.gitignore

@@ -1 +1,22 @@
-SOURCES/libgcrypt-1.8.5-hobbled.tar.xz
+libgcrypt-1.4.5-hobbled.tar.bz2
+/libgcrypt-1.4.6-hobbled.tar.bz2
+/libgcrypt-1.5.0-hobbled.tar.bz2
+/libgcrypt-1.5.1-hobbled.tar.xz
+/libgcrypt-1.5.2-hobbled.tar.xz
+/libgcrypt-1.5.3-hobbled.tar.xz
+/libgcrypt-1.6.1-hobbled.tar.xz
+/libgcrypt-1.6.2-hobbled.tar.xz
+/libgcrypt-1.6.3-hobbled.tar.xz
+/libgcrypt-1.6.4-hobbled.tar.xz
+/libgcrypt-1.6.5-hobbled.tar.xz
+/libgcrypt-1.6.6-hobbled.tar.xz
+/libgcrypt-1.7.3-hobbled.tar.xz
+/libgcrypt-1.7.5-hobbled.tar.xz
+/libgcrypt-1.7.6-hobbled.tar.xz
+/libgcrypt-1.7.7-hobbled.tar.xz
+/libgcrypt-1.7.8-hobbled.tar.xz
+/libgcrypt-1.8.0-hobbled.tar.xz
+/libgcrypt-1.8.1-hobbled.tar.xz
+/libgcrypt-1.8.2-hobbled.tar.xz
+/libgcrypt-1.8.3-hobbled.tar.xz
+/libgcrypt-1.8.5-hobbled.tar.xz

.libgcrypt.metadata

@@ -1 +0,0 @@
-1edcc623a15ed87ff832e021b4cb77fd94eb66c9 SOURCES/libgcrypt-1.8.5-hobbled.tar.xz

gating.yaml

@@ -0,0 +1,9 @@
+--- !Policy
+product_versions:
+  - rhel-8
+decision_context: osci_compose_gate
+rules:
+  - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier1.functional}
+  - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.userspace-fips-mode.functional}
+  - !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}
+  - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tedude.validation}

sources

@@ -0,0 +1 @@
+SHA512 (libgcrypt-1.8.5-hobbled.tar.xz) = 63391cdb4b2366dfc7869a45a9e5facbb05e4d28ada2646941cadfa2de93517ff5fb2a28aa7f486b79a1449cf701c8c36a6e99052d7c499b240dff606dd921a0

tests/.fmf/version

@@ -0,0 +1 @@
+1

tests/fips-selftest/Makefile

@@ -0,0 +1,64 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of /CoreOS/libgcrypt/Sanity/fips-selftest
+#   Description: FIPS mode initialization sanity
+#   Author: Tomas Mraz <tmraz@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2020 Red Hat, Inc.
+#
+#   This program is free software: you can redistribute it and/or
+#   modify it under the terms of the GNU General Public License as
+#   published by the Free Software Foundation, either version 2 of
+#   the License, or (at your option) any later version.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE.  See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public License
+#   along with this program. If not, see http://www.gnu.org/licenses/.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/CoreOS/libgcrypt/Sanity/fips-selftest
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) runtest.sh Makefile PURPOSE gcry-fips-random.c
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+	./runtest.sh
+
+build: $(BUILT_FILES)
+	test -x runtest.sh || chmod a+x runtest.sh
+
+clean:
+	rm -f *~ $(BUILT_FILES)
+
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+	@echo "Owner:           Tomas Mraz <tmraz@redhat.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "Description:     FIPS mode initialization sanity" >> $(METADATA)
+	@echo "Type:            Sanity" >> $(METADATA)
+	@echo "TestTime:        5m" >> $(METADATA)
+	@echo "RunFor:          libgcrypt" >> $(METADATA)
+	@echo "Requires:        make gcc libgcrypt-devel grub2" >> $(METADATA)
+	@echo "RhtsRequires:    library(distribution/fips)" >> $(METADATA)
+	@echo "Priority:        Normal" >> $(METADATA)
+	@echo "License:         GPLv2+" >> $(METADATA)
+	@echo "Confidential:    no" >> $(METADATA)
+	@echo "Destructive:     no" >> $(METADATA)
+	@echo "Releases:        -RHEL4 -RHELClient5 -RHELServer5 -RHELServer6 -RHELServer7" >> $(METADATA)
+
+	rhts-lint $(METADATA)

tests/fips-selftest/PURPOSE

@@ -0,0 +1,3 @@
+PURPOSE of /CoreOS/libgcrypt/Sanity/fips-selftest
+Description: FIPS mode initialization sanity
+Author: Tomas Mraz <tmraz@redhat.com>

tests/fips-selftest/gcry-fips-random.c

@@ -0,0 +1,26 @@
+#include <stdio.h>
+#include <gcrypt.h>
+#include <stdlib.h>
+#include <string.h>
+
+static char zerobuf[64];
+
+int main(int argc, char *argv[])
+{
+  char rndbuf[64];
+
+  gcry_check_version("1.4.0");
+  gcry_control(GCRYCTL_INITIALIZATION_FINISHED, 0);
+
+  printf("FIPS_MODE: %d\n", gcry_control(GCRYCTL_FIPS_MODE_P, 0) != 0);
+  printf("OPERATIONAL: %d\n", gcry_control(GCRYCTL_OPERATIONAL_P, 0) != 0);
+
+  /* a little rng test to do something */
+  memset(rndbuf, '\0', sizeof rndbuf);
+  gcry_randomize (rndbuf, sizeof rndbuf, GCRY_STRONG_RANDOM);
+  if (memcmp(rndbuf, zerobuf, sizeof rndbuf) == 0) {
+     printf("BAD RANDOMIZE!\n");
+     return 1;
+  }
+  return 0;
+}

tests/fips-selftest/runtest.sh

@@ -0,0 +1,129 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/gnutls/Sanity/fips-without-etc-system-fips
+#   Description: FIPS mode without /etc/system-fips
+#   Author: Alexander Sosedkin <asosedki@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2020 Red Hat, Inc.
+#
+#   This program is free software: you can redistribute it and/or
+#   modify it under the terms of the GNU General Public License as
+#   published by the Free Software Foundation, either version 2 of
+#   the License, or (at your option) any later version.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE.  See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public License
+#   along with this program. If not, see http://www.gnu.org/licenses/.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/bin/rhts-environment.sh || exit 1
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE='libgcrypt'
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlAssertRpm $PACKAGE
+        rlRun "TmpDir=\$(mktemp -d)" 0 'Creating tmp directory'
+        rlRun "cp gcry-fips-random.c $TmpDir/"
+        rlRun "pushd $TmpDir"
+        rlRun 'rlImport distribution/fips'
+        rlRun 'make CFLAGS="-g -O2 -Wall" LDFLAGS=-lgcrypt gcry-fips-random'
+        rlFileBackup "/etc/system-fips"
+    rlPhaseEnd
+
+
+    if [ $fipsMode == 'enabled' ]; then
+     rlPhaseStartTest "Check operation with FIPS $fipsMode"
+         rlRun -s './gcry-fips-random'
+         rlAssertGrep "FIPS_MODE: 1" $rlRun_LOG
+         rlAssertGrep "OPERATIONAL: 1" $rlRun_LOG
+     rlPhaseEnd
+
+     rlPhaseStartTest "Check operation with FIPS $fipsMode (corrupted hmac)"
+         hmacfile="$(ls /usr/lib*/.libgcrypt.so.??.hmac)"
+         rlFileBackup --namespace hmacfile $hmacfile
+         rlRun "sed -i 's/0/1/;s/1/2/;s/2/3/' $hmacfile"
+         rlRun -s './gcry-fips-random' 1-255
+         rlFileRestore --namespace hmacfile
+     rlPhaseEnd
+
+     if (rlIsRHEL && ! rlIsRHEL '<8.3') || (rlIsFedora && ! rlIsFedora '<33') || rlCheckRpm libgcrypt 1.8.5; then
+        rlPhaseStartTest 'RHEL >=8.3 or Fedora >=33 try removing /etc/system-fips'
+            # The file might disappear later completely so no need to error out
+            rlRun "mv /etc/system-fips /etc/system-fips.disabled || :"
+        rlPhaseEnd
+
+        rlPhaseStartTest "Check operation with FIPS $fipsMode (no system-fips)"
+            rlRun -s './gcry-fips-random'
+            rlAssertGrep "FIPS_MODE: 1" $rlRun_LOG
+            rlAssertGrep "OPERATIONAL: 1" $rlRun_LOG
+        rlPhaseEnd
+
+        rlPhaseStartTest "Check operation with FIPS $fipsMode (no system-fips corrupted hmac)"
+            hmacfile="$(ls /usr/lib*/.libgcrypt.so.??.hmac)"
+            rlFileBackup --namespace hmacfile $hmacfile
+            rlRun "sed -i 's/0/1/;s/1/2/;s/2/3/' $hmacfile"
+            rlRun -s './gcry-fips-random' 1-255
+            rlFileRestore --namespace hmacfile
+        rlPhaseEnd
+     fi
+
+    elif [[ $fipsMode == 'disabled' ]]; then
+
+     rlPhaseStartTest "Check operation with FIPS $fipsMode"
+         rlRun -s './gcry-fips-random'
+         rlAssertGrep "FIPS_MODE: 0" $rlRun_LOG
+         rlAssertGrep "OPERATIONAL: 1" $rlRun_LOG
+     rlPhaseEnd
+
+     rlPhaseStartTest "Check operation with FIPS $fipsMode (corrupted hmac)"
+         hmacfile="$(ls /usr/lib*/.libgcrypt.so.??.hmac)"
+         rlFileBackup --namespace hmacfile $hmacfile
+         rlRun "sed -i 's/0/1/;s/1/2/;s/2/3/' $hmacfile"
+         rlRun -s './gcry-fips-random' 0
+         rlAssertGrep "FIPS_MODE: 0" $rlRun_LOG
+         rlAssertGrep "OPERATIONAL: 1" $rlRun_LOG
+         rlFileRestore --namespace hmacfile
+     rlPhaseEnd
+
+     if (rlIsRHEL && ! rlIsRHEL '<8.3') || (rlIsFedora && ! rlIsFedora '<33') || rlCheckRpm libgcrypt 1.8.5; then
+        rlPhaseStartTest 'RHEL >=8.3 or Fedora >=33 try removing /etc/system-fips'
+            # The file might disappear later completely so no need to error out
+            rlRun "mv /etc/system-fips /etc/system-fips.disabled || :"
+        rlPhaseEnd
+
+        rlPhaseStartTest "Check operation with FIPS $fipsMode (no system-fips)"
+            rlRun -s './gcry-fips-random'
+            rlAssertGrep "FIPS_MODE: 0" $rlRun_LOG
+            rlAssertGrep "OPERATIONAL: 1" $rlRun_LOG
+        rlPhaseEnd
+
+        rlPhaseStartTest "Check operation with FIPS $fipsMode (no system-fips corrupted hmac)"
+            hmacfile="$(ls /usr/lib*/.libgcrypt.so.??.hmac)"
+            rlFileBackup --namespace hmacfile $hmacfile
+            rlRun "sed -i 's/0/1/;s/1/2/;s/2/3/' $hmacfile"
+            rlRun -s './gcry-fips-random' 0
+            rlAssertGrep "FIPS_MODE: 0" $rlRun_LOG
+            rlAssertGrep "OPERATIONAL: 1" $rlRun_LOG
+            rlFileRestore --namespace hmacfile
+        rlPhaseEnd
+     fi
+    fi
+
+    rlPhaseStartCleanup
+        rlFileRestore
+        rlRun 'popd'
+        rlRun "rm -r $TmpDir" 0 'Removing tmp directory'
+    rlPhaseEnd
+rlJournalEnd

tests/provision.fmf

@@ -0,0 +1,5 @@
+---
+
+standard-inventory-qcow2:
+  qemu:
+    m: 2G

tests/tests.yml

@@ -0,0 +1,12 @@
+- hosts: localhost
+  tags:
+  - classic
+  - container
+  roles:
+  - role: standard-test-beakerlib
+    tests:
+    - fips-selftest
+    required_packages:
+    - make
+    - gcc-c++
+    - libgcrypt-devel