@amritk/nish-x86_64-linux 0.18.0 → 0.20.0

package/std/net/quic.ts

@@ -66,13 +66,23 @@
  * holds back everything ack-eliciting but a probe; an ACK always goes.
  * PATH_RESPONSE and DATAGRAM are never sent again (RFC 9000 §13.3, RFC 9221
  * §5.2). Pacing, and GSO batching, are the carrier's:
- * `nish/net/quic-listener`.
+ * `nish/net/quic-listener`. Once the 1-RTT keys are in, one Application
+ * Data packet number in every 128 to 1024 is skipped, at a distance drawn
+ * from the ID seed, and the last `QUIC_CONN_SKIP_RING` are remembered: an
+ * ACK of one acknowledges a packet never sent, an optimistic ACK meant to
+ * widen the congestion window, and is PROTOCOL_VIOLATION (RFC 9000 §21.4).
  *
  * **Nothing allocated per packet** (QUIC-3). A connection is a slot: every
- * buffer it uses — the packet record, the stream buffers, the CRYPTO
- * reassembly, the connection-ID table, the datagram rings — is made by the
- * constructor and reused, and `reset` makes the slot a new connection for
- * the next peer. A packet is opened (`receiveWindow`) and a datagram built
+ * buffer it uses — the packet record, the CRYPTO reassembly, the
+ * connection-ID table, the datagram rings — is made by the constructor and
+ * reused, and `reset` makes the slot a new connection for the next peer. The
+ * stream buffers are borrowed instead (`QuicStreamPools` in
+ * `nish/net/quic-stream`): a receive side takes one on its first byte and a
+ * send side on its first write, each goes back zeroed once the stream is done
+ * with it, and a server's connections share one set of pools, so idle slots
+ * hold none. A standalone connection makes private pools as large as all its
+ * slots at its first packet. The pools are primed before a packet's arena
+ * block and never touched inside it. A packet is opened (`receiveWindow`) and a datagram built
  * and sealed (`takeDatagramInto`) inside a `using a = arena()` block, so the
  * AEAD's and the header protection's temporaries go when the block ends, and
  * the compiler refuses the block if anything in it could store one. The
@@ -87,7 +97,7 @@
  *
  * **Time.** The connection has no clock: `receive`, `takeDatagram` and
  * `handleTimer` take the caller's monotonic time in milliseconds, and
- * `deadline()` says when `handleTimer` is next due. Three things run on it.
+ * `deadline()` says when `handleTimer` is next due. Four things run on it.
  * The idle timeout (RFC 9000 §10.1) is the smaller of the two sides'
  * `max_idle_timeout`, never under `QUIC_CONN_IDLE_FLOOR` or three probe
  * timeouts; once it passes with nothing received, the connection closes
@@ -95,7 +105,13 @@
  * timer declares packets lost by the time threshold or fires the probe
  * timeout. And after a key update the previous read keys are kept for a
  * probe timeout (`recovery.probeTimeout()`), for packets the network
- * reordered, before the next generation's are derived (RFC 9001 §6.5).
+ * reordered, before the next generation's are derived (RFC 9001 §6.5). Once
+ * the connection has closed, by either side, its keys are kept through the
+ * closing or draining period, three probe timeouts (RFC 9000 §10.2), and
+ * wiped at its end; `deadline()` is that end, then -1. A close this side
+ * owes starts the period when `takeDatagram` sends it, not when `close` or
+ * `fail` is called, so that however long the caller waits, the close still
+ * goes out.
  *
  * **Key update** (RFC 9001 §6), both ways. A 1-RTT packet whose Key Phase
  * bit differs from the current one is opened with the next generation's read
@@ -108,6 +124,12 @@
  * update keeps nothing in the arena; each still costs two key derivations of
  * work, so a connection takes at most `QUIC_CONN_MAX_KEY_UPDATES` updates the
  * client starts and closes on the next with KEY_UPDATE_ERROR (QUIC-4).
+ * The AEAD limits are kept (RFC 9001 §6.6): from three quarters of AES-GCM's
+ * confidentiality limit, 2^23 packets under one write key, the server starts
+ * an update itself, and closes with AEAD_LIMIT_REACHED, sealing nothing more,
+ * if it reaches the limit with none possible; past the integrity limit of
+ * packets that fail to authenticate over the connection, 2^52 for AES-GCM
+ * and 2^36 for ChaCha20-Poly1305, it closes with AEAD_LIMIT_REACHED too.
  *
  * **Sans-IO and deterministic.** No socket, no clock and no random device:
  * every random choice (the TLS server random and ephemeral key, the server's
@@ -132,24 +154,28 @@
  * packet numbers by `QUIC_ACK_MAX_RANGES`, and datagrams by their ring.
  *
  * **Secrets.** The packet keys of each level live in this connection's key
- * slots as long as the level does, and in `TlsServer`'s (TLS-1); so do the
- * 1-RTT secrets the next key generation is derived from, and the next
- * generation's read keys. A `Secret` may not be a field (NL2430), so they are
- * plain bytes; `secureZero` wipes each level's key, IV and header-protection
- * key, and its AES schedules with ordinary stores, when the level is
- * discarded, each generation's key, IV and secret when a key update
- * replaces it, and `release()` (and `reset`) the rest — the 1-RTT keys, the
- * key-update secrets, the traffic secrets `TlsServer` holds, its ephemeral
- * key and the connection-ID seed. What no wipe reaches (`aesKeyInto`'s
- * working copy of a schedule) is recorded as QUIC-2 in
- * `docs/security/quic.md`, with #430, the follow-up that moves these structs
- * onto `nish:secret`.
+ * slots as long as the level does; so do the 1-RTT secrets the next key
+ * generation is derived from, and the next generation's read keys. The
+ * traffic secrets and the ephemeral key `TlsServer` holds are `Secret`
+ * fields its `wipe()` reaches (TLS-1): `afterTls` takes each level's secrets
+ * out of them once, into this connection's plain slots, and zeroes them
+ * through `wipeSecret`. The slots are plain bytes, wiped with stores no
+ * optimiser removes (`secureZero`, and `aesKeyWipe` for an AES schedule):
+ * each level's key, IV, header-protection key and schedules when the level
+ * is discarded; each generation's key, IV, schedule and secret when a key
+ * update replaces it; and the rest — the 1-RTT keys, the key-update secrets,
+ * whatever `TlsServer` still holds and the connection-ID seed — by
+ * `release()`, `reset`, the idle timeout, and the end of the closing or
+ * draining period (RFC 9000 §10.2), three probe timeouts after this side's
+ * CONNECTION_CLOSE went out or the client's arrived.
+ * `docs/security/quic.md` records what is wiped where as QUIC-2.
  *
  * Written from RFC 9000, RFC 9001 and RFC 9221, in this module's own
  * structure; nothing here is ported from another implementation. Private
  * names carry the `quicConn` prefix (`docs/wp26-stdlib.md` §3e).
  */
 import { timingSafeEqualAt } from "nish/crypto/ct"
+import { AesKey, aesKeyWipe } from "nish/crypto/aes"
 import { HkdfScratch } from "nish/crypto/hkdf"
 import { HmacSha256Scratch, hmacSha256 } from "nish/crypto/hmac"
 import {
@@ -164,6 +190,7 @@ import {
   QUIC_PACKET_INITIAL,
   QUIC_PACKET_OK,
   QUIC_PACKET_SHORT,
+  QUIC_PACKET_ZERO_RTT,
   QuicHeader,
   QuicKeys,
   QuicKeysSlot,
@@ -181,6 +208,7 @@ import {
   quicUnprotectHeader,
 } from "nish/net/quic-packet"
 import {
+  QUIC_ERROR_AEAD_LIMIT_REACHED,
   QUIC_ERROR_APPLICATION,
   QUIC_ERROR_CRYPTO,
   QUIC_ERROR_CRYPTO_BUFFER_EXCEEDED,
@@ -260,13 +288,22 @@ import {
   TLS_LEVEL_APPLICATION,
   TLS_LEVEL_HANDSHAKE,
   TLS_LEVEL_INITIAL,
+  TLS_SECRET_CLIENT_APPLICATION,
+  TLS_SECRET_CLIENT_HANDSHAKE,
+  TLS_SECRET_SERVER_APPLICATION,
+  TLS_SECRET_SERVER_HANDSHAKE,
   TLS_STATE_CONNECTED,
   TLS_STATE_WAIT_CLIENT_HELLO,
   TLS_STATE_WAIT_SIGNATURE,
+  TlsSecretPool,
   TlsServer,
   TlsServerConfig,
+  tlsHeldClone,
+  tlsHeldCopyIn,
+  tlsHeldCopyOver,
 } from "nish/net/tls"
 import { TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256 } from "nish/net/tls/schedule"
+import { Secret, expose, exposeWith, secret, wipe } from "nish:secret"
 
 // ---- Sizes ----------------------------------------------------------------------
 
@@ -299,10 +336,11 @@ export const QUIC_CONN_MAX_STREAM_DATA: i64 = 1048576
 /** The most streams of one kind a configuration may let the client open at once, or open itself. */
 export const QUIC_CONN_MAX_STREAMS: i64 = 1024
 /**
- * The most bytes of stream buffer a configuration may make each connection
+ * The most bytes of stream buffer a configuration may let each connection
  * hold: every stream slot (`maxStreamsBidi + maxStreamsUni + localStreams`)
- * has `maxStreamData` bytes each way, made when the connection is, so a
- * configuration past 64 MiB of them is refused rather than allocated.
+ * may borrow `maxStreamData` bytes each way, and the pools are sized so all
+ * of them can at once, so a configuration past 64 MiB of them is refused
+ * rather than allowed to allocate it.
  */
 export const QUIC_CONN_MAX_STREAM_BUFFERS: i64 = 67108864
 /** The length of the configuration's static keys: the stateless reset key and the Retry token key. */
@@ -337,6 +375,37 @@ export const QUIC_CONN_PACKET_CONTROL: i32 = 4
  * a probe timeout between two of them.
  */
 export const QUIC_CONN_MAX_KEY_UPDATES: i32 = 64
+/**
+ * AES-GCM's confidentiality limit (RFC 9001 §6.6): how many packets one
+ * 1-RTT write key seals. The server starts a key update at three quarters of
+ * it, and closes the connection with AEAD_LIMIT_REACHED, sending nothing more
+ * under the key, if it reaches it with no update possible. ChaCha20-Poly1305
+ * has no such limit.
+ */
+export const QUIC_CONN_CONFIDENTIALITY_LIMIT: i64 = 8388608
+/**
+ * The integrity limits (RFC 9001 §6.6): how many packets may fail to
+ * authenticate over a connection's life, across every key, before it closes
+ * with AEAD_LIMIT_REACHED. AES-GCM's is 2^52, ChaCha20-Poly1305's 2^36.
+ */
+export const QUIC_CONN_INTEGRITY_LIMIT_GCM: i64 = 4503599627370496
+export const QUIC_CONN_INTEGRITY_LIMIT_CHACHA: i64 = 68719476736
+/**
+ * How many skipped packet numbers the server remembers (RFC 9000 §21.4): an
+ * ACK of any of the last this many closes the connection as an optimistic
+ * acknowledgement. One is skipped every `QUIC_CONN_SKIP_MIN` to
+ * `QUIC_CONN_SKIP_MIN + QUIC_CONN_SKIP_SPREAD - 1` packets, so the ring
+ * reaches back at least 7 × 129 = 903 packets.
+ */
+export const QUIC_CONN_SKIP_RING: i32 = 8
+export const QUIC_CONN_SKIP_MIN: i64 = 128
+export const QUIC_CONN_SKIP_SPREAD: i64 = 897
+/**
+ * The HMAC counter the skip distances are drawn under, past any connection
+ * ID's sequence number (`QUIC_CONN_MAX_ISSUED_CIDS`), so the same seed gives
+ * both without either telling anything about the other.
+ */
+const QUIC_CONN_SKIP_SEQUENCE: i64 = QUIC_MAX_VARINT + 1
 /**
  * How many ack-eliciting datagrams a probe timeout sends in the Initial and
  * Handshake spaces (RFC 9002 §6.2.4 allows up to two). The server's first
@@ -923,7 +992,14 @@ const quicConnAead = (suite: i32): i32 => {
   return QUIC_AEAD_AES_128_GCM
 }
 
-/** Wipes a level's key, IV and header-protection key; the expanded AES schedules are out of reach (QUIC-2). */
+/** Empties a ring of skipped packet numbers. */
+const quicConnForgetSkips = (skipped: i64[]): void => {
+  for (let k: i32 = 0; k < toI32(skipped.length); k += 1) {
+    skipped[k] = -1
+  }
+}
+
+/** Wipes a level's key, IV and header-protection key; `QuicKeysSlot.wipe` takes the header-protection schedule. */
 const quicConnWipeKeys = (keys: QuicKeys | null): void => {
   quicConnWipePacketKey(keys)
   if (keys !== null) {
@@ -932,14 +1008,19 @@ const quicConnWipeKeys = (keys: QuicKeys | null): void => {
 }
 
 /**
- * Wipes a key generation's packet key and IV that a key update replaced. The
- * header-protection key is left alone: every generation shares it (RFC 9001
- * §6), so it goes only when the level does.
+ * Wipes a key generation's packet key, IV and the packet key's AES schedule,
+ * which a key update replaced. The header-protection key and its schedule are
+ * left alone: every generation shares them (RFC 9001 §6), so they go only
+ * when the level does.
  */
 const quicConnWipePacketKey = (keys: QuicKeys | null): void => {
   if (keys !== null) {
     secureZero(keys.key)
     secureZero(keys.iv)
+    const packetAes: AesKey | null = keys.packetAes
+    if (packetAes !== null) {
+      aesKeyWipe(packetAes)
+    }
   }
 }
 
@@ -999,26 +1080,17 @@ const quicConnRefill = (to: u8[], from: u8[], at: i32, length: i32): void => {
   }
 }
 
-/**
- * Secret `index` (0 or 1) of a direction's pool, of the length `aead`'s hash
- * gives: what a key update derives the next traffic secret into.
- */
-const quicConnSecretAt = (pool: u8[][], aead: i32, index: i32): u8[] => {
-  let wanted: i32 = index === 1 ? 1 : 0
-  if (aead === QUIC_AEAD_AES_256_GCM) {
-    wanted = wanted + 2
-  }
-  const at: i32 = wanted < toI32(pool.length) ? wanted : 0
-  return pool[at]
+/** Zeroes the bytes a `Secret` field holds, for `exposeWith` to run outside the connection's `wipe()`; answers `answer`. */
+const quicConnZeroHeld = (held: u8[], answer: i32): i32 => {
+  wipe(held)
+  return answer
 }
 
-/** Two secrets of SHA-256's length and two of SHA-384's, for one direction's key updates. */
-const quicConnSecretPool = (): u8[][] => [
-  new Array<u8>(32),
-  new Array<u8>(32),
-  new Array<u8>(48),
-  new Array<u8>(48),
-]
+/** Copies the x25519 private key, `entropy[32 .. 64)`, into the held key, for `exposeWith`; answers 0. */
+const quicConnEphemeralIn = (held: u8[], entropy: u8[]): i32 => {
+  quicCidCopy(held, entropy, 32, 32)
+  return 0
+}
 
 /** Whether the configuration's limits are ones this module can honour. */
 const quicConnConfigFits = (config: QuicServerConfig): boolean =>
@@ -1063,7 +1135,8 @@ export class QuicConnection {
   /** For a transport error: the type of the frame that caused it, or 0. */
   errorFrameType: i64 = 0
   serverRandom: u8[]
-  ephemeralPrivate: u8[]
+  /** The x25519 private key `begin` takes from the entropy, until the handshake hands it to `TlsServer`. */
+  readonly ephemeral: Secret<u8[]>
   cidSeed: u8[]
   /** The DCID of the client's first Initial, which the Initial keys come from: its first `originalDcidLength` bytes. */
   originalDcid: u8[]
@@ -1087,12 +1160,19 @@ export class QuicConnection {
   initialClient: u8[]
   initialServer: u8[]
   /**
-   * The 1-RTT secrets a key update derives, two of each hash's length a
-   * direction (SHA-256's first, then SHA-384's), used in turn: the next
-   * generation's goes in the one the current generation's is not in.
-   */
-  writeSecrets: u8[][]
-  readSecrets: u8[][]
+   * The 1-RTT traffic secrets (RFC 9001 §6.1), one set of SHA-256's length
+   * and one of SHA-384's, the one the suite's hash picks in use: the
+   * current read secret, the next generation's, and the current write
+   * secret, which a key update ratchets in place. The write side keeps no
+   * next secret, because the server derives its next write keys only when
+   * it moves to them.
+   */
+  readonly readSecret256: Secret<u8[]>
+  readonly nextReadSecret256: Secret<u8[]>
+  readonly writeSecret256: Secret<u8[]>
+  readonly readSecret384: Secret<u8[]>
+  readonly nextReadSecret384: Secret<u8[]>
+  readonly writeSecret384: Secret<u8[]>
   /** A connection ID being issued and its stateless reset token, before the table copies them. */
   cidScratch: u8[]
   tokenScratch: u8[]
@@ -1136,14 +1216,10 @@ export class QuicConnection {
   /** When the idle timer last restarted (RFC 9000 §10.1), or -1 before the first packet. */
   idleSince: i64 = -1
   /**
-   * The 1-RTT secrets of the current generation, the next generation's read
-   * secret, and its read keys (RFC 9001 §6.1, §6.3). `otherReadKeys` holds
-   * the next generation's while `otherIsNext`, and for a probe timeout after
-   * an update the previous one's, for reordered packets (§6.5).
+   * The other read keys of the Application Data space (RFC 9001 §6.3):
+   * the next generation's while `otherIsNext`, and for a probe timeout
+   * after an update the previous one's, for reordered packets (§6.5).
    */
-  appReadSecret: u8[]
-  appWriteSecret: u8[]
-  nextReadSecret: u8[]
   otherReadKeys: QuicKeys | null = null
   /** The lowest and highest packet numbers opened with the current read keys, or -1. */
   readPhaseLowest: i64 = -1
@@ -1152,10 +1228,49 @@ export class QuicConnection {
   writePhaseFirst: i64 = 0
   /** When the previous read keys go and the next are derived, or -1. */
   keyRetainUntil: i64 = -1
+  /**
+   * When a closed connection's closing or draining period ends (RFC 9000
+   * §10.2), and `runClocks` wipes every key it kept for it, or -1: before
+   * the close, while a close this side owes has not gone out, and once the
+   * keys are wiped.
+   */
+  closingUntil: i64 = -1
   /** The packet number of a client key update read but not applied yet, or -1. */
   phasePending: i64 = -1
   /** The largest DATAGRAM frame the client takes (its `max_datagram_frame_size`), 0 for none. */
   peerMaxDatagramFrame: i64 = 0
+  /**
+   * The AEAD limits this connection keeps (RFC 9001 §6.6): packets one 1-RTT
+   * write key seals, and packets that fail to authenticate over the
+   * connection. `afterTls` sets them from the suite when the 1-RTT keys
+   * arrive; until then they are AES-GCM's. They are fields so that a test can
+   * lower them after the handshake; nothing else should set them.
+   */
+  confidentialityLimit: i64 = 8388608
+  integrityLimit: i64 = 4503599627370496
+  /** Packets sealed under the current 1-RTT write key, and packets that failed to authenticate, against those limits. */
+  sealedUnderKey: i64 = 0
+  authFailures: i64 = 0
+  /**
+   * ECN (RFC 9000 §13.4): `ecnMarking` is the carrier's to set when it sends
+   * this connection's datagrams with the ECN bits of `datagramEcn`, which
+   * each `takeDatagramInto` sets for the datagram it wrote: ECT(0) while
+   * loss recovery's `ecnCodepoint()` asks for it, 0 otherwise and always
+   * while `ecnMarking` is false. Every packet of a marked datagram is counted
+   * as marked, and an ACK_ECN's counts are validated against them. `reset`
+   * keeps `ecnMarking`, which is the carrier's, and clears the rest.
+   */
+  ecnMarking: boolean = false
+  datagramEcn: i32 = 0
+  /**
+   * The next Application Data packet number skipped (RFC 9000 §21.4), or -1
+   * before the 1-RTT keys; a test may set it to force one. `skipped` holds
+   * the last `QUIC_CONN_SKIP_RING` skipped, -1 where none, `skipHead` where
+   * the next goes, and `skipsDrawn` how many distances were drawn.
+   */
+  nextSkip: i64 = -1
+  skipped: i64[]
+  skipsDrawn: i64 = 0
   originalDcidLength: i32 = 0
   peerScidLength: i32 = 0
   pathHead: i32 = 0
@@ -1165,12 +1280,11 @@ export class QuicConnection {
   dropped: i32 = 0
   /** Key updates the client started, against `QUIC_CONN_MAX_KEY_UPDATES`. */
   keyUpdates: i32 = 0
+  /** Where the next skipped packet number goes in `skipped`. */
+  skipHead: i32 = 0
   /** Which of the Application Data space's two read slots, and two write slots, hold the current keys. */
   appReadSlot: i32 = 0
   appWriteSlot: i32 = 0
-  /** Which of `readSecrets` and `writeSecrets` (0 or 1) holds the current secret, or -1 for `TlsServer`'s own. */
-  readSecretCurrent: i32 = -1
-  writeSecretCurrent: i32 = -1
   /** Handshake data sent again early, against `QUIC_CONN_EARLY_RESENDS` (RFC 9002 §6.2.3). */
   earlyResends: i32 = 0
   /** The level at which the packet just read showed the client lacks the server's handshake data, or -1. */
@@ -1184,6 +1298,12 @@ export class QuicConnection {
   /** Whether the handshake is complete, which for a server is also confirmed (RFC 9001 §4.1.2). */
   handshakeComplete: boolean = false
   handshakeDonePending: boolean = false
+  /**
+   * Whether `afterTls` has taken the application traffic secrets out of
+   * `TlsServer`. It takes them once: `wipeSecret` leaves them known, so a
+   * second take would derive the 1-RTT keys from the zeros it left.
+   */
+  applicationTaken: boolean = false
   /** Whether the connection was set up by `acceptRetry`. */
   retried: boolean = false
   /** Whether an ack-eliciting packet went out since the last packet was received. */
@@ -1208,7 +1328,7 @@ export class QuicConnection {
   constructor(config: QuicServerConfig, entropy: u8[]) {
     this.config = config
     this.serverRandom = new Array<u8>(32)
-    this.ephemeralPrivate = new Array<u8>(32)
+    this.ephemeral = secret(new Array<u8>(32))
     this.localScid = new Array<u8>(QUIC_CONN_CID_LENGTH)
     this.cidSeed = new Array<u8>(32)
     this.originalDcid = new Array<u8>(QUIC_MAX_CID_LENGTH)
@@ -1263,13 +1383,16 @@ export class QuicConnection {
     this.kdf = new HkdfScratch()
     this.initialClient = new Array<u8>(32)
     this.initialServer = new Array<u8>(32)
-    this.writeSecrets = quicConnSecretPool()
-    this.readSecrets = quicConnSecretPool()
+    this.readSecret256 = secret(new Array<u8>(32))
+    this.nextReadSecret256 = secret(new Array<u8>(32))
+    this.writeSecret256 = secret(new Array<u8>(32))
+    this.readSecret384 = secret(new Array<u8>(48))
+    this.nextReadSecret384 = secret(new Array<u8>(48))
+    this.writeSecret384 = secret(new Array<u8>(48))
     this.cidScratch = new Array<u8>(QUIC_CONN_CID_LENGTH)
     this.tokenScratch = new Array<u8>(QUIC_RESET_TOKEN_SIZE)
-    this.appReadSecret = this.none
-    this.appWriteSecret = this.none
-    this.nextReadSecret = this.none
+    this.skipped = new Array<i64>(QUIC_CONN_SKIP_RING)
+    quicConnForgetSkips(this.skipped)
     this.begin(entropy)
   }
 
@@ -1304,14 +1427,9 @@ export class QuicConnection {
     this.serverName = ""
     quicConnRefill(this.retryOriginalDcid, this.none, QUIC_CONN_FROM, QUIC_CONN_FROM)
     quicConnRefill(this.retryScid, this.none, QUIC_CONN_FROM, QUIC_CONN_FROM)
-    this.appReadSecret = this.none
-    this.appWriteSecret = this.none
-    this.nextReadSecret = this.none
     this.otherReadKeys = null
     this.appReadSlot = 0
     this.appWriteSlot = 0
-    this.readSecretCurrent = -1
-    this.writeSecretCurrent = -1
     this.earlyResends = 0
     this.resendLevel = -1
     this.now = 0
@@ -1320,6 +1438,7 @@ export class QuicConnection {
     this.readPhaseHighest = -1
     this.writePhaseFirst = 0
     this.keyRetainUntil = -1
+    this.closingUntil = -1
     this.phasePending = -1
     this.peerMaxDatagramFrame = 0
     this.originalDcidLength = 0
@@ -1329,10 +1448,20 @@ export class QuicConnection {
     this.state = QUIC_STATE_WAIT_INITIAL
     this.dropped = 0
     this.keyUpdates = 0
+    this.confidentialityLimit = QUIC_CONN_CONFIDENTIALITY_LIMIT
+    this.integrityLimit = QUIC_CONN_INTEGRITY_LIMIT_GCM
+    this.sealedUnderKey = 0
+    this.authFailures = 0
+    this.datagramEcn = 0
+    this.nextSkip = -1
+    quicConnForgetSkips(this.skipped)
+    this.skipsDrawn = 0
+    this.skipHead = 0
     this.errorIsApplication = false
     this.closeSent = false
     this.addressValidated = false
     this.handshakeComplete = false
+    this.applicationTaken = false
     this.handshakeDonePending = false
     this.retried = false
     this.elicitingSent = false
@@ -1347,7 +1476,7 @@ export class QuicConnection {
   /** Takes `entropy` (and wipes it), or closes with INTERNAL_ERROR for entropy or a configuration that does not fit. */
   begin(entropy: u8[]): void {
     quicCidCopy(this.serverRandom, entropy, 0, 32)
-    quicCidCopy(this.ephemeralPrivate, entropy, 32, 32)
+    exposeWith(this.ephemeral, entropy, quicConnEphemeralIn)
     quicCidCopy(this.localScid, entropy, 64, QUIC_CONN_CID_LENGTH)
     quicCidCopy(this.cidSeed, entropy, 72, 32)
     const fits: boolean = toI32(entropy.length) === QUIC_CONN_ENTROPY_SIZE && quicConnConfigFits(this.config)
@@ -1356,6 +1485,7 @@ export class QuicConnection {
       this.state = QUIC_STATE_CLOSING
       this.error = QUIC_ERROR_INTERNAL
       this.closeSent = true
+      this.startClosingPeriod()
     }
   }
 
@@ -1426,6 +1556,19 @@ export class QuicConnection {
     this.errorIsApplication = true
   }
 
+  /**
+   * Starts the closing or draining period, three probe timeouts long (RFC
+   * 9000 §10.2), once nothing more is owed: when the client's
+   * CONNECTION_CLOSE arrives, when `takeCloseInto` sends this side's, or when
+   * `begin` closes before anything could be sent. The keys stay through it,
+   * as the period's state, and `runClocks` wipes them all at its end, which
+   * `deadline()` names, so that a connection nobody `release()`s does not
+   * keep them.
+   */
+  startClosingPeriod(): void {
+    this.closingUntil = this.now + this.recovery.probeTimeout() * 3
+  }
+
   /** The space of packets of `type`, or `null` for a 0-RTT or Retry packet. */
   spaceOf(type: i32): QuicConnSpace | null {
     if (type === QUIC_PACKET_INITIAL) {
@@ -1646,15 +1789,24 @@ export class QuicConnection {
     quicEncodeTransportParametersInto(params, this.localEncoded)
     // One `TlsServer` a slot, made by its first handshake (so its flight is
     // sized for these parameters) and restarted, wiped, by each after it.
+    // The ephemeral key goes from the connection's `Secret` to the
+    // server's: a restart takes a plain copy, which it zeroes, made in an
+    // arena block; a new server takes a zero key that ours is copied over.
+    // Either way ours is zeroed once it is handed on.
     const tls: TlsServer | null = this.tlsSlot
     if (tls !== null) {
-      tls.restart(this.serverRandom, this.ephemeralPrivate)
+      {
+        using _scope = arena()
+        tls.restart(this.serverRandom, expose(this.ephemeral, tlsHeldClone))
+      }
       this.tls = tls
     } else {
-      const made: TlsServer = new TlsServer(this.tlsConfig, this.serverRandom, this.ephemeralPrivate)
+      const made: TlsServer = new TlsServer(this.tlsConfig, this.serverRandom, new Array<u8>(32))
+      exposeWith(this.ephemeral, made.ephemeral, tlsHeldCopyOver)
       this.tlsSlot = made
       this.tls = made
     }
+    exposeWith(this.ephemeral, QUIC_CONN_FROM, quicConnZeroHeld)
   }
 
   /**
@@ -1713,9 +1865,20 @@ export class QuicConnection {
     this.phasePending = -1
     this.resendLevel = -1
     let used: boolean = false
+    // A STREAM frame's first byte borrows a receive buffer, and no pool may
+    // take one inside the scope, so the reserve is primed before it with what
+    // this packet could want. Only 0-RTT and 1-RTT packets carry STREAM
+    // frames (RFC 9000 §12.4); any other still makes a standalone
+    // connection's private pools, so the handshake, not the first 1-RTT
+    // packet, pays for them.
+    if (type === QUIC_PACKET_SHORT || type === QUIC_PACKET_ZERO_RTT) {
+      this.streams.prime(header.end - header.pnOffset)
+    } else {
+      this.streams.ownPools()
+    }
     {
       using _scope = arena()
-      used = this.openScoped(buf, header, space, keys)
+      used = this.openScoped(buf, header, space, keys, first)
     }
     if (!used) {
       return false
@@ -1755,7 +1918,7 @@ export class QuicConnection {
    * an allocation, which is what lets the block release the packet's
    * temporaries. Answers whether the packet was used rather than dropped.
    */
-  openScoped(buf: u8[], header: QuicHeader, space: QuicConnSpace, keys: QuicKeys): boolean {
+  openScoped(buf: u8[], header: QuicHeader, space: QuicConnSpace, keys: QuicKeys, first: boolean): boolean {
     const packet: QuicPacket = this.packet
     // Every key generation shares the header-protection key (RFC 9001 §6),
     // so the current keys take it off whatever the Key Phase bit says.
@@ -1770,6 +1933,15 @@ export class QuicConnection {
     const payload: u8[] | null = quicDecryptPayload(open, buf, header, clear, packet)
     if (payload === null) {
       this.drop()
+      // RFC 9001 §6.6: past the integrity limit, the connection closes and
+      // reads nothing more. A first Initial that fails is not counted: the
+      // connection is not started, and the next one starts afresh.
+      if (!first) {
+        this.authFailures = this.authFailures + 1
+        if (this.authFailures > this.integrityLimit) {
+          this.fail(QUIC_ERROR_AEAD_LIMIT_REACHED, QUIC_CONN_NONE)
+        }
+      }
       return false
     }
     // §17.2, §17.3.1: reserved bits set under a valid tag close the connection.
@@ -1859,10 +2031,13 @@ export class QuicConnection {
     this.otherReadKeys = previous
     this.otherIsNext = false
     this.appReadSlot = 1 - this.appReadSlot
-    secureZero(this.appReadSecret)
-    this.appReadSecret = this.nextReadSecret
-    this.readSecretCurrent = this.readSecretCurrent === 0 ? 1 : 0
-    this.nextReadSecret = this.none
+    // The next read secret becomes the current one, over the secret it
+    // replaces, and is zeroed where it was. Both widths move: the one the
+    // suite does not use holds zeros.
+    exposeWith(this.nextReadSecret256, this.readSecret256, tlsHeldCopyOver)
+    exposeWith(this.nextReadSecret384, this.readSecret384, tlsHeldCopyOver)
+    exposeWith(this.nextReadSecret256, QUIC_CONN_FROM, quicConnZeroHeld)
+    exposeWith(this.nextReadSecret384, QUIC_CONN_FROM, quicConnZeroHeld)
     this.readPhase = !this.readPhase
     this.readPhaseLowest = pn
     this.readPhaseHighest = pn
@@ -1880,28 +2055,68 @@ export class QuicConnection {
     if (keys === null) {
       return false
     }
-    const target: i32 = this.writeSecretCurrent === 0 ? 1 : 0
-    const secret: u8[] = quicConnSecretAt(this.writeSecrets, keys.aead, target)
-    if (!quicKeyUpdateSecretInto(this.kdf, keys.aead, this.appWriteSecret, secret)) {
-      return false
-    }
     const slot: QuicKeysSlot = this.application.keySlot(QUIC_CONN_APP_WRITE_SLOTS + 1 - this.appWriteSlot)
-    const next: QuicKeys | null = quicKeysUpdateInto(this.kdf, slot, keys, secret)
+    const next: QuicKeys | null =
+      keys.aead === QUIC_AEAD_AES_256_GCM
+        ? this.nextKeys(slot, keys, this.writeSecret384, this.writeSecret384)
+        : this.nextKeys(slot, keys, this.writeSecret256, this.writeSecret256)
     if (next === null) {
-      secureZero(secret)
       return false
     }
     quicConnWipePacketKey(keys)
-    secureZero(this.appWriteSecret)
     this.application.writeKeys = next
-    this.appWriteSecret = secret
-    this.writeSecretCurrent = target
     this.appWriteSlot = 1 - this.appWriteSlot
     this.writePhase = !this.writePhase
     this.writePhaseFirst = this.application.nextPn
+    this.sealedUnderKey = 0
     return true
   }
 
+  /**
+   * A level's keys from a held traffic secret, derived into `slot` through
+   * the connection's own HKDF scratch, as `quicKeys` derives them: the
+   * derivation reads a plain copy made in an arena block, which is zeroed
+   * before it ends, so the call keeps nothing in the arena. Answers the
+   * slot's keys, or `null` for a secret of the wrong length.
+   */
+  keysFrom(slot: QuicKeysSlot, aead: i32, held: Secret<u8[]>): QuicKeys | null {
+    let made: boolean = false
+    {
+      using _scope = arena()
+      const plain: u8[] = expose(held, tlsHeldClone)
+      made = quicKeysInto(this.kdf, slot, aead, plain) !== null
+      secureZero(plain)
+    }
+    return made ? slot.keys : null
+  }
+
+  /**
+   * The next generation of `keys` into `slot` (RFC 9001 §6.1): the next
+   * traffic secret, `quic ku` of `current`, and its packet key and IV, with
+   * the header-protection key and its schedule shared, as every generation
+   * shares them. The secret is written into `next`, which may be `current`
+   * and then ratchets it. The derivation reads plain copies made in an arena
+   * block, which are zeroed before it ends. Answers the slot's keys, or
+   * `null`, leaving `next` as it was, for keys `quicKeys` did not make.
+   */
+  nextKeys(slot: QuicKeysSlot, keys: QuicKeys, current: Secret<u8[]>, next: Secret<u8[]>): QuicKeys | null {
+    let made: boolean = false
+    {
+      using _scope = arena()
+      const plain: u8[] = expose(current, tlsHeldClone)
+      const out: u8[] = new Array<u8>(plain.length)
+      made =
+        quicKeyUpdateSecretInto(this.kdf, keys.aead, plain, out) &&
+        quicKeysUpdateInto(this.kdf, slot, keys, out) !== null
+      if (made) {
+        exposeWith(next, out, tlsHeldCopyIn)
+      }
+      secureZero(plain)
+      secureZero(out)
+    }
+    return made ? slot.keys : null
+  }
+
   /**
    * Derives the next generation's read secret and keys from the current
    * ones, into `otherReadKeys`, wiping the previous generation's key and IV
@@ -1918,17 +2133,11 @@ export class QuicConnection {
     if (keys === null) {
       return
     }
-    const secret: u8[] = quicConnSecretAt(this.readSecrets, keys.aead, this.readSecretCurrent === 0 ? 1 : 0)
-    if (!quicKeyUpdateSecretInto(this.kdf, keys.aead, this.appReadSecret, secret)) {
-      return
-    }
-    this.nextReadSecret = secret
-    this.otherReadKeys = quicKeysUpdateInto(
-      this.kdf,
-      this.application.keySlot(1 - this.appReadSlot),
-      keys,
-      secret
-    )
+    const slot: QuicKeysSlot = this.application.keySlot(1 - this.appReadSlot)
+    this.otherReadKeys =
+      keys.aead === QUIC_AEAD_AES_256_GCM
+        ? this.nextKeys(slot, keys, this.readSecret384, this.nextReadSecret384)
+        : this.nextKeys(slot, keys, this.readSecret256, this.nextReadSecret256)
     this.otherIsNext = this.otherReadKeys !== null
   }
 
@@ -2123,6 +2332,7 @@ export class QuicConnection {
     this.error = code
     this.errorIsApplication = application
     this.closeSent = true
+    this.startClosingPeriod()
   }
 
   /**
@@ -2132,7 +2342,7 @@ export class QuicConnection {
    * carried, and each it shows lost has its frames queued again.
    */
   receiveAck(space: QuicConnSpace, frame: QuicFrame): void {
-    if (frame.largest >= space.nextPn) {
+    if (frame.largest >= space.nextPn || (space.level === TLS_LEVEL_APPLICATION && this.acksSkipped(frame))) {
       this.fail(QUIC_ERROR_PROTOCOL_VIOLATION, toI64(frame.type))
       return
     }
@@ -2141,9 +2351,24 @@ export class QuicConnection {
     }
     const sent: QuicSentPackets | null = this.recovery.space(space.level)
     const delay: i64 = this.ackDelayOf(frame.ackDelay)
+    // ACK_ECN's counts (RFC 9002 §7.1), or -1 each for a plain ACK.
+    const ecn: boolean = frame.type === QUIC_FRAME_ACK_ECN
+    const none: i64 = -1
+    const ect0: i64 = ecn ? frame.ect0 : none
+    const ect1: i64 = ecn ? frame.ect1 : none
+    const ce: i64 = ecn ? frame.ce : none
     if (
       sent === null ||
-      this.recovery.onAck(space.level, frame.ackRanges, frame.ackRangeCount, delay, this.now) <= 0
+      this.recovery.onAckEcn(
+        space.level,
+        frame.ackRanges,
+        frame.ackRangeCount,
+        delay,
+        this.now,
+        ect0,
+        ect1,
+        ce
+      ) <= 0
     ) {
       return
     }
@@ -2153,6 +2378,26 @@ export class QuicConnection {
     this.packetsLost(space, sent)
   }
 
+  /**
+   * Whether `frame` acknowledges a packet number the server skipped and
+   * still remembers (RFC 9000 §21.4): a client that does is acknowledging
+   * what it never received. Every range the frame stored is read; one past
+   * `QUIC_FRAME_MAX_ACK_RANGES` is not, and loss recovery does not act on
+   * it either.
+   */
+  acksSkipped(frame: QuicFrame): boolean {
+    const ranges: i64[] = frame.ackRanges
+    for (let k: i32 = 0; k < toI32(this.skipped.length); k += 1) {
+      const pn: i64 = this.skipped[k]
+      for (let r: i32 = 0; pn >= 0 && r < frame.ackRangeCount && r * 2 + 1 < toI32(ranges.length); r += 1) {
+        if (pn >= ranges[r * 2] && pn <= ranges[r * 2 + 1]) {
+          return true
+        }
+      }
+    }
+    return false
+  }
+
   /**
    * An ACK frame's ACK Delay in milliseconds: the field scaled by the
    * client's `ack_delay_exponent` (RFC 9000 §19.3, §18.2). A value too large
@@ -2440,35 +2685,59 @@ export class QuicConnection {
       }
       this.alpn = tls.alpn
       this.serverName = tls.serverName
-      this.handshake.readKeys = this.keysFor(
-        this.handshake.keySlot(QUIC_CONN_READ_SLOT),
-        aead,
-        tls.readSecret(TLS_LEVEL_HANDSHAKE)
-      )
-      this.handshake.writeKeys = this.keysFor(
-        this.handshake.keySlot(QUIC_CONN_WRITE_SLOT),
-        aead,
-        tls.writeSecret(TLS_LEVEL_HANDSHAKE)
-      )
+      if (tls.readKnown(TLS_LEVEL_HANDSHAKE)) {
+        this.handshake.readKeys = this.keysFrom(
+          this.handshake.keySlot(QUIC_CONN_READ_SLOT),
+          aead,
+          tls.secrets().clientHandshake
+        )
+      }
+      if (tls.writeKnown(TLS_LEVEL_HANDSHAKE)) {
+        this.handshake.writeKeys = this.keysFrom(
+          this.handshake.keySlot(QUIC_CONN_WRITE_SLOT),
+          aead,
+          tls.secrets().serverHandshake
+        )
+      }
     }
     if (
+      !this.applicationTaken &&
       !this.application.discarded &&
       this.application.writeKeys === null &&
       tls.state !== TLS_STATE_WAIT_SIGNATURE
     ) {
-      const write: u8[] | null = tls.writeSecret(TLS_LEVEL_APPLICATION)
-      const read: u8[] | null = tls.readSecret(TLS_LEVEL_APPLICATION)
-      if (write !== null && read !== null) {
-        this.application.writeKeys = this.keysFor(
-          this.application.keySlot(QUIC_CONN_APP_WRITE_SLOTS + this.appWriteSlot),
-          aead,
-          write
+      if (tls.writeKnown(TLS_LEVEL_APPLICATION) && tls.readKnown(TLS_LEVEL_APPLICATION)) {
+        // The key updates derive from the connection's own `Secret`
+        // fields, so the application secrets are copied into those of the
+        // suite's width and wiped in `TlsServer`, leaving one copy of each.
+        const pool: TlsSecretPool = tls.secrets()
+        const writeSlot: QuicKeysSlot = this.application.keySlot(
+          QUIC_CONN_APP_WRITE_SLOTS + this.appWriteSlot
         )
-        this.application.readKeys = this.keysFor(this.application.keySlot(this.appReadSlot), aead, read)
-        // The key update secrets start from `TlsServer`'s own arrays, so the
-        // first update wipes those too, rather than leaving a copy behind.
-        this.appWriteSecret = write
-        this.appReadSecret = read
+        const readSlot: QuicKeysSlot = this.application.keySlot(this.appReadSlot)
+        if (aead === QUIC_AEAD_AES_256_GCM) {
+          exposeWith(pool.serverApplication, this.writeSecret384, tlsHeldCopyOver)
+          exposeWith(pool.clientApplication, this.readSecret384, tlsHeldCopyOver)
+        } else {
+          exposeWith(pool.serverApplication, this.writeSecret256, tlsHeldCopyOver)
+          exposeWith(pool.clientApplication, this.readSecret256, tlsHeldCopyOver)
+        }
+        this.applicationTaken = true
+        // ChaCha20-Poly1305 has no confidentiality limit, and no packet
+        // number, so no count of packets, reaches `QUIC_MAX_VARINT`.
+        const chacha: boolean = aead === QUIC_AEAD_CHACHA20_POLY1305
+        this.integrityLimit = chacha ? QUIC_CONN_INTEGRITY_LIMIT_CHACHA : QUIC_CONN_INTEGRITY_LIMIT_GCM
+        this.confidentialityLimit = chacha ? QUIC_MAX_VARINT : QUIC_CONN_CONFIDENTIALITY_LIMIT
+        this.scheduleSkip(this.application.nextPn)
+        tls.wipeSecret(TLS_SECRET_SERVER_APPLICATION)
+        tls.wipeSecret(TLS_SECRET_CLIENT_APPLICATION)
+        if (aead === QUIC_AEAD_AES_256_GCM) {
+          this.application.writeKeys = this.keysFrom(writeSlot, aead, this.writeSecret384)
+          this.application.readKeys = this.keysFrom(readSlot, aead, this.readSecret384)
+        } else {
+          this.application.writeKeys = this.keysFrom(writeSlot, aead, this.writeSecret256)
+          this.application.readKeys = this.keysFrom(readSlot, aead, this.readSecret256)
+        }
         this.prepareNextReadKeys()
       }
     }
@@ -2478,18 +2747,14 @@ export class QuicConnection {
       this.handshakeDonePending = true
       this.state = QUIC_STATE_CONNECTED
       this.discard(this.handshake)
+      // The Handshake level's traffic secrets have nothing left to derive
+      // once it is discarded (TLS wipes the handshake secret itself).
+      tls.wipeSecret(TLS_SECRET_CLIENT_HANDSHAKE)
+      tls.wipeSecret(TLS_SECRET_SERVER_HANDSHAKE)
       this.topUpConnectionIds()
     }
   }
 
-  /** `quicKeysInto` `slot` of a secret TLS has, or `null` when it has none yet. */
-  keysFor(slot: QuicKeysSlot, aead: i32, secret: u8[] | null): QuicKeys | null {
-    if (secret === null) {
-      return null
-    }
-    return quicKeysInto(this.kdf, slot, aead, secret)
-  }
-
   /**
    * The client's transport parameters (RFC 9000 §7.3, §7.4, §18.2): they must
    * parse, and must name as `initial_source_connection_id` the SCID its first
@@ -2677,12 +2942,17 @@ export class QuicConnection {
    * When `handleTimer` is next due, in the caller's milliseconds: the idle
    * timeout, loss recovery's timer (a time-threshold loss or the probe
    * timeout), or the end of a key update's probe timeout, whichever comes
-   * first. -1 when nothing is timed: before the first packet, once the
-   * connection has closed, and with no idle timeout, nothing in flight and
-   * no update pending.
+   * first; once the connection has closed, the end of its closing or
+   * draining period, when its keys are wiped. -1 when nothing is timed:
+   * before the first packet, while a closed connection's own close has not
+   * gone out (`takeDatagram` sends it), once a closed connection's keys are
+   * wiped, and with no idle timeout, nothing in flight and no update pending.
    */
   deadline(): i64 {
-    if (this.closed() || this.state === QUIC_STATE_WAIT_INITIAL) {
+    if (this.closed()) {
+      return this.closingUntil
+    }
+    if (this.state === QUIC_STATE_WAIT_INITIAL) {
       return -1
     }
     let due: i64 = this.idleDeadline()
@@ -2709,9 +2979,10 @@ export class QuicConnection {
    * Runs whatever is due by `now`, the caller's monotonic time in
    * milliseconds; call it at `deadline()`, or any time. Past the idle timeout
    * the connection closes silently (`QUIC_STATE_TIMED_OUT`, RFC 9000 §10.1):
-   * no CONNECTION_CLOSE, every key wiped. Past a key update's probe timeout
-   * the previous read keys are wiped and the next generation's derived (RFC
-   * 9001 §6.5). Past loss recovery's timer, packets lost by the time
+   * no CONNECTION_CLOSE, every key wiped. Past the closing or draining
+   * period of a connection that closed, every key is wiped (§10.2). Past a
+   * key update's probe timeout the previous read keys are wiped and the next
+   * generation's derived (RFC 9001 §6.5). Past loss recovery's timer, packets lost by the time
    * threshold have their frames queued again, or a probe timeout queues
    * every space's packets in flight and asks for a probe (RFC 9002 §6.1.2,
    * §6.2.4): `takeDatagram` then sends it. `receive` and `takeDatagram` run
@@ -2723,12 +2994,24 @@ export class QuicConnection {
     this.runRecoveryTimer()
   }
 
-  /** `handleTimer`'s idle timeout and key retention, which `receive` runs before it reads a datagram. */
+  /**
+   * `handleTimer`'s idle timeout, key retention and the end of the closing
+   * or draining period, which `receive` runs before it reads a datagram.
+   */
   runClocks(now: i64): void {
     if (now > this.now) {
       this.now = now
     }
-    if (this.closed() || this.state === QUIC_STATE_WAIT_INITIAL) {
+    if (this.closed()) {
+      // RFC 9000 §10.2: past the period, nothing more goes out, so the keys
+      // kept for the CONNECTION_CLOSE are wiped (QUIC-2).
+      if (this.closingUntil >= 0 && this.now >= this.closingUntil) {
+        this.closeSent = true
+        this.wipeAll()
+      }
+      return
+    }
+    if (this.state === QUIC_STATE_WAIT_INITIAL) {
       return
     }
     const idle: i64 = this.idleDeadline()
@@ -2783,6 +3066,24 @@ export class QuicConnection {
     return this.updateWriteKeys()
   }
 
+  /**
+   * Draws where the next Application Data packet number is skipped (RFC
+   * 9000 §21.4): `QUIC_CONN_SKIP_MIN` plus up to `QUIC_CONN_SKIP_SPREAD - 1`
+   * packets past `from`, the distance taken from the ID seed's HMAC under
+   * `QUIC_CONN_SKIP_SEQUENCE`, so a client that saw where the last gaps fell
+   * cannot tell where the next will.
+   */
+  scheduleSkip(from: i64): void {
+    this.deriveConnectionId(QUIC_CONN_SKIP_SEQUENCE + this.skipsDrawn)
+    this.skipsDrawn = this.skipsDrawn + 1
+    let draw: i64 = 0
+    for (let k: i32 = 0; k < 4 && k < toI32(this.cidScratch.length); k += 1) {
+      draw = (draw << 8) | toI64(this.cidScratch[k])
+    }
+    secureZero(this.cidScratch)
+    this.nextSkip = from + QUIC_CONN_SKIP_MIN + (draw % QUIC_CONN_SKIP_SPREAD)
+  }
+
   // ---- Streams ------------------------------------------------------------------
 
   /**
@@ -3028,6 +3329,7 @@ export class QuicConnection {
       return 0
     }
     let n: i32 = 0
+    this.datagramEcn = 0
     if (this.state === QUIC_STATE_CLOSING) {
       using _scope = arena()
       n = this.takeCloseInto(out, at)
@@ -3041,6 +3343,8 @@ export class QuicConnection {
     if (this.amplificationBlocked()) {
       return 0
     }
+    this.beforeDatagram()
+    this.datagramEcn = this.ecnMarking ? this.recovery.ecnCodepoint() : 0
     {
       using _scope = arena()
       n = this.buildDatagram(out, at)
@@ -3048,6 +3352,32 @@ export class QuicConnection {
     return n
   }
 
+  /**
+   * What the next datagram's Application Data packet needs before it is
+   * built, outside the arena block because a key update stores the keys it
+   * derives. A datagram carries at most one such packet, so this runs once
+   * a packet. From three quarters of the confidentiality limit, each tries a
+   * key update, which goes when `updateKeys` allows (RFC 9001 §6.6). And
+   * the packet number due to be skipped is (RFC 9000 §21.4): remembered,
+   * never sealed nor recorded, and the next skip drawn.
+   */
+  beforeDatagram(): void {
+    const limit: i64 = this.confidentialityLimit
+    if (this.sealedUnderKey >= limit - limit / 4) {
+      this.updateKeys()
+    }
+    const pn: i64 = this.application.nextPn
+    if (pn !== this.nextSkip) {
+      return
+    }
+    if (this.skipHead >= 0 && this.skipHead < toI32(this.skipped.length)) {
+      this.skipped[this.skipHead] = pn
+    }
+    this.skipHead = (this.skipHead + 1) % QUIC_CONN_SKIP_RING
+    this.application.nextPn = pn + 1
+    this.scheduleSkip(pn + 1)
+  }
+
   /**
    * `takeDatagramInto`'s datagram, built and sealed into `out` at `at`: one
    * packet per space with something to carry, each written in place, the
@@ -3348,6 +3678,13 @@ export class QuicConnection {
    * `quicKeys` did not make cause.
    */
   sealAt(space: QuicConnSpace, out: u8[], start: i32, payloadEnd: i32): i32 {
+    // RFC 9001 §6.6: at the confidentiality limit, with no key update made
+    // (`beforeDatagram`), the connection closes, and no packet, its
+    // CONNECTION_CLOSE included, is sealed under the key again.
+    if (space.level === TLS_LEVEL_APPLICATION && this.sealedUnderKey >= this.confidentialityLimit) {
+      this.fail(QUIC_ERROR_AEAD_LIMIT_REACHED, QUIC_CONN_NONE)
+      return 0
+    }
     const keys: QuicKeys | null = space.writeKeys
     const pn: i64 = space.nextPn
     const pnLength: i32 = quicPacketNumberLength(pn, space.largestAcked)
@@ -3387,7 +3724,13 @@ export class QuicConnection {
       return 0
     }
     space.nextPn = pn + 1
-    this.recordSent(space, pn, end - start)
+    if (space.level === TLS_LEVEL_APPLICATION) {
+      this.sealedUnderKey = this.sealedUnderKey + 1
+    }
+    const slot: i32 = this.recordSent(space, pn, end - start)
+    if (this.datagramEcn !== 0) {
+      this.recovery.onEctSent(space.level, slot)
+    }
     return end - start
   }
 
@@ -3398,10 +3741,11 @@ export class QuicConnection {
    * recorded. `buildDatagram` builds nothing ack-eliciting into a space
    * whose record is full, so recovery does not refuse one; if it ever did,
    * what the packet carried is queued again at once, as though lost.
+   * Answers the slot recovery recorded it in, or -1.
    */
-  recordSent(space: QuicConnSpace, pn: i64, size: i32): void {
+  recordSent(space: QuicConnSpace, pn: i64, size: i32): i32 {
     if (!space.stagedEliciting) {
-      return
+      return -1
     }
     const slot: i32 = this.recovery.onPacketSent(space.level, pn, size, this.now)
     if (slot >= 0) {
@@ -3419,6 +3763,7 @@ export class QuicConnection {
       this.requeue(space, space.staging)
     }
     space.clearStaged()
+    return slot
   }
 
   /** An acknowledged packet in row `row`: each stream chunk and stream control frame it carried is settled. */
@@ -3464,6 +3809,7 @@ export class QuicConnection {
       return 0
     }
     this.closeSent = true
+    this.startClosingPeriod()
     let position: i32 = at
     const limit: i32 = at + QUIC_CONN_DATAGRAM_SIZE
     for (let level: i32 = 0; level < 3; level += 1) {
@@ -3514,10 +3860,13 @@ export class QuicConnection {
    * secrets and expected client Finished, the ephemeral key, the
    * connection-ID seed and the stateless reset tokens (QUIC-2). Call it when
    * the connection is done with (or `reset` the slot, which does the same
-   * first); the connection is closed after it and sends nothing more.
+   * first); the connection is closed after it and sends nothing more. Every
+   * stream buffer it borrowed goes back to its pool, zeroed: nothing is sent
+   * again from a closed connection.
    */
   release(): void {
     this.wipeAll()
+    this.streams.giveBack()
     if (!this.closed()) {
       this.state = QUIC_STATE_CLOSING
       this.error = QUIC_ERROR_NO_ERROR
@@ -3527,9 +3876,10 @@ export class QuicConnection {
 
   /**
    * Wipes every key and secret the connection holds and discards every
-   * level: `release()`'s work, the idle timeout's and `reset`'s. That takes
-   * in both sides' stateless reset tokens and `TlsServer`'s expected client
-   * Finished.
+   * level: `release()`'s work, the idle timeout's, the end of the closing or
+   * draining period's and `reset`'s. That takes in both sides' stateless
+   * reset tokens and `TlsServer`'s expected client Finished and resumption
+   * secret.
    */
   wipeAll(): void {
     this.discard(this.initial)
@@ -3539,19 +3889,11 @@ export class QuicConnection {
     this.otherReadKeys = null
     this.otherIsNext = false
     this.keyRetainUntil = -1
-    secureZero(this.appReadSecret)
-    secureZero(this.appWriteSecret)
-    secureZero(this.nextReadSecret)
-    for (const secret of this.writeSecrets) {
-      secureZero(secret)
-    }
-    for (const secret of this.readSecrets) {
-      secureZero(secret)
-    }
+    this.closingUntil = -1
+    this.wipe()
     secureZero(this.initialClient)
     secureZero(this.initialServer)
     secureZero(this.cidSeed)
-    secureZero(this.ephemeralPrivate)
     // The stateless reset tokens of both sides' IDs: either one ends the
     // connection for whoever learns it (RFC 9000 §10.3).
     for (const entry of this.cids.local) {
@@ -3566,13 +3908,23 @@ export class QuicConnection {
     if (tls !== null) {
       // The server's encoded transport parameters carry its first ID's token.
       secureZero(tls.config.quicTransportParameters)
-      secureZero(tls.expectedClientFinished)
-      secureZero(tls.handshakeSecret)
-      secureZero(tls.clientHandshakeSecret)
-      secureZero(tls.serverHandshakeSecret)
-      secureZero(tls.clientApplicationSecret)
-      secureZero(tls.serverApplicationSecret)
-      secureZero(tls.exporterSecret)
+      tls.wipe()
     }
   }
+
+  /**
+   * Wipes the connection's `Secret` fields: the ephemeral key and both
+   * widths' 1-RTT read, next read and write secrets. `wipeAll` calls it,
+   * and so `release()`, `reset`, the idle timeout and the end of the
+   * closing or draining period.
+   */
+  wipe(): void {
+    wipe(this.ephemeral)
+    wipe(this.readSecret256)
+    wipe(this.nextReadSecret256)
+    wipe(this.writeSecret256)
+    wipe(this.readSecret384)
+    wipe(this.nextReadSecret384)
+    wipe(this.writeSecret384)
+  }
 }