Add an SNI action to reject QUIC connections - #9348
Conversation
14963e2 to
a3a8ae4
Compare
|
[approve ci] |
|
Some of build issues are actually because of ATS's native QUIC implementation, which we don't maintain. #9670 should resolve those. |
|
[approve ci] |
1 similar comment
|
[approve ci] |
|
[approve ci centos] |
| An established TLS connection may be reused for another server name if it’s used for HTTP/2. This also means that settings | ||
| for server name A may affects requests for server name B as well. See https://daniel.haxx.se/blog/2016/08/18/http2-connection-coalescing/ | ||
| for a more detailed description of HTTP/2 connection coalescing. | ||
| for a more detailed description of HTTP/2 connection coalescing. Similar thing can happen on a QUIC connection for HTTP/3 as welll. |
|
[approve ci autest] |
|
Rocky CI job fails due to a link error for test_UDPNet: https://gist.github.com/ywkaras/59747baa5a9ede1b97ec9bac3b4b9d3e |
7d15f3f to
72058c7
Compare
|
[approve ci Fedora] |
|
[approve ci fedora] |
|
[approve ci] |
bneradt
left a comment
bneradt
left a comment
There was a problem hiding this comment.
Looks good. Just a few word smithing suggestions.
| :code:`off`. Note that this is an additional setting to configure QUIC availability per server | ||
| name. You need to configure :ts:cv:`proxy.config.http.server_ports` to open ports for QUIC. |
There was a problem hiding this comment.
I suggest:
Note that this is a more specific setting to configure QUIC availability per server
name. More broadly, you will also need to configure :ts:cv:`proxy.config.http.server_ports`
to open ports for QUIC.
|
@bneradt did you mean to continue block this? I'm OOO till the 22nd at least so don't wait for me. |
Thanks for checking. My comments aren't addressed yet, so the block still makes sense. |
|
@bneradt I've already updated the texts as you suggested. Did I miss something? |
5 participants
Adds
quicSNI action to on/off QUIC availability per server name.This depends on #9347.