#moonquic

// A protected Initial packet, from the connection ID up (RFC 9001 §5.2–§5.4).
let dcid : Bytes = b"\x83\x94\xc8\xf0\x3e\x51\x57\x08"
let (client, server) = @crypto.initial(dcid[:])
let wire = @conn.seal_long(
  @packet.Kind::Initial, 1U, dcid, b"\xaa\xbb\xcc\xdd", 1L, 4,
  @packet.payload([@frame.Ping]), server,
)

// And back, with the packet number recovered against what this space has seen.
let opened = @conn.recv_long(wire, client, largest=-1L) catch {
  _ => abort("the packet did not open")
}
guard opened is Some((frames, n)) else { abort("the packet did not open") }
assert_eq(n, 1L)
assert_eq(frames, [@frame.Ping])

moon run src/examples/02-frames     moon run src/examples/05-ack        moon run src/examples/08-streams
moon run src/examples/03-params     moon run src/examples/06-flow       moon run src/examples/09-sender
moon run src/examples/04-crypto     moon run src/examples/07-recovery

#Packages

#Serving

let server : @conn.Endpoint[Addr] = @conn.Endpoint::server(
  @conn.Config::default(),
  @tls.Server::new(chain, key, alpn=["h3"]),
  rand=entropy,
)
server.recv(datagram, from, now)
for conn in server.take_busy() {
  for event in conn.take_events() {
    match event {
      Readable(id) => {
        let bytes = conn.read(id)
        conn.write(id, reply(bytes), fin=conn.finished(id))
      }
      _ => ()
    }
  }
}
while server.poll_out(now) is Some((datagram, to)) {
  send(datagram, to)
}

#Connecting

let client = @conn.Client::new(
  @tls.Client::new(roots, alpn=["h3"]),
  "a.example",
  @conn.encode(params),
  rand=entropy,
  dcid=Bytes::make(8, 1),
  scid=Bytes::make(8, 2),
  now,
)
for datagram in client.poll_out(now) { send(datagram, to) }
for datagram in receive() {
  client.recv(datagram, now)
  for answer in client.poll_out(now) { send(answer, to) }
}

client.tick(now)
for datagram in client.poll_out(now) { send(datagram, to) }

#Resuming a connection

client.write(0UL, request, fin=true)
for datagram in client.poll_out(now) { send(datagram, to) }

let kept = client.remembered().unwrap()   // a ticket and the parameters it was issued under
let next = @conn.Client::new(
  @tls.Client::new(roots, alpn=["h3"], sessions=store, early=true),
  "a.example",
  @conn.encode(params),
  rand=entropy,
  dcid=Bytes::make(8, 3),
  scid=Bytes::make(8, 4),
  now,
  resumption=kept,
)

let cfg = @conn.Config::default()
assert_eq(cfg.zero_rtt_data, 0UL)
assert_eq(cfg.zero_rtt_stream_data, 0UL)
// A caller that knows better than the last connection says so; §7.4.1 makes the
// remembered value the ceiling, so a larger override earns a flow-control error.
let small = { ..cfg, zero_rtt_data: 4096UL, zero_rtt_stream_data: 4096UL }
assert_eq(small.zero_rtt_data, 4096UL)

#Several connections on one socket

let endpoint = @conn.ClientEndpoint::new(@conn.Config::default(), rand=entropy)
let id = endpoint.connect(
  @tls.Client::new(roots, alpn=["h3"]),
  "a.example",
  params,
  now,
)
endpoint.recv(datagram, now)
for answer in endpoint.poll_out(now) { send(answer, to) }
endpoint.tick(now)
let client = endpoint.client(id).unwrap()

#Paths

let paths = @conn.Paths::new(local_max=2UL)   // what this end will maintain
paths.on_max_path_id(1UL)                     // what the peer said it would
assert_true(paths.openable(1UL))
assert_false(paths.openable(2UL))             // the peer offered one path, not two
let spare : Bytes = b"\xaa\xbb\xcc\xdd"
paths.bind(1UL, spare)                        // the peer's id for the path
ignore(paths.bind_local(1UL, b"\x01\x02"))    // this end's
assert_eq(paths.path_of(b"\x01\x02"), 1UL)
assert_false(paths.validated(1UL))
ignore(paths.start(1UL, b"\x10\x20\x30\x40\x50\x60\x70\x80"))
assert_true(paths.prove(1UL, b"\x10\x20\x30\x40\x50\x60\x70\x80"))
assert_true(paths.validated(1UL))

let (_, keys) = @crypto.initial(b"\x83\x94\xc8\xf0\x3e\x51\x57\x08")
assert_eq(keys.nonce_at(0UL, 54321L), keys.nonce(54321L))
assert_true(keys.nonce_at(1UL, 54321L) != keys.nonce(54321L))

let status = @frame.PathStatus(path_id=1UL, seq=1UL, available=true)
let wire = @frame.encode(status)
let (back, used) = @frame.decode(wire[:]) catch {
  _ => abort("the frame did not decode")
}
assert_eq(used, wire.length())
assert_eq(back, status)
// PATH_ACK names the path whose packet numbers it settles.
let ack = @frame.PathAck(path_id=1, largest=9UL, delay=0UL, first_range=1UL, ranges=[])
assert_eq(@frame.encode(ack).length(), 4)

let scid : Bytes = b"\x01\x02\x03\x04\x05\x06\x07\x08"
let params = @conn.Limits::new(idle_timeout=30_000_000UL, streams_bidi=8UL).params()
params.push({ kind: @conn.Kind::InitialScid, value: scid, })
let client = @conn.Client::new(
  @tls.Client::new(@x509.Roots::new(), alpn=["h3"]),
  "a.example",
  @conn.encode(params[:]),
  n => Bytes::make(n, b'\x00'),
  b"\x08\x07\x06\x05\x04\x03\x02\x01",
  scid,
  0L,
) catch {
  _ => abort("the client did not start")
}
// Once the handshake is done, the request goes on stream 4, on whichever path the caller chooses.
ignore(client.open_stream(4UL))
ignore(
  client.send_on(
    1UL,
    [@frame.Stream(id=4UL, offset=0UL, fin=true, data=b"GET /\r\n")],
    0L,
  ),
)

#Datagrams

let cfg = { ..@conn.Config::default(), max_datagram_frame_size: 1200UL }
assert_eq(cfg.max_datagram_frame_size, 1200UL)

#Versions

assert_eq(@packet.Kind::Initial.code(@packet.version1), 0)
assert_eq(@packet.Kind::Initial.code(@packet.version2), 1)
assert_eq(@packet.Kind::of(@packet.version2, 1), @packet.Kind::Initial)
// The constants that differ, by the number a long header carries.
assert_eq(@crypto.Version::of(@packet.version2).unwrap().salt[0].to_int(), 0x0d)
assert_eq(@crypto.Version::of(@packet.version2).unwrap().key, b"quicv2 key")

let only_v2 = { ..@conn.Config::default(), versions: [@packet.version2], }
assert_eq(only_v2.versions, [@packet.version2])
let both = { ..@conn.Config::default(), versions: [@packet.version1, @packet.version2], }
assert_eq(both.versions.length(), 2)

• A client that receives a Version Negotiation packet restarts in a version both ends speak, from a new first flight (RFC 9368 §2.1). Client::versions says what the packet offered. A packet that lists the version already tried is discarded, and one arriving after anything else has been processed is discarded too (RFC 9000 §6.2).
• A client that finds the peer answering in another version it offered adopts that version, keeps the first flight's Initial keys until the handshake is confirmed, and sends what follows under the negotiated version's labels (RFC 9368 §2.3). Early data goes: RFC 9368 §7.3 leaves a compatible negotiation free to reject 0-RTT, which is what this library does.
• A server that prefers another version converts the first flight itself (RFC 9368 §2.3). It re-derives both directions' Initial keys under the new version's salt, keeps the old receive keys for Initial packets still on the wire, and declares the negotiated version in its own parameters. A client sees the new version in the long headers and adopts it; there is no Version Negotiation packet, so the handshake costs nothing extra. Version 1 and version 2 first flights are convertible here because they differ only in version-dependent constants — frames, TLS messages and transport parameters are identical — and no other pair is assumed compatible (§2.2).
• The peer's version_information is held to the version the handshake settled on: a chosen version that is not the negotiated one, or — after a Version Negotiation packet — a list this client would have picked a different version out of, closes the connection with VERSION_NEGOTIATION_ERROR (0x11).

#Everything the protocol leaves open is a parameter

let dcid : Bytes = b"\x83\x94\xc8\xf0\x3e\x51\x57\x08"
let (initial, _) = @crypto.initial(dcid[:])            // AEAD_AES_128_GCM, RFC 9001 §5.2
let strong = @crypto.Keys::of(initial.key, suite=@crypto.aes256)
let others = @crypto.Keys::of(initial.key, suite=@crypto.chacha20)
assert_eq(strong.iv.length(), 12)
assert_eq(others.iv.length(), 12)

let reno = @recovery.State::new()
let cubic = @recovery.State::new(control=@recovery.Cubic::new())
let bbr = @recovery.State::new(control=@recovery.Bbr::new())
assert_true(reno.window() > 0L)
assert_true(cubic.window() > 0L)
assert_true(bbr.window() > 0L)

#What is not here

#Verification

#Conformance

#License