summaryrefslogtreecommitdiffhomepage
path: root/src/http (follow)
AgeCommit message (Collapse)AuthorFilesLines
2021-07-08HTTP/3: bulk parse functions.Roman Arutyunyan4-870/+1068
Previously HTTP/3 streams were parsed by one character. Now all parse functions receive buffers. This should optimize parsing time and CPU load.
2021-08-24HTTP/3: fixed dead store assignment.Sergey Kandaurov1-1/+0
Found by Clang Static Analyzer.
2021-08-10HTTP/3: disabled control characters and space in header names.Sergey Kandaurov1-1/+1
This is a follow up to 41f4bd4c51f1.
2021-08-05HTTP/3: got rid of HTTP/2 module dependency.Vladimir Homutov2-6/+6
The Huffman encoder/decoder now can be built separately from HTTP/2 module.
2021-08-04HTTP/3: replaced macros with values.Roman Arutyunyan2-13/+4
2021-07-29HTTP/3: close connection on keepalive_requests * 2.Roman Arutyunyan1-2/+9
After receiving GOAWAY, client is not supposed to create new streams. However, until client reads this frame, we allow it to create new streams, which are gracefully rejected. To prevent client from abusing this algorithm, a new limit is introduced. Upon reaching keepalive_requests * 2, server now closes the entire QUIC connection claiming excessive load.
2021-08-02QUIC: stream limits in "hq" mode.Roman Arutyunyan1-0/+35
The "hq" mode is HTTP/0.9-1.1 over QUIC. The following limits are introduced: - uni streams are not allowed - keepalive_requests is enforced - keepalive_time is enforced In case of error, QUIC connection is finalized with 0x101 code. This code corresponds to HTTP/3 General Protocol Error.
2021-07-29HTTP/3: http3_max_uni_streams directive.Roman Arutyunyan3-0/+28
The directive limits the number of uni streams client is allowed to create.
2021-07-29HTTP/3: require mandatory uni streams before additional ones.Roman Arutyunyan1-2/+11
As per quic-http-34: Endpoints SHOULD create the HTTP control stream as well as the unidirectional streams required by mandatory extensions (such as the QPACK encoder and decoder streams) first, and then create additional streams as allowed by their peer. Previously, client could create and destroy additional uni streams unlimited number of times before creating mandatory streams.
2021-07-16HTTP/3: use request pool instead of connection pool.Roman Arutyunyan1-5/+5
In several parts of ngx_http_v3_header_filter() connection pool was used for request-related data.
2021-07-13HTTP/3: response trailers support.Roman Arutyunyan1-16/+118
2021-07-20QUIC: the "quic_gso" directive.Vladimir Homutov1-0/+9
The directive enables usage of UDP segmentation offloading by quic. By default, gso is disabled since it is not always operational when detected (depends on interface configuration).
2021-07-15Merged with the default branch.Sergey Kandaurov9-125/+132
2021-07-01HTTP/3: quic-qpack term updates.Sergey Kandaurov10-232/+232
Renamed header -> field per quic-qpack naming convention, in particular: - Header Field -> Field Line - Header Block -> (Encoded) Field Section - Without Name Reference -> With Literal Name - Header Acknowledgement -> Section Acknowledgment
2021-06-30QUIC: consider max_ack_delay=16384 invalid.Roman Arutyunyan1-1/+1
As per RFC 9000: Values of 2^14 or greater are invalid.
2021-06-28Disabled control characters in the Host header.Maxim Dounin1-3/+4
Control characters (0x00-0x1f, 0x7f) and space are not expected to appear in the Host header. Requests with such characters in the Host header are now unconditionally rejected.
2021-06-28Improved logging of invalid headers.Maxim Dounin6-13/+28
In 71edd9192f24 logging of invalid headers which were rejected with the NGX_HTTP_PARSE_INVALID_HEADER error was restricted to just the "client sent invalid header line" message, without any attempts to log the header itself. This patch returns logging of the header up to the invalid character and the character itself. The r->header_end pointer is now properly set in all cases to make logging possible. The same logging is also introduced when parsing headers from upstream servers.
2021-06-28Disabled control characters and space in header names.Maxim Dounin3-4/+4
Control characters (0x00-0x1f, 0x7f), space, and colon were never allowed in header names. The only somewhat valid use is header continuation which nginx never supported and which is explicitly obsolete by RFC 7230. Previously, such headers were considered invalid and were ignored by default (as per ignore_invalid_headers directive). With this change, such headers are unconditionally rejected. It is expected to make nginx more resilient to various attacks, in particular, with ignore_invalid_headers switched off (which is inherently unsecure, though nevertheless sometimes used in the wild).
2021-06-28Disabled control characters in URIs.Maxim Dounin1-14/+28
Control characters (0x00-0x1f, 0x7f) were never allowed in URIs, and must be percent-encoded by clients. Further, these are not believed to appear in practice. On the other hand, passing such characters might make various attacks possible or easier, despite the fact that currently allowed control characters are not significant for HTTP request parsing.
2021-06-28Disabled spaces in URIs (ticket #196).Maxim Dounin4-70/+11
From now on, requests with spaces in URIs are immediately rejected rather than allowed. Spaces were allowed in 31e9677b15a1 (0.8.41) to handle bad clients. It is believed that now this behaviour causes more harm than good.
2021-06-28Disabled requests with both Content-Length and Transfer-Encoding.Maxim Dounin1-2/+9
HTTP clients are not allowed to generate such requests since Transfer-Encoding introduction in RFC 2068, and they are not expected to appear in practice except in attempts to perform a request smuggling attack. While handling of such requests is strictly defined, the most secure approach seems to reject them.
2021-06-28Added CONNECT method rejection.Maxim Dounin4-17/+31
No valid CONNECT requests are expected to appear within nginx, since it is not a forward proxy. Further, request line parsing will reject proper CONNECT requests anyway, since we don't allow authority-form of request-target. On the other hand, RFC 7230 specifies separate message length rules for CONNECT which we don't support, so make sure to always reject CONNECTs to avoid potential abuse.
2021-06-28Moved TRACE method rejection to a better place.Maxim Dounin1-7/+7
Previously, TRACE requests were rejected before parsing Transfer-Encoding. This is not important since keepalive is not enabled at this point anyway, though rejecting such requests after properly parsing other headers is less likely to cause issues in case of further code changes.
2021-06-17gRPC: RST_STREAM(NO_ERROR) handling micro-optimization.Sergey Kandaurov1-0/+4
After 2096b21fcd10, a single RST_STREAM(NO_ERROR) may not result in an error. This change removes several unnecessary ctx->type checks for such a case.
2021-06-17gRPC: handling GOAWAY with a higher last stream identifier.Sergey Kandaurov1-0/+9
Previously, once received from upstream, it couldn't limit opening additional streams in a cached keepalive connection.
2021-06-11HTTP/3: client GOAWAY support.Roman Arutyunyan6-0/+49
2021-06-11HTTP/3: generate more H3_FRAME_UNEXPECTED.Roman Arutyunyan1-3/+23
As per quic-http-34, these are the cases when this error should be generated: If an endpoint receives a second SETTINGS frame on the control stream, the endpoint MUST respond with a connection error of type H3_FRAME_UNEXPECTED SETTINGS frames MUST NOT be sent on any stream other than the control stream. If an endpoint receives a SETTINGS frame on a different stream, the endpoint MUST respond with a connection error of type H3_FRAME_UNEXPECTED. A client MUST NOT send a PUSH_PROMISE frame. A server MUST treat the receipt of a PUSH_PROMISE frame as a connection error of type H3_FRAME_UNEXPECTED; see Section 8. The MAX_PUSH_ID frame is always sent on the control stream. Receipt of a MAX_PUSH_ID frame on any other stream MUST be treated as a connection error of type H3_FRAME_UNEXPECTED. Receipt of an invalid sequence of frames MUST be treated as a connection error of type H3_FRAME_UNEXPECTED; see Section 8. In particular, a DATA frame before any HEADERS frame, or a HEADERS or DATA frame after the trailing HEADERS frame, is considered invalid. A CANCEL_PUSH frame is sent on the control stream. Receiving a CANCEL_PUSH frame on a stream other than the control stream MUST be treated as a connection error of type H3_FRAME_UNEXPECTED. The GOAWAY frame is always sent on the control stream.
2021-06-11HTTP/3: reordered H3_MISSING_SETTINGS and H3_FRAME_UNEXPECTED.Roman Arutyunyan1-6/+6
The quic-http-34 is ambiguous as to what error should be generated for the first frame in control stream: Each side MUST initiate a single control stream at the beginning of the connection and send its SETTINGS frame as the first frame on this stream. If the first frame of the control stream is any other frame type, this MUST be treated as a connection error of type H3_MISSING_SETTINGS. If a DATA frame is received on a control stream, the recipient MUST respond with a connection error of type H3_FRAME_UNEXPECTED. If a HEADERS frame is received on a control stream, the recipient MUST respond with a connection error of type H3_FRAME_UNEXPECTED. Previously, H3_FRAME_UNEXPECTED had priority, but now H3_MISSING_SETTINGS has. The arguments in the spec sound more compelling for H3_MISSING_SETTINGS.
2021-06-01Fixed SSL logging with lingering close.Maxim Dounin1-0/+2
Recent fixes to SSL shutdown with lingering close (554c6ae25ffc, 1.19.5) broke logging of SSL variables. To make sure logging of SSL variables works properly, avoid freeing c->ssl when doing an SSL shutdown before lingering close. Reported by Reinis Rozitis (http://mailman.nginx.org/pipermail/nginx/2021-May/060670.html).
2021-06-01HTTP/3: undo 5a92523e50d3 after parser refactoring (e1eb7f4ca9f1).Sergey Kandaurov1-1/+0
This is no longer needed after HTTP/3 request processing has moved into its own function ngx_http_v3_process_header().
2021-06-01HTTP/3: fixed parsing encoder insertions with empty header value.Sergey Kandaurov1-0/+2
When starting processing a new encoder instruction, the header state is not memzero'ed because generally it's burdensome. If the header value is empty, this resulted in inserting a stale value left from the previous instruction. Based on a patch by Zhiyong Sun.
2021-05-31HTTP/3: removed $http3 that served its purpose.Sergey Kandaurov1-50/+1
To specify final protocol version by hand: add_header Alt-Svc h3=":443";
2021-05-28Merged with the default branch.Sergey Kandaurov15-131/+332
2021-05-27HTTP/3: fixed Insert With Name Reference index processing.Sergey Kandaurov1-1/+12
Based on a patch by Zhiyong Sun.
2021-05-24Location header escaping in redirects (ticket #882).Ruslan Ermilov5-7/+80
The header is escaped in redirects based on request URI or location name (auto redirect).
2021-05-24Fixed log action when using SSL certificates with variables.Maxim Dounin1-0/+2
When variables are used in ssl_certificate or ssl_certificate_key, a request is created in the certificate callback to evaluate the variables, and then freed. Freeing it, however, updates c->log->action to "closing request", resulting in confusing error messages like "client timed out ... while closing request" when a client times out during the SSL handshake. Fix is to restore c->log->action after calling ngx_http_free_request().
2021-05-18HTTP/3: fixed server push after 9ec3e71f8a61.Roman Arutyunyan1-4/+3
When using server push, a segfault occured because ngx_http_v3_create_push_request() accessed ngx_http_v3_session_t object the old way. Prior to 9ec3e71f8a61, HTTP/3 session was stored directly in c->data. Now it's referenced by the v3_session field of ngx_http_connection_t.
2021-05-06Upstream: variables support in certificates.Maxim Dounin7-73/+206
2021-05-06Auth basic: changed alcf->user_file to be a pointer.Maxim Dounin1-9/+12
This saves some memory in typical case when auth_basic_user_file is not explicitly set, and unifies the code with alcf->realm.
2021-05-06Changed complex value slots to use NGX_CONF_UNSET_PTR.Maxim Dounin7-42/+32
With this change, it is now possible to use ngx_conf_merge_ptr_value() to merge complex values. This change follows much earlier changes in ngx_conf_merge_ptr_value() and ngx_conf_set_str_array_slot() in 1452:cd586e963db0 (0.6.10) and 1701:40d004d95d88 (0.6.22), and the change in ngx_conf_set_keyval_slot() (7728:485dba3e2a01, 1.19.4). To preserve compatibility with existing 3rd party modules, both NULL and NGX_CONF_UNSET_PTR are accepted for now.
2021-04-28HTTP/3: clean up table from session cleanup handler.Roman Arutyunyan3-19/+13
Previously table had a separate cleanup handler.
2021-05-05HTTP/3: moved session initialization to a separate file.Roman Arutyunyan3-75/+87
Previously it was in ngx_http_v3_streams.c, but it's unrelated to streams.
2021-05-05HTTP/3: separate header files for existing source files.Roman Arutyunyan4-74/+135
2021-05-05HTTP/3: moved parsing uni stream type to ngx_http_v3_parse.c.Roman Arutyunyan4-125/+159
Previously it was parsed in ngx_http_v3_streams.c, while the streams were parsed in ngx_http_v3_parse.c. Now all parsing is done in one file. This simplifies parsing API and cleans up ngx_http_v3_streams.c.
2021-04-27HTTP/3: renamed ngx_http_v3_client_XXX() functions.Roman Arutyunyan4-17/+16
The functions are renamed to ngx_http_v3_send_XXX() similar to ngx_http_v3_send_settings() and ngx_http_v3_send_goaway().
2021-05-05HTTP/3: renamed ngx_http_v3_connection_t to ngx_http_v3_session_t.Roman Arutyunyan7-41/+40
2021-05-05HTTP/3: reference h3c directly from ngx_http_connection_t.Roman Arutyunyan7-32/+30
Previously, an ngx_http_v3_connection_t object was created for HTTP/3 and then assinged to c->data instead of the generic ngx_http_connection_t object. Now a direct reference is added to ngx_http_connection_t, which is less confusing and does not require a flag for http3.
2021-04-30HTTP/3: ngx_http_v3_get_session() macro.Roman Arutyunyan5-22/+24
It's used instead of accessing c->quic->parent->data directly. Apart from being simpler, it allows to change the way session is stored in the future by changing the macro.
2021-05-05HTTP/3: moved Stream Cancellation stub to ngx_http_v3_streams.c.Roman Arutyunyan2-12/+12
2021-05-04HTTP/3: fixed decoder stream stubs.Roman Arutyunyan1-5/+5
Now ngx_http_v3_ack_header() and ngx_http_v3_inc_insert_count() always generate decoder error. Our implementation does not use dynamic tables and does not expect client to send Section Acknowledgement or Insert Count Increment. Stream Cancellation, on the other hand, is allowed to be sent anyway. This is why ngx_http_v3_cancel_stream() does not return an error.
generated by cgit (git 2.34.1) at 2026-01-04 00:07:05 +0000