LoginSignup
4

More than 5 years have passed since last update.

nghttp2でhttp2を試してみる

Last updated at Posted at 2015-12-13

vagrant環境:CentOS Linux release 7.1.1503 (Core)

公式通り、必要なモジュールをyumで入れる。
https://github.com/tatsuhiro-t/nghttp2

sudo apt-get install g++ make binutils autoconf automake autotools-dev libtool pkg-config \
  zlib1g-dev libcunit1-dev libssl-dev libxml2-dev libev-dev libevent-dev libjansson-dev \
  libjemalloc-dev cython python3-dev python-setuptools

実際に必要だったモジュールは以下 pythonが必要。今回はv2.7.5

#yum install libtool binutils libev-devel autoconf automake python python-devel

libtoolsが無いとautoconf-iした時にメッセージが出る。

output
Can't exec "libtoolize": No such file or directory at /usr/share/autoconf/Autom4te/FileUtils.pm line 345, <GEN3> line 5.
autoreconf: failed to run libtoolize: No such file or directory
autoreconf: libtoolize is needed because this package uses Libtool

nghttp2 v1.5.0をgithubから

#wget https://github.com/tatsuhiro-t/nghttp2/releases/download/v1.5.0/nghttp2-1.5.0.tar.gz
#tar zxvf nghttp2-1.5.0.tar.gz
#cd nghttp2-1.5.0
#autoreconf -i
#automake
#autoconf
#./configure
#make
#make install
#make html

設定ファイルの作成

#touch /etc/sysconfig/nghttpd
#vi /etc/sysconfig/nghttpd

鍵の作成

#openssl genrsa 2048 > server.key
#openssl rsa -in server.key -out server.key
#openssl req -new -key server.key > server.csr
#openssl x509 -days 3650 -req -signkey server.key < server.csr > server.crt

nghttp2ユーザの作成

#chmod 600 server.crt
#chmod 600 server.key
#chown nghttp2:nghttp2 /root/ssl/server.key
#chown nghttp2:nghttp2 /root/ssl/server.crt

サービス登録

#cd /etc/systemd/system
#touch nghttpd.service
#vi nghttpd.service
#systemctl daemon-reload
#systemctl list-unit-files | grep nghttpd
#systemctl start nghttpd.service

確認

#ss -antup
Netid  State      Recv-Q Send-Q     Local Address:Port       Peer Address:Port
tcp    UNCONN     0      0                      *:51203                 *:*      users:(("dhclient",1175,20))
tcp    UNCONN     0      0                      *:68                    *:*      users:(("dhclient",1175,6))
tcp    UNCONN     0      0                     :::61435                :::*      users:(("dhclient",1175,21))
tcp    LISTEN     0      128                    *:22                    *:*      users:(("sshd",1147,3))
tcp    LISTEN     0      10             127.0.0.1:25                    *:*      users:(("sendmail",1213,4))
tcp    ESTAB      0      0              10.0.2.15:22             10.0.2.2:57340  users:(("sshd",2512,3),("sshd",2509,3))
tcp    LISTEN     0      128                   :::8080                 :::*      users:(("nghttpd",1149,10))
tcp    LISTEN     0      128                   :::22                   :::*      users:(("sshd",1147,4))

# ps ax | grep nghttp
21983 ?        Ss     0:00 /usr/local/bin/nghttpd -n 1 -d /var/www/html 8080 /etc/pki/tls/private/server.key /etc/pki/tls/private/server.crt

FireWalldを止める

#systemctl stop firewalld
#systemctl disable firewalld

ここまでで適当なディレクトリにindex.htmlファイルをおくと、http2でのブラウザ確認ができる。

curlをhttp2に対応させる

もともとCentOSに入っているopenssl,zlib,curlを使わず、最新を持ってくる。

# curl -LO https://www.openssl.org/source/openssl-1.0.2e.tar.gz
# tar zxvf openssl-1.0.2e.tar.gz
# cd openssl-1.0.2e
# ./config shared zlib-dynamic
# make && make test
# sudo make install

# curl -LO http://zlib.net/zlib-1.2.8.tar.gz
# tar zxvf zlib-1.2.8.tar.gz
# cd zlib-1.2.8
# ./configure
# make && make test
# make install

# curl -LO http://curl.haxx.se/download/curl-7.46.0.tar.gz
# tar zxvf curl-7.46.0.tar.gz
# cd curl-7.46.0
# ./configure --help
# ./configure --with-nghttp2=/usr/local/

libnghttp2を使う ※環境によっては、boostが必要
# cd nghttp2をインストールしたディレクトリ
# ./configure --enable-asio-lib
# make
# make install
output
curl version:     7.46.0
Host setup:       x86_64-pc-linux-gnu
Install prefix:   /usr/local
Compiler:         gcc
SSL support:      enabled (OpenSSL)
SSH support:      no      (--with-libssh2)
zlib support:     enabled
GSS-API support:  no      (--with-gssapi)
TLS-SRP support:  no      (--enable-tls-srp)
resolver:         default (--enable-ares / --enable-threaded-resolver)
IPv6 support:     enabled
Unix sockets support: enabled
IDN support:      no      (--with-{libidn,winidn})
Build libcurl:    Shared=yes, Static=yes
Built-in manual:  enabled
--libcurl option: enabled (--disable-libcurl-option)
Verbose errors:   enabled (--disable-verbose)
SSPI support:     no      (--enable-sspi)
ca cert bundle:   /etc/pki/tls/certs/ca-bundle.crt
ca cert path:     no
LDAP support:     no      (--enable-ldap / --with-ldap-lib / --with-lber-lib)
LDAPS support:    no      (--enable-ldaps)
RTSP support:     enabled
RTMP support:     no      (--with-librtmp)
metalink support: no      (--with-libmetalink)
PSL support:      no      (libpsl not found)
HTTP2 support:    enabled (nghttp2)★
Protocols:        DICT FILE FTP FTPS GOPHER HTTP HTTPS IMA

googleはhttp2対応していてyahooはしていなかった。

#/usr/local/bin/nghttp -nv https://google.com
[  0.015] Connected
[  0.020][NPN] server offers:
          * h2
          * spdy/3.1
          * http/1.1
The negotiated protocol: h2 ★
[  0.032] recv SETTINGS frame <length=18, flags=0x00, stream_id=0>
          (niv=3)
          [SETTINGS_MAX_CONCURRENT_STREAMS(0x03):100]
          [SETTINGS_INITIAL_WINDOW_SIZE(0x04):1048576]
          [SETTINGS_MAX_FRAME_SIZE(0x05):16384]
[  0.032] recv WINDOW_UPDATE frame <length=4, flags=0x00, stream_id=0>
          (window_size_increment=983041)
[  0.032] send SETTINGS frame <length=12, flags=0x00, stream_id=0>
          (niv=2)
          [SETTINGS_MAX_CONCURRENT_STREAMS(0x03):100]
          [SETTINGS_INITIAL_WINDOW_SIZE(0x04):65535]
[  0.032] send SETTINGS frame <length=0, flags=0x01, stream_id=0>
          ; ACK
          (niv=0)
[  0.032] send PRIORITY frame <length=5, flags=0x00, stream_id=3>
          (dep_stream_id=0, weight=201, exclusive=0)
[  0.032] send PRIORITY frame <length=5, flags=0x00, stream_id=5>
          (dep_stream_id=0, weight=101, exclusive=0)
[  0.032] send PRIORITY frame <length=5, flags=0x00, stream_id=7>
          (dep_stream_id=0, weight=1, exclusive=0)
[  0.032] send PRIORITY frame <length=5, flags=0x00, stream_id=9>
          (dep_stream_id=7, weight=1, exclusive=0)
[  0.032] send PRIORITY frame <length=5, flags=0x00, stream_id=11>
          (dep_stream_id=3, weight=1, exclusive=0)
[  0.032] send HEADERS frame <length=35, flags=0x25, stream_id=13>
          ; END_STREAM | END_HEADERS | PRIORITY
          (padlen=0, dep_stream_id=11, weight=16, exclusive=0)
          ; Open new stream
          :method: GET
          :path: /
          :scheme: https
          :authority: google.com
          accept: */*
          accept-encoding: gzip, deflate
          user-agent: nghttp2/1.5.0
[  0.037] recv SETTINGS frame <length=0, flags=0x01, stream_id=0>
          ; ACK
          (niv=0)
[  0.037] recv (stream_id=13) :status: 302
[  0.037] recv (stream_id=13) cache-control: private
[  0.037] recv (stream_id=13) content-type: text/html; charset=UTF-8
[  0.037] recv (stream_id=13) location: https://www.google.co.jp/?gfe_rd=cr&ei=ESVpVsPeOer98weXwJPYCA
[  0.037] recv (stream_id=13) content-length: 262
[  0.037] recv (stream_id=13) date: Thu, 10 Dec 2015 07:09:05 GMT
[  0.037] recv (stream_id=13) server: GFE/2.0
[  0.037] recv (stream_id=13) alternate-protocol: 443:quic,p=0
[  0.037] recv (stream_id=13) alt-svc: clear
[  0.037] recv HEADERS frame <length=160, flags=0x04, stream_id=13>
          ; END_HEADERS
          (padlen=0)
          ; First response header
[  0.037] recv DATA frame <length=262, flags=0x01, stream_id=13>
          ; END_STREAM
[  0.038] recv PING frame <length=8, flags=0x00, stream_id=0>
          (opaque_data=0000000000000000)
[  0.038] send GOAWAY frame <length=8, flags=0x00, stream_id=0>
          (last_stream_id=0, error_code=NO_ERROR(0x00), opaque_data(0)=[])

yahooにアクセス
# /usr/local/bin/nghttp -nv https://yahoo.com
[  0.100] Connected
[  0.191][NPN] server offers:
          * spdy/3.1
          * spdy/3
          * http/1.1
          * http/1.0
[ERROR] HTTP/2 protocol was not selected. (nghttp2 expects h2)
Some requests were not processed. total=1, processed=0

curlを使ってアクセス

# curl -vso /dev/null --http2 https://youtube.com
* Rebuilt URL to: https://youtube.com/
*   Trying 216.58.221.14...
* Connected to youtube.com (216.58.221.14) port 443 (#0)
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
} [252 bytes data]
* TLSv1.2 (IN), TLS handshake, Server hello (2):
{ [116 bytes data]
* NPN, negotiated HTTP2 (h2)
* TLSv1.2 (IN), TLS handshake, Certificate (11):
{ [3700 bytes data]
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
{ [148 bytes data]
* TLSv1.2 (IN), TLS handshake, Server finished (14):
{ [4 bytes data]
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
} [70 bytes data]
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
} [1 bytes data]
* TLSv1.2 (OUT), TLS handshake, Unknown (67):
} [36 bytes data]
* TLSv1.2 (OUT), TLS handshake, Finished (20):
} [16 bytes data]
* TLSv1.2 (IN), TLS change cipher, Client hello (1):
{ [1 bytes data]
* TLSv1.2 (IN), TLS handshake, Finished (20):
{ [16 bytes data]
* SSL connection using TLSv1.2 / ECDHE-ECDSA-AES128-GCM-SHA256
* Server certificate:
*        subject: C=US; ST=California; L=Mountain View; O=Google Inc; CN=*.google.com
*        start date: Nov 26 00:09:43 2015 GMT
*        expire date: Feb 23 00:00:00 2016 GMT
*        subjectAltName: youtube.com matched
*        issuer: C=US; O=Google Inc; CN=Google Internet Authority G2
*        SSL certificate verify ok.
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* TCP_NODELAY set
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Using Stream ID: 1 (easy handle 0x1ad2fb0)
> GET / HTTP/1.1
> Host: youtube.com
> User-Agent: curl/7.46.0
> Accept: */*
>
< HTTP/2.0 301
< date:Thu, 10 Dec 2015 07:38:04 GMT
< server:gwiseguy/2.0
< location:https://www.youtube.com/
< content-length:0
< content-type:text/html
< x-xss-protection:1; mode=block
< alternate-protocol:443:quic,p=0
< alt-svc:clear
<
* Connection #0 to host youtube.com left intact

参考
http://takeshiyako.blogspot.jp/2015/09/curl-http2.html
https://blog.cloudflare.com/tools-for-debugging-testing-and-using-http-2/
http://qiita.com/0xfffffff7/items/3a3c75f46c781d83a70d

Register as a new user and use Qiita more conveniently

  1. You get articles that match your needs
  2. You can efficiently read back useful information
  3. You can use dark theme
What you can do with signing up
4