quic 0.0.2 → 0.0.4

data/ext/quic/stream.c

@@ -1,47 +1,44 @@
 #include "stream.h"
+#include "connection_common.h"
 
 #include <string.h>
 
 VALUE rb_cQUICStream;
 
-static void
-quic_stream_free(void *ptr)
-{
-  xfree(ptr);
-}
+static void quic_stream_free(void *ptr) { xfree(ptr); }
 
-static size_t
-quic_stream_size(const void *ptr)
-{
+static size_t quic_stream_size(const void *ptr) {
   (void)ptr;
   return sizeof(quic_stream_t);
 }
 
 const rb_data_type_t quic_stream_data_type = {
-  "QUIC::Stream",
-  {NULL, quic_stream_free, quic_stream_size,},
-  NULL, NULL,
-  RUBY_TYPED_FREE_IMMEDIATELY,
+    "QUIC::Stream",
+    {
+        NULL,
+        quic_stream_free,
+        quic_stream_size,
+    },
+    NULL,
+    NULL,
+    RUBY_TYPED_FREE_IMMEDIATELY,
 };
 
-static VALUE
-quic_stream_alloc(VALUE klass)
-{
+static VALUE quic_stream_alloc(VALUE klass) {
   quic_stream_t *s = ALLOC(quic_stream_t);
   memset(s, 0, sizeof(*s));
   return TypedData_Wrap_Struct(klass, &quic_stream_data_type, s);
 }
 
 VALUE
-quic_stream_new(int64_t stream_id, VALUE client)
-{
+quic_stream_new(int64_t stream_id, VALUE owner) {
   VALUE self = quic_stream_alloc(rb_cQUICStream);
   quic_stream_t *s;
   TypedData_Get_Struct(self, quic_stream_t, &quic_stream_data_type, s);
   s->stream_id = stream_id;
 
   rb_ivar_set(self, rb_intern("@id"), LL2NUM(stream_id));
-  rb_ivar_set(self, rb_intern("@client"), client);
+  rb_ivar_set(self, rb_intern("@client"), owner);
   rb_ivar_set(self, rb_intern("@pending_chunks"), rb_ary_new());
   /* recv_buffer is a binary String; rb_str_buf_new returns ASCII-8BIT. */
   rb_ivar_set(self, rb_intern("@recv_buffer"), rb_str_buf_new(0));
@@ -54,9 +51,7 @@ quic_stream_new(int64_t stream_id, VALUE client)
    quic_stream_write_nonblock_m). This helper is reached only after the
    caller has confirmed the bytes fit in the current send window, so it
    never raises QUIC::Error::WaitWritable on its own. */
-static VALUE
-quic_stream_enqueue(VALUE self, VALUE data, bool fin)
-{
+static VALUE quic_stream_enqueue(VALUE self, VALUE data, bool fin) {
   quic_stream_t *s;
   TypedData_Get_Struct(self, quic_stream_t, &quic_stream_data_type, s);
 
@@ -86,41 +81,51 @@ quic_stream_enqueue(VALUE self, VALUE data, bool fin)
   return LONG2NUM(len);
 }
 
-static bool
-quic_stream_fin_kwarg(int argc, VALUE *argv, VALUE *data)
-{
+static bool quic_stream_fin_kwarg(int argc, VALUE *argv, VALUE *data) {
   VALUE opts = Qnil;
   rb_scan_args(argc, argv, "1:", data, &opts);
-  if (NIL_P(opts)) return false;
+  if (NIL_P(opts))
+    return false;
   VALUE fin = rb_hash_lookup(opts, ID2SYM(rb_intern("fin")));
   return RTEST(fin);
 }
 
-/* Return the effective send window for this stream, capped by both the
-   per-stream and the per-connection flow control limits ngtcp2 tracks. */
-static uint64_t
-quic_stream_window_left(VALUE client_v, quic_stream_t *s)
-{
-  ngtcp2_conn *conn = quic_client_conn(client_v);
-  uint64_t stream_left = ngtcp2_conn_get_max_stream_data_left(conn, s->stream_id);
-  uint64_t conn_left = ngtcp2_conn_get_max_data_left(conn);
-  return stream_left < conn_left ? stream_left : conn_left;
+/* Return the effective send window for this stream: the smaller of the
+   per-stream and the per-connection flow control limits ngtcp2 tracks, less
+   the bytes already queued in @pending_chunks but not yet handed to ngtcp2.
+   ngtcp2 only counts what it has sent, so without the subtraction a run of
+   writes could queue far more than the peer allows. */
+static uint64_t quic_stream_window_left(VALUE self, VALUE client_v,
+                                        quic_stream_t *s) {
+  ngtcp2_conn *conn = quic_conn_ptr(client_v);
+  uint64_t stream_left =
+      ngtcp2_conn_get_max_stream_data_left2(conn, s->stream_id);
+  uint64_t conn_left = ngtcp2_conn_get_max_data_left2(conn);
+  uint64_t left = stream_left < conn_left ? stream_left : conn_left;
+
+  /* @pending_chunks starts at stream offset pending_shifted, and the bytes
+     up to sent_offset have been sent. */
+  VALUE pending = rb_ivar_get(self, rb_intern("@pending_chunks"));
+  uint64_t queued_end = s->pending_shifted;
+  for (long i = 0; i < RARRAY_LEN(pending); i++) {
+    queued_end += (uint64_t)RSTRING_LEN(RARRAY_AREF(pending, i));
+  }
+  uint64_t unsent = queued_end - s->sent_offset;
+  return left > unsent ? left - unsent : 0;
 }
 
-/* Blocking write: block by repeatedly invoking Client#pump_once until the
-   peer's flow control window has enough room for the full payload, then
-   enqueue. IO#write-compatible: always queues all of `data`. Bare Streams
-   (built via QUIC::Stream.allocate for unit tests, with @client = nil) skip
-   the window check entirely. */
-static VALUE
-quic_stream_write_m(int argc, VALUE *argv, VALUE self)
-{
+/* Blocking write: block by repeatedly invoking #pump_once on the owning
+   connection (@client) until the peer's flow control window has enough room
+   for the full payload, then enqueue. IO#write-compatible: always queues all
+   of `data`. Bare Streams (built via QUIC::Stream.allocate for unit tests,
+   with @client = nil) skip the window check entirely. */
+static VALUE quic_stream_write_m(int argc, VALUE *argv, VALUE self) {
   VALUE data;
   bool fin = quic_stream_fin_kwarg(argc, argv, &data);
 
   VALUE client_v = rb_ivar_get(self, rb_intern("@client"));
   if (NIL_P(client_v)) {
-    return quic_stream_enqueue(self, data, fin);  /* bare-Stream test escape */
+    return quic_stream_enqueue(self, data, fin); /* bare-Stream test escape */
   }
 
   /* These will be re-validated by quic_stream_enqueue, but we need the
@@ -132,9 +137,9 @@ quic_stream_write_m(int argc, VALUE *argv, VALUE self)
     quic_stream_t *s;
     TypedData_Get_Struct(self, quic_stream_t, &quic_stream_data_type, s);
     /* Loop until the full payload would fit in the current window. pump_once
-       raises QUIC::Error::NotBound if @client has no socket bound; that
-       error surfaces verbatim. */
-    while ((uint64_t)needed > quic_stream_window_left(client_v, s)) {
+       raises QUIC::Error::NotBound if the connection has not been #bind'ed;
+       that error surfaces verbatim. */
+    while ((uint64_t)needed > quic_stream_window_left(self, client_v, s)) {
       rb_funcall(client_v, rb_intern("pump_once"), 0);
     }
   }
@@ -148,15 +153,13 @@ quic_stream_write_m(int argc, VALUE *argv, VALUE self)
    prefix fits, FIN is NOT set on this call (caller re-issues with
    `fin: true` once the remainder is accepted) so we don't half-commit FIN.
    Bare Streams with @client = nil skip the window check entirely. */
-static VALUE
-quic_stream_write_nonblock_m(int argc, VALUE *argv, VALUE self)
-{
+static VALUE quic_stream_write_nonblock_m(int argc, VALUE *argv, VALUE self) {
   VALUE data;
   bool fin = quic_stream_fin_kwarg(argc, argv, &data);
 
   VALUE client_v = rb_ivar_get(self, rb_intern("@client"));
   if (NIL_P(client_v)) {
-    return quic_stream_enqueue(self, data, fin);  /* bare-Stream test escape */
+    return quic_stream_enqueue(self, data, fin); /* bare-Stream test escape */
   }
 
   Check_Type(data, T_STRING);
@@ -169,7 +172,7 @@ quic_stream_write_nonblock_m(int argc, VALUE *argv, VALUE self)
 
   quic_stream_t *s;
   TypedData_Get_Struct(self, quic_stream_t, &quic_stream_data_type, s);
-  uint64_t avail = quic_stream_window_left(client_v, s);
+  uint64_t avail = quic_stream_window_left(self, client_v, s);
 
   if (avail == 0) {
     rb_raise(rb_eQUICErrorWaitWritable, "stream send window is full");
@@ -181,12 +184,11 @@ quic_stream_write_nonblock_m(int argc, VALUE *argv, VALUE self)
   return quic_stream_enqueue(self, slice, effective_fin);
 }
 
-static VALUE
-quic_stream_close_write_m(VALUE self)
-{
+static VALUE quic_stream_close_write_m(VALUE self) {
   quic_stream_t *s;
   TypedData_Get_Struct(self, quic_stream_t, &quic_stream_data_type, s);
-  if (s->fin_sent) return Qnil;  /* idempotent */
+  if (s->fin_sent)
+    return Qnil; /* idempotent */
   VALUE empty = rb_str_new("", 0);
   rb_enc_associate_index(empty, rb_ascii8bit_encindex());
   quic_stream_enqueue(self, empty, true);
@@ -201,9 +203,7 @@ quic_stream_close_write_m(VALUE self)
    - buffer empty + !fin_received: raise QUIC::Error::WaitReadable
    - buffer non-empty: return min(length, buffer.bytesize) bytes
 */
-static VALUE
-quic_stream_read_nonblock_m(VALUE self, VALUE length_v)
-{
+static VALUE quic_stream_read_nonblock_m(VALUE self, VALUE length_v) {
   quic_stream_t *s;
   TypedData_Get_Struct(self, quic_stream_t, &quic_stream_data_type, s);
 
@@ -227,41 +227,63 @@ quic_stream_read_nonblock_m(VALUE self, VALUE length_v)
 
   /* Drop the first |take| bytes from buffer by memmove + truncate. */
   if (take < have) {
-    memmove(RSTRING_PTR(buffer), RSTRING_PTR(buffer) + take, (size_t)(have - take));
+    memmove(RSTRING_PTR(buffer), RSTRING_PTR(buffer) + take,
+            (size_t)(have - take));
   }
   rb_str_set_len(buffer, have - take);
 
+  /* The application has consumed |take| bytes, so give the peer that much
+     more stream and connection credit. Without this the peer stops sending
+     once initial_max_data / initial_max_stream_data are used up. A stream
+     ngtcp2 has already forgotten is ignored (the call returns 0), but the
+     connection window still grows. Bare Streams have no connection. */
+  VALUE client_v = rb_ivar_get(self, rb_intern("@client"));
+  if (!NIL_P(client_v)) {
+    ngtcp2_conn *conn = quic_conn_ptr(client_v);
+    int rv = ngtcp2_conn_extend_max_stream_offset(conn, s->stream_id,
+                                                  (uint64_t)take);
+    if (rv != 0)
+      quic_raise_ngtcp2_error(rv);
+    ngtcp2_conn_extend_max_offset(conn, (uint64_t)take);
+  }
+
   return out;
 }
 
-static VALUE
-quic_stream_eof_p(VALUE self)
-{
+static VALUE quic_stream_eof_p(VALUE self) {
   quic_stream_t *s;
   TypedData_Get_Struct(self, quic_stream_t, &quic_stream_data_type, s);
   VALUE buffer = rb_ivar_get(self, rb_intern("@recv_buffer"));
   return (RSTRING_LEN(buffer) == 0 && s->fin_received) ? Qtrue : Qfalse;
 }
 
-static VALUE
-quic_stream_close_read_m(VALUE self)
-{
+/* True once the stream is fully closed: both directions have finished (FIN
+   or reset) and everything sent has been acknowledged. Stays false if the
+   connection closes first, since ngtcp2 does not report stream closure then.
+   Keeps returning true after the stream has left the connection's @streams.
+   A bare Stream is never closed. */
+static VALUE quic_stream_closed_p(VALUE self) {
+  quic_stream_t *s;
+  TypedData_Get_Struct(self, quic_stream_t, &quic_stream_data_type, s);
+  return s->closed ? Qtrue : Qfalse;
+}
+
+static VALUE quic_stream_close_read_m(VALUE self) {
   quic_stream_t *s;
   TypedData_Get_Struct(self, quic_stream_t, &quic_stream_data_type, s);
 
   VALUE client_v = rb_ivar_get(self, rb_intern("@client"));
-  ngtcp2_conn *conn = quic_client_conn(client_v);
+  ngtcp2_conn *conn = quic_conn_ptr(client_v);
 
   /* ngtcp2_conn_shutdown_stream_read sends STOP_SENDING. app_error_code 0
      since no QUIC-level error API is exposed yet. */
   int rv = ngtcp2_conn_shutdown_stream_read(conn, 0, s->stream_id, 0);
-  if (rv != 0) quic_raise_ngtcp2_error(rv);
+  if (rv != 0)
+    quic_raise_ngtcp2_error(rv);
   return Qnil;
 }
 
-static VALUE
-quic_stream_close_m(VALUE self)
-{
+static VALUE quic_stream_close_m(VALUE self) {
   /* Send FIN (if not yet) then STOP_SENDING. Idempotent on each leg. */
   quic_stream_close_write_m(self);
   quic_stream_close_read_m(self);
@@ -278,9 +300,7 @@ quic_stream_close_m(VALUE self)
    A bare Stream (@client == nil, used by unit-test fixtures) skips the
    ngtcp2 call and only flips s->reset, mirroring the #write / #close_write
    bare-Stream escapes. */
-static VALUE
-quic_stream_reset_m(int argc, VALUE *argv, VALUE self)
-{
+static VALUE quic_stream_reset_m(int argc, VALUE *argv, VALUE self) {
   VALUE error_code_v = Qnil;
   rb_scan_args(argc, argv, "01", &error_code_v);
   uint64_t error_code = NIL_P(error_code_v) ? 0 : NUM2ULL(error_code_v);
@@ -288,33 +308,55 @@ quic_stream_reset_m(int argc, VALUE *argv, VALUE self)
   quic_stream_t *s;
   TypedData_Get_Struct(self, quic_stream_t, &quic_stream_data_type, s);
 
-  if (s->reset) return Qnil;  /* idempotent */
+  if (s->reset)
+    return Qnil; /* idempotent */
 
   VALUE client_v = rb_ivar_get(self, rb_intern("@client"));
   if (NIL_P(client_v)) {
-    s->reset = true;  /* bare Stream escape */
+    s->reset = true; /* bare Stream escape */
     return Qnil;
   }
 
-  ngtcp2_conn *conn = quic_client_conn(client_v);
+  ngtcp2_conn *conn = quic_conn_ptr(client_v);
   int rv = ngtcp2_conn_shutdown_stream_write(conn, 0, s->stream_id, error_code);
-  if (rv != 0) quic_raise_ngtcp2_error(rv);
+  if (rv != 0)
+    quic_raise_ngtcp2_error(rv);
   s->reset = true;
   return Qnil;
 }
 
-void
-Init_quic_stream(VALUE rb_mQUICArg)
-{
+/* Called by #accept_stream / #accept_stream_nonblock for the stream they
+   take off @accept_queue. A stream that closed while it waited there gives
+   the peer back the stream it used up now (see quic_stream_close_body). */
+static VALUE quic_stream_accepted_m(VALUE self) {
+  quic_stream_t *s;
+  TypedData_Get_Struct(self, quic_stream_t, &quic_stream_data_type, s);
+  s->accepted = true;
+  if (s->peer_stream_held) {
+    s->peer_stream_held = false;
+    VALUE client_v = rb_ivar_get(self, rb_intern("@client"));
+    if (!NIL_P(client_v)) {
+      quic_conn_give_back_peer_stream(quic_conn_ptr(client_v), s->stream_id);
+    }
+  }
+  return Qnil;
+}
+
+void Init_quic_stream(VALUE rb_mQUICArg) {
   rb_cQUICStream = rb_define_class_under(rb_mQUICArg, "Stream", rb_cObject);
   rb_define_alloc_func(rb_cQUICStream, quic_stream_alloc);
   rb_define_method(rb_cQUICStream, "write", quic_stream_write_m, -1);
-  rb_define_method(rb_cQUICStream, "write_nonblock", quic_stream_write_nonblock_m, -1);
+  rb_define_method(rb_cQUICStream, "write_nonblock",
+                   quic_stream_write_nonblock_m, -1);
   rb_define_method(rb_cQUICStream, "close_write", quic_stream_close_write_m, 0);
-  rb_define_method(rb_cQUICStream, "read_nonblock", quic_stream_read_nonblock_m, 1);
+  rb_define_method(rb_cQUICStream, "read_nonblock", quic_stream_read_nonblock_m,
+                   1);
   rb_define_method(rb_cQUICStream, "eof?", quic_stream_eof_p, 0);
+  rb_define_method(rb_cQUICStream, "closed?", quic_stream_closed_p, 0);
   rb_define_method(rb_cQUICStream, "close_read", quic_stream_close_read_m, 0);
   rb_define_method(rb_cQUICStream, "close", quic_stream_close_m, 0);
   rb_define_method(rb_cQUICStream, "reset", quic_stream_reset_m, -1);
+  rb_define_private_method(rb_cQUICStream, "_accepted", quic_stream_accepted_m,
+                           0);
   /* #read (blocking) and #initiator are defined in lib/quic/stream.rb. */
 }

data/ext/quic/stream.h

@@ -7,7 +7,7 @@ extern VALUE rb_cQUICStream;
 
 void Init_quic_stream(VALUE rb_mQUICArg);
 
-/* Internal helpers used by connection_client.c stream callbacks and
+/* Internal helpers used by connection_common.c stream callbacks and
    write_pkt's stream-aware path. */
 
 typedef struct {
@@ -22,24 +22,30 @@ typedef struct {
   /* Cumulative bytes shifted out of @pending_chunks. Always
      <= acked_offset (we only shift a Chunk after its end is acked). */
   uint64_t pending_shifted;
-  bool fin_received;          /* recv_stream_data delivered FIN */
-  bool fin_sent;              /* #write(fin: true) queued FIN */
-  bool fin_flushed;           /* write_pkt actually wrote the FIN frame */
-  bool reset;                 /* stream_reset callback fired */
-  bool closed;                /* stream_close callback fired */
+  bool fin_received; /* recv_stream_data delivered FIN */
+  bool fin_sent;     /* #write(fin: true) queued FIN */
+  bool fin_flushed;  /* write_pkt actually wrote the FIN frame */
+  bool reset;        /* stream_reset callback fired */
+  bool closed;       /* stream_close callback fired */
   uint64_t close_app_error_code;
   bool close_has_app_error_code;
-  /* Set once a peer-initiated (server) stream has been pushed onto the
-     owner Client's @accept_queue, so recv_stream_data does not enqueue it
+  /* Set once a peer-initiated stream has been pushed onto the owning
+     connection's @accept_queue, so recv_stream_data does not enqueue it
      again on subsequent data arrivals. */
   bool accept_queued;
+  /* Set once #accept_stream has handed the stream to the application. */
+  bool accepted;
+  /* The stream closed while it waited in @accept_queue: the peer gets the
+     stream it used up back when the stream is accepted. */
+  bool peer_stream_held;
 } quic_stream_t;
 
 extern const rb_data_type_t quic_stream_data_type;
 
-/* Allocate a new QUIC::Stream Ruby object with a zero-initialized
-   quic_stream_t. Caller fills stream_id and ivars (@id / @client /
-   @pending_chunks / @recv_buffer). */
-VALUE quic_stream_new(int64_t stream_id, VALUE client);
+/* Allocate a new QUIC::Stream Ruby object for stream_id with a
+   zero-initialized quic_stream_t, and set its ivars (@id / @client /
+   @pending_chunks / @recv_buffer). @client is owner, the Client or Server
+   the stream belongs to; the ivar keeps its name for both. */
+VALUE quic_stream_new(int64_t stream_id, VALUE owner);
 
 #endif /* QUIC_STREAM_H */

data/ext/quic/tls_context.c

@@ -0,0 +1,269 @@
+#include "tls_context.h"
+#include "connection_common.h"
+
+#include <stddef.h>
+#include <string.h>
+
+#include <openssl/bio.h>
+#include <openssl/err.h>
+#include <openssl/pem.h>
+#include <openssl/x509.h>
+
+VALUE rb_cQUICTLSContext;
+
+void quic_tls_ctx_ref(quic_tls_ctx_t *t) { t->refcnt++; }
+
+void quic_tls_ctx_unref(quic_tls_ctx_t *t) {
+  if (--t->refcnt > 0)
+    return;
+  if (t->sign_cert_initialized)
+    ptls_openssl_dispose_sign_certificate(&t->sign_cert);
+  /* picotls malloc()ed the list and each entry, so free(), not xfree(). */
+  if (t->ctx.certificates.list != NULL) {
+    for (size_t i = 0; i < t->ctx.certificates.count; i++)
+      free(t->ctx.certificates.list[i].base);
+    free(t->ctx.certificates.list);
+  }
+  xfree(t->alpn);
+  xfree(t->alpn_buf);
+  xfree(t);
+}
+
+/* The QUIC::TLSContext object holds one reference. A context it never
+   finished building (an exception mid-way) is released the same way. */
+static void quic_tls_context_free(void *ptr) {
+  if (ptr != NULL)
+    quic_tls_ctx_unref((quic_tls_ctx_t *)ptr);
+}
+
+static size_t quic_tls_context_size(const void *ptr) {
+  (void)ptr;
+  return sizeof(quic_tls_ctx_t);
+}
+
+static const rb_data_type_t quic_tls_context_type = {
+    "QUIC::TLSContext",
+    {
+        NULL,
+        quic_tls_context_free,
+        quic_tls_context_size,
+    },
+    NULL,
+    NULL,
+    RUBY_TYPED_FREE_IMMEDIATELY,
+};
+
+quic_tls_ctx_t *quic_tls_context_get(VALUE tls_context) {
+  return (quic_tls_ctx_t *)rb_check_typeddata(tls_context,
+                                              &quic_tls_context_type);
+}
+
+/* Pick the first of the server's ALPN protocols, in the server's order of
+   preference, that the client offered. Runs inside read_pkt with the GVL
+   held and never touches Ruby objects. */
+static int
+quic_tls_on_client_hello_cb(ptls_on_client_hello_t *self, ptls_t *tls,
+                            ptls_on_client_hello_parameters_t *params) {
+  quic_tls_ctx_t *t =
+      (quic_tls_ctx_t *)((char *)self -
+                         offsetof(quic_tls_ctx_t, on_client_hello));
+  for (size_t i = 0; i < t->alpn_count; i++) {
+    for (size_t j = 0; j < params->negotiated_protocols.count; j++) {
+      ptls_iovec_t offered = params->negotiated_protocols.list[j];
+      if (offered.len == t->alpn[i].len &&
+          memcmp(offered.base, t->alpn[i].base, offered.len) == 0) {
+        return ptls_set_negotiated_protocol(tls, (const char *)offered.base,
+                                            offered.len) == 0
+                   ? 0
+                   : PTLS_ERROR_NO_MEMORY;
+      }
+    }
+  }
+  return PTLS_ALERT_NO_APPLICATION_PROTOCOL;
+}
+
+/* Never supply a passphrase. Without a callback, PEM_read_bio_PrivateKey
+   falls back to PEM_def_callback, which prompts on the controlling terminal;
+   this way an encrypted key fails to load like any other unreadable one. */
+static int quic_tls_no_passphrase_cb(char *buf, int size, int rwflag,
+                                     void *userdata) {
+  (void)buf;
+  (void)size;
+  (void)rwflag;
+  (void)userdata;
+  return -1;
+}
+
+/* Load the certificate chain and private key into t->ctx and install the
+   signer. The certificate file is PEM, the leaf first and then any
+   intermediates; there is no limit on their number. A misconfiguration
+   raises ArgumentError naming the step that failed. Everything allocated
+   here is released before raising, and libcrypto's error queue, which is
+   shared with Ruby's openssl extension, is left empty on every return. */
+static void quic_tls_ctx_load_certificate_and_key(quic_tls_ctx_t *t,
+                                                  VALUE certificate_path,
+                                                  VALUE private_key_path) {
+  VALUE failure_class = rb_eArgError;
+  const char *failure = NULL;
+  VALUE failed_path = Qnil;
+  BIO *cert_bio = NULL;
+  BIO *key_bio = NULL;
+  X509 *leaf = NULL;
+  X509 *x;
+  STACK_OF(X509) *chain = NULL;
+  EVP_PKEY *pkey = NULL;
+  unsigned long err;
+
+  ERR_clear_error();
+
+  cert_bio = BIO_new_file(RSTRING_PTR(certificate_path), "r");
+  if (cert_bio == NULL ||
+      (leaf = PEM_read_bio_X509(cert_bio, NULL, NULL, NULL)) == NULL) {
+    failure = "failed to load certificate";
+    failed_path = certificate_path;
+    goto done;
+  }
+
+  if ((chain = sk_X509_new_null()) == NULL) {
+    failure_class = rb_eRuntimeError;
+    failure = "sk_X509_new_null failed";
+    goto done;
+  }
+  while ((x = PEM_read_bio_X509(cert_bio, NULL, NULL, NULL)) != NULL) {
+    if (!sk_X509_push(chain, x)) {
+      X509_free(x);
+      failure_class = rb_eRuntimeError;
+      failure = "sk_X509_push failed";
+      goto done;
+    }
+  }
+  /* The loop ends with PEM_R_NO_START_LINE once no PEM block is left. Any
+     other error means a broken block, as in SSL_CTX_use_certificate_chain_file.
+   */
+  err = ERR_peek_last_error();
+  if (ERR_GET_LIB(err) != ERR_LIB_PEM ||
+      ERR_GET_REASON(err) != PEM_R_NO_START_LINE) {
+    failure = "failed to load certificate";
+    failed_path = certificate_path;
+    goto done;
+  }
+
+  key_bio = BIO_new_file(RSTRING_PTR(private_key_path), "r");
+  if (key_bio == NULL ||
+      (pkey = PEM_read_bio_PrivateKey(key_bio, NULL, quic_tls_no_passphrase_cb,
+                                      NULL)) == NULL) {
+    failure = "failed to load private key";
+    failed_path = private_key_path;
+    goto done;
+  }
+
+  /* picotls has no counterpart of SSL_CTX_check_private_key. */
+  if (X509_check_private_key(leaf, pkey) != 1) {
+    failure = "private key does not match certificate";
+    failed_path = private_key_path;
+    goto done;
+  }
+
+  /* Takes its own reference on pkey. */
+  if (ptls_openssl_init_sign_certificate(&t->sign_cert, pkey) != 0) {
+    failure = "unsupported private key type";
+    failed_path = private_key_path;
+    goto done;
+  }
+  t->sign_cert_initialized = true;
+  t->ctx.sign_certificate = &t->sign_cert.super;
+
+  /* Copies the DER of each certificate into a list quic_tls_ctx_unref
+     releases. It fails only on allocation, and frees what it allocated then. */
+  if (ptls_openssl_load_certificates(&t->ctx, leaf, chain) != 0) {
+    failure_class = rb_eRuntimeError;
+    failure = "ptls_openssl_load_certificates failed";
+    goto done;
+  }
+
+done:
+  sk_X509_pop_free(chain, X509_free);
+  X509_free(leaf);
+  EVP_PKEY_free(pkey);
+  BIO_free(cert_bio);
+  BIO_free(key_bio);
+  ERR_clear_error();
+
+  if (failure == NULL)
+    return;
+  if (NIL_P(failed_path))
+    rb_raise(failure_class, "%s", failure);
+  rb_raise(failure_class, "%s: %" PRIsVALUE, failure, failed_path);
+}
+
+VALUE
+quic_tls_context_server_new(VALUE certificate_path, VALUE private_key_path,
+                            VALUE alpn_ary) {
+  certificate_path = quic_path_value(certificate_path, "certificate_path");
+  private_key_path = quic_path_value(private_key_path, "private_key_path");
+  if (NIL_P(certificate_path))
+    rb_raise(rb_eArgError, "certificate_path must not be nil");
+  if (NIL_P(private_key_path))
+    rb_raise(rb_eArgError, "private_key_path must not be nil");
+
+  /* The object owns the context from the start, so that an exception below
+     releases whatever was built so far. */
+  VALUE self =
+      TypedData_Wrap_Struct(rb_cQUICTLSContext, &quic_tls_context_type, NULL);
+  quic_tls_ctx_t *t = ZALLOC(quic_tls_ctx_t);
+  t->refcnt = 1;
+  DATA_PTR(self) = t;
+
+  /* Without an ALPN to pick, every handshake would end in
+     no_application_protocol. */
+  quic_copy_alpn(alpn_ary, &t->alpn, &t->alpn_count, &t->alpn_buf);
+  if (t->alpn_count == 0)
+    rb_raise(rb_eArgError, "alpn must not be empty for a server");
+
+  t->ctx = (ptls_context_t){
+      .random_bytes = ptls_openssl_random_bytes,
+      .get_time = &ptls_get_time,
+      .key_exchanges = quic_key_exchanges,
+      .cipher_suites = quic_cipher_suites,
+      /* No session resumption: encrypt_ticket stays NULL, so no ticket is
+         ever issued. Keep this so that PSK-only resumption is refused once
+         resumption is added. */
+      .require_dhe_on_psk = 1,
+      .server_cipher_preference = 1,
+  };
+  if (ngtcp2_crypto_picotls_configure_server_context(&t->ctx) != 0) {
+    rb_raise(rb_eRuntimeError,
+             "ngtcp2_crypto_picotls_configure_server_context failed");
+  }
+  /* verify_certificate stays NULL: no client certificate is requested. */
+  quic_tls_ctx_load_certificate_and_key(t, certificate_path, private_key_path);
+  t->on_client_hello.cb = quic_tls_on_client_hello_cb;
+  t->ctx.on_client_hello = &t->on_client_hello;
+  return self;
+}
+
+/* QUIC::TLSContext.server(certificate_path:, private_key_path:, alpn:). A
+   missing or unknown keyword raises ArgumentError as a Ruby method would. */
+static VALUE quic_tls_context_s_server(int argc, VALUE *argv, VALUE klass) {
+  (void)klass;
+  VALUE opts = Qnil;
+  rb_scan_args(argc, argv, "0:", &opts);
+  if (NIL_P(opts))
+    opts = rb_hash_new();
+
+  ID keywords[3];
+  VALUE values[3];
+  keywords[0] = rb_intern("certificate_path");
+  keywords[1] = rb_intern("private_key_path");
+  keywords[2] = rb_intern("alpn");
+  rb_get_kwargs(opts, keywords, 3, 0, values);
+  return quic_tls_context_server_new(values[0], values[1], values[2]);
+}
+
+void Init_quic_tls_context(VALUE rb_mQUICArg) {
+  rb_cQUICTLSContext =
+      rb_define_class_under(rb_mQUICArg, "TLSContext", rb_cObject);
+  rb_undef_alloc_func(rb_cQUICTLSContext);
+  rb_define_singleton_method(rb_cQUICTLSContext, "server",
+                             quic_tls_context_s_server, -1);
+}