commit 72d7bb4bca913a5ef46f3b992e1a9416ea2cfc39
author Yanray Wang <yanray.wang@arm.com> Wed Aug 30 13:58:15 2023 +0800
committer Yanray Wang <yanray.wang@arm.com> Fri Sep 01 17:35:58 2023 +0800
tree 4be8cd1b518fc14839d1a92886ed01c99e8b6b6a
parent 3c565275c48f1ffc00b5854b1cfecb4dfeacf844

check_config.h: add checks for CIPHER_ENCRYPT_ONLY

MBEDTLS_CIPHER_ENCRYPT_ONLY is an internal configuration which is
automatically enabled via the PSA. Typically,
once MBEDTLS_CIPHER_ENCRYPT_ONLY is enabled,
MBEDTLS_PSA_CRYPTO_CONFIG must be enabled. This check is only used
to prevent user explicitly enabling MBEDTLS_CIPHER_ENCRYPT_ONLY.

In addition, we shouldn't enable MBEDTLS_CIPHER_ENCRYPT_ONLY if
either CIPHER_MODE_CBC, CIPHER_MODE_XTS or NIST_KW_C is enabled.
Since three of them always need AES-decrypt.

Signed-off-by: Yanray Wang <yanray.wang@arm.com>

include/mbedtls/check_config.h

diff --git a/include/mbedtls/check_config.h b/include/mbedtls/check_config.h
index ca267bd..c64e9c3 100644
--- a/include/mbedtls/check_config.h
+++ b/include/mbedtls/check_config.h
@@ -84,6 +84,14 @@
 #error "MBEDTLS_NIST_KW_C defined, but not all prerequisites"
 #endif
 
+#if defined(MBEDTLS_CIPHER_ENCRYPT_ONLY) && \
+    (!defined(MBEDTLS_PSA_CRYPTO_CONFIG) || \
+    (defined(MBEDTLS_CIPHER_MODE_CBC) || \
+     defined(MBEDTLS_CIPHER_MODE_XTS) || \
+     defined(MBEDTLS_NIST_KW_C)))
+#error "MBEDTLS_CIPHER_ENCRYPT_ONLY defined, but not all prerequisites"
+#endif
+
 #if defined(MBEDTLS_ECDH_C) && !defined(MBEDTLS_ECP_C)
 #error "MBEDTLS_ECDH_C defined, but not all prerequisites"
 #endif