Sync: OpenSSL: Implement HMAC using the high lever EVP_MAC API #86
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Why I did it
The below two PRs added some extra compile options to ignore the compiler errors during the Debian bookworm building.
#79
#80
To gracefully fix these compiler errors and meet the FIPS compliance requirements, this PR synced with the related commits from the Hostap repository to this Sonic-wpa-supplicant repository.
How I did it
Ported the below two commits to here.
https://w1.fi/cgit/hostap/commit/?id=e31500adea726897b2c308dae74ca2a3017d17c7
OpenSSL 3.0 deprecated the low-level HMAC functions, so use the EVP_MAC API for this. Maintain the HMAC API variant for older versions.
https://w1.fi/cgit/hostap/commit/?id=c9c2c2d9c73d8d74a1e285505a56d2127a7507d3
The EVP_MAC context data needs to be freed on error paths.
Fixes: e31500adea72 ("OpenSSL: Implement HMAC using the EVP_MAC API")
How to verify it
In the KVM-based testbed environment, tested it with FIPS and non-FIPS mode by running the SONiC MACSEC testing suite and got PASSED results.
The KVM-based testbed setup manual.
https://github.com/sonic-net/sonic-mgmt/blob/master/docs/testbed/README.testbed.VsSetup.md#option-1-veos-kvm-based-image