20251009-more-WOLFSSL_API_PREFIX_MAP#9287
Merged
dgarske merged 3 commits intowolfSSL:masterfrom Oct 10, 2025
Merged
Conversation
This comment was marked as spam.
This comment was marked as spam.
configure.ac:
* add ML-KEM, ML-DSA, XMSS, and LMS to --enable-all-crypto when !ENABLED_FIPS.
* swap order of --enable-kyber and --enable-mlkem handler code to put mlkem first.
* add --enable-mldsa hander code.
* remove setup code that was adding -DWOLFSSL_NO_TLS12 and -DNO_OLD_TLS to
AM_CFLAGS when ENABLED_CRYPTONLY -- NO_OLD_TLS is already defined earlier for
when ENABLED_CRYPTONLY, and WOLFSSL_NO_TLS12 breaks wc_PRF_TLS(), which is
inside-the-FIPS-boundary crypto.
linuxkm/linuxkm_wc_port.h:
* adopt the WC_SANITIZE_DISABLE and WC_SANITIZE_ENABLE setup code from
settings.h (where it didn't belong).
* fix FIPS remapping of wc_InitMutex&friends to InitMutex&friends -- inhibit
when WOLFSSL_API_PREFIX_MAP.
wolfcrypt/src/ge_operations.c: add _wc_curve25519_dummy() to fix visibility of
curve25519().
wolfcrypt/src/poly1305.c: fix visibility of several unprefixed helper routines.
wolfcrypt/test/test.c: fix gating on tls12_kdf_test() and prf_test() (both
require !WOLFSSL_NO_TLS12).
wolfssl/internal.h, wolfssl/wolfio.h: add several WOLFSSL_API_PREFIX_MAPs.
wolfssl/wolfcrypt/ge_operations.h: fix visibility of several internal asm
functions.
wolfssl/wolfcrypt/settings.h: in WOLFSSL_LINUXKM setup, add gates to avoid redef
warnings for various settings, and remove the setup for
WC_SANITIZE_{DISABLE,ENABLE} (moved to linuxkm_wc_port.h as noted above).
wolfssl/wolfcrypt/wc_port.h: add WOLFSSL_API_PREFIX_MAPs for InitMutex() and
friends.
.github/workflows/symbol-prefixes.yml: count and report total_public_symbols, and use a better pattern to classify refs as defs.
douzzer
force-pushed
the
20251009-more-WOLFSSL_API_PREFIX_MAP
branch
from
3e9c740 to
d1ba8eb
Compare
…-with-sys-crypto-policy to configuration; wolfssl/ssl.h: make sure WOLFSSL_NO_TLS12 is defined in the TLS layer when NO_TLS.
Contributor
Author
|
output from the new exported-symbol checker: |
Contributor
Author
|
retest this please ) |
Contributor
Author
|
retest this please |
Contributor
Author
|
retest this please |
dgarske
approved these changes
Oct 10, 2025
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is a mop-up second round of visibility fixes, follow on to #9282 . It adds a workflow to validate namespace hygiene when
defined(WOLFSSL_API_PREFIX_MAP).commit msg:
add
.github/workflows/symbol-prefixes.yml.configure.ac:--enable-kyberand--enable-mlkemhandler code to put mlkem first.--enable-mldsahander code.-DWOLFSSL_NO_TLS12and-DNO_OLD_TLStoAM_CFLAGSwhenENABLED_CRYPTONLY--NO_OLD_TLSis already defined earlierwhen
ENABLED_CRYPTONLY, andWOLFSSL_NO_TLS12breakswc_PRF_TLS(), which isinside-the-FIPS-boundary crypto.
wolfssl/ssl.h: make sureWOLFSSL_NO_TLS12is defined in the TLS layer whenNO_TLS.linuxkm/linuxkm_wc_port.h:WC_SANITIZE_DISABLEandWC_SANITIZE_ENABLEsetup code fromsettings.h(where it didn't belong).wc_InitMutex&friends toInitMutex&friends -- inhibitwhen
WOLFSSL_API_PREFIX_MAP.wolfcrypt/src/ge_operations.c: add_wc_curve25519_dummy()to fix visibility ofcurve25519().wolfcrypt/src/poly1305.c: fix visibility of several unprefixed helper routines.wolfcrypt/test/test.c: fix gating ontls12_kdf_test()andprf_test()(bothrequire !
WOLFSSL_NO_TLS12).wolfssl/internal.h,wolfssl/wolfio.h: add severalWOLFSSL_API_PREFIX_MAPs.wolfssl/wolfcrypt/ge_operations.h: fix visibility of several internal asmfunctions.
wolfssl/wolfcrypt/settings.h: inWOLFSSL_LINUXKMsetup, add gates to avoid redefwarnings for various settings, and remove the setup for
WC_SANITIZE_{DISABLE,ENABLE}(moved tolinuxkm_wc_port.has noted above).wolfssl/wolfcrypt/wc_port.h: addWOLFSSL_API_PREFIX_MAPs forInitMutex()andfriends.
tested with multi-test using a new
check-for-unprefixed-symbolsscenario, and with a fullpr-check.