mirror of
https://github.com/wolfSSL/wolfssl.git
synced 2026-08-20 03:13:28 +02:00
Daniel Pouzzner
eedceef23d
is_enabled, WC_DH_INITIAL_RUNTIME_ENABLEMENT, WC_DH_HAVE_RUNTIME_ENABLEMENT. Place the enablement check AFTER key->heap/trustedGroup init in the five entry points (wc_InitDhKey_ex, wc_DhGenerateKeyPair, wc_DhAgree, wc_DhAgree_ct, _DhSetKey) so a disabled-DH early return never leaves a half-initialized key for wc_FreeDhKey to mp_clear on garbage. configure.ac: add --enable-dh=conditional; when DH is enabled (directly or via all-crypto) set it initially usable under FIPS v7 with -DWC_DH_INITIAL_RUNTIME_ENABLEMENT=1; remove the FIPS-v7 DH force-off (in FIPS v7+, disable build by default, unless building in kernel mode with DH registration enabled). linuxkm/lkcapi_glue.c: bracket LKCAPI registration with `need_dh_disable = (wc_dh_enable() == 0)` ... `if (need_dh_disable) wc_dh_disable();`, so DH is disabled on every exit path, and only by the caller that actually enabled it (wc_dh_enable returns ALREADY_E if DH was already on, so this never disables a DH some other context legitimately enabled). tests/unit.c, wolfcrypt/test/test.c: bracket the DH tests with enable/disable so they succeed regardless of runtime initial default enablement.
Before creating any new configure files (.conf) read the CONF_FILES_README.md