Merge branch 'main' into fix-send-buffer

Author: rklaehn

.github/workflows/ci.yml

@@ -6,7 +6,7 @@ on:
   merge_group:
   push:
     branches:
-      - main-iroh
+      - main
 
 concurrency:
   group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}

.github/workflows/codecov.yml

@@ -3,7 +3,7 @@ name: Coverage
 on:
   pull_request:
   push:
-    branches: ['main-iroh']
+    branches: ['main']
 
 jobs:
   coverage:
@@ -37,4 +37,4 @@ jobs:
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: lcov.info
-          fail_ci_if_error: false
+          fail_ci_if_error: false

.github/workflows/tests.yaml

@@ -254,6 +254,26 @@ jobs:
       - name: Install cmake
         uses: lukka/get-cmake@latest
 
+      # Install LLVM for libclang (required by bindgen for aws-lc-fips-sys)
+      - name: Cache LLVM
+        id: cache-llvm
+        uses: actions/cache@v4
+        with:
+          path: C:\Program Files\LLVM
+          key: llvm-17.0.6-windows
+
+      - name: Install LLVM
+        if: steps.cache-llvm.outputs.cache-hit != 'true'
+        run: |
+          $llvmUrl = "https://github.com/llvm/llvm-project/releases/download/llvmorg-17.0.6/LLVM-17.0.6-win64.exe"
+          Invoke-WebRequest -Uri $llvmUrl -OutFile llvm-installer.exe
+          Start-Process -FilePath .\llvm-installer.exe -ArgumentList "/S" -Wait
+
+      - name: Add LLVM to PATH
+        run: |
+          echo "C:\Program Files\LLVM\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+          echo "LIBCLANG_PATH=C:\Program Files\LLVM\bin" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+
       - name: build tests
         run: |
           cargo nextest run --workspace --exclude fuzz ${{ env.FEATURES }} --lib --bins --tests --target ${{ matrix.target }} --no-run

CONTRIBUTING.md

@@ -0,0 +1,7 @@
+# Contributing
+
+
+## Git Branches
+
+- `main`: development
+- `main-quinn`: tracks upstream quinn

LICENSE-APACHE

@@ -186,7 +186,8 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright [yyyy] [name of copyright owner]
+   Copyright [2025] [The quinn developers]
+   Copyright [2025] [N0, Inc]
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

LICENSE-MIT

@@ -1,4 +1,5 @@
-Copyright (c) 2018 The quinn Developers
+Copyright (c) 2018-2025 The quinn Developers
+Copyright (c) 2025 N0, Inc.
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
 

README.md

@@ -1,4 +1,17 @@
-# Quinn fork of iroh
+# Iroh Quinn
+
+> This is a fork based on [quinn](https://github.com/quinn-rs/quinn), maintained
+> by [n0](https://github.com/n0-computer). Currently published to crates.io under
+> `iroh-quinn`.
+
+## Main differences to upstream quinn
+
+- Small API improvements
+- Implements additional QUIC extensions
+  - Multipath
+  - QAD
+  - QNT
+- Expanded support for QLOG
 
 Quinn is a pure-rust, async-compatible implementation of the IETF
 [QUIC][quic] transport protocol.
@@ -12,55 +25,21 @@ Quinn is a pure-rust, async-compatible implementation of the IETF
 - Future-based async API
 - Minimum supported Rust version of 1.83.0
 
-This is a fork incorporating some changes for use in iroh.  The aim is
-to contribute back any generally useful changes into upstream Quinn,
-so it is strongly discouraged to use this fork directly.
-
-
-## Git branches
-
-The upstream branches are kept unmodified and get occasionally synced
-(e.g. our `main` branch tracks `upstream/main` with a small delay).
-The iroh-specific branches are:
-
-- `iroh-0.10.x` is the branch for [email protected] series.
-- `iroh-0.11.x` is the branch for [email protected] series.
-
-The default branch should be set the currently actively used branch by
-iroh.
-
-### Updating a branch
-
-To update a branch to include the upstream changes, merge the upstream
-branch.  E.g. when upstream is `main` and the current iroh branch is
-`iroh-0.11.x`:
-
-- Check which commits are new in main.
-
-  Using *magit*: `magit-cherry` (Y), from `main` to `iroh-0.11.x`
-
-- Find the commit to merge.
-
-  You probably want to find the last released commit on the `main`
-  branch, which might not be the last commit on main.  So you need to
-  find the commit hash as you can't use "main" in this case.
 
-- Merge this commit: `git merge abc123`
+## License
 
-- You can check the log and cherries again to see if the right commits
-  are left in main.
+Copyright 2025 The quinn developers
+Copyright 2025 N0, INC.
 
-### Upstream versions
+This project is licensed under either of
 
-Usually we only try to merge tagged upstream versions. Currently (as
-of the 0.13 iroh-quinn release) we've released work that hasn't been
-released upstream yet.
+ * Apache License, Version 2.0, ([LICENSE-APACHE](LICENSE-APACHE) or
+   http://www.apache.org/licenses/LICENSE-2.0)
+ * MIT license ([LICENSE-MIT](LICENSE-MIT) or
+   http://opensource.org/licenses/MIT)
 
-In the normal case, you'd be able to check the current matching
-upstream version by running:
+at your option.
 
-`git tag --merged`
+## Contribution
 
-This shows all the tags which are in the ancestors of HEAD.  Look for
-the highest `quinn`, `quinn-proto` and `quinn-udp` tags which are
-found in all the ancestor commits.
+Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in this project by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.

quinn-proto/src/connection/mod.rs

@@ -821,31 +821,23 @@ impl Connection {
         &mut self.paths.get_mut(&path_id).expect("known path").data
     }
 
-    /// Check if the remote has been validated in any active path
-    fn is_remote_validated(&self, remote: SocketAddr) -> bool {
-        self.paths
-            .values()
-            .any(|path_state| path_state.data.remote == remote && path_state.data.validated)
-        // TODO(@divma): we might want to ensure the path has been recently active to consider the
-        // address validated
-    }
-
     fn ensure_path(
         &mut self,
         path_id: PathId,
         remote: SocketAddr,
         now: Instant,
         pn: Option<u64>,
     ) -> &mut PathData {
-        let validated = self.is_remote_validated(remote);
         let vacant_entry = match self.paths.entry(path_id) {
             btree_map::Entry::Vacant(vacant_entry) => vacant_entry,
             btree_map::Entry::Occupied(occupied_entry) => {
                 return &mut occupied_entry.into_mut().data;
             }
         };
 
-        debug!(%validated, %path_id, ?remote, "path added");
+        // TODO(matheus23): Add back short-circuiting path.validated = true, if we know that the
+        // path's four-tuple was already validated.
+        debug!(%path_id, ?remote, "path added");
         let peer_max_udp_payload_size =
             u16::try_from(self.peer_params.max_udp_payload_size.into_inner()).unwrap_or(u16::MAX);
         self.path_counter = self.path_counter.wrapping_add(1);
@@ -858,8 +850,6 @@ impl Connection {
             &self.config,
         );
 
-        data.validated = validated;
-
         let pto = self.ack_frequency.max_ack_delay_for_pto() + data.rtt.pto_base();
         self.timers.set(
             Timer::PerPath(path_id, PathTimer::PathOpen),
@@ -4288,44 +4278,30 @@ impl Connection {
                         .get_mut(&path_id)
                         .expect("payload is processed only after the path becomes known");
 
-                    match path.data.challenges_sent.get(&response.0) {
-                        // Response to an on-path PathChallenge
-                        Some(info) if info.remote == remote && path.data.remote == remote => {
-                            let sent_instant = info.sent_instant;
-                            // TODO(@divma): reset timers using the remaining off-path challenges
-                            self.timers.stop(
-                                Timer::PerPath(path_id, PathTimer::PathValidation),
-                                self.qlog.with_time(now),
-                            );
-                            self.timers.stop(
-                                Timer::PerPath(path_id, PathTimer::PathChallengeLost),
-                                self.qlog.with_time(now),
+                    use PathTimer::*;
+                    use paths::OnPathResponseReceived::*;
+                    match path.data.on_path_response_received(now, response.0, remote) {
+                        OnPath { was_open } => {
+                            let qlog = self.qlog.with_time(now);
+
+                            self.timers
+                                .stop(Timer::PerPath(path_id, PathValidation), qlog.clone());
+                            self.timers
+                                .stop(Timer::PerPath(path_id, PathOpen), qlog.clone());
+
+                            let next_challenge = path
+                                .data
+                                .earliest_expiring_challenge()
+                                .map(|time| time + self.ack_frequency.max_ack_delay_for_pto());
+                            self.timers.set_or_stop(
+                                Timer::PerPath(path_id, PathChallengeLost),
+                                next_challenge,
+                                qlog,
                             );
-                            if !path.data.validated {
-                                trace!("new path validated");
-                            }
-                            self.timers.stop(
-                                Timer::PerPath(path_id, PathTimer::PathOpen),
-                                self.qlog.with_time(now),
-                            );
-                            // Clear any other on-path sent challenge.
-                            path.data
-                                .challenges_sent
-                                .retain(|_token, info| info.remote != remote);
-                            path.data.send_new_challenge = false;
-                            path.data.validated = true;
-
-                            // This RTT can only be used for the initial RTT, not as a normal
-                            // sample: https://www.rfc-editor.org/rfc/rfc9002#section-6.2.2-2.
-                            let rtt = now.saturating_duration_since(sent_instant);
-                            path.data.rtt.reset_initial_rtt(rtt);
-
-                            self.events
-                                .push_back(Event::Path(PathEvent::Opened { id: path_id }));
-                            // mark the path as open from the application perspective now that Opened
-                            // event has been queued
-                            if !std::mem::replace(&mut path.data.open, true) {
-                                trace!("path opened");
+
+                            if !was_open {
+                                self.events
+                                    .push_back(Event::Path(PathEvent::Opened { id: path_id }));
                                 if let Some(observed) = path.data.last_observed_addr_report.as_ref()
                                 {
                                     self.events.push_back(Event::Path(PathEvent::ObservedAddr {
@@ -4339,19 +4315,22 @@ impl Connection {
                                 prev.send_new_challenge = false;
                             }
                         }
-                        // Response to an off-path PathChallenge
-                        Some(info) if info.remote == remote => {
+                        OffPath => {
                             debug!("Response to off-path PathChallenge!");
-                            path.data
-                                .challenges_sent
-                                .retain(|_token, info| info.remote != remote);
+                            let next_challenge = path
+                                .data
+                                .earliest_expiring_challenge()
+                                .map(|time| time + self.ack_frequency.max_ack_delay_for_pto());
+                            self.timers.set_or_stop(
+                                Timer::PerPath(path_id, PathChallengeLost),
+                                next_challenge,
+                                self.qlog.with_time(now),
+                            );
                         }
-                        // Response to a PathChallenge we recognize, but from an invalid remote
-                        Some(info) => {
-                            debug!(%response, from=%remote, expected=%info.remote, "ignoring invalid PATH_RESPONSE")
+                        Invalid { expected } => {
+                            debug!(%response, from=%remote, %expected, "ignoring invalid PATH_RESPONSE")
                         }
-                        // Response to an unknown PathChallenge
-                        None => debug!(%response, "ignoring invalid PATH_RESPONSE"),
+                        Unknown => debug!(%response, "ignoring invalid PATH_RESPONSE"),
                     }
                 }
                 Frame::MaxData(bytes) => {
@@ -6273,6 +6252,10 @@ impl Connection {
         &mut self,
         now: Instant,
     ) -> Result<Vec<SocketAddr>, iroh_hp::Error> {
+        if self.state.is_closed() {
+            return Err(iroh_hp::Error::Closed);
+        }
+
         let client_state = self.iroh_hp.client_side_mut()?;
         let iroh_hp::NatTraversalRound {
             new_round,