title: DTLS `HelloVerifyRequest`/`HelloRetryRequest` in WolfSSL
body: <p>The cookie exchange initiated by <code>HelloVerifyRequest</code> described in <a href="https://www.rfc-editor.org/rfc/rfc6347#section-4.2.1" rel="nofollow noreferrer">section 4.2.1 of RFC 6347</a> is essential to DoS-protection in DTLS. Unless I'm overlooking something, the WolfSSL documentation does not really describe how to enable this cookie exchange with its DTLS implementation.</p>
  <p>The closest I can find is the function <a href="https://www.wolfssl.com/doxygen/group__Setup.html#ga1817c18aa34a0999ab976b27f7abebf5" rel="nofollow noreferrer"><code>wolfSSL_send_hrr_cookie</code></a>, about which the manual states:</p>
  <blockquote>
  <p>This function is called on the server side to indicate that a
  HelloRetryRequest message must contain a Cookie. The Cookie holds a
  hash of the current transcript so that another server process can
  handle the ClientHello in reply. The secret is used when generting the
  integrity check on the Cookie data.</p>
  </blockquote>
  <p>As far as I understand, the <code>HelloRetryRequest</code> (compare <code>HelloVerifyRequest</code>) is TLS 1.3 terminology. DTLS 1.3 is not finalized. How does one enable and control the DTLS 1.0/1.2 cookie exchange in WolfSSL?</p>