Filter suites and sigalgs for the version from an unfiltered copy

ResetSuitesForVersion() removed the suites and sigalgs that the new
version lacks from a user-set list in place. Once a DTLS maximum or
option could be lifted again, that loss became permanent: capping a DTLS
1.3 SSL at DTLS 1.2 dropped the TLS 1.3 suites and the TLS 1.3-only
brainpool sigalgs, and lifting the cap left a DTLS 1.3 SSL without them.
Without a user list, the suites were rebuilt for the version but
InitSuites() keeps existing sigalgs, so a capped SSL still offered the
TLS 1.3-only brainpool and SLH-DSA sigalgs in its DTLS 1.2 ClientHello
or CertificateRequest.

The new FilterSuitesForVersion() filters ssl->suites for its version.
The first time it has to remove something, it keeps the unfiltered list
in suitesUser, and every later call filters that copy, so a lift
restores what a cap removed. It filters the suites of a user-set list
and the sigalgs of any list, user-set or default.
ResetSuitesForVersion() rebuilds the default suites and then calls it,
also on an SSL with no side yet once a copy exists, and so do
wolfSSL_SetVersion() and InitSSL_Suites(), which an either-side SSL runs
when it takes a side. If the copy cannot be allocated, the list is still
filtered in place. At the newest version nothing can be removed, so the
filter only copies back from the saved list there.

A suite or sigalg is removed only when the newest version's defaults
have it and this version's defaults lack it: TLS 1.3 suites below 1.3,
TLS 1.2 suites below 1.2, the TLS 1.3-only brainpool and SLH-DSA
sigalgs, and RSA-PSS before TLS 1.2. Anything else the user set, such as
the multicast WDM suite or ECDSA with SHA-224, DSA or SHA-1 sigalgs, is
kept, as before. If the filter would leave no sigalg, the list is kept
as it is, since an empty list means the defaults.

wolfSSL_set_cipher_list(), wolfSSL_set_cipher_list_bytes() and
wolfSSL_set1_sigalgs_list() write into the copy while it exists and
always filter afterwards, also when they fail, so the result depends
only on the version and not on whether the list was set before or after
a cap or whether a copy was made. A TLS 1.2 SSL given a list with TLS
1.3 suites now drops them, as a DTLS 1.2 SSL already did. A sigalgs
change made while capped keeps the user's suites. SetSuitesHashSigAlgo()
now parses into a local buffer, so a sigalgs list that fails to parse
leaves the previous one in place, on the CTX as well as on the SSL. On
an SSL whose list is still the default, the setters first rebuild the
defaults for the newest version the SSL can reach and its current key,
so with OPENSSL_EXTRA a TLS 1.2-only cipher list keeps the default TLS
1.3 suites, as OpenSSL does. SetCipherList_ex() builds the list for that
newest version too, the newer of the SSL's and the CTX method's, for TLS
and DTLS alike, so a keyword list such as HIGH set while capped still
has its TLS 1.3 suites for a lift, and one set after the CTX maximum was
lowered keeps them on an SSL still at DTLS 1.3.

The filter also built its table with the server's key flags. With an ECC
key, haveStaticECC cleared haveRSA and the RSA suites were removed;
without one, the static ECDH suites were. It now builds the table for
the client side with every key type, so only the version decides what is
removed. VerifyServerSuite() still skips a suite the server's key cannot
use when it matches suites.

test_dtls13_mask_lift_cipher_list caps and lifts a user-set list on the
client and on a server with an ECC key: the cap removes only the TLS 1.3
suite, and the lift restores the list with a sigalgs change (including
ECDSA with SHA-224), a TLS 1.2 cipher list, a list set by bytes or an
unrelated option made while capped. test_dtls13_mask_list_after_cap sets
the default list, a named list, a TLS 1.2-only list or HIGH after the
cap, and a cipher list and a byte list that fail to parse, and checks
that no TLS 1.3 suite or brainpool sigalg is left until the lift.
Further tests cover a DTLS and a TLS either-side SSL capped before it
becomes the client, a list set on a side-less SSL after
wolfSSL_SetVersion(), HIGH set after the CTX maximum was lowered, SHA-1
sigalgs kept where they are built, wolfSSL_SetVersion() restoring the
TLS 1.3 suites a TLS mask removed, also from a TLS 1.2 list set under
the mask, a capped list kept across wolfSSL_clear() and restored by a
lift, a CTX sigalgs list kept when a new one fails to parse, sigalgs set
on a default list across a cap, a failed set and a lift, a
brainpool-only sigalgs list kept under a cap, a capped TLS server
merging with defaults for a key loaded later, a TLS 1.2 SSL given a TLS
1.3 suite, and the multicast suite kept under a cap.

Author: Frauschi

src/internal.c

@@ -8049,7 +8049,7 @@ int wolfSSL_CTX_IsPrivatePkSet(WOLFSSL_CTX* ctx)
 }
 #endif /* HAVE_PK_CALLBACKS */
 
-static void InitSuites_EitherSide(Suites* suites, ProtocolVersion pv, int keySz,
+void InitSuites_EitherSide(Suites* suites, ProtocolVersion pv, int keySz,
         word16 haveRSA, word16 havePSK, word16 haveDH, word16 haveECDSAsig,
         word16 haveECC, word16 haveStaticECC,
         word16 haveAnon,
@@ -8093,6 +8093,20 @@ void InitSSL_CTX_Suites(const WOLFSSL_CTX* ctx, Suites* suites)
             haveAnon, ctx->method->side);
 }
 
+/* Returns the newest version a downgrade SSL can be moved back up to. DTLS
+ * minors count down. */
+ProtocolVersion SslNewestVersion(const WOLFSSL* ssl)
+{
+    ProtocolVersion pv = ssl->version;
+    byte methodMinor = ssl->ctx->method->version.minor;
+
+    if (ssl->options.downgrade && (ssl->options.dtls ?
+            methodMinor < pv.minor : methodMinor > pv.minor)) {
+        pv = ssl->ctx->method->version;
+    }
+    return pv;
+}
+
 int InitSSL_Suites(WOLFSSL* ssl)
 {
     int keySz = 0;
@@ -8151,6 +8165,8 @@ int InitSSL_Suites(WOLFSSL* ssl)
                 havePSK, ssl->options.haveDH, ssl->options.haveECDSAsig,
                 ssl->options.haveECC, ssl->options.haveStaticECC,
                 ssl->options.useAnon, ssl->options.side);
+        if (FilterSuitesForVersion(ssl) != 0)
+            return MEMORY_E;
     }
 
 #if !defined(NO_CERTS) && !defined(WOLFSSL_SESSION_EXPORT)
@@ -10508,6 +10524,8 @@ void FreeSuites(WOLFSSL* ssl)
 #endif
     XFREE(ssl->suites, ssl->heap, DYNAMIC_TYPE_SUITES);
     ssl->suites = NULL;
+    XFREE(ssl->suitesUser, ssl->heap, DYNAMIC_TYPE_SUITES);
+    ssl->suitesUser = NULL;
 }
 
 
@@ -34842,7 +34860,8 @@ int SetCipherList_ex(const WOLFSSL_CTX* ctx, const WOLFSSL* ssl,
         side = ctx->method->side;
     }
     else if (ssl != NULL) {
-        version = ssl->version;
+        /* A later lift needs the suites of the newer version in the list. */
+        version = SslNewestVersion(ssl);
 #ifndef NO_CERTS
         privateKeySz = ssl->buffers.keySz;
 #endif
@@ -35124,9 +35143,7 @@ int SetSuitesHashSigAlgo(Suites* suites, const char* list)
     const char* s = list;
     byte sig_alg = 0;
     byte mac_alg = no_mac;
-
-    /* Setting is destructive on error. */
-    suites->hashSigAlgoSz = 0;
+    byte hashSigAlgo[WOLFSSL_MAX_SIGALGO];
 
     do {
         if (*list == '+') {
@@ -35166,7 +35183,7 @@ int SetSuitesHashSigAlgo(Suites* suites, const char* list)
                     break;
                 }
             }
-            AddSuiteHashSigAlgo(suites->hashSigAlgo, mac_alg, sig_alg, 0, &idx);
+            AddSuiteHashSigAlgo(hashSigAlgo, mac_alg, sig_alg, 0, &idx);
             sig_alg = 0;
             mac_alg = no_mac;
             s = list + 1;
@@ -35179,7 +35196,8 @@ int SetSuitesHashSigAlgo(Suites* suites, const char* list)
     if (s != list && (sig_alg != 0 || mac_alg != 0)) {
         ret = 0;
     }
-    else {
+    if (ret == 1) {
+        XMEMCPY(suites->hashSigAlgo, hashSigAlgo, idx);
         suites->hashSigAlgoSz = idx;
     }