Solving HTTP Problems With Code and Protocols NATASHA ROONEY - - PowerPoint PPT Presentation

▶
solving http problems with code and protocols
SMART_READER_LITE
LIVE PREVIEW

Solving HTTP Problems With Code and Protocols NATASHA ROONEY - - PowerPoint PPT Presentation

Jul 08, 2023 17 likes •1.09k views

@thisNatasha Solving HTTP Problems With Code and Protocols NATASHA ROONEY @thisNatasha Web 7. Application Data HTTP / IMAP HTTP 6. Data Presentation , SSL / TLS Encryption 5. Session and connection - management TLS 4. Transport of

slide-1
SLIDE 1 @thisNatasha

Solving HTTP Problems With Code and Protocols

NATASHA ROONEY

slide-2
SLIDE 2 @thisNatasha
  • 7. Application Data
HTTP / IMAP
  • 6. Data Presentation,
Encryption SSL / TLS
  • 5. Session and connection
management
  • 4. Transport of packets and
streams TCP / UDP
  • 3. Routing and delivery of
datagrams on the Network IP / IPSec
  • 2. Local Data Connection
Ethernet
  • 1. Physical data connection
(cables) CAT5

HTTP

TLS TCP IP Web

slide-3
SLIDE 3 @thisNatasha

Some fundamental limitations

slide-4
SLIDE 4 @thisNatasha

300,000,000 m/s

slide-5
SLIDE 5 @thisNatasha

300,000,000 m/s

Speed of Light

slide-6
SLIDE 6 @thisNatasha

300km, 1ms

slide-7
SLIDE 7 @thisNatasha

10ms

slide-8
SLIDE 8 @thisNatasha

10ms

5G

slide-9
SLIDE 9 @thisNatasha

Only one way!

And as the crow flies...

slide-10
SLIDE 10 @thisNatasha @thisNatasha

Hops

slide-11
SLIDE 11 @thisNatasha

Not good enough!

slide-12
SLIDE 12 @thisNatasha

CDNs, Edge

slide-13
SLIDE 13 @thisNatasha

Mobile Network (not wifi) The Internet

slide-14
SLIDE 14 @thisNatasha

Amount of data

slide-15
SLIDE 15 @thisNatasha
slide-16
SLIDE 16 @thisNatasha
slide-17
SLIDE 17 @thisNatasha
slide-18
SLIDE 18 @thisNatasha
slide-19
SLIDE 19 @thisNatasha @thisNatasha

Speed & Distance

Capped by Speed of Light

Amount of Data

>100 objects per site 800k to 2.5mb data >50 resources on same domain

slide-20
SLIDE 20 @thisNatasha

RTs are Evil

Mostly because of physics. Not much you can do about that.

slide-21
SLIDE 21 @thisNatasha

HTTP/1

slide-22
SLIDE 22 @thisNatasha

HTTP/1 TLS TCP IP HTTP/1 TLS TCP

Request

slide-23
SLIDE 23 @thisNatasha

HTTP/1 TLS TCP IP HTTP/1 TLS TCP

Request Response

slide-24
SLIDE 24 @thisNatasha

HTTP/1 TLS TCP IP HTTP/1 TLS TCP

Request Response Request

slide-25
SLIDE 25 @thisNatasha
slide-26
SLIDE 26 @thisNatasha
slide-27
SLIDE 27 @thisNatasha

Urgh...

slide-28
SLIDE 28 @thisNatasha @thisNatasha

Spriting

slide-29
SLIDE 29 @thisNatasha @thisNatasha

Inlining

slide-30
SLIDE 30 @thisNatasha
slide-31
SLIDE 31 @thisNatasha
slide-32
SLIDE 32 @thisNatasha

Image source: @jungkees

slide-33
SLIDE 33 @thisNatasha

Pipelining

slide-34
SLIDE 34 @thisNatasha

Home Roads

Supermarket

slide-35
SLIDE 35 @thisNatasha

Home Roads

Supermarket

slide-36
SLIDE 36 @thisNatasha

HTTP/1 TLS TCP IP HTTP/1 TLS TCP

TCP Setup TLS Setup HTTP Request/Response

slide-37
SLIDE 37 @thisNatasha

HTTP/2

slide-38
SLIDE 38 @thisNatasha

SPDY

slide-39
SLIDE 39 @thisNatasha

Home Roads

Supermarket

slide-40
SLIDE 40 @thisNatasha

Home Roads

Supermarket

slide-41
SLIDE 41 @thisNatasha @thisNatasha

SPDY

A Protocol by Google 2009 Header Compression Parallel Connections Multiplexing Priority Marking Server Push TLS (to work)

slide-42
SLIDE 42 @thisNatasha @thisNatasha

SPDY

A Protocol by Google Header Compression

slide-43
SLIDE 43 @thisNatasha
slide-44
SLIDE 44 @thisNatasha
slide-45
SLIDE 45 @thisNatasha
slide-46
SLIDE 46 @thisNatasha
slide-47
SLIDE 47 @thisNatasha

HTTP/2

slide-48
SLIDE 48 @thisNatasha

“Idea was to maintain HTTP semantics but change how it is transported.”

Daniel Stenberg https://daniel.haxx.se/blog/
slide-49
SLIDE 49 @thisNatasha

Home Roads

Supermarket

slide-50
SLIDE 50 @thisNatasha

Home Roads

Supermarket

slide-51
SLIDE 51 @thisNatasha

HTTP/1 TLS TCP IP HTTP/1 TLS TCP

Request Response Request Request

slide-52
SLIDE 52 @thisNatasha @thisNatasha

HTTP2

A Protocol by IETF (SDPY base) Binary Header Compression Multiplexing Server Push TLS...

slide-53
SLIDE 53 @thisNatasha @thisNatasha

HTTP2

A Protocol by IETF (SDPY base)

slide-54
SLIDE 54 @thisNatasha
slide-55
SLIDE 55 @thisNatasha @thisNatasha

Stats

Gimme gimme 35% Requests 70% HTTPS Connections 13% Top 1,000,000 Sites 29% Top 1000 Sites “90% your site”

slide-56
SLIDE 56 @thisNatasha

2% packet loss

HTTP1 is better.

slide-57
SLIDE 57 @thisNatasha

Head of line blocking

slide-58
SLIDE 58 @thisNatasha

Home Roads

Supermarket

slide-59
SLIDE 59 @thisNatasha

Home Roads

Supermarket

slide-60
SLIDE 60 @thisNatasha

Home Roads

Supermarket

Not good enough!

slide-61
SLIDE 61 @thisNatasha

Home Roads

Supermarket

Not good enough!

slide-62
SLIDE 62 @thisNatasha

TCP issue

(Can happen on any protocol with in-order delivery)

slide-63
SLIDE 63 @thisNatasha

QUIC

slide-64
SLIDE 64 @thisNatasha

“Idea was to maintain HTTP semantics but change how it is transported.”

Daniel Stenberg https://daniel.haxx.se/blog/
slide-65
SLIDE 65 @thisNatasha

Home Roads

Supermarket

TCP

slide-66
SLIDE 66 @thisNatasha @thisNatasha

TCP

Suffers from Head of Line Blocking

UDP

Can work...with help.

Transport Layer

slide-67
SLIDE 67 @thisNatasha

“We want QUIC to work on today’s internet”

Jana Iyengar QUIC Editor, Google
slide-68
SLIDE 68 @thisNatasha

Ossification

slide-69
SLIDE 69 @thisNatasha

Why TCP or UDP only?

slide-70
SLIDE 70 @thisNatasha

Image source: http://itpro.nikkeibp.co.jp/

slide-71
SLIDE 71 @thisNatasha

HTTP/2 TLS 1.2+ TCP IP

Application

QUIC UDP

Google Crypto

Congestion Control

slide-72
SLIDE 72 @thisNatasha

HTTP/2 TLS 1.2+ TCP IP

Application

QUIC UDP

Google Crypto

Congestion Control

slide-73
SLIDE 73 @thisNatasha @thisNatasha

QUIC

A Protocol by Google Goo

slide-74
SLIDE 74 @thisNatasha

HTTP/2 TLS 1.2+ TCP IP

HTTP over QUIC

QUIC UDP

TLS 1.3

slide-75
SLIDE 75 @thisNatasha

“A "stream" is an independent, bidirectional sequence of frames exchanged between the client and server within an HTTP/2 connection… A single HTTP/2 connection can contain multiple concurrently open streams…”

Hypertext Transfer Protocol Version 2 (HTTP/2), RFC7540
slide-76
SLIDE 76 @thisNatasha

Image source: High Performance Browser Networking https://hpbn.co/http2/

slide-77
SLIDE 77 @thisNatasha

IP

HTTP over QUIC

QUIC UDP

TLS 1.3

HTTP over QUIC

QUIC UDP

TLS 1.3

slide-78
SLIDE 78 @thisNatasha

IP

HTTP over QUIC

QUIC UDP

TLS 1.3

HTTP over QUIC

QUIC UDP

TLS 1.3

slide-79
SLIDE 79 @thisNatasha

IP

HTTP over QUIC

QUIC UDP

TLS 1.3

HTTP over QUIC

QUIC UDP

TLS 1.3

slide-80
SLIDE 80 @thisNatasha

IP

HTTP over QUIC

QUIC UDP

TLS 1.3

HTTP over QUIC

QUIC UDP

TLS 1.3

Head of Line Blocking!

slide-81
SLIDE 81 @thisNatasha

RTs are Evil

Mostly because of physics. Not much you can do about that.

slide-82
SLIDE 82 @thisNatasha

IP

HTTP over QUIC

QUIC UDP

TLS 1.3

HTTP over QUIC

QUIC UDP

TLS 1.3

0RTT: Setup + Data 2RTT: If QUIC version negotiation needed 1RTT: New Crypto Keys

slide-83
SLIDE 83 @thisNatasha

Reduce the RTs!

slide-84
SLIDE 84 @thisNatasha
slide-85
SLIDE 85 @thisNatasha
slide-86
SLIDE 86 @thisNatasha

7% Internet Traffic

35% Google Egress Traffic

slide-87
SLIDE 87 @thisNatasha

How does this affect me?

slide-88
SLIDE 88 @thisNatasha

Abstraction

Is a computer scientist’s friend / fiend

slide-89
SLIDE 89 @thisNatasha

L a y e r V i

  • l

a t i

  • n
slide-90
SLIDE 90 @thisNatasha
  • 7. Application Data
HTTP / IMAP
  • 6. Data Presentation,
Encryption SSL / TLS
  • 5. Session and connection
management
  • 4. Transport of packets and
streams TCP / UDP
  • 3. Routing and delivery of
datagrams on the Network IP / IPSec
  • 2. Local Data Connection
Ethernet
  • 1. Physical data connection
(cables) CAT5

HTTP

TLS TCP IP Web

slide-91
SLIDE 91 @thisNatasha @thisNatasha

Some things

If you have to do something... Manage your resources logically Detect on upgrade header and adapt Measure Remember Physics!

slide-92
SLIDE 92 @thisNatasha @thisNatasha

Recap

We made it! RTTs, Physics, Data SPDY, HTTP2, QUIC Header compression Multiplexing & Streams Head of Line Blocking Make protocols for today’s internet

slide-93
SLIDE 93 @thisNatasha

3

slide-94
SLIDE 94 @thisNatasha
slide-95
SLIDE 95 @thisNatasha
slide-96
SLIDE 96 @thisNatasha
slide-97
SLIDE 97 @thisNatasha

Thank-you

People: Martin Thomson, Mark Nottingham, Jana Iyengar, Mike Bishop, Eric Rescola, Ian Swett

slide-98
SLIDE 98 @thisNatasha
slide-99
SLIDE 99 @thisNatasha
slide-100
SLIDE 100 @thisNatasha
slide-101
SLIDE 101 @thisNatasha
  • 7. Application Data
HTTP / IMAP
  • 6. Data Presentation,
Encryption SSL / TLS
  • 5. Session and connection
management
  • 4. Transport of packets and
streams TCP / UDP
  • 3. Routing and delivery of
datagrams on the Network IP / IPSec
  • 2. Local Data Connection
Ethernet
  • 1. Physical data connection
(cables) CAT5

OSI Model

slide-102
SLIDE 102 @thisNatasha

Handshake Flow TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

Key Exchange Authentication Algorithm Strength Mode Cipher MAC or PRF

TLS / Handshake Cheat Sheet

Key Exchange Method: creates the pre master secret. Premaster secret is combined with PRF to create master secret RSA, DHE_RSA, ECDHE_RSA, ECDHE_ECDSA Authentication Method: Uses public key crypto and certificates public key together. Once certificate is validated the client can used public key. RSA or ECDSA Certs: X.509, ASN.1 DER encoding. Server Hello, Certificate
  • Server selects cipher & compression
method
  • Server send certificate
  • Client authenticates
Key Exchange Pre-master secret exchanged between client & server, client validates certificate Master Secret Client & Server can compute Master Secret. MAC Server verifies MAC, returns to client to verify also. Finished Handshake complete. Client Hello Client sends TLS Version, Ciphersuites, Compression methods

Ciphers, Standards and Terms

Encryption 3DES, AES, ARIA, CAMELLIA, RC4, and SEED [1] Steam: adds MAC [2] Block: adds IV and padding after encryption [3] Encryption (AEAD): encryption and integrity validation, using nonce, no padding, no IV. Master Secret Pre-master secret: combines params to help client and server create master secret. Master Secret: both server and client create this from pre-master secret to symmetrically encrypt Integrity Validation PRF: Pseudorandom
  • Function. Takes a
secret, a seed, and a unique label. TLS1.2 suites use PRF based
  • n HMAC and SHA256
MAC: used for integrity validation in handshake and record.
slide-103
SLIDE 103 @thisNatasha

[1] Client Hello

Cli-ant Ser-ver

Server Hello [2] Certificate [3] Server Key Exchange [4] Server Hello Done [5] [6] Client Key Exchange [7] (Change Cipher Spec) [8] Finished (Change Cipher Spec) [9] Finished [10]

TLS Handshake

slide-104
SLIDE 104 @thisNatasha

Cli-ant Ser-ver TCP and TLS with Session Tickets

TCP Fast Open Handshake [1] Client Hello Server Hello [2] (Change Cipher Spec) [3] Finished [4] [5] (Change Cipher Spec) [6] Finished

slide-105
SLIDE 105 @thisNatasha
slide-106
SLIDE 106 @thisNatasha

Transport Overhead

slide-107
SLIDE 107 @thisNatasha @thisNatasha

Min