Add a runtime option to enable or disable the secure renegotiation check.

[kareem-wolfssl]

Description

Send no_renegotiation alert when rejecting renegotation attempt due to renegotiation being disabled as defined in RFC 5246 section 7.2.2.
Fixes zd#19378

Testing

Built in tests

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[devin-ai-integration]

🛟 Devin Lifeguard found 2 likely issues in this PR

• use-c-style-comments snippet: Replace the “// SCR check is enabled” (and similar) lines in the code examples with C-style comments, e.g. “/* SCR check is enabled */”.
• declare-const-pointers snippet snippet: Change wolfSSL_get_scr_check_enabled signature to int wolfSSL_get_scr_check_enabled(const WOLFSSL* ssl) (and similarly make the ssl and ctx parameters in test_SCR_check_remove_ext_io_cb const) since they are not modified within the functions.

@kareem-wolfssl
please take a look at the above issues which Devin flagged. Devin will not fix these issues automatically.

[Copilot]

Pull request overview

This PR adds a runtime option to enable or disable the secure renegotiation (SCR) check in wolfSSL. The feature allows clients to control whether to enforce RFC 9325 requirements that servers acknowledge the secure renegotiation extension. Additionally, it implements sending a no_renegotiation alert when rejecting renegotiation attempts on servers without secure renegotiation support.

Key changes:

• Adds scr_check_enabled bit field to the WOLFSSL structure with getter/setter API functions
• Implements logic to send no_renegotiation alert when server receives ClientHello after handshake completion without secure renegotiation support
• Makes the existing SCR check in DoServerHello conditional on the new scr_check_enabled flag

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
wolfssl/ssl.h	Adds API declarations for wolfSSL_get_scr_check_enabled and wolfSSL_set_scr_check_enabled
wolfssl/internal.h	Adds scr_check_enabled bit field to WOLFSSL structure
src/ssl.c	Implements getter/setter functions for the SCR check flag
src/internal.c	Initializes scr_check_enabled to 1 (enabled by default); adds no_renegotiation alert logic; makes SCR check conditional on the flag
tests/api.c	Adds comprehensive test for the SCR check enable/disable functionality
doc/dox_comments/header_files/ssl.h	Adds documentation for the new API functions

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The static variable 'sentServerHello' maintains state across multiple test invocations. This could cause test failures if the test is run multiple times in the same process, as the variable will remain TRUE after the first test execution. Consider resetting this variable at the beginning of each test or making it non-static and passed through the context parameter.

[kareem-wolfssl]

This test is expected to only run once. The variable needs to be static due to how the test is implemented.

[Copilot]

The loop condition 'i < (size_t)sz - sizeof(renegExt)' could miss checking the last valid position. When i equals sz - sizeof(renegExt), we can still safely access buf[i] and buf[i+1] (since sizeof(renegExt) is 2). The condition should be 'i <= (size_t)sz - sizeof(renegExt)' to check all valid positions.

[kareem-wolfssl]

The XMEMCMP line below this is accessing up to sizeof(renegExt) so this check must remain how it is currently.