[sebastian-carpenter]

Description

Clients using Encrypted Client Hello do not properly handle rejection via a downgrade to TLS1.2.

• Added an abort before the handshake completes, as in TLS1.3
• Improve session handling on ECH rejection
• Improve cert handling on ECH rejection

zd#22661

Testing

Added test with an ECH client that gets downgraded to TLS1.2. This also tests:

• Session storage
• What cert is sent

A client configured for TLS1.2 with ECH fails outright, instead of later

Harden resumption handling for TLS1.2

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[github-actions]

MemBrowse Memory Report

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• stm32-sim-stm32h753

[Copilot]

🟡 Changes recommended

Signature-algorithm selection can still trigger a credential-dependent abort before the required empty-certificate response.

1 open issue

• Skip credential signature selection after ECH rejection · New

What changed in this PR

This PR hardens wolfSSL’s Encrypted Client Hello (ECH) rejection handling when a server negotiates TLS 1.2.

Changes:

• Returns an ECH-required error instead of reporting handshake success.
• Suppresses client certificates and session persistence after ECH rejection.
• Adds a downgrade regression test covering rejection, certificates, and session storage.

File	Description
tests/​api.c	Adds and registers the ECH-to-TLS-1.2 downgrade test.
src/​ssl_api_hs.c	Aborts rejected ECH connections before reporting success.
src/​internal.c	Suppresses certificates, session caching, and ticket storage after rejection.

_{Review effort: Balanced}

[Frauschi]

Thanks, the TLS 1.2 downgrade now aborts with ech_required as it should. I built it with --enable-all --enable-ech, the new tests pass, and dropping the new check in wolfSSL_connect makes test_wolfSSL_Tls13_ECH_tls12_downgrade fail, so the fix is covered. The main question is the TLS 1.2 session case below; the rest are smaller.

[sebastian-carpenter]

Jenkins retest this please.

[Frauschi]

LGTM

[philljj]

tests good with multi-test with gcc-c89, c89-clang-tidy, tls13, etc scenarios.