quic: complete the QUIC tests

Signed-off-by: James M Snell <[email protected]>
Assisted-by: Opencode:Opus 4.6

Author: jasnell

test/cctest/test_dataqueue.cc

@@ -495,25 +495,10 @@ TEST(DataQueue, NonIdempotentDataQueue) {
     CHECK(!waitingForPull);
     CHECK_EQ(status, node::bob::STATUS_CONTINUE);
 
-    // We can read the expected data from reader1. Because the entries are
-    // InMemoryEntry instances, reads will be fully synchronous here.
+    // The next read produces buffer2. When the first entry's reader returns
+    // EOS, the NonIdempotentDataQueueReader immediately pulls from the next
+    // entry (recursive Pull), so the transition is seamless.
     waitingForPull = true;
-
-    status = reader->Pull(
-        [&](int status, const DataQueue::Vec* vecs, size_t count, auto done) {
-          waitingForPull = false;
-          CHECK_EQ(status, node::bob::STATUS_CONTINUE);
-          CHECK_EQ(count, 0);
-        },
-        node::bob::OPTIONS_SYNC,
-        nullptr,
-        0,
-        node::bob::kMaxCountHint);
-
-    CHECK(!waitingForPull);
-    CHECK_EQ(status, node::bob::STATUS_CONTINUE);
-
-    // The next read produces buffer2, and should be the end.
     status = reader->Pull(
         [&](int status, const DataQueue::Vec* vecs, size_t count, auto done) {
           waitingForPull = false;
@@ -628,6 +613,9 @@ TEST(DataQueue, DataQueueEntry) {
   CHECK(!pullIsPending);
   CHECK_EQ(status, node::bob::STATUS_CONTINUE);
 
+  // Cap the queue so the reader can reach EOS after draining all entries.
+  data_queue2->cap();
+
   // Read to completion...
   while (status != node::bob::STATUS_EOS) {
     status = reader->Pull(

test/cctest/test_quic_tokens.cc

@@ -56,7 +56,7 @@ TEST(StatelessResetToken, Basic) {
 
   CHECK_EQ(token, token2);
 
-  // Let's pretend out secret is also a token just for the sake
+  // Let's pretend our secret is also a token just for the sake
   // of the test. That's ok because they're the same length.
   StatelessResetToken token3(secret);
 
@@ -85,6 +85,83 @@ TEST(StatelessResetToken, Basic) {
   CHECK_EQ(found->second, token);
 }
 
+TEST(StatelessResetToken, Ngtcp2StructIntegration) {
+  uint8_t secret[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6};
+  uint8_t cid_data[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 0};
+  ngtcp2_cid cid_;
+  ngtcp2_cid_init(&cid_, cid_data, 10);
+  TokenSecret fixed_secret(secret);
+  CID cid(cid_);
+
+  // Owning token — generated into the inherited ngtcp2_stateless_reset_token
+  StatelessResetToken owning(fixed_secret, cid);
+  CHECK(owning);
+
+  // The ngtcp2_stateless_reset_token* conversion operator should return
+  // a valid pointer to the token data.
+  const ngtcp2_stateless_reset_token* as_struct = owning;
+  CHECK_NE(as_struct, nullptr);
+  // The struct's data should match the uint8_t* conversion.
+  const uint8_t* as_bytes = owning;
+  CHECK_EQ(
+      memcmp(
+          as_struct->data, as_bytes, StatelessResetToken::kStatelessTokenLen),
+      0);
+
+  // Non-owning from const ngtcp2_stateless_reset_token* — wraps an
+  // existing struct without copying.
+  StatelessResetToken from_struct(as_struct);
+  CHECK(from_struct);
+  CHECK_EQ(from_struct, owning);
+  // The pointer should be the same (non-owning wraps, doesn't copy).
+  const ngtcp2_stateless_reset_token* from_struct_ptr = from_struct;
+  CHECK_EQ(from_struct_ptr, as_struct);
+
+  // Owning into external ngtcp2_stateless_reset_token — generates the
+  // token into a caller-provided struct.
+  ngtcp2_stateless_reset_token external_struct{};
+  StatelessResetToken into_struct(&external_struct, fixed_secret, cid);
+  CHECK(into_struct);
+  CHECK_EQ(into_struct, owning);
+  // The external struct should now contain the generated token.
+  CHECK_EQ(memcmp(external_struct.data,
+                  as_bytes,
+                  StatelessResetToken::kStatelessTokenLen),
+           0);
+  // The conversion operator should return a pointer to the external struct.
+  const ngtcp2_stateless_reset_token* into_struct_ptr = into_struct;
+  CHECK_EQ(into_struct_ptr, &external_struct);
+
+  // Copy of an owning token should itself be owning (independent copy).
+  StatelessResetToken copy_of_owning = owning;
+  CHECK_EQ(copy_of_owning, owning);
+  const ngtcp2_stateless_reset_token* copy_ptr = copy_of_owning;
+  // Should NOT point to the same memory as the original.
+  CHECK_NE(copy_ptr, as_struct);
+  // But data should match.
+  CHECK_EQ(
+      memcmp(copy_ptr->data, as_bytes, StatelessResetToken::kStatelessTokenLen),
+      0);
+
+  // Copy of a non-owning token should become owning (copies data).
+  StatelessResetToken copy_of_non_owning = from_struct;
+  CHECK_EQ(copy_of_non_owning, from_struct);
+  const ngtcp2_stateless_reset_token* copy_no_ptr = copy_of_non_owning;
+  // Should NOT point to the original non-owning source.
+  CHECK_NE(copy_no_ptr, from_struct_ptr);
+
+  // kInvalid conversions.
+  const ngtcp2_stateless_reset_token* invalid_ptr =
+      StatelessResetToken::kInvalid;
+  CHECK_EQ(invalid_ptr, nullptr);
+  const uint8_t* invalid_bytes = StatelessResetToken::kInvalid;
+  // When ptr_ is null, falls back to inherited data (zeroed).
+  uint8_t zeroed[StatelessResetToken::kStatelessTokenLen]{};
+  CHECK_EQ(
+      memcmp(invalid_bytes, zeroed, StatelessResetToken::kStatelessTokenLen),
+      0);
+}
+
 TEST(RetryToken, Basic) {
   auto& random = CID::Factory::random();
   TokenSecret secret;

test/cctest/test_sockaddr.cc

@@ -1,5 +1,5 @@
-#include "node_sockaddr-inl.h"
 #include "gtest/gtest.h"
+#include "node_sockaddr-inl.h"
 
 using node::SocketAddress;
 using node::SocketAddressBlockList;
@@ -43,6 +43,85 @@ TEST(SocketAddress, SocketAddress) {
   CHECK_EQ(map[addr], 2);
 }
 
+TEST(SocketAddress, IpHashAndIpEqual) {
+  sockaddr_storage s1, s2, s3, s4;
+  // Same IP, different ports.
+  SocketAddress::ToSockAddr(AF_INET, "10.0.0.1", 443, &s1);
+  SocketAddress::ToSockAddr(AF_INET, "10.0.0.1", 8080, &s2);
+  // Different IP.
+  SocketAddress::ToSockAddr(AF_INET, "10.0.0.2", 443, &s3);
+
+  SocketAddress addr1(reinterpret_cast<const sockaddr*>(&s1));
+  SocketAddress addr2(reinterpret_cast<const sockaddr*>(&s2));
+  SocketAddress addr3(reinterpret_cast<const sockaddr*>(&s3));
+
+  SocketAddress::IpHash ip_hash;
+  SocketAddress::IpEqual ip_equal;
+
+  // Same IP, different port: should hash equal and compare equal.
+  CHECK_EQ(ip_hash(addr1), ip_hash(addr2));
+  CHECK(ip_equal(addr1, addr2));
+
+  // Different IP: should not compare equal.
+  CHECK(!ip_equal(addr1, addr3));
+
+  // Full Hash (includes port) should differ for same IP, different port.
+  CHECK_NE(SocketAddress::Hash()(addr1), SocketAddress::Hash()(addr2));
+
+  // IpMap should treat same-IP-different-port as the same key.
+  SocketAddress::IpMap<uint16_t> map;
+  map[addr1] = 1;
+  map[addr2]++;  // Same IP as addr1, should increment the same entry.
+  CHECK_EQ(map[addr1], 2);
+  CHECK_EQ(map.size(), 1);
+
+  map[addr3] = 10;
+  CHECK_EQ(map.size(), 2);
+  CHECK_EQ(map[addr3], 10);
+}
+
+TEST(SocketAddress, IpHashIPv6) {
+  sockaddr_storage s1, s2, s3;
+  SocketAddress::ToSockAddr(AF_INET6, "::1", 443, &s1);
+  SocketAddress::ToSockAddr(AF_INET6, "::1", 8080, &s2);
+  SocketAddress::ToSockAddr(AF_INET6, "::2", 443, &s3);
+
+  SocketAddress addr1(reinterpret_cast<const sockaddr*>(&s1));
+  SocketAddress addr2(reinterpret_cast<const sockaddr*>(&s2));
+  SocketAddress addr3(reinterpret_cast<const sockaddr*>(&s3));
+
+  SocketAddress::IpHash ip_hash;
+  SocketAddress::IpEqual ip_equal;
+
+  // Same IPv6, different port: equal.
+  CHECK_EQ(ip_hash(addr1), ip_hash(addr2));
+  CHECK(ip_equal(addr1, addr2));
+
+  // Different IPv6: not equal.
+  CHECK(!ip_equal(addr1, addr3));
+
+  // IpMap with IPv6 keys.
+  SocketAddress::IpMap<uint16_t> map;
+  map[addr1] = 5;
+  map[addr2]++;
+  CHECK_EQ(map[addr1], 6);
+  CHECK_EQ(map.size(), 1);
+}
+
+TEST(SocketAddress, IpEqualCrossFamily) {
+  sockaddr_storage s1, s2;
+  SocketAddress::ToSockAddr(AF_INET, "127.0.0.1", 443, &s1);
+  SocketAddress::ToSockAddr(AF_INET6, "::1", 443, &s2);
+
+  SocketAddress addr1(reinterpret_cast<const sockaddr*>(&s1));
+  SocketAddress addr2(reinterpret_cast<const sockaddr*>(&s2));
+
+  SocketAddress::IpEqual ip_equal;
+
+  // Different address families should never be equal.
+  CHECK(!ip_equal(addr1, addr2));
+}
+
 TEST(SocketAddress, SocketAddressIPv6) {
   sockaddr_storage storage;
   SocketAddress::ToSockAddr(AF_INET6, "::1", 443, &storage);
@@ -85,7 +164,6 @@ TEST(SocketAddressLRU, SocketAddressLRU) {
   SocketAddress::ToSockAddr(AF_INET, "123.123.123.125", 443, &storage[2]);
   SocketAddress::ToSockAddr(AF_INET, "123.123.123.123", 443, &storage[3]);
 
-
   SocketAddress addr1(reinterpret_cast<const sockaddr*>(&storage[0]));
   SocketAddress addr2(reinterpret_cast<const sockaddr*>(&storage[1]));
   SocketAddress addr3(reinterpret_cast<const sockaddr*>(&storage[2]));
@@ -197,12 +275,10 @@ TEST(SocketAddressBlockList, Simple) {
   sockaddr_storage storage[2];
   SocketAddress::ToSockAddr(AF_INET, "10.0.0.1", 0, &storage[0]);
   SocketAddress::ToSockAddr(AF_INET, "10.0.0.2", 0, &storage[1]);
-  std::shared_ptr<SocketAddress> addr1 =
-      std::make_shared<SocketAddress>(
-          reinterpret_cast<const sockaddr*>(&storage[0]));
-  std::shared_ptr<SocketAddress> addr2 =
-      std::make_shared<SocketAddress>(
-          reinterpret_cast<const sockaddr*>(&storage[1]));
+  std::shared_ptr<SocketAddress> addr1 = std::make_shared<SocketAddress>(
+      reinterpret_cast<const sockaddr*>(&storage[0]));
+  std::shared_ptr<SocketAddress> addr2 = std::make_shared<SocketAddress>(
+      reinterpret_cast<const sockaddr*>(&storage[1]));
 
   bl.AddSocketAddress(addr1);
   bl.AddSocketAddress(addr2);

test/common/quic.mjs

@@ -0,0 +1,57 @@
+// Shared helpers for QUIC tests.
+//
+// Usage:
+//   import { key, cert, listen, connect } from '../common/quic.mjs';
+//
+// Provides pre-loaded TLS credentials and thin wrappers around node:quic
+// listen/connect that apply default options suitable for most tests.
+
+import * as fixtures from '../common/fixtures.mjs';
+
+const { createPrivateKey } = await import('node:crypto');
+const quic = await import('node:quic');
+
+// Pre-loaded TLS credentials from the standard agent1 fixture pair.
+const key = createPrivateKey(fixtures.readKey('agent1-key.pem'));
+const cert = fixtures.readKey('agent1-cert.pem');
+
+/**
+ * Start a QUIC server with sensible test defaults.
+ * @param {Function} callback  The session callback (receives QuicSession).
+ * @param {object} [options]   Options forwarded to quic.listen(). The
+ *   following defaults are applied when not specified:
+ *     - sni: { '*': { keys: [key], certs: [cert] } }
+ *     - alpn: ['quic-test']
+ * @returns {Promise<QuicEndpoint>}
+ */
+async function listen(callback, options = {}) {
+  const {
+    sni = { '*': { keys: [key], certs: [cert] } },
+    alpn = ['quic-test'],
+    ...rest
+  } = options;
+  return quic.listen(callback, { sni, alpn, ...rest });
+}
+
+/**
+ * Connect a QUIC client with sensible test defaults.
+ * @param {SocketAddress|string} address  The server address.
+ * @param {object} [options]  Options forwarded to quic.connect(). The
+ *   following defaults are applied when not specified:
+ *     - alpn: 'quic-test'
+ * @returns {Promise<QuicSession>}
+ */
+async function connect(address, options = {}) {
+  const {
+    alpn = 'quic-test',
+    ...rest
+  } = options;
+  return quic.connect(address, { alpn, ...rest });
+}
+
+export {
+  key,
+  cert,
+  listen,
+  connect,
+};

test/fixtures/keys/ca2-crl-agent3.pem

@@ -0,0 +1,13 @@
+-----BEGIN X509 CRL-----
+MIIB/jCB5wIBATANBgkqhkiG9w0BAQ0FADB6MQswCQYDVQQGEwJVUzELMAkGA1UE
+CAwCQ0ExCzAJBgNVBAcMAlNGMQ8wDQYDVQQKDAZKb3llbnQxEDAOBgNVBAsMB05v
+ZGUuanMxDDAKBgNVBAMMA2NhMjEgMB4GCSqGSIb3DQEJARYRcnlAdGlueWNsb3Vk
+cy5vcmcXDTI2MDQxNjA0MDM1MloYDzIwNTMwOTAxMDQwMzUyWjAnMCUCFHtnB1Iw
+05rTKjL+Xc+x+pXi6jGdFw0yNjA0MTYwNDAzNTJaoA4wDDAKBgNVHRQEAwIBATAN
+BgkqhkiG9w0BAQ0FAAOCAQEAS7PnQxPHv+VXvmCOcTQOYWns16+G5cmaY8/fYjwM
+6zOQPTItJTH+S2EJ3JvqES3Xm3KH+2Qh/8gAiiGNL9zdBpuNcJyUlJpIPuvWPd0P
+Bup7u2YEvc9NjuP8thslf267A8tieFf4mF+AO1lvFp+CGoyRSwtNGOWCMkFDGgGn
+ZOVXw5Q782PhUwThozGjR40zDkNjW/uFPJjMkz/RZFEmWshGf9t3VzahRs8PUApr
+XTdatufBUPrWiTWyQAuME50ajzq/tfuj2kokqfOvy1mkoNwtySVxKSlwGjejd5Xj
+yV/v4a5FDjXw4AwqEe+Cul9J2eyBb1jHkc+R9rutHTKEZA==
+-----END X509 CRL-----

test/parallel/test-quic-address-validation.mjs

@@ -0,0 +1,48 @@
+// Flags: --experimental-quic --no-warnings
+
+// Test: validateAddress triggers Retry flow.
+// When the server endpoint has validateAddress: true, it should send
+// a Retry packet before accepting the connection. The handshake still
+// completes successfully.
+
+import { hasQuic, skip, mustCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+const { strictEqual } = assert;
+const { readKey } = fixtures;
+
+if (!hasQuic) {
+  skip('QUIC is not enabled');
+}
+
+const { listen, connect, QuicEndpoint } = await import('node:quic');
+const { createPrivateKey } = await import('node:crypto');
+
+const key = createPrivateKey(readKey('agent1-key.pem'));
+const cert = readKey('agent1-cert.pem');
+
+const endpoint = new QuicEndpoint({ validateAddress: true });
+
+const serverEndpoint = await listen(mustCall(async (serverSession) => {
+  const info = await serverSession.opened;
+  // The handshake should complete despite the Retry flow.
+  strictEqual(info.protocol, 'quic-test');
+  serverSession.close();
+}), {
+  endpoint,
+  sni: { '*': { keys: [key], certs: [cert] } },
+  alpn: ['quic-test'],
+});
+
+const clientSession = await connect(serverEndpoint.address, {
+  alpn: 'quic-test',
+  servername: 'localhost',
+});
+
+const info = await clientSession.opened;
+strictEqual(info.protocol, 'quic-test');
+
+// The serverEndpoint must be closed after we wait for the clientSession to close.
+await clientSession.closed;
+await serverEndpoint.close();