]> git.kaiwu.me - nginx.git/commit
QUIC: better approach for premature handshake completion.
authorSergey Kandaurov <pluknet@nginx.com>
Thu, 15 May 2025 21:10:11 +0000 (01:10 +0400)
committerRoman Arutyunyan <arutyunyan.roman@gmail.com>
Fri, 23 May 2025 11:00:47 +0000 (15:00 +0400)
commit1d4d2f2c962c33aafdd8f79d9fc50b7cacf05e24
tree2de7cecc6509ce3dda7f032f1770d5f6625952e4
parentbcb9d3fd2cc88eee23a5da854a0e2aa5c5b688d7
QUIC: better approach for premature handshake completion.

Using SSL_in_init() to inspect a handshake state was replaced with
SSL_is_init_finished().  This represents a more complete fix to the
BoringSSL issue addressed in 22671b37e.

This provides awareness of the early data handshake state when using
OpenSSL 3.5 TLS callbacks in 0-RTT enabled configurations, which, in
particular, is used to avoid premature completion of the initial TLS
handshake, before required client handshake messages are received.

This is a non-functional change when using BoringSSL.  It supersedes
testing non-positive SSL_do_handshake() results in all supported SSL
libraries, hence simplified.

In preparation for using OpenSSL 3.5 TLS callbacks.
src/event/quic/ngx_event_quic_ssl.c