HTTP/2, HTTP/3 and SSL/TLS State of the Art in Our Servers
1 like1,736 views
Jean-Frederic Clere presented on HTTP/2, HTTP/3 and SSL/TLS in servers. He discussed the latest developments in HTTP/3 using QUIC and TLS 1.3 over UDP. For HTTP/2, he covered implementations in Apache Tomcat, Apache HTTP Server, and Traffic Server. He demonstrated improved performance of HTTP/2 over HTTP/1.1 and discussed configuration requirements and options for enabling HTTP/2 in each server. The presentation concluded that HTTP/2 is ready for production use without server modifications to realize performance gains.
HTTP/2, HTTP/3 and SSL/TLS State of the Art in Our Servers
- 1. APACHECON North America Sept. 9-12, 2019 HTTP/2, HTTP/3 and SSL/TLSHTTP/2, HTTP/3 and SSL/TLS State of theState of the ArtArt in Our Serversin Our Servers Jean-Frederic ClereJean-Frederic Clere
- 2. APACHECON North America What I will coverWhat I will cover ● HTTP/3 ● HTTP/2 ● HTTP/2 and ALPN ● Servers ● Apache HTTPD ● Tomcat ● Traffic server ● Demos ● Questions? 2
- 3. APACHECON North America Who I amWho I am Jean-Frederic Clere Red Hat Years writing JAVA code and server software Tomcat committer since 2001 Doing OpenSource since 1999 Cyclist/Runner etc Lived 15 years in Spain (Barcelona) Now in Neuchâtel (CH) 3
- 4. APACHECON North America HTTP/3 (March 2018, in progress!)HTTP/3 (March 2018, in progress!) – Use QUIC / TLS-1.3 / UDP – To transport HTTP like HTTP/2 – Initial connection TPC + Alt-Svc ● Response Alt-Svc: h3=":56666": – problems: ● UDP ports closed ● UDP slower than TPC in Kernels ● Needs extra CPU (?) – Specifications: ● Several RFC (6 RFC) 4
- 5. APACHECON North America HTTP/3 implementations: – Curl (http3-direct and Alt-Svc way) – Libraries ● ngtcp2 ● quiche – Apache Tomcat: Problem UDP socket API incomplete – Apache HTTPD: need time probably like http/2 – Traffic Server: planed for the next version (end 2019) ● See ATS proto / curl demo
- 6. APACHECON North America HTTP/3 more info: – Demo ATS / curl – Playing browsers: ● test browser ● Interop matrix ● chrome activation
- 7. APACHECON North America Why HTTP/2Why HTTP/2 – HTTP/1.1: June 1999 (RFC 2616) ● 1999: – 1 page ~ 1kB HTML ● 2019: – 1 page ~ 3MB HTML + IMAGES + JS + CSS etc – Protocol: ● Not adapted / inefficient / etc 7
- 8. APACHECON North America HTTP/2 generalHTTP/2 general ● HTTP/2: – Binary – Frame – Multiplex – Based on SPDY – TLS everywhere: ● Browers use https and strong ciphers – No forward proxy – h2c: Clear text only with reverse proxy (proxy to back-end server) 8
- 9. APACHECON North America HTTP/2 generalHTTP/2 general ● Two specifications: – Hypertext Transfer Protocol version 2 - RFC7540 – HPACK - Header Compression for HTTP/2 - RFC7541 ● By the Internet Engineering Task Force ● ALPN Application-Layer Protocol Negotiation - RFC 7301 9
- 10. APACHECON North America HTTP/2 MultiplexedHTTP/2 Multiplexed 10 Headers Data Headers Headers Headers Data Data Headers Data Data HeadersData Headers
- 11. APACHECON North America HTTP/2 : moreHTTP/2 : more ● HTTP headers compression – ~ 80 % save ● Request priority – Both sides ● Server Push – Prevent round trip to get element of a page – Faster / better rendering on browsers. 11
- 12. APACHECON North America HTTP/2 With BrowsersHTTP/2 With Browsers ● Browser with HTTP/2 and TLS – FireFox 34 – Chrome 40 (with ALPN before was NPN) – IE 11 – Opera and Safari 9 ● Stats from docs.trafficserver and ci.trafficserver: – 80% is over HTTP/2 (data from last year) ● → go for it now! 12
- 13. APACHECON North America ALPN Client Hello (Firefox)ALPN Client Hello (Firefox) 13
- 14. APACHECON North America ALPN Server Hello (tomcat)ALPN Server Hello (tomcat) 14
- 15. APACHECON North America RequirementsRequirements ● OpenSSL for our 3 servers – At least 1.0.2c ● Tomcat (8.5 / trunk) – Tomcat-native (1.2.6 / trunk) or java9 ● Httpd (2.4.17 / trunk) – HTTP/2 C Library (libnghttp2) ● TrafficServer (since ATS v5.3.2). – Nothing except openssl. 15
- 16. APACHECON North America StatusStatus ● Tomcat (trunk/8.5) – Full support / released as stable. – Needs servlet 4.0 (JSR 369) for server PUSH API – Can't be full JAVA until JDK9 (ALPN support) ● Httpd (available since 2.4.17) – Full support (since 2.4.20) ● TrafficServer (since 5.3.0) (flow control 6.1) – Priorities (6.2.0) and Server PUSH (7.0.0) 16
- 17. APACHECON North America TC connector server.xmlTC connector server.xml <Connector port="8002" scheme="https" SSLEnabled="true" ciphers="TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" SSLCertificateFile="/home/jfclere/CERTS/newcert.pem" SSLCertificateKeyFile="/home/jfclere/CERTS/newkey.txt.pem" protocol="org.apache.coyote.http11.Http11AprProtocol"> <UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" /> <Connector/> <Connector port="8003" protocol="HTTP/1.1" SSLEnabled="true" scheme="https" secure="true" keystoreFile="conf/.keystore" keystorePass="changeit" socket.directBuffer="true" socket.directSslBuffer="true"> <UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" /> </Connector>
- 18. APACHECON North America Tomcat / configurationTomcat / configuration In bin/setenv.sh: LD_LIBRARY_PATH=/home/jfclere/tomcat-native/native/.libs export LD_LIBRARY_PATH And the libtcnative-1.so linked with openssl-1.0.2c, checking with ldd: libssl.so.1.0.0 => /home/jfclere/OPENSSL-1.0.2c/lib/libssl.so.1.0.0 (0x00007f6ab147b000) libcrypto.so.1.0.0 => /home/jfclere/OPENSSL-1.0.2c/lib/libcrypto.so.1.0.0 (0x00007f6ab1028000) libapr-1.so.0 => /home/jfclere/APR-1.4.x/lib/libapr-1.so.0 (0x00007f6ab0dfa000) Usually the openssl of recent distribution (fedora 23) will work. 18
- 19. APACHECON North America Tomcat / PerformancesTomcat / Performances 19 4KiB.bin 8KiB.bin 16KiB.bin 32KiB.bin 64KiB.bin 128KiB.bin 256KiB.bin 512KiB.bin 1MiB.bin 0 50000 100000 150000 200000 250000 300000 350000 400000 Concurency 240 coyote_nio_jsse_h1_https coyote_nio_jsse_h2_https File Size Kbytes/second
- 20. APACHECON North America Tomcat / PerformancesTomcat / Performances 20 4KiB 8KiB 16KiB 32KiB 64KiB 128KiB 256KiB 512KiB 1MiB 0 10 20 30 40 50 60 70 80 90 Concurency 240 coyote_nio_jsse_h1_https coyote_nio_jsse_h2_https File Size CPUUsage
- 21. APACHECON North America Tomcat / DemoTomcat / Demo ● No server push (may be change it: SimpleImagePush) ● Multiplexing ● headers compression ● HTML page: – That requires a lot (~1000) of (~4Kbytes) images to render. 21
- 22. APACHECON North America TrafficServer / ConfigurationTrafficServer / Configuration ● records.config – CONFIG proxy.config.ssl.number.threads INT 0 – CONFIG proxy.config.http.server_ports STRING 8888:ssl – CONFIG proxy.config.url_remap.pristine_host_hdr INT 1 – CONFIG proxy.config.http2.enabled INT 1 – CONFIG proxy.config.ssl.TLSv1_1 INT 1 – CONFIG proxy.config.ssl.TLSv1_2 INT 1 ● ssl_multicert.config: – dest_ip=* ssl_cert_name=newcert.pem ssl_key_name=newkey.txt.pem ● remap.config: – map / http://127.0.0.1:8080 ● ip_allow.config: – src_ip=192.168.1.38 action=ip_allow method=ALL – src_ip=::-ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff action=ip_allow method=ALL 22
- 23. APACHECON North America TrafficServer / DemoTrafficServer / Demo ● Like tomcat one ● Uses http/1.1 tomcat nio connector on 8080 as back-end. 23
- 24. APACHECON North America HTTPd / ConfigurationHTTPd / Configuration ● httpd.conf: LoadModule h2_module modules/mod_h2.so Listen 8006 <VirtualHost *:8006> Protocols h2 http/1.1 ProtocolsHonorOrder on SSLEngine on SSLCertificateFile "/home/jfclere/CERTS/newcert.pem" SSLCertificateKeyFile "/home/jfclere/CERTS/newkey.pem" SSLCACertificateFile "/etc/pki/CA/cacert.pem" </VirtualHost> 24
- 25. APACHECON North America HTTPd / PerformancesHTTPd / Performances 25 4KiB.bin 8KiB.bin 16KiB.bin 32KiB.bin 64KiB.bin 128KiB.bin 256KiB.bin 512KiB.bin 1MiB.bin 0 50000 100000 150000 200000 250000 300000 350000 400000 Concurency 240 httpd_h1_https httpd_h2_https File Size KBytes/second
- 26. APACHECON North America HTTPd / PerformancesHTTPd / Performances 26 4KiB 8KiB 16KiB 32KiB 64KiB 128KiB 256KiB 512KiB 1MiB 0 10 20 30 40 50 60 70 80 Concurency 240 httpd_h1_https httpd_h2_https File Szie CPUusage
- 27. APACHECON North America HTTPd / Configuration proxyHTTPd / Configuration proxy ● httpd.conf: LoadModule http2_module modules/mod_http2.so LoadModule proxy_http2_module modules/mod_proxy_http2.so Listen 8006 <VirtualHost *:8006> Protocols h2 http/1.1 ProtocolsHonorOrder on SSLEngine on … ProxyPass "/" "h2c://localhost:8003/" </VirtualHost> 27
- 28. APACHECON North America HTTPd / DemoHTTPd / Demo ● Like the tomcat one: – htdocs/http2.html – htdocs/images/ the images. 28
- 29. APACHECON North America HTTP/2 ready?HTTP/2 ready? ● Conclusion: – Using HTTP/2 without PUSH is already good. – “safer” crypto is good but expensive. – No need to rewrite application to get the gains. HTTP/2 : GO FOR IT 29
- 30. APACHECON North America Questions?Questions? Thank you!Thank you! ● jfclere@gmail.com ● users@tomcat.apache.org ● users@httpd.apache.org ● users@trafficserver.apache.org ● https://http2.github.io/ ● Demo generator: https://github.com/jfclere/h2_demos ● HTTP/3 see curl docs: http3-explained by Daniel 30