From bc949e5b9c53856d5b7bf6fe193bd4dfadd43ed9 Mon Sep 17 00:00:00 2001
From: Aidan Garske <aidan@wolfssl.com>
Date: Fri, 4 Jul 2025 12:39:18 -0700
Subject: [PATCH 1/3] FIPS support for scripts tests and AES cmd test fix

---
 .github/workflows/simple.yml      |  2 +-
 scripts/cmd_test/aes-cmd-test.sh  | 44 +++++++++++-----
 scripts/cmd_test/do-cmd-tests.sh  | 39 +++++++++++---
 scripts/cmd_test/ecc-cmd-test.sh  | 22 +++++---
 scripts/cmd_test/hash-cmd-test.sh | 22 +++++---
 scripts/cmd_test/rsa-cmd-test.sh  | 22 +++++---
 scripts/test-openssl.sh           | 85 ++++++++++++++++++++-----------
 scripts/test-sanity.sh            | 22 ++++++++
 scripts/test-wp-cs.sh             | 53 +++++++++++++++++--
 9 files changed, 237 insertions(+), 74 deletions(-)

diff --git a/.github/workflows/simple.yml b/.github/workflows/simple.yml
index 8530c90b..e54c78df 100644
--- a/.github/workflows/simple.yml
+++ b/.github/workflows/simple.yml
@@ -50,7 +50,7 @@ jobs:
 
       - name: Run simple tests
         run: |
-          ./scripts/cmd_test/do-cmd-tests.sh ${{ matrix.force_fail }}
+          ${{ matrix.force_fail }} ./scripts/cmd_test/do-cmd-tests.sh
 
       - name: Print test logs
         if: always()
diff --git a/scripts/cmd_test/aes-cmd-test.sh b/scripts/cmd_test/aes-cmd-test.sh
index d9da1b12..15acd14f 100755
--- a/scripts/cmd_test/aes-cmd-test.sh
+++ b/scripts/cmd_test/aes-cmd-test.sh
@@ -33,19 +33,29 @@ source "${UTILS_DIR}/utils-openssl.sh"
 source "${UTILS_DIR}/utils-wolfssl.sh"
 source "${UTILS_DIR}/utils-wolfprovider.sh"
 
-# Initialize the environment
-init_wolfprov
+# Initialize wolfProvider without WPFF set
+if [ "${WOLFPROV_FORCE_FAIL}" = "1" ]; then
+    unset WOLFPROV_FORCE_FAIL
+    init_wolfprov
+    export WOLFPROV_FORCE_FAIL=1
+else 
+    init_wolfprov
+fi
 
 # Fail flags
 FAIL=0
 FORCE_FAIL=0
 FORCE_FAIL_PASSED=0
+FIPS=0
 
-# Check for force fail parameter
-if [ "$1" = "WOLFPROV_FORCE_FAIL=1" ]; then
-    export WOLFPROV_FORCE_FAIL=1
+# Get the force fail parameter
+if [ "${WOLFPROV_FORCE_FAIL}" = "1" ]; then
+    echo "Force fail mode enabled for AES tests"
     FORCE_FAIL=1
-    echo -e "\nForce fail mode enabled for AES tests"
+fi
+if [ "${WOLFSSL_ISFIPS}" = "1" ]; then
+    echo "FIPS mode enabled for AES tests"
+    FIPS=1
 fi
 
 # Verify wolfProvider is properly loaded
@@ -80,7 +90,12 @@ check_force_fail() {
 # Arrays for test configurations
 KEY_SIZES=("128" "192" "256")
 # Only include modes supported by wolfProvider
-MODES=("ecb" "cbc" "ctr" "cfb")
+if [ $FIPS -eq 1 ]; then
+    MODES=("ecb" "cbc" "ctr")
+    echo "FIPS mode detected - excluding CFB mode"
+else
+    MODES=("ecb" "cbc" "ctr" "cfb")
+fi
 
 echo "=== Running AES Algorithm Comparisons ==="
 
@@ -90,11 +105,14 @@ for key_size in "${KEY_SIZES[@]}"; do
         echo -e "\n=== Testing AES-${key_size}-${mode} ==="
         
         # Generate random key and IV
-        key=$($OPENSSL_BIN rand -hex $((key_size/8)))
+        key=$($OPENSSL_BIN rand -hex $((key_size/8)) 2>/dev/null | tail -n 1 | tr -d '\n')
         iv=""
         if [ "$mode" != "ecb" ]; then
-            iv="-iv $($OPENSSL_BIN rand -hex 16)"
+            iv_value=$($OPENSSL_BIN rand -hex 16 2>/dev/null | tail -n 1 | tr -d '\n')
+            iv="-iv $iv_value"
         fi
+        echo "DEBUG: Key='$key' (length: ${#key})"
+        echo "DEBUG: IV='$iv'"
         
         # Output files
         enc_file="aes_outputs/aes${key_size}_${mode}.enc"
@@ -104,14 +122,14 @@ for key_size in "${KEY_SIZES[@]}"; do
         echo "Interop testing (encrypt with default, decrypt with wolfProvider):"
         
         # Encryption with OpenSSL default provider
-        if ! $OPENSSL_BIN enc -aes-${key_size}-${mode} -K $key $iv -provider default \
+        if ! $OPENSSL_BIN enc -aes-${key_size}-${mode} -K "$key" $iv -provider default \
             -in test.txt -out "$enc_file" -p; then
             echo "[FAIL] Interop AES-${key_size}-${mode}: OpenSSL encrypt failed"
             FAIL=1
         fi
         
         # Decryption with wolfProvider
-        if ! $OPENSSL_BIN enc -aes-${key_size}-${mode} -K $key $iv -provider-path $WOLFPROV_PATH -provider libwolfprov \
+        if ! $OPENSSL_BIN enc -aes-${key_size}-${mode} -K "$key" $iv -provider-path "$WOLFPROV_PATH" -provider libwolfprov \
             -in "$enc_file" -out "$dec_file" -d -p; then
             echo "[FAIL] Interop AES-${key_size}-${mode}: wolfProvider decrypt failed"
             FAIL=1
@@ -133,14 +151,14 @@ for key_size in "${KEY_SIZES[@]}"; do
         echo "Interop testing (encrypt with wolfProvider, decrypt with default):"
         
         # Encryption with wolfProvider
-        if ! $OPENSSL_BIN enc -aes-${key_size}-${mode} -K $key $iv -provider-path $WOLFPROV_PATH -provider libwolfprov \
+        if ! $OPENSSL_BIN enc -aes-${key_size}-${mode} -K "$key" $iv -provider-path "$WOLFPROV_PATH" -provider libwolfprov \
             -in test.txt -out "$enc_file" -p; then
             echo "[FAIL] Interop AES-${key_size}-${mode}: wolfProvider encrypt failed"
             FAIL=1
         fi
         
         # Decryption with OpenSSL default provider
-        if ! $OPENSSL_BIN enc -aes-${key_size}-${mode} -K $key $iv -provider default \
+        if ! $OPENSSL_BIN enc -aes-${key_size}-${mode} -K "$key" $iv -provider default \
             -in "$enc_file" -out "$dec_file" -d -p; then
             echo "[FAIL] Interop AES-${key_size}-${mode}: OpenSSL decrypt failed"
             FAIL=1
diff --git a/scripts/cmd_test/do-cmd-tests.sh b/scripts/cmd_test/do-cmd-tests.sh
index 96886203..ed43fc58 100755
--- a/scripts/cmd_test/do-cmd-tests.sh
+++ b/scripts/cmd_test/do-cmd-tests.sh
@@ -20,11 +20,18 @@
 # along with this program; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
 
-# Get the force fail parameter
 FORCE_FAIL=0
-if [ "$1" = "WOLFPROV_FORCE_FAIL=1" ]; then
+FIPS=0
+
+# Get the force fail parameter
+if [ "${WOLFPROV_FORCE_FAIL}" = "1" ]; then
+    echo "Force fail mode enabled for all tests"
     FORCE_FAIL=1
 fi
+if [ "${WOLFSSL_ISFIPS}" = "1" ]; then
+    echo "FIPS mode enabled for all tests"
+    FIPS=1
+fi
 
 # Get the directory where this script is located
 SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
@@ -57,30 +64,46 @@ echo "Using wolfSSL version: ${WOLFSSL_TAG}"
 
 # Run the hash comparison test
 echo -e "\n=== Running Hash Comparison Test ==="
-"${REPO_ROOT}/scripts/cmd_test/hash-cmd-test.sh" "$1"
+"${REPO_ROOT}/scripts/cmd_test/hash-cmd-test.sh"
 HASH_RESULT=$?
 
 # Run the AES comparison test
 echo -e "\n=== Running AES Comparison Test ==="
-"${REPO_ROOT}/scripts/cmd_test/aes-cmd-test.sh" "$1"
+"${REPO_ROOT}/scripts/cmd_test/aes-cmd-test.sh"
 AES_RESULT=$?
 
 # Run the RSA key generation test
 echo -e "\n=== Running RSA Key Generation Test ==="
-"${REPO_ROOT}/scripts/cmd_test/rsa-cmd-test.sh" "$1"
+"${REPO_ROOT}/scripts/cmd_test/rsa-cmd-test.sh"
 RSA_RESULT=$?
 
 # Run the ECC key generation test
 echo -e "\n=== Running ECC Key Generation Test ==="
-"${REPO_ROOT}/scripts/cmd_test/ecc-cmd-test.sh" "$1"
+"${REPO_ROOT}/scripts/cmd_test/ecc-cmd-test.sh"
 ECC_RESULT=$?
 
 # Check results
 if [ $HASH_RESULT -eq 0 ] && [ $AES_RESULT -eq 0 ] && [ $RSA_RESULT -eq 0 ] && [ $ECC_RESULT -eq 0 ]; then
-    echo -e "\n=== All Command-Line Tests Passed $1 ==="
+    echo -e "\n=== All Command-Line Tests Passed ==="
+    if [ $FORCE_FAIL -eq 1 ]; then
+        echo "Force fail mode was enabled"
+    fi
+    if [ $FIPS -eq 1 ]; then
+        echo "FIPS mode was enabled"
+    fi
+    echo "Hash Test Result: $HASH_RESULT (0=success)"
+    echo "AES Test Result: $AES_RESULT (0=success)"
+    echo "RSA Test Result: $RSA_RESULT (0=success)"
+    echo "ECC Test Result: $ECC_RESULT (0=success)"
     exit 0
 else
-    echo -e "\n=== Command-Line Tests Failed $1 ==="
+    echo -e "\n=== Command-Line Tests Failed ==="
+    if [ $FORCE_FAIL -eq 1 ]; then
+        echo "Force fail mode was enabled"
+    fi
+    if [ $FIPS -eq 1 ]; then
+        echo "FIPS mode was enabled"
+    fi
     echo "Hash Test Result: $HASH_RESULT (0=success)"
     echo "AES Test Result: $AES_RESULT (0=success)"
     echo "RSA Test Result: $RSA_RESULT (0=success)"
diff --git a/scripts/cmd_test/ecc-cmd-test.sh b/scripts/cmd_test/ecc-cmd-test.sh
index 9d0e80b6..dace1565 100755
--- a/scripts/cmd_test/ecc-cmd-test.sh
+++ b/scripts/cmd_test/ecc-cmd-test.sh
@@ -33,19 +33,29 @@ source "${UTILS_DIR}/utils-openssl.sh"
 source "${UTILS_DIR}/utils-wolfssl.sh"
 source "${UTILS_DIR}/utils-wolfprovider.sh"
 
-# Initialize the environment
-init_wolfprov
+# Initialize wolfProvider without WPFF set
+if [ "${WOLFPROV_FORCE_FAIL}" = "1" ]; then
+    unset WOLFPROV_FORCE_FAIL
+    init_wolfprov
+    export WOLFPROV_FORCE_FAIL=1
+else 
+    init_wolfprov
+fi
 
 # Fail flags
 FAIL=0
 FORCE_FAIL=0
 FORCE_FAIL_PASSED=0
+FIPS=0
 
-# Check for force fail parameter
-if [ "$1" = "WOLFPROV_FORCE_FAIL=1" ]; then
-    export WOLFPROV_FORCE_FAIL=1
+# Get the force fail parameter
+if [ "${WOLFPROV_FORCE_FAIL}" = "1" ]; then
+    echo "Force fail mode enabled for ECC tests"
     FORCE_FAIL=1
-    echo -e "\nForce fail mode enabled for ECC tests"
+fi
+if [ "${WOLFSSL_ISFIPS}" = "1" ]; then
+    echo "FIPS mode enabled for ECC tests"
+    FIPS=1
 fi
 
 # Verify wolfProvider is properly loaded
diff --git a/scripts/cmd_test/hash-cmd-test.sh b/scripts/cmd_test/hash-cmd-test.sh
index e8ea03fc..bd6c7957 100755
--- a/scripts/cmd_test/hash-cmd-test.sh
+++ b/scripts/cmd_test/hash-cmd-test.sh
@@ -33,19 +33,29 @@ source "${UTILS_DIR}/utils-openssl.sh"
 source "${UTILS_DIR}/utils-wolfssl.sh"
 source "${UTILS_DIR}/utils-wolfprovider.sh"
 
-# Initialize the environment
-init_wolfprov
+# Initialize wolfProvider without WPFF set
+if [ "${WOLFPROV_FORCE_FAIL}" = "1" ]; then
+    unset WOLFPROV_FORCE_FAIL
+    init_wolfprov
+    export WOLFPROV_FORCE_FAIL=1
+else 
+    init_wolfprov
+fi
 
 # Fail flags
 FAIL=0
 FORCE_FAIL=0
 FORCE_FAIL_PASSED=0
+FIPS=0
 
-# Check for force fail parameter
-if [ "$1" = "WOLFPROV_FORCE_FAIL=1" ]; then
-    export WOLFPROV_FORCE_FAIL=1
+# Get the force fail parameter
+if [ "${WOLFPROV_FORCE_FAIL}" = "1" ]; then
+    echo "Force fail mode enabled for Hash tests"
     FORCE_FAIL=1
-    echo -e "\nForce fail mode enabled for hash tests"
+fi
+if [ "${WOLFSSL_ISFIPS}" = "1" ]; then
+    echo "FIPS mode enabled for Hash tests"
+    FIPS=1
 fi
 
 # Verify wolfProvider is properly loaded
diff --git a/scripts/cmd_test/rsa-cmd-test.sh b/scripts/cmd_test/rsa-cmd-test.sh
index d6feb311..6cf8fd80 100755
--- a/scripts/cmd_test/rsa-cmd-test.sh
+++ b/scripts/cmd_test/rsa-cmd-test.sh
@@ -33,19 +33,29 @@ source "${UTILS_DIR}/utils-openssl.sh"
 source "${UTILS_DIR}/utils-wolfssl.sh"
 source "${UTILS_DIR}/utils-wolfprovider.sh"
 
-# Initialize the environment
-init_wolfprov
+# Initialize wolfProvider without WPFF set
+if [ "${WOLFPROV_FORCE_FAIL}" = "1" ]; then
+    unset WOLFPROV_FORCE_FAIL
+    init_wolfprov
+    export WOLFPROV_FORCE_FAIL=1
+else 
+    init_wolfprov
+fi
 
 # Fail flags
 FAIL=0
 FORCE_FAIL=0
 FORCE_FAIL_PASSED=0
+FIPS=0
 
-# Check for force fail parameter
-if [ "$1" = "WOLFPROV_FORCE_FAIL=1" ]; then
-    export WOLFPROV_FORCE_FAIL=1
+# Get the force fail parameter
+if [ "${WOLFPROV_FORCE_FAIL}" = "1" ]; then
+    echo "Force fail mode enabled for RSA tests"
     FORCE_FAIL=1
-    echo -e "\nForce fail mode enabled for RSA tests"
+fi
+if [ "${WOLFSSL_ISFIPS}" = "1" ]; then
+    echo "FIPS mode enabled for RSA tests"
+    FIPS=1
 fi
 
 # Verify wolfProvider is properly loaded
diff --git a/scripts/test-openssl.sh b/scripts/test-openssl.sh
index 08445b92..5f5ef8c3 100755
--- a/scripts/test-openssl.sh
+++ b/scripts/test-openssl.sh
@@ -16,16 +16,16 @@
 #
 # You should have received a copy of the GNU General Public License
 # along with wolfProvider. If not, see <http://www.gnu.org/licenses/>.
-#
-
-# Execute this script from: wolfProvider
-#set -e
 
 SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
 NUMCPU=${NUMCPU:-8}
 WOLFPROV_DEBUG=${WOLFPROV_DEBUG:-0}
 source ${SCRIPT_DIR}/utils-wolfprovider.sh
 
+if [ "${WOLFSSL_ISFIPS}" = "1" ]; then
+    echo "FIPS mode enabled for openssl tests"
+fi
+
 do_cleanup() {
     echo "Cleanup"
 }
@@ -93,32 +93,57 @@ trap do_trap INT TERM
 
 evp_test_run() {
     printf "\tTesting with evp_test:\n"
-    EVP_TESTS=(
-        evpciph_aes_ccm_cavs.txt
-        evpciph_aes_common.txt
-        evpciph_aes_wrap.txt
-        evpencod.txt
-        evpkdf_hkdf.txt
-        evpkdf_pbkdf2.txt
-        evpkdf_tls11_prf.txt
-        evpkdf_tls12_prf.txt
-        evpkdf_tls13_kdf.txt
-        evpmac_common.txt
-        evpmd_md.txt
-        evpmd_sha.txt
-        evppbe_pbkdf2.txt
-        evppbe_pkcs12.txt
-        evppkey_dh.txt
-        evppkey_ecc.txt
-        evppkey_ecdh.txt
-        evppkey_ecdsa.txt
-        evppkey_ecx.txt
-        evppkey_ffdhe.txt
-        evppkey_kas.txt
-        evppkey_kdf_hkdf.txt
-        evppkey_kdf_tls1_prf.txt
-        evppkey_mismatch.txt
-    )
+    
+    # FIPS-approved evp tests - exclude non-FIPS algorithms in FIPS mode
+    if [ "${WOLFSSL_ISFIPS}" = "1" ]; then
+        echo "FIPS mode enabled - using FIPS-approved evp tests only"
+        EVP_TESTS=(
+            evpciph_aes_ccm_cavs.txt
+            evpciph_aes_common.txt
+            evpkdf_hkdf.txt
+            evpkdf_pbkdf2.txt
+            evpkdf_tls12_prf.txt
+            evpkdf_tls13_kdf.txt
+            evpmac_common.txt
+            evpmd_sha.txt
+            evppbe_pbkdf2.txt
+            evppkey_ecc.txt
+            evppkey_ecdh.txt
+            evppkey_ecdsa.txt
+            evppkey_ffdhe.txt
+            evppkey_kas.txt
+            evppkey_kdf_hkdf.txt
+            evppkey_kdf_tls1_prf.txt
+        )
+    else
+        echo "Normal mode - using all evp tests"
+        EVP_TESTS=(
+            evpciph_aes_ccm_cavs.txt
+            evpciph_aes_common.txt
+            evpciph_aes_wrap.txt
+            evpencod.txt
+            evpkdf_hkdf.txt
+            evpkdf_pbkdf2.txt
+            evpkdf_tls11_prf.txt
+            evpkdf_tls12_prf.txt
+            evpkdf_tls13_kdf.txt
+            evpmac_common.txt
+            evpmd_md.txt
+            evpmd_sha.txt
+            evppbe_pbkdf2.txt
+            evppbe_pkcs12.txt
+            evppkey_dh.txt
+            evppkey_ecc.txt
+            evppkey_ecdh.txt
+            evppkey_ecdsa.txt
+            evppkey_ecx.txt
+            evppkey_ffdhe.txt
+            evppkey_kas.txt
+            evppkey_kdf_hkdf.txt
+            evppkey_kdf_tls1_prf.txt
+            evppkey_mismatch.txt
+        )
+    fi
 
     for T in ${EVP_TESTS[@]}
     do
diff --git a/scripts/test-sanity.sh b/scripts/test-sanity.sh
index ab582009..53cc7d0d 100755
--- a/scripts/test-sanity.sh
+++ b/scripts/test-sanity.sh
@@ -1,4 +1,22 @@
 #!/bin/bash
+#
+# Copyright (C) 2006-2024 wolfSSL Inc.
+#
+# This file is part of wolfProvider.
+#
+# wolfProvider is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# wolfProvider is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with wolfProvider. If not, see <http://www.gnu.org/licenses/>.
+#
 # This script provides simple sanity checks to make sure the provider is working
 
 SET_PRE=$( set )
@@ -7,6 +25,10 @@ LOG_FILE=${SCRIPT_DIR}/test-sanity.log
 rm -f ${LOG_FILE}
 source ${SCRIPT_DIR}/utils-wolfprovider.sh
 
+if [ "${WOLFSSL_ISFIPS}" = "1" ]; then
+    echo "FIPS mode enabled for sanity tests"
+fi
+
 echo "Using openssl: $OPENSSL_TAG, wolfssl: $WOLFSSL_TAG"
 
 function doTestCmd() {
diff --git a/scripts/test-wp-cs.sh b/scripts/test-wp-cs.sh
index 890fbdd8..a577405a 100755
--- a/scripts/test-wp-cs.sh
+++ b/scripts/test-wp-cs.sh
@@ -16,11 +16,15 @@
 #
 # You should have received a copy of the GNU General Public License
 # along with wolfProvider. If not, see <http://www.gnu.org/licenses/>.
-#
 
 SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
 NUMCPU=${NUMCPU:-8}
 WOLFPROV_DEBUG=${WOLFPROV_DEBUG:-0}
+
+if [ "${WOLFSSL_ISFIPS}" = "1" ]; then
+    echo "FIPS mode enabled for wp-cs tests"
+fi
+
 source ${SCRIPT_DIR}/utils-wolfprovider.sh
 source ${SCRIPT_DIR}/utils-openssl.sh
 
@@ -69,6 +73,11 @@ TLS13_CIPHERS=(
     TLS_AES_128_CCM_SHA256
 #    TLS_AES_128_CCM_8_SHA256
 )
+# FIPS-approved TLS 1.3 cipher suites
+TLS13_FIPS_CIPHERS=(
+    TLS_AES_256_GCM_SHA384
+    TLS_AES_128_GCM_SHA256
+)
 TLS12_CIPHERS=(
     ECDHE-ECDSA-AES256-GCM-SHA384
     ECDHE-RSA-AES256-GCM-SHA384
@@ -107,6 +116,31 @@ TLS12_CIPHERS=(
     AES256-SHA
     AES128-SHA
 )
+# FIPS-approved TLS 1.2 cipher suites
+TLS12_FIPS_CIPHERS=(
+    ECDHE-ECDSA-AES256-GCM-SHA384
+    ECDHE-RSA-AES256-GCM-SHA384
+    DHE-RSA-AES256-GCM-SHA384
+    ECDHE-ECDSA-AES128-GCM-SHA256
+    ECDHE-RSA-AES128-GCM-SHA256
+    DHE-RSA-AES128-GCM-SHA256
+    ECDHE-ECDSA-AES256-CCM
+    DHE-RSA-AES256-CCM
+    ECDHE-ECDSA-AES128-CCM
+    DHE-RSA-AES128-CCM
+    ECDHE-ECDSA-AES256-SHA384
+    ECDHE-RSA-AES256-SHA384
+    DHE-RSA-AES256-SHA256
+    ECDHE-ECDSA-AES128-SHA256
+    ECDHE-RSA-AES128-SHA256
+    DHE-RSA-AES128-SHA256
+    AES256-GCM-SHA384
+    AES128-GCM-SHA256
+    AES256-CCM
+    AES128-CCM
+    AES256-SHA256
+    AES128-SHA256
+)
 TLS1_CIPHERS=(
     ECDHE-RSA-AES256-SHA
     ECDHE-ECDSA-AES256-SHA
@@ -206,15 +240,26 @@ do_client_test() { # usage: do_client_test [extraArgs]
 #        do_client "$1"
 #    done
 
+    # Select cipher suites based on FIPS mode
+    if [ "${WOLFSSL_ISFIPS}" = "1" ]; then
+        echo "FIPS mode enabled - using FIPS-approved cipher suites only" | tee -a $LOG_FILE
+        TLS12_TEST_CIPHERS=("${TLS12_FIPS_CIPHERS[@]}")
+        TLS13_TEST_CIPHERS=("${TLS13_FIPS_CIPHERS[@]}")
+    else
+        echo "Normal mode - using all cipher suites" | tee -a $LOG_FILE
+        TLS12_TEST_CIPHERS=("${TLS12_CIPHERS[@]}")
+        TLS13_TEST_CIPHERS=("${TLS13_CIPHERS[@]}")
+    fi
+
     TLS_VERSION=-tls1_2
     printf "\t$TLS_VERSION\n" | tee -a $LOG_FILE
-    for CIPHER in ${TLS12_CIPHERS[@]}; do
+    for CIPHER in ${TLS12_TEST_CIPHERS[@]}; do
         do_client "$1"
     done
 
     TLS_VERSION=-tls1_3
     printf "\t$TLS_VERSION\n" | tee -a $LOG_FILE
-    for CIPHER in ${TLS13_CIPHERS[@]}; do
+    for CIPHER in ${TLS13_TEST_CIPHERS[@]}; do
         do_client "$1"
     done
 }
@@ -227,7 +272,7 @@ OPENSSL_ALL_CIPHERS="-cipher ALL -ciphersuites $TLS13_ALL_CIPHERS"
 OPENSSL_PORT=$(generate_port)
 
 # ensure we are doing a clean build
-printf "Cleaning up previous builds"
+printf "Cleaning up previous builds\n"
 rm -rf ${SCRIPT_DIR}/../*-install
 if [ -d ${OPENSSL_SOURCE_DIR} ]; then
     pushd ${OPENSSL_SOURCE_DIR} > /dev/null

From 781d8847c3544bf280060e55f2224b9e85a76d58 Mon Sep 17 00:00:00 2001
From: Aidan Garske <aidan@wolfssl.com>
Date: Sun, 6 Jul 2025 14:38:44 -0700
Subject: [PATCH 2/3] Only use the flag that is set

---
 scripts/cmd_test/aes-cmd-test.sh  | 12 ++++--------
 scripts/cmd_test/do-cmd-tests.sh  | 13 ++++---------
 scripts/cmd_test/ecc-cmd-test.sh  |  8 ++------
 scripts/cmd_test/hash-cmd-test.sh |  8 ++------
 scripts/cmd_test/rsa-cmd-test.sh  |  8 ++------
 5 files changed, 14 insertions(+), 35 deletions(-)

diff --git a/scripts/cmd_test/aes-cmd-test.sh b/scripts/cmd_test/aes-cmd-test.sh
index 15acd14f..47802908 100755
--- a/scripts/cmd_test/aes-cmd-test.sh
+++ b/scripts/cmd_test/aes-cmd-test.sh
@@ -44,18 +44,14 @@ fi
 
 # Fail flags
 FAIL=0
-FORCE_FAIL=0
 FORCE_FAIL_PASSED=0
-FIPS=0
 
-# Get the force fail parameter
+# Check environment variables directly
 if [ "${WOLFPROV_FORCE_FAIL}" = "1" ]; then
     echo "Force fail mode enabled for AES tests"
-    FORCE_FAIL=1
 fi
 if [ "${WOLFSSL_ISFIPS}" = "1" ]; then
     echo "FIPS mode enabled for AES tests"
-    FIPS=1
 fi
 
 # Verify wolfProvider is properly loaded
@@ -81,7 +77,7 @@ echo "This is test data for AES encryption testing." > test.txt
 
 # Helper function to handle force fail checks
 check_force_fail() {
-    if [ $FORCE_FAIL -eq 1 ]; then
+    if [ "${WOLFPROV_FORCE_FAIL}" = "1" ]; then
         echo "[PASS] Test passed when force fail was enabled"
         FORCE_FAIL_PASSED=1
     fi
@@ -90,7 +86,7 @@ check_force_fail() {
 # Arrays for test configurations
 KEY_SIZES=("128" "192" "256")
 # Only include modes supported by wolfProvider
-if [ $FIPS -eq 1 ]; then
+if [ "${WOLFSSL_ISFIPS}" = "1" ]; then
     MODES=("ecb" "cbc" "ctr")
     echo "FIPS mode detected - excluding CFB mode"
 else
@@ -178,7 +174,7 @@ for key_size in "${KEY_SIZES[@]}"; do
     done
 done
 
-if [ $FORCE_FAIL -eq 1 ]; then
+if [ "${WOLFPROV_FORCE_FAIL}" = "1" ]; then
     if [ $FORCE_FAIL_PASSED -eq 1 ]; then
         echo -e "\n=== AES Tests Failed With Force Fail Enabled ==="
         echo "ERROR: Some tests passed when they should have failed"
diff --git a/scripts/cmd_test/do-cmd-tests.sh b/scripts/cmd_test/do-cmd-tests.sh
index ed43fc58..1a397826 100755
--- a/scripts/cmd_test/do-cmd-tests.sh
+++ b/scripts/cmd_test/do-cmd-tests.sh
@@ -20,17 +20,12 @@
 # along with this program; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
 
-FORCE_FAIL=0
-FIPS=0
-
 # Get the force fail parameter
 if [ "${WOLFPROV_FORCE_FAIL}" = "1" ]; then
     echo "Force fail mode enabled for all tests"
-    FORCE_FAIL=1
 fi
 if [ "${WOLFSSL_ISFIPS}" = "1" ]; then
     echo "FIPS mode enabled for all tests"
-    FIPS=1
 fi
 
 # Get the directory where this script is located
@@ -85,10 +80,10 @@ ECC_RESULT=$?
 # Check results
 if [ $HASH_RESULT -eq 0 ] && [ $AES_RESULT -eq 0 ] && [ $RSA_RESULT -eq 0 ] && [ $ECC_RESULT -eq 0 ]; then
     echo -e "\n=== All Command-Line Tests Passed ==="
-    if [ $FORCE_FAIL -eq 1 ]; then
+    if [ "${WOLFPROV_FORCE_FAIL}" = "1" ]; then
         echo "Force fail mode was enabled"
     fi
-    if [ $FIPS -eq 1 ]; then
+    if [ "${WOLFSSL_ISFIPS}" = "1" ]; then
         echo "FIPS mode was enabled"
     fi
     echo "Hash Test Result: $HASH_RESULT (0=success)"
@@ -98,10 +93,10 @@ if [ $HASH_RESULT -eq 0 ] && [ $AES_RESULT -eq 0 ] && [ $RSA_RESULT -eq 0 ] && [
     exit 0
 else
     echo -e "\n=== Command-Line Tests Failed ==="
-    if [ $FORCE_FAIL -eq 1 ]; then
+    if [ "${WOLFPROV_FORCE_FAIL}" = "1" ]; then
         echo "Force fail mode was enabled"
     fi
-    if [ $FIPS -eq 1 ]; then
+    if [ "${WOLFSSL_ISFIPS}" = "1" ]; then
         echo "FIPS mode was enabled"
     fi
     echo "Hash Test Result: $HASH_RESULT (0=success)"
diff --git a/scripts/cmd_test/ecc-cmd-test.sh b/scripts/cmd_test/ecc-cmd-test.sh
index dace1565..294019d5 100755
--- a/scripts/cmd_test/ecc-cmd-test.sh
+++ b/scripts/cmd_test/ecc-cmd-test.sh
@@ -44,18 +44,14 @@ fi
 
 # Fail flags
 FAIL=0
-FORCE_FAIL=0
 FORCE_FAIL_PASSED=0
-FIPS=0
 
 # Get the force fail parameter
 if [ "${WOLFPROV_FORCE_FAIL}" = "1" ]; then
     echo "Force fail mode enabled for ECC tests"
-    FORCE_FAIL=1
 fi
 if [ "${WOLFSSL_ISFIPS}" = "1" ]; then
     echo "FIPS mode enabled for ECC tests"
-    FIPS=1
 fi
 
 # Verify wolfProvider is properly loaded
@@ -96,7 +92,7 @@ use_wolf_provider() {
 
 # Helper function to handle force fail checks
 check_force_fail() {
-    if [ $FORCE_FAIL -eq 1 ]; then
+    if [ "${WOLFPROV_FORCE_FAIL}" = "1" ]; then
         echo "[PASS] Test passed when force fail was enabled"
         FORCE_FAIL_PASSED=1
     fi
@@ -316,7 +312,7 @@ for curve in "${CURVES[@]}"; do
     done
 done
 
-if [ $FORCE_FAIL -eq 1 ]; then
+if [ "${WOLFPROV_FORCE_FAIL}" = "1" ]; then
     if [ $FORCE_FAIL_PASSED -eq 1 ]; then
         echo -e "\n=== ECC Tests Failed With Force Fail Enabled ==="
         echo "ERROR: Some tests passed when they should have failed"
diff --git a/scripts/cmd_test/hash-cmd-test.sh b/scripts/cmd_test/hash-cmd-test.sh
index bd6c7957..addaeffd 100755
--- a/scripts/cmd_test/hash-cmd-test.sh
+++ b/scripts/cmd_test/hash-cmd-test.sh
@@ -44,18 +44,14 @@ fi
 
 # Fail flags
 FAIL=0
-FORCE_FAIL=0
 FORCE_FAIL_PASSED=0
-FIPS=0
 
 # Get the force fail parameter
 if [ "${WOLFPROV_FORCE_FAIL}" = "1" ]; then
     echo "Force fail mode enabled for Hash tests"
-    FORCE_FAIL=1
 fi
 if [ "${WOLFSSL_ISFIPS}" = "1" ]; then
     echo "FIPS mode enabled for Hash tests"
-    FIPS=1
 fi
 
 # Verify wolfProvider is properly loaded
@@ -81,7 +77,7 @@ echo "This is test data for hash algorithm testing." > test.txt
 
 # Helper function to handle force fail checks
 check_force_fail() {
-    if [ $FORCE_FAIL -eq 1 ]; then
+    if [ "${WOLFPROV_FORCE_FAIL}" = "1" ]; then
         echo "[PASS] Test passed when force fail was enabled"
         FORCE_FAIL_PASSED=1
     fi
@@ -156,7 +152,7 @@ for algo in "${HASH_ALGOS[@]}"; do
 done
 
 # Modify end of script
-if [ $FORCE_FAIL -eq 1 ]; then
+if [ "${WOLFPROV_FORCE_FAIL}" = "1" ]; then
     if [ $FORCE_FAIL_PASSED -eq 1 ]; then
         echo -e "\n=== Hash Tests Failed With Force Fail Enabled ==="
         echo "ERROR: Some tests passed when they should have failed"
diff --git a/scripts/cmd_test/rsa-cmd-test.sh b/scripts/cmd_test/rsa-cmd-test.sh
index 6cf8fd80..2070f1ef 100755
--- a/scripts/cmd_test/rsa-cmd-test.sh
+++ b/scripts/cmd_test/rsa-cmd-test.sh
@@ -44,18 +44,14 @@ fi
 
 # Fail flags
 FAIL=0
-FORCE_FAIL=0
 FORCE_FAIL_PASSED=0
-FIPS=0
 
 # Get the force fail parameter
 if [ "${WOLFPROV_FORCE_FAIL}" = "1" ]; then
     echo "Force fail mode enabled for RSA tests"
-    FORCE_FAIL=1
 fi
 if [ "${WOLFSSL_ISFIPS}" = "1" ]; then
     echo "FIPS mode enabled for RSA tests"
-    FIPS=1
 fi
 
 # Verify wolfProvider is properly loaded
@@ -96,7 +92,7 @@ use_wolf_provider() {
 
 # Helper function to handle force fail checks
 check_force_fail() {
-    if [ $FORCE_FAIL -eq 1 ]; then
+    if [ "${WOLFPROV_FORCE_FAIL}" = "1" ]; then
         echo "[PASS] Test passed when force fail was enabled"
         FORCE_FAIL_PASSED=1
     fi
@@ -389,7 +385,7 @@ for key_type in "${KEY_TYPES[@]}"; do
     done
 done
 
-if [ $FORCE_FAIL -eq 1 ]; then
+if [ "${WOLFPROV_FORCE_FAIL}" = "1" ]; then
     if [ $FORCE_FAIL_PASSED -eq 1 ]; then
         echo -e "\n=== RSA Tests Failed With Force Fail Enabled ==="
         echo "ERROR: Some tests passed when they should have failed"

From 4620951c4259a1666c626206e73e6b3d6902e5fa Mon Sep 17 00:00:00 2001
From: Aidan Garske <aidan@wolfssl.com>
Date: Sun, 6 Jul 2025 15:02:23 -0700
Subject: [PATCH 3/3] Unset WPFF before we install_wolfprov

---
 scripts/cmd_test/aes-cmd-test.sh  | 10 ++--------
 scripts/cmd_test/ecc-cmd-test.sh  | 10 ++--------
 scripts/cmd_test/hash-cmd-test.sh | 10 ++--------
 scripts/cmd_test/rsa-cmd-test.sh  | 10 ++--------
 scripts/utils-wolfprovider.sh     |  9 ++++++++-
 5 files changed, 16 insertions(+), 33 deletions(-)

diff --git a/scripts/cmd_test/aes-cmd-test.sh b/scripts/cmd_test/aes-cmd-test.sh
index 47802908..c651642b 100755
--- a/scripts/cmd_test/aes-cmd-test.sh
+++ b/scripts/cmd_test/aes-cmd-test.sh
@@ -33,14 +33,8 @@ source "${UTILS_DIR}/utils-openssl.sh"
 source "${UTILS_DIR}/utils-wolfssl.sh"
 source "${UTILS_DIR}/utils-wolfprovider.sh"
 
-# Initialize wolfProvider without WPFF set
-if [ "${WOLFPROV_FORCE_FAIL}" = "1" ]; then
-    unset WOLFPROV_FORCE_FAIL
-    init_wolfprov
-    export WOLFPROV_FORCE_FAIL=1
-else 
-    init_wolfprov
-fi
+# Initialize wolfProvider
+init_wolfprov
 
 # Fail flags
 FAIL=0
diff --git a/scripts/cmd_test/ecc-cmd-test.sh b/scripts/cmd_test/ecc-cmd-test.sh
index 294019d5..e58659c5 100755
--- a/scripts/cmd_test/ecc-cmd-test.sh
+++ b/scripts/cmd_test/ecc-cmd-test.sh
@@ -33,14 +33,8 @@ source "${UTILS_DIR}/utils-openssl.sh"
 source "${UTILS_DIR}/utils-wolfssl.sh"
 source "${UTILS_DIR}/utils-wolfprovider.sh"
 
-# Initialize wolfProvider without WPFF set
-if [ "${WOLFPROV_FORCE_FAIL}" = "1" ]; then
-    unset WOLFPROV_FORCE_FAIL
-    init_wolfprov
-    export WOLFPROV_FORCE_FAIL=1
-else 
-    init_wolfprov
-fi
+# Initialize wolfProvider
+init_wolfprov
 
 # Fail flags
 FAIL=0
diff --git a/scripts/cmd_test/hash-cmd-test.sh b/scripts/cmd_test/hash-cmd-test.sh
index addaeffd..59a977e7 100755
--- a/scripts/cmd_test/hash-cmd-test.sh
+++ b/scripts/cmd_test/hash-cmd-test.sh
@@ -33,14 +33,8 @@ source "${UTILS_DIR}/utils-openssl.sh"
 source "${UTILS_DIR}/utils-wolfssl.sh"
 source "${UTILS_DIR}/utils-wolfprovider.sh"
 
-# Initialize wolfProvider without WPFF set
-if [ "${WOLFPROV_FORCE_FAIL}" = "1" ]; then
-    unset WOLFPROV_FORCE_FAIL
-    init_wolfprov
-    export WOLFPROV_FORCE_FAIL=1
-else 
-    init_wolfprov
-fi
+# Initialize wolfProvider
+init_wolfprov
 
 # Fail flags
 FAIL=0
diff --git a/scripts/cmd_test/rsa-cmd-test.sh b/scripts/cmd_test/rsa-cmd-test.sh
index 2070f1ef..2b497c43 100755
--- a/scripts/cmd_test/rsa-cmd-test.sh
+++ b/scripts/cmd_test/rsa-cmd-test.sh
@@ -33,14 +33,8 @@ source "${UTILS_DIR}/utils-openssl.sh"
 source "${UTILS_DIR}/utils-wolfssl.sh"
 source "${UTILS_DIR}/utils-wolfprovider.sh"
 
-# Initialize wolfProvider without WPFF set
-if [ "${WOLFPROV_FORCE_FAIL}" = "1" ]; then
-    unset WOLFPROV_FORCE_FAIL
-    init_wolfprov
-    export WOLFPROV_FORCE_FAIL=1
-else 
-    init_wolfprov
-fi
+# Initialize wolfProvider
+init_wolfprov
 
 # Fail flags
 FAIL=0
diff --git a/scripts/utils-wolfprovider.sh b/scripts/utils-wolfprovider.sh
index c3fe3824..f268f524 100755
--- a/scripts/utils-wolfprovider.sh
+++ b/scripts/utils-wolfprovider.sh
@@ -106,7 +106,14 @@ install_wolfprov() {
 }
 
 init_wolfprov() {
-    install_wolfprov
+    # Unset WPFF so we dont fail unit test when building
+    if [ "${WOLFPROV_FORCE_FAIL}" = "1" ]; then
+        unset WOLFPROV_FORCE_FAIL
+        install_wolfprov
+        export WOLFPROV_FORCE_FAIL=1
+    else
+        install_wolfprov
+    fi
     printf "\twolfProvider installed in: ${WOLFPROV_INSTALL_DIR}\n"
 
     export OPENSSL_MODULES=$WOLFPROV_PATH