QUIC support

[rektide]

Is your feature request related to a problem? Please describe.
The web is gaining a new connection-less, enduring long term way of communicating, quic & it would be great to be able to use this new communication technology in node.

Describe the solution you'd like
It would be excellent to see a quic module supported in Node.

Describe alternatives you've considered
We could do this in userland, but like http and http2, I believe it is fundamental & integral enough to the web & Node's purposes that Node should officially support an implementation.

[mscdex]

As far as I can see QUIC no longer has a current IETF draft, so I think it's a bit premature to be adding it to core at this time. Also, there are already some QUIC addons and pure js modules available on npm.

[Fishrock123]

I have never heard of "QUIC". I think this should be indefinitely shelved until some potential future usage in applications or implementation as a web standard is at a very significant stage.

I suggest closing this as nothing may be actionable for years or perhaps ever.

Edit: hah. Years later, this comment is laughable. Sorry folks.

[Fishrock123]

Closing, at least for now.

[jasnell]

I don't think closing this so quickly is necessary really. QUIC has a while to go before it is proven out but I think it's worthwhile keeping this open while we at least have the discussion. I'm not going to reopen it myself but I'm happy to keep discussing.

@rektide ... The quic module on npm today has only 18 downloads over the past week. I have not evaluated the quality of that module but that number suggests that the demand for this may not be very high. To help us have this discussion, it would be helpful to know:

1. which browsers outside of Chrome are using QUIC
2. the current state of any standardization efforts around QUIC
3. the success or failure of any user land modules to provide an implementation of QUIC

Btw, given that QUIC conversations are almost always bundled with http2 discussions, pinging @nodejs/http2 for thoughts and opinions.

[LPardue]

The IETF are working to standardise QUIC. Their milestone plan is on this bottom of this page. The family of documents are due to be submitted to IESG in November 2018. The main documents of interest to this thread are the Transport and HTTP mapping documents.

HTTP over QUIC is similar to HTTP/2 but there are subtle (and not so subtle) differences.

A list of QUIC implementations are available on the working group wiki. There are no current browsers that support IETF HTTP over QUIC. However, Chrome has indicated it's intent to migrate their Google QUIC support towards an IETF (compatible) version.

The WG have held several interop sessions where the above implementations have been tested against each other. To date, the main application-level testing has been simple HTTP/1.1. The formal HTTP over QUIC mapping has not had much interop.

[jasnell]

I hadn't realized that the IETF WG had made that much progress. That's definitely encouraging! I will say that it is going to be difficult gathering support to implement QUIC in Node.js so long as there are no major browsers supporting the IETF version of the protocol but that doesn't mean that we cannot explore it. One thing that would be good to know is: how difficult is it to implement the protocol in a performant way in pure userland code? Does it require native addon development?

[LPardue]

It's probably also worth highlighting that the IETF version of QUIC makes a much clearer separation of the transport layers and application layers than Google's version. This, in effect, means that QUIC becomes a secure, multiplexed transport for any application. This then becomes a natural substitute for other UDP-based protocols. There are several groups looking at other applications on top of QUIC. For instance, using QUIC as the transport for WebRTC.

I'm no Node.js expert, but I might suggest that providing a common core QUIC transport capability could allow innovation in the application space in userland.

[mcollina]

I think the bare minimum Node.js has to do is to add DTLS support. The major issue with that one has been finding a corporate sponsor to fund that work, as it looks like a sizable task that is bigger of a single individual.

[LPardue]

DTLS is not required for QUIC. It uses the TLS 1.3 handshake to establish a session key that is used to protect QUIC packets using AEAD.

[rmarx]

As a research project, we have been working on a NodeJS-based IETF QUIC client called Quicker (https://github.com/rmarx/quicker) (note: very unstable, very non-production ready). It's currently fully implemented in TypeScript (except for the OpenSSL stuff, which uses the NodeJS OpenSSL dependency + some C++ interfacing code). It's too early to do real performance testing and comparison to C/C++, but very early results do indicate a severe performance penalty for this type of setup.

It's my feeling that eventually NodeJS will want to use a C/C++ library for the main QUIC stuff (the creator of nghttp2, which Node now uses to provide HTTP/2, is also working on a C QUIC library called ngtcp2, which seems a likely candidate). One of the nice things about HTTP/2 was that it could be added with a simple NPM package (the "spdy" package was the one we used in our research), but this is currently more complex for QUIC because of the OpenSSL/TLS1.3 dependency which is still changing (the creator of ngtcp2 has his own OpenSSL fork for these changes, which we use as well). We currently have our own forked NodeJS with direct C++ changes, but are looking if we can't do this as a native plugin as well, which would be easier to redistribute (but still more of a PITA than an NPM package).

Long story short: I think it's currently too early to contemplate adding QUIC to NodeJS proper, but maybe looking into ways to speed up OpenSSL updates to the latest versions / integration with a (native) plugin would open up options for semi-easy to install external plugins while the libraries mature enough to be integrated later. If anyone from the Node project would be willing to help with that, please let me know :)