quic 0.0.1 → 0.0.3

data/ext/quic/endpoint.h

@@ -0,0 +1,28 @@
+#ifndef QUIC_ENDPOINT_H
+#define QUIC_ENDPOINT_H 1
+
+#include "connection_common.h"
+
+extern VALUE rb_cQUICEndpoint;
+
+/* The CID table, for the get_new_connection_id2 and remove_connection_id
+   callbacks of a connection the Endpoint holds. conn is that connection's
+   object. Neither touches Ruby objects, so the callbacks need no
+   rb_protect. dissociate leaves an entry that maps to another connection
+   alone. */
+void quic_endpoint_associate_cid(quic_endpoint_t *ep, const ngtcp2_cid *cid, VALUE conn);
+void quic_endpoint_dissociate_cid(quic_endpoint_t *ep, const ngtcp2_cid *cid, VALUE conn);
+
+/* The Stateless Reset token for cid, derived from the Endpoint's secret so
+   that it can be made again for a CID no longer in the table. token is
+   NGTCP2_STATELESS_RESET_TOKENLEN bytes. Returns 0, or -1 on failure. */
+int quic_endpoint_generate_reset_token(const quic_endpoint_t *ep, uint8_t *token,
+                                       const ngtcp2_cid *cid);
+
+/* Connection#close of a connection the Endpoint holds: build the
+   CONNECTION_CLOSE carrying ccerr, queue it for Endpoint#write_pkt and
+   start the closing period. When ngtcp2 cannot build the packet, the
+   connection leaves the table at once. */
+void quic_endpoint_close_conn(quic_endpoint_t *ep, quic_conn_t *c, const ngtcp2_ccerr *ccerr);
+
+#endif /* QUIC_ENDPOINT_H */

data/ext/quic/ext_api.c

@@ -0,0 +1,112 @@
+#include "connection_common.h"
+
+/* The quic_ext_api table of quic/ext.h. A quic_ext_conn * is a quic_conn_t *
+   behind the opaque type. None of these functions raises a Ruby exception
+   except quic_ext_conn_get; they return 0 or a QUIC_EXT_ERR_* code. */
+
+static quic_conn_t *
+quic_ext_conn_struct(quic_ext_conn *ec)
+{
+  return (quic_conn_t *)ec;
+}
+
+/* Raises TypeError unless conn is a QUIC::Connection::Client or Server. */
+static quic_ext_conn *
+quic_ext_conn_get(VALUE conn)
+{
+  return (quic_ext_conn *)rb_check_typeddata(conn, &quic_conn_data_type);
+}
+
+/* Hand every stream of the connection to h. Allowed once, and only before
+   the connection has a QUIC::Stream: the two modes cannot share streams.
+   Every member of the ABI 1.0 handler is called, so h must be at least that
+   large. @stream_handler marks the connection for the Ruby side, which then
+   refuses #accept_stream. */
+static int
+quic_ext_set_stream_handler(quic_ext_conn *ec, const quic_ext_stream_handler *h,
+                            void *ud, VALUE owner)
+{
+  quic_conn_t *c = quic_ext_conn_struct(ec);
+  if (h == NULL || h->size < sizeof(quic_ext_stream_handler)) return QUIC_EXT_ERR_OTHER;
+  if (c->handler != NULL) return QUIC_EXT_ERR_INVALID_STATE;
+  VALUE streams = rb_ivar_get(c->owner, rb_intern("@streams"));
+  if (RB_TYPE_P(streams, T_HASH) && RHASH_SIZE(streams) > 0) return QUIC_EXT_ERR_INVALID_STATE;
+
+  c->handler = h;
+  c->handler_ud = ud;
+  c->handler_owner = owner;
+  rb_ivar_set(c->owner, rb_intern("@stream_handler"), Qtrue);
+  return 0;
+}
+
+static int
+quic_ext_open_uni_stream(quic_ext_conn *ec, int64_t *id)
+{
+  quic_conn_t *c = quic_ext_conn_struct(ec);
+  int rv = ngtcp2_conn_open_uni_stream(c->conn, id, NULL);
+  if (rv == NGTCP2_ERR_STREAM_ID_BLOCKED) return QUIC_EXT_ERR_STREAM_ID_BLOCKED;
+  return rv == 0 ? 0 : QUIC_EXT_ERR_OTHER;
+}
+
+/* Give the peer n more bytes of credit on the stream and the connection,
+   for data the handler has now consumed (for HTTP/3, request body handed
+   to the application). */
+static int
+quic_ext_consume(quic_ext_conn *ec, int64_t id, uint64_t n)
+{
+  quic_conn_t *c = quic_ext_conn_struct(ec);
+  if (ngtcp2_conn_extend_max_stream_offset(c->conn, id, n) != 0) return QUIC_EXT_ERR_OTHER;
+  ngtcp2_conn_extend_max_offset(c->conn, n);
+  return 0;
+}
+
+/* Both return 0 for a stream ngtcp2 no longer knows. */
+static int
+quic_ext_shutdown_stream_read(quic_ext_conn *ec, int64_t id, uint64_t app_error_code)
+{
+  quic_conn_t *c = quic_ext_conn_struct(ec);
+  return ngtcp2_conn_shutdown_stream_read(c->conn, 0, id, app_error_code) == 0
+    ? 0 : QUIC_EXT_ERR_OTHER;
+}
+
+static int
+quic_ext_shutdown_stream_write(quic_ext_conn *ec, int64_t id, uint64_t app_error_code)
+{
+  quic_conn_t *c = quic_ext_conn_struct(ec);
+  return ngtcp2_conn_shutdown_stream_write(c->conn, 0, id, app_error_code) == 0
+    ? 0 : QUIC_EXT_ERR_OTHER;
+}
+
+/* This endpoint's initial_max_streams_bidi. nghttp3 needs it at setup;
+   later raises arrive through the extend_max_remote_streams_bidi handler. */
+static uint64_t
+quic_ext_local_max_streams_bidi(quic_ext_conn *ec)
+{
+  quic_conn_t *c = quic_ext_conn_struct(ec);
+  return ngtcp2_conn_get_local_transport_params2(c->conn)->initial_max_streams_bidi;
+}
+
+/* Remember the application error to close the connection with after the
+   handler reports a failure (for HTTP/3, the H3_* code nghttp3 gave). */
+static int
+quic_ext_set_application_error(quic_ext_conn *ec, uint64_t app_error_code)
+{
+  quic_conn_t *c = quic_ext_conn_struct(ec);
+  ngtcp2_ccerr_set_application_error(&c->close_error, app_error_code, NULL, 0);
+  c->close_error_set = true;
+  return 0;
+}
+
+const quic_ext_api quic_ext_api_table = {
+  .abi_major = QUIC_EXT_ABI_MAJOR,
+  .abi_minor = 0,
+  .size = sizeof(quic_ext_api),
+  .conn_get = quic_ext_conn_get,
+  .set_stream_handler = quic_ext_set_stream_handler,
+  .open_uni_stream = quic_ext_open_uni_stream,
+  .consume = quic_ext_consume,
+  .shutdown_stream_read = quic_ext_shutdown_stream_read,
+  .shutdown_stream_write = quic_ext_shutdown_stream_write,
+  .local_max_streams_bidi = quic_ext_local_max_streams_bidi,
+  .set_application_error = quic_ext_set_application_error,
+};

data/ext/quic/extconf.rb

@@ -2,53 +2,170 @@
 
 require "mkmf"
 require "mini_portile2"
+require "shellwords"
+require "fileutils"
 
-LIBRESSL_VERSION = "4.3.1"
-LIBRESSL_SHA256 = "c2db42ace14e7d5419826fab35a742ec6e4d12725a051a51d0cea3c10ba0fa50"
-NGTCP2_VERSION = "1.22.1"
-NGTCP2_SHA256 = "063d80531acac0ddbbc1b9d12829a824edc2abe8dba2e632fd1ce15cfd5632f9"
+NGTCP2_VERSION = "1.25.0"
+NGTCP2_SHA256 = "1c0843076528a87b65e9a9d455100941f4cb65d44f96c5da6ae56df146043955"
+# The picotls revision that ngtcp2 1.25.0 is tested against (see ngtcp2's README).
+PICOTLS_COMMIT = "f07f1c8c68b237f1468bc1f1fe1b68aba3ff23b4"
+PICOTLS_SHA256 = "6ecb4f8d9946c2b9342300b29627dc34e746a551d438d35af325a4495d62a6e3"
+# Bump when ext/quic/patches/picotls/ or PicotlsRecipe::SOURCES changes;
+# installed? only checks for the archive.
+PICOTLS_PATCH_LEVEL = "p2"
 
-libressl = MiniPortile.new("libressl", LIBRESSL_VERSION)
-libressl.files = [{
-  url: "https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-#{LIBRESSL_VERSION}.tar.gz",
-  sha256: LIBRESSL_SHA256
+# Locate the host's libcrypto. ngtcp2 and picotls are vendored and statically
+# linked, but the crypto primitives and X.509 come from whatever OpenSSL (or
+# LibreSSL) the system provides, linked dynamically. Sharing one libcrypto with
+# Ruby's own openssl extension is the point: two copies in one process
+# interpose on each other's global symbols.
+#
+# Everything downstream resolves OpenSSL through pkg-config -- this file,
+# ngtcp2's configure, and the `openssl` entry in libngtcp2_crypto_picotls.pc's
+# Requires.private -- so --with-openssl-dir is honoured by putting its prefix
+# on PKG_CONFIG_PATH once, here. That keeps all three agreeing on one install
+# instead of each making its own choice.
+_openssl_incdir, openssl_libdir = dir_config("openssl")
+if openssl_libdir
+  ENV["PKG_CONFIG_PATH"] =
+    [File.join(openssl_libdir, "pkgconfig"), ENV["PKG_CONFIG_PATH"]].compact.join(File::PATH_SEPARATOR)
+end
+
+unless pkg_config("openssl")
+  abort "OpenSSL not found. Install its development package (libssl-dev, " \
+        "openssl-devel, ...), or point at a prefix whose lib/pkgconfig holds " \
+        "openssl.pc with --with-openssl-dir=/path."
+end
+# picotls is compiled by hand below and needs the include path on its own.
+openssl_cflags = pkg_config("openssl", "cflags-only-I").to_s.strip
+
+# picotls has no release tarballs, and its CMake build needs the picotest
+# submodule, which GitHub archive tarballs do not contain. Build only what
+# quic.so uses into a single libpicotls.a: the core and the OpenSSL-API
+# backend. The core's lib/pembase64.c, a PEM loader, is left out; the server
+# reads its certificates with libcrypto instead.
+class PicotlsRecipe < MiniPortile
+  SOURCES = %w[lib/picotls.c lib/hpke.c lib/openssl.c].freeze
+
+  attr_accessor :openssl_cflags
+
+  def configure
+  end
+
+  def configured?
+    true
+  end
+
+  def compile
+    cflags = %w[-std=gnu99 -O2 -fPIC -fvisibility=hidden -Iinclude] + openssl_cflags.to_s.shellsplit
+    objects = SOURCES.map do |src|
+      obj = File.basename(src, ".c") + ".o"
+      execute("compile", [*cc_cmd.shellsplit, *cflags, "-c", src, "-o", obj])
+      obj
+    end
+    ar = (ENV["AR"] || RbConfig::CONFIG["AR"] || "ar").shellsplit
+    execute("compile", [*ar, "rcs", "libpicotls.a", *objects])
+  end
+
+  def install
+    FileUtils.mkdir_p([lib_path, include_path])
+    FileUtils.cp(File.join(work_path, "libpicotls.a"), lib_path)
+    FileUtils.cp_r(Dir.glob(File.join(work_path, "include", "*")), include_path)
+  end
+
+  def installed?
+    File.exist?(File.join(lib_path, "libpicotls.a"))
+  end
+end
+
+picotls = PicotlsRecipe.new("picotls", "#{PICOTLS_COMMIT[0, 7]}-#{PICOTLS_PATCH_LEVEL}")
+picotls.files = [{
+  url: "https://github.com/h2o/picotls/archive/#{PICOTLS_COMMIT}.tar.gz",
+  sha256: PICOTLS_SHA256
 }]
-libressl.configure_options = %w[--disable-shared --with-pic]
-libressl.cook
-libressl.activate
+picotls.patch_files = Dir.glob(File.join(__dir__, "patches", "picotls", "*.patch")).sort
+picotls.openssl_cflags = openssl_cflags
+picotls.cook
+# Deliberately no picotls.activate: mkmf_config passes -I/-L below, and not
+# activating keeps the extra directory out of CPATH.
 
 ngtcp2 = MiniPortile.new("ngtcp2", NGTCP2_VERSION)
 ngtcp2.files = [{
   url: "https://github.com/ngtcp2/ngtcp2/releases/download/v#{NGTCP2_VERSION}/ngtcp2-#{NGTCP2_VERSION}.tar.gz",
   sha256: NGTCP2_SHA256
 }]
-ngtcp2.configure_options = %W[
-  --enable-lib-only
-  --disable-shared
-  --with-pic
-  PKG_CONFIG_PATH=#{libressl.path}/lib/pkgconfig
+ngtcp2.configure_options = [
+  "--enable-lib-only",
+  "--disable-shared",
+  "--with-pic",
+  # Skip the quictls/libressl/ossl helpers; only libngtcp2_crypto_picotls.
+  "--without-openssl",
+  "--with-picotls",
+  # crypto/picotls declares lib_LIBRARIES, not lib_LTLIBRARIES, so it is built
+  # by plain ar rather than libtool and --with-pic does not reach it. Without
+  # -fPIC the archive cannot be linked into quic.so.
+  "CFLAGS=-g -O2 -fPIC",
+  "PICOTLS_CFLAGS=-I#{picotls.include_path}",
+  "PICOTLS_LIBS=-L#{picotls.lib_path} -lpicotls"
 ]
+# ngtcp2 still probes for OpenSSL under --without-openssl: its picotls check
+# links the conftest against libcrypto. It finds it through the same
+# PKG_CONFIG_PATH set above, which the configure subprocess inherits.
 ngtcp2.cook
 ngtcp2.activate
 
-# Wire static archives into mkmf in reverse dependency order. mkmf_config
-# prepends to $libs, so the leftmost entry on the final link line ends up being
-# the last one we add here (ngtcp2_crypto_libressl), satisfying static-link
-# ordering: ngtcp2_crypto_libressl -> ngtcp2 -> ssl -> crypto.
-libressl.mkmf_config(pkg: "libcrypto", static: "crypto")
-libressl.mkmf_config(pkg: "libssl", static: "ssl")
-ngtcp2.mkmf_config(pkg: "libngtcp2", static: "ngtcp2")
-ngtcp2.mkmf_config(pkg: "libngtcp2_crypto_libressl", static: "ngtcp2_crypto_libressl")
+# Wire the vendored static archives into mkmf in reverse dependency order.
+# mkmf_config prepends to $libs, so the leftmost entry on the final link line
+# ends up being the last one added here, satisfying static-link ordering:
+# ngtcp2_crypto_picotls -> ngtcp2 -> picotls -> the -lssl -lcrypto that
+# pkg_config("openssl") already put there.
+#
+# Deliberately not the `pkg:` form. Resolving libngtcp2_crypto_picotls.pc
+# would follow its `Requires.private: libngtcp2, openssl` with
+# `pkg-config --static`, which drags in the host libcrypto's own static
+# dependency list (on Ubuntu: -l:libjitterentropy.a -lz -lzstd). Those belong
+# to a static libcrypto we are not linking, and the archives they name are
+# often not even installed. The recipe's own include/lib paths are all we
+# need.
+picotls.mkmf_config(static: "picotls")
+ngtcp2.mkmf_config(static: "ngtcp2")
+ngtcp2.mkmf_config(static: "ngtcp2_crypto_picotls")
 
+# picotls's OpenSSL backend, and the X25519 patch in ext/quic/patches/picotls/,
+# both need the raw public key API introduced in OpenSSL 1.1.1. LibreSSL
+# reports 0x20000000L here, so one check covers both.
+abort "OpenSSL 1.1.1 or later is required" unless try_compile(<<~C)
+  #include <openssl/opensslv.h>
+  #if OPENSSL_VERSION_NUMBER < 0x10101000L
+  #error OpenSSL is too old
+  #endif
+  int main(void) { return 0; }
+C
 abort "ngtcp2 header missing" unless have_header("ngtcp2/ngtcp2.h")
-abort "ngtcp2_crypto_quictls header missing" unless have_header("ngtcp2/ngtcp2_crypto_quictls.h")
-abort "openssl/ssl.h missing" unless have_header("openssl/ssl.h")
+abort "picotls header missing" unless have_header("picotls.h")
+abort "picotls/openssl.h missing" unless have_header("picotls/openssl.h")
+abort "ngtcp2_crypto_picotls header missing" unless have_header("ngtcp2/ngtcp2_crypto_picotls.h")
+abort "picotls was built without X25519 (patch not applied?)" unless try_compile(<<~C)
+  #include <picotls/openssl.h>
+  #if !PTLS_OPENSSL_HAVE_X25519
+  #error X25519 unavailable
+  #endif
+C
 # ngtcp2_conn_client_new and most other ngtcp2 entry points are exposed as
 # ABI-versioned macros, so use non-macro symbols for link verification.
 abort "libngtcp2 not linkable" unless have_func("ngtcp2_version", "ngtcp2/ngtcp2.h")
-abort "libngtcp2_crypto_libressl not linkable" unless have_func("ngtcp2_crypto_quictls_init", "ngtcp2/ngtcp2_crypto_quictls.h")
-abort "libssl not linkable" unless have_func("OpenSSL_version", "openssl/opensslv.h")
+abort "libngtcp2_crypto_picotls not linkable" unless
+  have_func("ngtcp2_crypto_picotls_configure_client_context", %w[picotls.h ngtcp2/ngtcp2_crypto_picotls.h])
+abort "libcrypto not linkable" unless have_func("OpenSSL_version", "openssl/crypto.h")
 
+# picotls has neither a version macro nor releases, so QUIC.library_versions
+# reports the commit the extension was built against.
+append_cflags("-DQUIC_PICOTLS_COMMIT=\\\"#{PICOTLS_COMMIT}\\\"")
 append_cflags("-fvisibility=hidden")
+append_ldflags("-Wl,--exclude-libs,ALL")  # Unexport symbols from statically linked libraries
+
+# quic/ext.h, the C function table other extensions (the http3 gem) build
+# against. It ships in the gem; QUIC::EXT_INCLUDE_DIR points them here.
+append_cppflags("-I#{File.expand_path("include", __dir__)}")
 
 create_makefile("quic/quic")

data/ext/quic/include/quic/ext.h

@@ -0,0 +1,84 @@
+/* quic/ext.h — the C function table quic.so offers to other extensions.
+ *
+ * Another extension (the http3 gem) registers a stream handler on a
+ * connection and drives it through this table instead of QUIC::Stream.
+ * Obtain the table after rb_require("quic") with
+ *
+ *   quic_ext_get_api_fn get =
+ *     (quic_ext_get_api_fn)rb_ext_resolve_symbol("quic/quic", "quic_ext_get_api");
+ *   const quic_ext_api *api = get ? get(QUIC_EXT_ABI_MAJOR) : NULL;
+ *
+ * Rules:
+ *
+ * - Version: quic_ext_get_api(major) returns NULL when major differs from
+ *   the table's. The structs below grow only by appending, which bumps
+ *   abi_minor; reordering, removing or retyping a member bumps abi_major.
+ *   Check `size` before calling a member added after the version you were
+ *   built against. The handler struct follows the same rules.
+ * - Exceptions: no function in the table and no handler function raises a
+ *   Ruby exception; they return 0 or a negative error code. The one
+ *   exception is conn_get, which raises TypeError for a wrong object and is
+ *   meant for initialization called from a Ruby method. A handler function
+ *   returning a negative value makes the ngtcp2 callback fail with
+ *   NGTCP2_ERR_CALLBACK_FAILURE.
+ * - Lifetime: `owner` passed to set_stream_handler is marked by the
+ *   connection while it lives. `ud` must not move (allocate it with
+ *   xmalloc, not as a Ruby object), and `h` must outlive the connection
+ *   (a static const struct). quic.so never calls a handler from its dfree,
+ *   and the owner's dfree must not touch the quic_ext_conn.
+ * - Where: table functions may be called from inside handler functions.
+ *   Everything runs with the GVL held.
+ */
+#ifndef QUIC_EXT_H
+#define QUIC_EXT_H 1
+
+#include <stddef.h>
+#include <stdint.h>
+#include <ruby.h>
+
+#define QUIC_EXT_ABI_MAJOR 1
+
+#define QUIC_EXT_ERR_INVALID_STATE     (-1)
+#define QUIC_EXT_ERR_STREAM_ID_BLOCKED (-2)
+#define QUIC_EXT_ERR_STREAM_NOT_FOUND  (-3)
+#define QUIC_EXT_ERR_OTHER             (-99)
+
+typedef struct { const uint8_t *base; size_t len; } quic_ext_vec;  /* same layout as ngtcp2_vec */
+typedef struct quic_ext_conn quic_ext_conn;                        /* opaque */
+
+typedef struct {
+  size_t size;  /* sizeof(quic_ext_stream_handler); tells which members exist */
+  int (*recv_stream_data)(void *ud, int64_t id, const uint8_t *data, size_t len,
+                          int fin, uint64_t ts, size_t *consumed);
+  int (*next_stream_data)(void *ud, int64_t *id, int *fin,
+                          quic_ext_vec *vecs, size_t cap, size_t *nvecs);
+  int (*stream_data_written)(void *ud, int64_t id, size_t n);
+  int (*stream_blocked)(void *ud, int64_t id);
+  int (*stream_shut_write)(void *ud, int64_t id);
+  int (*acked_stream_data)(void *ud, int64_t id, uint64_t n);
+  int (*extend_max_stream_data)(void *ud, int64_t id);
+  int (*extend_max_remote_streams_bidi)(void *ud, uint64_t max);
+  int (*stream_stop_sending)(void *ud, int64_t id, uint64_t app_error_code);
+  int (*stream_reset)(void *ud, int64_t id, uint64_t final_size, uint64_t app_error_code);
+  int (*stream_close)(void *ud, int64_t id, int has_code, uint64_t app_error_code);
+  int (*handshake_completed)(void *ud);
+} quic_ext_stream_handler;
+
+typedef struct {
+  uint32_t abi_major;  /* bumped only to break compatibility */
+  uint32_t abi_minor;  /* bumped whenever a member is appended */
+  size_t size;         /* sizeof(quic_ext_api) */
+  quic_ext_conn *(*conn_get)(VALUE conn);  /* TypeError for a wrong object */
+  int (*set_stream_handler)(quic_ext_conn *c, const quic_ext_stream_handler *h,
+                            void *ud, VALUE owner);
+  int (*open_uni_stream)(quic_ext_conn *c, int64_t *id);
+  int (*consume)(quic_ext_conn *c, int64_t id, uint64_t n);
+  int (*shutdown_stream_read)(quic_ext_conn *c, int64_t id, uint64_t app_error_code);
+  int (*shutdown_stream_write)(quic_ext_conn *c, int64_t id, uint64_t app_error_code);
+  uint64_t (*local_max_streams_bidi)(quic_ext_conn *c);
+  int (*set_application_error)(quic_ext_conn *c, uint64_t app_error_code);
+} quic_ext_api;
+
+typedef const quic_ext_api *(*quic_ext_get_api_fn)(uint32_t abi_major);
+
+#endif /* QUIC_EXT_H */

data/ext/quic/patches/picotls/0001-openssl-use-raw-public-key-api-for-X25519.patch

@@ -0,0 +1,74 @@
+Subject: [PATCH] openssl: use the raw public key API for X25519
+
+LibreSSL does not provide EVP_PKEY_get1_tls_encodedpoint() /
+EVP_PKEY_set1_tls_encodedpoint(), so picotls disables ptls_openssl_x25519
+when built against LibreSSL. Switch the EVP-based X25519 key exchange to
+EVP_PKEY_get_raw_public_key() / EVP_PKEY_new_raw_public_key() and drop the
+LibreSSL exclusion.
+
+Verified with LibreSSL 4.3.1 and OpenSSL 3.5.7 (picotls test-openssl.t,
+including x25519-to-minicrypto / x25519-from-minicrypto).
+
+Not upstream. Requires OpenSSL >= 1.1.1 (1.1.0 lacks the raw key API).
+Applies to h2o/picotls@b84869f41414b6d0148db7728f1cf12f5b544874.
+
+diff --git a/include/picotls/openssl.h b/include/picotls/openssl.h
+index 37a0740..04e4653 100644
+--- a/include/picotls/openssl.h
++++ b/include/picotls/openssl.h
+@@ -60,7 +60,7 @@ extern ptls_key_exchange_algorithm_t ptls_openssl_secp521r1;
+ #ifdef EVP_PKEY_ED25519
+ #define PTLS_OPENSSL_HAVE_ED25519 1
+ #endif
+-#if defined(NID_X25519) && !defined(LIBRESSL_VERSION_NUMBER)
++#if defined(NID_X25519)
+ #define PTLS_OPENSSL_HAVE_X25519 1
+ #define PTLS_OPENSSL_HAS_X25519 1 /* deprecated; use HAVE_ */
+ extern ptls_key_exchange_algorithm_t ptls_openssl_x25519;
+diff --git a/lib/openssl.c b/lib/openssl.c
+index d6d073b..1c7e492 100644
+--- a/lib/openssl.c
++++ b/lib/openssl.c
+@@ -559,15 +559,7 @@ static int evp_keyex_on_exchange(ptls_key_exchange_context_t **_ctx, int release
+ #undef X25519_KEY_SIZE
+ #endif
+ 
+-    if ((evppeer = EVP_PKEY_new()) == NULL) {
+-        ret = PTLS_ERROR_NO_MEMORY;
+-        goto Exit;
+-    }
+-    if (EVP_PKEY_copy_parameters(evppeer, ctx->privkey) <= 0) {
+-        ret = PTLS_ERROR_LIBRARY;
+-        goto Exit;
+-    }
+-    if (EVP_PKEY_set1_tls_encodedpoint(evppeer, peerkey.base, peerkey.len) <= 0) {
++    if ((evppeer = EVP_PKEY_new_raw_public_key(EVP_PKEY_id(ctx->privkey), NULL, peerkey.base, peerkey.len)) == NULL) {
+         ret = PTLS_ERROR_LIBRARY;
+         goto Exit;
+     }
+@@ -629,10 +621,21 @@ static int evp_keyex_init(ptls_key_exchange_algorithm_t *algo, ptls_key_exchange
+     *ctx = (struct st_evp_keyex_context_t){{algo, {NULL}, evp_keyex_on_exchange}, pkey};
+ 
+     /* set public key */
+-    if ((ctx->super.pubkey.len = EVP_PKEY_get1_tls_encodedpoint(ctx->privkey, &ctx->super.pubkey.base)) == 0) {
+-        ctx->super.pubkey.base = NULL;
+-        ret = PTLS_ERROR_NO_MEMORY;
+-        goto Exit;
++    {
++        size_t publen = 0;
++        if (EVP_PKEY_get_raw_public_key(ctx->privkey, NULL, &publen) != 1 || publen == 0) {
++            ret = PTLS_ERROR_LIBRARY;
++            goto Exit;
++        }
++        if ((ctx->super.pubkey.base = OPENSSL_malloc(publen)) == NULL) {
++            ret = PTLS_ERROR_NO_MEMORY;
++            goto Exit;
++        }
++        if (EVP_PKEY_get_raw_public_key(ctx->privkey, ctx->super.pubkey.base, &publen) != 1) {
++            ret = PTLS_ERROR_LIBRARY;
++            goto Exit;
++        }
++        ctx->super.pubkey.len = publen;
+     }
+ 
+     *_ctx = &ctx->super;