Mbed-TLS · zacharykeyessonos · Oct 24, 2025 · Nov 3, 2025 · Nov 3, 2025
diff --git a/ChangeLog.d/fix-module-import-in-extern-c-compiler-error.txt b/ChangeLog.d/fix-module-import-in-extern-c-compiler-error.txt
@@ -0,0 +1,5 @@
+Changes
+   * Fixes a compiler error when building C++ projects that use the 'modules'
+     C++ language feature, and consume Mbed TLS. The specific error is
+     module-import-in-extern-c, which occurs when an #include occurs within
+     'extern C' blocks.
diff --git a/include/mbedtls/aes.h b/include/mbedtls/aes.h
@@ -49,10 +49,6 @@
 /** Invalid input data. */
 #define MBEDTLS_ERR_AES_BAD_INPUT_DATA                    -0x0021
 
-#ifdef __cplusplus
-extern "C" {
-#endif
-
 #if !defined(MBEDTLS_AES_ALT)
 // Regular implementation
 //
@@ -96,6 +92,10 @@ typedef struct mbedtls_aes_xts_context {
 #include "aes_alt.h"
 #endif /* MBEDTLS_AES_ALT */
 
+#ifdef __cplusplus
+extern "C" {
+#endif
+
 /**
  * \brief          This function initializes the specified AES context.
  *

diff --git a/include/mbedtls/aria.h b/include/mbedtls/aria.h
@@ -38,10 +38,6 @@
 /** Invalid data input length. */
 #define MBEDTLS_ERR_ARIA_INVALID_INPUT_LENGTH -0x005E
 
-#ifdef __cplusplus
-extern "C" {
-#endif
-
 #if !defined(MBEDTLS_ARIA_ALT)
 // Regular implementation
 //
@@ -60,6 +56,10 @@ mbedtls_aria_context;
 #include "aria_alt.h"
 #endif /* MBEDTLS_ARIA_ALT */
 
+#ifdef __cplusplus
+extern "C" {
+#endif
+
 /**
  * \brief          This function initializes the specified ARIA context.
  *

diff --git a/include/mbedtls/camellia.h b/include/mbedtls/camellia.h
@@ -27,10 +27,6 @@
 /** Invalid data input length. */
 #define MBEDTLS_ERR_CAMELLIA_INVALID_INPUT_LENGTH -0x0026
 
-#ifdef __cplusplus
-extern "C" {
-#endif
-
 #if !defined(MBEDTLS_CAMELLIA_ALT)
 // Regular implementation
 //
@@ -48,6 +44,10 @@ mbedtls_camellia_context;
 #include "camellia_alt.h"
 #endif /* MBEDTLS_CAMELLIA_ALT */
 
+#ifdef __cplusplus
+extern "C" {
+#endif
+
 /**
  * \brief          Initialize a CAMELLIA context.
  *

diff --git a/include/mbedtls/ccm.h b/include/mbedtls/ccm.h
@@ -54,10 +54,6 @@
 /** Authenticated decryption failed. */
 #define MBEDTLS_ERR_CCM_AUTH_FAILED     -0x000F
 
-#ifdef __cplusplus
-extern "C" {
-#endif
-
 #if !defined(MBEDTLS_CCM_ALT)
 // Regular implementation
 //
@@ -98,6 +94,10 @@ mbedtls_ccm_context;
 #include "ccm_alt.h"
 #endif /* MBEDTLS_CCM_ALT */
 
+#ifdef __cplusplus
+extern "C" {
+#endif
+
 /**
  * \brief           This function initializes the specified CCM context,
  *                  to make references valid, and prepare the context

diff --git a/include/mbedtls/chacha20.h b/include/mbedtls/chacha20.h
@@ -29,10 +29,6 @@
 /** Invalid input parameter(s). */
 #define MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA         -0x0051
 
-#ifdef __cplusplus
-extern "C" {
-#endif
-
 #if !defined(MBEDTLS_CHACHA20_ALT)
 
 typedef struct mbedtls_chacha20_context {
@@ -46,6 +42,10 @@ mbedtls_chacha20_context;
 #include "chacha20_alt.h"
 #endif /* MBEDTLS_CHACHA20_ALT */
 
+#ifdef __cplusplus
+extern "C" {
+#endif
+
 /**
  * \brief           This function initializes the specified ChaCha20 context.
  *

diff --git a/include/mbedtls/chachapoly.h b/include/mbedtls/chachapoly.h
@@ -31,10 +31,6 @@
 /** Authenticated decryption failed: data was not authentic. */
 #define MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED          -0x0056
 
-#ifdef __cplusplus
-extern "C" {
-#endif
-
 typedef enum {
     MBEDTLS_CHACHAPOLY_ENCRYPT,     /**< The mode value for performing encryption. */
     MBEDTLS_CHACHAPOLY_DECRYPT      /**< The mode value for performing decryption. */
@@ -59,6 +55,10 @@ mbedtls_chachapoly_context;
 #include "chachapoly_alt.h"
 #endif /* !MBEDTLS_CHACHAPOLY_ALT */
 
+#ifdef __cplusplus
+extern "C" {
+#endif
+
 /**
  * \brief           This function initializes the specified ChaCha20-Poly1305 context.
  *

diff --git a/include/mbedtls/cmac.h b/include/mbedtls/cmac.h
@@ -20,10 +20,6 @@
 
 #include "mbedtls/cipher.h"
 
-#ifdef __cplusplus
-extern "C" {
-#endif
-
 #define MBEDTLS_AES_BLOCK_SIZE          16
 #define MBEDTLS_DES3_BLOCK_SIZE         8
 
@@ -72,6 +68,10 @@ struct mbedtls_cmac_context_t {
 #include "cmac_alt.h"
 #endif /* !MBEDTLS_CMAC_ALT */
 
+#ifdef __cplusplus
+extern "C" {
+#endif
+
 /**
  * \brief               This function starts a new CMAC computation
  *                      by setting the CMAC key, and preparing to authenticate

diff --git a/include/mbedtls/des.h b/include/mbedtls/des.h
@@ -30,10 +30,6 @@
 
 #define MBEDTLS_DES_KEY_SIZE    8
 
-#ifdef __cplusplus
-extern "C" {
-#endif
-
 #if !defined(MBEDTLS_DES_ALT)
 // Regular implementation
 //
@@ -66,6 +62,10 @@ mbedtls_des3_context;
 #include "des_alt.h"
 #endif /* MBEDTLS_DES_ALT */
 
+#ifdef __cplusplus
+extern "C" {
+#endif
+
 /**
  * \brief          Initialize DES context
  *

diff --git a/include/mbedtls/dhm.h b/include/mbedtls/dhm.h
@@ -89,10 +89,6 @@ typedef enum {
     MBEDTLS_DHM_PARAM_K,  /*!<  The shared secret = \c G^(XY) mod \c P. */
 } mbedtls_dhm_parameter;
 
-#ifdef __cplusplus
-extern "C" {
-#endif
-
 #if !defined(MBEDTLS_DHM_ALT)
 
 /**
@@ -116,6 +112,10 @@ mbedtls_dhm_context;
 #include "dhm_alt.h"
 #endif /* MBEDTLS_DHM_ALT */
 
+#ifdef __cplusplus
+extern "C" {
+#endif
+
 /**
  * \brief          This function initializes the DHM context.
  *

diff --git a/include/mbedtls/ecjpake.h b/include/mbedtls/ecjpake.h
@@ -32,10 +32,6 @@
 #include "mbedtls/ecp.h"
 #include "mbedtls/md.h"
 
-#ifdef __cplusplus
-extern "C" {
-#endif
-
 /**
  * Roles in the EC J-PAKE exchange
  */
@@ -79,6 +75,10 @@ typedef struct mbedtls_ecjpake_context {
 #include "ecjpake_alt.h"
 #endif /* MBEDTLS_ECJPAKE_ALT */
 
+#ifdef __cplusplus
+extern "C" {
+#endif
+
 /**
  * \brief           Initialize an ECJPAKE context.
  *

diff --git a/include/mbedtls/ecp.h b/include/mbedtls/ecp.h
@@ -70,10 +70,6 @@
 #define MBEDTLS_ECP_MONTGOMERY_ENABLED
 #endif
 
-#ifdef __cplusplus
-extern "C" {
-#endif
-
 /**
  * Domain-parameter identifiers: curve, subgroup, and generator.
  *
@@ -313,6 +309,10 @@ mbedtls_ecp_group;
 #include "ecp_alt.h"
 #endif /* MBEDTLS_ECP_ALT */
 
+#ifdef __cplusplus
+extern "C" {
+#endif
+
 /**
  * The maximum size of the groups, that is, of \c N and \c P.
  */

diff --git a/include/mbedtls/gcm.h b/include/mbedtls/gcm.h
@@ -40,10 +40,6 @@
 /** An output buffer is too small. */
 #define MBEDTLS_ERR_GCM_BUFFER_TOO_SMALL                  -0x0016
 
-#ifdef __cplusplus
-extern "C" {
-#endif
-
 #if !defined(MBEDTLS_GCM_ALT)
 
 #if defined(MBEDTLS_GCM_LARGE_TABLE)
@@ -78,6 +74,10 @@ mbedtls_gcm_context;
 #include "gcm_alt.h"
 #endif /* !MBEDTLS_GCM_ALT */
 
+#ifdef __cplusplus
+extern "C" {
+#endif
+
 /**
  * \brief           This function initializes the specified GCM context,
  *                  to make references valid, and prepares the context

diff --git a/include/mbedtls/md5.h b/include/mbedtls/md5.h
@@ -20,10 +20,6 @@
 #include <stddef.h>
 #include <stdint.h>
 
-#ifdef __cplusplus
-extern "C" {
-#endif
-
 #if !defined(MBEDTLS_MD5_ALT)
 // Regular implementation
 //
@@ -47,6 +43,10 @@ mbedtls_md5_context;
 #include "md5_alt.h"
 #endif /* MBEDTLS_MD5_ALT */
 
+#ifdef __cplusplus
+extern "C" {
+#endif
+
 /**
  * \brief          Initialize MD5 context
  *

diff --git a/include/mbedtls/nist_kw.h b/include/mbedtls/nist_kw.h
@@ -28,10 +28,6 @@
 
 #include "mbedtls/cipher.h"
 
-#ifdef __cplusplus
-extern "C" {
-#endif
-
 typedef enum {
     MBEDTLS_KW_MODE_KW = 0,
     MBEDTLS_KW_MODE_KWP = 1
@@ -56,6 +52,10 @@ typedef struct {
 #include "nist_kw_alt.h"
 #endif /* MBEDTLS_NIST_KW_ALT */
 
+#ifdef __cplusplus
+extern "C" {
+#endif
+
 /**
  * \brief           This function initializes the specified key wrapping context
  *                  to make references valid and prepare the context