changeset 8825:59d2d47ad3c6 quic

QUIC: stream limits in "hq" mode. The "hq" mode is HTTP/0.9-1.1 over QUIC. The following limits are introduced: - uni streams are not allowed - keepalive_requests is enforced - keepalive_time is enforced In case of error, QUIC connection is finalized with 0x101 code. This code corresponds to HTTP/3 General Protocol Error.
author Roman Arutyunyan <arut@nginx.com>
date Mon, 02 Aug 2021 15:48:21 +0300
parents 054f9be0aaf9
children c35b255d80dc
files src/http/modules/ngx_http_quic_module.c
diffstat 1 files changed, 35 insertions(+), 0 deletions(-) [+]
line wrap: on
line diff
--- a/src/http/modules/ngx_http_quic_module.c
+++ b/src/http/modules/ngx_http_quic_module.c
@@ -188,6 +188,7 @@ static ngx_str_t  ngx_http_quic_salt = n
 ngx_int_t
 ngx_http_quic_init(ngx_connection_t *c)
 {
+    uint64_t                   n;
     ngx_quic_conf_t           *qcf;
     ngx_http_connection_t     *hc, *phc;
     ngx_http_core_loc_conf_t  *clcf;
@@ -208,6 +209,40 @@ ngx_http_quic_init(ngx_connection_t *c)
 
     ngx_log_debug0(NGX_LOG_DEBUG_HTTP, c->log, 0, "http init quic stream");
 
+#if (NGX_HTTP_V3)
+    if (!hc->addr_conf->http3)
+#endif
+    {
+        /* Use HTTP/3 General Protocol Error Code 0x101 for finalization */
+
+        if (c->quic->id & NGX_QUIC_STREAM_UNIDIRECTIONAL) {
+            ngx_quic_finalize_connection(c->quic->parent, 0x101,
+                                         "unexpected uni stream");
+            ngx_http_close_connection(c);
+            return NGX_DONE;
+        }
+
+        clcf = ngx_http_get_module_loc_conf(hc->conf_ctx, ngx_http_core_module);
+
+        n = c->quic->id >> 2;
+
+        if (n >= clcf->keepalive_requests) {
+            ngx_quic_finalize_connection(c->quic->parent, 0x101,
+                                         "reached maximum number of requests");
+            ngx_http_close_connection(c);
+            return NGX_DONE;
+        }
+
+        if (ngx_current_msec - c->quic->parent->start_time
+            > clcf->keepalive_time)
+        {
+            ngx_quic_finalize_connection(c->quic->parent, 0x101,
+                                          "reached maximum time for requests");
+            ngx_http_close_connection(c);
+            return NGX_DONE;
+        }
+    }
+
     phc = ngx_http_quic_get_connection(c);
 
     if (phc->ssl_servername) {