Assert when combining session resume and HRR in QUIC

[huitema]

During the QUIC trial, I observed something strange. Several server allow testing the "stateless retry" function of QUIC. For TLS, that means:

       Client Hello -->
              <-- HRR (with Cookie)
       Client Hello with selected handshake and cookie -->
              <-- Server Hello, etc.

The strangeness happens when the client owns a Resume Ticket. We get:

       Client Hello  + Resume Ticket -->
              <-- HRR (with Cookie)
       Try to process HRR in client (ptls_handshake)
       Assert in "derive_exporter_secret(tls, is_early=1)", complains that *slot is NULL.

I ended up mitigating this with the following hack: set the "ticket" in handshake properties to "NULL" before calling ptls_handshake with the received HRR message.

[kazuho]

Do you see the issue after #119 being merged? #119 was opened and merged the same day.

[huitema]

I have to undo my mitigation in order to test...

[huitema]

Just did this test after removing the mitigation on the client. The connection worked fine:

1. Sent CH with "zero key shares" + session ticket;
2. Sent 0-RTT packet;
3. Received Stateless Retry (HRR)
4. Repeated CIient Initial (Client Hello)
5. Received Handshake packet with Server Hello, etc.

We are good, you can close the issue.

[kazuho]

I'm glad to hear that. Thank you for checking!