From eb032e0266691ea0d1ce96ba946a9e48c3be9234 Mon Sep 17 00:00:00 2001
From: Daniel Pouzzner <douzzer@wolfssl.com>
Date: Tue, 14 Dec 2021 18:08:12 -0600
Subject: [PATCH] configure.ac: refactor changes of 7cccaa98b7 around FIPS v5*.

---
 configure.ac | 54 +++++++---------------------------------------------
 1 file changed, 7 insertions(+), 47 deletions(-)

diff --git a/configure.ac b/configure.ac
index 3a00dac8e..fda8c1cb4 100644
--- a/configure.ac
+++ b/configure.ac
@@ -3425,7 +3425,7 @@ fi
 
 # FIPS
 AS_CASE([$FIPS_VERSION],
-    [v5], [ # FIPS 140-3
+    [v5*], [ # FIPS 140-3, including 140-3 ready
         AM_CFLAGS="$AM_CFLAGS -DHAVE_FIPS -DHAVE_FIPS_VERSION=$HAVE_FIPS_VERSION -DHAVE_FIPS_VERSION_MINOR=$HAVE_FIPS_VERSION_MINOR -DWOLFSSL_KEY_GEN -DWOLFSSL_SHA224 -DWOLFSSL_AES_DIRECT -DHAVE_AES_ECB -DHAVE_ECC_CDH -DWC_RSA_NO_PADDING -DWOLFSSL_ECDSA_SET_K"
         ENABLED_KEYGEN="yes"; ENABLED_SHA224="yes"; ENABLED_DES3="no"
         # Shake256 is a SHA-3 algorithm not in our FIPS algorithm list
@@ -3452,8 +3452,9 @@ AS_CASE([$FIPS_VERSION],
               [AM_CFLAGS="$AM_CFLAGS -DFORCE_FAILURE_RDSEED"])
         AS_IF([test "x$ENABLED_SHA512" = "xno"],
             [ENABLED_SHA512="yes"; AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SHA512 -DWOLFSSL_SHA384"])
-        AS_IF([test "x$ENABLED_AESGCM" = "xno"],
-            [ENABLED_AESGCM="yes"; AM_CFLAGS="$AM_CFLAGS -DHAVE_AESGCM"])
+        # AES-GCM optional with fips-ready, required with real fips
+        AS_IF([test "x$ENABLED_AESGCM" = "xno" && (test "$FIPS_VERSION" != "v5-ready" || test "$enable_aesgcm" != "no")],
+	    [ENABLED_AESGCM="yes"; AM_CFLAGS="$AM_CFLAGS -DHAVE_AESGCM"])
         AS_IF([test "x$ENABLED_MD5" = "xyes"],[ENABLED_MD5="no"; ENABLED_OLD_TLS="no"; AM_CFLAGS="$AM_CFLAGS -DNO_MD5 -DNO_OLD_TLS"])
         AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_VALIDATE_ECC_IMPORT -DECC_USER_CURVES -DHAVE_ECC192 -DHAVE_ECC224 -DHAVE_ECC256 -DHAVE_ECC384 -DHAVE_ECC521"
         AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ECDSA_SET_K -DWC_RNG_SEED_CB"
@@ -3461,50 +3462,9 @@ AS_CASE([$FIPS_VERSION],
         AM_CFLAGS="$AM_CFLAGS -DHAVE_FFDHE_3072 -DHAVE_FFDHE_4096 -DHAVE_FFDHE_6144 -DHAVE_FFDHE_8192"
         DEFAULT_MAX_CLASSIC_ASYM_KEY_BITS=8192
         if test $HAVE_FIPS_VERSION_MINOR -ge 2; then
-            if test "x$ENABLED_AESOFB" = "xno"; then
-                ENABLED_AESOFB="yes"; AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AES_OFB"
-            fi
-        fi
-    ],
-    [v5-ready], [ # FIPS 140-3 ready
-        AM_CFLAGS="$AM_CFLAGS -DHAVE_FIPS -DHAVE_FIPS_VERSION=$HAVE_FIPS_VERSION -DHAVE_FIPS_VERSION_MINOR=$HAVE_FIPS_VERSION_MINOR -DWOLFSSL_KEY_GEN -DHAVE_ECC_CDH -DWC_RSA_NO_PADDING -DWOLFSSL_ECDSA_SET_K"
-        ENABLED_KEYGEN="yes"; ENABLED_SHA224="yes"; ENABLED_DES3="no"
-        # Shake256 is a SHA-3 algorithm not in our FIPS algorithm list
-        AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_NO_SHAKE256"
-        ENABLED_SHAKE256=no
-        # SHA512-224 and SHA512-256 are SHA-2 algorithms not in our FIPS algorithm list
-        AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_NOSHA512_224 -DWOLFSSL_NOSHA512_256"
-        AS_IF([test "x$ENABLED_AESCCM" = "xyes"], # AESCCM optional with fips-ready
-              [AM_CFLAGS="$AM_CFLAGS -DHAVE_AESCCM"])
-        AS_IF([test "x$ENABLED_RSAPSS" != "xyes"],
-              [ENABLED_RSAPSS="yes"; AM_CFLAGS="$AM_CFLAGS -DWC_RSA_PSS"])
-        AS_IF([test "x$ENABLED_ECC" != "xyes"],
-              [ENABLED_ECC="yes"; AM_CFLAGS="$AM_CFLAGS -DHAVE_ECC -DTFM_ECC256"
-               AS_IF([test "x$ENABLED_ECC_SHAMIR" = "xyes"],
-                     [AM_CFLAGS="$AM_CFLAGS -DECC_SHAMIR"])],
-              [AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_VALIDATE_ECC_IMPORT -DWOLFSSL_VALIDATE_ECC_KEYGEN"])
-        AS_IF([test "x$ENABLED_AESCTR" = "xyes"],
-              [AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AES_COUNTER"]) # AESCTR optional with fips-ready
-        AS_IF([test "x$ENABLED_CMAC" = "xyes"],
-              [AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CMAC"]) # CMAC optional with fips-ready
-        AS_IF([test "x$ENABLED_HKDF" != "xyes"],
-              [ENABLED_HKDF="yes"; AM_CFLAGS="$AM_CFLAGS -DHAVE_HKDF"])
-        AS_IF([test "x$ENABLED_INTELASM" = "xyes"],
-              [AM_CFLAGS="$AM_CFLAGS -DFORCE_FAILURE_RDSEED"])
-        AS_IF([test "x$ENABLED_SHA512" = "xno"],
-            [ENABLED_SHA512="yes"; AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SHA512 -DWOLFSSL_SHA384"])
-        AS_IF([test "x$ENABLED_AESGCM" = "xyes"],
-            [AM_CFLAGS="$AM_CFLAGS -DHAVE_AESGCM"]) # GCM optional with fips-ready
-        AS_IF([test "x$ENABLED_MD5" = "xyes"],[ENABLED_MD5="no"; ENABLED_OLD_TLS="no"; AM_CFLAGS="$AM_CFLAGS -DNO_MD5 -DNO_OLD_TLS"])
-        AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_VALIDATE_ECC_IMPORT -DECC_USER_CURVES -DHAVE_ECC192 -DHAVE_ECC224 -DHAVE_ECC256 -DHAVE_ECC384 -DHAVE_ECC521"
-        AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ECDSA_SET_K -DWC_RNG_SEED_CB"
-        AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_VALIDATE_FFC_IMPORT -DHAVE_FFDHE_Q"
-        AM_CFLAGS="$AM_CFLAGS -DHAVE_FFDHE_3072 -DHAVE_FFDHE_4096 -DHAVE_FFDHE_6144 -DHAVE_FFDHE_8192"
-        DEFAULT_MAX_CLASSIC_ASYM_KEY_BITS=8192
-        if test $HAVE_FIPS_VERSION_MINOR -ge 2; then
-            if test "x$ENABLED_AESOFB" = "xyes"; then # AESOFB optional with fips-ready
-                AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AES_OFB"
-            fi
+            # AES-OFB optional with fips-ready, required with real fips
+            AS_IF([test "x$ENABLED_AESOFB" = "xno" && (test "$FIPS_VERSION" != "v5-ready" || test "$enable_aesofb" != "no")],
+	        [ENABLED_AESOFB="yes"; AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_AES_OFB"])
         fi
     ],
     ["v3"],[ # FIPS 140-2 Ready