wolfSSL_dtls_export()/wolfSSL_dtls_import() only ever carried a DTLS 1.2
session. A DTLS 1.3 connection additionally keeps a table of epochs, each
with its own traffic secret, record and record number keys, sequence numbers
and replay window, and none of that was serialized.
Export version 7 adds two trailing sections to the blob, the DTLS 1.3 record
layer state and the Connection ID, both length prefixed so a reader that does
not know a section can step over it and a version 6 blob still imports.
- dtls13: serialize the send epoch, the peer epoch and, when there is one,
the previous peer epoch: epoch numbers, sequence numbers, replay window,
traffic secrets and key material. Import re-derives the record keys through
Tls13DeriveRecordKeys(), the same expansion the handshake runs
- dtls: carry a tx Connection ID of any length. The peer picks it and RFC 9146
bounds it only by its one byte length field, so DTLS_CID_MAX_SIZE may not
refuse it. The rx id keeps that bound: it is the one we hand the peer and it
has to fit the record layer buffers. Clear the target's CID when the blob
carries none
Refusals, so a blob never describes a connection that cannot be restored:
- refuse to export a half sent fragmented handshake message, or while a write
dup still has work parked
- refuse a state only import into a DTLS 1.3 session, and keep stamping the
state only blob with export version 6
- require the imported epochs to be the ones the blob names, reset the epoch
table on import and commit a slot only once every field of it has been read
Bounds checking on the import path:
- keep every exported section inside the buffer the caller sized, and step
over the import sections by their declared length
- check the imported epoch key lengths against the negotiated suite and the
traffic secret length against the hash
- size the exported key state from the build's own cipher sizes
- scrub the session export scratch buffer before freeing it
- use IsAtLeastTLSv1_3() for the imported version check
CI: build the session export job with Connection ID support.
wc_curve448_make_key and wc_curve448_export_public_ex derived the public
point through the keyless wc_curve448_make_pub, which dispatches to the
first registered device; route them through a devId-carrying helper.
Mirror curve25519: keygen, shared secret, make pub and generic
callbacks, wc_curve448_init_ex/new/delete, new wc_curve448_generic
API with scalar clamp checks, WOLF_CRYPTO_CB_ONLY_CURVE448 mode,
TLS devId plumbing, tests (test.c, api unit tests, swdev),
benchmark devId, CI entries.
The config probe now uses the target include path, and ARM assembly builds in
both modes. Documents the ECIES hardware path, drops a dead protocol branch,
declines a zero length message, and builds the ECC request helpers only where
they are called. Benchmark rows no longer claim hardware they cannot reach.
wolfSSL_CTX_no_early_data_fresh_start_check() only had success path
coverage. Test BAD_FUNC_ARG for a NULL and a TLS 1.2 ctx, and SIDE_ERROR
for a client ctx. Document the clock requirement on the public API.
- The JNI bundle appends -DWOLFSSL_TLS13_MIDDLEBOX_COMPAT straight to
WOLFSSL_DEFINITIONS, leaving the option at 'no'. The ECH conflict check
then tested a variable that never became true, so both features stayed
enabled. Sync the option with the definitions list.
- Validate recLen and the record end against s_len before flipping the
payload byte; the loop could index one past the buffer.
RFC 8446 Section 8.2 recommends that freshly started servers reject
0-RTT while their anti-replay state cannot cover the ticket. A restarted
server that keeps its session cache or ticket encryption keys would
otherwise accept early data it cannot check for replays. Record the ctx
creation time and refuse early data, but not resumption, when the ticket
was minted by a previous instance. Deployments whose anti-replay state
reliably survives restarts can opt out with
wolfSSL_CTX_no_early_data_fresh_start_check(). Fixes#11013.
Declare WOLFSSL_TLS13_MIDDLEBOX_COMPAT as a real CMake option and add
--enable-tls13-middlebox-compat to configure. Previously CMake accepted
-DWOLFSSL_TLS13_MIDDLEBOX_COMPAT=yes, advertised the macro in the
generated options.h, but never passed it to the library compile. Such a
build sent an empty legacy_session_id instead of the non-empty 32-byte
value RFC 8446 Section 4.1.2 requires in compatibility mode. Fixes
#11012. Fixes#11014.
Only skip undecryptable records when the server rejected early data. Once
the server has accepted the early_data extension, RFC 8446 Section 4.2.10
requires a decrypt failure on a 0-RTT record to terminate the connection
with a fatal bad_record_mac alert. Fixes#11011.
