quico 0.7.0 → 0.9.0

package/src/h3.js

@@ -87,8 +87,12 @@ import {
 //  deliberately NOT part of this move.
 // ============================================================
 
+// One decoder for the module: decode() holds no state between calls (no
+// `stream` option), and constructing one per name and per value cost more
+// than the decoding itself.
+var _utf8Decoder = new TextDecoder();
 function _text(bytes) {
-  return new TextDecoder().decode(bytes);
+  return _utf8Decoder.decode(bytes);
 }
 
 // Every decodeStringLiteral() call below passes strict = true, enabling the
@@ -249,7 +253,10 @@ function parseQpackHeaderBlock(buf, dynamicTable, totalInserts, maxEntries, maxS
 
 
 // ============================================================
-//  H3 Frame build/parse
+//  H3 Frame build
+//
+//  Frames are read in place, from each stream's own buffer, as the bytes
+//  arrive: processBidiStream and processControlStream in H3Connection.
 // ============================================================
 
 function buildH3Frames(frames) {
@@ -262,43 +269,6 @@ function buildH3Frames(frames) {
   return concatUint8Arrays(parts);
 }
 
-function extractH3Frames(chunks, fromOffset) {
-  if (!chunks || chunks.length === 0) return { frames: [], new_from_offset: fromOffset };
-
-  var buffers = [];
-  var acc = 0;
-  for (var i = 0; i < chunks.length; i++) {
-    var nextAcc = acc + chunks[i].length;
-    if (fromOffset < nextAcc) {
-      buffers.push(chunks[i].slice(fromOffset - acc));
-      for (var j = i + 1; j < chunks.length; j++) buffers.push(chunks[j]);
-      break;
-    }
-    acc = nextAcc;
-  }
-
-  if (buffers.length === 0) return { frames: [], new_from_offset: fromOffset };
-
-  var combined = concatUint8Arrays(buffers);
-  var offset = 0, frames = [];
-
-  while (offset < combined.length) {
-    var start = offset;
-    var ft = readVarInt(combined, offset);
-    if (!ft) break;
-    offset += ft.byteLength;
-    var len = readVarInt(combined, offset);
-    if (!len) { offset = start; break; }
-    offset += len.byteLength;
-    if (offset + len.value > combined.length) { offset = start; break; }
-    frames.push({ frame_type: ft.value, payload: combined.slice(offset, offset + len.value) });
-    offset += len.value;
-  }
-
-  return { frames: frames, new_from_offset: fromOffset + offset };
-}
-
-
 // ============================================================
 //  H3 Settings
 // ============================================================
@@ -337,8 +307,17 @@ function parseSettingsPayload(buf) {
   var list = [];
   var seen = {};
   while (offset < buf.length) {
-    var id = readVarInt(buf, offset); if (!id) break; offset += id.byteLength;
-    var val = readVarInt(buf, offset); if (!val) break; offset += val.byteLength;
+    // A payload that ends inside an identifier or before its value is
+    // H3_FRAME_ERROR (RFC 9114 §7.1). It was cut short silently: the setting
+    // dropped, the connection on.
+    var id = readVarInt(buf, offset);
+    var val = id ? readVarInt(buf, offset + id.byteLength) : null;
+    if (!id || !val) {
+      var te = new Error('SETTINGS payload ends inside a setting (' + (buf.length - offset) + ' byte(s) left)');
+      te.h3ErrorCode = 0x0106;
+      throw te;
+    }
+    offset += id.byteLength + val.byteLength;
     // RFC 9114 §7.2.4: an identifier twice, or one of HTTP/2's that HTTP/3
     // reserves (0x02-0x05), is H3_SETTINGS_ERROR.
     if (seen[id.value] || (id.value >= 0x02 && id.value <= 0x05)) {
@@ -369,24 +348,14 @@ function parseSettingsPayload(buf) {
 //  QPACK Encoder Instructions (from peer's encoder stream)
 // ============================================================
 
-function parseQpackEncoderInstructions(chunks, fromOffset, maxLiteral) {
-  if (!chunks || chunks.length === 0) return { instructions: [], new_from_offset: fromOffset, need: 0 };
+// Parse the encoder-stream instructions in `combined` — the stream's unparsed
+// bytes, from its read position. Returns the complete instructions, how many
+// bytes they took (consumed), and, when the last one is cut short, how many
+// bytes it needs (need). It used to take the stream's chunks and an offset
+// and join them itself; the one caller already hands it a single buffer.
+function parseQpackEncoderInstructions(combined, maxLiteral) {
+  if (!combined || combined.length === 0) return { instructions: [], consumed: 0, need: 0 };
   if (maxLiteral === undefined) maxLiteral = Infinity;
-
-  var buffers = [];
-  var acc = 0;
-  for (var i = 0; i < chunks.length; i++) {
-    var nextAcc = acc + chunks[i].length;
-    if (fromOffset < nextAcc) {
-      buffers.push(chunks[i].slice(fromOffset - acc));
-      for (var j = i + 1; j < chunks.length; j++) buffers.push(chunks[j]);
-      break;
-    }
-    acc = nextAcc;
-  }
-  if (buffers.length === 0) return { instructions: [], new_from_offset: fromOffset, need: 0 };
-
-  var combined = buffers.length === 1 ? buffers[0] : concatUint8Arrays(buffers);
   var pos = 0;
   var instructions = [];
   // When the last instruction is cut short: how many bytes, from its start,
@@ -457,7 +426,7 @@ function parseQpackEncoderInstructions(chunks, fromOffset, maxLiteral) {
     }
   }
 
-  return { instructions: instructions, new_from_offset: fromOffset + pos,
+  return { instructions: instructions, consumed: pos,
            need: needAbs > pos ? needAbs - pos : 0 };
 }
 
@@ -686,6 +655,11 @@ function H3Connection(options) {
   var decoderStreamId = null;
   var qpackKnownReceived = 0;               // insertions the peer has acknowledged
   var qpackPendingAcks = 0;                 // insertions of THEIRS we owe an ack for
+  // Field sections we sent with a non-zero Required Insert Count, not yet
+  // acknowledged: stream id → [RIC, …] in the order sent (RFC 9204 §2.1.1).
+  // The decoder acknowledges each (Section Acknowledgment), or cancels the
+  // stream's; an acknowledgment for none is an error (§4.4.1).
+  var qpackUnacked = new Map();
 
   // ---- SETTINGS remembered for 0-RTT (RFC 9114 §7.2.4.2) ----
   //
@@ -784,9 +758,10 @@ function H3Connection(options) {
    * reference — and until an entry is below it, we send a literal instead.
    * That single number is what makes this encoder non-blocking.
    *
-   * Section acknowledgements and stream cancellations are parsed and skipped:
-   * they drive eviction accounting in an encoder that references
-   * unacknowledged entries, which this one never does.
+   * Each instruction is held to what we actually sent (RFC 9204 §4.4): a
+   * Section Acknowledgment for a section we have outstanding on that stream,
+   * an Insert Count Increment of at least 1 that does not pass the entries we
+   * inserted. Anything else is QPACK_DECODER_STREAM_ERROR.
    */
   function processQpackDecoderStream(s) {
     if (s.buffered === 0) return;
@@ -795,14 +770,41 @@ function H3Connection(options) {
     var buf = Buffer.from(copyBytes(s, s.buffered));
 
     var r = qpackParseDecoderInstructions(buf, 0);
-    if (r.increments > 0) {
-      qpackKnownReceived += r.increments;
-      if (DEBUG) console.log('[h3] qpack acked ' + r.increments +
-                             ' (known=' + qpackKnownReceived + ')');
+    for (var k = 0; k < r.instructions.length; k++) {
+      var ins = r.instructions[k];
+      if (ins.type === 'section_ack') {
+        var pend = qpackUnacked.get(ins.value);
+        if (!pend || pend.length === 0) {
+          throw qpackDecoderStreamError('Section Acknowledgment for stream ' + ins.value +
+                                        ', which has no field section awaiting one');
+        }
+        var ric = pend.shift();
+        if (pend.length === 0) qpackUnacked.delete(ins.value);
+        // §4.4.1: the acknowledged section's entries are now known received.
+        if (ric > qpackKnownReceived) qpackKnownReceived = ric;
+      } else if (ins.type === 'stream_cancel') {
+        qpackUnacked.delete(ins.value);
+      } else {
+        // §4.4.3: zero, or past what was inserted, is an error.
+        if (ins.value === 0) throw qpackDecoderStreamError('Insert Count Increment of 0');
+        if (qpackKnownReceived + ins.value > encoderTable.insertCount) {
+          throw qpackDecoderStreamError('Insert Count Increment to ' + (qpackKnownReceived + ins.value) +
+                                        ', beyond the ' + encoderTable.insertCount + ' entries inserted');
+        }
+        qpackKnownReceived += ins.value;
+      }
     }
+    if (DEBUG && r.instructions.length) console.log('[h3] qpack decoder instructions ' + r.instructions.length +
+                                                    ' (known=' + qpackKnownReceived + ')');
     consumeBytes(s, r.consumed);
   }
 
+  function qpackDecoderStreamError(msg) {
+    var err = new Error('QPACK decoder stream: ' + msg);
+    err.h3ErrorCode = H3_ERR.QPACK_DECODER_STREAM_ERROR;
+    return err;
+  }
+
   function evictQpackTable(limit) {
     // Oldest first, until what remains fits. Sizes in BYTES: measuring by
     // string length, as this did, undercounts any non-ASCII header value and
@@ -887,7 +889,15 @@ function H3Connection(options) {
     if (context.control_streams_sent) return;
     context.control_streams_sent = true;
 
-    var settings = buildSettingsPayload(localSettings(context));
+    // A reserved identifier among them, of a random N (RFC 9114 §7.2.4.1,
+    // 0x1f·N + 0x21): peers must ignore it — sending one keeps them honest.
+    // Not part of localSettings: 0-RTT's context (settingsContext) holds the
+    // ones that mean something, and this one changes every connection.
+    var greaseId = 0x1f * Math.floor(Math.random() * 0x10000) + 0x21;
+    var settings = concatUint8Arrays([
+      buildSettingsPayload(localSettings(context)),
+      writeVarInt(greaseId), writeVarInt(Math.floor(Math.random() * 64))
+    ]);
 
     var controlFrame = buildH3Frames([{ frame_type: 0x04, payload: settings }]);
 
@@ -918,6 +928,11 @@ function H3Connection(options) {
   }
 
 
+  // Our control and QPACK streams (sendControlStreams).
+  function isOwnCriticalStream(sid) {
+    return sid === (context.isServer ? 3 : 2) || sid === encoderStreamId || sid === decoderStreamId;
+  }
+
   // ---- Graceful shutdown: GOAWAY (RFC 9114 §5.2) ----
 
   function sendGoaway(id) {
@@ -1195,6 +1210,15 @@ function H3Connection(options) {
   // a WT stream, so it can be routed to its session.
   listenQuic('stream_reset', function (streamId, code) {
     var sid = Number(streamId);
+    // The peer's control or QPACK stream, reset: closed, which RFC 9114
+    // §6.2.1 and RFC 9204 §4.2 make a connection error however it happens.
+    // Only a FIN was caught (processStream); a RESET_STREAM left the
+    // connection serving on without them.
+    var crit = context.streams[sid];
+    if (crit && (crit.type === 'control' || crit.type === 'qpack_enc' || crit.type === 'qpack_dec')) {
+      connectionError(H3_ERR.H3_CLOSED_CRITICAL_STREAM, 'the peer reset its ' + crit.type + ' stream');
+      return;
+    }
     var wt = _wtStreams[sid];
     var wasParsing = sid in context.streams;
     // A client's request stream reset before its HEADERS came: there is no
@@ -1219,6 +1243,13 @@ function H3Connection(options) {
   // whole cancellation.
   listenQuic('stop_sending', function (streamId, code) {
     var sid = Number(streamId);
+    // Asked to stop one of OUR critical streams: QUIC has answered with
+    // RESET_STREAM, so it is closed — the same connection error (§6.2.1:
+    // "A receiver MUST NOT request that the sender close the control stream").
+    if (context.control_streams_sent && isOwnCriticalStream(sid)) {
+      connectionError(H3_ERR.H3_CLOSED_CRITICAL_STREAM, 'the peer stopped our ' + (sid === encoderStreamId ? 'QPACK encoder' : sid === decoderStreamId ? 'QPACK decoder' : 'control') + ' stream');
+      return;
+    }
     if (_abortedHere.has(sid)) return;
     ev.emit('stop_sending', sid, code);
   });
@@ -1700,7 +1731,7 @@ function H3Connection(options) {
       // Only the unparsed bytes are copied (once per completed instruction,
       // given `need`), and no literal larger than our table can hold is
       // waited for.
-      ext = parseQpackEncoderInstructions([copyBytes(s, s.buffered)], 0,
+      ext = parseQpackEncoderInstructions(copyBytes(s, s.buffered),
                                           context.local_qpack_max_table_capacity);
     } catch (err) {
       // RFC 9204 §4.2: a malformed encoder stream is QPACK_ENCODER_STREAM_ERROR,
@@ -1708,7 +1739,7 @@ function H3Connection(options) {
       err.h3ErrorCode = H3_ERR.QPACK_ENCODER_STREAM_ERROR;
       throw err;
     }
-    consumeBytes(s, ext.new_from_offset);
+    consumeBytes(s, ext.consumed);
     s.need = ext.need;
     if (ext.instructions.length === 0) return;
 
@@ -2000,6 +2031,11 @@ function H3Connection(options) {
       if (avail < headLen + len.value) break;
       // Waits for the encoder stream when it must (see sectionBlocked): the
       // frame stays in the buffer, read again once unblocked.
+      // Already waiting, and the inserts it needs are not here yet: nothing
+      // to do. The frame was copied and its prefix decoded again on every
+      // packet that arrived on the stream meanwhile.
+      if (_blocked.has(Number(streamId)) &&
+          _blocked.get(Number(streamId)) > context.remote_qpack_table_base_index) return;
       var whole = copyBytes(s, headLen + len.value);
       var payload = whole.subarray(headLen);
       if (sectionBlocked(Number(streamId), payload)) return;
@@ -2138,7 +2174,11 @@ function H3Connection(options) {
     var list = [];
     for (var hname in headers) {
       if (Object.prototype.hasOwnProperty.call(headers, hname)) {
-        list.push([hname, headers[hname]]);
+        // A list: one field line per value (Set-Cookie above all, which may
+        // not be combined), not String(list).
+        var hv = headers[hname];
+        if (Array.isArray(hv)) { for (var hi = 0; hi < hv.length; hi++) list.push([hname, String(hv[hi])]); }
+        else list.push([hname, hv]);
       }
     }
     var enc = qpackEncodeHeaderBlock(list, encoderTable, {
@@ -2155,6 +2195,11 @@ function H3Connection(options) {
     // Insertions FIRST, on their own stream: they are for the next request,
     // not this one.
     flushQpackInserts(enc.inserts);
+    if (enc.requiredInsertCount > 0) {
+      var pend = qpackUnacked.get(streamId);
+      if (pend) pend.push(enc.requiredInsertCount);
+      else qpackUnacked.set(streamId, [enc.requiredInsertCount]);
+    }
 
     var frame = buildH3Frames([{ frame_type: 1, payload: new Uint8Array(enc.block) }]);
     if (DEBUG) console.log('[h3] sendHeaders stream=' + streamId + ' len=' + frame.byteLength + ' fin=' + !!fin);

package/src/h3_client.js

@@ -248,6 +248,7 @@ function request(options, callback) {
     udpSocket = createQuicClientSocket({
       remoteIp: remoteIp,
       remotePort: remotePort,
+      socketBufferSize: options.socketBufferSize,
       // SNI and the name the certificate is checked for: tls.connect's
       // servername where given.
       hostname: options.servername || hostname,
@@ -476,7 +477,11 @@ function request(options, callback) {
         return e;
       });
     });
-    conn.quic.on('close', function () {
+    // On 'closing' — the moment the connection is over (a CONNECTION_CLOSE
+    // either way, the idle timeout) — not only on 'close', which waits out
+    // the draining period (RFC 9000 §10.2, ~3 s): a response the server cut
+    // off hung that long before it failed.
+    function connectionOver() {
       failAll(0, function (sid) {
         var e = new Error('HTTP/3 connection closed before the response ended');
         e.code = 'ERR_HTTP3_CONNECTION_CLOSED';
@@ -484,7 +489,9 @@ function request(options, callback) {
         e.retryable = sid >= conn._goawayId;
         return e;
       });
-    });
+    }
+    conn.quic.on('closing', connectionOver);
+    conn.quic.on('close', connectionOver);
   }
 
 
@@ -662,17 +669,28 @@ function request(options, callback) {
     else if (reqBody.length) startStreaming();
   }
 
-  function requestHeaders() {
+  // contentLength: the body's size when it is known whole (ended before it
+  // went) — sent as h2_client and node:https send it, and as browsers do. A
+  // server that decides whether there is a body from the headers (Express's
+  // body-parser: content-length or transfer-encoding) saw none over HTTP/3,
+  // and req.body came out empty.
+  function requestHeaders(contentLength) {
     var h3Headers = {
       ':method': method,
       ':scheme': 'https',
       ':authority': hostname + (port !== 443 ? ':' + port : ''),
       ':path': path
     };
-    for (var name in headers) h3Headers[name.toLowerCase()] = String(headers[name]);
+    // A repeated field (an array) stays one line per value: String(list)
+    // made two cookies "a=1,b=2", which the server reads as one cookie.
+    for (var name in headers) {
+      var v = headers[name];
+      h3Headers[name.toLowerCase()] = Array.isArray(v) ? v.map(String) : String(v);
+    }
     if (!h3Headers['user-agent']) h3Headers['user-agent'] = 'quico/1.0';
     if (!h3Headers['accept']) h3Headers['accept'] = '*/*';
     if (!h3Headers['accept-encoding']) h3Headers['accept-encoding'] = 'identity';
+    if (contentLength != null && h3Headers['content-length'] === undefined) h3Headers['content-length'] = String(contentLength);
     return h3Headers;
   }
 
@@ -687,7 +705,9 @@ function request(options, callback) {
     // Early: kept, to go again if the server refuses it.
     if (earlyTried && !handshaken) earlyBody = { body: body.slice(), trailers: reqTrailers };
     if (body.length === 0 && !reqTrailers) { h3.sendHeaders(streamId, requestHeaders(), true); return; }
-    h3.sendHeaders(streamId, requestHeaders(), false);
+    var bodyLength = 0;
+    for (var bi = 0; bi < body.length; bi++) bodyLength += body[bi].byteLength;
+    h3.sendHeaders(streamId, requestHeaders(body.length ? bodyLength : null), false);
     for (var i = 0; i < body.length; i++) h3.sendBody(streamId, body[i], i === body.length - 1 && !reqTrailers);
     if (reqTrailers) h3.sendHeaders(streamId, reqTrailers, true);
   }

package/src/h3_server.js

@@ -28,7 +28,8 @@ import { createQuicServer } from './quic_server.js';
 import { pickTlsOptions } from './tls_options.js';
 import { _makeSocketStub } from './streams.js';
 import { H3Connection, H3_ERR, wtCloseCapsule, wtDrainCapsule, createCapsuleReader, h3SettingsContext } from './h3.js';
-import { createWtStream, openWtStream, createSendGroup, wtScheduling, createDatagrams, sessionStats } from './wt_stream.js';
+import { createWtStream, openWtStream, createSendGroup, wtScheduling, createDatagrams, sessionStats,
+         exporterArgs, exportSessionKeyingMaterial } from './wt_stream.js';
 import { contextZero, datagramCapsule, STREAM_QUEUE_MAX } from './connect_udp.js';
 
 
@@ -132,6 +133,7 @@ function createServer(options, handler) {
     ech: options.ech || null,
     ocspRequest: options.ocspRequest || null,
     resetTokenSecret: options.resetTokenSecret || null,
+    tokenSecret: options.tokenSecret || null,
     validateAddress: options.validateAddress === true,
     handshakeLoadThreshold: options.handshakeLoadThreshold,
     earlyData: options.earlyData, earlyDataMaxAge: options.earlyDataMaxAge, earlyDataReplay: options.earlyDataReplay,
@@ -151,6 +153,7 @@ function createServer(options, handler) {
     maxUdpPayloadSize: options.maxUdpPayloadSize,
     initialRtt: options.initialRtt,
     reorderWindow: options.reorderWindow,
+    socketBufferSize: options.socketBufferSize,
     connectionOptions: options.connectionOptions,
     quicVersions: options.quicVersions,
     socket: options.socket || null,
@@ -607,10 +610,15 @@ function createServer(options, handler) {
         // writeHead, when the status is known.
         _bodyAllowed: true,
 
+        // A list is kept a list, and goes as one field line per value, as
+        // HTTP/1.1 and HTTP/2 send it here and as Node's http does. It was
+        // String(list): two cookies became one "a=1,b=2", which a browser
+        // reads as a single cookie a with the value "1,b=2" (Set-Cookie
+        // never combines, RFC 9110 §5.3).
         setHeader: function (name, value) {
           validateHeaderName(name);
           validateHeaderValue(name, value);
-          res.headers[name.toLowerCase()] = String(value);
+          res.headers[name.toLowerCase()] = Array.isArray(value) ? value.map(String) : String(value);
         },
 
         getHeader: function (name) {
@@ -640,7 +648,7 @@ function createServer(options, handler) {
           }
           // Date (RFC 9110 §6.6.1), as HTTP/2 and HTTP/1.1 send it — HTTP/3's
           // responses had none.
-          if (!('date' in h3Headers) && statusCode >= 200) h3Headers['date'] = httpDate();
+          if (!('date' in h3Headers) && statusCode >= 200 && !(res._wrapper && res._wrapper.sendDate === false)) h3Headers['date'] = httpDate();
 
           if (conn.h3) {
             // Send headers WITHOUT FIN for WT (session stays open)
@@ -703,6 +711,12 @@ function createServer(options, handler) {
           if (typeof callback === 'function') process.nextTick(callback);
         },
 
+        // 102 Processing (node:http's writeProcessing): as Early Hints go.
+        writeProcessing: function () {
+          if (res.headersSent || res._finished || !conn.h3) return;
+          try { conn.h3.sendHeaders(streamId, { ':status': '102' }, false); } catch (e) { /* stream gone */ }
+        },
+
         write: function (chunk) {
           if (!res.headersSent) res.writeHead(res.statusCode);
           if (!res._bodyAllowed) return true;
@@ -868,6 +882,17 @@ function createServer(options, handler) {
         // datagram's.
         createSendGroup: function () { return createSendGroup(); },
 
+        // The browser's exportKeyingMaterial, as the client's: this session's
+        // keying material from the TLS exporter — the same bytes the client
+        // gets for the same label and context.
+        exportKeyingMaterial: function (label, context, outputLength) {
+          var a;
+          try { a = exporterArgs(arguments); } catch (e) { return Promise.reject(e); }
+          if (!req._isWebTransport || req._wtClosed) return Promise.reject(new DOMException('the session is closed', 'InvalidStateError'));
+          try { return Promise.resolve(exportSessionKeyingMaterial(conn.quic, Number(streamId), a)); }
+          catch (e) { return Promise.reject(e); }
+        },
+
         // A stream of ours: a Duplex, or a Writable — recorded with its
         // session, so the session's end destroys it. options { sendOrder,
         // sendGroup, waitUntilAvailable }, the browser's (wt_stream's
@@ -929,6 +954,13 @@ function createServer(options, handler) {
         for (var name in params.request_headers) {
           stream.req.headers[name] = params.request_headers[name];
         }
+        // The field lines as they came (validateFieldSection), which the
+        // copy above leaves behind — not enumerable: req.rawHeaders and
+        // headersDistinct are built from them. Without it they were rebuilt
+        // from the joined values, two x-a lines one "1, 2".
+        if (params.request_headers._rawHeaders && !stream.req.headers._rawHeaders) {
+          Object.defineProperty(stream.req.headers, '_rawHeaders', { value: params.request_headers._rawHeaders, enumerable: false });
+        }
 
         // Extract :method and :path
         if (stream.req.method === null && ':method' in stream.req.headers) {
@@ -1023,6 +1055,7 @@ function createServer(options, handler) {
           releaseHttpStream(conn, streamId, false);
           return;
         }
+        stream.req.upgrade = true;
         ev.emit('upgrade', stream.req, duplex, Buffer.alloc(0));
         return;
       }
@@ -1188,6 +1221,10 @@ function createServer(options, handler) {
     return sock;
   }
 
+  // Every connection, for closing them (closeIdleConnections, close()).
+  var conns = new Set();
+  var closingServer = null;     // close()'s callback, once every connection is gone
+
   qserver.on('connection', function (quic, peer) {
     var conn = { quic: quic, h3: null, http_streams: {}, _wtStreamObjects: {}, served: 0,
                  headerDeadlines: {},   // request streams whose HEADERS is still arriving
@@ -1208,7 +1245,12 @@ function createServer(options, handler) {
     // 'aborted' on the request and 'close' on the response, a tunnel
     // destroyed, a session closed with its streams. Requests that had
     // finished in both directions are already gone (releaseIfDone).
+    conns.add(conn);
+    // Over for the application ('closing'), or its draining done ('close').
+    var gone = function () { if (conns.delete(conn)) connGone(); };
+    quic.on('closing', gone);
     quic.on('close', function () {
+      gone();
       for (var hid in conn.headerDeadlines) clearHeadersDeadline(conn, hid);
       for (var sid in conn.http_streams) releaseHttpStream(conn, sid, true);
       for (var wid in conn._wtStreamObjects) releaseHttpStream(conn, wid, true);
@@ -1615,9 +1657,63 @@ function createServer(options, handler) {
   //  server. This layer adds HTTP/3 request events on top.
   // ============================================================
 
+  // ---- Closing, as node:http (see h1_server) ----
+  //
+  // Idle: no request open on it — before its handshake too, as node:http
+  // counts a connection that has not sent a request. GOAWAY, and closed at
+  // once (closeAfterGoaway: nothing to wait for); before the handshake,
+  // refused (goaway() does that).
+  function isIdle(conn) { return Object.keys(conn.http_streams).length === 0; }
+  // GOAWAY and CONNECTION_CLOSE together (§5.2 allows closing at once when
+  // nothing is in flight): waiting for the GOAWAY's acknowledgement, a
+  // client that had gone held the close until its idle timeout.
+  function closeIdle(conn) {
+    if (!conn.handle) return;
+    conn.handle.goaway();
+    conn.handle.destroy();
+  }
+  function closeIdleConnections() {
+    for (var conn of conns) if (isIdle(conn)) closeIdle(conn);
+  }
+  function closeAllConnections() {
+    for (var conn of conns) if (conn.handle) conn.handle.destroy();
+  }
+  // No new connections; GOAWAY on each — the requests in flight finish, then
+  // the connection closes (closeAfterGoaway) — and once none is left, the
+  // UDP sockets. It closed every connection on the spot: a response being
+  // sent was cut off, and its client waited for the rest until a timeout.
+  function close(callback) {
+    qserver.stopAccepting();
+    closingServer = typeof callback === 'function' ? callback : function () {};
+    for (var conn of conns) {
+      if (isIdle(conn)) closeIdle(conn);
+      else if (conn.handle) conn.handle.goaway();
+    }
+    connGone();
+  }
+  function connGone() {
+    if (!closingServer || conns.size > 0) return;
+    var cb = closingServer;
+    closingServer = null;
+    qserver.close(cb);
+  }
+  function setLimits(o) {
+    if (o.headersTimeout !== undefined) headersTimeout = o.headersTimeout;
+    if (o.requestTimeout !== undefined) requestTimeout = o.requestTimeout;
+    if (o.maxRequestsPerSocket !== undefined) maxRequests = maxRequestsPerSocket(o.maxRequestsPerSocket);
+  }
+
   return {
-    listen: qserver.listen,
-    close: qserver.close,
+    listen: function (p, h, cb) { closingServer = null; return qserver.listen(p, h, cb); },
+    // The UDP socket's address — after listen(0), the port the OS gave.
+    address: function () { return qserver.address(); },
+    close: close,
+    closeIdleConnections: closeIdleConnections,
+    closeAllConnections: closeAllConnections,
+    setLimits: setLimits,
+    get connectionCount() { return conns.size; },
+    ref: qserver.ref,
+    unref: qserver.unref,
     on: function (name, fn) { if (name === 'upgrade') upgradeListeners++; ev.on(name, fn); },
     setTimeout: function () { /* TODO */ },
 
@@ -1639,7 +1735,9 @@ function createServer(options, handler) {
     getOptions: qserver.getOptions,
     setOptions: qserver.setOptions,
     getResetTokenSecret: qserver.getResetTokenSecret,
-    setResetTokenSecret: qserver.setResetTokenSecret
+    setResetTokenSecret: qserver.setResetTokenSecret,
+    getTokenSecret: qserver.getTokenSecret,
+    setTokenSecret: qserver.setTokenSecret
   };
 }