Fixes for wolfJSSE handshake/parsing and JNI buffer/length hardening

[cconlon]

This PR includes 5 Fenrir fixes:

• F-13491: Reject setUseClientMode() once the handshake has begun, matching SSLEngine/SSLSocket semantics.
• F-14003: Parse jdk.tls.*.SignatureSchemes via splitCommaList so whitespace after commas is trimmed and every scheme is honored.
• F-14028: Give server-side ECC shared-secret callback a JVM heap ByteBuffer copy of the peer public key DER.
• F-13469: Return early for an empty or single-cert chain in sortCertChainBySubjectIssuer.
• F-13470: Bound caller lengths against GetArrayLength() in dtlsCidSet, sessionFromDerNative, and dtlsCidParseNative.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #419

Scan targets checked: wolfssljni-src, wolfssljni-bugs

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

[Copilot]

🟡 Changes recommended

Gate the RSA/ECC-dependent test on both corresponding capability checks.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

This PR hardens wolfJSSE handshake handling, parsing, ECC callbacks, certificate chains, and JNI length validation.

Changes:

• Rejects mode changes after handshake start.
• Trims signature-scheme lists and improves ECC buffer ownership.
• Adds certificate-chain and JNI bounds checks.

File summaries

File	Reviewed changes
src/test/com/wolfssl/provider/jsse/test/WolfSSLEngineTest.java	Adds handshake and signature-scheme regression tests.
src/java/com/wolfssl/WolfSSLEccSharedSecretCallback.java	Documents callback buffer ownership.
src/java/com/wolfssl/provider/jsse/WolfSSLUtil.java	Uses whitespace-aware comma parsing.
src/java/com/wolfssl/provider/jsse/WolfSSLTrustX509.java	Handles empty and single-certificate chains.
src/java/com/wolfssl/provider/jsse/WolfSSLSocket.java	Updates handshake mode documentation.
src/java/com/wolfssl/provider/jsse/WolfSSLEngineHelper.java	Tracks handshake start state.
native/com_wolfssl_WolfSSLSession.c	Bounds native array lengths.
native/com_wolfssl_WolfSSLContext.c	Copies server ECC DER data into heap memory.

Review details

• Files reviewed: 8/8 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.