summaryrefslogtreecommitdiffhomepage
path: root/src/http (unfollow)
AgeCommit message (Collapse)AuthorFilesLines
2020-05-22SSL: client certificate validation with OCSP (ticket #1534).Roman Arutyunyan3-5/+74
OCSP validation for client certificates is enabled by the "ssl_ocsp" directive. OCSP responder can be optionally specified by "ssl_ocsp_responder". When session is reused, peer chain is not available for validation. If the verified chain contains certificates from the peer chain not available at the server, validation will fail.
2020-05-14HTTP/3: reallocate strings inserted into the dynamic table.Roman Arutyunyan1-3/+30
They should always be allocated from the main QUIC connection pool.
2020-05-19Fixed client buffer reallocation for HTTP/3.Roman Arutyunyan2-29/+20
Preserving pointers within the client buffer is not needed for HTTP/3 because all data is either allocated from pool or static. Unlike with HTTP/1, data typically cannot be referenced directly within the client buffer. Trying to preserve NULLs or external pointers lead to broken pointers. Also, reverted changes in ngx_http_alloc_large_header_buffer() not relevant for HTTP/3 to minimize diff to mainstream.
2020-05-19Fixed $request_length for HTTP/3.Roman Arutyunyan4-13/+19
New field r->parse_start is introduced to substitute r->request_start and r->header_name_start for request length accounting. These fields only work for this purpose in HTTP/1 because HTTP/1 request line and header line start with these values. Also, error logging is now fixed to output the right part of the request.
2020-05-19HTTP/3: restricted symbols in header names.Roman Arutyunyan3-8/+54
As per HTTP/3 draft 27, a request or response containing uppercase header field names MUST be treated as malformed. Also, existing rules applied when parsing HTTP/1 header names are also applied to HTTP/3 header names: - null character is not allowed - underscore character may or may not be treated as invalid depending on the value of "underscores_in_headers" - all non-alphanumeric characters with the exception of '-' are treated as invalid Also, the r->locase_header field is now filled while parsing an HTTP/3 header. Error logging for invalid headers is fixed as well.
2020-05-19HTTP/3: split header parser in two functions.Roman Arutyunyan3-68/+77
The first one parses pseudo-headers and is analagous to the request line parser in HTTP/1. The second one parses regular headers and is analogous to the header parser in HTTP/1. Additionally, error handling of client passing malformed uri is now fixed.
2020-05-14HTTP/3: move body parser call out of ngx_http_parse_chunked().Roman Arutyunyan2-8/+20
The function ngx_http_parse_chunked() is also called from the proxy module to parse the upstream response. It should always parse HTTP/1 body in this case.
2020-05-19HTTP/3: prevent array access by negative index for unknown streams.Roman Arutyunyan1-1/+3
Currently there are no such streams, but the function ngx_http_v3_get_uni_stream() supports them.
2020-05-20Assorted fixes.Sergey Kandaurov1-1/+1
Found by Clang Static Analyzer.
2020-05-14Address validation using Retry packets.Sergey Kandaurov1-0/+18
The behaviour is toggled with the new directive "quic_retry on|off". QUIC token construction is made suitable for issuing with NEW_TOKEN.
2020-05-13Upstream: jump out of loop after matching the status code.Jinhua Tan1-0/+2
2020-05-08Variables: fixed buffer over-read when evaluating "$arg_".Sergey Kandaurov1-1/+1
2020-04-23Assign connection number to every QUIC stream log.Roman Arutyunyan2-3/+0
2020-04-23gRPC: WINDOW_UPDATE after END_STREAM handling (ticket #1797).Ruslan Ermilov1-1/+2
As per https://tools.ietf.org/html/rfc7540#section-6.9, WINDOW_UPDATE received after a frame with the END_STREAM flag should be handled and not treated as an error.
2020-04-23gRPC: RST_STREAM(NO_ERROR) handling (ticket #1792).Ruslan Ermilov1-5/+19
As per https://tools.ietf.org/html/rfc7540#section-8.1, : A server can send a complete response prior to the client : sending an entire request if the response does not depend on : any portion of the request that has not been sent and : received. When this is true, a server MAY request that the : client abort transmission of a request without error by : sending a RST_STREAM with an error code of NO_ERROR after : sending a complete response (i.e., a frame with the : END_STREAM flag). Clients MUST NOT discard responses as a : result of receiving such a RST_STREAM, though clients can : always discard responses at their discretion for other : reasons. Previously, RST_STREAM(NO_ERROR) received from upstream after a frame with the END_STREAM flag was incorrectly treated as an error. Now, a single RST_STREAM(NO_ERROR) is properly handled. This fixes problems observed with modern grpc-c [1], as well as with the Go gRPC module. [1] https://github.com/grpc/grpc/pull/1661
2020-04-22HTTP/3: directives with limited values converted to post handler.Sergey Kandaurov1-30/+50
The purpose is to show a precise line number with an invalid value.
2020-04-22HTTP/3: bytes holding directives changed to ngx_conf_set_size_slot.Sergey Kandaurov1-15/+15
This allows to specify directive values with measurement units.
2020-04-21HTTP/3: fixed encoding variable-length integers.Roman Arutyunyan1-5/+9
2020-04-16Added handling of incorrect values in TP configuration.Vladimir Homutov1-4/+30
Some parameters have minimal/maximum values defined by standard.
2020-04-15Added primitive flow control mechanisms.Vladimir Homutov1-4/+6
+ MAX_STREAM_DATA frame is sent when recv() is performed on stream The new value is a sum of total bytes received by stream + free space in a buffer; The sending of MAX_STREM_DATA frame in response to STREAM_DATA_BLOCKED frame is adjusted to follow the same logic as above. + MAX_DATA frame is sent when total amount of received data is 2x of current limit. The limit is doubled. + Default values of transport parameters are adjusted to more meaningful values: initial stream limits are set to quic buffer size instead of unrealistically small 255. initial max data is decreased to 16 buffer sizes, in an assumption that this is enough for a relatively short connection, instead of randomly chosen big number. All this allows to initiate a stable flow of streams that does not block on stream/connection limits (tested with FF 77.0a1 and 100K requests)
2020-04-13HTTP/3: fixed reading request body.Roman Arutyunyan1-1/+2
2020-04-08The new auth_delay directive for delaying unauthorized requests.Ruslan Ermilov2-1/+82
The request processing is delayed by a timer. Since nginx updates internal time once at the start of each event loop iteration, this normally ensures constant time delay, adding a mitigation from time-based attacks. A notable exception to this is the case when there are no additional events before the timer expires. To ensure constant-time processing in this case as well, we trigger an additional event loop iteration by posting a dummy event for the next event loop iteration.
2020-03-28HTTP/3: http3 variable.Sergey Kandaurov1-0/+24
2020-03-28HTTP/3: static table cleanup.Sergey Kandaurov1-7/+8
2020-03-27Parsing HTTP/3 request body.Roman Arutyunyan8-10/+167
2020-03-27Chunked response body in HTTP/3.Roman Arutyunyan3-18/+76
2020-03-27Fixed buffer overflow.Roman Arutyunyan1-1/+1
2020-03-25Simplifed handling HTTP/3 streams.Roman Arutyunyan2-178/+86
2020-03-24When closing a QUIC connection, wait for all streams to finish.Roman Arutyunyan1-0/+21
Additionally, streams are now removed from the tree in cleanup handler.
2020-03-24Removed ngx_quic_stream_node_t.Roman Arutyunyan1-1/+1
Now ngx_quic_stream_t is directly inserted into the tree.
2020-03-24QUIC streams don't need filter_need_in_memory after 7f0981be07c4.Sergey Kandaurov1-1/+0
Now they inherit c->ssl always enabled from the main connection, which makes r->main_filter_need_in_memory set for them.
2020-03-23Fixed client certificate verification.Sergey Kandaurov1-0/+1
For ngx_http_process_request() part to work, this required to set both r->http_connection->ssl and c->ssl on a QUIC stream. To avoid damaging global SSL object, ngx_ssl_shutdown() is managed to ignore QUIC streams.
2020-03-23Respect QUIC max_idle_timeout.Roman Arutyunyan2-4/+2
2020-03-23Support for HTTP/3 ALPN.Roman Arutyunyan2-2/+13
This is required by Chrome.
2020-03-23Limit output QUIC packets with client max_packet_size.Roman Arutyunyan1-3/+6
Additionally, receive larger packets than 512 bytes.
2020-03-20Removed unused variable.Roman Arutyunyan1-3/+1
2020-03-20Adedd the http "quic" variable.Vladimir Homutov1-1/+52
The value is literal "quic" for requests passed over HTTP/3, and empty string otherwise.
2020-03-20Configurable transport parameters.Vladimir Homutov3-3/+189
- integer parameters can be configured using the following directives: quic_max_idle_timeout quic_max_ack_delay quic_max_packet_size quic_initial_max_data quic_initial_max_stream_data_bidi_local quic_initial_max_stream_data_bidi_remote quic_initial_max_stream_data_uni quic_initial_max_streams_bidi quic_initial_max_streams_uni quic_ack_delay_exponent quic_active_migration quic_active_connection_id_limit - only following parameters are actually sent: active_connection_id_limit initial_max_streams_uni initial_max_streams_bidi initial_max_stream_data_bidi_local initial_max_stream_data_bidi_remote initial_max_stream_data_uni (other parameters are to be added into ngx_quic_create_transport_params() function as needed, should be easy now) - draft 24 and draft 27 are now supported (at compile-time using quic_version macro)
2020-03-19Fixed header creation for header_only responses in HTTP/3.Roman Arutyunyan2-24/+31
2020-03-18HTTP/3 $request_line variable.Roman Arutyunyan2-540/+37
2020-03-18Moved setting QUIC methods to runtime.Roman Arutyunyan2-15/+0
This allows listening to both https and http3 in the same server. Also, the change eliminates the ssl_quic directive.
2020-03-18Fixed pointer increment while parsing HTTP/3 header.Roman Arutyunyan1-3/+2
2020-03-18Fixed HTTP/3 server stream creation.Roman Arutyunyan1-5/+5
2020-03-18Removed comment.Roman Arutyunyan1-1/+0
2020-03-18Refactored HTTP/3 parser.Roman Arutyunyan9-694/+1872
2020-03-14Temporary fix for header null-termination in HTTP/3.Roman Arutyunyan2-2/+14
2020-03-13HTTP/3.Roman Arutyunyan12-56/+2926
2020-03-13Stream "connection" read/write methods.Vladimir Homutov1-0/+31
2020-03-13Auth basic: explicitly zero out password buffer.Ruslan Ermilov1-19/+18
2020-03-12Fix build.Sergey Kandaurov1-1/+2
generated by cgit (git 2.34.1) at 2026-01-08 05:41:28 +0000