Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

HTTP/3 for everyone

1,878 views

Published on



HTTP/3 is designed to improve in areas where HTTP/2 still has some shortcomings, primarily by changing the transport layer. HTTP/3 is the first major protocol to step away from TCP and instead it uses QUIC.

HTTP/3 is the designated name for the coming next version of the protocol that is currently under development within the QUIC working group in the IETF.

HTTP/3 is designed to improve in areas where HTTP/2 still has some shortcomings, primarily by changing the transport layer. HTTP/3 is the first major protocol to step away from TCP and instead it uses QUIC.

Daniel Stenberg does a presentation about HTTP/3 and QUIC. Why the new protocols are deemed necessary, how they work, how they change how things are sent over the network and what some of the coming deployment challenges will be.

Published in: Technology
  • Be the first to comment

HTTP/3 for everyone

  1. 1. DanielStenberg–FOSDEM-February1st ,2020 For everyone!
  2. 2. Daniel Stenberg @bagderhttps://daniel.haxx.se
  3. 3. Daniel Stenberg @bagder
  4. 4. Daniel Stenberg @bagder
  5. 5. HTTP 1 to 2 to 3HTTP 1 to 2 to 3 ProblemsProblems Why QUIC and how it worksWhy QUIC and how it works HTTP/3HTTP/3 ChallengesChallenges Coming soon?Coming soon? @bagder@bagder
  6. 6. Echo? I talked HTTP/3 at FOSDEM 2019 in the Mozilla devroom This is not just a rerun I promise @bagder@bagder
  7. 7. HTTP/1 HTTP/2 HTTP/3 @bagder@bagder
  8. 8. Under the hood GET / HTTP/1.1 Host: www.example.com Accept: */* User-Agent: HTTP-eats-the-world/2020 HTTP/1.1 200 OK Date: Thu, 09 Nov 2018 14:49:00 GMT Server: my-favorite v3 Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT Content-Length: 12345 Set-Cookie: this-is-simple=yeah-really; Content-Type: text/html [content] @bagder@bagder
  9. 9. HTTP began over TCP @bagder@bagder
  10. 10. TCPTCP TCP is transport over IP Establishes a “connection” 3-way handshake Resends lost packages A reliable byte stream Clear text @bagder@bagder
  11. 11. HTTPS means TCP + TLS + HTTP @bagder@bagder
  12. 12. @bagder@bagder Web pages over HTTPS in Firefox
  13. 13. @bagder@bagder Web pages over HTTPS in Chrome
  14. 14. TLSTLS TLS is done over TCP for HTTP/1 or 2 Transport Layer Security Additional handshake Privacy and security @bagder@bagder
  15. 15. Classic HTTPS stack IP TCP TLS HTTP @bagder@bagder
  16. 16. HTTP over TCP @bagder@bagder
  17. 17. HTTP/1.1HTTP/1.1 Shipped January 1997 Many parallel TCP connections Better but ineffective TCP use HTTP head-of-line-blocking Numerous work-arounds @bagder@bagder
  18. 18. HTTP/2HTTP/2 Shipped May 2015 Uses single connection per host Many parallel streams TCP head-of-line-blocking @bagder@bagder
  19. 19. OssificationOssification Internet is full of boxes Routers, gateways, firewalls, load balancers, NATs... Boxes run software to handle network data Middle-boxes work on existing protocols Upgrade much slower than edges @bagder@bagder
  20. 20. Internet WWW @bagder@bagder
  21. 21. Ossification casualties HTTP/2 in clear textHTTP/2 in clear text TCP improvements like TFOTCP improvements like TFO TCP/UDP replacementsTCP/UDP replacements HTTP brotliHTTP brotli Future innovationsFuture innovations …… unless encryptedunless encrypted @bagder@bagder
  22. 22. Improvement in spite of ossification @bagder@bagder
  23. 23. @bagder@bagder
  24. 24. @bagder@bagder QUIC is a name, not an acronym.
  25. 25. @bagder@bagder
  26. 26. A new transport protocol @bagder@bagder
  27. 27. Built on experiences by Google QUIC Google deployed “http2 frames over UDP”-QUIC in 2013Google deployed “http2 frames over UDP”-QUIC in 2013 Widely used clientWidely used client Widely used web servicesWidely used web services Proven to work at web scaleProven to work at web scale Taken to the IETF in 2015Taken to the IETF in 2015 QUIC working group started 2016QUIC working group started 2016 IETF QUIC is now very different than Google QUIC wasIETF QUIC is now very different than Google QUIC was @bagder@bagder
  28. 28. Improvements TCP head of line blockingTCP head of line blocking Faster handshakesFaster handshakes Earlier dataEarlier data Connection-IDConnection-ID More encryption, alwaysMore encryption, always Future developmentFuture development @bagder@bagder
  29. 29. Build on top of UDP TCP and UDP remain “the ones”TCP and UDP remain “the ones” Use UDP instead of IPUse UDP instead of IP Reliable transport protocol - inReliable transport protocol - in user-spaceuser-space A little like TCP + TLSA little like TCP + TLS @bagder@bagder
  30. 30. UDP isn’t reliable, QUIC is UDP Connectionless No resends No flow control No ordering @bagder@bagder QUIC Uses UDP like TCP uses IP Adds connections Reliability Flow control Security
  31. 31. QUIC has streamsQUIC has streams Many logical flows within a single connectionMany logical flows within a single connection Similar to HTTP/2 but in the transport layerSimilar to HTTP/2 but in the transport layer Client or server initiatedClient or server initiated Bidirectional or unidirectionalBidirectional or unidirectional IndependentIndependent streamsstreams @bagder@bagder
  32. 32. Independent streamsIndependent streams TCPTCP QUICQUIC @bagder@bagder
  33. 33. Application protocols over QUICApplication protocols over QUIC Streams for free Could be “any protocol” HTTP worked on as the first Others are planned to follow @bagder@bagder
  34. 34. HTTP/3 = HTTP over QUIC @bagder@bagder
  35. 35. HTTP – same but different RequestRequest - method + path- method + path - headers- headers - body- body ResponseResponse - response code- response code - headers- headers - body- body @bagder@bagder
  36. 36. HTTP – same but different HTTP/1 – in ASCII over TCP HTTP/2 – binary multiplexed over TCP HTTP/3 – binary over multiplexed QUIC @bagder@bagder
  37. 37. HTTPS stacks: old vs new TCP TLS HTTP/2 UDP HTTP/3 QUIC TLS 1.3 IP HTTP/1 @bagder@bagder streams
  38. 38. HTTP feature comparison @bagder@bagder HTTP/2 HTTP/3 Transport TCP QUIC Streams HTTP/2 QUIC Clear-text version Yes No Independent streams No Yes Header compression HPACK QPACK Server push Yes Yes Early data In theory Yes 0-RTT Handshake No Yes Prioritization Messy Changes
  39. 39. “The ultimate guide to HTTP resource prioritization” Who: Robin Marx Where: Web Performance devroom (H.1309) When: 17:00 (today, Saturday) @bagder@bagder (I bet it is already too late to get a seat in that room, so relax and watch the video after the fact instead.)
  40. 40. HTTP/3 is fasterHTTP/3 is faster Faster handshakes Early data that works The independent streams By how much remains to be measured! @bagder@bagder (Thanks to QUIC)(Thanks to QUIC)
  41. 41. HTTPS:// is TCP? HTTPS:// URLs are everywhereHTTPS:// URLs are everywhere TCP (and TLS) on TCP port 443TCP (and TLS) on TCP port 443 @bagder@bagder
  42. 42. This service - over there! The Alt-Svc: response header Another host, protocol or port number is the same “origin” This site also runs on HTTP/3 “over there”, for the next NNNN seconds @bagder@bagder
  43. 43. Race connections? Might be faster Probably needed anyway QUIC connections verify the cert HTTPSSVC – alt-svc: done in DNS @bagder@bagder
  44. 44. Will HTTP/3 deliver? @bagder@bagder
  45. 45. UDP challenges 3-7% of QUIC attempts fail Clients need fall back algorithms QUIC looks like a DDOS attack @bagder@bagder
  46. 46. CPU hog 2-3 times the CPU use Unoptimized UDP stacks Non-ideal UDP APIs Missing hardware offload @bagder@bagder
  47. 47. The TLS situation (1/2) TLS was made for TCP TLS is sent over TCP as records containing individual messages QUIC uses TLS messages No TLS library support(ed) TLS messages QUIC also needs additional secrets @bagder@bagder
  48. 48. The TLS situation (2/2) @bagder@bagder Frame 0 Message 0 Message 1 Frame 1 Message 2 Message 3TCPTCP Message 0 Message 1 Message 2 Message 3 QUICQUIC
  49. 49. Userland All QUIC stacks are user-land No standard QUIC API Will it be moved to kernels? @bagder@bagder
  50. 50. Tooling Lack of tooling Hooray for qlog & qvis @bagder@bagder
  51. 51. Ship date @bagder@bagder 2020?
  52. 52. Implementations Over a dozen QUIC and HTTP/3 implementations Google, Mozilla, Apple, Facebook, Microsoft, Akamai, Fastly, Cloudflare, F5, LiteSpeed, Apache, and more C, C++, Go, Rust, Python, Java, TypeScript, Erlang Monthly interops @bagder@bagder
  53. 53. Implementation Status curl Chrome and Edge Canary, Firefox Nightly Caddy and LiteSpeed nginx-patch + quiche Wireshark @bagder@bagder No Safari No Apache httpd, IIS or official nginx OpenSSL PR #8797
  54. 54. Browsers: bleeding edge h3 @bagder@bagder --enable-quic --quic-version=h3-24 about:config network.http.http3.enabled
  55. 55. in ExperimentalExperimental h3-25 works! Alt-svcAlt-svc support is there Based on ngtcp2ngtcp2 and FallbackFallback is tricky @bagder@bagder Try it! Try it!
  56. 56. $ curl --http3 --head https://example.com/ HTTP/3 200 date: Wed, 09 Oct 2019 11:16:06 GMT content-type: text/html content-length: 10602 set-cookie: crazy=d8bc7e7; expires=Thu, 08-Oct-22 11:16:06 GMT; path=/; domain=example.com; alt-svc: h3-24=":443"; ma=86400 @bagder@bagder curl HTTP/3 command line
  57. 57. Specifications Ship curl HTTP/3-enabled?Ship curl HTTP/3-enabled? Deployed servers Browser support libcurl TLS libraries QUIC and HTTP/3 libraries @bagder@bagder
  58. 58. HTTP/3 will take timeHTTP/3 will take time HTTP/3 will grow slowerHTTP/3 will grow slower Some will stick to HTTP/2Some will stick to HTTP/2 QUIC is for the long termQUIC is for the long term @bagder@bagder
  59. 59. FutureFuture MultipathMultipath Forward error correctionForward error correction Unreliable streamsUnreliable streams More application protocolsMore application protocols @bagder@bagder Partial reliabilityPartial reliability
  60. 60. Wait a minute, what about... @bagder@bagder
  61. 61. Websockets? Not actually a part of HTTP(/3) RFC 8441 took a long time for HTTP/2 Can probably be updated for HTTP/3 draft-vvv-webtransport-http3-01 Still in progress @bagder@bagder
  62. 62. Take-aways HTTP/3 is comingHTTP/3 is coming HTTP/3 is always encryptedHTTP/3 is always encrypted Similar to HTTP/2 but over QUICSimilar to HTTP/2 but over QUIC QUIC is transport over UDPQUIC is transport over UDP Challenges to overcomeChallenges to overcome Mid 2020?Mid 2020? @bagder@bagder
  63. 63. HTTP/3 Explained https://daniel.haxx.se/http3-explained @bagder@bagder
  64. 64. Daniel Stenberg @bagder https://daniel.haxx.se/ Thank you!Thank you! Questions?Questions? @bagder@bagder
  65. 65. License This presentation is provided under the Creative Commons Attribution 4.0 International Public License @bagder@bagder
  66. 66. Links to data and more info QUIC drafts: https://quicwg.github.io/ DATAGRAM: https://tools.ietf.org/html/draft-pauly-quic-datagram-05 QUIC multipath: https://tools.ietf.org/html/draft-deconinck-quic-multipath-03 HTTPS stats Firefox: https://letsencrypt.org/stats/#percent-pageloads HTTPS stats Chrome: https://transparencyreport.google.com/https/overview?hl=en Web Transport: https://tools.ietf.org/html/draft-vvv-webtransport-http3-01 Images: http://www.simonstalenhag.se/ and https://pixabay.com/ HTTP/3 Explained: https://http3-explained.haxx.se/ QUIC implementations: https://github.com/quicwg/base-drafts/wiki/Implementations Nginx + quiche: https://github.com/cloudflare/quiche/tree/master/extras/nginx HTTPSSVC: https://tools.ietf.org/html/draft-ietf-dnsop-svcb-httpssvc-01 qlog: https://github.com/quiclog/internet-drafts qvis: https://qvis.edm.uhasselt.be Build curl with HTTP/3: https://github.com/curl/curl/blob/master/docs/HTTP3.md @bagder@bagder

×