HTTP/3 support for frontend and DNS-over-HTTPS (DNS-over-HTTP/3, DoH3)

[ammnt]

Hello,

as far as we all know HTTP/3 it's close... Please add HTTP/3 support for three AGH entities:

1. Frontend web-interface;
2. Client part DoH;
3. Upstream DoH servers.

As I understand it, now the server is forcing down the connection protocol to HTTP/2☹️ Some providers already provide DoH3 support. For example, NextDNS has an DoH3 endpoint so you can try to test it too:
https://doh3.dns.nextdns.io/subscription_id/clients_id
https://help.nextdns.io/t/y4hfw14/cant-use-doh3

Thank you.
Best regards!🎁

[ainar-g]

AFAIK, the Go standard library currently doesn't support HTTP/3, and probably won't until it graduates the draft standard phase. Once it does, the Go standard library will probably get an implementation shortly.

[ameshkov]

DNS-over-HTTP3 support has been recently added to dnsproxy.

Here's what we should do now:

1. Upgrade dnsproxy version.
2. Add a flag to AdGuardHome.yaml that enables HTTP/3 for both the server-side and the client-side.

Eventually, we'll enable it globally so there's no need to expose it to the UI.

[ainar-g]

Added in v0.108.0-a.313+0cce4202. We'll need to make more adjustments, but these are going to be made in other issues.

[gspannu]

I have enabled both the config file parameters

serve_http3: true
use_http3_upstreams: true

but I am unable to use the following 2 providers in my upstream.
h3://dns.google
h3://cloudflare-dns.com

My upstream section looks like this

h3://cloudflare-dns.com
h3://dns.google
#---------------------
quic://unfiltered.adguard-dns.com
tls://unfiltered.adguard-dns.com
tls://1dot1dot1dot1.cloudflare-dns.com
tls://dns.google
tls://dns.opendns.com

Can you please advise where I am going wrong?

[ameshkov]

Should be h3://dns.google/dns-query and h3://cloudflare-dns.com/dns-query

Also, you don't need to enable these two config parameters if you use h3://.

1. use_http3_upstreams enables probing for HTTP/3 for regular https://
2. serve_http3 makes AdGuard Home run a DoH3 server when you have encryption configured.