Commit Graph

7806 Commits

Author SHA1 Message Date
Sergey Kandaurov
dd98809bef Merged with the default branch. 2021-03-30 23:34:51 +03:00
Roman Arutyunyan
7d1cf8ffb4 HTTP/3: fixed $connection_requests.
Previously, the value was always "1".
2021-03-15 16:25:54 +03:00
Roman Arutyunyan
25a74b52d1 HTTP/3: set initial_max_streams_uni default value to 3.
The maximum number of HTTP/3 unidirectional client streams we can handle is 3:
control, decode and encode.  These streams are never closed.
2021-03-22 15:51:14 +03:00
Roman Arutyunyan
f4ab680bcb HTTP/3: keepalive timeout.
This timeout limits the time when no client request streams exist.
2021-03-30 16:48:38 +03:00
Roman Arutyunyan
9533df5b72 QUIC: connection shutdown.
The function ngx_quic_shutdown_connection() waits until all non-cancelable
streams are closed, and then closes the connection.  In HTTP/3 cancelable
streams are all unidirectional streams except push streams.

The function is called from HTTP/3 when client reaches keepalive_requests.
2021-03-15 16:39:33 +03:00
Roman Arutyunyan
190b5d961c HTTP/3: send GOAWAY when last request is accepted.
The last request in connection is determined according to the keepalive_requests
directive.  Requests beyond keepalive_requests are rejected.
2021-03-15 19:26:04 +03:00
Vladimir Homutov
d8fd0b3161 Core: fixed build with BPF on non-64bit platforms (ticket #2152). 2021-03-23 10:58:18 +03:00
Vladimir Homutov
19c461a522 QUIC: bpf code regenerated. 2021-03-16 18:17:25 +03:00
Vladimir Homutov
bb44bfa631 QUIC: fixed key extraction in bpf.
In case of long header packets, dcid length was not read correctly.

While there, macros to parse uint64 was fixed as well as format specifiers
to print it in debug mode.

Thanks to Gao Yan <gaoyan09@baidu.com>.
2021-03-15 19:05:38 +03:00
Sergey Kandaurov
e522bb69f9 HTTP/3: do not push until a MAX_PUSH_ID frame is received.
Fixes interop with quic-go that doesn't send MAX_PUSH_ID.
2021-03-16 13:48:29 +03:00
Sergey Kandaurov
780de6de44 QUIC: fixed hq ALPN id for the final draft.
It was an agreement to use "hq-interop"[1] for interoperability testing.

[1] https://github.com/quicwg/base-drafts/wiki/ALPN-IDs-used-with-QUIC
2021-03-16 13:48:28 +03:00
Sergey Kandaurov
6a0bea5361 QUIC: fixed expected TLS codepoint with final draft and BoringSSL.
A reasonable codepoint is always set[1] explicitly so that it doesn't
depend on the default library value that may change[2] in the future.

[1] https://boringssl.googlesource.com/boringssl/+/3d8b8c3d
[2] https://boringssl.googlesource.com/boringssl/+/c47bfce0
2021-03-16 13:48:28 +03:00
Vladimir Homutov
b8fd5dc640 QUIC: added error handling to ngx_hkdf_extract()/ngx_hkdf_expand().
The OpenSSL variant of functions lacked proper error processing.
2021-03-11 14:43:01 +03:00
Ruslan Ermilov
02cca54770 Removed "ch" argument from ngx_pass_open_channel(). 2021-03-11 09:58:45 +03:00
Maxim Dounin
3bbec30739 Mail: fixed build without SSL.
Broken by d84f13618277 and 12ea1de7d87c (1.19.8).

Reported by Sergey Osokin.
2021-03-11 04:46:26 +03:00
Maxim Dounin
6b06660e07 Version bump. 2021-03-11 04:46:22 +03:00
Sergey Kandaurov
7f348b2d1f HTTP/3: fixed server push. 2021-03-10 17:56:34 +03:00
Sergey Kandaurov
02b52e4c0b Merged with the default branch. 2021-03-10 15:39:01 +03:00
Maxim Dounin
0026dded46 release-1.19.8 tag 2021-03-09 18:27:51 +03:00
Maxim Dounin
1b8771ddcb nginx-1.19.8-RELEASE 2021-03-09 18:27:50 +03:00
Maxim Dounin
d6f18d9529 Updated OpenSSL used for win32 builds. 2021-03-09 16:38:55 +03:00
Sergey Kandaurov
b7433b15fc README: http3_max_field_size was removed in ae2e68f206f9. 2021-03-07 00:23:25 +03:00
Sergey Kandaurov
449ce52f97 README: bump browsers' version after 81bb3a690c10 (old drafts rip). 2021-03-07 00:23:23 +03:00
Maxim Dounin
6538d93067 Mail: sending of the PROXY protocol to backends.
Activated with the "proxy_protocol" directive.  Can be combined with
"listen ... proxy_protocol;" and "set_real_ip_from ...;" to pass
client address provided to nginx in the PROXY protocol header.
2021-03-05 17:16:32 +03:00
Maxim Dounin
c2e22bcf32 Mail: realip module.
When configured with the "set_real_ip_from", it can set client's IP
address as visible in logs to the one obtained via the PROXY protocol.
2021-03-05 17:16:29 +03:00
Maxim Dounin
1fce224f01 Mail: parsing of the PROXY protocol from clients.
Activated with the "proxy_protocol" parameter of the "listen" directive.
Obtained information is passed to the auth_http script in Proxy-Protocol-Addr,
Proxy-Protocol-Port, Proxy-Protocol-Server-Addr, and Proxy-Protocol-Server-Port
headers.
2021-03-05 17:16:24 +03:00
Maxim Dounin
72dcd5141b Mail: made auth http creating request easier to extend. 2021-03-05 17:16:23 +03:00
Maxim Dounin
83de0868b1 Mail: fixed log action after SSL handshake. 2021-03-05 17:16:20 +03:00
Maxim Dounin
7d4cd6cff4 Mail: postponed session initialization under accept mutex.
Similarly to 40e8ce405859 in the stream module, this reduces the time
accept mutex is held.  This also simplifies following changes to
introduce PROXY protocol support.
2021-03-05 17:16:19 +03:00
Maxim Dounin
065a1641b2 Mail: added missing event handling after reading data.
If we need to be notified about further events, ngx_handle_read_event()
needs to be called after a read event is processed.  Without this,
an event can be removed from the kernel and won't be reported again,
notably when using oneshot event methods, such as eventport on Solaris.

For consistency, existing ngx_handle_read_event() call removed from
ngx_mail_read_command(), as this call only covers one of the code paths
where ngx_mail_read_command() returns NGX_AGAIN.  Instead, appropriate
processing added to the callers, covering all code paths where NGX_AGAIN
is returned.
2021-03-05 17:16:17 +03:00
Maxim Dounin
8ed63c936c Mail: added missing event handling after blocking events.
As long as a read event is blocked (ignored), ngx_handle_read_event()
needs to be called to make sure no further notifications will be
triggered when using level-triggered event methods, such as select() or
poll().
2021-03-05 17:16:16 +03:00
Maxim Dounin
d5a31fdad5 Events: fixed eventport handling in ngx_handle_read_event().
The "!rev->ready" test seems to be a typo, introduced in the original
commit (719:f30b1a75fd3b).  The ngx_handle_write_event() code properly
tests for "rev->ready" instead.

Due to this typo, read events might be unexpectedly removed during
proxying after an event on the other part of the proxied connection.
Catched by mail proxying tests.
2021-03-05 17:16:15 +03:00
Maxim Dounin
797ac536fe SSL: fixed build by Sun C with old OpenSSL versions.
Sun C complains about "statement not reached" if a "return" is followed
by additional statements.
2021-03-05 17:16:13 +03:00
Ruslan Ermilov
a38a8438b8 Proxy: variables support in "proxy_cookie_flags" flags. 2021-03-02 00:58:24 +03:00
Maxim Dounin
4c5a49ce4c Introduced strerrordesc_np() support.
The strerrordesc_np() function, introduced in glibc 2.32, provides an
async-signal-safe way to obtain error messages.  This makes it possible
to avoid copying error messages.
2021-03-01 20:00:45 +03:00
Maxim Dounin
71eb19da43 Improved maximum errno detection.
Previously, systems without sys_nerr (or _sys_nerr) were handled with an
assumption that errors start at 0 and continuous.  This is, however, not
something POSIX requires, and not true on some platforms.

Notably, on Linux, where sys_nerr is no longer available for newly linked
binaries starting with glibc 2.32, there are gaps in error list, which
used to stop us from properly detecting maximum errno.  Further, on
GNU/Hurd errors start at 0x40000001.

With this change, maximum errno detection is moved to the runtime code,
now able to ignore gaps, and also detects the first error if needed.
This fixes observed "Unknown error" messages as seen on Linux with
glibc 2.32 and on GNU/Hurd.
2021-03-01 20:00:43 +03:00
Maxim Dounin
0f5d0c5798 HTTP/2: client_header_timeout before first request (ticket #2142).
With this change, behaviour of HTTP/2 becomes even closer to HTTP/1.x,
and client_header_timeout instead of keepalive_timeout is used before
the first request is received.

This fixes HTTP/2 connections being closed even before the first request
if "keepalive_timeout 0;" was used in the configuration; the problem
appeared in f790816a0e87 (1.19.7).
2021-03-01 17:31:28 +03:00
Maxim Dounin
a74961f552 Contrib: vim syntax, default highlighting (ticket #2141).
Using default highlighting makes it possible to easily overrule
highlighting specified in the syntax file, see ":highlight-default"
in vim help for details.
2021-02-25 23:42:25 +03:00
Maxim Dounin
ef44627852 SSL: added check for debugging.
If debugging is not enabled, there is no need to do extra work in
ngx_ssl_verify_callback() and ngx_ssl_handshake_log().
2021-02-20 18:03:04 +03:00
Maxim Dounin
7ae100407c SSL: added missed error reporting during variables evaluation. 2021-02-20 18:02:54 +03:00
Maxim Dounin
60a8ed26f3 SSL: X509_NAME_oneline() error handling. 2021-02-20 18:02:49 +03:00
Ruslan Ermilov
1bb89914d7 Configure: marked top-level make targets as phony.
Reported by Thibault Nélis.
2021-02-20 12:44:26 +03:00
Ruslan Ermilov
fbcc09e17f Version bump. 2021-02-20 12:44:07 +03:00
Sergey Kandaurov
d72221b826 Updated the list of supported drafts. 2021-02-19 17:27:41 +03:00
Sergey Kandaurov
be98da0731 QUIC: multiple versions support.
Draft-29 and beyond are now supported simultaneously, no need to recompile.
2021-02-19 17:27:19 +03:00
Sergey Kandaurov
cd276b5ed6 QUIC: removed support prior to draft-29. 2021-02-18 19:21:09 +03:00
Roman Arutyunyan
edc2c75c75 QUIC: set idle timer when sending an ack-eliciting packet.
As per quic-transport-34:

   An endpoint also restarts its idle timer when sending an ack-eliciting
   packet if no other ack-eliciting packets have been sent since last receiving
   and processing a packet.

Previously, the timer was set for any packet.
2021-02-18 12:22:28 +03:00
Roman Arutyunyan
e0425791d4 HTTP/3: limited client header size.
The limit is the size of all large client header buffers.  Client header size
is the total size of all client header names and values.
2021-02-17 11:58:32 +03:00
Roman Arutyunyan
ffb099bf52 HTTP/3: introduced ngx_http_v3_parse_t structure.
The structure is used to parse an HTTP/3 request.  An object of this type is
added to ngx_http_request_t instead of h3_parse generic pointer.

Also, the new field is located outside of the request ephemeral zone to keep it
safe after request headers are parsed.
2021-02-17 15:56:34 +03:00
Maxim Dounin
949c97007b release-1.19.7 tag 2021-02-16 18:57:18 +03:00