chore: checkpoint before Python removal

vendor/quinn/examples/README.md

@@ -0,0 +1,92 @@
+## HTTP/0.9 File Serving Example
+
+The `server` and `client` examples demonstrate fetching files using a HTTP-like toy protocol.
+
+1. Server (`server.rs`)
+
+The server listens for any client requesting a file. 
+If the file path is valid and allowed, it returns the contents. 
+
+Open up a terminal and execute:
+
+```text
+$ cargo run --example server ./
+```
+
+2. Client (`client.rs`)
+
+The client requests a file and prints it to the console. 
+If the file is on the server, it will receive the response. 
+
+In a new terminal execute:
+
+```test
+$ cargo run --example client https://localhost:4433/Cargo.toml
+```
+
+where `Cargo.toml` is any file in the directory passed to the server.
+
+**Result:**
+
+The output will be the contents of this README.
+
+**Troubleshooting:**
+
+If the client times out with no activity on the server, try forcing the server to run on IPv4 by
+running it with `cargo run --example server -- ./ --listen 127.0.0.1:4433`. The server listens on
+IPv6 by default, `localhost` tends to resolve to IPv4, and support for accepting IPv4 packets on
+IPv6 sockets varies between platforms.
+
+If the client prints `failed to process request: failed reading file`, the request was processed
+successfully but the path segment of the URL did not correspond to a file in the directory being
+served.
+
+## Minimal Example
+The `connection.rs` example intends to use the smallest amount of code to make a simple QUIC connection.
+The server issues it's own certificate and passes it to the client to trust.
+
+```text
+$ cargo run --example connection
+```
+
+This example will make a QUIC connection on localhost, and you should see output like:
+
+```text
+[client] connected: addr=127.0.0.1:5000
+[server] connection accepted: addr=127.0.0.1:53712
+```
+
+## Insecure Connection Example
+
+The `insecure_connection.rs` example demonstrates how to make a QUIC connection that ignores the server certificate.
+
+```text
+$ cargo run --example insecure_connection --features="rustls/dangerous_configuration"
+```
+
+## Single Socket Example
+
+You can have multiple QUIC connections over a single UDP socket. This is especially
+useful, if you are building a peer-to-peer system where you potentially need to communicate with
+thousands of peers or if you have a
+[hole punched](https://en.wikipedia.org/wiki/UDP_hole_punching) UDP socket.
+Additionally, QUIC servers and clients can both operate on the same UDP socket.
+This example demonstrates how to make multiple outgoing connections on a single UDP socket.
+
+```text 
+$ cargo run --example single_socket
+```
+
+The expected output should be something like:
+
+```text
+[client] connected: addr=127.0.0.1:5000
+[server] incoming connection: addr=127.0.0.1:48930
+[client] connected: addr=127.0.0.1:5001
+[client] connected: addr=127.0.0.1:5002
+[server] incoming connection: addr=127.0.0.1:48930
+[server] incoming connection: addr=127.0.0.1:48930
+```
+
+Notice how the server sees multiple incoming connections with different IDs coming from the same
+endpoint.

vendor/quinn/examples/client.rs

@@ -0,0 +1,169 @@
+//! This example demonstrates an HTTP client that requests files from a server.
+//!
+//! Checkout the `README.md` for guidance.
+
+use std::{
+    fs,
+    io::{self, Write},
+    net::{SocketAddr, ToSocketAddrs},
+    path::PathBuf,
+    sync::Arc,
+    time::{Duration, Instant},
+};
+
+use anyhow::{Result, anyhow};
+use clap::Parser;
+use proto::crypto::rustls::QuicClientConfig;
+use rustls::pki_types::CertificateDer;
+use tracing::{error, info};
+use url::Url;
+
+mod common;
+
+/// HTTP/0.9 over QUIC client
+#[derive(Parser, Debug)]
+#[clap(name = "client")]
+struct Opt {
+    /// Perform NSS-compatible TLS key logging to the file specified in `SSLKEYLOGFILE`.
+    #[clap(long = "keylog")]
+    keylog: bool,
+
+    url: Url,
+
+    /// Override hostname used for certificate verification
+    #[clap(long = "host")]
+    host: Option<String>,
+
+    /// Custom certificate authority to trust, in DER format
+    #[clap(long = "ca")]
+    ca: Option<PathBuf>,
+
+    /// Simulate NAT rebinding after connecting
+    #[clap(long = "rebind")]
+    rebind: bool,
+
+    /// Address to bind on
+    #[clap(long = "bind", default_value = "[::]:0")]
+    bind: SocketAddr,
+}
+
+fn main() {
+    tracing::subscriber::set_global_default(
+        tracing_subscriber::FmtSubscriber::builder()
+            .with_env_filter(tracing_subscriber::EnvFilter::from_default_env())
+            .finish(),
+    )
+    .unwrap();
+    let opt = Opt::parse();
+    let code = {
+        if let Err(e) = run(opt) {
+            eprintln!("ERROR: {e}");
+            1
+        } else {
+            0
+        }
+    };
+    ::std::process::exit(code);
+}
+
+#[tokio::main]
+async fn run(options: Opt) -> Result<()> {
+    let url = options.url;
+    let url_host = strip_ipv6_brackets(url.host_str().unwrap());
+    let remote = (url_host, url.port().unwrap_or(4433))
+        .to_socket_addrs()?
+        .next()
+        .ok_or_else(|| anyhow!("couldn't resolve to an address"))?;
+
+    let mut roots = rustls::RootCertStore::empty();
+    if let Some(ca_path) = options.ca {
+        roots.add(CertificateDer::from(fs::read(ca_path)?))?;
+    } else {
+        let dirs = directories_next::ProjectDirs::from("org", "quinn", "quinn-examples").unwrap();
+        match fs::read(dirs.data_local_dir().join("cert.der")) {
+            Ok(cert) => {
+                roots.add(CertificateDer::from(cert))?;
+            }
+            Err(ref e) if e.kind() == io::ErrorKind::NotFound => {
+                info!("local server certificate not found");
+            }
+            Err(e) => {
+                error!("failed to open local server certificate: {}", e);
+            }
+        }
+    }
+    let mut client_crypto = rustls::ClientConfig::builder()
+        .with_root_certificates(roots)
+        .with_no_client_auth();
+
+    client_crypto.alpn_protocols = common::ALPN_QUIC_HTTP.iter().map(|&x| x.into()).collect();
+    if options.keylog {
+        client_crypto.key_log = Arc::new(rustls::KeyLogFile::new());
+    }
+
+    let client_config =
+        quinn::ClientConfig::new(Arc::new(QuicClientConfig::try_from(client_crypto)?));
+    let mut endpoint = quinn::Endpoint::client(options.bind)?;
+    endpoint.set_default_client_config(client_config);
+
+    let request = format!("GET {}\r\n", url.path());
+    let start = Instant::now();
+    let rebind = options.rebind;
+    let host = options.host.as_deref().unwrap_or(url_host);
+
+    eprintln!("connecting to {host} at {remote}");
+    let conn = endpoint
+        .connect(remote, host)?
+        .await
+        .map_err(|e| anyhow!("failed to connect: {}", e))?;
+    eprintln!("connected at {:?}", start.elapsed());
+    let (mut send, mut recv) = conn
+        .open_bi()
+        .await
+        .map_err(|e| anyhow!("failed to open stream: {}", e))?;
+    if rebind {
+        let socket = std::net::UdpSocket::bind("[::]:0").unwrap();
+        let addr = socket.local_addr().unwrap();
+        eprintln!("rebinding to {addr}");
+        endpoint.rebind(socket).expect("rebind failed");
+    }
+
+    send.write_all(request.as_bytes())
+        .await
+        .map_err(|e| anyhow!("failed to send request: {}", e))?;
+    send.finish().unwrap();
+    let response_start = Instant::now();
+    eprintln!("request sent at {:?}", response_start - start);
+    let resp = recv
+        .read_to_end(usize::MAX)
+        .await
+        .map_err(|e| anyhow!("failed to read response: {}", e))?;
+    let duration = response_start.elapsed();
+    eprintln!(
+        "response received in {:?} - {} KiB/s",
+        duration,
+        resp.len() as f32 / (duration_secs(&duration) * 1024.0)
+    );
+    io::stdout().write_all(&resp).unwrap();
+    io::stdout().flush().unwrap();
+    conn.close(0u32.into(), b"done");
+
+    // Give the server a fair chance to receive the close packet
+    endpoint.wait_idle().await;
+
+    Ok(())
+}
+
+fn strip_ipv6_brackets(host: &str) -> &str {
+    // An ipv6 url looks like eg https://[::1]:4433/Cargo.toml, wherein the host [::1] is the
+    // ipv6 address ::1 wrapped in brackets, per RFC 2732. This strips those.
+    if host.starts_with('[') && host.ends_with(']') {
+        &host[1..host.len() - 1]
+    } else {
+        host
+    }
+}
+
+fn duration_secs(x: &Duration) -> f32 {
+    x.as_secs() as f32 + x.subsec_nanos() as f32 * 1e-9
+}

vendor/quinn/examples/common/mod.rs

@@ -0,0 +1,73 @@
+#![cfg(any(feature = "rustls-aws-lc-rs", feature = "rustls-ring"))]
+//! Commonly used code in most examples.
+
+use quinn::{ClientConfig, Endpoint, ServerConfig};
+use rustls::pki_types::{CertificateDer, PrivatePkcs8KeyDer};
+
+use std::{error::Error, net::SocketAddr, sync::Arc};
+
+/// Constructs a QUIC endpoint configured for use a client only.
+///
+/// ## Args
+///
+/// - server_certs: list of trusted certificates.
+#[allow(unused)]
+pub fn make_client_endpoint(
+    bind_addr: SocketAddr,
+    server_certs: &[&[u8]],
+) -> Result<Endpoint, Box<dyn Error + Send + Sync + 'static>> {
+    let client_cfg = configure_client(server_certs)?;
+    let mut endpoint = Endpoint::client(bind_addr)?;
+    endpoint.set_default_client_config(client_cfg);
+    Ok(endpoint)
+}
+
+/// Constructs a QUIC endpoint configured to listen for incoming connections on a certain address
+/// and port.
+///
+/// ## Returns
+///
+/// - a stream of incoming QUIC connections
+/// - server certificate serialized into DER format
+#[allow(unused)]
+pub fn make_server_endpoint(
+    bind_addr: SocketAddr,
+) -> Result<(Endpoint, CertificateDer<'static>), Box<dyn Error + Send + Sync + 'static>> {
+    let (server_config, server_cert) = configure_server()?;
+    let endpoint = Endpoint::server(server_config, bind_addr)?;
+    Ok((endpoint, server_cert))
+}
+
+/// Builds default quinn client config and trusts given certificates.
+///
+/// ## Args
+///
+/// - server_certs: a list of trusted certificates in DER format.
+fn configure_client(
+    server_certs: &[&[u8]],
+) -> Result<ClientConfig, Box<dyn Error + Send + Sync + 'static>> {
+    let mut certs = rustls::RootCertStore::empty();
+    for cert in server_certs {
+        certs.add(CertificateDer::from(*cert))?;
+    }
+
+    Ok(ClientConfig::with_root_certificates(Arc::new(certs))?)
+}
+
+/// Returns default server configuration along with its certificate.
+fn configure_server()
+-> Result<(ServerConfig, CertificateDer<'static>), Box<dyn Error + Send + Sync + 'static>> {
+    let cert = rcgen::generate_simple_self_signed(vec!["localhost".into()]).unwrap();
+    let cert_der = CertificateDer::from(cert.cert);
+    let priv_key = PrivatePkcs8KeyDer::from(cert.signing_key.serialize_der());
+
+    let mut server_config =
+        ServerConfig::with_single_cert(vec![cert_der.clone()], priv_key.into())?;
+    let transport_config = Arc::get_mut(&mut server_config.transport).unwrap();
+    transport_config.max_concurrent_uni_streams(0_u8.into());
+
+    Ok((server_config, cert_der))
+}
+
+#[allow(unused)]
+pub const ALPN_QUIC_HTTP: &[&[u8]] = &[b"hq-29"];

vendor/quinn/examples/connection.rs

@@ -0,0 +1,45 @@
+//! This example intends to use the smallest amount of code to make a simple QUIC connection.
+//!
+//! Checkout the `README.md` for guidance.
+
+use std::{
+    error::Error,
+    net::{IpAddr, Ipv4Addr, SocketAddr},
+};
+
+mod common;
+use common::{make_client_endpoint, make_server_endpoint};
+
+#[tokio::main]
+async fn main() -> Result<(), Box<dyn Error + Send + Sync + 'static>> {
+    let server_addr = SocketAddr::new(IpAddr::V4(Ipv4Addr::LOCALHOST), 5000);
+    let (endpoint, server_cert) = make_server_endpoint(server_addr)?;
+    // accept a single connection
+    let endpoint2 = endpoint.clone();
+    tokio::spawn(async move {
+        let incoming_conn = endpoint2.accept().await.unwrap();
+        let conn = incoming_conn.await.unwrap();
+        println!(
+            "[server] connection accepted: addr={}",
+            conn.remote_address()
+        );
+        // Dropping all handles associated with a connection implicitly closes it
+    });
+
+    let endpoint = make_client_endpoint("0.0.0.0:0".parse().unwrap(), &[&server_cert])?;
+    // connect to server
+    let connection = endpoint
+        .connect(server_addr, "localhost")
+        .unwrap()
+        .await
+        .unwrap();
+    println!("[client] connected: addr={}", connection.remote_address());
+
+    // Waiting for a stream will complete with an error when the server closes the connection
+    let _ = connection.accept_uni().await;
+
+    // Make sure the server has a chance to clean up
+    endpoint.wait_idle().await;
+
+    Ok(())
+}

vendor/quinn/examples/insecure_connection.rs

@@ -0,0 +1,118 @@
+//! This example demonstrates how to make a QUIC connection that ignores the server certificate.
+//!
+//! Checkout the `README.md` for guidance.
+
+use std::{
+    error::Error,
+    net::{IpAddr, Ipv4Addr, SocketAddr},
+    sync::Arc,
+};
+
+use proto::crypto::rustls::QuicClientConfig;
+use quinn::{ClientConfig, Endpoint};
+use rustls::pki_types::{CertificateDer, ServerName, UnixTime};
+
+mod common;
+use common::make_server_endpoint;
+
+#[tokio::main]
+async fn main() -> Result<(), Box<dyn Error + Send + Sync + 'static>> {
+    // server and client are running on the same thread asynchronously
+    let addr = SocketAddr::new(IpAddr::V4(Ipv4Addr::LOCALHOST), 8080);
+    tokio::spawn(run_server(addr));
+    run_client(addr).await?;
+    Ok(())
+}
+
+/// Runs a QUIC server bound to given address.
+async fn run_server(addr: SocketAddr) {
+    let (endpoint, _server_cert) = make_server_endpoint(addr).unwrap();
+    // accept a single connection
+    let incoming_conn = endpoint.accept().await.unwrap();
+    let conn = incoming_conn.await.unwrap();
+    println!(
+        "[server] connection accepted: addr={}",
+        conn.remote_address()
+    );
+}
+
+async fn run_client(server_addr: SocketAddr) -> Result<(), Box<dyn Error + Send + Sync + 'static>> {
+    let mut endpoint = Endpoint::client(SocketAddr::new(IpAddr::V4(Ipv4Addr::LOCALHOST), 0))?;
+
+    endpoint.set_default_client_config(ClientConfig::new(Arc::new(QuicClientConfig::try_from(
+        rustls::ClientConfig::builder()
+            .dangerous()
+            .with_custom_certificate_verifier(SkipServerVerification::new())
+            .with_no_client_auth(),
+    )?)));
+
+    // connect to server
+    let connection = endpoint
+        .connect(server_addr, "localhost")
+        .unwrap()
+        .await
+        .unwrap();
+    println!("[client] connected: addr={}", connection.remote_address());
+    // Dropping handles allows the corresponding objects to automatically shut down
+    drop(connection);
+    // Make sure the server has a chance to clean up
+    endpoint.wait_idle().await;
+
+    Ok(())
+}
+
+/// Dummy certificate verifier that treats any certificate as valid.
+/// NOTE, such verification is vulnerable to MITM attacks, but convenient for testing.
+#[derive(Debug)]
+struct SkipServerVerification(Arc<rustls::crypto::CryptoProvider>);
+
+impl SkipServerVerification {
+    fn new() -> Arc<Self> {
+        Arc::new(Self(Arc::new(rustls::crypto::ring::default_provider())))
+    }
+}
+
+impl rustls::client::danger::ServerCertVerifier for SkipServerVerification {
+    fn verify_server_cert(
+        &self,
+        _end_entity: &CertificateDer<'_>,
+        _intermediates: &[CertificateDer<'_>],
+        _server_name: &ServerName<'_>,
+        _ocsp: &[u8],
+        _now: UnixTime,
+    ) -> Result<rustls::client::danger::ServerCertVerified, rustls::Error> {
+        Ok(rustls::client::danger::ServerCertVerified::assertion())
+    }
+
+    fn verify_tls12_signature(
+        &self,
+        message: &[u8],
+        cert: &CertificateDer<'_>,
+        dss: &rustls::DigitallySignedStruct,
+    ) -> Result<rustls::client::danger::HandshakeSignatureValid, rustls::Error> {
+        rustls::crypto::verify_tls12_signature(
+            message,
+            cert,
+            dss,
+            &self.0.signature_verification_algorithms,
+        )
+    }
+
+    fn verify_tls13_signature(
+        &self,
+        message: &[u8],
+        cert: &CertificateDer<'_>,
+        dss: &rustls::DigitallySignedStruct,
+    ) -> Result<rustls::client::danger::HandshakeSignatureValid, rustls::Error> {
+        rustls::crypto::verify_tls13_signature(
+            message,
+            cert,
+            dss,
+            &self.0.signature_verification_algorithms,
+        )
+    }
+
+    fn supported_verify_schemes(&self) -> Vec<rustls::SignatureScheme> {
+        self.0.signature_verification_algorithms.supported_schemes()
+    }
+}

vendor/quinn/examples/server.rs

@@ -0,0 +1,271 @@
+//! This example demonstrates an HTTP server that serves files from a directory.
+//!
+//! Checkout the `README.md` for guidance.
+
+use std::{
+    ascii, fs, io,
+    net::SocketAddr,
+    path::{self, Path, PathBuf},
+    str,
+    sync::Arc,
+};
+
+use anyhow::{Context, Result, anyhow, bail};
+use clap::Parser;
+use proto::crypto::rustls::QuicServerConfig;
+use rustls::pki_types::{CertificateDer, PrivateKeyDer, PrivatePkcs8KeyDer};
+use tracing::{error, info, info_span};
+use tracing_futures::Instrument as _;
+
+mod common;
+
+#[derive(Parser, Debug)]
+#[clap(name = "server")]
+struct Opt {
+    /// file to log TLS keys to for debugging
+    #[clap(long = "keylog")]
+    keylog: bool,
+    /// directory to serve files from
+    root: PathBuf,
+    /// TLS private key in PEM format
+    #[clap(short = 'k', long = "key", requires = "cert")]
+    key: Option<PathBuf>,
+    /// TLS certificate in PEM format
+    #[clap(short = 'c', long = "cert", requires = "key")]
+    cert: Option<PathBuf>,
+    /// Enable stateless retries
+    #[clap(long = "stateless-retry")]
+    stateless_retry: bool,
+    /// Address to listen on
+    #[clap(long = "listen", default_value = "[::1]:4433")]
+    listen: SocketAddr,
+    /// Client address to block
+    #[clap(long = "block")]
+    block: Option<SocketAddr>,
+    /// Maximum number of concurrent connections to allow
+    #[clap(long = "connection-limit")]
+    connection_limit: Option<usize>,
+}
+
+fn main() {
+    tracing::subscriber::set_global_default(
+        tracing_subscriber::FmtSubscriber::builder()
+            .with_env_filter(tracing_subscriber::EnvFilter::from_default_env())
+            .finish(),
+    )
+    .unwrap();
+    let opt = Opt::parse();
+    let code = {
+        if let Err(e) = run(opt) {
+            eprintln!("ERROR: {e}");
+            1
+        } else {
+            0
+        }
+    };
+    ::std::process::exit(code);
+}
+
+#[tokio::main]
+async fn run(options: Opt) -> Result<()> {
+    let (certs, key) = if let (Some(key_path), Some(cert_path)) = (&options.key, &options.cert) {
+        let key = fs::read(key_path).context("failed to read private key")?;
+        let key = if key_path.extension().is_some_and(|x| x == "der") {
+            PrivateKeyDer::Pkcs8(PrivatePkcs8KeyDer::from(key))
+        } else {
+            rustls_pemfile::private_key(&mut &*key)
+                .context("malformed PKCS #1 private key")?
+                .ok_or_else(|| anyhow::Error::msg("no private keys found"))?
+        };
+        let cert_chain = fs::read(cert_path).context("failed to read certificate chain")?;
+        let cert_chain = if cert_path.extension().is_some_and(|x| x == "der") {
+            vec![CertificateDer::from(cert_chain)]
+        } else {
+            rustls_pemfile::certs(&mut &*cert_chain)
+                .collect::<Result<_, _>>()
+                .context("invalid PEM-encoded certificate")?
+        };
+
+        (cert_chain, key)
+    } else {
+        let dirs = directories_next::ProjectDirs::from("org", "quinn", "quinn-examples").unwrap();
+        let path = dirs.data_local_dir();
+        let cert_path = path.join("cert.der");
+        let key_path = path.join("key.der");
+        let (cert, key) = match fs::read(&cert_path).and_then(|x| Ok((x, fs::read(&key_path)?))) {
+            Ok((cert, key)) => (
+                CertificateDer::from(cert),
+                PrivateKeyDer::try_from(key).map_err(anyhow::Error::msg)?,
+            ),
+            Err(ref e) if e.kind() == io::ErrorKind::NotFound => {
+                info!("generating self-signed certificate");
+                let cert = rcgen::generate_simple_self_signed(vec!["localhost".into()]).unwrap();
+                let key = PrivatePkcs8KeyDer::from(cert.signing_key.serialize_der());
+                let cert = cert.cert.into();
+                fs::create_dir_all(path).context("failed to create certificate directory")?;
+                fs::write(&cert_path, &cert).context("failed to write certificate")?;
+                fs::write(&key_path, key.secret_pkcs8_der())
+                    .context("failed to write private key")?;
+                (cert, key.into())
+            }
+            Err(e) => {
+                bail!("failed to read certificate: {}", e);
+            }
+        };
+
+        (vec![cert], key)
+    };
+
+    let mut server_crypto = rustls::ServerConfig::builder()
+        .with_no_client_auth()
+        .with_single_cert(certs, key)?;
+    server_crypto.alpn_protocols = common::ALPN_QUIC_HTTP.iter().map(|&x| x.into()).collect();
+    if options.keylog {
+        server_crypto.key_log = Arc::new(rustls::KeyLogFile::new());
+    }
+
+    let mut server_config =
+        quinn::ServerConfig::with_crypto(Arc::new(QuicServerConfig::try_from(server_crypto)?));
+    let transport_config = Arc::get_mut(&mut server_config.transport).unwrap();
+    transport_config.max_concurrent_uni_streams(0_u8.into());
+
+    let root = Arc::<Path>::from(options.root.clone());
+    if !root.exists() {
+        bail!("root path does not exist");
+    }
+
+    let endpoint = quinn::Endpoint::server(server_config, options.listen)?;
+    eprintln!("listening on {}", endpoint.local_addr()?);
+
+    while let Some(conn) = endpoint.accept().await {
+        if options
+            .connection_limit
+            .is_some_and(|n| endpoint.open_connections() >= n)
+        {
+            info!("refusing due to open connection limit");
+            conn.refuse();
+        } else if Some(conn.remote_address()) == options.block {
+            info!("refusing blocked client IP address");
+            conn.refuse();
+        } else if options.stateless_retry && !conn.remote_address_validated() {
+            info!("requiring connection to validate its address");
+            conn.retry().unwrap();
+        } else {
+            info!("accepting connection");
+            let fut = handle_connection(root.clone(), conn);
+            tokio::spawn(async move {
+                if let Err(e) = fut.await {
+                    error!("connection failed: {reason}", reason = e.to_string())
+                }
+            });
+        }
+    }
+
+    Ok(())
+}
+
+async fn handle_connection(root: Arc<Path>, conn: quinn::Incoming) -> Result<()> {
+    let connection = conn.await?;
+    let span = info_span!(
+        "connection",
+        remote = %connection.remote_address(),
+        protocol = %connection
+            .handshake_data()
+            .unwrap()
+            .downcast::<quinn::crypto::rustls::HandshakeData>().unwrap()
+            .protocol
+            .map_or_else(|| "<none>".into(), |x| String::from_utf8_lossy(&x).into_owned())
+    );
+    async {
+        info!("established");
+
+        // Each stream initiated by the client constitutes a new request.
+        loop {
+            let stream = connection.accept_bi().await;
+            let stream = match stream {
+                Err(quinn::ConnectionError::ApplicationClosed { .. }) => {
+                    info!("connection closed");
+                    return Ok(());
+                }
+                Err(e) => {
+                    return Err(e);
+                }
+                Ok(s) => s,
+            };
+            let fut = handle_request(root.clone(), stream);
+            tokio::spawn(
+                async move {
+                    if let Err(e) = fut.await {
+                        error!("failed: {reason}", reason = e.to_string());
+                    }
+                }
+                .instrument(info_span!("request")),
+            );
+        }
+    }
+    .instrument(span)
+    .await?;
+    Ok(())
+}
+
+async fn handle_request(
+    root: Arc<Path>,
+    (mut send, mut recv): (quinn::SendStream, quinn::RecvStream),
+) -> Result<()> {
+    let req = recv
+        .read_to_end(64 * 1024)
+        .await
+        .map_err(|e| anyhow!("failed reading request: {}", e))?;
+    let mut escaped = String::new();
+    for &x in &req[..] {
+        let part = ascii::escape_default(x).collect::<Vec<_>>();
+        escaped.push_str(str::from_utf8(&part).unwrap());
+    }
+    info!(content = %escaped);
+    // Execute the request
+    let resp = process_get(&root, &req).unwrap_or_else(|e| {
+        error!("failed: {}", e);
+        format!("failed to process request: {e}\n").into_bytes()
+    });
+    // Write the response
+    send.write_all(&resp)
+        .await
+        .map_err(|e| anyhow!("failed to send response: {}", e))?;
+    // Gracefully terminate the stream
+    send.finish().unwrap();
+    info!("complete");
+    Ok(())
+}
+
+fn process_get(root: &Path, x: &[u8]) -> Result<Vec<u8>> {
+    if x.len() < 4 || &x[0..4] != b"GET " {
+        bail!("missing GET");
+    }
+    if x[4..].len() < 2 || &x[x.len() - 2..] != b"\r\n" {
+        bail!("missing \\r\\n");
+    }
+    let x = &x[4..x.len() - 2];
+    let end = x.iter().position(|&c| c == b' ').unwrap_or(x.len());
+    let path = str::from_utf8(&x[..end]).context("path is malformed UTF-8")?;
+    let path = Path::new(&path);
+    let mut real_path = PathBuf::from(root);
+    let mut components = path.components();
+    match components.next() {
+        Some(path::Component::RootDir) => {}
+        _ => {
+            bail!("path must be absolute");
+        }
+    }
+    for c in components {
+        match c {
+            path::Component::Normal(x) => {
+                real_path.push(x);
+            }
+            x => {
+                bail!("illegal component in path: {:?}", x);
+            }
+        }
+    }
+    let data = fs::read(&real_path).context("failed reading file")?;
+    Ok(data)
+}

vendor/quinn/examples/single_socket.rs

@@ -0,0 +1,65 @@
+//! This example demonstrates how to make multiple outgoing connections on a single UDP socket.
+//!
+//! Checkout the `README.md` for guidance.
+
+use std::{
+    error::Error,
+    net::{IpAddr, Ipv4Addr, SocketAddr},
+};
+
+use quinn::Endpoint;
+
+mod common;
+use common::{make_client_endpoint, make_server_endpoint};
+use rustls::pki_types::CertificateDer;
+
+#[tokio::main]
+async fn main() -> Result<(), Box<dyn Error + Send + Sync + 'static>> {
+    let addr1 = SocketAddr::new(IpAddr::V4(Ipv4Addr::LOCALHOST), 5000);
+    let addr2 = SocketAddr::new(IpAddr::V4(Ipv4Addr::LOCALHOST), 5001);
+    let addr3 = SocketAddr::new(IpAddr::V4(Ipv4Addr::LOCALHOST), 5002);
+    let server1_cert = run_server(addr1)?;
+    let server2_cert = run_server(addr2)?;
+    let server3_cert = run_server(addr3)?;
+
+    let client = make_client_endpoint(
+        SocketAddr::new(IpAddr::V4(Ipv4Addr::LOCALHOST), 0),
+        &[&server1_cert, &server2_cert, &server3_cert],
+    )?;
+
+    // connect to multiple endpoints using the same socket/endpoint
+    tokio::join!(
+        run_client(&client, addr1),
+        run_client(&client, addr2),
+        run_client(&client, addr3),
+    );
+
+    // Make sure the server has a chance to clean up
+    client.wait_idle().await;
+
+    Ok(())
+}
+
+/// Runs a QUIC server bound to given address and returns server certificate.
+fn run_server(
+    addr: SocketAddr,
+) -> Result<CertificateDer<'static>, Box<dyn Error + Send + Sync + 'static>> {
+    let (endpoint, server_cert) = make_server_endpoint(addr)?;
+    // accept a single connection
+    tokio::spawn(async move {
+        let connection = endpoint.accept().await.unwrap().await.unwrap();
+        println!(
+            "[server] incoming connection: addr={}",
+            connection.remote_address()
+        );
+    });
+
+    Ok(server_cert)
+}
+
+/// Attempt QUIC connection with the given server address.
+async fn run_client(endpoint: &Endpoint, server_addr: SocketAddr) {
+    let connect = endpoint.connect(server_addr, "localhost").unwrap();
+    let connection = connect.await.unwrap();
+    println!("[client] connected: addr={}", connection.remote_address());
+}