view src/event/ngx_event_quic.h @ 8634:831d1960826f quic

QUIC: generate default stateless reset token key. Previously, if quic_stateless_reset_token_key was empty or unspecified, initial stateless reset token was not generated. However subsequent tokens were generated with empty key, which resulted in error with certain SSL libraries, for example OpenSSL. Now a random 32-byte stateless reset token key is generated if none is specified in the configuration. As a result, stateless reset tokens are now generated for all server ids.
author Roman Arutyunyan <arut@nginx.com>
date Wed, 11 Nov 2020 21:08:48 +0000
parents feec2cc762f6
children dbad2d6d1898
line wrap: on
line source


/*
 * Copyright (C) Nginx, Inc.
 */


#ifndef _NGX_EVENT_QUIC_H_INCLUDED_
#define _NGX_EVENT_QUIC_H_INCLUDED_


#include <ngx_config.h>
#include <ngx_core.h>


/* Supported drafts: 27, 28, 29 */
#ifndef NGX_QUIC_DRAFT_VERSION
#define NGX_QUIC_DRAFT_VERSION               29
#endif

#define NGX_QUIC_MAX_SHORT_HEADER            25 /* 1 flags + 20 dcid + 4 pn */
#define NGX_QUIC_MAX_LONG_HEADER             56
    /* 1 flags + 4 version + 2 x (1 + 20) s/dcid + 4 pn + 4 len + token len */

#define NGX_QUIC_MAX_UDP_PAYLOAD_SIZE        65527
#define NGX_QUIC_MAX_UDP_PAYLOAD_OUT         1252
#define NGX_QUIC_MAX_UDP_PAYLOAD_OUT6        1232

#define NGX_QUIC_DEFAULT_ACK_DELAY_EXPONENT  3
#define NGX_QUIC_DEFAULT_MAX_ACK_DELAY       25
#define NGX_QUIC_DEFAULT_SRT_KEY_LEN         32

#define NGX_QUIC_RETRY_TIMEOUT               3000
#define NGX_QUIC_RETRY_LIFETIME              30000
#define NGX_QUIC_RETRY_BUFFER_SIZE           128
    /* 1 flags + 4 version + 3 x (1 + 20) s/o/dcid + itag + token(44) */
#define NGX_QUIC_MAX_TOKEN_SIZE              32
    /* sizeof(struct in6_addr) + sizeof(ngx_msec_t) up to AES-256 block size */

/* quic-recovery, section 6.2.2, kInitialRtt */
#define NGX_QUIC_INITIAL_RTT                 333 /* ms */

/* quic-recovery, section 6.1.1, Packet Threshold */
#define NGX_QUIC_PKT_THR                     3 /* packets */
/* quic-recovery, section 6.1.2, Time Threshold */
#define NGX_QUIC_TIME_THR                    1.125
#define NGX_QUIC_TIME_GRANULARITY            1 /* ms */

#define NGX_QUIC_CC_MIN_INTERVAL             1000 /* 1s */

#define NGX_QUIC_MIN_INITIAL_SIZE            1200

#define NGX_QUIC_STREAM_SERVER_INITIATED     0x01
#define NGX_QUIC_STREAM_UNIDIRECTIONAL       0x02

#define NGX_QUIC_STREAM_BUFSIZE              65536

#define NGX_QUIC_MAX_CID_LEN                 20
#define NGX_QUIC_SERVER_CID_LEN              NGX_QUIC_MAX_CID_LEN

#define NGX_QUIC_SR_TOKEN_LEN                16

#define NGX_QUIC_MAX_SERVER_IDS              8

#define ngx_quic_get_connection(c)           ((ngx_quic_connection_t *)(c)->udp)


typedef struct {
    /* configurable */
    ngx_msec_t                 max_idle_timeout;
    ngx_msec_t                 max_ack_delay;

    size_t                     max_udp_payload_size;
    size_t                     initial_max_data;
    size_t                     initial_max_stream_data_bidi_local;
    size_t                     initial_max_stream_data_bidi_remote;
    size_t                     initial_max_stream_data_uni;
    ngx_uint_t                 initial_max_streams_bidi;
    ngx_uint_t                 initial_max_streams_uni;
    ngx_uint_t                 ack_delay_exponent;
    ngx_uint_t                 active_connection_id_limit;
    ngx_flag_t                 disable_active_migration;
    ngx_str_t                  original_dcid;
    ngx_str_t                  initial_scid;
    ngx_str_t                  retry_scid;
    u_char                     sr_token[NGX_QUIC_SR_TOKEN_LEN];

    /* TODO */
    void                      *preferred_address;
} ngx_quic_tp_t;


typedef struct {
    ngx_ssl_t                 *ssl;
    ngx_quic_tp_t              tp;
    ngx_flag_t                 retry;
    ngx_flag_t                 require_alpn;
    u_char                     token_key[32]; /* AES 256 */
    ngx_str_t                  sr_token_key; /* stateless reset token key */
} ngx_quic_conf_t;


typedef struct {
    uint64_t                   sent;
    uint64_t                   received;
    ngx_queue_t                frames;   /* reorder queue */
    size_t                     total;    /* size of buffered data */
} ngx_quic_frames_stream_t;


struct ngx_quic_stream_s {
    ngx_rbtree_node_t          node;
    ngx_connection_t          *parent;
    ngx_connection_t          *c;
    uint64_t                   id;
    uint64_t                   acked;
    uint64_t                   send_max_data;
    ngx_buf_t                 *b;
    ngx_quic_frames_stream_t   fs;
};


typedef struct ngx_quic_keys_s  ngx_quic_keys_t;


void ngx_quic_run(ngx_connection_t *c, ngx_quic_conf_t *conf);
ngx_connection_t *ngx_quic_open_stream(ngx_connection_t *c, ngx_uint_t bidi);
void ngx_quic_finalize_connection(ngx_connection_t *c, ngx_uint_t err,
    const char *reason);
uint32_t ngx_quic_version(ngx_connection_t *c);
ngx_int_t ngx_quic_get_packet_dcid(ngx_log_t *log, u_char *data, size_t len,
    ngx_str_t *dcid);


/********************************* DEBUG *************************************/

/* #define NGX_QUIC_DEBUG_PACKETS */      /* dump packet contents */
/* #define NGX_QUIC_DEBUG_FRAMES */       /* dump frames contents */
/* #define NGX_QUIC_DEBUG_FRAMES_ALLOC */ /* log frames alloc/reuse/free */
/* #define NGX_QUIC_DEBUG_CRYPTO */

#if (NGX_DEBUG)

#define ngx_quic_hexdump(log, fmt, data, len)                                 \
    ngx_quic_hexdump_real(log, fmt, (u_char *) data, (size_t) len)

static ngx_inline
void ngx_quic_hexdump_real(ngx_log_t *log, const char *label, u_char *data,
    size_t len)
{
    ngx_int_t  m;
    u_char     buf[2048];

    if (log->log_level & NGX_LOG_DEBUG_EVENT) {
        m = ngx_hex_dump(buf, data, (len > 1024) ? 1024 : len) - buf;
        ngx_log_debug5(NGX_LOG_DEBUG_EVENT, log, 0,
                      "%s len:%uz data:%*s%s",
                      label, len, m, buf, len < 2048 ? "" : "...");
    }
}

#else

#define ngx_quic_hexdump(log, fmt, data, len)

#endif

#endif /* _NGX_EVENT_QUIC_H_INCLUDED_ */