Siliently ignore RecordPadding option for QUIC objects

[nhorman]

QUIC doesn't support the SSL_set_block_padding_ex apis, because QUIC objects always pad at the packet level during packet encryption. However, record padding is a config file option, and setting it there is done without any knoweldge of the kind of SSL objects we are going to create (TCP vs QUIC). As such, it seems to make sense to siliently ignore the option when configuring an SSL/SSL_CTX on QUIC objects.

Checklist

• documentation is added or updated

[nhorman]

backport ci jobs can be ignored, will fixup manually on merge

[Sashan]

Why do we need this change? snippet below comes from SSL_set_block_padding_ex():

6026                                                                                                                                                                                                                                                                                                                        
6027 int SSL_set_block_padding_ex(SSL *ssl, size_t app_block_size,
6028                              size_t hs_block_size)
6029 {
6030     SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl);
6031
6032     if (sc == NULL
6033         || (IS_QUIC(ssl)
6034             && (app_block_size > 1 || hs_block_size > 1)))
6035         return 0;

The SSL_set_block_padding_ex() currently indicate failure (return 0) when it is presented with SSL QUIC object.

I think we can opt for more conservative change without introducing public version of SSL_CTX_is_quic(). We can let SSL_set_block_padding_ex() to always succeed for QUIC objects. Something like

in SSL_set_block_padding_ex(SSL *ssl, size_t app_block_size, size_t hs_block_size)
{
    if (IS_QUIC(ssl))
        return 1;
    ...

I think the one-liner above has the same effect as the change proposed here. I admit I might be missing some detail... thanks.

[nhorman]

@Sashan I specifically opted not to go with that approach because SSL_set_block_padding_ex and SSL_CTX_set_block_padding_ex are unsupported by QUIC, so I wanted applications that make those calls directly to be informed of that lack of support via the error code return. The exception we have to that case is the event in which we set these options via config file (where we have no idea what kind of SSL object we will be applying the padding to), so I figured this was the best compromise to make.

[Sashan]

thanks for clarificaiton. looks good to me.

[nhorman]

test added

[t8m]

OK for 4.0.

[Sashan]

looks good to me.

[openssl-machine]

This pull request is ready to merge

[t8m]

Merged to the master branch. Please create a backport PR for 3.6 branch without having the SSL_CTX_is_quic() API addition. (I.e. make non-public ossl_ssl_ctx_is_quic() there.)