Skip to content

Releases: quic-go/quic-go

v0.49.0

23 Jan 12:51
@marten-seemann marten-seemann
v0.49.0
c385cd1
This commit was created on github.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.49.0 Latest
Latest

In this release, we added support for HTTP client traces. We also fixed a large number of bugs that could lead to connection stalls, deadlocks and memory leaks. See the "Major Fixes" section for more details.

New Features

  • http3: add support for client traces net/http/httptrace.ClientTrace: #4749. Thanks to @lRoccoon for the contribution!

Major Fixes

  • fix accounting for lost RESET_STREAM frames in the stream, leading to potential connection stalls / deadlocks: #4804. Thanks to @Wondertan for reporting and testing the fix!
  • fix memory leak when the connection ID is rotated when the CONNECTION_CLOSE packet is sent: #4852. Thanks to @MarcoPolo for debugging this issue and contributing a fix!
  • http3: fix QUIC connection re-dialing logic: #4854, #4875, #4879
  • trigger sending of a new packet when a MAX_DATA frame (connection-level flow control update) is queued: #4844
  • Transport.Close was reworked: calls to Transport.Dial are now canceled, and return the newly introduced ErrTransportClosed, as do calls to Transport.Listen: #4883

Enhancements

  • trace dropping of packets by the Transport when no server is set: #4789
  • trace dropping of packets that the Transport doesn't send a stateless for: #4826
  • drain received packets when the connection is closed: #4773
  • add Prometheus metrics for sent and received packets: #4910
  • reduce calls to time.Now all over the code base: #4731, #4885, #4886, #4906
  • packetize DATA_BLOCKED frames in the same QUIC packet that caused us to block on connection-level flow control: #4845
  • packetize STREAM_DATA_BLOCKED frames in the same QUIC packed that caused us to block on stream-level flow control: #4801
  • we now don't enforce that only one Transport listens on any given net.PacketConn: #4851

Other Fixes

  • drain the server's connection accept queue before returning ErrClosed from Accept: #4846. Thanks to @sukunrt for discovering this bug and providing very helpful reviews!
  • preserve the error returned from SendStream.Write if it is closed after is canceled: #4882
  • fix race condition on concurrent calls to Transport.Dial and Transport.Close: #4904
  • qlog: fix logging of packet_in_flight on the metrics_updated event: #4895
  • fix errors.Is error comparisons: #4824, #4825, #4877
  • http3: fix race condition on concurrent calls to http.Response.Body.Close: #4798. Thanks to @RPRX for the contribution!
  • flowcontrol: reset the connection send window on 0-RTT rejection: #4764
  • wait for connection to shut down when the Dial context is cancelled: #4872
  • http3: the http.Request.Body is now properly closed on all code paths that return a non-nil error: #4874
  • NEW_CONNECTION_ID frames are now rejected when zero-length connection IDs are used, as required by the RFC: #4878
  • the stream ID of STREAM_DATA_BLOCKED frames is now validated, as required by the RFC: #4836
  • fix ECN markings of packets sent in GSO batches when the marking changes: #4835
  • the AEAD used to calculate the Retry Integrity Tag is now created lazily, avoiding a panic on initialization when using Go 1.24 FIPS-only mode: #4916
  • use a 24h maximum token age as default value for Transport.MaxTokenAge: #4763

Behind the Scenes

In the v0.48.0 release, we started migrating our test suite away from Ginkgo (tracking issue: #3652). This is an absolutely massive endeavor. Before we started, the number of LOC of Ginkgo tests was more than 41,000.

In this release, we're bringing this number down to less than 8,500 LOC: #4736, #4746, #4775, #4783, #4788, #4790, #4795, #4796, #4797, #4799, #4814, #4816, #4817, #4823, #4837, #4842, #4847, #4848, #4849, #4853, #4857, #4860, #4861, #4862, #4863, #4864, #4865, #4869, #4876, #4881, #4907.

There's still a lot of work ahead, but we'll hopefully be able to finish this item in the next couple of months.

Changelog

Read more

Contributors

juliens, markphelps, and 8 other contributors
Assets 2
Loading

v0.48.2

26 Nov 04:27
@marten-seemann marten-seemann
v0.48.2
34157e6
This commit was signed with the committer’s verified signature.
marten-seemann Marten Seemann
SSH Key Fingerprint: Hr7BysSpOIV7uTGBXM62NrKjq2jDqs4d5JubCZYaj6M
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.48.2

This patch release contains fixes for three bugs, including a patch for CVE-2024-53259 (details).

Changelog

Full Changelog: v0.48.1...v0.48.2

Contributors

glycerine and marten-seemann
Assets 2
Loading

v0.48.1

22 Oct 05:38
@marten-seemann marten-seemann
v0.48.1
98de6ae
This commit was created on github.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.48.1

This patch releases fixes a panic in the shutdown logic of the http3.Server that was introduced in v0.48.0. Thanks to @WeidiDeng for the fix!

Changelog

Full Changelog: v0.48.0...v0.48.1

Contributors

WeidiDeng
Assets 2
Loading

v0.48.0

15 Oct 09:26
@marten-seemann marten-seemann
v0.48.0
6af2b1a
This commit was created on github.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.48.0

New Features

The http3.Server now supports graceful shutdown: calling Shutdown stops the server from accepting new connections, and new HTTP requests on existing connections. It continues serving existing connections until all active requests have completed (or the context is canceled).

On the wire, graceful shutdown is signaled by sending a GOAWAY frame. This tells the client that the server will not accept any new requests. Clients are expected to finish existing requests and then close the QUIC connection.

Client-side support for graceful shutdown is not implemented yet (see #153).

Breaking Changes

  • The HTTP/3 client API was made more consistent with the Go standard library's HTTP/1 and HTTP/2 naming: #4693
  • The deprecated qlog.DefaultTracer function was removed: #4697
  • The deprecated http3.Server.SetQuicHeader method and http3.ListenAndServe were removed: #4698
  • http3.Server.Close now closes immediately all QUIC connections: #4689

Note that all connection passed to http3.Server.ServeQUICConn need to be closed by the caller, before calling http3.Server.Close.

Notable Fixes

  • Canceling a stream after connection termination now doesn't change the error returned from Stream.Write and Stream.Read (thanks to @sukunrt for the fix): #4673
  • HTTP/3 Capsule Parsing logic didn't work for capsules that weren't read with a single Read call: #4683

Behind The Scenes

We've started migrating our test suite away from Ginkgo (tracking issue: #3652), and towards a more idiomatic approach to testing Go code (using require). This is a massive endeavour, as our test suite is around 41k LOC.

In this release, a large number of Go packages were translated: #4640, #4641, #4642, #4643, #4649, #4650, #4652, #4662, #4670, #4671, #4675, #4667, #4676, #4680, #4681.

In the upcoming release(s), we will continue this work.

Changelog

Full Changelog: v0.47.0...v0.48.0

Contributors

marten-seemann, sukunrt, and WeidiDeng
Assets 2
Loading

v0.47.0

08 Sep 11:14
@marten-seemann marten-seemann
v0.47.0
8fc04bf
This commit was created on github.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.47.0

New Features

This release adds support for HTTP/3 Trailers, for both the server and the client side (#4581, #4630, #4656, #4639). Trailers work exactly the same way as for HTTP/1.1 and HTTP/2.

A big thank you to @sudorandom for contributing this feature!

Fixes

  • idle timeout calculation when the peer sends a max_idle_timeout of 0 (or omits the transport parameter): #4666
  • fix handling of corrupted coalesced 1-RTT packets: #4663
  • qpack: don't reject literal field lines with name references if N bit is set to 1: quic-go/qpack#52
  • http3: correctly set the http.Response.ContentLength on responses that don't set the Content-Length header: #4645
  • http3: reject connection-specific header fields (Connection, Keep-Alive, Proxy-Connection, Transfer-Encoding, Upgrade and TE != "trailers"): #4646, #4655

Breaking Changes

  • quic.VersionNumber and logging.VersionNumber were removed: #4627

Heads-Up

@sukunrt recently discovered and reported a race condition in the new time.Timer stopping logic introduced in Go 1.23. This manifests as a connection deadlock in quic-go. See #4659 and golang/go#69312 for more details. The new behavior is enabled when compiling with Go 1.23.x, and when the Go version in go.mod is set to Go 1.23.x.

Until this issue is fixed, it is recommended to either use Go 1.22.x, or to use GODEBUG="asynctimerchan=1" when compiling quic-go.

Update (Oct 1st 2024)

The Go project backported the fix (golang/go#69333) to the 1.23 branch, and released it in Go 1.23.2. This resolves above-mentioned issue. quic-go can now be built with Go 1.23.2, without the need to set any GODEBUG flags.

Changelog

New Contributors

Full Changelog: v0.46.0...v0.47.0

Contributors

sudorandom, marten-seemann, and sukunrt
Assets 2
Loading

v0.46.0

07 Aug 00:42
@marten-seemann marten-seemann
v0.46.0
0b033db
This commit was created on github.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.46.0

New Features

  • The http3.Server now has an IdleTimeout field: #4587. It works analogous to its HTTP/2 standard library equivalent: If no requests are received for the idle timeout period, the underlying QUIC connection is closed. Thanks to @rs for implementing.
  • The qlog file format was updated to the current qlog draft, which now uses JSON sequences (JSON-SEQ): #4609. qlog files now have the file extension .sqlog.

Breaking Changes

  • logging.VersionNumber was renamed to logging.Version (#4621), mirroring a similar renaming of quic.VersionNumber to quic.Version introduced in an earlier release
  • internal_error TLS alerts are now sent as QUIC CRYPTO_ERRORs (and not INTERNAL_ERRORs): #4601

Other Notable Changes

The stream logic for queueing stream-related control frames (RESET_STREAM, STOP_SENDING, MAX_STREAM_DATA, STREAM_DATA_BLOCKED) was completely rewritten. This makes quic-go more resilient to memory exhaustion attacks similar to those that we've seen earlier this year (1 and 2). It also enables further frame packing optimizations in the future.

Changelog

Full Changelog: v0.45.0...v0.46.0

Contributors

rs, marten-seemann, and 3 other contributors
Assets 2
Loading

v0.45.2

01 Aug 20:48
@marten-seemann marten-seemann
v0.45.2
4470c16
This commit was signed with the committer’s verified signature.
marten-seemann Marten Seemann
SSH Key Fingerprint: Hr7BysSpOIV7uTGBXM62NrKjq2jDqs4d5JubCZYaj6M
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.45.2

This patch release fixes a bug in the stream state machine, which could lead to streams not being properly marked completed: #4605.

Thanks to @sukunrt for discovering and fixing this bug.

Contributors

sukunrt
Assets 2
Loading

v0.45.1

23 Jun 04:59
@marten-seemann marten-seemann
v0.45.1
93c9427
Compare
Choose a tag to compare
v0.45.1

This patch release contains two fixes:

  • The new Prometheus metrics DefaultConnectionTracer was implemented incorrectly, leading to incorrect metrics being collected: #4560
  • The http3.RoundTripper was caching the dial error (#4561). Instead, we should re-dial the QUIC connection: #4573

Full Changelog: v0.45.0...v0.45.1

Assets 2
Loading

v0.45.0

06 Jun 09:31
@marten-seemann marten-seemann
v0.45.0
4d0562d
This commit was created on github.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.45.0

New Features

Prometheus

quic-go now exports a few Prometheus metrics, allowing users to get an aggregate picture of what's going on inside their QUIC stack. Currently, only a basic set of metrics is exposed, but we plan to track more metrics in the future (#4554). Head to the documentation to learn how to enable metrics collection.

Prometheus metrics can be used (among others) to build Grafana dashboards, and we provide a sample Grafana dashboard in metrics/dashboard.

Tracing Handshake Progression using a custom context.Context

Users can now set and modify the context that's used on all callbacks called during the handshake, and returned from Connection.Context (#4507 and #4536). This allows identifying the connection as it progresses through the different handshake stages. The documentation has more details and code samples.

Better Path MTU Discovery

Path MTU Discovery is used to automatically determine the available MTU of the path, which allows us to send full-size packets. This is especially relevant for high-bandwidth transfers.

Our old PMTUD algorithm was susceptible to packet loss, leading to suboptimal results if an MTU probe packet experienced packet loss in the network. The new algorithm (#4545) is now resilient to the consecutive loss of up to two probe packets.

Breaking Changes

  • Connection.NextConnection now takes a context and correctly handles handshake failures (#4551)
  • qlog: DefaultTracer was renamed to DefaultConnectionTracer (#4556)
  • The ConnectionTracingKey is now deprecated. Use Transport.ConnContext to set your own tracing key (#4532)

Fixes

  • The server now correctly restores its QUIC transport parameters when resuming 0-RTT using a tls.Config that sets GetConfigForClient: (#4550)

Changelog

Full Changelog: v0.44.0...v0.45.0

Contributors

marten-seemann
Assets 2
Loading

v0.44.0

19 May 03:00
@marten-seemann marten-seemann
v0.44.0
e2fbf3c
This commit was created on github.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
v0.44.0

v0.44 contains a lot of fixes related to HTTP Datagrams, new logic to determine (and configure) the QUIC packet size, as well as a significant speedup of the various parsers.

HTTP Datagram-related Fixes

The last release introduced support for HTTP Datagrams (RFC 9297). This release resolves a number of problems we discovered in the initial implementation:

  • reject sending of DATAGRAM frames that exceed the currently available MTU (#4497)
  • http3: deadline errors are now ignored in stream state tracking (#4495)
  • http3: refuse to send HTTP datagrams associated with a closed stream (#4488)
  • http3: use the send stream context for tracking the stream state (#4489)
  • http3: fix memory leak caused by stream state tracking (#4523). Thanks to @GeorgeMac for debugging and fixing!

QUIC Packet Size and Path MTU Discovery

  • The initial packet size is now configurable via quic.Config. Most users should not use this config option, but instead rely on Path MTU discovery (#4503)
  • The client's initial packet size was increased to 1280 bytes (#4500)
  • Respect the client's max_udp_payload_size transport parameter (#4514)
  • qlog: add support for the mtu_updated event (#4517)

Speeding up Parsing the variable-length Integers

The QUIC varint parser was rewritten to act on byte slices instead of a bytes.Reader. This is significantly faster (#4475). The new parser is now used for parsing QUIC frames (#4484), the QUIC packet header (#4481), the QUIC transport parameters (#4483) and HTTP datagrams (#4478).

Other Notable Changes

  • http3: ParseCapsule now returns an io.EOF (and not an io.UnexpectedEOF) if the underlying reader returns an io.EOF on the first byte (#4476)
  • http3: ListenAndServe was renamed to ListenAndServeTLS (#4522). Thanks to @ETZhangSX!
  • http3: reserved frame types now cause a connection error, as required by the RFC (#4467)
  • http3: pass the correct Connection to the ConnContext callback (#4480). Thanks to @rthellend!

quic-go needs your support!

Is your project / company relying on quic-go?
Please consider funding the project. Any support is highly appreciated!

What's Changed

New Contributors

Full Changelog: v0.43.0...v0.44.0

Contributors

GeorgeMac, marten-seemann, and 3 other contributors
Assets 2
Loading