TUN-4961: Update quic-go to latest

- Updates fips-go to be the latest on cfsetup.yaml - Updates sumtype's x/tools to be latest to avoid Internal: nil pkg errors with fips.
2025-07-28 04:59:58 +00:00 · 2021-08-27 12:26:00 +01:00
parent d0a1daac3b
commit 414cb12f02
585 changed files with 61873 additions and 6255 deletions
--- a/vendor/github.com/lucas-clemente/quic-go/.editorconfig
+++ b/vendor/github.com/lucas-clemente/quic-go/.editorconfig
@@ -1,5 +0,0 @@
-root = true
-
-[*]
-indent_style = tab
-indent_size = 2
--- a/vendor/github.com/lucas-clemente/quic-go/.travis.yml
+++ b/vendor/github.com/lucas-clemente/quic-go/.travis.yml
@@ -1,31 +0,0 @@
-dist: xenial
-group: travis_latest
-
-language: go
-
-go:
-  - "1.14.x"
-  - "1.15.x"
-
-# first part of the GOARCH workaround
-# setting the GOARCH directly doesn't work, since the value will be overwritten later
-# so set it to a temporary environment variable first
-env:
-  global:
-    - TIMESCALE_FACTOR=20
-  matrix:
-    - TRAVIS_GOARCH=amd64 TESTMODE=integration
-    - TRAVIS_GOARCH=386 TESTMODE=integration
-
-# second part of the GOARCH workaround
-# now actually set the GOARCH env variable to the value of the temporary variable set earlier
-before_install:
-  - travis_retry go get golang.org/x/tools/cmd/cover
-  - travis_retry go get github.com/onsi/ginkgo/ginkgo
-  - travis_retry go get github.com/onsi/gomega
-  - export GOARCH=$TRAVIS_GOARCH
-  - go env # for debugging
-  - travis_retry go get -t ./...
-
-script:
-  - .travis/script.sh
--- a/vendor/github.com/lucas-clemente/quic-go/Changelog.md
+++ b/vendor/github.com/lucas-clemente/quic-go/Changelog.md
@@ -1,6 +1,21 @@
 # Changelog

-## v0.20.0 (unreleased)
+## v0.22.0 (2021-07-25)
+
+- Use `ReadBatch` to read multiple UDP packets from the socket with a single syscall
+- Add a config option (`Config.DisableVersionNegotiationPackets`) to disable sending of Version Negotiation packets
+- Drop support for QUIC draft versions 32 and 34
+- Remove the `RetireBugBackwardsCompatibilityMode`, which was intended to mitigate a bug when retiring connection IDs in quic-go in v0.17.2 and ealier
+
+## v0.21.2 (2021-07-15)
+
+- Update qtls (for Go 1.15, 1.16 and 1.17rc1) to include the fix for the crypto/tls panic (see https://groups.google.com/g/golang-dev/c/5LJ2V7rd-Ag/m/YGLHVBZ6AAAJ for details)
+
+## v0.21.0 (2021-06-01)
+
+- quic-go now supports RFC 9000!
+
+## v0.20.0 (2021-03-19)

 - Remove the `quic.Config.HandshakeTimeout`. Introduce a `quic.Config.HandshakeIdleTimeout`.

--- a/vendor/github.com/lucas-clemente/quic-go/README.md
+++ b/vendor/github.com/lucas-clemente/quic-go/README.md
@@ -8,17 +8,12 @@
 [![Windows Build Status](https://img.shields.io/appveyor/ci/lucas-clemente/quic-go/master.svg?style=flat-square&label=windows+build)](https://ci.appveyor.com/project/lucas-clemente/quic-go/branch/master)
 [![Code Coverage](https://img.shields.io/codecov/c/github/lucas-clemente/quic-go/master.svg?style=flat-square)](https://codecov.io/gh/lucas-clemente/quic-go/)

-quic-go is an implementation of the [QUIC](https://en.wikipedia.org/wiki/QUIC) protocol in Go. It implements the [IETF QUIC draft-29](https://tools.ietf.org/html/draft-ietf-quic-transport-29), [draft-32](https://tools.ietf.org/html/draft-ietf-quic-transport-32) and [draft-34](https://tools.ietf.org/html/draft-ietf-quic-transport-34).
-
-## Version compatibility
-
-Since quic-go is under active development, there's no guarantee that two builds of different commits are interoperable. The QUIC version used in the *master* branch is just a placeholder, and should not be considered stable.
-
-When using quic-go as a library, please always use a [tagged release](https://github.com/lucas-clemente/quic-go/releases). Only these releases use the official draft version numbers.
+quic-go is an implementation of the [QUIC protocol, RFC 9000](https://datatracker.ietf.org/doc/html/rfc9000) protocol in Go.
+In addition to RFC 9000, it currently implements the [IETF QUIC draft-29](https://tools.ietf.org/html/draft-ietf-quic-transport-29). Support for draft-29 will eventually be dropped, as it is phased out of the ecosystem.

 ## Guides

-*We currently support Go 1.15+, with [Go modules](https://github.com/golang/go/wiki/Modules) support enabled.*
+*We currently support Go 1.16.x and Go 1.17.x.*

 Running tests:

--- a/vendor/github.com/lucas-clemente/quic-go/client.go
+++ b/vendor/github.com/lucas-clemente/quic-go/client.go
@@ -37,8 +37,9 @@ type client struct {

 	session quicSession

-	tracer logging.ConnectionTracer
-	logger utils.Logger
+	tracer    logging.ConnectionTracer
+	tracingID uint64
+	logger    utils.Logger
 }

 var (
@@ -202,8 +203,16 @@ func dialContext(
 	}
 	c.packetHandlers = packetHandlers

+	c.tracingID = nextSessionTracingID()
 	if c.config.Tracer != nil {
-		c.tracer = c.config.Tracer.TracerForConnection(protocol.PerspectiveClient, c.destConnID)
+		c.tracer = c.config.Tracer.TracerForConnection(
+			context.WithValue(ctx, SessionTracingKey, c.tracingID),
+			protocol.PerspectiveClient,
+			c.destConnID,
+		)
+	}
+	if c.tracer != nil {
+		c.tracer.StartedConnection(c.conn.LocalAddr(), c.conn.RemoteAddr(), c.srcConnID, c.destConnID)
 	}
 	if err := c.dial(ctx); err != nil {
 		return nil, err
@@ -270,9 +279,6 @@ func newClient(

 func (c *client) dial(ctx context.Context) error {
 	c.logger.Infof("Starting new connection to %s (%s -> %s), source connection ID %s, destination connection ID %s, version %s", c.tlsConf.ServerName, c.conn.LocalAddr(), c.conn.RemoteAddr(), c.srcConnID, c.destConnID, c.version)
-	if c.tracer != nil {
-		c.tracer.StartedConnection(c.conn.LocalAddr(), c.conn.RemoteAddr(), c.version, c.srcConnID, c.destConnID)
-	}

 	c.session = newClientSession(
 		c.conn,
@@ -285,6 +291,7 @@ func (c *client) dial(ctx context.Context) error {
 		c.use0RTT,
 		c.hasNegotiatedVersion,
 		c.tracer,
+		c.tracingID,
 		c.logger,
 		c.version,
 	)
@@ -293,7 +300,8 @@ func (c *client) dial(ctx context.Context) error {
 	errorChan := make(chan error, 1)
 	go func() {
 		err := c.session.run() // returns as soon as the session is closed
-		if !errors.Is(err, errCloseForRecreating{}) && c.createdPacketConn {
+
+		if e := (&errCloseForRecreating{}); !errors.As(err, &e) && c.createdPacketConn {
 			c.packetHandlers.Destroy()
 		}
 		errorChan <- err
--- a/vendor/github.com/lucas-clemente/quic-go/config.go
+++ b/vendor/github.com/lucas-clemente/quic-go/config.go
@@ -101,22 +101,23 @@ func populateConfig(config *Config) *Config {
 	}

 	return &Config{
-		Versions:                       versions,
-		HandshakeIdleTimeout:           handshakeIdleTimeout,
-		MaxIdleTimeout:                 idleTimeout,
-		AcceptToken:                    config.AcceptToken,
-		KeepAlive:                      config.KeepAlive,
-		InitialStreamReceiveWindow:     initialStreamReceiveWindow,
-		MaxStreamReceiveWindow:         maxStreamReceiveWindow,
-		InitialConnectionReceiveWindow: initialConnectionReceiveWindow,
-		MaxConnectionReceiveWindow:     maxConnectionReceiveWindow,
-		MaxIncomingStreams:             maxIncomingStreams,
-		MaxIncomingUniStreams:          maxIncomingUniStreams,
-		ConnectionIDLength:             config.ConnectionIDLength,
-		StatelessResetKey:              config.StatelessResetKey,
-		TokenStore:                     config.TokenStore,
-		EnableDatagrams:                config.EnableDatagrams,
-		DisablePathMTUDiscovery:        config.DisablePathMTUDiscovery,
-		Tracer:                         config.Tracer,
+		Versions:                         versions,
+		HandshakeIdleTimeout:             handshakeIdleTimeout,
+		MaxIdleTimeout:                   idleTimeout,
+		AcceptToken:                      config.AcceptToken,
+		KeepAlive:                        config.KeepAlive,
+		InitialStreamReceiveWindow:       initialStreamReceiveWindow,
+		MaxStreamReceiveWindow:           maxStreamReceiveWindow,
+		InitialConnectionReceiveWindow:   initialConnectionReceiveWindow,
+		MaxConnectionReceiveWindow:       maxConnectionReceiveWindow,
+		MaxIncomingStreams:               maxIncomingStreams,
+		MaxIncomingUniStreams:            maxIncomingUniStreams,
+		ConnectionIDLength:               config.ConnectionIDLength,
+		StatelessResetKey:                config.StatelessResetKey,
+		TokenStore:                       config.TokenStore,
+		EnableDatagrams:                  config.EnableDatagrams,
+		DisablePathMTUDiscovery:          config.DisablePathMTUDiscovery,
+		DisableVersionNegotiationPackets: config.DisableVersionNegotiationPackets,
+		Tracer:                           config.Tracer,
 	}
 }
--- a/vendor/github.com/lucas-clemente/quic-go/conn_helper_darwin.go
+++ b/vendor/github.com/lucas-clemente/quic-go/conn_helper_darwin.go
@@ -15,3 +15,7 @@ const (
 	msgTypeIPv4PKTINFO = unix.IP_PKTINFO
 	msgTypeIPv6PKTINFO = 0x2e
 )
+
+// ReadBatch only returns a single packet on OSX,
+// see https://godoc.org/golang.org/x/net/ipv4#PacketConn.ReadBatch.
+const batchSize = 1
--- a/vendor/github.com/lucas-clemente/quic-go/conn_helper_freebsd.go
+++ b/vendor/github.com/lucas-clemente/quic-go/conn_helper_freebsd.go
@@ -15,3 +15,5 @@ const (
 	msgTypeIPv4PKTINFO = 0x7
 	msgTypeIPv6PKTINFO = 0x2e
 )
+
+const batchSize = 8
--- a/vendor/github.com/lucas-clemente/quic-go/conn_helper_linux.go
+++ b/vendor/github.com/lucas-clemente/quic-go/conn_helper_linux.go
@@ -15,3 +15,5 @@ const (
 	msgTypeIPv4PKTINFO = unix.IP_PKTINFO
 	msgTypeIPv6PKTINFO = unix.IPV6_PKTINFO
 )
+
+const batchSize = 8 // needs to smaller than MaxUint8 (otherwise the type of oobConn.readPos has to be changed)
--- a/vendor/github.com/lucas-clemente/quic-go/conn_id_generator.go
+++ b/vendor/github.com/lucas-clemente/quic-go/conn_id_generator.go
@@ -73,15 +73,21 @@ func (m *connIDGenerator) SetMaxActiveConnIDs(limit uint64) error {

 func (m *connIDGenerator) Retire(seq uint64, sentWithDestConnID protocol.ConnectionID) error {
 	if seq > m.highestSeq {
-		return qerr.NewError(qerr.ProtocolViolation, fmt.Sprintf("tried to retire connection ID %d. Highest issued: %d", seq, m.highestSeq))
+		return &qerr.TransportError{
+			ErrorCode:    qerr.ProtocolViolation,
+			ErrorMessage: fmt.Sprintf("retired connection ID %d (highest issued: %d)", seq, m.highestSeq),
+		}
 	}
 	connID, ok := m.activeSrcConnIDs[seq]
 	// We might already have deleted this connection ID, if this is a duplicate frame.
 	if !ok {
 		return nil
 	}
-	if connID.Equal(sentWithDestConnID) && !protocol.UseRetireBugBackwardsCompatibilityMode(RetireBugBackwardsCompatibilityMode, m.version) {
-		return qerr.NewError(qerr.ProtocolViolation, fmt.Sprintf("tried to retire connection ID %d (%s), which was used as the Destination Connection ID on this packet", seq, connID))
+	if connID.Equal(sentWithDestConnID) {
+		return &qerr.TransportError{
+			ErrorCode:    qerr.ProtocolViolation,
+			ErrorMessage: fmt.Sprintf("retired connection ID %d (%s), which was used as the Destination Connection ID on this packet", seq, connID),
+		}
 	}
 	m.retireConnectionID(connID)
 	delete(m.activeSrcConnIDs, seq)
@@ -93,9 +99,6 @@ func (m *connIDGenerator) Retire(seq uint64, sentWithDestConnID protocol.Connect
 }

 func (m *connIDGenerator) issueNewConnID() error {
-	if protocol.UseRetireBugBackwardsCompatibilityMode(RetireBugBackwardsCompatibilityMode, m.version) {
-		return nil
-	}
 	connID, err := protocol.GenerateConnectionID(m.connIDLen)
 	if err != nil {
 		return err
--- a/vendor/github.com/lucas-clemente/quic-go/conn_id_manager.go
+++ b/vendor/github.com/lucas-clemente/quic-go/conn_id_manager.go
@@ -53,7 +53,7 @@ func (h *connIDManager) Add(f *wire.NewConnectionIDFrame) error {
 		return err
 	}
 	if h.queue.Len() >= protocol.MaxActiveConnectionIDs {
-		return qerr.ConnectionIDLimitError
+		return &qerr.TransportError{ErrorCode: qerr.ConnectionIDLimitError}
 	}
 	return nil
 }
--- a/vendor/github.com/lucas-clemente/quic-go/conn_oob.go
+++ b/vendor/github.com/lucas-clemente/quic-go/conn_oob.go
@@ -12,13 +12,27 @@ import (
 	"time"
 	"unsafe"

+	"golang.org/x/net/ipv4"
+	"golang.org/x/net/ipv6"
 	"golang.org/x/sys/unix"

 	"github.com/lucas-clemente/quic-go/internal/protocol"
 	"github.com/lucas-clemente/quic-go/internal/utils"
 )

-const ecnMask uint8 = 0x3
+const (
+	ecnMask       = 0x3
+	oobBufferSize = 128
+)
+
+// Contrary to what the naming suggests, the ipv{4,6}.Message is not dependent on the IP version.
+// They're both just aliases for x/net/internal/socket.Message.
+// This means we can use this struct to read from a socket that receives both IPv4 and IPv6 messages.
+var _ ipv4.Message = ipv6.Message{}
+
+type batchConn interface {
+	ReadBatch(ms []ipv4.Message, flags int) (int, error)
+}

 func inspectReadBuffer(c interface{}) (int, error) {
 	conn, ok := c.(interface {
@@ -43,7 +57,12 @@ func inspectReadBuffer(c interface{}) (int, error) {

 type oobConn struct {
 	OOBCapablePacketConn
-	oobBuffer []byte
+	batchConn batchConn
+
+	readPos uint8
+	// Packets received from the kernel, but not yet returned by ReadPacket().
+	messages []ipv4.Message
+	buffers  [batchSize]*packetBuffer
 }

 var _ connection = &oobConn{}
@@ -94,23 +113,52 @@ func newConn(c OOBCapablePacketConn) (*oobConn, error) {
 			return nil, errors.New("activating packet info failed for both IPv4 and IPv6")
 		}
 	}
-	return &oobConn{
+
+	// Allows callers to pass in a connection that already satisfies batchConn interface
+	// to make use of the optimisation. Otherwise, ipv4.NewPacketConn would unwrap the file descriptor
+	// via SyscallConn(), and read it that way, which might not be what the caller wants.
+	var bc batchConn
+	if ibc, ok := c.(batchConn); ok {
+		bc = ibc
+	} else {
+		bc = ipv4.NewPacketConn(c)
+	}
+
+	oobConn := &oobConn{
 		OOBCapablePacketConn: c,
-		oobBuffer:            make([]byte, 128),
-	}, nil
+		batchConn:            bc,
+		messages:             make([]ipv4.Message, batchSize),
+		readPos:              batchSize,
+	}
+	for i := 0; i < batchSize; i++ {
+		oobConn.messages[i].OOB = make([]byte, oobBufferSize)
+	}
+	return oobConn, nil
 }

 func (c *oobConn) ReadPacket() (*receivedPacket, error) {
-	buffer := getPacketBuffer()
-	// The packet size should not exceed protocol.MaxPacketBufferSize bytes
-	// If it does, we only read a truncated packet, which will then end up undecryptable
-	buffer.Data = buffer.Data[:protocol.MaxPacketBufferSize]
-	c.oobBuffer = c.oobBuffer[:cap(c.oobBuffer)]
-	n, oobn, _, addr, err := c.OOBCapablePacketConn.ReadMsgUDP(buffer.Data, c.oobBuffer)
-	if err != nil {
-		return nil, err
+	if len(c.messages) == int(c.readPos) { // all messages read. Read the next batch of messages.
+		c.messages = c.messages[:batchSize]
+		// replace buffers data buffers up to the packet that has been consumed during the last ReadBatch call
+		for i := uint8(0); i < c.readPos; i++ {
+			buffer := getPacketBuffer()
+			buffer.Data = buffer.Data[:protocol.MaxPacketBufferSize]
+			c.buffers[i] = buffer
+			c.messages[i].Buffers = [][]byte{c.buffers[i].Data}
+		}
+		c.readPos = 0
+
+		n, err := c.batchConn.ReadBatch(c.messages, 0)
+		if n == 0 || err != nil {
+			return nil, err
+		}
+		c.messages = c.messages[:n]
 	}
-	ctrlMsgs, err := unix.ParseSocketControlMessage(c.oobBuffer[:oobn])
+
+	msg := c.messages[c.readPos]
+	buffer := c.buffers[c.readPos]
+	c.readPos++
+	ctrlMsgs, err := unix.ParseSocketControlMessage(msg.OOB[:msg.NN])
 	if err != nil {
 		return nil, err
 	}
@@ -129,13 +177,15 @@ func (c *oobConn) ReadPacket() (*receivedPacket, error) {
 				// 	struct in_addr ipi_addr;     /* Header Destination
 				// 									address */
 				// };
+				ip := make([]byte, 4)
 				if len(ctrlMsg.Data) == 12 {
 					ifIndex = binary.LittleEndian.Uint32(ctrlMsg.Data)
-					destIP = net.IP(ctrlMsg.Data[8:12])
+					copy(ip, ctrlMsg.Data[8:12])
 				} else if len(ctrlMsg.Data) == 4 {
 					// FreeBSD
-					destIP = net.IP(ctrlMsg.Data)
+					copy(ip, ctrlMsg.Data)
 				}
+				destIP = net.IP(ip)
 			}
 		}
 		if ctrlMsg.Header.Level == unix.IPPROTO_IPV6 {
@@ -148,7 +198,9 @@ func (c *oobConn) ReadPacket() (*receivedPacket, error) {
 				// 	unsigned int    ipi6_ifindex; /* send/recv interface index */
 				// };
 				if len(ctrlMsg.Data) == 20 {
-					destIP = net.IP(ctrlMsg.Data[:16])
+					ip := make([]byte, 16)
+					copy(ip, ctrlMsg.Data[:16])
+					destIP = net.IP(ip)
 					ifIndex = binary.LittleEndian.Uint32(ctrlMsg.Data[16:])
 				}
 			}
@@ -162,9 +214,9 @@ func (c *oobConn) ReadPacket() (*receivedPacket, error) {
 		}
 	}
 	return &receivedPacket{
-		remoteAddr: addr,
+		remoteAddr: msg.Addr,
 		rcvTime:    time.Now(),
-		data:       buffer.Data[:n],
+		data:       msg.Buffers[0][:msg.N],
 		ecn:        ecn,
 		info:       info,
 		buffer:     buffer,
--- a/vendor/github.com/lucas-clemente/quic-go/conn_windows.go
+++ b/vendor/github.com/lucas-clemente/quic-go/conn_windows.go
@@ -11,7 +11,21 @@ import (
 	"golang.org/x/sys/windows"
 )

-func newConn(c net.PacketConn) (connection, error) {
+const IP_DONTFRAGMENT = 14
+
+func newConn(c OOBCapablePacketConn) (connection, error) {
+	rawConn, err := c.SyscallConn()
+	if err != nil {
+		return nil, fmt.Errorf("couldn't get syscall.RawConn: %w", err)
+	}
+	if err := rawConn.Control(func(fd uintptr) {
+		// This should succeed if the connection is a IPv4 or a dual-stack connection.
+		// It will fail for IPv6 connections.
+		// TODO: properly handle error.
+		_ = windows.SetsockoptInt(windows.Handle(fd), windows.IPPROTO_IP, IP_DONTFRAGMENT, 1)
+	}); err != nil {
+		return nil, err
+	}
 	return &basicConn{PacketConn: c}, nil
 }

--- a/vendor/github.com/lucas-clemente/quic-go/crypto_stream.go
+++ b/vendor/github.com/lucas-clemente/quic-go/crypto_stream.go
@@ -39,12 +39,18 @@ func newCryptoStream() cryptoStream {
 func (s *cryptoStreamImpl) HandleCryptoFrame(f *wire.CryptoFrame) error {
 	highestOffset := f.Offset + protocol.ByteCount(len(f.Data))
 	if maxOffset := highestOffset; maxOffset > protocol.MaxCryptoStreamOffset {
-		return qerr.NewError(qerr.CryptoBufferExceeded, fmt.Sprintf("received invalid offset %d on crypto stream, maximum allowed %d", maxOffset, protocol.MaxCryptoStreamOffset))
+		return &qerr.TransportError{
+			ErrorCode:    qerr.CryptoBufferExceeded,
+			ErrorMessage: fmt.Sprintf("received invalid offset %d on crypto stream, maximum allowed %d", maxOffset, protocol.MaxCryptoStreamOffset),
+		}
 	}
 	if s.finished {
 		if highestOffset > s.highestOffset {
 			// reject crypto data received after this stream was already finished
-			return qerr.NewError(qerr.ProtocolViolation, "received crypto data after change of encryption level")
+			return &qerr.TransportError{
+				ErrorCode:    qerr.ProtocolViolation,
+				ErrorMessage: "received crypto data after change of encryption level",
+			}
 		}
 		// ignore data with a smaller offset than the highest received
 		// could e.g. be a retransmission
@@ -80,7 +86,10 @@ func (s *cryptoStreamImpl) GetCryptoData() []byte {

 func (s *cryptoStreamImpl) Finish() error {
 	if s.queue.HasMoreData() {
-		return qerr.NewError(qerr.ProtocolViolation, "encryption level changed, but crypto stream has more data to read")
+		return &qerr.TransportError{
+			ErrorCode:    qerr.ProtocolViolation,
+			ErrorMessage: "encryption level changed, but crypto stream has more data to read",
+		}
 	}
 	s.finished = true
 	return nil
--- a/vendor/github.com/lucas-clemente/quic-go/errors.go
+++ b/vendor/github.com/lucas-clemente/quic-go/errors.go
@@ -0,0 +1,58 @@
+package quic
+
+import (
+	"fmt"
+
+	"github.com/lucas-clemente/quic-go/internal/qerr"
+)
+
+type (
+	TransportError          = qerr.TransportError
+	ApplicationError        = qerr.ApplicationError
+	VersionNegotiationError = qerr.VersionNegotiationError
+	StatelessResetError     = qerr.StatelessResetError
+	IdleTimeoutError        = qerr.IdleTimeoutError
+	HandshakeTimeoutError   = qerr.HandshakeTimeoutError
+)
+
+type (
+	TransportErrorCode   = qerr.TransportErrorCode
+	ApplicationErrorCode = qerr.ApplicationErrorCode
+	StreamErrorCode      = qerr.StreamErrorCode
+)
+
+const (
+	NoError                   = qerr.NoError
+	InternalError             = qerr.InternalError
+	ConnectionRefused         = qerr.ConnectionRefused
+	FlowControlError          = qerr.FlowControlError
+	StreamLimitError          = qerr.StreamLimitError
+	StreamStateError          = qerr.StreamStateError
+	FinalSizeError            = qerr.FinalSizeError
+	FrameEncodingError        = qerr.FrameEncodingError
+	TransportParameterError   = qerr.TransportParameterError
+	ConnectionIDLimitError    = qerr.ConnectionIDLimitError
+	ProtocolViolation         = qerr.ProtocolViolation
+	InvalidToken              = qerr.InvalidToken
+	ApplicationErrorErrorCode = qerr.ApplicationErrorErrorCode
+	CryptoBufferExceeded      = qerr.CryptoBufferExceeded
+	KeyUpdateError            = qerr.KeyUpdateError
+	AEADLimitReached          = qerr.AEADLimitReached
+	NoViablePathError         = qerr.NoViablePathError
+)
+
+// A StreamError is used for Stream.CancelRead and Stream.CancelWrite.
+// It is also returned from Stream.Read and Stream.Write if the peer canceled reading or writing.
+type StreamError struct {
+	StreamID  StreamID
+	ErrorCode StreamErrorCode
+}
+
+func (e *StreamError) Is(target error) bool {
+	_, ok := target.(*StreamError)
+	return ok
+}
+
+func (e *StreamError) Error() string {
+	return fmt.Sprintf("stream %d canceled with error code %d", e.StreamID, e.ErrorCode)
+}
--- a/vendor/github.com/lucas-clemente/quic-go/go.mod
+++ b/vendor/github.com/lucas-clemente/quic-go/go.mod
@@ -1,19 +1,19 @@
 module github.com/lucas-clemente/quic-go

-go 1.14
+go 1.16

 require (
 	github.com/cheekybits/genny v1.0.0
 	github.com/francoispqt/gojay v1.2.13
-	github.com/golang/mock v1.5.0
+	github.com/golang/mock v1.6.0
 	github.com/marten-seemann/qpack v0.2.1
-	github.com/marten-seemann/qtls-go1-15 v0.1.4
-	github.com/marten-seemann/qtls-go1-16 v0.1.3
-	github.com/onsi/ginkgo v1.14.0
-	github.com/onsi/gomega v1.10.1
+	github.com/marten-seemann/qtls-go1-16 v0.1.4
+	github.com/marten-seemann/qtls-go1-17 v0.1.0
+	github.com/onsi/ginkgo v1.16.4
+	github.com/onsi/gomega v1.13.0
 	golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9
-	golang.org/x/net v0.0.0-20200707034311-ab3426394381
-	golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e
-	golang.org/x/sys v0.0.0-20201231184435-2d18734c6014
+	golang.org/x/net v0.0.0-20210428140749-89ef3d95e781
+	golang.org/x/sync v0.0.0-20210220032951-036812b2e83c
+	golang.org/x/sys v0.0.0-20210510120138-977fb7262007
 	gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 // indirect
 )
--- a/vendor/github.com/lucas-clemente/quic-go/go.sum
+++ b/vendor/github.com/lucas-clemente/quic-go/go.sum
@@ -16,6 +16,7 @@ github.com/cheekybits/genny v1.0.0 h1:uGGa4nei+j20rOSeDeP5Of12XVm7TGUd4dJA9RDitf
 github.com/cheekybits/genny v1.0.0/go.mod h1:+tQajlRqAUrPI7DOSpB0XAqZYtQakVtB7wXkRAgjxjQ=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/coreos/go-systemd v0.0.0-20181012123002-c6f51f82210d/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
@@ -28,14 +29,16 @@ github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/gliderlabs/ssh v0.1.1/go.mod h1:U7qILu1NlMHj9FlMhZLlkCdDnU1DBEAqr0aevW3Awn0=
 github.com/go-errors/errors v1.0.1/go.mod h1:f4zRHt4oKfwPJE5k8C9vpYG+aDHdBFUsgrm6/TyX73Q=
+github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0 h1:p104kn46Q8WdvHunIJ9dAyjPVtrBPhSr3KT2yUst43I=
+github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/lint v0.0.0-20180702182130-06c8688daad7/go.mod h1:tluoj9z5200jBnyusfRPU2LqT6J+DAorxEvtC7LHB+E=
 github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
 github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
 github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4=
-github.com/golang/mock v1.5.0 h1:jlYHihg//f7RRwuPfptm04yp4s7O6Kw8EZiVYIGcH0g=
-github.com/golang/mock v1.5.0/go.mod h1:CWnOUgYIOo4TcNZ0wHX3YZCqsaM1I1Jvs6v3mP3KVu8=
+github.com/golang/mock v1.6.0 h1:ErTB+efbowRARo13NNdxyJji2egdxLGQhRaY+DUumQc=
+github.com/golang/mock v1.6.0/go.mod h1:p6yTPP+5HYm5mzsMV8JkE6ZKdX+/wYM6Hr+LicevLPs=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
@@ -43,14 +46,16 @@ github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:x
 github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
 github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
 github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
-github.com/golang/protobuf v1.4.2 h1:+Z5KGCizgyZCbGh1KZqA0fcLLkwbsjIzS4aV2v7wJX0=
 github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
+github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
+github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw=
+github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
 github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.4.0 h1:xsAVV57WRhGj6kEIi8ReJzQlHHqcBYCElAvkovg3B/4=
 github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-github v17.0.0+incompatible/go.mod h1:zLgOLi98H3fifZn+44m+umXrS52loVEgC2AApnigrVQ=
 github.com/google/go-querystring v1.0.0/go.mod h1:odCYkC5MyYFN7vkCjXpyrEuKhc/BUO6wN/zVPAxq5ck=
 github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
@@ -75,25 +80,30 @@ github.com/lunixbochs/vtclean v1.0.0/go.mod h1:pHhQNgMf3btfWnGBVipUOjRYhoOsdGqdm
 github.com/mailru/easyjson v0.0.0-20190312143242-1de009706dbe/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
 github.com/marten-seemann/qpack v0.2.1 h1:jvTsT/HpCn2UZJdP+UUB53FfUUgeOyG5K1ns0OJOGVs=
 github.com/marten-seemann/qpack v0.2.1/go.mod h1:F7Gl5L1jIgN1D11ucXefiuJS9UMVP2opoCp2jDKb7wc=
-github.com/marten-seemann/qtls-go1-15 v0.1.4 h1:RehYMOyRW8hPVEja1KBVsFVNSm35Jj9Mvs5yNoZZ28A=
 github.com/marten-seemann/qtls-go1-15 v0.1.4/go.mod h1:GyFwywLKkRt+6mfU99csTEY1joMZz5vmB1WNZH3P81I=
-github.com/marten-seemann/qtls-go1-16 v0.1.3 h1:XEZ1xGorVy9u+lJq+WXNE+hiqRYLNvJGYmwfwKQN2gU=
-github.com/marten-seemann/qtls-go1-16 v0.1.3/go.mod h1:gNpI2Ol+lRS3WwSOtIUUtRwZEQMXjYK+dQSBFbethAk=
+github.com/marten-seemann/qtls-go1-16 v0.1.4 h1:xbHbOGGhrenVtII6Co8akhLEdrawwB2iHl5yhJRpnco=
+github.com/marten-seemann/qtls-go1-16 v0.1.4/go.mod h1:gNpI2Ol+lRS3WwSOtIUUtRwZEQMXjYK+dQSBFbethAk=
+github.com/marten-seemann/qtls-go1-17 v0.1.0 h1:P9ggrs5xtwiqXv/FHNwntmuLMNq3KaSIG93AtAZ48xk=
+github.com/marten-seemann/qtls-go1-17 v0.1.0/go.mod h1:fz4HIxByo+LlWcreM4CZOYNuz3taBQ8rN2X6FqvaWo8=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
 github.com/microcosm-cc/bluemonday v1.0.1/go.mod h1:hsXNsILzKxV+sX77C5b8FSuKF00vh2OMYv+xgHpAMF4=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/neelance/astrewrite v0.0.0-20160511093645-99348263ae86/go.mod h1:kHJEU3ofeGjhHklVoIGuVj85JJwZ6kWPaJwCIxgnFmo=
 github.com/neelance/sourcemap v0.0.0-20151028013722-8c68805598ab/go.mod h1:Qr6/a/Q4r9LP1IltGz7tA7iOK1WonHEYhu1HRBA7ZiM=
-github.com/nxadm/tail v1.4.4 h1:DQuhQpB1tVlglWS2hLQ5OV6B5r8aGxSrPc5Qo6uTN78=
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
+github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
+github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
 github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
-github.com/onsi/ginkgo v1.14.0 h1:2mOpI4JVVPBN+WQRa0WKH2eXR+Ey+uK4n7Zj0aYpIQA=
 github.com/onsi/ginkgo v1.14.0/go.mod h1:iSB4RoI2tjJc9BBv4NKIKWKya62Rps+oPG/Lv9klQyY=
+github.com/onsi/ginkgo v1.16.2/go.mod h1:CObGmKUOKaSC0RjmoAK7tKyn4Azo5P2IWuoMnvwxz1E=
+github.com/onsi/ginkgo v1.16.4 h1:29JGrr5oVBm5ulCWet69zQkzWipVXIol6ygQUe/EzNc=
+github.com/onsi/ginkgo v1.16.4/go.mod h1:dX+/inL/fNMqNlz0e9LfyB9TswhZpCVdJM/Z6Vvnwo0=
 github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
-github.com/onsi/gomega v1.10.1 h1:o0+MgICZLuZ7xjH7Vx6zS/zcu93/BEp1VwkIW1mEXCE=
 github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
+github.com/onsi/gomega v1.13.0 h1:7lLHu94wT9Ij0o6EWWclhu0aOh32VxhkwEJvzuWPeak=
+github.com/onsi/gomega v1.13.0/go.mod h1:lRk9szgn8TxENtWd0Tp4c3wjlRfMTMH27I+3Je41yGY=
 github.com/openzipkin/zipkin-go v0.1.1/go.mod h1:NtoC/o8u3JlF1lSlyPNswIbeQH9bJTmOf0Erfk+hxe8=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
@@ -128,11 +138,15 @@ github.com/shurcooL/users v0.0.0-20180125191416-49c67e49c537/go.mod h1:QJTqeLYED
 github.com/shurcooL/webdavfs v0.0.0-20170829043945-18c3829fa133/go.mod h1:hKmq5kWdCj2z2KEozexVbfEZIWiTjhE0+UjmZgPqehw=
 github.com/sourcegraph/annotate v0.0.0-20160123013949-f4cad6c6324d/go.mod h1:UdhH50NIW0fCiwBSr0co2m7BnFLdv4fQTgdqdJTHFeE=
 github.com/sourcegraph/syntaxhighlight v0.0.0-20170531221838-bd320f5d308e/go.mod h1:HuIsMU8RRBOtsCgI77wP899iHVBQpCmg4ErYMZB+2IA=
-github.com/stretchr/testify v1.2.2 h1:bSDNvY7ZPG5RlJ8otE/7V6gMiyenm9RtJ7IUVIAoJ1w=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/stretchr/testify v1.5.1 h1:nOGnQDM7FYENwehXlg/kFVnos3rEvtKTjRvOWSzb6H4=
+github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/tarm/serial v0.0.0-20180830185346-98f6abe2eb07/go.mod h1:kDXzergiv9cbyO7IOYJZWg1U88JhDg3PB6klq9Hg2pA=
 github.com/viant/assertly v0.4.8/go.mod h1:aGifi++jvCrUaklKEKT0BU95igDNaqkvz+49uaYMPRU=
 github.com/viant/toolbox v0.24.0/go.mod h1:OxMCG57V0PXuIP2HNQrtJf2CjqdmbrOx5EkMILuUhzM=
+github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 go.opencensus.io v0.18.0/go.mod h1:vKdFvxhtzZ9onBp9VKHK8z/sRpBMnKAsufL7wlDrCOA=
 go4.org v0.0.0-20180809161055-417644f6feb5/go.mod h1:MkTOUMDaeVYJUOUsaDXIhWPZYa1yOyC1qaOBpL57BhE=
 golang.org/x/build v0.0.0-20190111050920-041ab4dc3f9d/go.mod h1:OWs+y06UdEOHN4y+MfF/py+xQ/tYqIWW03b70/CG9Rw=
@@ -148,6 +162,8 @@ golang.org/x/lint v0.0.0-20180702182130-06c8688daad7/go.mod h1:UVdnD1Gm6xHRNCYTk
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.4.2 h1:Gz96sIWK3OalVv/I/qNygP42zyoKp3xptRVCWRFEBvo=
+golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -160,8 +176,11 @@ golang.org/x/net v0.0.0-20190313220215-9f648a60d977/go.mod h1:t9HGtf8HONx5eT2rtn
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200707034311-ab3426394381 h1:VXak5I6aEWmAXeQjA+QSZzlgNrpq9mjcfDemuexIKsU=
 golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
+golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
+golang.org/x/net v0.0.0-20210428140749-89ef3d95e781 h1:DzZ89McO9/gWPsQXS/FVKAlG02ZjaQ6AlZRBimEYOd0=
+golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20181017192945-9dcd33a902f4/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20181203162652-d668ce993890/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
@@ -172,8 +191,9 @@ golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e h1:vcxGaoTs7kV8m5Np9uUNQin4BrLOthgV7252N8V+FwY=
-golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20210220032951-036812b2e83c h1:5KslGYwFpkhGh+Q16bwMP3cOontH8FOep7tGV86Y7SQ=
+golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181029174526-d69651ed3497/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -186,12 +206,20 @@ golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200519105757-fe76b779f299/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201231184435-2d18734c6014 h1:joucsQqXmyBVxViHCPFjG3hx8JzIFSaym3l3MM/Jsdg=
-golang.org/x/sys v0.0.0-20201231184435-2d18734c6014/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210112080510-489259a85091/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210510120138-977fb7262007 h1:gG67DSER+11cZvqIMb8S8bt0vZtiN6xWYARwirrOSfE=
+golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.2 h1:tW2bmiBqwgJj/UpqtC8EpXEZVYOwU0yG4iWbprSVAcs=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.6 h1:aRYxNxv6iGQlyVaZmk6ZgYEDa+Jg18DxebPSrd6bg1M=
+golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/tools v0.0.0-20180828015842-6cd1fcedba52/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -201,10 +229,14 @@ golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGm
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
 golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.1.1 h1:wGiQel/hW0NnEkJUk8lbzkX2gFJU6PFxf1v5OlCfuOs=
+golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 h1:E7g+9GITq07hpfrRu66IVDexMakfv52eLZ2CXBWiKr4=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/api v0.0.0-20180910000450-7ca32eb868bf/go.mod h1:4mhQ8q/RsB7i+udVvVy5NUi08OU8ZlA0gRVgrF7VFY0=
 google.golang.org/api v0.0.0-20181030000543-1d582fd0359e/go.mod h1:4mhQ8q/RsB7i+udVvVy5NUi08OU8ZlA0gRVgrF7VFY0=
 google.golang.org/api v0.1.0/go.mod h1:UGEZY7KEX120AnNLIHFMKIo4obdJhkp2tPbaPlQx13Y=
@@ -226,8 +258,10 @@ google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
 google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
 google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
-google.golang.org/protobuf v1.23.0 h1:4MY060fB1DLGMB/7MBTLnwQUY6+F09GEiz6SsrNqyzM=
 google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
+google.golang.org/protobuf v1.26.0 h1:bxAC2xTBsZGibn2RTntX0oH50xLsqy1OxA9tTL3p/lk=
+google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -238,8 +272,9 @@ gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWD
 gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.3.0 h1:clyUAQHOM3G0M3f5vQj7LuJrETvjVot3Z5el9nffUtU=
 gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 grpc.go4.org v0.0.0-20170609214715-11d0a25b4919/go.mod h1:77eQGdRu53HpSqPFJFmuJdjuHRquDANNeA4x7B8WQ9o=
 honnef.co/go/tools v0.0.0-20180728063816-88497007e858/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
--- a/vendor/github.com/lucas-clemente/quic-go/interface.go
+++ b/vendor/github.com/lucas-clemente/quic-go/interface.go
@@ -12,16 +12,6 @@ import (
 	"github.com/lucas-clemente/quic-go/logging"
 )

-// RetireBugBackwardsCompatibilityMode controls a backwards compatibility mode, necessary due to a bug in
-// quic-go v0.17.2 (and earlier), where under certain circumstances, an endpoint would retire the connection
-// ID it is currently using. See https://github.com/lucas-clemente/quic-go/issues/2658.
-// The bug has now been fixed, and new deployments have nothing to worry about.
-// Deployments that already have quic-go <= v0.17.2 deployed should active RetireBugBackwardsCompatibilityMode.
-// If activated, quic-go will take steps to avoid the bug from triggering when connected to endpoints that are still
-// running quic-go <= v0.17.2.
-// This flag will be removed in a future version of quic-go.
-var RetireBugBackwardsCompatibilityMode bool
-
 // The StreamID is the ID of a QUIC stream.
 type StreamID = protocol.StreamID

@@ -31,8 +21,8 @@ type VersionNumber = protocol.VersionNumber
 const (
 	// VersionDraft29 is IETF QUIC draft-29
 	VersionDraft29 = protocol.VersionDraft29
-	// VersionDraft32 is IETF QUIC draft-32
-	VersionDraft32 = protocol.VersionDraft32
+	// Version1 is RFC 9000
+	Version1 = protocol.Version1
 )

 // A Token can be used to verify the ownership of the client address.
@@ -62,10 +52,6 @@ type TokenStore interface {
 	Put(key string, token *ClientToken)
 }

-// An ErrorCode is an application-defined error code.
-// Valid values range between 0 and MAX_UINT62.
-type ErrorCode = protocol.ApplicationErrorCode
-
 // Err0RTTRejected is the returned from:
 // * Open{Uni}Stream{Sync}
 // * Accept{Uni}Stream
@@ -73,7 +59,16 @@ type ErrorCode = protocol.ApplicationErrorCode
 // when the server rejects a 0-RTT connection attempt.
 var Err0RTTRejected = errors.New("0-RTT rejected")

+// SessionTracingKey can be used to associate a ConnectionTracer with a Session.
+// It is set on the Session.Context() context,
+// as well as on the context passed to logging.Tracer.NewConnectionTracer.
+var SessionTracingKey = sessionTracingCtxKey{}
+
+type sessionTracingCtxKey struct{}
+
 // Stream is the interface implemented by QUIC streams
+// In addition to the errors listed on the Session,
+// calls to stream functions can return a StreamError if the stream is canceled.
 type Stream interface {
 	ReceiveStream
 	SendStream
@@ -99,7 +94,7 @@ type ReceiveStream interface {
 	// It will ask the peer to stop transmitting stream data.
 	// Read will unblock immediately, and future Read calls will fail.
 	// When called multiple times or after reading the io.EOF it is a no-op.
-	CancelRead(ErrorCode)
+	CancelRead(StreamErrorCode)
 	// SetReadDeadline sets the deadline for future Read calls and
 	// any currently-blocked Read call.
 	// A zero value for t means Read will not time out.
@@ -128,7 +123,7 @@ type SendStream interface {
 	// Data already written, but not yet delivered to the peer is not guaranteed to be delivered reliably.
 	// Write will unblock immediately, and future calls to Write will fail.
 	// When called multiple times or after closing the stream it is a no-op.
-	CancelWrite(ErrorCode)
+	CancelWrite(StreamErrorCode)
 	// The context is canceled as soon as the write-side of the stream is closed.
 	// This happens when Close() or CancelWrite() is called, or when the peer
 	// cancels the read-side of their stream.
@@ -142,14 +137,14 @@ type SendStream interface {
 	SetWriteDeadline(t time.Time) error
 }

-// StreamError is returned by Read and Write when the peer cancels the stream.
-type StreamError interface {
-	error
-	Canceled() bool
-	ErrorCode() ErrorCode
-}
-
 // A Session is a QUIC connection between two peers.
+// Calls to the session (and to streams) can return the following types of errors:
+// * ApplicationError: for errors triggered by the application running on top of QUIC
+// * TransportError: for errors triggered by the QUIC transport (in many cases a misbehaving peer)
+// * IdleTimeoutError: when the peer goes away unexpectedly (this is a net.Error timeout error)
+// * HandshakeTimeoutError: when the cryptographic handshake takes too long (this is a net.Error timeout error)
+// * StatelessResetError: when we receive a stateless reset (this is a net.Error temporary error)
+// * VersionNegotiationError: returned by the client, when there's no version overlap between the peers
 type Session interface {
 	// AcceptStream returns the next stream opened by the peer, blocking until one is available.
 	// If the session was closed due to a timeout, the error satisfies
@@ -185,9 +180,9 @@ type Session interface {
 	LocalAddr() net.Addr
 	// RemoteAddr returns the address of the peer.
 	RemoteAddr() net.Addr
-	// Close the connection with an error.
+	// CloseWithError closes the connection with an error.
 	// The error string will be sent to the peer.
-	CloseWithError(ErrorCode, string) error
+	CloseWithError(ApplicationErrorCode, string) error
 	// The context is cancelled when the session is closed.
 	// Warning: This API should not be considered stable and might change soon.
 	Context() context.Context
@@ -289,6 +284,10 @@ type Config struct {
 	// DisablePathMTUDiscovery disables Path MTU Discovery (RFC 8899).
 	// Packets will then be at most 1252 (IPv4) / 1232 (IPv6) bytes in size.
 	DisablePathMTUDiscovery bool
+	// DisableVersionNegotiationPackets disables the sending of Version Negotiation packets.
+	// This can be useful if version information is exchanged out-of-band.
+	// It has no effect for a client.
+	DisableVersionNegotiationPackets bool
 	// See https://datatracker.ietf.org/doc/draft-ietf-quic-datagram/.
 	// Datagrams will only be available when both peers enable datagram support.
 	EnableDatagrams bool
--- a/vendor/github.com/lucas-clemente/quic-go/internal/ackhandler/ackhandler.go
+++ b/vendor/github.com/lucas-clemente/quic-go/internal/ackhandler/ackhandler.go
@@ -9,12 +9,13 @@ import (
 // NewAckHandler creates a new SentPacketHandler and a new ReceivedPacketHandler
 func NewAckHandler(
 	initialPacketNumber protocol.PacketNumber,
+	initialMaxDatagramSize protocol.ByteCount,
 	rttStats *utils.RTTStats,
 	pers protocol.Perspective,
 	tracer logging.ConnectionTracer,
 	logger utils.Logger,
 	version protocol.VersionNumber,
 ) (SentPacketHandler, ReceivedPacketHandler) {
-	sph := newSentPacketHandler(initialPacketNumber, rttStats, pers, tracer, logger)
+	sph := newSentPacketHandler(initialPacketNumber, initialMaxDatagramSize, rttStats, pers, tracer, logger)
 	return sph, newReceivedPacketHandler(sph, rttStats, logger, version)
 }
--- a/vendor/github.com/lucas-clemente/quic-go/internal/ackhandler/interfaces.go
+++ b/vendor/github.com/lucas-clemente/quic-go/internal/ackhandler/interfaces.go
@@ -27,7 +27,7 @@ type Packet struct {
 type SentPacketHandler interface {
 	// SentPacket may modify the packet
 	SentPacket(packet *Packet)
-	ReceivedAck(ackFrame *wire.AckFrame, encLevel protocol.EncryptionLevel, recvTime time.Time) error
+	ReceivedAck(ackFrame *wire.AckFrame, encLevel protocol.EncryptionLevel, recvTime time.Time) (bool /* 1-RTT packet acked */, error)
 	ReceivedBytes(protocol.ByteCount)
 	DropPackets(protocol.EncryptionLevel)
 	ResetForRetry() error
--- a/vendor/github.com/lucas-clemente/quic-go/internal/ackhandler/sent_packet_handler.go
+++ b/vendor/github.com/lucas-clemente/quic-go/internal/ackhandler/sent_packet_handler.go
@@ -21,6 +21,8 @@ const (
 	packetThreshold = 3
 	// Before validating the client's address, the server won't send more than 3x bytes than it received.
 	amplificationFactor = 3
+	// We use Retry packets to derive an RTT estimate. Make sure we don't set the RTT to a super low value yet.
+	minRTTAfterRetry = 5 * time.Millisecond
 )

 type packetNumberSpace struct {
@@ -101,6 +103,7 @@ var (

 func newSentPacketHandler(
 	initialPN protocol.PacketNumber,
+	initialMaxDatagramSize protocol.ByteCount,
 	rttStats *utils.RTTStats,
 	pers protocol.Perspective,
 	tracer logging.ConnectionTracer,
@@ -109,6 +112,7 @@ func newSentPacketHandler(
 	congestion := congestion.NewCubicSender(
 		congestion.DefaultClock{},
 		rttStats,
+		initialMaxDatagramSize,
 		true, // use Reno
 		tracer,
 	)
@@ -194,12 +198,17 @@ func (h *sentPacketHandler) dropPackets(encLevel protocol.EncryptionLevel) {
 }

 func (h *sentPacketHandler) ReceivedBytes(n protocol.ByteCount) {
+	wasAmplificationLimit := h.isAmplificationLimited()
 	h.bytesReceived += n
+	if wasAmplificationLimit && !h.isAmplificationLimited() {
+		h.setLossDetectionTimer()
+	}
 }

-func (h *sentPacketHandler) ReceivedPacket(encLevel protocol.EncryptionLevel) {
-	if h.perspective == protocol.PerspectiveServer && encLevel == protocol.EncryptionHandshake {
+func (h *sentPacketHandler) ReceivedPacket(l protocol.EncryptionLevel) {
+	if h.perspective == protocol.PerspectiveServer && l == protocol.EncryptionHandshake && !h.peerAddressValidated {
 		h.peerAddressValidated = true
+		h.setLossDetectionTimer()
 	}
 }

@@ -268,12 +277,15 @@ func (h *sentPacketHandler) sentPacketImpl(packet *Packet) bool /* is ack-elicit
 	return isAckEliciting
 }

-func (h *sentPacketHandler) ReceivedAck(ack *wire.AckFrame, encLevel protocol.EncryptionLevel, rcvTime time.Time) error {
+func (h *sentPacketHandler) ReceivedAck(ack *wire.AckFrame, encLevel protocol.EncryptionLevel, rcvTime time.Time) (bool /* contained 1-RTT packet */, error) {
 	pnSpace := h.getPacketNumberSpace(encLevel)

 	largestAcked := ack.LargestAcked()
 	if largestAcked > pnSpace.largestSent {
-		return qerr.NewError(qerr.ProtocolViolation, "Received ACK for an unsent packet")
+		return false, &qerr.TransportError{
+			ErrorCode:    qerr.ProtocolViolation,
+			ErrorMessage: "received ACK for an unsent packet",
+		}
 	}

 	pnSpace.largestAcked = utils.MaxPacketNumber(pnSpace.largestAcked, largestAcked)
@@ -290,7 +302,7 @@ func (h *sentPacketHandler) ReceivedAck(ack *wire.AckFrame, encLevel protocol.En
 	priorInFlight := h.bytesInFlight
 	ackedPackets, err := h.detectAndRemoveAckedPackets(ack, encLevel)
 	if err != nil || len(ackedPackets) == 0 {
-		return err
+		return false, err
 	}
 	// update the RTT, if the largest acked is newly acknowledged
 	if len(ackedPackets) > 0 {
@@ -308,15 +320,16 @@ func (h *sentPacketHandler) ReceivedAck(ack *wire.AckFrame, encLevel protocol.En
 		}
 	}
 	if err := h.detectLostPackets(rcvTime, encLevel); err != nil {
-		return err
+		return false, err
 	}
+	var acked1RTTPacket bool
 	for _, p := range ackedPackets {
-		if p.skippedPacket {
-			return fmt.Errorf("received an ACK for skipped packet number: %d (%s)", p.PacketNumber, encLevel)
-		}
 		if p.includedInBytesInFlight && !p.declaredLost {
 			h.congestion.OnPacketAcked(p.PacketNumber, p.Length, priorInFlight, rcvTime)
 		}
+		if p.EncryptionLevel == protocol.Encryption1RTT {
+			acked1RTTPacket = true
+		}
 		h.removeFromBytesInFlight(p)
 	}

@@ -335,7 +348,7 @@ func (h *sentPacketHandler) ReceivedAck(ack *wire.AckFrame, encLevel protocol.En

 	pnSpace.history.DeleteOldPackets(rcvTime)
 	h.setLossDetectionTimer()
-	return nil
+	return acked1RTTPacket, nil
 }

 func (h *sentPacketHandler) GetLowestPacketNotConfirmedAcked() protocol.PacketNumber {
@@ -367,15 +380,20 @@ func (h *sentPacketHandler) detectAndRemoveAckedPackets(ack *wire.AckFrame, encL
 				ackRange = ack.AckRanges[len(ack.AckRanges)-1-ackRangeIndex]
 			}

-			if p.PacketNumber >= ackRange.Smallest { // packet i contained in ACK range
-				if p.PacketNumber > ackRange.Largest {
-					return false, fmt.Errorf("BUG: ackhandler would have acked wrong packet %d, while evaluating range %d -> %d", p.PacketNumber, ackRange.Smallest, ackRange.Largest)
-				}
-				h.ackedPackets = append(h.ackedPackets, p)
+			if p.PacketNumber < ackRange.Smallest { // packet not contained in ACK range
+				return true, nil
+			}
+			if p.PacketNumber > ackRange.Largest {
+				return false, fmt.Errorf("BUG: ackhandler would have acked wrong packet %d, while evaluating range %d -> %d", p.PacketNumber, ackRange.Smallest, ackRange.Largest)
 			}
-		} else {
-			h.ackedPackets = append(h.ackedPackets, p)
 		}
+		if p.skippedPacket {
+			return false, &qerr.TransportError{
+				ErrorCode:    qerr.ProtocolViolation,
+				ErrorMessage: fmt.Sprintf("received an ACK for skipped packet number: %d (%s)", p.PacketNumber, encLevel),
+			}
+		}
+		h.ackedPackets = append(h.ackedPackets, p)
 		return true, nil
 	})
 	if h.logger.Debug() && len(h.ackedPackets) > 0 {
@@ -399,6 +417,9 @@ func (h *sentPacketHandler) detectAndRemoveAckedPackets(ack *wire.AckFrame, encL
 		if err := pnSpace.history.Remove(p.PacketNumber); err != nil {
 			return nil, err
 		}
+		if h.tracer != nil {
+			h.tracer.AcknowledgedPacket(encLevel, p.PacketNumber)
+		}
 	}

 	return h.ackedPackets, err
@@ -424,20 +445,20 @@ func (h *sentPacketHandler) getLossTimeAndSpace() (time.Time, protocol.Encryptio
 }

 // same logic as getLossTimeAndSpace, but for lastAckElicitingPacketTime instead of lossTime
-func (h *sentPacketHandler) getPTOTimeAndSpace() (time.Time, protocol.EncryptionLevel) {
-	if !h.hasOutstandingPackets() {
+func (h *sentPacketHandler) getPTOTimeAndSpace() (pto time.Time, encLevel protocol.EncryptionLevel, ok bool) {
+	// We only send application data probe packets once the handshake is confirmed,
+	// because before that, we don't have the keys to decrypt ACKs sent in 1-RTT packets.
+	if !h.handshakeConfirmed && !h.hasOutstandingCryptoPackets() {
+		if h.peerCompletedAddressValidation {
+			return
+		}
 		t := time.Now().Add(h.rttStats.PTO(false) << h.ptoCount)
 		if h.initialPackets != nil {
-			return t, protocol.EncryptionInitial
+			return t, protocol.EncryptionInitial, true
 		}
-		return t, protocol.EncryptionHandshake
+		return t, protocol.EncryptionHandshake, true
 	}

-	var (
-		encLevel protocol.EncryptionLevel
-		pto      time.Time
-	)
-
 	if h.initialPackets != nil {
 		encLevel = protocol.EncryptionInitial
 		if t := h.initialPackets.lastAckElicitingPacketTime; !t.IsZero() {
@@ -458,30 +479,27 @@ func (h *sentPacketHandler) getPTOTimeAndSpace() (time.Time, protocol.Encryption
 			encLevel = protocol.Encryption1RTT
 		}
 	}
-	return pto, encLevel
+	return pto, encLevel, true
 }

 func (h *sentPacketHandler) hasOutstandingCryptoPackets() bool {
-	var hasInitial, hasHandshake bool
-	if h.initialPackets != nil {
-		hasInitial = h.initialPackets.history.HasOutstandingPackets()
+	if h.initialPackets != nil && h.initialPackets.history.HasOutstandingPackets() {
+		return true
 	}
-	if h.handshakePackets != nil {
-		hasHandshake = h.handshakePackets.history.HasOutstandingPackets()
+	if h.handshakePackets != nil && h.handshakePackets.history.HasOutstandingPackets() {
+		return true
 	}
-	return hasInitial || hasHandshake
+	return false
 }

 func (h *sentPacketHandler) hasOutstandingPackets() bool {
-	// We only send application data probe packets once the handshake completes,
-	// because before that, we don't have the keys to decrypt ACKs sent in 1-RTT packets.
-	return (h.handshakeConfirmed && h.appDataPackets.history.HasOutstandingPackets()) ||
-		h.hasOutstandingCryptoPackets()
+	return h.appDataPackets.history.HasOutstandingPackets() || h.hasOutstandingCryptoPackets()
 }

 func (h *sentPacketHandler) setLossDetectionTimer() {
 	oldAlarm := h.alarm // only needed in case tracing is enabled
-	if lossTime, encLevel := h.getLossTimeAndSpace(); !lossTime.IsZero() {
+	lossTime, encLevel := h.getLossTimeAndSpace()
+	if !lossTime.IsZero() {
 		// Early retransmit timer or time loss detection.
 		h.alarm = lossTime
 		if h.tracer != nil && h.alarm != oldAlarm {
@@ -490,18 +508,42 @@ func (h *sentPacketHandler) setLossDetectionTimer() {
 		return
 	}

+	// Cancel the alarm if amplification limited.
+	if h.isAmplificationLimited() {
+		h.alarm = time.Time{}
+		if !oldAlarm.IsZero() {
+			h.logger.Debugf("Canceling loss detection timer. Amplification limited.")
+			if h.tracer != nil {
+				h.tracer.LossTimerCanceled()
+			}
+		}
+		return
+	}
+
 	// Cancel the alarm if no packets are outstanding
 	if !h.hasOutstandingPackets() && h.peerCompletedAddressValidation {
 		h.alarm = time.Time{}
-		h.logger.Debugf("Canceling loss detection timer. No packets in flight.")
-		if h.tracer != nil && !oldAlarm.IsZero() {
-			h.tracer.LossTimerCanceled()
+		if !oldAlarm.IsZero() {
+			h.logger.Debugf("Canceling loss detection timer. No packets in flight.")
+			if h.tracer != nil {
+				h.tracer.LossTimerCanceled()
+			}
 		}
 		return
 	}

 	// PTO alarm
-	ptoTime, encLevel := h.getPTOTimeAndSpace()
+	ptoTime, encLevel, ok := h.getPTOTimeAndSpace()
+	if !ok {
+		if !oldAlarm.IsZero() {
+			h.alarm = time.Time{}
+			h.logger.Debugf("Canceling loss detection timer. No PTO needed..")
+			if h.tracer != nil {
+				h.tracer.LossTimerCanceled()
+			}
+		}
+		return
+	}
 	h.alarm = ptoTime
 	if h.tracer != nil && h.alarm != oldAlarm {
 		h.tracer.SetLossTimer(logging.TimerTypePTO, encLevel, h.alarm)
@@ -569,20 +611,7 @@ func (h *sentPacketHandler) detectLostPackets(now time.Time, encLevel protocol.E
 }

 func (h *sentPacketHandler) OnLossDetectionTimeout() error {
-	// When all outstanding are acknowledged, the alarm is canceled in
-	// setLossDetectionTimer. This doesn't reset the timer in the session though.
-	// When OnAlarm is called, we therefore need to make sure that there are
-	// actually packets outstanding.
-	if h.hasOutstandingPackets() || !h.peerCompletedAddressValidation {
-		if err := h.onVerifiedLossDetectionTimeout(); err != nil {
-			return err
-		}
-	}
-	h.setLossDetectionTimer()
-	return nil
-}
-
-func (h *sentPacketHandler) onVerifiedLossDetectionTimeout() error {
+	defer h.setLossDetectionTimer()
 	earliestLossTime, encLevel := h.getLossTimeAndSpace()
 	if !earliestLossTime.IsZero() {
 		if h.logger.Debug() {
@@ -596,34 +625,12 @@ func (h *sentPacketHandler) onVerifiedLossDetectionTimeout() error {
 	}

 	// PTO
-	h.ptoCount++
-	if h.bytesInFlight > 0 {
-		_, encLevel = h.getPTOTimeAndSpace()
-		if h.logger.Debug() {
-			h.logger.Debugf("Loss detection alarm for %s fired in PTO mode. PTO count: %d", encLevel, h.ptoCount)
-		}
-		if h.tracer != nil {
-			h.tracer.LossTimerExpired(logging.TimerTypePTO, encLevel)
-			h.tracer.UpdatedPTOCount(h.ptoCount)
-		}
-		h.numProbesToSend += 2
-		//nolint:exhaustive // We never arm a PTO timer for 0-RTT packets.
-		switch encLevel {
-		case protocol.EncryptionInitial:
-			h.ptoMode = SendPTOInitial
-		case protocol.EncryptionHandshake:
-			h.ptoMode = SendPTOHandshake
-		case protocol.Encryption1RTT:
-			// skip a packet number in order to elicit an immediate ACK
-			_ = h.PopPacketNumber(protocol.Encryption1RTT)
-			h.ptoMode = SendPTOAppData
-		default:
-			return fmt.Errorf("PTO timer in unexpected encryption level: %s", encLevel)
-		}
-	} else {
-		if h.perspective == protocol.PerspectiveServer {
-			return errors.New("sentPacketHandler BUG: PTO fired, but bytes_in_flight is 0")
-		}
+	// When all outstanding are acknowledged, the alarm is canceled in
+	// setLossDetectionTimer. This doesn't reset the timer in the session though.
+	// When OnAlarm is called, we therefore need to make sure that there are
+	// actually packets outstanding.
+	if h.bytesInFlight == 0 && !h.peerCompletedAddressValidation {
+		h.ptoCount++
 		h.numProbesToSend++
 		if h.initialPackets != nil {
 			h.ptoMode = SendPTOInitial
@@ -632,6 +639,37 @@ func (h *sentPacketHandler) onVerifiedLossDetectionTimeout() error {
 		} else {
 			return errors.New("sentPacketHandler BUG: PTO fired, but bytes_in_flight is 0 and Initial and Handshake already dropped")
 		}
+		return nil
+	}
+
+	_, encLevel, ok := h.getPTOTimeAndSpace()
+	if !ok {
+		return nil
+	}
+	if ps := h.getPacketNumberSpace(encLevel); !ps.history.HasOutstandingPackets() && !h.peerCompletedAddressValidation {
+		return nil
+	}
+	h.ptoCount++
+	if h.logger.Debug() {
+		h.logger.Debugf("Loss detection alarm for %s fired in PTO mode. PTO count: %d", encLevel, h.ptoCount)
+	}
+	if h.tracer != nil {
+		h.tracer.LossTimerExpired(logging.TimerTypePTO, encLevel)
+		h.tracer.UpdatedPTOCount(h.ptoCount)
+	}
+	h.numProbesToSend += 2
+	//nolint:exhaustive // We never arm a PTO timer for 0-RTT packets.
+	switch encLevel {
+	case protocol.EncryptionInitial:
+		h.ptoMode = SendPTOInitial
+	case protocol.EncryptionHandshake:
+		h.ptoMode = SendPTOHandshake
+	case protocol.Encryption1RTT:
+		// skip a packet number in order to elicit an immediate ACK
+		_ = h.PopPacketNumber(protocol.Encryption1RTT)
+		h.ptoMode = SendPTOAppData
+	default:
+		return fmt.Errorf("PTO timer in unexpected encryption level: %s", encLevel)
 	}
 	return nil
 }
@@ -768,8 +806,9 @@ func (h *sentPacketHandler) ResetForRetry() error {
 	// Only use the Retry to estimate the RTT if we didn't send any retransmission for the Initial.
 	// Otherwise, we don't know which Initial the Retry was sent in response to.
 	if h.ptoCount == 0 {
+		// Don't set the RTT to a value lower than 5ms here.
 		now := time.Now()
-		h.rttStats.UpdateRTT(now.Sub(firstPacketSendTime), 0, now)
+		h.rttStats.UpdateRTT(utils.MaxDuration(minRTTAfterRetry, now.Sub(firstPacketSendTime)), 0, now)
 		if h.logger.Debug() {
 			h.logger.Debugf("\tupdated RTT: %s (σ: %s)", h.rttStats.SmoothedRTT(), h.rttStats.MeanDeviation())
 		}
--- a/vendor/github.com/lucas-clemente/quic-go/internal/ackhandler/sent_packet_history.go
+++ b/vendor/github.com/lucas-clemente/quic-go/internal/ackhandler/sent_packet_history.go
@@ -64,8 +64,9 @@ func (h *sentPacketHistory) Iterate(cb func(*Packet) (cont bool, err error)) err
 // FirstOutStanding returns the first outstanding packet.
 func (h *sentPacketHistory) FirstOutstanding() *Packet {
 	for el := h.packetList.Front(); el != nil; el = el.Next() {
-		if !el.Value.declaredLost && !el.Value.skippedPacket {
-			return &el.Value
+		p := &el.Value
+		if !p.declaredLost && !p.skippedPacket && !p.IsPathMTUProbePacket {
+			return p
 		}
 	}
 	return nil
--- a/vendor/github.com/lucas-clemente/quic-go/internal/congestion/cubic_sender.go
+++ b/vendor/github.com/lucas-clemente/quic-go/internal/congestion/cubic_sender.go
@@ -1,6 +1,7 @@
 package congestion

 import (
+	"fmt"
 	"time"

 	"github.com/lucas-clemente/quic-go/internal/protocol"
@@ -14,9 +15,8 @@ const (
 	initialMaxDatagramSize     = protocol.ByteCount(protocol.InitialPacketSizeIPv4)
 	maxBurstPackets            = 3
 	renoBeta                   = 0.7 // Reno backoff factor.
-	initialMaxCongestionWindow = protocol.MaxCongestionWindowPackets * initialMaxDatagramSize
 	minCongestionWindowPackets = 2
-	initialCongestionWindow    = 32 * initialMaxDatagramSize
+	initialCongestionWindow    = 32
 )

 type cubicSender struct {
@@ -65,11 +65,33 @@ var (
 )

 // NewCubicSender makes a new cubic sender
-func NewCubicSender(clock Clock, rttStats *utils.RTTStats, reno bool, tracer logging.ConnectionTracer) *cubicSender {
-	return newCubicSender(clock, rttStats, reno, initialCongestionWindow, initialMaxCongestionWindow, tracer)
+func NewCubicSender(
+	clock Clock,
+	rttStats *utils.RTTStats,
+	initialMaxDatagramSize protocol.ByteCount,
+	reno bool,
+	tracer logging.ConnectionTracer,
+) *cubicSender {
+	return newCubicSender(
+		clock,
+		rttStats,
+		reno,
+		initialMaxDatagramSize,
+		initialCongestionWindow*initialMaxDatagramSize,
+		protocol.MaxCongestionWindowPackets*initialMaxDatagramSize,
+		tracer,
+	)
 }

-func newCubicSender(clock Clock, rttStats *utils.RTTStats, reno bool, initialCongestionWindow, initialMaxCongestionWindow protocol.ByteCount, tracer logging.ConnectionTracer) *cubicSender {
+func newCubicSender(
+	clock Clock,
+	rttStats *utils.RTTStats,
+	reno bool,
+	initialMaxDatagramSize,
+	initialCongestionWindow,
+	initialMaxCongestionWindow protocol.ByteCount,
+	tracer logging.ConnectionTracer,
+) *cubicSender {
 	c := &cubicSender{
 		rttStats:                   rttStats,
 		largestSentPacketNumber:    protocol.InvalidPacketNumber,
@@ -283,7 +305,7 @@ func (c *cubicSender) maybeTraceStateChange(new logging.CongestionState) {

 func (c *cubicSender) SetMaxDatagramSize(s protocol.ByteCount) {
 	if s < c.maxDatagramSize {
-		panic("congestion BUG: decreased max datagram size")
+		panic(fmt.Sprintf("congestion BUG: decreased max datagram size from %d to %d", c.maxDatagramSize, s))
 	}
 	cwndIsMinCwnd := c.congestionWindow == c.minCongestionWindow()
 	c.maxDatagramSize = s
--- a/vendor/github.com/lucas-clemente/quic-go/internal/flowcontrol/connection_flow_controller.go
+++ b/vendor/github.com/lucas-clemente/quic-go/internal/flowcontrol/connection_flow_controller.go
@@ -50,7 +50,10 @@ func (c *connectionFlowController) IncrementHighestReceived(increment protocol.B

 	c.highestReceived += increment
 	if c.checkFlowControlViolation() {
-		return qerr.NewError(qerr.FlowControlError, fmt.Sprintf("Received %d bytes for the connection, allowed %d bytes", c.highestReceived, c.receiveWindow))
+		return &qerr.TransportError{
+			ErrorCode:    qerr.FlowControlError,
+			ErrorMessage: fmt.Sprintf("received %d bytes for the connection, allowed %d bytes", c.highestReceived, c.receiveWindow),
+		}
 	}
 	return nil
 }
--- a/vendor/github.com/lucas-clemente/quic-go/internal/flowcontrol/stream_flow_controller.go
+++ b/vendor/github.com/lucas-clemente/quic-go/internal/flowcontrol/stream_flow_controller.go
@@ -54,11 +54,17 @@ func (c *streamFlowController) UpdateHighestReceived(offset protocol.ByteCount,
 	if c.receivedFinalOffset {
 		// If we receive another final offset, check that it's the same.
 		if final && offset != c.highestReceived {
-			return qerr.NewError(qerr.FinalSizeError, fmt.Sprintf("Received inconsistent final offset for stream %d (old: %d, new: %d bytes)", c.streamID, c.highestReceived, offset))
+			return &qerr.TransportError{
+				ErrorCode:    qerr.FinalSizeError,
+				ErrorMessage: fmt.Sprintf("received inconsistent final offset for stream %d (old: %d, new: %d bytes)", c.streamID, c.highestReceived, offset),
+			}
 		}
 		// Check that the offset is below the final offset.
 		if offset > c.highestReceived {
-			return qerr.NewError(qerr.FinalSizeError, fmt.Sprintf("Received offset %d for stream %d. Final offset was already received at %d", offset, c.streamID, c.highestReceived))
+			return &qerr.TransportError{
+				ErrorCode:    qerr.FinalSizeError,
+				ErrorMessage: fmt.Sprintf("received offset %d for stream %d, but final offset was already received at %d", offset, c.streamID, c.highestReceived),
+			}
 		}
 	}

@@ -72,7 +78,10 @@ func (c *streamFlowController) UpdateHighestReceived(offset protocol.ByteCount,
 	// This can happen due to reordering.
 	if offset <= c.highestReceived {
 		if final {
-			return qerr.NewError(qerr.FinalSizeError, fmt.Sprintf("Received final offset %d for stream %d, but already received offset %d before", offset, c.streamID, c.highestReceived))
+			return &qerr.TransportError{
+				ErrorCode:    qerr.FinalSizeError,
+				ErrorMessage: fmt.Sprintf("received final offset %d for stream %d, but already received offset %d before", offset, c.streamID, c.highestReceived),
+			}
 		}
 		return nil
 	}
@@ -80,7 +89,10 @@ func (c *streamFlowController) UpdateHighestReceived(offset protocol.ByteCount,
 	increment := offset - c.highestReceived
 	c.highestReceived = offset
 	if c.checkFlowControlViolation() {
-		return qerr.NewError(qerr.FlowControlError, fmt.Sprintf("Received %d bytes on stream %d, allowed %d bytes", offset, c.streamID, c.receiveWindow))
+		return &qerr.TransportError{
+			ErrorCode:    qerr.FlowControlError,
+			ErrorMessage: fmt.Sprintf("received %d bytes on stream %d, allowed %d bytes", offset, c.streamID, c.receiveWindow),
+		}
 	}
 	return c.connection.IncrementHighestReceived(increment)
 }
@@ -97,7 +109,10 @@ func (c *streamFlowController) AddBytesRead(n protocol.ByteCount) {
 }

 func (c *streamFlowController) Abandon() {
-	if unread := c.highestReceived - c.bytesRead; unread > 0 {
+	c.mutex.Lock()
+	unread := c.highestReceived - c.bytesRead
+	c.mutex.Unlock()
+	if unread > 0 {
 		c.connection.AddBytesRead(unread)
 	}
 }
--- a/vendor/github.com/lucas-clemente/quic-go/internal/handshake/crypto_setup.go
+++ b/vendor/github.com/lucas-clemente/quic-go/internal/handshake/crypto_setup.go
@@ -403,7 +403,10 @@ func (h *cryptoSetup) checkEncryptionLevel(msgType messageType, encLevel protoco
 func (h *cryptoSetup) handleTransportParameters(data []byte) {
 	var tp wire.TransportParameters
 	if err := tp.Unmarshal(data, h.perspective.Opposite()); err != nil {
-		h.runner.OnError(qerr.NewError(qerr.TransportParameterError, err.Error()))
+		h.runner.OnError(&qerr.TransportError{
+			ErrorCode:    qerr.TransportParameterError,
+			ErrorMessage: err.Error(),
+		})
 	}
 	h.peerParams = &tp
 	h.runner.OnReceivedParams(h.peerParams)
@@ -555,7 +558,7 @@ func (h *cryptoSetup) SetReadKey(encLevel qtls.EncryptionLevel, suite *qtls.Ciph
 			newHeaderProtector(suite, trafficSecret, true),
 		)
 		h.mutex.Unlock()
-		h.logger.Debugf("Installed 0-RTT Read keys (using %s)", qtls.CipherSuiteName(suite.ID))
+		h.logger.Debugf("Installed 0-RTT Read keys (using %s)", tls.CipherSuiteName(suite.ID))
 		if h.tracer != nil {
 			h.tracer.UpdatedKeyFromTLS(protocol.Encryption0RTT, h.perspective.Opposite())
 		}
@@ -568,12 +571,12 @@ func (h *cryptoSetup) SetReadKey(encLevel qtls.EncryptionLevel, suite *qtls.Ciph
 			h.dropInitialKeys,
 			h.perspective,
 		)
-		h.logger.Debugf("Installed Handshake Read keys (using %s)", qtls.CipherSuiteName(suite.ID))
+		h.logger.Debugf("Installed Handshake Read keys (using %s)", tls.CipherSuiteName(suite.ID))
 	case qtls.EncryptionApplication:
 		h.readEncLevel = protocol.Encryption1RTT
 		h.aead.SetReadKey(suite, trafficSecret)
 		h.has1RTTOpener = true
-		h.logger.Debugf("Installed 1-RTT Read keys (using %s)", qtls.CipherSuiteName(suite.ID))
+		h.logger.Debugf("Installed 1-RTT Read keys (using %s)", tls.CipherSuiteName(suite.ID))
 	default:
 		panic("unexpected read encryption level")
 	}
@@ -595,7 +598,7 @@ func (h *cryptoSetup) SetWriteKey(encLevel qtls.EncryptionLevel, suite *qtls.Cip
 			newHeaderProtector(suite, trafficSecret, true),
 		)
 		h.mutex.Unlock()
-		h.logger.Debugf("Installed 0-RTT Write keys (using %s)", qtls.CipherSuiteName(suite.ID))
+		h.logger.Debugf("Installed 0-RTT Write keys (using %s)", tls.CipherSuiteName(suite.ID))
 		if h.tracer != nil {
 			h.tracer.UpdatedKeyFromTLS(protocol.Encryption0RTT, h.perspective)
 		}
@@ -608,12 +611,12 @@ func (h *cryptoSetup) SetWriteKey(encLevel qtls.EncryptionLevel, suite *qtls.Cip
 			h.dropInitialKeys,
 			h.perspective,
 		)
-		h.logger.Debugf("Installed Handshake Write keys (using %s)", qtls.CipherSuiteName(suite.ID))
+		h.logger.Debugf("Installed Handshake Write keys (using %s)", tls.CipherSuiteName(suite.ID))
 	case qtls.EncryptionApplication:
 		h.writeEncLevel = protocol.Encryption1RTT
 		h.aead.SetWriteKey(suite, trafficSecret)
 		h.has1RTTSealer = true
-		h.logger.Debugf("Installed 1-RTT Write keys (using %s)", qtls.CipherSuiteName(suite.ID))
+		h.logger.Debugf("Installed 1-RTT Write keys (using %s)", tls.CipherSuiteName(suite.ID))
 		if h.zeroRTTSealer != nil {
 			h.zeroRTTSealer = nil
 			h.logger.Debugf("Dropping 0-RTT keys.")
--- a/vendor/github.com/lucas-clemente/quic-go/internal/handshake/initial_aead.go
+++ b/vendor/github.com/lucas-clemente/quic-go/internal/handshake/initial_aead.go
@@ -4,18 +4,20 @@ import (
 	"crypto"
 	"crypto/tls"

+	"golang.org/x/crypto/hkdf"
+
 	"github.com/lucas-clemente/quic-go/internal/protocol"
 	"github.com/lucas-clemente/quic-go/internal/qtls"
 )

 var (
-	quicSaltOld     = []byte{0xaf, 0xbf, 0xec, 0x28, 0x99, 0x93, 0xd2, 0x4c, 0x9e, 0x97, 0x86, 0xf1, 0x9c, 0x61, 0x11, 0xe0, 0x43, 0x90, 0xa8, 0x99}
-	quicSaltDraft34 = []byte{0x38, 0x76, 0x2c, 0xf7, 0xf5, 0x59, 0x34, 0xb3, 0x4d, 0x17, 0x9a, 0xe6, 0xa4, 0xc8, 0x0c, 0xad, 0xcc, 0xbb, 0x7f, 0x0a}
+	quicSaltOld = []byte{0xaf, 0xbf, 0xec, 0x28, 0x99, 0x93, 0xd2, 0x4c, 0x9e, 0x97, 0x86, 0xf1, 0x9c, 0x61, 0x11, 0xe0, 0x43, 0x90, 0xa8, 0x99}
+	quicSalt    = []byte{0x38, 0x76, 0x2c, 0xf7, 0xf5, 0x59, 0x34, 0xb3, 0x4d, 0x17, 0x9a, 0xe6, 0xa4, 0xc8, 0x0c, 0xad, 0xcc, 0xbb, 0x7f, 0x0a}
 )

 func getSalt(v protocol.VersionNumber) []byte {
-	if v == protocol.VersionDraft34 {
-		return quicSaltDraft34
+	if v == protocol.Version1 {
+		return quicSalt
 	}
 	return quicSaltOld
 }
@@ -49,7 +51,7 @@ func NewInitialAEAD(connID protocol.ConnectionID, pers protocol.Perspective, v p
 }

 func computeSecrets(connID protocol.ConnectionID, v protocol.VersionNumber) (clientSecret, serverSecret []byte) {
-	initialSecret := qtls.HkdfExtract(crypto.SHA256, connID, getSalt(v))
+	initialSecret := hkdf.Extract(crypto.SHA256.New, connID, getSalt(v))
 	clientSecret = hkdfExpandLabel(crypto.SHA256, initialSecret, []byte{}, "client in", crypto.SHA256.Size())
 	serverSecret = hkdfExpandLabel(crypto.SHA256, initialSecret, []byte{}, "server in", crypto.SHA256.Size())
 	return
--- a/vendor/github.com/lucas-clemente/quic-go/internal/handshake/retry.go
+++ b/vendor/github.com/lucas-clemente/quic-go/internal/handshake/retry.go
@@ -48,7 +48,7 @@ func GetRetryIntegrityTag(retry []byte, origDestConnID protocol.ConnectionID, ve

 	var tag [16]byte
 	var sealed []byte
-	if version != protocol.VersionDraft34 {
+	if version != protocol.Version1 {
 		sealed = oldRetryAEAD.Seal(tag[:0], oldRetryNonce[:], nil, retryBuf.Bytes())
 	} else {
 		sealed = retryAEAD.Seal(tag[:0], retryNonce[:], nil, retryBuf.Bytes())
--- a/vendor/github.com/lucas-clemente/quic-go/internal/handshake/tls_extension_handler.go
+++ b/vendor/github.com/lucas-clemente/quic-go/internal/handshake/tls_extension_handler.go
@@ -24,7 +24,7 @@ var _ tlsExtensionHandler = &extensionHandler{}
 // newExtensionHandler creates a new extension handler
 func newExtensionHandler(params []byte, pers protocol.Perspective, v protocol.VersionNumber) tlsExtensionHandler {
 	et := uint16(quicTLSExtensionType)
-	if v != protocol.VersionDraft34 {
+	if v != protocol.Version1 {
 		et = quicTLSExtensionTypeOldDrafts
 	}
 	return &extensionHandler{
--- a/vendor/github.com/lucas-clemente/quic-go/internal/handshake/updatable_aead.go
+++ b/vendor/github.com/lucas-clemente/quic-go/internal/handshake/updatable_aead.go
@@ -163,7 +163,7 @@ func (a *updatableAEAD) Open(dst, src []byte, rcvTime time.Time, pn protocol.Pac
 	if err == ErrDecryptionFailed {
 		a.invalidPacketCount++
 		if a.invalidPacketCount >= a.invalidPacketLimit {
-			return nil, qerr.AEADLimitReached
+			return nil, &qerr.TransportError{ErrorCode: qerr.AEADLimitReached}
 		}
 	}
 	if err == nil {
@@ -201,7 +201,10 @@ func (a *updatableAEAD) open(dst, src []byte, rcvTime time.Time, pn protocol.Pac
 		}
 		// Opening succeeded. Check if the peer was allowed to update.
 		if a.keyPhase > 0 && a.firstSentWithCurrentKey == protocol.InvalidPacketNumber {
-			return nil, qerr.NewError(qerr.KeyUpdateError, "keys updated too quickly")
+			return nil, &qerr.TransportError{
+				ErrorCode:    qerr.KeyUpdateError,
+				ErrorMessage: "keys updated too quickly",
+			}
 		}
 		a.rollKeys()
 		a.logger.Debugf("Peer updated keys to %d", a.keyPhase)
@@ -250,7 +253,10 @@ func (a *updatableAEAD) Seal(dst, src []byte, pn protocol.PacketNumber, ad []byt
 func (a *updatableAEAD) SetLargestAcked(pn protocol.PacketNumber) error {
 	if a.firstSentWithCurrentKey != protocol.InvalidPacketNumber &&
 		pn >= a.firstSentWithCurrentKey && a.numRcvdWithCurrentKey == 0 {
-		return qerr.NewError(qerr.KeyUpdateError, fmt.Sprintf("received ACK for key phase %d, but peer didn't update keys", a.keyPhase))
+		return &qerr.TransportError{
+			ErrorCode:    qerr.KeyUpdateError,
+			ErrorMessage: fmt.Sprintf("received ACK for key phase %d, but peer didn't update keys", a.keyPhase),
+		}
 	}
 	a.largestAcked = pn
 	return nil
--- a/vendor/github.com/lucas-clemente/quic-go/internal/protocol/protocol.go
+++ b/vendor/github.com/lucas-clemente/quic-go/internal/protocol/protocol.go
@@ -52,9 +52,6 @@ const MaxByteCount = ByteCount(1<<62 - 1)
 // InvalidByteCount is an invalid byte count
 const InvalidByteCount ByteCount = -1

-// An ApplicationErrorCode is an application-defined error code.
-type ApplicationErrorCode uint64
-
 // A StatelessResetToken is a stateless reset token.
 type StatelessResetToken [16]byte

--- a/vendor/github.com/lucas-clemente/quic-go/internal/protocol/version.go
+++ b/vendor/github.com/lucas-clemente/quic-go/internal/protocol/version.go
@@ -18,17 +18,16 @@ const (

 // The version numbers, making grepping easier
 const (
-	VersionTLS      VersionNumber = 0xff00001d // draft-29
-	VersionWhatever VersionNumber = 1          // for when the version doesn't matter
+	VersionTLS      VersionNumber = 0x1
+	VersionWhatever VersionNumber = math.MaxUint32 - 1 // for when the version doesn't matter
 	VersionUnknown  VersionNumber = math.MaxUint32
 	VersionDraft29  VersionNumber = 0xff00001d
-	VersionDraft32  VersionNumber = 0xff000020
-	VersionDraft34  VersionNumber = 0xff000022 // If everything goes according to plan at the IETF, this will one day be QUIC v1.
+	Version1        VersionNumber = 0x1
 )

 // SupportedVersions lists the versions that the server supports
 // must be in sorted descending order
-var SupportedVersions = []VersionNumber{VersionDraft29, VersionDraft34, VersionDraft32}
+var SupportedVersions = []VersionNumber{Version1, VersionDraft29}

 // IsValidVersion says if the version is known to quic-go
 func IsValidVersion(v VersionNumber) bool {
@@ -38,7 +37,7 @@ func IsValidVersion(v VersionNumber) bool {
 func (vn VersionNumber) String() string {
 	// For releases, VersionTLS will be set to a draft version.
 	// A switch statement can't contain duplicate cases.
-	if vn == VersionTLS && VersionTLS != VersionDraft29 && VersionTLS != VersionDraft32 {
+	if vn == VersionTLS && VersionTLS != VersionDraft29 && VersionTLS != Version1 {
 		return "TLS dev version (WIP)"
 	}
 	//nolint:exhaustive
@@ -49,10 +48,8 @@ func (vn VersionNumber) String() string {
 		return "unknown"
 	case VersionDraft29:
 		return "draft-29"
-	case VersionDraft32:
-		return "draft-32"
-	case VersionDraft34:
-		return "draft-34"
+	case Version1:
+		return "v1"
 	default:
 		if vn.isGQUIC() {
 			return fmt.Sprintf("gQUIC %d", vn.toGQUICVersion())
@@ -69,12 +66,6 @@ func (vn VersionNumber) toGQUICVersion() int {
 	return int(10*(vn-gquicVersion0)/0x100) + int(vn%0x10)
 }

-// UseRetireBugBackwardsCompatibilityMode says if it is necessary to use the backwards compatilibity mode.
-// This is only the case if it 1. is enabled and 2. draft-29 is used.
-func UseRetireBugBackwardsCompatibilityMode(enabled bool, v VersionNumber) bool {
-	return enabled && v == VersionDraft29
-}
-
 // IsSupportedVersion returns true if the server supports this version
 func IsSupportedVersion(supported []VersionNumber, v VersionNumber) bool {
 	for _, t := range supported {
@@ -118,14 +109,3 @@ func GetGreasedVersions(supported []VersionNumber) []VersionNumber {
 	copy(greased[randPos+1:], supported[randPos:])
 	return greased
 }
-
-// StripGreasedVersions strips all greased versions from a slice of versions
-func StripGreasedVersions(versions []VersionNumber) []VersionNumber {
-	realVersions := make([]VersionNumber, 0, len(versions))
-	for _, v := range versions {
-		if v&0x0f0f0f0f != 0x0a0a0a0a {
-			realVersions = append(realVersions, v)
-		}
-	}
-	return realVersions
-}
--- a/vendor/github.com/lucas-clemente/quic-go/internal/qerr/error_codes.go
+++ b/vendor/github.com/lucas-clemente/quic-go/internal/qerr/error_codes.go
@@ -6,51 +6,44 @@ import (
 	"github.com/lucas-clemente/quic-go/internal/qtls"
 )

-// ErrorCode can be used as a normal error without reason.
-type ErrorCode uint64
+// TransportErrorCode is a QUIC transport error.
+type TransportErrorCode uint64

 // The error codes defined by QUIC
 const (
-	NoError                 ErrorCode = 0x0
-	InternalError           ErrorCode = 0x1
-	ConnectionRefused       ErrorCode = 0x2
-	FlowControlError        ErrorCode = 0x3
-	StreamLimitError        ErrorCode = 0x4
-	StreamStateError        ErrorCode = 0x5
-	FinalSizeError          ErrorCode = 0x6
-	FrameEncodingError      ErrorCode = 0x7
-	TransportParameterError ErrorCode = 0x8
-	ConnectionIDLimitError  ErrorCode = 0x9
-	ProtocolViolation       ErrorCode = 0xa
-	InvalidToken            ErrorCode = 0xb
-	ApplicationError        ErrorCode = 0xc
-	CryptoBufferExceeded    ErrorCode = 0xd
-	KeyUpdateError          ErrorCode = 0xe
-	AEADLimitReached        ErrorCode = 0xf
-	NoViablePathError       ErrorCode = 0x10
+	NoError                   TransportErrorCode = 0x0
+	InternalError             TransportErrorCode = 0x1
+	ConnectionRefused         TransportErrorCode = 0x2
+	FlowControlError          TransportErrorCode = 0x3
+	StreamLimitError          TransportErrorCode = 0x4
+	StreamStateError          TransportErrorCode = 0x5
+	FinalSizeError            TransportErrorCode = 0x6
+	FrameEncodingError        TransportErrorCode = 0x7
+	TransportParameterError   TransportErrorCode = 0x8
+	ConnectionIDLimitError    TransportErrorCode = 0x9
+	ProtocolViolation         TransportErrorCode = 0xa
+	InvalidToken              TransportErrorCode = 0xb
+	ApplicationErrorErrorCode TransportErrorCode = 0xc
+	CryptoBufferExceeded      TransportErrorCode = 0xd
+	KeyUpdateError            TransportErrorCode = 0xe
+	AEADLimitReached          TransportErrorCode = 0xf
+	NoViablePathError         TransportErrorCode = 0x10
 )

-func (e ErrorCode) isCryptoError() bool {
+func (e TransportErrorCode) IsCryptoError() bool {
 	return e >= 0x100 && e < 0x200
 }

-func (e ErrorCode) Error() string {
-	if e.isCryptoError() {
-		return fmt.Sprintf("%s: %s", e.String(), e.Message())
-	}
-	return e.String()
-}
-
 // Message is a description of the error.
 // It only returns a non-empty string for crypto errors.
-func (e ErrorCode) Message() string {
-	if !e.isCryptoError() {
+func (e TransportErrorCode) Message() string {
+	if !e.IsCryptoError() {
 		return ""
 	}
 	return qtls.Alert(e - 0x100).Error()
 }

-func (e ErrorCode) String() string {
+func (e TransportErrorCode) String() string {
 	switch e {
 	case NoError:
 		return "NO_ERROR"
@@ -76,7 +69,7 @@ func (e ErrorCode) String() string {
 		return "PROTOCOL_VIOLATION"
 	case InvalidToken:
 		return "INVALID_TOKEN"
-	case ApplicationError:
+	case ApplicationErrorErrorCode:
 		return "APPLICATION_ERROR"
 	case CryptoBufferExceeded:
 		return "CRYPTO_BUFFER_EXCEEDED"
@@ -87,7 +80,7 @@ func (e ErrorCode) String() string {
 	case NoViablePathError:
 		return "NO_VIABLE_PATH"
 	default:
-		if e.isCryptoError() {
+		if e.IsCryptoError() {
 			return fmt.Sprintf("CRYPTO_ERROR (%#x)", uint16(e))
 		}
 		return fmt.Sprintf("unknown error code: %#x", uint16(e))
--- a/vendor/github.com/lucas-clemente/quic-go/internal/qerr/errors.go
+++ b/vendor/github.com/lucas-clemente/quic-go/internal/qerr/errors.go
@@ -0,0 +1,124 @@
+package qerr
+
+import (
+	"fmt"
+	"net"
+
+	"github.com/lucas-clemente/quic-go/internal/protocol"
+)
+
+var (
+	ErrHandshakeTimeout = &HandshakeTimeoutError{}
+	ErrIdleTimeout      = &IdleTimeoutError{}
+)
+
+type TransportError struct {
+	Remote       bool
+	FrameType    uint64
+	ErrorCode    TransportErrorCode
+	ErrorMessage string
+}
+
+var _ error = &TransportError{}
+
+// NewCryptoError create a new TransportError instance for a crypto error
+func NewCryptoError(tlsAlert uint8, errorMessage string) *TransportError {
+	return &TransportError{
+		ErrorCode:    0x100 + TransportErrorCode(tlsAlert),
+		ErrorMessage: errorMessage,
+	}
+}
+
+func (e *TransportError) Error() string {
+	str := e.ErrorCode.String()
+	if e.FrameType != 0 {
+		str += fmt.Sprintf(" (frame type: %#x)", e.FrameType)
+	}
+	msg := e.ErrorMessage
+	if len(msg) == 0 {
+		msg = e.ErrorCode.Message()
+	}
+	if len(msg) == 0 {
+		return str
+	}
+	return str + ": " + msg
+}
+
+func (e *TransportError) Is(target error) bool {
+	return target == net.ErrClosed
+}
+
+// An ApplicationErrorCode is an application-defined error code.
+type ApplicationErrorCode uint64
+
+func (e *ApplicationError) Is(target error) bool {
+	return target == net.ErrClosed
+}
+
+// A StreamErrorCode is an error code used to cancel streams.
+type StreamErrorCode uint64
+
+type ApplicationError struct {
+	Remote       bool
+	ErrorCode    ApplicationErrorCode
+	ErrorMessage string
+}
+
+var _ error = &ApplicationError{}
+
+func (e *ApplicationError) Error() string {
+	if len(e.ErrorMessage) == 0 {
+		return fmt.Sprintf("Application error %#x", e.ErrorCode)
+	}
+	return fmt.Sprintf("Application error %#x: %s", e.ErrorCode, e.ErrorMessage)
+}
+
+type IdleTimeoutError struct{}
+
+var _ error = &IdleTimeoutError{}
+
+func (e *IdleTimeoutError) Timeout() bool        { return true }
+func (e *IdleTimeoutError) Temporary() bool      { return false }
+func (e *IdleTimeoutError) Error() string        { return "timeout: no recent network activity" }
+func (e *IdleTimeoutError) Is(target error) bool { return target == net.ErrClosed }
+
+type HandshakeTimeoutError struct{}
+
+var _ error = &HandshakeTimeoutError{}
+
+func (e *HandshakeTimeoutError) Timeout() bool        { return true }
+func (e *HandshakeTimeoutError) Temporary() bool      { return false }
+func (e *HandshakeTimeoutError) Error() string        { return "timeout: handshake did not complete in time" }
+func (e *HandshakeTimeoutError) Is(target error) bool { return target == net.ErrClosed }
+
+// A VersionNegotiationError occurs when the client and the server can't agree on a QUIC version.
+type VersionNegotiationError struct {
+	Ours   []protocol.VersionNumber
+	Theirs []protocol.VersionNumber
+}
+
+func (e *VersionNegotiationError) Error() string {
+	return fmt.Sprintf("no compatible QUIC version found (we support %s, server offered %s)", e.Ours, e.Theirs)
+}
+
+func (e *VersionNegotiationError) Is(target error) bool {
+	return target == net.ErrClosed
+}
+
+// A StatelessResetError occurs when we receive a stateless reset.
+type StatelessResetError struct {
+	Token protocol.StatelessResetToken
+}
+
+var _ net.Error = &StatelessResetError{}
+
+func (e *StatelessResetError) Error() string {
+	return fmt.Sprintf("received a stateless reset with token %x", e.Token)
+}
+
+func (e *StatelessResetError) Is(target error) bool {
+	return target == net.ErrClosed
+}
+
+func (e *StatelessResetError) Timeout() bool   { return false }
+func (e *StatelessResetError) Temporary() bool { return true }
--- a/vendor/github.com/lucas-clemente/quic-go/internal/qerr/quic_error.go
+++ b/vendor/github.com/lucas-clemente/quic-go/internal/qerr/quic_error.go
@@ -1,112 +0,0 @@
-package qerr
-
-import (
-	"fmt"
-	"net"
-)
-
-// A QuicError consists of an error code plus a error reason
-type QuicError struct {
-	ErrorCode          ErrorCode
-	FrameType          uint64 // only valid if this not an application error
-	ErrorMessage       string
-	isTimeout          bool
-	isApplicationError bool
-}
-
-var _ net.Error = &QuicError{}
-
-// NewError creates a new QuicError instance
-func NewError(errorCode ErrorCode, errorMessage string) *QuicError {
-	return &QuicError{
-		ErrorCode:    errorCode,
-		ErrorMessage: errorMessage,
-	}
-}
-
-// NewErrorWithFrameType creates a new QuicError instance for a specific frame type
-func NewErrorWithFrameType(errorCode ErrorCode, frameType uint64, errorMessage string) *QuicError {
-	return &QuicError{
-		ErrorCode:    errorCode,
-		FrameType:    frameType,
-		ErrorMessage: errorMessage,
-	}
-}
-
-// NewTimeoutError creates a new QuicError instance for a timeout error
-func NewTimeoutError(errorMessage string) *QuicError {
-	return &QuicError{
-		ErrorMessage: errorMessage,
-		isTimeout:    true,
-	}
-}
-
-// NewCryptoError create a new QuicError instance for a crypto error
-func NewCryptoError(tlsAlert uint8, errorMessage string) *QuicError {
-	return &QuicError{
-		ErrorCode:    0x100 + ErrorCode(tlsAlert),
-		ErrorMessage: errorMessage,
-	}
-}
-
-// NewApplicationError creates a new QuicError instance for an application error
-func NewApplicationError(errorCode ErrorCode, errorMessage string) *QuicError {
-	return &QuicError{
-		ErrorCode:          errorCode,
-		ErrorMessage:       errorMessage,
-		isApplicationError: true,
-	}
-}
-
-func (e *QuicError) Error() string {
-	if e.isApplicationError {
-		if len(e.ErrorMessage) == 0 {
-			return fmt.Sprintf("Application error %#x", uint64(e.ErrorCode))
-		}
-		return fmt.Sprintf("Application error %#x: %s", uint64(e.ErrorCode), e.ErrorMessage)
-	}
-	str := e.ErrorCode.String()
-	if e.FrameType != 0 {
-		str += fmt.Sprintf(" (frame type: %#x)", e.FrameType)
-	}
-	msg := e.ErrorMessage
-	if len(msg) == 0 {
-		msg = e.ErrorCode.Message()
-	}
-	if len(msg) == 0 {
-		return str
-	}
-	return str + ": " + msg
-}
-
-// IsCryptoError says if this error is a crypto error
-func (e *QuicError) IsCryptoError() bool {
-	return e.ErrorCode.isCryptoError()
-}
-
-// IsApplicationError says if this error is an application error
-func (e *QuicError) IsApplicationError() bool {
-	return e.isApplicationError
-}
-
-// Temporary says if the error is temporary.
-func (e *QuicError) Temporary() bool {
-	return false
-}
-
-// Timeout says if this error is a timeout.
-func (e *QuicError) Timeout() bool {
-	return e.isTimeout
-}
-
-// ToQuicError converts an arbitrary error to a QuicError. It leaves QuicErrors
-// unchanged, and properly handles `ErrorCode`s.
-func ToQuicError(err error) *QuicError {
-	switch e := err.(type) {
-	case *QuicError:
-		return e
-	case ErrorCode:
-		return NewError(e, "")
-	}
-	return NewError(InternalError, err.Error())
-}
--- a/vendor/github.com/lucas-clemente/quic-go/internal/qtls/go116.go
+++ b/vendor/github.com/lucas-clemente/quic-go/internal/qtls/go116.go
@@ -1,4 +1,5 @@
 // +build go1.16
+// +build !go1.17

 package qtls

@@ -9,7 +10,7 @@ import (
 	"net"
 	"unsafe"

-	qtls "github.com/marten-seemann/qtls-go1-16"
+	"github.com/marten-seemann/qtls-go1-16"
 )

 type (
@@ -52,21 +53,6 @@ const (
 	EncryptionApplication = qtls.EncryptionApplication
 )

-// CipherSuiteName gets the name of a cipher suite.
-func CipherSuiteName(id uint16) string {
-	return qtls.CipherSuiteName(id)
-}
-
-// HkdfExtract generates a pseudorandom key for use with Expand from an input secret and an optional independent salt.
-func HkdfExtract(hash crypto.Hash, newSecret, currentSecret []byte) []byte {
-	return qtls.HkdfExtract(hash, newSecret, currentSecret)
-}
-
-// HkdfExpandLabel HKDF expands a label
-func HkdfExpandLabel(hash crypto.Hash, secret, hashValue []byte, label string, L int) []byte {
-	return qtls.HkdfExpandLabel(hash, secret, hashValue, label, L)
-}
-
 // AEADAESGCMTLS13 creates a new AES-GCM AEAD for TLS 1.3
 func AEADAESGCMTLS13(key, fixedNonce []byte) cipher.AEAD {
 	return qtls.AEADAESGCMTLS13(key, fixedNonce)
--- a/vendor/github.com/lucas-clemente/quic-go/internal/qtls/go117.go
+++ b/vendor/github.com/lucas-clemente/quic-go/internal/qtls/go117.go
@@ -1,5 +1,4 @@
-// +build go1.15
-// +build !go1.16
+// +build go1.17

 package qtls

@@ -10,7 +9,7 @@ import (
 	"net"
 	"unsafe"

-	qtls "github.com/marten-seemann/qtls-go1-15"
+	"github.com/marten-seemann/qtls-go1-17"
 )

 type (
@@ -53,21 +52,6 @@ const (
 	EncryptionApplication = qtls.EncryptionApplication
 )

-// CipherSuiteName gets the name of a cipher suite.
-func CipherSuiteName(id uint16) string {
-	return qtls.CipherSuiteName(id)
-}
-
-// HkdfExtract generates a pseudorandom key for use with Expand from an input secret and an optional independent salt.
-func HkdfExtract(hash crypto.Hash, newSecret, currentSecret []byte) []byte {
-	return qtls.HkdfExtract(hash, newSecret, currentSecret)
-}
-
-// HkdfExpandLabel HKDF expands a label
-func HkdfExpandLabel(hash crypto.Hash, secret, hashValue []byte, label string, L int) []byte {
-	return qtls.HkdfExpandLabel(hash, secret, hashValue, label, L)
-}
-
 // AEADAESGCMTLS13 creates a new AES-GCM AEAD for TLS 1.3
 func AEADAESGCMTLS13(key, fixedNonce []byte) cipher.AEAD {
 	return qtls.AEADAESGCMTLS13(key, fixedNonce)
@@ -99,7 +83,7 @@ type cipherSuiteTLS13 struct {
 	Hash   crypto.Hash
 }

-//go:linkname cipherSuiteTLS13ByID github.com/marten-seemann/qtls-go1-15.cipherSuiteTLS13ByID
+//go:linkname cipherSuiteTLS13ByID github.com/marten-seemann/qtls-go1-17.cipherSuiteTLS13ByID
 func cipherSuiteTLS13ByID(id uint16) *cipherSuiteTLS13

 // CipherSuiteTLS13ByID gets a TLS 1.3 cipher suite.
--- a/vendor/github.com/lucas-clemente/quic-go/internal/qtls/go118.go
+++ b/vendor/github.com/lucas-clemente/quic-go/internal/qtls/go118.go
@@ -0,0 +1,5 @@
+// +build go1.18
+
+package qtls
+
+var _ int = "quic-go doesn't build on Go 1.18 yet."
--- a/vendor/github.com/lucas-clemente/quic-go/internal/wire/connection_close_frame.go
+++ b/vendor/github.com/lucas-clemente/quic-go/internal/wire/connection_close_frame.go
@@ -5,14 +5,13 @@ import (
 	"io"

 	"github.com/lucas-clemente/quic-go/internal/protocol"
-	"github.com/lucas-clemente/quic-go/internal/qerr"
 	"github.com/lucas-clemente/quic-go/quicvarint"
 )

 // A ConnectionCloseFrame is a CONNECTION_CLOSE frame
 type ConnectionCloseFrame struct {
 	IsApplicationError bool
-	ErrorCode          qerr.ErrorCode
+	ErrorCode          uint64
 	FrameType          uint64
 	ReasonPhrase       string
 }
@@ -28,7 +27,7 @@ func parseConnectionCloseFrame(r *bytes.Reader, _ protocol.VersionNumber) (*Conn
 	if err != nil {
 		return nil, err
 	}
-	f.ErrorCode = qerr.ErrorCode(ec)
+	f.ErrorCode = ec
 	// read the Frame Type, if this is not an application error
 	if !f.IsApplicationError {
 		ft, err := quicvarint.Read(r)
@@ -59,8 +58,8 @@ func parseConnectionCloseFrame(r *bytes.Reader, _ protocol.VersionNumber) (*Conn
 }

 // Length of a written frame
-func (f *ConnectionCloseFrame) Length(version protocol.VersionNumber) protocol.ByteCount {
-	length := 1 + quicvarint.Len(uint64(f.ErrorCode)) + quicvarint.Len(uint64(len(f.ReasonPhrase))) + protocol.ByteCount(len(f.ReasonPhrase))
+func (f *ConnectionCloseFrame) Length(protocol.VersionNumber) protocol.ByteCount {
+	length := 1 + quicvarint.Len(f.ErrorCode) + quicvarint.Len(uint64(len(f.ReasonPhrase))) + protocol.ByteCount(len(f.ReasonPhrase))
 	if !f.IsApplicationError {
 		length += quicvarint.Len(f.FrameType) // for the frame type
 	}
@@ -74,7 +73,7 @@ func (f *ConnectionCloseFrame) Write(b *bytes.Buffer, version protocol.VersionNu
 		b.WriteByte(0x1c)
 	}

-	quicvarint.Write(b, uint64(f.ErrorCode))
+	quicvarint.Write(b, f.ErrorCode)
 	if !f.IsApplicationError {
 		quicvarint.Write(b, f.FrameType)
 	}
--- a/vendor/github.com/lucas-clemente/quic-go/internal/wire/frame_parser.go
+++ b/vendor/github.com/lucas-clemente/quic-go/internal/wire/frame_parser.go
@@ -26,7 +26,7 @@ func NewFrameParser(supportsDatagrams bool, v protocol.VersionNumber) FrameParse
 	}
 }

-// ParseNextFrame parses the next frame
+// ParseNext parses the next frame.
 // It skips PADDING frames.
 func (p *frameParser) ParseNext(r *bytes.Reader, encLevel protocol.EncryptionLevel) (Frame, error) {
 	for r.Len() != 0 {
@@ -38,7 +38,11 @@ func (p *frameParser) ParseNext(r *bytes.Reader, encLevel protocol.EncryptionLev

 		f, err := p.parseFrame(r, typeByte, encLevel)
 		if err != nil {
-			return nil, qerr.NewErrorWithFrameType(qerr.FrameEncodingError, uint64(typeByte), err.Error())
+			return nil, &qerr.TransportError{
+				FrameType:    uint64(typeByte),
+				ErrorCode:    qerr.FrameEncodingError,
+				ErrorMessage: err.Error(),
+			}
 		}
 		return f, nil
 	}
--- a/vendor/github.com/lucas-clemente/quic-go/internal/wire/reset_stream_frame.go
+++ b/vendor/github.com/lucas-clemente/quic-go/internal/wire/reset_stream_frame.go
@@ -4,13 +4,14 @@ import (
 	"bytes"

 	"github.com/lucas-clemente/quic-go/internal/protocol"
+	"github.com/lucas-clemente/quic-go/internal/qerr"
 	"github.com/lucas-clemente/quic-go/quicvarint"
 )

 // A ResetStreamFrame is a RESET_STREAM frame in QUIC
 type ResetStreamFrame struct {
 	StreamID  protocol.StreamID
-	ErrorCode protocol.ApplicationErrorCode
+	ErrorCode qerr.StreamErrorCode
 	FinalSize protocol.ByteCount
 }

@@ -38,7 +39,7 @@ func parseResetStreamFrame(r *bytes.Reader, _ protocol.VersionNumber) (*ResetStr

 	return &ResetStreamFrame{
 		StreamID:  streamID,
-		ErrorCode: protocol.ApplicationErrorCode(errorCode),
+		ErrorCode: qerr.StreamErrorCode(errorCode),
 		FinalSize: byteOffset,
 	}, nil
 }
--- a/vendor/github.com/lucas-clemente/quic-go/internal/wire/stop_sending_frame.go
+++ b/vendor/github.com/lucas-clemente/quic-go/internal/wire/stop_sending_frame.go
@@ -4,13 +4,14 @@ import (
 	"bytes"

 	"github.com/lucas-clemente/quic-go/internal/protocol"
+	"github.com/lucas-clemente/quic-go/internal/qerr"
 	"github.com/lucas-clemente/quic-go/quicvarint"
 )

 // A StopSendingFrame is a STOP_SENDING frame
 type StopSendingFrame struct {
 	StreamID  protocol.StreamID
-	ErrorCode protocol.ApplicationErrorCode
+	ErrorCode qerr.StreamErrorCode
 }

 // parseStopSendingFrame parses a STOP_SENDING frame
@@ -30,7 +31,7 @@ func parseStopSendingFrame(r *bytes.Reader, _ protocol.VersionNumber) (*StopSend

 	return &StopSendingFrame{
 		StreamID:  protocol.StreamID(streamID),
-		ErrorCode: protocol.ApplicationErrorCode(errorCode),
+		ErrorCode: qerr.StreamErrorCode(errorCode),
 	}, nil
 }

--- a/vendor/github.com/lucas-clemente/quic-go/internal/wire/stream_frame.go
+++ b/vendor/github.com/lucas-clemente/quic-go/internal/wire/stream_frame.go
@@ -6,7 +6,6 @@ import (
 	"io"

 	"github.com/lucas-clemente/quic-go/internal/protocol"
-	"github.com/lucas-clemente/quic-go/internal/qerr"
 	"github.com/lucas-clemente/quic-go/quicvarint"
 )

@@ -79,7 +78,7 @@ func parseStreamFrame(r *bytes.Reader, _ protocol.VersionNumber) (*StreamFrame,
 		}
 	}
 	if frame.Offset+frame.DataLen() > protocol.MaxByteCount {
-		return nil, qerr.NewError(qerr.FrameEncodingError, "stream data overflows maximum offset")
+		return nil, errors.New("stream data overflows maximum offset")
 	}
 	return frame, nil
 }
--- a/vendor/github.com/lucas-clemente/quic-go/internal/wire/transport_parameters.go
+++ b/vendor/github.com/lucas-clemente/quic-go/internal/wire/transport_parameters.go
@@ -90,7 +90,10 @@ type TransportParameters struct {
 // Unmarshal the transport parameters
 func (p *TransportParameters) Unmarshal(data []byte, sentBy protocol.Perspective) error {
 	if err := p.unmarshal(bytes.NewReader(data), sentBy, false); err != nil {
-		return qerr.NewError(qerr.TransportParameterError, err.Error())
+		return &qerr.TransportError{
+			ErrorCode:    qerr.TransportParameterError,
+			ErrorMessage: err.Error(),
+		}
 	}
 	return nil
 }
@@ -259,7 +262,7 @@ func (p *TransportParameters) readNumericTransportParameter(
 		return fmt.Errorf("error while reading transport parameter %d: %s", paramID, err)
 	}
 	if remainingLen-r.Len() != expectedLen {
-		return fmt.Errorf("inconsistent transport parameter length for %d", paramID)
+		return fmt.Errorf("inconsistent transport parameter length for transport parameter %#x", paramID)
 	}
 	//nolint:exhaustive // This only covers the numeric transport parameters.
 	switch paramID {
--- a/vendor/github.com/lucas-clemente/quic-go/logging/close_reason.go
+++ b/vendor/github.com/lucas-clemente/quic-go/logging/close_reason.go
@@ -1,78 +0,0 @@
-package logging
-
-// A CloseReason is the reason why a QUIC connection is closed.
-// It falls in one of 4 categories:
-// 1. The application closed the connection (with an application-specific error code).
-// 2. The transport closed the connection with a transport-error code.
-// 3. The connection timed out, either during the handshake, or due to an idle timeout.
-// 4. A stateless reset was received.
-type CloseReason struct {
-	remote           bool
-	applicationError *ApplicationError
-	transportError   *TransportError
-
-	timeout             *TimeoutReason
-	statelessResetToken *StatelessResetToken
-	versions            []VersionNumber
-}
-
-// NewApplicationCloseReason creates a new CloseReason for an application error.
-func NewApplicationCloseReason(errorCode ApplicationError, remote bool) CloseReason {
-	return CloseReason{remote: remote, applicationError: &errorCode}
-}
-
-// NewTransportCloseReason creates a new CloseReason for a transport error.
-func NewTransportCloseReason(errorCode TransportError, remote bool) CloseReason {
-	return CloseReason{remote: remote, transportError: &errorCode}
-}
-
-// NewTimeoutCloseReason creates a new CloseReason for a connection timeout.
-func NewTimeoutCloseReason(r TimeoutReason) CloseReason {
-	return CloseReason{timeout: &r}
-}
-
-// NewStatelessResetCloseReason creates a new CloseReason for a stateless reset.
-func NewStatelessResetCloseReason(token StatelessResetToken) CloseReason {
-	return CloseReason{statelessResetToken: &token}
-}
-
-// NewVersionNegotiationError creates a new CloseReason for a version negotiation error.
-func NewVersionNegotiationError(versions []VersionNumber) CloseReason {
-	return CloseReason{versions: versions}
-}
-
-// ApplicationError gets the application error.
-func (r *CloseReason) ApplicationError() (errorCode ApplicationError, remote bool, ok bool) {
-	if r.applicationError == nil {
-		return
-	}
-	return *r.applicationError, r.remote, true
-}
-
-// TransportError gets the transport error.
-func (r *CloseReason) TransportError() (errorCode TransportError, remote bool, ok bool) {
-	if r.transportError == nil {
-		return
-	}
-	return *r.transportError, r.remote, true
-}
-
-// Timeout gets the timeout error.
-func (r *CloseReason) Timeout() (reason TimeoutReason, ok bool) {
-	if r.timeout == nil {
-		return
-	}
-	return *r.timeout, true
-}
-
-// StatelessReset gets the stateless reset token.
-func (r *CloseReason) StatelessReset() (token StatelessResetToken, ok bool) {
-	if r.statelessResetToken == nil {
-		return
-	}
-	return *r.statelessResetToken, true
-}
-
-func (r *CloseReason) VersionNegotiation() (versions []VersionNumber, ok bool) {
-	return r.versions, len(r.versions) > 0
-}
--- a/vendor/github.com/lucas-clemente/quic-go/logging/interface.go
+++ b/vendor/github.com/lucas-clemente/quic-go/logging/interface.go
@@ -3,6 +3,7 @@
 package logging

 import (
+	"context"
 	"net"
 	"time"

@@ -49,9 +50,9 @@ type (
 	PreferredAddress = wire.PreferredAddress

 	// A TransportError is a transport-level error code.
-	TransportError = qerr.ErrorCode
+	TransportError = qerr.TransportErrorCode
 	// An ApplicationError is an application-defined error code.
-	ApplicationError = qerr.ErrorCode
+	ApplicationError = qerr.TransportErrorCode

 	// The RTTStats contain statistics used by the congestion controller.
 	RTTStats = utils.RTTStats
@@ -91,11 +92,11 @@ const (

 // A Tracer traces events.
 type Tracer interface {
-	// ConnectionTracer requests a new tracer for a connection.
+	// TracerForConnection requests a new tracer for a connection.
 	// The ODCID is the original destination connection ID:
 	// The destination connection ID that the client used on the first Initial packet it sent on this connection.
 	// If nil is returned, tracing will be disabled for this connection.
-	TracerForConnection(p Perspective, odcid ConnectionID) ConnectionTracer
+	TracerForConnection(ctx context.Context, p Perspective, odcid ConnectionID) ConnectionTracer

 	SentPacket(net.Addr, *Header, ByteCount, []Frame)
 	DroppedPacket(net.Addr, PacketType, ByteCount, PacketDropReason)
@@ -103,8 +104,9 @@ type Tracer interface {

 // A ConnectionTracer records events.
 type ConnectionTracer interface {
-	StartedConnection(local, remote net.Addr, version VersionNumber, srcConnID, destConnID ConnectionID)
-	ClosedConnection(CloseReason)
+	StartedConnection(local, remote net.Addr, srcConnID, destConnID ConnectionID)
+	NegotiatedVersion(chosen VersionNumber, clientVersions, serverVersions []VersionNumber)
+	ClosedConnection(error)
 	SentTransportParameters(*TransportParameters)
 	ReceivedTransportParameters(*TransportParameters)
 	RestoredTransportParameters(parameters *TransportParameters) // for 0-RTT
@@ -115,6 +117,7 @@ type ConnectionTracer interface {
 	BufferedPacket(PacketType)
 	DroppedPacket(PacketType, ByteCount, PacketDropReason)
 	UpdatedMetrics(rttStats *RTTStats, cwnd, bytesInFlight ByteCount, packetsInFlight int)
+	AcknowledgedPacket(EncryptionLevel, PacketNumber)
 	LostPacket(EncryptionLevel, PacketNumber, PacketLossReason)
 	UpdatedCongestionState(CongestionState)
 	UpdatedPTOCount(value uint32)
--- a/vendor/github.com/lucas-clemente/quic-go/logging/multiplex.go
+++ b/vendor/github.com/lucas-clemente/quic-go/logging/multiplex.go
@@ -1,6 +1,7 @@
 package logging

 import (
+	"context"
 	"net"
 	"time"
 )
@@ -22,10 +23,10 @@ func NewMultiplexedTracer(tracers ...Tracer) Tracer {
 	return &tracerMultiplexer{tracers}
 }

-func (m *tracerMultiplexer) TracerForConnection(p Perspective, odcid ConnectionID) ConnectionTracer {
+func (m *tracerMultiplexer) TracerForConnection(ctx context.Context, p Perspective, odcid ConnectionID) ConnectionTracer {
 	var connTracers []ConnectionTracer
 	for _, t := range m.tracers {
-		if ct := t.TracerForConnection(p, odcid); ct != nil {
+		if ct := t.TracerForConnection(ctx, p, odcid); ct != nil {
 			connTracers = append(connTracers, ct)
 		}
 	}
@@ -61,15 +62,21 @@ func NewMultiplexedConnectionTracer(tracers ...ConnectionTracer) ConnectionTrace
 	return &connTracerMultiplexer{tracers: tracers}
 }

-func (m *connTracerMultiplexer) StartedConnection(local, remote net.Addr, version VersionNumber, srcConnID, destConnID ConnectionID) {
+func (m *connTracerMultiplexer) StartedConnection(local, remote net.Addr, srcConnID, destConnID ConnectionID) {
 	for _, t := range m.tracers {
-		t.StartedConnection(local, remote, version, srcConnID, destConnID)
+		t.StartedConnection(local, remote, srcConnID, destConnID)
 	}
 }

-func (m *connTracerMultiplexer) ClosedConnection(reason CloseReason) {
+func (m *connTracerMultiplexer) NegotiatedVersion(chosen VersionNumber, clientVersions, serverVersions []VersionNumber) {
 	for _, t := range m.tracers {
-		t.ClosedConnection(reason)
+		t.NegotiatedVersion(chosen, clientVersions, serverVersions)
+	}
+}
+
+func (m *connTracerMultiplexer) ClosedConnection(e error) {
+	for _, t := range m.tracers {
+		t.ClosedConnection(e)
 	}
 }

@@ -139,6 +146,12 @@ func (m *connTracerMultiplexer) UpdatedMetrics(rttStats *RTTStats, cwnd, bytesIn
 	}
 }

+func (m *connTracerMultiplexer) AcknowledgedPacket(encLevel EncryptionLevel, pn PacketNumber) {
+	for _, t := range m.tracers {
+		t.AcknowledgedPacket(encLevel, pn)
+	}
+}
+
 func (m *connTracerMultiplexer) LostPacket(encLevel EncryptionLevel, pn PacketNumber, reason PacketLossReason) {
 	for _, t := range m.tracers {
 		t.LostPacket(encLevel, pn, reason)
--- a/vendor/github.com/lucas-clemente/quic-go/logging/types.go
+++ b/vendor/github.com/lucas-clemente/quic-go/logging/types.go
@@ -1,9 +1,7 @@
 package logging

-import "github.com/lucas-clemente/quic-go/internal/protocol"
-
 // PacketType is the packet type of a QUIC packet
-type PacketType = protocol.PacketType
+type PacketType uint8

 const (
 	// PacketTypeInitial is the packet type of an Initial packet
--- a/vendor/github.com/lucas-clemente/quic-go/mockgen.go
+++ b/vendor/github.com/lucas-clemente/quic-go/mockgen.go
@@ -22,5 +22,6 @@ package quic
 //go:generate sh -c "./mockgen_private.sh quic mock_unknown_packet_handler_test.go github.com/lucas-clemente/quic-go unknownPacketHandler"
 //go:generate sh -c "./mockgen_private.sh quic mock_packet_handler_manager_test.go github.com/lucas-clemente/quic-go packetHandlerManager"
 //go:generate sh -c "./mockgen_private.sh quic mock_multiplexer_test.go github.com/lucas-clemente/quic-go multiplexer"
+//go:generate sh -c "./mockgen_private.sh quic mock_batch_conn_test.go github.com/lucas-clemente/quic-go batchConn"
 //go:generate sh -c "mockgen -package quic -self_package github.com/lucas-clemente/quic-go -destination mock_token_store_test.go github.com/lucas-clemente/quic-go TokenStore && goimports -w mock_token_store_test.go"
 //go:generate sh -c "mockgen -package quic -self_package github.com/lucas-clemente/quic-go -destination mock_packetconn_test.go net PacketConn && goimports -w mock_packetconn_test.go"
--- a/vendor/github.com/lucas-clemente/quic-go/packet_handler_map.go
+++ b/vendor/github.com/lucas-clemente/quic-go/packet_handler_map.go
@@ -18,14 +18,6 @@ import (
 	"github.com/lucas-clemente/quic-go/logging"
 )

-type statelessResetErr struct {
-	token protocol.StatelessResetToken
-}
-
-func (e statelessResetErr) Error() string {
-	return fmt.Sprintf("received a stateless reset with token %x", e.token)
-}
-
 type zeroRTTQueue struct {
 	queue       []*receivedPacket
 	retireTimer *time.Timer
@@ -430,7 +422,7 @@ func (h *packetHandlerMap) maybeHandleStatelessReset(data []byte) bool {
 	copy(token[:], data[len(data)-16:])
 	if sess, ok := h.resetTokens[token]; ok {
 		h.logger.Debugf("Received a stateless reset with token %#x. Closing session.", token)
-		go sess.destroy(statelessResetErr{token: token})
+		go sess.destroy(&StatelessResetError{Token: token})
 		return true
 	}
 	return false
--- a/vendor/github.com/lucas-clemente/quic-go/packet_packer.go
+++ b/vendor/github.com/lucas-clemente/quic-go/packet_packer.go
@@ -20,7 +20,8 @@ type packer interface {
 	PackPacket() (*packedPacket, error)
 	MaybePackProbePacket(protocol.EncryptionLevel) (*packedPacket, error)
 	MaybePackAckPacket(handshakeConfirmed bool) (*packedPacket, error)
-	PackConnectionClose(*qerr.QuicError) (*coalescedPacket, error)
+	PackConnectionClose(*qerr.TransportError) (*coalescedPacket, error)
+	PackApplicationClose(*qerr.ApplicationError) (*coalescedPacket, error)

 	SetMaxPacketSize(protocol.ByteCount)
 	PackMTUProbePacket(ping ackhandler.Frame, size protocol.ByteCount) (*packedPacket, error)
@@ -203,14 +204,27 @@ func newPacketPacker(
 	}
 }

-// PackConnectionClose packs a packet that ONLY contains a ConnectionCloseFrame
-func (p *packetPacker) PackConnectionClose(quicErr *qerr.QuicError) (*coalescedPacket, error) {
+// PackConnectionClose packs a packet that closes the connection with a transport error.
+func (p *packetPacker) PackConnectionClose(e *qerr.TransportError) (*coalescedPacket, error) {
 	var reason string
 	// don't send details of crypto errors
-	if !quicErr.IsCryptoError() {
-		reason = quicErr.ErrorMessage
+	if !e.ErrorCode.IsCryptoError() {
+		reason = e.ErrorMessage
 	}
+	return p.packConnectionClose(false, uint64(e.ErrorCode), e.FrameType, reason)
+}

+// PackApplicationClose packs a packet that closes the connection with an application error.
+func (p *packetPacker) PackApplicationClose(e *qerr.ApplicationError) (*coalescedPacket, error) {
+	return p.packConnectionClose(true, uint64(e.ErrorCode), 0, e.ErrorMessage)
+}
+
+func (p *packetPacker) packConnectionClose(
+	isApplicationError bool,
+	errorCode uint64,
+	frameType uint64,
+	reason string,
+) (*coalescedPacket, error) {
 	var sealers [4]sealer
 	var hdrs [4]*wire.ExtendedHeader
 	var payloads [4]*payload
@@ -221,20 +235,17 @@ func (p *packetPacker) PackConnectionClose(quicErr *qerr.QuicError) (*coalescedP
 		if p.perspective == protocol.PerspectiveServer && encLevel == protocol.Encryption0RTT {
 			continue
 		}
-		quicErrToSend := quicErr
-		reasonPhrase := reason
-		if encLevel == protocol.EncryptionInitial || encLevel == protocol.EncryptionHandshake {
-			// don't send application errors in Initial or Handshake packets
-			if quicErr.IsApplicationError() {
-				quicErrToSend = qerr.NewError(qerr.ApplicationError, "")
-				reasonPhrase = ""
-			}
-		}
 		ccf := &wire.ConnectionCloseFrame{
-			IsApplicationError: quicErrToSend.IsApplicationError(),
-			ErrorCode:          quicErrToSend.ErrorCode,
-			FrameType:          quicErrToSend.FrameType,
-			ReasonPhrase:       reasonPhrase,
+			IsApplicationError: isApplicationError,
+			ErrorCode:          errorCode,
+			FrameType:          frameType,
+			ReasonPhrase:       reason,
+		}
+		// don't send application errors in Initial or Handshake packets
+		if isApplicationError && (encLevel == protocol.EncryptionInitial || encLevel == protocol.EncryptionHandshake) {
+			ccf.IsApplicationError = false
+			ccf.ErrorCode = uint64(qerr.ApplicationErrorErrorCode)
+			ccf.ReasonPhrase = ""
 		}
 		payload := &payload{
 			frames: []ackhandler.Frame{{Frame: ccf}},
--- a/vendor/github.com/lucas-clemente/quic-go/packet_unpacker.go
+++ b/vendor/github.com/lucas-clemente/quic-go/packet_unpacker.go
@@ -18,11 +18,6 @@ type headerParseError struct {
 	err error
 }

-func (e *headerParseError) Is(err error) bool {
-	_, ok := err.(*headerParseError)
-	return ok
-}
-
 func (e *headerParseError) Unwrap() error {
 	return e.err
 }
--- a/vendor/github.com/lucas-clemente/quic-go/quicvarint/io.go
+++ b/vendor/github.com/lucas-clemente/quic-go/quicvarint/io.go
@@ -0,0 +1,65 @@
+package quicvarint
+
+import (
+	"bytes"
+	"io"
+)
+
+// Reader implements both the io.ByteReader and io.Reader interfaces.
+type Reader interface {
+	io.ByteReader
+	io.Reader
+}
+
+var _ Reader = &bytes.Reader{}
+
+type byteReader struct {
+	io.Reader
+}
+
+var _ Reader = &byteReader{}
+
+// NewReader returns a Reader for r.
+// If r already implements both io.ByteReader and io.Reader, NewReader returns r.
+// Otherwise, r is wrapped to add the missing interfaces.
+func NewReader(r io.Reader) Reader {
+	if r, ok := r.(Reader); ok {
+		return r
+	}
+	return &byteReader{r}
+}
+
+func (r *byteReader) ReadByte() (byte, error) {
+	var b [1]byte
+	_, err := r.Reader.Read(b[:])
+	return b[0], err
+}
+
+// Writer implements both the io.ByteWriter and io.Writer interfaces.
+type Writer interface {
+	io.ByteWriter
+	io.Writer
+}
+
+var _ Writer = &bytes.Buffer{}
+
+type byteWriter struct {
+	io.Writer
+}
+
+var _ Writer = &byteWriter{}
+
+// NewWriter returns a Writer for w.
+// If r already implements both io.ByteWriter and io.Writer, NewWriter returns w.
+// Otherwise, w is wrapped to add the missing interfaces.
+func NewWriter(w io.Writer) Writer {
+	if w, ok := w.(Writer); ok {
+		return w
+	}
+	return &byteWriter{w}
+}
+
+func (w *byteWriter) WriteByte(c byte) error {
+	_, err := w.Writer.Write([]byte{c})
+	return err
+}
--- a/vendor/github.com/lucas-clemente/quic-go/quicvarint/varint.go
+++ b/vendor/github.com/lucas-clemente/quic-go/quicvarint/varint.go
@@ -1,7 +1,6 @@
 package quicvarint

 import (
-	"bytes"
 	"fmt"
 	"io"

@@ -10,15 +9,21 @@ import (

 // taken from the QUIC draft
 const (
+	// Min is the minimum value allowed for a QUIC varint.
+	Min = 0
+
+	// Max is the maximum allowed value for a QUIC varint (2^62-1).
+	Max = maxVarInt8
+
 	maxVarInt1 = 63
 	maxVarInt2 = 16383
 	maxVarInt4 = 1073741823
 	maxVarInt8 = 4611686018427387903
 )

-// Read reads a number in the QUIC varint format
-func Read(b io.ByteReader) (uint64, error) {
-	firstByte, err := b.ReadByte()
+// Read reads a number in the QUIC varint format from r.
+func Read(r io.ByteReader) (uint64, error) {
+	firstByte, err := r.ReadByte()
 	if err != nil {
 		return 0, err
 	}
@@ -28,53 +33,53 @@ func Read(b io.ByteReader) (uint64, error) {
 	if len == 1 {
 		return uint64(b1), nil
 	}
-	b2, err := b.ReadByte()
+	b2, err := r.ReadByte()
 	if err != nil {
 		return 0, err
 	}
 	if len == 2 {
 		return uint64(b2) + uint64(b1)<<8, nil
 	}
-	b3, err := b.ReadByte()
+	b3, err := r.ReadByte()
 	if err != nil {
 		return 0, err
 	}
-	b4, err := b.ReadByte()
+	b4, err := r.ReadByte()
 	if err != nil {
 		return 0, err
 	}
 	if len == 4 {
 		return uint64(b4) + uint64(b3)<<8 + uint64(b2)<<16 + uint64(b1)<<24, nil
 	}
-	b5, err := b.ReadByte()
+	b5, err := r.ReadByte()
 	if err != nil {
 		return 0, err
 	}
-	b6, err := b.ReadByte()
+	b6, err := r.ReadByte()
 	if err != nil {
 		return 0, err
 	}
-	b7, err := b.ReadByte()
+	b7, err := r.ReadByte()
 	if err != nil {
 		return 0, err
 	}
-	b8, err := b.ReadByte()
+	b8, err := r.ReadByte()
 	if err != nil {
 		return 0, err
 	}
 	return uint64(b8) + uint64(b7)<<8 + uint64(b6)<<16 + uint64(b5)<<24 + uint64(b4)<<32 + uint64(b3)<<40 + uint64(b2)<<48 + uint64(b1)<<56, nil
 }

-// Write writes a number in the QUIC varint format
-func Write(b *bytes.Buffer, i uint64) {
+// Write writes i in the QUIC varint format to w.
+func Write(w Writer, i uint64) {
 	if i <= maxVarInt1 {
-		b.WriteByte(uint8(i))
+		w.WriteByte(uint8(i))
 	} else if i <= maxVarInt2 {
-		b.Write([]byte{uint8(i>>8) | 0x40, uint8(i)})
+		w.Write([]byte{uint8(i>>8) | 0x40, uint8(i)})
 	} else if i <= maxVarInt4 {
-		b.Write([]byte{uint8(i>>24) | 0x80, uint8(i >> 16), uint8(i >> 8), uint8(i)})
+		w.Write([]byte{uint8(i>>24) | 0x80, uint8(i >> 16), uint8(i >> 8), uint8(i)})
 	} else if i <= maxVarInt8 {
-		b.Write([]byte{
+		w.Write([]byte{
 			uint8(i>>56) | 0xc0, uint8(i >> 48), uint8(i >> 40), uint8(i >> 32),
 			uint8(i >> 24), uint8(i >> 16), uint8(i >> 8), uint8(i),
 		})
@@ -83,35 +88,35 @@ func Write(b *bytes.Buffer, i uint64) {
 	}
 }

-// WriteWithLen writes a number in the QUIC varint format, with the desired length.
-func WriteWithLen(b *bytes.Buffer, i uint64, length protocol.ByteCount) {
+// WriteWithLen writes i in the QUIC varint format with the desired length to w.
+func WriteWithLen(w Writer, i uint64, length protocol.ByteCount) {
 	if length != 1 && length != 2 && length != 4 && length != 8 {
 		panic("invalid varint length")
 	}
 	l := Len(i)
 	if l == length {
-		Write(b, i)
+		Write(w, i)
 		return
 	}
 	if l > length {
 		panic(fmt.Sprintf("cannot encode %d in %d bytes", i, length))
 	}
 	if length == 2 {
-		b.WriteByte(0b01000000)
+		w.WriteByte(0b01000000)
 	} else if length == 4 {
-		b.WriteByte(0b10000000)
+		w.WriteByte(0b10000000)
 	} else if length == 8 {
-		b.WriteByte(0b11000000)
+		w.WriteByte(0b11000000)
 	}
 	for j := protocol.ByteCount(1); j < length-l; j++ {
-		b.WriteByte(0)
+		w.WriteByte(0)
 	}
 	for j := protocol.ByteCount(0); j < l; j++ {
-		b.WriteByte(uint8(i >> (8 * (l - 1 - j))))
+		w.WriteByte(uint8(i >> (8 * (l - 1 - j))))
 	}
 }

-// Len determines the number of bytes that will be needed to write a number
+// Len determines the number of bytes that will be needed to write the number i.
 func Len(i uint64) protocol.ByteCount {
 	if i <= maxVarInt1 {
 		return 1
--- a/vendor/github.com/lucas-clemente/quic-go/receive_stream.go
+++ b/vendor/github.com/lucas-clemente/quic-go/receive_stream.go
@@ -8,6 +8,7 @@ import (

 	"github.com/lucas-clemente/quic-go/internal/flowcontrol"
 	"github.com/lucas-clemente/quic-go/internal/protocol"
+	"github.com/lucas-clemente/quic-go/internal/qerr"
 	"github.com/lucas-clemente/quic-go/internal/utils"
 	"github.com/lucas-clemente/quic-go/internal/wire"
 )
@@ -38,7 +39,7 @@ type receiveStream struct {

 	closeForShutdownErr error
 	cancelReadErr       error
-	resetRemotelyErr    StreamError
+	resetRemotelyErr    *StreamError

 	closedForShutdown bool // set when CloseForShutdown() is called
 	finRead           bool // set once we read a frame with a Fin
@@ -196,7 +197,7 @@ func (s *receiveStream) dequeueNextFrame() {
 	s.readPosInFrame = 0
 }

-func (s *receiveStream) CancelRead(errorCode protocol.ApplicationErrorCode) {
+func (s *receiveStream) CancelRead(errorCode StreamErrorCode) {
 	s.mutex.Lock()
 	completed := s.cancelReadImpl(errorCode)
 	s.mutex.Unlock()
@@ -207,7 +208,7 @@ func (s *receiveStream) CancelRead(errorCode protocol.ApplicationErrorCode) {
 	}
 }

-func (s *receiveStream) cancelReadImpl(errorCode protocol.ApplicationErrorCode) bool /* completed */ {
+func (s *receiveStream) cancelReadImpl(errorCode qerr.StreamErrorCode) bool /* completed */ {
 	if s.finRead || s.canceledRead || s.resetRemotely {
 		return false
 	}
@@ -281,9 +282,9 @@ func (s *receiveStream) handleResetStreamFrameImpl(frame *wire.ResetStreamFrame)
 		return false, nil
 	}
 	s.resetRemotely = true
-	s.resetRemotelyErr = streamCanceledError{
-		errorCode: frame.ErrorCode,
-		error:     fmt.Errorf("stream %d was reset with error code %d", s.streamID, frame.ErrorCode),
+	s.resetRemotelyErr = &StreamError{
+		StreamID:  s.streamID,
+		ErrorCode: frame.ErrorCode,
 	}
 	s.signalRead()
 	return newlyRcvdFinalOffset, nil
--- a/vendor/github.com/lucas-clemente/quic-go/send_stream.go
+++ b/vendor/github.com/lucas-clemente/quic-go/send_stream.go
@@ -7,9 +7,9 @@ import (
 	"time"

 	"github.com/lucas-clemente/quic-go/internal/ackhandler"
-
 	"github.com/lucas-clemente/quic-go/internal/flowcontrol"
 	"github.com/lucas-clemente/quic-go/internal/protocol"
+	"github.com/lucas-clemente/quic-go/internal/qerr"
 	"github.com/lucas-clemente/quic-go/internal/utils"
 	"github.com/lucas-clemente/quic-go/internal/wire"
 )
@@ -407,12 +407,12 @@ func (s *sendStream) Close() error {
 	return nil
 }

-func (s *sendStream) CancelWrite(errorCode protocol.ApplicationErrorCode) {
+func (s *sendStream) CancelWrite(errorCode StreamErrorCode) {
 	s.cancelWriteImpl(errorCode, fmt.Errorf("Write on stream %d canceled with error code %d", s.streamID, errorCode))
 }

 // must be called after locking the mutex
-func (s *sendStream) cancelWriteImpl(errorCode protocol.ApplicationErrorCode, writeErr error) {
+func (s *sendStream) cancelWriteImpl(errorCode qerr.StreamErrorCode, writeErr error) {
 	s.mutex.Lock()
 	if s.canceledWrite {
 		s.mutex.Unlock()
@@ -449,11 +449,10 @@ func (s *sendStream) updateSendWindow(limit protocol.ByteCount) {
 }

 func (s *sendStream) handleStopSendingFrame(frame *wire.StopSendingFrame) {
-	writeErr := streamCanceledError{
-		errorCode: frame.ErrorCode,
-		error:     fmt.Errorf("stream %d was reset with error code %d", s.streamID, frame.ErrorCode),
-	}
-	s.cancelWriteImpl(frame.ErrorCode, writeErr)
+	s.cancelWriteImpl(frame.ErrorCode, &StreamError{
+		StreamID:  s.streamID,
+		ErrorCode: frame.ErrorCode,
+	})
 }

 func (s *sendStream) Context() context.Context {
--- a/vendor/github.com/lucas-clemente/quic-go/server.go
+++ b/vendor/github.com/lucas-clemente/quic-go/server.go
@@ -87,6 +87,7 @@ type baseServer struct {
 		*handshake.TokenGenerator,
 		bool, /* enable 0-RTT */
 		logging.ConnectionTracer,
+		uint64,
 		utils.Logger,
 		protocol.VersionNumber,
 	) quicSession
@@ -365,7 +366,9 @@ func (s *baseServer) handlePacketImpl(p *receivedPacket) bool /* is the buffer s
 			}
 			return false
 		}
-		go s.sendVersionNegotiationPacket(p, hdr)
+		if !s.config.DisableVersionNegotiationPackets {
+			go s.sendVersionNegotiationPacket(p, hdr)
+		}
 		return false
 	}
 	if hdr.IsLongHeader && hdr.Type != protocol.PacketTypeInitial {
@@ -450,6 +453,7 @@ func (s *baseServer) handleInitialImpl(p *receivedPacket, hdr *wire.Header) erro
 	}
 	s.logger.Debugf("Changing connection ID to %s.", connID)
 	var sess quicSession
+	tracingID := nextSessionTracingID()
 	if added := s.sessionHandler.AddWithConnID(hdr.DestConnectionID, connID, func() packetHandler {
 		var tracer logging.ConnectionTracer
 		if s.config.Tracer != nil {
@@ -458,7 +462,11 @@ func (s *baseServer) handleInitialImpl(p *receivedPacket, hdr *wire.Header) erro
 			if origDestConnID.Len() > 0 {
 				connID = origDestConnID
 			}
-			tracer = s.config.Tracer.TracerForConnection(protocol.PerspectiveServer, connID)
+			tracer = s.config.Tracer.TracerForConnection(
+				context.WithValue(context.Background(), SessionTracingKey, tracingID),
+				protocol.PerspectiveServer,
+				connID,
+			)
 		}
 		sess = s.newSession(
 			newSendConn(s.conn, p.remoteAddr, p.info),
@@ -474,6 +482,7 @@ func (s *baseServer) handleInitialImpl(p *receivedPacket, hdr *wire.Header) erro
 			s.tokenGenerator,
 			s.acceptEarlySessions,
 			tracer,
+			tracingID,
 			s.logger,
 			hdr.Version,
 		)
@@ -593,12 +602,12 @@ func (s *baseServer) sendConnectionRefused(remoteAddr net.Addr, hdr *wire.Header
 }

 // sendError sends the error as a response to the packet received with header hdr
-func (s *baseServer) sendError(remoteAddr net.Addr, hdr *wire.Header, sealer handshake.LongHeaderSealer, errorCode qerr.ErrorCode, info *packetInfo) error {
+func (s *baseServer) sendError(remoteAddr net.Addr, hdr *wire.Header, sealer handshake.LongHeaderSealer, errorCode qerr.TransportErrorCode, info *packetInfo) error {
 	packetBuffer := getPacketBuffer()
 	defer packetBuffer.Release()
 	buf := bytes.NewBuffer(packetBuffer.Data)

-	ccf := &wire.ConnectionCloseFrame{ErrorCode: errorCode}
+	ccf := &wire.ConnectionCloseFrame{ErrorCode: uint64(errorCode)}

 	replyHdr := &wire.ExtendedHeader{}
 	replyHdr.IsLongHeader = true
--- a/vendor/github.com/lucas-clemente/quic-go/session.go
+++ b/vendor/github.com/lucas-clemente/quic-go/session.go
@@ -10,6 +10,7 @@ import (
 	"net"
 	"reflect"
 	"sync"
+	"sync/atomic"
 	"time"

 	"github.com/lucas-clemente/quic-go/internal/ackhandler"
@@ -122,23 +123,12 @@ type errCloseForRecreating struct {
 	nextVersion      protocol.VersionNumber
 }

-func (errCloseForRecreating) Error() string {
+func (e *errCloseForRecreating) Error() string {
 	return "closing session in order to recreate it"
 }

-func (errCloseForRecreating) Is(target error) bool {
-	_, ok := target.(errCloseForRecreating)
-	return ok
-}
-
-type errVersionNegotiation struct {
-	ourVersions   []protocol.VersionNumber
-	theirVersions []protocol.VersionNumber
-}
-
-func (e errVersionNegotiation) Error() string {
-	return fmt.Sprintf("no compatible QUIC version found (we support %s, server offered %s)", e.ourVersions, e.theirVersions)
-}
+var sessionTracingID uint64        // to be accessed atomically
+func nextSessionTracingID() uint64 { return atomic.AddUint64(&sessionTracingID, 1) }

 // A Session is a QUIC session
 type session struct {
@@ -252,6 +242,7 @@ var newSession = func(
 	tokenGenerator *handshake.TokenGenerator,
 	enable0RTT bool,
 	tracer logging.ConnectionTracer,
+	tracingID uint64,
 	logger utils.Logger,
 	v protocol.VersionNumber,
 ) quicSession {
@@ -291,8 +282,10 @@ var newSession = func(
 		s.version,
 	)
 	s.preSetup()
+	s.ctx, s.ctxCancel = context.WithCancel(context.WithValue(context.Background(), SessionTracingKey, tracingID))
 	s.sentPacketHandler, s.receivedPacketHandler = ackhandler.NewAckHandler(
 		0,
+		getMaxPacketSize(s.conn.RemoteAddr()),
 		s.rttStats,
 		s.perspective,
 		s.tracer,
@@ -380,6 +373,7 @@ var newClientSession = func(
 	enable0RTT bool,
 	hasNegotiatedVersion bool,
 	tracer logging.ConnectionTracer,
+	tracingID uint64,
 	logger utils.Logger,
 	v protocol.VersionNumber,
 ) quicSession {
@@ -415,8 +409,10 @@ var newClientSession = func(
 		s.version,
 	)
 	s.preSetup()
+	s.ctx, s.ctxCancel = context.WithCancel(context.WithValue(context.Background(), SessionTracingKey, tracingID))
 	s.sentPacketHandler, s.receivedPacketHandler = ackhandler.NewAckHandler(
 		initialPacketNumber,
+		getMaxPacketSize(s.conn.RemoteAddr()),
 		s.rttStats,
 		s.perspective,
 		s.tracer,
@@ -522,7 +518,6 @@ func (s *session) preSetup() {
 	s.receivedPackets = make(chan *receivedPacket, protocol.MaxSessionUnprocessedPackets)
 	s.closeChan = make(chan closeError, 1)
 	s.sendingScheduled = make(chan struct{}, 1)
-	s.ctx, s.ctxCancel = context.WithCancel(context.Background())
 	s.handshakeCtx, s.handshakeCtxCancel = context.WithCancel(context.Background())

 	now := time.Now()
@@ -608,7 +603,6 @@ runLoop:
 				// nothing to see here.
 			case <-sendQueueAvailable:
 			case firstPacket := <-s.receivedPackets:
-				s.sentPacketHandler.ReceivedBytes(firstPacket.Size())
 				wasProcessed := s.handlePacketImpl(firstPacket)
 				// Don't set timers and send packets if the packet made us close the session.
 				select {
@@ -664,19 +658,13 @@ runLoop:
 			s.framer.QueueControlFrame(&wire.PingFrame{})
 			s.keepAlivePingSent = true
 		} else if !s.handshakeComplete && now.Sub(s.sessionCreationTime) >= s.config.handshakeTimeout() {
-			if s.tracer != nil {
-				s.tracer.ClosedConnection(logging.NewTimeoutCloseReason(logging.TimeoutReasonHandshake))
-			}
-			s.destroyImpl(qerr.NewTimeoutError("Handshake did not complete in time"))
+			s.destroyImpl(qerr.ErrHandshakeTimeout)
 			continue
 		} else {
 			idleTimeoutStartTime := s.idleTimeoutStartTime()
 			if (!s.handshakeComplete && now.Sub(idleTimeoutStartTime) >= s.config.HandshakeIdleTimeout) ||
 				(s.handshakeComplete && now.Sub(idleTimeoutStartTime) >= s.idleTimeout) {
-				if s.tracer != nil {
-					s.tracer.ClosedConnection(logging.NewTimeoutCloseReason(logging.TimeoutReasonIdle))
-				}
-				s.destroyImpl(qerr.NewTimeoutError("No recent network activity"))
+				s.destroyImpl(qerr.ErrIdleTimeout)
 				continue
 			}
 		}
@@ -697,8 +685,8 @@ runLoop:
 		}
 	}

-	s.handleCloseError(closeErr)
-	if !errors.Is(closeErr.err, errCloseForRecreating{}) && s.tracer != nil {
+	s.handleCloseError(&closeErr)
+	if e := (&errCloseForRecreating{}); !errors.As(closeErr.err, &e) && s.tracer != nil {
 		s.tracer.Close()
 	}
 	s.logger.Infof("Connection %s closed.", s.logID)
@@ -738,23 +726,26 @@ func (s *session) nextKeepAliveTime() time.Time {
 	if !s.config.KeepAlive || s.keepAlivePingSent || !s.firstAckElicitingPacketAfterIdleSentTime.IsZero() {
 		return time.Time{}
 	}
-	return s.lastPacketReceivedTime.Add(s.keepAliveInterval / 2)
+	return s.lastPacketReceivedTime.Add(s.keepAliveInterval)
 }

 func (s *session) maybeResetTimer() {
 	var deadline time.Time
 	if !s.handshakeComplete {
-		deadline = s.sessionCreationTime.Add(utils.MinDuration(s.config.handshakeTimeout(), s.config.HandshakeIdleTimeout))
+		deadline = utils.MinTime(
+			s.sessionCreationTime.Add(s.config.handshakeTimeout()),
+			s.idleTimeoutStartTime().Add(s.config.HandshakeIdleTimeout),
+		)
 	} else {
 		if keepAliveTime := s.nextKeepAliveTime(); !keepAliveTime.IsZero() {
 			deadline = keepAliveTime
 		} else {
 			deadline = s.idleTimeoutStartTime().Add(s.idleTimeout)
 		}
-		if !s.config.DisablePathMTUDiscovery {
-			if probeTime := s.mtuDiscoverer.NextProbeTime(); !probeTime.IsZero() {
-				deadline = utils.MinTime(deadline, probeTime)
-			}
+	}
+	if s.handshakeConfirmed && !s.config.DisablePathMTUDiscovery {
+		if probeTime := s.mtuDiscoverer.NextProbeTime(); !probeTime.IsZero() {
+			deadline = utils.MinTime(deadline, probeTime)
 		}
 	}

@@ -786,6 +777,36 @@ func (s *session) handleHandshakeComplete() {
 	s.connIDManager.SetHandshakeComplete()
 	s.connIDGenerator.SetHandshakeComplete()

+	if s.perspective == protocol.PerspectiveClient {
+		s.applyTransportParameters()
+		return
+	}
+
+	s.handleHandshakeConfirmed()
+
+	ticket, err := s.cryptoStreamHandler.GetSessionTicket()
+	if err != nil {
+		s.closeLocal(err)
+	}
+	if ticket != nil {
+		s.oneRTTStream.Write(ticket)
+		for s.oneRTTStream.HasData() {
+			s.queueControlFrame(s.oneRTTStream.PopCryptoFrame(protocol.MaxPostHandshakeCryptoFrameSize))
+		}
+	}
+	token, err := s.tokenGenerator.NewToken(s.conn.RemoteAddr())
+	if err != nil {
+		s.closeLocal(err)
+	}
+	s.queueControlFrame(&wire.NewTokenFrame{Token: token})
+	s.queueControlFrame(&wire.HandshakeDoneFrame{})
+}
+
+func (s *session) handleHandshakeConfirmed() {
+	s.handshakeConfirmed = true
+	s.sentPacketHandler.SetHandshakeConfirmed()
+	s.cryptoStreamHandler.SetHandshakeConfirmed()
+
 	if !s.config.DisablePathMTUDiscovery {
 		maxPacketSize := s.peerParams.MaxUDPPayloadSize
 		if maxPacketSize == 0 {
@@ -802,34 +823,11 @@ func (s *session) handleHandshakeComplete() {
 			},
 		)
 	}
-
-	if s.perspective == protocol.PerspectiveClient {
-		s.applyTransportParameters()
-		return
-	}
-
-	s.handshakeConfirmed = true
-	s.sentPacketHandler.SetHandshakeConfirmed()
-	ticket, err := s.cryptoStreamHandler.GetSessionTicket()
-	if err != nil {
-		s.closeLocal(err)
-	}
-	if ticket != nil {
-		s.oneRTTStream.Write(ticket)
-		for s.oneRTTStream.HasData() {
-			s.queueControlFrame(s.oneRTTStream.PopCryptoFrame(protocol.MaxPostHandshakeCryptoFrameSize))
-		}
-	}
-	token, err := s.tokenGenerator.NewToken(s.conn.RemoteAddr())
-	if err != nil {
-		s.closeLocal(err)
-	}
-	s.queueControlFrame(&wire.NewTokenFrame{Token: token})
-	s.cryptoStreamHandler.SetHandshakeConfirmed()
-	s.queueControlFrame(&wire.HandshakeDoneFrame{})
 }

 func (s *session) handlePacketImpl(rp *receivedPacket) bool {
+	s.sentPacketHandler.ReceivedBytes(rp.Size())
+
 	if wire.IsVersionNegotiationPacket(rp.data) {
 		s.handleVersionNegotiationPacket(rp)
 		return false
@@ -940,7 +938,10 @@ func (s *session) handleSinglePacket(p *receivedPacket, hdr *wire.Header) bool /
 			wasQueued = true
 			s.tryQueueingUndecryptablePacket(p, hdr)
 		case wire.ErrInvalidReservedBits:
-			s.closeLocal(qerr.NewError(qerr.ProtocolViolation, err.Error()))
+			s.closeLocal(&qerr.TransportError{
+				ErrorCode:    qerr.ProtocolViolation,
+				ErrorMessage: err.Error(),
+			})
 		case handshake.ErrDecryptionFailed:
 			// This might be a packet injected by an attacker. Drop it.
 			if s.tracer != nil {
@@ -1081,13 +1082,16 @@ func (s *session) handleVersionNegotiationPacket(p *receivedPacket) {
 	}
 	newVersion, ok := protocol.ChooseSupportedVersion(s.config.Versions, supportedVersions)
 	if !ok {
-		s.destroyImpl(errVersionNegotiation{
-			ourVersions:   s.config.Versions,
-			theirVersions: supportedVersions,
+		s.destroyImpl(&VersionNegotiationError{
+			Ours:   s.config.Versions,
+			Theirs: supportedVersions,
 		})
 		s.logger.Infof("No compatible QUIC version found.")
 		return
 	}
+	if s.tracer != nil {
+		s.tracer.NegotiatedVersion(newVersion, s.config.Versions, supportedVersions)
+	}

 	s.logger.Infof("Switching to QUIC version %s.", newVersion)
 	nextPN, _ := s.sentPacketHandler.PeekPacketNumber(protocol.EncryptionInitial)
@@ -1104,11 +1108,24 @@ func (s *session) handleUnpackedPacket(
 	packetSize protocol.ByteCount, // only for logging
 ) error {
 	if len(packet.data) == 0 {
-		return qerr.NewError(qerr.ProtocolViolation, "empty packet")
+		return &qerr.TransportError{
+			ErrorCode:    qerr.ProtocolViolation,
+			ErrorMessage: "empty packet",
+		}
 	}

 	if !s.receivedFirstPacket {
 		s.receivedFirstPacket = true
+		if !s.versionNegotiated && s.tracer != nil {
+			var clientVersions, serverVersions []protocol.VersionNumber
+			switch s.perspective {
+			case protocol.PerspectiveClient:
+				clientVersions = s.config.Versions
+			case protocol.PerspectiveServer:
+				serverVersions = s.config.Versions
+			}
+			s.tracer.NegotiatedVersion(s.version, clientVersions, serverVersions)
+		}
 		// The server can change the source connection ID with the first Handshake packet.
 		if s.perspective == protocol.PerspectiveClient && packet.hdr.IsLongHeader && !packet.hdr.SrcConnectionID.Equal(s.handshakeDestConnID) {
 			cid := packet.hdr.SrcConnectionID
@@ -1130,7 +1147,6 @@ func (s *session) handleUnpackedPacket(
 				s.tracer.StartedConnection(
 					s.conn.LocalAddr(),
 					s.conn.RemoteAddr(),
-					s.version,
 					packet.hdr.SrcConnectionID,
 					packet.hdr.DestConnectionID,
 				)
@@ -1246,13 +1262,20 @@ func (s *session) handlePacket(p *receivedPacket) {
 }

 func (s *session) handleConnectionCloseFrame(frame *wire.ConnectionCloseFrame) {
-	var e error
 	if frame.IsApplicationError {
-		e = qerr.NewApplicationError(frame.ErrorCode, frame.ReasonPhrase)
-	} else {
-		e = qerr.NewError(frame.ErrorCode, frame.ReasonPhrase)
+		s.closeRemote(&qerr.ApplicationError{
+			Remote:       true,
+			ErrorCode:    qerr.ApplicationErrorCode(frame.ErrorCode),
+			ErrorMessage: frame.ReasonPhrase,
+		})
+		return
 	}
-	s.closeRemote(e)
+	s.closeRemote(&qerr.TransportError{
+		Remote:       true,
+		ErrorCode:    qerr.TransportErrorCode(frame.ErrorCode),
+		FrameType:    frame.FrameType,
+		ErrorMessage: frame.ReasonPhrase,
+	})
 }

 func (s *session) handleCryptoFrame(frame *wire.CryptoFrame, encLevel protocol.EncryptionLevel) error {
@@ -1333,7 +1356,10 @@ func (s *session) handlePathChallengeFrame(frame *wire.PathChallengeFrame) {

 func (s *session) handleNewTokenFrame(frame *wire.NewTokenFrame) error {
 	if s.perspective == protocol.PerspectiveServer {
-		return qerr.NewError(qerr.ProtocolViolation, "Received NEW_TOKEN frame from the client.")
+		return &qerr.TransportError{
+			ErrorCode:    qerr.ProtocolViolation,
+			ErrorMessage: "received NEW_TOKEN frame from the client",
+		}
 	}
 	if s.config.TokenStore != nil {
 		s.config.TokenStore.Put(s.tokenStoreKey, &ClientToken{data: frame.Token})
@@ -1351,27 +1377,37 @@ func (s *session) handleRetireConnectionIDFrame(f *wire.RetireConnectionIDFrame,

 func (s *session) handleHandshakeDoneFrame() error {
 	if s.perspective == protocol.PerspectiveServer {
-		return qerr.NewError(qerr.ProtocolViolation, "received a HANDSHAKE_DONE frame")
+		return &qerr.TransportError{
+			ErrorCode:    qerr.ProtocolViolation,
+			ErrorMessage: "received a HANDSHAKE_DONE frame",
+		}
+	}
+	if !s.handshakeConfirmed {
+		s.handleHandshakeConfirmed()
 	}
-	s.handshakeConfirmed = true
-	s.sentPacketHandler.SetHandshakeConfirmed()
-	s.cryptoStreamHandler.SetHandshakeConfirmed()
 	return nil
 }

 func (s *session) handleAckFrame(frame *wire.AckFrame, encLevel protocol.EncryptionLevel) error {
-	if err := s.sentPacketHandler.ReceivedAck(frame, encLevel, s.lastPacketReceivedTime); err != nil {
+	acked1RTTPacket, err := s.sentPacketHandler.ReceivedAck(frame, encLevel, s.lastPacketReceivedTime)
+	if err != nil {
 		return err
 	}
-	if encLevel != protocol.Encryption1RTT {
+	if !acked1RTTPacket {
 		return nil
 	}
+	if s.perspective == protocol.PerspectiveClient && !s.handshakeConfirmed {
+		s.handleHandshakeConfirmed()
+	}
 	return s.cryptoStreamHandler.SetLargest1RTTAcked(frame.LargestAcked())
 }

 func (s *session) handleDatagramFrame(f *wire.DatagramFrame) error {
 	if f.Length(s.version) > protocol.MaxDatagramFrameSize {
-		return qerr.NewError(qerr.ProtocolViolation, "DATAGRAM frame too large")
+		return &qerr.TransportError{
+			ErrorCode:    qerr.ProtocolViolation,
+			ErrorMessage: "DATAGRAM frame too large",
+		}
 	}
 	s.datagramQueue.HandleDatagramFrame(f)
 	return nil
@@ -1420,44 +1456,55 @@ func (s *session) shutdown() {
 	<-s.ctx.Done()
 }

-func (s *session) CloseWithError(code protocol.ApplicationErrorCode, desc string) error {
-	s.closeLocal(qerr.NewApplicationError(qerr.ErrorCode(code), desc))
+func (s *session) CloseWithError(code ApplicationErrorCode, desc string) error {
+	s.closeLocal(&qerr.ApplicationError{
+		ErrorCode:    code,
+		ErrorMessage: desc,
+	})
 	<-s.ctx.Done()
 	return nil
 }

-func (s *session) handleCloseError(closeErr closeError) {
-	if closeErr.err == nil {
-		closeErr.err = qerr.NewApplicationError(0, "")
+func (s *session) handleCloseError(closeErr *closeError) {
+	e := closeErr.err
+	if e == nil {
+		e = &qerr.ApplicationError{}
+	} else {
+		defer func() {
+			closeErr.err = e
+		}()
 	}

-	var quicErr *qerr.QuicError
-	var ok bool
-	if quicErr, ok = closeErr.err.(*qerr.QuicError); !ok {
-		quicErr = qerr.ToQuicError(closeErr.err)
+	var (
+		statelessResetErr     *StatelessResetError
+		versionNegotiationErr *VersionNegotiationError
+		recreateErr           *errCloseForRecreating
+		applicationErr        *ApplicationError
+		transportErr          *TransportError
+	)
+	switch {
+	case errors.Is(e, qerr.ErrIdleTimeout),
+		errors.Is(e, qerr.ErrHandshakeTimeout),
+		errors.As(e, &statelessResetErr),
+		errors.As(e, &versionNegotiationErr),
+		errors.As(e, &recreateErr),
+		errors.As(e, &applicationErr),
+		errors.As(e, &transportErr):
+	default:
+		e = &qerr.TransportError{
+			ErrorCode:    qerr.InternalError,
+			ErrorMessage: e.Error(),
+		}
 	}

-	s.streamsMap.CloseWithError(quicErr)
+	s.streamsMap.CloseWithError(e)
 	s.connIDManager.Close()
 	if s.datagramQueue != nil {
-		s.datagramQueue.CloseWithError(quicErr)
+		s.datagramQueue.CloseWithError(e)
 	}

-	if s.tracer != nil {
-		// timeout errors are logged as soon as they occur (to distinguish between handshake and idle timeouts)
-		if nerr, ok := closeErr.err.(net.Error); !ok || !nerr.Timeout() {
-			var resetErr statelessResetErr
-			var vnErr errVersionNegotiation
-			if errors.As(closeErr.err, &resetErr) {
-				s.tracer.ClosedConnection(logging.NewStatelessResetCloseReason(resetErr.token))
-			} else if errors.As(closeErr.err, &vnErr) {
-				s.tracer.ClosedConnection(logging.NewVersionNegotiationError(vnErr.theirVersions))
-			} else if quicErr.IsApplicationError() {
-				s.tracer.ClosedConnection(logging.NewApplicationCloseReason(quicErr.ErrorCode, closeErr.remote))
-			} else {
-				s.tracer.ClosedConnection(logging.NewTransportCloseReason(quicErr.ErrorCode, closeErr.remote))
-			}
-		}
+	if s.tracer != nil && !errors.As(e, &recreateErr) {
+		s.tracer.ClosedConnection(e)
 	}

 	// If this is a remote close we're done here
@@ -1469,7 +1516,7 @@ func (s *session) handleCloseError(closeErr closeError) {
 		s.connIDGenerator.RemoveAll()
 		return
 	}
-	connClosePacket, err := s.sendConnectionClose(quicErr)
+	connClosePacket, err := s.sendConnectionClose(e)
 	if err != nil {
 		s.logger.Debugf("Error sending CONNECTION_CLOSE: %s", err)
 	}
@@ -1508,7 +1555,10 @@ func (s *session) restoreTransportParameters(params *wire.TransportParameters) {

 func (s *session) handleTransportParameters(params *wire.TransportParameters) {
 	if err := s.checkTransportParameters(params); err != nil {
-		s.closeLocal(err)
+		s.closeLocal(&qerr.TransportError{
+			ErrorCode:    qerr.TransportParameterError,
+			ErrorMessage: err.Error(),
+		})
 	}
 	s.peerParams = params
 	// On the client side we have to wait for handshake completion.
@@ -1531,7 +1581,7 @@ func (s *session) checkTransportParameters(params *wire.TransportParameters) err

 	// check the initial_source_connection_id
 	if !params.InitialSourceConnectionID.Equal(s.handshakeDestConnID) {
-		return qerr.NewError(qerr.TransportParameterError, fmt.Sprintf("expected initial_source_connection_id to equal %s, is %s", s.handshakeDestConnID, params.InitialSourceConnectionID))
+		return fmt.Errorf("expected initial_source_connection_id to equal %s, is %s", s.handshakeDestConnID, params.InitialSourceConnectionID)
 	}

 	if s.perspective == protocol.PerspectiveServer {
@@ -1539,17 +1589,17 @@ func (s *session) checkTransportParameters(params *wire.TransportParameters) err
 	}
 	// check the original_destination_connection_id
 	if !params.OriginalDestinationConnectionID.Equal(s.origDestConnID) {
-		return qerr.NewError(qerr.TransportParameterError, fmt.Sprintf("expected original_destination_connection_id to equal %s, is %s", s.origDestConnID, params.OriginalDestinationConnectionID))
+		return fmt.Errorf("expected original_destination_connection_id to equal %s, is %s", s.origDestConnID, params.OriginalDestinationConnectionID)
 	}
 	if s.retrySrcConnID != nil { // a Retry was performed
 		if params.RetrySourceConnectionID == nil {
-			return qerr.NewError(qerr.TransportParameterError, "missing retry_source_connection_id")
+			return errors.New("missing retry_source_connection_id")
 		}
 		if !(*params.RetrySourceConnectionID).Equal(*s.retrySrcConnID) {
-			return qerr.NewError(qerr.TransportParameterError, fmt.Sprintf("expected retry_source_connection_id to equal %s, is %s", s.retrySrcConnID, *params.RetrySourceConnectionID))
+			return fmt.Errorf("expected retry_source_connection_id to equal %s, is %s", s.retrySrcConnID, *params.RetrySourceConnectionID)
 		}
 	} else if params.RetrySourceConnectionID != nil {
-		return qerr.NewError(qerr.TransportParameterError, "received retry_source_connection_id, although no Retry was performed")
+		return errors.New("received retry_source_connection_id, although no Retry was performed")
 	}
 	return nil
 }
@@ -1718,7 +1768,7 @@ func (s *session) sendPacket() (bool, error) {
 		s.sendQueue.Send(packet.buffer)
 		return true, nil
 	}
-	if !s.config.DisablePathMTUDiscovery && s.handshakeComplete && s.mtuDiscoverer.ShouldSendProbe(now) {
+	if !s.config.DisablePathMTUDiscovery && s.mtuDiscoverer.ShouldSendProbe(now) {
 		packet, err := s.packer.PackMTUProbePacket(s.mtuDiscoverer.GetPing())
 		if err != nil {
 			return false, err
@@ -1744,8 +1794,21 @@ func (s *session) sendPackedPacket(packet *packedPacket, now time.Time) {
 	s.sendQueue.Send(packet.buffer)
 }

-func (s *session) sendConnectionClose(quicErr *qerr.QuicError) ([]byte, error) {
-	packet, err := s.packer.PackConnectionClose(quicErr)
+func (s *session) sendConnectionClose(e error) ([]byte, error) {
+	var packet *coalescedPacket
+	var err error
+	var transportErr *qerr.TransportError
+	var applicationErr *qerr.ApplicationError
+	if errors.As(e, &transportErr) {
+		packet, err = s.packer.PackConnectionClose(transportErr)
+	} else if errors.As(e, &applicationErr) {
+		packet, err = s.packer.PackApplicationClose(applicationErr)
+	} else {
+		packet, err = s.packer.PackConnectionClose(&qerr.TransportError{
+			ErrorCode:    qerr.InternalError,
+			ErrorMessage: fmt.Sprintf("session BUG: unspecified error type (msg: %s)", e.Error()),
+		})
+	}
 	if err != nil {
 		return nil, err
 	}
@@ -1902,8 +1965,7 @@ func (s *session) SendMessage(p []byte) error {
 	}
 	f.Data = make([]byte, len(p))
 	copy(f.Data, p)
-	s.datagramQueue.AddAndWait(f)
-	return nil
+	return s.datagramQueue.AddAndWait(f)
 }

 func (s *session) ReceiveMessage() ([]byte, error) {
--- a/vendor/github.com/lucas-clemente/quic-go/stream.go
+++ b/vendor/github.com/lucas-clemente/quic-go/stream.go
@@ -86,16 +86,6 @@ type stream struct {

 var _ Stream = &stream{}

-type streamCanceledError struct {
-	error
-	errorCode protocol.ApplicationErrorCode
-}
-
-func (streamCanceledError) Canceled() bool                             { return true }
-func (e streamCanceledError) ErrorCode() protocol.ApplicationErrorCode { return e.errorCode }
-
-var _ StreamError = &streamCanceledError{}
-
 // newStream creates a new Stream
 func newStream(streamID protocol.StreamID,
 	sender streamSender,
--- a/vendor/github.com/lucas-clemente/quic-go/streams_map.go
+++ b/vendor/github.com/lucas-clemente/quic-go/streams_map.go
@@ -209,7 +209,10 @@ func (m *streamsMap) DeleteStream(id protocol.StreamID) error {
 func (m *streamsMap) GetOrOpenReceiveStream(id protocol.StreamID) (receiveStreamI, error) {
 	str, err := m.getOrOpenReceiveStream(id)
 	if err != nil {
-		return nil, qerr.NewError(qerr.StreamStateError, err.Error())
+		return nil, &qerr.TransportError{
+			ErrorCode:    qerr.StreamStateError,
+			ErrorMessage: err.Error(),
+		}
 	}
 	return str, nil
 }
@@ -240,7 +243,10 @@ func (m *streamsMap) getOrOpenReceiveStream(id protocol.StreamID) (receiveStream
 func (m *streamsMap) GetOrOpenSendStream(id protocol.StreamID) (sendStreamI, error) {
 	str, err := m.getOrOpenSendStream(id)
 	if err != nil {
-		return nil, qerr.NewError(qerr.StreamStateError, err.Error())
+		return nil, &qerr.TransportError{
+			ErrorCode:    qerr.StreamStateError,
+			ErrorMessage: err.Error(),
+		}
 	}
 	return str, nil
 }
--- a/vendor/github.com/lucas-clemente/quic-go/streams_map_incoming_bidi.go
+++ b/vendor/github.com/lucas-clemente/quic-go/streams_map_incoming_bidi.go
@@ -145,7 +145,7 @@ func (m *incomingBidiStreamsMap) DeleteStream(num protocol.StreamNum) error {
 func (m *incomingBidiStreamsMap) deleteStream(num protocol.StreamNum) error {
 	if _, ok := m.streams[num]; !ok {
 		return streamError{
-			message: "Tried to delete unknown incoming stream %d",
+			message: "tried to delete unknown incoming stream %d",
 			nums:    []protocol.StreamNum{num},
 		}
 	}
@@ -156,7 +156,7 @@ func (m *incomingBidiStreamsMap) deleteStream(num protocol.StreamNum) error {
 		entry, ok := m.streams[num]
 		if ok && entry.shouldDelete {
 			return streamError{
-				message: "Tried to delete incoming stream %d multiple times",
+				message: "tried to delete incoming stream %d multiple times",
 				nums:    []protocol.StreamNum{num},
 			}
 		}
--- a/vendor/github.com/lucas-clemente/quic-go/streams_map_incoming_generic.go
+++ b/vendor/github.com/lucas-clemente/quic-go/streams_map_incoming_generic.go
@@ -143,7 +143,7 @@ func (m *incomingItemsMap) DeleteStream(num protocol.StreamNum) error {
 func (m *incomingItemsMap) deleteStream(num protocol.StreamNum) error {
 	if _, ok := m.streams[num]; !ok {
 		return streamError{
-			message: "Tried to delete unknown incoming stream %d",
+			message: "tried to delete unknown incoming stream %d",
 			nums:    []protocol.StreamNum{num},
 		}
 	}
@@ -154,7 +154,7 @@ func (m *incomingItemsMap) deleteStream(num protocol.StreamNum) error {
 		entry, ok := m.streams[num]
 		if ok && entry.shouldDelete {
 			return streamError{
-				message: "Tried to delete incoming stream %d multiple times",
+				message: "tried to delete incoming stream %d multiple times",
 				nums:    []protocol.StreamNum{num},
 			}
 		}
--- a/vendor/github.com/lucas-clemente/quic-go/streams_map_incoming_uni.go
+++ b/vendor/github.com/lucas-clemente/quic-go/streams_map_incoming_uni.go
@@ -145,7 +145,7 @@ func (m *incomingUniStreamsMap) DeleteStream(num protocol.StreamNum) error {
 func (m *incomingUniStreamsMap) deleteStream(num protocol.StreamNum) error {
 	if _, ok := m.streams[num]; !ok {
 		return streamError{
-			message: "Tried to delete unknown incoming stream %d",
+			message: "tried to delete unknown incoming stream %d",
 			nums:    []protocol.StreamNum{num},
 		}
 	}
@@ -156,7 +156,7 @@ func (m *incomingUniStreamsMap) deleteStream(num protocol.StreamNum) error {
 		entry, ok := m.streams[num]
 		if ok && entry.shouldDelete {
 			return streamError{
-				message: "Tried to delete incoming stream %d multiple times",
+				message: "tried to delete incoming stream %d multiple times",
 				nums:    []protocol.StreamNum{num},
 			}
 		}
--- a/vendor/github.com/lucas-clemente/quic-go/streams_map_outgoing_bidi.go
+++ b/vendor/github.com/lucas-clemente/quic-go/streams_map_outgoing_bidi.go
@@ -157,7 +157,7 @@ func (m *outgoingBidiStreamsMap) DeleteStream(num protocol.StreamNum) error {

 	if _, ok := m.streams[num]; !ok {
 		return streamError{
-			message: "Tried to delete unknown outgoing stream %d",
+			message: "tried to delete unknown outgoing stream %d",
 			nums:    []protocol.StreamNum{num},
 		}
 	}
--- a/vendor/github.com/lucas-clemente/quic-go/streams_map_outgoing_generic.go
+++ b/vendor/github.com/lucas-clemente/quic-go/streams_map_outgoing_generic.go
@@ -155,7 +155,7 @@ func (m *outgoingItemsMap) DeleteStream(num protocol.StreamNum) error {

 	if _, ok := m.streams[num]; !ok {
 		return streamError{
-			message: "Tried to delete unknown outgoing stream %d",
+			message: "tried to delete unknown outgoing stream %d",
 			nums:    []protocol.StreamNum{num},
 		}
 	}
--- a/vendor/github.com/lucas-clemente/quic-go/streams_map_outgoing_uni.go
+++ b/vendor/github.com/lucas-clemente/quic-go/streams_map_outgoing_uni.go
@@ -157,7 +157,7 @@ func (m *outgoingUniStreamsMap) DeleteStream(num protocol.StreamNum) error {

 	if _, ok := m.streams[num]; !ok {
 		return streamError{
-			message: "Tried to delete unknown outgoing stream %d",
+			message: "tried to delete unknown outgoing stream %d",
 			nums:    []protocol.StreamNum{num},
 		}
 	}
--- a/vendor/github.com/lucas-clemente/quic-go/tools.go
+++ b/vendor/github.com/lucas-clemente/quic-go/tools.go
@@ -0,0 +1,8 @@
+// +build tools
+
+package quic
+
+import (
+	_ "github.com/cheekybits/genny"
+	_ "github.com/onsi/ginkgo/ginkgo"
+)