TASK-196: Isolate unauthenticated QUIC traffic and mark task complete

Author: etr

specs/tasks/M14-v3-release-repairs/TASK-196.md

@@ -25,6 +25,6 @@
 - Blocks: TASK-197, TASK-185
 **Related Requirements:** PRD-V3N-REQ-003, PRD-V3N-REQ-007, PRD-V3N-REQ-008, PRD-V3N-REQ-009, PRD-V3N-REQ-014, PRD-V3N-REQ-015, PRD-V3N-REQ-016, PRD-V3N-REQ-021, PRD-V3N-REQ-025, PRD-V3N-REQ-027, PRD-V3N-REQ-034, PRD-V3N-REQ-037.
 **Related Decisions:** DR-V3-001, DR-V3-002, DR-V3-004, DR-V3-006, DR-V3-007, DR-V3-008.
-**Status:** In Progress
+**Status:** Complete
 
-**Implementation evidence:** [TASK-196-design.md](../../architecture/v3/TASK-196-design.md) documents ownership and bounded lifecycle decisions. [TASK-196-implementation-evidence.md](../../architecture/v3/TASK-196-implementation-evidence.md) and [TASK-196-receipt.json](../../architecture/v3/TASK-196-receipt.json) record completed local native/public/capture/sanitizer gates and exact proof reuse scope. The pinned simulator clock compatibility and original failed attempts remain explicit. Caller-owned Groundwork validation/finalization, merge and cleanup remain pending; task status stays In Progress. Nonlocal BSD/macOS/Windows execution belongs to CI and the v3 PR.
+**Implementation evidence:** [TASK-196-design.md](../../architecture/v3/TASK-196-design.md) documents ownership and bounded lifecycle decisions. [TASK-196-implementation-evidence.md](../../architecture/v3/TASK-196-implementation-evidence.md) and [TASK-196-receipt.json](../../architecture/v3/TASK-196-receipt.json) record completed local native/public/capture/sanitizer gates and exact proof reuse scope. The pinned simulator clock compatibility and original failed attempts remain explicit. Groundwork validation passed in two iterations on 2026-10-11. Both required unauthenticated-packet isolation repairs passed regression, normal/ASan/UBSan/TSan, all 12 refreshed installed public HTTP/3 cells and the affected 2,000-run callback fuzz gate. The original implementation receipt remains historical; validation and repair receipts are archived in `build/task196-evidence/`. Two approved review observations remain recorded in [the validation notes](../../unworked_review_issues/task-196_validation_a7750fef553d70aa25d6309cee70d461.md). Local completion is validated for integration into `v3`. Nonlocal BSD/macOS/Windows execution belongs to CI and the v3 PR.

specs/tasks/_index.md

@@ -343,7 +343,7 @@ Nominally: **13 sequential tasks**, each S–XL. Most other tasks parallelize of
 | TASK-193 | [Install public credentials and serve native TCP TLS](M14-v3-release-repairs/TASK-193.md) | M14 | Complete | TASK-192 |
 | TASK-194 | [Complete public TLS profiles, live rotation and ACME selection](M14-v3-release-repairs/TASK-194.md) | M14 | Complete | TASK-193 |
 | TASK-195 | [Route negotiated public HTTP/2 streams through native listeners](M14-v3-release-repairs/TASK-195.md) | M14 | Complete | TASK-190, TASK-194 |
-| TASK-196 | [Add production UDP QUIC ownership and public HTTP/3 routing](M14-v3-release-repairs/TASK-196.md) | M14 | In Progress | TASK-191, TASK-193, TASK-195 |
+| TASK-196 | [Add production UDP QUIC ownership and public HTTP/3 routing](M14-v3-release-repairs/TASK-196.md) | M14 | Complete | TASK-191, TASK-193, TASK-195 |
 | TASK-197 | [Complete public HTTP/3 lifecycle, policy and WebSocket parity](M14-v3-release-repairs/TASK-197.md) | M14 | Not Started | TASK-194, TASK-196 |
 | TASK-198 | [Provide native public throughput and latency benchmarks](M14-v3-release-repairs/TASK-198.md) | M14 | Not Started | TASK-195, TASK-197 |
 | TASK-199 | [Deliver packaged public-capability and benchmark adapters for release execution](M14-v3-release-repairs/TASK-199.md) | M14 | Not Started | TASK-198 |

specs/unworked_review_issues/task-196_validation_a7750fef553d70aa25d6309cee70d461.md

@@ -0,0 +1,17 @@
+# Unworked Review Issues
+
+**Run:** 2026-10-11 00:35:26
+**Task:** TASK-196
+**Total:** 2 (0 critical, 1 major, 1 minor)
+
+## Major
+
+1. [ ] **test-quality-reviewer** | `test/integ/http3-client-go/public.go:310` | missing-test
+   The independent destruction witness reports passed for every publicRead error. publicOpen sets a three-second stream deadline, so a server that leaves the held stream unresolved and never closes or resets it still produces a timeout and reaches status=passed. Protocol/decoder errors are also accepted. This weakens TASK-196’s active-stream destruction/cancellation witness; the stricter aioquic test does not make this independent-client predicate valid.
+   *Recommendation:* Require an observed remote QUIC connection-close or stream cancellation with the expected shutdown semantics; reject deadline/context timeout and decoding errors. Add a bounded negative witness using a peer that keeps the stream open without closing/resetting it, and require that witness to fail rather than emit a passing destruction result.
+
+## Minor
+
+2. [ ] **performance-reviewer** | `src/detail/quic_network_packets.cpp:51` | memory-allocation
+   Every receive_packet call value-initializes two 65,536-byte automatic buffers, clearing 128 KiB on the packet hot path even though the production UDP reader caps datagrams at 2,048 bytes. This is bounded and does not block basic routing, but adds avoidable stack footprint and memory traffic, including for failed authentication.
+   *Recommendation:* Measure this cost in TASK-198/199 packet-throughput profiles. If material, right-size the buffers to an explicit accepted-datagram bound or reuse owner-serialized scratch storage, preserving capacity rejection, authenticated output lengths, and the crypto scratch wiping contract.

src/detail/quic_network_connection.cpp

@@ -80,11 +80,12 @@ void quic_network_connection::adopt_routes(quic_datagram_dispatch& routes, io_co
     quic_datagram_dispatch::cid_registration initial) {
     require(static_cast<bool>(identity_->attach_routes(routes, owner, std::make_shared<weak_sink>(weak_from_this()), std::move(initial))), "CID registration failed");
 }
-void quic_network_connection::queue_datagram(std::shared_ptr<const io_datagram> packet, clock_type::time_point now) {
+void quic_network_connection::queue_datagram(std::shared_ptr<const io_datagram> packet) {
     server::reservation storage;
+    // Capacity pressure from unauthenticated ciphertext only discards input.
     if (received_.size() == 16 || received_bytes_ + packet->bytes.size() > 32768 ||
         !pool_.data().budget.reserve(server::resource::quic_reassembly_bytes, packet->bytes.size() + sizeof(queued_packet), storage).ok()) {
-        request_close({false, 0x01, 0, {}}, now); return;
+        return;
     }
     received_bytes_ += packet->bytes.size();
     received_.push_back({std::move(packet), std::move(storage)});
@@ -123,7 +124,7 @@ void quic_network_connection::on_datagram(std::shared_ptr<const io_datagram> pac
     const auto now = clock_type::now();
     try {
         if (pending()) {
-            queue_datagram(std::move(packet), now);
+            queue_datagram(std::move(packet));
             return;
         }
         if (receiving_ || lifecycle_.state() == quic_lifecycle_state::closed || lifecycle_.state() == quic_lifecycle_state::draining) return;

src/detail/quic_network_packets.cpp

@@ -46,6 +46,10 @@ decoded_frames decode_authenticated_frames(std::span<const std::byte> payload, q
 }  // namespace
 bool quic_network_connection::receive_packet(std::span<const std::byte> packet, const quic_path_identity& path, std::size_t credit, bool& accounted, clock_type::time_point now) {
     auto envelope = parse_quic_envelope(packet, server_cid_.size());
+    // Disabled 0-RTT and server-only packet types cannot select a receive space.
+    if (envelope.code != quic_codec_code::ok ||
+        (envelope.value.kind != quic_packet_kind::initial && envelope.value.kind != quic_packet_kind::handshake &&
+         envelope.value.kind != quic_packet_kind::one_rtt)) return false;
     auto space = packet_space(envelope.value.kind);
     auto index = static_cast<unsigned>(space);
     std::array<std::byte, 65536> plain{}, scratch{};

src/httpserver/detail/quic_network_connection.hpp

@@ -52,7 +52,7 @@ class quic_network_connection final : public datagram_sink, public std::enable_s
  private:
     bool credit_datagram(const io_datagram&, const quic_path_identity&);
     void signal_progress();
-    void queue_datagram(std::shared_ptr<const io_datagram>, clock_type::time_point);
+    void queue_datagram(std::shared_ptr<const io_datagram>);
     void receive_datagram(const io_datagram&, const quic_path_identity&, bool&, clock_type::time_point);
     void inspect_reset(const io_datagram&, clock_type::time_point);
     bool retire_application();

test/unit/quic_native_owner_test.cpp

@@ -1,9 +1,11 @@
 /* Copyright (C) 2026 Sebastiano Merlino; SPDX-License-Identifier: LGPL-2.1-or-later */
 #include <array>
+#include <algorithm>
 #include <chrono>
 #include <memory>
 #include <stdexcept>
 #include <thread>
+#include <utility>
 #include <vector>
 #include <httpserver/detail/fake_io_backend.hpp>
 #include <httpserver/detail/quic_network_connection.hpp>
@@ -26,7 +28,7 @@ struct fixture {
     std::shared_ptr<hd::io_datagram> packet;
     hd::quic_admission_facts facts;
     std::shared_ptr<hd::quic_network_connection> owner;
-    explicit fixture(bool adopt = false) {
+    explicit fixture(bool adopt = false, std::size_t data_bytes = 393216) {
         if (!credentials.replace(quic_test::credentials()).ok() || !hs::route_registry::create(root, routes).ok()) throw std::runtime_error("native fixture setup");
         if (SSL_set1_groups_list(peer.ssl.get(), "X25519") != 1) throw std::runtime_error("native test group");
         const std::array<std::byte, 1> source{std::byte{7}};
@@ -48,7 +50,7 @@ struct fixture {
         admission = std::make_unique<hd::quic_server_admission>(limits);
         const auto pending = admission->receive(packet, 0); const auto seen = admission->inspect(pending.pending);
         if (!seen) throw std::runtime_error("native Initial admission"); facts = *seen;
-        hd::quic_network_config config; config.data_bytes = config.critical_bytes = 393216;
+        hd::quic_network_config config; config.data_bytes = data_bytes; config.critical_bytes = 393216;
         owner = std::make_shared<hd::quic_network_connection>(credentials.acquire()->select_default(), facts, routes, executor, 1, policy, root, config, hd::request_dispatch_context{}, hd::http3_native_context{});
         if (adopt) {
             auto promotion = admission->promote(pending.pending, io.datagrams(), owner->route_sink(), 0);
@@ -106,6 +108,51 @@ struct fixture {
         if (sealed.code != hd::quic_crypto_code::ok) throw std::runtime_error("native client protection");
         result->bytes.resize(sealed.consumed); return result;
     }
+    std::shared_ptr<hd::io_datagram> unsupported_packet(hd::quic_packet_kind kind) {
+        const std::array<std::byte, 16> tag{};
+        const std::array<std::byte, 4> payload{}, versions{std::byte{0}, std::byte{0}, std::byte{0}, std::byte{1}};
+        const std::array<std::byte, 1> source{std::byte{7}}, token{std::byte{1}};
+        hd::quic_packet_write write; write.kind = kind;
+        write.destination = std::span(facts.destination.bytes).first(facts.destination.size); write.source = source;
+        if (kind == hd::quic_packet_kind::version_negotiation) {
+            write.versions = versions;
+        } else {
+            write.tag = tag;
+            if (kind == hd::quic_packet_kind::retry) write.token = token;
+            else write.payload = payload;
+        }
+        auto result = std::make_shared<hd::io_datagram>(*packet);
+        auto encoded = hd::encode_quic_packet(write, result->bytes);
+        if (encoded.code != hd::quic_codec_code::ok) throw std::runtime_error("native unsupported packet");
+        result->bytes.resize(encoded.consumed); result->peer.peer.port = 4999; return result;
+    }
+    bool ping_acknowledged() {
+        const auto number = next_number[2];
+        const std::array<hd::quic_frame, 1> ping{hd::quic_ping_frame{}};
+        owner->on_datagram(protected_frames(ping));
+        const auto now = std::chrono::steady_clock::now() + std::chrono::milliseconds(25);
+        owner->tick(now);
+        const auto output = owner->prepare(now);
+        if (!output) return false;
+        owner->emitted(true, now);
+        auto remaining = std::span(output->bytes);
+        while (!remaining.empty()) {
+            const auto envelope = hd::parse_quic_envelope(remaining, 1);
+            if (envelope.code != hd::quic_codec_code::ok) throw std::runtime_error("native continuation envelope");
+            const unsigned level = envelope.value.kind == hd::quic_packet_kind::initial ? 0 : envelope.value.kind == hd::quic_packet_kind::handshake ? 1 : 2;
+            std::array<std::byte, 1600> plain{}, scratch{};
+            const auto opened = client_keys.open_packet(static_cast<hd::quic_key_level>(level), envelope.value.packet, 1, largest[level], true, plain, scratch);
+            if (opened.code != hd::quic_crypto_code::ok) throw std::runtime_error("native continuation authentication");
+            hd::quic_frame_cursor cursor;
+            while (cursor.offset < opened.payload_size) {
+                const auto frame = hd::next_quic_frame(std::span(plain).first(opened.payload_size), cursor, {envelope.value.kind, hd::quic_endpoint_role::server});
+                if (frame.code != hd::quic_codec_code::ok) throw std::runtime_error("native continuation frame");
+                if (const auto* ack = std::get_if<hd::quic_ack_frame>(&frame.value); level == 2 && ack && ack->largest == number) return true;
+            }
+            remaining = remaining.subspan(envelope.consumed);
+        }
+        return false;
+    }
     void consume_server(const hd::quic_transmission& transmission) {
         auto remaining = std::span(transmission.bytes);
         while (!remaining.empty()) {
@@ -192,21 +239,56 @@ LT_BEGIN_AUTO_TEST(native_quic_suite, actual_operation_completion_settles_prepar
         LT_CHECK(!backend.complete(*ops[0], {})); backend.close(); f.executor.run_pending();
     }
 LT_END_AUTO_TEST(actual_operation_completion_settles_preparation_once_without_ambiguous_refund)
-LT_BEGIN_AUTO_TEST(native_quic_suite, received_datagrams_wait_for_pending_send_and_overflow_closes_bounded_owner)
+LT_BEGIN_AUTO_TEST(native_quic_suite, unsupported_packets_for_established_cid_are_discarded_without_closing)
+    for (const auto kind : {hd::quic_packet_kind::zero_rtt, hd::quic_packet_kind::retry, hd::quic_packet_kind::version_negotiation}) {
+        fixture f(true); f.connect();
+        const auto forged = f.unsupported_packet(kind);
+        const auto envelope = hd::parse_quic_envelope(forged->bytes);
+        LT_ASSERT(envelope.code == hd::quic_codec_code::ok); LT_CHECK(envelope.value.kind == kind);
+        const auto received = f.facts.budget->received(); const auto debit = f.facts.budget->debited();
+        LT_CHECK(f.admission->receive(forged, 0).code == hd::quic_admission_code::routed); f.executor.run_pending();
+        LT_CHECK(!f.owner->terminal()); LT_CHECK(f.owner->connected());
+        LT_CHECK_EQ(f.facts.budget->received(), received); LT_CHECK_EQ(f.facts.budget->debited(), debit);
+        LT_CHECK(f.ping_acknowledged());
+    }
+LT_END_AUTO_TEST(unsupported_packets_for_established_cid_are_discarded_without_closing)
+LT_BEGIN_AUTO_TEST(native_quic_suite, received_datagrams_wait_for_pending_send_before_accounting)
     fixture f; const auto now = std::chrono::steady_clock::now();
     auto output = f.owner->prepare(now); LT_ASSERT(output);
     const auto received = f.facts.budget->received();
     f.owner->on_datagram(std::make_shared<hd::io_datagram>(*f.packet)); LT_CHECK_EQ(f.facts.budget->received(), received);
     f.owner->emitted(hd::quic_identity_emission::sent, now); f.owner->tick(now);
     LT_CHECK_EQ(f.facts.budget->received(), received + f.packet->bytes.size());
-    output = f.owner->prepare(now); if (!output) output = f.owner->prepare(now + std::chrono::milliseconds(20));
-    LT_ASSERT(output);
-    for (unsigned n = 0; n < 17; ++n) f.owner->on_datagram(std::make_shared<hd::io_datagram>(*f.packet));
-    LT_CHECK(f.owner->terminal()); LT_CHECK(f.owner->pending());
-    LT_CHECK(f.root.in_use(hs::resource::quic_reassembly_bytes) <= f.root.capacity(hs::resource::quic_reassembly_bytes));
-    f.owner->emitted(hd::quic_identity_emission::ambiguous, now); f.owner->tick(now + std::chrono::minutes(1));
-    LT_CHECK(f.owner->retired()); f.owner.reset(); LT_CHECK_EQ(f.root.in_use(hs::resource::quic_reassembly_bytes), 0u);
-LT_END_AUTO_TEST(received_datagrams_wait_for_pending_send_and_overflow_closes_bounded_owner)
+LT_END_AUTO_TEST(received_datagrams_wait_for_pending_send_before_accounting)
+LT_BEGIN_AUTO_TEST(native_quic_suite, unauthenticated_queue_pressure_drops_excess_and_preserves_established_owner)
+    struct pressure_case { std::size_t data_bytes, packet_bytes, retained_packets; };
+    // Record limit, exact byte limit, and storage reservation exhaustion.
+    for (const auto test : {pressure_case{393216, 64, 16}, pressure_case{393216, 16384, 2}, pressure_case{32768, 32768, 0}}) {
+        fixture f(true, test.data_bytes); f.connect();
+        const auto now = std::chrono::steady_clock::now();
+        const auto output = f.owner->prepare(now); LT_ASSERT(output);
+        const auto received = f.facts.budget->received(); const auto debit = f.facts.budget->debited();
+        const std::array<hd::quic_frame, 1> ping{hd::quic_ping_frame{}};
+        auto forged = f.protected_frames(ping); forged->bytes.back() ^= std::byte{1};
+        forged->bytes.resize(test.packet_bytes); forged->peer.peer.port = 4999;
+        std::vector<std::weak_ptr<hd::io_datagram>> retained;
+        for (std::size_t n = 0; n < test.retained_packets; ++n) {
+            auto packet = std::make_shared<hd::io_datagram>(*forged); retained.push_back(packet);
+            LT_CHECK(f.admission->receive(std::move(packet), 0).code == hd::quic_admission_code::routed); f.executor.run_pending();
+            LT_CHECK(!retained.back().expired());
+        }
+        auto excess = std::make_shared<hd::io_datagram>(*forged); const auto dropped = std::weak_ptr(excess);
+        LT_CHECK(f.admission->receive(std::move(excess), 0).code == hd::quic_admission_code::routed); f.executor.run_pending();
+        LT_CHECK(dropped.expired()); LT_CHECK(!f.owner->terminal()); LT_CHECK(f.owner->pending());
+        LT_CHECK_EQ(f.facts.budget->received(), received); LT_CHECK_EQ(f.facts.budget->debited(), debit);
+        LT_CHECK(f.root.in_use(hs::resource::quic_reassembly_bytes) <= f.root.capacity(hs::resource::quic_reassembly_bytes));
+        f.owner->emitted(hd::quic_identity_emission::ambiguous, now); f.owner->tick(now);
+        LT_CHECK(!f.owner->pending()); LT_CHECK(!f.owner->terminal());
+        for (const auto& packet : retained) LT_CHECK(packet.expired());
+        LT_CHECK(f.ping_acknowledged());
+        f.owner.reset(); LT_CHECK_EQ(f.root.in_use(hs::resource::quic_reassembly_bytes), 0u);
+    }
+LT_END_AUTO_TEST(unauthenticated_queue_pressure_drops_excess_and_preserves_established_owner)
 LT_BEGIN_AUTO_TEST(native_quic_suite, close_expiry_keeps_cid_routes_and_pending_storage_until_settlement)
     fixture f(true); const auto now = std::chrono::steady_clock::now();
     const auto packet = f.owner->prepare(now); LT_ASSERT(packet);
@@ -226,6 +308,15 @@ LT_BEGIN_AUTO_TEST(native_quic_suite, authenticated_frame_flood_refuses_before_u
     f.owner->tick(std::chrono::steady_clock::now() + std::chrono::minutes(1));
     LT_CHECK(f.owner->retired());
 LT_END_AUTO_TEST(authenticated_frame_flood_refuses_before_unbounded_frame_storage)
+LT_BEGIN_AUTO_TEST(native_quic_suite, authenticated_application_frame_flood_still_closes_established_owner)
+    fixture f(true); f.connect();
+    std::array<hd::quic_frame, 129> frames;
+    std::fill(frames.begin(), frames.end(), hd::quic_ping_frame{});
+    LT_CHECK(f.admission->receive(f.protected_frames(frames), 0).code == hd::quic_admission_code::routed); f.executor.run_pending();
+    LT_CHECK(f.owner->terminal());
+    f.owner->tick(std::chrono::steady_clock::now() + std::chrono::minutes(1));
+    LT_CHECK(f.owner->retired());
+LT_END_AUTO_TEST(authenticated_application_frame_flood_still_closes_established_owner)
 LT_BEGIN_AUTO_TEST(native_quic_suite, cid_registration_does_not_own_connection_or_form_a_retirement_cycle)
     fixture f(true); const auto weak = std::weak_ptr(f.owner);
     f.owner.reset(); LT_CHECK(weak.expired());