nginx-quic's Introduction
Experimental QUIC support for nginx ----------------------------------- 1. Introduction 2. Installing 3. Configuration 4. Clients 5. Troubleshooting 6. Contributing 7. Links 1. Introduction This is an experimental QUIC [1] / HTTP/3 [2] support for nginx. The code is developed in a separate "quic" branch available at https://hg.nginx.org/nginx-quic. Currently it is based on nginx mainline 1.21.x. We merge new nginx releases into this branch regularly. The project code base is under the same BSD license as nginx. The code is currently at a beta level of quality and should not be used in production. We are working on improving HTTP/3 support with the goal of integrating it to the main NGINX codebase. Expect frequent updates of this code and don't rely on it for whatever purpose. We'll be grateful for any feedback and code submissions however we don't bear any responsibilities for any issues with this code. You can always contact us via nginx-devel mailing list [3]. What works now: Currently we support IETF-QUIC draft-29 through final RFC documents. Earlier drafts are NOT supported as they have incompatible wire format. nginx should be able to respond to HTTP/3 requests over QUIC and it should be possible to upload and download big files without errors. + The handshake completes successfully + One endpoint can update keys and its peer responds correctly + 0-RTT data is being received and acted on + Connection is established using TLS Resume Ticket + A handshake that includes a Retry packet completes successfully + Stream data is being exchanged and ACK'ed + An H3 transaction succeeded + One or both endpoints insert entries into dynamic table and subsequently reference them from header blocks + Version Negotiation packet is sent to client with unknown version + Lost packets are detected and retransmitted properly + Clients may migrate to new address Not (yet) supported features: - Explicit Congestion Notification (ECN) as specified in quic-recovery [5] - A connection with the spin bit succeeds and the bit is spinning - Structured Logging Since the code is experimental and still under development, a lot of things may not work as expected, for example: - Flow control mechanism is basic and intended to avoid CPU hog and make simple interactions possible - Not all protocol requirements are strictly followed; some of checks are omitted for the sake of simplicity of initial implementation 2. Installing You will need a BoringSSL [4] library that provides QUIC support $ hg clone -b quic https://hg.nginx.org/nginx-quic $ cd nginx-quic $ ./auto/configure --with-debug --with-http_v3_module \ --with-cc-opt="-I../boringssl/include" \ --with-ld-opt="-L../boringssl/build/ssl \ -L../boringssl/build/crypto" $ make When configuring nginx, you can enable QUIC and HTTP/3 using the following new configuration options: --with-http_v3_module - enable QUIC and HTTP/3 --with-http_quic_module - enable QUIC for older HTTP versions --with-stream_quic_module - enable QUIC in Stream 3. Configuration The HTTP "listen" directive got two new options: "http3" and "quic". The "http3" option enables HTTP/3 over QUIC on the specified port. The "quic" option enables QUIC for older HTTP versions on this port. The Stream "listen" directive got a new option "quic" which enables QUIC as client transport protocol instead of TCP or plain UDP. Along with "http3" or "quic", you also have to specify "reuseport" option [6] to make it work properly with multiple workers. A number of directives were added that specify transport parameter values: quic_max_idle_timeout quic_max_ack_delay quic_max_udp_payload_size quic_initial_max_data quic_initial_max_stream_data_bidi_local quic_initial_max_stream_data_bidi_remote quic_initial_max_stream_data_uni quic_initial_max_streams_bidi quic_initial_max_streams_uni quic_ack_delay_exponent quic_disable_active_migration quic_active_connection_id_limit To enable address validation: quic_retry on; To enable 0-RTT: ssl_early_data on; Make sure that TLS 1.3 is configured which is required for QUIC: ssl_protocols TLSv1.3; To enable GSO (Generic Segmentation Offloading): quic_gso on; By default this Linux-specific optimization [8] is disabled. Enable if your network interface is configured to support GSO. A number of directives were added that configure HTTP/3: http3_max_table_capacity http3_max_blocked_streams http3_max_concurrent_pushes http3_push http3_push_preload An additional variable is available: $quic. The value of $quic is "quic" if QUIC connection is used, or an empty string otherwise. Example configuration: http { log_format quic '$remote_addr - $remote_user [$time_local] ' '"$request" $status $body_bytes_sent ' '"$http_referer" "$http_user_agent" "$quic"'; access_log logs/access.log quic; server { # for better compatibility it's recommended # to use the same port for quic and https listen 8443 http3 reuseport; listen 8443 ssl; ssl_certificate certs/example.com.crt; ssl_certificate_key certs/example.com.key; ssl_protocols TLSv1.3; location / { # required for browsers to direct them into quic port add_header Alt-Svc 'h3=":8443"; ma=86400'; } } } 4. Clients * Browsers Known to work: Firefox 80+ and Chrome 85+ (QUIC draft 29+) Beware of strange issues: sometimes browser may decide to ignore QUIC Cache clearing/restart might help. Always check access.log and error.log to make sure you are using HTTP/3 and not TCP https. + to enable QUIC in Firefox, set the following in 'about:config': network.http.http3.enabled = true + to enable QUIC in Chrome, enable it on command line and force it on your site: $ ./chrome --enable-quic --quic-version=h3-29 \ --origin-to-force-quic-on=example.com:8443 * Console clients Known to work: ngtcp2, firefox's neqo and chromium's console clients: $ examples/client 127.0.0.1 8443 https://example.com:8443/index.html $ ./neqo-client https://127.0.0.1:8443/ $ chromium-build/out/my_build/quic_client http://example.com:8443 \ --quic_version=h3-29 \ --allow_unknown_root_cert \ --disable_certificate_verification If you've got it right, in the access log you should see something like: 127.0.0.1 - - [24/Apr/2020:11:27:29 +0300] "GET / HTTP/3" 200 805 "-" "nghttp3/ngtcp2 client" "quic" 5. Troubleshooting Here are some tips that may help you to identify problems: + Ensure you are building with proper SSL library that supports QUIC + Ensure you are using the proper SSL library in runtime (`nginx -V` will show you what you are using) + Ensure your client is actually sending QUIC requests (see "Clients" section about browsers and cache) We recommend to start with simple console client like ngtcp2 to ensure you've got server configured properly before trying with real browsers that may be very picky with certificates, for example. + Build nginx with debug support [7] and check your debug log. It should contain all details about connection and why it failed. All related messages contain "quic " prefix and can be easily filtered out. + If you want to investigate deeper, you may want to enable additional debugging in src/event/quic/ngx_event_quic_connection.h: #define NGX_QUIC_DEBUG_PACKETS #define NGX_QUIC_DEBUG_FRAMES #define NGX_QUIC_DEBUG_ALLOC #define NGX_QUIC_DEBUG_CRYPTO 6. Contributing If you are willing to contribute, please refer to http://nginx.org/en/docs/contributing_changes.html 7. Links [1] https://datatracker.ietf.org/doc/html/rfc9000 [2] https://datatracker.ietf.org/doc/html/draft-ietf-quic-http [3] https://mailman.nginx.org/mailman/listinfo/nginx-devel [4] https://boringssl.googlesource.com/boringssl/ [5] https://datatracker.ietf.org/doc/html/rfc9002 [6] https://nginx.org/en/docs/http/ngx_http_core_module.html#listen [7] https://nginx.org/en/docs/debugging_log.html [8] http://vger.kernel.org/lpc_net2018_talks/willemdebruijn-lpc2018-udpgso-paper-DRAFT-1.pdf
nginx-quic's People
Forkers
rashkur andrey-mostovoy aav66 liferenko incubos inerc z106a yuribabak max-ramas alexrogalskiy lipski dorofeevaa dennis-nedry-from-jurassic-park id-2 cricketnestnginx-quic's Issues
Работает ли это РЕПО с QUICTLS?
Когда я использую опцию --with-openssl=../openssl-quic, я получаю эту ошибку:
checking for OpenSSL QUIC support ... not found
Как насчет Docker image?
Хотел попробовать ваш nginx после доклада и понял что установка не будет такой легкой. Не хотите собирать образы в Docker?
Slow speed upload file
Hi!
I use nginx-quic with "proxy_pass" for nodejs server http://localhost:5000
I upload a large file to this by method="POST" enctype="multipart/form-data".
For uploading a large files I use busboy at NodeJS and I add to nginx.conf :
client_max_body_size 0;
proxy_request_buffering off;
All is work! But I have HTTP/3 is slowly than HTTP/1.1
When I try to upload file 32 Mb via HTTP/1.1, this file uploads aproxymaly for 5 seconds and every chunk size is about ~65000 bytes
When I try to upload this file via HTTP/3, file uploads elapsing aproxymaly 30 seconds and every chunk size has about ~2000 bytes.
Uploading via HTTP/3 more slowly than HTTP/1.1 because HTTP/3 has more count of chunks and this chunks is more small that chunks in HTTP/1.1.
Can I change size of chunks for HTTP/3 ?
issue when build nginx quic
Hello all,
when I try to build Nginx with quic ,it throws the below error outputs:
[root@nginxhttp3 nginx-quic]# ./auto/configure --prefix=/webapps/nginx --sbin-path=/webapps/nginx/sbin/nginx --conf-path=/webapps/nginx/config/nginx.conf --error-log-path=/webapps/nginx/logs/nginx_error.log --http-log-path=/webapps/nginx/logs/nginx_access.log --pid-path=/webapps/nginx/logs/nginx.pid --user=nginx --group=nginx --with-file-aio --with-threads --with-http_addition_module --with-http_auth_request_module --with-http_dav_module --with-http_flv_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_mp4_module --with-http_random_index_module --with-http_realip_module --with-http_secure_link_module --with-http_ssl_module --with-http_stub_status_module --with-http_sub_module --with-mail --with-mail_ssl_module --with-http_v2_module --with-debug --with-http_v3_module --with-cc-opt="-I../boringssl/include" --with-ld-opt="-L../boringssl/build/ssl -L../boringssl/build/crypto"
checking for OS
- Linux 4.18.0-193.6.3.el8_2.x86_64 x86_64
checking for C compiler ... found - using GNU C compiler
- gcc version: 8.3.1 20191121 (Red Hat 8.3.1-5) (GCC)
checking for gcc -pipe switch ... found
checking for --with-ld-opt="-L../boringssl/build/ssl -L../boringssl/build/crypto" ... found
checking for -Wl,-E switch ... found
checking for gcc builtin atomic operations ... found
checking for C99 variadic macros ... found
checking for gcc variadic macros ... found
checking for gcc builtin 64 bit byteswap ... found
checking for unistd.h ... found
checking for inttypes.h ... found
checking for limits.h ... found
checking for sys/filio.h ... not found
checking for sys/param.h ... found
checking for sys/mount.h ... found
checking for sys/statvfs.h ... found
checking for crypt.h ... found
checking for Linux specific features
checking for epoll ... found
checking for EPOLLRDHUP ... found
checking for EPOLLEXCLUSIVE ... found
checking for eventfd() ... found
checking for O_PATH ... found
checking for sendfile() ... found
checking for sendfile64() ... found
checking for sys/prctl.h ... found
checking for prctl(PR_SET_DUMPABLE) ... found
checking for prctl(PR_SET_KEEPCAPS) ... found
checking for capabilities ... found
checking for crypt_r() ... found
checking for sys/vfs.h ... found
checking for BPF sockhash ... found
checking for SO_COOKIE ... found
checking for UDP_SEGMENT ... not found
checking for poll() ... found
checking for /dev/poll ... not found
checking for kqueue ... not found
checking for crypt() ... not found
checking for crypt() in libcrypt ... found
checking for F_READAHEAD ... not found
checking for posix_fadvise() ... found
checking for O_DIRECT ... found
checking for F_NOCACHE ... not found
checking for directio() ... not found
checking for statfs() ... found
checking for statvfs() ... found
checking for dlopen() ... not found
checking for dlopen() in libdl ... found
checking for sched_yield() ... found
checking for sched_setaffinity() ... found
checking for SO_SETFIB ... not found
checking for SO_REUSEPORT ... found
checking for SO_ACCEPTFILTER ... not found
checking for SO_BINDANY ... not found
checking for IP_TRANSPARENT ... found
checking for IP_BINDANY ... not found
checking for IP_BIND_ADDRESS_NO_PORT ... found
checking for IP_RECVDSTADDR ... not found
checking for IP_SENDSRCADDR ... not found
checking for IP_PKTINFO ... found
checking for IPV6_RECVPKTINFO ... found
checking for TCP_DEFER_ACCEPT ... found
checking for TCP_KEEPIDLE ... found
checking for TCP_FASTOPEN ... found
checking for TCP_INFO ... found
checking for accept4() ... found
checking for kqueue AIO support ... not found
checking for Linux AIO support ... found
checking for int size ... 4 bytes
checking for long size ... 8 bytes
checking for long long size ... 8 bytes
checking for void * size ... 8 bytes
checking for uint32_t ... found
checking for uint64_t ... found
checking for sig_atomic_t ... found
checking for sig_atomic_t size ... 4 bytes
checking for socklen_t ... found
checking for in_addr_t ... found
checking for in_port_t ... found
checking for rlim_t ... found
checking for uintptr_t ... uintptr_t found
checking for system byte ordering ... little endian
checking for size_t size ... 8 bytes
checking for off_t size ... 8 bytes
checking for time_t size ... 8 bytes
checking for AF_INET6 ... found
checking for setproctitle() ... not found
checking for pread() ... found
checking for pwrite() ... found
checking for pwritev() ... found
checking for strerrordesc_np() ... not found
checking for sys_nerr ... found
checking for localtime_r() ... found
checking for clock_gettime(CLOCK_MONOTONIC) ... found
checking for posix_memalign() ... found
checking for memalign() ... found
checking for mmap(MAP_ANON|MAP_SHARED) ... found
checking for mmap("/dev/zero", MAP_SHARED) ... found
checking for System V shared memory ... found
checking for POSIX semaphores ... not found
checking for POSIX semaphores in libpthread ... found
checking for struct msghdr.msg_control ... found
checking for ioctl(FIONBIO) ... found
checking for ioctl(FIONREAD) ... found
checking for struct tm.tm_gmtoff ... found
checking for struct dirent.d_namlen ... not found
checking for struct dirent.d_type ... found
checking for sysconf(_SC_NPROCESSORS_ONLN) ... found
checking for sysconf(_SC_LEVEL1_DCACHE_LINESIZE) ... found
checking for openat(), fstatat() ... found
checking for getaddrinfo() ... found
checking for PCRE2 library ... found
checking for OpenSSL library ... found
checking for OpenSSL QUIC support ... not found
./auto/configure: error: certain modules require OpenSSL QUIC support.
You can either do not enable the modules or install the OpenSSL library with
QUIC support into the system, or build the OpenSSL library with QUIC support
statically from the source with nginx by using --with-openssl= option.
Actually, there is no file/folder related with OpenSSL or BoringSSL
[root@nginxhttp3 nginx-quic]# cd ..
[root@nginxhttp3 src]# ls
curl nginx-1.19.2 nginx-quic quiche
Discuz_X3.2_SC_UTF8.zip nginx-1.19.2.tar.gz php-5.5.7.tar.gz quiche.tar.gz
question1: if I wanna install Nginx with quic successfully, what should I do next?
question2: should I download BoringSSL and build and install it?
How to let nginx log the ssl key log file by changing nginx.conf file
Hi @mihver1 @morf @mdounin @lyokha @arut ,
My goal is capture the pcap file on my linux machine which is using nginx quic to connect and decrypt those packets using ssl key log file.but i am unable to find how to capture ssl key log file on nginx. Could someone please help me how to capture ssl key log file ?
Looking forward for you reply.
Thanks,
Kartheek.
quic_gso on not work!
How is everything going?I met a problem when I use you projects, and here is the problem.
“To enable GSO (Generic Segmentation Offloading):
quic_gso on;
By default this Linux-specific optimization [8] is disabled.
Enable if your network interface is configured to support GSO.”
I have set my network interface ”generic-segmentation-offload: on“,and cancel the annotation of “quic_gso on;”,but the gso not work, how to solve this problem?
I hope I can receive you help soon
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.