summaryrefslogtreecommitdiffhomepage
path: root/src (follow)
AgeCommit message (Collapse)AuthorFilesLines
2020-05-06Restored ngx_quic_encrypt return type.Sergey Kandaurov2-7/+6
It was inadvertently changed while working on removing memory allocations.
2020-04-30Store clearflags in pkt->flags after decryption.Vladimir Homutov1-0/+1
It doesn't make sense to store protected flags.
2020-04-30Configure: unbreak with old OpenSSL, --with-http_v3_module added.Sergey Kandaurov1-0/+2
2020-04-29Removed outdated/incorrect comments and fixed style.Vladimir Homutov3-9/+7
- we need transport parameters early to get packet size limits at least.
2020-04-30Reworked macros for parsing/assembling packet types.Vladimir Homutov4-110/+105
Previously, macros checking a packet type with the long header also checked whether this is a long header. Now it requires a separate preceding check.
2020-04-29Renamed retransmit event object in preparation for retry support.Sergey Kandaurov1-10/+10
2020-04-28Server CID change.Sergey Kandaurov1-5/+32
2020-04-28Factored out sending ACK from payload handler.Sergey Kandaurov1-39/+46
Now there's no need to annotate every frame in ACK-eliciting packet. Sending ACK was moved to the first place, so that queueing ACK frame no longer postponed up to the next packet after pushing STREAM frames.
2020-04-28Respect MAX_DATA and MAX_STREAM_DATA from QUIC client.Roman Arutyunyan2-18/+156
2020-04-28QUIC basic congestion control.Roman Arutyunyan2-10/+212
2020-04-24Fixed packet retransmission.Roman Arutyunyan1-9/+10
Previously frames in ctx->sent queue could be lost.
2020-04-23Assign connection number to every QUIC stream log.Roman Arutyunyan3-3/+2
2020-04-24Error messages cleanup.Vladimir Homutov2-187/+135
+ added "quic" prefix to all error messages + rephrased some messages + removed excessive error logging from frame parser + added ngx_quic_check_peer() function to check proper source/destination match and do it one place
2020-04-24Cleaned up hexdumps in debug output.Vladimir Homutov4-54/+63
- the ngx_quic_hexdump0() macro is renamed to ngx_quic_hexdump(); the original ngx_quic_hexdump() macro with variable argument is removed, extra information is logged normally, with ngx_log_debug() - all labels in hex dumps are prefixed with "quic" - the hexdump format is simplified, length is moved forward to avoid situations when the dump is truncated, and length is not shown - ngx_quic_flush_flight() function contents is debug-only, placed under NGX_DEBUG macro to avoid "unused variable" warnings from compiler - frame names in labels are capitalized, similar to other places
2020-04-24Debug cleanup.Vladimir Homutov4-104/+184
+ all dumps are moved under one of the following macros (undefined by default): NGX_QUIC_DEBUG_PACKETS NGX_QUIC_DEBUG_FRAMES NGX_QUIC_DEBUG_FRAMES_ALLOC NGX_QUIC_DEBUG_CRYPTO + all QUIC debug messages got "quic " prefix + all input frames are reported as "quic frame in FOO_FRAME bar:1 baz:2" + all outgoing frames re reported as "quic frame out foo bar baz" + all stream operations are prefixed with id, like: "quic stream id 0x33 recv" + all transport parameters are prefixed with "quic tp" (hex dump is moved to caller, to avoid using ngx_cycle->log) + packet flags and some other debug messages are updated to include packet type
2020-04-23gRPC: WINDOW_UPDATE after END_STREAM handling (ticket #1797).Ruslan Ermilov1-1/+2
As per https://tools.ietf.org/html/rfc7540#section-6.9, WINDOW_UPDATE received after a frame with the END_STREAM flag should be handled and not treated as an error.
2020-04-23gRPC: RST_STREAM(NO_ERROR) handling (ticket #1792).Ruslan Ermilov1-5/+19
As per https://tools.ietf.org/html/rfc7540#section-8.1, : A server can send a complete response prior to the client : sending an entire request if the response does not depend on : any portion of the request that has not been sent and : received. When this is true, a server MAY request that the : client abort transmission of a request without error by : sending a RST_STREAM with an error code of NO_ERROR after : sending a complete response (i.e., a frame with the : END_STREAM flag). Clients MUST NOT discard responses as a : result of receiving such a RST_STREAM, though clients can : always discard responses at their discretion for other : reasons. Previously, RST_STREAM(NO_ERROR) received from upstream after a frame with the END_STREAM flag was incorrectly treated as an error. Now, a single RST_STREAM(NO_ERROR) is properly handled. This fixes problems observed with modern grpc-c [1], as well as with the Go gRPC module. [1] https://github.com/grpc/grpc/pull/1661
2020-04-23Version bump.Ruslan Ermilov1-2/+2
2020-04-23TODOs cleanup in transport.Vladimir Homutov1-10/+1
We always generate stream frames that have length. The 'len' member is used during parsing incoming frames and can be safely ignored when generating output.
2020-04-23Retired the ngx_quic_parse_int_multi() function.Vladimir Homutov1-55/+56
It used variable-length arguments what is not really necessary.
2020-04-23Removed support of drafts older than currently latest 27.Vladimir Homutov2-97/+1
2020-04-23Added proper handling of connection close phases.Vladimir Homutov2-36/+182
There are following flags in quic connection: closing - true, when a connection close is initiated, for whatever reason draining - true, when a CC frame is received from peer The following state machine is used for closing: +------------------+ | I/HS/AD | +------------------+ | | | | | V | | immediate close initiated: | | reasons: close by top-level protocol, fatal error | | + sends CC (probably with app-level message) | | + starts close_timer: 3 * PTO (current probe timeout) | | | | | V | | +---------+ - Reply to input with CC (rate-limited) | | | CLOSING | - Close/Reset all streams | | +---------+ | | | | | V V | | receives CC | | | | idle | | timer | | | V | | +----------+ | - MUST NOT send anything (MAY send a single CC) | | DRAINING | | - if not already started, starts close_timer: 3 * PTO | +----------+ | - if not already done, close all streams | | | | | | | close_timer fires | | V V +------------------------+ | CLOSED | - clean up all the resources, drop connection +------------------------+ state completely The ngx_quic_close_connection() function gets an "rc" argument, that signals reason of connection closing: NGX_OK - initiated by application (i.e. http/3), follow state machine NGX_DONE - timedout (while idle or draining) NGX_ERROR - fatal error, destroy connection immediately The PTO calculations are not yet implemented, hardcoded value of 5s is used.
2020-04-23Refactored ngx_quic_close_connection().Vladimir Homutov1-62/+89
The function is split into three: ngx_quic_close_connection() itself cleans up all core nginx things ngx_quic_close_quic() deals with everything inside c->quic ngx_quic_close_streams() deals with streams cleanup The quic and streams cleanup functions may return NGX_AGAIN, thus signalling that cleanup is not ready yet, and the close cannot continue to next step.
2020-04-22HTTP/3: directives with limited values converted to post handler.Sergey Kandaurov1-30/+50
The purpose is to show a precise line number with an invalid value.
2020-04-22HTTP/3: bytes holding directives changed to ngx_conf_set_size_slot.Sergey Kandaurov2-20/+20
This allows to specify directive values with measurement units.
2020-04-22Improved ngx_quic_build_int() code and readability.Sergey Kandaurov1-14/+8
The function now generates somewhat shorter assembler after inlining.
2020-04-21Fixed QUIC buffer consumption in send_chain().Roman Arutyunyan1-1/+2
2020-04-21HTTP/3: fixed encoding variable-length integers.Roman Arutyunyan1-5/+9
2020-04-20Fixed memory leak with reordered stream frames.Vladimir Homutov1-2/+1
2020-04-21Fixed includes in quic headers.Roman Arutyunyan3-2/+8
2020-04-20Added MAX_STREAM_DATA stub handler.Vladimir Homutov1-0/+3
Currently sending code is ignoring this.
2020-04-20Respecting maximum packet size.Vladimir Homutov2-36/+82
The header size macros for long and short packets were fixed to provide correct values in bytes. Currently the sending code limits frames so they don't exceed max_packet_size. But it does not account the case when a single frame can exceed the limit. As a result of this patch, big payload (CRYPTO and STREAM) will be split into a number of smaller frames that fit into advertised max_packet_size (which specifies final packet size, after encryption).
2020-04-20Removed source/destination swap from the function creating header.Vladimir Homutov2-6/+6
The function now creates a header according to fileds provided in the "pkt" argument without applying any logic regarding sending side.
2020-04-17Revert "Rejecting new connections with non-zero Initial packet."Sergey Kandaurov1-6/+0
chrome-unstable 83.0.4103.7 starts with Initial packet number 1. I couldn't find a proper explanation besides this text in quic-transport: An endpoint MAY skip packet numbers when sending packets to detect this (Optimistic ACK Attack) behavior.
2020-04-16Fixed error descriptions.Vladimir Homutov2-9/+9
The check for array bound is done inside function that returns error description. Missing initialization element is added.
2020-04-16Removed outdated TODO.Vladimir Homutov1-1/+0
If required, frame handler can invoke output itself. There is no need to call output directly in the payload handler, queuing is enough.
2020-04-16Added handling of incorrect values in TP configuration.Vladimir Homutov1-4/+30
Some parameters have minimal/maximum values defined by standard.
2020-04-16Parsing of truncated packet numbers.Sergey Kandaurov3-18/+63
For sample decoding algorithm, see quic-transport-27#appendix-A.
2020-04-15Added primitive flow control mechanisms.Vladimir Homutov3-9/+92
+ MAX_STREAM_DATA frame is sent when recv() is performed on stream The new value is a sum of total bytes received by stream + free space in a buffer; The sending of MAX_STREM_DATA frame in response to STREAM_DATA_BLOCKED frame is adjusted to follow the same logic as above. + MAX_DATA frame is sent when total amount of received data is 2x of current limit. The limit is doubled. + Default values of transport parameters are adjusted to more meaningful values: initial stream limits are set to quic buffer size instead of unrealistically small 255. initial max data is decreased to 16 buffer sizes, in an assumption that this is enough for a relatively short connection, instead of randomly chosen big number. All this allows to initiate a stable flow of streams that does not block on stream/connection limits (tested with FF 77.0a1 and 100K requests)
2020-04-15Create new stream immediately on receiving new stream id.Vladimir Homutov1-76/+73
Before the patch, full STREAM frame handling was delayed until the frame with zero offset is received. Only node in the streams tree was created. This lead to problems when such stream was deleted, in particular, it had no handlers set for read events. This patch creates new stream immediately, but delays data delivery until the proper offset will arrive. This is somewhat similar to how accept() operation works. The ngx_quic_add_stream() function is no longer needed and merged into stream handler. The ngx_quic_stream_input() now only handles frames for existing streams and does not deal with stream creation.
2020-04-15Free remaining frames on connection close.Vladimir Homutov1-4/+9
Frames can still float in the following queues: - crypto frames reordering queues (one per encryption level) - moved crypto frames cleanup to the moment where all streams are closed - stream frames reordering queues (one per packet number namespace) - frames retransmit queues (one per packet number namespace)
2020-04-14Sorted functions and functions declarations.Vladimir Homutov1-23/+24
2020-04-15Added reordering support for STREAM frames.Vladimir Homutov2-72/+159
Each stream node now includes incoming frames queue and sent/received counters for tracking offset. The sent counter is not used, c->sent is used, not like in crypto buffers, which have no connections.
2020-04-14Crypto buffer frames reordering.Vladimir Homutov3-50/+307
If offset in CRYPTO frame doesn't match expected, following actions are taken: a) Duplicate frames or frames within [0...current offset] are ignored b) New data from intersecting ranges (starts before current_offset, ends after) is consumed c) "Future" frames are stored in a sorted queue (min offset .. max offset) Once a frame is consumed, current offset is updated and the queue is inspected: we iterate the queue until the gap is found and act as described above for each frame. The amount of data in buffered frames is limited by corresponding macro. The CRYPTO and STREAM frame structures are now compatible: they share the same set of initial fields. This allows to have code that deals with both of this frames. The ordering layer now processes the frame with offset and invokes the handler when it can organise an ordered stream of data.
2020-04-13Cleaned up magic numbers in ngx_quic_output_frames().Vladimir Homutov1-8/+8
2020-04-14Rename types and variables used for packet number space.Vladimir Homutov1-67/+71
Quote: Conceptually, a packet number space is the context in which a packet can be processed and acknowledged. ngx_quic_namespace_t => ngx_quic_send_ctx_t qc->ns => qc->send_ctx ns->largest => send_ctx->largest_ack The ngx_quic_ns(level) macro now returns pointer, not just index: ngx_quic_get_send_ctx(c->quic, level) ngx_quic_retransmit_ns() => ngx_quic_retransmit() ngx_quic_output_ns() => ngx_quic_output_frames()
2020-04-14Merged with the default branch.Sergey Kandaurov5-45/+113
2020-04-13HTTP/3: fixed reading request body.Roman Arutyunyan1-1/+2
2020-04-08The new auth_delay directive for delaying unauthorized requests.Ruslan Ermilov2-1/+82
The request processing is delayed by a timer. Since nginx updates internal time once at the start of each event loop iteration, this normally ensures constant time delay, adding a mitigation from time-based attacks. A notable exception to this is the case when there are no additional events before the timer expires. To ensure constant-time processing in this case as well, we trigger an additional event loop iteration by posting a dummy event for the next event loop iteration.
2020-04-07Added basic offset support in client CRYPTO frames.Vladimir Homutov1-9/+19
The offset in client CRYPTO frames is tracked in c->quic->crypto_offset_in. This means that CRYPTO frames with non-zero offset are now accepted making possible to finish handshake with client certificates that exceed max packet size (if no reordering happens). The c->quic->crypto_offset field is renamed to crypto_offset_out to avoid confusion with tracking of incoming CRYPTO stream.
generated by cgit (git 2.34.1) at 2025-12-21 16:18:05 +0000