recovery: add unchecked congestion window controller

Some deployments constrain transmission outside quiche but still need
QUIC recovery. Add an opt-in controller with a fixed congestion window
that does not adapt to ACKs or loss.

The controller preserves ACK processing, RTT estimation, loss detection
and bytes-in-flight accounting. Its window defaults to usize::MAX, and
callers can set a finite byte window through the Rust, C and
tokio-quiche configuration APIs. The setting has no effect unless the
controller is enabled and selected.

Restore the configured window in controller callbacks and after PMTU
updates. This prevents shared recovery code from changing the policy
permanently.

The controller is behind the non-default
congestion_window_unchecked_available feature in quiche and
tokio-quiche. With the default window, callers must enforce their own
transmission limits.

Author: cf-rhett

.github/workflows/nightly.yml

@@ -7,7 +7,7 @@ permissions:
   pull-requests: write
 
 env:
-  FEATURES: "async,ffi,qlog,rpk"
+  FEATURES: "async,ffi,qlog,rpk,congestion_window_unchecked_available"
   RUSTFLAGS: "-D warnings"
   RUSTDOCFLAGS: "--cfg docsrs"
   RUSTTOOLCHAIN: "nightly"

.github/workflows/stable.yml

@@ -7,7 +7,7 @@ permissions:
   pull-requests: write
 
 env:
-  DEFAULT_OPTIONS: "--features=async,ffi,qlog,rpk --workspace"
+  DEFAULT_OPTIONS: "--features=async,ffi,qlog,rpk,congestion_window_unchecked_available --workspace"
   # Used by `quiche_multiarch`, which can't link `boring` for foreign targets.
   NO_BORING_OPTIONS: "--features=ffi,qlog --workspace --exclude h3i --exclude tokio-quiche"
   RUSTFLAGS: "-D warnings"
@@ -62,6 +62,12 @@ jobs:
       - name: Run cargo test
         run: cargo test --verbose --all-targets ${{ env.DEFAULT_OPTIONS }}
 
+      - name: Run recovery and settings tests without unchecked congestion window
+        if: matrix.boring_version == 'latest'
+        run: |
+          cargo test --verbose --lib ${DEFAULT_OPTIONS/,congestion_window_unchecked_available/} 'recovery::'
+          cargo test --verbose --lib ${DEFAULT_OPTIONS/,congestion_window_unchecked_available/} 'settings::'
+
       # Need to run doc tests separately.
       # (https://github.com/rust-lang/cargo/issues/6669)
       - name: Run cargo doc test

quiche/Cargo.toml

@@ -46,6 +46,12 @@ default = ["boringssl-boring-crate"]
 # copy in the dep graph.
 boringssl-boring-crate = ["boring", "boring-sys", "foreign-types-shared"]
 
+# Exposes a congestion control algorithm that provides no congestion-window
+# protection. ACK processing, RTT estimation, loss detection, and recovery
+# remain enabled. Only enable this for deployments that constrain transmission
+# elsewhere.
+congestion_window_unchecked_available = []
+
 # Allow client connections to provide a custom DCID when initiating a
 # connection. Be aware that RFC 9000 places requirements for unpredictability and
 # length on the client DCID field. Enabling this feature can be dangerous if these
@@ -82,7 +88,12 @@ tag-prefix = ""
 
 [package.metadata.docs.rs]
 no-default-features = true
-features = ["boringssl-boring-crate", "qlog", "custom-client-dcid"]
+features = [
+  "boringssl-boring-crate",
+  "qlog",
+  "custom-client-dcid",
+  "congestion_window_unchecked_available",
+]
 rustdoc-args = ["--cfg", "docsrs"]
 
 [build-dependencies]

quiche/include/quiche.h

@@ -237,6 +237,14 @@ int quiche_config_set_cc_algorithm_name(quiche_config *config, const char *algo)
 // Sets the initial cwnd for the connection in terms of packet count.
 void quiche_config_set_initial_congestion_window_packets(quiche_config *config, size_t packets);
 
+// Sets the fixed congestion window in bytes for congestion_window_unchecked.
+// Select the controller using quiche_config_set_cc_algorithm_name(config,
+// "congestion_window_unchecked") in builds with the
+// congestion_window_unchecked_available feature.
+// Defaults to SIZE_MAX. Other congestion control algorithms are unchanged.
+// Recovery probes can bypass the fixed window.
+void quiche_config_set_unchecked_congestion_window(quiche_config *config, size_t window);
+
 enum quiche_cc_algorithm {
     QUICHE_CC_RENO = 0,
     QUICHE_CC_CUBIC = 1,

quiche/src/ffi.rs

@@ -368,6 +368,17 @@ pub extern "C" fn quiche_config_set_initial_congestion_window_packets(
     config.set_initial_congestion_window_packets(packets);
 }
 
+/// Sets the fixed congestion window in bytes for `congestion_window_unchecked`.
+///
+/// Defaults to `usize::MAX`. Other congestion control algorithms are unchanged.
+/// Recovery probes can bypass the fixed window.
+#[no_mangle]
+pub extern "C" fn quiche_config_set_unchecked_congestion_window(
+    config: &mut Config, window: size_t,
+) {
+    config.set_unchecked_congestion_window(window);
+}
+
 #[no_mangle]
 pub extern "C" fn quiche_config_enable_hystart(config: &mut Config, v: bool) {
     config.enable_hystart(v);

quiche/src/lib.rs

@@ -372,6 +372,9 @@
 //!   initiating a connection. Dangerous if the DCID does not meet QUIC's
 //!   unpredictability and length requirements.
 //!
+//! * `congestion_window_unchecked_available`: Expose a congestion control
+//!   algorithm with a fixed, configurable window that defaults to `usize::MAX`.
+//!
 //! [feature flags]: https://doc.rust-lang.org/cargo/reference/manifest.html#the-features-section
 //! [boring]: https://crates.io/crates/boring
 //! [qlog]: https://datatracker.ietf.org/doc/html/draft-ietf-quic-qlog-main-schema
@@ -578,6 +581,7 @@ pub struct Config {
     cc_algorithm: CongestionControlAlgorithm,
     custom_bbr_params: Option<BbrParams>,
     initial_congestion_window_packets: usize,
+    unchecked_congestion_window: usize,
     enable_relaxed_loss_threshold: bool,
     enable_cubic_idle_restart_fix: bool,
     enable_send_streams_blocked: bool,
@@ -660,6 +664,7 @@ impl Config {
             custom_bbr_params: None,
             initial_congestion_window_packets:
                 DEFAULT_INITIAL_CONGESTION_WINDOW_PACKETS,
+            unchecked_congestion_window: usize::MAX,
             enable_relaxed_loss_threshold: false,
             enable_cubic_idle_restart_fix: true,
             enable_send_streams_blocked: false,
@@ -1139,6 +1144,23 @@ impl Config {
         self.initial_congestion_window_packets = packets;
     }
 
+    /// Sets the fixed congestion window in bytes for the
+    /// `congestion_window_unchecked` algorithm.
+    ///
+    /// The default is `usize::MAX`. Other congestion control algorithms ignore
+    /// this setting. Recovery probes can temporarily bypass this window.
+    ///
+    /// Values are not clamped. Zero can prevent connection establishment, and
+    /// windows too small for outgoing packets or PMTU probes can stall
+    /// transmission. At least two maximum-sized datagrams are recommended.
+    ///
+    /// This API is available even when the
+    /// `congestion_window_unchecked_available` feature is disabled, in which
+    /// case the setting has no effect.
+    pub fn set_unchecked_congestion_window(&mut self, window: usize) {
+        self.unchecked_congestion_window = window;
+    }
+
     /// Configure whether to enable relaxed loss detection on spurious loss.
     ///
     /// The default value is false.

quiche/src/recovery/AGENTS.md

@@ -74,8 +74,10 @@ gcongestion/        Next-gen CC (BBR2)
 ## NOTES
 
 - Constants cite RFC 9002: `INITIAL_TIME_THRESHOLD = 9.0/8.0`, `GRANULARITY = 1ms`.
-- `CongestionControlAlgorithm` values: Reno=0, CUBIC=1, Bbr2Gcongestion=4. Gap is intentional (removed variants).
-- `Recovery::new_with_config` tries `GRecovery::new` first; falls back to `LegacyRecovery` if algo is Reno/CUBIC.
+- `CongestionControlAlgorithm` values: Reno=0, CUBIC=1, Bbr2Gcongestion=4,
+  CongestionWindowUnchecked=5 when enabled. Gaps are intentional (removed variants).
+- `Recovery::new_with_config` tries `GRecovery::new` first; falls back to
+  `LegacyRecovery` for Reno, CUBIC, and CongestionWindowUnchecked.
 - `bbr2/` is a deeply nested state machine -- changes require understanding all six substates.
 - `enable_relaxed_loss_threshold` experiment adjusts time thresholds dynamically on spurious loss.
 - `gcongestion/bbr.rs` is BBRv1 -- mostly vestigial alongside BBR2.

quiche/src/recovery/congestion/cubic.rs

@@ -47,6 +47,7 @@ use crate::recovery::MINIMUM_WINDOW_PACKETS;
 
 pub(crate) static CUBIC: CongestionControlOps = CongestionControlOps {
     on_init,
+    on_mtu_update: |_| {},
     on_packet_sent,
     on_packets_acked,
     congestion_event,

quiche/src/recovery/congestion/mod.rs

@@ -113,6 +113,10 @@ pub struct Congestion {
     /// Initial congestion window size in terms of packet count.
     pub(crate) initial_congestion_window_packets: usize,
 
+    #[cfg(feature = "congestion_window_unchecked_available")]
+    /// Fixed congestion window in bytes for the unchecked controller.
+    pub(crate) unchecked_congestion_window: usize,
+
     max_datagram_size: usize,
 
     pub(crate) lost_count: usize,
@@ -146,6 +150,9 @@ impl Congestion {
 
             initial_congestion_window_packets: recovery_config
                 .initial_congestion_window_packets,
+            #[cfg(feature = "congestion_window_unchecked_available")]
+            unchecked_congestion_window: recovery_config
+                .unchecked_congestion_window,
 
             max_datagram_size: recovery_config.max_send_udp_payload_size,
 
@@ -247,6 +254,9 @@ impl Congestion {
 pub(crate) struct CongestionControlOps {
     pub on_init: fn(r: &mut Congestion),
 
+    /// Updates controller state after the packet-size limit changes.
+    pub on_mtu_update: fn(congestion: &mut Congestion),
+
     pub on_packet_sent: fn(
         r: &mut Congestion,
         sent_bytes: usize,
@@ -283,6 +293,34 @@ pub(crate) struct CongestionControlOps {
     ) -> std::fmt::Result,
 }
 
+#[cfg(feature = "congestion_window_unchecked_available")]
+static CONGESTION_WINDOW_UNCHECKED: CongestionControlOps = CongestionControlOps {
+    on_init: reset_unchecked_congestion_window,
+    on_mtu_update: reset_unchecked_congestion_window,
+    on_packet_sent: |congestion, _, _, _| {
+        reset_unchecked_congestion_window(congestion)
+    },
+    on_packets_acked: |congestion, _, _, _, _| {
+        reset_unchecked_congestion_window(congestion)
+    },
+    congestion_event: |congestion, _, _, _, _| {
+        reset_unchecked_congestion_window(congestion)
+    },
+    checkpoint: reset_unchecked_congestion_window,
+    rollback: |congestion| {
+        reset_unchecked_congestion_window(congestion);
+        true
+    },
+    #[cfg(feature = "qlog")]
+    state_str: |_, _| "congestion_window_unchecked",
+    debug_fmt: |_, _| Ok(()),
+};
+
+#[cfg(feature = "congestion_window_unchecked_available")]
+fn reset_unchecked_congestion_window(congestion: &mut Congestion) {
+    congestion.congestion_window = congestion.unchecked_congestion_window;
+}
+
 impl From<CongestionControlAlgorithm> for &'static CongestionControlOps {
     fn from(algo: CongestionControlAlgorithm) -> Self {
         match algo {
@@ -293,13 +331,80 @@ impl From<CongestionControlAlgorithm> for &'static CongestionControlOps {
             // LegacyRecovery never gets a RecoveryConfig with the
             // Bbr2Gcongestion algorithm.
             CongestionControlAlgorithm::Bbr2Gcongestion => unreachable!(),
+            #[cfg(feature = "congestion_window_unchecked_available")]
+            CongestionControlAlgorithm::CongestionWindowUnchecked =>
+                &CONGESTION_WINDOW_UNCHECKED,
         }
     }
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
+    #[cfg(feature = "congestion_window_unchecked_available")]
+    use crate::test_utils;
+    #[cfg(feature = "congestion_window_unchecked_available")]
+    use crate::Config;
+    #[cfg(feature = "congestion_window_unchecked_available")]
+    use rstest::rstest;
+    #[cfg(feature = "congestion_window_unchecked_available")]
+    use std::time::Duration;
+
+    #[cfg(feature = "congestion_window_unchecked_available")]
+    #[rstest]
+    fn unchecked_window_is_restored_by_callbacks(
+        #[values(usize::MAX, 40 * 1024 * 1024)] window: usize,
+    ) {
+        let mut config = Config::new(crate::PROTOCOL_VERSION)
+            .expect("create transport configuration");
+        config.set_cc_algorithm(
+            CongestionControlAlgorithm::CongestionWindowUnchecked,
+        );
+        config.set_unchecked_congestion_window(window);
+        let mut congestion =
+            Congestion::from_config(&RecoveryConfig::from_config(&config));
+        assert_eq!(congestion.congestion_window(), window);
+
+        let callbacks: [fn(&mut Congestion); 5] = [
+            |congestion| {
+                (congestion.cc_ops.on_packet_sent)(
+                    congestion,
+                    1_200,
+                    0,
+                    Instant::now(),
+                );
+            },
+            |congestion| {
+                (congestion.cc_ops.on_packets_acked)(
+                    congestion,
+                    0,
+                    &mut Vec::new(),
+                    Instant::now(),
+                    &RttStats::new(
+                        Duration::from_millis(100),
+                        Duration::from_millis(25),
+                    ),
+                );
+            },
+            |congestion| {
+                let now = Instant::now();
+                let packet = test_utils::helper_packet_sent(0, now, 1_200);
+                (congestion.cc_ops.congestion_event)(
+                    congestion, 1_200, 1_200, &packet, now,
+                );
+            },
+            |congestion| (congestion.cc_ops.checkpoint)(congestion),
+            |congestion| {
+                assert!((congestion.cc_ops.rollback)(congestion));
+            },
+        ];
+
+        for callback in callbacks {
+            congestion.congestion_window = 0;
+            callback(&mut congestion);
+            assert_eq!(congestion.congestion_window(), window);
+        }
+    }
 
     #[test]
     fn ssthresh_init() {

quiche/src/recovery/congestion/recovery.rs

@@ -953,6 +953,7 @@ impl RecoveryOps for LegacyRecovery {
         }
 
         self.max_datagram_size = new_max_datagram_size;
+        (self.congestion.cc_ops.on_mtu_update)(&mut self.congestion);
     }
 
     fn update_max_datagram_size(&mut self, new_max_datagram_size: usize) {