From 5fc5bee9f023ff212ade767cd78e9f37ddfff0ef Mon Sep 17 00:00:00 2001 From: Daniel Pouzzner Date: Thu, 10 Sep 2026 11:34:30 -0500 Subject: [PATCH] tests/api.c: in test_wolfSSL_EVP_PKEY_ED25519_openssl(), add old-FIPS exclusion gate for test clauses that depends on new fixes (implicit public key rederivation on import etc.). add missing && !defined(NO_TLS) gate to test_wolfSSL_certs_clear(). --- tests/api.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/tests/api.c b/tests/api.c index 3618a95773..73bd699bbf 100644 --- a/tests/api.c +++ b/tests/api.c @@ -11887,12 +11887,14 @@ static int test_wolfSSL_EVP_PKEY_ED25519_openssl(void) 0x44, 0x49, 0xc5, 0x69, 0x7b, 0x32, 0x69, 0x19, 0x70, 0x3b, 0xac, 0x03, 0x1c, 0xae, 0x7f, 0x60 }; +#if !defined(HAVE_FIPS) || FIPS_VERSION3_GE(7,0,0) static const unsigned char ed25519SeedPub[ED25519_PUB_KEY_SIZE] = { 0xd7, 0x5a, 0x98, 0x01, 0x82, 0xb1, 0x0a, 0xb7, 0xd5, 0x4b, 0xfe, 0xd3, 0xc9, 0x64, 0x07, 0x3a, 0x0e, 0xe1, 0x72, 0xf3, 0xda, 0xa6, 0x23, 0x25, 0xaf, 0x02, 0x1a, 0x68, 0xf7, 0x07, 0x51, 0x1a }; +#endif WOLFSSL_EVP_PKEY_CTX* ctx = NULL; WOLFSSL_EVP_PKEY* pkey = NULL; WOLFSSL_EVP_PKEY* certPub = NULL; @@ -11954,7 +11956,9 @@ static int test_wolfSSL_EVP_PKEY_ED25519_openssl(void) unsigned char* rawSpki = NULL; unsigned char* privSpki = NULL; int rawSpkiSz = 0; +#if !defined(HAVE_FIPS) || FIPS_VERSION3_GE(7,0,0) int privSpkiSz = 0; +#endif const int ed25519SpkiHdrSz = (int)sizeof(ed25519SpkiHdr); /* An Ed25519 SPKI is a fixed-size header followed by the raw public @@ -11979,6 +11983,7 @@ static int test_wolfSSL_EVP_PKEY_ED25519_openssl(void) ExpectNotNull(rawPriv = wolfSSL_EVP_PKEY_new_raw_private_key( EVP_PKEY_ED25519, NULL, ed25519Seed, ED25519_KEY_SIZE)); +#if !defined(HAVE_FIPS) || FIPS_VERSION3_GE(7,0,0) /* The raw input is only the seed, so the key must derive its public * half on import -- otherwise a key built this way is unusable with * i2d_PUBKEY / EVP_PKEY_cmp / signing, unlike the same key decoded @@ -12004,6 +12009,7 @@ static int test_wolfSSL_EVP_PKEY_ED25519_openssl(void) ExpectIntEQ(wolfSSL_EVP_PKEY_cmp(rawPriv, seedPub), 0); ExpectIntEQ(wolfSSL_EVP_PKEY_cmp(rawPriv, rawPub), -1); #endif +#endif /* !HAVE_FIPS || FIPS_VERSION3_GE(7,0,0) */ /* A raw private key caches the bare 32-byte seed, not PKCS#8, so * pkcs8_encode() must build the PKCS#8 wrapper from the key object @@ -12037,7 +12043,8 @@ static int test_wolfSSL_EVP_PKEY_ED25519_openssl(void) /* (3) Encode the private key as PKCS#8 PrivateKeyInfo and (7) decode it * back. These compat helpers (EVP_PKEY2PKCS8, i2d_PKCS8_PKEY, * d2i_AutoPrivateKey) are only built with OPENSSL_ALL. */ -#if defined(OPENSSL_ALL) && !defined(NO_AES) +#if defined(OPENSSL_ALL) && !defined(NO_AES) && \ + (!defined(HAVE_FIPS) || FIPS_VERSION3_GE(7,0,0)) { WOLFSSL_PKCS8_PRIV_KEY_INFO* p8 = NULL; WOLFSSL_EVP_PKEY* decPriv = NULL; @@ -12142,7 +12149,8 @@ static int test_wolfSSL_EVP_PKEY_ED25519_openssl(void) wolfSSL_EVP_PKEY_free(v2Priv); wc_ed25519_free(&v2Key); } -#endif + +#endif /* OPENSSL_ALL && !NO_AES && (!HAVE_FIPS || FIPS_VERSION3_GE(7,0,0)) */ /* (4)(5) Build an in-memory self-signed cert; Ed25519 signs with a NULL * digest (it carries its own hash). */ @@ -12288,7 +12296,7 @@ static int test_wolfSSL_EVP_PKEY_ED25519_openssl(void) * public-only key has no private half and must fail rather than emit its * raw public bytes wrapped as a bogus PKCS#8 private key. */ #if defined(OPENSSL_ALL) && !defined(NO_BIO) && !defined(NO_PWDBASED) && \ - defined(HAVE_PKCS8) + defined(HAVE_PKCS8) && (!defined(HAVE_FIPS) || FIPS_VERSION3_GE(7,0,0)) { WOLFSSL_BIO* pkcs8Bio = NULL; @@ -32070,7 +32078,7 @@ static int test_wolfSSL_certs_clear(void) { EXPECT_DECLS; #if defined(OPENSSL_EXTRA) && !defined(NO_RSA) && !defined(NO_FILESYSTEM) && \ - !defined(NO_WOLFSSL_SERVER) + !defined(NO_WOLFSSL_SERVER) && !defined(NO_TLS) WOLFSSL_CTX* ctx = NULL; WOLFSSL* ssl = NULL; #ifdef KEEP_OUR_CERT