Mercurial > hg > nginx-quic
annotate src/event/quic/ngx_event_quic.h @ 8717:e06283038ec8 quic
QUIC: clear SSL_OP_ENABLE_MIDDLEBOX_COMPAT on SSL context switch.
The SSL_OP_ENABLE_MIDDLEBOX_COMPAT option is provided by QuicTLS and enabled
by default in the newly created SSL contexts. SSL_set_quic_method() is used
to clear it, which is required for SSL handshake to work on QUIC connections.
Switching context in the ngx_http_ssl_servername() SNI callback overrides SSL
options from the new SSL context. This results in the option set again.
Fix is to explicitly clear it when switching to another SSL context.
Initially reported here (in Russian):
http://mailman.nginx.org/pipermail/nginx-ru/2021-November/063989.html
author | Sergey Kandaurov <pluknet@nginx.com> |
---|---|
date | Tue, 07 Dec 2021 15:49:51 +0300 |
parents | d6ef13c5fd8e |
children | 56dec0d4e5b1 |
rev | line source |
---|---|
7633
5d91389e0fd3
Initial QUIC support in http.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff
changeset
|
1 |
5d91389e0fd3
Initial QUIC support in http.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff
changeset
|
2 /* |
7648
b28ea685a56e
Moved all QUIC code into ngx_event_quic.c
Vladimir Homutov <vl@nginx.com>
parents:
7647
diff
changeset
|
3 * Copyright (C) Nginx, Inc. |
7633
5d91389e0fd3
Initial QUIC support in http.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff
changeset
|
4 */ |
5d91389e0fd3
Initial QUIC support in http.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff
changeset
|
5 |
5d91389e0fd3
Initial QUIC support in http.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff
changeset
|
6 |
5d91389e0fd3
Initial QUIC support in http.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff
changeset
|
7 #ifndef _NGX_EVENT_QUIC_H_INCLUDED_ |
5d91389e0fd3
Initial QUIC support in http.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff
changeset
|
8 #define _NGX_EVENT_QUIC_H_INCLUDED_ |
5d91389e0fd3
Initial QUIC support in http.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff
changeset
|
9 |
5d91389e0fd3
Initial QUIC support in http.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff
changeset
|
10 |
7824
a5141e6b3214
Fixed includes in quic headers.
Roman Arutyunyan <arut@nginx.com>
parents:
7822
diff
changeset
|
11 #include <ngx_config.h> |
a5141e6b3214
Fixed includes in quic headers.
Roman Arutyunyan <arut@nginx.com>
parents:
7822
diff
changeset
|
12 #include <ngx_core.h> |
7636
53a5cdbe500c
QUIC add_handshake_data callback, varint routines.
Sergey Kandaurov <pluknet@nginx.com>
parents:
7635
diff
changeset
|
13 |
7687
69345a26ba69
Split transport and crypto parts into separate files.
Vladimir Homutov <vl@nginx.com>
parents:
7681
diff
changeset
|
14 |
7910
125cbfa77013
Renamed max_packet_size to max_udp_payload_size, from draft-28.
Sergey Kandaurov <pluknet@nginx.com>
parents:
7860
diff
changeset
|
15 #define NGX_QUIC_MAX_UDP_PAYLOAD_SIZE 65527 |
7927
391d06a51bc0
Limited max udp payload size for outgoing packets.
Vladimir Homutov <vl@nginx.com>
parents:
7913
diff
changeset
|
16 |
7731
d45325e90221
Limit output QUIC packets with client max_packet_size.
Roman Arutyunyan <arut@nginx.com>
parents:
7729
diff
changeset
|
17 #define NGX_QUIC_DEFAULT_ACK_DELAY_EXPONENT 3 |
d45325e90221
Limit output QUIC packets with client max_packet_size.
Roman Arutyunyan <arut@nginx.com>
parents:
7729
diff
changeset
|
18 #define NGX_QUIC_DEFAULT_MAX_ACK_DELAY 25 |
8287
cef042935003
QUIC: the "quic_host_key" directive.
Vladimir Homutov <vl@nginx.com>
parents:
8279
diff
changeset
|
19 #define NGX_QUIC_DEFAULT_HOST_KEY_LEN 32 |
cef042935003
QUIC: the "quic_host_key" directive.
Vladimir Homutov <vl@nginx.com>
parents:
8279
diff
changeset
|
20 #define NGX_QUIC_SR_KEY_LEN 32 |
cef042935003
QUIC: the "quic_host_key" directive.
Vladimir Homutov <vl@nginx.com>
parents:
8279
diff
changeset
|
21 #define NGX_QUIC_AV_KEY_LEN 32 |
7731
d45325e90221
Limit output QUIC packets with client max_packet_size.
Roman Arutyunyan <arut@nginx.com>
parents:
7729
diff
changeset
|
22 |
8407 | 23 #define NGX_QUIC_SR_TOKEN_LEN 16 |
7832
ad3a6f069498
Added proper handling of connection close phases.
Vladimir Homutov <vl@nginx.com>
parents:
7829
diff
changeset
|
24 |
7822
6481427ca3fc
Respecting maximum packet size.
Vladimir Homutov <vl@nginx.com>
parents:
7811
diff
changeset
|
25 #define NGX_QUIC_MIN_INITIAL_SIZE 1200 |
6481427ca3fc
Respecting maximum packet size.
Vladimir Homutov <vl@nginx.com>
parents:
7811
diff
changeset
|
26 |
7746
b364af7f9f3f
Removed ngx_quic_stream_node_t.
Roman Arutyunyan <arut@nginx.com>
parents:
7739
diff
changeset
|
27 #define NGX_QUIC_STREAM_SERVER_INITIATED 0x01 |
b364af7f9f3f
Removed ngx_quic_stream_node_t.
Roman Arutyunyan <arut@nginx.com>
parents:
7739
diff
changeset
|
28 #define NGX_QUIC_STREAM_UNIDIRECTIONAL 0x02 |
b364af7f9f3f
Removed ngx_quic_stream_node_t.
Roman Arutyunyan <arut@nginx.com>
parents:
7739
diff
changeset
|
29 |
7713
e9891e8ee975
Configurable transport parameters.
Vladimir Homutov <vl@nginx.com>
parents:
7690
diff
changeset
|
30 |
7811
72d20158c814
Added reordering support for STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents:
7748
diff
changeset
|
31 typedef struct { |
8101
bed310672f39
QUIC: moved ssl configuration pointer to quic configuration.
Vladimir Homutov <vl@nginx.com>
parents:
8100
diff
changeset
|
32 ngx_ssl_t *ssl; |
8713
d6ef13c5fd8e
QUIC: simplified configuration.
Vladimir Homutov <vl@nginx.com>
parents:
8695
diff
changeset
|
33 |
7999
0d2b2664b41c
QUIC: added "quic" listen parameter.
Roman Arutyunyan <arut@nginx.com>
parents:
7998
diff
changeset
|
34 ngx_flag_t retry; |
8540
8ab0d609af09
QUIC: the "quic_gso" directive.
Vladimir Homutov <vl@nginx.com>
parents:
8492
diff
changeset
|
35 ngx_flag_t gso_enabled; |
8713
d6ef13c5fd8e
QUIC: simplified configuration.
Vladimir Homutov <vl@nginx.com>
parents:
8695
diff
changeset
|
36 ngx_flag_t disable_active_migration; |
d6ef13c5fd8e
QUIC: simplified configuration.
Vladimir Homutov <vl@nginx.com>
parents:
8695
diff
changeset
|
37 ngx_msec_t timeout; |
8287
cef042935003
QUIC: the "quic_host_key" directive.
Vladimir Homutov <vl@nginx.com>
parents:
8279
diff
changeset
|
38 ngx_str_t host_key; |
8713
d6ef13c5fd8e
QUIC: simplified configuration.
Vladimir Homutov <vl@nginx.com>
parents:
8695
diff
changeset
|
39 size_t mtu; |
d6ef13c5fd8e
QUIC: simplified configuration.
Vladimir Homutov <vl@nginx.com>
parents:
8695
diff
changeset
|
40 size_t stream_buffer_size; |
d6ef13c5fd8e
QUIC: simplified configuration.
Vladimir Homutov <vl@nginx.com>
parents:
8695
diff
changeset
|
41 ngx_uint_t max_concurrent_streams_bidi; |
d6ef13c5fd8e
QUIC: simplified configuration.
Vladimir Homutov <vl@nginx.com>
parents:
8695
diff
changeset
|
42 ngx_uint_t max_concurrent_streams_uni; |
8695
41caf5410110
QUIC: reject streams which we could not create.
Roman Arutyunyan <arut@nginx.com>
parents:
8684
diff
changeset
|
43 ngx_int_t stream_close_code; |
41caf5410110
QUIC: reject streams which we could not create.
Roman Arutyunyan <arut@nginx.com>
parents:
8684
diff
changeset
|
44 ngx_int_t stream_reject_code_uni; |
41caf5410110
QUIC: reject streams which we could not create.
Roman Arutyunyan <arut@nginx.com>
parents:
8684
diff
changeset
|
45 ngx_int_t stream_reject_code_bidi; |
8713
d6ef13c5fd8e
QUIC: simplified configuration.
Vladimir Homutov <vl@nginx.com>
parents:
8695
diff
changeset
|
46 |
8287
cef042935003
QUIC: the "quic_host_key" directive.
Vladimir Homutov <vl@nginx.com>
parents:
8279
diff
changeset
|
47 u_char av_token_key[NGX_QUIC_AV_KEY_LEN]; |
cef042935003
QUIC: the "quic_host_key" directive.
Vladimir Homutov <vl@nginx.com>
parents:
8279
diff
changeset
|
48 u_char sr_token_key[NGX_QUIC_SR_KEY_LEN]; |
7999
0d2b2664b41c
QUIC: added "quic" listen parameter.
Roman Arutyunyan <arut@nginx.com>
parents:
7998
diff
changeset
|
49 } ngx_quic_conf_t; |
0d2b2664b41c
QUIC: added "quic" listen parameter.
Roman Arutyunyan <arut@nginx.com>
parents:
7998
diff
changeset
|
50 |
0d2b2664b41c
QUIC: added "quic" listen parameter.
Roman Arutyunyan <arut@nginx.com>
parents:
7998
diff
changeset
|
51 |
7674
4ae9ac69ab93
HTTP/QUIC interface reworked.
Vladimir Homutov <vl@nginx.com>
parents:
7648
diff
changeset
|
52 struct ngx_quic_stream_s { |
7811
72d20158c814
Added reordering support for STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents:
7748
diff
changeset
|
53 ngx_rbtree_node_t node; |
8552
fe919fd63b0b
QUIC: client certificate validation with OCSP.
Sergey Kandaurov <pluknet@nginx.com>
parents:
8540
diff
changeset
|
54 ngx_queue_t queue; |
7811
72d20158c814
Added reordering support for STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents:
7748
diff
changeset
|
55 ngx_connection_t *parent; |
8420
baf9551b4a5b
QUIC: renamed stream field from c to connection.
Roman Arutyunyan <arut@nginx.com>
parents:
8415
diff
changeset
|
56 ngx_connection_t *connection; |
7811
72d20158c814
Added reordering support for STREAM frames.
Vladimir Homutov <vl@nginx.com>
parents:
7748
diff
changeset
|
57 uint64_t id; |
7841
eee307399229
QUIC basic congestion control.
Roman Arutyunyan <arut@nginx.com>
parents:
7837
diff
changeset
|
58 uint64_t acked; |
7842
fab75acb1f72
Respect MAX_DATA and MAX_STREAM_DATA from QUIC client.
Roman Arutyunyan <arut@nginx.com>
parents:
7841
diff
changeset
|
59 uint64_t send_max_data; |
8439
f52a2b77d406
QUIC: generic buffering for stream input.
Roman Arutyunyan <arut@nginx.com>
parents:
8420
diff
changeset
|
60 uint64_t recv_max_data; |
8442
b3f6ad181df4
QUIC: refactored CRYPTO and STREAM buffer ordering.
Roman Arutyunyan <arut@nginx.com>
parents:
8439
diff
changeset
|
61 uint64_t recv_offset; |
8492
af33d1ef1c3c
QUIC: stream flow control refactored.
Roman Arutyunyan <arut@nginx.com>
parents:
8489
diff
changeset
|
62 uint64_t recv_window; |
8443
60c6e8d8d3ae
QUIC: make sure stream data size is lower than final size.
Roman Arutyunyan <arut@nginx.com>
parents:
8442
diff
changeset
|
63 uint64_t recv_last; |
8442
b3f6ad181df4
QUIC: refactored CRYPTO and STREAM buffer ordering.
Roman Arutyunyan <arut@nginx.com>
parents:
8439
diff
changeset
|
64 uint64_t final_size; |
8439
f52a2b77d406
QUIC: generic buffering for stream input.
Roman Arutyunyan <arut@nginx.com>
parents:
8420
diff
changeset
|
65 ngx_chain_t *in; |
8359
fc64ab301bad
QUIC: connection shutdown.
Roman Arutyunyan <arut@nginx.com>
parents:
8323
diff
changeset
|
66 ngx_uint_t cancelable; /* unsigned cancelable:1; */ |
7674
4ae9ac69ab93
HTTP/QUIC interface reworked.
Vladimir Homutov <vl@nginx.com>
parents:
7648
diff
changeset
|
67 }; |
4ae9ac69ab93
HTTP/QUIC interface reworked.
Vladimir Homutov <vl@nginx.com>
parents:
7648
diff
changeset
|
68 |
7634 | 69 |
8101
bed310672f39
QUIC: moved ssl configuration pointer to quic configuration.
Vladimir Homutov <vl@nginx.com>
parents:
8100
diff
changeset
|
70 void ngx_quic_run(ngx_connection_t *c, ngx_quic_conf_t *conf); |
8013
455a8536eaa7
QUIC: limited the number of server-initiated streams.
Roman Arutyunyan <arut@nginx.com>
parents:
8001
diff
changeset
|
71 ngx_connection_t *ngx_quic_open_stream(ngx_connection_t *c, ngx_uint_t bidi); |
7953
e0f92f68e018
QUIC: Introduced ngx_quic_finalize_connection().
Roman Arutyunyan <arut@nginx.com>
parents:
7933
diff
changeset
|
72 void ngx_quic_finalize_connection(ngx_connection_t *c, ngx_uint_t err, |
e0f92f68e018
QUIC: Introduced ngx_quic_finalize_connection().
Roman Arutyunyan <arut@nginx.com>
parents:
7933
diff
changeset
|
73 const char *reason); |
8359
fc64ab301bad
QUIC: connection shutdown.
Roman Arutyunyan <arut@nginx.com>
parents:
8323
diff
changeset
|
74 void ngx_quic_shutdown_connection(ngx_connection_t *c, ngx_uint_t err, |
fc64ab301bad
QUIC: connection shutdown.
Roman Arutyunyan <arut@nginx.com>
parents:
8323
diff
changeset
|
75 const char *reason); |
8296
d710c457171c
QUIC: added ability to reset a stream.
Sergey Kandaurov <pluknet@nginx.com>
parents:
8287
diff
changeset
|
76 ngx_int_t ngx_quic_reset_stream(ngx_connection_t *c, ngx_uint_t err); |
8679
b4c7853b0488
QUIC: added shutdown support in stream proxy.
Vladimir Homutov <vl@nginx.com>
parents:
8617
diff
changeset
|
77 ngx_int_t ngx_quic_shutdown_stream(ngx_connection_t *c, int how); |
8196
e0947c952d43
QUIC: multiple versions support in ALPN.
Sergey Kandaurov <pluknet@nginx.com>
parents:
8195
diff
changeset
|
78 uint32_t ngx_quic_version(ngx_connection_t *c); |
8617
9ae239d2547d
QUIC: separate event handling functions.
Roman Arutyunyan <arut@nginx.com>
parents:
8552
diff
changeset
|
79 ngx_int_t ngx_quic_handle_read_event(ngx_event_t *rev, ngx_uint_t flags); |
9ae239d2547d
QUIC: separate event handling functions.
Roman Arutyunyan <arut@nginx.com>
parents:
8552
diff
changeset
|
80 ngx_int_t ngx_quic_handle_write_event(ngx_event_t *wev, size_t lowat); |
8198
45db1b5c1706
QUIC: connection multiplexing per port.
Roman Arutyunyan <arut@nginx.com>
parents:
8196
diff
changeset
|
81 ngx_int_t ngx_quic_get_packet_dcid(ngx_log_t *log, u_char *data, size_t len, |
45db1b5c1706
QUIC: connection multiplexing per port.
Roman Arutyunyan <arut@nginx.com>
parents:
8196
diff
changeset
|
82 ngx_str_t *dcid); |
8415
b4e6b7049984
QUIC: normalize header inclusion.
Sergey Kandaurov <pluknet@nginx.com>
parents:
8414
diff
changeset
|
83 ngx_int_t ngx_quic_derive_key(ngx_log_t *log, const char *label, |
b4e6b7049984
QUIC: normalize header inclusion.
Sergey Kandaurov <pluknet@nginx.com>
parents:
8414
diff
changeset
|
84 ngx_str_t *secret, ngx_str_t *salt, u_char *out, size_t len); |
7633
5d91389e0fd3
Initial QUIC support in http.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff
changeset
|
85 |
5d91389e0fd3
Initial QUIC support in http.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff
changeset
|
86 #endif /* _NGX_EVENT_QUIC_H_INCLUDED_ */ |