Slide 1

Slide 1 text

Fabian Lange SPDY - http reloaded

Slide 2

Slide 2 text

(WILL BE) PART OF HTTP/2.0

Slide 3

Slide 3 text

HTTP Problems • Single request per connection. Because HTTP can only fetch one resource at a time (HTTP pipelining helps, but still enforces only a FIFO queue), a server delay of 500 ms prevents reuse of the TCP channel for additional requests. Browsers work around this problem by using multiple connections. Since 2008, most browsers have finally moved from 2 connections per domain to 6. • Exclusively client-initiated requests. In HTTP, only the client can initiate a request. Even if the server knows the client needs a resource, it has no mechanism to inform the client and must instead wait to receive a request for the resource from the client. • Uncompressed request and response headers. Request headers today vary in size from ~200 bytes to over 2KB. As applications use more cookies and user agents expand features, typical header sizes of 700-800 bytes is common. For modems or ADSL connections, in which the uplink bandwidth is fairly low, this latency can be significant. Reducing the data in headers could directly improve the serialization latency to send requests. • Redundant headers. In addition, several headers are repeatedly sent across requests on the same channel. However, headers such as the User-Agent, Host, and Accept* are generally static and do not need to be resent. • Optional data compression. HTTP uses optional compression encodings for data. Content should always be sent in a compressed format. Source: http://dev.chromium.org/spdy/spdy-whitepaper

Slide 4

Slide 4 text

Web Requests Are Simple • Open a connection • Send a request • Receive a response • Done

Slide 5

Slide 5 text

No content

Slide 6

Slide 6 text

Transfer per Page

Slide 7

Slide 7 text

How to Avoid Requests • Caching • Domain Sharding – Browser Limits • Keep Alive – Dedicated Connections – Waste Ressources • Pipelining

Slide 8

Slide 8 text

TCP Handshake 0ms 1) Host A sends a TCP SYNchronize packet to Host B 25ms 2) Host B receives A's SYN 25ms 3) Host B sends a SYNchronize-ACKnowledgement 50ms 4) Host A receives B's SYN-ACK 75ms 5) Host A sends ACKnowledge and data 75ms 6) Host B receives ACK and data. • With a "distance" of just 25ms, this takes us 75ms until data arrives at server

Slide 9

Slide 9 text

No content

Slide 10

Slide 10 text

Initial Window • Congestion Control Mechanism • Avoid overloading clients • Each ACK of the client increases window • RFC 3390 – Increasing icwnd – Small Resonses are complete without ACK – Avoid the ACK RTT

Slide 11

Slide 11 text

Pushing over http • Push === Long Polling • Consumes one connection on clients • On server – Used to be expensive to hold – Modern servers have evented I/O • WebSockets

Slide 12

Slide 12 text

Headers Accept text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding gzip, deflate Accept-Language de-de,de;q=0.8,en-us;q=0.5,en;q=0.3 Connection keep-alive Cookie __utma=40497137.1800912468.1315901303.1328525769.1328537171.234; __utmz=40497137.1326462670.198.110.utmcsr=twitterfeed|utmccn=blogfee d_de|utmcmd=twitter; wp-settings- 3=editor%3Dhtml%26m0%3Do%26m1%3Do%26m2%3Do%26m3%3Dc%2 6m4%3Do%26m5%3Do%26m6%3Do%26m7%3Do%26m8%3Do%26m9%3 Do%26m10%3Do%26m11%3Do%26align%3Dcenter%26imgsize%3Dfull%2 6urlbutton%3Dnone%26hidetb%3D0; wp-settings-time-3=1328519940; __utma=162617902.1417890302.1315914276.1328537194.1328541774.63; __utmz=162617902.1328537194.62.41.utmcsr=blog.codecentric.de|utmccn =(referral)|utmcmd=referral|utmcct=/; wp-settings-time-81=1321966374 Host blog.codecentric.de User-Agent Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0) Gecko/20100101 Firefox/10.0 http://blog.codecentric.de/

Slide 13

Slide 13 text

http://blog.codecentric.de/files/2012/02/adlite.png Headers Accept image/png,image/*;q=0.8,*/*;q=0.5 Accept-Encoding gzip, deflate Accept-Language de-de,de;q=0.8,en-us;q=0.5,en;q=0.3 Connection keep-alive Cookie __utma=162617902.1417890302.1315914276.1328537194.1328541774.63; __utmz=162617902.1328537194.62.41.utmcsr=blog.codecentric.de|utmccn=(referral) |utmcmd=referral|utmcct=/; wp-settings- 3=m0%3Do%26m1%3Do%26m5%3Do%26m4%3Do%26editor%3Dhtml%26wplink% 3D1%26align%3Dcenter%26imgsize%3Dfull%26hidetb%3D1%26m7%3Do%26m9% 3Do; wp-settings-time-3=1326290899 Host blog.codecentric.de Referer http://blog.codecentric.de/ User-Agent Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0) Gecko/20100101 Firefox/10.0

Slide 14

Slide 14 text

Content Compression • Gzip is optional • But generally best practice LoadModule deflate_module /usr/lib/httpd/modules/mod_deflate.so

Slide 15

Slide 15 text

SPDY TO THE RESCUE

Slide 16

Slide 16 text

SPDY Solutions • Allow many concurrent HTTP requests to run across a single TCP session. • Reduce the bandwidth currently used by HTTP by compressing headers and eliminating unnecessary headers. • Make SSL the underlying transport protocol, for better security and compatibility with existing network infrastructure. Although SSL does introduce a latency penalty, we believe that the long-term future of the web depends on a secure network connection. In addition, the use of SSL is necessary to ensure that communication across existing proxies is not broken. • Enable the server to initiate communications with the client and push data to the client whenever possible. Source: http://dev.chromium.org/spdy/spdy-whitepaper

Slide 17

Slide 17 text

Connection Multiplexing • Single TCP Connection transports all requests • TCP Handshake still exists • Inital cwnd should be 16

Slide 18

Slide 18 text

Compression • All data is compressed • Includes headers • Redundand data is removed – User Agent of second request is known to be same as on first

Slide 19

Slide 19 text

CRIME • Compression Ratio Info-leak Made Easy • Cookie value can be detected when compression is effective Sources: threatpost.com/en_us/blogs/new-attack-uses-ssltls-information-leak-hijack-https-sessions-090512 security.stackexchange.com/questions/19911/crime-how-to-beat-the-beast-successor/19914

Slide 20

Slide 20 text

Cookie: JSESSIONID=1234 c: jid=1234 d: kje=2345

Slide 21

Slide 21 text

Cookie: JSESSIONID=1234 Cookie: JSESSIONID=9876 X[i] = c: jid= [i]1234 [i]9876 Y[j] = d: kje= [j]2345 [j]0987

Slide 22

Slide 22 text

Cookie: JSESSIONID=1234 Cookie: JSESSIONID=1235 X[i] = c: jid=123 [i]4 [i]5 Y[j] = d: kje=234 [j]5 [j]6

Slide 23

Slide 23 text

Fixes • Don't compress headers • Use a compressor that is not affected

Slide 24

Slide 24 text

SSL • Not said to be a problem with HTTP • SSL should be default – But actually expensive • SSL hides SPDY traffic, so that proxies don't break it 

Slide 25

Slide 25 text

Pushing • Long Lasting Connection By Design • Send does not close the "request" • Two flavors – Server push – Server hint

Slide 26

Slide 26 text

Compatibility • SPDY is backwards compatible • Uses Next Protocol Negotiation – tools.ietf.org/html/draft-agl-tls- nextprotoneg-02

Slide 27

Slide 27 text

Adoption • Facebook implements and favors SPDY http://lists.w3.org/Archives/Public/ietf-http-wg/2012JulSep/0251.html • Twitter implements and favors SPDY http://lists.w3.org/Archives/Public/ietf-http-wg/2012JulSep/0250.html • Google implements and favors SPDY http://lists.w3.org/Archives/Public/ietf-http-wg/2012JulSep/0219.html • Mozilla implements and favors SPDY http://lists.w3.org/Archives/Public/ietf-http-wg/2012JulSep/0156.html • Wordpress.com uses SPDY https://twitter.com/wordpressdotcom/statuses/238741078172389377

Slide 28

Slide 28 text

Concerns • Encryption by default renders network caching useless

Slide 29

Slide 29 text

SPDY Support Clients • Chrome – since 11 – Ice Cream Sandwich • Amazon Silk – Kindle Fire • Firefox – Since 13 • Opera – Since 12.1 Server • Apache mod_spdy • erlang-spdy • node-spdy • Netty 3.3.1 – Means JBoss • Jetty 7.6.2 • Ngnix 1.3 • Tomcat 8.0.0-dev

Slide 30

Slide 30 text

No content

Slide 31

Slide 31 text

SPDY Drafts • dev.chromium.org/spdy/spdy-protocol/spdy-protocol- draft1 – First draft 2009 • dev.chromium.org/spdy/spdy-protocol/spdy-protocol- draft2 – Changes to server push • dev.chromium.org/spdy/spdy-protocol/spdy-protocol- draft3 – Flow control • Draft 4 will feature compression and QoS changes

Slide 32

Slide 32 text

DEMO: MIGRATING PHP ON APACHE TO SUPPORT SPDY

Slide 33

Slide 33 text

PHP is not Threadsafe • The way SPDY works is incompatible with non threadsafe implementations – one connection one httpd worker – But multiple requests • Zend Threadsafe does not support some features (mysql!) • Need to externalize it with cgi

Slide 34

Slide 34 text

mod_php to mod_fcgid + php • yum install mod_fcgid • vi /etc/httpd/conf/httpd.conf • mv /etc/httpd/conf.d/php.conf /etc/httpd/conf.d/php.conf.bak • vi /etc/httpd/conf.d/fcgid.conf Options Indexes FollowSymLinks ExecCGI

Slide 35

Slide 35 text

DirectoryIndex index.php AddHandler fcgid-script .fcgi .php DefaultInitEnv PHPRC "/etc/" MaxRequestsPerProcess 1000 MaxProcessCount 10 MaxRequestLen 209715200 IPCCommTimeout 240 IdleTimeout 240 FCGIWrapper /usr/bin/php-cgi .php

Slide 36

Slide 36 text

mod_prefork to mod_worker • Needs recompilation • Luckily we have both already  – httpd -V | grep MPM – httpd.worker -V | grep MPM • sudo vi /etc/init.d/httpd httpd=${HTTPD- /usr/sbin/httpd.worker} prog=httpd.worker

Slide 37

Slide 37 text

mod_ssl • We need mod_ssl patched with NPN • yum install subversion curl gcc- c++ patch binutils make • mkdir modssl; cd modssl • svn export http://mod- spdy.googlecode.com/svn/trunk/src/ build_modssl_with_npn.sh • ./build_modssl_with_npn.sh • cp /root/modssl/mod_ssl.so /etc/httpd/modules/mod_ssl.so

Slide 38

Slide 38 text

[root@centos57 modssl]# ./build_modssl_with_npn.sh Using buildroot: /tmp/tmp.CooHIy8770 Downloading http://www.openssl.org/source/openssl-1.0.1-beta2.tar.gz ######################################################################## 100.0% Downloading http://www.apache.org/dist/httpd/httpd-2.2.21.tar.gz ######################################################################## 100.0% Downloading https://issues.apache.org/bugzilla/attachment.cgi?id=27969context=patch ######################################################################## 100.0% Uncompressing openssl-1.0.1-beta2.tar.gz ... done Uncompressing httpd-2.2.21.tar.gz ... done Applying Apache mod_ssl NPN patch ... patching file modules/ssl/ssl_private.h patching file modules/ssl/ssl_engine_init.c patching file modules/ssl/ssl_engine_io.c patching file modules/ssl/ssl_engine_kernel.c patching file modules/ssl/mod_ssl.c patching file modules/ssl/mod_ssl.h done Configuring OpenSSL ... done Building OpenSSL (this may take a while) ... done Configuring Apache mod_ssl ... done Building Apache mod_ssl (this may take a while) ... done Generated mod_ssl.so at /root/modssl/mod_ssl.so.

Slide 39

Slide 39 text

mod_spdy • Built from source • mkdir mod_spdy; cd mod_spdy • svn co http://src.chromium.org/svn/trunk/tools/depot_tools • export PATH="$PATH":`pwd`/depot_tools • gclient config http://mod- spdy.googlecode.com/svn/trunk/src • gclient sync --force • cd src; make BUILDTYPE=Release • sudo cp out/Release/libmod_spdy.so /etc/httpd/modules/mod_spdy.so • vi /etc/httpd/conf.d/spdy.conf LoadModule spdy_module /etc/httpd/modules/mod_spdy.so SpdyEnabled on

Slide 40

Slide 40 text

chrome://net-internals/#spdy

Slide 41

Slide 41 text

No content

Slide 42

Slide 42 text

Is it spdy? • www.devthought.com/2012/03/10/chro me-spdy-indicator/ • ckon.wordpress.com/2012/03/11/spdy- indicator-for-firefox/

Slide 43

Slide 43 text

HTTP 2.07 seconds

Slide 44

Slide 44 text

HTTPS 4.94 seconds

Slide 45

Slide 45 text

SPDY 2.65 seconds

Slide 46

Slide 46 text

real HTTP 17.83 seconds

Slide 47

Slide 47 text

real SPDY 11.70 seconds

Slide 48

Slide 48 text

Online Demo • www.modspdy.com/world-flags/

Slide 49

Slide 49 text

www.belshe.com/2012/08/20/visualizing-spdy-vs-http

Slide 50

Slide 50 text

LET'S MAKE THE WEB FASTER