From 6254482b9dcf85f183f00602932ddd06c8ed556b Mon Sep 17 00:00:00 2001
From: David Benjamin <davidben@google.com>
Date: Mon, 4 Nov 2024 16:47:46 +0000
Subject: [PATCH] runner: Rearrange 0-RTT code in server slightly

The point at which we flush is tricky for testing DTLS 1.3 ACKs. This
rearrangement is not sufficient to make that work, but I wanted to pull
this into a separately reviewable CL first. The changes are:

- We can derive keys and set the out keys very early

- I've removed the shouldSkipEarlyData() check. That check is
  unnecessary because we're already checking for whether the server
  accepted early data in EncryptedExtensions. (Also it doesn't make
  sense to apply that check to reading a bit of early data, but not to
  reading EndOfEarlyData. The conditions on those should match.)

Change-Id: Ie1909bb5f8a8a2aeab05ba0f95155ce45eb160f3
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/72948
Reviewed-by: Nick Harper <nharper@chromium.org>
Commit-Queue: David Benjamin <davidben@google.com>
---
 ssl/test/runner/handshake_server.go | 50 ++++++++++++++---------------
 1 file changed, 24 insertions(+), 26 deletions(-)

diff --git a/ssl/test/runner/handshake_server.go b/ssl/test/runner/handshake_server.go
index 799eb13df..96490cb97 100644
--- a/ssl/test/runner/handshake_server.go
+++ b/ssl/test/runner/handshake_server.go
@@ -1219,21 +1219,6 @@ ResendHelloRetryRequest:
 	if c.config.Bugs.SendExtraFinished {
 		c.writeRecord(recordTypeHandshake, finished.marshal())
 	}
-	if err := c.flushHandshake(); err != nil {
-		return err
-	}
-
-	if encryptedExtensions.extensions.hasEarlyData && !c.shouldSkipEarlyData() {
-		for _, expectedMsg := range config.Bugs.ExpectLateEarlyData {
-			if err := c.readRecord(recordTypeApplicationData); err != nil {
-				return err
-			}
-			if !bytes.Equal(c.input.Bytes(), expectedMsg) {
-				return fmt.Errorf("tls: got late early data record %x, wanted %x", c.input.Bytes(), expectedMsg)
-			}
-			c.input.Reset()
-		}
-	}
 
 	// The various secrets do not incorporate the client's final leg, so
 	// derive them now before updating the handshake context.
@@ -1252,19 +1237,32 @@ ResendHelloRetryRequest:
 	// from the client certificate are sent over these keys.
 	c.useOutTrafficSecret(uint16(encryptionApplication), c.wireVersion, hs.suite, serverTrafficSecret)
 
-	// Read end_of_early_data.
-	if encryptedExtensions.extensions.hasEarlyData && c.usesEndOfEarlyData() {
-		msg, err := c.readHandshake()
-		if err != nil {
-			return err
-		}
+	if err := c.flushHandshake(); err != nil {
+		return err
+	}
 
-		endOfEarlyData, ok := msg.(*endOfEarlyDataMsg)
-		if !ok {
-			c.sendAlert(alertUnexpectedMessage)
-			return unexpectedMessageError(endOfEarlyData, msg)
+	if encryptedExtensions.extensions.hasEarlyData {
+		for _, expectedMsg := range config.Bugs.ExpectLateEarlyData {
+			if err := c.readRecord(recordTypeApplicationData); err != nil {
+				return err
+			}
+			if !bytes.Equal(c.input.Bytes(), expectedMsg) {
+				return fmt.Errorf("tls: got late early data record %x, wanted %x", c.input.Bytes(), expectedMsg)
+			}
+			c.input.Reset()
+		}
+		if c.usesEndOfEarlyData() {
+			msg, err := c.readHandshake()
+			if err != nil {
+				return err
+			}
+			endOfEarlyData, ok := msg.(*endOfEarlyDataMsg)
+			if !ok {
+				c.sendAlert(alertUnexpectedMessage)
+				return unexpectedMessageError(endOfEarlyData, msg)
+			}
+			hs.writeClientHash(endOfEarlyData.marshal())
 		}
-		hs.writeClientHash(endOfEarlyData.marshal())
 	}
 
 	// Switch input stream to handshake traffic keys.