qir: additional tests

quic-version-negotiation

qir-last-tests

xr-29

Author: lws-team

include/libwebsockets/lws-client.h

@@ -227,6 +227,10 @@ struct lws_client_connect_info {
 	 * to the client connection.
 	 */
 
+	struct lws      *quic_migrate_from_wsi;
+	/**< If set, this connection acts as a Make-Before-Break migration probe for
+	 * the existing QUIC network connection in quic_migrate_from_wsi. */
+
 	uint8_t		priority;
 	/**< 0 means normal priority... otherwise sets the IP priority on
 	 * packets coming from this connection, from 1 - 7.  Setting 7

include/libwebsockets/lws-context-vhost.h

@@ -284,6 +284,12 @@
 #define LWS_SERVER_OPTION_QUIC_PAD_CRYPTO                       (1ll << 49)
         /**< (VH) Pad the QUIC handshake crypto data to artificially hit anti-amplification limits */
 
+#define LWS_SERVER_OPTION_QUIC_EARLY_KEY_UPDATE                 (1ll << 51)
+	/**< CONTEXT: For testing. Trigger a QUIC early key update */
+
+#define LWS_SERVER_OPTION_QUIC_LATEST_VERSION                   (1ll << 50)
+        /**< (CTX) Force client to initiate QUIC connections using the latest supported version (e.g. v2) */
+
         /****** add new things just above ---^ ******/
 
 
@@ -1102,7 +1108,11 @@ struct lws_context_creation_info {
 	const struct lws_cc_ops		*quic_cc_ops;
 	/**< CONTEXT: QUIC congestion control algorithm ops to use. If NULL, defaults to &lws_cc_ops_newreno. */
 
-	void *_unused[1]; /**< dummy */
+	const char                      *quic_preferred_addresses;
+	/**< VHOST: Comma-separated list of IPv4 and/or IPv6 preferred addresses (e.g., "1.2.3.4:443,[2001:db8::1]:443")
+	 * to send to the client during the handshake to facilitate Connection Migration. */
+
+	void *_unused[0]; /**< dummy */
 };
 
 /**

include/libwebsockets/lws-quic.h

@@ -159,6 +159,7 @@ struct lws_cc_ops {
 	void (*on_sent)(struct lws *nwsi, size_t bytes);
 	void (*on_ack)(struct lws *nwsi, size_t bytes_acked, lws_usec_t rtt);
 	void (*on_loss)(struct lws *nwsi, size_t bytes_lost);
+	void (*on_discard)(struct lws *nwsi, size_t bytes_discarded);
 	int  (*can_send)(struct lws *nwsi, size_t bytes);
 	lws_usec_t (*get_pacing_delay)(struct lws *nwsi, size_t bytes_to_send);
 };

lib/core-net/client/connect.c

@@ -208,6 +208,10 @@ lws_client_connect_via_info(const struct lws_client_connect_info *i)
 	wsi->client_proxy_onward = !!(i->ssl_connection & LCCSCF_SECSTREAM_PROXY_ONWARD);
 #endif
 
+#if defined(LWS_ROLE_QUIC)
+        wsi->quic.migrate_from_wsi = i->quic_migrate_from_wsi;
+#endif
+
 #if defined(LWS_WITH_SYS_FAULT_INJECTION)
 	wsi->fic.name = "wsi";
 	if (i->fic.fi_owner.count)
@@ -250,6 +254,8 @@ lws_client_connect_via_info(const struct lws_client_connect_info *i)
 		wsi->keep_warm_secs = 5;
 
 	wsi->flags = i->ssl_connection;
+	if (i->context->options & LWS_SERVER_OPTION_ALLOW_EARLY_DATA)
+		wsi->flags |= LCCSCF_ALLOW_EARLY_DATA;
 
 	wsi->c_pri = i->priority;
 
@@ -347,7 +353,7 @@ lws_client_connect_via_info(const struct lws_client_connect_info *i)
 	}
 
 #if defined(LWS_WITH_TLS)
-	wsi->tls.use_ssl = (unsigned int)i->ssl_connection;
+	wsi->tls.use_ssl = (unsigned int)wsi->flags;
 #else
 	if (i->ssl_connection & LCCSCF_USE_SSL) {
 		lwsl_wsi_err(wsi, "lws not configured for tls");

lib/core-net/client/connect4.c

@@ -135,7 +135,7 @@ lws_client_connect_4_established(struct lws *wsi, struct lws *wsi_piggyback,
 
 send_hs:
 
-#if defined(LWS_ROLE_H1) || defined(LWS_ROLE_H2)
+#if defined(LWS_ROLE_H1) || defined(LWS_ROLE_H2) || defined(LWS_ROLE_H3)
 	if (wsi_piggyback &&
 	    !lws_dll2_is_detached(&wsi->dll2_cli_txn_queue)) {
 		/*
@@ -250,7 +250,11 @@ lws_client_connect_4_established(struct lws *wsi, struct lws *wsi_piggyback,
 #if defined(LWS_ROLE_QUIC)
 			if ((meth && !strcmp(meth, "QUIC")) ||
 			    !strcmp(wsi->role_ops->name, "quic")) {
-				lwsi_set_state(wsi, LRS_WAITING_SSL);
+				if (wsi->quic.migrate_from_wsi) {
+					lwsi_set_state(wsi, LRS_ESTABLISHED);
+				} else {
+					lwsi_set_state(wsi, LRS_WAITING_SSL);
+				}
 				wsi->hdr_parsing_completed = 1;
 				lws_callback_on_writable(wsi);
 				return wsi;

lib/core-net/close.c

@@ -507,7 +507,14 @@ __lws_close_free_wsi(struct lws *wsi, enum lws_close_status reason,
 
 #if defined(LWS_WITH_CLIENT)
 #if defined(LWS_WITH_TLS_SESSIONS) && defined(LWS_WITH_GNUTLS)
-	lws_tls_session_new_gnutls(wsi);
+	/*
+	 * For multiplexed connections (H3/H2), the TLS session belongs
+	 * to the network-level WSI, not to individual stream WSIs.  Don't
+	 * perform the (expensive) session ticket snapshot on every mux
+	 * substream close — only on the actual network wsi.
+	 */
+	if (!wsi->client_mux_substream)
+		lws_tls_session_new_gnutls(wsi);
 #endif
 
 	lws_free_set_NULL(wsi->cli_hostname_copy);

lib/core-net/private-lib-core-net.h

@@ -540,6 +540,8 @@ struct lws_vhost {
 
 	uint64_t options;
 
+	const char *quic_preferred_addresses;
+
 	struct lws_context *context;
 	struct lws_vhost *vhost_next;
 

lib/core-net/service.c

@@ -677,8 +677,6 @@ lws_service_flag_pending(struct lws_context *context, int tsi)
 
 		if (!lws_is_flowcontrolled(wsi) &&
 		    lwsi_state(wsi) != LRS_DEFERRING_ACTION &&
-		    lwsi_state(wsi) != LRS_ISSUING_FILE &&
-		    lwsi_state(wsi) != LRS_DOING_TRANSACTION &&
 		    lwsi_state(wsi) != LRS_AWAITING_FILE_READ &&
 		    lwsi_state(wsi) != LRS_AWAITING_SSL_ACCEPT) {
 			forced = 1;

lib/core-net/vhost.c

@@ -835,8 +835,9 @@ lws_create_vhost(struct lws_context *context,
 			vh->count_protocols++)
 				;
 
-	vh->options			= info->options;
-	vh->pvo				= info->pvo;
+	vh->options                     = info->options;
+	vh->quic_preferred_addresses    = info->quic_preferred_addresses;
+	vh->pvo                         = info->pvo;
 #if defined(LWS_ROLE_H1) || defined(LWS_ROLE_H2)
 	vh->headers			= info->headers;
 #endif
@@ -879,8 +880,8 @@ lws_create_vhost(struct lws_context *context,
 	if (info->tls1_3_plus_cipher_list)
 		vh->tls.cfg_tls1_3_plus_cipher_list = lws_strdup(info->tls1_3_plus_cipher_list);
 #if defined(LWS_WITH_CLIENT)
-	if (info->client_ssl_cipher_list)
-		vh->tls.cfg_tls_client_cipher_list = lws_strdup(info->client_ssl_cipher_list);
+        if (info->client_ssl_cipher_list)
+                vh->tls.cfg_tls_client_cipher_list = lws_strdup(info->client_ssl_cipher_list);
 #endif
 	if (info->tls_ciphers_iana)
 		vh->tls.cfg_tls_ciphers_iana = lws_strdup(info->tls_ciphers_iana);
@@ -2101,7 +2102,7 @@ lws_vhost_active_conns(struct lws *wsi, struct lws **nwsi, const char *adsin)
 			 * h2: if in usable state already: just use it without
 			 *     going through the queue
 			 */
-			if (w->client_h2_alpn && w->client_mux_migrated &&
+			if (lwsi_role_h2(w) && w->client_h2_alpn && w->client_mux_migrated &&
 			    (lwsi_state(w) == LRS_H2_WAITING_TO_SEND_HEADERS ||
 			     lwsi_state(w) == LRS_ESTABLISHED ||
 			     lwsi_state(w) == LRS_IDLING)) {
@@ -2130,14 +2131,15 @@ lws_vhost_active_conns(struct lws *wsi, struct lws **nwsi, const char *adsin)
 			 * h3: if in usable state already: just use it without
 			 *     going through the queue
 			 */
-			if (lwsi_role_h3(w) && w->client_h2_alpn && w->client_mux_migrated &&
+			if ((w->role_ops && !strcmp(w->role_ops->name, "quic")) && w->client_h2_alpn && w->client_mux_migrated &&
 			    (lwsi_state(w) == LRS_H2_WAITING_TO_SEND_HEADERS ||
 			     lwsi_state(w) == LRS_ESTABLISHED ||
 			     lwsi_state(w) == LRS_IDLING)) {
 
 				lwsl_wsi_info(w, "just join h3 directly 0x%x",
 						   lwsi_state(w));
 
+
 				if (lwsi_state(w) == LRS_IDLING)
 					_lws_generic_transaction_completed_active_conn(&w, 0);
 

lib/core-net/wsi.c

@@ -608,8 +608,7 @@ int lws_has_buffered_out(struct lws *wsi) {
 				lws_start_foreach_dll_safe(struct lws_dll2 *, d, d1, qn->pending_tx[i].head) {
 					struct lws_quic_tx_frame *f = lws_container_of(d, struct lws_quic_tx_frame, list);
 					if (((f->type & 0xf8) == LWS_QUIC_FT_STREAM && f->stream_id == sid) ||
-					    (f->type == LWS_QUIC_FT_STREAM_DATA_BLOCKED && f->stream_id == sid) ||
-					    f->type == LWS_QUIC_FT_DATA_BLOCKED) {
+					    (f->type == LWS_QUIC_FT_STREAM_DATA_BLOCKED && f->stream_id == sid)) {
 						lwsl_notice("lws_has_buffered_out: %s has pending_tx stream/blocked frame on sid %llu\n", lws_wsi_tag(wsi), (unsigned long long)sid);
 						return 1;
 					}
@@ -618,8 +617,7 @@ int lws_has_buffered_out(struct lws *wsi) {
 				lws_start_foreach_dll_safe(struct lws_dll2 *, d, d1, qn->in_flight[i].head) {
 					struct lws_quic_tx_frame *f = lws_container_of(d, struct lws_quic_tx_frame, list);
 					if (((f->type & 0xf8) == LWS_QUIC_FT_STREAM && f->stream_id == sid) ||
-					    (f->type == LWS_QUIC_FT_STREAM_DATA_BLOCKED && f->stream_id == sid) ||
-					    f->type == LWS_QUIC_FT_DATA_BLOCKED) {
+					    (f->type == LWS_QUIC_FT_STREAM_DATA_BLOCKED && f->stream_id == sid)) {
 						lwsl_notice("lws_has_buffered_out: %s has in_flight stream/blocked frame on sid %llu\n", lws_wsi_tag(wsi), (unsigned long long)sid);
 						return 1;
 					}
@@ -1511,7 +1509,7 @@ int lws_wsi_mux_mark_parents_needing_writeable(struct lws *wsi) {
 	wsi2 = wsi;
 	while (wsi2) {
 		wsi2->mux.requested_POLLOUT = 1;
-		lwsl_wsi_info(wsi2, "sid %u, pending writable", wsi2->mux.my_sid);
+		lwsl_wsi_debug(wsi2, "sid %u, pending writable", wsi2->mux.my_sid);
 		wsi2 = wsi2->mux.parent_wsi;
 	}
 
@@ -1650,6 +1648,8 @@ int lws_wsi_mux_apply_queue(struct lws *wsi) {
 
 		lwsl_wsi_notice(wsi, "evaluating queued conn %s (state 0x%x, par role %s)",
 				lws_wsi_tag(w), lwsi_state(w), wsi->role_ops ? wsi->role_ops->name : "none");
+        lwsl_notice("AGY-MUX: parent role=%s, child state=0x%x (expected 0x%x)\n",
+                wsi->role_ops ? wsi->role_ops->name : "none", lwsi_state(w), LRS_H2_WAITING_TO_SEND_HEADERS);
 
 #if defined(LWS_ROLE_H2)
 		if (lwsi_role_h2(wsi) &&
@@ -1669,7 +1669,7 @@ int lws_wsi_mux_apply_queue(struct lws *wsi) {
 #endif
 
 #if defined(LWS_ROLE_H3)
-		if ((wsi->role_ops && !strcmp(wsi->role_ops->name, "quic")) &&
+		if ((wsi->role_ops && (!strcmp(wsi->role_ops->name, "quic") || !strcmp(wsi->role_ops->name, "h3"))) &&
 				lwsi_state(w) == LRS_H2_WAITING_TO_SEND_HEADERS) {
 
 			if (!lws_wsi_h3_can_adopt(wsi)) {