HTTP3 走 UDP，HTTP2 仍走 TCP 兜底

(
set -euo pipefail
: "${URL:?Set one authorized HTTPS URL with an expected 200 response}"
umask 077
tmp=$(mktemp -d)
trap 'rm -rf -- "$tmp"' EXIT
probe() {
    local label=$1 mode=$2 expected=$3 rc check_rc
    if curl --disable --silent --show-error --fail --globoff \
        --noproxy '*' --proto '=https' --connect-timeout 10 --max-time 30 \
        "$mode" --output /dev/null --dump-header "$tmp/$label.headers" \
        --write-out '%{json}\n' --url "$URL" > "$tmp/$label.json"; then
        rc=0
    else
        rc=$?
        printf '%s: curl failed (exit %s)\n' "$label" "$rc" >&2
    fi
    if python3 - "$tmp/$label.json" "$label" "$expected" "$URL" "$rc" <<'PY'
import json, math, pathlib, sys
path, label, expected, url, curl_exit = sys.argv[1:]
print(label, "curl_exit", curl_exit)
d, headers = None, None
try:
    d = json.loads(pathlib.Path(path).read_text())
    if not isinstance(d, dict):
        raise ValueError("expected a JSON object")
except (OSError, UnicodeError, ValueError) as error:
    d = None
    print(label, "metadata unavailable:", str(error), file=sys.stderr)
keys = ("url_effective", "remote_ip", "remote_port", "http_version", "http_code",
        "ssl_verify_result", "time_appconnect", "time_starttransfer", "time_total")
if d is not None:
    print(label, json.dumps({k: d[k] for k in keys + ("exitcode", "errormsg") if k in d}))
    missing = [k for k in keys if k not in d]
    if missing:
        print(label, "metadata fields unavailable:", ", ".join(missing), file=sys.stderr)
try:
    headers = pathlib.Path(path).with_suffix(".headers").read_text(encoding="iso-8859-1")
    print(label, "Alt-Svc header observations:",
          [line for line in headers.splitlines() if line.lower().startswith("alt-svc:")])
except OSError as error:
    print(label, "header observations unavailable:", str(error), file=sys.stderr)
if int(curl_exit) != 0:
    # Observations from a failed transfer are not successful validation.
    raise SystemExit(0)
try:
    ok = (d is not None and headers is not None and d["http_code"] == 200 and
          d["url_effective"] == url and d["http_version"] in ("1.1", "2", "3") and
          d["remote_ip"] and d["remote_port"] > 0 and d["ssl_verify_result"] == 0 and
          (expected == "any" or d["http_version"] == expected) and
          all(math.isfinite(d[k]) and d[k] >= 0 for k in
              ("time_appconnect", "time_starttransfer", "time_total")))
except (KeyError, TypeError, ValueError):
    ok = False
if not ok:
    raise SystemExit(label + ": unavailable or unexpected endpoint, protocol, status or timing")
PY
    then
        check_rc=0
    else
        check_rc=$?
    fi
    if [ "$rc" -ne 0 ]; then
        return "$rc"
    fi
    return "$check_rc"
}
failed=0
probe h2 --http2 2 || failed=1
probe h3-only --http3-only 3 || failed=1
probe fallback-enabled --http3 any || failed=1
exit "$failed"
)

(
set -euo pipefail
umask 077
tmp=$(mktemp -d)
trap 'rm -rf -- "$tmp"' EXIT
if nginx -T > "$tmp/nginx.txt" 2> "$tmp/nginx.err"; then
    cat "$tmp/nginx.err" >&2
else
    rc=$?
    cat "$tmp/nginx.err" >&2
    exit "$rc"
fi
if grep -nE 'listen .*quic|http2|http3|Alt-Svc' "$tmp/nginx.txt"; then
    :
else
    rc=$?
    printf 'No matching directives, or grep failed (exit %s)\n' "$rc" >&2
    exit "$rc"
fi
ss -H -lunp 'sport = :443' > "$tmp/udp.txt"
cat "$tmp/udp.txt"
if [ ! -s "$tmp/udp.txt" ]; then
    printf 'No local UDP:443 listener observed\n' >&2
    exit 1
fi
)