quic transport (proto)

This extension has the qualified name envoy.transport_sockets.quic

Note

This extension is intended to be robust against both untrusted downstream and upstream traffic.

Tip

This extension extends and can be used with the following extension categories:

This extension must be configured with one of the following type URLs:

The QUIC configurations below provide the transport socket configuration for downstream/upstream QUIC.

extensions.transport_sockets.quic.v3.QuicDownstreamTransport

Configuration for Downstream QUIC transport socket. This provides Google’s implementation of Google QUIC and IETF QUIC to Envoy.

{
  "downstream_tls_context": {...},
  "enable_early_data": {...},
  "enable_resumption": {...}
}

downstream_tls_context: (extensions.transport_sockets.tls.v3.DownstreamTlsContext, REQUIRED)

enable_early_data: (BoolValue) If false, QUIC will tell TLS to reject any early data and to stop issuing 0-RTT credentials with resumption session tickets. This will prevent clients from sending 0-RTT requests. Defaults to true, except when a client certificate validation context is configured, in which case it defaults to false. Early data requires resumption, so it cannot be enabled unless enable_resumption is also true.

enable_resumption: (BoolValue) If false, TLS session tickets are not issued and accepted by QUIC. Defaults to true, except when a client certificate validation context is configured, in which case it defaults to false. QUIC does not re-validate the client certificate when a session is resumed. A resumed connection reuses the certificate verdict of the original handshake until the ticket expires, so certificate revocation or expiry and validation context changes are not rechecked. Setting this to true on a filter chain that validates a client certificate opts into that trade-off in exchange for cheaper handshakes. Resumption also requires disable_stateless_session_resumption to be false, because that field controls the underlying TLS session tickets.

Configuration for Upstream QUIC transport socket. This provides Google’s implementation of Google QUIC and IETF QUIC to Envoy.

{
  "upstream_tls_context": {...}
}

upstream_tls_context: (extensions.transport_sockets.tls.v3.UpstreamTlsContext, REQUIRED)