puma-plus-core 0.1.0

data/go/vendor/github.com/quic-go/quic-go/internal/handshake/fake_conn.go

@@ -0,0 +1,21 @@
+package handshake
+
+import (
+	"net"
+	"time"
+)
+
+type conn struct {
+	localAddr, remoteAddr net.Addr
+}
+
+var _ net.Conn = &conn{}
+
+func (c *conn) Read([]byte) (int, error)         { return 0, nil }
+func (c *conn) Write([]byte) (int, error)        { return 0, nil }
+func (c *conn) Close() error                     { return nil }
+func (c *conn) RemoteAddr() net.Addr             { return c.remoteAddr }
+func (c *conn) LocalAddr() net.Addr              { return c.localAddr }
+func (c *conn) SetReadDeadline(time.Time) error  { return nil }
+func (c *conn) SetWriteDeadline(time.Time) error { return nil }
+func (c *conn) SetDeadline(time.Time) error      { return nil }

data/go/vendor/github.com/quic-go/quic-go/internal/handshake/fips140_go126.go

@@ -0,0 +1,9 @@
+//go:build go1.26
+
+package handshake
+
+import "crypto/fips140"
+
+func withoutFIPSEnforcement(f func()) {
+	fips140.WithoutEnforcement(f)
+}

data/go/vendor/github.com/quic-go/quic-go/internal/handshake/fips140_legacy.go

@@ -0,0 +1,7 @@
+//go:build !go1.26
+
+package handshake
+
+func withoutFIPSEnforcement(f func()) {
+	f()
+}

data/go/vendor/github.com/quic-go/quic-go/internal/handshake/header_protector.go

@@ -0,0 +1,134 @@
+package handshake
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/tls"
+	"encoding/binary"
+	"fmt"
+
+	"golang.org/x/crypto/chacha20"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+)
+
+type headerProtector interface {
+	EncryptHeader(sample []byte, firstByte *byte, hdrBytes []byte)
+	DecryptHeader(sample []byte, firstByte *byte, hdrBytes []byte)
+}
+
+func hkdfHeaderProtectionLabel(v protocol.Version) string {
+	if v == protocol.Version2 {
+		return "quicv2 hp"
+	}
+	return "quic hp"
+}
+
+func newHeaderProtector(suite cipherSuite, trafficSecret []byte, isLongHeader bool, v protocol.Version) headerProtector {
+	hkdfLabel := hkdfHeaderProtectionLabel(v)
+	switch suite.ID {
+	case tls.TLS_AES_128_GCM_SHA256, tls.TLS_AES_256_GCM_SHA384:
+		return newAESHeaderProtector(suite, trafficSecret, isLongHeader, hkdfLabel)
+	case tls.TLS_CHACHA20_POLY1305_SHA256:
+		return newChaChaHeaderProtector(suite, trafficSecret, isLongHeader, hkdfLabel)
+	default:
+		panic(fmt.Sprintf("Invalid cipher suite id: %d", suite.ID))
+	}
+}
+
+type aesHeaderProtector struct {
+	mask         [16]byte // AES always has a 16 byte block size
+	block        cipher.Block
+	isLongHeader bool
+}
+
+var _ headerProtector = &aesHeaderProtector{}
+
+func newAESHeaderProtector(suite cipherSuite, trafficSecret []byte, isLongHeader bool, hkdfLabel string) headerProtector {
+	hpKey := hkdfExpandLabel(suite.Hash, trafficSecret, []byte{}, hkdfLabel, suite.KeyLen)
+	block, err := aes.NewCipher(hpKey)
+	if err != nil {
+		panic(fmt.Sprintf("error creating new AES cipher: %s", err))
+	}
+	return &aesHeaderProtector{
+		block:        block,
+		isLongHeader: isLongHeader,
+	}
+}
+
+func (p *aesHeaderProtector) DecryptHeader(sample []byte, firstByte *byte, hdrBytes []byte) {
+	p.apply(sample, firstByte, hdrBytes)
+}
+
+func (p *aesHeaderProtector) EncryptHeader(sample []byte, firstByte *byte, hdrBytes []byte) {
+	p.apply(sample, firstByte, hdrBytes)
+}
+
+func (p *aesHeaderProtector) apply(sample []byte, firstByte *byte, hdrBytes []byte) {
+	if len(sample) != len(p.mask) {
+		panic("invalid sample size")
+	}
+	p.block.Encrypt(p.mask[:], sample)
+	if p.isLongHeader {
+		*firstByte ^= p.mask[0] & 0xf
+	} else {
+		*firstByte ^= p.mask[0] & 0x1f
+	}
+	for i := range hdrBytes {
+		hdrBytes[i] ^= p.mask[i+1]
+	}
+}
+
+type chachaHeaderProtector struct {
+	mask [5]byte
+
+	key          [32]byte
+	isLongHeader bool
+}
+
+var _ headerProtector = &chachaHeaderProtector{}
+
+func newChaChaHeaderProtector(suite cipherSuite, trafficSecret []byte, isLongHeader bool, hkdfLabel string) headerProtector {
+	hpKey := hkdfExpandLabel(suite.Hash, trafficSecret, []byte{}, hkdfLabel, suite.KeyLen)
+
+	p := &chachaHeaderProtector{
+		isLongHeader: isLongHeader,
+	}
+	copy(p.key[:], hpKey)
+	return p
+}
+
+func (p *chachaHeaderProtector) DecryptHeader(sample []byte, firstByte *byte, hdrBytes []byte) {
+	p.apply(sample, firstByte, hdrBytes)
+}
+
+func (p *chachaHeaderProtector) EncryptHeader(sample []byte, firstByte *byte, hdrBytes []byte) {
+	p.apply(sample, firstByte, hdrBytes)
+}
+
+func (p *chachaHeaderProtector) apply(sample []byte, firstByte *byte, hdrBytes []byte) {
+	if len(sample) != 16 {
+		panic("invalid sample size")
+	}
+	for i := range 5 {
+		p.mask[i] = 0
+	}
+	cipher, err := chacha20.NewUnauthenticatedCipher(p.key[:], sample[4:])
+	if err != nil {
+		panic(err)
+	}
+	cipher.SetCounter(binary.LittleEndian.Uint32(sample[:4]))
+	cipher.XORKeyStream(p.mask[:], p.mask[:])
+	p.applyMask(firstByte, hdrBytes)
+}
+
+func (p *chachaHeaderProtector) applyMask(firstByte *byte, hdrBytes []byte) {
+	if p.isLongHeader {
+		*firstByte ^= p.mask[0] & 0xf
+	} else {
+		*firstByte ^= p.mask[0] & 0x1f
+	}
+	for i := range hdrBytes {
+		hdrBytes[i] ^= p.mask[i+1]
+	}
+}

data/go/vendor/github.com/quic-go/quic-go/internal/handshake/hkdf.go

@@ -0,0 +1,26 @@
+package handshake
+
+import (
+	"crypto"
+	"crypto/hkdf"
+	"encoding/binary"
+	"fmt"
+)
+
+// hkdfExpandLabel HKDF expands a label as defined in RFC 8446, section 7.1.
+func hkdfExpandLabel(hash crypto.Hash, secret, context []byte, label string, length int) []byte {
+	b := make([]byte, 3, 3+6+len(label)+1+len(context))
+	binary.BigEndian.PutUint16(b, uint16(length))
+	b[2] = uint8(6 + len(label))
+	b = append(b, []byte("tls13 ")...)
+	b = append(b, []byte(label)...)
+	b = b[:3+6+len(label)+1]
+	b[3+6+len(label)] = uint8(len(context))
+	b = append(b, context...)
+
+	expanded, err := hkdf.Expand(hash.New, secret, string(b), length)
+	if err != nil {
+		panic(fmt.Errorf("quic: HKDF-Expand-Label invocation failed unexpectedly: %v", err))
+	}
+	return expanded
+}

data/go/vendor/github.com/quic-go/quic-go/internal/handshake/initial_aead.go

@@ -0,0 +1,80 @@
+package handshake
+
+import (
+	"crypto"
+	"crypto/hkdf"
+	"crypto/tls"
+	"fmt"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+)
+
+var (
+	quicSaltV1 = []byte{0x38, 0x76, 0x2c, 0xf7, 0xf5, 0x59, 0x34, 0xb3, 0x4d, 0x17, 0x9a, 0xe6, 0xa4, 0xc8, 0x0c, 0xad, 0xcc, 0xbb, 0x7f, 0x0a}
+	quicSaltV2 = []byte{0x0d, 0xed, 0xe3, 0xde, 0xf7, 0x00, 0xa6, 0xdb, 0x81, 0x93, 0x81, 0xbe, 0x6e, 0x26, 0x9d, 0xcb, 0xf9, 0xbd, 0x2e, 0xd9}
+)
+
+const (
+	hkdfLabelKeyV1 = "quic key"
+	hkdfLabelKeyV2 = "quicv2 key"
+	hkdfLabelIVV1  = "quic iv"
+	hkdfLabelIVV2  = "quicv2 iv"
+)
+
+var initialSuite = getCipherSuite(tls.TLS_AES_128_GCM_SHA256)
+
+// NewInitialAEAD creates a new AEAD for Initial encryption / decryption.
+func NewInitialAEAD(connID protocol.ConnectionID, pers protocol.Perspective, v protocol.Version) (LongHeaderSealer, LongHeaderOpener) {
+	var sealer LongHeaderSealer
+	var opener LongHeaderOpener
+	// The keys for the Initial AEAD are derived from the connection ID and constants defined in RFC 9001, Section 5.2.
+	// By design, the Initial encryption level provides no confidentiality against any attacker who has read the RFC.
+	// Its sole purpose is integrity protection. The Initial encryption level is therefore out of scope for FIPS 140.
+	// See also this thread on the IETF QUIC mailing list: https://mailarchive.ietf.org/arch/msg/quic/k2kl2W_n5WDEZBbt3O31Ef2XBbM.
+	withoutFIPSEnforcement(func() {
+		clientSecret, serverSecret := computeSecrets(connID, v)
+		var mySecret, otherSecret []byte
+		if pers == protocol.PerspectiveClient {
+			mySecret = clientSecret
+			otherSecret = serverSecret
+		} else {
+			mySecret = serverSecret
+			otherSecret = clientSecret
+		}
+		myKey, myIV := computeInitialKeyAndIV(mySecret, v)
+		otherKey, otherIV := computeInitialKeyAndIV(otherSecret, v)
+
+		encrypter := initialSuite.AEAD(myKey, myIV)
+		decrypter := initialSuite.AEAD(otherKey, otherIV)
+
+		sealer = newLongHeaderSealer(encrypter, newHeaderProtector(initialSuite, mySecret, true, v))
+		opener = newLongHeaderOpener(decrypter, newHeaderProtector(initialSuite, otherSecret, true, v))
+	})
+	return sealer, opener
+}
+
+func computeSecrets(connID protocol.ConnectionID, v protocol.Version) (clientSecret, serverSecret []byte) {
+	salt := quicSaltV1
+	if v == protocol.Version2 {
+		salt = quicSaltV2
+	}
+	initialSecret, err := hkdf.Extract(crypto.SHA256.New, connID.Bytes(), salt)
+	if err != nil {
+		panic(fmt.Errorf("quic: HKDF-Extract invocation failed unexpectedly: %v", err))
+	}
+	clientSecret = hkdfExpandLabel(crypto.SHA256, initialSecret, []byte{}, "client in", crypto.SHA256.Size())
+	serverSecret = hkdfExpandLabel(crypto.SHA256, initialSecret, []byte{}, "server in", crypto.SHA256.Size())
+	return
+}
+
+func computeInitialKeyAndIV(secret []byte, v protocol.Version) (key, iv []byte) {
+	keyLabel := hkdfLabelKeyV1
+	ivLabel := hkdfLabelIVV1
+	if v == protocol.Version2 {
+		keyLabel = hkdfLabelKeyV2
+		ivLabel = hkdfLabelIVV2
+	}
+	key = hkdfExpandLabel(crypto.SHA256, secret, []byte{}, keyLabel, 16)
+	iv = hkdfExpandLabel(crypto.SHA256, secret, []byte{}, ivLabel, 12)
+	return
+}

data/go/vendor/github.com/quic-go/quic-go/internal/handshake/interface.go

@@ -0,0 +1,140 @@
+package handshake
+
+import (
+	"context"
+	"crypto/tls"
+	"errors"
+	"io"
+
+	"github.com/quic-go/quic-go/internal/monotime"
+	"github.com/quic-go/quic-go/internal/protocol"
+	"github.com/quic-go/quic-go/internal/wire"
+)
+
+var (
+	// ErrKeysNotYetAvailable is returned when an opener or a sealer is requested for an encryption level,
+	// but the corresponding opener has not yet been initialized
+	// This can happen when packets arrive out of order.
+	ErrKeysNotYetAvailable = errors.New("CryptoSetup: keys at this encryption level not yet available")
+	// ErrKeysDropped is returned when an opener or a sealer is requested for an encryption level,
+	// but the corresponding keys have already been dropped.
+	ErrKeysDropped = errors.New("CryptoSetup: keys were already dropped")
+	// ErrDecryptionFailed is returned when the AEAD fails to open the packet.
+	ErrDecryptionFailed = errors.New("decryption failed")
+)
+
+type headerDecryptor interface {
+	DecryptHeader(sample []byte, firstByte *byte, pnBytes []byte)
+}
+
+// LongHeaderOpener opens a long header packet
+type LongHeaderOpener interface {
+	headerDecryptor
+	DecodePacketNumber(wirePN protocol.PacketNumber, wirePNLen protocol.PacketNumberLen) protocol.PacketNumber
+	Open(dst, src []byte, pn protocol.PacketNumber, associatedData []byte) ([]byte, error)
+}
+
+// ShortHeaderOpener opens a short header packet
+type ShortHeaderOpener interface {
+	headerDecryptor
+	DecodePacketNumber(wirePN protocol.PacketNumber, wirePNLen protocol.PacketNumberLen) protocol.PacketNumber
+	Open(dst, src []byte, rcvTime monotime.Time, pn protocol.PacketNumber, kp protocol.KeyPhaseBit, associatedData []byte) ([]byte, error)
+}
+
+// LongHeaderSealer seals a long header packet
+type LongHeaderSealer interface {
+	Seal(dst, src []byte, packetNumber protocol.PacketNumber, associatedData []byte) []byte
+	EncryptHeader(sample []byte, firstByte *byte, pnBytes []byte)
+	Overhead() int
+}
+
+// ShortHeaderSealer seals a short header packet
+type ShortHeaderSealer interface {
+	LongHeaderSealer
+	KeyPhase() protocol.KeyPhaseBit
+}
+
+type ConnectionState struct {
+	tls.ConnectionState
+	Used0RTT bool
+}
+
+// EventKind is the kind of handshake event.
+type EventKind uint8
+
+const (
+	// EventNoEvent signals that there are no new handshake events
+	EventNoEvent EventKind = iota + 1
+	// EventWriteInitialData contains new CRYPTO data to send at the Initial encryption level
+	EventWriteInitialData
+	// EventWriteHandshakeData contains new CRYPTO data to send at the Handshake encryption level
+	EventWriteHandshakeData
+	// EventReceivedReadKeys signals that new decryption keys are available.
+	// It doesn't say which encryption level those keys are for.
+	EventReceivedReadKeys
+	// EventDiscard0RTTKeys signals that the Handshake keys were discarded.
+	EventDiscard0RTTKeys
+	// EventReceivedTransportParameters contains the transport parameters sent by the peer.
+	EventReceivedTransportParameters
+	// EventRestoredTransportParameters contains the transport parameters restored from the session ticket.
+	// It is only used for the client.
+	EventRestoredTransportParameters
+	// EventHandshakeComplete signals that the TLS handshake was completed.
+	EventHandshakeComplete
+)
+
+func (k EventKind) String() string {
+	switch k {
+	case EventNoEvent:
+		return "EventNoEvent"
+	case EventWriteInitialData:
+		return "EventWriteInitialData"
+	case EventWriteHandshakeData:
+		return "EventWriteHandshakeData"
+	case EventReceivedReadKeys:
+		return "EventReceivedReadKeys"
+	case EventDiscard0RTTKeys:
+		return "EventDiscard0RTTKeys"
+	case EventReceivedTransportParameters:
+		return "EventReceivedTransportParameters"
+	case EventRestoredTransportParameters:
+		return "EventRestoredTransportParameters"
+	case EventHandshakeComplete:
+		return "EventHandshakeComplete"
+	default:
+		return "Unknown EventKind"
+	}
+}
+
+// Event is a handshake event.
+type Event struct {
+	Kind                EventKind
+	Data                []byte
+	TransportParameters *wire.TransportParameters
+}
+
+// CryptoSetup handles the handshake and protecting / unprotecting packets
+type CryptoSetup interface {
+	StartHandshake(context.Context) error
+	io.Closer
+	ChangeConnectionID(protocol.ConnectionID)
+	GetSessionTicket() ([]byte, error)
+
+	HandleMessage([]byte, protocol.EncryptionLevel) error
+	NextEvent() Event
+
+	SetLargest1RTTAcked(protocol.PacketNumber) error
+	DiscardInitialKeys()
+	SetHandshakeConfirmed()
+	ConnectionState() ConnectionState
+
+	GetInitialOpener() (LongHeaderOpener, error)
+	GetHandshakeOpener() (LongHeaderOpener, error)
+	Get0RTTOpener() (LongHeaderOpener, error)
+	Get1RTTOpener() (ShortHeaderOpener, error)
+
+	GetInitialSealer() (LongHeaderSealer, error)
+	GetHandshakeSealer() (LongHeaderSealer, error)
+	Get0RTTSealer() (LongHeaderSealer, error)
+	Get1RTTSealer() (ShortHeaderSealer, error)
+}

data/go/vendor/github.com/quic-go/quic-go/internal/handshake/quic_event_go125.go

@@ -0,0 +1,11 @@
+//go:build go1.25 && !go1.26
+
+package handshake
+
+import "crypto/tls"
+
+const quicErrorEvent tls.QUICEventKind = -1
+
+func extractQUICEventError(tls.QUICEvent) error {
+	return nil
+}

data/go/vendor/github.com/quic-go/quic-go/internal/handshake/quic_event_go126.go

@@ -0,0 +1,11 @@
+//go:build go1.26
+
+package handshake
+
+import "crypto/tls"
+
+const quicErrorEvent tls.QUICEventKind = tls.QUICErrorEvent
+
+func extractQUICEventError(ev tls.QUICEvent) error {
+	return ev.Err
+}

data/go/vendor/github.com/quic-go/quic-go/internal/handshake/retry_go125.go

@@ -0,0 +1,68 @@
+//go:build !go1.26
+
+package handshake
+
+import (
+	"bytes"
+	"crypto/aes"
+	"crypto/cipher"
+	"fmt"
+	"sync"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+)
+
+// Instead of using an init function, the AEADs are created lazily.
+// For more details see https://github.com/quic-go/quic-go/issues/4894.
+var (
+	retryAEADv1 cipher.AEAD // used for QUIC v1 (RFC 9000)
+	retryAEADv2 cipher.AEAD // used for QUIC v2 (RFC 9369)
+)
+
+func initAEAD(key [16]byte) cipher.AEAD {
+	aes, err := aes.NewCipher(key[:])
+	if err != nil {
+		panic(err)
+	}
+	aead, err := cipher.NewGCM(aes)
+	if err != nil {
+		panic(err)
+	}
+	return aead
+}
+
+var (
+	retryBuf     bytes.Buffer
+	retryMutex   sync.Mutex
+	retryNonceV1 = [12]byte{0x46, 0x15, 0x99, 0xd3, 0x5d, 0x63, 0x2b, 0xf2, 0x23, 0x98, 0x25, 0xbb}
+	retryNonceV2 = [12]byte{0xd8, 0x69, 0x69, 0xbc, 0x2d, 0x7c, 0x6d, 0x99, 0x90, 0xef, 0xb0, 0x4a}
+)
+
+// GetRetryIntegrityTag calculates the integrity tag on a Retry packet
+func GetRetryIntegrityTag(retry []byte, origDestConnID protocol.ConnectionID, version protocol.Version) *[16]byte {
+	retryMutex.Lock()
+	defer retryMutex.Unlock()
+
+	retryBuf.WriteByte(uint8(origDestConnID.Len()))
+	retryBuf.Write(origDestConnID.Bytes())
+	retryBuf.Write(retry)
+	defer retryBuf.Reset()
+
+	var tag [16]byte
+	var sealed []byte
+	if version == protocol.Version2 {
+		if retryAEADv2 == nil {
+			retryAEADv2 = initAEAD([16]byte{0x8f, 0xb4, 0xb0, 0x1b, 0x56, 0xac, 0x48, 0xe2, 0x60, 0xfb, 0xcb, 0xce, 0xad, 0x7c, 0xcc, 0x92})
+		}
+		sealed = retryAEADv2.Seal(tag[:0], retryNonceV2[:], nil, retryBuf.Bytes())
+	} else {
+		if retryAEADv1 == nil {
+			retryAEADv1 = initAEAD([16]byte{0xbe, 0x0c, 0x69, 0x0b, 0x9f, 0x66, 0x57, 0x5a, 0x1d, 0x76, 0x6b, 0x54, 0xe3, 0x68, 0xc8, 0x4e})
+		}
+		sealed = retryAEADv1.Seal(tag[:0], retryNonceV1[:], nil, retryBuf.Bytes())
+	}
+	if len(sealed) != 16 {
+		panic(fmt.Sprintf("unexpected Retry integrity tag length: %d", len(sealed)))
+	}
+	return &tag
+}

data/go/vendor/github.com/quic-go/quic-go/internal/handshake/retry_go126.go

@@ -0,0 +1,70 @@
+//go:build go1.26
+
+package handshake
+
+import (
+	"bytes"
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/fips140"
+	"fmt"
+	"sync"
+
+	"github.com/quic-go/quic-go/internal/protocol"
+)
+
+// used for QUIC v1 (RFC 9000)
+var retryAEADv1 = initAEAD([16]byte{0xbe, 0x0c, 0x69, 0x0b, 0x9f, 0x66, 0x57, 0x5a, 0x1d, 0x76, 0x6b, 0x54, 0xe3, 0x68, 0xc8, 0x4e})
+
+// used for QUIC v2 (RFC 9369)
+var retryAEADv2 = initAEAD([16]byte{0x8f, 0xb4, 0xb0, 0x1b, 0x56, 0xac, 0x48, 0xe2, 0x60, 0xfb, 0xcb, 0xce, 0xad, 0x7c, 0xcc, 0x92})
+
+func initAEAD(key [16]byte) cipher.AEAD {
+	aes, err := aes.NewCipher(key[:])
+	if err != nil {
+		panic(err)
+	}
+	var aead cipher.AEAD
+	// Retry packet authentication uses the fixed key and nonce specified by RFC 9000.
+	// It acts as an integrity tag for the Retry packet itself, protecting against
+	// accidental modification and making injection harder. It is not used to encrypt
+	// packet contents and therefore outside the scope of FIPS 140 enforcement.
+	fips140.WithoutEnforcement(func() {
+		var err error
+		aead, err = cipher.NewGCM(aes)
+		if err != nil {
+			panic(err)
+		}
+	})
+	return aead
+}
+
+var (
+	retryBuf     bytes.Buffer
+	retryMutex   sync.Mutex
+	retryNonceV1 = [12]byte{0x46, 0x15, 0x99, 0xd3, 0x5d, 0x63, 0x2b, 0xf2, 0x23, 0x98, 0x25, 0xbb}
+	retryNonceV2 = [12]byte{0xd8, 0x69, 0x69, 0xbc, 0x2d, 0x7c, 0x6d, 0x99, 0x90, 0xef, 0xb0, 0x4a}
+)
+
+// GetRetryIntegrityTag calculates the integrity tag on a Retry packet
+func GetRetryIntegrityTag(retry []byte, origDestConnID protocol.ConnectionID, version protocol.Version) *[16]byte {
+	retryMutex.Lock()
+	defer retryMutex.Unlock()
+
+	retryBuf.WriteByte(uint8(origDestConnID.Len()))
+	retryBuf.Write(origDestConnID.Bytes())
+	retryBuf.Write(retry)
+	defer retryBuf.Reset()
+
+	var tag [16]byte
+	var sealed []byte
+	if version == protocol.Version2 {
+		sealed = retryAEADv2.Seal(tag[:0], retryNonceV2[:], nil, retryBuf.Bytes())
+	} else {
+		sealed = retryAEADv1.Seal(tag[:0], retryNonceV1[:], nil, retryBuf.Bytes())
+	}
+	if len(sealed) != 16 {
+		panic(fmt.Sprintf("unexpected Retry integrity tag length: %d", len(sealed)))
+	}
+	return &tag
+}

data/go/vendor/github.com/quic-go/quic-go/internal/handshake/session_ticket.go

@@ -0,0 +1,55 @@
+package handshake
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+
+	"github.com/quic-go/quic-go/internal/wire"
+	"github.com/quic-go/quic-go/quicvarint"
+)
+
+const sessionTicketRevision = 5
+
+type sessionTicket struct {
+	Parameters *wire.TransportParameters
+}
+
+func (t *sessionTicket) Marshal() []byte {
+	b := make([]byte, 0, 256)
+	b = quicvarint.Append(b, sessionTicketRevision)
+	return t.Parameters.MarshalForSessionTicket(b)
+}
+
+func (t *sessionTicket) Unmarshal(b []byte) error {
+	rev, l, err := quicvarint.Parse(b)
+	if err != nil {
+		return errors.New("failed to read session ticket revision")
+	}
+	b = b[l:]
+	if rev != sessionTicketRevision {
+		return fmt.Errorf("unknown session ticket revision: %d", rev)
+	}
+	var tp wire.TransportParameters
+	if err := tp.UnmarshalFromSessionTicket(b); err != nil {
+		return fmt.Errorf("unmarshaling transport parameters from session ticket failed: %s", err.Error())
+	}
+	t.Parameters = &tp
+	return nil
+}
+
+const extraPrefix = "quic-go1"
+
+func addSessionStateExtraPrefix(b []byte) []byte {
+	return append([]byte(extraPrefix), b...)
+}
+
+func findSessionStateExtraData(extras [][]byte) []byte {
+	prefix := []byte(extraPrefix)
+	for _, extra := range extras {
+		if data, ok := bytes.CutPrefix(extra, prefix); ok {
+			return data
+		}
+	}
+	return nil
+}

data/go/vendor/github.com/quic-go/quic-go/internal/handshake/tls_config_go126.go

@@ -0,0 +1,54 @@
+//go:build !go1.27
+
+package handshake
+
+import (
+	"crypto/tls"
+	"net"
+)
+
+func setupConfigForClient(conf *tls.Config) *tls.Config {
+	conf = conf.Clone()
+	conf.MinVersion = tls.VersionTLS13
+	return conf
+}
+
+func setupConfigForServer(conf *tls.Config, localAddr, remoteAddr net.Addr) *tls.Config {
+	// Workaround for https://github.com/golang/go/issues/60506.
+	// This initializes the session tickets _before_ cloning the config.
+	_, _ = conf.DecryptTicket(nil, tls.ConnectionState{})
+
+	conf = conf.Clone()
+	conf.MinVersion = tls.VersionTLS13
+
+	// The tls.Config contains two callbacks that pass in a tls.ClientHelloInfo.
+	// Since crypto/tls doesn't do it, we need to make sure to set the Conn field with a fake net.Conn
+	// that allows the caller to get the local and the remote address.
+	if conf.GetConfigForClient != nil {
+		gcfc := conf.GetConfigForClient
+		conf.GetConfigForClient = func(info *tls.ClientHelloInfo) (*tls.Config, error) {
+			info.Conn = &conn{localAddr: localAddr, remoteAddr: remoteAddr}
+			c, err := gcfc(info)
+			if c != nil {
+				// we're returning a tls.Config here, so we need to apply this recursively
+				c = setupConfigForServer(c, localAddr, remoteAddr)
+			}
+			return c, err
+		}
+	}
+	if conf.GetCertificate != nil {
+		gc := conf.GetCertificate
+		conf.GetCertificate = func(info *tls.ClientHelloInfo) (*tls.Certificate, error) {
+			info.Conn = &conn{localAddr: localAddr, remoteAddr: remoteAddr}
+			return gc(info)
+		}
+	}
+	return conf
+}
+
+func getQUICConfig(tlsConf *tls.Config, _, _ net.Addr) *tls.QUICConfig {
+	return &tls.QUICConfig{
+		TLSConfig:           tlsConf,
+		EnableSessionEvents: true,
+	}
+}