Fix TLS 1.3 reads with mbedtls, and errno signaling on Windows

ixwebsocket/IXNetSystem.h

@@ -34,13 +34,15 @@
 #undef EINPROGRESS
 #undef EBADF
 #undef EINVAL
+#undef ECONNRESET
 
 // map to WSA error codes
 #define EWOULDBLOCK WSAEWOULDBLOCK
 #define EAGAIN WSATRY_AGAIN
 #define EINPROGRESS WSAEINPROGRESS
 #define EBADF WSAEBADF
 #define EINVAL WSAEINVAL
+#define ECONNRESET WSAECONNRESET
 
 // Define our own poll on Windows, as a wrapper on top of select
 typedef unsigned long int nfds_t;

ixwebsocket/IXSocket.cpp

@@ -286,6 +286,17 @@ namespace ix
         return err;
     }
 
+    void Socket::setErrno(int err)
+    {
+#ifdef _WIN32
+        // getErrno() reads WSAGetLastError() on Windows, the CRT errno is
+        // invisible to it
+        WSASetLastError(err);
+#else
+        errno = err;
+#endif
+    }
+
     bool Socket::isWaitNeeded()
     {
         int err = getErrno();

ixwebsocket/IXSocket.h

@@ -81,6 +81,7 @@ namespace ix
                                                const CancellationRequest& isCancellationRequested);
 
         static int getErrno();
+        static void setErrno(int err);
         static bool isWaitNeeded();
         static void closeSocket(socket_t fd);
 

ixwebsocket/IXSocketAppleSSL.cpp

@@ -267,13 +267,13 @@ namespace ix
             if (status == errSSLClosedGraceful || status == errSSLClosedNoNotify ||
                 status == errSSLClosedAbort)
             {
-                errno = ECONNRESET;
+                Socket::setErrno(ECONNRESET);
                 return -1;
             }
 
             if (status == errSSLWouldBlock)
             {
-                errno = EWOULDBLOCK;
+                Socket::setErrno(EWOULDBLOCK);
                 return -1;
             }
         }
@@ -297,13 +297,13 @@ namespace ix
             if (status == errSSLClosedGraceful || status == errSSLClosedNoNotify ||
                 status == errSSLClosedAbort)
             {
-                errno = ECONNRESET;
+                Socket::setErrno(ECONNRESET);
                 return -1;
             }
 
             if (status == errSSLWouldBlock)
             {
-                errno = EWOULDBLOCK;
+                Socket::setErrno(EWOULDBLOCK);
                 return -1;
             }
         }

ixwebsocket/IXSocketMbedTLS.cpp

@@ -347,7 +347,7 @@ namespace ix
         }
         else if (res == MBEDTLS_ERR_SSL_WANT_READ || res == MBEDTLS_ERR_SSL_WANT_WRITE)
         {
-            errno = EWOULDBLOCK;
+            Socket::setErrno(EWOULDBLOCK);
             return -1;
         }
         else
@@ -369,14 +369,30 @@ namespace ix
                 return res;
             }
 
+            // TLS 1.3 (mbedtls 3.6+): the server can send post-handshake messages
+            // (NewSessionTicket, early data) which surface as non-fatal "read again"
+            // return codes. Retry the read instead of treating them as errors.
+#if defined(MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET)
+            if (res == MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET)
+            {
+                continue;
+            }
+#endif
+#if defined(MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA)
+            if (res == MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA)
+            {
+                continue;
+            }
+#endif
+
             if (res == 0)
             {
-                errno = ECONNRESET;
+                Socket::setErrno(ECONNRESET);
             }
 
             if (res == MBEDTLS_ERR_SSL_WANT_READ || res == MBEDTLS_ERR_SSL_WANT_WRITE)
             {
-                errno = EWOULDBLOCK;
+                Socket::setErrno(EWOULDBLOCK);
             }
             return -1;
         }

ixwebsocket/IXSocketOpenSSL.cpp

@@ -837,7 +837,7 @@ namespace ix
         }
         else if (reason == SSL_ERROR_WANT_READ || reason == SSL_ERROR_WANT_WRITE)
         {
-            errno = EWOULDBLOCK;
+            Socket::setErrno(EWOULDBLOCK);
             return -1;
         }
         else
@@ -869,7 +869,7 @@ namespace ix
 
             if (reason == SSL_ERROR_WANT_READ || reason == SSL_ERROR_WANT_WRITE)
             {
-                errno = EWOULDBLOCK;
+                Socket::setErrno(EWOULDBLOCK);
             }
             return -1;
         }