This page lists details of known active QUIC implementations (applications or libraries) and QUIC-related tooling. Many of these are open source projects that welcome contributions. Several project include a “Vulnerability Reporting” field containing details for reporting vulnerability-related matters.

Implementations

aioquic

AppleQuic

Chromium

f5

haproxy

Haskell quic

kwik / flupke

linuxquic

lsquic / lsqpack

MsQuic

mvfst / proxygen

Neqo

ngtcp2 / nghttp3 / h2load

nginx

picoquic / fuzi_q

qlog / qvis

quiche / h3i

quicly

QUIC Interop runner / network simulator

Quinn

quic-go

s2n-quic

Wireshark

XQUIC

Details

aioquic

Implementation using Python and asyncio.

• Website: https://github.com/aiortc/aioquic
• Language(s): Python
• Role(s): client, server, library
• Public server(s):
  • quic.aiortc.org:443
  • quic.aiortc.org:4434 (Stateless Retry)

AppleQuic

Apple’s implementation

• Website: N/A
• Language(s): C, Objective-C, Swift
• Role(s): client, server
• Public server(s): N/A
• Vulnerability reporting: https://support.apple.com/en-us/HT201220

Chromium

Chromium’s implementation (not to be confused with Cloudflare quiche)

• Website: https://quiche.googlesource.com/quiche/
• Language(s): C, C++
• Role(s): client, server, library
• Public Server(s):
  • https://quic.rocks:4433
  • https://google.com

f5

F5’s implementation

• Website: N/A
• Language(s): C
• Role(s): client, server
• Public Server(s): N/A

haproxy

HAproxy’s implementation

• Website: https://github.com/haproxy/haproxy/
• Language(s): C
• Role(s): server
• Public Server(s):
  • https://www.haproxy.org/

Haskell quic

Implementation using Haskell

• Website: https://github.com/kazu-yamamoto/quic
• Language(s): Haskell
• Role(s): client, server
• Public Server(s):
  • mew.org:443
  • mew.org:4434 for stateless retry

kwik / flupke

Implementation using Java

• Website: https://bitbucket.org/pjtr/kwik/
• Language(s): Java
• Role(s): client, server, library
• Public Server: N/A

linuxquic

In-kernel QUIC implementation with Userspace handshake for the Linux kernel. A socket API draft exists to discuss the interface between kernel and user space.

• Website: https://github.com/lxin/quic
• Language(s): C
• Role(s): client, server
• Public Server(s):
  • d.moritzbuhl.de:443/pub/
• Vulnerability reporting: Xin Long lucien.xin@gmail.com

lsquic / lsqpack

LiteSpeed QUIC and HTTP/3 library. Works on Linux, FreeBSD, MacOS, Android, and Windows. Turn-key open-source web server that uses lsquic is available at openlitespeed.org in both source and package forms.

• Website: https://github.com/litespeedtech/lsquic
• Language(s): C
• Role(s): client, server
• Public Server(s):
  • http3-test.litespeedtech.com:4433
  • http3-test.litespeedtech.com:4434 (sends stateless retry packets)
  • http3-test.litespeedtech.com:4435 (faster downloads due to less logging)
  • www.litespeedtech.com:443 (production web server)

MsQuic

Microsoft’s general purpose (cross-platform) QUIC implementation. Optimized for high performance. More documentation here.

• Website: https://github.com/microsoft/msquic
• Language(s): C
• Role(s): client, server
• Public Server(s):
  • msquic.net
  • quic.westus.cloudapp.azure.com
• Vulnerability reporting: https://github.com/microsoft/msquic/security/policy

mvfst / proxygen

mvfst (pronounced move fast) is an implementation by Facebook. proxygen implements HTTP/3 mapping over QUIC and QPACK in C++, with MVFST as the transport.

• Website: https://github.com/facebookincubator/mvfst
• Language(s): C++
• Role(s): client, server, library
• Public Server(s):
  • fb.mvfst.net:443
  • www.facebook.com
  • www.instagram.com
• Vulnerability reporting: https://github.com/facebookincubator/mvfst/security/policy

Neqo

Mozilla’s implementation

• Website: https://github.com/mozilla/neqo
• Language(s):
• Role(s): client, server
• Public Server(s):

ngtcp2 / nghttp3 / h2load

A range of implementation and tools implemented using C and C++

• Website(s):
  • https://github.com/ngtcp2/ngtcp2
  • https://github.com/ngtcp2/nghttp3
  • https://nghttp2.org/documentation/h2load-howto.html
• Language(s): C, C++
• Role(s): client, server, library, tool
• Public Server(s):
  • nghttp2.org:443
  • nghttp2.org:4433
• Vulnerability reporting: https://nghttp2.org/documentation/security.html

nginx

nginx’s implementation

• Website: https://hg.nginx.org/nginx-quic/
• Language(s): C
• Role(s): server
• Public Server(s):
  • quic.nginx.org:443

picoquic / fuzi_q

Picoquic is a small(ish) implementation of QUIC in C, to explore the protocol and the API, for example for DNS over QUIC. Relies on PicoTLS for TLS 1.3. MIT license. Tested on Windows, Linux, FreeBSD/IOS.

Over the net fuzzing of QUIC servers or clients. Fuzi_q can be used as a client to test a QUIC server, or as a server to test a QUIC client.

• Website: https://github.com/private-octopus/picoquic
• Language(s): C
• Role(s): client, server, library, tool
• Public Server(s):
  • test.privateoctopus.com:4433 (server log accessible at https://test.privateoctopus.com/).
  • test.privateoctopus.com:4433 (retries).
• Vulnerability reporting: https://github.com/private-octopus/picoquic/security/policy

qlog / qvis

qlog is a standard logging format for network protocols such as QUIC and HTTP/3. Support for generating qlogs in included in many implementations.

qvis is a toolsuite for visualizing QUIC+HTTP/3 qlog and pcap files. Includes a sequence diagram, congestion graph, multiplexing diagram and packetization visualization.

• Website(s):
  • https://github.com/quicwg/qlog
  • https://qvis.quictools.info/
• Language(s): C++
• Role(s): tool
• Public Server(s): N/A

quiche / h3i

quiche is Cloudflare’s implementation (not to be confused with Google QUICHE).

h3i consists of an interactive command-line tool and library for low-level HTTP/3 debugging and testing.

• Website(s):
  • https://github.com/cloudflare/quiche
  • https://blog.cloudflare.com/h3i
• Language(s): Rust
• Role(s): client, server, library
• Public Server(s):
  • quic.tech:4433 (HTTP/0.9 + 0-RTT)
  • quic.tech:8443 (HTTP/3 + 0-RTT)
  • quic.tech:8444 (HTTP/3 + Retry)
• Vulnerability reporting: https://github.com/cloudflare/quiche/security/policy

quicly

QUIC protocol implementation for H2O server

• Website: https://github.com/h2o/quicly
• Language(s): C
• Role(s): client, server, library
• Public Server(s): N/A
• Vulnerability reporting: https://github.com/h2o/h2o/security/policy

QUIC Interop runner / network simulator

The QUIC Interop runner provides automated, continuous interop testing for participating QUIC implementations. Implementers are encouraged to join this effort by making compatible Docker images of their implementations available.

The QUIC network simulator is a simulation framework for automated benchmarking of QUIC implementations. Allows extensive network simulations using ns-3.

• Website: https://interop.seemann.io/
• Language(s): N/A
• Role(s): tool
• Public Server(s): N/A

Quinn

Rust implementation with both a synchronous (sans-I/O) interface and an async interface, using rustls for TLS.

• Website: https://github.com/quinn-rs/quinn
• Language(s): Rust
• Role(s): client, server, library
• Public Server(s):

quic-go

Implementation using Go

• Website: https://github.com/quic-go/quic-go
• Language(s): Go
• Role(s): client, server, library
• Public Server(s):
  • https://interop.seemann.io
• Vulnerability reporting: https://github.com/quic-go/quic-go/security/policy

s2n-quic

Amazon’s implementation

• Website: https://github.com/aws/s2n-quic
• Language(s): Rust
• Role(s): client, server, library
• Public Server(s): N/A
• Vulnerability reporting: https://github.com/aws/s2n-quic/security/policy

Wireshark

The world’s most popular network protocol analyzer

• Website: https://www.wireshark.org/
• Language(s): C
• Role(s): tool
• Public Server(s): N/A

XQUIC

XQUIC Library released by Alibaba is a cross-platform implementation of IETF QUIC and HTTP/3 protocol.

• Website: https://github.com/alibaba/xquic
• Language(s): C
• Role(s): client, server
• Public Server(s): N/A
• Vulnerability reporting: https://github.com/alibaba/xquic/security/policy