Server::Configuration::TransportSocketFactoryContext& context) {

  if (config->tlsCertificateSelectorFactory()) {

    return absl::UnimplementedError("Client certificate selector not supported on QUIC");

  }

  absl::Status creation_status = absl::OkStatus();

  auto factory = std::unique_ptr<QuicClientTransportSocketFactory>(

      new QuicClientTransportSocketFactory(std::move(config), context, creation_status));

  RETURN_IF_NOT_OK(creation_status);

  factory->initialize();

  return factory;

}

    Server::Configuration::TransportSocketFactoryContext& context) {

  auto quic_transport = MessageUtil::downcastAndValidate<

      const envoy::extensions::transport_sockets::quic::v3::QuicUpstreamTransport&>(

      config, context.messageValidationVisitor());

  absl::StatusOr<std::unique_ptr<Extensions::TransportSockets::Tls::ClientContextConfigImpl>>

      client_config_or_error = Extensions::TransportSockets::Tls::ClientContextConfigImpl::create(

          quic_transport.upstream_tls_context(), context);

  RETURN_IF_NOT_OK(client_config_or_error.status());

  return QuicClientTransportSocketFactory::create(std::move(*client_config_or_error), context);

}

    : QuicTransportSocketFactoryBase(factory_context.statsScope(), "client"),

      tls_slot_(factory_context.serverFactoryContext().threadLocal()) {

  auto factory_or_error = Extensions::TransportSockets::Tls::ClientSslSocketFactory::create(

      std::move(config), factory_context.serverFactoryContext().sslContextManager(),

      factory_context.statsScope());

  SET_AND_RETURN_IF_NOT_OK(factory_or_error.status(), creation_status);

  fallback_factory_ = std::move(*factory_or_error);

  tls_slot_.set([](Event::Dispatcher&) { return std::make_shared<ThreadLocalQuicConfig>(); });

}

void QuicClientTransportSocketFactory::initialize() {

  if (!fallback_factory_->clientContextConfig()->alpnProtocols().empty()) {

    supported_alpns_ =

        absl::StrSplit(fallback_factory_->clientContextConfig()->alpnProtocols(), ',');

  }

}

ProtobufTypes::MessagePtr QuicClientTransportSocketConfigFactory::createEmptyConfigProto() {

  return std::make_unique<envoy::extensions::transport_sockets::quic::v3::QuicUpstreamTransport>();

}

std::shared_ptr<quic::QuicCryptoClientConfig> QuicClientTransportSocketFactory::getCryptoConfig() {

  Envoy::Ssl::ClientContextSharedPtr context = sslCtx();

  if (context == nullptr) {

    ENVOY_LOG(warn, "SDS hasn't finished updating Ssl context config yet.");

    stats_.upstream_context_secrets_not_ready_.inc();

    return nullptr;

  }

  ASSERT(tls_slot_.currentThreadRegistered());

  ThreadLocalQuicConfig& tls_config = *tls_slot_;

  if (tls_config.client_context_ != context) {

    bool accept_untrusted =

        clientContextConfig() && clientContextConfig()->certificateValidationContext() &&

        clientContextConfig()->certificateValidationContext()->trustChainVerification() ==

            envoy::extensions::transport_sockets::tls::v3::CertificateValidationContext::

                ACCEPT_UNTRUSTED;

    tls_config.client_context_ = context;

    tls_config.crypto_config_ = std::make_shared<quic::QuicCryptoClientConfig>(

        std::make_unique<Quic::EnvoyQuicProofVerifier>(std::move(context), accept_untrusted),

        std::make_unique<quic::QuicClientSessionCache>());

    registerCertCompression(tls_config.crypto_config_->ssl_ctx());

  }

  return tls_config.crypto_config_;

}