quico 0.8.0 → 0.9.0

package/src/quic_server.js

@@ -13,8 +13,10 @@
  */
 
 import dgram from 'node:dgram';
+import dns from 'node:dns';
+import net from 'node:net';
 import crypto from 'node:crypto';
-import { DEBUG, Emitter } from './utils.js';
+import { DEBUG, Emitter, checkedSocketBufferSize, setSocketBuffers } from './utils.js';
 import {
   parse_quic_datagram,
   build_version_negotiation
@@ -118,6 +120,10 @@ function createQuicServer(options) {
   // When socket/socket6 are provided, the UDP layer is owned externally.
   // The caller demuxes packets and feeds them via handlePacket(msg, rinfo).
   // See RFC 9443 for the shared-port multiplexing scheme.
+  // The UDP sockets' buffers (utils.js): 4 MB by default — external ones
+  // too, as before (the demultiplexer that owns them may not have, and
+  // asking twice costs nothing); 0 or false leaves them all at the OS's.
+  var socketBufferSize = checkedSocketBufferSize(options.socketBufferSize, 'socketBufferSize');
   var externalSocket4 = options.socket  || null;
   var externalSocket6 = options.socket6 || null;
 
@@ -826,6 +832,17 @@ function createQuicServer(options) {
   //  UDP send
   // ============================================================
 
+  // A client that has gone away: its port answers our datagrams with ICMP
+  // "port unreachable". Node does not report that on an unconnected UDP
+  // socket; Bun does, as ECONNREFUSED — an 'error' on the socket, or on a
+  // send's callback. It concerns that client alone (its connection ends at
+  // its idle timeout, as any silent peer's), not the socket: taken for a
+  // socket error it closed the server's socket, and with it every other
+  // client of that family (quico PR #12).
+  function isDepartedPeer(err) {
+    return !!err && err.code === 'ECONNREFUSED';
+  }
+
   function sendUdp(toIp, toPort, data) {
     var isV6 = toIp.indexOf(':') >= 0;
     // Prefer external socket (shared mode) over internally-bound socket
@@ -836,7 +853,7 @@ function createQuicServer(options) {
     sendsPending++;
     socket.send(data, toPort, toIp, function (err) {
       sendsPending--;
-      if (err && !closing) ev.emit('error', err);
+      if (err && !closing && !isDepartedPeer(err)) ev.emit('error', err);
       if (closing && sendsPending === 0) closing();
     });
   }
@@ -882,14 +899,8 @@ function createQuicServer(options) {
       // decrypted a second time and dropped as a duplicate, and every non-QUIC
       // packet — media included, on the hottest path there is — went through
       // the QUIC parser before being discarded.
-      if (externalSocket4) {
-        try { externalSocket4.setSendBufferSize(2 * 1024 * 1024); } catch (e) {}
-        try { externalSocket4.setRecvBufferSize(2 * 1024 * 1024); } catch (e) {}
-      }
-      if (externalSocket6) {
-        try { externalSocket6.setSendBufferSize(2 * 1024 * 1024); } catch (e) {}
-        try { externalSocket6.setRecvBufferSize(2 * 1024 * 1024); } catch (e) {}
-      }
+      if (externalSocket4) setSocketBuffers(externalSocket4, socketBufferSize);
+      if (externalSocket6) setSocketBuffers(externalSocket6, socketBufferSize);
       startSweepTimer();
       if (typeof callback === 'function') setImmediate(callback);
       return;
@@ -902,65 +913,108 @@ function createQuicServer(options) {
     // recovery engages and throughput collapses. See LOSS_PTO_PLAN 7.4: this
     // is what defeated the third pacer-calibration attempt.
     //
-    // try/catch because some platforms cap the value and throw; not being
-    // able to enlarge the buffer must not stop the server from listening.
-    function growBuffers(sock) {
-      try { sock.setSendBufferSize(2 * 1024 * 1024); } catch (e) {}
-      try { sock.setRecvBufferSize(2 * 1024 * 1024); } catch (e) {}
+    // Not being able to enlarge the buffer must not stop the server from
+    // listening (setSocketBuffers).
+    function growBuffers(sock) { setSocketBuffers(sock, socketBufferSize); }
+
+    // Which addresses: as node:net. An address binds its own family alone —
+    // '127.0.0.1' and '0.0.0.0' IPv4, '::1' IPv6; '::' (and no host) both;
+    // a hostname is looked up once, and each family it has binds its first
+    // address ('localhost': loopback, both families). Every address used to
+    // bind '::' unless it held a ':', and '0.0.0.0' unless it held a '.':
+    // listen(p, '127.0.0.1') answered on every IPv6 interface too, and
+    // listen(p, 'localhost') on every interface of both.
+    if (host === '::') bindFamilies('0.0.0.0', '::');
+    else if (net.isIP(host) === 4) bindFamilies(host, null);
+    else if (net.isIP(host) === 6) bindFamilies(null, host);
+    else {
+      dns.lookup(host, { all: true }, function (err, list) {
+        if (shutDown) return;
+        if (err) { ev.emit('error', err); return; }
+        bindFamilies(firstOf(list, 4), firstOf(list, 6));
+      });
     }
 
-    // Both sockets are attempted, and listening succeeds if EITHER binds.
-    //
-    // The callback used to hang off udp6.bind alone. On a host without IPv6 —
-    // a container, a CI runner, plenty of cloud instances — that bind fails
-    // with EAFNOSUPPORT and the callback is never called: listen() returns, the
-    // v4 socket is up and working, and the caller waits forever for a
-    // 'listening' that cannot arrive. Nothing logs, because the error goes to
-    // the 'error' event that a caller waiting on the callback has not reached
-    // yet.
+    function firstOf(list, family) {
+      for (var i = 0; i < list.length; i++) if (list[i].family === family) return list[i].address;
+      return null;
+    }
+
+    // The families one after the other, IPv4 first: after listen(0) IPv6
+    // takes the port the OS gave IPv4 — one server, one port, the one
+    // address() and Alt-Svc name. Each took a port of its own.
     //
-    // A failure on one family is also not fatal on its own. Only if BOTH fail
-    // is there nothing to listen on, and that is reported as an error.
-    var pending = 2;
-    var bound = 0;
-    var lastErr = null;
-
-    function settle(err) {
-      if (err) lastErr = err;
-      else bound++;
-      if (--pending > 0) return;
-      if (bound === 0) {
-        ev.emit('error', lastErr || new Error('failed to bind UDP on port ' + port));
+    // Listening succeeds when every family binds, but for one the host does
+    // not have (familyMissing: no IPv6 in a container) while another did.
+    // Any other failure fails the listen() — the sockets that bound are
+    // closed, and one 'error' says why. Before, either family binding was
+    // enough: with IPv4's port taken (another server already on it) this
+    // one served IPv6 alone, and nothing said so.
+    function bindFamilies(addr4, addr6) {
+      var steps = [];
+      if (addr4) steps.push([false, addr4]);
+      if (addr6) steps.push([true, addr6]);
+      var errs = [], bound = 0;
+      (function next(i) {
+        if (shutDown) return;
+        if (i === steps.length) { settle(errs, bound); return; }
+        bindOne(steps[i][0], steps[i][1], function (err) {
+          if (!err) bound++;
+          else { errs.push(err); if (!familyMissing(err)) { settle(errs, bound); return; } }
+          next(i + 1);
+        });
+      })(0);
+    }
+
+    function familyMissing(err) { return err.code === 'EAFNOSUPPORT' || err.code === 'EADDRNOTAVAIL'; }
+
+    // The callback used to hang off udp6.bind alone: on a host without IPv6
+    // it was never called, while the IPv4 socket served. It is called once
+    // the families are settled, whichever bound.
+    function settle(errs, bound) {
+      var fatal = null;
+      for (var i = 0; i < errs.length && !fatal; i++) if (!familyMissing(errs[i])) fatal = errs[i];
+      if (!fatal && bound === 0) fatal = errs[0] || new Error('failed to bind UDP on port ' + port);
+      if (fatal) {
+        if (udp4) { try { udp4.close(); } catch (e) {} udp4 = null; }
+        if (udp6) { try { udp6.close(); } catch (e) {} udp6 = null; }
+        ev.emit('error', fatal);
         return;
       }
       if (typeof callback === 'function') callback();
     }
 
-    udp4 = dgram.createSocket('udp4');
-    udp4.on('message', onUdpMessage);
-    udp4.once('error', function (err) {
-      // A bind failure arrives before we are listening; anything later is a
-      // runtime socket error and belongs to the consumer.
-      udp4 = null;
-      settle(err);
-      ev.emit('error', err);
-    });
-    var host4 = host.indexOf('.') !== -1 ? host : '0.0.0.0';
-    if (!refed) udp4.unref();
-    udp4.bind(port, host4, function () { growBuffers(udp4); settle(null); });
-
-    udp6 = dgram.createSocket({ type: 'udp6', ipv6Only: true });
-    udp6.on('message', onUdpMessage);
-    udp6.once('error', function (err) {
-      udp6 = null;
-      // No IPv6 on this host is ordinary, not an error the application needs
-      // to see — the v4 socket is serving. Only a total failure is emitted,
-      // from settle() above.
-      settle(err);
-    });
-    var host6 = host.indexOf(':') !== -1 ? host : '::';
-    if (!refed) udp6.unref();
-    udp6.bind(port, host6, function () { growBuffers(udp6); settle(null); });
+    // A socket whose bind fails is closed, not only dropped: it stayed open
+    // (no IPv6 on the host, the port taken), an object nothing could close
+    // once `udp4` / `udp6` no longer named it. The failure goes to settle()
+    // alone, which reports one error; it was also emitted here, so a
+    // listen() that failed emitted 'error' twice.
+    //
+    // An error after the bind is a runtime socket error: it belongs to the
+    // consumer, and the socket goes on serving — it is not closed. It was:
+    // the close ran for every error, so on Bun one departed client's
+    // ECONNREFUSED (isDepartedPeer, not reported at all) closed the socket,
+    // and the server answered no one of that family again. And `on`, not
+    // `once`: a second error with no listener left would throw.
+    function bindOne(v6, addr, done) {
+      var sock = dgram.createSocket(v6 ? { type: 'udp6', ipv6Only: true } : 'udp4'), isBound = false;
+      if (v6) udp6 = sock; else udp4 = sock;
+      sock.on('message', onUdpMessage);
+      sock.on('error', function (err) {
+        if (isBound) { if (!isDepartedPeer(err)) ev.emit('error', err); return; }
+        try { sock.close(); } catch (e) {}
+        if (udp4 === sock) udp4 = null;
+        if (udp6 === sock) udp6 = null;
+        done(err);
+      });
+      if (!refed) sock.unref();
+      sock.bind(port, addr, function () {
+        isBound = true;
+        growBuffers(sock);
+        if (port === 0) port = sock.address().port;
+        done(null);
+      });
+    }
 
     startSweepTimer();
   }
@@ -1084,6 +1138,12 @@ function createQuicServer(options) {
   return {
     listen: listen,
     close: close,
+    // node:dgram's address() of the socket listening — after listen(0), the
+    // port the OS gave (both families have it); null when not listening.
+    address: function () {
+      var s = udp4 || udp6 || externalSocket4 || externalSocket6;
+      try { return s ? s.address() : null; } catch (e) { return null; }
+    },
     stopAccepting: function () { accepting = false; },
     get connectionCount() { return connectionCount; },
     // node:dgram's: whether the process may exit while this listens.

package/src/quic_socket.js

@@ -16,6 +16,7 @@ import dgram from 'node:dgram';
 import { QUICConnection } from './quic_connection.js';
 import lemonTls from 'lemon-tls';
 import { SUPPORTED_VERSIONS, parseVersionList, versionName } from './quic_version.js';
+import { checkedSocketBufferSize, setSocketBuffers } from './utils.js';
 
 
 /**
@@ -67,6 +68,7 @@ function createQuicClientSocket(opts) {
   // lemon-tls's list. A name it does not know throws here.
   var sigalgs = lemonTls.parseSigalgs(opts.sigalgs);
   var isIPv6 = opts.remoteIp.indexOf(':') >= 0;
+  var socketBufferSize = checkedSocketBufferSize(opts.socketBufferSize, 'socketBufferSize');
   var udpSocket = dgram.createSocket(isIPv6 ? 'udp6' : 'udp4');
   var quic = null;
 
@@ -88,11 +90,9 @@ function createQuicClientSocket(opts) {
     // pacer-calibration attempt (see LOSS_PTO_PLAN 7.4): larger bursts spilled
     // over the buffer and turned a lossless link into a slow one.
     //
-    // Wrapped in try/catch because the call can throw on platforms that cap
-    // the size; failing to enlarge the buffer is not a reason to fail the
-    // connection.
-    try { udpSocket.setSendBufferSize(2 * 1024 * 1024); } catch (e) {}
-    try { udpSocket.setRecvBufferSize(2 * 1024 * 1024); } catch (e) {}
+    // 4 MB by default (utils.js), socketBufferSize where given; failing to
+    // enlarge the buffer is not a reason to fail the connection.
+    setSocketBuffers(udpSocket, socketBufferSize);
 
     // One attempt; after a Version Negotiation, a second in a version the
     // server offered (RFC 9000 §6.2) — once.

package/src/server.js

@@ -218,26 +218,16 @@ function createServer(options, handler) {
   function toContext(o, what) {
     if (o && typeof o === 'object' && o.certificateChain && o.privateKey) return o;   // made already (quico.createSecureContext)
     if (!o || typeof o !== 'object') throw new TypeError(what + ' takes { key, cert[, ca, passphrase] } or a context from quico.createSecureContext()');
+    // createSecureContext (lemon-tls's) refuses a key that is not the
+    // certificate's (ERR_OSSL_X509_KEY_VALUES_MISMATCH) - before it replaces
+    // anything, not found out by every client's handshake failing.
     var ctx = createSecureContext(Object.assign({ passphrase: options.passphrase }, o));
-    checkKeyMatches(ctx);
     // Its chain compressed now, not in a client's handshake (RFC 8879).
     if (typeof lemonTls.precompressCertificate === 'function' && !(Array.isArray(options.certificateCompression) && options.certificateCompression.length === 0)) {
       try { lemonTls.precompressCertificate(ctx, options.certificateCompression || undefined); } catch (e) {}
     }
     return ctx;
   }
-  // A certificate whose key is another's is refused here — before it
-  // replaces anything — not found out by every client's handshake failing.
-  function checkKeyMatches(ctx) {
-    if (!ctx.keyObj || !ctx.certObjs || !ctx.certObjs[0]) return;
-    var a = crypto.createPublicKey(ctx.keyObj).export({ type: 'spki', format: 'der' });
-    var b = ctx.certObjs[0].publicKey.export({ type: 'spki', format: 'der' });
-    if (Buffer.compare(Buffer.from(a), Buffer.from(b)) !== 0) {
-      var e = new Error('the private key does not match the certificate');
-      e.code = 'ERR_OSSL_X509_KEY_VALUES_MISMATCH';
-      throw e;
-    }
-  }
   function contextFor(servername) {
     var name = String(servername || '');
     for (var i = sniContexts.length - 1; i >= 0; i--) if (sniContexts[i][0].test(name)) return sniContexts[i][1];
@@ -412,6 +402,8 @@ function createServer(options, handler) {
     maxUdpPayloadSize: options.maxUdpPayloadSize,
     initialRtt: options.initialRtt,
     reorderWindow: options.reorderWindow,
+    // The UDP sockets' buffers, bytes: 4 MB by default; 0, the OS's (utils.js).
+    socketBufferSize: options.socketBufferSize,
     // Per QUIC connection, asked once its ClientHello is in: (info, callback)
     // → { transportParams, initialCongestionWindow, carefulResume, startupCap,
     //     pmtuDiscovery, maxUdpPayloadSize, initialRtt, reorderWindow }.
@@ -945,7 +937,7 @@ function createServer(options, handler) {
         listening = true;
         closed = false;
         // After listen(0) the OS chose the port; Alt-Svc must name that one.
-        if (port === 0 && tcpServer && tcpServer.address()) altSvcPort = tcpServer.address().port;
+        if (port === 0) { var a = address(); if (a && a.port) altSvcPort = a.port; }
         ev.emit('listening');
         if (typeof callback === 'function') callback();
       }
@@ -956,8 +948,22 @@ function createServer(options, handler) {
     if (remaining === 0) { remaining = 1; setImmediate(done); return server; }
 
     if (ref === false) { if (enableH3) h3srv.unref(); if (tcpServer) tcpServer.unref(); }
+    // No host: TCP as node:net, '::' where the host has IPv6 (both
+    // families), else '0.0.0.0' — as UDP. It was '0.0.0.0': HTTP/1.1 and
+    // HTTP/2 on IPv4 alone, HTTP/3 on both.
+    var tcpHost = host || undefined;
+    // listen(0): TCP first, then UDP on the port the OS gave TCP — the port
+    // Alt-Svc names and address() reports. Each took a port of its own, and
+    // Alt-Svc named TCP's: a browser never reached HTTP/3.
+    if (bindUdp && needsTcp && port === 0) {
+      tcpServer.listen(0, tcpHost, function () {
+        done();
+        h3srv.listen(tcpServer.address().port, host, done);
+      });
+      return server;
+    }
     if (bindUdp) h3srv.listen(port, host, done);
-    if (needsTcp) tcpServer.listen(port, host || '0.0.0.0', done);
+    if (needsTcp) tcpServer.listen(port, tcpHost, done);
 
     return server;
   }
@@ -1056,6 +1062,9 @@ function createServer(options, handler) {
       var addr = tcpServer.address();
       if (addr) return addr;
     }
+    // HTTP/3 alone: the UDP socket's (the same port, when both listen).
+    var a3 = enableH3 && h3srv.address ? h3srv.address() : null;
+    if (a3) return a3;
     return { address: '0.0.0.0', family: 'IPv4', port: altSvcPort };
   }
 

package/src/tls_bridge.js

@@ -17,7 +17,6 @@ import {
   createSecureContext as _lemonCreateSecureContext,
   certificateObject
 } from 'lemon-tls';
-import { X509Certificate } from 'node:crypto';
 import { DEBUG, Emitter } from './utils.js';
 import { rootCertificates as lemonRoots, parseEcdhCurve as lemonParseEcdhCurve, DEFAULT_SERVER_GROUPS as lemonServerGroups,
          DEFAULT_SIGNATURE_SCHEMES as lemonSigSchemes } from 'lemon-tls';
@@ -159,6 +158,16 @@ function TLSBridge(options) {
   var handshakeSecretsEmitted = false;
   var appSecretsEmitted = false;
   var helloHandled = false;
+  // A handshake refused here, for what QUIC asks of TLS (RFC 9001): the
+  // alert closes the connection; nothing more is answered or sent.
+  var refused = false;
+  function refuse(alert, why) {
+    if (refused) return;
+    refused = true;
+    if (DEBUG) console.log('[tls] refused: ' + why);
+    ev.emit('alert', alert);
+    ev.emit('error', Object.assign(new Error(why), { code: 'ERR_QUIC_TLS' }));
+  }
   // A client's: what it keeps with each session it saves — the server's
   // transport parameters (tp), and the application's own (app: HTTP/3's
   // SETTINGS) once it has them — for 0-RTT next time.
@@ -363,31 +372,44 @@ function TLSBridge(options) {
     // 'handshakeMessage' with the parsed extensions, so we extract the 0x39 data,
     // parse it, and hand the params to the QUIC layer (which seeds remote_max_data,
     // max_ack_delay, ack_delay_exponent, etc. — previously hardcoded defaults).
+    //
+    // The extension is required (RFC 9001 §8.2): a ClientHello — every one, a
+    // second after a HelloRetryRequest included — or EncryptedExtensions
+    // without it is refused with missing_extension, before anything is
+    // answered. TLS itself has no reason to require it; QUIC does, so here.
     var peerParamsEmitted = false;
     session.on('handshakeMessage', function (type, data, message) {
-      if (peerParamsEmitted || !message || !Array.isArray(message.extensions)) return;
-      for (var i = 0; i < message.extensions.length; i++) {
-        var e = message.extensions[i];
-        if (e && (e.type === 0x39 || e.type === 57) && e.data) {
-          try {
-            var parsed = parse_transport_params(e.data, 0);
-            peerParamsEmitted = true;
-            if (DEBUG) console.log('[tls] peer transport params parsed (' + e.data.length + 'B)');
-            // A client keeps, with the sessions this connection saves, the
-            // server's parameters that 0-RTT must stay within (RFC 9000
-            // §7.4.1) — given back with the early secret next time.
-            if (!isServer) keepAppData('tp', rememberedParams(parsed));
-            ev.emit('peerTransportParams', parsed);
-          } catch (err) {
-            if (DEBUG) console.log('[tls] peer transport params parse failed: ' + err.message);
-          }
-          break;
-        }
+      var carrier = isServer ? 'client_hello' : 'encrypted_extensions';
+      if (type !== carrier || refused) return;
+      var ext = null;
+      var list = (message && Array.isArray(message.extensions)) ? message.extensions : [];
+      for (var i = 0; i < list.length; i++) {
+        var e = list[i];
+        if (e && (e.type === 0x39 || e.type === 57) && e.data) { ext = e; break; }
+      }
+      if (!ext) { refuse(109, 'no quic_transport_parameters in the ' + type); return; }
+      if (peerParamsEmitted) return;
+      var parsed;
+      try {
+        parsed = parse_transport_params(ext.data, 0);
+      } catch (err) {
+        // RFC 9000 §7.4: TRANSPORT_PARAMETER_ERROR, not a connection that
+        // goes on with the defaults.
+        refused = true;
+        ev.emit('transportParamsError', 'quic_transport_parameters: ' + err.message);
+        return;
       }
+      peerParamsEmitted = true;
+      if (DEBUG) console.log('[tls] peer transport params parsed (' + ext.data.length + 'B)');
+      // A client keeps, with the sessions this connection saves, the
+      // server's parameters that 0-RTT must stay within (RFC 9000
+      // §7.4.1) — given back with the early secret next time.
+      if (!isServer) keepAppData('tp', rememberedParams(parsed));
+      ev.emit('peerTransportParams', parsed);
     });
 
     session.on('hello', function () {
-      if (helloHandled) return; // prevent double-fire
+      if (helloHandled || refused) return; // prevent double-fire
       helloHandled = true;
       if (DEBUG) console.log('[tls] hello — configuring TLS');
 
@@ -435,6 +457,15 @@ function TLSBridge(options) {
         if (data && data.length >= 2 && data[0] === 2) ev.emit('alert', data[1]);
         return;
       }
+      // Refused above: nothing more of this handshake goes out.
+      if (refused) return;
+      // Never sent over QUIC (RFC 9001 §6, §8.3), whatever TLS would do over
+      // TCP: a KeyUpdate (QUIC has its own), an EndOfEarlyData. Should TLS
+      // make one, the connection ends — internal_error — rather than send it.
+      if (type === 'key_update' || type === 'end_of_early_data') {
+        refuse(80, 'TLS produced a ' + type + ', which QUIC never sends');
+        return;
+      }
       var quicEpoch;
       if (epoch === 0) quicEpoch = 'initial';
       else if (epoch === 1) quicEpoch = 'handshake';
@@ -525,7 +556,6 @@ function TLSBridge(options) {
     on: function (name, fn) { ev.on(name, fn); },
     off: function (name, fn) { ev.off(name, fn); },
     feedMessage: feedMessage,
-    requestKeyUpdate: function () { if (session) session.requestKeyUpdate(true); },
     getHandshakeSecrets: function () {
       if (!session) return null;
       var hs = session.getHandshakeSecrets();
@@ -662,27 +692,17 @@ function TLSBridge(options) {
      * fingerprint, fingerprint256, serialNumber, raw }, or {} when none. On a
      * server, the one the SNI lookup chose; on a resumed connection, the one
      * the lookup chose again for the same name.
+     *
+     * lemon-tls's certificateObject: the one implementation, the one its
+     * TLSSocket and getPeerCertificate use. This built it apiece, with
+     * subject and issuer as OpenSSL's text ('CN=a\nO=b') where node:tls
+     * gives objects ({ CN: 'a', O: 'b' }).
      */
     getCertificate: function () {
       var chain = session && session.getCertificate ? session.getCertificate() : null;
       if (!chain || chain.length === 0) return {};
-      try {
-        var der = chain[0].cert || chain[0];
-        var x509 = new X509Certificate(Buffer.isBuffer(der) ? der : Buffer.from(der));
-        return {
-          subject: x509.subject,
-          issuer: x509.issuer,
-          subjectaltname: x509.subjectAltName,
-          valid_from: x509.validFrom,
-          valid_to: x509.validTo,
-          fingerprint: x509.fingerprint,
-          fingerprint256: x509.fingerprint256,
-          serialNumber: x509.serialNumber,
-          raw: der
-        };
-      } catch (e) {
-        return {};
-      }
+      var der = chain[0].cert || chain[0];
+      return certificateObject(Buffer.isBuffer(der) ? der : Buffer.from(der)) || {};
     },
 
     close: function () { if (session && session.close) session.close(); }

package/src/transport.js

@@ -734,7 +734,9 @@ function parse_quic_frames(buf) {
       frames.push({ type: 'max_stream_data', id: id.value, max: max.value });
 
     } else if (type === 0x12 || type === 0x13) {
-      var max = safeReadVarInt(); if (!max) break;
+      // A count past 2^60 is not one (RFC 9000 §19.11): FRAME_ENCODING_ERROR.
+      var at = offset;
+      var max = safeReadVarInt(); if (!max || streamCountTooLarge(buf.subarray(at, offset))) break;
       frames.push({ type: type === 0x12 ? 'max_streams_bidi' : 'max_streams_uni', max: max.value });
 
     } else if (type === 0x14) {
@@ -747,7 +749,9 @@ function parse_quic_frames(buf) {
       frames.push({ type: 'stream_data_blocked', id: id.value, limit: limit.value });
 
     } else if (type === 0x16 || type === 0x17) {
-      var limit = safeReadVarInt(); if (!limit) break;
+      // Likewise (§19.14: STREAM_LIMIT_ERROR or FRAME_ENCODING_ERROR).
+      var at = offset;
+      var limit = safeReadVarInt(); if (!limit || streamCountTooLarge(buf.subarray(at, offset))) break;
       frames.push({ type: type === 0x16 ? 'streams_blocked_bidi' : 'streams_blocked_uni', limit: limit.value });
 
     } else if (type === 0x18) {

package/src/utils.js

@@ -410,7 +410,43 @@ function creditAsRead(readable, credit) {
   return function (n) { received += n; };
 }
 
+// ── UDP socket buffers ──
+//
+// The kernel's receive buffer is where datagrams wait for the event loop.
+// The OS default (208 KB on Linux) holds some 180 of them: a burst larger
+// than one turn drains is dropped there, silently — loss to QUIC, so a
+// retransmission and a congestion-window cut on a lossless link. 4 MB by
+// default, for the send buffer too (a full one drops what is sent, the same
+// way). The kernel caps both at net.core.rmem_max / wmem_max.
+//   socketBufferSize: bytes; 0 or false — the OS default.
+var DEFAULT_SOCKET_BUFFER_SIZE = 4 << 20;
+function checkedSocketBufferSize(v, what) {
+  if (v === undefined || v === null) return DEFAULT_SOCKET_BUFFER_SIZE;
+  if (v === 0 || v === false) return 0;
+  if (!Number.isInteger(v) || v < 0 || v > 0x7fffffff) {
+    var e = new RangeError((what || 'socketBufferSize') + ' must be a positive integer (bytes), 0 or false, got ' + v);
+    e.code = 'ERR_OUT_OF_RANGE';
+    throw e;
+  }
+  return v;
+}
+// For dgram.createSocket: applied when the socket is bound.
+function udpSocketOptions(base, size) {
+  return size > 0 ? Object.assign({}, base, { recvBufferSize: size, sendBufferSize: size }) : base;
+}
+// For a socket already bound. A platform that refuses the size does not stop
+// the socket from working.
+function setSocketBuffers(sock, size) {
+  if (!(size > 0)) return;
+  try { sock.setSendBufferSize(size); } catch (e) {}
+  try { sock.setRecvBufferSize(size); } catch (e) {}
+}
+
 export {
+  DEFAULT_SOCKET_BUFFER_SIZE,
+  checkedSocketBufferSize,
+  udpSocketOptions,
+  setSocketBuffers,
   createEmitter,
   mergePriority,
   creditAsRead,

package/src/webtransport.js

@@ -17,7 +17,8 @@ import dns from 'node:dns';
 import { H3Connection, wtCloseCapsule, createCapsuleReader } from './h3.js';
 import { createQuicClientSocket } from './quic_socket.js';
 import lemonTls from 'lemon-tls';
-import { createHash, X509Certificate } from 'node:crypto';
+import { createHash } from 'node:crypto';
+import { x509 } from 'cryptographic-formats';
 import { readVarInt, wt_datagram_payload } from './utils.js';
 import { createWtStream, openWtStream, createSendGroup, wtScheduling, createDatagrams, sessionStats, setErrorCode,
          exporterArgs, exportSessionKeyingMaterial,
@@ -425,6 +426,7 @@ class WebTransport extends EventEmitter {
     this._udpSocket = createQuicClientSocket({
       remoteIp: remoteIp,
       remotePort: remotePort,
+      socketBufferSize: this._options.socketBufferSize,
       hostname: this._hostname,
       // serverCertificateHashes pins the certificate instead of a CA (checked
       // in onConnect, before anything is sent on the connection).
@@ -693,8 +695,11 @@ class WebTransport extends EventEmitter {
       return v.length === digest.length && v.equals(digest);
     });
     if (!match) return new Error('serverCertificateHashes: the certificate matches none of them');
-    var cert = new X509Certificate(der), now = Date.now();
-    var from = Date.parse(cert.validFrom), to = Date.parse(cert.validTo);
+    // Its dates, read by cryptographic-formats
+    var cert;
+    try { cert = x509.from_der(der); } catch (e) { return new Error('serverCertificateHashes: the certificate does not parse: ' + e.message); }
+    var now = Date.now();
+    var from = cert.validity.not_before.date.getTime(), to = cert.validity.not_after.date.getTime();
     if (!(now >= from && now <= to)) return new Error('serverCertificateHashes: the certificate is not valid now');
     if (to - from > 14 * 24 * 3600 * 1000) return new Error('serverCertificateHashes: the certificate is valid for more than 14 days');
     return null;