[yosuke-wolfssl]

Problem

A TLS 1.3 client answers a post-handshake CertificateRequest from inside wolfSSL_read(). When the socket will not take the Certificate / CertificateVerify / Finished flight, the WANT_WRITE is rewritten to the fatal POST_HAND_AUTH_ERROR (-504):

Client	Result
reads only	every later read is refused; the queued flight never leaves and the server waits forever
writes next	wolfSSL_negotiate() finishes the flight, then the next read fails with LENGTH_ERROR: the CertificateRequest record was left half-processed

Fix (src/tls13.c)

• DoTls13HandShakeMsgType() passes WANT_WRITE from the post-handshake wolfSSL_connect_TLSv13() call through, as it already did for WC_PENDING_E.
• DoProcessReplyEx() (src/internal.c) finishes the CertificateRequest record for WANT_WRITE as well as WC_PENDING_E: it either resumes at the next message or skips the padding. This block was async-only before.

The caller now sees WOLFSSL_ERROR_WANT_WRITE, and the next wolfSSL_read() or wolfSSL_write() finishes the flight through wolfSSL_negotiate().

Tests

test_tls13_pha_want_write: a blocked TLS 1.3 PHA response, retried once by wolfSSL_read() and once by wolfSSL_write(). The server must accept the certificate, and the client must then read the server's data.

Verification

• Negative controls: reverting the tls13.c or the internal.c change makes the test fail.
• Full --api, 0 failures: --enable-tls13 --enable-postauth --enable-sessioncerts (686 passed); --enable-all --enable-writedup --enable-asynccrypt --enable-asynccrypt-sw (2550 passed).

Not in this PR

• DTLS 1.3: a blocked PHA response still returns POST_HAND_AUTH_ERROR. Resuming it on DTLS also needs _Dtls13HandshakeRecv() to count the message as processed (Ack DTLS 1.3 handshake message when response hits WANT_WRITE #11768) and DoProcessReplyEx() to keep WANT_WRITE when more records follow in the same datagram. Follow-up.
• Untested branch: a CertificateRequest followed by another message in the same record (the runProcessingOneMessage path). The code was reviewed, but building that record needs a hand-crafted encrypted record.

[github-actions]

MemBrowse Memory Report · Explore what changed →

zephyr-frdm_rw612

• FLASH: log_const_area -8 B, rodata -8 B, text +1,592 B (+0.6%, 284,040 B / 67,108,864 B, total: 0% used)

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• stm32-sim-stm32h753

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

[Copilot]

🟡 Changes recommended

Without WOLFSSL_ASYNC_CRYPT, coalesced DTLS records can lose WANT_WRITE after CertificateRequest, allowing an ACK to overwrite the result or a NewSessionTicket to fail with OUT_OF_ORDER_E.

1 open issue

• Preserve WANT_WRITE when processing coalesced DTLS records · New

What changed in this PR

This PR updates wolfSSL’s TLS 1.3 and DTLS 1.3 post-handshake authentication handling so blocked responses report WANT_WRITE and can resume on a later read or write.

Changes:

• Preserve WANT_WRITE instead of converting it to a fatal authentication error.
• Complete record bookkeeping and DTLS acknowledgment processing when a response blocks.
• Add regression tests for read/write retries and a second authentication request.

File	Description
tests/​api/​test_tls13.h	Declares and registers the regression test.
tests/​api/​test_tls13.c	Tests blocked responses and retries for TLS and DTLS.
src/​tls13.c	Preserves WANT_WRITE from authentication responses.
src/​internal.c	Extends record completion handling to blocked responses.
src/​dtls13.c	Acknowledges and marks requests processed before returning WANT_WRITE.

_{Review effort: Balanced}

[yosuke-wolfssl]

@claude review

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #12014

Scan targets checked: wolfssl-src, wolfssl-bugs
Not reviewed (no scan target covers them): tests/api/test_tls13.h
Coverage: 2 of 3 in-scope changed file(s) opened by the reviewer; not opened: tests/api/test_tls13.c

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

[SparkiDev]

@claude review

[Copilot]

🟡 Changes recommended

The regression test can pass without completed server-side PHA because WANT_READ and application-data exchange do not prove authentication success, so it needs explicit assertions for the peer certificate, peer verification, and Finished receipt.

1 open issue

• Assert server completed PHA in retry test · New

1 resolved since last review

• Preserve WANT_WRITE when processing coalesced DTLS records

_{Review effort: Balanced}

[claude]

Code review found no issues

No high-confidence issues detected in this change.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #12014

Scan targets checked: wolfssl-src, wolfssl-bugs
Not reviewed (no scan target covers them): tests/api/test_tls13.h
Coverage: 3 of 3 in-scope changed file(s) opened by the reviewer

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Max