[PATCH 3/4] tests: hwsim: Add PSA crypto backend option

[Chaitanya Tata]

From: Chaitanya Tata <Chaitanya.Tata at nordicsemi.no>

Offer CONFIG_TLS=psa in the hwsim example configs. Since the PSA backend
does not yet support EAP-FAST/EAP-TEAP or DPP2/DPP3, those are gated out for
psa; EAP-PWD is enabled and the MbedTLS 4.x / TF-PSA-Crypto include/library
paths (MBEDTLS_SRC) and internal DES/MD4/RC4/DH-group-5 selections are set.

start.sh detects a PSA hostapd build and strips the EAP-FAST/EAP-TEAP items
from the generated RADIUS auth server configuration and EAP user database,
so the auth server starts and the hwsim tests run out of the box (the
FAST/TEAP-specific test cases skip on their own).

Validated with hwsim: open, WPA2-PSK, SAE, OWE and EAP-TLS/PEAP/TTLS
associations pass with the PSA backend.

Signed-off-by: Chaitanya Tata <Chaitanya.Tata at nordicsemi.no>
---
 tests/hwsim/example-hostapd.config        | 24 +++++++++++++++++++++++
 tests/hwsim/example-wpa_supplicant.config | 24 +++++++++++++++++++++++
 tests/hwsim/start.sh                      | 17 ++++++++++++++++
 3 files changed, 65 insertions(+)

diff --git a/tests/hwsim/example-hostapd.config b/tests/hwsim/example-hostapd.config
index d660f632d..9e2046e68 100644
--- a/tests/hwsim/example-hostapd.config
+++ b/tests/hwsim/example-hostapd.config
@@ -5,6 +5,7 @@ CONFIG_DRIVER_NL80211=y
 CONFIG_RSN_PREAUTH=y
 
 #CONFIG_TLS=internal
+#CONFIG_TLS=psa   # MbedTLS 4 / TF-PSA-Crypto; set MBEDTLS_SRC and see src/crypto/README-psa.md
 #CONFIG_INTERNAL_LIBTOMMATH=y
 #CONFIG_INTERNAL_LIBTOMMATH_FAST=y
 CONFIG_TLS=openssl
@@ -26,8 +27,12 @@ CONFIG_EAP_SAKE=y
 CONFIG_EAP_PAX=y
 CONFIG_EAP_PSK=y
 CONFIG_EAP_VENDOR_TEST=y
+ifneq ($(CONFIG_TLS), psa)
 CONFIG_EAP_FAST=y
+endif
+ifneq ($(CONFIG_TLS), psa)
 CONFIG_EAP_TEAP=y
+endif
 CONFIG_EAP_IKEV2=y
 CONFIG_EAP_TNC=y
 CFLAGS += -DTNC_CONFIG_FILE=\"tnc/tnc_config\"
@@ -39,6 +44,21 @@ endif
 ifeq ($(CONFIG_TLS), wolfssl)
 CONFIG_EAP_PWD=y
 endif
+ifeq ($(CONFIG_TLS), psa)
+CONFIG_EAP_PWD=y
+# PSA needs the MbedTLS 4 / TF-PSA-Crypto source tree; override MBEDTLS_SRC
+MBEDTLS_SRC ?= /usr/local/src/mbedtls
+CFLAGS += -I$(MBEDTLS_SRC)/include
+CFLAGS += -I$(MBEDTLS_SRC)/tf-psa-crypto/include
+CFLAGS += -I$(MBEDTLS_SRC)/tf-psa-crypto/drivers/builtin/include
+LIBS += -L$(MBEDTLS_SRC)/build/library
+LIBS_p += -L$(MBEDTLS_SRC)/build/library
+LDFLAGS += -Wl,-rpath=$(MBEDTLS_SRC)/build/library
+CONFIG_INTERNAL_DES=y
+CONFIG_INTERNAL_MD4=y
+CONFIG_INTERNAL_RC4=y
+CONFIG_INTERNAL_DH_GROUP5=y
+endif
 CONFIG_EAP_EKE=y
 CONFIG_PKCS12=y
 CONFIG_RADIUS_SERVER=y
@@ -117,8 +137,12 @@ CONFIG_FILS=y
 CONFIG_FILS_SK_PFS=y
 CONFIG_OWE=y
 CONFIG_DPP=y
+ifneq ($(CONFIG_TLS), psa)
 CONFIG_DPP2=y
+endif
+ifneq ($(CONFIG_TLS), psa)
 CONFIG_DPP3=y
+endif
 CONFIG_WEP=y
 CONFIG_PASN=y
 CONFIG_AIRTIME_POLICY=y
diff --git a/tests/hwsim/example-wpa_supplicant.config b/tests/hwsim/example-wpa_supplicant.config
index c5b364757..c56dd3ebe 100644
--- a/tests/hwsim/example-wpa_supplicant.config
+++ b/tests/hwsim/example-wpa_supplicant.config
@@ -3,6 +3,7 @@
 CONFIG_TLS=openssl
 #CONFIG_TLS=wolfssl
 #CONFIG_TLS=internal
+#CONFIG_TLS=psa   # MbedTLS 4 / TF-PSA-Crypto; set MBEDTLS_SRC and see src/crypto/README-psa.md
 #CONFIG_INTERNAL_LIBTOMMATH=y
 #CONFIG_INTERNAL_LIBTOMMATH_FAST=y
 
@@ -31,8 +32,12 @@ CONFIG_EAP_EKE=y
 CONFIG_EAP_TNC=y
 CFLAGS += -DTNC_CONFIG_FILE=\"tnc/tnc_config\"
 LIBS += -rdynamic
+ifneq ($(CONFIG_TLS), psa)
 CONFIG_EAP_FAST=y
+endif
+ifneq ($(CONFIG_TLS), psa)
 CONFIG_EAP_TEAP=y
+endif
 CONFIG_EAP_IKEV2=y
 
 ifeq ($(CONFIG_TLS), openssl)
@@ -41,6 +46,21 @@ endif
 ifeq ($(CONFIG_TLS), wolfssl)
 CONFIG_EAP_PWD=y
 endif
+ifeq ($(CONFIG_TLS), psa)
+CONFIG_EAP_PWD=y
+# PSA needs the MbedTLS 4 / TF-PSA-Crypto source tree; override MBEDTLS_SRC
+MBEDTLS_SRC ?= /usr/local/src/mbedtls
+CFLAGS += -I$(MBEDTLS_SRC)/include
+CFLAGS += -I$(MBEDTLS_SRC)/tf-psa-crypto/include
+CFLAGS += -I$(MBEDTLS_SRC)/tf-psa-crypto/drivers/builtin/include
+LIBS += -L$(MBEDTLS_SRC)/build/library
+LIBS_p += -L$(MBEDTLS_SRC)/build/library
+LDFLAGS += -Wl,-rpath=$(MBEDTLS_SRC)/build/library
+CONFIG_INTERNAL_DES=y
+CONFIG_INTERNAL_MD4=y
+CONFIG_INTERNAL_RC4=y
+CONFIG_INTERNAL_DH_GROUP5=y
+endif
 
 CONFIG_USIM_SIMULATOR=y
 CONFIG_SIM_SIMULATOR=y
@@ -162,8 +182,12 @@ CONFIG_FILS_SK_PFS=y
 CONFIG_PMKSA_CACHE_EXTERNAL=y
 CONFIG_OWE=y
 CONFIG_DPP=y
+ifneq ($(CONFIG_TLS), psa)
 CONFIG_DPP2=y
+endif
+ifneq ($(CONFIG_TLS), psa)
 CONFIG_DPP3=y
+endif
 CONFIG_WEP=y
 CONFIG_PASN=y
 CONFIG_NAN_USD=y
diff --git a/tests/hwsim/start.sh b/tests/hwsim/start.sh
index 0ba3fdc66..de33dc831 100755
--- a/tests/hwsim/start.sh
+++ b/tests/hwsim/start.sh
@@ -72,6 +72,23 @@ done
 sed "s/group=admin/group=$GROUP/;s%LOGDIR%$LOGDIR%g" "$DIR/auth_serv/as.conf" > "$LOGDIR/as.conf"
 sed "s/group=admin/group=$GROUP/;s%LOGDIR%$LOGDIR%g" "$DIR/auth_serv/as2.conf" > "$LOGDIR/as2.conf"
 
+# The PSA crypto backend (CONFIG_TLS=psa) does not support EAP-FAST/EAP-TEAP,
+# so a hostapd built with it rejects the EAP-FAST configuration and the EAP
+# server database entries for those methods. When the RADIUS server hostapd
+# is a PSA build, strip EAP-FAST/EAP-TEAP so the auth server still starts;
+# the corresponding hwsim test cases skip on their own.
+if grep -q '^CONFIG_TLS=psa' "$DIR/../../hostapd/.config" 2>/dev/null; then
+    sed -E 's/\bFAST,//g; s/,FAST\b//g; s/\bTEAP,//g; s/,TEAP\b//g' \
+	"$DIR/auth_serv/eap_user.conf" | \
+	sed -E '/[[:space:]](FAST|TEAP)[[:space:]]*$/ s/^/#/' > "$LOGDIR/eap_user.conf"
+    for f in as.conf as2.conf; do
+	sed -i -E '/^(pac_opaque_encr_key|eap_fast_a_id|eap_fast_a_id_info)=/d' \
+	    "$LOGDIR/$f"
+	sed -i "s%eap_user_file=auth_serv/eap_user.conf%eap_user_file=$LOGDIR/eap_user.conf%" \
+	    "$LOGDIR/$f"
+    done
+fi
+
 unset VM
 if [ "$1" = "VM" ]; then
     VM="y"
-- 
2.43.0