Merge branch 'master' into make_rpm_fix

Author: twcook86

.github/workflows/async.yml

@@ -18,11 +18,11 @@ jobs:
       matrix:
         config: [
           # Add new configs here
-          '--enable-asynccrypt --enable-all --enable-dtls13 --disable-mlkem CFLAGS="-pedantic -Wdeclaration-after-statement -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -DWOLFCRYPT_TEST_LINT"',
-          '--enable-asynccrypt-sw --enable-ocspstapling --enable-ocspstapling2 --disable-mlkem CFLAGS="-pedantic -Wdeclaration-after-statement -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
-          '--enable-asynccrypt --enable-all --enable-dtls13 CFLAGS="-pedantic -Wdeclaration-after-statement -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -DWOLFCRYPT_TEST_LINT"',
-          '--enable-asynccrypt-sw --enable-ocspstapling --enable-ocspstapling2 CFLAGS="-pedantic -Wdeclaration-after-statement -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
-          '--enable-ocsp CFLAGS="-DTEST_NONBLOCK_CERTS -pedantic -Wdeclaration-after-statement -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
+          '--enable-asynccrypt --enable-all --enable-dtls13 --disable-mlkem CFLAGS="-pedantic -Wdeclaration-after-statement -Wnull-dereference -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -DWOLFCRYPT_TEST_LINT"',
+          '--enable-asynccrypt-sw --enable-ocspstapling --enable-ocspstapling2 --disable-mlkem CFLAGS="-pedantic -Wdeclaration-after-statement -Wnull-dereference -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
+          '--enable-asynccrypt --enable-all --enable-dtls13 CFLAGS="-pedantic -Wdeclaration-after-statement -Wnull-dereference -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -DWOLFCRYPT_TEST_LINT"',
+          '--enable-asynccrypt-sw --enable-ocspstapling --enable-ocspstapling2 CFLAGS="-pedantic -Wdeclaration-after-statement -Wnull-dereference -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
+          '--enable-ocsp CFLAGS="-DTEST_NONBLOCK_CERTS -pedantic -Wdeclaration-after-statement -Wnull-dereference -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
         ]
     name: make check
     if: github.repository_owner == 'wolfssl'

.github/workflows/codespell.yml

@@ -23,7 +23,7 @@ jobs:
         check_filenames: true
         check_hidden: true
           # Add comma separated list of words that occur multiple times that should be ignored (sorted alphabetically, case sensitive)
-        ignore_words_list: adin,aNULL,brunch,carryIn,chainG,ciph,cLen,cliKs,dout,haveA,inCreated,inOut,inout,larg,LEAPYEAR,Merget,optionA,parm,parms,repid,rIn,userA,ser,siz,te,Te,HSI,failT,
+        ignore_words_list: adin,aNULL,brunch,carryIn,chainG,ciph,cLen,cliKs,dout,haveA,inCreated,inOut,inout,larg,LEAPYEAR,Merget,optionA,parm,parms,repid,rIn,userA,ser,siz,te,Te,HSI,failT,toLen,
           # The exclude_file contains lines of code that should be ignored. This is useful for individual lines which have non-words that can safely be ignored.
         exclude_file: '.codespellexcludelines'
           # To skip files entirely from being processed, add it to the following list:

.github/workflows/hostap-files/configs/07c9f183ea744ac04585fb6dd10220c75a5e2e74/tests

@@ -238,8 +238,6 @@ ap_wpa2_eap_sim_imsi_privacy_attr
 ap_wpa2_eap_sim_imsi_privacy_key
 ap_wpa2_eap_sim_no_change_set
 ap_wpa2_eap_sim_oom
-ap_wpa2_eap_sim_sql
-ap_wpa2_eap_sim_sql_fallback_to_pseudonym
 ap_wpa2_eap_sim_zero_db_timeout
 ap_wpa2_eap_tls_13_ec
 ap_wpa2_eap_tls_13_missing_prot_success
@@ -248,9 +246,6 @@ ap_wpa2_eap_tls_check_cert_subject_neg
 ap_wpa2_eap_tls_diff_ca_trust2
 ap_wpa2_eap_tls_domain_mismatch_cn
 ap_wpa2_eap_tls_domain_suffix_mismatch_cn
-ap_wpa2_eap_tls_intermediate_ca_ocsp_multi_missing_resp
-ap_wpa2_eap_tls_intermediate_ca_ocsp_revoked_sha1
-ap_wpa2_eap_tls_intermediate_ca_ocsp_sha1
 ap_wpa2_eap_tls_neg_incorrect_trust_root
 ap_wpa2_eap_tls_ocsp_multi
 ap_wpa2_eap_tls_ocsp_multi_revoked
@@ -649,9 +644,6 @@ dpp_config_dpp_gen_secp521r1
 dpp_config_dpp_gen_secp521r1_prime256v1
 dpp_config_dpp_gen_secp521r1_secp384r1
 dpp_config_dpp_gen_secp521r1_secp521r1
-dpp_config_dpp_override_prime256v1
-dpp_config_dpp_override_secp384r1
-dpp_config_dpp_override_secp521r1
 dpp_config_error_legacy_invalid_psk
 dpp_config_error_legacy_no_pass
 dpp_config_error_legacy_no_pass_for_sae
@@ -691,7 +683,6 @@ dpp_config_no_discovery
 dpp_config_no_discovery_ssid
 dpp_config_no_signed_connector
 dpp_config_no_wi_fi_tech
-dpp_config_override_objects
 dpp_config_root_not_an_object
 dpp_config_save
 dpp_config_save2
@@ -748,12 +739,6 @@ dpp_hostapd_configurator_enrollee_v1
 dpp_hostapd_configurator_fragmentation
 dpp_hostapd_configurator_override_objects
 dpp_hostapd_configurator_responder
-dpp_hostapd_enrollee_fragmentation
-dpp_hostapd_enrollee_gas_errors
-dpp_hostapd_enrollee_gas_proto
-dpp_hostapd_enrollee_gas_timeout
-dpp_hostapd_enrollee_gas_timeout_comeback
-dpp_hostapd_enrollee_gas_tx_status_errors
 dpp_intro_mismatch
 dpp_invalid_configurator_key
 dpp_invalid_legacy_params
@@ -906,10 +891,6 @@ dpp_qr_code_auth_incompatible_roles2
 dpp_qr_code_auth_incompatible_roles_failure
 dpp_qr_code_auth_incompatible_roles_failure2
 dpp_qr_code_auth_incompatible_roles_failure3
-dpp_qr_code_auth_initiator_either_1
-dpp_qr_code_auth_initiator_either_2
-dpp_qr_code_auth_initiator_either_3
-dpp_qr_code_auth_initiator_enrollee
 dpp_qr_code_auth_mutual
 dpp_qr_code_auth_mutual2
 dpp_qr_code_auth_mutual_bp_256

.github/workflows/hostap-files/configs/b607d2723e927a3446d89aed813f1aa6068186bb/tests

@@ -219,7 +219,6 @@ ap_wpa2_eap_sim
 ap_wpa2_eap_sim_imsi_identity
 ap_wpa2_eap_sim_imsi_privacy_key
 ap_wpa2_eap_sim_imsi_privacy_attr
-ap_wpa2_eap_sim_sql
 ap_wpa2_eap_sim_config
 ap_wpa2_eap_sim_id_0
 ap_wpa2_eap_sim_id_1
@@ -347,7 +346,6 @@ ap_wpa2_eap_tls_ocsp_server_signed
 ap_wpa2_eap_tls_ocsp_invalid_data
 ap_wpa2_eap_tls_ocsp_invalid
 ap_wpa2_eap_tls_ocsp_unknown_sign
-ap_wpa2_eap_tls_intermediate_ca
 ap_wpa2_eap_tls_ocsp_multi_revoked
 ap_wpa2_eap_tls_domain_suffix_match_cn_full
 ap_wpa2_eap_tls_domain_match_cn
@@ -461,9 +459,6 @@ dpp_qr_code_auth_mutual_not_used
 dpp_qr_code_auth_mutual_curve_mismatch
 dpp_qr_code_auth_hostapd_mutual2
 dpp_qr_code_listen_continue
-dpp_qr_code_auth_initiator_enrollee
-dpp_qr_code_auth_initiator_either_2
-dpp_qr_code_auth_initiator_either_3
 dpp_config_legacy
 dpp_config_legacy_psk_hex
 dpp_config_fragmentation
@@ -475,9 +470,6 @@ dpp_config_dpp_gen_secp521r1
 dpp_config_dpp_gen_expiry
 dpp_config_dpp_gen_expired_key
 dpp_config_dpp_gen_3rd_party
-dpp_config_dpp_override_prime256v1
-dpp_config_dpp_override_secp384r1
-dpp_config_override_objects
 dpp_config_signed_connector_error_no_dot_1
 dpp_config_signed_connector_error_no_dot_2
 dpp_config_signed_connector_error_unexpected_signature_len
@@ -579,12 +571,6 @@ dpp_pkex_nak_curve_change2
 dpp_hostapd_configurator
 dpp_hostapd_configurator_responder
 dpp_hostapd_configurator_fragmentation
-dpp_hostapd_enrollee_fragmentation
-dpp_hostapd_enrollee_gas_timeout
-dpp_hostapd_enrollee_gas_timeout_comeback
-dpp_hostapd_enrollee_gas_errors
-dpp_hostapd_enrollee_gas_proto
-dpp_hostapd_enrollee_gas_tx_status_errors
 dpp_hostapd_configurator_override_objects
 dpp_own_config
 dpp_own_config_group_id

.github/workflows/hostap-files/configs/hostap_2_10/tests

@@ -176,7 +176,6 @@ ap_wpa2_psk_ext_key_id_ptk_rekey_sta0
 ap_wpa2_psk_ext_key_id_ptk_rekey_sta1
 ap_wpa2_psk_ext_key_id_ptk_rekey_sta2
 ap_wpa2_eap_sim
-ap_wpa2_eap_sim_sql
 ap_wpa2_eap_sim_config
 ap_wpa2_eap_sim_id_0
 ap_wpa2_eap_sim_id_1

.github/workflows/hostap-vm.yml

@@ -2,14 +2,10 @@ name: hostap and wpa-supplicant Tests
 
 # START OF COMMON SECTION
 on:
-    workflow_dispatch: # Allows people to run it manually if they want but
-                       # disables it from running automatically when broken
-# To restore this to an auto test delete the above workflow_dispatch line and
-# comments and uncomment the below lines for push and pull_request
-#  push:
-#    branches: [ 'master', 'main', 'release/**' ]
-#  pull_request:
-#    branches: [ '*' ]
+  push:
+    branches: [ 'master', 'main', 'release/**' ]
+  pull_request:
+    branches: [ '*' ]
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -80,12 +76,21 @@ jobs:
         with:
           path: hostap
           key: hostap-repo
-          lookup-only: true
 
       - name: Checkout hostap
         if: steps.cache.outputs.cache-hit != 'true'
         run: git clone https://w1.fi/hostap.git hostap
 
+      - name: tar hostap
+        run: tar -zcf hostap.tgz hostap
+
+      - name: Upload hostap repo
+        uses: actions/upload-artifact@v4
+        with:
+          name: hostap-repo
+          path: hostap.tgz
+          retention-days: 1
+
   build_uml_linux:
     name: Build UML (UserMode Linux)
     if: github.repository_owner == 'wolfssl'
@@ -100,15 +105,16 @@ jobs:
         with:
           path: linux/linux
           key: hostap-linux-${{ env.LINUX_REF }}
-          lookup-only: true
 
-      - name: Checking if we have hostap in cache
+      - name: Download hostap repo
         if: steps.cache.outputs.cache-hit != 'true'
-        uses: actions/cache/restore@v4
+        uses: actions/download-artifact@v4
         with:
-          path: hostap
-          key: hostap-repo
-          fail-on-cache-miss: true
+          name: hostap-repo
+
+      - name: untar hostap
+        if: steps.cache.outputs.cache-hit != 'true'
+        run: tar -xf hostap.tgz
 
       - name: Checkout linux
         if: steps.cache.outputs.cache-hit != 'true'
@@ -126,6 +132,13 @@ jobs:
           cd linux
           yes "" | ARCH=um make -j $(nproc)
 
+      - name: Upload kernel binary
+        uses: actions/upload-artifact@v4
+        with:
+          name: uml-linux-kernel
+          path: linux/linux
+          retention-days: 1
+
   hostap_test:
     strategy:
       fail-fast: false
@@ -174,13 +187,14 @@ jobs:
     timeout-minutes: 45
     needs: [build_wolfssl, build_uml_linux, checkout_hostap]
     steps:
-      - name: Checking if we have kernel in cache
-        uses: actions/cache/restore@v4
-        id: cache
+      - name: Download kernel binary
+        uses: actions/download-artifact@v4
         with:
-          path: linux/linux
-          key: hostap-linux-${{ env.LINUX_REF }}
-          fail-on-cache-miss: true
+          name: uml-linux-kernel
+          path: linux
+
+      - name: Restore kernel binary executable bit
+        run: chmod +x linux/linux
 
         # No way to view the full strategy in the browser (really weird)
       - name: Print strategy
@@ -219,27 +233,18 @@ jobs:
       - name: Install pip dependencies
         run: sudo pip install pycryptodome
 
-      - name: Checking if we have hostap in cache
-        uses: actions/cache/restore@v4
+      - name: Download hostap repo
+        uses: actions/download-artifact@v4
         with:
-          path: hostap
-          key: hostap-repo
-          fail-on-cache-miss: true
+          name: hostap-repo
+
+      - name: untar hostap
+        run: tar -xf hostap.tgz
 
       - name: Checkout correct ref
         working-directory: hostap
         run: git checkout ${{ matrix.config.hostap_ref }}
 
-      - name: Update certs
-        working-directory: hostap/tests/hwsim/auth_serv
-        run: |
-          ./update.sh
-          ./sha512-generate.sh
-          # Force regeneration of rsa3072-ca.key to get rsa3072-generate.sh to
-          # correctly update all the certs
-          rm rsa3072-ca.key
-          ./rsa3072-generate.sh
-
       - if: ${{ matrix.config.osp_ref }}
         name: Checkout OSP
         uses: actions/checkout@v4
@@ -258,6 +263,20 @@ jobs:
             patch -p1 < $f
           done
 
+      - name: Update certs
+        working-directory: hostap/tests/hwsim/auth_serv
+        run: |
+          mkdir -p rootCA/newcerts
+          ./update.sh
+          ./ec-generate.sh
+          ./ec2-generate.sh
+          ./sha512-generate.sh
+          # Force regeneration of rsa3072-ca.key to get rsa3072-generate.sh to
+          # correctly update all the certs
+          rm rsa3072-ca.key
+          ./rsa3072-generate.sh
+          ./ica-generate.sh
+
       - name: Apply extra patches
         working-directory: hostap
         run: |

.github/workflows/multi-arch.yml

@@ -14,7 +14,7 @@ concurrency:
 
 jobs:
   my_matrix:
-    name: Multi-arch test
+    name: Multi-arch test (${{ matrix.ARCH }}, ${{ matrix.opts.name }})
     strategy:
       fail-fast: false
       matrix:
@@ -37,7 +37,20 @@ jobs:
             CFLAGS: -marm -DWOLFSSL_SP_ARM_ARCH=6
             ARCH: armel
             EXTRA_OPTS: --enable-sp-asm
-        opts: [ '-O2', '-O3', '-O1 -UFP_ECC', '-O0', '-Os', '-Ofast' ]
+        opts:
+          - name: '-O2'
+            OPT_CFLAGS: '-O2'
+          - name: '-O2 sp-math'
+            OPT_CFLAGS: '-O2'
+            OPT_EXTRA_OPTS: '--enable-sp-math'
+          - name: '-O1 -UFP_ECC'
+            OPT_CFLAGS: '-O1 -UFP_ECC'
+          - name: '-O0'
+            OPT_CFLAGS: '-O0'
+          - name: '-Os'
+            OPT_CFLAGS: '-Os'
+          - name: '-Ofast'
+            OPT_CFLAGS: '-Ofast'
     if: github.repository_owner == 'wolfssl'
     runs-on: ubuntu-22.04
     # This should be a safe limit for the tests to run.
@@ -48,12 +61,12 @@ jobs:
           sudo apt update
           sudo apt install -y crossbuild-essential-${{ matrix.ARCH }} qemu-user
       - uses: actions/checkout@v4
-      - name: Build for ${{ matrix.ARCH }} with Opt Level ${{ matrix.opts }}
+      - name: Build for ${{ matrix.ARCH }} with ${{ matrix.opts.name }}
         env:
             CC: ${{ matrix.CC }}
-            CFLAGS: ${{ matrix.CFLAGS }} ${{ matrix.opts }}
+            CFLAGS: ${{ matrix.CFLAGS }} ${{ matrix.opts.OPT_CFLAGS }}
             QEMU_LD_PREFIX: /usr/${{ matrix.HOST }}
-        run: ./autogen.sh && ./configure --host=${{ matrix.HOST }} --enable-all --disable-examples CPPFLAGS="-pedantic -Wdeclaration-after-statement -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -DWOLFCRYPT_TEST_LINT" ${{ matrix.EXTRA_OPTS }} && make
+        run: ./autogen.sh && ./configure --host=${{ matrix.HOST }} --enable-all --disable-examples CPPFLAGS="-pedantic -Wdeclaration-after-statement -Wnull-dereference -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -DWOLFCRYPT_TEST_LINT" ${{ matrix.EXTRA_OPTS }} ${{ matrix.opts.OPT_EXTRA_OPTS }} && make
       - name: Print errors
         if: ${{ failure() }}
         run: |

.github/workflows/multi-compiler.yml

@@ -51,7 +51,7 @@ jobs:
         env:
             CC: ${{ matrix.CC }}
             CXX: ${{ matrix.CXX }}
-        run: ./autogen.sh && ./configure CFLAGS="-pedantic -Wdeclaration-after-statement" && make && make dist
+        run: ./autogen.sh && ./configure CFLAGS="-pedantic -Wdeclaration-after-statement -Wnull-dereference" && make && make dist
       - name: Show log on errors
         if: ${{ failure() }}
         run: |

.github/workflows/no-malloc.yml

@@ -18,9 +18,9 @@ jobs:
       matrix:
         config: [
           # Add new configs here
-          '--enable-rsa --enable-keygen --disable-dh CFLAGS="-DWOLFSSL_NO_MALLOC -DRSA_MIN_SIZE=1024 -pedantic -Wdeclaration-after-statement -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
-          '--enable-ecc --enable-rsa --enable-keygen --enable-ed25519 --enable-curve25519 --enable-ed448 --enable-curve448 --enable-mlkem CFLAGS="-DWOLFSSL_NO_MALLOC -pedantic -Wdeclaration-after-statement -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
-          '--enable-ecc --enable-rsa --enable-keygen --enable-ed25519 --enable-curve25519 --enable-ed448 --enable-curve448 --enable-mlkem --enable-staticmemory CFLAGS="-DWOLFSSL_NO_MALLOC -pedantic -Wdeclaration-after-statement -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
+          '--enable-rsa --enable-keygen --disable-dh CFLAGS="-DWOLFSSL_NO_MALLOC -DRSA_MIN_SIZE=1024 -pedantic -Wdeclaration-after-statement -Wnull-dereference -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
+          '--enable-ecc --enable-rsa --enable-keygen --enable-ed25519 --enable-curve25519 --enable-ed448 --enable-curve448 --enable-mlkem CFLAGS="-DWOLFSSL_NO_MALLOC -pedantic -Wdeclaration-after-statement -Wnull-dereference -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
+          '--enable-ecc --enable-rsa --enable-keygen --enable-ed25519 --enable-curve25519 --enable-ed448 --enable-curve448 --enable-mlkem --enable-staticmemory CFLAGS="-DWOLFSSL_NO_MALLOC -pedantic -Wdeclaration-after-statement -Wnull-dereference -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
         ]
     name: make check
     if: github.repository_owner == 'wolfssl'

.github/workflows/no-tls.yml

@@ -18,7 +18,7 @@ jobs:
       matrix:
         config: [
           # Add new configs here
-          '--disable-tls --enable-all CFLAGS="-pedantic -Wdeclaration-after-statement -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
+          '--disable-tls --enable-all CFLAGS="-pedantic -Wdeclaration-after-statement -Wnull-dereference -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE"',
         ]
     name: make check
     if: github.repository_owner == 'wolfssl'