Better macro guarding fix undeclared var error

[anhu]

No description provided.

[anhu]

retest this please

[dgarske]

@anhu please share the steps to reproduce this error...

[dgarske]

Odd that FIPS is different here since this is outside the boundary.

[lealem47]

Reproducible with ./configure --enable-curl --enable-fips=v5

[dgarske]

I see four places in this AddSessionToCache function where XFREE(preallocNonce, addSession->heap, DYNAMIC_TYPE_SESSION_TICK); is used. Only one of them is wrapped with FIPS check... Should the others also? What's the error when you reproduce? Again I am surprised this is related to FIPS and not a specific build macro since its is NOT in the wolfCrypt FIPS boundary.

[lealem47]

The error:

  CC       src/libwolfssl_la-wolfio.lo
  CC       src/libwolfssl_la-keys.lo
  CC       src/libwolfssl_la-ssl.lo
  CC       src/libwolfssl_la-tls.lo
  CC       src/libwolfssl_la-tls13.lo
  CC       src/libwolfssl_la-ocsp.lo
  CC       src/libwolfssl_la-crl.lo
  CC       wolfcrypt/test/test.o
  CC       examples/benchmark/tls_bench.o
  CC       examples/client/client-client.o
In file included from src/ssl.c:197:
./src/ssl_sess.c:1859:15: error: use of undeclared identifier 'preallocNonce'
        XFREE(preallocNonce, addSession->heap, DYNAMIC_TYPE_SESSION_TICK);
              ^
./src/ssl_sess.c:1870:15: error: use of undeclared identifier 'preallocNonce'
        XFREE(preallocNonce, addSession->heap, DYNAMIC_TYPE_SESSION_TICK);
              ^
  CC       examples/echoclient/echoclient.o
  CC       examples/echoserver/echoserver.o

Not sure how it is related to FIPS either but looks like it was an intentional choice by @rizlik when adding in the --enable-nonce-malloc functionality. #5593 (comment)

[rizlik]

Yes, this is intentionally guarded from FIPS < 5,3. The reason is that the bigger nonce is used for KDF functions inside the boundary, and that those functions have a hardcoded limit for the size of input key material. See

wolfssl/src/tls13.c

Line 1323 in dbf88e4

#if defined(WOLFSSL_TICKET_NONCE_MALLOC) && \

and #5593 (comment)

[dgarske]

I see four places in this AddSessionToCache function where XFREE(preallocNonce, addSession->heap, DYNAMIC_TYPE_SESSION_TICK); is used. Only one of them is wrapped with FIPS check... Should the others also? What's the error when you reproduce? Again I am surprised this is related to FIPS and not a specific build macro since its is NOT in the wolfCrypt FIPS boundary.