update regression test to better test when inRemaining == 0 and add on additional continuation bytes testing

Author: rlm2002

src/java/com/wolfssl/provider/jsse/WolfSSLEngine.java

@@ -110,6 +110,7 @@ public class WolfSSLEngine extends SSLEngine {
 
     /* session stored (WOLFSSL_SESSION), relevant on client side */
     private boolean sessionStored = false;
+    /* Skip record header peek in next unwrap, continue same TLS record */
     private boolean contPartialRecord = false;
 
     /* TLS 1.3 session ticket received (on client side) */

src/test/com/wolfssl/provider/jsse/test/WolfSSLEngineTest.java

@@ -3047,13 +3047,13 @@ public void testBufferUnderflowPartialRecord()
     }
 
     @Test
-    public void testHandshakeUnwrapConsumedNotBufferUnderflow()
+    public void testHandshakeUnwrapIncrementalStatus()
         throws NoSuchProviderException, NoSuchAlgorithmException,
                KeyManagementException, KeyStoreException,
                CertificateException, IOException,
                UnrecoverableKeyException {
 
-        System.out.print("\tTest unwrap consumed != BUFFER_UNDERFLOW");
+        System.out.print("\tTest unwrap incremental status");
 
         if (!enabledProtocols.contains("TLSv1.3")) {
             System.out.println("\t... skipped");
@@ -3127,42 +3127,108 @@ public void testHandshakeUnwrapConsumedNotBufferUnderflow()
         srvFlight.flip();
 
         int total = srvFlight.remaining();
-        if (total < 2) {
+        /* Parse first TLS record header to find exact boundary:
+         * type[1] + version[2] + length[2] = 5 bytes. */
+        if (total < 5) {
             error("\t... failed");
-            fail("server flight too small to split: " + total);
+            fail("server flight too small: " + total);
+        }
+        int firstRecPayload =
+            ((srvFlight.get(srvFlight.position() + 3) & 0xFF) << 8)
+            | (srvFlight.get(srvFlight.position() + 4) & 0xFF);
+        int firstRecordLen = 5 + firstRecPayload;
+        if (total < firstRecordLen) {
+            error("\t... failed");
+            fail("first TLS record exceeds server flight");
         }
 
-        /* Feed the first half of the server flight to
-         * client.unwrap(). wolfSSL will consume these bytes through
-         * the I/O callback, exhaust the buffer, and return
-         * SSL_ERROR_WANT_READ. With the fix, BUFFER_UNDERFLOW must
-         * NOT be set because inRemaining > 0 (data was provided). */
-        int half = total / 2;
-        byte[] halfBytes = new byte[half];
-        srvFlight.get(halfBytes);
-        ByteBuffer firstHalf = ByteBuffer.wrap(halfBytes);
+        /* Feed exactly the first TLS record to client.unwrap().
+         * Peek confirms it is complete, DoHandshake() runs,
+         * wolfSSL consumes all bytes and returns WANT_READ. */
+        byte[] firstRecBytes = new byte[firstRecordLen];
+        srvFlight.get(firstRecBytes);
+        ByteBuffer firstRecord = ByteBuffer.wrap(firstRecBytes);
 
         ByteBuffer cliAppBuf =
             ByteBuffer.allocateDirect(appBufSize);
-        result = client.unwrap(firstHalf, cliAppBuf);
+        result = client.unwrap(firstRecord, cliAppBuf);
 
-        /* BUFFER_UNDERFLOW must not be returned when input was
-         * consumed - regression for inRemaining == 0 guard fix */
-        if (result.getStatus() ==
-                SSLEngineResult.Status.BUFFER_UNDERFLOW) {
+        /* wolfSSL processed first record but needs more data:
+         * status must be OK, not BUFFER_UNDERFLOW. */
+        if (result.getStatus() != SSLEngineResult.Status.OK) {
             error("\t... failed");
-            fail("unwrap() with consumed handshake data must not " +
-                 "return BUFFER_UNDERFLOW (regression: inRemaining" +
-                 " == 0 guard), bytesConsumed=" +
-                 result.bytesConsumed());
+            fail("expected Status.OK, got: " +
+                 result.getStatus());
         }
 
-        /* Input was non-empty so at least some bytes must have
-         * been consumed */
-        if (result.bytesConsumed() == 0) {
+        /* Handshake needs more data to continue. */
+        if (result.getHandshakeStatus() !=
+                SSLEngineResult.HandshakeStatus.NEED_UNWRAP) {
             error("\t... failed");
-            fail("unwrap() consumed 0 bytes from a non-empty " +
-                 "handshake buffer");
+            fail("expected NEED_UNWRAP, got: " +
+                 result.getHandshakeStatus());
+        }
+
+        /* All bytes consumed via I/O callback. */
+        if (result.bytesConsumed() != firstRecordLen) {
+            error("\t... failed");
+            fail("expected " + firstRecordLen + " bytes " +
+                 "consumed, got: " + result.bytesConsumed());
+        }
+
+        /* No application data produced during handshake. */
+        if (result.bytesProduced() != 0) {
+            error("\t... failed");
+            fail("expected 0 bytes produced, got: " +
+                 result.bytesProduced());
+        }
+
+        /*
+         * The first unwrap set contPartialRecord=true because wolfSSL
+         * exhausted firstRecord and returned WANT_READ. On this call,
+         * peek is skipped and DoHandshake() receives raw continuation
+         * bytes. inRemaining > 0 must suppress BUFFER_UNDERFLOW. */
+        int contLen = Math.min(3, srvFlight.remaining());
+        if (contLen > 0) {
+            byte[] contBytes = new byte[contLen];
+            srvFlight.get(contBytes);
+            ByteBuffer contBuf = ByteBuffer.wrap(contBytes);
+            ByteBuffer cliAppBuf2 =
+                ByteBuffer.allocateDirect(appBufSize);
+            result = client.unwrap(contBuf, cliAppBuf2);
+
+            /* wolfSSL consumed continuation bytes, needs more:
+             * must be Status.OK, not BUFFER_UNDERFLOW. */
+            if (result.getStatus() !=
+                    SSLEngineResult.Status.OK) {
+                error("\t... failed");
+                fail("expected Status.OK for continuation " +
+                     "bytes, got: " + result.getStatus());
+            }
+
+            /* Handshake still needs more data. */
+            if (result.getHandshakeStatus() !=
+                    SSLEngineResult.HandshakeStatus.NEED_UNWRAP) {
+                error("\t... failed");
+                fail("expected NEED_UNWRAP for continuation " +
+                     "bytes, got: " +
+                     result.getHandshakeStatus());
+            }
+
+            /* All continuation bytes consumed. */
+            if (result.bytesConsumed() != contLen) {
+                error("\t... failed");
+                fail("expected " + contLen + " continuation " +
+                     "bytes consumed, got: " +
+                     result.bytesConsumed());
+            }
+
+            /* No application data produced. */
+            if (result.bytesProduced() != 0) {
+                error("\t... failed");
+                fail("expected 0 bytes produced, got: " +
+                     result.bytesProduced());
+            }
         }
 
         pass("\t... passed");