Add QUIC support by tenderlove · Pull Request #1008 · ruby/openssl

tenderlove · 2026-02-23T00:31:31Z

This commit exposes various QUIC methods so that you can build QUIC clients and servers.

I'm really sorry about the very large patch. I can split it in to smaller patches if that helps to get this upstream. I think the patch is pretty straightforward though. It just adds different QUIC related methods that OpenSSL provides. I've been using this patch to develop a QUIC/HTTP3 client and server in Ruby.

My development branch is here. Here is an example script that uses these APIs.

tenderlove · 2026-02-25T16:56:30Z

I've been able to serve a Rails application with QUIC+HTTP/3 using this patch:

rhenium · 2026-02-26T10:57:59Z

Thanks for working on this!

I wonder if QUIC listener SSL, QUIC connection SSL, and QUIC stream SSL should be represented as separate (sub)classes. Although they all have the same type SSL, they support different sets of methods, so that would make

I think the blocking methods such as #read and #wait_readable need to be updated to check SSL_poll() rather than just the readiness of the underlying socket. I imagine currently SSLSocket#read can enter a busy loop if the stream is blocked by another stream on the same connection, even when the underlying socket is readable.

Regarding the thread assisted mode (OSSL_QUIC_client_thread_method() and SSL_set_blocking_mode()), please note that we currently don't release the GVL when calling SSL_read(). It may take some work to do so, as it needs fixing callbacks (e.g., SSLContext#new_session_cb which can be called at any time in the connection lifecycle) to re-acquire it as necessary. I'm not so sure if supporting this mode is worthwhile at the moment, especially since the server side support is still missing in OpenSSL and we have to consider both. It appears you didn't use this mode in the kantan repo either.

@ioquatix, what do you think?

rhenium · 2026-02-26T08:26:11Z

ext/openssl/extconf.rb

+have_func("SSL_get_accept_connection_queue_len(NULL)", ssl_h)
+have_func("SSL_listen(NULL)", ssl_h)
+have_func("SSL_poll(NULL, 0, 0, NULL, 0, NULL)", ssl_h)
+have_func("SSL_set_incoming_stream_policy(NULL, 0, 0)", ssl_h)


We can simply require OpenSSL 3.5+ and remove most of the conditionals. There is little need to support 3.2-3.4 which are non-LTS releases and will reach EOL in 8 months, and we want the server side support in 3.5 to write meaningful tests.

Makes sense, but I'm not sure how to do that. How do we take other SSL implementations in to account?

ext/openssl/ossl_ssl.c

rhenium · 2026-02-26T08:41:32Z

ext/openssl/ossl_ssl.c

+
+    GetSSL(self, ssl);
+    return SSL_is_init_finished(ssl) ? Qtrue : Qfalse;
+}


Is this related to QUIC support? Is this different from seeing whether #accept/#connect/#accept_connection successfully returned or not?

Yes. I'm using it on the server side to detect if the handshake has finished here. Without this, open_streams can raise an exception.

ext/openssl/ossl_ssl.c

rhenium · 2026-02-26T11:26:52Z

ext/openssl/ossl_ssl.c

+/*
+ * call-seq:
+ *    ssl.accept_connection(flags = 0) => SSLSocket or nil
+ *
+ * Accepts an incoming QUIC connection from the listener. Returns a new
+ * SSLSocket representing the connection, or +nil+ if no connection is
+ * available (when using non-blocking mode or ACCEPT_CONNECTION_NO_BLOCK).
+ */


Would it make sense to provide a blocking and non-blocking variants, similar to TCPServer#accept and #accept_nonblock?

Maybe also for #accept_stream.

Yes, I think that makes sense. From reading OpenSSL source code, NO_BLOCK is the only flag it cares about.

I'll change this to accept and add an accept_nonblock

This commit exposes various QUIC methods so that you can build QUIC clients and servers

tenderlove · 2026-02-27T01:05:57Z

I wonder if QUIC listener SSL, QUIC connection SSL, and QUIC stream SSL should be represented as separate (sub)classes. Although they all have the same type SSL, they support different sets of methods, so that would make

I'm not sure. We could do that, and I'm happy to do that work. It's up to you.

Regarding the thread assisted mode (OSSL_QUIC_client_thread_method() and SSL_set_blocking_mode()), please note that we currently don't release the GVL when calling SSL_read(). It may take some work to do so, as it needs fixing callbacks (e.g., SSLContext#new_session_cb which can be called at any time in the connection lifecycle) to re-acquire it as necessary. I'm not so sure if supporting this mode is worthwhile at the moment, especially since the server side support is still missing in OpenSSL and we have to consider both. It appears you didn't use this mode in the kantan repo either.

I think we shouldn't support it, and I'll remove it. I've updated the patch to make QUIC connections always non-blocking, and I think that's the way we should go. I've removed the accessor to SSL_set_blocking_mode, and I'll remove the OSSL_QUIC_client_thread_method. I tried using OSSL_QUIC_client_thread_method, but ran in to exactly the GVL problem, so changed to non-blocking mode in my code.

tenderlove · 2026-02-27T01:07:13Z

I wonder if QUIC listener SSL, QUIC connection SSL, and QUIC stream SSL should be represented as separate (sub)classes. Although they all have the same type SSL, they support different sets of methods, so that would make

I'm not sure. We could do that, and I'm happy to do that work. It's up to you

Ah, I remember. I had considered adding a subclass as you say, but I've always run in to issues when trying to work with a subclass on T_DATA objects. I think we should not make it a subclass, but my only reason is from having a bad experience in the past.

Clients should use IO.select and non-blocking sockets instead

tenderlove force-pushed the quic-api branch from d71935a to 80178a2 Compare February 23, 2026 23:12

tenderlove force-pushed the quic-api branch from 80178a2 to 716df15 Compare February 26, 2026 01:33

rhenium reviewed Feb 26, 2026

View reviewed changes

ioquatix reviewed Feb 26, 2026

View reviewed changes

ext/openssl/ossl_ssl.c Outdated Show resolved Hide resolved

rhenium reviewed Feb 26, 2026

View reviewed changes

tenderlove force-pushed the quic-api branch from 716df15 to 164092e Compare February 26, 2026 23:59

tenderlove added 2 commits February 26, 2026 16:03

Add QUIC support

0f8130f

This commit exposes various QUIC methods so that you can build QUIC clients and servers

fix tv_usec type

3a28e67

tenderlove force-pushed the quic-api branch from 164092e to 3a28e67 Compare February 27, 2026 00:03

tenderlove added 2 commits February 26, 2026 16:13

Remove default_stream_mode=

b62d9a5

always set the connection to non-blocking mode

c373fdc

tenderlove force-pushed the quic-api branch from e67135d to c373fdc Compare February 27, 2026 00:51

remove SSLSocket.poll

910bed1

Clients should use IO.select and non-blocking sockets instead

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add QUIC support#1008

Add QUIC support#1008
tenderlove wants to merge 5 commits intoruby:masterfrom
tenderlove:quic-api

tenderlove commented Feb 23, 2026 •

edited

Loading

Uh oh!

tenderlove commented Feb 25, 2026 •

edited

Loading

Uh oh!

rhenium commented Feb 26, 2026

Uh oh!

rhenium Feb 26, 2026

Uh oh!

tenderlove Feb 27, 2026

Uh oh!

Uh oh!

rhenium Feb 26, 2026

Uh oh!

tenderlove Feb 27, 2026

Uh oh!

Uh oh!

rhenium Feb 26, 2026 •

edited

Loading

Uh oh!

tenderlove Feb 27, 2026

Uh oh!

tenderlove commented Feb 27, 2026

Uh oh!

tenderlove commented Feb 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

tenderlove commented Feb 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tenderlove commented Feb 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rhenium commented Feb 26, 2026

Uh oh!

rhenium Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

tenderlove Feb 27, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

rhenium Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

tenderlove Feb 27, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

rhenium Feb 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tenderlove Feb 27, 2026

Choose a reason for hiding this comment

Uh oh!

tenderlove commented Feb 27, 2026

Uh oh!

tenderlove commented Feb 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

tenderlove commented Feb 23, 2026 •

edited

Loading

tenderlove commented Feb 25, 2026 •

edited

Loading

rhenium Feb 26, 2026 •

edited

Loading