Call SSL_get_negotiated_group not during read early data (#12224)

Recent versions of OpenSSL define SSL_CB_HANDSHAKE_DONE as follows:

> Callback has been called because a handshake is finished. It also
> occurs if the handshake is paused to allow the exchange of early data.

Calling SSL_get_negotiated_group duing early data situations was causing
a crash. This moves the calling of SSL_get_negotiated_group next to
_record_tls_handshake_end_time where it will reliably not be called in
the context of processing early data.

Fixes: #12140
(cherry picked from commit afbb1f5)

Author: bneradt

include/iocore/net/TLSBasicSupport.h

@@ -79,6 +79,7 @@ class TLSBasicSupport
 
   void _record_tls_handshake_begin_time();
   void _record_tls_handshake_end_time();
+  void _update_end_of_handshake_stats();
 
   /**
    * Implementation should schedule either TS_EVENT_SSL_VERIFY_SERVER or TS_EVENT_SSL_VERIFY_CLIENT accordingly.

src/iocore/net/QUICNetVConnection.cc

@@ -250,6 +250,7 @@ QUICNetVConnection::_switch_to_established_state()
 {
   QUICConDebug("Enter state_connection_established");
   this->_record_tls_handshake_end_time();
+  this->_update_end_of_handshake_stats();
   SET_HANDLER((NetVConnHandler)&QUICNetVConnection::state_established);
   this->_start_application();
   this->_handshake_completed = true;

src/iocore/net/SSLNetVConnection.cc

@@ -1321,7 +1321,7 @@ SSLNetVConnection::sslServerHandShakeEvent(int &err)
 
     if (this->get_tls_handshake_begin_time()) {
       this->_record_tls_handshake_end_time();
-      Metrics::Counter::increment(ssl_rsb.total_success_handshake_count_in);
+      this->_update_end_of_handshake_stats();
     }
 
     if (this->get_tunnel_type() != SNIRoutingType::NONE) {

src/iocore/net/SSLUtils.cc

@@ -1077,28 +1077,6 @@ ssl_callback_info(const SSL *ssl, int where, int ret)
       }
       Metrics::Counter::increment(it->second);
     }
-
-#if defined(OPENSSL_IS_BORINGSSL)
-    uint16_t group_id = SSL_get_group_id(ssl);
-    if (group_id != 0) {
-      const char *group_name = SSL_get_group_name(group_id);
-      if (auto it = tls_group_map.find(group_name); it != tls_group_map.end()) {
-        Metrics::Counter::increment(it->second);
-      } else {
-        Warning("Unknown TLS Group");
-      }
-    }
-#elif defined(SSL_get_negotiated_group)
-    int nid = SSL_get_negotiated_group(const_cast<SSL *>(ssl));
-    if (nid != NID_undef) {
-      if (auto it = tls_group_map.find(nid); it != tls_group_map.end()) {
-        Metrics::Counter::increment(it->second);
-      } else {
-        auto other = tls_group_map.find(SSL_GROUP_STAT_OTHER_KEY);
-        Metrics::Counter::increment(other->second);
-      }
-    }
-#endif // OPENSSL_IS_BORINGSSL or SSL_get_negotiated_group
   }
 }
 

src/iocore/net/TLSBasicSupport.cc

@@ -24,6 +24,9 @@
 
 #include "SSLStats.h"
 #include "iocore/net/TLSBasicSupport.h"
+#if defined(OPENSSL_IS_BORINGSSL)
+#include "tscore/Diags.h" // For Warning
+#endif                    // OPENSSL_IS_BORINGSSL
 #include "tsutil/DbgCtl.h"
 
 #include <cinttypes>
@@ -201,3 +204,33 @@ TLSBasicSupport::_record_tls_handshake_end_time()
   Dbg(dbg_ctl_ssl, "ssl handshake time:%" PRId64, ssl_handshake_time);
   Metrics::Counter::increment(ssl_rsb.total_handshake_time, ssl_handshake_time);
 }
+
+void
+TLSBasicSupport::_update_end_of_handshake_stats()
+{
+  Metrics::Counter::increment(ssl_rsb.total_success_handshake_count_in);
+
+#if defined(OPENSSL_IS_BORINGSSL)
+  SSL     *ssl      = this->_get_ssl_object();
+  uint16_t group_id = SSL_get_group_id(ssl);
+  if (group_id != 0) {
+    const char *group_name = SSL_get_group_name(group_id);
+    if (auto it = tls_group_map.find(group_name); it != tls_group_map.end()) {
+      Metrics::Counter::increment(it->second);
+    } else {
+      Warning("Unknown TLS Group");
+    }
+  }
+#elif defined(SSL_get_negotiated_group)
+  SSL *ssl = this->_get_ssl_object();
+  int  nid = SSL_get_negotiated_group(const_cast<SSL *>(ssl));
+  if (nid != NID_undef) {
+    if (auto it = tls_group_map.find(nid); it != tls_group_map.end()) {
+      Metrics::Counter::increment(it->second);
+    } else {
+      auto other = tls_group_map.find(SSL_GROUP_STAT_OTHER_KEY);
+      Metrics::Counter::increment(other->second);
+    }
+  }
+#endif // OPENSSL_IS_BORINGSSL or SSL_get_negotiated_group
+}