QUIC ACKM: Clarify the role of is_inflight

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from #21135)

include/internal/quic_ackm.h

@@ -67,10 +67,19 @@ struct ossl_ackm_tx_pkt_st {
      */
     unsigned int pkt_space :2;
 
-    /* 1 if the packet is in flight. */
+    /*
+     * 1 if the packet is in flight. A packet is considered 'in flight' if it is
+     * counted for purposes of congestion control and 'bytes in flight' counts.
+     * Most packets are considered in flight. The only circumstance where a
+     * numbered packet is not considered in flight is if it contains only ACK
+     * frames (not even PADDING frames), as these frames can bypass CC.
+     */
     unsigned int is_inflight :1;
 
-    /* 1 if the packet has one or more ACK-eliciting frames. */
+    /*
+     * 1 if the packet has one or more ACK-eliciting frames.
+     * Note that if this is set, is_inflight must be set.
+     */
     unsigned int is_ack_eliciting :1;
 
     /* 1 if the packet is a PTO probe. */

ssl/quic/quic_ackm.c

@@ -1068,6 +1068,10 @@ int ossl_ackm_on_tx_packet(OSSL_ACKM *ackm, OSSL_ACKM_TX_PKT *pkt)
     if (pkt->num_bytes == 0)
         return 0;
 
+    /* Does not make any sense for a non-in-flight packet to be ACK-eliciting. */
+    if (!pkt->is_inflight && pkt->is_ack_eliciting)
+        return 0;
+
     if (tx_pkt_history_add(h, pkt) == 0)
         return 0;