Fix a few TLS compliance issues

[kareem-wolfssl]

Description

Partially fixes zd#21873

Testing

Built in tests

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[Copilot]

Pull request overview

This PR tightens TLS compliance-related behavior in the core handshake and exporter paths, primarily by enforcing correct timing/validity constraints for keying material export and session ticket usage.

Changes:

• Refuse wolfSSL_export_keying_material() calls until the handshake has fully completed (per RFC 8446 / RFC 5705 intent).
• Suppress use of expired stored session tickets (fall back to full handshake instead of attempting resumption).
• Map BUFFER_E to decode_error in TranslateErrorToAlert().

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
src/ssl.c	Adds a “handshake complete” gate before exporting keying material.
src/internal.c	Adds client-side session ticket expiry suppression and extends alert translation for buffer errors.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m3

• FLASH: .text +4 B (+0.0%, 125,779 B / 262,144 B, total: 48% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .text +64 B (+0.0%, 783,268 B / 1,048,576 B, total: 75% used)

gcc-arm-cortex-m4-rsa-only

• FLASH: .text +64 B (+0.0%, 332,512 B / 1,048,576 B, total: 32% used)
  No memory changes detected for:
• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• linuxkm-pie
• linuxkm-standard
• stm32-sim-stm32h753

[dgarske]

Skoll Code Review

Scan type: reviewOverall recommendation: COMMENT
Findings: 4 total — 3 posted, 1 skipped
2 finding(s) posted as inline comments (see file-level comments below)

Posted findings

• [Medium] Expired-ticket branch drops SessionTicket extension entirely; client may no longer obtain a fresh ticket — src/internal.c:31665-31687
• [Medium] No tests added for the three new compliance behaviors — tests/api.c
• [Low] Redundant dual condition in keying-material handshake-complete gate — src/ssl.c:4076-4080

Skipped findings

• [Low] Preprocessor directives indented to code column instead of repo convention

Review generated by Skoll

[dgarske]

See skoll review #10594 (review)

[kareem-wolfssl]

Retest this please

[dgarske]

Skoll Code Review

Scan type: reviewOverall recommendation: COMMENT
Findings: 13 total — 6 posted, 7 skipped
5 finding(s) posted as inline comments (see file-level comments below)
1 finding(s) not tied to a diff line (full detail below)

Posted findings

• [Medium] New build macro not added to the src/internal.c macro documentation block — src/internal.c:3742
• [Medium] "eNULL" directive now behaves asymmetrically between TLS 1.2 and TLS 1.3 NULL suites — src/internal.c:3733-3757
• [Medium] Expired ticket is not deleted from the session, contrary to the cited RFC — src/internal.c:32701-32715
• [Low] Expiry comparison differs from the server-side check and treats timeout 0 as immediately expired — src/internal.c:32701-32706
• [Low] Continuation line left misaligned and over 80 columns after re-indent — src/internal.c:32719-32720

Findings not tied to a diff line

Removal of integrity-only .conf cases drops end-to-end coverage that would still pass

File: tests/test-tls13.conf:213-231, tests/test-dtls13.conf:270-292
Function: n/a
Severity: Medium

Eight entries (four TLS 1.3, four DTLS 1.3) that ran real client/server processes over TLS13-SHA256-SHA256 / TLS13-SHA384-SHA384 were deleted. These do not appear to be broken by the source change: IsValidCipherSuite() in tests/suites.c:128-169 validates a conf -l entry by calling wolfSSL_CTX_set_cipher_list() with the literal name, and the explicit-name path in ParseCipherList() is untouched by the InitSuites_Tls13 gating - which is precisely what the new tests/api.c:2548-2552 assertion ("TLS13-SHA256-SHA256" -> suite present) proves. Both peers pass -l, so the handshake should still negotiate. After the removal the documented opt-in path is exercised only by in-process memio unit tests (tests/api/test_tls_ext.c:420, tests/api/test_dtls13.c:131,783); the cross-process client/server coverage, including the DTLS 1.3 record path, is gone.

Recommendation: Restore the conf entries (they exercise the opt-in path the PR says remains supported), or state in the PR why they can no longer pass.

Referenced code: tests/test-tls13.conf:213-231, tests/test-dtls13.conf:270-276 (7 lines)

---

Skipped findings

• [Medium] Default TLS 1.3 suite list can become empty in NULL-cipher-only builds
• [Medium] Exporter gate is stricter than the TLS 1.3 key schedule requires (0.5-RTT server window)
• [Medium] New public-API precondition in wolfSSL_export_keying_material has no test
• [Medium] New BUFFER_E - decode_error alert mapping is untested
• [Medium] BUFFER_E also signals local send-side failures, so decode_error can blame the peer for our own error
• [Low] Comment cites RFC 8446 4.6.1 in a code path unreachable for TLS 1.3
• [Low] Test opens a block solely to declare a variable and cites a non-existent flag

Review generated by Skoll

[dgarske]

#10594 (review)

[JacobBarthelmeh]

@kareem-wolfssl please go through and address comments. Assign to wolfSSL-bot and un-assign yourself when ready for review/merge.

[kareem-wolfssl]

Retest this please

[kareem-wolfssl]

Retest this please

[kareem-wolfssl]

Retest this please

[kareem-wolfssl]

Retest this please