ALPN support for HTTP/2 #76

mxmo0rhuhn · 2016-03-29T17:24:36Z

Would it be possible to include a OpenSSL version >= 1.0.2 to make ALPN work?
Due to the official documentation it's needed for HTTP/2 over TLS:

Note that accepting HTTP/2 connections over TLS requires the “Application-Layer Protocol Negotiation” (ALPN) TLS extension support, which is available only since OpenSSL version 1.0.2.

The current version in the nginx:1.9.12 image is:

$ openssl version
OpenSSL 1.0.1k 8 Jan 2015

The text was updated successfully, but these errors were encountered:

thresheek · 2016-03-29T17:48:35Z

Note that HTTP/2 right now works via NPN, which does not require openssl 1.0.2 and most browsers still support it at the time of writing.

The support for ALPN will arrive in nginx:latest as soon as Debian Stretch with openssl 1.0.2 is released.
If you really need ALPN with nginx official, please use the alpine variant, as it has openssl 1.0.2.

mxmo0rhuhn · 2016-03-29T17:53:57Z

Thanks a lot for the fast reply!
I will have a look at the alpine variant.

hermansje · 2016-04-17T15:23:30Z

Starting May 15th, Chrome will drop support for SPDY and NPN [1].
Does this mean everyone wanting something better than HTTP/1.1 using this image should switch to the Alpine version?

[1] https://blog.chromium.org/2016/02/transitioning-from-spdy-to-http2.html

thresheek · 2016-04-17T15:56:50Z

Not really, you can still use HTTPS.

teohhanhui · 2016-04-18T07:07:08Z

I agree with this: https://plus.google.com/+AmbroosVaes/posts/TLJJ41Ghg9R

There does't seem to be any workaround for now except building OpenSSL ourselves (is it easy?) or switching to the Alpine variant (which is alien to most people).

hermansje · 2016-04-18T08:52:56Z

I tried the Alpine version and HTTP/2 and ALPN are working. I only had to change the FROM instruction in my Dockerfile to reference an Alpine version.

thresheek · 2016-04-18T09:30:42Z

@teohhanhui indeed. There are a lots of people with the same arguments like you linked, but apparently Google does not care at all (not that is surprising).

One of the workarounds for nginx could be using Ubuntu 16.04 as a base image, but I'm not really sure how much breakage that will cause - I would expect many people actually do FROM nginx:latest and use debian-specific things there. I'm also sure HTTP2 does not justify that breakage - after all, browsers will still show your website.

fruitl00p · 2016-05-09T18:37:47Z

I was looking into this today and found out (by trial and error) that the alpine and debian versions differ in their end result due to this...

I would expect that nginx:1.10 and nginx:1.10-alpine wouldnt differ that much (i.e. the openssl-version) but it did... One might argue that since we're talking about an nginx image that both would lead to the same build...? (but smaller images et al) But due to differing openssl-versions the actual nginx build is also very different... (one supporting APLN whilst the other doesnt) that seems weird to me... (or atleast should be documented somewhere? i.e. which openssl version its built with i.e.)

(BTW this also seems to go for the built in modules enabled between the two versions of the image?)

CWSpear · 2016-10-18T03:40:22Z

Now that it's long past May 15th (I guess the switch to turn it off actually came a couple weeks after?), HTTP/2 is not working on a lot of sites where it was working...

Being a nice feature that has some nice performance gains on many sites, it'd be great if we could come up with a good solution for the official nginx image.

Having a community-audited image with the recommended version of OpenSSL seems like a very good idea. (Isn't that part of why Google dropped support for older versions?)

thresheek · 2016-10-18T10:10:47Z

It looks like openssl-1.0.2 is available in jessie-backports. I'll have it running for a couple of weeks on my infra and then will consider it being included in the nginx official image.

Scratch that actually, as it will require nginx to be recompiled against backports version of openssl. Won't work.

Foorack · 2016-12-11T18:31:34Z

Any update on this?

teohhanhui · 2016-12-12T04:49:14Z

Use the Alpine variant. It's smaller too.

…

On 12 Dec 2016 02:31, "Foorack" ***@***.***> wrote: Any update on this? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#76 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAhf6-DGwzSQ-_5HWHTvEygVN9wha_wVks5rHEGHgaJpZM4H68nw> .

CWSpear · 2016-12-12T05:08:57Z

The problem isn't just when we want to use nginx ourselves, but when we use tools built off of nginx or don't have as much options for the base image. We should be able to rely on the main official image for things like this.

(An example is https://github.com/jwilder/nginx-proxy, which uses FROM nginx and thus doesn't support HTTP/2 out of the box.)

teohhanhui · 2016-12-12T05:16:50Z

For jwilder/nginx-proxy, it's actually recommended(?) to use a setup with separate containers for docker-gen and nginx.

…

On 12 Dec 2016 13:08, "Cameron Spear" ***@***.***> wrote: The problem isn't just when we want to use nginx ourselves, but when we use tools built off of nginx or don't have as much options for the base image. We should be able to rely on the *main* official image for things like this. (An example is https://github.com/jwilder/nginx-proxy, which uses FROM nginx and thus doesn't support HTTP/2 out of the box.) — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#76 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAhf62g1ZKbTotZJrufEYc4-E74vk7hqks5rHNbqgaJpZM4H68nw> .

mgcrea · 2017-01-05T18:04:06Z

Stumbled across this today, found out http2 was broken on all our websites.

Would be great to add a footnote to the readme that only the -alpine version currently works with http2. Wouldn't mind a ubuntu:16.04 based version as well. I don't think it would break anything in my use cases.

adityapatadia · 2017-03-17T06:26:45Z

Alpine nginx is not same as debian based. It can be shown that alpine has lower performance. I really don't see a reason why ubuntu can't be used.

OpenSSL 1.0.1 has security flaws too and leaving this image based on it causes many people install it without their knowledge. One more problem is silent http2 failure. You would not know until you check in Chrome network console.

I suggest either moving to ubuntu or compile nginx against OpenSSL 1.0.2. I request @thresheek to do something about it. Let's not keep http2 broken for so long just because of a dependency.

thresheek · 2017-03-17T11:03:39Z

@adityapatadia can you elaborate which exact OpenSSL "security flaws" are present in this image? Thank you.

thresheek · 2017-03-17T11:04:11Z

Also, I'm waiting for Debian 9 to be available in docker to use, then I'll mgirate this image to it.

adityapatadia · 2017-03-17T13:29:54Z

https://www.openssl.org/news/secadv/20160922.txt this is one issue which is concerning. But I found that it also affects some version of 1.0.2.

I think only way is to always include latest openssl at build time if that is possible. If we want to be even more maverick, we can try https://en.wikipedia.org/wiki/S2n

A quick google search did not reveal much details about when will new Debian be released. Any specific reason why we don't move to Ubuntu?

phw · 2017-03-17T13:50:43Z

@adityapatadia All of the security issues in that document are fixed in Debian (except the ones only affecting OpenSSL 1.1 of course), see http://metadata.ftp-master.debian.org/changelogs/main/o/openssl/openssl_1.0.1t-1+deb8u6_changelog . Yes, Debian does know how to handle security issues ;)

A quick google search did not reveal much details about when will new Debian be released.

No release date has been announced, but Debian 9 currently is in "FullFreeze", meaning it is in its final stage before release and they are busy fixing release critical bugs.
See also https://wiki.debian.org/DebianStretch

thresheek · 2017-03-17T13:50:52Z

According to https://security-tracker.debian.org/tracker/CVE-2016-6304 and openssl package changelog in debian, it was fixed in 1.0.1t-1+deb8u4, around September 21, 2016 (so, one day after CVE was published). As far as I can see, we shipped deb8u5 in nginx:1.11.4 (which probably was rebuilt after those fixes went live, because 1.11.4 went out around 15 Sep 2016).

I also have to add that nginx does not allow SSL/TLS renegotiation, so this exact problem is moot since you could not exploit it at all with any version of openssl used, vulnerable or not.

Including openssl in the image is not possible, we're not able to replicate distributions work and track security issues of every involved project.

adityapatadia · 2017-03-17T14:42:42Z

Yes, Debian does know how to handle security issues ;)

😄

@thresheek you know nginx better than I do :) I hope debian team releases the new version soon. I was just surprised like @mgcrea when I came to know that my sites are not using http2. I switched to alpine version for now.

motss · 2017-04-20T14:03:53Z

Any9ne tried the 1.12 stable version?

thresheek · 2017-04-20T14:15:48Z

@motss since it is built using stretch-slim as a base image, it will work nicely with http2.

EDIT: it is built using stretch.

adityapatadia · 2017-04-20T15:25:48Z

Just tried on my production system. Things seem fine. It's using http2 in chrome. I think the issue can be now closed.

CWSpear · 2017-04-20T19:21:10Z

Why is latest behind stable? I know that no other tags other than latest have any real meaning in Docker, but it does seem odd and perhaps unintentional that latest is behind something we're calling stable?

I can open a separate issue about this inquiry if desired.

CWSpear · 2017-04-20T19:26:25Z

Found the answer to my own question (mostly because I wasn't the only one confused by the naming). It ultimately led me here: https://www.nginx.com/blog/nginx-1-12-1-13-released/

thresheek · 2017-04-20T20:43:36Z

When 1.13.0 will be released next week, latest will be updated to point to it. :-)

CWSpear · 2017-04-20T20:45:06Z

Yeah, figured that out eventually!

…

On Thu, Apr 20, 2017, 1:43 PM Konstantin Pavlov ***@***.***> wrote: When 1.13.0 will be released next week, latest will be updated to point to it. :-) — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#76 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAeQ76w89uOYkMmDrQMzyntTZ69Ef0QKks5rx8N-gaJpZM4H68nw> .

motss · 2017-04-21T04:23:39Z

Just curious if the Nginx 1.12 supports Brotli compression. It'd be nice if someone told me how to check it?

thresheek · 2017-04-21T08:52:25Z

@motss, it does not: http://nginx.org/en/CHANGES-1.12

thresheek · 2017-04-26T14:12:08Z

Done starting with nginx:1.13.0 / mainline and nginx:1.12.0 / stable for Debian-based images / latest.

thaJeztah mentioned this issue May 15, 2016

HTTP/2 in conjunction with SSL/TLS does not work properly nginx-proxy/nginx-proxy#458

Closed

ihor-sviziev mentioned this issue Aug 25, 2016

Http2 not working with active tls nginx-proxy/nginx-proxy#543

Closed

JamesKyburz mentioned this issue Oct 30, 2016

Bring http2 support back to chrome. #129

Closed

CWSpear mentioned this issue Apr 20, 2017

New Build for Nginx 1.12? nginx-proxy/nginx-proxy#798

Closed

thresheek closed this as completed Apr 26, 2017

smrubin mentioned this issue Jun 21, 2017

Update nginx docker container to use http2. NIEM/Movement#21

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ALPN support for HTTP/2 #76

ALPN support for HTTP/2 #76

mxmo0rhuhn commented Mar 29, 2016

thresheek commented Mar 29, 2016

mxmo0rhuhn commented Mar 29, 2016

hermansje commented Apr 17, 2016

thresheek commented Apr 17, 2016

teohhanhui commented Apr 18, 2016

hermansje commented Apr 18, 2016 •

edited

Loading

thresheek commented Apr 18, 2016

fruitl00p commented May 9, 2016

CWSpear commented Oct 18, 2016

thresheek commented Oct 18, 2016 •

edited

Loading

Foorack commented Dec 11, 2016

teohhanhui commented Dec 12, 2016 via email

CWSpear commented Dec 12, 2016

teohhanhui commented Dec 12, 2016 via email

mgcrea commented Jan 5, 2017

adityapatadia commented Mar 17, 2017

thresheek commented Mar 17, 2017

thresheek commented Mar 17, 2017

adityapatadia commented Mar 17, 2017

phw commented Mar 17, 2017 •

edited

Loading

thresheek commented Mar 17, 2017

adityapatadia commented Mar 17, 2017

motss commented Apr 20, 2017

thresheek commented Apr 20, 2017 •

edited

Loading

adityapatadia commented Apr 20, 2017 •

edited

Loading

CWSpear commented Apr 20, 2017

CWSpear commented Apr 20, 2017

thresheek commented Apr 20, 2017

CWSpear commented Apr 20, 2017 via email

motss commented Apr 21, 2017

thresheek commented Apr 21, 2017

thresheek commented Apr 26, 2017

ALPN support for HTTP/2 #76

ALPN support for HTTP/2 #76

Comments

mxmo0rhuhn commented Mar 29, 2016

thresheek commented Mar 29, 2016

mxmo0rhuhn commented Mar 29, 2016

hermansje commented Apr 17, 2016

thresheek commented Apr 17, 2016

teohhanhui commented Apr 18, 2016

hermansje commented Apr 18, 2016 • edited Loading

thresheek commented Apr 18, 2016

fruitl00p commented May 9, 2016

CWSpear commented Oct 18, 2016

thresheek commented Oct 18, 2016 • edited Loading

Foorack commented Dec 11, 2016

teohhanhui commented Dec 12, 2016 via email

CWSpear commented Dec 12, 2016

teohhanhui commented Dec 12, 2016 via email

mgcrea commented Jan 5, 2017

adityapatadia commented Mar 17, 2017

thresheek commented Mar 17, 2017

thresheek commented Mar 17, 2017

adityapatadia commented Mar 17, 2017

phw commented Mar 17, 2017 • edited Loading

thresheek commented Mar 17, 2017

adityapatadia commented Mar 17, 2017

motss commented Apr 20, 2017

thresheek commented Apr 20, 2017 • edited Loading

adityapatadia commented Apr 20, 2017 • edited Loading

CWSpear commented Apr 20, 2017

CWSpear commented Apr 20, 2017

thresheek commented Apr 20, 2017

CWSpear commented Apr 20, 2017 via email

motss commented Apr 21, 2017

thresheek commented Apr 21, 2017

thresheek commented Apr 26, 2017

hermansje commented Apr 18, 2016 •

edited

Loading

thresheek commented Oct 18, 2016 •

edited

Loading

phw commented Mar 17, 2017 •

edited

Loading

thresheek commented Apr 20, 2017 •

edited

Loading

adityapatadia commented Apr 20, 2017 •

edited

Loading