@@ -41,6 +41,8 @@ import (
4141 "github.com/bufbuild/buf/private/pkg/netrc"
4242 "github.com/bufbuild/buf/private/pkg/stringutil"
4343 "github.com/bufbuild/buf/private/pkg/verbose"
44+ "github.com/quic-go/quic-go"
45+ "github.com/quic-go/quic-go/http3"
4446 "github.com/spf13/pflag"
4547 "go.uber.org/multierr"
4648 "golang.org/x/net/http2"
@@ -60,6 +62,7 @@ const (
6062 protocolFlagName = "protocol"
6163 unixSocketFlagName = "unix-socket"
6264 http2PriorKnowledgeFlagName = "http2-prior-knowledge"
65+ http3FlagName = "http3"
6366
6467 // TLS flags
6568 keyFlagName = "key"
@@ -207,6 +210,7 @@ type flags struct {
207210 Protocol string
208211 UnixSocket string
209212 HTTP2PriorKnowledge bool
213+ HTTP3 bool
210214
211215 // TLS
212216 Key , Cert , CACert , ServerName string
@@ -324,6 +328,16 @@ choose either HTTP 1.1 or HTTP/2 for URLs with an https scheme. With this flag s
324328HTTP/2 is always used, even over plain-text.` ,
325329 )
326330
331+ flagSet .BoolVar (
332+ & f .HTTP3 ,
333+ http3FlagName ,
334+ false ,
335+ `This flag can be used to indicate that HTTP/3 should be used. Without this, HTTP 1.1
336+ will be used with URLs with an http scheme, and protocol negotiation will be used to
337+ choose either HTTP 1.1 or HTTP/2 for URLs with an https scheme. With this flag set,
338+ HTTP/3 is always used.` ,
339+ )
340+
327341 flagSet .BoolVar (
328342 & f .NoKeepAlive ,
329343 noKeepAliveFlagName ,
@@ -544,6 +558,19 @@ func (f *flags) validate(hasURL, isSecure bool) error {
544558 return fmt .Errorf ("grpc protocol cannot be used with plain-text URLs (http) unless --%s flag is set" , http2PriorKnowledgeFlagName )
545559 }
546560
561+ if ! isSecure && f .HTTP3 {
562+ return fmt .Errorf ("--%s cannot be used with plain-text URLs (http)" , http3FlagName )
563+ }
564+
565+ if f .UnixSocket != "" && f .HTTP3 {
566+ return fmt .Errorf ("--%s cannot be used with --%s" , unixSocketFlagName , http3FlagName )
567+ }
568+
569+ // NOTE: This can be removed once trailer support lands for quic-go: https://github.com/quic-go/quic-go/issues/2266
570+ if f .Protocol == connect .ProtocolGRPC && f .HTTP3 {
571+ return fmt .Errorf ("--%s cannot be used with --%s=%s" , http3FlagName , protocolFlagName , connect .ProtocolGRPC )
572+ }
573+
547574 if f .Netrc && f .NetrcFile != "" {
548575 return fmt .Errorf ("--%s and --%s flags are mutually exclusive; they may not both be specified" , netrcFlagName , netrcFileFlagName )
549576 }
@@ -691,6 +718,18 @@ func (f *flags) determineCredentials(
691718 return basicAuth (username , password ), nil
692719}
693720
721+ func (f * flags ) getTLSConfig (authority string , printer verbose.Printer ) (* tls.Config , error ) {
722+ return bufcurl .MakeVerboseTLSConfig (& bufcurl.TLSSettings {
723+ KeyFile : f .Key ,
724+ CertFile : f .Cert ,
725+ CACertFile : f .CACert ,
726+ ServerName : f .ServerName ,
727+ Insecure : f .Insecure ,
728+ HTTP2PriorKnowledge : f .HTTP2PriorKnowledge ,
729+ HTTP3 : f .HTTP3 ,
730+ }, authority , printer )
731+ }
732+
694733func promptForPassword (ctx context.Context , container app.Container , prompt string ) (string , error ) {
695734 // NB: The comments below and the mechanism of handling I/O async was
696735 // copied from the "registry login" command.
@@ -916,7 +955,11 @@ func run(ctx context.Context, container appext.Container, f *flags) (err error)
916955 // This shouldn't be possible since we check in flags.validate, but just in case
917956 return nil , errors .New ("URL positional argument is missing" )
918957 }
919- return makeHTTPClient (f , isSecure , bufcurl .GetAuthority (host , requestHeaders ), container .VerbosePrinter ())
958+ roundTripper , err := makeHTTPRoundTripper (f , isSecure , bufcurl .GetAuthority (host , requestHeaders ), container .VerbosePrinter ())
959+ if err != nil {
960+ return nil , err
961+ }
962+ return bufcurl .NewVerboseHTTPClient (roundTripper , container .VerbosePrinter ()), nil
920963 })
921964
922965 output := container .Stdout ()
@@ -1025,7 +1068,10 @@ func run(ctx context.Context, container appext.Container, f *flags) (err error)
10251068 }
10261069}
10271070
1028- func makeHTTPClient (f * flags , isSecure bool , authority string , printer verbose.Printer ) (connect.HTTPClient , error ) {
1071+ func makeHTTPRoundTripper (f * flags , isSecure bool , authority string , printer verbose.Printer ) (http.RoundTripper , error ) {
1072+ if f .HTTP3 {
1073+ return makeHTTP3RoundTripper (f , authority , printer )
1074+ }
10291075 var dialer net.Dialer
10301076 if f .ConnectTimeoutSeconds != 0 {
10311077 dialer .Timeout = secondsToDuration (f .ConnectTimeoutSeconds )
@@ -1035,6 +1081,7 @@ func makeHTTPClient(f *flags, isSecure bool, authority string, printer verbose.P
10351081 } else {
10361082 dialer .KeepAlive = secondsToDuration (f .KeepAliveTimeSeconds )
10371083 }
1084+
10381085 var dialFunc func (ctx context.Context , network , address string ) (net.Conn , error )
10391086 if f .UnixSocket != "" {
10401087 dialFunc = func (ctx context.Context , network , addr string ) (net.Conn , error ) {
@@ -1055,14 +1102,7 @@ func makeHTTPClient(f *flags, isSecure bool, authority string, printer verbose.P
10551102
10561103 var dialTLSFunc func (ctx context.Context , network , address string ) (net.Conn , error )
10571104 if isSecure {
1058- tlsConfig , err := bufcurl .MakeVerboseTLSConfig (& bufcurl.TLSSettings {
1059- KeyFile : f .Key ,
1060- CertFile : f .Cert ,
1061- CACertFile : f .CACert ,
1062- ServerName : f .ServerName ,
1063- Insecure : f .Insecure ,
1064- HTTP2PriorKnowledge : f .HTTP2PriorKnowledge ,
1065- }, authority , printer )
1105+ tlsConfig , err := f .getTLSConfig (authority , printer )
10661106 if err != nil {
10671107 return nil , err
10681108 }
@@ -1104,7 +1144,53 @@ func makeHTTPClient(f *flags, isSecure bool, authority string, printer verbose.P
11041144 MaxIdleConns : 1 ,
11051145 }
11061146 }
1107- return bufcurl .NewVerboseHTTPClient (transport , printer ), nil
1147+ return transport , nil
1148+ }
1149+
1150+ func makeHTTP3RoundTripper (f * flags , authority string , printer verbose.Printer ) (http.RoundTripper , error ) {
1151+ quicCfg := & quic.Config {
1152+ KeepAlivePeriod : - 1 ,
1153+ }
1154+ if f .ConnectTimeoutSeconds != 0 {
1155+ quicCfg .HandshakeIdleTimeout = secondsToDuration (f .ConnectTimeoutSeconds )
1156+ }
1157+ if ! f .NoKeepAlive {
1158+ quicCfg .KeepAlivePeriod = secondsToDuration (f .KeepAliveTimeSeconds )
1159+ }
1160+
1161+ tlsConfig , err := f .getTLSConfig (authority , printer )
1162+ if err != nil {
1163+ return nil , err
1164+ }
1165+
1166+ udpConn , err := net .ListenUDP ("udp" , nil )
1167+ if err != nil {
1168+ return nil , err
1169+ }
1170+ transport := & quic.Transport {Conn : udpConn }
1171+ roundTripper := & http3.RoundTripper {
1172+ TLSClientConfig : tlsConfig ,
1173+ QUICConfig : quicCfg ,
1174+ Dial : func (ctx context.Context , addr string , tlsCfg * tls.Config , cfg * quic.Config ) (quic.EarlyConnection , error ) {
1175+ printer .Printf ("* Dialing (udp) %s..." , addr )
1176+ udpAddr , err := net .ResolveUDPAddr ("udp" , addr )
1177+ if err != nil {
1178+ return nil , err
1179+ }
1180+ printer .Printf ("* ALPN: offering %s" , strings .Join (tlsCfg .NextProtos , "," ))
1181+ conn , err := transport .DialEarly (ctx , udpAddr , tlsCfg , cfg )
1182+ if err != nil {
1183+ return nil , err
1184+ }
1185+ printer .Printf ("* Connected to %s" , conn .RemoteAddr ().String ())
1186+ return conn , err
1187+ },
1188+ EnableDatagrams : false ,
1189+ AdditionalSettings : map [uint64 ]uint64 {},
1190+ MaxResponseHeaderBytes : 0 ,
1191+ DisableCompression : false ,
1192+ }
1193+ return roundTripper , nil
11081194}
11091195
11101196func secondsToDuration (secs float64 ) time.Duration {
0 commit comments