luna - wolfssl/tests/quic.c

   1/* quic.c QUIC unit tests
   2 *
   3 * Copyright (C) 2006-2026 wolfSSL Inc.
   4 *
   5 * This file is part of wolfSSL.
   6 *
   7 * wolfSSL is free software; you can redistribute it and/or modify
   8 * it under the terms of the GNU General Public License as published by
   9 * the Free Software Foundation; either version 3 of the License, or
  10 * (at your option) any later version.
  11 *
  12 * wolfSSL is distributed in the hope that it will be useful,
  13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15 * GNU General Public License for more details.
  16 *
  17 * You should have received a copy of the GNU General Public License
  18 * along with this program; if not, write to the Free Software
  19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
  20 */
  21
  22#include <tests/unit.h>
  23
  24#ifdef WOLFSSL_QUIC
  25
  26#include <wolfssl/ssl.h>
  27#include <wolfssl/quic.h>
  28#ifdef NO_INLINE
  29    #include <wolfssl/wolfcrypt/misc.h>
  30#else
  31    #define WOLFSSL_MISC_INCLUDED
  32    #include <wolfcrypt/src/misc.c>
  33#endif
  34#include <wolfssl/error-ssl.h>
  35#include <wolfssl/internal.h>
  36
  37#if defined(WOLFSSL_SHA384) && defined(WOLFSSL_AES_256)
  38    #define DEFAULT_TLS_DIGEST_SZ WC_SHA384_DIGEST_SIZE
  39#else
  40    #define DEFAULT_TLS_DIGEST_SZ WC_SHA256_DIGEST_SIZE
  41#endif
  42
  43#define testingFmt "   %s:"
  44#define resultFmt  " %s\n"
  45static const char* pass = "pass";
  46static const char* fail = "fail";
  47
  48typedef struct {
  49    const char *name;
  50    WOLFSSL_METHOD * (*method)(void);
  51    int is_server;
  52} ctx_setups;
  53
  54static int dummy_set_encryption_secrets(WOLFSSL *ssl,
  55                                        WOLFSSL_ENCRYPTION_LEVEL level,
  56                                        const uint8_t *read_secret,
  57                                        const uint8_t *write_secret,
  58                                        size_t secret_len)
  59{
  60    (void)ssl;
  61    printf("QUIC_set_encryption_secrets(level=%d, length=%d, rx=%s, tx=%s)\n",
  62           level, (int)secret_len, read_secret? "yes" : "no",
  63           write_secret? "yes" : "no");
  64    return 1;
  65}
  66
  67#if !defined(NO_WOLFSSL_CLIENT) && !defined(NO_WOLFSSL_SERVER)
  68static int dummy_set_encryption_secrets_fail(WOLFSSL *ssl,
  69                                             WOLFSSL_ENCRYPTION_LEVEL level,
  70                                             const uint8_t *read_secret,
  71                                             const uint8_t *write_secret,
  72                                             size_t secret_len)
  73{
  74    (void)ssl;
  75    printf("QUIC_set_encryption_secrets(level=%d, length=%d, rx=%s, tx=%s)\n",
  76           level, (int)secret_len, read_secret? "yes" : "no",
  77           write_secret? "yes" : "no");
  78    return 0;
  79}
  80#endif
  81
  82static int dummy_add_handshake_data(WOLFSSL *ssl,
  83                                    WOLFSSL_ENCRYPTION_LEVEL level,
  84                                    const uint8_t *data, size_t len)
  85{
  86    (void)ssl;
  87    (void)data;
  88    printf("QUIC_add_handshake_data(level=%d, length=%d)\n", level, (int)len);
  89    return 1;
  90}
  91
  92static int dummy_flush_flight(WOLFSSL *ssl)
  93{
  94    (void)ssl;
  95    printf("QUIC_flush_flight()\n");
  96    return 1;
  97}
  98
  99static int dummy_send_alert(WOLFSSL *ssl, WOLFSSL_ENCRYPTION_LEVEL level,
 100                            uint8_t err)
 101{
 102    (void)ssl;
 103    printf("QUIC_send_alert(level=%d, err=%d)\n", level, err);
 104    return 1;
 105}
 106
 107static WOLFSSL_QUIC_METHOD dummy_method = {
 108    dummy_set_encryption_secrets,
 109    dummy_add_handshake_data,
 110    dummy_flush_flight,
 111    dummy_send_alert,
 112};
 113
 114static WOLFSSL_QUIC_METHOD null_method = {
 115    NULL, NULL, NULL, NULL
 116};
 117
 118static ctx_setups valids[] = {
 119#ifdef WOLFSSL_TLS13
 120#ifndef NO_WOLFSSL_SERVER
 121    { "TLSv1.3 server", wolfTLSv1_3_server_method, 1},
 122#endif
 123#ifndef NO_WOLFSSL_CLIENT
 124    { "TLSv1.3 client", wolfTLSv1_3_client_method, 0},
 125#endif
 126#endif
 127    { NULL, NULL, 0}
 128};
 129
 130static ctx_setups invalids[] = {
 131#ifndef WOLFSSL_NO_TLS12
 132#ifndef NO_WOLFSSL_SERVER
 133    { "TLSv1.2 server", wolfTLSv1_2_server_method, 1},
 134#endif
 135#ifndef NO_WOLFSSL_CLIENT
 136    { "TLSv1.2 client", wolfTLSv1_2_client_method, 0},
 137#endif
 138#endif
 139#ifndef NO_OLD_TLS
 140#ifndef NO_WOLFSSL_SERVER
 141    { "TLSv1.1 server", wolfTLSv1_1_server_method, 1},
 142#endif
 143#ifndef NO_WOLFSSL_CLIENT
 144    { "TLSv1.1 client", wolfTLSv1_1_client_method, 0},
 145#endif
 146#endif
 147    { NULL, NULL, 0}
 148};
 149
 150
 151static int test_set_quic_method(void) {
 152    EXPECT_DECLS;
 153    WOLFSSL_CTX *   ctx = NULL;
 154    WOLFSSL *       ssl = NULL;
 155    int             i = 0;
 156    const uint8_t * data = NULL;
 157    size_t          data_len = 0;;
 158
 159    for (i = 0; valids[i].name != NULL; ++i) {
 160        ExpectNotNull(ctx = wolfSSL_CTX_new(valids[i].method()));
 161        if (ctx == NULL) {
 162            break;
 163        }
 164        if (valids[i].is_server) {
 165            ExpectTrue(wolfSSL_CTX_use_certificate_file(ctx, svrCertFile,
 166                                                        WOLFSSL_FILETYPE_PEM));
 167            ExpectTrue(wolfSSL_CTX_use_PrivateKey_file(ctx, svrKeyFile,
 168                                                       WOLFSSL_FILETYPE_PEM));
 169        }
 170        /* ctx does not have quic enabled, so will SSL* derived from it */
 171        ExpectNotNull(ssl = wolfSSL_new(ctx));
 172        if (ssl == NULL) {
 173            break;
 174        }
 175        ExpectFalse(wolfSSL_is_quic(ssl));
 176        /* Enable quic on the SSL* */
 177        ExpectFalse(wolfSSL_set_quic_method(ssl, &null_method) == WOLFSSL_SUCCESS);
 178        ExpectTrue(wolfSSL_set_quic_method(ssl, &dummy_method) == WOLFSSL_SUCCESS);
 179        ExpectTrue(wolfSSL_is_quic(ssl));
 180        /* Check some default, initial behaviour */
 181        ExpectTrue(wolfSSL_set_quic_transport_params(ssl, NULL, 0) == WOLFSSL_SUCCESS);
 182        wolfSSL_get_peer_quic_transport_params(ssl, &data, &data_len);
 183        ExpectNull(data);
 184        ExpectTrue(data_len == 0);
 185        ExpectTrue(wolfSSL_quic_read_level(ssl) == wolfssl_encryption_initial);
 186        ExpectTrue(wolfSSL_quic_write_level(ssl) == wolfssl_encryption_initial);
 187        ExpectTrue(wolfSSL_get_quic_transport_version(ssl) == 0);
 188        wolfSSL_set_quic_transport_version(ssl, TLSX_KEY_QUIC_TP_PARAMS);
 189        ExpectTrue(wolfSSL_get_quic_transport_version(ssl) == TLSX_KEY_QUIC_TP_PARAMS);
 190        wolfSSL_set_quic_use_legacy_codepoint(ssl, 1);
 191        ExpectTrue(wolfSSL_get_quic_transport_version(ssl) == TLSX_KEY_QUIC_TP_PARAMS_DRAFT);
 192        wolfSSL_set_quic_use_legacy_codepoint(ssl, 0);
 193        ExpectTrue(wolfSSL_get_quic_transport_version(ssl) == TLSX_KEY_QUIC_TP_PARAMS);
 194        /* max flight len during stages of handhshake, we us 16k initial and on
 195         * app data, and during handshake allow larger for cert exchange. This is
 196         * more advisory for the network code. ngtcp2 has its own ideas, for example.
 197         */
 198        data_len = wolfSSL_quic_max_handshake_flight_len(ssl, wolfssl_encryption_initial);
 199        ExpectTrue(data_len == 16*1024);
 200        data_len = wolfSSL_quic_max_handshake_flight_len(ssl, wolfssl_encryption_early_data);
 201        ExpectTrue(data_len == 0);
 202        data_len = wolfSSL_quic_max_handshake_flight_len(ssl, wolfssl_encryption_handshake);
 203        ExpectTrue(data_len >= 16*1024);
 204        data_len = wolfSSL_quic_max_handshake_flight_len(ssl, wolfssl_encryption_application);
 205        ExpectTrue(data_len == 16*1024);
 206        wolfSSL_free(ssl);
 207        ssl = NULL;
 208        /* Enabled quic on the ctx */
 209        ExpectTrue(wolfSSL_CTX_set_quic_method(ctx, &dummy_method) == WOLFSSL_SUCCESS);
 210        /* It will be enabled on the SSL* */
 211        ExpectNotNull(ssl = wolfSSL_new(ctx));
 212        if (ssl == NULL) {
 213            break;
 214        }
 215        ExpectTrue(wolfSSL_is_quic(ssl));
 216        wolfSSL_free(ssl);
 217        ssl = NULL;
 218        wolfSSL_CTX_free(ctx);
 219        ctx = NULL;
 220    }
 221
 222    for (i = 0; invalids[i].name != NULL; ++i) {
 223        ExpectNotNull(ctx = wolfSSL_CTX_new(invalids[i].method()));
 224        if (ctx == NULL) {
 225            break;
 226        }
 227        ExpectTrue(wolfSSL_CTX_use_certificate_file(ctx, svrCertFile,
 228                                                    WOLFSSL_FILETYPE_PEM));
 229        ExpectTrue(wolfSSL_CTX_use_PrivateKey_file(ctx, svrKeyFile,
 230                                                   WOLFSSL_FILETYPE_PEM));
 231        ExpectFalse(wolfSSL_CTX_set_quic_method(ctx, &dummy_method) == WOLFSSL_SUCCESS);
 232        ExpectNotNull(ssl = wolfSSL_new(ctx));
 233        if (ssl == NULL) {
 234            break;
 235        }
 236        ExpectFalse(wolfSSL_set_quic_method(ssl, &dummy_method) == WOLFSSL_SUCCESS);
 237        ExpectFalse(wolfSSL_is_quic(ssl));
 238        /* even though not quic, this is the only level we can return */
 239        ExpectTrue(wolfSSL_quic_read_level(ssl) == wolfssl_encryption_initial);
 240        ExpectTrue(wolfSSL_quic_write_level(ssl) == wolfssl_encryption_initial);
 241        wolfSSL_free(ssl);
 242        ssl = NULL;
 243        wolfSSL_CTX_free(ctx);
 244        ctx = NULL;
 245    }
 246
 247    /* cleanup */
 248    if (ssl != NULL) {
 249        wolfSSL_free(ssl);
 250        ssl = NULL;
 251    }
 252    if (ctx != NULL) {
 253        wolfSSL_CTX_free(ctx);
 254        ctx = NULL;
 255    }
 256
 257    printf("    test_set_quic_method: %s\n", (EXPECT_SUCCESS()) ? pass : fail);
 258    return EXPECT_RESULT();
 259}
 260
 261#if !defined(NO_WOLFSSL_CLIENT)
 262static void dump_buffer(const char *name, const byte *p, size_t len, int indent)
 263{
 264    size_t i = 0;
 265
 266    printf("%s[%d] = {", name, (int)len);
 267    while((p != NULL) && (i < len)) {
 268        if((i % 0x10) == 0) {
 269            printf("\n");
 270            printf("%*s  %04X - ", indent, " ", (int)i);
 271        }
 272        else if((i % 0x08) == 0) {
 273            printf("  ");
 274        }
 275        printf("%02X ", p[i]);
 276        i++;
 277    }
 278    printf("\n%*s};\n", indent, " ");
 279}
 280#endif
 281
 282#ifndef NO_WOLFSSL_CLIENT
 283static size_t fake_record(byte rtype, word32 rlen, uint8_t *rec)
 284{
 285    rec[0] = (uint8_t)rtype;
 286    c32to24(rlen, rec+1);
 287    return rlen + 4;
 288}
 289
 290static size_t shift_record(uint8_t *rec, size_t len, size_t written)
 291{
 292    len -= written;
 293    XMEMMOVE(rec, rec+written, len);
 294    return len;
 295}
 296
 297static void dump_ssl_buffers(WOLFSSL *ssl, FILE *fp)
 298{
 299    QuicRecord *qr = ssl->quic.input_head;
 300
 301    fprintf(fp, "SSL quic data buffered: \n");
 302    while (qr) {
 303        fprintf(fp, "  - %d-%d/%d (cap %d, level=%d)\n",
 304                qr->start, qr->end, qr->len, qr->capacity, qr->level);
 305        qr = qr->next;
 306    }
 307    if ((qr = ssl->quic.scratch)) {
 308        fprintf(fp, "  scratch: %d-%d/%d (cap %d, level=%d)\n",
 309                qr->start, qr->end, qr->len, qr->capacity, qr->level);
 310    }
 311    else {
 312        fprintf(fp, "  scratch: -\n");
 313    }
 314}
 315
 316static int provide_data(WOLFSSL *ssl, WOLFSSL_ENCRYPTION_LEVEL level,
 317                        const uint8_t *data, size_t len, int excpect_fail)
 318{
 319    int ret;
 320
 321    ret = (wolfSSL_provide_quic_data(ssl, level, data, len) == WOLFSSL_SUCCESS);
 322    if (!!ret != !excpect_fail) {
 323        dump_ssl_buffers(ssl, stdout);
 324        return 0;
 325    }
 326    return 1;
 327}
 328
 329static int test_provide_quic_data(void) {
 330    EXPECT_DECLS;
 331    WOLFSSL_CTX * ctx = NULL;
 332    WOLFSSL *     ssl = NULL;
 333    uint8_t       lbuffer[16*1024];
 334    size_t        len = 0;
 335
 336    XMEMSET(lbuffer, 0, sizeof(lbuffer));
 337
 338    ExpectNotNull(ctx = wolfSSL_CTX_new(wolfTLSv1_3_client_method()));
 339    ExpectTrue(wolfSSL_CTX_set_quic_method(ctx, &dummy_method) == WOLFSSL_SUCCESS);
 340    /* provide_quic_data() feeds CRYPTO packets inside a QUIC Frame into
 341    * the TLSv1.3 state machine.
 342     * The data fed is not the QUIC frame, but the TLS record inside it.
 343     * This may be called several times before SSL_do_handshake() is invoked
 344     * to process them.
 345     * During buffering this data, the code checks that:
 346     * - encryption level only ever increases for subsequent TLS records
 347     * - a TLS record is received complete before the encryption level increases
 348     */
 349    ExpectNotNull(ssl = wolfSSL_new(ctx));
 350    len = fake_record(1, 100, lbuffer);
 351    ExpectTrue(provide_data(ssl, wolfssl_encryption_initial, lbuffer, 1, 0));
 352    ExpectTrue(provide_data(ssl, wolfssl_encryption_initial, lbuffer+1, 3, 0));
 353    ExpectTrue(provide_data(ssl, wolfssl_encryption_initial, lbuffer+4, len, 0)
 354            );
 355    len = fake_record(2, 1523, lbuffer);
 356    ExpectTrue(provide_data(ssl, wolfssl_encryption_handshake, lbuffer, len, 0));
 357    len = fake_record(2, 1, lbuffer);
 358    len += fake_record(3, 190, lbuffer+len);
 359    ExpectTrue(provide_data(ssl, wolfssl_encryption_handshake, lbuffer, len, 0));
 360    len = fake_record(5, 2049, lbuffer);
 361    ExpectTrue(provide_data(ssl, wolfssl_encryption_application, lbuffer, len, 0));
 362    /* adding another record with decreased level must fail */
 363    len = fake_record(1, 100, lbuffer);
 364    ExpectTrue(provide_data(ssl, wolfssl_encryption_initial, lbuffer, len, 1));
 365    wolfSSL_free(ssl);
 366    ssl = NULL;
 367
 368    ExpectNotNull(ssl = wolfSSL_new(ctx));
 369    len = fake_record(1, 100, lbuffer);
 370    ExpectTrue(provide_data(ssl, wolfssl_encryption_initial, lbuffer, 24, 0));
 371    len = shift_record(lbuffer, len, 24);
 372    len += fake_record(2, 4000, lbuffer+len);
 373    ExpectTrue(provide_data(ssl, wolfssl_encryption_initial, lbuffer, len - 99, 0));
 374    len = shift_record(lbuffer, len, len - 99);
 375    len += fake_record(5, 2049, lbuffer+len);
 376    ExpectTrue(provide_data(ssl, wolfssl_encryption_initial, lbuffer, len, 0));
 377    /* should be recognized as complete and level increase needs to be accepted */
 378    len = fake_record(2, 1, lbuffer);
 379    len += fake_record(3, 190, lbuffer+len);
 380    ExpectTrue(provide_data(ssl, wolfssl_encryption_handshake, lbuffer, len - 10, 0));
 381    len = shift_record(lbuffer, len, len - 10);
 382    /* Change level with incomplete record in lbuffer, needs to fail */
 383    len += fake_record(5, 8102, lbuffer+len);
 384    ExpectTrue(provide_data(ssl, wolfssl_encryption_application, lbuffer, len - 10, 1));
 385    wolfSSL_free(ssl);
 386
 387    wolfSSL_CTX_free(ctx);
 388
 389    printf("    test_provide_quic_data: %s\n", (EXPECT_SUCCESS()) ? pass : fail);
 390    return EXPECT_RESULT();
 391}
 392
 393static int test_quic_record_cap(void) {
 394    EXPECT_DECLS;
 395    WOLFSSL_CTX * ctx = NULL;
 396    WOLFSSL *     ssl = NULL;
 397    size_t        over = (size_t)WOLFSSL_QUIC_MAX_RECORD_CAPACITY + 512U * 1024U;
 398    uint8_t *     buf = NULL;
 399    uint8_t       hdr[4];
 400    word32        rlen;
 401
 402    ExpectNotNull(buf = (uint8_t*)XMALLOC(over, NULL, DYNAMIC_TYPE_TMP_BUFFER));
 403    if (buf != NULL)
 404        XMEMSET(buf, 0, over);
 405
 406    ExpectNotNull(ctx = wolfSSL_CTX_new(wolfTLSv1_3_client_method()));
 407    ExpectTrue(wolfSSL_CTX_set_quic_method(ctx, &dummy_method) == WOLFSSL_SUCCESS);
 408
 409    /* early_data with over-cap length must be rejected */
 410    ExpectNotNull(ssl = wolfSSL_new(ctx));
 411    ExpectTrue(provide_data(ssl, wolfssl_encryption_early_data, buf, over, 1));
 412    wolfSSL_free(ssl);
 413    ssl = NULL;
 414
 415    /* early_data at exactly cap must succeed */
 416    ExpectNotNull(ssl = wolfSSL_new(ctx));
 417    ExpectTrue(provide_data(ssl, wolfssl_encryption_early_data, buf,
 418                            WOLFSSL_QUIC_MAX_RECORD_CAPACITY, 0));
 419    wolfSSL_free(ssl);
 420    ssl = NULL;
 421
 422    /* early_data at cap+1 must be rejected */
 423    ExpectNotNull(ssl = wolfSSL_new(ctx));
 424    ExpectTrue(provide_data(ssl, wolfssl_encryption_early_data, buf,
 425                            (size_t)WOLFSSL_QUIC_MAX_RECORD_CAPACITY + 1U, 1));
 426    wolfSSL_free(ssl);
 427    ssl = NULL;
 428
 429    /* early_data well within cap must succeed */
 430    ExpectNotNull(ssl = wolfSSL_new(ctx));
 431    ExpectTrue(provide_data(ssl, wolfssl_encryption_early_data, buf, 1024, 0));
 432    wolfSSL_free(ssl);
 433    ssl = NULL;
 434
 435    /* handshake with over-cap record header must also be rejected */
 436    rlen = (word32)WOLFSSL_QUIC_MAX_RECORD_CAPACITY + 16U - 4U;
 437    hdr[0] = 0x16;
 438    hdr[1] = (byte)(rlen >> 16);
 439    hdr[2] = (byte)(rlen >> 8);
 440    hdr[3] = (byte)rlen;
 441    ExpectNotNull(ssl = wolfSSL_new(ctx));
 442    ExpectTrue(provide_data(ssl, wolfssl_encryption_handshake, hdr, 4, 1));
 443    wolfSSL_free(ssl);
 444
 445    wolfSSL_CTX_free(ctx);
 446    if (buf != NULL)
 447        XFREE(buf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 448
 449    printf("    test_quic_record_cap: %s\n", (EXPECT_SUCCESS()) ? pass : fail);
 450    return EXPECT_RESULT();
 451}
 452
 453static int test_quic_crypt(void) {
 454    EXPECT_DECLS;
 455    WOLFSSL_CTX * ctx = NULL;
 456    WOLFSSL *     ssl = NULL;
 457    const WOLFSSL_EVP_CIPHER * aead_cipher = NULL;
 458    /* check that our enc-/decrypt support in quic rount-trips */
 459    static const uint8_t key[16] =
 460    {0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77,
 461     0x88, 0x99, 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff};
 462    static const uint8_t aad[] =
 463    {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19};
 464    static const uint8_t iv[] =
 465    {20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31};
 466    static const uint8_t plaintext[] =
 467    "hello world\nhello world\nhello world\nhello world\nhello world\n"
 468    "hello world\nhello world\n";
 469    static const uint8_t expected[] =
 470    {0xd3, 0xa8, 0x1d, 0x96, 0x4c, 0x9b, 0x02, 0xd7,
 471     0x9a, 0xb0, 0x41, 0x07, 0x4c, 0x8c, 0xe2, 0xe0,
 472     0x2e, 0x83, 0x54, 0x52, 0x45, 0xcb, 0xd4, 0x68,
 473     0xc8, 0x43, 0x45, 0xca, 0x91, 0xfb, 0xa3, 0x7a,
 474     0x67, 0xed, 0xe8, 0xd7, 0x5e, 0xe2, 0x33, 0xd1,
 475     0x3e, 0xbf, 0x50, 0xc2, 0x4b, 0x86, 0x83, 0x55,
 476     0x11, 0xbb, 0x17, 0x4f, 0xf5, 0x78, 0xb8, 0x65,
 477     0xeb, 0x9a, 0x2b, 0x8f, 0x77, 0x08, 0xa9, 0x60,
 478     0x17, 0x73, 0xc5, 0x07, 0xf3, 0x04, 0xc9, 0x3f,
 479     0x67, 0x4d, 0x12, 0xa1, 0x02, 0x93, 0xc2, 0x3c,
 480     0xd3, 0xf8, 0x59, 0x33, 0xd5, 0x01, 0xc3, 0xbb,
 481     0xaa, 0xe6, 0x3f, 0xbb, 0x23, 0x66, 0x94, 0x26,
 482     0x28, 0x43, 0xa5, 0xfd, 0x2f};
 483    WOLFSSL_EVP_CIPHER_CTX * enc_ctx = NULL;
 484    WOLFSSL_EVP_CIPHER_CTX * dec_ctx = NULL;
 485    uint8_t * encrypted = NULL;
 486    uint8_t * decrypted = NULL;
 487    size_t tag_len = 0;
 488    size_t enc_len = 0;
 489    size_t dec_len = 0;
 490
 491    ExpectNotNull(ctx = wolfSSL_CTX_new(wolfTLSv1_3_client_method()));
 492    ExpectTrue(wolfSSL_CTX_set_quic_method(ctx, &dummy_method) == WOLFSSL_SUCCESS);
 493    ExpectNotNull(ssl = wolfSSL_new(ctx));
 494
 495    /* don't have an AEAD cipher selected before start */
 496    ExpectTrue(wolfSSL_CIPHER_get_id(wolfSSL_get_current_cipher(ssl)) == 0);
 497    ExpectNotNull(aead_cipher = wolfSSL_EVP_aes_128_gcm());
 498    ExpectTrue(wolfSSL_quic_aead_is_gcm(aead_cipher) != 0);
 499    ExpectTrue(wolfSSL_quic_aead_is_ccm(aead_cipher) == 0);
 500    ExpectTrue(wolfSSL_quic_aead_is_chacha20(aead_cipher) == 0);
 501
 502    tag_len = wolfSSL_quic_get_aead_tag_len(aead_cipher);
 503    ExpectTrue(tag_len == 16);
 504    dec_len = sizeof(plaintext);
 505    enc_len = dec_len + tag_len;
 506    encrypted = (uint8_t*)XMALLOC(enc_len, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 507    ExpectNotNull(encrypted);
 508    decrypted = (uint8_t*)XMALLOC(dec_len, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 509    ExpectNotNull(decrypted);
 510
 511    ExpectNotNull(enc_ctx = wolfSSL_quic_crypt_new(aead_cipher, key, iv, 1));
 512    ExpectTrue(wolfSSL_quic_aead_encrypt(encrypted, enc_ctx,
 513                                         plaintext, sizeof(plaintext),
 514                                         NULL, aad, sizeof(aad)) == WOLFSSL_SUCCESS);
 515    ExpectTrue(memcmp(expected, encrypted, dec_len) == 0);
 516    ExpectTrue(memcmp(expected+dec_len, encrypted+dec_len, tag_len) == 0);
 517
 518    ExpectNotNull(dec_ctx = wolfSSL_quic_crypt_new(aead_cipher, key, iv, 0));
 519    ExpectTrue(wolfSSL_quic_aead_decrypt(decrypted, dec_ctx,
 520                                         encrypted, enc_len,
 521                                         NULL, aad, sizeof(aad)) == WOLFSSL_SUCCESS);
 522    ExpectTrue(memcmp(plaintext, decrypted, dec_len) == 0);
 523
 524    XFREE(encrypted, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 525    XFREE(decrypted, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 526    wolfSSL_EVP_CIPHER_CTX_free(enc_ctx);
 527    wolfSSL_EVP_CIPHER_CTX_free(dec_ctx);
 528
 529    wolfSSL_free(ssl);
 530    wolfSSL_CTX_free(ctx);
 531    printf("    test_quic_crypt: %s\n", (EXPECT_SUCCESS()) ? pass : fail);
 532    return EXPECT_RESULT();
 533}
 534
 535typedef struct OutputBuffer {
 536    byte data[64*1024];
 537    size_t len;
 538    WOLFSSL_ENCRYPTION_LEVEL level;
 539    struct OutputBuffer *next;
 540} OutputBuffer;
 541
 542typedef struct {
 543    const char *name;
 544    WOLFSSL *ssl;
 545    OutputBuffer output;
 546    byte rx_secret[4][1024];
 547    size_t rx_secret_len[4];
 548    byte tx_secret[4][1024];
 549    size_t tx_secret_len[4];
 550    int handshake_done;
 551    int alert_level;
 552    int alert;
 553    int flushed;
 554    int verbose;
 555    byte ticket[16*1024];
 556    word32 ticket_len;
 557    byte session[16*1024];
 558    word32 session_len;
 559} QuicTestContext;
 560
 561static int ctx_set_encryption_secrets(WOLFSSL *ssl,
 562                                      WOLFSSL_ENCRYPTION_LEVEL level,
 563                                      const uint8_t *read_secret,
 564                                      const uint8_t *write_secret,
 565                                      size_t secret_len);
 566static int ctx_add_handshake_data(WOLFSSL *ssl, WOLFSSL_ENCRYPTION_LEVEL level,
 567                                  const uint8_t *data, size_t len);
 568static int ctx_flush_flight(WOLFSSL *ssl);
 569static int ctx_send_alert(WOLFSSL *ssl, WOLFSSL_ENCRYPTION_LEVEL level,
 570                          uint8_t err);
 571#ifdef HAVE_SESSION_TICKET
 572static int ctx_session_ticket_cb(WOLFSSL* ssl,
 573                                 const unsigned char* ticket, int ticketSz,
 574                                 void* cb_ctx);
 575#endif
 576
 577static WOLFSSL_QUIC_METHOD ctx_method = {
 578    ctx_set_encryption_secrets,
 579    ctx_add_handshake_data,
 580    ctx_flush_flight,
 581    ctx_send_alert,
 582};
 583
 584#if !defined(NO_WOLFSSL_SERVER)
 585static WOLFSSL_QUIC_METHOD ctx_method_fail = {
 586    dummy_set_encryption_secrets_fail,
 587    ctx_add_handshake_data,
 588    ctx_flush_flight,
 589    ctx_send_alert,
 590};
 591#endif
 592
 593static void QuicTestContext_init(QuicTestContext *tctx, WOLFSSL_CTX *ctx,
 594                                 const char *name, int verbose)
 595{
 596    static const byte tp_params_c[] = {0, 1, 2, 3, 4, 5, 6, 7};
 597    static const byte tp_params_s[] = {7, 6, 5, 4, 3, 2, 1, 0, 1};
 598
 599    AssertNotNull(tctx);
 600    memset(tctx, 0, sizeof(*tctx));
 601    tctx->name = name;
 602    tctx->ssl = wolfSSL_new(ctx);
 603    AssertNotNull(tctx->ssl);
 604    tctx->verbose = verbose;
 605    wolfSSL_set_app_data(tctx->ssl, tctx);
 606    AssertTrue(wolfSSL_set_quic_method(tctx->ssl, &ctx_method) == WOLFSSL_SUCCESS);
 607    wolfSSL_set_verify(tctx->ssl, SSL_VERIFY_NONE, 0);
 608#ifdef HAVE_SESSION_TICKET
 609    wolfSSL_UseSessionTicket(tctx->ssl);
 610    wolfSSL_set_SessionTicket_cb(tctx->ssl, ctx_session_ticket_cb, NULL);
 611#endif
 612    if (wolfSSL_is_server(tctx->ssl)) {
 613        wolfSSL_set_quic_transport_version(tctx->ssl, 0);
 614        wolfSSL_set_quic_transport_params(tctx->ssl, tp_params_s, sizeof(tp_params_s));
 615    }
 616    else {
 617        wolfSSL_set_quic_transport_version(tctx->ssl, 0);
 618        wolfSSL_set_quic_transport_params(tctx->ssl, tp_params_c, sizeof(tp_params_c));
 619    }
 620    (void)ctx_method;
 621}
 622
 623#if !defined(NO_WOLFSSL_SERVER)
 624static void QuicTestContext_init_fail_cb(QuicTestContext *tctx, WOLFSSL_CTX *ctx,
 625                                 const char *name, int verbose)
 626{
 627    static const byte tp_params_c[] = {0, 1, 2, 3, 4, 5, 6, 7};
 628    static const byte tp_params_s[] = {7, 6, 5, 4, 3, 2, 1, 0, 1};
 629
 630    AssertNotNull(tctx);
 631    memset(tctx, 0, sizeof(*tctx));
 632    tctx->name = name;
 633    tctx->ssl = wolfSSL_new(ctx);
 634    AssertNotNull(tctx->ssl);
 635    tctx->verbose = verbose;
 636    wolfSSL_set_app_data(tctx->ssl, tctx);
 637    AssertTrue(wolfSSL_set_quic_method(tctx->ssl, &ctx_method_fail) == WOLFSSL_SUCCESS);
 638    wolfSSL_set_verify(tctx->ssl, SSL_VERIFY_NONE, 0);
 639#ifdef HAVE_SESSION_TICKET
 640    wolfSSL_UseSessionTicket(tctx->ssl);
 641    wolfSSL_set_SessionTicket_cb(tctx->ssl, ctx_session_ticket_cb, NULL);
 642#endif
 643    if (wolfSSL_is_server(tctx->ssl)) {
 644        wolfSSL_set_quic_transport_version(tctx->ssl, 0);
 645        wolfSSL_set_quic_transport_params(tctx->ssl, tp_params_s, sizeof(tp_params_s));
 646    }
 647    else {
 648        wolfSSL_set_quic_transport_version(tctx->ssl, 0);
 649        wolfSSL_set_quic_transport_params(tctx->ssl, tp_params_c, sizeof(tp_params_c));
 650    }
 651    (void)ctx_method;
 652}
 653#endif
 654
 655static void QuicTestContext_free(QuicTestContext *tctx)
 656{
 657    OutputBuffer *out, *n;
 658
 659    if (tctx->ssl) {
 660        wolfSSL_free(tctx->ssl);
 661        tctx->ssl = NULL;
 662    }
 663    out = tctx->output.next;
 664    while (out) {
 665        n = out->next;
 666        free(out);
 667        out = n;
 668    }
 669}
 670
 671static int ctx_set_encryption_secrets(WOLFSSL *ssl, WOLFSSL_ENCRYPTION_LEVEL level,
 672                                      const uint8_t *read_secret,
 673                                      const uint8_t *write_secret, size_t secret_len)
 674{
 675    QuicTestContext *ctx = (QuicTestContext*)wolfSSL_get_app_data(ssl);
 676
 677    AssertNotNull(ctx);
 678    AssertTrue(secret_len <= sizeof(ctx->rx_secret[0]));
 679    if (read_secret) {
 680        memcpy(ctx->rx_secret[level], read_secret, secret_len);
 681        ctx->rx_secret_len[level] = secret_len;
 682    }
 683    if (write_secret) {
 684        memcpy(ctx->tx_secret[level], write_secret, secret_len);
 685        ctx->tx_secret_len[level] = secret_len;
 686    }
 687    AssertNotNull(ctx);
 688    return 1;
 689}
 690
 691static int ctx_add_handshake_data(WOLFSSL *ssl, WOLFSSL_ENCRYPTION_LEVEL level,
 692                                  const uint8_t *data, size_t len)
 693{
 694    QuicTestContext *ctx = (QuicTestContext*)wolfSSL_get_app_data(ssl);
 695    OutputBuffer *out;
 696
 697    AssertNotNull(ctx);
 698    out = &ctx->output;
 699    while (out->next) {
 700        out = out->next;
 701    }
 702    if (out->level != level) {
 703        if (out->len > 0) {
 704            out->next = (OutputBuffer*)calloc(1, sizeof(OutputBuffer));
 705            out = out->next;
 706            AssertNotNull(out);
 707        }
 708        out->level = level;
 709    }
 710    if (ctx->verbose) {
 711        printf("[%s] add_handshake[enc_level=%d]: %d bytes\n", ctx->name, level, (int)len);
 712        /* dump_buffer("add", data, len, 0); */
 713    }
 714    if (len > 0) {
 715        AssertTrue(out->len + len < sizeof(out->data));
 716        memcpy(out->data + out->len, data, len);
 717        out->len += len;
 718    }
 719    return 1;
 720}
 721
 722static int ctx_flush_flight(WOLFSSL *ssl)
 723{
 724    QuicTestContext *ctx = (QuicTestContext*)wolfSSL_get_app_data(ssl);
 725
 726    AssertNotNull(ctx);
 727    ctx->flushed = 1;
 728    return 1;
 729}
 730
 731static int ctx_send_alert(WOLFSSL *ssl, WOLFSSL_ENCRYPTION_LEVEL level, uint8_t err)
 732{
 733    QuicTestContext *ctx = (QuicTestContext*)wolfSSL_get_app_data(ssl);
 734
 735    AssertNotNull(ctx);
 736
 737    if (ctx->verbose) {
 738        printf("[%s] send_alert: level=%d, err=%d\n", ctx->name, level, err);
 739    }
 740    ctx->alert_level = (int)level;
 741    ctx->alert = alert;
 742    return 1;
 743}
 744
 745#ifdef HAVE_SESSION_TICKET
 746static int ctx_session_ticket_cb(WOLFSSL* ssl,
 747                                 const unsigned char* ticket, int ticketSz,
 748                                 void* cb_ctx)
 749{
 750    QuicTestContext *ctx = (QuicTestContext*)wolfSSL_get_app_data(ssl);
 751
 752    AssertNotNull(ctx);
 753
 754    (void)cb_ctx;
 755    if (ticketSz < 0 || (size_t)ticketSz > sizeof(ctx->ticket)) {
 756        printf("SESSION TICKET callback: ticket given is too large: %d bytes\n",
 757               ticketSz);
 758        return 1;
 759    }
 760    memset(ctx->ticket, 0, sizeof(ctx->ticket));
 761    ctx->ticket_len = (word32)ticketSz;
 762    memcpy(ctx->ticket, ticket, (size_t)ticketSz);
 763    if (ctx->verbose) {
 764        printf("Session Ticket[%s]: ", ctx->name);
 765        dump_buffer("", ticket, (size_t)ticketSz, 4);
 766    }
 767    return 0;
 768}
 769#endif
 770
 771static void ctx_dump_output(QuicTestContext *ctx)
 772{
 773    dump_buffer("Output", ctx->output.data, ctx->output.len, 0);
 774}
 775
 776static void check_handshake_record(const byte *data, size_t data_len,
 777                                   int *ptype, size_t *prlen)
 778{
 779    word32 rlen;
 780    AssertTrue(data_len >= HANDSHAKE_HEADER_SZ);
 781    *ptype = data[0];
 782    c24to32(&data[1], &rlen);
 783    *prlen = rlen + HANDSHAKE_HEADER_SZ;
 784}
 785
 786#if !defined(NO_WOLFSSL_SERVER)
 787static void ext_dump(const byte *data, size_t data_len, int indent)
 788{
 789    size_t idx = 0;
 790    word16 len16, etype, i;
 791
 792    printf("%*sextensions:\n", indent, " ");
 793    while (idx + 4 <= data_len) {
 794        ato16(&data[idx], &etype); /* extension type */
 795        ato16(&data[idx+2], &len16); /* extension length */
 796        if (idx + 4 + len16 > data_len) {
 797            printf("  unexpected extension length\n");
 798            break;
 799        }
 800        printf("  extension: %04x [", etype);
 801        for (i = 0; i < len16; ++i) {
 802            printf("%s0x%02x", (i? ", ": ""), data[idx+4+i]);
 803        }
 804        printf("]\n");
 805        idx += 2 + 2 + len16;
 806    }
 807}
 808#endif
 809
 810static const byte *ext_find(const byte *data, size_t data_len, int ext_type)
 811{
 812    size_t idx = 0;
 813    word16 len16, etype;
 814
 815    while (idx < data_len) {
 816        ato16(&data[idx], &etype); /* extension type */
 817        if (etype == ext_type) {
 818            return data + idx;
 819        }
 820        ato16(&data[idx+2], &len16); /* extension length */
 821        idx += 2 + 2 + len16;
 822    }
 823    return NULL;
 824}
 825
 826static int ext_has(const byte *data, size_t data_len, int ext_type)
 827{
 828    return ext_find(data, data_len,ext_type) != NULL;
 829}
 830
 831#if !defined(NO_WOLFSSL_SERVER)
 832static void ext_equals(const byte *data, size_t data_len, int ext_type,
 833                       const byte *exp_data, size_t exp_len)
 834{
 835    const byte *ext;
 836    word16 len16;
 837
 838    ext = ext_find(data, data_len, ext_type);
 839    AssertNotNull(ext);
 840    ato16(&ext[2], &len16);
 841    AssertTrue(len16 == exp_len);
 842    AssertTrue(memcmp(ext + 4, exp_data, exp_len) == 0);
 843}
 844
 845static void check_quic_client_hello(const byte *data, size_t data_len,
 846                                    int verbose, int indent)
 847{
 848    size_t idx;
 849    word16 len16;
 850    const byte *exts;
 851    size_t exts_len, rec_len;
 852    int rec_type;
 853    static byte ext_sup_version[3] = {0x02, 0x03, 0x04};
 854
 855    check_handshake_record(data, data_len, &rec_type, &rec_len);
 856    AssertIntEQ(rec_type, client_hello);
 857    idx = HANDSHAKE_HEADER_SZ;
 858    /* the client hello arrives alone */
 859    AssertIntEQ(rec_len, data_len);
 860    AssertTrue(data[idx] == SSLv3_MAJOR);
 861    idx++;
 862    AssertTrue(data[idx] == TLSv1_2_MINOR);
 863    idx++;
 864    idx += 32; /* 32 bytes RANDOM */
 865    AssertIntEQ(data[idx], 0);  /* session id length MUST be 0, RFC9001 ch. 8.4 */
 866    idx += 1 + data[idx];
 867    ato16(&data[idx], &len16); /* ciphers length */
 868    AssertTrue(len16 > 0);
 869    idx += 2 + len16;
 870    AssertTrue(data[idx] == 1);   /* compressions */
 871    AssertTrue(data[idx+1] == 0);   /* no compression */
 872    idx += 2;
 873    ato16(&data[idx], &len16); /* extensions length */
 874    AssertTrue(len16 > 0);
 875    exts_len = len16;
 876    idx += 2;
 877    exts = &data[idx];
 878    idx += exts_len;
 879    AssertTrue(idx <= rec_len); /* should fit */
 880    for (; idx < rec_len; ++idx) {
 881        AssertTrue(data[idx] == 0); /* padding */
 882    }
 883    ext_equals(exts, exts_len, TLSX_SUPPORTED_VERSIONS,
 884               ext_sup_version, sizeof(ext_sup_version));
 885    if (verbose) {
 886        ext_dump(exts, exts_len, indent);
 887        dump_buffer("", data, data_len, indent);
 888    }
 889}
 890#endif
 891
 892static void check_quic_client_hello_tp(OutputBuffer *out, int tp_v1,
 893                                       int tp_draft)
 894{
 895    size_t idx;
 896    word16 len16;
 897    const byte *exts;
 898    size_t exts_len, rec_len;
 899    int rec_type;
 900
 901    check_handshake_record(out->data, out->len, &rec_type, &rec_len);
 902    AssertIntEQ(rec_type, client_hello);
 903    idx = HANDSHAKE_HEADER_SZ;
 904    idx += 2; /* old version */
 905    idx += 32; /* 32 bytes RANDOM */
 906    idx += 1 + out->data[idx]; /* session id */
 907    ato16(&out->data[idx], &len16); /* ciphers length */
 908    idx += 2 + len16;
 909    idx += 2; /* compression */
 910    ato16(&out->data[idx], &len16); /* extensions length */
 911    AssertTrue(len16 > 0);
 912    exts_len = len16;
 913    idx += 2;
 914    exts = &out->data[idx];
 915
 916    AssertTrue(!ext_has(exts, exts_len, TLSX_KEY_QUIC_TP_PARAMS) == !tp_v1);
 917    AssertTrue(!ext_has(exts, exts_len, TLSX_KEY_QUIC_TP_PARAMS_DRAFT) == !tp_draft);
 918}
 919
 920#if !defined(NO_WOLFSSL_SERVER)
 921static void check_secrets(QuicTestContext *ctx, WOLFSSL_ENCRYPTION_LEVEL level,
 922                          size_t rx_len, size_t tx_len)
 923{
 924    int idx = (int)level;
 925    AssertTrue(idx < 4);
 926    AssertIntEQ(ctx->rx_secret_len[idx], rx_len);
 927    AssertIntEQ(ctx->tx_secret_len[idx], tx_len);
 928}
 929
 930static void assert_secrets_EQ(QuicTestContext *ctx1, QuicTestContext *ctx2,
 931                              WOLFSSL_ENCRYPTION_LEVEL level)
 932{
 933    int idx = (int)level;
 934    /* rx secrets are the other ones tx secrets */
 935    AssertIntEQ(ctx1->rx_secret_len[idx], ctx2->tx_secret_len[idx]);
 936    AssertIntEQ(ctx1->tx_secret_len[idx], ctx2->rx_secret_len[idx]);
 937    AssertIntEQ(memcmp(ctx1->rx_secret[idx], ctx2->tx_secret[idx],
 938                ctx1->rx_secret_len[idx]), 0);
 939    AssertIntEQ(memcmp(ctx1->tx_secret[idx], ctx2->rx_secret[idx],
 940                ctx1->tx_secret_len[idx]), 0);
 941}
 942
 943static void check_ee(const byte *data, size_t data_len, int verbose,
 944                     int indent)
 945{
 946    size_t rec_len, exts_len, idx;
 947    word16 len16;
 948    const byte *exts;
 949    int rec_type;
 950
 951    check_handshake_record(data, data_len, &rec_type, &rec_len);
 952    AssertIntEQ(rec_type, encrypted_extensions);
 953    idx = HANDSHAKE_HEADER_SZ;
 954    ato16(&data[idx], &len16); /* extensions length */
 955    AssertTrue(len16 > 0);
 956    exts_len = len16;
 957    idx += 2;
 958    exts = &data[idx];
 959    if (verbose) {
 960        ext_dump(exts, exts_len, indent);
 961        dump_buffer("", data, data_len, indent);
 962    }
 963}
 964
 965static void check_quic_server_hello(const byte *data, size_t data_len,
 966                                    int verbose, int indent)
 967{
 968    size_t idx;
 969    word16 len16, cipher;
 970    const byte *exts;
 971    size_t exts_len, rec_len;
 972    static byte ext_sup_version[2] = {0x03, 0x04};
 973    int rec_type;
 974
 975    check_handshake_record(data, data_len, &rec_type, &rec_len);
 976    AssertIntEQ(rec_type, server_hello);
 977    idx = HANDSHAKE_HEADER_SZ;
 978    AssertTrue(data[idx] == SSLv3_MAJOR);
 979    idx++;
 980    AssertTrue(data[idx] == TLSv1_2_MINOR);
 981    idx++;
 982    idx += 32; /* 32 bytes RANDOM */
 983    /* AssertIntEQ(data[idx], 0);  session id of len 0 */
 984    idx += 1 + data[idx];
 985    ato16(&data[idx], &cipher); /* cipher selected */
 986    AssertTrue(cipher != 0);
 987    idx += 2;
 988    AssertTrue(data[idx] == 0);   /* null compression */
 989    idx += 1;
 990    ato16(&data[idx], &len16); /* extensions length */
 991    AssertTrue(len16 > 0);
 992    exts_len = len16;
 993    idx += 2;
 994    exts = &data[idx];
 995    idx += exts_len;
 996    AssertTrue(idx <= rec_len); /* should fit */
 997    for (; idx < rec_len; ++idx) {
 998        AssertTrue(data[idx] == 0); /* padding */
 999    }
1000    if (verbose) {
1001        ext_dump(exts, exts_len, indent);
1002        dump_buffer("", data, rec_len, indent);
1003    }
1004    ext_equals(exts, exts_len, TLSX_SUPPORTED_VERSIONS,
1005               ext_sup_version, sizeof(ext_sup_version));
1006}
1007
1008static void check_crypto_rec(const byte *data, size_t data_len, int verbose,
1009                             int indent)
1010{
1011    size_t rec_len;
1012    int rec_type;
1013
1014    check_handshake_record(data, data_len, &rec_type, &rec_len);
1015    if (verbose) {
1016        dump_buffer("", data, rec_len, indent);
1017    }
1018}
1019
1020static void check_crypto_records(QuicTestContext *from, OutputBuffer *out,
1021                                 int indent, char *rec_log,
1022                                 size_t rec_log_size)
1023{
1024    const byte *data = out->data;
1025    size_t data_len = out->len;
1026    size_t rec_len;
1027    int rec_type;
1028    const char *rec_name;
1029    char lbuffer[128];
1030    void (*check_rec) (const byte *d, size_t l, int v, int indent);
1031
1032    while (data_len > 0) {
1033        check_handshake_record(data, data_len, &rec_type, &rec_len);
1034        if (rec_len > data_len) {
1035            printf("%*sINCOMPLETE CRYPTO?: ", indent, " ");
1036            dump_buffer("", data, data_len, indent);
1037        }
1038        AssertTrue(rec_len <= data_len);
1039        check_rec = check_crypto_rec;
1040        switch (rec_type) {
1041            case client_hello:
1042                rec_name = "ClientHello";
1043                check_rec = check_quic_client_hello;
1044                break;
1045            case server_hello:
1046                rec_name = "ServerHello";
1047                check_rec = check_quic_server_hello;
1048                break;
1049            case session_ticket:
1050                rec_name = "SessionTicket";
1051                break;
1052            case encrypted_extensions:
1053                rec_name = "EncryptedExtension";
1054                check_rec = check_ee;
1055                break;
1056            case certificate:
1057                rec_name = "Certificate";
1058                break;
1059            case certificate_verify:
1060                rec_name = "CertificateVerify";
1061                break;
1062            case finished:
1063                rec_name = "Finished";
1064                break;
1065            default:
1066                (void)XSNPRINTF(lbuffer, sizeof(lbuffer), "%d", rec_type);
1067                rec_name = lbuffer;
1068                break;
1069        }
1070
1071        if (rec_log) {
1072            if (*rec_log) XSTRLCAT(rec_log, ":", rec_log_size);
1073            XSTRLCAT(rec_log, rec_name, rec_log_size);
1074        }
1075        if (from->verbose) printf("%*sCRYPTO[%s]: ", indent, " ", rec_name);
1076        check_rec(data, rec_len, from->verbose, indent);
1077        if (from->verbose) printf("\n");
1078        data += rec_len;
1079        data_len -= rec_len;
1080    }
1081}
1082
1083static void QuicTestContext_forward(QuicTestContext *from, QuicTestContext *to,
1084                                    char *rec_log, size_t rec_log_size)
1085{
1086    int ret;
1087    OutputBuffer *out, *old;
1088
1089    out = &from->output;
1090    while (out->len > 0) {
1091        if (from->verbose) {
1092            printf("[%s -> %s] forward %d bytes at level %d\n",
1093                   from->name, to->name, (int)out->len, out->level);
1094        }
1095        if (out->level == wolfssl_encryption_early_data) {
1096            if (from->verbose) {
1097                dump_buffer("EarlyData", out->data, out->len, 4);
1098            }
1099        }
1100        else {
1101            check_crypto_records(from, out, 4, rec_log, rec_log_size);
1102        }
1103        ret = wolfSSL_provide_quic_data(to->ssl, out->level, out->data,
1104                                        out->len);
1105        out->len = 0;
1106        AssertIntEQ(ret, WOLFSSL_SUCCESS);
1107        if (out->next) {
1108            old = out->next;
1109            memcpy(out, out->next, sizeof(*out));
1110            free(old);
1111        }
1112    }
1113}
1114
1115typedef struct {
1116    QuicTestContext *client;
1117    QuicTestContext *server;
1118    int started;
1119    int verbose;
1120    char rec_log[16*1024];
1121    int sent_early_data;
1122    int accept_early_data;
1123    char early_data[16*1024];
1124    size_t early_data_len;
1125} QuicConversation;
1126
1127static void QuicConversation_init(QuicConversation *conv,
1128                                  QuicTestContext *tclient,
1129                                  QuicTestContext *tserver)
1130{
1131    memset(conv, 0, sizeof(*conv));
1132    conv->client = tclient;
1133    conv->server = tserver;
1134    conv->verbose = tclient->verbose && tserver->verbose;
1135}
1136
1137static int QuicConversation_start(QuicConversation *conv, const byte *data,
1138                                  size_t data_len, size_t *pwritten)
1139{
1140    int ret;
1141
1142    AssertFalse(conv->started);
1143
1144    if (conv->verbose) {
1145        printf("[%s <-> %s] starting\n", conv->client->name,
1146               conv->server->name);
1147    }
1148    if (data && data_len > 0) {
1149#ifdef WOLFSSL_EARLY_DATA
1150        int written;
1151        ret = wolfSSL_write_early_data(conv->client->ssl, data, (int)data_len,
1152                                       &written);
1153        if (ret < 0) {
1154            int err = wolfSSL_get_error(conv->client->ssl, ret);
1155            char lbuffer[1024];
1156            printf("EARLY DATA ret = %d, error = %d, %s\n", ret, err,
1157                   wolfSSL_ERR_error_string((unsigned long)err, lbuffer));
1158            AssertTrue(0);
1159        }
1160        *pwritten = (size_t)written;
1161        conv->sent_early_data = 1;
1162#else
1163        fprintf(stderr, "Cannot send EARLY DATA without feature enabled!\n");
1164        AssertTrue(0);
1165#endif
1166    }
1167    else {
1168        ret = wolfSSL_connect(conv->client->ssl);
1169        if (ret != WOLFSSL_SUCCESS) {
1170            AssertIntEQ(wolfSSL_get_error(conv->client->ssl, 0),
1171                        WC_NO_ERR_TRACE(SSL_ERROR_WANT_READ));
1172        }
1173        if (pwritten) *pwritten = 0;
1174    }
1175    conv->started = 1;
1176    return ret;
1177}
1178
1179static int QuicConversation_step(QuicConversation *conv, int may_fail)
1180{
1181    int n;
1182
1183    if (!conv->started) {
1184        n = wolfSSL_connect(conv->client->ssl);
1185        if ((n != WOLFSSL_SUCCESS) &&
1186            (wolfSSL_get_error(conv->client->ssl, 0) !=
1187            WC_NO_ERR_TRACE(SSL_ERROR_WANT_READ))) {
1188            if (may_fail) return 0;
1189            AssertIntEQ(WC_NO_ERR_TRACE(SSL_ERROR_WANT_READ),
1190                        wolfSSL_get_error(conv->client->ssl, 0));
1191        }
1192        conv->started = 1;
1193    }
1194    if (conv->server->output.len > 0) {
1195        QuicTestContext_forward(conv->server, conv->client, conv->rec_log,
1196                                sizeof(conv->rec_log));
1197        n = wolfSSL_quic_read_write(conv->client->ssl);
1198        if ((n != WOLFSSL_SUCCESS) &&
1199            (wolfSSL_get_error(conv->client->ssl, 0) !=
1200             WC_NO_ERR_TRACE(SSL_ERROR_WANT_READ))) {
1201            if (may_fail) return 0;
1202            AssertIntEQ(WC_NO_ERR_TRACE(SSL_ERROR_WANT_READ),
1203                        wolfSSL_get_error(conv->client->ssl, 0));
1204        }
1205        return 1;
1206    }
1207    else if (conv->client->output.len > 0) {
1208        QuicTestContext_forward(conv->client, conv->server, conv->rec_log,
1209                                sizeof(conv->rec_log));
1210#ifdef WOLFSSL_EARLY_DATA
1211        if (conv->accept_early_data) {
1212            int written;
1213            n = wolfSSL_read_early_data(conv->server->ssl,
1214                                        conv->early_data + conv->early_data_len,
1215                                        (int)(sizeof(conv->early_data) - conv->early_data_len),
1216                                        &written);
1217            if (n < 0) {
1218                if (wolfSSL_get_error(conv->server->ssl, 0) != WC_NO_ERR_TRACE(SSL_ERROR_WANT_READ)) {
1219                    if (may_fail) return 0;
1220                    AssertIntEQ(wolfSSL_get_error(conv->server->ssl, 0),
1221                                WC_NO_ERR_TRACE(SSL_ERROR_WANT_READ));
1222                }
1223            }
1224            else if (n > 0) {
1225                conv->early_data_len += (size_t)n;
1226                if (conv->verbose)
1227                    printf("RECVed early data, len now=%d\n",
1228                           (int)conv->early_data_len);
1229            }
1230        }
1231        else
1232 #endif /* WOLFSSL_EARLY_DATA */
1233        {
1234            n = wolfSSL_quic_read_write(conv->server->ssl);
1235            if (n != WOLFSSL_SUCCESS
1236                && wolfSSL_get_error(conv->server->ssl, 0) != WC_NO_ERR_TRACE(SSL_ERROR_WANT_READ)) {
1237                if (may_fail) return 0;
1238                AssertIntEQ(wolfSSL_get_error(conv->server->ssl, 0),
1239                            WC_NO_ERR_TRACE(SSL_ERROR_WANT_READ));
1240            }
1241        }
1242        return 1;
1243    }
1244    return 0;
1245}
1246
1247static void QuicConversation_do(QuicConversation *conv)
1248{
1249    if (!conv->started) {
1250        QuicConversation_start(conv, NULL, 0, NULL);
1251    }
1252
1253    while (1) {
1254        if (!QuicConversation_step(conv, 0)) {
1255            int c_err = wolfSSL_get_error(conv->client->ssl, 0);
1256            int s_err = wolfSSL_get_error(conv->server->ssl, 0);
1257            if (c_err == 0 && s_err == 0) {
1258                break;  /* handshake done */
1259            }
1260            printf("Neither tclient nor server have anything to send, "
1261                   "but client_error=%d, server_error=%d\n",
1262                   c_err, s_err);
1263            AssertFalse(1);
1264        }
1265    }
1266}
1267
1268#ifdef HAVE_SESSION_TICKET
1269
1270static void QuicConversation_fail(QuicConversation *conv)
1271{
1272    if (!conv->started) {
1273        QuicConversation_start(conv, NULL, 0, NULL);
1274    }
1275
1276    while (1) {
1277        if (!QuicConversation_step(conv, 1)) {
1278            int c_err = wolfSSL_get_error(conv->client->ssl, 0);
1279            int s_err = wolfSSL_get_error(conv->server->ssl, 0);
1280            AssertTrue(c_err != 0 || s_err != 0);
1281            break;
1282        }
1283    }
1284}
1285
1286#endif /* HAVE_SESSION_TICKET */
1287#endif
1288
1289static int test_quic_client_hello(int verbose) {
1290    EXPECT_DECLS;
1291    WOLFSSL_CTX * ctx = NULL;
1292    QuicTestContext tctx;
1293
1294    (void)ctx_dump_output;
1295
1296    ExpectNotNull(ctx = wolfSSL_CTX_new(wolfTLSv1_3_client_method()));
1297
1298    QuicTestContext_init(&tctx, ctx, "client", verbose);
1299    /* Without any QUIC transport params, this needs to fail */
1300    ExpectTrue(wolfSSL_set_quic_transport_params(tctx.ssl, NULL, 0) == WOLFSSL_SUCCESS);
1301    ExpectTrue(wolfSSL_quic_read_write(tctx.ssl) != 0);
1302    ExpectIntEQ(wolfSSL_get_error(tctx.ssl, 0),
1303                WC_NO_ERR_TRACE(QUIC_TP_MISSING_E));
1304    QuicTestContext_free(&tctx);
1305
1306    /* Set transport params, expect both extensions */
1307    QuicTestContext_init(&tctx, ctx, "client", verbose);
1308#ifdef HAVE_SNI
1309    wolfSSL_UseSNI(tctx.ssl, WOLFSSL_SNI_HOST_NAME,
1310                   "wolfssl.com", sizeof("wolfssl.com")-1);
1311#endif
1312    ExpectTrue(wolfSSL_connect(tctx.ssl) != 0);
1313    ExpectIntEQ(wolfSSL_get_error(tctx.ssl, 0),
1314                WC_NO_ERR_TRACE(SSL_ERROR_WANT_READ));
1315    check_quic_client_hello_tp(&tctx.output, 1, 1);
1316    QuicTestContext_free(&tctx);
1317
1318    /* Set transport params v1, expect v1 extension */
1319    QuicTestContext_init(&tctx, ctx, "client", verbose);
1320    wolfSSL_set_quic_transport_version(tctx.ssl, TLSX_KEY_QUIC_TP_PARAMS);
1321    ExpectTrue(wolfSSL_connect(tctx.ssl) != 0);
1322    check_quic_client_hello_tp(&tctx.output, 1, 0);
1323    QuicTestContext_free(&tctx);
1324
1325    /* Set transport params draft, expect draft extension */
1326    QuicTestContext_init(&tctx, ctx, "client", verbose);
1327    wolfSSL_set_quic_transport_version(tctx.ssl,
1328                                       TLSX_KEY_QUIC_TP_PARAMS_DRAFT);
1329    ExpectTrue(wolfSSL_connect(tctx.ssl) != 0);
1330    check_quic_client_hello_tp(&tctx.output, 0, 1);
1331    QuicTestContext_free(&tctx);
1332
1333    /* Set transport params 0, expect both extension */
1334    QuicTestContext_init(&tctx, ctx, "client", verbose);
1335    wolfSSL_set_quic_transport_version(tctx.ssl, 0);
1336    ExpectTrue(wolfSSL_connect(tctx.ssl) != 0);
1337    check_quic_client_hello_tp(&tctx.output, 1, 1);
1338    QuicTestContext_free(&tctx);
1339
1340    wolfSSL_CTX_free(ctx);
1341    printf("    test_quic_client_hello: %s\n", EXPECT_SUCCESS() ? pass : fail);
1342
1343    return EXPECT_RESULT();
1344}
1345#endif /* !NO_WOLFSSL_CLIENT */
1346
1347#if !defined(NO_WOLFSSL_CLIENT) && !defined(NO_WOLFSSL_SERVER)
1348static int test_quic_server_hello(int verbose) {
1349    EXPECT_DECLS;
1350    WOLFSSL_CTX * ctx_c = NULL;
1351    WOLFSSL_CTX * ctx_s = NULL;
1352    QuicTestContext tclient, tserver;
1353    QuicConversation conv;
1354
1355    ExpectNotNull(ctx_c = wolfSSL_CTX_new(wolfTLSv1_3_client_method()));
1356    ExpectNotNull(ctx_s = wolfSSL_CTX_new(wolfTLSv1_3_server_method()));
1357    ExpectTrue(wolfSSL_CTX_use_certificate_file(ctx_s, svrCertFile,
1358                                                WOLFSSL_FILETYPE_PEM));
1359    ExpectTrue(wolfSSL_CTX_use_PrivateKey_file(ctx_s, svrKeyFile,
1360                                               WOLFSSL_FILETYPE_PEM));
1361
1362    /* setup ssls */
1363    QuicTestContext_init(&tclient, ctx_c, "client", verbose);
1364    QuicTestContext_init(&tserver, ctx_s, "server", verbose);
1365
1366    /* connect */
1367    QuicConversation_init(&conv, &tclient, &tserver);
1368    QuicConversation_step(&conv, 0);
1369    /* check established/missing secrets */
1370    check_secrets(&tserver, wolfssl_encryption_initial, 0, 0);
1371    check_secrets(&tserver, wolfssl_encryption_handshake,
1372        DEFAULT_TLS_DIGEST_SZ, DEFAULT_TLS_DIGEST_SZ);
1373    check_secrets(&tserver, wolfssl_encryption_application,
1374        DEFAULT_TLS_DIGEST_SZ, DEFAULT_TLS_DIGEST_SZ);
1375    check_secrets(&tclient, wolfssl_encryption_handshake, 0, 0);
1376    /* feed the server data to the client */
1377    QuicConversation_step(&conv, 0);
1378    /* client has generated handshake secret */
1379    check_secrets(&tclient, wolfssl_encryption_handshake,
1380        DEFAULT_TLS_DIGEST_SZ, DEFAULT_TLS_DIGEST_SZ);
1381    /* continue the handshake till done */
1382    conv.started = 1;
1383    /* run till end */
1384    QuicConversation_do(&conv);
1385    ExpectIntEQ(tclient.output.len, 0);
1386    ExpectIntEQ(tserver.output.len, 0);
1387    /* what have we seen? */
1388#ifdef HAVE_SESSION_TICKET
1389    ExpectStrEQ(conv.rec_log, "ClientHello:ServerHello:EncryptedExtension:"
1390        "Certificate:CertificateVerify:Finished:Finished:SessionTicket");
1391#else
1392    ExpectStrEQ(conv.rec_log, "ClientHello:ServerHello:EncryptedExtension:"
1393        "Certificate:CertificateVerify:Finished:Finished");
1394#endif
1395    /* we are at application encryption level */
1396    ExpectTrue(wolfSSL_quic_read_level(tclient.ssl) == wolfssl_encryption_application);
1397    ExpectTrue(wolfSSL_quic_write_level(tclient.ssl) == wolfssl_encryption_application);
1398    ExpectTrue(wolfSSL_quic_read_level(tserver.ssl) == wolfssl_encryption_application);
1399    ExpectTrue(wolfSSL_quic_write_level(tserver.ssl) == wolfssl_encryption_application);
1400    /* the last client write (FINISHED) was at handshake level */
1401    ExpectTrue(tclient.output.level == wolfssl_encryption_handshake);
1402    /* we have the app secrets */
1403    check_secrets(&tclient, wolfssl_encryption_application,
1404        DEFAULT_TLS_DIGEST_SZ, DEFAULT_TLS_DIGEST_SZ);
1405    check_secrets(&tserver, wolfssl_encryption_application,
1406        DEFAULT_TLS_DIGEST_SZ, DEFAULT_TLS_DIGEST_SZ);
1407    /* verify client and server have the same secrets established */
1408    assert_secrets_EQ(&tclient, &tserver, wolfssl_encryption_handshake);
1409    assert_secrets_EQ(&tclient, &tserver, wolfssl_encryption_application);
1410    /* AEAD cipher should be known */
1411    ExpectNotNull(wolfSSL_quic_get_aead(tclient.ssl));
1412    ExpectNotNull(wolfSSL_quic_get_aead(tserver.ssl));
1413    /* What was negiotiated and is it the same? */
1414    ExpectIntEQ(wolfSSL_get_peer_quic_transport_version(tclient.ssl),
1415                wolfSSL_get_peer_quic_transport_version(tserver.ssl));
1416
1417    QuicTestContext_free(&tclient);
1418    QuicTestContext_free(&tserver);
1419
1420    wolfSSL_CTX_free(ctx_c);
1421    wolfSSL_CTX_free(ctx_s);
1422    printf("    test_quic_server_hello: %s\n", EXPECT_RESULT() ? pass : fail);
1423    return EXPECT_RESULT();
1424}
1425
1426static int test_quic_server_hello_fail(int verbose) {
1427    EXPECT_DECLS;
1428    WOLFSSL_CTX * ctx_c = NULL;
1429    WOLFSSL_CTX * ctx_s = NULL;
1430    QuicTestContext tclient, tserver;
1431    QuicConversation conv;
1432
1433    ExpectNotNull(ctx_c = wolfSSL_CTX_new(wolfTLSv1_3_client_method()));
1434    ExpectNotNull(ctx_s = wolfSSL_CTX_new(wolfTLSv1_3_server_method()));
1435    ExpectTrue(wolfSSL_CTX_use_certificate_file(ctx_s, svrCertFile,
1436                                                WOLFSSL_FILETYPE_PEM));
1437    ExpectTrue(wolfSSL_CTX_use_PrivateKey_file(ctx_s, svrKeyFile,
1438                                               WOLFSSL_FILETYPE_PEM));
1439
1440    /* setup ssls */
1441    QuicTestContext_init_fail_cb(&tclient, ctx_c, "client", verbose);
1442    QuicTestContext_init(&tserver, ctx_s, "server", verbose);
1443
1444    /* connect */
1445    QuicConversation_init(&conv, &tclient, &tserver);
1446    QuicConversation_step(&conv, 0);
1447    /* check established/missing secrets */
1448    check_secrets(&tserver, wolfssl_encryption_initial, 0, 0);
1449    check_secrets(&tserver, wolfssl_encryption_handshake,
1450        DEFAULT_TLS_DIGEST_SZ, DEFAULT_TLS_DIGEST_SZ);
1451    check_secrets(&tserver, wolfssl_encryption_application,
1452        DEFAULT_TLS_DIGEST_SZ, DEFAULT_TLS_DIGEST_SZ);
1453    check_secrets(&tclient, wolfssl_encryption_handshake, 0, 0);
1454    /* feed the server data to the client. This is when the cb will fail */
1455    QuicConversation_step(&conv, 1);
1456    /* confirm failure to generate secrets */
1457    {
1458        int idx = (int)wolfssl_encryption_handshake;
1459        ExpectTrue(idx < 4);
1460        ExpectIntEQ(tclient.rx_secret_len[idx], 0);
1461        ExpectIntEQ(tclient.tx_secret_len[idx], 0);
1462    }
1463    QuicTestContext_free(&tclient);
1464    QuicTestContext_free(&tserver);
1465
1466    wolfSSL_CTX_free(ctx_c);
1467    wolfSSL_CTX_free(ctx_s);
1468    printf("    test_quic_server_hello_fail: %s\n",
1469           EXPECT_RESULT() ? pass : fail);
1470    return EXPECT_RESULT();
1471}
1472
1473/* This has gotten a bit out of hand. */
1474#if (defined(OPENSSL_ALL) || (defined(OPENSSL_EXTRA) && \
1475    (defined(HAVE_STUNNEL) || defined(WOLFSSL_NGINX) || \
1476    defined(HAVE_LIGHTY) || defined(WOLFSSL_HAPROXY) || \
1477    defined(WOLFSSL_OPENSSH) || defined(HAVE_SBLIM_SFCB)))) \
1478    && defined(HAVE_ALPN) && defined(HAVE_SNI)
1479#define REALLY_HAVE_ALPN_AND_SNI
1480#else
1481#undef REALLY_HAVE_ALPN_AND_SNI
1482#endif
1483
1484#ifdef REALLY_HAVE_ALPN_AND_SNI
1485struct stripe_buffer {
1486    char stripe[256];
1487};
1488
1489static int inspect_SNI(WOLFSSL *ssl, int *ad, void *baton)
1490{
1491    struct stripe_buffer *stripe = (struct stripe_buffer *)baton;
1492
1493    (void)ssl;
1494    *ad = 0;
1495    XSTRLCAT(stripe->stripe, "S", sizeof(stripe->stripe));
1496    return 0;
1497}
1498
1499static int select_ALPN(WOLFSSL *ssl,
1500            const unsigned char **out,
1501            unsigned char *outlen,
1502            const unsigned char *in,
1503            unsigned int inlen,
1504            void *baton)
1505{
1506    struct stripe_buffer *stripe = (struct stripe_buffer *)baton;
1507
1508    (void)ssl;
1509    (void)inlen;
1510    /* just select the first */
1511    *out = in + 1;
1512    *outlen = in[0];
1513    XSTRLCAT(stripe->stripe, "A", sizeof(stripe->stripe));
1514    return 0;
1515}
1516
1517static int test_quic_alpn(int verbose) {
1518    EXPECT_DECLS;
1519    WOLFSSL_CTX *        ctx_c = NULL;
1520    WOLFSSL_CTX *        ctx_s = NULL;
1521    QuicTestContext      tclient, tserver;
1522    QuicConversation     conv;
1523    struct stripe_buffer stripe;
1524    unsigned char        alpn_protos[256];
1525
1526    XMEMSET(&stripe, 0, sizeof(stripe));
1527    XMEMSET(alpn_protos, 0, sizeof(alpn_protos));
1528
1529    ExpectNotNull(ctx_c = wolfSSL_CTX_new(wolfTLSv1_3_client_method()));
1530    ExpectNotNull(ctx_s = wolfSSL_CTX_new(wolfTLSv1_3_server_method()));
1531    ExpectTrue(wolfSSL_CTX_use_certificate_file(ctx_s, svrCertFile,
1532               WOLFSSL_FILETYPE_PEM));
1533    ExpectTrue(wolfSSL_CTX_use_PrivateKey_file(ctx_s, svrKeyFile,
1534               WOLFSSL_FILETYPE_PEM));
1535
1536    stripe.stripe[0] = '\0';
1537    wolfSSL_CTX_set_servername_callback(ctx_s, inspect_SNI);
1538    wolfSSL_CTX_set_servername_arg(ctx_s, &stripe);
1539    wolfSSL_CTX_set_alpn_select_cb(ctx_s, select_ALPN, &stripe);
1540
1541    /* setup ssls */
1542    QuicTestContext_init(&tclient, ctx_c, "client", verbose);
1543    QuicTestContext_init(&tserver, ctx_s, "server", verbose);
1544
1545    /* set SNI and ALPN callbacks on server side,
1546     * provide values on client side */
1547    wolfSSL_UseSNI(tclient.ssl, WOLFSSL_SNI_HOST_NAME,
1548                   "wolfssl.com", sizeof("wolfssl.com")-1);
1549    /* connect */
1550    QuicConversation_init(&conv, &tclient, &tserver);
1551
1552    XSTRLCPY((char*)(alpn_protos + 1), "test", sizeof(alpn_protos));
1553    alpn_protos[0] = strlen("test");
1554    wolfSSL_set_alpn_protos(tclient.ssl, alpn_protos, 1 + strlen("test"));
1555
1556    QuicConversation_do(&conv);
1557    ExpectIntEQ(tclient.output.len, 0);
1558    ExpectIntEQ(tserver.output.len, 0);
1559
1560    /* SNI callback needs to be called before ALPN callback */
1561    ExpectStrEQ(stripe.stripe, "SA");
1562
1563    QuicTestContext_free(&tclient);
1564    QuicTestContext_free(&tserver);
1565
1566    wolfSSL_CTX_free(ctx_c);
1567    wolfSSL_CTX_free(ctx_s);
1568    printf("    test_quic_alpn: %s\n", (EXPECT_SUCCESS())? pass : fail);
1569    return EXPECT_RESULT();
1570}
1571#endif /* REALLY_HAVE_ALPN_AND_SNI */
1572
1573
1574#ifdef HAVE_SESSION_TICKET
1575
1576static int test_quic_key_share(int verbose) {
1577    EXPECT_DECLS;
1578    WOLFSSL_CTX *    ctx_c = NULL;
1579    WOLFSSL_CTX *    ctx_s = NULL;
1580    QuicTestContext  tclient, tserver;
1581    QuicConversation conv;
1582
1583    ExpectNotNull(ctx_c = wolfSSL_CTX_new(wolfTLSv1_3_client_method()));
1584    ExpectNotNull(ctx_s = wolfSSL_CTX_new(wolfTLSv1_3_server_method()));
1585    ExpectTrue(wolfSSL_CTX_use_certificate_file(ctx_s, svrCertFile,
1586               WOLFSSL_FILETYPE_PEM));
1587    ExpectTrue(wolfSSL_CTX_use_PrivateKey_file(ctx_s, svrKeyFile,
1588               WOLFSSL_FILETYPE_PEM));
1589
1590    /* setup & handshake defaults */
1591    QuicTestContext_init(&tclient, ctx_c, "client", verbose);
1592    QuicTestContext_init(&tserver, ctx_s, "server", verbose);
1593    QuicConversation_init(&conv, &tclient, &tserver);
1594    QuicConversation_do(&conv);
1595    ExpectStrEQ(conv.rec_log, "ClientHello:ServerHello:EncryptedExtension:"
1596        "Certificate:CertificateVerify:Finished:Finished:SessionTicket");
1597    QuicTestContext_free(&tclient);
1598    QuicTestContext_free(&tserver);
1599
1600    /* setup & handshake, restricted groups. KEY_SHARE should use
1601     * the first configured group. */
1602    /*If that is supported by the server, expect a smooth handshake.*/
1603    QuicTestContext_init(&tclient, ctx_c, "client", verbose);
1604    QuicTestContext_init(&tserver, ctx_s, "server", verbose);
1605
1606#ifdef HAVE_CURVE25519
1607    ExpectTrue(wolfSSL_set1_curves_list(tclient.ssl, "X25519:P-256")
1608               == WOLFSSL_SUCCESS);
1609    ExpectTrue(wolfSSL_set1_curves_list(tserver.ssl, "X25519")
1610               == WOLFSSL_SUCCESS);
1611#else
1612    ExpectTrue(wolfSSL_set1_curves_list(tclient.ssl, "P-256:P-384")
1613               == WOLFSSL_SUCCESS);
1614    ExpectTrue(wolfSSL_set1_curves_list(tserver.ssl, "P-256")
1615               == WOLFSSL_SUCCESS);
1616#endif
1617
1618    QuicConversation_init(&conv, &tclient, &tserver);
1619    QuicConversation_do(&conv);
1620    ExpectStrEQ(conv.rec_log,
1621        "ClientHello:ServerHello:EncryptedExtension:"
1622            "Certificate:CertificateVerify:Finished:Finished:SessionTicket");
1623    QuicTestContext_free(&tclient);
1624    QuicTestContext_free(&tserver);
1625    printf("    test_quic_key_share: priority ok\n");
1626
1627    /* If group is not supported by server, expect HelloRetry */
1628    QuicTestContext_init(&tclient, ctx_c, "client", verbose);
1629    QuicTestContext_init(&tserver, ctx_s, "server", verbose);
1630
1631#ifdef HAVE_CURVE25519
1632    ExpectTrue(wolfSSL_set1_curves_list(tclient.ssl, "X25519:P-256")
1633               == WOLFSSL_SUCCESS);
1634    ExpectTrue(wolfSSL_set1_curves_list(tserver.ssl, "P-256")
1635               == WOLFSSL_SUCCESS);
1636#else
1637    ExpectTrue(wolfSSL_set1_curves_list(tclient.ssl, "P-384:P-256")
1638               == WOLFSSL_SUCCESS);
1639    ExpectTrue(wolfSSL_set1_curves_list(tserver.ssl, "P-256")
1640               == WOLFSSL_SUCCESS);
1641#endif
1642
1643    QuicConversation_init(&conv, &tclient, &tserver);
1644    QuicConversation_do(&conv);
1645    ExpectStrEQ(conv.rec_log,
1646        "ClientHello:ServerHello:ClientHello:ServerHello:EncryptedExtension:"
1647            "Certificate:CertificateVerify:Finished:Finished:SessionTicket");
1648    QuicTestContext_free(&tclient);
1649    QuicTestContext_free(&tserver);
1650    printf("    test_quic_key_share: retry ok\n");
1651
1652    /* If no group overlap, expect failure */
1653    QuicTestContext_init(&tclient, ctx_c, "client", verbose);
1654    QuicTestContext_init(&tserver, ctx_s, "server", verbose);
1655
1656#ifdef HAVE_CURVE25519
1657    ExpectTrue(wolfSSL_set1_curves_list(tclient.ssl, "P-256")
1658               == WOLFSSL_SUCCESS);
1659    ExpectTrue(wolfSSL_set1_curves_list(tserver.ssl, "X25519")
1660               == WOLFSSL_SUCCESS);
1661#else
1662    ExpectTrue(wolfSSL_set1_curves_list(tclient.ssl, "P-256")
1663               == WOLFSSL_SUCCESS);
1664    ExpectTrue(wolfSSL_set1_curves_list(tserver.ssl, "P-384")
1665               == WOLFSSL_SUCCESS);
1666#endif
1667
1668    QuicConversation_init(&conv, &tclient, &tserver);
1669    QuicConversation_fail(&conv);
1670    ExpectIntEQ(wolfSSL_get_error(tserver.ssl, 0),
1671                WC_NO_ERR_TRACE(SSL_ERROR_WANT_READ));
1672    ExpectIntEQ(wolfSSL_get_error(tclient.ssl, 0),
1673                WC_NO_ERR_TRACE(BAD_KEY_SHARE_DATA));
1674    QuicTestContext_free(&tclient);
1675    QuicTestContext_free(&tserver);
1676    printf("    test_quic_key_share: no match ok\n");
1677
1678    wolfSSL_CTX_free(ctx_c);
1679    wolfSSL_CTX_free(ctx_s);
1680    printf("    test_quic_key_share: %s\n", EXPECT_SUCCESS() ? pass : fail);
1681    return EXPECT_RESULT();
1682}
1683
1684static int test_quic_resumption(int verbose) {
1685    EXPECT_DECLS;
1686    WOLFSSL_CTX *         ctx_c = NULL;
1687    WOLFSSL_CTX *         ctx_s = NULL;
1688    WOLFSSL_SESSION *     session = NULL;
1689    WOLFSSL_SESSION *     session_restored = NULL;
1690    QuicTestContext       tclient, tserver;
1691    QuicConversation      conv;
1692    unsigned char         session_buffer[16 * 1024];
1693    unsigned char *       session_data = NULL;
1694    const unsigned char * session_data2 = NULL;
1695    unsigned int          session_size = 0;
1696
1697    ExpectNotNull(ctx_c = wolfSSL_CTX_new(wolfTLSv1_3_client_method()));
1698    ExpectNotNull(ctx_s = wolfSSL_CTX_new(wolfTLSv1_3_server_method()));
1699    ExpectTrue(wolfSSL_CTX_use_certificate_file(ctx_s, svrCertFile,
1700               WOLFSSL_FILETYPE_PEM));
1701    ExpectTrue(wolfSSL_CTX_use_PrivateKey_file(ctx_s, svrKeyFile,
1702               WOLFSSL_FILETYPE_PEM));
1703
1704    /* setup ssls */
1705    QuicTestContext_init(&tclient, ctx_c, "client", verbose);
1706    QuicTestContext_init(&tserver, ctx_s, "server", verbose);
1707
1708    QuicConversation_init(&conv, &tclient, &tserver);
1709    /* run till end */
1710    QuicConversation_do(&conv);
1711    /* what have we seen? */
1712    ExpectStrEQ(conv.rec_log, "ClientHello:ServerHello:EncryptedExtension:"
1713        "Certificate:CertificateVerify:Finished:Finished:SessionTicket");
1714
1715    /* Should have received a session ticket, save the session
1716     * and also make a serialized/deserialized copy to check that persisting
1717     * a session works. */
1718    ExpectTrue(tclient.ticket_len > 0);
1719    ExpectNotNull(session = wolfSSL_get1_session(tclient.ssl));
1720    session_size = (unsigned int)wolfSSL_i2d_SSL_SESSION(session, NULL);
1721    ExpectTrue(session_size > 0);
1722    ExpectTrue((size_t)session_size < sizeof(session_buffer));
1723    session_data2 = session_data = session_buffer;
1724    session_size = (unsigned int)wolfSSL_i2d_SSL_SESSION(session,
1725                                                         &session_data);
1726    session_restored = wolfSSL_d2i_SSL_SESSION(NULL, &session_data2,
1727                                               session_size);
1728    ExpectNotNull(session_restored);
1729
1730    QuicTestContext_free(&tserver);
1731    QuicTestContext_free(&tclient);
1732
1733    /* Do a Session resumption with the session object */
1734    QuicTestContext_init(&tserver, ctx_s, "server", verbose);
1735    QuicTestContext_init(&tclient, ctx_c, "client_resume", verbose);
1736    ExpectIntEQ(wolfSSL_set_session(tclient.ssl, session), WOLFSSL_SUCCESS);
1737    /* let them talk */
1738    QuicConversation_init(&conv, &tclient, &tserver);
1739    QuicConversation_do(&conv);
1740    /* this is what should happen. Look Ma, no certificate! */
1741    ExpectStrEQ(conv.rec_log, "ClientHello:ServerHello:EncryptedExtension:"
1742        "Finished:Finished:SessionTicket");
1743    QuicTestContext_free(&tclient);
1744    QuicTestContext_free(&tserver);
1745
1746    /* Do a Session resumption with the restored session object */
1747    QuicTestContext_init(&tserver, ctx_s, "server", verbose);
1748    QuicTestContext_init(&tclient, ctx_c, "client_resume_restored", verbose);
1749    ExpectIntEQ(wolfSSL_set_session(tclient.ssl, session_restored),
1750                WOLFSSL_SUCCESS);
1751    /* let them talk */
1752    QuicConversation_init(&conv, &tclient, &tserver);
1753    QuicConversation_do(&conv);
1754    /* this is what should happen. Look Ma, no certificate! */
1755    ExpectStrEQ(conv.rec_log, "ClientHello:ServerHello:EncryptedExtension:"
1756        "Finished:Finished:SessionTicket");
1757    QuicTestContext_free(&tclient);
1758    QuicTestContext_free(&tserver);
1759
1760    {
1761        /* Do a Session resumption with a new server ctx */
1762        WOLFSSL_CTX * ctx_s2 = NULL;
1763        ExpectNotNull(ctx_s2 = wolfSSL_CTX_new(wolfTLSv1_3_server_method()));
1764        ExpectTrue(wolfSSL_CTX_use_certificate_file(ctx_s2, eccCertFile,
1765                                                    WOLFSSL_FILETYPE_PEM));
1766        ExpectTrue(wolfSSL_CTX_use_PrivateKey_file(ctx_s2, eccKeyFile,
1767                                                   WOLFSSL_FILETYPE_PEM));
1768
1769        QuicTestContext_init(&tserver, ctx_s2, "server2", verbose);
1770        QuicTestContext_init(&tclient, ctx_c, "client_resume2", verbose);
1771        ExpectIntEQ(wolfSSL_set_session(tclient.ssl, session_restored),
1772                                        WOLFSSL_SUCCESS);
1773        /* let them talk */
1774        QuicConversation_init(&conv, &tclient, &tserver);
1775        QuicConversation_do(&conv);
1776        ExpectStrEQ(conv.rec_log, "ClientHello:ServerHello:EncryptedExtension:"
1777            "Certificate:CertificateVerify:Finished:Finished:SessionTicket");
1778        QuicTestContext_free(&tclient);
1779        QuicTestContext_free(&tserver);
1780        wolfSSL_CTX_free(ctx_s2);
1781    }
1782
1783    wolfSSL_SESSION_free(session);
1784    wolfSSL_SESSION_free(session_restored);
1785    wolfSSL_CTX_free(ctx_c);
1786    wolfSSL_CTX_free(ctx_s);
1787
1788    printf("    test_quic_resumption: %s\n", EXPECT_SUCCESS() ? pass : fail);
1789    return EXPECT_RESULT();
1790}
1791
1792#ifdef WOLFSSL_EARLY_DATA
1793static int test_quic_early_data(int verbose) {
1794    EXPECT_DECLS;
1795    WOLFSSL_CTX *     ctx_c = NULL;
1796    WOLFSSL_CTX *     ctx_s = NULL;
1797    QuicTestContext   tclient, tserver;
1798    QuicConversation  conv;
1799    const byte        early_data[] = "Nulla dies sine linea!";
1800    size_t            ed_written = 0;
1801    WOLFSSL_SESSION * session = NULL;
1802    unsigned int      max_early_sz = 0;
1803
1804    ExpectNotNull(ctx_c = wolfSSL_CTX_new(wolfTLSv1_3_client_method()));
1805    wolfSSL_CTX_UseSessionTicket(ctx_c);
1806
1807    ExpectNotNull(ctx_s = wolfSSL_CTX_new(wolfTLSv1_3_server_method()));
1808    ExpectTrue(wolfSSL_CTX_use_certificate_file(ctx_s, svrCertFile,
1809               WOLFSSL_FILETYPE_PEM));
1810    ExpectTrue(wolfSSL_CTX_use_PrivateKey_file(ctx_s, svrKeyFile,
1811               WOLFSSL_FILETYPE_PEM));
1812
1813    /* setup ssls */
1814    QuicTestContext_init(&tclient, ctx_c, "client", verbose);
1815    QuicTestContext_init(&tserver, ctx_s, "server", verbose);
1816    wolfSSL_set_quic_early_data_enabled(tserver.ssl, 1);
1817    /* QUIC only allows 0xffffffff or 0x0 as values */
1818    ExpectIntEQ(wolfSSL_get_max_early_data(tserver.ssl), UINT32_MAX);
1819
1820    QuicConversation_init(&conv, &tclient, &tserver);
1821    /* run till end */
1822    QuicConversation_do(&conv);
1823    /* what have we seen? */
1824    ExpectStrEQ(conv.rec_log, "ClientHello:ServerHello:EncryptedExtension:"
1825        "Certificate:CertificateVerify:Finished:Finished:SessionTicket");
1826
1827    /* Should have received a session ticket, save the session */
1828    ExpectTrue(tclient.ticket_len > 0);
1829    ExpectNotNull(session = wolfSSL_get1_session(tclient.ssl));
1830    QuicTestContext_free(&tclient);
1831    QuicTestContext_free(&tserver);
1832
1833    /* check for error value with null argument */
1834    ExpectIntEQ(wolfSSL_SESSION_get_max_early_data(NULL), BAD_FUNC_ARG);
1835
1836    /* QUIC requires 0 or 0xffffffff as only allowed values.
1837     * Since we enabled early data in the server that created the session,
1838     * we need to see it here. */
1839    max_early_sz = wolfSSL_SESSION_get_max_early_data(session);
1840    ExpectIntEQ(max_early_sz, UINT32_MAX);
1841
1842    /* Do a Session resumption with the ticket */
1843    QuicTestContext_init(&tserver, ctx_s, "server", verbose);
1844    QuicTestContext_init(&tclient, ctx_c, "client", verbose);
1845    ExpectIntEQ(wolfSSL_set_session(tclient.ssl, session), WOLFSSL_SUCCESS);
1846    /* enable early data -*/
1847    wolfSSL_set_quic_early_data_enabled(tserver.ssl, 1);
1848    /* client will send, and server will receive implicitly */
1849    QuicConversation_init(&conv, &tclient, &tserver);
1850    QuicConversation_start(&conv, early_data, sizeof(early_data), &ed_written);
1851    QuicConversation_do(&conv);
1852    ExpectIntEQ(wolfSSL_get_early_data_status(tclient.ssl),
1853                WOLFSSL_EARLY_DATA_ACCEPTED);
1854
1855    QuicTestContext_free(&tclient);
1856    QuicTestContext_free(&tserver);
1857
1858    QuicTestContext_init(&tserver, ctx_s, "server", verbose);
1859    QuicTestContext_init(&tclient, ctx_c, "client", verbose);
1860    ExpectIntEQ(wolfSSL_set_session(tclient.ssl, session), WOLFSSL_SUCCESS);
1861    /* client will send, and server will receive */
1862    QuicConversation_init(&conv, &tclient, &tserver);
1863    /* make QuicConversation_do() use wolfSSL_read_early_data() */
1864    conv.accept_early_data = 1;
1865    QuicConversation_start(&conv, early_data, sizeof(early_data), &ed_written);
1866    QuicConversation_do(&conv);
1867    ExpectIntEQ(wolfSSL_get_early_data_status(tclient.ssl),
1868                WOLFSSL_EARLY_DATA_ACCEPTED);
1869    ExpectIntEQ(conv.early_data_len, sizeof(early_data));
1870    ExpectStrEQ(conv.early_data, (const char*)early_data);
1871
1872    QuicTestContext_free(&tclient);
1873    QuicTestContext_free(&tserver);
1874
1875    wolfSSL_SESSION_free(session);
1876    wolfSSL_CTX_free(ctx_c);
1877    wolfSSL_CTX_free(ctx_s);
1878    printf("    test_quic_early_data: %s\n", EXPECT_SUCCESS() ? pass : fail);
1879    return EXPECT_RESULT();
1880}
1881#endif /* WOLFSSL_EARLY_DATA */
1882
1883static int new_session_cb(WOLFSSL *ssl, WOLFSSL_SESSION *session)
1884{
1885    QuicTestContext * ctx = (QuicTestContext*)wolfSSL_get_app_data(ssl);
1886    byte * data = NULL;
1887    int    ret = 0;
1888    int    sz = 0;
1889
1890    AssertNotNull(ctx);
1891
1892    sz = wolfSSL_i2d_SSL_SESSION(session, NULL);
1893    if (sz <= 0) {
1894        printf("[%s] session serialization error: %d <- ", ctx->name, sz);
1895        return sz;
1896    }
1897    if ((size_t)sz > sizeof(ctx->session)) {
1898        printf("[%s] session serialization too large: %d <- ", ctx->name, sz);
1899        return -1;
1900    }
1901    data = ctx->session;
1902    ctx->session_len = (word32)wolfSSL_i2d_SSL_SESSION(session, &data);
1903    if (ctx->verbose) {
1904        printf("[%s]", ctx->name);
1905        dump_buffer(" new SESSION", ctx->session, ctx->session_len, 4);
1906    }
1907    return ret;
1908}
1909
1910static int test_quic_session_export(int verbose)
1911{
1912    EXPECT_DECLS;
1913    WOLFSSL_CTX *     ctx_c = NULL;
1914    WOLFSSL_CTX *     ctx_s = NULL;
1915    WOLFSSL_SESSION * session = NULL;
1916    QuicTestContext   tclient, tserver;
1917    QuicConversation  conv;
1918    byte              session_data[16*1024];
1919    const byte *      bp = NULL;
1920    word32            session_len = 0;
1921
1922    ExpectNotNull(ctx_c = wolfSSL_CTX_new(wolfTLSv1_3_client_method()));
1923    ExpectNotNull(ctx_s = wolfSSL_CTX_new(wolfTLSv1_3_server_method()));
1924    ExpectTrue(wolfSSL_CTX_use_certificate_file(ctx_s, svrCertFile,
1925               WOLFSSL_FILETYPE_PEM));
1926    ExpectTrue(wolfSSL_CTX_use_PrivateKey_file(ctx_s, svrKeyFile,
1927               WOLFSSL_FILETYPE_PEM));
1928
1929    /* Uses CTX session callback for new sessions */
1930    wolfSSL_CTX_sess_set_new_cb(ctx_c, new_session_cb);
1931
1932    /* setup ssls */
1933    QuicTestContext_init(&tclient, ctx_c, "client", verbose);
1934    QuicTestContext_init(&tserver, ctx_s, "server", verbose);
1935
1936    QuicConversation_init(&conv, &tclient, &tserver);
1937    /* run till end */
1938    QuicConversation_do(&conv);
1939    /* what have we seen? */
1940    ExpectStrEQ(conv.rec_log, "ClientHello:ServerHello:EncryptedExtension:"
1941                "Certificate:CertificateVerify:Finished:Finished:"
1942                "SessionTicket");
1943
1944    /* Should have received a session, save it */
1945    ExpectTrue(tclient.session_len > 0);
1946    memcpy(session_data, tclient.session, tclient.session_len);
1947    session_len = tclient.session_len;
1948    if (verbose)
1949        dump_buffer("copied SESSION", session_data, session_len, 0);
1950
1951    QuicTestContext_free(&tserver);
1952    QuicTestContext_free(&tclient);
1953
1954    /* Do a Session resumption with the ticket */
1955    QuicTestContext_init(&tserver, ctx_s, "server", verbose);
1956    QuicTestContext_init(&tclient, ctx_c, "client_resume", verbose);
1957    bp = session_data;
1958    ExpectNotNull(session = wolfSSL_d2i_SSL_SESSION(NULL, &bp, session_len));
1959    ExpectIntEQ(wolfSSL_set_session(tclient.ssl, session), WOLFSSL_SUCCESS);
1960    wolfSSL_SESSION_free(session);
1961
1962    /* let them talk */
1963    QuicConversation_init(&conv, &tclient, &tserver);
1964    QuicConversation_do(&conv);
1965    /* this is what should happen. Look Ma, no certificate! */
1966    ExpectStrEQ(conv.rec_log, "ClientHello:ServerHello:EncryptedExtension:"
1967                "Finished:Finished:SessionTicket");
1968
1969    QuicTestContext_free(&tclient);
1970    QuicTestContext_free(&tserver);
1971
1972    wolfSSL_CTX_free(ctx_c);
1973    wolfSSL_CTX_free(ctx_s);
1974    printf("    test_quic_session_export: %s\n", EXPECT_RESULT() ? pass : fail);
1975    return EXPECT_RESULT();
1976}
1977#endif /* WOLFSSL_SESSION_EXPORT */
1978#endif /* !NO_WOLFSSL_CLIENT && !NO_WOLFSSL_SERVER */
1979
1980#endif /* WOLFSSL_QUIC */
1981
1982
1983int QuicTest(void)
1984{
1985    int ret = 0;
1986#ifdef WOLFSSL_QUIC
1987#ifndef NO_WOLFSSL_CLIENT
1988    int verbose = 0;
1989#endif
1990
1991    if (wolfSSL_Init() != WOLFSSL_SUCCESS) {
1992        printf("wolfSSL_Init() failed in QuicTest().");
1993        return -1;
1994    }
1995
1996    printf(" Begin QUIC Tests\n");
1997
1998    if ((ret = test_set_quic_method()) != TEST_SUCCESS) goto leave;
1999#ifndef NO_WOLFSSL_CLIENT
2000    if ((ret = test_provide_quic_data()) != TEST_SUCCESS) goto leave;
2001    if ((ret = test_quic_record_cap()) != TEST_SUCCESS) goto leave;
2002    if ((ret = test_quic_crypt()) != TEST_SUCCESS) goto leave;
2003    if ((ret = test_quic_client_hello(verbose)) != TEST_SUCCESS) goto leave;
2004#endif
2005#if !defined(NO_WOLFSSL_CLIENT) && !defined(NO_WOLFSSL_SERVER)
2006    if ((ret = test_quic_server_hello(verbose)) != TEST_SUCCESS) goto leave;
2007    if ((ret = test_quic_server_hello_fail(verbose)) != TEST_SUCCESS) goto leave;
2008#ifdef REALLY_HAVE_ALPN_AND_SNI
2009    if ((ret = test_quic_alpn(verbose)) != TEST_SUCCESS) goto leave;
2010#endif /* REALLY_HAVE_ALPN_AND_SNI */
2011#ifdef HAVE_SESSION_TICKET
2012    if ((ret = test_quic_key_share(verbose)) != TEST_SUCCESS) goto leave;
2013    if ((ret = test_quic_resumption(verbose)) != TEST_SUCCESS) goto leave;
2014#ifdef WOLFSSL_EARLY_DATA
2015    if ((ret = test_quic_early_data(verbose)) != TEST_SUCCESS) goto leave;
2016#endif /* WOLFSSL_EARLY_DATA */
2017    if ((ret = test_quic_session_export(verbose)) != TEST_SUCCESS) goto leave;
2018#endif /* HAVE_SESSION_TICKET */
2019#endif
2020
2021leave:
2022    if (ret != TEST_SUCCESS) {
2023        printf("  FAILED: some tests did not pass.\n");
2024    }
2025    printf(" End QUIC Tests\n");
2026
2027    (void)wolfSSL_Cleanup();
2028#endif
2029    return ret == TEST_SUCCESS ? 0 : -1;
2030}