From 479659fa96f893d00b7ec10ba7543902b3848458 Mon Sep 17 00:00:00 2001 From: Daniele Lacamera Date: Tue, 7 Jul 2026 07:26:43 +0200 Subject: [PATCH] tests: guard Gmac/AesGcmSetExtIV tests for the self-test module The CAVP self-test build (--enable-selftest) failed to compile test_aes.c: wc_AesGcmSetExtIV (test_wc_AesGcmDecisionCoverage) and wc_Gmac/wc_GmacVerify (test_wc_AesGmacArgMcdc) are declared only under !WC_NO_RNG in mainline and are absent from the frozen self-test module's headers (they are present under FIPS - the apple-M1 FIPS build compiled and passed both), so -Werror=implicit-function- declaration aborted the build. Gate those specific calls (and the now-otherwise-unused iv buffer) on !defined(WC_NO_RNG) && !defined(HAVE_SELFTEST). wc_GmacSetKey stays available, so its coverage is retained under self-test. FIPS builds are unaffected. Verified: --enable-all still builds and both tests pass; preprocessing test_aes.c with -DHAVE_SELFTEST leaves no wc_AesGcmSetExtIV/wc_Gmac/wc_GmacVerify calls in any always-compiled function (remaining ones are in the WOLFSSL_AESGCM_STREAM stream test, which the self-test config disables). --- tests/api/test_aes.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/tests/api/test_aes.c b/tests/api/test_aes.c index d2bd499a94..667104c909 100644 --- a/tests/api/test_aes.c +++ b/tests/api/test_aes.c @@ -8347,10 +8347,13 @@ int test_wc_AesGcmDecisionCoverage(void) 0xFE,0xFF,0xE9,0x92,0x86,0x65,0x73,0x1C, 0x6D,0x6A,0x8F,0x94,0x67,0x30,0x83,0x08 }; + /* wc_AesGcmSetExtIV needs an RNG and is absent from the self-test module. */ +#if !defined(WC_NO_RNG) && !defined(HAVE_SELFTEST) static const byte iv[GCM_NONCE_MID_SZ] = { 0xCA,0xFE,0xBA,0xBE,0xFA,0xCE,0xDB,0xAD, 0xDE,0xCA,0xF8,0x88 }; +#endif Aes aes; int initDone = 0; @@ -8359,6 +8362,7 @@ int test_wc_AesGcmDecisionCoverage(void) if (EXPECT_SUCCESS()) initDone = 1; ExpectIntEQ(wc_AesGcmSetKey(&aes, key, sizeof(key)), 0); +#if !defined(WC_NO_RNG) && !defined(HAVE_SELFTEST) /* wc_AesGcmSetExtIV null-argument decision branches. */ ExpectIntEQ(wc_AesGcmSetExtIV(NULL, iv, sizeof(iv)), WC_NO_ERR_TRACE(BAD_FUNC_ARG)); @@ -8367,6 +8371,7 @@ int test_wc_AesGcmDecisionCoverage(void) /* Zero-length IV branch: should reject. */ ExpectIntEQ(wc_AesGcmSetExtIV(&aes, iv, 0), WC_NO_ERR_TRACE(BAD_FUNC_ARG)); +#endif /* wc_AesGcmSetKey invalid key-length decision branch. */ { @@ -9312,7 +9317,9 @@ int test_wc_AesGmacArgMcdc(void) { EXPECT_DECLS; #if !defined(NO_AES) && defined(HAVE_AESGCM) && defined(WOLFSSL_AES_128) -#ifndef WC_NO_RNG +/* wc_Gmac()/wc_GmacVerify() need an RNG and are absent from the self-test + * module (present under FIPS); wc_GmacSetKey() below stays available. */ +#if !defined(WC_NO_RNG) && !defined(HAVE_SELFTEST) { WC_RNG rng; byte key[AES_128_KEY_SIZE] = { 0 };