Commit Graph

7419 Commits

Author SHA1 Message Date
Vladimir Homutov
a1473ce8b0 QUIC: added push event afer the address was validated.
This allows to continue processing when the anti-amplification limit was hit.
2020-10-27 00:00:56 +03:00
Vladimir Homutov
ddd665ca66 QUIC: updated anti-amplification check for draft 32.
This accounts for the following change:

   *  Require expansion of datagrams to ensure that a path supports at
      least 1200 bytes:

      -  During the handshake ack-eliciting Initial packets from the
         server need to be expanded
2020-10-26 23:58:34 +03:00
Vladimir Homutov
7ba467944d QUIC: got rid of "pkt" abbreviation in logs. 2020-10-26 23:47:49 +03:00
Vladimir Homutov
37b7360893 QUIC: added "rx" and "tx" prefixes to packet debug. 2020-10-26 23:47:16 +03:00
Vladimir Homutov
d35db4b3eb QUIC: added connection state debug to event handlers. 2020-10-26 23:17:54 +03:00
Vladimir Homutov
1d9e9a1a29 QUIC: added logging of a declined packet without retry token. 2020-10-26 00:34:24 +03:00
Vladimir Homutov
0946f8c3ca QUIC: revised value separators in debug and error messages.
All values are prefixed with name and separated from it using colon.
Multiple values are listed without commas in between.

Rationale: this greatly simplifies log parsing for analysis.
2020-10-27 14:12:31 +03:00
Vladimir Homutov
528e5bd1fb QUIC: single function for frame debug logging.
The function may be called for any initialized frame, both rx and tx.

While there, shortened level names.
2020-10-27 14:32:08 +03:00
Vladimir Homutov
83d7a949e8 QUIC: optimized acknowledgement generation.
For application level packets, only every second packet is now acknowledged,
respecting max ack delay.

13.2.1 Sending ACK Frames

   In order to assist loss detection at the sender, an endpoint SHOULD
   generate and send an ACK frame without delay when it receives an ack-
   eliciting packet either:

   *  when the received packet has a packet number less than another
      ack-eliciting packet that has been received, or

   *  when the packet has a packet number larger than the highest-
      numbered ack-eliciting packet that has been received and there are
      missing packets between that packet and this packet.


13.2.2.  Acknowledgement Frequency

    A receiver SHOULD send an ACK frame after receiving at least two
    ack-eliciting packets.
2020-10-23 17:08:50 +03:00
Vladimir Homutov
b92e596918 QUIC: added missing "quic" prefix in debug messages. 2020-10-23 18:22:01 +03:00
Maxim Dounin
9cdb278454 SSL: ssl_reject_handshake directive (ticket #195).
In some cases it might be needed to reject SSL handshake based on SNI
server name provided, for example, to make sure an invalid certificate
is not returned to clients trying to contact a name-based virtual server
without SSL configured.  Previously, a "ssl_ciphers aNULL;" was used for
this.  This workaround, however, is not compatible with TLSv1.3, in
particular, when using BoringSSL, where it is not possible to configure
TLSv1.3 ciphers at all.

With this change, the ssl_reject_handshake directive is introduced,
which instructs nginx to reject SSL handshakes with an "unrecognized_name"
alert in a particular server block.

For example, to reject handshake with names other than example.com,
one can use the following configuration:

    server {
        listen 443 ssl;
        ssl_reject_handshake on;
    }

    server {
        listen 443 ssl;
        server_name example.com;
        ssl_certificate example.com.crt;
        ssl_certificate_key example.com.key;
    }

The following configuration can be used to reject all SSL handshakes
without SNI server name provided:

    server {
        listen 443 ssl;
        ssl_reject_handshake on;
    }

    server {
        listen 443 ssl;
        server_name ~^;
        ssl_certificate example.crt;
        ssl_certificate_key example.key;
    }

Additionally, the ssl_reject_handshake directive makes configuring
certificates for the default server block optional.  If no certificates
are configured in the default server for a given listening socket,
certificates must be defined in all non-default server blocks with
the listening socket in question.
2020-10-22 18:02:28 +03:00
Maxim Dounin
f9a37243c9 Stream: proxy_ssl_conf_command directive.
Similarly to ssl_conf_command, proxy_ssl_conf_command can be used to
set arbitrary OpenSSL configuration parameters as long as nginx is
compiled with OpenSSL 1.0.2 or later, when connecting to upstream
servers with SSL.  Full list of available configuration commands
can be found in the SSL_CONF_cmd manual page
(https://www.openssl.org/docs/man1.1.1/man3/SSL_CONF_cmd.html).
2020-10-22 18:00:27 +03:00
Maxim Dounin
9a72ac799c Upstream: proxy_ssl_conf_command and friends.
Similarly to ssl_conf_command, proxy_ssl_conf_command (grpc_ssl_conf_command,
uwsgi_ssl_conf_command) can be used to set arbitrary OpenSSL configuration
parameters as long as nginx is compiled with OpenSSL 1.0.2 or later,
when connecting to upstream servers with SSL.  Full list of available
configuration commands can be found in the SSL_CONF_cmd manual page
(https://www.openssl.org/docs/man1.1.1/man3/SSL_CONF_cmd.html).
2020-10-22 18:00:23 +03:00
Maxim Dounin
ac9c162282 SSL: ssl_conf_command directive.
With the ssl_conf_command directive it is now possible to set
arbitrary OpenSSL configuration parameters as long as nginx is compiled
with OpenSSL 1.0.2 or later.  Full list of available configuration
commands can be found in the SSL_CONF_cmd manual page
(https://www.openssl.org/docs/man1.1.1/man3/SSL_CONF_cmd.html).

In particular, this allows configuring PrioritizeChaCha option
(ticket #1445):

    ssl_conf_command Options PrioritizeChaCha;

It can be also used to configure TLSv1.3 ciphers in OpenSSL,
which fails to configure them via the SSL_CTX_set_cipher_list()
interface (ticket #1529):

    ssl_conf_command Ciphersuites TLS_CHACHA20_POLY1305_SHA256;

Configuration commands are applied after nginx own configuration
for SSL, so they can be used to override anything set by nginx.
Note though that configuring OpenSSL directly with ssl_conf_command
might result in a behaviour nginx does not expect, and should be
done with care.
2020-10-22 18:00:22 +03:00
Maxim Dounin
af05f05f91 Core: ngx_conf_set_keyval_slot() now accepts NGX_CONF_UNSET_PTR.
With this change, it is now possible to use ngx_conf_merge_ptr_value()
to merge keyval arrays.  This change actually follows much earlier
changes in ngx_conf_merge_ptr_value() and ngx_conf_set_str_array_slot()
in 1452:cd586e963db0 (0.6.10) and 1701:40d004d95d88 (0.6.22).

To preserve compatibility with existing 3rd party modules, both NULL
and NGX_CONF_UNSET_PTR are accepted for now.
2020-10-22 18:00:20 +03:00
Sergey Kandaurov
8e1ec8a5c2 QUIC: updated README.
- ACK ranges are implemented
 - up to draft-32 is now supported
 - removed mentions of early alpha quality and further cleanup
2020-10-22 12:55:15 +01:00
Sergey Kandaurov
fec3d792c9 QUIC: restored proper usage of ngx_quic_drop_ack_ranges().
ACK Ranges are again managed based on the remembered Largest Acknowledged
sent in the packet being acknowledged, which partially reverts c01964fd7b8b.
2020-10-22 11:05:50 +01:00
Vladimir Homutov
ff26faaf77 QUIC: fixed dropping output ack ranges on input ack.
While there, additional debug messages were added.
2020-10-21 20:39:25 +03:00
Vladimir Homutov
1506c7b825 QUIC: added macro for unset packet number. 2020-10-21 18:44:25 +03:00
Vladimir Homutov
cb3a1d7f49 QUIC: drop acknowledged ranges.
13.2.4.  Limiting Ranges by Tracking ACK Frames

   When a packet containing an ACK frame is sent, the largest
   acknowledged in that frame may be saved.  When a packet containing an
   ACK frame is acknowledged, the receiver can stop acknowledging
   packets less than or equal to the largest acknowledged in the sent
   ACK frame.
2020-10-20 18:53:25 +03:00
Vladimir Homutov
6e412bf182 QUIC: added ACK frame range support.
The history of acknowledged packet is kept in send context as ranges.
Up to NGX_QUIC_MAX_RANGES ranges is stored.

As a result, instead of separate ack frames, single frame with ranges
is sent.
2020-10-20 18:53:00 +03:00
Sergey Kandaurov
74f6c92529 QUIC: expand UDP datagrams with an ack-eliciting Initial packet.
Per draft-ietf-quic-transport-32 on the topic:

:   Similarly, a server MUST expand the payload of all UDP datagrams carrying
:   ack-eliciting Initial packets to at least the smallest allowed maximum
:   datagram size of 1200 bytes.
2020-10-21 12:46:23 +01:00
Sergey Kandaurov
e1982a1aba QUIC: teach how to compute only the length of created QUIC headers.
It will be used for precise expansion of UDP datagram payload.
2020-10-21 12:03:23 +01:00
Sergey Kandaurov
fe2c392551 QUIC: simplified ngx_quic_create_long_header().
As seen in the quic-transport draft, which this implementation follows:
Initial packets sent by the server MUST set the Token Length field to zero.
2020-10-21 12:03:22 +01:00
Sergey Kandaurov
a47a4400b8 QUIC: avoided excessive initialization in ngx_quic_send_frames().
A zero-length token was used to initialize a prezeroed packet header.
2020-10-21 12:03:22 +01:00
Sergey Kandaurov
c405a364eb QUIC: sorted ngx_quic_send_frames() declarations. 2020-10-21 12:03:21 +01:00
Vladimir Homutov
d54fd4ed34 QUIC: account packet header length in amplification limit.
This is the restoration of 02ee77f8d53d accidentally reverted by 93be5658a250.
2020-10-19 12:19:38 +03:00
Vladimir Homutov
743cc99781 QUIC: reverted previous 3 commits.
Changes were intended for the test repository.
2020-10-19 10:32:53 +03:00
Vladimir Homutov
2d65615b42 try: --skiptests 2020-10-19 10:10:21 +03:00
Vladimir Homutov
622a65edea QUIC: added ACK frame range support.
The history of acknowledged packet is kept in send context as ranges.
Up to NGX_QUIC_MAX_RANGES ranges is stored.

As a result, instead of separate ack frames, single frame with ranges
is sent.
2020-10-14 23:21:36 +03:00
Ruslan Ermilov
2ba670a925 Cpp test: added stream. 2020-10-13 07:44:09 +03:00
Maxim Dounin
9381ecb185 Limit req: unlocking of nodes on complex value errors.
Previously, if there were multiple limits configured, errors in
ngx_http_complex_value() during processing of a non-first limit
resulted in reference count leak in shared memory nodes of already
processed limits.  Fix is to explicity unlock relevant nodes, much
like we do when rejecting requests.
2020-10-08 17:44:34 +03:00
Maxim Dounin
1e92a0a4ce Mail: proxy_smtp_auth directive.
The proxy_smtp_auth directive instructs nginx to authenticate users
on backend via the AUTH command (using the PLAIN SASL mechanism),
similar to what is normally done for IMAP and POP3.

If xclient is enabled along with proxy_smtp_auth, the XCLIENT command
won't try to send the LOGIN parameter.
2020-10-03 21:04:57 +03:00
Maxim Dounin
8523ef8e86 Version bump. 2020-10-03 21:01:12 +03:00
Maxim Dounin
135b707ab0 release-1.19.3 tag 2020-09-29 17:32:10 +03:00
Maxim Dounin
3e299b1576 nginx-1.19.3-RELEASE 2020-09-29 17:32:10 +03:00
Maxim Dounin
249e126beb Updated OpenSSL used for win32 builds. 2020-09-29 15:56:16 +03:00
Maxim Dounin
e64f7fe7c9 Proxy: error checking for array init, missed in 7716:d6a5e14aa3e4.
Found by Coverity (CID 1467637).
2020-09-29 15:54:09 +03:00
Maxim Dounin
718d589091 Userid: userid_flags fixup.
In 7717:e3e8b8234f05, the 1st bit was incorrectly used.  It shouldn't
be used for bitmask values, as it is used by NGX_CONF_BITMASK_SET.

Additionally, special value "off" added to make it possible to clear
inherited userid_flags value.
2020-09-29 15:52:18 +03:00
Maxim Dounin
279efaab66 Resolver: improved error messages (ticket #2024). 2020-09-28 17:41:22 +03:00
Maxim Dounin
c511f3de3e Userid: userid_flags directive to set cookie flags. 2020-09-28 17:07:48 +03:00
Ruslan Ermilov
21b903f8e3 Proxy: added the "proxy_cookie_flags" directive. 2020-09-27 23:21:11 +03:00
Ruslan Ermilov
8b3f778cbc Proxy: changed interface of some internal functions.
This is in preparation for the next change.

Also, moved optimization from ngx_http_proxy_rewrite_regex_handler()
to ngx_http_proxy_rewrite().
2020-09-27 23:21:10 +03:00
Ruslan Ermilov
b2b8f226f1 Proxy: strengthen syntax checking for some directives.
The "false" parameter of the proxy_redirect directive is deprecated.
Warning has been emitted since c2230102df6f (0.7.54).

The "off" parameter of the proxy_redirect, proxy_cookie_domain, and
proxy_cookie_path directives tells nginx not to inherit the
configuration from the previous configuration level.

Previously, after specifying the directive with the "off" parameter,
any other directives were ignored, and syntax checking was disabled.

The syntax was enforced to allow either one directive with the "off"
parameter, or several directives with other parameters.

Also, specifying "proxy_redirect default foo" no longer works like
"proxy_redirect default".
2020-09-27 23:21:09 +03:00
Vladimir Homutov
e8277e4224 SSL: added the "ssl_keys_file" directive. 2020-09-15 22:44:46 +03:00
Vladimir Homutov
26102d7ad7 QUIC: account packet header length in amplification limit.
Header length calculation is adjusted to account real connection id lengths
instead of worst case.
2020-10-15 11:37:01 +03:00
Sergey Kandaurov
72b566cea5 QUIC: fixed ngx_http_upstream_init() much like HTTP/2 connections. 2020-10-12 14:00:00 +01:00
Vladimir Homutov
bb64f2017a QUIC: reset error and error_reason prior to processing packet. 2020-10-09 16:57:19 +03:00
Sergey Kandaurov
c245c9ea20 QUIC: fixed dead store assignment.
Found by Clang Static Analyzer.
2020-10-07 14:51:05 +01:00
Vladimir Homutov
017e3bd8a8 QUIC: fixed format specifier in debug message. 2020-10-07 15:29:23 +03:00