summaryrefslogtreecommitdiffhomepage
AgeCommit message (Collapse)AuthorFilesLines
2021-02-09QUIC: fixed logging ACK frames.Roman Arutyunyan1-1/+1
Previously, the wrong end pointer was used, which could lead to errors "quic failed to parse ack frame gap".
2021-02-08QUIC: the "quic_host_key" directive.Vladimir Homutov6-78/+336
The token generation in QUIC is reworked. Single host key is used to generate all required keys of needed sizes using HKDF. The "quic_stateless_reset_token_key" directive is removed. Instead, the "quic_host_key" directive is used, which reads key from file, or sets it to random bytes if not specified.
2021-02-04QUIC: use server ack_delay_exponent when sending ack.Roman Arutyunyan1-1/+1
Previously, client one was used.
2021-02-03QUIC: removed redundant "app" flag from ngx_quic_close_frame_t.Sergey Kandaurov3-16/+15
The flag was introduced to create type-aware CONNECTION_CLOSE frames, and now is replaced with frame type information, directly accessible. Notably, this fixes type logging for received frames in b3d9e57d0f62.
2021-02-02HTTP/3: reverted version check for keepalive flag.Roman Arutyunyan1-1/+1
The flag is used in ngx_http_finalize_connection() to switch client connection to the keepalive mode. Since eaea7dac3292 this code is not executed for HTTP/3 which allows us to revert the change and get back to the default branch code.
2021-02-01HTTP/3: fixed format specifier.Roman Arutyunyan1-1/+1
2021-02-01HTTP/2: lingering close changed to handle NGX_AGAIN.Ruslan Ermilov1-0/+4
This part somehow slipped away from c5840ca2063d. While it is not expected to be needed in case of lingering close, it is good to keep it for correctness (see 2b5528023f6b).
2021-01-26Clean up trailers in ngx_http_clean_header() as well.Sergey Kandaurov1-0/+4
The function has not been updated with introduction of trailers support in 7034:1b068a4e82d8 (1.13.2).
2021-01-25HTTP/3: refactored request body parser.Roman Arutyunyan4-86/+488
The change reduces diff to the default branch for src/http/ngx_http_request_body.c. Also, client Content-Length, if present, is now checked against the real body size sent by client.
2021-02-01QUIC: fixed stateless reset recognition and send.Roman Arutyunyan1-19/+13
Previously, if an unexpected packet was received on an existing QUIC connection, stateless reset token was neither recognized nor sent.
2021-01-28QUIC: refactored packet processing.Roman Arutyunyan1-96/+107
- split ngx_quic_process_packet() in two functions with the second one called ngx_quic_process_payload() in charge of decrypring and handling the payload - renamed ngx_quic_payload_handler() to ngx_quic_handle_frames() - moved error cleanup from ngx_quic_input() to ngx_quic_process_payload() - moved handling closed connection from ngx_quic_handle_frames() to ngx_quic_process_payload() - minor fixes
2021-01-29QUIC: stateless retry.Vladimir Homutov5-246/+319
Previously, quic connection object was created when Retry packet was sent. This is neither necessary nor convenient, and contradicts the idea of retry: protecting from bad clients and saving server resources. Now, the connection is not created, token is verified cryptographically instead of holding it in connection.
2021-01-29HTTP/3: call ngx_handle_read_event() from client header handler.Roman Arutyunyan1-4/+5
This function should be called at the end of an event handler to prepare the event for the next handler call. Particularly, the "active" flag is set or cleared depending on data availability. With this call missing in one code path, read handler was not called again after handling the initial part of the client request, if the request was too big to fit into a single STREAM frame. Now ngx_handle_read_event() is called in this code path. Also, read timer is restarted.
2021-01-27README: reflect renaming of several transport parameter directives.Sergey Kandaurov1-2/+2
Reported by Kyriakos Zarifis.
2021-01-19Year 2021.Maxim Dounin1-2/+2
2021-01-19Core: removed post_accept_timeout.Maxim Dounin3-16/+21
Keeping post_accept_timeout in ngx_listening_t is no longer needed since we've switched to 1 second timeout for deferred accept in 5541:fdb67cfc957d. Further, using it in HTTP code can result in client_header_timeout being used from an incorrect server block, notably if address-specific virtual servers are used along with a wildcard listening socket, or if we've switched to a different server block based on SNI in SSL handshake.
2021-01-19Removed incorrect optimization of HEAD requests.Maxim Dounin2-11/+1
The stub status module and ngx_http_send_response() (used by the empty gif module and the "return" directive) incorrectly assumed that responding to HEAD requests always results in r->header_only being set. This is not true, and results in incorrect behaviour, for example, in the following configuration: location / { image_filter size; return 200 test; } Fix is to remove this incorrect micro-optimization from both stub status module and ngx_http_send_response(). Reported by Chris Newton.
2021-01-12Upstream: fixed zero size buf alerts on extra data (ticket #2117).Maxim Dounin2-0/+14
After 7675:9afa45068b8f and 7678:bffcc5af1d72 (1.19.1), during non-buffered simple proxying, responses with extra data might result in zero size buffers being generated and "zero size buf" alerts in writer. This bug is similar to the one with FastCGI proxying fixed in 7689:da8d758aabeb. In non-buffered mode, normally the filter function is not called if u->length is already 0, since u->length is checked after each call of the filter function. There is a case when this can happen though: if the response length is 0, and there are pre-read response body data left after reading response headers. As such, a check for u->length is needed at the start of non-buffered filter functions, similar to the one for p->length present in buffered filter functions. Appropriate checks added to the existing non-buffered copy filters in the upstream (used by scgi and uwsgi proxying) and proxy modules.
2020-12-29Contrib: vim syntax, update core and 3rd party module directives.Gena Makhomed1-6/+37
2021-01-11Version bump.Maxim Dounin1-2/+2
2020-12-21HTTP/3: removed HTTP/3-specific code.Roman Arutyunyan1-7/+5
The ngx_http_set_lingering_close() function is not called for HTTP/3. The change reduces diff to the default branch.
2021-01-18HTTP/3: client header validation.Roman Arutyunyan1-0/+70
A header with the name containing null, CR, LF, colon or uppercase characters, is now considered an error. A header with the value containing null, CR or LF, is also considered an error. Also, header is considered invalid unless its name only contains lowercase characters, digits, minus and optionally underscore. Such header can be optionally ignored.
2021-01-12HTTP/3: added comment.Roman Arutyunyan1-0/+1
2021-01-22HTTP/3: client pseudo-headers restrictions.Roman Arutyunyan1-0/+92
- :method, :path and :scheme are expected exactly once and not empty - :method and :scheme character validation is added - :authority cannot appear more than once
2021-01-22HTTP/3: refactored request parser.Roman Arutyunyan9-388/+457
The change reduces diff to the default branch for src/http/ngx_http_request.c and src/http/ngx_http_parse.c.
2021-01-11QUIC: draft-33 salt and retry keys.Sergey Kandaurov2-7/+15
Notably, the version negotiation table is updated to reject draft-33/QUICv1 (which requires a new TLS codepoint) unless explicitly asked to built with.
2020-12-30QUIC: fixed header protection macro name.Vladimir Homutov1-3/+3
2020-12-25QUIC: ngx_quic_bpf module.Vladimir Homutov12-0/+1145
The quic kernel bpf helper inspects packet payload for DCID, extracts key and routes the packet into socket matching the key. Due to reuseport feature, each worker owns a personal socket, which is identified by the same key, used to create DCID. BPF objects are locked in RAM and are subject to RLIMIT_MEMLOCK. The "ulimit -l" command may be used to setup proper limits, if maps cannot be created with EPERM or updated with ETOOLONG.
2020-12-15release-1.19.6 tagMaxim Dounin1-0/+1
2020-12-15nginx-1.19.6-RELEASErelease-1.19.6Maxim Dounin1-0/+49
2020-12-15Updated OpenSSL used for win32 builds.Maxim Dounin1-1/+1
2020-12-15Core: added interface to linux bpf() system call.Vladimir Homutov5-0/+217
It contains wrappers for operations with BPF maps and for loading BPF programs.
2020-12-25QUIC: ngx_quic_module.Vladimir Homutov2-10/+41
2020-12-25QUIC: moved all quic sources into src/event/quic.Vladimir Homutov9-8/+9
2020-12-22QUIC: removed unused <openssl/aes.h> inclusion.Sergey Kandaurov1-1/+0
The low-level API was used in early QUIC development.
2020-12-22QUIC: fixed -Wtype-limits with GCC <= 5 (ticket #2104).Sergey Kandaurov1-6/+15
2020-12-22QUIC: fixed logging PATH_CHALLENGE/RESPONSE and build with GCC < 5.Sergey Kandaurov1-4/+6
2020-12-22QUIC: fixed building ALPN callback without debug and http2.Sergey Kandaurov1-1/+1
2020-12-22QUIC: fixed build with OpenSSL < 1.1.1.Sergey Kandaurov1-0/+2
The <openssl/kdf.h> header is available since OpenSSL 1.1.0, and HKDF API used for separate Extract and Expand steps in TLSv1.3 - since OpenSSL 1.1.1.
2020-12-21QUIC: converted to SSL_CIPHER_get_protocol_id().Sergey Kandaurov1-5/+1
This API is available in BoringSSL for quite some time: https://boringssl.googlesource.com/boringssl/+/3743aaf
2020-12-16HTTP/3: staticize internal parsing functions.Sergey Kandaurov2-45/+45
2020-12-16HTTP/3: staticize ngx_http_v3_methods.Sergey Kandaurov1-1/+1
2020-12-15Merged with the default branch.Sergey Kandaurov15-28/+120
2020-12-11Fixed double close of non-regular files in flv and mp4.Maxim Dounin2-12/+0
With introduction of open_file_cache in 1454:f497ed7682a7, opening a file with ngx_open_cached_file() automatically adds a cleanup handler to close the file. As such, calling ngx_close_file() directly for non-regular files is no longer needed and will result in duplicate close() call. In 1454:f497ed7682a7 ngx_close_file() call for non-regular files was removed in the static module, but wasn't in the flv module. And the resulting incorrect code was later copied to the mp4 module. Fix is to remove the ngx_close_file() call from both modules. Reported by Chris Newton.
2020-12-10Removed extra allocation for r->uri.Maxim Dounin1-1/+1
The ngx_http_parse_complex_uri() function cannot make URI longer and does not null-terminate URI, so there is no need to allocate an extra byte. This allocation appears to be a leftover from changes in 461:a88a3e4e158f (0.1.5), where null-termination of r->uri and many other strings was removed.
2020-12-10Fixed parsing of absolute URIs with empty path (ticket #2079).Maxim Dounin3-2/+26
When the request line contains request-target in the absolute-URI form, it can contain path-empty instead of a single slash (see RFC 7230, RFC 3986). Previously, the ngx_http_parse_request_line() function only accepted empty path when there was no query string. With this change, non-empty query is also correctly handled. That is, request line "GET http://example.com?foo HTTP/1.1" is accepted and results in $uri "/" and $args "foo". Note that $request_uri remains "?foo", similarly to how spaces in URIs are handled. Providing "/?foo", similarly to how "/" is provided for "GET http://example.com HTTP/1.1", requires allocation.
2020-12-09QUIC: always calculate rtt for largest acknowledged packet.Roman Arutyunyan1-4/+1
Previously, when processing client ACK, rtt could be calculated for a packet different than the largest if it was missing in the sent chain. Even though this is an unlikely situation, rtt based on a different packet could be larger than needed leading to bigger pto timeout and performance degradation.
2020-12-10QUIC: send and process ack_delay for Initial and Handshake levels.Roman Arutyunyan1-13/+5
Previously, this only worked for Application level because before quic-transport-30, there were the following constraints: Because the receiver doesn't use the ACK Delay for Initial and Handshake packets, a sender SHOULD send a value of 0. When adjusting an RTT sample using peer-reported acknowledgement delays, an endpoint ... MUST ignore the ACK Delay field of the ACK frame for packets sent in the Initial and Handshake packet number space.
2020-12-09QUIC: use client max_ack_delay when computing pto timeout.Roman Arutyunyan1-4/+2
Previously, server max_ack_delay was used which is wrong. Also, level check is simplified.
2020-12-08QUIC: resend handshake packets along with initial.Roman Arutyunyan1-0/+5
To speed up handshake, resend both initial and handshake packets if there's at least one unacknowledged initial packet.
generated by cgit (git 2.34.1) at 2025-12-26 10:05:32 +0000