Fenrir: TLS/DTLS conformance and crypto hardening fixes#10575

Merged

douzzer merged 11 commits into

wolfSSL:masterfrom

julek-wolfssl:fenrir-fixes-20260601

Jun 5, 2026

Commits on Jun 3, 2026

F-5606: enforce DTLS 1.3 KeyUpdate 2^48-1 sending epoch ceiling
julek-wolfssl
committed
F-5590: reject oversized length in wolfSSL_CRYPTO_memcmp
julek-wolfssl
committed
F-4594: return non-zero from wolfSSL_get_verify_result on NULL ssl
julek-wolfssl
committed
F-5628: reject max_fragment_length response that differs from request
julek-wolfssl
committed
F-5629: reject ServerHello ALPN response with multiple protocols
julek-wolfssl
committed
F-5630: require signature_algorithms in TLS 1.3 CertificateRequest
julek-wolfssl
committed
F-5631: reject zero-length/duplicate post-handshake CertReq context
julek-wolfssl
committed
F-5591: reject negative group count in group setters
julek-wolfssl
committed
F-5583: evict oldest DTLS 1.3 epoch slot, not the last eligible one
julek-wolfssl
committed
F-5632: zeroize Camellia key schedule on cipher free
julek-wolfssl
committed
F-4591: fix right-justification of short DH shared secret
julek-wolfssl
committed