Fixes

neqo-transport/src/connection/mod.rs

@@ -1528,7 +1528,7 @@ impl Connection {
                 State::WaitVersion
             };
             self.set_state(new_state, now);
-            if self.role == Role::Server && new_state == State::Handshaking {
+            if self.role == Role::Server && self.state == State::Handshaking {
                 self.zero_rtt_state =
                     if self.crypto.enable_0rtt(self.version, self.role) == Ok(true) {
                         qdebug!("[{self}] Accepted 0-RTT");
@@ -2515,6 +2515,7 @@ impl Connection {
             }
 
             // If the client has more Initial CRYPTO data queued up, do not coalesce.
+            // FIXME: This is a temporary hack to avoid coalescing 0-RTT packets too early.
             if self.role == Role::Client
                 && *space == PacketNumberSpace::Initial
                 && !self.crypto.streams.is_empty(*space)

neqo-transport/src/crypto.rs

@@ -1527,10 +1527,9 @@ impl CryptoStreams {
         }
 
         let cs = self.get_mut(space).unwrap();
-        // Because the TLS extensions in the CRYPTO data are randomly ordered, if the CH is
-        // larger than fits into a single packet, depending on where the SNI is located, slicing and
-        // reordering it can cause the generation of discontiguous chunks. We need to loop here to
-        // make sure we fill the packets, and not send superfluous packets that are mostly padding.
+        // Sending fresh data will always fill a packet. However, when there are
+        // lost packets, the outstanding CRYPTO chunks might not be contiguous
+        // and packet-filling. So we need to loop.
         while let Some((offset, data)) = cs.tx.next_bytes() {
             let written = if sni_slicing {
                 if let Some(sni) = find_sni(data) {
@@ -1548,7 +1547,7 @@ impl CryptoStreams {
                     // the first Initial with the minimum amount of zeros to
                     // help middlebox traversal, so the second packets had more
                     // space for coalescing.
-                    let packets_needed = data.len() / builder.limit() + 1;
+                    let packets_needed = data.len().div_ceil(builder.limit());
                     if packets_needed > 1 {
                         builder.set_limit(data.len() / packets_needed);
                     }