summaryrefslogtreecommitdiffhomepage
AgeCommit message (Collapse)AuthorFilesLines
2021-10-26QUIC: style.Sergey Kandaurov3-5/+1
2021-10-26QUIC: speeding up processing 0-RTT.Sergey Kandaurov1-2/+18
After fe919fd63b0b, processing QUIC streams was postponed until after handshake completion, which means that 0-RTT is effectively off. With ssl_ocsp enabled, it could be further delayed. This differs from how OCSP validation works with SSL_read_early_data(). With this change, processing QUIC streams is unlocked when obtaining 0-RTT secret.
2021-10-26QUIC: refactored OCSP validation in preparation for 0-RTT support.Sergey Kandaurov3-13/+33
2021-10-19QUIC: switched to integer arithmetic in rtt calculations.Vladimir Homutov1-8/+17
RFC 9002 uses constants implying effective implementation, i.e. using bit shift operations instead of floating point.
2021-10-15QUIC: optimized ack range processing.Vladimir Homutov1-3/+7
The sent queue is sorted by packet number. It is possible to avoid traversing full queue while handling ack ranges. It makes sense to start traversing from the queue head (i.e. check oldest packets first).
2021-10-13QUIC: limited the total number of frames.Roman Arutyunyan2-3/+7
Exceeding 10000 allocated frames is considered a flood.
2021-10-13QUIC: traffic-based flood detection.Roman Arutyunyan2-5/+31
With this patch, all traffic over a QUIC connection is compared to traffic over QUIC streams. As long as total traffic is many times larger than stream traffic, we consider this to be a flood.
2021-10-07HTTP/3: traffic-based flood detection.Roman Arutyunyan5-23/+138
With this patch, all traffic over HTTP/3 bidi and uni streams is counted in the h3c->total_bytes field, and payload traffic is counted in the h3c->payload_bytes field. As long as total traffic is many times larger than payload traffic, we consider this to be a flood. Request header traffic is counted as if all fields are literal. Response header traffic is counted as is.
2021-10-06HTTP/3: fixed request length calculation.Roman Arutyunyan1-2/+2
Previously, when request was blocked, r->request_length was not updated.
2021-10-06HTTP/3: removed client-side encoder support.Roman Arutyunyan2-156/+0
Dynamic tables are not used when generating responses anyway.
2021-10-12QUIC: attempt decrypt before checking for stateless reset.Martin Duke1-2/+5
Checking the reset after encryption avoids false positives. More importantly, it avoids the check entirely in the usual case where decryption succeeds. RFC 9000, 10.3.1 Detecting a Stateless Reset Endpoints MAY skip this check if any packet from a datagram is successfully processed.
2021-10-12QUIC: Check if CID has been used in stateless reset checkMartin Duke1-2/+5
Section 10.3.1 of RFC9000 requires this check.
2021-09-21QUIC: send RESET_STREAM in response to STOP_SENDING.Roman Arutyunyan1-5/+13
As per RFC 9000: An endpoint that receives a STOP_SENDING frame MUST send a RESET_STREAM frame if the stream is in the "Ready" or "Send" state. An endpoint SHOULD copy the error code from the STOP_SENDING frame to the RESET_STREAM frame it sends, but it can use any application error code.
2021-09-22QUIC: reset stream only once.Roman Arutyunyan1-1/+6
2021-09-27HTTP/3: reset streams with incomplete responses or timeouts.Roman Arutyunyan1-0/+14
This prevents client from closing the QUIC connection due to response parse error.
2021-09-30Added r->response_sent flag.Roman Arutyunyan2-0/+9
The flag indicates that the entire response was sent to the socket up to the last_buf flag. The flag is only usable for protocol implementations that call ngx_http_write_filter() from header filter, such as HTTP/1.x and HTTP/3.
2021-09-29Stream: fixed segfault when using SSL certificates with variables.Sergey Kandaurov1-17/+15
Similar to the previous change, a segmentation fault occurres when evaluating SSL certificates on a QUIC connection due to an uninitialized stream session. The fix is to adjust initializing the QUIC part of a connection until after it has session and variables initialized. Similarly, this appends logging error context for QUIC connections: - client 127.0.0.1:54749 connected to 127.0.0.1:8880 while handling frames - quic client timed out (60: Operation timed out) while handling quic input
2021-09-29HTTP/3: fixed segfault when using SSL certificates with variables.Sergey Kandaurov2-10/+8
A QUIC connection doesn't have c->log->data and friends initialized to sensible values. Yet, a request can be created in the certificate callback with such an assumption, which leads to a segmentation fault due to null pointer dereference in ngx_http_free_request(). The fix is to adjust initializing the QUIC part of a connection such that it has all of that in place. Further, this appends logging error context for unsuccessful QUIC handshakes: - cannot load certificate .. while handling frames - SSL_do_handshake() failed .. while sending frames
2021-09-29Stream: detect "listen .. quic" without TLSv1.3.Sergey Kandaurov1-0/+21
2021-09-29Fixed mismerge of ssl_reject_handshake in 71b7453fb11f.Sergey Kandaurov1-10/+11
In particular, this fixes rejecting "listen .. quic|http3" configurations without TLSv1.3 configured.
2021-09-27HTTP/3: fixed server push after ea9b645472b5.Sergey Kandaurov1-1/+1
Unlike in HTTP/2, both "host" and ":authority" reside in r->headers_in.server.
2021-09-27QUIC: moved a variable initialization near to its use.Sergey Kandaurov1-2/+2
This tends to produce slightly more optimal code with pos == NULL when built with Clang on low optimization levels. Spotted by Ruslan Ermilov.
2021-09-27Configure: fixed QUIC support test.Ruslan Ermilov1-23/+22
OpenSSL library QUIC support cannot be tested at configure time when using the --with-openssl option so assume it's present if requested. While here, fixed the error message in case QUIC support is missing.
2021-09-27Configure: check for QUIC 0-RTT support at compile time.Ruslan Ermilov2-10/+1
2021-09-22HTTP/3: fixed null pointer dereference with server push.Sergey Kandaurov1-0/+4
See details for HTTP/2 fix in 8b0553239592 for a complete description.
2021-09-22HTTP/3: fixed ngx_stat_active counter.Roman Arutyunyan2-0/+8
Previously the counter was not incremented for HTTP/3 streams, but still decremented in ngx_http_close_connection(). There are two solutions here, one is to increment the counter for HTTP/3 streams, and the other one is not to decrement the counter for HTTP/3 streams. The latter solution looks inconsistent with ngx_stat_reading/ngx_stat_writing, which are incremented on a per-request basis. The change adds ngx_stat_active increment for HTTP/3 request and push streams.
2021-09-17HTTP/3: fixed pushed request finalization in case of error.Roman Arutyunyan1-32/+23
Previously request could be finalized twice. For example, this could happen if "Host" header was invalid.
2021-09-22QUIC: set NGX_TCP_NODELAY_DISABLED for fake stream connections.Sergey Kandaurov2-3/+1
Notably, it is to avoid setting the TCP_NODELAY flag for QUIC streams in ngx_http_upstream_send_response(). It is an invalid operation on inherently SOCK_DGRAM sockets, which leads to QUIC connection close. The change reduces diff to the default branch in stream content phase.
2021-09-21QUIC: simplified stream fd initialization.Roman Arutyunyan1-2/+1
2021-09-21Configure: USE_OPENSSL_QUIC=YES implies USE_OPENSSL=YES.Ruslan Ermilov1-1/+1
2021-09-21Configure: ordered directories.Ruslan Ermilov1-2/+2
2021-09-21Configure: simplified condition.Ruslan Ermilov1-3/+0
2021-09-17HTTP/3: make ngx_http_log_error() static again.Roman Arutyunyan3-3/+3
This function was only referenced from ngx_http_v3_create_push_request() to initialize push connection log. Now the log handler is copied from the parent request connection. The change reduces diff to the default branch.
2021-09-09QUIC: separate event handling functions.Roman Arutyunyan3-25/+37
The functions ngx_quic_handle_read_event() and ngx_quic_handle_write_event() are added. Previously this code was a part of ngx_handle_read_event() and ngx_handle_write_event(). The change simplifies ngx_handle_read_event() and ngx_handle_write_event() by moving QUIC-related code to a QUIC source file.
2021-09-16HTTP/3: added CONNECT and TRACE methods rejection.Sergey Kandaurov1-1/+14
It has got lost in e1eb7f4ca9f1, let alone a subsequent update in 63c66b7cc07c.
2021-09-14Removed NGX_OPENSSL_QUIC macro, NGX_QUIC is enough.Ruslan Ermilov3-5/+3
2021-09-13HTTP/3: added debug logging of response fields.Sergey Kandaurov1-3/+38
Because of QPACK compression it's hard to see what fields are actually sent by the server.
2021-09-13HTTP/3: Huffman encoding for the Location response field.Sergey Kandaurov1-59/+55
2021-09-13HTTP/3: Huffman encoding for the Last-Modified response field.Sergey Kandaurov1-4/+11
2021-09-13HTTP/3: Huffman encoding for the Content-Type response field.Sergey Kandaurov1-20/+20
2021-09-13HTTP/3: implemented QPACK Huffman encoding for response fields.Sergey Kandaurov1-5/+82
2021-09-09HTTP/3: reading body buffering in filters.Roman Arutyunyan1-3/+35
This change follows similar changes in HTTP/1 and HTTP/2 in 9cf043a5d9ca.
2021-09-09QUIC: removed Firefox workaround for trailing zeroes in datagrams.Sergey Kandaurov1-5/+0
This became unnecessary after discarding invalid packets since a6784cf32c13.
2021-09-09QUIC: macro style.Ruslan Ermilov1-1/+1
2021-09-09Changed the OpenSSL QUIC support detection.Ruslan Ermilov1-1/+1
As was changed in 253cf267f95a.
2021-09-08Merged with the default branch.Sergey Kandaurov4-56/+58
2021-09-07release-1.21.3 tagMaxim Dounin1-0/+1
2021-09-07nginx-1.21.3-RELEASErelease-1.21.3Maxim Dounin1-0/+27
2021-09-06QUIC: store QUIC connection fd in stream fake connection.Roman Arutyunyan2-6/+8
Previously it had -1 as fd. This fixes proxying, which relies on downstream connection having a real fd. Also, this reduces diff to the default branch for ngx_close_connection().
2021-09-06HTTP/2: optimized processing of small DATA frames.Maxim Dounin1-54/+12
The request body filter chain is no longer called after processing a DATA frame. Instead, we now post a read event to do this. This ensures that multiple small DATA frames read during the same event loop iteration are coalesced together, resulting in much faster processing. Since rb->buf can now contain unprocessed data, window update is no longer sent in ngx_http_v2_state_read_data() in case of flow control being used due to filter buffering. Instead, window will be updated by ngx_http_v2_read_client_request_body_handler() in the posted read event.
generated by cgit (git 2.34.1) at 2026-01-05 08:17:27 +0000