[dependabot]

Bumps aioquic from 1.2.0 to 1.7.1.

Changelog

Sourced from aioquic's changelog.

1.7.1

• Fix streams which never ended when their FIN, written after all their data had been sent, did not fit in the packet being built: the FIN was never sent, so the peer kept waiting for it.
• Derive the keys for QUIC version 2 key updates with the quicv2 ku label, as :rfc:9369 requires. After its first key update, a QUIC version 2 connection could no longer exchange packets with a conforming peer.
• Reject a FIN or RESET_STREAM whose final size is below the data already received with FINAL_SIZE_ERROR, as :rfc:9000 recommends, instead of silently discarding the data beyond it.
• Drop 1-RTT packets which a server receives on a connection ID it never issued or which the client retired, as :rfc:9000 requires, instead of switching to that connection ID.
• Discard Retry packets which a client receives after processing a packet from the server, or whose Retry Token is empty, as :rfc:9000 requires. Such a Retry restarted the connection attempt, and broke an established connection.
• Discard 0-RTT keys once 1-RTT keys are in use, as :rfc:9001 requires: on servers when the first 1-RTT packet arrives, on clients when they install 1-RTT keys.

1.7.0

• Migrate clients to the server's preferred address, as :rfc:9000 allows.

  .. note::

  If you drive :class:~aioquic.quic.connection.QuicConnection with your own I/O, you must send each datagram to the address returned alongside it by datagrams_to_send(). That address may now differ from the one passed to connect(), so a connected UDP socket or a tunnel with a single fixed destination no longer works.

• Add :meth:~aioquic.quic.connection.QuicConnection.get_peer_address, which returns the address datagrams are currently sent to. It can change when either endpoint migrates.

• Improve path validation and connection migration as :rfc:9000 requires:

  • Discard datagrams received by clients from unknown server addresses.
  • Pad datagrams carrying PATH_CHALLENGE or PATH_RESPONSE frames to 1200 bytes, within the anti-amplification limit.
  • Retransmit lost PATH_CHALLENGE frames on servers, abandon failed validations and revert to the last validated address.
  • Answer path probes on servers on the path they arrive on, with a connection ID kept for each path.
  • Keep outstanding PATH_CHALLENGE data for each path, and ignore a PATH_RESPONSE that matches no challenge instead of closing the

... (truncated)

Commits

• f7babca 1.7.1
• 397c73e Discard 0-RTT keys once 1-RTT keys are in use
• 3e33d9c Check dropped packets with a context manager
• 1a9577a Discard Retry packets after a server packet or with an empty token
• c70fe75 Drop 1-RTT packets sent to an unknown connection ID on servers
• 94fef9d Reject final sizes below the data already received
• d2aab6e Use the "quicv2 ku" label for QUIC version 2 key updates
• cdcb99f Keep a FIN without data pending when the packet has no room for it
• 8c5c6b4 1.7.0
• b732937 Do not arm timers the anti-amplification limit leaves no room for
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #247.