v0.39.3

This patch contains two fixes:

• The tls.Config returned by GetConfigForClient is now cloned before quic-go modifies it: #4133
• The MinVersion on the tlsConfig returned by GetConfigForClient is not set to TLS 1.3, making sure that the TLS stack doesn't negotiate a TLS version older than 1.3: #4134

Full Changelog: v0.39.2...v0.39.3

v0.39.2

This patch release fixes the control message length for the ECN control message on Linux systems (#4127), which lead to sendmsg: invalid argument errors on some platforms.

v0.39.1

This patch release fixes the control message length for the ECN control message on FreeBSD systems (#4110), which lead to sendmsg: invalid argument errors.

v0.39.0

New Features

• quic-go now uses feeds ECN signals into its congestion controller (#4059). ECN is used by routers to signal congestion before queues overflow (and packets are dropped). When using ECN, there are a number of failure modes, which necessitates some rather complex validation logic, see section 13.4 of RFC 9000 for details. ECN support can be disabled by setting the QUIC_GO_DISABLE_ECN environment variable to true.
• The HTTP/3 package introduced a http3.Error, making the errors returned by the http3 package more useful, and allowing easy assertions of the HTTP/3 error codes defined in RFC 9114: #4039

Other Changes

• The key used to encrypt resumption tokens can now be configured using using Transport.TokenGeneratorKey: #4066
• The RTT is now saved in session tickets, even when not using 0-RTT, allowing for faster session resumption: #4042
• The reason for dial cancelations is now returned, when the context is canceled using a context.CancelCauseFunc: #4078

When using Go 1.21, make sure to build with (at least) Go 1.21.1, as this release fixes a remote-triggered panic in crypto/tls. See the release announcement for details.

Breaking Changes

• Config.DisableVersionNegotiationPackets was moved to the Transport: #4047
• Config.MaxTokenAge was moved to the Transport: #4084
• Config.MaxRetryTokenAge was removed. The age limit for Retry tokens is now set to twice the handshake timeout: #4064
• The handshake timeout is now set to twice the handshake idle timeout: #4063. For clients, it is recommend to limit the duration of the handshake by using setting the context on the Dial call.
• The logging.Tracer and logging.ConnectionTracer are now structs (not interfaces): #4082

Please support quic-go!

Is your project / company relying on quic-go? Please consider funding the project. Any support is highly appreciated!

Changelog

• ci: fix integration test running with and without GSO by @marten-seemann in #4043
• ci: fix syntax error in integration test workflow by @marten-seemann in #4048
• fix flaky version negotiation connection unit test by @marten-seemann in #4052
• switch from unmaintained golang/mock to go.uber.org/mock by @marten-seemann in #4050
• move the DisableVersionNegotiationPackets flag to the Transport by @marten-seemann in #4047
• move GSO control message handling to the oobConn by @marten-seemann in #4056
• integration tests: fix connection timeout in 0-RTT test by @tanghaowillow in #4060
• ackhandler: rename variables to follow RFC 9002 terminology by @marten-seemann in #4062
• ci: update GitHub checkout and setup-go actions to v4 by @marten-seemann in #4067
• update qtls-go1-20 to v0.3.4 by @marten-seemann in #4068
• remove TLS post-handshake message reassembly logic by @marten-seemann in #4073
• ackhandler: use the receive time of the Retry packet for RTT estimation by @marten-seemann in #4070
• set the handshake timeout to twice the handshake idle timeout by @marten-seemann in #4063
• remove Config.MaxRetryTokenAge, set it to the handshake timeout by @marten-seemann in #4064
• randomize the serialization order of control frames by @marten-seemann in #4069
• add ECN support by @marten-seemann in #4059
• save the RTT in non-0-RTT session tickets by @tanghaowillow in #4042
• remove duplicate mocks for the Tracer and the ConnectionTracer by @marten-seemann in #4076
• ackhandler: detect ECN mangling by @marten-seemann in #4080
• ci: clean up Codecov ignore list by @marten-seemann in #4081
• expose GSO usage through ConnectionState by @birneee in #4083
• add a Transport config option for the key used to encrypt tokens by @marten-seemann in #4066
• http09: increase the startup timeout in tests by @marten-seemann in #4071
• ci: fail if any Go files contain an ignore directive by @marten-seemann in #4055
• ci: combine the go generate workflow with the linting workflow by @marten-seemann in #4053
• integrate ClusterFuzzLite by @marten-seemann in #4034
• http3: introduce an HTTP/3 error type by @marten-seemann in #4039
• make the logging.Tracer and logging.ConnectionTracer a struct by @marten-seemann in #4082
• move MaxTokenAge configuration option to the Transport by @marten-seemann in #4084
• return the cancellation cause for cancelled dials by @marten-seemann in #4078
• remove unused unknownPacketHandler interface by @marten-seemann in #4093
• ackhandler: don't fail ECN validation if less than 10 testing packets are lost by @marten-seemann in #4088
• ackhandler: fix ECN mangling detection when packets are lost by @marten-seemann in #4089
• README: add Hysteria by @tobyxdd in #4085
• update gomock to v0.3.0 by @marten-seemann in #4087

Full Changelog: v0.38.1...v0.39.0

v0.38.1

What's Changed

• move QUIC_GO_DISABLE_GSO check out of init by @jfgiorgi in #4041
• update qtls to v0.3.3 by @marten-seemann in #4044
• remove the port from the hostname used for tls.Config.ServerName by @marten-seemann in #4046

Full Changelog: v0.38.0...v0.38.1

v0.38.0

Generic Segmentation Offload (GSO)

This release re-enables GSO by default. We shipped GSO support in v0.36.0 (see the release notes for that release for an explanation of what GSO is), but had to disable it due to problems in certain configurations and on certain platforms. We believe that we now manage to properly detect these and automatically fall back to the non-GSO code path (#4005). That said, there are a lot of different systems and configurations around, and kernel GSO support seems to be a bit brittle, so if you encounter any problems, please let us know in an issue.

Demultiplexing QUIC

The QUIC header is designed such that it can easily be demultiplexed from other common UDP-based protocols, such STUN, RTP, TURN, DTLS, etc. (see RFC 9443 for details). In this release, we added a Transport.ReadNonQUICPacket method (#3992) that allows the application to retrieve non-QUIC packets arriving on the underlying UDP socket. The existing Transport.WriteTo can be used to send (non-QUIC) packets.

Other Notable Changes

• Support for QUIC Datagrams (RFC 9221) is now saved in the session ticket and can be used when doing 0-RTT resumption: #4013
• crypto/tls errors are now returned on the TransportError and can be obtained using error assertions: #4015
• The code point for HTTP datagrams (RFC 9297) was changed from the value used for draft versions to the value used in the RFC: #3588
• For small HTTP responses, the Content-Length header is automatically added: #3989

Changelog

• check transport parameters after 0-RTT resumption by @tanghaowillow in #3985
• update qtls to restrict RSA keys in certificates to <= 8192 bits by @marten-seemann in #4012
• set a net.Conn for tls.ClientHelloInfo.Conn used by GetCertificate by @marten-seemann in #4014
• add error handling when confirming handshake on HANDSHAKE_DONE frames by @marten-seemann in #4017
• add tls.ClientHelloInfo.Conn for recursive GetConfigForClient calls by @marten-seemann in #4016
• fix compatibility with API breaking change in Go 1.21 by @elagergren-spideroak in #4020
• README: fix invocation of Go routine in example by @gokpm in #4019
• http3: change code point for HTTP datagrams to RFC 9297 by @kokes in #3588
• integrationtests: fix proxy test on Windows by @egonelbre in #4023
• http3: remove leftover ALPN constant for draft-29 by @marten-seemann in #4027
• ignore QUICConn.SendSessionTicket error if session tickets are disabled by @marten-seemann in #4030
• handshake: use the correct hash function for TLS_AES_256_GCM_SHA384 by @marten-seemann in #4031
• add OSS-Fuzz badge to README by @marten-seemann in #3942
• store the server port as an int, not a string, in HTTP tests by @marten-seemann in #3959
• automatically set the tls.Config.ServerName if unset by @marten-seemann in #4032
• handshake fuzzer: fix TLS handshake sequence by @marten-seemann in #4033
• ci: also run integration tests on Windows and macOS by @marten-seemann in #3987
• handshake fuzzer: fix setting of cipher suites by @marten-seemann in #4037
• enable GSO, disable if sending fails for a particular address by @marten-seemann in #4005
• expose crypto/tls errors on the TransportError by @marten-seemann in #4015
• reassemble post-handshake TLS messages before passing them to crypto/tls by @marten-seemann in #4038
• protocol: add string representation for ECN values by @marten-seemann in #4008
• save the max_datagram_frame_size transport parameter in the session ticket by @tanghaowillow in #4013
• add a method to retrieve non-QUIC packets from the Transport by @marten-seemann in #3992
• ci: build interop Docker image for pushes to master, and for releases by @marten-seemann in #4035
• wire: always set the QUIC bit for Version Negotiation packets by @marten-seemann in #3991
• http3: automatically add content-length for small responses by @WeidiDeng in #3989

New Contributors

• @tanghaowillow made their first contribution in #3985
• @elagergren-spideroak made their first contribution in #4020
• @gokpm made their first contribution in #4019
• @kokes made their first contribution in #3588

Full Changelog: v0.37.1...v0.38.0

v0.37.6

This patch release contains a backport of #4038.

Full Changelog: v0.37.5...v0.37.6

v0.37.5

This patch release contains the backport of 3 fixes:

• fix handshake failure if tls.Config.SessionTicketDisabled = false, but tls.Config.GetConfigForClient returns a config that disables session tickets: #4030
• use the correct hash function for TLS_AES_256_GCM_SHA384: #4031
• automatically set the tls.Config.ServerName: #4032

Full Changelog: v0.37.4...v0.37.5

v0.37.4

This release contains a fix for a last-minute breaking API change in Go 1.21: #4020

Full Changelog: v0.37.3...v0.37.4

v0.37.3

This patch release

• fixes handling of ACK frames serialized after CRYPTO frames: #4018
• sets a net.Conn on the tls.ClientHelloInfo used on GetCertificate and GetConfigForClient, for tls.Configs returned (recursively) from GetConfigForClient: #4016

Full Changelog: v0.37.2...v0.37.3