QUIC and HTTP/3 Protocol Development

10/22/2020

This post announces the IETF Last Call for QUIC and HTTP/3 draft 32, a critical step towards standardization. It highlights Cloudflare's long-standing involvement in QUIC development, including co-chairing the working group and deploying HTTP/3 on its edge network since September 2019. The post also details the availability of extensive learning resources on Cloudflare TV, covering QUIC and HTTP/3 basics, debugging, and performance analysis, and introduces Cloudflare's 'quiche' library for QUIC and HTTP/3.

5/8/2020

This post details the integration of CUBIC congestion control and HyStart++ into Cloudflare's quiche IETF QUIC implementation. It explains the concepts of QUIC congestion control and loss recovery, contrasts Reno and CUBIC algorithms, and introduces HyStart++ as an improvement to slow start. Lab test results are presented, showing that QUIC CUBIC with HyStart++ performs comparably to TCP CUBIC and significantly reduces packet loss compared to QUIC Reno without HyStart++.

4/14/2020

This post details performance comparisons between HTTP/3 and HTTP/2, highlighting the benefits of HTTP/3 in reducing head-of-line blocking due to its UDP-based nature and faster 0-RTT session startup. It presents benchmark data showing HTTP/3's advantage in Time To First Byte (TTFB) and performance on small test pages. The post also discusses the impact of congestion control algorithms (CUBIC for HTTP/3 vs. BBR v1 for HTTP/2) on performance, noting that while HTTP/3 shows promise, its real-world performance currently trails HTTP/2 by a small margin on average across various geographies, likely due to these algorithmic differences. It concludes with excitement for the finalization of the standard and future optimizations.

1/14/2020

This post details the creation of a cost-effective and extensible testbed for transport protocol development, specifically for QUIC and HTTP/3. It outlines the goals of the lab, including aiding multiple transport protocol development, debugging, performance comparison, and bottleneck identification. The configuration includes Raspberry Pis for ARM architecture testing, x86 hosts, traffic shapers (FreeBSD/ipfw+dummynet, Linux/netem), and automation scripts for reproducible testing under various network conditions. It also introduces the integration of smartphones (Android/iOS) into the testbed for mobile device performance analysis.

1/8/2020

This post details techniques to accelerate UDP packet transmission for QUIC, focusing on improving throughput by reducing system call overhead and leveraging kernel offloading features. It introduces and evaluates the performance benefits of using `sendmmsg()` for batching UDP packets and `UDP_SEGMENT` (GSO) for kernel-level segmentation. The post also discusses the challenges of integrating packet pacing with these batching techniques.

12/31/2019

This post details the adoption of the 'Extensible Prioritization Scheme for HTTP' by the IETF HTTP Working Group, co-authored by Tommy Pauly and Kazuho Oku. It explains the limitations of HTTP/1.1 and HTTP/2 prioritization, the challenges with HTTP/3's non-deterministic ordering, and introduces the new scheme which uses absolute weighting signaled in an HTTP header. This scheme aims to improve performance by making prioritization easier to reason about and schedule, and is designed to be backported to HTTP/2 or carried over HTTP/1.1 hops. The post also touches upon Cloudflare's own Enhanced HTTP/2 Prioritization feature.

11/20/2019

This post details the implementation and implications of 0-RTT connection resumption for QUIC, building upon TLS 1.3's capabilities. It explains how QUIC achieves true 0-RTT by merging transport and cryptographic handshakes. The post highlights the security risks of 0-RTT, specifically replay attacks on non-idempotent requests, and Cloudflare's mitigation strategies, including rejecting obvious non-idempotent requests and adding the `Early-Data: 1` header. It also introduces the dashboard toggle for enabling 0-RTT and mentions the `ssl_early_data` option for NGINX deployments.

10/17/2019

This post details the process of integrating Cloudflare's 'quiche' library for QUIC and HTTP/3 into NGINX. It provides instructions for downloading NGINX source code, cloning the 'quiche' repository, applying the provided patch, and building NGINX with HTTP/3 support enabled. It also includes a minimal NGINX configuration example to enable QUIC and HTTP/3, and discusses the experimental nature of the implementation.

9/26/2019

Announces the general availability of QUIC and HTTP/3 support on the Cloudflare edge network, enabling customers to serve traffic over these new protocols. Highlights collaboration with Google Chrome and Mozilla Firefox on standards development and client support. Explains the technical evolution from HTTP/1.0 to HTTP/2, detailing the head-of-line blocking problem in TCP and how QUIC (and thus HTTP/3) addresses it by using UDP and introducing streams as first-class citizens at the transport layer, combining TCP's 3-way handshake with TLS 1.3's handshake for faster, encrypted connections.

8/13/2019

This post details Cloudflare's immediate response and mitigation of several HTTP/2 Denial of Service (DoS) vulnerabilities (CVE-2019-9511 through CVE-2019-9518). Cloudflare's Protocols team developed and deployed patches to detect and block attack attempts, ensuring customer protection. The company's NGINX-based infrastructure was updated to address these specific vulnerabilities, with ongoing monitoring.

1/24/2019

This post details the historical evolution of HTTP from HTTP/0.9 to HTTP/1.1 and HTTP/2, leading up to the development of HTTP/3. It explains the relationship between HTTP/3 and the QUIC transport protocol, differentiating between Google's gQUIC and the IETF's QUIC standard. The post also discusses the IETF standardization process, including Internet Drafts (I-Ds) and RFCs, and presents a 'Secure Web Timeline' visualization to illustrate the development of web protocols. It highlights Cloudflare's involvement with QUIC and HTTP/3, including their open-source 'quiche' implementation.

1/22/2019

This post introduces 'quiche', Cloudflare's open-source implementation of the QUIC protocol written in Rust. It details the design principles of quiche, emphasizing a minimal API for application integration and its use of BoringSSL for TLS 1.3 handshakes and the 'ring' library for packet protection. The post also highlights the challenges and solutions for integrating with existing stacks like NGINX and cURL, and the open-sourcing of changes made to BoringSSL and ring to support QUIC's cryptographic needs.

9/25/2018

This post details the beta deployment of QUIC on cloudflare-quic.com, supporting draft 14 of the IETF QUIC transport standard. It provides instructions for users to build and use the ngtcp2 client to perform HTTP transactions over QUIC. The post analyzes the client HELLO and server HELLO packets, explaining QUIC's connection IDs, the overlap of transport and TLS handshakes (reducing round trips), and the use of PADDING frames to mitigate amplification attacks. It also contrasts IETF QUIC with Google's gQUIC and highlights the potential for large connection IDs in Cloudflare's infrastructure.

9/25/2018

This post introduces QUIC as a solution to the problems of unreliable internet conditions (packet loss, IP address changes) that affect TCP-based protocols like HTTPS and HTTP/2. It explains QUIC's use of UDP, end-to-end encryption, forward-error correction, and its ability to solve the HTTP/2 Head-of-Line blocking problem by managing streams independently. It also highlights QUIC's merged connection and encryption handshake for reduced latency. The post encourages users to test QUIC via cloudflare-quic.com and join the early access program.

7/26/2018

This post introduces QUIC as a new encrypted-by-default Internet transport protocol designed to replace TCP and TLS. It highlights QUIC's built-in security and performance improvements, including a combined handshake for faster connection establishment and encryption of metadata to prevent ossification. The post also addresses the head-of-line blocking issue inherent in HTTP/2 over TCP by enabling independent stream delivery in QUIC. Challenges in deployment, such as NAT rebinding and connection migration, are discussed, along with QUIC's use of connection IDs and the need for Layer 4 load balancing solutions like Katran. The post also introduces QPACK as the header compression mechanism for QUIC, explaining its challenges with out-of-order delivery across streams.