aboutsummaryrefslogtreecommitdiff
path: root/src/http/v3/ngx_http_v3_request.c
Commit message (Collapse)AuthorAge
* HTTP/3: decoder stream pre-creation.Roman Arutyunyan2024-05-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | Previously a decoder stream was created on demand for sending Section Acknowledgement, Stream Cancellation and Insert Count Increment. If conditions for sending any of these instructions never happen, a decoder stream is not created at all. These conditions include client not using the dynamic table and no streams abandoned by server (RFC 9204, Section 2.2.2.2). However RFC 9204, Section 4.2 defines only one condition for not creating a decoder stream: An endpoint MAY avoid creating a decoder stream if its decoder sets the maximum capacity of the dynamic table to zero. The change enables pre-creation of the decoder stream at HTTP/3 session initialization if maximum dynamic table capacity is not zero. Note that this value is currently hardcoded to 4096 bytes and is not configurable, so the stream is now always created. Also, the change fixes a potential stack overflow when creating a decoder stream in ngx_http_v3_send_cancel_stream() while draining a request stream by ngx_drain_connections(). Creating a decoder stream involves calling ngx_get_connection(), which calls ngx_drain_connections(), which will drain the same request stream again. If client's MAX_STREAMS for uni stream is high enough, these recursive calls will continue until we run out of stack. Otherwise, decoder stream creation will fail at some point and the request stream connection will be drained. This may result in use-after-free, since this connection could still be referenced up the stack.
* HTTP/3: fixed handling of malformed request body length.Sergey Kandaurov2024-05-03
| | | | | | | Previously, a request body larger than declared in Content-Length resulted in a 413 status code, because Content-Length was mistakenly used as the maximum allowed request body, similar to client_max_body_size. Following the HTTP/3 specification, such requests are now rejected with the 400 error as malformed.
* HTTP/3: postponed session creation to init() callback.Roman Arutyunyan2023-09-14
| | | | | | | | | | | | | | Now the session object is assigned to c->data while ngx_http_connection_t object is referenced by its http_connection field, similar to ngx_http_v2_connection_t and ngx_http_request_t. The change allows to eliminate v3_session field from ngx_http_connection_t. The field was under NGX_HTTP_V3 macro, which was a source of binary compatibility problems when nginx/module is build with/without HTTP/3 support. Postponing is essential since c->data should retain the reference to ngx_http_connection_t object throughout QUIC handshake, because SSL callbacks ngx_http_ssl_servername() and ngx_http_ssl_alpn_select() rely on this.
* HTTP/3: moved variable initialization.Roman Arutyunyan2023-09-13
|
* QUIC: "handshake_timeout" configuration parameter.Roman Arutyunyan2023-09-13
| | | | | | | | Previously QUIC did not have such parameter and handshake duration was controlled by HTTP/3. However that required creating and storing HTTP/3 session on first client datagram. Apparently there's no convenient way to store the session object until QUIC handshake is complete. In the followup patches session creation will be postponed to init() callback.
* HTTP/3: removed "http3" parameter of "listen" directive.Roman Arutyunyan2023-05-11
| | | | The parameter has been deprecated since c851a2ed5ce8.
* HTTP/3: "quic" parameter of "listen" directive.Roman Arutyunyan2023-02-27
| | | | | | | | | Now "listen" directve has a new "quic" parameter which enables QUIC protocol for the address. Further, to enable HTTP/3, a new directive "http3" is introduced. The hq-interop protocol is enabled by "http3_hq" as before. Now application protocol is chosen by ALPN. Previously used "http3" parameter of "listen" is deprecated.
* HTTP/3: insert count block timeout.Roman Arutyunyan2023-01-05
| | | | | | Previously, there was no timeout for a request stream blocked on insert count, which could result in infinite wait. Now client_header_timeout is set when stream is first blocked.
* HTTP/3: trigger 400 (Bad Request) on stream error while blocked.Roman Arutyunyan2023-01-05
| | | | | Previously, stream was closed with NGX_HTTP_CLOSE. However, in a similar case when recv() returns eof or error, status 400 is triggered.
* HTTP/3: fixed $connection_time.Sergey Kandaurov2023-01-10
| | | | | | Previously, start_time wasn't set for a new stream. The fix is to derive it from the parent connection. Also it's used to simplify tracking keepalive_time.
* HTTP/3: implement keepalive for hq.Roman Arutyunyan2022-10-25
| | | | | | | | Previously, keepalive timer was deleted in ngx_http_v3_wait_request_handler() and set in request cleanup handler. This worked for HTTP/3 connections, but not for hq connections. Now keepalive timer is deleted in ngx_http_v3_init_request_stream() and set in connection cleanup handler, which works both for HTTP/3 and hq.
* QUIC: application init() callback.Roman Arutyunyan2022-11-30
| | | | | | | | | | It's called after handshake completion or prior to the first early data stream creation. The callback should initialize application-level data before creating streams. HTTP/3 callback implementation sets keepalive timer and sends SETTINGS. Also, this allows to limit max handshake time in ngx_http_v3_init_stream().
* HTTP/3: renamed functions.Roman Arutyunyan2022-08-22
| | | | | ngx_http_v3_init() is renamed ngx_http_v3_init_stream(). ngx_http_v3_reset_connection() is renamed to ngx_http_v3_reset_stream().
* QUIC: idle mode for main connection.Roman Arutyunyan2022-10-19
| | | | | | | | | Now main QUIC connection for HTTP/3 always has c->idle flag set. This allows the connection to receive worker shutdown notification. It is passed to application level via a new conf->shutdown() callback. The HTTP/3 shutdown callback sends GOAWAY to client and gracefully shuts down the QUIC connection.
* HTTP/3: unified hq code with regular HTTP/3 code.Roman Arutyunyan2022-10-19
| | | | | The change removes hq-specific request handler. Now hq requests are handled by the HTTP/3 request handler.
* HTTP/3: fixed build without NGX_PCRE (broken by 0f5fc7a320db).Jiuzhou Cui2022-11-25
|
* HTTP/3: fixed server_name regex captures (ticket #2407).Sergey Kandaurov2022-11-22
| | | | | | | Previously, HTTP/3 stream connection didn't inherit the servername regex from the main QUIC connection saved when processing SNI and using regular expressions in server names. As a result, it didn't execute to set regex captures when choosing the virtual server while parsing HTTP/3 headers.
* HTTP/3: skip empty request body buffers (ticket #2374).Roman Arutyunyan2022-08-03
| | | | | | | | | | | | When client DATA frame header and its content come in different QUIC packets, it may happen that only the header is processed by the first ngx_http_v3_request_body_filter() call. In this case an empty request body buffer is added to r->request_body->bufs, which is later reused in a subsequent ngx_http_v3_request_body_filter() call without being removed from the body chain. As a result, rb->request_body->bufs ends up with two copies of the same buffer. The fix is to avoid adding empty request body buffers to r->request_body->bufs.
* HTTP/3: improved processing of multiple Cookie field lines.Sergey Kandaurov2021-12-30
| | | | | As per draft-ietf-quic-http, 4.1.1.2, and similar to HTTP/2 specification, they ought to be concatenated. This closely follows ngx_http_v2_module.
* Style.Roman Arutyunyan2021-12-29
|
* HTTP/3: avoid sending stream cancellation for pushed streams.Sergey Kandaurov2021-12-07
|
* QUIC: simplified configuration.Vladimir Homutov2021-12-06
| | | | | | | Directives that set transport parameters are removed from the configuration. Corresponding values are derived from the quic configuration or initialized to default. Whenever possible, quic configuration parameters are taken from higher-level protocol settings, i.e. HTTP/3.
* HTTP/3: http3_hq directive and NGX_HTTP_V3_HQ macro.Roman Arutyunyan2021-12-04
| | | | Listen quic parameter is no longer supported.
* HTTP/3: merged ngx_http_quic_module into ngx_http_v3_module.Roman Arutyunyan2021-12-06
|
* HTTP/3: send Stream Cancellation instruction.Roman Arutyunyan2021-10-18
| | | | | | | | | | | | As per quic-qpack-21: When a stream is reset or reading is abandoned, the decoder emits a Stream Cancellation instruction. Previously the instruction was not sent. Now it's sent when closing QUIC stream connection if dynamic table capacity is non-zero and eof was not received from client. The latter condition means that a trailers section may still be on its way from client and the stream needs to be cancelled.
* HTTP/3: allowed QUIC stream connection reuse.Roman Arutyunyan2021-10-18
| | | | | | | | | | | | | | | | | | | A QUIC stream connection is treated as reusable until first bytes of request arrive, which is also when the request object is now allocated. A connection closed as a result of draining, is reset with the error code H3_REQUEST_REJECTED. Such behavior is allowed by quic-http-34: Once a request stream has been opened, the request MAY be cancelled by either endpoint. Clients cancel requests if the response is no longer of interest; servers cancel requests if they are unable to or choose not to respond. When the server cancels a request without performing any application processing, the request is considered "rejected." The server SHOULD abort its response stream with the error code H3_REQUEST_REJECTED. The client can treat requests rejected by the server as though they had never been sent at all, thereby allowing them to be retried later.
* HTTP/3: adjusted QUIC connection finalization.Roman Arutyunyan2021-10-18
| | | | | | | | | | | | | When an HTTP/3 function returns an error in context of a QUIC stream, it's this function's responsibility now to finalize the entire QUIC connection with the right code, if required. Previously, QUIC connection finalization could be done both outside and inside such functions. The new rule follows a similar rule for logging, leads to cleaner code, and allows to provide more details about the error. While here, a few error cases are no longer treated as fatal and QUIC connection is no longer finalized in these cases. A few other cases now lead to stream reset instead of connection finalization.
* HTTP/3: traffic-based flood detection.Roman Arutyunyan2021-10-07
| | | | | | | | | | With this patch, all traffic over HTTP/3 bidi and uni streams is counted in the h3c->total_bytes field, and payload traffic is counted in the h3c->payload_bytes field. As long as total traffic is many times larger than payload traffic, we consider this to be a flood. Request header traffic is counted as if all fields are literal. Response header traffic is counted as is.
* HTTP/3: fixed request length calculation.Roman Arutyunyan2021-10-06
| | | | Previously, when request was blocked, r->request_length was not updated.
* HTTP/3: fixed ngx_stat_active counter.Roman Arutyunyan2021-09-22
| | | | | | | | | | Previously the counter was not incremented for HTTP/3 streams, but still decremented in ngx_http_close_connection(). There are two solutions here, one is to increment the counter for HTTP/3 streams, and the other one is not to decrement the counter for HTTP/3 streams. The latter solution looks inconsistent with ngx_stat_reading/ngx_stat_writing, which are incremented on a per-request basis. The change adds ngx_stat_active increment for HTTP/3 request and push streams.
* HTTP/3: added CONNECT and TRACE methods rejection.Sergey Kandaurov2021-09-16
| | | | It has got lost in e1eb7f4ca9f1, let alone a subsequent update in 63c66b7cc07c.
* HTTP/3: reading body buffering in filters.Roman Arutyunyan2021-09-09
| | | | This change follows similar changes in HTTP/1 and HTTP/2 in 9cf043a5d9ca.
* HTTP/3: bulk parse functions.Roman Arutyunyan2021-07-08
| | | | | Previously HTTP/3 streams were parsed by one character. Now all parse functions receive buffers. This should optimize parsing time and CPU load.
* HTTP/3: fixed dead store assignment.Sergey Kandaurov2021-08-24
| | | | Found by Clang Static Analyzer.
* HTTP/3: disabled control characters and space in header names.Sergey Kandaurov2021-08-10
| | | | This is a follow up to 41f4bd4c51f1.
* HTTP/3: close connection on keepalive_requests * 2.Roman Arutyunyan2021-07-29
| | | | | | | | After receiving GOAWAY, client is not supposed to create new streams. However, until client reads this frame, we allow it to create new streams, which are gracefully rejected. To prevent client from abusing this algorithm, a new limit is introduced. Upon reaching keepalive_requests * 2, server now closes the entire QUIC connection claiming excessive load.
* HTTP/3: quic-qpack term updates.Sergey Kandaurov2021-07-01
| | | | | | | | Renamed header -> field per quic-qpack naming convention, in particular: - Header Field -> Field Line - Header Block -> (Encoded) Field Section - Without Name Reference -> With Literal Name - Header Acknowledgement -> Section Acknowledgment
* HTTP/3: renamed ngx_http_v3_connection_t to ngx_http_v3_session_t.Roman Arutyunyan2021-05-05
|
* HTTP/3: ngx_http_v3_get_session() macro.Roman Arutyunyan2021-04-30
| | | | | | It's used instead of accessing c->quic->parent->data directly. Apart from being simpler, it allows to change the way session is stored in the future by changing the macro.
* HTTP/3: keepalive_time support.Sergey Kandaurov2021-04-16
|
* HTTP/3: fixed $connection_requests.Roman Arutyunyan2021-03-15
| | | | Previously, the value was always "1".
* HTTP/3: keepalive timeout.Roman Arutyunyan2021-03-30
| | | | This timeout limits the time when no client request streams exist.
* QUIC: connection shutdown.Roman Arutyunyan2021-03-15
| | | | | | | | The function ngx_quic_shutdown_connection() waits until all non-cancelable streams are closed, and then closes the connection. In HTTP/3 cancelable streams are all unidirectional streams except push streams. The function is called from HTTP/3 when client reaches keepalive_requests.
* HTTP/3: send GOAWAY when last request is accepted.Roman Arutyunyan2021-03-15
| | | | | The last request in connection is determined according to the keepalive_requests directive. Requests beyond keepalive_requests are rejected.
* HTTP/3: limited client header size.Roman Arutyunyan2021-02-17
| | | | | The limit is the size of all large client header buffers. Client header size is the total size of all client header names and values.
* HTTP/3: introduced ngx_http_v3_parse_t structure.Roman Arutyunyan2021-02-17
| | | | | | | | The structure is used to parse an HTTP/3 request. An object of this type is added to ngx_http_request_t instead of h3_parse generic pointer. Also, the new field is located outside of the request ephemeral zone to keep it safe after request headers are parsed.
* HTTP/3: fixed format specifier.Roman Arutyunyan2021-02-01
|
* HTTP/3: refactored request body parser.Roman Arutyunyan2021-01-25
| | | | | | | | The change reduces diff to the default branch for src/http/ngx_http_request_body.c. Also, client Content-Length, if present, is now checked against the real body size sent by client.
* HTTP/3: call ngx_handle_read_event() from client header handler.Roman Arutyunyan2021-01-29
| | | | | | | | | | | | | This function should be called at the end of an event handler to prepare the event for the next handler call. Particularly, the "active" flag is set or cleared depending on data availability. With this call missing in one code path, read handler was not called again after handling the initial part of the client request, if the request was too big to fit into a single STREAM frame. Now ngx_handle_read_event() is called in this code path. Also, read timer is restarted.
* HTTP/3: client header validation.Roman Arutyunyan2021-01-18
| | | | | | | | | | A header with the name containing null, CR, LF, colon or uppercase characters, is now considered an error. A header with the value containing null, CR or LF, is also considered an error. Also, header is considered invalid unless its name only contains lowercase characters, digits, minus and optionally underscore. Such header can be optionally ignored.
generated by cgit v1.2.3 (git 2.25.1) at 2025-05-20 01:39:19 +0000