Process review comments:

- Update lib.pyi
- Remove obsolete comment from test_reseed_multiple
- Update HASHDRBG detection logic to match random.h

scripts/build_ffi.py

@@ -378,7 +378,9 @@ def get_features(local_wolfssl, features):
     features["ML_DSA"] = 1 if '#define HAVE_DILITHIUM'  in defines else 0
     features["ML_KEM"] = 1 if '#define WOLFSSL_HAVE_MLKEM'  in defines else 0
     features["HKDF"] = 1 if "#define HAVE_HKDF" in defines else 0
-    features["HASHDRBG"] = 1 if "#define HAVE_HASHDRBG" in defines else 0
+    # Unlike the other fatures, HASHDRBG is enabled by default in random.h, unless WC_NO_HASHDRBG or
+    # CUSTOM_RAND_GENERATE_BLOCK is defined.
+    features["HASHDRBG"] = 0 if ("#define WC_NO_HASHDRBG" in defines or "#define CUSTOM_RAND_GENERATE_BLOCK" in defines) else 1
 
     if '#define HAVE_FIPS' in defines:
         if not fips:

tests/test_random.py

@@ -73,7 +73,6 @@ def test_reseed_multiple(rng):
     """
     Test that consecutive reseeding of the random number generator works.
     """
-    # Using our own rng for getting random seed sizes.
     for _ in range(10):
         # Create seed of typical size. Testing with various seed sizes done in `test_reseed_sizes`.
         seed = bytes(x % 256 for x in range(32))

wolfcrypt/_ffi/lib.pyi

@@ -31,6 +31,7 @@ SHA256_ENABLED: int
 SHA384_ENABLED: int
 SHA512_ENABLED: int
 WC_RNG_SEED_CB_ENABLED: int
+HASHDRBG_ENABLED: int
 
 FIPS_VERSION: int
 
@@ -73,4 +74,5 @@ RNG: TypeAlias = FFI.CData
 def wc_InitRngNonce_ex(rng: RNG, nonce: bytes, nonce_size: int, heap: FFI.CData, device_id: int) -> int: ...
 def wc_RNG_GenerateByte(rng: RNG, buffer: FFI.CData) -> int: ...
 def wc_RNG_GenerateBlock(rng: RNG, buffer: FFI.CData, len: int) -> int: ...
+def wc_RNG_DRBG_Reseed(rng: RNG, seed: bytes, seed_size: int) -> int: ...
 def wc_FreeRng(rng: RNG) -> None: ...