You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
option(LWS_WITH_SYS_ASYNC_DNS"Nonblocking internal IPv4 + IPv6 DNS resolver"OFF)
187
+
if (LWS_WITH_HTTP3)
188
+
set(LWS_WITH_SYS_ASYNC_DNS 1)
189
+
endif()
182
190
option(LWS_WITH_SYS_ASYNC_DNS_DNSSEC"Include DNSSEC parsing/validation in async-dns (requires crypto)"OFF)
183
191
option(LWS_WITH_AUTHORITATIVE_DNS"Authoritative DNS zone signer / server"OFF)
184
192
option(LWS_WITH_SYS_NTPCLIENT"Build in tiny ntpclient good for tls date validation and run via lws_system"OFF)
@@ -238,13 +246,30 @@ option(LWS_WITH_SSL "Include SSL support (defaults to OpenSSL or similar, mbedTL
238
246
option(LWS_WITH_MBEDTLS"Use mbedTLS (>=2.0) replacement for OpenSSL. When setting this, you also may need to specify LWS_MBEDTLS_LIBRARIES and LWS_MBEDTLS_INCLUDE_DIRS"OFF)
239
247
option(LWS_WITH_BEARSSL"Use BearSSL replacement for OpenSSL. When setting this, you also may need to specify LWS_BEARSSL_LIBRARIES and LWS_BEARSSL_INCLUDE_DIRS"OFF)
240
248
set(LWS_BEARSSL_PROFILE "full"CACHESTRING"BearSSL profile to use (e.g. full, client, minimal)")
241
-
if (WIN32)
242
-
option(LWS_WITH_SCHANNEL"Use Windows SChannel for SSL"OFF)
243
-
endif()
244
249
option(LWS_WITH_BORINGSSL"Use BoringSSL replacement for OpenSSL"OFF)
245
-
option(LWS_WITH_GNUTLS"Use GnuTLS for SSL"OFF)
250
+
option(LWS_WITH_AWSLC"Use AWSLC replacement for OpenSSL"OFF)
246
251
option(LWS_WITH_CYASSL"Use CyaSSL replacement for OpenSSL. When setting this, you also need to specify LWS_CYASSL_LIBRARIES and LWS_CYASSL_INCLUDE_DIRS"OFF)
247
252
option(LWS_WITH_WOLFSSL"Use wolfSSL replacement for OpenSSL. When setting this, you also may need to specify LWS_WOLFSSL_LIBRARIES and LWS_WOLFSSL_INCLUDE_DIRS"OFF)
253
+
254
+
if (LWS_WITH_BEARSSL)
255
+
set(LWS_ROLE_QUIC 0)
256
+
set(LWS_WITH_HTTP3 0)
257
+
endif()
258
+
259
+
if (WIN32ANDNOT (LWS_WITH_BORINGSSL OR LWS_WITH_AWSLC OR LWS_WITH_MBEDTLS OR LWS_WITH_WOLFSSL OR LWS_WITH_CYASSL OR LWS_WITH_BEARSSL OR LWS_WITH_GNUTLS))
260
+
set(LWS_SCHANNEL_DEFAULT ON)
261
+
else()
262
+
set(LWS_SCHANNEL_DEFAULT OFF)
263
+
endif()
264
+
if (WIN32)
265
+
option(LWS_WITH_SCHANNEL"Use Windows SChannel for SSL"${LWS_SCHANNEL_DEFAULT})
266
+
endif()
267
+
268
+
if (LWS_ROLE_QUIC ANDNOT (LWS_WITH_BORINGSSL OR LWS_WITH_AWSLC OR LWS_WITH_MBEDTLS OR LWS_WITH_WOLFSSL OR LWS_WITH_CYASSL OR LWS_WITH_BEARSSL OR LWS_WITH_SCHANNEL OR ESP_PLATFORM OR LWS_WITH_ESP32))
269
+
option(LWS_WITH_GNUTLS"Use GnuTLS for SSL"ON)
270
+
else()
271
+
set(LWS_WITH_GNUTLS OFFCACHEBOOL"Use GnuTLS for SSL"FORCE)
272
+
endif()
248
273
option(LWS_SSL_CLIENT_USE_OS_CA_CERTS"SSL support should make use of the OS-installed CA root certs"ON)
249
274
option(LWS_TLS_LOG_PLAINTEXT_RX"For debugging log the received plaintext as soon as decrypted"OFF)
250
275
option(LWS_TLS_LOG_PLAINTEXT_TX"For debugging log the transmitted plaintext just before encryption"OFF)
\**Note: Upstream OpenSSL does not provide the necessary QUIC TLS API (`SSL_set_quic_method`) to act as a cryptographic engine for LWS's QUIC transport. If you need QUIC/HTTP3 support, we recommend using BoringSSL, GnuTLS, WolfSSL, or the `quictls` fork of OpenSSL.*
24
+
25
+
23
26
- DHT support built-in: `-DLWS_WITH_DHT=1`
24
27
25
28
** v4.5 is released, you can follow it on v4.5-stable **
libwebsockets supports QUIC 0-RTT (Early Data) to allow clients to send data before the TLS 1.3 handshake fully completes, reducing latency for resuming connections.
4
+
5
+
Because 0-RTT data is susceptible to replay attacks, the implementation uses an explicit opt-in model. Existing applications using QUIC or HTTP/3 will ignore 0-RTT by default and continue operating with the standard `LWS_CALLBACK_CLIENT_ESTABLISHED`.
6
+
7
+
## How it works
8
+
9
+
When a client connection initiates a handshake with a server it has previously connected to, it can attempt to send 0-RTT data using early TLS secrets.
10
+
- If the server accepts it, the client's 0-RTT data is processed immediately.
11
+
- If the server rejects it, the connection falls back to the standard 1-RTT handshake.
12
+
13
+
## Enabling 0-RTT
14
+
15
+
To enable 0-RTT capabilities on a connection, both the client and server must explicitly allow it using flags and options:
16
+
17
+
### Client
18
+
19
+
When creating a client connection, set the `LCCSCF_ALLOW_EARLY_DATA` flag in the `ssl_connection` member of your `struct lws_client_connect_info`:
* Return 1 to opt-in and become writable immediately.
58
+
* Return 0 (default) to ignore 0-RTT.
59
+
*/
60
+
return 1;
61
+
62
+
case LWS_CALLBACK_CLIENT_ESTABLISHED:
63
+
/* The traditional handshake has completed. */
64
+
break;
65
+
66
+
// ...
67
+
}
68
+
return 0;
69
+
}
70
+
```
71
+
72
+
If you return `1`, the stream opts into 0-RTT, and LWS will immediately call `lws_callback_on_writable(wsi)` for that stream so you can send your early data payload.
73
+
74
+
> [!NOTE]
75
+
> Opting into 0-RTT does not skip the normal `LWS_CALLBACK_CLIENT_ESTABLISHED`. You will still receive `LWS_CALLBACK_CLIENT_ESTABLISHED` when the QUIC handshake actually completes.
76
+
77
+
## Handling Rejection and Idempotency
78
+
79
+
### Client-side Rejection Status
80
+
81
+
Since 0-RTT can be rejected by the server (e.g. if the server lost its session ticket keys), the client needs to know if the early data it sent was actually accepted.
82
+
You can query the status of 0-RTT using the `lws_tls_0rtt_status(wsi)` API:
83
+
84
+
```c
85
+
enum lws_0rtt_status status = lws_tls_0rtt_status(wsi);
86
+
87
+
if (status == LWS_0RTT_STATUS_REJECTED) {
88
+
/* 0-RTT was rejected by the server. Any early data sent must be re-sent. */
89
+
}
90
+
```
91
+
92
+
### Server-side Idempotency
93
+
94
+
Because 0-RTT data can be intercepted and replayed by attackers, servers MUST ensure that any actions taken based on 0-RTT data are strictly idempotent (e.g., HTTP GET requests without side effects).
95
+
96
+
Servers can check if incoming data was received during the 0-RTT phase by calling `lws_rx_is_early_data(wsi)`:
97
+
98
+
```c
99
+
if (lws_rx_is_early_data(wsi)) {
100
+
/* Data was received via 0-RTT. Enforce idempotency!
101
+
* Do not process state-changing requests like POST or DELETE here.
lws uses `h3spec` to validate its QUIC and HTTP/3 implementation against the RFCs. The `ctest` infrastructure automatically discovers and runs the `h3spec` test suite against the `lws-minimal-quic-client-server` test application if the `h3spec` executable is found in your system's `PATH`.
205
+
206
+
### Enabling `h3spec` tests in CI or locally
207
+
208
+
To enable`h3spec` testing, simply download the pre-compiled static binary foryour platform from the [h3spec GitHub releases](https://github.com/kazu-yamamoto/h3spec/releases) and place it somewherein your `PATH` (e.g., `/usr/local/bin`).
Once installed, re-run `cmake` on your lws build directory so it can discover the `h3spec` executable. Then, simply run `ctest` (or `make test`) as usual. The `h3spec`test will spawn a temporary test server in the background, run the compliance suite, and tear down the server automatically.
218
+
219
+
---
220
+
221
+
## Congestion Control
222
+
223
+
Libwebsockets features a pluggable QUIC Congestion Control architecture. By default, it uses a New Reno algorithm, but we also provide an implementation of CUBIC.
224
+
225
+
### Selecting a Congestion Control Algorithm
226
+
227
+
You can selectthe congestion control algorithm used forthe context by configuring `quic_cc_ops`in`struct lws_context_creation_info`. We export two built-in implementations natively in`lws-quic.h`:
0 commit comments