mod_h2

Implementing HTTP/2

for Apache HTTPD

Stefan Eissing, greenbytes GmbH / @icing

Topics

  • Motivations
  • HTTP/2? Ez!
  • Challenges
  • Observations
  • Compliance

Motivations

  • GSMA: h2c as migration choice
  • GSMA: cache/accelerators common
  • greenbytes: Cool!
  • Apache: Take that, nginx!

The African villages are in South America!

Ez!

  • Look at mod_spdy
  • Take nghttp2, test with curl
  • Optimize a bit...

Jan - July 2015

mod_spdy

  • C/C++ hybrid SPDY engine
  • Apache httpd 2.2 pluggable
  • Solved many plumbing details

Pioneered by Matthew Steele and Bryan McQuade!

nghttp2 + curl

  • The Reference Implementations
  • C, high Quality
  • Well Documented
  • Excellent Support

Many Thanks to Tatsuhiro Tsujikawa and Daniel Stenberg!

mod_h2

Donated by GSMA and greenbytes in July

Optimize a bit

Evolution of mod_h2 performance.

~50k
requests / sec
March
125102040100
http/1# streams
April
125102040100
http/1mod_h2
April
125102040100
http/1mod_h2
April
125102040100
http/1mod_h2
April
125102040100
http/1mod_h2
May
125102040100
http/1mod_h2
May
125102040100
http/1mod_h2
June
125102040100
http/1mod_h2
July
125102040100
http/1mod_h2

Challenges

  • Processing Models
  • Resource Management
  • Parameter Variations

Processing Models

Processing a h2 connection is vastly different in terms of (Connection/Request/Thread).

  • 1-1-1 (http/1)
  • 1-n-m (h2)

In h2, 1 connection has n ongoing request, worked on by m threads.

Existing runtimes are optimized for 1-1-1

Resource Management

Not new, but different.

  • File Handles
  • Threads, Locking
  • Scheduling

Server manage resources/connection. h2 adds two order of magnitude.

Keeping file handles open reduces buffer copies.

Connection fairness vs. priority handling.

Variations

Many parameters in play, what to optimize for?

Requesting 1k, 10k, 10M resource mix on 8 connections+threads, 100 max streams.
*64k just for testing, TLS layer does max 16k fragments itself.
~1200
MB/sec
2k4k8k16k64k*
Write Sizes

max streams, window sizes, priorities, processing modules, worker capacities, buffer sizes...

Observations

  • A Wave
  • Miracle Preforker
  • More Force

Ultimately: Cycles/Request

A Wave

Requesting different resource sizes.

1 Gbps ethernet, Core i5 2010 server.

~18k
8k
requests / sec
10k resource
123456789102040100
# streams
7.5k resource
123456789102040100
# streams
4k resource
123456789102040100
# streams
2k resource
123456789102040100
# streams
1k resource
123456789102040100
# streams

Miracle Preforker

Best: mpm_prefork + 1 worker

  • mpm_prefork
  • mpm_worker
~60k
requests / sec
125102040100
http/1# streams
125102040100
http/1# streams

But best in what exactly?

More Force

Transfer of 10 MB resources

~5
GB/sec
httph2chttpsh2+preforkh2+worker

Measured on localhost: buffer copies, encryption.

Compliance

  • Missing
  • Configure
  • Clients
  • Futures

"You're off the edge of the map, mate. Here there be monsters."

Missing

  • Server Push (Link Header?)
  • Priority Worker Assignment
  • OpSec http vs. https safety

How do YOU do it?

Configure

RFC 7540 compliance configured, not coded.

  • Upgrades on any HTTP/1 request
  • Direct on any connection start
  • Ciphers unchecked when negotiating

SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK

Clients

  • Tests with curl, Protocol::HTTP2, nghttp,
  • Firefox, Chrome, Edge, iOS9
  • All working well, slight differences
  • Ciphers, priorities and h2c support
  • UX of "insufficient security" sucks!

New game: 421 ping pong!

Futures

  • Release in 2.4.x
  • Tighter Integration, less Cycles
  • Reshaping a HTTP/2 library
  • Timely Standard Extensions

Sponsoring Needed!

mod_h2

Thanks!