TLS Extensions: add more extensions and improve current

Added support for record_size_limit in TLS 1.3 and TLS 1.2.
Added compress_certificate support for TLS 1.3.
Added signed_certificate_timestamp TLS 1.2 and 1.3.
Added handshake-message fragmentation to EncryptedExtension, CertificateRequest
and NewSessionTicket.
Accepts server_name in CertificateRequest.
Added API for setting signature algorithms for signature_algorithms_cert.

SHA-1 certificate chain fix: a peer advertising ecdsa_sha1 against a chain
with an RSA-SHA1 intermediates will see a failed handshake.

Tests added and interop performed where possible.

Author: SparkiDev

.github/configs/os-check-linux.json

@@ -1,4 +1,23 @@
 [
+{"name": "record-size-limit",
+ "comment": "RFC 8449 on its own. --enable-all covers it alongside everything else; this is the minimal build, which is where the extension's own guards get exercised.",
+ "configure": ["--enable-recordsizelimit"]},
+{"name": "record-size-limit-tls12",
+ "comment": "RFC 8449 defines the extension for TLS 1.2 too, where the server answers in the ServerHello. Guards the parse dispatch staying outside the WOLFSSL_TLS13 block.",
+ "configure": ["--enable-recordsizelimit", "--disable-tls13"]},
+{"name": "signed-cert-timestamp",
+ "comment": "RFC 6962 on its own.",
+ "configure": ["--enable-sct"]},
+{"name": "signed-cert-timestamp-tls12",
+ "comment": "RFC 6962 is a TLS 1.2 extension that TLS 1.3 relocated, so it must build with TLS 1.3 off. Guards the dispatch case staying outside the WOLFSSL_TLS13 block, and TLSX_SetResponse() staying behind NO_WOLFSSL_SERVER.",
+ "configure": ["--enable-sct", "--disable-tls13"]},
+{"name": "cert-compression",
+ "comment": "RFC 8879 on its own, with the zlib it requires.",
+ "configure": ["--enable-certcomp", "--with-libz"]},
+{"name": "cert-compression-no-client-auth",
+ "comment": "Server-only build without client auth: DoTls13CompressedCertificate() calls a static function guarded on exactly this combination, so it is the config that catches the guard drifting.",
+ "configure": ["--enable-certcomp", "--with-libz",
+  "CPPFLAGS=-DNO_WOLFSSL_CLIENT -DWOLFSSL_NO_CLIENT_AUTH"]},
 {"name": "user-settings-all-compat", "minutes": 9.5,
  "comment": "user_settings_all.h with the compatibility layer enabled by flipping its \"#if 0\" block, as a build-dir copy.",
  "user_settings": "examples/configs/user_settings_all.h",

.github/workflows/os-check.yml

@@ -101,7 +101,7 @@ jobs:
       - name: Install dependencies
         uses: ./.github/actions/install-apt-deps
         with:
-          packages: autoconf automake libtool build-essential bubblewrap ccache gcc-multilib
+          packages: autoconf automake libtool build-essential bubblewrap ccache gcc-multilib zlib1g-dev
           ghcr-debs-tag: ubuntu-24.04-minimal
 
       # Ubuntu 24.04 can restrict unprivileged user namespaces via AppArmor,

CMakeLists.txt

@@ -4083,6 +4083,53 @@ if(WOLFSSL_LIBZ)
     list(APPEND WOLFSSL_INCLUDE_DIRS ${ZLIB_INCLUDE_DIRS})
 endif()
 
+# Signed certificate timestamp (RFC 6962). Carries a Certificate Transparency
+# SCT list between peers; validating it is left to the application.
+add_option("WOLFSSL_SCT"
+           "Enable RFC 6962 signed_certificate_timestamp (default: disabled)"
+           "no" "yes;no")
+if(WOLFSSL_SCT)
+    list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_TLS_EXTENSIONS")
+    list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_SIGNED_CERT_TIMESTAMP")
+endif()
+
+# Record size limit (RFC 8449). Applies to TLS 1.2 as well as TLS 1.3, where
+# the server answers in the ServerHello rather than EncryptedExtensions, so
+# unlike certificate compression below it imposes no TLS 1.3 requirement.
+add_option("WOLFSSL_RECORDSIZELIMIT"
+           "Enable RFC 8449 record_size_limit, for TLS 1.2 and TLS 1.3 (default: disabled)"
+           "no" "yes;no")
+if(WOLFSSL_RECORDSIZELIMIT)
+    list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_TLS_EXTENSIONS")
+    list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_RECORD_SIZE_LIMIT")
+endif()
+
+# Certificate compression (RFC 8879); needs zlib and TLS 1.3
+add_option("WOLFSSL_CERTCOMP"
+           "Enable RFC 8879 TLS 1.3 certificate compression (default: disabled)"
+           "no" "yes;no")
+if(WOLFSSL_CERTCOMP)
+    if(NOT WOLFSSL_LIBZ)
+        message(FATAL_ERROR
+                "WOLFSSL_CERTCOMP requires WOLFSSL_LIBZ.")
+    endif()
+    if(NOT WOLFSSL_TLS13)
+        message(FATAL_ERROR
+                "WOLFSSL_CERTCOMP requires WOLFSSL_TLS13.")
+    endif()
+    # WOLFSSL_CERTS is not an option in this file; what actually produces
+    # -DNO_CERTS is WOLFSSL_ASN=no or WOLFSSL_LEAN_PSK, both resolved well
+    # before this point. Testing those is what makes this the configure-time
+    # equivalent of configure.ac's ENABLED_CERTS check.
+    if(NOT WOLFSSL_ASN OR WOLFSSL_LEAN_PSK)
+        message(FATAL_ERROR
+                "WOLFSSL_CERTCOMP requires certificate support "
+                "(WOLFSSL_ASN=yes, and not WOLFSSL_LEAN_PSK).")
+    endif()
+    list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_TLS_EXTENSIONS")
+    list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_CERTIFICATE_COMPRESSION")
+endif()
+
 
 ####################################################
 # Maximum key size options (parity with configure.ac)

cmake/options.h.in

@@ -87,6 +87,8 @@ extern "C" {
 #cmakedefine HAVE_ALPN
 #undef HAVE_ARIA
 #cmakedefine HAVE_ARIA
+#undef HAVE_CERTIFICATE_COMPRESSION
+#cmakedefine HAVE_CERTIFICATE_COMPRESSION
 #undef HAVE_CERTIFICATE_STATUS_REQUEST
 #cmakedefine HAVE_CERTIFICATE_STATUS_REQUEST
 #undef HAVE_CERTIFICATE_STATUS_REQUEST_V2
@@ -159,8 +161,12 @@ extern "C" {
 #cmakedefine HAVE_PTHREAD 1
 #undef HAVE_REPRODUCIBLE_BUILD
 #cmakedefine HAVE_REPRODUCIBLE_BUILD
+#undef HAVE_RECORD_SIZE_LIMIT
+#cmakedefine HAVE_RECORD_SIZE_LIMIT
 #undef HAVE_SESSION_TICKET
 #cmakedefine HAVE_SESSION_TICKET
+#undef HAVE_SIGNED_CERT_TIMESTAMP
+#cmakedefine HAVE_SIGNED_CERT_TIMESTAMP
 #undef HAVE_SNI
 #cmakedefine HAVE_SNI
 #undef HAVE_SUPPORTED_CURVES

configure.ac

@@ -1427,6 +1427,21 @@ then
     test "$enable_earlydata" = "" && enable_earlydata=yes
     test "$enable_rpk" = "" && enable_rpk=yes
 
+    test "$enable_sct" = "" && enable_sct=yes
+    test "$enable_recordsizelimit" = "" && enable_recordsizelimit=yes
+    # Certificate compression needs zlib, and --enable-all deliberately does
+    # NOT pull libz in. Doing so gave every --enable-all build a link-time
+    # dependency on libz.so and made wolfio.h include zlib.h: that broke the
+    # OpenWrt image (no zlib on the target) and the Linux kernel module (no
+    # userspace zlib.h), among others. So it joins only when libz was asked
+    # for - and even then as an implicit enable, which steps aside with a
+    # warning if its other requirements are missing rather than stopping
+    # configure.
+    if test "$enable_certcomp" = "" && test "$with_libz" = "yes"; then
+        enable_certcomp=yes
+        certcomp_implicit=yes
+    fi
+
     if test "$KERNEL_MODE_DEFAULTS" != "yes"
     then
         # Disable QUIC with JNI since incompatible with WOLFSSL_TLS13_MIDDLEBOX_COMPAT
@@ -10787,8 +10802,8 @@ AC_ARG_WITH([libz],
             AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <zlib.h>]], [[ deflateInit(0, 8); ]])],[ libz_linked=yes ],[ libz_linked=no ])
 
             if test "x$libz_linked" = "xno" ; then
-                AC_MSG_ERROR([libz isn't found.
-                If it's already installed, specify its path using --with-libz=/dir/])
+                AC_MSG_ERROR([libz isn't found. If it's already
+                installed, specify its path using --with-libz=/dir/])
             fi
             AC_MSG_RESULT([yes])
         else
@@ -10798,6 +10813,67 @@ AC_ARG_WITH([libz],
     ]
 )
 
+# Signed Certificate Timestamp (RFC 6962)
+AC_ARG_ENABLE([sct],
+    [AS_HELP_STRING([--enable-sct],[Enable RFC 6962 signed_certificate_timestamp. Carries a Certificate Transparency SCT list between peers; validating it is left to the application (default: disabled)])],
+    [ ENABLED_SCT=$enableval ],
+    [ ENABLED_SCT=no ]
+    )
+if test "$ENABLED_SCT" = "yes"
+then
+    AM_CFLAGS="$AM_CFLAGS -DHAVE_TLS_EXTENSIONS -DHAVE_SIGNED_CERT_TIMESTAMP"
+fi
+
+# Record Size Limit (RFC 8449)
+AC_ARG_ENABLE([recordsizelimit],
+    [AS_HELP_STRING([--enable-recordsizelimit],[Enable RFC 8449 record_size_limit, the byte-exact replacement for max_fragment_length. Applies to TLS 1.2 and TLS 1.3 (default: disabled)])],
+    [ ENABLED_RECORD_SIZE_LIMIT=$enableval ],
+    [ ENABLED_RECORD_SIZE_LIMIT=no ]
+    )
+dnl RFC 8449 defines the extension for TLS 1.2 as well as TLS 1.3, where the
+dnl server answers in the ServerHello rather than EncryptedExtensions, so no
+dnl TLS 1.3 dependency is imposed here.
+if test "$ENABLED_RECORD_SIZE_LIMIT" = "yes"
+then
+    AM_CFLAGS="$AM_CFLAGS -DHAVE_TLS_EXTENSIONS -DHAVE_RECORD_SIZE_LIMIT"
+fi
+
+# Certificate Compression (RFC 8879)
+AC_ARG_ENABLE([certcomp],
+    [AS_HELP_STRING([--enable-certcomp],[Enable RFC 8879 TLS 1.3 certificate compression. Accepts a CompressedCertificate from the peer, and sends one when the certificate has been compressed with wolfSSL_CTX_compress_certs(). Needs --with-libz (default: disabled)])],
+    [ ENABLED_CERTCOMP=$enableval ],
+    [ ENABLED_CERTCOMP=no ]
+    )
+if test "$ENABLED_CERTCOMP" = "yes"
+then
+    certcomp_missing=""
+    if test "x$ENABLED_TLS13" = "xno"
+    then
+        certcomp_missing="TLS 1.3"
+    fi
+    if test "x$ENABLED_LIBZ" = "xno"
+    then
+        certcomp_missing="libz"
+    fi
+    if test "x$certcomp_missing" != "x"
+    then
+        if test "x$certcomp_implicit" = "xyes"
+        then
+            dnl Switched on by --enable-all rather than asked for, so its
+            dnl requirements are not the user's to satisfy.
+            AC_MSG_WARN([certificate compression needs $certcomp_missing;
+                         turning it off])
+            ENABLED_CERTCOMP=no
+        else
+            AC_MSG_ERROR([Certificate compression requires $certcomp_missing.])
+        fi
+    fi
+fi
+if test "$ENABLED_CERTCOMP" = "yes"
+then
+    AM_CFLAGS="$AM_CFLAGS -DHAVE_TLS_EXTENSIONS -DHAVE_CERTIFICATE_COMPRESSION"
+fi
+
 
 # PKCS#11
 AC_ARG_ENABLE([pkcs11],
@@ -12639,6 +12715,18 @@ AS_IF([test "x$ENABLED_MAXSTRENGTH" = "xyes" && \
        test "x$ENABLED_LEANPSK" = "xyes"],
       [AC_MSG_ERROR([Cannot use Max Strength and Lean PSK at the same time.])])
 
+dnl Certificate compression carries a Certificate message, so it needs
+dnl certificates. Checked here, not beside the option: ENABLED_CERTS is still
+dnl being assigned well past that point.
+AS_IF([test "x$ENABLED_CERTCOMP" = "xyes" && test "x$ENABLED_CERTS" = "xno"],
+      [AS_IF([test "x$certcomp_implicit" = "xyes"],
+             [AC_MSG_WARN([certificate compression needs certificates;
+                           turning it off])
+              ENABLED_CERTCOMP=no
+              AM_CFLAGS=`echo "$AM_CFLAGS" | \
+                  sed 's/ -DHAVE_CERTIFICATE_COMPRESSION//'`],
+             [AC_MSG_ERROR([Certificate compression requires certificates.])])])
+
 AS_IF([test "x$ENABLED_CRYPTONLY" = "xno" && \
        test "x$ENABLED_PSK" = "xno" && \
        test "x$ENABLED_ASN" = "xno"],
@@ -14129,6 +14217,9 @@ echo "   * Whitewood netRandom:        $ENABLED_WNR"
 echo "   * Server Name Indication:     $ENABLED_SNI"
 echo "   * ALPN:                       $ENABLED_ALPN"
 echo "   * Maximum Fragment Length:    $ENABLED_MAX_FRAGMENT"
+echo "   * Record Size Limit:          $ENABLED_RECORD_SIZE_LIMIT"
+echo "   * Certificate Compression:    $ENABLED_CERTCOMP"
+echo "   * Signed Cert Timestamps:     $ENABLED_SCT"
 echo "   * Trusted CA Indication:      $ENABLED_TRUSTED_CA"
 echo "   * Truncated HMAC:             $ENABLED_TRUNCATED_HMAC"
 echo "   * Supported Elliptic Curves:  $ENABLED_SUPPORTED_CURVES"