From c4fcd5fd54cad09611df2d85fed45d61cc5bdb5a Mon Sep 17 00:00:00 2001
From: JacobBarthelmeh <jacob@wolfssl.com>
Date: Thu, 3 Apr 2025 13:58:43 -0600
Subject: [PATCH 1/2] do sanity check that the
 -Wa,-mbranches-within-32B-boundaries is supported for cases where CC=gcc is
 really clang

---
 configure.ac | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/configure.ac b/configure.ac
index 8372573f0..0ff116460 100644
--- a/configure.ac
+++ b/configure.ac
@@ -178,12 +178,21 @@ DEBUG_CFLAGS="-g -DDEBUG -DDEBUG_WOLFSSL"
 LIB_ADD=
 LIB_STATIC_ADD=
 
-EXTRA_OPTS_CFLAGS=
-if test "$host_cpu" = "x86_64"
+CAN_USE_32B_BOUNDARIES_FLAG=no
+AX_CHECK_COMPILE_FLAG([-Wa,-mbranches-within-32B-boundaries],
+    [CAN_USE_32B_BOUNDARIES_FLAG=yes],
+    [CAN_USE_32B_BOUNDARIES_FLAG=no],
+    [-Werror],[])
+
+if test "$CAN_USE_32B_BOUNDARIES_FLAG" = "yes"
 then
-    if test "$CC" = "gcc" || test "$CC" = "icc"
+    EXTRA_OPTS_CFLAGS=
+    if test "$host_cpu" = "x86_64"
     then
-        EXTRA_OPTS_CFLAGS="$EXTRA_OPTS_CFLAGS -Wa,-mbranches-within-32B-boundaries -falign-loops=64"
+        if test "$GCC" = "yes" || test "$CC" = "icc"
+        then
+            EXTRA_OPTS_CFLAGS="$EXTRA_OPTS_CFLAGS -Wa,-mbranches-within-32B-boundaries -falign-loops=64"
+        fi
     fi
 fi
 OPTIMIZE_CFLAGS="$OPTIMIZE_CFLAGS $EXTRA_OPTS_CFLAGS"

From f6894a39496e990d78fe5456de4eb5a4d3b4d55b Mon Sep 17 00:00:00 2001
From: JacobBarthelmeh <jacob@wolfssl.com>
Date: Thu, 3 Apr 2025 15:05:24 -0600
Subject: [PATCH 2/2] add compileharden flag

---
 configure.ac | 41 ++++++++++++++++++++++++-----------------
 1 file changed, 24 insertions(+), 17 deletions(-)

diff --git a/configure.ac b/configure.ac
index 0ff116460..343ab5173 100644
--- a/configure.ac
+++ b/configure.ac
@@ -178,23 +178,6 @@ DEBUG_CFLAGS="-g -DDEBUG -DDEBUG_WOLFSSL"
 LIB_ADD=
 LIB_STATIC_ADD=
 
-CAN_USE_32B_BOUNDARIES_FLAG=no
-AX_CHECK_COMPILE_FLAG([-Wa,-mbranches-within-32B-boundaries],
-    [CAN_USE_32B_BOUNDARIES_FLAG=yes],
-    [CAN_USE_32B_BOUNDARIES_FLAG=no],
-    [-Werror],[])
-
-if test "$CAN_USE_32B_BOUNDARIES_FLAG" = "yes"
-then
-    EXTRA_OPTS_CFLAGS=
-    if test "$host_cpu" = "x86_64"
-    then
-        if test "$GCC" = "yes" || test "$CC" = "icc"
-        then
-            EXTRA_OPTS_CFLAGS="$EXTRA_OPTS_CFLAGS -Wa,-mbranches-within-32B-boundaries -falign-loops=64"
-        fi
-    fi
-fi
 OPTIMIZE_CFLAGS="$OPTIMIZE_CFLAGS $EXTRA_OPTS_CFLAGS"
 OPTIMIZE_FAST_CFLAGS="$OPTIMIZE_FAST_CFLAGS $EXTRA_OPTS_CFLAGS"
 OPTIMIZE_HUGE_CFLAGS="$OPTIMIZE_HUGE_CFLAGS $EXTRA_OPTS_CFLAGS"
@@ -2535,6 +2518,30 @@ then
     AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_CHECK_SIG_FAULTS -DWOLFSSL_CHECK_VER_FAULTS"
 fi
 
+AC_ARG_ENABLE([compileharden],
+    [AS_HELP_STRING([--enable-compileharden],[Enable extra hardening compile flags (default: disabled)])],
+    [ENABLED_COMPILEHARDEN=$enableval],
+    [ENABLED_COMPILEHARDEN=no])
+
+EXTRA_OPTS_CFLAGS=
+if test "$ENABLED_COMPILEHARDEN" = "yes"
+then
+    CAN_USE_32B_BOUNDARIES_FLAG=no
+    AX_CHECK_COMPILE_FLAG([-Wa,-mbranches-within-32B-boundaries],
+        [CAN_USE_32B_BOUNDARIES_FLAG=yes],
+        [CAN_USE_32B_BOUNDARIES_FLAG=no],
+        [-Werror],[])
+
+    if test "$CAN_USE_32B_BOUNDARIES_FLAG" = "yes"
+    then
+        EXTRA_OPTS_CFLAGS="$EXTRA_OPTS_CFLAGS -Wa,-mbranches-within-32B-boundaries -falign-loops=64"
+    else
+        AC_MSG_ERROR([compiler does not accept -mbranches-within-32B-boundaries flag])
+    fi
+fi
+
+
+
 # IPv6 Test Apps
 AC_ARG_ENABLE([ipv6],
     [AS_HELP_STRING([--enable-ipv6],[Enable testing of IPV6 (default: disabled)])],