annotate src/event/quic/ngx_event_quic_migration.h @ 8913:40445fc7c403 quic

QUIC: fixed migration during NAT rebinding. The RFC 9000 allows a packet from known CID arrive from unknown path: These requirements regarding connection ID reuse apply only to the sending of packets, as unintentional changes in path without a change in connection ID are possible. For example, after a period of network inactivity, NAT rebinding might cause packets to be sent on a new path when the client resumes sending. Before the patch, such packets were rejected with an error in the ngx_quic_check_migration() function. Removing the check makes the separate function excessive - remaining checks are early migration check and "disable_active_migration" check. The latter is a transport parameter sent to client and it should not be used by server. The server should send "disable_active_migration" "if the endpoint does not support active connection migration" (18.2). The support status depends on nginx configuration: to have migration working with multiple workers, you need bpf helper, available on recent Linux systems. The patch does not set "disable_active_migration" automatically and leaves it for the administrator. By default, active migration is enabled. RFC 900 says that it is ok to migrate if the peer violates "disable_active_migration" flag requirements: If the peer violates this requirement, the endpoint MUST either drop the incoming packets on that path without generating a Stateless Reset OR proceed with path validation and allow the peer to migrate. Generating a Stateless Reset or closing the connection would allow third parties in the network to cause connections to close by spoofing or otherwise manipulating observed traffic. So, nginx adheres to the second option and proceeds to path validation. Note: The ngtcp2 may be used for testing both active migration and NAT rebinding: ngtcp2/client --change-local-addr=200ms --delay-stream=500ms <ip> <port> <url> ngtcp2/client --change-local-addr=200ms --delay-stream=500ms --nat-rebinding \ <ip> <port> <url>
author Vladimir Homutov <vl@nginx.com>
date Mon, 29 Nov 2021 11:51:14 +0300
parents 5186ee5a94b9
children ddd5e5c0f87d
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
8737
76f476ce4d31 QUIC: distinct files for connection migration.
Vladimir Homutov <vl@nginx.com>
parents:
diff changeset
1
76f476ce4d31 QUIC: distinct files for connection migration.
Vladimir Homutov <vl@nginx.com>
parents:
diff changeset
2 /*
76f476ce4d31 QUIC: distinct files for connection migration.
Vladimir Homutov <vl@nginx.com>
parents:
diff changeset
3 * Copyright (C) Nginx, Inc.
76f476ce4d31 QUIC: distinct files for connection migration.
Vladimir Homutov <vl@nginx.com>
parents:
diff changeset
4 */
76f476ce4d31 QUIC: distinct files for connection migration.
Vladimir Homutov <vl@nginx.com>
parents:
diff changeset
5
76f476ce4d31 QUIC: distinct files for connection migration.
Vladimir Homutov <vl@nginx.com>
parents:
diff changeset
6
76f476ce4d31 QUIC: distinct files for connection migration.
Vladimir Homutov <vl@nginx.com>
parents:
diff changeset
7 #ifndef _NGX_EVENT_QUIC_MIGRATION_H_INCLUDED_
76f476ce4d31 QUIC: distinct files for connection migration.
Vladimir Homutov <vl@nginx.com>
parents:
diff changeset
8 #define _NGX_EVENT_QUIC_MIGRATION_H_INCLUDED_
76f476ce4d31 QUIC: distinct files for connection migration.
Vladimir Homutov <vl@nginx.com>
parents:
diff changeset
9
76f476ce4d31 QUIC: distinct files for connection migration.
Vladimir Homutov <vl@nginx.com>
parents:
diff changeset
10
76f476ce4d31 QUIC: distinct files for connection migration.
Vladimir Homutov <vl@nginx.com>
parents:
diff changeset
11 #include <ngx_config.h>
76f476ce4d31 QUIC: distinct files for connection migration.
Vladimir Homutov <vl@nginx.com>
parents:
diff changeset
12 #include <ngx_core.h>
76f476ce4d31 QUIC: distinct files for connection migration.
Vladimir Homutov <vl@nginx.com>
parents:
diff changeset
13
8763
4117aa7fa38e QUIC: connection migration.
Vladimir Homutov <vl@nginx.com>
parents: 8747
diff changeset
14 #define NGX_QUIC_PATH_RETRIES 3
4117aa7fa38e QUIC: connection migration.
Vladimir Homutov <vl@nginx.com>
parents: 8747
diff changeset
15
4117aa7fa38e QUIC: connection migration.
Vladimir Homutov <vl@nginx.com>
parents: 8747
diff changeset
16 #define NGX_QUIC_PATH_NEW 0
4117aa7fa38e QUIC: connection migration.
Vladimir Homutov <vl@nginx.com>
parents: 8747
diff changeset
17 #define NGX_QUIC_PATH_VALIDATING 1
4117aa7fa38e QUIC: connection migration.
Vladimir Homutov <vl@nginx.com>
parents: 8747
diff changeset
18 #define NGX_QUIC_PATH_VALIDATED 2
4117aa7fa38e QUIC: connection migration.
Vladimir Homutov <vl@nginx.com>
parents: 8747
diff changeset
19
4117aa7fa38e QUIC: connection migration.
Vladimir Homutov <vl@nginx.com>
parents: 8747
diff changeset
20 #define NGX_QUIC_PATH_VALID_TIME 600 /* seconds */
4117aa7fa38e QUIC: connection migration.
Vladimir Homutov <vl@nginx.com>
parents: 8747
diff changeset
21
4117aa7fa38e QUIC: connection migration.
Vladimir Homutov <vl@nginx.com>
parents: 8747
diff changeset
22
4117aa7fa38e QUIC: connection migration.
Vladimir Homutov <vl@nginx.com>
parents: 8747
diff changeset
23 #define ngx_quic_path_state_str(p) \
4117aa7fa38e QUIC: connection migration.
Vladimir Homutov <vl@nginx.com>
parents: 8747
diff changeset
24 ((p)->state == NGX_QUIC_PATH_NEW) ? "new" : \
4117aa7fa38e QUIC: connection migration.
Vladimir Homutov <vl@nginx.com>
parents: 8747
diff changeset
25 (((p)->state == NGX_QUIC_PATH_VALIDATED) ? "validated" : "validating")
4117aa7fa38e QUIC: connection migration.
Vladimir Homutov <vl@nginx.com>
parents: 8747
diff changeset
26
8737
76f476ce4d31 QUIC: distinct files for connection migration.
Vladimir Homutov <vl@nginx.com>
parents:
diff changeset
27
76f476ce4d31 QUIC: distinct files for connection migration.
Vladimir Homutov <vl@nginx.com>
parents:
diff changeset
28 ngx_int_t ngx_quic_handle_path_challenge_frame(ngx_connection_t *c,
8778
5186ee5a94b9 QUIC: simplified sending 1-RTT only frames.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8763
diff changeset
29 ngx_quic_path_challenge_frame_t *f);
8737
76f476ce4d31 QUIC: distinct files for connection migration.
Vladimir Homutov <vl@nginx.com>
parents:
diff changeset
30 ngx_int_t ngx_quic_handle_path_response_frame(ngx_connection_t *c,
8778
5186ee5a94b9 QUIC: simplified sending 1-RTT only frames.
Sergey Kandaurov <pluknet@nginx.com>
parents: 8763
diff changeset
31 ngx_quic_path_challenge_frame_t *f);
8737
76f476ce4d31 QUIC: distinct files for connection migration.
Vladimir Homutov <vl@nginx.com>
parents:
diff changeset
32
8913
40445fc7c403 QUIC: fixed migration during NAT rebinding.
Vladimir Homutov <vl@nginx.com>
parents: 8778
diff changeset
33 ngx_quic_path_t *ngx_quic_find_path(ngx_connection_t *c,
40445fc7c403 QUIC: fixed migration during NAT rebinding.
Vladimir Homutov <vl@nginx.com>
parents: 8778
diff changeset
34 struct sockaddr *sockaddr, socklen_t socklen);
8763
4117aa7fa38e QUIC: connection migration.
Vladimir Homutov <vl@nginx.com>
parents: 8747
diff changeset
35 ngx_quic_path_t *ngx_quic_add_path(ngx_connection_t *c,
4117aa7fa38e QUIC: connection migration.
Vladimir Homutov <vl@nginx.com>
parents: 8747
diff changeset
36 struct sockaddr *sockaddr, socklen_t socklen);
4117aa7fa38e QUIC: connection migration.
Vladimir Homutov <vl@nginx.com>
parents: 8747
diff changeset
37
4117aa7fa38e QUIC: connection migration.
Vladimir Homutov <vl@nginx.com>
parents: 8747
diff changeset
38 ngx_int_t ngx_quic_update_paths(ngx_connection_t *c, ngx_quic_header_t *pkt);
4117aa7fa38e QUIC: connection migration.
Vladimir Homutov <vl@nginx.com>
parents: 8747
diff changeset
39 ngx_int_t ngx_quic_handle_migration(ngx_connection_t *c,
4117aa7fa38e QUIC: connection migration.
Vladimir Homutov <vl@nginx.com>
parents: 8747
diff changeset
40 ngx_quic_header_t *pkt);
4117aa7fa38e QUIC: connection migration.
Vladimir Homutov <vl@nginx.com>
parents: 8747
diff changeset
41
4117aa7fa38e QUIC: connection migration.
Vladimir Homutov <vl@nginx.com>
parents: 8747
diff changeset
42 void ngx_quic_path_validation_handler(ngx_event_t *ev);
4117aa7fa38e QUIC: connection migration.
Vladimir Homutov <vl@nginx.com>
parents: 8747
diff changeset
43
8747
c8bda5e1e662 QUIC: headers cleanup.
Vladimir Homutov <vl@nginx.com>
parents: 8737
diff changeset
44 #endif /* _NGX_EVENT_QUIC_MIGRATION_H_INCLUDED_ */