]> git.ipfire.org Git - thirdparty/openssl.git/blobdiff - ssl/quic/quic_rx_depack.c
Rationalize FIPS sources
[thirdparty/openssl.git] / ssl / quic / quic_rx_depack.c
index 12a7b9c39e91b90a56ea20590d28ba701081e789..939df84c9dd881c109aa331d394a51046e3fd012 100644 (file)
  * https://www.openssl.org/source/license.html
  */
 
-#include "internal/packet.h"
+#include "internal/packet_quic.h"
 #include "internal/nelem.h"
 #include "internal/quic_wire.h"
 #include "internal/quic_record_rx.h"
 #include "internal/quic_ackm.h"
 #include "internal/quic_rx_depack.h"
-#include "internal/quic_record_rx_wrap.h"
+#include "internal/quic_error.h"
+#include "internal/quic_fc.h"
+#include "internal/quic_channel.h"
 #include "internal/sockets.h"
 
 #include "quic_local.h"
+#include "quic_channel_local.h"
 #include "../ssl_local.h"
 
-/*
- * TODO(QUIC): ASSUMPTION: the QUIC_CONNECTION structure refers to other related
- * components, such as OSSL_ACKM and OSSL_QRX, in some manner.  These macros
- * should be used to get those components.
- */
-#define GET_CONN_ACKM(c)        ((c)->ackm)
-#define GET_CONN_QRX(c)         ((c)->qrx)
-#define GET_CONN_STATEM(c)      ((c)->ssl.statem)
-
-#if 0                            /* Currently unimplemented */
-# define GET_CONN_ACK_DELAY_EXP(c) (QUIC_CONNECTION_get_ack_delay_exponent(c))
-#else
-/* 3 is the default, see RFC 9000, 18.2. Transport Parameter Definitions */
-# define GET_CONN_ACK_DELAY_EXP(c) 3
-#endif
-
-/* TODO(QUIC): [BEGIN: TO BE REMOVED] placeholder macros and functions */
-
-/* Diverse things that should be implemented elsewhere, bur currently aren't. */
-
-typedef struct quic_stream_st QUIC_STREAM;
-
-/*
- * TODO(QUIC): ASSUMPTION: ssl_get_stream() gets a QUIC_STREAM from a connection
- * by stream ID.  For now, we simply return a fake stream.
- */
-static QUIC_STREAM *ssl_get_stream(QUIC_CONNECTION *conn, uint64_t stream_id)
-{
-    static uint64_t fake_stream = 0;
-
-    return (QUIC_STREAM *)&fake_stream;
-}
-
-/*
- * TODO(QUIC): ASSUMPTION: ssl_get_stream_type() gets a stream type from a
- * QUIC_STREAM
- */
-/* Receive */
-#define SSL_STREAM_TYPE_R       1
-/* Send */
-#define SSL_STREAM_TYPE_S       2
-/* Bidirectional */
-#define SSL_STREAM_TYPE_B       (SSL_STREAM_TYPE_R|SSL_STREAM_TYPE_S)
-static int ssl_get_stream_type(QUIC_STREAM *stream)
-{
-    return SSL_STREAM_TYPE_B;
-}
-
-/*
- * TODO(QUIC): ASSUMPTION: ssl_queue_data() adds data to a QUIC_STREAM, to be
- * consumed by the application when doing an SSL_read().
- *
- * We assume that queuing of the data has to be done without copying, thus
- * we get the reference counting QRX packet wrapper so it can increment the
- * reference count.  When the data is consumed (i.e. as a result of, say,
- * SSL_read()), ossl_qrx_pkt_wrap_free() must be called.
- */
-static int ssl_queue_data(QUIC_STREAM *stream, OSSL_QRX_PKT_WRAP *pkt_wrap,
-                          const unsigned char *data, uint64_t data_len,
-                          uint64_t logical_offset, int is_fin)
-{
-    /*
-     * Since this function is just a placeholder that doesn't actually queue
-     * anything, we do nothing here, not even the reference count increment.
-     */
-
-    /*
-     * 1. Queuing the data and the parent packet wrapper should happen here,
-     *    and this call with it:
-     *
-     *        ossl_qrx_pkt_wrap_up_ref(pkt_wrap);
-     *
-     * 2. Dequeuing the data happens somewhere else, and this call with it
-     *    (|pkt_wrap| replaced with the pointer from the queue):
-     *
-     *        ossl_qrx_pkt_wrap_free(pkt_wrap);
-     */
-    return 1;
-}
-
-/*
- * TODO(QUIC): ASSUMPTION: ssl_close_stream() detaches the QUIC_STREAM from
- * the QUIC_CONNECTION it's attached to, and then destroys that QUIC_STREAM
- * (as well as its SSL object).  |how| works the same way as in shutdown(2),
- * i.e. |SHUT_RD| closes the reader part, |SHUT_WR| closes the writer part.
- */
-static int ssl_close_stream(QUIC_STREAM *stream, int how)
-{
-    return 1;
-}
-
-/*
- * TODO(QUIC): ASSUMPTION: ssl_close_connection() closes all the streams that
- * are attached to it, then closes the QUIC_CONNECTION as well.
- * Actual cleanup / destruction of the QUIC_CONNECTION is assumed to be done
- * higher up in the call stack (state machine, for example?).
- */
-static int ssl_close_connection(QUIC_CONNECTION *connection)
-{
-    return 1;
-}
-
-/*
- * TODO(QUIC): ASSUMPTION: ossl_statem_set_error_state() sets an overall error
- * state in the state machine.  It's up to the state machine to determine what
- * to do with it.
- */
-#define QUIC_STREAM_STATE_ERROR 1
-
-/*
- * QUICfatal() et al is the same as SSLfatal(), but for QUIC.  We define a
- * placeholder here as long as it's not defined elsewhere.
- *
- * ossl_quic_fatal() is an error reporting building block used instead of
- * ERR_set_error().  In addition to what ERR_set_error() does, this puts
- * the state machine into an error state and sends an alert if appropriate,
- * and also closes the current connection.
- * This is a permanent error for the current connection.
- */
-#ifndef QUICfatal
-
-static void ossl_quic_fatal(QUIC_CONNECTION *c, int al, int reason,
-                            const char *fmt, ...)
-{
-    va_list args;
-
-    va_start(args, fmt);
-    ERR_vset_error(ERR_LIB_SSL, reason, fmt, args);
-    va_end(args);
-
-    /*
-     * TODO(QUIC): ADD CODE to set the state machine error.
-     * It's assumed that you can get the state machine with
-     * GET_CONN_STATEM(c)
-     */
-
-    ssl_close_connection(c);
-
-}
-# define QUICfatal(c, al, r) QUICfatal_data((c), (al), (r), NULL)
-# define QUICfatal_data                                         \
-    (ERR_new(),                                                 \
-     ERR_set_debug(OPENSSL_FILE, OPENSSL_LINE, OPENSSL_FUNC),   \
-     ossl_quic_fatal)
-#endif
-
-/* TODO(QUIC): [END: TO BE REMOVED] */
-
 /*
  * Helper functions to process different frame types.
  *
@@ -178,127 +33,196 @@ static void ossl_quic_fatal(QUIC_CONNECTION *c, int al, int reason,
 static int depack_do_frame_padding(PACKET *pkt)
 {
     /* We ignore this frame */
-    return ossl_quic_wire_decode_padding(pkt);
+    ossl_quic_wire_decode_padding(pkt);
+    return 1;
 }
 
-static int depack_do_frame_ping(PACKET *pkt, OSSL_ACKM_RX_PKT *ackm_data)
+static int depack_do_frame_ping(PACKET *pkt, QUIC_CHANNEL *ch,
+                                OSSL_ACKM_RX_PKT *ackm_data)
 {
     /* We ignore this frame, apart from eliciting an ACK */
-    if (!ossl_quic_wire_decode_frame_ping(pkt))
+    if (!ossl_quic_wire_decode_frame_ping(pkt)) {
+        ossl_quic_channel_raise_protocol_error(ch,
+                                               QUIC_ERR_FRAME_ENCODING_ERROR,
+                                               OSSL_QUIC_FRAME_TYPE_PING,
+                                               "decode error");
         return 0;
+    }
+
     /* This frame makes the packet ACK eliciting */
     ackm_data->is_ack_eliciting = 1;
     return 1;
 }
 
-static int depack_do_frame_ack(PACKET *pkt, QUIC_CONNECTION *connection,
-                               int packet_space, OSSL_TIME received)
+static int depack_do_frame_ack(PACKET *pkt, QUIC_CHANNEL *ch,
+                               int packet_space, OSSL_TIME received,
+                               uint64_t frame_type)
 {
     OSSL_QUIC_FRAME_ACK ack;
-    OSSL_QUIC_ACK_RANGE *ack_ranges;
+    OSSL_QUIC_ACK_RANGE *ack_ranges = NULL;
     uint64_t total_ranges = 0;
-    uint32_t ack_delay_exp = GET_CONN_ACK_DELAY_EXP(connection);
-    int ok = 1;          /* Assume the best */
+    uint32_t ack_delay_exp = ch->rx_ack_delay_exp;
 
     if (!ossl_quic_wire_peek_frame_ack_num_ranges(pkt, &total_ranges)
         /* In case sizeof(uint64_t) > sizeof(size_t) */
         || total_ranges > SIZE_MAX / sizeof(ack_ranges[0])
         || (ack_ranges = OPENSSL_zalloc(sizeof(ack_ranges[0])
                                         * (size_t)total_ranges)) == NULL)
-        return 0;
+        goto malformed;
 
     ack.ack_ranges = ack_ranges;
     ack.num_ack_ranges = (size_t)total_ranges;
 
     if (!ossl_quic_wire_decode_frame_ack(pkt, ack_delay_exp, &ack, NULL))
-        ok = 0;
-    if (ok
-        && !ossl_ackm_on_rx_ack_frame(GET_CONN_ACKM(connection), &ack,
-                                      packet_space, received))
-        ok = 0;
+        goto malformed;
+
+    if (!ossl_ackm_on_rx_ack_frame(ch->ackm, &ack,
+                                   packet_space, received))
+        goto malformed;
 
     OPENSSL_free(ack_ranges);
-    if (!ok)
-        return 0;
     return 1;
+
+malformed:
+    ossl_quic_channel_raise_protocol_error(ch,
+                                           QUIC_ERR_FRAME_ENCODING_ERROR,
+                                           frame_type,
+                                           "decode error");
+    OPENSSL_free(ack_ranges);
+    return 0;
 }
 
 static int depack_do_frame_reset_stream(PACKET *pkt,
-                                        QUIC_CONNECTION *connection,
+                                        QUIC_CHANNEL *ch,
                                         OSSL_ACKM_RX_PKT *ackm_data)
 {
     OSSL_QUIC_FRAME_RESET_STREAM frame_data;
     QUIC_STREAM *stream = NULL;
-    int stream_type = 0;
 
-    if (!ossl_quic_wire_decode_frame_reset_stream(pkt, &frame_data))
+    if (!ossl_quic_wire_decode_frame_reset_stream(pkt, &frame_data)) {
+        ossl_quic_channel_raise_protocol_error(ch,
+                                               QUIC_ERR_FRAME_ENCODING_ERROR,
+                                               OSSL_QUIC_FRAME_TYPE_RESET_STREAM,
+                                               "decode error");
         return 0;
+    }
 
     /* This frame makes the packet ACK eliciting */
     ackm_data->is_ack_eliciting = 1;
 
-    if ((stream = ssl_get_stream(connection, frame_data.stream_id)) == NULL)
+    stream = ossl_quic_stream_map_get_by_id(&ch->qsm, frame_data.stream_id);
+    if (stream == NULL) {
+        ossl_quic_channel_raise_protocol_error(ch,
+                                               QUIC_ERR_STREAM_STATE_ERROR,
+                                               OSSL_QUIC_FRAME_TYPE_RESET_STREAM,
+                                               "RESET_STREAM frame for "
+                                               "nonexistent stream");
         return 0;
-    stream_type = ssl_get_stream_type(stream);
+    }
 
-    ssl_close_stream(stream, SHUT_WR); /* Reuse shutdown(2) symbols */
-    if ((stream_type & SSL_STREAM_TYPE_S) != 0) {
-        QUICfatal(connection, QUIC_STREAM_STATE_ERROR, ERR_R_INTERNAL_ERROR);
+    if (stream->rstream == NULL) {
+        ossl_quic_channel_raise_protocol_error(ch,
+                                               QUIC_ERR_STREAM_STATE_ERROR,
+                                               OSSL_QUIC_FRAME_TYPE_RESET_STREAM,
+                                               "RESET_STREAM frame for "
+                                               "TX only stream");
         return 0;
     }
+
+    stream->peer_reset_stream = 1;
+    ossl_quic_stream_map_update_state(&ch->qsm, stream);
     return 1;
 }
 
 static int depack_do_frame_stop_sending(PACKET *pkt,
-                                        QUIC_CONNECTION *connection,
+                                        QUIC_CHANNEL *ch,
                                         OSSL_ACKM_RX_PKT *ackm_data)
 {
     OSSL_QUIC_FRAME_STOP_SENDING frame_data;
     QUIC_STREAM *stream = NULL;
-    int stream_type = 0;
 
-    if (!ossl_quic_wire_decode_frame_stop_sending(pkt, &frame_data))
+    if (!ossl_quic_wire_decode_frame_stop_sending(pkt, &frame_data)) {
+        ossl_quic_channel_raise_protocol_error(ch,
+                                               QUIC_ERR_FRAME_ENCODING_ERROR,
+                                               OSSL_QUIC_FRAME_TYPE_STOP_SENDING,
+                                               "decode error");
         return 0;
+    }
 
     /* This frame makes the packet ACK eliciting */
     ackm_data->is_ack_eliciting = 1;
 
-    if ((stream = ssl_get_stream(connection, frame_data.stream_id)) == NULL)
+    stream = ossl_quic_stream_map_get_by_id(&ch->qsm, frame_data.stream_id);
+    if (stream == NULL) {
+        ossl_quic_channel_raise_protocol_error(ch,
+                                               QUIC_ERR_STREAM_STATE_ERROR,
+                                               OSSL_QUIC_FRAME_TYPE_STOP_SENDING,
+                                               "STOP_SENDING frame for "
+                                               "nonexistent stream");
         return 0;
-    stream_type = ssl_get_stream_type(stream);
+    }
 
-    ssl_close_stream(stream, SHUT_RD); /* Reuse shutdown(2) symbols */
-    if ((stream_type & SSL_STREAM_TYPE_R) != 0) {
-        QUICfatal(connection, QUIC_STREAM_STATE_ERROR, ERR_R_INTERNAL_ERROR);
+    if (stream->sstream == NULL) {
+        ossl_quic_channel_raise_protocol_error(ch,
+                                               QUIC_ERR_STREAM_STATE_ERROR,
+                                               OSSL_QUIC_FRAME_TYPE_STOP_SENDING,
+                                               "STOP_SENDING frame for "
+                                               "RX only stream");
         return 0;
     }
+
+    stream->peer_stop_sending = 1;
+    ossl_quic_stream_map_update_state(&ch->qsm, stream);
     return 1;
 }
 
-static int depack_do_frame_crypto(PACKET *pkt, QUIC_CONNECTION *connection,
+static int depack_do_frame_crypto(PACKET *pkt, QUIC_CHANNEL *ch,
+                                  OSSL_QRX_PKT *parent_pkt,
                                   OSSL_ACKM_RX_PKT *ackm_data)
 {
-    OSSL_QUIC_FRAME_CRYPTO frame_data;
-
-    if (!ossl_quic_wire_decode_frame_crypto(pkt, &frame_data))
+    OSSL_QUIC_FRAME_CRYPTO f;
+    QUIC_RSTREAM *rstream;
+
+    if (!ossl_quic_wire_decode_frame_crypto(pkt, &f)) {
+        ossl_quic_channel_raise_protocol_error(ch,
+                                               QUIC_ERR_FRAME_ENCODING_ERROR,
+                                               OSSL_QUIC_FRAME_TYPE_CRYPTO,
+                                               "decode error");
         return 0;
+    }
 
     /* This frame makes the packet ACK eliciting */
     ackm_data->is_ack_eliciting = 1;
 
-    /* TODO(QUIC): ADD CODE to send |frame_data.data| to the handshake manager */
+    rstream = ch->crypto_recv[ackm_data->pkt_space];
+    if (!ossl_assert(rstream != NULL))
+        /*
+         * This should not happen; we should only have a NULL stream here if
+         * the EL has been discarded, and if the EL has been discarded we
+         * shouldn't be here.
+         */
+        return 0;
+
+    if (!ossl_quic_rstream_queue_data(rstream, parent_pkt,
+                                      f.offset, f.data, f.len, 0))
+        return 0;
 
     return 1;
 }
 
-static int depack_do_frame_new_token(PACKET *pkt, QUIC_CONNECTION *connection,
+static int depack_do_frame_new_token(PACKET *pkt, QUIC_CHANNEL *ch,
                                      OSSL_ACKM_RX_PKT *ackm_data)
 {
     const uint8_t *token;
     size_t token_len;
 
-    if (!ossl_quic_wire_decode_frame_new_token(pkt, &token, &token_len))
+    if (!ossl_quic_wire_decode_frame_new_token(pkt, &token, &token_len)) {
+        ossl_quic_channel_raise_protocol_error(ch,
+                                               QUIC_ERR_FRAME_ENCODING_ERROR,
+                                               OSSL_QUIC_FRAME_TYPE_NEW_TOKEN,
+                                               "decode error");
         return 0;
+    }
 
     /* This frame makes the packet ACK eliciting */
     ackm_data->is_ack_eliciting = 1;
@@ -308,221 +232,367 @@ static int depack_do_frame_new_token(PACKET *pkt, QUIC_CONNECTION *connection,
     return 1;
 }
 
-static int depack_do_frame_stream(PACKET *pkt, QUIC_CONNECTION *connection,
-                                  OSSL_QRX_PKT_WRAP *parent_pkt,
-                                  OSSL_ACKM_RX_PKT *ackm_data)
+static int depack_do_frame_stream(PACKET *pkt, QUIC_CHANNEL *ch,
+                                  OSSL_QRX_PKT *parent_pkt,
+                                  OSSL_ACKM_RX_PKT *ackm_data,
+                                  uint64_t frame_type)
 {
     OSSL_QUIC_FRAME_STREAM frame_data;
     QUIC_STREAM *stream;
+    uint64_t fce;
 
-    if (!ossl_quic_wire_decode_frame_stream(pkt, &frame_data))
+    if (!ossl_quic_wire_decode_frame_stream(pkt, &frame_data)) {
+        ossl_quic_channel_raise_protocol_error(ch,
+                                               QUIC_ERR_FRAME_ENCODING_ERROR,
+                                               frame_type,
+                                               "decode error");
         return 0;
+    }
 
     /* This frame makes the packet ACK eliciting */
     ackm_data->is_ack_eliciting = 1;
 
-    /*
-     * TODO(QUIC): ASSUMPTION: ssl_get_stream() gets a QUIC_STREAM from a
-     * QUIC_CONNECTION by stream ID.
-     */
-    if ((stream = ssl_get_stream(connection, frame_data.stream_id)) == NULL)
+    stream = ossl_quic_stream_map_get_by_id(&ch->qsm, frame_data.stream_id);
+    if (stream == NULL) {
+        ossl_quic_channel_raise_protocol_error(ch,
+                                               QUIC_ERR_STREAM_STATE_ERROR,
+                                               frame_type,
+                                               "STREAM frame for nonexistent "
+                                               "stream");
         return 0;
+    }
+
+    if (stream->rstream == NULL) {
+        ossl_quic_channel_raise_protocol_error(ch,
+                                               QUIC_ERR_STREAM_STATE_ERROR,
+                                               frame_type,
+                                               "STREAM frame for TX only "
+                                               "stream");
+        return 0;
+    }
+
+    /* Notify stream flow controller. */
+    if (!ossl_quic_rxfc_on_rx_stream_frame(&stream->rxfc,
+                                           frame_data.offset + frame_data.len,
+                                           frame_data.is_fin)) {
+        ossl_quic_channel_raise_protocol_error(ch,
+                                               QUIC_ERR_INTERNAL_ERROR,
+                                               frame_type,
+                                               "internal error (flow control)");
+        return 0;
+    }
+
+    /* Has a flow control error occurred? */
+    fce = ossl_quic_rxfc_get_error(&stream->rxfc, 0);
+    if (fce != QUIC_ERR_NO_ERROR) {
+        ossl_quic_channel_raise_protocol_error(ch,
+                                               fce,
+                                               frame_type,
+                                               "flow control violation");
+        return 0;
+    }
+
     /*
-     * TODO(QUIC): ASSUMPTION: ssl_queue_data() knows what to do with
-     * |frame_data.offset| and |frame_data.is_fin|.
+     * The receive stream buffer may or may not choose to consume the data
+     * without copying by reffing the OSSL_QRX_PKT. In this case
+     * ossl_qrx_pkt_release() will be eventually called when the data is no
+     * longer needed.
      */
-    if (!ssl_queue_data(stream, parent_pkt, frame_data.data, frame_data.len,
-                        frame_data.offset, frame_data.is_fin))
+    if (!ossl_quic_rstream_queue_data(stream->rstream, parent_pkt,
+                                      frame_data.offset,
+                                      frame_data.data,
+                                      frame_data.len,
+                                      frame_data.is_fin))
         return 0;
+
     return 1;
 }
 
-static int depack_do_frame_max_data(PACKET *pkt, QUIC_CONNECTION *connection,
+static int depack_do_frame_max_data(PACKET *pkt, QUIC_CHANNEL *ch,
                                     OSSL_ACKM_RX_PKT *ackm_data)
 {
     uint64_t max_data = 0;
 
-    if (!ossl_quic_wire_decode_frame_max_data(pkt, &max_data))
+    if (!ossl_quic_wire_decode_frame_max_data(pkt, &max_data)) {
+        ossl_quic_channel_raise_protocol_error(ch,
+                                               QUIC_ERR_FRAME_ENCODING_ERROR,
+                                               OSSL_QUIC_FRAME_TYPE_MAX_DATA,
+                                               "decode error");
         return 0;
+    }
 
     /* This frame makes the packet ACK eliciting */
     ackm_data->is_ack_eliciting = 1;
 
-    /* TODO(QUIC): ADD CODE to send |max_data| to flow control */
-
+    ossl_quic_txfc_bump_cwm(&ch->conn_txfc, max_data);
+    ossl_quic_stream_map_update_state(&ch->qsm, ch->stream0);
     return 1;
 }
 
 static int depack_do_frame_max_stream_data(PACKET *pkt,
-                                           QUIC_CONNECTION *connection,
+                                           QUIC_CHANNEL *ch,
                                            OSSL_ACKM_RX_PKT *ackm_data)
 {
     uint64_t stream_id = 0;
     uint64_t max_stream_data = 0;
+    QUIC_STREAM *stream;
 
     if (!ossl_quic_wire_decode_frame_max_stream_data(pkt, &stream_id,
-                                                     &max_stream_data))
+                                                     &max_stream_data)) {
+        ossl_quic_channel_raise_protocol_error(ch,
+                                               QUIC_ERR_FRAME_ENCODING_ERROR,
+                                               OSSL_QUIC_FRAME_TYPE_MAX_STREAM_DATA,
+                                               "decode error");
         return 0;
+    }
 
     /* This frame makes the packet ACK eliciting */
     ackm_data->is_ack_eliciting = 1;
 
-    /* TODO(QUIC): ADD CODE to send |max_stream_data| to flow control */
+    stream = ossl_quic_stream_map_get_by_id(&ch->qsm, stream_id);
+    if (stream == NULL) {
+        ossl_quic_channel_raise_protocol_error(ch,
+                                               QUIC_ERR_STREAM_STATE_ERROR,
+                                               OSSL_QUIC_FRAME_TYPE_MAX_STREAM_DATA,
+                                               "MAX_STREAM_DATA for nonexistent "
+                                               "stream");
+        return 0;
+    }
+
+    if (stream->sstream == NULL) {
+        ossl_quic_channel_raise_protocol_error(ch,
+                                               QUIC_ERR_STREAM_STATE_ERROR,
+                                               OSSL_QUIC_FRAME_TYPE_MAX_STREAM_DATA,
+                                               "MAX_STREAM_DATA for TX only "
+                                               "stream");
+        return 0;
+    }
 
+    ossl_quic_txfc_bump_cwm(&stream->txfc, max_stream_data);
+    ossl_quic_stream_map_update_state(&ch->qsm, stream);
     return 1;
 }
 
 static int depack_do_frame_max_streams(PACKET *pkt,
-                                       QUIC_CONNECTION *connection,
-                                       OSSL_ACKM_RX_PKT *ackm_data)
+                                       QUIC_CHANNEL *ch,
+                                       OSSL_ACKM_RX_PKT *ackm_data,
+                                       uint64_t frame_type)
 {
     uint64_t max_streams = 0;
 
-    if (!ossl_quic_wire_decode_frame_max_streams(pkt, &max_streams))
+    if (!ossl_quic_wire_decode_frame_max_streams(pkt, &max_streams)) {
+        ossl_quic_channel_raise_protocol_error(ch,
+                                               QUIC_ERR_FRAME_ENCODING_ERROR,
+                                               frame_type,
+                                               "decode error");
         return 0;
+    }
 
     /* This frame makes the packet ACK eliciting */
     ackm_data->is_ack_eliciting = 1;
 
-    /* TODO(QUIC): ADD CODE to send |max_streams| to the connection manager */
+    if (max_streams > (((uint64_t)1) << 60)) {
+        ossl_quic_channel_raise_protocol_error(ch,
+                                               QUIC_ERR_FRAME_ENCODING_ERROR,
+                                               frame_type,
+                                               "invalid max streams value");
+        return 0;
+    }
+
+    switch (frame_type) {
+    case OSSL_QUIC_FRAME_TYPE_MAX_STREAMS_BIDI:
+        if (max_streams > ch->max_local_streams_bidi)
+            ch->max_local_streams_bidi = max_streams;
+
+        /* Stream may now be able to send */
+        ossl_quic_stream_map_update_state(&ch->qsm,
+                                          ch->stream0);
+        break;
+    case OSSL_QUIC_FRAME_TYPE_MAX_STREAMS_UNI:
+        if (max_streams > ch->max_local_streams_uni)
+            ch->max_local_streams_uni = max_streams;
+
+        /* Stream may now be able to send */
+        ossl_quic_stream_map_update_state(&ch->qsm,
+                                          ch->stream0);
+        break;
+    default:
+        ossl_quic_channel_raise_protocol_error(ch,
+                                               QUIC_ERR_FRAME_ENCODING_ERROR,
+                                               frame_type,
+                                               "decode error");
+        return 0;
+    }
 
     return 1;
 }
 
 static int depack_do_frame_data_blocked(PACKET *pkt,
-                                        QUIC_CONNECTION *connection,
+                                        QUIC_CHANNEL *ch,
                                         OSSL_ACKM_RX_PKT *ackm_data)
 {
     uint64_t max_data = 0;
 
-    if (!ossl_quic_wire_decode_frame_data_blocked(pkt, &max_data))
+    if (!ossl_quic_wire_decode_frame_data_blocked(pkt, &max_data)) {
+        ossl_quic_channel_raise_protocol_error(ch,
+                                               QUIC_ERR_FRAME_ENCODING_ERROR,
+                                               OSSL_QUIC_FRAME_TYPE_DATA_BLOCKED,
+                                               "decode error");
         return 0;
+    }
 
     /* This frame makes the packet ACK eliciting */
     ackm_data->is_ack_eliciting = 1;
 
-    /* TODO(QUIC): ADD CODE to send |max_data| to flow control */
-
+    /* No-op - informative/debugging frame. */
     return 1;
 }
 
 static int depack_do_frame_stream_data_blocked(PACKET *pkt,
-                                               QUIC_CONNECTION *connection,
+                                               QUIC_CHANNEL *ch,
                                                OSSL_ACKM_RX_PKT *ackm_data)
 {
     uint64_t stream_id = 0;
     uint64_t max_data = 0;
 
     if (!ossl_quic_wire_decode_frame_stream_data_blocked(pkt, &stream_id,
-                                                         &max_data))
+                                                         &max_data)) {
+        ossl_quic_channel_raise_protocol_error(ch,
+                                               QUIC_ERR_FRAME_ENCODING_ERROR,
+                                               OSSL_QUIC_FRAME_TYPE_STREAM_DATA_BLOCKED,
+                                               "decode error");
         return 0;
+    }
 
     /* This frame makes the packet ACK eliciting */
     ackm_data->is_ack_eliciting = 1;
 
-    /* TODO(QUIC): ADD CODE to send |max_data| to flow control */
-
+    /* No-op - informative/debugging frame. */
     return 1;
 }
 
 static int depack_do_frame_streams_blocked(PACKET *pkt,
-                                           QUIC_CONNECTION *connection,
-                                           OSSL_ACKM_RX_PKT *ackm_data)
+                                           QUIC_CHANNEL *ch,
+                                           OSSL_ACKM_RX_PKT *ackm_data,
+                                           uint64_t frame_type)
 {
     uint64_t max_data = 0;
 
-    if (!ossl_quic_wire_decode_frame_streams_blocked(pkt, &max_data))
+    if (!ossl_quic_wire_decode_frame_streams_blocked(pkt, &max_data)) {
+        ossl_quic_channel_raise_protocol_error(ch,
+                                               QUIC_ERR_FRAME_ENCODING_ERROR,
+                                               frame_type,
+                                               "decode error");
         return 0;
+    }
 
     /* This frame makes the packet ACK eliciting */
     ackm_data->is_ack_eliciting = 1;
 
-    /* TODO(QUIC): ADD CODE to send |max_data| to connection manager */
-
+    /* No-op - informative/debugging frame. */
     return 1;
 }
 
 static int depack_do_frame_new_conn_id(PACKET *pkt,
-                                       QUIC_CONNECTION *connection,
+                                       QUIC_CHANNEL *ch,
                                        OSSL_ACKM_RX_PKT *ackm_data)
 {
     OSSL_QUIC_FRAME_NEW_CONN_ID frame_data;
 
-    if (!ossl_quic_wire_decode_frame_new_conn_id(pkt, &frame_data))
+    if (!ossl_quic_wire_decode_frame_new_conn_id(pkt, &frame_data)) {
+        ossl_quic_channel_raise_protocol_error(ch,
+                                               QUIC_ERR_FRAME_ENCODING_ERROR,
+                                               OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID,
+                                               "decode error");
         return 0;
+    }
 
     /* This frame makes the packet ACK eliciting */
     ackm_data->is_ack_eliciting = 1;
 
-    /* TODO(QUIC): ADD CODE to send |frame_data.data| to the connection manager */
+    /* TODO(QUIC): ADD CODE to send |frame_data.data| to the ch manager */
 
     return 1;
 }
 
 static int depack_do_frame_retire_conn_id(PACKET *pkt,
-                                          QUIC_CONNECTION *connection,
+                                          QUIC_CHANNEL *ch,
                                           OSSL_ACKM_RX_PKT *ackm_data)
 {
     uint64_t seq_num;
 
-    if (!ossl_quic_wire_decode_frame_retire_conn_id(pkt, &seq_num))
+    if (!ossl_quic_wire_decode_frame_retire_conn_id(pkt, &seq_num)) {
+        ossl_quic_channel_raise_protocol_error(ch,
+                                               QUIC_ERR_FRAME_ENCODING_ERROR,
+                                               OSSL_QUIC_FRAME_TYPE_RETIRE_CONN_ID,
+                                               "decode error");
         return 0;
+    }
 
     /* This frame makes the packet ACK eliciting */
     ackm_data->is_ack_eliciting = 1;
 
-    /* TODO(QUIC): ADD CODE to send |seq_num| to the connection manager */
+    /* TODO(QUIC): ADD CODE to send |seq_num| to the ch manager */
     return 1;
 }
 
 static int depack_do_frame_path_challenge(PACKET *pkt,
-                                          QUIC_CONNECTION *connection,
+                                          QUIC_CHANNEL *ch,
                                           OSSL_ACKM_RX_PKT *ackm_data)
 {
     uint64_t frame_data = 0;
 
-    if (!ossl_quic_wire_decode_frame_path_challenge(pkt, &frame_data))
+    if (!ossl_quic_wire_decode_frame_path_challenge(pkt, &frame_data)) {
+        ossl_quic_channel_raise_protocol_error(ch,
+                                               QUIC_ERR_FRAME_ENCODING_ERROR,
+                                               OSSL_QUIC_FRAME_TYPE_PATH_CHALLENGE,
+                                               "decode error");
         return 0;
+    }
 
     /* This frame makes the packet ACK eliciting */
     ackm_data->is_ack_eliciting = 1;
 
-    /* TODO(QUIC): ADD CODE to send |frame_data| to the connection manager */
+    /* TODO(QUIC): ADD CODE to send |frame_data| to the ch manager */
 
     return 1;
 }
 
 static int depack_do_frame_path_response(PACKET *pkt,
-                                         QUIC_CONNECTION *connection,
+                                         QUIC_CHANNEL *ch,
                                          OSSL_ACKM_RX_PKT *ackm_data)
 {
     uint64_t frame_data = 0;
 
-    if (!ossl_quic_wire_decode_frame_path_response(pkt, &frame_data))
+    if (!ossl_quic_wire_decode_frame_path_response(pkt, &frame_data)) {
+        ossl_quic_channel_raise_protocol_error(ch,
+                                               QUIC_ERR_FRAME_ENCODING_ERROR,
+                                               OSSL_QUIC_FRAME_TYPE_PATH_RESPONSE,
+                                               "decode error");
         return 0;
+    }
 
     /* This frame makes the packet ACK eliciting */
     ackm_data->is_ack_eliciting = 1;
 
-    /* TODO(QUIC): ADD CODE to send |frame_data| to the connection manager */
+    /* TODO(QUIC): ADD CODE to send |frame_data| to the ch manager */
 
     return 1;
 }
 
-static int depack_do_frame_conn_close(PACKET *pkt, QUIC_CONNECTION *connection)
+static int depack_do_frame_conn_close(PACKET *pkt, QUIC_CHANNEL *ch)
 {
     OSSL_QUIC_FRAME_CONN_CLOSE frame_data;
 
     if (!ossl_quic_wire_decode_frame_conn_close(pkt, &frame_data))
         return 0;
 
-    /* TODO(QUIC): ADD CODE to send |frame_data| to the connection manager */
-
+    ossl_quic_channel_on_remote_conn_close(ch, &frame_data);
     return 1;
 }
 
 static int depack_do_frame_handshake_done(PACKET *pkt,
-                                          QUIC_CONNECTION *connection,
+                                          QUIC_CHANNEL *ch,
                                           OSSL_ACKM_RX_PKT *ackm_data)
 {
     if (!ossl_quic_wire_decode_frame_handshake_done(pkt))
@@ -531,13 +601,12 @@ static int depack_do_frame_handshake_done(PACKET *pkt,
     /* This frame makes the packet ACK eliciting */
     ackm_data->is_ack_eliciting = 1;
 
-    /* TODO(QUIC): ADD CODE to tell the handshake manager that we're done */
-
+    ossl_quic_channel_on_handshake_confirmed(ch);
     return 1;
 }
 
 static int depack_do_frame_unknown_extension(PACKET *pkt,
-                                             QUIC_CONNECTION *connection,
+                                             QUIC_CHANNEL *ch,
                                              OSSL_ACKM_RX_PKT *ackm_data)
 {
     /*
@@ -560,11 +629,11 @@ static int depack_do_frame_unknown_extension(PACKET *pkt,
 
 /* Main frame processor */
 
-static int depack_process_frames(QUIC_CONNECTION *connection, PACKET *pkt,
-                                 OSSL_QRX_PKT_WRAP *parent_pkt, int packet_space,
+static int depack_process_frames(QUIC_CHANNEL *ch, PACKET *pkt,
+                                 OSSL_QRX_PKT *parent_pkt, int packet_space,
                                  OSSL_TIME received, OSSL_ACKM_RX_PKT *ackm_data)
 {
-    uint32_t pkt_type = parent_pkt->pkt->hdr->type;
+    uint32_t pkt_type = parent_pkt->hdr->type;
 
     while (PACKET_remaining(pkt) > 0) {
         uint64_t frame_type;
@@ -575,7 +644,7 @@ static int depack_process_frames(QUIC_CONNECTION *connection, PACKET *pkt,
         switch (frame_type) {
         case OSSL_QUIC_FRAME_TYPE_PING:
             /* Allowed in all packet types */
-            if (!depack_do_frame_ping(pkt, ackm_data))
+            if (!depack_do_frame_ping(pkt, ch, ackm_data))
                 return 0;
             break;
         case OSSL_QUIC_FRAME_TYPE_PADDING:
@@ -587,40 +656,68 @@ static int depack_process_frames(QUIC_CONNECTION *connection, PACKET *pkt,
         case OSSL_QUIC_FRAME_TYPE_ACK_WITHOUT_ECN:
         case OSSL_QUIC_FRAME_TYPE_ACK_WITH_ECN:
             /* ACK frames are valid everywhere except in 0RTT packets */
-            if (pkt_type == QUIC_PKT_TYPE_0RTT)
+            if (pkt_type == QUIC_PKT_TYPE_0RTT) {
+                ossl_quic_channel_raise_protocol_error(ch,
+                                                       QUIC_ERR_PROTOCOL_VIOLATION,
+                                                       frame_type,
+                                                       "ACK not valid in 0-RTT");
                 return 0;
-            if (!depack_do_frame_ack(pkt, connection, packet_space, received))
+            }
+            if (!depack_do_frame_ack(pkt, ch, packet_space, received,
+                                     frame_type))
                 return 0;
             break;
 
         case OSSL_QUIC_FRAME_TYPE_RESET_STREAM:
             /* RESET_STREAM frames are valid in 0RTT and 1RTT packets */
             if (pkt_type != QUIC_PKT_TYPE_0RTT
-                && pkt_type != QUIC_PKT_TYPE_1RTT)
+                && pkt_type != QUIC_PKT_TYPE_1RTT) {
+                ossl_quic_channel_raise_protocol_error(ch,
+                                                       QUIC_ERR_PROTOCOL_VIOLATION,
+                                                       frame_type,
+                                                       "RESET_STREAM not valid in "
+                                                       "INITIAL/HANDSHAKE");
                 return 0;
-            if (!depack_do_frame_reset_stream(pkt, connection, ackm_data))
+            }
+            if (!depack_do_frame_reset_stream(pkt, ch, ackm_data))
                 return 0;
             break;
         case OSSL_QUIC_FRAME_TYPE_STOP_SENDING:
             /* STOP_SENDING frames are valid in 0RTT and 1RTT packets */
             if (pkt_type != QUIC_PKT_TYPE_0RTT
-                && pkt_type != QUIC_PKT_TYPE_1RTT)
+                && pkt_type != QUIC_PKT_TYPE_1RTT) {
+                ossl_quic_channel_raise_protocol_error(ch,
+                                                       QUIC_ERR_PROTOCOL_VIOLATION,
+                                                       frame_type,
+                                                       "STOP_SENDING not valid in "
+                                                       "INITIAL/HANDSHAKE");
                 return 0;
-            if (!depack_do_frame_stop_sending(pkt, connection, ackm_data))
+            }
+            if (!depack_do_frame_stop_sending(pkt, ch, ackm_data))
                 return 0;
             break;
         case OSSL_QUIC_FRAME_TYPE_CRYPTO:
             /* CRYPTO frames are valid everywhere except in 0RTT packets */
-            if (pkt_type == QUIC_PKT_TYPE_0RTT)
+            if (pkt_type == QUIC_PKT_TYPE_0RTT) {
+                ossl_quic_channel_raise_protocol_error(ch,
+                                                       QUIC_ERR_PROTOCOL_VIOLATION,
+                                                       frame_type,
+                                                       "CRYPTO frame not valid in 0-RTT");
                 return 0;
-            if (!depack_do_frame_crypto(pkt, connection, ackm_data))
+            }
+            if (!depack_do_frame_crypto(pkt, ch, parent_pkt, ackm_data))
                 return 0;
             break;
         case OSSL_QUIC_FRAME_TYPE_NEW_TOKEN:
             /* NEW_TOKEN frames are valid in 1RTT packets */
-            if (pkt_type != QUIC_PKT_TYPE_1RTT)
+            if (pkt_type != QUIC_PKT_TYPE_1RTT) {
+                ossl_quic_channel_raise_protocol_error(ch,
+                                                       QUIC_ERR_PROTOCOL_VIOLATION,
+                                                       frame_type,
+                                                       "NEW_TOKEN valid only in 1-RTT");
                 return 0;
-            if (!depack_do_frame_new_token(pkt, connection, ackm_data))
+            }
+            if (!depack_do_frame_new_token(pkt, ch, ackm_data))
                 return 0;
             break;
 
@@ -634,26 +731,42 @@ static int depack_process_frames(QUIC_CONNECTION *connection, PACKET *pkt,
         case OSSL_QUIC_FRAME_TYPE_STREAM_OFF_LEN_FIN:
             /* STREAM frames are valid in 0RTT and 1RTT packets */
             if (pkt_type != QUIC_PKT_TYPE_0RTT
-                && pkt_type != QUIC_PKT_TYPE_1RTT)
+                && pkt_type != QUIC_PKT_TYPE_1RTT) {
+                ossl_quic_channel_raise_protocol_error(ch,
+                                                       QUIC_ERR_PROTOCOL_VIOLATION,
+                                                       frame_type,
+                                                       "STREAM valid only in 0/1-RTT");
                 return 0;
-            if (!depack_do_frame_stream(pkt, connection, parent_pkt, ackm_data))
+            }
+            if (!depack_do_frame_stream(pkt, ch, parent_pkt, ackm_data,
+                                        frame_type))
                 return 0;
             break;
 
         case OSSL_QUIC_FRAME_TYPE_MAX_DATA:
             /* MAX_DATA frames are valid in 0RTT and 1RTT packets */
             if (pkt_type != QUIC_PKT_TYPE_0RTT
-                && pkt_type != QUIC_PKT_TYPE_1RTT)
+                && pkt_type != QUIC_PKT_TYPE_1RTT) {
+                ossl_quic_channel_raise_protocol_error(ch,
+                                                       QUIC_ERR_PROTOCOL_VIOLATION,
+                                                       frame_type,
+                                                       "MAX_DATA valid only in 0/1-RTT");
                 return 0;
-            if (!depack_do_frame_max_data(pkt, connection, ackm_data))
+            }
+            if (!depack_do_frame_max_data(pkt, ch, ackm_data))
                 return 0;
             break;
         case OSSL_QUIC_FRAME_TYPE_MAX_STREAM_DATA:
             /* MAX_STREAM_DATA frames are valid in 0RTT and 1RTT packets */
             if (pkt_type != QUIC_PKT_TYPE_0RTT
-                && pkt_type != QUIC_PKT_TYPE_1RTT)
+                && pkt_type != QUIC_PKT_TYPE_1RTT) {
+                ossl_quic_channel_raise_protocol_error(ch,
+                                                       QUIC_ERR_PROTOCOL_VIOLATION,
+                                                       frame_type,
+                                                       "MAX_STREAM_DATA valid only in 0/1-RTT");
                 return 0;
-            if (!depack_do_frame_max_stream_data(pkt, connection, ackm_data))
+            }
+            if (!depack_do_frame_max_stream_data(pkt, ch, ackm_data))
                 return 0;
             break;
 
@@ -661,26 +774,42 @@ static int depack_process_frames(QUIC_CONNECTION *connection, PACKET *pkt,
         case OSSL_QUIC_FRAME_TYPE_MAX_STREAMS_UNI:
             /* MAX_STREAMS frames are valid in 0RTT and 1RTT packets */
             if (pkt_type != QUIC_PKT_TYPE_0RTT
-                && pkt_type != QUIC_PKT_TYPE_1RTT)
+                && pkt_type != QUIC_PKT_TYPE_1RTT) {
+                ossl_quic_channel_raise_protocol_error(ch,
+                                                       QUIC_ERR_PROTOCOL_VIOLATION,
+                                                       frame_type,
+                                                       "MAX_STREAMS valid only in 0/1-RTT");
                 return 0;
-            if (!depack_do_frame_max_streams(pkt, connection, ackm_data))
+            }
+            if (!depack_do_frame_max_streams(pkt, ch, ackm_data,
+                                             frame_type))
                 return 0;
             break;
 
         case OSSL_QUIC_FRAME_TYPE_DATA_BLOCKED:
             /* DATA_BLOCKED frames are valid in 0RTT and 1RTT packets */
             if (pkt_type != QUIC_PKT_TYPE_0RTT
-                && pkt_type != QUIC_PKT_TYPE_1RTT)
+                && pkt_type != QUIC_PKT_TYPE_1RTT) {
+                ossl_quic_channel_raise_protocol_error(ch,
+                                                       QUIC_ERR_PROTOCOL_VIOLATION,
+                                                       frame_type,
+                                                       "DATA_BLOCKED valid only in 0/1-RTT");
                 return 0;
-            if (!depack_do_frame_data_blocked(pkt, connection, ackm_data))
+            }
+            if (!depack_do_frame_data_blocked(pkt, ch, ackm_data))
                 return 0;
             break;
         case OSSL_QUIC_FRAME_TYPE_STREAM_DATA_BLOCKED:
             /* STREAM_DATA_BLOCKED frames are valid in 0RTT and 1RTT packets */
             if (pkt_type != QUIC_PKT_TYPE_0RTT
-                && pkt_type != QUIC_PKT_TYPE_1RTT)
+                && pkt_type != QUIC_PKT_TYPE_1RTT) {
+                ossl_quic_channel_raise_protocol_error(ch,
+                                                       QUIC_ERR_PROTOCOL_VIOLATION,
+                                                       frame_type,
+                                                       "STREAM_DATA_BLOCKED valid only in 0/1-RTT");
                 return 0;
-            if (!depack_do_frame_stream_data_blocked(pkt, connection, ackm_data))
+            }
+            if (!depack_do_frame_stream_data_blocked(pkt, ch, ackm_data))
                 return 0;
             break;
 
@@ -688,67 +817,102 @@ static int depack_process_frames(QUIC_CONNECTION *connection, PACKET *pkt,
         case OSSL_QUIC_FRAME_TYPE_STREAMS_BLOCKED_UNI:
             /* STREAMS_BLOCKED frames are valid in 0RTT and 1RTT packets */
             if (pkt_type != QUIC_PKT_TYPE_0RTT
-                && pkt_type != QUIC_PKT_TYPE_1RTT)
+                && pkt_type != QUIC_PKT_TYPE_1RTT) {
+                ossl_quic_channel_raise_protocol_error(ch,
+                                                       QUIC_ERR_PROTOCOL_VIOLATION,
+                                                       frame_type,
+                                                       "STREAMS valid only in 0/1-RTT");
                 return 0;
-            if (!depack_do_frame_streams_blocked(pkt, connection, ackm_data))
+            }
+            if (!depack_do_frame_streams_blocked(pkt, ch, ackm_data,
+                                                 frame_type))
                 return 0;
             break;
 
         case OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID:
             /* NEW_CONN_ID frames are valid in 0RTT and 1RTT packets */
             if (pkt_type != QUIC_PKT_TYPE_0RTT
-                && pkt_type != QUIC_PKT_TYPE_1RTT)
-                return 0;
-            if (!depack_do_frame_new_conn_id(pkt, connection, ackm_data))
+                && pkt_type != QUIC_PKT_TYPE_1RTT) {
+                ossl_quic_channel_raise_protocol_error(ch,
+                                                       QUIC_ERR_PROTOCOL_VIOLATION,
+                                                       frame_type,
+                                                       "NEW_CONN_ID valid only in 0/1-RTT");
+            }
+            if (!depack_do_frame_new_conn_id(pkt, ch, ackm_data))
                 return 0;
             break;
         case OSSL_QUIC_FRAME_TYPE_RETIRE_CONN_ID:
             /* RETIRE_CONN_ID frames are valid in 0RTT and 1RTT packets */
             if (pkt_type != QUIC_PKT_TYPE_0RTT
-                && pkt_type != QUIC_PKT_TYPE_1RTT)
+                && pkt_type != QUIC_PKT_TYPE_1RTT) {
+                ossl_quic_channel_raise_protocol_error(ch,
+                                                       QUIC_ERR_PROTOCOL_VIOLATION,
+                                                       frame_type,
+                                                       "RETIRE_CONN_ID valid only in 0/1-RTT");
                 return 0;
-            if (!depack_do_frame_retire_conn_id(pkt, connection, ackm_data))
+            }
+            if (!depack_do_frame_retire_conn_id(pkt, ch, ackm_data))
                 return 0;
             break;
         case OSSL_QUIC_FRAME_TYPE_PATH_CHALLENGE:
             /* PATH_CHALLENGE frames are valid in 0RTT and 1RTT packets */
             if (pkt_type != QUIC_PKT_TYPE_0RTT
-                && pkt_type != QUIC_PKT_TYPE_1RTT)
+                && pkt_type != QUIC_PKT_TYPE_1RTT) {
+                ossl_quic_channel_raise_protocol_error(ch,
+                                                       QUIC_ERR_PROTOCOL_VIOLATION,
+                                                       frame_type,
+                                                       "PATH_CHALLENGE valid only in 0/1-RTT");
                 return 0;
-            if (!depack_do_frame_path_challenge(pkt, connection, ackm_data))
+            }
+            if (!depack_do_frame_path_challenge(pkt, ch, ackm_data))
                 return 0;
             break;
         case OSSL_QUIC_FRAME_TYPE_PATH_RESPONSE:
             /* PATH_RESPONSE frames are valid in 1RTT packets */
-            if (pkt_type != QUIC_PKT_TYPE_1RTT)
+            if (pkt_type != QUIC_PKT_TYPE_1RTT) {
+                ossl_quic_channel_raise_protocol_error(ch,
+                                                       QUIC_ERR_PROTOCOL_VIOLATION,
+                                                       frame_type,
+                                                       "PATH_CHALLENGE valid only in 1-RTT");
                 return 0;
-            if (!depack_do_frame_path_response(pkt, connection, ackm_data))
+            }
+            if (!depack_do_frame_path_response(pkt, ch, ackm_data))
                 return 0;
             break;
 
         case OSSL_QUIC_FRAME_TYPE_CONN_CLOSE_APP:
             /* CONN_CLOSE_APP frames are valid in 0RTT and 1RTT packets */
             if (pkt_type != QUIC_PKT_TYPE_0RTT
-                && pkt_type != QUIC_PKT_TYPE_1RTT)
+                && pkt_type != QUIC_PKT_TYPE_1RTT) {
+                ossl_quic_channel_raise_protocol_error(ch,
+                                                       QUIC_ERR_PROTOCOL_VIOLATION,
+                                                       frame_type,
+                                                       "CONN_CLOSE (APP) valid only in 0/1-RTT");
                 return 0;
+            }
             /* FALLTHRU */
         case OSSL_QUIC_FRAME_TYPE_CONN_CLOSE_TRANSPORT:
             /* CONN_CLOSE_TRANSPORT frames are valid in all packets */
-            if (!depack_do_frame_conn_close(pkt, connection))
+            if (!depack_do_frame_conn_close(pkt, ch))
                 return 0;
             break;
 
         case OSSL_QUIC_FRAME_TYPE_HANDSHAKE_DONE:
             /* HANDSHAKE_DONE frames are valid in 1RTT packets */
-            if (pkt_type != QUIC_PKT_TYPE_1RTT)
+            if (pkt_type != QUIC_PKT_TYPE_1RTT) {
+                ossl_quic_channel_raise_protocol_error(ch,
+                                                       QUIC_ERR_PROTOCOL_VIOLATION,
+                                                       frame_type,
+                                                       "HANDSHAKE_DONE valid only in 1-RTT");
                 return 0;
-            if (!depack_do_frame_handshake_done(pkt, connection, ackm_data))
+            }
+            if (!depack_do_frame_handshake_done(pkt, ch, ackm_data))
                 return 0;
             break;
 
         default:
             /* Unknown frame type. */
-            if (!depack_do_frame_unknown_extension(pkt, connection, ackm_data))
+            if (!depack_do_frame_unknown_extension(pkt, ch, ackm_data))
                 return 0;
 
             break;
@@ -758,11 +922,10 @@ static int depack_process_frames(QUIC_CONNECTION *connection, PACKET *pkt,
     return 1;
 }
 
-int ossl_quic_handle_frames(QUIC_CONNECTION *connection, OSSL_QRX_PKT *qpacket)
+int ossl_quic_handle_frames(QUIC_CHANNEL *ch, OSSL_QRX_PKT *qpacket)
 {
     PACKET pkt;
     OSSL_ACKM_RX_PKT ackm_data;
-    OSSL_QRX_PKT_WRAP *qpkt_wrap = NULL;
     /*
      * ok has three states:
      * -1 error with ackm_data uninitialized
@@ -771,10 +934,7 @@ int ossl_quic_handle_frames(QUIC_CONNECTION *connection, OSSL_QRX_PKT *qpacket)
      */
     int ok = -1;                  /* Assume the worst */
 
-    if (connection == NULL)
-        goto end;
-
-    if ((qpkt_wrap = ossl_qrx_pkt_wrap_new(qpacket)) == NULL)
+    if (ch == NULL)
         goto end;
 
     /* Initialize |ackm_data| (and reinitialize |ok|)*/
@@ -796,26 +956,22 @@ int ossl_quic_handle_frames(QUIC_CONNECTION *connection, OSSL_QRX_PKT *qpacket)
     case QUIC_PKT_TYPE_1RTT:
         ackm_data.pkt_space = QUIC_PN_SPACE_APP;
         break;
+    default:
+        /*
+         * Retry and Version Negotiation packets should not be passed to this
+         * function.
+         */
+        goto end;
     }
     ok = 0;                      /* Still assume the worst */
 
-    /* Handle special cases */
-    if (qpacket->hdr->type == QUIC_PKT_TYPE_RETRY) {
-        /* TODO(QUIC): ADD CODE to handle a retry */
-        goto success;
-    } else if (qpacket->hdr->type == QUIC_PKT_TYPE_VERSION_NEG) {
-        /* TODO(QUIC): ADD CODE to handle version negotiation */
-        goto success;
-    }
-
     /* Now that special cases are out of the way, parse frames */
     if (!PACKET_buf_init(&pkt, qpacket->hdr->data, qpacket->hdr->len)
-        || !depack_process_frames(connection, &pkt, qpkt_wrap,
+        || !depack_process_frames(ch, &pkt, qpacket,
                                   ackm_data.pkt_space, qpacket->time,
                                   &ackm_data))
         goto end;
 
- success:
     ok = 1;
  end:
     /*
@@ -825,30 +981,7 @@ int ossl_quic_handle_frames(QUIC_CONNECTION *connection, OSSL_QRX_PKT *qpacket)
      * |ackm_data| has at least been initialized.
      */
     if (ok >= 0)
-        ossl_ackm_on_rx_packet(GET_CONN_ACKM(connection), &ackm_data);
-
-    /*
-     * Let go of the packet pointer in |qpkt_wrap|.  This means that the
-     * reference counter can't be incremented any more.
-     */
-    if (qpkt_wrap != NULL)
-        qpkt_wrap->pkt = NULL;
+        ossl_ackm_on_rx_packet(ch->ackm, &ackm_data);
 
-    ossl_qrx_pkt_wrap_free(GET_CONN_QRX(connection), qpkt_wrap);
     return ok > 0;
 }
-
-int ossl_quic_depacketize(QUIC_CONNECTION *connection)
-{
-    OSSL_QRX_PKT qpacket;
-
-    if (connection == NULL)
-        return 0;
-
-    /* Try to read a packet from the read record layer */
-    memset(&qpacket, 0, sizeof(qpacket));
-    if (ossl_qrx_read_pkt(GET_CONN_QRX(connection), &qpacket) <= 0)
-        return 0;
-
-    return ossl_quic_handle_frames(connection, &qpacket);
-}