5
HTTP/1 doesn't share the same request semantics as HTTP/2 so HTTP/1 clients need to be detected and handled in a HTTP/2 server. To support both you need to use the HTTP2 Compatibility API.
HTTP / 1不与HTTP / 2共享相同的请求语义,因此需要在HTTP / 2服务器中检测和处理HTTP / 1客户端。要同时支持,您需要使用HTTP2兼容性API。
The "hang" occurs when a HTTP1 client connects to a HTTP/2 server with allowHTTP1: true set but doesn't handle the HTTP/1 request.
当HTTP1客户端连接到具有allowHTTP1:true设置但未处理HTTP / 1请求的HTTP / 2服务器时,会发生“挂起”。
The examples are based on the Node documentation example code.
这些示例基于Node文档示例代码。
HTTP/1 and /2 Mixed Server
const http2 = require('http2')
const fs = require('fs')
var optiOns= {
key: fs.readFileSync('server-key.pem'),
cert: fs.readFileSync('server-crt.pem'),
//ca: fs.readFileSync('ca-crt.pem'),
allowHTTP1: true,
}
var server = http2.createSecureServer(options, (req, res) => {
// detects if it is a HTTPS request or HTTP/2
const { socket: { alpnProtocol } } = (req.httpVersion === '2.0')
? req.stream.session
: req
res.writeHead(200, { 'content-type': 'application/json' })
res.end(JSON.stringify({
alpnProtocol,
httpVersion: req.httpVersion
}))
})
server.listen(8443)
HTTP/2 Client
const http2 = require('http2')
const fs = require('fs')
const client = http2.connect('https://localhost:8443', {
ca: fs.readFileSync('ca-crt.pem'),
rejectUnauthorized: true,
})
client.on('socketError', (err) => console.error(err))
client.on('error', (err) => console.error(err))
const req = client.request({ ':path': '/' })
req.on('response', (headers, flags) => {
for (const name in headers) {
console.log('Header: "%s" "%s"', name, headers[name])
}
})
req.setEncoding('utf8')
let data = ''
req.on('data', chunk => data += chunk)
req.on('end', () => {
console.log('Data:', data)
client.destroy()
})
req.end()
Then running:
→ node http2_client.js
(node:34542) ExperimentalWarning: The http2 module is an experimental API.
Header: ":status" "200"
Header: "content-type" "application/json"
Header: "date" "Sat, 02 Dec 2017 23:27:21 GMT"
Data: {"alpnProtocol":"h2","httpVersion":"2.0"}
HTTP/1 Client
const https = require('https')
const fs = require('fs')
var optiOns= {
method: 'GET',
hostname: 'localhost',
port: '8443',
path: '/',
protocol: 'https:',
ca: fs.readFileSync('ca-crt.pem'),
rejectUnauthorized: true,
//agent: false
}
var req = https.request(options, function(res){
var body = ''
res.setEncoding('utf8')
res.on('data', data => body += data)
res.on('end', ()=> console.log('Body:', body))
})
req.on('response', respOnse=> {
for (const name in response.headers) {
console.log('Header: "%s" "%s"', name, response.headers[name])
}
})
req.end()
Then running
→ node http1_client.js
Header: "content-type" "application/json"
Header: "date" "Sat, 02 Dec 2017 23:27:08 GMT"
Header: "connection" "close"
Header: "transfer-encoding" "chunked"
Body: {"alpnProtocol":false,"httpVersion":"1.1"}
HTTP/2 Server
Using the plain HTTP/2 Server will work with the http2_client but will "hang" for a http1_client. The TLS connection from a HTTP/1 client will be closed when you remove allowHTTP1: true.
使用普通的HTTP / 2服务器将与http2_client一起使用,但对于http1_client将“挂起”。删除allowHTTP1:true时,将关闭来自HTTP / 1客户端的TLS连接。
const http2 = require('http2')
const fs = require('fs')
var optiOns= {
key: fs.readFileSync('server-key.pem'),
cert: fs.readFileSync('server-crt.pem'),
ca: fs.readFileSync('ca-crt.pem'),
allowHTTP1: true,
}
var server = http2.createSecureServer(options)
server.on('error', error => console.log(error))
server.on('connect', cOnn=> console.log('connect', conn))
server.on('socketError', error => console.log('socketError', error))
server.on('frameError', error => console.log('frameError', error))
server.on('remoteSettings', settings => console.log('remote settings', settings))
server.on('stream', (stream, headers) => {
console.log('stream', headers)
stream.respond({
'content-type': 'application/html',
':status': 200
})
console.log(stream.session)
stream.end(JSON.stringify({
alpnProtocol: stream.session.socket.alpnProtocol,
httpVersion: "2"
}))
})
server.listen(8443)
Certs
With the extended intermediate certificate setup detailed in the gist, the complete certificate chain for the CA needs to be supplied to the clients.
通过要点中详述的扩展中间证书设置,需要将完整的CA证书链提供给客户端。
cat ca/x/certs/x.public.pem > caxy.pem
cat ca/y/certs/y.public.pem >> caxy.pem
Then in the clients use this ca in the options.
然后在客户端中使用此选项中的ca.
{
ca: fs.readFileSync('caxy.pem'),
}
These examples were run withe the following simple CA setup from this circle.com article:
这些示例是使用此circle.com文章中的以下简单CA设置运行的:
To simplify the configuration, let’s grab the following CA configuration file.
为了简化配置,让我们获取以下CA配置文件。
wget https://raw.githubusercontent.com/anders94/https-authorized-clients/master/keys/ca.cnf
Next, we’ll create a new certificate authority using this configuration.
接下来,我们将使用此配置创建新的证书颁发机构。
openssl req -new -x509 \
-days 9999 \
-config ca.cnf \
-keyout ca-key.pem \
-out ca-crt.pem
Now that we have our certificate authority in ca-key.pem and ca-crt.pem, let’s generate a private key for the server.
现在我们在ca-key.pem和ca-crt.pem中拥有了我们的证书颁发机构,让我们为服务器生成一个私钥。
openssl genrsa \
-out server-key.pem \
4096
Our next move is to generate a certificate signing request. Again to simplify configuration, let’s use server.cnf as a configuration shortcut.
我们的下一步是生成证书签名请求。再次简化配置,让我们使用server.cnf作为配置快捷方式。
wget https://raw.githubusercontent.com/anders94/https-authorized-clients/master/keys/server.cnf
Now we’ll generate the certificate signing request.
现在我们将生成证书签名请求。
openssl req -new \
-config server.cnf \
-key server-key.pem \
-out server-csr.pem
Now let’s sign the request.
现在让我们签署请求。
openssl x509 -req -extfile server.cnf \
-days 999 \
-passin "pass:password" \
-in server-csr.pem \
-CA ca-crt.pem \
-CAkey ca-key.pem \
-CAcreateserial \
-out server-crt.pem
京公网安备 11010802041100号