Rust wrapper: fix more FIPS v5 compatibility situations and doc tests

wrapper/rust/wolfssl-wolfcrypt/CHANGELOG.md

@@ -80,8 +80,8 @@ New features:
   for prehash signing and verification
 - Publish build metadata to dependent crates' build scripts: the directory of
   a shared wolfSSL library as DEP_WOLFSSL_LIBDIRS (e.g. to set an rpath), and
-  DEP_WOLFSSL_FIPS and DEP_WOLFSSL_FIPS_V5_2_3 when wolfSSL is a FIPS build or
-  specifically the FIPS v5.2.3 module
+  DEP_WOLFSSL_FIPS and DEP_WOLFSSL_FIPS_V5 when wolfSSL is a FIPS build or
+  specifically a FIPS v5.x.x module
 - build.rs looks for the library under either lib or lib64 in WOLFSSL_PREFIX,
   recognizes MinGW, Cygwin and MSVC library file names, and reruns when
   WOLFSSL_PREFIX changes

wrapper/rust/wolfssl-wolfcrypt/README.md

@@ -163,7 +163,7 @@ the build scripts of crates that depend on it directly:
 | ------------------------- | ----- |
 | `DEP_WOLFSSL_LIBDIRS`     | Directory containing a shared wolfSSL library (e.g. to set an rpath) |
 | `DEP_WOLFSSL_FIPS`        | `1` when wolfSSL is a FIPS build |
-| `DEP_WOLFSSL_FIPS_V5_2_3` | `1` when wolfSSL is the FIPS v5.2.3 module |
+| `DEP_WOLFSSL_FIPS_V5`     | `1` when wolfSSL is the FIPS v5 module |
 
 ### Cross-Compiling
 

wrapper/rust/wolfssl-wolfcrypt/build.rs

@@ -665,19 +665,17 @@ fn scan_cfg() -> Result<()> {
         // Crates that depend on this one see it as DEP_WOLFSSL_FIPS.
         println!("cargo::metadata=FIPS=1");
     }
-    // FIPS v5.2.3 builds without RSA blinding, so it has no wc_RsaSetRNG(),
+    // FIPS v5 builds without RSA blinding, so it has no wc_RsaSetRNG(),
     // and keeps wc_RNG_DRBG_Reseed() internal though the header declares it.
-    println!("cargo::rustc-check-cfg=cfg(fips_v5_2_3)");
+    println!("cargo::rustc-check-cfg=cfg(fips_v5)");
     let version = |name: &str| {
         Regex::new(&format!(r"pub const {}: u32 = (\d+);", name)).unwrap()
             .captures(&binding).and_then(|cap| cap[1].parse::<u32>().ok())
     };
-    if fips && version("HAVE_FIPS_VERSION_MAJOR") == Some(5)
-            && version("HAVE_FIPS_VERSION_MINOR") == Some(2)
-            && version("HAVE_FIPS_VERSION_PATCH") == Some(3) {
-        println!("cargo::rustc-cfg=fips_v5_2_3");
-        // Crates that depend on this one see it as DEP_WOLFSSL_FIPS_V5_2_3.
-        println!("cargo::metadata=FIPS_V5_2_3=1");
+    if fips && version("HAVE_FIPS_VERSION_MAJOR").or_else(|| version("HAVE_FIPS_VERSION")) == Some(5) {
+        println!("cargo::rustc-cfg=fips_v5");
+        // Crates that depend on this one see it as DEP_WOLFSSL_FIPS_V5.
+        println!("cargo::metadata=FIPS_V5=1");
     }
 
     /* hkdf */

wrapper/rust/wolfssl-wolfcrypt/src/dh.rs

@@ -1170,6 +1170,11 @@ impl DH {
     /// {
     /// use wolfssl_wolfcrypt::random::RNG;
     /// use wolfssl_wolfcrypt::dh::DH;
+    /// #[cfg(fips)]
+    /// {
+    /// use wolfssl_wolfcrypt::fips;
+    /// fips::set_private_key_read_enable(1);
+    /// }
     /// let p = [
     ///     0xc5u8, 0x7c, 0xa2, 0x4f, 0x4b, 0xd6, 0x8c, 0x3c,
     ///     0xda, 0xc7, 0xba, 0xaa, 0xea, 0x2e, 0x5c, 0x1e,
@@ -1337,6 +1342,11 @@ impl DH {
     /// {
     /// use wolfssl_wolfcrypt::random::RNG;
     /// use wolfssl_wolfcrypt::dh::DH;
+    /// #[cfg(fips)]
+    /// {
+    /// use wolfssl_wolfcrypt::fips;
+    /// fips::set_private_key_read_enable(1);
+    /// }
     /// let p = [
     ///     0xc5u8, 0x7c, 0xa2, 0x4f, 0x4b, 0xd6, 0x8c, 0x3c,
     ///     0xda, 0xc7, 0xba, 0xaa, 0xea, 0x2e, 0x5c, 0x1e,

wrapper/rust/wolfssl-wolfcrypt/src/ecc.rs

@@ -726,6 +726,11 @@ impl ECC {
     /// {
     /// use wolfssl_wolfcrypt::random::RNG;
     /// use wolfssl_wolfcrypt::ecc::ECC;
+    /// #[cfg(fips)]
+    /// {
+    /// use wolfssl_wolfcrypt::fips;
+    /// fips::set_private_key_read_enable(1);
+    /// }
     /// let rng = RNG::new().expect("Failed to create RNG");
     /// let mut ecc = ECC::generate(32, &rng, None, None).expect("Error with generate()");
     /// let hash = [0x42u8; 32];
@@ -791,6 +796,11 @@ impl ECC {
     /// {
     /// use wolfssl_wolfcrypt::random::RNG;
     /// use wolfssl_wolfcrypt::ecc::ECC;
+    /// #[cfg(fips)]
+    /// {
+    /// use wolfssl_wolfcrypt::fips;
+    /// fips::set_private_key_read_enable(1);
+    /// }
     /// let rng = RNG::new().expect("Failed to create RNG");
     /// let curve_id = ECC::SECP256R1;
     /// let curve_size = ECC::get_curve_size_from_id(curve_id).expect("Error with get_curve_size_from_id()");
@@ -1030,6 +1040,11 @@ impl ECC {
     /// {
     /// use wolfssl_wolfcrypt::random::RNG;
     /// use wolfssl_wolfcrypt::ecc::ECC;
+    /// #[cfg(fips)]
+    /// {
+    /// use wolfssl_wolfcrypt::fips;
+    /// fips::set_private_key_read_enable(1);
+    /// }
     /// let rng = RNG::new().expect("Failed to create RNG");
     /// let mut ecc = ECC::generate(32, &rng, None, None).expect("Error with generate()");
     /// let mut x963 = [0u8; 128];
@@ -1084,6 +1099,11 @@ impl ECC {
     /// {
     /// use wolfssl_wolfcrypt::random::RNG;
     /// use wolfssl_wolfcrypt::ecc::ECC;
+    /// #[cfg(fips)]
+    /// {
+    /// use wolfssl_wolfcrypt::fips;
+    /// fips::set_private_key_read_enable(1);
+    /// }
     /// let rng = RNG::new().expect("Failed to create RNG");
     /// let curve_id = ECC::SECP256R1;
     /// let curve_size = ECC::get_curve_size_from_id(curve_id).expect("Error with get_curve_size_from_id()");
@@ -1542,6 +1562,11 @@ impl ECC {
     /// {
     /// use wolfssl_wolfcrypt::random::RNG;
     /// use wolfssl_wolfcrypt::ecc::ECC;
+    /// #[cfg(fips)]
+    /// {
+    /// use wolfssl_wolfcrypt::fips;
+    /// fips::set_private_key_read_enable(1);
+    /// }
     /// let rng = RNG::new().expect("Failed to create RNG");
     /// let mut ecc = ECC::generate(32, &rng, None, None).expect("Error with generate()");
     /// let mut x963 = [0u8; 128];
@@ -1781,6 +1806,11 @@ impl ECC {
     /// use std::rc::Rc;
     /// use wolfssl_wolfcrypt::random::RNG;
     /// use wolfssl_wolfcrypt::ecc::ECC;
+    /// #[cfg(fips)]
+    /// {
+    /// use wolfssl_wolfcrypt::fips;
+    /// fips::set_private_key_read_enable(1);
+    /// }
     /// let rng = Rc::new(RNG::new().expect("Failed to create RNG"));
     /// let mut ecc0 = ECC::generate(32, &rng, None, None).expect("Error with generate()");
     /// let mut ecc1 = ECC::generate(32, &rng, None, None).expect("Error with generate()");
@@ -1831,6 +1861,11 @@ impl ECC {
     /// use std::rc::Rc;
     /// use wolfssl_wolfcrypt::random::RNG;
     /// use wolfssl_wolfcrypt::ecc::ECC;
+    /// #[cfg(fips)]
+    /// {
+    /// use wolfssl_wolfcrypt::fips;
+    /// fips::set_private_key_read_enable(1);
+    /// }
     /// let rng = Rc::new(RNG::new().expect("Failed to create RNG"));
     /// let mut ecc0 = ECC::generate(32, &rng, None, None).expect("Error with generate()");
     /// let mut ecc1 = ECC::generate(32, &rng, None, None).expect("Error with generate()");

wrapper/rust/wolfssl-wolfcrypt/src/hkdf.rs

@@ -52,6 +52,11 @@ use crate::hmac::HMAC;
 /// use wolfssl_wolfcrypt::hkdf::*;
 /// use wolfssl_wolfcrypt::hmac::HMAC;
 /// use wolfssl_wolfcrypt::sha::SHA256;
+/// #[cfg(fips)]
+/// {
+/// use wolfssl_wolfcrypt::fips;
+/// fips::set_private_key_read_enable(1);
+/// }
 /// let ikm = b"MyPassword0";
 /// let salt = b"12345678ABCDEFGH";
 /// let mut extract_out = [0u8; SHA256::DIGEST_SIZE];
@@ -87,6 +92,11 @@ pub fn hkdf_extract(typ: i32, salt: Option<&[u8]>, key: &[u8], out: &mut [u8]) -
 /// use wolfssl_wolfcrypt::hkdf::*;
 /// use wolfssl_wolfcrypt::hmac::HMAC;
 /// use wolfssl_wolfcrypt::sha::SHA256;
+/// #[cfg(fips)]
+/// {
+/// use wolfssl_wolfcrypt::fips;
+/// fips::set_private_key_read_enable(1);
+/// }
 /// let ikm = b"MyPassword0";
 /// let salt = b"12345678ABCDEFGH";
 /// let mut extract_out = [0u8; SHA256::DIGEST_SIZE];
@@ -146,6 +156,11 @@ pub fn hkdf_extract_ex(typ: i32, salt: Option<&[u8]>, key: &[u8], out: &mut [u8]
 /// use wolfssl_wolfcrypt::hkdf::*;
 /// use wolfssl_wolfcrypt::hmac::HMAC;
 /// use wolfssl_wolfcrypt::sha::SHA256;
+/// #[cfg(fips)]
+/// {
+/// use wolfssl_wolfcrypt::fips;
+/// fips::set_private_key_read_enable(1);
+/// }
 /// let ikm = b"MyPassword0";
 /// let salt = b"12345678ABCDEFGH";
 /// let mut extract_out = [0u8; SHA256::DIGEST_SIZE];
@@ -185,6 +200,11 @@ pub fn hkdf_expand(typ: i32, key: &[u8], info: Option<&[u8]>, out: &mut [u8]) ->
 /// use wolfssl_wolfcrypt::hkdf::*;
 /// use wolfssl_wolfcrypt::hmac::HMAC;
 /// use wolfssl_wolfcrypt::sha::SHA256;
+/// #[cfg(fips)]
+/// {
+/// use wolfssl_wolfcrypt::fips;
+/// fips::set_private_key_read_enable(1);
+/// }
 /// let ikm = b"MyPassword0";
 /// let salt = b"12345678ABCDEFGH";
 /// let mut extract_out = [0u8; SHA256::DIGEST_SIZE];
@@ -247,6 +267,11 @@ pub fn hkdf_expand_ex(typ: i32, key: &[u8], info: Option<&[u8]>, out: &mut [u8],
 /// ```rust
 /// use wolfssl_wolfcrypt::hkdf::*;
 /// use wolfssl_wolfcrypt::hmac::HMAC;
+/// #[cfg(fips)]
+/// {
+/// use wolfssl_wolfcrypt::fips;
+/// fips::set_private_key_read_enable(1);
+/// }
 /// let ikm = b"MyPassword0";
 /// let salt = b"12345678ABCDEFGH";
 /// let info = b"0";

wrapper/rust/wolfssl-wolfcrypt/src/kdf.rs

@@ -634,6 +634,11 @@ pub fn tls13_hkdf_expand_label_ex(typ: i32, key: &[u8], protocol: &[u8], label:
 /// {
 /// use wolfssl_wolfcrypt::hmac::HMAC;
 /// use wolfssl_wolfcrypt::kdf::*;
+/// #[cfg(fips)]
+/// {
+/// use wolfssl_wolfcrypt::fips;
+/// fips::set_private_key_read_enable(1);
+/// }
 /// let k = [0x42u8; 256];
 /// let h = [0x43u8; 32];
 /// let sid = [0x44u8; 32];

wrapper/rust/wolfssl-wolfcrypt/src/pbkdf2_password_hash.rs

@@ -199,7 +199,7 @@ impl TryFrom<&PasswordHash> for Params {
 ///
 /// let hasher = Pbkdf2::default();
 /// let salt = b"0123456789abcdef"; // 16 bytes
-/// let hash = hasher.hash_password_with_salt(b"password", salt)
+/// let hash = hasher.hash_password_with_salt(b"correct horse battery staple", salt)
 ///     .expect("hashing failed");
 /// ```
 #[derive(Clone, Debug, Default)]

wrapper/rust/wolfssl-wolfcrypt/src/prf.rs

@@ -58,6 +58,11 @@ pub const PRF_HASH_SM3: i32 = sys::wc_MACAlgorithm_sm3_mac as i32;
 /// #[cfg(sha384)]
 /// {
 /// use wolfssl_wolfcrypt::prf::*;
+/// #[cfg(fips)]
+/// {
+/// use wolfssl_wolfcrypt::fips;
+/// fips::set_private_key_read_enable(1);
+/// }
 /// let secret = [0x10u8, 0xbc, 0xb4, 0xa2, 0xe8, 0xdc, 0xf1, 0x9b, 0x4c,
 ///     0x51, 0x9c, 0xed, 0x31, 0x1b, 0x51, 0x57, 0x02, 0x3f,
 ///     0xa1, 0x7d, 0xfb, 0x0e, 0xf3, 0x4e, 0x8f, 0x6f, 0x71,
@@ -102,6 +107,11 @@ pub fn prf(secret: &[u8], seed: &[u8], hash_type: i32, dout: &mut [u8]) -> Resul
 /// #[cfg(sha384)]
 /// {
 /// use wolfssl_wolfcrypt::prf::*;
+/// #[cfg(fips)]
+/// {
+/// use wolfssl_wolfcrypt::fips;
+/// fips::set_private_key_read_enable(1);
+/// }
 /// let secret = [0x10u8, 0xbc, 0xb4, 0xa2, 0xe8, 0xdc, 0xf1, 0x9b, 0x4c,
 ///     0x51, 0x9c, 0xed, 0x31, 0x1b, 0x51, 0x57, 0x02, 0x3f,
 ///     0xa1, 0x7d, 0xfb, 0x0e, 0xf3, 0x4e, 0x8f, 0x6f, 0x71,

wrapper/rust/wolfssl-wolfcrypt/src/random.rs

@@ -404,7 +404,7 @@ impl RNG {
     /// let seed = [1u8, 2, 3, 4];
     /// rng.reseed(&seed).expect("Error with reseed()");
     /// ```
-    #[cfg(all(random_hashdrbg, not(fips_v5_2_3)))]
+    #[cfg(all(random_hashdrbg, not(fips_v5)))]
     pub fn reseed(&self, seed: &[u8]) -> Result<(), i32> {
         let seed_size = crate::buffer_len_to_u32(seed.len())?;
         let rc = unsafe {

wrapper/rust/wolfssl-wolfcrypt/src/rsa.rs

@@ -575,6 +575,11 @@ impl RSA {
     /// {
     /// use wolfssl_wolfcrypt::random::RNG;
     /// use wolfssl_wolfcrypt::rsa::RSA;
+    /// #[cfg(fips)]
+    /// {
+    /// use wolfssl_wolfcrypt::fips;
+    /// fips::set_private_key_read_enable(1);
+    /// }
     ///
     /// let rng = RNG::new().expect("Error creating RNG");
     /// let mut rsa = RSA::generate(2048, 65537, &rng).expect("Error with generate()");
@@ -1034,7 +1039,7 @@ impl RSA {
     /// # Example
     ///
     /// ```rust
-    /// #[cfg(all(random, rsa_pss, rsa_private, rsa_sign, feature = "alloc"))]
+    /// #[cfg(all(random, rsa_pss, rsa_const_api, rsa_private, rsa_sign, feature = "alloc"))]
     /// {
     /// use std::fs;
     /// use wolfssl_wolfcrypt::random::RNG;
@@ -1261,13 +1266,13 @@ impl RSA {
     /// rsa.pss_verify_check(signature, &mut verify_out, msg, RSA::HASH_TYPE_SHA256, RSA::MGF1SHA256).expect("Error with pss_verify_check()");
     /// }
     /// ```
-    #[cfg(all(rsa_pss, any(rsa_const_api, fips_v5_2_3)))]
+    #[cfg(all(rsa_pss, any(rsa_const_api, fips_v5)))]
     pub fn pss_verify_check(&mut self, din: &[u8], dout: &mut [u8], digest: &[u8], hash_algo: u32, mgf: i32) -> Result<usize, i32> {
         let din_size = crate::buffer_len_to_u32(din.len())?;
         let dout_size = crate::buffer_len_to_u32(dout.len())?;
         let digest_size = crate::buffer_len_to_u32(digest.len())?;
         let rc = unsafe {
-            // FIPS v5.2.3 declares the input non const but only reads it.
+            // FIPS v5 declares the input non const but only reads it.
             sys::wc_RsaPSS_VerifyCheck(din.as_ptr().cast_mut(), din_size,
                 dout.as_mut_ptr(), dout_size, digest.as_ptr(), digest_size,
                 hash_algo, mgf, &mut self.wc_rsakey)
@@ -1405,11 +1410,9 @@ impl RSA {
 
     /// Point the wolfCrypt key at `rng` for blinding.
     #[cfg(random)]
-    #[cfg_attr(fips_v5_2_3, allow(unused_variables))]
+    #[cfg_attr(not(rsa_setrng), allow(unused_variables))]
     fn set_wc_rng(&mut self, rng: &RNG) -> Result<(), i32> {
-        // FIPS v5.2.3 builds without RSA blinding, so there is no
-        // wc_RsaSetRNG() and private operations need no RNG.
-        #[cfg(not(fips_v5_2_3))]
+        #[cfg(rsa_setrng)]
         {
             let rc = unsafe {
                 sys::wc_RsaSetRNG(&mut self.wc_rsakey, rng.wc_rng)

wrapper/rust/wolfssl-wolfcrypt/src/sys.rs

@@ -17,8 +17,3 @@ include!(concat!(env!("OUT_DIR"), "/bindings.rs"));
 
 /* Include generated FIPS symbol aliases. */
 include!(concat!(env!("OUT_DIR"), "/fips_aliases.rs"));
-
-#[cfg(all(rsa,not(rsa_setrng),not(fips_v5_2_3)))]
-unsafe extern "C" {
-    pub fn wc_RsaSetRNG(key: *mut RsaKey, rng: *mut WC_RNG) -> core::ffi::c_int;
-}

wrapper/rust/wolfssl-wolfcrypt/tests/test_pbkdf2_password_hash.rs

@@ -10,7 +10,7 @@ use password_hash::phc::{Output, PasswordHash};
 use password_hash::{CustomizedPasswordHasher, PasswordHasher, PasswordVerifier};
 use wolfssl_wolfcrypt::pbkdf2_password_hash::*;
 
-// FIPS v5.2.3 refuses HMAC keys under 14 bytes, and PBKDF2 uses the password as
+// FIPS v5 refuses HMAC keys under 14 bytes, and PBKDF2 uses the password as
 // its HMAC key.
 const PASSWORD: &[u8] = b"correct horse battery staple";
 

wrapper/rust/wolfssl-wolfcrypt/tests/test_random.rs

@@ -109,7 +109,7 @@ fn test_rng_generate_block_large() {
 }
 
 #[test]
-#[cfg(all(random_hashdrbg, not(fips_v5_2_3)))]
+#[cfg(all(random_hashdrbg, not(fips_v5)))]
 fn test_rng_reseed() {
     let rng = RNG::new().expect("Failed to create RNG");
     let seed = [1u8, 2, 3, 4];