configure.ac, wolfssl/wolfcrypt/settings.h: finish implementing opt-in DH for FIPS v7+.

configure.ac

@@ -1891,14 +1891,17 @@ then
             -dh) lkcapi_dh=no ;;
             esac
         done
-        if test "$lkcapi_dh" = yes; then
+        if test "$lkcapi_dh" = yes
+        then
             enable_dh=conditional
         fi
     fi
 
     # Enable WOLFSSL_DH_EXTRA and DH const table speedups (eliminates `-lm` math lib dependency)
-    # No effect if DH is disabled.
-    AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DH_EXTRA -DHAVE_FFDHE_2048 -DHAVE_FFDHE_3072"
+    if test "$enable_dh" != no
+    then
+        AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DH_EXTRA -DHAVE_FFDHE_2048 -DHAVE_FFDHE_3072"
+    fi
 
     DEFAULT_MAX_CLASSIC_ASYM_KEY_BITS=4096
     AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_ECDSA_DETERMINISTIC_K_VARIANT"
@@ -12893,6 +12896,15 @@ then
         fi
     fi
 fi
+
+
+# Provisions for opt-in DH (FIPS v7+):
+if test "$ENABLED_DH" != "no"
+then
+    AM_CFLAGS="$AM_CFLAGS -DHAVE_DH"
+fi
+
+
 ################################################################################
 
 # USER SETTINGS

wolfssl/wolfcrypt/settings.h

@@ -5950,6 +5950,15 @@ blinding by defining WC_BLINDING_NO_RNG_ACKNOWLEDGE_WEAKNESS."
     #error WC_C_DYNAMIC_FALLBACK requires WC_HAVE_VECTOR_SPEEDUPS
 #endif
 
+/* setup for opt-in DH in FIPS v7+ */
+#if FIPS_VERSION3_GE(7,0,0) && !defined(HAVE_DH) && !defined(NO_DH)
+    #define NO_DH
+#elif defined(NO_DH)
+    #undef HAVE_DH
+#elif !defined(HAVE_DH)
+    #define HAVE_DH
+#endif
+
 #ifdef __cplusplus
     }   /* extern "C" */
 #endif