mirror/nginx
1
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2024-11-23 20:19:02 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

QUIC: fixed anti-amplification with explicit send.

Browse Source 
Previously, when using ngx_quic_frame_sendto() to explicitly send a packet with
a single frame, anti-amplification limit was not properly enforced.  Even when
there was no quota left for the packet, it was sent anyway, but with no padding.
Now the packet is not sent at all.

This function is called to send PATH_CHALLENGE/PATH_RESPONSE, PMTUD and probe
packets.  For all these cases packet send is retried later in case the send was
not successful.
This commit is contained in:
Roman Arutyunyan 2023-11-22 14:52:21 +04:00
parent 0efe8db1d0
commit 6c78bb9bb1
2 changed files with 22 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/event/quic/ngx_event_quic_migration.c
View File

@ -872,6 +872,7 @@ ngx_quic_expire_path_mtu_discovery(ngx_connection_t *c, ngx_quic_path_t *path)
static ngx_int_t
ngx_quic_send_path_mtu_probe(ngx_connection_t *c, ngx_quic_path_t *path)
{
size_t mtu;
ngx_int_t rc;
ngx_uint_t log_error;
ngx_quic_frame_t frame;
@ -895,7 +896,12 @@ ngx_quic_send_path_mtu_probe(ngx_connection_t *c, ngx_quic_path_t *path)
log_error = c->log_error;
c->log_error = NGX_ERROR_IGNORE_EMSGSIZE;
mtu = path->mtu;
path->mtu = path->mtud;
rc = ngx_quic_frame_sendto(c, &frame, path->mtud, path);
path->mtu = mtu;
c->log_error = log_error;
if (rc == NGX_ERROR) {

24
src/event/quic/ngx_event_quic_output.c
View File

@ -1181,7 +1181,7 @@ ngx_int_t
ngx_quic_frame_sendto(ngx_connection_t *c, ngx_quic_frame_t *frame,
size_t min, ngx_quic_path_t *path)
{
size_t min_payload, pad;
size_t max, max_payload, min_payload, pad;
ssize_t len, sent;
ngx_str_t res;
ngx_quic_header_t pkt;
@ -1194,15 +1194,25 @@ ngx_quic_frame_sendto(ngx_connection_t *c, ngx_quic_frame_t *frame,
qc = ngx_quic_get_connection(c);
ctx = ngx_quic_get_send_ctx(qc, frame->level);
max = ngx_quic_path_limit(c, path, path->mtu);
ngx_log_debug3(NGX_LOG_DEBUG_EVENT, c->log, 0,
"quic sendto %s packet max:%uz min:%uz",
ngx_quic_level_name(ctx->level), max, min);
ngx_quic_init_packet(c, ctx, &pkt, path);
min = ngx_quic_path_limit(c, path, min);
min_payload = min ? ngx_quic_payload_size(&pkt, min) : 0;
min_payload = ngx_quic_payload_size(&pkt, min);
max_payload = ngx_quic_payload_size(&pkt, max);
/* RFC 9001, 5.4.2. Header Protection Sample */
pad = 4 - pkt.num_len;
min_payload = ngx_max(min_payload, pad);
if (min_payload > max_payload) {
return NGX_AGAIN;
}
#if (NGX_DEBUG)
frame->pnum = pkt.number;
#endif
@ -1210,8 +1220,8 @@ ngx_quic_frame_sendto(ngx_connection_t *c, ngx_quic_frame_t *frame,
ngx_quic_log_frame(c->log, frame, 1);
len = ngx_quic_create_frame(NULL, frame);
if (len > NGX_QUIC_MAX_UDP_PAYLOAD_SIZE) {
return NGX_ERROR;
if ((size_t) len > max_payload) {
return NGX_AGAIN;
}
len = ngx_quic_create_frame(src, frame);
@ -1258,8 +1268,6 @@ ngx_quic_path_limit(ngx_connection_t *c, ngx_quic_path_t *path, size_t size)
max = (path->sent >= max) ? 0 : max - path->sent;
if ((off_t) size > max) {
ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
"quic path limit %uz - %O", size, max);
return max;
}
}