Optimize CI for wolfProvider #593
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: hostap and wpa supplicant Tests | |
| # START OF COMMON SECTION | |
| on: | |
| push: | |
| branches: [ 'master', 'main', 'release/**'] | |
| pull_request: | |
| branches: [ '*' ] | |
| types: [opened, synchronize, reopened, ready_for_review] | |
| paths-ignore: | |
| - '**.md' | |
| - 'docs/**' | |
| - 'LICENSE*' | |
| - '.github/ISSUE_TEMPLATE/**' | |
| - '.github/dependabot.yml' | |
| - '.gitignore' | |
| - 'AUTHORS' | |
| - 'COPYING' | |
| - 'README*' | |
| - 'CHANGELOG*' | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| # END OF COMMON SECTION | |
| jobs: | |
| wait_for_smoke: | |
| name: Wait for smoke | |
| if: github.event_name != 'pull_request' || github.event.pull_request.draft == false | |
| runs-on: ubuntu-22.04 | |
| timeout-minutes: 35 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 1 | |
| - uses: ./.github/actions/wait-for-smoke | |
| with: | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| build_wolfprovider: | |
| needs: wait_for_smoke | |
| if: github.event_name != 'pull_request' || github.event.pull_request.draft == false | |
| uses: ./.github/workflows/build-wolfprovider.yml | |
| with: | |
| wolfssl_ref: ${{ matrix.wolfssl_ref }} | |
| openssl_ref: ${{ matrix.openssl_ref }} | |
| fips_ref: ${{ matrix.fips_ref }} | |
| replace_default: ${{ matrix.replace_default }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| wolfssl_ref: [ 'v5.8.4-stable' ] | |
| openssl_ref: [ 'openssl-3.5.4' ] | |
| fips_ref: [ 'FIPS', 'non-FIPS' ] | |
| replace_default: [ true ] | |
| test_hostap: | |
| if: github.event_name != 'pull_request' || github.event.pull_request.draft == false | |
| runs-on: ubuntu-22.04 | |
| needs: build_wolfprovider | |
| # Run inside Debian Bookworm with privileged access for UML | |
| container: | |
| image: ghcr.io/${{ github.event.pull_request && github.event.pull_request.head.repo.owner.login || github.repository_owner }}/wolfprovider-test-deps:bookworm | |
| options: --privileged --cap-add=ALL -v /dev:/dev | |
| env: | |
| DEBIAN_FRONTEND: noninteractive | |
| # This should be a safe limit for the tests to run. | |
| timeout-minutes: 90 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| hostap_ref: [ 'main' ] | |
| wolfssl_ref: [ 'v5.8.4-stable' ] | |
| openssl_ref: [ 'openssl-3.5.4' ] | |
| fips_ref: [ 'FIPS', 'non-FIPS' ] | |
| replace_default: [ true ] | |
| # force_fail collapsed into sequential VM test rounds below | |
| env: | |
| WOLFSSL_PACKAGES_PATH: /tmp/wolfssl-packages | |
| OPENSSL_PACKAGES_PATH: /tmp/openssl-packages | |
| WOLFPROV_PACKAGES_PATH: /tmp/wolfprov-packages | |
| steps: | |
| # Checkout the source so we can run the check-workflow-result script. | |
| - name: Checkout wolfProvider | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 1 | |
| - name: Download packages from build job | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: debian-packages-${{ matrix.fips_ref }}${{ matrix.replace_default && '-replace-default' || '' }}-${{ matrix.wolfssl_ref }}-${{ matrix.openssl_ref }} | |
| path: /tmp | |
| - name: Install wolfSSL/OpenSSL/wolfprov packages | |
| run: | | |
| apt install --reinstall -y --allow-downgrades --allow-change-held-packages \ | |
| ${{ env.WOLFSSL_PACKAGES_PATH }}/libwolfssl_*.deb | |
| apt install --reinstall -y --allow-downgrades --allow-change-held-packages \ | |
| ${{ env.OPENSSL_PACKAGES_PATH }}/openssl_*.deb \ | |
| ${{ env.OPENSSL_PACKAGES_PATH }}/libssl3_*.deb \ | |
| ${{ env.OPENSSL_PACKAGES_PATH }}/libssl-dev_*.deb | |
| apt install --reinstall -y --allow-downgrades --allow-change-held-packages \ | |
| ${{ env.WOLFPROV_PACKAGES_PATH }}/libwolfprov_*.deb | |
| # Prevent later 'apt-get install' of test dependencies from | |
| # replacing the wolfprov-patched libssl3, which breaks | |
| # replace-default mode. | |
| apt-mark hold libssl3 libssl-dev openssl libwolfssl libwolfprov | |
| - name: Show OpenSSL version | |
| run: | | |
| echo "OpenSSL version:" | |
| openssl version -a || true | |
| - name: Test OpenSSL providers before hostap installation | |
| run: | | |
| echo "Testing OpenSSL providers before hostap installation..." | |
| openssl list -providers | |
| - name: Verify wolfProvider is properly installed | |
| run: | | |
| $GITHUB_WORKSPACE/scripts/verify-install.sh \ | |
| ${{ matrix.replace_default && '--replace-default' || '' }} \ | |
| ${{ matrix.fips_ref == 'FIPS' && '--fips' || '' }} | |
| - name: Install hostap-specific Python crypto module | |
| run: | | |
| # hostap test scripts need pip's cryptography, not the apt one. | |
| apt-get remove -y python3-cryptography 2>/dev/null || true | |
| pip install --no-cache-dir --force-reinstall --break-system-packages cryptography | |
| - name: Checkout hostap | |
| run: | | |
| test -d hostap || git clone https://w1.fi/hostap.git | |
| cd hostap/tests/hwsim/vm && git checkout inside.sh 2>/dev/null || true | |
| - name: Checkout OSP | |
| uses: actions/checkout@v4 | |
| with: | |
| repository: wolfssl/osp | |
| path: osp | |
| fetch-depth: 1 | |
| - name: Apply hostap patches for wolfProvider | |
| run: | | |
| cd hostap | |
| patch -p1 < "$GITHUB_WORKSPACE/osp/wolfProvider/hostap/hostap-${{ matrix.hostap_ref }}-wolfprov.patch" | |
| - name: Checkout linux | |
| uses: actions/checkout@v4 | |
| with: | |
| repository: torvalds/linux | |
| path: linux | |
| ref: master | |
| - name: Compile linux | |
| run: | | |
| cp $GITHUB_WORKSPACE/hostap/tests/hwsim/vm/kernel-config.uml linux/.config | |
| cd linux | |
| yes "" | ARCH=um make -j $(nproc) | |
| - name: Update config | |
| working-directory: hostap/tests/hwsim | |
| run: | | |
| cat << EOF >> example-hostapd.config | |
| CFLAGS += -I/usr/include/openssl | |
| LDFLAGS += -L/usr/lib/x86_64-linux-gnu | |
| LIBS += -lssl -lcrypto | |
| EOF | |
| cat << EOF >> example-wpa_supplicant.config | |
| CFLAGS += -I/usr/include/openssl | |
| LDFLAGS += -L/usr/lib/x86_64-linux-gnu | |
| LIBS += -lssl -lcrypto | |
| EOF | |
| # The non-WPFF env writes vm/inside.sh without WOLFPROV_FORCE_FAIL=1. | |
| # The WPFF round below re-writes vm/inside.sh with that export added. | |
| - name: Setup non-WPFF environment (round 1) | |
| working-directory: hostap/tests/hwsim | |
| run: | | |
| cd vm && git checkout inside.sh 2>/dev/null || true && cd .. | |
| sed -i '115 r /dev/stdin' vm/inside.sh <<'ENVEOF' | |
| cat > /tmp/bin/halt << 'HALTEOF' | |
| #!/bin/sh | |
| sync | |
| exit 0 | |
| HALTEOF | |
| chmod +x /tmp/bin/halt | |
| OPENSSL_MODULES_PATH=$(find /usr -name "libwolfprov.so" -exec dirname {} \; 2>/dev/null | head -1) | |
| [ -n "$OPENSSL_MODULES_PATH" ] && export OPENSSL_MODULES="$OPENSSL_MODULES_PATH" | |
| export OPENSSL_CONF="/etc/ssl/openssl.cnf" | |
| export CRYPTOGRAPHY_OPENSSL_NO_LEGACY=1 | |
| ENVEOF | |
| - name: Update certs | |
| working-directory: hostap/tests/hwsim/auth_serv | |
| run: ./update.sh | |
| - name: Build hostap and wpa_supplicant | |
| working-directory: hostap/tests/hwsim/ | |
| run: ./build.sh | |
| - name: Verify openssl binaries linked | |
| working-directory: hostap | |
| run: | | |
| ldd hostapd/hostapd | grep ssl | |
| ldd wpa_supplicant/wpa_supplicant | grep ssl | |
| - name: Run focused tests (normal mode) | |
| id: testing | |
| working-directory: hostap/tests/hwsim/ | |
| run: | | |
| set +e | |
| echo "KERNELDIR=$GITHUB_WORKSPACE/linux" >> vm/vm-config | |
| # Run smoke tests | |
| SMOKE_TESTS="ap_open ap_wpa2_psk discovery" | |
| rm -rf /tmp/hwsim-test-logs | |
| timeout 3m ./vm/parallel-vm.py --nocurses $(nproc) $SMOKE_TESTS || SMOKE_RES=$? | |
| # Run EAP tests (excluding MSCHAPv2 - requires MD4/DES not in wolfSSL) | |
| TLS_EAP_TESTS="ap_wpa2_eap_tls ap_wpa2_eap_ttls_eap_gtc ap_wpa2_eap_peap_eap_tls" | |
| timeout 5m ./vm/parallel-vm.py --nocurses $(nproc) $TLS_EAP_TESTS || TLS_RES=$? | |
| # Evaluate results | |
| FINAL_RES=0 | |
| if [ "${SMOKE_RES:-0}" -ne "0" ] || [ "${TLS_RES:-0}" -ne "0" ]; then | |
| FINAL_RES=1 | |
| fi | |
| # Ignore NOT-FOUND errors (test files missing/require special params) | |
| NOT_FOUND=$(grep -h "NOT-FOUND" /tmp/hwsim-test-logs/*-parallel.log 2>/dev/null | wc -l || echo "0") | |
| REAL_FAILS=$(grep -h "Failed:" /tmp/hwsim-test-logs/*-parallel.log 2>/dev/null | grep -v "NOT-FOUND" | wc -l || echo "0") | |
| if [ "$FINAL_RES" -ne "0" ] && [ "$REAL_FAILS" -eq "0" ] && [ "$NOT_FOUND" -gt "0" ]; then | |
| FINAL_RES=0 | |
| fi | |
| if [ $FINAL_RES -eq 0 ]; then | |
| echo "✓ SUCCESS: wolfProvider tests passed" | |
| exit 0 | |
| else | |
| echo "✗ FAILURE: wolfProvider tests failed" | |
| exit 1 | |
| fi | |
| - name: Setup WPFF environment (round 2) | |
| working-directory: hostap/tests/hwsim | |
| run: | | |
| cd vm && git checkout inside.sh 2>/dev/null || true && cd .. | |
| sed -i '115 r /dev/stdin' vm/inside.sh <<'ENVEOF' | |
| cat > /tmp/bin/halt << 'HALTEOF' | |
| #!/bin/sh | |
| sync | |
| exit 0 | |
| HALTEOF | |
| chmod +x /tmp/bin/halt | |
| OPENSSL_MODULES_PATH=$(find /usr -name "libwolfprov.so" -exec dirname {} \; 2>/dev/null | head -1) | |
| [ -n "$OPENSSL_MODULES_PATH" ] && export OPENSSL_MODULES="$OPENSSL_MODULES_PATH" | |
| export OPENSSL_CONF="/etc/ssl/openssl.cnf" | |
| export CRYPTOGRAPHY_OPENSSL_NO_LEGACY=1 | |
| export WOLFPROV_FORCE_FAIL=1 | |
| ENVEOF | |
| - name: Run focused tests (force-fail mode) | |
| working-directory: hostap/tests/hwsim/ | |
| run: | | |
| set +e | |
| SMOKE_RES=0 | |
| TLS_RES=0 | |
| SMOKE_TESTS="ap_open ap_wpa2_psk discovery" | |
| rm -rf /tmp/hwsim-test-logs | |
| timeout 3m ./vm/parallel-vm.py --nocurses $(nproc) $SMOKE_TESTS || SMOKE_RES=$? | |
| TLS_EAP_TESTS="ap_wpa2_eap_tls ap_wpa2_eap_ttls_eap_gtc ap_wpa2_eap_peap_eap_tls" | |
| timeout 5m ./vm/parallel-vm.py --nocurses $(nproc) $TLS_EAP_TESTS || TLS_RES=$? | |
| FINAL_RES=0 | |
| if [ "${SMOKE_RES:-0}" -ne "0" ] || [ "${TLS_RES:-0}" -ne "0" ]; then | |
| FINAL_RES=1 | |
| fi | |
| WPA_CONNECT_FAILS=$(grep -h "Could not connect to /tmp/wpas" /tmp/hwsim-test-logs/*-parallel.log 2>/dev/null | wc -l || echo "0") | |
| # With force fail, we expect failures or connection issues | |
| if [ $FINAL_RES -ne 0 ] || [ "$WPA_CONNECT_FAILS" -gt "0" ]; then | |
| echo "✓ EXPECTED: Tests failed/crashed with WOLFPROV_FORCE_FAIL=1" | |
| exit 0 | |
| else | |
| echo "✗ UNEXPECTED: Tests passed with WOLFPROV_FORCE_FAIL=1" | |
| exit 1 | |
| fi |