quic: reuse TLS pause machinery to drop event deferral & improve 0RTT

With this change, the TLS pause mechanisms used in node:tls are now made
generic, and used in QUIC to pause the handshake entirely for the
session event, thereby stopping almost all events being emitted
(everything except qlog) so that all the previously existing deferral
machinery is unnecessary.

This is useful immediately to clean up & simplify things, but also
medium term because this makes the 0RTT flow significantly clearer,
which will help with the upcoming dynamic attach for QUIC (which
requires deferring ticket processing & 0RTT delivery until after
user code).

As part of this, this changes the internal flow of how ALPN & SNI are
resolved. Instead of calculating them synchronously within the OpenSSL
callbacks, we precalculate them at the pause, and then the OpenSSL
callbacks just return the precalculated values.

This is intended to only create visible changes to node:quic. Though it
touches node:tls, it preserves all existing behaviour (including
callback order and other details).

Signed-off-by: Tim Perry <pimterry@gmail.com>
PR-URL: #65522
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>

Author: pimterry

benchmark/quic/h3-request.js

@@ -0,0 +1,150 @@
+'use strict';
+
+// Measures a complete HTTP/3 exchange: establish a session, send one request
+// and read the whole response. Run in two modes, so the cost of a resumed
+// 0-RTT session can be compared against a full handshake.
+//
+// The 0-RTT mode needs a session ticket, which can only come from an earlier
+// connection. That first connection is made during warmup, outside the
+// measured region, so what is timed is only the resumed exchange.
+
+const common = require('../common.js');
+const fixtures = require('../../test/common/fixtures');
+const { createPrivateKey } = require('crypto');
+
+const bench = common.createBenchmark(main, {
+  // '0rtt' resumes from a ticket and sends the request in the very first
+  // flight; '1rtt' is a fresh session each time. 0-RTT is listed first so
+  // that it is the mode the benchmark CI test exercises.
+  mode: ['0rtt', '1rtt'],
+  n: [500],
+}, { flags: ['--experimental-quic', '--experimental-stream-iter',
+             '--no-warnings'] });
+
+async function main({ mode, n }) {
+  const { listen, connect } = require('node:quic');
+  const { bytes } = require('stream/iter');
+
+  const key = createPrivateKey(fixtures.readKey('agent1-key.pem'));
+  const cert = fixtures.readKey('agent1-cert.pem');
+  const body = new TextEncoder().encode('x'.repeat(256));
+  const decoder = new TextDecoder();
+
+  const request = {
+    ':method': 'GET',
+    ':path': '/',
+    ':scheme': 'https',
+    ':authority': 'localhost',
+  };
+
+  const endpoint = await listen((session) => {
+    session.opened.catch(() => {});
+    session.closed.catch(() => {});
+    session.onstream = (stream) => { stream.closed.catch(() => {}); };
+  }, {
+    sni: { '*': { keys: [key], certs: [cert] } },
+    onheaders() {
+      this.sendHeaders({ ':status': '200' });
+      this.writer.writeSync(body);
+      this.writer.endSync();
+    },
+    endpoint: {
+      maxConnectionsPerHost: 0xFFFF,
+      maxConnectionsTotal: 0xFFFF,
+      sessionCreationRate: 1_000_000,
+      sessionCreationBurst: 1_000_000,
+    },
+  });
+
+  const address = endpoint.address;
+  let received = 0;
+  const onheaders = () => { received++; };
+
+  // A full handshake, one request, one response. When resume is supplied the
+  // request goes out in the first flight, before the handshake completes.
+  async function exchange(resume) {
+    const session = await connect(address, {
+      servername: 'localhost',
+      verifyPeer: 'manual',
+      alpn: 'h3',
+      ...resume,
+    });
+    const stream = await session.createBidirectionalStream({
+      headers: request,
+      onheaders,
+    });
+    if (resume === undefined) await session.opened;
+    const response = decoder.decode(await bytes(stream));
+    if (response.length !== body.length) {
+      throw new Error(`short response: ${response.length}`);
+    }
+    session.close();
+    await session.closed.catch(() => {});
+    return session;
+  }
+
+  // Collect a ticket for the 0-RTT mode from a connection that is not timed.
+  let resume;
+  if (mode === '0rtt') {
+    const { promise, resolve } = Promise.withResolvers();
+    let ticket;
+    let token;
+    const session = await connect(address, {
+      servername: 'localhost',
+      verifyPeer: 'manual',
+      alpn: 'h3',
+      onsessionticket(value) {
+        ticket ??= value;
+        if (token !== undefined) resolve();
+      },
+      onnewtoken(value) {
+        token ??= value;
+        if (ticket !== undefined) resolve();
+      },
+    });
+    await session.opened;
+    await promise;
+    session.close();
+    await session.closed.catch(() => {});
+    resume = { sessionTicket: ticket, token };
+  }
+
+  // The timed 0-RTT exchanges deliberately never await session.opened, since
+  // waiting for the handshake is exactly what 0-RTT avoids. That leaves no
+  // opportunity to notice early data being refused, so check separately -
+  // otherwise a ticket the server stopped accepting would quietly turn this
+  // into a measurement of the 1-RTT path.
+  async function checkEarlyDataAccepted() {
+    const session = await connect(address, {
+      servername: 'localhost',
+      verifyPeer: 'manual',
+      alpn: 'h3',
+      ...resume,
+    });
+    const stream = await session.createBidirectionalStream({
+      headers: request,
+      onheaders,
+    });
+    const info = await session.opened;
+    await bytes(stream);
+    session.close();
+    await session.closed.catch(() => {});
+    if (!info.earlyDataAccepted) {
+      throw new Error('0-RTT was not accepted, benchmark would be invalid');
+    }
+  }
+
+  for (let i = 0; i < 20; i++) await exchange(resume);
+  if (mode === '0rtt') await checkEarlyDataAccepted();
+
+  received = 0;
+  bench.start();
+  for (let i = 0; i < n; i++) await exchange(resume);
+  bench.end(n);
+
+  if (received !== n) throw new Error(`missing responses: ${received}/${n}`);
+  // The ticket is reused for every iteration, so confirm it was still being
+  // accepted at the end of the run and not just at the start.
+  if (mode === '0rtt') await checkEarlyDataAccepted();
+  await endpoint.close();
+}

benchmark/quic/handshake.js

@@ -0,0 +1,74 @@
+'use strict';
+
+// Measures the cost of establishing QUIC sessions: how many complete
+// handshakes per second a single endpoint can serve, for raw QUIC and for
+// HTTP/3. Nothing is sent on the session beyond what the protocol itself
+// requires, so this isolates connection setup rather than data transfer.
+
+const common = require('../common.js');
+const fixtures = require('../../test/common/fixtures');
+const { createPrivateKey } = require('crypto');
+
+const bench = common.createBenchmark(main, {
+  // 'raw' negotiates a non-HTTP ALPN and does no application work.
+  // 'h3' negotiates HTTP/3, so the server also builds an nghttp3 connection
+  // and its control/QPACK streams for every session.
+  protocol: ['raw', 'h3'],
+  concurrency: [1, 10],
+  n: [1000],
+}, { flags: ['--experimental-quic', '--no-warnings'] });
+
+async function main({ protocol, concurrency, n }) {
+  const { listen, connect } = require('node:quic');
+
+  const key = createPrivateKey(fixtures.readKey('agent1-key.pem'));
+  const cert = fixtures.readKey('agent1-cert.pem');
+  const alpn = protocol === 'h3' ? 'h3' : 'quic-bench';
+
+  const endpoint = await listen((session) => {
+    // A benchmark peer never reads these; swallow so a torn-down session
+    // cannot produce an unhandled rejection.
+    session.opened.catch(() => {});
+    session.closed.catch(() => {});
+  }, {
+    sni: { '*': { keys: [key], certs: [cert] } },
+    alpn: [alpn],
+    // The defaults rate-limit session creation per host, which a benchmark
+    // hammering a single address would otherwise trip.
+    endpoint: {
+      maxConnectionsPerHost: 0xFFFF,
+      maxConnectionsTotal: 0xFFFF,
+      sessionCreationRate: 1_000_000,
+      sessionCreationBurst: 1_000_000,
+    },
+  });
+
+  const address = endpoint.address;
+
+  async function handshake() {
+    const session = await connect(address, {
+      servername: 'localhost',
+      verifyPeer: 'manual',
+      alpn,
+    });
+    await session.opened;
+    session.close();
+    await session.closed.catch(() => {});
+  }
+
+  async function run(count) {
+    for (let i = 0; i < count; i += concurrency) {
+      const batch = Math.min(concurrency, count - i);
+      await Promise.all(Array.from({ length: batch }, handshake));
+    }
+  }
+
+  // Warm up the TLS and QUIC machinery before measuring.
+  await run(Math.min(100, n));
+
+  bench.start();
+  await run(n);
+  bench.end(n);
+
+  await endpoint.close();
+}

doc/api/quic.md

@@ -2948,10 +2948,10 @@ The ALPN (Application-Layer Protocol Negotiation) identifier(s).
 For **client** sessions, this is a single string specifying the protocol
 the client wants to use (e.g. `'h3'`).
 
-For **server** sessions, this is an array of protocol names in preference
-order that the server supports (e.g. `['h3', 'h3-29']`). During the TLS
-handshake, the server selects the first protocol from its list that the
-client also supports.
+For **server** sessions, this is a non-empty array of protocol names in
+preference order that the server supports (e.g. `['h3', 'h3-29']`).
+During the TLS handshake, the server selects the first protocol from its
+list that the client also supports.
 
 The negotiated ALPN determines which Application implementation is used
 for the session. `'h3'` and `'h3-*'` variants select the HTTP/3

lib/internal/quic/quic.js

@@ -5144,6 +5144,12 @@ function processTlsOptions(tls, forServer) {
     if (!forServer) {
       validateString(alpn, 'options.alpn');
     }
+    // QUIC has no default application protocol: a server that offers none
+    // cannot complete a handshake with anyone.
+    if (protocols.length === 0) {
+      throw new ERR_INVALID_ARG_VALUE('options.alpn', alpn,
+                                      'must offer at least one protocol');
+    }
     let totalLen = 0;
     for (let i = 0; i < protocols.length; i++) {
       validateString(protocols[i], `options.alpn[${i}]`);

node.gyp

@@ -391,6 +391,7 @@
       'src/crypto/crypto_sig.cc',
       'src/crypto/crypto_timing.cc',
       'src/crypto/crypto_cipher.cc',
+      'src/crypto/crypto_client_hello.cc',
       'src/crypto/crypto_context.cc',
       'src/crypto/crypto_tls_certificates.cc',
       'src/crypto/crypto_ec.cc',
@@ -422,6 +423,7 @@
       'src/crypto/crypto_spkac.h',
       'src/crypto/crypto_util.h',
       'src/crypto/crypto_cipher.h',
+      'src/crypto/crypto_client_hello.h',
       'src/crypto/crypto_common.h',
       'src/crypto/crypto_dsa.h',
       'src/crypto/crypto_hash.h',