quic http/3 limited-quic version 2.9.7 about haproxy

[xkid1]

hello valentine,

Yes, Permission error on QUIC socket binding for proxy all. Consider using setcap cap_net_bind_service (Linux only) or running as root. But I already fixed.

sudo setcap cap_net_bind_service=+ep /path/to/haproxy
sudo systemctl restart haproxy

then from iptables i open the port 443 from udp

[vkssv]

Hi Elmer !

Thanks for reporting this !

Do you see some errors in haproxy logs ?
With which client do you check QUIC connection establishment ?
Many clients as curl and h2load does not support QUIC out of the box, thus needed to be recompiled with explicit settings for this.
Could you please try to do your test without strict-sni settings in your bind lines, please ?

I've just done a quick test with HAProxy version 2.9.7 from haproxy_2.9.7-1ppa1~jammy_amd64.deb + h2load and config settings below: H2 and QUIC protocol support works as expected:

global
 ...
 limited-quic
 ...
listen test2
  mode http
  ....
  bind quic4@:443 name quic ssl crt /etc/ssl/frontend/combined.pem alpn h3
  bind *:443 name https ssl crt /etc/ssl/frontend/combined.pem alpn h2
  ...

haproxy@lg31:/home/haproxy$ h2load/h2load https://198.19.0.33:443/?s=4M -t 1 -c 1 -m 1 --npn-list=h3 -n 1
starting benchmark...
spawning thread #0: 1 total client(s). 1 total requests
TLS Protocol: TLSv1.3
Cipher: TLS_AES_256_GCM_SHA384
Server Temp Key: X25519 253 bits
Application protocol: h3
progress: 100% done

finished in 28.01ms, 35.70 req/s, 142.94MB/s
requests: 1 total, 1 started, 1 done, 1 succeeded, 0 failed, 0 errored, 0 timeout
status codes: 1 2xx, 0 3xx, 0 4xx, 0 5xx
traffic: 4.00MB (4198191) total, 120B (120) headers (space savings 0.00%), 4.00MB (4194304) data
UDP datagram: 222 sent, 3675 received
min max mean sd +/- sd
time for request: 22.56ms 22.56ms 22.56ms 0us 100.00%
time for connect: 5.23ms 5.23ms 5.23ms 0us 100.00%
time to 1st byte: 7.49ms 7.49ms 7.49ms 0us 100.00%
req/s : 35.91 35.91 35.91 0.00 100.00%

haproxy@lg31:/home/haproxy$ h2load/h2load https://198.19.0.33:443/?s=4M -t 1 -c 1 -m 1 --npn-list=h2 -n 1
starting benchmark...
spawning thread #0: 1 total client(s). 1 total requests
TLS Protocol: TLSv1.3
Cipher: TLS_AES_256_GCM_SHA384
Server Temp Key: X25519 253 bits
Application protocol: h2
progress: 100% done

finished in 26.49ms, 37.75 req/s, 151.14MB/s
requests: 1 total, 1 started, 1 done, 1 succeeded, 0 failed, 0 errored, 0 timeout
status codes: 1 2xx, 0 3xx, 0 4xx, 0 5xx
traffic: 4.00MB (4197613) total, 105B (105) headers (space savings 12.50%), 4.00MB (4194304) data
min max mean sd +/- sd
time for request: 21.54ms 21.54ms 21.54ms 0us 100.00%
time for connect: 4.72ms 4.72ms 4.72ms 0us 100.00%
time to 1st byte: 6.54ms 6.54ms 6.54ms 0us 100.00%
req/s : 38.00 38.00 38.00 0.00 100.00%

Many thanks in advance,
Kind regards,