CI Fix: fix flaky ECH test

[sebastian-carpenter]

Description

test_wolfSSL_Tls13_ECH_ch2_decrypt_error flakes out after a couple thousand iterations. Previously this test was seeking the first 0xFE0D bytes (TLSXT_ECH) and would then tamper with the 14th byte after that marker. Every couple thousand iterations 0xFE0D would show up before the extension marker and cause an incorrect failure.

Updated the test to iterate along the extensions list and find TLSXT_ECH.

Testing

Reproduced the error three times within 10000 iterations. Tested the fix with 20000 iterations.

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[Copilot]

Pull request overview

This PR addresses flakiness in the TLS 1.3 ECH API test test_wolfSSL_Tls13_ECH_ch2_decrypt_error by replacing a raw byte-pattern scan for 0xFE0D with structured parsing of the ClientHello extensions list to locate TLSXT_ECH deterministically.

Changes:

• Added ech_seek_extensions() / ech_find_extension() helpers to parse a ClientHello and locate a specific extension by type.
• Updated test_wolfSSL_Tls13_ECH_ch2_decrypt_error() to corrupt the ECH ciphertext by first finding the actual ECH extension in the parsed extensions list.
• Deduplicated ECH tamper helpers by reusing the new extension-finding logic.

Comments suppressed due to low confidence (1)

tests/api.c:16190

• idx is initialized as RECORD_HEADER_SZ + HANDSHAKE_HEADER_SZ and passed to ech_find_extension() under the assumption that s_buff starts with a single Handshake record containing CH2. In the memio harness, a single write can contain multiple TLS records (e.g., TLS 1.3 middlebox-compat ChangeCipherSpec followed by ClientHello), which would make this offset point into the wrong record and cause the extension parser to read incorrect data (potentially reintroducing flakiness or even out-of-bounds reads). Consider locating the ClientHello handshake message by iterating the TLS record(s) in s_buff (skipping non-handshake records like CCS) before calling ech_find_extension().

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.