Re: Questions on HTTP URI schemes and QUIC

[Patrick McManus <[e-mail]>]

On Wed, Jul 18, 2018 at 6:49 AM, Sridhar Bhaskaran <
[e-mail]> wrote:

> Dear Quic experts,
>
> I am Sridhar Bhaskaran from Huawei. Going through the drafts on QUIC
> transport and HTTP over QUIC, I have the following queries
>
> 1. If a HTTP URI uses http:// scheme and the origin server advertises
> alternate service via QUIC, can a HTTP client use QUIC to connect to the
> origin server and still use the http:// scheme URI?
>

There is an experimental RFC, 8164, that would probably apply here for
consenting endpoints. 8164 requires the same crypto and authentication as
https - so you should probably just go with https unless you're already
using that strategy with h2 for legacy mixed content.



> 2. If a HTTP URI uses https:// scheme and the HTTP client is configured
> to connect to a HTTP proxy and if the HTTP proxy supports QUIC, my
> understanding is the following sequence of events
>         a. HTTP client to HTTP proxy QUIC connection is setup
>         b. HTTP client issues a HTTP CONNECT request to the proxy with the
> ":authority" HTTP/2 pseudo header pointing to the origin server
>         c. HTTP proxy upon getting the CONNECT request sets up a TCP
> connection with the origin server
>         d. HTTP proxy sends HTTP CONNECT response to the client
>         e. HTTP client then initiates a TLS connection towards the origin
> server via the proxy and the proxy simply tunnels it.
>         f. Actual HTTP traffic happens between client and origin server
>
> Is this correct?
>
>
i believe so


> Where I am not clear is whether step /e/ actually happens. If it does,
> then for step /f/ is the client required to do ciphering 2 times - one for
> the TLS and other for the QUIC connection to proxy itself.
>
>
yes, connect tunnels are end to end encryption for their content so the
data that flows between the client and proxy is encrypted twice. That's the
same in all versions of http.

Could you please clarify?
>
> Thanks
> Sridhar
>
>