add QuinnReuseportIdGenerator

Author: zh-jq

Cargo.lock

@@ -168,6 +168,7 @@ rustls-pki-types = { version = "1", default-features = false }
 rustls = { version = "0.23.40", default-features = false, features = ["std", "tls12", "brotli"] }
 tokio-rustls = { version = "0.26", default-features = false, features = ["tls12"] }
 quinn = { version = "0.11", default-features = false, features = ["runtime-tokio"] }
+quinn-proto = { version = "0.11", default-features = false }
 quinn-udp = { version = "0.5.9", default-features = false, features = ["fast-apple-datapath"] }
 #
 openssl = { package = "variant-ssl", version = "0.17.30" }

Cargo.toml

@@ -63,5 +63,5 @@ mimalloc = ["dep:vey-mimalloc"]
 ebpf = ["dep:vey-reuseport"]
 event-log = ["dep:vey-fluentd"]
 register = ["vey-yaml/http", "dep:http", "dep:serde_json", "dep:vey-http"]
-quic = ["dep:quinn"]
+quic = ["dep:quinn", "vey-types/quinn"]
 openssl-async-job = ["vey-runtime/openssl-async-job"]

lib/vey-daemon/Cargo.toml

@@ -21,6 +21,8 @@ use vey_reuseport::quic::{QuicSocketSelectGuard, QuicSocketSelector};
 use vey_socket::RawSocket;
 use vey_std_ext::net::SocketAddrExt;
 use vey_types::acl::{AclAction, AclNetworkRule};
+#[cfg(feature = "ebpf")]
+use vey_types::net::QuinnReuseportIdGenerator;
 use vey_types::net::UdpListenConfig;
 
 use crate::listen::{ListenAliveGuard, ListenStats};
@@ -114,13 +116,6 @@ where
 
         for i in 0..instance_count {
             let socket = vey_socket::udp::new_std_bind_listen(&self.listen_config)?;
-            #[cfg(feature = "ebpf")]
-            let guard = if let Some(selector) = &mut self.socket_selector {
-                let guard = selector.add_socket(RawSocket::from(&socket))?;
-                Some(guard)
-            } else {
-                None
-            };
             let listen_addr = socket.local_addr()?;
 
             let mut endpoint_config = EndpointConfig::default();
@@ -130,6 +125,17 @@ where
                 warn!("ignored UDP payload size {payload_max_size}: {e}");
             }
 
+            #[cfg(feature = "ebpf")]
+            let guard = if let Some(selector) = &mut self.socket_selector {
+                let guard = selector.add_socket(RawSocket::from(&socket))?;
+                let cid_generator = QuinnReuseportIdGenerator::new(guard.cookie());
+                // TODO set cid lifetime
+                endpoint_config.cid_generator(move || Box::new(cid_generator));
+                Some(guard)
+            } else {
+                None
+            };
+
             let runtime = ListenQuicRuntimeInstance {
                 server: self.server.clone(),
                 server_type: self.server.r#type(),

lib/vey-daemon/src/listen/quic.rs

@@ -25,6 +25,7 @@ arcstr.workspace = true
 memchr.workspace = true
 constant_time_eq.workspace = true
 zeroize.workspace = true
+zerocopy.workspace = true
 url.workspace = true
 num-traits.workspace = true
 arc-swap.workspace = true
@@ -39,6 +40,7 @@ radix_trie = { workspace = true, optional = true }
 rustls = { workspace = true, optional = true }
 rustls-pki-types = { workspace = true, optional = true }
 quinn = { workspace = true, optional = true }
+quinn-proto = { workspace = true, optional = true }
 webpki-roots = { version = "1.0", optional = true }
 rustls-native-certs = { version = "0.8", optional = true }
 openssl = { workspace = true, optional = true }
@@ -61,7 +63,7 @@ quic = []
 auth-crypt = ["dep:openssl", "dep:blake3", "dep:hex"]
 auth-facts = ["dep:ip_network"]
 resolve = ["dep:ahash", "dep:radix_trie", "dep:fastrand"]
-quinn = ["dep:quinn", "quic"]
+quinn = ["dep:quinn", "dep:quinn-proto", "quic"]
 rustls = ["dep:rustls", "dep:rustls-pki-types", "dep:webpki-roots", "dep:rustls-native-certs", "dep:lru", "dep:ahash"]
 rustls-ring = ["rustls", "rustls/ring", "quinn?/rustls-ring"]
 rustls-aws-lc = ["rustls", "rustls/aws-lc-rs", "quinn?/rustls-aws-lc-rs"]

lib/vey-types/Cargo.toml

@@ -0,0 +1,81 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ * SPDX-FileCopyrightText: 2026 VEY-OSS Developers.
+ */
+
+use std::hash::Hasher;
+use std::time::Duration;
+
+use quinn_proto::{ConnectionId, ConnectionIdGenerator, InvalidCid};
+use rustc_hash::FxHasher;
+use zerocopy::{FromBytes, IntoBytes};
+
+const CID_LENGTH: usize = 20;
+const CID_COOKIE_LENGTH: usize = 8;
+const CID_NONCE_LENGTH: usize = 4;
+
+#[derive(Clone, Copy)]
+pub struct QuinnReuseportIdGenerator {
+    key: u64,
+    cookie: u64,
+    cid_lifetime: Option<Duration>,
+}
+
+impl QuinnReuseportIdGenerator {
+    pub fn new(cookie: u64) -> Self {
+        let key = rand::random();
+        QuinnReuseportIdGenerator {
+            key,
+            cookie,
+            cid_lifetime: None,
+        }
+    }
+}
+
+impl ConnectionIdGenerator for QuinnReuseportIdGenerator {
+    fn generate_cid(&mut self) -> ConnectionId {
+        let mut buf = [0; CID_LENGTH];
+        buf[..CID_COOKIE_LENGTH].copy_from_slice(&self.cookie.to_be_bytes());
+        rand::fill(&mut buf[CID_COOKIE_LENGTH..CID_COOKIE_LENGTH + CID_NONCE_LENGTH]);
+
+        let mut hasher = FxHasher::default();
+        hasher.write_u64(self.key);
+        hasher.write(&buf[..CID_COOKIE_LENGTH + CID_NONCE_LENGTH]);
+        let hash = hasher.finish();
+        buf[CID_COOKIE_LENGTH + CID_NONCE_LENGTH..].copy_from_slice(&hash.as_bytes());
+        ConnectionId::new(&buf)
+    }
+
+    fn validate(&self, cid: &ConnectionId) -> Result<(), InvalidCid> {
+        if cid.len() != CID_LENGTH {
+            return Err(InvalidCid);
+        }
+
+        let cookie = u64::from_be_bytes(cid[..CID_COOKIE_LENGTH].try_into().unwrap());
+        if cookie != self.cookie {
+            return Err(InvalidCid);
+        }
+
+        let given_hash = u64::ref_from_bytes(&cid[CID_COOKIE_LENGTH + CID_NONCE_LENGTH..])
+            .map_err(|_e| InvalidCid)?;
+
+        let mut hasher = FxHasher::default();
+        hasher.write_u64(self.key);
+        hasher.write(&cid[..CID_COOKIE_LENGTH + CID_NONCE_LENGTH]);
+        let expected_hash = hasher.finish();
+
+        if *given_hash != expected_hash {
+            Err(InvalidCid)
+        } else {
+            Ok(())
+        }
+    }
+
+    fn cid_len(&self) -> usize {
+        20
+    }
+
+    fn cid_lifetime(&self) -> Option<Duration> {
+        self.cid_lifetime
+    }
+}

lib/vey-types/src/net/quinn/connection_id.rs

@@ -5,3 +5,6 @@
 
 mod transport;
 pub use transport::QuinnTransportConfigBuilder;
+
+mod connection_id;
+pub use connection_id::QuinnReuseportIdGenerator;