Repository navigation
Reject 0-RTT downgrade of the extended CONNECT setting - #3940
Merged
larseggert merged 2 commits intoSep 7, 2026
Merged
Conversation
Signed-off-by: David Sarkisyan <[email protected]>
srkyn
requested review from
KershawChang,
larseggert,
martinthomson and
mxinden
as code owners
September 4, 2026 15:03
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #3940 +/- ##
==========================================
- Coverage 96.91% 96.75% -0.16%
==========================================
Files 113 118 +5
Lines 39439 39801 +362
Branches 39439 39801 +362
==========================================
+ Hits 38222 38510 +288
- Misses 1202 1266 +64
- Partials 15 25 +10
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
Contributor
Merging this PR will not alter performance
Comparing 
Footnotes
|
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The focused implementation and regression test address the RFC requirement with no unresolved issues.
Pull request overview
Adds RFC-compliant rejection of extended CONNECT setting downgrades during 0-RTT resumption.
Changes:
- Includes
EnableConnectin resumed-setting compatibility checks. - Adds regression coverage for omission after a stored value of
1.
File summaries
| File | Description |
|---|---|
neqo-http3/src/connection.rs |
Rejects extended CONNECT downgrades with H3_SETTINGS_ERROR. |
neqo-http3/src/connection_client.rs |
Tests the omitted-setting downgrade case. |
Review details
- Files reviewed: 2/2 changed files
- Comments generated: 0
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
martinthomson
approved these changes
Sep 7, 2026
Signed-off-by: David Sarkisyan <[email protected]>
larseggert
enabled auto-merge
September 7, 2026 05:29
Collaborator
|
Thank you! |
Contributor
Performance profiles for profiler.firefox.comBenchmarks (14)
|
Contributor
Client/server transfer resultsPerformance differences relative to 152962a. No significant performance differences. Table above only shows statistically significant changes. See all results below. All resultsTransfer of 33554432 bytes over loopback, min. 100 runs. All unit-less numbers are in milliseconds.
Download data for |
Contributor
Failed Interop TestsQUIC Interop Runner, client vs. server, differences relative to
All resultsSucceeded Interop TestsQUIC Interop Runner, client vs. server neqo-pr as client
neqo-pr as server
Unsupported Interop TestsQUIC Interop Runner, client vs. server neqo-pr as client
neqo-pr as server
|
Contributor
Benchmark resultsNo significant performance differences relative to 152962a. All resultstransfer/1-conn/1-100mb-resp (aka. Download)/mtu-1504: Change within noise threshold. time: [165.16 ms 165.45 ms 165.74 ms]
thrpt: [603.37 MiB/s 604.42 MiB/s 605.47 MiB/s]
change:
time: [-0.6967% -0.4742% -0.2400%] (p = 0.00 < 0.05)
thrpt: [+0.2406% +0.4765% +0.7016%]
Change within noise threshold.
Found 1 outliers among 100 measurements (1.00%)
1 (1.00%) high mildtransfer/1-conn/10_000-parallel-1b-resp (aka. RPS)/mtu-1504: No change in performance detected. time: [220.78 ms 221.14 ms 221.54 ms]
thrpt: [45.139 Kelem/s 45.221 Kelem/s 45.294 Kelem/s]
change:
time: [-0.1175% +0.1083% +0.3380%] (p = 0.37 > 0.05)
thrpt: [-0.3368% -0.1082% +0.1177%]
No change in performance detected.
Found 3 outliers among 100 measurements (3.00%)
2 (2.00%) high mild
1 (1.00%) high severetransfer/1-conn/1-1b-resp (aka. HPS)/mtu-1504: No change in performance detected. time: [35.798 ms 35.881 ms 35.971 ms]
thrpt: [27.801 B/s 27.870 B/s 27.934 B/s]
change:
time: [-0.5625% -0.2106% +0.1301%] (p = 0.24 > 0.05)
thrpt: [-0.1300% +0.2111% +0.5656%]
No change in performance detected.
Found 5 outliers among 100 measurements (5.00%)
4 (4.00%) high mild
1 (1.00%) high severetransfer/1-conn/1-100mb-req (aka. Upload)/mtu-1504: Change within noise threshold. time: [162.07 ms 162.34 ms 162.64 ms]
thrpt: [614.87 MiB/s 615.99 MiB/s 617.02 MiB/s]
change:
time: [-1.0441% -0.7751% -0.5029%] (p = 0.00 < 0.05)
thrpt: [+0.5055% +0.7812% +1.0552%]
Change within noise threshold.
Found 6 outliers among 100 measurements (6.00%)
5 (5.00%) high mild
1 (1.00%) high severestreams/walltime/1-streams/each-1000-bytes: No change in performance detected. time: [547.63 µs 549.16 µs 551.00 µs]
thrpt: [1.7308 MiB/s 1.7366 MiB/s 1.7415 MiB/s]
change:
time: [-0.0496% +0.4451% +0.9465%] (p = 0.08 > 0.05)
thrpt: [-0.9376% -0.4431% +0.0496%]
No change in performance detected.
Found 9 outliers among 100 measurements (9.00%)
1 (1.00%) high mild
8 (8.00%) high severestreams/walltime/1000-streams/each-1-bytes: No change in performance detected. time: [10.498 ms 10.512 ms 10.525 ms]
thrpt: [92.782 KiB/s 92.904 KiB/s 93.022 KiB/s]
change:
time: [-0.1937% +0.0076% +0.2050%] (p = 0.94 > 0.05)
thrpt: [-0.2046% -0.0076% +0.1940%]
No change in performance detected.streams/walltime/1000-streams/each-1000-bytes: Change within noise threshold. time: [30.534 ms 30.568 ms 30.603 ms]
thrpt: [31.163 MiB/s 31.198 MiB/s 31.233 MiB/s]
change:
time: [-0.6189% -0.4564% -0.2878%] (p = 0.00 < 0.05)
thrpt: [+0.2886% +0.4585% +0.6227%]
Change within noise threshold.
Found 1 outliers among 100 measurements (1.00%)
1 (1.00%) high mildstreams-flow-controlled/walltime/1-streams/each-4194304-bytes: Change within noise threshold. time: [25.624 ms 25.658 ms 25.693 ms]
thrpt: [155.69 MiB/s 155.90 MiB/s 156.10 MiB/s]
change:
time: [-0.5754% -0.3909% -0.1980%] (p = 0.00 < 0.05)
thrpt: [+0.1984% +0.3924% +0.5788%]
Change within noise threshold.streams-flow-controlled/walltime/10-streams/each-1048576-bytes: Change within noise threshold. time: [70.769 ms 70.837 ms 70.907 ms]
thrpt: [141.03 MiB/s 141.17 MiB/s 141.31 MiB/s]
change:
time: [-0.3989% -0.2392% -0.0853%] (p = 0.00 < 0.05)
thrpt: [+0.0853% +0.2398% +0.4005%]
Change within noise threshold.
Found 1 outliers among 100 measurements (1.00%)
1 (1.00%) high mildtransfer/walltime/pacing-false/varying-seeds: Change within noise threshold. time: [17.785 ms 17.796 ms 17.807 ms]
thrpt: [224.63 MiB/s 224.77 MiB/s 224.90 MiB/s]
change:
time: [+0.2133% +0.2927% +0.3786%] (p = 0.00 < 0.05)
thrpt: [-0.3772% -0.2918% -0.2129%]
Change within noise threshold.
Found 1 outliers among 100 measurements (1.00%)
1 (1.00%) high mildtransfer/walltime/pacing-true/varying-seeds: Change within noise threshold. time: [18.096 ms 18.108 ms 18.119 ms]
thrpt: [220.76 MiB/s 220.90 MiB/s 221.04 MiB/s]
change:
time: [-0.7854% -0.7073% -0.6239%] (p = 0.00 < 0.05)
thrpt: [+0.6278% +0.7124% +0.7916%]
Change within noise threshold.
Found 2 outliers among 100 measurements (2.00%)
1 (1.00%) low mild
1 (1.00%) high mildtransfer/walltime/pacing-false/same-seed: Change within noise threshold. time: [17.803 ms 17.815 ms 17.827 ms]
thrpt: [224.38 MiB/s 224.53 MiB/s 224.68 MiB/s]
change:
time: [-1.2925% -1.2003% -1.1105%] (p = 0.00 < 0.05)
thrpt: [+1.1230% +1.2148% +1.3094%]
Change within noise threshold.
Found 1 outliers among 100 measurements (1.00%)
1 (1.00%) high mildtransfer/walltime/pacing-true/same-seed: Change within noise threshold. time: [18.052 ms 18.061 ms 18.071 ms]
thrpt: [221.35 MiB/s 221.47 MiB/s 221.59 MiB/s]
change:
time: [-1.4466% -1.3687% -1.2876%] (p = 0.00 < 0.05)
thrpt: [+1.3044% +1.3877% +1.4678%]
Change within noise threshold.
Found 1 outliers among 100 measurements (1.00%)
1 (1.00%) high mildInstructions per cycleCriterion reported no significant timing changes. All benchmarks
Download data for |
mxinden-bot
pushed a commit
to mxinden-bot/neqo
that referenced
this pull request
Sep 17, 2026
User-visible changes since v0.31.1: - Update nss-rs to 0.16.1, adding NSS 3.129 support: mozilla#4000 - Remove HTTP/3 server push: mozilla#3816 - Back-pressure the outbound QUIC datagram queue: mozilla#3859 - Reject 0-RTT downgrade of the extended CONNECT setting: mozilla#3940 - Report the receiver flow-control window in Stats: mozilla#3978
Merged
pull Bot
pushed a commit
to SINHASantos/neqo
that referenced
this pull request
Sep 25, 2026
User-visible changes since v0.31.1: - Update nss-rs to 0.16.1, adding NSS 3.129 support: mozilla#4000 - Remove HTTP/3 server push: mozilla#3816 - Back-pressure the outbound QUIC datagram queue: mozilla#3859 - Reject 0-RTT downgrade of the extended CONNECT setting: mozilla#3940 - Report the receiver flow-control window in Stats: mozilla#3978
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
On a resumed connection, Neqo currently accepts a new SETTINGS frame that omits
SETTINGS_ENABLE_CONNECT_PROTOCOLeven when the stored 0-RTT value was 1. The feature negotiation then disables extended CONNECT, but the connection remains open.RFC 9114 Section 7.2.4.2 requires
H3_SETTINGS_ERRORwhen a server accepts 0-RTT and then omits an understood setting that previously had a non-default value. The setting's default is 0, so omission after a stored value of 1 is covered by that rule.This adds
EnableConnectto the existing 0-RTT settings comparison and includes a regression test for the omitted-setting case.Validation:
cargo test --locked --release -p neqo-http3cargo check --locked -p neqo-http3cargo fmt --all -- --checkcargo clippy --locked -p neqo-http3 --all-targets -- -D warnings