Echo HRR Cookie by default on client. Fix a few sniffer issues. Document DES function size requirements.

[kareem-wolfssl]

Description

Fixes zd#21992, #11010, F-2246

Testing

Built in tests, provided reproducers

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[Copilot]

Pull request overview

This PR makes TLS 1.3 clients RFC 8446-compliant by enabling HelloRetryRequest (HRR) cookie echoing by default (with an opt-out for size-constrained clients), while also hardening the packet sniffer’s TCP sequence/FIN handling and documenting DES buffer sizing requirements.

Changes:

• Enable HAVE_TLSX_COOKIE by default for TLS 1.3 clients (opt-out via WOLFSSL_NO_CLIENT_HRR_COOKIE) and switch HRR-cookie logic to use that feature macro.
• Fix sniffer edge cases: negative-length handling, FIN capture when relative sequence is 0, and 32-bit wrap-safe sequence comparisons.
• Document DES-CBC function behavior requiring buffers sized to round_up(len, DES_BLOCK_SIZE).

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
wolfssl/wolfcrypt/settings.h	Defines HAVE_TLSX_COOKIE by default for TLS 1.3 clients (with opt-out) to ensure HRR cookie echo support is compiled in.
wolfssl/internal.h	Gates hrrSentCookie option bit on HAVE_TLSX_COOKIE instead of WOLFSSL_SEND_HRR_COOKIE.
src/tls13.c	Uses HAVE_TLSX_COOKIE to include HRR cookie presence in client-side HRR validation.
src/tls.c	Compiles TLSX Cookie extension support under HAVE_TLSX_COOKIE and refines cookie parsing behavior when server-side cookie generation is disabled.
src/ssl_crypto.c	Adds Doxygen notes clarifying DES-CBC rounding/padding behavior and buffer size requirements.
src/sniffer.c	Improves robustness around negative lengths, sequence wrap comparisons, and FIN capture semantics.
.wolfssl_known_macro_extras	Registers HAVE_TLSX_COOKIE and WOLFSSL_NO_CLIENT_HRR_COOKIE as known macros.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m4-openssl-compat

• FLASH: .rodata +40 B, .text +384 B (+0.1%, 775,972 B / 1,048,576 B, total: 74% used)

gcc-arm-cortex-m4-pq

• FLASH: .text +256 B (+0.1%, 297,884 B / 1,048,576 B, total: 28% used)

gcc-arm-cortex-m4-rsa-only

• FLASH: .text +320 B (+0.1%, 328,432 B / 1,048,576 B, total: 31% used)

gcc-arm-cortex-m4-tls13

• FLASH: .text +320 B (+0.1%, 238,689 B / 262,144 B, total: 91% used)

gcc-arm-cortex-m7-pq

• FLASH: .text +320 B (+0.1%, 298,844 B / 1,048,576 B, total: 28% used)

gcc-arm-cortex-m7-tls13

• FLASH: .text +320 B (+0.1%, 238,753 B / 262,144 B, total: 91% used)
  No memory changes detected for:
• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m7
• linuxkm-pie
• linuxkm-standard
• stm32-sim-stm32h753