TCP Fast Open Support

[HLeithner]

It seams that hitch doesn't support TFO.

Varnish supports TFO so it would be good if hitch also support TCP Fast Open.

[ahmed-sigmalux]

Seconding this request.

[didebuli]

Using TFO in varnish and would be great if it would also be possible in Hitch.

+1 for TFO in hitch

[lkarsten]

TFO makes even more sense in Hitch than in Varnish, due to the extra round trips with TLS.

+1.

[dvershinin]

+11 :) to add fastopen to hitch. That would be one more reason to use hitch instead of Nginx for TLS termination.

[dmatetelki]

PR is done.

@HLeithner , @ahmed-sigmalux , @didebuli , @lkarsten , @dvershinin : I would appreciate if someone could test it before I merge it.

[HLeithner]

I'm sry I don't use hitch anymore 😥

[lkarsten]

@dmatetelki I didn't finish, but here is how far I got when I worked on this in December: https://gist.github.com/lkarsten/0ca6d4bc4a6f01465da68b18b64503f1

[didebuli]

Good Job Denes ! thank you !!!

Test results:
pr_tfo branch compiled without issues for me. To test if TFO works and improves response time I did simulate 200 ms delay between client and server (tc qdisc add dev eth0 root netem delay 200ms) after which I did run test using recent curl with TFO support.

curl --tcp-fastopen https:// -IXGET

TFO works well with hitch and on this simulated 200ms latency link my result with TFO is about 1 RTT faster (~640ms) than without TFO (~840ms)..

[dmatetelki]

@didebuli : Thank you very much for the testing! :)

@lkarsten : I'll set it default disabled, and add option to enable it in the configure file and as a command-line option. So the PR won't be premature anymore 😢

[dridi]

Reopening, apparently it doesn't play well on FreeBSD.

[unitb-ore]

@didebuli : Thank you very much for the testing! :)

@lkarsten : I'll set it default disabled, and add option to enable it in the configure file and as a command-line option. So the PR won't be premature anymore 😢

What are the options? I am missing it in the doc:
https://github.com/varnish/hitch/blob/master/docs/configuration.md

https://fossies.org/linux/hitch/hitch.conf.5 says "tcp−fastopen = on", but this does not work (Hitch is not starting with this option).

Thanks!

[dvershinin]

@unitb-ore when you compiled it, watch out for kernel support detection by the configure script. It should be:

checking whether TCP_FASTOPEN works... yes

If not, then I guess the kernel is not recent enough. Required is 3.13 and newer.

[unitb-ore]

I saw the line "checking whether TCP_FASTOPEN works... yes", but Hitch did not start. After removing the option it started again. It seems, that the OS has to support this feature. We just switched our Dockerfile from Ubuntu 18 (where apt-get provides Hitch 1.4, not 1.5) to Alpine 3.11:

`FROM alpine:3.11

ARG HITCH_VERSION=1.5.2

RUN apk --update add bash build-base libev libev-dev automake openssl openssl-dev autoconf curl byacc flex

RUN cd /tmp && curl -L https://hitch-tls.org/source/hitch-${HITCH_VERSION}.tar.gz | tar xz
RUN cd /tmp/hitch* && ./configure --with-rst2man=/bin/true
RUN cd /tmp/hitch* && make && make install

RUN adduser -h /var/lib/hitch -s /sbin/nologin -u 1000 -D hitch

COPY conf/ /etc/hitch/
COPY ssl/ /etc/hitch/ssl/

CMD /usr/local/sbin/hitch --pidfile=/run/hitch.pid --user hitch --group hitch --config=/etc/hitch/hitch.conf

EXPOSE 443`

[dvershinin]

It seems, that the OS has to support this feature

Naturally. At compile time it checks whether the current kernel supports the feature.
At run time it needs a kernel that supports the feature as well.

When you use something in Docker, AFAIK, you will be using the kernel of the "host machine".
So it's crucial that the host OS (the one running Docker engine, not the one you run inside Docker), has TFO support (recent enough, does not explicitly disable TFO during kernel compilation or via sysctl).

[unitb-ore]

Ah, I found the error. This option is incorrect:

tcp−fastopen = on

Correct is certainly:

tcp-fastopen = on

Not Hitch starts. :)

I copied it from https://fossies.org/linux/hitch/hitch.conf.5, where it has the wrong character (between "tcp" and "fastopen") -- but only, because the option is missing here: https://github.com/varnish/hitch/blob/master/docs/configuration.md ;)

Thanks for your support!

[dridi]

(between "tcp" and "fastopen")

I was definitely confused before reading that part. Is it incorrectly generated by us in the man page or by fossies.org in their HTML conversion? Looking at other man pages I'm tempted to blame them.

Thanks for #332!

[dvershinin]

@dridi yep, fossies.org have faulty HTML conversion, the issue should be raised with them (everyone copy-pasting from that man conversion would have this highly puzzling issue with hyphen-minus).