aboutsummaryrefslogtreecommitdiff
path: root/src
Commit message (Collapse)AuthorAge
...
| * | | | | | | | | | | | QUIC: limited the total number of frames.Roman Arutyunyan2021-10-13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Exceeding 10000 allocated frames is considered a flood.
| * | | | | | | | | | | | QUIC: traffic-based flood detection.Roman Arutyunyan2021-10-13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With this patch, all traffic over a QUIC connection is compared to traffic over QUIC streams. As long as total traffic is many times larger than stream traffic, we consider this to be a flood.
| * | | | | | | | | | | | HTTP/3: traffic-based flood detection.Roman Arutyunyan2021-10-07
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With this patch, all traffic over HTTP/3 bidi and uni streams is counted in the h3c->total_bytes field, and payload traffic is counted in the h3c->payload_bytes field. As long as total traffic is many times larger than payload traffic, we consider this to be a flood. Request header traffic is counted as if all fields are literal. Response header traffic is counted as is.
| * | | | | | | | | | | | HTTP/3: fixed request length calculation.Roman Arutyunyan2021-10-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously, when request was blocked, r->request_length was not updated.
| * | | | | | | | | | | | HTTP/3: removed client-side encoder support.Roman Arutyunyan2021-10-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Dynamic tables are not used when generating responses anyway.
| * | | | | | | | | | | | QUIC: attempt decrypt before checking for stateless reset.Martin Duke2021-10-12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Checking the reset after encryption avoids false positives. More importantly, it avoids the check entirely in the usual case where decryption succeeds. RFC 9000, 10.3.1 Detecting a Stateless Reset Endpoints MAY skip this check if any packet from a datagram is successfully processed.
| * | | | | | | | | | | | QUIC: Check if CID has been used in stateless reset checkMartin Duke2021-10-12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Section 10.3.1 of RFC9000 requires this check.
| * | | | | | | | | | | | QUIC: send RESET_STREAM in response to STOP_SENDING.Roman Arutyunyan2021-09-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As per RFC 9000: An endpoint that receives a STOP_SENDING frame MUST send a RESET_STREAM frame if the stream is in the "Ready" or "Send" state. An endpoint SHOULD copy the error code from the STOP_SENDING frame to the RESET_STREAM frame it sends, but it can use any application error code.
| * | | | | | | | | | | | QUIC: reset stream only once.Roman Arutyunyan2021-09-22
| | | | | | | | | | | | |
| * | | | | | | | | | | | HTTP/3: reset streams with incomplete responses or timeouts.Roman Arutyunyan2021-09-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This prevents client from closing the QUIC connection due to response parse error.
| * | | | | | | | | | | | Added r->response_sent flag.Roman Arutyunyan2021-09-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The flag indicates that the entire response was sent to the socket up to the last_buf flag. The flag is only usable for protocol implementations that call ngx_http_write_filter() from header filter, such as HTTP/1.x and HTTP/3.
| * | | | | | | | | | | | Stream: fixed segfault when using SSL certificates with variables.Sergey Kandaurov2021-09-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Similar to the previous change, a segmentation fault occurres when evaluating SSL certificates on a QUIC connection due to an uninitialized stream session. The fix is to adjust initializing the QUIC part of a connection until after it has session and variables initialized. Similarly, this appends logging error context for QUIC connections: - client 127.0.0.1:54749 connected to 127.0.0.1:8880 while handling frames - quic client timed out (60: Operation timed out) while handling quic input
| * | | | | | | | | | | | HTTP/3: fixed segfault when using SSL certificates with variables.Sergey Kandaurov2021-09-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A QUIC connection doesn't have c->log->data and friends initialized to sensible values. Yet, a request can be created in the certificate callback with such an assumption, which leads to a segmentation fault due to null pointer dereference in ngx_http_free_request(). The fix is to adjust initializing the QUIC part of a connection such that it has all of that in place. Further, this appends logging error context for unsuccessful QUIC handshakes: - cannot load certificate .. while handling frames - SSL_do_handshake() failed .. while sending frames
| * | | | | | | | | | | | Stream: detect "listen .. quic" without TLSv1.3.Sergey Kandaurov2021-09-29
| | | | | | | | | | | | |
| * | | | | | | | | | | | Fixed mismerge of ssl_reject_handshake in 71b7453fb11f.Sergey Kandaurov2021-09-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In particular, this fixes rejecting "listen .. quic|http3" configurations without TLSv1.3 configured.
| * | | | | | | | | | | | HTTP/3: fixed server push after ea9b645472b5.Sergey Kandaurov2021-09-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Unlike in HTTP/2, both "host" and ":authority" reside in r->headers_in.server.
| * | | | | | | | | | | | QUIC: moved a variable initialization near to its use.Sergey Kandaurov2021-09-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This tends to produce slightly more optimal code with pos == NULL when built with Clang on low optimization levels. Spotted by Ruslan Ermilov.
| * | | | | | | | | | | | Configure: check for QUIC 0-RTT support at compile time.Ruslan Ermilov2021-09-27
| | | | | | | | | | | | |
| * | | | | | | | | | | | HTTP/3: fixed null pointer dereference with server push.Sergey Kandaurov2021-09-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | See details for HTTP/2 fix in 8b0553239592 for a complete description.
| * | | | | | | | | | | | HTTP/3: fixed ngx_stat_active counter.Roman Arutyunyan2021-09-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously the counter was not incremented for HTTP/3 streams, but still decremented in ngx_http_close_connection(). There are two solutions here, one is to increment the counter for HTTP/3 streams, and the other one is not to decrement the counter for HTTP/3 streams. The latter solution looks inconsistent with ngx_stat_reading/ngx_stat_writing, which are incremented on a per-request basis. The change adds ngx_stat_active increment for HTTP/3 request and push streams.
| * | | | | | | | | | | | HTTP/3: fixed pushed request finalization in case of error.Roman Arutyunyan2021-09-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously request could be finalized twice. For example, this could happen if "Host" header was invalid.
| * | | | | | | | | | | | QUIC: set NGX_TCP_NODELAY_DISABLED for fake stream connections.Sergey Kandaurov2021-09-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Notably, it is to avoid setting the TCP_NODELAY flag for QUIC streams in ngx_http_upstream_send_response(). It is an invalid operation on inherently SOCK_DGRAM sockets, which leads to QUIC connection close. The change reduces diff to the default branch in stream content phase.
| * | | | | | | | | | | | QUIC: simplified stream fd initialization.Roman Arutyunyan2021-09-21
| | | | | | | | | | | | |
| * | | | | | | | | | | | HTTP/3: make ngx_http_log_error() static again.Roman Arutyunyan2021-09-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This function was only referenced from ngx_http_v3_create_push_request() to initialize push connection log. Now the log handler is copied from the parent request connection. The change reduces diff to the default branch.
| * | | | | | | | | | | | QUIC: separate event handling functions.Roman Arutyunyan2021-09-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The functions ngx_quic_handle_read_event() and ngx_quic_handle_write_event() are added. Previously this code was a part of ngx_handle_read_event() and ngx_handle_write_event(). The change simplifies ngx_handle_read_event() and ngx_handle_write_event() by moving QUIC-related code to a QUIC source file.
| * | | | | | | | | | | | HTTP/3: added CONNECT and TRACE methods rejection.Sergey Kandaurov2021-09-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It has got lost in e1eb7f4ca9f1, let alone a subsequent update in 63c66b7cc07c.
| * | | | | | | | | | | | Removed NGX_OPENSSL_QUIC macro, NGX_QUIC is enough.Ruslan Ermilov2021-09-14
| | | | | | | | | | | | |
| * | | | | | | | | | | | HTTP/3: added debug logging of response fields.Sergey Kandaurov2021-09-13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Because of QPACK compression it's hard to see what fields are actually sent by the server.
| * | | | | | | | | | | | HTTP/3: Huffman encoding for the Location response field.Sergey Kandaurov2021-09-13
| | | | | | | | | | | | |
| * | | | | | | | | | | | HTTP/3: Huffman encoding for the Last-Modified response field.Sergey Kandaurov2021-09-13
| | | | | | | | | | | | |
| * | | | | | | | | | | | HTTP/3: Huffman encoding for the Content-Type response field.Sergey Kandaurov2021-09-13
| | | | | | | | | | | | |
| * | | | | | | | | | | | HTTP/3: implemented QPACK Huffman encoding for response fields.Sergey Kandaurov2021-09-13
| | | | | | | | | | | | |
| * | | | | | | | | | | | HTTP/3: reading body buffering in filters.Roman Arutyunyan2021-09-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This change follows similar changes in HTTP/1 and HTTP/2 in 9cf043a5d9ca.
| * | | | | | | | | | | | QUIC: removed Firefox workaround for trailing zeroes in datagrams.Sergey Kandaurov2021-09-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This became unnecessary after discarding invalid packets since a6784cf32c13.
| * | | | | | | | | | | | QUIC: macro style.Ruslan Ermilov2021-09-09
| | | | | | | | | | | | |
| * | | | | | | | | | | | Merged with the default branch.Sergey Kandaurov2021-09-08
| |\ \ \ \ \ \ \ \ \ \ \ \
| * | | | | | | | | | | | | QUIC: store QUIC connection fd in stream fake connection.Roman Arutyunyan2021-09-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously it had -1 as fd. This fixes proxying, which relies on downstream connection having a real fd. Also, this reduces diff to the default branch for ngx_close_connection().
| * | | | | | | | | | | | | QUIC: fixed null pointer dereference in MAX_DATA handler.Mariano Di Martino2021-09-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If a MAX_DATA frame was received before any stream was created, then the worker process would crash in nginx_quic_handle_max_data_frame() while traversing the stream tree. The issue is solved by adding a check that makes sure the tree is not empty.
| * | | | | | | | | | | | | Merged with the default branch.Sergey Kandaurov2021-09-01
| |\ \ \ \ \ \ \ \ \ \ \ \ \
| * | | | | | | | | | | | | | HTTP/3: bulk parse functions.Roman Arutyunyan2021-07-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously HTTP/3 streams were parsed by one character. Now all parse functions receive buffers. This should optimize parsing time and CPU load.
| * | | | | | | | | | | | | | QUIC: Stateless Reset Token debug logging cleanup.Sergey Kandaurov2021-08-24
| | | | | | | | | | | | | | |
| * | | | | | | | | | | | | | QUIC: removed duplicate logging of Stateless Reset Token.Sergey Kandaurov2021-08-24
| | | | | | | | | | | | | | |
| * | | | | | | | | | | | | | HTTP/3: fixed dead store assignment.Sergey Kandaurov2021-08-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Found by Clang Static Analyzer.
| * | | | | | | | | | | | | | QUIC: fixed dead store assignment.Sergey Kandaurov2021-08-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Found by Clang Static Analyzer.
| * | | | | | | | | | | | | | QUIC: fixed format specifiers in ngx_quic_bpf module.Sergey Kandaurov2021-08-17
| | | | | | | | | | | | | | |
| * | | | | | | | | | | | | | HTTP/3: disabled control characters and space in header names.Sergey Kandaurov2021-08-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is a follow up to 41f4bd4c51f1.
| * | | | | | | | | | | | | | HTTP/3: got rid of HTTP/2 module dependency.Vladimir Homutov2021-08-05
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Huffman encoder/decoder now can be built separately from HTTP/2 module.
| * | | | | | | | | | | | | | HTTP/3: replaced macros with values.Roman Arutyunyan2021-08-04
| | | | | | | | | | | | | | |
| * | | | | | | | | | | | | | QUIC: asynchronous shutdown.Roman Arutyunyan2021-08-05
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously, when cleaning up a QUIC stream in shutdown mode, ngx_quic_shutdown_quic() was called, which could close the QUIC connection right away. This could be a problem if the connection was referenced up the stack. For example, this could happen in ngx_quic_init_streams(), ngx_quic_close_streams(), ngx_quic_create_client_stream() etc. With a typical HTTP/3 client the issue is unlikely because of HTTP/3 uni streams which need a posted event to close. In this case QUIC connection cannot be closed right away. Now QUIC connection read event is posted and it will shut down the connection asynchronously.
| * | | | | | | | | | | | | | QUIC: client certificate validation with OCSP.Sergey Kandaurov2021-08-04
| | | | | | | | | | | | | | |
generated by cgit v1.2.3 (git 2.25.1) at 2025-07-06 21:02:13 +0000