Re-enable hostap tests and remove some flaky tests

ALL should not include NULL ciphersuites. Those need to be enabled explicitly.

.github/workflows/hostap-files/configs/07c9f183ea744ac04585fb6dd10220c75a5e2e74/tests

@@ -248,9 +248,6 @@ ap_wpa2_eap_tls_check_cert_subject_neg
 ap_wpa2_eap_tls_diff_ca_trust2
 ap_wpa2_eap_tls_domain_mismatch_cn
 ap_wpa2_eap_tls_domain_suffix_mismatch_cn
-ap_wpa2_eap_tls_intermediate_ca_ocsp_multi_missing_resp
-ap_wpa2_eap_tls_intermediate_ca_ocsp_revoked_sha1
-ap_wpa2_eap_tls_intermediate_ca_ocsp_sha1
 ap_wpa2_eap_tls_neg_incorrect_trust_root
 ap_wpa2_eap_tls_ocsp_multi
 ap_wpa2_eap_tls_ocsp_multi_revoked
@@ -649,9 +646,6 @@ dpp_config_dpp_gen_secp521r1
 dpp_config_dpp_gen_secp521r1_prime256v1
 dpp_config_dpp_gen_secp521r1_secp384r1
 dpp_config_dpp_gen_secp521r1_secp521r1
-dpp_config_dpp_override_prime256v1
-dpp_config_dpp_override_secp384r1
-dpp_config_dpp_override_secp521r1
 dpp_config_error_legacy_invalid_psk
 dpp_config_error_legacy_no_pass
 dpp_config_error_legacy_no_pass_for_sae
@@ -691,7 +685,6 @@ dpp_config_no_discovery
 dpp_config_no_discovery_ssid
 dpp_config_no_signed_connector
 dpp_config_no_wi_fi_tech
-dpp_config_override_objects
 dpp_config_root_not_an_object
 dpp_config_save
 dpp_config_save2
@@ -748,12 +741,6 @@ dpp_hostapd_configurator_enrollee_v1
 dpp_hostapd_configurator_fragmentation
 dpp_hostapd_configurator_override_objects
 dpp_hostapd_configurator_responder
-dpp_hostapd_enrollee_fragmentation
-dpp_hostapd_enrollee_gas_errors
-dpp_hostapd_enrollee_gas_proto
-dpp_hostapd_enrollee_gas_timeout
-dpp_hostapd_enrollee_gas_timeout_comeback
-dpp_hostapd_enrollee_gas_tx_status_errors
 dpp_intro_mismatch
 dpp_invalid_configurator_key
 dpp_invalid_legacy_params
@@ -906,10 +893,6 @@ dpp_qr_code_auth_incompatible_roles2
 dpp_qr_code_auth_incompatible_roles_failure
 dpp_qr_code_auth_incompatible_roles_failure2
 dpp_qr_code_auth_incompatible_roles_failure3
-dpp_qr_code_auth_initiator_either_1
-dpp_qr_code_auth_initiator_either_2
-dpp_qr_code_auth_initiator_either_3
-dpp_qr_code_auth_initiator_enrollee
 dpp_qr_code_auth_mutual
 dpp_qr_code_auth_mutual2
 dpp_qr_code_auth_mutual_bp_256

.github/workflows/hostap-files/configs/b607d2723e927a3446d89aed813f1aa6068186bb/tests

@@ -347,7 +347,6 @@ ap_wpa2_eap_tls_ocsp_server_signed
 ap_wpa2_eap_tls_ocsp_invalid_data
 ap_wpa2_eap_tls_ocsp_invalid
 ap_wpa2_eap_tls_ocsp_unknown_sign
-ap_wpa2_eap_tls_intermediate_ca
 ap_wpa2_eap_tls_ocsp_multi_revoked
 ap_wpa2_eap_tls_domain_suffix_match_cn_full
 ap_wpa2_eap_tls_domain_match_cn
@@ -461,9 +460,6 @@ dpp_qr_code_auth_mutual_not_used
 dpp_qr_code_auth_mutual_curve_mismatch
 dpp_qr_code_auth_hostapd_mutual2
 dpp_qr_code_listen_continue
-dpp_qr_code_auth_initiator_enrollee
-dpp_qr_code_auth_initiator_either_2
-dpp_qr_code_auth_initiator_either_3
 dpp_config_legacy
 dpp_config_legacy_psk_hex
 dpp_config_fragmentation
@@ -475,9 +471,6 @@ dpp_config_dpp_gen_secp521r1
 dpp_config_dpp_gen_expiry
 dpp_config_dpp_gen_expired_key
 dpp_config_dpp_gen_3rd_party
-dpp_config_dpp_override_prime256v1
-dpp_config_dpp_override_secp384r1
-dpp_config_override_objects
 dpp_config_signed_connector_error_no_dot_1
 dpp_config_signed_connector_error_no_dot_2
 dpp_config_signed_connector_error_unexpected_signature_len
@@ -579,12 +572,6 @@ dpp_pkex_nak_curve_change2
 dpp_hostapd_configurator
 dpp_hostapd_configurator_responder
 dpp_hostapd_configurator_fragmentation
-dpp_hostapd_enrollee_fragmentation
-dpp_hostapd_enrollee_gas_timeout
-dpp_hostapd_enrollee_gas_timeout_comeback
-dpp_hostapd_enrollee_gas_errors
-dpp_hostapd_enrollee_gas_proto
-dpp_hostapd_enrollee_gas_tx_status_errors
 dpp_hostapd_configurator_override_objects
 dpp_own_config
 dpp_own_config_group_id

.github/workflows/hostap-vm.yml

@@ -2,14 +2,10 @@ name: hostap and wpa-supplicant Tests
 
 # START OF COMMON SECTION
 on:
-    workflow_dispatch: # Allows people to run it manually if they want but
-                       # disables it from running automatically when broken
-# To restore this to an auto test delete the above workflow_dispatch line and
-# comments and uncomment the below lines for push and pull_request
-#  push:
-#    branches: [ 'master', 'main', 'release/**' ]
-#  pull_request:
-#    branches: [ '*' ]
+  push:
+    branches: [ 'master', 'main', 'release/**' ]
+  pull_request:
+    branches: [ '*' ]
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -232,16 +228,6 @@ jobs:
         working-directory: hostap
         run: git checkout ${{ matrix.config.hostap_ref }}
 
-      - name: Update certs
-        working-directory: hostap/tests/hwsim/auth_serv
-        run: |
-          ./update.sh
-          ./sha512-generate.sh
-          # Force regeneration of rsa3072-ca.key to get rsa3072-generate.sh to
-          # correctly update all the certs
-          rm rsa3072-ca.key
-          ./rsa3072-generate.sh
-
       - if: ${{ matrix.config.osp_ref }}
         name: Checkout OSP
         uses: actions/checkout@v4
@@ -259,6 +245,20 @@ jobs:
             patch -p1 < $f
           done
 
+      - name: Update certs
+        working-directory: hostap/tests/hwsim/auth_serv
+        run: |
+          mkdir -p rootCA/newcerts
+          ./update.sh
+          ./ec-generate.sh
+          ./ec2-generate.sh
+          ./sha512-generate.sh
+          # Force regeneration of rsa3072-ca.key to get rsa3072-generate.sh to
+          # correctly update all the certs
+          rm rsa3072-ca.key
+          ./rsa3072-generate.sh
+          ./ica-generate.sh
+
       - name: Apply extra patches
         working-directory: hostap
         run: |

scripts/openssl.test

@@ -263,9 +263,9 @@ start_wolfssl_server() {
         echo -e "\n# Trying to start $wolfssl_suite wolfSSL server on port $server_port..."
 
         echo "#"
-        echo "# $WOLFSSL_SERVER -p $server_port -g -v d -x -i $psk $crl -l ALL \"$wolfssl_cert\" \"$wolfssl_key\" \"$wolfssl_caCert\""
+        echo "# $WOLFSSL_SERVER -p $server_port -g -v d -x -i $psk $crl -l ALL:eNULL \"$wolfssl_cert\" \"$wolfssl_key\" \"$wolfssl_caCert\""
         # shellcheck disable=SC2086
-        $WOLFSSL_SERVER -p "$server_port" -g -v d -x -i $psk $crl -l ALL "$wolfssl_cert" "$wolfssl_key" "$wolfssl_caCert" &
+        $WOLFSSL_SERVER -p "$server_port" -g -v d -x -i $psk $crl -l ALL:eNULL "$wolfssl_cert" "$wolfssl_key" "$wolfssl_caCert" &
         server_pid=$!
         # wait to see if server successfully starts before continuing
         sleep 0.1

src/internal.c

@@ -28751,6 +28751,7 @@ static int ParseCipherList(Suites* suites,
                 haveRSA, 1, 1, !haveRSA, 1, haveRSA, !haveRSA, 0, 0, 1,
                 1, 1, side
         );
+        suites->setSuites = 1;
         return 1; /* wolfSSL default */
     }