summaryrefslogtreecommitdiffhomepage
path: root/src/http (follow)
AgeCommit message (Collapse)AuthorFilesLines
2020-07-03HTTP/3: put ngx_http_v3_parse_varlen_int() return code in variable.Roman Arutyunyan1-16/+26
This makes calling this function similar to other parse functions.
2020-07-03HTTP/3: simplifed handling ngx_http_v3_parse_literal() return code.Roman Arutyunyan1-56/+21
2020-07-03HTTP/3: limited prefixed integer size by 62 bits.Roman Arutyunyan1-38/+66
2020-07-03HTTP/3: fixed overflow in prefixed integer parser.Roman Arutyunyan1-1/+1
Previously, the expression (ch & 0x7f) was promoted to a signed integer. Depending on the platform, the size of this integer could be less than 8 bytes, leading to overflow when handling the higher bits of the result. Also, sign bit of this integer could be replicated when adding to the 64-bit st->value.
2020-07-02HTTP/3: fixed prefix in decoding Section Acknowledgement.Sergey Kandaurov1-1/+1
2020-06-30HTTP/3: set r->headers_in.chunked flag after parsing headers.Roman Arutyunyan1-1/+6
Previously it was set when creating the request object. The side-effect was trying to discard the request body in case of header parse error.
2020-07-02HTTP/3: close QUIC connection with HTTP/QPACK errors when needed.Roman Arutyunyan7-136/+220
Previously errors led only to closing streams. To simplify closing QUIC connection from a QUIC stream context, new macro ngx_http_v3_finalize_connection() is introduced. It calls ngx_quic_finalize_connection() for the parent connection.
2020-06-30HTTP/3: error code definitions for HTTP/3 and QPACK.Roman Arutyunyan1-0/+23
2020-07-02HTTP/3: downgraded literal size error level to NGX_LOG_INFO.Roman Arutyunyan1-1/+1
Now it's similar to HTTP/2.
2020-07-02HTTP/3: refactored dynamic table implementation.Roman Arutyunyan7-166/+584
Previously dynamic table was not functional because of zero limit on its size set by default. Now the following changes enable it: - new directives to set SETTINGS_QPACK_MAX_TABLE_CAPACITY and SETTINGS_QPACK_BLOCKED_STREAMS - send settings with SETTINGS_QPACK_MAX_TABLE_CAPACITY and SETTINGS_QPACK_BLOCKED_STREAMS to the client - send Insert Count Increment to the client - send Header Acknowledgement to the client - evict old dynamic table entries on overflow - decode Required Insert Count from client - block stream if Required Insert Count is not reached
2020-07-02HTTP/3: fixed prefixed integer encoding and decoding.Roman Arutyunyan3-16/+16
Previously bytes were ordered from MSB to LSB, but the right order is the reverse.
2020-06-29HTTP/3: http3_max_field_size directive to limit string size.Roman Arutyunyan3-1/+25
Client streams may send literal strings which are now limited in size by the new directive. The default value is 4096. The directive is similar to HTTP/2 directive http2_max_field_size.
2020-06-26HTTP/3: introduced ngx_http_v3_get_module_srv_conf() macro.Roman Arutyunyan1-0/+6
The macro helps to access a module's server configuration from a QUIC stream context.
2020-06-26HTTP/3: fixed dropping first non-pseudo header.Roman Arutyunyan1-11/+38
2020-06-25HTTP/3: do not emit a DATA frame header for header_only responses.Sergey Kandaurov1-1/+1
This resulted in the frame error due to the invalid DATA frame length.
2020-06-23Do not close QUIC sockets in ngx_close_listening_sockets().Sergey Kandaurov1-0/+4
This breaks graceful shutdown of QUIC connections in terms of quic-transport.
2020-06-15Fixed potential leak of temp pool.Eran Kornblau1-2/+2
In case ngx_hash_add_key() fails, need to goto failed instead of returning, so that temp_pool will be destoryed.
2020-06-22Cache: introduced min_free cache clearing.Maxim Dounin2-3/+41
Clearing cache based on free space left on a file system is expected to allow better disk utilization in some cases, notably when disk space might be also used for something other than nginx cache (including nginx own temporary files) and while loading cache (when cache size might be inaccurate for a while, effectively disabling max_size cache clearing). Based on a patch by Adam Bambuch.
2020-06-15Correctly flush request body to uwsgi with SSL.Quantum1-0/+1
The flush flag was not set when forwarding the request body to the uwsgi server. When using uwsgi_pass suwsgi://..., this causes the uwsgi server to wait indefinitely for the request body and eventually time out due to SSL buffering. This is essentially the same change as 4009:3183165283cc, which was made to ngx_http_proxy_module.c. This will fix the uwsgi bug https://github.com/unbit/uwsgi/issues/1490.
2020-06-02Decoupled validation of Host and :authority for HTTP/2 and HTTP/3.Roman Arutyunyan1-3/+11
Previously an error was triggered for HTTP/2 when host with port was passed by client.
2020-05-29Require ":authority" or "Host" in HTTP/3 and HTTP/2 requests.Roman Arutyunyan1-0/+25
Also, if both are present, require that they have the same value. These requirements are specified in HTTP/3 draft 28. Current implementation of HTTP/2 treats ":authority" and "Host" interchangeably. New checks only make sure at least one of these values is present in the request. A similar check existed earlier and was limited only to HTTP/1.1 in 38c0898b6df7.
2020-05-29Added propagation of the "wildcard" flag to c->listening.Vladimir Homutov1-0/+2
The flags was originally added by 8f038068f4bc, and is propagated correctly in the stream module. With QUIC introduction, http module now uses datagram sockets as well, thus the fix.
2020-05-29QUIC draft-28 transport parameters support.Sergey Kandaurov1-1/+3
Draft-27 and draft-28 support can now be enabled interchangeably, it's based on the compile-time macro NGX_QUIC_DRAFT_VERSION.
2020-05-29Renamed max_packet_size to max_udp_payload_size, from draft-28.Sergey Kandaurov1-14/+15
No functional changes.
2020-05-26Merged with the default branch.Sergey Kandaurov7-17/+194
2020-05-25HTTP/2: invalid connection preface logging (ticket #1981).Maxim Dounin1-6/+4
Previously, invalid connection preface errors were only logged at debug level, providing no visible feedback, in particular, when a plain text HTTP/2 listening socket is erroneously used for HTTP/1.x connections. Now these are explicitly logged at the info level, much like other client-related errors.
2020-05-22OCSP: certificate status cache.Roman Arutyunyan2-1/+94
When enabled, certificate status is stored in cache and is used to validate the certificate in future requests. New directive ssl_ocsp_cache is added to configure the cache.
2020-05-22SSL: client certificate validation with OCSP (ticket #1534).Roman Arutyunyan3-5/+74
OCSP validation for client certificates is enabled by the "ssl_ocsp" directive. OCSP responder can be optionally specified by "ssl_ocsp_responder". When session is reused, peer chain is not available for validation. If the verified chain contains certificates from the peer chain not available at the server, validation will fail.
2020-05-14HTTP/3: reallocate strings inserted into the dynamic table.Roman Arutyunyan1-3/+30
They should always be allocated from the main QUIC connection pool.
2020-05-19Fixed client buffer reallocation for HTTP/3.Roman Arutyunyan2-29/+20
Preserving pointers within the client buffer is not needed for HTTP/3 because all data is either allocated from pool or static. Unlike with HTTP/1, data typically cannot be referenced directly within the client buffer. Trying to preserve NULLs or external pointers lead to broken pointers. Also, reverted changes in ngx_http_alloc_large_header_buffer() not relevant for HTTP/3 to minimize diff to mainstream.
2020-05-19Fixed $request_length for HTTP/3.Roman Arutyunyan4-13/+19
New field r->parse_start is introduced to substitute r->request_start and r->header_name_start for request length accounting. These fields only work for this purpose in HTTP/1 because HTTP/1 request line and header line start with these values. Also, error logging is now fixed to output the right part of the request.
2020-05-19HTTP/3: restricted symbols in header names.Roman Arutyunyan3-8/+54
As per HTTP/3 draft 27, a request or response containing uppercase header field names MUST be treated as malformed. Also, existing rules applied when parsing HTTP/1 header names are also applied to HTTP/3 header names: - null character is not allowed - underscore character may or may not be treated as invalid depending on the value of "underscores_in_headers" - all non-alphanumeric characters with the exception of '-' are treated as invalid Also, the r->locase_header field is now filled while parsing an HTTP/3 header. Error logging for invalid headers is fixed as well.
2020-05-19HTTP/3: split header parser in two functions.Roman Arutyunyan3-68/+77
The first one parses pseudo-headers and is analagous to the request line parser in HTTP/1. The second one parses regular headers and is analogous to the header parser in HTTP/1. Additionally, error handling of client passing malformed uri is now fixed.
2020-05-14HTTP/3: move body parser call out of ngx_http_parse_chunked().Roman Arutyunyan2-8/+20
The function ngx_http_parse_chunked() is also called from the proxy module to parse the upstream response. It should always parse HTTP/1 body in this case.
2020-05-19HTTP/3: prevent array access by negative index for unknown streams.Roman Arutyunyan1-1/+3
Currently there are no such streams, but the function ngx_http_v3_get_uni_stream() supports them.
2020-05-20Assorted fixes.Sergey Kandaurov1-1/+1
Found by Clang Static Analyzer.
2020-05-14Address validation using Retry packets.Sergey Kandaurov1-0/+18
The behaviour is toggled with the new directive "quic_retry on|off". QUIC token construction is made suitable for issuing with NEW_TOKEN.
2020-05-13Upstream: jump out of loop after matching the status code.Jinhua Tan1-0/+2
2020-05-08Variables: fixed buffer over-read when evaluating "$arg_".Sergey Kandaurov1-1/+1
2020-04-23Assign connection number to every QUIC stream log.Roman Arutyunyan2-3/+0
2020-04-23gRPC: WINDOW_UPDATE after END_STREAM handling (ticket #1797).Ruslan Ermilov1-1/+2
As per https://tools.ietf.org/html/rfc7540#section-6.9, WINDOW_UPDATE received after a frame with the END_STREAM flag should be handled and not treated as an error.
2020-04-23gRPC: RST_STREAM(NO_ERROR) handling (ticket #1792).Ruslan Ermilov1-5/+19
As per https://tools.ietf.org/html/rfc7540#section-8.1, : A server can send a complete response prior to the client : sending an entire request if the response does not depend on : any portion of the request that has not been sent and : received. When this is true, a server MAY request that the : client abort transmission of a request without error by : sending a RST_STREAM with an error code of NO_ERROR after : sending a complete response (i.e., a frame with the : END_STREAM flag). Clients MUST NOT discard responses as a : result of receiving such a RST_STREAM, though clients can : always discard responses at their discretion for other : reasons. Previously, RST_STREAM(NO_ERROR) received from upstream after a frame with the END_STREAM flag was incorrectly treated as an error. Now, a single RST_STREAM(NO_ERROR) is properly handled. This fixes problems observed with modern grpc-c [1], as well as with the Go gRPC module. [1] https://github.com/grpc/grpc/pull/1661
2020-04-22HTTP/3: directives with limited values converted to post handler.Sergey Kandaurov1-30/+50
The purpose is to show a precise line number with an invalid value.
2020-04-22HTTP/3: bytes holding directives changed to ngx_conf_set_size_slot.Sergey Kandaurov1-15/+15
This allows to specify directive values with measurement units.
2020-04-21HTTP/3: fixed encoding variable-length integers.Roman Arutyunyan1-5/+9
2020-04-16Added handling of incorrect values in TP configuration.Vladimir Homutov1-4/+30
Some parameters have minimal/maximum values defined by standard.
2020-04-15Added primitive flow control mechanisms.Vladimir Homutov1-4/+6
+ MAX_STREAM_DATA frame is sent when recv() is performed on stream The new value is a sum of total bytes received by stream + free space in a buffer; The sending of MAX_STREM_DATA frame in response to STREAM_DATA_BLOCKED frame is adjusted to follow the same logic as above. + MAX_DATA frame is sent when total amount of received data is 2x of current limit. The limit is doubled. + Default values of transport parameters are adjusted to more meaningful values: initial stream limits are set to quic buffer size instead of unrealistically small 255. initial max data is decreased to 16 buffer sizes, in an assumption that this is enough for a relatively short connection, instead of randomly chosen big number. All this allows to initiate a stable flow of streams that does not block on stream/connection limits (tested with FF 77.0a1 and 100K requests)
2020-04-14Merged with the default branch.Sergey Kandaurov4-43/+111
2020-04-13HTTP/3: fixed reading request body.Roman Arutyunyan1-1/+2
2020-04-08The new auth_delay directive for delaying unauthorized requests.Ruslan Ermilov2-1/+82
The request processing is delayed by a timer. Since nginx updates internal time once at the start of each event loop iteration, this normally ensures constant time delay, adding a mitigation from time-based attacks. A notable exception to this is the case when there are no additional events before the timer expires. To ensure constant-time processing in this case as well, we trigger an additional event loop iteration by posting a dummy event for the next event loop iteration.
generated by cgit (git 2.34.1) at 2025-12-13 01:37:55 +0000