QUIC 协议拆解（下）：用 C 实现一个最小 QUIC 握手

static const uint8_t initial_salt_v1[] = {
    0x38, 0x76, 0x2c, 0xf7, 0xf5, 0x59, 0x34, 0xb3, 0x4d, 0x17,
    0x9a, 0xe6, 0xa4, 0xc8, 0x0c, 0xad, 0xcc, 0xbb, 0x7f, 0x0a
};

void derive_initial_keys(const uint8_t *dcid, size_t dcid_len,
                         uint8_t client_key[16], uint8_t client_iv[12],
                         uint8_t server_key[16], uint8_t server_iv[12]) {
    uint8_t initial_secret[32], client_secret[32], server_secret[32];

    // HKDF-Extract: 从 DCID 提取初始密钥材料
    hkdf_extract(initial_salt_v1, 20, dcid, dcid_len, initial_secret);

    // 派生客户端/服务端 initial secret
    hkdf_expand_label(initial_secret, 32, "client in", 9, NULL, 0, client_secret, 32);
    hkdf_expand_label(initial_secret, 32, "server in", 9, NULL, 0, server_secret, 32);

    // 从 secret 派生 key 和 IV
    hkdf_expand_label(client_secret, 32, "quic key", 8, NULL, 0, client_key, 16);
    hkdf_expand_label(client_secret, 32, "quic iv",  7, NULL, 0, client_iv, 12);
    hkdf_expand_label(server_secret, 32, "quic key", 8, NULL, 0, server_key, 16);
    hkdf_expand_label(server_secret, 32, "quic iv",  7, NULL, 0, server_iv, 12);
}

/* mini_quic_client.c — 最小 QUIC 客户端（ngtcp2 + OpenSSL）
 * 编译: gcc -o mini_quic_client mini_quic_client.c \
 *       -lngtcp2 -lngtcp2_crypto_openssl -lssl -lcrypto
 */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <arpa/inet.h>
#include <sys/socket.h>
#include <netdb.h>
#include <time.h>
#include <ngtcp2/ngtcp2.h>
#include <ngtcp2/ngtcp2_crypto.h>
#include <ngtcp2/ngtcp2_crypto_openssl.h>
#include <openssl/ssl.h>
#include <openssl/rand.h>

#define BUF_SIZE 65535

typedef struct {
    ngtcp2_conn *conn;
    SSL_CTX *ssl_ctx;  SSL *ssl;
    int fd;  int64_t stream_id;  int handshake_done;
} client_ctx;

static ngtcp2_tstamp timestamp_ns(void) {
    struct timespec ts;
    clock_gettime(CLOCK_MONOTONIC, &ts);
    return (ngtcp2_tstamp)ts.tv_sec * NGTCP2_SECONDS
         + (ngtcp2_tstamp)ts.tv_nsec;
}

/* ---- 应用层回调（只列关键的几个） ---- */
static int on_recv_stream_data(ngtcp2_conn *conn, uint32_t flags,
        int64_t stream_id, uint64_t offset,
        const uint8_t *data, size_t datalen,
        void *user_data, void *stream_user_data) {
    printf("[RECV] stream=%ld len=%zu: ", stream_id, datalen);
    fwrite(data, 1, datalen, stdout);  printf("\n");
    return 0;
}

static int on_handshake_completed(ngtcp2_conn *conn, void *user_data) {
    ((client_ctx *)user_data)->handshake_done = 1;
    printf("[INFO] QUIC 握手完成！\n");
    return 0;
}

static void on_rand(uint8_t *dest, size_t destlen,
                    const ngtcp2_rand_ctx *rand_ctx) {
    (void)rand_ctx;  RAND_bytes(dest, (int)destlen);
}

static int on_get_new_cid(ngtcp2_conn *conn, ngtcp2_cid *cid,
        uint8_t *token, size_t cidlen, void *user_data) {
    RAND_bytes(cid->data, (int)cidlen);  cid->datalen = cidlen;
    RAND_bytes(token, NGTCP2_STATELESS_RESET_TOKENLEN);
    return 0;
}

/* ---- 事件循环：握手 → 发数据 → 关闭 ---- */
static int event_loop(client_ctx *ctx) {
    uint8_t buf[BUF_SIZE];
    int data_sent = 0, close_timer = 20;

    for (;;) {
        ngtcp2_tstamp now = timestamp_ns();
        if (ngtcp2_conn_get_expiry(ctx->conn) <= now)
            ngtcp2_conn_handle_expiry(ctx->conn, now);

        ngtcp2_path_storage ps;  ngtcp2_path_storage_zero(&ps);
        ngtcp2_pkt_info pi;

        // 握手完成后打开流并发送数据
        if (ctx->handshake_done && !data_sent) {
            if (ngtcp2_conn_open_bidi_stream(ctx->conn,
                    &ctx->stream_id, NULL) == 0) {
                const uint8_t *msg = (const uint8_t *)"Hello, QUIC!\n";
                ngtcp2_vec dv = {.base = (uint8_t *)msg, .len = 13};
                ngtcp2_ssize ndl, nw;
                nw = ngtcp2_conn_writev_stream(ctx->conn, &ps.path, &pi,
                        buf, sizeof(buf), &ndl,
                        NGTCP2_WRITE_STREAM_FLAG_FIN,
                        ctx->stream_id, &dv, 1, now);
                if (nw > 0) { send(ctx->fd, buf, (size_t)nw, 0); data_sent=1; }
            }
        }

        // 发送协议控制包（ACK / 握手消息等）
        for (;;) {
            ngtcp2_ssize nw = ngtcp2_conn_write_pkt(ctx->conn,
                    &ps.path, &pi, buf, sizeof(buf), now);
            if (nw <= 0) break;
            send(ctx->fd, buf, (size_t)nw, 0);
        }

        // 接收来自服务器的 UDP 包（50ms 超时）
        struct timeval tv = {.tv_sec=0, .tv_usec=50000};
        setsockopt(ctx->fd, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv));
        ssize_t nr = recv(ctx->fd, buf, sizeof(buf), 0);
        if (nr > 0) {
            ngtcp2_path path = {0};  ngtcp2_pkt_info rpi = {0};
            int rv = ngtcp2_conn_read_pkt(ctx->conn, &path, &rpi,
                                          buf, (size_t)nr, timestamp_ns());
            if (rv == NGTCP2_ERR_DRAINING) return 0;
        }

        if (ngtcp2_conn_in_draining_period(ctx->conn)) return 0;

        if (data_sent && --close_timer <= 0) {
            ngtcp2_ccerr ccerr;  ngtcp2_ccerr_default(&ccerr);
            ngtcp2_ssize cw = ngtcp2_conn_write_connection_close(
                ctx->conn, &ps.path, &pi, buf, sizeof(buf), &ccerr, now);
            if (cw > 0) send(ctx->fd, buf, (size_t)cw, 0);
            printf("[INFO] 发送 CONNECTION_CLOSE\n");
            return 0;
        }
    }
}

int main(int argc, char *argv[]) {
    if (argc < 3) { fprintf(stderr, "用法: %s <host> <port>\n", argv[0]); return 1; }
    client_ctx ctx = {0};

    /* 1) UDP socket */
    struct sockaddr_storage raddr, laddr;  socklen_t rlen, llen;
    struct addrinfo hints = {.ai_family=AF_UNSPEC, .ai_socktype=SOCK_DGRAM}, *res;
    // 生产环境必须检查所有返回值
    getaddrinfo(argv[1], argv[2], &hints, &res);
    ctx.fd = socket(res->ai_family, SOCK_DGRAM, 0);
    connect(ctx.fd, res->ai_addr, res->ai_addrlen);
    memcpy(&raddr, res->ai_addr, res->ai_addrlen); rlen = res->ai_addrlen;
    freeaddrinfo(res);
    llen = sizeof(laddr);
    getsockname(ctx.fd, (struct sockaddr *)&laddr, &llen);

    /* 2) TLS 上下文 */
    ctx.ssl_ctx = SSL_CTX_new(TLS_client_method());
    SSL_CTX_set_min_proto_version(ctx.ssl_ctx, TLS1_3_VERSION);
    SSL_CTX_set_max_proto_version(ctx.ssl_ctx, TLS1_3_VERSION);
    static const uint8_t alpn[] = "\x02h3";
    SSL_CTX_set_alpn_protos(ctx.ssl_ctx, alpn, sizeof(alpn) - 1);
    SSL_CTX_set_verify(ctx.ssl_ctx, SSL_VERIFY_NONE, NULL); // ⚠️ 教学用
    ngtcp2_crypto_openssl_configure_client_context(ctx.ssl_ctx);
    ctx.ssl = SSL_new(ctx.ssl_ctx);
    SSL_set_connect_state(ctx.ssl);
    SSL_set_tlsext_host_name(ctx.ssl, argv[1]);

    /* 3) ngtcp2 连接参数 */
    ngtcp2_cid dcid, scid;
    dcid.datalen = NGTCP2_MIN_INITIAL_DCIDLEN; RAND_bytes(dcid.data, (int)dcid.datalen);
    scid.datalen = 8; RAND_bytes(scid.data, (int)scid.datalen);

    ngtcp2_path path;
    ngtcp2_addr_init(&path.local, (struct sockaddr *)&laddr, llen);
    ngtcp2_addr_init(&path.remote, (struct sockaddr *)&raddr, rlen);

    ngtcp2_settings settings;  ngtcp2_settings_default(&settings);
    settings.initial_ts = timestamp_ns();

    ngtcp2_transport_params params;  ngtcp2_transport_params_default(&params);
    params.initial_max_streams_bidi = 4;
    params.initial_max_data = 1048576;
    params.initial_max_stream_data_bidi_local  = 262144;
    params.initial_max_stream_data_bidi_remote = 262144;

    /* 4) 回调：加密部分由 ngtcp2_crypto_openssl 提供，应用层自己写 */
    ngtcp2_callbacks cb = {
        .client_initial           = ngtcp2_crypto_client_initial_cb,
        .recv_crypto_data         = ngtcp2_crypto_recv_crypto_data_cb,
        .encrypt                  = ngtcp2_crypto_encrypt_cb,
        .decrypt                  = ngtcp2_crypto_decrypt_cb,
        .hp_mask                  = ngtcp2_crypto_hp_mask_cb,
        .recv_retry               = ngtcp2_crypto_recv_retry_cb,
        .update_key               = ngtcp2_crypto_update_key_cb,
        .delete_crypto_aead_ctx   = ngtcp2_crypto_delete_crypto_aead_ctx_cb,
        .delete_crypto_cipher_ctx = ngtcp2_crypto_delete_crypto_cipher_ctx_cb,
        .get_path_challenge_data  = ngtcp2_crypto_get_path_challenge_data_cb,
        .version_negotiation      = ngtcp2_crypto_version_negotiation_cb,
        .recv_stream_data         = on_recv_stream_data,
        .handshake_completed      = on_handshake_completed,
        .rand                     = on_rand,
        .get_new_connection_id    = on_get_new_cid,
    };

    ngtcp2_conn_client_new(&ctx.conn, &dcid, &scid, &path,
                           NGTCP2_PROTO_VER_V1, &cb, &settings, &params,
                           NULL, &ctx);
    ngtcp2_conn_set_tls_native_handle(ctx.conn, ctx.ssl);

    printf("[INFO] 连接 %s:%s ...\n", argv[1], argv[2]);
    event_loop(&ctx);

    ngtcp2_conn_del(ctx.conn);
    SSL_free(ctx.ssl);  SSL_CTX_free(ctx.ssl_ctx);  close(ctx.fd);
    return 0;
}

# 安装依赖 + 编译
sudo apt install libssl-dev
git clone --recursive https://github.com/ngtcp2/ngtcp2
cd ngtcp2
mkdir build && cd build
cmake -DCMAKE_BUILD_TYPE=Release -DENABLE_OPENSSL=ON ..
make -j$(nproc)
sudo make install

gcc -o mini_quic_client mini_quic_client.c \
    -lngtcp2 -lngtcp2_crypto_openssl -lssl -lcrypto
./mini_quic_client quic.example.com 443

# 导出 TLS 密钥，让 Wireshark 能解密 QUIC
export SSLKEYLOGFILE=./quic_keys.log
sudo tcpdump -i any udp port 443 -w quic_capture.pcap &

./mini_quic_client quic.example.com 443

# Wireshark: Edit → Preferences → Protocols → TLS →
#   (Pre)-Master-Secret log filename → 选择 quic_keys.log

// ACK 帧结构伪代码
struct ack_frame {
    uint64_t largest_acked;    // 最大已确认包号
    uint64_t ack_delay;        // 接收到 largest_acked 到发送 ACK 的延迟（微秒）
    uint64_t ack_range_count;  // 间隔区间数量
    uint64_t first_ack_range;  // 从 largest_acked 向前连续确认的包数
    struct {
        uint64_t gap;          // 未确认的包数（间隔）
        uint64_t ack_range;    // 该区间内连续确认的包数
    } ranges[];
};

// 示例：确认了包号 10,11,12, 15,16, 20
// largest_acked = 20
// first_ack_range = 0      → 确认 [20, 20]
// ranges[0] = {gap=3, range=1}  → 跳过 19,18,17, 确认 [15, 16]
// ranges[1] = {gap=2, range=2}  → 跳过 14,13, 确认 [10, 12]

# QUIC 丢包检测伪代码（基于 RFC 9002）
# 中文注释说明每一步的逻辑

def on_ack_received(ack_frame):
    """收到 ACK 帧时触发丢包检测"""
    newly_acked = 解析_ack_frame_得到已确认包号列表(ack_frame)
    largest_acked = ack_frame.largest_acked

    for pkt in sent_packets:  # 遍历所有已发送但未确认的包
        if pkt.packet_number in newly_acked:
            # 包被确认了，从发送列表移除
            on_packet_acked(pkt)
            continue

        # ── 信号 1：包号阈值（Packet Threshold） ──
        # 如果比这个包更新的包已经被确认了 >= 3 个，
        # 认为这个包丢了（类似 TCP 的三次重复 ACK）
        if largest_acked - pkt.packet_number >= PACKET_THRESHOLD:  # 默认 3
            declare_lost(pkt)
            continue

        # ── 信号 2：时间阈值（Time Threshold） ──
        # 如果距离发送已经超过 max(1.25 * smoothed_rtt, 1ms) + ack_delay，
        # 认为这个包丢了
        loss_delay = max(smoothed_rtt * TIME_THRESHOLD_FACTOR, 1ms)  # 因子默认 9/8
        if now() - pkt.time_sent > loss_delay:
            declare_lost(pkt)
            continue

def declare_lost(pkt):
    """确认包丢失，执行重传"""
    # QUIC 不重传"包"，而是重传包里的"帧"
    # 包号永远递增，不会重用
    for frame in pkt.frames:
        if frame.type == CRYPTO:
            # CRYPTO 帧：必须重传（握手消息不能丢）
            queue_crypto_retransmit(frame)
        elif frame.type == STREAM:
            # STREAM 帧：标记对应流的数据段为待重传
            mark_stream_data_for_retransmit(frame.stream_id,
                                             frame.offset,
                                             frame.length)
        elif frame.type == ACK:
            # ACK 帧：不需要重传（下一个 ACK 会包含最新信息）
            pass
        # MAX_DATA, MAX_STREAM_DATA 等：用最新值重发即可

# PTO 定时器伪代码
def compute_pto():
    """计算 PTO 超时时间"""
    # PTO = smoothed_rtt + max(4 * rttvar, 1ms) + max_ack_delay
    # 每次 PTO 触发后加倍（指数退避）
    pto = smoothed_rtt + max(4 * rttvar, 1ms)
    if handshake_not_confirmed:
        # 握手阶段不加 max_ack_delay（对端可能还没准备好）
        pass
    else:
        pto += peer_max_ack_delay

    return pto * (2 ** pto_backoff_count)  # 指数退避

def on_pto_timeout():
    """PTO 超时处理"""
    pto_backoff_count += 1

    if has_crypto_data_in_flight():
        # 握手数据优先：重传 CRYPTO 帧
        retransmit_unacked_crypto()
    else:
        # 发送探测包（1-2 个，包含 PING 帧或待确认数据）
        # 目的不是重传，而是"刺探"对端是否还活着
        send_probe_packet(count=2)

    # 重启 PTO 定时器（已加倍）
    restart_pto_timer()

int64_t stream_id;
ngtcp2_conn_open_bidi_stream(conn, &stream_id, NULL);
// 流 ID 最低 2 位决定类型：
// 0x00: 客户端双向  0x01: 服务端双向  0x02: 客户端单向  0x03: 服务端单向

// 发送数据——writev_stream 把流数据打包成 QUIC 包
const uint8_t *data = (const uint8_t *)"GET / HTTP/3\r\n";
ngtcp2_vec datav = {.base = (uint8_t *)data, .len = 14};
ngtcp2_ssize ndatalen, nw;
uint8_t buf[BUF_SIZE];
ngtcp2_path_storage ps;  ngtcp2_path_storage_zero(&ps);
ngtcp2_pkt_info pi;

nw = ngtcp2_conn_writev_stream(conn, &ps.path, &pi, buf, sizeof(buf),
    &ndatalen, NGTCP2_WRITE_STREAM_FLAG_NONE,
    stream_id, &datav, 1, timestamp_ns());
if (nw > 0) send(fd, buf, (size_t)nw, 0);

// 通知 ngtcp2 已消费数据，触发发送 MAX_STREAM_DATA 帧
ngtcp2_conn_extend_max_stream_offset(conn, stream_id, datalen);
ngtcp2_conn_extend_max_offset(conn, datalen);

ngtcp2_ccerr ccerr;
ngtcp2_ccerr_default(&ccerr);  // error_code = 0
ngtcp2_ssize nw = ngtcp2_conn_write_connection_close(
    conn, &ps.path, &pi, buf, sizeof(buf), &ccerr, timestamp_ns());
if (nw > 0) send(fd, buf, (size_t)nw, 0);

settings.cc_algo = NGTCP2_CC_ALGO_BBR2;  // 默认 NewReno