Skip to content

quic.md

Latest commit

 

History

History
71 lines (53 loc) · 4.05 KB

quic.md

File metadata and controls

71 lines (53 loc) · 4.05 KB
Raw

QUIC

This repository includes a concrete QUIC transport core rather than only packet helpers.

Implemented and locally validated in this build

  • QUIC packet helpers for long-header packets, short-header packets, Version Negotiation, Retry, and Stateless Reset parsing/encoding
  • QUIC-TLS packet protection helpers for Initial, Handshake, 0-RTT, and 1-RTT packet protection
  • a binary TLS 1.3 handshake driver with certificate verification, transport-parameter negotiation, session tickets, resumption, and 0-RTT support
  • AES-based QUIC header protection helpers
  • Retry integrity-tag computation and validation
  • multiplexed stream frames, ACK ranges, RESET_STREAM / STOP_SENDING / CRYPTO / MAX_DATA / MAX_STREAM_DATA / MAX_STREAMS / PATH_CHALLENGE / PATH_RESPONSE / HANDSHAKE_DONE / CONNECTION_CLOSE frame handling in the codec
  • connection-ID-based runtime session routing in the HTTP/3 UDP server path
  • live recovery, ACK, loss, PTO, and pacing integration in the runtime
  • a versioned congestion-controller extension API in tigrcorn-quic-cc
  • a separately distributable default Reno provider in tigrcorn-quic-cc-reno
  • one fresh controller instance per QUIC network path, with loss detection, packet accounting, pacing enforcement, anti-amplification, and wire ordering retained by the Tigrcorn transport
  • public API / CLI startup for certificate-driven QUIC-TLS listeners over UDP
  • UDP listener client-certificate verification through ssl_ca_certs and ssl_require_client_cert
  • UDP listener Retry configuration through quic_require_retry / --quic-require-retry

Congestion-controller selection

Reno remains the default. A provider is selected once when each UDP listener starts; each connection path then receives a new controller from the resolved factory. Providers register under the tigrcorn.quic_cc.v1 entry-point group.

[quic.congestion_control]
algorithm = "reno"

[quic.congestion_control.options]
initial_window_packets = 10
initial_window_cap_bytes = 14720
pacing_gain = 1.0

The equivalent CLI is:

tigrcorn example:app --quic-bind 0.0.0.0:443 \
  --quic-congestion-control reno \
  --quic-congestion-control-options '{"pacing_gain":1.0}'

Environment configuration accepts TIGRCORN_QUIC_CONGESTION_CONTROL and a JSON object in TIGRCORN_QUIC_CONGESTION_CONTROL_OPTIONS. Listener-specific congestion_control blocks override the global algorithm and merge their options over the global options. Missing providers, duplicate provider IDs, incompatible API versions, and invalid options fail listener startup. Invalid runtime output closes the provider's send gate for that path.

Evidence tiers

The canonical package-wide target for this transport is defined in docs/review/conformance/CERTIFICATION_BOUNDARY.md.

QUIC evidence is now split explicitly:

  • local conformance — RFC 9000, RFC 9001, RFC 9002, RFC 7301, and local TLS / X.509 fixtures in corpus.json
  • same-stack replay — docs/review/conformance/external_matrix.same_stack_replay.json and the canonical same-stack bundle under docs/review/conformance/releases/0.3.9/release-0.3.9/tigrcorn-same-stack-replay-matrix/
  • independent certification — docs/review/conformance/external_matrix.release.json and the canonical independent bundle under docs/review/conformance/releases/0.3.9/release-0.3.9/tigrcorn-independent-certification-release-matrix/

Current certification status

The independent matrix proves that the UDP listener can complete an OpenSSL QUIC handshake and negotiate h3, and it now preserves passing third-party HTTP/3 feature-axis scenarios for Retry, resumption, 0-RTT, migration, mTLS, and GOAWAY / QPACK.

Under the authoritative certification boundary, the QUIC transport now satisfies the required independent evidence for RFC 9000, RFC 9001, RFC 9002, and the HTTP/3 carrier that depends on them. The package-wide RFC 8446 target is no longer blocked by the public TCP/TLS listener path.

Broader flow-control and strict all-surfaces-independent follow-on work remains tracked separately and does not change the current passing release-gate result.