777645ce";
|
||||
static const char sample_ed25519_q_y[] =
|
||||
"1a5107f7681a02af2523a6daf372e10e3a0764c9d3fe4bd5b70ab18201985ad7";
|
||||
static const char sample_ed25519_q_eddsa[] =
|
||||
"d75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a";
|
||||
static const char sample_ed25519_d[] =
|
||||
"9d61b19deffd5a60ba844af492ec2cc44449c5697b326919703bac031cae7f60";
|
||||
|
||||
|
||||
static void
|
||||
print_mpi_2 (const char *text, const char *text2, gcry_mpi_t a)
|
||||
{
|
||||
gcry_error_t err;
|
||||
char *buf;
|
||||
void *bufaddr = &buf;
|
||||
|
||||
err = gcry_mpi_aprint (GCRYMPI_FMT_HEX, bufaddr, NULL, a);
|
||||
if (err)
|
||||
fprintf (stderr, "%s%s: [error printing number: %s]\n",
|
||||
text, text2? text2:"", gpg_strerror (err));
|
||||
else
|
||||
{
|
||||
fprintf (stderr, "%s%s: %s\n", text, text2? text2:"", buf);
|
||||
gcry_free (buf);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
static void
|
||||
print_mpi (const char *text, gcry_mpi_t a)
|
||||
{
|
||||
print_mpi_2 (text, NULL, a);
|
||||
}
|
||||
|
||||
|
||||
static void
|
||||
print_point (const char *text, gcry_mpi_point_t a)
|
||||
{
|
||||
gcry_mpi_t x, y, z;
|
||||
|
||||
x = gcry_mpi_new (0);
|
||||
y = gcry_mpi_new (0);
|
||||
z = gcry_mpi_new (0);
|
||||
gcry_mpi_point_get (x, y, z, a);
|
||||
print_mpi_2 (text, ".x", x);
|
||||
print_mpi_2 (text, ".y", y);
|
||||
print_mpi_2 (text, ".z", z);
|
||||
gcry_mpi_release (x);
|
||||
gcry_mpi_release (y);
|
||||
gcry_mpi_release (z);
|
||||
}
|
||||
|
||||
|
||||
static void
|
||||
print_sexp (const char *prefix, gcry_sexp_t a)
|
||||
{
|
||||
char *buf;
|
||||
size_t size;
|
||||
|
||||
if (prefix)
|
||||
fputs (prefix, stderr);
|
||||
size = gcry_sexp_sprint (a, GCRYSEXP_FMT_ADVANCED, NULL, 0);
|
||||
buf = gcry_xmalloc (size);
|
||||
|
||||
gcry_sexp_sprint (a, GCRYSEXP_FMT_ADVANCED, buf, size);
|
||||
fprintf (stderr, "%.*s", (int)size, buf);
|
||||
gcry_free (buf);
|
||||
}
|
||||
|
||||
|
||||
static gcry_mpi_t
|
||||
hex2mpi (const char *string)
|
||||
{
|
||||
gpg_error_t err;
|
||||
gcry_mpi_t val;
|
||||
|
||||
err = gcry_mpi_scan (&val, GCRYMPI_FMT_HEX, string, 0, NULL);
|
||||
if (err)
|
||||
die ("hex2mpi '%s' failed: %s\n", string, gpg_strerror (err));
|
||||
return val;
|
||||
}
|
||||
|
||||
|
||||
/* Convert STRING consisting of hex characters into its binary
|
||||
representation and return it as an allocated buffer. The valid
|
||||
length of the buffer is returned at R_LENGTH. The string is
|
||||
delimited by end of string. The function returns NULL on
|
||||
error. */
|
||||
static void *
|
||||
hex2buffer (const char *string, size_t *r_length)
|
||||
{
|
||||
const char *s;
|
||||
unsigned char *buffer;
|
||||
size_t length;
|
||||
|
||||
buffer = xmalloc (strlen(string)/2+1);
|
||||
length = 0;
|
||||
for (s=string; *s; s +=2 )
|
||||
{
|
||||
if (!hexdigitp (s) || !hexdigitp (s+1))
|
||||
return NULL; /* Invalid hex digits. */
|
||||
((unsigned char*)buffer)[length++] = xtoi_2 (s);
|
||||
}
|
||||
*r_length = length;
|
||||
return buffer;
|
||||
}
|
||||
|
||||
|
||||
static gcry_mpi_t
|
||||
hex2mpiopa (const char *string)
|
||||
{
|
||||
char *buffer;
|
||||
size_t buflen;
|
||||
gcry_mpi_t val;
|
||||
|
||||
buffer = hex2buffer (string, &buflen);
|
||||
if (!buffer)
|
||||
die ("hex2mpiopa '%s' failed: parser error\n", string);
|
||||
val = gcry_mpi_set_opaque (NULL, buffer, buflen*8);
|
||||
if (!buffer)
|
||||
die ("hex2mpiopa '%s' failed: set_opaque error\n", string);
|
||||
return val;
|
||||
}
|
||||
|
||||
|
||||
/* Compare A to B, where B is given as a hex string. */
|
||||
static int
|
||||
cmp_mpihex (gcry_mpi_t a, const char *b)
|
||||
{
|
||||
gcry_mpi_t bval;
|
||||
int res;
|
||||
|
||||
if (gcry_mpi_get_flag (a, GCRYMPI_FLAG_OPAQUE))
|
||||
bval = hex2mpiopa (b);
|
||||
else
|
||||
bval = hex2mpi (b);
|
||||
res = gcry_mpi_cmp (a, bval);
|
||||
gcry_mpi_release (bval);
|
||||
return res;
|
||||
}
|
||||
|
||||
|
||||
/* Wrapper to emulate the libgcrypt internal EC context allocation
|
||||
function. */
|
||||
static gpg_error_t
|
||||
ec_p_new (gcry_ctx_t *r_ctx, gcry_mpi_t p, gcry_mpi_t a)
|
||||
{
|
||||
gpg_error_t err;
|
||||
gcry_sexp_t sexp;
|
||||
|
||||
if (p && a)
|
||||
err = gcry_sexp_build (&sexp, NULL, "(ecdsa (p %m)(a %m))", p, a);
|
||||
else if (p)
|
||||
err = gcry_sexp_build (&sexp, NULL, "(ecdsa (p %m))", p);
|
||||
else if (a)
|
||||
err = gcry_sexp_build (&sexp, NULL, "(ecdsa (a %m))", a);
|
||||
else
|
||||
err = gcry_sexp_build (&sexp, NULL, "(ecdsa)");
|
||||
if (err)
|
||||
return err;
|
||||
err = gcry_mpi_ec_new (r_ctx, sexp, NULL);
|
||||
gcry_sexp_release (sexp);
|
||||
return err;
|
||||
}
|
||||
|
||||
|
||||
|
||||
static void
|
||||
set_get_point (void)
|
||||
{
|
||||
gcry_mpi_point_t point, point2;
|
||||
gcry_mpi_t x, y, z;
|
||||
|
||||
wherestr = "set_get_point";
|
||||
info ("checking point setting functions\n");
|
||||
|
||||
point = gcry_mpi_point_new (0);
|
||||
x = gcry_mpi_set_ui (NULL, 17);
|
||||
y = gcry_mpi_set_ui (NULL, 42);
|
||||
z = gcry_mpi_set_ui (NULL, 11371);
|
||||
gcry_mpi_point_get (x, y, z, point);
|
||||
if (gcry_mpi_cmp_ui (x, 0)
|
||||
|| gcry_mpi_cmp_ui (y, 0) || gcry_mpi_cmp_ui (z, 0))
|
||||
fail ("new point not initialized to (0,0,0)\n");
|
||||
gcry_mpi_point_snatch_get (x, y, z, point);
|
||||
point = NULL;
|
||||
if (gcry_mpi_cmp_ui (x, 0)
|
||||
|| gcry_mpi_cmp_ui (y, 0) || gcry_mpi_cmp_ui (z, 0))
|
||||
fail ("snatch_get failed\n");
|
||||
gcry_mpi_release (x);
|
||||
gcry_mpi_release (y);
|
||||
gcry_mpi_release (z);
|
||||
|
||||
point = gcry_mpi_point_new (0);
|
||||
x = gcry_mpi_set_ui (NULL, 17);
|
||||
y = gcry_mpi_set_ui (NULL, 42);
|
||||
z = gcry_mpi_set_ui (NULL, 11371);
|
||||
gcry_mpi_point_set (point, x, y, z);
|
||||
gcry_mpi_set_ui (x, 23);
|
||||
gcry_mpi_set_ui (y, 24);
|
||||
gcry_mpi_set_ui (z, 25);
|
||||
gcry_mpi_point_get (x, y, z, point);
|
||||
if (gcry_mpi_cmp_ui (x, 17)
|
||||
|| gcry_mpi_cmp_ui (y, 42) || gcry_mpi_cmp_ui (z, 11371))
|
||||
fail ("point_set/point_get failed\n");
|
||||
gcry_mpi_point_snatch_set (point, x, y, z);
|
||||
x = gcry_mpi_new (0);
|
||||
y = gcry_mpi_new (0);
|
||||
z = gcry_mpi_new (0);
|
||||
gcry_mpi_point_get (x, y, z, point);
|
||||
if (gcry_mpi_cmp_ui (x, 17)
|
||||
|| gcry_mpi_cmp_ui (y, 42) || gcry_mpi_cmp_ui (z, 11371))
|
||||
fail ("point_snatch_set/point_get failed\n");
|
||||
|
||||
point2 = gcry_mpi_point_copy (point);
|
||||
|
||||
gcry_mpi_point_get (x, y, z, point2);
|
||||
if (gcry_mpi_cmp_ui (x, 17)
|
||||
|| gcry_mpi_cmp_ui (y, 42) || gcry_mpi_cmp_ui (z, 11371))
|
||||
fail ("point_copy failed (1)\n");
|
||||
|
||||
gcry_mpi_point_release (point);
|
||||
|
||||
gcry_mpi_point_get (x, y, z, point2);
|
||||
if (gcry_mpi_cmp_ui (x, 17)
|
||||
|| gcry_mpi_cmp_ui (y, 42) || gcry_mpi_cmp_ui (z, 11371))
|
||||
fail ("point_copy failed (2)\n");
|
||||
|
||||
gcry_mpi_point_release (point2);
|
||||
|
||||
gcry_mpi_release (x);
|
||||
gcry_mpi_release (y);
|
||||
gcry_mpi_release (z);
|
||||
}
|
||||
|
||||
|
||||
static void
|
||||
context_alloc (void)
|
||||
{
|
||||
gpg_error_t err;
|
||||
gcry_ctx_t ctx;
|
||||
gcry_mpi_t p, a;
|
||||
|
||||
wherestr = "context_alloc";
|
||||
info ("checking context functions\n");
|
||||
|
||||
p = gcry_mpi_set_ui (NULL, 1);
|
||||
a = gcry_mpi_set_ui (NULL, 1);
|
||||
err = ec_p_new (&ctx, p, a);
|
||||
if (err)
|
||||
die ("ec_p_new returned an error: %s\n", gpg_strerror (err));
|
||||
gcry_mpi_release (p);
|
||||
gcry_mpi_release (a);
|
||||
gcry_ctx_release (ctx);
|
||||
|
||||
p = NULL;
|
||||
a = gcry_mpi_set_ui (NULL, 0);
|
||||
|
||||
err = ec_p_new (&ctx, p, a);
|
||||
if (!err || gpg_err_code (err) != GPG_ERR_EINVAL)
|
||||
fail ("ec_p_new: bad parameter detection failed (1)\n");
|
||||
|
||||
gcry_mpi_release (a);
|
||||
a = NULL;
|
||||
err = ec_p_new (&ctx, p, a);
|
||||
if (!err || gpg_err_code (err) != GPG_ERR_EINVAL)
|
||||
fail ("ec_p_new: bad parameter detection failed (2)\n");
|
||||
|
||||
}
|
||||
|
||||
|
||||
static int
|
||||
get_and_cmp_mpi (const char *name, const char *mpistring, const char *desc,
|
||||
gcry_ctx_t ctx)
|
||||
{
|
||||
gcry_mpi_t mpi;
|
||||
|
||||
mpi = gcry_mpi_ec_get_mpi (name, ctx, 1);
|
||||
if (!mpi)
|
||||
{
|
||||
fail ("error getting parameter '%s' of curve '%s'\n", name, desc);
|
||||
return 1;
|
||||
}
|
||||
if (debug)
|
||||
print_mpi (name, mpi);
|
||||
if (cmp_mpihex (mpi, mpistring))
|
||||
{
|
||||
fail ("parameter '%s' of curve '%s' does not match\n", name, desc);
|
||||
gcry_mpi_release (mpi);
|
||||
return 1;
|
||||
}
|
||||
gcry_mpi_release (mpi);
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
static int
|
||||
get_and_cmp_point (const char *name,
|
||||
const char *mpi_x_string, const char *mpi_y_string,
|
||||
const char *desc, gcry_ctx_t ctx)
|
||||
{
|
||||
gcry_mpi_point_t point;
|
||||
gcry_mpi_t x, y, z;
|
||||
int result = 0;
|
||||
|
||||
point = gcry_mpi_ec_get_point (name, ctx, 1);
|
||||
if (!point)
|
||||
{
|
||||
fail ("error getting point parameter '%s' of curve '%s'\n", name, desc);
|
||||
return 1;
|
||||
}
|
||||
if (debug)
|
||||
print_point (name, point);
|
||||
|
||||
x = gcry_mpi_new (0);
|
||||
y = gcry_mpi_new (0);
|
||||
z = gcry_mpi_new (0);
|
||||
gcry_mpi_point_snatch_get (x, y, z, point);
|
||||
if (cmp_mpihex (x, mpi_x_string))
|
||||
{
|
||||
fail ("x coordinate of '%s' of curve '%s' does not match\n", name, desc);
|
||||
result = 1;
|
||||
}
|
||||
if (cmp_mpihex (y, mpi_y_string))
|
||||
{
|
||||
fail ("y coordinate of '%s' of curve '%s' does not match\n", name, desc);
|
||||
result = 1;
|
||||
}
|
||||
if (cmp_mpihex (z, "01"))
|
||||
{
|
||||
fail ("z coordinate of '%s' of curve '%s' is not 1\n", name, desc);
|
||||
result = 1;
|
||||
}
|
||||
gcry_mpi_release (x);
|
||||
gcry_mpi_release (y);
|
||||
gcry_mpi_release (z);
|
||||
return result;
|
||||
}
|
||||
|
||||
|
||||
static void
|
||||
context_param (void)
|
||||
{
|
||||
gpg_error_t err;
|
||||
int idx;
|
||||
gcry_ctx_t ctx = NULL;
|
||||
gcry_mpi_t q, d;
|
||||
gcry_sexp_t keyparam;
|
||||
|
||||
wherestr = "context_param";
|
||||
|
||||
info ("checking standard curves\n");
|
||||
for (idx=0; test_curve[idx].desc; idx++)
|
||||
{
|
||||
/* P-192 and Ed25519 are not supported in fips mode */
|
||||
if (gcry_fips_mode_active())
|
||||
{
|
||||
if (!strcmp(test_curve[idx].desc, "NIST P-192")
|
||||
|| !strcmp(test_curve[idx].desc, "Ed25519"))
|
||||
{
|
||||
info ("skipping %s in fips mode\n", test_curve[idx].desc );
|
||||
continue;
|
||||
}
|
||||
}
|
||||
|
||||
gcry_ctx_release (ctx);
|
||||
err = gcry_mpi_ec_new (&ctx, NULL, test_curve[idx].desc);
|
||||
if (err)
|
||||
{
|
||||
fail ("can't create context for curve '%s': %s\n",
|
||||
test_curve[idx].desc, gpg_strerror (err));
|
||||
continue;
|
||||
}
|
||||
if (get_and_cmp_mpi ("p", test_curve[idx].p, test_curve[idx].desc, ctx))
|
||||
continue;
|
||||
if (get_and_cmp_mpi ("a", test_curve[idx].a, test_curve[idx].desc, ctx))
|
||||
continue;
|
||||
if (get_and_cmp_mpi ("b", test_curve[idx].b, test_curve[idx].desc, ctx))
|
||||
continue;
|
||||
if (get_and_cmp_mpi ("g.x",test_curve[idx].g_x, test_curve[idx].desc,ctx))
|
||||
continue;
|
||||
if (get_and_cmp_mpi ("g.y",test_curve[idx].g_y, test_curve[idx].desc,ctx))
|
||||
continue;
|
||||
if (get_and_cmp_mpi ("n", test_curve[idx].n, test_curve[idx].desc, ctx))
|
||||
continue;
|
||||
if (get_and_cmp_point ("g", test_curve[idx].g_x, test_curve[idx].g_y,
|
||||
test_curve[idx].desc, ctx))
|
||||
continue;
|
||||
if (get_and_cmp_mpi ("h", test_curve[idx].h, test_curve[idx].desc, ctx))
|
||||
continue;
|
||||
|
||||
}
|
||||
|
||||
info ("checking sample public key (nistp256)\n");
|
||||
q = hex2mpi (sample_p256_q);
|
||||
err = gcry_sexp_build (&keyparam, NULL,
|
||||
"(public-key(ecc(curve %s)(q %m)))",
|
||||
"NIST P-256", q);
|
||||
if (err)
|
||||
die ("gcry_sexp_build failed: %s\n", gpg_strerror (err));
|
||||
gcry_mpi_release (q);
|
||||
|
||||
/* We can't call gcry_pk_testkey because it is only implemented for
|
||||
private keys. */
|
||||
/* err = gcry_pk_testkey (keyparam); */
|
||||
/* if (err) */
|
||||
/* fail ("gcry_pk_testkey failed for sample public key: %s\n", */
|
||||
/* gpg_strerror (err)); */
|
||||
|
||||
gcry_ctx_release (ctx);
|
||||
err = gcry_mpi_ec_new (&ctx, keyparam, NULL);
|
||||
if (err)
|
||||
fail ("gcry_mpi_ec_new failed for sample public key (nistp256): %s\n",
|
||||
gpg_strerror (err));
|
||||
else
|
||||
{
|
||||
gcry_sexp_t sexp;
|
||||
|
||||
get_and_cmp_mpi ("q", sample_p256_q, "nistp256", ctx);
|
||||
get_and_cmp_point ("q", sample_p256_q_x, sample_p256_q_y, "nistp256",
|
||||
ctx);
|
||||
|
||||
/* Delete Q. */
|
||||
err = gcry_mpi_ec_set_mpi ("q", NULL, ctx);
|
||||
if (err)
|
||||
fail ("clearing Q for nistp256 failed: %s\n", gpg_strerror (err));
|
||||
if (gcry_mpi_ec_get_mpi ("q", ctx, 0))
|
||||
fail ("clearing Q for nistp256 did not work\n");
|
||||
|
||||
/* Set Q again. */
|
||||
q = hex2mpi (sample_p256_q);
|
||||
err = gcry_mpi_ec_set_mpi ("q", q, ctx);
|
||||
if (err)
|
||||
fail ("setting Q for nistp256 failed: %s\n", gpg_strerror (err));
|
||||
get_and_cmp_mpi ("q", sample_p256_q, "nistp256(2)", ctx);
|
||||
gcry_mpi_release (q);
|
||||
|
||||
/* Get as s-expression. */
|
||||
err = gcry_pubkey_get_sexp (&sexp, 0, ctx);
|
||||
if (err)
|
||||
fail ("gcry_pubkey_get_sexp(0) failed: %s\n", gpg_strerror (err));
|
||||
else if (debug)
|
||||
print_sexp ("Result of gcry_pubkey_get_sexp (0):\n", sexp);
|
||||
gcry_sexp_release (sexp);
|
||||
|
||||
err = gcry_pubkey_get_sexp (&sexp, GCRY_PK_GET_PUBKEY, ctx);
|
||||
if (err)
|
||||
fail ("gcry_pubkey_get_sexp(GET_PUBKEY) failed: %s\n",
|
||||
gpg_strerror (err));
|
||||
else if (debug)
|
||||
print_sexp ("Result of gcry_pubkey_get_sexp (GET_PUBKEY):\n", sexp);
|
||||
gcry_sexp_release (sexp);
|
||||
|
||||
err = gcry_pubkey_get_sexp (&sexp, GCRY_PK_GET_SECKEY, ctx);
|
||||
if (gpg_err_code (err) != GPG_ERR_NO_SECKEY)
|
||||
fail ("gcry_pubkey_get_sexp(GET_SECKEY) returned wrong error: %s\n",
|
||||
gpg_strerror (err));
|
||||
gcry_sexp_release (sexp);
|
||||
}
|
||||
|
||||
/* Skipping Ed25519 if in FIPS mode (it isn't supported) */
|
||||
if (gcry_fips_mode_active())
|
||||
goto cleanup;
|
||||
|
||||
info ("checking sample public key (Ed25519)\n");
|
||||
q = hex2mpi (sample_ed25519_q);
|
||||
gcry_sexp_release (keyparam);
|
||||
err = gcry_sexp_build (&keyparam, NULL,
|
||||
"(public-key(ecc(curve %s)(flags eddsa)(q %m)))",
|
||||
"Ed25519", q);
|
||||
if (err)
|
||||
die ("gcry_sexp_build failed: %s\n", gpg_strerror (err));
|
||||
gcry_mpi_release (q);
|
||||
|
||||
/* We can't call gcry_pk_testkey because it is only implemented for
|
||||
private keys. */
|
||||
/* err = gcry_pk_testkey (keyparam); */
|
||||
/* if (err) */
|
||||
/* fail ("gcry_pk_testkey failed for sample public key: %s\n", */
|
||||
/* gpg_strerror (err)); */
|
||||
|
||||
gcry_ctx_release (ctx);
|
||||
err = gcry_mpi_ec_new (&ctx, keyparam, NULL);
|
||||
if (err)
|
||||
fail ("gcry_mpi_ec_new failed for sample public key: %s\n",
|
||||
gpg_strerror (err));
|
||||
else
|
||||
{
|
||||
gcry_sexp_t sexp;
|
||||
|
||||
get_and_cmp_mpi ("q", sample_ed25519_q, "Ed25519", ctx);
|
||||
get_and_cmp_point ("q", sample_ed25519_q_x, sample_ed25519_q_y,
|
||||
"Ed25519", ctx);
|
||||
get_and_cmp_mpi ("q@eddsa", sample_ed25519_q_eddsa, "Ed25519", ctx);
|
||||
|
||||
/* Set d to see whether Q is correctly re-computed. */
|
||||
d = hex2mpi (sample_ed25519_d);
|
||||
err = gcry_mpi_ec_set_mpi ("d", d, ctx);
|
||||
if (err)
|
||||
fail ("setting d for Ed25519 failed: %s\n", gpg_strerror (err));
|
||||
gcry_mpi_release (d);
|
||||
get_and_cmp_mpi ("q", sample_ed25519_q, "Ed25519(recompute Q)", ctx);
|
||||
|
||||
/* Delete Q by setting d and then clearing d. The clearing is
|
||||
required so that we can check whether Q has been cleared and
|
||||
because further tests only expect a public key. */
|
||||
d = hex2mpi (sample_ed25519_d);
|
||||
err = gcry_mpi_ec_set_mpi ("d", d, ctx);
|
||||
if (err)
|
||||
fail ("setting d for Ed25519 failed: %s\n", gpg_strerror (err));
|
||||
gcry_mpi_release (d);
|
||||
err = gcry_mpi_ec_set_mpi ("d", NULL, ctx);
|
||||
if (err)
|
||||
fail ("setting d for Ed25519 failed(2): %s\n", gpg_strerror (err));
|
||||
if (gcry_mpi_ec_get_mpi ("q", ctx, 0))
|
||||
fail ("setting d for Ed25519 did not reset Q\n");
|
||||
|
||||
/* Set Q again. We need to use an opaque MPI here because
|
||||
sample_ed25519_q is in uncompressed format which can only be
|
||||
auto-detected if passed opaque. */
|
||||
q = hex2mpiopa (sample_ed25519_q);
|
||||
err = gcry_mpi_ec_set_mpi ("q", q, ctx);
|
||||
if (err)
|
||||
fail ("setting Q for Ed25519 failed: %s\n", gpg_strerror (err));
|
||||
gcry_mpi_release (q);
|
||||
get_and_cmp_mpi ("q", sample_ed25519_q, "Ed25519(2)", ctx);
|
||||
|
||||
/* Get as s-expression. */
|
||||
err = gcry_pubkey_get_sexp (&sexp, 0, ctx);
|
||||
if (err)
|
||||
fail ("gcry_pubkey_get_sexp(0) failed: %s\n", gpg_strerror (err));
|
||||
else if (debug)
|
||||
print_sexp ("Result of gcry_pubkey_get_sexp (0):\n", sexp);
|
||||
gcry_sexp_release (sexp);
|
||||
|
||||
err = gcry_pubkey_get_sexp (&sexp, GCRY_PK_GET_PUBKEY, ctx);
|
||||
if (err)
|
||||
fail ("gcry_pubkey_get_sexp(GET_PUBKEY) failed: %s\n",
|
||||
gpg_strerror (err));
|
||||
else if (debug)
|
||||
print_sexp ("Result of gcry_pubkey_get_sexp (GET_PUBKEY):\n", sexp);
|
||||
gcry_sexp_release (sexp);
|
||||
|
||||
err = gcry_pubkey_get_sexp (&sexp, GCRY_PK_GET_SECKEY, ctx);
|
||||
if (gpg_err_code (err) != GPG_ERR_NO_SECKEY)
|
||||
fail ("gcry_pubkey_get_sexp(GET_SECKEY) returned wrong error: %s\n",
|
||||
gpg_strerror (err));
|
||||
gcry_sexp_release (sexp);
|
||||
|
||||
}
|
||||
|
||||
cleanup:
|
||||
gcry_ctx_release (ctx);
|
||||
gcry_sexp_release (keyparam);
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
/* Create a new point from (X,Y,Z) given as hex strings. */
|
||||
gcry_mpi_point_t
|
||||
make_point (const char *x, const char *y, const char *z)
|
||||
{
|
||||
gcry_mpi_point_t point;
|
||||
|
||||
point = gcry_mpi_point_new (0);
|
||||
gcry_mpi_point_snatch_set (point, hex2mpi (x), hex2mpi (y), hex2mpi (z));
|
||||
|
||||
return point;
|
||||
}
|
||||
|
||||
|
||||
/* This tests checks that the low-level EC API yields the same result
|
||||
as using the high level API. The values have been taken from a
|
||||
test run using the high level API. */
|
||||
static void
|
||||
basic_ec_math (void)
|
||||
{
|
||||
gpg_error_t err;
|
||||
gcry_ctx_t ctx;
|
||||
gcry_mpi_t P, A;
|
||||
gcry_mpi_point_t G, Q;
|
||||
gcry_mpi_t d;
|
||||
gcry_mpi_t x, y, z;
|
||||
|
||||
wherestr = "basic_ec_math";
|
||||
info ("checking basic math functions for EC\n");
|
||||
|
||||
P = hex2mpi ("0xfffffffffffffffffffffffffffffffeffffffffffffffff");
|
||||
A = hex2mpi ("0xfffffffffffffffffffffffffffffffefffffffffffffffc");
|
||||
G = make_point ("188DA80EB03090F67CBF20EB43A18800F4FF0AFD82FF1012",
|
||||
"7192B95FFC8DA78631011ED6B24CDD573F977A11E794811",
|
||||
"1");
|
||||
d = hex2mpi ("D4EF27E32F8AD8E2A1C6DDEBB1D235A69E3CEF9BCE90273D");
|
||||
Q = gcry_mpi_point_new (0);
|
||||
|
||||
err = ec_p_new (&ctx, P, A);
|
||||
if (err)
|
||||
die ("ec_p_new failed: %s\n", gpg_strerror (err));
|
||||
|
||||
x = gcry_mpi_new (0);
|
||||
y = gcry_mpi_new (0);
|
||||
z = gcry_mpi_new (0);
|
||||
|
||||
{
|
||||
/* A quick check that multiply by zero works. */
|
||||
gcry_mpi_t tmp;
|
||||
|
||||
tmp = gcry_mpi_new (0);
|
||||
gcry_mpi_ec_mul (Q, tmp, G, ctx);
|
||||
gcry_mpi_release (tmp);
|
||||
gcry_mpi_point_get (x, y, z, Q);
|
||||
if (gcry_mpi_cmp_ui (x, 0) || gcry_mpi_cmp_ui (y, 0)
|
||||
|| gcry_mpi_cmp_ui (z, 0))
|
||||
fail ("multiply a point by zero failed\n");
|
||||
}
|
||||
|
||||
gcry_mpi_ec_mul (Q, d, G, ctx);
|
||||
gcry_mpi_point_get (x, y, z, Q);
|
||||
if (cmp_mpihex (x, "222D9EC717C89D047E0898C9185B033CD11C0A981EE6DC66")
|
||||
|| cmp_mpihex (y, "605DE0A82D70D3E0F84A127D0739ED33D657DF0D054BFDE8")
|
||||
|| cmp_mpihex (z, "00B06B519071BC536999AC8F2D3934B3C1FC9EACCD0A31F88F"))
|
||||
fail ("computed public key does not match\n");
|
||||
if (debug)
|
||||
{
|
||||
print_mpi ("Q.x", x);
|
||||
print_mpi ("Q.y", y);
|
||||
print_mpi ("Q.z", z);
|
||||
}
|
||||
|
||||
if (gcry_mpi_ec_get_affine (x, y, Q, ctx))
|
||||
fail ("failed to get affine coordinates\n");
|
||||
if (cmp_mpihex (x, "008532093BA023F4D55C0424FA3AF9367E05F309DC34CDC3FE")
|
||||
|| cmp_mpihex (y, "00C13CA9E617C6C8487BFF6A726E3C4F277913D97117939966"))
|
||||
fail ("computed affine coordinates of public key do not match\n");
|
||||
if (debug)
|
||||
{
|
||||
print_mpi ("q.x", x);
|
||||
print_mpi ("q.y", y);
|
||||
}
|
||||
|
||||
gcry_mpi_release (z);
|
||||
gcry_mpi_release (y);
|
||||
gcry_mpi_release (x);
|
||||
gcry_mpi_point_release (Q);
|
||||
gcry_mpi_release (d);
|
||||
gcry_mpi_point_release (G);
|
||||
gcry_mpi_release (A);
|
||||
gcry_mpi_release (P);
|
||||
gcry_ctx_release (ctx);
|
||||
}
|
||||
|
||||
|
||||
/* This is the same as basic_ec_math but uses more advanced
|
||||
features. */
|
||||
static void
|
||||
basic_ec_math_simplified (void)
|
||||
{
|
||||
}
|
||||
|
||||
|
||||
/* Check the math used with Twisted Edwards curves. */
|
||||
static void
|
||||
twistededwards_math (void)
|
||||
{
|
||||
gpg_error_t err;
|
||||
gcry_ctx_t ctx;
|
||||
gcry_mpi_point_t G, Q;
|
||||
gcry_mpi_t k;
|
||||
gcry_mpi_t w, a, x, y, z, p, n, b, I;
|
||||
|
||||
wherestr = "twistededwards_math";
|
||||
info ("checking basic Twisted Edwards math\n");
|
||||
|
||||
err = gcry_mpi_ec_new (&ctx, NULL, "Ed25519");
|
||||
if (err)
|
||||
die ("gcry_mpi_ec_new failed: %s\n", gpg_strerror (err));
|
||||
|
||||
k = hex2mpi
|
||||
("2D3501E723239632802454EE5DDC406EFB0BDF18486A5BDE9C0390A9C2984004"
|
||||
"F47252B628C953625B8DEB5DBCB8DA97AA43A1892D11FA83596F42E0D89CB1B6");
|
||||
G = gcry_mpi_ec_get_point ("g", ctx, 1);
|
||||
if (!G)
|
||||
die ("gcry_mpi_ec_get_point(G) failed\n");
|
||||
Q = gcry_mpi_point_new (0);
|
||||
|
||||
|
||||
w = gcry_mpi_new (0);
|
||||
a = gcry_mpi_new (0);
|
||||
x = gcry_mpi_new (0);
|
||||
y = gcry_mpi_new (0);
|
||||
z = gcry_mpi_new (0);
|
||||
I = gcry_mpi_new (0);
|
||||
p = gcry_mpi_ec_get_mpi ("p", ctx, 1);
|
||||
n = gcry_mpi_ec_get_mpi ("n", ctx, 1);
|
||||
b = gcry_mpi_ec_get_mpi ("b", ctx, 1);
|
||||
|
||||
/* Check: 2^{p-1} mod p == 1 */
|
||||
gcry_mpi_sub_ui (a, p, 1);
|
||||
gcry_mpi_powm (w, GCRYMPI_CONST_TWO, a, p);
|
||||
if (gcry_mpi_cmp_ui (w, 1))
|
||||
fail ("failed assertion: 2^{p-1} mod p == 1\n");
|
||||
|
||||
/* Check: p % 4 == 1 */
|
||||
gcry_mpi_mod (w, p, GCRYMPI_CONST_FOUR);
|
||||
if (gcry_mpi_cmp_ui (w, 1))
|
||||
fail ("failed assertion: p %% 4 == 1\n");
|
||||
|
||||
/* Check: 2^{n-1} mod n == 1 */
|
||||
gcry_mpi_sub_ui (a, n, 1);
|
||||
gcry_mpi_powm (w, GCRYMPI_CONST_TWO, a, n);
|
||||
if (gcry_mpi_cmp_ui (w, 1))
|
||||
fail ("failed assertion: 2^{n-1} mod n == 1\n");
|
||||
|
||||
/* Check: b^{(p-1)/2} mod p == p-1 */
|
||||
gcry_mpi_sub_ui (a, p, 1);
|
||||
gcry_mpi_div (x, NULL, a, GCRYMPI_CONST_TWO, -1);
|
||||
gcry_mpi_powm (w, b, x, p);
|
||||
gcry_mpi_abs (w);
|
||||
if (gcry_mpi_cmp (w, a))
|
||||
fail ("failed assertion: b^{(p-1)/2} mod p == p-1\n");
|
||||
|
||||
/* I := 2^{(p-1)/4} mod p */
|
||||
gcry_mpi_sub_ui (a, p, 1);
|
||||
gcry_mpi_div (x, NULL, a, GCRYMPI_CONST_FOUR, -1);
|
||||
gcry_mpi_powm (I, GCRYMPI_CONST_TWO, x, p);
|
||||
|
||||
/* Check: I^2 mod p == p-1 */
|
||||
gcry_mpi_powm (w, I, GCRYMPI_CONST_TWO, p);
|
||||
if (gcry_mpi_cmp (w, a))
|
||||
fail ("failed assertion: I^2 mod p == p-1\n");
|
||||
|
||||
/* Check: G is on the curve */
|
||||
if (!gcry_mpi_ec_curve_point (G, ctx))
|
||||
fail ("failed assertion: G is on the curve\n");
|
||||
|
||||
/* Check: nG == (0,1) */
|
||||
gcry_mpi_ec_mul (Q, n, G, ctx);
|
||||
if (gcry_mpi_ec_get_affine (x, y, Q, ctx))
|
||||
fail ("failed to get affine coordinates\n");
|
||||
if (gcry_mpi_cmp_ui (x, 0) || gcry_mpi_cmp_ui (y, 1))
|
||||
fail ("failed assertion: nG == (0,1)\n");
|
||||
|
||||
/* Now two arbitrary point operations taken from the ed25519.py
|
||||
sample data. */
|
||||
gcry_mpi_release (a);
|
||||
a = hex2mpi
|
||||
("4f71d012df3c371af3ea4dc38385ca5bb7272f90cb1b008b3ed601c76de1d496"
|
||||
"e30cbf625f0a756a678d8f256d5325595cccc83466f36db18f0178eb9925edd3");
|
||||
gcry_mpi_ec_mul (Q, a, G, ctx);
|
||||
if (gcry_mpi_ec_get_affine (x, y, Q, ctx))
|
||||
fail ("failed to get affine coordinates\n");
|
||||
if (cmp_mpihex (x, ("157f7361c577aad36f67ed33e38dc7be"
|
||||
"00014fecc2165ca5cee9eee19fe4d2c1"))
|
||||
|| cmp_mpihex (y, ("5a69dbeb232276b38f3f5016547bb2a2"
|
||||
"4025645f0b820e72b8cad4f0a909a092")))
|
||||
{
|
||||
fail ("sample point multiply failed:\n");
|
||||
print_mpi ("r", a);
|
||||
print_mpi ("Rx", x);
|
||||
print_mpi ("Ry", y);
|
||||
}
|
||||
|
||||
gcry_mpi_release (a);
|
||||
a = hex2mpi
|
||||
("2d3501e723239632802454ee5ddc406efb0bdf18486a5bde9c0390a9c2984004"
|
||||
"f47252b628c953625b8deb5dbcb8da97aa43a1892d11fa83596f42e0d89cb1b6");
|
||||
gcry_mpi_ec_mul (Q, a, G, ctx);
|
||||
if (gcry_mpi_ec_get_affine (x, y, Q, ctx))
|
||||
fail ("failed to get affine coordinates\n");
|
||||
if (cmp_mpihex (x, ("6218e309d40065fcc338b3127f468371"
|
||||
"82324bd01ce6f3cf81ab44e62959c82a"))
|
||||
|| cmp_mpihex (y, ("5501492265e073d874d9e5b81e7f8784"
|
||||
"8a826e80cce2869072ac60c3004356e5")))
|
||||
{
|
||||
fail ("sample point multiply failed:\n");
|
||||
print_mpi ("r", a);
|
||||
print_mpi ("Rx", x);
|
||||
print_mpi ("Ry", y);
|
||||
}
|
||||
|
||||
|
||||
gcry_mpi_release (I);
|
||||
gcry_mpi_release (b);
|
||||
gcry_mpi_release (n);
|
||||
gcry_mpi_release (p);
|
||||
gcry_mpi_release (w);
|
||||
gcry_mpi_release (a);
|
||||
gcry_mpi_release (x);
|
||||
gcry_mpi_release (y);
|
||||
gcry_mpi_release (z);
|
||||
gcry_mpi_point_release (Q);
|
||||
gcry_mpi_point_release (G);
|
||||
gcry_mpi_release (k);
|
||||
gcry_ctx_release (ctx);
|
||||
}
|
||||
|
||||
|
||||
int
|
||||
main (int argc, char **argv)
|
||||
{
|
||||
|
||||
if (argc > 1 && !strcmp (argv[1], "--verbose"))
|
||||
verbose = 1;
|
||||
else if (argc > 1 && !strcmp (argv[1], "--debug"))
|
||||
verbose = debug = 1;
|
||||
|
||||
if (!gcry_check_version (GCRYPT_VERSION))
|
||||
die ("version mismatch\n");
|
||||
|
||||
xgcry_control (GCRYCTL_DISABLE_SECMEM, 0);
|
||||
xgcry_control (GCRYCTL_ENABLE_QUICK_RANDOM, 0);
|
||||
if (debug)
|
||||
xgcry_control (GCRYCTL_SET_DEBUG_FLAGS, 1u, 0);
|
||||
xgcry_control (GCRYCTL_INITIALIZATION_FINISHED, 0);
|
||||
|
||||
set_get_point ();
|
||||
context_alloc ();
|
||||
context_param ();
|
||||
basic_ec_math ();
|
||||
|
||||
/* The tests are for P-192 and ed25519 which are not supported in
|
||||
FIPS mode. */
|
||||
if (!gcry_fips_mode_active())
|
||||
{
|
||||
basic_ec_math_simplified ();
|
||||
twistededwards_math ();
|
||||
}
|
||||
|
||||
info ("All tests completed. Errors: %d\n", error_count);
|
||||
return error_count ? 1 : 0;
|
||||
}
|
||||
|
|
@ -57,17 +57,13 @@ $(METADATA): Makefile
|
|||
@echo "Requires: libgcrypt" >> $(METADATA)
|
||||
@echo "Requires: nfs-utils" >> $(METADATA)
|
||||
@echo "Requires: rpm-build" >> $(METADATA)
|
||||
@echo "Requires: autoconf automake libtool" >> $(METADATA)
|
||||
@echo "Requires: gawk" >> $(METADATA)
|
||||
@echo "Requires: gcc-c++" >> $(METADATA)
|
||||
@echo "Requires: libgpg-error-devel" >> $(METADATA)
|
||||
@echo "Requires: pkgconfig texinfo fipscheck libkcapi-fipscheck" >> $(METADATA)
|
||||
@echo "Requires: crypto-policies-scripts" >> $(METADATA)
|
||||
@echo "Requires: bc" >> $(METADATA)
|
||||
@echo "RhtsRequires: library(distribution/fips)" >> $(METADATA)
|
||||
@echo "Requires: gcc-c++ fipscheck" >> $(METADATA)
|
||||
@echo "Requires: libgpg-error-devel yum-utils wget" >> $(METADATA)
|
||||
@echo "Requires: pkgconfig texinfo libselinux-utils" >> $(METADATA)
|
||||
@echo "Releases: -RHEL3 -RHEL4" >> $(METADATA)
|
||||
@echo "Priority: Normal" >> $(METADATA)
|
||||
@echo "Architectures: i386 x86_64 s390x ia64" >> $(METADATA)
|
||||
@echo "Architectures: i386 x86_64 s390x ia64" >> $(METADATA)
|
||||
@echo "License: GPLv2" >> $(METADATA)
|
||||
@echo "Confidential: no" >> $(METADATA)
|
||||
@echo "Destructive: no" >> $(METADATA)
|
||||
|
|
|
|||
|
|
@ -1,25 +0,0 @@
|
|||
summary: Test calls upstream test suite.
|
||||
test: ./runtest.sh
|
||||
enabled: true
|
||||
framework: beakerlib
|
||||
require:
|
||||
- library(distribution/fips)
|
||||
recommend:
|
||||
- libgcrypt
|
||||
- nfs-utils
|
||||
- rpm-build
|
||||
- autoconf
|
||||
- automake
|
||||
- libtool
|
||||
- gawk
|
||||
- gcc-c++
|
||||
- libgpg-error-devel
|
||||
- pkgconfig
|
||||
- texinfo
|
||||
- fipscheck
|
||||
- libkcapi-fipscheck
|
||||
- crypto-policies-scripts
|
||||
- bc
|
||||
- annobin-annocheck
|
||||
- gnupg2
|
||||
duration: 45m
|
||||
|
|
@ -26,6 +26,8 @@
|
|||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
# Include rhts environment
|
||||
#. /usr/bin/rhts-environment.sh
|
||||
. /usr/share/beakerlib/beakerlib.sh
|
||||
|
||||
PACKAGE="libgcrypt"
|
||||
|
|
@ -33,112 +35,36 @@ PACKAGE="libgcrypt"
|
|||
rlJournalStart
|
||||
|
||||
rlPhaseStartSetup
|
||||
rlImport distribution/fips || rlFail "FIPS library needed for some phases"
|
||||
TmpDir=`mktemp -d`
|
||||
rlAssertRpm $PACKAGE
|
||||
rlRun "rlFileBackup --clean /etc/gcrypt/fips_enabled"
|
||||
if [[ -r /etc/gcrypt/hwf.deny ]]; then
|
||||
rlRun "rlFileBackup /etc/gcrypt/hwf.deny"
|
||||
rlRun "rm -f /etc/gcrypt/hwf.deny"
|
||||
fi
|
||||
rlFileBackup --clean "/etc/gcrypt/fips_enabled"
|
||||
rlRun "pushd $TmpDir" 0
|
||||
rlRun "rlFetchSrcForInstalled $PACKAGE"
|
||||
rlFetchSrcForInstalled $PACKAGE
|
||||
rlRun "rpm -ihv `ls *.rpm`" 0
|
||||
if grep '1' /proc/sys/crypto/fips_enabled; then
|
||||
rlRun "echo '1' > /etc/gcrypt/fips_enabled" 0
|
||||
fi
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartTest "Package build"
|
||||
rlPhaseStartTest
|
||||
TOPDIR=`rpm --eval %_topdir`
|
||||
rlRun "pushd $TOPDIR" 0
|
||||
rlRun "rm -rf BUILD/libgcrypt-*" 0-255
|
||||
rlRun "rpmbuild -vv -bc SPECS/libgcrypt.spec" 0
|
||||
libgcrypt_dir="libgcrypt-`rpm -q --qf "%{VERSION}\n" libgcrypt | head -1`"
|
||||
if [ -d "BUILD/$libgcrypt_dir-build" ]; then
|
||||
BUILDDIR="BUILD/$libgcrypt_dir-build/$libgcrypt_dir"
|
||||
else
|
||||
BUILDDIR="BUILD/$libgcrypt_dir"
|
||||
fi
|
||||
rlRun "pushd $BUILDDIR" 0
|
||||
rlRun "pushd BUILD/libgcrypt-*" 0
|
||||
rlRun "fipshmac src/.libs/libgcrypt.so.??" 0
|
||||
rlRun "popd"
|
||||
rlRun "popd"
|
||||
rlRun "make check > $TmpDir/make_check.out" 0
|
||||
rlRun "popd" 0
|
||||
rlRun "popd" 0
|
||||
rlRun "grep \"All [0-9]\+ tests passed\" $TmpDir/make_check.out" 0 \
|
||||
"All tests passed"
|
||||
rlRun "cat $TmpDir/make_check.out" 0
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartTest "Upstream testsuite"
|
||||
rlRun "pushd $TOPDIR/$BUILDDIR" 0
|
||||
exp_fails=()
|
||||
|
||||
rlRun "echo 'Expecting ${#exp_fails[@]} fails'"
|
||||
exp_exitcode=0
|
||||
if [[ ${#exp_fails[@]} -gt 0 ]]; then exp_exitcode=2; fi
|
||||
rlRun "make check &> $TmpDir/make_check.out" $exp_exitcode
|
||||
rlRun "grep ^FAIL: $TmpDir/make_check.out" 0,1 "Print fails"
|
||||
if [[ ${#exp_fails[@]} -gt 0 ]]; then
|
||||
for f in $(grep '^FAIL:' $TmpDir/make_check.out | awk -F ': ' '{print $2}'); do
|
||||
if [[ "${exp_fails[@]}" =~ "$f" ]]; then
|
||||
rlLog "$f failure is expected"
|
||||
else
|
||||
rlFail "$f failure is not expected"
|
||||
fi
|
||||
done
|
||||
else
|
||||
rlRun "grep \"All [0-9]\+ tests passed\" $TmpDir/make_check.out" 0 \
|
||||
"All tests passed"
|
||||
fi
|
||||
rlRun "cat $TmpDir/make_check.out"
|
||||
rlRun "popd"
|
||||
rlPhaseEnd
|
||||
|
||||
if ! (rlIsRHEL '<=8.4' || ([[ $fipsMode = "enabled" ]] && rlIsFedora '<37')); then
|
||||
# (we are ~expecting to fix HW optimization problem around Fedora-37)
|
||||
rlPhaseStartTest "Performance with HW optimizations disabled - bz1990059"
|
||||
# we are gathering more samples, so that this test is robust in shared environments
|
||||
N_SAMPLES=5
|
||||
N_MEDIAN=$(echo "$N_SAMPLES/2+1" |bc)
|
||||
HWF_DENY_FILE="/etc/gcrypt/hwf.deny"
|
||||
# Disabling via cmdline arguments would need either handpicking
|
||||
# all the algorithms (variant with ":"), or making "all" work.
|
||||
# "--disable-hwf all" does not work: https://dev.gnupg.org/T5636
|
||||
#dis_arg="--disable-hwf all"
|
||||
dis_arg=""
|
||||
|
||||
for x in "cipher:aes256:CBC enc" "hash:sha256:SHA256" "mac:hmac_sha256:HMAC_SHA256"; do
|
||||
alg_type=$(echo $x |cut -d: -f1)
|
||||
algorithm=$(echo $x |cut -d: -f2)
|
||||
alg_line=$(echo $x |cut -d: -f3)
|
||||
rlRun "rm -f $algorithm.ena $algorithm.dis"
|
||||
rlLogInfo "Performance measurements started ..."
|
||||
for i in `seq 1 $N_SAMPLES`; do
|
||||
# run with HW optimizations ENAbled
|
||||
rm -f $HWF_DENY_FILE
|
||||
$TOPDIR/$BUILDDIR/tests/bench-slope $alg_type $algorithm |grep "$alg_line" >>$algorithm.ena
|
||||
|
||||
# run with HW optimizations DISabled
|
||||
# this looks idiotic, but I wasn't able to make --disable-hwf work
|
||||
echo "all" >$HWF_DENY_FILE
|
||||
$TOPDIR/$BUILDDIR/tests/bench-slope $dis_arg $alg_type $algorithm |grep "$alg_line" >>$algorithm.dis
|
||||
done
|
||||
rlLogInfo "Performance measurements finished"
|
||||
rlRun "cat $algorithm.ena"
|
||||
rlRun "cat $algorithm.dis"
|
||||
dis=$(cat $algorithm.dis |cut -d'|' -f2 |awk '{ print $1 }' |sort -n |sed -n "$N_MEDIAN p")
|
||||
ena=$(cat $algorithm.ena |cut -d'|' -f2 |awk '{ print $1 }' |sort -n |sed -n "$N_MEDIAN p")
|
||||
rlRun "echo '$algorithm Time: disabled $dis enabled $ena'"
|
||||
if (( $(echo "$dis > $ena" |bc -l) )); then
|
||||
rlPass "HW optimizations work for $algorithm"
|
||||
else
|
||||
rlFail "HW optimizations DO NOT work for $algorithm"
|
||||
fi
|
||||
done
|
||||
rlPhaseEnd
|
||||
fi
|
||||
|
||||
rlPhaseStartCleanup
|
||||
rlRun "popd"
|
||||
rlRun "popd" 0
|
||||
rlRun "rm -r $TmpDir" 0
|
||||
rlRun "rlFileRestore"
|
||||
rlFileRestore
|
||||
rlPhaseEnd
|
||||
|
||||
rlJournalPrintText
|
||||
|
|
|
|||
21
tests/tests.yml
Normal file
21
tests/tests.yml
Normal file
|
|
@ -0,0 +1,21 @@
|
|||
- hosts: localhost
|
||||
tags:
|
||||
- classic
|
||||
- container
|
||||
roles:
|
||||
- role: standard-test-beakerlib
|
||||
tests:
|
||||
- smoke-test
|
||||
required_packages:
|
||||
- fipscheck
|
||||
- gawk
|
||||
- gcc-c++
|
||||
- libgcrypt
|
||||
- libgpg-error-devel
|
||||
- libselinux-utils
|
||||
- nfs-utils
|
||||
- pkgconfig
|
||||
- rpm-build
|
||||
- texinfo
|
||||
- wget
|
||||
- yum-utils
|
||||
2007
wk@g10code.com
Normal file
2007
wk@g10code.com
Normal file
File diff suppressed because it is too large
Load diff
Loading…
Add table
Add a link
Reference in a new issue