wired_srvboot_id Struct Reference

The fixed server identity a bootstrap needs: the X25519 handshake key pair, the ECDSA P-256 signing scalar the server builds its end-entity certificate from, the server's source connection id (written in every reply), and the ServerHello random. More...

#include <srvboot.h>

Data Fields
const u8 *	priv
	X25519 private, 32 bytes.
const u8 *	pub
	X25519 public, 32 bytes.
const u8 *	cert_seed
	ECDSA P-256 signing scalar, 32 bytes.
const u8 *	scid
	server source connection id
u8	scid_len
	scid length in octets, at most 20
const u8 *	random
	ServerHello.random, 32 bytes.
const quic_span *	chain
	optional: external chain, leaf first
usz	chain_count
	entries in chain; 0 = self-signed
u64	max_data
	advertised initial_max_data; 0 = default
u64	max_streams_bidi
	advertised initial_max_streams_bidi; 0 = default
u64	max_datagram_frame_size
	advertised max_datagram_frame_size (RFC 9221 3); 0 = not advertised (no default – opt in once DATAGRAM delivery is wired end-to-end)
const u8 *	san_ipv4
	RFC 5280 4.2.1.6: 4-byte IPv4 address (network byte order) added to the self-signed certificate's Subject Alternative Name as an iPAddress entry, alongside the fixed dNSName=localhost – a browser validating a WebTransport connection to a bare IP literal checks this entry (RFC 9110 4.3.5), not just the serverCertificateHashes-pinned hash.
u64	now_secs
	RFC 5280 4.1.2.5.1: UNIX epoch seconds the self-signed certificate's validity window is anchored to (notBefore = now_secs, notAfter = now_secs + 14 days – the W3C WebTransport spec's serverCertificateHashes pinning rejects any cert whose validity window exceeds 14 days).
const u8 *	retry_odcid
	RFC 9000 7.3 after a Retry: the true original DCID (recovered from the validated Retry token) to advertise as original_destination_connection_id; when set, the accepted Initial's own header DCID (the Retry's SCID) is advertised as retry_source_connection_id.
u8	retry_odcid_len
	Bytes at retry_odcid; 0 = no Retry preceded this accept.
const u8 *	ticket_key
	RFC 8446 4.6.1: this server's session-ticket encryption key (QUIC_TICKET_KEY_LEN bytes, tls/keys/ticket/ticket.h), or 0 to disable session resumption – threaded straight to wired_server_init_in.ticket_key, see its doc.

Detailed Description

The fixed server identity a bootstrap needs: the X25519 handshake key pair, the ECDSA P-256 signing scalar the server builds its end-entity certificate from, the server's source connection id (written in every reply), and the ServerHello random.

chain/chain_count, when non-empty, are an externally issued certificate chain (leaf first) to send instead of a self-signed certificate. All views; the caller keeps them alive for the call.

Field Documentation

now_secs

u64 wired_srvboot_id::now_secs

RFC 5280 4.1.2.5.1: UNIX epoch seconds the self-signed certificate's validity window is anchored to (notBefore = now_secs, notAfter = now_secs + 14 days – the W3C WebTransport spec's serverCertificateHashes pinning rejects any cert whose validity window exceeds 14 days).

Pass quic_clock_epoch_secs() for a real deployment; 0 keeps a fixed 2020-2030 window (tests only – that window is far outside 14 days and will fail serverCertificateHashes validation in a browser). Ignored when chain_count > 0.

retry_odcid

const u8* wired_srvboot_id::retry_odcid

RFC 9000 7.3 after a Retry: the true original DCID (recovered from the validated Retry token) to advertise as original_destination_connection_id; when set, the accepted Initial's own header DCID (the Retry's SCID) is advertised as retry_source_connection_id.

0/0 on the normal no-Retry path.

san_ipv4

const u8* wired_srvboot_id::san_ipv4

RFC 5280 4.2.1.6: 4-byte IPv4 address (network byte order) added to the self-signed certificate's Subject Alternative Name as an iPAddress entry, alongside the fixed dNSName=localhost – a browser validating a WebTransport connection to a bare IP literal checks this entry (RFC 9110 4.3.5), not just the serverCertificateHashes-pinned hash.

0 to omit (dNSName=localhost only, the pre-existing behavior). Ignored when chain_count > 0 (an external chain's own SAN is used as-is).

---

The documentation for this struct was generated from the following file:

• app/http3/server/srvboot/srvboot.h