All out of order read of epoch 0. Tests

conn_test.go

@@ -1636,3 +1636,54 @@ func TestEarlyIOFail(t *testing.T) {
 	readWriteExpectFail(t, client)
 	readWriteExpectFail(t, server)
 }
+
+func TestDTLSOutOfEpochHSFail(t *testing.T) {
+	cConn, sConn := pipe()
+
+	cbConn := newBufferedConn(cConn)
+	sbConn := newBufferedConn(sConn)
+	cbConn.SetAutoflush()
+	sbConn.SetAutoflush()
+
+	client := Client(cbConn, nbConfigDTLS)
+	server := Server(sbConn, nbConfigDTLS)
+
+	hsUntilBlocked(t, client, cbConn)
+	hsUntilBlocked(t, server, sbConn)
+
+	cbConn.Write([]byte{byte(RecordTypeApplicationData),
+		byte(dtls12WireVersion >> 8), byte(dtls12WireVersion & 0xff),
+		0, 0, 0, 0, 0, 0, 0, 0, // Epoch 0, seq 0
+		0, 5, 1, 2, 3, 4, 5, // Payload
+	})
+
+	// This causes an error because it's an unexpected record type.
+	err := server.Handshake()
+	assertEquals(t, err, AlertCloseNotify)
+}
+
+func TestDTLSOutOfEpochPostHSDiscard(t *testing.T) {
+	cConn, sConn := pipe()
+
+	cbConn := newBufferedConn(cConn)
+	sbConn := newBufferedConn(sConn)
+	cbConn.SetAutoflush()
+	sbConn.SetAutoflush()
+
+	client := Client(cbConn, pskDTLSConfig)
+	server := Server(sbConn, pskDTLSConfig)
+
+	hsRunHandshakeOneThread(t, client, server)
+
+	// Now inject something with epoch 0, but as app data.
+	// It will get discarded.
+	cbConn.Write([]byte{byte(RecordTypeApplicationData),
+		byte(dtls12WireVersion >> 8), byte(dtls12WireVersion & 0xff),
+		0, 0, 0, 0, 0, 0, 0, 0, // Epoch 0, seq 0
+		0, 5, 1, 2, 3, 4, 5, // Payload
+	})
+
+	tmp := make([]byte, 10)
+	_, err := server.Read(tmp)
+	assertEquals(t, err, AlertWouldBlock)
+}

record-layer.go

@@ -118,6 +118,7 @@ func NewRecordLayerDTLS(conn io.ReadWriter, dir direction) *RecordLayer {
 	r.frame = newFrameReader(recordLayerFrameDetails{true})
 	r.cipher = newCipherStateNull()
 	r.readCiphers = make(map[Epoch]*cipherState, 0)
+	r.readCiphers[0] = r.cipher
 	r.datagram = true
 	return &r
 }
@@ -368,14 +369,15 @@ func (r *RecordLayer) nextRecord(allowOldEpoch bool) (*TLSPlaintext, error) {
 
 		// Look up the cipher suite from the epoch
 		if epoch != cipher.epoch {
-			logf(logTypeIO, "%s Message from non-current epoch: [%v != %v]", r.label, epoch,
-				cipher.epoch)
+			logf(logTypeIO, "%s Message from non-current epoch: [%v != %v] out-of-epoch reads=%v", r.label, epoch,
+				cipher.epoch, allowOldEpoch)
 			if !allowOldEpoch {
 				return nil, AlertWouldBlock
 			}
 			c, ok := r.readCiphers[epoch]
 			if !ok {
 				logf(logTypeIO, "%s Message from unknown epoch: [%v]", r.label, epoch)
+				fmt.Println("Known epochs = ", r.readCiphers)
 				return nil, AlertWouldBlock
 			}
 			cipher = c