13 files changed, 1100 insertions, 905 deletions

diff --git a/libs/libcurl/src/vquic/curl_msh3.c b/libs/libcurl/src/vquic/curl_msh3.c
index 0ce9fe4cac..8f9590391f 100644
--- a/libs/libcurl/src/vquic/curl_msh3.c
+++ b/libs/libcurl/src/vquic/curl_msh3.c
@@ -22,30 +22,32 @@
  *

  ***************************************************************************/

 

-#include "curl_setup.h"

+#include "../curl_setup.h"

 

 #ifdef USE_MSH3

 

-#include "urldata.h"

-#include "hash.h"

-#include "timeval.h"

-#include "multiif.h"

-#include "sendf.h"

-#include "curl_trc.h"

-#include "cfilters.h"

-#include "cf-socket.h"

-#include "connect.h"

-#include "progress.h"

-#include "http1.h"

+#include "../urldata.h"

+#include "../hash.h"

+#include "../uint-hash.h"

+#include "../curlx/timeval.h"

+#include "../multiif.h"

+#include "../sendf.h"

+#include "../curl_trc.h"

+#include "../cfilters.h"

+#include "../cf-socket.h"

+#include "../connect.h"

+#include "../progress.h"

+#include "../http1.h"

 #include "curl_msh3.h"

-#include "socketpair.h"

-#include "vtls/vtls.h"

-#include "vquic/vquic.h"

+#include "../socketpair.h"

+#include "../vtls/vtls.h"

+#include "vquic.h"

+#include "vquic_int.h"

 

 /* The last 3 #include files should be in this order */

-#include "curl_printf.h"

-#include "curl_memory.h"

-#include "memdebug.h"

+#include "../curl_printf.h"

+#include "../curl_memory.h"

+#include "../memdebug.h"

 

 #ifdef CURL_DISABLE_SOCKETPAIR

 #error "MSH3 cannot be build with CURL_DISABLE_SOCKETPAIR set"

@@ -119,34 +121,42 @@ struct cf_msh3_ctx {
   struct cf_call_data call_data;

   struct curltime connect_started;   /* time the current attempt started */

   struct curltime handshake_at;      /* time connect handshake finished */

-  struct Curl_hash streams;          /* hash `data->mid` to `stream_ctx` */

+  struct uint_hash streams;          /* hash `data->mid` to `stream_ctx` */

   /* Flags written by msh3/msquic thread */

-  bool handshake_complete;

-  bool handshake_succeeded;

-  bool connected;

+  BIT(handshake_complete);

+  BIT(handshake_succeeded);

+  BIT(connected);

   BIT(initialized);

   /* Flags written by curl thread */

   BIT(verbose);

   BIT(active);

 };

 

-static void h3_stream_hash_free(void *stream);

+static void h3_stream_hash_free(unsigned int id, void *stream);

 

-static void cf_msh3_ctx_init(struct cf_msh3_ctx *ctx,

-                             const struct Curl_addrinfo *ai)

+static CURLcode cf_msh3_ctx_init(struct cf_msh3_ctx *ctx,

+                                 const struct Curl_addrinfo *ai)

 {

+  CURLcode result;

+

   DEBUGASSERT(!ctx->initialized);

-  Curl_hash_offt_init(&ctx->streams, 63, h3_stream_hash_free);

-  Curl_sock_assign_addr(&ctx->addr, ai, TRNSPRT_QUIC);

+  Curl_uint_hash_init(&ctx->streams, 63, h3_stream_hash_free);

+

+  result = Curl_sock_assign_addr(&ctx->addr, ai, TRNSPRT_QUIC);

+  if(result)

+    return result;

+

   ctx->sock[SP_LOCAL] = CURL_SOCKET_BAD;

   ctx->sock[SP_REMOTE] = CURL_SOCKET_BAD;

   ctx->initialized = TRUE;

+

+  return result;

 }

 

 static void cf_msh3_ctx_free(struct cf_msh3_ctx *ctx)

 {

   if(ctx && ctx->initialized) {

-    Curl_hash_destroy(&ctx->streams);

+    Curl_uint_hash_destroy(&ctx->streams);

   }

   free(ctx);

 }

@@ -161,7 +171,7 @@ static struct cf_msh3_ctx *h3_get_msh3_ctx(struct Curl_easy *data);
 /**

  * All about the H3 internals of a stream

  */

-struct stream_ctx {

+struct h3_stream_ctx {

   struct MSH3_REQUEST *req;

   struct bufq recvbuf;   /* h3 response */

 #ifdef _WIN32

@@ -172,33 +182,31 @@ struct stream_ctx {
   uint64_t error3; /* HTTP/3 stream error code */

   int status_code; /* HTTP status code */

   CURLcode recv_error;

-  bool closed;

-  bool reset;

-  bool upload_done;

-  bool firstheader;  /* FALSE until headers arrive */

-  bool recv_header_complete;

+  BIT(closed);

+  BIT(reset);

+  BIT(upload_done);

+  BIT(firstheader);  /* FALSE until headers arrive */

+  BIT(recv_header_complete);

 };

 

-#define H3_STREAM_CTX(ctx,data)   ((struct stream_ctx *)((data && ctx)? \

-                Curl_hash_offt_get(&(ctx)->streams, (data)->mid) : NULL))

-

-static void h3_stream_ctx_free(struct stream_ctx *stream)

+static void h3_stream_ctx_free(struct h3_stream_ctx *stream)

 {

   Curl_bufq_free(&stream->recvbuf);

   free(stream);

 }

 

-static void h3_stream_hash_free(void *stream)

+static void h3_stream_hash_free(unsigned int id, void *stream)

 {

+  (void)id;

   DEBUGASSERT(stream);

-  h3_stream_ctx_free((struct stream_ctx *)stream);

+  h3_stream_ctx_free((struct h3_stream_ctx *)stream);

 }

 

 static CURLcode h3_data_setup(struct Curl_cfilter *cf,

                               struct Curl_easy *data)

 {

   struct cf_msh3_ctx *ctx = cf->ctx;

-  struct stream_ctx *stream = H3_STREAM_CTX(ctx, data);

+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);

 

   if(stream)

     return CURLE_OK;

@@ -213,7 +221,7 @@ static CURLcode h3_data_setup(struct Curl_cfilter *cf,
                   H3_STREAM_RECV_CHUNKS, BUFQ_OPT_SOFT_LIMIT);

   CURL_TRC_CF(data, cf, "data setup");

 

-  if(!Curl_hash_offt_set(&ctx->streams, data->mid, stream)) {

+  if(!Curl_uint_hash_set(&ctx->streams, data->mid, stream)) {

     h3_stream_ctx_free(stream);

     return CURLE_OUT_OF_MEMORY;

   }

@@ -224,17 +232,17 @@ static CURLcode h3_data_setup(struct Curl_cfilter *cf,
 static void h3_data_done(struct Curl_cfilter *cf, struct Curl_easy *data)

 {

   struct cf_msh3_ctx *ctx = cf->ctx;

-  struct stream_ctx *stream = H3_STREAM_CTX(ctx, data);

+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);

 

   (void)cf;

   if(stream) {

     CURL_TRC_CF(data, cf, "easy handle is done");

-    Curl_hash_offt_remove(&ctx->streams, data->mid);

+    Curl_uint_hash_remove(&ctx->streams, data->mid);

   }

 }

 

 static void drain_stream_from_other_thread(struct Curl_easy *data,

-                                           struct stream_ctx *stream)

+                                           struct h3_stream_ctx *stream)

 {

   unsigned char bits;

 

@@ -252,7 +260,7 @@ static void h3_drain_stream(struct Curl_cfilter *cf,
                             struct Curl_easy *data)

 {

   struct cf_msh3_ctx *ctx = cf->ctx;

-  struct stream_ctx *stream = H3_STREAM_CTX(ctx, data);

+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);

   unsigned char bits;

 

   (void)cf;

@@ -351,7 +359,7 @@ static CURLcode write_resp_raw(struct Curl_easy *data,
                                const void *mem, size_t memlen)

 {

   struct cf_msh3_ctx *ctx = h3_get_msh3_ctx(data);

-  struct stream_ctx *stream = H3_STREAM_CTX(ctx, data);

+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);

   CURLcode result = CURLE_OK;

   ssize_t nwritten;

 

@@ -378,7 +386,7 @@ static void MSH3_CALL msh3_header_received(MSH3_REQUEST *Request,
 {

   struct Curl_easy *data = userp;

   struct cf_msh3_ctx *ctx = h3_get_msh3_ctx(data);

-  struct stream_ctx *stream = H3_STREAM_CTX(ctx, data);

+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);

   CURLcode result;

   (void)Request;

 

@@ -390,7 +398,7 @@ static void MSH3_CALL msh3_header_received(MSH3_REQUEST *Request,
   msh3_lock_acquire(&stream->recv_lock);

 

   if((hd->NameLength == 7) &&

-     !strncmp(HTTP_PSEUDO_STATUS, (char *)hd->Name, 7)) {

+     !strncmp(HTTP_PSEUDO_STATUS, (const char *)hd->Name, 7)) {

     char line[14]; /* status line is always 13 characters long */

     size_t ncopy;

 

@@ -429,14 +437,14 @@ static bool MSH3_CALL msh3_data_received(MSH3_REQUEST *Request,
 {

   struct Curl_easy *data = IfContext;

   struct cf_msh3_ctx *ctx = h3_get_msh3_ctx(data);

-  struct stream_ctx *stream = H3_STREAM_CTX(ctx, data);

+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);

   CURLcode result;

   bool rv = FALSE;

 

-  /* TODO: we would like to limit the amount of data we are buffer here.

-   * There seems to be no mechanism in msh3 to adjust flow control and

-   * it is undocumented what happens if we return FALSE here or less

-   * length (buflen is an inout parameter).

+  /* We would like to limit the amount of data we are buffer here. There seems

+   * to be no mechanism in msh3 to adjust flow control and it is undocumented

+   * what happens if we return FALSE here or less length (buflen is an inout

+   * parameter).

    */

   (void)Request;

   if(!stream)

@@ -469,7 +477,7 @@ static void MSH3_CALL msh3_complete(MSH3_REQUEST *Request, void *IfContext,
 {

   struct Curl_easy *data = IfContext;

   struct cf_msh3_ctx *ctx = h3_get_msh3_ctx(data);

-  struct stream_ctx *stream = H3_STREAM_CTX(ctx, data);

+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);

 

   (void)Request;

   if(!stream)

@@ -489,7 +497,7 @@ static void MSH3_CALL msh3_shutdown_complete(MSH3_REQUEST *Request,
 {

   struct Curl_easy *data = IfContext;

   struct cf_msh3_ctx *ctx = h3_get_msh3_ctx(data);

-  struct stream_ctx *stream = H3_STREAM_CTX(ctx, data);

+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);

 

   if(!stream)

     return;

@@ -502,7 +510,7 @@ static void MSH3_CALL msh3_data_sent(MSH3_REQUEST *Request,
 {

   struct Curl_easy *data = IfContext;

   struct cf_msh3_ctx *ctx = h3_get_msh3_ctx(data);

-  struct stream_ctx *stream = H3_STREAM_CTX(ctx, data);

+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);

   if(!stream)

     return;

   (void)Request;

@@ -515,7 +523,7 @@ static ssize_t recv_closed_stream(struct Curl_cfilter *cf,
                                   CURLcode *err)

 {

   struct cf_msh3_ctx *ctx = cf->ctx;

-  struct stream_ctx *stream = H3_STREAM_CTX(ctx, data);

+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);

   ssize_t nread = -1;

 

   if(!stream) {

@@ -549,7 +557,7 @@ out:
 static void set_quic_expire(struct Curl_cfilter *cf, struct Curl_easy *data)

 {

   struct cf_msh3_ctx *ctx = cf->ctx;

-  struct stream_ctx *stream = H3_STREAM_CTX(ctx, data);

+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);

 

   /* we have no indication from msh3 when it would be a good time

    * to juggle the connection again. So, we compromise by calling

@@ -567,7 +575,7 @@ static ssize_t cf_msh3_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
                             char *buf, size_t len, CURLcode *err)

 {

   struct cf_msh3_ctx *ctx = cf->ctx;

-  struct stream_ctx *stream = H3_STREAM_CTX(ctx, data);

+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);

   ssize_t nread = -1;

   struct cf_call_data save;

 

@@ -619,7 +627,7 @@ static ssize_t cf_msh3_send(struct Curl_cfilter *cf, struct Curl_easy *data,
                             CURLcode *err)

 {

   struct cf_msh3_ctx *ctx = cf->ctx;

-  struct stream_ctx *stream = H3_STREAM_CTX(ctx, data);

+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);

   struct h1_req_parser h1;

   struct dynhds h2_headers;

   MSH3_HEADER *nva = NULL;

@@ -695,8 +703,8 @@ static ssize_t cf_msh3_send(struct Curl_cfilter *cf, struct Curl_easy *data,
       goto out;

     }

 

-    /* TODO - msh3/msquic will hold onto this memory until the send complete

-       event. How do we make sure curl does not free it until then? */

+    /* msh3/msquic will hold onto this memory until the send complete event.

+       How do we make sure curl does not free it until then? */

     *err = CURLE_OK;

     nwritten = len;

   }

@@ -715,7 +723,7 @@ static void cf_msh3_adjust_pollset(struct Curl_cfilter *cf,
                                    struct easy_pollset *ps)

 {

   struct cf_msh3_ctx *ctx = cf->ctx;

-  struct stream_ctx *stream = H3_STREAM_CTX(ctx, data);

+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);

   struct cf_call_data save;

 

   CF_DATA_SAVE(save, cf, data);

@@ -735,7 +743,7 @@ static bool cf_msh3_data_pending(struct Curl_cfilter *cf,
                                  const struct Curl_easy *data)

 {

   struct cf_msh3_ctx *ctx = cf->ctx;

-  struct stream_ctx *stream = H3_STREAM_CTX(ctx, data);

+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);

   struct cf_call_data save;

   bool pending = FALSE;

 

@@ -744,12 +752,13 @@ static bool cf_msh3_data_pending(struct Curl_cfilter *cf,
   (void)cf;

   if(stream && stream->req) {

     msh3_lock_acquire(&stream->recv_lock);

-    CURL_TRC_CF((struct Curl_easy *)data, cf, "data pending = %zu",

+    CURL_TRC_CF((struct Curl_easy *)CURL_UNCONST(data), cf,

+                "data pending = %zu",

                 Curl_bufq_len(&stream->recvbuf));

     pending = !Curl_bufq_is_empty(&stream->recvbuf);

     msh3_lock_release(&stream->recv_lock);

     if(pending)

-      h3_drain_stream(cf, (struct Curl_easy *)data);

+      h3_drain_stream(cf, (struct Curl_easy *)CURL_UNCONST(data));

   }

 

   CF_DATA_RESTORE(cf, save);

@@ -772,7 +781,7 @@ static CURLcode cf_msh3_data_event(struct Curl_cfilter *cf,
                                    int event, int arg1, void *arg2)

 {

   struct cf_msh3_ctx *ctx = cf->ctx;

-  struct stream_ctx *stream = H3_STREAM_CTX(ctx, data);

+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);

   struct cf_call_data save;

   CURLcode result = CURLE_OK;

 

@@ -830,16 +839,10 @@ static CURLcode cf_connect_start(struct Curl_cfilter *cf,
   MSH3_SET_PORT(&addr, (uint16_t)cf->conn->remote_port);

 

   if(verify && (conn_config->CAfile || conn_config->CApath)) {

-    /* TODO: need a way to provide trust anchors to MSH3 */

-#ifdef DEBUGBUILD

-    /* we need this for our test cases to run */

-    CURL_TRC_CF(data, cf, "non-standard CA not supported, "

-                "switching off verifypeer in DEBUG mode");

-    verify = 0;

-#else

+    /* Note there's currently no way to provide trust anchors to MSH3 and

+       that causes tests to fail. */

     CURL_TRC_CF(data, cf, "non-standard CA not supported, "

                 "attempting with built-in verification");

-#endif

   }

 

   CURL_TRC_CF(data, cf, "connecting to %s:%d (verify=%d)",

@@ -875,13 +878,12 @@ static CURLcode cf_connect_start(struct Curl_cfilter *cf,
 

 static CURLcode cf_msh3_connect(struct Curl_cfilter *cf,

                                 struct Curl_easy *data,

-                                bool blocking, bool *done)

+                                bool *done)

 {

   struct cf_msh3_ctx *ctx = cf->ctx;

   struct cf_call_data save;

   CURLcode result = CURLE_OK;

 

-  (void)blocking;

   if(cf->connected) {

     *done = TRUE;

     return CURLE_OK;

@@ -899,18 +901,17 @@ static CURLcode cf_msh3_connect(struct Curl_cfilter *cf,
 

   *done = FALSE;

   if(!ctx->qconn) {

-    ctx->connect_started = Curl_now();

+    ctx->connect_started = curlx_now();

     result = cf_connect_start(cf, data);

     if(result)

       goto out;

   }

 

   if(ctx->handshake_complete) {

-    ctx->handshake_at = Curl_now();

+    ctx->handshake_at = curlx_now();

     if(ctx->handshake_succeeded) {

       CURL_TRC_CF(data, cf, "handshake succeeded");

       cf->conn->bits.multiplex = TRUE; /* at least potentially multiplexed */

-      cf->conn->httpversion = 30;

       cf->connected = TRUE;

       cf->conn->alpn = CURL_HTTP_VERSION_3;

       *done = TRUE;

@@ -999,7 +1000,7 @@ static CURLcode cf_msh3_query(struct Curl_cfilter *cf,
 

   switch(query) {

   case CF_QUERY_MAX_CONCURRENT: {

-    /* TODO: we do not have access to this so far, fake it */

+    /* We do not have access to this so far, fake it */

     (void)ctx;

     *pres1 = 100;

     return CURLE_OK;

@@ -1017,6 +1018,9 @@ static CURLcode cf_msh3_query(struct Curl_cfilter *cf,
       *when = ctx->handshake_at;

     return CURLE_OK;

   }

+  case CF_QUERY_HTTP_VERSION:

+    *pres1 = 30;

+    return CURLE_OK;

   default:

     break;

   }

@@ -1039,7 +1043,7 @@ static bool cf_msh3_conn_is_alive(struct Curl_cfilter *cf,
 

 struct Curl_cftype Curl_cft_http3 = {

   "HTTP/3",

-  CF_TYPE_IP_CONNECT | CF_TYPE_SSL | CF_TYPE_MULTIPLEX,

+  CF_TYPE_IP_CONNECT | CF_TYPE_SSL | CF_TYPE_MULTIPLEX | CF_TYPE_HTTP,

   0,

   cf_msh3_destroy,

   cf_msh3_connect,

@@ -1081,13 +1085,16 @@ CURLcode Curl_cf_msh3_create(struct Curl_cfilter **pcf,
 

   (void)data;

   (void)conn;

-  (void)ai; /* TODO: msh3 resolves itself? */

+  (void)ai; /* msh3 resolves itself? */

   ctx = calloc(1, sizeof(*ctx));

   if(!ctx) {

     result = CURLE_OUT_OF_MEMORY;

     goto out;

   }

-  cf_msh3_ctx_init(ctx, ai);

+

+  result = cf_msh3_ctx_init(ctx, ai);

+  if(result)

+    goto out;

 

   result = Curl_cf_create(&cf, &Curl_cft_http3, ctx);

 

diff --git a/libs/libcurl/src/vquic/curl_msh3.h b/libs/libcurl/src/vquic/curl_msh3.h
index e3f40c2ab9..259011499b 100644
--- a/libs/libcurl/src/vquic/curl_msh3.h
+++ b/libs/libcurl/src/vquic/curl_msh3.h
@@ -24,7 +24,7 @@
  *

  ***************************************************************************/

 

-#include "curl_setup.h"

+#include "../curl_setup.h"

 

 #ifdef USE_MSH3

 

diff --git a/libs/libcurl/src/vquic/curl_ngtcp2.c b/libs/libcurl/src/vquic/curl_ngtcp2.c
index b017b49ace..d5a9553677 100644
--- a/libs/libcurl/src/vquic/curl_ngtcp2.c
+++ b/libs/libcurl/src/vquic/curl_ngtcp2.c
@@ -22,7 +22,7 @@
  *

  ***************************************************************************/

 

-#include "curl_setup.h"

+#include "../curl_setup.h"

 

 #if defined(USE_NGTCP2) && defined(USE_NGHTTP3)

 #include <ngtcp2/ngtcp2.h>

@@ -32,48 +32,51 @@
 #include <openssl/err.h>

 #if defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)

 #include <ngtcp2/ngtcp2_crypto_boringssl.h>

+#elif defined(OPENSSL_QUIC_API2)

+#include <ngtcp2/ngtcp2_crypto_ossl.h>

 #else

 #include <ngtcp2/ngtcp2_crypto_quictls.h>

 #endif

-#include "vtls/openssl.h"

+#include "../vtls/openssl.h"

 #elif defined(USE_GNUTLS)

 #include <ngtcp2/ngtcp2_crypto_gnutls.h>

-#include "vtls/gtls.h"

+#include "../vtls/gtls.h"

 #elif defined(USE_WOLFSSL)

 #include <ngtcp2/ngtcp2_crypto_wolfssl.h>

-#include "vtls/wolfssl.h"

+#include "../vtls/wolfssl.h"

 #endif

 

-#include "urldata.h"

-#include "hash.h"

-#include "sendf.h"

-#include "strdup.h"

-#include "rand.h"

-#include "multiif.h"

-#include "strcase.h"

-#include "cfilters.h"

-#include "cf-socket.h"

-#include "connect.h"

-#include "progress.h"

-#include "strerror.h"

-#include "dynbuf.h"

-#include "http1.h"

-#include "select.h"

-#include "inet_pton.h"

-#include "transfer.h"

+#include "../urldata.h"

+#include "../uint-hash.h"

+#include "../sendf.h"

+#include "../strdup.h"

+#include "../rand.h"

+#include "../multiif.h"

+#include "../strcase.h"

+#include "../cfilters.h"

+#include "../cf-socket.h"

+#include "../connect.h"

+#include "../progress.h"

+#include "../strerror.h"

+#include "../curlx/dynbuf.h"

+#include "../http1.h"

+#include "../select.h"

+#include "../curlx/inet_pton.h"

+#include "../transfer.h"

 #include "vquic.h"

 #include "vquic_int.h"

 #include "vquic-tls.h"

-#include "vtls/keylog.h"

-#include "vtls/vtls.h"

+#include "../vtls/keylog.h"

+#include "../vtls/vtls.h"

+#include "../vtls/vtls_scache.h"

 #include "curl_ngtcp2.h"

 

-#include "warnless.h"

+#include "../curlx/warnless.h"

 

 /* The last 3 #include files should be in this order */

-#include "curl_printf.h"

-#include "curl_memory.h"

-#include "memdebug.h"

+#include "../curl_printf.h"

+#include "../curl_memory.h"

+#include "../memdebug.h"

 

 

 #define QUIC_MAX_STREAMS (256*1024)

@@ -86,6 +89,10 @@
  * Chunk size is large enough to take a full DATA frame */

 #define H3_STREAM_WINDOW_SIZE (128 * 1024)

 #define H3_STREAM_CHUNK_SIZE   (16 * 1024)

+#if H3_STREAM_CHUNK_SIZE < NGTCP2_MAX_UDP_PAYLOAD_SIZE

+#error H3_STREAM_CHUNK_SIZE smaller than NGTCP2_MAX_UDP_PAYLOAD_SIZE

+#endif

+

 /* The pool keeps spares around and half of a full stream windows

  * seems good. More does not seem to improve performance.

  * The benefit of the pool is that stream buffer to not keep

@@ -116,6 +123,9 @@ struct cf_ngtcp2_ctx {
   struct cf_quic_ctx q;

   struct ssl_peer peer;

   struct curl_tls_ctx tls;

+#ifdef OPENSSL_QUIC_API2

+  ngtcp2_crypto_ossl_ctx *ossl_ctx;

+#endif

   ngtcp2_path connected_path;

   ngtcp2_conn *qconn;

   ngtcp2_cid dcid;

@@ -132,13 +142,20 @@ struct cf_ngtcp2_ctx {
   struct curltime handshake_at;      /* time connect handshake finished */

   struct bufc_pool stream_bufcp;     /* chunk pool for streams */

   struct dynbuf scratch;             /* temp buffer for header construction */

-  struct Curl_hash streams;          /* hash `data->mid` to `h3_stream_ctx` */

+  struct uint_hash streams;          /* hash `data->mid` to `h3_stream_ctx` */

   size_t max_stream_window;          /* max flow window for one stream */

-  uint64_t max_idle_ms;              /* max idle time for QUIC connection */

   uint64_t used_bidi_streams;        /* bidi streams we have opened */

   uint64_t max_bidi_streams;         /* max bidi streams we can open */

+  size_t earlydata_max;              /* max amount of early data supported by

+                                        server on session reuse */

+  size_t earlydata_skip;            /* sending bytes to skip when earlydata

+                                     * is accepted by peer */

+  CURLcode tls_vrfy_result;          /* result of TLS peer verification */

   int qlogfd;

   BIT(initialized);

+  BIT(tls_handshake_complete);       /* TLS handshake is done */

+  BIT(use_earlydata);                /* Using 0RTT data */

+  BIT(earlydata_accepted);           /* 0RTT was acceptd by server */

   BIT(shutdown_started);             /* queued shutdown packets */

 };

 

@@ -147,7 +164,7 @@ struct cf_ngtcp2_ctx {
 #define CF_CTX_CALL_DATA(cf)  \

   ((struct cf_ngtcp2_ctx *)(cf)->ctx)->call_data

 

-static void h3_stream_hash_free(void *stream);

+static void h3_stream_hash_free(unsigned int id, void *stream);

 

 static void cf_ngtcp2_ctx_init(struct cf_ngtcp2_ctx *ctx)

 {

@@ -155,26 +172,64 @@ static void cf_ngtcp2_ctx_init(struct cf_ngtcp2_ctx *ctx)
   ctx->qlogfd = -1;

   ctx->version = NGTCP2_PROTO_VER_MAX;

   ctx->max_stream_window = H3_STREAM_WINDOW_SIZE;

-  ctx->max_idle_ms = CURL_QUIC_MAX_IDLE_MS;

   Curl_bufcp_init(&ctx->stream_bufcp, H3_STREAM_CHUNK_SIZE,

                   H3_STREAM_POOL_SPARES);

-  Curl_dyn_init(&ctx->scratch, CURL_MAX_HTTP_HEADER);

-  Curl_hash_offt_init(&ctx->streams, 63, h3_stream_hash_free);

+  curlx_dyn_init(&ctx->scratch, CURL_MAX_HTTP_HEADER);

+  Curl_uint_hash_init(&ctx->streams, 63, h3_stream_hash_free);

   ctx->initialized = TRUE;

 }

 

 static void cf_ngtcp2_ctx_free(struct cf_ngtcp2_ctx *ctx)

 {

   if(ctx && ctx->initialized) {

+    Curl_vquic_tls_cleanup(&ctx->tls);

+    vquic_ctx_free(&ctx->q);

     Curl_bufcp_free(&ctx->stream_bufcp);

-    Curl_dyn_free(&ctx->scratch);

-    Curl_hash_clean(&ctx->streams);

-    Curl_hash_destroy(&ctx->streams);

+    curlx_dyn_free(&ctx->scratch);

+    Curl_uint_hash_destroy(&ctx->streams);

     Curl_ssl_peer_cleanup(&ctx->peer);

   }

   free(ctx);

 }

 

+static void cf_ngtcp2_setup_keep_alive(struct Curl_cfilter *cf,

+                                       struct Curl_easy *data)

+{

+  struct cf_ngtcp2_ctx *ctx = cf->ctx;

+  const ngtcp2_transport_params *rp;

+  /* Peer should have sent us its transport parameters. If it

+  * announces a positive `max_idle_timeout` it will close the

+  * connection when it does not hear from us for that time.

+  *

+  * Some servers use this as a keep-alive timer at a rather low

+  * value. We are doing HTTP/3 here and waiting for the response

+  * to a request may take a considerable amount of time. We need

+  * to prevent the peer's QUIC stack from closing in this case.

+  */

+  if(!ctx->qconn)

+    return;

+

+  rp = ngtcp2_conn_get_remote_transport_params(ctx->qconn);

+  if(!rp || !rp->max_idle_timeout) {

+    ngtcp2_conn_set_keep_alive_timeout(ctx->qconn, UINT64_MAX);

+    CURL_TRC_CF(data, cf, "no peer idle timeout, unset keep-alive");

+  }

+  else if(!Curl_uint_hash_count(&ctx->streams)) {

+    ngtcp2_conn_set_keep_alive_timeout(ctx->qconn, UINT64_MAX);

+    CURL_TRC_CF(data, cf, "no active streams, unset keep-alive");

+  }

+  else {

+    ngtcp2_duration keep_ns;

+    keep_ns = (rp->max_idle_timeout > 1) ? (rp->max_idle_timeout / 2) : 1;

+    ngtcp2_conn_set_keep_alive_timeout(ctx->qconn, keep_ns);

+    CURL_TRC_CF(data, cf, "peer idle timeout is %" FMT_PRIu64 "ms, "

+                "set keep-alive to %" FMT_PRIu64 " ms.",

+                (curl_uint64_t)(rp->max_idle_timeout / NGTCP2_MILLISECONDS),

+                (curl_uint64_t)(keep_ns / NGTCP2_MILLISECONDS));

+  }

+}

+

+

 struct pkt_io_ctx;

 static CURLcode cf_progress_ingress(struct Curl_cfilter *cf,

                                     struct Curl_easy *data,

@@ -195,18 +250,13 @@ struct h3_stream_ctx {
   curl_off_t upload_left; /* number of request bytes left to upload */

   int status_code; /* HTTP status code */

   CURLcode xfer_result; /* result from xfer_resp_write(_hd) */

-  bool resp_hds_complete; /* we have a complete, final response */

-  bool closed; /* TRUE on stream close */

-  bool reset;  /* TRUE on stream reset */

-  bool send_closed; /* stream is local closed */

+  BIT(resp_hds_complete); /* we have a complete, final response */

+  BIT(closed); /* TRUE on stream close */

+  BIT(reset);  /* TRUE on stream reset */

+  BIT(send_closed); /* stream is local closed */

   BIT(quic_flow_blocked); /* stream is blocked by QUIC flow control */

 };

 

-#define H3_STREAM_CTX(ctx,data)   ((struct h3_stream_ctx *)(\

-            data? Curl_hash_offt_get(&(ctx)->streams, (data)->mid) : NULL))

-#define H3_STREAM_CTX_ID(ctx,id)  ((struct h3_stream_ctx *)(\

-            Curl_hash_offt_get(&(ctx)->streams, (id))))

-

 static void h3_stream_ctx_free(struct h3_stream_ctx *stream)

 {

   Curl_bufq_free(&stream->sendbuf);

@@ -214,8 +264,9 @@ static void h3_stream_ctx_free(struct h3_stream_ctx *stream)
   free(stream);

 }

 

-static void h3_stream_hash_free(void *stream)

+static void h3_stream_hash_free(unsigned int id, void *stream)

 {

+  (void)id;

   DEBUGASSERT(stream);

   h3_stream_ctx_free((struct h3_stream_ctx *)stream);

 }

@@ -243,11 +294,14 @@ static CURLcode h3_data_setup(struct Curl_cfilter *cf,
   stream->sendbuf_len_in_flight = 0;

   Curl_h1_req_parse_init(&stream->h1, H1_PARSE_DEFAULT_MAX_LINE_LEN);

 

-  if(!Curl_hash_offt_set(&ctx->streams, data->mid, stream)) {

+  if(!Curl_uint_hash_set(&ctx->streams, data->mid, stream)) {

     h3_stream_ctx_free(stream);

     return CURLE_OUT_OF_MEMORY;

   }

 

+  if(Curl_uint_hash_count(&ctx->streams) == 1)

+    cf_ngtcp2_setup_keep_alive(cf, data);

+

   return CURLE_OK;

 }

 

@@ -282,40 +336,10 @@ static void h3_data_done(struct Curl_cfilter *cf, struct Curl_easy *data)
     CURL_TRC_CF(data, cf, "[%" FMT_PRId64 "] easy handle is done",

                 stream->id);

     cf_ngtcp2_stream_close(cf, data, stream);

-    Curl_hash_offt_remove(&ctx->streams, data->mid);

-  }

-}

-

-static struct Curl_easy *get_stream_easy(struct Curl_cfilter *cf,

-                                         struct Curl_easy *data,

-                                         int64_t stream_id,

-                                         struct h3_stream_ctx **pstream)

-{

-  struct cf_ngtcp2_ctx *ctx = cf->ctx;

-  struct h3_stream_ctx *stream;

-

-  (void)cf;

-  stream = H3_STREAM_CTX(ctx, data);

-  if(stream && stream->id == stream_id) {

-    *pstream = stream;

-    return data;

-  }

-  else {

-    struct Curl_llist_node *e;

-    DEBUGASSERT(data->multi);

-    for(e = Curl_llist_head(&data->multi->process); e; e = Curl_node_next(e)) {

-      struct Curl_easy *sdata = Curl_node_elem(e);

-      if(sdata->conn != data->conn)

-        continue;

-      stream = H3_STREAM_CTX(ctx, sdata);

-      if(stream && stream->id == stream_id) {

-        *pstream = stream;

-        return sdata;

-      }

-    }

+    Curl_uint_hash_remove(&ctx->streams, data->mid);

+    if(!Curl_uint_hash_count(&ctx->streams))

+      cf_ngtcp2_setup_keep_alive(cf, data);

   }

-  *pstream = NULL;

-  return NULL;

 }

 

 static void h3_drain_stream(struct Curl_cfilter *cf,

@@ -383,7 +407,7 @@ static void quic_printf(void *user_data, const char *fmt, ...)
   struct Curl_cfilter *cf = user_data;

   struct cf_ngtcp2_ctx *ctx = cf->ctx;

 

-  (void)ctx;  /* TODO: need an easy handle to infof() message */

+  (void)ctx;  /* need an easy handle to infof() message */

   va_list ap;

   va_start(ap, fmt);

   vfprintf(stderr, fmt, ap);

@@ -436,18 +460,66 @@ static void quic_settings(struct cf_ngtcp2_ctx *ctx,
   t->initial_max_stream_data_uni = ctx->max_stream_window;

   t->initial_max_streams_bidi = QUIC_MAX_STREAMS;

   t->initial_max_streams_uni = QUIC_MAX_STREAMS;

-  t->max_idle_timeout = (ctx->max_idle_ms * NGTCP2_MILLISECONDS);

+  t->max_idle_timeout = 0; /* no idle timeout from our side */

   if(ctx->qlogfd != -1) {

     s->qlog_write = qlog_callback;

   }

 }

 

-static CURLcode init_ngh3_conn(struct Curl_cfilter *cf);

+static CURLcode init_ngh3_conn(struct Curl_cfilter *cf,

+                               struct Curl_easy *data);

 

-static int cb_handshake_completed(ngtcp2_conn *tconn, void *user_data)

+static int cf_ngtcp2_handshake_completed(ngtcp2_conn *tconn, void *user_data)

 {

-  (void)user_data;

+  struct Curl_cfilter *cf = user_data;

+  struct cf_ngtcp2_ctx *ctx = cf ? cf->ctx : NULL;

+  struct Curl_easy *data;

+

   (void)tconn;

+  DEBUGASSERT(ctx);

+  data = CF_DATA_CURRENT(cf);

+  DEBUGASSERT(data);

+  if(!ctx || !data)

+    return NGHTTP3_ERR_CALLBACK_FAILURE;

+

+  ctx->handshake_at = curlx_now();

+  ctx->tls_handshake_complete = TRUE;

+  cf->conn->bits.multiplex = TRUE; /* at least potentially multiplexed */

+

+  ctx->tls_vrfy_result = Curl_vquic_tls_verify_peer(&ctx->tls, cf,

+                                                    data, &ctx->peer);

+  CURL_TRC_CF(data, cf, "handshake complete after %dms",

+             (int)curlx_timediff(ctx->handshake_at, ctx->started_at));

+  /* In case of earlydata, where we simulate being connected, update

+   * the handshake time when we really did connect */

+  if(ctx->use_earlydata)

+    Curl_pgrsTimeWas(data, TIMER_APPCONNECT, ctx->handshake_at);

+  if(ctx->use_earlydata) {

+#if defined(USE_OPENSSL) && defined(HAVE_OPENSSL_EARLYDATA)

+    ctx->earlydata_accepted =

+      (SSL_get_early_data_status(ctx->tls.ossl.ssl) !=

+       SSL_EARLY_DATA_REJECTED);

+#endif

+#ifdef USE_GNUTLS

+    int flags = gnutls_session_get_flags(ctx->tls.gtls.session);

+    ctx->earlydata_accepted = !!(flags & GNUTLS_SFLAGS_EARLY_DATA);

+#endif

+#ifdef USE_WOLFSSL

+#ifdef WOLFSSL_EARLY_DATA

+    ctx->earlydata_accepted =

+      (wolfSSL_get_early_data_status(ctx->tls.wssl.ssl) !=

+       WOLFSSL_EARLY_DATA_REJECTED);

+#else

+    DEBUGASSERT(0); /* should not come here if ED is disabled. */

+    ctx->earlydata_accepted = FALSE;

+#endif /* WOLFSSL_EARLY_DATA */

+#endif

+    CURL_TRC_CF(data, cf, "server did%s accept %zu bytes of early data",

+                ctx->earlydata_accepted ? "" : " not", ctx->earlydata_skip);

+    Curl_pgrsEarlyData(data, ctx->earlydata_accepted ?

+                              (curl_off_t)ctx->earlydata_skip :

+                             -(curl_off_t)ctx->earlydata_skip);

+  }

   return 0;

 }

 

@@ -519,7 +591,7 @@ static int cb_recv_stream_data(ngtcp2_conn *tconn, uint32_t flags,
     CURL_TRC_CF(data, cf, "[%" FMT_PRId64 "] read_stream(len=%zu) -> %zd",

                 stream_id, buflen, nconsumed);

   if(nconsumed < 0) {

-    struct h3_stream_ctx *stream = H3_STREAM_CTX_ID(ctx, stream_id);

+    struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);

     if(data && stream) {

       CURL_TRC_CF(data, cf, "[%" FMT_PRId64 "] error on known stream, "

                   "reset=%d, closed=%d",

@@ -651,28 +723,26 @@ static int cb_extend_max_local_streams_bidi(ngtcp2_conn *tconn,
   return 0;

 }

 

-static int cb_extend_max_stream_data(ngtcp2_conn *tconn, int64_t sid,

+static int cb_extend_max_stream_data(ngtcp2_conn *tconn, int64_t stream_id,

                                      uint64_t max_data, void *user_data,

                                      void *stream_user_data)

 {

   struct Curl_cfilter *cf = user_data;

   struct cf_ngtcp2_ctx *ctx = cf->ctx;

-  curl_int64_t stream_id = (curl_int64_t)sid;

-  struct Curl_easy *data = CF_DATA_CURRENT(cf);

-  struct Curl_easy *s_data;

+  struct Curl_easy *s_data = stream_user_data;

   struct h3_stream_ctx *stream;

   int rv;

   (void)tconn;

   (void)max_data;

-  (void)stream_user_data;

 

   rv = nghttp3_conn_unblock_stream(ctx->h3conn, stream_id);

   if(rv && rv != NGHTTP3_ERR_STREAM_NOT_FOUND) {

     return NGTCP2_ERR_CALLBACK_FAILURE;

   }

-  s_data = get_stream_easy(cf, data, stream_id, &stream);

-  if(s_data && stream && stream->quic_flow_blocked) {

-    CURL_TRC_CF(s_data, cf, "[%" FMT_PRId64 "] unblock quic flow", stream_id);

+  stream = H3_STREAM_CTX(ctx, s_data);

+  if(stream && stream->quic_flow_blocked) {

+    CURL_TRC_CF(s_data, cf, "[%" FMT_PRId64 "] unblock quic flow",

+                (curl_int64_t)stream_id);

     stream->quic_flow_blocked = FALSE;

     h3_drain_stream(cf, s_data);

   }

@@ -717,16 +787,19 @@ static int cb_recv_rx_key(ngtcp2_conn *tconn, ngtcp2_encryption_level level,
                           void *user_data)

 {

   struct Curl_cfilter *cf = user_data;

+  struct cf_ngtcp2_ctx *ctx = cf ? cf->ctx : NULL;

+  struct Curl_easy *data = CF_DATA_CURRENT(cf);

   (void)tconn;

 

-  if(level != NGTCP2_ENCRYPTION_LEVEL_1RTT) {

+  if(level != NGTCP2_ENCRYPTION_LEVEL_1RTT)

     return 0;

-  }

 

-  if(init_ngh3_conn(cf) != CURLE_OK) {

-    return NGTCP2_ERR_CALLBACK_FAILURE;

+  DEBUGASSERT(ctx);

+  DEBUGASSERT(data);

+  if(ctx && data && !ctx->h3conn) {

+    if(init_ngh3_conn(cf, data))

+      return NGTCP2_ERR_CALLBACK_FAILURE;

   }

-

   return 0;

 }

 

@@ -739,7 +812,7 @@ static ngtcp2_callbacks ng_callbacks = {
   ngtcp2_crypto_client_initial_cb,

   NULL, /* recv_client_initial */

   ngtcp2_crypto_recv_crypto_data_cb,

-  cb_handshake_completed,

+  cf_ngtcp2_handshake_completed,

   NULL, /* recv_version_negotiation */

   ngtcp2_crypto_encrypt_cb,

   ngtcp2_crypto_decrypt_cb,

@@ -949,7 +1022,7 @@ static int cb_h3_recv_data(nghttp3_conn *conn, int64_t stream3_id,
   if(!stream)

     return NGHTTP3_ERR_CALLBACK_FAILURE;

 

-  h3_xfer_write_resp(cf, data, stream, (char *)buf, blen, FALSE);

+  h3_xfer_write_resp(cf, data, stream, (const char *)buf, blen, FALSE);

   if(blen) {

     CURL_TRC_CF(data, cf, "[%" FMT_PRId64 "] ACK %zu bytes of DATA",

                 stream->id, blen);

@@ -1032,18 +1105,18 @@ static int cb_h3_recv_header(nghttp3_conn *conn, int64_t sid,
                                      (const char *)h3val.base, h3val.len);

     if(result)

       return -1;

-    Curl_dyn_reset(&ctx->scratch);

-    result = Curl_dyn_addn(&ctx->scratch, STRCONST("HTTP/3 "));

+    curlx_dyn_reset(&ctx->scratch);

+    result = curlx_dyn_addn(&ctx->scratch, STRCONST("HTTP/3 "));

     if(!result)

-      result = Curl_dyn_addn(&ctx->scratch,

-                             (const char *)h3val.base, h3val.len);

+      result = curlx_dyn_addn(&ctx->scratch,

+                              (const char *)h3val.base, h3val.len);

     if(!result)

-      result = Curl_dyn_addn(&ctx->scratch, STRCONST(" \r\n"));

+      result = curlx_dyn_addn(&ctx->scratch, STRCONST(" \r\n"));

     if(!result)

-      h3_xfer_write_resp_hd(cf, data, stream, Curl_dyn_ptr(&ctx->scratch),

-                            Curl_dyn_len(&ctx->scratch), FALSE);

+      h3_xfer_write_resp_hd(cf, data, stream, curlx_dyn_ptr(&ctx->scratch),

+                            curlx_dyn_len(&ctx->scratch), FALSE);

     CURL_TRC_CF(data, cf, "[%" FMT_PRId64 "] status: %s",

-                stream_id, Curl_dyn_ptr(&ctx->scratch));

+                stream_id, curlx_dyn_ptr(&ctx->scratch));

     if(result) {

       return -1;

     }

@@ -1053,19 +1126,19 @@ static int cb_h3_recv_header(nghttp3_conn *conn, int64_t sid,
     CURL_TRC_CF(data, cf, "[%" FMT_PRId64 "] header: %.*s: %.*s",

                 stream_id, (int)h3name.len, h3name.base,

                 (int)h3val.len, h3val.base);

-    Curl_dyn_reset(&ctx->scratch);

-    result = Curl_dyn_addn(&ctx->scratch,

-                           (const char *)h3name.base, h3name.len);

+    curlx_dyn_reset(&ctx->scratch);

+    result = curlx_dyn_addn(&ctx->scratch,

+                            (const char *)h3name.base, h3name.len);

     if(!result)

-      result = Curl_dyn_addn(&ctx->scratch, STRCONST(": "));

+      result = curlx_dyn_addn(&ctx->scratch, STRCONST(": "));

     if(!result)

-      result = Curl_dyn_addn(&ctx->scratch,

-                             (const char *)h3val.base, h3val.len);

+      result = curlx_dyn_addn(&ctx->scratch,

+                              (const char *)h3val.base, h3val.len);

     if(!result)

-      result = Curl_dyn_addn(&ctx->scratch, STRCONST("\r\n"));

+      result = curlx_dyn_addn(&ctx->scratch, STRCONST("\r\n"));

     if(!result)

-      h3_xfer_write_resp_hd(cf, data, stream, Curl_dyn_ptr(&ctx->scratch),

-                            Curl_dyn_len(&ctx->scratch), FALSE);

+      h3_xfer_write_resp_hd(cf, data, stream, curlx_dyn_ptr(&ctx->scratch),

+                            curlx_dyn_len(&ctx->scratch), FALSE);

   }

   return 0;

 }

@@ -1128,14 +1201,15 @@ static nghttp3_callbacks ngh3_callbacks = {
   NULL /* recv_settings */

 };

 

-static CURLcode init_ngh3_conn(struct Curl_cfilter *cf)

+static CURLcode init_ngh3_conn(struct Curl_cfilter *cf,

+                               struct Curl_easy *data)

 {

   struct cf_ngtcp2_ctx *ctx = cf->ctx;

-  CURLcode result;

-  int rc;

   int64_t ctrl_stream_id, qpack_enc_stream_id, qpack_dec_stream_id;

+  int rc;

 

   if(ngtcp2_conn_get_streams_uni_left(ctx->qconn) < 3) {

+    failf(data, "QUIC connection lacks 3 uni streams to run HTTP/3");

     return CURLE_QUIC_CONNECT_ERROR;

   }

 

@@ -1147,45 +1221,47 @@ static CURLcode init_ngh3_conn(struct Curl_cfilter *cf)
                                nghttp3_mem_default(),

                                cf);

   if(rc) {

-    result = CURLE_OUT_OF_MEMORY;

-    goto fail;

+    failf(data, "error creating nghttp3 connection instance");

+    return CURLE_OUT_OF_MEMORY;

   }

 

   rc = ngtcp2_conn_open_uni_stream(ctx->qconn, &ctrl_stream_id, NULL);

   if(rc) {

-    result = CURLE_QUIC_CONNECT_ERROR;

-    goto fail;

+    failf(data, "error creating HTTP/3 control stream: %s",

+          ngtcp2_strerror(rc));

+    return CURLE_QUIC_CONNECT_ERROR;

   }

 

   rc = nghttp3_conn_bind_control_stream(ctx->h3conn, ctrl_stream_id);

   if(rc) {

-    result = CURLE_QUIC_CONNECT_ERROR;

-    goto fail;

+    failf(data, "error binding HTTP/3 control stream: %s",

+          ngtcp2_strerror(rc));

+    return CURLE_QUIC_CONNECT_ERROR;

   }

 

   rc = ngtcp2_conn_open_uni_stream(ctx->qconn, &qpack_enc_stream_id, NULL);

   if(rc) {

-    result = CURLE_QUIC_CONNECT_ERROR;

-    goto fail;

+    failf(data, "error creating HTTP/3 qpack encoding stream: %s",

+          ngtcp2_strerror(rc));

+    return CURLE_QUIC_CONNECT_ERROR;

   }

 

   rc = ngtcp2_conn_open_uni_stream(ctx->qconn, &qpack_dec_stream_id, NULL);

   if(rc) {

-    result = CURLE_QUIC_CONNECT_ERROR;

-    goto fail;

+    failf(data, "error creating HTTP/3 qpack decoding stream: %s",

+          ngtcp2_strerror(rc));

+    return CURLE_QUIC_CONNECT_ERROR;

   }

 

   rc = nghttp3_conn_bind_qpack_streams(ctx->h3conn, qpack_enc_stream_id,

                                        qpack_dec_stream_id);

   if(rc) {

-    result = CURLE_QUIC_CONNECT_ERROR;

-    goto fail;

+    failf(data, "error binding HTTP/3 qpack streams: %s",

+          ngtcp2_strerror(rc));

+    return CURLE_QUIC_CONNECT_ERROR;

   }

 

   return CURLE_OK;

-fail:

-

-  return result;

 }

 

 static ssize_t recv_closed_stream(struct Curl_cfilter *cf,

@@ -1236,6 +1312,10 @@ static ssize_t cf_ngtcp2_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
   DEBUGASSERT(ctx->h3conn);

   *err = CURLE_OK;

 

+  /* handshake verification failed in callback, do not recv anything */

+  if(ctx->tls_vrfy_result)

+    return ctx->tls_vrfy_result;

+

   pktx_init(&pktx, cf, data);

 

   if(!stream || ctx->shutdown_started) {

@@ -1346,7 +1426,7 @@ cb_h3_read_req_body(nghttp3_conn *conn, int64_t stream_id,
     while(nvecs < veccnt &&

           Curl_bufq_peek_at(&stream->sendbuf,

                             stream->sendbuf_len_in_flight,

-                            (const unsigned char **)&vec[nvecs].base,

+                            CURL_UNCONST(&vec[nvecs].base),

                             &vec[nvecs].len)) {

       stream->sendbuf_len_in_flight += vec[nvecs].len;

       nwritten += vec[nvecs].len;

@@ -1521,7 +1601,7 @@ static ssize_t cf_ngtcp2_send(struct Curl_cfilter *cf, struct Curl_easy *data,
 {

   struct cf_ngtcp2_ctx *ctx = cf->ctx;

   struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);

-  ssize_t sent = 0;

+  ssize_t sent = -1;

   struct cf_call_data save;

   struct pkt_io_ctx pktx;

   CURLcode result;

@@ -1533,18 +1613,20 @@ static ssize_t cf_ngtcp2_send(struct Curl_cfilter *cf, struct Curl_easy *data,
   pktx_init(&pktx, cf, data);

   *err = CURLE_OK;

 

-  (void)eos; /* TODO: use for stream EOF and block handling */

+  /* handshake verification failed in callback, do not send anything */

+  if(ctx->tls_vrfy_result)

+    return ctx->tls_vrfy_result;

+

+  (void)eos; /* use for stream EOF and block handling */

   result = cf_progress_ingress(cf, data, &pktx);

   if(result) {

     *err = result;

-    sent = -1;

   }

 

   if(!stream || stream->id < 0) {

     if(ctx->shutdown_started) {

       CURL_TRC_CF(data, cf, "cannot open stream on closed connection");

       *err = CURLE_SEND_ERROR;

-      sent = -1;

       goto out;

     }

     sent = h3_stream_open(cf, data, buf, len, err);

@@ -1558,7 +1640,6 @@ static ssize_t cf_ngtcp2_send(struct Curl_cfilter *cf, struct Curl_easy *data,
     CURL_TRC_CF(data, cf, "[%" FMT_PRId64 "] xfer write failed", stream->id);

     cf_ngtcp2_stream_close(cf, data, stream);

     *err = stream->xfer_result;

-    sent = -1;

     goto out;

   }

   else if(stream->closed) {

@@ -1583,7 +1664,6 @@ static ssize_t cf_ngtcp2_send(struct Curl_cfilter *cf, struct Curl_easy *data,
   else if(ctx->shutdown_started) {

     CURL_TRC_CF(data, cf, "cannot send on closed connection");

     *err = CURLE_SEND_ERROR;

-    sent = -1;

     goto out;

   }

   else {

@@ -1598,6 +1678,9 @@ static ssize_t cf_ngtcp2_send(struct Curl_cfilter *cf, struct Curl_easy *data,
     (void)nghttp3_conn_resume_stream(ctx->h3conn, stream->id);

   }

 

+  if(sent > 0 && !ctx->tls_handshake_complete && ctx->use_earlydata)

+    ctx->earlydata_skip += sent;

+

   result = cf_progress_egress(cf, data, &pktx);

   if(result) {

     *err = result;

@@ -1616,17 +1699,6 @@ out:
   return sent;

 }

 

-static CURLcode qng_verify_peer(struct Curl_cfilter *cf,

-                                struct Curl_easy *data)

-{

-  struct cf_ngtcp2_ctx *ctx = cf->ctx;

-

-  cf->conn->bits.multiplex = TRUE; /* at least potentially multiplexed */

-  cf->conn->httpversion = 30;

-

-  return Curl_vquic_tls_verify_peer(&ctx->tls, cf, data, &ctx->peer);

-}

-

 static CURLcode recv_pkt(const unsigned char *pkt, size_t pktlen,

                          struct sockaddr_storage *remote_addr,

                          socklen_t remote_addrlen, int ecn,

@@ -1696,7 +1768,7 @@ static ssize_t read_pkt_to_send(void *userp,
   uint32_t flags;

   int64_t stream_id;

   int fin;

-  ssize_t nwritten, n;

+  ssize_t nwritten = 0, n;

   veccnt = 0;

   stream_id = -1;

   fin = 0;

@@ -1708,13 +1780,12 @@ static ssize_t read_pkt_to_send(void *userp,
    * When ngtcp2 is happy (because it has no other frame that would fit

    * or it has nothing more to send), it returns the total length

    * of the assembled packet. This may be 0 if there was nothing to send. */

-  nwritten = 0;

   *err = CURLE_OK;

   for(;;) {

 

     if(ctx->h3conn && ngtcp2_conn_get_max_data_left(ctx->qconn)) {

       veccnt = nghttp3_conn_writev_stream(ctx->h3conn, &stream_id, &fin, vec,

-                                          sizeof(vec) / sizeof(vec[0]));

+                                          CURL_ARRAYSIZE(vec));

       if(veccnt < 0) {

         failf(x->data, "nghttp3_conn_writev_stream returned error: %s",

               nghttp3_strerror((int)veccnt));

@@ -1920,8 +1991,8 @@ static CURLcode h3_data_pause(struct Curl_cfilter *cf,
                               struct Curl_easy *data,

                               bool pause)

 {

-  /* TODO: there seems right now no API in ngtcp2 to shrink/enlarge

-   * the streams windows. As we do in HTTP/2. */

+  /* There seems to exist no API in ngtcp2 to shrink/enlarge the streams

+   * windows. As we do in HTTP/2. */

   if(!pause) {

     h3_drain_stream(cf, data);

     Curl_expire(data, 0, EXPIRE_RUN_NOW);

@@ -1946,9 +2017,6 @@ static CURLcode cf_ngtcp2_data_event(struct Curl_cfilter *cf,
   case CF_CTRL_DATA_PAUSE:

     result = h3_data_pause(cf, data, (arg1 != 0));

     break;

-  case CF_CTRL_DATA_DETACH:

-    h3_data_done(cf, data);

-    break;

   case CF_CTRL_DATA_DONE:

     h3_data_done(cf, data);

     break;

@@ -1991,10 +2059,20 @@ static void cf_ngtcp2_ctx_close(struct cf_ngtcp2_ctx *ctx)
   ctx->qlogfd = -1;

   Curl_vquic_tls_cleanup(&ctx->tls);

   vquic_ctx_free(&ctx->q);

-  if(ctx->h3conn)

+  if(ctx->h3conn) {

     nghttp3_conn_del(ctx->h3conn);

-  if(ctx->qconn)

+    ctx->h3conn = NULL;

+  }

+  if(ctx->qconn) {

     ngtcp2_conn_del(ctx->qconn);

+    ctx->qconn = NULL;

+  }

+#ifdef OPENSSL_QUIC_API2

+  if(ctx->ossl_ctx) {

+    ngtcp2_crypto_ossl_ctx_del(ctx->ossl_ctx);

+    ctx->ossl_ctx = NULL;

+  }

+#endif

   ctx->call_data = save;

 }

 

@@ -2034,6 +2112,7 @@ static CURLcode cf_ngtcp2_shutdown(struct Curl_cfilter *cf,
       }

     }

 

+    DEBUGASSERT(Curl_bufq_is_empty(&ctx->q.sendbuf));

     ctx->shutdown_started = TRUE;

     nwritten = ngtcp2_conn_write_connection_close(

       ctx->qconn, NULL, /* path */

@@ -2043,14 +2122,21 @@ static CURLcode cf_ngtcp2_shutdown(struct Curl_cfilter *cf,
     CURL_TRC_CF(data, cf, "start shutdown(err_type=%d, err_code=%"

                 FMT_PRIu64 ") -> %d", ctx->last_error.type,

                 (curl_uint64_t)ctx->last_error.error_code, (int)nwritten);

+    /* there are cases listed in ngtcp2 documentation where this call

+     * may fail. Since we are doing a connection shutdown as graceful

+     * as we can, such an error is ignored here. */

     if(nwritten > 0) {

-      Curl_bufq_write(&ctx->q.sendbuf, (const unsigned char *)buffer,

-                      (size_t)nwritten, &result);

+      /* Ignore amount written. sendbuf was empty and has always room for

+       * NGTCP2_MAX_UDP_PAYLOAD_SIZE. It can only completely fail, in which

+       * case `result` is set non zero. */

+      (void)Curl_bufq_write(&ctx->q.sendbuf, (const unsigned char *)buffer,

+                            (size_t)nwritten, &result);

       if(result) {

         CURL_TRC_CF(data, cf, "error %d adding shutdown packets to sendbuf, "

                     "aborting shutdown", result);

         goto out;

       }

+

       ctx->q.no_gso = TRUE;

       ctx->q.gsolen = (size_t)nwritten;

       ctx->q.split_len = 0;

@@ -2110,6 +2196,7 @@ static void cf_ngtcp2_destroy(struct Curl_cfilter *cf, struct Curl_easy *data)
 {

   CURL_TRC_CF(data, cf, "destroy");

   if(cf->ctx) {

+    cf_ngtcp2_close(cf, data);

     cf_ngtcp2_ctx_free(cf->ctx);

     cf->ctx = NULL;

   }

@@ -2131,7 +2218,24 @@ static int quic_ossl_new_session_cb(SSL *ssl, SSL_SESSION *ssl_sessionid)
   ctx = cf ? cf->ctx : NULL;

   data = cf ? CF_DATA_CURRENT(cf) : NULL;

   if(cf && data && ctx) {

-    Curl_ossl_add_session(cf, data, &ctx->peer, ssl_sessionid);

+    unsigned char *quic_tp = NULL;

+    size_t quic_tp_len = 0;

+#ifdef HAVE_OPENSSL_EARLYDATA

+    ngtcp2_ssize tplen;

+    uint8_t tpbuf[256];

+

+    tplen = ngtcp2_conn_encode_0rtt_transport_params(ctx->qconn, tpbuf,

+                                                     sizeof(tpbuf));

+    if(tplen < 0)

+      CURL_TRC_CF(data, cf, "error encoding 0RTT transport data: %s",

+                  ngtcp2_strerror((int)tplen));

+    else {

+      quic_tp = (unsigned char *)tpbuf;

+      quic_tp_len = (size_t)tplen;

+    }

+#endif

+    Curl_ossl_add_session(cf, data, ctx->peer.scache_key, ssl_sessionid,

+                          SSL_version(ssl), "h3", quic_tp, quic_tp_len);

     return 1;

   }

   return 0;

@@ -2139,6 +2243,24 @@ static int quic_ossl_new_session_cb(SSL *ssl, SSL_SESSION *ssl_sessionid)
 #endif /* USE_OPENSSL */

 

 #ifdef USE_GNUTLS

+

+static const char *gtls_hs_msg_name(int mtype)

+{

+  switch(mtype) {

+    case 1: return "ClientHello";

+    case 2: return "ServerHello";

+    case 4: return "SessionTicket";

+    case 8: return "EncryptedExtensions";

+    case 11: return "Certificate";

+    case 13: return "CertificateRequest";

+    case 15: return "CertificateVerify";

+    case 20: return "Finished";

+    case 24: return "KeyUpdate";

+    case 254: return "MessageHash";

+  }

+  return "Unknown";

+}

+

 static int quic_gtls_handshake_cb(gnutls_session_t session, unsigned int htype,

                                   unsigned when, unsigned int incoming,

                                   const gnutls_datum_t *msg)

@@ -2152,13 +2274,28 @@ static int quic_gtls_handshake_cb(gnutls_session_t session, unsigned int htype,
   if(when && cf && ctx) { /* after message has been processed */

     struct Curl_easy *data = CF_DATA_CURRENT(cf);

     DEBUGASSERT(data);

-    if(data) {

-      CURL_TRC_CF(data, cf, "handshake: %s message type %d",

-                  incoming ? "incoming" : "outgoing", htype);

-    }

+    if(!data)

+      return 0;

+    CURL_TRC_CF(data, cf, "SSL message: %s %s [%d]",

+                incoming ? "<-" : "->", gtls_hs_msg_name(htype), htype);

     switch(htype) {

     case GNUTLS_HANDSHAKE_NEW_SESSION_TICKET: {

-      (void)Curl_gtls_update_session_id(cf, data, session, &ctx->peer, "h3");

+      ngtcp2_ssize tplen;

+      uint8_t tpbuf[256];

+      unsigned char *quic_tp = NULL;

+      size_t quic_tp_len = 0;

+

+      tplen = ngtcp2_conn_encode_0rtt_transport_params(ctx->qconn, tpbuf,

+                                                       sizeof(tpbuf));

+      if(tplen < 0)

+        CURL_TRC_CF(data, cf, "error encoding 0RTT transport data: %s",

+                    ngtcp2_strerror((int)tplen));

+      else {

+        quic_tp = (unsigned char *)tpbuf;

+        quic_tp_len = (size_t)tplen;

+      }

+      (void)Curl_gtls_cache_session(cf, data, ctx->peer.scache_key,

+                                    session, 0, "h3", quic_tp, quic_tp_len);

       break;

     }

     default:

@@ -2181,16 +2318,32 @@ static int wssl_quic_new_session_cb(WOLFSSL *ssl, WOLFSSL_SESSION *session)
     struct Curl_easy *data = CF_DATA_CURRENT(cf);

     DEBUGASSERT(data);

     if(data && ctx) {

-      (void)wssl_cache_session(cf, data, &ctx->peer, session);

+      ngtcp2_ssize tplen;

+      uint8_t tpbuf[256];

+      unsigned char *quic_tp = NULL;

+      size_t quic_tp_len = 0;

+

+      tplen = ngtcp2_conn_encode_0rtt_transport_params(ctx->qconn, tpbuf,

+                                                       sizeof(tpbuf));

+      if(tplen < 0)

+        CURL_TRC_CF(data, cf, "error encoding 0RTT transport data: %s",

+                    ngtcp2_strerror((int)tplen));

+      else {

+        quic_tp = (unsigned char *)tpbuf;

+        quic_tp_len = (size_t)tplen;

+      }

+      (void)Curl_wssl_cache_session(cf, data, ctx->peer.scache_key,

+                                    session, wolfSSL_version(ssl),

+                                    "h3", quic_tp, quic_tp_len);

     }

   }

   return 0;

 }

 #endif /* USE_WOLFSSL */

 

-static CURLcode tls_ctx_setup(struct Curl_cfilter *cf,

-                              struct Curl_easy *data,

-                              void *user_data)

+static CURLcode cf_ngtcp2_tls_ctx_setup(struct Curl_cfilter *cf,

+                                        struct Curl_easy *data,

+                                        void *user_data)

 {

   struct curl_tls_ctx *ctx = user_data;

   struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);

@@ -2202,6 +2355,8 @@ static CURLcode tls_ctx_setup(struct Curl_cfilter *cf,
     failf(data, "ngtcp2_crypto_boringssl_configure_client_context failed");

     return CURLE_FAILED_INIT;

   }

+#elif defined(OPENSSL_QUIC_API2)

+  /* nothing to do */

 #else

   if(ngtcp2_crypto_quictls_configure_client_context(ctx->ossl.ssl_ctx) != 0) {

     failf(data, "ngtcp2_crypto_quictls_configure_client_context failed");

@@ -2231,18 +2386,80 @@ static CURLcode tls_ctx_setup(struct Curl_cfilter *cf,
   }

 

 #elif defined(USE_WOLFSSL)

-  if(ngtcp2_crypto_wolfssl_configure_client_context(ctx->wssl.ctx) != 0) {

+  if(ngtcp2_crypto_wolfssl_configure_client_context(ctx->wssl.ssl_ctx) != 0) {

     failf(data, "ngtcp2_crypto_wolfssl_configure_client_context failed");

     return CURLE_FAILED_INIT;

   }

   if(ssl_config->primary.cache_session) {

     /* Register to get notified when a new session is received */

-    wolfSSL_CTX_sess_set_new_cb(ctx->wssl.ctx, wssl_quic_new_session_cb);

+    wolfSSL_CTX_sess_set_new_cb(ctx->wssl.ssl_ctx, wssl_quic_new_session_cb);

   }

 #endif

   return CURLE_OK;

 }

 

+static CURLcode cf_ngtcp2_on_session_reuse(struct Curl_cfilter *cf,

+                                           struct Curl_easy *data,

+                                           struct alpn_spec *alpns,

+                                           struct Curl_ssl_session *scs,

+                                           bool *do_early_data)

+{

+  struct cf_ngtcp2_ctx *ctx = cf->ctx;

+  CURLcode result = CURLE_OK;

+

+  *do_early_data = FALSE;

+#if defined(USE_OPENSSL) && defined(HAVE_OPENSSL_EARLYDATA)

+  ctx->earlydata_max = scs->earlydata_max;

+#endif

+#ifdef USE_GNUTLS

+  ctx->earlydata_max =

+    gnutls_record_get_max_early_data_size(ctx->tls.gtls.session);

+#endif

+#ifdef USE_WOLFSSL

+#ifdef WOLFSSL_EARLY_DATA

+  ctx->earlydata_max = scs->earlydata_max;

+#else

+  ctx->earlydata_max = 0;

+#endif /* WOLFSSL_EARLY_DATA */

+#endif

+#if defined(USE_GNUTLS) || defined(USE_WOLFSSL) || \

+    (defined(USE_OPENSSL) && defined(HAVE_OPENSSL_EARLYDATA))

+  if((!ctx->earlydata_max)) {

+    CURL_TRC_CF(data, cf, "SSL session does not allow earlydata");

+  }

+  else if(!Curl_alpn_contains_proto(alpns, scs->alpn)) {

+    CURL_TRC_CF(data, cf, "SSL session from different ALPN, no early data");

+  }

+  else if(!scs->quic_tp || !scs->quic_tp_len) {

+    CURL_TRC_CF(data, cf, "no 0RTT transport parameters, no early data, ");

+  }

+  else {

+    int rv;

+    rv = ngtcp2_conn_decode_and_set_0rtt_transport_params(

+      ctx->qconn, (const uint8_t *)scs->quic_tp, scs->quic_tp_len);

+    if(rv)

+      CURL_TRC_CF(data, cf, "no early data, failed to set 0RTT transport "

+                  "parameters: %s", ngtcp2_strerror(rv));

+    else {

+      infof(data, "SSL session allows %zu bytes of early data, "

+            "reusing ALPN '%s'", ctx->earlydata_max, scs->alpn);

+      result = init_ngh3_conn(cf, data);

+      if(!result) {

+        ctx->use_earlydata = TRUE;

+        cf->connected = TRUE;

+        *do_early_data = TRUE;

+      }

+    }

+  }

+#else /* not supported in the TLS backend */

+  (void)data;

+  (void)ctx;

+  (void)scs;

+  (void)alpns;

+#endif

+  return result;

+}

+

 /*

  * Might be called twice for happy eyeballs.

  */

@@ -2256,23 +2473,11 @@ static CURLcode cf_connect_start(struct Curl_cfilter *cf,
   CURLcode result;

   const struct Curl_sockaddr_ex *sockaddr = NULL;

   int qfd;

+static const struct alpn_spec ALPN_SPEC_H3 = {

+  { "h3", "h3-29" }, 2

+};

 

   DEBUGASSERT(ctx->initialized);

-  result = Curl_ssl_peer_init(&ctx->peer, cf, TRNSPRT_QUIC);

-  if(result)

-    return result;

-

-#define H3_ALPN "\x2h3\x5h3-29"

-  result = Curl_vquic_tls_init(&ctx->tls, cf, data, &ctx->peer,

-                               H3_ALPN, sizeof(H3_ALPN) - 1,

-                               tls_ctx_setup, &ctx->tls, &ctx->conn_ref);

-  if(result)

-    return result;

-

-#ifdef USE_OPENSSL

-  SSL_set_quic_use_legacy_codepoint(ctx->tls.ossl.ssl, 0);

-#endif

-

   ctx->dcid.datalen = NGTCP2_MAX_CIDLEN;

   result = Curl_rand(data, ctx->dcid.data, NGTCP2_MAX_CIDLEN);

   if(result)

@@ -2314,27 +2519,45 @@ static CURLcode cf_connect_start(struct Curl_cfilter *cf,
   if(rc)

     return CURLE_QUIC_CONNECT_ERROR;

 

-#ifdef USE_OPENSSL

+  ctx->conn_ref.get_conn = get_conn;

+  ctx->conn_ref.user_data = cf;

+

+  result = Curl_vquic_tls_init(&ctx->tls, cf, data, &ctx->peer, &ALPN_SPEC_H3,

+                               cf_ngtcp2_tls_ctx_setup, &ctx->tls,

+                               &ctx->conn_ref,

+                               cf_ngtcp2_on_session_reuse);

+  if(result)

+    return result;

+

+#if defined(USE_OPENSSL) && defined(OPENSSL_QUIC_API2)

+  if(ngtcp2_crypto_ossl_ctx_new(&ctx->ossl_ctx, ctx->tls.ossl.ssl) != 0) {

+    failf(data, "ngtcp2_crypto_ossl_ctx_new failed");

+    return CURLE_FAILED_INIT;

+  }

+  ngtcp2_conn_set_tls_native_handle(ctx->qconn, ctx->ossl_ctx);

+  if(ngtcp2_crypto_ossl_configure_client_session(ctx->tls.ossl.ssl) != 0) {

+    failf(data, "ngtcp2_crypto_ossl_configure_client_session failed");

+    return CURLE_FAILED_INIT;

+  }

+#elif defined(USE_OPENSSL)

+  SSL_set_quic_use_legacy_codepoint(ctx->tls.ossl.ssl, 0);

   ngtcp2_conn_set_tls_native_handle(ctx->qconn, ctx->tls.ossl.ssl);

 #elif defined(USE_GNUTLS)

   ngtcp2_conn_set_tls_native_handle(ctx->qconn, ctx->tls.gtls.session);

 #elif defined(USE_WOLFSSL)

-  ngtcp2_conn_set_tls_native_handle(ctx->qconn, ctx->tls.wssl.handle);

+  ngtcp2_conn_set_tls_native_handle(ctx->qconn, ctx->tls.wssl.ssl);

 #else

   #error "ngtcp2 TLS backend not defined"

 #endif

 

   ngtcp2_ccerr_default(&ctx->last_error);

 

-  ctx->conn_ref.get_conn = get_conn;

-  ctx->conn_ref.user_data = cf;

-

   return CURLE_OK;

 }

 

 static CURLcode cf_ngtcp2_connect(struct Curl_cfilter *cf,

                                   struct Curl_easy *data,

-                                  bool blocking, bool *done)

+                                  bool *done)

 {

   struct cf_ngtcp2_ctx *ctx = cf->ctx;

   CURLcode result = CURLE_OK;

@@ -2349,13 +2572,13 @@ static CURLcode cf_ngtcp2_connect(struct Curl_cfilter *cf,
 

   /* Connect the UDP filter first */

   if(!cf->next->connected) {

-    result = Curl_conn_cf_connect(cf->next, data, blocking, done);

+    result = Curl_conn_cf_connect(cf->next, data, done);

     if(result || !*done)

       return result;

   }

 

   *done = FALSE;

-  now = Curl_now();

+  now = curlx_now();

   pktx_init(&pktx, cf, data);

 

   CF_DATA_SAVE(save, cf, data);

@@ -2365,6 +2588,11 @@ static CURLcode cf_ngtcp2_connect(struct Curl_cfilter *cf,
     result = cf_connect_start(cf, data, &pktx);

     if(result)

       goto out;

+    if(cf->connected) {

+      cf->conn->alpn = CURL_HTTP_VERSION_3;

+      *done = TRUE;

+      goto out;

+    }

     result = cf_progress_egress(cf, data, &pktx);

     /* we do not expect to be able to recv anything yet */

     goto out;

@@ -2379,10 +2607,7 @@ static CURLcode cf_ngtcp2_connect(struct Curl_cfilter *cf,
     goto out;

 

   if(ngtcp2_conn_get_handshake_completed(ctx->qconn)) {

-    ctx->handshake_at = now;

-    CURL_TRC_CF(data, cf, "handshake complete after %dms",

-               (int)Curl_timediff(now, ctx->started_at));

-    result = qng_verify_peer(cf, data);

+    result = ctx->tls_vrfy_result;

     if(!result) {

       CURL_TRC_CF(data, cf, "peer verified");

       cf->connected = TRUE;

@@ -2440,7 +2665,7 @@ static CURLcode cf_ngtcp2_query(struct Curl_cfilter *cf,
     }

     else if(ctx->max_bidi_streams) {

       uint64_t avail_bidi_streams = 0;

-      uint64_t max_streams = CONN_INUSE(cf->conn);

+      uint64_t max_streams = CONN_ATTACHED(cf->conn);

       if(ctx->max_bidi_streams > ctx->used_bidi_streams)

         avail_bidi_streams = ctx->max_bidi_streams - ctx->used_bidi_streams;

       max_streams += avail_bidi_streams;

@@ -2449,14 +2674,14 @@ static CURLcode cf_ngtcp2_query(struct Curl_cfilter *cf,
     else  /* transport params not arrived yet? take our default. */

       *pres1 = (int)Curl_multi_max_concurrent_streams(data->multi);

     CURL_TRC_CF(data, cf, "query conn[%" FMT_OFF_T "]: "

-                "MAX_CONCURRENT -> %d (%zu in use)",

-                cf->conn->connection_id, *pres1, CONN_INUSE(cf->conn));

+                "MAX_CONCURRENT -> %d (%u in use)",

+                cf->conn->connection_id, *pres1, CONN_ATTACHED(cf->conn));

     CF_DATA_RESTORE(cf, save);

     return CURLE_OK;

   }

   case CF_QUERY_CONNECT_REPLY_MS:

     if(ctx->q.got_first_byte) {

-      timediff_t ms = Curl_timediff(ctx->q.first_byte_at, ctx->started_at);

+      timediff_t ms = curlx_timediff(ctx->q.first_byte_at, ctx->started_at);

       *pres1 = (ms < INT_MAX) ? (int)ms : INT_MAX;

     }

     else

@@ -2474,6 +2699,9 @@ static CURLcode cf_ngtcp2_query(struct Curl_cfilter *cf,
       *when = ctx->handshake_at;

     return CURLE_OK;

   }

+  case CF_QUERY_HTTP_VERSION:

+    *pres1 = 30;

+    return CURLE_OK;

   default:

     break;

   }

@@ -2496,21 +2724,12 @@ static bool cf_ngtcp2_conn_is_alive(struct Curl_cfilter *cf,
   if(!ctx->qconn || ctx->shutdown_started)

     goto out;

 

-  /* Both sides of the QUIC connection announce they max idle times in

-   * the transport parameters. Look at the minimum of both and if

-   * we exceed this, regard the connection as dead. The other side

-   * may have completely purged it and will no longer respond

-   * to any packets from us. */

+  /* We do not announce a max idle timeout, but when the peer does

+   * it will close the connection when it expires. */

   rp = ngtcp2_conn_get_remote_transport_params(ctx->qconn);

-  if(rp) {

-    timediff_t idletime;

-    uint64_t idle_ms = ctx->max_idle_ms;

-

-    if(rp->max_idle_timeout &&

-      (rp->max_idle_timeout / NGTCP2_MILLISECONDS) < idle_ms)

-      idle_ms = (rp->max_idle_timeout / NGTCP2_MILLISECONDS);

-    idletime = Curl_timediff(Curl_now(), ctx->q.last_io);

-    if(idletime > 0 && (uint64_t)idletime > idle_ms)

+  if(rp && rp->max_idle_timeout) {

+    timediff_t idletime = curlx_timediff(curlx_now(), ctx->q.last_io);

+    if(idletime > 0 && (uint64_t)idletime > rp->max_idle_timeout)

       goto out;

   }

 

@@ -2536,7 +2755,7 @@ out:
 

 struct Curl_cftype Curl_cft_http3 = {

   "HTTP/3",

-  CF_TYPE_IP_CONNECT | CF_TYPE_SSL | CF_TYPE_MULTIPLEX,

+  CF_TYPE_IP_CONNECT | CF_TYPE_SSL | CF_TYPE_MULTIPLEX | CF_TYPE_HTTP,

   0,

   cf_ngtcp2_destroy,

   cf_ngtcp2_connect,

diff --git a/libs/libcurl/src/vquic/curl_ngtcp2.h b/libs/libcurl/src/vquic/curl_ngtcp2.h
index 7b8a158b76..313d853644 100644
--- a/libs/libcurl/src/vquic/curl_ngtcp2.h
+++ b/libs/libcurl/src/vquic/curl_ngtcp2.h
@@ -24,7 +24,7 @@
  *

  ***************************************************************************/

 

-#include "curl_setup.h"

+#include "../curl_setup.h"

 

 #if defined(USE_NGTCP2) && defined(USE_NGHTTP3)

 

@@ -33,6 +33,9 @@
 #endif

 

 #include <ngtcp2/ngtcp2_crypto.h>

+#ifdef OPENSSL_QUIC_API2

+#include <ngtcp2/ngtcp2_crypto_ossl.h>

+#endif

 #include <nghttp3/nghttp3.h>

 #ifdef USE_OPENSSL

 #include <openssl/ssl.h>

@@ -44,7 +47,7 @@
 

 struct Curl_cfilter;

 

-#include "urldata.h"

+#include "../urldata.h"

 

 void Curl_ngtcp2_ver(char *p, size_t len);

 

diff --git a/libs/libcurl/src/vquic/curl_osslq.c b/libs/libcurl/src/vquic/curl_osslq.c
index c3d695d415..3a7f9b185e 100644
--- a/libs/libcurl/src/vquic/curl_osslq.c
+++ b/libs/libcurl/src/vquic/curl_osslq.c
@@ -22,7 +22,7 @@
  *

  ***************************************************************************/

 

-#include "curl_setup.h"

+#include "../curl_setup.h"

 

 #if defined(USE_OPENSSL_QUIC) && defined(USE_NGHTTP3)

 

@@ -31,36 +31,36 @@
 #include <openssl/err.h>

 #include <nghttp3/nghttp3.h>

 

-#include "urldata.h"

-#include "hash.h"

-#include "sendf.h"

-#include "strdup.h"

-#include "rand.h"

-#include "multiif.h"

-#include "strcase.h"

-#include "cfilters.h"

-#include "cf-socket.h"

-#include "connect.h"

-#include "progress.h"

-#include "strerror.h"

-#include "dynbuf.h"

-#include "http1.h"

-#include "select.h"

-#include "inet_pton.h"

+#include "../urldata.h"

+#include "../hash.h"

+#include "../sendf.h"

+#include "../strdup.h"

+#include "../rand.h"

+#include "../multiif.h"

+#include "../strcase.h"

+#include "../cfilters.h"

+#include "../cf-socket.h"

+#include "../connect.h"

+#include "../progress.h"

+#include "../strerror.h"

+#include "../curlx/dynbuf.h"

+#include "../http1.h"

+#include "../select.h"

+#include "../curlx/inet_pton.h"

+#include "../uint-hash.h"

 #include "vquic.h"

 #include "vquic_int.h"

 #include "vquic-tls.h"

-#include "vtls/keylog.h"

-#include "vtls/vtls.h"

-#include "vtls/openssl.h"

+#include "../vtls/keylog.h"

+#include "../vtls/vtls.h"

+#include "../vtls/openssl.h"

 #include "curl_osslq.h"

-

-#include "warnless.h"

+#include "../curlx/warnless.h"

 

 /* The last 3 #include files should be in this order */

-#include "curl_printf.h"

-#include "curl_memory.h"

-#include "memdebug.h"

+#include "../curl_printf.h"

+#include "../curl_memory.h"

+#include "../memdebug.h"

 

 /* A stream window is the maximum amount we need to buffer for

  * each active transfer. We use HTTP/3 flow control and only ACK

@@ -82,10 +82,6 @@
 #define H3_STREAM_SEND_CHUNKS \

           (H3_STREAM_WINDOW_SIZE / H3_STREAM_CHUNK_SIZE)

 

-#ifndef ARRAYSIZE

-#define ARRAYSIZE(A) (sizeof(A)/sizeof((A)[0]))

-#endif

-

 #if defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)

 typedef uint32_t sslerr_t;

 #else

@@ -175,7 +171,7 @@ static CURLcode make_bio_addr(BIO_ADDR **pbio_addr,
   switch(addr->family) {

   case AF_INET: {

     struct sockaddr_in * const sin =

-      (struct sockaddr_in * const)(void *)&addr->curl_sa_addr;

+      (struct sockaddr_in * const)CURL_UNCONST(&addr->curl_sa_addr);

     if(!BIO_ADDR_rawmake(ba, AF_INET, &sin->sin_addr,

                          sizeof(sin->sin_addr), sin->sin_port)) {

       goto out;

@@ -186,7 +182,7 @@ static CURLcode make_bio_addr(BIO_ADDR **pbio_addr,
 #ifdef USE_IPV6

   case AF_INET6: {

     struct sockaddr_in6 * const sin =

-      (struct sockaddr_in6 * const)(void *)&addr->curl_sa_addr;

+      (struct sockaddr_in6 * const)CURL_UNCONST(&addr->curl_sa_addr);

     if(!BIO_ADDR_rawmake(ba, AF_INET6, &sin->sin6_addr,

                          sizeof(sin->sin6_addr), sin->sin6_port)) {

     }

@@ -289,9 +285,12 @@ struct cf_osslq_ctx {
   struct curltime handshake_at;      /* time connect handshake finished */

   struct curltime first_byte_at;     /* when first byte was recvd */

   struct bufc_pool stream_bufcp;     /* chunk pool for streams */

-  struct Curl_hash streams;          /* hash `data->mid` to `h3_stream_ctx` */

+  struct uint_hash streams;          /* hash `data->mid` to `h3_stream_ctx` */

   size_t max_stream_window;          /* max flow window for one stream */

   uint64_t max_idle_ms;              /* max idle time for QUIC connection */

+  SSL_POLL_ITEM *poll_items;         /* Array for polling on writable state */

+  struct Curl_easy **curl_items;     /* Array of easy objs */

+  size_t items_max;                  /* max elements in poll/curl_items */

   BIT(initialized);

   BIT(got_first_byte);               /* if first byte was received */

   BIT(x509_store_setup);             /* if x509 store has been set up */

@@ -300,14 +299,17 @@ struct cf_osslq_ctx {
   BIT(need_send);                    /* QUIC connection needs to send */

 };

 

-static void h3_stream_hash_free(void *stream);

+static void h3_stream_hash_free(unsigned int id, void *stream);

 

 static void cf_osslq_ctx_init(struct cf_osslq_ctx *ctx)

 {

   DEBUGASSERT(!ctx->initialized);

   Curl_bufcp_init(&ctx->stream_bufcp, H3_STREAM_CHUNK_SIZE,

                   H3_STREAM_POOL_SPARES);

-  Curl_hash_offt_init(&ctx->streams, 63, h3_stream_hash_free);

+  Curl_uint_hash_init(&ctx->streams, 63, h3_stream_hash_free);

+  ctx->poll_items = NULL;

+  ctx->curl_items = NULL;

+  ctx->items_max = 0;

   ctx->initialized = TRUE;

 }

 

@@ -315,9 +317,10 @@ static void cf_osslq_ctx_free(struct cf_osslq_ctx *ctx)
 {

   if(ctx && ctx->initialized) {

     Curl_bufcp_free(&ctx->stream_bufcp);

-    Curl_hash_clean(&ctx->streams);

-    Curl_hash_destroy(&ctx->streams);

+    Curl_uint_hash_destroy(&ctx->streams);

     Curl_ssl_peer_cleanup(&ctx->peer);

+    free(ctx->poll_items);

+    free(ctx->curl_items);

   }

   free(ctx);

 }

@@ -450,7 +453,7 @@ static CURLcode cf_osslq_h3conn_add_stream(struct cf_osslq_h3conn *h3,
   struct cf_osslq_ctx *ctx = cf->ctx;

   curl_int64_t stream_id = (curl_int64_t)SSL_get_stream_id(stream_ssl);

 

-  if(h3->remote_ctrl_n >= ARRAYSIZE(h3->remote_ctrl)) {

+  if(h3->remote_ctrl_n >= CURL_ARRAYSIZE(h3->remote_ctrl)) {

     /* rejected, we are full */

     CURL_TRC_CF(data, cf, "[%" FMT_PRId64 "] rejecting remote stream",

                 stream_id);

@@ -562,7 +565,6 @@ static CURLcode cf_osslq_verify_peer(struct Curl_cfilter *cf,
   struct cf_osslq_ctx *ctx = cf->ctx;

 

   cf->conn->bits.multiplex = TRUE; /* at least potentially multiplexed */

-  cf->conn->httpversion = 30;

 

   return Curl_vquic_tls_verify_peer(&ctx->tls, cf, data, &ctx->peer);

 }

@@ -581,16 +583,13 @@ struct h3_stream_ctx {
   curl_off_t upload_left; /* number of request bytes left to upload */

   curl_off_t download_recvd; /* number of response DATA bytes received */

   int status_code; /* HTTP status code */

-  bool resp_hds_complete; /* we have a complete, final response */

-  bool closed; /* TRUE on stream close */

-  bool reset;  /* TRUE on stream reset */

-  bool send_closed; /* stream is local closed */

+  BIT(resp_hds_complete); /* we have a complete, final response */

+  BIT(closed); /* TRUE on stream close */

+  BIT(reset);  /* TRUE on stream reset */

+  BIT(send_closed); /* stream is local closed */

   BIT(quic_flow_blocked); /* stream is blocked by QUIC flow control */

 };

 

-#define H3_STREAM_CTX(ctx,data)   ((struct h3_stream_ctx *)(\

-            data? Curl_hash_offt_get(&(ctx)->streams, (data)->mid) : NULL))

-

 static void h3_stream_ctx_free(struct h3_stream_ctx *stream)

 {

   cf_osslq_stream_cleanup(&stream->s);

@@ -600,8 +599,9 @@ static void h3_stream_ctx_free(struct h3_stream_ctx *stream)
   free(stream);

 }

 

-static void h3_stream_hash_free(void *stream)

+static void h3_stream_hash_free(unsigned int id, void *stream)

 {

+  (void)id;

   DEBUGASSERT(stream);

   h3_stream_ctx_free((struct h3_stream_ctx *)stream);

 }

@@ -634,7 +634,7 @@ static CURLcode h3_data_setup(struct Curl_cfilter *cf,
   stream->recv_buf_nonflow = 0;

   Curl_h1_req_parse_init(&stream->h1, H1_PARSE_DEFAULT_MAX_LINE_LEN);

 

-  if(!Curl_hash_offt_set(&ctx->streams, data->mid, stream)) {

+  if(!Curl_uint_hash_set(&ctx->streams, data->mid, stream)) {

     h3_stream_ctx_free(stream);

     return CURLE_OUT_OF_MEMORY;

   }

@@ -651,7 +651,7 @@ static void h3_data_done(struct Curl_cfilter *cf, struct Curl_easy *data)
   if(stream) {

     CURL_TRC_CF(data, cf, "[%"FMT_PRId64"] easy handle is done",

                 stream->s.id);

-    if(ctx->h3.conn && !stream->closed) {

+    if(ctx->h3.conn && (stream->s.id >= 0) && !stream->closed) {

       nghttp3_conn_shutdown_stream_read(ctx->h3.conn, stream->s.id);

       nghttp3_conn_close_stream(ctx->h3.conn, stream->s.id,

                                 NGHTTP3_H3_REQUEST_CANCELLED);

@@ -659,8 +659,26 @@ static void h3_data_done(struct Curl_cfilter *cf, struct Curl_easy *data)
       stream->closed = TRUE;

     }

 

-    Curl_hash_offt_remove(&ctx->streams, data->mid);

+    Curl_uint_hash_remove(&ctx->streams, data->mid);

+  }

+}

+

+struct cf_ossq_find_ctx {

+  curl_int64_t stream_id;

+  struct h3_stream_ctx *stream;

+};

+

+static bool cf_osslq_find_stream(unsigned int mid, void *val, void *user_data)

+{

+  struct h3_stream_ctx *stream = val;

+  struct cf_ossq_find_ctx *fctx = user_data;

+

+  (void)mid;

+  if(stream && stream->s.id == fctx->stream_id) {

+    fctx->stream = stream;

+    return FALSE; /* stop iterating */

   }

+  return TRUE;

 }

 

 static struct cf_osslq_stream *cf_osslq_get_qstream(struct Curl_cfilter *cf,

@@ -683,17 +701,12 @@ static struct cf_osslq_stream *cf_osslq_get_qstream(struct Curl_cfilter *cf,
     return &ctx->h3.s_qpack_dec;

   }

   else {

-    struct Curl_llist_node *e;

-    DEBUGASSERT(data->multi);

-    for(e = Curl_llist_head(&data->multi->process); e; e = Curl_node_next(e)) {

-      struct Curl_easy *sdata = Curl_node_elem(e);

-      if(sdata->conn != data->conn)

-        continue;

-      stream = H3_STREAM_CTX(ctx, sdata);

-      if(stream && stream->s.id == stream_id) {

-        return &stream->s;

-      }

-    }

+    struct cf_ossq_find_ctx fctx;

+    fctx.stream_id = stream_id;

+    fctx.stream = NULL;

+    Curl_uint_hash_visit(&ctx->streams, cf_osslq_find_stream, &fctx);

+    if(fctx.stream)

+      return &fctx.stream->s;

   }

   return NULL;

 }

@@ -816,7 +829,7 @@ static int cb_h3_recv_data(nghttp3_conn *conn, int64_t stream3_id,
     return NGHTTP3_ERR_CALLBACK_FAILURE;

   }

   stream->download_recvd += (curl_off_t)buflen;

-  CURL_TRC_CF(data, cf, "[%" FMT_PRId64 "] DATA len=%zu, total=%zd",

+  CURL_TRC_CF(data, cf, "[%" FMT_PRId64 "] DATA len=%zu, total=%" FMT_OFF_T,

               stream->s.id, buflen, stream->download_recvd);

   h3_drain_stream(cf, data);

   return 0;

@@ -1009,7 +1022,7 @@ cb_h3_read_req_body(nghttp3_conn *conn, int64_t stream_id,
     while(nvecs < veccnt &&

           Curl_bufq_peek_at(&stream->sendbuf,

                             stream->sendbuf_len_in_flight,

-                            (const unsigned char **)&vec[nvecs].base,

+                            CURL_UNCONST(&vec[nvecs].base),

                             &vec[nvecs].len)) {

       stream->sendbuf_len_in_flight += vec[nvecs].len;

       nwritten += vec[nvecs].len;

@@ -1160,16 +1173,15 @@ static CURLcode cf_osslq_ctx_start(struct Curl_cfilter *cf,
   const struct Curl_sockaddr_ex *peer_addr = NULL;

   BIO *bio = NULL;

   BIO_ADDR *baddr = NULL;

+static const struct alpn_spec ALPN_SPEC_H3 = {

+  { "h3" }, 1

+};

 

   DEBUGASSERT(ctx->initialized);

-  result = Curl_ssl_peer_init(&ctx->peer, cf, TRNSPRT_QUIC);

-  if(result)

-    goto out;

 

 #define H3_ALPN "\x2h3"

   result = Curl_vquic_tls_init(&ctx->tls, cf, data, &ctx->peer,

-                               H3_ALPN, sizeof(H3_ALPN) - 1,

-                               NULL, NULL, NULL);

+                               &ALPN_SPEC_H3, NULL, NULL, NULL, NULL);

   if(result)

     goto out;

 

@@ -1224,17 +1236,6 @@ static CURLcode cf_osslq_ctx_start(struct Curl_cfilter *cf,
     goto out;

   }

 

-#ifdef SSL_VALUE_QUIC_IDLE_TIMEOUT

-  /* Added in OpenSSL v3.3.x */

-  if(!SSL_set_feature_request_uint(ctx->tls.ossl.ssl,

-                                   SSL_VALUE_QUIC_IDLE_TIMEOUT,

-                                   CURL_QUIC_MAX_IDLE_MS)) {

-    CURL_TRC_CF(data, cf, "error setting idle timeout, ");

-    result = CURLE_FAILED_INIT;

-    goto out;

-  }

-#endif

-

   SSL_set_bio(ctx->tls.ossl.ssl, bio, bio);

   bio = NULL;

   SSL_set_connect_state(ctx->tls.ossl.ssl);

@@ -1399,6 +1400,29 @@ out:
   return result;

 }

 

+struct cf_ossq_recv_ctx {

+  struct Curl_cfilter *cf;

+  struct Curl_multi *multi;

+  CURLcode result;

+};

+

+static bool cf_osslq_iter_recv(unsigned int mid, void *val, void *user_data)

+{

+  struct h3_stream_ctx *stream = val;

+  struct cf_ossq_recv_ctx *rctx = user_data;

+

+  (void)mid;

+  if(stream && !stream->closed && !Curl_bufq_is_full(&stream->recvbuf)) {

+    struct Curl_easy *sdata = Curl_multi_get_easy(rctx->multi, mid);

+    if(sdata) {

+      rctx->result = cf_osslq_stream_recv(&stream->s, rctx->cf, sdata);

+      if(rctx->result)

+        return FALSE; /* abort iteration */

+    }

+  }

+  return TRUE;

+}

+

 static CURLcode cf_progress_ingress(struct Curl_cfilter *cf,

                                     struct Curl_easy *data)

 {

@@ -1435,22 +1459,14 @@ static CURLcode cf_progress_ingress(struct Curl_cfilter *cf,
   }

 

   if(ctx->h3.conn) {

-    struct Curl_llist_node *e;

-    struct h3_stream_ctx *stream;

-    /* PULL all open streams */

+    struct cf_ossq_recv_ctx rctx;

+

     DEBUGASSERT(data->multi);

-    for(e = Curl_llist_head(&data->multi->process); e; e = Curl_node_next(e)) {

-      struct Curl_easy *sdata = Curl_node_elem(e);

-      if(sdata->conn == data->conn && CURL_WANT_RECV(sdata)) {

-        stream = H3_STREAM_CTX(ctx, sdata);

-        if(stream && !stream->closed &&

-           !Curl_bufq_is_full(&stream->recvbuf)) {

-          result = cf_osslq_stream_recv(&stream->s, cf, sdata);

-          if(result)

-            goto out;

-        }

-      }

-    }

+    rctx.cf = cf;

+    rctx.multi = data->multi;

+    rctx.result = CURLE_OK;

+    Curl_uint_hash_visit(&ctx->streams, cf_osslq_iter_recv, &rctx);

+    result = rctx.result;

   }

 

 out:

@@ -1458,30 +1474,109 @@ out:
   return result;

 }

 

+struct cf_ossq_fill_ctx {

+  struct cf_osslq_ctx *ctx;

+  struct Curl_multi *multi;

+  size_t n;

+};

+

+static bool cf_osslq_collect_block_send(unsigned int mid, void *val,

+                                        void *user_data)

+{

+  struct h3_stream_ctx *stream = val;

+  struct cf_ossq_fill_ctx *fctx = user_data;

+  struct cf_osslq_ctx *ctx = fctx->ctx;

+

+  if(fctx->n >= ctx->items_max)  /* should not happen, prevent mayhem */

+    return FALSE;

+

+  if(stream && stream->s.ssl && stream->s.send_blocked) {

+    struct Curl_easy *sdata = Curl_multi_get_easy(fctx->multi, mid);

+    if(sdata) {

+      ctx->poll_items[fctx->n].desc = SSL_as_poll_descriptor(stream->s.ssl);

+      ctx->poll_items[fctx->n].events = SSL_POLL_EVENT_W;

+      ctx->curl_items[fctx->n] = sdata;

+      fctx->n++;

+    }

+  }

+  return TRUE;

+}

+

 /* Iterate over all streams and check if blocked can be unblocked */

 static CURLcode cf_osslq_check_and_unblock(struct Curl_cfilter *cf,

                                            struct Curl_easy *data)

 {

   struct cf_osslq_ctx *ctx = cf->ctx;

   struct h3_stream_ctx *stream;

+  size_t poll_count;

+  size_t result_count = 0;

+  size_t idx_count = 0;

+  CURLcode res = CURLE_OK;

+  struct timeval timeout;

+  void *tmpptr;

 

   if(ctx->h3.conn) {

-    struct Curl_llist_node *e;

-    for(e = Curl_llist_head(&data->multi->process); e; e = Curl_node_next(e)) {

-      struct Curl_easy *sdata = Curl_node_elem(e);

-      if(sdata->conn == data->conn) {

-        stream = H3_STREAM_CTX(ctx, sdata);

-        if(stream && stream->s.ssl && stream->s.send_blocked &&

-           !SSL_want_write(stream->s.ssl)) {

-          nghttp3_conn_unblock_stream(ctx->h3.conn, stream->s.id);

-          stream->s.send_blocked = FALSE;

-          h3_drain_stream(cf, sdata);

-          CURL_TRC_CF(sdata, cf, "unblocked");

+    struct cf_ossq_fill_ctx fill_ctx;

+

+    if(ctx->items_max < Curl_uint_hash_count(&ctx->streams)) {

+      size_t nmax = Curl_uint_hash_count(&ctx->streams);

+      ctx->items_max = 0;

+      tmpptr = realloc(ctx->poll_items, nmax * sizeof(SSL_POLL_ITEM));

+      if(!tmpptr) {

+        free(ctx->poll_items);

+        ctx->poll_items = NULL;

+        res = CURLE_OUT_OF_MEMORY;

+        goto out;

+      }

+      ctx->poll_items = tmpptr;

+

+      tmpptr = realloc(ctx->curl_items, nmax * sizeof(struct Curl_easy *));

+      if(!tmpptr) {

+        free(ctx->curl_items);

+        ctx->curl_items = NULL;

+        res = CURLE_OUT_OF_MEMORY;

+        goto out;

+      }

+      ctx->curl_items = tmpptr;

+      ctx->items_max = nmax;

+    }

+

+    fill_ctx.ctx = ctx;

+    fill_ctx.multi = data->multi;

+    fill_ctx.n = 0;

+    Curl_uint_hash_visit(&ctx->streams, cf_osslq_collect_block_send,

+                         &fill_ctx);

+    poll_count = fill_ctx.n;

+    if(poll_count) {

+      CURL_TRC_CF(data, cf, "polling %zu blocked streams", poll_count);

+

+      memset(&timeout, 0, sizeof(struct timeval));

+      res = CURLE_UNRECOVERABLE_POLL;

+      if(!SSL_poll(ctx->poll_items, poll_count, sizeof(SSL_POLL_ITEM),

+                   &timeout, 0, &result_count))

+          goto out;

+

+      res = CURLE_OK;

+

+      for(idx_count = 0; idx_count < poll_count && result_count > 0;

+          idx_count++) {

+        if(ctx->poll_items[idx_count].revents & SSL_POLL_EVENT_W) {

+          stream = H3_STREAM_CTX(ctx, ctx->curl_items[idx_count]);

+          DEBUGASSERT(stream);  /* should still exist */

+          if(stream) {

+            nghttp3_conn_unblock_stream(ctx->h3.conn, stream->s.id);

+            stream->s.send_blocked = FALSE;

+            h3_drain_stream(cf, ctx->curl_items[idx_count]);

+            CURL_TRC_CF(ctx->curl_items[idx_count], cf, "unblocked");

+          }

+          result_count--;

         }

       }

     }

   }

-  return CURLE_OK;

+

+out:

+  return res;

 }

 

 static CURLcode h3_send_streams(struct Curl_cfilter *cf,

@@ -1504,7 +1599,7 @@ static CURLcode h3_send_streams(struct Curl_cfilter *cf,
     bool blocked = FALSE, eos_written = FALSE;

 

     n = nghttp3_conn_writev_stream(ctx->h3.conn, &stream_id, &eos,

-                                   vec, ARRAYSIZE(vec));

+                                   vec, CURL_ARRAYSIZE(vec));

     if(n < 0) {

       failf(data, "nghttp3_conn_writev_stream returned error: %s",

             nghttp3_strerror((int)n));

@@ -1569,7 +1664,7 @@ static CURLcode h3_send_streams(struct Curl_cfilter *cf,
     if(acked_len > 0 || (eos && !s->send_blocked)) {

       /* Since QUIC buffers the data written internally, we can tell

        * nghttp3 that it can move forward on it */

-      ctx->q.last_io = Curl_now();

+      ctx->q.last_io = curlx_now();

       rv = nghttp3_conn_add_write_offset(ctx->h3.conn, s->id, acked_len);

       if(rv && rv != NGHTTP3_ERR_STREAM_NOT_FOUND) {

         failf(data, "nghttp3_conn_add_write_offset returned error: %s\n",

@@ -1662,7 +1757,7 @@ out:
 

 static CURLcode cf_osslq_connect(struct Curl_cfilter *cf,

                                  struct Curl_easy *data,

-                                 bool blocking, bool *done)

+                                 bool *done)

 {

   struct cf_osslq_ctx *ctx = cf->ctx;

   CURLcode result = CURLE_OK;

@@ -1677,13 +1772,13 @@ static CURLcode cf_osslq_connect(struct Curl_cfilter *cf,
 

   /* Connect the UDP filter first */

   if(!cf->next->connected) {

-    result = Curl_conn_cf_connect(cf->next, data, blocking, done);

+    result = Curl_conn_cf_connect(cf->next, data, done);

     if(result || !*done)

       return result;

   }

 

   *done = FALSE;

-  now = Curl_now();

+  now = curlx_now();

   CF_DATA_SAVE(save, cf, data);

 

   if(!ctx->tls.ossl.ssl) {

@@ -1697,7 +1792,7 @@ static CURLcode cf_osslq_connect(struct Curl_cfilter *cf,
     int readable = SOCKET_READABLE(ctx->q.sockfd, 0);

     if(readable > 0 && (readable & CURL_CSELECT_IN)) {

       ctx->got_first_byte = TRUE;

-      ctx->first_byte_at = Curl_now();

+      ctx->first_byte_at = curlx_now();

     }

   }

 

@@ -1717,7 +1812,7 @@ static CURLcode cf_osslq_connect(struct Curl_cfilter *cf,
     ctx->handshake_at = now;

     ctx->q.last_io = now;

     CURL_TRC_CF(data, cf, "handshake complete after %dms",

-               (int)Curl_timediff(now, ctx->started_at));

+               (int)curlx_timediff(now, ctx->started_at));

     result = cf_osslq_verify_peer(cf, data);

     if(!result) {

       CURL_TRC_CF(data, cf, "peer verified");

@@ -1924,7 +2019,7 @@ static ssize_t cf_osslq_send(struct Curl_cfilter *cf, struct Curl_easy *data,
   ssize_t nwritten;

   CURLcode result;

 

-  (void)eos; /* TODO: use to end stream */

+  (void)eos; /* use to end stream */

   CF_DATA_SAVE(save, cf, data);

   DEBUGASSERT(cf->connected);

   DEBUGASSERT(ctx->tls.ossl.ssl);

@@ -2139,9 +2234,6 @@ static CURLcode cf_osslq_data_event(struct Curl_cfilter *cf,
   case CF_CTRL_DATA_PAUSE:

     result = h3_data_pause(cf, data, (arg1 != 0));

     break;

-  case CF_CTRL_DATA_DETACH:

-    h3_data_done(cf, data);

-    break;

   case CF_CTRL_DATA_DONE:

     h3_data_done(cf, data);

     break;

@@ -2196,7 +2288,7 @@ static bool cf_osslq_conn_is_alive(struct Curl_cfilter *cf,
       goto out;

     }

     CURL_TRC_CF(data, cf, "negotiated idle timeout: %zums", (size_t)idle_ms);

-    idletime = Curl_timediff(Curl_now(), ctx->q.last_io);

+    idletime = curlx_timediff(curlx_now(), ctx->q.last_io);

     if(idletime > 0 && (uint64_t)idletime > idle_ms)

       goto out;

   }

@@ -2273,17 +2365,17 @@ static CURLcode cf_osslq_query(struct Curl_cfilter *cf,
       return CURLE_HTTP3;

     }

     /* we report avail + in_use */

-    v += CONN_INUSE(cf->conn);

+    v += CONN_ATTACHED(cf->conn);

     *pres1 = (v > INT_MAX) ? INT_MAX : (int)v;

 #else

     *pres1 = 100;

 #endif

-    CURL_TRC_CF(data, cf, "query max_conncurrent -> %d", *pres1);

+    CURL_TRC_CF(data, cf, "query max_concurrent -> %d", *pres1);

     return CURLE_OK;

   }

   case CF_QUERY_CONNECT_REPLY_MS:

     if(ctx->got_first_byte) {

-      timediff_t ms = Curl_timediff(ctx->first_byte_at, ctx->started_at);

+      timediff_t ms = curlx_timediff(ctx->first_byte_at, ctx->started_at);

       *pres1 = (ms < INT_MAX) ? (int)ms : INT_MAX;

     }

     else

@@ -2301,6 +2393,9 @@ static CURLcode cf_osslq_query(struct Curl_cfilter *cf,
       *when = ctx->handshake_at;

     return CURLE_OK;

   }

+  case CF_QUERY_HTTP_VERSION:

+    *pres1 = 30;

+    return CURLE_OK;

   default:

     break;

   }

@@ -2311,7 +2406,7 @@ static CURLcode cf_osslq_query(struct Curl_cfilter *cf,
 

 struct Curl_cftype Curl_cft_http3 = {

   "HTTP/3",

-  CF_TYPE_IP_CONNECT | CF_TYPE_SSL | CF_TYPE_MULTIPLEX,

+  CF_TYPE_IP_CONNECT | CF_TYPE_SSL | CF_TYPE_MULTIPLEX | CF_TYPE_HTTP,

   0,

   cf_osslq_destroy,

   cf_osslq_connect,

diff --git a/libs/libcurl/src/vquic/curl_osslq.h b/libs/libcurl/src/vquic/curl_osslq.h
index f34d84baf8..f0e670c106 100644
--- a/libs/libcurl/src/vquic/curl_osslq.h
+++ b/libs/libcurl/src/vquic/curl_osslq.h
@@ -24,7 +24,7 @@
  *

  ***************************************************************************/

 

-#include "curl_setup.h"

+#include "../curl_setup.h"

 

 #if defined(USE_OPENSSL_QUIC) && defined(USE_NGHTTP3)

 

@@ -34,7 +34,7 @@
 

 struct Curl_cfilter;

 

-#include "urldata.h"

+#include "../urldata.h"

 

 void Curl_osslq_ver(char *p, size_t len);

 

diff --git a/libs/libcurl/src/vquic/curl_quiche.c b/libs/libcurl/src/vquic/curl_quiche.c
index 8cdd512dd0..d8bbbd72f6 100644
--- a/libs/libcurl/src/vquic/curl_quiche.c
+++ b/libs/libcurl/src/vquic/curl_quiche.c
@@ -22,40 +22,40 @@
  *

  ***************************************************************************/

 

-#include "curl_setup.h"

+#include "../curl_setup.h"

 

 #ifdef USE_QUICHE

 #include <quiche.h>

 #include <openssl/err.h>

 #include <openssl/ssl.h>

-#include "bufq.h"

-#include "hash.h"

-#include "urldata.h"

-#include "cfilters.h"

-#include "cf-socket.h"

-#include "sendf.h"

-#include "strdup.h"

-#include "rand.h"

-#include "strcase.h"

-#include "multiif.h"

-#include "connect.h"

-#include "progress.h"

-#include "strerror.h"

-#include "http1.h"

+#include "../bufq.h"

+#include "../uint-hash.h"

+#include "../urldata.h"

+#include "../cfilters.h"

+#include "../cf-socket.h"

+#include "../sendf.h"

+#include "../strdup.h"

+#include "../rand.h"

+#include "../strcase.h"

+#include "../multiif.h"

+#include "../connect.h"

+#include "../progress.h"

+#include "../strerror.h"

+#include "../http1.h"

 #include "vquic.h"

 #include "vquic_int.h"

 #include "vquic-tls.h"

 #include "curl_quiche.h"

-#include "transfer.h"

-#include "inet_pton.h"

-#include "vtls/openssl.h"

-#include "vtls/keylog.h"

-#include "vtls/vtls.h"

+#include "../transfer.h"

+#include "../curlx/inet_pton.h"

+#include "../vtls/openssl.h"

+#include "../vtls/keylog.h"

+#include "../vtls/vtls.h"

 

 /* The last 3 #include files should be in this order */

-#include "curl_printf.h"

-#include "curl_memory.h"

-#include "memdebug.h"

+#include "../curl_printf.h"

+#include "../curl_memory.h"

+#include "../memdebug.h"

 

 /* HTTP/3 error values defined in RFC 9114, ch. 8.1 */

 #define CURL_H3_NO_ERROR  (0x0100)

@@ -97,7 +97,7 @@ struct cf_quiche_ctx {
   struct curltime started_at;        /* time the current attempt started */

   struct curltime handshake_at;      /* time connect handshake finished */

   struct bufc_pool stream_bufcp;     /* chunk pool for streams */

-  struct Curl_hash streams;          /* hash `data->mid` to `stream_ctx` */

+  struct uint_hash streams;          /* hash `data->mid` to `stream_ctx` */

   curl_off_t data_recvd;

   BIT(initialized);

   BIT(goaway);                       /* got GOAWAY from server */

@@ -115,7 +115,7 @@ static void quiche_debug_log(const char *line, void *argp)
 }

 #endif

 

-static void h3_stream_hash_free(void *stream);

+static void h3_stream_hash_free(unsigned int id, void *stream);

 

 static void cf_quiche_ctx_init(struct cf_quiche_ctx *ctx)

 {

@@ -128,7 +128,7 @@ static void cf_quiche_ctx_init(struct cf_quiche_ctx *ctx)
 #endif

   Curl_bufcp_init(&ctx->stream_bufcp, H3_STREAM_CHUNK_SIZE,

                   H3_STREAM_POOL_SPARES);

-  Curl_hash_offt_init(&ctx->streams, 63, h3_stream_hash_free);

+  Curl_uint_hash_init(&ctx->streams, 63, h3_stream_hash_free);

   ctx->data_recvd = 0;

   ctx->initialized = TRUE;

 }

@@ -142,8 +142,7 @@ static void cf_quiche_ctx_free(struct cf_quiche_ctx *ctx)
     Curl_ssl_peer_cleanup(&ctx->peer);

     vquic_ctx_free(&ctx->q);

     Curl_bufcp_free(&ctx->stream_bufcp);

-    Curl_hash_clean(&ctx->streams);

-    Curl_hash_destroy(&ctx->streams);

+    Curl_uint_hash_destroy(&ctx->streams);

   }

   free(ctx);

 }

@@ -166,7 +165,7 @@ static CURLcode cf_flush_egress(struct Curl_cfilter *cf,
 /**

  * All about the H3 internals of a stream

  */

-struct stream_ctx {

+struct h3_stream_ctx {

   curl_uint64_t id; /* HTTP/3 protocol stream identifier */

   struct bufq recvbuf; /* h3 response */

   struct h1_req_parser h1; /* h1 request parsing */

@@ -180,47 +179,87 @@ struct stream_ctx {
   BIT(quic_flow_blocked); /* stream is blocked by QUIC flow control */

 };

 

-#define H3_STREAM_CTX(ctx,data)   ((struct stream_ctx *)(\

-            data? Curl_hash_offt_get(&(ctx)->streams, (data)->mid) : NULL))

-

-static void h3_stream_ctx_free(struct stream_ctx *stream)

+static void h3_stream_ctx_free(struct h3_stream_ctx *stream)

 {

   Curl_bufq_free(&stream->recvbuf);

   Curl_h1_req_parse_free(&stream->h1);

   free(stream);

 }

 

-static void h3_stream_hash_free(void *stream)

+static void h3_stream_hash_free(unsigned int id, void *stream)

 {

+  (void)id;

   DEBUGASSERT(stream);

-  h3_stream_ctx_free((struct stream_ctx *)stream);

+  h3_stream_ctx_free((struct h3_stream_ctx *)stream);

+}

+

+typedef bool cf_quiche_svisit(struct Curl_cfilter *cf,

+                              struct Curl_easy *sdata,

+                              struct h3_stream_ctx *stream,

+                              void *user_data);

+

+struct cf_quiche_visit_ctx {

+  struct Curl_cfilter *cf;

+  struct Curl_multi *multi;

+  cf_quiche_svisit *cb;

+  void *user_data;

+};

+

+static bool cf_quiche_stream_do(unsigned int mid, void *val, void *user_data)

+{

+  struct cf_quiche_visit_ctx *vctx = user_data;

+  struct h3_stream_ctx *stream = val;

+  struct Curl_easy *sdata = Curl_multi_get_easy(vctx->multi, mid);

+  if(sdata)

+    return vctx->cb(vctx->cf, sdata, stream, vctx->user_data);

+  return TRUE;

 }

 

-static void check_resumes(struct Curl_cfilter *cf,

-                          struct Curl_easy *data)

+static void cf_quiche_for_all_streams(struct Curl_cfilter *cf,

+                                      struct Curl_multi *multi,

+                                      cf_quiche_svisit *do_cb,

+                                      void *user_data)

 {

   struct cf_quiche_ctx *ctx = cf->ctx;

-  struct Curl_llist_node *e;

+  struct cf_quiche_visit_ctx vctx;

+  vctx.cf = cf;

+  vctx.multi = multi;

+  vctx.cb = do_cb;

+  vctx.user_data = user_data;

+  Curl_uint_hash_visit(&ctx->streams, cf_quiche_stream_do, &vctx);

+}

 

-  DEBUGASSERT(data->multi);

-  for(e = Curl_llist_head(&data->multi->process); e; e = Curl_node_next(e)) {

-    struct Curl_easy *sdata = Curl_node_elem(e);

-    if(sdata->conn == data->conn) {

-      struct stream_ctx *stream = H3_STREAM_CTX(ctx, sdata);

-      if(stream && stream->quic_flow_blocked) {

-        stream->quic_flow_blocked = FALSE;

-        Curl_expire(data, 0, EXPIRE_RUN_NOW);

-        CURL_TRC_CF(data, cf, "[%"FMT_PRIu64"] unblock", stream->id);

-      }

-    }

+static bool cf_quiche_do_resume(struct Curl_cfilter *cf,

+                                struct Curl_easy *sdata,

+                                struct h3_stream_ctx *stream,

+                                void *user_data)

+{

+  (void)user_data;

+  if(stream->quic_flow_blocked) {

+    stream->quic_flow_blocked = FALSE;

+    Curl_expire(sdata, 0, EXPIRE_RUN_NOW);

+    CURL_TRC_CF(sdata, cf, "[%"FMT_PRIu64"] unblock", stream->id);

   }

+  return TRUE;

+}

+

+static bool cf_quiche_do_expire(struct Curl_cfilter *cf,

+                                struct Curl_easy *sdata,

+                                struct h3_stream_ctx *stream,

+                                void *user_data)

+{

+  (void)stream;

+  (void)user_data;

+  CURL_TRC_CF(sdata, cf, "conn closed, expire transfer");

+  Curl_expire(sdata, 0, EXPIRE_RUN_NOW);

+  return TRUE;

 }

 

 static CURLcode h3_data_setup(struct Curl_cfilter *cf,

                               struct Curl_easy *data)

 {

   struct cf_quiche_ctx *ctx = cf->ctx;

-  struct stream_ctx *stream = H3_STREAM_CTX(ctx, data);

+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);

 

   if(stream)

     return CURLE_OK;

@@ -234,7 +273,7 @@ static CURLcode h3_data_setup(struct Curl_cfilter *cf,
                   H3_STREAM_RECV_CHUNKS, BUFQ_OPT_SOFT_LIMIT);

   Curl_h1_req_parse_init(&stream->h1, H1_PARSE_DEFAULT_MAX_LINE_LEN);

 

-  if(!Curl_hash_offt_set(&ctx->streams, data->mid, stream)) {

+  if(!Curl_uint_hash_set(&ctx->streams, data->mid, stream)) {

     h3_stream_ctx_free(stream);

     return CURLE_OUT_OF_MEMORY;

   }

@@ -245,7 +284,7 @@ static CURLcode h3_data_setup(struct Curl_cfilter *cf,
 static void h3_data_done(struct Curl_cfilter *cf, struct Curl_easy *data)

 {

   struct cf_quiche_ctx *ctx = cf->ctx;

-  struct stream_ctx *stream = H3_STREAM_CTX(ctx, data);

+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);

   CURLcode result;

 

   (void)cf;

@@ -264,7 +303,7 @@ static void h3_data_done(struct Curl_cfilter *cf, struct Curl_easy *data)
       if(result)

         CURL_TRC_CF(data, cf, "data_done, flush egress -> %d", result);

     }

-    Curl_hash_offt_remove(&ctx->streams, data->mid);

+    Curl_uint_hash_remove(&ctx->streams, data->mid);

   }

 }

 

@@ -272,7 +311,7 @@ static void h3_drain_stream(struct Curl_cfilter *cf,
                             struct Curl_easy *data)

 {

   struct cf_quiche_ctx *ctx = cf->ctx;

-  struct stream_ctx *stream = H3_STREAM_CTX(ctx, data);

+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);

   unsigned char bits;

 

   (void)cf;

@@ -285,52 +324,12 @@ static void h3_drain_stream(struct Curl_cfilter *cf,
   }

 }

 

-static struct Curl_easy *get_stream_easy(struct Curl_cfilter *cf,

-                                         struct Curl_easy *data,

-                                         curl_uint64_t stream_id,

-                                         struct stream_ctx **pstream)

-{

-  struct cf_quiche_ctx *ctx = cf->ctx;

-  struct stream_ctx *stream;

-

-  (void)cf;

-  stream = H3_STREAM_CTX(ctx, data);

-  if(stream && stream->id == stream_id) {

-    *pstream = stream;

-    return data;

-  }

-  else {

-    struct Curl_llist_node *e;

-    DEBUGASSERT(data->multi);

-    for(e = Curl_llist_head(&data->multi->process); e; e = Curl_node_next(e)) {

-      struct Curl_easy *sdata = Curl_node_elem(e);

-      if(sdata->conn != data->conn)

-        continue;

-      stream = H3_STREAM_CTX(ctx, sdata);

-      if(stream && stream->id == stream_id) {

-        *pstream = stream;

-        return sdata;

-      }

-    }

-  }

-  *pstream = NULL;

-  return NULL;

-}

-

 static void cf_quiche_expire_conn_closed(struct Curl_cfilter *cf,

                                          struct Curl_easy *data)

 {

-  struct Curl_llist_node *e;

-

   DEBUGASSERT(data->multi);

   CURL_TRC_CF(data, cf, "conn closed, expire all transfers");

-  for(e = Curl_llist_head(&data->multi->process); e; e = Curl_node_next(e)) {

-    struct Curl_easy *sdata = Curl_node_elem(e);

-    if(sdata == data || sdata->conn != data->conn)

-      continue;

-    CURL_TRC_CF(sdata, cf, "conn closed, expire transfer");

-    Curl_expire(sdata, 0, EXPIRE_RUN_NOW);

-  }

+  cf_quiche_for_all_streams(cf, data->multi, cf_quiche_do_expire, NULL);

 }

 

 /*

@@ -343,7 +342,7 @@ static CURLcode write_resp_raw(struct Curl_cfilter *cf,
                                const void *mem, size_t memlen)

 {

   struct cf_quiche_ctx *ctx = cf->ctx;

-  struct stream_ctx *stream = H3_STREAM_CTX(ctx, data);

+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);

   CURLcode result = CURLE_OK;

   ssize_t nwritten;

 

@@ -374,7 +373,7 @@ static int cb_each_header(uint8_t *name, size_t name_len,
 {

   struct cb_ctx *x = argp;

   struct cf_quiche_ctx *ctx = x->cf->ctx;

-  struct stream_ctx *stream = H3_STREAM_CTX(ctx, x->data);

+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, x->data);

   CURLcode result;

 

   if(!stream)

@@ -414,7 +413,7 @@ static ssize_t stream_resp_read(void *reader_ctx,
 {

   struct cb_ctx *x = reader_ctx;

   struct cf_quiche_ctx *ctx = x->cf->ctx;

-  struct stream_ctx *stream = H3_STREAM_CTX(ctx, x->data);

+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, x->data);

   ssize_t nread;

 

   if(!stream) {

@@ -438,7 +437,7 @@ static CURLcode cf_recv_body(struct Curl_cfilter *cf,
                              struct Curl_easy *data)

 {

   struct cf_quiche_ctx *ctx = cf->ctx;

-  struct stream_ctx *stream = H3_STREAM_CTX(ctx, data);

+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);

   ssize_t nwritten;

   struct cb_ctx cb_ctx;

   CURLcode result = CURLE_OK;

@@ -496,7 +495,7 @@ static const char *cf_ev_name(quiche_h3_event *ev)
 

 static CURLcode h3_process_event(struct Curl_cfilter *cf,

                                  struct Curl_easy *data,

-                                 struct stream_ctx *stream,

+                                 struct h3_stream_ctx *stream,

                                  quiche_h3_event *ev)

 {

   struct cb_ctx cb_ctx;

@@ -557,14 +556,48 @@ static CURLcode h3_process_event(struct Curl_cfilter *cf,
   return result;

 }

 

+static CURLcode cf_quiche_ev_process(struct Curl_cfilter *cf,

+                                     struct Curl_easy *data,

+                                     struct h3_stream_ctx *stream,

+                                     quiche_h3_event *ev)

+{

+  CURLcode result = h3_process_event(cf, data, stream, ev);

+  h3_drain_stream(cf, data);

+  if(result)

+    CURL_TRC_CF(data, cf, "error processing event %s "

+                "for [%"FMT_PRIu64"] -> %d", cf_ev_name(ev),

+                stream->id, result);

+  return result;

+}

+

+struct cf_quich_disp_ctx {

+  curl_uint64_t stream_id;

+  struct Curl_cfilter *cf;

+  struct Curl_multi *multi;

+  quiche_h3_event *ev;

+  CURLcode result;

+};

+

+static bool cf_quiche_disp_event(unsigned int mid, void *val, void *user_data)

+{

+  struct cf_quich_disp_ctx *dctx = user_data;

+  struct h3_stream_ctx *stream = val;

+

+  if(stream->id == dctx->stream_id) {

+    struct Curl_easy *sdata = Curl_multi_get_easy(dctx->multi, mid);

+    if(sdata)

+      dctx->result = cf_quiche_ev_process(dctx->cf, sdata, stream, dctx->ev);

+    return FALSE; /* stop iterating */

+  }

+  return TRUE;

+}

+

 static CURLcode cf_poll_events(struct Curl_cfilter *cf,

                                struct Curl_easy *data)

 {

   struct cf_quiche_ctx *ctx = cf->ctx;

-  struct stream_ctx *stream = NULL;

-  struct Curl_easy *sdata;

+  struct h3_stream_ctx *stream = NULL;

   quiche_h3_event *ev;

-  CURLcode result;

 

   /* Take in the events and distribute them to the transfers. */

   while(ctx->h3c) {

@@ -576,28 +609,27 @@ static CURLcode cf_poll_events(struct Curl_cfilter *cf,
       CURL_TRC_CF(data, cf, "error poll: %"FMT_PRId64, stream3_id);

       return CURLE_HTTP3;

     }

-

-    sdata = get_stream_easy(cf, data, stream3_id, &stream);

-    if(!sdata || !stream) {

-      CURL_TRC_CF(data, cf, "discard event %s for unknown [%"FMT_PRId64"]",

-                  cf_ev_name(ev), stream3_id);

-    }

     else {

-      result = h3_process_event(cf, sdata, stream, ev);

-      h3_drain_stream(cf, sdata);

-      if(result) {

-        CURL_TRC_CF(data, cf, "error processing event %s "

-                    "for [%"FMT_PRIu64"] -> %d", cf_ev_name(ev),

-                    stream3_id, result);

-        if(data == sdata) {

-          /* Only report this error to the caller if it is about the

-           * transfer we were called with. Otherwise we fail a transfer

-           * due to a problem in another one. */

-          quiche_h3_event_free(ev);

+      struct cf_quich_disp_ctx dctx;

+      dctx.stream_id = (curl_uint64_t)stream3_id;

+      dctx.cf = cf;

+      dctx.multi = data->multi;

+      dctx.ev = ev;

+      dctx.result = CURLE_OK;

+      stream = H3_STREAM_CTX(ctx, data);

+      if(stream && stream->id == dctx.stream_id) {

+        /* event for calling transfer */

+        CURLcode result = cf_quiche_ev_process(cf, data, stream, ev);

+        quiche_h3_event_free(ev);

+        if(result)

           return result;

-        }

       }

-      quiche_h3_event_free(ev);

+      else {

+        /* another transfer, do not return errors, as they are not for

+         * the calling transfer */

+        Curl_uint_hash_visit(&ctx->streams, cf_quiche_disp_event, &dctx);

+        quiche_h3_event_free(ev);

+      }

     }

   }

   return CURLE_OK;

@@ -627,7 +659,8 @@ static CURLcode recv_pkt(const unsigned char *pkt, size_t pktlen,
   recv_info.from = (struct sockaddr *)remote_addr;

   recv_info.from_len = remote_addrlen;

 

-  nread = quiche_conn_recv(ctx->qconn, (unsigned char *)pkt, pktlen,

+  nread = quiche_conn_recv(ctx->qconn,

+                           (unsigned char *)CURL_UNCONST(pkt), pktlen,

                            &recv_info);

   if(nread < 0) {

     if(QUICHE_ERR_DONE == nread) {

@@ -686,7 +719,8 @@ static CURLcode cf_process_ingress(struct Curl_cfilter *cf,
   if(rctx.pkts > 0) {

     /* quiche digested ingress packets. It might have opened flow control

      * windows again. */

-    check_resumes(cf, data);

+    DEBUGASSERT(data->multi);

+    cf_quiche_for_all_streams(cf, data->multi, cf_quiche_do_resume, NULL);

   }

   return cf_poll_events(cf, data);

 }

@@ -811,7 +845,7 @@ static ssize_t recv_closed_stream(struct Curl_cfilter *cf,
                                   CURLcode *err)

 {

   struct cf_quiche_ctx *ctx = cf->ctx;

-  struct stream_ctx *stream = H3_STREAM_CTX(ctx, data);

+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);

   ssize_t nread = -1;

 

   DEBUGASSERT(stream);

@@ -843,7 +877,7 @@ static ssize_t cf_quiche_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
                               char *buf, size_t len, CURLcode *err)

 {

   struct cf_quiche_ctx *ctx = cf->ctx;

-  struct stream_ctx *stream = H3_STREAM_CTX(ctx, data);

+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);

   ssize_t nread = -1;

   CURLcode result;

 

@@ -916,7 +950,7 @@ out:
 

 static ssize_t cf_quiche_send_body(struct Curl_cfilter *cf,

                                    struct Curl_easy *data,

-                                   struct stream_ctx *stream,

+                                   struct h3_stream_ctx *stream,

                                    const void *buf, size_t len, bool eos,

                                    CURLcode *err)

 {

@@ -924,10 +958,10 @@ static ssize_t cf_quiche_send_body(struct Curl_cfilter *cf,
   ssize_t nwritten;

 

   nwritten = quiche_h3_send_body(ctx->h3c, ctx->qconn, stream->id,

-                                 (uint8_t *)buf, len, eos);

+                                 (uint8_t *)CURL_UNCONST(buf), len, eos);

   if(nwritten == QUICHE_H3_ERR_DONE || (nwritten == 0 && len > 0)) {

-    /* TODO: we seem to be blocked on flow control and should HOLD

-     * sending. But when do we open again? */

+    /* Blocked on flow control and should HOLD sending. But when do we open

+     * again? */

     if(!quiche_conn_stream_writable(ctx->qconn, stream->id, len)) {

       CURL_TRC_CF(data, cf, "[%" FMT_PRIu64 "] send_body(len=%zu) "

                   "-> window exhausted", stream->id, len);

@@ -975,7 +1009,7 @@ static ssize_t h3_open_stream(struct Curl_cfilter *cf,
                               CURLcode *err)

 {

   struct cf_quiche_ctx *ctx = cf->ctx;

-  struct stream_ctx *stream = H3_STREAM_CTX(ctx, data);

+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);

   size_t nheader, i;

   curl_int64_t stream3_id;

   struct dynhds h2_headers;

@@ -1095,7 +1129,7 @@ static ssize_t cf_quiche_send(struct Curl_cfilter *cf, struct Curl_easy *data,
                               CURLcode *err)

 {

   struct cf_quiche_ctx *ctx = cf->ctx;

-  struct stream_ctx *stream = H3_STREAM_CTX(ctx, data);

+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);

   CURLcode result;

   ssize_t nwritten;

 

@@ -1154,7 +1188,7 @@ static bool stream_is_writeable(struct Curl_cfilter *cf,
                                 struct Curl_easy *data)

 {

   struct cf_quiche_ctx *ctx = cf->ctx;

-  struct stream_ctx *stream = H3_STREAM_CTX(ctx, data);

+  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);

 

   return stream && (quiche_conn_stream_writable(

     ctx->qconn, (curl_uint64_t)stream->id, 1) > 0);

@@ -1172,7 +1206,7 @@ static void cf_quiche_adjust_pollset(struct Curl_cfilter *cf,
 

   Curl_pollset_check(data, ps, ctx->q.sockfd, &want_recv, &want_send);

   if(want_recv || want_send) {

-    struct stream_ctx *stream = H3_STREAM_CTX(ctx, data);

+    struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);

     bool c_exhaust, s_exhaust;

 

     c_exhaust = FALSE; /* Have not found any call in quiche that tells

@@ -1195,7 +1229,7 @@ static bool cf_quiche_data_pending(struct Curl_cfilter *cf,
                                    const struct Curl_easy *data)

 {

   struct cf_quiche_ctx *ctx = cf->ctx;

-  const struct stream_ctx *stream = H3_STREAM_CTX(ctx, data);

+  const struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);

   (void)cf;

   return stream && !Curl_bufq_is_empty(&stream->recvbuf);

 }

@@ -1204,8 +1238,8 @@ static CURLcode h3_data_pause(struct Curl_cfilter *cf,
                               struct Curl_easy *data,

                               bool pause)

 {

-  /* TODO: there seems right now no API in quiche to shrink/enlarge

-   * the streams windows. As we do in HTTP/2. */

+  /* There seems to exist no API in quiche to shrink/enlarge the streams

+   * windows. As we do in HTTP/2. */

   if(!pause) {

     h3_drain_stream(cf, data);

     Curl_expire(data, 0, EXPIRE_RUN_NOW);

@@ -1228,14 +1262,11 @@ static CURLcode cf_quiche_data_event(struct Curl_cfilter *cf,
   case CF_CTRL_DATA_PAUSE:

     result = h3_data_pause(cf, data, (arg1 != 0));

     break;

-  case CF_CTRL_DATA_DETACH:

-    h3_data_done(cf, data);

-    break;

   case CF_CTRL_DATA_DONE:

     h3_data_done(cf, data);

     break;

   case CF_CTRL_DATA_DONE_SEND: {

-    struct stream_ctx *stream = H3_STREAM_CTX(ctx, data);

+    struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);

     if(stream && !stream->send_closed) {

       unsigned char body[1];

       ssize_t sent;

@@ -1249,7 +1280,7 @@ static CURLcode cf_quiche_data_event(struct Curl_cfilter *cf,
     break;

   }

   case CF_CTRL_DATA_IDLE: {

-    struct stream_ctx *stream = H3_STREAM_CTX(ctx, data);

+    struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);

     if(stream && !stream->closed) {

       result = cf_flush_egress(cf, data);

       if(result)

@@ -1270,6 +1301,9 @@ static CURLcode cf_quiche_ctx_open(struct Curl_cfilter *cf,
   int rv;

   CURLcode result;

   const struct Curl_sockaddr_ex *sockaddr;

+static const struct alpn_spec ALPN_SPEC_H3 = {

+  { "h3" }, 1

+};

 

   DEBUGASSERT(ctx->q.sockfd != CURL_SOCKET_BAD);

   DEBUGASSERT(ctx->initialized);

@@ -1278,17 +1312,12 @@ static CURLcode cf_quiche_ctx_open(struct Curl_cfilter *cf,
   if(result)

     return result;

 

-  result = Curl_ssl_peer_init(&ctx->peer, cf, TRNSPRT_QUIC);

-  if(result)

-    return result;

-

   ctx->cfg = quiche_config_new(QUICHE_PROTOCOL_VERSION);

   if(!ctx->cfg) {

     failf(data, "cannot create quiche config");

     return CURLE_FAILED_INIT;

   }

   quiche_config_enable_pacing(ctx->cfg, FALSE);

-  quiche_config_set_max_idle_timeout(ctx->cfg, CURL_QUIC_MAX_IDLE_MS);

   quiche_config_set_initial_max_data(ctx->cfg, (1 * 1024 * 1024)

     /* (QUIC_MAX_STREAMS/2) * H3_STREAM_WINDOW_SIZE */);

   quiche_config_set_initial_max_streams_bidi(ctx->cfg, QUIC_MAX_STREAMS);

@@ -1305,15 +1334,12 @@ static CURLcode cf_quiche_ctx_open(struct Curl_cfilter *cf,
     10 * QUIC_MAX_STREAMS * H3_STREAM_WINDOW_SIZE);

   quiche_config_set_max_stream_window(ctx->cfg, 10 * H3_STREAM_WINDOW_SIZE);

   quiche_config_set_application_protos(ctx->cfg,

-                                       (uint8_t *)

-                                       QUICHE_H3_APPLICATION_PROTOCOL,

+                       (uint8_t *)CURL_UNCONST(QUICHE_H3_APPLICATION_PROTOCOL),

                                        sizeof(QUICHE_H3_APPLICATION_PROTOCOL)

                                        - 1);

 

   result = Curl_vquic_tls_init(&ctx->tls, cf, data, &ctx->peer,

-                               QUICHE_H3_APPLICATION_PROTOCOL,

-                               sizeof(QUICHE_H3_APPLICATION_PROTOCOL) - 1,

-                               NULL, NULL, cf);

+                               &ALPN_SPEC_H3, NULL, NULL, cf, NULL);

   if(result)

     return result;

 

@@ -1379,14 +1405,13 @@ static CURLcode cf_quiche_verify_peer(struct Curl_cfilter *cf,
   struct cf_quiche_ctx *ctx = cf->ctx;

 

   cf->conn->bits.multiplex = TRUE; /* at least potentially multiplexed */

-  cf->conn->httpversion = 30;

 

   return Curl_vquic_tls_verify_peer(&ctx->tls, cf, data, &ctx->peer);

 }

 

 static CURLcode cf_quiche_connect(struct Curl_cfilter *cf,

                                   struct Curl_easy *data,

-                                  bool blocking, bool *done)

+                                  bool *done)

 {

   struct cf_quiche_ctx *ctx = cf->ctx;

   CURLcode result = CURLE_OK;

@@ -1398,7 +1423,7 @@ static CURLcode cf_quiche_connect(struct Curl_cfilter *cf,
 

   /* Connect the UDP filter first */

   if(!cf->next->connected) {

-    result = Curl_conn_cf_connect(cf->next, data, blocking, done);

+    result = Curl_conn_cf_connect(cf->next, data, done);

     if(result || !*done)

       return result;

   }

@@ -1427,7 +1452,7 @@ static CURLcode cf_quiche_connect(struct Curl_cfilter *cf,
   if(quiche_conn_is_established(ctx->qconn)) {

     ctx->handshake_at = ctx->q.last_op;

     CURL_TRC_CF(data, cf, "handshake complete after %dms",

-                (int)Curl_timediff(ctx->handshake_at, ctx->started_at));

+                (int)curlx_timediff(ctx->handshake_at, ctx->started_at));

     result = cf_quiche_verify_peer(cf, data);

     if(!result) {

       CURL_TRC_CF(data, cf, "peer verified");

@@ -1543,19 +1568,19 @@ static CURLcode cf_quiche_query(struct Curl_cfilter *cf,
 

   switch(query) {

   case CF_QUERY_MAX_CONCURRENT: {

-    curl_uint64_t max_streams = CONN_INUSE(cf->conn);

+    curl_uint64_t max_streams = CONN_ATTACHED(cf->conn);

     if(!ctx->goaway) {

       max_streams += quiche_conn_peer_streams_left_bidi(ctx->qconn);

     }

     *pres1 = (max_streams > INT_MAX) ? INT_MAX : (int)max_streams;

     CURL_TRC_CF(data, cf, "query conn[%" FMT_OFF_T "]: "

-                "MAX_CONCURRENT -> %d (%zu in use)",

-                cf->conn->connection_id, *pres1, CONN_INUSE(cf->conn));

+                "MAX_CONCURRENT -> %d (%u in use)",

+                cf->conn->connection_id, *pres1, CONN_ATTACHED(cf->conn));

     return CURLE_OK;

   }

   case CF_QUERY_CONNECT_REPLY_MS:

     if(ctx->q.got_first_byte) {

-      timediff_t ms = Curl_timediff(ctx->q.first_byte_at, ctx->started_at);

+      timediff_t ms = curlx_timediff(ctx->q.first_byte_at, ctx->started_at);

       *pres1 = (ms < INT_MAX) ? (int)ms : INT_MAX;

     }

     else

@@ -1573,6 +1598,9 @@ static CURLcode cf_quiche_query(struct Curl_cfilter *cf,
       *when = ctx->handshake_at;

     return CURLE_OK;

   }

+  case CF_QUERY_HTTP_VERSION:

+    *pres1 = 30;

+    return CURLE_OK;

   default:

     break;

   }

@@ -1620,7 +1648,7 @@ static bool cf_quiche_conn_is_alive(struct Curl_cfilter *cf,
 

 struct Curl_cftype Curl_cft_http3 = {

   "HTTP/3",

-  CF_TYPE_IP_CONNECT | CF_TYPE_SSL | CF_TYPE_MULTIPLEX,

+  CF_TYPE_IP_CONNECT | CF_TYPE_SSL | CF_TYPE_MULTIPLEX | CF_TYPE_HTTP,

   0,

   cf_quiche_destroy,

   cf_quiche_connect,

diff --git a/libs/libcurl/src/vquic/curl_quiche.h b/libs/libcurl/src/vquic/curl_quiche.h
index 6af88dd479..caf21e0137 100644
--- a/libs/libcurl/src/vquic/curl_quiche.h
+++ b/libs/libcurl/src/vquic/curl_quiche.h
@@ -24,7 +24,7 @@
  *

  ***************************************************************************/

 

-#include "curl_setup.h"

+#include "../curl_setup.h"

 

 #ifdef USE_QUICHE

 

diff --git a/libs/libcurl/src/vquic/vquic-tls.c b/libs/libcurl/src/vquic/vquic-tls.c
index b246d7fdc3..7eb343538e 100644
--- a/libs/libcurl/src/vquic/vquic-tls.c
+++ b/libs/libcurl/src/vquic/vquic-tls.c
@@ -22,238 +22,82 @@
  *

  ***************************************************************************/

 

-#include "curl_setup.h"

+#include "../curl_setup.h"

 

 #if defined(USE_HTTP3) && \

   (defined(USE_OPENSSL) || defined(USE_GNUTLS) || defined(USE_WOLFSSL))

 

 #ifdef USE_OPENSSL

 #include <openssl/err.h>

-#include "vtls/openssl.h"

+#include "../vtls/openssl.h"

 #elif defined(USE_GNUTLS)

 #include <gnutls/abstract.h>

 #include <gnutls/gnutls.h>

 #include <gnutls/x509.h>

 #include <gnutls/crypto.h>

 #include <nettle/sha2.h>

-#include "vtls/gtls.h"

+#include "../vtls/gtls.h"

 #elif defined(USE_WOLFSSL)

 #include <wolfssl/options.h>

 #include <wolfssl/ssl.h>

 #include <wolfssl/quic.h>

-#include "vtls/wolfssl.h"

+#include "../vtls/wolfssl.h"

 #endif

 

-#include "urldata.h"

-#include "curl_trc.h"

-#include "cfilters.h"

-#include "multiif.h"

-#include "vtls/keylog.h"

-#include "vtls/vtls.h"

+#include "../urldata.h"

+#include "../curl_trc.h"

+#include "../cfilters.h"

+#include "../multiif.h"

+#include "../vtls/keylog.h"

+#include "../vtls/vtls.h"

+#include "../vtls/vtls_scache.h"

 #include "vquic-tls.h"

 

 /* The last 3 #include files should be in this order */

-#include "curl_printf.h"

-#include "curl_memory.h"

-#include "memdebug.h"

-

-#ifndef ARRAYSIZE

-#define ARRAYSIZE(A) (sizeof(A)/sizeof((A)[0]))

-#endif

-

-#if defined(USE_WOLFSSL)

-

-#define QUIC_CIPHERS                                                          \

-  "TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_"               \

-  "POLY1305_SHA256:TLS_AES_128_CCM_SHA256"

-#define QUIC_GROUPS "P-256:P-384:P-521"

-

-#if defined(HAVE_SECRET_CALLBACK)

-static void keylog_callback(const WOLFSSL *ssl, const char *line)

-{

-  (void)ssl;

-  Curl_tls_keylog_write_line(line);

-}

-#endif

-

-static CURLcode wssl_init_ctx(struct curl_tls_ctx *ctx,

-                              struct Curl_cfilter *cf,

-                              struct Curl_easy *data,

-                              Curl_vquic_tls_ctx_setup *cb_setup,

-                              void *cb_user_data)

-{

-  struct ssl_primary_config *conn_config;

-  CURLcode result = CURLE_FAILED_INIT;

-

-  conn_config = Curl_ssl_cf_get_primary_config(cf);

-  if(!conn_config) {

-    result = CURLE_FAILED_INIT;

-    goto out;

-  }

-

-  ctx->wssl.ctx = wolfSSL_CTX_new(wolfTLSv1_3_client_method());

-  if(!ctx->wssl.ctx) {

-    result = CURLE_OUT_OF_MEMORY;

-    goto out;

-  }

-

-  if(cb_setup) {

-    result = cb_setup(cf, data, cb_user_data);

-    if(result)

-      goto out;

-  }

-

-  wolfSSL_CTX_set_default_verify_paths(ctx->wssl.ctx);

-

-  if(wolfSSL_CTX_set_cipher_list(ctx->wssl.ctx, conn_config->cipher_list13 ?

-                                 conn_config->cipher_list13 :

-                                 QUIC_CIPHERS) != 1) {

-    char error_buffer[256];

-    ERR_error_string_n(ERR_get_error(), error_buffer, sizeof(error_buffer));

-    failf(data, "wolfSSL failed to set ciphers: %s", error_buffer);

-    result = CURLE_BAD_FUNCTION_ARGUMENT;

-    goto out;

-  }

-

-  if(wolfSSL_CTX_set1_groups_list(ctx->wssl.ctx, conn_config->curves ?

-                                  conn_config->curves :

-                                  (char *)QUIC_GROUPS) != 1) {

-    failf(data, "wolfSSL failed to set curves");

-    result = CURLE_BAD_FUNCTION_ARGUMENT;

-    goto out;

-  }

-

-  /* Open the file if a TLS or QUIC backend has not done this before. */

-  Curl_tls_keylog_open();

-  if(Curl_tls_keylog_enabled()) {

-#if defined(HAVE_SECRET_CALLBACK)

-    wolfSSL_CTX_set_keylog_callback(ctx->wssl.ctx, keylog_callback);

-#else

-    failf(data, "wolfSSL was built without keylog callback");

-    result = CURLE_NOT_BUILT_IN;

-    goto out;

-#endif

-  }

-

-  if(conn_config->verifypeer) {

-    const char * const ssl_cafile = conn_config->CAfile;

-    const char * const ssl_capath = conn_config->CApath;

-

-    wolfSSL_CTX_set_verify(ctx->wssl.ctx, SSL_VERIFY_PEER, NULL);

-    if(ssl_cafile || ssl_capath) {

-      /* tell wolfSSL where to find CA certificates that are used to verify

-         the server's certificate. */

-      int rc =

-        wolfSSL_CTX_load_verify_locations_ex(ctx->wssl.ctx, ssl_cafile,

-                                             ssl_capath,

-                                             WOLFSSL_LOAD_FLAG_IGNORE_ERR);

-      if(SSL_SUCCESS != rc) {

-        /* Fail if we insist on successfully verifying the server. */

-        failf(data, "error setting certificate verify locations:"

-              "  CAfile: %s CApath: %s",

-              ssl_cafile ? ssl_cafile : "none",

-              ssl_capath ? ssl_capath : "none");

-        result = CURLE_SSL_CACERT_BADFILE;

-        goto out;

-      }

-      infof(data, " CAfile: %s", ssl_cafile ? ssl_cafile : "none");

-      infof(data, " CApath: %s", ssl_capath ? ssl_capath : "none");

-    }

-#ifdef CURL_CA_FALLBACK

-    else {

-      /* verifying the peer without any CA certificates will not work so

-         use wolfSSL's built-in default as fallback */

-      wolfSSL_CTX_set_default_verify_paths(ctx->wssl.ctx);

-    }

-#endif

-  }

-  else {

-    wolfSSL_CTX_set_verify(ctx->wssl.ctx, SSL_VERIFY_NONE, NULL);

-  }

-

-  /* give application a chance to interfere with SSL set up. */

-  if(data->set.ssl.fsslctx) {

-    Curl_set_in_callback(data, TRUE);

-    result = (*data->set.ssl.fsslctx)(data, ctx->wssl.ctx,

-                                      data->set.ssl.fsslctxp);

-    Curl_set_in_callback(data, FALSE);

-    if(result) {

-      failf(data, "error signaled by ssl ctx callback");

-      goto out;

-    }

-  }

-  result = CURLE_OK;

-

-out:

-  if(result && ctx->wssl.ctx) {

-    SSL_CTX_free(ctx->wssl.ctx);

-    ctx->wssl.ctx = NULL;

-  }

-  return result;

-}

-

-/** SSL callbacks ***/

-

-static CURLcode wssl_init_ssl(struct curl_tls_ctx *ctx,

-                              struct Curl_cfilter *cf,

-                              struct Curl_easy *data,

-                              struct ssl_peer *peer,

-                              const char *alpn, size_t alpn_len,

-                              void *user_data)

-{

-  struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);

-

-  DEBUGASSERT(!ctx->wssl.handle);

-  DEBUGASSERT(ctx->wssl.ctx);

-  ctx->wssl.handle = wolfSSL_new(ctx->wssl.ctx);

-

-  wolfSSL_set_app_data(ctx->wssl.handle, user_data);

-  wolfSSL_set_connect_state(ctx->wssl.handle);

-  wolfSSL_set_quic_use_legacy_codepoint(ctx->wssl.handle, 0);

-

-  if(alpn)

-    wolfSSL_set_alpn_protos(ctx->wssl.handle, (const unsigned char *)alpn,

-                            (unsigned int)alpn_len);

-

-  if(peer->sni) {

-    wolfSSL_UseSNI(ctx->wssl.handle, WOLFSSL_SNI_HOST_NAME,

-                   peer->sni, (unsigned short)strlen(peer->sni));

-  }

-

-  if(ssl_config->primary.cache_session) {

-    (void)wssl_setup_session(cf, data, &ctx->wssl, peer);

-  }

-

-  return CURLE_OK;

-}

-#endif /* defined(USE_WOLFSSL) */

+#include "../curl_printf.h"

+#include "../curl_memory.h"

+#include "../memdebug.h"

 

 CURLcode Curl_vquic_tls_init(struct curl_tls_ctx *ctx,

                              struct Curl_cfilter *cf,

                              struct Curl_easy *data,

                              struct ssl_peer *peer,

-                             const char *alpn, size_t alpn_len,

+                             const struct alpn_spec *alpns,

                              Curl_vquic_tls_ctx_setup *cb_setup,

-                             void *cb_user_data, void *ssl_user_data)

+                             void *cb_user_data, void *ssl_user_data,

+                             Curl_vquic_session_reuse_cb *session_reuse_cb)

 {

+  char tls_id[80];

   CURLcode result;

 

 #ifdef USE_OPENSSL

-  (void)result;

-  return Curl_ossl_ctx_init(&ctx->ossl, cf, data, peer, TRNSPRT_QUIC,

-                            (const unsigned char *)alpn, alpn_len,

-                            cb_setup, cb_user_data, NULL, ssl_user_data);

+  Curl_ossl_version(tls_id, sizeof(tls_id));

 #elif defined(USE_GNUTLS)

-  (void)result;

-  return Curl_gtls_ctx_init(&ctx->gtls, cf, data, peer,

-                            (const unsigned char *)alpn, alpn_len, NULL,

-                            cb_setup, cb_user_data, ssl_user_data);

+  Curl_gtls_version(tls_id, sizeof(tls_id));

 #elif defined(USE_WOLFSSL)

-  result = wssl_init_ctx(ctx, cf, data, cb_setup, cb_user_data);

+  Curl_wssl_version(tls_id, sizeof(tls_id));

+#else

+#error "no TLS lib in used, should not happen"

+  return CURLE_FAILED_INIT;

+#endif

+  (void)session_reuse_cb;

+  result = Curl_ssl_peer_init(peer, cf, tls_id, TRNSPRT_QUIC);

   if(result)

     return result;

 

-  return wssl_init_ssl(ctx, cf, data, peer, alpn, alpn_len, ssl_user_data);

+#ifdef USE_OPENSSL

+  (void)result;

+  return Curl_ossl_ctx_init(&ctx->ossl, cf, data, peer, alpns,

+                            cb_setup, cb_user_data, NULL, ssl_user_data,

+                            session_reuse_cb);

+#elif defined(USE_GNUTLS)

+  return Curl_gtls_ctx_init(&ctx->gtls, cf, data, peer, alpns,

+                            cb_setup, cb_user_data, ssl_user_data,

+                            session_reuse_cb);

+#elif defined(USE_WOLFSSL)

+  return Curl_wssl_ctx_init(&ctx->wssl, cf, data, peer, alpns,

+                            cb_setup, cb_user_data,

+                            ssl_user_data, session_reuse_cb);

 #else

 #error "no TLS lib in used, should not happen"

   return CURLE_FAILED_INIT;

@@ -272,10 +116,10 @@ void Curl_vquic_tls_cleanup(struct curl_tls_ctx *ctx)
     gnutls_deinit(ctx->gtls.session);

   Curl_gtls_shared_creds_free(&ctx->gtls.shared_creds);

 #elif defined(USE_WOLFSSL)

-  if(ctx->wssl.handle)

-    wolfSSL_free(ctx->wssl.handle);

-  if(ctx->wssl.ctx)

-    wolfSSL_CTX_free(ctx->wssl.ctx);

+  if(ctx->wssl.ssl)

+    wolfSSL_free(ctx->wssl.ssl);

+  if(ctx->wssl.ssl_ctx)

+    wolfSSL_CTX_free(ctx->wssl.ssl_ctx);

 #endif

   memset(ctx, 0, sizeof(*ctx));

 }

@@ -335,17 +179,20 @@ CURLcode Curl_vquic_tls_verify_peer(struct curl_tls_ctx *ctx,
 #elif defined(USE_WOLFSSL)

   (void)data;

   if(conn_config->verifyhost) {

-    if(peer->sni) {

-      WOLFSSL_X509* cert = wolfSSL_get_peer_certificate(ctx->wssl.handle);

-      if(wolfSSL_X509_check_host(cert, peer->sni, strlen(peer->sni), 0, NULL)

-            == WOLFSSL_FAILURE) {

-        result = CURLE_PEER_FAILED_VERIFICATION;

-      }

-      wolfSSL_X509_free(cert);

+    char *snihost = peer->sni ? peer->sni : peer->hostname;

+    WOLFSSL_X509* cert = wolfSSL_get_peer_certificate(ctx->wssl.ssl);

+    if(wolfSSL_X509_check_host(cert, snihost, strlen(snihost), 0, NULL)

+          == WOLFSSL_FAILURE) {

+      result = CURLE_PEER_FAILED_VERIFICATION;

     }

-

+    wolfSSL_X509_free(cert);

   }

+  if(!result)

+    result = Curl_wssl_verify_pinned(cf, data, &ctx->wssl);

 #endif

+  /* on error, remove any session we might have in the pool */

+  if(result)

+    Curl_ssl_scache_remove_all(cf, data, peer->scache_key);

   return result;

 }

 

diff --git a/libs/libcurl/src/vquic/vquic-tls.h b/libs/libcurl/src/vquic/vquic-tls.h
index 558170810b..0b9a1ec4f7 100644
--- a/libs/libcurl/src/vquic/vquic-tls.h
+++ b/libs/libcurl/src/vquic/vquic-tls.h
@@ -24,14 +24,19 @@
  *

  ***************************************************************************/

 

-#include "curl_setup.h"

-#include "bufq.h"

-#include "vtls/openssl.h"

+#include "../curl_setup.h"

+#include "../bufq.h"

+#include "../vtls/vtls.h"

+#include "../vtls/vtls_int.h"

+#include "../vtls/openssl.h"

 

 #if defined(USE_HTTP3) && \

   (defined(USE_OPENSSL) || defined(USE_GNUTLS) || defined(USE_WOLFSSL))

 

-#include "vtls/wolfssl.h"

+#include "../vtls/wolfssl.h"

+

+struct ssl_peer;

+struct Curl_ssl_session;

 

 struct curl_tls_ctx {

 #ifdef USE_OPENSSL

@@ -39,7 +44,7 @@ struct curl_tls_ctx {
 #elif defined(USE_GNUTLS)

   struct gtls_ctx gtls;

 #elif defined(USE_WOLFSSL)

-  struct wolfssl_ctx wssl;

+  struct wssl_ctx wssl;

 #endif

 };

 

@@ -54,6 +59,12 @@ typedef CURLcode Curl_vquic_tls_ctx_setup(struct Curl_cfilter *cf,
                                           struct Curl_easy *data,

                                           void *cb_user_data);

 

+typedef CURLcode Curl_vquic_session_reuse_cb(struct Curl_cfilter *cf,

+                                             struct Curl_easy *data,

+                                             struct alpn_spec *alpns,

+                                             struct Curl_ssl_session *scs,

+                                             bool *do_early_data);

+

 /**

  * Initialize the QUIC TLS instances based of the SSL configurations

  * for the connection filter, transfer and peer.

@@ -61,21 +72,21 @@ typedef CURLcode Curl_vquic_tls_ctx_setup(struct Curl_cfilter *cf,
  * @param cf          the connection filter involved

  * @param data        the transfer involved

  * @param peer        the peer that will be connected to

- * @param alpn        the ALPN string in protocol format ((len+bytes+)+),

- *                    may be NULL

- * @param alpn_len    the overall number of bytes in `alpn`

+ * @param alpns       the ALPN specifications to negotiate, may be NULL

  * @param cb_setup    optional callback for early TLS config

- ± @param cb_user_data user_data param for callback

+ * @param cb_user_data user_data param for callback

  * @param ssl_user_data  optional pointer to set in TLS application context

+ * @param session_reuse_cb callback to handle session reuse, signal early data

  */

 CURLcode Curl_vquic_tls_init(struct curl_tls_ctx *ctx,

                              struct Curl_cfilter *cf,

                              struct Curl_easy *data,

                              struct ssl_peer *peer,

-                             const char *alpn, size_t alpn_len,

+                             const struct alpn_spec *alpns,

                              Curl_vquic_tls_ctx_setup *cb_setup,

                              void *cb_user_data,

-                             void *ssl_user_data);

+                             void *ssl_user_data,

+                             Curl_vquic_session_reuse_cb *session_reuse_cb);

 

 /**

  * Cleanup all data that has been initialized.

diff --git a/libs/libcurl/src/vquic/vquic.c b/libs/libcurl/src/vquic/vquic.c
index 960c710170..4b7ab97c5b 100644
--- a/libs/libcurl/src/vquic/vquic.c
+++ b/libs/libcurl/src/vquic/vquic.c
@@ -22,7 +22,7 @@
  *

  ***************************************************************************/

 

-#include "curl_setup.h"

+#include "../curl_setup.h"

 

 #ifdef HAVE_NETINET_UDP_H

 #include <netinet/udp.h>

@@ -30,39 +30,44 @@
 #ifdef HAVE_FCNTL_H

 #include <fcntl.h>

 #endif

-#include "urldata.h"

-#include "bufq.h"

-#include "dynbuf.h"

-#include "cfilters.h"

-#include "curl_trc.h"

+#include "../urldata.h"

+#include "../bufq.h"

+#include "../curlx/dynbuf.h"

+#include "../cfilters.h"

+#include "../curl_trc.h"

 #include "curl_msh3.h"

 #include "curl_ngtcp2.h"

 #include "curl_osslq.h"

 #include "curl_quiche.h"

-#include "multiif.h"

-#include "rand.h"

+#include "../multiif.h"

+#include "../rand.h"

 #include "vquic.h"

 #include "vquic_int.h"

-#include "strerror.h"

+#include "../strerror.h"

+#include "../curlx/strparse.h"

 

 /* The last 3 #include files should be in this order */

-#include "curl_printf.h"

-#include "curl_memory.h"

-#include "memdebug.h"

+#include "../curl_printf.h"

+#include "../curl_memory.h"

+#include "../memdebug.h"

 

 

 #ifdef USE_HTTP3

 

-#ifdef O_BINARY

-#define QLOGMODE O_WRONLY|O_CREAT|O_BINARY

-#else

-#define QLOGMODE O_WRONLY|O_CREAT

-#endif

-

 #define NW_CHUNK_SIZE     (64 * 1024)

 #define NW_SEND_CHUNKS    2

 

 

+int Curl_vquic_init(void)

+{

+#if defined(USE_NGTCP2) && defined(OPENSSL_QUIC_API2)

+  if(ngtcp2_crypto_ossl_init())

+    return 0;

+#endif

+

+  return 1;

+}

+

 void Curl_quic_ver(char *p, size_t len)

 {

 #if defined(USE_NGTCP2) && defined(USE_NGHTTP3)

@@ -87,10 +92,10 @@ CURLcode vquic_ctx_init(struct cf_quic_ctx *qctx)
 #endif

 #ifdef DEBUGBUILD

   {

-    char *p = getenv("CURL_DBG_QUIC_WBLOCK");

+    const char *p = getenv("CURL_DBG_QUIC_WBLOCK");

     if(p) {

-      long l = strtol(p, NULL, 10);

-      if(l >= 0 && l <= 100)

+      curl_off_t l;

+      if(!curlx_str_number(&p, &l, 100))

         qctx->wblock_percent = (int)l;

     }

   }

@@ -107,7 +112,7 @@ void vquic_ctx_free(struct cf_quic_ctx *qctx)
 

 void vquic_ctx_update_time(struct cf_quic_ctx *qctx)

 {

-  qctx->last_op = Curl_now();

+  qctx->last_op = curlx_now();

 }

 

 static CURLcode send_packet_no_gso(struct Curl_cfilter *cf,

@@ -132,7 +137,7 @@ static CURLcode do_sendmsg(struct Curl_cfilter *cf,
 #endif

 

   *psent = 0;

-  msg_iov.iov_base = (uint8_t *)pkt;

+  msg_iov.iov_base = (uint8_t *)CURL_UNCONST(pkt);

   msg_iov.iov_len = pktlen;

   msg.msg_iov = &msg_iov;

   msg.msg_iovlen = 1;

@@ -153,23 +158,24 @@ static CURLcode do_sendmsg(struct Curl_cfilter *cf,
 #endif

 

 

-  while((sent = sendmsg(qctx->sockfd, &msg, 0)) == -1 && SOCKERRNO == EINTR)

+  while((sent = sendmsg(qctx->sockfd, &msg, 0)) == -1 &&

+        SOCKERRNO == SOCKEINTR)

     ;

 

   if(sent == -1) {

     switch(SOCKERRNO) {

     case EAGAIN:

-#if EAGAIN != EWOULDBLOCK

-    case EWOULDBLOCK:

+#if EAGAIN != SOCKEWOULDBLOCK

+    case SOCKEWOULDBLOCK:

 #endif

       return CURLE_AGAIN;

-    case EMSGSIZE:

+    case SOCKEMSGSIZE:

       /* UDP datagram is too large; caused by PMTUD. Just let it be lost. */

       break;

     case EIO:

       if(pktlen > gsolen) {

         /* GSO failure */

-        failf(data, "sendmsg() returned %zd (errno %d); disable GSO", sent,

+        infof(data, "sendmsg() returned %zd (errno %d); disable GSO", sent,

               SOCKERRNO);

         qctx->no_gso = TRUE;

         return send_packet_no_gso(cf, data, qctx, pkt, pktlen, gsolen, psent);

@@ -191,16 +197,16 @@ static CURLcode do_sendmsg(struct Curl_cfilter *cf,
 

   while((sent = send(qctx->sockfd,

                      (const char *)pkt, (SEND_TYPE_ARG3)pktlen, 0)) == -1 &&

-        SOCKERRNO == EINTR)

+        SOCKERRNO == SOCKEINTR)

     ;

 

   if(sent == -1) {

-    if(SOCKERRNO == EAGAIN || SOCKERRNO == EWOULDBLOCK) {

+    if(SOCKERRNO == EAGAIN || SOCKERRNO == SOCKEWOULDBLOCK) {

       return CURLE_AGAIN;

     }

     else {

       failf(data, "send() returned %zd (errno %d)", sent, SOCKERRNO);

-      if(SOCKERRNO != EMSGSIZE) {

+      if(SOCKERRNO != SOCKEMSGSIZE) {

         return CURLE_SEND_ERROR;

       }

       /* UDP datagram is too large; caused by PMTUD. Just let it be

@@ -248,6 +254,7 @@ static CURLcode vquic_send_packets(struct Curl_cfilter *cf,
   /* simulate network blocking/partial writes */

   if(qctx->wblock_percent > 0) {

     unsigned char c;

+    *psent = 0;

     Curl_rand(data, &c, 1);

     if(c >= ((100-qctx->wblock_percent)*256/100)) {

       CURL_TRC_CF(data, cf, "vquic_flush() simulate EWOULDBLOCK");

@@ -363,7 +370,7 @@ static CURLcode recvmmsg_packets(struct Curl_cfilter *cf,
   struct mmsghdr mmsg[MMSG_NUM];

   uint8_t msg_ctrl[MMSG_NUM * CMSG_SPACE(sizeof(int))];

   struct sockaddr_storage remote_addr[MMSG_NUM];

-  size_t total_nread = 0, pkts;

+  size_t total_nread = 0, pkts = 0;

   int mcount, i, n;

   char errstr[STRERROR_LEN];

   CURLcode result = CURLE_OK;

@@ -380,10 +387,9 @@ static CURLcode recvmmsg_packets(struct Curl_cfilter *cf,
     goto out;

   bufs = (uint8_t (*)[64*1024])sockbuf;

 

-  pkts = 0;

   total_nread = 0;

   while(pkts < max_pkts) {

-    n = (int)CURLMIN(MMSG_NUM, max_pkts);

+    n = (int)CURLMIN(CURLMIN(MMSG_NUM, IOV_MAX), max_pkts);

     memset(&mmsg, 0, sizeof(mmsg));

     for(i = 0; i < n; ++i) {

       msg_iov[i].iov_base = bufs[i];

@@ -397,14 +403,14 @@ static CURLcode recvmmsg_packets(struct Curl_cfilter *cf,
     }

 

     while((mcount = recvmmsg(qctx->sockfd, mmsg, n, 0, NULL)) == -1 &&

-          SOCKERRNO == EINTR)

+          SOCKERRNO == SOCKEINTR)

       ;

     if(mcount == -1) {

-      if(SOCKERRNO == EAGAIN || SOCKERRNO == EWOULDBLOCK) {

+      if(SOCKERRNO == EAGAIN || SOCKERRNO == SOCKEWOULDBLOCK) {

         CURL_TRC_CF(data, cf, "ingress, recvmmsg -> EAGAIN");

         goto out;

       }

-      if(!cf->connected && SOCKERRNO == ECONNREFUSED) {

+      if(!cf->connected && SOCKERRNO == SOCKECONNREFUSED) {

         struct ip_quadruple ip;

         Curl_cf_socket_peek(cf->next, data, NULL, NULL, &ip);

         failf(data, "QUIC: connection to %s port %u refused",

@@ -475,27 +481,28 @@ static CURLcode recvmsg_packets(struct Curl_cfilter *cf,
   size_t pktlen;

   size_t offset, to;

 

-  msg_iov.iov_base = buf;

-  msg_iov.iov_len = (int)sizeof(buf);

-

-  memset(&msg, 0, sizeof(msg));

-  msg.msg_iov = &msg_iov;

-  msg.msg_iovlen = 1;

-  msg.msg_control = msg_ctrl;

-

   DEBUGASSERT(max_pkts > 0);

   for(pkts = 0, total_nread = 0; pkts < max_pkts;) {

+    /* fully initialise this on each call to `recvmsg()`. There seem to

+     * operating systems out there that mess with `msg_iov.iov_len`. */

+    memset(&msg, 0, sizeof(msg));

+    msg_iov.iov_base = buf;

+    msg_iov.iov_len = (int)sizeof(buf);

+    msg.msg_iov = &msg_iov;

+    msg.msg_iovlen = 1;

+    msg.msg_control = msg_ctrl;

     msg.msg_name = &remote_addr;

     msg.msg_namelen = sizeof(remote_addr);

     msg.msg_controllen = sizeof(msg_ctrl);

+

     while((nread = recvmsg(qctx->sockfd, &msg, 0)) == -1 &&

-          SOCKERRNO == EINTR)

+          SOCKERRNO == SOCKEINTR)

       ;

     if(nread == -1) {

-      if(SOCKERRNO == EAGAIN || SOCKERRNO == EWOULDBLOCK) {

+      if(SOCKERRNO == EAGAIN || SOCKERRNO == SOCKEWOULDBLOCK) {

         goto out;

       }

-      if(!cf->connected && SOCKERRNO == ECONNREFUSED) {

+      if(!cf->connected && SOCKERRNO == SOCKECONNREFUSED) {

         struct ip_quadruple ip;

         Curl_cf_socket_peek(cf->next, data, NULL, NULL, &ip);

         failf(data, "QUIC: connection to %s port %u refused",

@@ -563,14 +570,14 @@ static CURLcode recvfrom_packets(struct Curl_cfilter *cf,
     while((nread = recvfrom(qctx->sockfd, (char *)buf, bufsize, 0,

                             (struct sockaddr *)&remote_addr,

                             &remote_addrlen)) == -1 &&

-          SOCKERRNO == EINTR)

+          SOCKERRNO == SOCKEINTR)

       ;

     if(nread == -1) {

-      if(SOCKERRNO == EAGAIN || SOCKERRNO == EWOULDBLOCK) {

+      if(SOCKERRNO == EAGAIN || SOCKERRNO == SOCKEWOULDBLOCK) {

         CURL_TRC_CF(data, cf, "ingress, recvfrom -> EAGAIN");

         goto out;

       }

-      if(!cf->connected && SOCKERRNO == ECONNREFUSED) {

+      if(!cf->connected && SOCKERRNO == SOCKECONNREFUSED) {

         struct ip_quadruple ip;

         Curl_cf_socket_peek(cf->next, data, NULL, NULL, &ip);

         failf(data, "QUIC: connection to %s port %u refused",

@@ -644,25 +651,25 @@ CURLcode Curl_qlogdir(struct Curl_easy *data,
     struct dynbuf fname;

     CURLcode result;

     unsigned int i;

-    Curl_dyn_init(&fname, DYN_QLOG_NAME);

-    result = Curl_dyn_add(&fname, qlog_dir);

+    curlx_dyn_init(&fname, DYN_QLOG_NAME);

+    result = curlx_dyn_add(&fname, qlog_dir);

     if(!result)

-      result = Curl_dyn_add(&fname, "/");

+      result = curlx_dyn_add(&fname, "/");

     for(i = 0; (i < scidlen) && !result; i++) {

       char hex[3];

       msnprintf(hex, 3, "%02x", scid[i]);

-      result = Curl_dyn_add(&fname, hex);

+      result = curlx_dyn_add(&fname, hex);

     }

     if(!result)

-      result = Curl_dyn_add(&fname, ".sqlog");

+      result = curlx_dyn_add(&fname, ".sqlog");

 

     if(!result) {

-      int qlogfd = open(Curl_dyn_ptr(&fname), QLOGMODE,

+      int qlogfd = open(curlx_dyn_ptr(&fname), O_WRONLY|O_CREAT|CURL_O_BINARY,

                         data->set.new_file_perms);

       if(qlogfd != -1)

         *qlogfdp = qlogfd;

     }

-    Curl_dyn_free(&fname);

+    curlx_dyn_free(&fname);

     if(result)

       return result;

   }

@@ -695,24 +702,6 @@ CURLcode Curl_cf_quic_create(struct Curl_cfilter **pcf,
 #endif

 }

 

-bool Curl_conn_is_http3(const struct Curl_easy *data,

-                        const struct connectdata *conn,

-                        int sockindex)

-{

-#if defined(USE_NGTCP2) && defined(USE_NGHTTP3)

-  return Curl_conn_is_ngtcp2(data, conn, sockindex);

-#elif defined(USE_OPENSSL_QUIC) && defined(USE_NGHTTP3)

-  return Curl_conn_is_osslq(data, conn, sockindex);

-#elif defined(USE_QUICHE)

-  return Curl_conn_is_quiche(data, conn, sockindex);

-#elif defined(USE_MSH3)

-  return Curl_conn_is_msh3(data, conn, sockindex);

-#else

-  return ((conn->handler->protocol & PROTO_FAMILY_HTTP) &&

-          (conn->httpversion == 30));

-#endif

-}

-

 CURLcode Curl_conn_may_http3(struct Curl_easy *data,

                              const struct connectdata *conn)

 {

diff --git a/libs/libcurl/src/vquic/vquic.h b/libs/libcurl/src/vquic/vquic.h
index dde9003fa3..0534d49286 100644
--- a/libs/libcurl/src/vquic/vquic.h
+++ b/libs/libcurl/src/vquic/vquic.h
@@ -24,7 +24,7 @@
  *

  ***************************************************************************/

 

-#include "curl_setup.h"

+#include "../curl_setup.h"

 

 #ifdef USE_HTTP3

 struct Curl_cfilter;

@@ -33,6 +33,7 @@ struct connectdata;
 struct Curl_addrinfo;

 

 void Curl_quic_ver(char *p, size_t len);

+int Curl_vquic_init(void);

 

 CURLcode Curl_qlogdir(struct Curl_easy *data,

                       unsigned char *scid,

@@ -46,16 +47,10 @@ CURLcode Curl_cf_quic_create(struct Curl_cfilter **pcf,
                              const struct Curl_addrinfo *ai,

                              int transport);

 

-bool Curl_conn_is_http3(const struct Curl_easy *data,

-                        const struct connectdata *conn,

-                        int sockindex);

-

 extern struct Curl_cftype Curl_cft_http3;

 

-#else /* USE_HTTP3 */

-

-#define Curl_conn_is_http3(a,b,c)   FALSE

-

+#else

+#define Curl_vquic_init() 1

 #endif /* !USE_HTTP3 */

 

 CURLcode Curl_conn_may_http3(struct Curl_easy *data,

diff --git a/libs/libcurl/src/vquic/vquic_int.h b/libs/libcurl/src/vquic/vquic_int.h
index 52203735bf..75dfd33d26 100644
--- a/libs/libcurl/src/vquic/vquic_int.h
+++ b/libs/libcurl/src/vquic/vquic_int.h
@@ -24,15 +24,13 @@
  *

  ***************************************************************************/

 

-#include "curl_setup.h"

-#include "bufq.h"

+#include "../curl_setup.h"

+#include "../bufq.h"

 

 #ifdef USE_HTTP3

 

 #define MAX_PKT_BURST 10

 #define MAX_UDP_PAYLOAD_SIZE  1452

-/* Default QUIC connection timeout we announce from our side */

-#define CURL_QUIC_MAX_IDLE_MS   (120 * 1000)

 

 struct cf_quic_ctx {

   curl_socket_t sockfd; /* connected UDP socket */

@@ -53,6 +51,9 @@ struct cf_quic_ctx {
   BIT(no_gso); /* do not use gso on sending */

 };

 

+#define H3_STREAM_CTX(ctx,data)                                         \

+  (data ? Curl_uint_hash_get(&(ctx)->streams, (data)->mid) : NULL)

+

 CURLcode vquic_ctx_init(struct cf_quic_ctx *qctx);

 void vquic_ctx_free(struct cf_quic_ctx *qctx);