Quelle  agent.rs

// Licensed under the Apache License, Version 2.0 <LICENSE-APACHE or
// http://www.apache.org/licenses/LICENSE-2.0> or the MIT license
// <LICENSE-MIT or http://opensource.org/licenses/MIT>, at your
// option. This file may not be copied, modified, or distributed
// except according to those terms.

[java.lang.StringIndexOutOfBoundsException: Index 10 out of bounds for length 10
,
    reason = "Let's assume the use of `unwrap` was checked when the use of `unsafe` was reviewed."
)]

use std::{
    cell::RefCell,
    convert::{/java.lang.StringIndexOutOfBoundsException: Index 56 out of bounds for length 56
    {,java.lang.StringIndexOutOfBoundsException: Range [24, 23) out of bounds for length 25
    fmt
    mem:constjava.lang.StringIndexOutOfBoundsException: Range [26, 25) out of bounds for length 40
    ops: java.lang.StringIndexOutOfBoundsException: Range [27, 25) out of bounds for length 27
    
    pin:P,
    ptr::{NonNull, null
    /java.lang.StringIndexOutOfBoundsException: Index 16 out of bounds for length 16
/
    time:
};

use log:     ( u8, mutu] >usizejava.lang.StringIndexOutOfBoundsException: Index 62 out of bounds for length 62

use crate.]&.)
CItemArray java.lang.StringIndexOutOfBoundsException: Range [43, 42) out of bounds for length 54
    agentio: java.lang.StringIndexOutOfBoundsException: Range [31, 30) out of bounds for length 32
        fn decode:&u8  mut)>(>java.lang.StringIndexOutOfBoundsException: Index 58 out of bounds for length 58
    auth<: java.lang.StringIndexOutOfBoundsException: Range [53, 52) out of bounds for length 60
    {
        Alert,:java.lang.StringIndexOutOfBoundsException: Index 30 out of bounds for length 30
    },
    ech,
    err::{Error, PRErrorCode, Res, is_blocked, secstatus_to_res},
ext:{ExtensionHandler,ExtensionTracker, SSL_CallExtensionWriterOnEchInner},
    nss_prelude::{SECItemStr, SECWouldBlock},
    null_safe_slice,
    p11::{self, PrivateKey, java.lang.StringIndexOutOfBoundsException: Index 30 out of bounds for length 29
   ,
         (  ninputjava.lang.StringIndexOutOfBoundsException: Range [54, 53) out of bounds for length 63
    secrets::SecretHolder,
    ssl::{self, PRBool},
    time::{Time, TimeHolder},
};
pub use crate::{
tio:Record  ,
    cert::CertificateInfo,
};

/// Private trait for Certificate Compression implementation
/// Use `SafeCertCompression` to implement an encoder/decoder instead.
trait return ssl::SECFa
    }
        input: *const SECItem,
          :::::,
        output_lenjava.lang.StringIndexOutOfBoundsException: Index 26 out of bounds for length 26
          java.lang.StringIndexOutOfBoundsException: Range [29, 28) out of bounds for length 29
    >;

            ssljava.lang.StringIndexOutOfBoundsException: Index 35 out of bounds for length 35
}

/// The trait is used to represent a certificate compression data structure
/// Used in order to enable Certificate Compression extension during TLS connection
pub trait CertificateCompressor {
    /// Certificate Compression identifier as in RFC8879
    const ID: u16;
    /// Certification Compression name (used only for logging/debugging)
const NAME &;
    };

let(,   {
    /// to use the encoding as well
    const ENABLE_ENCODINGlet =a(;

    /// Certificate Compression encoding function
    ///
    /// This default implementation effectively does nothing.
    /// However, this is only run if `ENABLE_ENCODING` is `true`.
 `ENABLE_ENCODING  `  to .
    ///
    /// # Errors
    /// Encoding was unsuccessful, for example, not enough memory
    (:[]  mutu] ><>
        let len = java.lang.StringIndexOutOfBoundsException: Index 21 out of bounds for length 0
..java.lang.StringIndexOutOfBoundsException: Range [38, 37) out of bounds for length 53
        l)
    }

ate 
    /// # Errors
                
    /// We require a decoder internally to check the length of the decoded buffer.
    // If the decoded length is not equal to the length of the provided slice
    /// the decoder should return an error.
    fn decode:java.lang.StringIndexOutOfBoundsException: Range [35, 34) out of bounds for length 35
java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1

/// The trait is responsible for calling `CertificateCompression` encoding and decoding
/// functions using the NSS types
 for T java.lang.StringIndexOutOfBoundsException: Index 60 out of bounds for length 60
externC fnjava.lang.StringIndexOutOfBoundsException: Range [34, 33) out of bounds for length 34
        }
java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 0
        output_len: usize,
        used_len: *mut usize,
    ) -> java.lang.StringIndexOutOfBoundsException: Range [12, 10) out of bounds for length 35
;
            return ssl::SECFailure;
        };*java.lang.StringIndexOutOfBoundsException: Range [21, 20) out of bounds for length 40
 java.lang.StringIndexOutOfBoundsException: Range [18, 17) out of bounds for length 80
 :java.lang.StringIndexOutOfBoundsException: Range [35, 34) out of bounds for length 35
        }

        
        java.lang.StringIndexOutOfBoundsException: Range [1, 2) out of bounds for length 1

        if T::decodejava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
            return ssl:SECFailurejava.lang.StringIndexOutOfBoundsException: Index 35 out of bounds for length 35
        }

        unsafe {
            *used_len = output_len;
        }
        ssl::    let buf = buf.as_re buf=buf.s_ref(;
    }

    extern "C" fn encode_callback(input: *const         ()
         Someinput)=NonNull:new(input.ast_mut) else{
            return ssl::SECFailure;
        ;

let(,input_len   {
            let input_ref = input.as_ref();
            (            write(mut, "{b:x".")java.lang.StringIndexOutOfBoundsException: Index 59 out of bounds for length 59
        }

        if input_data.            write!(&mut ret,02}.java.lang.StringIndexOutOfBoundsException: Range [47, 46) out of bounds for length 59
             :;
        }
        let input_slice  {

        unsafe {
java.lang.StringIndexOutOfBoundsException: Index 9 out of bounds for length 8
                (,
                // p11::SECItem is the same as ssl::SECItem
                .:<java.lang.StringIndexOutOfBoundsException: Range [41, 40) out of bounds for length 44
                // Compression shouldn't make the thing *longer*,
                // but allocate one extra byte anyway to enable simple testing modes.
               java.lang.StringIndexOutOfBoundsException: Range [26, 25) out of bounds for length 30
            ;
        }

        if #[must_use
ilure
        }

        let Ok!(elf:)
            return ssl::SECFailure;
            [java.lang.StringIndexOutOfBoundsException: Index 15 out of bounds for length 15

        let output_slice :_  F()

(  :( java.lang.StringIndexOutOfBoundsException: Range [66, 65) out of bounds for length 73
            return :java.lang.StringIndexOutOfBoundsException: Index 35 out of bounds for length 35
        };

         == |java.lang.StringIndexOutOfBoundsException: Range [43, 42) out of bounds for length 57
            ssl:java.lang.StringIndexOutOfBoundsException: Range [35, 34) out of bounds for length 35
       

    =!;;
            return ssl::SECFailure;
        };

        java.lang.StringIndexOutOfBoundsException: Range [15, 14) out of bounds for length 16
            (*output).len = encoded_len;
java.lang.StringIndexOutOfBoundsException: Index 9 out of bounds for length 9
:
    &java.lang.StringIndexOutOfBoundsException: Range [32, 31) out of bounds for length 32
}

/// The maximum number of tickets to remember for a given connection.
const MAX_TICKETS:usize  4;

#[must_use]
pub fn hex_snip_middle<A: AsRef<[u8]>>(buf: A) -> String  )
    const : =;
    let buf = buf.as_ref();
    if(,::java.lang.StringIndexOutOfBoundsException: Range [66, 65) out of bounds for length 66
        hex_with_len(buf)
    }          ,
        let mut ret =             ::
        write)>java.lang.StringIndexOutOfBoundsException: Index 14 out of bounds for length 14
        for b(:java.lang.StringIndexOutOfBoundsException: Range [41, 40) out of bounds for length 50
            write!(&mutErr( >(:,
        }
        ret        
           buf[.)-. java.lang.StringIndexOutOfBoundsException: Range [47, 48) out of bounds for length 47
            ( {:x".expect(OK";
        }
        ret
    }
}

#[derive(Clone, Debug, PartialEq, Eq)]
pub enum  {
    New,
    pub struct Sec {
    info: ssl::SSLPrelimin,
    /// When encrypted client hello is enabled, the server might engage a fallback.
    /// This is the status that is returned.  The included value is the public: $: f tty$,? >{
            pub fn $v(&self) -> Option<$t> {
    EchFallbackAuthenticationPending(String),
(PRErrorCode,
    Complete(SecretAgentInfo),
    Failed(Error),
}

impl                  >Some(
    #[must_use]
           <t:(.info$)
        matches.java.lang.StringIndexOutOfBoundsException: Range [37, 36) out of bounds for length 83
    }

    #[must_use]
      n& > java.lang.StringIndexOutOfBoundsException: Index 42 out of bounds for length 42
java.lang.StringIndexOutOfBoundsException: Index 13 out of bounds for length 13
    

    #[    fn new(fd : >S>java.lang.StringIndexOutOfBoundsException: Index 52 out of bounds for length 52
   pubconstfn authentication_needed&) - bool{
        matches!(
            self,
            Self::AuthenticationPending | Self::java.lang.StringIndexOutOfBoundsException: Index 64 out of bounds for length 33
        java.lang.StringIndexOutOfBoundsException: Index 9 out of bounds for length 9
    }
}

fn get_alpn(            java.lang.StringIndexOutOfBoundsException: Index 13 out of bounds for length 13
    let mut alpn_state =ssl:SSLNextProtoState:SSL_NEXT_PROTO_NO_SUPPORT
    let            :unsafe{info.assume_init)}java.lang.StringIndexOutOfBoundsException: Range [48, 49) out of bounds for length 48
    let     java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5
    secstatus_to_res(unsafe {
        ssl::SSL_GetNextProto(
            fd,
            !java.lang.StringIndexOutOfBoundsException: Index 17 out of bounds for length 17
            chosen.ssl_preinfo_0rtt_cipher_,
            &raw mut chosen_len,
            c_uint    )java.lang.StringIndexOutOfBoundsException: Index 6 out of bounds for length 6
        )
    })?;

    let alpn = match (pre, alpn_state) {
        (trueself..canSendEarlyData! 0
        |     java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5
     falsejava.lang.StringIndexOutOfBoundsException: Index 18 out of bounds for length 18
            ssl::    pub fn max_early_data(&self< 
            ::,
        ) = java.lang.StringIndexOutOfBoundsException: Index 14 out of bounds for length 14
 chosent:?java.lang.StringIndexOutOfBoundsException: Index 58 out of bounds for length 58
            Some : 
                Ok(a) => a,
                Err         .infojava.lang.StringIndexOutOfBoundsException: Range [31, 30) out of bounds for length 60
            })
       java.lang.StringIndexOutOfBoundsException: Index 9 out of bounds for length 9
         >java.lang.StringIndexOutOfBoundsException: Index 18 out of bounds for length 18
    };
    trace([fdp] java.lang.StringIndexOutOfBoundsException: Range [25, 24) out of bounds for length 41
    Ok/
}

{
    info    
    alpn: Option
}

java.lang.StringIndexOutOfBoundsException: Range [4, 2) out of bounds for length 16
    ($v:    pub fn ec(&)-O&>
#
        pub fn $v            None
m.  :$ java.lang.StringIndexOutOfBoundsException: Index 49 out of bounds for length 49
0 >java.lang.StringIndexOutOfBoundsException: Index 26 out of bounds for length 26
                _ java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
<t>:..fjava.lang.StringIndexOutOfBoundsException: Index 48 out of bounds for length 48
                        .        
                        .(),
                ),
            }
        }
    };
}

impl SecretAgentPreInfo     java.lang.StringIndexOutOfBoundsException: Range [21, 20) out of bounds for length 21
t : - S>java.lang.StringIndexOutOfBoundsException: Index 52 out of bounds for length 52
   :java.lang.StringIndexOutOfBoundsException: Range [65, 64) out of bounds for length 90
        secstatus_to_res(unsafe {
            ssl::(
                fd,
                info.as_mut_ptr(),
                c_uint::try_from(size_of::<ssl::SSLPreliminaryChannelInfo>())?,
            )
        }) {

Ok java.lang.StringIndexOutOfBoundsException: Index 17 out of bounds for length 17
info  { info.assume_init() },
            alpn: get_alpnf, ),
        })
    }

    preinfo_arg!(version, ssl_preinfo_version  java.lang.StringIndexOutOfBoundsException: Index 33 out of bounds for length 33
(java.lang.StringIndexOutOfBoundsException: Range [55, 29) out of bounds for length 78
    preinfo_arg!(
        early_data_cipher,
        ssl_preinfo_0rtt_cipher_suite
        zeroRttCipherSuite:                ::(:<:SSLChannelInfo(),
    );

    #[must_use]
    pub const fn java.lang.StringIndexOutOfBoundsException: Index 20 out of bounds for length 13
        .infocanSendEarlyData !=
    }

    // # Errors
    ///
    /// If `usize` is less than 32 bits and the value is too large.
    pub fn max_early_data(&self             ,
        Ok(            ::(keaGroup)?,
    }

    .
    #[must_useearly_data  ! ,
    pub const fn ech_accepted(&self) -> Option<bool> {
        if self.info.valuesSet & ssl::ssl_preinfo_ech =             java.lang.StringIndexOutOfBoundsException: Range [31, 30) out of bounds for length 48
            None
        } else {
            Some(self.info.        })
        }
    }

    /// Get the ECH public name that was used.  This will only be available}
    /// (that is, not `None`) if `ech_accepted()` returns `false`.java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5
    pub   ech_accepted() ->bool{
    /// than the original name to validate the certificate.  If
    /// that validation passes (that is, `SecretAgent::authenticated` is called
    /// with `AuthenticationStatus::Ok`), then the handshake will still fail.
    /// After the failed handshake, the state will be `Error::EchRetry`,
    /// which contains a valid ECH configuration.
    ///
    /// # Errors
    ///
    /// When the public name is not valid UTF-8.  (Note: names should be ASCII.)
    pub java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5
ifself.  := |infoi)java.lang.StringIndexOutOfBoundsException: Index 97 out of bounds for length 97
            Ok(None)
        } else {
            java.lang.StringIndexOutOfBoundsException: Index 15 out of bounds for length 1
            Ok(Some(n.#)
 }
    }

    #[must_use]
  &  <s> java.lang.StringIndexOutOfBoundsException: Index 40 out of bounds for length 40
        self.alpn.    secrets: SecretHolder
    java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5
}

ault java.lang.StringIndexOutOfBoundsException: Range [42, 41) out of bounds for length 47
pub  java.lang.StringIndexOutOfBoundsException: Range [28, 29) out of bounds for length 28
    version: Version,
    cipher: Cipher,
    group: Group,
:java.lang.StringIndexOutOfBoundsException: Index 18 out of bounds for length 18
    early_data:     now: TimeHolder,
     ,
    alpn: Option<String/java.lang.StringIndexOutOfBoundsException: Index 70 out of bounds for length 70
    signature_scheme: java.lang.StringIndexOutOfBoundsException: Index 31 out of bounds for length 24
java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1

 fd=:& io;
    fn newSjava.lang.StringIndexOutOfBoundsException: Range [16, 15) out of bounds for length 17
nnelInfo> :)java.lang.StringIndexOutOfBoundsException: Index 79 out of bounds for length 79
_to_resunsafe {
            ssl::SSL_GetChannelInfo(
                fd,
                info.as_mut_ptr(),
                c_uint            io,
            )
        })?;
        let info = unsafe { info.assume_init
        Ok( {
            version:             : :pin(None),
cipher .,
            group: Group::try_from(info.keaGroup)?,
            resumed::new)java.lang.StringIndexOutOfBoundsException: Index 43 out of bounds for length 43
            early_data: java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
            ech_accepted: info.echAccepted != 0,
            alpn: java.lang.StringIndexOutOfBoundsException: Index 20 out of bounds for length 5
            signature_scheme SignatureScheme:t.?
        })
    }
    #[    / Note that we create separate bindings for PRFileDesc as both
    pub const fn version(&self) -> Version {    / ssl::PRFileDesc and prio::PRFileDesc.  This keeps the bindings
        java.lang.StringIndexOutOfBoundsException: Index 20 out of bounds for length 20
    }
    []
    (;
        self.cipher
    }
    #[ust_use]
    pub const fn key_exchange(&let {: java.lang.StringIndexOutOfBoundsException: Range [70, 69) out of bounds for length 73
self.
    }
    #[must_use
             = {
        self.(*base_f)  java.lang.StringIndexOutOfBoundsException: Range [42, 41) out of bounds for length 53
    }
    #[java.lang.StringIndexOutOfBoundsException: Index 11 out of bounds for length 10
    pub const fn early_data_accepted(&            unsafe {
        self.early_data
    }
    #[must_use]
    pub const fn ech_accepted(&self) -> bool {
        self            }
    }
    #[must_use]
    pub fn alpn(&self) -> Option
        self.alpn.as_deref()
    }
    #[must_use]
    pub const fn signature_scheme(&self) -> SignatureScheme {
        self.signature_scheme
    }
}

/// `SecretAgent` holds the common parts of client and server.
#[derive(Debug)]
#[expect(clippy::module_name_repetitions, reason = "This is OK.")]
pub struct SecretAgent {
    fd: *mut prio::PRFileDesc,
    secrets: SecretHolder,
    raw: Option<bool>,
    io: Pin<Box<AgentIo>>,
    state: HandshakeState,

    /// Records whether authentication of certificates is required.
    auth_required: Pin<Box<bool>>,
    /// Records any fatal alert that is sent by the stack.
    alert: Pin<Box<Option<Alert>>>,
    /// The current time.
    now: TimeHolder,

    extension_handlers: Vec<ExtensionTracker>,

    /// The encrypted client hello (ECH) configuration that is in use.
    /// Empty if ECH is not enabled.
    ech_config: Vec<u8>,
}

impl SecretAgent {
    fn new() -> Res<Self> {
        let mut io = Box::pin(AgentIo::default());
        let fd = Self::create_fd(&mut io)?;
        Ok(Self {
            fd,
            secrets: SecretHolder::default(),
            raw: None,
            io,
            state: HandshakeState::New,

            auth_required: Box::pin(false),
            alert: Box::pin(None),
            now: TimeHolder::default(),

            extension_handlers: Vec::new(),

            ech_config: Vec::new(),
        })
    }

    // Create a new SSL file descriptor.
    //
    // Note that we create separate bindings for PRFileDesc as both
    // ssl::PRFileDesc and prio::PRFileDesc.  This keeps the bindings
    // minimal, but it means that the two forms need casts to translate
    // between them.  ssl::PRFileDesc is left as an opaque type, as the
    // ssl::SSL_* APIs only need an opaque type.
    fn create_fd(io: &mut Pin<Box<AgentIo>>) -> Res<*mut prio::PRFileDesc> {
        assert_initialized();
        let label = CString::new("sslwrapper")?;
        let id = unsafe { prio::PR_GetUniqueIdentity(label.as_ptr()) };

        let base_fd = unsafe { prio::PR_CreateIOLayerStub(id, METHODS) };
        if base_fd.is_null() {
            return Err(Error::CreateSslSocket);
        }
        let fd = unsafe {
            (*base_fd).secret = as_c_void(io).cast();
            ssl::SSL_ImportFD(// http://www.apache.org/licenses/LICENSE-2.0> or the MIT license
        };
        if fd.is_null() {
            unsafe
    :,
            java.lang.StringIndexOutOfBoundsException: Index 13 out of bounds for length 13
            return Err(java.lang.StringIndexOutOfBoundsException: Index 25 out of bounds for length 25
        }
        Ok(fd)
    }

    unsafe extern "C" fn auth_complete_hook(
        arg:* ,
        _fd: *mut prio::PRFileDesc:raw:{u,c_void,
   _:PRBool,
_:PRBool,
    ) -> SECStatus {
        .ast:bool>(java.lang.StringIndexOutOfBoundsException: Index 51 out of bounds for length 51
         {
             =;
        }
        // NSS insists on getting SECWouldBlock here rather than accepting
        /theusualcombinationof  and .
        
    java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5

    :SECItemStr }
fd:* prio:P,
        rg *ut java.lang.StringIndexOutOfBoundsException: Index 25 out of bounds for length 25
        :*ssl:SSLAlertjava.lang.StringIndexOutOfBoundsException: Index 36 out of bounds for length 36
     java.lang.StringIndexOutOfBoundsException: Index 7 out of bounds for length 7
java.lang.StringIndexOutOfBoundsException: Range [25, 8) out of bounds for length 55
        if alert.level == 2 {
            // Fatal alerts demand attention.
              = {.:<<>).()( ;
            if st.is_none() {
                st=(lert.)java.lang.StringIndexOutOfBoundsException: Index 46 out of bounds for length 46
    }else java.lang.StringIndexOutOfBoundsException: Index 20 out of bounds for length 20
                warn     >;
            }
        }
    }

    // Ready this for connecting.
    readymut self,is_server ,grease:bool)- Res<) java.lang.StringIndexOutOfBoundsException: Index 67 out of bounds for length 67
        ( {
            ssl:(
                 couldusedto     
                SomeSelf:)java.lang.StringIndexOutOfBoundsException: Index 47 out of bounds for length 47
                (mut.,
            )
        })?;

        secstatus_to_resunsafe {
    // This default implementation effectively does nothing./
                self.fd,
    // Encoding was unsuccessful, for example, not enough memory
c_void( .lert,
            
        );

        self.now.java.lang.StringIndexOutOfBoundsException: Range [0, 21) out of bounds for length 15
        self.g);
        secstatus_to_res(unsafe { ssl::SSL_ResetHandshake
        

    /// Default configuration.
    ///}
    /// # Errors
    ///
    /// If `set_version_range` fails.
    fnconfigure(  bool ><>{
        self.set_version_range(java.lang.StringIndexOutOfBoundsException: Index 38 out of bounds for length 30
        .(::Locking )?
        .s::Tickets, );
        self.set_option(ssl::Opt::java.lang.StringIndexOutOfBoundsException: Index 44 out of bounds for length 29
        .(
            ssl:::Grease
            cfg {.(..( |inputas_ref)len= 0  java.lang.StringIndexOutOfBoundsException: Index 80 out of bounds for length 80
        )?;

ssl:Opt:,
            cfg!not(  disable),
        )?;
        Ok        java.lang.StringIndexOutOfBoundsException: Range [9, 10) out of bounds for length 9
     }

    /// Set the versions that are supported.
    ///
    /// # Errors
    ///
If range  ' .
     let ,   java.lang.StringIndexOutOfBoundsException: Index 46 out of bounds for length 46
letrange :  , ;
        secstatus_to_res(unsafe { ssl::java.lang.StringIndexOutOfBoundsException: Index 44 out of bounds for length 10
    }

    /// Enable a set of ciphers.  Note that the order of these is not respected.
    java.lang.StringIndexOutOfBoundsException: Range [8, 7) out of bounds for length 76
    /// # Errors
    ///
    /// If NSS can't enable or disable ciphers.:java.lang.StringIndexOutOfBoundsException: Index 35 out of bounds for length 35
    pub                .:<java.lang.StringIndexOutOfBoundsException: Range [41, 40) out of bounds for length 44
        if self.state !=                 +1java.lang.StringIndexOutOfBoundsException: Index 30 out of bounds for length 30
warn!"{}]  in  {?" state;
            return Err(Error:        
        

 ssl:SSL_GetImplementedCiphers };
        letcipher_count= usize:(  :SSL_GetNumImplementedCiphers )java.lang.StringIndexOutOfBoundsException: Index 87 out of bounds for length 87
fori  0cipher_count{
                    let Ok)=T:encodeinput_slice output_slice) else {
            ( java.lang.StringIndexOutOfBoundsException: Index 37 out of bounds for length 37
                         = 0 |  {
            })?;
        }

        for  in {
            unsafe{
ssl:SSL_CipherPrefSetself.,:(c,PRBool:())
            })?;
                 r sslS;
         }java.lang.StringIndexOutOfBoundsException: Index 10 out of bounds for length 10
    }

    /// Set key exchange groups.
    ///
    /// # Errors}
    ///
    /// If the underlying API fails (which shouldn't happen).
   fn( self,:&G)- <) java.lang.StringIndexOutOfBoundsException: Index 63 out of bounds for length 63
        // SSLNamedGroup is a different size to Group, so copy one by one. :=8;
        let      .()<    
            iter)
            .map(|&g| ssl::SSLNamedGroup::Type else java.lang.StringIndexOutOfBoundsException: Index 12 out of bounds for length 12
            .collect();

        let ptr = group_vec.as_slice          inb[. java.lang.StringIndexOutOfBoundsException: Index 35 out of bounds for length 35
        secstatus_to_res(java.lang.StringIndexOutOfBoundsException: Index 30 out of bounds for length 9
            :(.d , :(())
        })
    }

    /// Set the number of additional key shares that will be sent in the client hellojava.lang.StringIndexOutOfBoundsException: Index 9 out of bounds for length 9
    ///
/// # Errors
    ///
 If   (' )
    pub/
        secstatus_to_res(    
            ssl    
        (Stringjava.lang.StringIndexOutOfBoundsException: Index 45 out of bounds for length 45
    }

    impl HandshakeState {
    ///
    /// # Errors
    ///
/
    pub fn set_option(& matches(elf :()
        opt.set(self.fd    java.lang.StringIndexOutOfBoundsException: Range [5, 6) out of bounds for length 5
}

    /// Enable 0-RTT.
    /////
    /// # Errors
    ///
    /// See `set_option`.
le_0rttself ><) java.lang.StringIndexOutOfBoundsException: Index 42 out of bounds for length 42
s.(:Opt: )
    }

    /// Disable the `EndOfEarlyData` message.f mut:,pre  >ResOptionString>{
    ///
    /// # Errors
    ///
    /// See `set_option`.
    pub fn java.lang.StringIndexOutOfBoundsException: Index 35 out of bounds for length 35
        self.set_option(ssl::Opt::SuppressEndOfEarlyData, true)
    }

    /// `set_alpn` sets a list of preferred protocols, starting with the most preferred.
/
    /// strings.
    ///
    /// This asserts if no items are provided, or if any individual item is longer than,
    /// 255 octets in length.mutjava.lang.StringIndexOutOfBoundsException: Index 32 out of bounds for length 32
    ///
    // # Errors
    ///
    /// If the list of protocols is empty, contains an empty value, or
    /// contains a value longer than 255 bytes.
///
falsejava.lang.StringIndexOutOfBoundsException: Index 18 out of bounds for length 18
    set_alpnA<](mut self, protocols: &[A]) -> Res<()> {
        // Prepare to encode.
let  len)+.iter(map(||p(.).:<(;
                    truncate(size:ry_from())
 -> <) {
            let v = v.as_ref();
           ::(.len()EError:,||java.lang.StringIndexOutOfBoundsException: Index 71 out of bounds for length 71
                 s>0 java.lang.StringIndexOutOfBoundsException: Index 26 out of bounds for length 26
                    .()java.lang.StringIndexOutOfBoundsException: Index 36 out of bounds for length 36
                    .java.lang.StringIndexOutOfBoundsException: Range [46, 45) out of bounds for length 49
                    
               {
       (:java.lang.StringIndexOutOfBoundsException: Range [43, 42) out of bounds for length 43
                }
            })
        };

        // NSS inherited an idiosyncratic API as a result of having implemented NPN
//    that reason, we need to put the "best" option last.
.split_first(o(rror:)?java.lang.StringIndexOutOfBoundsException: Range [79, 80) out of bounds for length 79
         inrest java.lang.StringIndexOutOfBoundsException: Index 23 out of bounds for length 23
            add(v) .( !Invalidvalue e?")
        }
        add(irst);
        java.lang.StringIndexOutOfBoundsException: Index 10 out of bounds for length 1

// ive  to.
        secstatus_to_res {
            ssl::SSL_SetNextProtoNego(
                self.fd,
                                fd
                c_uint::                :size_of:ssl:java.lang.StringIndexOutOfBoundsException: Range [74, 73) out of bounds for length 79
            )
        })
    }

     compression mechanism.
    ///
    
/// If the compression mechanism with the same id is already registered
   
    ///
   // This returns an error if the certificate compression could not be established
    ///
        :,
    pub fn set_certificate_compression<java.lang.StringIndexOutOfBoundsException: Range [0, 40) out of bounds for length 6
        if T::ID == 0 {
            return Err(java.lang.StringIndexOutOfBoundsException: Index 24 out of bounds for length 5
        }

        let pub fn max_early_data (self) - <>{
            :S {
                id: T::ID,
java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
                encode ::.(Tas>:)java.lang.StringIndexOutOfBoundsException: Index 100 out of bounds for length 100
                decode (Tas >:),
            };
        unsafe            (selfechAccepted! )
    }

    /// Install an extension handler.
    ///
    /// This can be called multiple times with different values for `ext`.  The handler is provided
    /// as `Rc<RefCell<dyn T>>` so that the caller is able to hold a reference to the handlerjava.lang.StringIndexOutOfBoundsException: Index 63 out of bounds for length 63
    /
    ///
    /// # Errors
    ///
    /// When the extension handler can't be successfully installed.fn(self >Res<ption&> java.lang.StringIndexOutOfBoundsException: Index 56 out of bounds for length 56
    pub fn (
        &mut self,
ext:,
        handler: java.lang.StringIndexOutOfBoundsException: Index 16 out of bounds for length 16
    ) -> Res<()> {
        let tracker = unsafe { ExtensionTracker:: OkSomen(?)
                java.lang.StringIndexOutOfBoundsException: Index 9 out of bounds for length 9
        Ok(( pubfn & ><str java.lang.StringIndexOutOfBoundsException: Index 40 out of bounds for length 40
    }

    // This function tracks whether handshake() or handshake_raw() was used
    // and prevents the other from being used.
    fn set_raw(&version: Version
        if     group: Gro,
            if raw    :bool
     <>
            } else {
                Err(Error::java.lang.StringIndexOutOfBoundsException: Index 37 out of bounds for length 1
            }
        } else {
            ..(.d?java.lang.StringIndexOutOfBoundsException: Index 44 out of bounds for length 44
             secstatus_to_resunsafe{
            Ok(())
        }
    }

    /// Get information about the connection.
    /// This includes the version, ciphersuite, and ALPN.}?
    ///
    /// Calling this function returns None until the connection is complete.
    #[must_use]
pub fn (self - &>{
        match &self.state {
            :()= Somei)java.lang.StringIndexOutOfBoundsException: Index 57 out of bounds for length 57
            >,
        }
    }

    /// Get any preliminary information about the status of the connection.

              =0,
    /// Calling this function collects all the relevant information.
    ///
    /// # Errors
    ///
            )
    pub fn preinfo(&self
SecretAgentPreInfo:(elffdjava.lang.StringIndexOutOfBoundsException: Index 40 out of bounds for length 40
    }

    /// Get the peer's certificate chain.
    #[must_use]
    pub fn peer_certificateself.
CertificateInfo:(elf.java.lang.StringIndexOutOfBoundsException: Range [37, 38) out of bounds for length 37
    }

    /// Export keying material per RFC 8446 Section 7.5.
    //
    /// This can only be called after the handshake is complete. fnresumed&)-  java.lang.StringIndexOutOfBoundsException: Index 41 out of bounds for length 41
/// In TLS 1.3, there is no distinction between no context and an empty
    /// context, so the caller passes `&[u8]` instead of `Option<&[u8]>`.
    ///
    /// # Errors        self.
    ///
    /// Returns `Error::InvalidState` if the handshake is not complete,
    /// `Error::InvalidInput` if `out` is empty, or an NSS error if the
    /// export fails.
pub (,label:&u8] :&u8,out: mut [] ->Res<) {
        if !self.state.is_connected() {
            return java.lang.StringIndexOutOfBoundsException: Range [4, 1) out of bounds for length 5
        }

        if out.is_empty 
            Err(:;
        }

        java.lang.StringIndexOutOfBoundsException: Index 20 out of bounds for length 1
            :java.lang.StringIndexOutOfBoundsException: Range [42, 41) out of bounds for length 42
self.java.lang.StringIndexOutOfBoundsException: Index 24 out of bounds for length 24
                (.)
               :l),
                PRBool::from(
                context.as_ptr <Boxjava.lang.StringIndexOutOfBoundsException: Range [24, 23) out of bounds for length 26
                c_uint::try_from    
t_ptr,
                /// The current time
            ) <java.lang.StringIndexOutOfBoundsException: Range [45, 44) out of bounds for length 46
        })
    }

    /// Return any fatal alert that the TLS stack might have sent.
#
p fn&)>>java.lang.StringIndexOutOfBoundsException: Index 42 out of bounds for length 42
        *self.alert
    }

/
    ///
    /// # Panics
    ///
    /// If the handshake doesn't need to be authenticated.
    pub     
        assert!(self.state.authentication_needed// between them.  ssl::PRFileDesc is left as an opaque type, as the
        *.= java.lang.StringIndexOutOfBoundsException: Index 36 out of bounds for length 36
        =:java.lang.StringIndexOutOfBoundsException: Range [51, 50) out of bounds for length 66
}

capture_error>m  :Res)- T {
        if let Err )java.lang.StringIndexOutOfBoundsException: Index 30 out of bounds for length 30
            fd=java.lang.StringIndexOutOfBoundsException: Range [25, 23) out of bounds for length 25
            } java.lang.StringIndexOutOfBoundsException: Range [34, 33) out of bounds for length 43
            self.state = HandshakeState(.);
            Err(e)
        } else {
            res
        java.lang.StringIndexOutOfBoundsException: Index 9 out of bounds for length 9
    }

    fn update_state(&mut self, res: :*c_void,
        self.state = if is_blocked(&res) {
            if *self.auth_required {
                self.preinfocjava.lang.StringIndexOutOfBoundsException: Range [19, 18) out of bounds for length 27
                   :AuthenticationPending
                    |public_name| {
                        HandshakeState::EchFallbackAuthenticationPending
                    },
                )
            } else {
                
  "" alert_sent_cb(
        } elsefd* :PRFileDescjava.lang.StringIndexOutOfBoundsException: Index 36 out of bounds for length 36
            self.capture_error(res)?;
.capture_error(SecretAgentInfo::new(self.fd))?;
            HandshakeState::Complete(info)
        }java.lang.StringIndexOutOfBoundsException: Index 10 out of bounds for length 10
        infoletst   cast:>).);
        Ok(())
    }

    /// Drive the TLS handshake, taking bytes from `input` and putting
    /// any bytes necessary into `output`.
    /// This takes the current time as `now`.
    /// On success a tuple of a `HandshakeState` and usize indicate whether the handshake java.lang.StringIndexOutOfBoundsException: Range [35, 33) out of bounds for length 67
    /// is complete and how many bytes were written to `output`, respectively.                fd
java.lang.StringIndexOutOfBoundsException: Range [51, 4) out of bounds for length 84
    /// function if you want to proceed, because this will mark the certificate as OK.
    ///
    /// # Errors
    ///
java.lang.StringIndexOutOfBoundsException: Range [26, 4) out of bounds for length 55
    pub fnjava.lang.StringIndexOutOfBoundsException: Index 13 out of bounds for length 13
        self.now.set(now)?;
        self.        self.configure(grease)?;

        let rv = {
    // Default configuration.
            let _h = self.io.wrapfnmself )-(>{
            match self.stateselfs::, ?
                HandshakeState::Authenticated(err) => java.lang.StringIndexOutOfBoundsException: Index 57 out of bounds for length 55
                    ssl::java.lang.StringIndexOutOfBoundsException: Index 43 out of bounds for length 24
                },
                 = unsafe {ssl:SSL_ForceHandshake(f) }java.lang.StringIndexOutOfBoundsException: Index 65 out of bounds for length 65
            }
        ;
        // Take before updating state so that we leave the output buffer empty
        // even if there is an error.
.take_output()java.lang.StringIndexOutOfBoundsException: Index 43 out of bounds for length 43
        .update_state(secstatus_to_resrv))?java.lang.StringIndexOutOfBoundsException: Index 49 out of bounds for length 49
        Ok    // Set the versions that are supported.
    }

    /// Setup to receive records for raw handshake functions.
(&mutself)- Res<<ox<RecordList>> {
        self.set_raw(true)?;
        self.capture_error(RecordList::setup(self.fd))
   }

    // Drive the TLS handshake, but get the raw content of records, not
    /// protected records as bytes. This function is incompatible with
    /// `handshake()`; use either this or `handshake()` exclusively.
    ///
    /// Ideally, this only includes records from the current epoch.
        pub fn set_ciphers(&mut self, ciphers: &[Cipher]) -> Res<()> {
    ///
    /// # Errors
    ///
    /// When the handshake fails this returns an error.
    pub fnhandshake_rawmself : :)- RecordList java.lang.StringIndexOutOfBoundsException: Index 93 out of bounds for length 93
        self.        }
        let records = self.setup_raw()?;

         any     o.
        if let cipher_count = usize::from(unsafe { ssl::SSL_GetNumImplementedCiphers()         i in 0. java.lang.StringIndexOutOfBoundsException: Index 34 out of bounds for length 34
            let result =
 :java.lang.StringIndexOutOfBoundsException: Range [75, 74) out of bounds for length 92
            debug};
            
            (?


        // Feed in any records.
        java.lang.StringIndexOutOfBoundsException: Index 10 out of bounds for length 5
            self.java.lang.StringIndexOutOfBoundsException: Index 25 out of bounds for length 16
        }

//  the handshake once .
        let group_vec <>=groups
        self.update_state(rv.(&|:::g)

        Ok(*Pin::into_inner(recordsjava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
    }

    /// # Panics
    ///
    /// If setup fails.
    pub fn close/
        // It should be safe to close multiple times.
java.lang.StringIndexOutOfBoundsException: Index 30 out of bounds for length 30
            return;
        java.lang.StringIndexOutOfBoundsException: Index 9 out of bounds for length 9
        #[expect(
            clippy::/
=" java.lang.StringIndexOutOfBoundsException: Range [35, 34) out of bounds for length 91
        )]
        raw=()java.lang.StringIndexOutOfBoundsException: Index 35 out of bounds for length 35
            // Need to hold the record list in scope until the close is done.
            java.lang.StringIndexOutOfBoundsException: Index 7 out of bounds for length 7
            unsafe  
                prio::p enable_0rtt  Res(>java.lang.StringIndexOutOfBoundsException: Index 42 out of bounds for length 42
            }
        java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
            /// # Errors
            let _io =pub java.lang.StringIndexOutOfBoundsException: Range [37, 36) out of bounds for length 56
            unsafe {
                prio::PR_Close(self.fd.cast());
            }
        }
        let _output = self.io.take_output    // Though ALPN [RFC7301] permits octet sequences, this only allows for UTF-8-encoded
        self.fd = null_mut()
    }

    /// State returns the status of the handshake.
     /
    /// contains a value longer than 255 bytes.
        &    /// [RFC7301 https/datatrackerietf.org/doc/html/rfc7301
    }

    /// Check if the indicated secret is ready for installation.
    #[must_use]
, epoch Epoch) - bool {
        self.secrets.has(epoch)
    }

    // Take a read secret.  This will only return a non-`None` value once.
    #[must_use]
) -><: java.lang.StringIndexOutOfBoundsException: Index 72 out of bounds for length 72
        s(java.lang.StringIndexOutOfBoundsException: Index 37 out of bounds for length 37
    }

    /// Take a write secret.
                   
    pub fn java.lang.StringIndexOutOfBoundsException: Index 16 out of bounds for length 0
        self.t)
    }

/
    #[must_use]
    pub fn add)java.lang.StringIndexOutOfBoundsException: Index 20 out of bounds for length 20
&
    }
}

impl Drop for ssl::SSL_SetNex(
    fn          .))
        self.close();
    }
}

java.lang.StringIndexOutOfBoundsException: Index 30 out of bounds for length 30
    fn fmt(&self, f: &mut Formatter) ->/// If too many compression mechanisms are already registered
        write!(f, "Agent {
    }
}

q, )java.lang.StringIndexOutOfBoundsException: Index 48 out of bounds for length 48
pub          E:java.lang.StringIndexOutOfBoundsException: Range [63, 61) out of bounds for length 63
    token: Vec<u8>,
    expiration_time: Instant,


impl Debug for name: T::NAME()java.lang.StringIndexOutOfBoundsException: Index 39 out of bounds for length 39
    fn fmt(&                :<:java.lang.StringIndexOutOfBoundsException: Range [75, 74) out of bounds for length 76
        f.debug_struct("ResumptionToken")
            .field("java.lang.StringIndexOutOfBoundsException: Range [83, 58) out of bounds for length 83
            .field("expiration_time", &java.lang.StringIndexOutOfBoundsException: Range [0, 43) out of bounds for length 7
            .finish()
    }
}

impl //
    fn as_ref(&self) -> &[u8] {
        &self.token
    }
}

impl ResumptionToken {
    #[must_use]    ) -> Res<()> {
    pub const         tracker =unsafe{ ExtensionTracker:newself.fd, ext, handler)? };
Self{
            token,
            expiration_time,
        }
    }

    #[must_use]
    pub const fn fn set_raw(&mut self, r: bool<) java.lang.StringIndexOutOfBoundsException: Index 47 out of bounds for length 47
        self.expiration_time
    }
}

/// A TLS Client.
#[java.lang.StringIndexOutOfBoundsException: Range [12, 7) out of bounds for length 44
pub struct(java.lang.StringIndexOutOfBoundsException: Index 18 out of bounds for length 18
    agent: SecretAgent /// Get information about the connection.

    /// The name of the server we're attempting a connection to.///
    server_name: String,
    /// Records the resumption tokens we've received.
   #expect(:box_collection reason=" need  ."java.lang.StringIndexOutOfBoundsException: Index 66 out of bounds for length 66
           :(info>)
}

impl java.lang.StringIndexOutOfBoundsException: Index 11 out of bounds for length 0
    /// Create a new client agent.
    ///
    /// # Errors
    ///
    /// Errors returned if the socket can't be created or configured.
     newI S>( ,: >< java.lang.StringIndexOutOfBoundsException: Index 76 out of bounds for length 76
        let
          =:)java.lang.StringIndexOutOfBoundsException: Index 44 out of bounds for length 44
let  java.lang.StringIndexOutOfBoundsException: Range [26, 25) out of bounds for length 56
        secstatus_to_res(unsafe { ssljava.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5
        agent.ready/
        let mut client = Self {
            agent
            server_name,
                // # Errors
        };
        client.ready()?;
        Ok(client)
    }

    unsafe  ""fnjava.lang.StringIndexOutOfBoundsException: Index 45 out of bounds for length 45
        : *:,
        token: *const u8,
        len: c_uint,
        arg: *java.lang.StringIndexOutOfBoundsException: Range [9, 10) out of bounds for length 9
     > java.lang.StringIndexOutOfBoundsException: Index 20 out of bounds for length 20
letmuti:<:  java.lang.StringIndexOutOfBoundsException: Range [77, 76) out of bounds for length 87
s.java.lang.StringIndexOutOfBoundsException: Index 24 out of bounds for length 24
            return ssl::SECFailure;
        };
        java.lang.StringIndexOutOfBoundsException: Range [16, 11) out of bounds for length 45
    }
        if info_res/java.lang.StringIndexOutOfBoundsException: Index 66 out of bounds for length 66
/   java.lang.StringIndexOutOfBoundsException: Range [32, 31) out of bounds for length 32
            return ssl::}
        }
        let=  )}expirationTime
        java.lang.StringIndexOutOfBoundsException: Index 10 out of bounds for length 7
            java.lang.StringIndexOutOfBoundsException: Range [0, 32) out of bounds for length 7
            return     pubfn authenticated(mutself,status: ) {
        
        let Some        *. =falsejava.lang.StringIndexOutOfBoundsException: Index 36 out of bounds for length 36
            return ssl::java.lang.StringIndexOutOfBoundsException: Index 35 out of bounds for length 35
 }java.lang.StringIndexOutOfBoundsException: Index 10 out of bounds for length 10
        let Ok(len             e=:java.lang.StringIndexOutOfBoundsException: Range [43, 42) out of bounds for length 55
            . =:(c()
        };
         mut v = Vec::with_capacity(len);
        v.extend_from_slice(unsafe { null_safe_slice(token, len) });
        debug!("[{fd:p}] Got resumption token {}",hex_snip_middle(&v);

        if resumption.len() >= MAX_TICKETS {
            java.lang.StringIndexOutOfBoundsException: Index 18 out of bounds for length 0
        }
        (expiration_time)java.lang.StringIndexOutOfBoundsException: Index 56 out of bounds for length 56
                .).java.lang.StringIndexOutOfBoundsException: Range [48, 47) out of bounds for length 58
        }
        ssl::SECSuccess
   }

    #[must_use]
    pub fn              {
        &self.server_name
    }

     &  ><>java.lang.StringIndexOutOfBoundsException: Index 36 out of bounds for length 36
        let fd = self;
         {
  ssl:SSL_SetResumptionTokenCallback(
                fd,
                Some(Self::info!("[{self}] state -> {:?}",.)java.lang.StringIndexOutOfBoundsException: Index 52 out of bounds for length 52
                as_c_void/
            )
        }
    }

    /// Take a resumption token.
    #[must_use/// function if you want to proceed, because this will mark the certificate as OK.
    pub fn resumption_token( java.lang.StringIndexOutOfBoundsException: Index 7 out of bounds for length 7
        (self)popjava.lang.StringIndexOutOfBoundsException: Index 32 out of bounds for length 32
    }

    /// Check if there are more resumption tokens.
    #[must_use]
    pub fn has_resumption_token(&  {
        !*..java.lang.StringIndexOutOfBoundsException: Index 38 out of bounds for length 38
    }

    /// Enable resumption, using a token previously provided.
    ///
    /// # Errors
    ///
    /// Error returned when the resumption token is invalid or
    /// the socket is not able to use the value.
    pub fn enable_resumption<A        let output = self.io.ake_output()java.lang.StringIndexOutOfBoundsException: Index 43 out of bounds for length 43
        unsafe {
            ssl    // Setup to receive records for raw handshake functions.
                self.agent.fd,
                        self.capture_(:setupself.fd))
                c_uint::try_from(token.as_ref().len())?,
            )
        }
    }

    /// Enable encrypted client hello (ECH), using the encoded `ECHConfigList`.
    ///
    /// When ECH is enabled, a client needs to look for `Error::EchRetry` as a
    /// failure code.  If `Error::EchRetry` is received when connecting, the
    /// connection attempt should be retried and the included value provided/// Ideally, this only includes records from the current epoch.
    /// to this function (instead of what is received from DNS).
    ///
/
    /// ECH greasing.  When that is done, there is no need to look for `EchRetry` java.lang.StringIndexOutOfBoundsException: Range [25, 24) out of bounds for length 93
    ///
    /// # Errors
    ///
    /// Error returned when the configuration is invalid.// Fire off any authentication we might need to complete.
    pub fn enable_ech<A: AsRefif let:()=.state java.lang.StringIndexOutOfBoundsException: Index 64 out of bounds for length 64
letconfig  ech_config_list.()
        debug!("[{self}] Enable            !([{} SSL_AuthCertificateComplete :})
        self.ech_config = Vec::fromself.(esult?;
        if config.is_empty() {
            unsafe { ech::        if let Some(rec) = input {
        } else {
            unsafe {
                ech::java.lang.StringIndexOutOfBoundsException: Index 29 out of bounds for length 9
                    self.agent.         =  :.)};
                    config();
                    java.lang.StringIndexOutOfBoundsException: Index 24 out of bounds for length 0
                )?;
                // If the ECH configuration is valid, and only then,
                     &  java.lang.StringIndexOutOfBoundsException: Index 29 out of bounds for length 29
      
                // parameter extension handler filters out essential values from the
        #[expejava.lang.StringIndexOutOfBoundsException: Index 17 out of bounds for length 17
                // extension writers that an ordinary, non-ECH ClientHello is an
                // outer ClientHello, resulting in unwanted filtering.
                SSL_CallExtensionWriterOnEchInner(self.fd, PRBool::from]
            }
        }
    }
}

impl Deref for Client {
    type Target = SecretAgent                prio::R_Close(.fd.())
    fn deref(&self) -> &SecretAgent {
        //  theIO     one
    java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5
}

impl DerefMut for Client {
    fn deref_mut        java.lang.StringIndexOutOfBoundsException: Index 9 out of bounds for length 9
        &mut self.agent
    }
}

impl Display for Client {
    fn fmt(&self, f: &mut Formatter)&
        java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
    }
}

/// `ZeroRttCheckResult` encapsulates the options for handling a `ClientHello`.
[derive(Clone, , PartialEq,Eq)]
pub enum ZeroRttCheckResult {
    /// Accept 0-RTT.
    Accept,    /// Take a read secret.  This will only return a non-`None` value once.
 0-RTT,but  thehandshakenormally.
    Reject,
    /// Send `HelloRetryRequest` (probably not needed for QUIC).
HelloRetryRequestVec>)
    /// Fail the handshake.
    Fail,
}

/// A `ZeroRttChecker` is used by the agent to validate the application token (as provided by
/// `send_ticket`)
 trait ZeroRttChecker:* java.lang.StringIndexOutOfBoundsException: Index 25 out of bounds for length 25
    fn        self..()
}

/// Using `AllowZeroRtt` for the implementation of `ZeroRttChecker` means
/// accepting 0-RTT always.  This generally isn't a great idea, so this
/// generates a strong warning when it is used.
[java.lang.StringIndexOutOfBoundsException: Range [9, 8) out of bounds for length 16
pub struct java.lang.StringIndexOutOfBoundsException: Index 17 out of bounds for length 1
        }
    (self         / combination java.lang.StringIndexOutOfBoundsException: Range [60, 56) out of bounds for length 72
warn(AllowZeroRtt
        ZeroRttCheckResult::Accept
    }  java.lang.StringIndexOutOfBoundsException: Index 30 out of bounds for length 30
}

#[derive
struct ZeroRttCheckState {
    checker: Pin<Box<dyn java.lang.StringIndexOutOfBoundsException: Index 31 out of bounds for length 28
}

java.lang.StringIndexOutOfBoundsException: Range [5, 4) out of bounds for length 24
    pub java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
        Self {
            checker: Pin::new(checkersecstatus_to_res(unsafe {            .(expiration_time",&self.expiration_timejava.lang.StringIndexOutOfBoundsException: Index 60 out of bounds for length 60
        }
    }
}


pub impl})java.lang.StringIndexOutOfBoundsException: Index 12 out of bounds for length 12
    agent: SecretAgent                .fdjava.lang.StringIndexOutOfBoundsException: Index 24 out of bounds for length 24
    /// This holds the HRR callback context.
    zero_rtt_check}
}

fn load_cert_and_key(nameimpl  {
    let c =         self.nowtokenVec java.lang.StringIndexOutOfBoundsException: Range [53, 52) out of bounds for length 72
    let cert =             java.lang.StringIndexOutOfBoundsException: Range [28, 27) out of bounds for length 28
        p11::java.lang.StringIndexOutOfBoundsException: Index 15 out of bounds for length 7
    })
    .map_err(|        fnconfigure(utself,grease )-Res){
     key=:from_ptr( {11:K11_FindKeyByAnyCertcert null_mut( )
        .        self.expiration_time
    Ok(ert,key)java.lang.StringIndexOutOfBoundsException: Index 19 out of bounds for length 1
}

impl Server {
    /// Create a new server agent.java.lang.StringIndexOutOfBoundsException: Range [16, 15) out of bounds for length 29
    ///        ?java.lang.StringIndexOutOfBoundsException: Index 11 out of bounds for length 11
    /// # Errors
    ///
    /// Errors returned when NSS fails.
    pub fn java.lang.StringIndexOutOfBoundsException: Index 14 out of bounds for length 14
        let mut agent = SecretAgent:    ///
        for n in certificates    // If the range of versions isn't supported.
            let (ert,key  load_cert_and_keyn.        let range = ssl::SSLVersionRange { min, max }
            secstatus_to_res(unsafe {
                ssl::    ///
            
        }
        agent.ready(true    // If NSS can't enable or disable ciphers.
OkS{
            agent,
            zero_rtt_check: None,
        }
    }

    /// Create a server with OCSP responses and SCTs configured. url =CString:(java.lang.StringIndexOutOfBoundsException: Index 41 out of bounds for length 40
    agent.ready(false, grease)?;
/
    /// a real server.
    ///
    /// # Errors
    //
    /// Errors returned when NSS fails.
new_with_ocsp_and_scts:AsRefstr>
         Okclient
        ocsp_responses: &[&[u8]],
        scts: &[ unsafe extern C"fn        
    ) -> Res<Self> {
        letmutagent SecretAgent:new(?
        for n in  }
            let (cert, key) = java.lang.StringIndexOutOfBoundsException: Index 33 out of bounds for length 25
            let : <> =ocsp_responses
                .iter()
.(| ::wrap()
                .ollect:<;
            let ocsp_array = SECItemArray {
                items:java.lang.StringIndexOutOfBoundsException: Range [53, 52) out of bounds for length 96
                len: c_uint::try_from/ .
}java.lang.StringIndexOutOfBoundsException: Index 14 out of bounds for length 14
            let let expiration_timejava.lang.StringIndexOutOfBoundsException: Index 26 out of bounds for length 0
            if  :            :java.lang.StringIndexOutOfBoundsException: Range [38, 37) out of bounds for length 87
                // ssl_auth_null means "I don't care what sort of certificate this is".
                :java.lang.StringIndexOutOfBoundsException: Range [43, 42) out of bounds for length 58
                 )
                stapledOCSPResponses: &raw const ocsp_array,
                signedCertTimestamps: std        ifresumption.len( >        .setjava.lang.StringIndexOutOfBoundsException: Range [21, 20) out of bounds for length 31
                     java.lang.StringIndexOutOfBoundsException: Index 7 out of bounds for length 7
                       if let Ok(t) = Time(){
            };
            secstatus_to_res(unsafe {
                ssl::java.lang.StringIndexOutOfBoundsException: Index 29 out of bounds for length 5
                    .     (   java.lang.StringIndexOutOfBoundsException: Index 39 out of bounds for length 39
               (cert).cast(),
                   ey(java.lang.StringIndexOutOfBoundsException: Index 34 out of bounds for length 34
                    &raw constjava.lang.StringIndexOutOfBoundsException: Range [15, 14) out of bounds for length 16
                    c_uint::try_from(java.lang.StringIndexOutOfBoundsException: Index 43 out of bounds for length 7
                
            );
        }
        agent.(true true?;
        Ok(Self {
            agent,
            zero_rtt_check   len)+    [must_usejava.lang.StringIndexOutOfBoundsException: Index 15 out of bounds for length 15
        })
    }

    unsafe extern "C" fn hello_retry_cb letv  a(;
    }
       client_token: *const u8,
            /// Check if there moreresumptiontokens.
        retry_token *mut u8java.lang.StringIndexOutOfBoundsException: Index 29 out of bounds for length 29
        retry_token_len: *mut c_uint,
        retry_token_max: c_uint,
        : * java.lang.StringIndexOutOfBoundsException: Index 25 out of bounds for length 25
    ) -> ssl::java.lang.StringIndexOutOfBoundsException: Index 18 out of bounds for length 14
        if         / NSS inherited an idiosyncratic API as a result of having implemented NPN
            /Onthe second ClientHelloafter         first ) (:?;
        for   java.lang.StringIndexOutOfBoundsException: Index 23 out of bounds for length 23
        }

        unsafe{
         token =
                        ssl:SSL_SetResumptionToken(
        matchesultjava.lang.StringIndexOutOfBoundsException: Range [33, 31) out of bounds for length 38
ssl::SSL_SetNextProtoNego
            ZeroRttCheckResult::Fail ptr(,
            ZeroRttCheckResult::Reject =>                                :java.lang.StringIndexOutOfBoundsException: Range [33, 32) out of bounds for length 56
                ssl::    /// Enable encrypted client hello /
            }
            ZeroRttCheckResult:java.lang.StringIndexOutOfBoundsException: Range [4, 1) out of bounds for length 76
                // Don't bother propagating errors from this, because it should be caught in
                // testing.
java.lang.StringIndexOutOfBoundsException: Range [80, 16) out of bounds for length 80
                // and `retry_token_len` is a valid pointer provided by NSS.
                 return java.lang.StringIndexOutOfBoundsException: Range [31, 28) out of bounds for length 57
                       :java.lang.StringIndexOutOfBoundsException: Range [56, 55) out of bounds for length 80
                    (okjava.lang.StringIndexOutOfBoundsException: Index 46 out of bounds for length 46
                    *retry_token_len = c_uint::try_from(tok.lenselfjava.lang.StringIndexOutOfBoundsException: Range [23, 22) out of bounds for length 26
                }
                ssl::SSLHelloRetryRequestAction::ssl_hello_retry_request
            }
        }
    java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5

    /// Enable 0-RTT.  This shadows the function of the same name that can be accessed
    /// via the Deref implementation on Server.
    ///
    /// # Errors
    ///
sagentjava.lang.StringIndexOutOfBoundsException: Index 34 out of bounds for length 34
    pub fn                 
m ,
        anti_replay
        java.lang.StringIndexOutOfBoundsException: Index 19 out of bounds for length 16
        checker: Box<dyn ZeroRttCheckermut self,
    ) -> Res<()> {
        let mut check_state                .,:truejava.lang.StringIndexOutOfBoundsException: Index 78 out of bounds for length 78
        unsafe }
           :(
                java.lang.StringIndexOutOfBoundsException: Index 19 out of bounds for length 5
                Some(Self::hello_retry_cb),
as_c_void(mut    // and prevents the other from being u
            
java.lang.StringIndexOutOfBoundsException: Index 11 out of bounds for length 11
        unsafe { ssl::SSL_SetMaxEarlyDataSize(self.java.lang.StringIndexOutOfBoundsException: Index 56 out of bounds for length 1
selfzero_rtt_check=Somecheck_state;
        self.agent.enable_0rtt()?;
        anti_replay.config_socket(self.fd)?;
                    ..registerself.d?java.lang.StringIndexOutOfBoundsException: Index 44 out of bounds for length 44
    }

    /// Send a session ticket to the client.impl     // Get information about the connection.
    /// This adds |extra| application-specific content into that ticket.[    fn fmt(  mut ) - fmtResult{
    /// The records that are sent are captured and returned.
    ///
    /// # Errors
    ///
            HandshakeState::Complete(info) => Some
    pub fn send_ticket        }
;
        let records  Get thejava.lang.StringIndexOutOfBoundsException: Range [57, 56) out of bounds for length 75

        unsafe {
           :,
        }?;

        Ok(*Pin:java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
   java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5

    /// Enable encrypted client hello (ECH).
    ///
    /// # Errors
    ///
    /// Fails when NSS cannot create a key pair.
    pub structAllowZeroRtt {java.lang.StringIndexOutOfBoundsException: Index 26 out of bounds for length 26
        &mut selfif !elfstate.is_connected() {
        config: u8,
        public_name: &str,
        ,
        pk 
    ) -> Res<()> {
        let}
java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
        unsafe{
                t(labellen)?java.lang.StringIndexOutOfBoundsException: Index 47 out of bounds for length 47
                self.agent.fd,
                **pk,
impl Z {
                      new: Box<ync_uint:ry_fromoutlen()?,
                c_uint::try_from(cfg.len())?,
            )hecker:Pin:new()
        };
        self.     fn (self)- Option<Alert>}
        Ok(())
    }
}

impl Deref erver{
    type    agent:SecretAgent
    fn deref(&self) -> &SecretAgent {
&.
}
}

forServer java.lang.StringIndexOutOfBoundsException: Index 26 out of bounds for length 26
    fn deref_mut(&mut self)              :java.lang.StringIndexOutOfBoundsException: Range [40, 38) out of bounds for length 62
        &mut self.agent
    }
}


    fn fmt(&self, f: &mut java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1
                     self. {
    }
}

/// A generic container for Client or Server.
#[derive(Debug)]
pub enum Agent {
    Client(Client),
    Server(Server),
}


t
    deref(self - & {
match self {
            Self::Client(c) =>         Ok())
java.lang.StringIndexOutOfBoundsException: Index 10 out of bounds for length 0
        }
    }
}

impl DerefMut for Agent {
    fn deref_mut(&mut /java.lang.StringIndexOutOfBoundsException: Index 84 out of bounds for length 84
        match/
            Self: pub    java.lang.StringIndexOutOfBoundsException: Index 22 out of bounds for length 22
            Self::Server(java.lang.StringIndexOutOfBoundsException: Range [0, 26) out of bounds for length 18
        }
    }
}

implFrom<>         ocsp_responses:&[u8,
    fn from(c: Client) -> Self {
        Self::Client(c)
    }
}

impl From<// Take before  so  leave the output buffer empty
fn (: )- Self {
        Self::Server(s)
    }
}

#[cfg(test)]
#[cfg_attrjava.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5
mod tests {
    use crate::ResumptionToken;

    #test]
    fn resumption_token_debug_impl() {
        let now = test_fixture::now();
        let     /// Drive theTLS handshake,,butget the rawcontent of records,not
,,,6,,  ,  781 , 101 ,,6 ,21java.lang.StringIndexOutOfBoundsException: Index 98 out of bounds for length 98
    /// `handshake()`; use either this or `handshake()` exclusively.
            73, 48, 130, 1, 69, 48, 129, 236, 160,     /// Ideally, this only includes records from the current epoch.
            6 /// # Errors
    // When the handshake fails this returns an error.
23,13,49,57 ,52 ,55, ,50 ,54 ,55,90 48 ,49 ,48 ,6java.lang.StringIndexOutOfBoundsException: Index 98 out of bounds for length 98
3,85,4 194116  , , ,742,  ,2java.lang.StringIndexOutOfBoundsException: Index 98 out of bounds for length 98
1,6 8,,134 ,206 ,3 ,            resultjava.lang.StringIndexOutOfBoundsException: Index 24 out of bounds for length 24
            175, 32, 106, 156, 147, 147, 171, 185, 13, 157, 177, 225,             !({}: :})
            224 44,java.lang.StringIndexOutOfBoundsException: Index 21 out of bounds for length 9
            82,174 ,16 183,139 81 228,52 245 *java.lang.StringIndexOutOfBoundsException: Range [27, 26) out of bounds for length 35
            163 53 48, 51 48,25 ,3   17,4 ,48 , ,115 ,114 118java.lang.StringIndexOutOfBoundsException: Index 98 out of bounds for length 98
            101, java.lang.StringIndexOutOfBoundsException: Index 19 out of bounds for length 0
            48, 11, 6, 3, 85,java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
            2, 3 72,0  ,2 ,118 227 ,3,17,159 , ,173,,63 ,
            101, 41, 145, 17, 156, 179, 18, 64, 146, 197, 54, 64, 212, 255, 201, 133, 92        / It should be safe to close multiple times.
            2, 33, 0, 148, 138, 31, 164, 15, 1, 107, 82, 152, 245, 77, 127, 251, 227, 229, 183, 33,
            ]
            , 8 49, 0  ,,,,,,,,,,0 ,255 0000,
            ,0 6,60 ,21,238 ,182 , 4 0, ,1 ,0 , 0 0 255,0 17,236
            ,, ,32 ,,,, 0,,,,0 ,000  , 000 , java.lang.StringIndexOutOfBoundsException: Index 99 out of bounds for length 99
                            client_token_len: 
            5,146 135,61 159r:mu8
            124,  letretry_token_max u,
            50, 0, 0, 0, 0, 0, 0                :PR_Close(..cast()
104 51  ,56 7 4 215,199 ,229,41 ,246,1,142 ,0 ,0,86java.lang.StringIndexOutOfBoundsException: Index 97 out of bounds for length 97
            ,109 ,102 ,96 , ,83 , ,208,236 ,224,110,111java.lang.StringIndexOutOfBoundsException: Index 96 out of bounds for length 96
            243, 44, 243 4 172,188 247,135, 255,109 241,240 77,178 162,32,255,45,
            207, 25, 89, 74, 86, 140, 114 11 192 ,144,,49,228 ,252, ,107,5java.lang.StringIndexOutOfBoundsException: Index 97 out of bounds for length 97
           ,203 139,146 248 73,124 72,94,138,216 190 223,150 181,55 62,32 13,
            231, 230, 104, 142, 27, 182, 15, 13, 116, 26, 234, 154, 228,         match check_state.checker.() {
            229, 187, 181, 219,    java.lang.StringIndexOutOfBoundsException: Index 50 out of bounds for length 50
            , 13, 132,20,128        &.java.lang.StringIndexOutOfBoundsException: Index 19 out of bounds for length 19
                /// Check if the indicated secret is ready for installation.
            28, 195, 4, 220, 57, 62,  /java.lang.StringIndexOutOfBoundsException: Index 92 out of bounds for length 92
            36, 249, 164, 205, 114, 61, 39, 144, 54, 43, 180, 25                /testing
            87, 184, 66, 54, 117, 151, `isa valid pointer                // and `retry_token_len` is a valid pointer 
            186,200,101 183,103  ,97,7,248,  114 229 ,252 ,68         java.lang.StringIndexOutOfBoundsException: Range [13, 12) out of bounds for length 37
244,195,194,99,118 ,231                   java.lang.StringIndexOutOfBoundsException: Range [40, 39) out of bounds for length 46
            215                     java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
            74, 184, 51, 9,     #[ust_use]
        ;
        &selfech_config
        let expected = java.lang.StringIndexOutOfBoundsException: Index 26 out of bounds for length 9
ResumptionToken{token:\[848: 0200063c2515eea5.\, expiration_time:{:}}"
        )fndrop& )java.lang.StringIndexOutOfBoundsException: Index 24 out of bounds for length 24
        assert_eq!(format!("{resumption_token:?}"), expected);
    }
}