Commit Graph

7570 Commits

Author SHA1 Message Date
Roman Arutyunyan
a40fa4aa96 HTTP/3: moved Stream Cancellation stub to ngx_http_v3_streams.c. 2021-05-05 15:15:17 +03:00
Roman Arutyunyan
bbbc80465b HTTP/3: fixed decoder stream stubs.
Now ngx_http_v3_ack_header() and ngx_http_v3_inc_insert_count() always generate
decoder error.  Our implementation does not use dynamic tables and does not
expect client to send Section Acknowledgement or Insert Count Increment.

Stream Cancellation, on the other hand, is allowed to be sent anyway.  This is
why ngx_http_v3_cancel_stream() does not return an error.
2021-05-04 13:38:59 +03:00
Roman Arutyunyan
acc3ad0060 HTTP/3: reject empty DATA and HEADERS frames on control stream.
Previously only non-empty frames were rejected.
2021-05-05 13:28:05 +03:00
Vladimir Homutov
f36ebdc3cd QUIC: fixed build with NGX_QUIC_DEBUG_ALLOC enabled. 2021-04-28 13:37:18 +03:00
Vladimir Homutov
c4f5b50c47 QUIC: connection migration.
The patch adds proper transitions between multiple networking addresses that
can be used by a single quic connection. New networking paths are validated
using PATH_CHALLENGE/PATH_RESPONSE frames.
2021-04-29 15:35:02 +03:00
Ruslan Ermilov
f02e2a734e Restored zeroing of ngx_channel_t in ngx_pass_open_channel().
Due to structure's alignment, some uninitialized memory contents may have
been passed between processes.

Zeroing was removed in 0215ec9aaa8a.

Reported by Johnny Wang.
2021-04-22 16:12:52 +03:00
Vladimir Homutov
a8acca865b HTTP/3: adjusted control stream parsing.
7.2.1:
   If a DATA frame is received on a control stream, the recipient MUST
   respond with a connection error of type H3_FRAME_UNEXPECTED;

7.2.2:
   If a HEADERS frame is received on a control stream, the recipient MUST
   respond with a connection error (Section 8) of type H3_FRAME_UNEXPECTED.
2021-04-22 13:49:18 +03:00
Maxim Dounin
7b9920aad8 Mail: fixed reading with fully filled buffer (ticket #2159).
With SMTP pipelining, ngx_mail_read_command() can be called with s->buffer
without any space available, to parse additional commands received to the
buffer on previous calls.  Previously, this resulted in recv() being called
with zero length, resulting in zero being returned, which was interpreted
as a connection close by the client, so nginx silently closed connection.

Fix is to avoid calling c->recv() if there is no free space in the buffer,
but continue parsing of the already received commands.
2021-04-21 23:24:59 +03:00
Maxim Dounin
ead9ab0925 Version bump. 2021-04-21 23:24:48 +03:00
Roman Arutyunyan
013880bbda QUIC: renamed stream variables from sn to qs.
Currently both names are used which is confusing.  Historically these were
different objects, but now it's the same one.  The name qs (quic stream) makes
more sense than sn (stream node).
2021-04-19 17:25:56 +03:00
Roman Arutyunyan
e9a0123e67 QUIC: renamed stream field from c to connection. 2021-04-19 17:21:07 +03:00
Sergey Kandaurov
256db862fd QUIC: fixed permitted packet types for PATH_RESPONSE.
PATH_RESPONSE was explicitly forbidden in 0-RTT since at least draft-22, but
the Frame Types table was not updated until recently while in IESG evaluation.
2021-04-16 23:03:59 +03:00
Vladimir Homutov
f184bc0a0a QUIC: added missing checks for limits in stream frames parsing. 2021-04-19 09:46:37 +03:00
Vladimir Homutov
db4c8fe45f QUIC: fixed parsing of unknown frame types.
The ngx_quic_frame_allowed() function only expects known frame types.
2021-04-19 11:36:41 +03:00
Vladimir Homutov
17eebfea99 QUIC: avoid sending extra frames in case of error. 2021-04-15 12:17:19 +03:00
Maxim Dounin
a64190933e release-1.19.10 tag 2021-04-13 18:13:59 +03:00
Maxim Dounin
95d97aedb9 nginx-1.19.10-RELEASE 2021-04-13 18:13:58 +03:00
Sergey Kandaurov
2f5bcafdde QUIC: normalize header inclusion.
Stop including QUIC headers with no user-serviceable parts inside.
This allows to provide a much cleaner QUIC interface.  To cope with that,
ngx_quic_derive_key() is now explicitly exported for v3 and quic modules.
Additionally, this completely hides the ngx_quic_keys_t internal type.
2021-04-13 12:38:34 +03:00
Sergey Kandaurov
792117312d QUIC: ngx_quic_frames_stream_t made opaque. 2021-04-13 11:49:52 +03:00
Vladimir Homutov
2fd1aac46d QUIC: separate files for SSL library interfaces. 2021-04-14 14:47:04 +03:00
Vladimir Homutov
e0b73cf6a2 QUIC: separate files for tokens related processing. 2021-04-13 14:41:52 +03:00
Vladimir Homutov
8df0b6bb2c QUIC: separate files for output and ack related processing. 2021-04-13 14:41:20 +03:00
Vladimir Homutov
9326156b8b QUIC: separate files for stream related processing. 2021-04-13 14:40:00 +03:00
Vladimir Homutov
87ca8c087a QUIC: separate files for frames related processing. 2021-04-13 14:38:46 +03:00
Vladimir Homutov
118775761c QUIC: separate files for connection id related processing. 2021-04-13 14:37:41 +03:00
Vladimir Homutov
232fcba34b QUIC: headers cleanup.
The "ngx_event_quic.h" header file now contains only public definitions,
used by modules.  All internal definitions are moved into
the "ngx_event_quic_connection.h" header file.
2021-04-14 14:47:37 +03:00
Vladimir Homutov
9495ea7cda QUIC: separate function for connection ids initialization.
The function correctly cleans up resources in case of failure to create
initial server id: it removes previously created udp node for odcid from
listening rbtree.
2021-04-09 11:33:10 +03:00
Maxim Dounin
eb52de8311 Changed keepalive_requests default to 1000 (ticket #2155).
It turns out no browsers implement HTTP/2 GOAWAY handling properly, and
large enough number of resources on a page results in failures to load
some resources.  In particular, Chrome seems to experience errors if
loading of all resources requires more than 1 connection (while it
is usually able to retry requests at least once, even with 2 connections
there are occasional failures for some reason), Safari if loading requires
more than 3 connections, and Firefox if loading requires more than 10
connections (can be configured with network.http.request.max-attempts,
defaults to 10).

It does not seem to be possible to resolve this on nginx side, even strict
limiting of maximum concurrency does not help, and loading issues seems to
be triggered by merely queueing of a request for a particular connection.
The only available mitigation seems to use higher keepalive_requests value.

The new default is 1000 and matches previously used default for
http2_max_requests.  It is expected to be enough for 99.98% of the pages
(https://httparchive.org/reports/state-of-the-web?start=latest#reqTotal)
even in Chrome.
2021-04-08 00:16:30 +03:00
Maxim Dounin
497acbd0ed Added $connection_time variable. 2021-04-08 00:16:17 +03:00
Maxim Dounin
d9996d6f27 Introduced the "keepalive_time" directive.
Similar to lingering_time, it limits total connection lifetime before
keepalive is switched off.  The default is 1 hour, which is close to
the total maximum connection lifetime possible with default
keepalive_requests and keepalive_timeout.
2021-04-08 00:15:48 +03:00
Vladimir Homutov
6e945f235e QUIC: fixed ngx_quic_send_ack_range() function.
Created frame was not added to the output queue.
2021-04-07 13:09:26 +03:00
Maxim Dounin
5599731c00 HTTP/2: relaxed PRIORITY frames limit.
Firefox uses several idle streams for PRIORITY frames[1], and
"http2_max_concurrent_streams 1;" results in "client sent too many
PRIORITY frames" errors when a connection is established by Firefox.

Fix is to relax the PRIORITY frames limit to use at least 100 as
the initial value (which is the recommended by the HTTP/2 protocol
minimum limit on the number of concurrent streams, so it is not
unreasonable for clients to assume that similar number of idle streams
can be used for prioritization).

[1] https://hg.mozilla.org/mozilla-central/file/32a9e6e145d6e3071c3993a20bb603a2f388722b/netwerk/protocol/http/Http2Stream.cpp#l1270
2021-04-07 02:03:29 +03:00
Maxim Dounin
ca9bf16f09 Configure: fixed --test-build-epoll on FreeBSD 13.
In FreeBSD 13, eventfd(2) was added, and this breaks build
with --test-build-epoll and without --with-file-aio.  Fix is
to move eventfd(2) detection to auto/os/linux, as it is used
only on Linux as a notification mechanism for epoll().
2021-04-05 20:14:16 +03:00
Vladimir Homutov
5e6ee4b50a QUIC: fixed debug message macro. 2021-04-05 11:35:46 +03:00
Vladimir Homutov
a6c52268eb QUIC: added error codes and messages from latest drafts.
The AEAD_LIMIT_REACHED was addeded in draft-31.
The NO_VIABLE_PATH was added in draft-33.
2021-04-05 11:31:03 +03:00
Sergey Kandaurov
2fd50ca589 HTTP/3: keepalive_time support. 2021-04-16 19:42:03 +03:00
Sergey Kandaurov
f29e48f7ee Merged with the default branch. 2021-04-16 19:35:55 +03:00
Sergey Kandaurov
8ba7adf037 HTTP/3: removed h3scf->quic leftover after 0d2b2664b41c. 2021-04-12 12:30:30 +03:00
Sergey Kandaurov
b61176b9f7 QUIC: fixed memory leak in ngx_hkdf_extract()/ngx_hkdf_expand().
This fixes leak on successful path when built with OpenSSL.
2021-04-07 15:14:41 +03:00
Maxim Dounin
4af67214ad Gzip: updated handling of zlib variant from Intel.
In current versions (all versions based on zlib 1.2.11, at least
since 2018) it no longer uses 64K hash and does not force window
bits to 13 if it is less than 13.  That is, it needs just 16 bytes
more memory than normal zlib, so these bytes are simply added to
the normal size calculation.
2021-04-05 04:07:17 +03:00
Maxim Dounin
e3797a66a3 Gzip: support for zlib-ng. 2021-04-05 04:06:58 +03:00
Maxim Dounin
d23f77b028 Version bump. 2021-04-05 04:03:10 +03:00
Maxim Dounin
7b053dd1b2 release-1.19.9 tag 2021-03-30 17:47:11 +03:00
Maxim Dounin
9148be8173 nginx-1.19.9-RELEASE 2021-03-30 17:47:11 +03:00
Maxim Dounin
3e7c094993 Updated OpenSSL used for win32 builds. 2021-03-30 17:44:36 +03:00
Maxim Dounin
179c79ce8a Fixed handling of already closed connections.
In limit_req, auth_delay, and upstream code to check for broken
connections, tests for possible connection close by the client
did not work if the connection was already closed when relevant
event handler was set.  This happened because there were no additional
events in case of edge-triggered event methods, and read events
were disabled in case of level-triggered ones.

Fix is to explicitly post a read event if the c->read->ready flag
is set.
2021-03-28 17:45:39 +03:00
Maxim Dounin
8885c45e1e Upstream: fixed broken connection check with eventport.
For connection close to be reported with eventport on Solaris,
ngx_handle_read_event() needs to be called.
2021-03-28 17:45:37 +03:00
Maxim Dounin
9104757a7d Upstream: fixed non-buffered proxying with eventport.
For new data to be reported with eventport on Solaris,
ngx_handle_read_event() needs to be called after reading response
headers.  To do so, ngx_http_upstream_process_non_buffered_upstream()
now called unconditionally if there are no prepread data.  This
won't cause any read() syscalls as long as upstream connection
is not ready for reading (c->read->ready is not set), but will result
in proper handling of all events.
2021-03-28 17:45:35 +03:00
Maxim Dounin
cb9fca0846 Resolver: added missing event handling after reading.
If we need to be notified about further events, ngx_handle_read_event()
needs to be called after a read event is processed.  Without this,
an event can be removed from the kernel and won't be reported again,
notably when using oneshot event methods, such as eventport on Solaris.

While here, error handling is also added, similar to one present in
ngx_resolver_tcp_read().  This is not expected to make a difference
and mostly added for consistency.
2021-03-28 17:45:31 +03:00
Maxim Dounin
fd0546aa33 Events: fixed "port_dissociate() failed" alerts with eventport.
If an attempt is made to delete an event which was already reported,
port_dissociate() returns an error.  Fix is avoid doing anything if
ev->active is not set.

Possible alternative approach would be to avoid calling ngx_del_event()
at all if ev->active is not set.  This approach, however, will require
something else to re-add the other event of the connection, since both
read and write events are dissociated if an event is reported on a file
descriptor.  Currently ngx_eventport_del_event() re-associates write
event if called to delete read event, and vice versa.
2021-03-28 17:45:29 +03:00