mbedtls
mbedtls copied to clipboard
Callback style API for new session ticket for TLS 1.3
Suggested enhancement
Should we consider the callback style API to report a new session ticket is received by the client?
Justification
OpenSSL uses SSL_CTX_sess_set_new_cb to report a new session ticket. In mbedtls TLS 1.3, we report it via return code, MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET. There are couple of limitations in current approach.
- This new return value,
MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET
, will be propagated to public API, such asmbedtls_ssl_read
,mbedtls_ssl_handshake
andmbedtls_ssl_write
. The client need add code to handle new return code. - In some cases with async io,
mbedtls_ssl_write
will returnMBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET
. This happens when the state transits to MBEDTLS_SSL_CLIENT_NEW_SESSION_TICKET, andmbedtls_ssl_write
is called immediate after it.