[Server Padding] Don't pad on resumption handshake.

Resumption handshakes don't pass back certificates, so servers shouldn't
send back padding in these circumstances.

Change-Id: I88f2a27cb9c15927a52c529f83fc60846cf5db04
Bug: 509499093
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/95427
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: David Benjamin <davidben@google.com>

ssl/extensions.cc

diff --git a/ssl/extensions.cc b/ssl/extensions.cc
index 4f4965b..db1a291 100644
--- a/ssl/extensions.cc
+++ b/ssl/extensions.cc
@@ -2876,6 +2876,11 @@
     return true;
   }
 
+  // The extension shouldn't be sent when resuming sessions.
+  if (ssl->s3->session_reused) {
+    return true;
+  }
+
   // Limit max padding; if a client requests more than this, don't return any
   // padding.
   uint16_t padding_len = hs->client_requested_server_padding_size.value();

ssl/test/runner/handshake_client.go

diff --git a/ssl/test/runner/handshake_client.go b/ssl/test/runner/handshake_client.go
index bc36003..338ab58 100644
--- a/ssl/test/runner/handshake_client.go
+++ b/ssl/test/runner/handshake_client.go
@@ -2031,27 +2031,6 @@
 func (hs *clientHandshakeState) processServerExtensions(serverExtensions *serverExtensions) error {
 	c := hs.c
 
-	if serverExtensions.serverPadding != nil && c.vers.protocolVersion() < VersionTLS13 {
-		return errors.New("tls: server sent padding over non-TLS 1.3 connection")
-	}
-
-	if !c.config.Bugs.ExpectedServerPadding && serverExtensions.serverPadding != nil {
-		return errors.New("tls: server sent unexpected padding")
-	}
-
-	if c.config.Bugs.ExpectedServerPadding && serverExtensions.serverPadding == nil {
-		return fmt.Errorf("tls: server did not send padding, expected %d bytes",
-			*c.config.RequestServerPadding)
-	}
-
-	// We expected padding of a certain amount, and got some padding. Check that
-	// they match.
-	if c.config.Bugs.ExpectedServerPadding && serverExtensions.serverPadding != nil {
-		if *serverExtensions.serverPadding != *c.config.RequestServerPadding {
-			return fmt.Errorf("tls: server sent %d bytes of padding instead of %d bytes", *serverExtensions.serverPadding, *c.config.RequestServerPadding)
-		}
-	}
-
 	if c.vers.protocolVersion() < VersionTLS13 {
 		if c.config.Bugs.RequireRenegotiationInfo && serverExtensions.secureRenegotiation == nil {
 			return errors.New("tls: renegotiation extension missing")
@@ -2273,6 +2252,35 @@
 	}
 	c.clientCertificateType = serverExtensions.clientCertificateType
 
+	// Server padding should never be sent on resumption handshakes.
+	if serverExtensions.serverPadding != nil && isResume {
+		return errors.New("tls: server sent padding on a resumption handshake")
+	}
+
+	// If this isn't a resumption handshake, run server padding checks.
+	if !isResume {
+		if serverExtensions.serverPadding != nil && c.vers.protocolVersion() < VersionTLS13 {
+			return errors.New("tls: server sent padding over non-TLS 1.3 connection")
+		}
+
+		if !c.config.Bugs.ExpectedServerPadding && serverExtensions.serverPadding != nil {
+			return errors.New("tls: server sent unexpected padding")
+		}
+
+		if c.config.Bugs.ExpectedServerPadding && serverExtensions.serverPadding == nil {
+			return fmt.Errorf("tls: server did not send padding, expected %d bytes",
+				*c.config.RequestServerPadding)
+		}
+
+		// We expected padding of a certain amount, and got some padding. Check that
+		// they match.
+		if c.config.Bugs.ExpectedServerPadding && serverExtensions.serverPadding != nil {
+			if *serverExtensions.serverPadding != *c.config.RequestServerPadding {
+				return fmt.Errorf("tls: server sent %d bytes of padding instead of %d bytes", *serverExtensions.serverPadding, *c.config.RequestServerPadding)
+			}
+		}
+	}
+
 	return nil
 }
 

ssl/test/runner/server_padding_tests.go

diff --git a/ssl/test/runner/server_padding_tests.go b/ssl/test/runner/server_padding_tests.go
index f4de16e..a5b89f3 100644
--- a/ssl/test/runner/server_padding_tests.go
+++ b/ssl/test/runner/server_padding_tests.go
@@ -224,4 +224,22 @@
 			"-server-supports-padding",
 		},
 	})
+
+	// Runner requests padding, and then does a resumption handshake. Shim should
+	// send server padding on initial handshake, but not resumption handshake.
+	testCases = append(testCases, testCase{
+		name:          "ServerPaddingServer-ResumeSession",
+		testType:      serverTest,
+		resumeSession: true,
+		config: Config{
+			MinVersion:           VersionTLS13,
+			RequestServerPadding: ptrTo(uint16(10)),
+			Bugs: ProtocolBugs{
+				ExpectedServerPadding: true,
+			},
+		},
+		flags: []string{
+			"-server-supports-padding",
+		},
+	})
 }