From 8543e40032babc22b191c4a0e2e22744dee2ab2e Mon Sep 17 00:00:00 2001
From: David Garske <david@wolfssl.com>
Date: Tue, 20 Oct 2026 14:29:32 -0700
Subject: [PATCH] Define WOLFSSL_AES_DIRECT for AES-CTR and AES-OFB alongside
 CFB and XTS

---
 wolfssl/wolfcrypt/settings.h | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/wolfssl/wolfcrypt/settings.h b/wolfssl/wolfcrypt/settings.h
index ed78cdda96..37662b1418 100644
--- a/wolfssl/wolfcrypt/settings.h
+++ b/wolfssl/wolfcrypt/settings.h
@@ -3978,14 +3978,12 @@
         #undef  HAVE_AES_CBC
         #define HAVE_AES_CBC
     #endif
-    #ifdef WOLFSSL_AES_XTS
-        /* AES-XTS makes calls to AES direct functions */
-        #ifndef WOLFSSL_AES_DIRECT
-        #define WOLFSSL_AES_DIRECT
-        #endif
-    #endif
-    #ifdef WOLFSSL_AES_CFB
-        /* AES-CFB makes calls to AES direct functions */
+    /* These modes make calls to the AES direct functions. configure pairs
+     * CTR, OFB and XTS with WOLFSSL_AES_DIRECT itself and leaves CFB to this
+     * block, so all four are handled here: a user_settings.h build enabling
+     * one of them without it fails on an implicit wc_AesEncrypt(). */
+    #if defined(WOLFSSL_AES_COUNTER) || defined(WOLFSSL_AES_CFB) || \
+        defined(WOLFSSL_AES_OFB)     || defined(WOLFSSL_AES_XTS)
         #ifndef WOLFSSL_AES_DIRECT
         #define WOLFSSL_AES_DIRECT
         #endif