[openssh-commits] [openssh] branch master updated: Supply RSA limit params for BoringSSL/AWS-LC.

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

dtucker pushed a commit to branch master
in repository openssh.

The following commit(s) were added to refs/heads/master by this push:
     new 1fbdcb402 Supply RSA limit params for BoringSSL/AWS-LC.
1fbdcb402 is described below

commit 1fbdcb402516aacce59b4cc7b7d98f06820a1e44
Author: Darren Tucker <dtucker at dtucker.net>
AuthorDate: Sat Oct 31 08:49:44 2026 +1100

    Supply RSA limit params for BoringSSL/AWS-LC.
    
    In commit 625475f, BoringSSL removed OPENSSL_RSA_SMALL_MODULUS_BITS and
    OPENSSL_RSA_MAX_PUBEXP_BITS (previously having but not exporting them).
    Check for them and if not found supply them, assuming they are no bigger
    than when they were removed.  Fixes builds with BoringSSL and AWS-LC.
---
 configure.ac | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/configure.ac b/configure.ac
index 2b8c0b7d5..19cb23331 100644
--- a/configure.ac
+++ b/configure.ac
@@ -3363,6 +3363,17 @@ if test "x$openssl" = "xyes" ; then
 	aws-lc|boringssl)
 		# Brainpool does not work with AWC-LS or BoringSSL.
 		unsupported_algorithms="$unsupported_algorithms mlkem768brainpoolp256r1-sha256"
+
+		# BoringSSL removed these in exports in commit 625475f
+		# Assume they are no larger than they were when removed.
+		AC_CHECK_DECL([OPENSSL_RSA_SMALL_MODULUS_BITS], [],
+		    AC_DEFINE([OPENSSL_RSA_SMALL_MODULUS_BITS], [3072],
+			[BoringSSL/AWS-LC does not provide this]),
+		    [[#include <openssl/rsa.h>]])
+		AC_CHECK_DECL([OPENSSL_RSA_MAX_PUBEXP_BITS], [],
+		    AC_DEFINE([OPENSSL_RSA_MAX_PUBEXP_BITS], [64],
+			[BoringSSL/AWS-LC does not provide this]),
+		    [[#include <openssl/rsa.h>]])
 		;;
 	*)
 		AC_CHECK_DECL([NID_brainpoolP256r1],

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.