From e87db2099aba276f24fb3c33dec95f18a47d50e6 Mon Sep 17 00:00:00 2001 From: Aidan Garske Date: Mon, 17 Aug 2026 12:25:51 -0700 Subject: [PATCH] Cover FIPS-clean EAP methods in hostap CI and enable AES key wrap --- .github/workflows/hostap.yml | 10 +++++----- scripts/utils-wolfssl.sh | 2 +- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/hostap.yml b/.github/workflows/hostap.yml index 5ba4c0ee..4ec8801e 100644 --- a/.github/workflows/hostap.yml +++ b/.github/workflows/hostap.yml @@ -214,12 +214,12 @@ jobs: echo "KERNELDIR=$GITHUB_WORKSPACE/linux" >> vm/vm-config # Run smoke tests - SMOKE_TESTS="ap_open ap_wpa2_psk discovery" - timeout 3m ./vm/parallel-vm.py --nocurses $(nproc) $SMOKE_TESTS || SMOKE_RES=$? + SMOKE_TESTS="ap_open ap_wpa2_psk_disable_enable sae_password_id_only discovery" + timeout 4m ./vm/parallel-vm.py --nocurses $(nproc) $SMOKE_TESTS || SMOKE_RES=$? - # Run EAP tests (excluding MSCHAPv2 - requires MD4/DES not in wolfSSL) - TLS_EAP_TESTS="ap_wpa2_eap_tls ap_wpa2_eap_ttls_eap_gtc ap_wpa2_eap_peap_eap_tls" - timeout 5m ./vm/parallel-vm.py --nocurses $(nproc) $TLS_EAP_TESTS || TLS_RES=$? + # FIPS-clean EAP methods only (MSCHAPv2/LEAP/EAP-MD5 need MD4/MD5/DES) + TLS_EAP_TESTS="ap_wpa2_eap_tls ap_wpa2_eap_psk ap_wpa2_eap_ttls_eap_gtc ap_wpa2_eap_peap_eap_tls ap_wpa2_eap_peap_eap_gtc ap_wpa2_eap_fast_gtc_auth_prov" + timeout 8m ./vm/parallel-vm.py --nocurses $(nproc) $TLS_EAP_TESTS || TLS_RES=$? # Evaluate results FINAL_RES=0 diff --git a/scripts/utils-wolfssl.sh b/scripts/utils-wolfssl.sh index 48b5c204..5cc7c99d 100644 --- a/scripts/utils-wolfssl.sh +++ b/scripts/utils-wolfssl.sh @@ -42,7 +42,7 @@ WOLFSSL_SOURCE_DIR=${SCRIPT_DIR}/../wolfssl-source WOLFSSL_INSTALL_DIR=${SCRIPT_DIR}/../wolfssl-install WOLFSSL_ISFIPS=${WOLFSSL_ISFIPS:-0} WOLFSSL_FIPS_VERSION=${WOLFSSL_FIPS_VERSION:-"5.2.4"} -WOLFSSL_FIPS_CONFIG_OPTS=${WOLFSSL_CONFIG_OPTS:-'--enable-opensslcoexist '} +WOLFSSL_FIPS_CONFIG_OPTS=${WOLFSSL_CONFIG_OPTS:-'--enable-opensslcoexist --enable-aeskeywrap '} WOLFSSL_FIPS_CONFIG_CFLAGS=${WOLFSSL_CONFIG_CFLAGS:-"-I${OPENSSL_INSTALL_DIR}/include -DWOLFSSL_OLD_OID_SUM -DWOLFSSL_DH_EXTRA"} WOLFSSL_CONFIG_OPTS=${WOLFSSL_CONFIG_OPTS:-'--enable-all-crypto --with-eccminsz=192 --with-max-ecc-bits=1024 --enable-opensslcoexist --enable-sha'} WOLFSSL_CONFIG_CFLAGS=${WOLFSSL_CONFIG_CFLAGS:-"-I${OPENSSL_INSTALL_DIR}/include -DWC_RSA_NO_PADDING -DWOLFSSL_PUBLIC_MP -DHAVE_PUBLIC_FFDHE -DHAVE_FFDHE_6144 -DHAVE_FFDHE_8192 -DWOLFSSL_PSS_LONG_SALT -DWOLFSSL_PSS_SALT_LEN_DISCOVER -DRSA_MIN_SIZE=1024 -DWOLFSSL_OLD_OID_SUM "}