- Generated by
1.16.1
|
wired
libc-free QUIC/HTTP3 SDK in C for x86_64-linux
|
The fixed server identity a bootstrap needs: the X25519 handshake key pair, the ECDSA P-256 signing scalar the server builds its end-entity certificate from, the server's source connection id (written in every reply), and the ServerHello random. More...
#include <srvboot.h>
Data Fields | |
| const u8 * | priv |
| X25519 private, 32 bytes. | |
| const u8 * | pub |
| X25519 public, 32 bytes. | |
| const u8 * | cert_seed |
| ECDSA P-256 signing scalar, 32 bytes. | |
| const u8 * | scid |
| server source connection id | |
| u8 | scid_len |
| scid length in octets, at most 20 | |
| const u8 * | random |
| ServerHello.random, 32 bytes. | |
| const wired_span * | chain |
| optional: external chain, leaf first | |
| usz | chain_count |
| entries in chain; 0 = self-signed | |
| u64 | max_data |
| advertised initial_max_data; 0 = default | |
| u64 | max_streams_bidi |
| advertised initial_max_streams_bidi; 0 = default | |
| u64 | max_datagram_frame_size |
| advertised max_datagram_frame_size (RFC 9221 3); 0 = not advertised (no default – opt in once DATAGRAM delivery is wired end-to-end) | |
| const u8 * | san_ipv4 |
| RFC 5280 4.2.1.6: 4-byte IPv4 address (network byte order) added to the self-signed certificate's Subject Alternative Name as an iPAddress entry, alongside the fixed dNSName=localhost – a browser validating a WebTransport connection to a bare IP literal checks this entry (RFC 9110 4.3.5), not just the serverCertificateHashes-pinned hash. | |
| u64 | now_secs |
| RFC 5280 4.1.2.5.1: UNIX epoch seconds the self-signed certificate's validity window is anchored to (notBefore = now_secs, notAfter = now_secs + 14 days – the W3C WebTransport spec's serverCertificateHashes pinning rejects any cert whose validity window exceeds 14 days). | |
| const u8 * | retry_odcid |
| RFC 9000 7.3 after a Retry: the true original DCID (recovered from the validated Retry token) to advertise as original_destination_connection_id; when set, the accepted Initial's own header DCID (the Retry's SCID) is advertised as retry_source_connection_id. | |
| u8 | retry_odcid_len |
| Bytes at retry_odcid; 0 = no Retry preceded this accept. | |
| const u8 * | ticket_key |
| RFC 8446 4.6.1: this server's session-ticket key seed (TICKET_KEY_LEN bytes), or 0 to disable session resumption. | |
| const u8 * | pref_v4 |
| RFC 9000 9.6: the preferred_address this server advertises – both addresses in network byte order, ports in host byte order. | |
| const u8 * | pref_v6 |
| 16 bytes; required when pref_v4 is set | |
| u16 | pref_v4_port |
| port of pref_v4 | |
| u16 | pref_v6_port |
| port of pref_v6 | |
| const char * | raw_alpns |
| RFC 7301 3.2 / draft-ietf-moq-transport-22 6.1.2: raw-QUIC application ALPN ids this server also selects, space-separated in no particular order (e.g. | |
The fixed server identity a bootstrap needs: the X25519 handshake key pair, the ECDSA P-256 signing scalar the server builds its end-entity certificate from, the server's source connection id (written in every reply), and the ServerHello random.
chain/chain_count, when non-empty, are an externally issued certificate chain (leaf first) to send instead of a self-signed certificate. All views; the caller keeps them alive for the call.
| u64 wired_srvboot_id::now_secs |
RFC 5280 4.1.2.5.1: UNIX epoch seconds the self-signed certificate's validity window is anchored to (notBefore = now_secs, notAfter = now_secs + 14 days – the W3C WebTransport spec's serverCertificateHashes pinning rejects any cert whose validity window exceeds 14 days).
Pass wired_clock_epoch_secs() for a real deployment; 0 keeps a fixed 2020-2030 window (tests only – that window is far outside 14 days and will fail serverCertificateHashes validation in a browser). Ignored when chain_count > 0.
| const u8* wired_srvboot_id::pref_v4 |
RFC 9000 9.6: the preferred_address this server advertises – both addresses in network byte order, ports in host byte order.
pref_v4 == 0 disables the parameter (the default). The migration CID and its token come from the connection's own spare CID (issued by the runner), not from here. 4 bytes, or 0 for no preferred_address
| const char* wired_srvboot_id::raw_alpns |
RFC 7301 3.2 / draft-ietf-moq-transport-22 6.1.2: raw-QUIC application ALPN ids this server also selects, space-separated in no particular order (e.g.
"moqt-22 moqt-19 moqt-18"), or 0 to select only h3 and hq-interop (the default). The client's preference order decides between these and h3, so one port serves WebTransport and native QUIC. Must name neither h3 nor hq-interop. A static string: the negotiated id is kept as a view into it for the connection's lifetime.
| const u8* wired_srvboot_id::retry_odcid |
RFC 9000 7.3 after a Retry: the true original DCID (recovered from the validated Retry token) to advertise as original_destination_connection_id; when set, the accepted Initial's own header DCID (the Retry's SCID) is advertised as retry_source_connection_id.
0/0 on the normal no-Retry path.
| const u8* wired_srvboot_id::san_ipv4 |
RFC 5280 4.2.1.6: 4-byte IPv4 address (network byte order) added to the self-signed certificate's Subject Alternative Name as an iPAddress entry, alongside the fixed dNSName=localhost – a browser validating a WebTransport connection to a bare IP literal checks this entry (RFC 9110 4.3.5), not just the serverCertificateHashes-pinned hash.
0 to omit (dNSName=localhost only, the pre-existing behavior). Ignored when chain_count > 0 (an external chain's own SAN is used as-is).
| const u8* wired_srvboot_id::ticket_key |
RFC 8446 4.6.1: this server's session-ticket key seed (TICKET_KEY_LEN bytes), or 0 to disable session resumption.
The per-epoch ticket keys derive from it (tls/keys/keyring/keyring.h): the current epoch's key reaches wired_server_init_in.ticket_key and the previous epoch's sdrv_set_ticket_key_prev.
1.16.1