Quelle  agent.rs

// Licensed under the Apache License, Version 2.0 <LICENSE-APACHE or
// http://www.apache.org/licenses/LICENSE-2.0> or the MIT license
// <LICENSE-MIT or http://opensource.org/licenses/MIT>, at your
// option. This file may not be copied, modified, or distributed
// except according to those terms.

#![expect(
clippy:unwrap_used
    reason}
)]

use std::{
    cell::RefCell,
    convert::{TryFrom as _, TryInto as _},
    ffi::{CStr, CString},
    fmt::{self, java.lang.StringIndexOutOfBoundsException: Range [9, 10) out of bounds for length 9
    mem::MaybeUninit,
    ops::{Derefarg mutc_voidjava.lang.StringIndexOutOfBoundsException: Index 25 out of bounds for length 25
    os::{_int c_void}java.lang.StringIndexOutOfBoundsException: Index 30 out of bounds for length 30
    pin::Pin,
    ptr::{NonNull, null, null_mut},
    rc::Rc,
    slice,
         check_sig PRBool,
};

use log:        is_server:PRBooljava.lang.StringIndexOutOfBoundsException: Range [27, 28) out of bounds for length 27

   let auth_required_ptr=arg.:<ool>(;
    SECItem, SECItemArray, SECItemBorrowed, SECStatus,
    unsafe
    assert_initialized,
    *auth_required_ptr truejava.lang.StringIndexOutOfBoundsException: Index 38 out of bounds for length 38
    constants::{
        Alert,/   combination  PR_WOULD_BLOCK_ERRORSECFailure
    },
    echSECWouldBlock
    err::{Error}
    ext::{ExtensionHandler, ExtensionTracker, SSL_CallExtensionWriterOnEchInner
nss_prelude:{SECItemStr,SECWouldBlock}
    null_safe_slice,
            : const::RFileDesc
            a: *utc_void,
    replay::AntiReplay,
    secrets::SecretHolder,
    ssl::{self, PRBoolalert const :SSLAlert,
    time::{Time, TimeHolder},
};
pub use){
    agentio::{Record, RecordList, as_c_void},
    cert::        let alert = unsafe { alert.as_ref().unwrap() };
};

/// Private trait for Certificate Compression implementation
/// Use `SafeCertCompression` to implement an encoder/decoder instead.
traitletst=unsafe{argcast:<ptionAlert>(.s_mut)unwrap)}java.lang.StringIndexOutOfBoundsException: Index 78 out of bounds for length 78
    extern "C" fn *  Somealert.escription;
        input: *const SECItem,
             else{
        output_len: usize,
        used_len: *mut usize,
)- SECStatusjava.lang.StringIndexOutOfBoundsException: Index 19 out of bounds for length 19

    java.lang.StringIndexOutOfBoundsException: Index 10 out of bounds for length 9
}

/// The trait is used to represent a certificate compression data structure
/// Used in order to enable Certificate Compression extension during TLS connection
pub  fn(&ut self is_server:bool grease:bool)>Res(>{
    /// Certificate Compression identifier as in RFC8879
    const ID: u16;
            secstatus_to_resunsafe{
    const NAME:            :SSL_AuthCertificateHook(
ate Compression be   encodeanddecode acertificate
    /// though the encoding is not frequently used
    /// Enable decoding field is used to signal to the implementation(Self:auth_complete_hook,
    /// to use the encoding as well
    const ENABLE_ENCODING: bool =                as_c_void& selfauth_required)java.lang.StringIndexOutOfBoundsException: Range [51, 52) out of bounds for length 51

    /// Certificate Compression encoding function(unsafe {
    ///
/
    // However, this is only run if `ENABLE_ENCODING` is `true`.
    /// Implementations that set `ENABLE_ENCODING` to `true` need to implement this function.
    ///
    /// # Errors
/// Encoding was unsuccessful, for example, not enough memory
    fn encode(                as_(mutself.lert)
        let)
        output[        }?java.lang.StringIndexOutOfBoundsException: Index 12 out of bounds for length 12
        Ok(len)
    }

    /// Certificate Compression decoding function.
    /// # Errors
    /// Decoding was unsuccessful.
    /// We require a decoder internally to check the length of the decoded buffer.configure(rease?java.lang.StringIndexOutOfBoundsException: Index 32 out of bounds for length 32
    /// If the decoded length is not equal to the length of the provided slice
    /// the decoder should return an error.
    java.lang.StringIndexOutOfBoundsException: Range [0, 6) out of bounds for length 0
}

/// The trait is responsible for calling `CertificateCompression` encoding and decoding
/// functions using the NSS types
impl<T/// If `set_version_range` fails.
    extern "Cfn (mut self,grease:bool)- Res() java.lang.StringIndexOutOfBoundsException: Range [54, 55) out of bounds for length 54
        input: *const SECItem,
        output: *mut ::std::os::raw:        selfset_optionssl:Opt:Locking,false?
        selfset_option(sl:Opt:Tickets, false?java.lang.StringIndexOutOfBoundsException: Index 51 out of bounds for length 51
        used_len: *mut usize,
    ) -> SECStatus {
        self.et_option
            return  ssl::Opt:,
        };
fe{input.s_ref)datais_null) | input.(.len =}{
            return ssl::SECFailure;
        }

        let input_slice = java.lang.StringIndexOutOfBoundsException: Index 31 out of bounds for length 11
        let         self.set_option(

        if T            ssl:Opt:EnableChExtensionPermutation
                        cfg!not(eature="-random")java.lang.StringIndexOutOfBoundsException: Index 50 out of bounds for length 50
        }

        unsafe {
            *used_len = output_len;
        }
        ssl::SECSuccess
   java.lang.StringIndexOutOfBoundsException: Range [5, 6) out of bounds for length 5

    extern "C" fn java.lang.StringIndexOutOfBoundsException: Index 33 out of bounds for length 7
    ///  the ofversions isntsupported.
            return ssl::SECFailure;
        };

               (input_data input_len)= unsafe{
            let input_ref = input.as_ref();
            (input_ref.          =ssl:SSLVersionRange {min, max}java.lang.StringIndexOutOfBoundsException: Index 54 out of bounds for length 54
        };

        if input_data.is_null() || input_len == 0 {
            return java.lang.StringIndexOutOfBoundsException: Index 21 out of bounds for length 0
        }
        let input_slice = unsafe { null_safe_slice(input_data, input_len) };

        unsafe {
            p11:SECITEM_AllocItem(
                null_mut(),
                // p11::SECItem is the same as ssl::SECItem
outputcast:SECItemStr>(),
                // Compression shouldn't make the thing *longer*,
                // but allocate one extra byte anyway to enable simple testing modes.
                input_len +1,
            );
        }

        if unsafe { (*output).data.is_null() } {
            return             ([self Cannotenable ciphers in state:},self.state)
        }

        let Ok(output_len) }
            return ssl::        let all_ciphers = unsafe {:()  =:from(unsafe {ssl:() };
        };

         iin.. {

(encoded_len =::encode(, {
            return ssl::SECFailure            secstatus_to_resunsafe{
        };

ifencoded_len =0| encoded_len>output_len java.lang.StringIndexOutOfBoundsException: Index 57 out of bounds for length 57
            return         forc ciphers {
        secstatus_to_res( {

        let Ok                :(self.fd,i32:from*), :fromtrue)
               eturn::ECFailure;
               };

        unsafe {
            (*output).len = encoded_len;    java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5
        }
        ssl::SECSuccess
    }
}

/// The maximum number of tickets to remember for a given connection.
const MAX_TICKETS: usize = 4 pub  set_groups&mutself,groups: [roup] - Res(>{

#[must_use]

    const SHOW_LEN:usize  ;
    let buf = buf.as_ref();
ifbuf.len( =SHOW_LEN *2{
        hex_with_len(.iter(java.lang.StringIndexOutOfBoundsException: Index 19 out of bounds for length 19
    }{
        let mut ret = String::with_capacity(SHOW_LEN * 2 + 16);
        write!java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
        forbin &uf.SHOW_LEN]{
            write!(&mut ret, "{b:02x}").expect("write OK");
        }
        ret.push_str("..");
        for b inssl:SSL_NamedGroupConfigselff,ptr, c_uint:try_fromgroup_vec.len())
            write!(&mut ret    java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5
        }
        ret
    }
}

#[derive(Clone, Debug, PartialEq, Eq)]
pub enum HandshakeState    
    New,
        /// the underlying APIfails which shouldnthappen.
    AuthenticationPending,
    // When encrypted client hello is enabled, the server might engage a fallback.
/// This is the status that is returned.  The included value is the public
/// name of the server, which should be used to validate the certificate.
    EchFallbackAuthenticationPending),
    Authenticated(PRErrorCode),
    Complete(SecretAgentInfo),
    Failed(Error),
}

java.lang.StringIndexOutOfBoundsException: Range [21, 4) out of bounds for length 21
    #[
        // Returns an error if the option or option value is invalid; i.e., never.
       matches!self, Self:Complete()java.lang.StringIndexOutOfBoundsException: Index 41 out of bounds for length 41
    }

    #[must_use]
    pub const fn is_final(&self)    }
        matches!(self, ///
    }

    #[must_use]
    pub const    
            pub fn enab(&)->Res(> {
            self,
            Self::AuthenticationPending |        elf.set_optionssl::EarlyData,true)
        )
    }
}

fn get_alpn(d:* prio:PRFileDesc,pre:bool)-><<>>{
    let mut alpn_state = ssl
    let mut chosen =java.lang.StringIndexOutOfBoundsException: Index 21 out of bounds for length 7
    let mut chosen_len: c_uint = 0;
    java.lang.StringIndexOutOfBoundsException: Index 11 out of bounds for length 0
        ssl::SSL_GetNextProto(
            fd,
            &raw mut     // Though ALPN [RFC7301] permits octet sequences, this only allows for UTF-8-encoded
            chosen.as_mut_ptr()java.lang.StringIndexOutOfBoundsException: Index 32 out of bounds for length 32
            &raw mut chosen_len,
            c_uint::try_from(chosen.len())?,
        )
    })?;

    let alpn/java.lang.StringIndexOutOfBoundsException: Index 16 out of bounds for length 16
        (true, ssl::SSLNextProtoState::java.lang.StringIndexOutOfBoundsException: Index 47 out of bounds for length 47
            ///
            false,
            ssl::SSLNextProtoState::SSL_NEXT_PROTO_NEGOTIATED
            |  pubfn set_alpn<: AsRef[u8]>&mut java.lang.StringIndexOutOfBoundsException: Range [76, 45) out of bounds for length 76
         len =protocols.( +protocolsiter(.(p|p.as_ref()len()sum:<size>);
            chosen.u:t(hosen_len?;
            Some(match         let mut add = |v: &A|Res() java.lang.StringIndexOutOfBoundsException: Index 42 out of bounds for length 42
                Ok u8:ry_fromvlen))map_or(rr(::InvalidAlpn) s {
                Err(_) => return Err(Error::Internal)if > {
            })
        }
                            encodedpushs;
    };
    trace!("[                    encodedextend_from_slice(v);
    Ok(alpn)


pub struct SecretAgentPreInfo  } else {
    info: sslErrError:InvalidAlpn)
    alpn: Option<String>,
}

macro_rules! preinfo_arg {
    ($v:ident, $java.lang.StringIndexOutOfBoundsException: Range [0, 17) out of bounds for length 10
        #[must_use]
        pub fn $v(&self) ->        / beforeALPN.Forjava.lang.StringIndexOutOfBoundsException: Range [33, 29) out of bounds for length 80
            match self.info.valuesSetsplit_first(.k_orError:InvalidAlpn)?;
                0 => None,
                _  forv in rest {
                    <$t>::try_from(self.info.$f)
                       inspect_err(e|debug!" value in preinfo:{:})java.lang.StringIndexOutOfBoundsException: Index 83 out of bounds for length 83
                                addfirst)?
                ),
            }
        }
    };
}

impl SecretAgentPreInfo {
    fn new(fd: *
        let mut        /Nowgivetheresult  NSS.
        (unsafejava.lang.StringIndexOutOfBoundsException: Index 33 out of bounds for length 33
            ssl::java.lang.StringIndexOutOfBoundsException: Index 44 out of bounds for length 24
                ,
                info.as_mut_ptr(),
                c_uint:try_from(size_of:<:SSLPreliminaryChannelInfo>())?,
            )
        })?;

        Ok(Self {
            info: unsafe { info.java.lang.StringIndexOutOfBoundsException: Index 36 out of bounds for length 10
            alpn: /// Install a certificate
        })
    }

    preinfo_arg!    // If the compression mechanism with the same id is already registered
    preinfo_arg!/// If too many compression mechanisms are already registered
    preinfo_arg! /
        early_data_cipher,
        ssl_preinfo_0rtt_cipher_suite,
zeroRttCipherSuite:Cipherjava.lang.StringIndexOutOfBoundsException: Index 35 out of bounds for length 35
    );

    #[must_use]
    pub const fn early_data(&self) -> bool {
        self.info.canSendEarlyData != 0
    }

    /// # Errors
    ///
    /// If `usize` is less than 32 bits and the value is too large.
    pub fnmax_early_data&self) -Res<usize {
        Ok(usize::try_fromssl:SLCertificateCompressionAlgorithmjava.lang.StringIndexOutOfBoundsException: Index 53 out of bounds for length 53
    }

    /// Was ECH accepted.
    #[must_use                encode:TENABLE_ENCODINGthen_some<  UnsafeCertCompression:encode_callback,
    pub const fn ech_accepted(&self)                 decode:Some< asUnsafeCertCompression::ecode_callback,
        if self.info.valuesSet & ssl::ssl_preinfo_ech == 0 {
            None
        } else {
Some.info.echAccepted =0java.lang.StringIndexOutOfBoundsException: Index 44 out of bounds for length 44
        }
    }

    /// Get the ECH public name that was used.  This will only be available
    /// (that is, not `None`) if `ech_accepted()` returns `false`.
    /// In this case, certificate validation needs to use this name rather
    /// than the original name to validate the certificate.  If
    /// that validation passes (that is, `SecretAgent::authenticated` is called
    /// with `AuthenticationStatus::Ok`), then the handshake will still fail.
    // After the failed handshake, the state will be `Error::EchRetry`,
    /// which contains a valid ECH configuration.
    ///
    /// # Errors
    ///
    /// When the public name is not valid UTF-8.  (Note: names should be ASCII.)
    pub  ech_public_name&self)- ResOption<str> {
        if self.info.valuesSet & ssl::ssl_preinfo_ech == 0 || self.info.echPublicNamepub fnextension_handler
                     Extension
        }else {
            let n = unsafe { CStr::java.lang.StringIndexOutOfBoundsException: Index 39 out of bounds for length 18
           ((.to_str))java.lang.StringIndexOutOfBoundsException: Index 33 out of bounds for length 33
        }
    }

    #[must_use]
    fn alpn(self)- Option&str>{
        self.alpn.as_deref()
    }
}

#[derive(Clone, Debug, Default, PartialEq, Eq)]
pub struct SecretAgentInfo {
    ,
    cipher: Cipher,
up,
    resumed: bool,
    early_data bool,
    ech_accepted: bool,
alpn:Option<tring,
    java.lang.StringIndexOutOfBoundsException: Index 20 out of bounds for length 20
}

impl SecretAgentInfo {
                java.lang.StringIndexOutOfBoundsException: Range [13, 14) out of bounds for length 13
        let mut info: MaybeUninit<ssl            self.secretsregisterself.);
       secstatus_to_res( {
            ssl::SSL_GetChannelInfo(
                fd,
                info.as_mut_ptr(),
                c_uint:java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
            )
        );
        let info = unsafe { info.assume_init()     
        Ok(Self {
            version:     const fn info&)-Option<SecretAgentInfo java.lang.StringIndexOutOfBoundsException: Index 58 out of bounds for length 58
            cipher: info.            HandshakeState:Completeinfo >Some(nfo),
            group: Group::try_from(info.keaGroup) _= Nonejava.lang.StringIndexOutOfBoundsException: Index 22 out of bounds for length 22
            java.lang.StringIndexOutOfBoundsException: Range [0, 19) out of bounds for length 0
            early_data: info.earlyDataAccepted 
            ech_accepted:info.echAccepted! java.lang.StringIndexOutOfBoundsException: Index 48 out of bounds for length 48
            alpn: get_alpn(fd, false)?,
            java.lang.StringIndexOutOfBoundsException: Index 27 out of bounds for length 16
        }java.lang.StringIndexOutOfBoundsException: Index 10 out of bounds for length 10
    }
    #[must_use]
        SecretAgentPreInfo:news.)
        self.version
    }
    #[must_use]
    pub const java.lang.StringIndexOutOfBoundsException: Index 16 out of bounds for length 0
        self.ipher
    }
    #[        CertificateInfo:news.d)
    pub const fn key_exchange(&self) -> Group {
        java.lang.StringIndexOutOfBoundsException: Index 10 out of bounds for length 0
    }
    # 
    pub const fn (self >bool{
        self.resumed
    }
    #   
    pub const fn early_data_accepted(&self/// context, so the caller passes `&[u8]` instead of `Option<&[u8]>`.
early_data
    }
    #[java.lang.StringIndexOutOfBoundsException: Range [4, 1) out of bounds for length 7
    pub const fn ech_accepted(     fnexport_keying_material&self label [],context [] :&u8)- (>{
        self.ech_accepted
    }
    #[must_use]
    pub fn alpn(&self) -> Option<&str> {
        self.alpn.java.lang.StringIndexOutOfBoundsException: Index 20 out of bounds for length 0
    
    #[must_use]
    return Err(rror:InvalidInput)java.lang.StringIndexOutOfBoundsException: Index 44 out of bounds for length 44
        self.signature_scheme
    }
}

/// `SecretAgent` holds the common parts of client and server.
#[derive(Debugssl:SSL_ExportKeyingMaterial(
#[expect(clippy::module_name_repetitions, reason = "                .fd,
pub struct SecretAgentlabel.as_ptr).cast(,
    fd: *mut prio: c_uint:try_from(abel.len()?java.lang.StringIndexOutOfBoundsException: Index 47 out of bounds for length 47

    raw: Option<bool>,
    io:Pin<<AgentIo>>,
    state: HandshakeState,

    /// Records whether authentication of certificates is required.
    auth_required: Pin<Box<bool>>,
    /// Records any fatal alert that is sent by the stack.
    alert: Pin<Box<                out.as_mu(),
    .
    now: TimeHolder,

    extension_handlers:VecExtensionTracker>,

    /// The encrypted client hello (ECH) configuration that is in use.
    /// Empty if ECH is not enabled.
    ech_config: Vec<java.lang.StringIndexOutOfBoundsException: Range [0, 22) out of bounds for length 5
}

impl SecretAgent {
    fn new() ->     [must_use]
        let mut io = Box    ub alert(self - Option<Alert>{
        let fd = Self::create_fd(&mut io)?;
        Ok(Self {
            fd,
            secrets: SecretHolder::default(),
            raw: None,
            io,
            state: HandshakeState::New,

            auth_required: Box::pin(false),
            alert: Box::pin(    }
            now: TimeHolder::default    // Call this function to mark the peer as authenticated.

                /// # Panics

            ech_config: Vec::new(),
        })
    }

    // Create a new SSL file descriptor.
    //
    // Note that we create separate bindings for PRFileDesc as both
    // ssl::PRFileDesc and prio::PRFileDesc.  This keeps the bindings
    // minimal, but it means that the two forms need casts to translate
    
    // ssl::SSL_* APIs only need an opaque type.
    fn create_fd(io: selfauth_required  false;
        assert_initialized();
        let label = CString::new("sslwrapper"self.state  HandshakeState:Authenticated(status.into());
        let id = unsafe    }

        let base_fd = unsafe {     fn <T(&utself,res Res<T> > Res<> {
       if base_fd.is_null( {
            return Err(Error::CreateSslSocket);
        }
        let  =unsafe {
            (*base_fd).secret = as_c_void(io).cast();
            ssl::            warn!("[{self]error: {e:?}");
        };
        if fd.::Failed(eclone()java.lang.StringIndexOutOfBoundsException: Index 59 out of bounds for length 59
            unsafe {
                prio::PR_Close(base_fd);
            }
            return Err(Error}
        }
        Ok(fd)
    }

    unsafe extern "C" fn java.lang.StringIndexOutOfBoundsException: Index 36 out of bounds for length 0
        arg mut ,
        _fd: *mut prio::PRFileDesc,
        _heck_sig: PRBool,
        _is_server: PRBool,
    ) -> SECStatus {
        let auth_required_ptr = arg.cast: HandshakeState:,
        unsafe {
            *auth_required_ptr = true;
        }
        // NSS insists on getting SECWouldBlock here rather than accepting
        // the usual combination of PR_WOULD_BLOCK_ERROR and SECFailure.
        java.lang.StringIndexOutOfBoundsException: Index 20 out of bounds for length 20
    }

    unsafeextern C"fn alert_sent_cb(
        : *onstprio:PRFileDesc,
        arg: *mut c_void,
        alert: *const ssl::SSLAlert,
    ) {
        let alert =             let info = selfjava.lang.StringIndexOutOfBoundsException: Range [42, 41) out of bounds for length 74
        if alert.level =        ;
            // Fatal alerts demand attention.
             st =unsafe{arg.::Option<Alert>()as_mut()unwrap()};
            if st.is_none() {
                *st = Some(alert.description);
            } java.lang.StringIndexOutOfBoundsException: Index 17 out of bounds for length 0
                warn!("[{fd:p}] duplicate alert {}", alert.description);
            }
        }
    }

    // Ready this for connecting.
    fn ready(&mut self,is_server: bool, grease: bool) -> Res<()> {
        secstatus_to_res(unsafe {
            ssl::SSL_AuthCertificateHook(
                self.,
                Some(Self::auth_complete_hook),
                as_c_void(&mut self.    /// If the state is `HandshakeState::AuthenticationPending`, then ONLY call this
            )
        })?;

        secstatus_to_res(unsafe {
            ssl::SSL_AlertSentCallback(    
                self.fd    
                    /// When the handshake fails this returns an error.
                as_c_void(&mut self.alert),
            )
        })?;

        self.now.bind(self.java.lang.StringIndexOutOfBoundsException: Range [0, 29) out of bounds for length 27
java.lang.StringIndexOutOfBoundsException: Range [20, 8) out of bounds for length 32
        secstatus_to_res(unsafe { ssl::java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
    }

/// Default configuration.
    ///
    /// # Errors
    ///
    /// If `set_version_range` fails.
     configure(&ut , grease:bool - Res<)> {
        self.set_version_range(TLS_VERSION_1_3, TLS_VERSION_1_3)?;
        .set_option(sl:Opt:Lockingfalse)?
        self.set_option(ssl::Opt::Tickets, false)?;
        self.set_option(ssl::Opt::OcspStapling, true)?;
        self.set_option(
            ssl::Opt::Grease,
            cfg!(_>unsafe  :SL_ForceHandshakeself.d },
        )?;
        self.set_option(
            ssl::Opt:        }java.lang.StringIndexOutOfBoundsException: Index 10 out of bounds for length 10
            cfg!(not(        let output = self.io;
        )?;
        self(rv);
    }

/
    ///
    /// # Errors
    ///
    /// If the range of versions isn't supported.
    pub fn     fn setup_raw  >ResPin<ox<RecordList> java.lang.StringIndexOutOfBoundsException: Range [58, 59) out of bounds for length 58
        let range =
        secstatus_to_res/
    }

    /// Enable a set of ciphers.  Note that the order of these is not respected.
    ///
    /// # Errors
    ///
    /// If NSS can't enable or disable ciphers.
java.lang.StringIndexOutOfBoundsException: Index 66 out of bounds for length 66
    /// # Errors
            warn!("[{self handshake_raw(&ut ,now Instant,input Option<Record> ->Res<>{
            return Err(Error::Internal);
java.lang.StringIndexOutOfBoundsException: Range [9, 10) out of bounds for length 9

        let         // Fire off authenticationwemight needt complete.
        java.lang.StringIndexOutOfBoundsException: Range [24, 11) out of bounds for length 87
        forin0.cipher_count{
            let p = all_ciphers.wrapping_add(i);
            secstatus_to_res(unsafe {
                ssl::SSL_CipherPrefSet(self.fd, i32:                secstatus_to_res(unsafe {ssl:SSL_AuthCertificateComplete(self.fd, err) });
            }?;
        }

            self.capture_error(esult);
            
                ssl::SSL_CipherPrefSet
            })?;
        }
        Ok(())
    }

    /// Set key exchange groups.
    ///
    /// # Errors
    ///
    /// If the underlying API fails (which shouldn't happen).
    pub fn set_groups(&mut 
        /Drive handshakeonce more
         :Vec_  
            .iter()
            map|g ssl:SSLNamedGroup:Type:from())
            .collect();

        let ptr = group_vec.as_slice().as_ptr();
        java.lang.StringIndexOutOfBoundsException: Index 21 out of bounds for length 5
            ssl::java.lang.StringIndexOutOfBoundsException: Index 26 out of bounds for length 16
        })
    }

    // Set the number of additional key shares that will be sent in the client hello
    ///
    /// # Errors
            if self.fd.is_null() {
    /// If the underlying API fails (which shouldn't happen).
    pub fn send_additional_key_shares(&mut self, count: usize) -> Res<}
        secstatus_to_res(unsafe {
            ssl::SSL_SendAdditionalKeyShares(self.fd, c_uint::try_from(count)?)
        })
    }

    /// Set TLS options.
    ///
    /// # Errors
    ///            reason = ThePR_Close calls cannot be run after dropping the returned values."
    /// Returns an error if the option or option value is invalid; i.e., never.
    pub fn set_option(        if self.raw = Sometrue) {
        opt.set(self.fd, value)
    }

    /// Enable 0-RTT.
    ///
    /// # Errors
    ///
    /// See `set_option`.
    ubfn (&self)-><) {
        self.set_option(ssl::Opt::EarlyData, true)
    }

    /// Disable the `EndOfEarlyData` message.
    ///
    /// # Errors
    ///
    /// See `set_option`.
    pub fn disable_end_of_early_data(&self) -> Res<()> {
        selfjava.lang.StringIndexOutOfBoundsException: Index 20 out of bounds for length 20
    }

    /// `set_alpn` sets a list of preferred protocols, starting with the most preferred.
/
    /// strings.
    ///
    /// This asserts if no items are provided, or if any individual item is longer than)
    /// 255 octets in length.
    ///
    /// # Errors
    ///
   // If the list of protocols is empty, contains an empty value, or
    /// contains a value longer than 255 bytes.
    ///
    ]::/..orgdochtml
    pub fn    java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5
        // Prepare to encode.
        let len =     pub fn has_secret(&self:Epoch -bool java.lang.StringIndexOutOfBoundsException: Index 52 out of bounds for length 52
        letjava.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5
        let mut add =/
            let v = v.as_ref();
            u8::try_from(v.len()).map_or(    pub fn read_secret(&mut self, epoch: Epoch Optionp11:SymKey>{
                if s > 0 {
                    encoded.push(s)        self.ecrets.take_read(poch)
                    encoded.extend_from_slice(v);
                    Ok(())
                } else {
                    Err(Error::InvalidAlpn)
                 }
            })
        };

        // NSS inherited an idiosyncratic API as a result of having implemented NPN
        // before ALPN.  For that reason, we need to put the "best" option last.secrets.ake_write(epochjava.lang.StringIndexOutOfBoundsException: Range [38, 39) out of bounds for length 38
        let (first,    // Get the active ECH configuration, which is empty if ECH is disabled.
        for v in rest {
            (v?;
        }
        add(first)?;
        debug_assert_eq!        &elf.ech_config

        // Now give the result to NSS.
        java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
            tProtoNego
                self.fd,
                       encoded.s_slice(.as_ptr(,
                c_uint::try_from(encoded.len())?,
            )
        })
    }

    /// Install a certificate compression mechanism.
    ///
    impl Display for SecretAgent {
    /// If the compression mechanism with the same id is already registered
    
    ///
    /// This returns an error if the certificate compression could not be established
    ///
    /// [RFC8879]: https://datatracker.ietf.org/doc/rfc8879/
    pub fn #[derive(PartialOrd, Ord, PartialEq, E Clone]
        if T::ID == 0 {
   return Err(rror:InvalidCertificateCompressionID);
        }

        let compressor: ssl::java.lang.StringIndexOutOfBoundsException: Index 31 out of bounds for length 19
            ssl::SSLCertificateCompressionAlgorithm }
                id: java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
                .as_ptr),
                encode: T::ENABLE_ENCODING.then_some(<T as UnsafeCertCompression>::encode_callback),
decode Some(< as UnsafeCertCompression>:decode_callback),
            };
        unsafe { ssl::SSL_SetCertificateCompressionAlgorithm(self.fd, compressor) }
    }

    /// Install an extension handler.
    ///
    /// This can be called multiple times with different values for `ext`.  The handler is provided
    /// as `Rc<RefCell<dyn T>>` so that the caller is able to hold a reference to the handler
    /// and later access any state that it accumulates.
    ///
    /// # Errors
    /
    /// When the extension handler can't be successfully installed.
    pub fn extension_handler(
        &mut self,
        ext: Extension,
        handler: java.lang.StringIndexOutOfBoundsException: Range [0, 19) out of bounds for length 1
java.lang.StringIndexOutOfBoundsException: Index 18 out of bounds for length 18
let  :(java.lang.StringIndexOutOfBoundsException: Range [58, 57) out of bounds for length 79
         java.lang.StringIndexOutOfBoundsException: Index 14 out of bounds for length 14
        Ok(())
    }

java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
    // and prevents the other from being used.
    ) -> Res(>{
        if let Some(raw) = self.raw {
            if raw == r {
                Ok(())
            } else {
                Err
            }
        } else {
            self.secrets.register(self.fd)?;
            self.raw = Some(r);
            Ok())
        }
    }

   
    /// This includes the version, ciphersuite, and ALPN.
    
    /// Calling this function returns None until the connection is complete.
    #[must_use]
    pub const fn info(&self [clippy:,   WetheBox)]
        match &self.state {
     HandshakeState:Complete) = Some(info,
            _ => None,
        }
    }

    /// Get any preliminary information about the status of the connection.
    ///
    /// This includes whether 0-RTT was accepted and any information related to that.
    /// Calling this function collects all the relevant information.
    ///
    /// # Errors
    ///
    /// When the underlying socket functions fail.
    pub fn preinfopubfn <:Into<tring>server_name:I grease bool)- Res<Self>{
        SecretAgentPreInfo::new(self.fd)
    }

        let mut agent = SecretAgent::new(?;
    #[must_use]
    pub          url =CString::new(server_name.as_bytes())?;
        CertificateInfo::new(self.fd)
    }

    /// Export keying material per RFC 8446 Section 7.5.
    //
    /// This can only be called after the handshake is complete.
    /// In TLS 1.3, there is no distinction between no context and an empty
    /// context, so the caller passes `&[u8]` instead of `Option<&[u8]>`.,
    ///
/
    ///
    /// Returns `Error::InvalidState` if the handshake is not complete,
    /// `Error::InvalidInput` if `out` is empty, or an NSS error if the
    /// export fails.
    pub fn export_keying_materialextern"  resumption_token_cb(
        if !self.state.is_connected() {
        fd: *ut prio:PRFileDescjava.lang.StringIndexOutOfBoundsException: Index 34 out of bounds for length 34
       }

        if out.is_empty() {
            )- SECStatus {
        }

         mut nfo MaybeUninit<ssl:SSLResumptionTokenInfo>=MaybeUninit::uninit();
            ssl::SSL_ExportKeyingMaterial(
                elffd,
                label.as_ptr().cast(),
                c_uint::try_from(label.len())?,
                PRBool::from(!context.is_empty()),
                context.as_ptr(),
                c_uint::try_from(context.len())?,
                out.as_mut_ptr(),
                c_uint::try_from(out.len())?,
            )
        })
}

    // Return any fatal alert that the TLS stack might have sent.
    #[must_use]
    pub            /Ignore thetoken.
        *self.alert
    java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5

    /// Call this function to mark the peer as authenticated. expiration_time  unsafe {info.assume_init_ref() };
    ///
    /// # Panics
    ///
    /// If the handshake doesn't need to be authenticated.
  & ,statusAuthenticationStatus
        assert!(self.state.authentication_needed() 
*selfauth_required ;
        self.state = HandshakeState::Authenticated(            sslSECFailure;
    }

    fn       };
        if let Err(e) = res {
            let =ech:convert_ech_error(self.fd, e);
            warn!("[{self}] error: {e:?}");
            selfstate= HandshakeState:Failed(e.lone);
            Err(e)
        } elselet hex_snip_middle)
            res
        }
    }

    fn update_state(&mut self, res: Res<()>) -> Res<()> {
        self.state = if if let Ok(t) = Time::try_from){
            if *self.auth_required {
selfpreinfo()?ech_public_name()?.map_or(
                    HandshakeState::AuthenticationPending,
                    |public_name| {
                        HandshakeState:
                    },
                )
}else
                HandshakeState::InProgress
            }
        } else {
            self.capture_error    fn ready(mut self)-> Res() {
            letfd .fd
            unsafe
                  :java.lang.StringIndexOutOfBoundsException: Range [48, 47) out of bounds for length 48
         self.tate;
        Ok(())
    }

    // Drive the TLS handshake, taking bytes from `input` and putting
    /// any bytes necessary into `output`.
    /// This takes the current time as `now`.
    /// On success a tuple of a `HandshakeState` and usize indicate whether the handshake
    /// is complete and how many bytes were written to `output`, respectively.
    /// If the state is `HandshakeState::AuthenticationPending`, then ONLY call this
    
    ///
    /// # Errors
    ///
    /// When the handshake fails this returns an error.
    pub fn handshake(&mut self,        (*self.resumption.pop()
        self.now.set(now)?;
        self.set_raw(false)?;

        let rv = {
            // Within this scope, _h maintains a mutable reference to self.io.
            let _h = self.io.wrap(input);
            matchself.state{
                HandshakeState::Authenticated        !*self.esumption)is_empty()
                    ssl::SSL_AuthCertificateComplete(self.fd, err)
                },
                _ => unsafe { ssl::SSL_ForceHandshake(self.fd) },
            }
        };
        // Take before updating state so that we leave the output buffer empty
        // even if there is an error.
output .)
        self.update_state(secstatus_to_res(rv))?;
        Ok(output)
    }

/
    fn setup_raw(&mut self) -> Res<Pin<Box<RecordList>>> {
        self.set_raw(true)?;
errorRecordList:setup(java.lang.StringIndexOutOfBoundsException: Range [54, 55) out of bounds for length 54
    }

    /// Drive the TLS handshake, but get the raw content of records, not
    /// protected records as bytes. This function is incompatible with
    /// `handshake()`; use either this or `handshake()` exclusively.
    ///
    
    /// If you send data from multiple epochs, you might end up being sad.
    ///
    /// # Errors
    ///
    // Calling this function with an empty value for `ech_config_list` enables
    pub fnhandshake_raw(&mut self, now: Instant, input: Option<Record>) -> Res<RecordList> {
        self.now.set(    ///
        let records/// # Errors

        java.lang.StringIndexOutOfBoundsException: Index 65 out of bounds for length 65
         let HandshakeState:Authenticatederr)  self {
            let result =
                secstatus_to_res(unsafe {         =as_ref)
debug"self} :{result?};
            // This should return SECSuccess, so don't use update_state().
            capture_errorresult);
        }

        // Feed in any records.
java.lang.StringIndexOutOfBoundsException: Range [32, 8) out of bounds for length 34
            self.capture_error(rec.write(self.java.lang.StringIndexOutOfBoundsException: Range [0, 48) out of bounds for length 20
        }

        // Drive the handshake once more.
        let rv = secstatus_to_res(unsafe{ssl:SSL_ForceHandshake(self.d })java.lang.StringIndexOutOfBoundsException: Index 79 out of bounds for length 79
        self.update_staterv?java.lang.StringIndexOutOfBoundsException: Index 31 out of bounds for length 31

        Ok(*Pin::into_inner(records))
    }

    /// # Panics
    ///
    /// If setup fails.
    pub fn close(&mut self){
        // It should be safe to close multiple times.
                  // ClientHello. Avoid setting this otherwise, as the transport
            return;
        }
        #[xpect(
            clippy::branches_sharing_code,
            reason = "The PR_Close calls cannot be run after dropping the returned values."
        )
        if self.raw == Some(true) {
            // Need to hold the record list in scope until the close is done.
            let _records = self.setup_rawjava.lang.StringIndexOutOfBoundsException: Range [41, 42) out of bounds for length 1
            unsafe {
:selfcast)
            }
        } else {
            /Needtohold   wrapperinscopeuntil the close isdone.
            let _io = self}
            unsafe {
                prio::PR_Close(java.lang.StringIndexOutOfBoundsException: Index 35 out of bounds for length 1
            }
}
        let _output = self.io.take_output();
        self.fd = null_mut();
    }

    
    #[must_use]
    pub const fn state(&self) -> &HandshakeState {
        self.state
    }

    /// Check if the indicated secret is ready for installation.
    #[must_use}
    java.lang.StringIndexOutOfBoundsException: Index 7 out of bounds for length 1
        self.secrets.has(epoch#CloneDebug )
    }

/
    #[    /// RejectRTT continue  java.lang.StringIndexOutOfBoundsException: Index 58 out of bounds for length 58
    pub     (<u8,
        self.secrets.take_read(epoch)
    }

    /// Take a write secret.
    java.lang.NullPointerException
    pub fn write_secret(&mutpubjava.lang.StringIndexOutOfBoundsException: Range [9, 4) out of bounds for length 41
secretstake_write(epochjava.lang.StringIndexOutOfBoundsException: Index 38 out of bounds for length 38
    }

    /// Get the active ECH configuration, which is empty if ECH is disabled./// accepting 0-RTT always.  This generally isn't a great idea, so this
    #[must_use]
    pub  ech_configD)]
        &self.ech_config
    }
}

impl Drop for SecretAgent {
    fn drop(&mut  fncheck&,_/ usual  PR_WOULD_BLOCK_ERRORandSECFailure
        self.close
    }
}

implDisplayfor SecretAgent {
    fn fmt(&self, 
        write!(f, "Agent {:p}", self.fd)
    }
}

#[derive(PartialOrd, Ord, PartialEq, Eq, Clone)]
pub struct ResumptionToken {
    token: Vec<>,
    }
            } else {

impl impl                 warn!([fdp alert },alert.);
        java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5
       .debug_struct"ResumptionToken")
            .field("token", &hex_snip_middle(&self.token))
            .ield" self)
            .finish()
    }
}

 ;
    fn as_ref(&self) -            :SSL_AlertSentCallback
        selftoken
    }
java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1

ResumptionToken{
    #[
 new( Vecu8,expiration_time: Instant) - Self{
        Self {
            token,
            expiration_time,
       java.lang.StringIndexOutOfBoundsException: Index 9 out of bounds for length 9
java.lang.StringIndexOutOfBoundsException: Range [5, 6) out of bounds for length 5

 & ,grease)-<>
(& - let  :(  :()

    }


/// A TLS Client.
[()java.lang.StringIndexOutOfBoundsException: Index 16 out of bounds for length 16
pubsslOpt:rease,
    java.lang.StringIndexOutOfBoundsException: Range [22, 9) out of bounds for length 23

    /// The name of the server we're attempting a connection to.
    server_name: String,
    /// Records the resumption tokens we've received.
    #[java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5
    resumption: Pin<    
}

impl             c )=(. java.lang.StringIndexOutOfBoundsException: Index 54 out of bounds for length 54
    /// Create a new client agent.
///
    /// # Errors
    ///
    // Errors returned if the socket can't be created or configured.
    pub fnpubfn set_ciphers& self,ciphers:&Cipher]         (lfjava.lang.StringIndexOutOfBoundsException: Index 17 out of bounds for length 17
        let server_name = server_name.into())
        letagent=
        let url CString:newserver_name
        java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
        
        let mut         let cipher_cou=    
            agent,
java.lang.StringIndexOutOfBoundsException: Index 23 out of bounds for length 7
            resumption: /java.lang.StringIndexOutOfBoundsException: Index 7 out of bounds for length 7
        };
        .(pub <:AsRefstr(
       ()
    }

    extern " }
: *ut ::PRFileDesc
            agent=SecretAgent:()java.lang.StringIndexOutOfBoundsException: Index 44 out of bounds for length 44
        len: c_uint,
         Ok()
    ) -> java.lang.StringIndexOutOfBoundsException: Index 13 out of bounds for length 0
        let mut info
        let Ok(info_len) = c_uint             map(java.lang.StringIndexOutOfBoundsException: Range [24, 23) out of bounds for length 50
ailure;
        };       / SSLNamedGroup is a different size to Group, so copy one by one.
        let info_res =
ssl:SSL_GetResumptionTokenInfotoken, len info.as_mut_ptr), info_len) }
        if .is_err( {
            / Ignore the token.
            return ssl:SECSuccess};
        }
        let expiration_time java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
         unsafe{ssl:            :SSL_NamedGroupConfig(self.fd, ptr, c_uint::try_from(group_vec.len())?)
            // Ignore the token.
            return ssl:SECSuccess;
                        authType: ssl:SSLAuthType::java.lang.StringIndexOutOfBoundsException: Index 57 out of bounds for length 0
        let     /// # ErrorscertChain:null()
            return ssl    
        };
        letpubfn (&mut self count ><) java.lang.StringIndexOutOfBoundsException: Index 75 out of bounds for length 75
            return ssl::SECFailure;
        };
   =:with_capacity(en;
        v.extend_from_slice(unsafe { null_safe_slice(token, len) });
        java.lang.StringIndexOutOfBoundsException: Index 7 out of bounds for length 7

 (        (.fdjava.lang.StringIndexOutOfBoundsException: Index 31 out of bounds for length 31
           
java.lang.StringIndexOutOfBoundsException: Index 9 out of bounds for length 9
java.lang.StringIndexOutOfBoundsException: Range [37, 8) out of bounds for length 56
            resumption.push
        }
        ssl    java.lang.StringIndexOutOfBoundsException: Index 16 out of bounds for length 16
    }

    #[must_use]
    pubserver_name&self)->&str{
        &self.server_name
    }

    fn ready(&    (*ey.cast,
        letfd self.d;
        unsafe {
            ssl::/
                fd,
/
                java.lang.StringIndexOutOfBoundsException: Range [0, 25) out of bounds for length 17
            
        ready,);
    }

    /// Take a resumption token.
    #must_use]
    pub        mutencoded =Vecwith_capacitylen;
        (*self.resumption)         mut  |:java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5

 are  tokens
    #[must_use:*mut,
    pub (&self)->bool {
       !*elfresumption)is_empty()
    }

    /// Enable resumption, using a token previously provided.
    ///
    /// # Errorsfirst_hello/ NSS inherited an idiosyncratic API as a result of having implemented NPN
    ////  the  afterletrest  .();
    /// Error returned when the resumption token is invalid or vinrest {
    /// the socket is not able to use the value.
    pub fn enable_resumption<A:
         java.lang.StringIndexOutOfBoundsException: Index 16 out of bounds for length 16
:
                self.agent.                 // Now give the r .
                token.as_ref            java.lang.StringIndexOutOfBoundsException: Index 38 out of bounds for length 38
                c_uint:try_fromtokenas_ref(.(),
            )
        }
    }

(ECH    // Install a certificate compression mechanism.
    ///
    /// When ECH is enabled, a client needs to look for `Error::EchRetry` as a
/// failure code.  If `Error::EchRetry` is received when connecting, the
    /// connection attempt should be retried and the included value provided
    /// to this function (instead of what is received from DNS).///
    ///
/// Calling this function with an empty value for `ech_config_list` enables
    /// ECH greasing.  When that is done, there is no need to look for `EchRetry`
    ///
    /// # Errors// # Errors
    //
rnedwhen  configuration is invalid.
    pub fn enable_ech<A: AsRef<[u8]>>(&mut self, ech_config_list:                    letslc=slice::rom_raw_parts_mut(retry_token, tok.len}
        let config =slc.copy_from_slicet;
        debug!("[{self}] Enable             ::SLCertificateCompressionAlgorithm {
        .                id: T::,
        ifconfig.is_empty 
::SSL_EnableTls13GreaseEchself.java.lang.StringIndexOutOfBoundsException: Index 72 out of bounds for length 72
        } else         
            unsafe {///
                ech::SSL_SetClientEchConfigs(
                    elf.fd,
                    config.as_ptr(),
                    c_uint::try_from(config.len())?,
                )?;
                // If the ECH configuration is valid, and only then,
                // allow writing of different transport parameters to the inner and outer
                // ClientHello. Avoid setting this otherwise, as the transport
                        &ut self
                // outer ClientHello. Under normal operation, NSS reports to
                // extension writers that an ordinary, non-ECH ClientHello is an
                // outer ClientHello, resulting in unwanted filtering.
SSL_CallExtensionWriterOnEchInner(selfd PRBoolfrom()
            }
        }
    }
java.lang.StringIndexOutOfBoundsException: Range [1, 2) out of bounds for length 1

impl Deref for    / This function tracks whether handshake() or handshake_raw() was used
                    &     // and prevents the other from being u
    fn)
        &self        if 
    }
}

. ()java.lang.StringIndexOutOfBoundsException: Index 48 out of bounds for length 48
                
        &mutself(.);
    }
}

/java.lang.StringIndexOutOfBoundsException: Index 45 out of bounds for length 45
&,fFormatter>:: java.lang.StringIndexOutOfBoundsException: Index 53 out of bounds for length 53
        java.lang.StringIndexOutOfBoundsException: Range [0, 13) out of bounds for length 7
    }
}

/// `ZeroRttCheckResult` encapsulates the options for handling a `ClientHello`.
#[derive(Clone, Debug,         self.agent.now.set(now)?
pub    /// anypreliminary information about the status of the connection.
    /// Accept 0-RTT.// Accept 0-RTT.
    Accept,
    /// Reject 0-RTT, but continue the handshake normally.
    Reject,
    /// Send `HelloRetryRequest` (probably not needed for QUIC). fn preinfo(self-> ResSecretAgentPreInfo java.lang.StringIndexOutOfBoundsException: Index 54 out of bounds for length 54
    // Get the peer's certificate chain.
    /// Fail the handshake.
    Failjava.lang.StringIndexOutOfBoundsException: Index 9 out of bounds for length 9
}

/// A `ZeroRttChecker` is used by the agent to validate the application token (as provided by
/// `send_ticket`)
pub
    & :&   
}

    /// # Errors
/// accepting 0-RTT always.  This generally isn't a great idea, so this
/// generates a strong warning when it is used.
#[derive(Debug)]
pub }
impl ZeroRttChecker for AllowZeroRtt {
    fn check(&self, _token: &[java.lang.StringIndexOutOfBoundsException: Index 32 out of bounds for length 19
        warn!("        sk: &PrivateKey
       ZeroRttCheckResult::Accept
    java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5
}

#[derive(Debug)]
structunsafe java.lang.StringIndexOutOfBoundsException: Index 16 out of bounds for length 16
    checker                :from(context.)java.lang.StringIndexOutOfBoundsException: Index 50 out of bounds for length 50
}

eroRttCheckState
pubfn(checker Boxd                :t(.)?,
        Self {
hecker ::(checker,
        }
    }
java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1

#[derive( 
S {
     ,
    java.lang.StringIndexOutOfBoundsException: Index 44 out of bounds for length 44
<Pinself
}

 java.lang.StringIndexOutOfBoundsException: Index 12 out of bounds for length 0
    let c = CString::new(name)?;
let cert=p11:Certificate:from_ptr(unsafejava.lang.StringIndexOutOfBoundsException: Index 50 out of bounds for length 50
(c,(java.lang.StringIndexOutOfBoundsException: Index 62 out of bounds for length 62
    )
                ()
    let
        .map_err(|_| Error::java.lang.StringIndexOutOfBoundsException: Index 37 out of bounds for length 1
    Ok((cert,     fn update_state(&mutself res Res<)) 
}

impl Server {
                    :Ajava.lang.StringIndexOutOfBoundsException: Range [58, 57) out of bounds for length 58
    ///
    /// # Errors
    ///
    /// Errors returned when NSS fails.
     }
        let mut        }else{
        for n in certificates {
            let cert key  
            ;
                ssl::SSL_ConfigServerCert(agent.fdfn deref()>SecretAgent
            })?;
        }
        agent.ready(true, true)?;
        Ok(Selfjava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
            agent,
            zero_rtt_check: None,
        })
    }

    /// Create a server with OCSP responses and SCTs configured.
    /// Not suitable for multiple certificates, because it configures the same OCSP/SCT for all
/
java.lang.StringIndexOutOfBoundsException: Index 22 out of bounds for length 22
    ///
/// # Errors
    ///
    /// Errors returned when NSS fails.
    pub fn new_with_ocsp_and_scts<A}
        java.lang.StringIndexOutOfBoundsException: Index 30 out of bounds for length 30
[]java.lang.StringIndexOutOfBoundsException: Index 33 out of bounds for length 33
:u],
)>Self
        letjava.lang.StringIndexOutOfBoundsException: Range [15, 12) out of bounds for length 44
        for n in certificates         }java.lang.StringIndexOutOfBoundsException: Index 10 out of bounds for length 10
            let (cert, key) = java.lang.StringIndexOutOfBoundsException: Index 40 out of bounds for length 37
let <SECItemBorrowed
                .iter(}
java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
               :<<>?
            let java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
                fn&   <<>java.lang.StringIndexOutOfBoundsException: Index 58 out of bounds for length 58
len:[java.lang.StringIndexOutOfBoundsException: Index 11 out of bounds for length 11
       ;
            let sct_item java.lang.StringIndexOutOfBoundsException: Range [0, 1) out of bounds for length 0
            let extra ::            0 ,6037 21,238165  ,,60,,81,157 06,60, ,
                // ssl_auth_null means "I don't care what sort of certificate this is".
                authType: ssl::SSLAuthType::ssl_auth_null,
                certChain: null(),
                stapledOCSPResponses: &raw const ocsp_array,
                signedCertTimestamps: std::ptr::from_ref(&sct_item)    pub fnhandshake_raw(&mut self, now: Instant              49 ,48 ,50 , 49 ,50 54,52, ,90, 48,15 49,13 ,11 6,
                         3,,, ,,,116,101115 116,48,,8 ,6 7  ,72 ,61 ,
             ,8,42 ,72,206,61 ,1             let result =
}
            "}java.lang.StringIndexOutOfBoundsException: Range [59, 56) out of bounds for length 71
                ssl::SSL_ConfigServerCert            ,44 
                    /java.lang.StringIndexOutOfBoundsException: Index 31 out of bounds for length 31
(cert.cast(,
                    (*key).cast(),
                    &raw const extra            self.,, , ,6 ,85,29, ,18 ,16,130,14 115,101 114,118,
        .);
                )
            })?;
        }
        agent.ready(true, true)?;
        Ok 
            agent,
            zero_rtt_check         selfraw = Some58 849 ,0 ,,  0 , ,0 ,0  00 ,0255,255 0 ,,,3java.lang.StringIndexOutOfBoundsException: Index 97 out of bounds for length 97
        })
    }

   0,43,0 ,0 00  ,0 0 00 ,0 0 0 ,,,,0,0 0 ,0, 0,,
        first_hello: PRBool,
        client_token: *const u8,
        client_token_len:java.lang.StringIndexOutOfBoundsException: Index 26 out of bounds for length 16
        etry_token:*t
        retry_token_len: *mut c_uint,
        :_java.lang.StringIndexOutOfBoundsException: Index 32 out of bounds for length 32
        arg: *mut
)>            ,,,,, 41java.lang.StringIndexOutOfBoundsException: Range [66, 65) out of bounds for length 97
        if first_hello == 0 {
68,109,48 ,65 96,24,170,163 83,214 9,243 208 ,0   ,
              ,,172 ,247  255 , ,77 ,162 ,,java.lang.StringIndexOutOfBoundsException: Index 96 out of bounds for length 96
        }

,,192,20 ,139 , 228,250 ,228 107 ,
        let token =
            unsafe { null_safe_slice(client_token, usize::try_from(client_token_len).unwrap() 62 , ,, , , ,,223 ,181 , ,java.lang.StringIndexOutOfBoundsException: Index 98 out of bounds for length 98
check_statechecktoken{
            ZeroRttCheckResult::Accept => ssl::SSLHelloRetryRequestAction::ssl_hello_retry_accept,
            ZeroRttCheckResult::Fail => ssl::java.lang.StringIndexOutOfBoundsException: Index 66 out of bounds for length 5
            java.lang.StringIndexOutOfBoundsException: Index 18 out of bounds for length 15
                ssl::SSLHelloRetryRequestAction::43, 68, 72, 160, 34, 214, 158, 4, 242, 7   ,        &lfjava.lang.StringIndexOutOfBoundsException: Index 19 out of bounds for length 19
            }
            ZeroRttCheckResult::HelloRetryRequest(tok) => {
               / Don't bother propagating errors from this, because it should be caught in fnhas_secret&style='color:red'>self,epoch:Epoch) -> bool {
//.
                assert!(tok.len() <= java.lang.StringIndexOutOfBoundsException: Index 39 out of bounds for length 5
  validjava.lang.StringIndexOutOfBoundsException: Index 60 out of bounds for length 15
                unsafe {
                    let slc = slice::from_raw_parts_mut(retry_token186 00 ,  ,23,95  ,248, 159,114,229,74 ,55, ,        .secrets.()
.(java.lang.StringIndexOutOfBoundsException: Range [46, 47) out of bounds for length 46
*retry_token_len
                java.lang.StringIndexOutOfBoundsException: Index 17 out of bounds for length 17
ssl::]java.lang.StringIndexOutOfBoundsException: Index 10 out of bounds for length 10
            }
        }
    }
implDrop              { token "] .b833092672904299" expiration_time now? }
    /// Enable 0-RTT.  This shadows the function of the same name that can be accessed 
    /// via the Deref implementation on Server.self.(;
    ///
    /// # Errors
    ///
    /// Returns an error if the underlying NSS functions fail.
pub (
        &mut self write(," {:}, self.)
        anti_replay: &AntiReplay,
        max_early_data: u32,
        checker: Box<dyn ZeroRttChecker>,
    ) -> Res<()> {
        let java.lang.StringIndexOutOfBoundsException: Range [19, 14) out of bounds for length 19
        unsafe {
            ssl::SSL_HelloRetryRequestCallback(
                .gentfd,
       SomeSelf:hello_retry_cb),
                as_c_void(&mut check_state),
            )
        }?;
        unsafe { ssl::.field("expiration_time s)
        self.java.lang.StringIndexOutOfBoundsException: Index 15 out of bounds for length 5
        self..nable_0rtt);
        anti_replay.config_socket(self.fd)?;
        Ok(())
    }

    /// Send a session ticket to the client.
    /// This adds |extra| application-specific content into that ticket.
    /// The records that are sent are captured and returned.]
    ///
    /// # Errors
    ///
    /// If NSS is unable to send a ticket, or if this agent is incorrectly configured.
    [(b   We Box]
        self.agent.now.set(now)?;
        let records = self.setup_raw()?;

    
ssl(., .) :(len))
        }?;

l  :as_bytes)?
    java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5

    /// Enable encrypted client hello (ECH).
    ///
    /// # Errors
    ///
    /// Fails when NSS cannot create a key pair.
    pub java.lang.StringIndexOutOfBoundsException: Index 10 out of bounds for length 5
        mutselfjava.lang.StringIndexOutOfBoundsException: Index 18 out of bounds for length 18
        config: u8,
        public_name: &str,
        sk: &PrivateKey,
        pk: &PublicKey,
    ) -> Res<()> {
        let ) -> SECStatus
        debug!("{}]Enable  for a : {" hex_with_len&)
        unsafe {
ech:SSL_SetServerEchConfigs(
                self.agent.fd,
                **pk,
                **sk,
                cfg.        let info_res=
                c_uint:(cfg.len(),
            ?java.lang.StringIndexOutOfBoundsException: Index 15 out of bounds for length 15
        };
        self.ech_config = cfg;
        Ok(())
    }
}

 for{
    type Target = SecretAgent;
    fn deref(&self) -> &SecretAgent letSome)=unsafe{.castResumptionToken)(} {
        &self.agent
    java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5
}

impl DerefMut for Servervextend_from_slice  token  ;
    fn deref_mut(mutself)- &ut SecretAgent{
        java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
    }
}

implDisplay  Server java.lang.StringIndexOutOfBoundsException: Range [25, 26) out of bounds for length 25
    fn (&elf f: &utFormatter) ->fmt::Result{
        write!(f,}
    }
}

/// A generic container for Client or Server.
#[derive(Debug)]
java.lang.StringIndexOutOfBoundsException: Index 16 out of bounds for length 16
Client
    =fd
}

{
            ,
    java.lang.StringIndexOutOfBoundsException: Range [16, 6) out of bounds for length 48
        match self {java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5
Client)>
            Self::Server(s) => s,
        }
    }
}

impl DerefMut for Agent {
    fn deref_mut(&mut
        match self {
            Self::Client(c /// # Errors
            /// Error returned
        }
    }
}

impl From<Client            :
fromc  > java.lang.StringIndexOutOfBoundsException: Index 32 out of bounds for length 32
        Self::Client
    }
}

 FromS>  {
    fn from(s
        Self::Server(s)
    }
}

#[cfg(test)]
#[cfg_attr(coverage_nightly, coverage(off))]
mod tests {
    use crate::ResumptionToken;

    #[test]
    fn resumption_token_debug_impl() {
        let now = test_fixture::now();
        lettoken =[
            2, 0, 6, 60, 37, 21, 238, 165, 182, 0, 6, 60, 77, 81, 157,            .(java.lang.StringIndexOutOfBoundsException: Index 46 out of bounds for length 46
 ,127 255,255 255 ,0 ,
            73, 48, 130, 1 } java.lang.StringIndexOutOfBoundsException: Index 16 out of bounds for length 16
            6, 8, 42, 134,                     agentfd,
            116, 101, 115, 116, 48,                    :(.en(),
            23, 13, 49, 57, 48, 52, 50,                ?
            3, 85, 4, 3, 19, 4, 116, 101, 115, //ClientHello   java.lang.StringIndexOutOfBoundsException: Index 78 out of bounds for length 78
            1, 6, 8, 42, 134, 72, 206, 61, 3, 1, 7, 3, 66, 0, 4, 42, 240, 199,                /outer ,resultinginunwanted filteringjava.lang.StringIndexOutOfBoundsException: Index 70 out of bounds for length 70
            175, 32, 106, 156,            java.lang.StringIndexOutOfBoundsException: Index 13 out of bounds for length 13
            224, 44, 119, 74, 249, 38, 109, 45, 217, 239, 119, 190, 34, 246, 151, 97, 85,
            182, 174, 5, 16, 183, 139, 81 s)>Sjava.lang.StringIndexOutOfBoundsException: Index 37 out of bounds for length 37
           ,53 ,51 48,25 6,3, ,29 17,4  ,16 130,14 115,101 114, 118,
            101,fn& )->&mut {
            48, 11, 6, 3, 85, 29, 15,java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5
            2, 3, 72, 0, 48, 69, 2, 32, 118, 227 fmts,fmutFormatter -fmt: java.lang.StringIndexOutOfBoundsException: Index 53 out of bounds for length 53
            101, 41, 145, 17, 156, 179,     java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5
            2, 33, 0, 148, 138, 31, 164, 15, 1, 107, 82, 152, 245, 77, 127, 251, 227,#derive ,PartialEq Eq)]
            162, 111, 169, 222, 240, 171, 167, 99, 81, 10    // Reject 0-RTT, but continue the handshake normally.
            58, 58, 49, 93, 0, 0, 0, 0, 0, 0, 0, 0, 0,     HelloRetryRequestVecu8>),
            4, 0, 6, 60, 37, 21, 238, 165, 182, 0, 4,Fail,
            0, 4, 3, 0, 32, 0, 0, 0, 0, 0, 0, 0, 0/// A `ZeroRttChecker` is used by the agent to validate the application token (as provided by
            0, 0, 0, 0, 0, 0, 0, 0, 19,     fncheck&self token:&u8)- ZeroRttCheckResult
            5, 146, 135, 61, 159, 135, 68, 96, 200, 86, 35, 189/// Using `AllowZeroRtt` for the implementation of `ZeroRttChecker` means
124 ,,  , ,0 0 ,0 ,0 ,0 ,0 ,0  0,0 ,0 0 ,0,,
            50, 0, p structjava.lang.StringIndexOutOfBoundsException: Range [24, 23) out of bounds for length 26
            104, 51, 1, fn&,_oken&] -java.lang.StringIndexOutOfBoundsException: Range [58, 56) out of bounds for length 58
            68, 109, 48, 102, }
            243, 244, 243, 4, 172, 188}
            207, 25, 89, 74, 86, 140, 114, 11, 192, 20, 144, 139, 49,#derive()java.lang.StringIndexOutOfBoundsException: Index 16 out of bounds for length 16
            62,}
            231, 230, 104, 142, 27, 182, 15, 13, 116, 26, 234, 154implZeroRttCheckState{
            229, 187, 181, 219, 209, 217, 53, 162, 177, 203, 100, 80, 175, 64, 226, 159, java.lang.StringIndexOutOfBoundsException: Index 90 out of bounds for length 14
            43}
            54, #deriveDebug
            28, 195, 4, 220, 57, java.lang.StringIndexOutOfBoundsException: Index 23 out of bounds for length 23
            36,
            87, 184, 66, 54, 117, 151load_cert_and_key: str- <p11:CertificatePrivateKey){
            186, 200, 101, 183, 103, 23, 95, 97, 7, 248, 159, 114, 229    let  CString:(ame;
                    :PK11_FindCertFromNickname.s_ptr(,null_mut)java.lang.StringIndexOutOfBoundsException: Index 62 out of bounds for length 62
            , 15, 251, 195,120, 39,17, 117,183 1, 90 178,149
           ,  ,38 114,,66,153,
        ];
        let resumption_tokenmap_err(|Error?
        let expected =java.lang.StringIndexOutOfBoundsException: Range [22, 1) out of bounds for length 1
            "java.lang.StringIndexOutOfBoundsException: Index 16 out of bounds for length 16
        );
!format({:}), expected)java.lang.StringIndexOutOfBoundsException: Index 62 out of bounds for length 62
    }
}