aboutsummaryrefslogtreecommitdiff
path: root/src
Commit message (Collapse)AuthorAge
...
| * | | | | | | | | | | | QUIC: style.Sergey Kandaurov2021-10-26
| | | | | | | | | | | | |
| * | | | | | | | | | | | QUIC: speeding up processing 0-RTT.Sergey Kandaurov2021-10-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | After fe919fd63b0b, processing QUIC streams was postponed until after handshake completion, which means that 0-RTT is effectively off. With ssl_ocsp enabled, it could be further delayed. This differs from how OCSP validation works with SSL_read_early_data(). With this change, processing QUIC streams is unlocked when obtaining 0-RTT secret.
| * | | | | | | | | | | | QUIC: refactored OCSP validation in preparation for 0-RTT support.Sergey Kandaurov2021-10-26
| | | | | | | | | | | | |
| * | | | | | | | | | | | QUIC: switched to integer arithmetic in rtt calculations.Vladimir Homutov2021-10-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | RFC 9002 uses constants implying effective implementation, i.e. using bit shift operations instead of floating point.
| * | | | | | | | | | | | QUIC: optimized ack range processing.Vladimir Homutov2021-10-15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The sent queue is sorted by packet number. It is possible to avoid traversing full queue while handling ack ranges. It makes sense to start traversing from the queue head (i.e. check oldest packets first).
| * | | | | | | | | | | | QUIC: limited the total number of frames.Roman Arutyunyan2021-10-13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Exceeding 10000 allocated frames is considered a flood.
| * | | | | | | | | | | | QUIC: traffic-based flood detection.Roman Arutyunyan2021-10-13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With this patch, all traffic over a QUIC connection is compared to traffic over QUIC streams. As long as total traffic is many times larger than stream traffic, we consider this to be a flood.
| * | | | | | | | | | | | HTTP/3: traffic-based flood detection.Roman Arutyunyan2021-10-07
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With this patch, all traffic over HTTP/3 bidi and uni streams is counted in the h3c->total_bytes field, and payload traffic is counted in the h3c->payload_bytes field. As long as total traffic is many times larger than payload traffic, we consider this to be a flood. Request header traffic is counted as if all fields are literal. Response header traffic is counted as is.
| * | | | | | | | | | | | HTTP/3: fixed request length calculation.Roman Arutyunyan2021-10-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously, when request was blocked, r->request_length was not updated.
| * | | | | | | | | | | | HTTP/3: removed client-side encoder support.Roman Arutyunyan2021-10-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Dynamic tables are not used when generating responses anyway.
| * | | | | | | | | | | | QUIC: attempt decrypt before checking for stateless reset.Martin Duke2021-10-12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Checking the reset after encryption avoids false positives. More importantly, it avoids the check entirely in the usual case where decryption succeeds. RFC 9000, 10.3.1 Detecting a Stateless Reset Endpoints MAY skip this check if any packet from a datagram is successfully processed.
| * | | | | | | | | | | | QUIC: Check if CID has been used in stateless reset checkMartin Duke2021-10-12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Section 10.3.1 of RFC9000 requires this check.
| * | | | | | | | | | | | QUIC: send RESET_STREAM in response to STOP_SENDING.Roman Arutyunyan2021-09-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As per RFC 9000: An endpoint that receives a STOP_SENDING frame MUST send a RESET_STREAM frame if the stream is in the "Ready" or "Send" state. An endpoint SHOULD copy the error code from the STOP_SENDING frame to the RESET_STREAM frame it sends, but it can use any application error code.
| * | | | | | | | | | | | QUIC: reset stream only once.Roman Arutyunyan2021-09-22
| | | | | | | | | | | | |
| * | | | | | | | | | | | HTTP/3: reset streams with incomplete responses or timeouts.Roman Arutyunyan2021-09-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This prevents client from closing the QUIC connection due to response parse error.
| * | | | | | | | | | | | Added r->response_sent flag.Roman Arutyunyan2021-09-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The flag indicates that the entire response was sent to the socket up to the last_buf flag. The flag is only usable for protocol implementations that call ngx_http_write_filter() from header filter, such as HTTP/1.x and HTTP/3.
| * | | | | | | | | | | | Stream: fixed segfault when using SSL certificates with variables.Sergey Kandaurov2021-09-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Similar to the previous change, a segmentation fault occurres when evaluating SSL certificates on a QUIC connection due to an uninitialized stream session. The fix is to adjust initializing the QUIC part of a connection until after it has session and variables initialized. Similarly, this appends logging error context for QUIC connections: - client 127.0.0.1:54749 connected to 127.0.0.1:8880 while handling frames - quic client timed out (60: Operation timed out) while handling quic input
| * | | | | | | | | | | | HTTP/3: fixed segfault when using SSL certificates with variables.Sergey Kandaurov2021-09-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A QUIC connection doesn't have c->log->data and friends initialized to sensible values. Yet, a request can be created in the certificate callback with such an assumption, which leads to a segmentation fault due to null pointer dereference in ngx_http_free_request(). The fix is to adjust initializing the QUIC part of a connection such that it has all of that in place. Further, this appends logging error context for unsuccessful QUIC handshakes: - cannot load certificate .. while handling frames - SSL_do_handshake() failed .. while sending frames
| * | | | | | | | | | | | Stream: detect "listen .. quic" without TLSv1.3.Sergey Kandaurov2021-09-29
| | | | | | | | | | | | |
| * | | | | | | | | | | | Fixed mismerge of ssl_reject_handshake in 71b7453fb11f.Sergey Kandaurov2021-09-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In particular, this fixes rejecting "listen .. quic|http3" configurations without TLSv1.3 configured.
| * | | | | | | | | | | | HTTP/3: fixed server push after ea9b645472b5.Sergey Kandaurov2021-09-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Unlike in HTTP/2, both "host" and ":authority" reside in r->headers_in.server.
| * | | | | | | | | | | | QUIC: moved a variable initialization near to its use.Sergey Kandaurov2021-09-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This tends to produce slightly more optimal code with pos == NULL when built with Clang on low optimization levels. Spotted by Ruslan Ermilov.
| * | | | | | | | | | | | Configure: check for QUIC 0-RTT support at compile time.Ruslan Ermilov2021-09-27
| | | | | | | | | | | | |
| * | | | | | | | | | | | HTTP/3: fixed null pointer dereference with server push.Sergey Kandaurov2021-09-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | See details for HTTP/2 fix in 8b0553239592 for a complete description.
| * | | | | | | | | | | | HTTP/3: fixed ngx_stat_active counter.Roman Arutyunyan2021-09-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously the counter was not incremented for HTTP/3 streams, but still decremented in ngx_http_close_connection(). There are two solutions here, one is to increment the counter for HTTP/3 streams, and the other one is not to decrement the counter for HTTP/3 streams. The latter solution looks inconsistent with ngx_stat_reading/ngx_stat_writing, which are incremented on a per-request basis. The change adds ngx_stat_active increment for HTTP/3 request and push streams.
| * | | | | | | | | | | | HTTP/3: fixed pushed request finalization in case of error.Roman Arutyunyan2021-09-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously request could be finalized twice. For example, this could happen if "Host" header was invalid.
| * | | | | | | | | | | | QUIC: set NGX_TCP_NODELAY_DISABLED for fake stream connections.Sergey Kandaurov2021-09-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Notably, it is to avoid setting the TCP_NODELAY flag for QUIC streams in ngx_http_upstream_send_response(). It is an invalid operation on inherently SOCK_DGRAM sockets, which leads to QUIC connection close. The change reduces diff to the default branch in stream content phase.
| * | | | | | | | | | | | QUIC: simplified stream fd initialization.Roman Arutyunyan2021-09-21
| | | | | | | | | | | | |
| * | | | | | | | | | | | HTTP/3: make ngx_http_log_error() static again.Roman Arutyunyan2021-09-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This function was only referenced from ngx_http_v3_create_push_request() to initialize push connection log. Now the log handler is copied from the parent request connection. The change reduces diff to the default branch.
| * | | | | | | | | | | | QUIC: separate event handling functions.Roman Arutyunyan2021-09-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The functions ngx_quic_handle_read_event() and ngx_quic_handle_write_event() are added. Previously this code was a part of ngx_handle_read_event() and ngx_handle_write_event(). The change simplifies ngx_handle_read_event() and ngx_handle_write_event() by moving QUIC-related code to a QUIC source file.
| * | | | | | | | | | | | HTTP/3: added CONNECT and TRACE methods rejection.Sergey Kandaurov2021-09-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It has got lost in e1eb7f4ca9f1, let alone a subsequent update in 63c66b7cc07c.
| * | | | | | | | | | | | Removed NGX_OPENSSL_QUIC macro, NGX_QUIC is enough.Ruslan Ermilov2021-09-14
| | | | | | | | | | | | |
| * | | | | | | | | | | | HTTP/3: added debug logging of response fields.Sergey Kandaurov2021-09-13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Because of QPACK compression it's hard to see what fields are actually sent by the server.
| * | | | | | | | | | | | HTTP/3: Huffman encoding for the Location response field.Sergey Kandaurov2021-09-13
| | | | | | | | | | | | |
| * | | | | | | | | | | | HTTP/3: Huffman encoding for the Last-Modified response field.Sergey Kandaurov2021-09-13
| | | | | | | | | | | | |
| * | | | | | | | | | | | HTTP/3: Huffman encoding for the Content-Type response field.Sergey Kandaurov2021-09-13
| | | | | | | | | | | | |
| * | | | | | | | | | | | HTTP/3: implemented QPACK Huffman encoding for response fields.Sergey Kandaurov2021-09-13
| | | | | | | | | | | | |
| * | | | | | | | | | | | HTTP/3: reading body buffering in filters.Roman Arutyunyan2021-09-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This change follows similar changes in HTTP/1 and HTTP/2 in 9cf043a5d9ca.
| * | | | | | | | | | | | QUIC: removed Firefox workaround for trailing zeroes in datagrams.Sergey Kandaurov2021-09-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This became unnecessary after discarding invalid packets since a6784cf32c13.
| * | | | | | | | | | | | QUIC: macro style.Ruslan Ermilov2021-09-09
| | | | | | | | | | | | |
| * | | | | | | | | | | | Merged with the default branch.Sergey Kandaurov2021-09-08
| |\ \ \ \ \ \ \ \ \ \ \ \
| * | | | | | | | | | | | | QUIC: store QUIC connection fd in stream fake connection.Roman Arutyunyan2021-09-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously it had -1 as fd. This fixes proxying, which relies on downstream connection having a real fd. Also, this reduces diff to the default branch for ngx_close_connection().
| * | | | | | | | | | | | | QUIC: fixed null pointer dereference in MAX_DATA handler.Mariano Di Martino2021-09-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If a MAX_DATA frame was received before any stream was created, then the worker process would crash in nginx_quic_handle_max_data_frame() while traversing the stream tree. The issue is solved by adding a check that makes sure the tree is not empty.
| * | | | | | | | | | | | | Merged with the default branch.Sergey Kandaurov2021-09-01
| |\ \ \ \ \ \ \ \ \ \ \ \ \
| * | | | | | | | | | | | | | HTTP/3: bulk parse functions.Roman Arutyunyan2021-07-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously HTTP/3 streams were parsed by one character. Now all parse functions receive buffers. This should optimize parsing time and CPU load.
| * | | | | | | | | | | | | | QUIC: Stateless Reset Token debug logging cleanup.Sergey Kandaurov2021-08-24
| | | | | | | | | | | | | | |
| * | | | | | | | | | | | | | QUIC: removed duplicate logging of Stateless Reset Token.Sergey Kandaurov2021-08-24
| | | | | | | | | | | | | | |
| * | | | | | | | | | | | | | HTTP/3: fixed dead store assignment.Sergey Kandaurov2021-08-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Found by Clang Static Analyzer.
| * | | | | | | | | | | | | | QUIC: fixed dead store assignment.Sergey Kandaurov2021-08-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Found by Clang Static Analyzer.
| * | | | | | | | | | | | | | QUIC: fixed format specifiers in ngx_quic_bpf module.Sergey Kandaurov2021-08-17
| | | | | | | | | | | | | | |
generated by cgit v1.2.3 (git 2.25.1) at 2025-07-17 04:07:52 +0000