HTTP/3 over QUIC. All is new but still the same!
5 likes1,000 views
The document discusses HTTP/3, which is built on QUIC, a protocol developed by Google to improve performance and security over existing HTTP/1 and HTTP/2. It highlights the benefits of HTTP/3, including faster handshakes, independent streams, and always-on encryption, while also addressing challenges such as client fallback and CPU-intensive implementations. The document provides implementation status updates and anticipates a gradual adoption of HTTP/3 due to challenges in transitioning from HTTP/2.
![Under the hood
GET / HTTP/1.1
Host: www.example.com
Accept: */*
User-Agent: HTTP-eats-the-world/2019
HTTP/1.1 200 OK
Date: Thu, 09 Nov 2018 14:49:00 GMT
Server: my-favorite v3
Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
Content-Length: 12345
Set-Cookie: this-is-simple=yeah-really;
Content-Type: text/html
[content]
@bagder@bagder](https://image.slidesharecdn.com/http3-internetdagarna-2019-191125105344/85/HTTP-3-over-QUIC-All-is-new-but-still-the-same-7-320.jpg)
HTTP/3 over QUIC. All is new but still the same!
- 1. Nov 25, 2019 HTTP/3 over QUIC. All is new but still the same
- 5. HTTP 1 to 2 to 3HTTP 1 to 2 to 3 ProblemsProblems Why QUIC and how it worksWhy QUIC and how it works HTTP/3HTTP/3 ChallengesChallenges Coming soon!Coming soon! @bagder@bagder
- 7. Under the hood GET / HTTP/1.1 Host: www.example.com Accept: */* User-Agent: HTTP-eats-the-world/2019 HTTP/1.1 200 OK Date: Thu, 09 Nov 2018 14:49:00 GMT Server: my-favorite v3 Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT Content-Length: 12345 Set-Cookie: this-is-simple=yeah-really; Content-Type: text/html [content] @bagder@bagder
- 8. HTTP started done over TCP @bagder@bagder
- 9. TCPTCP TCP/IP works over IP Establishes a “connection” 3-way handshake Resends lost packages Delivers a byte stream Clear text @bagder@bagder
- 10. HTTPS means TCP + TLS + HTTP @bagder@bagder
- 11. @bagder@bagder Percentage of Web Pages Loaded by Firefox Using HTTPS
- 12. @bagder@bagder Percentage of pages loaded over HTTPS in Chrome by platform
- 13. TLSTLS TLS is done over TCP for HTTP/1 or 2 Transport Layer Security Additional handshake Privacy and security @bagder@bagder
- 14. Classic HTTP Network Stack IP TCP TLS 1.2+ HTTP @bagder@bagder
- 16. HTTP/1.1HTTP/1.1 Shipped January 1997 Many parallel TCP connections Better but ineffective TCP use HTTP head-of-line-blocking Numerous work-arounds @bagder@bagder
- 17. HTTP/2HTTP/2 Shipped May 2015 Uses single connection per host Many parallel streams TCP head-of-line-blocking @bagder@bagder
- 18. OssificationOssification Internet is full of boxes Routers, gateways, firewalls, load balancers, NATs... Boxes run software to handle network data Middle-boxes work on existing protocols Upgrade much slower than edges @bagder@bagder
- 20. Ossification casualties HTTP/2 in clear textHTTP/2 in clear text TCP improvements like TFOTCP improvements like TFO TCP/UDP replacementsTCP/UDP replacements HTTP brotliHTTP brotli Future innovationsFuture innovations …… unless encryptedunless encrypted @bagder@bagder
- 21. Improvement in spite of ossification @bagder@bagder
- 22. @bagder@bagder
- 23. @bagder@bagder
- 24. A new transport protocol @bagder@bagder
- 25. Built on experiences by Google QUIC Google deployed “http2 frames over UDP”-QUIC in 2013Google deployed “http2 frames over UDP”-QUIC in 2013 Widely used clientWidely used client Widely used web servicesWidely used web services Proven to work at web scaleProven to work at web scale Taken to the IETF in 2015Taken to the IETF in 2015 QUIC working group started 2016QUIC working group started 2016 IETF QUIC is now very different than Google QUIC wasIETF QUIC is now very different than Google QUIC was @bagder@bagder
- 26. Improvements TCP head of line blockingTCP head of line blocking Faster handshakesFaster handshakes Earlier dataEarlier data Connection-IDConnection-ID More encryption, alwaysMore encryption, always Future developmentFuture development @bagder@bagder
- 27. Build on top of UDP TCP and UDP remain “the ones”TCP and UDP remain “the ones” Use UDP instead of IPUse UDP instead of IP Reliable transport protocol - inReliable transport protocol - in user-spaceuser-space A little like TCP + TLSA little like TCP + TLS @bagder@bagder
- 28. UDP isn’t reliable, QUIC is UDP Connectionless No resends No flow control No ordering @bagder@bagder QUIC Uses UDP like TCP uses IP Adds connections, reliability, flow control, security
- 29. Streams! QUIC provides streamsQUIC provides streams Many logical flows within a single connectionMany logical flows within a single connection Similar to HTTP/2 but in the transport layerSimilar to HTTP/2 but in the transport layer IndependentIndependent streamsstreams @bagder@bagder
- 31. Application protocols over QUICApplication protocols over QUIC Streams for free Could be “any protocol” HTTP worked on as the first Others are planned to follow @bagder@bagder
- 32. HTTP/3 = HTTP over QUIC @bagder@bagder
- 33. HTTP – same but different RequestRequest - method + path- method + path - headers- headers - body- body ResponseResponse - response code- response code - headers- headers - body- body @bagder@bagder
- 34. HTTP – same but different HTTP/1 – in ASCII over TCP HTTP/2 – binary multiplexed over TCP HTTP/3 – binary over multiplexed QUIC @bagder@bagder
- 35. Stacks: old vs new TCP TLS 1.2+ HTTP/2 UDP HTTP/3 QUIC TLS 1.3 IP HTTP/1 @bagder@bagder streams
- 36. HTTP feature comparison @bagder@bagder HTTP/2 HTTP/3 Transport TCP QUIC Streams HTTP/2 QUIC Clear-text version Yes No Independent streams No Yes Header compression HPACK QPACK Server push Yes Yes Early data In theory Yes 0-RTT Handshake No Yes Prioritization Messy Changes
- 37. HTTP/3 is fasterHTTP/3 is faster Faster handshakes Early data that works The independent streams By how much remains to be measured! @bagder@bagder (Thanks to QUIC)(Thanks to QUIC)
- 38. HTTPS is TCP? HTTPS:// URLs are everywhereHTTPS:// URLs are everywhere TCP (and TLS) on TCP port 443TCP (and TLS) on TCP port 443 @bagder@bagder
- 39. This service - over there! The Alt-Svc: response header Another host, protocol or port number is the same “origin” This site also runs on HTTP/3 “over there”, for the next NNNN seconds @bagder@bagder
- 40. Race connection attempts? Might be faster Needed occasionally anyway QUIC connections verify the host cert HTTPSSVC @bagder@bagder
- 42. Eight HTTP/3 challenges 3-7% of QUIC attempts fail Clients need fall back algorithms 1 2 3 4 5 6 7 8 @bagder@bagder
- 43. Eight HTTP/3 challenges CPU intensive Unoptimized UDP stacks 1 2 3 4 5 6 7 8 @bagder@bagder
- 44. Eight HTTP/3 challenges “Funny” TLS layer 1 2 3 4 5 6 7 8 @bagder@bagder
- 45. Eight HTTP/3 challenges All QUIC stacks are user-land No standard QUIC API 1 2 3 4 5 6 7 8 @bagder@bagder
- 46. Eight HTTP/3 challenges Lack of tooling 1 2 3 4 5 6 7 8 @bagder@bagder
- 48. Implementations Over a dozen QUIC and HTTP/3 implementations Google, Mozilla, Apple, Facebook, Microsoft, Akamai, Fastly, Cloudflare, F5, LiteSpeed, Apache, and more C, C++, Go, Rust, Python, Java, TypeScript, Erlang Monthly interops @bagder@bagder
- 49. Implementation Status curl Chrome and Edge Canary Firefox Nightly Caddy ngx_quic + quiche @bagder@bagder No Safari No Apache nor IIS OpenSSL PR #8797
- 50. HTTP/3 in curl ExperimentalExperimental h3-24 works! Alt-svcAlt-svc support is there Based on ngtcp2ngtcp2 and quichequiche FallbackFallback is tricky @bagder@bagder Try it! Try it!
- 51. $ curl --http3 --head https://example.com/ HTTP/3 200 date: Wed, 09 Oct 2019 11:16:06 GMT content-type: text/html content-length: 106072 set-cookie: cfduid=d8bc7e716b30f10766; expires=Thu, 08- Oct-20 11:16:06 GMT; path=/; domain=example.com; alt-svc: h3-24=":443"; ma=86400 @bagder@bagder curl HTTP/3 command line
- 52. @bagder@bagder Fetch HTTP/3 from PHP* if (!defined('CURL_HTTP_VERSION_3')) { define('CURL_HTTP_VERSION_3', 30); } $ch = curl_init("https://example.com"); curl_setopt($ch, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_3); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); $output = curl_exec($ch); curl_close($ch); * = requires only an experimental libcurl build
- 53. Specifications Ship curl HTTP/3-enabled? Deployed servers Browser support libcurl TLS libraries QUIC and HTTP/3 libraries @bagder@bagder
- 54. HTTP/3 will take timeHTTP/3 will take time HTTP/3 will grow slowerHTTP/3 will grow slower Some will stick to HTTP/2Some will stick to HTTP/2 QUIC is for the long termQUIC is for the long term @bagder@bagder
- 55. FutureFuture MultipathMultipath Forward error correctionForward error correction Unreliable streamsUnreliable streams More application protocolsMore application protocols @bagder@bagder
- 56. Websockets? Not actually a part of HTTP(/3) RFC 8441 took a long time for HTTP/2 Can probably be updated for HTTP/3 draft-vvv-webtransport-http3-01 Still in progress @bagder@bagder
- 57. Take-aways HTTP/3 is coming soonHTTP/3 is coming soon HTTP/3 is always encryptedHTTP/3 is always encrypted Similar to HTTP/2 but over QUICSimilar to HTTP/2 but over QUIC QUIC is transport over UDPQUIC is transport over UDP Challenges to overcomeChallenges to overcome Early/mid 2020?Early/mid 2020? @bagder@bagder
- 59. Daniel Stenberg @bagder https://daniel.haxx.se/ Thank you!Thank you! Questions?Questions? @bagder@bagder
- 60. License This presentation is provided under the Creative Commons Attribution 4.0 International Public License @bagder@bagder
- 61. QUIC and HTTP/3 links QUIC drafts: https://quicwg.github.io/ HTTPS stats Firefox: https://letsencrypt.org/stats/#percent-pageloads HTTPS stats Chrome: https://transparencyreport.google.com/https/overview?hl=en Images: http://www.simonstalenhag.se/ and https://pixabay.com/ HTTP/3 Explained: https://http3-explained.haxx.se/ QUIC implementations: https://github.com/quicwg/base-drafts/wiki/Implementations HTTPSSVC: https://tools.ietf.org/html/draft-nygren-dnsop-svcb-httpssvc-00 Build curl with HTTP/3: https://github.com/curl/curl/blob/master/docs/HTTP3.md @bagder@bagder