Repository: wolfSSL/wolfssh
Pull request #804: Soft Disable AES-CBC
Author: login: ejohnstown
Created: 2025-05-16T15:27:33Z | Merged: 2025-05-17T14:53:56Z

1. By default, soft disable AES-CBC. It isn't offered as a default encrypt algorithm, but may be set at runtime.
2. Add guard where AES-CBC can be added back as a default.
3. Add option to example client to run it with a custom encrypt algorithm list.
4. In the client, add macro to add items to the arg lists while checking the number of items in the list.
(ZD 19606)


Diff:
diff --git a/examples/client/client.c b/examples/client/client.c
index 1329de39c..e27305f72 100644
--- a/examples/client/client.c
+++ b/examples/client/client.c
@@ -126,7 +126,8 @@ static void ShowUsage(void)
     printf(" -X            Ignore IP checks on peer vs peer certificate\n");
 #endif
     printf(" -E            List all possible algos\n");
-    printf(" -k            set the list of key algos to use\n");
+    printf(" -k            set the list of key algos\n");
+    printf(" -C            set the list of encrypt algos\n");
     printf(" -q            turn off debugging output\n");
 }
 
@@ -651,6 +652,7 @@ THREAD_RETURN WOLFSSH_THREAD client_test(void* args)
     const char* cmd      = NULL;
     const char* privKeyName = NULL;
     const char* keyList = NULL;
+    const char* cipherList = NULL;
     byte imExit = 0;
     byte listAlgos = 0;
     byte nonBlock = 0;
@@ -669,7 +671,7 @@ THREAD_RETURN WOLFSSH_THREAD client_test(void* args)
 
     (void)keepOpen;
 
-    while ((ch = mygetopt(argc, argv, "?ac:h:i:j:p:tu:xzNP:RJ:A:XeEk:qK:")) != -1) {
+    while ((ch = mygetopt(argc, argv, "?ac:C:h:i:j:p:tu:xzNP:RJ:A:XeEk:qK:")) != -1) {
         switch (ch) {
             case 'h':
                 host = myoptarg;
@@ -750,6 +752,10 @@ THREAD_RETURN WOLFSSH_THREAD client_test(void* args)
                 keyList = myoptarg;
                 break;
 
+            case 'C':
+                cipherList = myoptarg;
+                break;
+
         #if !defined(SINGLE_THREADED) && !defined(WOLFSSL_NUCLEUS)
             case 'c':
                 cmd = myoptarg;
@@ -841,6 +847,11 @@ THREAD_RETURN WOLFSSH_THREAD client_test(void* args)
             err_sys("Error setting key list.\n");
         }
     }
+    if (cipherList) {
+        if (wolfSSH_CTX_SetAlgoListCipher(ctx, cipherList) != WS_SUCCESS) {
+            err_sys("Error setting cipher list.\n");
+        }
+    }
 
     if (((func_args*)args)->user_auth == NULL)
         wolfSSH_SetUserAuth(ctx, ClientUserAuth);
diff --git a/src/internal.c b/src/internal.c
index e1a042e4d..c75a84524 100644
--- a/src/internal.c
+++ b/src/internal.c
@@ -147,6 +147,11 @@
   WOLFSSH_NO_NISTP256_MLKEM768_SHA256
     Set when ML-KEM is disabled in wolfssl. Set to disable use of ECDHE with
     prime NISTP256 hybridized with post-quantum ML-KEM 768.
+  WOLFSSH_NO_AES_CBC_SOFT_DISABLE
+    AES-CBC is normally soft-disabled. The default configuration will not
+    advertise the availability of AES-CBC algorithms during KEX. AES-CBC
+    algorithms still work. Setting this flag will advertise AES-CBC
+    algorithms during KEX by default.
   WOLFSSH_NO_AES_CBC
     Set when AES or AES-CBC are disabled. Set to disable use of AES-CBC
     encryption.
@@ -803,7 +808,7 @@ static const char cannedEncAlgoNames[] =
     "aes192-ctr,"
     "aes128-ctr,"
 #endif
-#if !defined(WOLFSSH_NO_AES_CBC)
+#if !defined(WOLFSSH_NO_AES_CBC) && defined(WOLFSSH_NO_AES_CBC_SOFT_DISABLE)
     "aes256-cbc,"
     "aes192-cbc,"
     "aes128-cbc,"
diff --git a/tests/kex.c b/tests/kex.c
index d511db48b..02f9837ff 100644
--- a/tests/kex.c
+++ b/tests/kex.c
@@ -163,6 +163,52 @@ static int tsClientUserAuth(byte authType, WS_UserAuthData* authData, void* ctx)
 #define NUMARGS 12
 #define ARGLEN 32
 
+/* 
+ * Macro: ADD_ARG
+ * Purpose: Adds a string argument to the argument list.
+ * Parameters:
+ *   - argList: The array of argument strings.
+ *   - argListCount: The current count of arguments in the list (modified
+ *     by the macro).
+ *   - arg: The string argument to add.
+ * Behavior:
+ *   - Copies the string `arg` into the next available slot in `argList`.
+ *   - Increments `argListCount` if the operation is successful.
+ * Constraints:
+ *   - The total number of arguments must not exceed `NUMARGS`.
+ *   - Each argument string must not exceed `ARGLEN` characters.
+ * Side effects:
+ *   - Modifies `argList` and increments `argListCount`.
+ */
+#define ADD_ARG(argList,argListCount,arg) do { \
+    if ((argListCount) < NUMARGS) \
+        WSTRNCPY((argList)[(argListCount)++], (arg), ARGLEN); \
+} while (0)
+
+/* 
+ * Macro: ADD_ARG_INT
+ * Purpose: Adds an integer argument to the argument list as a string.
+ * Parameters:
+ *   - argList: The array of argument strings.
+ *   - argListCount: The current count of arguments in the list (modified
+ *     by the macro).
+ *   - arg: The integer argument to add.
+ * Behavior:
+ *   - Converts the integer `arg` to a string and stores it in the next
+ *     available slot in `argList`.
+ *   - Increments `argListCount` if the operation is successful.
+ * Constraints:
+ *   - The total number of arguments must not exceed `NUMARGS`.
+ *   - Each argument string must not exceed `ARGLEN` characters.
+ * Side effects:
+ *   - Modifies `argList` and increments `argListCount`.
+ */
+#define ADD_ARG_INT(argList,argListCount,arg) do { \
+    if ((argListCount) < NUMARGS) \
+        WSNPRINTF((argList)[(argListCount)++], ARGLEN, "%d", (arg)); \
+} while (0)
+
+
 static int wolfSSH_wolfSSH_Group16_512(void)
 {
     tcp_ready ready;
@@ -175,7 +221,8 @@ static int wolfSSH_wolfSSH_Group16_512(void)
           sA[10], sA[11] };
     char cA[NUMARGS][ARGLEN];
     char *clientArgv[NUMARGS] =
-        { cA[0], cA[1], cA[2], cA[3], cA[4] };
+        { cA[0], cA[1], cA[2], cA[3], cA[4], cA[5], cA[6], cA[7], cA[8], cA[9],
+          cA[10], cA[11] };
     int serverArgc = 0;
     int clientArgc = 0;
 
@@ -202,19 +249,19 @@ static int wolfSSH_wolfSSH_Group16_512(void)
 
     InitTcpReady(&ready);
 
-    WSTRNCPY(serverArgv[serverArgc++], "echoserver", ARGLEN);
-    WSTRNCPY(serverArgv[serverArgc++], "-1", ARGLEN);
-    WSTRNCPY(serverArgv[serverArgc++], "-f", ARGLEN);
+    ADD_ARG(serverArgv, serverArgc, "echoserver");
+    ADD_ARG(serverArgv, serverArgc, "-1");
+    ADD_ARG(serverArgv, serverArgc, "-f");
     #if !defined(USE_WINDOWS_API) && !defined(WOLFSSH_ZEPHYR)
-        WSTRNCPY(serverArgv[serverArgc++], "-p", ARGLEN);
-        WSTRNCPY(serverArgv[serverArgc++], "-0", ARGLEN);
+        ADD_ARG(serverArgv, serverArgc, "-p");
+        ADD_ARG(serverArgv, serverArgc, "-0");
     #endif
-    WSTRNCPY(serverArgv[serverArgc++], "-x", ARGLEN);
-    WSTRNCPY(serverArgv[serverArgc++], "diffie-hellman-group16-sha512", ARGLEN);
-    WSTRNCPY(serverArgv[serverArgc++], "-m", ARGLEN);
-    WSTRNCPY(serverArgv[serverArgc++], "hmac-sha2-512", ARGLEN);
-    WSTRNCPY(serverArgv[serverArgc++], "-c", ARGLEN);
-    WSTRNCPY(serverArgv[serverArgc++], "aes256-cbc", ARGLEN);
+    ADD_ARG(serverArgv, serverArgc, "-x");
+    ADD_ARG(serverArgv, serverArgc, "diffie-hellman-group16-sha512");
+    ADD_ARG(serverArgv, serverArgc, "-m");
+    ADD_ARG(serverArgv, serverArgc, "hmac-sha2-512");
+    ADD_ARG(serverArgv, serverArgc, "-c");
+    ADD_ARG(serverArgv, serverArgc, "aes256-cbc");
 
     serverArgs.argc = serverArgc;
     serverArgs.argv = serverArgv;
@@ -224,12 +271,14 @@ static int wolfSSH_wolfSSH_Group16_512(void)
     ThreadStart(echoserver_test, &serverArgs, &serverThread);
     WaitTcpReady(&ready);
 
-    WSTRNCPY(cA[clientArgc++], "client", ARGLEN);
-    WSTRNCPY(cA[clientArgc++], "-u", ARGLEN);
-    WSTRNCPY(cA[clientArgc++], "jill", ARGLEN);
+    ADD_ARG(clientArgv, clientArgc, "client");
+    ADD_ARG(clientArgv, clientArgc, "-u");
+    ADD_ARG(clientArgv, clientArgc, "jill");
+    ADD_ARG(clientArgv, clientArgc, "-C");
+    ADD_ARG(clientArgv, clientArgc, "aes256-cbc");
     #if !defined(USE_WINDOWS_API) && !defined(WOLFSSH_ZEPHYR)
-        WSTRNCPY(cA[clientArgc++], "-p", ARGLEN);
-        WSNPRINTF(cA[clientArgc++], ARGLEN, "%d", ready.port);
+        ADD_ARG(clientArgv, clientArgc, "-p");
+        ADD_ARG_INT(clientArgv, clientArgc, ready.port);
     #endif
 
     clientArgs.argc = clientArgc;


Reviews:
user: login: copilot-pull-request-reviewer[bot]
body: ## Pull Request Overview

Soft-disable AES-CBC by default while allowing it to be re-enabled at build time, and add runtime support and testing for specifying custom cipher lists.

- Introduce a build flag to control AES-CBC advertisement during KEX.
- Update internal cipher enumeration and canned algorithm list to respect the new flag.
- Add a `-C` option to the example client for custom cipher lists and extend the kex test to cover AES-CBC.

### Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

| File                          | Description                                                     |
|-------------------------------|-----------------------------------------------------------------|
| tests/kex.c                   | Expanded `clientArgv` and populated extra args to test AES-CBC  |
| src/internal.c                | Added `WOLFSSH_NO_AES_CBC_SOFT_DISABLE` and guarded CBC algos   |
| examples/client/client.c      | Added `cipherList` (`-C`) option and applied it via SetAlgoListCipher |


<details>
<summary>Comments suppressed due to low confidence (3)</summary>

**src/internal.c:150**
* [nitpick] The macro name `WOLFSSH_NO_AES_CBC_SOFT_DISABLE` is a double negative and may be confusing. Consider renaming it to something like `WOLFSSH_ENABLE_AES_CBC_ADVERTISEMENT` for clarity.
```
  WOLFSSH_NO_AES_CBC_SOFT_DISABLE
```
**examples/client/client.c:673**
* The new `-C` option is parsed but isn't mentioned in the client usage/help text. Please update the printed usage message to include `-C <cipherList>` so users know how to use it.
```
while ((ch = mygetopt(argc, argv, "?ac:C:h:i:j:p:tu:xzNP:RJ:A:XeEk:qK:")) != -1) {
```
**tests/kex.c:178**
* The initializer for `clientArgv` now has more entries—ensure that `NUMARGS` is updated accordingly or that you guard against out-of-bounds access so the test can't overrun the array.
```
{ cA[0], cA[1], cA[2], cA[3], cA[4], cA[5], cA[6], cA[7], cA[8], cA[9],
```
</details>


state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-16T15:29:44Z
user: login: copilot-pull-request-reviewer[bot]
body: ## Pull Request Overview

This PR implements a soft-disable for AES-CBC by default and provides a runtime guard to enable it, as well as an option for the example client to specify a custom cipher algorithm list.  
- Added helper macros (ADD_ARG and ADD_ARG_INT) to simplify argument list construction in tests  
- Updated internal configuration to manage AES-CBC soft disable and modified the canned algorithm list accordingly  
- Extended the example client to support a custom encryption algorithm list via a new "-C" command line flag

### Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

| File                           | Description                                                              |
| ------------------------------ | ------------------------------------------------------------------------ |
| tests/kex.c                   | Introduced macros for consistent argument array handling                |
| src/internal.c                | Added soft-disable flag and adjusted algorithm advertisement logic       |
| examples/client/client.c       | Added support for a custom cipher algorithm list via a new "-C" option     |


<details>
<summary>Comments suppressed due to low confidence (1)</summary>

**examples/client/client.c:130**
* [nitpick] Consider updating the '-C' help text to 'set the list of cipher algorithms to use' for improved clarity and consistency.
```
printf(" -C            set the list of encrypt algos\n");
```
</details>


state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-16T16:15:25Z
user: login: copilot-pull-request-reviewer[bot]
body: ## Pull Request Overview

This PR implements a soft-disable mechanism for AES-CBC by introducing a new preprocessor flag and updates the test and client example code to reflect configurable encryption settings.  
- Introduces new macros for adding string and integer arguments in kex tests  
- Adds the WOLFSSH_NO_AES_CBC_SOFT_DISABLE flag and integrates it in the advertised cipher list  
- Updates the example client to accept a custom cipher list via command-line arguments

### Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

| File                         | Description                                             |
| ---------------------------- | ------------------------------------------------------- |
| tests/kex.c                  | Refactors argument addition using new ADD_ARG macros; expands client and server argument arrays to support additional options |
| src/internal.c               | Adds new soft disable flag for AES-CBC and adjusts advertised cipher list accordingly  |
| examples/client/client.c     | Adds command-line support to specify a custom encryption algorithm list                       |




state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-16T16:37:29Z
user: login: copilot-pull-request-reviewer[bot]
body: ## Pull Request Overview

This PR updates the encryption configuration to soft-disable AES-CBC by default while providing an option to enable it at runtime, and it enhances the test and client example code for handling encryption and key algorithm lists.
- Introduces macros (ADD_ARG and ADD_ARG_INT) in tests/kex.c for handling argument list updates.
- Updates src/internal.c to conditionally advertise AES-CBC based on a new soft-disable flag.
- Extends the client example to accept a custom encryption algorithm list via the new "-C" flag.

### Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

| File                         | Description                                                          |
| ---------------------------- | -------------------------------------------------------------------- |
| tests/kex.c                  | Adds argument macros and uses them to build client/server argument lists. |
| src/internal.c               | Introduces a new flag and updates conditions to control AES-CBC advertisement. |
| examples/client/client.c     | Adds a new client option for setting the encryption algorithm list.  |




state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-16T16:41:42Z
user: login: copilot-pull-request-reviewer[bot]
body: ## Pull Request Overview

This PR soft disables AES-CBC by default while allowing its re-enablement through a runtime flag, and it adds new macros to safely build command-line argument lists for testing and client usage. Key changes include:
- Introduction of the ADD_ARG and ADD_ARG_INT macros in tests/kex.c to build argument lists.
- Addition of the WOLFSSH_NO_AES_CBC_SOFT_DISABLE flag and update to the encryption algorithm list in src/internal.c.
- Updates to the client usage message and argument parsing in examples/client/client.c.

### Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

| File                        | Description                                                                                                    |
| --------------------------- | -------------------------------------------------------------------------------------------------------------- |
| tests/kex.c                 | Added macros for argument list management and updated argument-building calls for server and client configurations. |
| src/internal.c              | Introduced WOLFSSH_NO_AES_CBC_SOFT_DISABLE and modified the encryption algorithm list condition.               |
| examples/client/client.c    | Updated help text and command-line parsing to support a custom cipher list.                                    |




state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-16T16:45:17Z
user: login: douzzer
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-05-16T20:11:32Z

Review comments:
diff_hunk: @@ -163,6 +163,16 @@ static int tsClientUserAuth(byte authType, WS_UserAuthData* authData, void* ctx)
 #define NUMARGS 12
 #define ARGLEN 32
 
+#define ADD_ARG(argList,argListCount,arg) do { \
+    if ((argListCount) < NUMARGS) \
+        WSTRNCPY((argList)[(argListCount)++], (arg), ARGLEN); \
+} while (0)
path: tests/kex.c
user: login: Copilot
body: [nitpick] Consider adding inline comments to document the expected behavior and side effects of the ADD_ARG and ADD_ARG_INT macros to aid future maintainers.
```suggestion

/* 
 * Macro: ADD_ARG
 * Purpose: Adds a string argument to the argument list.
 * Parameters:
 *   - argList: The array of argument strings.
 *   - argListCount: The current count of arguments in the list (modified by the macro).
 *   - arg: The string argument to add.
 * Behavior:
 *   - Copies the string `arg` into the next available slot in `argList`.
 *   - Increments `argListCount` if the operation is successful.
 * Constraints:
 *   - The total number of arguments must not exceed `NUMARGS`.
 *   - Each argument string must not exceed `ARGLEN` characters.
 * Side effects:
 *   - Modifies `argList` and increments `argListCount`.
 */
#define ADD_ARG(argList,argListCount,arg) do { \
    if ((argListCount) < NUMARGS) \
        WSTRNCPY((argList)[(argListCount)++], (arg), ARGLEN); \
} while (0)

/* 
 * Macro: ADD_ARG_INT
 * Purpose: Adds an integer argument to the argument list as a string.
 * Parameters:
 *   - argList: The array of argument strings.
 *   - argListCount: The current count of arguments in the list (modified by the macro).
 *   - arg: The integer argument to add.
 * Behavior:
 *   - Converts the integer `arg` to a string and stores it in the next available slot in `argList`.
 *   - Increments `argListCount` if the operation is successful.
 * Constraints:
 *   - The total number of arguments must not exceed `NUMARGS`.
 *   - Each argument string must not exceed `ARGLEN` characters.
 * Side effects:
 *   - Modifies `argList` and increments `argListCount`.
 */
```
created_at: 2025-05-16T16:15:24Z
author_association: CONTRIBUTOR
diff_hunk: @@ -804,10 +809,12 @@ static const char cannedEncAlgoNames[] =
     "aes128-ctr,"
 #endif
 #if !defined(WOLFSSH_NO_AES_CBC)
-    "aes256-cbc,"
-    "aes192-cbc,"
-    "aes128-cbc,"
-#endif
+    #if defined(WOLFSSH_NO_AES_CBC_SOFT_DISABLE)
+        "aes256-cbc,"
+        "aes192-cbc,"
+        "aes128-cbc,"
+    #endif
+#endif /* WOLFSSH_NO_AES_CBC */
path: src/internal.c
user: login: Copilot
body: Consider combining the nested preprocessor conditions into a single condition (e.g., #if !defined(WOLFSSH_NO_AES_CBC) && defined(WOLFSSH_NO_AES_CBC_SOFT_DISABLE)) for better clarity on when AES-CBC ciphers are advertised.
```suggestion
#if !defined(WOLFSSH_NO_AES_CBC) && defined(WOLFSSH_NO_AES_CBC_SOFT_DISABLE)
    "aes256-cbc,"
    "aes192-cbc,"
    "aes128-cbc,"
#endif /* !defined(WOLFSSH_NO_AES_CBC) && defined(WOLFSSH_NO_AES_CBC_SOFT_DISABLE) */
```
created_at: 2025-05-16T16:37:28Z
author_association: CONTRIBUTOR
diff_hunk: @@ -126,7 +126,8 @@ static void ShowUsage(void)
     printf(" -X            Ignore IP checks on peer vs peer certificate\n");
 #endif
     printf(" -E            List all possible algos\n");
-    printf(" -k            set the list of key algos to use\n");
+    printf(" -k            set the list of key algos\n");
+    printf(" -C            set the list of encrypt algos");
path: examples/client/client.c
user: login: Copilot
body: Consider appending a newline character ('\n') to the usage message for the '-C' option to maintain consistency with other usage strings.
created_at: 2025-05-16T16:37:29Z
author_association: CONTRIBUTOR
diff_hunk: @@ -126,7 +126,8 @@ static void ShowUsage(void)
     printf(" -X            Ignore IP checks on peer vs peer certificate\n");
 #endif
     printf(" -E            List all possible algos\n");
-    printf(" -k            set the list of key algos to use\n");
+    printf(" -k            set the list of key algos\n");
+    printf(" -C            set the list of encrypt algos");
path: examples/client/client.c
user: login: Copilot
body: [nitpick] Consider appending a newline (e.g. "\n") at the end of the '-C set the list of encrypt algos' usage message for consistency with the other usage messages.
created_at: 2025-05-16T16:41:42Z
author_association: CONTRIBUTOR
diff_hunk: @@ -803,7 +808,7 @@ static const char cannedEncAlgoNames[] =
     "aes192-ctr,"
     "aes128-ctr,"
 #endif
-#if !defined(WOLFSSH_NO_AES_CBC)
+#if !defined(WOLFSSH_NO_AES_CBC) && defined(WOLFSSH_NO_AES_CBC_SOFT_DISABLE)
path: src/internal.c
user: login: Copilot
body: [nitpick] Verify that the condition for including AES-CBC algorithms correctly reflects the intended behavior of enabling AES-CBC advertisement when overriding the default soft-disable configuration.
created_at: 2025-05-16T16:41:42Z
author_association: CONTRIBUTOR
diff_hunk: @@ -163,6 +163,52 @@ static int tsClientUserAuth(byte authType, WS_UserAuthData* authData, void* ctx)
 #define NUMARGS 12
 #define ARGLEN 32
 
+/* 
+ * Macro: ADD_ARG
+ * Purpose: Adds a string argument to the argument list.
+ * Parameters:
+ *   - argList: The array of argument strings.
+ *   - argListCount: The current count of arguments in the list (modified
+ *     by the macro).
+ *   - arg: The string argument to add.
+ * Behavior:
+ *   - Copies the string `arg` into the next available slot in `argList`.
+ *   - Increments `argListCount` if the operation is successful.
+ * Constraints:
+ *   - The total number of arguments must not exceed `NUMARGS`.
+ *   - Each argument string must not exceed `ARGLEN` characters.
+ * Side effects:
+ *   - Modifies `argList` and increments `argListCount`.
+ */
+#define ADD_ARG(argList,argListCount,arg) do { \
+    if ((argListCount) < NUMARGS) \
+        WSTRNCPY((argList)[(argListCount)++], (arg), ARGLEN); \
path: tests/kex.c
user: login: Copilot
body: Consider wrapping macro parameters in parentheses to ensure correct operator precedence when passed compound expressions, and verify that argListCount is not inadvertently evaluated multiple times.
```suggestion
#define ADD_ARG(argList, argListCount, arg) do { \
    int tempCount = (argListCount); \
    if (tempCount < NUMARGS) { \
        WSTRNCPY((argList)[tempCount], (arg), ARGLEN); \
        (argListCount) = tempCount + 1; \
    } \
```
created_at: 2025-05-16T16:45:17Z
author_association: CONTRIBUTOR
diff_hunk: @@ -803,7 +808,7 @@ static const char cannedEncAlgoNames[] =
     "aes192-ctr,"
     "aes128-ctr,"
 #endif
-#if !defined(WOLFSSH_NO_AES_CBC)
+#if !defined(WOLFSSH_NO_AES_CBC) && defined(WOLFSSH_NO_AES_CBC_SOFT_DISABLE)
path: src/internal.c
user: login: Copilot
body: Confirm that the conditional inclusion of AES-CBC algorithms aligns with the intended configuration behavior, ensuring that AES-CBC is advertised only when WOLFSSH_NO_AES_CBC_SOFT_DISABLE is defined while AES-CBC is not completely disabled.
created_at: 2025-05-16T16:45:17Z
author_association: CONTRIBUTOR

PR comments:
user: login: douzzer
created_at: 2025-05-16T20:21:39Z
body: This PR appears to be unmergeable due to a bug in githib (see https://github.com/orgs/community/discussions/144455)

A trick that often works is to close and reopen a PR.  I've used that to clear a rebase conflict (the instant-dismissed-review syndrome).  Doesn't work here.

author_association: CONTRIBUTOR
user: login: LinuxJedi
created_at: 2025-05-17T14:54:15Z
body: No problem merging for me, once I resolved the open conversation I could see.
author_association: MEMBER
user: login: douzzer
created_at: 2025-05-19T15:24:31Z
body: Thanks @LinuxJedi -- not sure if I was missing something or if something changed, but all's well that ends well.

author_association: CONTRIBUTOR