Chapter 12 · MASQUE: Proxying UDP and IP over HTTP/3
Check your understanding
16 questionsself-scored · offline
Answer to check your grasp of Chapter 12. Multiple-choice and true/false questions score themselves and reveal an explanation; short-answer questions reveal a model answer. Nothing leaves your browser.
- Q1multiple choiceWhat gap in HTTP proxying does MASQUE fill?WhyCONNECT tunnels TCP; MASQUE's CONNECT-UDP (RFC 9298) tunnels UDP and CONNECT-IP (RFC 9484) tunnels IP packets, both inside an encrypted HTTP/3 connection. [§12.1]
- Q2true / falseMASQUE is a single protocol you enable with one setting.WhyMASQUE is the IETF working-group/umbrella name. Concretely you implement RFC 9297 (HTTP Datagrams + Capsules), RFC 9298 (CONNECT-UDP), and/or RFC 9484 (CONNECT-IP), plus Extended CONNECT (RFC 9220). [§12.1]
- Q3multiple choiceWhy is HTTP/3 the natural substrate for MASQUE?WhyTunneled packets are usually loss-tolerant or already reliable; wrapping them in a reliable outer stream causes reliability-over-reliability meltdown. QUIC DATAGRAM frames deliver them unreliably, so the inner protocol handles loss. Over TCP-based HTTP, MASQUE falls back to reliable capsules. [§12.1, §12.2]
- Q4multiple choiceOver HTTP/3, how is an HTTP Datagram associated with the request that opened the tunnel?WhyQUIC DATAGRAM frames belong to the connection, not a stream, so the HTTP/3 Datagram prefixes a Quarter Stream ID (stream ÷ 4, since client request streams are multiples of 4) to name the tunnel's stream. [§12.2, RFC 9297 §2.1]
- Q5multiple choiceThe Capsule Protocol differs from QUIC DATAGRAM frames in that capsules are:WhyCapsules are TLV tuples on the request data stream, delivered reliably and in order — used for control data that must arrive, and as the datagram carrier over transports without QUIC DATAGRAM frames (the DATAGRAM capsule, 0x00). [§12.2, RFC 9297 §3]
- Q6true / falseBoth endpoints must send SETTINGS_H3_DATAGRAM with value 1 before any QUIC DATAGRAM frame may be sent.WhySETTINGS_H3_DATAGRAM (0x33) must be both sent AND received with value 1 to enable HTTP/3 Datagrams; a one-sided setting yields a tunnel that opens but can't carry a datagram. [§12.2, RFC 9297 §2.1.1]
- Q7multiple choiceA CONNECT-UDP request names its target via:WhyThe Extended CONNECT request (:protocol = connect-udp) encodes target_host and target_port in the path via the well-known URI template; the proxy parses them and opens a UDP socket. [§12.3, RFC 9298 §2, §3.4]
- Q8multiple choiceIn a CONNECT-UDP HTTP Datagram payload, a Context ID of 0 means:WhyContext ID 0 is reserved: the UDP Proxying Payload that follows is a plain UDP packet's payload. Non-zero Context IDs (even=client, odd=proxy) are for extensions. [§12.3, RFC 9298 §5]
- Q9true / falseA CONNECT-UDP proxy may forward return packets from any source without validation.WhyIf it uses a non-connected socket, the proxy MUST validate the source IP and port match the client's request and discard mismatches — otherwise it becomes an injection/amplification vector. It also must not IP-fragment forwarded packets (DF bit set). [§12.3, RFC 9298 §3.1]
- Q10multiple choiceWhat does CONNECT-IP tunnel that CONNECT-UDP does not?WhyCONNECT-IP (RFC 9484) tunnels whole IP packets, enabling a VPN; CONNECT-UDP only carries UDP payloads to a specific target. CONNECT-IP MUST run over TLS/QUIC encryption. [§12.4, RFC 9484 §1]
- Q11multiple choiceIn CONNECT-IP, which capsule does the proxy send to give the client its tunnel IP address?WhyADDRESS_ASSIGN (0x01) assigns the peer IP addresses/prefixes; the client first sends ADDRESS_REQUEST (0x02), and the proxy also sends ROUTE_ADVERTISEMENT (0x03) to say which routes it will carry. [§12.4, RFC 9484 §4.7]
- Q12true / falseIn CONNECT-IP, the address/route configuration travels as unreliable datagrams, while the IP packets travel as reliable capsules.WhyIt's the opposite: the control plane (ADDRESS_ASSIGN/REQUEST, ROUTE_ADVERTISEMENT) rides RELIABLE capsules on the stream because it must arrive, while the IP packets ride UNRELIABLE datagrams like a real network path. [§12.4]
- Q13multiple choiceIn the §12.5 stack, how much overhead does tunneling a UDP payload add beyond the outer QUIC/UDP/IP headers?WhyThe nesting adds only the DATAGRAM frame type byte plus two short varints (Quarter Stream ID, Context ID 0). That thinness is what lets relays carry full QUIC connections at scale. [§12.5]
- Q14true / falseFor QUIC-in-QUIC through a MASQUE proxy, the proxy can read the inner QUIC connection's payload.WhyThere are two independent, separately-encrypted QUIC connections (client↔proxy outer, client↔website inner). The proxy routes opaque datagrams by Quarter Stream ID and holds no keys for the inner connection, so the inner payload stays opaque even in a decrypted outer capture. [§12.5, §12.1]
- Q15short answerList the layers, outer to inner, that encapsulate a tunneled UDP payload sent from a client to a CONNECT-UDP proxy over HTTP/3.Model answer(1) The outer QUIC 1-RTT (short-header) packet to the proxy, AEAD-encrypted. (2) A QUIC DATAGRAM frame (type 0x30/0x31) inside its frame payload — the unreliable carrier. (3) An HTTP/3 Datagram, whose leading Quarter Stream ID (request stream ÷ 4) ties it to the tunnel's request stream. (4) The CONNECT-UDP payload, beginning with a Context ID (0 = a plain UDP packet). (5) The inner UDP payload itself, the opaque application bytes the proxy forwards to the target as a real UDP packet. The overhead over a direct path is just the DATAGRAM type byte plus the Quarter Stream ID and Context ID varints. [§12.5, §12.2, §12.3]
- Q16short answerWhy does MASQUE use QUIC DATAGRAM frames rather than reliable streams to carry tunneled packets, and what breaks if you don't?Model answerTunneled packets are usually either loss-tolerant (real-time media) or already reliable (an inner QUIC/TCP connection running its own recovery). Carrying them over a reliable, ordered outer stream stacks two reliability layers: the outer layer retransmits and reorders packets the inner layer would have handled, and the two recovery loops fight — the classic reliability-over-reliability (‘TCP-over-TCP’) meltdown, where outer retransmissions and head-of-line blocking add latency and waste bandwidth. QUIC DATAGRAM frames deliver tunneled packets unreliably and unordered, exactly like a real path, so a lost inner packet is simply lost and the inner protocol recovers normally. Over TCP-based HTTP, MASQUE can only fall back to the reliable Capsule Protocol, which reintroduces that pathology — which is why HTTP/3 is MASQUE's natural home. [§12.1, §12.2]