From 0e9ee6ffb0cd375cc24d4de4c8c76e717366d53b Mon Sep 17 00:00:00 2001 From: Lealem Amedie Date: Tue, 21 Jul 2026 08:41:10 -0600 Subject: [PATCH] Remove MIN_AUTH_TAG_SZ logic from kernel section to synchronize with user-space build --- wolfssl/wolfcrypt/settings.h | 50 +++++++++++++++++++----------------- 1 file changed, 26 insertions(+), 24 deletions(-) diff --git a/wolfssl/wolfcrypt/settings.h b/wolfssl/wolfcrypt/settings.h index 3522921de5..d19d35dc73 100644 --- a/wolfssl/wolfcrypt/settings.h +++ b/wolfssl/wolfcrypt/settings.h @@ -3925,6 +3925,32 @@ #endif #endif +#if defined(HAVE_FIPS) + #if FIPS_VERSION3_EQ(5, 2, 4) + /* support RFC 4106 IPsec ESP 64 bit tags */ + #undef WOLFSSL_MIN_AUTH_TAG_SZ + #define WOLFSSL_MIN_AUTH_TAG_SZ 8 + #else + /* No short (<96 bit) tags per SP 800-38D 2026 revision in process. */ + #if WOLFSSL_MIN_AUTH_TAG_SZ < 12 + #undef WOLFSSL_MIN_AUTH_TAG_SZ + #define WOLFSSL_MIN_AUTH_TAG_SZ 12 + #endif + #endif +#elif defined(CONFIG_CRYPTO_MANAGER_EXTRA_TESTS) || defined(CONFIG_CRYPTO_SELFTESTS_FULL) + /* The Linux kernel native crypto fuzzer expects small AES-GCM tag sizes to succeed. */ + #if WOLFSSL_MIN_AUTH_TAG_SZ > 4 + #undef WOLFSSL_MIN_AUTH_TAG_SZ + #define WOLFSSL_MIN_AUTH_TAG_SZ 4 + #endif +#elif defined(WOLFSSL_LINUXKM) + /* support RFC 4106 IPsec ESP */ + #if WOLFSSL_MIN_AUTH_TAG_SZ > 8 + #undef WOLFSSL_MIN_AUTH_TAG_SZ + #define WOLFSSL_MIN_AUTH_TAG_SZ 8 + #endif +#endif + #if defined(HAVE_FIPS) && defined(HAVE_AESGCM) && FIPS_VERSION3_LT(7,0,0) && \ defined(WC_FIPS_AESGCM_ONE_SHOT_EXT_IV_ALLOWED) && \ !defined(WOLFSSL_EXPERIMENTAL_SETTINGS) @@ -4406,30 +4432,6 @@ #if defined(WC_DEBUG_CIPHER_LIFECYCLE) && FIPS_VERSION3_LT(6, 0, 0) #error Configured FIPS version does not support WC_DEBUG_CIPHER_LIFECYCLE. #endif - #if FIPS_VERSION3_LT(7, 0, 0) - /* support RFC 4106 IPsec ESP 64 bit tags */ - #undef WOLFSSL_MIN_AUTH_TAG_SZ - #define WOLFSSL_MIN_AUTH_TAG_SZ 8 - #else - /* No short (<96 bit) tags per SP 800-38D 2026 revision in process. */ - #if WOLFSSL_MIN_AUTH_TAG_SZ < 12 - #undef WOLFSSL_MIN_AUTH_TAG_SZ - #define WOLFSSL_MIN_AUTH_TAG_SZ 12 - #endif - #endif - #elif defined(CONFIG_CRYPTO_MANAGER_EXTRA_TESTS) || defined(CONFIG_CRYPTO_SELFTESTS_FULL) - /* The Linux kernel native crypto fuzzer expects small AES-GCM tag sizes to succeed. */ - #if WOLFSSL_MIN_AUTH_TAG_SZ > 4 - #undef WOLFSSL_MIN_AUTH_TAG_SZ - #define WOLFSSL_MIN_AUTH_TAG_SZ 4 - #endif - #else - /* support RFC 4106 IPsec ESP */ - #if WOLFSSL_MIN_AUTH_TAG_SZ > 8 - #undef WOLFSSL_MIN_AUTH_TAG_SZ - #define WOLFSSL_MIN_AUTH_TAG_SZ 8 - #endif - #endif #if defined(LINUXKM_LKCAPI_REGISTER) && !defined(WOLFSSL_ASN_INT_LEAD_0_ANY) /* kernel 5.10 crypto manager tests key(s) that fail unless leading