{"id":81847,"date":"2020-05-17T01:42:34","date_gmt":"2020-05-16T23:42:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/http-po-udp-ispolzuem-s-polzoj-protokol-quic"},"modified":"2020-05-17T01:42:34","modified_gmt":"2020-05-16T23:42:34","slug":"http-po-udp-ispolzuem-s-polzoj-protokol-quic","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/http-po-udp-ispolzuem-s-polzoj-protokol-quic","title":{"rendered":"HTTP p\u0159es UDP \u2014 vyu\u017eijme protokol QUIC","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"HTTP
\n
\nQUIC (Rychl\u00e9 UDP Internetov\u00e9 p\u0159ipojen\u00ed) je protokol nad UDP, kter\u00fd podporuje v\u0161echny funkce TCP, TLS a HTTP\/2 a \u0159e\u0161\u00ed v\u011bt\u0161inu jejich probl\u00e9m\u016f. \u010casto je naz\u00fdv\u00e1n nov\u00fdm nebo \"experiment\u00e1ln\u00edm\" protokolem, ale ji\u017e dlouho p\u0159ekro\u010dil f\u00e1zi experimentu: v\u00fdvoj trv\u00e1 v\u00edce ne\u017e 7 let. B\u011bhem t\u00e9to doby protokol se sice nestal standardem, ale p\u0159esto z\u00edskal \u0161irok\u00e9 roz\u0161\u00ed\u0159en\u00ed. Nap\u0159\u00edklad QUIC pou\u017e\u00edvaj\u00ed k urychlen\u00ed provozu a sn\u00ed\u017een\u00ed latence v mobiln\u00edch s\u00edt\u00edch takov\u00ed giganti jako Google a Facebook, zat\u00edmco IETF vyhl\u00e1sila jeho fork z\u00e1kladem pro standard HTTP\/3 (b\u011bhem toho, co HTTP\/2 vyu\u017e\u00edv\u00e1 pouze 44,8%<\/a><\/noindex> str\u00e1nek).<\/a><\/noindex><\/p>\n

Koncept<\/h2>\n

\nQUIC byl vyvinut jako n\u00e1hrada zastaral\u00e9ho TCP, kter\u00e9 bylo p\u016fvodn\u011b navr\u017eeno pro dr\u00e1tov\u00e9 s\u00edt\u011b s n\u00edzk\u00fdm procentem ztr\u00e1t. TCP doru\u010duje pakety v ur\u010dit\u00e9m po\u0159ad\u00ed, tak\u017ee p\u0159i ztr\u00e1t\u011b jednoho paketu se cel\u00e1 fronta zastav\u00ed (blokov\u00e1n\u00ed na za\u010d\u00e1tku \u0159ady<\/a><\/noindex>), co\u017e negativn\u011b ovliv\u0148uje kvalitu a stabilitu p\u0159ipojen\u00ed. Aby se p\u0159ede\u0161lo masivn\u00edm ztr\u00e1t\u00e1m, mobiln\u00ed s\u00edt\u011b pou\u017e\u00edvaj\u00ed velk\u00e9 buffery, co\u017e na druh\u00e9 stran\u011b vede k nadbyte\u010dnosti a fale\u0161n\u011b negativn\u00ed reakci protokolu (bufferbloat<\/a><\/noindex>). Nav\u00edc TCP zabere hodn\u011b \u010dasu na nav\u00e1z\u00e1n\u00ed spojen\u00ed: SYN\/ACK a TLS po\u017eadavky prob\u00edhaj\u00ed odd\u011blen\u011b, co\u017e vy\u017eaduje t\u0159i roundtripy nam\u00edsto jednoho, jak to d\u011bl\u00e1 QUIC.<\/p>\n

\"HTTP
\n
\nJeliko\u017e QUIC kombinuje nahrazen\u00ed TCP s implementac\u00ed TLS 1.3, v\u0161echna spojen\u00ed jsou v\u017edy \u0161ifrov\u00e1na, de\u0161ifrovat takov\u00fd provoz nen\u00ed snaz\u0161\u00ed ne\u017e kdyby prob\u00edhal p\u0159es HTTPS. Krom\u011b toho je QUIC implementov\u00e1n na aplika\u010dn\u00ed \u00farovni, proto\u017ee kompletn\u00ed n\u00e1hrada TCP stacku by zabrala v\u011b\u010dnost.<\/i>.<\/p>\n

I p\u0159es podporu multiplexov\u00e1n\u00ed v HTTP\/2 z\u016fst\u00e1v\u00e1 probl\u00e9m blokov\u00e1n\u00ed na za\u010d\u00e1tku \u0159ady kv\u016fli nutnosti doru\u010dovat pakety ve spr\u00e1vn\u00e9m po\u0159ad\u00ed. QUIC je implementov\u00e1n nad UDP, tak\u017ee se blokov\u00e1n\u00ed vlastn\u011b nevyskytuje, a aby pakety nebyly ztraceny bez n\u00e1vratu, jsou o\u010d\u00edslov\u00e1ny a mohou obsahovat \u010d\u00e1sti \"soused\u016f\", \u010d\u00edm\u017e zaji\u0161\u0165uj\u00ed nadbyte\u010dnost. Krom\u011b toho QUIC rozb\u00edj\u00ed monolitickou frontu na n\u011bkolik proud\u016f pro r\u016fzn\u00e9 typy po\u017eadavk\u016f uvnit\u0159 jednoho p\u0159ipojen\u00ed. T\u00edm p\u00e1dem, p\u0159i ztr\u00e1t\u011b paketu, mohou probl\u00e9my nastat pouze u jedn\u00e9 fronty (nap\u0159\u00edklad p\u0159i p\u0159enosu konkr\u00e9tn\u00edho souboru):<\/p>\n

\"HTTP
\n<\/p>\n

Pou\u017eit\u00ed <\/h2>\n

\nP\u016fvodn\u011b byl QUIC vyvinut uvnit\u0159 spole\u010dnosti Google a byl p\u0159izp\u016fsoben p\u0159edev\u0161\u00edm pro intern\u00ed pou\u017eit\u00ed. V roce 2013 byl p\u0159ed\u00e1n IETF k standardizaci (kter\u00e1 st\u00e1le prob\u00edh\u00e1) a nyn\u00ed se m\u016f\u017ee ka\u017ed\u00fd zapojit do v\u00fdvoje protokolu a navrhnout, co mu pr\u00e1v\u011b chyb\u00ed. Pracovn\u00ed skupina IETF ka\u017edoro\u010dn\u011b organizuje setk\u00e1n\u00ed, b\u011bhem nich\u017e je schvalov\u00e1n nov\u00fd standard a diskutuj\u00ed se novinky. Tato implementace QUIC je pova\u017eov\u00e1na za hlavn\u00ed a pr\u00e1v\u011b na jej\u00edm z\u00e1klad\u011b je certifikov\u00e1n standard HTTP\/3.<\/p>\n

V tuto chv\u00edli se o za\u0159azen\u00ed HTTP\/3 jako hlavn\u00edho protokolu nemluv\u00ed, proto\u017ee nen\u00ed dokon\u010den a t\u00e9m\u011b\u0159 nen\u00ed podporov\u00e1n:<\/p>\n

\"HTTP
\n
\nQUIC v\u0161ak m\u016f\u017ee b\u00fdt realizov\u00e1n jako p\u0159enos mezi aplikac\u00ed a serverem, co\u017e \u00fasp\u011b\u0161n\u011b provedli v Uberu:<\/p>\n

\n

Koment\u00e1\u0159 Uber ohledn\u011b implementace QUIC<\/i><\/h3>\n

\nAbychom \u00fasp\u011b\u0161n\u011b integrovali QUIC a zlep\u0161ili v\u00fdkon aplikace za \u0161patn\u00fdch podm\u00ednek p\u0159ipojen\u00ed, nahradili jsme starou technologii (HTTP\/2 nad TLS\/TCP) protokolem QUIC. Vyu\u017eili jsme s\u00ed\u0165ovou knihovnu Cronet<\/a><\/noindex> z Chromium Projects<\/a><\/noindex>, kter\u00e1 obsahuje origin\u00e1ln\u00ed verzi protokolu \u2013 gQUIC. Tato implementace je tak\u00e9 neust\u00e1le vylep\u0161ov\u00e1na, aby odpov\u00eddala posledn\u00edm specifikac\u00edm IETF.<\/p>\n

Nejprve jsme integrovali Cronet do na\u0161ich aplikac\u00ed pro Android, abychom p\u0159idali podporu QUIC. Integrace byla provedena tak, aby se minimalizovaly n\u00e1klady na migraci. M\u00edsto \u00fapln\u00e9 v\u00fdm\u011bny star\u00e9ho s\u00ed\u0165ov\u00e9ho z\u00e1sobn\u00edku, kter\u00fd pou\u017e\u00edval knihovnu OkHttp<\/a><\/noindex>, jsme integrovali Cronet POD r\u00e1mcem OkHttp API. T\u00edmto zp\u016fsobem jsme se vyhnuli zm\u011bn\u00e1m v na\u0161ich s\u00ed\u0165ov\u00fdch vol\u00e1n\u00edch (kter\u00e9 vyu\u017e\u00edvaj\u00ed Retrofit<\/a><\/noindex>) na \u00farovni API.<\/p>\n

Podobn\u011b jako u p\u0159\u00edstupu k za\u0159\u00edzen\u00ed Android jsme implementovali Cronet do aplikac\u00ed Uber na iOS t\u00edm, \u017ee jsme zachyt\u00e1vali HTTP provoz ze s\u00ed\u0165ov\u00fdch API<\/a><\/noindex>, pomoc\u00ed NSURLProtocol<\/a><\/noindex>. Tato abstrakce poskytnut\u00e1 iOS Foundation zpracov\u00e1v\u00e1 specifick\u00e1 URL pro protokoly a zaji\u0161\u0165uje, \u017ee m\u016f\u017eeme integrovat Cronet do na\u0161ich aplikac\u00ed pro iOS bez v\u00fdznamn\u00fdch n\u00e1klad\u016f na migraci.<\/p><\/blockquote>\n

\u010derp\u00e1no z tohoto p\u0159ekladu<\/a><\/noindex> \u010dl\u00e1nku Uber<\/i><\/p>\n

Na backendu zachyt\u00e1vali QUIC spojen\u00ed p\u0159es Google Cloud lb, kter\u00fd podporuje protokol<\/a><\/noindex> od poloviny roku 2018.<\/p>\n

Nen\u00ed p\u0159ekvapen\u00edm, \u017ee Google Cloud skv\u011ble funguje s protokolem vyvinut\u00fdm Googlem, ale jak\u00e9 jsou alternativy?<\/p>\n

Nginx<\/h3>\n

\nNed\u00e1vno se CloudFlare pokou\u0161el zkombinovat<\/a><\/noindex> nginx (kter\u00fd v\u00fdchoz\u00ed nastaven\u00ed neumo\u017e\u0148uje HTTP\/3) s n\u00e1strojem Quiche. Implementace je k dispozici jako jedin\u00fd .patch soubor, k n\u011bmu\u017e je p\u0159ilo\u017een tutori\u00e1l k instalaci:<\/p>\n

curl -O https:\/\/nginx.org\/download\/nginx-1.16.1.tar.gz\ntar xvzf nginx-1.16.1.tar.gz\ngit clone --recursive https:\/\/github.com\/cloudflare\/quiche\ncd nginx-1.16.1\npatch -p01 < ..\/quiche\/extras\/nginx\/nginx-1.16.patch<\/code><\/pre>\n
\nZde m\u016f\u017eete v p\u0159\u00edpad\u011b pot\u0159eby p\u0159ipojit sv\u00e9 moduly<\/p>\n
.\/configure                          \t\n   \t--prefix=$PWD                       \t\n   \t--with-http_ssl_module              \t\n   \t--with-http_v2_module               \t\n   \t--with-http_v3_module               \t\n   \t--with-openssl=..\/quiche\/deps\/boringssl \n   \t--with-quiche=..\/quiche\n make<\/code><\/pre>\n
\nNyn\u00ed zb\u00fdv\u00e1 pouze zapnout podporu HTTP\/3<\/p>\n
events {\n    worker_connections  1024;\n}\n\nhttp {\n    server {\n        # Aktivujte QUIC a HTTP\/3.\n        listen 443 quic reuseport;\n\n        # Aktivujte HTTP\/2 (voliteln\u011b).\n        listen 443 ssl http2;\n\n        ssl_certificate      cert.crt;\n        ssl_certificate_key  cert.key;\n\n        # Aktivujte v\u0161echny verze TLS (TLSv1.3 je nutn\u00fd pro QUIC).\n        ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;\n\n        # Buffrov\u00e1n\u00ed \u017e\u00e1dost\u00ed v sou\u010dasn\u00e9 dob\u011b nen\u00ed podporov\u00e1no pro HTTP\/3.\n        proxy_request_buffering off;\n\n        # P\u0159idejte hlavi\u010dku Alt-Svc pro vyjedn\u00e1v\u00e1n\u00ed HTTP\/3.\n        add_header alt-svc 'h3-27=":443"; ma=86400';\n    }\n}<\/code><\/pre>\n
\nV b\u011b\u017en\u00fdch prohl\u00ed\u017ee\u010d\u00edch zat\u00edm nebude mo\u017en\u00e9 se p\u0159ipojit p\u0159es HTTP\/3, ale m\u016f\u017eete vz\u00edt Chrome Canary<\/a><\/noindex> a spustit jej s p\u0159\u00edznakem --enable-quic<\/code>, obr\u00e1tit se na sv\u016fj server nebo nap\u0159\u00edklad na str\u00e1nku quic.rocks a zkontrolovat typ p\u0159ipojen\u00ed v N\u00e1stroj\u00edch pro v\u00fdvoj\u00e1\u0159e:
\n\"HTTP
\nM\u00edsto HTTP\/3 se zobraz\u00ed http2+quic\/99<\/code>, ale v podstat\u011b jde o to sam\u00e9.<\/p>\n
Dal\u0161\u00ed technologie<\/h3>\n
<\/p>\n