MDEV-40445 TLS 1.3 early data (wolfssl)

Compiles with WolfSSL but hits protocol errors.
Disable 0-RTT for WolfSSL for now - compile it off, simply
setting SSL_CTX_set_max_early_data(ssl, 0) is not enough.

Author: vuvova

extra/wolfssl/user_settings.h.in

@@ -59,6 +59,7 @@
 #define WC_RSA_PSS
 #define HAVE_SESSION_TICKET
 #define KEEP_PEER_CERT
+/*#define WOLFSSL_EARLY_DATA*/
 /* End of TLSv1.3 defines */
 
 /* Features we exclude */

include/ssl_compat.h

@@ -68,6 +68,42 @@
 
 #ifdef HAVE_WOLFSSL
 #define EVP_MD_CTX_SIZE                 sizeof(wc_Md5)
+#define SSL_READ_EARLY_DATA_SUCCESS 0
+#define early_data_size_t int
+/**** WolfSSL stub: will go away when WOLFSSL_EARLY_DATA is enabled ****/
+static inline
+int  wolfSSL_write_early_data(void* ssl __attribute__((unused)),
+                              const void* data __attribute__((unused)),
+                              int sz __attribute__((unused)),
+                              int* outSz)
+{
+  return 1;
+}
+static inline
+int  wolfSSL_read_early_data(void* ssl __attribute__((unused)),
+                             void* data __attribute__((unused)),
+                             int sz __attribute__((unused)),
+                             int* outSz __attribute__((unused)))
+{
+  *outSz= 0;
+  return SSL_READ_EARLY_DATA_SUCCESS;
+}
+static inline
+int  SSL_CTX_set_max_early_data(void* ctx __attribute__((unused)),
+                                    unsigned int sz __attribute__((unused)))
+{
+  return 1;
+}
+static inline
+int SSL_get_early_data_status(const void* ssl __attribute__((unused)))
+{
+  return 1;
+}
+#define SSL_EARLY_DATA_ACCEPTED 0
+#define SSL_EARLY_DATA_REJECTED 1
+/**** End of WolfSSL stub **********************************************/
+#else
+#define early_data_size_t size_t
 #endif
 
 #ifndef HAVE_OPENSSL11

mysql-test/main/ssl_early_data,wolfssl.rdiff

@@ -0,0 +1,37 @@
+--- a/mysql-test/main/ssl_early_data.result
++++ b/mysql-test/main/ssl_early_data.result
+@@ -7,7 +7,7 @@ connect ssl1,localhost,u1,pw,,,,SSL;
+ show status like 'ssl_early_data%';
+ Variable_name	Value
+ Ssl_early_data_accepted	0
+-Ssl_early_data_rejected	0
++Ssl_early_data_rejected	1
+ Ssl_early_data_replies	0
+ show status like 'ssl_sessions_reused';
+ Variable_name	Value
+@@ -16,9 +16,9 @@ disconnect ssl1;
+ connect ssl2,localhost,u1,pw,,,,SSL;
+ show status like 'ssl_early_data%';
+ Variable_name	Value
+-Ssl_early_data_accepted	1
+-Ssl_early_data_rejected	0
+-Ssl_early_data_replies	1
++Ssl_early_data_accepted	0
++Ssl_early_data_rejected	2
++Ssl_early_data_replies	0
+ show status like 'ssl_sessions_reused';
+ Variable_name	Value
+ Ssl_sessions_reused	1
+@@ -26,9 +26,9 @@ disconnect ssl2;
+ connect ssl3,localhost,u1,pw,,,,SSL;
+ show status like 'ssl_early_data%';
+ Variable_name	Value
+-Ssl_early_data_accepted	2
+-Ssl_early_data_rejected	0
+-Ssl_early_data_replies	2
++Ssl_early_data_accepted	0
++Ssl_early_data_rejected	3
++Ssl_early_data_replies	0
+ show status like 'ssl_sessions_reused';
+ Variable_name	Value
+ Ssl_sessions_reused	1

mysql-test/main/ssl_early_data.test

@@ -3,6 +3,7 @@
 --echo #
 
 --source include/not_embedded.inc
+--source include/ssl_library.inc
 
 --echo try without a password or with unsecure plugin
 

vio/viossl.c

@@ -425,7 +425,7 @@ ulong sslaccept(struct st_VioSSLFd *ptr, Vio *vio, long timeout, unsigned long *
     set_if_smaller(bufsize, MAX_EARLY_DATA);
     for (;;)
     {
-      size_t nread;
+      early_data_size_t nread;
       int ret= SSL_read_early_data(ssl, buf, bufsize, &nread);
       if (ret >= SSL_READ_EARLY_DATA_SUCCESS)
       {