@fails-components/webtransport 0.0.1-rc.0 → 0.0.1-rc.1

package/third_party/quiche/quiche/quic/core/quic_server_id_test.cc

@@ -8,7 +8,7 @@
 
 #include "quiche/quic/platform/api/quic_test.h"
 
-namespace quic {
+namespace quic::test {
 
 namespace {
 
@@ -121,4 +121,4 @@ TEST_F(QuicServerIdTest, Equals) {
 
 }  // namespace
 
-}  // namespace quic
+}  // namespace quic::test

package/third_party/quiche/quiche/quic/core/quic_session.cc

@@ -543,7 +543,7 @@ void QuicSession::OnBlockedFrame(const QuicBlockedFrame& frame) {
   //                streams: if we have a large window then maybe something
   //                had gone wrong with the flow control accounting.
   QUIC_DLOG(INFO) << ENDPOINT << "Received BLOCKED frame with stream id: "
-                  << frame.stream_id;
+                  << frame.stream_id << ", offset: " << frame.offset;
 }
 
 bool QuicSession::CheckStreamNotBusyLooping(QuicStream* stream,
@@ -939,8 +939,8 @@ void QuicSession::SendGoAway(QuicErrorCode error_code,
       reason);
 }
 
-void QuicSession::SendBlocked(QuicStreamId id) {
-  control_frame_manager_.WriteOrBufferBlocked(id);
+void QuicSession::SendBlocked(QuicStreamId id, QuicStreamOffset byte_offset) {
+  control_frame_manager_.WriteOrBufferBlocked(id, byte_offset);
 }
 
 void QuicSession::SendWindowUpdate(QuicStreamId id,
@@ -1558,7 +1558,7 @@ bool QuicSession::OnNewDecryptionKeyAvailable(
     bool set_alternative_decrypter, bool latch_once_used) {
   if (connection_->version().handshake_protocol == PROTOCOL_TLS1_3 &&
       !connection()->framer().HasEncrypterOfEncryptionLevel(
-          QuicUtils::GetEncryptionLevel(
+          QuicUtils::GetEncryptionLevelToSendAckofSpace(
               QuicUtils::GetPacketNumberSpace(level)))) {
     // This should never happen because connection should never decrypt a packet
     // while an ACK for it cannot be encrypted.

package/third_party/quiche/quiche/quic/core/quic_session.h

@@ -266,7 +266,7 @@ class QUIC_EXPORT_PRIVATE QuicSession
   virtual void SendGoAway(QuicErrorCode error_code, const std::string& reason);
 
   // Sends a BLOCKED frame.
-  virtual void SendBlocked(QuicStreamId id);
+  virtual void SendBlocked(QuicStreamId id, QuicStreamOffset byte_offset);
 
   // Sends a WINDOW_UPDATE frame.
   virtual void SendWindowUpdate(QuicStreamId id, QuicStreamOffset byte_offset);

package/third_party/quiche/quiche/quic/core/quic_session_test.cc

@@ -38,6 +38,7 @@
 #include "quiche/quic/test_tools/quic_stream_peer.h"
 #include "quiche/quic/test_tools/quic_stream_send_buffer_peer.h"
 #include "quiche/quic/test_tools/quic_test_utils.h"
+#include "quiche/common/platform/api/quiche_logging.h"
 #include "quiche/common/quiche_mem_slice_storage.h"
 
 using spdy::kV3HighestPriority;
@@ -186,6 +187,21 @@ class TestCryptoStream : public QuicCryptoStream, public QuicCryptoHandshaker {
     return level != ENCRYPTION_ZERO_RTT;
   }
 
+  EncryptionLevel GetEncryptionLevelToSendCryptoDataOfSpace(
+      PacketNumberSpace space) const override {
+    switch (space) {
+      case INITIAL_DATA:
+        return ENCRYPTION_INITIAL;
+      case HANDSHAKE_DATA:
+        return ENCRYPTION_HANDSHAKE;
+      case APPLICATION_DATA:
+        return ENCRYPTION_FORWARD_SECURE;
+      default:
+        QUICHE_DCHECK(false);
+        return NUM_ENCRYPTION_LEVELS;
+    }
+  }
+
  private:
   using QuicCryptoStream::session;
 
@@ -2959,7 +2975,11 @@ TEST_P(QuicSessionTestServer, WriteBufferedCryptoFrames) {
 
   EXPECT_CALL(*connection_, SendCryptoData(ENCRYPTION_INITIAL, 350, 1000))
       .WillOnce(Return(350));
-  EXPECT_CALL(*connection_, SendCryptoData(ENCRYPTION_ZERO_RTT, 1350, 0))
+  EXPECT_CALL(
+      *connection_,
+      SendCryptoData(crypto_stream->GetEncryptionLevelToSendCryptoDataOfSpace(
+                         QuicUtils::GetPacketNumberSpace(ENCRYPTION_ZERO_RTT)),
+                     1350, 0))
       .WillOnce(Return(1350));
   session_.OnCanWrite();
   EXPECT_FALSE(session_.HasPendingHandshake());

package/third_party/quiche/quiche/quic/core/quic_stream.cc

@@ -150,7 +150,7 @@ void PendingStream::AddBytesConsumed(QuicByteCount bytes) {
 void PendingStream::ResetWithError(QuicResetStreamError /*error*/) {
   // Currently PendingStream is only read-unidirectional. It shouldn't send
   // Reset.
-  QUIC_NOTREACHED();
+  QUICHE_NOTREACHED();
 }
 
 void PendingStream::OnUnrecoverableError(QuicErrorCode error,
@@ -741,15 +741,12 @@ void QuicStream::MaybeSendBlocked() {
         << ENDPOINT << "MaybeSendBlocked called on stream without flow control";
     return;
   }
-  if (flow_controller_->ShouldSendBlocked()) {
-    session_->SendBlocked(id_);
-  }
+  flow_controller_->MaybeSendBlocked();
   if (!stream_contributes_to_connection_flow_control_) {
     return;
   }
-  if (connection_flow_controller_->ShouldSendBlocked()) {
-    session_->SendBlocked(QuicUtils::GetInvalidStreamId(transport_version()));
-  }
+  connection_flow_controller_->MaybeSendBlocked();
+
   // If the stream is blocked by connection-level flow control but not by
   // stream-level flow control, add the stream to the write blocked list so that
   // the stream will be given a chance to write when a connection-level

package/third_party/quiche/quiche/quic/core/quic_stream_test.cc

@@ -1510,8 +1510,7 @@ TEST_P(QuicStreamTest, MarkConnectionLevelWriteBlockedOnWindowUpdateFrame) {
 
   EXPECT_CALL(*session_, WritevData(_, _, _, _, _, _))
       .WillRepeatedly(Invoke(session_.get(), &MockQuicSession::ConsumeData));
-  EXPECT_CALL(*session_, WriteControlFrame(_, _))
-      .WillOnce(Invoke(&ClearControlFrameWithTransmissionType));
+  EXPECT_CALL(*session_, SendBlocked(_, _)).Times(1);
   std::string data(1024, '.');
   stream->WriteOrBufferData(data, false, nullptr);
   EXPECT_FALSE(HasWriteBlockedStreams());
@@ -1544,8 +1543,7 @@ TEST_P(QuicStreamTest,
   std::string data(100, '.');
   EXPECT_CALL(*session_, WritevData(_, _, _, _, _, _))
       .WillRepeatedly(Invoke(session_.get(), &MockQuicSession::ConsumeData));
-  EXPECT_CALL(*session_, WriteControlFrame(_, _))
-      .WillOnce(Invoke(&ClearControlFrameWithTransmissionType));
+  EXPECT_CALL(*session_, SendBlocked(_, _)).Times(1);
   stream->WriteOrBufferData(data, false, nullptr);
   EXPECT_FALSE(HasWriteBlockedStreams());
 

package/third_party/quiche/quiche/quic/core/quic_trace_visitor_test.cc

@@ -11,7 +11,7 @@
 #include "quiche/quic/test_tools/simulator/simulator.h"
 #include "quiche/quic/test_tools/simulator/switch.h"
 
-namespace quic {
+namespace quic::test {
 namespace {
 
 const QuicByteCount kTransferSize = 1000 * kMaxOutgoingPacketSize;
@@ -181,4 +181,4 @@ TEST_F(QuicTraceVisitorTest, EncryptionLevels) {
 }
 
 }  // namespace
-}  // namespace quic
+}  // namespace quic::test

package/third_party/quiche/quiche/quic/core/quic_types.h

@@ -28,13 +28,6 @@ using QuicPacketLength = uint16_t;
 using QuicControlFrameId = uint32_t;
 using QuicMessageId = uint32_t;
 
-// TODO(b/181256914) replace QuicDatagramStreamId with QuicStreamId once we
-// remove support for draft-ietf-masque-h3-datagram-00 in favor of later drafts.
-using QuicDatagramStreamId = uint64_t;
-using QuicDatagramContextId = uint64_t;
-// Note that for draft-ietf-masque-h3-datagram-00, we represent the flow ID as a
-// QuicDatagramStreamId.
-
 // IMPORTANT: IETF QUIC defines stream IDs and stream counts as being unsigned
 // 62-bit numbers. However, we have decided to only support up to 2^32-1 streams
 // in order to reduce the size of data structures such as QuicStreamFrame
@@ -836,6 +829,8 @@ QUIC_EXPORT_PRIVATE std::ostream& operator<<(std::ostream& os,
 
 QUIC_EXPORT_PRIVATE std::string KeyUpdateReasonString(KeyUpdateReason reason);
 
+using QuicSignatureAlgorithmVector = absl::InlinedVector<uint16_t, 8>;
+
 // QuicSSLConfig contains configurations to be applied on a SSL object, which
 // overrides the configurations in SSL_CTX.
 struct QUIC_NO_EXPORT QuicSSLConfig {
@@ -846,7 +841,7 @@ struct QUIC_NO_EXPORT QuicSSLConfig {
   absl::optional<bool> disable_ticket_support;
   // If set, used to configure the SSL object with
   // SSL_set_signing_algorithm_prefs.
-  absl::optional<absl::InlinedVector<uint16_t, 8>> signing_algorithm_prefs;
+  absl::optional<QuicSignatureAlgorithmVector> signing_algorithm_prefs;
   // Client certificate mode for mTLS support. Only used at server side.
   ClientCertMode client_cert_mode = ClientCertMode::kNone;
 };

package/third_party/quiche/quiche/quic/core/quic_udp_socket_posix.cc

@@ -9,6 +9,7 @@
 #include <sys/socket.h>
 #include <sys/types.h>
 
+#include "absl/base/optimization.h"
 #include "quiche/quic/core/quic_udp_socket.h"
 #include "quiche/quic/platform/api/quic_bug_tracker.h"
 #include "quiche/quic/platform/api/quic_udp_socket_platform_api.h"
@@ -413,13 +414,13 @@ void QuicUdpSocketApi::ReadPacket(QuicUdpSocketFd fd,
     return;
   }
 
-  if (QUIC_PREDICT_FALSE(hdr.msg_flags & MSG_CTRUNC)) {
+  if (ABSL_PREDICT_FALSE(hdr.msg_flags & MSG_CTRUNC)) {
     QUIC_BUG(quic_bug_10751_3)
         << "Control buffer too small. size:" << control_buffer.buffer_len;
     return;
   }
 
-  if (QUIC_PREDICT_FALSE(hdr.msg_flags & MSG_TRUNC) ||
+  if (ABSL_PREDICT_FALSE(hdr.msg_flags & MSG_TRUNC) ||
       // Normally "bytes_read > packet_buffer.buffer_len" implies the MSG_TRUNC
       // bit is set, but it is not the case if tested with config=android_arm64.
       static_cast<size_t>(bytes_read) > packet_buffer.buffer_len) {
@@ -502,14 +503,14 @@ size_t QuicUdpSocketApi::ReadMultiplePackets(QuicUdpSocketFd fd,
     }
 
     msghdr& hdr = hdrs[i].msg_hdr;
-    if (QUIC_PREDICT_FALSE(hdr.msg_flags & MSG_CTRUNC)) {
+    if (ABSL_PREDICT_FALSE(hdr.msg_flags & MSG_CTRUNC)) {
       QUIC_BUG(quic_bug_10751_4) << "Control buffer too small. size:"
                                  << (*results)[i].control_buffer.buffer_len
                                  << ", need:" << hdr.msg_controllen;
       continue;
     }
 
-    if (QUIC_PREDICT_FALSE(hdr.msg_flags & MSG_TRUNC)) {
+    if (ABSL_PREDICT_FALSE(hdr.msg_flags & MSG_TRUNC)) {
       QUIC_LOG_FIRST_N(WARNING, 100)
           << "Received truncated QUIC packet: buffer size:"
           << (*results)[i].packet_buffer.buffer_len

package/third_party/quiche/quiche/quic/core/quic_unacked_packet_map_test.cc

@@ -551,7 +551,7 @@ TEST_P(QuicUnackedPacketMapTest, CannotAggregateAckedControlFrames) {
   QuicWindowUpdateFrame window_update(1, 5, 100);
   QuicStreamFrame stream_frame1(3, false, 0, 100);
   QuicStreamFrame stream_frame2(3, false, 100, 100);
-  QuicBlockedFrame blocked(2, 5);
+  QuicBlockedFrame blocked(2, 5, 0);
   QuicGoAwayFrame go_away(3, QUIC_PEER_GOING_AWAY, 5, "Going away.");
 
   QuicTransmissionInfo info1;

package/third_party/quiche/quiche/quic/core/quic_utils.cc

@@ -595,7 +595,7 @@ PacketNumberSpace QuicUtils::GetPacketNumberSpace(
 }
 
 // static
-EncryptionLevel QuicUtils::GetEncryptionLevel(
+EncryptionLevel QuicUtils::GetEncryptionLevelToSendAckofSpace(
     PacketNumberSpace packet_number_space) {
   switch (packet_number_space) {
     case INITIAL_DATA:

package/third_party/quiche/quiche/quic/core/quic_utils.h

@@ -209,8 +209,8 @@ class QUIC_EXPORT_PRIVATE QuicUtils {
   static PacketNumberSpace GetPacketNumberSpace(
       EncryptionLevel encryption_level);
 
-  // Determines encryption level to send packets in |packet_number_space|.
-  static EncryptionLevel GetEncryptionLevel(
+  // Determines encryption level to send ACK in |packet_number_space|.
+  static EncryptionLevel GetEncryptionLevelToSendAckofSpace(
       PacketNumberSpace packet_number_space);
 
   // Get the maximum value for a V99/IETF QUIC stream count. If a count

package/third_party/quiche/quiche/quic/core/quic_versions_test.cc

@@ -8,7 +8,6 @@
 #include "quiche/quic/platform/api/quic_expect_bug.h"
 #include "quiche/quic/platform/api/quic_flags.h"
 #include "quiche/quic/platform/api/quic_logging.h"
-#include "quiche/quic/platform/api/quic_mock_log.h"
 #include "quiche/quic/platform/api/quic_test.h"
 
 namespace quic {

package/third_party/quiche/quiche/quic/core/tls_client_handshaker.cc

@@ -361,6 +361,19 @@ bool TlsClientHandshaker::IsCryptoFrameExpectedForEncryptionLevel(
   return level != ENCRYPTION_ZERO_RTT;
 }
 
+EncryptionLevel TlsClientHandshaker::GetEncryptionLevelToSendCryptoDataOfSpace(
+    PacketNumberSpace space) const {
+  switch (space) {
+    case INITIAL_DATA:
+      return ENCRYPTION_INITIAL;
+    case HANDSHAKE_DATA:
+      return ENCRYPTION_HANDSHAKE;
+    default:
+      QUICHE_DCHECK(false);
+      return NUM_ENCRYPTION_LEVELS;
+  }
+}
+
 bool TlsClientHandshaker::one_rtt_keys_available() const {
   return state_ >= HANDSHAKE_COMPLETE;
 }

package/third_party/quiche/quiche/quic/core/tls_client_handshaker.h

@@ -56,6 +56,8 @@ class QUIC_EXPORT_PRIVATE TlsClientHandshaker
   bool encryption_established() const override;
   bool IsCryptoFrameExpectedForEncryptionLevel(
       EncryptionLevel level) const override;
+  EncryptionLevel GetEncryptionLevelToSendCryptoDataOfSpace(
+      PacketNumberSpace space) const override;
   bool one_rtt_keys_available() const override;
   const QuicCryptoNegotiatedParameters& crypto_negotiated_params()
       const override;

package/third_party/quiche/quiche/quic/core/tls_server_handshaker.cc

@@ -742,9 +742,8 @@ ssl_ticket_aead_result_t TlsServerHandshaker::SessionTicketOpen(
   }
 
   if (!ticket_decryption_callback_) {
-    ticket_decryption_callback_ = new DecryptCallback(this);
-    proof_source_->GetTicketCrypter()->Decrypt(
-        in, std::unique_ptr<DecryptCallback>(ticket_decryption_callback_));
+    ticket_decryption_callback_ = std::make_shared<DecryptCallback>(this);
+    proof_source_->GetTicketCrypter()->Decrypt(in, ticket_decryption_callback_);
 
     // Decrypt can run the callback synchronously. In that case, the callback
     // will clear the ticket_decryption_callback_ pointer, and instead of
@@ -1130,4 +1129,19 @@ bool TlsServerHandshaker::IsCryptoFrameExpectedForEncryptionLevel(
   return level != ENCRYPTION_ZERO_RTT;
 }
 
+EncryptionLevel TlsServerHandshaker::GetEncryptionLevelToSendCryptoDataOfSpace(
+    PacketNumberSpace space) const {
+  switch (space) {
+    case INITIAL_DATA:
+      return ENCRYPTION_INITIAL;
+    case HANDSHAKE_DATA:
+      return ENCRYPTION_HANDSHAKE;
+    case APPLICATION_DATA:
+      return ENCRYPTION_FORWARD_SECURE;
+    default:
+      QUICHE_DCHECK(false);
+      return NUM_ENCRYPTION_LEVELS;
+  }
+}
+
 }  // namespace quic

package/third_party/quiche/quiche/quic/core/tls_server_handshaker.h

@@ -73,6 +73,8 @@ class QUIC_EXPORT_PRIVATE TlsServerHandshaker
   SSL* GetSsl() const override;
   bool IsCryptoFrameExpectedForEncryptionLevel(
       EncryptionLevel level) const override;
+  EncryptionLevel GetEncryptionLevelToSendCryptoDataOfSpace(
+      PacketNumberSpace space) const override;
 
   // From QuicCryptoServerStreamBase and TlsHandshaker
   ssl_early_data_reason_t EarlyDataReason() const override;
@@ -323,7 +325,7 @@ class QUIC_EXPORT_PRIVATE TlsServerHandshaker
   // |ticket_decryption_callback_| points to the non-owned callback that was
   // passed to ProofSource::TicketCrypter::Decrypt but hasn't finished running
   // yet.
-  DecryptCallback* ticket_decryption_callback_ = nullptr;
+  std::shared_ptr<DecryptCallback> ticket_decryption_callback_;
   // |decrypted_session_ticket_| contains the decrypted session ticket after the
   // callback has run but before it is passed to BoringSSL.
   std::vector<uint8_t> decrypted_session_ticket_;

package/third_party/quiche/quiche/quic/core/uber_received_packet_manager_test.cc

@@ -33,6 +33,20 @@ const QuicTime::Delta kMinRttMs = QuicTime::Delta::FromMilliseconds(40);
 const QuicTime::Delta kDelayedAckTime =
     QuicTime::Delta::FromMilliseconds(kDefaultDelayedAckTimeMs);
 
+EncryptionLevel GetEncryptionLevel(PacketNumberSpace packet_number_space) {
+  switch (packet_number_space) {
+    case INITIAL_DATA:
+      return ENCRYPTION_INITIAL;
+    case HANDSHAKE_DATA:
+      return ENCRYPTION_HANDSHAKE;
+    case APPLICATION_DATA:
+      return ENCRYPTION_FORWARD_SECURE;
+    default:
+      QUICHE_DCHECK(false);
+      return NUM_ENCRYPTION_LEVELS;
+  }
+}
+
 class UberReceivedPacketManagerTest : public QuicTest {
  protected:
   UberReceivedPacketManagerTest() {
@@ -108,7 +122,7 @@ class UberReceivedPacketManagerTest : public QuicTest {
         continue;
       }
       manager_->ResetAckStates(
-          QuicUtils::GetEncryptionLevel(static_cast<PacketNumberSpace>(i)));
+          GetEncryptionLevel(static_cast<PacketNumberSpace>(i)));
     }
   }
 
@@ -544,15 +558,9 @@ TEST_F(UberReceivedPacketManagerTest,
   CheckAckTimeout(clock_.ApproximateNow());
 
   EXPECT_TRUE(HasPendingAck());
-  if (GetQuicReloadableFlag(quic_update_ack_timeout_on_receipt_time)) {
-    // Verify ACK delay is based on packet receipt time.
-    CheckAckTimeout(clock_.ApproximateNow() -
-                    QuicTime::Delta::FromMilliseconds(11) + kDelayedAckTime);
-  } else {
-    // Delayed ack is scheduled.
-    CheckAckTimeout(clock_.ApproximateNow() -
-                    QuicTime::Delta::FromMilliseconds(1) + kDelayedAckTime);
-  }
+  // Verify ACK delay is based on packet receipt time.
+  CheckAckTimeout(clock_.ApproximateNow() -
+                  QuicTime::Delta::FromMilliseconds(11) + kDelayedAckTime);
 }
 
 }  // namespace

package/third_party/quiche/quiche/quic/masque/masque_client_bin.cc

@@ -54,14 +54,16 @@ int RunMasqueClient(int argc, char* argv[]) {
   }
 
   const bool disable_certificate_verification =
-      GetQuicFlag(FLAGS_disable_certificate_verification);
+      quiche::GetQuicheCommandLineFlag(FLAGS_disable_certificate_verification);
   QuicEpollServer epoll_server;
 
   std::string uri_template = urls[0];
   if (!absl::StrContains(uri_template, '/')) {
-    // Allow passing in authority instead of URI template.
+    // If an authority is passed in instead of a URI template, use the default
+    // URI template.
     uri_template =
-        absl::StrCat("https://", uri_template, "/{target_host}/{target_port}/");
+        absl::StrCat("https://", uri_template,
+                     "/.well-known/masque/udp/{target_host}/{target_port}/");
   }
   url::Parsed parsed_uri_template;
   url::ParseStandardURL(uri_template.c_str(), uri_template.length(),
@@ -82,7 +84,7 @@ int RunMasqueClient(int argc, char* argv[]) {
     proof_verifier = CreateDefaultProofVerifier(host);
   }
   MasqueMode masque_mode = MasqueMode::kOpen;
-  std::string mode_string = GetQuicFlag(FLAGS_masque_mode);
+  std::string mode_string = quiche::GetQuicheCommandLineFlag(FLAGS_masque_mode);
   if (!mode_string.empty() && mode_string != "open") {
     std::cerr << "Invalid masque_mode \"" << mode_string << "\"" << std::endl;
     return 1;

package/third_party/quiche/quiche/quic/masque/masque_client_session.cc

@@ -4,12 +4,14 @@
 
 #include "quiche/quic/masque/masque_client_session.h"
 
+#include <cstring>
 #include <string>
 
 #include "absl/algorithm/container.h"
 #include "absl/container/flat_hash_map.h"
 #include "absl/container/flat_hash_set.h"
 #include "absl/strings/str_cat.h"
+#include "absl/strings/string_view.h"
 #include "url/url_canon.h"
 #include "quiche/quic/core/http/spdy_utils.h"
 #include "quiche/quic/core/quic_data_reader.h"
@@ -122,10 +124,7 @@ MasqueClientSession::GetOrCreateConnectUdpClientState(
   headers[":scheme"] = scheme;
   headers[":authority"] = authority;
   headers[":path"] = canonicalized_path;
-  headers["connect-udp-version"] = "6";
-  if (http_datagram_support() == HttpDatagramSupport::kDraft00) {
-    SpdyUtils::AddDatagramFlowIdHeader(&headers, stream->id());
-  }
+  headers["connect-udp-version"] = "12";
   size_t bytes_sent =
       stream->SendRequest(std::move(headers), /*body=*/"", /*fin=*/false);
   if (bytes_sent == 0) {
@@ -148,8 +147,12 @@ void MasqueClientSession::SendPacket(
     return;
   }
 
+  std::string http_payload;
+  http_payload.resize(1 + packet.size());
+  http_payload[0] = 0;
+  memcpy(&http_payload[1], packet.data(), packet.size());
   MessageStatus message_status =
-      SendHttp3Datagram(connect_udp->stream()->id(), packet);
+      SendHttp3Datagram(connect_udp->stream()->id(), http_payload);
 
   QUIC_DVLOG(1) << "Sent packet to " << target_server_address
                 << " compressed with stream ID " << connect_udp->stream()->id()
@@ -271,8 +274,21 @@ MasqueClientSession::ConnectUdpClientState::operator=(
 void MasqueClientSession::ConnectUdpClientState::OnHttp3Datagram(
     QuicStreamId stream_id, absl::string_view payload) {
   QUICHE_DCHECK_EQ(stream_id, stream()->id());
-  encapsulated_client_session_->ProcessPacket(payload, target_server_address_);
-  QUIC_DVLOG(1) << "Sent " << payload.size()
+  QuicDataReader reader(payload);
+  uint64_t context_id;
+  if (!reader.ReadVarInt62(&context_id)) {
+    QUIC_DLOG(ERROR) << "Failed to read context ID";
+    return;
+  }
+  if (context_id != 0) {
+    QUIC_DLOG(ERROR) << "Ignoring HTTP Datagram with unexpected context ID "
+                     << context_id;
+    return;
+  }
+  absl::string_view http_payload = reader.ReadRemainingPayload();
+  encapsulated_client_session_->ProcessPacket(http_payload,
+                                              target_server_address_);
+  QUIC_DVLOG(1) << "Sent " << http_payload.size()
                 << " bytes to connection for stream ID " << stream_id;
 }
 

package/third_party/quiche/quiche/quic/masque/masque_client_session.h

@@ -125,7 +125,7 @@ class QUIC_NO_EXPORT MasqueClientSession : public QuicSpdyClientSession {
   };
 
   HttpDatagramSupport LocalHttpDatagramSupport() override {
-    return HttpDatagramSupport::kDraft00And04;
+    return HttpDatagramSupport::kDraft09;
   }
 
   const ConnectUdpClientState* GetOrCreateConnectUdpClientState(

package/third_party/quiche/quiche/quic/masque/masque_server_backend.cc

@@ -88,6 +88,19 @@ void MasqueServerBackend::FetchResponseFromBackend(
       request_headers, request_body, request_handler);
 }
 
+void MasqueServerBackend::HandleConnectHeaders(
+    const spdy::Http2HeaderBlock& request_headers,
+    RequestHandler* request_handler) {
+  if (MaybeHandleMasqueRequest(request_headers, request_handler)) {
+    // Request was handled as a MASQUE request.
+    return;
+  }
+  QUIC_DLOG(INFO) << "Fetching non-MASQUE CONNECT response for "
+                  << request_headers.DebugString();
+  QuicMemoryCacheBackend::HandleConnectHeaders(request_headers,
+                                               request_handler);
+}
+
 void MasqueServerBackend::CloseBackendResponseStream(
     QuicSimpleServerBackend::RequestHandler* request_handler) {
   QUIC_DLOG(INFO) << "Closing response stream";

package/third_party/quiche/quiche/quic/masque/masque_server_backend.h

@@ -39,6 +39,8 @@ class QUIC_NO_EXPORT MasqueServerBackend : public QuicMemoryCacheBackend {
       const spdy::Http2HeaderBlock& request_headers,
       const std::string& request_body,
       QuicSimpleServerBackend::RequestHandler* request_handler) override;
+  void HandleConnectHeaders(const spdy::Http2HeaderBlock& request_headers,
+                            RequestHandler* request_handler) override;
 
   void CloseBackendResponseStream(
       QuicSimpleServerBackend::RequestHandler* request_handler) override;

package/third_party/quiche/quiche/quic/masque/masque_server_bin.cc

@@ -46,21 +46,22 @@ int main(int argc, char* argv[]) {
   }
 
   quic::MasqueMode masque_mode = quic::MasqueMode::kOpen;
-  std::string mode_string = GetQuicFlag(FLAGS_masque_mode);
+  std::string mode_string = quiche::GetQuicheCommandLineFlag(FLAGS_masque_mode);
   if (!mode_string.empty() && mode_string != "open") {
     std::cerr << "Invalid masque_mode \"" << mode_string << "\"" << std::endl;
     return 1;
   }
 
   auto backend = std::make_unique<quic::MasqueServerBackend>(
-      masque_mode, GetQuicFlag(FLAGS_server_authority),
-      GetQuicFlag(FLAGS_cache_dir));
+      masque_mode, quiche::GetQuicheCommandLineFlag(FLAGS_server_authority),
+      quiche::GetQuicheCommandLineFlag(FLAGS_cache_dir));
 
   auto server =
       std::make_unique<quic::MasqueEpollServer>(masque_mode, backend.get());
 
   if (!server->CreateUDPSocketAndListen(quic::QuicSocketAddress(
-          quic::QuicIpAddress::Any6(), GetQuicFlag(FLAGS_port)))) {
+          quic::QuicIpAddress::Any6(),
+          quiche::GetQuicheCommandLineFlag(FLAGS_port)))) {
     return 1;
   }