aboutsummaryrefslogtreecommitdiff
path: root/src
Commit message (Collapse)AuthorAge
...
| * QUIC: resized input datagram buffer from 65535 to 65527.Roman Arutyunyan2023-05-11
| | | | | | | | The value of 65527 is the maximum permitted UDP payload size.
| * QUIC: keep stream sockaddr and addr_text constant.Roman Arutyunyan2023-05-11
| | | | | | | | | | | | | | | | | | | | | | | | HTTP and Stream variables $remote_addr and $binary_remote_addr rely on constant client address, particularly because they are cacheable. However, QUIC client may migrate to a new address. While there's no perfect way to handle this, the proposed solution is to copy client address to QUIC stream at stream creation. The change also fixes truncated $remote_addr if migration happened while the stream was active. The reason is addr_text string was copied to stream by value.
| * QUIC: set c->socklen for streams.Roman Arutyunyan2023-04-27
| | | | | | | | | | | | Previously, the value was not set and remained zero. While in nginx code the value of c->sockaddr is accessed without taking c->socklen into account, invalid c->socklen could lead to unexpected results in third-party modules.
| * QUIC: fixed addr_text after migration (ticket #2488).Roman Arutyunyan2023-04-27
| | | | | | | | | | | | Previously, the post-migration value of addr_text could be truncated, if it was longer than the previous one. Also, the new value always included port, which should not be there.
| * QUIC: reschedule path validation on path insertion/removal.Sergey Kandaurov2023-05-09
| | | | | | | | | | | | Two issues fixed: - new path validation could be scheduled late - a validated path could leave a spurious timer
| * QUIC: lower bound path validation PTO.Sergey Kandaurov2023-05-09
| | | | | | | | | | | | | | | | | | | | | | According to RFC 9000, 8.2.4. Failed Path Validation, the following value is recommended as a validation timeout: A value of three times the larger of the current PTO or the PTO for the new path (using kInitialRtt, as defined in [QUIC-RECOVERY]) is RECOMMENDED. The change adds PTO of the new path to the equation as the lower bound.
| * QUIC: separated path validation retransmit backoff.Sergey Kandaurov2023-05-09
| | | | | | | | | | | | | | | | Path validation packets containing PATH_CHALLENGE frames are sent separately from regular frame queue, because of the need to use a decicated path and pad the packets. The packets are sent periodically, separately from the regular probe/lost detection mechanism. A path validation packet is resent up to 3 times, each time after PTO expiration, with increasing per-path PTO backoff.
| * QUIC: removed check for in-flight packets in computing PTO.Sergey Kandaurov2023-05-09
| | | | | | | | | | | | | | | | | | | | | | | | The check is needed for clients in order to unblock a server due to anti-amplification limits, and it seems to make no sense for servers. See RFC 9002, A.6 and A.8 for a further explanation. This makes max_ack_delay to now always account, notably including PATH_CHALLENGE timers as noted in the last paragraph of 9000, 9.4, unlike when it was only used when there are packets in flight. While here, fixed nearby style.
| * QUIC: disabled datagram fragmentation.Roman Arutyunyan2023-05-06
| | | | | | | | | | | | As per RFC 9000, Section 14: UDP datagrams MUST NOT be fragmented at the IP layer.
| * QUIC: fixed encryption level in ngx_quic_frame_sendto().Roman Arutyunyan2023-05-04
| | | | | | | | | | | | | | | | | | Previously, ssl_encryption_application was hardcoded. Before 9553eea74f2a, ngx_quic_frame_sendto() was used only for PATH_CHALLENGE/PATH_RESPONSE sent at the application level only. Since 9553eea74f2a, ngx_quic_frame_sendto() is also used for CONNECTION_CLOSE, which can be sent at initial level after SSL handshake error or rejection. This resulted in packet encryption error. Now level is copied from frame, which fixes the error.
| * QUIC: optimized immediate close.Roman Arutyunyan2023-05-02
| | | | | | | | | | | | | | | | | | | | Previously, before sending CONNECTION_CLOSE to client, all pending frames were sent. This is redundant and could prevent CONNECTION_CLOSE from being sent due to congestion control. Now pending frames are freed and CONNECTION_CLOSE is sent without congestion control, as advised by RFC 9002: Packets containing frames besides ACK or CONNECTION_CLOSE frames count toward congestion control limits and are considered to be in flight.
| * QUIC: fixed split frames error handling.Sergey Kandaurov2023-05-04
| | | | | | | | | | | | | | Do not corrupt frame data chain pointer on ngx_quic_read_buffer() error. The error leads to closing a QUIC connection where the frame may be used as part of the QUIC connection tear down, which envolves writing pending frames, including this one.
| * HTTP/3: fixed ngx_http_v3_init_session() error handling.Sergey Kandaurov2023-05-04
| | | | | | | | A QUIC connection is not usable yet at this early stage of spin up.
| * Stream: allow waiting on a blocked QUIC stream (ticket #2479).Roman Arutyunyan2023-04-06
| | | | | | | | | | | | | | | | | | | | | | Previously, waiting on a shared connection was not allowed, because the only type of such connection was plain UDP. However, QUIC stream connections are also shared since they share socket descriptor with the listen connection. Meanwhile, it's perfectly normal to wait on such connections. The issue manifested itself with stream write errors when the amount of data exceeded stream buffer size or flow control. Now no error is triggered and Stream write module is allowed to wait for buffer space to become available.
| * HTTP/3: fixed CANCEL_PUSH handling.Sergey Kandaurov2023-04-06
| |
| * QUIC: optimized sending stream response.Roman Arutyunyan2023-04-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When a stream is created by client, it's often the case that nginx will send immediate response on that stream. An example is HTTP/3 request stream, which in most cases quickly replies with at least HTTP headers. QUIC stream init handlers are called from a posted event. Output QUIC frames are also sent to client from a posted event, called the push event. If the push event is posted before the stream init event, then output produced by stream may trigger sending an extra UDP datagram. To address this, push event is now re-posted when a new stream init event is posted. An example is handling 0-RTT packets. Client typically sends an init packet coalesced with a 0-RTT packet. Previously, nginx replied with a padded CRYPTO datagram, followed by a 1-RTT stream reply datagram. Now CRYPTO and STREAM packets are coalesced in one reply datagram, which saves bandwidth. Other examples include coalescing 1-RTT first stream response, and MAX_STREAMS/STREAM sent in response to ACK/STREAM.
| * Merged with the default branch.Sergey Kandaurov2023-03-29
| |\
| * | QUIC: style.Roman Arutyunyan2023-03-15
| | |
| * | HTTP/3: fixed OpenSSL compatibility layer initialization.Sergey Kandaurov2023-03-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | SSL context is not present if the default server has neither certificates nor ssl_reject_handshake enabled. Previously, this led to null pointer dereference before it would be caught with configuration checks. Additionally, non-default servers with distinct SSL contexts need to initialize compatibility layer in order to complete a QUIC handshake.
| * | HTTP/3: trigger more compatibility errors for "listen quic".Roman Arutyunyan2023-01-26
| | | | | | | | | | | | | | | Now "ssl", "proxy_protocol" and "http2" are not allowed with "quic" in "listen" directive. Previously, only "ssl" was not allowed.
| * | HTTP/3: "quic" parameter of "listen" directive.Roman Arutyunyan2023-02-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | Now "listen" directve has a new "quic" parameter which enables QUIC protocol for the address. Further, to enable HTTP/3, a new directive "http3" is introduced. The hq-interop protocol is enabled by "http3_hq" as before. Now application protocol is chosen by ALPN. Previously used "http3" parameter of "listen" is deprecated.
| * | QUIC: OpenSSL compatibility layer.Roman Arutyunyan2023-02-22
| | | | | | | | | | | | | | | | | | The change allows to compile QUIC with OpenSSL which lacks BoringSSL QUIC API. This implementation does not support 0-RTT.
| * | QUIC: improved ssl_reject_handshake error logging.Sergey Kandaurov2023-02-23
| | | | | | | | | | | | The check follows the ngx_ssl_handshake() change in 59e1c73fe02b.
| * | QUIC: using ngx_ssl_handshake_log().Sergey Kandaurov2023-02-23
| | |
| * | QUIC: moved "handshake failed" reason to send_alert.Sergey Kandaurov2023-02-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A QUIC handshake failure breaks down into several cases: - a handshake error which leads to a send_alert call - an error triggered by the add_handshake_data callback - internal errors (allocation etc) Previously, in the first case, only error code was set in the send_alert callback. Now the "handshake failed" reason phrase is set there as well. In the second case, both code and reason are set by add_handshake_data. In the last case, setting reason phrase is removed: returning NGX_ERROR now leads to closing the connection with just INTERNAL_ERROR. Reported by Jiuzhou Cui.
| * | QUIC: using NGX_QUIC_ERR_CRYPTO macro in ALPN checks.Sergey Kandaurov2023-02-23
| | | | | | | | | | | | Patch by Jiuzhou Cui.
| * | QUIC: fixed indentation.Sergey Kandaurov2023-02-13
| | |
| * | QUIC: fixed broken token in NEW_TOKEN (ticket #2446).Roman Arutyunyan2023-01-31
| | | | | | | | | | | | | | | | | | Previously, since 3550b00d9dc8, the token was allocated on stack, to get rid of pool usage. Now the token is allocated by ngx_quic_copy_buffer() in QUIC buffers, also used for STREAM, CRYPTO and ACK frames.
| * | QUIC: ngx_quic_copy_buffer() function.Roman Arutyunyan2023-01-31
| | | | | | | | | | | | | | | The function copies passed data to QUIC buffer chain and returns it. The chain can be used in ngx_quic_frame_t data field.
| * | QUIC: defer setting the active flag for client stream events.Sergey Kandaurov2023-01-18
| | | | | | | | | | | | | | | | | | | | | Specifically, now it is kept unset until streams are initialized. Notably, this unbreaks OCSP with client certificates after 35e27117b593. Previously, the read event could be posted prematurely via ngx_quic_set_event() e.g., as part of handling a STREAM frame.
| * | QUIC: relocated ngx_quic_init_streams() for 0-RTT.Roman Arutyunyan2023-01-10
| | | | | | | | | | | | | | | | | | | | | Previously, streams were initialized in early keys handler. However, client transport parameters may not be available by then. This happens, for example, when using QuicTLS. Now streams are initialized in ngx_quic_crypto_input() after calling SSL_do_handshake() for both 0-RTT and 1-RTT.
| * | HTTP/3: insert count block timeout.Roman Arutyunyan2023-01-05
| | | | | | | | | | | | | | | | | | Previously, there was no timeout for a request stream blocked on insert count, which could result in infinite wait. Now client_header_timeout is set when stream is first blocked.
| * | HTTP/3: trigger 400 (Bad Request) on stream error while blocked.Roman Arutyunyan2023-01-05
| | | | | | | | | | | | | | | Previously, stream was closed with NGX_HTTP_CLOSE. However, in a similar case when recv() returns eof or error, status 400 is triggered.
| * | QUIC: set stream error flag on reset.Roman Arutyunyan2023-01-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Now, when RESET_STREAM is sent or received, or when streams are closed, stream connection error flag is set. Previously, only stream state was changed, which resulted in setting the error flag only after calling recv()/send()/send_chain(). However, there are cases when none of these functions is called, but it's still important to know if the stream is being closed. For example, when an HTTP/3 request stream is blocked on insert count, receiving RESET_STREAM should trigger stream closure, which was not the case. The change also fixes ngx_http_upstream_check_broken_connection() and ngx_http_test_reading() with QUIC streams.
| * | QUIC: automatically add and never delete stream events.Roman Arutyunyan2023-01-10
| | | | | | | | | | | | | | | | | | | | | Previously, stream events were added and deleted by ngx_handle_read_event() and ngx_handle_write_event() in a way similar to level-triggered events. However, QUIC stream events are effectively edge-triggered and can stay active all time. Moreover, the events are now active since the moment a stream is created.
| * | HTTP/3: fixed $connection_time.Sergey Kandaurov2023-01-10
| | | | | | | | | | | | | | | | | | Previously, start_time wasn't set for a new stream. The fix is to derive it from the parent connection. Also it's used to simplify tracking keepalive_time.
| * | HTTP/3: handled insertion reference to a going to be evicted entry.Roman Arutyunyan2023-01-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As per RFC 9204, section 3.2.2, a new entry can reference an entry in the dynamic table that will be evicted when adding this new entry into the dynamic table. Previously, such inserts resulted in use-after-free since the old entry was evicted before the insertion (ticket #2431). Now it's evicted after the insertion. This change fixes Insert with Name Reference and Duplicate encoder instructions.
| * | Merged with the default branch.Sergey Kandaurov2023-01-02
| |\ \
| * \ \ Merged with the default branch.Sergey Kandaurov2022-12-15
| |\ \ \
| * | | | HTTP/3: implement keepalive for hq.Roman Arutyunyan2022-10-25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously, keepalive timer was deleted in ngx_http_v3_wait_request_handler() and set in request cleanup handler. This worked for HTTP/3 connections, but not for hq connections. Now keepalive timer is deleted in ngx_http_v3_init_request_stream() and set in connection cleanup handler, which works both for HTTP/3 and hq.
| * | | | QUIC: application init() callback.Roman Arutyunyan2022-11-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It's called after handshake completion or prior to the first early data stream creation. The callback should initialize application-level data before creating streams. HTTP/3 callback implementation sets keepalive timer and sends SETTINGS. Also, this allows to limit max handshake time in ngx_http_v3_init_stream().
| * | | | HTTP/3: renamed functions.Roman Arutyunyan2022-08-22
| | | | | | | | | | | | | | | | | | | | | | | | | ngx_http_v3_init() is renamed ngx_http_v3_init_stream(). ngx_http_v3_reset_connection() is renamed to ngx_http_v3_reset_stream().
| * | | | QUIC: removed cancelable flag from QUIC and HTTP/3 events.Roman Arutyunyan2022-11-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | All these events are created in context of a client connection and are deleted when the connection is closed. Setting ev->cancelable could trigger premature connection closure and a socket leak alert.
| * | | | QUIC: idle mode for main connection.Roman Arutyunyan2022-10-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Now main QUIC connection for HTTP/3 always has c->idle flag set. This allows the connection to receive worker shutdown notification. It is passed to application level via a new conf->shutdown() callback. The HTTP/3 shutdown callback sends GOAWAY to client and gracefully shuts down the QUIC connection.
| * | | | HTTP/3: unified hq code with regular HTTP/3 code.Roman Arutyunyan2022-10-19
| | | | | | | | | | | | | | | | | | | | | | | | | The change removes hq-specific request handler. Now hq requests are handled by the HTTP/3 request handler.
| * | | | QUIC: do not send MAX_STREAMS in shutdown state.Roman Arutyunyan2022-09-07
| | | | | | | | | | | | | | | | | | | | No more streams are expected from client.
| * | | | QUIC: defer stream removal until all its data is acked.Roman Arutyunyan2022-08-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously, stream was kept alive until all its data is sent. This resulted in disabling retransmission of final part of stream when QUIC connection was closed right after closing stream connection.
| * | | | QUIC: reusable mode for main connection.Roman Arutyunyan2022-11-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The connection is automatically switched to this mode by transport layer when there are no non-cancelable streams. Currently, cancelable streams are HTTP/3 encoder/decoder/control streams.
| * | | | QUIC: post close event for connection close.Roman Arutyunyan2022-09-07
| | | | | | | | | | | | | | | | | | | | | | | | | Previously, close event was used only for close timeout, while read event was used for posting connection close.
| * | | | QUIC: made ngx_quic_finalize_connecion() more graceful.Roman Arutyunyan2022-08-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously, ngx_quic_finalize_connection() closed the connection with NGX_ERROR code, which resulted in immediate connection closure. Now the code is NGX_OK, which provides a more graceful shutdown with a timeout.
generated by cgit v1.2.3 (git 2.25.1) at 2025-07-15 04:53:11 +0000