This PR changes the API for sending early data on the client side. It deprecates the mbedtls_ssl_set_early_data() method and reuses mbedtls_ssl_write() method for sending early data. An alternative design is in #369.
Changes proposed
Add an error code MBEDTLS_ERR_SSL_HANDSHAKE_EARLY_RETURN for early return. Handshake returns with this error indicating the user can start sending early data. Calling mbedtls_ssl_handshake() again will continue the handshake. This pattern is similar to the handling of NewSessionTicket.
Rename MBEDTLS_SSL_EARLY_DATA_ON|OFF to MBEDTLS_SSL_EARLY_DATA_STATE_DISABLED |ON|OFF as these values represent the state of the client, rather than a configuration. When early data is enabled, the early_data state is initially ON, it will be turned to OFF if early data is rejected, a HRR is received, or max_early_data is reached (to add).
Status
DRAFT, solicit early feedback on design.
Requires Backporting
NO
Migrations
Additional comments
Any additional information that could be of interest
Todos
[ ] Tests
[ ] Documentation
[ ] Changelog updated
[ ] Backported
Steps to test or reproduce
Outline the steps to test or reproduce the PR here.
This PR changes the API for sending early data on the client side. It deprecates the
mbedtls_ssl_set_early_data()
method and reusesmbedtls_ssl_write()
method for sending early data. An alternative design is in #369.Changes proposed
MBEDTLS_ERR_SSL_HANDSHAKE_EARLY_RETURN
for early return. Handshake returns with this error indicating the user can start sending early data. Callingmbedtls_ssl_handshake()
again will continue the handshake. This pattern is similar to the handling ofNewSessionTicket
.MBEDTLS_SSL_EARLY_DATA_ON|OFF
toMBEDTLS_SSL_EARLY_DATA_STATE_DISABLED |ON|OFF
as these values represent the state of the client, rather than a configuration. When early data is enabled, the early_data state is initially ON, it will be turned to OFF if early data is rejected, a HRR is received, or max_early_data is reached (to add).Status
DRAFT, solicit early feedback on design.
Requires Backporting
NO
Migrations
Additional comments
Any additional information that could be of interest
Todos
Steps to test or reproduce
Outline the steps to test or reproduce the PR here.
Start openssl server using
Then try