quico 0.7.0 → 0.9.0

package/src/streams.js

@@ -59,17 +59,38 @@ class IncomingMessage extends Readable {
     // QUIC has no TCP socket — stub so libraries don't crash
     this.socket = options.socket || _makeSocketStub();
     this.connection = this.socket;
+    this.client = this.socket;      // node:http's older alias
+    // node:http's: true on a request handed to 'upgrade' (an HTTP/1.1
+    // Upgrade, an extended CONNECT over HTTP/2 and HTTP/3).
+    this.upgrade = false;
 
     // H3 stream id (internal)
     this._streamId = options.streamId != null ? options.streamId : null;
     this._timeoutTimer = null;
 
-    // Build rawHeaders
-    for (var name in this.headers) {
-      this.rawHeaders.push(name, String(this.headers[name]));
+    // Build rawHeaders: one name and value per field line, as node:http has
+    // them — the field lines as they came when the decoder kept them
+    // (validateFieldSection's _rawHeaders); otherwise from the map, a list
+    // (Set-Cookie) one entry per value. String(list) made two cookies one
+    // "a=1,b=2".
+    var rawList = this.headers._rawHeaders;
+    if (Array.isArray(rawList)) {
+      for (var ri = 0; ri < rawList.length; ri++) this.rawHeaders.push(rawList[ri]);
+    } else {
+      for (var name in this.headers) {
+        var hv = this.headers[name];
+        if (Array.isArray(hv)) { for (var hi = 0; hi < hv.length; hi++) this.rawHeaders.push(name, String(hv[hi])); }
+        else this.rawHeaders.push(name, String(hv));
+      }
     }
   }
 
+  // node:http's headersDistinct / trailersDistinct: each name (lower case)
+  // with every value it came with, as an array, nothing joined — from the
+  // field lines as they arrived (rawHeaders, rawTrailers).
+  get headersDistinct() { return distinctFields(this.rawHeaders); }
+  get trailersDistinct() { return distinctFields(this.rawTrailers); }
+
   // Readable requires _read — data is pushed externally, so no-op.
   _read(_size) { /* no-op */ }
 
@@ -184,6 +205,11 @@ class ServerResponse extends Writable {
     this.finished = false;
     this._headers = {};
     this._headerNames = {};  // lowercase → original-case
+    // node:http's: a Date header unless false (RFC 9110 §6.6.1); and, when
+    // true, a body that does not match its Content-Length throws.
+    this.sendDate = true;
+    this.strictContentLength = false;
+    this._bodyBytes = 0;
 
     // H3 references (set by server when creating the response)
     this._streamId = options.streamId != null ? options.streamId : null;
@@ -210,6 +236,9 @@ class ServerResponse extends Writable {
     this.getHeaderNames = this.getHeaderNames.bind(this);
     this.hasHeader = this.hasHeader.bind(this);
     this.removeHeader = this.removeHeader.bind(this);
+    this.appendHeader = this.appendHeader.bind(this);
+    this.setHeaders = this.setHeaders.bind(this);
+    this.getRawHeaderNames = this.getRawHeaderNames.bind(this);
     this.writeHead = this.writeHead.bind(this);
     this.flushHeaders = this.flushHeaders.bind(this);
     this._flushHeaders = this._flushHeaders.bind(this);
@@ -270,8 +299,10 @@ class ServerResponse extends Writable {
     return this._headers[name.toLowerCase()];
   }
 
+  // An object with no prototype, as node:http's: a header named
+  // "constructor" or "__proto__" is a header, not a property it inherits.
   getHeaders() {
-    var out = {};
+    var out = Object.create(null);
     for (var k in this._headers) out[k] = this._headers[k];
     return out;
   }
@@ -280,6 +311,38 @@ class ServerResponse extends Writable {
     return Object.keys(this._headers);
   }
 
+  // node:http's: the names as they were set, in their case.
+  getRawHeaderNames() {
+    var out = [];
+    for (var k in this._headers) out.push(this._headerNames[k] || k);
+    return out;
+  }
+
+  // node:http's: a value added to a header's (both kept), not in its place.
+  appendHeader(name, value) {
+    if (this.headersSent) throw headersSentError('append', this.req && this.req.httpVersion);
+    return this._appendHeader(name, value);
+  }
+
+  // node:http's: several at once, from a Headers or a Map — each replacing
+  // that name's value (Set-Cookie: every one of a Headers' cookies).
+  setHeaders(headers) {
+    if (this.headersSent) throw headersSentError('set', this.req && this.req.httpVersion);
+    var isHeaders = typeof Headers !== 'undefined' && headers instanceof Headers;
+    if (!isHeaders && !(headers instanceof Map)) {
+      var e = new TypeError('The "headers" argument must be an instance of Headers or Map');
+      e.code = 'ERR_INVALID_ARG_TYPE';
+      throw e;
+    }
+    var self = this, cookies = null;
+    headers.forEach(function (value, name) {
+      if (isHeaders && String(name).toLowerCase() === 'set-cookie') { cookies = headers.getSetCookie(); return; }
+      self.setHeader(name, value);
+    });
+    if (cookies) this.setHeader('set-cookie', cookies);
+    return this;
+  }
+
   hasHeader(name) {
     return name.toLowerCase() in this._headers;
   }
@@ -292,6 +355,16 @@ class ServerResponse extends Writable {
     return this;
   }
 
+  // A value added to what a name has (kept as a list), not in its place.
+  _appendHeader(name, value) {
+    var lower = String(name).toLowerCase();
+    if (!(lower in this._headers)) return this.setHeader(name, value);
+    validateHeaderName(name);
+    validateHeaderValue(name, value);
+    this._headers[lower] = [].concat(this._headers[lower], value);
+    return this;
+  }
+
   /**
    * node:http's res.addTrailers(headers): fields sent after the body — an
    * object, or an array of [name, value] pairs. Over HTTP/1.1 they go in the
@@ -325,7 +398,22 @@ class ServerResponse extends Writable {
     this.statusCode = statusCode;
     if (statusMessage !== undefined) this.statusMessage = String(statusMessage);
 
-    if (typeof headers === 'object' && headers !== null) {
+    // node:http's three forms: an object; a flat array [name, value, name,
+    // value]; an array of [name, value] pairs. The arrays may repeat a name
+    // and every value is kept (two Set-Cookie lines). An array went through
+    // for…in: headers named "0", "1", … — over HTTP/3 the response failed.
+    if (Array.isArray(headers)) {
+      var tuples = headers.length > 0 && Array.isArray(headers[0]);
+      if (!tuples && headers.length % 2 !== 0) {
+        var bad = new TypeError('The argument \'headers\' is invalid: an array of names and values must have an even length');
+        bad.code = 'ERR_INVALID_ARG_VALUE';
+        throw bad;
+      }
+      for (var i = 0; i < headers.length; i += tuples ? 1 : 2) {
+        var hn = tuples ? headers[i][0] : headers[i], hv = tuples ? headers[i][1] : headers[i + 1];
+        if (hn) this._appendHeader(hn, hv);
+      }
+    } else if (typeof headers === 'object' && headers !== null) {
       for (var name in headers) this.setHeader(name, headers[name]);
     }
 
@@ -372,12 +460,38 @@ class ServerResponse extends Writable {
   write(chunk, encoding, callback) {
     if (typeof encoding === 'function') { callback = encoding; encoding = undefined; }
     this._wrote = true;
+    this._countBody(chunk, encoding, false);
     return super.write(chunk, encoding, callback);
   }
 
+  // strictContentLength (node:http's): the body may not go past its
+  // Content-Length, nor end short of it — ERR_HTTP_CONTENT_LENGTH_MISMATCH,
+  // thrown from the write() or end() that shows it.
+  // Counted only once checked: a write that threw sent nothing.
+  _countBody(chunk, encoding, ending) {
+    var total = this._bodyBytes;
+    if (chunk != null && !this.writableEnded) {
+      total += typeof chunk === 'string' ? Buffer.byteLength(chunk, encoding) : (chunk.byteLength || 0);
+    }
+    var declared = this.strictContentLength ? this.getHeader('content-length') : undefined;
+    if (declared !== undefined && !Array.isArray(declared) && !(this.req && this.req.method === 'HEAD') && Number(declared) >= 0) {
+      declared = Number(declared);
+      if (total > declared || (ending && total !== declared)) {
+        var e = new Error('Response body\'s content-length of ' + total + ' byte(s) does not match the content-length of ' + declared + ' byte(s) set in header');
+        e.code = 'ERR_HTTP_CONTENT_LENGTH_MISMATCH';
+        throw e;
+      }
+    }
+    this._bodyBytes = total;
+  }
+
   end(data, encoding, callback) {
     if (typeof data === 'function') { callback = data; data = undefined; encoding = undefined; }
     if (typeof encoding === 'function') { callback = encoding; encoding = undefined; }
+    if (!this.writableEnded) {
+      if (data != null) this._countBody(data, encoding, true);
+      else this._countBody(null, null, true);
+    }
     // The whole body, when nothing was written before it and the head has
     // not gone: its length, for HTTP/1.1 to send as Content-Length rather
     // than chunk it (node:http's end() does the same). HTTP/2 and HTTP/3
@@ -388,8 +502,22 @@ class ServerResponse extends Writable {
         : data.byteLength;
       if (typeof len === 'number') this._endLength = len;   // else write() rejects it
     }
-    if (data != null) this.write(data, encoding);
-    return super.end(callback);
+    if (data != null) this._writeCounted(data, encoding);
+    // The callback runs at 'finish', after the listeners already on it — as
+    // node:http's end(cb), a once('finish'). Given to Writable's end() it
+    // ran before them.
+    if (typeof callback === 'function') {
+      if (this.writableFinished) process.nextTick(callback);
+      else this.once('finish', callback);
+    }
+    super.end();
+    return this;
+  }
+
+  // The last write, its bytes already counted by end().
+  _writeCounted(data, encoding) {
+    this._wrote = true;
+    return super.write(data, encoding);
   }
 
   writeContinue() { /* HTTP/3 doesn't use 100-continue — stub */ }
@@ -405,6 +533,12 @@ class ServerResponse extends Writable {
     if (typeof callback === 'function') process.nextTick(callback);
   }
 
+  /**
+   * 102 Processing — node:http's response.writeProcessing(). Replaced by the
+   * layer that made the response, as writeEarlyHints is; here, nothing.
+   */
+  writeProcessing() {}
+
   /**
    * The response's priority, { urgency, incremental } (RFC 9218). HTTP/2 and
    * HTTP/3 replace this with the real thing (h2_server, h3_server); over
@@ -593,6 +727,21 @@ class ClientRequest extends Writable {
     if (Buffer.isBuffer(chunk)) {
       chunk = new Uint8Array(chunk.buffer, chunk.byteOffset, chunk.byteLength);
     }
+    if (this._sink && this._wholeBody) {
+      // end(data) with nothing written before it: the body whole, handed to
+      // the transport as its end — sent with a content-length, as node:http
+      // sends end(data). Written, then ended, a transport already able to
+      // send had begun streaming on the write: no length, and a server that
+      // goes by the headers (Express's body-parser) saw no body. It happened
+      // whenever the connection was ready at once — a pooled one.
+      this._wholeBody = false;
+      this._sinkEnded = true;
+      this._remember(chunk);
+      this._sink.end(chunk, this._trailers);
+      callback();
+      return;
+    }
+    this._wholeBody = false;
     if (this._sink) { this._toSink(chunk, callback); return; }
     // No transport yet (still connecting): held — and the writer told to wait
     // past the high-water mark, as a socket not yet connected would.
@@ -604,7 +753,7 @@ class ClientRequest extends Writable {
 
   _final(callback) {
     this.finished = true;
-    if (this._sink) this._sink.end(null, this._trailers);
+    if (this._sink && !this._sinkEnded) { this._sinkEnded = true; this._sink.end(null, this._trailers); }
     callback();
   }
 
@@ -647,12 +796,21 @@ class ClientRequest extends Writable {
     });
     var held = this._bodyChunks, more = true;
     this._bodyChunks = []; this._bodyBuffered = 0;
+    this._sinkEnded = false;
+    if (this.finished) {
+      // Ended before a transport took it: the body is known whole — one
+      // end(), so it goes with its length rather than streamed.
+      for (var j = 0; j < held.length; j++) this._remember(held[j]);
+      var whole = held.length === 0 ? null : held.length === 1 ? held[0] : Buffer.concat(held);
+      this._sinkEnded = true;
+      sink.end(whole, this._trailers);
+      return;
+    }
     for (var i = 0; i < held.length; i++) { this._remember(held[i]); more = sink.write(held[i]); }
     if (this._pendingWriteCb) {
       var cb = this._pendingWriteCb; this._pendingWriteCb = null;
       if (more) cb(); else this._sinkWaitCb = cb;
     }
-    if (this.finished) sink.end(null, this._trailers);
   }
 
   // The transport failed before the server processed the request: the body
@@ -684,13 +842,18 @@ class ClientRequest extends Writable {
 
   write(chunk, encoding, callback) {
     if (typeof encoding === 'function') { callback = encoding; encoding = undefined; }
+    this._wroteBody = true;
     return super.write(chunk, encoding, callback);
   }
 
   end(data, encoding, callback) {
     if (typeof data === 'function') { callback = data; data = undefined; encoding = undefined; }
     if (typeof encoding === 'function') { callback = encoding; encoding = undefined; }
-    if (data != null) this.write(data, encoding);
+    if (data != null) {
+      // Nothing written before: this chunk is the body whole (_write).
+      this._wholeBody = !this._wroteBody && !this.writableEnded;
+      this.write(data, encoding);
+    }
     return super.end(callback);
   }
 
@@ -778,6 +941,16 @@ function reparent(obj, Base) {
   Object.setPrototypeOf(obj, top);
 }
 
+// rawHeaders' pairs as node:http's headersDistinct: name → [values].
+function distinctFields(raw) {
+  var out = {};
+  for (var i = 0; raw && i + 1 < raw.length; i += 2) {
+    var n = String(raw[i]).toLowerCase();
+    (out[n] || (out[n] = [])).push(String(raw[i + 1]));
+  }
+  return out;
+}
+
 function _makeSocketStub() {
   var sock = new Duplex({
     read(_size) { /* no-op — no data from QUIC socket */ },

package/src/tcp_listener.js

@@ -67,6 +67,7 @@ function createTcpListener(options) {
   var order = [];           // registration order = ALPN preference order
   var sockets = new Set();
   var closing = false;
+  var refed = true;
 
   var tls = options.tls || null;
   var cachedContext = null;
@@ -134,6 +135,7 @@ function createTcpListener(options) {
     if (stats) stats.protocol(protocol);
 
     sockets.add(socket);
+    socket._quicoProtocol = protocol;
     socket.on('close', function () { sockets.delete(socket); });
     if (handlerOpts[protocol] && handlerOpts[protocol].paused) socket.pause();
     handler(socket, protocol);
@@ -501,6 +503,7 @@ function createTcpListener(options) {
     if (order.length === 0) throw new Error('no protocol handlers registered');
 
     server = net.createServer({ allowHalfOpen: false }, handleConnection);
+    if (!refed) server.unref();
     server.on('error', function (err) { ev.emit('error', err); });
     server.listen(port, host, function () {
       ev.emit('listening');
@@ -521,7 +524,12 @@ function createTcpListener(options) {
     // — sockets handed in through handleConnection — there is no net.Server
     // here to close, and returning early (as this did) left every one of
     // those connections open after shutdown.
+    // A protocol that closes its own connections (registered with
+    // managesClose: HTTP/1.1 and HTTP/2 finish what is in flight first) is
+    // left to it.
     for (var socket of sockets) {
+      var po = handlerOpts[socket._quicoProtocol];
+      if (po && po.managesClose) continue;
       if (!socket._quicoBusy) { try { socket.end(); } catch (e) {} }
     }
 
@@ -540,6 +548,9 @@ function createTcpListener(options) {
     off: function (n, f) { ev.off(n, f); return listener; },
     get protocols() { return order.slice(); },
     get connections() { return sockets.size; },
+    // node:net's: whether the process may exit while this listens.
+    ref: function () { refed = true; if (server && server.ref) server.ref(); return listener; },
+    unref: function () { refed = false; if (server && server.unref) server.unref(); return listener; },
 
     // The session ticket keys — tls.Server's names. A new key takes effect
     // for the next connection; tickets sealed with the one before no longer

package/src/tls_bridge.js

@@ -17,7 +17,6 @@ import {
   createSecureContext as _lemonCreateSecureContext,
   certificateObject
 } from 'lemon-tls';
-import { X509Certificate } from 'node:crypto';
 import { DEBUG, Emitter } from './utils.js';
 import { rootCertificates as lemonRoots, parseEcdhCurve as lemonParseEcdhCurve, DEFAULT_SERVER_GROUPS as lemonServerGroups,
          DEFAULT_SIGNATURE_SCHEMES as lemonSigSchemes } from 'lemon-tls';
@@ -159,6 +158,16 @@ function TLSBridge(options) {
   var handshakeSecretsEmitted = false;
   var appSecretsEmitted = false;
   var helloHandled = false;
+  // A handshake refused here, for what QUIC asks of TLS (RFC 9001): the
+  // alert closes the connection; nothing more is answered or sent.
+  var refused = false;
+  function refuse(alert, why) {
+    if (refused) return;
+    refused = true;
+    if (DEBUG) console.log('[tls] refused: ' + why);
+    ev.emit('alert', alert);
+    ev.emit('error', Object.assign(new Error(why), { code: 'ERR_QUIC_TLS' }));
+  }
   // A client's: what it keeps with each session it saves — the server's
   // transport parameters (tp), and the application's own (app: HTTP/3's
   // SETTINGS) once it has them — for 0-RTT next time.
@@ -363,31 +372,44 @@ function TLSBridge(options) {
     // 'handshakeMessage' with the parsed extensions, so we extract the 0x39 data,
     // parse it, and hand the params to the QUIC layer (which seeds remote_max_data,
     // max_ack_delay, ack_delay_exponent, etc. — previously hardcoded defaults).
+    //
+    // The extension is required (RFC 9001 §8.2): a ClientHello — every one, a
+    // second after a HelloRetryRequest included — or EncryptedExtensions
+    // without it is refused with missing_extension, before anything is
+    // answered. TLS itself has no reason to require it; QUIC does, so here.
     var peerParamsEmitted = false;
     session.on('handshakeMessage', function (type, data, message) {
-      if (peerParamsEmitted || !message || !Array.isArray(message.extensions)) return;
-      for (var i = 0; i < message.extensions.length; i++) {
-        var e = message.extensions[i];
-        if (e && (e.type === 0x39 || e.type === 57) && e.data) {
-          try {
-            var parsed = parse_transport_params(e.data, 0);
-            peerParamsEmitted = true;
-            if (DEBUG) console.log('[tls] peer transport params parsed (' + e.data.length + 'B)');
-            // A client keeps, with the sessions this connection saves, the
-            // server's parameters that 0-RTT must stay within (RFC 9000
-            // §7.4.1) — given back with the early secret next time.
-            if (!isServer) keepAppData('tp', rememberedParams(parsed));
-            ev.emit('peerTransportParams', parsed);
-          } catch (err) {
-            if (DEBUG) console.log('[tls] peer transport params parse failed: ' + err.message);
-          }
-          break;
-        }
+      var carrier = isServer ? 'client_hello' : 'encrypted_extensions';
+      if (type !== carrier || refused) return;
+      var ext = null;
+      var list = (message && Array.isArray(message.extensions)) ? message.extensions : [];
+      for (var i = 0; i < list.length; i++) {
+        var e = list[i];
+        if (e && (e.type === 0x39 || e.type === 57) && e.data) { ext = e; break; }
+      }
+      if (!ext) { refuse(109, 'no quic_transport_parameters in the ' + type); return; }
+      if (peerParamsEmitted) return;
+      var parsed;
+      try {
+        parsed = parse_transport_params(ext.data, 0);
+      } catch (err) {
+        // RFC 9000 §7.4: TRANSPORT_PARAMETER_ERROR, not a connection that
+        // goes on with the defaults.
+        refused = true;
+        ev.emit('transportParamsError', 'quic_transport_parameters: ' + err.message);
+        return;
       }
+      peerParamsEmitted = true;
+      if (DEBUG) console.log('[tls] peer transport params parsed (' + ext.data.length + 'B)');
+      // A client keeps, with the sessions this connection saves, the
+      // server's parameters that 0-RTT must stay within (RFC 9000
+      // §7.4.1) — given back with the early secret next time.
+      if (!isServer) keepAppData('tp', rememberedParams(parsed));
+      ev.emit('peerTransportParams', parsed);
     });
 
     session.on('hello', function () {
-      if (helloHandled) return; // prevent double-fire
+      if (helloHandled || refused) return; // prevent double-fire
       helloHandled = true;
       if (DEBUG) console.log('[tls] hello — configuring TLS');
 
@@ -435,6 +457,15 @@ function TLSBridge(options) {
         if (data && data.length >= 2 && data[0] === 2) ev.emit('alert', data[1]);
         return;
       }
+      // Refused above: nothing more of this handshake goes out.
+      if (refused) return;
+      // Never sent over QUIC (RFC 9001 §6, §8.3), whatever TLS would do over
+      // TCP: a KeyUpdate (QUIC has its own), an EndOfEarlyData. Should TLS
+      // make one, the connection ends — internal_error — rather than send it.
+      if (type === 'key_update' || type === 'end_of_early_data') {
+        refuse(80, 'TLS produced a ' + type + ', which QUIC never sends');
+        return;
+      }
       var quicEpoch;
       if (epoch === 0) quicEpoch = 'initial';
       else if (epoch === 1) quicEpoch = 'handshake';
@@ -525,7 +556,6 @@ function TLSBridge(options) {
     on: function (name, fn) { ev.on(name, fn); },
     off: function (name, fn) { ev.off(name, fn); },
     feedMessage: feedMessage,
-    requestKeyUpdate: function () { if (session) session.requestKeyUpdate(true); },
     getHandshakeSecrets: function () {
       if (!session) return null;
       var hs = session.getHandshakeSecrets();
@@ -620,6 +650,10 @@ function TLSBridge(options) {
      */
     getJA4: function (opts) { return session && session.getJA4 ? session.getJA4(quicOpts(opts)) : null; },
 
+    /** TLS keying material (RFC 8446 §7.5), as node:tls's exportKeyingMaterial(length, label, context) — or null before the handshake has the secret. */
+    exportKeyingMaterial: function (length, label, context) {
+      return session && session.exportKeyingMaterial ? session.exportKeyingMaterial(length, label, context) : null;
+    },
     /** The peer's certificate chain, leaf first, as DER — or null. */
     getPeerCertificateChain: function () {
       var chain = session && session.getPeerCertificate ? session.getPeerCertificate() : null;
@@ -658,27 +692,17 @@ function TLSBridge(options) {
      * fingerprint, fingerprint256, serialNumber, raw }, or {} when none. On a
      * server, the one the SNI lookup chose; on a resumed connection, the one
      * the lookup chose again for the same name.
+     *
+     * lemon-tls's certificateObject: the one implementation, the one its
+     * TLSSocket and getPeerCertificate use. This built it apiece, with
+     * subject and issuer as OpenSSL's text ('CN=a\nO=b') where node:tls
+     * gives objects ({ CN: 'a', O: 'b' }).
      */
     getCertificate: function () {
       var chain = session && session.getCertificate ? session.getCertificate() : null;
       if (!chain || chain.length === 0) return {};
-      try {
-        var der = chain[0].cert || chain[0];
-        var x509 = new X509Certificate(Buffer.isBuffer(der) ? der : Buffer.from(der));
-        return {
-          subject: x509.subject,
-          issuer: x509.issuer,
-          subjectaltname: x509.subjectAltName,
-          valid_from: x509.validFrom,
-          valid_to: x509.validTo,
-          fingerprint: x509.fingerprint,
-          fingerprint256: x509.fingerprint256,
-          serialNumber: x509.serialNumber,
-          raw: der
-        };
-      } catch (e) {
-        return {};
-      }
+      var der = chain[0].cert || chain[0];
+      return certificateObject(Buffer.isBuffer(der) ? der : Buffer.from(der)) || {};
     },
 
     close: function () { if (session && session.close) session.close(); }

package/src/transport.js

@@ -734,7 +734,9 @@ function parse_quic_frames(buf) {
       frames.push({ type: 'max_stream_data', id: id.value, max: max.value });
 
     } else if (type === 0x12 || type === 0x13) {
-      var max = safeReadVarInt(); if (!max) break;
+      // A count past 2^60 is not one (RFC 9000 §19.11): FRAME_ENCODING_ERROR.
+      var at = offset;
+      var max = safeReadVarInt(); if (!max || streamCountTooLarge(buf.subarray(at, offset))) break;
       frames.push({ type: type === 0x12 ? 'max_streams_bidi' : 'max_streams_uni', max: max.value });
 
     } else if (type === 0x14) {
@@ -747,7 +749,9 @@ function parse_quic_frames(buf) {
       frames.push({ type: 'stream_data_blocked', id: id.value, limit: limit.value });
 
     } else if (type === 0x16 || type === 0x17) {
-      var limit = safeReadVarInt(); if (!limit) break;
+      // Likewise (§19.14: STREAM_LIMIT_ERROR or FRAME_ENCODING_ERROR).
+      var at = offset;
+      var limit = safeReadVarInt(); if (!limit || streamCountTooLarge(buf.subarray(at, offset))) break;
       frames.push({ type: type === 0x16 ? 'streams_blocked_bidi' : 'streams_blocked_uni', limit: limit.value });
 
     } else if (type === 0x18) {

package/src/utils.js

@@ -410,7 +410,43 @@ function creditAsRead(readable, credit) {
   return function (n) { received += n; };
 }
 
+// ── UDP socket buffers ──
+//
+// The kernel's receive buffer is where datagrams wait for the event loop.
+// The OS default (208 KB on Linux) holds some 180 of them: a burst larger
+// than one turn drains is dropped there, silently — loss to QUIC, so a
+// retransmission and a congestion-window cut on a lossless link. 4 MB by
+// default, for the send buffer too (a full one drops what is sent, the same
+// way). The kernel caps both at net.core.rmem_max / wmem_max.
+//   socketBufferSize: bytes; 0 or false — the OS default.
+var DEFAULT_SOCKET_BUFFER_SIZE = 4 << 20;
+function checkedSocketBufferSize(v, what) {
+  if (v === undefined || v === null) return DEFAULT_SOCKET_BUFFER_SIZE;
+  if (v === 0 || v === false) return 0;
+  if (!Number.isInteger(v) || v < 0 || v > 0x7fffffff) {
+    var e = new RangeError((what || 'socketBufferSize') + ' must be a positive integer (bytes), 0 or false, got ' + v);
+    e.code = 'ERR_OUT_OF_RANGE';
+    throw e;
+  }
+  return v;
+}
+// For dgram.createSocket: applied when the socket is bound.
+function udpSocketOptions(base, size) {
+  return size > 0 ? Object.assign({}, base, { recvBufferSize: size, sendBufferSize: size }) : base;
+}
+// For a socket already bound. A platform that refuses the size does not stop
+// the socket from working.
+function setSocketBuffers(sock, size) {
+  if (!(size > 0)) return;
+  try { sock.setSendBufferSize(size); } catch (e) {}
+  try { sock.setRecvBufferSize(size); } catch (e) {}
+}
+
 export {
+  DEFAULT_SOCKET_BUFFER_SIZE,
+  checkedSocketBufferSize,
+  udpSocketOptions,
+  setSocketBuffers,
   createEmitter,
   mergePriority,
   creditAsRead,