From a2b5da86513d3cd604b800804f5f793e4160fb45 Mon Sep 17 00:00:00 2001
From: David Garske <david@wolfssl.com>
Date: Tue, 10 Dec 2024 14:10:15 -0800
Subject: [PATCH] Fix nested `NO_TLS`.

---
 src/internal.c | 22 +++++++---------------
 src/keys.c     |  4 ++--
 2 files changed, 9 insertions(+), 17 deletions(-)

diff --git a/src/internal.c b/src/internal.c
index 23b89788c..e10ba5092 100644
--- a/src/internal.c
+++ b/src/internal.c
@@ -11904,14 +11904,9 @@ static int BuildFinished(WOLFSSL* ssl, Hashes* hashes, const byte* sender)
     if (ssl == NULL)
         return BAD_FUNC_ARG;
 
-#ifndef NO_TLS
     if (ssl->options.tls) {
         ret = BuildTlsFinished(ssl, hashes, sender);
     }
-#else
-    (void)hashes;
-    (void)sender;
-#endif
 #ifndef NO_OLD_TLS
     if (!ssl->options.tls) {
         ret = BuildMD5(ssl, hashes, sender);
@@ -22903,8 +22898,8 @@ int BuildMessage(WOLFSSL* ssl, byte* output, int outSz, const byte* input,
              int inSz, int type, int hashOutput, int sizeOnly, int asyncOkay,
              int epochOrder)
 {
+#ifndef WOLFSSL_NO_TLS12
     int ret;
-#if !defined(NO_TLS) && !defined(WOLFSSL_NO_TLS12)
     BuildMsgArgs* args;
     BuildMsgArgs  lcl_args;
 #endif
@@ -22924,12 +22919,12 @@ int BuildMessage(WOLFSSL* ssl, byte* output, int outSz, const byte* input,
 
     (void)epochOrder;
 
-#ifndef NO_TLS
 #if defined(WOLFSSL_NO_TLS12) && defined(WOLFSSL_TLS13)
+    /* TLS v1.3 only */
     return BuildTls13Message(ssl, output, outSz, input, inSz, type,
                                                hashOutput, sizeOnly, asyncOkay);
 #else
-
+    /* TLS v1.2 or v1.3 */
 #ifdef WOLFSSL_TLS13
     if (ssl->options.tls1_3) {
         return BuildTls13Message(ssl, output, outSz, input, inSz, type,
@@ -23450,19 +23445,16 @@ exit_buildmsg:
 
     /* Final cleanup */
     FreeBuildMsgArgs(ssl, args);
-#endif /* !WOLFSSL_NO_TLS12 */
-#endif /* !WOLFSSL_NO_TLS12 || WOLFSSL_TLS13 */
-#endif /* !NO_TLS */
-
-#if defined(NO_TLS) || (defined(WOLFSSL_NO_TLS12) && !defined(WOLFSSL_TLS13))
+    return ret;
+#else
     (void)outSz;
     (void)inSz;
     (void)type;
     (void)hashOutput;
     (void)asyncOkay;
-    ret = NOT_COMPILED_IN;
+    return NOT_COMPILED_IN;
+#endif /* !WOLFSSL_NO_TLS12 */
 #endif
-    return ret;
 }
 
 #ifndef WOLFSSL_NO_TLS12
diff --git a/src/keys.c b/src/keys.c
index 693e6b133..4ff687ed9 100644
--- a/src/keys.c
+++ b/src/keys.c
@@ -28,7 +28,7 @@
 
 #include <wolfssl/wolfcrypt/settings.h>
 
-#ifndef WOLFCRYPT_ONLY
+#if !defined(WOLFCRYPT_ONLY) && !defined(NO_TLS)
 
 #include <wolfssl/internal.h>
 #include <wolfssl/error-ssl.h>
@@ -4109,4 +4109,4 @@ int MakeMasterSecret(WOLFSSL* ssl)
 #endif
 }
 
-#endif /* WOLFCRYPT_ONLY */
+#endif /* !WOLFCRYPT_ONLY && !NO_TLS */