Handle non IO based retry errors in QUIC
authorMatt Caswell <matt@openssl.org>
Thu, 31 Aug 2023 14:31:42 +0000 (15:31 +0100)
committerHugo Landau <hlandau@openssl.org>
Sat, 2 Sep 2023 14:23:47 +0000 (15:23 +0100)
commit3a0012cb52bef4df54bd46946d7ff783c24b4305
treef8312172f88d1132aad5e203853bfa9247ba6057
parent7b8e27bc2e02238986d89ef0ece067ec1b48e165
Handle non IO based retry errors in QUIC

SSL_get_error() may respond with some retry errors that are not IO related.
In particular SSL_ERROR_WANT_RETRY_VERIFY and SSL_ERROR_WANT_X509_LOOKUP.
These can occur during a TLS handshake. If they occur when a QUIC Connection
is performing a TLS handshake then we need to propagate these up to the QCSO.

We also handle SSL_ERROR_WANT_CLIENT_HELLO_CB. This one will only ever
occur on the server side which we don't currently support. However adding
the handling for it now is identical to all the other handling so including
it is no cost, and will be needed when we do add server support.

We are not concerned with SSL_ERROR_WANT_ASYNC or SSL_ERROR_WANT_ASYNC_JOB
since we do not support async operation with QUIC.

Fixes openssl/project#199

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Hugo Landau <hlandau@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/21922)
ssl/quic/quic_impl.c
ssl/quic/quic_tls.c