Reject protocol version changes after HelloRetryRequest

A ServerHello after HelloRetryRequest must retain TLS 1.3. Reject a
missing or changed supported_versions value before version negotiation,
so TLS 1.3-only clients also send illegal_parameter.

Reuse the existing BoGo cases and remove their alternate error mappings.

bogo/config.json.in

@@ -264,8 +264,6 @@
     "RenegotiationInfo-Forbidden-TLS13": ":UNEXPECTED_EXTENSION:",
     "RequestContextInHandshake-TLS13": ":BAD_HANDSHAKE_MSG:",
     "Resume-Client-Mismatch-TLS13-TLS12-TLS": ":WRONG_CIPHER_RETURNED:",
-    "SecondServerHelloNoVersion-TLS13": ":WRONG_CIPHER_RETURNED:",
-    "SecondServerHelloWrongVersion-TLS13": ":INCOMPATIBLE:",
     "SendBogusAlertType": ":BAD_ALERT:",
     "SendInvalidRecordType": ":GARBAGE:",
     "SendPostHandshakeChangeCipherSpec-TLS13": ":ILLEGAL_MIDDLEBOX_CHANGE_CIPHER_SPEC:",

bogo/src/main.rs

@@ -1008,6 +1008,9 @@ fn handle_err(opts: &Options, err: Error) -> ! {
         Error::PeerMisbehaved(PeerMisbehaved::SelectedDifferentCipherSuiteAfterRetry) => {
             quit(":SELECTED_DIFFERENT_CIPHERSUITE_AFTER_RETRY:")
         }
+        Error::PeerMisbehaved(PeerMisbehaved::SelectedDifferentProtocolVersionAfterRetry) => {
+            quit(":SECOND_SERVERHELLO_VERSION_MISMATCH:")
+        }
         Error::PeerMisbehaved(
             PeerMisbehaved::ResumptionAttemptedWithVariedEms
             | PeerMisbehaved::ResumptionOfferedWithVariedEms,

rustls/src/client/hs.rs

@@ -215,6 +215,11 @@ impl ExpectServerHello {
         )?;
         trace!("We got ServerHello {server_hello:#?}");
 
+        // HelloRetryRequest selected TLS 1.3, so ServerHello must retain it.
+        if self.done_retry && server_hello.selected_version != Some(ProtocolVersion::TLSv1_3) {
+            return Err(PeerMisbehaved::SelectedDifferentProtocolVersionAfterRetry.into());
+        }
+
         let config = &self.input.config;
 
         let server_version = if server_hello.legacy_version == ProtocolVersion::TLSv1_2 {

rustls/src/error/mod.rs

@@ -1224,6 +1224,7 @@ pub enum PeerMisbehaved {
     ResumptionOfferedWithVariedEms,
     ResumptionOfferedWithIncompatibleCipherSuite,
     SelectedDifferentCipherSuiteAfterRetry,
+    SelectedDifferentProtocolVersionAfterRetry,
     SelectedInvalidPsk,
     SelectedTls12UsingTls13VersionExtension,
     SelectedUnofferedApplicationProtocol,