[lealem47]

Description

Make wc_RNG_HealthTest* APIs WOLFSSL_LOCAL unless WOLFSSL_FIPS_EXPORT_LOCAL_APIS is defined. These will now not be exported in FIPS builds to strictly comply with FIPS 140-3 IG 9.3.A requirements and avoid testing arbitrary seeds.

WOLFSSL_FIPS_EXPORT_LOCAL_APIS will continue to be enabled for non-fips builds and for FIPS testing builds with HAVE_FORCE_FIPS_FAILURE

Testing

How did you test?

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[github-actions]

MemBrowse Memory Report · Explore what changed →

stm32-sim-stm32h753

• FLASH: .text +64 B (+0.0%, 203,756 B / 2,097,152 B, total: 10% used)

zephyr-frdm_rw612

• FLASH: log_const_area -8 B, rodata -8 B, text +1,552 B (+0.5%, 284,000 B / 67,108,864 B, total: 0% used)

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

[Copilot]

🟡 Changes recommended

Health-test export gating remains incomplete: some shared FIPS builds still expose the functions, while Rust and C# bindings and tests fail when the exports are removed.

3 open issues

• C# FIPS tests require an optional health-test export · New
• Rust health-test methods are exposed without public-test exports · New
• Hidden visibility is not enabled for shared FIPS builds · New

What changed in this PR

This PR restricts RNG health-test API exports in FIPS builds to support FIPS 140-3 compliance, while preserving access for non-FIPS and forced-failure testing builds.

Changes:

• Defines WOLFSSL_PUBLIC_HT for non-FIPS builds and builds using HAVE_FORCE_FIPS_FAILURE.
• Selects public or local visibility for health-test APIs through HT_API.
• Gates C health-test calls and test vectors on public API availability.

File	Description
wolfssl/​wolfcrypt/​settings.h	Defines when health-test APIs are public.
wolfssl/​wolfcrypt/​random.h	Applies conditional visibility to health-test declarations.
wolfcrypt/​test/​test.c	Guards health-test vectors and calls with WOLFSSL_PUBLIC_HT.
tests/​api/​test_random.c	Gates API health tests on public availability.

_{Review effort: Balanced}

[lealem47]

Tests will fail until https://github.com/wolfSSL/testing/pull/1090 is in

[lealem47]

Reworking this PR to have a more generic application (WOLFSSL_FIPS_PRIVATE_API) based on the teams feedback

[lealem47]

Ready for re-review

[SparkiDev]

Jenkins: retest this please

[Copilot]

🔵 Needs a closer look

Unavailable licensed FIPS sources and companion wolfSSL/fips PR #424 prevent verification of symbol exports and self-tests across production, opt-in, and forced-failure builds.

No open issues 🎉

3 resolved since last review

• Rust health-test methods are exposed without public-test exports
• C# FIPS tests require an optional health-test export
• Hidden visibility is not enabled for shared FIPS builds

_{Review effort: Balanced}

[SparkiDev]

unrecognized macros used:
WOLFSSL_EXPOSE_FIPS_PRIVATE_API

[philljj]

tests good with multi-test with gcc-c89, c89-clang-tidy, etc scenarios

[douzzer]

tested with

wolfssl-multi-test.sh ...
check-source-text
all-crypto-only-intelasm-fips-dev-linuxkm-next-insmod-optest-acvp
quantum-safe-wolfssl-all-linuxkm-defaults-clang-tidy
quantum-safe-wolfssl-all-crypto-only-intelasm-sp-asm-fips-dev-linuxkm-next-clang-tidy
quantum-safe-wolfssl-all-crypto-only-intelasm-sp-asm-fips-dev-linuxkm-next-insmod

[philljj]

note: some PRB failures expected until this is merged:

• https://github.com/wolfSSL/testing/pull/1090

Merge both PRs together.

[lealem47]

Jenkins retest this please