Fixups from CI testing

Author: kaleb-himes

wolfcrypt/src/random.c

@@ -1618,6 +1618,7 @@ static int _InitRng(WC_RNG* rng, byte* nonce, word32 nonceSz,
     rng->status = DRBG_NOT_INIT;
 
     /* Select DRBG type: prefer SHA-512 unless disabled or not compiled */
+#if !defined(HAVE_SELFTEST) && (!defined(HAVE_FIPS) || FIPS_VERSION3_GE(7,0,0))
 #ifdef WOLFSSL_DRBG_SHA512
     if (!wc_Sha512Drbg_GetStatus())
         rng->drbgType = WC_DRBG_SHA512;
@@ -1631,6 +1632,9 @@ static int _InitRng(WC_RNG* rng, byte* nonce, word32 nonceSz,
     {
         return BAD_STATE_E; /* no DRBG available */
     }
+#else
+    rng->drbgType = WC_DRBG_SHA256;
+#endif
 #endif
 
 #if defined(HAVE_INTEL_RDSEED) || defined(HAVE_INTEL_RDRAND) || \

wolfcrypt/test/test.c

@@ -1268,9 +1268,13 @@ static void myFipsCb(int ok, int err, const char* hash)
 }
 #endif /* HAVE_FIPS && !WOLFSSL_KERNEL_MODE */
 
-#if defined(HAVE_FIPS) && FIPS_VERSION3_LT(6,0,0) && !defined(WC_NO_CONSTRUCTORS)
+/* Polyfill for old FIPS modules whose headers don't declare the
+ * constructor/destructor helpers.  Skip when the current headers
+ * already provide them (WC_AES_NEW_API_AVAILABLE / WC_RSA_NEW_API_AVAILABLE). */
+#if defined(HAVE_FIPS) && FIPS_VERSION3_LT(6,0,0) && \
+    !defined(WC_NO_CONSTRUCTORS)
 
-#if !defined(NO_AES)
+#if !defined(NO_AES) && !defined(WC_AES_NEW_API_AVAILABLE)
 static WC_MAYBE_UNUSED Aes* wc_AesNew(void* heap, int thisDevId, int *result_code)
 {
     int ret;
@@ -1328,9 +1332,9 @@ static WC_MAYBE_UNUSED Aes* wc_AesNew_Id(unsigned char* id, int len,
 }
 #endif /* WOLF_PRIVATE_KEY_ID */
 
-#endif /* !NO_AES */
+#endif /* !NO_AES && !WC_AES_NEW_API_AVAILABLE */
 
-#if !defined(NO_RSA)
+#if !defined(NO_RSA) && !defined(WC_RSA_NEW_API_AVAILABLE)
 static WC_MAYBE_UNUSED RsaKey* wc_NewRsaKey(void* heap, int thisDevId, int *result_code)
 {
     int ret;
@@ -1386,9 +1390,9 @@ static WC_MAYBE_UNUSED RsaKey* wc_NewRsaKey_Id(unsigned char* id, int len,
     return key;
 }
 #endif /* WOLF_PRIVATE_KEY_ID */
-#endif /* !NO_RSA */
+#endif /* !NO_RSA && !WC_RSA_NEW_API_AVAILABLE */
 
-#endif /* FIPS_VERSION3_LT(6,0,0) && !WC_NO_CONSTRUCTORS */
+#endif /* HAVE_FIPS && FIPS_VERSION3_LT(6,0,0) && !WC_NO_CONSTRUCTORS */
 
 /* AES/RSA New helpers -- placed after the FIPS polyfill block so wc_AesNew /
  * wc_NewRsaKey are visible from either the library or the polyfill above.

wolfssl/wolfcrypt/aes.h

@@ -189,6 +189,12 @@ enum {
     #include <wolfssl/wolfcrypt/async.h>
 #endif
 
+/* Undefine the settings.h compat macro so it doesn't collide with the enum
+ * member below (settings.h may pre-define WC_AES_BLOCK_SIZE for old FIPS). */
+#ifdef WC_AES_BLOCK_SIZE
+    #undef WC_AES_BLOCK_SIZE
+#endif
+
 enum {
     AES_ENC_TYPE   = WC_CIPHER_AES,   /* cipher unique type */
     AES_ENCRYPTION = 0,
@@ -777,6 +783,7 @@ WOLFSSL_API int  wc_AesInit_Label(Aes* aes, const char* label, void* heap,
 #endif
 WOLFSSL_API void wc_AesFree(Aes* aes);
 #ifndef WC_NO_CONSTRUCTORS
+#define WC_AES_NEW_API_AVAILABLE
 WOLFSSL_API Aes* wc_AesNew(void* heap, int devId, int *result_code);
 #ifdef WOLF_PRIVATE_KEY_ID
 WOLFSSL_API Aes* wc_AesNew_Id(unsigned char* id, int len, void* heap,

wolfssl/wolfcrypt/random.h

@@ -152,8 +152,11 @@
     #endif
 #endif
 
-#ifndef WC_RNG_TYPE_DEFINED /* guard on redeclaration */
+#ifndef WC_OS_SEED_TYPE_DEFINED
     typedef struct OS_Seed OS_Seed;
+    #define WC_OS_SEED_TYPE_DEFINED
+#endif
+#ifndef WC_RNG_TYPE_DEFINED /* guard on redeclaration */
     typedef struct WC_RNG WC_RNG;
     #ifdef WC_RNG_SEED_CB
         typedef int (*wc_RngSeed_Cb)(OS_Seed* os, byte* seed, word32 sz);

wolfssl/wolfcrypt/rsa.h

@@ -299,6 +299,7 @@ WOLFSSL_API int  wc_InitRsaKey(RsaKey* key, void* heap);
 WOLFSSL_API int  wc_InitRsaKey_ex(RsaKey* key, void* heap, int devId);
 WOLFSSL_API int  wc_FreeRsaKey(RsaKey* key);
 #ifndef WC_NO_CONSTRUCTORS
+#define WC_RSA_NEW_API_AVAILABLE
 WOLFSSL_API RsaKey* wc_NewRsaKey(void* heap, int devId, int *result_code);
 #ifdef WOLF_PRIVATE_KEY_ID
 WOLFSSL_API RsaKey* wc_NewRsaKey_Id(unsigned char* id, int len, void* heap,

wolfssl/wolfcrypt/settings.h

@@ -505,7 +505,7 @@
 /* old FIPS has only AES_BLOCK_SIZE. */
 #if !defined(NO_AES) && (defined(HAVE_SELFTEST) || \
      (defined(HAVE_FIPS) && FIPS_VERSION3_LT(6,0,0)))
-    #define WC_AES_BLOCK_SIZE AES_BLOCK_SIZE
+    #define WC_AES_BLOCK_SIZE 16
 #endif /* !NO_AES && (HAVE_SELFTEST || FIPS_VERSION3_LT(6,0,0)) */
 
 #ifdef WOLFSSL_HARDEN_TLS