QUIC: fixed handling stream input buffers.

Previously, ngx_quic_write_chain() treated each input buffer as a memory
buffer, which is not always the case.  Special buffers were not skipped, which
is especially important when hitting the input byte limit.

The issue manifested itself with ngx_quic_write_chain() returning a non-empty
chain consisting of a special last_buf buffer when called from QUIC stream
send_chain().  In order for this to happen, input byte limit should be equal to
the chain length, and the input chain should end with an empty last_buf buffer.
An easy way to achieve this is the following:

  location /empty {
      return 200;
  }

When this non-empty chain was returned from send_chain(), it signalled to the
caller that input was blocked, while in fact it wasn't.  This prevented HTTP
request from finalization, which prevented QUIC from sending STREAM FIN to
the client.  The QUIC stream was then reset after a timeout.

Now special buffers are skipped and send_chain() returns NULL in the case
above, which signals to the caller a successful operation.

Also, original byte limit is now passed to ngx_quic_write_chain() from
send_chain() instead of actual chain length to make sure it's never zero.

2 files changed, 12 insertions, 6 deletions

diff --git a/src/event/quic/ngx_event_quic_frames.c b/src/event/quic/ngx_event_quic_frames.c
index ac9e38b76..89bd6d236 100644
--- a/src/event/quic/ngx_event_quic_frames.c
+++ b/src/event/quic/ngx_event_quic_frames.c
@@ -527,7 +527,17 @@ ngx_quic_write_chain(ngx_connection_t *c, ngx_chain_t **chain, ngx_chain_t *in,
             continue;
         }
 
-        for (p = b->pos + offset; p != b->last && in && limit; /* void */ ) {
+        for (p = b->pos + offset; p != b->last && in; /* void */ ) {
+
+            if (!ngx_buf_in_memory(in->buf) || in->buf->pos == in->buf->last) {
+                in = in->next;
+                continue;
+            }
+
+            if (limit == 0) {
+                break;
+            }
+
             n = ngx_min(b->last - p, in->buf->last - in->buf->pos);
             n = ngx_min(n, limit);
 
@@ -539,10 +549,6 @@ ngx_quic_write_chain(ngx_connection_t *c, ngx_chain_t **chain, ngx_chain_t *in,
             in->buf->pos += n;
             offset += n;
             limit -= n;
-
-            if (in->buf->pos == in->buf->last) {
-                in = in->next;
-            }
         }
 
         if (b->sync && p == b->last) {
diff --git a/src/event/quic/ngx_event_quic_streams.c b/src/event/quic/ngx_event_quic_streams.c
index a74a43c43..6f6ab5f9e 100644
--- a/src/event/quic/ngx_event_quic_streams.c
+++ b/src/event/quic/ngx_event_quic_streams.c
@@ -861,7 +861,7 @@ ngx_quic_stream_send_chain(ngx_connection_t *c, ngx_chain_t *in, off_t limit)
         }
     }
 
-    in = ngx_quic_write_chain(pc, &qs->out, in, n, 0);
+    in = ngx_quic_write_chain(pc, &qs->out, in, limit, 0);
     if (in == NGX_CHAIN_ERROR) {
         return NGX_CHAIN_ERROR;
     }