summaryrefslogtreecommitdiffhomepage
path: root/src/event (follow)
AgeCommit message (Collapse)AuthorFilesLines
2020-08-18Merged with the default branch.Roman Arutyunyan2-31/+57
2020-08-18QUIC: coalesce neighbouring stream send buffers.Roman Arutyunyan1-110/+166
Previously a single STREAM frame was created for each buffer in stream output chain which is wasteful with respect to memory. The following changes were made in the stream send code: - ngx_quic_stream_send_chain() no longer calls ngx_quic_stream_send() and got a separate implementation that coalesces neighbouring buffers into a single frame - the new ngx_quic_stream_send_chain() respects the limit argument, which fixes sendfile_max_chunk and limit_rate - ngx_quic_stream_send() is reimplemented to call ngx_quic_stream_send_chain() - stream frame size limit is moved out to a separate function ngx_quic_max_stream_frame() - flow control is moved out to a separate function ngx_quic_max_stream_flow() - ngx_quic_stream_send_chain() is relocated next to ngx_quic_stream_send()
2020-08-14QUIC: packet based bytes_in_flight accounting.Sergey Kandaurov2-9/+30
A packet size is kept in one of the frames belonging to the packet.
2020-08-14QUIC: fixed leak of bytes_in_flight on keys discard.Sergey Kandaurov1-2/+21
This applies to discarding Initial and Handshake keys.
2020-08-14QUIC: fixed leak of bytes_in_flight attributed to lost packets.Sergey Kandaurov1-0/+1
2020-08-10SSL: fixed shutdown handling.Maxim Dounin1-31/+48
Previously, bidirectional shutdown never worked, due to two issues in the code: 1. The code only tested SSL_ERROR_WANT_READ and SSL_ERROR_WANT_WRITE when there was an error in the error queue, which cannot happen. The bug was introduced in an attempt to fix unexpected error logging as reported with OpenSSL 0.9.8g (http://mailman.nginx.org/pipermail/nginx/2008-January/003084.html). 2. The code never called SSL_shutdown() for the second time to wait for the peer's close_notify alert. This change fixes both issues. Note that after this change bidirectional shutdown is expected to work for the first time, so c->ssl->no_wait_shutdown now makes a difference. This is not a problem for HTTP code which always uses c->ssl->no_wait_shutdown, but might be a problem for stream and mail code, as well as 3rd party modules. To minimize the effect of the change, the timeout, which was used to be 30 seconds and not configurable, though never actually used, is now set to 3 seconds. It is also expanded to apply to both SSL_ERROR_WANT_READ and SSL_ERROR_WANT_WRITE, so timeout is properly set if writing to the socket buffer is not possible.
2020-08-03QUIC: handle client RESET_STREAM and STOP_SENDING.Roman Arutyunyan1-10/+65
For RESET_STREAM the c->read->error flag is set. For STOP_SENDING the c->write->error flag is set.
2020-08-11QUIC: create streams for STREAM_DATA_BLOCKED and MAX_STREAM_DATA.Roman Arutyunyan1-91/+144
Creating client-initiated streams is moved from ngx_quic_handle_stream_frame() to a separate function ngx_quic_create_client_stream(). This function is responsible for creating streams with lower ids as well. Also, simplified and fixed initial data buffering in ngx_quic_handle_stream_frame(). It is now done before calling the initial handler as the handler can destroy the stream.
2020-08-11QUIC: fixed ngx_http_test_reading() for QUIC streams.Roman Arutyunyan1-3/+13
Previously this function generated an error trying to figure out if client shut down the write end of the connection. The reason for this error was that a QUIC stream has no socket descriptor. However checking for eof is not the right thing to do for an HTTP/3 QUIC stream since HTTP/3 clients are expected to shut down the write end of the stream after sending the request. Now the function handles QUIC streams separately. It checks if c->read->error is set. The error flags for c->read and c->write are now set for all streams when closing the QUIC connection instead of setting the pending_eof flag.
2020-08-07QUIC: fixed ACK Ranges processing.Sergey Kandaurov1-7/+10
According to quic-transport draft 29, section 19.3.1: The value of the Gap field establishes the largest packet number value for the subsequent ACK Range using the following formula: largest = previous_smallest - gap - 2 Thus, given a largest packet number for the range, the smallest value is determined by the formula: smallest = largest - ack_range While here, changed min/max to uint64_t for consistency.
2020-08-07QUIC: fixed possible use-after-free on stream cleanup.Sergey Kandaurov1-1/+3
A QUIC stream could be destroyed by handler while in ngx_quic_stream_input(). To detect this, ngx_quic_find_stream() is used to check that it still exists. Previously, a stream id was passed to this routine off the frame structure. In case of stream cleanup, it is freed along with other frames belonging to the stream on cleanup. Then, a cleanup handler reuses last frames to update MAX_STREAMS and serve other purpose. Thus, ngx_quic_find_stream() is passed a reused frame with zeroed out part pointed by stream_id. If a stream with id 0x0 still exists, this leads to use-after-free.
2020-07-28QUIC: fixed format specifiers and removed casts.Sergey Kandaurov1-8/+8
2020-07-28QUIC: consistent Stream ID logging format.Sergey Kandaurov2-9/+11
2020-07-23OCSP: fixed certificate reference leak.Sergey Kandaurov1-0/+9
2020-07-27QUIC: limited the number of client-initiated streams.Roman Arutyunyan1-92/+85
The limits on active bidi and uni client streams are maintained at their initial values initial_max_streams_bidi and initial_max_streams_uni by sending a MAX_STREAMS frame upon each client stream closure. Also, the following is changed for data arriving to non-existing streams: - if a stream was already closed, such data is ignored - when creating a new stream, all streams of the same type with lower ids are created too
2020-07-27QUIC: limited the number of server-initiated streams.Roman Arutyunyan2-13/+96
Also, ngx_quic_create_uni_stream() is replaced with ngx_quic_open_stream() which is capable of creating a bidi stream.
2020-07-22QUIC: fixed bulding perl module by reducing header pollution.Sergey Kandaurov3-0/+5
The ngx_http_perl_module module doesn't have a notion of including additional search paths through --with-cc-opt, which results in compile error incomplete type 'enum ssl_encryption_level_t' when building nginx without QUIC support. The enum is visible from quic event headers and eventually pollutes ngx_core.h. The fix is to limit including headers to compile units that are real consumers.
2020-07-22SSL: fixed compilation without QUIC after 0d2b2664b41c.Roman Arutyunyan1-0/+2
2020-07-21QUIC: eliminated connection handler argument in ngx_quic_run().Roman Arutyunyan2-12/+6
Now c->listening->handler() is called instead.
2020-07-21QUIC: added "quic" listen parameter in Stream.Roman Arutyunyan2-11/+13
Also, introduced ngx_stream_quic_module.
2020-07-21QUIC: added "quic" listen parameter.Roman Arutyunyan3-14/+32
The parameter allows processing HTTP/0.9-2 over QUIC. Also, introduced ngx_http_quic_module and moved QUIC settings there
2020-07-18QUIC: do not verify the selected ALPN protocol.Roman Arutyunyan2-8/+1
The right protocol is selected by the HTTP code. In the QUIC code only verify that some protocol was selected and trigger an error otherwise.
2020-07-18QUIC: fixed stream read event log.Roman Arutyunyan1-2/+2
Previously, the main connection log was there. Now it's the stream connection log.
2020-07-20Fixed format specifiers.Sergey Kandaurov3-44/+43
2020-07-16QUIC: added anti-amplification limit.Vladimir Homutov1-0/+25
According to quic-transport draft 29, section 21.12.1.1: Prior to validation, endpoints are limited in what they are able to send. During the handshake, a server cannot send more than three times the data it receives; clients that initiate new connections or migrate to a new network path are limited.
2020-07-16QUIC: added limit of queued data.Vladimir Homutov3-15/+32
The ngx_quic_queue_frame() functions puts a frame into send queue and schedules a push timer to actually send data. The patch adds tracking for data amount in the queue and sends data immediately if amount of data exceeds limit.
2020-07-16QUIC: implemented probe timeout (PTO) calculation.Vladimir Homutov2-9/+60
2020-07-13QUIC: reworked retransmission mechanism.Vladimir Homutov2-63/+75
Instead of timer-based retransmissions with constant packet lifetime, this patch implements ack-based loss detection and probe timeout for the cases, when no ack is received, according to the quic-recovery draft 29.
2020-07-15QUIC: reworked ngx_quic_send_frames() function.Vladimir Homutov1-44/+29
Instead of returning NGX_DONE/NGX_OK, the function now itself moves passed frames range into sent queue and sets PTO timer if required.
2020-07-13QUIC: renaming.Vladimir Homutov1-18/+16
The c->quic->retransmit timer is now called "pto". The ngx_quic_retransmit() function is renamed to "ngx_quic_detect_lost()". This is a preparation for the following patches.
2020-07-13QUIC: caching c->quic in the ngx_quic_handle_ack_frame() function.Vladimir Homutov1-10/+13
To minimize difference with the following changes.
2020-07-10QUIC: delay field of an ACK frame is now calculated.Vladimir Homutov3-2/+28
2020-07-16QUIC: added rtt estimation.Vladimir Homutov2-9/+96
According to the quic-recovery 29, Section 5: Estimating the Round-Trip Time. Currently, integer arithmetics is used, which loses sub-millisecond accuracy.
2020-07-13Merged with the default branch.Sergey Kandaurov3-21/+51
2020-07-06Upstream: drop extra data sent by upstream.Maxim Dounin1-0/+28
Previous behaviour was to pass everything to the client, but this seems to be suboptimal and causes issues (ticket #1695). Fix is to drop extra data instead, as it naturally happens in most clients. This change covers generic buffered and unbuffered filters as used in the scgi and uwsgi modules. Appropriate input filter init handlers are provided by the scgi and uwsgi modules to set corresponding lengths. Note that for responses to HEAD requests there is an exception: we do allow any response length. This is because responses to HEAD requests might be actual full responses, and it is up to nginx to remove the response body. If caching is enabled, only full responses matching the Content-Length header will be cached (see b779728b180c).
2020-07-02QUIC: Introduced ngx_quic_finalize_connection().Roman Arutyunyan4-48/+91
The function finalizes QUIC connection with an application protocol error code and sends a CONNECTION_CLOSE frame with type=0x1d. Also, renamed NGX_QUIC_FT_CONNECTION_CLOSE2 to NGX_QUIC_FT_CONNECTION_CLOSE_APP.
2020-06-29SSL: fixed unexpected certificate requests (ticket #2008).Maxim Dounin1-1/+2
Using SSL_CTX_set_verify(SSL_VERIFY_PEER) implies that OpenSSL will send a certificate request during an SSL handshake, leading to unexpected certificate requests from browsers as long as there are any client certificates installed. Given that ngx_ssl_trusted_certificate() is called unconditionally by the ngx_http_ssl_module, this affected all HTTPS servers. Broken by 699f6e55bbb4 (not released yet). Fix is to set verify callback in the ngx_ssl_trusted_certificate() function without changing the verify mode.
2020-06-19Style.Vladimir Homutov1-0/+1
2020-06-23Update Initial salt and Retry secret from quic-tls-29.Sergey Kandaurov1-4/+15
See sections 5.2 and 5.8 for the current values.
2020-06-23Get rid of hardcoded numbers used for quic handshake errors.Sergey Kandaurov3-7/+13
2020-06-23Discard short packets which could not be decrypted.Sergey Kandaurov2-4/+6
So that connections are protected from failing from on-path attacks. Decryption failure of long packets used during handshake still leads to connection close since it barely makes sense to handle them there.
2020-06-23Close connection with PROTOCOL_VIOLATION on decryption failure.Sergey Kandaurov1-2/+2
A previously used undefined error code is now replaced with the generic one. Note that quic-transport prescribes keeping connection intact, discarding such QUIC packets individually, in the sense that coalesced packets could be there. This is selectively handled in the next change.
2020-06-23Define KEY_UPDATE_ERROR from quic-tls-24.Sergey Kandaurov2-2/+2
2020-06-23Reject new QUIC connection with CONNECTION_REFUSED on shutdown.Sergey Kandaurov1-0/+5
2020-06-23Close QUIC connection with NO_ERROR on c->close.Sergey Kandaurov1-1/+2
That way it makes more sense. Previously it was closed with INTERNAL_ERROR.
2020-06-23QUIC error SERVER_BUSY renamed to CONNECTION_REFUSED in draft-29.Sergey Kandaurov2-2/+2
2020-06-18QUIC: cleaned up quic encryption state tracking.Vladimir Homutov1-14/+6
The patch removes remnants of the old state tracking mechanism, which did not take into account assimetry of read/write states and was not very useful. The encryption state now is entirely tracked using SSL_quic_read/write_level().
2020-06-18QUIC: added ALPN checks.Vladimir Homutov2-3/+32
quic-transport draft 29: section 7: * authenticated negotiation of an application protocol (TLS uses ALPN [RFC7301] for this purpose) ... Endpoints MUST explicitly negotiate an application protocol. This avoids situations where there is a disagreement about the protocol that is in use. section 8.1: When using ALPN, endpoints MUST immediately close a connection (see Section 10.3 of [QUIC-TRANSPORT]) with a no_application_protocol TLS alert (QUIC error code 0x178; see Section 4.10) if an application protocol is not negotiated. Changes in ngx_quic_close_quic() function are required to avoid attempts to generated and send packets without proper keys, what happens in case of failed ALPN check.
2020-06-18QUIC: fixed off-by-one in frame range handler.Vladimir Homutov1-1/+1
The ctx->pnum is incremented after the packet is sent, thus pointing to the next packet number, which should not be used in comparison.
2020-06-16QUIC: further limiting maximum QUIC packet size.Vladimir Homutov2-4/+21
quic-transport draft 29, section 14: QUIC depends upon a minimum IP packet size of at least 1280 bytes. This is the IPv6 minimum size [RFC8200] and is also supported by most modern IPv4 networks. Assuming the minimum IP header size, this results in a QUIC maximum packet size of 1232 bytes for IPv6 and 1252 bytes for IPv4. Since the packet size can change during connection lifetime, the ngx_quic_max_udp_payload() function is introduced that currently returns minimal allowed size, depending on address family.
generated by cgit (git 2.34.1) at 2026-04-12 05:08:04 +0000