Repository navigation
Implement the HTTP/3 CONNECT-IP edge service #980
Description
Parent: #970
Deliverable
A runnable edge service that accepts authenticated CONNECT-IP requests over HTTP/3 on UDP/443 and forwards packets through the gVPC attachment.
Dependencies
#973, #975, #976, #977, #978, #979; resolve the #991 exposure blockers and applicable #989 findings before wiring the externally reachable listener.
Galactic Edge integration (#992)
Implement this milestone as a consumer of the Galactic Edge provider contract. #992 owns provider authorization, host attachment lifecycle, shared-state fencing and maintenance, independently enforced forwarding expiry, prefix conflict arbitration/publication, and gVPC traffic policy. MASQUE owns client authentication, connector /96 assignment and retention, session packet checks, transport behavior and its provider adapter. Use the foundation's versioned contract and existing provider helpers; do not introduce a second host-networking controller, lease store or BGP publisher. Any required foundation change must be tracked and qualified under #992 before this milestone claims integrated acceptance.
Work
- Integrate the selected QUIC/HTTP/3 stack with TLS configuration, CONNECT-IP negotiation, HTTP datagrams and required control capsules.
- Wire requests to common admission, prefix assignment, ownership, packet policy and return-routing components.
- Support concurrent requests with bounded resources and independent cancellation; release request-owned resources without affecting other connectors.
- Provide buildable service artifacts, internal configuration and a runnable development fixture. Document startup and shutdown for engineering verification, without production rollout work.
Acceptance criteria
- Independent clients complete connect/send/receive/disconnect/reconnect against real gVPC workloads in both directions.
- Tests verify certificate/hostname validation, invalid credentials, denied gVPC selection and cancellation isolation.
- Assigned /96 addresses and subdivisions receive return traffic; expired ownership cannot continue forwarding.
- CONNECT-IP runs natively over HTTP/3/QUIC without requiring a proprietary backend transport.
Additional integration acceptance
- Ship the runnable service as a separate Edge provider using Integrate MASQUE with Galactic Edge provider attachments #975–Enforce delegated-prefix ownership and bidirectional traffic policy #979, with scoped registration/grant examples and container/device access verified by Prove MASQUE packet attachments on the Galactic Edge foundation #974. The core remains protocol-independent.
- Supply a foundation-backed Admission/Lease/PacketBackend path; the raw TUN adapter and cancellation-only Lease are insufficient forwarding authority. Do not expose an unfenced backend.
- Enforce pre-authentication connection/request/admission limits before exposure, authenticate before probes, and isolate full-device/backpressure failures per CONNECT-IP server lacks overload limits and tenant isolation checks #991. Enforce resource limits and qualify connector capacity #984 performs capacity qualification; it is not permission to defer these protections.
- Validate readiness, claim acceptance, grant loss, drain and process restart against real foundation artifacts; no direct host networking or BGP writes.
Scope follows #970: CONNECT-IP with HTTP/2 fallback; no public API development, plugin/portal integration, product-client development or production rollout.
Metadata
Metadata
Assignees
Labels
Type
Fields
Priority
Activity
[-]MASQUE: implement the HTTP/3 CONNECT-IP edge service[/-][+]Implement the HTTP/3 CONNECT-IP edge service[/+]privateip commentedon Oct 28, 2026
Verdict: valid, and blocked on its own prerequisites. Checked against
mainat 15a1b5a.Main has no CONNECT-IP service you can deploy. The only process that serves
internal/edge/connectipover HTTP/3 is the conformance fixture intests/edgeconformance/masqueprovider. It authenticates with static test credentials unless a grant authority is configured, and nothing builds or publishes it as an image.This issue says not to wire an externally reachable listener until #991 is resolved, and it depends on #976 and #979. All three are still open:
server.go,probeInnerMTUstill runs beforeAdmit. There is still no connection, session or admission limit ahead of admission.#991 goes first. Work on this issue resumes once #976, #979 and #991 are closed.
fix(connectip): Bound CONNECT-IP work before admission
privateip commentedon Oct 28, 2026
Updated verdict: valid, and now unblocked enough to build on. Checked against
mainat 7988c31 and #1201's head ff154e0.What changed since the last comment:
Admitand caps connections, streams per connection, admissions in progress and sessions.What #980 still lacks:
go list ./cmd/...has no CONNECT-IP provider. The only process that servesinternal/edge/connectipis the conformance fixture intests/edgeconformance/masqueprovider. It accepts static bearer credentials from its config file, which a deployed listener must not..github/workflows/publish.yamlpublishes neither a provider nor amasque-authorityimage, andconfig/has no manifests for either.masque-authority.mdlists the image and manifests as Implement the HTTP/3 CONNECT-IP edge service #980's work.HandshakeIdleTimeout, so 10 s by default.http3.Server.MaxHeaderBytesis unset, so the limit ishttp.DefaultMaxHeaderBytes(1 MiB).Admitruns with the request's context and no deadline of its own.TestMASQUEruns the fixture with static credentials only. No lab row usescmd/masque-authority.privateip commentedon Oct 28, 2026
Fix plan (approved). Three stacked PRs on top of #1201:
internal/edge/connectip). Cap connections at 8 per source IP and close a QUIC handshake that hasn't finished in 5 s. Limit request headers to 8 KiB. Allow 2 admissions in progress per credential digest, checked after the connection and global caps. GiveAdmita 3 s deadline. Unit tests cover each cap.cmd/masque-provider. The fixture's run loop moves into a shared package, so the fixture and the service run the same code. The service authorizes only throughmasque-authority, never with static credentials. It reloads its certificate when the file changes. It serves/readyz, ready once it holds the instance Lease and the listener is up, and it serves metrics. Dockerfiles andpublish.yamljobs formasque-providerandmasque-authority.config/for the authority (the RBAC inmasque-authority.md) and the provider (Deployment on UDP/443, TUN device-plugin resource, probes), plus anEdgeProviderexample. A guide covers startup, shutdown and configuration.Risk: nothing deploys these manifests, so no running cluster changes. The limits change only the server that the fixture already runs.
Verification:
task ci, the envtest suites underinternal/edge/masque/..., and the root TUN tests. No lab run in this stack. The acceptance rows that need real gVPC workloads under the grant authority stay open, so the stack references this issue without closing it.feat(config): Add MASQUE authority and provider manifests
feat(masque): Add the masque-provider CONNECT-IP service and images
feat(config): Add MASQUE authority and provider manifests
privateip commentedon Oct 29, 2026
Every acceptance criterion now has evidence, so I'm closing this. The service merged as the #1205 stack: transport limits in #1202, the
masque-providerservice in #1203 and its manifests in #1204. #1238 runs that shipped service and its grant authority on the containerlab lab, and all of its rows passed./readyzfailed at 14.99 s against a 15 s lease. process-restart: the lease was retaken at 17.2 s and both connectors were served at about 20 s on their adopted attachments. drain: the claim, attachment and lease were released 200 ms after SIGTERMCapacity qualification stays with #984 and #1242. One related bug stays open under #970. The process-restart row exposed it: if a connector reconnects within the clock-skew window before its grant's deadline, the authority renews the grant but core keeps the attachment refused for about 30 s (#1236).