Commit Graph

7364 Commits

Author SHA1 Message Date
Sergey Kandaurov
d0a0619577 QUIC: simplified and streamlined ngx_quic_decrypt().
Both clearflags and badflags are removed.  It makes a little sense now
to keep them as intermediate storage.
2020-11-17 21:33:16 +00:00
Sergey Kandaurov
99ae2fbd95 QUIC: merged create_long/short_packet() functions.
They no longer differ.
2020-11-17 21:33:12 +00:00
Sergey Kandaurov
cb158c264d QUIC: macros for manipulating header protection and reserved bits.
This gets rid of magic numbers from quic protection and allows to push down
header construction specifics further to quic transport.
2020-11-17 21:32:22 +00:00
Sergey Kandaurov
97dcde9799 QUIC: hide header creation internals in ngx_event_quic_transport.c.
It doesn't make sense to expose the header type in a public function.
2020-11-17 21:32:06 +00:00
Sergey Kandaurov
5e32d82dea QUIC: refactored long header parsing.
The largely duplicate type-specific functions ngx_quic_parse_initial_header(),
ngx_quic_parse_handshake_header(), and a missing one for 0-RTT, were merged.
The new order of functions listed in ngx_event_quic_transport.c reflects this.

|_ ngx_quic_parse_long_header    - version-invariant long header fields
\_ ngx_quic_supported_version    - a helper to decide we can go further
\_ ngx_quic_parse_long_header_v1 - QUICv1-specific long header fields

0-RTT packets previously appeared as Handshake are now logged as appropriate:
 *1 quic packet rx long flags:db version:ff00001d
 *1 quic packet rx early len:870

Logging SCID/DCID is no longer duplicated as were seen with Initial packets.
2020-11-17 21:32:04 +00:00
Sergey Kandaurov
b1d930b893 QUIC: sorted header parsing functions in order of appearance.
No functional changes.
2020-11-17 21:31:51 +00:00
Sergey Kandaurov
5ff8f8aaea QUIC: removed macros for stream limits unused since c5324bb3a704. 2020-11-17 12:22:24 +00:00
Sergey Kandaurov
7046a10134 Core: hide "struct ngx_quic_connection_s" and further reduce diffs.
As with the previous change, it became feasible with feec2cc762f6
that removes ngx_quic_connection_t from ngx_connection_s.
2020-11-13 15:11:29 +00:00
Sergey Kandaurov
375b47efb3 Core: reduced diff to the default branch.
It became feasible to reduce after feec2cc762f6 that
removes ngx_quic_connection_t from ngx_connection_s.
2020-11-13 15:11:27 +00:00
Sergey Kandaurov
c092a7de0f QUIC: microoptimization in varint parsing.
Removed a useless mask from the value being shifted, since it is 1-byte wide.
2020-11-13 13:24:45 +00:00
Roman Arutyunyan
eb8f476d59 Fixed generating chunked response after 46e3542d51b3.
If trailers were missing and a chain carrying the last_buf flag had no data
in it, then last HTTP/1 chunk was broken.  The problem was introduced while
implementing HTTP/3 response body generation.

The change fixes the issue and reduces diff to the mainline nginx.
2020-11-10 20:42:45 +00:00
Roman Arutyunyan
5bbc3f1967 QUIC: generate default stateless reset token key.
Previously, if quic_stateless_reset_token_key was empty or unspecified,
initial stateless reset token was not generated.  However subsequent tokens
were generated with empty key, which resulted in error with certain SSL
libraries, for example OpenSSL.

Now a random 32-byte stateless reset token key is generated if none is
specified in the configuration.  As a result, stateless reset tokens are now
generated for all server ids.
2020-11-11 21:08:48 +00:00
Roman Arutyunyan
6e6daf4592 QUIC: removed comment. 2020-11-11 19:40:41 +00:00
Roman Arutyunyan
fc5a088665 QUIC: added quic_stateless_reset_token_key Stream directive.
A similar directive is already available in HTTP.
2020-11-11 19:39:23 +00:00
Roman Arutyunyan
db7fbc4d04 QUIC: reallocate qc->dcid on retry.
Previously new dcid was generated in the same memory that was allocated for
qc->dcid when creating the QUIC connection.  However this memory was also
referenced by initial_source_connection_id and retry_source_connection_id
transport parameters.  As a result these parameters changed their values after
retry which broke the protocol.
2020-11-11 17:56:02 +00:00
Roman Arutyunyan
2fd31c8959 QUIC: renamed c->qs to c->quic. 2020-11-10 19:40:00 +00:00
Roman Arutyunyan
4b41b1478f QUIC: got rid of the c->quic field.
Now QUIC connection is accessed via the c->udp field.
2020-11-10 18:38:42 +00:00
Roman Arutyunyan
1be6d80089 QUIC: connection multiplexing per port.
Also, connection migration within a single worker is implemented.
2020-11-11 11:57:50 +00:00
Maxim Dounin
23597e97f5 Configure: shared sources for addon modules.
Addon modules, both dynamic and static, can now use shared source files.
Shared sources result in only one make rule even if specified several
times in different modules.
2020-11-10 17:13:20 +03:00
Maxim Dounin
3030907f5f Configure: initialization of NGX_ADDON_SRCS. 2020-11-10 17:13:17 +03:00
Maxim Dounin
82a56ff85a Configure: style. 2020-11-10 17:13:14 +03:00
Maxim Dounin
a3b5ccd056 Request body: removed error assumption (ticket #2058).
Before introduction of request body filter in 42d9beeb22db, the only
possible return code from the ngx_http_request_body_filter() call
without actual buffers was NGX_HTTP_INTERNAL_SERVER_ERROR, and
the code in ngx_http_read_client_request_body() hardcoded the only
possible error to simplify the code of initial call to set rb->rest.

This is no longer true after introduction of request body filters though,
as a request body filter might need to return other errors, such as 403.
Fix is to preserve the error code actually returned by the call
instead of assuming 500.
2020-11-09 22:41:54 +03:00
Maxim Dounin
8ed303c055 Request body: improved logging.
Added logging before returning NGX_HTTP_INTERNAL_SERVER_ERROR if there
are busy buffers after a request body flush.  This should never happen
with current code, though bugs can be introduced by 3rd party modules.
Make sure debugging will be easy enough.
2020-11-09 22:40:53 +03:00
Roman Arutyunyan
d889cff0e5 QUIC: renamed field and function related to client ids.
Particularly, c->curr_seqnum is renamed to c->client_seqnum and
ngx_quic_alloc_connection_id() is renamed to ngx_quic_alloc_client_id().
2020-11-09 18:58:29 +00:00
Sergey Kandaurov
b19923f91b QUIC: multiple versions support in ALPN.
Previously, a version based on NGX_QUIC_DRAFT_VERSION was always set.
Now it is taken from the negotiated QUIC version that may differ.
2020-11-10 00:32:56 +03:00
Sergey Kandaurov
7f43460387 QUIC: multiple versions support.
Draft-29 and beyond are now treated as compatible versions.
2020-11-10 00:23:04 +03:00
Sergey Kandaurov
66cb03f003 QUIC: preparatory changes for multiple QUIC versions support.
A negotiated version is decoupled from NGX_QUIC_VERSION and, if supported,
now stored in c->quic->version after packets processing.  It is then used
to create long header packets.  Otherwise, the list of supported versions
(which may be many now) is sent in the Version Negotiation packet.

All packets in the connection are expected to have the same version.
Incoming packets with mismatched version are now rejected.
2020-11-10 00:20:44 +03:00
Ruslan Ermilov
ad2b9944b0 SSL: fixed non-working SSL shutdown on lingering close.
When doing lingering close, the socket was first shut down for writing,
so SSL shutdown initiated after lingering close was not able to send
the close_notify alerts (ticket #2056).

The fix is to call ngx_ssl_shutdown() before shutting down the socket.
2020-11-06 23:44:54 +03:00
Ruslan Ermilov
aad0d1bf1c Removed dead code from ngx_http_set_keepalive().
The code removed became dead after 98f03cd8d6cc (0.8.14),
circa when the request reference counting was introduced.
2020-11-06 23:44:47 +03:00
Vladimir Homutov
b874b822e1 QUIC: added proper logging of special values.
A number of unsigned variables has a special value, usually -1 or some maximum,
which produces huge numeric value in logs and makes them hard to read.

In order to distinguish such values in log, they are casted to the signed type
and printed as literal '-1'.
2020-11-06 18:21:31 +03:00
Sergey Kandaurov
609af6e31d QUIC: fixed address validation issues in a new connection.
The client address validation didn't complete with a valid token,
which was broken after packet processing refactoring in d0d3fc0697a0.

An invalid or expired token was treated as a connection error.
Now we proceed as outlined in draft-ietf-quic-transport-32,
section 8.1.3 "Address Validation for Future Connections" below,
which is unlike validating the client address using Retry packets.

   When a server receives an Initial packet with an address validation
   token, it MUST attempt to validate the token, unless it has already
   completed address validation.  If the token is invalid then the
   server SHOULD proceed as if the client did not have a validated
   address, including potentially sending a Retry.

The connection is now closed in this case on internal errors only.
2020-11-02 17:38:11 +00:00
Sergey Kandaurov
0aef8438f4 QUIC: refactored key handling.
All key handling functionality is moved into ngx_quic_protection.c.
Public structures from ngx_quic_protection.h are now private and new
methods are available to manipulate keys.

A negotiated cipher is cached in QUIC connection from the set secret callback
to avoid calling SSL_get_current_cipher() on each encrypt/decrypt operation.
This also reduces the number of unwanted c->ssl->connection occurrences.
2020-11-02 18:21:34 +03:00
Sergey Kandaurov
8ed020db75 QUIC: refactored SSL_do_handshake() handling.
No functional changes.
2020-10-29 21:50:49 +00:00
Sergey Kandaurov
1a0888aef9 QUIC: passing ssl_conn to SSL_get0_alpn_selected() directly.
No functional changes.
2020-10-29 21:50:19 +00:00
Sergey Kandaurov
6f73d24061 Merged with the default branch. 2020-10-29 14:53:58 +00:00
Roman Arutyunyan
c3e8e59a55 QUIC: handle more frames in ngx_quic_resend_frames().
When a packet is declared lost, its frames are handled differently according to
13.3. Retransmission of Information.
2020-10-29 14:25:02 +00:00
Vladimir Homutov
21a5955f75 QUIC: avoided retransmission of stale ack frames.
Acknowledgments are regenerated using the most recent data available.
2020-10-28 14:22:51 +03:00
Vladimir Homutov
3c04273733 Core: added format specifiers to output binary data as hex.
Now "s", "V", and "v" format specifiers may be prefixed with "x" (lowercase)
or "X" (uppercase) to output corresponding data in hexadecimal format.

In collaboration with Maxim Dounin.
2020-10-28 10:56:11 +03:00
Vladimir Homutov
c566d79993 Version bump. 2020-11-05 22:37:27 +03:00
Roman Arutyunyan
54187d2d7a QUIC: changed STREAM frame debugging. 2020-10-27 18:21:36 +00:00
Roman Arutyunyan
42a4e6d311 QUIC: changed ACK frame debugging.
Previously ACK ranges were logged as a gap/range sequence.  Now these
values are expanded to packet number ranges for easier reading.
2020-10-28 09:15:04 +00:00
Maxim Dounin
db65797133 release-1.19.4 tag 2020-10-27 18:09:20 +03:00
Maxim Dounin
0db948d240 nginx-1.19.4-RELEASE 2020-10-27 18:09:20 +03:00
Roman Arutyunyan
a37d00064a QUIC: unified range format for rx and tx ACK frames.
Previously, tx ACK frames held ranges in an array of ngx_quic_ack_range_t,
while rx ACK frames held ranges in the serialized format.  Now serialized format
is used for both types of frames.
2020-10-27 13:24:00 +00:00
Vladimir Homutov
68f7e9540a QUIC: cleanup send context properly.
The patch resets ctx->frames queue, which may contain frames.  It was possible
that congestion or amplification limits prevented all frames to be sent.

Retransmitted frames could be accounted twice as inflight: first time in
ngx_quic_congestion_lost() called from ngx_quic_resend_frames(), and later
from ngx_quic_discard_ctx().
2020-10-27 00:14:24 +03:00
Vladimir Homutov
a1473ce8b0 QUIC: added push event afer the address was validated.
This allows to continue processing when the anti-amplification limit was hit.
2020-10-27 00:00:56 +03:00
Vladimir Homutov
ddd665ca66 QUIC: updated anti-amplification check for draft 32.
This accounts for the following change:

   *  Require expansion of datagrams to ensure that a path supports at
      least 1200 bytes:

      -  During the handshake ack-eliciting Initial packets from the
         server need to be expanded
2020-10-26 23:58:34 +03:00
Vladimir Homutov
7ba467944d QUIC: got rid of "pkt" abbreviation in logs. 2020-10-26 23:47:49 +03:00
Vladimir Homutov
37b7360893 QUIC: added "rx" and "tx" prefixes to packet debug. 2020-10-26 23:47:16 +03:00
Vladimir Homutov
d35db4b3eb QUIC: added connection state debug to event handlers. 2020-10-26 23:17:54 +03:00