[cconlon]

wolfSSL PR #11960 hides wc_RNG_HealthTest* in FIPS builds unless WOLFSSL_FIPS_EXPORT_LOCAL_APIS is defined (FIPS 140-3 IG 9.3.A). wolfcrypt-jni still called wc_RNG_HealthTest_fips(), so when called the JVM would crash with an unresolved symbol on the first health test call.

• Fips.RNG_HealthTest_fips() now returns NOT_COMPILED_IN when the native library does not export the health test. Older wolfSSL versions are unaffected.
• Adds FeatureDetect.RngHealthTestEnabled().
• Skips the RNG health test JUnit tests when it is unavailable, and adds tests for the NOT_COMPILED_IN path.

[cconlon]

@claude review

[Copilot]

🟢 Approval recommended

No active review issues block approval of the RNG health-test compatibility changes.

No open issues 🎉

1 file not reviewed

• jni/include/com_wolfssl_wolfcrypt_FeatureDetect.h: Generated file

What changed in this PR

Updates wolfcrypt-jni to handle wolfSSL FIPS builds that hide RNG health-test APIs, preventing unresolved-symbol JVM crashes while preserving support for older wolfSSL versions.

Changes:

• Gates both native health-test wrappers, returning NOT_COMPILED_IN when unavailable.
• Adds FeatureDetect.RngHealthTestEnabled() and documents availability.
• Skips tests requiring the health test when unavailable and adds fallback coverage.

File	Description
src/​test/​java/​com/​wolfssl/​wolfcrypt/​test/​RngTest.java	Tests feature detection and fallback behavior in non-FIPS builds.
src/​test/​java/​com/​wolfssl/​wolfcrypt/​test/​fips/​RngFipsTest.java	Gates health tests and verifies fallback for both buffer types.
src/​main/​java/​com/​wolfssl/​wolfcrypt/​Fips.java	Documents health-test availability and fallback return values.
src/​main/​java/​com/​wolfssl/​wolfcrypt/​FeatureDetect.java	Declares the health-test availability query.
jni/​jni_fips.c	Guards native health-test calls using export-related macros.
jni/​jni_feature_detect.c	Implements the native availability query.
jni/​include/​com_wolfssl_wolfcrypt_FeatureDetect.h	Declares the new JNI entry point.

_{Review effort: Balanced}

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #305

Scan targets checked: wolfcrypt-jni-src, wolfcrypt-jni-bugs
Coverage: 5 of 7 in-scope changed file(s) opened by the reviewer; not opened: jni/include/com_wolfssl_wolfcrypt_FeatureDetect.h, src/test/java/com/wolfssl/wolfcrypt/test/RngTest.java

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Max

[claude]

I reviewed this PR and didn't find any bugs. It changes FIPS build gating, and the gate only works if native wolfSSL defines WC_FIPS_LOCAL_API in random.h, which can't be checked from this repo. A human should confirm that against the upstream wolfSSL change.

What was reviewed:

• The WOLFCRYPT_JNI_FIPS_RNG_HEALTHTEST gate in jni/jni_fips.c is defined after random.h is included. Both native health-test variants fall back to NOT_COMPILED_IN, and no locals are left unused when the gate is off.
• FeatureDetect.RngHealthTestEnabled() uses the same preprocessor condition as jni_fips.c. jni_feature_detect.c now includes random.h, so the macro is visible there.
• In the tests, Assume skips the health-test cases when the feature is unavailable. The non-FIPS test and the new FIPS NOT_COMPILED_IN test have matching assumptions.

Extended reasoning...

The change gates the JNI wrappers for the wolfCrypt FIPS DRBG health test (jni_fips.c, jni_feature_detect.c) on a new preprocessor condition. It also adds a FeatureDetect native method, Javadoc and JUnit coverage. It touches FIPS crypto build configuration, not data handling or authentication. The code is small and consistent. I deferred instead of approving because this is FIPS crypto code, and whether the gate works depends on the external macro name WC_FIPS_LOCAL_API, which I couldn't check here.