mbedtls icon indicating copy to clipboard operation
mbedtls copied to clipboard

Callback style API for new session ticket for TLS 1.3

Open lhuang04 opened this issue 3 years ago • 1 comments

Suggested enhancement

Should we consider the callback style API to report a new session ticket is received by the client?

Justification

OpenSSL uses SSL_CTX_sess_set_new_cb to report a new session ticket. In mbedtls TLS 1.3, we report it via return code, MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET. There are couple of limitations in current approach.

  • This new return value, MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET, will be propagated to public API, such as mbedtls_ssl_read, mbedtls_ssl_handshake and mbedtls_ssl_write. The client need add code to handle new return code.
  • In some cases with async io, mbedtls_ssl_write will return MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET. This happens when the state transits to MBEDTLS_SSL_CLIENT_NEW_SESSION_TICKET, and mbedtls_ssl_write is called immediate after it.

lhuang04 avatar Aug 30 '21 15:08 lhuang04