recovery: add unchecked congestion window

Applications that constrain transmission outside quiche need QUIC
recovery without congestion-window backpressure. Expose an explicitly
opt-in algorithm that keeps the window at usize::MAX while preserving
shared ACK, RTT, loss, and bytes-in-flight accounting.

Generic accounting now allows this to be a small callback table instead
of a Reno copy. Saturate PRR allowance at the maximum window, cover the
behavior in feature-enabled CI, and document that optimistic-ACK probes
become extremely infrequent.

Author: cf-rhett

.github/workflows/nightly.yml

@@ -7,7 +7,7 @@ permissions:
   pull-requests: write
 
 env:
-  FEATURES: "async,ffi,qlog,rpk"
+  FEATURES: "async,ffi,qlog,rpk,congestion_window_unchecked_available"
   RUSTFLAGS: "-D warnings"
   RUSTDOCFLAGS: "--cfg docsrs"
   RUSTTOOLCHAIN: "nightly"

.github/workflows/stable.yml

@@ -7,7 +7,7 @@ permissions:
   pull-requests: write
 
 env:
-  DEFAULT_OPTIONS: "--features=async,ffi,qlog,rpk --workspace"
+  DEFAULT_OPTIONS: "--features=async,ffi,qlog,rpk,congestion_window_unchecked_available --workspace"
   # Used by `quiche_multiarch`, which can't link `boring` for foreign targets.
   NO_BORING_OPTIONS: "--features=ffi,qlog --workspace --exclude h3i --exclude tokio-quiche"
   RUSTFLAGS: "-D warnings"

quiche/Cargo.toml

@@ -46,6 +46,12 @@ default = ["boringssl-boring-crate"]
 # copy in the dep graph.
 boringssl-boring-crate = ["boring", "boring-sys", "foreign-types-shared"]
 
+# Exposes a congestion control algorithm that provides no congestion-window
+# protection. ACK processing, RTT estimation, loss detection, and recovery
+# remain enabled. Only enable this for deployments that constrain transmission
+# elsewhere.
+congestion_window_unchecked_available = []
+
 # Allow client connections to provide a custom DCID when initiating a
 # connection. Be aware that RFC 9000 places requirements for unpredictability and
 # length on the client DCID field. Enabling this feature can be dangerous if these
@@ -82,7 +88,12 @@ tag-prefix = ""
 
 [package.metadata.docs.rs]
 no-default-features = true
-features = ["boringssl-boring-crate", "qlog", "custom-client-dcid"]
+features = [
+  "boringssl-boring-crate",
+  "qlog",
+  "custom-client-dcid",
+  "congestion_window_unchecked_available",
+]
 rustdoc-args = ["--cfg", "docsrs"]
 
 [build-dependencies]

quiche/src/lib.rs

@@ -372,6 +372,9 @@
 //!   initiating a connection. Dangerous if the DCID does not meet QUIC's
 //!   unpredictability and length requirements.
 //!
+//! * `congestion_window_unchecked_available`: Expose a congestion control
+//!   algorithm that provides no congestion-window protection.
+//!
 //! [feature flags]: https://doc.rust-lang.org/cargo/reference/manifest.html#the-features-section
 //! [boring]: https://crates.io/crates/boring
 //! [qlog]: https://datatracker.ietf.org/doc/html/draft-ietf-quic-qlog-main-schema

quiche/src/recovery/AGENTS.md

@@ -74,8 +74,10 @@ gcongestion/        Next-gen CC (BBR2)
 ## NOTES
 
 - Constants cite RFC 9002: `INITIAL_TIME_THRESHOLD = 9.0/8.0`, `GRANULARITY = 1ms`.
-- `CongestionControlAlgorithm` values: Reno=0, CUBIC=1, Bbr2Gcongestion=4. Gap is intentional (removed variants).
-- `Recovery::new_with_config` tries `GRecovery::new` first; falls back to `LegacyRecovery` if algo is Reno/CUBIC.
+- `CongestionControlAlgorithm` values: Reno=0, CUBIC=1, Bbr2Gcongestion=4,
+  CongestionWindowUnchecked=5 when enabled. Gaps are intentional (removed variants).
+- `Recovery::new_with_config` tries `GRecovery::new` first; falls back to
+  `LegacyRecovery` for Reno, CUBIC, and CongestionWindowUnchecked.
 - `bbr2/` is a deeply nested state machine -- changes require understanding all six substates.
 - `enable_relaxed_loss_threshold` experiment adjusts time thresholds dynamically on spurious loss.
 - `gcongestion/bbr.rs` is BBRv1 -- mostly vestigial alongside BBR2.

quiche/src/recovery/congestion/mod.rs

@@ -283,6 +283,24 @@ pub(crate) struct CongestionControlOps {
     ) -> std::fmt::Result,
 }
 
+#[cfg(feature = "congestion_window_unchecked_available")]
+static CONGESTION_WINDOW_UNCHECKED: CongestionControlOps = CongestionControlOps {
+    on_init: |recovery| recovery.congestion_window = usize::MAX,
+    on_packet_sent: |_, _, _, _| {},
+    on_packets_acked: |_, _, _, _, _| {},
+    congestion_event: |recovery, _, _, largest_lost_packet, now| {
+        if !recovery.in_congestion_recovery(largest_lost_packet.time_sent) {
+            recovery.congestion_recovery_start_time = Some(now);
+            recovery.ssthresh.update(recovery.congestion_window, false);
+        }
+    },
+    checkpoint: |_| {},
+    rollback: |_| true,
+    #[cfg(feature = "qlog")]
+    state_str: |_, _| "congestion_window_unchecked",
+    debug_fmt: |_, _| Ok(()),
+};
+
 impl From<CongestionControlAlgorithm> for &'static CongestionControlOps {
     fn from(algo: CongestionControlAlgorithm) -> Self {
         match algo {
@@ -293,6 +311,9 @@ impl From<CongestionControlAlgorithm> for &'static CongestionControlOps {
             // LegacyRecovery never gets a RecoveryConfig with the
             // Bbr2Gcongestion algorithm.
             CongestionControlAlgorithm::Bbr2Gcongestion => unreachable!(),
+            #[cfg(feature = "congestion_window_unchecked_available")]
+            CongestionControlAlgorithm::CongestionWindowUnchecked =>
+                &CONGESTION_WINDOW_UNCHECKED,
         }
     }
 }

quiche/src/recovery/congestion/recovery.rs

@@ -889,8 +889,9 @@ impl RecoveryOps for LegacyRecovery {
         }
 
         // Open more space (snd_cnt) for PRR when allowed.
-        self.cwnd().saturating_sub(self.bytes_in_flight.get()) +
-            self.congestion.prr.snd_cnt
+        self.cwnd()
+            .saturating_sub(self.bytes_in_flight.get())
+            .saturating_add(self.congestion.prr.snd_cnt)
     }
 
     fn rtt(&self) -> Duration {
@@ -1159,6 +1160,18 @@ mod tests {
     use crate::recovery::RecoveryConfig;
     use std::time::Instant;
 
+    #[test]
+    fn congestion_window_unchecked_saturates_prr_allowance() {
+        let config = crate::Config::new(crate::PROTOCOL_VERSION)
+            .expect("configuration should be valid");
+        let recovery_config = RecoveryConfig::from_config(&config);
+        let mut recovery = LegacyRecovery::new_with_config(&recovery_config);
+        recovery.congestion.congestion_window = usize::MAX;
+        recovery.congestion.prr.snd_cnt = 1;
+
+        assert_eq!(recovery.cwnd_available(), usize::MAX);
+    }
+
     #[test]
     fn test_high_pto_count_no_panic() {
         let config = crate::Config::new(crate::PROTOCOL_VERSION).unwrap();

quiche/src/recovery/mod.rs

@@ -371,6 +371,7 @@ impl Recovery {
 /// algorithms.
 #[derive(Debug, Copy, Clone, PartialEq, Eq)]
 #[repr(C)]
+#[non_exhaustive]
 pub enum CongestionControlAlgorithm {
     /// Reno congestion control algorithm. `reno` in a string form.
     Reno            = 0,
@@ -379,6 +380,18 @@ pub enum CongestionControlAlgorithm {
     /// BBRv2 congestion control algorithm implementation from gcongestion
     /// branch. `bbr2_gcongestion` in a string form.
     Bbr2Gcongestion = 4,
+    /// Keeps the congestion window at `usize::MAX` instead of reducing send
+    /// capacity in response to congestion. ACK processing, RTT estimation,
+    /// loss detection, and recovery remain enabled. This provides no
+    /// congestion-window protection and makes optimistic-ACK probes extremely
+    /// infrequent.
+    /// `congestion_window_unchecked` in string form.
+    #[cfg(feature = "congestion_window_unchecked_available")]
+    #[cfg_attr(
+        docsrs,
+        doc(cfg(feature = "congestion_window_unchecked_available"))
+    )]
+    CongestionWindowUnchecked = 5,
 }
 
 impl FromStr for CongestionControlAlgorithm {
@@ -394,6 +407,9 @@ impl FromStr for CongestionControlAlgorithm {
             "bbr" => Ok(CongestionControlAlgorithm::Bbr2Gcongestion),
             "bbr2" => Ok(CongestionControlAlgorithm::Bbr2Gcongestion),
             "bbr2_gcongestion" => Ok(CongestionControlAlgorithm::Bbr2Gcongestion),
+            #[cfg(feature = "congestion_window_unchecked_available")]
+            "congestion_window_unchecked" =>
+                Ok(CongestionControlAlgorithm::CongestionWindowUnchecked),
             _ => Err(crate::Error::CongestionControl),
         }
     }
@@ -953,10 +969,94 @@ mod tests {
         );
     }
 
+    #[cfg(feature = "congestion_window_unchecked_available")]
+    fn congestion_window_unchecked_recovery() -> Recovery {
+        let mut config = Config::new(crate::PROTOCOL_VERSION)
+            .expect("configuration should be valid");
+        config
+            .set_cc_algorithm_name("congestion_window_unchecked")
+            .expect("congestion_window_unchecked should be available");
+        Recovery::new(&config)
+    }
+
+    #[cfg(feature = "congestion_window_unchecked_available")]
+    #[test]
+    fn congestion_window_unchecked_keeps_the_send_window_open() {
+        let mut recovery = congestion_window_unchecked_recovery();
+        let now = Instant::now();
+        recovery.on_packet_sent(
+            test_utils::helper_packet_sent(0, now, 1_200),
+            packet::Epoch::Application,
+            HandshakeStatus::default(),
+            now,
+            "",
+        );
+
+        assert_eq!(recovery.cwnd(), usize::MAX);
+        assert_eq!(recovery.bytes_in_flight(), 1_200);
+        assert_eq!(recovery.cwnd_available(), usize::MAX - 1_200);
+    }
+
+    #[cfg(feature = "congestion_window_unchecked_available")]
+    #[test]
+    fn congestion_window_unchecked_retains_recovery_accounting() {
+        let mut recovery = congestion_window_unchecked_recovery();
+        let now = Instant::now();
+        recovery.on_packet_sent(
+            test_utils::helper_packet_sent(0, now, 1_200),
+            packet::Epoch::Application,
+            HandshakeStatus::default(),
+            now,
+            "",
+        );
+
+        let mut acked = RangeSet::default();
+        acked.insert(0..1);
+        let outcome = recovery
+            .on_ack_received(
+                &acked,
+                0,
+                packet::Epoch::Application,
+                HandshakeStatus::default(),
+                now + Duration::from_millis(10),
+                None,
+                "",
+            )
+            .expect("ACK should be valid");
+        assert_eq!(outcome.acked_bytes, 1_200);
+        assert_eq!(recovery.bytes_in_flight(), 0);
+        assert_eq!(recovery.rtt(), Duration::from_millis(10));
+        assert_eq!(recovery.min_rtt(), Some(Duration::from_millis(10)));
+
+        let mut recovery = congestion_window_unchecked_recovery();
+        recovery.on_packet_sent(
+            test_utils::helper_packet_sent(
+                0,
+                now + Duration::from_secs(2),
+                1_200,
+            ),
+            packet::Epoch::Initial,
+            HandshakeStatus::default(),
+            now + Duration::from_secs(2),
+            "",
+        );
+        recovery.on_pkt_num_space_discarded(
+            packet::Epoch::Initial,
+            HandshakeStatus::default(),
+            now + Duration::from_secs(3),
+        );
+        assert_eq!(recovery.bytes_in_flight(), 0);
+    }
+
     #[rstest]
-    fn loss_on_pto(
-        #[values("reno", "cubic", "bbr2_gcongestion")] cc_algorithm_name: &str,
-    ) {
+    #[case::reno("reno")]
+    #[case::cubic("cubic")]
+    #[case::bbr2_gcongestion("bbr2_gcongestion")]
+    #[cfg_attr(
+        feature = "congestion_window_unchecked_available",
+        case::congestion_window_unchecked("congestion_window_unchecked")
+    )]
+    fn loss_on_pto(#[case] cc_algorithm_name: &str) {
         let mut cfg = Config::new(crate::PROTOCOL_VERSION).unwrap();
         assert_eq!(cfg.set_cc_algorithm_name(cc_algorithm_name), Ok(()));
 
@@ -1231,7 +1331,10 @@ mod tests {
         );
 
         assert_eq!(r.sent_packets_len(packet::Epoch::Application), 0);
-        if cc_algorithm_name == "reno" || cc_algorithm_name == "cubic" {
+        if matches!(
+            cc_algorithm_name,
+            "reno" | "cubic" | "congestion_window_unchecked"
+        ) {
             assert!(r.startup_exit().is_some());
             assert_eq!(r.startup_exit().unwrap().reason, StartupExitReason::Loss);
         } else {
@@ -1240,9 +1343,14 @@ mod tests {
     }
 
     #[rstest]
-    fn loss_on_timer(
-        #[values("reno", "cubic", "bbr2_gcongestion")] cc_algorithm_name: &str,
-    ) {
+    #[case::reno("reno")]
+    #[case::cubic("cubic")]
+    #[case::bbr2_gcongestion("bbr2_gcongestion")]
+    #[cfg_attr(
+        feature = "congestion_window_unchecked_available",
+        case::congestion_window_unchecked("congestion_window_unchecked")
+    )]
+    fn loss_on_timer(#[case] cc_algorithm_name: &str) {
         let mut cfg = Config::new(crate::PROTOCOL_VERSION).unwrap();
         assert_eq!(cfg.set_cc_algorithm_name(cc_algorithm_name), Ok(()));
 
@@ -1427,7 +1535,10 @@ mod tests {
         );
 
         assert_eq!(r.sent_packets_len(packet::Epoch::Application), 0);
-        if cc_algorithm_name == "reno" || cc_algorithm_name == "cubic" {
+        if matches!(
+            cc_algorithm_name,
+            "reno" | "cubic" | "congestion_window_unchecked"
+        ) {
             assert!(r.startup_exit().is_some());
             assert_eq!(r.startup_exit().unwrap().reason, StartupExitReason::Loss);
         } else {
@@ -1436,9 +1547,14 @@ mod tests {
     }
 
     #[rstest]
-    fn loss_on_reordering(
-        #[values("reno", "cubic", "bbr2_gcongestion")] cc_algorithm_name: &str,
-    ) {
+    #[case::reno("reno")]
+    #[case::cubic("cubic")]
+    #[case::bbr2_gcongestion("bbr2_gcongestion")]
+    #[cfg_attr(
+        feature = "congestion_window_unchecked_available",
+        case::congestion_window_unchecked("congestion_window_unchecked")
+    )]
+    fn loss_on_reordering(#[case] cc_algorithm_name: &str) {
         let mut cfg = Config::new(crate::PROTOCOL_VERSION).unwrap();
         assert_eq!(cfg.set_cc_algorithm_name(cc_algorithm_name), Ok(()));
 
@@ -1543,7 +1659,10 @@ mod tests {
         );
         assert_eq!(r.sent_packets_len(packet::Epoch::Application), 0);
 
-        if cc_algorithm_name == "reno" || cc_algorithm_name == "cubic" {
+        if matches!(
+            cc_algorithm_name,
+            "reno" | "cubic" | "congestion_window_unchecked"
+        ) {
             assert!(r.startup_exit().is_some());
             assert_eq!(r.startup_exit().unwrap().reason, StartupExitReason::Loss);
         } else {

tokio-quiche/Cargo.toml

@@ -15,6 +15,7 @@ build = "build.rs"
 default = ["qlog-gzip", "qlog-zstd"]
 
 # Forwarded quiche features for re-exports
+congestion_window_unchecked = ["quiche/congestion_window_unchecked_available"]
 fuzzing = ["quiche/fuzzing"]
 quiche_internal = ["quiche/internal"]
 

tokio-quiche/src/lib.rs

@@ -93,6 +93,8 @@
 //!
 //! Off by default:
 //!
+//! - `congestion_window_unchecked`: Expose quiche's congestion control
+//!   algorithm that provides no congestion-window protection.
 //! - `rpk`: Support for raw public keys (RPK) in QUIC handshakes (via
 //!   [boring]).
 //! - `gcongestion`: Replace quiche's original congestion control implementation