Fenrir fixes

[julek-wolfssl]

• Update setup-msbuild action
• Dockerfile: use https instead of http
• ProcessSessionTicket: verify nonce length
• ProcessServerHello: verify extension lengths
• Pin actions/checkout version
• DoTls13ClientHello: session length is a sender side requirement
• CheckCertCRL_ex: check cbRet after callback
• QuicTransportParam_new: update len check
• Remove dead code
• wc_ChaCha20Poly1305_Decrypt: clear unauthed plaintext
• wc_GetKeyOID: Clean up logging in mldsa case

[Copilot]

Pull request overview

Hardening and cleanup changes across TLS/QUIC parsing, crypto error handling, and CI/container tooling to improve security and robustness.

Changes:

• Strengthen input/length validation in TLS 1.3 parsing and sniffer logic; remove dead session ticket validation code.
• Improve security posture by clearing plaintext on AEAD failure and tightening CRL callback return handling.
• Update CI and Docker dependencies (pin/upgrade actions, switch Docker git clone to HTTPS).

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
wolfcrypt/src/chacha20_poly1305.c	Clears plaintext buffer on decrypt error to avoid returning unauthenticated data.
wolfcrypt/src/asn.c	Adjusts Dilithium-related logging condition in wc_GetKeyOID.
src/tls13.c	Relaxes TLS 1.3 ClientHello legacy session ID length check.
src/tls.c	Removes dead session ticket request validation hook and macro usage.
src/sniffer.c	Adds additional bounds checks for TLS 1.3 ticket nonce and ServerHello extensions.
src/quic.c	Updates QUIC transport parameter length upper bound.
src/crl.c	Fixes retry condition to check cbRet after callback.
Docker/Dockerfile	Switches git clone URL from HTTP to HTTPS.
.github/workflows/win-csharp-test.yml	Pins/updates actions/checkout and setup-msbuild.
.github/workflows/ada.yml	Pins actions/checkout version.

Comments suppressed due to low confidence (1)

wolfcrypt/src/asn.c:1

• The logging condition depends on the current value of *algoID, which may be influenced by its prior value rather than the Dilithium init result in this call. To make the behavior deterministic and easier to reason about, prefer logging based on the initialization return status (or explicitly initialize/reset *algoID before attempting initialization so *algoID == 0 reliably reflects 'init failed').

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[douzzer]

retest this please