implement parsing and writing of RESET_STREAM_AT frames (#5155)

* implement parsing and writing of RESET_STREAM_AT frames * wire: add support for parsing RESET_STREAM_AT frames
2025-05-28 11:49:54 +08:00
parent eb7b7df1db
commit cb5c3f2aad
7 changed files with 271 additions and 292 deletions
--- a/connection.go
+++ b/connection.go
@@ -467,7 +467,7 @@ func (s *connection) preSetup() {
 	s.handshakeStream = newCryptoStream()
 	s.sendQueue = newSendQueue(s.conn)
 	s.retransmissionQueue = newRetransmissionQueue()
-	s.frameParser = *wire.NewFrameParser(s.config.EnableDatagrams)
+	s.frameParser = *wire.NewFrameParser(s.config.EnableDatagrams, false)
 	s.rttStats = &utils.RTTStats{}
 	s.connFlowController = flowcontrol.NewConnectionFlowController(
 		protocol.ByteCount(s.config.InitialConnectionReceiveWindow),
--- a/fuzzing/frames/fuzz.go
+++ b/fuzzing/frames/fuzz.go
@@ -34,7 +34,7 @@ func Fuzz(data []byte) int {
 	encLevel := toEncLevel(data[0])
 	data = data[PrefixLen:]

-	parser := wire.NewFrameParser(true)
+	parser := wire.NewFrameParser(true, true)
 	parser.SetAckDelayExponent(protocol.DefaultAckDelayExponent)

 	var numFrames int
@@ -131,5 +131,9 @@ func validateFrame(frame wire.Frame) {
 		if f.IsApplicationError && f.FrameType != 0 {
 			panic("CONNECTION_CLOSE for an application error containing a frame type")
 		}
+	case *wire.ResetStreamFrame:
+		if f.FinalSize < f.ReliableSize {
+			panic("RESET_STREAM frame with a FinalSize smaller than the ReliableSize")
+		}
 	}
 }
--- a/internal/wire/frame_parser.go
+++ b/internal/wire/frame_parser.go
@@ -34,12 +34,16 @@ const (
 	connectionCloseFrameType    = 0x1c
 	applicationCloseFrameType   = 0x1d
 	handshakeDoneFrameType      = 0x1e
+	resetStreamAtFrameType      = 0x24 // https://datatracker.ietf.org/doc/draft-ietf-quic-reliable-stream-reset/06/
 )

+var errUnknownFrameType = errors.New("unknown frame type")
+
 // The FrameParser parses QUIC frames, one by one.
 type FrameParser struct {
 	ackDelayExponent      uint8
 	supportsDatagrams     bool
+	supportsResetStreamAt bool

 	// To avoid allocating when parsing, keep a single ACK frame struct.
 	// It is used over and over again.
@@ -47,9 +51,10 @@ type FrameParser struct {
 }

 // NewFrameParser creates a new frame parser.
-func NewFrameParser(supportsDatagrams bool) *FrameParser {
+func NewFrameParser(supportsDatagrams, supportsResetStreamAt bool) *FrameParser {
 	return &FrameParser{
 		supportsDatagrams:     supportsDatagrams,
+		supportsResetStreamAt: supportsResetStreamAt,
 		ackFrame:              &AckFrame{},
 	}
 }
@@ -110,7 +115,7 @@ func (p *FrameParser) parseFrame(b []byte, typ uint64, encLevel protocol.Encrypt
 			l, err = parseAckFrame(p.ackFrame, b, typ, ackDelayExponent, v)
 			frame = p.ackFrame
 		case resetStreamFrameType:
-			frame, l, err = parseResetStreamFrame(b, v)
+			frame, l, err = parseResetStreamFrame(b, false, v)
 		case stopSendingFrameType:
 			frame, l, err = parseStopSendingFrame(b, v)
 		case cryptoFrameType:
@@ -142,13 +147,17 @@ func (p *FrameParser) parseFrame(b []byte, typ uint64, encLevel protocol.Encrypt
 		case handshakeDoneFrameType:
 			frame = &HandshakeDoneFrame{}
 		case 0x30, 0x31:
-			if p.supportsDatagrams {
-				frame, l, err = parseDatagramFrame(b, typ, v)
-				break
+			if !p.supportsDatagrams {
+				return nil, 0, errUnknownFrameType
 			}
-			fallthrough
+			frame, l, err = parseDatagramFrame(b, typ, v)
+		case resetStreamAtFrameType:
+			if !p.supportsResetStreamAt {
+				return nil, 0, errUnknownFrameType
+			}
+			frame, l, err = parseResetStreamFrame(b, true, v)
 		default:
-			err = errors.New("unknown frame type")
+			err = errUnknownFrameType
 		}
 	}
 	if err != nil {
--- a/internal/wire/frame_parser_test.go
+++ b/internal/wire/frame_parser_test.go
@@ -13,7 +13,7 @@ import (
 )

 func TestFrameParsingReturnsNilWhenNothingToRead(t *testing.T) {
-	parser := NewFrameParser(true)
+	parser := NewFrameParser(true, true)
 	l, f, err := parser.ParseNext(nil, protocol.Encryption1RTT, protocol.Version1)
 	require.NoError(t, err)
 	require.Zero(t, l)
@@ -21,7 +21,7 @@ func TestFrameParsingReturnsNilWhenNothingToRead(t *testing.T) {
 }

 func TestFrameParsingSkipsPaddingFrames(t *testing.T) {
-	parser := NewFrameParser(true)
+	parser := NewFrameParser(true, true)
 	b := []byte{0, 0} // 2 PADDING frames
 	b, err := (&PingFrame{}).Append(b, protocol.Version1)
 	require.NoError(t, err)
@@ -32,7 +32,7 @@ func TestFrameParsingSkipsPaddingFrames(t *testing.T) {
 }

 func TestFrameParsingHandlesPaddingAtEnd(t *testing.T) {
-	parser := NewFrameParser(true)
+	parser := NewFrameParser(true, true)
 	l, f, err := parser.ParseNext([]byte{0, 0, 0}, protocol.Encryption1RTT, protocol.Version1)
 	require.NoError(t, err)
 	require.Nil(t, f)
@@ -40,9 +40,9 @@ func TestFrameParsingHandlesPaddingAtEnd(t *testing.T) {
 }

 func TestFrameParsingParsesSingleFrame(t *testing.T) {
-	parser := NewFrameParser(true)
+	parser := NewFrameParser(true, true)
 	var b []byte
-	for i := 0; i < 10; i++ {
+	for range 10 {
 		var err error
 		b, err = (&PingFrame{}).Append(b, protocol.Version1)
 		require.NoError(t, err)
@@ -53,8 +53,8 @@ func TestFrameParsingParsesSingleFrame(t *testing.T) {
 	require.Equal(t, 1, l)
 }

-func TestFrameParsingUnpacksAckFrames(t *testing.T) {
-	parser := NewFrameParser(true)
+func TestFrameParserACK(t *testing.T) {
+	parser := NewFrameParser(true, true)
 	f := &AckFrame{AckRanges: []AckRange{{Smallest: 1, Largest: 0x13}}}
 	b, err := f.Append(nil, protocol.Version1)
 	require.NoError(t, err)
@@ -66,22 +66,17 @@ func TestFrameParsingUnpacksAckFrames(t *testing.T) {
 	require.Equal(t, len(b), l)
 }

-func TestFrameParsingUsesCustomAckDelayExponentFor1RTTPackets(t *testing.T) {
-	parser := NewFrameParser(true)
-	parser.SetAckDelayExponent(protocol.AckDelayExponent + 2)
-	f := &AckFrame{
-		AckRanges: []AckRange{{Smallest: 1, Largest: 1}},
-		DelayTime: time.Second,
-	}
-	b, err := f.Append(nil, protocol.Version1)
-	require.NoError(t, err)
-	_, frame, err := parser.ParseNext(b, protocol.Encryption1RTT, protocol.Version1)
-	require.NoError(t, err)
-	require.Equal(t, 4*time.Second, frame.(*AckFrame).DelayTime)
+func TestFrameParserAckDelay(t *testing.T) {
+	t.Run("1-RTT", func(t *testing.T) {
+		testFrameParserAckDelay(t, protocol.Encryption1RTT)
+	})
+	t.Run("Handshake", func(t *testing.T) {
+		testFrameParserAckDelay(t, protocol.EncryptionHandshake)
+	})
 }

-func TestFrameParsingUsesDefaultAckDelayExponentForNon1RTTPackets(t *testing.T) {
-	parser := NewFrameParser(true)
+func testFrameParserAckDelay(t *testing.T, encLevel protocol.EncryptionLevel) {
+	parser := NewFrameParser(true, true)
 	parser.SetAckDelayExponent(protocol.AckDelayExponent + 2)
 	f := &AckFrame{
 		AckRanges: []AckRange{{Smallest: 1, Largest: 1}},
@@ -89,66 +84,17 @@ func TestFrameParsingUsesDefaultAckDelayExponentForNon1RTTPackets(t *testing.T)
 	}
 	b, err := f.Append(nil, protocol.Version1)
 	require.NoError(t, err)
-	_, frame, err := parser.ParseNext(b, protocol.EncryptionHandshake, protocol.Version1)
+	_, frame, err := parser.ParseNext(b, encLevel, protocol.Version1)
 	require.NoError(t, err)
+	if encLevel == protocol.Encryption1RTT {
+		require.Equal(t, 4*time.Second, frame.(*AckFrame).DelayTime)
+	} else {
 		require.Equal(t, time.Second, frame.(*AckFrame).DelayTime)
 	}
-
-func TestFrameParsingUnpacksResetStreamFrames(t *testing.T) {
-	parser := NewFrameParser(true)
-	f := &ResetStreamFrame{
-		StreamID:  0xdeadbeef,
-		FinalSize: 0xdecafbad1234,
-		ErrorCode: 0x1337,
-	}
-	b, err := f.Append(nil, protocol.Version1)
-	require.NoError(t, err)
-	l, frame, err := parser.ParseNext(b, protocol.Encryption1RTT, protocol.Version1)
-	require.NoError(t, err)
-	require.Equal(t, f, frame)
-	require.Equal(t, len(b), l)
 }

-func TestFrameParsingUnpacksStopSendingFrames(t *testing.T) {
-	parser := NewFrameParser(true)
-	f := &StopSendingFrame{StreamID: 0x42}
-	b, err := f.Append(nil, protocol.Version1)
-	require.NoError(t, err)
-	l, frame, err := parser.ParseNext(b, protocol.Encryption1RTT, protocol.Version1)
-	require.NoError(t, err)
-	require.Equal(t, f, frame)
-	require.Equal(t, len(b), l)
-}
-
-func TestFrameParsingUnpacksCryptoFrames(t *testing.T) {
-	parser := NewFrameParser(true)
-	f := &CryptoFrame{
-		Offset: 0x1337,
-		Data:   []byte("lorem ipsum"),
-	}
-	b, err := f.Append(nil, protocol.Version1)
-	require.NoError(t, err)
-	l, frame, err := parser.ParseNext(b, protocol.Encryption1RTT, protocol.Version1)
-	require.NoError(t, err)
-	require.NotNil(t, frame)
-	require.Equal(t, f, frame)
-	require.Equal(t, len(b), l)
-}
-
-func TestFrameParsingUnpacksNewTokenFrames(t *testing.T) {
-	parser := NewFrameParser(true)
-	f := &NewTokenFrame{Token: []byte("foobar")}
-	b, err := f.Append(nil, protocol.Version1)
-	require.NoError(t, err)
-	l, frame, err := parser.ParseNext(b, protocol.Encryption1RTT, protocol.Version1)
-	require.NoError(t, err)
-	require.NotNil(t, frame)
-	require.Equal(t, f, frame)
-	require.Equal(t, len(b), l)
-}
-
-func TestFrameParsingUnpacksStreamFrames(t *testing.T) {
-	parser := NewFrameParser(true)
+func TestFrameParserStreamFrames(t *testing.T) {
+	parser := NewFrameParser(true, true)
 	f := &StreamFrame{
 		StreamID: 0x42,
 		Offset:   0x1337,
@@ -164,199 +110,142 @@ func TestFrameParsingUnpacksStreamFrames(t *testing.T) {
 	require.Equal(t, len(b), l)
 }

-func TestFrameParsingUnpacksMaxDataFrames(t *testing.T) {
-	parser := NewFrameParser(true)
-	f := &MaxDataFrame{MaximumData: 0xcafe}
-	b, err := f.Append(nil, protocol.Version1)
-	require.NoError(t, err)
-	l, frame, err := parser.ParseNext(b, protocol.Encryption1RTT, protocol.Version1)
-	require.NoError(t, err)
-	require.Equal(t, f, frame)
-	require.Equal(t, len(b), l)
-}
-
-func TestFrameParsingUnpacksMaxStreamDataFrames(t *testing.T) {
-	parser := NewFrameParser(true)
-	f := &MaxStreamDataFrame{
+func TestFrameParserFrames(t *testing.T) {
+	tests := []struct {
+		name  string
+		frame Frame
+	}{
+		{
+			name:  "MAX_DATA",
+			frame: &MaxDataFrame{MaximumData: 0xcafe},
+		},
+		{
+			name:  "MAX_STREAM_DATA",
+			frame: &MaxStreamDataFrame{StreamID: 0xdeadbeef, MaximumStreamData: 0xdecafbad},
+		},
+		{
+			name: "RESET_STREAM",
+			frame: &ResetStreamFrame{
 				StreamID:  0xdeadbeef,
-		MaximumStreamData: 0xdecafbad,
-	}
-	b, err := f.Append(nil, protocol.Version1)
-	require.NoError(t, err)
-	l, frame, err := parser.ParseNext(b, protocol.Encryption1RTT, protocol.Version1)
-	require.NoError(t, err)
-	require.Equal(t, f, frame)
-	require.Equal(t, len(b), l)
-}
-
-func TestFrameParsingUnpacksMaxStreamsFrames(t *testing.T) {
-	parser := NewFrameParser(true)
-	f := &MaxStreamsFrame{
-		Type:         protocol.StreamTypeBidi,
-		MaxStreamNum: 0x1337,
-	}
-	b, err := f.Append(nil, protocol.Version1)
-	require.NoError(t, err)
-	l, frame, err := parser.ParseNext(b, protocol.Encryption1RTT, protocol.Version1)
-	require.NoError(t, err)
-	require.Equal(t, f, frame)
-	require.Equal(t, len(b), l)
-}
-
-func TestFrameParsingUnpacksDataBlockedFrames(t *testing.T) {
-	parser := NewFrameParser(true)
-	f := &DataBlockedFrame{MaximumData: 0x1234}
-	b, err := f.Append(nil, protocol.Version1)
-	require.NoError(t, err)
-	l, frame, err := parser.ParseNext(b, protocol.Encryption1RTT, protocol.Version1)
-	require.NoError(t, err)
-	require.Equal(t, f, frame)
-	require.Equal(t, len(b), l)
-}
-
-func TestFrameParsingUnpacksStreamDataBlockedFrames(t *testing.T) {
-	parser := NewFrameParser(true)
-	f := &StreamDataBlockedFrame{
-		StreamID:          0xdeadbeef,
-		MaximumStreamData: 0xdead,
-	}
-	b, err := f.Append(nil, protocol.Version1)
-	require.NoError(t, err)
-	l, frame, err := parser.ParseNext(b, protocol.Encryption1RTT, protocol.Version1)
-	require.NoError(t, err)
-	require.Equal(t, f, frame)
-	require.Equal(t, len(b), l)
-}
-
-func TestFrameParsingUnpacksStreamsBlockedFrames(t *testing.T) {
-	parser := NewFrameParser(true)
-	f := &StreamsBlockedFrame{
-		Type:        protocol.StreamTypeBidi,
-		StreamLimit: 0x1234567,
-	}
-	b, err := f.Append(nil, protocol.Version1)
-	require.NoError(t, err)
-	l, frame, err := parser.ParseNext(b, protocol.Encryption1RTT, protocol.Version1)
-	require.NoError(t, err)
-	require.Equal(t, f, frame)
-	require.Equal(t, len(b), l)
-}
-
-func TestFrameParsingUnpacksNewConnectionIDFrames(t *testing.T) {
-	parser := NewFrameParser(true)
-	f := &NewConnectionIDFrame{
+				FinalSize: 0xdecafbad1234,
+				ErrorCode: 0x1337,
+			},
+		},
+		{
+			name:  "STOP_SENDING",
+			frame: &StopSendingFrame{StreamID: 0x42},
+		},
+		{
+			name:  "CRYPTO",
+			frame: &CryptoFrame{Offset: 0x1337, Data: []byte("lorem ipsum")},
+		},
+		{
+			name:  "NEW_TOKEN",
+			frame: &NewTokenFrame{Token: []byte("foobar")},
+		},
+		{
+			name:  "MAX_STREAMS",
+			frame: &MaxStreamsFrame{Type: protocol.StreamTypeBidi, MaxStreamNum: 0x1337},
+		},
+		{
+			name:  "DATA_BLOCKED",
+			frame: &DataBlockedFrame{MaximumData: 0x1234},
+		},
+		{
+			name:  "STREAM_DATA_BLOCKED",
+			frame: &StreamDataBlockedFrame{StreamID: 0xdeadbeef, MaximumStreamData: 0xdead},
+		},
+		{
+			name:  "STREAMS_BLOCKED",
+			frame: &StreamsBlockedFrame{Type: protocol.StreamTypeBidi, StreamLimit: 0x1234567},
+		},
+		{
+			name: "NEW_CONNECTION_ID",
+			frame: &NewConnectionIDFrame{
 				SequenceNumber:      0x1337,
 				ConnectionID:        protocol.ParseConnectionID([]byte{0xde, 0xad, 0xbe, 0xef}),
 				StatelessResetToken: protocol.StatelessResetToken{0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15},
+			},
+		},
+		{
+			name:  "RETIRE_CONNECTION_ID",
+			frame: &RetireConnectionIDFrame{SequenceNumber: 0x1337},
+		},
+		{
+			name:  "PATH_CHALLENGE",
+			frame: &PathChallengeFrame{Data: [8]byte{1, 2, 3, 4, 5, 6, 7, 8}},
+		},
+		{
+			name:  "PATH_RESPONSE",
+			frame: &PathResponseFrame{Data: [8]byte{1, 2, 3, 4, 5, 6, 7, 8}},
+		},
+		{
+			name:  "CONNECTION_CLOSE",
+			frame: &ConnectionCloseFrame{IsApplicationError: true, ReasonPhrase: "foobar"},
+		},
+		{
+			name:  "HANDSHAKE_DONE",
+			frame: &HandshakeDoneFrame{},
+		},
+		{
+			name:  "DATAGRAM",
+			frame: &DatagramFrame{Data: []byte("foobar")},
+		},
+		{
+			name:  "RESET_STREAM_AT",
+			frame: &ResetStreamFrame{StreamID: 0x1337, ReliableSize: 0x42, FinalSize: 0xdeadbeef},
+		},
 	}
-	b, err := f.Append(nil, protocol.Version1)
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			parser := NewFrameParser(true, true)
+			b, err := test.frame.Append(nil, protocol.Version1)
 			require.NoError(t, err)
 			l, frame, err := parser.ParseNext(b, protocol.Encryption1RTT, protocol.Version1)
 			require.NoError(t, err)
-	require.Equal(t, f, frame)
+			require.Equal(t, test.frame, frame)
 			require.Equal(t, len(b), l)
+		})
+	}
 }

-func TestFrameParsingUnpacksRetireConnectionIDFrames(t *testing.T) {
-	parser := NewFrameParser(true)
-	f := &RetireConnectionIDFrame{SequenceNumber: 0x1337}
-	b, err := f.Append(nil, protocol.Version1)
-	require.NoError(t, err)
-	l, frame, err := parser.ParseNext(b, protocol.Encryption1RTT, protocol.Version1)
-	require.NoError(t, err)
-	require.Equal(t, f, frame)
-	require.Equal(t, len(b), l)
+func checkFrameUnsupported(t *testing.T, err error, expectedFrameType uint64) {
+	t.Helper()
+	require.ErrorContains(t, err, errUnknownFrameType.Error())
+	var transportErr *qerr.TransportError
+	require.ErrorAs(t, err, &transportErr)
+	require.Equal(t, qerr.FrameEncodingError, transportErr.ErrorCode)
+	require.Equal(t, expectedFrameType, transportErr.FrameType)
+	require.Equal(t, "unknown frame type", transportErr.ErrorMessage)
 }

-func TestFrameParsingUnpacksPathChallengeFrames(t *testing.T) {
-	parser := NewFrameParser(true)
-	f := &PathChallengeFrame{Data: [8]byte{1, 2, 3, 4, 5, 6, 7, 8}}
-	b, err := f.Append(nil, protocol.Version1)
-	require.NoError(t, err)
-	l, frame, err := parser.ParseNext(b, protocol.Encryption1RTT, protocol.Version1)
-	require.NoError(t, err)
-	require.NotNil(t, frame)
-	require.IsType(t, &PathChallengeFrame{}, frame)
-	require.Equal(t, [8]byte{1, 2, 3, 4, 5, 6, 7, 8}, frame.(*PathChallengeFrame).Data)
-	require.Equal(t, len(b), l)
-}
-
-func TestFrameParsingUnpacksPathResponseFrames(t *testing.T) {
-	parser := NewFrameParser(true)
-	f := &PathResponseFrame{Data: [8]byte{1, 2, 3, 4, 5, 6, 7, 8}}
-	b, err := f.Append(nil, protocol.Version1)
-	require.NoError(t, err)
-	l, frame, err := parser.ParseNext(b, protocol.Encryption1RTT, protocol.Version1)
-	require.NoError(t, err)
-	require.NotNil(t, frame)
-	require.IsType(t, &PathResponseFrame{}, frame)
-	require.Equal(t, [8]byte{1, 2, 3, 4, 5, 6, 7, 8}, frame.(*PathResponseFrame).Data)
-	require.Equal(t, len(b), l)
-}
-
-func TestFrameParsingUnpacksConnectionCloseFrames(t *testing.T) {
-	parser := NewFrameParser(true)
-	f := &ConnectionCloseFrame{
-		IsApplicationError: true,
-		ReasonPhrase:       "foobar",
-	}
-	b, err := f.Append(nil, protocol.Version1)
-	require.NoError(t, err)
-	l, frame, err := parser.ParseNext(b, protocol.Encryption1RTT, protocol.Version1)
-	require.NoError(t, err)
-	require.Equal(t, f, frame)
-	require.Equal(t, len(b), l)
-}
-
-func TestFrameParsingUnpacksHandshakeDoneFrames(t *testing.T) {
-	parser := NewFrameParser(true)
-	f := &HandshakeDoneFrame{}
-	b, err := f.Append(nil, protocol.Version1)
-	require.NoError(t, err)
-	l, frame, err := parser.ParseNext(b, protocol.Encryption1RTT, protocol.Version1)
-	require.NoError(t, err)
-	require.Equal(t, f, frame)
-	require.Equal(t, len(b), l)
-}
-
-func TestFrameParsingUnpacksDatagramFrames(t *testing.T) {
-	parser := NewFrameParser(true)
-	f := &DatagramFrame{Data: []byte("foobar")}
-	b, err := f.Append(nil, protocol.Version1)
-	require.NoError(t, err)
-	l, frame, err := parser.ParseNext(b, protocol.Encryption1RTT, protocol.Version1)
-	require.NoError(t, err)
-	require.Equal(t, f, frame)
-	require.Equal(t, len(b), l)
-}
-
-func TestFrameParsingErrorsWhenDatagramFramesAreNotSupported(t *testing.T) {
-	parser := NewFrameParser(false)
+func TestFrameParserDatagramUnsupported(t *testing.T) {
+	parser := NewFrameParser(false, true)
 	f := &DatagramFrame{Data: []byte("foobar")}
 	b, err := f.Append(nil, protocol.Version1)
 	require.NoError(t, err)
 	_, _, err = parser.ParseNext(b, protocol.Encryption1RTT, protocol.Version1)
-	require.Error(t, err)
-	var transportErr *qerr.TransportError
-	require.ErrorAs(t, err, &transportErr)
-	require.Equal(t, qerr.FrameEncodingError, transportErr.ErrorCode)
-	require.Equal(t, uint64(0x30), transportErr.FrameType)
-	require.Equal(t, "unknown frame type", transportErr.ErrorMessage)
+	checkFrameUnsupported(t, err, 0x30)
 }

-func TestFrameParsingErrorsOnInvalidType(t *testing.T) {
-	parser := NewFrameParser(true)
+func TestFrameParserResetStreamAtUnsupported(t *testing.T) {
+	parser := NewFrameParser(true, false)
+	f := &ResetStreamFrame{StreamID: 0x1337, ReliableSize: 0x42, FinalSize: 0xdeadbeef}
+	b, err := f.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	_, _, err = parser.ParseNext(b, protocol.Encryption1RTT, protocol.Version1)
+	checkFrameUnsupported(t, err, 0x24)
+}
+
+func TestFrameParserInvalidFrameType(t *testing.T) {
+	parser := NewFrameParser(true, true)
 	_, _, err := parser.ParseNext(encodeVarInt(0x42), protocol.Encryption1RTT, protocol.Version1)
-	require.Error(t, err)
-	var transportErr *qerr.TransportError
-	require.ErrorAs(t, err, &transportErr)
-	require.Equal(t, qerr.FrameEncodingError, transportErr.ErrorCode)
-	require.Equal(t, uint64(0x42), transportErr.FrameType)
-	require.Equal(t, "unknown frame type", transportErr.ErrorMessage)
+	checkFrameUnsupported(t, err, 0x42)
 }

 func TestFrameParsingErrorsOnInvalidFrames(t *testing.T) {
-	parser := NewFrameParser(true)
+	parser := NewFrameParser(true, true)
 	f := &MaxStreamDataFrame{
 		StreamID:          0x1337,
 		MaximumStreamData: 0xdeadbeef,
@@ -399,7 +288,7 @@ func BenchmarkParseStreamAndACK(b *testing.B) {
 		b.Fatal(err)
 	}

-	parser := NewFrameParser(false)
+	parser := NewFrameParser(false, false)
 	parser.SetAckDelayExponent(3)

 	b.ResetTimer()
@@ -457,7 +346,7 @@ func BenchmarkParseOtherFrames(b *testing.B) {
 		}
 	}

-	parser := NewFrameParser(false)
+	parser := NewFrameParser(false, false)

 	b.ResetTimer()
 	b.ReportAllocs()
--- a/internal/wire/reset_stream_frame.go
+++ b/internal/wire/reset_stream_frame.go
@@ -1,55 +1,79 @@
 package wire

 import (
+	"fmt"
+
 	"github.com/quic-go/quic-go/internal/protocol"
 	"github.com/quic-go/quic-go/internal/qerr"
 	"github.com/quic-go/quic-go/quicvarint"
 )

-// A ResetStreamFrame is a RESET_STREAM frame in QUIC
+// A ResetStreamFrame is a RESET_STREAM or RESET_STREAM_AT frame in QUIC
 type ResetStreamFrame struct {
 	StreamID     protocol.StreamID
 	ErrorCode    qerr.StreamErrorCode
 	FinalSize    protocol.ByteCount
+	ReliableSize protocol.ByteCount
 }

-func parseResetStreamFrame(b []byte, _ protocol.Version) (*ResetStreamFrame, int, error) {
+func parseResetStreamFrame(b []byte, isResetStreamAt bool, _ protocol.Version) (*ResetStreamFrame, int, error) {
 	startLen := len(b)
-	var streamID protocol.StreamID
-	var byteOffset protocol.ByteCount
-	sid, l, err := quicvarint.Parse(b)
+	streamID, l, err := quicvarint.Parse(b)
 	if err != nil {
 		return nil, 0, replaceUnexpectedEOF(err)
 	}
 	b = b[l:]
-	streamID = protocol.StreamID(sid)
 	errorCode, l, err := quicvarint.Parse(b)
 	if err != nil {
 		return nil, 0, replaceUnexpectedEOF(err)
 	}
 	b = b[l:]
-	bo, l, err := quicvarint.Parse(b)
+	finalSize, l, err := quicvarint.Parse(b)
 	if err != nil {
 		return nil, 0, replaceUnexpectedEOF(err)
 	}
-	byteOffset = protocol.ByteCount(bo)
+	b = b[l:]
+
+	var reliableSize uint64
+	if isResetStreamAt {
+		reliableSize, l, err = quicvarint.Parse(b)
+		if err != nil {
+			return nil, 0, replaceUnexpectedEOF(err)
+		}
+		b = b[l:]
+	}
+	if reliableSize > finalSize {
+		return nil, 0, fmt.Errorf("RESET_STREAM_AT: reliable size can't be larger than final size (%d vs %d)", reliableSize, finalSize)
+	}

 	return &ResetStreamFrame{
-		StreamID:  streamID,
+		StreamID:     protocol.StreamID(streamID),
 		ErrorCode:    qerr.StreamErrorCode(errorCode),
-		FinalSize: byteOffset,
-	}, startLen - len(b) + l, nil
+		FinalSize:    protocol.ByteCount(finalSize),
+		ReliableSize: protocol.ByteCount(reliableSize),
+	}, startLen - len(b), nil
 }

 func (f *ResetStreamFrame) Append(b []byte, _ protocol.Version) ([]byte, error) {
-	b = append(b, resetStreamFrameType)
+	if f.ReliableSize == 0 {
+		b = quicvarint.Append(b, resetStreamFrameType)
+	} else {
+		b = quicvarint.Append(b, resetStreamAtFrameType)
+	}
 	b = quicvarint.Append(b, uint64(f.StreamID))
 	b = quicvarint.Append(b, uint64(f.ErrorCode))
 	b = quicvarint.Append(b, uint64(f.FinalSize))
+	if f.ReliableSize > 0 {
+		b = quicvarint.Append(b, uint64(f.ReliableSize))
+	}
 	return b, nil
 }

 // Length of a written frame
 func (f *ResetStreamFrame) Length(protocol.Version) protocol.ByteCount {
-	return 1 + protocol.ByteCount(quicvarint.Len(uint64(f.StreamID))+quicvarint.Len(uint64(f.ErrorCode))+quicvarint.Len(uint64(f.FinalSize)))
+	size := 1 // the frame type for both RESET_STREAM and RESET_STREAM_AT fits into 1 byte
+	if f.ReliableSize > 0 {
+		size += quicvarint.Len(uint64(f.ReliableSize))
+	}
+	return protocol.ByteCount(size + quicvarint.Len(uint64(f.StreamID)) + quicvarint.Len(uint64(f.ErrorCode)) + quicvarint.Len(uint64(f.FinalSize)))
 }
--- a/internal/wire/reset_stream_frame_test.go
+++ b/internal/wire/reset_stream_frame_test.go
@@ -13,7 +13,7 @@ func TestParseResetStream(t *testing.T) {
 	data := encodeVarInt(0xdeadbeef)                  // stream ID
 	data = append(data, encodeVarInt(0x1337)...)      // error code
 	data = append(data, encodeVarInt(0x987654321)...) // byte offset
-	frame, l, err := parseResetStreamFrame(data, protocol.Version1)
+	frame, l, err := parseResetStreamFrame(data, false, protocol.Version1)
 	require.NoError(t, err)
 	require.Equal(t, protocol.StreamID(0xdeadbeef), frame.StreamID)
 	require.Equal(t, protocol.ByteCount(0x987654321), frame.FinalSize)
@@ -21,15 +21,50 @@ func TestParseResetStream(t *testing.T) {
 	require.Equal(t, len(data), l)
 }

+func TestParseResetStreamAt(t *testing.T) {
+	data := encodeVarInt(0xabcdef12)                  // stream ID
+	data = append(data, encodeVarInt(0x2468)...)      // error code
+	data = append(data, encodeVarInt(0x123456789)...) // byte offset
+	data = append(data, encodeVarInt(0x789abc)...)    // reliable size
+	frame, l, err := parseResetStreamFrame(data, true, protocol.Version1)
+	require.NoError(t, err)
+	require.Equal(t, protocol.StreamID(0xabcdef12), frame.StreamID)
+	require.Equal(t, protocol.ByteCount(0x123456789), frame.FinalSize)
+	require.Equal(t, qerr.StreamErrorCode(0x2468), frame.ErrorCode)
+	require.Equal(t, protocol.ByteCount(0x789abc), frame.ReliableSize)
+	require.Equal(t, len(data), l)
+}
+
+func TestParseResetStreamAtSizeTooLarge(t *testing.T) {
+	data := encodeVarInt(0xabcdef12)             // stream ID
+	data = append(data, encodeVarInt(0x2468)...) // error code
+	data = append(data, encodeVarInt(1000)...)   // byte offset
+	data = append(data, encodeVarInt(1001)...)   // reliable size
+	_, _, err := parseResetStreamFrame(data, true, protocol.Version1)
+	require.EqualError(t, err, "RESET_STREAM_AT: reliable size can't be larger than final size (1001 vs 1000)")
+}
+
 func TestParseResetStreamErrorsOnEOFs(t *testing.T) {
+	t.Run("RESET_STREAM", func(t *testing.T) {
+		testParseResetStreamErrorsOnEOFs(t, false)
+	})
+	t.Run("RESET_STREAM_AT", func(t *testing.T) {
+		testParseResetStreamErrorsOnEOFs(t, true)
+	})
+}
+
+func testParseResetStreamErrorsOnEOFs(t *testing.T, isResetStreamAt bool) {
 	data := encodeVarInt(0xdeadbeef)                  // stream ID
 	data = append(data, encodeVarInt(0x1337)...)      // error code
 	data = append(data, encodeVarInt(0x987654321)...) // byte offset
-	_, l, err := parseResetStreamFrame(data, protocol.Version1)
+	if isResetStreamAt {
+		data = append(data, encodeVarInt(0x123456)...) // reliable size
+	}
+	_, l, err := parseResetStreamFrame(data, isResetStreamAt, protocol.Version1)
 	require.NoError(t, err)
 	require.Equal(t, len(data), l)
 	for i := range data {
-		_, _, err := parseResetStreamFrame(data[:i], protocol.Version1)
+		_, _, err := parseResetStreamFrame(data[:i], isResetStreamAt, protocol.Version1)
 		require.Error(t, err)
 	}
 }
@@ -49,3 +84,21 @@ func TestWriteResetStream(t *testing.T) {
 	require.Equal(t, expected, b)
 	require.Len(t, b, int(frame.Length(protocol.Version1)))
 }
+
+func TestWriteResetStreamAt(t *testing.T) {
+	frame := ResetStreamFrame{
+		StreamID:     1337,
+		FinalSize:    42,
+		ErrorCode:    0xcafe,
+		ReliableSize: 12,
+	}
+	b, err := frame.Append(nil, protocol.Version1)
+	require.NoError(t, err)
+	expected := []byte{resetStreamAtFrameType}
+	expected = append(expected, encodeVarInt(1337)...)
+	expected = append(expected, encodeVarInt(0xcafe)...)
+	expected = append(expected, encodeVarInt(42)...)
+	expected = append(expected, encodeVarInt(12)...)
+	require.Equal(t, expected, b)
+	require.Len(t, b, int(frame.Length(protocol.Version1)))
+}
--- a/packet_packer_test.go
+++ b/packet_packer_test.go
@@ -735,7 +735,7 @@ func TestPackLongHeaderPadToAtLeast4Bytes(t *testing.T) {
 	// first bytes should be 2 PADDING frames...
 	require.Equal(t, []byte{0, 0}, data[:2])
 	// ...followed by the PING frame
-	frameParser := wire.NewFrameParser(false)
+	frameParser := wire.NewFrameParser(false, false)
 	l, frame, err := frameParser.ParseNext(data[2:], protocol.EncryptionHandshake, protocol.Version1)
 	require.NoError(t, err)
 	require.IsType(t, &wire.PingFrame{}, frame)
@@ -773,7 +773,7 @@ func TestPackShortHeaderPadToAtLeast4Bytes(t *testing.T) {
 	require.Equal(t, byte(0), payload[0])

 	// ... followed by the STREAM frame
-	frameParser := wire.NewFrameParser(true)
+	frameParser := wire.NewFrameParser(false, false)
 	frameLen, frame, err := frameParser.ParseNext(payload[1:], protocol.Encryption1RTT, protocol.Version1)
 	require.NoError(t, err)
 	require.Equal(t, f, frame)