mirror of
https://github.com/curl/curl.git
synced 2026-06-02 09:34:16 +03:00
e78b1b3ecc
This patch adds two major proxy capabilities to curl (ngtcp2 QUIC):
- HTTP/3 Proxy CONNECT: Tunnel HTTP/1.1 or HTTP/2 traffic through an
HTTPS proxy that speaks HTTP/3 (QUIC) using the standard CONNECT
method over an HTTP/3 connection.
- MASQUE CONNECT-UDP: Tunnel HTTP/3 (QUIC) traffic through an HTTP
proxy (speaking HTTP/1.1, HTTP/2, or HTTP/3) using the extended
CONNECT method with the CONNECT-UDP protocol (RFC9297 & RFC9298).
Public API additions:
- `CURLPROXY_HTTPS3`: new proxy type constant for HTTP/3 proxy
- `--proxy-http3`: new CLI flag to negotiate HTTP/3 with HTTPS proxy
The implementation adds two new filters:
- `H3-PROXY` - enables negotiating HTTP/3 (QUIC) to the proxy and
running CONNECT/CONNECT-UDP through that proxy transport.
- `CAPSULE` - dedicated filter inserted between QUIC transport and
HTTP-PROXY to handle datagram capsule encapsulation/decapsulation.
Here is how the curl filter chaining looks in different scenarios:
- HTTP/3 Proxy CONNECT (tunneling TCP protocols over QUIC proxy):
conn -> HTTP/1.1 or HTTP/2 -> SSL -> HTTP-PROXY ->
H3-PROXY -> HAPPY-EYEBALLS -> UDP
- MASQUE CONNECT-UDP (tunneling QUIC over any proxy):
conn -> HTTP/3 -> CAPSULE -> HTTP-PROXY -> H3-PROXY ->
HAPPY-EYEBALLS -> UDP
conn -> HTTP/3 -> CAPSULE -> HTTP-PROXY -> H1-PROXY or H2-PROXY ->
SSL -> HAPPY-EYEBALLS -> TCP
- Both features currently require the ngtcp2 QUIC backend.
- Both features are experimental (disabled by default). Enable with
`--enable-proxy-http3`(autotools) or `-DUSE_PROXY_HTTP3=ON`(CMake).
Tests:
- tests/unit/unit3400.c: Unit tests for capsule protocol encode/decode
- tests/http/test_60_h3_proxy.py: Comprehensive pytest integration suite
- tests/http/testenv/h2o.py: Managing h2o instances with HTTP/1.1, HTTP/2,
and HTTP/3 (QUIC) listeners, proxy.connect and proxy.connect-udp enabled.
References:
RFC 9297 - HTTP Datagrams and the Capsule Protocol
RFC 9298 - Proxying UDP in HTTP
RFC 9000 §16 — Variable-Length Integer Encoding
Signed-off-by: Aritra Basu <aritrbas+gh@cisco.com>
Closes #21153
|
||
|---|---|---|
| .. | ||
| certs | ||
| cmake | ||
| data | ||
| http | ||
| libtest | ||
| server | ||
| tunit | ||
| unit | ||
| .gitignore | ||
| allversions.pm | ||
| appveyor.pm | ||
| azure.pm | ||
| CMakeLists.txt | ||
| config.in | ||
| configurehelp.pm.in | ||
| devtest.pl | ||
| dictserver.py | ||
| directories.pm | ||
| ech_combos.py | ||
| ech_tests.sh | ||
| ftpserver.pl | ||
| getpart.pm | ||
| globalconfig.pm | ||
| http-server.pl | ||
| http2-server.pl | ||
| http3-server.pl | ||
| Makefile.am | ||
| memanalyze.pl | ||
| memanalyzer.pm | ||
| negtelnetserver.py | ||
| nghttpx.conf | ||
| pathhelp.pm | ||
| processhelp.pm | ||
| requirements.txt | ||
| rtspserver.pl | ||
| runner.pm | ||
| runtests.pl | ||
| secureserver.pl | ||
| serverhelp.pm | ||
| servers.pm | ||
| smbserver.py | ||
| sshhelp.pm | ||
| sshserver.pl | ||
| test745.pl | ||
| test971.pl | ||
| test1119.pl | ||
| test1135.pl | ||
| test1139.pl | ||
| test1140.pl | ||
| test1165.pl | ||
| test1167.pl | ||
| test1173.pl | ||
| test1175.pl | ||
| test1177.pl | ||
| test1222.pl | ||
| test1275.pl | ||
| test1276.pl | ||
| test1477.pl | ||
| test1486.pl | ||
| test1488.pl | ||
| test1544.pl | ||
| test1707.pl | ||
| testcurl.pl | ||
| testutil.pm | ||
| tftpserver.pl | ||
| util.py | ||
| valgrind.pm | ||
| valgrind.supp | ||