Forbird supported_versions when using TLS <1.3. Forbid sending more than one cert when using RPK. Confirm QUIC early_data_max_size matches expected value.

[kareem-wolfssl]

Description

Fixes F-9230, F-9231, F-9233

Testing

Built in tests + added tests

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[Copilot]

Pull request overview

This PR tightens TLS/QUIC and TLS 1.3 conformance checks in wolfSSL and adds regression tests covering those cases (F-9230, F-9231, F-9233).

Changes:

• Enforce QUIC NewSessionTicket early_data max_early_data_size sentinel value (0xffffffff) and add a QUIC regression test.
• Reject supported_versions in a ServerHello when negotiating TLS < 1.3 and add a TLS 1.3 legacy_version downgrade-related regression test.
• For TLS 1.3 + RPK, reject Certificate messages containing more than one CertificateEntry and add a corresponding test.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tests/quic.c	Adds a QUIC post-handshake ticket parsing test for early_data max size; fixes QUIC alert callback bookkeeping.
tests/api/test_tls13.h	Registers new TLS 1.3 API tests in the test list.
tests/api/test_tls13.c	Adds TLS 1.3 tests for multiple RPK cert entries and ServerHello legacy_version handling with supported_versions.
src/tls.c	Enforces QUIC early_data ticket size sentinel and rejects supported_versions in older-version ServerHello.
src/internal.c	Refactors negotiated peer cert-type lookup and rejects multi-entry Certificate lists when RPK is negotiated in TLS 1.3.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m4-openssl-compat

• FLASH: .text +64 B (+0.0%, 775,676 B / 1,048,576 B, total: 74% used)

gcc-arm-cortex-m4-rsa-only

• FLASH: .text +64 B (+0.0%, 328,176 B / 1,048,576 B, total: 31% used)

gcc-arm-cortex-m4-tls13

• FLASH: .text +64 B (+0.0%, 238,433 B / 262,144 B, total: 91% used)

gcc-arm-cortex-m7-pq

• FLASH: .text +64 B (+0.0%, 298,588 B / 1,048,576 B, total: 28% used)
  No memory changes detected for:
• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-tls13
• linuxkm-pie
• linuxkm-standard
• stm32-sim-stm32h753