Restore quic_version and wire it into Http3Settings (PR 49)

* Restore quic_version and wire it into Http3Settings

The quiche -> NLC/http3 migration (AG-53338) dropped the quic_version
fields because NLC's Http3Client did not expose the setting at the time.
NLC's Http3Settings now has a quic_version field, so restore the removed
struct fields and thread the value end-to-end into the QUIC version
offered by ngtcp2.

Direct-connect path (http3_upstream): read PROTOCOL_CONFIG->http3 and
set m_h3_settings.quic_version before Http3Client::connect().

Ping/handoff path: VpnHttp3UpstreamConfig.quic_version flows through
LocationsPingerInfo -> LocationsPinger -> PingInfo -> Ping ->
QuicConnectorConnectParameters -> Http3Settings. The vpn_fsm
locations-pinger initializer passes quic_version = 0 for now (to be
wired from vpn_manager make_client_config later). Zero already selects
the default version (NGTCP2_PROTO_VER_V1) in NLC, so the old
QUICHE_PROTOCOL_VERSION fallbacks are gone.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Temporarily pin native_libs_common to snapshot 8.1.38-3-g3e5d3f1

Override to a git-described NCL snapshot that carries the changes this
branch depends on, until a tagged NCL release is available.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Use dns-libs 2.8.58-2-g2c375f1c and native_libs_common 8.1.39

Bump dns-libs to 2.8.58-2-g2c375f1c and move native_libs_common off the
temporary 8.1.38-3-g3e5d3f1 snapshot pin to the tagged 8.1.39 release,
dropping the override now that a real release carries the needed changes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Fix conan_bootstrap_deps.py

* Add changelog entry for quic_version restore; document one-entry rule

Add a single [Unreleased] entry for restoring the quic_version parameter,
and add a Mandatory Task Rule that a required CHANGELOG.md update must
contain exactly one entry per PR/change.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: sfionov

AGENTS.md

@@ -197,6 +197,11 @@ You MUST follow the following rules for EVERY task that you perform:
 
 - You MUST update the unit tests for changed code.
 
+- When a change is user-visible, you MUST update `CHANGELOG.md` under
+  `## [Unreleased]` in the appropriate category. A required `CHANGELOG.md`
+  update MUST contain exactly ONE entry for the PR/change: summarize the whole
+  change in a single bullet, not one bullet per file or sub-change.
+
 - You MUST run tests with the `make test` script to verify that your changes do
   not break existing functionality.
 

CHANGELOG.md

@@ -16,6 +16,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ### Fixed
 
+- Restore the `quic_version` HTTP/3 upstream configuration parameter that was
+  accidentally dropped during the quiche → ngtcp2 migration, wiring it through
+  to the QUIC version offered by ngtcp2 (`0` selects the default version).
+
 ### Security
 
 ## [1.1.5-beta.6] - 2026-07-03

conanfile.py

@@ -32,8 +32,8 @@ class VpnLibsConan(ConanFile):
     exports_sources = patch_files
 
     def requirements(self):
-        self.requires("dns-libs/2.8.58@adguard/oss", transitive_headers=True)
-        self.requires("native_libs_common/8.1.38@adguard/oss", transitive_headers=True)
+        self.requires("dns-libs/2.8.58-2-g2c375f1c@adguard/oss", transitive_headers=True)
+        self.requires("native_libs_common/8.1.39@adguard/oss", transitive_headers=True)
 
         self.requires("brotli/1.1.0", transitive_headers=True)
         self.requires("cxxopts/3.1.1", transitive_headers=True)

core/src/http3_upstream.cpp

@@ -87,10 +87,13 @@ bool Http3Upstream::open_session(std::optional<Millis>) {
     }
 
     const vpn_client::EndpointConnectionConfig &upstream_config = this->vpn->upstream_config;
+    // NOLINTNEXTLINE(bugprone-unchecked-optional-access)
+    const VpnHttp3UpstreamConfig &h3_config = this->PROTOCOL_CONFIG->http3;
 
     // Let the connection live long enough to perform a health check.
     m_max_idle_timeout = 2 * (upstream_config.timeout + upstream_config.health_check_timeout);
     m_h3_settings.max_idle_timeout = Micros{m_max_idle_timeout};
+    m_h3_settings.quic_version = h3_config.quic_version;
     m_h3_settings.initial_max_data = QUIC_CONNECTION_WINDOW_SIZE;
     m_h3_settings.initial_max_stream_data_bidi_local = QUIC_STREAM_WINDOW_SIZE;
     m_h3_settings.initial_max_stream_data_bidi_remote = QUIC_STREAM_WINDOW_SIZE;

core/src/vpn_fsm.cpp

@@ -286,6 +286,7 @@ static void run_ping(void *ctx, void *) {
             .anti_dpi = vpn->upstream_config->anti_dpi,
             .handoff = true,
             .quic_max_idle_timeout_ms = quic_max_idle_timeout,
+            .quic_version = 0,
     };
 
     // Speed up recovery if we have already connected through a relay by pinging through the relay in parallel.

net/include/net/locations_pinger.h

@@ -39,6 +39,7 @@ typedef struct {
                                        // If `true`, pass the connection state with the ping result.
     const VpnRelay *relay_parallel;    // Ping through this relay in parallel with normal pings.
     uint32_t quic_max_idle_timeout_ms; // QUIC connection max idle timeout. Set `0` to use the default.
+    uint32_t quic_version;             // QUIC version. Set `0` to use the default.
 } LocationsPingerInfo;
 
 typedef struct {

net/include/net/quic_connector.h

@@ -50,6 +50,7 @@ struct QuicConnectorConnectParameters {
     SSL *ssl;
     Millis timeout;          // How long to wait for server response before giving up.
     Millis max_idle_timeout; // QUIC connection's maximum idle timeout.
+    uint32_t quic_version;
 };
 
 struct QuicConnectorResult {

net/src/locations_pinger.cpp

@@ -81,6 +81,7 @@ struct LocationsPinger {
     bool handoff;
     AutoVpnRelay relay_parallel;
     uint32_t quic_max_idle_timeout_ms;
+    uint32_t quic_version;
 };
 
 struct FinalizeLocationInfo {
@@ -262,7 +263,7 @@ static void start_location_ping(LocationsPinger *pinger) {
             {i->info->endpoints.data, i->info->endpoints.size}, pinger->timeout_ms,
             {pinger->interfaces.data(), pinger->interfaces.size()}, pinger->rounds, pinger->main_protocol,
             pinger->anti_dpi, pinger->handoff, {i->info->relays.data, i->info->relays.size}, *pinger->relay_parallel,
-            pinger->quic_max_idle_timeout_ms};
+            pinger->quic_max_idle_timeout_ms, pinger->quic_version};
     Ping *ping = ping_start(&ping_info, {ping_handler, pinger});
 
     // Must be extracted before pop_front() invalidates the iterator, and before finalize_location()
@@ -313,6 +314,7 @@ LocationsPinger *locations_pinger_start(const LocationsPingerInfo *info, Locatio
     pinger->anti_dpi = info->anti_dpi;
     pinger->handoff = info->handoff;
     pinger->quic_max_idle_timeout_ms = info->quic_max_idle_timeout_ms;
+    pinger->quic_version = info->quic_version;
     if (info->relay_parallel) {
         pinger->relay_parallel = vpn_relay_clone(info->relay_parallel);
     }

net/src/ping.cpp

@@ -116,6 +116,7 @@ struct Ping {
     bool handoff;
 
     uint32_t quic_max_idle_timeout_ms;
+    uint32_t quic_version;
 
     int minimum_round_timeout_ms;
 };
@@ -237,6 +238,7 @@ static void do_connect(void *arg, bool shortcut) {
                 .ssl = conn->ssl.release(), // Always consumed by `quic_connector_connect`.
                 .timeout = Millis{self->round_timeout_ms},
                 .max_idle_timeout = Millis{self->quic_max_idle_timeout_ms},
+                .quic_version = self->quic_version,
         };
         error = quic_connector_connect(conn->quic_connector.get(), &parameters);
     } else {
@@ -594,6 +596,7 @@ Ping *ping_start(const PingInfo *info, PingHandler handler) {
     constexpr auto TIMEOUT_MULTIPLIER = 10;
     self->quic_max_idle_timeout_ms = info->quic_max_idle_timeout_ms ? info->quic_max_idle_timeout_ms
                                                                     : TIMEOUT_MULTIPLIER * DEFAULT_PING_TIMEOUT_MS;
+    self->quic_version = info->quic_version;
 #endif
 
     constexpr uint32_t DEFAULT_IF_IDX = 0;

net/src/ping.h

@@ -64,6 +64,7 @@ struct PingInfo {
 
     /// QUIC parameters. Set 0 to use defaults.
     uint32_t quic_max_idle_timeout_ms = 0;
+    uint32_t quic_version = 0;
 };
 
 struct PingHandler {