Commit 3cc8de0a8d for strongswan.org

commit 3cc8de0a8d86f79f16260c3e1bbee5538675b267
Author: Tobias Brunner <tobias@strongswan.org>
Date:   Mon Sep 28 08:42:51 2026 +0200

    Use wolfSSL 5.9.4 for tests

    The minimum DH key size supported is now restricted via DH_MIN_SIZE by
    default.

diff --git a/.github/active-transforms/wolfssl b/.github/active-transforms/wolfssl
index 704ccbb4a1..58afc14290 100644
--- a/.github/active-transforms/wolfssl
+++ b/.github/active-transforms/wolfssl
@@ -95,7 +95,6 @@ MODP_2048_256[wolfssl]
 MODP_1536[wolfssl]
 MODP_1024[wolfssl]
 MODP_1024_160[wolfssl]
-MODP_768[wolfssl]
 MODP_CUSTOM[wolfssl]
 ML_KEM_512[wolfssl]
 ML_KEM_768[wolfssl]
diff --git a/scripts/test.sh b/scripts/test.sh
index 9f35be624d..baa8f23f8d 100755
--- a/scripts/test.sh
+++ b/scripts/test.sh
@@ -39,7 +39,7 @@ build_botan()

 build_wolfssl()
 {
-	WOLFSSL_REV=v5.9.2-stable
+	WOLFSSL_REV=v5.9.4-stable
 	WOLFSSL_DIR=$DEPS_BUILD_DIR/wolfssl

 	if test -d "$WOLFSSL_DIR"; then
diff --git a/src/libstrongswan/plugins/wolfssl/wolfssl_plugin.c b/src/libstrongswan/plugins/wolfssl/wolfssl_plugin.c
index 463cbf04d2..3c4e09f77f 100644
--- a/src/libstrongswan/plugins/wolfssl/wolfssl_plugin.c
+++ b/src/libstrongswan/plugins/wolfssl/wolfssl_plugin.c
@@ -284,47 +284,55 @@ METHOD(plugin_t, get_features, int,
 #ifndef NO_DH
 		/* MODP DH groups */
 		PLUGIN_REGISTER(KE, wolfssl_diffie_hellman_create),
-	#if (defined(USE_FAST_MATH) && FP_MAX_BITS >= (3072 * 2)) || \
+	#if ((defined(USE_FAST_MATH) && FP_MAX_BITS >= (3072 * 2)) || \
 		(defined(WOLFSSL_SP_MATH_ALL) && SP_INT_BITS >= 3072) || \
-		defined(USE_INTEGER_HEAP_MATH)
+		defined(USE_INTEGER_HEAP_MATH)) && \
+		(!defined(DH_MIN_SIZE) || DH_MIN_SIZE <= 3072)
 			PLUGIN_PROVIDE(KE, MODP_3072_BIT),
 	#endif
-	#if (defined(USE_FAST_MATH) && FP_MAX_BITS >= (4096 * 2)) || \
+	#if ((defined(USE_FAST_MATH) && FP_MAX_BITS >= (4096 * 2)) || \
 		(defined(WOLFSSL_SP_MATH_ALL) && SP_INT_BITS >= 4096) || \
-		defined(USE_INTEGER_HEAP_MATH)
+		defined(USE_INTEGER_HEAP_MATH)) && \
+		(!defined(DH_MIN_SIZE) || DH_MIN_SIZE <= 4096)
 			PLUGIN_PROVIDE(KE, MODP_4096_BIT),
 	#endif
-	#if (defined(USE_FAST_MATH) && FP_MAX_BITS >= (6144 * 2)) || \
+	#if ((defined(USE_FAST_MATH) && FP_MAX_BITS >= (6144 * 2)) || \
 		(defined(WOLFSSL_SP_MATH_ALL) && SP_INT_BITS >= 6144) || \
-		defined(USE_INTEGER_HEAP_MATH)
+		defined(USE_INTEGER_HEAP_MATH)) && \
+		(!defined(DH_MIN_SIZE) || DH_MIN_SIZE <= 6144)
 			PLUGIN_PROVIDE(KE, MODP_6144_BIT),
 	#endif
-	#if (defined(USE_FAST_MATH) && FP_MAX_BITS >= (8192 * 2)) || \
+	#if ((defined(USE_FAST_MATH) && FP_MAX_BITS >= (8192 * 2)) || \
 		(defined(WOLFSSL_SP_MATH_ALL) && SP_INT_BITS >= 8192) || \
-		defined(USE_INTEGER_HEAP_MATH)
+		defined(USE_INTEGER_HEAP_MATH)) && \
+		(!defined(DH_MIN_SIZE) || DH_MIN_SIZE <= 8192)
 			PLUGIN_PROVIDE(KE, MODP_8192_BIT),
 	#endif
-	#if (defined(USE_FAST_MATH) && FP_MAX_BITS >= (2048 * 2)) || \
+	#if ((defined(USE_FAST_MATH) && FP_MAX_BITS >= (2048 * 2)) || \
 		(defined(WOLFSSL_SP_MATH_ALL) && SP_INT_BITS >= 2048) || \
-		defined(USE_INTEGER_HEAP_MATH)
+		defined(USE_INTEGER_HEAP_MATH)) && \
+		(!defined(DH_MIN_SIZE) || DH_MIN_SIZE <= 2048)
 			PLUGIN_PROVIDE(KE, MODP_2048_BIT),
 			PLUGIN_PROVIDE(KE, MODP_2048_224),
 			PLUGIN_PROVIDE(KE, MODP_2048_256),
 	#endif
-	#if (defined(USE_FAST_MATH) && FP_MAX_BITS >= (1536 * 2)) || \
+	#if ((defined(USE_FAST_MATH) && FP_MAX_BITS >= (1536 * 2)) || \
 		(defined(WOLFSSL_SP_MATH_ALL) && SP_INT_BITS >= 1536) || \
-		defined(USE_INTEGER_HEAP_MATH)
+		defined(USE_INTEGER_HEAP_MATH)) && \
+		(!defined(DH_MIN_SIZE) || DH_MIN_SIZE <= 1536)
 			PLUGIN_PROVIDE(KE, MODP_1536_BIT),
 	#endif
-	#if (defined(USE_FAST_MATH) && FP_MAX_BITS >= (1024 * 2)) || \
+	#if ((defined(USE_FAST_MATH) && FP_MAX_BITS >= (1024 * 2)) || \
 		(defined(WOLFSSL_SP_MATH_ALL) && SP_INT_BITS >= 1024) || \
-		defined(USE_INTEGER_HEAP_MATH)
+		defined(USE_INTEGER_HEAP_MATH)) && \
+		(!defined(DH_MIN_SIZE) || DH_MIN_SIZE <= 1024)
 			PLUGIN_PROVIDE(KE, MODP_1024_BIT),
 			PLUGIN_PROVIDE(KE, MODP_1024_160),
 	#endif
-	#if (defined(USE_FAST_MATH) && FP_MAX_BITS >= (768 * 2)) || \
+	#if ((defined(USE_FAST_MATH) && FP_MAX_BITS >= (768 * 2)) || \
 		(defined(WOLFSSL_SP_MATH_ALL) && SP_INT_BITS >= 768) || \
-		defined(USE_INTEGER_HEAP_MATH)
+		defined(USE_INTEGER_HEAP_MATH)) && \
+		(!defined(DH_MIN_SIZE) || DH_MIN_SIZE <= 768)
 			PLUGIN_PROVIDE(KE, MODP_768_BIT),
 	#endif
 			PLUGIN_PROVIDE(KE, MODP_CUSTOM),
diff --git a/testing/scripts/recipes/012_wolfssl.mk b/testing/scripts/recipes/012_wolfssl.mk
index e553552c64..36e6b40cfe 100644
--- a/testing/scripts/recipes/012_wolfssl.mk
+++ b/testing/scripts/recipes/012_wolfssl.mk
@@ -2,7 +2,7 @@

 PKG = wolfssl
 SRC = https://github.com/wolfSSL/$(PKG).git
-REV = v5.9.2-stable
+REV = v5.9.4-stable

 NUM_CPUS := $(shell getconf _NPROCESSORS_ONLN)