Commit Graph

7206 Commits

Author SHA1 Message Date
Roman Arutyunyan
f2368597c2 HTTP/3: renamed server configuration variables from v3cf to h3scf.
Now they are similar to HTTP/2 where they are called h2scf.
2020-07-23 13:12:01 +03:00
Roman Arutyunyan
47ed87f855 HTTP/3: renamed ngx_http_v3.c to ngx_http_v3_encode.c.
The file contains only encoding functions.
2020-07-13 12:38:08 +03:00
Roman Arutyunyan
6d7ddb5471 HTTP/3: encode frame ids with ngx_http_v3_encode_varlen_int().
Even though typically frame ids fit into a single byte, calling
ngx_http_v3_encode_varlen_int() adds to the code clarity.
2020-07-13 12:33:00 +03:00
Roman Arutyunyan
fc5a7234b4 HTTP/3: generate Location response header for absolute redirects. 2020-07-23 12:31:40 +03:00
Roman Arutyunyan
04b2a169a4 HTTP/3: header encoding functions. 2020-07-13 16:00:00 +03:00
Roman Arutyunyan
548d515fba QUIC: updated README to mention "quic" listen parameter. 2020-07-22 13:45:34 +03:00
Sergey Kandaurov
ca0b9871bc QUIC: fixed bulding perl module by reducing header pollution.
The ngx_http_perl_module module doesn't have a notion of including additional
search paths through --with-cc-opt, which results in compile error incomplete
type 'enum ssl_encryption_level_t' when building nginx without QUIC support.
The enum is visible from quic event headers and eventually pollutes ngx_core.h.

The fix is to limit including headers to compile units that are real consumers.
2020-07-22 14:48:49 +03:00
Roman Arutyunyan
5468904e3b SSL: fixed compilation without QUIC after 0d2b2664b41c. 2020-07-22 13:34:48 +03:00
Roman Arutyunyan
cdc0d61ea0 HTTP/3: do not call shutdown() for QUIC streams.
Previously, this triggered an alert "shutdown() failed" in error log.
2020-07-22 11:03:42 +03:00
Roman Arutyunyan
3073ad1381 QUIC: eliminated connection handler argument in ngx_quic_run().
Now c->listening->handler() is called instead.
2020-07-21 23:08:23 +03:00
Roman Arutyunyan
36f2873f6b QUIC: added "quic" listen parameter in Stream.
Also, introduced ngx_stream_quic_module.
2020-07-21 23:08:39 +03:00
Roman Arutyunyan
b813b9ec35 QUIC: added "quic" listen parameter.
The parameter allows processing HTTP/0.9-2 over QUIC.

Also, introduced ngx_http_quic_module and moved QUIC settings there
2020-07-21 23:09:22 +03:00
Roman Arutyunyan
a305de07e9 QUIC: do not verify the selected ALPN protocol.
The right protocol is selected by the HTTP code.  In the QUIC code only verify
that some protocol was selected and trigger an error otherwise.
2020-07-18 00:08:04 +03:00
Roman Arutyunyan
0f1478706d QUIC: fixed stream read event log.
Previously, the main connection log was there.  Now it's the stream connection
log.
2020-07-18 00:08:29 +03:00
Sergey Kandaurov
8d2d2c5f8f Fixed format specifiers. 2020-07-20 15:19:03 +03:00
Vladimir Homutov
91b6487d8d QUIC: added anti-amplification limit.
According to quic-transport draft 29, section 21.12.1.1:

   Prior to validation, endpoints are limited in what they are able to
   send.  During the handshake, a server cannot send more than three
   times the data it receives; clients that initiate new connections or
   migrate to a new network path are limited.
2020-07-16 16:36:02 +03:00
Vladimir Homutov
e05337214e QUIC: added limit of queued data.
The ngx_quic_queue_frame() functions puts a frame into send queue and
schedules a push timer to actually send data.

The patch adds tracking for data amount in the queue and sends data
immediately if amount of data exceeds limit.
2020-07-16 15:02:38 +03:00
Vladimir Homutov
a5fc86c2a2 QUIC: implemented probe timeout (PTO) calculation. 2020-07-16 16:05:44 +03:00
Vladimir Homutov
782a634e38 QUIC: reworked retransmission mechanism.
Instead of timer-based retransmissions with constant packet lifetime,
this patch implements ack-based loss detection and probe timeout
for the cases, when no ack is received, according to the quic-recovery
draft 29.
2020-07-13 17:31:29 +03:00
Vladimir Homutov
230882ba50 QUIC: reworked ngx_quic_send_frames() function.
Instead of returning NGX_DONE/NGX_OK, the function now itself moves
passed frames range into sent queue and sets PTO timer if required.
2020-07-15 15:10:17 +03:00
Vladimir Homutov
395ec44029 QUIC: renaming.
The c->quic->retransmit timer is now called "pto".
The ngx_quic_retransmit() function is renamed to "ngx_quic_detect_lost()".

This is a preparation for the following patches.
2020-07-13 10:07:15 +03:00
Vladimir Homutov
d7ab1bfb7c QUIC: caching c->quic in the ngx_quic_handle_ack_frame() function.
To minimize difference with the following changes.
2020-07-13 10:07:20 +03:00
Vladimir Homutov
732720f3ca QUIC: delay field of an ACK frame is now calculated. 2020-07-10 15:33:51 +03:00
Vladimir Homutov
32fd0a7b44 QUIC: added rtt estimation.
According to the quic-recovery 29, Section 5: Estimating the Round-Trip Time.

Currently, integer arithmetics is used, which loses sub-millisecond accuracy.
2020-07-16 15:44:06 +03:00
Sergey Kandaurov
2346ee29e1 Merged with the default branch. 2020-07-13 15:34:22 +03:00
Roman Arutyunyan
5cef7de7a1 Slice filter: clear original Accept-Ranges.
The slice filter allows ranges for the response by setting the r->allow_ranges
flag, which enables the range filter.  If the range was not requested, the
range filter adds an Accept-Ranges header to the response to signal the
support for ranges.

Previously, if an Accept-Ranges header was already present in the first slice
response, client received two copies of this header.  Now, the slice filter
removes the Accept-Ranges header from the response prior to setting the
r->allow_ranges flag.
2020-07-09 16:21:37 +03:00
Roman Arutyunyan
826fb0d45c Version bump. 2020-07-09 17:33:22 +03:00
Maxim Dounin
1b2f040a1f release-1.19.1 tag 2020-07-07 18:56:06 +03:00
Maxim Dounin
0f648f6875 nginx-1.19.1-RELEASE 2020-07-07 18:56:05 +03:00
Maxim Dounin
5348706fe6 gRPC: generate error when response size is wrong.
As long as the "Content-Length" header is given, we now make sure
it exactly matches the size of the response.  If it doesn't,
the response is considered malformed and must not be forwarded
(https://tools.ietf.org/html/rfc7540#section-8.1.2.6).  While it
is not really possible to "not forward" the response which is already
being forwarded, we generate an error instead, which is the closest
equivalent.

Previous behaviour was to pass everything to the client, but this
seems to be suboptimal and causes issues (ticket #1695).  Also this
directly contradicts HTTP/2 specification requirements.

Note that the new behaviour for the gRPC proxy is more strict than that
applied in other variants of proxying.  This is intentional, as HTTP/2
specification requires us to do so, while in other types of proxying
malformed responses from backends are well known and historically
tolerated.
2020-07-06 18:36:25 +03:00
Maxim Dounin
1194ba36a0 FastCGI: protection from responses with wrong length.
Previous behaviour was to pass everything to the client, but this
seems to be suboptimal and causes issues (ticket #1695).  Fix is to
drop extra data instead, as it naturally happens in most clients.

Additionally, we now also issue a warning if the response is too
short, and make sure the fact it is truncated is propagated to the
client.  The u->error flag is introduced to make it possible to
propagate the error to the client in case of unbuffered proxying.

For responses to HEAD requests there is an exception: we do allow
both responses without body and responses with body matching the
Content-Length header.
2020-07-06 18:36:23 +03:00
Maxim Dounin
dfcfcc5a88 Upstream: drop extra data sent by upstream.
Previous behaviour was to pass everything to the client, but this
seems to be suboptimal and causes issues (ticket #1695).  Fix is to
drop extra data instead, as it naturally happens in most clients.

This change covers generic buffered and unbuffered filters as used
in the scgi and uwsgi modules.  Appropriate input filter init
handlers are provided by the scgi and uwsgi modules to set corresponding
lengths.

Note that for responses to HEAD requests there is an exception:
we do allow any response length.  This is because responses to HEAD
requests might be actual full responses, and it is up to nginx
to remove the response body.  If caching is enabled, only full
responses matching the Content-Length header will be cached
(see b779728b180c).
2020-07-06 18:36:22 +03:00
Maxim Dounin
7f2490c43c Proxy: style. 2020-07-06 18:36:21 +03:00
Maxim Dounin
156e193408 Proxy: detection of data after final chunk.
Previously, additional data after final chunk was either ignored
(in the same buffer, or during unbuffered proxying) or sent to the
client (in the next buffer already if it was already read from the
socket).  Now additional data are properly detected and ignored
in all cases.  Additionally, a warning is now logged and keepalive
is disabled in the connection.
2020-07-06 18:36:20 +03:00
Maxim Dounin
a2abe31a85 Proxy: drop extra data sent by upstream.
Previous behaviour was to pass everything to the client, but this
seems to be suboptimal and causes issues (ticket #1695).  Fix is to
drop extra data instead, as it naturally happens in most clients.
2020-07-06 18:36:19 +03:00
Maxim Dounin
b835b57184 Memcached: protect from too long responses.
If a memcached response was followed by a correct trailer, and then
the NUL character followed by some extra data - this was accepted by
the trailer checking code.  This in turn resulted in ctx->rest underflow
and caused negative size buffer on the next reading from the upstream,
followed by the "negative size buf in writer" alert.

Fix is to always check for too long responses, so a correct trailer cannot
be followed by extra data.
2020-07-06 18:36:17 +03:00
Ruslan Ermilov
829c9d5981 HTTP/2: lingering close after GOAWAY.
After sending the GOAWAY frame, a connection is now closed using
the lingering close mechanism.

This allows for the reliable delivery of the GOAWAY frames, while
also fixing connection resets observed when http2_max_requests is
reached (ticket #1250), or with graceful shutdown (ticket #1544),
when some additional data from the client is received on a fully
closed connection.

For HTTP/2, the settings lingering_close, lingering_timeout, and
lingering_time are taken from the "server" level.
2020-07-03 16:16:47 +03:00
Roman Arutyunyan
3db00b4da7 HTTP/3: simplified handling return codes from parse functions. 2020-07-02 20:07:24 +03:00
Roman Arutyunyan
ac9c1dcad8 HTTP/3: put ngx_http_v3_parse_varlen_int() return code in variable.
This makes calling this function similar to other parse functions.
2020-07-03 12:07:43 +03:00
Roman Arutyunyan
8d1875d39a HTTP/3: simplifed handling ngx_http_v3_parse_literal() return code. 2020-07-03 12:05:05 +03:00
Roman Arutyunyan
3a9874c4ab HTTP/3: limited prefixed integer size by 62 bits. 2020-07-03 09:26:12 +03:00
Roman Arutyunyan
3b2eabde0b HTTP/3: fixed overflow in prefixed integer parser.
Previously, the expression (ch & 0x7f) was promoted to a signed integer.
Depending on the platform, the size of this integer could be less than 8 bytes,
leading to overflow when handling the higher bits of the result.  Also, sign
bit of this integer could be replicated when adding to the 64-bit st->value.
2020-07-03 16:41:31 +03:00
Sergey Kandaurov
0ebcffcf14 HTTP/3: fixed prefix in decoding Section Acknowledgement. 2020-07-02 17:35:57 +03:00
Roman Arutyunyan
d839fee75f HTTP/3: set r->headers_in.chunked flag after parsing headers.
Previously it was set when creating the request object.  The side-effect was
trying to discard the request body in case of header parse error.
2020-06-30 15:32:09 +03:00
Roman Arutyunyan
707117276e HTTP/3: close QUIC connection with HTTP/QPACK errors when needed.
Previously errors led only to closing streams.

To simplify closing QUIC connection from a QUIC stream context, new macro
ngx_http_v3_finalize_connection() is introduced.  It calls
ngx_quic_finalize_connection() for the parent connection.
2020-07-02 16:47:51 +03:00
Roman Arutyunyan
fd35d92232 HTTP/3: error code definitions for HTTP/3 and QPACK. 2020-06-30 12:30:57 +03:00
Roman Arutyunyan
90f5c334f1 QUIC: Introduced ngx_quic_finalize_connection().
The function finalizes QUIC connection with an application protocol error
code and sends a CONNECTION_CLOSE frame with type=0x1d.

Also, renamed NGX_QUIC_FT_CONNECTION_CLOSE2 to NGX_QUIC_FT_CONNECTION_CLOSE_APP.
2020-07-02 16:33:59 +03:00
Roman Arutyunyan
86e287a2de HTTP/3: downgraded literal size error level to NGX_LOG_INFO.
Now it's similar to HTTP/2.
2020-07-02 16:33:36 +03:00
Roman Arutyunyan
a687d08062 HTTP/3: refactored dynamic table implementation.
Previously dynamic table was not functional because of zero limit on its size
set by default.  Now the following changes enable it:

- new directives to set SETTINGS_QPACK_MAX_TABLE_CAPACITY and
  SETTINGS_QPACK_BLOCKED_STREAMS
- send settings with SETTINGS_QPACK_MAX_TABLE_CAPACITY and
  SETTINGS_QPACK_BLOCKED_STREAMS to the client
- send Insert Count Increment to the client
- send Header Acknowledgement to the client
- evict old dynamic table entries on overflow
- decode Required Insert Count from client
- block stream if Required Insert Count is not reached
2020-07-02 15:34:05 +03:00
Roman Arutyunyan
a7ef0da3c8 HTTP/3: fixed prefixed integer encoding and decoding.
Previously bytes were ordered from MSB to LSB, but the right order is the
reverse.
2020-07-02 15:15:55 +03:00