Select TLS 1.3 cipher before resumption in BoGo.

This is generally much cleaner and makes it possible to implement the
more lax cipher matching in draft 18.

BUG=117

Change-Id: I595d7619d60bc92e598d75b43945286323c0b72b
Reviewed-on: https://boringssl-review.googlesource.com/12309
Reviewed-by: Nick Harper <nharper@chromium.org>
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>

ssl/test/runner/handshake_server.go

diff --git a/ssl/test/runner/handshake_server.go b/ssl/test/runner/handshake_server.go
index 6f86a21..c9a5b50 100644
--- a/ssl/test/runner/handshake_server.go
+++ b/ssl/test/runner/handshake_server.go
@@ -385,6 +385,36 @@
 		return err
 	}
 
+	// Select the cipher suite.
+	var preferenceList, supportedList []uint16
+	if config.PreferServerCipherSuites {
+		preferenceList = config.cipherSuites()
+		supportedList = hs.clientHello.cipherSuites
+	} else {
+		preferenceList = hs.clientHello.cipherSuites
+		supportedList = config.cipherSuites()
+	}
+
+	for _, id := range preferenceList {
+		if hs.suite = c.tryCipherSuite(id, supportedList, c.vers, true, true); hs.suite != nil {
+			break
+		}
+	}
+
+	if hs.suite == nil {
+		c.sendAlert(alertHandshakeFailure)
+		return errors.New("tls: no cipher suite supported by both client and server")
+	}
+
+	hs.hello.cipherSuite = hs.suite.id
+	if c.config.Bugs.SendCipherSuite != 0 {
+		hs.hello.cipherSuite = c.config.Bugs.SendCipherSuite
+	}
+
+	hs.finishedHash = newFinishedHash(c.vers, hs.suite)
+	hs.finishedHash.discardHandshakeBuffer()
+	hs.writeClientHash(hs.clientHello.marshal())
+
 	supportedCurve := false
 	var selectedCurve CurveID
 	preferredCurves := config.curvePreferences()
@@ -425,30 +455,16 @@
 				continue
 			}
 
-			if config.Bugs.AcceptAnySession {
-				// Replace the cipher suite with one known to work, to
-				// test cross-version resumption attempts.
-				sessionState.cipherSuite = TLS_AES_128_GCM_SHA256
-			} else {
+			if !config.Bugs.AcceptAnySession {
 				if sessionState.vers != c.vers {
 					continue
 				}
 				if sessionState.ticketExpiration.Before(c.config.time()) {
 					continue
 				}
-
-				cipherSuiteOk := false
-				// Check that the client is still offering the ciphersuite in the session.
-				for _, id := range hs.clientHello.cipherSuites {
-					if id == sessionState.cipherSuite {
-						cipherSuiteOk = true
-						break
-					}
-				}
-				if !cipherSuiteOk {
+				if sessionState.cipherSuite != hs.suite.id {
 					continue
 				}
-
 			}
 
 			clientTicketAge := time.Duration(uint32(pskIdentity.obfuscatedTicketAge-sessionState.ticketAgeAdd)) * time.Millisecond
@@ -457,14 +473,7 @@
 				return errors.New("tls: invalid ticket age")
 			}
 
-			// Check that we also support the ciphersuite from the session.
-			suite := c.tryCipherSuite(sessionState.cipherSuite, c.config.cipherSuites(), c.vers, true, true)
-			if suite == nil {
-				continue
-			}
-
 			hs.sessionState = sessionState
-			hs.suite = suite
 			hs.hello.hasPSKIdentity = true
 			hs.hello.pskIdentity = uint16(i)
 			pskIndex = i
@@ -490,38 +499,6 @@
 		}
 	}
 
-	// If not resuming, select the cipher suite.
-	if hs.suite == nil {
-		var preferenceList, supportedList []uint16
-		if config.PreferServerCipherSuites {
-			preferenceList = config.cipherSuites()
-			supportedList = hs.clientHello.cipherSuites
-		} else {
-			preferenceList = hs.clientHello.cipherSuites
-			supportedList = config.cipherSuites()
-		}
-
-		for _, id := range preferenceList {
-			if hs.suite = c.tryCipherSuite(id, supportedList, c.vers, true, true); hs.suite != nil {
-				break
-			}
-		}
-	}
-
-	if hs.suite == nil {
-		c.sendAlert(alertHandshakeFailure)
-		return errors.New("tls: no cipher suite supported by both client and server")
-	}
-
-	hs.hello.cipherSuite = hs.suite.id
-	if c.config.Bugs.SendCipherSuite != 0 {
-		hs.hello.cipherSuite = c.config.Bugs.SendCipherSuite
-	}
-
-	hs.finishedHash = newFinishedHash(c.vers, hs.suite)
-	hs.finishedHash.discardHandshakeBuffer()
-	hs.writeClientHash(hs.clientHello.marshal())
-
 	// Resolve PSK and compute the early secret.
 	var psk []byte
 	if hs.sessionState != nil {