add a HTTP3 - QUIC probe

[stanthewizzard]

Hello

I have an issu with sslh.

With this settings:

pidfile:"/var/run/sslh.pid";
user: "nobody";

verbose:0;
numeric:false;
on_timeout:"tls";
listen:
(
    { host: "0.0.0.0"; is_udp: true; port: "443" },
    { host: "0.0.0.0"; port: "443" }
);

protocols:
(
     { name: "openvpn";                 host: "0.0.0.0"; port: "1194"; },
     { name: "tls";                     host: "192.168.0.30"; is_udp: true; port: "443"; regex_patterns: [  "\x51\x30\x35\x30" ]; },
     { name: "tls";                     host: "192.168.0.30"; port: "443"; },
);

Using https://http3check.net/

I got
QUIC connection could not be established

HTTP/1.1 200 OK
Alt-Svc: h3=":443"; ma=2592000
Content-Encoding: gzip
Content-Security-Policy: default-src 'self'; frame-src 'none'; object-src 'none'; style-src 'self' 'nonce-DeFXWWkg7pcGQhdd781ggpOuXU6at7qP'; frame-ancestors 'none'; base-uri 'self'
Content-Type: text/html; charset=utf-8
Date: Wed, 07 Aug 2024 09:23:37 GMT
Permissions-Policy: accelerometer=(), autoplay=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), screen-wake-lock=(), sync-xhr=(), xr-spatial-tracking=(), interest-cohort=()
Referrer-Policy: no-referrer;
Strict-Transport-Security: max-age=31536000;
Vary: Accept-Encoding
X-Content-Type-Options: nosniff;
X-Dns-Prefetch-Control: off
X-Frame-Options: SAMEORIGIN;
X-Robots-Tag: none;
X-Xss-Protection: 1; mode=block;
Content-Length: 557

Thanks for help

[yrutschle]

I don't know QUIC and the RFCs are too long for me to delve into right now, but it does not look like QUIC is simply "TLS over UDP", so the TLS probe would not work.

That said, if you're not share UDP 443 with another protocol, why not simply have your Web server listen to UDP 443, while sslh listens to TCP 443?

[stanthewizzard]

Good idea !

EDIT:
on FW (opnsense)
IP UDP directly to caddy ... HTTP3 is OK !
IP TCP to sshl ... also working
Very clever and I didn't have the idea
THANK YOU !!!!

[JoshuaPettus]

I'll do that myself, but if you ever do come up with a specific probe, that would be better

[stanthewizzard]

you do that yourself ?

[JoshuaPettus]

Lol appologies, it was late when I saw this and responded. I mean to say yrutschle's solution does indeed work for the time being, but of course means I cant leverage udp for coturn or something else as well.

[yrutschle]

I understand this issue is solved, please re-open if I interpreted wrong :-)

[stanthewizzard]

TBH
Not using it anymore
Caddy does everything no more need for sslh "proxy"
Thanks

[JoshuaPettus]

If the issue is that there is no known filter for QUIC protocol. AFAIK that is still the case, correct?

[yrutschle]

Fair enough, I'll rename it and mark as "enhancement"

[Neur0toxine]

This probe works for me:

protocols:
(
     { name: "tls"; host: "127.0.0.1"; port: "8443";  tfo_ok: true },
     { name: "regex"; is_udp: true; regex_patterns: [ "^[\xC0-\xFF].{3}\x00" ]; host: "127.0.0.1"; port: "4443"; },
     { name: "anyprot"; is_udp: true; host: "127.0.0.1"; port: "4444"; }
);

But I'm not sure how correct it is.