Also handle alerts for alternate DoTls13ServerHello call path.

Fix incorrect illegal_parameter alert for missing supported_versions.  This is a missing extension rather than an extra/unexpected extension.

Author: kareem-wolfssl

src/internal.c

@@ -33142,7 +33142,17 @@ static void MakePSKPreMasterSecret(Arrays* arrays, byte use_psk_key)
 #ifdef WOLFSSL_TLS13
         if (IsAtLeastTLSv1_3(pv)) {
             byte type = server_hello;
-            return DoTls13ServerHello(ssl, input, inOutIdx, helloSz, &type);
+            ret = DoTls13ServerHello(ssl, input, inOutIdx, helloSz, &type);
+            if (ret != 0 &&
+                    ssl->alert_history.last_tx.level != alert_fatal) {
+                int alertType = TranslateErrorToAlert(ret);
+                if (alertType != invalid_alert) {
+                    if (SendAlert(ssl, alert_fatal, alertType) ==
+                            WC_NO_ERR_TRACE(SOCKET_ERROR_E))
+                        ret = SOCKET_ERROR_E;
+                }
+            }
+            return ret;
         }
 #endif
 

src/tls13.c

@@ -5659,21 +5659,6 @@ int DoTls13ServerHello(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
                 WOLFSSL_ERROR_VERBOSE(VERSION_ERROR);
                 return VERSION_ERROR;
             }
-
-            if (args->extMsgType == hello_retry_request) {
-                /* The HelloRetryRequest sentinel Random is reserved for TLS 1.3
-                 * (RFC 8446 4.1.3), but supported_versions (which an HRR MUST
-                 * carry, 4.1.4/4.2.1) is absent, so the message is malformed.
-                 * Reject before the downgrade reparses the remaining extensions
-                 * as a TLS 1.2 server_hello, where a recognized-but-not-
-                 * permitted extension (e.g. server_name) would wrongly yield an
-                 * unsupported_extension alert. illegal_parameter (via
-                 * EXT_NOT_ALLOWED) is chosen over missing_extension per the
-                 * RFC 8446 4.2 rule for such extensions. */
-                WOLFSSL_MSG("HelloRetryRequest without supported_versions");
-                WOLFSSL_ERROR_VERBOSE(EXT_NOT_ALLOWED);
-                return EXT_NOT_ALLOWED;
-            }
 #if defined(OPENSSL_EXTRA) || defined(HAVE_WEBSERVER) || \
     defined(WOLFSSL_WPAS_SMALL)
             /* Check if client has disabled TLS 1.2 */

tests/api/test_tls13.c

@@ -6446,16 +6446,18 @@ int test_tls13_hrr_recognized_ext_downgrade(void)
     ExpectIntEQ(test_memio_inject_message(&test_ctx, 1,
         (const char *)hrr_sni_no_sv, sizeof(hrr_sni_no_sv)), 0);
 
-    /* Handshake must fail with EXT_NOT_ALLOWED (server_name is not permitted in
-     * a HelloRetryRequest), not UNSUPPORTED_EXTENSION. */
+    /* Handshake must fail because the mandatory supported_versions extension
+     * is absent from the HelloRetryRequest. The HRR is rejected before the
+     * downgrade reparses the remaining (server_name) extension, so the result
+     * is the missing mandatory extension (INCOMPLETE_DATA). */
     ExpectIntEQ(wolfSSL_connect(ssl_c), -1);
     ExpectIntEQ(wolfSSL_get_error(ssl_c, -1),
-        WC_NO_ERR_TRACE(EXT_NOT_ALLOWED));
+        WC_NO_ERR_TRACE(INCOMPLETE_DATA));
 
-    /* RFC 8446 Sec. 4.2: the client MUST abort with illegal_parameter (47),
-     * not unsupported_extension (110). */
+    /* RFC 8446 Sec. 4.1.4/4.2: a mandatory-but-absent extension MUST abort with
+     * a missing_extension (109) alert. */
     ExpectIntEQ(wolfSSL_get_alert_history(ssl_c, &h), WOLFSSL_SUCCESS);
-    ExpectIntEQ(h.last_tx.code, illegal_parameter);
+    ExpectIntEQ(h.last_tx.code, missing_extension);
     ExpectIntEQ(h.last_tx.level, alert_fatal);
 
     wolfSSL_free(ssl_c);