quico 0.7.0 → 0.9.0

package/index.js

@@ -28,8 +28,10 @@ import lemonTls from 'lemon-tls';
 
 // Encrypted Client Hello keys (RFC 9849) — LemonTLS's; for createServer's `ech`.
 const generateEchKey = lemonTls.generateEchKey;
-import { WebTransport, WebTransportError } from './src/webtransport.js';
+import { WebTransport, WebTransportError, WebTransportBidirectionalStream, WebTransportReceiveStream, WebTransportSendStream,
+         WebTransportWriter, WebTransportSendGroup, WebTransportDatagramsWritable, WebTransportDatagramDuplexStream } from './src/webtransport.js';
 import { WebSocket } from './src/ws_client.js';
+import { WebSocketStream, WebSocketError } from './src/ws_stream.js';
 import { connectUdp } from './src/connect_udp_client.js';
 import { WebSocketServer, upgradeWebSocket } from './src/ws_server.js';
 import { ja4h } from './src/ja4h.js';
@@ -52,7 +54,8 @@ import { request as h3Request } from './src/h3_client.js';
 const api = {
   createServer, request, get, Agent, globalAgent,
   IncomingMessage, ServerResponse, ClientRequest,
-  connectUdp, createSecureContext, generateEchKey, WebTransport, WebTransportError, WebSocket, WebSocketServer, upgradeWebSocket,
+  connectUdp, createSecureContext, generateEchKey, WebTransport, WebTransportError, WebTransportBidirectionalStream, WebTransportReceiveStream, WebTransportSendStream,
+  WebTransportWriter, WebTransportSendGroup, WebTransportDatagramsWritable, WebTransportDatagramDuplexStream, WebSocket, WebSocketStream, WebSocketError, WebSocketServer, upgradeWebSocket,
   ja4h, h2Fingerprint, h3Fingerprint, observeH2, profileRequest,
   createQuicServer, createQuicClientSocket, createTcpListener,
   createH1Server, createH2Server, createH3Server,
@@ -62,7 +65,8 @@ const api = {
 export {
   createServer, request, get, Agent, globalAgent,
   IncomingMessage, ServerResponse, ClientRequest,
-  connectUdp, createSecureContext, generateEchKey, WebTransport, WebTransportError, WebSocket, WebSocketServer, upgradeWebSocket,
+  connectUdp, createSecureContext, generateEchKey, WebTransport, WebTransportError, WebTransportBidirectionalStream, WebTransportReceiveStream, WebTransportSendStream,
+  WebTransportWriter, WebTransportSendGroup, WebTransportDatagramsWritable, WebTransportDatagramDuplexStream, WebSocket, WebSocketStream, WebSocketError, WebSocketServer, upgradeWebSocket,
   ja4h, h2Fingerprint, h3Fingerprint, observeH2, profileRequest,
   createQuicServer, createQuicClientSocket, createTcpListener,
   createH1Server, createH2Server, createH3Server,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "quico",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "description": "A pure JavaScript implementation of QUIC, HTTP/3, QPACK, and WebTransport for Node.js",
   "type": "module",
   "main": "index.cjs",
@@ -12,7 +12,7 @@
     }
   },
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=24.0.0"
   },
   "types": "index.d.ts",
   "files": [
@@ -37,6 +37,9 @@
     "http3-client",
     "h3-node",
     "webtransport",
+    "moqt",
+    "masque",
+    "connect-udp",
     "websocket",
     "datagram",
     "udp",
@@ -65,7 +68,7 @@
     "email": "support@quicojs.dev",
     "url": "https://github.com/colocohen/quico/issues"
   },
-  "homepage": "https://github.com/colocohen/quico#readme",
+  "homepage": "https://quicojs.dev",
   "funding": [
     {
       "type": "github",
@@ -77,7 +80,8 @@
     }
   ],
   "dependencies": {
+    "cryptographic-formats": "^0.1.0",
     "flat-ranges": "^2.2.0",
-    "lemon-tls": "^0.9.0"
+    "lemon-tls": "^0.11.0"
   }
-}
+}

package/src/client.js

@@ -479,6 +479,7 @@ function request(url, options, callback) {
         startupCap: options.startupCap, pmtuDiscovery: options.pmtuDiscovery,
         maxUdpPayloadSize: options.maxUdpPayloadSize, initialRtt: options.initialRtt,
         reorderWindow: options.reorderWindow, initialCongestionWindow: options.initialCongestionWindow,
+        socketBufferSize: options.socketBufferSize,   // the UDP socket's buffers (utils.js)
         // 0-RTT with the saved session (below), off unless asked for.
         earlyData: options.earlyData === true
       };

package/src/connect_udp.js

@@ -53,7 +53,7 @@ import { EventEmitter } from 'node:events';
 import dgram from 'node:dgram';
 import dns from 'node:dns';
 import net from 'node:net';
-import { readVarInt, writeVarInt } from './utils.js';
+import { readVarInt, writeVarInt, checkedSocketBufferSize, udpSocketOptions } from './utils.js';
 
 var DEFAULT_TEMPLATE = '/.well-known/masque/udp/{target_host}/{target_port}/';
 var MIN_IDLE_MS = 120000;           // §3.1: "SHOULD NOT use a period lower than two minutes"
@@ -369,6 +369,9 @@ function createConnectUdp(options) {
     }
     var headers = opts.headers || null;
     if (opts.relay === false) { this._open(headers); return this; }
+    // The socket to the target, when this tunnel makes it (no opts.socket):
+    // its buffers (utils.js), 4 MB by default; socketBufferSize 0, the OS's.
+    var bufferSize = checkedSocketBufferSize(opts.socketBufferSize, 'accept({ socketBufferSize })');
 
     var allowPrivate = opts.allowPrivate != null ? !!opts.allowPrivate : allowPrivateDefault;
     var host = this.target.host;
@@ -390,7 +393,7 @@ function createConnectUdp(options) {
       if (opts.socket) self._useSocket(opts.socket, false, pick.address, headers);
       else {
         var sock;
-        try { sock = dgram.createSocket(family === 6 ? 'udp6' : 'udp4'); }
+        try { sock = dgram.createSocket(udpSocketOptions({ type: family === 6 ? 'udp6' : 'udp4' }, bufferSize)); }
         catch (e2) { self._refuse(502, proxyStatus('proxy_internal_error'), e2); return; }
         sock.once('error', function (e3) {
           if (self.state === 'pending') self._refuse(502, proxyStatus('destination_ip_unroutable', e3.code), e3);

package/src/connect_udp_client.js

@@ -395,6 +395,7 @@ function ProxyH3Connection(key, proxy, o, ech) {
     if (self.state !== 'connecting') return;
     self.udp = createQuicClientSocket({
       remoteIp: ip, remotePort: proxy.port, hostname: o.servername || proxy.hostname,
+      socketBufferSize: o.socketBufferSize,
       rejectUnauthorized: o.rejectUnauthorized !== false, ca: o.ca || null,
       key: o.key || null, cert: o.cert || null, passphrase: o.passphrase,
       quicVersions: o.quicVersions,
@@ -407,6 +408,15 @@ function ProxyH3Connection(key, proxy, o, ech) {
       // Each ticket the proxy sends: the agent's, and each tunnel's 'session'.
       onSocket: function (q) {
         self.quic = q;
+        // The connection is over the moment either side's CONNECTION_CLOSE is
+        // known ('closing'), not when its draining period (RFC 9000 §10.2,
+        // some 3 s) ends and 'close' comes: each tunnel on it is told at
+        // once, and the connection leaves the pool at once — a tunnel opened
+        // meanwhile joined a connection already closed, and failed. As the
+        // WebTransport client hears it (r69). Only once open: a handshake
+        // that ends is onError's to report — an ECH rejection is retried
+        // there with the server's new keys, not failed.
+        q.on('closing', function () { if (self.quic === q && self.state === 'open') self._gone(); });
         q.on('session', function (s) {
           self.sessions.keep(s);
           self.tunnels.forEach(function (t) { if (t.session) t.session(s); });

package/src/crypto.js

@@ -607,6 +607,12 @@ function decrypt_quic_packet(array, readKey, readIv, readHp, ownCid, largestPn,
   return {
     packet_number: packetNumber,
     key_phase: keyPhase,
+    // The first byte with header protection removed: its reserved bits are
+    // the caller's to check — only once the AEAD has passed the packet
+    // (RFC 9000 §17.2, §17.3.1), since before that anyone could set them.
+    first_byte: array[0],
+    // null: the AEAD refused the packet. An empty Uint8Array: it passed, and
+    // there was nothing in it — a different thing (RFC 9000 §12.4).
     plaintext: plaintext
   };
 }

package/src/h1_server.js

@@ -155,6 +155,8 @@ function createServer(options, handler) {
 
     socket.on('data', function (chunk) {
       if (destroyed) return;
+      // A request is arriving: not idle (closeIdleConnections, close()).
+      socket._quicoBusy = true;
 
       try {
         parser.execute(chunk);
@@ -231,6 +233,7 @@ function createServer(options, handler) {
     });
 
     parser.on('headers', function (info) {
+      socket._quicoBusy = true;
       clearTimer();
       setTimer(requestTimeout, 'request');
       served++;
@@ -359,6 +362,7 @@ function createServer(options, handler) {
         socket: socket
       });
       req.rawHeaders = info.rawHeaders;
+      req.upgrade = true;
       req._endData();
 
       // Hand the raw socket over, exactly as node:http does. `head` is the
@@ -452,7 +456,7 @@ function createServer(options, handler) {
         willClose = !keepAlive;
 
         if (keepAlive && info.httpVersion === '1.0') headers['keep-alive'] = 'timeout=5';
-        if (!('date' in headers)) headers['date'] = httpDate();
+        if (!('date' in headers) && res.sendDate !== false) headers['date'] = httpDate();
         // A function when the server was built before its port was known —
         // the unified server builds its layers at creation and learns the
         // port from listen(), or from options.port when fed from outside.
@@ -484,6 +488,13 @@ function createServer(options, handler) {
         if (typeof callback === 'function') process.nextTick(callback);
       };
 
+      // 102 Processing (node:http's writeProcessing): an interim response,
+      // as Early Hints are.
+      res.writeProcessing = function () {
+        if (res.headersSent || info.httpVersion === '1.0' || destroyed) return;
+        try { socket.write(buildResponseHead(102, null, {})); } catch (e) {}
+      };
+
       res._write = function (chunk, encoding, callback) {
         if (!res.headersSent) res._flushHeaders();
         if (typeof chunk === 'string') chunk = Buffer.from(chunk, encoding);
@@ -526,6 +537,7 @@ function createServer(options, handler) {
       function onResponseComplete() {
         clearTimer();
         current = null;
+        socket._quicoBusy = false;
         // Whatever of the body is still to come is dropped from here on (the
         // parser reads it, to find the next request): the reader no longer
         // holds the socket back.
@@ -573,7 +585,7 @@ function createServer(options, handler) {
       ca: options.ca,
       SNICallback: options.SNICallback
     });
-    tcpServer.register('http/1.1', handleConnection);
+    tcpServer.register('http/1.1', handleConnection, { managesClose: true });
     tcpServer.on('error', function (err) { ev.emit('error', err); });
     tcpServer.on('clientError', function (err, sock) { ev.emit('clientError', err, sock); });
     tcpServer.on('tlsClientError', function (err, sock) { ev.emit('tlsClientError', err, sock); });
@@ -584,17 +596,42 @@ function createServer(options, handler) {
     return server;
   }
 
-  function close(callback) {
+  // ---- Closing, as node:http ----
+  //
+  // Idle: a connection between requests (or before its first) — no request
+  // arriving, no response being written. Closing one costs nothing.
+  function closeIdleConnections() {
+    for (var s of connections) if (!s._quicoBusy) { try { s.destroy(); } catch (e) {} }
+  }
+  // All, mid-request too. Not the sockets handed to 'upgrade' (a WebSocket):
+  // those left this server at the upgrade, as in node:http.
+  function closeAllConnections() {
+    for (var s of connections) { try { s.destroy(); } catch (e) {} }
+  }
+  // No new connections, the idle ones closed; each busy one closes as its
+  // response completes (onResponseComplete). It used to end every socket at
+  // once: a response being written was cut off.
+  function beginClose() {
     closing = true;
-    if (!tcpServer) {
-      // Sockets we were handed rather than accepted: still ours to close.
-      for (var s of connections) { try { s.end(); } catch (e) {} }
-      if (callback) callback();
-      return;
-    }
+    closeIdleConnections();
+  }
+
+  function close(callback) {
+    beginClose();
+    if (!tcpServer) { if (callback) callback(); return; }
     tcpServer.close(callback);
   }
 
+  // node:http's timeouts and limits, changed while the server runs: from
+  // the next request (or connection) on.
+  function setLimits(o) {
+    if (o.headersTimeout !== undefined) headersTimeout = o.headersTimeout;
+    if (o.keepAliveTimeout !== undefined) keepAliveTimeout = o.keepAliveTimeout;
+    if (o.requestTimeout !== undefined) requestTimeout = o.requestTimeout;
+    if (o.maxHeaderCount !== undefined) maxHeaderCount = o.maxHeaderCount;
+    if (o.maxRequestsPerSocket !== undefined) maxRequests = maxRequestsPerSocket(o.maxRequestsPerSocket);
+  }
+
   function address() {
     return tcpServer && tcpServer.address ? tcpServer.address() : null;
   }
@@ -610,6 +647,11 @@ function createServer(options, handler) {
     emit: function () { ev.emit.apply(ev, arguments); return server; },
     listenerCount: function (n) { return ev.listenerCount(n); },
     setTimeout: function (ms) { headersTimeout = ms; return server; },
+    closeIdleConnections: closeIdleConnections,
+    closeAllConnections: closeAllConnections,
+    beginClose: beginClose,
+    setLimits: setLimits,
+    get connectionCount() { return connections.size; },
 
     /** Attach an already-connected Duplex, bypassing the listener. Lets the
      *  unified server share one TCP port, and makes the whole stack testable

package/src/h2_server.js

@@ -255,6 +255,20 @@ function createServer(options, handler) {
     });
 
     connections.add(socket);
+    socket._quicoH2 = {
+      idle: function () { return h2.activeStreams === 0; },
+      drain: function () {
+        if (destroyed || draining) return;
+        draining = true;
+        try { h2.sendGoaway(F.ERROR.NO_ERROR); } catch (e) {}
+        finishIfDone();
+      },
+      destroy: function () {
+        if (destroyed) return;
+        try { h2.sendGoaway(F.ERROR.NO_ERROR); } catch (e) {}
+        destroy(null, true);
+      }
+    };
 
     // `linger`: end the socket rather than destroy it — what was written last
     // (the GOAWAY saying why) leaves first — and destroy it if the peer has
@@ -340,8 +354,12 @@ function createServer(options, handler) {
     // only (HTTP/1.1 ends its socket with the client's, as node:http does).
     socket.allowHalfOpen = true;
     var peerEnded = false;
+    // Closing (server.close(), closeIdleConnections): GOAWAY sent — no new
+    // streams — and the connection ends with its last stream, as when the
+    // peer half-closes.
+    var draining = false;
     function finishIfDone() {
-      if (destroyed || !peerEnded || h2.activeStreams > 0) return;
+      if (destroyed || !(peerEnded || draining) || h2.activeStreams > 0) return;
       try { h2.sendGoaway(F.ERROR.NO_ERROR); } catch (e) {}
       destroy(null, true);
     }
@@ -375,7 +393,7 @@ function createServer(options, handler) {
       // a long-lived connection kept every WebSocket it ever carried).
       var st = streams[id];
       if (st && st.duplex) delete streams[id];
-      if (peerEnded) process.nextTick(finishIfDone);
+      if (peerEnded || draining) process.nextTick(finishIfDone);
     });
     // A response that waits for the client to open a window, from a client
     // that has half-closed: it sends nothing more — no WINDOW_UPDATE either —
@@ -435,6 +453,7 @@ function createServer(options, handler) {
           delete streams[streamId];
           return;
         }
+        creq.upgrade = true;
         ev.emit('upgrade', creq, stream, Buffer.alloc(0));
         return;
       }
@@ -686,7 +705,7 @@ function createServer(options, handler) {
 
         bodyAllowed = !statusHasNoBody(code) && req.method !== 'HEAD';
 
-        if (!('date' in headers)) headers['date'] = httpDate();
+        if (!('date' in headers) && res.sendDate !== false) headers['date'] = httpDate();
         // A function when the server was built before its port was known —
         // the unified server builds its layers at creation and learns the
         // port from listen(), or from options.port when fed from outside.
@@ -767,6 +786,12 @@ function createServer(options, handler) {
         if (typeof callback === 'function') process.nextTick(callback);
       };
 
+      // 102 Processing (node:http's writeProcessing), as Early Hints go.
+      res.writeProcessing = function () {
+        if (res.headersSent || res._aborted || destroyed) return;
+        try { h2.sendHeaders(streamId, buildResponsePseudoHeaders(102, {}), false); } catch (e) {}
+      };
+
       /**
        * The response's priority, as the server decides it: { urgency (0..7,
        * 0 first), incremental } — RFC 9218, as h3_server's. It replaces what
@@ -821,7 +846,7 @@ function createServer(options, handler) {
       ca: options.ca,
       SNICallback: options.SNICallback
     });
-    listener.register('h2', handleConnection);
+    listener.register('h2', handleConnection, { managesClose: true });
     listener.on('error', function (err) { ev.emit('error', err); });
     listener.on('clientError', function (err, sock) { ev.emit('clientError', err, sock); });
     listener.on('tlsClientError', function (err, sock) { ev.emit('tlsClientError', err, sock); });
@@ -832,16 +857,35 @@ function createServer(options, handler) {
     return server;
   }
 
-  function close(callback) {
+  // ---- Closing, as node:http (see h1_server) ----
+  // Idle: no stream open. Closed with GOAWAY first, so the client knows
+  // nothing it sent was lost.
+  function closeIdleConnections() {
+    for (var s of connections) if (s._quicoH2 && s._quicoH2.idle()) s._quicoH2.drain();
+  }
+  function closeAllConnections() {
+    for (var s of connections) if (s._quicoH2) s._quicoH2.destroy();
+  }
+  // GOAWAY on every connection: those idle end now, the others when their
+  // last stream does. It used to end every socket at once — responses in
+  // progress were cut off.
+  function beginClose() {
     closing = true;
-    if (!listener) {
-      for (var s of connections) { try { s.end(); } catch (e) {} }
-      if (callback) callback();
-      return;
-    }
+    for (var s of connections) if (s._quicoH2) s._quicoH2.drain();
+  }
+
+  function close(callback) {
+    beginClose();
+    if (!listener) { if (callback) callback(); return; }
     listener.close(callback);
   }
 
+  function setLimits(o) {
+    if (o.headersTimeout !== undefined) headersTimeout = o.headersTimeout;
+    if (o.requestTimeout !== undefined) requestTimeout = o.requestTimeout;
+    if (o.maxRequestsPerSocket !== undefined) maxRequests = maxRequestsPerSocket(o.maxRequestsPerSocket);
+  }
+
 
   var server = {
     listen: listen,
@@ -852,7 +896,12 @@ function createServer(options, handler) {
     once: function (n, f) { ev.once(n, f); return server; },
     off: function (n, f) { ev.off(n, f); return server; },
     emit: function () { ev.emit.apply(ev, arguments); return server; },
-    listenerCount: function (n) { return ev.listenerCount(n); }
+    listenerCount: function (n) { return ev.listenerCount(n); },
+    closeIdleConnections: closeIdleConnections,
+    closeAllConnections: closeAllConnections,
+    beginClose: beginClose,
+    setLimits: setLimits,
+    get connectionCount() { return connections.size; }
   };
 
   return server;