QUIC CFQ

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19206)

6 files changed, 681 insertions, 1 deletions

diff --git a/include/internal/quic_cfq.h b/include/internal/quic_cfq.h
new file mode 100644
index 0000000000..d5ac37ae43
--- /dev/null
+++ b/include/internal/quic_cfq.h
@@ -0,0 +1,140 @@
+/*
+ * Copyright 2022 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#ifndef OSSL_QUIC_CFQ_H
+# define OSSL_QUIC_CFQ_H
+
+# include <openssl/ssl.h>
+# include "internal/quic_types.h"
+
+/*
+ * QUIC Control Frame Queue Item
+ * =============================
+ *
+ * The CFQ item structure has a public and a private part. This structure
+ * documents the public part.
+ */
+typedef struct quic_cfq_item_st QUIC_CFQ_ITEM;
+
+struct quic_cfq_item_st {
+    /*
+     * These fields are not used by the CFQ, but are a convenience to assist the
+     * TXPIM in keeping a list of GCR control frames which were sent in a
+     * packet. They may be used for any purpose.
+     */
+    QUIC_CFQ_ITEM  *pkt_prev, *pkt_next;
+
+    /* All other fields are private; use ossl_quic_cfq_item_* accessors. */
+};
+
+#define QUIC_CFQ_STATE_NEW      0
+#define QUIC_CFQ_STATE_TX       1
+
+/* Returns the frame type of a CFQ item. */
+uint64_t ossl_quic_cfq_item_get_frame_type(QUIC_CFQ_ITEM *item);
+
+/* Returns a pointer to the encoded buffer of a CFQ item. */
+const unsigned char *ossl_quic_cfq_item_get_encoded(QUIC_CFQ_ITEM *item);
+
+/* Returns the length of the encoded buffer in bytes. */
+size_t ossl_quic_cfq_item_get_encoded_len(QUIC_CFQ_ITEM *item);
+
+/* Returns the CFQ item state, a QUIC_CFQ_STATE_* value. */
+int ossl_quic_cfq_item_get_state(QUIC_CFQ_ITEM *item);
+
+/* Returns the PN space for the CFQ item. */
+uint32_t ossl_quic_cfq_item_get_pn_space(QUIC_CFQ_ITEM *item);
+
+/*
+ * QUIC Control Frame Queue
+ * ========================
+ */
+typedef struct quic_cfq_st QUIC_CFQ;
+
+QUIC_CFQ *ossl_quic_cfq_new(void);
+void ossl_quic_cfq_free(QUIC_CFQ *cfq);
+
+/*
+ * Input Side
+ * ----------
+ */
+
+/*
+ * Enqueue a frame to the CFQ.
+ *
+ * encoded points to the opaque encoded frame.
+ *
+ * free_cb is called by the CFQ when the buffer is no longer needed;
+ * free_cb_arg is an opaque value passed to free_cb.
+ *
+ * priority determines the relative ordering of control frames in a packet.
+ * Lower numerical values for priority mean that a frame should come earlier in
+ * a packet. pn_space is a QUIC_PN_SPACE_* value.
+ *
+ * On success, returns a QUIC_CFQ_ITEM pointer which acts as a handle to
+ * the queued frame. On failure, returns NULL.
+ *
+ * The frame is initially in the TX state, so there is no need to call
+ * ossl_quic_cfq_mark_tx() immediately after calling this function.
+ *
+ * The frame type is duplicated as the frame_type argument here, even though it
+ * is also encoded into the buffer. This allows the caller to determine the
+ * frame type if desired without having to decode the frame.
+ */
+typedef void (cfq_free_cb)(unsigned char *buf, size_t buf_len, void *arg);
+
+QUIC_CFQ_ITEM *ossl_quic_cfq_add_frame(QUIC_CFQ            *cfq,
+                                       uint32_t             priority,
+                                       uint32_t             pn_space,
+                                       uint64_t             frame_type,
+                                       const unsigned char *encoded,
+                                       size_t               encoded_len,
+                                       cfq_free_cb         *free_cb,
+                                       void                *free_cb_arg);
+
+/*
+ * Effects an immediate transition of the given CFQ item to the TX state.
+ */
+void ossl_quic_cfq_mark_tx(QUIC_CFQ *cfq, QUIC_CFQ_ITEM *item);
+
+/*
+ * Effects an immediate transition of the given CFQ item to the NEW state,
+ * allowing the frame to be retransmitted. If priority is not UINT32_MAX,
+ * the priority is changed to the given value.
+ */
+void ossl_quic_cfq_mark_lost(QUIC_CFQ *cfq, QUIC_CFQ_ITEM *item,
+                             uint32_t priority);
+
+/*
+ * Releases a CFQ item. The item may be in either state (NEW or TX) prior to the
+ * call. The QUIC_CFQ_ITEM pointer must not be used following this call.
+ */
+void ossl_quic_cfq_release(QUIC_CFQ *cfq, QUIC_CFQ_ITEM *item);
+
+/*
+ * Output Side
+ * -----------
+ */
+
+/*
+ * Gets the highest priority CFQ item in the given PN space awaiting
+ * transmission. If there are none, returns NULL.
+ */
+QUIC_CFQ_ITEM *ossl_quic_cfq_get_priority_head(QUIC_CFQ *cfq, uint32_t pn_space);
+
+/*
+ * Given a CFQ item, gets the next CFQ item awaiting transmission in priority
+ * order in the given PN space. In other words, given the return value of
+ * ossl_quic_cfq_get_priority_head(), returns the next-lower priority item.
+ * Returns NULL if the given item is the last item in priority order.
+ */
+QUIC_CFQ_ITEM *ossl_quic_cfq_item_get_priority_next(QUIC_CFQ_ITEM *item,
+                                                    uint32_t pn_space);
+
+#endif
diff --git a/ssl/quic/build.info b/ssl/quic/build.info
index 017100407d..c4d5ad504d 100644
--- a/ssl/quic/build.info
+++ b/ssl/quic/build.info
@@ -5,3 +5,4 @@ SOURCE[$LIBSSL]=cc_dummy.c quic_demux.c quic_record_rx.c
 SOURCE[$LIBSSL]=quic_record_tx.c quic_record_util.c quic_record_shared.c quic_wire_pkt.c
 SOURCE[$LIBSSL]=quic_record_rx_wrap.c quic_rx_depack.c
 SOURCE[$LIBSSL]=quic_fc.c uint_set.c quic_stream.c
+SOURCE[$LIBSSL]=quic_cfq.c
diff --git a/ssl/quic/quic_cfq.c b/ssl/quic/quic_cfq.c
new file mode 100644
index 0000000000..cdd621458c
--- /dev/null
+++ b/ssl/quic/quic_cfq.c
@@ -0,0 +1,339 @@
+/*
+ * Copyright 2022 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#include "internal/quic_cfq.h"
+
+typedef struct quic_cfq_item_ex_st QUIC_CFQ_ITEM_EX;
+
+struct quic_cfq_item_ex_st {
+    QUIC_CFQ_ITEM           public;
+    QUIC_CFQ_ITEM_EX       *prev, *next;
+    unsigned char          *encoded;
+    cfq_free_cb            *free_cb;
+    void                   *free_cb_arg;
+    uint64_t                frame_type;
+    size_t                  encoded_len;
+    uint32_t                priority, pn_space;
+    char                    state;
+};
+
+uint64_t ossl_quic_cfq_item_get_frame_type(QUIC_CFQ_ITEM *item)
+{
+    QUIC_CFQ_ITEM_EX *ex = (QUIC_CFQ_ITEM_EX *)item;
+
+    return ex->frame_type;
+}
+
+const unsigned char *ossl_quic_cfq_item_get_encoded(QUIC_CFQ_ITEM *item)
+{
+    QUIC_CFQ_ITEM_EX *ex = (QUIC_CFQ_ITEM_EX *)item;
+
+    return ex->encoded;
+}
+
+size_t ossl_quic_cfq_item_get_encoded_len(QUIC_CFQ_ITEM *item)
+{
+    QUIC_CFQ_ITEM_EX *ex = (QUIC_CFQ_ITEM_EX *)item;
+
+    return ex->encoded_len;
+}
+
+int ossl_quic_cfq_item_get_state(QUIC_CFQ_ITEM *item)
+{
+    QUIC_CFQ_ITEM_EX *ex = (QUIC_CFQ_ITEM_EX *)item;
+
+    return ex->state;
+}
+
+uint32_t ossl_quic_cfq_item_get_pn_space(QUIC_CFQ_ITEM *item)
+{
+    QUIC_CFQ_ITEM_EX *ex = (QUIC_CFQ_ITEM_EX *)item;
+
+    return ex->pn_space;
+}
+
+typedef struct quic_cfq_item_list_st {
+    QUIC_CFQ_ITEM_EX *head, *tail;
+} QUIC_CFQ_ITEM_LIST;
+
+struct quic_cfq_st {
+    /* 
+     * Invariant: A CFQ item is always in exactly one of these lists, never more
+     * or less than one.
+     *
+     * Invariant: The list the CFQ item is determined exactly by the state field
+     * of the item.
+     */
+    QUIC_CFQ_ITEM_LIST                      new_list, tx_list, free_list;
+};
+
+static int compare(const QUIC_CFQ_ITEM_EX *a, const QUIC_CFQ_ITEM_EX *b)
+{
+    if (a->pn_space < b->pn_space)
+        return -1;
+    else if (a->pn_space > b->pn_space)
+        return 1;
+
+    if (a->priority > b->priority)
+        return -1;
+    else if (a->priority < b->priority)
+        return 1;
+
+    return 0;
+}
+
+static void list_remove(QUIC_CFQ_ITEM_LIST *l, QUIC_CFQ_ITEM_EX *n)
+{
+    if (l->head == n)
+        l->head = n->next;
+    if (l->tail == n)
+        l->tail = n->prev;
+    if (n->prev != NULL)
+        n->prev->next = n->next;
+    if (n->next != NULL)
+        n->next->prev = n->prev;
+    n->prev = n->next = NULL;
+}
+
+static void list_insert_head(QUIC_CFQ_ITEM_LIST *l, QUIC_CFQ_ITEM_EX *n)
+{
+    n->next = l->head;
+    n->prev = NULL;
+    l->head = n;
+    if (n->next != NULL)
+        n->next->prev = n;
+    if (l->tail == NULL)
+        l->tail = n;
+}
+
+static void list_insert_tail(QUIC_CFQ_ITEM_LIST *l, QUIC_CFQ_ITEM_EX *n)
+{
+    n->prev = l->tail;
+    n->next = NULL;
+    l->tail = n;
+    if (n->prev != NULL)
+        n->prev->next = n;
+    if (l->head == NULL)
+        l->head = n;
+}
+
+static void list_insert_after(QUIC_CFQ_ITEM_LIST *l,
+                              QUIC_CFQ_ITEM_EX *ref,
+                              QUIC_CFQ_ITEM_EX *n)
+{
+    n->prev = ref;
+    n->next = ref->next;
+    if (ref->next != NULL)
+        ref->next->prev = n;
+    ref->next = n;
+    if (l->tail == ref)
+        l->tail = n;
+}
+
+static void list_insert_sorted(QUIC_CFQ_ITEM_LIST *l, QUIC_CFQ_ITEM_EX *n,
+                               int (*cmp)(const QUIC_CFQ_ITEM_EX *a,
+                                          const QUIC_CFQ_ITEM_EX *b))
+{
+    QUIC_CFQ_ITEM_EX *p = l->head, *pprev = NULL;
+
+    if (p == NULL) {
+        l->head = l->tail = n;
+        n->prev = n->next = NULL;
+        return;
+    }
+
+    for (; p != NULL && cmp(p, n) < 0; pprev = p, p = p->next);
+
+    if (p == NULL)
+        list_insert_tail(l, n);
+    else if (pprev == NULL)
+        list_insert_head(l, n);
+    else
+        list_insert_after(l, pprev, n);
+}
+
+QUIC_CFQ *ossl_quic_cfq_new(void)
+{
+    QUIC_CFQ *cfq = OPENSSL_zalloc(sizeof(*cfq));
+    if (cfq == NULL)
+        return NULL;
+
+    return cfq;
+}
+
+static void clear_item(QUIC_CFQ_ITEM_EX *item)
+{
+    if (item->free_cb != NULL) {
+        item->free_cb(item->encoded, item->encoded_len, item->free_cb_arg);
+
+        item->free_cb       = NULL;
+        item->encoded       = NULL;
+        item->encoded_len   = 0;
+    }
+
+    item->state = -1;
+}
+
+static void free_list_items(QUIC_CFQ_ITEM_LIST *l)
+{
+    QUIC_CFQ_ITEM_EX *p, *pnext;
+
+    for (p = l->head; p != NULL; p = pnext) {
+        pnext = p->next;
+        clear_item(p);
+        OPENSSL_free(p);
+    }
+}
+
+void ossl_quic_cfq_free(QUIC_CFQ *cfq)
+{
+    if (cfq == NULL)
+        return;
+
+    free_list_items(&cfq->new_list);
+    free_list_items(&cfq->tx_list);
+    free_list_items(&cfq->free_list);
+    OPENSSL_free(cfq);
+}
+
+static QUIC_CFQ_ITEM_EX *cfq_get_free(QUIC_CFQ *cfq)
+{
+    QUIC_CFQ_ITEM_EX *item = cfq->free_list.head;
+
+    if (item != NULL)
+        return item;
+
+    item = OPENSSL_zalloc(sizeof(*item));
+    if (item == NULL)
+        return NULL;
+
+    item->state = -1;
+    list_insert_tail(&cfq->free_list, item);
+    return item;
+}
+
+QUIC_CFQ_ITEM *ossl_quic_cfq_add_frame(QUIC_CFQ            *cfq,
+                                       uint32_t             priority,
+                                       uint32_t             pn_space,
+                                       uint64_t             frame_type,
+                                       const unsigned char *encoded,
+                                       size_t               encoded_len,
+                                       cfq_free_cb         *free_cb,
+                                       void                *free_cb_arg)
+{
+    QUIC_CFQ_ITEM_EX *item = cfq_get_free(cfq);
+
+    if (item == NULL)
+        return NULL;
+
+    item->priority      = priority;
+    item->frame_type    = frame_type;
+    item->pn_space      = pn_space;
+    item->encoded       = (unsigned char *)encoded;
+    item->encoded_len   = encoded_len;
+    item->free_cb       = free_cb;
+    item->free_cb_arg   = free_cb_arg;
+
+    item->state = QUIC_CFQ_STATE_NEW;
+    list_remove(&cfq->free_list, item);
+    list_insert_sorted(&cfq->new_list, item, compare);
+    return &item->public;
+}
+
+void ossl_quic_cfq_mark_tx(QUIC_CFQ *cfq, QUIC_CFQ_ITEM *item)
+{
+    QUIC_CFQ_ITEM_EX *ex = (QUIC_CFQ_ITEM_EX *)item;
+
+    switch (ex->state) {
+    case QUIC_CFQ_STATE_NEW:
+        list_remove(&cfq->new_list, ex);
+        list_insert_tail(&cfq->tx_list, ex);
+        ex->state = QUIC_CFQ_STATE_TX;
+        break;
+    case QUIC_CFQ_STATE_TX:
+        break; /* nothing to do */
+    default:
+        assert(0); /* invalid state (e.g. in free state) */
+        break;
+    }
+}
+
+void ossl_quic_cfq_mark_lost(QUIC_CFQ *cfq, QUIC_CFQ_ITEM *item,
+                             uint32_t priority)
+{
+    QUIC_CFQ_ITEM_EX *ex = (QUIC_CFQ_ITEM_EX *)item;
+
+    switch (ex->state) {
+    case QUIC_CFQ_STATE_NEW:
+        if (priority != UINT32_MAX && priority != ex->priority) {
+            list_remove(&cfq->new_list, ex);
+            ex->priority = priority;
+            list_insert_sorted(&cfq->new_list, ex, compare);
+        }
+        break; /* nothing to do */
+    case QUIC_CFQ_STATE_TX:
+        if (priority != UINT32_MAX)
+            ex->priority = priority;
+        list_remove(&cfq->tx_list, ex);
+        list_insert_sorted(&cfq->new_list, ex, compare);
+        ex->state = QUIC_CFQ_STATE_NEW;
+        break;
+    default:
+        assert(0); /* invalid state (e.g. in free state) */
+        break;
+    }
+}
+
+/*
+ * Releases a CFQ item. The item may be in either state (NEW or TX) prior to the
+ * call. The QUIC_CFQ_ITEM pointer must not be used following this call.
+ */
+void ossl_quic_cfq_release(QUIC_CFQ *cfq, QUIC_CFQ_ITEM *item)
+{
+    QUIC_CFQ_ITEM_EX *ex = (QUIC_CFQ_ITEM_EX *)item;
+    switch (ex->state) {
+    case QUIC_CFQ_STATE_NEW:
+        list_remove(&cfq->new_list, ex);
+        list_insert_tail(&cfq->free_list, ex);
+        clear_item(ex);
+        break;
+    case QUIC_CFQ_STATE_TX:
+        list_remove(&cfq->tx_list, ex);
+        list_insert_tail(&cfq->free_list, ex);
+        clear_item(ex);
+        break;
+    default:
+        assert(0); /* invalid state (e.g. in free state) */
+        break;
+    }
+}
+
+QUIC_CFQ_ITEM *ossl_quic_cfq_get_priority_head(QUIC_CFQ *cfq, uint32_t pn_space)
+{
+    QUIC_CFQ_ITEM_EX *item = cfq->new_list.head;
+
+    for (; item != NULL && item->pn_space != pn_space; item = item->next);
+
+    return &item->public;
+}
+
+QUIC_CFQ_ITEM *ossl_quic_cfq_item_get_priority_next(QUIC_CFQ_ITEM *item,
+                                                    uint32_t pn_space)
+{
+    QUIC_CFQ_ITEM_EX *ex = (QUIC_CFQ_ITEM_EX *)item;
+
+    if (ex == NULL)
+        return NULL;
+
+     ex = ex->next;
+
+     for (; ex != NULL && ex->pn_space != pn_space; ex = ex->next);
+
+     return &ex->public;
+}
diff --git a/test/build.info b/test/build.info
index fd7fa953fd..cd72179be1 100644
--- a/test/build.info
+++ b/test/build.info
@@ -300,6 +300,10 @@ IF[{- !$disabled{tests} -}]
   INCLUDE[quic_stream_test]=../include ../apps/include
   DEPEND[quic_stream_test]=../libcrypto.a ../libssl.a libtestutil.a
 
+  SOURCE[quic_cfq_test]=quic_cfq_test.c
+  INCLUDE[quic_cfq_test]=../include ../apps/include
+  DEPEND[quic_cfq_test]=../libcrypto.a ../libssl.a libtestutil.a
+
   SOURCE[asynctest]=asynctest.c
   INCLUDE[asynctest]=../include ../apps/include
   DEPEND[asynctest]=../libcrypto
@@ -1024,7 +1028,7 @@ ENDIF
   ENDIF
 
   IF[{- !$disabled{'quic'} -}]
-    PROGRAMS{noinst}=quicapitest quic_wire_test quic_ackm_test quic_record_test quic_fc_test quic_stream_test
+    PROGRAMS{noinst}=quicapitest quic_wire_test quic_ackm_test quic_record_test quic_fc_test quic_stream_test quic_cfq_test
   ENDIF
 
   SOURCE[quicapitest]=quicapitest.c helpers/ssltestlib.c
diff --git a/test/quic_cfq_test.c b/test/quic_cfq_test.c
new file mode 100644
index 0000000000..76a1091fd2
--- /dev/null
+++ b/test/quic_cfq_test.c
@@ -0,0 +1,177 @@
+/*
+ * Copyright 2022 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#include "internal/packet.h"
+#include "internal/quic_cfq.h"
+#include "internal/quic_wire.h"
+#include "testutil.h"
+
+static const unsigned char ref_buf[] = {
+    0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19
+};
+
+static const uint32_t ref_priority[] = {
+    90, 80, 70, 60, 95, 40, 94, 20, 10, 0
+};
+
+static const uint32_t ref_pn_space[] = {
+    QUIC_PN_SPACE_INITIAL,
+    QUIC_PN_SPACE_HANDSHAKE,
+    QUIC_PN_SPACE_HANDSHAKE,
+    QUIC_PN_SPACE_INITIAL,
+    QUIC_PN_SPACE_INITIAL,
+    QUIC_PN_SPACE_INITIAL,
+    QUIC_PN_SPACE_INITIAL,
+    QUIC_PN_SPACE_INITIAL,
+    QUIC_PN_SPACE_APP,
+    QUIC_PN_SPACE_APP,
+};
+
+static const uint64_t ref_frame_type[] = {
+    OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID,
+    OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID,
+    OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID,
+    OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID,
+    OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID,
+    OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID,
+    OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID,
+    OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID,
+    OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID,
+    OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID,
+};
+
+static const uint32_t expect[QUIC_PN_SPACE_NUM][11] = {
+    { 4, 6, 0, 3, 5, 7, UINT32_MAX },
+    { 1, 2, UINT32_MAX },
+    { 8, 9, UINT32_MAX },
+};
+
+static QUIC_CFQ_ITEM *items[QUIC_PN_SPACE_NUM][10];
+
+static unsigned char *g_free;
+static size_t g_free_len;
+
+static void free_cb(unsigned char *buf, size_t buf_len, void *arg)
+{
+    g_free      = buf;
+    g_free_len  = buf_len;
+}
+
+static int check(QUIC_CFQ *cfq)
+{
+    int testresult = 0;
+    QUIC_CFQ_ITEM *item;
+    size_t i;
+    uint32_t pn_space;
+
+    for (pn_space = QUIC_PN_SPACE_INITIAL; pn_space < QUIC_PN_SPACE_NUM; ++pn_space)
+        for (i = 0, item = ossl_quic_cfq_get_priority_head(cfq, pn_space);;
+             ++i, item = ossl_quic_cfq_item_get_priority_next(item, pn_space)) {
+
+            if (expect[pn_space][i] == UINT32_MAX) {
+                if (!TEST_ptr_null(item))
+                    goto err;
+
+                break;
+            }
+
+            items[pn_space][i] = item;
+
+            if (!TEST_ptr(item)
+                || !TEST_ptr_eq(ossl_quic_cfq_item_get_encoded(item),
+                                ref_buf + expect[pn_space][i])
+                || !TEST_int_eq(ossl_quic_cfq_item_get_pn_space(item), pn_space)
+                || !TEST_int_eq(ossl_quic_cfq_item_get_state(item),
+                                QUIC_CFQ_STATE_NEW))
+                goto err;
+        }
+
+    testresult = 1;
+err:
+    return testresult;
+}
+
+static int test_cfq(void)
+{
+    int testresult = 0;
+    QUIC_CFQ *cfq = NULL;
+    QUIC_CFQ_ITEM *item, *inext;
+    size_t i;
+    uint32_t pn_space;
+
+    if (!TEST_ptr(cfq = ossl_quic_cfq_new()))
+        goto err;
+
+    g_free      = NULL;
+    g_free_len  = 0;
+
+    for (i = 0; i < OSSL_NELEM(ref_buf); ++i) {
+        if (!TEST_ptr(item = ossl_quic_cfq_add_frame(cfq, ref_priority[i],
+                                                     ref_pn_space[i],
+                                                     ref_frame_type[i],
+                                                     ref_buf + i,
+                                                     1,
+                                                     free_cb,
+                                                     NULL))
+            || !TEST_int_eq(ossl_quic_cfq_item_get_state(item),
+                            QUIC_CFQ_STATE_NEW)
+            || !TEST_uint_eq(ossl_quic_cfq_item_get_pn_space(item),
+                             ref_pn_space[i])
+            || !TEST_uint_eq(ossl_quic_cfq_item_get_frame_type(item),
+                             ref_frame_type[i])
+            || !TEST_ptr_eq(ossl_quic_cfq_item_get_encoded(item),
+                            ref_buf + i)
+            || !TEST_size_t_eq(ossl_quic_cfq_item_get_encoded_len(item),
+                               1))
+            goto err;
+    }
+
+    if (!check(cfq))
+        goto err;
+
+    for (pn_space = QUIC_PN_SPACE_INITIAL; pn_space < QUIC_PN_SPACE_NUM; ++pn_space)
+        for (item = ossl_quic_cfq_get_priority_head(cfq, pn_space);
+             item != NULL; item = inext) {
+            inext = ossl_quic_cfq_item_get_priority_next(item, pn_space);
+
+            ossl_quic_cfq_mark_tx(cfq, item);
+        }
+
+    for (pn_space = QUIC_PN_SPACE_INITIAL; pn_space < QUIC_PN_SPACE_NUM; ++pn_space)
+        if (!TEST_ptr_null(ossl_quic_cfq_get_priority_head(cfq, pn_space)))
+            goto err;
+
+    for (pn_space = QUIC_PN_SPACE_INITIAL; pn_space < QUIC_PN_SPACE_NUM; ++pn_space)
+        for (i = 0; i < OSSL_NELEM(items[0]); ++i)
+            if (items[pn_space][i] != NULL)
+                ossl_quic_cfq_mark_lost(cfq, items[pn_space][i], UINT32_MAX);
+
+    if (!check(cfq))
+        goto err;
+
+    for (pn_space = QUIC_PN_SPACE_INITIAL; pn_space < QUIC_PN_SPACE_NUM; ++pn_space)
+        for (i = 0; i < OSSL_NELEM(items[0]); ++i)
+            if (items[pn_space][i] != NULL)
+                ossl_quic_cfq_release(cfq, items[pn_space][i]);
+
+    for (pn_space = QUIC_PN_SPACE_INITIAL; pn_space < QUIC_PN_SPACE_NUM; ++pn_space)
+        if (!TEST_ptr_null(ossl_quic_cfq_get_priority_head(cfq, pn_space)))
+            goto err;
+
+    testresult = 1;
+err:
+    ossl_quic_cfq_free(cfq);
+    return testresult;
+}
+
+int setup_tests(void)
+{
+    ADD_TEST(test_cfq);
+    return 1;
+}
diff --git a/test/recipes/70-test_quic_cfq.t b/test/recipes/70-test_quic_cfq.t
new file mode 100644
index 0000000000..39418b7195
--- /dev/null
+++ b/test/recipes/70-test_quic_cfq.t
@@ -0,0 +1,19 @@
+#! /usr/bin/env perl
+# Copyright 2022 The OpenSSL Project Authors. All Rights Reserved.
+#
+# Licensed under the Apache License 2.0 (the "License").  You may not use
+# this file except in compliance with the License.  You can obtain a copy
+# in the file LICENSE in the source distribution or at
+# https://www.openssl.org/source/license.html
+
+use OpenSSL::Test;
+use OpenSSL::Test::Utils;
+
+setup("test_quic_cfq");
+
+plan skip_all => "QUIC protocol is not supported by this OpenSSL build"
+    if disabled('quic');
+
+plan tests => 1;
+
+ok(run(test(["quic_cfq_test"])));