Commit Graph

7795 Commits

Author SHA1 Message Date
Sergey Kandaurov
a47a4400b8 QUIC: avoided excessive initialization in ngx_quic_send_frames().
A zero-length token was used to initialize a prezeroed packet header.
2020-10-21 12:03:22 +01:00
Sergey Kandaurov
c405a364eb QUIC: sorted ngx_quic_send_frames() declarations. 2020-10-21 12:03:21 +01:00
Vladimir Homutov
d54fd4ed34 QUIC: account packet header length in amplification limit.
This is the restoration of 02ee77f8d53d accidentally reverted by 93be5658a250.
2020-10-19 12:19:38 +03:00
Vladimir Homutov
743cc99781 QUIC: reverted previous 3 commits.
Changes were intended for the test repository.
2020-10-19 10:32:53 +03:00
Vladimir Homutov
2d65615b42 try: --skiptests 2020-10-19 10:10:21 +03:00
Vladimir Homutov
622a65edea QUIC: added ACK frame range support.
The history of acknowledged packet is kept in send context as ranges.
Up to NGX_QUIC_MAX_RANGES ranges is stored.

As a result, instead of separate ack frames, single frame with ranges
is sent.
2020-10-14 23:21:36 +03:00
Ruslan Ermilov
2ba670a925 Cpp test: added stream. 2020-10-13 07:44:09 +03:00
Maxim Dounin
9381ecb185 Limit req: unlocking of nodes on complex value errors.
Previously, if there were multiple limits configured, errors in
ngx_http_complex_value() during processing of a non-first limit
resulted in reference count leak in shared memory nodes of already
processed limits.  Fix is to explicity unlock relevant nodes, much
like we do when rejecting requests.
2020-10-08 17:44:34 +03:00
Maxim Dounin
1e92a0a4ce Mail: proxy_smtp_auth directive.
The proxy_smtp_auth directive instructs nginx to authenticate users
on backend via the AUTH command (using the PLAIN SASL mechanism),
similar to what is normally done for IMAP and POP3.

If xclient is enabled along with proxy_smtp_auth, the XCLIENT command
won't try to send the LOGIN parameter.
2020-10-03 21:04:57 +03:00
Maxim Dounin
8523ef8e86 Version bump. 2020-10-03 21:01:12 +03:00
Maxim Dounin
135b707ab0 release-1.19.3 tag 2020-09-29 17:32:10 +03:00
Maxim Dounin
3e299b1576 nginx-1.19.3-RELEASE 2020-09-29 17:32:10 +03:00
Maxim Dounin
249e126beb Updated OpenSSL used for win32 builds. 2020-09-29 15:56:16 +03:00
Maxim Dounin
e64f7fe7c9 Proxy: error checking for array init, missed in 7716:d6a5e14aa3e4.
Found by Coverity (CID 1467637).
2020-09-29 15:54:09 +03:00
Maxim Dounin
718d589091 Userid: userid_flags fixup.
In 7717:e3e8b8234f05, the 1st bit was incorrectly used.  It shouldn't
be used for bitmask values, as it is used by NGX_CONF_BITMASK_SET.

Additionally, special value "off" added to make it possible to clear
inherited userid_flags value.
2020-09-29 15:52:18 +03:00
Maxim Dounin
279efaab66 Resolver: improved error messages (ticket #2024). 2020-09-28 17:41:22 +03:00
Maxim Dounin
c511f3de3e Userid: userid_flags directive to set cookie flags. 2020-09-28 17:07:48 +03:00
Ruslan Ermilov
21b903f8e3 Proxy: added the "proxy_cookie_flags" directive. 2020-09-27 23:21:11 +03:00
Ruslan Ermilov
8b3f778cbc Proxy: changed interface of some internal functions.
This is in preparation for the next change.

Also, moved optimization from ngx_http_proxy_rewrite_regex_handler()
to ngx_http_proxy_rewrite().
2020-09-27 23:21:10 +03:00
Ruslan Ermilov
b2b8f226f1 Proxy: strengthen syntax checking for some directives.
The "false" parameter of the proxy_redirect directive is deprecated.
Warning has been emitted since c2230102df6f (0.7.54).

The "off" parameter of the proxy_redirect, proxy_cookie_domain, and
proxy_cookie_path directives tells nginx not to inherit the
configuration from the previous configuration level.

Previously, after specifying the directive with the "off" parameter,
any other directives were ignored, and syntax checking was disabled.

The syntax was enforced to allow either one directive with the "off"
parameter, or several directives with other parameters.

Also, specifying "proxy_redirect default foo" no longer works like
"proxy_redirect default".
2020-09-27 23:21:09 +03:00
Vladimir Homutov
e8277e4224 SSL: added the "ssl_keys_file" directive. 2020-09-15 22:44:46 +03:00
Vladimir Homutov
26102d7ad7 QUIC: account packet header length in amplification limit.
Header length calculation is adjusted to account real connection id lengths
instead of worst case.
2020-10-15 11:37:01 +03:00
Sergey Kandaurov
72b566cea5 QUIC: fixed ngx_http_upstream_init() much like HTTP/2 connections. 2020-10-12 14:00:00 +01:00
Vladimir Homutov
bb64f2017a QUIC: reset error and error_reason prior to processing packet. 2020-10-09 16:57:19 +03:00
Sergey Kandaurov
c245c9ea20 QUIC: fixed dead store assignment.
Found by Clang Static Analyzer.
2020-10-07 14:51:05 +01:00
Vladimir Homutov
017e3bd8a8 QUIC: fixed format specifier in debug message. 2020-10-07 15:29:23 +03:00
Vladimir Homutov
5a07601a3c QUIC: added debug message with final packet processing status. 2020-10-02 16:20:41 +03:00
Roman Arutyunyan
783df73ba0 QUIC: set local_socklen in stream connections.
Previously, this field was not set while creating a QUIC stream connection.
As a result, calling ngx_connection_local_sockaddr() led to getsockname()
bad descriptor error.
2020-10-07 12:24:03 +01:00
Vladimir Homutov
d600364887 QUIC: enabled more key-related debug by default. 2020-10-02 12:40:49 +03:00
Vladimir Homutov
9f583efe3d QUIC: added connection id debug. 2020-10-02 12:56:34 +03:00
Vladimir Homutov
7369bdc47c QUIC: updated c->log->action strings to reflect proper state. 2020-10-07 13:38:17 +03:00
Vladimir Homutov
7250a7688d QUIC: fixed memory leak in ngx_quic_send_frames().
The function did not free passed frames in case of error.
2020-10-07 10:14:02 +03:00
Sergey Kandaurov
46a01acdc0 QUIC: fixed measuring ACK Delay against 0-RTT packets. 2020-10-06 18:08:55 +01:00
Sergey Kandaurov
f09be89a52 QUIC: do not resend empty queue when speeding up handshake.
If client acknowledged an Initial packet with CRYPTO frame and then
sent another Initial packet containing duplicate CRYPTO again, this
could result in resending frames off the empty send queue.
2020-10-05 13:02:53 +01:00
Sergey Kandaurov
3309b1e8df QUIC: zero out packet length in frames prior to send.
It could be that a frame was previously sent and may have stale information.
This was previously broken by merging frames on resend in b383120afca3.
2020-10-05 13:02:38 +01:00
Vladimir Homutov
4ed768d3d1 QUIC: fixed build with clang and NGX_QUIC_DEBUG_CRYPTO enabled.
The ngx_quic_hexdump() function is wrapped into macros to cast "data"
argument to "* u_char".
2020-10-05 14:36:17 +03:00
Vladimir Homutov
b99a4a0b82 QUIC: inline function instead of macro for hexdump.
This prevents name clashes with local variables.
2020-10-05 10:03:01 +03:00
Vladimir Homutov
a06a3f6aba QUIC: fixed handling of incorrect packets.
Instead of ignoring, connection was closed. This was broken in d0d3fc0697a0.
2020-10-01 22:20:51 +03:00
Sergey Kandaurov
88cb4d3ab0 Merged with the default branch. 2020-10-01 12:21:11 +01:00
Sergey Kandaurov
ee4a6024cc QUIC: a bandaid for calculating ack_delay with non-monotonic time. 2020-10-01 12:10:37 +01:00
Sergey Kandaurov
7bd3868715 QUIC: speeding up handshake completion.
As per quic-recovery draft, section-6.2.3: resend CRYPTO frames
when receiving an Initial packet containing duplicate CRYPTO data.
2020-10-01 12:10:22 +01:00
Sergey Kandaurov
b64446f6f9 QUIC: fixed clang-ast asserts. 2020-10-01 12:09:47 +01:00
Sergey Kandaurov
154536a64f QUIC: fixed build with OpenSSL after bed310672f39. 2020-10-01 12:00:12 +01:00
Vladimir Homutov
0f843cfb74 QUIC: moved ssl configuration pointer to quic configuration.
The ssl configuration is obtained at config time and saved for future use.
2020-10-01 10:04:35 +03:00
Vladimir Homutov
f797a8a5b5 QUIC: added stateless reset support.
The new "quic_stateless_reset_token_key" directive is added.  It sets the
endpoint key used to generate stateless reset tokens and enables feature.

If the endpoint receives short-header packet that can't be matched to
existing  connection, a stateless reset packet is generated with
a proper token.

If a valid stateless reset token is found in the incoming packet,
the connection is closed.

Example configuration:

http {
    quic_stateless_reset_token_key  "foo";
    ...
}
2020-09-30 20:54:46 +03:00
Vladimir Homutov
2c3ada5722 QUIC: refined the "c->quic->initialized" flag usage.
The flag is tied to the initial secret creation.  The presence of c->quic
pointer is sufficient to enable execution of ngx_quic_close_quic().

The ngx_quic_new_connection() function now returns the allocated quic
connection object and the c->quic pointer is set by the caller.

If an early error occurs before secrets initialization (i.e. in cases
of invalid retry token or nginx exiting), it is still possible to
generate an error response by trying to initialize secrets directly
in the ngx_quic_send_cc() function.

Before the change such early errors failed to send proper connection close
message and logged an error.

An auxilliary ngx_quic_init_secrets() function is introduced to avoid
verbose call to ngx_quic_set_initial_secret() requiring local variable.
2020-09-30 21:27:52 +03:00
Vladimir Homutov
99d4f2399d QUIC: packet processing refactoring.
All packet header parsing is now performed by ngx_quic_parse_packet()
function, located in the ngx_quic_transport.c file.

The packet processing is centralized in the ngx_quic_process_packet()
function which decides if the packet should be accepted, ignored or
connection should be closed, depending on the connection state.

As a result of refactoring, behavior has changed in some places:

 - minimal size of Initial packet is now always tested
 - connection IDs are always tested in existing connections
 - old keys are discarded on encryption level switch
2020-09-30 15:14:09 +03:00
Vladimir Homutov
fe626bda84 QUIC: simplified packet header parsing.
Now flags are processed in ngx_quic_input(), and raw->pos points to the first
byte after the flags. Redundant checks from ngx_quic_parse_short_header() and
ngx_quic_parse_long_header() are removed.
2020-09-25 21:47:28 +03:00
Roman Arutyunyan
80958b29a2 QUIC: keep the entire packet size in pkt->len.
Previously pkt->len kept the length of the packet remainder starting from
pkt->raw->pos.
2020-09-25 21:46:55 +03:00
Vladimir Homutov
6c0be4b4cf QUIC: switched to using fixed-length server connection IDs. 2020-09-18 15:53:37 +03:00