Fix build failures when NO_AES_DECRYPT is defined - #11448
Conversation
|
retest this please |
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #11448
Scan targets checked: none
Failed targets: wolfcrypt-src, wolfcrypt-bugs, wolfssl-src, wolfssl-bugs
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #11448
Scan targets checked: none
Failed targets: wolfcrypt-src, wolfcrypt-bugs, wolfssl-src, wolfssl-bugs
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #11448
Scan targets checked: none
Failed targets: wolfcrypt-src, wolfcrypt-bugs, wolfssl-src, wolfssl-bugs
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #11448
Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfssl-src, wolfssl-bugs
Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)
This review was generated automatically by Fenrir. Reported findings require changes before merge.
| /* GCM and CCM decrypt only use AES encrypt, so keep them with | ||
| * NO_AES_DECRYPT. */ | ||
| #undef HAVE_AESGCM_DECRYPT | ||
| #define HAVE_AESGCM_DECRYPT |
There was a problem hiding this comment.
New GCM decrypt macro breaks accelerated builds · Logic errors
HAVE_AESGCM_DECRYPT now compiles GCM decryption under NO_AES_DECRYPT, but AES-NI and RISC-V streaming decrypt declarations remain gated only by HAVE_AES_DECRYPT. These configurations fail with undeclared-function errors.
Suggested fix: Guard the AES-NI and RISC-V GCM decrypt declarations with HAVE_AES_DECRYPT || HAVE_AESGCM_DECRYPT.
Basis: ISO C99 §6.5.1p2 requires an identifier used as a primary expression to be declared.
| #if defined(WOLFSSL_STATIC_PSK) | ||
| #if !defined(NO_PSK) && !defined(NO_AES) && !defined(NO_TLS) | ||
| #if !defined(NO_SHA) | ||
| #if !defined(NO_SHA) && defined(HAVE_AES_DECRYPT) |
There was a problem hiding this comment.
SHA-1 PSK suites remain enabled without AES-CBC · Logic errors
The SHA-1 PSK guard still omits HAVE_AES_CBC. NO_AES_CBC static-PSK builds advertise AES-CBC suites whose record-layer cases are compiled out, causing ENCRYPT_ERROR after negotiation.
Suggested fix: Require both HAVE_AES_CBC and HAVE_AES_DECRYPT in the SHA-1 PSK suite guard.
65d8000 to
8c68122
Compare
2 participants
Description
Followup to: #11423
Fixes the NO_AES_DECRYPT builds which had fallen into disrepair somewhat both with and without TLS enabled.
How did you test?
Building on macOS both with and without
--enable-wolfcryptonlyChecklist