HTTP/3 still experimental?

[mibere]

The template of example-dnscrypt-proxy.toml contains

## Enable *experimental* support for HTTP/3 (HTTP over QUIC)
## Note that, like DNSCrypt but unlike other HTTP versions, this uses
## UDP and (usually) port 443 instead of TCP.

http3 = false

As far as I could determine, it was added in July 2022.

Is the status of the current implementation still “experimental”?

[jedisct1]

Even though HTTP/3 is still not part of the Go standard library, there hasn't been much complaints about it, and we have code to downgrade to HTTP/2 when UDP is blocked.

So, it's probably fine to remove the HTTP experimental label.

[mibere]

For DNS-over-HTTPS/3 of controld.com you have to set http3_probe = true. With false there is

[INFO] [...] TLS version: 304 - Protocol: h2 - Cipher suite: 4865

in the dnscrypt-proxy log - this is already reported here.

With http3 = true + http3_probe = true I just noticed, does not happen every time:

[INFO] [server1] TLS version: 304 - Protocol: h2 - Cipher suite: 4865
[NOTICE] [server1] OK (DoH) - rtt: 13ms
[INFO] [server2] TLS version: 304 - Protocol: h3 - Cipher suite: 4865
[NOTICE] [server2] OK (DoH) - rtt: 14ms
[INFO] [server3] TLS version: 304 - Protocol: h3 - Cipher suite: 4865
[NOTICE] [server3] OK (DoH) - rtt: 14ms
[INFO] [server4] TLS version: 304 - Protocol: h3 - Cipher suite: 4865
[NOTICE] [server4] OK (DoH) - rtt: 15ms

server2 to server4: h3
server1: h2?!

After a restart of dnscrypt-proxy 2.1.14 the protocol for server1 was h3 again.

Used servers: 76.76.2.22, 76.76.10.22, 2606:1a40::22, 2606:1a40:1::22

[jedisct1]

They should configure their server to send the Alt-Svc: h3=":443" HTTP header.

[mibere]

Dropped them a mail.

As personal workaround there is a new option in my dnscrypt-proxy.toml

# Server must support HTTP/3, HTTP/2 is not accepted.

http3_require = true

with

func fetchDoHServerInfo(...) (ServerInfo, error) {
  ...
  dlog.Infof("[%s] TLS version: %x - Protocol: %v - Cipher suite: %v", name, tls.Version, protocol, tls.CipherSuite)
  if (protocol != "h3" && proxy.xTransport.http3Require) {
    return ServerInfo{}, fmt.Errorf("[%s] does not support HTTP/3", name)
  }
  ...

in serversInfo.go.