Two coupled gaps surfaced when running the runner's zerortt testcase
against aioquic (picoquic + quic-go already passed because they
fault-tolerate harder).
1) Wire format. The 0-RTT pre-handshake batch was sending raw
"GET /<path>\r\n" on bidi streams regardless of ALPN. aioquic's
h3 server accepts 0-RTT at the TLS layer (early_data extension
echoed in EE) but its h3 layer silently drops bidi streams whose
payload isn't a valid HEADERS frame — server log shows N "Stream
X created by peer" lines and zero responses. Switch the
pre-handshake builder to fork on the cached ALPN: h3 →
Http3GetClient (three uni control streams + HEADERS-framed bidi
requests via prepareRequests); else → HqInteropGetClient (raw
text). The post-handshake side then reuses the pre-handshake
client and collects responses via awaitResponse(handle), so 1-RTT
replay (after rejection) lands on the right parser.
2) TLS-layer rejection. When the server skips the early_data
extension in EncryptedExtensions, the client must replay all
in-flight 0-RTT app data through the 1-RTT keys (RFC 9001 §4.6.2).
TlsClient now exposes earlyDataAccepted, set in the
WAITING_ENCRYPTED_EXTENSIONS branch. QuicConnection's
onApplicationKeysReady checks it: if 0-RTT was offered but EE
didn't carry early_data, we requeueAllInflightStreamData() +
cryptoSend.requeueAllInflight() + sentPackets.clear() BEFORE
installing 1-RTT keys, so the next writer drain ships the
identical stream/CRYPTO bytes under 1-RTT protection. Same
stream handles, same response collection — invisible to the
request layer.
Result, ./quic/interop/run-matrix.sh -t zerortt:
aioquic ✓(Z)
picoquic ✓(Z)
quic-go ✓(Z)
Resumption sweep regression-clean across all three.
334 :quic unit tests pass.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Vitor Pamplona
9bbfe718f9