Avoid advertising NULL cipher suites by default unless WOLFSSL_TLS13_NULL_CIPHER_IN_DEFAULT is defined.

Thanks to Ben Smyth for the report.

src/internal.c

@@ -4053,6 +4053,15 @@ static word16 InitSuites_Tls13(Suites* suites, word16 idx, int tls1_3,
 #endif
 
 #ifdef HAVE_NULL_CIPHER
+    /* RFC 9150 integrity-only (zero-confidentiality) TLS 1.3 suites.
+     * These provide authentication and integrity but no confidentiality, so
+     * they are NOT advertised in the default cipher preference list. A caller
+     * that genuinely needs them (e.g. constrained/IoT deployments) must opt in
+     * explicitly with a cipher list, for example:
+     *     wolfSSL_set_cipher_list(ssl, "TLS13-SHA256-SHA256");
+     * Define WOLFSSL_TLS13_NULL_CIPHER_IN_DEFAULT to restore the legacy
+     * behaviour of including them in the default list. */
+    #ifdef WOLFSSL_TLS13_NULL_CIPHER_IN_DEFAULT
     #ifdef BUILD_TLS_SHA256_SHA256
         if (tls1_3 && haveNull) {
             suites->suites[idx++] = ECC_BYTE;
@@ -4066,6 +4075,7 @@ static word16 InitSuites_Tls13(Suites* suites, word16 idx, int tls1_3,
             suites->suites[idx++] = TLS_SHA384_SHA384;
         }
     #endif
+    #endif /* WOLFSSL_TLS13_NULL_CIPHER_IN_DEFAULT */
 #endif
 
     return idx;

tests/api.c

@@ -2826,10 +2826,15 @@ static int test_wolfSSL_set_cipher_list_exclusions(void)
     wolfSSL_free(ssl);
     ssl = NULL;
 
-    /* OpenSSL compat: "ALL" is "all but eNULL" - it does not generate NULL
-     * suites, but it is not a delete directive, so a following "eNULL"
-     * re-enables them. (The earlier sticky excludeNull-for-ALL wrongly kept
-     * them disabled; only "!eNULL"/"DEFAULT" should.) */
+    /* By default the RFC 9150 integrity-only TLS 1.3 suites are
+     * zero-confidentiality and are treated as SSL_NOT_DEFAULT:
+     * they are never produced by the generic cipher-string directives ("ALL",
+     * "eNULL", ...) and are kept out of the default preference list, so they
+     * must be requested by explicit suite name.
+     *
+     * Defining WOLFSSL_TLS13_NULL_CIPHER_IN_DEFAULT restores the legacy
+     * behaviour where the "eNULL" directive re-enables them via the generated
+     * list. "ALL" on its own never generates NULL ciphers in either mode. */
     ExpectNotNull(ssl = wolfSSL_new(ctx));
     ExpectIntEQ(wolfSSL_set_cipher_list(ssl, "ALL"), WOLFSSL_SUCCESS);
     ExpectIntEQ(test_suites_contains(ssl, ECC_BYTE,
@@ -2839,8 +2844,23 @@ static int test_wolfSSL_set_cipher_list_exclusions(void)
 
     ExpectNotNull(ssl = wolfSSL_new(ctx));
     ExpectIntEQ(wolfSSL_set_cipher_list(ssl, "ALL:eNULL"), WOLFSSL_SUCCESS);
+    ExpectIntEQ(test_suites_contains(ssl, ECC_BYTE, TLS_SHA256_SHA256),
+#ifdef WOLFSSL_TLS13_NULL_CIPHER_IN_DEFAULT
+                1 /* legacy: "eNULL" re-enables the integrity-only suite */
+#else
+                0 /* default: SSL_NOT_DEFAULT, "eNULL" does not add it */
+#endif
+                );
+    wolfSSL_free(ssl);
+    ssl = NULL;
+
+    /* Explicit suite name remains the supported opt-in and works in both
+     * modes. */
+    ExpectNotNull(ssl = wolfSSL_new(ctx));
+    ExpectIntEQ(wolfSSL_set_cipher_list(ssl, "TLS13-SHA256-SHA256"),
+                WOLFSSL_SUCCESS);
     ExpectIntEQ(test_suites_contains(ssl, ECC_BYTE,
-                TLS_SHA256_SHA256), 1); /* "eNULL" after "ALL" re-enables NULL */
+                TLS_SHA256_SHA256), 1);
     wolfSSL_free(ssl);
     ssl = NULL;
 #endif /* BUILD_TLS_SHA256_SHA256 */

tests/test-dtls13.conf

@@ -271,26 +271,6 @@
 -v 4
 -l TLS_AES_128_GCM_SHA256
 
-# server DTLSv1.3 Integrity-only SHA256
--u
--v 4
--l TLS13-SHA256-SHA256
-
-# client DTLSv1.3 Integrity-only SHA256
--u
--v 4
--l TLS13-SHA256-SHA256
-
-# server DTSv1.3 Integrity-only SHA384
--u
--v 4
--l TLS13-SHA384-SHA384
-
-# client DTLSv1.3 Integrity-only SHA384
--u
--v 4
--l TLS13-SHA384-SHA384
-
 # server DTLSv1.3 no (EC)DHE with PSK, must still key share in the HRR
 -u
 -v 4

tests/test-tls13.conf

@@ -213,19 +213,3 @@
 # client TLSv1.3 Send Ticket explicitly
 -v 4
 -l TLS13-AES128-GCM-SHA256
-
-# server TLSv1.3 Integrity-only SHA256
--v 4
--l TLS13-SHA256-SHA256
-
-# client TLSv1.3 Integrity-only SHA256
--v 4
--l TLS13-SHA256-SHA256
-
-# server TLSv1.3 Integrity-only SHA384
--v 4
--l TLS13-SHA384-SHA384
-
-# client TLSv1.3 Integrity-only SHA384
--v 4
--l TLS13-SHA384-SHA384