Skip to content

Fixes for "--enable-jni --enable-all" with WOLFSSL_TLS13_MIDDLEBOX_COMPAT#9404

Merged
dgarske merged 2 commits intowolfSSL:masterfrom
cconlon:jniNoQuicEch
Nov 11, 2025
Merged

Fixes for "--enable-jni --enable-all" with WOLFSSL_TLS13_MIDDLEBOX_COMPAT#9404
dgarske merged 2 commits intowolfSSL:masterfrom
cconlon:jniNoQuicEch

Conversation

@cconlon
Copy link
Copy Markdown
Member

@cconlon cconlon commented Nov 8, 2025

Description

This PR prevents --enable-all from enabling QUIC and ECH when --enable-jni is also specified, as these are incompatible with WOLFSSL_TLS13_MIDDLEBOX_COMPAT mode enabled by JNI. Changes include:

  • configure.ac: Modified --enable-all logic to exclude QUIC and ECH when $enable_jni = "yes"
  • tests/api/test_tls13.c: Skip test_tls13_hrr_different_cs() when WOLFSSL_TLS13_MIDDLEBOX_COMPAT is defined

Without these changes, make check fails with ./configure --enable-jni --enable-all.


QUIC incompatibility:

  • TLS 1.3 middlebox compatibility (RFC 8446 Appendix D.4) requires echoing a 32-byte session ID in ClientHello
  • QUIC (RFC 9001 Section 8.4) requires the legacy_session_id field to be empty
  • These requirements seem mutually exclusive

ECH incompatibility:

  • ECH (draft-ietf-tls-esni-25) requires ClientHelloInner.legacy_session_id to be empty before encryption
  • Middlebox compatibility mode populates session IDs based on client random, violating ECH requirements
  • There might be future work here for compatibility in GetTls13SessionId(), but simply skipping this test combo for now.

Testing

Tested various enable combinations between the above with built-in tests.

Checklist

  • added tests
  • updated/added doxygen
  • updated appropriate READMEs
  • Updated manual and documentation

@cconlon cconlon self-assigned this Nov 8, 2025
@cconlon
Copy link
Copy Markdown
Member Author

cconlon commented Nov 10, 2025

Retest this please Jenkins. PRB-CAVP-selftest-v2 (resume test).

@cconlon cconlon assigned wolfSSL-Bot and unassigned cconlon Nov 10, 2025
@dgarske dgarske merged commit 4c273a6 into wolfSSL:master Nov 11, 2025
345 of 347 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants