Mailing List Archive

Can apache2 reverse proxy forward HTTP/2 server push?
Hi! I'm using apache2 as a reverse proxy of my HTTP/2 origin server. My origin server has some assets to push, however, apache2 disabled the push stream (PUSH PROMISE STREAM) in the test. I have searched for reasons on RFC, it shows that "SETTINGS_ENABLE_PUSH (0x2): This setting can be used to disable server push (Section 8.2)". Therefore, I wonder how to set apache2 to enable the origin server push(not in a Link Header manner). Can apache2 handle PUSH PROMISE FRAME or forward server push? It would help to give me some instructions, the core of my configuration of apache2 is below:
############################
<VirtualHost *:443>
Protocols h2 http/1.1
ServerName www.xxx.com
SSLEngine on
SSLProxyEngine on
#SSLProxyVerify none
SSLProxyCheckPeerCN off
SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
#SSLProxyCheckPeerName off
#SSLProxyCheckPeerExpire off
ProxyRequests Off
ProxyPass / h2://127.0.0.1:8443/
ProxyPassReverse / http://127.0.0.1:8443/
SSLCertificateFile /path/to/fullchain.cer
SSLCertificateKeyFile /path/to/example.key



chenpinji@foxmail.com
Re: Can apache2 reverse proxy forward HTTP/2 server push? [ In reply to ]
On 2023-08-06 05:36, chenpinji@foxmail.com wrote:
> Hi! I'm using apache2 as a reverse proxy of my HTTP/2 origin server. My origin server has some assets to push, however, apache2 disabled the push stream (PUSH PROMISE STREAM) in the test. I have searched for reasons on RFC, it shows that "SETTINGS_ENABLE_PUSH (0x2): This setting can be used to disable server push (Section 8.2)". Therefore, I wonder how to set apache2 to enable the origin server push(not in a Link Header manner). Can apache2 handle PUSH PROMISE FRAME or forward server push? It would help to give me some instructions, the core of my configuration of apache2 is below:
> ############################
> <VirtualHost *:443>
> Protocols h2 http/1.1
> ServerName www.xxx.com
> SSLEngine on
> SSLProxyEngine on
> #SSLProxyVerify none
> SSLProxyCheckPeerCN off
> SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
> #SSLProxyCheckPeerName off
> #SSLProxyCheckPeerExpire off
> ProxyRequests Off
> ProxyPass / h2://127.0.0.1:8443/
> ProxyPassReverse /http://127.0.0.1:8443/ <http://127.0.0.1:8443/>
> SSLCertificateFile /path/to/fullchain.cer
> SSLCertificateKeyFile /path/to/example.key

I could be wrong (we never put it into production), but I have a note
concerning the need for "protocol" h2c as well as h2, otherwise TCP is
not recognized. We came to the conclusion (as did chrome who dropped it
last year <https://chromestatus.com/feature/6302414934114304>) that
client cache and push were probably not compatible with latency, but YMMV.

See: Protocols h2 h2c http/1.1 at
<https://httpd.apache.org/docs/2.4/howto/http2.html>

Paul


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: Re: Can apache2 reverse proxy forward HTTP/2 server push? [ In reply to ]
Hi! I add h2c to my protocol configuration. It comes to "Protocols h2 h2c http/1.1". Nevertheless, Apache still disabled my origin server push stream. It seems that Apache never put this into production. PUSH PROMISE STREAM is one of the most important characteristics of http/2 defined in RFC. So, I wonder what is the reason behind. Maybe there is no std library to use? I would be quite grateful if you let me know the considerations



chenpinji@foxmail.com

From: Stormy
Date: 2023-08-07 03:41
To: users
Subject: Re: [users@httpd] Can apache2 reverse proxy forward HTTP/2 server push?
On 2023-08-06 05:36, chenpinji@foxmail.com wrote:
> Hi! I'm using apache2 as a reverse proxy of my HTTP/2 origin server. My origin server has some assets to push, however, apache2 disabled the push stream (PUSH PROMISE STREAM) in the test. I have searched for reasons on RFC, it shows that "SETTINGS_ENABLE_PUSH (0x2): This setting can be used to disable server push (Section 8.2)". Therefore, I wonder how to set apache2 to enable the origin server push(not in a Link Header manner). Can apache2 handle PUSH PROMISE FRAME or forward server push? It would help to give me some instructions, the core of my configuration of apache2 is below:
> ############################
> <VirtualHost *:443>
> Protocols h2 http/1.1
> ServerName www.xxx.com
> SSLEngine on
> SSLProxyEngine on
> #SSLProxyVerify none
> SSLProxyCheckPeerCN off
> SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
> #SSLProxyCheckPeerName off
> #SSLProxyCheckPeerExpire off
> ProxyRequests Off
> ProxyPass / h2://127.0.0.1:8443/
> ProxyPassReverse /http://127.0.0.1:8443/ <http://127.0.0.1:8443/>
> SSLCertificateFile /path/to/fullchain.cer
> SSLCertificateKeyFile /path/to/example.key

I could be wrong (we never put it into production), but I have a note
concerning the need for "protocol" h2c as well as h2, otherwise TCP is
not recognized. We came to the conclusion (as did chrome who dropped it
last year <https://chromestatus.com/feature/6302414934114304>) that
client cache and push were probably not compatible with latency, but YMMV.

See: Protocols h2 h2c http/1.1 at
<https://httpd.apache.org/docs/2.4/howto/http2.html>

Paul


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: Can apache2 reverse proxy forward HTTP/2 server push? [ In reply to ]
On 2023-08-06 21:53, chenpinji@foxmail.com wrote:
> Hi! I add h2c to my protocol configuration. It comes to "Protocols h2
> h2c http/1.1". Nevertheless, Apache still disabled my origin server push
> stream.

What is your "origin server"? Is the "push stream" validly formatted?
What do the logs on *both* servers say about it?

It seems that Apache never put this into production.

I'll leave that up to one of the developers -- this is the "user" list.
We stopped even considering it when Chrome announced quite openly that
they would not support it.

Paul

PUSH
> PROMISE STREAM is one of the most important characteristics of http/2
> defined in RFC. So, I wonder what is the reason behind. Maybe there is
> no std library to use? I would be quite grateful if you let me know the
> considerations
>
> ------------------------------------------------------------------------
> chenpinji@foxmail.com
>
> *From:* Stormy <mailto:stormy22@stormy.ca>
> *Date:* 2023-08-07 03:41
> *To:* users <mailto:users@httpd.apache.org>
> *Subject:* Re: [users@httpd] Can apache2 reverse proxy forward
> HTTP/2 server push?
> On 2023-08-06 05:36, chenpinji@foxmail.com wrote:
> > Hi! I'm using apache2 as a reverse proxy of my HTTP/2 origin
> server. My origin server has some assets to push, however, apache2
> disabled the push stream (PUSH PROMISE STREAM) in the test. I have
> searched for reasons on RFC, it shows that "SETTINGS_ENABLE_PUSH
> (0x2): This setting can be used to disable server push (Section
> 8.2)". Therefore, I wonder how to set apache2 to enable the origin
> server push(not in a Link Header manner). Can apache2 handle PUSH
> PROMISE FRAME or forward server push? It would help to give me some
> instructions, the core of my configuration of apache2 is below:
> > ############################
> > <VirtualHost *:443>
> > Protocols h2 http/1.1
> > ServerName www.xxx.com
> > SSLEngine on
> > SSLProxyEngine on
> > #SSLProxyVerify none
> > SSLProxyCheckPeerCN off
> > SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
> > #SSLProxyCheckPeerName off
> > #SSLProxyCheckPeerExpire off
> > ProxyRequests Off
> > ProxyPass / h2://127.0.0.1:8443/
> > ProxyPassReverse /http://127.0.0.1:8443/  <http://127.0.0.1:8443/>
> > SSLCertificateFile /path/to/fullchain.cer
> > SSLCertificateKeyFile /path/to/example.key
> I could be wrong (we never put it into production), but I have a note
> concerning the need for "protocol" h2c as well as h2, otherwise TCP is
> not recognized.  We came to the conclusion (as did chrome who
> dropped it
> last year <https://chromestatus.com/feature/6302414934114304>) that
> client cache and push were probably not compatible with latency, but
> YMMV.
> See:  Protocols h2 h2c http/1.1 at
> <https://httpd.apache.org/docs/2.4/howto/http2.html>
> Paul
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: Re: Can apache2 reverse proxy forward HTTP/2 server push? [ In reply to ]
Thanks for your reply! My origin server is a Nodejs http/2 server. I confirm that the push stream is valid because everything works well without Apache reverse proxy. My orgin server's log says that the client(here should be Apache as it works well without Apache) disabled the push stream. And Apache doesn't have a log about push stream.

Although maybe Apache never put this into production, thanks for your helpful guidance. I want to keep connected with the developers to catch the latest news about this http/2 feature, so could you tell me how to contact them?


chenpinji@foxmail.com

From: Stormy
Date: 2023-08-07 21:39
To: users
Subject: Re: [users@httpd] Can apache2 reverse proxy forward HTTP/2 server push?
On 2023-08-06 21:53, chenpinji@foxmail.com wrote:
> Hi! I add h2c to my protocol configuration. It comes to "Protocols h2
> h2c http/1.1". Nevertheless, Apache still disabled my origin server push
> stream.

What is your "origin server"? Is the "push stream" validly formatted?
What do the logs on *both* servers say about it?

It seems that Apache never put this into production.

I'll leave that up to one of the developers -- this is the "user" list.
We stopped even considering it when Chrome announced quite openly that
they would not support it.

Paul

PUSH
> PROMISE STREAM is one of the most important characteristics of http/2
> defined in RFC. So, I wonder what is the reason behind. Maybe there is
> no std library to use? I would be quite grateful if you let me know the
> considerations
>
> ------------------------------------------------------------------------
> chenpinji@foxmail.com
>
> *From:* Stormy <mailto:stormy22@stormy.ca>
> *Date:* 2023-08-07 03:41
> *To:* users <mailto:users@httpd.apache.org>
> *Subject:* Re: [users@httpd] Can apache2 reverse proxy forward
> HTTP/2 server push?
> On 2023-08-06 05:36, chenpinji@foxmail.com wrote:
> > Hi! I'm using apache2 as a reverse proxy of my HTTP/2 origin
> server. My origin server has some assets to push, however, apache2
> disabled the push stream (PUSH PROMISE STREAM) in the test. I have
> searched for reasons on RFC, it shows that "SETTINGS_ENABLE_PUSH
> (0x2): This setting can be used to disable server push (Section
> 8.2)". Therefore, I wonder how to set apache2 to enable the origin
> server push(not in a Link Header manner). Can apache2 handle PUSH
> PROMISE FRAME or forward server push? It would help to give me some
> instructions, the core of my configuration of apache2 is below:
> > ############################
> > <VirtualHost *:443>
> > Protocols h2 http/1.1
> > ServerName www.xxx.com
> > SSLEngine on
> > SSLProxyEngine on
> > #SSLProxyVerify none
> > SSLProxyCheckPeerCN off
> > SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
> > #SSLProxyCheckPeerName off
> > #SSLProxyCheckPeerExpire off
> > ProxyRequests Off
> > ProxyPass / h2://127.0.0.1:8443/
> > ProxyPassReverse /http://127.0.0.1:8443/ <http://127.0.0.1:8443/>
> > SSLCertificateFile /path/to/fullchain.cer
> > SSLCertificateKeyFile /path/to/example.key
> I could be wrong (we never put it into production), but I have a note
> concerning the need for "protocol" h2c as well as h2, otherwise TCP is
> not recognized. We came to the conclusion (as did chrome who
> dropped it
> last year <https://chromestatus.com/feature/6302414934114304>) that
> client cache and push were probably not compatible with latency, but
> YMMV.
> See: Protocols h2 h2c http/1.1 at
> <https://httpd.apache.org/docs/2.4/howto/http2.html>
> Paul
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: Can apache2 reverse proxy forward HTTP/2 server push? [ In reply to ]
On 2023-08-07 10:23, chenpinji@foxmail.com wrote:
> Thanks for your reply! My origin server is a Nodejs http/2 server. I
> confirm that the push stream is valid because everything works well
> without Apache reverse proxy. My orgin server's log says that the
> client(here should be Apache as it works well without Apache) disabled
> the push stream. And Apache doesn't have a log about push stream.

Please, stop "top-posting":
A: Maybe because some people are too annoyed by top-posting.

Q: Why do I not get an answer to my question(s)?

A: Because it messes up the order in which people normally read text.

Q: Why is top-posting such a bad thing?

However...

A server /= client ; over-simplistically, a client is a browswer,
Apache2 is not a browser. If your Apache2 server (reverse proxy or not)
is set up fairly normally, it will log any request that fails at
/var/log/apache2/error.log (or your config.) If your Nodejs log really
states "the client *disabled* the push stream", it's probably because it
was expecting to talk to a client, not a server.

This is looking more and more like a nodejs problem (have you tried
<https://github.com/nodejs/node/issues>) not apache2, but again, "What
do the logs on *both* servers say about it?" Go back, do a test all
over again, look in *both* logs for identically (+/- a few ms) timed log
entries and post them in full here.

Somebody on this list will surely have the time, knowledge, experience
and patience to help you.

Paul

>
> Although maybe Apache never put this into production, thanks for your
> helpful guidance. I want to keep connected with the developers to catch
> the latest news about this http/2 feature, so could you  tell me how to
> contact them?
> ------------------------------------------------------------------------
> chenpinji@foxmail.com
>
> *From:* Stormy <mailto:stormy22@stormy.ca>
> *Date:* 2023-08-07 21:39
> *To:* users <mailto:users@httpd.apache.org>
> *Subject:* Re: [users@httpd] Can apache2 reverse proxy forward
> HTTP/2 server push?
> On 2023-08-06 21:53, chenpinji@foxmail.com wrote:
> > Hi! I add h2c to my protocol configuration. It comes to
> "Protocols h2
> > h2c http/1.1". Nevertheless, Apache still disabled my origin
> server push
> > stream.
> What is your "origin server"? Is the "push stream" validly formatted?
> What do the logs on *both* servers say about it?
> It seems that Apache never put this into production.
> I'll leave that up to one of the developers -- this is the "user" list.
> We stopped even considering it when Chrome announced quite openly that
> they would not support it.
> Paul
>   PUSH
> > PROMISE STREAM is one of the most important characteristics of
> http/2
> > defined in RFC. So, I wonder what is the reason behind. Maybe
> there is
> > no std library to use? I would be quite grateful if you let me
> know the
> > considerations
> >
> >
> ------------------------------------------------------------------------
> > chenpinji@foxmail.com
> >
> >     *From:* Stormy <mailto:stormy22@stormy.ca>
> >     *Date:* 2023-08-07 03:41
> >     *To:* users <mailto:users@httpd.apache.org>
> >     *Subject:* Re: [users@httpd] Can apache2 reverse proxy forward
> >     HTTP/2 server push?
> >     On 2023-08-06 05:36, chenpinji@foxmail.com wrote:
> >      > Hi! I'm using apache2 as a reverse proxy of my HTTP/2 origin
> >     server. My origin server has some assets to push, however,
> apache2
> >     disabled the push stream (PUSH PROMISE STREAM) in the test. I
> have
> >     searched for reasons on RFC, it shows that "SETTINGS_ENABLE_PUSH
> >     (0x2): This setting can be used to disable server push (Section
> >     8.2)". Therefore, I wonder how to set apache2 to enable the
> origin
> >     server push(not in a Link Header manner). Can apache2 handle PUSH
> >     PROMISE FRAME or forward server push? It would help to give
> me some
> >     instructions, the core of my configuration of apache2 is below:
> >      > ############################
> >      > <VirtualHost *:443>
> >      > Protocols h2 http/1.1
> >      > ServerName www.xxx.com
> >      > SSLEngine on
> >      > SSLProxyEngine on
> >      > #SSLProxyVerify none
> >      > SSLProxyCheckPeerCN off
> >      > SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
> >      > #SSLProxyCheckPeerName off
> >      > #SSLProxyCheckPeerExpire off
> >      > ProxyRequests Off
> >      > ProxyPass / h2://127.0.0.1:8443/
> >      > ProxyPassReverse /http://127.0.0.1:8443/
> <http://127.0.0.1:8443/>
> >      > SSLCertificateFile /path/to/fullchain.cer
> >      > SSLCertificateKeyFile /path/to/example.key
> >     I could be wrong (we never put it into production), but I
> have a note
> >     concerning the need for "protocol" h2c as well as h2,
> otherwise TCP is
> >     not recognized.  We came to the conclusion (as did chrome who
> >     dropped it
> >     last year
> <https://chromestatus.com/feature/6302414934114304>) that
> >     client cache and push were probably not compatible with
> latency, but
> >     YMMV.
> >     See:  Protocols h2 h2c http/1.1 at
> >     <https://httpd.apache.org/docs/2.4/howto/http2.html>
> >     Paul
> >
> ---------------------------------------------------------------------
> >     To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> >     For additional commands, e-mail: users-help@httpd.apache.org
> >
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org