Tools for debugging, testing and using HTTP/2

#1

Post by anand-s » Sun, Dec 06, 2015, 5:11 AM UTC

Tools for debugging, testing and using HTTP/2
blog.cloudflare.com

Re: Tools for debugging, testing and using HTTP/2

#2

Post by CrLf » Sun, Dec 06, 2015, 6:17 PM UTC

One thing is missing from that list: how to test for ALPN support (or the lack thereof). The OpenSSL client just lists the next protocols supported, but no mention if that's NPN or ALPN.

This is one of those details that I believe are the real roadblocks to HTTP/2.0 support. Google is trying to drive adoption by deprecating old features like NPN from Chrome, but people setting their servers up with HTTP/2.0 don't even know about these details or how it affects them.

Re: Tools for debugging, testing and using HTTP/2

#3

Post by androck1 » Sun, Dec 06, 2015, 7:35 PM UTC

Chrome also shows more detailed HTTP/2 tracing in chrome://net-internals. Select HTTP/2 from the drop-down.

Re: Tools for debugging, testing and using HTTP/2

#4

Post by ghedo » Sun, Dec 06, 2015, 10:07 PM UTC

CrLf wrote: post #2

One thing is missing from that list: how to test for ALPN support (or the lack thereof). The OpenSSL client just lists the next protocols supported, but no mention if that's NPN or ALPN. This is one of those details that I believe are the real roadblocks to HTTP/2.0 support. Google is trying to drive adoption by deprecating old features like NPN from Chrome, but people setting their servers up with HTTP/2.0 don't eve…

Using curl is one way:

  % curl -v https://google.com/ --http2
  *   Trying 2607:f8b0:4007:802::1008...
  * Connected to google.com (2607:f8b0:4007:802::1008) port 443 (#0)
  * found 180 certificates in /etc/ssl/certs/ca-certificates.crt
  * found 722 certificates in /etc/ssl/certs
  * ALPN, offering h2
  * ALPN, offering http/1.1
  * SSL connection using TLS1.2 / ECDHE_ECDSA_AES_128_GCM_SHA256
  ...
  * ALPN, server accepted to use h2

The above is with the GnuTLS build on Debian, recent enough OpenSSL versions support both NPN and ALPN.

Re: Tools for debugging, testing and using HTTP/2

#5

Post by sohkamyung » Mon, Dec 07, 2015, 2:25 AM UTC

Daniel Stenberg (creator of curl) has a HTTP/2 explained website [1] which might help in understanding HTTP/2.

[1] http://daniel.haxx.se/http2/

Re: Tools for debugging, testing and using HTTP/2

#6

Post by achillean » Mon, Dec 07, 2015, 6:28 AM UTC

ghedo wrote: post #4

CrLf wrote: post #2

One thing is missing from that list: how to test for ALPN support (or the lack thereof). The OpenSSL client just lists the next protocols supported, but no mention if that's NPN or ALPN. This is one of those details that I believe are the real roadblocks to HTTP/2.0 support. Google is trying to drive adoption by deprecating old features like NPN from Chrome, but people setting their servers up with HTTP/2.0 don't eve…

Using curl is one way: % curl -v https://google.com/ --http2 * Trying 2607:f8b0:4007:802::1008... * Connected to google.com (2607:f8b0:4007:802::1008) port 443 (#0) * found 180 certificates in /etc/ssl/certs/ca-certificates.crt * found 722 certificates in /etc/ssl/certs * ALPN, offering h2 * ALPN, offering http/1.1 * SSL connection using TLS1.2 / ECDHE_ECDSA_AES_128_GCM_SHA256 ... * ALPN, server accepted to use h2 Th…

Shodan also keeps track of the ALPN negotation results, see the "Negotiated HTTP Versions" chart: https://www.shodan.io/report/tbi6kDZa

Re: Tools for debugging, testing and using HTTP/2

#7

Post by jgrahamc » Mon, Dec 07, 2015, 9:26 AM UTC

sohkamyung wrote: post #5

Daniel Stenberg (creator of curl) has a HTTP/2 explained website [1] which might help in understanding HTTP/2. [1] http://daniel.haxx.se/http2/

Thanks. I added a section at the end with resources on learning more about HTTP/2

Re: Tools for debugging, testing and using HTTP/2

#8

Post by Ambroos » Mon, Dec 07, 2015, 11:11 AM UTC

CrLf wrote: post #2

One thing is missing from that list: how to test for ALPN support (or the lack thereof). The OpenSSL client just lists the next protocols supported, but no mention if that's NPN or ALPN. This is one of those details that I believe are the real roadblocks to HTTP/2.0 support. Google is trying to drive adoption by deprecating old features like NPN from Chrome, but people setting their servers up with HTTP/2.0 don't eve…

Next protocols supported are strictly NPN only. If you want to check ALPN support for a specific connection type you can use the following command:

  openssl s_client -alpn h2 -connect news.ycombinator.com:443

Near the end of the output you'll see the ALPN protocol or `No ALPN negotiated`. I haven't managed to get a list of server-supported protocols so far, not sure if that's even possible with ALPN.

This is with LibreSSL 2.3, but I expect OpenSSL 1.0.2 to support it too.