mirror of
https://github.com/wolfSSL/wolfssl.git
synced 2026-10-24 04:09:07 +03:00
2cdf44b253
fips-hash.sh now works out the in core integrity digest from the length of the verifyCore literal in fips_test.c (64 hex SHA-256, 96 hex SHA-384, 128 hex SHA-512), falling back to a WC_SHA256 HMAC type named in the source for placeholder values. A reported hash of the wrong length is rejected instead of being written, and the rewrite is verified. fips-hash-offline.sh gains HMAC-SHA-512 for v7 and checks coreKey against the per digest key size (128 bytes for v7) instead of assuming it matches the digest length.
179 lines
7.4 KiB
Bash
Executable File
179 lines
7.4 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# fips-hash-offline.sh
|
|
#
|
|
# Copyright (C) 2006-2026 wolfSSL Inc.
|
|
#
|
|
# This file is part of wolfSSL.
|
|
#
|
|
# wolfSSL is free software; you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation; either version 3 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# wolfSSL is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with this program; if not, write to the Free Software
|
|
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
|
|
|
|
# This script computes the wolfCrypt FIPS in-core integrity hash at compile
|
|
# time directly from an already linked binary, and patches the result into the
|
|
# verifyCore[] array inside that binary.
|
|
#
|
|
# This reproduces, at build time and against the final ELF image, exactly what
|
|
# DoInCoreCheck() in wolfcrypt/src/fips_test.c computes at run time:
|
|
#
|
|
# HMAC-SHAxxx( coreKey,
|
|
# .text bytes in [wolfCrypt_FIPS_first, wolfCrypt_FIPS_last)
|
|
# ||
|
|
# .rodata bytes in [wolfCrypt_FIPS_ro_start, wolfCrypt_FIPS_ro_end)
|
|
# with the verifyCore[] bytes skipped )
|
|
#
|
|
# where SHAxxx is SHA-256 (or SHA-384) up to FIPS v6.0.0 and SHA-512 from
|
|
# v7.0.0 on, selected below from the size of verifyCore[].
|
|
#
|
|
# Because verifyCore[] is excluded from the digest, overwriting it with the
|
|
# computed value does not change the digest, so a single pass over the linked
|
|
# binary is sufficient -- no rebuild and no scraping of the module's reported
|
|
# hash is required.
|
|
#
|
|
# Assumptions (match the optest user-space static FIPS build):
|
|
# - single fixed-address (ET_EXEC) image, not stripped
|
|
# - measured .text/.rodata bracketed by the wolfCrypt_FIPS_first/last and
|
|
# wolfCrypt_FIPS_ro_start/ro_end symbols
|
|
# - no text-segment canonicalizer and no relocation-table indirection in
|
|
# effect (i.e. the plain #else path of DoInCoreCheck())
|
|
#
|
|
# Usage: fips-hash-offline.sh [path-to-binary]
|
|
# default binary: wolfcrypt/test/testwolfcrypt
|
|
|
|
set -euo pipefail
|
|
|
|
BIN="${1:-wolfcrypt/test/testwolfcrypt}"
|
|
|
|
die() { echo "fips-hash-offline: error: $*" >&2; exit 1; }
|
|
|
|
[ -w "$BIN" ] || die "binary not writable: $BIN"
|
|
command -v awk >/dev/null 2>&1 || die "awk not found"
|
|
command -v dd >/dev/null 2>&1 || die "dd not found"
|
|
command -v readelf >/dev/null 2>&1 || die "readelf not found"
|
|
command -v openssl >/dev/null 2>&1 || die "openssl not found"
|
|
command -v xxd >/dev/null 2>&1 || die "xxd not found"
|
|
|
|
# Symbol lookup from the ELF symbol table.
|
|
# readelf -s columns: Num: Value Size Type Bind Vis Ndx Name
|
|
# -> Value ($2) is hexadecimal, Size ($3) is decimal, Ndx ($7), Name ($8).
|
|
sym_val() { readelf -sW "$BIN" | awk -v n="$1" '{if (!printed && $8==n && $7!="UND"){print $2; printed=1; }}'; }
|
|
sym_size() { readelf -sW "$BIN" | awk -v n="$1" '{if (!printed && $8==n && $7!="UND"){print $3; printed=1; }}'; }
|
|
|
|
# Map a virtual address to a file offset using the containing PROGBITS section.
|
|
# This avoids assuming any particular load base or section padding.
|
|
vaddr_to_off() {
|
|
local v="$1"
|
|
local name type addr off size a o s
|
|
while read -r name type addr off size; do
|
|
[ "$type" = "PROGBITS" ] || continue
|
|
a=$((0x$addr)); o=$((0x$off)); s=$((0x$size))
|
|
if [ "$v" -ge "$a" ] && [ "$v" -lt $((a + s)) ]; then
|
|
echo $((o + v - a))
|
|
return 0
|
|
fi
|
|
done < <(readelf -SW "$BIN" | sed 's/\[[ 0-9]*\]//' | awk '/PROGBITS/{print $1, $2, $3, $4, $5}')
|
|
return 1
|
|
}
|
|
|
|
# Extract byte_count bytes starting at file_offset (both in bytes) to stdout.
|
|
# Uses a 1-byte block size so skip/count are byte-granular on any POSIX dd.
|
|
# dd seeks over the skip on a regular file, so the offset is not read byte
|
|
# by byte; only the small count is copied one byte at a time.
|
|
extract() {
|
|
dd if="$BIN" bs=1 skip="$1" count="$2" 2>/dev/null
|
|
}
|
|
|
|
# --- gather the FIPS boundary and verifyCore/coreKey symbols ---
|
|
FIRST_H=$(sym_val wolfCrypt_FIPS_first)
|
|
LAST_H=$(sym_val wolfCrypt_FIPS_last)
|
|
ROSTART_H=$(sym_val wolfCrypt_FIPS_ro_start)
|
|
ROEND_H=$(sym_val wolfCrypt_FIPS_ro_end)
|
|
VC_H=$(sym_val verifyCore)
|
|
VCSZ=$(sym_size verifyCore)
|
|
KEY_H=$(sym_val coreKey)
|
|
KEYSZ=$(sym_size coreKey)
|
|
|
|
[ -n "$FIRST_H" ] && [ -n "$LAST_H" ] && [ -n "$ROSTART_H" ] && [ -n "$ROEND_H" ] \
|
|
&& [ -n "$VC_H" ] && [ -n "$VCSZ" ] && [ -n "$KEY_H" ] && [ -n "$KEYSZ" ] \
|
|
|| die "missing FIPS boundary symbols (is $BIN a non-stripped static FIPS build?)"
|
|
|
|
first=$((0x$FIRST_H))
|
|
last=$((0x$LAST_H))
|
|
rostart=$((0x$ROSTART_H))
|
|
roend=$((0x$ROEND_H))
|
|
vc=$((0x$VC_H))
|
|
keyaddr=$((0x$KEY_H))
|
|
|
|
[ "$last" -gt "$first" ] || die "wolfCrypt_FIPS_last <= wolfCrypt_FIPS_first"
|
|
[ "$roend" -gt "$rostart" ] || die "wolfCrypt_FIPS_ro_end <= wolfCrypt_FIPS_ro_start"
|
|
|
|
# Select the digest from the size of verifyCore[] (= digest_bytes*2 + 1).
|
|
digest_bytes=$(( (VCSZ - 1) / 2 ))
|
|
# The coreKey size follows the digest up to v6.0.0; v7 (HMAC-SHA-512) uses a
|
|
# full 128-byte SHA-512 block-size key.
|
|
case "$digest_bytes" in
|
|
32) ALG=sha256; key_bytes=32 ;;
|
|
48) ALG=sha384; key_bytes=48 ;;
|
|
64) ALG=sha512; key_bytes=128 ;;
|
|
*) die "unexpected verifyCore size ($VCSZ); cannot determine digest" ;;
|
|
esac
|
|
|
|
# Read the HMAC key (coreKey) as ASCII hex straight out of the binary.
|
|
keyoff=$(vaddr_to_off "$keyaddr") || die "cannot map coreKey address to file offset"
|
|
KEYHEX=$(extract "$keyoff" $((KEYSZ - 1)))
|
|
[ "${#KEYHEX}" -eq $((key_bytes * 2)) ] || die "coreKey length mismatch in binary"
|
|
|
|
# File offsets for the measured regions.
|
|
codeoff=$(vaddr_to_off "$first") || die "cannot map wolfCrypt_FIPS_first"
|
|
roff=$(vaddr_to_off "$rostart") || die "cannot map wolfCrypt_FIPS_ro_start"
|
|
|
|
vc_in_ro=0
|
|
if [ "$vc" -ge "$rostart" ] && [ "$vc" -lt "$roend" ]; then
|
|
vc_in_ro=1
|
|
aoff=$(vaddr_to_off $((vc + VCSZ))) || die "cannot map verifyCore tail"
|
|
fi
|
|
|
|
# Compute the digest, streaming the measured bytes in the same order and with
|
|
# the same verifyCore exclusion as DoInCoreCheck().
|
|
NEWHASH=$(
|
|
{
|
|
extract "$codeoff" $((last - first))
|
|
if [ "$vc_in_ro" -eq 1 ]; then
|
|
extract "$roff" $((vc - rostart))
|
|
extract "$aoff" $((roend - vc - VCSZ))
|
|
else
|
|
extract "$roff" $((roend - rostart))
|
|
fi
|
|
} | openssl dgst -"$ALG" -mac HMAC -macopt hexkey:"$KEYHEX" -binary \
|
|
| xxd -p -c 1000 | tr -d '\n' | tr 'a-f' 'A-F'
|
|
)
|
|
[ "${#NEWHASH}" -eq $((digest_bytes * 2)) ] || die "hash computation failed"
|
|
|
|
# Overwrite the first digest_bytes*2 ASCII characters of verifyCore[] in place.
|
|
# The trailing NUL terminator (byte digest_bytes*2) is left untouched.
|
|
vcoff=$(vaddr_to_off "$vc") || die "cannot map verifyCore address to file offset"
|
|
printf '%s' "$NEWHASH" | dd of="$BIN" bs=1 conv=notrunc seek="$vcoff" 2>/dev/null \
|
|
|| die "failed to write verifyCore"
|
|
|
|
# Confirm the patch landed.
|
|
CHECK=$(extract "$vcoff" $((digest_bytes * 2)))
|
|
[ "$CHECK" = "$NEWHASH" ] || die "verifyCore patch verification failed"
|
|
|
|
ALG_UC=$(echo "$ALG" | tr 'a-z' 'A-Z')
|
|
echo "fips-hash-offline: patched $BIN"
|
|
echo " algorithm : HMAC-$ALG_UC"
|
|
echo " code range : [0x$FIRST_H, 0x$LAST_H) ($((last - first)) bytes)"
|
|
echo " ro range : [0x$ROSTART_H, 0x$ROEND_H) (verifyCore $([ "$vc_in_ro" -eq 1 ] && echo excluded || echo 'not in range'))"
|
|
echo " hash : $NEWHASH"
|