Mercurial > hg > nginx-quic
annotate README @ 7949:032cb35ce758 quic
HTTP/3: http3_max_field_size directive to limit string size.
Client streams may send literal strings which are now limited in size by the
new directive. The default value is 4096.
The directive is similar to HTTP/2 directive http2_max_field_size.
| author | Roman Arutyunyan <arut@nginx.com> |
|---|---|
| date | Mon, 29 Jun 2020 15:56:14 +0300 |
| parents | 3c32717d7bb2 |
| children | 6e84524886d4 |
| rev | line source |
|---|---|
| 7843 | 1 Experimental QUIC support for nginx |
| 2 ----------------------------------- | |
| 3 | |
| 4 1. Introduction | |
| 5 2. Installing | |
| 6 3. Configuration | |
| 7 4. Clients | |
| 8 5. Troubleshooting | |
|
7887
c7d1b500bd0a
Updated README with "Contributing" section and draft details.
Vladimir Homutov <vl@nginx.com>
parents:
7879
diff
changeset
|
9 6. Contributing |
|
c7d1b500bd0a
Updated README with "Contributing" section and draft details.
Vladimir Homutov <vl@nginx.com>
parents:
7879
diff
changeset
|
10 7. Links |
| 7843 | 11 |
| 12 1. Introduction | |
| 13 | |
| 14 This is an experimental QUIC [1] / HTTP/3 [2] support for nginx. | |
| 15 | |
| 16 The code is developed in a separate "quic" branch available | |
| 17 at https://hg.nginx.org/nginx-quic. Currently it is based | |
|
7907
4ea302a47d28
README: update after merging 1.19.0.
Sergey Kandaurov <pluknet@nginx.com>
parents:
7887
diff
changeset
|
18 on nginx mainline 1.19.x. We are planning to merge new nginx |
| 7843 | 19 releases into this branch regularly. |
| 20 | |
| 21 The project code base is under the same BSD license as nginx. | |
| 22 | |
| 23 The code is at an early alpha level of quality and should not | |
| 24 be used in production. | |
| 25 | |
| 26 We are working on improving HTTP/3 support with the goal of | |
| 27 integrating it to the main NGINX codebase. Expect frequent | |
| 28 updates of this code and don't rely on it for whatever purpose. | |
| 29 | |
| 30 We'll be grateful for any feedback and code submissions however | |
| 31 we don't bear any responsibilities for any issues with this code. | |
| 32 | |
| 33 You can always contact us via nginx-devel mailing list [3]. | |
| 34 | |
| 35 What works now: | |
| 36 | |
|
7944
3c32717d7bb2
README: documented draft-28, draft-29 support.
Sergey Kandaurov <pluknet@nginx.com>
parents:
7907
diff
changeset
|
37 Currently we support IETF-QUIC draft-27, draft-28, draft-29. |
|
3c32717d7bb2
README: documented draft-28, draft-29 support.
Sergey Kandaurov <pluknet@nginx.com>
parents:
7907
diff
changeset
|
38 Earlier drafts are NOT supported as they have incompatible wire format. |
| 7843 | 39 |
|
7887
c7d1b500bd0a
Updated README with "Contributing" section and draft details.
Vladimir Homutov <vl@nginx.com>
parents:
7879
diff
changeset
|
40 You may look at src/event/ngx_event_quic.h for alternative values of the |
|
c7d1b500bd0a
Updated README with "Contributing" section and draft details.
Vladimir Homutov <vl@nginx.com>
parents:
7879
diff
changeset
|
41 NGX_QUIC_DRAFT_VERSION macro used to select IETF draft version number. |
|
c7d1b500bd0a
Updated README with "Contributing" section and draft details.
Vladimir Homutov <vl@nginx.com>
parents:
7879
diff
changeset
|
42 |
| 7843 | 43 nginx should be able to respond to simple HTTP/3 requests over QUIC and |
| 44 it should be possible to upload and download big files without errors. | |
| 45 | |
| 46 + The handshake completes successfully | |
| 47 + One endpoint can update keys and its peer responds correctly | |
| 7867 | 48 + 0-RTT data is being received and acted on |
| 7843 | 49 + Connection is established using TLS Resume Ticket |
|
7866
2b580ac17a47
README: Retry support, protocol error messages implemented.
Sergey Kandaurov <pluknet@nginx.com>
parents:
7850
diff
changeset
|
50 + A handshake that includes a Retry packet completes successfully |
| 7843 | 51 + Stream data is being exchanged and ACK'ed |
| 52 + An H3 transaction succeeded | |
| 53 + One or both endpoints insert entries into dynamic table and | |
| 54 subsequently reference them from header blocks | |
| 55 | |
| 56 Not (yet) supported features: | |
| 57 | |
| 58 - Version negotiation | |
| 59 - ECN, Congestion control and friends as specified in quic-recovery [5] | |
| 60 - A connection with the spin bit succeeds and the bit is spinning | |
| 61 - Structured Logging | |
| 62 - QUIC recovery (proper congestion and flow control) | |
| 63 - NAT Rebinding | |
| 64 - Address Mobility | |
| 65 - Server push | |
| 66 - HTTP/3 trailers | |
| 67 | |
| 68 Since the code is experimental and still under development, | |
| 69 a lot of things may not work as expected, for example: | |
| 70 | |
| 71 - ACK handling is basic: every received ack-eliciting packet | |
| 72 is acknowledged, no ack ranges are used | |
| 73 | |
| 74 - Flow control mechanism is basic and intended to avoid CPU hog and make | |
| 75 simple interactions possible | |
| 76 | |
| 77 - Not all draft requirements are strictly followed; some of checks are | |
| 78 omitted for the sake of simplicity of initial implementation | |
| 79 | |
| 80 2. Installing | |
| 81 | |
| 82 You will need a BoringSSL [4] library that provides QUIC support | |
| 83 | |
|
7850
796b5b6c43cd
Mention quic branch in README.
Sergey Kandaurov <pluknet@nginx.com>
parents:
7849
diff
changeset
|
84 $ hg clone -b quic https://hg.nginx.org/nginx-quic |
| 7843 | 85 $ cd nginx-quic |
|
7849
0e6528551f26
Configure: unbreak with old OpenSSL, --with-http_v3_module added.
Sergey Kandaurov <pluknet@nginx.com>
parents:
7843
diff
changeset
|
86 $ ./auto/configure --with-debug --with-http_v3_module \ |
|
0e6528551f26
Configure: unbreak with old OpenSSL, --with-http_v3_module added.
Sergey Kandaurov <pluknet@nginx.com>
parents:
7843
diff
changeset
|
87 --with-cc-opt="-I../boringssl/include" \ |
|
0e6528551f26
Configure: unbreak with old OpenSSL, --with-http_v3_module added.
Sergey Kandaurov <pluknet@nginx.com>
parents:
7843
diff
changeset
|
88 --with-ld-opt="-L../boringssl/build/ssl \ |
|
0e6528551f26
Configure: unbreak with old OpenSSL, --with-http_v3_module added.
Sergey Kandaurov <pluknet@nginx.com>
parents:
7843
diff
changeset
|
89 -L../boringssl/build/crypto" |
| 7843 | 90 $ make |
| 91 | |
| 92 3. Configuration | |
| 93 | |
| 94 The "listen" directive got a new option: "http3" | |
| 95 which enables HTTP/3 over QUIC on the specified port. | |
| 96 | |
| 97 Along with "http3", you also have to specify "reuseport" option [6] | |
| 98 to make it work properly with multiple workers. | |
| 99 | |
| 100 A number of directives were added that specify transport parameter values: | |
| 101 | |
| 102 quic_max_idle_timeout | |
| 103 quic_max_ack_delay | |
| 104 quic_max_packet_size | |
| 105 quic_initial_max_data | |
| 106 quic_initial_max_stream_data_bidi_local | |
| 107 quic_initial_max_stream_data_bidi_remote | |
| 108 quic_initial_max_stream_data_uni | |
| 109 quic_initial_max_streams_bidi | |
| 110 quic_initial_max_streams_uni | |
| 111 quic_ack_delay_exponent | |
| 112 quic_active_migration | |
| 113 quic_active_connection_id_limit | |
| 114 | |
|
7879
af22b60a905b
README: documented Retry, 0-RTT, TLSv1.3 configuration.
Sergey Kandaurov <pluknet@nginx.com>
parents:
7873
diff
changeset
|
115 To enable address validation: |
|
af22b60a905b
README: documented Retry, 0-RTT, TLSv1.3 configuration.
Sergey Kandaurov <pluknet@nginx.com>
parents:
7873
diff
changeset
|
116 |
|
af22b60a905b
README: documented Retry, 0-RTT, TLSv1.3 configuration.
Sergey Kandaurov <pluknet@nginx.com>
parents:
7873
diff
changeset
|
117 quic_retry on; |
|
af22b60a905b
README: documented Retry, 0-RTT, TLSv1.3 configuration.
Sergey Kandaurov <pluknet@nginx.com>
parents:
7873
diff
changeset
|
118 |
|
af22b60a905b
README: documented Retry, 0-RTT, TLSv1.3 configuration.
Sergey Kandaurov <pluknet@nginx.com>
parents:
7873
diff
changeset
|
119 To enable 0-RTT: |
|
af22b60a905b
README: documented Retry, 0-RTT, TLSv1.3 configuration.
Sergey Kandaurov <pluknet@nginx.com>
parents:
7873
diff
changeset
|
120 |
|
af22b60a905b
README: documented Retry, 0-RTT, TLSv1.3 configuration.
Sergey Kandaurov <pluknet@nginx.com>
parents:
7873
diff
changeset
|
121 ssl_early_data on; |
|
af22b60a905b
README: documented Retry, 0-RTT, TLSv1.3 configuration.
Sergey Kandaurov <pluknet@nginx.com>
parents:
7873
diff
changeset
|
122 |
|
af22b60a905b
README: documented Retry, 0-RTT, TLSv1.3 configuration.
Sergey Kandaurov <pluknet@nginx.com>
parents:
7873
diff
changeset
|
123 Make sure that TLS 1.3 is configured which is required for QUIC: |
|
af22b60a905b
README: documented Retry, 0-RTT, TLSv1.3 configuration.
Sergey Kandaurov <pluknet@nginx.com>
parents:
7873
diff
changeset
|
124 |
|
af22b60a905b
README: documented Retry, 0-RTT, TLSv1.3 configuration.
Sergey Kandaurov <pluknet@nginx.com>
parents:
7873
diff
changeset
|
125 ssl_protocols TLSv1.3; |
|
af22b60a905b
README: documented Retry, 0-RTT, TLSv1.3 configuration.
Sergey Kandaurov <pluknet@nginx.com>
parents:
7873
diff
changeset
|
126 |
| 7843 | 127 Two additional variables are available: $quic and $http3. |
| 128 The value of $quic is "quic" if QUIC connection is used, | |
| 129 and empty string otherwise. The value of $http3 is a string | |
| 130 "h3-xx" where "xx" is the supported draft number. | |
| 131 | |
| 132 Example configuration: | |
| 133 | |
| 134 http { | |
| 135 log_format quic '$remote_addr - $remote_user [$time_local] ' | |
| 136 '"$request" $status $body_bytes_sent ' | |
| 137 '"$http_referer" "$http_user_agent" "$quic" "$http3"'; | |
| 138 | |
| 139 access_log logs/access.log quic; | |
| 140 | |
| 141 server { | |
| 142 # for better compatibility it's recommended | |
| 143 # to use the same port for quic and https | |
| 144 listen 8443 http3 reuseport; | |
| 145 listen 8443 ssl; | |
| 146 | |
| 147 ssl_certificate certs/example.com.crt; | |
| 148 ssl_certificate_key certs/example.com.key; | |
| 149 ssl_protocols TLSv1.3; | |
| 150 | |
| 151 location / { | |
| 152 # required for browsers to direct them into quic port | |
|
7873
94c06fe6e159
README: pointed out Alt-Svc "ma" parameter useful with curl.
Sergey Kandaurov <pluknet@nginx.com>
parents:
7872
diff
changeset
|
153 add_header Alt-Svc '$http3=":8443"; ma=86400'; |
| 7843 | 154 } |
| 155 } | |
| 156 } | |
| 157 | |
| 158 4. Clients | |
| 159 | |
| 160 * Browsers | |
| 161 | |
| 162 Known to work: Firefox 75+ and Chrome 83+ | |
| 163 | |
| 164 Beware of strange issues: sometimes browser may decide to ignore QUIC | |
| 165 Cache clearing/restart might help. Always check access.log and | |
| 166 error.log to make sure you are using HTTP/3 and not TCP https. | |
| 167 | |
| 168 + to enable QUIC in Firefox, set the following in 'about:config': | |
| 169 network.http.http3.enabled = true | |
| 170 | |
| 171 + to enable QUIC in Chrome, enable it on command line and force it | |
| 172 on your site: | |
| 173 | |
| 174 $ ./chrome --enable-quic --quic-version=h3-27 \ | |
| 175 --origin-to-force-quic-on=example.com:8443 | |
| 176 | |
| 177 * Console clients | |
| 178 | |
| 179 Known to work: ngtcp2, firefox's neqo and chromium's console clients: | |
| 180 | |
| 181 $ examples/client 127.0.0.1 8443 https://example.com:8443/index.html | |
| 182 | |
| 183 $ ./neqo-client https://127.0.0.1:8443/ | |
| 184 | |
| 185 $ chromium-build/out/my_build/quic_client http://example.com:8443 \ | |
| 186 --quic_version=h3-27 \ | |
| 187 --allow_unknown_root_cert \ | |
| 188 --disable_certificate_verification | |
| 189 | |
| 190 | |
| 191 If you've got it right, in the access log you should see something like: | |
| 192 | |
| 193 127.0.0.1 - - [24/Apr/2020:11:27:29 +0300] "GET / HTTP/3" 200 805 "-" | |
| 194 "nghttp3/ngtcp2 client" "quic" "h3-27" | |
| 195 | |
| 196 | |
| 197 5. Troubleshooting | |
| 198 | |
| 199 Here are some tips that may help you to identify problems: | |
| 200 | |
| 201 + Ensure you are building with proper SSL library that | |
| 202 implements draft 27 | |
| 203 | |
| 204 + Ensure you are using the proper SSL library in runtime | |
| 205 (`nginx -V` will show you what you are using) | |
| 206 | |
| 207 + Ensure your client is actually sending QUIC requests | |
| 208 (see "Clients" section about browsers and cache) | |
| 209 | |
| 210 We recommend to start with simple console client like ngtcp2 | |
| 211 to ensure you've got server configured properly before trying | |
| 7872 | 212 with real browsers that may be very picky with certificates, |
| 7843 | 213 for example. |
| 214 | |
| 215 + Build nginx with debug support [7] and check your debug log. | |
| 216 It should contain all details about connection and why it | |
| 217 failed. All related messages contain "quic " prefix and can | |
| 218 be easily filtered out. | |
| 219 | |
| 220 + If you want to investigate deeper, you may want to enable | |
| 221 additional debugging in src/event/ngx_event_quic.h: | |
| 222 | |
| 223 #define NGX_QUIC_DEBUG_PACKETS | |
| 224 #define NGX_QUIC_DEBUG_FRAMES | |
| 225 #define NGX_QUIC_DEBUG_FRAMES_ALLOC | |
| 226 #define NGX_QUIC_DEBUG_CRYPTO | |
| 227 | |
|
7887
c7d1b500bd0a
Updated README with "Contributing" section and draft details.
Vladimir Homutov <vl@nginx.com>
parents:
7879
diff
changeset
|
228 6. Contributing |
|
c7d1b500bd0a
Updated README with "Contributing" section and draft details.
Vladimir Homutov <vl@nginx.com>
parents:
7879
diff
changeset
|
229 |
|
c7d1b500bd0a
Updated README with "Contributing" section and draft details.
Vladimir Homutov <vl@nginx.com>
parents:
7879
diff
changeset
|
230 If you are willing to contribute, please refer to |
|
c7d1b500bd0a
Updated README with "Contributing" section and draft details.
Vladimir Homutov <vl@nginx.com>
parents:
7879
diff
changeset
|
231 http://nginx.org/en/docs/contributing_changes.html |
|
c7d1b500bd0a
Updated README with "Contributing" section and draft details.
Vladimir Homutov <vl@nginx.com>
parents:
7879
diff
changeset
|
232 |
|
c7d1b500bd0a
Updated README with "Contributing" section and draft details.
Vladimir Homutov <vl@nginx.com>
parents:
7879
diff
changeset
|
233 7. Links |
| 7843 | 234 |
| 235 [1] https://tools.ietf.org/html/draft-ietf-quic-transport-27 | |
| 236 [2] https://tools.ietf.org/html/draft-ietf-quic-http-27 | |
| 237 [3] https://mailman.nginx.org/mailman/listinfo/nginx-devel | |
| 238 [4] https://boringssl.googlesource.com/boringssl/ | |
| 239 [5] https://tools.ietf.org/html/draft-ietf-quic-recovery-27 | |
| 240 [6] https://nginx.org/en/docs/http/ngx_http_core_module.html#listen | |
| 241 [7] https://nginx.org/en/docs/debugging_log.html |