mirror/nginx
1
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2024-11-23 20:19:02 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

QUIC: split keys availability checks to read and write sides.

Browse Source 
Keys may be released by TLS stack in different times, so it makes sense
to check this independently as well.  This allows to fine-tune what key
direction is used when checking keys availability.

When discarding, server keys are now marked in addition to client keys.
This commit is contained in:
Sergey Kandaurov 2023-08-31 19:54:10 +04:00
parent c93cb45ae3
commit cd5f4cd8d3
4 changed files with 14 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/event/quic/ngx_event_quic.c
View File

@ -530,7 +530,7 @@ ngx_quic_close_connection(ngx_connection_t *c, ngx_int_t rc)
for (i = 0; i < NGX_QUIC_SEND_CTX_LAST; i++) {
ctx = &qc->send_ctx[i];
if (!ngx_quic_keys_available(qc->keys, ctx->level)) {
if (!ngx_quic_keys_available(qc->keys, ctx->level, 1)) {
continue;
}
@ -959,7 +959,7 @@ ngx_quic_handle_payload(ngx_connection_t *c, ngx_quic_header_t *pkt)
c->log->action = "decrypting packet";
if (!ngx_quic_keys_available(qc->keys, pkt->level)) {
if (!ngx_quic_keys_available(qc->keys, pkt->level, 0)) {
ngx_log_error(NGX_LOG_INFO, c->log, 0,
"quic no %s keys, ignoring packet",
ngx_quic_level_name(pkt->level));
@ -1082,7 +1082,9 @@ ngx_quic_discard_ctx(ngx_connection_t *c, enum ssl_encryption_level_t level)
qc = ngx_quic_get_connection(c);
if (!ngx_quic_keys_available(qc->keys, level)) {
if (!ngx_quic_keys_available(qc->keys, level, 0)
&& !ngx_quic_keys_available(qc->keys, level, 1))
{
return;
}

9
src/event/quic/ngx_event_quic_protection.c
View File

@ -672,9 +672,13 @@ ngx_quic_keys_set_encryption_secret(ngx_log_t *log, ngx_uint_t is_write,
ngx_uint_t
ngx_quic_keys_available(ngx_quic_keys_t *keys,
enum ssl_encryption_level_t level)
enum ssl_encryption_level_t level, ngx_uint_t is_write)
{
return keys->secrets[level].client.key.len != 0;
if (is_write == 0) {
return keys->secrets[level].client.key.len != 0;
}
return keys->secrets[level].server.key.len != 0;
}
@ -683,6 +687,7 @@ ngx_quic_keys_discard(ngx_quic_keys_t *keys,
enum ssl_encryption_level_t level)
{
keys->secrets[level].client.key.len = 0;
keys->secrets[level].server.key.len = 0;
}

2
src/event/quic/ngx_event_quic_protection.h
View File

@ -95,7 +95,7 @@ ngx_int_t ngx_quic_keys_set_encryption_secret(ngx_log_t *log,
enum ssl_encryption_level_t level, const SSL_CIPHER *cipher,
const uint8_t *secret, size_t secret_len);
ngx_uint_t ngx_quic_keys_available(ngx_quic_keys_t *keys,
enum ssl_encryption_level_t level);
enum ssl_encryption_level_t level, ngx_uint_t is_write);
void ngx_quic_keys_discard(ngx_quic_keys_t *keys,
enum ssl_encryption_level_t level);
void ngx_quic_keys_switch(ngx_connection_t *c, ngx_quic_keys_t *keys);

2
src/event/quic/ngx_event_quic_ssl.c
View File

@ -434,7 +434,7 @@ ngx_quic_crypto_input(ngx_connection_t *c, ngx_chain_t *data,
}
if (n <= 0 || SSL_in_init(ssl_conn)) {
if (ngx_quic_keys_available(qc->keys, ssl_encryption_early_data)
if (ngx_quic_keys_available(qc->keys, ssl_encryption_early_data, 0)
&& qc->client_tp_done)
{
if (ngx_quic_init_streams(c) != NGX_OK) {