quic 0.0.1 → 0.0.2

data/ext/quic/extconf.rb

@@ -2,53 +2,163 @@
 
 require "mkmf"
 require "mini_portile2"
+require "shellwords"
+require "fileutils"
 
-LIBRESSL_VERSION = "4.3.1"
-LIBRESSL_SHA256 = "c2db42ace14e7d5419826fab35a742ec6e4d12725a051a51d0cea3c10ba0fa50"
-NGTCP2_VERSION = "1.22.1"
-NGTCP2_SHA256 = "063d80531acac0ddbbc1b9d12829a824edc2abe8dba2e632fd1ce15cfd5632f9"
+NGTCP2_VERSION = "1.25.0"
+NGTCP2_SHA256 = "1c0843076528a87b65e9a9d455100941f4cb65d44f96c5da6ae56df146043955"
+# The picotls revision that ngtcp2 1.25.0 is tested against (see ngtcp2's README).
+PICOTLS_COMMIT = "f07f1c8c68b237f1468bc1f1fe1b68aba3ff23b4"
+PICOTLS_SHA256 = "6ecb4f8d9946c2b9342300b29627dc34e746a551d438d35af325a4495d62a6e3"
+# Bump when ext/quic/patches/picotls/ changes; installed? only checks for the archive.
+PICOTLS_PATCH_LEVEL = "p1"
 
-libressl = MiniPortile.new("libressl", LIBRESSL_VERSION)
-libressl.files = [{
-  url: "https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-#{LIBRESSL_VERSION}.tar.gz",
-  sha256: LIBRESSL_SHA256
+# Locate the host's libcrypto. ngtcp2 and picotls are vendored and statically
+# linked, but the crypto primitives and X.509 come from whatever OpenSSL (or
+# LibreSSL) the system provides, linked dynamically. Sharing one libcrypto with
+# Ruby's own openssl extension is the point: two copies in one process
+# interpose on each other's global symbols.
+#
+# Everything downstream resolves OpenSSL through pkg-config -- this file,
+# ngtcp2's configure, and the `openssl` entry in libngtcp2_crypto_picotls.pc's
+# Requires.private -- so --with-openssl-dir is honoured by putting its prefix
+# on PKG_CONFIG_PATH once, here. That keeps all three agreeing on one install
+# instead of each making its own choice.
+_openssl_incdir, openssl_libdir = dir_config("openssl")
+if openssl_libdir
+  ENV["PKG_CONFIG_PATH"] =
+    [File.join(openssl_libdir, "pkgconfig"), ENV["PKG_CONFIG_PATH"]].compact.join(File::PATH_SEPARATOR)
+end
+
+unless pkg_config("openssl")
+  abort "OpenSSL not found. Install its development package (libssl-dev, " \
+        "openssl-devel, ...), or point at a prefix whose lib/pkgconfig holds " \
+        "openssl.pc with --with-openssl-dir=/path."
+end
+# picotls is compiled by hand below and needs the include path on its own.
+openssl_cflags = pkg_config("openssl", "cflags-only-I").to_s.strip
+
+# picotls has no release tarballs, and its CMake build needs the picotest
+# submodule, which GitHub archive tarballs do not contain. Build only the two
+# libraries we need (core + OpenSSL-API backend) into a single libpicotls.a.
+class PicotlsRecipe < MiniPortile
+  SOURCES = %w[lib/picotls.c lib/hpke.c lib/pembase64.c lib/openssl.c].freeze
+
+  attr_accessor :openssl_cflags
+
+  def configure
+  end
+
+  def configured?
+    true
+  end
+
+  def compile
+    cflags = %w[-std=gnu99 -O2 -fPIC -fvisibility=hidden -Iinclude] + openssl_cflags.to_s.shellsplit
+    objects = SOURCES.map do |src|
+      obj = File.basename(src, ".c") + ".o"
+      execute("compile", [*cc_cmd.shellsplit, *cflags, "-c", src, "-o", obj])
+      obj
+    end
+    ar = (ENV["AR"] || RbConfig::CONFIG["AR"] || "ar").shellsplit
+    execute("compile", [*ar, "rcs", "libpicotls.a", *objects])
+  end
+
+  def install
+    FileUtils.mkdir_p([lib_path, include_path])
+    FileUtils.cp(File.join(work_path, "libpicotls.a"), lib_path)
+    FileUtils.cp_r(Dir.glob(File.join(work_path, "include", "*")), include_path)
+  end
+
+  def installed?
+    File.exist?(File.join(lib_path, "libpicotls.a"))
+  end
+end
+
+picotls = PicotlsRecipe.new("picotls", "#{PICOTLS_COMMIT[0, 7]}-#{PICOTLS_PATCH_LEVEL}")
+picotls.files = [{
+  url: "https://github.com/h2o/picotls/archive/#{PICOTLS_COMMIT}.tar.gz",
+  sha256: PICOTLS_SHA256
 }]
-libressl.configure_options = %w[--disable-shared --with-pic]
-libressl.cook
-libressl.activate
+picotls.patch_files = Dir.glob(File.join(__dir__, "patches", "picotls", "*.patch")).sort
+picotls.openssl_cflags = openssl_cflags
+picotls.cook
+# Deliberately no picotls.activate: mkmf_config passes -I/-L below, and not
+# activating keeps the extra directory out of CPATH.
 
 ngtcp2 = MiniPortile.new("ngtcp2", NGTCP2_VERSION)
 ngtcp2.files = [{
   url: "https://github.com/ngtcp2/ngtcp2/releases/download/v#{NGTCP2_VERSION}/ngtcp2-#{NGTCP2_VERSION}.tar.gz",
   sha256: NGTCP2_SHA256
 }]
-ngtcp2.configure_options = %W[
-  --enable-lib-only
-  --disable-shared
-  --with-pic
-  PKG_CONFIG_PATH=#{libressl.path}/lib/pkgconfig
+ngtcp2.configure_options = [
+  "--enable-lib-only",
+  "--disable-shared",
+  "--with-pic",
+  # Skip the quictls/libressl/ossl helpers; only libngtcp2_crypto_picotls.
+  "--without-openssl",
+  "--with-picotls",
+  # crypto/picotls declares lib_LIBRARIES, not lib_LTLIBRARIES, so it is built
+  # by plain ar rather than libtool and --with-pic does not reach it. Without
+  # -fPIC the archive cannot be linked into quic.so.
+  "CFLAGS=-g -O2 -fPIC",
+  "PICOTLS_CFLAGS=-I#{picotls.include_path}",
+  "PICOTLS_LIBS=-L#{picotls.lib_path} -lpicotls"
 ]
+# ngtcp2 still probes for OpenSSL under --without-openssl: its picotls check
+# links the conftest against libcrypto. It finds it through the same
+# PKG_CONFIG_PATH set above, which the configure subprocess inherits.
 ngtcp2.cook
 ngtcp2.activate
 
-# Wire static archives into mkmf in reverse dependency order. mkmf_config
-# prepends to $libs, so the leftmost entry on the final link line ends up being
-# the last one we add here (ngtcp2_crypto_libressl), satisfying static-link
-# ordering: ngtcp2_crypto_libressl -> ngtcp2 -> ssl -> crypto.
-libressl.mkmf_config(pkg: "libcrypto", static: "crypto")
-libressl.mkmf_config(pkg: "libssl", static: "ssl")
-ngtcp2.mkmf_config(pkg: "libngtcp2", static: "ngtcp2")
-ngtcp2.mkmf_config(pkg: "libngtcp2_crypto_libressl", static: "ngtcp2_crypto_libressl")
+# Wire the vendored static archives into mkmf in reverse dependency order.
+# mkmf_config prepends to $libs, so the leftmost entry on the final link line
+# ends up being the last one added here, satisfying static-link ordering:
+# ngtcp2_crypto_picotls -> ngtcp2 -> picotls -> the -lssl -lcrypto that
+# pkg_config("openssl") already put there.
+#
+# Deliberately not the `pkg:` form. Resolving libngtcp2_crypto_picotls.pc
+# would follow its `Requires.private: libngtcp2, openssl` with
+# `pkg-config --static`, which drags in the host libcrypto's own static
+# dependency list (on Ubuntu: -l:libjitterentropy.a -lz -lzstd). Those belong
+# to a static libcrypto we are not linking, and the archives they name are
+# often not even installed. The recipe's own include/lib paths are all we
+# need.
+picotls.mkmf_config(static: "picotls")
+ngtcp2.mkmf_config(static: "ngtcp2")
+ngtcp2.mkmf_config(static: "ngtcp2_crypto_picotls")
 
+# picotls's OpenSSL backend, and the X25519 patch in ext/quic/patches/picotls/,
+# both need the raw public key API introduced in OpenSSL 1.1.1. LibreSSL
+# reports 0x20000000L here, so one check covers both.
+abort "OpenSSL 1.1.1 or later is required" unless try_compile(<<~C)
+  #include <openssl/opensslv.h>
+  #if OPENSSL_VERSION_NUMBER < 0x10101000L
+  #error OpenSSL is too old
+  #endif
+  int main(void) { return 0; }
+C
 abort "ngtcp2 header missing" unless have_header("ngtcp2/ngtcp2.h")
-abort "ngtcp2_crypto_quictls header missing" unless have_header("ngtcp2/ngtcp2_crypto_quictls.h")
-abort "openssl/ssl.h missing" unless have_header("openssl/ssl.h")
+abort "picotls header missing" unless have_header("picotls.h")
+abort "picotls/openssl.h missing" unless have_header("picotls/openssl.h")
+abort "ngtcp2_crypto_picotls header missing" unless have_header("ngtcp2/ngtcp2_crypto_picotls.h")
+abort "picotls was built without X25519 (patch not applied?)" unless try_compile(<<~C)
+  #include <picotls/openssl.h>
+  #if !PTLS_OPENSSL_HAVE_X25519
+  #error X25519 unavailable
+  #endif
+C
 # ngtcp2_conn_client_new and most other ngtcp2 entry points are exposed as
 # ABI-versioned macros, so use non-macro symbols for link verification.
 abort "libngtcp2 not linkable" unless have_func("ngtcp2_version", "ngtcp2/ngtcp2.h")
-abort "libngtcp2_crypto_libressl not linkable" unless have_func("ngtcp2_crypto_quictls_init", "ngtcp2/ngtcp2_crypto_quictls.h")
-abort "libssl not linkable" unless have_func("OpenSSL_version", "openssl/opensslv.h")
+abort "libngtcp2_crypto_picotls not linkable" unless
+  have_func("ngtcp2_crypto_picotls_configure_client_context", %w[picotls.h ngtcp2/ngtcp2_crypto_picotls.h])
+abort "libcrypto not linkable" unless have_func("OpenSSL_version", "openssl/crypto.h")
 
+# picotls has neither a version macro nor releases, so QUIC.library_versions
+# reports the commit the extension was built against.
+append_cflags("-DQUIC_PICOTLS_COMMIT=\\\"#{PICOTLS_COMMIT}\\\"")
 append_cflags("-fvisibility=hidden")
+append_ldflags("-Wl,--exclude-libs,ALL")  # Unexport symbols from statically linked libraries
 
 create_makefile("quic/quic")

data/ext/quic/patches/picotls/0001-openssl-use-raw-public-key-api-for-X25519.patch

@@ -0,0 +1,74 @@
+Subject: [PATCH] openssl: use the raw public key API for X25519
+
+LibreSSL does not provide EVP_PKEY_get1_tls_encodedpoint() /
+EVP_PKEY_set1_tls_encodedpoint(), so picotls disables ptls_openssl_x25519
+when built against LibreSSL. Switch the EVP-based X25519 key exchange to
+EVP_PKEY_get_raw_public_key() / EVP_PKEY_new_raw_public_key() and drop the
+LibreSSL exclusion.
+
+Verified with LibreSSL 4.3.1 and OpenSSL 3.5.7 (picotls test-openssl.t,
+including x25519-to-minicrypto / x25519-from-minicrypto).
+
+Not upstream. Requires OpenSSL >= 1.1.1 (1.1.0 lacks the raw key API).
+Applies to h2o/picotls@b84869f41414b6d0148db7728f1cf12f5b544874.
+
+diff --git a/include/picotls/openssl.h b/include/picotls/openssl.h
+index 37a0740..04e4653 100644
+--- a/include/picotls/openssl.h
++++ b/include/picotls/openssl.h
+@@ -60,7 +60,7 @@ extern ptls_key_exchange_algorithm_t ptls_openssl_secp521r1;
+ #ifdef EVP_PKEY_ED25519
+ #define PTLS_OPENSSL_HAVE_ED25519 1
+ #endif
+-#if defined(NID_X25519) && !defined(LIBRESSL_VERSION_NUMBER)
++#if defined(NID_X25519)
+ #define PTLS_OPENSSL_HAVE_X25519 1
+ #define PTLS_OPENSSL_HAS_X25519 1 /* deprecated; use HAVE_ */
+ extern ptls_key_exchange_algorithm_t ptls_openssl_x25519;
+diff --git a/lib/openssl.c b/lib/openssl.c
+index d6d073b..1c7e492 100644
+--- a/lib/openssl.c
++++ b/lib/openssl.c
+@@ -559,15 +559,7 @@ static int evp_keyex_on_exchange(ptls_key_exchange_context_t **_ctx, int release
+ #undef X25519_KEY_SIZE
+ #endif
+ 
+-    if ((evppeer = EVP_PKEY_new()) == NULL) {
+-        ret = PTLS_ERROR_NO_MEMORY;
+-        goto Exit;
+-    }
+-    if (EVP_PKEY_copy_parameters(evppeer, ctx->privkey) <= 0) {
+-        ret = PTLS_ERROR_LIBRARY;
+-        goto Exit;
+-    }
+-    if (EVP_PKEY_set1_tls_encodedpoint(evppeer, peerkey.base, peerkey.len) <= 0) {
++    if ((evppeer = EVP_PKEY_new_raw_public_key(EVP_PKEY_id(ctx->privkey), NULL, peerkey.base, peerkey.len)) == NULL) {
+         ret = PTLS_ERROR_LIBRARY;
+         goto Exit;
+     }
+@@ -629,10 +621,21 @@ static int evp_keyex_init(ptls_key_exchange_algorithm_t *algo, ptls_key_exchange
+     *ctx = (struct st_evp_keyex_context_t){{algo, {NULL}, evp_keyex_on_exchange}, pkey};
+ 
+     /* set public key */
+-    if ((ctx->super.pubkey.len = EVP_PKEY_get1_tls_encodedpoint(ctx->privkey, &ctx->super.pubkey.base)) == 0) {
+-        ctx->super.pubkey.base = NULL;
+-        ret = PTLS_ERROR_NO_MEMORY;
+-        goto Exit;
++    {
++        size_t publen = 0;
++        if (EVP_PKEY_get_raw_public_key(ctx->privkey, NULL, &publen) != 1 || publen == 0) {
++            ret = PTLS_ERROR_LIBRARY;
++            goto Exit;
++        }
++        if ((ctx->super.pubkey.base = OPENSSL_malloc(publen)) == NULL) {
++            ret = PTLS_ERROR_NO_MEMORY;
++            goto Exit;
++        }
++        if (EVP_PKEY_get_raw_public_key(ctx->privkey, ctx->super.pubkey.base, &publen) != 1) {
++            ret = PTLS_ERROR_LIBRARY;
++            goto Exit;
++        }
++        ctx->super.pubkey.len = publen;
+     }
+ 
+     *_ctx = &ctx->super;

data/ext/quic/quic.c

@@ -1,24 +1,25 @@
 #include "quic.h"
 #include "stream.h"
 
-VALUE rb_mQuic;
-VALUE rb_mQuicConnection;
-VALUE rb_cQuicConnectionClient;
+VALUE rb_mQUIC;
+VALUE rb_mQUICConnection;
+VALUE rb_cQUICConnectionClient;
 
-VALUE rb_eQuicError;
-VALUE rb_eQuicErrorProto;
-VALUE rb_eQuicErrorDropConn;
-VALUE rb_eQuicErrorRetry;
-VALUE rb_eQuicErrorClosed;
-VALUE rb_eQuicErrorCryptoError;
-VALUE rb_eQuicErrorHandshakeTimeout;
-VALUE rb_eQuicErrorFlowControl;
-VALUE rb_eQuicErrorUnknown;
-VALUE rb_eQuicErrorWaitReadable;
-VALUE rb_eQuicErrorWaitWritable;
-VALUE rb_eQuicErrorStreamClosed;
-VALUE rb_eQuicErrorStreamReset;
-VALUE rb_eQuicErrorNotBound;
+VALUE rb_eQUICError;
+VALUE rb_eQUICErrorProto;
+VALUE rb_eQUICErrorDropConn;
+VALUE rb_eQUICErrorRetry;
+VALUE rb_eQUICErrorClosed;
+VALUE rb_eQUICErrorCryptoError;
+VALUE rb_eQUICErrorCertificateVerifyFailed;
+VALUE rb_eQUICErrorHandshakeTimeout;
+VALUE rb_eQUICErrorFlowControl;
+VALUE rb_eQUICErrorUnknown;
+VALUE rb_eQUICErrorWaitReadable;
+VALUE rb_eQUICErrorWaitWritable;
+VALUE rb_eQUICErrorStreamClosed;
+VALUE rb_eQUICErrorStreamReset;
+VALUE rb_eQUICErrorNotBound;
 
 static VALUE
 quic_library_versions(VALUE self)
@@ -29,6 +30,10 @@ quic_library_versions(VALUE self)
                rb_str_new_cstr(ngtcp2_version(0)->version_str));
   rb_hash_aset(h, ID2SYM(rb_intern("openssl")),
                rb_str_new_cstr(OpenSSL_version(OPENSSL_VERSION)));
+  /* picotls has neither a version macro nor releases, so report the commit
+     extconf.rb built against (passed in as -DQUIC_PICOTLS_COMMIT). */
+  rb_hash_aset(h, ID2SYM(rb_intern("picotls")),
+               rb_str_new_cstr(QUIC_PICOTLS_COMMIT));
   return h;
 }
 
@@ -38,35 +43,35 @@ quic_raise_ngtcp2_error(int rv)
   VALUE cls;
   switch (rv) {
     case NGTCP2_ERR_PROTO:
-      cls = rb_eQuicErrorProto;
+      cls = rb_eQUICErrorProto;
       break;
     case NGTCP2_ERR_DROP_CONN:
-      cls = rb_eQuicErrorDropConn;
+      cls = rb_eQUICErrorDropConn;
       break;
     case NGTCP2_ERR_RETRY:
-      cls = rb_eQuicErrorRetry;
+      cls = rb_eQUICErrorRetry;
       break;
     case NGTCP2_ERR_CLOSING:
     case NGTCP2_ERR_DRAINING:
-      cls = rb_eQuicErrorClosed;
+      cls = rb_eQUICErrorClosed;
       break;
     case NGTCP2_ERR_IDLE_CLOSE:
-      cls = rb_eQuicErrorClosed;
+      cls = rb_eQUICErrorClosed;
       break;
     case NGTCP2_ERR_CRYPTO:
-      cls = rb_eQuicErrorCryptoError;
+      cls = rb_eQUICErrorCryptoError;
       break;
     case NGTCP2_ERR_HANDSHAKE_TIMEOUT:
-      cls = rb_eQuicErrorHandshakeTimeout;
+      cls = rb_eQUICErrorHandshakeTimeout;
       break;
     case NGTCP2_ERR_STREAM_DATA_BLOCKED:
-      cls = rb_eQuicErrorFlowControl;
+      cls = rb_eQUICErrorFlowControl;
       break;
     case NGTCP2_ERR_STREAM_SHUT_WR:
-      cls = rb_eQuicErrorStreamClosed;
+      cls = rb_eQUICErrorStreamClosed;
       break;
     default:
-      cls = rb_eQuicErrorUnknown;
+      cls = rb_eQUICErrorUnknown;
       break;
   }
 
@@ -78,37 +83,44 @@ quic_raise_ngtcp2_error(int rv)
 RUBY_FUNC_EXPORTED void
 Init_quic(void)
 {
-  rb_mQuic = rb_define_module("Quic");
-  rb_mQuicConnection = rb_define_module_under(rb_mQuic, "Connection");
-  rb_define_singleton_method(rb_mQuic, "library_versions", quic_library_versions, 0);
+  rb_mQUIC = rb_define_module("QUIC");
+  rb_mQUICConnection = rb_define_module_under(rb_mQUIC, "Connection");
+  rb_define_singleton_method(rb_mQUIC, "library_versions", quic_library_versions, 0);
 
-  /* Quic::Error is defined in Ruby (lib/quic.rb) before this Init_quic runs,
+  /* QUIC::Error is defined in Ruby (lib/quic.rb) before this Init_quic runs,
      so rb_const_get retrieves the already-defined base class. Subclasses live
-     under Quic::Error::<Name>. */
-  rb_eQuicError = rb_const_get(rb_mQuic, rb_intern("Error"));
-  rb_eQuicErrorProto = rb_define_class_under(rb_eQuicError, "Proto", rb_eQuicError);
-  rb_eQuicErrorDropConn = rb_define_class_under(rb_eQuicError, "DropConn", rb_eQuicError);
-  rb_eQuicErrorRetry = rb_define_class_under(rb_eQuicError, "Retry", rb_eQuicError);
-  rb_eQuicErrorClosed = rb_define_class_under(rb_eQuicError, "Closed", rb_eQuicError);
-  rb_eQuicErrorCryptoError = rb_define_class_under(rb_eQuicError, "CryptoError", rb_eQuicError);
-  rb_eQuicErrorHandshakeTimeout = rb_define_class_under(rb_eQuicError, "HandshakeTimeout", rb_eQuicError);
-  rb_eQuicErrorFlowControl = rb_define_class_under(rb_eQuicError, "FlowControl", rb_eQuicError);
-  rb_eQuicErrorUnknown = rb_define_class_under(rb_eQuicError, "Unknown", rb_eQuicError);
+     under QUIC::Error::<Name>. */
+  rb_eQUICError = rb_const_get(rb_mQUIC, rb_intern("Error"));
+  rb_eQUICErrorProto = rb_define_class_under(rb_eQUICError, "Proto", rb_eQUICError);
+  rb_eQUICErrorDropConn = rb_define_class_under(rb_eQUICError, "DropConn", rb_eQUICError);
+  rb_eQUICErrorRetry = rb_define_class_under(rb_eQUICError, "Retry", rb_eQUICError);
+  rb_eQUICErrorClosed = rb_define_class_under(rb_eQUICError, "Closed", rb_eQUICError);
+  rb_eQUICErrorCryptoError = rb_define_class_under(rb_eQUICError, "CryptoError", rb_eQUICError);
+  /* The TLS alert this client sent, when read_pkt fails in the handshake.
+     Alerts received from the peer are not recorded by ngtcp2. */
+  rb_define_attr(rb_eQUICErrorCryptoError, "tls_alert", 1, 0);
+  rb_eQUICErrorCertificateVerifyFailed =
+    rb_define_class_under(rb_eQUICError, "CertificateVerifyFailed", rb_eQUICErrorCryptoError);
+  /* X509_V_ERR_* from the chain / name check, or nil when no certificate came. */
+  rb_define_attr(rb_eQUICErrorCertificateVerifyFailed, "verify_result", 1, 0);
+  rb_eQUICErrorHandshakeTimeout = rb_define_class_under(rb_eQUICError, "HandshakeTimeout", rb_eQUICError);
+  rb_eQUICErrorFlowControl = rb_define_class_under(rb_eQUICError, "FlowControl", rb_eQUICError);
+  rb_eQUICErrorUnknown = rb_define_class_under(rb_eQUICError, "Unknown", rb_eQUICError);
 
   /* IO-style non-blocking errors. Mix in the standard IO::Wait{Readable,Writable}
-     modules so callers can `rescue IO::WaitReadable` (or the Quic subclass)
+     modules so callers can `rescue IO::WaitReadable` (or the QUIC subclass)
      interchangeably with stdlib IO objects. */
   VALUE io_wait_readable = rb_const_get(rb_cIO, rb_intern("WaitReadable"));
   VALUE io_wait_writable = rb_const_get(rb_cIO, rb_intern("WaitWritable"));
-  rb_eQuicErrorWaitReadable = rb_define_class_under(rb_eQuicError, "WaitReadable", rb_eQuicError);
-  rb_include_module(rb_eQuicErrorWaitReadable, io_wait_readable);
-  rb_eQuicErrorWaitWritable = rb_define_class_under(rb_eQuicError, "WaitWritable", rb_eQuicError);
-  rb_include_module(rb_eQuicErrorWaitWritable, io_wait_writable);
+  rb_eQUICErrorWaitReadable = rb_define_class_under(rb_eQUICError, "WaitReadable", rb_eQUICError);
+  rb_include_module(rb_eQUICErrorWaitReadable, io_wait_readable);
+  rb_eQUICErrorWaitWritable = rb_define_class_under(rb_eQUICError, "WaitWritable", rb_eQUICError);
+  rb_include_module(rb_eQUICErrorWaitWritable, io_wait_writable);
 
-  rb_eQuicErrorStreamClosed = rb_define_class_under(rb_eQuicError, "StreamClosed", rb_eQuicError);
-  rb_eQuicErrorStreamReset = rb_define_class_under(rb_eQuicError, "StreamReset", rb_eQuicError);
-  rb_eQuicErrorNotBound = rb_define_class_under(rb_eQuicError, "NotBound", rb_eQuicError);
+  rb_eQUICErrorStreamClosed = rb_define_class_under(rb_eQUICError, "StreamClosed", rb_eQUICError);
+  rb_eQUICErrorStreamReset = rb_define_class_under(rb_eQUICError, "StreamReset", rb_eQUICError);
+  rb_eQUICErrorNotBound = rb_define_class_under(rb_eQUICError, "NotBound", rb_eQUICError);
 
-  Init_quic_connection_client(rb_mQuicConnection);
-  Init_quic_stream(rb_mQuic);
+  Init_quic_connection_client(rb_mQUICConnection);
+  Init_quic_stream(rb_mQUIC);
 }

data/ext/quic/quic.h

@@ -6,38 +6,48 @@
 
 #include <ngtcp2/ngtcp2.h>
 #include <ngtcp2/ngtcp2_crypto.h>
-#include <ngtcp2/ngtcp2_crypto_quictls.h>
-#include <openssl/ssl.h>
-
-extern VALUE rb_mQuic;
-extern VALUE rb_mQuicConnection;
-extern VALUE rb_cQuicConnectionClient;
-
-extern VALUE rb_eQuicError;
-extern VALUE rb_eQuicErrorProto;
-extern VALUE rb_eQuicErrorDropConn;
-extern VALUE rb_eQuicErrorRetry;
-extern VALUE rb_eQuicErrorClosed;
-extern VALUE rb_eQuicErrorCryptoError;
-extern VALUE rb_eQuicErrorHandshakeTimeout;
-extern VALUE rb_eQuicErrorFlowControl;
-extern VALUE rb_eQuicErrorUnknown;
-extern VALUE rb_eQuicErrorWaitReadable;
-extern VALUE rb_eQuicErrorWaitWritable;
-extern VALUE rb_eQuicErrorStreamClosed;
-extern VALUE rb_eQuicErrorStreamReset;
-extern VALUE rb_eQuicErrorNotBound;
-
-void Init_quic_connection_client(VALUE rb_mQuicConnection);
+#include <picotls.h>
+#include <picotls/openssl.h>
+#include <ngtcp2/ngtcp2_crypto_picotls.h>
+#include <openssl/crypto.h>
+
+/* picotls disables ptls_openssl_x25519 unless it is built with the patch in
+   ext/quic/patches/picotls/. extconf.rb checks the same condition at configure
+   time; this catches a prebuilt ports/ tree whose patch was swapped out. */
+#if !PTLS_OPENSSL_HAVE_X25519
+#error "picotls was built without X25519; is ext/quic/patches/picotls/*.patch applied?"
+#endif
+
+extern VALUE rb_mQUIC;
+extern VALUE rb_mQUICConnection;
+extern VALUE rb_cQUICConnectionClient;
+
+extern VALUE rb_eQUICError;
+extern VALUE rb_eQUICErrorProto;
+extern VALUE rb_eQUICErrorDropConn;
+extern VALUE rb_eQUICErrorRetry;
+extern VALUE rb_eQUICErrorClosed;
+extern VALUE rb_eQUICErrorCryptoError;
+extern VALUE rb_eQUICErrorCertificateVerifyFailed;
+extern VALUE rb_eQUICErrorHandshakeTimeout;
+extern VALUE rb_eQUICErrorFlowControl;
+extern VALUE rb_eQUICErrorUnknown;
+extern VALUE rb_eQUICErrorWaitReadable;
+extern VALUE rb_eQUICErrorWaitWritable;
+extern VALUE rb_eQUICErrorStreamClosed;
+extern VALUE rb_eQUICErrorStreamReset;
+extern VALUE rb_eQUICErrorNotBound;
+
+void Init_quic_connection_client(VALUE rb_mQUICConnection);
 
 /* Accessor used by stream.c to issue ngtcp2 calls (e.g.
    ngtcp2_conn_shutdown_stream_read) for streams that hold a back-reference
-   to their parent Quic::Connection::Client via @client. Returns the raw
+   to their parent QUIC::Connection::Client via @client. Returns the raw
    ngtcp2_conn pointer; the caller is responsible for ensuring the Ruby
    Client object is alive for the duration of the call. */
 ngtcp2_conn *quic_client_conn(VALUE client);
 
-/* Raise a Quic::Error subclass mapped from an ngtcp2 negative error code.
+/* Raise a QUIC::Error subclass mapped from an ngtcp2 negative error code.
    Never returns. */
 NORETURN(void quic_raise_ngtcp2_error(int rv));