quic transport (proto)

This extension has the qualified name envoy.transport_sockets.quic

Note

This extension is intended to be robust against both untrusted downstream and upstream traffic.

Tip

This extension extends and can be used with the following extension categories:

This extension must be configured with one of the following type URLs:

The QUIC configurations below provide the transport socket configuration for downstream/upstream QUIC.

extensions.transport_sockets.quic.v3.QuicDownstreamTransport

Configuration for Downstream QUIC transport socket. This provides Google’s implementation of Google QUIC and IETF QUIC to Envoy.

{
  "downstream_tls_context": {...},
  "enable_early_data": {...},
  "enable_resumption": {...}
}

downstream_tls_context: (extensions.transport_sockets.tls.v3.DownstreamTlsContext, REQUIRED)

enable_early_data: (BoolValue) If false, QUIC will tell TLS to reject any early data and to stop issuing 0-RTT credentials with resumption session tickets. This will prevent clients from sending 0-RTT requests. Default to true, except when require_client_certificate is set, in which case early data is never used and this defaults to false.

enable_resumption: (BoolValue) If false, TLS session tickets are not issued and accepted by QUIC. Default to true, except when require_client_certificate is set, in which case this defaults to false. QUIC does not re-validate the client certificate when a session is resumed: a resumed connection reuses the certificate verdict of the original handshake until the ticket expires, so certificate revocation or expiry and validation context changes are not rechecked. Setting this to true on a filter chain that requires a client certificate opts into that trade-off in exchange for cheaper handshakes.

Configuration for Upstream QUIC transport socket. This provides Google’s implementation of Google QUIC and IETF QUIC to Envoy.

{
  "upstream_tls_context": {...}
}

upstream_tls_context: (extensions.transport_sockets.tls.v3.UpstreamTlsContext, REQUIRED)