[yosuke-wolfssl]

Problem

With wolfSSL_write_dup(), the write side answers a TLS 1.3 post-handshake CertificateRequest and then copies its transcript to the read side. The read side hashes the next CertificateRequest onto that copy.

The copy was made in wolfssl_write_dup_do_tls13_work() only when wolfSSL_connect_TLSv13() sent the whole response in one call. If the response hit WANT_WRITE or WC_PENDING_E and finished on a later wolfSSL_write(), no copy was made. The next PHA round was then hashed onto the old transcript, so the client's CertificateVerify/Finished did not match the server's, and every later PHA round on the connection failed.

Fix (src/tls13.c)

• postHandshakeAuthPublish is set by wolfssl_write_dup_do_tls13_work() when it starts a PHA response.
• Tls13WriteDupPublishPhaHashes() copies the transcript into dupWrite->postHandshakeSyncedHashState in wolfSSL_connect_TLSv13()'s FINISHED_DONE state while that bit is set.

Tests

• test_write_dup and test_write_dup_want_write run a second PHA round. The want_write case covers a first response that blocked.
• New test_write_dup_negotiate_pha calls wolfSSL_negotiate() on the write side before and after a PHA round and checks that no copy is made.

Verification

• --enable-all --enable-writedup --enable-asynccrypt --enable-asynccrypt-sw: builds clean, and all three tests pass over TLS 1.3 and DTLS 1.3.
• With the new tests on master's library code, test_write_dup_want_write fails on its second PHA round. The other two tests still pass there, so the second round of test_write_dup_want_write is the one that catches this bug.

[Copilot]

🟢 Approval recommended

No active review issues are reported for the TLS 1.3 post-handshake authentication transcript synchronization change.

No open issues 🎉

What changed in this PR

This PR fixes transcript synchronization for TLS 1.3 post-handshake authentication with wolfSSL_write_dup() when a response completes across multiple calls, preventing later authentication rounds from using a stale transcript.

Changes:

• Moves transcript publication to FINISHED_DONE, guarded by a flag set when a post-handshake authentication response starts.
• Adds second-round regression coverage and verifies that unrelated wolfSSL_negotiate() calls do not publish a transcript.

File	Description
wolfssl/​internal.h	Adds the pending transcript-publication flag.
tests/​api.c	Extends repeated-authentication tests and adds negotiation isolation coverage.
src/​tls13.c	Publishes the transcript at handshake completion, including resumed responses.
src/​ssl_api_rw.c	Sets the publication flag and removes the single-call publication path.

_{Review effort: Balanced}

[github-actions]

MemBrowse Memory Report · Explore what changed →

zephyr-frdm_rw612

• FLASH: log_const_area -8 B, rodata -8 B, text +1,592 B (+0.6%, 284,040 B / 67,108,864 B, total: 0% used)

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• stm32-sim-stm32h753

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

[yosuke-wolfssl]

@claude review

[claude]

Code review found no issues

No high-confidence issues detected in this change.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #12027

Scan targets checked: wolfssl-src, wolfssl-bugs
Coverage: 4 of 4 in-scope changed file(s) opened by the reviewer

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Max