use go 1.12

Signed-off-by: hongming <talonwan@yunify.com>

vendor/github.com/lucas-clemente/quic-go/internal/ackhandler/gen.go

@@ -0,0 +1,3 @@
+package ackhandler
+
+//go:generate genny -pkg ackhandler -in ../utils/linkedlist/linkedlist.go -out packet_linkedlist.go gen Item=Packet

vendor/github.com/lucas-clemente/quic-go/internal/ackhandler/interfaces.go

@@ -0,0 +1,47 @@
+package ackhandler
+
+import (
+	"time"
+
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+	"github.com/lucas-clemente/quic-go/internal/wire"
+)
+
+// SentPacketHandler handles ACKs received for outgoing packets
+type SentPacketHandler interface {
+	// SentPacket may modify the packet
+	SentPacket(packet *Packet)
+	SentPacketsAsRetransmission(packets []*Packet, retransmissionOf protocol.PacketNumber)
+	ReceivedAck(ackFrame *wire.AckFrame, withPacketNumber protocol.PacketNumber, encLevel protocol.EncryptionLevel, recvTime time.Time) error
+	SetHandshakeComplete()
+
+	// The SendMode determines if and what kind of packets can be sent.
+	SendMode() SendMode
+	// TimeUntilSend is the time when the next packet should be sent.
+	// It is used for pacing packets.
+	TimeUntilSend() time.Time
+	// ShouldSendNumPackets returns the number of packets that should be sent immediately.
+	// It always returns a number greater or equal than 1.
+	// A number greater than 1 is returned when the pacing delay is smaller than the minimum pacing delay.
+	// Note that the number of packets is only calculated based on the pacing algorithm.
+	// Before sending any packet, SendingAllowed() must be called to learn if we can actually send it.
+	ShouldSendNumPackets() int
+
+	GetStopWaitingFrame(force bool) *wire.StopWaitingFrame
+	GetLowestPacketNotConfirmedAcked() protocol.PacketNumber
+	DequeuePacketForRetransmission() *Packet
+	DequeueProbePacket() (*Packet, error)
+	GetPacketNumberLen(protocol.PacketNumber) protocol.PacketNumberLen
+
+	GetAlarmTimeout() time.Time
+	OnAlarm() error
+}
+
+// ReceivedPacketHandler handles ACKs needed to send for incoming packets
+type ReceivedPacketHandler interface {
+	ReceivedPacket(packetNumber protocol.PacketNumber, rcvTime time.Time, shouldInstigateAck bool) error
+	IgnoreBelow(protocol.PacketNumber)
+
+	GetAlarmTimeout() time.Time
+	GetAckFrame() *wire.AckFrame
+}

vendor/github.com/lucas-clemente/quic-go/internal/ackhandler/packet.go

@@ -0,0 +1,29 @@
+package ackhandler
+
+import (
+	"time"
+
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+	"github.com/lucas-clemente/quic-go/internal/wire"
+)
+
+// A Packet is a packet
+type Packet struct {
+	PacketNumber    protocol.PacketNumber
+	PacketType      protocol.PacketType
+	Frames          []wire.Frame
+	Length          protocol.ByteCount
+	EncryptionLevel protocol.EncryptionLevel
+	SendTime        time.Time
+
+	largestAcked protocol.PacketNumber // if the packet contains an ACK, the LargestAcked value of that ACK
+
+	// There are two reasons why a packet cannot be retransmitted:
+	// * it was already retransmitted
+	// * this packet is a retransmission, and we already received an ACK for the original packet
+	canBeRetransmitted      bool
+	includedInBytesInFlight bool
+	retransmittedAs         []protocol.PacketNumber
+	isRetransmission        bool // we need a separate bool here because 0 is a valid packet number
+	retransmissionOf        protocol.PacketNumber
+}

vendor/github.com/lucas-clemente/quic-go/internal/ackhandler/packet_linkedlist.go

@@ -0,0 +1,217 @@
+// This file was automatically generated by genny.
+// Any changes will be lost if this file is regenerated.
+// see https://github.com/cheekybits/genny
+
+package ackhandler
+
+// Linked list implementation from the Go standard library.
+
+// PacketElement is an element of a linked list.
+type PacketElement struct {
+	// Next and previous pointers in the doubly-linked list of elements.
+	// To simplify the implementation, internally a list l is implemented
+	// as a ring, such that &l.root is both the next element of the last
+	// list element (l.Back()) and the previous element of the first list
+	// element (l.Front()).
+	next, prev *PacketElement
+
+	// The list to which this element belongs.
+	list *PacketList
+
+	// The value stored with this element.
+	Value Packet
+}
+
+// Next returns the next list element or nil.
+func (e *PacketElement) Next() *PacketElement {
+	if p := e.next; e.list != nil && p != &e.list.root {
+		return p
+	}
+	return nil
+}
+
+// Prev returns the previous list element or nil.
+func (e *PacketElement) Prev() *PacketElement {
+	if p := e.prev; e.list != nil && p != &e.list.root {
+		return p
+	}
+	return nil
+}
+
+// PacketList is a linked list of Packets.
+type PacketList struct {
+	root PacketElement // sentinel list element, only &root, root.prev, and root.next are used
+	len  int           // current list length excluding (this) sentinel element
+}
+
+// Init initializes or clears list l.
+func (l *PacketList) Init() *PacketList {
+	l.root.next = &l.root
+	l.root.prev = &l.root
+	l.len = 0
+	return l
+}
+
+// NewPacketList returns an initialized list.
+func NewPacketList() *PacketList { return new(PacketList).Init() }
+
+// Len returns the number of elements of list l.
+// The complexity is O(1).
+func (l *PacketList) Len() int { return l.len }
+
+// Front returns the first element of list l or nil if the list is empty.
+func (l *PacketList) Front() *PacketElement {
+	if l.len == 0 {
+		return nil
+	}
+	return l.root.next
+}
+
+// Back returns the last element of list l or nil if the list is empty.
+func (l *PacketList) Back() *PacketElement {
+	if l.len == 0 {
+		return nil
+	}
+	return l.root.prev
+}
+
+// lazyInit lazily initializes a zero List value.
+func (l *PacketList) lazyInit() {
+	if l.root.next == nil {
+		l.Init()
+	}
+}
+
+// insert inserts e after at, increments l.len, and returns e.
+func (l *PacketList) insert(e, at *PacketElement) *PacketElement {
+	n := at.next
+	at.next = e
+	e.prev = at
+	e.next = n
+	n.prev = e
+	e.list = l
+	l.len++
+	return e
+}
+
+// insertValue is a convenience wrapper for insert(&Element{Value: v}, at).
+func (l *PacketList) insertValue(v Packet, at *PacketElement) *PacketElement {
+	return l.insert(&PacketElement{Value: v}, at)
+}
+
+// remove removes e from its list, decrements l.len, and returns e.
+func (l *PacketList) remove(e *PacketElement) *PacketElement {
+	e.prev.next = e.next
+	e.next.prev = e.prev
+	e.next = nil // avoid memory leaks
+	e.prev = nil // avoid memory leaks
+	e.list = nil
+	l.len--
+	return e
+}
+
+// Remove removes e from l if e is an element of list l.
+// It returns the element value e.Value.
+// The element must not be nil.
+func (l *PacketList) Remove(e *PacketElement) Packet {
+	if e.list == l {
+		// if e.list == l, l must have been initialized when e was inserted
+		// in l or l == nil (e is a zero Element) and l.remove will crash
+		l.remove(e)
+	}
+	return e.Value
+}
+
+// PushFront inserts a new element e with value v at the front of list l and returns e.
+func (l *PacketList) PushFront(v Packet) *PacketElement {
+	l.lazyInit()
+	return l.insertValue(v, &l.root)
+}
+
+// PushBack inserts a new element e with value v at the back of list l and returns e.
+func (l *PacketList) PushBack(v Packet) *PacketElement {
+	l.lazyInit()
+	return l.insertValue(v, l.root.prev)
+}
+
+// InsertBefore inserts a new element e with value v immediately before mark and returns e.
+// If mark is not an element of l, the list is not modified.
+// The mark must not be nil.
+func (l *PacketList) InsertBefore(v Packet, mark *PacketElement) *PacketElement {
+	if mark.list != l {
+		return nil
+	}
+	// see comment in List.Remove about initialization of l
+	return l.insertValue(v, mark.prev)
+}
+
+// InsertAfter inserts a new element e with value v immediately after mark and returns e.
+// If mark is not an element of l, the list is not modified.
+// The mark must not be nil.
+func (l *PacketList) InsertAfter(v Packet, mark *PacketElement) *PacketElement {
+	if mark.list != l {
+		return nil
+	}
+	// see comment in List.Remove about initialization of l
+	return l.insertValue(v, mark)
+}
+
+// MoveToFront moves element e to the front of list l.
+// If e is not an element of l, the list is not modified.
+// The element must not be nil.
+func (l *PacketList) MoveToFront(e *PacketElement) {
+	if e.list != l || l.root.next == e {
+		return
+	}
+	// see comment in List.Remove about initialization of l
+	l.insert(l.remove(e), &l.root)
+}
+
+// MoveToBack moves element e to the back of list l.
+// If e is not an element of l, the list is not modified.
+// The element must not be nil.
+func (l *PacketList) MoveToBack(e *PacketElement) {
+	if e.list != l || l.root.prev == e {
+		return
+	}
+	// see comment in List.Remove about initialization of l
+	l.insert(l.remove(e), l.root.prev)
+}
+
+// MoveBefore moves element e to its new position before mark.
+// If e or mark is not an element of l, or e == mark, the list is not modified.
+// The element and mark must not be nil.
+func (l *PacketList) MoveBefore(e, mark *PacketElement) {
+	if e.list != l || e == mark || mark.list != l {
+		return
+	}
+	l.insert(l.remove(e), mark.prev)
+}
+
+// MoveAfter moves element e to its new position after mark.
+// If e or mark is not an element of l, or e == mark, the list is not modified.
+// The element and mark must not be nil.
+func (l *PacketList) MoveAfter(e, mark *PacketElement) {
+	if e.list != l || e == mark || mark.list != l {
+		return
+	}
+	l.insert(l.remove(e), mark)
+}
+
+// PushBackList inserts a copy of an other list at the back of list l.
+// The lists l and other may be the same. They must not be nil.
+func (l *PacketList) PushBackList(other *PacketList) {
+	l.lazyInit()
+	for i, e := other.Len(), other.Front(); i > 0; i, e = i-1, e.Next() {
+		l.insertValue(e.Value, l.root.prev)
+	}
+}
+
+// PushFrontList inserts a copy of an other list at the front of list l.
+// The lists l and other may be the same. They must not be nil.
+func (l *PacketList) PushFrontList(other *PacketList) {
+	l.lazyInit()
+	for i, e := other.Len(), other.Back(); i > 0; i, e = i-1, e.Prev() {
+		l.insertValue(e.Value, &l.root)
+	}
+}

vendor/github.com/lucas-clemente/quic-go/internal/ackhandler/received_packet_handler.go

@@ -0,0 +1,215 @@
+package ackhandler
+
+import (
+	"time"
+
+	"github.com/lucas-clemente/quic-go/internal/congestion"
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+	"github.com/lucas-clemente/quic-go/internal/utils"
+	"github.com/lucas-clemente/quic-go/internal/wire"
+)
+
+type receivedPacketHandler struct {
+	largestObserved             protocol.PacketNumber
+	ignoreBelow                 protocol.PacketNumber
+	largestObservedReceivedTime time.Time
+
+	packetHistory *receivedPacketHistory
+
+	ackSendDelay time.Duration
+	rttStats     *congestion.RTTStats
+
+	packetsReceivedSinceLastAck                int
+	retransmittablePacketsReceivedSinceLastAck int
+	ackQueued                                  bool
+	ackAlarm                                   time.Time
+	lastAck                                    *wire.AckFrame
+
+	logger utils.Logger
+
+	version protocol.VersionNumber
+}
+
+const (
+	// maximum delay that can be applied to an ACK for a retransmittable packet
+	ackSendDelay = 25 * time.Millisecond
+	// initial maximum number of retransmittable packets received before sending an ack.
+	initialRetransmittablePacketsBeforeAck = 2
+	// number of retransmittable that an ACK is sent for
+	retransmittablePacketsBeforeAck = 10
+	// 1/5 RTT delay when doing ack decimation
+	ackDecimationDelay = 1.0 / 4
+	// 1/8 RTT delay when doing ack decimation
+	shortAckDecimationDelay = 1.0 / 8
+	// Minimum number of packets received before ack decimation is enabled.
+	// This intends to avoid the beginning of slow start, when CWNDs may be
+	// rapidly increasing.
+	minReceivedBeforeAckDecimation = 100
+	// Maximum number of packets to ack immediately after a missing packet for
+	// fast retransmission to kick in at the sender.  This limit is created to
+	// reduce the number of acks sent that have no benefit for fast retransmission.
+	// Set to the number of nacks needed for fast retransmit plus one for protection
+	// against an ack loss
+	maxPacketsAfterNewMissing = 4
+)
+
+// NewReceivedPacketHandler creates a new receivedPacketHandler
+func NewReceivedPacketHandler(
+	rttStats *congestion.RTTStats,
+	logger utils.Logger,
+	version protocol.VersionNumber,
+) ReceivedPacketHandler {
+	return &receivedPacketHandler{
+		packetHistory: newReceivedPacketHistory(),
+		ackSendDelay:  ackSendDelay,
+		rttStats:      rttStats,
+		logger:        logger,
+		version:       version,
+	}
+}
+
+func (h *receivedPacketHandler) ReceivedPacket(packetNumber protocol.PacketNumber, rcvTime time.Time, shouldInstigateAck bool) error {
+	if packetNumber < h.ignoreBelow {
+		return nil
+	}
+
+	isMissing := h.isMissing(packetNumber)
+	if packetNumber > h.largestObserved {
+		h.largestObserved = packetNumber
+		h.largestObservedReceivedTime = rcvTime
+	}
+
+	if err := h.packetHistory.ReceivedPacket(packetNumber); err != nil {
+		return err
+	}
+	h.maybeQueueAck(packetNumber, rcvTime, shouldInstigateAck, isMissing)
+	return nil
+}
+
+// IgnoreBelow sets a lower limit for acking packets.
+// Packets with packet numbers smaller than p will not be acked.
+func (h *receivedPacketHandler) IgnoreBelow(p protocol.PacketNumber) {
+	if p <= h.ignoreBelow {
+		return
+	}
+	h.ignoreBelow = p
+	h.packetHistory.DeleteBelow(p)
+	if h.logger.Debug() {
+		h.logger.Debugf("\tIgnoring all packets below %#x.", p)
+	}
+}
+
+// isMissing says if a packet was reported missing in the last ACK.
+func (h *receivedPacketHandler) isMissing(p protocol.PacketNumber) bool {
+	if h.lastAck == nil || p < h.ignoreBelow {
+		return false
+	}
+	return p < h.lastAck.LargestAcked() && !h.lastAck.AcksPacket(p)
+}
+
+func (h *receivedPacketHandler) hasNewMissingPackets() bool {
+	if h.lastAck == nil {
+		return false
+	}
+	highestRange := h.packetHistory.GetHighestAckRange()
+	return highestRange.Smallest >= h.lastAck.LargestAcked() && highestRange.Len() <= maxPacketsAfterNewMissing
+}
+
+// maybeQueueAck queues an ACK, if necessary.
+// It is implemented analogously to Chrome's QuicConnection::MaybeQueueAck()
+// in ACK_DECIMATION_WITH_REORDERING mode.
+func (h *receivedPacketHandler) maybeQueueAck(packetNumber protocol.PacketNumber, rcvTime time.Time, shouldInstigateAck, wasMissing bool) {
+	h.packetsReceivedSinceLastAck++
+
+	// always ack the first packet
+	if h.lastAck == nil {
+		h.logger.Debugf("\tQueueing ACK because the first packet should be acknowledged.")
+		h.ackQueued = true
+		return
+	}
+
+	// Send an ACK if this packet was reported missing in an ACK sent before.
+	// Ack decimation with reordering relies on the timer to send an ACK, but if
+	// missing packets we reported in the previous ack, send an ACK immediately.
+	if wasMissing {
+		if h.logger.Debug() {
+			h.logger.Debugf("\tQueueing ACK because packet %#x was missing before.", packetNumber)
+		}
+		h.ackQueued = true
+	}
+
+	if !h.ackQueued && shouldInstigateAck {
+		h.retransmittablePacketsReceivedSinceLastAck++
+
+		if packetNumber > minReceivedBeforeAckDecimation {
+			// ack up to 10 packets at once
+			if h.retransmittablePacketsReceivedSinceLastAck >= retransmittablePacketsBeforeAck {
+				h.ackQueued = true
+				if h.logger.Debug() {
+					h.logger.Debugf("\tQueueing ACK because packet %d packets were received after the last ACK (using threshold: %d).", h.retransmittablePacketsReceivedSinceLastAck, retransmittablePacketsBeforeAck)
+				}
+			} else if h.ackAlarm.IsZero() {
+				// wait for the minimum of the ack decimation delay or the delayed ack time before sending an ack
+				ackDelay := utils.MinDuration(ackSendDelay, time.Duration(float64(h.rttStats.MinRTT())*float64(ackDecimationDelay)))
+				h.ackAlarm = rcvTime.Add(ackDelay)
+				if h.logger.Debug() {
+					h.logger.Debugf("\tSetting ACK timer to min(1/4 min-RTT, max ack delay): %s (%s from now)", ackDelay, time.Until(h.ackAlarm))
+				}
+			}
+		} else {
+			// send an ACK every 2 retransmittable packets
+			if h.retransmittablePacketsReceivedSinceLastAck >= initialRetransmittablePacketsBeforeAck {
+				if h.logger.Debug() {
+					h.logger.Debugf("\tQueueing ACK because packet %d packets were received after the last ACK (using initial threshold: %d).", h.retransmittablePacketsReceivedSinceLastAck, initialRetransmittablePacketsBeforeAck)
+				}
+				h.ackQueued = true
+			} else if h.ackAlarm.IsZero() {
+				if h.logger.Debug() {
+					h.logger.Debugf("\tSetting ACK timer to max ack delay: %s", ackSendDelay)
+				}
+				h.ackAlarm = rcvTime.Add(ackSendDelay)
+			}
+		}
+		// If there are new missing packets to report, set a short timer to send an ACK.
+		if h.hasNewMissingPackets() {
+			// wait the minimum of 1/8 min RTT and the existing ack time
+			ackDelay := time.Duration(float64(h.rttStats.MinRTT()) * float64(shortAckDecimationDelay))
+			ackTime := rcvTime.Add(ackDelay)
+			if h.ackAlarm.IsZero() || h.ackAlarm.After(ackTime) {
+				h.ackAlarm = ackTime
+				if h.logger.Debug() {
+					h.logger.Debugf("\tSetting ACK timer to 1/8 min-RTT: %s (%s from now)", ackDelay, time.Until(h.ackAlarm))
+				}
+			}
+		}
+	}
+
+	if h.ackQueued {
+		// cancel the ack alarm
+		h.ackAlarm = time.Time{}
+	}
+}
+
+func (h *receivedPacketHandler) GetAckFrame() *wire.AckFrame {
+	now := time.Now()
+	if !h.ackQueued && (h.ackAlarm.IsZero() || h.ackAlarm.After(now)) {
+		return nil
+	}
+	if h.logger.Debug() && !h.ackQueued && !h.ackAlarm.IsZero() {
+		h.logger.Debugf("Sending ACK because the ACK timer expired.")
+	}
+
+	ack := &wire.AckFrame{
+		AckRanges: h.packetHistory.GetAckRanges(),
+		DelayTime: now.Sub(h.largestObservedReceivedTime),
+	}
+
+	h.lastAck = ack
+	h.ackAlarm = time.Time{}
+	h.ackQueued = false
+	h.packetsReceivedSinceLastAck = 0
+	h.retransmittablePacketsReceivedSinceLastAck = 0
+	return ack
+}
+
+func (h *receivedPacketHandler) GetAlarmTimeout() time.Time { return h.ackAlarm }

vendor/github.com/lucas-clemente/quic-go/internal/ackhandler/received_packet_history.go

@@ -0,0 +1,121 @@
+package ackhandler
+
+import (
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+	"github.com/lucas-clemente/quic-go/internal/utils"
+	"github.com/lucas-clemente/quic-go/internal/wire"
+	"github.com/lucas-clemente/quic-go/qerr"
+)
+
+// The receivedPacketHistory stores if a packet number has already been received.
+// It does not store packet contents.
+type receivedPacketHistory struct {
+	ranges *utils.PacketIntervalList
+
+	lowestInReceivedPacketNumbers protocol.PacketNumber
+}
+
+var errTooManyOutstandingReceivedAckRanges = qerr.Error(qerr.TooManyOutstandingReceivedPackets, "Too many outstanding received ACK ranges")
+
+// newReceivedPacketHistory creates a new received packet history
+func newReceivedPacketHistory() *receivedPacketHistory {
+	return &receivedPacketHistory{
+		ranges: utils.NewPacketIntervalList(),
+	}
+}
+
+// ReceivedPacket registers a packet with PacketNumber p and updates the ranges
+func (h *receivedPacketHistory) ReceivedPacket(p protocol.PacketNumber) error {
+	if h.ranges.Len() >= protocol.MaxTrackedReceivedAckRanges {
+		return errTooManyOutstandingReceivedAckRanges
+	}
+
+	if h.ranges.Len() == 0 {
+		h.ranges.PushBack(utils.PacketInterval{Start: p, End: p})
+		return nil
+	}
+
+	for el := h.ranges.Back(); el != nil; el = el.Prev() {
+		// p already included in an existing range. Nothing to do here
+		if p >= el.Value.Start && p <= el.Value.End {
+			return nil
+		}
+
+		var rangeExtended bool
+		if el.Value.End == p-1 { // extend a range at the end
+			rangeExtended = true
+			el.Value.End = p
+		} else if el.Value.Start == p+1 { // extend a range at the beginning
+			rangeExtended = true
+			el.Value.Start = p
+		}
+
+		// if a range was extended (either at the beginning or at the end, maybe it is possible to merge two ranges into one)
+		if rangeExtended {
+			prev := el.Prev()
+			if prev != nil && prev.Value.End+1 == el.Value.Start { // merge two ranges
+				prev.Value.End = el.Value.End
+				h.ranges.Remove(el)
+				return nil
+			}
+			return nil // if the two ranges were not merge, we're done here
+		}
+
+		// create a new range at the end
+		if p > el.Value.End {
+			h.ranges.InsertAfter(utils.PacketInterval{Start: p, End: p}, el)
+			return nil
+		}
+	}
+
+	// create a new range at the beginning
+	h.ranges.InsertBefore(utils.PacketInterval{Start: p, End: p}, h.ranges.Front())
+
+	return nil
+}
+
+// DeleteBelow deletes all entries below (but not including) p
+func (h *receivedPacketHistory) DeleteBelow(p protocol.PacketNumber) {
+	if p <= h.lowestInReceivedPacketNumbers {
+		return
+	}
+	h.lowestInReceivedPacketNumbers = p
+
+	nextEl := h.ranges.Front()
+	for el := h.ranges.Front(); nextEl != nil; el = nextEl {
+		nextEl = el.Next()
+
+		if p > el.Value.Start && p <= el.Value.End {
+			el.Value.Start = p
+		} else if el.Value.End < p { // delete a whole range
+			h.ranges.Remove(el)
+		} else { // no ranges affected. Nothing to do
+			return
+		}
+	}
+}
+
+// GetAckRanges gets a slice of all AckRanges that can be used in an AckFrame
+func (h *receivedPacketHistory) GetAckRanges() []wire.AckRange {
+	if h.ranges.Len() == 0 {
+		return nil
+	}
+
+	ackRanges := make([]wire.AckRange, h.ranges.Len())
+	i := 0
+	for el := h.ranges.Back(); el != nil; el = el.Prev() {
+		ackRanges[i] = wire.AckRange{Smallest: el.Value.Start, Largest: el.Value.End}
+		i++
+	}
+	return ackRanges
+}
+
+func (h *receivedPacketHistory) GetHighestAckRange() wire.AckRange {
+	ackRange := wire.AckRange{}
+	if h.ranges.Len() > 0 {
+		r := h.ranges.Back().Value
+		ackRange.Smallest = r.Start
+		ackRange.Largest = r.End
+	}
+	return ackRange
+}

vendor/github.com/lucas-clemente/quic-go/internal/ackhandler/retransmittable.go

@@ -0,0 +1,36 @@
+package ackhandler
+
+import "github.com/lucas-clemente/quic-go/internal/wire"
+
+// Returns a new slice with all non-retransmittable frames deleted.
+func stripNonRetransmittableFrames(fs []wire.Frame) []wire.Frame {
+	res := make([]wire.Frame, 0, len(fs))
+	for _, f := range fs {
+		if IsFrameRetransmittable(f) {
+			res = append(res, f)
+		}
+	}
+	return res
+}
+
+// IsFrameRetransmittable returns true if the frame should be retransmitted.
+func IsFrameRetransmittable(f wire.Frame) bool {
+	switch f.(type) {
+	case *wire.StopWaitingFrame:
+		return false
+	case *wire.AckFrame:
+		return false
+	default:
+		return true
+	}
+}
+
+// HasRetransmittableFrames returns true if at least one frame is retransmittable.
+func HasRetransmittableFrames(fs []wire.Frame) bool {
+	for _, f := range fs {
+		if IsFrameRetransmittable(f) {
+			return true
+		}
+	}
+	return false
+}

vendor/github.com/lucas-clemente/quic-go/internal/ackhandler/send_mode.go

@@ -0,0 +1,40 @@
+package ackhandler
+
+import "fmt"
+
+// The SendMode says what kind of packets can be sent.
+type SendMode uint8
+
+const (
+	// SendNone means that no packets should be sent
+	SendNone SendMode = iota
+	// SendAck means an ACK-only packet should be sent
+	SendAck
+	// SendRetransmission means that retransmissions should be sent
+	SendRetransmission
+	// SendRTO means that an RTO probe packet should be sent
+	SendRTO
+	// SendTLP means that a TLP probe packet should be sent
+	SendTLP
+	// SendAny means that any packet should be sent
+	SendAny
+)
+
+func (s SendMode) String() string {
+	switch s {
+	case SendNone:
+		return "none"
+	case SendAck:
+		return "ack"
+	case SendRetransmission:
+		return "retransmission"
+	case SendRTO:
+		return "rto"
+	case SendTLP:
+		return "tlp"
+	case SendAny:
+		return "any"
+	default:
+		return fmt.Sprintf("invalid send mode: %d", s)
+	}
+}

vendor/github.com/lucas-clemente/quic-go/internal/ackhandler/sent_packet_handler.go

@@ -0,0 +1,659 @@
+package ackhandler
+
+import (
+	"errors"
+	"fmt"
+	"math"
+	"time"
+
+	"github.com/lucas-clemente/quic-go/internal/congestion"
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+	"github.com/lucas-clemente/quic-go/internal/utils"
+	"github.com/lucas-clemente/quic-go/internal/wire"
+	"github.com/lucas-clemente/quic-go/qerr"
+)
+
+const (
+	// Maximum reordering in time space before time based loss detection considers a packet lost.
+	// In fraction of an RTT.
+	timeReorderingFraction = 1.0 / 8
+	// defaultRTOTimeout is the RTO time on new connections
+	defaultRTOTimeout = 500 * time.Millisecond
+	// Minimum time in the future a tail loss probe alarm may be set for.
+	minTPLTimeout = 10 * time.Millisecond
+	// Maximum number of tail loss probes before an RTO fires.
+	maxTLPs = 2
+	// Minimum time in the future an RTO alarm may be set for.
+	minRTOTimeout = 200 * time.Millisecond
+	// maxRTOTimeout is the maximum RTO time
+	maxRTOTimeout = 60 * time.Second
+)
+
+type sentPacketHandler struct {
+	lastSentPacketNumber              protocol.PacketNumber
+	lastSentRetransmittablePacketTime time.Time
+	lastSentHandshakePacketTime       time.Time
+
+	nextPacketSendTime time.Time
+	skippedPackets     []protocol.PacketNumber
+
+	largestAcked                 protocol.PacketNumber
+	largestReceivedPacketWithAck protocol.PacketNumber
+	// lowestPacketNotConfirmedAcked is the lowest packet number that we sent an ACK for, but haven't received confirmation, that this ACK actually arrived
+	// example: we send an ACK for packets 90-100 with packet number 20
+	// once we receive an ACK from the peer for packet 20, the lowestPacketNotConfirmedAcked is 101
+	lowestPacketNotConfirmedAcked protocol.PacketNumber
+	largestSentBeforeRTO          protocol.PacketNumber
+
+	packetHistory      *sentPacketHistory
+	stopWaitingManager stopWaitingManager
+
+	retransmissionQueue []*Packet
+
+	bytesInFlight protocol.ByteCount
+
+	congestion congestion.SendAlgorithm
+	rttStats   *congestion.RTTStats
+
+	handshakeComplete bool
+	// The number of times the handshake packets have been retransmitted without receiving an ack.
+	handshakeCount uint32
+
+	// The number of times a TLP has been sent without receiving an ack.
+	tlpCount uint32
+	allowTLP bool
+
+	// The number of times an RTO has been sent without receiving an ack.
+	rtoCount uint32
+	// The number of RTO probe packets that should be sent.
+	numRTOs int
+
+	// The time at which the next packet will be considered lost based on early transmit or exceeding the reordering window in time.
+	lossTime time.Time
+
+	// The alarm timeout
+	alarm time.Time
+
+	logger utils.Logger
+
+	version protocol.VersionNumber
+}
+
+// NewSentPacketHandler creates a new sentPacketHandler
+func NewSentPacketHandler(rttStats *congestion.RTTStats, logger utils.Logger, version protocol.VersionNumber) SentPacketHandler {
+	congestion := congestion.NewCubicSender(
+		congestion.DefaultClock{},
+		rttStats,
+		false, /* don't use reno since chromium doesn't (why?) */
+		protocol.InitialCongestionWindow,
+		protocol.DefaultMaxCongestionWindow,
+	)
+
+	return &sentPacketHandler{
+		packetHistory:      newSentPacketHistory(),
+		stopWaitingManager: stopWaitingManager{},
+		rttStats:           rttStats,
+		congestion:         congestion,
+		logger:             logger,
+		version:            version,
+	}
+}
+
+func (h *sentPacketHandler) lowestUnacked() protocol.PacketNumber {
+	if p := h.packetHistory.FirstOutstanding(); p != nil {
+		return p.PacketNumber
+	}
+	return h.largestAcked + 1
+}
+
+func (h *sentPacketHandler) SetHandshakeComplete() {
+	h.logger.Debugf("Handshake complete. Discarding all outstanding handshake packets.")
+	var queue []*Packet
+	for _, packet := range h.retransmissionQueue {
+		if packet.EncryptionLevel == protocol.EncryptionForwardSecure {
+			queue = append(queue, packet)
+		}
+	}
+	var handshakePackets []*Packet
+	h.packetHistory.Iterate(func(p *Packet) (bool, error) {
+		if p.EncryptionLevel != protocol.EncryptionForwardSecure {
+			handshakePackets = append(handshakePackets, p)
+		}
+		return true, nil
+	})
+	for _, p := range handshakePackets {
+		h.packetHistory.Remove(p.PacketNumber)
+	}
+	h.retransmissionQueue = queue
+	h.handshakeComplete = true
+}
+
+func (h *sentPacketHandler) SentPacket(packet *Packet) {
+	if isRetransmittable := h.sentPacketImpl(packet); isRetransmittable {
+		h.packetHistory.SentPacket(packet)
+		h.updateLossDetectionAlarm()
+	}
+}
+
+func (h *sentPacketHandler) SentPacketsAsRetransmission(packets []*Packet, retransmissionOf protocol.PacketNumber) {
+	var p []*Packet
+	for _, packet := range packets {
+		if isRetransmittable := h.sentPacketImpl(packet); isRetransmittable {
+			p = append(p, packet)
+		}
+	}
+	h.packetHistory.SentPacketsAsRetransmission(p, retransmissionOf)
+	h.updateLossDetectionAlarm()
+}
+
+func (h *sentPacketHandler) sentPacketImpl(packet *Packet) bool /* isRetransmittable */ {
+	for p := h.lastSentPacketNumber + 1; p < packet.PacketNumber; p++ {
+		h.logger.Debugf("Skipping packet number %#x", p)
+		h.skippedPackets = append(h.skippedPackets, p)
+		if len(h.skippedPackets) > protocol.MaxTrackedSkippedPackets {
+			h.skippedPackets = h.skippedPackets[1:]
+		}
+	}
+
+	h.lastSentPacketNumber = packet.PacketNumber
+
+	if len(packet.Frames) > 0 {
+		if ackFrame, ok := packet.Frames[0].(*wire.AckFrame); ok {
+			packet.largestAcked = ackFrame.LargestAcked()
+		}
+	}
+
+	packet.Frames = stripNonRetransmittableFrames(packet.Frames)
+	isRetransmittable := len(packet.Frames) != 0
+
+	if isRetransmittable {
+		if packet.EncryptionLevel < protocol.EncryptionForwardSecure {
+			h.lastSentHandshakePacketTime = packet.SendTime
+		}
+		h.lastSentRetransmittablePacketTime = packet.SendTime
+		packet.includedInBytesInFlight = true
+		h.bytesInFlight += packet.Length
+		packet.canBeRetransmitted = true
+		if h.numRTOs > 0 {
+			h.numRTOs--
+		}
+		h.allowTLP = false
+	}
+	h.congestion.OnPacketSent(packet.SendTime, h.bytesInFlight, packet.PacketNumber, packet.Length, isRetransmittable)
+
+	h.nextPacketSendTime = utils.MaxTime(h.nextPacketSendTime, packet.SendTime).Add(h.congestion.TimeUntilSend(h.bytesInFlight))
+	return isRetransmittable
+}
+
+func (h *sentPacketHandler) ReceivedAck(ackFrame *wire.AckFrame, withPacketNumber protocol.PacketNumber, encLevel protocol.EncryptionLevel, rcvTime time.Time) error {
+	largestAcked := ackFrame.LargestAcked()
+	if largestAcked > h.lastSentPacketNumber {
+		return qerr.Error(qerr.InvalidAckData, "Received ACK for an unsent package")
+	}
+
+	// duplicate or out of order ACK
+	if withPacketNumber != 0 && withPacketNumber <= h.largestReceivedPacketWithAck {
+		h.logger.Debugf("Ignoring ACK frame (duplicate or out of order).")
+		return nil
+	}
+	h.largestReceivedPacketWithAck = withPacketNumber
+	h.largestAcked = utils.MaxPacketNumber(h.largestAcked, largestAcked)
+
+	if h.skippedPacketsAcked(ackFrame) {
+		return qerr.Error(qerr.InvalidAckData, "Received an ACK for a skipped packet number")
+	}
+
+	if rttUpdated := h.maybeUpdateRTT(largestAcked, ackFrame.DelayTime, rcvTime); rttUpdated {
+		h.congestion.MaybeExitSlowStart()
+	}
+
+	ackedPackets, err := h.determineNewlyAckedPackets(ackFrame)
+	if err != nil {
+		return err
+	}
+
+	priorInFlight := h.bytesInFlight
+	for _, p := range ackedPackets {
+		if encLevel < p.EncryptionLevel {
+			return fmt.Errorf("Received ACK with encryption level %s that acks a packet %d (encryption level %s)", encLevel, p.PacketNumber, p.EncryptionLevel)
+		}
+		// largestAcked == 0 either means that the packet didn't contain an ACK, or it just acked packet 0
+		// It is safe to ignore the corner case of packets that just acked packet 0, because
+		// the lowestPacketNotConfirmedAcked is only used to limit the number of ACK ranges we will send.
+		if p.largestAcked != 0 {
+			h.lowestPacketNotConfirmedAcked = utils.MaxPacketNumber(h.lowestPacketNotConfirmedAcked, p.largestAcked+1)
+		}
+		if err := h.onPacketAcked(p, rcvTime); err != nil {
+			return err
+		}
+		if p.includedInBytesInFlight {
+			h.congestion.OnPacketAcked(p.PacketNumber, p.Length, priorInFlight, rcvTime)
+		}
+	}
+
+	if err := h.detectLostPackets(rcvTime, priorInFlight); err != nil {
+		return err
+	}
+	h.updateLossDetectionAlarm()
+
+	h.garbageCollectSkippedPackets()
+	h.stopWaitingManager.ReceivedAck(ackFrame)
+
+	return nil
+}
+
+func (h *sentPacketHandler) GetLowestPacketNotConfirmedAcked() protocol.PacketNumber {
+	return h.lowestPacketNotConfirmedAcked
+}
+
+func (h *sentPacketHandler) determineNewlyAckedPackets(ackFrame *wire.AckFrame) ([]*Packet, error) {
+	var ackedPackets []*Packet
+	ackRangeIndex := 0
+	lowestAcked := ackFrame.LowestAcked()
+	largestAcked := ackFrame.LargestAcked()
+	err := h.packetHistory.Iterate(func(p *Packet) (bool, error) {
+		// Ignore packets below the lowest acked
+		if p.PacketNumber < lowestAcked {
+			return true, nil
+		}
+		// Break after largest acked is reached
+		if p.PacketNumber > largestAcked {
+			return false, nil
+		}
+
+		if ackFrame.HasMissingRanges() {
+			ackRange := ackFrame.AckRanges[len(ackFrame.AckRanges)-1-ackRangeIndex]
+
+			for p.PacketNumber > ackRange.Largest && ackRangeIndex < len(ackFrame.AckRanges)-1 {
+				ackRangeIndex++
+				ackRange = ackFrame.AckRanges[len(ackFrame.AckRanges)-1-ackRangeIndex]
+			}
+
+			if p.PacketNumber >= ackRange.Smallest { // packet i contained in ACK range
+				if p.PacketNumber > ackRange.Largest {
+					return false, fmt.Errorf("BUG: ackhandler would have acked wrong packet 0x%x, while evaluating range 0x%x -> 0x%x", p.PacketNumber, ackRange.Smallest, ackRange.Largest)
+				}
+				ackedPackets = append(ackedPackets, p)
+			}
+		} else {
+			ackedPackets = append(ackedPackets, p)
+		}
+		return true, nil
+	})
+	if h.logger.Debug() && len(ackedPackets) > 0 {
+		pns := make([]protocol.PacketNumber, len(ackedPackets))
+		for i, p := range ackedPackets {
+			pns[i] = p.PacketNumber
+		}
+		h.logger.Debugf("\tnewly acked packets (%d): %#x", len(pns), pns)
+	}
+	return ackedPackets, err
+}
+
+func (h *sentPacketHandler) maybeUpdateRTT(largestAcked protocol.PacketNumber, ackDelay time.Duration, rcvTime time.Time) bool {
+	if p := h.packetHistory.GetPacket(largestAcked); p != nil {
+		h.rttStats.UpdateRTT(rcvTime.Sub(p.SendTime), ackDelay, rcvTime)
+		if h.logger.Debug() {
+			h.logger.Debugf("\tupdated RTT: %s (σ: %s)", h.rttStats.SmoothedRTT(), h.rttStats.MeanDeviation())
+		}
+		return true
+	}
+	return false
+}
+
+func (h *sentPacketHandler) updateLossDetectionAlarm() {
+	// Cancel the alarm if no packets are outstanding
+	if !h.packetHistory.HasOutstandingPackets() {
+		h.alarm = time.Time{}
+		return
+	}
+
+	if h.packetHistory.HasOutstandingHandshakePackets() {
+		h.alarm = h.lastSentHandshakePacketTime.Add(h.computeHandshakeTimeout())
+	} else if !h.lossTime.IsZero() {
+		// Early retransmit timer or time loss detection.
+		h.alarm = h.lossTime
+	} else {
+		// RTO or TLP alarm
+		alarmDuration := h.computeRTOTimeout()
+		if h.tlpCount < maxTLPs {
+			tlpAlarm := h.computeTLPTimeout()
+			// if the RTO duration is shorter than the TLP duration, use the RTO duration
+			alarmDuration = utils.MinDuration(alarmDuration, tlpAlarm)
+		}
+		h.alarm = h.lastSentRetransmittablePacketTime.Add(alarmDuration)
+	}
+}
+
+func (h *sentPacketHandler) detectLostPackets(now time.Time, priorInFlight protocol.ByteCount) error {
+	h.lossTime = time.Time{}
+
+	maxRTT := float64(utils.MaxDuration(h.rttStats.LatestRTT(), h.rttStats.SmoothedRTT()))
+	delayUntilLost := time.Duration((1.0 + timeReorderingFraction) * maxRTT)
+
+	var lostPackets []*Packet
+	h.packetHistory.Iterate(func(packet *Packet) (bool, error) {
+		if packet.PacketNumber > h.largestAcked {
+			return false, nil
+		}
+
+		timeSinceSent := now.Sub(packet.SendTime)
+		if timeSinceSent > delayUntilLost {
+			lostPackets = append(lostPackets, packet)
+		} else if h.lossTime.IsZero() {
+			if h.logger.Debug() {
+				h.logger.Debugf("\tsetting loss timer for packet %#x to %s (in %s)", packet.PacketNumber, delayUntilLost, delayUntilLost-timeSinceSent)
+			}
+			// Note: This conditional is only entered once per call
+			h.lossTime = now.Add(delayUntilLost - timeSinceSent)
+		}
+		return true, nil
+	})
+	if h.logger.Debug() && len(lostPackets) > 0 {
+		pns := make([]protocol.PacketNumber, len(lostPackets))
+		for i, p := range lostPackets {
+			pns[i] = p.PacketNumber
+		}
+		h.logger.Debugf("\tlost packets (%d): %#x", len(pns), pns)
+	}
+
+	for _, p := range lostPackets {
+		// the bytes in flight need to be reduced no matter if this packet will be retransmitted
+		if p.includedInBytesInFlight {
+			h.bytesInFlight -= p.Length
+			h.congestion.OnPacketLost(p.PacketNumber, p.Length, priorInFlight)
+		}
+		if p.canBeRetransmitted {
+			// queue the packet for retransmission, and report the loss to the congestion controller
+			if err := h.queuePacketForRetransmission(p); err != nil {
+				return err
+			}
+		}
+		h.packetHistory.Remove(p.PacketNumber)
+	}
+	return nil
+}
+
+func (h *sentPacketHandler) OnAlarm() error {
+	// When all outstanding are acknowledged, the alarm is canceled in
+	// updateLossDetectionAlarm. This doesn't reset the timer in the session though.
+	// When OnAlarm is called, we therefore need to make sure that there are
+	// actually packets outstanding.
+	if h.packetHistory.HasOutstandingPackets() {
+		if err := h.onVerifiedAlarm(); err != nil {
+			return err
+		}
+	}
+	h.updateLossDetectionAlarm()
+	return nil
+}
+
+func (h *sentPacketHandler) onVerifiedAlarm() error {
+	var err error
+	if h.packetHistory.HasOutstandingHandshakePackets() {
+		if h.logger.Debug() {
+			h.logger.Debugf("Loss detection alarm fired in handshake mode. Handshake count: %d", h.handshakeCount)
+		}
+		h.handshakeCount++
+		err = h.queueHandshakePacketsForRetransmission()
+	} else if !h.lossTime.IsZero() {
+		if h.logger.Debug() {
+			h.logger.Debugf("Loss detection alarm fired in loss timer mode. Loss time: %s", h.lossTime)
+		}
+		// Early retransmit or time loss detection
+		err = h.detectLostPackets(time.Now(), h.bytesInFlight)
+	} else if h.tlpCount < maxTLPs { // TLP
+		if h.logger.Debug() {
+			h.logger.Debugf("Loss detection alarm fired in TLP mode. TLP count: %d", h.tlpCount)
+		}
+		h.allowTLP = true
+		h.tlpCount++
+	} else { // RTO
+		if h.logger.Debug() {
+			h.logger.Debugf("Loss detection alarm fired in RTO mode. RTO count: %d", h.rtoCount)
+		}
+		if h.rtoCount == 0 {
+			h.largestSentBeforeRTO = h.lastSentPacketNumber
+		}
+		h.rtoCount++
+		h.numRTOs += 2
+	}
+	return err
+}
+
+func (h *sentPacketHandler) GetAlarmTimeout() time.Time {
+	return h.alarm
+}
+
+func (h *sentPacketHandler) onPacketAcked(p *Packet, rcvTime time.Time) error {
+	// This happens if a packet and its retransmissions is acked in the same ACK.
+	// As soon as we process the first one, this will remove all the retransmissions,
+	// so we won't find the retransmitted packet number later.
+	if packet := h.packetHistory.GetPacket(p.PacketNumber); packet == nil {
+		return nil
+	}
+
+	// only report the acking of this packet to the congestion controller if:
+	// * it is a retransmittable packet
+	// * this packet wasn't retransmitted yet
+	if p.isRetransmission {
+		// that the parent doesn't exist is expected to happen every time the original packet was already acked
+		if parent := h.packetHistory.GetPacket(p.retransmissionOf); parent != nil {
+			if len(parent.retransmittedAs) == 1 {
+				parent.retransmittedAs = nil
+			} else {
+				// remove this packet from the slice of retransmission
+				retransmittedAs := make([]protocol.PacketNumber, 0, len(parent.retransmittedAs)-1)
+				for _, pn := range parent.retransmittedAs {
+					if pn != p.PacketNumber {
+						retransmittedAs = append(retransmittedAs, pn)
+					}
+				}
+				parent.retransmittedAs = retransmittedAs
+			}
+		}
+	}
+	// this also applies to packets that have been retransmitted as probe packets
+	if p.includedInBytesInFlight {
+		h.bytesInFlight -= p.Length
+	}
+	if h.rtoCount > 0 {
+		h.verifyRTO(p.PacketNumber)
+	}
+	if err := h.stopRetransmissionsFor(p); err != nil {
+		return err
+	}
+	h.rtoCount = 0
+	h.tlpCount = 0
+	h.handshakeCount = 0
+	return h.packetHistory.Remove(p.PacketNumber)
+}
+
+func (h *sentPacketHandler) stopRetransmissionsFor(p *Packet) error {
+	if err := h.packetHistory.MarkCannotBeRetransmitted(p.PacketNumber); err != nil {
+		return err
+	}
+	for _, r := range p.retransmittedAs {
+		packet := h.packetHistory.GetPacket(r)
+		if packet == nil {
+			return fmt.Errorf("sent packet handler BUG: marking packet as not retransmittable %d (retransmission of %d) not found in history", r, p.PacketNumber)
+		}
+		h.stopRetransmissionsFor(packet)
+	}
+	return nil
+}
+
+func (h *sentPacketHandler) verifyRTO(pn protocol.PacketNumber) {
+	if pn <= h.largestSentBeforeRTO {
+		h.logger.Debugf("Spurious RTO detected. Received an ACK for %#x (largest sent before RTO: %#x)", pn, h.largestSentBeforeRTO)
+		// Replace SRTT with latest_rtt and increase the variance to prevent
+		// a spurious RTO from happening again.
+		h.rttStats.ExpireSmoothedMetrics()
+		return
+	}
+	h.logger.Debugf("RTO verified. Received an ACK for %#x (largest sent before RTO: %#x", pn, h.largestSentBeforeRTO)
+	h.congestion.OnRetransmissionTimeout(true)
+}
+
+func (h *sentPacketHandler) DequeuePacketForRetransmission() *Packet {
+	if len(h.retransmissionQueue) == 0 {
+		return nil
+	}
+	packet := h.retransmissionQueue[0]
+	// Shift the slice and don't retain anything that isn't needed.
+	copy(h.retransmissionQueue, h.retransmissionQueue[1:])
+	h.retransmissionQueue[len(h.retransmissionQueue)-1] = nil
+	h.retransmissionQueue = h.retransmissionQueue[:len(h.retransmissionQueue)-1]
+	return packet
+}
+
+func (h *sentPacketHandler) DequeueProbePacket() (*Packet, error) {
+	if len(h.retransmissionQueue) == 0 {
+		p := h.packetHistory.FirstOutstanding()
+		if p == nil {
+			return nil, errors.New("cannot dequeue a probe packet. No outstanding packets")
+		}
+		if err := h.queuePacketForRetransmission(p); err != nil {
+			return nil, err
+		}
+	}
+	return h.DequeuePacketForRetransmission(), nil
+}
+
+func (h *sentPacketHandler) GetPacketNumberLen(p protocol.PacketNumber) protocol.PacketNumberLen {
+	return protocol.GetPacketNumberLengthForHeader(p, h.lowestUnacked(), h.version)
+}
+
+func (h *sentPacketHandler) GetStopWaitingFrame(force bool) *wire.StopWaitingFrame {
+	return h.stopWaitingManager.GetStopWaitingFrame(force)
+}
+
+func (h *sentPacketHandler) SendMode() SendMode {
+	numTrackedPackets := len(h.retransmissionQueue) + h.packetHistory.Len()
+
+	// Don't send any packets if we're keeping track of the maximum number of packets.
+	// Note that since MaxOutstandingSentPackets is smaller than MaxTrackedSentPackets,
+	// we will stop sending out new data when reaching MaxOutstandingSentPackets,
+	// but still allow sending of retransmissions and ACKs.
+	if numTrackedPackets >= protocol.MaxTrackedSentPackets {
+		if h.logger.Debug() {
+			h.logger.Debugf("Limited by the number of tracked packets: tracking %d packets, maximum %d", numTrackedPackets, protocol.MaxTrackedSentPackets)
+		}
+		return SendNone
+	}
+	if h.allowTLP {
+		return SendTLP
+	}
+	if h.numRTOs > 0 {
+		return SendRTO
+	}
+	// Only send ACKs if we're congestion limited.
+	if cwnd := h.congestion.GetCongestionWindow(); h.bytesInFlight > cwnd {
+		if h.logger.Debug() {
+			h.logger.Debugf("Congestion limited: bytes in flight %d, window %d", h.bytesInFlight, cwnd)
+		}
+		return SendAck
+	}
+	// Send retransmissions first, if there are any.
+	if len(h.retransmissionQueue) > 0 {
+		return SendRetransmission
+	}
+	if numTrackedPackets >= protocol.MaxOutstandingSentPackets {
+		if h.logger.Debug() {
+			h.logger.Debugf("Max outstanding limited: tracking %d packets, maximum: %d", numTrackedPackets, protocol.MaxOutstandingSentPackets)
+		}
+		return SendAck
+	}
+	return SendAny
+}
+
+func (h *sentPacketHandler) TimeUntilSend() time.Time {
+	return h.nextPacketSendTime
+}
+
+func (h *sentPacketHandler) ShouldSendNumPackets() int {
+	if h.numRTOs > 0 {
+		// RTO probes should not be paced, but must be sent immediately.
+		return h.numRTOs
+	}
+	delay := h.congestion.TimeUntilSend(h.bytesInFlight)
+	if delay == 0 || delay > protocol.MinPacingDelay {
+		return 1
+	}
+	return int(math.Ceil(float64(protocol.MinPacingDelay) / float64(delay)))
+}
+
+func (h *sentPacketHandler) queueHandshakePacketsForRetransmission() error {
+	var handshakePackets []*Packet
+	h.packetHistory.Iterate(func(p *Packet) (bool, error) {
+		if p.canBeRetransmitted && p.EncryptionLevel < protocol.EncryptionForwardSecure {
+			handshakePackets = append(handshakePackets, p)
+		}
+		return true, nil
+	})
+	for _, p := range handshakePackets {
+		h.logger.Debugf("Queueing packet %#x as a handshake retransmission", p.PacketNumber)
+		if err := h.queuePacketForRetransmission(p); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (h *sentPacketHandler) queuePacketForRetransmission(p *Packet) error {
+	if !p.canBeRetransmitted {
+		return fmt.Errorf("sent packet handler BUG: packet %d already queued for retransmission", p.PacketNumber)
+	}
+	if err := h.packetHistory.MarkCannotBeRetransmitted(p.PacketNumber); err != nil {
+		return err
+	}
+	h.retransmissionQueue = append(h.retransmissionQueue, p)
+	h.stopWaitingManager.QueuedRetransmissionForPacketNumber(p.PacketNumber)
+	return nil
+}
+
+func (h *sentPacketHandler) computeHandshakeTimeout() time.Duration {
+	duration := utils.MaxDuration(2*h.rttStats.SmoothedOrInitialRTT(), minTPLTimeout)
+	// exponential backoff
+	// There's an implicit limit to this set by the handshake timeout.
+	return duration << h.handshakeCount
+}
+
+func (h *sentPacketHandler) computeTLPTimeout() time.Duration {
+	// TODO(#1236): include the max_ack_delay
+	return utils.MaxDuration(h.rttStats.SmoothedOrInitialRTT()*3/2, minTPLTimeout)
+}
+
+func (h *sentPacketHandler) computeRTOTimeout() time.Duration {
+	var rto time.Duration
+	rtt := h.rttStats.SmoothedRTT()
+	if rtt == 0 {
+		rto = defaultRTOTimeout
+	} else {
+		rto = rtt + 4*h.rttStats.MeanDeviation()
+	}
+	rto = utils.MaxDuration(rto, minRTOTimeout)
+	// Exponential backoff
+	rto <<= h.rtoCount
+	return utils.MinDuration(rto, maxRTOTimeout)
+}
+
+func (h *sentPacketHandler) skippedPacketsAcked(ackFrame *wire.AckFrame) bool {
+	for _, p := range h.skippedPackets {
+		if ackFrame.AcksPacket(p) {
+			return true
+		}
+	}
+	return false
+}
+
+func (h *sentPacketHandler) garbageCollectSkippedPackets() {
+	lowestUnacked := h.lowestUnacked()
+	deleteIndex := 0
+	for i, p := range h.skippedPackets {
+		if p < lowestUnacked {
+			deleteIndex = i + 1
+		}
+	}
+	h.skippedPackets = h.skippedPackets[deleteIndex:]
+}

vendor/github.com/lucas-clemente/quic-go/internal/ackhandler/sent_packet_history.go

@@ -0,0 +1,168 @@
+package ackhandler
+
+import (
+	"fmt"
+
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+)
+
+type sentPacketHistory struct {
+	packetList *PacketList
+	packetMap  map[protocol.PacketNumber]*PacketElement
+
+	numOutstandingPackets          int
+	numOutstandingHandshakePackets int
+
+	firstOutstanding *PacketElement
+}
+
+func newSentPacketHistory() *sentPacketHistory {
+	return &sentPacketHistory{
+		packetList: NewPacketList(),
+		packetMap:  make(map[protocol.PacketNumber]*PacketElement),
+	}
+}
+
+func (h *sentPacketHistory) SentPacket(p *Packet) {
+	h.sentPacketImpl(p)
+}
+
+func (h *sentPacketHistory) sentPacketImpl(p *Packet) *PacketElement {
+	el := h.packetList.PushBack(*p)
+	h.packetMap[p.PacketNumber] = el
+	if h.firstOutstanding == nil {
+		h.firstOutstanding = el
+	}
+	if p.canBeRetransmitted {
+		h.numOutstandingPackets++
+		if p.EncryptionLevel < protocol.EncryptionForwardSecure {
+			h.numOutstandingHandshakePackets++
+		}
+	}
+	return el
+}
+
+func (h *sentPacketHistory) SentPacketsAsRetransmission(packets []*Packet, retransmissionOf protocol.PacketNumber) {
+	retransmission, ok := h.packetMap[retransmissionOf]
+	// The retransmitted packet is not present anymore.
+	// This can happen if it was acked in between dequeueing of the retransmission and sending.
+	// Just treat the retransmissions as normal packets.
+	// TODO: This won't happen if we clear packets queued for retransmission on new ACKs.
+	if !ok {
+		for _, packet := range packets {
+			h.sentPacketImpl(packet)
+		}
+		return
+	}
+	retransmission.Value.retransmittedAs = make([]protocol.PacketNumber, len(packets))
+	for i, packet := range packets {
+		retransmission.Value.retransmittedAs[i] = packet.PacketNumber
+		el := h.sentPacketImpl(packet)
+		el.Value.isRetransmission = true
+		el.Value.retransmissionOf = retransmissionOf
+	}
+}
+
+func (h *sentPacketHistory) GetPacket(p protocol.PacketNumber) *Packet {
+	if el, ok := h.packetMap[p]; ok {
+		return &el.Value
+	}
+	return nil
+}
+
+// Iterate iterates through all packets.
+// The callback must not modify the history.
+func (h *sentPacketHistory) Iterate(cb func(*Packet) (cont bool, err error)) error {
+	cont := true
+	for el := h.packetList.Front(); cont && el != nil; el = el.Next() {
+		var err error
+		cont, err = cb(&el.Value)
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// FirstOutStanding returns the first outstanding packet.
+// It must not be modified (e.g. retransmitted).
+// Use DequeueFirstPacketForRetransmission() to retransmit it.
+func (h *sentPacketHistory) FirstOutstanding() *Packet {
+	if h.firstOutstanding == nil {
+		return nil
+	}
+	return &h.firstOutstanding.Value
+}
+
+// QueuePacketForRetransmission marks a packet for retransmission.
+// A packet can only be queued once.
+func (h *sentPacketHistory) MarkCannotBeRetransmitted(pn protocol.PacketNumber) error {
+	el, ok := h.packetMap[pn]
+	if !ok {
+		return fmt.Errorf("sent packet history: packet %d not found", pn)
+	}
+	if el.Value.canBeRetransmitted {
+		h.numOutstandingPackets--
+		if h.numOutstandingPackets < 0 {
+			panic("numOutstandingHandshakePackets negative")
+		}
+		if el.Value.EncryptionLevel < protocol.EncryptionForwardSecure {
+			h.numOutstandingHandshakePackets--
+			if h.numOutstandingHandshakePackets < 0 {
+				panic("numOutstandingHandshakePackets negative")
+			}
+		}
+	}
+	el.Value.canBeRetransmitted = false
+	if el == h.firstOutstanding {
+		h.readjustFirstOutstanding()
+	}
+	return nil
+}
+
+// readjustFirstOutstanding readjusts the pointer to the first outstanding packet.
+// This is necessary every time the first outstanding packet is deleted or retransmitted.
+func (h *sentPacketHistory) readjustFirstOutstanding() {
+	el := h.firstOutstanding.Next()
+	for el != nil && !el.Value.canBeRetransmitted {
+		el = el.Next()
+	}
+	h.firstOutstanding = el
+}
+
+func (h *sentPacketHistory) Len() int {
+	return len(h.packetMap)
+}
+
+func (h *sentPacketHistory) Remove(p protocol.PacketNumber) error {
+	el, ok := h.packetMap[p]
+	if !ok {
+		return fmt.Errorf("packet %d not found in sent packet history", p)
+	}
+	if el == h.firstOutstanding {
+		h.readjustFirstOutstanding()
+	}
+	if el.Value.canBeRetransmitted {
+		h.numOutstandingPackets--
+		if h.numOutstandingPackets < 0 {
+			panic("numOutstandingHandshakePackets negative")
+		}
+		if el.Value.EncryptionLevel < protocol.EncryptionForwardSecure {
+			h.numOutstandingHandshakePackets--
+			if h.numOutstandingHandshakePackets < 0 {
+				panic("numOutstandingHandshakePackets negative")
+			}
+		}
+	}
+	h.packetList.Remove(el)
+	delete(h.packetMap, p)
+	return nil
+}
+
+func (h *sentPacketHistory) HasOutstandingPackets() bool {
+	return h.numOutstandingPackets > 0
+}
+
+func (h *sentPacketHistory) HasOutstandingHandshakePackets() bool {
+	return h.numOutstandingHandshakePackets > 0
+}

vendor/github.com/lucas-clemente/quic-go/internal/ackhandler/stop_waiting_manager.go

@@ -0,0 +1,43 @@
+package ackhandler
+
+import (
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+	"github.com/lucas-clemente/quic-go/internal/wire"
+)
+
+// This stopWaitingManager is not supposed to satisfy the StopWaitingManager interface, which is a remnant of the legacy AckHandler, and should be remove once we drop support for QUIC 33
+type stopWaitingManager struct {
+	largestLeastUnackedSent protocol.PacketNumber
+	nextLeastUnacked        protocol.PacketNumber
+
+	lastStopWaitingFrame *wire.StopWaitingFrame
+}
+
+func (s *stopWaitingManager) GetStopWaitingFrame(force bool) *wire.StopWaitingFrame {
+	if s.nextLeastUnacked <= s.largestLeastUnackedSent {
+		if force {
+			return s.lastStopWaitingFrame
+		}
+		return nil
+	}
+
+	s.largestLeastUnackedSent = s.nextLeastUnacked
+	swf := &wire.StopWaitingFrame{
+		LeastUnacked: s.nextLeastUnacked,
+	}
+	s.lastStopWaitingFrame = swf
+	return swf
+}
+
+func (s *stopWaitingManager) ReceivedAck(ack *wire.AckFrame) {
+	largestAcked := ack.LargestAcked()
+	if largestAcked >= s.nextLeastUnacked {
+		s.nextLeastUnacked = largestAcked + 1
+	}
+}
+
+func (s *stopWaitingManager) QueuedRetransmissionForPacketNumber(p protocol.PacketNumber) {
+	if p >= s.nextLeastUnacked {
+		s.nextLeastUnacked = p + 1
+	}
+}

vendor/github.com/lucas-clemente/quic-go/internal/congestion/bandwidth.go

@@ -0,0 +1,22 @@
+package congestion
+
+import (
+	"time"
+
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+)
+
+// Bandwidth of a connection
+type Bandwidth uint64
+
+const (
+	// BitsPerSecond is 1 bit per second
+	BitsPerSecond Bandwidth = 1
+	// BytesPerSecond is 1 byte per second
+	BytesPerSecond = 8 * BitsPerSecond
+)
+
+// BandwidthFromDelta calculates the bandwidth from a number of bytes and a time delta
+func BandwidthFromDelta(bytes protocol.ByteCount, delta time.Duration) Bandwidth {
+	return Bandwidth(bytes) * Bandwidth(time.Second) / Bandwidth(delta) * BytesPerSecond
+}

vendor/github.com/lucas-clemente/quic-go/internal/congestion/clock.go

@@ -0,0 +1,18 @@
+package congestion
+
+import "time"
+
+// A Clock returns the current time
+type Clock interface {
+	Now() time.Time
+}
+
+// DefaultClock implements the Clock interface using the Go stdlib clock.
+type DefaultClock struct{}
+
+var _ Clock = DefaultClock{}
+
+// Now gets the current time
+func (DefaultClock) Now() time.Time {
+	return time.Now()
+}

vendor/github.com/lucas-clemente/quic-go/internal/congestion/cubic.go

@@ -0,0 +1,210 @@
+package congestion
+
+import (
+	"math"
+	"time"
+
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+	"github.com/lucas-clemente/quic-go/internal/utils"
+)
+
+// This cubic implementation is based on the one found in Chromiums's QUIC
+// implementation, in the files net/quic/congestion_control/cubic.{hh,cc}.
+
+// Constants based on TCP defaults.
+// The following constants are in 2^10 fractions of a second instead of ms to
+// allow a 10 shift right to divide.
+
+// 1024*1024^3 (first 1024 is from 0.100^3)
+// where 0.100 is 100 ms which is the scaling round trip time.
+const cubeScale = 40
+const cubeCongestionWindowScale = 410
+const cubeFactor protocol.ByteCount = 1 << cubeScale / cubeCongestionWindowScale / protocol.DefaultTCPMSS
+
+const defaultNumConnections = 2
+
+// Default Cubic backoff factor
+const beta float32 = 0.7
+
+// Additional backoff factor when loss occurs in the concave part of the Cubic
+// curve. This additional backoff factor is expected to give up bandwidth to
+// new concurrent flows and speed up convergence.
+const betaLastMax float32 = 0.85
+
+// Cubic implements the cubic algorithm from TCP
+type Cubic struct {
+	clock Clock
+
+	// Number of connections to simulate.
+	numConnections int
+
+	// Time when this cycle started, after last loss event.
+	epoch time.Time
+
+	// Max congestion window used just before last loss event.
+	// Note: to improve fairness to other streams an additional back off is
+	// applied to this value if the new value is below our latest value.
+	lastMaxCongestionWindow protocol.ByteCount
+
+	// Number of acked bytes since the cycle started (epoch).
+	ackedBytesCount protocol.ByteCount
+
+	// TCP Reno equivalent congestion window in packets.
+	estimatedTCPcongestionWindow protocol.ByteCount
+
+	// Origin point of cubic function.
+	originPointCongestionWindow protocol.ByteCount
+
+	// Time to origin point of cubic function in 2^10 fractions of a second.
+	timeToOriginPoint uint32
+
+	// Last congestion window in packets computed by cubic function.
+	lastTargetCongestionWindow protocol.ByteCount
+}
+
+// NewCubic returns a new Cubic instance
+func NewCubic(clock Clock) *Cubic {
+	c := &Cubic{
+		clock:          clock,
+		numConnections: defaultNumConnections,
+	}
+	c.Reset()
+	return c
+}
+
+// Reset is called after a timeout to reset the cubic state
+func (c *Cubic) Reset() {
+	c.epoch = time.Time{}
+	c.lastMaxCongestionWindow = 0
+	c.ackedBytesCount = 0
+	c.estimatedTCPcongestionWindow = 0
+	c.originPointCongestionWindow = 0
+	c.timeToOriginPoint = 0
+	c.lastTargetCongestionWindow = 0
+}
+
+func (c *Cubic) alpha() float32 {
+	// TCPFriendly alpha is described in Section 3.3 of the CUBIC paper. Note that
+	// beta here is a cwnd multiplier, and is equal to 1-beta from the paper.
+	// We derive the equivalent alpha for an N-connection emulation as:
+	b := c.beta()
+	return 3 * float32(c.numConnections) * float32(c.numConnections) * (1 - b) / (1 + b)
+}
+
+func (c *Cubic) beta() float32 {
+	// kNConnectionBeta is the backoff factor after loss for our N-connection
+	// emulation, which emulates the effective backoff of an ensemble of N
+	// TCP-Reno connections on a single loss event. The effective multiplier is
+	// computed as:
+	return (float32(c.numConnections) - 1 + beta) / float32(c.numConnections)
+}
+
+func (c *Cubic) betaLastMax() float32 {
+	// betaLastMax is the additional backoff factor after loss for our
+	// N-connection emulation, which emulates the additional backoff of
+	// an ensemble of N TCP-Reno connections on a single loss event. The
+	// effective multiplier is computed as:
+	return (float32(c.numConnections) - 1 + betaLastMax) / float32(c.numConnections)
+}
+
+// OnApplicationLimited is called on ack arrival when sender is unable to use
+// the available congestion window. Resets Cubic state during quiescence.
+func (c *Cubic) OnApplicationLimited() {
+	// When sender is not using the available congestion window, the window does
+	// not grow. But to be RTT-independent, Cubic assumes that the sender has been
+	// using the entire window during the time since the beginning of the current
+	// "epoch" (the end of the last loss recovery period). Since
+	// application-limited periods break this assumption, we reset the epoch when
+	// in such a period. This reset effectively freezes congestion window growth
+	// through application-limited periods and allows Cubic growth to continue
+	// when the entire window is being used.
+	c.epoch = time.Time{}
+}
+
+// CongestionWindowAfterPacketLoss computes a new congestion window to use after
+// a loss event. Returns the new congestion window in packets. The new
+// congestion window is a multiplicative decrease of our current window.
+func (c *Cubic) CongestionWindowAfterPacketLoss(currentCongestionWindow protocol.ByteCount) protocol.ByteCount {
+	if currentCongestionWindow+protocol.DefaultTCPMSS < c.lastMaxCongestionWindow {
+		// We never reached the old max, so assume we are competing with another
+		// flow. Use our extra back off factor to allow the other flow to go up.
+		c.lastMaxCongestionWindow = protocol.ByteCount(c.betaLastMax() * float32(currentCongestionWindow))
+	} else {
+		c.lastMaxCongestionWindow = currentCongestionWindow
+	}
+	c.epoch = time.Time{} // Reset time.
+	return protocol.ByteCount(float32(currentCongestionWindow) * c.beta())
+}
+
+// CongestionWindowAfterAck computes a new congestion window to use after a received ACK.
+// Returns the new congestion window in packets. The new congestion window
+// follows a cubic function that depends on the time passed since last
+// packet loss.
+func (c *Cubic) CongestionWindowAfterAck(
+	ackedBytes protocol.ByteCount,
+	currentCongestionWindow protocol.ByteCount,
+	delayMin time.Duration,
+	eventTime time.Time,
+) protocol.ByteCount {
+	c.ackedBytesCount += ackedBytes
+
+	if c.epoch.IsZero() {
+		// First ACK after a loss event.
+		c.epoch = eventTime            // Start of epoch.
+		c.ackedBytesCount = ackedBytes // Reset count.
+		// Reset estimated_tcp_congestion_window_ to be in sync with cubic.
+		c.estimatedTCPcongestionWindow = currentCongestionWindow
+		if c.lastMaxCongestionWindow <= currentCongestionWindow {
+			c.timeToOriginPoint = 0
+			c.originPointCongestionWindow = currentCongestionWindow
+		} else {
+			c.timeToOriginPoint = uint32(math.Cbrt(float64(cubeFactor * (c.lastMaxCongestionWindow - currentCongestionWindow))))
+			c.originPointCongestionWindow = c.lastMaxCongestionWindow
+		}
+	}
+
+	// Change the time unit from microseconds to 2^10 fractions per second. Take
+	// the round trip time in account. This is done to allow us to use shift as a
+	// divide operator.
+	elapsedTime := int64(eventTime.Add(delayMin).Sub(c.epoch)/time.Microsecond) << 10 / (1000 * 1000)
+
+	// Right-shifts of negative, signed numbers have implementation-dependent
+	// behavior, so force the offset to be positive, as is done in the kernel.
+	offset := int64(c.timeToOriginPoint) - elapsedTime
+	if offset < 0 {
+		offset = -offset
+	}
+
+	deltaCongestionWindow := protocol.ByteCount(cubeCongestionWindowScale*offset*offset*offset) * protocol.DefaultTCPMSS >> cubeScale
+	var targetCongestionWindow protocol.ByteCount
+	if elapsedTime > int64(c.timeToOriginPoint) {
+		targetCongestionWindow = c.originPointCongestionWindow + deltaCongestionWindow
+	} else {
+		targetCongestionWindow = c.originPointCongestionWindow - deltaCongestionWindow
+	}
+	// Limit the CWND increase to half the acked bytes.
+	targetCongestionWindow = utils.MinByteCount(targetCongestionWindow, currentCongestionWindow+c.ackedBytesCount/2)
+
+	// Increase the window by approximately Alpha * 1 MSS of bytes every
+	// time we ack an estimated tcp window of bytes.  For small
+	// congestion windows (less than 25), the formula below will
+	// increase slightly slower than linearly per estimated tcp window
+	// of bytes.
+	c.estimatedTCPcongestionWindow += protocol.ByteCount(float32(c.ackedBytesCount) * c.alpha() * float32(protocol.DefaultTCPMSS) / float32(c.estimatedTCPcongestionWindow))
+	c.ackedBytesCount = 0
+
+	// We have a new cubic congestion window.
+	c.lastTargetCongestionWindow = targetCongestionWindow
+
+	// Compute target congestion_window based on cubic target and estimated TCP
+	// congestion_window, use highest (fastest).
+	if targetCongestionWindow < c.estimatedTCPcongestionWindow {
+		targetCongestionWindow = c.estimatedTCPcongestionWindow
+	}
+	return targetCongestionWindow
+}
+
+// SetNumConnections sets the number of emulated connections
+func (c *Cubic) SetNumConnections(n int) {
+	c.numConnections = n
+}

vendor/github.com/lucas-clemente/quic-go/internal/congestion/cubic_sender.go

@@ -0,0 +1,318 @@
+package congestion
+
+import (
+	"time"
+
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+	"github.com/lucas-clemente/quic-go/internal/utils"
+)
+
+const (
+	maxBurstBytes                                     = 3 * protocol.DefaultTCPMSS
+	renoBeta                       float32            = 0.7 // Reno backoff factor.
+	defaultMinimumCongestionWindow protocol.ByteCount = 2 * protocol.DefaultTCPMSS
+)
+
+type cubicSender struct {
+	hybridSlowStart HybridSlowStart
+	prr             PrrSender
+	rttStats        *RTTStats
+	stats           connectionStats
+	cubic           *Cubic
+
+	reno bool
+
+	// Track the largest packet that has been sent.
+	largestSentPacketNumber protocol.PacketNumber
+
+	// Track the largest packet that has been acked.
+	largestAckedPacketNumber protocol.PacketNumber
+
+	// Track the largest packet number outstanding when a CWND cutback occurs.
+	largestSentAtLastCutback protocol.PacketNumber
+
+	// Whether the last loss event caused us to exit slowstart.
+	// Used for stats collection of slowstartPacketsLost
+	lastCutbackExitedSlowstart bool
+
+	// When true, exit slow start with large cutback of congestion window.
+	slowStartLargeReduction bool
+
+	// Congestion window in packets.
+	congestionWindow protocol.ByteCount
+
+	// Minimum congestion window in packets.
+	minCongestionWindow protocol.ByteCount
+
+	// Maximum congestion window.
+	maxCongestionWindow protocol.ByteCount
+
+	// Slow start congestion window in bytes, aka ssthresh.
+	slowstartThreshold protocol.ByteCount
+
+	// Number of connections to simulate.
+	numConnections int
+
+	// ACK counter for the Reno implementation.
+	numAckedPackets uint64
+
+	initialCongestionWindow    protocol.ByteCount
+	initialMaxCongestionWindow protocol.ByteCount
+
+	minSlowStartExitWindow protocol.ByteCount
+}
+
+var _ SendAlgorithm = &cubicSender{}
+var _ SendAlgorithmWithDebugInfo = &cubicSender{}
+
+// NewCubicSender makes a new cubic sender
+func NewCubicSender(clock Clock, rttStats *RTTStats, reno bool, initialCongestionWindow, initialMaxCongestionWindow protocol.ByteCount) SendAlgorithmWithDebugInfo {
+	return &cubicSender{
+		rttStats:                   rttStats,
+		initialCongestionWindow:    initialCongestionWindow,
+		initialMaxCongestionWindow: initialMaxCongestionWindow,
+		congestionWindow:           initialCongestionWindow,
+		minCongestionWindow:        defaultMinimumCongestionWindow,
+		slowstartThreshold:         initialMaxCongestionWindow,
+		maxCongestionWindow:        initialMaxCongestionWindow,
+		numConnections:             defaultNumConnections,
+		cubic:                      NewCubic(clock),
+		reno:                       reno,
+	}
+}
+
+// TimeUntilSend returns when the next packet should be sent.
+func (c *cubicSender) TimeUntilSend(bytesInFlight protocol.ByteCount) time.Duration {
+	if c.InRecovery() {
+		// PRR is used when in recovery.
+		if c.prr.CanSend(c.GetCongestionWindow(), bytesInFlight, c.GetSlowStartThreshold()) {
+			return 0
+		}
+	}
+	delay := c.rttStats.SmoothedRTT() / time.Duration(2*c.GetCongestionWindow())
+	if !c.InSlowStart() { // adjust delay, such that it's 1.25*cwd/rtt
+		delay = delay * 8 / 5
+	}
+	return delay
+}
+
+func (c *cubicSender) OnPacketSent(
+	sentTime time.Time,
+	bytesInFlight protocol.ByteCount,
+	packetNumber protocol.PacketNumber,
+	bytes protocol.ByteCount,
+	isRetransmittable bool,
+) {
+	if !isRetransmittable {
+		return
+	}
+	if c.InRecovery() {
+		// PRR is used when in recovery.
+		c.prr.OnPacketSent(bytes)
+	}
+	c.largestSentPacketNumber = packetNumber
+	c.hybridSlowStart.OnPacketSent(packetNumber)
+}
+
+func (c *cubicSender) InRecovery() bool {
+	return c.largestAckedPacketNumber <= c.largestSentAtLastCutback && c.largestAckedPacketNumber != 0
+}
+
+func (c *cubicSender) InSlowStart() bool {
+	return c.GetCongestionWindow() < c.GetSlowStartThreshold()
+}
+
+func (c *cubicSender) GetCongestionWindow() protocol.ByteCount {
+	return c.congestionWindow
+}
+
+func (c *cubicSender) GetSlowStartThreshold() protocol.ByteCount {
+	return c.slowstartThreshold
+}
+
+func (c *cubicSender) ExitSlowstart() {
+	c.slowstartThreshold = c.congestionWindow
+}
+
+func (c *cubicSender) SlowstartThreshold() protocol.ByteCount {
+	return c.slowstartThreshold
+}
+
+func (c *cubicSender) MaybeExitSlowStart() {
+	if c.InSlowStart() && c.hybridSlowStart.ShouldExitSlowStart(c.rttStats.LatestRTT(), c.rttStats.MinRTT(), c.GetCongestionWindow()/protocol.DefaultTCPMSS) {
+		c.ExitSlowstart()
+	}
+}
+
+func (c *cubicSender) OnPacketAcked(
+	ackedPacketNumber protocol.PacketNumber,
+	ackedBytes protocol.ByteCount,
+	priorInFlight protocol.ByteCount,
+	eventTime time.Time,
+) {
+	c.largestAckedPacketNumber = utils.MaxPacketNumber(ackedPacketNumber, c.largestAckedPacketNumber)
+	if c.InRecovery() {
+		// PRR is used when in recovery.
+		c.prr.OnPacketAcked(ackedBytes)
+		return
+	}
+	c.maybeIncreaseCwnd(ackedPacketNumber, ackedBytes, priorInFlight, eventTime)
+	if c.InSlowStart() {
+		c.hybridSlowStart.OnPacketAcked(ackedPacketNumber)
+	}
+}
+
+func (c *cubicSender) OnPacketLost(
+	packetNumber protocol.PacketNumber,
+	lostBytes protocol.ByteCount,
+	priorInFlight protocol.ByteCount,
+) {
+	// TCP NewReno (RFC6582) says that once a loss occurs, any losses in packets
+	// already sent should be treated as a single loss event, since it's expected.
+	if packetNumber <= c.largestSentAtLastCutback {
+		if c.lastCutbackExitedSlowstart {
+			c.stats.slowstartPacketsLost++
+			c.stats.slowstartBytesLost += lostBytes
+			if c.slowStartLargeReduction {
+				// Reduce congestion window by lost_bytes for every loss.
+				c.congestionWindow = utils.MaxByteCount(c.congestionWindow-lostBytes, c.minSlowStartExitWindow)
+				c.slowstartThreshold = c.congestionWindow
+			}
+		}
+		return
+	}
+	c.lastCutbackExitedSlowstart = c.InSlowStart()
+	if c.InSlowStart() {
+		c.stats.slowstartPacketsLost++
+	}
+
+	c.prr.OnPacketLost(priorInFlight)
+
+	// TODO(chromium): Separate out all of slow start into a separate class.
+	if c.slowStartLargeReduction && c.InSlowStart() {
+		if c.congestionWindow >= 2*c.initialCongestionWindow {
+			c.minSlowStartExitWindow = c.congestionWindow / 2
+		}
+		c.congestionWindow -= protocol.DefaultTCPMSS
+	} else if c.reno {
+		c.congestionWindow = protocol.ByteCount(float32(c.congestionWindow) * c.RenoBeta())
+	} else {
+		c.congestionWindow = c.cubic.CongestionWindowAfterPacketLoss(c.congestionWindow)
+	}
+	if c.congestionWindow < c.minCongestionWindow {
+		c.congestionWindow = c.minCongestionWindow
+	}
+	c.slowstartThreshold = c.congestionWindow
+	c.largestSentAtLastCutback = c.largestSentPacketNumber
+	// reset packet count from congestion avoidance mode. We start
+	// counting again when we're out of recovery.
+	c.numAckedPackets = 0
+}
+
+func (c *cubicSender) RenoBeta() float32 {
+	// kNConnectionBeta is the backoff factor after loss for our N-connection
+	// emulation, which emulates the effective backoff of an ensemble of N
+	// TCP-Reno connections on a single loss event. The effective multiplier is
+	// computed as:
+	return (float32(c.numConnections) - 1. + renoBeta) / float32(c.numConnections)
+}
+
+// Called when we receive an ack. Normal TCP tracks how many packets one ack
+// represents, but quic has a separate ack for each packet.
+func (c *cubicSender) maybeIncreaseCwnd(
+	ackedPacketNumber protocol.PacketNumber,
+	ackedBytes protocol.ByteCount,
+	priorInFlight protocol.ByteCount,
+	eventTime time.Time,
+) {
+	// Do not increase the congestion window unless the sender is close to using
+	// the current window.
+	if !c.isCwndLimited(priorInFlight) {
+		c.cubic.OnApplicationLimited()
+		return
+	}
+	if c.congestionWindow >= c.maxCongestionWindow {
+		return
+	}
+	if c.InSlowStart() {
+		// TCP slow start, exponential growth, increase by one for each ACK.
+		c.congestionWindow += protocol.DefaultTCPMSS
+		return
+	}
+	// Congestion avoidance
+	if c.reno {
+		// Classic Reno congestion avoidance.
+		c.numAckedPackets++
+		// Divide by num_connections to smoothly increase the CWND at a faster
+		// rate than conventional Reno.
+		if c.numAckedPackets*uint64(c.numConnections) >= uint64(c.congestionWindow)/uint64(protocol.DefaultTCPMSS) {
+			c.congestionWindow += protocol.DefaultTCPMSS
+			c.numAckedPackets = 0
+		}
+	} else {
+		c.congestionWindow = utils.MinByteCount(c.maxCongestionWindow, c.cubic.CongestionWindowAfterAck(ackedBytes, c.congestionWindow, c.rttStats.MinRTT(), eventTime))
+	}
+}
+
+func (c *cubicSender) isCwndLimited(bytesInFlight protocol.ByteCount) bool {
+	congestionWindow := c.GetCongestionWindow()
+	if bytesInFlight >= congestionWindow {
+		return true
+	}
+	availableBytes := congestionWindow - bytesInFlight
+	slowStartLimited := c.InSlowStart() && bytesInFlight > congestionWindow/2
+	return slowStartLimited || availableBytes <= maxBurstBytes
+}
+
+// BandwidthEstimate returns the current bandwidth estimate
+func (c *cubicSender) BandwidthEstimate() Bandwidth {
+	srtt := c.rttStats.SmoothedRTT()
+	if srtt == 0 {
+		// If we haven't measured an rtt, the bandwidth estimate is unknown.
+		return 0
+	}
+	return BandwidthFromDelta(c.GetCongestionWindow(), srtt)
+}
+
+// HybridSlowStart returns the hybrid slow start instance for testing
+func (c *cubicSender) HybridSlowStart() *HybridSlowStart {
+	return &c.hybridSlowStart
+}
+
+// SetNumEmulatedConnections sets the number of emulated connections
+func (c *cubicSender) SetNumEmulatedConnections(n int) {
+	c.numConnections = utils.Max(n, 1)
+	c.cubic.SetNumConnections(c.numConnections)
+}
+
+// OnRetransmissionTimeout is called on an retransmission timeout
+func (c *cubicSender) OnRetransmissionTimeout(packetsRetransmitted bool) {
+	c.largestSentAtLastCutback = 0
+	if !packetsRetransmitted {
+		return
+	}
+	c.hybridSlowStart.Restart()
+	c.cubic.Reset()
+	c.slowstartThreshold = c.congestionWindow / 2
+	c.congestionWindow = c.minCongestionWindow
+}
+
+// OnConnectionMigration is called when the connection is migrated (?)
+func (c *cubicSender) OnConnectionMigration() {
+	c.hybridSlowStart.Restart()
+	c.prr = PrrSender{}
+	c.largestSentPacketNumber = 0
+	c.largestAckedPacketNumber = 0
+	c.largestSentAtLastCutback = 0
+	c.lastCutbackExitedSlowstart = false
+	c.cubic.Reset()
+	c.numAckedPackets = 0
+	c.congestionWindow = c.initialCongestionWindow
+	c.slowstartThreshold = c.initialMaxCongestionWindow
+	c.maxCongestionWindow = c.initialMaxCongestionWindow
+}
+
+// SetSlowStartLargeReduction allows enabling the SSLR experiment
+func (c *cubicSender) SetSlowStartLargeReduction(enabled bool) {
+	c.slowStartLargeReduction = enabled
+}

vendor/github.com/lucas-clemente/quic-go/internal/congestion/hybrid_slow_start.go

@@ -0,0 +1,111 @@
+package congestion
+
+import (
+	"time"
+
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+	"github.com/lucas-clemente/quic-go/internal/utils"
+)
+
+// Note(pwestin): the magic clamping numbers come from the original code in
+// tcp_cubic.c.
+const hybridStartLowWindow = protocol.ByteCount(16)
+
+// Number of delay samples for detecting the increase of delay.
+const hybridStartMinSamples = uint32(8)
+
+// Exit slow start if the min rtt has increased by more than 1/8th.
+const hybridStartDelayFactorExp = 3 // 2^3 = 8
+// The original paper specifies 2 and 8ms, but those have changed over time.
+const hybridStartDelayMinThresholdUs = int64(4000)
+const hybridStartDelayMaxThresholdUs = int64(16000)
+
+// HybridSlowStart implements the TCP hybrid slow start algorithm
+type HybridSlowStart struct {
+	endPacketNumber      protocol.PacketNumber
+	lastSentPacketNumber protocol.PacketNumber
+	started              bool
+	currentMinRTT        time.Duration
+	rttSampleCount       uint32
+	hystartFound         bool
+}
+
+// StartReceiveRound is called for the start of each receive round (burst) in the slow start phase.
+func (s *HybridSlowStart) StartReceiveRound(lastSent protocol.PacketNumber) {
+	s.endPacketNumber = lastSent
+	s.currentMinRTT = 0
+	s.rttSampleCount = 0
+	s.started = true
+}
+
+// IsEndOfRound returns true if this ack is the last packet number of our current slow start round.
+func (s *HybridSlowStart) IsEndOfRound(ack protocol.PacketNumber) bool {
+	return s.endPacketNumber < ack
+}
+
+// ShouldExitSlowStart should be called on every new ack frame, since a new
+// RTT measurement can be made then.
+// rtt: the RTT for this ack packet.
+// minRTT: is the lowest delay (RTT) we have seen during the session.
+// congestionWindow: the congestion window in packets.
+func (s *HybridSlowStart) ShouldExitSlowStart(latestRTT time.Duration, minRTT time.Duration, congestionWindow protocol.ByteCount) bool {
+	if !s.started {
+		// Time to start the hybrid slow start.
+		s.StartReceiveRound(s.lastSentPacketNumber)
+	}
+	if s.hystartFound {
+		return true
+	}
+	// Second detection parameter - delay increase detection.
+	// Compare the minimum delay (s.currentMinRTT) of the current
+	// burst of packets relative to the minimum delay during the session.
+	// Note: we only look at the first few(8) packets in each burst, since we
+	// only want to compare the lowest RTT of the burst relative to previous
+	// bursts.
+	s.rttSampleCount++
+	if s.rttSampleCount <= hybridStartMinSamples {
+		if s.currentMinRTT == 0 || s.currentMinRTT > latestRTT {
+			s.currentMinRTT = latestRTT
+		}
+	}
+	// We only need to check this once per round.
+	if s.rttSampleCount == hybridStartMinSamples {
+		// Divide minRTT by 8 to get a rtt increase threshold for exiting.
+		minRTTincreaseThresholdUs := int64(minRTT / time.Microsecond >> hybridStartDelayFactorExp)
+		// Ensure the rtt threshold is never less than 2ms or more than 16ms.
+		minRTTincreaseThresholdUs = utils.MinInt64(minRTTincreaseThresholdUs, hybridStartDelayMaxThresholdUs)
+		minRTTincreaseThreshold := time.Duration(utils.MaxInt64(minRTTincreaseThresholdUs, hybridStartDelayMinThresholdUs)) * time.Microsecond
+
+		if s.currentMinRTT > (minRTT + minRTTincreaseThreshold) {
+			s.hystartFound = true
+		}
+	}
+	// Exit from slow start if the cwnd is greater than 16 and
+	// increasing delay is found.
+	return congestionWindow >= hybridStartLowWindow && s.hystartFound
+}
+
+// OnPacketSent is called when a packet was sent
+func (s *HybridSlowStart) OnPacketSent(packetNumber protocol.PacketNumber) {
+	s.lastSentPacketNumber = packetNumber
+}
+
+// OnPacketAcked gets invoked after ShouldExitSlowStart, so it's best to end
+// the round when the final packet of the burst is received and start it on
+// the next incoming ack.
+func (s *HybridSlowStart) OnPacketAcked(ackedPacketNumber protocol.PacketNumber) {
+	if s.IsEndOfRound(ackedPacketNumber) {
+		s.started = false
+	}
+}
+
+// Started returns true if started
+func (s *HybridSlowStart) Started() bool {
+	return s.started
+}
+
+// Restart the slow start phase
+func (s *HybridSlowStart) Restart() {
+	s.started = false
+	s.hystartFound = false
+}

vendor/github.com/lucas-clemente/quic-go/internal/congestion/interface.go

@@ -0,0 +1,36 @@
+package congestion
+
+import (
+	"time"
+
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+)
+
+// A SendAlgorithm performs congestion control and calculates the congestion window
+type SendAlgorithm interface {
+	TimeUntilSend(bytesInFlight protocol.ByteCount) time.Duration
+	OnPacketSent(sentTime time.Time, bytesInFlight protocol.ByteCount, packetNumber protocol.PacketNumber, bytes protocol.ByteCount, isRetransmittable bool)
+	GetCongestionWindow() protocol.ByteCount
+	MaybeExitSlowStart()
+	OnPacketAcked(number protocol.PacketNumber, ackedBytes protocol.ByteCount, priorInFlight protocol.ByteCount, eventTime time.Time)
+	OnPacketLost(number protocol.PacketNumber, lostBytes protocol.ByteCount, priorInFlight protocol.ByteCount)
+	SetNumEmulatedConnections(n int)
+	OnRetransmissionTimeout(packetsRetransmitted bool)
+	OnConnectionMigration()
+
+	// Experiments
+	SetSlowStartLargeReduction(enabled bool)
+}
+
+// SendAlgorithmWithDebugInfo adds some debug functions to SendAlgorithm
+type SendAlgorithmWithDebugInfo interface {
+	SendAlgorithm
+	BandwidthEstimate() Bandwidth
+
+	// Stuff only used in testing
+
+	HybridSlowStart() *HybridSlowStart
+	SlowstartThreshold() protocol.ByteCount
+	RenoBeta() float32
+	InRecovery() bool
+}

vendor/github.com/lucas-clemente/quic-go/internal/congestion/prr_sender.go

@@ -0,0 +1,54 @@
+package congestion
+
+import (
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+)
+
+// PrrSender implements the Proportional Rate Reduction (PRR) per RFC 6937
+type PrrSender struct {
+	bytesSentSinceLoss      protocol.ByteCount
+	bytesDeliveredSinceLoss protocol.ByteCount
+	ackCountSinceLoss       protocol.ByteCount
+	bytesInFlightBeforeLoss protocol.ByteCount
+}
+
+// OnPacketSent should be called after a packet was sent
+func (p *PrrSender) OnPacketSent(sentBytes protocol.ByteCount) {
+	p.bytesSentSinceLoss += sentBytes
+}
+
+// OnPacketLost should be called on the first loss that triggers a recovery
+// period and all other methods in this class should only be called when in
+// recovery.
+func (p *PrrSender) OnPacketLost(priorInFlight protocol.ByteCount) {
+	p.bytesSentSinceLoss = 0
+	p.bytesInFlightBeforeLoss = priorInFlight
+	p.bytesDeliveredSinceLoss = 0
+	p.ackCountSinceLoss = 0
+}
+
+// OnPacketAcked should be called after a packet was acked
+func (p *PrrSender) OnPacketAcked(ackedBytes protocol.ByteCount) {
+	p.bytesDeliveredSinceLoss += ackedBytes
+	p.ackCountSinceLoss++
+}
+
+// CanSend returns if packets can be sent
+func (p *PrrSender) CanSend(congestionWindow, bytesInFlight, slowstartThreshold protocol.ByteCount) bool {
+	// Return QuicTime::Zero In order to ensure limited transmit always works.
+	if p.bytesSentSinceLoss == 0 || bytesInFlight < protocol.DefaultTCPMSS {
+		return true
+	}
+	if congestionWindow > bytesInFlight {
+		// During PRR-SSRB, limit outgoing packets to 1 extra MSS per ack, instead
+		// of sending the entire available window. This prevents burst retransmits
+		// when more packets are lost than the CWND reduction.
+		//   limit = MAX(prr_delivered - prr_out, DeliveredData) + MSS
+		return p.bytesDeliveredSinceLoss+p.ackCountSinceLoss*protocol.DefaultTCPMSS > p.bytesSentSinceLoss
+	}
+	// Implement Proportional Rate Reduction (RFC6937).
+	// Checks a simplified version of the PRR formula that doesn't use division:
+	// AvailableSendWindow =
+	//   CEIL(prr_delivered * ssthresh / BytesInFlightAtLoss) - prr_sent
+	return p.bytesDeliveredSinceLoss*slowstartThreshold > p.bytesSentSinceLoss*p.bytesInFlightBeforeLoss
+}

vendor/github.com/lucas-clemente/quic-go/internal/congestion/rtt_stats.go

@@ -0,0 +1,101 @@
+package congestion
+
+import (
+	"time"
+
+	"github.com/lucas-clemente/quic-go/internal/utils"
+)
+
+const (
+	rttAlpha      float32 = 0.125
+	oneMinusAlpha float32 = (1 - rttAlpha)
+	rttBeta       float32 = 0.25
+	oneMinusBeta  float32 = (1 - rttBeta)
+	// The default RTT used before an RTT sample is taken.
+	defaultInitialRTT = 100 * time.Millisecond
+)
+
+// RTTStats provides round-trip statistics
+type RTTStats struct {
+	minRTT        time.Duration
+	latestRTT     time.Duration
+	smoothedRTT   time.Duration
+	meanDeviation time.Duration
+}
+
+// NewRTTStats makes a properly initialized RTTStats object
+func NewRTTStats() *RTTStats {
+	return &RTTStats{}
+}
+
+// MinRTT Returns the minRTT for the entire connection.
+// May return Zero if no valid updates have occurred.
+func (r *RTTStats) MinRTT() time.Duration { return r.minRTT }
+
+// LatestRTT returns the most recent rtt measurement.
+// May return Zero if no valid updates have occurred.
+func (r *RTTStats) LatestRTT() time.Duration { return r.latestRTT }
+
+// SmoothedRTT returns the EWMA smoothed RTT for the connection.
+// May return Zero if no valid updates have occurred.
+func (r *RTTStats) SmoothedRTT() time.Duration { return r.smoothedRTT }
+
+// SmoothedOrInitialRTT returns the EWMA smoothed RTT for the connection.
+// If no valid updates have occurred, it returns the initial RTT.
+func (r *RTTStats) SmoothedOrInitialRTT() time.Duration {
+	if r.smoothedRTT != 0 {
+		return r.smoothedRTT
+	}
+	return defaultInitialRTT
+}
+
+// MeanDeviation gets the mean deviation
+func (r *RTTStats) MeanDeviation() time.Duration { return r.meanDeviation }
+
+// UpdateRTT updates the RTT based on a new sample.
+func (r *RTTStats) UpdateRTT(sendDelta, ackDelay time.Duration, now time.Time) {
+	if sendDelta == utils.InfDuration || sendDelta <= 0 {
+		return
+	}
+
+	// Update r.minRTT first. r.minRTT does not use an rttSample corrected for
+	// ackDelay but the raw observed sendDelta, since poor clock granularity at
+	// the client may cause a high ackDelay to result in underestimation of the
+	// r.minRTT.
+	if r.minRTT == 0 || r.minRTT > sendDelta {
+		r.minRTT = sendDelta
+	}
+
+	// Correct for ackDelay if information received from the peer results in a
+	// an RTT sample at least as large as minRTT. Otherwise, only use the
+	// sendDelta.
+	sample := sendDelta
+	if sample-r.minRTT >= ackDelay {
+		sample -= ackDelay
+	}
+	r.latestRTT = sample
+	// First time call.
+	if r.smoothedRTT == 0 {
+		r.smoothedRTT = sample
+		r.meanDeviation = sample / 2
+	} else {
+		r.meanDeviation = time.Duration(oneMinusBeta*float32(r.meanDeviation/time.Microsecond)+rttBeta*float32(utils.AbsDuration(r.smoothedRTT-sample)/time.Microsecond)) * time.Microsecond
+		r.smoothedRTT = time.Duration((float32(r.smoothedRTT/time.Microsecond)*oneMinusAlpha)+(float32(sample/time.Microsecond)*rttAlpha)) * time.Microsecond
+	}
+}
+
+// OnConnectionMigration is called when connection migrates and rtt measurement needs to be reset.
+func (r *RTTStats) OnConnectionMigration() {
+	r.latestRTT = 0
+	r.minRTT = 0
+	r.smoothedRTT = 0
+	r.meanDeviation = 0
+}
+
+// ExpireSmoothedMetrics causes the smoothed_rtt to be increased to the latest_rtt if the latest_rtt
+// is larger. The mean deviation is increased to the most recent deviation if
+// it's larger.
+func (r *RTTStats) ExpireSmoothedMetrics() {
+	r.meanDeviation = utils.MaxDuration(r.meanDeviation, utils.AbsDuration(r.smoothedRTT-r.latestRTT))
+	r.smoothedRTT = utils.MaxDuration(r.smoothedRTT, r.latestRTT)
+}

vendor/github.com/lucas-clemente/quic-go/internal/congestion/stats.go

@@ -0,0 +1,8 @@
+package congestion
+
+import "github.com/lucas-clemente/quic-go/internal/protocol"
+
+type connectionStats struct {
+	slowstartPacketsLost protocol.PacketNumber
+	slowstartBytesLost   protocol.ByteCount
+}

vendor/github.com/lucas-clemente/quic-go/internal/crypto/AEAD.go

@@ -0,0 +1,10 @@
+package crypto
+
+import "github.com/lucas-clemente/quic-go/internal/protocol"
+
+// An AEAD implements QUIC's authenticated encryption and associated data
+type AEAD interface {
+	Open(dst, src []byte, packetNumber protocol.PacketNumber, associatedData []byte) ([]byte, error)
+	Seal(dst, src []byte, packetNumber protocol.PacketNumber, associatedData []byte) []byte
+	Overhead() int
+}

vendor/github.com/lucas-clemente/quic-go/internal/crypto/aesgcm12_aead.go

@@ -0,0 +1,72 @@
+package crypto
+
+import (
+	"crypto/cipher"
+	"encoding/binary"
+	"errors"
+
+	"github.com/lucas-clemente/aes12"
+
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+)
+
+type aeadAESGCM12 struct {
+	otherIV   []byte
+	myIV      []byte
+	encrypter cipher.AEAD
+	decrypter cipher.AEAD
+}
+
+var _ AEAD = &aeadAESGCM12{}
+
+// NewAEADAESGCM12 creates a AEAD using AES-GCM with 12 bytes tag size
+//
+// AES-GCM support is a bit hacky, since the go stdlib does not support 12 byte
+// tag size, and couples the cipher and aes packages closely.
+// See https://github.com/lucas-clemente/aes12.
+func NewAEADAESGCM12(otherKey []byte, myKey []byte, otherIV []byte, myIV []byte) (AEAD, error) {
+	if len(myKey) != 16 || len(otherKey) != 16 || len(myIV) != 4 || len(otherIV) != 4 {
+		return nil, errors.New("AES-GCM: expected 16-byte keys and 4-byte IVs")
+	}
+	encrypterCipher, err := aes12.NewCipher(myKey)
+	if err != nil {
+		return nil, err
+	}
+	encrypter, err := aes12.NewGCM(encrypterCipher)
+	if err != nil {
+		return nil, err
+	}
+	decrypterCipher, err := aes12.NewCipher(otherKey)
+	if err != nil {
+		return nil, err
+	}
+	decrypter, err := aes12.NewGCM(decrypterCipher)
+	if err != nil {
+		return nil, err
+	}
+	return &aeadAESGCM12{
+		otherIV:   otherIV,
+		myIV:      myIV,
+		encrypter: encrypter,
+		decrypter: decrypter,
+	}, nil
+}
+
+func (aead *aeadAESGCM12) Open(dst, src []byte, packetNumber protocol.PacketNumber, associatedData []byte) ([]byte, error) {
+	return aead.decrypter.Open(dst, aead.makeNonce(aead.otherIV, packetNumber), src, associatedData)
+}
+
+func (aead *aeadAESGCM12) Seal(dst, src []byte, packetNumber protocol.PacketNumber, associatedData []byte) []byte {
+	return aead.encrypter.Seal(dst, aead.makeNonce(aead.myIV, packetNumber), src, associatedData)
+}
+
+func (aead *aeadAESGCM12) makeNonce(iv []byte, packetNumber protocol.PacketNumber) []byte {
+	res := make([]byte, 12)
+	copy(res[0:4], iv)
+	binary.LittleEndian.PutUint64(res[4:12], uint64(packetNumber))
+	return res
+}
+
+func (aead *aeadAESGCM12) Overhead() int {
+	return aead.encrypter.Overhead()
+}

vendor/github.com/lucas-clemente/quic-go/internal/crypto/aesgcm_aead.go

@@ -0,0 +1,74 @@
+package crypto
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"encoding/binary"
+	"errors"
+
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+)
+
+type aeadAESGCM struct {
+	otherIV   []byte
+	myIV      []byte
+	encrypter cipher.AEAD
+	decrypter cipher.AEAD
+}
+
+var _ AEAD = &aeadAESGCM{}
+
+const ivLen = 12
+
+// NewAEADAESGCM creates a AEAD using AES-GCM
+func NewAEADAESGCM(otherKey []byte, myKey []byte, otherIV []byte, myIV []byte) (AEAD, error) {
+	// the IVs need to be at least 8 bytes long, otherwise we can't compute the nonce
+	if len(otherIV) != ivLen || len(myIV) != ivLen {
+		return nil, errors.New("AES-GCM: expected 12 byte IVs")
+	}
+
+	encrypterCipher, err := aes.NewCipher(myKey)
+	if err != nil {
+		return nil, err
+	}
+	encrypter, err := cipher.NewGCM(encrypterCipher)
+	if err != nil {
+		return nil, err
+	}
+	decrypterCipher, err := aes.NewCipher(otherKey)
+	if err != nil {
+		return nil, err
+	}
+	decrypter, err := cipher.NewGCM(decrypterCipher)
+	if err != nil {
+		return nil, err
+	}
+
+	return &aeadAESGCM{
+		otherIV:   otherIV,
+		myIV:      myIV,
+		encrypter: encrypter,
+		decrypter: decrypter,
+	}, nil
+}
+
+func (aead *aeadAESGCM) Open(dst, src []byte, packetNumber protocol.PacketNumber, associatedData []byte) ([]byte, error) {
+	return aead.decrypter.Open(dst, aead.makeNonce(aead.otherIV, packetNumber), src, associatedData)
+}
+
+func (aead *aeadAESGCM) Seal(dst, src []byte, packetNumber protocol.PacketNumber, associatedData []byte) []byte {
+	return aead.encrypter.Seal(dst, aead.makeNonce(aead.myIV, packetNumber), src, associatedData)
+}
+
+func (aead *aeadAESGCM) makeNonce(iv []byte, packetNumber protocol.PacketNumber) []byte {
+	nonce := make([]byte, ivLen)
+	binary.BigEndian.PutUint64(nonce[ivLen-8:], uint64(packetNumber))
+	for i := 0; i < ivLen; i++ {
+		nonce[i] ^= iv[i]
+	}
+	return nonce
+}
+
+func (aead *aeadAESGCM) Overhead() int {
+	return aead.encrypter.Overhead()
+}

vendor/github.com/lucas-clemente/quic-go/internal/crypto/cert_cache.go

@@ -0,0 +1,48 @@
+package crypto
+
+import (
+	"fmt"
+	"hash/fnv"
+
+	"github.com/hashicorp/golang-lru"
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+)
+
+var (
+	compressedCertsCache *lru.Cache
+)
+
+func getCompressedCert(chain [][]byte, pCommonSetHashes, pCachedHashes []byte) ([]byte, error) {
+	// Hash all inputs
+	hasher := fnv.New64a()
+	for _, v := range chain {
+		hasher.Write(v)
+	}
+	hasher.Write(pCommonSetHashes)
+	hasher.Write(pCachedHashes)
+	hash := hasher.Sum64()
+
+	var result []byte
+
+	resultI, isCached := compressedCertsCache.Get(hash)
+	if isCached {
+		result = resultI.([]byte)
+	} else {
+		var err error
+		result, err = compressChain(chain, pCommonSetHashes, pCachedHashes)
+		if err != nil {
+			return nil, err
+		}
+		compressedCertsCache.Add(hash, result)
+	}
+
+	return result, nil
+}
+
+func init() {
+	var err error
+	compressedCertsCache, err = lru.New(protocol.NumCachedCertificates)
+	if err != nil {
+		panic(fmt.Sprintf("fatal error in quic-go: could not create lru cache: %s", err.Error()))
+	}
+}

vendor/github.com/lucas-clemente/quic-go/internal/crypto/cert_chain.go

@@ -0,0 +1,118 @@
+package crypto
+
+import (
+	"crypto/tls"
+	"errors"
+	"strings"
+)
+
+// A CertChain holds a certificate and a private key
+type CertChain interface {
+	SignServerProof(sni string, chlo []byte, serverConfigData []byte) ([]byte, error)
+	GetCertsCompressed(sni string, commonSetHashes, cachedHashes []byte) ([]byte, error)
+	GetLeafCert(sni string) ([]byte, error)
+}
+
+// proofSource stores a key and a certificate for the server proof
+type certChain struct {
+	config *tls.Config
+}
+
+var _ CertChain = &certChain{}
+
+var errNoMatchingCertificate = errors.New("no matching certificate found")
+
+// NewCertChain loads the key and cert from files
+func NewCertChain(tlsConfig *tls.Config) CertChain {
+	return &certChain{config: tlsConfig}
+}
+
+// SignServerProof signs CHLO and server config for use in the server proof
+func (c *certChain) SignServerProof(sni string, chlo []byte, serverConfigData []byte) ([]byte, error) {
+	cert, err := c.getCertForSNI(sni)
+	if err != nil {
+		return nil, err
+	}
+
+	return signServerProof(cert, chlo, serverConfigData)
+}
+
+// GetCertsCompressed gets the certificate in the format described by the QUIC crypto doc
+func (c *certChain) GetCertsCompressed(sni string, pCommonSetHashes, pCachedHashes []byte) ([]byte, error) {
+	cert, err := c.getCertForSNI(sni)
+	if err != nil {
+		return nil, err
+	}
+	return getCompressedCert(cert.Certificate, pCommonSetHashes, pCachedHashes)
+}
+
+// GetLeafCert gets the leaf certificate
+func (c *certChain) GetLeafCert(sni string) ([]byte, error) {
+	cert, err := c.getCertForSNI(sni)
+	if err != nil {
+		return nil, err
+	}
+	return cert.Certificate[0], nil
+}
+
+func (c *certChain) getCertForSNI(sni string) (*tls.Certificate, error) {
+	conf, err := maybeGetConfigForClient(c.config, sni)
+	if err != nil {
+		return nil, err
+	}
+	// The rest of this function is mostly copied from crypto/tls.getCertificate
+
+	if conf.GetCertificate != nil {
+		cert, err := conf.GetCertificate(&tls.ClientHelloInfo{ServerName: sni})
+		if cert != nil || err != nil {
+			return cert, err
+		}
+	}
+
+	if len(conf.Certificates) == 0 {
+		return nil, errNoMatchingCertificate
+	}
+
+	if len(conf.Certificates) == 1 || conf.NameToCertificate == nil {
+		// There's only one choice, so no point doing any work.
+		return &conf.Certificates[0], nil
+	}
+
+	name := strings.ToLower(sni)
+	for len(name) > 0 && name[len(name)-1] == '.' {
+		name = name[:len(name)-1]
+	}
+
+	if cert, ok := conf.NameToCertificate[name]; ok {
+		return cert, nil
+	}
+
+	// try replacing labels in the name with wildcards until we get a
+	// match.
+	labels := strings.Split(name, ".")
+	for i := range labels {
+		labels[i] = "*"
+		candidate := strings.Join(labels, ".")
+		if cert, ok := conf.NameToCertificate[candidate]; ok {
+			return cert, nil
+		}
+	}
+
+	// If nothing matches, return the first certificate.
+	return &conf.Certificates[0], nil
+}
+
+func maybeGetConfigForClient(c *tls.Config, sni string) (*tls.Config, error) {
+	if c.GetConfigForClient == nil {
+		return c, nil
+	}
+	confForClient, err := c.GetConfigForClient(&tls.ClientHelloInfo{ServerName: sni})
+	if err != nil {
+		return nil, err
+	}
+	// if GetConfigForClient returns nil, use the original config
+	if confForClient == nil {
+		return c, nil
+	}
+	return confForClient, nil
+}

vendor/github.com/lucas-clemente/quic-go/internal/crypto/cert_compression.go

@@ -0,0 +1,272 @@
+package crypto
+
+import (
+	"bytes"
+	"compress/flate"
+	"compress/zlib"
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"hash/fnv"
+
+	"github.com/lucas-clemente/quic-go/internal/utils"
+)
+
+type entryType uint8
+
+const (
+	entryCompressed entryType = 1
+	entryCached     entryType = 2
+	entryCommon     entryType = 3
+)
+
+type entry struct {
+	t entryType
+	h uint64 // set hash
+	i uint32 // index
+}
+
+func compressChain(chain [][]byte, pCommonSetHashes, pCachedHashes []byte) ([]byte, error) {
+	res := &bytes.Buffer{}
+
+	cachedHashes, err := splitHashes(pCachedHashes)
+	if err != nil {
+		return nil, err
+	}
+
+	setHashes, err := splitHashes(pCommonSetHashes)
+	if err != nil {
+		return nil, err
+	}
+
+	chainHashes := make([]uint64, len(chain))
+	for i := range chain {
+		chainHashes[i] = HashCert(chain[i])
+	}
+
+	entries := buildEntries(chain, chainHashes, cachedHashes, setHashes)
+
+	totalUncompressedLen := 0
+	for i, e := range entries {
+		res.WriteByte(uint8(e.t))
+		switch e.t {
+		case entryCached:
+			utils.LittleEndian.WriteUint64(res, e.h)
+		case entryCommon:
+			utils.LittleEndian.WriteUint64(res, e.h)
+			utils.LittleEndian.WriteUint32(res, e.i)
+		case entryCompressed:
+			totalUncompressedLen += 4 + len(chain[i])
+		}
+	}
+	res.WriteByte(0) // end of list
+
+	if totalUncompressedLen > 0 {
+		gz, err := zlib.NewWriterLevelDict(res, flate.BestCompression, buildZlibDictForEntries(entries, chain))
+		if err != nil {
+			return nil, fmt.Errorf("cert compression failed: %s", err.Error())
+		}
+
+		utils.LittleEndian.WriteUint32(res, uint32(totalUncompressedLen))
+
+		for i, e := range entries {
+			if e.t != entryCompressed {
+				continue
+			}
+			lenCert := len(chain[i])
+			gz.Write([]byte{
+				byte(lenCert & 0xff),
+				byte((lenCert >> 8) & 0xff),
+				byte((lenCert >> 16) & 0xff),
+				byte((lenCert >> 24) & 0xff),
+			})
+			gz.Write(chain[i])
+		}
+
+		gz.Close()
+	}
+
+	return res.Bytes(), nil
+}
+
+func decompressChain(data []byte) ([][]byte, error) {
+	var chain [][]byte
+	var entries []entry
+	r := bytes.NewReader(data)
+
+	var numCerts int
+	var hasCompressedCerts bool
+	for {
+		entryTypeByte, err := r.ReadByte()
+		if entryTypeByte == 0 {
+			break
+		}
+
+		et := entryType(entryTypeByte)
+		if err != nil {
+			return nil, err
+		}
+
+		numCerts++
+
+		switch et {
+		case entryCached:
+			// we're not sending any certificate hashes in the CHLO, so there shouldn't be any cached certificates in the chain
+			return nil, errors.New("unexpected cached certificate")
+		case entryCommon:
+			e := entry{t: entryCommon}
+			e.h, err = utils.LittleEndian.ReadUint64(r)
+			if err != nil {
+				return nil, err
+			}
+			e.i, err = utils.LittleEndian.ReadUint32(r)
+			if err != nil {
+				return nil, err
+			}
+			certSet, ok := certSets[e.h]
+			if !ok {
+				return nil, errors.New("unknown certSet")
+			}
+			if e.i >= uint32(len(certSet)) {
+				return nil, errors.New("certificate not found in certSet")
+			}
+			entries = append(entries, e)
+			chain = append(chain, certSet[e.i])
+		case entryCompressed:
+			hasCompressedCerts = true
+			entries = append(entries, entry{t: entryCompressed})
+			chain = append(chain, nil)
+		default:
+			return nil, errors.New("unknown entryType")
+		}
+	}
+
+	if numCerts == 0 {
+		return make([][]byte, 0), nil
+	}
+
+	if hasCompressedCerts {
+		uncompressedLength, err := utils.LittleEndian.ReadUint32(r)
+		if err != nil {
+			fmt.Println(4)
+			return nil, err
+		}
+
+		zlibDict := buildZlibDictForEntries(entries, chain)
+		gz, err := zlib.NewReaderDict(r, zlibDict)
+		if err != nil {
+			return nil, err
+		}
+		defer gz.Close()
+
+		var totalLength uint32
+		var certIndex int
+		for totalLength < uncompressedLength {
+			lenBytes := make([]byte, 4)
+			_, err := gz.Read(lenBytes)
+			if err != nil {
+				return nil, err
+			}
+			certLen := binary.LittleEndian.Uint32(lenBytes)
+
+			cert := make([]byte, certLen)
+			n, err := gz.Read(cert)
+			if uint32(n) != certLen && err != nil {
+				return nil, err
+			}
+
+			for {
+				if certIndex >= len(entries) {
+					return nil, errors.New("CertCompression BUG: no element to save uncompressed certificate")
+				}
+				if entries[certIndex].t == entryCompressed {
+					chain[certIndex] = cert
+					certIndex++
+					break
+				}
+				certIndex++
+			}
+
+			totalLength += 4 + certLen
+		}
+	}
+
+	return chain, nil
+}
+
+func buildEntries(chain [][]byte, chainHashes, cachedHashes, setHashes []uint64) []entry {
+	res := make([]entry, len(chain))
+chainLoop:
+	for i := range chain {
+		// Check if hash is in cachedHashes
+		for j := range cachedHashes {
+			if chainHashes[i] == cachedHashes[j] {
+				res[i] = entry{t: entryCached, h: chainHashes[i]}
+				continue chainLoop
+			}
+		}
+
+		// Go through common sets and check if it's in there
+		for _, setHash := range setHashes {
+			set, ok := certSets[setHash]
+			if !ok {
+				// We don't have this set
+				continue
+			}
+			// We have this set, check if chain[i] is in the set
+			pos := set.findCertInSet(chain[i])
+			if pos >= 0 {
+				// Found
+				res[i] = entry{t: entryCommon, h: setHash, i: uint32(pos)}
+				continue chainLoop
+			}
+		}
+
+		res[i] = entry{t: entryCompressed}
+	}
+	return res
+}
+
+func buildZlibDictForEntries(entries []entry, chain [][]byte) []byte {
+	var dict bytes.Buffer
+
+	// First the cached and common in reverse order
+	for i := len(entries) - 1; i >= 0; i-- {
+		if entries[i].t == entryCompressed {
+			continue
+		}
+		dict.Write(chain[i])
+	}
+
+	dict.Write(certDictZlib)
+	return dict.Bytes()
+}
+
+func splitHashes(hashes []byte) ([]uint64, error) {
+	if len(hashes)%8 != 0 {
+		return nil, errors.New("expected a multiple of 8 bytes for CCS / CCRT hashes")
+	}
+	n := len(hashes) / 8
+	res := make([]uint64, n)
+	for i := 0; i < n; i++ {
+		res[i] = binary.LittleEndian.Uint64(hashes[i*8 : (i+1)*8])
+	}
+	return res, nil
+}
+
+func getCommonCertificateHashes() []byte {
+	ccs := make([]byte, 8*len(certSets))
+	i := 0
+	for certSetHash := range certSets {
+		binary.LittleEndian.PutUint64(ccs[i*8:(i+1)*8], certSetHash)
+		i++
+	}
+	return ccs
+}
+
+// HashCert calculates the FNV1a hash of a certificate
+func HashCert(cert []byte) uint64 {
+	h := fnv.New64a()
+	h.Write(cert)
+	return h.Sum64()
+}

vendor/github.com/lucas-clemente/quic-go/internal/crypto/cert_dict.go

@@ -0,0 +1,128 @@
+package crypto
+
+var certDictZlib = []byte{
+	0x04, 0x02, 0x30, 0x00, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x25, 0x04,
+	0x16, 0x30, 0x14, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x03,
+	0x01, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x03, 0x02, 0x30,
+	0x5f, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x86, 0xf8, 0x42, 0x04, 0x01,
+	0x06, 0x06, 0x0b, 0x60, 0x86, 0x48, 0x01, 0x86, 0xfd, 0x6d, 0x01, 0x07,
+	0x17, 0x01, 0x30, 0x33, 0x20, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x64, 0x65,
+	0x64, 0x20, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x20, 0x53, 0x20, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x65, 0x64, 0x31, 0x34,
+	0x20, 0x53, 0x53, 0x4c, 0x20, 0x43, 0x41, 0x30, 0x1e, 0x17, 0x0d, 0x31,
+	0x32, 0x20, 0x53, 0x65, 0x63, 0x75, 0x72, 0x65, 0x20, 0x53, 0x65, 0x72,
+	0x76, 0x65, 0x72, 0x20, 0x43, 0x41, 0x30, 0x2d, 0x61, 0x69, 0x61, 0x2e,
+	0x76, 0x65, 0x72, 0x69, 0x73, 0x69, 0x67, 0x6e, 0x2e, 0x63, 0x6f, 0x6d,
+	0x2f, 0x45, 0x2d, 0x63, 0x72, 0x6c, 0x2e, 0x76, 0x65, 0x72, 0x69, 0x73,
+	0x69, 0x67, 0x6e, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x45, 0x2e, 0x63, 0x65,
+	0x72, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01,
+	0x01, 0x05, 0x05, 0x00, 0x03, 0x82, 0x01, 0x01, 0x00, 0x4a, 0x2e, 0x63,
+	0x6f, 0x6d, 0x2f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73,
+	0x2f, 0x63, 0x70, 0x73, 0x20, 0x28, 0x63, 0x29, 0x30, 0x30, 0x09, 0x06,
+	0x03, 0x55, 0x1d, 0x13, 0x04, 0x02, 0x30, 0x00, 0x30, 0x1d, 0x30, 0x0d,
+	0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x05, 0x05,
+	0x00, 0x03, 0x82, 0x01, 0x01, 0x00, 0x7b, 0x30, 0x1d, 0x06, 0x03, 0x55,
+	0x1d, 0x0e, 0x30, 0x82, 0x01, 0x22, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86,
+	0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x82, 0x01,
+	0x0f, 0x00, 0x30, 0x82, 0x01, 0x0a, 0x02, 0x82, 0x01, 0x01, 0x00, 0xd2,
+	0x6f, 0x64, 0x6f, 0x63, 0x61, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x43, 0x2e,
+	0x63, 0x72, 0x6c, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x0e, 0x04, 0x16,
+	0x04, 0x14, 0xb4, 0x2e, 0x67, 0x6c, 0x6f, 0x62, 0x61, 0x6c, 0x73, 0x69,
+	0x67, 0x6e, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x72, 0x30, 0x0b, 0x06, 0x03,
+	0x55, 0x1d, 0x0f, 0x04, 0x04, 0x03, 0x02, 0x01, 0x30, 0x0d, 0x06, 0x09,
+	0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x05, 0x05, 0x00, 0x30,
+	0x81, 0xca, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13,
+	0x02, 0x55, 0x53, 0x31, 0x10, 0x30, 0x0e, 0x06, 0x03, 0x55, 0x04, 0x08,
+	0x13, 0x07, 0x41, 0x72, 0x69, 0x7a, 0x6f, 0x6e, 0x61, 0x31, 0x13, 0x30,
+	0x11, 0x06, 0x03, 0x55, 0x04, 0x07, 0x13, 0x0a, 0x53, 0x63, 0x6f, 0x74,
+	0x74, 0x73, 0x64, 0x61, 0x6c, 0x65, 0x31, 0x1a, 0x30, 0x18, 0x06, 0x03,
+	0x55, 0x04, 0x0a, 0x13, 0x11, 0x47, 0x6f, 0x44, 0x61, 0x64, 0x64, 0x79,
+	0x2e, 0x63, 0x6f, 0x6d, 0x2c, 0x20, 0x49, 0x6e, 0x63, 0x2e, 0x31, 0x33,
+	0x30, 0x31, 0x06, 0x03, 0x55, 0x04, 0x0b, 0x13, 0x2a, 0x68, 0x74, 0x74,
+	0x70, 0x3a, 0x2f, 0x2f, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63,
+	0x61, 0x74, 0x65, 0x73, 0x2e, 0x67, 0x6f, 0x64, 0x61, 0x64, 0x64, 0x79,
+	0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x72, 0x65, 0x70, 0x6f, 0x73, 0x69, 0x74,
+	0x6f, 0x72, 0x79, 0x31, 0x30, 0x30, 0x2e, 0x06, 0x03, 0x55, 0x04, 0x03,
+	0x13, 0x27, 0x47, 0x6f, 0x20, 0x44, 0x61, 0x64, 0x64, 0x79, 0x20, 0x53,
+	0x65, 0x63, 0x75, 0x72, 0x65, 0x20, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66,
+	0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x41, 0x75, 0x74, 0x68,
+	0x6f, 0x72, 0x69, 0x74, 0x79, 0x31, 0x11, 0x30, 0x0f, 0x06, 0x03, 0x55,
+	0x04, 0x05, 0x13, 0x08, 0x30, 0x37, 0x39, 0x36, 0x39, 0x32, 0x38, 0x37,
+	0x30, 0x1e, 0x17, 0x0d, 0x31, 0x31, 0x30, 0x0e, 0x06, 0x03, 0x55, 0x1d,
+	0x0f, 0x01, 0x01, 0xff, 0x04, 0x04, 0x03, 0x02, 0x05, 0xa0, 0x30, 0x0c,
+	0x06, 0x03, 0x55, 0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x02, 0x30, 0x00,
+	0x30, 0x1d, 0x30, 0x0f, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01, 0x01, 0xff,
+	0x04, 0x05, 0x30, 0x03, 0x01, 0x01, 0x00, 0x30, 0x1d, 0x06, 0x03, 0x55,
+	0x1d, 0x25, 0x04, 0x16, 0x30, 0x14, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05,
+	0x05, 0x07, 0x03, 0x01, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07,
+	0x03, 0x02, 0x30, 0x0e, 0x06, 0x03, 0x55, 0x1d, 0x0f, 0x01, 0x01, 0xff,
+	0x04, 0x04, 0x03, 0x02, 0x05, 0xa0, 0x30, 0x33, 0x06, 0x03, 0x55, 0x1d,
+	0x1f, 0x04, 0x2c, 0x30, 0x2a, 0x30, 0x28, 0xa0, 0x26, 0xa0, 0x24, 0x86,
+	0x22, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x63, 0x72, 0x6c, 0x2e,
+	0x67, 0x6f, 0x64, 0x61, 0x64, 0x64, 0x79, 0x2e, 0x63, 0x6f, 0x6d, 0x2f,
+	0x67, 0x64, 0x73, 0x31, 0x2d, 0x32, 0x30, 0x2a, 0x30, 0x28, 0x06, 0x08,
+	0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x02, 0x01, 0x16, 0x1c, 0x68, 0x74,
+	0x74, 0x70, 0x73, 0x3a, 0x2f, 0x2f, 0x77, 0x77, 0x77, 0x2e, 0x76, 0x65,
+	0x72, 0x69, 0x73, 0x69, 0x67, 0x6e, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x63,
+	0x70, 0x73, 0x30, 0x34, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x17,
+	0x0d, 0x31, 0x33, 0x30, 0x35, 0x30, 0x39, 0x06, 0x08, 0x2b, 0x06, 0x01,
+	0x05, 0x05, 0x07, 0x30, 0x02, 0x86, 0x2d, 0x68, 0x74, 0x74, 0x70, 0x3a,
+	0x2f, 0x2f, 0x73, 0x30, 0x39, 0x30, 0x37, 0x06, 0x08, 0x2b, 0x06, 0x01,
+	0x05, 0x05, 0x07, 0x02, 0x30, 0x44, 0x06, 0x03, 0x55, 0x1d, 0x20, 0x04,
+	0x3d, 0x30, 0x3b, 0x30, 0x39, 0x06, 0x0b, 0x60, 0x86, 0x48, 0x01, 0x86,
+	0xf8, 0x45, 0x01, 0x07, 0x17, 0x06, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03,
+	0x55, 0x04, 0x06, 0x13, 0x02, 0x47, 0x42, 0x31, 0x1b, 0x53, 0x31, 0x17,
+	0x30, 0x15, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x0e, 0x56, 0x65, 0x72,
+	0x69, 0x53, 0x69, 0x67, 0x6e, 0x2c, 0x20, 0x49, 0x6e, 0x63, 0x2e, 0x31,
+	0x1f, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x04, 0x0b, 0x13, 0x16, 0x56, 0x65,
+	0x72, 0x69, 0x53, 0x69, 0x67, 0x6e, 0x20, 0x54, 0x72, 0x75, 0x73, 0x74,
+	0x20, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x31, 0x3b, 0x30, 0x39,
+	0x06, 0x03, 0x55, 0x04, 0x0b, 0x13, 0x32, 0x54, 0x65, 0x72, 0x6d, 0x73,
+	0x20, 0x6f, 0x66, 0x20, 0x75, 0x73, 0x65, 0x20, 0x61, 0x74, 0x20, 0x68,
+	0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f, 0x2f, 0x77, 0x77, 0x77, 0x2e, 0x76,
+	0x65, 0x72, 0x69, 0x73, 0x69, 0x67, 0x6e, 0x2e, 0x63, 0x6f, 0x6d, 0x2f,
+	0x72, 0x70, 0x61, 0x20, 0x28, 0x63, 0x29, 0x30, 0x31, 0x10, 0x30, 0x0e,
+	0x06, 0x03, 0x55, 0x04, 0x07, 0x13, 0x07, 0x53, 0x31, 0x13, 0x30, 0x11,
+	0x06, 0x03, 0x55, 0x04, 0x0b, 0x13, 0x0a, 0x47, 0x31, 0x13, 0x30, 0x11,
+	0x06, 0x0b, 0x2b, 0x06, 0x01, 0x04, 0x01, 0x82, 0x37, 0x3c, 0x02, 0x01,
+	0x03, 0x13, 0x02, 0x55, 0x31, 0x16, 0x30, 0x14, 0x06, 0x03, 0x55, 0x04,
+	0x03, 0x14, 0x31, 0x19, 0x30, 0x17, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13,
+	0x31, 0x1d, 0x30, 0x1b, 0x06, 0x03, 0x55, 0x04, 0x0f, 0x13, 0x14, 0x50,
+	0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x20, 0x4f, 0x72, 0x67, 0x61, 0x6e,
+	0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x31, 0x12, 0x31, 0x21, 0x30,
+	0x1f, 0x06, 0x03, 0x55, 0x04, 0x0b, 0x13, 0x18, 0x44, 0x6f, 0x6d, 0x61,
+	0x69, 0x6e, 0x20, 0x43, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x20, 0x56,
+	0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x64, 0x31, 0x14, 0x31, 0x31,
+	0x30, 0x2f, 0x06, 0x03, 0x55, 0x04, 0x0b, 0x13, 0x28, 0x53, 0x65, 0x65,
+	0x20, 0x77, 0x77, 0x77, 0x2e, 0x72, 0x3a, 0x2f, 0x2f, 0x73, 0x65, 0x63,
+	0x75, 0x72, 0x65, 0x2e, 0x67, 0x47, 0x6c, 0x6f, 0x62, 0x61, 0x6c, 0x53,
+	0x69, 0x67, 0x6e, 0x31, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x43, 0x41,
+	0x2e, 0x63, 0x72, 0x6c, 0x56, 0x65, 0x72, 0x69, 0x53, 0x69, 0x67, 0x6e,
+	0x20, 0x43, 0x6c, 0x61, 0x73, 0x73, 0x20, 0x33, 0x20, 0x45, 0x63, 0x72,
+	0x6c, 0x2e, 0x67, 0x65, 0x6f, 0x74, 0x72, 0x75, 0x73, 0x74, 0x2e, 0x63,
+	0x6f, 0x6d, 0x2f, 0x63, 0x72, 0x6c, 0x73, 0x2f, 0x73, 0x64, 0x31, 0x1a,
+	0x30, 0x18, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x68, 0x74, 0x74, 0x70, 0x3a,
+	0x2f, 0x2f, 0x45, 0x56, 0x49, 0x6e, 0x74, 0x6c, 0x2d, 0x63, 0x63, 0x72,
+	0x74, 0x2e, 0x67, 0x77, 0x77, 0x77, 0x2e, 0x67, 0x69, 0x63, 0x65, 0x72,
+	0x74, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x31, 0x6f, 0x63, 0x73, 0x70, 0x2e,
+	0x76, 0x65, 0x72, 0x69, 0x73, 0x69, 0x67, 0x6e, 0x2e, 0x63, 0x6f, 0x6d,
+	0x30, 0x39, 0x72, 0x61, 0x70, 0x69, 0x64, 0x73, 0x73, 0x6c, 0x2e, 0x63,
+	0x6f, 0x73, 0x2e, 0x67, 0x6f, 0x64, 0x61, 0x64, 0x64, 0x79, 0x2e, 0x63,
+	0x6f, 0x6d, 0x2f, 0x72, 0x65, 0x70, 0x6f, 0x73, 0x69, 0x74, 0x6f, 0x72,
+	0x79, 0x2f, 0x30, 0x81, 0x80, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05,
+	0x07, 0x01, 0x01, 0x04, 0x74, 0x30, 0x72, 0x30, 0x24, 0x06, 0x08, 0x2b,
+	0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x01, 0x86, 0x18, 0x68, 0x74, 0x74,
+	0x70, 0x3a, 0x2f, 0x2f, 0x6f, 0x63, 0x73, 0x70, 0x2e, 0x67, 0x6f, 0x64,
+	0x61, 0x64, 0x64, 0x79, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x30, 0x4a, 0x06,
+	0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x30, 0x02, 0x86, 0x3e, 0x68,
+	0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66,
+	0x69, 0x63, 0x61, 0x74, 0x65, 0x73, 0x2e, 0x67, 0x6f, 0x64, 0x61, 0x64,
+	0x64, 0x79, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x72, 0x65, 0x70, 0x6f, 0x73,
+	0x69, 0x74, 0x6f, 0x72, 0x79, 0x2f, 0x67, 0x64, 0x5f, 0x69, 0x6e, 0x74,
+	0x65, 0x72, 0x6d, 0x65, 0x64, 0x69, 0x61, 0x74, 0x65, 0x2e, 0x63, 0x72,
+	0x74, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, 0x18, 0x30, 0x16,
+	0x80, 0x14, 0xfd, 0xac, 0x61, 0x32, 0x93, 0x6c, 0x45, 0xd6, 0xe2, 0xee,
+	0x85, 0x5f, 0x9a, 0xba, 0xe7, 0x76, 0x99, 0x68, 0xcc, 0xe7, 0x30, 0x27,
+	0x86, 0x29, 0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x63, 0x86, 0x30,
+	0x68, 0x74, 0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x73,
+}

vendor/github.com/lucas-clemente/quic-go/internal/crypto/cert_manager.go

@@ -0,0 +1,135 @@
+package crypto
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"errors"
+	"hash/fnv"
+	"time"
+
+	"github.com/lucas-clemente/quic-go/qerr"
+)
+
+// CertManager manages the certificates sent by the server
+type CertManager interface {
+	SetData([]byte) error
+	GetCommonCertificateHashes() []byte
+	GetLeafCert() []byte
+	GetLeafCertHash() (uint64, error)
+	VerifyServerProof(proof, chlo, serverConfigData []byte) bool
+	Verify(hostname string) error
+	GetChain() []*x509.Certificate
+}
+
+type certManager struct {
+	chain  []*x509.Certificate
+	config *tls.Config
+}
+
+var _ CertManager = &certManager{}
+
+var errNoCertificateChain = errors.New("CertManager BUG: No certicifate chain loaded")
+
+// NewCertManager creates a new CertManager
+func NewCertManager(tlsConfig *tls.Config) CertManager {
+	return &certManager{config: tlsConfig}
+}
+
+// SetData takes the byte-slice sent in the SHLO and decompresses it into the certificate chain
+func (c *certManager) SetData(data []byte) error {
+	byteChain, err := decompressChain(data)
+	if err != nil {
+		return qerr.Error(qerr.InvalidCryptoMessageParameter, "Certificate data invalid")
+	}
+
+	chain := make([]*x509.Certificate, len(byteChain))
+	for i, data := range byteChain {
+		cert, err := x509.ParseCertificate(data)
+		if err != nil {
+			return err
+		}
+		chain[i] = cert
+	}
+
+	c.chain = chain
+	return nil
+}
+
+func (c *certManager) GetChain() []*x509.Certificate {
+	return c.chain
+}
+
+func (c *certManager) GetCommonCertificateHashes() []byte {
+	return getCommonCertificateHashes()
+}
+
+// GetLeafCert returns the leaf certificate of the certificate chain
+// it returns nil if the certificate chain has not yet been set
+func (c *certManager) GetLeafCert() []byte {
+	if len(c.chain) == 0 {
+		return nil
+	}
+	return c.chain[0].Raw
+}
+
+// GetLeafCertHash calculates the FNV1a_64 hash of the leaf certificate
+func (c *certManager) GetLeafCertHash() (uint64, error) {
+	leafCert := c.GetLeafCert()
+	if leafCert == nil {
+		return 0, errNoCertificateChain
+	}
+
+	h := fnv.New64a()
+	_, err := h.Write(leafCert)
+	if err != nil {
+		return 0, err
+	}
+	return h.Sum64(), nil
+}
+
+// VerifyServerProof verifies the signature of the server config
+// it should only be called after the certificate chain has been set, otherwise it returns false
+func (c *certManager) VerifyServerProof(proof, chlo, serverConfigData []byte) bool {
+	if len(c.chain) == 0 {
+		return false
+	}
+
+	return verifyServerProof(proof, c.chain[0], chlo, serverConfigData)
+}
+
+// Verify verifies the certificate chain
+func (c *certManager) Verify(hostname string) error {
+	if len(c.chain) == 0 {
+		return errNoCertificateChain
+	}
+
+	if c.config != nil && c.config.InsecureSkipVerify {
+		return nil
+	}
+
+	leafCert := c.chain[0]
+
+	var opts x509.VerifyOptions
+	if c.config != nil {
+		opts.Roots = c.config.RootCAs
+		if c.config.Time == nil {
+			opts.CurrentTime = time.Now()
+		} else {
+			opts.CurrentTime = c.config.Time()
+		}
+	}
+	// we don't need to care about the tls.Config.ServerName here, since hostname has already been set to that value in the session setup
+	opts.DNSName = hostname
+
+	// the first certificate is the leaf certificate, all others are intermediates
+	if len(c.chain) > 1 {
+		intermediates := x509.NewCertPool()
+		for i := 1; i < len(c.chain); i++ {
+			intermediates.AddCert(c.chain[i])
+		}
+		opts.Intermediates = intermediates
+	}
+
+	_, err := leafCert.Verify(opts)
+	return err
+}

vendor/github.com/lucas-clemente/quic-go/internal/crypto/cert_sets.go

@@ -0,0 +1,24 @@
+package crypto
+
+import (
+	"bytes"
+
+	"github.com/lucas-clemente/quic-go-certificates"
+)
+
+type certSet [][]byte
+
+var certSets = map[uint64]certSet{
+	certsets.CertSet2Hash: certsets.CertSet2,
+	certsets.CertSet3Hash: certsets.CertSet3,
+}
+
+// findCertInSet searches for the cert in the set. Negative return value means not found.
+func (s *certSet) findCertInSet(cert []byte) int {
+	for i, c := range *s {
+		if bytes.Equal(c, cert) {
+			return i
+		}
+	}
+	return -1
+}

vendor/github.com/lucas-clemente/quic-go/internal/crypto/chacha20poly1305_aead.go

@@ -0,0 +1,61 @@
+// +build ignore
+
+package crypto
+
+import (
+	"crypto/cipher"
+	"encoding/binary"
+	"errors"
+
+	"github.com/aead/chacha20"
+
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+)
+
+type aeadChacha20Poly1305 struct {
+	otherIV   []byte
+	myIV      []byte
+	encrypter cipher.AEAD
+	decrypter cipher.AEAD
+}
+
+// NewAEADChacha20Poly1305 creates a AEAD using chacha20poly1305
+func NewAEADChacha20Poly1305(otherKey []byte, myKey []byte, otherIV []byte, myIV []byte) (AEAD, error) {
+	if len(myKey) != 32 || len(otherKey) != 32 || len(myIV) != 4 || len(otherIV) != 4 {
+		return nil, errors.New("chacha20poly1305: expected 32-byte keys and 4-byte IVs")
+	}
+	// copy because ChaCha20Poly1305 expects array pointers
+	var MyKey, OtherKey [32]byte
+	copy(MyKey[:], myKey)
+	copy(OtherKey[:], otherKey)
+
+	encrypter, err := chacha20.NewChaCha20Poly1305WithTagSize(&MyKey, 12)
+	if err != nil {
+		return nil, err
+	}
+	decrypter, err := chacha20.NewChaCha20Poly1305WithTagSize(&OtherKey, 12)
+	if err != nil {
+		return nil, err
+	}
+	return &aeadChacha20Poly1305{
+		otherIV:   otherIV,
+		myIV:      myIV,
+		encrypter: encrypter,
+		decrypter: decrypter,
+	}, nil
+}
+
+func (aead *aeadChacha20Poly1305) Open(dst, src []byte, packetNumber protocol.PacketNumber, associatedData []byte) ([]byte, error) {
+	return aead.decrypter.Open(dst, aead.makeNonce(aead.otherIV, packetNumber), src, associatedData)
+}
+
+func (aead *aeadChacha20Poly1305) Seal(dst, src []byte, packetNumber protocol.PacketNumber, associatedData []byte) []byte {
+	return aead.encrypter.Seal(dst, aead.makeNonce(aead.myIV, packetNumber), src, associatedData)
+}
+
+func (aead *aeadChacha20Poly1305) makeNonce(iv []byte, packetNumber protocol.PacketNumber) []byte {
+	res := make([]byte, 12)
+	copy(res[0:4], iv)
+	binary.LittleEndian.PutUint64(res[4:12], uint64(packetNumber))
+	return res
+}

vendor/github.com/lucas-clemente/quic-go/internal/crypto/curve_25519.go

@@ -0,0 +1,41 @@
+package crypto
+
+import (
+	"crypto/rand"
+	"errors"
+
+	"golang.org/x/crypto/curve25519"
+)
+
+// KeyExchange manages the exchange of keys
+type curve25519KEX struct {
+	secret [32]byte
+	public [32]byte
+}
+
+var _ KeyExchange = &curve25519KEX{}
+
+// NewCurve25519KEX creates a new KeyExchange using Curve25519, see https://cr.yp.to/ecdh.html
+func NewCurve25519KEX() (KeyExchange, error) {
+	c := &curve25519KEX{}
+	if _, err := rand.Read(c.secret[:]); err != nil {
+		return nil, errors.New("Curve25519: could not create private key")
+	}
+	curve25519.ScalarBaseMult(&c.public, &c.secret)
+	return c, nil
+}
+
+func (c *curve25519KEX) PublicKey() []byte {
+	return c.public[:]
+}
+
+func (c *curve25519KEX) CalculateSharedKey(otherPublic []byte) ([]byte, error) {
+	if len(otherPublic) != 32 {
+		return nil, errors.New("Curve25519: expected public key of 32 byte")
+	}
+	var res [32]byte
+	var otherPublicArray [32]byte
+	copy(otherPublicArray[:], otherPublic)
+	curve25519.ScalarMult(&res, &c.secret, &otherPublicArray)
+	return res[:], nil
+}

vendor/github.com/lucas-clemente/quic-go/internal/crypto/hkdf.go

@@ -0,0 +1,56 @@
+package crypto
+
+import (
+	"crypto"
+	"crypto/hmac"
+	"encoding/binary"
+)
+
+// copied from https://github.com/cloudflare/tls-tris/blob/master/hkdf.go
+func hkdfExtract(hash crypto.Hash, secret, salt []byte) []byte {
+	if salt == nil {
+		salt = make([]byte, hash.Size())
+	}
+	if secret == nil {
+		secret = make([]byte, hash.Size())
+	}
+	extractor := hmac.New(hash.New, salt)
+	extractor.Write(secret)
+	return extractor.Sum(nil)
+}
+
+// copied from https://github.com/cloudflare/tls-tris/blob/master/hkdf.go
+func hkdfExpand(hash crypto.Hash, prk, info []byte, l int) []byte {
+	var (
+		expander = hmac.New(hash.New, prk)
+		res      = make([]byte, l)
+		counter  = byte(1)
+		prev     []byte
+	)
+
+	if l > 255*expander.Size() {
+		panic("hkdf: requested too much output")
+	}
+
+	p := res
+	for len(p) > 0 {
+		expander.Reset()
+		expander.Write(prev)
+		expander.Write(info)
+		expander.Write([]byte{counter})
+		prev = expander.Sum(prev[:0])
+		counter++
+		n := copy(p, prev)
+		p = p[n:]
+	}
+
+	return res
+}
+
+func qhkdfExpand(secret []byte, label string, length int) []byte {
+	qlabel := make([]byte, 2+1+5+len(label))
+	binary.BigEndian.PutUint16(qlabel[0:2], uint16(length))
+	qlabel[2] = uint8(5 + len(label))
+	copy(qlabel[3:], []byte("QUIC "+label))
+	return hkdfExpand(crypto.SHA256, secret, qlabel, length)
+}

vendor/github.com/lucas-clemente/quic-go/internal/crypto/key_derivation.go

@@ -0,0 +1,49 @@
+package crypto
+
+import (
+	"github.com/bifurcation/mint"
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+)
+
+const (
+	clientExporterLabel = "EXPORTER-QUIC client 1rtt"
+	serverExporterLabel = "EXPORTER-QUIC server 1rtt"
+)
+
+// A TLSExporter gets the negotiated ciphersuite and computes exporter
+type TLSExporter interface {
+	ConnectionState() mint.ConnectionState
+	ComputeExporter(label string, context []byte, keyLength int) ([]byte, error)
+}
+
+// DeriveAESKeys derives the AES keys and creates a matching AES-GCM AEAD instance
+func DeriveAESKeys(tls TLSExporter, pers protocol.Perspective) (AEAD, error) {
+	var myLabel, otherLabel string
+	if pers == protocol.PerspectiveClient {
+		myLabel = clientExporterLabel
+		otherLabel = serverExporterLabel
+	} else {
+		myLabel = serverExporterLabel
+		otherLabel = clientExporterLabel
+	}
+	myKey, myIV, err := computeKeyAndIV(tls, myLabel)
+	if err != nil {
+		return nil, err
+	}
+	otherKey, otherIV, err := computeKeyAndIV(tls, otherLabel)
+	if err != nil {
+		return nil, err
+	}
+	return NewAEADAESGCM(otherKey, myKey, otherIV, myIV)
+}
+
+func computeKeyAndIV(tls TLSExporter, label string) (key, iv []byte, err error) {
+	cs := tls.ConnectionState().CipherSuite
+	secret, err := tls.ComputeExporter(label, nil, cs.Hash.Size())
+	if err != nil {
+		return nil, nil, err
+	}
+	key = qhkdfExpand(secret, "key", cs.KeyLen)
+	iv = qhkdfExpand(secret, "iv", cs.IvLen)
+	return key, iv, nil
+}

vendor/github.com/lucas-clemente/quic-go/internal/crypto/key_derivation_quic_crypto.go

@@ -0,0 +1,100 @@
+package crypto
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"io"
+
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+
+	"golang.org/x/crypto/hkdf"
+)
+
+// DeriveKeysChacha20 derives the client and server keys and creates a matching chacha20poly1305 AEAD instance
+// func DeriveKeysChacha20(version protocol.VersionNumber, forwardSecure bool, sharedSecret, nonces []byte, connID protocol.ConnectionID, chlo []byte, scfg []byte, cert []byte, divNonce []byte) (AEAD, error) {
+// 	otherKey, myKey, otherIV, myIV, err := deriveKeys(version, forwardSecure, sharedSecret, nonces, connID, chlo, scfg, cert, divNonce, 32)
+// 	if err != nil {
+// 		return nil, err
+// 	}
+// 	return NewAEADChacha20Poly1305(otherKey, myKey, otherIV, myIV)
+// }
+
+// DeriveQuicCryptoAESKeys derives the client and server keys and creates a matching AES-GCM AEAD instance
+func DeriveQuicCryptoAESKeys(forwardSecure bool, sharedSecret, nonces []byte, connID protocol.ConnectionID, chlo []byte, scfg []byte, cert []byte, divNonce []byte, pers protocol.Perspective) (AEAD, error) {
+	var swap bool
+	if pers == protocol.PerspectiveClient {
+		swap = true
+	}
+	otherKey, myKey, otherIV, myIV, err := deriveKeys(forwardSecure, sharedSecret, nonces, connID, chlo, scfg, cert, divNonce, 16, swap)
+	if err != nil {
+		return nil, err
+	}
+	return NewAEADAESGCM12(otherKey, myKey, otherIV, myIV)
+}
+
+// deriveKeys derives the keys and the IVs
+// swap should be set true if generating the values for the client, and false for the server
+func deriveKeys(forwardSecure bool, sharedSecret, nonces []byte, connID protocol.ConnectionID, chlo, scfg, cert, divNonce []byte, keyLen int, swap bool) ([]byte, []byte, []byte, []byte, error) {
+	var info bytes.Buffer
+	if forwardSecure {
+		info.Write([]byte("QUIC forward secure key expansion\x00"))
+	} else {
+		info.Write([]byte("QUIC key expansion\x00"))
+	}
+	info.Write(connID)
+	info.Write(chlo)
+	info.Write(scfg)
+	info.Write(cert)
+
+	r := hkdf.New(sha256.New, sharedSecret, nonces, info.Bytes())
+
+	s := make([]byte, 2*keyLen+2*4)
+	if _, err := io.ReadFull(r, s); err != nil {
+		return nil, nil, nil, nil, err
+	}
+
+	key1 := s[:keyLen]
+	key2 := s[keyLen : 2*keyLen]
+	iv1 := s[2*keyLen : 2*keyLen+4]
+	iv2 := s[2*keyLen+4:]
+
+	var otherKey, myKey []byte
+	var otherIV, myIV []byte
+
+	if !forwardSecure {
+		if err := diversify(key2, iv2, divNonce); err != nil {
+			return nil, nil, nil, nil, err
+		}
+	}
+
+	if swap {
+		otherKey = key2
+		myKey = key1
+		otherIV = iv2
+		myIV = iv1
+	} else {
+		otherKey = key1
+		myKey = key2
+		otherIV = iv1
+		myIV = iv2
+	}
+
+	return otherKey, myKey, otherIV, myIV, nil
+}
+
+func diversify(key, iv, divNonce []byte) error {
+	secret := make([]byte, len(key)+len(iv))
+	copy(secret, key)
+	copy(secret[len(key):], iv)
+
+	r := hkdf.New(sha256.New, secret, divNonce, []byte("QUIC key diversification"))
+
+	if _, err := io.ReadFull(r, key); err != nil {
+		return err
+	}
+	if _, err := io.ReadFull(r, iv); err != nil {
+		return err
+	}
+
+	return nil
+}

vendor/github.com/lucas-clemente/quic-go/internal/crypto/key_exchange.go

@@ -0,0 +1,7 @@
+package crypto
+
+// KeyExchange manages the exchange of keys
+type KeyExchange interface {
+	PublicKey() []byte
+	CalculateSharedKey(otherPublic []byte) ([]byte, error)
+}

vendor/github.com/lucas-clemente/quic-go/internal/crypto/null_aead.go

@@ -0,0 +1,11 @@
+package crypto
+
+import "github.com/lucas-clemente/quic-go/internal/protocol"
+
+// NewNullAEAD creates a NullAEAD
+func NewNullAEAD(p protocol.Perspective, connID protocol.ConnectionID, v protocol.VersionNumber) (AEAD, error) {
+	if v.UsesTLS() {
+		return newNullAEADAESGCM(connID, p)
+	}
+	return &nullAEADFNV128a{perspective: p}, nil
+}

vendor/github.com/lucas-clemente/quic-go/internal/crypto/null_aead_aesgcm.go

@@ -0,0 +1,40 @@
+package crypto
+
+import (
+	"crypto"
+
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+)
+
+var quicVersion1Salt = []byte{0x9c, 0x10, 0x8f, 0x98, 0x52, 0x0a, 0x5c, 0x5c, 0x32, 0x96, 0x8e, 0x95, 0x0e, 0x8a, 0x2c, 0x5f, 0xe0, 0x6d, 0x6c, 0x38}
+
+func newNullAEADAESGCM(connectionID protocol.ConnectionID, pers protocol.Perspective) (AEAD, error) {
+	clientSecret, serverSecret := computeSecrets(connectionID)
+
+	var mySecret, otherSecret []byte
+	if pers == protocol.PerspectiveClient {
+		mySecret = clientSecret
+		otherSecret = serverSecret
+	} else {
+		mySecret = serverSecret
+		otherSecret = clientSecret
+	}
+
+	myKey, myIV := computeNullAEADKeyAndIV(mySecret)
+	otherKey, otherIV := computeNullAEADKeyAndIV(otherSecret)
+
+	return NewAEADAESGCM(otherKey, myKey, otherIV, myIV)
+}
+
+func computeSecrets(connID protocol.ConnectionID) (clientSecret, serverSecret []byte) {
+	handshakeSecret := hkdfExtract(crypto.SHA256, connID, quicVersion1Salt)
+	clientSecret = qhkdfExpand(handshakeSecret, "client hs", crypto.SHA256.Size())
+	serverSecret = qhkdfExpand(handshakeSecret, "server hs", crypto.SHA256.Size())
+	return
+}
+
+func computeNullAEADKeyAndIV(secret []byte) (key, iv []byte) {
+	key = qhkdfExpand(secret, "key", 16)
+	iv = qhkdfExpand(secret, "iv", 12)
+	return
+}

vendor/github.com/lucas-clemente/quic-go/internal/crypto/null_aead_fnv128a.go

@@ -0,0 +1,79 @@
+package crypto
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"hash/fnv"
+
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+)
+
+// nullAEAD handles not-yet encrypted packets
+type nullAEADFNV128a struct {
+	perspective protocol.Perspective
+}
+
+var _ AEAD = &nullAEADFNV128a{}
+
+// Open and verify the ciphertext
+func (n *nullAEADFNV128a) Open(dst, src []byte, packetNumber protocol.PacketNumber, associatedData []byte) ([]byte, error) {
+	if len(src) < 12 {
+		return nil, errors.New("NullAEAD: ciphertext cannot be less than 12 bytes long")
+	}
+
+	hash := fnv.New128a()
+	hash.Write(associatedData)
+	hash.Write(src[12:])
+	if n.perspective == protocol.PerspectiveServer {
+		hash.Write([]byte("Client"))
+	} else {
+		hash.Write([]byte("Server"))
+	}
+	sum := make([]byte, 0, 16)
+	sum = hash.Sum(sum)
+	// The tag is written in little endian, so we need to reverse the slice.
+	reverse(sum)
+
+	if !bytes.Equal(sum[:12], src[:12]) {
+		return nil, fmt.Errorf("NullAEAD: failed to authenticate received data (%#v vs %#v)", sum[:12], src[:12])
+	}
+	return src[12:], nil
+}
+
+// Seal writes hash and ciphertext to the buffer
+func (n *nullAEADFNV128a) Seal(dst, src []byte, packetNumber protocol.PacketNumber, associatedData []byte) []byte {
+	if cap(dst) < 12+len(src) {
+		dst = make([]byte, 12+len(src))
+	} else {
+		dst = dst[:12+len(src)]
+	}
+
+	hash := fnv.New128a()
+	hash.Write(associatedData)
+	hash.Write(src)
+
+	if n.perspective == protocol.PerspectiveServer {
+		hash.Write([]byte("Server"))
+	} else {
+		hash.Write([]byte("Client"))
+	}
+	sum := make([]byte, 0, 16)
+	sum = hash.Sum(sum)
+	// The tag is written in little endian, so we need to reverse the slice.
+	reverse(sum)
+
+	copy(dst[12:], src)
+	copy(dst, sum[:12])
+	return dst
+}
+
+func (n *nullAEADFNV128a) Overhead() int {
+	return 12
+}
+
+func reverse(a []byte) {
+	for left, right := 0, len(a)-1; left < right; left, right = left+1, right-1 {
+		a[left], a[right] = a[right], a[left]
+	}
+}

vendor/github.com/lucas-clemente/quic-go/internal/crypto/server_proof.go

@@ -0,0 +1,66 @@
+package crypto
+
+import (
+	"crypto"
+	"crypto/ecdsa"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/sha256"
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/asn1"
+	"errors"
+	"math/big"
+)
+
+type ecdsaSignature struct {
+	R, S *big.Int
+}
+
+// signServerProof signs CHLO and server config for use in the server proof
+func signServerProof(cert *tls.Certificate, chlo []byte, serverConfigData []byte) ([]byte, error) {
+	hash := sha256.New()
+	hash.Write([]byte("QUIC CHLO and server config signature\x00"))
+	chloHash := sha256.Sum256(chlo)
+	hash.Write([]byte{32, 0, 0, 0})
+	hash.Write(chloHash[:])
+	hash.Write(serverConfigData)
+
+	key, ok := cert.PrivateKey.(crypto.Signer)
+	if !ok {
+		return nil, errors.New("expected PrivateKey to implement crypto.Signer")
+	}
+
+	opts := crypto.SignerOpts(crypto.SHA256)
+
+	if _, ok = key.(*rsa.PrivateKey); ok {
+		opts = &rsa.PSSOptions{SaltLength: 32, Hash: crypto.SHA256}
+	}
+
+	return key.Sign(rand.Reader, hash.Sum(nil), opts)
+}
+
+// verifyServerProof verifies the server proof signature
+func verifyServerProof(proof []byte, cert *x509.Certificate, chlo []byte, serverConfigData []byte) bool {
+	hash := sha256.New()
+	hash.Write([]byte("QUIC CHLO and server config signature\x00"))
+	chloHash := sha256.Sum256(chlo)
+	hash.Write([]byte{32, 0, 0, 0})
+	hash.Write(chloHash[:])
+	hash.Write(serverConfigData)
+
+	// RSA
+	if cert.PublicKeyAlgorithm == x509.RSA {
+		opts := &rsa.PSSOptions{SaltLength: 32, Hash: crypto.SHA256}
+		err := rsa.VerifyPSS(cert.PublicKey.(*rsa.PublicKey), crypto.SHA256, hash.Sum(nil), proof, opts)
+		return err == nil
+	}
+
+	// ECDSA
+	signature := &ecdsaSignature{}
+	rest, err := asn1.Unmarshal(proof, signature)
+	if err != nil || len(rest) != 0 {
+		return false
+	}
+	return ecdsa.Verify(cert.PublicKey.(*ecdsa.PublicKey), hash.Sum(nil), signature.R, signature.S)
+}

vendor/github.com/lucas-clemente/quic-go/internal/flowcontrol/base_flow_controller.go

@@ -0,0 +1,122 @@
+package flowcontrol
+
+import (
+	"sync"
+	"time"
+
+	"github.com/lucas-clemente/quic-go/internal/congestion"
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+	"github.com/lucas-clemente/quic-go/internal/utils"
+)
+
+type baseFlowController struct {
+	// for sending data
+	bytesSent     protocol.ByteCount
+	sendWindow    protocol.ByteCount
+	lastBlockedAt protocol.ByteCount
+
+	// for receiving data
+	mutex                sync.RWMutex
+	bytesRead            protocol.ByteCount
+	highestReceived      protocol.ByteCount
+	receiveWindow        protocol.ByteCount
+	receiveWindowSize    protocol.ByteCount
+	maxReceiveWindowSize protocol.ByteCount
+
+	epochStartTime   time.Time
+	epochStartOffset protocol.ByteCount
+	rttStats         *congestion.RTTStats
+
+	logger utils.Logger
+}
+
+// IsNewlyBlocked says if it is newly blocked by flow control.
+// For every offset, it only returns true once.
+// If it is blocked, the offset is returned.
+func (c *baseFlowController) IsNewlyBlocked() (bool, protocol.ByteCount) {
+	if c.sendWindowSize() != 0 || c.sendWindow == c.lastBlockedAt {
+		return false, 0
+	}
+	c.lastBlockedAt = c.sendWindow
+	return true, c.sendWindow
+}
+
+func (c *baseFlowController) AddBytesSent(n protocol.ByteCount) {
+	c.bytesSent += n
+}
+
+// UpdateSendWindow should be called after receiving a WindowUpdateFrame
+// it returns true if the window was actually updated
+func (c *baseFlowController) UpdateSendWindow(offset protocol.ByteCount) {
+	if offset > c.sendWindow {
+		c.sendWindow = offset
+	}
+}
+
+func (c *baseFlowController) sendWindowSize() protocol.ByteCount {
+	// this only happens during connection establishment, when data is sent before we receive the peer's transport parameters
+	if c.bytesSent > c.sendWindow {
+		return 0
+	}
+	return c.sendWindow - c.bytesSent
+}
+
+func (c *baseFlowController) AddBytesRead(n protocol.ByteCount) {
+	c.mutex.Lock()
+	defer c.mutex.Unlock()
+
+	// pretend we sent a WindowUpdate when reading the first byte
+	// this way auto-tuning of the window size already works for the first WindowUpdate
+	if c.bytesRead == 0 {
+		c.startNewAutoTuningEpoch()
+	}
+	c.bytesRead += n
+}
+
+func (c *baseFlowController) hasWindowUpdate() bool {
+	bytesRemaining := c.receiveWindow - c.bytesRead
+	// update the window when more than the threshold was consumed
+	return bytesRemaining <= protocol.ByteCount((float64(c.receiveWindowSize) * float64((1 - protocol.WindowUpdateThreshold))))
+}
+
+// getWindowUpdate updates the receive window, if necessary
+// it returns the new offset
+func (c *baseFlowController) getWindowUpdate() protocol.ByteCount {
+	if !c.hasWindowUpdate() {
+		return 0
+	}
+
+	c.maybeAdjustWindowSize()
+	c.receiveWindow = c.bytesRead + c.receiveWindowSize
+	return c.receiveWindow
+}
+
+// maybeAdjustWindowSize increases the receiveWindowSize if we're sending updates too often.
+// For details about auto-tuning, see https://docs.google.com/document/d/1SExkMmGiz8VYzV3s9E35JQlJ73vhzCekKkDi85F1qCE/edit?usp=sharing.
+func (c *baseFlowController) maybeAdjustWindowSize() {
+	bytesReadInEpoch := c.bytesRead - c.epochStartOffset
+	// don't do anything if less than half the window has been consumed
+	if bytesReadInEpoch <= c.receiveWindowSize/2 {
+		return
+	}
+	rtt := c.rttStats.SmoothedRTT()
+	if rtt == 0 {
+		return
+	}
+
+	fraction := float64(bytesReadInEpoch) / float64(c.receiveWindowSize)
+	if time.Since(c.epochStartTime) < time.Duration(4*fraction*float64(rtt)) {
+		// window is consumed too fast, try to increase the window size
+		c.receiveWindowSize = utils.MinByteCount(2*c.receiveWindowSize, c.maxReceiveWindowSize)
+	}
+	c.startNewAutoTuningEpoch()
+}
+
+func (c *baseFlowController) startNewAutoTuningEpoch() {
+	c.epochStartTime = time.Now()
+	c.epochStartOffset = c.bytesRead
+}
+
+func (c *baseFlowController) checkFlowControlViolation() bool {
+	return c.highestReceived > c.receiveWindow
+}

vendor/github.com/lucas-clemente/quic-go/internal/flowcontrol/connection_flow_controller.go

@@ -0,0 +1,87 @@
+package flowcontrol
+
+import (
+	"fmt"
+
+	"github.com/lucas-clemente/quic-go/internal/congestion"
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+	"github.com/lucas-clemente/quic-go/internal/utils"
+	"github.com/lucas-clemente/quic-go/qerr"
+)
+
+type connectionFlowController struct {
+	baseFlowController
+
+	queueWindowUpdate func()
+}
+
+var _ ConnectionFlowController = &connectionFlowController{}
+
+// NewConnectionFlowController gets a new flow controller for the connection
+// It is created before we receive the peer's transport paramenters, thus it starts with a sendWindow of 0.
+func NewConnectionFlowController(
+	receiveWindow protocol.ByteCount,
+	maxReceiveWindow protocol.ByteCount,
+	queueWindowUpdate func(),
+	rttStats *congestion.RTTStats,
+	logger utils.Logger,
+) ConnectionFlowController {
+	return &connectionFlowController{
+		baseFlowController: baseFlowController{
+			rttStats:             rttStats,
+			receiveWindow:        receiveWindow,
+			receiveWindowSize:    receiveWindow,
+			maxReceiveWindowSize: maxReceiveWindow,
+			logger:               logger,
+		},
+		queueWindowUpdate: queueWindowUpdate,
+	}
+}
+
+func (c *connectionFlowController) SendWindowSize() protocol.ByteCount {
+	return c.baseFlowController.sendWindowSize()
+}
+
+// IncrementHighestReceived adds an increment to the highestReceived value
+func (c *connectionFlowController) IncrementHighestReceived(increment protocol.ByteCount) error {
+	c.mutex.Lock()
+	defer c.mutex.Unlock()
+
+	c.highestReceived += increment
+	if c.checkFlowControlViolation() {
+		return qerr.Error(qerr.FlowControlReceivedTooMuchData, fmt.Sprintf("Received %d bytes for the connection, allowed %d bytes", c.highestReceived, c.receiveWindow))
+	}
+	return nil
+}
+
+func (c *connectionFlowController) MaybeQueueWindowUpdate() {
+	c.mutex.Lock()
+	hasWindowUpdate := c.hasWindowUpdate()
+	c.mutex.Unlock()
+	if hasWindowUpdate {
+		c.queueWindowUpdate()
+	}
+}
+
+func (c *connectionFlowController) GetWindowUpdate() protocol.ByteCount {
+	c.mutex.Lock()
+	oldWindowSize := c.receiveWindowSize
+	offset := c.baseFlowController.getWindowUpdate()
+	if oldWindowSize < c.receiveWindowSize {
+		c.logger.Debugf("Increasing receive flow control window for the connection to %d kB", c.receiveWindowSize/(1<<10))
+	}
+	c.mutex.Unlock()
+	return offset
+}
+
+// EnsureMinimumWindowSize sets a minimum window size
+// it should make sure that the connection-level window is increased when a stream-level window grows
+func (c *connectionFlowController) EnsureMinimumWindowSize(inc protocol.ByteCount) {
+	c.mutex.Lock()
+	if inc > c.receiveWindowSize {
+		c.logger.Debugf("Increasing receive flow control window for the connection to %d kB, in response to stream flow control window increase", c.receiveWindowSize/(1<<10))
+		c.receiveWindowSize = utils.MinByteCount(inc, c.maxReceiveWindowSize)
+		c.startNewAutoTuningEpoch()
+	}
+	c.mutex.Unlock()
+}

vendor/github.com/lucas-clemente/quic-go/internal/flowcontrol/interface.go

@@ -0,0 +1,38 @@
+package flowcontrol
+
+import "github.com/lucas-clemente/quic-go/internal/protocol"
+
+type flowController interface {
+	// for sending
+	SendWindowSize() protocol.ByteCount
+	UpdateSendWindow(protocol.ByteCount)
+	AddBytesSent(protocol.ByteCount)
+	// for receiving
+	AddBytesRead(protocol.ByteCount)
+	GetWindowUpdate() protocol.ByteCount // returns 0 if no update is necessary
+	MaybeQueueWindowUpdate()             //  queues a window update, if necessary
+	IsNewlyBlocked() (bool, protocol.ByteCount)
+}
+
+// A StreamFlowController is a flow controller for a QUIC stream.
+type StreamFlowController interface {
+	flowController
+	// for receiving
+	// UpdateHighestReceived should be called when a new highest offset is received
+	// final has to be to true if this is the final offset of the stream, as contained in a STREAM frame with FIN bit, and the RST_STREAM frame
+	UpdateHighestReceived(offset protocol.ByteCount, final bool) error
+}
+
+// The ConnectionFlowController is the flow controller for the connection.
+type ConnectionFlowController interface {
+	flowController
+}
+
+type connectionFlowControllerI interface {
+	ConnectionFlowController
+	// The following two methods are not supposed to be called from outside this packet, but are needed internally
+	// for sending
+	EnsureMinimumWindowSize(protocol.ByteCount)
+	// for receiving
+	IncrementHighestReceived(protocol.ByteCount) error
+}

vendor/github.com/lucas-clemente/quic-go/internal/flowcontrol/stream_flow_controller.go

@@ -0,0 +1,149 @@
+package flowcontrol
+
+import (
+	"fmt"
+
+	"github.com/lucas-clemente/quic-go/internal/congestion"
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+	"github.com/lucas-clemente/quic-go/internal/utils"
+	"github.com/lucas-clemente/quic-go/qerr"
+)
+
+type streamFlowController struct {
+	baseFlowController
+
+	streamID protocol.StreamID
+
+	queueWindowUpdate func()
+
+	connection              connectionFlowControllerI
+	contributesToConnection bool // does the stream contribute to connection level flow control
+
+	receivedFinalOffset bool
+}
+
+var _ StreamFlowController = &streamFlowController{}
+
+// NewStreamFlowController gets a new flow controller for a stream
+func NewStreamFlowController(
+	streamID protocol.StreamID,
+	contributesToConnection bool,
+	cfc ConnectionFlowController,
+	receiveWindow protocol.ByteCount,
+	maxReceiveWindow protocol.ByteCount,
+	initialSendWindow protocol.ByteCount,
+	queueWindowUpdate func(protocol.StreamID),
+	rttStats *congestion.RTTStats,
+	logger utils.Logger,
+) StreamFlowController {
+	return &streamFlowController{
+		streamID:                streamID,
+		contributesToConnection: contributesToConnection,
+		connection:              cfc.(connectionFlowControllerI),
+		queueWindowUpdate:       func() { queueWindowUpdate(streamID) },
+		baseFlowController: baseFlowController{
+			rttStats:             rttStats,
+			receiveWindow:        receiveWindow,
+			receiveWindowSize:    receiveWindow,
+			maxReceiveWindowSize: maxReceiveWindow,
+			sendWindow:           initialSendWindow,
+			logger:               logger,
+		},
+	}
+}
+
+// UpdateHighestReceived updates the highestReceived value, if the byteOffset is higher
+// it returns an ErrReceivedSmallerByteOffset if the received byteOffset is smaller than any byteOffset received before
+func (c *streamFlowController) UpdateHighestReceived(byteOffset protocol.ByteCount, final bool) error {
+	c.mutex.Lock()
+	defer c.mutex.Unlock()
+
+	// when receiving a final offset, check that this final offset is consistent with a final offset we might have received earlier
+	if final && c.receivedFinalOffset && byteOffset != c.highestReceived {
+		return qerr.Error(qerr.StreamDataAfterTermination, fmt.Sprintf("Received inconsistent final offset for stream %d (old: %d, new: %d bytes)", c.streamID, c.highestReceived, byteOffset))
+	}
+	// if we already received a final offset, check that the offset in the STREAM frames is below the final offset
+	if c.receivedFinalOffset && byteOffset > c.highestReceived {
+		return qerr.StreamDataAfterTermination
+	}
+	if final {
+		c.receivedFinalOffset = true
+	}
+	if byteOffset == c.highestReceived {
+		return nil
+	}
+	if byteOffset <= c.highestReceived {
+		// a STREAM_FRAME with a higher offset was received before.
+		if final {
+			// If the current byteOffset is smaller than the offset in that STREAM_FRAME, this STREAM_FRAME contained data after the end of the stream
+			return qerr.StreamDataAfterTermination
+		}
+		// this is a reordered STREAM_FRAME
+		return nil
+	}
+
+	increment := byteOffset - c.highestReceived
+	c.highestReceived = byteOffset
+	if c.checkFlowControlViolation() {
+		return qerr.Error(qerr.FlowControlReceivedTooMuchData, fmt.Sprintf("Received %d bytes on stream %d, allowed %d bytes", byteOffset, c.streamID, c.receiveWindow))
+	}
+	if c.contributesToConnection {
+		return c.connection.IncrementHighestReceived(increment)
+	}
+	return nil
+}
+
+func (c *streamFlowController) AddBytesRead(n protocol.ByteCount) {
+	c.baseFlowController.AddBytesRead(n)
+	if c.contributesToConnection {
+		c.connection.AddBytesRead(n)
+	}
+}
+
+func (c *streamFlowController) AddBytesSent(n protocol.ByteCount) {
+	c.baseFlowController.AddBytesSent(n)
+	if c.contributesToConnection {
+		c.connection.AddBytesSent(n)
+	}
+}
+
+func (c *streamFlowController) SendWindowSize() protocol.ByteCount {
+	window := c.baseFlowController.sendWindowSize()
+	if c.contributesToConnection {
+		window = utils.MinByteCount(window, c.connection.SendWindowSize())
+	}
+	return window
+}
+
+func (c *streamFlowController) MaybeQueueWindowUpdate() {
+	c.mutex.Lock()
+	hasWindowUpdate := !c.receivedFinalOffset && c.hasWindowUpdate()
+	c.mutex.Unlock()
+	if hasWindowUpdate {
+		c.queueWindowUpdate()
+	}
+	if c.contributesToConnection {
+		c.connection.MaybeQueueWindowUpdate()
+	}
+}
+
+func (c *streamFlowController) GetWindowUpdate() protocol.ByteCount {
+	// don't use defer for unlocking the mutex here, GetWindowUpdate() is called frequently and defer shows up in the profiler
+	c.mutex.Lock()
+	// if we already received the final offset for this stream, the peer won't need any additional flow control credit
+	if c.receivedFinalOffset {
+		c.mutex.Unlock()
+		return 0
+	}
+
+	oldWindowSize := c.receiveWindowSize
+	offset := c.baseFlowController.getWindowUpdate()
+	if c.receiveWindowSize > oldWindowSize { // auto-tuning enlarged the window size
+		c.logger.Debugf("Increasing receive flow control window for stream %d to %d kB", c.streamID, c.receiveWindowSize/(1<<10))
+		if c.contributesToConnection {
+			c.connection.EnsureMinimumWindowSize(protocol.ByteCount(float64(c.receiveWindowSize) * protocol.ConnectionFlowControlMultiplier))
+		}
+	}
+	c.mutex.Unlock()
+	return offset
+}

vendor/github.com/lucas-clemente/quic-go/internal/handshake/cookie_generator.go

@@ -0,0 +1,99 @@
+package handshake
+
+import (
+	"encoding/asn1"
+	"fmt"
+	"net"
+	"time"
+)
+
+const (
+	cookiePrefixIP byte = iota
+	cookiePrefixString
+)
+
+// A Cookie is derived from the client address and can be used to verify the ownership of this address.
+type Cookie struct {
+	RemoteAddr string
+	// The time that the STK was issued (resolution 1 second)
+	SentTime time.Time
+}
+
+// token is the struct that is used for ASN1 serialization and deserialization
+type token struct {
+	Data      []byte
+	Timestamp int64
+}
+
+// A CookieGenerator generates Cookies
+type CookieGenerator struct {
+	cookieProtector cookieProtector
+}
+
+// NewCookieGenerator initializes a new CookieGenerator
+func NewCookieGenerator() (*CookieGenerator, error) {
+	cookieProtector, err := newCookieProtector()
+	if err != nil {
+		return nil, err
+	}
+	return &CookieGenerator{
+		cookieProtector: cookieProtector,
+	}, nil
+}
+
+// NewToken generates a new Cookie for a given source address
+func (g *CookieGenerator) NewToken(raddr net.Addr) ([]byte, error) {
+	data, err := asn1.Marshal(token{
+		Data:      encodeRemoteAddr(raddr),
+		Timestamp: time.Now().Unix(),
+	})
+	if err != nil {
+		return nil, err
+	}
+	return g.cookieProtector.NewToken(data)
+}
+
+// DecodeToken decodes a Cookie
+func (g *CookieGenerator) DecodeToken(encrypted []byte) (*Cookie, error) {
+	// if the client didn't send any Cookie, DecodeToken will be called with a nil-slice
+	if len(encrypted) == 0 {
+		return nil, nil
+	}
+
+	data, err := g.cookieProtector.DecodeToken(encrypted)
+	if err != nil {
+		return nil, err
+	}
+	t := &token{}
+	rest, err := asn1.Unmarshal(data, t)
+	if err != nil {
+		return nil, err
+	}
+	if len(rest) != 0 {
+		return nil, fmt.Errorf("rest when unpacking token: %d", len(rest))
+	}
+	return &Cookie{
+		RemoteAddr: decodeRemoteAddr(t.Data),
+		SentTime:   time.Unix(t.Timestamp, 0),
+	}, nil
+}
+
+// encodeRemoteAddr encodes a remote address such that it can be saved in the Cookie
+func encodeRemoteAddr(remoteAddr net.Addr) []byte {
+	if udpAddr, ok := remoteAddr.(*net.UDPAddr); ok {
+		return append([]byte{cookiePrefixIP}, udpAddr.IP...)
+	}
+	return append([]byte{cookiePrefixString}, []byte(remoteAddr.String())...)
+}
+
+// decodeRemoteAddr decodes the remote address saved in the Cookie
+func decodeRemoteAddr(data []byte) string {
+	// data will never be empty for a Cookie that we generated. Check it to be on the safe side
+	if len(data) == 0 {
+		return ""
+	}
+	if data[0] == cookiePrefixIP {
+		return net.IP(data[1:]).String()
+	}
+	return string(data[1:])
+}

vendor/github.com/lucas-clemente/quic-go/internal/handshake/cookie_protector.go

@@ -0,0 +1,86 @@
+package handshake
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/rand"
+	"crypto/sha256"
+	"fmt"
+	"io"
+
+	"golang.org/x/crypto/hkdf"
+)
+
+// CookieProtector is used to create and verify a cookie
+type cookieProtector interface {
+	// NewToken creates a new token
+	NewToken([]byte) ([]byte, error)
+	// DecodeToken decodes a token
+	DecodeToken([]byte) ([]byte, error)
+}
+
+const (
+	cookieSecretSize = 32
+	cookieNonceSize  = 32
+)
+
+// cookieProtector is used to create and verify a cookie
+type cookieProtectorImpl struct {
+	secret []byte
+}
+
+// newCookieProtector creates a source for source address tokens
+func newCookieProtector() (cookieProtector, error) {
+	secret := make([]byte, cookieSecretSize)
+	if _, err := rand.Read(secret); err != nil {
+		return nil, err
+	}
+	return &cookieProtectorImpl{secret: secret}, nil
+}
+
+// NewToken encodes data into a new token.
+func (s *cookieProtectorImpl) NewToken(data []byte) ([]byte, error) {
+	nonce := make([]byte, cookieNonceSize)
+	if _, err := rand.Read(nonce); err != nil {
+		return nil, err
+	}
+	aead, aeadNonce, err := s.createAEAD(nonce)
+	if err != nil {
+		return nil, err
+	}
+	return append(nonce, aead.Seal(nil, aeadNonce, data, nil)...), nil
+}
+
+// DecodeToken decodes a token.
+func (s *cookieProtectorImpl) DecodeToken(p []byte) ([]byte, error) {
+	if len(p) < cookieNonceSize {
+		return nil, fmt.Errorf("Token too short: %d", len(p))
+	}
+	nonce := p[:cookieNonceSize]
+	aead, aeadNonce, err := s.createAEAD(nonce)
+	if err != nil {
+		return nil, err
+	}
+	return aead.Open(nil, aeadNonce, p[cookieNonceSize:], nil)
+}
+
+func (s *cookieProtectorImpl) createAEAD(nonce []byte) (cipher.AEAD, []byte, error) {
+	h := hkdf.New(sha256.New, s.secret, nonce, []byte("quic-go cookie source"))
+	key := make([]byte, 32) // use a 32 byte key, in order to select AES-256
+	if _, err := io.ReadFull(h, key); err != nil {
+		return nil, nil, err
+	}
+	aeadNonce := make([]byte, 12)
+	if _, err := io.ReadFull(h, aeadNonce); err != nil {
+		return nil, nil, err
+	}
+	c, err := aes.NewCipher(key)
+	if err != nil {
+		return nil, nil, err
+	}
+	aead, err := cipher.NewGCM(c)
+	if err != nil {
+		return nil, nil, err
+	}
+	return aead, aeadNonce, nil
+}

vendor/github.com/lucas-clemente/quic-go/internal/handshake/crypto_setup_client.go

@@ -0,0 +1,542 @@
+package handshake
+
+import (
+	"bytes"
+	"crypto/rand"
+	"crypto/tls"
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"io"
+	"sync"
+	"time"
+
+	"github.com/lucas-clemente/quic-go/internal/crypto"
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+	"github.com/lucas-clemente/quic-go/internal/utils"
+	"github.com/lucas-clemente/quic-go/qerr"
+)
+
+type cryptoSetupClient struct {
+	mutex sync.RWMutex
+
+	hostname           string
+	connID             protocol.ConnectionID
+	version            protocol.VersionNumber
+	initialVersion     protocol.VersionNumber
+	negotiatedVersions []protocol.VersionNumber
+
+	cryptoStream io.ReadWriter
+
+	serverConfig *serverConfigClient
+
+	stk              []byte
+	sno              []byte
+	nonc             []byte
+	proof            []byte
+	chloForSignature []byte
+	lastSentCHLO     []byte
+	certManager      crypto.CertManager
+
+	divNonceChan         chan struct{}
+	diversificationNonce []byte
+
+	clientHelloCounter int
+	serverVerified     bool // has the certificate chain and the proof already been verified
+	keyDerivation      QuicCryptoKeyDerivationFunction
+
+	receivedSecurePacket bool
+	nullAEAD             crypto.AEAD
+	secureAEAD           crypto.AEAD
+	forwardSecureAEAD    crypto.AEAD
+
+	paramsChan     chan<- TransportParameters
+	handshakeEvent chan<- struct{}
+
+	params *TransportParameters
+
+	logger utils.Logger
+}
+
+var _ CryptoSetup = &cryptoSetupClient{}
+
+var (
+	errNoObitForClientNonce             = errors.New("CryptoSetup BUG: No OBIT for client nonce available")
+	errClientNonceAlreadyExists         = errors.New("CryptoSetup BUG: A client nonce was already generated")
+	errConflictingDiversificationNonces = errors.New("Received two different diversification nonces")
+)
+
+// NewCryptoSetupClient creates a new CryptoSetup instance for a client
+func NewCryptoSetupClient(
+	cryptoStream io.ReadWriter,
+	connID protocol.ConnectionID,
+	version protocol.VersionNumber,
+	tlsConf *tls.Config,
+	params *TransportParameters,
+	paramsChan chan<- TransportParameters,
+	handshakeEvent chan<- struct{},
+	initialVersion protocol.VersionNumber,
+	negotiatedVersions []protocol.VersionNumber,
+	logger utils.Logger,
+) (CryptoSetup, error) {
+	nullAEAD, err := crypto.NewNullAEAD(protocol.PerspectiveClient, connID, version)
+	if err != nil {
+		return nil, err
+	}
+	divNonceChan := make(chan struct{})
+	cs := &cryptoSetupClient{
+		cryptoStream:   cryptoStream,
+		hostname:       tlsConf.ServerName,
+		connID:         connID,
+		version:        version,
+		certManager:    crypto.NewCertManager(tlsConf),
+		params:         params,
+		keyDerivation:  crypto.DeriveQuicCryptoAESKeys,
+		nullAEAD:       nullAEAD,
+		paramsChan:     paramsChan,
+		handshakeEvent: handshakeEvent,
+		initialVersion: initialVersion,
+		// The server might have sent greased versions in the Version Negotiation packet.
+		// We need strip those from the list, since they won't be included in the handshake tag.
+		negotiatedVersions: protocol.StripGreasedVersions(negotiatedVersions),
+		divNonceChan:       divNonceChan,
+		logger:             logger,
+	}
+	return cs, nil
+}
+
+func (h *cryptoSetupClient) HandleCryptoStream() error {
+	messageChan := make(chan HandshakeMessage)
+	errorChan := make(chan error, 1)
+
+	go func() {
+		for {
+			message, err := ParseHandshakeMessage(h.cryptoStream)
+			if err != nil {
+				errorChan <- qerr.Error(qerr.HandshakeFailed, err.Error())
+				return
+			}
+			messageChan <- message
+		}
+	}()
+
+	for {
+		if err := h.maybeUpgradeCrypto(); err != nil {
+			return err
+		}
+
+		h.mutex.RLock()
+		sendCHLO := h.secureAEAD == nil
+		h.mutex.RUnlock()
+		if sendCHLO {
+			if err := h.sendCHLO(); err != nil {
+				return err
+			}
+		}
+
+		var message HandshakeMessage
+		select {
+		case <-h.divNonceChan:
+			// there's no message to process, but we should try upgrading the crypto again
+			continue
+		case message = <-messageChan:
+		case err := <-errorChan:
+			return err
+		}
+
+		h.logger.Debugf("Got %s", message)
+		switch message.Tag {
+		case TagREJ:
+			if err := h.handleREJMessage(message.Data); err != nil {
+				return err
+			}
+		case TagSHLO:
+			params, err := h.handleSHLOMessage(message.Data)
+			if err != nil {
+				return err
+			}
+			// blocks until the session has received the parameters
+			h.paramsChan <- *params
+			h.handshakeEvent <- struct{}{}
+			close(h.handshakeEvent)
+		default:
+			return qerr.InvalidCryptoMessageType
+		}
+	}
+}
+
+func (h *cryptoSetupClient) handleREJMessage(cryptoData map[Tag][]byte) error {
+	var err error
+
+	if stk, ok := cryptoData[TagSTK]; ok {
+		h.stk = stk
+	}
+
+	if sno, ok := cryptoData[TagSNO]; ok {
+		h.sno = sno
+	}
+
+	// TODO: what happens if the server sends a different server config in two packets?
+	if scfg, ok := cryptoData[TagSCFG]; ok {
+		h.serverConfig, err = parseServerConfig(scfg)
+		if err != nil {
+			return err
+		}
+
+		if h.serverConfig.IsExpired() {
+			return qerr.CryptoServerConfigExpired
+		}
+
+		// now that we have a server config, we can use its OBIT value to generate a client nonce
+		if len(h.nonc) == 0 {
+			err = h.generateClientNonce()
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	if proof, ok := cryptoData[TagPROF]; ok {
+		h.proof = proof
+		h.chloForSignature = h.lastSentCHLO
+	}
+
+	if crt, ok := cryptoData[TagCERT]; ok {
+		err := h.certManager.SetData(crt)
+		if err != nil {
+			return qerr.Error(qerr.InvalidCryptoMessageParameter, "Certificate data invalid")
+		}
+
+		err = h.certManager.Verify(h.hostname)
+		if err != nil {
+			h.logger.Infof("Certificate validation failed: %s", err.Error())
+			return qerr.ProofInvalid
+		}
+	}
+
+	if h.serverConfig != nil && len(h.proof) != 0 && h.certManager.GetLeafCert() != nil {
+		validProof := h.certManager.VerifyServerProof(h.proof, h.chloForSignature, h.serverConfig.Get())
+		if !validProof {
+			h.logger.Infof("Server proof verification failed")
+			return qerr.ProofInvalid
+		}
+
+		h.serverVerified = true
+	}
+
+	return nil
+}
+
+func (h *cryptoSetupClient) handleSHLOMessage(cryptoData map[Tag][]byte) (*TransportParameters, error) {
+	h.mutex.Lock()
+	defer h.mutex.Unlock()
+
+	if !h.receivedSecurePacket {
+		return nil, qerr.Error(qerr.CryptoEncryptionLevelIncorrect, "unencrypted SHLO message")
+	}
+
+	if sno, ok := cryptoData[TagSNO]; ok {
+		h.sno = sno
+	}
+
+	serverPubs, ok := cryptoData[TagPUBS]
+	if !ok {
+		return nil, qerr.Error(qerr.CryptoMessageParameterNotFound, "PUBS")
+	}
+
+	verTag, ok := cryptoData[TagVER]
+	if !ok {
+		return nil, qerr.Error(qerr.InvalidCryptoMessageParameter, "server hello missing version list")
+	}
+	if !h.validateVersionList(verTag) {
+		return nil, qerr.Error(qerr.VersionNegotiationMismatch, "Downgrade attack detected")
+	}
+
+	nonce := append(h.nonc, h.sno...)
+
+	ephermalSharedSecret, err := h.serverConfig.kex.CalculateSharedKey(serverPubs)
+	if err != nil {
+		return nil, err
+	}
+
+	leafCert := h.certManager.GetLeafCert()
+
+	h.forwardSecureAEAD, err = h.keyDerivation(
+		true,
+		ephermalSharedSecret,
+		nonce,
+		h.connID,
+		h.lastSentCHLO,
+		h.serverConfig.Get(),
+		leafCert,
+		nil,
+		protocol.PerspectiveClient,
+	)
+	if err != nil {
+		return nil, err
+	}
+	h.logger.Debugf("Creating AEAD for forward-secure encryption. Stopping to accept all lower encryption levels.")
+
+	params, err := readHelloMap(cryptoData)
+	if err != nil {
+		return nil, qerr.InvalidCryptoMessageParameter
+	}
+	return params, nil
+}
+
+func (h *cryptoSetupClient) validateVersionList(verTags []byte) bool {
+	numNegotiatedVersions := len(h.negotiatedVersions)
+	if numNegotiatedVersions == 0 {
+		return true
+	}
+	if len(verTags)%4 != 0 || len(verTags)/4 != numNegotiatedVersions {
+		return false
+	}
+
+	b := bytes.NewReader(verTags)
+	for i := 0; i < numNegotiatedVersions; i++ {
+		v, err := utils.BigEndian.ReadUint32(b)
+		if err != nil { // should never occur, since the length was already checked
+			return false
+		}
+		if protocol.VersionNumber(v) != h.negotiatedVersions[i] {
+			return false
+		}
+	}
+	return true
+}
+
+func (h *cryptoSetupClient) Open(dst, src []byte, packetNumber protocol.PacketNumber, associatedData []byte) ([]byte, protocol.EncryptionLevel, error) {
+	h.mutex.RLock()
+	defer h.mutex.RUnlock()
+
+	if h.forwardSecureAEAD != nil {
+		data, err := h.forwardSecureAEAD.Open(dst, src, packetNumber, associatedData)
+		if err == nil {
+			return data, protocol.EncryptionForwardSecure, nil
+		}
+		return nil, protocol.EncryptionUnspecified, err
+	}
+
+	if h.secureAEAD != nil {
+		data, err := h.secureAEAD.Open(dst, src, packetNumber, associatedData)
+		if err == nil {
+			h.logger.Debugf("Received first secure packet. Stopping to accept unencrypted packets.")
+			h.receivedSecurePacket = true
+			return data, protocol.EncryptionSecure, nil
+		}
+		if h.receivedSecurePacket {
+			return nil, protocol.EncryptionUnspecified, err
+		}
+	}
+	res, err := h.nullAEAD.Open(dst, src, packetNumber, associatedData)
+	if err != nil {
+		return nil, protocol.EncryptionUnspecified, err
+	}
+	return res, protocol.EncryptionUnencrypted, nil
+}
+
+func (h *cryptoSetupClient) GetSealer() (protocol.EncryptionLevel, Sealer) {
+	h.mutex.RLock()
+	defer h.mutex.RUnlock()
+	if h.forwardSecureAEAD != nil {
+		return protocol.EncryptionForwardSecure, h.forwardSecureAEAD
+	} else if h.secureAEAD != nil {
+		return protocol.EncryptionSecure, h.secureAEAD
+	} else {
+		return protocol.EncryptionUnencrypted, h.nullAEAD
+	}
+}
+
+func (h *cryptoSetupClient) GetSealerForCryptoStream() (protocol.EncryptionLevel, Sealer) {
+	return protocol.EncryptionUnencrypted, h.nullAEAD
+}
+
+func (h *cryptoSetupClient) GetSealerWithEncryptionLevel(encLevel protocol.EncryptionLevel) (Sealer, error) {
+	h.mutex.RLock()
+	defer h.mutex.RUnlock()
+
+	switch encLevel {
+	case protocol.EncryptionUnencrypted:
+		return h.nullAEAD, nil
+	case protocol.EncryptionSecure:
+		if h.secureAEAD == nil {
+			return nil, errors.New("CryptoSetupClient: no secureAEAD")
+		}
+		return h.secureAEAD, nil
+	case protocol.EncryptionForwardSecure:
+		if h.forwardSecureAEAD == nil {
+			return nil, errors.New("CryptoSetupClient: no forwardSecureAEAD")
+		}
+		return h.forwardSecureAEAD, nil
+	}
+	return nil, errors.New("CryptoSetupClient: no encryption level specified")
+}
+
+func (h *cryptoSetupClient) ConnectionState() ConnectionState {
+	h.mutex.Lock()
+	defer h.mutex.Unlock()
+	return ConnectionState{
+		HandshakeComplete: h.forwardSecureAEAD != nil,
+		PeerCertificates:  h.certManager.GetChain(),
+	}
+}
+
+func (h *cryptoSetupClient) SetDiversificationNonce(divNonce []byte) error {
+	h.mutex.Lock()
+	if len(h.diversificationNonce) > 0 {
+		defer h.mutex.Unlock()
+		if !bytes.Equal(h.diversificationNonce, divNonce) {
+			return errConflictingDiversificationNonces
+		}
+		return nil
+	}
+	h.diversificationNonce = divNonce
+	h.mutex.Unlock()
+	h.divNonceChan <- struct{}{}
+	return nil
+}
+
+func (h *cryptoSetupClient) sendCHLO() error {
+	h.clientHelloCounter++
+	if h.clientHelloCounter > protocol.MaxClientHellos {
+		return qerr.Error(qerr.CryptoTooManyRejects, fmt.Sprintf("More than %d rejects", protocol.MaxClientHellos))
+	}
+
+	b := &bytes.Buffer{}
+
+	tags, err := h.getTags()
+	if err != nil {
+		return err
+	}
+	h.addPadding(tags)
+	message := HandshakeMessage{
+		Tag:  TagCHLO,
+		Data: tags,
+	}
+
+	h.logger.Debugf("Sending %s", message)
+	message.Write(b)
+
+	_, err = h.cryptoStream.Write(b.Bytes())
+	if err != nil {
+		return err
+	}
+
+	h.lastSentCHLO = b.Bytes()
+	return nil
+}
+
+func (h *cryptoSetupClient) getTags() (map[Tag][]byte, error) {
+	tags := h.params.getHelloMap()
+	tags[TagSNI] = []byte(h.hostname)
+	tags[TagPDMD] = []byte("X509")
+
+	ccs := h.certManager.GetCommonCertificateHashes()
+	if len(ccs) > 0 {
+		tags[TagCCS] = ccs
+	}
+
+	versionTag := make([]byte, 4)
+	binary.BigEndian.PutUint32(versionTag, uint32(h.initialVersion))
+	tags[TagVER] = versionTag
+
+	if len(h.stk) > 0 {
+		tags[TagSTK] = h.stk
+	}
+	if len(h.sno) > 0 {
+		tags[TagSNO] = h.sno
+	}
+
+	if h.serverConfig != nil {
+		tags[TagSCID] = h.serverConfig.ID
+
+		leafCert := h.certManager.GetLeafCert()
+		if leafCert != nil {
+			certHash, _ := h.certManager.GetLeafCertHash()
+			xlct := make([]byte, 8)
+			binary.LittleEndian.PutUint64(xlct, certHash)
+
+			tags[TagNONC] = h.nonc
+			tags[TagXLCT] = xlct
+			tags[TagKEXS] = []byte("C255")
+			tags[TagAEAD] = []byte("AESG")
+			tags[TagPUBS] = h.serverConfig.kex.PublicKey() // TODO: check if 3 bytes need to be prepended
+		}
+	}
+
+	return tags, nil
+}
+
+// add a TagPAD to a tagMap, such that the total size will be bigger than the ClientHelloMinimumSize
+func (h *cryptoSetupClient) addPadding(tags map[Tag][]byte) {
+	var size int
+	for _, tag := range tags {
+		size += 8 + len(tag) // 4 bytes for the tag + 4 bytes for the offset + the length of the data
+	}
+	paddingSize := protocol.MinClientHelloSize - size
+	if paddingSize > 0 {
+		tags[TagPAD] = bytes.Repeat([]byte{0}, paddingSize)
+	}
+}
+
+func (h *cryptoSetupClient) maybeUpgradeCrypto() error {
+	if !h.serverVerified {
+		return nil
+	}
+
+	h.mutex.Lock()
+	defer h.mutex.Unlock()
+
+	leafCert := h.certManager.GetLeafCert()
+	if h.secureAEAD == nil && (h.serverConfig != nil && len(h.serverConfig.sharedSecret) > 0 && len(h.nonc) > 0 && len(leafCert) > 0 && len(h.diversificationNonce) > 0 && len(h.lastSentCHLO) > 0) {
+		var err error
+		var nonce []byte
+		if h.sno == nil {
+			nonce = h.nonc
+		} else {
+			nonce = append(h.nonc, h.sno...)
+		}
+
+		h.secureAEAD, err = h.keyDerivation(
+			false,
+			h.serverConfig.sharedSecret,
+			nonce,
+			h.connID,
+			h.lastSentCHLO,
+			h.serverConfig.Get(),
+			leafCert,
+			h.diversificationNonce,
+			protocol.PerspectiveClient,
+		)
+		if err != nil {
+			return err
+		}
+		h.logger.Debugf("Creating AEAD for secure encryption.")
+		h.handshakeEvent <- struct{}{}
+	}
+	return nil
+}
+
+func (h *cryptoSetupClient) generateClientNonce() error {
+	if len(h.nonc) > 0 {
+		return errClientNonceAlreadyExists
+	}
+
+	nonc := make([]byte, 32)
+	binary.BigEndian.PutUint32(nonc, uint32(time.Now().Unix()))
+
+	if len(h.serverConfig.obit) != 8 {
+		return errNoObitForClientNonce
+	}
+
+	copy(nonc[4:12], h.serverConfig.obit)
+
+	_, err := rand.Read(nonc[12:])
+	if err != nil {
+		return err
+	}
+
+	h.nonc = nonc
+	return nil
+}

vendor/github.com/lucas-clemente/quic-go/internal/handshake/crypto_setup_server.go

@@ -0,0 +1,467 @@
+package handshake
+
+import (
+	"bytes"
+	"crypto/rand"
+	"encoding/binary"
+	"errors"
+	"io"
+	"net"
+	"sync"
+
+	"github.com/lucas-clemente/quic-go/internal/crypto"
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+	"github.com/lucas-clemente/quic-go/internal/utils"
+	"github.com/lucas-clemente/quic-go/qerr"
+)
+
+// QuicCryptoKeyDerivationFunction is used for key derivation
+type QuicCryptoKeyDerivationFunction func(forwardSecure bool, sharedSecret, nonces []byte, connID protocol.ConnectionID, chlo []byte, scfg []byte, cert []byte, divNonce []byte, pers protocol.Perspective) (crypto.AEAD, error)
+
+// KeyExchangeFunction is used to make a new KEX
+type KeyExchangeFunction func() (crypto.KeyExchange, error)
+
+// The CryptoSetupServer handles all things crypto for the Session
+type cryptoSetupServer struct {
+	mutex sync.RWMutex
+
+	connID               protocol.ConnectionID
+	remoteAddr           net.Addr
+	scfg                 *ServerConfig
+	diversificationNonce []byte
+
+	version           protocol.VersionNumber
+	supportedVersions []protocol.VersionNumber
+
+	acceptSTKCallback func(net.Addr, *Cookie) bool
+
+	nullAEAD                    crypto.AEAD
+	secureAEAD                  crypto.AEAD
+	forwardSecureAEAD           crypto.AEAD
+	receivedForwardSecurePacket bool
+	receivedSecurePacket        bool
+	sentSHLO                    chan struct{} // this channel is closed as soon as the SHLO has been written
+
+	receivedParams bool
+	paramsChan     chan<- TransportParameters
+	handshakeEvent chan<- struct{}
+
+	keyDerivation QuicCryptoKeyDerivationFunction
+	keyExchange   KeyExchangeFunction
+
+	cryptoStream io.ReadWriter
+
+	params *TransportParameters
+
+	sni string // need to fill out the ConnectionState
+
+	logger utils.Logger
+}
+
+var _ CryptoSetup = &cryptoSetupServer{}
+
+// ErrNSTPExperiment is returned when the client sends the NSTP tag in the CHLO.
+// This is an experiment implemented by Chrome in QUIC 38, which we don't support at this point.
+var ErrNSTPExperiment = qerr.Error(qerr.InvalidCryptoMessageParameter, "NSTP experiment. Unsupported")
+
+// NewCryptoSetup creates a new CryptoSetup instance for a server
+func NewCryptoSetup(
+	cryptoStream io.ReadWriter,
+	connID protocol.ConnectionID,
+	remoteAddr net.Addr,
+	version protocol.VersionNumber,
+	divNonce []byte,
+	scfg *ServerConfig,
+	params *TransportParameters,
+	supportedVersions []protocol.VersionNumber,
+	acceptSTK func(net.Addr, *Cookie) bool,
+	paramsChan chan<- TransportParameters,
+	handshakeEvent chan<- struct{},
+	logger utils.Logger,
+) (CryptoSetup, error) {
+	nullAEAD, err := crypto.NewNullAEAD(protocol.PerspectiveServer, connID, version)
+	if err != nil {
+		return nil, err
+	}
+	return &cryptoSetupServer{
+		cryptoStream:         cryptoStream,
+		connID:               connID,
+		remoteAddr:           remoteAddr,
+		version:              version,
+		supportedVersions:    supportedVersions,
+		diversificationNonce: divNonce,
+		scfg:                 scfg,
+		keyDerivation:        crypto.DeriveQuicCryptoAESKeys,
+		keyExchange:          getEphermalKEX,
+		nullAEAD:             nullAEAD,
+		params:               params,
+		acceptSTKCallback:    acceptSTK,
+		sentSHLO:             make(chan struct{}),
+		paramsChan:           paramsChan,
+		handshakeEvent:       handshakeEvent,
+		logger:               logger,
+	}, nil
+}
+
+// HandleCryptoStream reads and writes messages on the crypto stream
+func (h *cryptoSetupServer) HandleCryptoStream() error {
+	for {
+		var chloData bytes.Buffer
+		message, err := ParseHandshakeMessage(io.TeeReader(h.cryptoStream, &chloData))
+		if err != nil {
+			return qerr.HandshakeFailed
+		}
+		if message.Tag != TagCHLO {
+			return qerr.InvalidCryptoMessageType
+		}
+
+		h.logger.Debugf("Got %s", message)
+		done, err := h.handleMessage(chloData.Bytes(), message.Data)
+		if err != nil {
+			return err
+		}
+		if done {
+			return nil
+		}
+	}
+}
+
+func (h *cryptoSetupServer) handleMessage(chloData []byte, cryptoData map[Tag][]byte) (bool, error) {
+	if _, isNSTPExperiment := cryptoData[TagNSTP]; isNSTPExperiment {
+		return false, ErrNSTPExperiment
+	}
+
+	sniSlice, ok := cryptoData[TagSNI]
+	if !ok {
+		return false, qerr.Error(qerr.CryptoMessageParameterNotFound, "SNI required")
+	}
+	sni := string(sniSlice)
+	if sni == "" {
+		return false, qerr.Error(qerr.CryptoMessageParameterNotFound, "SNI required")
+	}
+	h.sni = sni
+
+	// prevent version downgrade attacks
+	// see https://groups.google.com/a/chromium.org/forum/#!topic/proto-quic/N-de9j63tCk for a discussion and examples
+	verSlice, ok := cryptoData[TagVER]
+	if !ok {
+		return false, qerr.Error(qerr.InvalidCryptoMessageParameter, "client hello missing version tag")
+	}
+	if len(verSlice) != 4 {
+		return false, qerr.Error(qerr.InvalidCryptoMessageParameter, "incorrect version tag")
+	}
+	ver := protocol.VersionNumber(binary.BigEndian.Uint32(verSlice))
+	// If the client's preferred version is not the version we are currently speaking, then the client went through a version negotiation.  In this case, we need to make sure that we actually do not support this version and that it wasn't a downgrade attack.
+	if ver != h.version && protocol.IsSupportedVersion(h.supportedVersions, ver) {
+		return false, qerr.Error(qerr.VersionNegotiationMismatch, "Downgrade attack detected")
+	}
+
+	var reply []byte
+	var err error
+
+	certUncompressed, err := h.scfg.certChain.GetLeafCert(sni)
+	if err != nil {
+		return false, err
+	}
+
+	params, err := readHelloMap(cryptoData)
+	if err != nil {
+		return false, err
+	}
+	// blocks until the session has received the parameters
+	if !h.receivedParams {
+		h.receivedParams = true
+		h.paramsChan <- *params
+	}
+
+	if !h.isInchoateCHLO(cryptoData, certUncompressed) {
+		// We have a CHLO with a proper server config ID, do a 0-RTT handshake
+		reply, err = h.handleCHLO(sni, chloData, cryptoData)
+		if err != nil {
+			return false, err
+		}
+		if _, err := h.cryptoStream.Write(reply); err != nil {
+			return false, err
+		}
+		h.handshakeEvent <- struct{}{}
+		close(h.sentSHLO)
+		return true, nil
+	}
+
+	// We have an inchoate or non-matching CHLO, we now send a rejection
+	reply, err = h.handleInchoateCHLO(sni, chloData, cryptoData)
+	if err != nil {
+		return false, err
+	}
+	_, err = h.cryptoStream.Write(reply)
+	return false, err
+}
+
+// Open a message
+func (h *cryptoSetupServer) Open(dst, src []byte, packetNumber protocol.PacketNumber, associatedData []byte) ([]byte, protocol.EncryptionLevel, error) {
+	h.mutex.RLock()
+	defer h.mutex.RUnlock()
+
+	if h.forwardSecureAEAD != nil {
+		res, err := h.forwardSecureAEAD.Open(dst, src, packetNumber, associatedData)
+		if err == nil {
+			if !h.receivedForwardSecurePacket { // this is the first forward secure packet we receive from the client
+				h.logger.Debugf("Received first forward-secure packet. Stopping to accept all lower encryption levels.")
+				h.receivedForwardSecurePacket = true
+				// wait for the send on the handshakeEvent chan
+				<-h.sentSHLO
+				close(h.handshakeEvent)
+			}
+			return res, protocol.EncryptionForwardSecure, nil
+		}
+		if h.receivedForwardSecurePacket {
+			return nil, protocol.EncryptionUnspecified, err
+		}
+	}
+	if h.secureAEAD != nil {
+		res, err := h.secureAEAD.Open(dst, src, packetNumber, associatedData)
+		if err == nil {
+			h.logger.Debugf("Received first secure packet. Stopping to accept unencrypted packets.")
+			h.receivedSecurePacket = true
+			return res, protocol.EncryptionSecure, nil
+		}
+		if h.receivedSecurePacket {
+			return nil, protocol.EncryptionUnspecified, err
+		}
+	}
+	res, err := h.nullAEAD.Open(dst, src, packetNumber, associatedData)
+	if err != nil {
+		return res, protocol.EncryptionUnspecified, err
+	}
+	return res, protocol.EncryptionUnencrypted, err
+}
+
+func (h *cryptoSetupServer) GetSealer() (protocol.EncryptionLevel, Sealer) {
+	h.mutex.RLock()
+	defer h.mutex.RUnlock()
+	if h.forwardSecureAEAD != nil {
+		return protocol.EncryptionForwardSecure, h.forwardSecureAEAD
+	}
+	return protocol.EncryptionUnencrypted, h.nullAEAD
+}
+
+func (h *cryptoSetupServer) GetSealerForCryptoStream() (protocol.EncryptionLevel, Sealer) {
+	h.mutex.RLock()
+	defer h.mutex.RUnlock()
+	if h.secureAEAD != nil {
+		return protocol.EncryptionSecure, h.secureAEAD
+	}
+	return protocol.EncryptionUnencrypted, h.nullAEAD
+}
+
+func (h *cryptoSetupServer) GetSealerWithEncryptionLevel(encLevel protocol.EncryptionLevel) (Sealer, error) {
+	h.mutex.RLock()
+	defer h.mutex.RUnlock()
+
+	switch encLevel {
+	case protocol.EncryptionUnencrypted:
+		return h.nullAEAD, nil
+	case protocol.EncryptionSecure:
+		if h.secureAEAD == nil {
+			return nil, errors.New("CryptoSetupServer: no secureAEAD")
+		}
+		return h.secureAEAD, nil
+	case protocol.EncryptionForwardSecure:
+		if h.forwardSecureAEAD == nil {
+			return nil, errors.New("CryptoSetupServer: no forwardSecureAEAD")
+		}
+		return h.forwardSecureAEAD, nil
+	}
+	return nil, errors.New("CryptoSetupServer: no encryption level specified")
+}
+
+func (h *cryptoSetupServer) isInchoateCHLO(cryptoData map[Tag][]byte, cert []byte) bool {
+	if _, ok := cryptoData[TagPUBS]; !ok {
+		return true
+	}
+	scid, ok := cryptoData[TagSCID]
+	if !ok || !bytes.Equal(h.scfg.ID, scid) {
+		return true
+	}
+	xlctTag, ok := cryptoData[TagXLCT]
+	if !ok || len(xlctTag) != 8 {
+		return true
+	}
+	xlct := binary.LittleEndian.Uint64(xlctTag)
+	if crypto.HashCert(cert) != xlct {
+		return true
+	}
+	return !h.acceptSTK(cryptoData[TagSTK])
+}
+
+func (h *cryptoSetupServer) acceptSTK(token []byte) bool {
+	stk, err := h.scfg.cookieGenerator.DecodeToken(token)
+	if err != nil {
+		h.logger.Debugf("STK invalid: %s", err.Error())
+		return false
+	}
+	return h.acceptSTKCallback(h.remoteAddr, stk)
+}
+
+func (h *cryptoSetupServer) handleInchoateCHLO(sni string, chlo []byte, cryptoData map[Tag][]byte) ([]byte, error) {
+	token, err := h.scfg.cookieGenerator.NewToken(h.remoteAddr)
+	if err != nil {
+		return nil, err
+	}
+
+	replyMap := map[Tag][]byte{
+		TagSCFG: h.scfg.Get(),
+		TagSTK:  token,
+		TagSVID: []byte("quic-go"),
+	}
+
+	if h.acceptSTK(cryptoData[TagSTK]) {
+		proof, err := h.scfg.Sign(sni, chlo)
+		if err != nil {
+			return nil, err
+		}
+
+		commonSetHashes := cryptoData[TagCCS]
+		cachedCertsHashes := cryptoData[TagCCRT]
+
+		certCompressed, err := h.scfg.GetCertsCompressed(sni, commonSetHashes, cachedCertsHashes)
+		if err != nil {
+			return nil, err
+		}
+		// Token was valid, send more details
+		replyMap[TagPROF] = proof
+		replyMap[TagCERT] = certCompressed
+	}
+
+	message := HandshakeMessage{
+		Tag:  TagREJ,
+		Data: replyMap,
+	}
+
+	var serverReply bytes.Buffer
+	message.Write(&serverReply)
+	h.logger.Debugf("Sending %s", message)
+	return serverReply.Bytes(), nil
+}
+
+func (h *cryptoSetupServer) handleCHLO(sni string, data []byte, cryptoData map[Tag][]byte) ([]byte, error) {
+	// We have a CHLO matching our server config, we can continue with the 0-RTT handshake
+	sharedSecret, err := h.scfg.kex.CalculateSharedKey(cryptoData[TagPUBS])
+	if err != nil {
+		return nil, err
+	}
+
+	h.mutex.Lock()
+	defer h.mutex.Unlock()
+
+	certUncompressed, err := h.scfg.certChain.GetLeafCert(sni)
+	if err != nil {
+		return nil, err
+	}
+
+	serverNonce := make([]byte, 32)
+	if _, err = rand.Read(serverNonce); err != nil {
+		return nil, err
+	}
+
+	clientNonce := cryptoData[TagNONC]
+	err = h.validateClientNonce(clientNonce)
+	if err != nil {
+		return nil, err
+	}
+
+	aead := cryptoData[TagAEAD]
+	if !bytes.Equal(aead, []byte("AESG")) {
+		return nil, qerr.Error(qerr.CryptoNoSupport, "Unsupported AEAD or KEXS")
+	}
+
+	kexs := cryptoData[TagKEXS]
+	if !bytes.Equal(kexs, []byte("C255")) {
+		return nil, qerr.Error(qerr.CryptoNoSupport, "Unsupported AEAD or KEXS")
+	}
+
+	h.secureAEAD, err = h.keyDerivation(
+		false,
+		sharedSecret,
+		clientNonce,
+		h.connID,
+		data,
+		h.scfg.Get(),
+		certUncompressed,
+		h.diversificationNonce,
+		protocol.PerspectiveServer,
+	)
+	if err != nil {
+		return nil, err
+	}
+	h.logger.Debugf("Creating AEAD for secure encryption.")
+	h.handshakeEvent <- struct{}{}
+
+	// Generate a new curve instance to derive the forward secure key
+	var fsNonce bytes.Buffer
+	fsNonce.Write(clientNonce)
+	fsNonce.Write(serverNonce)
+	ephermalKex, err := h.keyExchange()
+	if err != nil {
+		return nil, err
+	}
+	ephermalSharedSecret, err := ephermalKex.CalculateSharedKey(cryptoData[TagPUBS])
+	if err != nil {
+		return nil, err
+	}
+
+	h.forwardSecureAEAD, err = h.keyDerivation(
+		true,
+		ephermalSharedSecret,
+		fsNonce.Bytes(),
+		h.connID,
+		data,
+		h.scfg.Get(),
+		certUncompressed,
+		nil,
+		protocol.PerspectiveServer,
+	)
+	if err != nil {
+		return nil, err
+	}
+	h.logger.Debugf("Creating AEAD for forward-secure encryption.")
+
+	replyMap := h.params.getHelloMap()
+	// add crypto parameters
+	verTag := &bytes.Buffer{}
+	for _, v := range h.supportedVersions {
+		utils.BigEndian.WriteUint32(verTag, uint32(v))
+	}
+	replyMap[TagPUBS] = ephermalKex.PublicKey()
+	replyMap[TagSNO] = serverNonce
+	replyMap[TagVER] = verTag.Bytes()
+
+	// note that the SHLO *has* to fit into one packet
+	message := HandshakeMessage{
+		Tag:  TagSHLO,
+		Data: replyMap,
+	}
+	var reply bytes.Buffer
+	message.Write(&reply)
+	h.logger.Debugf("Sending %s", message)
+	return reply.Bytes(), nil
+}
+
+func (h *cryptoSetupServer) ConnectionState() ConnectionState {
+	h.mutex.Lock()
+	defer h.mutex.Unlock()
+	return ConnectionState{
+		ServerName:        h.sni,
+		HandshakeComplete: h.receivedForwardSecurePacket,
+	}
+}
+
+func (h *cryptoSetupServer) validateClientNonce(nonce []byte) error {
+	if len(nonce) != 32 {
+		return qerr.Error(qerr.InvalidCryptoMessageParameter, "invalid client nonce length")
+	}
+	if !bytes.Equal(nonce[4:12], h.scfg.obit) {
+		return qerr.Error(qerr.InvalidCryptoMessageParameter, "OBIT not matching")
+	}
+	return nil
+}

vendor/github.com/lucas-clemente/quic-go/internal/handshake/crypto_setup_tls.go

@@ -0,0 +1,163 @@
+package handshake
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"sync"
+
+	"github.com/bifurcation/mint"
+	"github.com/lucas-clemente/quic-go/internal/crypto"
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+)
+
+// KeyDerivationFunction is used for key derivation
+type KeyDerivationFunction func(crypto.TLSExporter, protocol.Perspective) (crypto.AEAD, error)
+
+type cryptoSetupTLS struct {
+	mutex sync.RWMutex
+
+	perspective protocol.Perspective
+
+	keyDerivation KeyDerivationFunction
+	nullAEAD      crypto.AEAD
+	aead          crypto.AEAD
+
+	tls            mintTLS
+	conn           *cryptoStreamConn
+	handshakeEvent chan<- struct{}
+}
+
+var _ CryptoSetupTLS = &cryptoSetupTLS{}
+
+// NewCryptoSetupTLSServer creates a new TLS CryptoSetup instance for a server
+func NewCryptoSetupTLSServer(
+	cryptoStream io.ReadWriter,
+	connID protocol.ConnectionID,
+	config *mint.Config,
+	handshakeEvent chan<- struct{},
+	version protocol.VersionNumber,
+) (CryptoSetupTLS, error) {
+	nullAEAD, err := crypto.NewNullAEAD(protocol.PerspectiveServer, connID, version)
+	if err != nil {
+		return nil, err
+	}
+	conn := newCryptoStreamConn(cryptoStream)
+	tls := mint.Server(conn, config)
+	return &cryptoSetupTLS{
+		tls:            tls,
+		conn:           conn,
+		nullAEAD:       nullAEAD,
+		perspective:    protocol.PerspectiveServer,
+		keyDerivation:  crypto.DeriveAESKeys,
+		handshakeEvent: handshakeEvent,
+	}, nil
+}
+
+// NewCryptoSetupTLSClient creates a new TLS CryptoSetup instance for a client
+func NewCryptoSetupTLSClient(
+	cryptoStream io.ReadWriter,
+	connID protocol.ConnectionID,
+	config *mint.Config,
+	handshakeEvent chan<- struct{},
+	version protocol.VersionNumber,
+) (CryptoSetupTLS, error) {
+	nullAEAD, err := crypto.NewNullAEAD(protocol.PerspectiveClient, connID, version)
+	if err != nil {
+		return nil, err
+	}
+	conn := newCryptoStreamConn(cryptoStream)
+	tls := mint.Client(conn, config)
+	return &cryptoSetupTLS{
+		tls:            tls,
+		conn:           conn,
+		perspective:    protocol.PerspectiveClient,
+		nullAEAD:       nullAEAD,
+		keyDerivation:  crypto.DeriveAESKeys,
+		handshakeEvent: handshakeEvent,
+	}, nil
+}
+
+func (h *cryptoSetupTLS) HandleCryptoStream() error {
+	for {
+		if alert := h.tls.Handshake(); alert != mint.AlertNoAlert {
+			return fmt.Errorf("TLS handshake error: %s (Alert %d)", alert.String(), alert)
+		}
+		state := h.tls.ConnectionState().HandshakeState
+		if err := h.conn.Flush(); err != nil {
+			return err
+		}
+		if state == mint.StateClientConnected || state == mint.StateServerConnected {
+			break
+		}
+	}
+
+	aead, err := h.keyDerivation(h.tls, h.perspective)
+	if err != nil {
+		return err
+	}
+	h.mutex.Lock()
+	h.aead = aead
+	h.mutex.Unlock()
+
+	h.handshakeEvent <- struct{}{}
+	close(h.handshakeEvent)
+	return nil
+}
+
+func (h *cryptoSetupTLS) OpenHandshake(dst, src []byte, packetNumber protocol.PacketNumber, associatedData []byte) ([]byte, error) {
+	return h.nullAEAD.Open(dst, src, packetNumber, associatedData)
+}
+
+func (h *cryptoSetupTLS) Open1RTT(dst, src []byte, packetNumber protocol.PacketNumber, associatedData []byte) ([]byte, error) {
+	h.mutex.RLock()
+	defer h.mutex.RUnlock()
+
+	if h.aead == nil {
+		return nil, errors.New("no 1-RTT sealer")
+	}
+	return h.aead.Open(dst, src, packetNumber, associatedData)
+}
+
+func (h *cryptoSetupTLS) GetSealer() (protocol.EncryptionLevel, Sealer) {
+	h.mutex.RLock()
+	defer h.mutex.RUnlock()
+
+	if h.aead != nil {
+		return protocol.EncryptionForwardSecure, h.aead
+	}
+	return protocol.EncryptionUnencrypted, h.nullAEAD
+}
+
+func (h *cryptoSetupTLS) GetSealerWithEncryptionLevel(encLevel protocol.EncryptionLevel) (Sealer, error) {
+	errNoSealer := fmt.Errorf("CryptoSetup: no sealer with encryption level %s", encLevel.String())
+	h.mutex.RLock()
+	defer h.mutex.RUnlock()
+
+	switch encLevel {
+	case protocol.EncryptionUnencrypted:
+		return h.nullAEAD, nil
+	case protocol.EncryptionForwardSecure:
+		if h.aead == nil {
+			return nil, errNoSealer
+		}
+		return h.aead, nil
+	default:
+		return nil, errNoSealer
+	}
+}
+
+func (h *cryptoSetupTLS) GetSealerForCryptoStream() (protocol.EncryptionLevel, Sealer) {
+	return protocol.EncryptionUnencrypted, h.nullAEAD
+}
+
+func (h *cryptoSetupTLS) ConnectionState() ConnectionState {
+	h.mutex.Lock()
+	defer h.mutex.Unlock()
+	mintConnState := h.tls.ConnectionState()
+	return ConnectionState{
+		// TODO: set the ServerName, once mint exports it
+		HandshakeComplete: h.aead != nil,
+		PeerCertificates:  mintConnState.PeerCertificates,
+	}
+}

vendor/github.com/lucas-clemente/quic-go/internal/handshake/crypto_stream_conn.go

@@ -0,0 +1,69 @@
+package handshake
+
+import (
+	"bytes"
+	"io"
+	"net"
+	"time"
+)
+
+type cryptoStreamConn struct {
+	buffer *bytes.Buffer
+	stream io.ReadWriter
+}
+
+var _ net.Conn = &cryptoStreamConn{}
+
+func newCryptoStreamConn(stream io.ReadWriter) *cryptoStreamConn {
+	return &cryptoStreamConn{
+		stream: stream,
+		buffer: &bytes.Buffer{},
+	}
+}
+
+func (c *cryptoStreamConn) Read(b []byte) (int, error) {
+	return c.stream.Read(b)
+}
+
+func (c *cryptoStreamConn) Write(p []byte) (int, error) {
+	return c.buffer.Write(p)
+}
+
+func (c *cryptoStreamConn) Flush() error {
+	if c.buffer.Len() == 0 {
+		return nil
+	}
+	_, err := c.stream.Write(c.buffer.Bytes())
+	c.buffer.Reset()
+	return err
+}
+
+// Close is not implemented
+func (c *cryptoStreamConn) Close() error {
+	return nil
+}
+
+// LocalAddr is not implemented
+func (c *cryptoStreamConn) LocalAddr() net.Addr {
+	return nil
+}
+
+// RemoteAddr is not implemented
+func (c *cryptoStreamConn) RemoteAddr() net.Addr {
+	return nil
+}
+
+// SetReadDeadline is not implemented
+func (c *cryptoStreamConn) SetReadDeadline(time.Time) error {
+	return nil
+}
+
+// SetWriteDeadline is not implemented
+func (c *cryptoStreamConn) SetWriteDeadline(time.Time) error {
+	return nil
+}
+
+// SetDeadline is not implemented
+func (c *cryptoStreamConn) SetDeadline(time.Time) error {
+	return nil
+}

vendor/github.com/lucas-clemente/quic-go/internal/handshake/ephermal_cache.go

@@ -0,0 +1,48 @@
+package handshake
+
+import (
+	"sync"
+	"time"
+
+	"github.com/lucas-clemente/quic-go/internal/crypto"
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+)
+
+var (
+	kexLifetime    = protocol.EphermalKeyLifetime
+	kexCurrent     crypto.KeyExchange
+	kexCurrentTime time.Time
+	kexMutex       sync.RWMutex
+)
+
+// getEphermalKEX returns the currently active KEX, which changes every protocol.EphermalKeyLifetime
+// See the explanation from the QUIC crypto doc:
+//
+// A single connection is the usual scope for forward security, but the security
+// difference between an ephemeral key used for a single connection, and one
+// used for all connections for 60 seconds is negligible. Thus we can amortise
+// the Diffie-Hellman key generation at the server over all the connections in a
+// small time span.
+func getEphermalKEX() (crypto.KeyExchange, error) {
+	kexMutex.RLock()
+	res := kexCurrent
+	t := kexCurrentTime
+	kexMutex.RUnlock()
+	if res != nil && time.Since(t) < kexLifetime {
+		return res, nil
+	}
+
+	kexMutex.Lock()
+	defer kexMutex.Unlock()
+	// Check if still unfulfilled
+	if kexCurrent == nil || time.Since(kexCurrentTime) >= kexLifetime {
+		kex, err := crypto.NewCurve25519KEX()
+		if err != nil {
+			return nil, err
+		}
+		kexCurrent = kex
+		kexCurrentTime = time.Now()
+		return kexCurrent, nil
+	}
+	return kexCurrent, nil
+}

vendor/github.com/lucas-clemente/quic-go/internal/handshake/handshake_message.go

@@ -0,0 +1,137 @@
+package handshake
+
+import (
+	"bytes"
+	"encoding/binary"
+	"fmt"
+	"io"
+	"sort"
+
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+	"github.com/lucas-clemente/quic-go/internal/utils"
+	"github.com/lucas-clemente/quic-go/qerr"
+)
+
+// A HandshakeMessage is a handshake message
+type HandshakeMessage struct {
+	Tag  Tag
+	Data map[Tag][]byte
+}
+
+var _ fmt.Stringer = &HandshakeMessage{}
+
+// ParseHandshakeMessage reads a crypto message
+func ParseHandshakeMessage(r io.Reader) (HandshakeMessage, error) {
+	slice4 := make([]byte, 4)
+
+	if _, err := io.ReadFull(r, slice4); err != nil {
+		return HandshakeMessage{}, err
+	}
+	messageTag := Tag(binary.LittleEndian.Uint32(slice4))
+
+	if _, err := io.ReadFull(r, slice4); err != nil {
+		return HandshakeMessage{}, err
+	}
+	nPairs := binary.LittleEndian.Uint32(slice4)
+
+	if nPairs > protocol.CryptoMaxParams {
+		return HandshakeMessage{}, qerr.CryptoTooManyEntries
+	}
+
+	index := make([]byte, nPairs*8)
+	if _, err := io.ReadFull(r, index); err != nil {
+		return HandshakeMessage{}, err
+	}
+
+	resultMap := map[Tag][]byte{}
+
+	var dataStart uint32
+	for indexPos := 0; indexPos < int(nPairs)*8; indexPos += 8 {
+		tag := Tag(binary.LittleEndian.Uint32(index[indexPos : indexPos+4]))
+		dataEnd := binary.LittleEndian.Uint32(index[indexPos+4 : indexPos+8])
+
+		dataLen := dataEnd - dataStart
+		if dataLen > protocol.CryptoParameterMaxLength {
+			return HandshakeMessage{}, qerr.Error(qerr.CryptoInvalidValueLength, "value too long")
+		}
+
+		data := make([]byte, dataLen)
+		if _, err := io.ReadFull(r, data); err != nil {
+			return HandshakeMessage{}, err
+		}
+
+		resultMap[tag] = data
+		dataStart = dataEnd
+	}
+
+	return HandshakeMessage{
+		Tag:  messageTag,
+		Data: resultMap}, nil
+}
+
+// Write writes a crypto message
+func (h HandshakeMessage) Write(b *bytes.Buffer) {
+	data := h.Data
+	utils.LittleEndian.WriteUint32(b, uint32(h.Tag))
+	utils.LittleEndian.WriteUint16(b, uint16(len(data)))
+	utils.LittleEndian.WriteUint16(b, 0)
+
+	// Save current position in the buffer, so that we can update the index in-place later
+	indexStart := b.Len()
+
+	indexData := make([]byte, 8*len(data))
+	b.Write(indexData) // Will be updated later
+
+	offset := uint32(0)
+	for i, t := range h.getTagsSorted() {
+		v := data[t]
+		b.Write(v)
+		offset += uint32(len(v))
+		binary.LittleEndian.PutUint32(indexData[i*8:], uint32(t))
+		binary.LittleEndian.PutUint32(indexData[i*8+4:], offset)
+	}
+
+	// Now we write the index data for real
+	copy(b.Bytes()[indexStart:], indexData)
+}
+
+func (h *HandshakeMessage) getTagsSorted() []Tag {
+	tags := make([]Tag, len(h.Data))
+	i := 0
+	for t := range h.Data {
+		tags[i] = t
+		i++
+	}
+	sort.Slice(tags, func(i, j int) bool {
+		return tags[i] < tags[j]
+	})
+	return tags
+}
+
+func (h HandshakeMessage) String() string {
+	var pad string
+	res := tagToString(h.Tag) + ":\n"
+	for _, tag := range h.getTagsSorted() {
+		if tag == TagPAD {
+			pad = fmt.Sprintf("\t%s: (%d bytes)\n", tagToString(tag), len(h.Data[tag]))
+		} else {
+			res += fmt.Sprintf("\t%s: %#v\n", tagToString(tag), string(h.Data[tag]))
+		}
+	}
+
+	if len(pad) > 0 {
+		res += pad
+	}
+	return res
+}
+
+func tagToString(tag Tag) string {
+	b := make([]byte, 4)
+	binary.LittleEndian.PutUint32(b, uint32(tag))
+	for i := range b {
+		if b[i] == 0 {
+			b[i] = ' '
+		}
+	}
+	return string(b)
+}

vendor/github.com/lucas-clemente/quic-go/internal/handshake/interface.go

@@ -0,0 +1,61 @@
+package handshake
+
+import (
+	"crypto/x509"
+
+	"github.com/bifurcation/mint"
+	"github.com/lucas-clemente/quic-go/internal/crypto"
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+)
+
+// Sealer seals a packet
+type Sealer interface {
+	Seal(dst, src []byte, packetNumber protocol.PacketNumber, associatedData []byte) []byte
+	Overhead() int
+}
+
+// mintTLS combines some methods needed to interact with mint.
+type mintTLS interface {
+	crypto.TLSExporter
+	Handshake() mint.Alert
+}
+
+// A TLSExtensionHandler sends and received the QUIC TLS extension.
+// It provides the parameters sent by the peer on a channel.
+type TLSExtensionHandler interface {
+	Send(mint.HandshakeType, *mint.ExtensionList) error
+	Receive(mint.HandshakeType, *mint.ExtensionList) error
+	GetPeerParams() <-chan TransportParameters
+}
+
+type baseCryptoSetup interface {
+	HandleCryptoStream() error
+	ConnectionState() ConnectionState
+
+	GetSealer() (protocol.EncryptionLevel, Sealer)
+	GetSealerWithEncryptionLevel(protocol.EncryptionLevel) (Sealer, error)
+	GetSealerForCryptoStream() (protocol.EncryptionLevel, Sealer)
+}
+
+// CryptoSetup is the crypto setup used by gQUIC
+type CryptoSetup interface {
+	baseCryptoSetup
+
+	Open(dst, src []byte, packetNumber protocol.PacketNumber, associatedData []byte) ([]byte, protocol.EncryptionLevel, error)
+}
+
+// CryptoSetupTLS is the crypto setup used by IETF QUIC
+type CryptoSetupTLS interface {
+	baseCryptoSetup
+
+	OpenHandshake(dst, src []byte, packetNumber protocol.PacketNumber, associatedData []byte) ([]byte, error)
+	Open1RTT(dst, src []byte, packetNumber protocol.PacketNumber, associatedData []byte) ([]byte, error)
+}
+
+// ConnectionState records basic details about the QUIC connection.
+// Warning: This API should not be considered stable and might change soon.
+type ConnectionState struct {
+	HandshakeComplete bool                // handshake is complete
+	ServerName        string              // server name requested by client, if any (server side only)
+	PeerCertificates  []*x509.Certificate // certificate chain presented by remote peer
+}

vendor/github.com/lucas-clemente/quic-go/internal/handshake/mockgen.go

@@ -0,0 +1,3 @@
+package handshake
+
+//go:generate sh -c "../mockgen_internal.sh handshake mock_mint_tls_test.go github.com/lucas-clemente/quic-go/internal/handshake mintTLS"

vendor/github.com/lucas-clemente/quic-go/internal/handshake/server_config.go

@@ -0,0 +1,73 @@
+package handshake
+
+import (
+	"bytes"
+	"crypto/rand"
+
+	"github.com/lucas-clemente/quic-go/internal/crypto"
+)
+
+// ServerConfig is a server config
+type ServerConfig struct {
+	kex             crypto.KeyExchange
+	certChain       crypto.CertChain
+	ID              []byte
+	obit            []byte
+	cookieGenerator *CookieGenerator
+}
+
+// NewServerConfig creates a new server config
+func NewServerConfig(kex crypto.KeyExchange, certChain crypto.CertChain) (*ServerConfig, error) {
+	id := make([]byte, 16)
+	_, err := rand.Read(id)
+	if err != nil {
+		return nil, err
+	}
+
+	obit := make([]byte, 8)
+	if _, err = rand.Read(obit); err != nil {
+		return nil, err
+	}
+
+	cookieGenerator, err := NewCookieGenerator()
+
+	if err != nil {
+		return nil, err
+	}
+
+	return &ServerConfig{
+		kex:             kex,
+		certChain:       certChain,
+		ID:              id,
+		obit:            obit,
+		cookieGenerator: cookieGenerator,
+	}, nil
+}
+
+// Get the server config binary representation
+func (s *ServerConfig) Get() []byte {
+	var serverConfig bytes.Buffer
+	msg := HandshakeMessage{
+		Tag: TagSCFG,
+		Data: map[Tag][]byte{
+			TagSCID: s.ID,
+			TagKEXS: []byte("C255"),
+			TagAEAD: []byte("AESG"),
+			TagPUBS: append([]byte{0x20, 0x00, 0x00}, s.kex.PublicKey()...),
+			TagOBIT: s.obit,
+			TagEXPY: {0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff},
+		},
+	}
+	msg.Write(&serverConfig)
+	return serverConfig.Bytes()
+}
+
+// Sign the server config and CHLO with the server's keyData
+func (s *ServerConfig) Sign(sni string, chlo []byte) ([]byte, error) {
+	return s.certChain.SignServerProof(sni, chlo, s.Get())
+}
+
+// GetCertsCompressed returns the certificate data
+func (s *ServerConfig) GetCertsCompressed(sni string, commonSetHashes, compressedHashes []byte) ([]byte, error) {
+	return s.certChain.GetCertsCompressed(sni, commonSetHashes, compressedHashes)
+}

vendor/github.com/lucas-clemente/quic-go/internal/handshake/server_config_client.go

@@ -0,0 +1,184 @@
+package handshake
+
+import (
+	"bytes"
+	"encoding/binary"
+	"errors"
+	"math"
+	"time"
+
+	"github.com/lucas-clemente/quic-go/internal/crypto"
+	"github.com/lucas-clemente/quic-go/internal/utils"
+	"github.com/lucas-clemente/quic-go/qerr"
+)
+
+type serverConfigClient struct {
+	raw    []byte
+	ID     []byte
+	obit   []byte
+	expiry time.Time
+
+	kex          crypto.KeyExchange
+	sharedSecret []byte
+}
+
+var (
+	errMessageNotServerConfig = errors.New("ServerConfig must have TagSCFG")
+)
+
+// parseServerConfig parses a server config
+func parseServerConfig(data []byte) (*serverConfigClient, error) {
+	message, err := ParseHandshakeMessage(bytes.NewReader(data))
+	if err != nil {
+		return nil, err
+	}
+	if message.Tag != TagSCFG {
+		return nil, errMessageNotServerConfig
+	}
+
+	scfg := &serverConfigClient{raw: data}
+	err = scfg.parseValues(message.Data)
+	if err != nil {
+		return nil, err
+	}
+
+	return scfg, nil
+}
+
+func (s *serverConfigClient) parseValues(tagMap map[Tag][]byte) error {
+	// SCID
+	scfgID, ok := tagMap[TagSCID]
+	if !ok {
+		return qerr.Error(qerr.CryptoMessageParameterNotFound, "SCID")
+	}
+	if len(scfgID) != 16 {
+		return qerr.Error(qerr.CryptoInvalidValueLength, "SCID")
+	}
+	s.ID = scfgID
+
+	// KEXS
+	// TODO: setup Key Exchange
+	kexs, ok := tagMap[TagKEXS]
+	if !ok {
+		return qerr.Error(qerr.CryptoMessageParameterNotFound, "KEXS")
+	}
+	if len(kexs)%4 != 0 {
+		return qerr.Error(qerr.CryptoInvalidValueLength, "KEXS")
+	}
+	c255Foundat := -1
+
+	for i := 0; i < len(kexs)/4; i++ {
+		if bytes.Equal(kexs[4*i:4*i+4], []byte("C255")) {
+			c255Foundat = i
+			break
+		}
+	}
+	if c255Foundat < 0 {
+		return qerr.Error(qerr.CryptoNoSupport, "KEXS: Could not find C255, other key exchanges are not supported")
+	}
+
+	// AEAD
+	aead, ok := tagMap[TagAEAD]
+	if !ok {
+		return qerr.Error(qerr.CryptoMessageParameterNotFound, "AEAD")
+	}
+	if len(aead)%4 != 0 {
+		return qerr.Error(qerr.CryptoInvalidValueLength, "AEAD")
+	}
+	var aesgFound bool
+	for i := 0; i < len(aead)/4; i++ {
+		if bytes.Equal(aead[4*i:4*i+4], []byte("AESG")) {
+			aesgFound = true
+			break
+		}
+	}
+	if !aesgFound {
+		return qerr.Error(qerr.CryptoNoSupport, "AEAD")
+	}
+
+	// PUBS
+	pubs, ok := tagMap[TagPUBS]
+	if !ok {
+		return qerr.Error(qerr.CryptoMessageParameterNotFound, "PUBS")
+	}
+
+	var pubsKexs []struct {
+		Length uint32
+		Value  []byte
+	}
+	var lastLen uint32
+	for i := 0; i < len(pubs)-3; i += int(lastLen) + 3 {
+		// the PUBS value is always prepended by 3 byte little endian length field
+
+		err := binary.Read(bytes.NewReader([]byte{pubs[i], pubs[i+1], pubs[i+2], 0x00}), binary.LittleEndian, &lastLen)
+		if err != nil {
+			return qerr.Error(qerr.CryptoInvalidValueLength, "PUBS not decodable")
+		}
+		if lastLen == 0 {
+			return qerr.Error(qerr.CryptoInvalidValueLength, "PUBS")
+		}
+
+		if i+3+int(lastLen) > len(pubs) {
+			return qerr.Error(qerr.CryptoInvalidValueLength, "PUBS")
+		}
+
+		pubsKexs = append(pubsKexs, struct {
+			Length uint32
+			Value  []byte
+		}{lastLen, pubs[i+3 : i+3+int(lastLen)]})
+	}
+
+	if c255Foundat >= len(pubsKexs) {
+		return qerr.Error(qerr.CryptoMessageParameterNotFound, "KEXS not in PUBS")
+	}
+
+	if pubsKexs[c255Foundat].Length != 32 {
+		return qerr.Error(qerr.CryptoInvalidValueLength, "PUBS")
+	}
+
+	var err error
+	s.kex, err = crypto.NewCurve25519KEX()
+	if err != nil {
+		return err
+	}
+
+	s.sharedSecret, err = s.kex.CalculateSharedKey(pubsKexs[c255Foundat].Value)
+	if err != nil {
+		return err
+	}
+
+	// OBIT
+	obit, ok := tagMap[TagOBIT]
+	if !ok {
+		return qerr.Error(qerr.CryptoMessageParameterNotFound, "OBIT")
+	}
+	if len(obit) != 8 {
+		return qerr.Error(qerr.CryptoInvalidValueLength, "OBIT")
+	}
+	s.obit = obit
+
+	// EXPY
+	expy, ok := tagMap[TagEXPY]
+	if !ok {
+		return qerr.Error(qerr.CryptoMessageParameterNotFound, "EXPY")
+	}
+	if len(expy) != 8 {
+		return qerr.Error(qerr.CryptoInvalidValueLength, "EXPY")
+	}
+	// make sure that the value doesn't overflow an int64
+	// furthermore, values close to MaxInt64 are not a valid input to time.Unix, thus set MaxInt64/2 as the maximum value here
+	expyTimestamp := utils.MinUint64(binary.LittleEndian.Uint64(expy), math.MaxInt64/2)
+	s.expiry = time.Unix(int64(expyTimestamp), 0)
+
+	// TODO: implement VER
+
+	return nil
+}
+
+func (s *serverConfigClient) IsExpired() bool {
+	return s.expiry.Before(time.Now())
+}
+
+func (s *serverConfigClient) Get() []byte {
+	return s.raw
+}

vendor/github.com/lucas-clemente/quic-go/internal/handshake/tags.go

@@ -0,0 +1,93 @@
+package handshake
+
+// A Tag in the QUIC crypto
+type Tag uint32
+
+const (
+	// TagCHLO is a client hello
+	TagCHLO Tag = 'C' + 'H'<<8 + 'L'<<16 + 'O'<<24
+	// TagREJ is a server hello rejection
+	TagREJ Tag = 'R' + 'E'<<8 + 'J'<<16
+	// TagSCFG is a server config
+	TagSCFG Tag = 'S' + 'C'<<8 + 'F'<<16 + 'G'<<24
+
+	// TagPAD is padding
+	TagPAD Tag = 'P' + 'A'<<8 + 'D'<<16
+	// TagSNI is the server name indication
+	TagSNI Tag = 'S' + 'N'<<8 + 'I'<<16
+	// TagVER is the QUIC version
+	TagVER Tag = 'V' + 'E'<<8 + 'R'<<16
+	// TagCCS are the hashes of the common certificate sets
+	TagCCS Tag = 'C' + 'C'<<8 + 'S'<<16
+	// TagCCRT are the hashes of the cached certificates
+	TagCCRT Tag = 'C' + 'C'<<8 + 'R'<<16 + 'T'<<24
+	// TagMSPC is max streams per connection
+	TagMSPC Tag = 'M' + 'S'<<8 + 'P'<<16 + 'C'<<24
+	// TagMIDS is max incoming dyanamic streams
+	TagMIDS Tag = 'M' + 'I'<<8 + 'D'<<16 + 'S'<<24
+	// TagUAID is the user agent ID
+	TagUAID Tag = 'U' + 'A'<<8 + 'I'<<16 + 'D'<<24
+	// TagSVID is the server ID (unofficial tag by us :)
+	TagSVID Tag = 'S' + 'V'<<8 + 'I'<<16 + 'D'<<24
+	// TagTCID is truncation of the connection ID
+	TagTCID Tag = 'T' + 'C'<<8 + 'I'<<16 + 'D'<<24
+	// TagPDMD is the proof demand
+	TagPDMD Tag = 'P' + 'D'<<8 + 'M'<<16 + 'D'<<24
+	// TagSRBF is the socket receive buffer
+	TagSRBF Tag = 'S' + 'R'<<8 + 'B'<<16 + 'F'<<24
+	// TagICSL is the idle connection state lifetime
+	TagICSL Tag = 'I' + 'C'<<8 + 'S'<<16 + 'L'<<24
+	// TagNONP is the client proof nonce
+	TagNONP Tag = 'N' + 'O'<<8 + 'N'<<16 + 'P'<<24
+	// TagSCLS is the silently close timeout
+	TagSCLS Tag = 'S' + 'C'<<8 + 'L'<<16 + 'S'<<24
+	// TagCSCT is the signed cert timestamp (RFC6962) of leaf cert
+	TagCSCT Tag = 'C' + 'S'<<8 + 'C'<<16 + 'T'<<24
+	// TagCOPT are the connection options
+	TagCOPT Tag = 'C' + 'O'<<8 + 'P'<<16 + 'T'<<24
+	// TagCFCW is the initial session/connection flow control receive window
+	TagCFCW Tag = 'C' + 'F'<<8 + 'C'<<16 + 'W'<<24
+	// TagSFCW is the initial stream flow control receive window.
+	TagSFCW Tag = 'S' + 'F'<<8 + 'C'<<16 + 'W'<<24
+
+	// TagNSTP is the no STOP_WAITING experiment
+	// currently unsupported by quic-go
+	TagNSTP Tag = 'N' + 'S'<<8 + 'T'<<16 + 'P'<<24
+
+	// TagSTK is the source-address token
+	TagSTK Tag = 'S' + 'T'<<8 + 'K'<<16
+	// TagSNO is the server nonce
+	TagSNO Tag = 'S' + 'N'<<8 + 'O'<<16
+	// TagPROF is the server proof
+	TagPROF Tag = 'P' + 'R'<<8 + 'O'<<16 + 'F'<<24
+
+	// TagNONC is the client nonce
+	TagNONC Tag = 'N' + 'O'<<8 + 'N'<<16 + 'C'<<24
+	// TagXLCT is the expected leaf certificate
+	TagXLCT Tag = 'X' + 'L'<<8 + 'C'<<16 + 'T'<<24
+
+	// TagSCID is the server config ID
+	TagSCID Tag = 'S' + 'C'<<8 + 'I'<<16 + 'D'<<24
+	// TagKEXS is the list of key exchange algos
+	TagKEXS Tag = 'K' + 'E'<<8 + 'X'<<16 + 'S'<<24
+	// TagAEAD is the list of AEAD algos
+	TagAEAD Tag = 'A' + 'E'<<8 + 'A'<<16 + 'D'<<24
+	// TagPUBS is the public value for the KEX
+	TagPUBS Tag = 'P' + 'U'<<8 + 'B'<<16 + 'S'<<24
+	// TagOBIT is the client orbit
+	TagOBIT Tag = 'O' + 'B'<<8 + 'I'<<16 + 'T'<<24
+	// TagEXPY is the server config expiry
+	TagEXPY Tag = 'E' + 'X'<<8 + 'P'<<16 + 'Y'<<24
+	// TagCERT is the CERT data
+	TagCERT Tag = 0xff545243
+
+	// TagSHLO is the server hello
+	TagSHLO Tag = 'S' + 'H'<<8 + 'L'<<16 + 'O'<<24
+
+	// TagPRST is the public reset tag
+	TagPRST Tag = 'P' + 'R'<<8 + 'S'<<16 + 'T'<<24
+	// TagRSEQ is the public reset rejected packet number
+	TagRSEQ Tag = 'R' + 'S'<<8 + 'E'<<16 + 'Q'<<24
+	// TagRNON is the public reset nonce
+	TagRNON Tag = 'R' + 'N'<<8 + 'O'<<16 + 'N'<<24
+)

vendor/github.com/lucas-clemente/quic-go/internal/handshake/tls_extension.go

@@ -0,0 +1,123 @@
+package handshake
+
+import (
+	"bytes"
+	"encoding/binary"
+	"errors"
+	"fmt"
+
+	"github.com/bifurcation/mint"
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+	"github.com/lucas-clemente/quic-go/internal/utils"
+)
+
+type transportParameterID uint16
+
+const quicTLSExtensionType = 0xff5
+
+const (
+	initialMaxStreamDataParameterID  transportParameterID = 0x0
+	initialMaxDataParameterID        transportParameterID = 0x1
+	initialMaxBidiStreamsParameterID transportParameterID = 0x2
+	idleTimeoutParameterID           transportParameterID = 0x3
+	maxPacketSizeParameterID         transportParameterID = 0x5
+	statelessResetTokenParameterID   transportParameterID = 0x6
+	initialMaxUniStreamsParameterID  transportParameterID = 0x8
+	disableMigrationParameterID      transportParameterID = 0x9
+)
+
+type clientHelloTransportParameters struct {
+	InitialVersion protocol.VersionNumber
+	Parameters     TransportParameters
+}
+
+func (p *clientHelloTransportParameters) Marshal() []byte {
+	const lenOffset = 4
+	b := &bytes.Buffer{}
+	utils.BigEndian.WriteUint32(b, uint32(p.InitialVersion))
+	b.Write([]byte{0, 0}) // length. Will be replaced later
+	p.Parameters.marshal(b)
+	data := b.Bytes()
+	binary.BigEndian.PutUint16(data[lenOffset:lenOffset+2], uint16(len(data)-lenOffset-2))
+	return data
+}
+
+func (p *clientHelloTransportParameters) Unmarshal(data []byte) error {
+	if len(data) < 6 {
+		return errors.New("transport parameter data too short")
+	}
+	p.InitialVersion = protocol.VersionNumber(binary.BigEndian.Uint32(data[:4]))
+	paramsLen := int(binary.BigEndian.Uint16(data[4:6]))
+	data = data[6:]
+	if len(data) != paramsLen {
+		return fmt.Errorf("expected transport parameters to be %d bytes long, have %d", paramsLen, len(data))
+	}
+	return p.Parameters.unmarshal(data)
+}
+
+type encryptedExtensionsTransportParameters struct {
+	NegotiatedVersion protocol.VersionNumber
+	SupportedVersions []protocol.VersionNumber
+	Parameters        TransportParameters
+}
+
+func (p *encryptedExtensionsTransportParameters) Marshal() []byte {
+	b := &bytes.Buffer{}
+	utils.BigEndian.WriteUint32(b, uint32(p.NegotiatedVersion))
+	b.WriteByte(uint8(4 * len(p.SupportedVersions)))
+	for _, v := range p.SupportedVersions {
+		utils.BigEndian.WriteUint32(b, uint32(v))
+	}
+	lenOffset := b.Len()
+	b.Write([]byte{0, 0}) // length. Will be replaced later
+	p.Parameters.marshal(b)
+	data := b.Bytes()
+	binary.BigEndian.PutUint16(data[lenOffset:lenOffset+2], uint16(len(data)-lenOffset-2))
+	return data
+}
+
+func (p *encryptedExtensionsTransportParameters) Unmarshal(data []byte) error {
+	if len(data) < 5 {
+		return errors.New("transport parameter data too short")
+	}
+	p.NegotiatedVersion = protocol.VersionNumber(binary.BigEndian.Uint32(data[:4]))
+	numVersions := int(data[4])
+	if numVersions%4 != 0 {
+		return fmt.Errorf("invalid length for version list: %d", numVersions)
+	}
+	numVersions /= 4
+	data = data[5:]
+	if len(data) < 4*numVersions+2 /*length field for the parameter list */ {
+		return errors.New("transport parameter data too short")
+	}
+	p.SupportedVersions = make([]protocol.VersionNumber, numVersions)
+	for i := 0; i < numVersions; i++ {
+		p.SupportedVersions[i] = protocol.VersionNumber(binary.BigEndian.Uint32(data[:4]))
+		data = data[4:]
+	}
+	paramsLen := int(binary.BigEndian.Uint16(data[:2]))
+	data = data[2:]
+	if len(data) != paramsLen {
+		return fmt.Errorf("expected transport parameters to be %d bytes long, have %d", paramsLen, len(data))
+	}
+	return p.Parameters.unmarshal(data)
+}
+
+type tlsExtensionBody struct {
+	data []byte
+}
+
+var _ mint.ExtensionBody = &tlsExtensionBody{}
+
+func (e *tlsExtensionBody) Type() mint.ExtensionType {
+	return quicTLSExtensionType
+}
+
+func (e *tlsExtensionBody) Marshal() ([]byte, error) {
+	return e.data, nil
+}
+
+func (e *tlsExtensionBody) Unmarshal(data []byte) (int, error) {
+	e.data = data
+	return len(data), nil
+}

vendor/github.com/lucas-clemente/quic-go/internal/handshake/tls_extension_handler_client.go

@@ -0,0 +1,112 @@
+package handshake
+
+import (
+	"errors"
+	"fmt"
+
+	"github.com/lucas-clemente/quic-go/qerr"
+
+	"github.com/bifurcation/mint"
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+	"github.com/lucas-clemente/quic-go/internal/utils"
+)
+
+type extensionHandlerClient struct {
+	ourParams  *TransportParameters
+	paramsChan chan TransportParameters
+
+	initialVersion    protocol.VersionNumber
+	supportedVersions []protocol.VersionNumber
+	version           protocol.VersionNumber
+
+	logger utils.Logger
+}
+
+var _ mint.AppExtensionHandler = &extensionHandlerClient{}
+var _ TLSExtensionHandler = &extensionHandlerClient{}
+
+// NewExtensionHandlerClient creates a new extension handler for the client.
+func NewExtensionHandlerClient(
+	params *TransportParameters,
+	initialVersion protocol.VersionNumber,
+	supportedVersions []protocol.VersionNumber,
+	version protocol.VersionNumber,
+	logger utils.Logger,
+) TLSExtensionHandler {
+	// The client reads the transport parameters from the Encrypted Extensions message.
+	// The paramsChan is used in the session's run loop's select statement.
+	// We have to use an unbuffered channel here to make sure that the session actually processes the transport parameters immediately.
+	paramsChan := make(chan TransportParameters)
+	return &extensionHandlerClient{
+		ourParams:         params,
+		paramsChan:        paramsChan,
+		initialVersion:    initialVersion,
+		supportedVersions: supportedVersions,
+		version:           version,
+		logger:            logger,
+	}
+}
+
+func (h *extensionHandlerClient) Send(hType mint.HandshakeType, el *mint.ExtensionList) error {
+	if hType != mint.HandshakeTypeClientHello {
+		return nil
+	}
+	h.logger.Debugf("Sending Transport Parameters: %s", h.ourParams)
+	chtp := &clientHelloTransportParameters{
+		InitialVersion: h.initialVersion,
+		Parameters:     *h.ourParams,
+	}
+	return el.Add(&tlsExtensionBody{data: chtp.Marshal()})
+}
+
+func (h *extensionHandlerClient) Receive(hType mint.HandshakeType, el *mint.ExtensionList) error {
+	ext := &tlsExtensionBody{}
+	found, err := el.Find(ext)
+	if err != nil {
+		return err
+	}
+
+	if hType != mint.HandshakeTypeEncryptedExtensions {
+		if found {
+			return fmt.Errorf("Unexpected QUIC extension in handshake message %d", hType)
+		}
+		return nil
+	}
+
+	// hType == mint.HandshakeTypeEncryptedExtensions
+	if !found {
+		return errors.New("EncryptedExtensions message didn't contain a QUIC extension")
+	}
+
+	eetp := &encryptedExtensionsTransportParameters{}
+	if err := eetp.Unmarshal(ext.data); err != nil {
+		return err
+	}
+	// check that the negotiated_version is the current version
+	if eetp.NegotiatedVersion != h.version {
+		return qerr.Error(qerr.VersionNegotiationMismatch, "current version doesn't match negotiated_version")
+	}
+	// check that the current version is included in the supported versions
+	if !protocol.IsSupportedVersion(eetp.SupportedVersions, h.version) {
+		return qerr.Error(qerr.VersionNegotiationMismatch, "current version not included in the supported versions")
+	}
+	// if version negotiation was performed, check that we would have selected the current version based on the supported versions sent by the server
+	if h.version != h.initialVersion {
+		negotiatedVersion, ok := protocol.ChooseSupportedVersion(h.supportedVersions, eetp.SupportedVersions)
+		if !ok || h.version != negotiatedVersion {
+			return qerr.Error(qerr.VersionNegotiationMismatch, "would have picked a different version")
+		}
+	}
+
+	// check that the server sent a stateless reset token
+	if len(eetp.Parameters.StatelessResetToken) == 0 {
+		return errors.New("server didn't sent stateless_reset_token")
+	}
+	h.logger.Debugf("Received Transport Parameters: %s", &eetp.Parameters)
+	h.paramsChan <- eetp.Parameters
+	return nil
+}
+
+func (h *extensionHandlerClient) GetPeerParams() <-chan TransportParameters {
+	return h.paramsChan
+}

vendor/github.com/lucas-clemente/quic-go/internal/handshake/tls_extension_handler_server.go

@@ -0,0 +1,100 @@
+package handshake
+
+import (
+	"errors"
+	"fmt"
+
+	"github.com/lucas-clemente/quic-go/qerr"
+
+	"github.com/bifurcation/mint"
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+	"github.com/lucas-clemente/quic-go/internal/utils"
+)
+
+type extensionHandlerServer struct {
+	ourParams  *TransportParameters
+	paramsChan chan TransportParameters
+
+	version           protocol.VersionNumber
+	supportedVersions []protocol.VersionNumber
+
+	logger utils.Logger
+}
+
+var _ mint.AppExtensionHandler = &extensionHandlerServer{}
+var _ TLSExtensionHandler = &extensionHandlerServer{}
+
+// NewExtensionHandlerServer creates a new extension handler for the server
+func NewExtensionHandlerServer(
+	params *TransportParameters,
+	supportedVersions []protocol.VersionNumber,
+	version protocol.VersionNumber,
+	logger utils.Logger,
+) TLSExtensionHandler {
+	// Processing the ClientHello is performed statelessly (and from a single go-routine).
+	// Therefore, we have to use a buffered chan to pass the transport parameters to that go routine.
+	paramsChan := make(chan TransportParameters, 1)
+	return &extensionHandlerServer{
+		ourParams:         params,
+		paramsChan:        paramsChan,
+		supportedVersions: supportedVersions,
+		version:           version,
+		logger:            logger,
+	}
+}
+
+func (h *extensionHandlerServer) Send(hType mint.HandshakeType, el *mint.ExtensionList) error {
+	if hType != mint.HandshakeTypeEncryptedExtensions {
+		return nil
+	}
+	h.logger.Debugf("Sending Transport Parameters: %s", h.ourParams)
+	eetp := &encryptedExtensionsTransportParameters{
+		NegotiatedVersion: h.version,
+		SupportedVersions: protocol.GetGreasedVersions(h.supportedVersions),
+		Parameters:        *h.ourParams,
+	}
+	return el.Add(&tlsExtensionBody{data: eetp.Marshal()})
+}
+
+func (h *extensionHandlerServer) Receive(hType mint.HandshakeType, el *mint.ExtensionList) error {
+	ext := &tlsExtensionBody{}
+	found, err := el.Find(ext)
+	if err != nil {
+		return err
+	}
+
+	if hType != mint.HandshakeTypeClientHello {
+		if found {
+			return fmt.Errorf("Unexpected QUIC extension in handshake message %d", hType)
+		}
+		return nil
+	}
+
+	if !found {
+		return errors.New("ClientHello didn't contain a QUIC extension")
+	}
+	chtp := &clientHelloTransportParameters{}
+	if err := chtp.Unmarshal(ext.data); err != nil {
+		return err
+	}
+
+	// perform the stateless version negotiation validation:
+	// make sure that we would have sent a Version Negotiation Packet if the client offered the initial version
+	// this is the case if and only if the initial version is not contained in the supported versions
+	if chtp.InitialVersion != h.version && protocol.IsSupportedVersion(h.supportedVersions, chtp.InitialVersion) {
+		return qerr.Error(qerr.VersionNegotiationMismatch, "Client should have used the initial version")
+	}
+
+	// check that the client didn't send a stateless reset token
+	if len(chtp.Parameters.StatelessResetToken) != 0 {
+		// TODO: return the correct error type
+		return errors.New("client sent a stateless reset token")
+	}
+	h.logger.Debugf("Received Transport Parameters: %s", &chtp.Parameters)
+	h.paramsChan <- chtp.Parameters
+	return nil
+}
+
+func (h *extensionHandlerServer) GetPeerParams() <-chan TransportParameters {
+	return h.paramsChan
+}

vendor/github.com/lucas-clemente/quic-go/internal/handshake/transport_parameters.go

@@ -0,0 +1,215 @@
+package handshake
+
+import (
+	"bytes"
+	"encoding/binary"
+	"fmt"
+	"sort"
+	"time"
+
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+	"github.com/lucas-clemente/quic-go/internal/utils"
+	"github.com/lucas-clemente/quic-go/qerr"
+)
+
+// errMalformedTag is returned when the tag value cannot be read
+var errMalformedTag = qerr.Error(qerr.InvalidCryptoMessageParameter, "malformed Tag value")
+
+// TransportParameters are parameters sent to the peer during the handshake
+type TransportParameters struct {
+	StreamFlowControlWindow     protocol.ByteCount
+	ConnectionFlowControlWindow protocol.ByteCount
+
+	MaxPacketSize protocol.ByteCount
+
+	MaxUniStreams  uint16 // only used for IETF QUIC
+	MaxBidiStreams uint16 // only used for IETF QUIC
+	MaxStreams     uint32 // only used for gQUIC
+
+	OmitConnectionID    bool // only used for gQUIC
+	IdleTimeout         time.Duration
+	DisableMigration    bool   // only used for IETF QUIC
+	StatelessResetToken []byte // only used for IETF QUIC
+}
+
+// readHelloMap reads the transport parameters from the tags sent in a gQUIC handshake message
+func readHelloMap(tags map[Tag][]byte) (*TransportParameters, error) {
+	params := &TransportParameters{}
+	if value, ok := tags[TagTCID]; ok {
+		v, err := utils.LittleEndian.ReadUint32(bytes.NewBuffer(value))
+		if err != nil {
+			return nil, errMalformedTag
+		}
+		params.OmitConnectionID = (v == 0)
+	}
+	if value, ok := tags[TagMIDS]; ok {
+		v, err := utils.LittleEndian.ReadUint32(bytes.NewBuffer(value))
+		if err != nil {
+			return nil, errMalformedTag
+		}
+		params.MaxStreams = v
+	}
+	if value, ok := tags[TagICSL]; ok {
+		v, err := utils.LittleEndian.ReadUint32(bytes.NewBuffer(value))
+		if err != nil {
+			return nil, errMalformedTag
+		}
+		params.IdleTimeout = utils.MaxDuration(protocol.MinRemoteIdleTimeout, time.Duration(v)*time.Second)
+	}
+	if value, ok := tags[TagSFCW]; ok {
+		v, err := utils.LittleEndian.ReadUint32(bytes.NewBuffer(value))
+		if err != nil {
+			return nil, errMalformedTag
+		}
+		params.StreamFlowControlWindow = protocol.ByteCount(v)
+	}
+	if value, ok := tags[TagCFCW]; ok {
+		v, err := utils.LittleEndian.ReadUint32(bytes.NewBuffer(value))
+		if err != nil {
+			return nil, errMalformedTag
+		}
+		params.ConnectionFlowControlWindow = protocol.ByteCount(v)
+	}
+	return params, nil
+}
+
+// GetHelloMap gets all parameters needed for the Hello message in the gQUIC handshake.
+func (p *TransportParameters) getHelloMap() map[Tag][]byte {
+	sfcw := bytes.NewBuffer([]byte{})
+	utils.LittleEndian.WriteUint32(sfcw, uint32(p.StreamFlowControlWindow))
+	cfcw := bytes.NewBuffer([]byte{})
+	utils.LittleEndian.WriteUint32(cfcw, uint32(p.ConnectionFlowControlWindow))
+	mids := bytes.NewBuffer([]byte{})
+	utils.LittleEndian.WriteUint32(mids, p.MaxStreams)
+	icsl := bytes.NewBuffer([]byte{})
+	utils.LittleEndian.WriteUint32(icsl, uint32(p.IdleTimeout/time.Second))
+
+	tags := map[Tag][]byte{
+		TagICSL: icsl.Bytes(),
+		TagMIDS: mids.Bytes(),
+		TagCFCW: cfcw.Bytes(),
+		TagSFCW: sfcw.Bytes(),
+	}
+	if p.OmitConnectionID {
+		tags[TagTCID] = []byte{0, 0, 0, 0}
+	}
+	return tags
+}
+
+func (p *TransportParameters) unmarshal(data []byte) error {
+	// needed to check that every parameter is only sent at most once
+	var parameterIDs []transportParameterID
+
+	for len(data) >= 4 {
+		paramID := transportParameterID(binary.BigEndian.Uint16(data[:2]))
+		paramLen := int(binary.BigEndian.Uint16(data[2:4]))
+		data = data[4:]
+		if len(data) < paramLen {
+			return fmt.Errorf("remaining length (%d) smaller than parameter length (%d)", len(data), paramLen)
+		}
+		parameterIDs = append(parameterIDs, paramID)
+		switch paramID {
+		case initialMaxStreamDataParameterID:
+			if paramLen != 4 {
+				return fmt.Errorf("wrong length for initial_max_stream_data: %d (expected 4)", paramLen)
+			}
+			p.StreamFlowControlWindow = protocol.ByteCount(binary.BigEndian.Uint32(data[:4]))
+		case initialMaxDataParameterID:
+			if paramLen != 4 {
+				return fmt.Errorf("wrong length for initial_max_data: %d (expected 4)", paramLen)
+			}
+			p.ConnectionFlowControlWindow = protocol.ByteCount(binary.BigEndian.Uint32(data[:4]))
+		case initialMaxBidiStreamsParameterID:
+			if paramLen != 2 {
+				return fmt.Errorf("wrong length for initial_max_stream_id_bidi: %d (expected 2)", paramLen)
+			}
+			p.MaxBidiStreams = binary.BigEndian.Uint16(data[:2])
+		case initialMaxUniStreamsParameterID:
+			if paramLen != 2 {
+				return fmt.Errorf("wrong length for initial_max_stream_id_uni: %d (expected 2)", paramLen)
+			}
+			p.MaxUniStreams = binary.BigEndian.Uint16(data[:2])
+		case idleTimeoutParameterID:
+			if paramLen != 2 {
+				return fmt.Errorf("wrong length for idle_timeout: %d (expected 2)", paramLen)
+			}
+			p.IdleTimeout = utils.MaxDuration(protocol.MinRemoteIdleTimeout, time.Duration(binary.BigEndian.Uint16(data[:2]))*time.Second)
+		case maxPacketSizeParameterID:
+			if paramLen != 2 {
+				return fmt.Errorf("wrong length for max_packet_size: %d (expected 2)", paramLen)
+			}
+			maxPacketSize := protocol.ByteCount(binary.BigEndian.Uint16(data[:2]))
+			if maxPacketSize < 1200 {
+				return fmt.Errorf("invalid value for max_packet_size: %d (minimum 1200)", maxPacketSize)
+			}
+			p.MaxPacketSize = maxPacketSize
+		case disableMigrationParameterID:
+			if paramLen != 0 {
+				return fmt.Errorf("wrong length for disable_migration: %d (expected empty)", paramLen)
+			}
+			p.DisableMigration = true
+		case statelessResetTokenParameterID:
+			if paramLen != 16 {
+				return fmt.Errorf("wrong length for stateless_reset_token: %d (expected 16)", paramLen)
+			}
+			p.StatelessResetToken = data[:16]
+		}
+		data = data[paramLen:]
+	}
+
+	// check that every transport parameter was sent at most once
+	sort.Slice(parameterIDs, func(i, j int) bool { return parameterIDs[i] < parameterIDs[j] })
+	for i := 0; i < len(parameterIDs)-1; i++ {
+		if parameterIDs[i] == parameterIDs[i+1] {
+			return fmt.Errorf("received duplicate transport parameter %#x", parameterIDs[i])
+		}
+	}
+
+	if len(data) != 0 {
+		return fmt.Errorf("should have read all data. Still have %d bytes", len(data))
+	}
+	return nil
+}
+
+func (p *TransportParameters) marshal(b *bytes.Buffer) {
+	// initial_max_stream_data
+	utils.BigEndian.WriteUint16(b, uint16(initialMaxStreamDataParameterID))
+	utils.BigEndian.WriteUint16(b, 4)
+	utils.BigEndian.WriteUint32(b, uint32(p.StreamFlowControlWindow))
+	// initial_max_data
+	utils.BigEndian.WriteUint16(b, uint16(initialMaxDataParameterID))
+	utils.BigEndian.WriteUint16(b, 4)
+	utils.BigEndian.WriteUint32(b, uint32(p.ConnectionFlowControlWindow))
+	// initial_max_bidi_streams
+	utils.BigEndian.WriteUint16(b, uint16(initialMaxBidiStreamsParameterID))
+	utils.BigEndian.WriteUint16(b, 2)
+	utils.BigEndian.WriteUint16(b, p.MaxBidiStreams)
+	// initial_max_uni_streams
+	utils.BigEndian.WriteUint16(b, uint16(initialMaxUniStreamsParameterID))
+	utils.BigEndian.WriteUint16(b, 2)
+	utils.BigEndian.WriteUint16(b, p.MaxUniStreams)
+	// idle_timeout
+	utils.BigEndian.WriteUint16(b, uint16(idleTimeoutParameterID))
+	utils.BigEndian.WriteUint16(b, 2)
+	utils.BigEndian.WriteUint16(b, uint16(p.IdleTimeout/time.Second))
+	// max_packet_size
+	utils.BigEndian.WriteUint16(b, uint16(maxPacketSizeParameterID))
+	utils.BigEndian.WriteUint16(b, 2)
+	utils.BigEndian.WriteUint16(b, uint16(protocol.MaxReceivePacketSize))
+	// disable_migration
+	if p.DisableMigration {
+		utils.BigEndian.WriteUint16(b, uint16(disableMigrationParameterID))
+		utils.BigEndian.WriteUint16(b, 0)
+	}
+	if len(p.StatelessResetToken) > 0 {
+		utils.BigEndian.WriteUint16(b, uint16(statelessResetTokenParameterID))
+		utils.BigEndian.WriteUint16(b, uint16(len(p.StatelessResetToken))) // should always be 16 bytes
+		b.Write(p.StatelessResetToken)
+	}
+}
+
+// String returns a string representation, intended for logging.
+// It should only used for IETF QUIC.
+func (p *TransportParameters) String() string {
+	return fmt.Sprintf("&handshake.TransportParameters{StreamFlowControlWindow: %#x, ConnectionFlowControlWindow: %#x, MaxBidiStreams: %d, MaxUniStreams: %d, IdleTimeout: %s}", p.StreamFlowControlWindow, p.ConnectionFlowControlWindow, p.MaxBidiStreams, p.MaxUniStreams, p.IdleTimeout)
+}

vendor/github.com/lucas-clemente/quic-go/internal/protocol/connection_id.go

@@ -0,0 +1,69 @@
+package protocol
+
+import (
+	"bytes"
+	"crypto/rand"
+	"fmt"
+	"io"
+)
+
+// A ConnectionID in QUIC
+type ConnectionID []byte
+
+const maxConnectionIDLen = 18
+
+// GenerateConnectionID generates a connection ID using cryptographic random
+func GenerateConnectionID(len int) (ConnectionID, error) {
+	b := make([]byte, len)
+	if _, err := rand.Read(b); err != nil {
+		return nil, err
+	}
+	return ConnectionID(b), nil
+}
+
+// GenerateConnectionIDForInitial generates a connection ID for the Initial packet.
+// It uses a length randomly chosen between 8 and 18 bytes.
+func GenerateConnectionIDForInitial() (ConnectionID, error) {
+	r := make([]byte, 1)
+	if _, err := rand.Read(r); err != nil {
+		return nil, err
+	}
+	len := MinConnectionIDLenInitial + int(r[0])%(maxConnectionIDLen-MinConnectionIDLenInitial+1)
+	return GenerateConnectionID(len)
+}
+
+// ReadConnectionID reads a connection ID of length len from the given io.Reader.
+// It returns io.EOF if there are not enough bytes to read.
+func ReadConnectionID(r io.Reader, len int) (ConnectionID, error) {
+	if len == 0 {
+		return nil, nil
+	}
+	c := make(ConnectionID, len)
+	_, err := io.ReadFull(r, c)
+	if err == io.ErrUnexpectedEOF {
+		return nil, io.EOF
+	}
+	return c, err
+}
+
+// Equal says if two connection IDs are equal
+func (c ConnectionID) Equal(other ConnectionID) bool {
+	return bytes.Equal(c, other)
+}
+
+// Len returns the length of the connection ID in bytes
+func (c ConnectionID) Len() int {
+	return len(c)
+}
+
+// Bytes returns the byte representation
+func (c ConnectionID) Bytes() []byte {
+	return []byte(c)
+}
+
+func (c ConnectionID) String() string {
+	if c.Len() == 0 {
+		return "(empty)"
+	}
+	return fmt.Sprintf("%#x", c.Bytes())
+}

vendor/github.com/lucas-clemente/quic-go/internal/protocol/encryption_level.go

@@ -0,0 +1,28 @@
+package protocol
+
+// EncryptionLevel is the encryption level
+// Default value is Unencrypted
+type EncryptionLevel int
+
+const (
+	// EncryptionUnspecified is a not specified encryption level
+	EncryptionUnspecified EncryptionLevel = iota
+	// EncryptionUnencrypted is not encrypted
+	EncryptionUnencrypted
+	// EncryptionSecure is encrypted, but not forward secure
+	EncryptionSecure
+	// EncryptionForwardSecure is forward secure
+	EncryptionForwardSecure
+)
+
+func (e EncryptionLevel) String() string {
+	switch e {
+	case EncryptionUnencrypted:
+		return "unencrypted"
+	case EncryptionSecure:
+		return "encrypted (not forward-secure)"
+	case EncryptionForwardSecure:
+		return "forward-secure"
+	}
+	return "unknown"
+}

vendor/github.com/lucas-clemente/quic-go/internal/protocol/packet_number.go

@@ -0,0 +1,70 @@
+package protocol
+
+// InferPacketNumber calculates the packet number based on the received packet number, its length and the last seen packet number
+func InferPacketNumber(
+	packetNumberLength PacketNumberLen,
+	lastPacketNumber PacketNumber,
+	wirePacketNumber PacketNumber,
+	version VersionNumber,
+) PacketNumber {
+	var epochDelta PacketNumber
+	if version.UsesVarintPacketNumbers() {
+		switch packetNumberLength {
+		case PacketNumberLen1:
+			epochDelta = PacketNumber(1) << 7
+		case PacketNumberLen2:
+			epochDelta = PacketNumber(1) << 14
+		case PacketNumberLen4:
+			epochDelta = PacketNumber(1) << 30
+		}
+	} else {
+		epochDelta = PacketNumber(1) << (uint8(packetNumberLength) * 8)
+	}
+	epoch := lastPacketNumber & ^(epochDelta - 1)
+	prevEpochBegin := epoch - epochDelta
+	nextEpochBegin := epoch + epochDelta
+	return closestTo(
+		lastPacketNumber+1,
+		epoch+wirePacketNumber,
+		closestTo(lastPacketNumber+1, prevEpochBegin+wirePacketNumber, nextEpochBegin+wirePacketNumber),
+	)
+}
+
+func closestTo(target, a, b PacketNumber) PacketNumber {
+	if delta(target, a) < delta(target, b) {
+		return a
+	}
+	return b
+}
+
+func delta(a, b PacketNumber) PacketNumber {
+	if a < b {
+		return b - a
+	}
+	return a - b
+}
+
+// GetPacketNumberLengthForHeader gets the length of the packet number for the public header
+// it never chooses a PacketNumberLen of 1 byte, since this is too short under certain circumstances
+func GetPacketNumberLengthForHeader(packetNumber, leastUnacked PacketNumber, version VersionNumber) PacketNumberLen {
+	diff := uint64(packetNumber - leastUnacked)
+	if version.UsesVarintPacketNumbers() && diff < (1<<(14-1)) ||
+		!version.UsesVarintPacketNumbers() && diff < (1<<(16-1)) {
+		return PacketNumberLen2
+	}
+	return PacketNumberLen4
+}
+
+// GetPacketNumberLength gets the minimum length needed to fully represent the packet number
+func GetPacketNumberLength(packetNumber PacketNumber) PacketNumberLen {
+	if packetNumber < (1 << (uint8(PacketNumberLen1) * 8)) {
+		return PacketNumberLen1
+	}
+	if packetNumber < (1 << (uint8(PacketNumberLen2) * 8)) {
+		return PacketNumberLen2
+	}
+	if packetNumber < (1 << (uint8(PacketNumberLen4) * 8)) {
+		return PacketNumberLen4
+	}
+	return PacketNumberLen6
+}

vendor/github.com/lucas-clemente/quic-go/internal/protocol/perspective.go

@@ -0,0 +1,26 @@
+package protocol
+
+// Perspective determines if we're acting as a server or a client
+type Perspective int
+
+// the perspectives
+const (
+	PerspectiveServer Perspective = 1
+	PerspectiveClient Perspective = 2
+)
+
+// Opposite returns the perspective of the peer
+func (p Perspective) Opposite() Perspective {
+	return 3 - p
+}
+
+func (p Perspective) String() string {
+	switch p {
+	case PerspectiveServer:
+		return "Server"
+	case PerspectiveClient:
+		return "Client"
+	default:
+		return "invalid perspective"
+	}
+}

vendor/github.com/lucas-clemente/quic-go/internal/protocol/protocol.go

@@ -0,0 +1,90 @@
+package protocol
+
+import (
+	"fmt"
+)
+
+// A PacketNumber in QUIC
+type PacketNumber uint64
+
+// PacketNumberLen is the length of the packet number in bytes
+type PacketNumberLen uint8
+
+const (
+	// PacketNumberLenInvalid is the default value and not a valid length for a packet number
+	PacketNumberLenInvalid PacketNumberLen = 0
+	// PacketNumberLen1 is a packet number length of 1 byte
+	PacketNumberLen1 PacketNumberLen = 1
+	// PacketNumberLen2 is a packet number length of 2 bytes
+	PacketNumberLen2 PacketNumberLen = 2
+	// PacketNumberLen4 is a packet number length of 4 bytes
+	PacketNumberLen4 PacketNumberLen = 4
+	// PacketNumberLen6 is a packet number length of 6 bytes
+	PacketNumberLen6 PacketNumberLen = 6
+)
+
+// The PacketType is the Long Header Type (only used for the IETF draft header format)
+type PacketType uint8
+
+const (
+	// PacketTypeInitial is the packet type of an Initial packet
+	PacketTypeInitial PacketType = 0x7f
+	// PacketTypeRetry is the packet type of a Retry packet
+	PacketTypeRetry PacketType = 0x7e
+	// PacketTypeHandshake is the packet type of a Handshake packet
+	PacketTypeHandshake PacketType = 0x7d
+	// PacketType0RTT is the packet type of a 0-RTT packet
+	PacketType0RTT PacketType = 0x7c
+)
+
+func (t PacketType) String() string {
+	switch t {
+	case PacketTypeInitial:
+		return "Initial"
+	case PacketTypeRetry:
+		return "Retry"
+	case PacketTypeHandshake:
+		return "Handshake"
+	case PacketType0RTT:
+		return "0-RTT Protected"
+	default:
+		return fmt.Sprintf("unknown packet type: %d", t)
+	}
+}
+
+// A ByteCount in QUIC
+type ByteCount uint64
+
+// MaxByteCount is the maximum value of a ByteCount
+const MaxByteCount = ByteCount(1<<62 - 1)
+
+// An ApplicationErrorCode is an application-defined error code.
+type ApplicationErrorCode uint16
+
+// MaxReceivePacketSize maximum packet size of any QUIC packet, based on
+// ethernet's max size, minus the IP and UDP headers. IPv6 has a 40 byte header,
+// UDP adds an additional 8 bytes.  This is a total overhead of 48 bytes.
+// Ethernet's max packet size is 1500 bytes,  1500 - 48 = 1452.
+const MaxReceivePacketSize ByteCount = 1452
+
+// DefaultTCPMSS is the default maximum packet size used in the Linux TCP implementation.
+// Used in QUIC for congestion window computations in bytes.
+const DefaultTCPMSS ByteCount = 1460
+
+// MinClientHelloSize is the minimum size the server expects an inchoate CHLO to have (in gQUIC)
+const MinClientHelloSize = 1024
+
+// MinInitialPacketSize is the minimum size an Initial packet (in IETF QUIC) is required to have.
+const MinInitialPacketSize = 1200
+
+// MaxClientHellos is the maximum number of times we'll send a client hello
+// The value 3 accounts for:
+// * one failure due to an incorrect or missing source-address token
+// * one failure due the server's certificate chain being unavailable and the server being unwilling to send it without a valid source-address token
+const MaxClientHellos = 3
+
+// ConnectionIDLenGQUIC is the length of the source Connection ID used on gQUIC QUIC packets.
+const ConnectionIDLenGQUIC = 8
+
+// MinConnectionIDLenInitial is the minimum length of the destination connection ID on an Initial packet.
+const MinConnectionIDLenInitial = 8

vendor/github.com/lucas-clemente/quic-go/internal/protocol/server_parameters.go

@@ -0,0 +1,151 @@
+package protocol
+
+import "time"
+
+// MaxPacketSizeIPv4 is the maximum packet size that we use for sending IPv4 packets.
+const MaxPacketSizeIPv4 = 1252
+
+// MaxPacketSizeIPv6 is the maximum packet size that we use for sending IPv6 packets.
+const MaxPacketSizeIPv6 = 1232
+
+// NonForwardSecurePacketSizeReduction is the number of bytes a non forward-secure packet has to be smaller than a forward-secure packet
+// This makes sure that those packets can always be retransmitted without splitting the contained StreamFrames
+const NonForwardSecurePacketSizeReduction = 50
+
+const defaultMaxCongestionWindowPackets = 1000
+
+// DefaultMaxCongestionWindow is the default for the max congestion window
+const DefaultMaxCongestionWindow ByteCount = defaultMaxCongestionWindowPackets * DefaultTCPMSS
+
+// InitialCongestionWindow is the initial congestion window in QUIC packets
+const InitialCongestionWindow ByteCount = 32 * DefaultTCPMSS
+
+// MaxUndecryptablePackets limits the number of undecryptable packets that a
+// session queues for later until it sends a public reset.
+const MaxUndecryptablePackets = 10
+
+// PublicResetTimeout is the time to wait before sending a Public Reset when receiving too many undecryptable packets during the handshake
+// This timeout allows the Go scheduler to switch to the Go rountine that reads the crypto stream and to escalate the crypto
+const PublicResetTimeout = 500 * time.Millisecond
+
+// ReceiveStreamFlowControlWindow is the stream-level flow control window for receiving data
+// This is the value that Google servers are using
+const ReceiveStreamFlowControlWindow = (1 << 10) * 32 // 32 kB
+
+// ReceiveConnectionFlowControlWindow is the connection-level flow control window for receiving data
+// This is the value that Google servers are using
+const ReceiveConnectionFlowControlWindow = (1 << 10) * 48 // 48 kB
+
+// DefaultMaxReceiveStreamFlowControlWindowServer is the default maximum stream-level flow control window for receiving data, for the server
+// This is the value that Google servers are using
+const DefaultMaxReceiveStreamFlowControlWindowServer = 1 * (1 << 20) // 1 MB
+
+// DefaultMaxReceiveConnectionFlowControlWindowServer is the default connection-level flow control window for receiving data, for the server
+// This is the value that Google servers are using
+const DefaultMaxReceiveConnectionFlowControlWindowServer = 1.5 * (1 << 20) // 1.5 MB
+
+// DefaultMaxReceiveStreamFlowControlWindowClient is the default maximum stream-level flow control window for receiving data, for the client
+// This is the value that Chromium is using
+const DefaultMaxReceiveStreamFlowControlWindowClient = 6 * (1 << 20) // 6 MB
+
+// DefaultMaxReceiveConnectionFlowControlWindowClient is the default connection-level flow control window for receiving data, for the client
+// This is the value that Google servers are using
+const DefaultMaxReceiveConnectionFlowControlWindowClient = 15 * (1 << 20) // 15 MB
+
+// ConnectionFlowControlMultiplier determines how much larger the connection flow control windows needs to be relative to any stream's flow control window
+// This is the value that Chromium is using
+const ConnectionFlowControlMultiplier = 1.5
+
+// WindowUpdateThreshold is the fraction of the receive window that has to be consumed before an higher offset is advertised to the client
+const WindowUpdateThreshold = 0.25
+
+// DefaultMaxIncomingStreams is the maximum number of streams that a peer may open
+const DefaultMaxIncomingStreams = 100
+
+// DefaultMaxIncomingUniStreams is the maximum number of unidirectional streams that a peer may open
+const DefaultMaxIncomingUniStreams = 100
+
+// MaxStreamsMultiplier is the slack the client is allowed for the maximum number of streams per connection, needed e.g. when packets are out of order or dropped. The minimum of this procentual increase and the absolute increment specified by MaxStreamsMinimumIncrement is used.
+const MaxStreamsMultiplier = 1.1
+
+// MaxStreamsMinimumIncrement is the slack the client is allowed for the maximum number of streams per connection, needed e.g. when packets are out of order or dropped. The minimum of this absolute increment and the procentual increase specified by MaxStreamsMultiplier is used.
+const MaxStreamsMinimumIncrement = 10
+
+// MaxSessionUnprocessedPackets is the max number of packets stored in each session that are not yet processed.
+const MaxSessionUnprocessedPackets = defaultMaxCongestionWindowPackets
+
+// SkipPacketAveragePeriodLength is the average period length in which one packet number is skipped to prevent an Optimistic ACK attack
+const SkipPacketAveragePeriodLength PacketNumber = 500
+
+// MaxTrackedSkippedPackets is the maximum number of skipped packet numbers the SentPacketHandler keep track of for Optimistic ACK attack mitigation
+const MaxTrackedSkippedPackets = 10
+
+// CookieExpiryTime is the valid time of a cookie
+const CookieExpiryTime = 24 * time.Hour
+
+// MaxOutstandingSentPackets is maximum number of packets saved for retransmission.
+// When reached, it imposes a soft limit on sending new packets:
+// Sending ACKs and retransmission is still allowed, but now new regular packets can be sent.
+const MaxOutstandingSentPackets = 2 * defaultMaxCongestionWindowPackets
+
+// MaxTrackedSentPackets is maximum number of sent packets saved for retransmission.
+// When reached, no more packets will be sent.
+// This value *must* be larger than MaxOutstandingSentPackets.
+const MaxTrackedSentPackets = MaxOutstandingSentPackets * 5 / 4
+
+// MaxTrackedReceivedAckRanges is the maximum number of ACK ranges tracked
+const MaxTrackedReceivedAckRanges = defaultMaxCongestionWindowPackets
+
+// MaxNonRetransmittableAcks is the maximum number of packets containing an ACK, but no retransmittable frames, that we send in a row
+const MaxNonRetransmittableAcks = 19
+
+// MaxStreamFrameSorterGaps is the maximum number of gaps between received StreamFrames
+// prevents DoS attacks against the streamFrameSorter
+const MaxStreamFrameSorterGaps = 1000
+
+// CryptoMaxParams is the upper limit for the number of parameters in a crypto message.
+// Value taken from Chrome.
+const CryptoMaxParams = 128
+
+// CryptoParameterMaxLength is the upper limit for the length of a parameter in a crypto message.
+const CryptoParameterMaxLength = 4000
+
+// EphermalKeyLifetime is the lifetime of the ephermal key during the handshake, see handshake.getEphermalKEX.
+const EphermalKeyLifetime = time.Minute
+
+// MinRemoteIdleTimeout is the minimum value that we accept for the remote idle timeout
+const MinRemoteIdleTimeout = 5 * time.Second
+
+// DefaultIdleTimeout is the default idle timeout
+const DefaultIdleTimeout = 30 * time.Second
+
+// DefaultHandshakeTimeout is the default timeout for a connection until the crypto handshake succeeds.
+const DefaultHandshakeTimeout = 10 * time.Second
+
+// ClosedSessionDeleteTimeout the server ignores packets arriving on a connection that is already closed
+// after this time all information about the old connection will be deleted
+const ClosedSessionDeleteTimeout = time.Minute
+
+// NumCachedCertificates is the number of cached compressed certificate chains, each taking ~1K space
+const NumCachedCertificates = 128
+
+// MinStreamFrameSize is the minimum size that has to be left in a packet, so that we add another STREAM frame.
+// This avoids splitting up STREAM frames into small pieces, which has 2 advantages:
+// 1. it reduces the framing overhead
+// 2. it reduces the head-of-line blocking, when a packet is lost
+const MinStreamFrameSize ByteCount = 128
+
+// MaxAckFrameSize is the maximum size for an (IETF QUIC) ACK frame that we write
+// Due to the varint encoding, ACK frames can grow (almost) indefinitely large.
+// The MaxAckFrameSize should be large enough to encode many ACK range,
+// but must ensure that a maximum size ACK frame fits into one packet.
+const MaxAckFrameSize ByteCount = 1000
+
+// MinPacingDelay is the minimum duration that is used for packet pacing
+// If the packet packing frequency is higher, multiple packets might be sent at once.
+// Example: For a packet pacing delay of 20 microseconds, we would send 5 packets at once, wait for 100 microseconds, and so forth.
+const MinPacingDelay time.Duration = 100 * time.Microsecond
+
+// DefaultConnectionIDLength is the connection ID length that is used for multiplexed connections
+// if no other value is configured.
+const DefaultConnectionIDLength = 4

vendor/github.com/lucas-clemente/quic-go/internal/protocol/stream_id.go

@@ -0,0 +1,36 @@
+package protocol
+
+// A StreamID in QUIC
+type StreamID uint64
+
+// MaxBidiStreamID is the highest stream ID that the peer is allowed to open,
+// when it is allowed to open numStreams bidirectional streams.
+// It is only valid for IETF QUIC.
+func MaxBidiStreamID(numStreams int, pers Perspective) StreamID {
+	if numStreams == 0 {
+		return 0
+	}
+	var first StreamID
+	if pers == PerspectiveClient {
+		first = 1
+	} else {
+		first = 4
+	}
+	return first + 4*StreamID(numStreams-1)
+}
+
+// MaxUniStreamID is the highest stream ID that the peer is allowed to open,
+// when it is allowed to open numStreams unidirectional streams.
+// It is only valid for IETF QUIC.
+func MaxUniStreamID(numStreams int, pers Perspective) StreamID {
+	if numStreams == 0 {
+		return 0
+	}
+	var first StreamID
+	if pers == PerspectiveClient {
+		first = 3
+	} else {
+		first = 2
+	}
+	return first + 4*StreamID(numStreams-1)
+}

vendor/github.com/lucas-clemente/quic-go/internal/protocol/version.go

@@ -0,0 +1,181 @@
+package protocol
+
+import (
+	"crypto/rand"
+	"encoding/binary"
+	"fmt"
+	"math"
+)
+
+// VersionNumber is a version number as int
+type VersionNumber uint32
+
+// gQUIC version range as defined in the wiki: https://github.com/quicwg/base-drafts/wiki/QUIC-Versions
+const (
+	gquicVersion0   = 0x51303030
+	maxGquicVersion = 0x51303439
+)
+
+// The version numbers, making grepping easier
+const (
+	Version39       VersionNumber = gquicVersion0 + 3*0x100 + 0x9
+	Version43       VersionNumber = gquicVersion0 + 4*0x100 + 0x3
+	Version44       VersionNumber = gquicVersion0 + 4*0x100 + 0x4
+	VersionTLS      VersionNumber = 101
+	VersionWhatever VersionNumber = 0 // for when the version doesn't matter
+	VersionUnknown  VersionNumber = math.MaxUint32
+)
+
+// SupportedVersions lists the versions that the server supports
+// must be in sorted descending order
+var SupportedVersions = []VersionNumber{
+	Version44,
+	Version43,
+	Version39,
+}
+
+// IsValidVersion says if the version is known to quic-go
+func IsValidVersion(v VersionNumber) bool {
+	return v == VersionTLS || IsSupportedVersion(SupportedVersions, v)
+}
+
+// UsesTLS says if this QUIC version uses TLS 1.3 for the handshake
+func (vn VersionNumber) UsesTLS() bool {
+	return !vn.isGQUIC()
+}
+
+func (vn VersionNumber) String() string {
+	switch vn {
+	case VersionWhatever:
+		return "whatever"
+	case VersionUnknown:
+		return "unknown"
+	case VersionTLS:
+		return "TLS dev version (WIP)"
+	default:
+		if vn.isGQUIC() {
+			return fmt.Sprintf("gQUIC %d", vn.toGQUICVersion())
+		}
+		return fmt.Sprintf("%#x", uint32(vn))
+	}
+}
+
+// ToAltSvc returns the representation of the version for the H2 Alt-Svc parameters
+func (vn VersionNumber) ToAltSvc() string {
+	if vn.isGQUIC() {
+		return fmt.Sprintf("%d", vn.toGQUICVersion())
+	}
+	return fmt.Sprintf("%d", vn)
+}
+
+// CryptoStreamID gets the Stream ID of the crypto stream
+func (vn VersionNumber) CryptoStreamID() StreamID {
+	if vn.isGQUIC() {
+		return 1
+	}
+	return 0
+}
+
+// UsesIETFFrameFormat tells if this version uses the IETF frame format
+func (vn VersionNumber) UsesIETFFrameFormat() bool {
+	return !vn.isGQUIC()
+}
+
+// UsesIETFHeaderFormat tells if this version uses the IETF header format
+func (vn VersionNumber) UsesIETFHeaderFormat() bool {
+	return !vn.isGQUIC() || vn >= Version44
+}
+
+// UsesLengthInHeader tells if this version uses the Length field in the IETF header
+func (vn VersionNumber) UsesLengthInHeader() bool {
+	return !vn.isGQUIC()
+}
+
+// UsesTokenInHeader tells if this version uses the Token field in the IETF header
+func (vn VersionNumber) UsesTokenInHeader() bool {
+	return !vn.isGQUIC()
+}
+
+// UsesStopWaitingFrames tells if this version uses STOP_WAITING frames
+func (vn VersionNumber) UsesStopWaitingFrames() bool {
+	return vn.isGQUIC() && vn <= Version43
+}
+
+// UsesVarintPacketNumbers tells if this version uses 7/14/30 bit packet numbers
+func (vn VersionNumber) UsesVarintPacketNumbers() bool {
+	return !vn.isGQUIC()
+}
+
+// StreamContributesToConnectionFlowControl says if a stream contributes to connection-level flow control
+func (vn VersionNumber) StreamContributesToConnectionFlowControl(id StreamID) bool {
+	if id == vn.CryptoStreamID() {
+		return false
+	}
+	if vn.isGQUIC() && id == 3 {
+		return false
+	}
+	return true
+}
+
+func (vn VersionNumber) isGQUIC() bool {
+	return vn > gquicVersion0 && vn <= maxGquicVersion
+}
+
+func (vn VersionNumber) toGQUICVersion() int {
+	return int(10*(vn-gquicVersion0)/0x100) + int(vn%0x10)
+}
+
+// IsSupportedVersion returns true if the server supports this version
+func IsSupportedVersion(supported []VersionNumber, v VersionNumber) bool {
+	for _, t := range supported {
+		if t == v {
+			return true
+		}
+	}
+	return false
+}
+
+// ChooseSupportedVersion finds the best version in the overlap of ours and theirs
+// ours is a slice of versions that we support, sorted by our preference (descending)
+// theirs is a slice of versions offered by the peer. The order does not matter.
+// The bool returned indicates if a matching version was found.
+func ChooseSupportedVersion(ours, theirs []VersionNumber) (VersionNumber, bool) {
+	for _, ourVer := range ours {
+		for _, theirVer := range theirs {
+			if ourVer == theirVer {
+				return ourVer, true
+			}
+		}
+	}
+	return 0, false
+}
+
+// generateReservedVersion generates a reserved version number (v & 0x0f0f0f0f == 0x0a0a0a0a)
+func generateReservedVersion() VersionNumber {
+	b := make([]byte, 4)
+	_, _ = rand.Read(b) // ignore the error here. Failure to read random data doesn't break anything
+	return VersionNumber((binary.BigEndian.Uint32(b) | 0x0a0a0a0a) & 0xfafafafa)
+}
+
+// GetGreasedVersions adds one reserved version number to a slice of version numbers, at a random position
+func GetGreasedVersions(supported []VersionNumber) []VersionNumber {
+	b := make([]byte, 1)
+	_, _ = rand.Read(b) // ignore the error here. Failure to read random data doesn't break anything
+	randPos := int(b[0]) % (len(supported) + 1)
+	greased := make([]VersionNumber, len(supported)+1)
+	copy(greased, supported[:randPos])
+	greased[randPos] = generateReservedVersion()
+	copy(greased[randPos+1:], supported[randPos:])
+	return greased
+}
+
+// StripGreasedVersions strips all greased versions from a slice of versions
+func StripGreasedVersions(versions []VersionNumber) []VersionNumber {
+	realVersions := make([]VersionNumber, 0, len(versions))
+	for _, v := range versions {
+		if v&0x0f0f0f0f != 0x0a0a0a0a {
+			realVersions = append(realVersions, v)
+		}
+	}
+	return realVersions
+}

vendor/github.com/lucas-clemente/quic-go/internal/utils/atomic_bool.go

@@ -0,0 +1,22 @@
+package utils
+
+import "sync/atomic"
+
+// An AtomicBool is an atomic bool
+type AtomicBool struct {
+	v int32
+}
+
+// Set sets the value
+func (a *AtomicBool) Set(value bool) {
+	var n int32
+	if value {
+		n = 1
+	}
+	atomic.StoreInt32(&a.v, n)
+}
+
+// Get gets the value
+func (a *AtomicBool) Get() bool {
+	return atomic.LoadInt32(&a.v) != 0
+}

vendor/github.com/lucas-clemente/quic-go/internal/utils/byteinterval_linkedlist.go

@@ -0,0 +1,217 @@
+// This file was automatically generated by genny.
+// Any changes will be lost if this file is regenerated.
+// see https://github.com/cheekybits/genny
+
+package utils
+
+// Linked list implementation from the Go standard library.
+
+// ByteIntervalElement is an element of a linked list.
+type ByteIntervalElement struct {
+	// Next and previous pointers in the doubly-linked list of elements.
+	// To simplify the implementation, internally a list l is implemented
+	// as a ring, such that &l.root is both the next element of the last
+	// list element (l.Back()) and the previous element of the first list
+	// element (l.Front()).
+	next, prev *ByteIntervalElement
+
+	// The list to which this element belongs.
+	list *ByteIntervalList
+
+	// The value stored with this element.
+	Value ByteInterval
+}
+
+// Next returns the next list element or nil.
+func (e *ByteIntervalElement) Next() *ByteIntervalElement {
+	if p := e.next; e.list != nil && p != &e.list.root {
+		return p
+	}
+	return nil
+}
+
+// Prev returns the previous list element or nil.
+func (e *ByteIntervalElement) Prev() *ByteIntervalElement {
+	if p := e.prev; e.list != nil && p != &e.list.root {
+		return p
+	}
+	return nil
+}
+
+// ByteIntervalList is a linked list of ByteIntervals.
+type ByteIntervalList struct {
+	root ByteIntervalElement // sentinel list element, only &root, root.prev, and root.next are used
+	len  int                 // current list length excluding (this) sentinel element
+}
+
+// Init initializes or clears list l.
+func (l *ByteIntervalList) Init() *ByteIntervalList {
+	l.root.next = &l.root
+	l.root.prev = &l.root
+	l.len = 0
+	return l
+}
+
+// NewByteIntervalList returns an initialized list.
+func NewByteIntervalList() *ByteIntervalList { return new(ByteIntervalList).Init() }
+
+// Len returns the number of elements of list l.
+// The complexity is O(1).
+func (l *ByteIntervalList) Len() int { return l.len }
+
+// Front returns the first element of list l or nil if the list is empty.
+func (l *ByteIntervalList) Front() *ByteIntervalElement {
+	if l.len == 0 {
+		return nil
+	}
+	return l.root.next
+}
+
+// Back returns the last element of list l or nil if the list is empty.
+func (l *ByteIntervalList) Back() *ByteIntervalElement {
+	if l.len == 0 {
+		return nil
+	}
+	return l.root.prev
+}
+
+// lazyInit lazily initializes a zero List value.
+func (l *ByteIntervalList) lazyInit() {
+	if l.root.next == nil {
+		l.Init()
+	}
+}
+
+// insert inserts e after at, increments l.len, and returns e.
+func (l *ByteIntervalList) insert(e, at *ByteIntervalElement) *ByteIntervalElement {
+	n := at.next
+	at.next = e
+	e.prev = at
+	e.next = n
+	n.prev = e
+	e.list = l
+	l.len++
+	return e
+}
+
+// insertValue is a convenience wrapper for insert(&Element{Value: v}, at).
+func (l *ByteIntervalList) insertValue(v ByteInterval, at *ByteIntervalElement) *ByteIntervalElement {
+	return l.insert(&ByteIntervalElement{Value: v}, at)
+}
+
+// remove removes e from its list, decrements l.len, and returns e.
+func (l *ByteIntervalList) remove(e *ByteIntervalElement) *ByteIntervalElement {
+	e.prev.next = e.next
+	e.next.prev = e.prev
+	e.next = nil // avoid memory leaks
+	e.prev = nil // avoid memory leaks
+	e.list = nil
+	l.len--
+	return e
+}
+
+// Remove removes e from l if e is an element of list l.
+// It returns the element value e.Value.
+// The element must not be nil.
+func (l *ByteIntervalList) Remove(e *ByteIntervalElement) ByteInterval {
+	if e.list == l {
+		// if e.list == l, l must have been initialized when e was inserted
+		// in l or l == nil (e is a zero Element) and l.remove will crash
+		l.remove(e)
+	}
+	return e.Value
+}
+
+// PushFront inserts a new element e with value v at the front of list l and returns e.
+func (l *ByteIntervalList) PushFront(v ByteInterval) *ByteIntervalElement {
+	l.lazyInit()
+	return l.insertValue(v, &l.root)
+}
+
+// PushBack inserts a new element e with value v at the back of list l and returns e.
+func (l *ByteIntervalList) PushBack(v ByteInterval) *ByteIntervalElement {
+	l.lazyInit()
+	return l.insertValue(v, l.root.prev)
+}
+
+// InsertBefore inserts a new element e with value v immediately before mark and returns e.
+// If mark is not an element of l, the list is not modified.
+// The mark must not be nil.
+func (l *ByteIntervalList) InsertBefore(v ByteInterval, mark *ByteIntervalElement) *ByteIntervalElement {
+	if mark.list != l {
+		return nil
+	}
+	// see comment in List.Remove about initialization of l
+	return l.insertValue(v, mark.prev)
+}
+
+// InsertAfter inserts a new element e with value v immediately after mark and returns e.
+// If mark is not an element of l, the list is not modified.
+// The mark must not be nil.
+func (l *ByteIntervalList) InsertAfter(v ByteInterval, mark *ByteIntervalElement) *ByteIntervalElement {
+	if mark.list != l {
+		return nil
+	}
+	// see comment in List.Remove about initialization of l
+	return l.insertValue(v, mark)
+}
+
+// MoveToFront moves element e to the front of list l.
+// If e is not an element of l, the list is not modified.
+// The element must not be nil.
+func (l *ByteIntervalList) MoveToFront(e *ByteIntervalElement) {
+	if e.list != l || l.root.next == e {
+		return
+	}
+	// see comment in List.Remove about initialization of l
+	l.insert(l.remove(e), &l.root)
+}
+
+// MoveToBack moves element e to the back of list l.
+// If e is not an element of l, the list is not modified.
+// The element must not be nil.
+func (l *ByteIntervalList) MoveToBack(e *ByteIntervalElement) {
+	if e.list != l || l.root.prev == e {
+		return
+	}
+	// see comment in List.Remove about initialization of l
+	l.insert(l.remove(e), l.root.prev)
+}
+
+// MoveBefore moves element e to its new position before mark.
+// If e or mark is not an element of l, or e == mark, the list is not modified.
+// The element and mark must not be nil.
+func (l *ByteIntervalList) MoveBefore(e, mark *ByteIntervalElement) {
+	if e.list != l || e == mark || mark.list != l {
+		return
+	}
+	l.insert(l.remove(e), mark.prev)
+}
+
+// MoveAfter moves element e to its new position after mark.
+// If e or mark is not an element of l, or e == mark, the list is not modified.
+// The element and mark must not be nil.
+func (l *ByteIntervalList) MoveAfter(e, mark *ByteIntervalElement) {
+	if e.list != l || e == mark || mark.list != l {
+		return
+	}
+	l.insert(l.remove(e), mark)
+}
+
+// PushBackList inserts a copy of an other list at the back of list l.
+// The lists l and other may be the same. They must not be nil.
+func (l *ByteIntervalList) PushBackList(other *ByteIntervalList) {
+	l.lazyInit()
+	for i, e := other.Len(), other.Front(); i > 0; i, e = i-1, e.Next() {
+		l.insertValue(e.Value, l.root.prev)
+	}
+}
+
+// PushFrontList inserts a copy of an other list at the front of list l.
+// The lists l and other may be the same. They must not be nil.
+func (l *ByteIntervalList) PushFrontList(other *ByteIntervalList) {
+	l.lazyInit()
+	for i, e := other.Len(), other.Back(); i > 0; i, e = i-1, e.Prev() {
+		l.insertValue(e.Value, &l.root)
+	}
+}

vendor/github.com/lucas-clemente/quic-go/internal/utils/byteorder.go

@@ -0,0 +1,25 @@
+package utils
+
+import (
+	"bytes"
+	"io"
+)
+
+// A ByteOrder specifies how to convert byte sequences into 16-, 32-, or 64-bit unsigned integers.
+type ByteOrder interface {
+	ReadUintN(b io.ByteReader, length uint8) (uint64, error)
+	ReadUint64(io.ByteReader) (uint64, error)
+	ReadUint32(io.ByteReader) (uint32, error)
+	ReadUint16(io.ByteReader) (uint16, error)
+
+	WriteUint64(*bytes.Buffer, uint64)
+	WriteUint56(*bytes.Buffer, uint64)
+	WriteUint48(*bytes.Buffer, uint64)
+	WriteUint40(*bytes.Buffer, uint64)
+	WriteUint32(*bytes.Buffer, uint32)
+	WriteUint24(*bytes.Buffer, uint32)
+	WriteUint16(*bytes.Buffer, uint16)
+
+	ReadUfloat16(io.ByteReader) (uint64, error)
+	WriteUfloat16(*bytes.Buffer, uint64)
+}

vendor/github.com/lucas-clemente/quic-go/internal/utils/byteorder_big_endian.go

@@ -0,0 +1,157 @@
+package utils
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+)
+
+// BigEndian is the big-endian implementation of ByteOrder.
+var BigEndian ByteOrder = bigEndian{}
+
+type bigEndian struct{}
+
+var _ ByteOrder = &bigEndian{}
+
+// ReadUintN reads N bytes
+func (bigEndian) ReadUintN(b io.ByteReader, length uint8) (uint64, error) {
+	var res uint64
+	for i := uint8(0); i < length; i++ {
+		bt, err := b.ReadByte()
+		if err != nil {
+			return 0, err
+		}
+		res ^= uint64(bt) << ((length - 1 - i) * 8)
+	}
+	return res, nil
+}
+
+// ReadUint64 reads a uint64
+func (bigEndian) ReadUint64(b io.ByteReader) (uint64, error) {
+	var b1, b2, b3, b4, b5, b6, b7, b8 uint8
+	var err error
+	if b8, err = b.ReadByte(); err != nil {
+		return 0, err
+	}
+	if b7, err = b.ReadByte(); err != nil {
+		return 0, err
+	}
+	if b6, err = b.ReadByte(); err != nil {
+		return 0, err
+	}
+	if b5, err = b.ReadByte(); err != nil {
+		return 0, err
+	}
+	if b4, err = b.ReadByte(); err != nil {
+		return 0, err
+	}
+	if b3, err = b.ReadByte(); err != nil {
+		return 0, err
+	}
+	if b2, err = b.ReadByte(); err != nil {
+		return 0, err
+	}
+	if b1, err = b.ReadByte(); err != nil {
+		return 0, err
+	}
+	return uint64(b1) + uint64(b2)<<8 + uint64(b3)<<16 + uint64(b4)<<24 + uint64(b5)<<32 + uint64(b6)<<40 + uint64(b7)<<48 + uint64(b8)<<56, nil
+}
+
+// ReadUint32 reads a uint32
+func (bigEndian) ReadUint32(b io.ByteReader) (uint32, error) {
+	var b1, b2, b3, b4 uint8
+	var err error
+	if b4, err = b.ReadByte(); err != nil {
+		return 0, err
+	}
+	if b3, err = b.ReadByte(); err != nil {
+		return 0, err
+	}
+	if b2, err = b.ReadByte(); err != nil {
+		return 0, err
+	}
+	if b1, err = b.ReadByte(); err != nil {
+		return 0, err
+	}
+	return uint32(b1) + uint32(b2)<<8 + uint32(b3)<<16 + uint32(b4)<<24, nil
+}
+
+// ReadUint16 reads a uint16
+func (bigEndian) ReadUint16(b io.ByteReader) (uint16, error) {
+	var b1, b2 uint8
+	var err error
+	if b2, err = b.ReadByte(); err != nil {
+		return 0, err
+	}
+	if b1, err = b.ReadByte(); err != nil {
+		return 0, err
+	}
+	return uint16(b1) + uint16(b2)<<8, nil
+}
+
+// WriteUint64 writes a uint64
+func (bigEndian) WriteUint64(b *bytes.Buffer, i uint64) {
+	b.Write([]byte{
+		uint8(i >> 56), uint8(i >> 48), uint8(i >> 40), uint8(i >> 32),
+		uint8(i >> 24), uint8(i >> 16), uint8(i >> 8), uint8(i),
+	})
+}
+
+// WriteUint56 writes 56 bit of a uint64
+func (bigEndian) WriteUint56(b *bytes.Buffer, i uint64) {
+	if i >= (1 << 56) {
+		panic(fmt.Sprintf("%#x doesn't fit into 56 bits", i))
+	}
+	b.Write([]byte{
+		uint8(i >> 48), uint8(i >> 40), uint8(i >> 32),
+		uint8(i >> 24), uint8(i >> 16), uint8(i >> 8), uint8(i),
+	})
+}
+
+// WriteUint48 writes 48 bit of a uint64
+func (bigEndian) WriteUint48(b *bytes.Buffer, i uint64) {
+	if i >= (1 << 48) {
+		panic(fmt.Sprintf("%#x doesn't fit into 48 bits", i))
+	}
+	b.Write([]byte{
+		uint8(i >> 40), uint8(i >> 32),
+		uint8(i >> 24), uint8(i >> 16), uint8(i >> 8), uint8(i),
+	})
+}
+
+// WriteUint40 writes 40 bit of a uint64
+func (bigEndian) WriteUint40(b *bytes.Buffer, i uint64) {
+	if i >= (1 << 40) {
+		panic(fmt.Sprintf("%#x doesn't fit into 40 bits", i))
+	}
+	b.Write([]byte{
+		uint8(i >> 32),
+		uint8(i >> 24), uint8(i >> 16), uint8(i >> 8), uint8(i),
+	})
+}
+
+// WriteUint32 writes a uint32
+func (bigEndian) WriteUint32(b *bytes.Buffer, i uint32) {
+	b.Write([]byte{uint8(i >> 24), uint8(i >> 16), uint8(i >> 8), uint8(i)})
+}
+
+// WriteUint24 writes 24 bit of a uint32
+func (bigEndian) WriteUint24(b *bytes.Buffer, i uint32) {
+	if i >= (1 << 24) {
+		panic(fmt.Sprintf("%#x doesn't fit into 24 bits", i))
+	}
+	b.Write([]byte{uint8(i >> 16), uint8(i >> 8), uint8(i)})
+}
+
+// WriteUint16 writes a uint16
+func (bigEndian) WriteUint16(b *bytes.Buffer, i uint16) {
+	b.Write([]byte{uint8(i >> 8), uint8(i)})
+}
+
+func (l bigEndian) ReadUfloat16(b io.ByteReader) (uint64, error) {
+	return readUfloat16(b, l)
+}
+
+func (l bigEndian) WriteUfloat16(b *bytes.Buffer, val uint64) {
+	writeUfloat16(b, l, val)
+}

vendor/github.com/lucas-clemente/quic-go/internal/utils/byteorder_little_endian.go

@@ -0,0 +1,157 @@
+package utils
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+)
+
+// LittleEndian is the little-endian implementation of ByteOrder.
+var LittleEndian ByteOrder = littleEndian{}
+
+type littleEndian struct{}
+
+var _ ByteOrder = &littleEndian{}
+
+// ReadUintN reads N bytes
+func (littleEndian) ReadUintN(b io.ByteReader, length uint8) (uint64, error) {
+	var res uint64
+	for i := uint8(0); i < length; i++ {
+		bt, err := b.ReadByte()
+		if err != nil {
+			return 0, err
+		}
+		res ^= uint64(bt) << (i * 8)
+	}
+	return res, nil
+}
+
+// ReadUint64 reads a uint64
+func (littleEndian) ReadUint64(b io.ByteReader) (uint64, error) {
+	var b1, b2, b3, b4, b5, b6, b7, b8 uint8
+	var err error
+	if b1, err = b.ReadByte(); err != nil {
+		return 0, err
+	}
+	if b2, err = b.ReadByte(); err != nil {
+		return 0, err
+	}
+	if b3, err = b.ReadByte(); err != nil {
+		return 0, err
+	}
+	if b4, err = b.ReadByte(); err != nil {
+		return 0, err
+	}
+	if b5, err = b.ReadByte(); err != nil {
+		return 0, err
+	}
+	if b6, err = b.ReadByte(); err != nil {
+		return 0, err
+	}
+	if b7, err = b.ReadByte(); err != nil {
+		return 0, err
+	}
+	if b8, err = b.ReadByte(); err != nil {
+		return 0, err
+	}
+	return uint64(b1) + uint64(b2)<<8 + uint64(b3)<<16 + uint64(b4)<<24 + uint64(b5)<<32 + uint64(b6)<<40 + uint64(b7)<<48 + uint64(b8)<<56, nil
+}
+
+// ReadUint32 reads a uint32
+func (littleEndian) ReadUint32(b io.ByteReader) (uint32, error) {
+	var b1, b2, b3, b4 uint8
+	var err error
+	if b1, err = b.ReadByte(); err != nil {
+		return 0, err
+	}
+	if b2, err = b.ReadByte(); err != nil {
+		return 0, err
+	}
+	if b3, err = b.ReadByte(); err != nil {
+		return 0, err
+	}
+	if b4, err = b.ReadByte(); err != nil {
+		return 0, err
+	}
+	return uint32(b1) + uint32(b2)<<8 + uint32(b3)<<16 + uint32(b4)<<24, nil
+}
+
+// ReadUint16 reads a uint16
+func (littleEndian) ReadUint16(b io.ByteReader) (uint16, error) {
+	var b1, b2 uint8
+	var err error
+	if b1, err = b.ReadByte(); err != nil {
+		return 0, err
+	}
+	if b2, err = b.ReadByte(); err != nil {
+		return 0, err
+	}
+	return uint16(b1) + uint16(b2)<<8, nil
+}
+
+// WriteUint64 writes a uint64
+func (littleEndian) WriteUint64(b *bytes.Buffer, i uint64) {
+	b.Write([]byte{
+		uint8(i), uint8(i >> 8), uint8(i >> 16), uint8(i >> 24),
+		uint8(i >> 32), uint8(i >> 40), uint8(i >> 48), uint8(i >> 56),
+	})
+}
+
+// WriteUint56 writes 56 bit of a uint64
+func (littleEndian) WriteUint56(b *bytes.Buffer, i uint64) {
+	if i >= (1 << 56) {
+		panic(fmt.Sprintf("%#x doesn't fit into 56 bits", i))
+	}
+	b.Write([]byte{
+		uint8(i), uint8(i >> 8), uint8(i >> 16), uint8(i >> 24),
+		uint8(i >> 32), uint8(i >> 40), uint8(i >> 48),
+	})
+}
+
+// WriteUint48 writes 48 bit of a uint64
+func (littleEndian) WriteUint48(b *bytes.Buffer, i uint64) {
+	if i >= (1 << 48) {
+		panic(fmt.Sprintf("%#x doesn't fit into 48 bits", i))
+	}
+	b.Write([]byte{
+		uint8(i), uint8(i >> 8), uint8(i >> 16), uint8(i >> 24),
+		uint8(i >> 32), uint8(i >> 40),
+	})
+}
+
+// WriteUint40 writes 40 bit of a uint64
+func (littleEndian) WriteUint40(b *bytes.Buffer, i uint64) {
+	if i >= (1 << 40) {
+		panic(fmt.Sprintf("%#x doesn't fit into 40 bits", i))
+	}
+	b.Write([]byte{
+		uint8(i), uint8(i >> 8), uint8(i >> 16),
+		uint8(i >> 24), uint8(i >> 32),
+	})
+}
+
+// WriteUint32 writes a uint32
+func (littleEndian) WriteUint32(b *bytes.Buffer, i uint32) {
+	b.Write([]byte{uint8(i), uint8(i >> 8), uint8(i >> 16), uint8(i >> 24)})
+}
+
+// WriteUint24 writes 24 bit of a uint32
+func (littleEndian) WriteUint24(b *bytes.Buffer, i uint32) {
+	if i >= (1 << 24) {
+		panic(fmt.Sprintf("%#x doesn't fit into 24 bits", i))
+	}
+	b.Write([]byte{uint8(i), uint8(i >> 8), uint8(i >> 16)})
+}
+
+// WriteUint16 writes a uint16
+func (littleEndian) WriteUint16(b *bytes.Buffer, i uint16) {
+	b.Write([]byte{uint8(i), uint8(i >> 8)})
+}
+
+func (l littleEndian) ReadUfloat16(b io.ByteReader) (uint64, error) {
+	return readUfloat16(b, l)
+}
+
+func (l littleEndian) WriteUfloat16(b *bytes.Buffer, val uint64) {
+	writeUfloat16(b, l, val)
+}

vendor/github.com/lucas-clemente/quic-go/internal/utils/float16.go

@@ -0,0 +1,86 @@
+package utils
+
+import (
+	"bytes"
+	"io"
+	"math"
+)
+
+// We define an unsigned 16-bit floating point value, inspired by IEEE floats
+// (http://en.wikipedia.org/wiki/Half_precision_floating-point_format),
+// with 5-bit exponent (bias 1), 11-bit mantissa (effective 12 with hidden
+// bit) and denormals, but without signs, transfinites or fractions. Wire format
+// 16 bits (little-endian byte order) are split into exponent (high 5) and
+// mantissa (low 11) and decoded as:
+//   uint64_t value;
+//   if (exponent == 0) value = mantissa;
+//   else value = (mantissa | 1 << 11) << (exponent - 1)
+const uFloat16ExponentBits = 5
+const uFloat16MaxExponent = (1 << uFloat16ExponentBits) - 2                                        // 30
+const uFloat16MantissaBits = 16 - uFloat16ExponentBits                                             // 11
+const uFloat16MantissaEffectiveBits = uFloat16MantissaBits + 1                                     // 12
+const uFloat16MaxValue = ((uint64(1) << uFloat16MantissaEffectiveBits) - 1) << uFloat16MaxExponent // 0x3FFC0000000
+
+// readUfloat16 reads a float in the QUIC-float16 format and returns its uint64 representation
+func readUfloat16(b io.ByteReader, byteOrder ByteOrder) (uint64, error) {
+	val, err := byteOrder.ReadUint16(b)
+	if err != nil {
+		return 0, err
+	}
+
+	res := uint64(val)
+
+	if res < (1 << uFloat16MantissaEffectiveBits) {
+		// Fast path: either the value is denormalized (no hidden bit), or
+		// normalized (hidden bit set, exponent offset by one) with exponent zero.
+		// Zero exponent offset by one sets the bit exactly where the hidden bit is.
+		// So in both cases the value encodes itself.
+		return res, nil
+	}
+
+	exponent := val >> uFloat16MantissaBits // No sign extend on uint!
+	// After the fast pass, the exponent is at least one (offset by one).
+	// Un-offset the exponent.
+	exponent--
+	// Here we need to clear the exponent and set the hidden bit. We have already
+	// decremented the exponent, so when we subtract it, it leaves behind the
+	// hidden bit.
+	res -= uint64(exponent) << uFloat16MantissaBits
+	res <<= exponent
+	return res, nil
+}
+
+// writeUfloat16 writes a float in the QUIC-float16 format from its uint64 representation
+func writeUfloat16(b *bytes.Buffer, byteOrder ByteOrder, value uint64) {
+	var result uint16
+	if value < (uint64(1) << uFloat16MantissaEffectiveBits) {
+		// Fast path: either the value is denormalized, or has exponent zero.
+		// Both cases are represented by the value itself.
+		result = uint16(value)
+	} else if value >= uFloat16MaxValue {
+		// Value is out of range; clamp it to the maximum representable.
+		result = math.MaxUint16
+	} else {
+		// The highest bit is between position 13 and 42 (zero-based), which
+		// corresponds to exponent 1-30. In the output, mantissa is from 0 to 10,
+		// hidden bit is 11 and exponent is 11 to 15. Shift the highest bit to 11
+		// and count the shifts.
+		exponent := uint16(0)
+		for offset := uint16(16); offset > 0; offset /= 2 {
+			// Right-shift the value until the highest bit is in position 11.
+			// For offset of 16, 8, 4, 2 and 1 (binary search over 1-30),
+			// shift if the bit is at or above 11 + offset.
+			if value >= (uint64(1) << (uFloat16MantissaBits + offset)) {
+				exponent += offset
+				value >>= offset
+			}
+		}
+
+		// Hidden bit (position 11) is set. We should remove it and increment the
+		// exponent. Equivalently, we just add it to the exponent.
+		// This hides the bit.
+		result = (uint16(value) + (exponent << uFloat16MantissaBits))
+	}
+
+	byteOrder.WriteUint16(b, result)
+}

vendor/github.com/lucas-clemente/quic-go/internal/utils/gen.go

@@ -0,0 +1,4 @@
+package utils
+
+//go:generate genny -pkg utils -in linkedlist/linkedlist.go -out byteinterval_linkedlist.go gen Item=ByteInterval
+//go:generate genny -pkg utils -in linkedlist/linkedlist.go -out packetinterval_linkedlist.go gen Item=PacketInterval

vendor/github.com/lucas-clemente/quic-go/internal/utils/host.go

@@ -0,0 +1,27 @@
+package utils
+
+import (
+	"net/url"
+	"strings"
+)
+
+// HostnameFromAddr determines the hostname in an address string
+func HostnameFromAddr(addr string) (string, error) {
+	p, err := url.Parse(addr)
+	if err != nil {
+		return "", err
+	}
+	h := p.Host
+
+	// copied from https://golang.org/src/net/http/transport.go
+	if hasPort(h) {
+		h = h[:strings.LastIndex(h, ":")]
+	}
+
+	return h, nil
+}
+
+// copied from https://golang.org/src/net/http/http.go
+func hasPort(s string) bool {
+	return strings.LastIndex(s, ":") > strings.LastIndex(s, "]")
+}

vendor/github.com/lucas-clemente/quic-go/internal/utils/log.go

@@ -0,0 +1,131 @@
+package utils
+
+import (
+	"fmt"
+	"log"
+	"os"
+	"strings"
+	"time"
+)
+
+// LogLevel of quic-go
+type LogLevel uint8
+
+const (
+	// LogLevelNothing disables
+	LogLevelNothing LogLevel = iota
+	// LogLevelError enables err logs
+	LogLevelError
+	// LogLevelInfo enables info logs (e.g. packets)
+	LogLevelInfo
+	// LogLevelDebug enables debug logs (e.g. packet contents)
+	LogLevelDebug
+)
+
+const logEnv = "QUIC_GO_LOG_LEVEL"
+
+// A Logger logs.
+type Logger interface {
+	SetLogLevel(LogLevel)
+	SetLogTimeFormat(format string)
+	WithPrefix(prefix string) Logger
+	Debug() bool
+
+	Errorf(format string, args ...interface{})
+	Infof(format string, args ...interface{})
+	Debugf(format string, args ...interface{})
+}
+
+// DefaultLogger is used by quic-go for logging.
+var DefaultLogger Logger
+
+type defaultLogger struct {
+	prefix string
+
+	logLevel   LogLevel
+	timeFormat string
+}
+
+var _ Logger = &defaultLogger{}
+
+// SetLogLevel sets the log level
+func (l *defaultLogger) SetLogLevel(level LogLevel) {
+	l.logLevel = level
+}
+
+// SetLogTimeFormat sets the format of the timestamp
+// an empty string disables the logging of timestamps
+func (l *defaultLogger) SetLogTimeFormat(format string) {
+	log.SetFlags(0) // disable timestamp logging done by the log package
+	l.timeFormat = format
+}
+
+// Debugf logs something
+func (l *defaultLogger) Debugf(format string, args ...interface{}) {
+	if l.logLevel == LogLevelDebug {
+		l.logMessage(format, args...)
+	}
+}
+
+// Infof logs something
+func (l *defaultLogger) Infof(format string, args ...interface{}) {
+	if l.logLevel >= LogLevelInfo {
+		l.logMessage(format, args...)
+	}
+}
+
+// Errorf logs something
+func (l *defaultLogger) Errorf(format string, args ...interface{}) {
+	if l.logLevel >= LogLevelError {
+		l.logMessage(format, args...)
+	}
+}
+
+func (l *defaultLogger) logMessage(format string, args ...interface{}) {
+	var pre string
+
+	if len(l.timeFormat) > 0 {
+		pre = time.Now().Format(l.timeFormat) + " "
+	}
+	if len(l.prefix) > 0 {
+		pre += l.prefix + " "
+	}
+	log.Printf(pre+format, args...)
+}
+
+func (l *defaultLogger) WithPrefix(prefix string) Logger {
+	if len(l.prefix) > 0 {
+		prefix = l.prefix + " " + prefix
+	}
+	return &defaultLogger{
+		logLevel:   l.logLevel,
+		timeFormat: l.timeFormat,
+		prefix:     prefix,
+	}
+}
+
+// Debug returns true if the log level is LogLevelDebug
+func (l *defaultLogger) Debug() bool {
+	return l.logLevel == LogLevelDebug
+}
+
+func init() {
+	DefaultLogger = &defaultLogger{}
+	DefaultLogger.SetLogLevel(readLoggingEnv())
+}
+
+func readLoggingEnv() LogLevel {
+	switch strings.ToLower(os.Getenv(logEnv)) {
+	case "":
+		return LogLevelNothing
+	case "debug":
+		return LogLevelDebug
+	case "info":
+		return LogLevelInfo
+	case "error":
+		return LogLevelError
+	default:
+		fmt.Fprintln(os.Stderr, "invalid quic-go log level, see https://github.com/lucas-clemente/quic-go/wiki/Logging")
+		return LogLevelNothing
+	}
+}

vendor/github.com/lucas-clemente/quic-go/internal/utils/minmax.go

@@ -0,0 +1,147 @@
+package utils
+
+import (
+	"math"
+	"time"
+
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+)
+
+// InfDuration is a duration of infinite length
+const InfDuration = time.Duration(math.MaxInt64)
+
+// Max returns the maximum of two Ints
+func Max(a, b int) int {
+	if a < b {
+		return b
+	}
+	return a
+}
+
+// MaxUint32 returns the maximum of two uint32
+func MaxUint32(a, b uint32) uint32 {
+	if a < b {
+		return b
+	}
+	return a
+}
+
+// MaxUint64 returns the maximum of two uint64
+func MaxUint64(a, b uint64) uint64 {
+	if a < b {
+		return b
+	}
+	return a
+}
+
+// MinUint64 returns the maximum of two uint64
+func MinUint64(a, b uint64) uint64 {
+	if a < b {
+		return a
+	}
+	return b
+}
+
+// Min returns the minimum of two Ints
+func Min(a, b int) int {
+	if a < b {
+		return a
+	}
+	return b
+}
+
+// MinUint32 returns the maximum of two uint32
+func MinUint32(a, b uint32) uint32 {
+	if a < b {
+		return a
+	}
+	return b
+}
+
+// MinInt64 returns the minimum of two int64
+func MinInt64(a, b int64) int64 {
+	if a < b {
+		return a
+	}
+	return b
+}
+
+// MaxInt64 returns the minimum of two int64
+func MaxInt64(a, b int64) int64 {
+	if a > b {
+		return a
+	}
+	return b
+}
+
+// MinByteCount returns the minimum of two ByteCounts
+func MinByteCount(a, b protocol.ByteCount) protocol.ByteCount {
+	if a < b {
+		return a
+	}
+	return b
+}
+
+// MaxByteCount returns the maximum of two ByteCounts
+func MaxByteCount(a, b protocol.ByteCount) protocol.ByteCount {
+	if a < b {
+		return b
+	}
+	return a
+}
+
+// MaxDuration returns the max duration
+func MaxDuration(a, b time.Duration) time.Duration {
+	if a > b {
+		return a
+	}
+	return b
+}
+
+// MinDuration returns the minimum duration
+func MinDuration(a, b time.Duration) time.Duration {
+	if a > b {
+		return b
+	}
+	return a
+}
+
+// AbsDuration returns the absolute value of a time duration
+func AbsDuration(d time.Duration) time.Duration {
+	if d >= 0 {
+		return d
+	}
+	return -d
+}
+
+// MinTime returns the earlier time
+func MinTime(a, b time.Time) time.Time {
+	if a.After(b) {
+		return b
+	}
+	return a
+}
+
+// MaxTime returns the later time
+func MaxTime(a, b time.Time) time.Time {
+	if a.After(b) {
+		return a
+	}
+	return b
+}
+
+// MaxPacketNumber returns the max packet number
+func MaxPacketNumber(a, b protocol.PacketNumber) protocol.PacketNumber {
+	if a > b {
+		return a
+	}
+	return b
+}
+
+// MinPacketNumber returns the min packet number
+func MinPacketNumber(a, b protocol.PacketNumber) protocol.PacketNumber {
+	if a < b {
+		return a
+	}
+	return b
+}

vendor/github.com/lucas-clemente/quic-go/internal/utils/packet_interval.go

@@ -0,0 +1,9 @@
+package utils
+
+import "github.com/lucas-clemente/quic-go/internal/protocol"
+
+// PacketInterval is an interval from one PacketNumber to the other
+type PacketInterval struct {
+	Start protocol.PacketNumber
+	End   protocol.PacketNumber
+}

vendor/github.com/lucas-clemente/quic-go/internal/utils/packetinterval_linkedlist.go

@@ -0,0 +1,217 @@
+// This file was automatically generated by genny.
+// Any changes will be lost if this file is regenerated.
+// see https://github.com/cheekybits/genny
+
+package utils
+
+// Linked list implementation from the Go standard library.
+
+// PacketIntervalElement is an element of a linked list.
+type PacketIntervalElement struct {
+	// Next and previous pointers in the doubly-linked list of elements.
+	// To simplify the implementation, internally a list l is implemented
+	// as a ring, such that &l.root is both the next element of the last
+	// list element (l.Back()) and the previous element of the first list
+	// element (l.Front()).
+	next, prev *PacketIntervalElement
+
+	// The list to which this element belongs.
+	list *PacketIntervalList
+
+	// The value stored with this element.
+	Value PacketInterval
+}
+
+// Next returns the next list element or nil.
+func (e *PacketIntervalElement) Next() *PacketIntervalElement {
+	if p := e.next; e.list != nil && p != &e.list.root {
+		return p
+	}
+	return nil
+}
+
+// Prev returns the previous list element or nil.
+func (e *PacketIntervalElement) Prev() *PacketIntervalElement {
+	if p := e.prev; e.list != nil && p != &e.list.root {
+		return p
+	}
+	return nil
+}
+
+// PacketIntervalList is a linked list of PacketIntervals.
+type PacketIntervalList struct {
+	root PacketIntervalElement // sentinel list element, only &root, root.prev, and root.next are used
+	len  int                   // current list length excluding (this) sentinel element
+}
+
+// Init initializes or clears list l.
+func (l *PacketIntervalList) Init() *PacketIntervalList {
+	l.root.next = &l.root
+	l.root.prev = &l.root
+	l.len = 0
+	return l
+}
+
+// NewPacketIntervalList returns an initialized list.
+func NewPacketIntervalList() *PacketIntervalList { return new(PacketIntervalList).Init() }
+
+// Len returns the number of elements of list l.
+// The complexity is O(1).
+func (l *PacketIntervalList) Len() int { return l.len }
+
+// Front returns the first element of list l or nil if the list is empty.
+func (l *PacketIntervalList) Front() *PacketIntervalElement {
+	if l.len == 0 {
+		return nil
+	}
+	return l.root.next
+}
+
+// Back returns the last element of list l or nil if the list is empty.
+func (l *PacketIntervalList) Back() *PacketIntervalElement {
+	if l.len == 0 {
+		return nil
+	}
+	return l.root.prev
+}
+
+// lazyInit lazily initializes a zero List value.
+func (l *PacketIntervalList) lazyInit() {
+	if l.root.next == nil {
+		l.Init()
+	}
+}
+
+// insert inserts e after at, increments l.len, and returns e.
+func (l *PacketIntervalList) insert(e, at *PacketIntervalElement) *PacketIntervalElement {
+	n := at.next
+	at.next = e
+	e.prev = at
+	e.next = n
+	n.prev = e
+	e.list = l
+	l.len++
+	return e
+}
+
+// insertValue is a convenience wrapper for insert(&Element{Value: v}, at).
+func (l *PacketIntervalList) insertValue(v PacketInterval, at *PacketIntervalElement) *PacketIntervalElement {
+	return l.insert(&PacketIntervalElement{Value: v}, at)
+}
+
+// remove removes e from its list, decrements l.len, and returns e.
+func (l *PacketIntervalList) remove(e *PacketIntervalElement) *PacketIntervalElement {
+	e.prev.next = e.next
+	e.next.prev = e.prev
+	e.next = nil // avoid memory leaks
+	e.prev = nil // avoid memory leaks
+	e.list = nil
+	l.len--
+	return e
+}
+
+// Remove removes e from l if e is an element of list l.
+// It returns the element value e.Value.
+// The element must not be nil.
+func (l *PacketIntervalList) Remove(e *PacketIntervalElement) PacketInterval {
+	if e.list == l {
+		// if e.list == l, l must have been initialized when e was inserted
+		// in l or l == nil (e is a zero Element) and l.remove will crash
+		l.remove(e)
+	}
+	return e.Value
+}
+
+// PushFront inserts a new element e with value v at the front of list l and returns e.
+func (l *PacketIntervalList) PushFront(v PacketInterval) *PacketIntervalElement {
+	l.lazyInit()
+	return l.insertValue(v, &l.root)
+}
+
+// PushBack inserts a new element e with value v at the back of list l and returns e.
+func (l *PacketIntervalList) PushBack(v PacketInterval) *PacketIntervalElement {
+	l.lazyInit()
+	return l.insertValue(v, l.root.prev)
+}
+
+// InsertBefore inserts a new element e with value v immediately before mark and returns e.
+// If mark is not an element of l, the list is not modified.
+// The mark must not be nil.
+func (l *PacketIntervalList) InsertBefore(v PacketInterval, mark *PacketIntervalElement) *PacketIntervalElement {
+	if mark.list != l {
+		return nil
+	}
+	// see comment in List.Remove about initialization of l
+	return l.insertValue(v, mark.prev)
+}
+
+// InsertAfter inserts a new element e with value v immediately after mark and returns e.
+// If mark is not an element of l, the list is not modified.
+// The mark must not be nil.
+func (l *PacketIntervalList) InsertAfter(v PacketInterval, mark *PacketIntervalElement) *PacketIntervalElement {
+	if mark.list != l {
+		return nil
+	}
+	// see comment in List.Remove about initialization of l
+	return l.insertValue(v, mark)
+}
+
+// MoveToFront moves element e to the front of list l.
+// If e is not an element of l, the list is not modified.
+// The element must not be nil.
+func (l *PacketIntervalList) MoveToFront(e *PacketIntervalElement) {
+	if e.list != l || l.root.next == e {
+		return
+	}
+	// see comment in List.Remove about initialization of l
+	l.insert(l.remove(e), &l.root)
+}
+
+// MoveToBack moves element e to the back of list l.
+// If e is not an element of l, the list is not modified.
+// The element must not be nil.
+func (l *PacketIntervalList) MoveToBack(e *PacketIntervalElement) {
+	if e.list != l || l.root.prev == e {
+		return
+	}
+	// see comment in List.Remove about initialization of l
+	l.insert(l.remove(e), l.root.prev)
+}
+
+// MoveBefore moves element e to its new position before mark.
+// If e or mark is not an element of l, or e == mark, the list is not modified.
+// The element and mark must not be nil.
+func (l *PacketIntervalList) MoveBefore(e, mark *PacketIntervalElement) {
+	if e.list != l || e == mark || mark.list != l {
+		return
+	}
+	l.insert(l.remove(e), mark.prev)
+}
+
+// MoveAfter moves element e to its new position after mark.
+// If e or mark is not an element of l, or e == mark, the list is not modified.
+// The element and mark must not be nil.
+func (l *PacketIntervalList) MoveAfter(e, mark *PacketIntervalElement) {
+	if e.list != l || e == mark || mark.list != l {
+		return
+	}
+	l.insert(l.remove(e), mark)
+}
+
+// PushBackList inserts a copy of an other list at the back of list l.
+// The lists l and other may be the same. They must not be nil.
+func (l *PacketIntervalList) PushBackList(other *PacketIntervalList) {
+	l.lazyInit()
+	for i, e := other.Len(), other.Front(); i > 0; i, e = i-1, e.Next() {
+		l.insertValue(e.Value, l.root.prev)
+	}
+}
+
+// PushFrontList inserts a copy of an other list at the front of list l.
+// The lists l and other may be the same. They must not be nil.
+func (l *PacketIntervalList) PushFrontList(other *PacketIntervalList) {
+	l.lazyInit()
+	for i, e := other.Len(), other.Back(); i > 0; i, e = i-1, e.Prev() {
+		l.insertValue(e.Value, &l.root)
+	}
+}

vendor/github.com/lucas-clemente/quic-go/internal/utils/streamframe_interval.go

@@ -0,0 +1,9 @@
+package utils
+
+import "github.com/lucas-clemente/quic-go/internal/protocol"
+
+// ByteInterval is an interval from one ByteCount to the other
+type ByteInterval struct {
+	Start protocol.ByteCount
+	End   protocol.ByteCount
+}

vendor/github.com/lucas-clemente/quic-go/internal/utils/timer.go

@@ -0,0 +1,48 @@
+package utils
+
+import (
+	"math"
+	"time"
+)
+
+// A Timer wrapper that behaves correctly when resetting
+type Timer struct {
+	t        *time.Timer
+	read     bool
+	deadline time.Time
+}
+
+// NewTimer creates a new timer that is not set
+func NewTimer() *Timer {
+	return &Timer{t: time.NewTimer(time.Duration(math.MaxInt64))}
+}
+
+// Chan returns the channel of the wrapped timer
+func (t *Timer) Chan() <-chan time.Time {
+	return t.t.C
+}
+
+// Reset the timer, no matter whether the value was read or not
+func (t *Timer) Reset(deadline time.Time) {
+	if deadline.Equal(t.deadline) && !t.read {
+		// No need to reset the timer
+		return
+	}
+
+	// We need to drain the timer if the value from its channel was not read yet.
+	// See https://groups.google.com/forum/#!topic/golang-dev/c9UUfASVPoU
+	if !t.t.Stop() && !t.read {
+		<-t.t.C
+	}
+	if !deadline.IsZero() {
+		t.t.Reset(time.Until(deadline))
+	}
+
+	t.read = false
+	t.deadline = deadline
+}
+
+// SetRead should be called after the value from the chan was read
+func (t *Timer) SetRead() {
+	t.read = true
+}

vendor/github.com/lucas-clemente/quic-go/internal/utils/varint.go

@@ -0,0 +1,101 @@
+package utils
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+)
+
+// taken from the QUIC draft
+const (
+	maxVarInt1 = 63
+	maxVarInt2 = 16383
+	maxVarInt4 = 1073741823
+	maxVarInt8 = 4611686018427387903
+)
+
+// ReadVarInt reads a number in the QUIC varint format
+func ReadVarInt(b io.ByteReader) (uint64, error) {
+	firstByte, err := b.ReadByte()
+	if err != nil {
+		return 0, err
+	}
+	// the first two bits of the first byte encode the length
+	len := 1 << ((firstByte & 0xc0) >> 6)
+	b1 := firstByte & (0xff - 0xc0)
+	if len == 1 {
+		return uint64(b1), nil
+	}
+	b2, err := b.ReadByte()
+	if err != nil {
+		return 0, err
+	}
+	if len == 2 {
+		return uint64(b2) + uint64(b1)<<8, nil
+	}
+	b3, err := b.ReadByte()
+	if err != nil {
+		return 0, err
+	}
+	b4, err := b.ReadByte()
+	if err != nil {
+		return 0, err
+	}
+	if len == 4 {
+		return uint64(b4) + uint64(b3)<<8 + uint64(b2)<<16 + uint64(b1)<<24, nil
+	}
+	b5, err := b.ReadByte()
+	if err != nil {
+		return 0, err
+	}
+	b6, err := b.ReadByte()
+	if err != nil {
+		return 0, err
+	}
+	b7, err := b.ReadByte()
+	if err != nil {
+		return 0, err
+	}
+	b8, err := b.ReadByte()
+	if err != nil {
+		return 0, err
+	}
+	return uint64(b8) + uint64(b7)<<8 + uint64(b6)<<16 + uint64(b5)<<24 + uint64(b4)<<32 + uint64(b3)<<40 + uint64(b2)<<48 + uint64(b1)<<56, nil
+}
+
+// WriteVarInt writes a number in the QUIC varint format
+func WriteVarInt(b *bytes.Buffer, i uint64) {
+	if i <= maxVarInt1 {
+		b.WriteByte(uint8(i))
+	} else if i <= maxVarInt2 {
+		b.Write([]byte{uint8(i>>8) | 0x40, uint8(i)})
+	} else if i <= maxVarInt4 {
+		b.Write([]byte{uint8(i>>24) | 0x80, uint8(i >> 16), uint8(i >> 8), uint8(i)})
+	} else if i <= maxVarInt8 {
+		b.Write([]byte{
+			uint8(i>>56) | 0xc0, uint8(i >> 48), uint8(i >> 40), uint8(i >> 32),
+			uint8(i >> 24), uint8(i >> 16), uint8(i >> 8), uint8(i),
+		})
+	} else {
+		panic(fmt.Sprintf("%#x doesn't fit into 62 bits", i))
+	}
+}
+
+// VarIntLen determines the number of bytes that will be needed to write a number
+func VarIntLen(i uint64) protocol.ByteCount {
+	if i <= maxVarInt1 {
+		return 1
+	}
+	if i <= maxVarInt2 {
+		return 2
+	}
+	if i <= maxVarInt4 {
+		return 4
+	}
+	if i <= maxVarInt8 {
+		return 8
+	}
+	panic(fmt.Sprintf("%#x doesn't fit into 62 bits", i))
+}

vendor/github.com/lucas-clemente/quic-go/internal/utils/varint_packetnumber.go

@@ -0,0 +1,50 @@
+package utils
+
+import (
+	"bytes"
+	"fmt"
+
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+)
+
+// ReadVarIntPacketNumber reads a number in the QUIC varint packet number format
+func ReadVarIntPacketNumber(b *bytes.Reader) (protocol.PacketNumber, protocol.PacketNumberLen, error) {
+	b1, err := b.ReadByte()
+	if err != nil {
+		return 0, 0, err
+	}
+	if b1&0x80 == 0 {
+		return protocol.PacketNumber(b1), protocol.PacketNumberLen1, nil
+	}
+	b2, err := b.ReadByte()
+	if err != nil {
+		return 0, 0, err
+	}
+	if b1&0x40 == 0 {
+		return protocol.PacketNumber(uint64(b1&0x3f)<<8 + uint64(b2)), protocol.PacketNumberLen2, nil
+	}
+	b3, err := b.ReadByte()
+	if err != nil {
+		return 0, 0, err
+	}
+	b4, err := b.ReadByte()
+	if err != nil {
+		return 0, 0, err
+	}
+	return protocol.PacketNumber(uint64(b1&0x3f)<<24 + uint64(b2)<<16 + uint64(b3)<<8 + uint64(b4)), protocol.PacketNumberLen4, nil
+}
+
+// WriteVarIntPacketNumber writes a packet number in the QUIC varint packet number format
+func WriteVarIntPacketNumber(b *bytes.Buffer, i protocol.PacketNumber, len protocol.PacketNumberLen) error {
+	switch len {
+	case protocol.PacketNumberLen1:
+		b.WriteByte(uint8(i & 0x7f))
+	case protocol.PacketNumberLen2:
+		b.Write([]byte{(uint8(i>>8) & 0x3f) | 0x80, uint8(i)})
+	case protocol.PacketNumberLen4:
+		b.Write([]byte{(uint8(i>>24) & 0x3f) | 0xc0, uint8(i >> 16), uint8(i >> 8), uint8(i)})
+	default:
+		return fmt.Errorf("invalid packet number length: %d", len)
+	}
+	return nil
+}

vendor/github.com/lucas-clemente/quic-go/internal/wire/ack_frame.go

@@ -0,0 +1,239 @@
+package wire
+
+import (
+	"bytes"
+	"errors"
+	"sort"
+	"time"
+
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+	"github.com/lucas-clemente/quic-go/internal/utils"
+)
+
+// TODO: use the value sent in the transport parameters
+const ackDelayExponent = 3
+
+// An AckFrame is an ACK frame
+type AckFrame struct {
+	AckRanges []AckRange // has to be ordered. The highest ACK range goes first, the lowest ACK range goes last
+	DelayTime time.Duration
+}
+
+// parseAckFrame reads an ACK frame
+func parseAckFrame(r *bytes.Reader, version protocol.VersionNumber) (*AckFrame, error) {
+	if !version.UsesIETFFrameFormat() {
+		return parseAckFrameLegacy(r, version)
+	}
+
+	typeByte, err := r.ReadByte()
+	if err != nil {
+		return nil, err
+	}
+	ecn := typeByte&0x1 > 0
+
+	frame := &AckFrame{}
+
+	la, err := utils.ReadVarInt(r)
+	if err != nil {
+		return nil, err
+	}
+	largestAcked := protocol.PacketNumber(la)
+	delay, err := utils.ReadVarInt(r)
+	if err != nil {
+		return nil, err
+	}
+	frame.DelayTime = time.Duration(delay*1<<ackDelayExponent) * time.Microsecond
+
+	numBlocks, err := utils.ReadVarInt(r)
+	if err != nil {
+		return nil, err
+	}
+
+	// read the first ACK range
+	ab, err := utils.ReadVarInt(r)
+	if err != nil {
+		return nil, err
+	}
+	ackBlock := protocol.PacketNumber(ab)
+	if ackBlock > largestAcked {
+		return nil, errors.New("invalid first ACK range")
+	}
+	smallest := largestAcked - ackBlock
+
+	// read all the other ACK ranges
+	frame.AckRanges = append(frame.AckRanges, AckRange{Smallest: smallest, Largest: largestAcked})
+	for i := uint64(0); i < numBlocks; i++ {
+		g, err := utils.ReadVarInt(r)
+		if err != nil {
+			return nil, err
+		}
+		gap := protocol.PacketNumber(g)
+		if smallest < gap+2 {
+			return nil, errInvalidAckRanges
+		}
+		largest := smallest - gap - 2
+
+		ab, err := utils.ReadVarInt(r)
+		if err != nil {
+			return nil, err
+		}
+		ackBlock := protocol.PacketNumber(ab)
+
+		if ackBlock > largest {
+			return nil, errInvalidAckRanges
+		}
+		smallest = largest - ackBlock
+		frame.AckRanges = append(frame.AckRanges, AckRange{Smallest: smallest, Largest: largest})
+	}
+
+	if !frame.validateAckRanges() {
+		return nil, errInvalidAckRanges
+	}
+
+	// parse (and skip) the ECN section
+	if ecn {
+		for i := 0; i < 3; i++ {
+			if _, err := utils.ReadVarInt(r); err != nil {
+				return nil, err
+			}
+		}
+	}
+
+	return frame, nil
+}
+
+// Write writes an ACK frame.
+func (f *AckFrame) Write(b *bytes.Buffer, version protocol.VersionNumber) error {
+	if !version.UsesIETFFrameFormat() {
+		return f.writeLegacy(b, version)
+	}
+
+	b.WriteByte(0x1a)
+	utils.WriteVarInt(b, uint64(f.LargestAcked()))
+	utils.WriteVarInt(b, encodeAckDelay(f.DelayTime))
+
+	numRanges := f.numEncodableAckRanges()
+	utils.WriteVarInt(b, uint64(numRanges-1))
+
+	// write the first range
+	_, firstRange := f.encodeAckRange(0)
+	utils.WriteVarInt(b, firstRange)
+
+	// write all the other range
+	for i := 1; i < numRanges; i++ {
+		gap, len := f.encodeAckRange(i)
+		utils.WriteVarInt(b, gap)
+		utils.WriteVarInt(b, len)
+	}
+	return nil
+}
+
+// Length of a written frame
+func (f *AckFrame) Length(version protocol.VersionNumber) protocol.ByteCount {
+	if !version.UsesIETFFrameFormat() {
+		return f.lengthLegacy(version)
+	}
+
+	largestAcked := f.AckRanges[0].Largest
+	numRanges := f.numEncodableAckRanges()
+
+	length := 1 + utils.VarIntLen(uint64(largestAcked)) + utils.VarIntLen(encodeAckDelay(f.DelayTime))
+
+	length += utils.VarIntLen(uint64(numRanges - 1))
+	lowestInFirstRange := f.AckRanges[0].Smallest
+	length += utils.VarIntLen(uint64(largestAcked - lowestInFirstRange))
+
+	for i := 1; i < numRanges; i++ {
+		gap, len := f.encodeAckRange(i)
+		length += utils.VarIntLen(gap)
+		length += utils.VarIntLen(len)
+	}
+	return length
+}
+
+// gets the number of ACK ranges that can be encoded
+// such that the resulting frame is smaller than the maximum ACK frame size
+func (f *AckFrame) numEncodableAckRanges() int {
+	length := 1 + utils.VarIntLen(uint64(f.LargestAcked())) + utils.VarIntLen(encodeAckDelay(f.DelayTime))
+	length += 2 // assume that the number of ranges will consume 2 bytes
+	for i := 1; i < len(f.AckRanges); i++ {
+		gap, len := f.encodeAckRange(i)
+		rangeLen := utils.VarIntLen(gap) + utils.VarIntLen(len)
+		if length+rangeLen > protocol.MaxAckFrameSize {
+			// Writing range i would exceed the MaxAckFrameSize.
+			// So encode one range less than that.
+			return i - 1
+		}
+		length += rangeLen
+	}
+	return len(f.AckRanges)
+}
+
+func (f *AckFrame) encodeAckRange(i int) (uint64 /* gap */, uint64 /* length */) {
+	if i == 0 {
+		return 0, uint64(f.AckRanges[0].Largest - f.AckRanges[0].Smallest)
+	}
+	return uint64(f.AckRanges[i-1].Smallest - f.AckRanges[i].Largest - 2),
+		uint64(f.AckRanges[i].Largest - f.AckRanges[i].Smallest)
+}
+
+// HasMissingRanges returns if this frame reports any missing packets
+func (f *AckFrame) HasMissingRanges() bool {
+	return len(f.AckRanges) > 1
+}
+
+func (f *AckFrame) validateAckRanges() bool {
+	if len(f.AckRanges) == 0 {
+		return false
+	}
+
+	// check the validity of every single ACK range
+	for _, ackRange := range f.AckRanges {
+		if ackRange.Smallest > ackRange.Largest {
+			return false
+		}
+	}
+
+	// check the consistency for ACK with multiple NACK ranges
+	for i, ackRange := range f.AckRanges {
+		if i == 0 {
+			continue
+		}
+		lastAckRange := f.AckRanges[i-1]
+		if lastAckRange.Smallest <= ackRange.Smallest {
+			return false
+		}
+		if lastAckRange.Smallest <= ackRange.Largest+1 {
+			return false
+		}
+	}
+
+	return true
+}
+
+// LargestAcked is the largest acked packet number
+func (f *AckFrame) LargestAcked() protocol.PacketNumber {
+	return f.AckRanges[0].Largest
+}
+
+// LowestAcked is the lowest acked packet number
+func (f *AckFrame) LowestAcked() protocol.PacketNumber {
+	return f.AckRanges[len(f.AckRanges)-1].Smallest
+}
+
+// AcksPacket determines if this ACK frame acks a certain packet number
+func (f *AckFrame) AcksPacket(p protocol.PacketNumber) bool {
+	if p < f.LowestAcked() || p > f.LargestAcked() {
+		return false
+	}
+
+	i := sort.Search(len(f.AckRanges), func(i int) bool {
+		return p >= f.AckRanges[i].Smallest
+	})
+	// i will always be < len(f.AckRanges), since we checked above that p is not bigger than the largest acked
+	return p <= f.AckRanges[i].Largest
+}
+
+func encodeAckDelay(delay time.Duration) uint64 {
+	return uint64(delay.Nanoseconds() / (1000 * (1 << ackDelayExponent)))
+}

vendor/github.com/lucas-clemente/quic-go/internal/wire/ack_frame_legacy.go

@@ -0,0 +1,364 @@
+package wire
+
+import (
+	"bytes"
+	"errors"
+	"time"
+
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+	"github.com/lucas-clemente/quic-go/internal/utils"
+)
+
+var errInvalidAckRanges = errors.New("AckFrame: ACK frame contains invalid ACK ranges")
+
+func parseAckFrameLegacy(r *bytes.Reader, _ protocol.VersionNumber) (*AckFrame, error) {
+	frame := &AckFrame{}
+
+	typeByte, err := r.ReadByte()
+	if err != nil {
+		return nil, err
+	}
+
+	hasMissingRanges := typeByte&0x20 == 0x20
+	largestAckedLen := 2 * ((typeByte & 0x0C) >> 2)
+	if largestAckedLen == 0 {
+		largestAckedLen = 1
+	}
+
+	missingSequenceNumberDeltaLen := 2 * (typeByte & 0x03)
+	if missingSequenceNumberDeltaLen == 0 {
+		missingSequenceNumberDeltaLen = 1
+	}
+
+	la, err := utils.BigEndian.ReadUintN(r, largestAckedLen)
+	if err != nil {
+		return nil, err
+	}
+	largestAcked := protocol.PacketNumber(la)
+
+	delay, err := utils.BigEndian.ReadUfloat16(r)
+	if err != nil {
+		return nil, err
+	}
+	frame.DelayTime = time.Duration(delay) * time.Microsecond
+
+	var numAckBlocks uint8
+	if hasMissingRanges {
+		numAckBlocks, err = r.ReadByte()
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	if hasMissingRanges && numAckBlocks == 0 {
+		return nil, errInvalidAckRanges
+	}
+
+	abl, err := utils.BigEndian.ReadUintN(r, missingSequenceNumberDeltaLen)
+	if err != nil {
+		return nil, err
+	}
+	ackBlockLength := protocol.PacketNumber(abl)
+	if largestAcked > 0 && ackBlockLength < 1 {
+		return nil, errors.New("invalid first ACK range")
+	}
+
+	if ackBlockLength > largestAcked+1 {
+		return nil, errInvalidAckRanges
+	}
+
+	if hasMissingRanges {
+		ackRange := AckRange{
+			Smallest: largestAcked - ackBlockLength + 1,
+			Largest:  largestAcked,
+		}
+		frame.AckRanges = append(frame.AckRanges, ackRange)
+
+		var inLongBlock bool
+		var lastRangeComplete bool
+		for i := uint8(0); i < numAckBlocks; i++ {
+			var gap uint8
+			gap, err = r.ReadByte()
+			if err != nil {
+				return nil, err
+			}
+
+			abl, err := utils.BigEndian.ReadUintN(r, missingSequenceNumberDeltaLen)
+			if err != nil {
+				return nil, err
+			}
+			ackBlockLength := protocol.PacketNumber(abl)
+
+			if inLongBlock {
+				frame.AckRanges[len(frame.AckRanges)-1].Smallest -= protocol.PacketNumber(gap) + ackBlockLength
+				frame.AckRanges[len(frame.AckRanges)-1].Largest -= protocol.PacketNumber(gap)
+			} else {
+				lastRangeComplete = false
+				ackRange := AckRange{
+					Largest: frame.AckRanges[len(frame.AckRanges)-1].Smallest - protocol.PacketNumber(gap) - 1,
+				}
+				ackRange.Smallest = ackRange.Largest - ackBlockLength + 1
+				frame.AckRanges = append(frame.AckRanges, ackRange)
+			}
+
+			if ackBlockLength > 0 {
+				lastRangeComplete = true
+			}
+			inLongBlock = (ackBlockLength == 0)
+		}
+
+		// if the last range was not complete, First and Last make no sense
+		// remove the range from frame.AckRanges
+		if !lastRangeComplete {
+			frame.AckRanges = frame.AckRanges[:len(frame.AckRanges)-1]
+		}
+	} else {
+		frame.AckRanges = make([]AckRange, 1)
+		if largestAcked != 0 {
+			frame.AckRanges[0].Largest = largestAcked
+			frame.AckRanges[0].Smallest = largestAcked + 1 - ackBlockLength
+		}
+	}
+
+	if !frame.validateAckRanges() {
+		return nil, errInvalidAckRanges
+	}
+
+	var numTimestamp byte
+	numTimestamp, err = r.ReadByte()
+	if err != nil {
+		return nil, err
+	}
+
+	if numTimestamp > 0 {
+		// Delta Largest acked
+		_, err = r.ReadByte()
+		if err != nil {
+			return nil, err
+		}
+		// First Timestamp
+		_, err = utils.BigEndian.ReadUint32(r)
+		if err != nil {
+			return nil, err
+		}
+
+		for i := 0; i < int(numTimestamp)-1; i++ {
+			// Delta Largest acked
+			_, err = r.ReadByte()
+			if err != nil {
+				return nil, err
+			}
+
+			// Time Since Previous Timestamp
+			_, err = utils.BigEndian.ReadUint16(r)
+			if err != nil {
+				return nil, err
+			}
+		}
+	}
+	return frame, nil
+}
+
+func (f *AckFrame) writeLegacy(b *bytes.Buffer, _ protocol.VersionNumber) error {
+	largestAcked := f.LargestAcked()
+	largestAckedLen := protocol.GetPacketNumberLength(largestAcked)
+
+	typeByte := uint8(0x40)
+
+	if largestAckedLen != protocol.PacketNumberLen1 {
+		typeByte ^= (uint8(largestAckedLen / 2)) << 2
+	}
+
+	missingSequenceNumberDeltaLen := f.getMissingSequenceNumberDeltaLen()
+	if missingSequenceNumberDeltaLen != protocol.PacketNumberLen1 {
+		typeByte ^= (uint8(missingSequenceNumberDeltaLen / 2))
+	}
+
+	if f.HasMissingRanges() {
+		typeByte |= 0x20
+	}
+
+	b.WriteByte(typeByte)
+
+	switch largestAckedLen {
+	case protocol.PacketNumberLen1:
+		b.WriteByte(uint8(largestAcked))
+	case protocol.PacketNumberLen2:
+		utils.BigEndian.WriteUint16(b, uint16(largestAcked))
+	case protocol.PacketNumberLen4:
+		utils.BigEndian.WriteUint32(b, uint32(largestAcked))
+	case protocol.PacketNumberLen6:
+		utils.BigEndian.WriteUint48(b, uint64(largestAcked)&(1<<48-1))
+	}
+
+	utils.BigEndian.WriteUfloat16(b, uint64(f.DelayTime/time.Microsecond))
+
+	var numRanges uint64
+	var numRangesWritten uint64
+	if f.HasMissingRanges() {
+		numRanges = f.numWritableNackRanges()
+		if numRanges > 0xFF {
+			panic("AckFrame: Too many ACK ranges")
+		}
+		b.WriteByte(uint8(numRanges - 1))
+	}
+
+	var firstAckBlockLength protocol.PacketNumber
+	if !f.HasMissingRanges() {
+		firstAckBlockLength = largestAcked - f.LowestAcked() + 1
+	} else {
+		firstAckBlockLength = largestAcked - f.AckRanges[0].Smallest + 1
+		numRangesWritten++
+	}
+
+	switch missingSequenceNumberDeltaLen {
+	case protocol.PacketNumberLen1:
+		b.WriteByte(uint8(firstAckBlockLength))
+	case protocol.PacketNumberLen2:
+		utils.BigEndian.WriteUint16(b, uint16(firstAckBlockLength))
+	case protocol.PacketNumberLen4:
+		utils.BigEndian.WriteUint32(b, uint32(firstAckBlockLength))
+	case protocol.PacketNumberLen6:
+		utils.BigEndian.WriteUint48(b, uint64(firstAckBlockLength)&(1<<48-1))
+	}
+
+	for i, ackRange := range f.AckRanges {
+		if i == 0 {
+			continue
+		}
+
+		length := ackRange.Largest - ackRange.Smallest + 1
+		gap := f.AckRanges[i-1].Smallest - ackRange.Largest - 1
+
+		num := gap/0xFF + 1
+		if gap%0xFF == 0 {
+			num--
+		}
+
+		if num == 1 {
+			b.WriteByte(uint8(gap))
+			switch missingSequenceNumberDeltaLen {
+			case protocol.PacketNumberLen1:
+				b.WriteByte(uint8(length))
+			case protocol.PacketNumberLen2:
+				utils.BigEndian.WriteUint16(b, uint16(length))
+			case protocol.PacketNumberLen4:
+				utils.BigEndian.WriteUint32(b, uint32(length))
+			case protocol.PacketNumberLen6:
+				utils.BigEndian.WriteUint48(b, uint64(length)&(1<<48-1))
+			}
+			numRangesWritten++
+		} else {
+			for i := 0; i < int(num); i++ {
+				var lengthWritten uint64
+				var gapWritten uint8
+
+				if i == int(num)-1 { // last block
+					lengthWritten = uint64(length)
+					gapWritten = uint8(1 + ((gap - 1) % 255))
+				} else {
+					lengthWritten = 0
+					gapWritten = 0xFF
+				}
+
+				b.WriteByte(gapWritten)
+				switch missingSequenceNumberDeltaLen {
+				case protocol.PacketNumberLen1:
+					b.WriteByte(uint8(lengthWritten))
+				case protocol.PacketNumberLen2:
+					utils.BigEndian.WriteUint16(b, uint16(lengthWritten))
+				case protocol.PacketNumberLen4:
+					utils.BigEndian.WriteUint32(b, uint32(lengthWritten))
+				case protocol.PacketNumberLen6:
+					utils.BigEndian.WriteUint48(b, lengthWritten&(1<<48-1))
+				}
+
+				numRangesWritten++
+			}
+		}
+
+		// this is needed if not all AckRanges can be written to the ACK frame (if there are more than 0xFF)
+		if numRangesWritten >= numRanges {
+			break
+		}
+	}
+
+	if numRanges != numRangesWritten {
+		return errors.New("BUG: Inconsistent number of ACK ranges written")
+	}
+
+	b.WriteByte(0) // no timestamps
+	return nil
+}
+
+func (f *AckFrame) lengthLegacy(_ protocol.VersionNumber) protocol.ByteCount {
+	length := protocol.ByteCount(1 + 2 + 1) // 1 TypeByte, 2 ACK delay time, 1 Num Timestamp
+	length += protocol.ByteCount(protocol.GetPacketNumberLength(f.LargestAcked()))
+
+	missingSequenceNumberDeltaLen := protocol.ByteCount(f.getMissingSequenceNumberDeltaLen())
+
+	if f.HasMissingRanges() {
+		length += (1 + missingSequenceNumberDeltaLen) * protocol.ByteCount(f.numWritableNackRanges())
+	} else {
+		length += missingSequenceNumberDeltaLen
+	}
+	// we don't write
+	return length
+}
+
+// numWritableNackRanges calculates the number of ACK blocks that are about to be written
+// this number is different from len(f.AckRanges) for the case of long gaps (> 255 packets)
+func (f *AckFrame) numWritableNackRanges() uint64 {
+	if len(f.AckRanges) == 0 {
+		return 0
+	}
+
+	var numRanges uint64
+	for i, ackRange := range f.AckRanges {
+		if i == 0 {
+			continue
+		}
+
+		lastAckRange := f.AckRanges[i-1]
+		gap := lastAckRange.Smallest - ackRange.Largest - 1
+		rangeLength := 1 + uint64(gap)/0xFF
+		if uint64(gap)%0xFF == 0 {
+			rangeLength--
+		}
+
+		if numRanges+rangeLength < 0xFF {
+			numRanges += rangeLength
+		} else {
+			break
+		}
+	}
+
+	return numRanges + 1
+}
+
+func (f *AckFrame) getMissingSequenceNumberDeltaLen() protocol.PacketNumberLen {
+	var maxRangeLength protocol.PacketNumber
+
+	if f.HasMissingRanges() {
+		for _, ackRange := range f.AckRanges {
+			rangeLength := ackRange.Largest - ackRange.Smallest + 1
+			if rangeLength > maxRangeLength {
+				maxRangeLength = rangeLength
+			}
+		}
+	} else {
+		maxRangeLength = f.LargestAcked() - f.LowestAcked() + 1
+	}
+
+	if maxRangeLength <= 0xFF {
+		return protocol.PacketNumberLen1
+	}
+	if maxRangeLength <= 0xFFFF {
+		return protocol.PacketNumberLen2
+	}
+	if maxRangeLength <= 0xFFFFFFFF {
+		return protocol.PacketNumberLen4
+	}
+
+	return protocol.PacketNumberLen6
+}

vendor/github.com/lucas-clemente/quic-go/internal/wire/ack_range.go

@@ -0,0 +1,14 @@
+package wire
+
+import "github.com/lucas-clemente/quic-go/internal/protocol"
+
+// AckRange is an ACK range
+type AckRange struct {
+	Smallest protocol.PacketNumber
+	Largest  protocol.PacketNumber
+}
+
+// Len returns the number of packets contained in this ACK range
+func (r AckRange) Len() protocol.PacketNumber {
+	return r.Largest - r.Smallest + 1
+}

vendor/github.com/lucas-clemente/quic-go/internal/wire/blocked_frame.go

@@ -0,0 +1,45 @@
+package wire
+
+import (
+	"bytes"
+
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+	"github.com/lucas-clemente/quic-go/internal/utils"
+)
+
+// A BlockedFrame is a BLOCKED frame
+type BlockedFrame struct {
+	Offset protocol.ByteCount
+}
+
+// parseBlockedFrame parses a BLOCKED frame
+func parseBlockedFrame(r *bytes.Reader, _ protocol.VersionNumber) (*BlockedFrame, error) {
+	if _, err := r.ReadByte(); err != nil {
+		return nil, err
+	}
+	offset, err := utils.ReadVarInt(r)
+	if err != nil {
+		return nil, err
+	}
+	return &BlockedFrame{
+		Offset: protocol.ByteCount(offset),
+	}, nil
+}
+
+func (f *BlockedFrame) Write(b *bytes.Buffer, version protocol.VersionNumber) error {
+	if !version.UsesIETFFrameFormat() {
+		return (&blockedFrameLegacy{}).Write(b, version)
+	}
+	typeByte := uint8(0x08)
+	b.WriteByte(typeByte)
+	utils.WriteVarInt(b, uint64(f.Offset))
+	return nil
+}
+
+// Length of a written frame
+func (f *BlockedFrame) Length(version protocol.VersionNumber) protocol.ByteCount {
+	if !version.UsesIETFFrameFormat() {
+		return 1 + 4
+	}
+	return 1 + utils.VarIntLen(uint64(f.Offset))
+}

vendor/github.com/lucas-clemente/quic-go/internal/wire/blocked_frame_legacy.go

@@ -0,0 +1,37 @@
+package wire
+
+import (
+	"bytes"
+
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+	"github.com/lucas-clemente/quic-go/internal/utils"
+)
+
+type blockedFrameLegacy struct {
+	StreamID protocol.StreamID
+}
+
+// parseBlockedFrameLegacy parses a BLOCKED frame (in gQUIC format)
+// The frame returned is
+// * a STREAM_BLOCKED frame, if the BLOCKED applies to a stream
+// * a BLOCKED frame, if the BLOCKED applies to the connection
+func parseBlockedFrameLegacy(r *bytes.Reader, _ protocol.VersionNumber) (Frame, error) {
+	if _, err := r.ReadByte(); err != nil { // read the TypeByte
+		return nil, err
+	}
+	streamID, err := utils.BigEndian.ReadUint32(r)
+	if err != nil {
+		return nil, err
+	}
+	if streamID == 0 {
+		return &BlockedFrame{}, nil
+	}
+	return &StreamBlockedFrame{StreamID: protocol.StreamID(streamID)}, nil
+}
+
+//Write writes a BLOCKED frame
+func (f *blockedFrameLegacy) Write(b *bytes.Buffer, _ protocol.VersionNumber) error {
+	b.WriteByte(0x05)
+	utils.BigEndian.WriteUint32(b, uint32(f.StreamID))
+	return nil
+}

vendor/github.com/lucas-clemente/quic-go/internal/wire/connection_close_frame.go

@@ -0,0 +1,96 @@
+package wire
+
+import (
+	"bytes"
+	"errors"
+	"io"
+	"math"
+
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+	"github.com/lucas-clemente/quic-go/internal/utils"
+	"github.com/lucas-clemente/quic-go/qerr"
+)
+
+// A ConnectionCloseFrame in QUIC
+type ConnectionCloseFrame struct {
+	ErrorCode    qerr.ErrorCode
+	ReasonPhrase string
+}
+
+// parseConnectionCloseFrame reads a CONNECTION_CLOSE frame
+func parseConnectionCloseFrame(r *bytes.Reader, version protocol.VersionNumber) (*ConnectionCloseFrame, error) {
+	if _, err := r.ReadByte(); err != nil { // read the TypeByte
+		return nil, err
+	}
+
+	var errorCode qerr.ErrorCode
+	var reasonPhraseLen uint64
+	if version.UsesIETFFrameFormat() {
+		ec, err := utils.BigEndian.ReadUint16(r)
+		if err != nil {
+			return nil, err
+		}
+		errorCode = qerr.ErrorCode(ec)
+		reasonPhraseLen, err = utils.ReadVarInt(r)
+		if err != nil {
+			return nil, err
+		}
+	} else {
+		ec, err := utils.BigEndian.ReadUint32(r)
+		if err != nil {
+			return nil, err
+		}
+		errorCode = qerr.ErrorCode(ec)
+		length, err := utils.BigEndian.ReadUint16(r)
+		if err != nil {
+			return nil, err
+		}
+		reasonPhraseLen = uint64(length)
+	}
+
+	// shortcut to prevent the unnecessary allocation of dataLen bytes
+	// if the dataLen is larger than the remaining length of the packet
+	// reading the whole reason phrase would result in EOF when attempting to READ
+	if int(reasonPhraseLen) > r.Len() {
+		return nil, io.EOF
+	}
+
+	reasonPhrase := make([]byte, reasonPhraseLen)
+	if _, err := io.ReadFull(r, reasonPhrase); err != nil {
+		// this should never happen, since we already checked the reasonPhraseLen earlier
+		return nil, err
+	}
+
+	return &ConnectionCloseFrame{
+		ErrorCode:    errorCode,
+		ReasonPhrase: string(reasonPhrase),
+	}, nil
+}
+
+// Length of a written frame
+func (f *ConnectionCloseFrame) Length(version protocol.VersionNumber) protocol.ByteCount {
+	if version.UsesIETFFrameFormat() {
+		return 1 + 2 + utils.VarIntLen(uint64(len(f.ReasonPhrase))) + protocol.ByteCount(len(f.ReasonPhrase))
+	}
+	return 1 + 4 + 2 + protocol.ByteCount(len(f.ReasonPhrase))
+}
+
+// Write writes an CONNECTION_CLOSE frame.
+func (f *ConnectionCloseFrame) Write(b *bytes.Buffer, version protocol.VersionNumber) error {
+	b.WriteByte(0x02)
+
+	if len(f.ReasonPhrase) > math.MaxUint16 {
+		return errors.New("ConnectionFrame: ReasonPhrase too long")
+	}
+
+	if version.UsesIETFFrameFormat() {
+		utils.BigEndian.WriteUint16(b, uint16(f.ErrorCode))
+		utils.WriteVarInt(b, uint64(len(f.ReasonPhrase)))
+	} else {
+		utils.BigEndian.WriteUint32(b, uint32(f.ErrorCode))
+		utils.BigEndian.WriteUint16(b, uint16(len(f.ReasonPhrase)))
+	}
+	b.WriteString(f.ReasonPhrase)
+
+	return nil
+}

vendor/github.com/lucas-clemente/quic-go/internal/wire/frame.go

@@ -0,0 +1,13 @@
+package wire
+
+import (
+	"bytes"
+
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+)
+
+// A Frame in QUIC
+type Frame interface {
+	Write(b *bytes.Buffer, version protocol.VersionNumber) error
+	Length(version protocol.VersionNumber) protocol.ByteCount
+}

vendor/github.com/lucas-clemente/quic-go/internal/wire/frame_parser.go

@@ -0,0 +1,167 @@
+package wire
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+	"github.com/lucas-clemente/quic-go/qerr"
+)
+
+// ParseNextFrame parses the next frame
+// It skips PADDING frames.
+func ParseNextFrame(r *bytes.Reader, hdr *Header, v protocol.VersionNumber) (Frame, error) {
+	for r.Len() != 0 {
+		typeByte, _ := r.ReadByte()
+		if typeByte == 0x0 { // PADDING frame
+			continue
+		}
+		r.UnreadByte()
+
+		if !v.UsesIETFFrameFormat() {
+			return parseGQUICFrame(r, typeByte, hdr, v)
+		}
+		return parseIETFFrame(r, typeByte, v)
+	}
+	return nil, nil
+}
+
+func parseIETFFrame(r *bytes.Reader, typeByte byte, v protocol.VersionNumber) (Frame, error) {
+	var frame Frame
+	var err error
+	if typeByte&0xf8 == 0x10 {
+		frame, err = parseStreamFrame(r, v)
+		if err != nil {
+			err = qerr.Error(qerr.InvalidStreamData, err.Error())
+		}
+		return frame, err
+	}
+	// TODO: implement all IETF QUIC frame types
+	switch typeByte {
+	case 0x1:
+		frame, err = parseRstStreamFrame(r, v)
+		if err != nil {
+			err = qerr.Error(qerr.InvalidRstStreamData, err.Error())
+		}
+	case 0x2:
+		frame, err = parseConnectionCloseFrame(r, v)
+		if err != nil {
+			err = qerr.Error(qerr.InvalidConnectionCloseData, err.Error())
+		}
+	case 0x4:
+		frame, err = parseMaxDataFrame(r, v)
+		if err != nil {
+			err = qerr.Error(qerr.InvalidWindowUpdateData, err.Error())
+		}
+	case 0x5:
+		frame, err = parseMaxStreamDataFrame(r, v)
+		if err != nil {
+			err = qerr.Error(qerr.InvalidWindowUpdateData, err.Error())
+		}
+	case 0x6:
+		frame, err = parseMaxStreamIDFrame(r, v)
+		if err != nil {
+			err = qerr.Error(qerr.InvalidFrameData, err.Error())
+		}
+	case 0x7:
+		frame, err = parsePingFrame(r, v)
+	case 0x8:
+		frame, err = parseBlockedFrame(r, v)
+		if err != nil {
+			err = qerr.Error(qerr.InvalidBlockedData, err.Error())
+		}
+	case 0x9:
+		frame, err = parseStreamBlockedFrame(r, v)
+		if err != nil {
+			err = qerr.Error(qerr.InvalidBlockedData, err.Error())
+		}
+	case 0xa:
+		frame, err = parseStreamIDBlockedFrame(r, v)
+		if err != nil {
+			err = qerr.Error(qerr.InvalidFrameData, err.Error())
+		}
+	case 0xc:
+		frame, err = parseStopSendingFrame(r, v)
+		if err != nil {
+			err = qerr.Error(qerr.InvalidFrameData, err.Error())
+		}
+	case 0xe:
+		frame, err = parsePathChallengeFrame(r, v)
+		if err != nil {
+			err = qerr.Error(qerr.InvalidFrameData, err.Error())
+		}
+	case 0xf:
+		frame, err = parsePathResponseFrame(r, v)
+		if err != nil {
+			err = qerr.Error(qerr.InvalidFrameData, err.Error())
+		}
+	case 0x1a, 0x1b:
+		frame, err = parseAckFrame(r, v)
+		if err != nil {
+			err = qerr.Error(qerr.InvalidAckData, err.Error())
+		}
+	default:
+		err = qerr.Error(qerr.InvalidFrameData, fmt.Sprintf("unknown type byte 0x%x", typeByte))
+	}
+	return frame, err
+}
+
+func parseGQUICFrame(r *bytes.Reader, typeByte byte, hdr *Header, v protocol.VersionNumber) (Frame, error) {
+	var frame Frame
+	var err error
+	if typeByte&0x80 == 0x80 {
+		frame, err = parseStreamFrame(r, v)
+		if err != nil {
+			err = qerr.Error(qerr.InvalidStreamData, err.Error())
+		}
+		return frame, err
+	} else if typeByte&0xc0 == 0x40 {
+		frame, err = parseAckFrame(r, v)
+		if err != nil {
+			err = qerr.Error(qerr.InvalidAckData, err.Error())
+		}
+		return frame, err
+	}
+	switch typeByte {
+	case 0x1:
+		frame, err = parseRstStreamFrame(r, v)
+		if err != nil {
+			err = qerr.Error(qerr.InvalidRstStreamData, err.Error())
+		}
+	case 0x2:
+		frame, err = parseConnectionCloseFrame(r, v)
+		if err != nil {
+			err = qerr.Error(qerr.InvalidConnectionCloseData, err.Error())
+		}
+	case 0x3:
+		frame, err = parseGoawayFrame(r, v)
+		if err != nil {
+			err = qerr.Error(qerr.InvalidGoawayData, err.Error())
+		}
+	case 0x4:
+		frame, err = parseWindowUpdateFrame(r, v)
+		if err != nil {
+			err = qerr.Error(qerr.InvalidWindowUpdateData, err.Error())
+		}
+	case 0x5:
+		frame, err = parseBlockedFrameLegacy(r, v)
+		if err != nil {
+			err = qerr.Error(qerr.InvalidBlockedData, err.Error())
+		}
+	case 0x6:
+		if !v.UsesStopWaitingFrames() {
+			err = errors.New("STOP_WAITING frames not supported by this QUIC version")
+			break
+		}
+		frame, err = parseStopWaitingFrame(r, hdr.PacketNumber, hdr.PacketNumberLen, v)
+		if err != nil {
+			err = qerr.Error(qerr.InvalidStopWaitingData, err.Error())
+		}
+	case 0x7:
+		frame, err = parsePingFrame(r, v)
+	default:
+		err = qerr.Error(qerr.InvalidFrameData, fmt.Sprintf("unknown type byte 0x%x", typeByte))
+	}
+	return frame, err
+}

vendor/github.com/lucas-clemente/quic-go/internal/wire/goaway_frame.go

@@ -0,0 +1,68 @@
+package wire
+
+import (
+	"bytes"
+	"io"
+
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+	"github.com/lucas-clemente/quic-go/internal/utils"
+	"github.com/lucas-clemente/quic-go/qerr"
+)
+
+// A GoawayFrame is a GOAWAY frame
+type GoawayFrame struct {
+	ErrorCode      qerr.ErrorCode
+	LastGoodStream protocol.StreamID
+	ReasonPhrase   string
+}
+
+// parseGoawayFrame parses a GOAWAY frame
+func parseGoawayFrame(r *bytes.Reader, _ protocol.VersionNumber) (*GoawayFrame, error) {
+	frame := &GoawayFrame{}
+
+	if _, err := r.ReadByte(); err != nil {
+		return nil, err
+	}
+
+	errorCode, err := utils.BigEndian.ReadUint32(r)
+	if err != nil {
+		return nil, err
+	}
+	frame.ErrorCode = qerr.ErrorCode(errorCode)
+
+	lastGoodStream, err := utils.BigEndian.ReadUint32(r)
+	if err != nil {
+		return nil, err
+	}
+	frame.LastGoodStream = protocol.StreamID(lastGoodStream)
+
+	reasonPhraseLen, err := utils.BigEndian.ReadUint16(r)
+	if err != nil {
+		return nil, err
+	}
+
+	if reasonPhraseLen > uint16(protocol.MaxReceivePacketSize) {
+		return nil, qerr.Error(qerr.InvalidGoawayData, "reason phrase too long")
+	}
+
+	reasonPhrase := make([]byte, reasonPhraseLen)
+	if _, err := io.ReadFull(r, reasonPhrase); err != nil {
+		return nil, err
+	}
+	frame.ReasonPhrase = string(reasonPhrase)
+	return frame, nil
+}
+
+func (f *GoawayFrame) Write(b *bytes.Buffer, _ protocol.VersionNumber) error {
+	b.WriteByte(0x03)
+	utils.BigEndian.WriteUint32(b, uint32(f.ErrorCode))
+	utils.BigEndian.WriteUint32(b, uint32(f.LastGoodStream))
+	utils.BigEndian.WriteUint16(b, uint16(len(f.ReasonPhrase)))
+	b.WriteString(f.ReasonPhrase)
+	return nil
+}
+
+// Length of a written frame
+func (f *GoawayFrame) Length(version protocol.VersionNumber) protocol.ByteCount {
+	return protocol.ByteCount(1 + 4 + 4 + 2 + len(f.ReasonPhrase))
+}

vendor/github.com/lucas-clemente/quic-go/internal/wire/header.go

@@ -0,0 +1,333 @@
+package wire
+
+import (
+	"bytes"
+	"crypto/rand"
+	"errors"
+	"fmt"
+
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+	"github.com/lucas-clemente/quic-go/internal/utils"
+)
+
+// Header is the header of a QUIC packet.
+// It contains fields that are only needed for the gQUIC Public Header and the IETF draft Header.
+type Header struct {
+	IsPublicHeader bool
+
+	Raw []byte
+
+	Version protocol.VersionNumber
+
+	DestConnectionID     protocol.ConnectionID
+	SrcConnectionID      protocol.ConnectionID
+	OrigDestConnectionID protocol.ConnectionID // only needed in the Retry packet
+
+	PacketNumberLen protocol.PacketNumberLen
+	PacketNumber    protocol.PacketNumber
+
+	IsVersionNegotiation bool
+	SupportedVersions    []protocol.VersionNumber // Version Number sent in a Version Negotiation Packet by the server
+
+	// only needed for the gQUIC Public Header
+	VersionFlag          bool
+	ResetFlag            bool
+	DiversificationNonce []byte
+
+	// only needed for the IETF Header
+	Type         protocol.PacketType
+	IsLongHeader bool
+	KeyPhase     int
+	PayloadLen   protocol.ByteCount
+	Token        []byte
+}
+
+var errInvalidPacketNumberLen = errors.New("invalid packet number length")
+
+// Write writes the Header.
+func (h *Header) Write(b *bytes.Buffer, pers protocol.Perspective, ver protocol.VersionNumber) error {
+	if !ver.UsesIETFHeaderFormat() {
+		h.IsPublicHeader = true // save that this is a Public Header, so we can log it correctly later
+		return h.writePublicHeader(b, pers, ver)
+	}
+	// write an IETF QUIC header
+	if h.IsLongHeader {
+		return h.writeLongHeader(b, ver)
+	}
+	return h.writeShortHeader(b, ver)
+}
+
+// TODO: add support for the key phase
+func (h *Header) writeLongHeader(b *bytes.Buffer, v protocol.VersionNumber) error {
+	b.WriteByte(byte(0x80 | h.Type))
+	utils.BigEndian.WriteUint32(b, uint32(h.Version))
+	connIDLen, err := encodeConnIDLen(h.DestConnectionID, h.SrcConnectionID)
+	if err != nil {
+		return err
+	}
+	b.WriteByte(connIDLen)
+	b.Write(h.DestConnectionID.Bytes())
+	b.Write(h.SrcConnectionID.Bytes())
+
+	if h.Type == protocol.PacketTypeInitial && v.UsesTokenInHeader() {
+		utils.WriteVarInt(b, uint64(len(h.Token)))
+		b.Write(h.Token)
+	}
+
+	if h.Type == protocol.PacketTypeRetry {
+		odcil, err := encodeSingleConnIDLen(h.OrigDestConnectionID)
+		if err != nil {
+			return err
+		}
+		// randomize the first 4 bits
+		odcilByte := make([]byte, 1)
+		_, _ = rand.Read(odcilByte) // it's safe to ignore the error here
+		odcilByte[0] = (odcilByte[0] & 0xf0) | odcil
+		b.Write(odcilByte)
+		b.Write(h.OrigDestConnectionID.Bytes())
+		b.Write(h.Token)
+		return nil
+	}
+
+	if v.UsesLengthInHeader() {
+		utils.WriteVarInt(b, uint64(h.PayloadLen))
+	}
+	if v.UsesVarintPacketNumbers() {
+		return utils.WriteVarIntPacketNumber(b, h.PacketNumber, h.PacketNumberLen)
+	}
+	utils.BigEndian.WriteUint32(b, uint32(h.PacketNumber))
+	if h.Type == protocol.PacketType0RTT && v == protocol.Version44 {
+		if len(h.DiversificationNonce) != 32 {
+			return errors.New("invalid diversification nonce length")
+		}
+		b.Write(h.DiversificationNonce)
+	}
+	return nil
+}
+
+func (h *Header) writeShortHeader(b *bytes.Buffer, v protocol.VersionNumber) error {
+	typeByte := byte(0x30)
+	typeByte |= byte(h.KeyPhase << 6)
+	if !v.UsesVarintPacketNumbers() {
+		switch h.PacketNumberLen {
+		case protocol.PacketNumberLen1:
+		case protocol.PacketNumberLen2:
+			typeByte |= 0x1
+		case protocol.PacketNumberLen4:
+			typeByte |= 0x2
+		default:
+			return errInvalidPacketNumberLen
+		}
+	}
+
+	b.WriteByte(typeByte)
+	b.Write(h.DestConnectionID.Bytes())
+
+	if !v.UsesVarintPacketNumbers() {
+		switch h.PacketNumberLen {
+		case protocol.PacketNumberLen1:
+			b.WriteByte(uint8(h.PacketNumber))
+		case protocol.PacketNumberLen2:
+			utils.BigEndian.WriteUint16(b, uint16(h.PacketNumber))
+		case protocol.PacketNumberLen4:
+			utils.BigEndian.WriteUint32(b, uint32(h.PacketNumber))
+		}
+		return nil
+	}
+	return utils.WriteVarIntPacketNumber(b, h.PacketNumber, h.PacketNumberLen)
+}
+
+// writePublicHeader writes a Public Header.
+func (h *Header) writePublicHeader(b *bytes.Buffer, pers protocol.Perspective, _ protocol.VersionNumber) error {
+	if h.ResetFlag || (h.VersionFlag && pers == protocol.PerspectiveServer) {
+		return errors.New("PublicHeader: Can only write regular packets")
+	}
+	if h.SrcConnectionID.Len() != 0 {
+		return errors.New("PublicHeader: SrcConnectionID must not be set")
+	}
+	if len(h.DestConnectionID) != 0 && len(h.DestConnectionID) != 8 {
+		return fmt.Errorf("PublicHeader: wrong length for Connection ID: %d (expected 8)", len(h.DestConnectionID))
+	}
+
+	publicFlagByte := uint8(0x00)
+	if h.VersionFlag {
+		publicFlagByte |= 0x01
+	}
+	if h.DestConnectionID.Len() > 0 {
+		publicFlagByte |= 0x08
+	}
+	if len(h.DiversificationNonce) > 0 {
+		if len(h.DiversificationNonce) != 32 {
+			return errors.New("invalid diversification nonce length")
+		}
+		publicFlagByte |= 0x04
+	}
+	switch h.PacketNumberLen {
+	case protocol.PacketNumberLen1:
+		publicFlagByte |= 0x00
+	case protocol.PacketNumberLen2:
+		publicFlagByte |= 0x10
+	case protocol.PacketNumberLen4:
+		publicFlagByte |= 0x20
+	}
+	b.WriteByte(publicFlagByte)
+
+	if h.DestConnectionID.Len() > 0 {
+		b.Write(h.DestConnectionID)
+	}
+	if h.VersionFlag && pers == protocol.PerspectiveClient {
+		utils.BigEndian.WriteUint32(b, uint32(h.Version))
+	}
+	if len(h.DiversificationNonce) > 0 {
+		b.Write(h.DiversificationNonce)
+	}
+
+	switch h.PacketNumberLen {
+	case protocol.PacketNumberLen1:
+		b.WriteByte(uint8(h.PacketNumber))
+	case protocol.PacketNumberLen2:
+		utils.BigEndian.WriteUint16(b, uint16(h.PacketNumber))
+	case protocol.PacketNumberLen4:
+		utils.BigEndian.WriteUint32(b, uint32(h.PacketNumber))
+	case protocol.PacketNumberLen6:
+		return errInvalidPacketNumberLen
+	default:
+		return errors.New("PublicHeader: PacketNumberLen not set")
+	}
+
+	return nil
+}
+
+// GetLength determines the length of the Header.
+func (h *Header) GetLength(v protocol.VersionNumber) (protocol.ByteCount, error) {
+	if !v.UsesIETFHeaderFormat() {
+		return h.getPublicHeaderLength()
+	}
+	return h.getHeaderLength(v)
+}
+
+func (h *Header) getHeaderLength(v protocol.VersionNumber) (protocol.ByteCount, error) {
+	if h.IsLongHeader {
+		length := 1 /* type byte */ + 4 /* version */ + 1 /* conn id len byte */ + protocol.ByteCount(h.DestConnectionID.Len()+h.SrcConnectionID.Len()) + protocol.ByteCount(h.PacketNumberLen)
+		if v.UsesLengthInHeader() {
+			length += utils.VarIntLen(uint64(h.PayloadLen))
+		}
+		if h.Type == protocol.PacketTypeInitial && v.UsesTokenInHeader() {
+			length += utils.VarIntLen(uint64(len(h.Token))) + protocol.ByteCount(len(h.Token))
+		}
+		if h.Type == protocol.PacketType0RTT && v == protocol.Version44 {
+			length += protocol.ByteCount(len(h.DiversificationNonce))
+		}
+		return length, nil
+	}
+
+	length := protocol.ByteCount(1 /* type byte */ + h.DestConnectionID.Len())
+	if h.PacketNumberLen != protocol.PacketNumberLen1 && h.PacketNumberLen != protocol.PacketNumberLen2 && h.PacketNumberLen != protocol.PacketNumberLen4 {
+		return 0, fmt.Errorf("invalid packet number length: %d", h.PacketNumberLen)
+	}
+	length += protocol.ByteCount(h.PacketNumberLen)
+	return length, nil
+}
+
+// getPublicHeaderLength gets the length of the publicHeader in bytes.
+// It can only be called for regular packets.
+func (h *Header) getPublicHeaderLength() (protocol.ByteCount, error) {
+	length := protocol.ByteCount(1) // 1 byte for public flags
+	if h.PacketNumberLen == protocol.PacketNumberLen6 {
+		return 0, errInvalidPacketNumberLen
+	}
+	if h.PacketNumberLen != protocol.PacketNumberLen1 && h.PacketNumberLen != protocol.PacketNumberLen2 && h.PacketNumberLen != protocol.PacketNumberLen4 {
+		return 0, errPacketNumberLenNotSet
+	}
+	length += protocol.ByteCount(h.PacketNumberLen)
+	length += protocol.ByteCount(h.DestConnectionID.Len())
+	// Version Number in packets sent by the client
+	if h.VersionFlag {
+		length += 4
+	}
+	length += protocol.ByteCount(len(h.DiversificationNonce))
+	return length, nil
+}
+
+// Log logs the Header
+func (h *Header) Log(logger utils.Logger) {
+	if h.IsPublicHeader {
+		h.logPublicHeader(logger)
+	} else {
+		h.logHeader(logger)
+	}
+}
+
+func (h *Header) logHeader(logger utils.Logger) {
+	if h.IsLongHeader {
+		if h.Version == 0 {
+			logger.Debugf("\tVersionNegotiationPacket{DestConnectionID: %s, SrcConnectionID: %s, SupportedVersions: %s}", h.DestConnectionID, h.SrcConnectionID, h.SupportedVersions)
+		} else {
+			var token string
+			if h.Type == protocol.PacketTypeInitial || h.Type == protocol.PacketTypeRetry {
+				if len(h.Token) == 0 {
+					token = "Token: (empty), "
+				} else {
+					token = fmt.Sprintf("Token: %#x, ", h.Token)
+				}
+			}
+			if h.Type == protocol.PacketTypeRetry {
+				logger.Debugf("\tLong Header{Type: %s, DestConnectionID: %s, SrcConnectionID: %s, %sOrigDestConnectionID: %s, Version: %s}", h.Type, h.DestConnectionID, h.SrcConnectionID, token, h.OrigDestConnectionID, h.Version)
+				return
+			}
+			if h.Version == protocol.Version44 {
+				var divNonce string
+				if h.Type == protocol.PacketType0RTT {
+					divNonce = fmt.Sprintf("Diversification Nonce: %#x, ", h.DiversificationNonce)
+				}
+				logger.Debugf("\tLong Header{Type: %s, DestConnectionID: %s, SrcConnectionID: %s, PacketNumber: %#x, PacketNumberLen: %d, %sVersion: %s}", h.Type, h.DestConnectionID, h.SrcConnectionID, h.PacketNumber, h.PacketNumberLen, divNonce, h.Version)
+				return
+			}
+			logger.Debugf("\tLong Header{Type: %s, DestConnectionID: %s, SrcConnectionID: %s, %sPacketNumber: %#x, PacketNumberLen: %d, PayloadLen: %d, Version: %s}", h.Type, h.DestConnectionID, h.SrcConnectionID, token, h.PacketNumber, h.PacketNumberLen, h.PayloadLen, h.Version)
+		}
+	} else {
+		logger.Debugf("\tShort Header{DestConnectionID: %s, PacketNumber: %#x, PacketNumberLen: %d, KeyPhase: %d}", h.DestConnectionID, h.PacketNumber, h.PacketNumberLen, h.KeyPhase)
+	}
+}
+
+func (h *Header) logPublicHeader(logger utils.Logger) {
+	ver := "(unset)"
+	if h.Version != 0 {
+		ver = h.Version.String()
+	}
+	logger.Debugf("\tPublic Header{ConnectionID: %s, PacketNumber: %#x, PacketNumberLen: %d, Version: %s, DiversificationNonce: %#v}", h.DestConnectionID, h.PacketNumber, h.PacketNumberLen, ver, h.DiversificationNonce)
+}
+
+func encodeConnIDLen(dest, src protocol.ConnectionID) (byte, error) {
+	dcil, err := encodeSingleConnIDLen(dest)
+	if err != nil {
+		return 0, err
+	}
+	scil, err := encodeSingleConnIDLen(src)
+	if err != nil {
+		return 0, err
+	}
+	return scil | dcil<<4, nil
+}
+
+func encodeSingleConnIDLen(id protocol.ConnectionID) (byte, error) {
+	len := id.Len()
+	if len == 0 {
+		return 0, nil
+	}
+	if len < 4 || len > 18 {
+		return 0, fmt.Errorf("invalid connection ID length: %d bytes", len)
+	}
+	return byte(len - 3), nil
+}
+
+func decodeConnIDLen(enc byte) (int /*dest conn id len*/, int /*src conn id len*/) {
+	return decodeSingleConnIDLen(enc >> 4), decodeSingleConnIDLen(enc & 0xf)
+}
+
+func decodeSingleConnIDLen(enc uint8) int {
+	if enc == 0 {
+		return 0
+	}
+	return int(enc) + 3
+}

vendor/github.com/lucas-clemente/quic-go/internal/wire/header_parser.go

@@ -0,0 +1,273 @@
+package wire
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+	"github.com/lucas-clemente/quic-go/internal/utils"
+	"github.com/lucas-clemente/quic-go/qerr"
+)
+
+// The InvariantHeader is the version independent part of the header
+type InvariantHeader struct {
+	IsLongHeader     bool
+	Version          protocol.VersionNumber
+	SrcConnectionID  protocol.ConnectionID
+	DestConnectionID protocol.ConnectionID
+
+	typeByte byte
+}
+
+// ParseInvariantHeader parses the version independent part of the header
+func ParseInvariantHeader(b *bytes.Reader, shortHeaderConnIDLen int) (*InvariantHeader, error) {
+	typeByte, err := b.ReadByte()
+	if err != nil {
+		return nil, err
+	}
+
+	h := &InvariantHeader{typeByte: typeByte}
+	h.IsLongHeader = typeByte&0x80 > 0
+
+	// If this is not a Long Header, it could either be a Public Header or a Short Header.
+	if !h.IsLongHeader {
+		// In the Public Header 0x8 is the Connection ID Flag.
+		// In the IETF Short Header:
+		// * 0x8 it is the gQUIC Demultiplexing bit, and always 0.
+		// * 0x20 and 0x10 are always 1.
+		var connIDLen int
+		if typeByte&0x8 > 0 { // Public Header containing a connection ID
+			connIDLen = 8
+		}
+		if typeByte&0x38 == 0x30 { // Short Header
+			connIDLen = shortHeaderConnIDLen
+		}
+		if connIDLen > 0 {
+			h.DestConnectionID, err = protocol.ReadConnectionID(b, connIDLen)
+			if err != nil {
+				return nil, err
+			}
+		}
+		return h, nil
+	}
+	// Long Header
+	v, err := utils.BigEndian.ReadUint32(b)
+	if err != nil {
+		return nil, err
+	}
+	h.Version = protocol.VersionNumber(v)
+	connIDLenByte, err := b.ReadByte()
+	if err != nil {
+		return nil, err
+	}
+	dcil, scil := decodeConnIDLen(connIDLenByte)
+	h.DestConnectionID, err = protocol.ReadConnectionID(b, dcil)
+	if err != nil {
+		return nil, err
+	}
+	h.SrcConnectionID, err = protocol.ReadConnectionID(b, scil)
+	if err != nil {
+		return nil, err
+	}
+	return h, nil
+}
+
+// Parse parses the version dependent part of the header
+func (iv *InvariantHeader) Parse(b *bytes.Reader, sentBy protocol.Perspective, ver protocol.VersionNumber) (*Header, error) {
+	if iv.IsLongHeader {
+		if iv.Version == 0 { // Version Negotiation Packet
+			return iv.parseVersionNegotiationPacket(b)
+		}
+		return iv.parseLongHeader(b, sentBy, ver)
+	}
+	// The Public Header never uses 6 byte packet numbers.
+	// Therefore, the third and fourth bit will never be 11.
+	// For the Short Header, the third and fourth bit are always 11.
+	if iv.typeByte&0x30 != 0x30 {
+		if sentBy == protocol.PerspectiveServer && iv.typeByte&0x1 > 0 {
+			return iv.parseVersionNegotiationPacket(b)
+		}
+		return iv.parsePublicHeader(b, sentBy, ver)
+	}
+	return iv.parseShortHeader(b, ver)
+}
+
+func (iv *InvariantHeader) toHeader() *Header {
+	return &Header{
+		IsLongHeader:     iv.IsLongHeader,
+		DestConnectionID: iv.DestConnectionID,
+		SrcConnectionID:  iv.SrcConnectionID,
+		Version:          iv.Version,
+	}
+}
+
+func (iv *InvariantHeader) parseVersionNegotiationPacket(b *bytes.Reader) (*Header, error) {
+	h := iv.toHeader()
+	h.VersionFlag = true
+	if b.Len() == 0 {
+		return nil, qerr.Error(qerr.InvalidVersionNegotiationPacket, "empty version list")
+	}
+	h.IsVersionNegotiation = true
+	h.SupportedVersions = make([]protocol.VersionNumber, b.Len()/4)
+	for i := 0; b.Len() > 0; i++ {
+		v, err := utils.BigEndian.ReadUint32(b)
+		if err != nil {
+			return nil, qerr.InvalidVersionNegotiationPacket
+		}
+		h.SupportedVersions[i] = protocol.VersionNumber(v)
+	}
+	return h, nil
+}
+
+func (iv *InvariantHeader) parseLongHeader(b *bytes.Reader, sentBy protocol.Perspective, v protocol.VersionNumber) (*Header, error) {
+	h := iv.toHeader()
+	h.Type = protocol.PacketType(iv.typeByte & 0x7f)
+
+	if h.Type != protocol.PacketTypeInitial && h.Type != protocol.PacketTypeRetry && h.Type != protocol.PacketType0RTT && h.Type != protocol.PacketTypeHandshake {
+		return nil, qerr.Error(qerr.InvalidPacketHeader, fmt.Sprintf("Received packet with invalid packet type: %d", h.Type))
+	}
+
+	if h.Type == protocol.PacketTypeRetry {
+		odcilByte, err := b.ReadByte()
+		if err != nil {
+			return nil, err
+		}
+		odcil := decodeSingleConnIDLen(odcilByte & 0xf)
+		h.OrigDestConnectionID, err = protocol.ReadConnectionID(b, odcil)
+		if err != nil {
+			return nil, err
+		}
+		h.Token = make([]byte, b.Len())
+		if _, err := io.ReadFull(b, h.Token); err != nil {
+			return nil, err
+		}
+		return h, nil
+	}
+
+	if h.Type == protocol.PacketTypeInitial && v.UsesTokenInHeader() {
+		tokenLen, err := utils.ReadVarInt(b)
+		if err != nil {
+			return nil, err
+		}
+		if tokenLen > uint64(b.Len()) {
+			return nil, io.EOF
+		}
+		h.Token = make([]byte, tokenLen)
+		if _, err := io.ReadFull(b, h.Token); err != nil {
+			return nil, err
+		}
+	}
+
+	if v.UsesLengthInHeader() {
+		pl, err := utils.ReadVarInt(b)
+		if err != nil {
+			return nil, err
+		}
+		h.PayloadLen = protocol.ByteCount(pl)
+	}
+	if v.UsesVarintPacketNumbers() {
+		pn, pnLen, err := utils.ReadVarIntPacketNumber(b)
+		if err != nil {
+			return nil, err
+		}
+		h.PacketNumber = pn
+		h.PacketNumberLen = pnLen
+	} else {
+		pn, err := utils.BigEndian.ReadUint32(b)
+		if err != nil {
+			return nil, err
+		}
+		h.PacketNumber = protocol.PacketNumber(pn)
+		h.PacketNumberLen = protocol.PacketNumberLen4
+	}
+	if h.Type == protocol.PacketType0RTT && v == protocol.Version44 && sentBy == protocol.PerspectiveServer {
+		h.DiversificationNonce = make([]byte, 32)
+		if _, err := io.ReadFull(b, h.DiversificationNonce); err != nil {
+			if err == io.ErrUnexpectedEOF {
+				return nil, io.EOF
+			}
+			return nil, err
+		}
+	}
+
+	return h, nil
+}
+
+func (iv *InvariantHeader) parseShortHeader(b *bytes.Reader, v protocol.VersionNumber) (*Header, error) {
+	h := iv.toHeader()
+	h.KeyPhase = int(iv.typeByte&0x40) >> 6
+
+	if v.UsesVarintPacketNumbers() {
+		pn, pnLen, err := utils.ReadVarIntPacketNumber(b)
+		if err != nil {
+			return nil, err
+		}
+		h.PacketNumber = pn
+		h.PacketNumberLen = pnLen
+	} else {
+		switch iv.typeByte & 0x3 {
+		case 0x0:
+			h.PacketNumberLen = protocol.PacketNumberLen1
+		case 0x1:
+			h.PacketNumberLen = protocol.PacketNumberLen2
+		case 0x2:
+			h.PacketNumberLen = protocol.PacketNumberLen4
+		default:
+			return nil, errInvalidPacketNumberLen
+		}
+		p, err := utils.BigEndian.ReadUintN(b, uint8(h.PacketNumberLen))
+		if err != nil {
+			return nil, err
+		}
+		h.PacketNumber = protocol.PacketNumber(p)
+	}
+	return h, nil
+}
+
+func (iv *InvariantHeader) parsePublicHeader(b *bytes.Reader, sentBy protocol.Perspective, ver protocol.VersionNumber) (*Header, error) {
+	h := iv.toHeader()
+	h.IsPublicHeader = true
+	h.ResetFlag = iv.typeByte&0x2 > 0
+	if h.ResetFlag {
+		return h, nil
+	}
+
+	h.VersionFlag = iv.typeByte&0x1 > 0
+	if h.VersionFlag && sentBy == protocol.PerspectiveClient {
+		v, err := utils.BigEndian.ReadUint32(b)
+		if err != nil {
+			return nil, err
+		}
+		h.Version = protocol.VersionNumber(v)
+	}
+
+	// Contrary to what the gQUIC wire spec says, the 0x4 bit only indicates the presence of the diversification nonce for packets sent by the server.
+	// It doesn't have any meaning when sent by the client.
+	if sentBy == protocol.PerspectiveServer && iv.typeByte&0x4 > 0 {
+		h.DiversificationNonce = make([]byte, 32)
+		if _, err := io.ReadFull(b, h.DiversificationNonce); err != nil {
+			if err == io.ErrUnexpectedEOF {
+				return nil, io.EOF
+			}
+			return nil, err
+		}
+	}
+
+	switch iv.typeByte & 0x30 {
+	case 0x00:
+		h.PacketNumberLen = protocol.PacketNumberLen1
+	case 0x10:
+		h.PacketNumberLen = protocol.PacketNumberLen2
+	case 0x20:
+		h.PacketNumberLen = protocol.PacketNumberLen4
+	}
+
+	pn, err := utils.BigEndian.ReadUintN(b, uint8(h.PacketNumberLen))
+	if err != nil {
+		return nil, err
+	}
+	h.PacketNumber = protocol.PacketNumber(pn)
+
+	return h, nil
+}

vendor/github.com/lucas-clemente/quic-go/internal/wire/log.go

@@ -0,0 +1,41 @@
+package wire
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/lucas-clemente/quic-go/internal/utils"
+)
+
+// LogFrame logs a frame, either sent or received
+func LogFrame(logger utils.Logger, frame Frame, sent bool) {
+	if !logger.Debug() {
+		return
+	}
+	dir := "<-"
+	if sent {
+		dir = "->"
+	}
+	switch f := frame.(type) {
+	case *StreamFrame:
+		logger.Debugf("\t%s &wire.StreamFrame{StreamID: %d, FinBit: %t, Offset: 0x%x, Data length: 0x%x, Offset + Data length: 0x%x}", dir, f.StreamID, f.FinBit, f.Offset, f.DataLen(), f.Offset+f.DataLen())
+	case *StopWaitingFrame:
+		if sent {
+			logger.Debugf("\t%s &wire.StopWaitingFrame{LeastUnacked: 0x%x, PacketNumberLen: 0x%x}", dir, f.LeastUnacked, f.PacketNumberLen)
+		} else {
+			logger.Debugf("\t%s &wire.StopWaitingFrame{LeastUnacked: 0x%x}", dir, f.LeastUnacked)
+		}
+	case *AckFrame:
+		if len(f.AckRanges) > 1 {
+			ackRanges := make([]string, len(f.AckRanges))
+			for i, r := range f.AckRanges {
+				ackRanges[i] = fmt.Sprintf("{Largest: %#x, Smallest: %#x}", r.Largest, r.Smallest)
+			}
+			logger.Debugf("\t%s &wire.AckFrame{LargestAcked: %#x, LowestAcked: %#x, AckRanges: {%s}, DelayTime: %s}", dir, f.LargestAcked(), f.LowestAcked(), strings.Join(ackRanges, ", "), f.DelayTime.String())
+		} else {
+			logger.Debugf("\t%s &wire.AckFrame{LargestAcked: %#x, LowestAcked: %#x, DelayTime: %s}", dir, f.LargestAcked(), f.LowestAcked(), f.DelayTime.String())
+		}
+	default:
+		logger.Debugf("\t%s %#v", dir, frame)
+	}
+}

vendor/github.com/lucas-clemente/quic-go/internal/wire/max_data_frame.go

@@ -0,0 +1,51 @@
+package wire
+
+import (
+	"bytes"
+
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+	"github.com/lucas-clemente/quic-go/internal/utils"
+)
+
+// A MaxDataFrame carries flow control information for the connection
+type MaxDataFrame struct {
+	ByteOffset protocol.ByteCount
+}
+
+// parseMaxDataFrame parses a MAX_DATA frame
+func parseMaxDataFrame(r *bytes.Reader, version protocol.VersionNumber) (*MaxDataFrame, error) {
+	// read the TypeByte
+	if _, err := r.ReadByte(); err != nil {
+		return nil, err
+	}
+
+	frame := &MaxDataFrame{}
+	byteOffset, err := utils.ReadVarInt(r)
+	if err != nil {
+		return nil, err
+	}
+	frame.ByteOffset = protocol.ByteCount(byteOffset)
+	return frame, nil
+}
+
+//Write writes a MAX_STREAM_DATA frame
+func (f *MaxDataFrame) Write(b *bytes.Buffer, version protocol.VersionNumber) error {
+	if !version.UsesIETFFrameFormat() {
+		// write a gQUIC WINDOW_UPDATE frame (with stream ID 0, which means connection-level there)
+		return (&windowUpdateFrame{
+			StreamID:   0,
+			ByteOffset: f.ByteOffset,
+		}).Write(b, version)
+	}
+	b.WriteByte(0x4)
+	utils.WriteVarInt(b, uint64(f.ByteOffset))
+	return nil
+}
+
+// Length of a written frame
+func (f *MaxDataFrame) Length(version protocol.VersionNumber) protocol.ByteCount {
+	if !version.UsesIETFFrameFormat() { // writing this frame would result in a gQUIC WINDOW_UPDATE being written, which is longer
+		return 1 + 4 + 8
+	}
+	return 1 + utils.VarIntLen(uint64(f.ByteOffset))
+}

vendor/github.com/lucas-clemente/quic-go/internal/wire/max_stream_data_frame.go

@@ -0,0 +1,60 @@
+package wire
+
+import (
+	"bytes"
+
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+	"github.com/lucas-clemente/quic-go/internal/utils"
+)
+
+// A MaxStreamDataFrame carries flow control information for a stream
+type MaxStreamDataFrame struct {
+	StreamID   protocol.StreamID
+	ByteOffset protocol.ByteCount
+}
+
+// parseMaxStreamDataFrame parses a MAX_STREAM_DATA frame
+func parseMaxStreamDataFrame(r *bytes.Reader, version protocol.VersionNumber) (*MaxStreamDataFrame, error) {
+	frame := &MaxStreamDataFrame{}
+
+	// read the TypeByte
+	if _, err := r.ReadByte(); err != nil {
+		return nil, err
+	}
+
+	sid, err := utils.ReadVarInt(r)
+	if err != nil {
+		return nil, err
+	}
+	frame.StreamID = protocol.StreamID(sid)
+
+	byteOffset, err := utils.ReadVarInt(r)
+	if err != nil {
+		return nil, err
+	}
+	frame.ByteOffset = protocol.ByteCount(byteOffset)
+	return frame, nil
+}
+
+// Write writes a MAX_STREAM_DATA frame
+func (f *MaxStreamDataFrame) Write(b *bytes.Buffer, version protocol.VersionNumber) error {
+	if !version.UsesIETFFrameFormat() {
+		return (&windowUpdateFrame{
+			StreamID:   f.StreamID,
+			ByteOffset: f.ByteOffset,
+		}).Write(b, version)
+	}
+	b.WriteByte(0x5)
+	utils.WriteVarInt(b, uint64(f.StreamID))
+	utils.WriteVarInt(b, uint64(f.ByteOffset))
+	return nil
+}
+
+// Length of a written frame
+func (f *MaxStreamDataFrame) Length(version protocol.VersionNumber) protocol.ByteCount {
+	// writing this frame would result in a gQUIC WINDOW_UPDATE being written, which has a different length
+	if !version.UsesIETFFrameFormat() {
+		return 1 + 4 + 8
+	}
+	return 1 + utils.VarIntLen(uint64(f.StreamID)) + utils.VarIntLen(uint64(f.ByteOffset))
+}

vendor/github.com/lucas-clemente/quic-go/internal/wire/max_stream_id_frame.go

@@ -0,0 +1,37 @@
+package wire
+
+import (
+	"bytes"
+
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+	"github.com/lucas-clemente/quic-go/internal/utils"
+)
+
+// A MaxStreamIDFrame is a MAX_STREAM_ID frame
+type MaxStreamIDFrame struct {
+	StreamID protocol.StreamID
+}
+
+// parseMaxStreamIDFrame parses a MAX_STREAM_ID frame
+func parseMaxStreamIDFrame(r *bytes.Reader, _ protocol.VersionNumber) (*MaxStreamIDFrame, error) {
+	// read the Type byte
+	if _, err := r.ReadByte(); err != nil {
+		return nil, err
+	}
+	streamID, err := utils.ReadVarInt(r)
+	if err != nil {
+		return nil, err
+	}
+	return &MaxStreamIDFrame{StreamID: protocol.StreamID(streamID)}, nil
+}
+
+func (f *MaxStreamIDFrame) Write(b *bytes.Buffer, _ protocol.VersionNumber) error {
+	b.WriteByte(0x6)
+	utils.WriteVarInt(b, uint64(f.StreamID))
+	return nil
+}
+
+// Length of a written frame
+func (f *MaxStreamIDFrame) Length(protocol.VersionNumber) protocol.ByteCount {
+	return 1 + utils.VarIntLen(uint64(f.StreamID))
+}

vendor/github.com/lucas-clemente/quic-go/internal/wire/path_challenge_frame.go

@@ -0,0 +1,39 @@
+package wire
+
+import (
+	"bytes"
+	"io"
+
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+)
+
+// A PathChallengeFrame is a PATH_CHALLENGE frame
+type PathChallengeFrame struct {
+	Data [8]byte
+}
+
+func parsePathChallengeFrame(r *bytes.Reader, version protocol.VersionNumber) (*PathChallengeFrame, error) {
+	if _, err := r.ReadByte(); err != nil {
+		return nil, err
+	}
+	frame := &PathChallengeFrame{}
+	if _, err := io.ReadFull(r, frame.Data[:]); err != nil {
+		if err == io.ErrUnexpectedEOF {
+			return nil, io.EOF
+		}
+		return nil, err
+	}
+	return frame, nil
+}
+
+func (f *PathChallengeFrame) Write(b *bytes.Buffer, _ protocol.VersionNumber) error {
+	typeByte := uint8(0x0e)
+	b.WriteByte(typeByte)
+	b.Write(f.Data[:])
+	return nil
+}
+
+// Length of a written frame
+func (f *PathChallengeFrame) Length(_ protocol.VersionNumber) protocol.ByteCount {
+	return 1 + 8
+}