Mercurial > hg > nginx
annotate src/event/quic/ngx_event_quic_tokens.h @ 9295:c5623963c29e
Upstream: fixed proxy_no_cache when caching errors.
Caching errors, notably intercepted errors and internally generated
502/504 errors, as well as handling of cache revalidation with 304,
did not take into account u->conf->no_cache predicates configured.
As a result, an error might be cached even if configuration explicitly
says not to. Fix is to check u->conf->no_cache in these cases.
To simplify usage in multiple places, checking u->conf->no_cache is now
done in a separate function. As a minor optimization, u->conf->no_cache
is only checked if u->cacheable is set.
As a side effect, this change also fixes caching errors after
proxy_cache_bypass. Also, during cache revalidation u->cacheable is
now tested, so 304 responses which disable caching won't extend
cacheability of stored responses.
Additionally, when caching internally generated 502/504 errors
u->cacheable is now explicitly updated from u->headers_in.no_cache and
u->headers_in.expired, restoring the behaviour before 8041:0784ab86ad08
(1.23.0) when an error happens while reading the response headers.
Reported by Kirill A. Korinsky,
https://freenginx.org/pipermail/nginx/2024-April/000082.html
author | Maxim Dounin <mdounin@mdounin.ru> |
---|---|
date | Tue, 25 Jun 2024 21:44:50 +0300 |
parents | 77c1418916f7 |
children |
rev | line source |
---|---|
8752
e19723c40d28
QUIC: separate files for tokens related processing.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
1 |
e19723c40d28
QUIC: separate files for tokens related processing.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
2 /* |
e19723c40d28
QUIC: separate files for tokens related processing.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
3 * Copyright (C) Nginx, Inc. |
e19723c40d28
QUIC: separate files for tokens related processing.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
4 */ |
e19723c40d28
QUIC: separate files for tokens related processing.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
5 |
e19723c40d28
QUIC: separate files for tokens related processing.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
6 |
e19723c40d28
QUIC: separate files for tokens related processing.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
7 #ifndef _NGX_EVENT_QUIC_TOKENS_H_INCLUDED_ |
e19723c40d28
QUIC: separate files for tokens related processing.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
8 #define _NGX_EVENT_QUIC_TOKENS_H_INCLUDED_ |
e19723c40d28
QUIC: separate files for tokens related processing.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
9 |
e19723c40d28
QUIC: separate files for tokens related processing.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
10 |
e19723c40d28
QUIC: separate files for tokens related processing.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
11 #include <ngx_config.h> |
e19723c40d28
QUIC: separate files for tokens related processing.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
12 #include <ngx_core.h> |
e19723c40d28
QUIC: separate files for tokens related processing.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
13 |
e19723c40d28
QUIC: separate files for tokens related processing.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
14 |
9026
3550b00d9dc8
QUIC: avoided pool usage in token calculation.
Vladimir Homutov <vl@nginx.com>
parents:
8763
diff
changeset
|
15 #define NGX_QUIC_MAX_TOKEN_SIZE 64 |
3550b00d9dc8
QUIC: avoided pool usage in token calculation.
Vladimir Homutov <vl@nginx.com>
parents:
8763
diff
changeset
|
16 /* SHA-1(addr)=20 + sizeof(time_t) + retry(1) + odcid.len(1) + odcid */ |
3550b00d9dc8
QUIC: avoided pool usage in token calculation.
Vladimir Homutov <vl@nginx.com>
parents:
8763
diff
changeset
|
17 |
9132
77c1418916f7
QUIC: use AEAD to encrypt address validation tokens.
Roman Arutyunyan <arut@nginx.com>
parents:
9026
diff
changeset
|
18 #define NGX_QUIC_AES_256_GCM_IV_LEN 12 |
77c1418916f7
QUIC: use AEAD to encrypt address validation tokens.
Roman Arutyunyan <arut@nginx.com>
parents:
9026
diff
changeset
|
19 #define NGX_QUIC_AES_256_GCM_TAG_LEN 16 |
9026
3550b00d9dc8
QUIC: avoided pool usage in token calculation.
Vladimir Homutov <vl@nginx.com>
parents:
8763
diff
changeset
|
20 |
9132
77c1418916f7
QUIC: use AEAD to encrypt address validation tokens.
Roman Arutyunyan <arut@nginx.com>
parents:
9026
diff
changeset
|
21 #define NGX_QUIC_TOKEN_BUF_SIZE (NGX_QUIC_AES_256_GCM_IV_LEN \ |
9026
3550b00d9dc8
QUIC: avoided pool usage in token calculation.
Vladimir Homutov <vl@nginx.com>
parents:
8763
diff
changeset
|
22 + NGX_QUIC_MAX_TOKEN_SIZE \ |
9132
77c1418916f7
QUIC: use AEAD to encrypt address validation tokens.
Roman Arutyunyan <arut@nginx.com>
parents:
9026
diff
changeset
|
23 + NGX_QUIC_AES_256_GCM_TAG_LEN) |
9026
3550b00d9dc8
QUIC: avoided pool usage in token calculation.
Vladimir Homutov <vl@nginx.com>
parents:
8763
diff
changeset
|
24 |
3550b00d9dc8
QUIC: avoided pool usage in token calculation.
Vladimir Homutov <vl@nginx.com>
parents:
8763
diff
changeset
|
25 |
8752
e19723c40d28
QUIC: separate files for tokens related processing.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
26 ngx_int_t ngx_quic_new_sr_token(ngx_connection_t *c, ngx_str_t *cid, |
e19723c40d28
QUIC: separate files for tokens related processing.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
27 u_char *secret, u_char *token); |
9026
3550b00d9dc8
QUIC: avoided pool usage in token calculation.
Vladimir Homutov <vl@nginx.com>
parents:
8763
diff
changeset
|
28 ngx_int_t ngx_quic_new_token(ngx_log_t *log, struct sockaddr *sockaddr, |
8763
4117aa7fa38e
QUIC: connection migration.
Vladimir Homutov <vl@nginx.com>
parents:
8752
diff
changeset
|
29 socklen_t socklen, u_char *key, ngx_str_t *token, ngx_str_t *odcid, |
4117aa7fa38e
QUIC: connection migration.
Vladimir Homutov <vl@nginx.com>
parents:
8752
diff
changeset
|
30 time_t expires, ngx_uint_t is_retry); |
8752
e19723c40d28
QUIC: separate files for tokens related processing.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
31 ngx_int_t ngx_quic_validate_token(ngx_connection_t *c, |
e19723c40d28
QUIC: separate files for tokens related processing.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
32 u_char *key, ngx_quic_header_t *pkt); |
e19723c40d28
QUIC: separate files for tokens related processing.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
33 |
e19723c40d28
QUIC: separate files for tokens related processing.
Vladimir Homutov <vl@nginx.com>
parents:
diff
changeset
|
34 #endif /* _NGX_EVENT_QUIC_TOKENS_H_INCLUDED_ */ |