deps: update ngtcp2 to 1.23.0

PR-URL: #63777
Backport-PR-URL: #64675
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

Author: nodejs-github-bot

deps/ngtcp2/ngtcp2/crypto/boringssl/boringssl.c

@@ -432,7 +432,7 @@ int ngtcp2_crypto_hp_mask(uint8_t *dest, const ngtcp2_crypto_cipher *hp,
 intngtcp2_crypto_read_write_crypto_data(
 ngtcp2_conn*conn, ngtcp2_encryption_levelencryption_level,
 constuint8_t*data, size_tdatalen) {
-SSL*ssl=ngtcp2_conn_get_tls_native_handle(conn);
+SSL*ssl=ngtcp2_conn_get_tls_native_handle2(conn);
 intrv;
 interr;
 
@@ -444,7 +444,7 @@ int ngtcp2_crypto_read_write_crypto_data(
 return-1;
  }
 
-if (!ngtcp2_conn_get_handshake_completed(conn)) {
+if (!ngtcp2_conn_get_handshake_completed2(conn)) {
 retry:
 rv=SSL_do_handshake(ssl);
 if (rv <= 0) {
@@ -456,7 +456,7 @@ int ngtcp2_crypto_read_write_crypto_data(
 caseSSL_ERROR_SSL:
 return-1;
 caseSSL_ERROR_EARLY_DATA_REJECTED:
-assert(!ngtcp2_conn_is_server(conn));
+assert(!ngtcp2_conn_is_server2(conn));
 
 SSL_reset_early_data_reject(ssl);
 

deps/ngtcp2/ngtcp2/crypto/cryptotest.c

@@ -0,0 +1,46 @@
+/*
+ * ngtcp2
+ *
+ * Copyright (c) 2026 ngtcp2 contributors
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+#ifdefHAVE_CONFIG_H
+# include<config.h>
+#endif/* defined(HAVE_CONFIG_H) */
+
+#include"munit.h"
+
+/* include test cases' include files here */
+#include"shared_test.h"
+
+intmain(intargc, char*argv[]) {
+constMunitSuitesuites[] = {
+shared_suite,
+ {0},
+ };
+constMunitSuitesuite= {
+ .prefix="",
+ .suites=suites,
+ .iterations=1,
+ };
+
+returnmunit_suite_main(&suite, NULL, argc, argv);
+}

deps/ngtcp2/ngtcp2/crypto/includes/ngtcp2/ngtcp2_crypto.h

@@ -338,16 +338,16 @@ ngtcp2_crypto_hp_mask_cb(uint8_t *dest, const ngtcp2_crypto_cipher *hp,
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_0RTT`) to
  * set negotiated AEAD and message digest algorithm. After the
  * successful call of this function, application can use
- * `ngtcp2_conn_get_crypto_ctx` (or `ngtcp2_conn_get_0rtt_crypto_ctx`
- * if |level| ==
+ * `ngtcp2_conn_get_crypto_ctx2` (or
+ * `ngtcp2_conn_get_0rtt_crypto_ctx2` if |level| ==
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_0RTT`) to
  * get :type:`ngtcp2_crypto_ctx`.
  *
  * If |conn| is initialized as client, and |level| is
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_1RTT`, this
  * function retrieves a remote QUIC transport parameters extension
- * from an object obtained by `ngtcp2_conn_get_tls_native_handle`, and
- * sets it to |conn| by calling
+ * from an object obtained by `ngtcp2_conn_get_tls_native_handle2`,
+ * and sets it to |conn| by calling
  * `ngtcp2_conn_decode_and_set_remote_transport_params`.
  *
  * This function returns 0 if it succeeds, or -1.
@@ -385,16 +385,16 @@ NGTCP2_EXTERN int ngtcp2_crypto_derive_and_install_rx_key(
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_0RTT`) to
  * set negotiated AEAD and message digest algorithm. After the
  * successful call of this function, application can use
- * `ngtcp2_conn_get_crypto_ctx` (or `ngtcp2_conn_get_0rtt_crypto_ctx`
- * if |level| ==
+ * `ngtcp2_conn_get_crypto_ctx2` (or
+ * `ngtcp2_conn_get_0rtt_crypto_ctx2` if |level| ==
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_0RTT`) to
  * get :type:`ngtcp2_crypto_ctx`.
  *
  * If |conn| is initialized as server, and |level| is
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_1RTT`, this
  * function retrieves a remote QUIC transport parameters extension
- * from an object obtained by `ngtcp2_conn_get_tls_native_handle`, and
- * sets it to |conn| by calling
+ * from an object obtained by `ngtcp2_conn_get_tls_native_handle2`,
+ * and sets it to |conn| by calling
  * `ngtcp2_conn_decode_and_set_remote_transport_params`.
  *
  * This function returns 0 if it succeeds, or -1.
@@ -986,15 +986,17 @@ NGTCP2_EXTERN void ngtcp2_crypto_delete_crypto_cipher_ctx_cb(
 /**
  * @function
  *
+ * .. warning::
+ *
+ * .. version-deprecated:: 1.22.0
+ * Use `ngtcp2_crypto_get_path_challenge_data2_cb` instead.
+ *
  * `ngtcp2_crypto_get_path_challenge_data_cb` writes unpredictable
  * sequence of :macro:`NGTCP2_PATH_CHALLENGE_DATALEN` bytes to |data|
  * which is sent with PATH_CHALLENGE frame.
  *
  * This function can be directly passed to
  * :member:`ngtcp2_callbacks.get_path_challenge_data` field.
- *
- * Deprecated since v1.22.0. Use
- * `ngtcp2_crypto_get_path_challenge_data2_cb` instead.
  */
 NGTCP2_EXTERNintngtcp2_crypto_get_path_challenge_data_cb(ngtcp2_conn*conn,
 uint8_t*data,
@@ -1010,7 +1012,7 @@ NGTCP2_EXTERN int ngtcp2_crypto_get_path_challenge_data_cb(ngtcp2_conn *conn,
  * This function can be directly passed to
  * :member:`ngtcp2_callbacks.get_path_challenge_data2` field.
  *
- * This function has been available since v1.22.0.
+ * .. version-added:: 1.22.0
  */
 NGTCP2_EXTERNintngtcp2_crypto_get_path_challenge_data2_cb(
 ngtcp2_conn*conn, ngtcp2_path_challenge_data*data, void*user_data);

deps/ngtcp2/ngtcp2/crypto/ossl/ossl.c

@@ -440,7 +440,7 @@ static int crypto_ossl_ctx_write_crypto_data(ngtcp2_crypto_ossl_ctx *ossl_ctx,
 left=crypto_buf_left(ossl_ctx->crypto_write);
  }
 
-n=ngtcp2_min_size((size_t)(end-data), left);
+n=ngtcp2_min((size_t)(end-data), left);
 crypto_buf_write(ossl_ctx->crypto_write, data, n);
 data+=n;
  }
@@ -871,7 +871,7 @@ int ngtcp2_crypto_hp_mask(uint8_t *dest, const ngtcp2_crypto_cipher *hp,
 intngtcp2_crypto_read_write_crypto_data(
 ngtcp2_conn*conn, ngtcp2_encryption_levelencryption_level,
 constuint8_t*data, size_tdatalen) {
-ngtcp2_crypto_ossl_ctx*ossl_ctx=ngtcp2_conn_get_tls_native_handle(conn);
+ngtcp2_crypto_ossl_ctx*ossl_ctx=ngtcp2_conn_get_tls_native_handle2(conn);
 SSL*ssl=ossl_ctx->ssl;
 intrv;
 interr;
@@ -881,7 +881,7 @@ int ngtcp2_crypto_read_write_crypto_data(
 return-1;
  }
 
-if (!ngtcp2_conn_get_handshake_completed(conn)) {
+if (!ngtcp2_conn_get_handshake_completed2(conn)) {
 rv=SSL_do_handshake(ssl);
 if (rv <= 0) {
 err=SSL_get_error(ssl, rv);
@@ -1033,7 +1033,7 @@ static int ossl_yield_secret(SSL *ssl, uint32_t ossl_level, int direction,
  }
 
 conn=conn_ref->get_conn(conn_ref);
-ossl_ctx=ngtcp2_conn_get_tls_native_handle(conn);
+ossl_ctx=ngtcp2_conn_get_tls_native_handle2(conn);
 
 if (direction) {
 if (ngtcp2_crypto_derive_and_install_tx_key(conn, NULL, NULL, NULL, level,
@@ -1067,7 +1067,7 @@ static int ossl_crypto_send(SSL *ssl, const unsigned char *buf, size_t buflen,
  }
 
 conn=conn_ref->get_conn(conn_ref);
-ossl_ctx=ngtcp2_conn_get_tls_native_handle(conn);
+ossl_ctx=ngtcp2_conn_get_tls_native_handle2(conn);
 
 rv=ngtcp2_conn_submit_crypto_data(conn, ossl_ctx->tx_level, buf, buflen);
 if (rv!=0) {
@@ -1094,7 +1094,7 @@ static int ossl_crypto_recv_rcd(SSL *ssl, const unsigned char **buf,
  }
 
 conn=conn_ref->get_conn(conn_ref);
-ossl_ctx=ngtcp2_conn_get_tls_native_handle(conn);
+ossl_ctx=ngtcp2_conn_get_tls_native_handle2(conn);
 
 crypto_ossl_ctx_read_crypto_data(ossl_ctx, buf, bytes_read);
 
@@ -1116,7 +1116,7 @@ static int ossl_crypto_release_rcd(SSL *ssl, size_t released, void *arg) {
  }
 
 conn=conn_ref->get_conn(conn_ref);
-ossl_ctx=ngtcp2_conn_get_tls_native_handle(conn);
+ossl_ctx=ngtcp2_conn_get_tls_native_handle2(conn);
 
 crypto_ossl_ctx_release_crypto_data(ossl_ctx, released);
 

deps/ngtcp2/ngtcp2/crypto/picotls/picotls.c

@@ -378,7 +378,7 @@ int ngtcp2_crypto_hp_mask(uint8_t *dest, const ngtcp2_crypto_cipher *hp,
 intngtcp2_crypto_read_write_crypto_data(
 ngtcp2_conn*conn, ngtcp2_encryption_levelencryption_level,
 constuint8_t*data, size_tdatalen) {
-ngtcp2_crypto_picotls_ctx*cptls=ngtcp2_conn_get_tls_native_handle(conn);
+ngtcp2_crypto_picotls_ctx*cptls=ngtcp2_conn_get_tls_native_handle2(conn);
 ptls_buffer_tsendbuf;
 size_tepoch_offsets[5] = {0};
 size_tepoch=
@@ -402,7 +402,7 @@ int ngtcp2_crypto_read_write_crypto_data(
  goto fin;
  }
 
-if (!ngtcp2_conn_is_server(conn) &&
+if (!ngtcp2_conn_is_server2(conn) &&
 cptls->handshake_properties.client.early_data_acceptance==
 PTLS_EARLY_DATA_REJECTED) {
 rv=ngtcp2_conn_tls_early_data_rejected(conn);
@@ -540,7 +540,7 @@ static int set_additional_extensions(ptls_handshake_properties_t *hsprops,
 return-1;
  }
 
-nwrite=ngtcp2_conn_encode_local_transport_params(conn, buf, buflen);
+nwrite=ngtcp2_conn_encode_local_transport_params2(conn, buf, buflen);
 if (nwrite<0) {
  goto fail;
  }
@@ -620,7 +620,7 @@ static int update_traffic_key_server_cb(ptls_update_traffic_key_t *self,
  * wait for the key to get the correct local transport
  * parameters from ngtcp2_conn.
  */
-cptls=ngtcp2_conn_get_tls_native_handle(conn);
+cptls=ngtcp2_conn_get_tls_native_handle2(conn);
 
 if (set_additional_extensions(&cptls->handshake_properties, conn) !=0) {
 return-1;

deps/ngtcp2/ngtcp2/crypto/quictls/quictls.c

@@ -812,7 +812,7 @@ int ngtcp2_crypto_hp_mask(uint8_t *dest, const ngtcp2_crypto_cipher *hp,
 intngtcp2_crypto_read_write_crypto_data(
 ngtcp2_conn*conn, ngtcp2_encryption_levelencryption_level,
 constuint8_t*data, size_tdatalen) {
-SSL*ssl=ngtcp2_conn_get_tls_native_handle(conn);
+SSL*ssl=ngtcp2_conn_get_tls_native_handle2(conn);
 intrv;
 interr;
 
@@ -824,7 +824,7 @@ int ngtcp2_crypto_read_write_crypto_data(
 return-1;
  }
 
-if (!ngtcp2_conn_get_handshake_completed(conn)) {
+if (!ngtcp2_conn_get_handshake_completed2(conn)) {
 rv=SSL_do_handshake(ssl);
 if (rv <= 0) {
 err=SSL_get_error(ssl, rv);

deps/ngtcp2/ngtcp2/crypto/boringssl/boringssl.c

@@ -432,7 +432,7 @@ int ngtcp2_crypto_hp_mask(uint8_t *dest, const ngtcp2_crypto_cipher *hp,
 intngtcp2_crypto_read_write_crypto_data(
 ngtcp2_conn*conn, ngtcp2_encryption_levelencryption_level,
 constuint8_t*data, size_tdatalen) {
-SSL*ssl=ngtcp2_conn_get_tls_native_handle(conn);
+SSL*ssl=ngtcp2_conn_get_tls_native_handle2(conn);
 intrv;
 interr;
 
@@ -444,7 +444,7 @@ int ngtcp2_crypto_read_write_crypto_data(
 return-1;
  }
 
-if (!ngtcp2_conn_get_handshake_completed(conn)) {
+if (!ngtcp2_conn_get_handshake_completed2(conn)) {
 retry:
 rv=SSL_do_handshake(ssl);
 if (rv <= 0) {
@@ -456,7 +456,7 @@ int ngtcp2_crypto_read_write_crypto_data(
 caseSSL_ERROR_SSL:
 return-1;
 caseSSL_ERROR_EARLY_DATA_REJECTED:
-assert(!ngtcp2_conn_is_server(conn));
+assert(!ngtcp2_conn_is_server2(conn));
 
 SSL_reset_early_data_reject(ssl);
 

deps/ngtcp2/ngtcp2/crypto/cryptotest.c

@@ -0,0 +1,46 @@
+/*
+ * ngtcp2
+ *
+ * Copyright (c) 2026 ngtcp2 contributors
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+#ifdefHAVE_CONFIG_H
+# include<config.h>
+#endif/* defined(HAVE_CONFIG_H) */
+
+#include"munit.h"
+
+/* include test cases' include files here */
+#include"shared_test.h"
+
+intmain(intargc, char*argv[]) {
+constMunitSuitesuites[] = {
+shared_suite,
+ {0},
+ };
+constMunitSuitesuite= {
+ .prefix="",
+ .suites=suites,
+ .iterations=1,
+ };
+
+returnmunit_suite_main(&suite, NULL, argc, argv);
+}

deps/ngtcp2/ngtcp2/crypto/includes/ngtcp2/ngtcp2_crypto.h

@@ -338,16 +338,16 @@ ngtcp2_crypto_hp_mask_cb(uint8_t *dest, const ngtcp2_crypto_cipher *hp,
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_0RTT`) to
  * set negotiated AEAD and message digest algorithm. After the
  * successful call of this function, application can use
- * `ngtcp2_conn_get_crypto_ctx` (or `ngtcp2_conn_get_0rtt_crypto_ctx`
- * if |level| ==
+ * `ngtcp2_conn_get_crypto_ctx2` (or
+ * `ngtcp2_conn_get_0rtt_crypto_ctx2` if |level| ==
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_0RTT`) to
  * get :type:`ngtcp2_crypto_ctx`.
  *
  * If |conn| is initialized as client, and |level| is
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_1RTT`, this
  * function retrieves a remote QUIC transport parameters extension
- * from an object obtained by `ngtcp2_conn_get_tls_native_handle`, and
- * sets it to |conn| by calling
+ * from an object obtained by `ngtcp2_conn_get_tls_native_handle2`,
+ * and sets it to |conn| by calling
  * `ngtcp2_conn_decode_and_set_remote_transport_params`.
  *
  * This function returns 0 if it succeeds, or -1.
@@ -385,16 +385,16 @@ NGTCP2_EXTERN int ngtcp2_crypto_derive_and_install_rx_key(
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_0RTT`) to
  * set negotiated AEAD and message digest algorithm. After the
  * successful call of this function, application can use
- * `ngtcp2_conn_get_crypto_ctx` (or `ngtcp2_conn_get_0rtt_crypto_ctx`
- * if |level| ==
+ * `ngtcp2_conn_get_crypto_ctx2` (or
+ * `ngtcp2_conn_get_0rtt_crypto_ctx2` if |level| ==
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_0RTT`) to
  * get :type:`ngtcp2_crypto_ctx`.
  *
  * If |conn| is initialized as server, and |level| is
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_1RTT`, this
  * function retrieves a remote QUIC transport parameters extension
- * from an object obtained by `ngtcp2_conn_get_tls_native_handle`, and
- * sets it to |conn| by calling
+ * from an object obtained by `ngtcp2_conn_get_tls_native_handle2`,
+ * and sets it to |conn| by calling
  * `ngtcp2_conn_decode_and_set_remote_transport_params`.
  *
  * This function returns 0 if it succeeds, or -1.
@@ -986,15 +986,17 @@ NGTCP2_EXTERN void ngtcp2_crypto_delete_crypto_cipher_ctx_cb(
 /**
  * @function
  *
+ * .. warning::
+ *
+ * .. version-deprecated:: 1.22.0
+ * Use `ngtcp2_crypto_get_path_challenge_data2_cb` instead.
+ *
  * `ngtcp2_crypto_get_path_challenge_data_cb` writes unpredictable
  * sequence of :macro:`NGTCP2_PATH_CHALLENGE_DATALEN` bytes to |data|
  * which is sent with PATH_CHALLENGE frame.
  *
  * This function can be directly passed to
  * :member:`ngtcp2_callbacks.get_path_challenge_data` field.
- *
- * Deprecated since v1.22.0. Use
- * `ngtcp2_crypto_get_path_challenge_data2_cb` instead.
  */
 NGTCP2_EXTERNintngtcp2_crypto_get_path_challenge_data_cb(ngtcp2_conn*conn,
 uint8_t*data,
@@ -1010,7 +1012,7 @@ NGTCP2_EXTERN int ngtcp2_crypto_get_path_challenge_data_cb(ngtcp2_conn *conn,
  * This function can be directly passed to
  * :member:`ngtcp2_callbacks.get_path_challenge_data2` field.
  *
- * This function has been available since v1.22.0.
+ * .. version-added:: 1.22.0
  */
 NGTCP2_EXTERNintngtcp2_crypto_get_path_challenge_data2_cb(
 ngtcp2_conn*conn, ngtcp2_path_challenge_data*data, void*user_data);

deps/ngtcp2/ngtcp2/crypto/ossl/ossl.c

@@ -440,7 +440,7 @@ static int crypto_ossl_ctx_write_crypto_data(ngtcp2_crypto_ossl_ctx *ossl_ctx,
 left=crypto_buf_left(ossl_ctx->crypto_write);
  }
 
-n=ngtcp2_min_size((size_t)(end-data), left);
+n=ngtcp2_min((size_t)(end-data), left);
 crypto_buf_write(ossl_ctx->crypto_write, data, n);
 data+=n;
  }
@@ -871,7 +871,7 @@ int ngtcp2_crypto_hp_mask(uint8_t *dest, const ngtcp2_crypto_cipher *hp,
 intngtcp2_crypto_read_write_crypto_data(
 ngtcp2_conn*conn, ngtcp2_encryption_levelencryption_level,
 constuint8_t*data, size_tdatalen) {
-ngtcp2_crypto_ossl_ctx*ossl_ctx=ngtcp2_conn_get_tls_native_handle(conn);
+ngtcp2_crypto_ossl_ctx*ossl_ctx=ngtcp2_conn_get_tls_native_handle2(conn);
 SSL*ssl=ossl_ctx->ssl;
 intrv;
 interr;
@@ -881,7 +881,7 @@ int ngtcp2_crypto_read_write_crypto_data(
 return-1;
  }
 
-if (!ngtcp2_conn_get_handshake_completed(conn)) {
+if (!ngtcp2_conn_get_handshake_completed2(conn)) {
 rv=SSL_do_handshake(ssl);
 if (rv <= 0) {
 err=SSL_get_error(ssl, rv);
@@ -1033,7 +1033,7 @@ static int ossl_yield_secret(SSL *ssl, uint32_t ossl_level, int direction,
  }
 
 conn=conn_ref->get_conn(conn_ref);
-ossl_ctx=ngtcp2_conn_get_tls_native_handle(conn);
+ossl_ctx=ngtcp2_conn_get_tls_native_handle2(conn);
 
 if (direction) {
 if (ngtcp2_crypto_derive_and_install_tx_key(conn, NULL, NULL, NULL, level,
@@ -1067,7 +1067,7 @@ static int ossl_crypto_send(SSL *ssl, const unsigned char *buf, size_t buflen,
  }
 
 conn=conn_ref->get_conn(conn_ref);
-ossl_ctx=ngtcp2_conn_get_tls_native_handle(conn);
+ossl_ctx=ngtcp2_conn_get_tls_native_handle2(conn);
 
 rv=ngtcp2_conn_submit_crypto_data(conn, ossl_ctx->tx_level, buf, buflen);
 if (rv!=0) {
@@ -1094,7 +1094,7 @@ static int ossl_crypto_recv_rcd(SSL *ssl, const unsigned char **buf,
  }
 
 conn=conn_ref->get_conn(conn_ref);
-ossl_ctx=ngtcp2_conn_get_tls_native_handle(conn);
+ossl_ctx=ngtcp2_conn_get_tls_native_handle2(conn);
 
 crypto_ossl_ctx_read_crypto_data(ossl_ctx, buf, bytes_read);
 
@@ -1116,7 +1116,7 @@ static int ossl_crypto_release_rcd(SSL *ssl, size_t released, void *arg) {
  }
 
 conn=conn_ref->get_conn(conn_ref);
-ossl_ctx=ngtcp2_conn_get_tls_native_handle(conn);
+ossl_ctx=ngtcp2_conn_get_tls_native_handle2(conn);
 
 crypto_ossl_ctx_release_crypto_data(ossl_ctx, released);
 

deps/ngtcp2/ngtcp2/crypto/picotls/picotls.c

@@ -378,7 +378,7 @@ int ngtcp2_crypto_hp_mask(uint8_t *dest, const ngtcp2_crypto_cipher *hp,
 intngtcp2_crypto_read_write_crypto_data(
 ngtcp2_conn*conn, ngtcp2_encryption_levelencryption_level,
 constuint8_t*data, size_tdatalen) {
-ngtcp2_crypto_picotls_ctx*cptls=ngtcp2_conn_get_tls_native_handle(conn);
+ngtcp2_crypto_picotls_ctx*cptls=ngtcp2_conn_get_tls_native_handle2(conn);
 ptls_buffer_tsendbuf;
 size_tepoch_offsets[5] = {0};
 size_tepoch=
@@ -402,7 +402,7 @@ int ngtcp2_crypto_read_write_crypto_data(
  goto fin;
  }
 
-if (!ngtcp2_conn_is_server(conn) &&
+if (!ngtcp2_conn_is_server2(conn) &&
 cptls->handshake_properties.client.early_data_acceptance==
 PTLS_EARLY_DATA_REJECTED) {
 rv=ngtcp2_conn_tls_early_data_rejected(conn);
@@ -540,7 +540,7 @@ static int set_additional_extensions(ptls_handshake_properties_t *hsprops,
 return-1;
  }
 
-nwrite=ngtcp2_conn_encode_local_transport_params(conn, buf, buflen);
+nwrite=ngtcp2_conn_encode_local_transport_params2(conn, buf, buflen);
 if (nwrite<0) {
  goto fail;
  }
@@ -620,7 +620,7 @@ static int update_traffic_key_server_cb(ptls_update_traffic_key_t *self,
  * wait for the key to get the correct local transport
  * parameters from ngtcp2_conn.
  */
-cptls=ngtcp2_conn_get_tls_native_handle(conn);
+cptls=ngtcp2_conn_get_tls_native_handle2(conn);
 
 if (set_additional_extensions(&cptls->handshake_properties, conn) !=0) {
 return-1;

deps/ngtcp2/ngtcp2/crypto/quictls/quictls.c

@@ -812,7 +812,7 @@ int ngtcp2_crypto_hp_mask(uint8_t *dest, const ngtcp2_crypto_cipher *hp,
 intngtcp2_crypto_read_write_crypto_data(
 ngtcp2_conn*conn, ngtcp2_encryption_levelencryption_level,
 constuint8_t*data, size_tdatalen) {
-SSL*ssl=ngtcp2_conn_get_tls_native_handle(conn);
+SSL*ssl=ngtcp2_conn_get_tls_native_handle2(conn);
 intrv;
 interr;
 
@@ -824,7 +824,7 @@ int ngtcp2_crypto_read_write_crypto_data(
 return-1;
  }
 
-if (!ngtcp2_conn_get_handshake_completed(conn)) {
+if (!ngtcp2_conn_get_handshake_completed2(conn)) {
 rv=SSL_do_handshake(ssl);
 if (rv <= 0) {
 err=SSL_get_error(ssl, rv);

deps/ngtcp2/ngtcp2/crypto/boringssl/boringssl.c

@@ -432,7 +432,7 @@ int ngtcp2_crypto_hp_mask(uint8_t *dest, const ngtcp2_crypto_cipher *hp,
 intngtcp2_crypto_read_write_crypto_data(
 ngtcp2_conn*conn, ngtcp2_encryption_levelencryption_level,
 constuint8_t*data, size_tdatalen) {
-SSL*ssl=ngtcp2_conn_get_tls_native_handle(conn);
+SSL*ssl=ngtcp2_conn_get_tls_native_handle2(conn);
 intrv;
 interr;
 
@@ -444,7 +444,7 @@ int ngtcp2_crypto_read_write_crypto_data(
 return-1;
  }
 
-if (!ngtcp2_conn_get_handshake_completed(conn)) {
+if (!ngtcp2_conn_get_handshake_completed2(conn)) {
 retry:
 rv=SSL_do_handshake(ssl);
 if (rv <= 0) {
@@ -456,7 +456,7 @@ int ngtcp2_crypto_read_write_crypto_data(
 caseSSL_ERROR_SSL:
 return-1;
 caseSSL_ERROR_EARLY_DATA_REJECTED:
-assert(!ngtcp2_conn_is_server(conn));
+assert(!ngtcp2_conn_is_server2(conn));
 
 SSL_reset_early_data_reject(ssl);
 

deps/ngtcp2/ngtcp2/crypto/cryptotest.c

@@ -0,0 +1,46 @@
+/*
+ * ngtcp2
+ *
+ * Copyright (c) 2026 ngtcp2 contributors
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+#ifdefHAVE_CONFIG_H
+# include<config.h>
+#endif/* defined(HAVE_CONFIG_H) */
+
+#include"munit.h"
+
+/* include test cases' include files here */
+#include"shared_test.h"
+
+intmain(intargc, char*argv[]) {
+constMunitSuitesuites[] = {
+shared_suite,
+ {0},
+ };
+constMunitSuitesuite= {
+ .prefix="",
+ .suites=suites,
+ .iterations=1,
+ };
+
+returnmunit_suite_main(&suite, NULL, argc, argv);
+}

deps/ngtcp2/ngtcp2/crypto/includes/ngtcp2/ngtcp2_crypto.h

@@ -338,16 +338,16 @@ ngtcp2_crypto_hp_mask_cb(uint8_t *dest, const ngtcp2_crypto_cipher *hp,
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_0RTT`) to
  * set negotiated AEAD and message digest algorithm. After the
  * successful call of this function, application can use
- * `ngtcp2_conn_get_crypto_ctx` (or `ngtcp2_conn_get_0rtt_crypto_ctx`
- * if |level| ==
+ * `ngtcp2_conn_get_crypto_ctx2` (or
+ * `ngtcp2_conn_get_0rtt_crypto_ctx2` if |level| ==
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_0RTT`) to
  * get :type:`ngtcp2_crypto_ctx`.
  *
  * If |conn| is initialized as client, and |level| is
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_1RTT`, this
  * function retrieves a remote QUIC transport parameters extension
- * from an object obtained by `ngtcp2_conn_get_tls_native_handle`, and
- * sets it to |conn| by calling
+ * from an object obtained by `ngtcp2_conn_get_tls_native_handle2`,
+ * and sets it to |conn| by calling
  * `ngtcp2_conn_decode_and_set_remote_transport_params`.
  *
  * This function returns 0 if it succeeds, or -1.
@@ -385,16 +385,16 @@ NGTCP2_EXTERN int ngtcp2_crypto_derive_and_install_rx_key(
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_0RTT`) to
  * set negotiated AEAD and message digest algorithm. After the
  * successful call of this function, application can use
- * `ngtcp2_conn_get_crypto_ctx` (or `ngtcp2_conn_get_0rtt_crypto_ctx`
- * if |level| ==
+ * `ngtcp2_conn_get_crypto_ctx2` (or
+ * `ngtcp2_conn_get_0rtt_crypto_ctx2` if |level| ==
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_0RTT`) to
  * get :type:`ngtcp2_crypto_ctx`.
  *
  * If |conn| is initialized as server, and |level| is
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_1RTT`, this
  * function retrieves a remote QUIC transport parameters extension
- * from an object obtained by `ngtcp2_conn_get_tls_native_handle`, and
- * sets it to |conn| by calling
+ * from an object obtained by `ngtcp2_conn_get_tls_native_handle2`,
+ * and sets it to |conn| by calling
  * `ngtcp2_conn_decode_and_set_remote_transport_params`.
  *
  * This function returns 0 if it succeeds, or -1.
@@ -986,15 +986,17 @@ NGTCP2_EXTERN void ngtcp2_crypto_delete_crypto_cipher_ctx_cb(
 /**
  * @function
  *
+ * .. warning::
+ *
+ * .. version-deprecated:: 1.22.0
+ * Use `ngtcp2_crypto_get_path_challenge_data2_cb` instead.
+ *
  * `ngtcp2_crypto_get_path_challenge_data_cb` writes unpredictable
  * sequence of :macro:`NGTCP2_PATH_CHALLENGE_DATALEN` bytes to |data|
  * which is sent with PATH_CHALLENGE frame.
  *
  * This function can be directly passed to
  * :member:`ngtcp2_callbacks.get_path_challenge_data` field.
- *
- * Deprecated since v1.22.0. Use
- * `ngtcp2_crypto_get_path_challenge_data2_cb` instead.
  */
 NGTCP2_EXTERNintngtcp2_crypto_get_path_challenge_data_cb(ngtcp2_conn*conn,
 uint8_t*data,
@@ -1010,7 +1012,7 @@ NGTCP2_EXTERN int ngtcp2_crypto_get_path_challenge_data_cb(ngtcp2_conn *conn,
  * This function can be directly passed to
  * :member:`ngtcp2_callbacks.get_path_challenge_data2` field.
  *
- * This function has been available since v1.22.0.
+ * .. version-added:: 1.22.0
  */
 NGTCP2_EXTERNintngtcp2_crypto_get_path_challenge_data2_cb(
 ngtcp2_conn*conn, ngtcp2_path_challenge_data*data, void*user_data);

deps/ngtcp2/ngtcp2/crypto/ossl/ossl.c

@@ -440,7 +440,7 @@ static int crypto_ossl_ctx_write_crypto_data(ngtcp2_crypto_ossl_ctx *ossl_ctx,
 left=crypto_buf_left(ossl_ctx->crypto_write);
  }
 
-n=ngtcp2_min_size((size_t)(end-data), left);
+n=ngtcp2_min((size_t)(end-data), left);
 crypto_buf_write(ossl_ctx->crypto_write, data, n);
 data+=n;
  }
@@ -871,7 +871,7 @@ int ngtcp2_crypto_hp_mask(uint8_t *dest, const ngtcp2_crypto_cipher *hp,
 intngtcp2_crypto_read_write_crypto_data(
 ngtcp2_conn*conn, ngtcp2_encryption_levelencryption_level,
 constuint8_t*data, size_tdatalen) {
-ngtcp2_crypto_ossl_ctx*ossl_ctx=ngtcp2_conn_get_tls_native_handle(conn);
+ngtcp2_crypto_ossl_ctx*ossl_ctx=ngtcp2_conn_get_tls_native_handle2(conn);
 SSL*ssl=ossl_ctx->ssl;
 intrv;
 interr;
@@ -881,7 +881,7 @@ int ngtcp2_crypto_read_write_crypto_data(
 return-1;
  }
 
-if (!ngtcp2_conn_get_handshake_completed(conn)) {
+if (!ngtcp2_conn_get_handshake_completed2(conn)) {
 rv=SSL_do_handshake(ssl);
 if (rv <= 0) {
 err=SSL_get_error(ssl, rv);
@@ -1033,7 +1033,7 @@ static int ossl_yield_secret(SSL *ssl, uint32_t ossl_level, int direction,
  }
 
 conn=conn_ref->get_conn(conn_ref);
-ossl_ctx=ngtcp2_conn_get_tls_native_handle(conn);
+ossl_ctx=ngtcp2_conn_get_tls_native_handle2(conn);
 
 if (direction) {
 if (ngtcp2_crypto_derive_and_install_tx_key(conn, NULL, NULL, NULL, level,
@@ -1067,7 +1067,7 @@ static int ossl_crypto_send(SSL *ssl, const unsigned char *buf, size_t buflen,
  }
 
 conn=conn_ref->get_conn(conn_ref);
-ossl_ctx=ngtcp2_conn_get_tls_native_handle(conn);
+ossl_ctx=ngtcp2_conn_get_tls_native_handle2(conn);
 
 rv=ngtcp2_conn_submit_crypto_data(conn, ossl_ctx->tx_level, buf, buflen);
 if (rv!=0) {
@@ -1094,7 +1094,7 @@ static int ossl_crypto_recv_rcd(SSL *ssl, const unsigned char **buf,
  }
 
 conn=conn_ref->get_conn(conn_ref);
-ossl_ctx=ngtcp2_conn_get_tls_native_handle(conn);
+ossl_ctx=ngtcp2_conn_get_tls_native_handle2(conn);
 
 crypto_ossl_ctx_read_crypto_data(ossl_ctx, buf, bytes_read);
 
@@ -1116,7 +1116,7 @@ static int ossl_crypto_release_rcd(SSL *ssl, size_t released, void *arg) {
  }
 
 conn=conn_ref->get_conn(conn_ref);
-ossl_ctx=ngtcp2_conn_get_tls_native_handle(conn);
+ossl_ctx=ngtcp2_conn_get_tls_native_handle2(conn);
 
 crypto_ossl_ctx_release_crypto_data(ossl_ctx, released);
 

deps/ngtcp2/ngtcp2/crypto/picotls/picotls.c

@@ -378,7 +378,7 @@ int ngtcp2_crypto_hp_mask(uint8_t *dest, const ngtcp2_crypto_cipher *hp,
 intngtcp2_crypto_read_write_crypto_data(
 ngtcp2_conn*conn, ngtcp2_encryption_levelencryption_level,
 constuint8_t*data, size_tdatalen) {
-ngtcp2_crypto_picotls_ctx*cptls=ngtcp2_conn_get_tls_native_handle(conn);
+ngtcp2_crypto_picotls_ctx*cptls=ngtcp2_conn_get_tls_native_handle2(conn);
 ptls_buffer_tsendbuf;
 size_tepoch_offsets[5] = {0};
 size_tepoch=
@@ -402,7 +402,7 @@ int ngtcp2_crypto_read_write_crypto_data(
  goto fin;
  }
 
-if (!ngtcp2_conn_is_server(conn) &&
+if (!ngtcp2_conn_is_server2(conn) &&
 cptls->handshake_properties.client.early_data_acceptance==
 PTLS_EARLY_DATA_REJECTED) {
 rv=ngtcp2_conn_tls_early_data_rejected(conn);
@@ -540,7 +540,7 @@ static int set_additional_extensions(ptls_handshake_properties_t *hsprops,
 return-1;
  }
 
-nwrite=ngtcp2_conn_encode_local_transport_params(conn, buf, buflen);
+nwrite=ngtcp2_conn_encode_local_transport_params2(conn, buf, buflen);
 if (nwrite<0) {
  goto fail;
  }
@@ -620,7 +620,7 @@ static int update_traffic_key_server_cb(ptls_update_traffic_key_t *self,
  * wait for the key to get the correct local transport
  * parameters from ngtcp2_conn.
  */
-cptls=ngtcp2_conn_get_tls_native_handle(conn);
+cptls=ngtcp2_conn_get_tls_native_handle2(conn);
 
 if (set_additional_extensions(&cptls->handshake_properties, conn) !=0) {
 return-1;

deps/ngtcp2/ngtcp2/crypto/quictls/quictls.c

@@ -812,7 +812,7 @@ int ngtcp2_crypto_hp_mask(uint8_t *dest, const ngtcp2_crypto_cipher *hp,
 intngtcp2_crypto_read_write_crypto_data(
 ngtcp2_conn*conn, ngtcp2_encryption_levelencryption_level,
 constuint8_t*data, size_tdatalen) {
-SSL*ssl=ngtcp2_conn_get_tls_native_handle(conn);
+SSL*ssl=ngtcp2_conn_get_tls_native_handle2(conn);
 intrv;
 interr;
 
@@ -824,7 +824,7 @@ int ngtcp2_crypto_read_write_crypto_data(
 return-1;
  }
 
-if (!ngtcp2_conn_get_handshake_completed(conn)) {
+if (!ngtcp2_conn_get_handshake_completed2(conn)) {
 rv=SSL_do_handshake(ssl);
 if (rv <= 0) {
 err=SSL_get_error(ssl, rv);

deps/ngtcp2/ngtcp2/crypto/boringssl/boringssl.c

@@ -432,7 +432,7 @@ int ngtcp2_crypto_hp_mask(uint8_t *dest, const ngtcp2_crypto_cipher *hp,
 intngtcp2_crypto_read_write_crypto_data(
 ngtcp2_conn*conn, ngtcp2_encryption_levelencryption_level,
 constuint8_t*data, size_tdatalen) {
-SSL*ssl=ngtcp2_conn_get_tls_native_handle(conn);
+SSL*ssl=ngtcp2_conn_get_tls_native_handle2(conn);
 intrv;
 interr;
 
@@ -444,7 +444,7 @@ int ngtcp2_crypto_read_write_crypto_data(
 return-1;
  }
 
-if (!ngtcp2_conn_get_handshake_completed(conn)) {
+if (!ngtcp2_conn_get_handshake_completed2(conn)) {
 retry:
 rv=SSL_do_handshake(ssl);
 if (rv <= 0) {
@@ -456,7 +456,7 @@ int ngtcp2_crypto_read_write_crypto_data(
 caseSSL_ERROR_SSL:
 return-1;
 caseSSL_ERROR_EARLY_DATA_REJECTED:
-assert(!ngtcp2_conn_is_server(conn));
+assert(!ngtcp2_conn_is_server2(conn));
 
 SSL_reset_early_data_reject(ssl);
 

deps/ngtcp2/ngtcp2/crypto/cryptotest.c

@@ -0,0 +1,46 @@
+/*
+ * ngtcp2
+ *
+ * Copyright (c) 2026 ngtcp2 contributors
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+#ifdefHAVE_CONFIG_H
+# include<config.h>
+#endif/* defined(HAVE_CONFIG_H) */
+
+#include"munit.h"
+
+/* include test cases' include files here */
+#include"shared_test.h"
+
+intmain(intargc, char*argv[]) {
+constMunitSuitesuites[] = {
+shared_suite,
+ {0},
+ };
+constMunitSuitesuite= {
+ .prefix="",
+ .suites=suites,
+ .iterations=1,
+ };
+
+returnmunit_suite_main(&suite, NULL, argc, argv);
+}

deps/ngtcp2/ngtcp2/crypto/includes/ngtcp2/ngtcp2_crypto.h

@@ -338,16 +338,16 @@ ngtcp2_crypto_hp_mask_cb(uint8_t *dest, const ngtcp2_crypto_cipher *hp,
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_0RTT`) to
  * set negotiated AEAD and message digest algorithm. After the
  * successful call of this function, application can use
- * `ngtcp2_conn_get_crypto_ctx` (or `ngtcp2_conn_get_0rtt_crypto_ctx`
- * if |level| ==
+ * `ngtcp2_conn_get_crypto_ctx2` (or
+ * `ngtcp2_conn_get_0rtt_crypto_ctx2` if |level| ==
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_0RTT`) to
  * get :type:`ngtcp2_crypto_ctx`.
  *
  * If |conn| is initialized as client, and |level| is
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_1RTT`, this
  * function retrieves a remote QUIC transport parameters extension
- * from an object obtained by `ngtcp2_conn_get_tls_native_handle`, and
- * sets it to |conn| by calling
+ * from an object obtained by `ngtcp2_conn_get_tls_native_handle2`,
+ * and sets it to |conn| by calling
  * `ngtcp2_conn_decode_and_set_remote_transport_params`.
  *
  * This function returns 0 if it succeeds, or -1.
@@ -385,16 +385,16 @@ NGTCP2_EXTERN int ngtcp2_crypto_derive_and_install_rx_key(
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_0RTT`) to
  * set negotiated AEAD and message digest algorithm. After the
  * successful call of this function, application can use
- * `ngtcp2_conn_get_crypto_ctx` (or `ngtcp2_conn_get_0rtt_crypto_ctx`
- * if |level| ==
+ * `ngtcp2_conn_get_crypto_ctx2` (or
+ * `ngtcp2_conn_get_0rtt_crypto_ctx2` if |level| ==
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_0RTT`) to
  * get :type:`ngtcp2_crypto_ctx`.
  *
  * If |conn| is initialized as server, and |level| is
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_1RTT`, this
  * function retrieves a remote QUIC transport parameters extension
- * from an object obtained by `ngtcp2_conn_get_tls_native_handle`, and
- * sets it to |conn| by calling
+ * from an object obtained by `ngtcp2_conn_get_tls_native_handle2`,
+ * and sets it to |conn| by calling
  * `ngtcp2_conn_decode_and_set_remote_transport_params`.
  *
  * This function returns 0 if it succeeds, or -1.
@@ -986,15 +986,17 @@ NGTCP2_EXTERN void ngtcp2_crypto_delete_crypto_cipher_ctx_cb(
 /**
  * @function
  *
+ * .. warning::
+ *
+ * .. version-deprecated:: 1.22.0
+ * Use `ngtcp2_crypto_get_path_challenge_data2_cb` instead.
+ *
  * `ngtcp2_crypto_get_path_challenge_data_cb` writes unpredictable
  * sequence of :macro:`NGTCP2_PATH_CHALLENGE_DATALEN` bytes to |data|
  * which is sent with PATH_CHALLENGE frame.
  *
  * This function can be directly passed to
  * :member:`ngtcp2_callbacks.get_path_challenge_data` field.
- *
- * Deprecated since v1.22.0. Use
- * `ngtcp2_crypto_get_path_challenge_data2_cb` instead.
  */
 NGTCP2_EXTERNintngtcp2_crypto_get_path_challenge_data_cb(ngtcp2_conn*conn,
 uint8_t*data,
@@ -1010,7 +1012,7 @@ NGTCP2_EXTERN int ngtcp2_crypto_get_path_challenge_data_cb(ngtcp2_conn *conn,
  * This function can be directly passed to
  * :member:`ngtcp2_callbacks.get_path_challenge_data2` field.
  *
- * This function has been available since v1.22.0.
+ * .. version-added:: 1.22.0
  */
 NGTCP2_EXTERNintngtcp2_crypto_get_path_challenge_data2_cb(
 ngtcp2_conn*conn, ngtcp2_path_challenge_data*data, void*user_data);

deps/ngtcp2/ngtcp2/crypto/ossl/ossl.c

@@ -440,7 +440,7 @@ static int crypto_ossl_ctx_write_crypto_data(ngtcp2_crypto_ossl_ctx *ossl_ctx,
 left=crypto_buf_left(ossl_ctx->crypto_write);
  }
 
-n=ngtcp2_min_size((size_t)(end-data), left);
+n=ngtcp2_min((size_t)(end-data), left);
 crypto_buf_write(ossl_ctx->crypto_write, data, n);
 data+=n;
  }
@@ -871,7 +871,7 @@ int ngtcp2_crypto_hp_mask(uint8_t *dest, const ngtcp2_crypto_cipher *hp,
 intngtcp2_crypto_read_write_crypto_data(
 ngtcp2_conn*conn, ngtcp2_encryption_levelencryption_level,
 constuint8_t*data, size_tdatalen) {
-ngtcp2_crypto_ossl_ctx*ossl_ctx=ngtcp2_conn_get_tls_native_handle(conn);
+ngtcp2_crypto_ossl_ctx*ossl_ctx=ngtcp2_conn_get_tls_native_handle2(conn);
 SSL*ssl=ossl_ctx->ssl;
 intrv;
 interr;
@@ -881,7 +881,7 @@ int ngtcp2_crypto_read_write_crypto_data(
 return-1;
  }
 
-if (!ngtcp2_conn_get_handshake_completed(conn)) {
+if (!ngtcp2_conn_get_handshake_completed2(conn)) {
 rv=SSL_do_handshake(ssl);
 if (rv <= 0) {
 err=SSL_get_error(ssl, rv);
@@ -1033,7 +1033,7 @@ static int ossl_yield_secret(SSL *ssl, uint32_t ossl_level, int direction,
  }
 
 conn=conn_ref->get_conn(conn_ref);
-ossl_ctx=ngtcp2_conn_get_tls_native_handle(conn);
+ossl_ctx=ngtcp2_conn_get_tls_native_handle2(conn);
 
 if (direction) {
 if (ngtcp2_crypto_derive_and_install_tx_key(conn, NULL, NULL, NULL, level,
@@ -1067,7 +1067,7 @@ static int ossl_crypto_send(SSL *ssl, const unsigned char *buf, size_t buflen,
  }
 
 conn=conn_ref->get_conn(conn_ref);
-ossl_ctx=ngtcp2_conn_get_tls_native_handle(conn);
+ossl_ctx=ngtcp2_conn_get_tls_native_handle2(conn);
 
 rv=ngtcp2_conn_submit_crypto_data(conn, ossl_ctx->tx_level, buf, buflen);
 if (rv!=0) {
@@ -1094,7 +1094,7 @@ static int ossl_crypto_recv_rcd(SSL *ssl, const unsigned char **buf,
  }
 
 conn=conn_ref->get_conn(conn_ref);
-ossl_ctx=ngtcp2_conn_get_tls_native_handle(conn);
+ossl_ctx=ngtcp2_conn_get_tls_native_handle2(conn);
 
 crypto_ossl_ctx_read_crypto_data(ossl_ctx, buf, bytes_read);
 
@@ -1116,7 +1116,7 @@ static int ossl_crypto_release_rcd(SSL *ssl, size_t released, void *arg) {
  }
 
 conn=conn_ref->get_conn(conn_ref);
-ossl_ctx=ngtcp2_conn_get_tls_native_handle(conn);
+ossl_ctx=ngtcp2_conn_get_tls_native_handle2(conn);
 
 crypto_ossl_ctx_release_crypto_data(ossl_ctx, released);
 

deps/ngtcp2/ngtcp2/crypto/picotls/picotls.c

@@ -378,7 +378,7 @@ int ngtcp2_crypto_hp_mask(uint8_t *dest, const ngtcp2_crypto_cipher *hp,
 intngtcp2_crypto_read_write_crypto_data(
 ngtcp2_conn*conn, ngtcp2_encryption_levelencryption_level,
 constuint8_t*data, size_tdatalen) {
-ngtcp2_crypto_picotls_ctx*cptls=ngtcp2_conn_get_tls_native_handle(conn);
+ngtcp2_crypto_picotls_ctx*cptls=ngtcp2_conn_get_tls_native_handle2(conn);
 ptls_buffer_tsendbuf;
 size_tepoch_offsets[5] = {0};
 size_tepoch=
@@ -402,7 +402,7 @@ int ngtcp2_crypto_read_write_crypto_data(
  goto fin;
  }
 
-if (!ngtcp2_conn_is_server(conn) &&
+if (!ngtcp2_conn_is_server2(conn) &&
 cptls->handshake_properties.client.early_data_acceptance==
 PTLS_EARLY_DATA_REJECTED) {
 rv=ngtcp2_conn_tls_early_data_rejected(conn);
@@ -540,7 +540,7 @@ static int set_additional_extensions(ptls_handshake_properties_t *hsprops,
 return-1;
  }
 
-nwrite=ngtcp2_conn_encode_local_transport_params(conn, buf, buflen);
+nwrite=ngtcp2_conn_encode_local_transport_params2(conn, buf, buflen);
 if (nwrite<0) {
  goto fail;
  }
@@ -620,7 +620,7 @@ static int update_traffic_key_server_cb(ptls_update_traffic_key_t *self,
  * wait for the key to get the correct local transport
  * parameters from ngtcp2_conn.
  */
-cptls=ngtcp2_conn_get_tls_native_handle(conn);
+cptls=ngtcp2_conn_get_tls_native_handle2(conn);
 
 if (set_additional_extensions(&cptls->handshake_properties, conn) !=0) {
 return-1;

deps/ngtcp2/ngtcp2/crypto/quictls/quictls.c

@@ -812,7 +812,7 @@ int ngtcp2_crypto_hp_mask(uint8_t *dest, const ngtcp2_crypto_cipher *hp,
 intngtcp2_crypto_read_write_crypto_data(
 ngtcp2_conn*conn, ngtcp2_encryption_levelencryption_level,
 constuint8_t*data, size_tdatalen) {
-SSL*ssl=ngtcp2_conn_get_tls_native_handle(conn);
+SSL*ssl=ngtcp2_conn_get_tls_native_handle2(conn);
 intrv;
 interr;
 
@@ -824,7 +824,7 @@ int ngtcp2_crypto_read_write_crypto_data(
 return-1;
  }
 
-if (!ngtcp2_conn_get_handshake_completed(conn)) {
+if (!ngtcp2_conn_get_handshake_completed2(conn)) {
 rv=SSL_do_handshake(ssl);
 if (rv <= 0) {
 err=SSL_get_error(ssl, rv);

deps/ngtcp2/ngtcp2/crypto/boringssl/boringssl.c

@@ -432,7 +432,7 @@ int ngtcp2_crypto_hp_mask(uint8_t *dest, const ngtcp2_crypto_cipher *hp,
 intngtcp2_crypto_read_write_crypto_data(
 ngtcp2_conn*conn, ngtcp2_encryption_levelencryption_level,
 constuint8_t*data, size_tdatalen) {
-SSL*ssl=ngtcp2_conn_get_tls_native_handle(conn);
+SSL*ssl=ngtcp2_conn_get_tls_native_handle2(conn);
 intrv;
 interr;
 
@@ -444,7 +444,7 @@ int ngtcp2_crypto_read_write_crypto_data(
 return-1;
  }
 
-if (!ngtcp2_conn_get_handshake_completed(conn)) {
+if (!ngtcp2_conn_get_handshake_completed2(conn)) {
 retry:
 rv=SSL_do_handshake(ssl);
 if (rv <= 0) {
@@ -456,7 +456,7 @@ int ngtcp2_crypto_read_write_crypto_data(
 caseSSL_ERROR_SSL:
 return-1;
 caseSSL_ERROR_EARLY_DATA_REJECTED:
-assert(!ngtcp2_conn_is_server(conn));
+assert(!ngtcp2_conn_is_server2(conn));
 
 SSL_reset_early_data_reject(ssl);
 

deps/ngtcp2/ngtcp2/crypto/cryptotest.c

@@ -0,0 +1,46 @@
+/*
+ * ngtcp2
+ *
+ * Copyright (c) 2026 ngtcp2 contributors
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+#ifdefHAVE_CONFIG_H
+# include<config.h>
+#endif/* defined(HAVE_CONFIG_H) */
+
+#include"munit.h"
+
+/* include test cases' include files here */
+#include"shared_test.h"
+
+intmain(intargc, char*argv[]) {
+constMunitSuitesuites[] = {
+shared_suite,
+ {0},
+ };
+constMunitSuitesuite= {
+ .prefix="",
+ .suites=suites,
+ .iterations=1,
+ };
+
+returnmunit_suite_main(&suite, NULL, argc, argv);
+}

deps/ngtcp2/ngtcp2/crypto/includes/ngtcp2/ngtcp2_crypto.h

@@ -338,16 +338,16 @@ ngtcp2_crypto_hp_mask_cb(uint8_t *dest, const ngtcp2_crypto_cipher *hp,
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_0RTT`) to
  * set negotiated AEAD and message digest algorithm. After the
  * successful call of this function, application can use
- * `ngtcp2_conn_get_crypto_ctx` (or `ngtcp2_conn_get_0rtt_crypto_ctx`
- * if |level| ==
+ * `ngtcp2_conn_get_crypto_ctx2` (or
+ * `ngtcp2_conn_get_0rtt_crypto_ctx2` if |level| ==
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_0RTT`) to
  * get :type:`ngtcp2_crypto_ctx`.
  *
  * If |conn| is initialized as client, and |level| is
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_1RTT`, this
  * function retrieves a remote QUIC transport parameters extension
- * from an object obtained by `ngtcp2_conn_get_tls_native_handle`, and
- * sets it to |conn| by calling
+ * from an object obtained by `ngtcp2_conn_get_tls_native_handle2`,
+ * and sets it to |conn| by calling
  * `ngtcp2_conn_decode_and_set_remote_transport_params`.
  *
  * This function returns 0 if it succeeds, or -1.
@@ -385,16 +385,16 @@ NGTCP2_EXTERN int ngtcp2_crypto_derive_and_install_rx_key(
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_0RTT`) to
  * set negotiated AEAD and message digest algorithm. After the
  * successful call of this function, application can use
- * `ngtcp2_conn_get_crypto_ctx` (or `ngtcp2_conn_get_0rtt_crypto_ctx`
- * if |level| ==
+ * `ngtcp2_conn_get_crypto_ctx2` (or
+ * `ngtcp2_conn_get_0rtt_crypto_ctx2` if |level| ==
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_0RTT`) to
  * get :type:`ngtcp2_crypto_ctx`.
  *
  * If |conn| is initialized as server, and |level| is
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_1RTT`, this
  * function retrieves a remote QUIC transport parameters extension
- * from an object obtained by `ngtcp2_conn_get_tls_native_handle`, and
- * sets it to |conn| by calling
+ * from an object obtained by `ngtcp2_conn_get_tls_native_handle2`,
+ * and sets it to |conn| by calling
  * `ngtcp2_conn_decode_and_set_remote_transport_params`.
  *
  * This function returns 0 if it succeeds, or -1.
@@ -986,15 +986,17 @@ NGTCP2_EXTERN void ngtcp2_crypto_delete_crypto_cipher_ctx_cb(
 /**
  * @function
  *
+ * .. warning::
+ *
+ * .. version-deprecated:: 1.22.0
+ * Use `ngtcp2_crypto_get_path_challenge_data2_cb` instead.
+ *
  * `ngtcp2_crypto_get_path_challenge_data_cb` writes unpredictable
  * sequence of :macro:`NGTCP2_PATH_CHALLENGE_DATALEN` bytes to |data|
  * which is sent with PATH_CHALLENGE frame.
  *
  * This function can be directly passed to
  * :member:`ngtcp2_callbacks.get_path_challenge_data` field.
- *
- * Deprecated since v1.22.0. Use
- * `ngtcp2_crypto_get_path_challenge_data2_cb` instead.
  */
 NGTCP2_EXTERNintngtcp2_crypto_get_path_challenge_data_cb(ngtcp2_conn*conn,
 uint8_t*data,
@@ -1010,7 +1012,7 @@ NGTCP2_EXTERN int ngtcp2_crypto_get_path_challenge_data_cb(ngtcp2_conn *conn,
  * This function can be directly passed to
  * :member:`ngtcp2_callbacks.get_path_challenge_data2` field.
  *
- * This function has been available since v1.22.0.
+ * .. version-added:: 1.22.0
  */
 NGTCP2_EXTERNintngtcp2_crypto_get_path_challenge_data2_cb(
 ngtcp2_conn*conn, ngtcp2_path_challenge_data*data, void*user_data);

deps/ngtcp2/ngtcp2/crypto/ossl/ossl.c

@@ -440,7 +440,7 @@ static int crypto_ossl_ctx_write_crypto_data(ngtcp2_crypto_ossl_ctx *ossl_ctx,
 left=crypto_buf_left(ossl_ctx->crypto_write);
  }
 
-n=ngtcp2_min_size((size_t)(end-data), left);
+n=ngtcp2_min((size_t)(end-data), left);
 crypto_buf_write(ossl_ctx->crypto_write, data, n);
 data+=n;
  }
@@ -871,7 +871,7 @@ int ngtcp2_crypto_hp_mask(uint8_t *dest, const ngtcp2_crypto_cipher *hp,
 intngtcp2_crypto_read_write_crypto_data(
 ngtcp2_conn*conn, ngtcp2_encryption_levelencryption_level,
 constuint8_t*data, size_tdatalen) {
-ngtcp2_crypto_ossl_ctx*ossl_ctx=ngtcp2_conn_get_tls_native_handle(conn);
+ngtcp2_crypto_ossl_ctx*ossl_ctx=ngtcp2_conn_get_tls_native_handle2(conn);
 SSL*ssl=ossl_ctx->ssl;
 intrv;
 interr;
@@ -881,7 +881,7 @@ int ngtcp2_crypto_read_write_crypto_data(
 return-1;
  }
 
-if (!ngtcp2_conn_get_handshake_completed(conn)) {
+if (!ngtcp2_conn_get_handshake_completed2(conn)) {
 rv=SSL_do_handshake(ssl);
 if (rv <= 0) {
 err=SSL_get_error(ssl, rv);
@@ -1033,7 +1033,7 @@ static int ossl_yield_secret(SSL *ssl, uint32_t ossl_level, int direction,
  }
 
 conn=conn_ref->get_conn(conn_ref);
-ossl_ctx=ngtcp2_conn_get_tls_native_handle(conn);
+ossl_ctx=ngtcp2_conn_get_tls_native_handle2(conn);
 
 if (direction) {
 if (ngtcp2_crypto_derive_and_install_tx_key(conn, NULL, NULL, NULL, level,
@@ -1067,7 +1067,7 @@ static int ossl_crypto_send(SSL *ssl, const unsigned char *buf, size_t buflen,
  }
 
 conn=conn_ref->get_conn(conn_ref);
-ossl_ctx=ngtcp2_conn_get_tls_native_handle(conn);
+ossl_ctx=ngtcp2_conn_get_tls_native_handle2(conn);
 
 rv=ngtcp2_conn_submit_crypto_data(conn, ossl_ctx->tx_level, buf, buflen);
 if (rv!=0) {
@@ -1094,7 +1094,7 @@ static int ossl_crypto_recv_rcd(SSL *ssl, const unsigned char **buf,
  }
 
 conn=conn_ref->get_conn(conn_ref);
-ossl_ctx=ngtcp2_conn_get_tls_native_handle(conn);
+ossl_ctx=ngtcp2_conn_get_tls_native_handle2(conn);
 
 crypto_ossl_ctx_read_crypto_data(ossl_ctx, buf, bytes_read);
 
@@ -1116,7 +1116,7 @@ static int ossl_crypto_release_rcd(SSL *ssl, size_t released, void *arg) {
  }
 
 conn=conn_ref->get_conn(conn_ref);
-ossl_ctx=ngtcp2_conn_get_tls_native_handle(conn);
+ossl_ctx=ngtcp2_conn_get_tls_native_handle2(conn);
 
 crypto_ossl_ctx_release_crypto_data(ossl_ctx, released);
 

deps/ngtcp2/ngtcp2/crypto/picotls/picotls.c

@@ -378,7 +378,7 @@ int ngtcp2_crypto_hp_mask(uint8_t *dest, const ngtcp2_crypto_cipher *hp,
 intngtcp2_crypto_read_write_crypto_data(
 ngtcp2_conn*conn, ngtcp2_encryption_levelencryption_level,
 constuint8_t*data, size_tdatalen) {
-ngtcp2_crypto_picotls_ctx*cptls=ngtcp2_conn_get_tls_native_handle(conn);
+ngtcp2_crypto_picotls_ctx*cptls=ngtcp2_conn_get_tls_native_handle2(conn);
 ptls_buffer_tsendbuf;
 size_tepoch_offsets[5] = {0};
 size_tepoch=
@@ -402,7 +402,7 @@ int ngtcp2_crypto_read_write_crypto_data(
  goto fin;
  }
 
-if (!ngtcp2_conn_is_server(conn) &&
+if (!ngtcp2_conn_is_server2(conn) &&
 cptls->handshake_properties.client.early_data_acceptance==
 PTLS_EARLY_DATA_REJECTED) {
 rv=ngtcp2_conn_tls_early_data_rejected(conn);
@@ -540,7 +540,7 @@ static int set_additional_extensions(ptls_handshake_properties_t *hsprops,
 return-1;
  }
 
-nwrite=ngtcp2_conn_encode_local_transport_params(conn, buf, buflen);
+nwrite=ngtcp2_conn_encode_local_transport_params2(conn, buf, buflen);
 if (nwrite<0) {
  goto fail;
  }
@@ -620,7 +620,7 @@ static int update_traffic_key_server_cb(ptls_update_traffic_key_t *self,
  * wait for the key to get the correct local transport
  * parameters from ngtcp2_conn.
  */
-cptls=ngtcp2_conn_get_tls_native_handle(conn);
+cptls=ngtcp2_conn_get_tls_native_handle2(conn);
 
 if (set_additional_extensions(&cptls->handshake_properties, conn) !=0) {
 return-1;

deps/ngtcp2/ngtcp2/crypto/quictls/quictls.c

@@ -812,7 +812,7 @@ int ngtcp2_crypto_hp_mask(uint8_t *dest, const ngtcp2_crypto_cipher *hp,
 intngtcp2_crypto_read_write_crypto_data(
 ngtcp2_conn*conn, ngtcp2_encryption_levelencryption_level,
 constuint8_t*data, size_tdatalen) {
-SSL*ssl=ngtcp2_conn_get_tls_native_handle(conn);
+SSL*ssl=ngtcp2_conn_get_tls_native_handle2(conn);
 intrv;
 interr;
 
@@ -824,7 +824,7 @@ int ngtcp2_crypto_read_write_crypto_data(
 return-1;
  }
 
-if (!ngtcp2_conn_get_handshake_completed(conn)) {
+if (!ngtcp2_conn_get_handshake_completed2(conn)) {
 rv=SSL_do_handshake(ssl);
 if (rv <= 0) {
 err=SSL_get_error(ssl, rv);

deps/ngtcp2/ngtcp2/crypto/boringssl/boringssl.c

@@ -432,7 +432,7 @@ int ngtcp2_crypto_hp_mask(uint8_t *dest, const ngtcp2_crypto_cipher *hp,
 intngtcp2_crypto_read_write_crypto_data(
 ngtcp2_conn*conn, ngtcp2_encryption_levelencryption_level,
 constuint8_t*data, size_tdatalen) {
-SSL*ssl=ngtcp2_conn_get_tls_native_handle(conn);
+SSL*ssl=ngtcp2_conn_get_tls_native_handle2(conn);
 intrv;
 interr;
 
@@ -444,7 +444,7 @@ int ngtcp2_crypto_read_write_crypto_data(
 return-1;
  }
 
-if (!ngtcp2_conn_get_handshake_completed(conn)) {
+if (!ngtcp2_conn_get_handshake_completed2(conn)) {
 retry:
 rv=SSL_do_handshake(ssl);
 if (rv <= 0) {
@@ -456,7 +456,7 @@ int ngtcp2_crypto_read_write_crypto_data(
 caseSSL_ERROR_SSL:
 return-1;
 caseSSL_ERROR_EARLY_DATA_REJECTED:
-assert(!ngtcp2_conn_is_server(conn));
+assert(!ngtcp2_conn_is_server2(conn));
 
 SSL_reset_early_data_reject(ssl);
 

deps/ngtcp2/ngtcp2/crypto/cryptotest.c

@@ -0,0 +1,46 @@
+/*
+ * ngtcp2
+ *
+ * Copyright (c) 2026 ngtcp2 contributors
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+#ifdefHAVE_CONFIG_H
+# include<config.h>
+#endif/* defined(HAVE_CONFIG_H) */
+
+#include"munit.h"
+
+/* include test cases' include files here */
+#include"shared_test.h"
+
+intmain(intargc, char*argv[]) {
+constMunitSuitesuites[] = {
+shared_suite,
+ {0},
+ };
+constMunitSuitesuite= {
+ .prefix="",
+ .suites=suites,
+ .iterations=1,
+ };
+
+returnmunit_suite_main(&suite, NULL, argc, argv);
+}

deps/ngtcp2/ngtcp2/crypto/includes/ngtcp2/ngtcp2_crypto.h

@@ -338,16 +338,16 @@ ngtcp2_crypto_hp_mask_cb(uint8_t *dest, const ngtcp2_crypto_cipher *hp,
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_0RTT`) to
  * set negotiated AEAD and message digest algorithm. After the
  * successful call of this function, application can use
- * `ngtcp2_conn_get_crypto_ctx` (or `ngtcp2_conn_get_0rtt_crypto_ctx`
- * if |level| ==
+ * `ngtcp2_conn_get_crypto_ctx2` (or
+ * `ngtcp2_conn_get_0rtt_crypto_ctx2` if |level| ==
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_0RTT`) to
  * get :type:`ngtcp2_crypto_ctx`.
  *
  * If |conn| is initialized as client, and |level| is
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_1RTT`, this
  * function retrieves a remote QUIC transport parameters extension
- * from an object obtained by `ngtcp2_conn_get_tls_native_handle`, and
- * sets it to |conn| by calling
+ * from an object obtained by `ngtcp2_conn_get_tls_native_handle2`,
+ * and sets it to |conn| by calling
  * `ngtcp2_conn_decode_and_set_remote_transport_params`.
  *
  * This function returns 0 if it succeeds, or -1.
@@ -385,16 +385,16 @@ NGTCP2_EXTERN int ngtcp2_crypto_derive_and_install_rx_key(
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_0RTT`) to
  * set negotiated AEAD and message digest algorithm. After the
  * successful call of this function, application can use
- * `ngtcp2_conn_get_crypto_ctx` (or `ngtcp2_conn_get_0rtt_crypto_ctx`
- * if |level| ==
+ * `ngtcp2_conn_get_crypto_ctx2` (or
+ * `ngtcp2_conn_get_0rtt_crypto_ctx2` if |level| ==
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_0RTT`) to
  * get :type:`ngtcp2_crypto_ctx`.
  *
  * If |conn| is initialized as server, and |level| is
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_1RTT`, this
  * function retrieves a remote QUIC transport parameters extension
- * from an object obtained by `ngtcp2_conn_get_tls_native_handle`, and
- * sets it to |conn| by calling
+ * from an object obtained by `ngtcp2_conn_get_tls_native_handle2`,
+ * and sets it to |conn| by calling
  * `ngtcp2_conn_decode_and_set_remote_transport_params`.
  *
  * This function returns 0 if it succeeds, or -1.
@@ -986,15 +986,17 @@ NGTCP2_EXTERN void ngtcp2_crypto_delete_crypto_cipher_ctx_cb(
 /**
  * @function
  *
+ * .. warning::
+ *
+ * .. version-deprecated:: 1.22.0
+ * Use `ngtcp2_crypto_get_path_challenge_data2_cb` instead.
+ *
  * `ngtcp2_crypto_get_path_challenge_data_cb` writes unpredictable
  * sequence of :macro:`NGTCP2_PATH_CHALLENGE_DATALEN` bytes to |data|
  * which is sent with PATH_CHALLENGE frame.
  *
  * This function can be directly passed to
  * :member:`ngtcp2_callbacks.get_path_challenge_data` field.
- *
- * Deprecated since v1.22.0. Use
- * `ngtcp2_crypto_get_path_challenge_data2_cb` instead.
  */
 NGTCP2_EXTERNintngtcp2_crypto_get_path_challenge_data_cb(ngtcp2_conn*conn,
 uint8_t*data,
@@ -1010,7 +1012,7 @@ NGTCP2_EXTERN int ngtcp2_crypto_get_path_challenge_data_cb(ngtcp2_conn *conn,
  * This function can be directly passed to
  * :member:`ngtcp2_callbacks.get_path_challenge_data2` field.
  *
- * This function has been available since v1.22.0.
+ * .. version-added:: 1.22.0
  */
 NGTCP2_EXTERNintngtcp2_crypto_get_path_challenge_data2_cb(
 ngtcp2_conn*conn, ngtcp2_path_challenge_data*data, void*user_data);

deps/ngtcp2/ngtcp2/crypto/ossl/ossl.c

@@ -440,7 +440,7 @@ static int crypto_ossl_ctx_write_crypto_data(ngtcp2_crypto_ossl_ctx *ossl_ctx,
 left=crypto_buf_left(ossl_ctx->crypto_write);
  }
 
-n=ngtcp2_min_size((size_t)(end-data), left);
+n=ngtcp2_min((size_t)(end-data), left);
 crypto_buf_write(ossl_ctx->crypto_write, data, n);
 data+=n;
  }
@@ -871,7 +871,7 @@ int ngtcp2_crypto_hp_mask(uint8_t *dest, const ngtcp2_crypto_cipher *hp,
 intngtcp2_crypto_read_write_crypto_data(
 ngtcp2_conn*conn, ngtcp2_encryption_levelencryption_level,
 constuint8_t*data, size_tdatalen) {
-ngtcp2_crypto_ossl_ctx*ossl_ctx=ngtcp2_conn_get_tls_native_handle(conn);
+ngtcp2_crypto_ossl_ctx*ossl_ctx=ngtcp2_conn_get_tls_native_handle2(conn);
 SSL*ssl=ossl_ctx->ssl;
 intrv;
 interr;
@@ -881,7 +881,7 @@ int ngtcp2_crypto_read_write_crypto_data(
 return-1;
  }
 
-if (!ngtcp2_conn_get_handshake_completed(conn)) {
+if (!ngtcp2_conn_get_handshake_completed2(conn)) {
 rv=SSL_do_handshake(ssl);
 if (rv <= 0) {
 err=SSL_get_error(ssl, rv);
@@ -1033,7 +1033,7 @@ static int ossl_yield_secret(SSL *ssl, uint32_t ossl_level, int direction,
  }
 
 conn=conn_ref->get_conn(conn_ref);
-ossl_ctx=ngtcp2_conn_get_tls_native_handle(conn);
+ossl_ctx=ngtcp2_conn_get_tls_native_handle2(conn);
 
 if (direction) {
 if (ngtcp2_crypto_derive_and_install_tx_key(conn, NULL, NULL, NULL, level,
@@ -1067,7 +1067,7 @@ static int ossl_crypto_send(SSL *ssl, const unsigned char *buf, size_t buflen,
  }
 
 conn=conn_ref->get_conn(conn_ref);
-ossl_ctx=ngtcp2_conn_get_tls_native_handle(conn);
+ossl_ctx=ngtcp2_conn_get_tls_native_handle2(conn);
 
 rv=ngtcp2_conn_submit_crypto_data(conn, ossl_ctx->tx_level, buf, buflen);
 if (rv!=0) {
@@ -1094,7 +1094,7 @@ static int ossl_crypto_recv_rcd(SSL *ssl, const unsigned char **buf,
  }
 
 conn=conn_ref->get_conn(conn_ref);
-ossl_ctx=ngtcp2_conn_get_tls_native_handle(conn);
+ossl_ctx=ngtcp2_conn_get_tls_native_handle2(conn);
 
 crypto_ossl_ctx_read_crypto_data(ossl_ctx, buf, bytes_read);
 
@@ -1116,7 +1116,7 @@ static int ossl_crypto_release_rcd(SSL *ssl, size_t released, void *arg) {
  }
 
 conn=conn_ref->get_conn(conn_ref);
-ossl_ctx=ngtcp2_conn_get_tls_native_handle(conn);
+ossl_ctx=ngtcp2_conn_get_tls_native_handle2(conn);
 
 crypto_ossl_ctx_release_crypto_data(ossl_ctx, released);
 

deps/ngtcp2/ngtcp2/crypto/picotls/picotls.c

@@ -378,7 +378,7 @@ int ngtcp2_crypto_hp_mask(uint8_t *dest, const ngtcp2_crypto_cipher *hp,
 intngtcp2_crypto_read_write_crypto_data(
 ngtcp2_conn*conn, ngtcp2_encryption_levelencryption_level,
 constuint8_t*data, size_tdatalen) {
-ngtcp2_crypto_picotls_ctx*cptls=ngtcp2_conn_get_tls_native_handle(conn);
+ngtcp2_crypto_picotls_ctx*cptls=ngtcp2_conn_get_tls_native_handle2(conn);
 ptls_buffer_tsendbuf;
 size_tepoch_offsets[5] = {0};
 size_tepoch=
@@ -402,7 +402,7 @@ int ngtcp2_crypto_read_write_crypto_data(
  goto fin;
  }
 
-if (!ngtcp2_conn_is_server(conn) &&
+if (!ngtcp2_conn_is_server2(conn) &&
 cptls->handshake_properties.client.early_data_acceptance==
 PTLS_EARLY_DATA_REJECTED) {
 rv=ngtcp2_conn_tls_early_data_rejected(conn);
@@ -540,7 +540,7 @@ static int set_additional_extensions(ptls_handshake_properties_t *hsprops,
 return-1;
  }
 
-nwrite=ngtcp2_conn_encode_local_transport_params(conn, buf, buflen);
+nwrite=ngtcp2_conn_encode_local_transport_params2(conn, buf, buflen);
 if (nwrite<0) {
  goto fail;
  }
@@ -620,7 +620,7 @@ static int update_traffic_key_server_cb(ptls_update_traffic_key_t *self,
  * wait for the key to get the correct local transport
  * parameters from ngtcp2_conn.
  */
-cptls=ngtcp2_conn_get_tls_native_handle(conn);
+cptls=ngtcp2_conn_get_tls_native_handle2(conn);
 
 if (set_additional_extensions(&cptls->handshake_properties, conn) !=0) {
 return-1;

deps/ngtcp2/ngtcp2/crypto/quictls/quictls.c

@@ -812,7 +812,7 @@ int ngtcp2_crypto_hp_mask(uint8_t *dest, const ngtcp2_crypto_cipher *hp,
 intngtcp2_crypto_read_write_crypto_data(
 ngtcp2_conn*conn, ngtcp2_encryption_levelencryption_level,
 constuint8_t*data, size_tdatalen) {
-SSL*ssl=ngtcp2_conn_get_tls_native_handle(conn);
+SSL*ssl=ngtcp2_conn_get_tls_native_handle2(conn);
 intrv;
 interr;
 
@@ -824,7 +824,7 @@ int ngtcp2_crypto_read_write_crypto_data(
 return-1;
  }
 
-if (!ngtcp2_conn_get_handshake_completed(conn)) {
+if (!ngtcp2_conn_get_handshake_completed2(conn)) {
 rv=SSL_do_handshake(ssl);
 if (rv <= 0) {
 err=SSL_get_error(ssl, rv);

deps/ngtcp2/ngtcp2/crypto/boringssl/boringssl.c

@@ -432,7 +432,7 @@ int ngtcp2_crypto_hp_mask(uint8_t *dest, const ngtcp2_crypto_cipher *hp,
 intngtcp2_crypto_read_write_crypto_data(
 ngtcp2_conn*conn, ngtcp2_encryption_levelencryption_level,
 constuint8_t*data, size_tdatalen) {
-SSL*ssl=ngtcp2_conn_get_tls_native_handle(conn);
+SSL*ssl=ngtcp2_conn_get_tls_native_handle2(conn);
 intrv;
 interr;
 
@@ -444,7 +444,7 @@ int ngtcp2_crypto_read_write_crypto_data(
 return-1;
  }
 
-if (!ngtcp2_conn_get_handshake_completed(conn)) {
+if (!ngtcp2_conn_get_handshake_completed2(conn)) {
 retry:
 rv=SSL_do_handshake(ssl);
 if (rv <= 0) {
@@ -456,7 +456,7 @@ int ngtcp2_crypto_read_write_crypto_data(
 caseSSL_ERROR_SSL:
 return-1;
 caseSSL_ERROR_EARLY_DATA_REJECTED:
-assert(!ngtcp2_conn_is_server(conn));
+assert(!ngtcp2_conn_is_server2(conn));
 
 SSL_reset_early_data_reject(ssl);
 

deps/ngtcp2/ngtcp2/crypto/cryptotest.c

@@ -0,0 +1,46 @@
+/*
+ * ngtcp2
+ *
+ * Copyright (c) 2026 ngtcp2 contributors
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+#ifdefHAVE_CONFIG_H
+# include<config.h>
+#endif/* defined(HAVE_CONFIG_H) */
+
+#include"munit.h"
+
+/* include test cases' include files here */
+#include"shared_test.h"
+
+intmain(intargc, char*argv[]) {
+constMunitSuitesuites[] = {
+shared_suite,
+ {0},
+ };
+constMunitSuitesuite= {
+ .prefix="",
+ .suites=suites,
+ .iterations=1,
+ };
+
+returnmunit_suite_main(&suite, NULL, argc, argv);
+}

deps/ngtcp2/ngtcp2/crypto/includes/ngtcp2/ngtcp2_crypto.h

@@ -338,16 +338,16 @@ ngtcp2_crypto_hp_mask_cb(uint8_t *dest, const ngtcp2_crypto_cipher *hp,
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_0RTT`) to
  * set negotiated AEAD and message digest algorithm. After the
  * successful call of this function, application can use
- * `ngtcp2_conn_get_crypto_ctx` (or `ngtcp2_conn_get_0rtt_crypto_ctx`
- * if |level| ==
+ * `ngtcp2_conn_get_crypto_ctx2` (or
+ * `ngtcp2_conn_get_0rtt_crypto_ctx2` if |level| ==
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_0RTT`) to
  * get :type:`ngtcp2_crypto_ctx`.
  *
  * If |conn| is initialized as client, and |level| is
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_1RTT`, this
  * function retrieves a remote QUIC transport parameters extension
- * from an object obtained by `ngtcp2_conn_get_tls_native_handle`, and
- * sets it to |conn| by calling
+ * from an object obtained by `ngtcp2_conn_get_tls_native_handle2`,
+ * and sets it to |conn| by calling
  * `ngtcp2_conn_decode_and_set_remote_transport_params`.
  *
  * This function returns 0 if it succeeds, or -1.
@@ -385,16 +385,16 @@ NGTCP2_EXTERN int ngtcp2_crypto_derive_and_install_rx_key(
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_0RTT`) to
  * set negotiated AEAD and message digest algorithm. After the
  * successful call of this function, application can use
- * `ngtcp2_conn_get_crypto_ctx` (or `ngtcp2_conn_get_0rtt_crypto_ctx`
- * if |level| ==
+ * `ngtcp2_conn_get_crypto_ctx2` (or
+ * `ngtcp2_conn_get_0rtt_crypto_ctx2` if |level| ==
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_0RTT`) to
  * get :type:`ngtcp2_crypto_ctx`.
  *
  * If |conn| is initialized as server, and |level| is
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_1RTT`, this
  * function retrieves a remote QUIC transport parameters extension
- * from an object obtained by `ngtcp2_conn_get_tls_native_handle`, and
- * sets it to |conn| by calling
+ * from an object obtained by `ngtcp2_conn_get_tls_native_handle2`,
+ * and sets it to |conn| by calling
  * `ngtcp2_conn_decode_and_set_remote_transport_params`.
  *
  * This function returns 0 if it succeeds, or -1.
@@ -986,15 +986,17 @@ NGTCP2_EXTERN void ngtcp2_crypto_delete_crypto_cipher_ctx_cb(
 /**
  * @function
  *
+ * .. warning::
+ *
+ * .. version-deprecated:: 1.22.0
+ * Use `ngtcp2_crypto_get_path_challenge_data2_cb` instead.
+ *
  * `ngtcp2_crypto_get_path_challenge_data_cb` writes unpredictable
  * sequence of :macro:`NGTCP2_PATH_CHALLENGE_DATALEN` bytes to |data|
  * which is sent with PATH_CHALLENGE frame.
  *
  * This function can be directly passed to
  * :member:`ngtcp2_callbacks.get_path_challenge_data` field.
- *
- * Deprecated since v1.22.0. Use
- * `ngtcp2_crypto_get_path_challenge_data2_cb` instead.
  */
 NGTCP2_EXTERNintngtcp2_crypto_get_path_challenge_data_cb(ngtcp2_conn*conn,
 uint8_t*data,
@@ -1010,7 +1012,7 @@ NGTCP2_EXTERN int ngtcp2_crypto_get_path_challenge_data_cb(ngtcp2_conn *conn,
  * This function can be directly passed to
  * :member:`ngtcp2_callbacks.get_path_challenge_data2` field.
  *
- * This function has been available since v1.22.0.
+ * .. version-added:: 1.22.0
  */
 NGTCP2_EXTERNintngtcp2_crypto_get_path_challenge_data2_cb(
 ngtcp2_conn*conn, ngtcp2_path_challenge_data*data, void*user_data);

deps/ngtcp2/ngtcp2/crypto/ossl/ossl.c

@@ -440,7 +440,7 @@ static int crypto_ossl_ctx_write_crypto_data(ngtcp2_crypto_ossl_ctx *ossl_ctx,
 left=crypto_buf_left(ossl_ctx->crypto_write);
  }
 
-n=ngtcp2_min_size((size_t)(end-data), left);
+n=ngtcp2_min((size_t)(end-data), left);
 crypto_buf_write(ossl_ctx->crypto_write, data, n);
 data+=n;
  }
@@ -871,7 +871,7 @@ int ngtcp2_crypto_hp_mask(uint8_t *dest, const ngtcp2_crypto_cipher *hp,
 intngtcp2_crypto_read_write_crypto_data(
 ngtcp2_conn*conn, ngtcp2_encryption_levelencryption_level,
 constuint8_t*data, size_tdatalen) {
-ngtcp2_crypto_ossl_ctx*ossl_ctx=ngtcp2_conn_get_tls_native_handle(conn);
+ngtcp2_crypto_ossl_ctx*ossl_ctx=ngtcp2_conn_get_tls_native_handle2(conn);
 SSL*ssl=ossl_ctx->ssl;
 intrv;
 interr;
@@ -881,7 +881,7 @@ int ngtcp2_crypto_read_write_crypto_data(
 return-1;
  }
 
-if (!ngtcp2_conn_get_handshake_completed(conn)) {
+if (!ngtcp2_conn_get_handshake_completed2(conn)) {
 rv=SSL_do_handshake(ssl);
 if (rv <= 0) {
 err=SSL_get_error(ssl, rv);
@@ -1033,7 +1033,7 @@ static int ossl_yield_secret(SSL *ssl, uint32_t ossl_level, int direction,
  }
 
 conn=conn_ref->get_conn(conn_ref);
-ossl_ctx=ngtcp2_conn_get_tls_native_handle(conn);
+ossl_ctx=ngtcp2_conn_get_tls_native_handle2(conn);
 
 if (direction) {
 if (ngtcp2_crypto_derive_and_install_tx_key(conn, NULL, NULL, NULL, level,
@@ -1067,7 +1067,7 @@ static int ossl_crypto_send(SSL *ssl, const unsigned char *buf, size_t buflen,
  }
 
 conn=conn_ref->get_conn(conn_ref);
-ossl_ctx=ngtcp2_conn_get_tls_native_handle(conn);
+ossl_ctx=ngtcp2_conn_get_tls_native_handle2(conn);
 
 rv=ngtcp2_conn_submit_crypto_data(conn, ossl_ctx->tx_level, buf, buflen);
 if (rv!=0) {
@@ -1094,7 +1094,7 @@ static int ossl_crypto_recv_rcd(SSL *ssl, const unsigned char **buf,
  }
 
 conn=conn_ref->get_conn(conn_ref);
-ossl_ctx=ngtcp2_conn_get_tls_native_handle(conn);
+ossl_ctx=ngtcp2_conn_get_tls_native_handle2(conn);
 
 crypto_ossl_ctx_read_crypto_data(ossl_ctx, buf, bytes_read);
 
@@ -1116,7 +1116,7 @@ static int ossl_crypto_release_rcd(SSL *ssl, size_t released, void *arg) {
  }
 
 conn=conn_ref->get_conn(conn_ref);
-ossl_ctx=ngtcp2_conn_get_tls_native_handle(conn);
+ossl_ctx=ngtcp2_conn_get_tls_native_handle2(conn);
 
 crypto_ossl_ctx_release_crypto_data(ossl_ctx, released);
 

deps/ngtcp2/ngtcp2/crypto/picotls/picotls.c

@@ -378,7 +378,7 @@ int ngtcp2_crypto_hp_mask(uint8_t *dest, const ngtcp2_crypto_cipher *hp,
 intngtcp2_crypto_read_write_crypto_data(
 ngtcp2_conn*conn, ngtcp2_encryption_levelencryption_level,
 constuint8_t*data, size_tdatalen) {
-ngtcp2_crypto_picotls_ctx*cptls=ngtcp2_conn_get_tls_native_handle(conn);
+ngtcp2_crypto_picotls_ctx*cptls=ngtcp2_conn_get_tls_native_handle2(conn);
 ptls_buffer_tsendbuf;
 size_tepoch_offsets[5] = {0};
 size_tepoch=
@@ -402,7 +402,7 @@ int ngtcp2_crypto_read_write_crypto_data(
  goto fin;
  }
 
-if (!ngtcp2_conn_is_server(conn) &&
+if (!ngtcp2_conn_is_server2(conn) &&
 cptls->handshake_properties.client.early_data_acceptance==
 PTLS_EARLY_DATA_REJECTED) {
 rv=ngtcp2_conn_tls_early_data_rejected(conn);
@@ -540,7 +540,7 @@ static int set_additional_extensions(ptls_handshake_properties_t *hsprops,
 return-1;
  }
 
-nwrite=ngtcp2_conn_encode_local_transport_params(conn, buf, buflen);
+nwrite=ngtcp2_conn_encode_local_transport_params2(conn, buf, buflen);
 if (nwrite<0) {
  goto fail;
  }
@@ -620,7 +620,7 @@ static int update_traffic_key_server_cb(ptls_update_traffic_key_t *self,
  * wait for the key to get the correct local transport
  * parameters from ngtcp2_conn.
  */
-cptls=ngtcp2_conn_get_tls_native_handle(conn);
+cptls=ngtcp2_conn_get_tls_native_handle2(conn);
 
 if (set_additional_extensions(&cptls->handshake_properties, conn) !=0) {
 return-1;

deps/ngtcp2/ngtcp2/crypto/quictls/quictls.c

@@ -812,7 +812,7 @@ int ngtcp2_crypto_hp_mask(uint8_t *dest, const ngtcp2_crypto_cipher *hp,
 intngtcp2_crypto_read_write_crypto_data(
 ngtcp2_conn*conn, ngtcp2_encryption_levelencryption_level,
 constuint8_t*data, size_tdatalen) {
-SSL*ssl=ngtcp2_conn_get_tls_native_handle(conn);
+SSL*ssl=ngtcp2_conn_get_tls_native_handle2(conn);
 intrv;
 interr;
 
@@ -824,7 +824,7 @@ int ngtcp2_crypto_read_write_crypto_data(
 return-1;
  }
 
-if (!ngtcp2_conn_get_handshake_completed(conn)) {
+if (!ngtcp2_conn_get_handshake_completed2(conn)) {
 rv=SSL_do_handshake(ssl);
 if (rv <= 0) {
 err=SSL_get_error(ssl, rv);

deps/ngtcp2/ngtcp2/crypto/boringssl/boringssl.c

@@ -432,7 +432,7 @@ int ngtcp2_crypto_hp_mask(uint8_t *dest, const ngtcp2_crypto_cipher *hp,
 intngtcp2_crypto_read_write_crypto_data(
 ngtcp2_conn*conn, ngtcp2_encryption_levelencryption_level,
 constuint8_t*data, size_tdatalen) {
-SSL*ssl=ngtcp2_conn_get_tls_native_handle(conn);
+SSL*ssl=ngtcp2_conn_get_tls_native_handle2(conn);
 intrv;
 interr;
 
@@ -444,7 +444,7 @@ int ngtcp2_crypto_read_write_crypto_data(
 return-1;
  }
 
-if (!ngtcp2_conn_get_handshake_completed(conn)) {
+if (!ngtcp2_conn_get_handshake_completed2(conn)) {
 retry:
 rv=SSL_do_handshake(ssl);
 if (rv <= 0) {
@@ -456,7 +456,7 @@ int ngtcp2_crypto_read_write_crypto_data(
 caseSSL_ERROR_SSL:
 return-1;
 caseSSL_ERROR_EARLY_DATA_REJECTED:
-assert(!ngtcp2_conn_is_server(conn));
+assert(!ngtcp2_conn_is_server2(conn));
 
 SSL_reset_early_data_reject(ssl);
 

deps/ngtcp2/ngtcp2/crypto/cryptotest.c

@@ -0,0 +1,46 @@
+/*
+ * ngtcp2
+ *
+ * Copyright (c) 2026 ngtcp2 contributors
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation the rights to use, copy, modify, merge, publish,
+ * distribute, sublicense, and/or sell copies of the Software, and to
+ * permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be
+ * included in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+ * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+#ifdefHAVE_CONFIG_H
+# include<config.h>
+#endif/* defined(HAVE_CONFIG_H) */
+
+#include"munit.h"
+
+/* include test cases' include files here */
+#include"shared_test.h"
+
+intmain(intargc, char*argv[]) {
+constMunitSuitesuites[] = {
+shared_suite,
+ {0},
+ };
+constMunitSuitesuite= {
+ .prefix="",
+ .suites=suites,
+ .iterations=1,
+ };
+
+returnmunit_suite_main(&suite, NULL, argc, argv);
+}

deps/ngtcp2/ngtcp2/crypto/includes/ngtcp2/ngtcp2_crypto.h

@@ -338,16 +338,16 @@ ngtcp2_crypto_hp_mask_cb(uint8_t *dest, const ngtcp2_crypto_cipher *hp,
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_0RTT`) to
  * set negotiated AEAD and message digest algorithm. After the
  * successful call of this function, application can use
- * `ngtcp2_conn_get_crypto_ctx` (or `ngtcp2_conn_get_0rtt_crypto_ctx`
- * if |level| ==
+ * `ngtcp2_conn_get_crypto_ctx2` (or
+ * `ngtcp2_conn_get_0rtt_crypto_ctx2` if |level| ==
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_0RTT`) to
  * get :type:`ngtcp2_crypto_ctx`.
  *
  * If |conn| is initialized as client, and |level| is
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_1RTT`, this
  * function retrieves a remote QUIC transport parameters extension
- * from an object obtained by `ngtcp2_conn_get_tls_native_handle`, and
- * sets it to |conn| by calling
+ * from an object obtained by `ngtcp2_conn_get_tls_native_handle2`,
+ * and sets it to |conn| by calling
  * `ngtcp2_conn_decode_and_set_remote_transport_params`.
  *
  * This function returns 0 if it succeeds, or -1.
@@ -385,16 +385,16 @@ NGTCP2_EXTERN int ngtcp2_crypto_derive_and_install_rx_key(
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_0RTT`) to
  * set negotiated AEAD and message digest algorithm. After the
  * successful call of this function, application can use
- * `ngtcp2_conn_get_crypto_ctx` (or `ngtcp2_conn_get_0rtt_crypto_ctx`
- * if |level| ==
+ * `ngtcp2_conn_get_crypto_ctx2` (or
+ * `ngtcp2_conn_get_0rtt_crypto_ctx2` if |level| ==
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_0RTT`) to
  * get :type:`ngtcp2_crypto_ctx`.
  *
  * If |conn| is initialized as server, and |level| is
  * :enum:`ngtcp2_encryption_level.NGTCP2_ENCRYPTION_LEVEL_1RTT`, this
  * function retrieves a remote QUIC transport parameters extension
- * from an object obtained by `ngtcp2_conn_get_tls_native_handle`, and
- * sets it to |conn| by calling
+ * from an object obtained by `ngtcp2_conn_get_tls_native_handle2`,
+ * and sets it to |conn| by calling
  * `ngtcp2_conn_decode_and_set_remote_transport_params`.
  *
  * This function returns 0 if it succeeds, or -1.
@@ -986,15 +986,17 @@ NGTCP2_EXTERN void ngtcp2_crypto_delete_crypto_cipher_ctx_cb(
 /**
  * @function
  *
+ * .. warning::
+ *
+ * .. version-deprecated:: 1.22.0
+ * Use `ngtcp2_crypto_get_path_challenge_data2_cb` instead.
+ *
  * `ngtcp2_crypto_get_path_challenge_data_cb` writes unpredictable
  * sequence of :macro:`NGTCP2_PATH_CHALLENGE_DATALEN` bytes to |data|
  * which is sent with PATH_CHALLENGE frame.
  *
  * This function can be directly passed to
  * :member:`ngtcp2_callbacks.get_path_challenge_data` field.
- *
- * Deprecated since v1.22.0. Use
- * `ngtcp2_crypto_get_path_challenge_data2_cb` instead.
  */
 NGTCP2_EXTERNintngtcp2_crypto_get_path_challenge_data_cb(ngtcp2_conn*conn,
 uint8_t*data,
@@ -1010,7 +1012,7 @@ NGTCP2_EXTERN int ngtcp2_crypto_get_path_challenge_data_cb(ngtcp2_conn *conn,
  * This function can be directly passed to
  * :member:`ngtcp2_callbacks.get_path_challenge_data2` field.
  *
- * This function has been available since v1.22.0.
+ * .. version-added:: 1.22.0
  */
 NGTCP2_EXTERNintngtcp2_crypto_get_path_challenge_data2_cb(
 ngtcp2_conn*conn, ngtcp2_path_challenge_data*data, void*user_data);

deps/ngtcp2/ngtcp2/crypto/ossl/ossl.c

@@ -440,7 +440,7 @@ static int crypto_ossl_ctx_write_crypto_data(ngtcp2_crypto_ossl_ctx *ossl_ctx,
 left=crypto_buf_left(ossl_ctx->crypto_write);
  }
 
-n=ngtcp2_min_size((size_t)(end-data), left);
+n=ngtcp2_min((size_t)(end-data), left);
 crypto_buf_write(ossl_ctx->crypto_write, data, n);
 data+=n;
  }
@@ -871,7 +871,7 @@ int ngtcp2_crypto_hp_mask(uint8_t *dest, const ngtcp2_crypto_cipher *hp,
 intngtcp2_crypto_read_write_crypto_data(
 ngtcp2_conn*conn, ngtcp2_encryption_levelencryption_level,
 constuint8_t*data, size_tdatalen) {
-ngtcp2_crypto_ossl_ctx*ossl_ctx=ngtcp2_conn_get_tls_native_handle(conn);
+ngtcp2_crypto_ossl_ctx*ossl_ctx=ngtcp2_conn_get_tls_native_handle2(conn);
 SSL*ssl=ossl_ctx->ssl;
 intrv;
 interr;
@@ -881,7 +881,7 @@ int ngtcp2_crypto_read_write_crypto_data(
 return-1;
  }
 
-if (!ngtcp2_conn_get_handshake_completed(conn)) {
+if (!ngtcp2_conn_get_handshake_completed2(conn)) {
 rv=SSL_do_handshake(ssl);
 if (rv <= 0) {
 err=SSL_get_error(ssl, rv);
@@ -1033,7 +1033,7 @@ static int ossl_yield_secret(SSL *ssl, uint32_t ossl_level, int direction,
  }
 
 conn=conn_ref->get_conn(conn_ref);
-ossl_ctx=ngtcp2_conn_get_tls_native_handle(conn);
+ossl_ctx=ngtcp2_conn_get_tls_native_handle2(conn);
 
 if (direction) {
 if (ngtcp2_crypto_derive_and_install_tx_key(conn, NULL, NULL, NULL, level,
@@ -1067,7 +1067,7 @@ static int ossl_crypto_send(SSL *ssl, const unsigned char *buf, size_t buflen,
  }
 
 conn=conn_ref->get_conn(conn_ref);
-ossl_ctx=ngtcp2_conn_get_tls_native_handle(conn);
+ossl_ctx=ngtcp2_conn_get_tls_native_handle2(conn);
 
 rv=ngtcp2_conn_submit_crypto_data(conn, ossl_ctx->tx_level, buf, buflen);
 if (rv!=0) {
@@ -1094,7 +1094,7 @@ static int ossl_crypto_recv_rcd(SSL *ssl, const unsigned char **buf,
  }
 
 conn=conn_ref->get_conn(conn_ref);
-ossl_ctx=ngtcp2_conn_get_tls_native_handle(conn);
+ossl_ctx=ngtcp2_conn_get_tls_native_handle2(conn);
 
 crypto_ossl_ctx_read_crypto_data(ossl_ctx, buf, bytes_read);
 
@@ -1116,7 +1116,7 @@ static int ossl_crypto_release_rcd(SSL *ssl, size_t released, void *arg) {
  }
 
 conn=conn_ref->get_conn(conn_ref);
-ossl_ctx=ngtcp2_conn_get_tls_native_handle(conn);
+ossl_ctx=ngtcp2_conn_get_tls_native_handle2(conn);
 
 crypto_ossl_ctx_release_crypto_data(ossl_ctx, released);
 

deps/ngtcp2/ngtcp2/crypto/picotls/picotls.c

@@ -378,7 +378,7 @@ int ngtcp2_crypto_hp_mask(uint8_t *dest, const ngtcp2_crypto_cipher *hp,
 intngtcp2_crypto_read_write_crypto_data(
 ngtcp2_conn*conn, ngtcp2_encryption_levelencryption_level,
 constuint8_t*data, size_tdatalen) {
-ngtcp2_crypto_picotls_ctx*cptls=ngtcp2_conn_get_tls_native_handle(conn);
+ngtcp2_crypto_picotls_ctx*cptls=ngtcp2_conn_get_tls_native_handle2(conn);
 ptls_buffer_tsendbuf;
 size_tepoch_offsets[5] = {0};
 size_tepoch=
@@ -402,7 +402,7 @@ int ngtcp2_crypto_read_write_crypto_data(
  goto fin;
  }
 
-if (!ngtcp2_conn_is_server(conn) &&
+if (!ngtcp2_conn_is_server2(conn) &&
 cptls->handshake_properties.client.early_data_acceptance==
 PTLS_EARLY_DATA_REJECTED) {
 rv=ngtcp2_conn_tls_early_data_rejected(conn);
@@ -540,7 +540,7 @@ static int set_additional_extensions(ptls_handshake_properties_t *hsprops,
 return-1;
  }
 
-nwrite=ngtcp2_conn_encode_local_transport_params(conn, buf, buflen);
+nwrite=ngtcp2_conn_encode_local_transport_params2(conn, buf, buflen);
 if (nwrite<0) {
  goto fail;
  }
@@ -620,7 +620,7 @@ static int update_traffic_key_server_cb(ptls_update_traffic_key_t *self,
  * wait for the key to get the correct local transport
  * parameters from ngtcp2_conn.
  */
-cptls=ngtcp2_conn_get_tls_native_handle(conn);
+cptls=ngtcp2_conn_get_tls_native_handle2(conn);
 
 if (set_additional_extensions(&cptls->handshake_properties, conn) !=0) {
 return-1;

deps/ngtcp2/ngtcp2/crypto/quictls/quictls.c

@@ -812,7 +812,7 @@ int ngtcp2_crypto_hp_mask(uint8_t *dest, const ngtcp2_crypto_cipher *hp,
 intngtcp2_crypto_read_write_crypto_data(
 ngtcp2_conn*conn, ngtcp2_encryption_levelencryption_level,
 constuint8_t*data, size_tdatalen) {
-SSL*ssl=ngtcp2_conn_get_tls_native_handle(conn);
+SSL*ssl=ngtcp2_conn_get_tls_native_handle2(conn);
 intrv;
 interr;
 
@@ -824,7 +824,7 @@ int ngtcp2_crypto_read_write_crypto_data(
 return-1;
  }
 
-if (!ngtcp2_conn_get_handshake_completed(conn)) {
+if (!ngtcp2_conn_get_handshake_completed2(conn)) {
 rv=SSL_do_handshake(ssl);
 if (rv <= 0) {
 err=SSL_get_error(ssl, rv);