mbedtls: fix ticket handling

[icing]

Getting MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET from mbedTLS is in no way blocking. Send/receive calls need to make another attempt afterwards to get the "real" result.

[Copilot]

🟡 Changes recommended

The new retry paths ignore mbed_new_session() failures, which can mask real errors and potentially lead to unexpected looping.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR updates the mbedTLS VTLS backend to treat MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET as a non-blocking condition, immediately processing the ticket and retrying the underlying send/recv operation to obtain the “real” I/O result.

Changes:

• Retry mbedtls_ssl_write() after receiving a TLS 1.3 new session ticket instead of returning a would-block condition.
• Retry mbedtls_ssl_read() after receiving a new session ticket instead of falling through to a would-block path.

File summaries

File	Description
lib/vtls/mbedtls.c	Adjusts send/recv error handling to process new session tickets and retry the I/O call to obtain the actual result.

Review details

Suppressed comments (1)

lib/vtls/mbedtls.c:1477

• mbed_new_session() returns a CURLcode, but the new retry loop ignores it and immediately calls mbedtls_ssl_read() again. If session extraction/saving fails, this will hide the failure from the caller and may loop unexpectedly.

    case MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET:
      mbed_new_session(cf, data);
      /* This is not blocking anything. We can try again until a
       * "real" result comes. */
      goto do_read;

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.