summaryrefslogtreecommitdiffhomepage
path: root/src/event (follow)
AgeCommit message (Collapse)AuthorFilesLines
2021-02-20SSL: added check for debugging.Maxim Dounin1-0/+8
If debugging is not enabled, there is no need to do extra work in ngx_ssl_verify_callback() and ngx_ssl_handshake_log().
2021-02-20SSL: added missed error reporting during variables evaluation.Maxim Dounin1-4/+13
2021-02-20SSL: X509_NAME_oneline() error handling.Maxim Dounin1-5/+37
2021-02-19Updated the list of supported drafts.Sergey Kandaurov1-1/+0
2021-02-19QUIC: multiple versions support.Sergey Kandaurov4-20/+14
Draft-29 and beyond are now supported simultaneously, no need to recompile.
2021-02-18QUIC: removed support prior to draft-29.Sergey Kandaurov3-36/+4
2021-02-18QUIC: set idle timer when sending an ack-eliciting packet.Roman Arutyunyan1-5/+9
As per quic-transport-34: An endpoint also restarts its idle timer when sending an ack-eliciting packet if no other ack-eliciting packets have been sent since last receiving and processing a packet. Previously, the timer was set for any packet.
2021-02-17QUIC: added ability to reset a stream.Sergey Kandaurov3-0/+71
2021-02-15QUIC: fixed indentation.Sergey Kandaurov5-29/+28
2021-02-15QUIC: added check of client transport parameters.Vladimir Homutov1-36/+86
Parameters sent by client are verified and defaults are set for parameters omitted by client.
2021-02-08QUIC: updated list of transport parameters to be sent.Vladimir Homutov1-3/+22
The "max_ack_delay", "ack_delay_exponent", and "max_udp_payload_size" transport parameters were not communicated to client. The "disable_active_migration" and "active_connection_id_limit" parameters were not saved into zero-rtt context.
2021-02-10QUIC: distinguish reserved transport parameters in logging.Vladimir Homutov1-1/+2
18.1. Reserved Transport Parameters Transport parameters with an identifier of the form "31 * N + 27" for integer values of N are reserved to exercise the requirement that unknown transport parameters be ignored. These transport parameters have no semantics, and can carry arbitrary values.
2021-02-12QUIC: send PING frames on PTO expiration.Roman Arutyunyan3-12/+95
Two PING frames are sent per level that generate two UDP datagrams.
2021-02-12QUIC: improved setting the lost timer.Roman Arutyunyan1-25/+85
Setting the timer is brought into compliance with quic-recovery-34. Now it's set from a single function ngx_quic_set_lost_timer() that takes into account both loss detection and PTO. The following issues are fixed with this change: - when in loss detection mode, discarding a context could turn off the timer forever after switching to the PTO mode - when in loss detection mode, sending a packet resulted in rescheduling the timer as if it's always in the PTO mode
2021-02-04QUIC: disabled non-immediate ACKs for Initial and Handshake.Roman Arutyunyan1-2/+5
As per quic-transport-33: An endpoint MUST acknowledge all ack-eliciting Initial and Handshake packets immediately If a packet carrying Initial or Handshake ACK was lost, a non-immediate ACK should not be sent later. Instead, client is expected to send a new packet to acknowledge. Sending non-immediate ACKs for Initial packets can cause the client to generate an inflated RTT sample.
2021-02-09QUIC: fixed logging ACK frames.Roman Arutyunyan1-1/+1
Previously, the wrong end pointer was used, which could lead to errors "quic failed to parse ack frame gap".
2021-02-08QUIC: the "quic_host_key" directive.Vladimir Homutov4-48/+71
The token generation in QUIC is reworked. Single host key is used to generate all required keys of needed sizes using HKDF. The "quic_stateless_reset_token_key" directive is removed. Instead, the "quic_host_key" directive is used, which reads key from file, or sets it to random bytes if not specified.
2021-02-04QUIC: use server ack_delay_exponent when sending ack.Roman Arutyunyan1-1/+1
Previously, client one was used.
2021-02-03QUIC: removed redundant "app" flag from ngx_quic_close_frame_t.Sergey Kandaurov3-16/+15
The flag was introduced to create type-aware CONNECTION_CLOSE frames, and now is replaced with frame type information, directly accessible. Notably, this fixes type logging for received frames in b3d9e57d0f62.
2021-02-01QUIC: fixed stateless reset recognition and send.Roman Arutyunyan1-19/+13
Previously, if an unexpected packet was received on an existing QUIC connection, stateless reset token was neither recognized nor sent.
2021-01-28QUIC: refactored packet processing.Roman Arutyunyan1-96/+107
- split ngx_quic_process_packet() in two functions with the second one called ngx_quic_process_payload() in charge of decrypring and handling the payload - renamed ngx_quic_payload_handler() to ngx_quic_handle_frames() - moved error cleanup from ngx_quic_input() to ngx_quic_process_payload() - moved handling closed connection from ngx_quic_handle_frames() to ngx_quic_process_payload() - minor fixes
2021-01-29QUIC: stateless retry.Vladimir Homutov3-238/+315
Previously, quic connection object was created when Retry packet was sent. This is neither necessary nor convenient, and contradicts the idea of retry: protecting from bad clients and saving server resources. Now, the connection is not created, token is verified cryptographically instead of holding it in connection.
2021-01-11QUIC: draft-33 salt and retry keys.Sergey Kandaurov2-7/+15
Notably, the version negotiation table is updated to reject draft-33/QUICv1 (which requires a new TLS codepoint) unless explicitly asked to built with.
2020-12-30QUIC: fixed header protection macro name.Vladimir Homutov1-3/+3
2020-12-25QUIC: ngx_quic_bpf module.Vladimir Homutov8-0/+1081
The quic kernel bpf helper inspects packet payload for DCID, extracts key and routes the packet into socket matching the key. Due to reuseport feature, each worker owns a personal socket, which is identified by the same key, used to create DCID. BPF objects are locked in RAM and are subject to RLIMIT_MEMLOCK. The "ulimit -l" command may be used to setup proper limits, if maps cannot be created with EPERM or updated with ETOOLONG.
2020-12-25QUIC: ngx_quic_module.Vladimir Homutov1-0/+23
2020-12-25QUIC: moved all quic sources into src/event/quic.Vladimir Homutov6-0/+0
2020-12-22QUIC: removed unused <openssl/aes.h> inclusion.Sergey Kandaurov1-1/+0
The low-level API was used in early QUIC development.
2020-12-22QUIC: fixed -Wtype-limits with GCC <= 5 (ticket #2104).Sergey Kandaurov1-6/+15
2020-12-22QUIC: fixed logging PATH_CHALLENGE/RESPONSE and build with GCC < 5.Sergey Kandaurov1-4/+6
2020-12-22QUIC: fixed build with OpenSSL < 1.1.1.Sergey Kandaurov1-0/+2
The <openssl/kdf.h> header is available since OpenSSL 1.1.0, and HKDF API used for separate Extract and Expand steps in TLSv1.3 - since OpenSSL 1.1.1.
2020-12-21QUIC: converted to SSL_CIPHER_get_protocol_id().Sergey Kandaurov1-5/+1
This API is available in BoringSSL for quite some time: https://boringssl.googlesource.com/boringssl/+/3743aaf
2020-12-15Merged with the default branch.Sergey Kandaurov1-0/+4
2020-12-09QUIC: always calculate rtt for largest acknowledged packet.Roman Arutyunyan1-4/+1
Previously, when processing client ACK, rtt could be calculated for a packet different than the largest if it was missing in the sent chain. Even though this is an unlikely situation, rtt based on a different packet could be larger than needed leading to bigger pto timeout and performance degradation.
2020-12-10QUIC: send and process ack_delay for Initial and Handshake levels.Roman Arutyunyan1-13/+5
Previously, this only worked for Application level because before quic-transport-30, there were the following constraints: Because the receiver doesn't use the ACK Delay for Initial and Handshake packets, a sender SHOULD send a value of 0. When adjusting an RTT sample using peer-reported acknowledgement delays, an endpoint ... MUST ignore the ACK Delay field of the ACK frame for packets sent in the Initial and Handshake packet number space.
2020-12-09QUIC: use client max_ack_delay when computing pto timeout.Roman Arutyunyan1-4/+2
Previously, server max_ack_delay was used which is wrong. Also, level check is simplified.
2020-12-08QUIC: resend handshake packets along with initial.Roman Arutyunyan1-0/+5
To speed up handshake, resend both initial and handshake packets if there's at least one unacknowledged initial packet.
2020-12-08QUIC: set the temporary flag for input frame buffers.Roman Arutyunyan1-0/+1
Missing flag prevented frame data from being copied as the buffer was not considered a memory buffer.
2020-12-08SSL: fixed SSL shutdown on lingering close.Ruslan Ermilov1-0/+4
Ensure c->recv is properly reset to ngx_recv if SSL_shutdown() blocks on writing. The bug had appeared in 554c6ae25ffc.
2020-12-07QUIC: coalesce output packets into a single UDP datagram.Roman Arutyunyan1-287/+447
Now initial output packet is not padded anymore if followed by a handshake packet. If the datagram is still not big enough to satisfy minimum size requirements, handshake packet is padded.
2020-12-01QUIC: introduced QUIC buffers.Roman Arutyunyan4-145/+380
Buffers are used to hold frame data. They have a fixed size and are reused after being freed.
2020-12-07QUIC: fixed handling of clients connected to wildcard address.Vladimir Homutov1-6/+32
The patch replaces c->send() occurences with c->send_chain(), because the latter accounts for the local address, which may be different if the wildcard listener is used. Previously, server sent response to client using address different from one client connected to.
2020-12-06QUIC: disabling bidirectional SSL shutdown earlier.Sergey Kandaurov1-1/+2
Notably, this fixes an issue with Chrome that can emit a "certificate_unknown" alert during the SSL handshake where c->ssl->no_wait_shutdown is not yet set.
2020-12-02QUIC: fixed send contexts cleanup.Vladimir Homutov1-2/+1
The ngx_quic_get_send_ctx() macro takes 'level' argument, not send context index.
2020-11-27QUIC: removed ngx_quic_hexdump() macro.Vladimir Homutov4-66/+65
Instead, appropriate format specifier for hexadecimal is used in ngx_log_debug(). The STREAM frame "data" debug is moved into ngx_quic_log_frame(), similar to all other frame fields debug.
2020-11-24Merged with the default branch.Sergey Kandaurov2-20/+8
2020-11-18QUIC: rejecting zero-length packets with PROTOCOL_VIOLATION.Sergey Kandaurov1-6/+15
Per the latest post draft-32 specification updates on the topic: https://github.com/quicwg/base-drafts/pull/4391
2020-11-17QUIC: simplified and streamlined ngx_quic_decrypt().Sergey Kandaurov1-11/+7
Both clearflags and badflags are removed. It makes a little sense now to keep them as intermediate storage.
2020-11-17QUIC: merged create_long/short_packet() functions.Sergey Kandaurov1-67/+3
They no longer differ.
2020-11-17QUIC: macros for manipulating header protection and reserved bits.Sergey Kandaurov2-15/+10
This gets rid of magic numbers from quic protection and allows to push down header construction specifics further to quic transport.
generated by cgit (git 2.34.1) at 2026-01-16 02:21:34 +0000