diff --git a/wrapper/rust/wolfssl-wolfcrypt/build.rs b/wrapper/rust/wolfssl-wolfcrypt/build.rs index f87d05c6c0b..dd9bc832ca5 100644 --- a/wrapper/rust/wolfssl-wolfcrypt/build.rs +++ b/wrapper/rust/wolfssl-wolfcrypt/build.rs @@ -391,19 +391,39 @@ const FIPS_RENAMES: &[(&str, &str)] = &[ ("wc_PRF_TLS", "wc_PRF_TLSv12_fips"), ]; +/// Renames done only by older FIPS modules (v5), used when the module has no +/// `_fips` symbol for the standard name. +const FIPS_V5_RENAMES: &[(&str, &str)] = &[ + /* v5 exports the external IV encrypt under the one shot's FIPS name */ + ("wc_AesGcmEncrypt_ex", "wc_AesGcmEncrypt_fips"), +]; + +/// The renames that apply to the FIPS module whose bindings are `binding`. +/// +/// Computed once and cached, as a build has a single set of bindings. +fn fips_renames(binding: &str) -> &'static [(&'static str, &'static str)] { + static RENAMES: OnceLock> = OnceLock::new(); + RENAMES.get_or_init(|| { + FIPS_RENAMES.iter().chain(FIPS_V5_RENAMES.iter().filter(|(std_name, _)| { + let pattern = format!(r"pub fn {}_fips\s*\(", regex::escape(std_name)); + !Regex::new(&pattern).unwrap().is_match(binding) + })).copied().collect() + }) +} + /// Returns the name the FIPS module exports `base_name` under, for the -/// functions listed in `FIPS_RENAMES`, or `None` for every other function -/// (whose FIPS name is `_fips`). -fn fips_rename(base_name: &str) -> Option<&'static str> { - FIPS_RENAMES.iter() +/// functions listed in `FIPS_RENAMES` and `FIPS_V5_RENAMES`, or `None` for +/// every other function (whose FIPS name is `_fips`). +fn fips_rename(binding: &str, base_name: &str) -> Option<&'static str> { + fips_renames(binding).iter() .find(|(std_name, _)| *std_name == base_name) .map(|(_, fips_name)| *fips_name) } /// Returns the standard wolfCrypt name of the renamed FIPS symbol /// `fips_name`, or `None` if the FIPS module does not rename it. -fn fips_rename_base(fips_name: &str) -> Option<&'static str> { - FIPS_RENAMES.iter() +fn fips_rename_base(binding: &str, fips_name: &str) -> Option<&'static str> { + fips_renames(binding).iter() .find(|(_, fips)| *fips == fips_name) .map(|(std_name, _)| *std_name) } @@ -434,7 +454,7 @@ fn generate_fips_aliases() -> Result<()> { // Handle the functions the FIPS module renames rather than simply // suffixing with _fips. - if let Some(renamed_base_name) = fips_rename_base(&fips_name) { + if let Some(renamed_base_name) = fips_rename_base(&binding, &fips_name) { base_name = renamed_base_name; } @@ -514,7 +534,7 @@ fn has_symbol(binding: &str, function_name: &str) -> bool { // too: the generated aliases make it callable under its standard name, so // missing it here would compile out wrapper code the library supports. let mut pattern = format!(r"\b{}(_fips)?\b", regex::escape(function_name)); - if let Some(fips_name) = fips_rename(function_name) { + if let Some(fips_name) = fips_rename(binding, function_name) { pattern.push_str(&format!(r"|\b{}\b", regex::escape(fips_name))); } let re = match Regex::new(&pattern) { @@ -601,7 +621,8 @@ fn scan_cfg() -> Result<()> { /* ecc */ check_cfg(&binding, "wc_ecc_init", "ecc"); check_cfg(&binding, "wc_ecc_key_new_ex", "ecc_key_new_ex"); - check_cfg(&binding, "wc_ecc_export_point_der_compressed", "ecc_comp_key"); + check_cfg_if(&binding, "wc_ecc_export_point_der_compressed", "ecc_comp_key", + has_symbol(&binding, "WOLFSSL_RUST_HAVE_COMP_KEY")); check_cfg(&binding, "wc_ecc_shared_secret", "ecc_dh"); check_cfg(&binding, "wc_ecc_sign_hash", "ecc_sign"); check_cfg(&binding, "wc_ecc_verify_hash", "ecc_verify"); @@ -639,17 +660,34 @@ fn scan_cfg() -> Result<()> { check_cfg(&binding, "wc_ed448_verify_msg_init", "ed448_streaming_verify"); /* fips */ - if check_cfg(&binding, "wc_SetSeed_Cb_fips", "fips") { + let fips = check_cfg(&binding, "wc_SetSeed_Cb_fips", "fips"); + if fips { // Crates that depend on this one see it as DEP_WOLFSSL_FIPS. println!("cargo::metadata=FIPS=1"); } + // FIPS v5.2.3 builds without RSA blinding, so it has no wc_RsaSetRNG(), + // and keeps wc_RNG_DRBG_Reseed() internal though the header declares it. + println!("cargo::rustc-check-cfg=cfg(fips_v5_2_3)"); + let version = |name: &str| { + Regex::new(&format!(r"pub const {}: u32 = (\d+);", name)).unwrap() + .captures(&binding).and_then(|cap| cap[1].parse::().ok()) + }; + if fips && version("HAVE_FIPS_VERSION_MAJOR") == Some(5) + && version("HAVE_FIPS_VERSION_MINOR") == Some(2) + && version("HAVE_FIPS_VERSION_PATCH") == Some(3) { + println!("cargo::rustc-cfg=fips_v5_2_3"); + // Crates that depend on this one see it as DEP_WOLFSSL_FIPS_V5_2_3. + println!("cargo::metadata=FIPS_V5_2_3=1"); + } /* hkdf */ - check_cfg(&binding, "wc_HKDF_Extract_ex", "hkdf"); + check_cfg(&binding, "wc_HKDF_Extract", "hkdf"); + check_cfg(&binding, "wc_HKDF_Extract_ex", "hkdf_ex"); /* hmac */ check_cfg(&binding, "wc_HmacSetKey", "hmac"); check_cfg(&binding, "wc_HmacSetKey_ex", "hmac_setkey_ex"); + check_cfg(&binding, "wc_HmacCopy", "hmac_copy"); /* kdf */ check_cfg(&binding, "wc_PBKDF2", "kdf_pbkdf2"); @@ -665,6 +703,7 @@ fn scan_cfg() -> Result<()> { /* random */ check_cfg(&binding, "wc_RNG_DRBG_Reseed", "random_hashdrbg"); check_cfg(&binding, "wc_InitRng", "random"); + check_cfg(&binding, "wc_rng_new_ex", "rng_new_ex"); // When WOLFSSL_NO_MALLOC is set without WOLFSSL_STATIC_MEMORY, the // WC_RNG struct contains an inline `drbg_data` field and wolfCrypt sets diff --git a/wrapper/rust/wolfssl-wolfcrypt/headers.h b/wrapper/rust/wolfssl-wolfcrypt/headers.h index 852b37ddb54..4798d0294d4 100644 --- a/wrapper/rust/wolfssl-wolfcrypt/headers.h +++ b/wrapper/rust/wolfssl-wolfcrypt/headers.h @@ -29,6 +29,10 @@ #if !defined(NO_RSA) && !defined(WC_NO_RSA_OAEP) #define WOLFSSL_RUST_HAVE_RSA_OAEP 1 #endif +/* FIPS v5 headers declare the compressed ECC export without HAVE_COMP_KEY. */ +#ifdef HAVE_COMP_KEY +#define WOLFSSL_RUST_HAVE_COMP_KEY 1 +#endif /* Sentinels for wolfSSL build configurations that the Rust wrapper does not * support. build.rs fails the build if any of these appear in the generated diff --git a/wrapper/rust/wolfssl-wolfcrypt/src/hkdf.rs b/wrapper/rust/wolfssl-wolfcrypt/src/hkdf.rs index 79312f94fde..6e3d48484a6 100644 --- a/wrapper/rust/wolfssl-wolfcrypt/src/hkdf.rs +++ b/wrapper/rust/wolfssl-wolfcrypt/src/hkdf.rs @@ -112,7 +112,7 @@ pub fn hkdf_extract_ex(typ: i32, salt: Option<&[u8]>, key: &[u8], out: &mut [u8] None => sys::INVALID_DEVID, }; let rc = unsafe { - sys::wc_HKDF_Extract_ex(typ, salt_ptr, salt_size, + hkdf_extract_raw(typ, salt_ptr, salt_size, key.as_ptr(), key_size, out.as_mut_ptr(), heap, dev_id) }; if rc != 0 { @@ -211,7 +211,7 @@ pub fn hkdf_expand_ex(typ: i32, key: &[u8], info: Option<&[u8]>, out: &mut [u8], None => sys::INVALID_DEVID, }; let rc = unsafe { - sys::wc_HKDF_Expand_ex(typ, key.as_ptr(), key_size, + hkdf_expand_raw(typ, key.as_ptr(), key_size, info_ptr, info_size, out.as_mut_ptr(), out_size, heap, dev_id) }; if rc != 0 { @@ -277,3 +277,60 @@ pub fn hkdf(typ: i32, key: &[u8], salt: Option<&[u8]>, info: Option<&[u8]>, out: } Ok(()) } + +/// `wc_HKDF_Extract_ex()`, or on libraries without it (FIPS v5) the older +/// `wc_HKDF_Extract()`, which takes no heap hint or device ID, so either is +/// refused there. +/// +/// # Safety +/// +/// Same as `wc_HKDF_Extract_ex()`. +#[allow(clippy::too_many_arguments)] +unsafe fn hkdf_extract_raw(typ: i32, salt: *const u8, salt_size: u32, + key: *const u8, key_size: u32, out: *mut u8, + heap: *mut core::ffi::c_void, dev_id: i32) -> i32 { + #[cfg(hkdf_ex)] + { + unsafe { + sys::wc_HKDF_Extract_ex(typ, salt, salt_size, key, key_size, out, + heap, dev_id) + } + } + #[cfg(not(hkdf_ex))] + { + if !heap.is_null() || dev_id != sys::INVALID_DEVID { + return sys::wolfCrypt_ErrorCodes_BAD_FUNC_ARG; + } + unsafe { sys::wc_HKDF_Extract(typ, salt, salt_size, key, key_size, out) } + } +} + +/// `wc_HKDF_Expand_ex()`, or on libraries without it (FIPS v5) the older +/// `wc_HKDF_Expand()`, which takes no heap hint or device ID, so either is +/// refused there. +/// +/// # Safety +/// +/// Same as `wc_HKDF_Expand_ex()`. +#[allow(clippy::too_many_arguments)] +unsafe fn hkdf_expand_raw(typ: i32, key: *const u8, key_size: u32, + info: *const u8, info_size: u32, out: *mut u8, out_size: u32, + heap: *mut core::ffi::c_void, dev_id: i32) -> i32 { + #[cfg(hkdf_ex)] + { + unsafe { + sys::wc_HKDF_Expand_ex(typ, key, key_size, info, info_size, out, + out_size, heap, dev_id) + } + } + #[cfg(not(hkdf_ex))] + { + if !heap.is_null() || dev_id != sys::INVALID_DEVID { + return sys::wolfCrypt_ErrorCodes_BAD_FUNC_ARG; + } + unsafe { + sys::wc_HKDF_Expand(typ, key, key_size, info, info_size, out, + out_size) + } + } +} diff --git a/wrapper/rust/wolfssl-wolfcrypt/src/hmac.rs b/wrapper/rust/wolfssl-wolfcrypt/src/hmac.rs index c312c4ef487..8b1e9cb96f4 100644 --- a/wrapper/rust/wolfssl-wolfcrypt/src/hmac.rs +++ b/wrapper/rust/wolfssl-wolfcrypt/src/hmac.rs @@ -361,6 +361,7 @@ impl HMAC { /// let mut forked = hmac.copy().expect("Error with copy()"); /// forked.update(b"suffix").expect("Error with update()"); /// ``` + #[cfg(hmac_copy)] pub fn copy(&mut self) -> Result { /* &mut self, so a writable pointer to the context is available * directly. */ @@ -374,6 +375,7 @@ impl HMAC { /// `src` must point to an initialized `Hmac` context that nothing else is /// accessing for the duration of the call; `wc_HmacCopy()` may write /// through it. + #[cfg(hmac_copy)] unsafe fn copy_from(src: *mut sys::Hmac) -> Result { /* wc_HmacCopy() fills dst with XMEMCPY() before touching it, so an * uninitialized destination is fine here (unlike wc_Sha256Copy(), @@ -392,6 +394,7 @@ impl HMAC { } } +#[cfg(hmac_copy)] impl Clone for HMAC { /// Deep-copy the HMAC state via `wc_HmacCopy()`. /// diff --git a/wrapper/rust/wolfssl-wolfcrypt/src/hmac_mac.rs b/wrapper/rust/wolfssl-wolfcrypt/src/hmac_mac.rs index a2f5deefe27..f97de1da820 100644 --- a/wrapper/rust/wolfssl-wolfcrypt/src/hmac_mac.rs +++ b/wrapper/rust/wolfssl-wolfcrypt/src/hmac_mac.rs @@ -42,7 +42,7 @@ macro_rules! impl_hmac_mac { $name:ident, hmac_type = $hmac_type:expr, key = $key_size:ty, out = $out_size:ty ) => { $(#[$attr])* - #[derive(Clone)] + #[cfg_attr(hmac_copy, derive(Clone))] pub struct $name { hmac: crate::hmac::HMAC, } diff --git a/wrapper/rust/wolfssl-wolfcrypt/src/random.rs b/wrapper/rust/wolfssl-wolfcrypt/src/random.rs index 515fb9574aa..575b1baf271 100644 --- a/wrapper/rust/wolfssl-wolfcrypt/src/random.rs +++ b/wrapper/rust/wolfssl-wolfcrypt/src/random.rs @@ -131,7 +131,7 @@ impl RNG { None => sys::INVALID_DEVID, }; let rc = unsafe { - sys::wc_rng_new_ex(&mut wc_rng, core::ptr::null_mut(), 0, heap, dev_id) + rng_new_ex(&mut wc_rng, core::ptr::null_mut(), 0, heap, dev_id) }; if rc == 0 { Ok(RNG {wc_rng}) @@ -191,7 +191,7 @@ impl RNG { None => sys::INVALID_DEVID, }; let rc = unsafe { - sys::wc_rng_new_ex(&mut wc_rng, ptr, size, heap, dev_id) + rng_new_ex(&mut wc_rng, ptr, size, heap, dev_id) }; if rc == 0 { Ok(RNG {wc_rng}) @@ -404,7 +404,7 @@ impl RNG { /// let seed = [1u8, 2, 3, 4]; /// rng.reseed(&seed).expect("Error with reseed()"); /// ``` - #[cfg(random_hashdrbg)] + #[cfg(all(random_hashdrbg, not(fips_v5_2_3)))] pub fn reseed(&self, seed: &[u8]) -> Result<(), i32> { let seed_size = crate::buffer_len_to_u32(seed.len())?; let rc = unsafe { @@ -496,6 +496,32 @@ impl rand_core::TryRng for RNG { #[cfg(feature = "rand_core")] impl rand_core::TryCryptoRng for RNG {} +/// `wc_rng_new_ex()`, or on libraries without it (FIPS v5) the older +/// `wc_rng_new()`, which takes no device ID, so any device ID is refused there. +/// +/// # Safety +/// +/// Same as `wc_rng_new_ex()`. +unsafe fn rng_new_ex(rng: &mut *mut sys::WC_RNG, nonce: *mut u8, + nonce_size: u32, heap: *mut core::ffi::c_void, dev_id: i32) -> i32 { + #[cfg(rng_new_ex)] + { + unsafe { sys::wc_rng_new_ex(rng, nonce, nonce_size, heap, dev_id) } + } + #[cfg(not(rng_new_ex))] + { + if dev_id != sys::INVALID_DEVID { + return sys::wolfCrypt_ErrorCodes_BAD_FUNC_ARG; + } + *rng = unsafe { sys::wc_rng_new(nonce, nonce_size, heap) }; + if rng.is_null() { + sys::wolfCrypt_ErrorCodes_RNG_FAILURE_E + } else { + 0 + } + } +} + impl Drop for RNG { /// Safely free the underlying wolfSSL RNG context. /// diff --git a/wrapper/rust/wolfssl-wolfcrypt/src/rsa.rs b/wrapper/rust/wolfssl-wolfcrypt/src/rsa.rs index b5bce21f11c..799534f0576 100644 --- a/wrapper/rust/wolfssl-wolfcrypt/src/rsa.rs +++ b/wrapper/rust/wolfssl-wolfcrypt/src/rsa.rs @@ -1261,13 +1261,14 @@ impl RSA { /// rsa.pss_verify_check(signature, &mut verify_out, msg, RSA::HASH_TYPE_SHA256, RSA::MGF1SHA256).expect("Error with pss_verify_check()"); /// } /// ``` - #[cfg(all(rsa_pss, rsa_const_api))] + #[cfg(all(rsa_pss, any(rsa_const_api, fips_v5_2_3)))] pub fn pss_verify_check(&mut self, din: &[u8], dout: &mut [u8], digest: &[u8], hash_algo: u32, mgf: i32) -> Result { let din_size = crate::buffer_len_to_u32(din.len())?; let dout_size = crate::buffer_len_to_u32(dout.len())?; let digest_size = crate::buffer_len_to_u32(digest.len())?; let rc = unsafe { - sys::wc_RsaPSS_VerifyCheck(din.as_ptr(), din_size, + // FIPS v5.2.3 declares the input non const but only reads it. + sys::wc_RsaPSS_VerifyCheck(din.as_ptr().cast_mut(), din_size, dout.as_mut_ptr(), dout_size, digest.as_ptr(), digest_size, hash_algo, mgf, &mut self.wc_rsakey) }; @@ -1385,13 +1386,7 @@ impl RSA { /// ``` #[cfg(random)] pub fn set_rng(&mut self, rng: RNG) -> Result<(), i32> { - let wc_rng = rng.wc_rng; - let rc = unsafe { - sys::wc_RsaSetRNG(&mut self.wc_rsakey, wc_rng) - }; - if rc != 0 { - return Err(rc); - } + self.set_wc_rng(&rng)?; self.rng = Some(RngHandle::Owned(rng)); Ok(()) } @@ -1403,17 +1398,29 @@ impl RSA { /// when the `alloc` feature is enabled. #[cfg(all(random, feature = "alloc"))] pub fn set_shared_rng(&mut self, rng: alloc::rc::Rc) -> Result<(), i32> { - let wc_rng = rng.wc_rng; - let rc = unsafe { - sys::wc_RsaSetRNG(&mut self.wc_rsakey, wc_rng) - }; - if rc != 0 { - return Err(rc); - } + self.set_wc_rng(&rng)?; self.rng = Some(RngHandle::Shared(rng)); Ok(()) } + /// Point the wolfCrypt key at `rng` for blinding. + #[cfg(random)] + #[cfg_attr(fips_v5_2_3, allow(unused_variables))] + fn set_wc_rng(&mut self, rng: &RNG) -> Result<(), i32> { + // FIPS v5.2.3 builds without RSA blinding, so there is no + // wc_RsaSetRNG() and private operations need no RNG. + #[cfg(not(fips_v5_2_3))] + { + let rc = unsafe { + sys::wc_RsaSetRNG(&mut self.wc_rsakey, rng.wc_rng) + }; + if rc != 0 { + return Err(rc); + } + } + Ok(()) + } + /// Borrow the RNG previously bound via `set_rng` or `set_shared_rng`. #[cfg(random)] pub fn rng(&self) -> Option<&RNG> { diff --git a/wrapper/rust/wolfssl-wolfcrypt/src/sys.rs b/wrapper/rust/wolfssl-wolfcrypt/src/sys.rs index e2d900d0dd4..dfc5673ca3a 100644 --- a/wrapper/rust/wolfssl-wolfcrypt/src/sys.rs +++ b/wrapper/rust/wolfssl-wolfcrypt/src/sys.rs @@ -18,7 +18,7 @@ include!(concat!(env!("OUT_DIR"), "/bindings.rs")); /* Include generated FIPS symbol aliases. */ include!(concat!(env!("OUT_DIR"), "/fips_aliases.rs")); -#[cfg(all(rsa,not(rsa_setrng)))] +#[cfg(all(rsa,not(rsa_setrng),not(fips_v5_2_3)))] unsafe extern "C" { pub fn wc_RsaSetRNG(key: *mut RsaKey, rng: *mut WC_RNG) -> core::ffi::c_int; } diff --git a/wrapper/rust/wolfssl-wolfcrypt/tests/test_hmac.rs b/wrapper/rust/wolfssl-wolfcrypt/tests/test_hmac.rs index 41800a294d5..e70608ffdfc 100644 --- a/wrapper/rust/wolfssl-wolfcrypt/tests/test_hmac.rs +++ b/wrapper/rust/wolfssl-wolfcrypt/tests/test_hmac.rs @@ -58,6 +58,7 @@ fn test_hmac_sha256() { /// Advance an HMAC-SHA256 past "Hi ", fork it with `fork`, then check that /// both the fork and the original produce the RFC 4231 test case 1 tag once /// each has consumed the remaining "There". +#[cfg(hmac_copy)] fn check_hmac_sha256_fork(fork: impl FnOnce(&mut HMAC) -> HMAC) { let key = b"\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b"; let expected = b"\xb0\x34\x4c\x61\xd8\xdb\x38\x53\x5c\xa8\xaf\xce\xaf\x0b\xf1\x2b\x88\x1d\xc2\x00\xc9\x83\x3d\xa7\x26\xe9\x37\x6c\x2e\x32\xcf\xf7"; @@ -81,11 +82,13 @@ fn check_hmac_sha256_fork(fork: impl FnOnce(&mut HMAC) -> HMAC) { } #[test] +#[cfg(hmac_copy)] fn test_hmac_sha256_copy() { check_hmac_sha256_fork(|hmac| hmac.copy().expect("Error with copy()")); } #[test] +#[cfg(hmac_copy)] fn test_hmac_sha256_clone() { check_hmac_sha256_fork(|hmac| hmac.clone()); } diff --git a/wrapper/rust/wolfssl-wolfcrypt/tests/test_hmac_mac.rs b/wrapper/rust/wolfssl-wolfcrypt/tests/test_hmac_mac.rs index 11353118b9b..9cf07ac7d71 100644 --- a/wrapper/rust/wolfssl-wolfcrypt/tests/test_hmac_mac.rs +++ b/wrapper/rust/wolfssl-wolfcrypt/tests/test_hmac_mac.rs @@ -42,6 +42,7 @@ fn test_hmac_sha256_mac_finalize() { } #[test] +#[cfg(hmac_copy)] fn test_hmac_sha256_mac_clone() { let key = b"\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b"; let prefix = b"Hi "; diff --git a/wrapper/rust/wolfssl-wolfcrypt/tests/test_pbkdf2_password_hash.rs b/wrapper/rust/wolfssl-wolfcrypt/tests/test_pbkdf2_password_hash.rs index 690c803ff58..7fd3c9358ce 100644 --- a/wrapper/rust/wolfssl-wolfcrypt/tests/test_pbkdf2_password_hash.rs +++ b/wrapper/rust/wolfssl-wolfcrypt/tests/test_pbkdf2_password_hash.rs @@ -10,6 +10,10 @@ use password_hash::phc::{Output, PasswordHash}; use password_hash::{CustomizedPasswordHasher, PasswordHasher, PasswordVerifier}; use wolfssl_wolfcrypt::pbkdf2_password_hash::*; +// FIPS v5.2.3 refuses HMAC keys under 14 bytes, and PBKDF2 uses the password as +// its HMAC key. +const PASSWORD: &[u8] = b"correct horse battery staple"; + #[test] #[cfg(sha256)] fn test_hash_and_verify() { @@ -24,7 +28,7 @@ fn test_hash_and_verify() { }; let salt = b"0123456789abcdef"; // 16 bytes - let password = b"hunter2"; + let password = PASSWORD; let hash = hasher .hash_password_with_salt(password, salt) @@ -59,7 +63,7 @@ fn test_hash_roundtrip_phc_string() { }; let salt = b"0123456789abcdef"; - let password = b"password"; + let password = PASSWORD; let hash = hasher .hash_password_with_salt(password, salt) @@ -106,7 +110,7 @@ fn test_sha384_algorithm() { }; let salt = b"0123456789abcdef"; - let password = b"password"; + let password = PASSWORD; let hash = hasher .hash_password_with_salt(password, salt) @@ -133,7 +137,7 @@ fn test_sha512_algorithm() { }; let salt = b"0123456789abcdef"; - let password = b"password"; + let password = PASSWORD; let hash = hasher .hash_password_with_salt(password, salt) @@ -153,7 +157,7 @@ fn test_customized_hash() { let hasher = Pbkdf2::default(); let salt = b"0123456789abcdef"; - let password = b"password"; + let password = PASSWORD; let custom_params = Params { rounds: 8192, output_len: 48, @@ -179,7 +183,7 @@ fn test_customized_hash_with_algorithm_override() { let hasher = Pbkdf2::default(); let salt = b"0123456789abcdef"; - let password = b"password"; + let password = PASSWORD; let params = Params { rounds: 4096, output_len: 64, @@ -210,7 +214,7 @@ fn test_version_rejected() { let salt = b"0123456789abcdef"; let result = - hasher.hash_password_customized(b"password", salt, None, Some(1), Params::default()); + hasher.hash_password_customized(PASSWORD, salt, None, Some(1), Params::default()); assert!(result.is_err()); } @@ -222,7 +226,7 @@ fn test_unknown_algorithm_rejected() { let salt = b"0123456789abcdef"; let result = hasher.hash_password_customized( - b"password", + PASSWORD, salt, Some("argon2id"), None, @@ -245,7 +249,7 @@ fn test_deterministic_output() { }; let salt = b"0123456789abcdef"; - let password = b"password"; + let password = PASSWORD; let hash1 = hasher .hash_password_with_salt(password, salt) @@ -270,7 +274,7 @@ fn test_different_salts_produce_different_hashes() { }, }; - let password = b"password"; + let password = PASSWORD; let hash1 = hasher .hash_password_with_salt(password, b"salt_aaaaaaaaaa01") @@ -296,7 +300,7 @@ fn test_output_len_bounds() { for len in [0, 1, Output::MIN_LENGTH - 1, Output::MAX_LENGTH + 1] { let bad = Params { rounds: 1000, output_len: len }; let err = hasher - .hash_password_customized(b"pw", salt, None, None, bad) + .hash_password_customized(PASSWORD, salt, None, None, bad) .unwrap_err(); assert_eq!(err, Error::ParamInvalid { name: "l" }); } @@ -306,7 +310,7 @@ fn test_output_len_bounds() { for len in [min_ok_len, Output::MAX_LENGTH] { let ok = Params { rounds: 1000, output_len: len }; let hash = hasher - .hash_password_customized(b"pw", salt, None, None, ok) + .hash_password_customized(PASSWORD, salt, None, None, ok) .unwrap(); assert_eq!(hash.hash.unwrap().len(), len); } diff --git a/wrapper/rust/wolfssl-wolfcrypt/tests/test_random.rs b/wrapper/rust/wolfssl-wolfcrypt/tests/test_random.rs index 3d83a8c8a97..158235dda9e 100644 --- a/wrapper/rust/wolfssl-wolfcrypt/tests/test_random.rs +++ b/wrapper/rust/wolfssl-wolfcrypt/tests/test_random.rs @@ -109,7 +109,7 @@ fn test_rng_generate_block_large() { } #[test] -#[cfg(random_hashdrbg)] +#[cfg(all(random_hashdrbg, not(fips_v5_2_3)))] fn test_rng_reseed() { let rng = RNG::new().expect("Failed to create RNG"); let seed = [1u8, 2, 3, 4]; diff --git a/wrapper/rust/wolfssl-wolfcrypt/tests/test_rsa.rs b/wrapper/rust/wolfssl-wolfcrypt/tests/test_rsa.rs index 33f0a1fd20d..dab63112fe6 100644 --- a/wrapper/rust/wolfssl-wolfcrypt/tests/test_rsa.rs +++ b/wrapper/rust/wolfssl-wolfcrypt/tests/test_rsa.rs @@ -93,7 +93,7 @@ fn test_rsa_encrypt_decrypt() { } #[test] -#[cfg(all(sha256, random, rsa_pss, rsa_private, rsa_sign))] +#[cfg(all(sha256, random, rsa_pss, rsa_const_api, rsa_private, rsa_sign))] fn test_rsa_pss() { let rng = Rc::new(RNG::new().expect("Error creating RNG")); @@ -120,7 +120,7 @@ fn test_rsa_pss() { } #[test] -#[cfg(all(random, rsa_direct, rsa_private))] +#[cfg(all(random, rsa_direct, rsa_const_api, rsa_private))] fn test_rsa_direct() { let rng = RNG::new().expect("Error creating RNG");