tls_mock_server.cc

Go to the documentation of this file.

/*
 * Copyright (C) Max Dymond, <cmeister2@gmail.com>, et al.
 *
 * SPDX-License-Identifier: curl
 */

 
#include "proto_fuzzer/tls_mock_server.h"
 
#include <openssl/bio.h>
#include <openssl/ech.h>
#include <openssl/err.h>
#include <openssl/ssl.h>
#include <sys/socket.h>
 
#include <cstddef>
#include <cstring>
#include <string>
#include <vector>
 
#include "proto_fuzzer/tls_test_credential_cache.h"
#include "proto_fuzzer/tls_test_credentials.h"
 
namespace proto_fuzzer {
 
namespace {
 
constexpr std::size_t kMaxSessionExportAttempts = 8;
constexpr std::size_t kMaxSessionHashSize = 128;
constexpr std::size_t kMaxSessionDataSize = 16 * 1024;

bool CurlClientUsesOpenSsl() {
  const curl_version_info_data* version = curl_version_info(CURLVERSION_NOW);
  constexpr char kOpenSslPrefix[] = "OpenSSL/";
  return version != nullptr && version->ssl_version != nullptr &&
         std::strncmp(version->ssl_version, kOpenSslPrefix, sizeof(kOpenSslPrefix) - 1) == 0;
}

struct ExportedSession {
  std::vector<unsigned char> salted_hash;
  std::vector<unsigned char> session_data;
};

CURLcode CaptureExportedSession(CURL* /*easy*/, void* user_data, const char* /*session_key*/,
                                const unsigned char* salted_hash, std::size_t salted_hash_size,
                                const unsigned char* session_data, std::size_t session_data_size,
                                curl_off_t /*valid_until*/, int /*ietf_tls_id*/, const char* /*alpn*/,
                                std::size_t /*early_data_max*/) {
  auto* exported = static_cast<ExportedSession*>(user_data);
  if (!exported->session_data.empty() || salted_hash == nullptr || salted_hash_size == 0 ||
      salted_hash_size > kMaxSessionHashSize || session_data == nullptr || session_data_size == 0 ||
      session_data_size > kMaxSessionDataSize) {
    return CURLE_OK;
  }
  exported->salted_hash.assign(salted_hash, salted_hash + salted_hash_size);
  exported->session_data.assign(session_data, session_data + session_data_size);
  return CURLE_OK;
}

class OpenSslErrorQueueGuard {
 public:
  OpenSslErrorQueueGuard() { ERR_clear_error(); }
 
  ~OpenSslErrorQueueGuard() { ERR_clear_error(); }
 
  OpenSslErrorQueueGuard(const OpenSslErrorQueueGuard&) = delete;
  OpenSslErrorQueueGuard& operator=(const OpenSslErrorQueueGuard&) = delete;
};

int SelectAlpn(SSL* /*ssl*/, const unsigned char** selected, unsigned char* selected_length,
               const unsigned char* client_protocols, unsigned int client_protocols_length, void* userdata) {
  const auto protocol = *static_cast<const TlsApplicationProtocol*>(userdata);
  // OpenSSL may return a pointer into the server preference list. Function-
  // local static storage keeps that result valid for the rest of the
  // handshake without reintroducing mutable transport policy as a global.
  static constexpr unsigned char http11_alpn[] = {8, 'h', 't', 't', 'p', '/', '1', '.', '1'};
  static constexpr unsigned char http2_alpn[] = {2, 'h', '2'};
  const unsigned char* server_protocols = protocol == TlsApplicationProtocol::kHttp2 ? http2_alpn : http11_alpn;
  const unsigned int server_protocols_length =
      protocol == TlsApplicationProtocol::kHttp2 ? sizeof(http2_alpn) : sizeof(http11_alpn);
  unsigned char* match = nullptr;
  unsigned char match_length = 0;
  const int result = SSL_select_next_proto(&match, &match_length, server_protocols, server_protocols_length,
                                           client_protocols, client_protocols_length);
  if (result != OPENSSL_NPN_NEGOTIATED) {
    return SSL_TLSEXT_ERR_NOACK;
  }
  *selected = match;
  *selected_length = match_length;
  return SSL_TLSEXT_ERR_OK;
}
 
}  // namespace

class TlsServerContext {
 public:
  // Doxygen's no-preprocessing pass would see both conditional body openings.
  // Skip this implementation-only constructor to preserve the enclosing scope.
  TlsServerContext(TlsApplicationProtocol protocol, curl::fuzzer::proto::TlsCertificateChainProfile certificate_chain,
                   TlsGroupPolicy group_policy)
      : context_(nullptr),
        protocol_(protocol),
        group_policy_(group_policy),
        negotiated_tls_version_(0),
        completed_handshake_count_(0),
        reused_session_count_(0),
        write_retry_count_(0),
#ifndef OPENSSL_NO_ECH
        ech_status_(SSL_ECH_STATUS_NOT_TRIED) {
#else
        ech_status_(-1) {
#endif
    OpenSslErrorQueueGuard error_guard;
    context_ = SSL_CTX_new(TLS_server_method());
    if (context_ == nullptr || !ApplyGroupPolicy() || !InstallCachedTlsTestCredentials(context_, certificate_chain) ||
        !LoadEchConfig()) {
      SSL_CTX_free(context_);
      context_ = nullptr;
      return;
    }
 
    (void)SSL_CTX_set_min_proto_version(context_, TLS1_2_VERSION);
    (void)SSL_CTX_set_options(context_, SSL_OP_NO_COMPRESSION);
    (void)SSL_CTX_set_session_cache_mode(context_, SSL_SESS_CACHE_SERVER);
    constexpr unsigned char session_id_context[] = "curl-fuzzer";
    (void)SSL_CTX_set_session_id_context(context_, session_id_context, sizeof(session_id_context) - 1);
    SSL_CTX_set_alpn_select_cb(context_, &SelectAlpn, &protocol_);
  }
 
  ~TlsServerContext() {
    OpenSslErrorQueueGuard error_guard;
    SSL_CTX_free(context_);
  }
 
  TlsServerContext(const TlsServerContext&) = delete;
  TlsServerContext& operator=(const TlsServerContext&) = delete;

  SSL_CTX* get() const { return context_; }

  void RecordHandshake(SSL* ssl) {
    if (ssl == nullptr) {
      return;
    }
    negotiated_tls_version_ = SSL_version(ssl);
    const unsigned char* alpn = nullptr;
    unsigned int alpn_length = 0;
    SSL_get0_alpn_selected(ssl, &alpn, &alpn_length);
    if (alpn != nullptr && alpn_length != 0) {
      negotiated_alpn_.assign(reinterpret_cast<const char*>(alpn), alpn_length);
    } else {
      negotiated_alpn_.clear();
    }
    ++completed_handshake_count_;
    if (SSL_session_reused(ssl) == 1) {
      ++reused_session_count_;
    }
    const int negotiated_group = SSL_get_negotiated_group(ssl);
    const char* group_name = negotiated_group == 0 ? nullptr : SSL_group_to_name(ssl, negotiated_group);
    negotiated_group_ = group_name == nullptr ? std::string() : group_name;
#ifndef OPENSSL_NO_ECH
    char* inner_name = nullptr;
    char* outer_name = nullptr;
    ech_status_ = SSL_ech_get1_status(ssl, &inner_name, &outer_name);
    ech_inner_name_ = inner_name == nullptr ? std::string() : inner_name;
    ech_outer_name_ = outer_name == nullptr ? std::string() : outer_name;
    OPENSSL_free(inner_name);
    OPENSSL_free(outer_name);
#endif
  }

  void RecordWriteRetry() { ++write_retry_count_; }

  int negotiated_tls_version() const { return negotiated_tls_version_; }
  std::size_t completed_handshake_count() const { return completed_handshake_count_; }
  std::size_t reused_session_count() const { return reused_session_count_; }
  std::size_t write_retry_count() const { return write_retry_count_; }
  const std::string& negotiated_alpn() const { return negotiated_alpn_; }
  const std::string& negotiated_group() const { return negotiated_group_; }
  TlsApplicationProtocol protocol() const { return protocol_; }
  int ech_status() const { return ech_status_; }
  const std::string& ech_inner_name() const { return ech_inner_name_; }
  const std::string& ech_outer_name() const { return ech_outer_name_; }
 
 private:
  bool ApplyGroupPolicy() {
    switch (group_policy_) {
      case TlsGroupPolicy::kProviderDefault:
        return true;
      case TlsGroupPolicy::kX25519:
        return SSL_CTX_set1_groups_list(context_, "X25519") == 1;
    }
    return false;
  }

  bool LoadEchConfig() {
#ifndef OPENSSL_NO_ECH
    BIO* ech_bio = BIO_new_mem_buf(tls_test_credentials::kEchConfigPem, -1);
    OSSL_ECHSTORE* store = OSSL_ECHSTORE_new(nullptr, nullptr);
    if (ech_bio == nullptr || store == nullptr) {
      BIO_free(ech_bio);
      OSSL_ECHSTORE_free(store);
      return false;
    }
    const bool loaded =
        OSSL_ECHSTORE_read_pem(store, ech_bio, OSSL_ECH_NO_RETRY) == 1 && SSL_CTX_set1_echstore(context_, store) == 1;
    BIO_free(ech_bio);
    OSSL_ECHSTORE_free(store);
    return loaded;
#else
    return true;
#endif
  }
 
  SSL_CTX* context_;
  TlsApplicationProtocol protocol_;
  const TlsGroupPolicy group_policy_;
  std::string negotiated_alpn_;
  std::string negotiated_group_;
  int negotiated_tls_version_;
  std::size_t completed_handshake_count_;
  std::size_t reused_session_count_;
  std::size_t write_retry_count_;
  int ech_status_;
  std::string ech_inner_name_;
  std::string ech_outer_name_;
};
 
namespace {

class TlsMockConnection final : public MockConnection {
 public:
  explicit TlsMockConnection(TlsServerContext* context)
      : ssl_(nullptr),
        context_(context),
        pending_offset_(0),
        pending_write_end_(0),
        handshake_complete_(false),
        shutdown_requested_(false),
        write_shutdown_(false),
        failed_(false) {
    InitializeSsl();
  }
 
  TlsMockConnection(TlsServerContext* context, int accepted_fd)
      : MockConnection(accepted_fd),
        ssl_(nullptr),
        context_(context),
        pending_offset_(0),
        pending_write_end_(0),
        handshake_complete_(false),
        shutdown_requested_(false),
        write_shutdown_(false),
        failed_(false) {
    InitializeSsl();
  }
 
  ~TlsMockConnection() override {
    OpenSslErrorQueueGuard error_guard;
    if (ssl_ != nullptr) {
      SSL_free(ssl_);
    }
  }

  bool ok() const override { return MockConnection::ok() && ssl_ != nullptr; }

  bool WriteAll(const unsigned char* data, std::size_t size) override {
    if (failed_ || (data == nullptr && size != 0) || size > pending_plaintext_.max_size() - pending_plaintext_.size()) {
      return false;
    }
    if (size != 0) {
      pending_plaintext_.append(reinterpret_cast<const char*>(data), size);
    }
    return true;
  }

  std::size_t DrainIncoming() override {
    if (!ok() || failed_) {
      return 0;
    }
 
    OpenSslErrorQueueGuard error_guard;
    std::size_t progress = 0;
    if (!handshake_complete_) {
      const int state_before = static_cast<int>(SSL_get_state(ssl_));
      const int result = SSL_accept(ssl_);
      // SSL_get_error must be the next OpenSSL call after failed I/O. Even a
      // state query in between would make its use formally unreliable.
      const int error = result == 1 ? SSL_ERROR_NONE : SSL_get_error(ssl_, result);
      const int state_after = static_cast<int>(SSL_get_state(ssl_));
      if (state_after != state_before) {
        ++progress;
      }
      if (result == 1) {
        handshake_complete_ = true;
        if (context_ != nullptr) {
          context_->RecordHandshake(ssl_);
        }
        ++progress;
      } else {
        if (error == SSL_ERROR_WANT_READ || error == SSL_ERROR_WANT_WRITE) {
          return progress;
        }
        failed_ = true;
        return progress;
      }
    }
 
    // A WANT result leaves SSL_write_ex in flight. OpenSSL requires the next
    // I/O operation to retry that exact write, so do not interpose SSL_read_ex
    // merely because the outer driver has yielded back to us.
    if (pending_write_end_ != 0) {
      progress += FlushPendingWrites();
      if (failed_ || pending_write_end_ != 0) {
        return progress;
      }
    }
 
    unsigned char request[4096];
    while (true) {
      std::size_t received = 0;
      const int result = SSL_read_ex(ssl_, request, sizeof(request), &received);
      if (result == 1 && received != 0) {
        NotifyIncomingData(request, received);
        progress += received;
        continue;
      }
      if (result != 1) {
        const int error = SSL_get_error(ssl_, result);
        if (error == SSL_ERROR_ZERO_RETURN) {
          // The client sent close_notify. TLS requires a reciprocal close_notify
          // before the orderly shutdown completes; protocols such as FTP upload
          // wait for that completion even though the application data is done.
          shutdown_requested_ = true;
        } else if (error != SSL_ERROR_WANT_READ && error != SSL_ERROR_WANT_WRITE) {
          failed_ = true;
        }
      }
      break;
    }
 
    progress += FlushPendingWrites();
 
    if (!failed_ && shutdown_requested_ && pending_plaintext_.empty() && !write_shutdown_) {
      const int result = SSL_shutdown(ssl_);
      if (result >= 0) {
        // The first successful call sends close_notify. The fuzzer does not
        // need to wait for the client's reciprocal alert before exposing EOF.
        (void)::shutdown(server_fd(), SHUT_WR);
        write_shutdown_ = true;
        ++progress;
      } else {
        const int error = SSL_get_error(ssl_, result);
        if (error != SSL_ERROR_WANT_READ && error != SSL_ERROR_WANT_WRITE) {
          failed_ = true;
        }
      }
    }
    return progress;
  }

  void ShutdownWrite() override {
    // An HTTP/2 proxy connection outlives the scripted origin response inside
    // its CONNECT stream. Half-closing TLS when the last script chunk is
    // queued would make curl observe a dead proxy rather than exercise its
    // own stream/session shutdown and GOAWAY handling.
    if (context_ != nullptr && context_->protocol() == TlsApplicationProtocol::kHttp2) {
      return;
    }
    shutdown_requested_ = true;
    (void)DrainIncoming();
  }
 
 private:
  void InitializeSsl() {
    OpenSslErrorQueueGuard error_guard;
    SSL_CTX* ssl_context = context_ == nullptr ? nullptr : context_->get();
    ssl_ = ssl_context == nullptr ? nullptr : SSL_new(ssl_context);
    if (ssl_ == nullptr) {
      return;
    }
    SSL_set_mode(ssl_, SSL_MODE_ENABLE_PARTIAL_WRITE | SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
    if (SSL_set_fd(ssl_, server_fd()) != 1) {
      SSL_free(ssl_);
      ssl_ = nullptr;
      return;
    }
    SSL_set_accept_state(ssl_);
  }

  std::size_t FlushPendingWrites() {
    std::size_t progress = 0;
    while (!failed_ && pending_offset_ < pending_plaintext_.size()) {
      if (pending_write_end_ == 0) {
        // Freeze one write boundary until OpenSSL accepts it. WriteAll may
        // append the next scripted chunk after WANT_READ/WANT_WRITE, but the
        // retry contract permits only pointer relocation—not changed bytes or
        // length—for the outstanding SSL_write_ex call.
        pending_write_end_ = pending_plaintext_.size();
      }
      std::size_t written = 0;
      const int result = SSL_write_ex(ssl_, pending_plaintext_.data() + pending_offset_,
                                      pending_write_end_ - pending_offset_, &written);
      if (result == 1) {
        if (written == 0) {
          failed_ = true;
          break;
        }
        pending_offset_ += written;
        progress += written;
        if (pending_offset_ == pending_write_end_) {
          pending_write_end_ = 0;
        }
        continue;
      }
      const int error = SSL_get_error(ssl_, result);
      if (error == SSL_ERROR_WANT_READ || error == SSL_ERROR_WANT_WRITE) {
        if (context_ != nullptr) {
          context_->RecordWriteRetry();
        }
      } else {
        failed_ = true;
      }
      break;
    }
    if (pending_offset_ == pending_plaintext_.size()) {
      pending_plaintext_.clear();
      pending_offset_ = 0;
      pending_write_end_ = 0;
    }
    return progress;
  }
 
  SSL* ssl_;
  TlsServerContext* context_;
  std::string pending_plaintext_;
  std::size_t pending_offset_;
  std::size_t pending_write_end_;
  bool handshake_complete_;
  bool shutdown_requested_;
  bool write_shutdown_;
  bool failed_;
};

class TlsCloseNotifyConnection final : public MockConnection {
 public:
  TlsCloseNotifyConnection() : alert_sent_(false) {}
 
  bool WriteAll(const unsigned char* /*data*/, std::size_t /*size*/) override { return true; }
 
  void ShutdownWrite() override {
    if (alert_sent_) {
      return;
    }
    static constexpr unsigned char kCloseNotify[] = {
        0x15, 0x03, 0x03, 0x00, 0x02, 0x01, 0x00,
    };
    alert_sent_ = true;
    (void)MockConnection::WriteAll(kCloseNotify, sizeof(kCloseNotify));
    MockConnection::ShutdownWrite();
  }
 
 private:
  bool alert_sent_;
};

class TlsHelloRequestConnection final : public MockConnection {
 public:
  TlsHelloRequestConnection() : record_sent_(false) {}
 
  bool WriteAll(const unsigned char* /*data*/, std::size_t /*size*/) override { return SendOnce(); }
 
  void ShutdownWrite() override {
    (void)SendOnce();
    MockConnection::ShutdownWrite();
  }
 
 private:
  bool SendOnce() {
    if (record_sent_) {
      return true;
    }
    static constexpr unsigned char kHelloRequest[] = {
        0x16, 0x03, 0x03, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00,
    };
    record_sent_ = MockConnection::WriteAll(kHelloRequest, sizeof(kHelloRequest));
    return record_sent_;
  }
 
  bool record_sent_;
};
 
}  // namespace

TlsMockTransport::TlsMockTransport(TlsApplicationProtocol protocol,
                                   curl::fuzzer::proto::TlsCertificateChainProfile certificate_chain,
                                   TlsGroupPolicy group_policy,
                                   curl::fuzzer::proto::TlsHandshakeProfile handshake_profile)
    : group_policy_(group_policy),
      openssl_close_notify_(handshake_profile == curl::fuzzer::proto::TLS_HANDSHAKE_OPENSSL_CLOSE_NOTIFY &&
                            CurlClientUsesOpenSsl()),
      openssl_hello_request_(handshake_profile == curl::fuzzer::proto::TLS_HANDSHAKE_OPENSSL_HELLO_REQUEST &&
                             CurlClientUsesOpenSsl()),
      context_(std::make_unique<TlsServerContext>(protocol, certificate_chain, group_policy)) {}
 
TlsMockTransport::~TlsMockTransport() = default;

void TlsMockTransport::Install(CURL* easy) const {
  struct curl_blob trust_anchor = {const_cast<char*>(tls_test_credentials::kCertificatePem),
                                   sizeof(tls_test_credentials::kCertificatePem) - 1, CURL_BLOB_NOCOPY};
  (void)curl_easy_setopt(easy, CURLOPT_CAINFO_BLOB, &trust_anchor);
  (void)curl_easy_setopt(easy, CURLOPT_SSL_VERIFYPEER, 1L);
  (void)curl_easy_setopt(easy, CURLOPT_SSL_VERIFYHOST, 2L);
}

std::unique_ptr<MockConnection> TlsMockTransport::CreateConnection() {
  if (openssl_close_notify_) {
    return std::make_unique<TlsCloseNotifyConnection>();
  }
  if (openssl_hello_request_) {
    return std::make_unique<TlsHelloRequestConnection>();
  }
  return std::make_unique<TlsMockConnection>(context_.get());
}

std::unique_ptr<MockConnection> TlsMockTransport::CreateAcceptedConnection(int accepted_fd) {
  return std::make_unique<TlsMockConnection>(context_.get(), accepted_fd);
}

int TlsMockTransport::negotiated_tls_version() const {
  return context_ == nullptr ? 0 : context_->negotiated_tls_version();
}

std::size_t TlsMockTransport::completed_handshake_count() const {
  return context_ == nullptr ? 0 : context_->completed_handshake_count();
}

std::size_t TlsMockTransport::reused_session_count() const {
  return context_ == nullptr ? 0 : context_->reused_session_count();
}

std::size_t TlsMockTransport::write_retry_count() const {
  return context_ == nullptr ? 0 : context_->write_retry_count();
}

std::string TlsMockTransport::negotiated_alpn() const {
  return context_ == nullptr ? std::string() : context_->negotiated_alpn();
}

TlsGroupPolicy TlsMockTransport::group_policy() const { return group_policy_; }

std::string TlsMockTransport::negotiated_group() const {
  return context_ == nullptr ? std::string() : context_->negotiated_group();
}

int TlsMockTransport::ech_status() const { return context_ == nullptr ? -1 : context_->ech_status(); }

std::string TlsMockTransport::ech_inner_name() const {
  return context_ == nullptr ? std::string() : context_->ech_inner_name();
}

std::string TlsMockTransport::ech_outer_name() const {
  return context_ == nullptr ? std::string() : context_->ech_outer_name();
}

TlsMockServer::TlsMockServer() : TlsMockServer(curl::fuzzer::proto::TLS_CERTIFICATE_CHAIN_DEFAULT_EC) {}

TlsMockServer::TlsMockServer(curl::fuzzer::proto::TlsCertificateChainProfile certificate_chain,
                             curl::fuzzer::proto::TlsHandshakeProfile handshake_profile)
    : TlsMockServer(TlsApplicationProtocol::kHttp11, certificate_chain, TlsGroupPolicy::kProviderDefault,
                    handshake_profile) {}

TlsMockServer::TlsMockServer(TlsApplicationProtocol protocol,
                             curl::fuzzer::proto::TlsCertificateChainProfile certificate_chain,
                             TlsGroupPolicy group_policy, curl::fuzzer::proto::TlsHandshakeProfile handshake_profile)
    : transport_(protocol, certificate_chain, group_policy, handshake_profile),
      saw_live_tls_session_(false),
      session_export_attempt_count_(0),
      exported_session_count_(0),
      imported_session_count_(0) {}

TlsMockServer::~TlsMockServer() { ResetConnections(); }

void TlsMockServer::Install(CURL* easy) {
  MockServer::Install(easy);
  transport_.Install(easy);
}

bool TlsMockServer::saw_live_tls_session() const { return saw_live_tls_session_; }

std::size_t TlsMockServer::exported_session_count() const { return exported_session_count_; }

std::size_t TlsMockServer::imported_session_count() const { return imported_session_count_; }

int TlsMockServer::negotiated_tls_version() const { return transport_.negotiated_tls_version(); }

std::size_t TlsMockServer::completed_handshake_count() const { return transport_.completed_handshake_count(); }

std::size_t TlsMockServer::reused_session_count() const { return transport_.reused_session_count(); }

std::size_t TlsMockServer::write_retry_count() const { return transport_.write_retry_count(); }

std::string TlsMockServer::negotiated_alpn() const { return transport_.negotiated_alpn(); }

TlsGroupPolicy TlsMockServer::group_policy() const { return transport_.group_policy(); }

std::string TlsMockServer::negotiated_group() const { return transport_.negotiated_group(); }

int TlsMockServer::ech_status() const { return transport_.ech_status(); }

std::string TlsMockServer::ech_inner_name() const { return transport_.ech_inner_name(); }

std::string TlsMockServer::ech_outer_name() const { return transport_.ech_outer_name(); }

std::unique_ptr<MockConnection> TlsMockServer::CreateConnection() { return transport_.CreateConnection(); }

void TlsMockServer::ObserveActiveTransfer(CURL* easy) {
  if (!saw_live_tls_session_) {
    long verify_result = 0;
    curl_off_t appconnect_time = 0;
    struct curl_certinfo* certificate_info = nullptr;
    struct curl_tlssessioninfo* tls_session = nullptr;
    (void)curl_easy_getinfo(easy, CURLINFO_SSL_VERIFYRESULT, &verify_result);
    (void)curl_easy_getinfo(easy, CURLINFO_APPCONNECT_TIME_T, &appconnect_time);
    (void)curl_easy_getinfo(easy, CURLINFO_CERTINFO, &certificate_info);
    if (curl_easy_getinfo(easy, CURLINFO_TLS_SSL_PTR, &tls_session) == CURLE_OK && tls_session != nullptr &&
        tls_session->internals != nullptr) {
      saw_live_tls_session_ = true;
    }
  }
 
  // A TLS 1.3 ticket may arrive after the peer first completes its handshake.
  // Retry only a small fixed number of outer-loop observations, and stop
  // permanently once one copied ticket has made one import attempt.
  const bool completed_live_handshake = transport_.completed_handshake_count() != 0;
#if defined(PROTO_FUZZER_OBSERVE_STATE)
  // Read the owned peer observations once after a real handshake. Signed
  // status values retain their unavailable sentinels; string results are
  // consumed immediately while their temporaries and context are still live.
  static bool observed = false;
  if (completed_live_handshake && !observed) {
    observed = true;
    const volatile bool live = saw_live_tls_session();
    const volatile int status[] = {negotiated_tls_version(), ech_status()};
    const volatile std::size_t counts[] = {
        exported_session_count(),  imported_session_count(), completed_handshake_count(),
        reused_session_count(),    write_retry_count(),      negotiated_alpn().size(),
        negotiated_group().size(), ech_inner_name().size(),  ech_outer_name().size()};
    (void)live;
    (void)status;
    (void)counts;
  }
#endif
  if (!completed_live_handshake || exported_session_count_ != 0 ||
      session_export_attempt_count_ >= kMaxSessionExportAttempts) {
    return;
  }
  ++session_export_attempt_count_;
  ExportedSession exported;
  const CURLcode export_result = curl_easy_ssls_export(easy, &CaptureExportedSession, &exported);
  if (export_result != CURLE_OK || exported.session_data.empty()) {
    return;
  }
  ++exported_session_count_;
 
  // curl holds the SSL session-cache lock throughout CaptureExportedSession.
  // This deliberately separate call therefore exercises import without
  // recursive API use or retaining any callback-owned pointer.
  if (curl_easy_ssls_import(easy, nullptr, exported.salted_hash.data(), exported.salted_hash.size(),
                            exported.session_data.data(), exported.session_data.size()) == CURLE_OK) {
    ++imported_session_count_;
  }
}
 
}  // namespace proto_fuzzer