Adds InMemoryQuicPipe — a quiche-Pipe-style harness that runs a real
QuicConnection through the full handshake without touching the network.
The "server" side wraps InProcessTlsServer in QUIC packet protection
(Initial + Handshake long-header packets) and routes CRYPTO bytes
between the layers. Direct port of the pattern from
quiche/src/test_utils.rs (`Pipe`).
InMemoryQuicPipeTest.client_connection_reaches_connected_via_in_memory_pipe
verifies the full client receive path:
- ClientHello at Initial level → server decrypts, drives TLS, replies
- Server Initial packet (ServerHello) → client decrypts, derives handshake keys
- Server Handshake packets (EE + Finished) → client verifies, derives 1-RTT keys
- Client Finished at Handshake level → server verifies
- Client status flips to CONNECTED, both directions of 1-RTT keys installed
This is the test category three of the four mature QUIC implementations
surveyed have or rely on:
- quiche's `Pipe` is the gold standard (we ported it here)
- quic-interop-runner is the network-level equivalent (Docker matrix)
- kwik notably does NOT have one — uses Mockito + reflection instead
It catches the largest class of bugs: wrong layer-to-layer wiring (e.g.
TLS layer derives keys but QUIC layer doesn't install them, the
hardcoded-cipher-suite C1 bug, AckTracker PN bug C2 across coalesced
packets). Future tests can build on it: stream send/receive, datagram
round-trip, flow-control stall, retransmission once we add it.
Pipe currently supports AES-128-GCM only; ChaCha20 path validation is
covered by TlsRoundTripTest at the TLS layer for now.
https://claude.ai/code/session_01EC1tfXfap8k8GyKvrxkxZx
Claude
02b03e143b