QUIC SSL Behaviours: Allow detection of an SSL connection used for QUIC handshake

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20061)

diff --git a/include/openssl/ssl3.h b/include/openssl/ssl3.h
index 3007a31d52a57317bde982080a847223660674c9..2747a9d65bea32467af521ef17b6467b1374a17c 100644 (file)
--- a/include/openssl/ssl3.h
+++ b/include/openssl/ssl3.h
@@ -307,6 +307,9 @@ extern "C" {
 /* Set if extended master secret extension required on renegotiation */
 # define TLS1_FLAGS_REQUIRED_EXTMS               0x1000
 
+/* Set if this is the QUIC handshake layer */
+# define TLS1_FLAGS_QUIC                         0x2000
+
 # define SSL3_MT_HELLO_REQUEST                   0
 # define SSL3_MT_CLIENT_HELLO                    1
 # define SSL3_MT_SERVER_HELLO                    2

diff --git a/ssl/quic/quic_impl.c b/ssl/quic/quic_impl.c
index bbd995d5174f562fb199715d74374a2154f62a12..9d2624102ebbfcc1848889d26576d7cdd349b8ed 100644 (file)
--- a/ssl/quic/quic_impl.c
+++ b/ssl/quic/quic_impl.c
@@ -322,6 +322,9 @@ SSL *ossl_quic_new(SSL_CTX *ctx)
     qc->tls = ossl_ssl_connection_new_int(ctx, TLS_method());
     if (qc->tls == NULL || (sc = SSL_CONNECTION_FROM_SSL(qc->tls)) == NULL)
          goto err;
+    /* override the user_ssl of the inner connection */
+    sc->user_ssl = ssl_base;
+    sc->flags   |= TLS1_FLAGS_QUIC;
 
 #if defined(OPENSSL_THREADS)
     if ((qc->mutex = ossl_crypto_mutex_new()) == NULL)

diff --git a/ssl/ssl_local.h b/ssl/ssl_local.h
index 1c01377e14b1e843c2ea18b0d66b870f03e172fb..890c757c96fb46272a6d93e6eb1108b7a1e91f37 100644 (file)
--- a/ssl/ssl_local.h
+++ b/ssl/ssl_local.h
@@ -311,6 +311,8 @@
 # define SSL_READ_ETM(s) (s->s3.flags & TLS1_FLAGS_ENCRYPT_THEN_MAC_READ)
 # define SSL_WRITE_ETM(s) (s->s3.flags & TLS1_FLAGS_ENCRYPT_THEN_MAC_WRITE)
 
+# define SSL_IS_QUIC_HANDSHAKE(s) (((s)->s3.flags & TLS1_FLAGS_QUIC) != 0)
+
 /* alert_dispatch values */
 
 /* No alert pending */