tests: fix FIPS-config build failures (cmac _ex, random seed-cb statics)

- test_cmac.c: wc_AesCmacGenerate_ex / wc_AesCmacVerify_ex are absent from
  the frozen FIPS cmac.h (fips-check freezes cmac.h at WCv4-stable /
  WCv5.0-RC12 / v5.2.1-stable, none of which declare the _ex variants), so
  the DecisionCoverage + cryptocb tests calling them fail to compile on the
  FIPS legs. Add !defined(HAVE_FIPS) to their guards. cmac is NOT frozen
  under CAVP self-test, so no HAVE_SELFTEST clause is needed.
- test_random.c: the WC_RNG_SEED_CB callbacks (test_random_seedCb_ok/_fail)
  were guarded #ifdef WC_RNG_SEED_CB, but their only caller test_wc_RNG_SeedCb
  is additionally !HAVE_SELFTEST && !HAVE_FIPS; a fips-ready build with
  WC_RNG_SEED_CB on compiled the statics but not the caller ->
  -Werror=unused-function. Match the statics' guard to the caller's.

Author: danielinux

tests/api/test_cmac.c

@@ -476,7 +476,11 @@ int test_wc_InitCmac_Label(void)
 int test_wc_AesCmacGenerateExDecisionCoverage(void)
 {
     EXPECT_DECLS;
-#if defined(WOLFSSL_CMAC) && !defined(NO_AES) && defined(WOLFSSL_AES_128)
+/* wc_AesCmacGenerate_ex is absent from the frozen FIPS cmac.h (WCv4-stable,
+ * WCv5.0-RC12, ...), so exclude FIPS builds. cmac is NOT frozen under CAVP
+ * self-test, so no HAVE_SELFTEST clause is needed. */
+#if defined(WOLFSSL_CMAC) && !defined(NO_AES) && defined(WOLFSSL_AES_128) && \
+    !defined(HAVE_FIPS)
     Cmac   cmac;
     byte   key[] = {
         0x64, 0x4c, 0xbf, 0x12, 0x85, 0x9d, 0xf0, 0x55,
@@ -551,7 +555,10 @@ int test_wc_AesCmacGenerateExDecisionCoverage(void)
 int test_wc_AesCmacVerifyExDecisionCoverage(void)
 {
     EXPECT_DECLS;
-#if defined(WOLFSSL_CMAC) && !defined(NO_AES) && defined(WOLFSSL_AES_128)
+/* wc_AesCmacVerify_ex is absent from the frozen FIPS cmac.h; exclude FIPS
+ * (cmac is not frozen under CAVP self-test). */
+#if defined(WOLFSSL_CMAC) && !defined(NO_AES) && defined(WOLFSSL_AES_128) && \
+    !defined(HAVE_FIPS)
     Cmac   cmac;
     byte   key[] = {
         0x64, 0x4c, 0xbf, 0x12, 0x85, 0x9d, 0xf0, 0x55,
@@ -618,7 +625,7 @@ int test_wc_AesCmacVerifyExDecisionCoverage(void)
  * dereferences wc_CryptoInfo's cmac member (WOLFSSL_CMAC only) and uses the
  * Cmac type / wc_AesCmacGenerate_ex, so WOLF_CRYPTO_CB alone is not enough. */
 #if defined(WOLF_CRYPTO_CB) && defined(WOLFSSL_CMAC) && !defined(NO_AES) && \
-    defined(WOLFSSL_AES_128)
+    defined(WOLFSSL_AES_128) && !defined(HAVE_FIPS)
 #define TEST_CMAC_CRYPTOCB_DEVID 0x434d4143 /* "CMAC" */
 
 /* Toggled by the test function below: when set, the callback fails
@@ -676,7 +683,7 @@ int test_wc_AesCmacVerify_CryptoCb_LenMismatch(void)
 {
     EXPECT_DECLS;
 #if defined(WOLFSSL_CMAC) && !defined(NO_AES) && defined(WOLFSSL_AES_128) && \
-    defined(WOLF_CRYPTO_CB)
+    defined(WOLF_CRYPTO_CB) && !defined(HAVE_FIPS)
     Cmac   cmac;
     byte   key[] = {
         0x64, 0x4c, 0xbf, 0x12, 0x85, 0x9d, 0xf0, 0x55,

tests/api/test_random.c

@@ -997,7 +997,11 @@ int test_wc_RNG_HealthTest_SHA512_Ext(void)
     return EXPECT_RESULT();
 }
 
-#ifdef WC_RNG_SEED_CB
+/* Guard must match test_wc_RNG_SeedCb (the only user) exactly, else these
+ * static functions are unused -> -Werror=unused-function in FIPS/self-test builds
+ * that define WC_RNG_SEED_CB but compile the test itself out. */
+#if defined(WC_RNG_SEED_CB) && defined(HAVE_HASHDRBG) && \
+    !defined(HAVE_SELFTEST) && !defined(HAVE_FIPS)
 /* Varying (non-repeating) pattern so wc_RNG_TestSeed()'s RCT/APT continuous
  * checks (called from _InitRng()/PollAndReSeed() right after the callback
  * runs) do not reject it; a constant fill would legitimately fail those