Disallow KeyUpdate during early data transmission

[holtrop-wolfssl]

Description

Disallow KeyUpdate during early data transmission

Resolves #11130.

Testing

How did you test?

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[Copilot]

Pull request overview

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Disallows emitting TLS 1.3 KeyUpdate messages before the endpoint has sent Finished (notably during 0-RTT early data), and adds regression coverage to ensure AEAD key usage limit handling fails the write rather than attempting a KeyUpdate.

Changes:

• Add a TLS 1.3 helper to detect whether Finished has been sent and gate SendTls13KeyUpdate() accordingly.
• Update API tests to expect OUT_OF_ORDER_E when KeyUpdate is attempted before Finished.
• Add a new 0-RTT regression test that hits the AEAD usage limit and verifies no KeyUpdate is sent and the write fails.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
tests/api/test_tls13.h	Registers the new test_tls13_0rtt_aead_limit test.
tests/api/test_tls13.c	Updates expected KeyUpdate error pre-handshake and adds a new 0-RTT AEAD-limit regression test.
src/tls13.c	Adds a “Finished sent” helper and blocks KeyUpdate before Finished to comply with spec and early-data constraints.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m4-openssl-compat

• FLASH: .rodata +24 B, .text +64 B (+0.0%, 775,700 B / 1,048,576 B, total: 74% used)

gcc-arm-cortex-m4-rsa-only

• FLASH: .text +64 B (+0.0%, 328,176 B / 1,048,576 B, total: 31% used)

gcc-arm-cortex-m4-tls13

• FLASH: .text +64 B (+0.0%, 238,433 B / 262,144 B, total: 91% used)

gcc-arm-cortex-m7-pq

• FLASH: .text +64 B (+0.0%, 298,588 B / 1,048,576 B, total: 28% used)

gcc-arm-cortex-m7-tls13

• FLASH: .text +64 B (+0.0%, 238,497 B / 262,144 B, total: 91% used)
  No memory changes detected for:
• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m7
• linuxkm-pie
• linuxkm-standard
• stm32-sim-stm32h753

[holtrop-wolfssl]

retest this please (ERROR: Preflight failed (rc=1) - aborting PRB)