fips: define DH_MIN_SIZE for the FIPS PILOT build#425
Open
aidangarske wants to merge 3 commits into
Open
Conversation
There was a problem hiding this comment.
Pull request overview
This PR fixes a build break in the FIPS PILOT flow by ensuring DH_MIN_SIZE is defined when building older v5.x FIPS bases that don’t provide the macro in their settings.h, while preserving the optimized build settings required for the FIPS integrity hash.
Changes:
- Adds a scoped
CPPFLAGSdefine (-DDH_MIN_SIZE=2048) to thefips-check-PILOT.shinvocation path to avoidDH_MIN_SIZEbeing undeclared during compilation.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
aidangarske
force-pushed
the
fips-pilot-dh-min-size
branch
from
ef19f24 to
f43d9ef
Compare
aidangarske
force-pushed
the
fips-pilot-dh-min-size
branch
from
f43d9ef to
d54e893
Compare
padelsbach
reviewed
Jul 6, 2026
| if [ "$fips_check_script" = "fips-check-PILOT.sh" ]; then | ||
| # PILOT script has different usage: [flavor] [keep] | ||
| LD_LIBRARY_PATH="" ./$fips_check_script "$fips_tag" keep >$LOG_FILE 2>&1 | ||
| # v5.2.1 FIPS base predates DH_MIN_SIZE; add it to the FIPS wolfSSL build only - WOLFSSL_CONFIG_CFLAGS feeds the XXX-fips-test rebuilds, CPPFLAGS the PILOT's own configure. |
Contributor
There was a problem hiding this comment.
Nit: this comment is quite long
| const int newKeySize = 3072; | ||
| const int badKeyGenSizes[] = {512, 1024}; | ||
| /* FIPS 186 requires the RSA public exponent >= 65537; e=3 is rejected. */ | ||
| const long newKeyExp = 65537; |
Contributor
There was a problem hiding this comment.
Could be useful to check other values here to confirm the fix. Eg:
const int badKeyGenExps[] = {3, 65535};
And maybe check another good value too, eg 65539.
Edit: maybe this belongs in wolfcrypt (as well?). AI tells me that there is no "too small" test there either.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The FIPS PILOT build (
--enable-fips=v5,fips-check-PILOT.sh) fails to compile:Root cause
The PILOT builds
BASE_TAG=v5.2.1-stableand overlays FIPS-module crypto files.The module
dh.cnow carries a< DH_MIN_SIZEbounds check, but thev5.2.1-stablebasesettings.hpredates theDH_MIN_SIZEdefinition (added towolfSSL master only recently), so the symbol is undeclared in that build.
The PILOT runs
./configure --enable-fips=$FIPS_OPTIONwith noCFLAGS, so thebuild inherits flags from the environment.
Fix
Supply the FIPS
DH_MIN_SIZEvalue (2048, matching master'ssettings.hHAVE_FIPSbranch) viaCPPFLAGS, scoped to the PILOT invocation.CPPFLAGS(not
CFLAGS) is used so autoconf's default-g -O2is preserved — important sothe FIPS in-core integrity hash is computed against the normal optimized build.
Scoped to the PILOT path only; the
linuxv5.*/linuxv6.*bundles areself-consistent and unaffected.