quico 0.3.0 → 0.4.0

package/src/quic_socket.js

@@ -27,6 +27,16 @@ import { QUICConnection } from './quic_connection.js';
  * opts:
  *   remoteIp, remotePort   — where to send packets
  *   hostname               — SNI / :authority for the QUIC/TLS handshake
+ *   alpn                   — ALPN protocol(s) to offer. String or array.
+ *                            Defaults to ['h3']. Non-HTTP/3 consumers pass
+ *                            their own (e.g. ['hq-interop'] for HTTP/0.9,
+ *                            ['doq'] for DNS-over-QUIC).
+ *   rejectUnauthorized      — verify the server certificate (default true)
+ *   ca                      — CA certificate(s) for verification
+ *   onSocket(quic, socket)  — called as soon as the QUICConnection exists,
+ *                            BEFORE the handshake starts. Use this to attach
+ *                            listeners that must observe the handshake, such
+ *                            as 'keylog'. onConnect is too late for those.
  *   onConnect(quic, socket) — called once the QUIC handshake completes
  *   onClose()              — called when the connection closes (the socket is
  *                            already closed by the time this runs)
@@ -49,7 +59,48 @@ function createQuicClientSocket(opts) {
   });
 
   udpSocket.bind(0, function () {
-    quic = new QUICConnection({ isServer: false, hostname: opts.hostname });
+    // Grow the kernel socket buffers before any traffic flows.
+    //
+    // Node's defaults are small (and notably small on Windows). When the send
+    // buffer overflows, the datagram is dropped locally with no error — it
+    // looks exactly like network loss, so the loss-recovery machinery kicks in
+    // and the connection crawls. This was the failure that killed the third
+    // pacer-calibration attempt (see LOSS_PTO_PLAN 7.4): larger bursts spilled
+    // over the buffer and turned a lossless link into a slow one.
+    //
+    // Wrapped in try/catch because the call can throw on platforms that cap
+    // the size; failing to enlarge the buffer is not a reason to fail the
+    // connection.
+    try { udpSocket.setSendBufferSize(2 * 1024 * 1024); } catch (e) {}
+    try { udpSocket.setRecvBufferSize(2 * 1024 * 1024); } catch (e) {}
+
+    quic = new QUICConnection({
+      isServer: false,
+      hostname: opts.hostname,
+      // Without this the client always offered 'h3' regardless of what the
+      // caller wanted, because TLSBridge falls back to ['h3'] when alpn is
+      // undefined. Normalize a bare string into an array here so callers can
+      // pass either form.
+      alpn: (function () {
+        var a = opts.alpn || ['h3'];
+        return Array.isArray(a) ? a : [a];
+      })(),
+      // Defaults to true. Pass false for self-signed certificates, or supply
+      // `ca` for a private CA.
+      rejectUnauthorized: opts.rejectUnauthorized !== false,
+      ca: opts.ca || null
+    });
+
+    // Hand the connection to the caller BEFORE connect() runs.
+    //
+    // onConnect fires after the handshake, which is too late for anything that
+    // has to observe the handshake itself. Key logging is the concrete case:
+    // lemon-tls skips building NSS lines while nothing is listening, and the
+    // handshake secrets are emitted during connect() — so a listener attached
+    // in onConnect receives nothing at all, and the client half of a capture
+    // is undecryptable. onSocket gives callers a hook at the only moment that
+    // works.
+    if (opts.onSocket) opts.onSocket(quic, udpSocket);
 
     quic.on('packet', function (data) {
       udpSocket.send(data, opts.remotePort, opts.remoteIp, function (err) {

package/src/streams.js

@@ -291,7 +291,21 @@ class ServerResponse extends Writable {
 class ClientRequest extends Writable {
 
   constructor(options) {
-    super({ highWaterMark: (options && options.highWaterMark) || 64 * 1024 });
+    super({
+      highWaterMark: (options && options.highWaterMark) || 64 * 1024,
+      // Node's Writable default (autoDestroy: true) marks the stream
+      // destroyed the moment the request BODY finishes — i.e. milliseconds
+      // after end(), on every GET. But a ClientRequest outlives its body: the
+      // transport keeps working on it until the response completes, and
+      // node:http's ClientRequest behaves exactly that way. With the default,
+      // `destroyed` stops meaning "aborted" and starts meaning "body written",
+      // and every liveness guard built on it silently kills healthy requests:
+      // the H3→H2/H1 fallback after the 3s timeout hit such a guard and died
+      // for every GET, and coalesced requests parked on a shared connection
+      // being established were dropped at wake-up the same way. abort() still
+      // calls destroy() explicitly, so real cancellations are unaffected.
+      autoDestroy: false
+    });
 
     options = options || {};
 

package/src/tls_bridge.js

@@ -52,6 +52,14 @@ function TLSBridge(options) {
   var originalDcid = options.originalDcid || new Uint8Array(0);
   var localCid = options.localCid || new Uint8Array(0); // client's own SCID
   var hostname = options.hostname || null;
+  // Peer certificate verification. Defaults to true, matching node:tls — but
+  // until now the option was never plumbed through at all, so quico could not
+  // talk to a server whose certificate wasn't signed by a publicly trusted CA:
+  // no local development against self-signed certs, no internal PKI, and no
+  // interop (the QUIC interop runner mints its own CA and addresses hosts as
+  // server4 / server6, so every implementation disables verification there).
+  var rejectUnauthorized = options.rejectUnauthorized !== false;
+  var ca = options.ca || null;
   // ALPN protocol(s) to advertise. Default ['h3']; normalize string → array.
   var supportedAlpns = (function () {
     var a = options.alpn || ['h3'];
@@ -60,7 +68,12 @@ function TLSBridge(options) {
 
   function feedMessage(data) {
     if (!session) {
-      var sessionOpts = { isServer: isServer, SNICallback: options.SNICallback };
+      var sessionOpts = {
+        isServer: isServer,
+        SNICallback: options.SNICallback,
+        rejectUnauthorized: rejectUnauthorized
+      };
+      if (ca) sessionOpts.ca = ca;
       if (!isServer) {
         sessionOpts.sessionId = new Uint8Array(0); // QUIC: no compatibility mode
         if (hostname) sessionOpts.servername = hostname;
@@ -101,7 +114,18 @@ function TLSBridge(options) {
         helloHandled = true; // ClientHello will be generated from this set_context
       }
     }
-    session.message(data);
+    // Only feed real handshake bytes. QUICConnection.connect() calls
+    // feedMessage(new Uint8Array(0)) as a "trigger" to start the handshake,
+    // but the ClientHello is actually built by lemon-tls from set_context()
+    // above, on its own timer — the empty feed was always a no-op in intent.
+    //
+    // It stopped being harmless once lemon-tls hardened parse failures into
+    // fatalAlert(): an empty buffer fails as "truncated u8 at 0", which sets
+    // the session state to 'error' permanently, so the ClientHello timer then
+    // early-returns and NO handshake is ever sent. Guard here rather than
+    // making lemon-tls lenient — rejecting malformed handshake input is the
+    // correct behavior for a TLS stack facing a hostile peer.
+    if (data && data.length > 0) session.message(data);
   }
 
   function setupSessionEvents() {
@@ -218,6 +242,22 @@ function TLSBridge(options) {
     session.on('keyUpdate', function (info) {
       ev.emit('keyUpdate', info.direction, info.secret);
     });
+
+    // NSS SSLKEYLOGFILE lines, forwarded to whoever owns the connection.
+    //
+    // lemon-tls already formats these correctly for TLS 1.3 — including
+    // picking client_random from the right side based on role — and QUIC uses
+    // the identical label set (CLIENT_HANDSHAKE_TRAFFIC_SECRET,
+    // SERVER_TRAFFIC_SECRET_0, ...), so no translation is needed here.
+    //
+    // Note that subscribing has a cost: lemon-tls skips building these strings
+    // entirely while listenerCount('keylog') is 0. We accept that, matching
+    // node:tls, which also always emits 'keylog'. Two short buffers per
+    // handshake is not a measurable expense, and having key logs available
+    // without a rebuild is worth far more when debugging a live capture.
+    session.on('keylog', function (line) {
+      ev.emit('keylog', line);
+    });
   }
 
   return {

package/src/transport.js

@@ -154,6 +154,94 @@ function parse_quic_datagram(array) {
 }
 
 
+// ============================================================
+//  Version Negotiation (RFC 9000 §6, §17.2.1)
+// ============================================================
+
+/** QUIC versions this implementation can actually speak. */
+var SUPPORTED_VERSIONS = [0x00000001];
+
+/**
+ * Is this a version we can handle?
+ * Version 0 identifies a Version Negotiation packet, not a real version.
+ */
+function is_supported_version(version) {
+  return SUPPORTED_VERSIONS.indexOf(version >>> 0) !== -1;
+}
+
+/**
+ * Build a Version Negotiation packet (RFC 9000 §17.2.1).
+ *
+ * A server MUST send one when it receives a long-header packet carrying a
+ * version it does not support — it is how a client discovers what the server
+ * speaks, and how any QUIC prober checks whether a server is alive without
+ * completing a handshake. The interop runner's simulator does exactly that
+ * before starting a test, so without this the server looks dead.
+ *
+ * The packet is unusual: no encryption, no packet number, no frames, and no
+ * connection state. It is valid only as an immediate response.
+ *
+ * IMPORTANT: the connection IDs are swapped. The DCID we send is the SCID we
+ * received, and vice versa — the client matches the reply against its own
+ * Source CID, so getting this backwards makes the packet be ignored.
+ *
+ *   byte 0    1 (long header) + 7 unpredictable bits
+ *   1..4      version 0x00000000
+ *   5         DCID length, then DCID
+ *   ...       SCID length, then SCID
+ *   ...       list of supported versions, 4 bytes each
+ *
+ * @param {Uint8Array} recvDcid  DCID from the client's packet (becomes our SCID)
+ * @param {Uint8Array} recvScid  SCID from the client's packet (becomes our DCID)
+ */
+function build_version_negotiation(recvDcid, recvScid) {
+  var dcid = recvScid || new Uint8Array(0);
+  var scid = recvDcid || new Uint8Array(0);
+
+  // RFC 9000 §17.2.1: the low 7 bits are unused and SHOULD be random, so that
+  // clients don't come to depend on a fixed value.
+  var first = 0x80 | (Math.floor(Math.random() * 128) & 0x7f);
+
+  var versions = SUPPORTED_VERSIONS.slice();
+
+  // A reserved ("greased") version, per RFC 9000 §6.3. Its pattern is
+  // 0x?a?a?a?a, and no endpoint will ever support it. Including one keeps
+  // clients honest: any client that assumes it understands every version in
+  // the list will break here rather than in the field.
+  var grease = ((Math.floor(Math.random() * 16) << 28) |
+                (0x0a << 24) |
+                (Math.floor(Math.random() * 16) << 20) |
+                (0x0a << 16) |
+                (Math.floor(Math.random() * 16) << 12) |
+                (0x0a << 8) |
+                (Math.floor(Math.random() * 16) << 4) |
+                0x0a) >>> 0;
+  versions.push(grease);
+
+  var out = new Uint8Array(1 + 4 + 1 + dcid.length + 1 + scid.length + versions.length * 4);
+  var o = 0;
+
+  out[o++] = first;
+  out[o++] = 0; out[o++] = 0; out[o++] = 0; out[o++] = 0;   // version 0
+
+  out[o++] = dcid.length;
+  out.set(dcid, o); o += dcid.length;
+
+  out[o++] = scid.length;
+  out.set(scid, o); o += scid.length;
+
+  for (var i = 0; i < versions.length; i++) {
+    var v = versions[i] >>> 0;
+    out[o++] = (v >>> 24) & 0xff;
+    out[o++] = (v >>> 16) & 0xff;
+    out[o++] = (v >>> 8) & 0xff;
+    out[o++] = v & 0xff;
+  }
+
+  return out;
+}
+
+
 // ============================================================
 //  QUIC Frame encoding (RFC 9000 §12.4)
 // ============================================================
@@ -657,6 +745,11 @@ export {
   parse_quic_datagram,
   parse_quic_packet,
 
+  // Version negotiation
+  SUPPORTED_VERSIONS,
+  is_supported_version,
+  build_version_negotiation,
+
   // Frame encode/decode
   encode_quic_frames,
   parse_quic_frames,