Add support for HTTP/3 (IETF QUIC) ("h3" protocol)

[sfionov]

Add support for HTTP/3 filtering.

[TPS]

@ameshkov Maybe #486?

[sfionov]

@TPS No, IETF QUIC and existing QUIC are different protocols.
IETF QUIC is split to QUIC transport (with modified TLS1.3 handshake) and HTTP over QUIC (hq) based on modified HTTP/2.
Google QUIC is more solid and have different Alt-Svc/ALPN protocol name.

[sfionov]

nghq seems to be abandoned. Current implementations:

HTTP/3 QUIC transport:
https://github.com/ngtcp2/ngtcp2

HTTP/3 application protocol:
https://github.com/cloudflare/quiche (Rust, C bindings exist)
https://github.com/ngtcp2/nghttp3

[DBotThePony]

nginx is getting official support for QUIC: https://quic.nginx.org/

[sfionov]

@BooBerry Can you please send a crash report and say what time report is sent?

About falling back to HTTP/2 - I reproduced it on Facebook and https://cloudflare-quic.com/, thanks.

[BooBerry]

@sfionov Sent a report in, #800123 is the number, Crash happened at 1:09 PM my time, sent in within 2 minutes ago at 1:11 PM my time.

Hopefully that helps. :)

[BooBerry]

Also did some more HTTP/3 testing in Firefox (developer console with the Protocol tab enabled) and it looks like with AG enabled it only uses HTTP/3 for one connection, for the RotateCookies connection. I'm seeing this on https://www.google.com and https://news.google.com at the moment.

Other sites like https://www.twitter.com and https://www.youtube.com and https://outlook.live.com and https://mail.google.com it isn't used at all, whereas without AG (testing with a portable Firefox not filtered by AG but set up exactly the same) I see HTTP/3 being used quite a bit.

Same with https://http3.is where Firefox with AG falls back to HTTP/2 only, and Firefox alone uses HTTP/3.

[sfionov]

@BooBerry A fix is available in Mac version 2.12 beta 1 and Windows version 7.15 nightly 10+ (and will be included into beta 2 soon).

[BooBerry]

For which issue? The crash issue or the HTTP/3 not working on sites in Firefox issue?

[sfionov]

@BooBerry HTTP/3 filtering in Firefox should be fixed.

As of "HTTP/3 for DNS-over-HTTPS", it is known issue that it crashes, it is recommended not to switch on this feature in 7.15 release.

[BooBerry]

Just double checked 7.15 nightly 12 and here's the results.

1. Random AG service crashes still exists when Filter HTTP/3 and Use HTTP/3 for DNS-over-HTTPS are both enabled at the same time. If I disable Use HTTP/3 for DNS-over-HTTPS, no more crashes of the AG service.

2. Just tested Firefox 117.0.1 with it (and a cleared browser cache) and it's still not using HTTP/3 for anything but RotateCookies. I'm going to do a backup of the Firefox profile and first try deleting all cookies then try a clean profile.

[sfionov]

Did you try reloading page twice? Few reloads may be needed to switch to HTTP/3 - after first reload Alt-Svc is cached, and after second it is applied.

[BooBerry]

Yeah, just double checked with a clean profile in Firefox, HTTP/3 isn't being used with AG enabled (and Filter HTTP/3 enabled).

And yes, I reloaded multiple times. It works with AG disabled, of course.

[sfionov]

There was an issue in driver configuration that blocked HTTP/3 from being filtered under Windows. The fix will be included into the next beta.

[BooBerry]

Groovy, I assume it'll be in the next nightly (nightly 17 or newer) too?

[TPS]

Note, that it will not work in Chromium-based browsers until this bug is resolved.

@ameshkov, @sfionov: Just to confirm, the announcement re: this issue @ https://github.com/AdguardTeam/AdguardForAndroid/releases/tag/v4.2-beta-1 really only means Ff-based browsers, correct? Chromium-based are still SOL d/t this bug? Or was there progress somehow, & this issue wasn't updated? I'm still having very similar behavior as @BooBerry detailed previously, so wanted to verify expectations.

[BooBerry]

No, it won't work in Chromium-based browsers right now until Google resolves it, just Firefox (and I think Safari?) right now.

The currently AG for Windows nightly build does work with HTTP/3 in Firefox finally, but as I was expecting it's not any faster than HTTP/2 in my own testing, but it's something. :D

[sfionov]

@TPS MS Edge should work too, it is Chromium-based but have, I believe, another QUIC implementation.

[TPS]

@TPS MS Edge should work too, it is Chromium-based but have, I believe, another QUIC implementation.

@sfionov MSEdge Android is specifically failing. It says it'll accept QUIC on 1st connection (ALPN or 0RTT, IIUC), but all QUIC connections fail in actual use, using test sites as provided above.

Would someone confirm/deny my experience?

[BooBerry]

No-go for Edge here on Windows, unfortunately.

[TPS]

@BooBerry Just to confirm: did you force Enabled the QUIC options under edge://flags? I did so under Android to give it the best chance of success.

[BooBerry]

Of course, I've had the QUIC option force enabled in Edge (and Chrome) the whole time.

[sfionov]

@TPS @BooBerry Tested on my Mac, it doesn't work too. Seems that previous test was incomplete. So it is true, feature is available only on FF and Safari. :(

You may also use --origin-to-force-quic-on=www.google.com:443 Chrome command line option to force quic on your favorite domain in Chrome, but it is not a solution for all sites.

[TPS]

You may also use --origin-to-force-quic-on=www.google.com:443 Chrome command line option to force quic on your favorite domain in Chrome, but it is not a solution for all sites.

@sfionov This causes QUIC to work while on AG? Is this somehow different than the ://flags options as mentioned previously?

[sfionov]

@TPS This option disables certificate verification for that site and forces HTTP/3. So yes, it should work with AG. But if you try to enable it on all sites, every non-HTTP/3 site will be broken.

[szhu25]

I tested http3 using AdGuard for Android beta with Firefox, and it doesn't seem like http3 is working.
Edit:
AdGuard for Windows & Android Beta (with filter http3 toggled) & Firefox release (with http3 enabled) does not use HTTP/3 connection on both http3.is & cloudflare-quic.com.
If I disable AdGuard, both Android and Windows desktop Firefox would use http3 on cloudflare-quic.com and http3.is.

[sfionov]

@jslawler CoreLibs are only used on Android, Mac and Windows.

http3.is is hard to get working even without AdGuard - several reloads are needed, and result is not guaranteed

[sfionov]

@szhu25 There is fix in Adguard for Android 4.2 beta 2 for issue that prevented HTTP/3 in Firefox from being filtered

[szhu25]

@szhu25 There is fix in Adguard for Android 4.2 beta 2 for issue that prevented HTTP/3 in Firefox from being filtered

I can confirm that! HTTP/3 in Firefox is working for both AdGuard for Windows stable & AdGuard for Android beta 2.

Edit: On Firefox Android, http3.is also works consistently.

[Rtizer-9]

@sfionov http3 still not working for me with latest beta in Firefox Android.

[sfionov]

@Rtizer-9 If you use "Automatic proxy mode" then HTTP/3 filtering will not be available. Unfortunately, it only works in default mode right now. UDP filtering in automatic proxy mode requires more work which is not done yet.

[Rtizer-9]

Oh ok. Thanks for clarifying because there isn't any official information regarding this in the kb or anywhere else, even in the recently released latest beta changelog or the http3 config in low level setting itself....no issues...will wait.