Mercurial > hg > nginx
view src/event/quic/ngx_event_quic_frames.c @ 8963:5acd0d89d8c2 quic
QUIC: fixed handling stream input buffers.
Previously, ngx_quic_write_chain() treated each input buffer as a memory
buffer, which is not always the case. Special buffers were not skipped, which
is especially important when hitting the input byte limit.
The issue manifested itself with ngx_quic_write_chain() returning a non-empty
chain consisting of a special last_buf buffer when called from QUIC stream
send_chain(). In order for this to happen, input byte limit should be equal to
the chain length, and the input chain should end with an empty last_buf buffer.
An easy way to achieve this is the following:
location /empty {
return 200;
}
When this non-empty chain was returned from send_chain(), it signalled to the
caller that input was blocked, while in fact it wasn't. This prevented HTTP
request from finalization, which prevented QUIC from sending STREAM FIN to
the client. The QUIC stream was then reset after a timeout.
Now special buffers are skipped and send_chain() returns NULL in the case
above, which signals to the caller a successful operation.
Also, original byte limit is now passed to ngx_quic_write_chain() from
send_chain() instead of actual chain length to make sure it's never zero.
author | Roman Arutyunyan <arut@nginx.com> |
---|---|
date | Thu, 13 Jan 2022 11:23:53 +0300 |
parents | fb811b6c76ee |
children | 3789f4a56d65 |
line wrap: on
line source
/* * Copyright (C) Nginx, Inc. */ #include <ngx_config.h> #include <ngx_core.h> #include <ngx_event.h> #include <ngx_event_quic_connection.h> #define NGX_QUIC_BUFFER_SIZE 4096 #define ngx_quic_buf_refs(b) (b)->shadow->num #define ngx_quic_buf_inc_refs(b) ngx_quic_buf_refs(b)++ #define ngx_quic_buf_dec_refs(b) ngx_quic_buf_refs(b)-- #define ngx_quic_buf_set_refs(b, v) ngx_quic_buf_refs(b) = v static ngx_buf_t *ngx_quic_alloc_buf(ngx_connection_t *c); static void ngx_quic_free_buf(ngx_connection_t *c, ngx_buf_t *b); static ngx_buf_t *ngx_quic_clone_buf(ngx_connection_t *c, ngx_buf_t *b); static ngx_buf_t * ngx_quic_alloc_buf(ngx_connection_t *c) { u_char *p; ngx_buf_t *b; ngx_quic_connection_t *qc; qc = ngx_quic_get_connection(c); b = qc->free_bufs; if (b) { qc->free_bufs = b->shadow; p = b->start; } else { b = qc->free_shadow_bufs; if (b) { qc->free_shadow_bufs = b->shadow; #ifdef NGX_QUIC_DEBUG_ALLOC ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0, "quic use shadow buffer n:%ui %ui", ++qc->nbufs, --qc->nshadowbufs); #endif } else { b = ngx_palloc(c->pool, sizeof(ngx_buf_t)); if (b == NULL) { return NULL; } #ifdef NGX_QUIC_DEBUG_ALLOC ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "quic new buffer n:%ui", ++qc->nbufs); #endif } p = ngx_pnalloc(c->pool, NGX_QUIC_BUFFER_SIZE); if (p == NULL) { return NULL; } } #ifdef NGX_QUIC_DEBUG_ALLOC ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "quic alloc buffer %p", b); #endif ngx_memzero(b, sizeof(ngx_buf_t)); b->tag = (ngx_buf_tag_t) &ngx_quic_alloc_buf; b->temporary = 1; b->shadow = b; b->start = p; b->pos = p; b->last = p; b->end = p + NGX_QUIC_BUFFER_SIZE; ngx_quic_buf_set_refs(b, 1); return b; } static void ngx_quic_free_buf(ngx_connection_t *c, ngx_buf_t *b) { ngx_buf_t *shadow; ngx_quic_connection_t *qc; qc = ngx_quic_get_connection(c); ngx_quic_buf_dec_refs(b); #ifdef NGX_QUIC_DEBUG_ALLOC ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0, "quic free buffer %p r:%ui", b, (ngx_uint_t) ngx_quic_buf_refs(b)); #endif shadow = b->shadow; if (ngx_quic_buf_refs(b) == 0) { shadow->shadow = qc->free_bufs; qc->free_bufs = shadow; } if (b != shadow) { b->shadow = qc->free_shadow_bufs; qc->free_shadow_bufs = b; } } static ngx_buf_t * ngx_quic_clone_buf(ngx_connection_t *c, ngx_buf_t *b) { ngx_buf_t *nb; ngx_quic_connection_t *qc; qc = ngx_quic_get_connection(c); nb = qc->free_shadow_bufs; if (nb) { qc->free_shadow_bufs = nb->shadow; } else { nb = ngx_palloc(c->pool, sizeof(ngx_buf_t)); if (nb == NULL) { return NULL; } #ifdef NGX_QUIC_DEBUG_ALLOC ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "quic new shadow buffer n:%ui", ++qc->nshadowbufs); #endif } *nb = *b; ngx_quic_buf_inc_refs(b); #ifdef NGX_QUIC_DEBUG_ALLOC ngx_log_debug3(NGX_LOG_DEBUG_EVENT, c->log, 0, "quic clone buffer %p %p r:%ui", b, nb, (ngx_uint_t) ngx_quic_buf_refs(b)); #endif return nb; } ngx_quic_frame_t * ngx_quic_alloc_frame(ngx_connection_t *c) { ngx_queue_t *q; ngx_quic_frame_t *frame; ngx_quic_connection_t *qc; qc = ngx_quic_get_connection(c); if (!ngx_queue_empty(&qc->free_frames)) { q = ngx_queue_head(&qc->free_frames); frame = ngx_queue_data(q, ngx_quic_frame_t, queue); ngx_queue_remove(&frame->queue); #ifdef NGX_QUIC_DEBUG_ALLOC ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "quic reuse frame n:%ui", qc->nframes); #endif } else if (qc->nframes < 10000) { frame = ngx_palloc(c->pool, sizeof(ngx_quic_frame_t)); if (frame == NULL) { return NULL; } ++qc->nframes; #ifdef NGX_QUIC_DEBUG_ALLOC ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "quic alloc frame n:%ui", qc->nframes); #endif } else { ngx_log_error(NGX_LOG_INFO, c->log, 0, "quic flood detected"); return NULL; } ngx_memzero(frame, sizeof(ngx_quic_frame_t)); return frame; } void ngx_quic_free_frame(ngx_connection_t *c, ngx_quic_frame_t *frame) { ngx_quic_connection_t *qc; qc = ngx_quic_get_connection(c); if (frame->data) { ngx_quic_free_chain(c, frame->data); } ngx_queue_insert_head(&qc->free_frames, &frame->queue); #ifdef NGX_QUIC_DEBUG_ALLOC ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "quic free frame n:%ui", qc->nframes); #endif } void ngx_quic_trim_chain(ngx_chain_t *in, size_t size) { size_t n; ngx_buf_t *b; while (in && size > 0) { b = in->buf; n = ngx_min((size_t) (b->last - b->pos), size); b->pos += n; size -= n; if (b->pos == b->last) { in = in->next; } } } void ngx_quic_free_chain(ngx_connection_t *c, ngx_chain_t *in) { ngx_chain_t *cl; while (in) { cl = in; in = in->next; ngx_quic_free_buf(c, cl->buf); ngx_free_chain(c->pool, cl); } } void ngx_quic_free_frames(ngx_connection_t *c, ngx_queue_t *frames) { ngx_queue_t *q; ngx_quic_frame_t *f; do { q = ngx_queue_head(frames); if (q == ngx_queue_sentinel(frames)) { break; } ngx_queue_remove(q); f = ngx_queue_data(q, ngx_quic_frame_t, queue); ngx_quic_free_frame(c, f); } while (1); } void ngx_quic_queue_frame(ngx_quic_connection_t *qc, ngx_quic_frame_t *frame) { ngx_quic_send_ctx_t *ctx; ctx = ngx_quic_get_send_ctx(qc, frame->level); ngx_queue_insert_tail(&ctx->frames, &frame->queue); frame->len = ngx_quic_create_frame(NULL, frame); /* always succeeds */ if (qc->closing) { return; } ngx_post_event(&qc->push, &ngx_posted_events); } ngx_int_t ngx_quic_split_frame(ngx_connection_t *c, ngx_quic_frame_t *f, size_t len) { size_t shrink; ngx_quic_frame_t *nf; ngx_quic_ordered_frame_t *of, *onf; switch (f->type) { case NGX_QUIC_FT_CRYPTO: case NGX_QUIC_FT_STREAM: break; default: return NGX_DECLINED; } if ((size_t) f->len <= len) { return NGX_OK; } shrink = f->len - len; ngx_log_debug3(NGX_LOG_DEBUG_EVENT, c->log, 0, "quic split frame now:%uz need:%uz shrink:%uz", f->len, len, shrink); of = &f->u.ord; if (of->length <= shrink) { return NGX_DECLINED; } of->length -= shrink; f->len = ngx_quic_create_frame(NULL, f); if ((size_t) f->len > len) { ngx_log_error(NGX_LOG_ERR, c->log, 0, "could not split QUIC frame"); return NGX_ERROR; } nf = ngx_quic_alloc_frame(c); if (nf == NULL) { return NGX_ERROR; } *nf = *f; onf = &nf->u.ord; onf->offset += of->length; onf->length = shrink; nf->len = ngx_quic_create_frame(NULL, nf); f->data = ngx_quic_read_chain(c, &nf->data, of->length); if (f->data == NGX_CHAIN_ERROR) { return NGX_ERROR; } ngx_queue_insert_after(&f->queue, &nf->queue); return NGX_OK; } ngx_chain_t * ngx_quic_read_chain(ngx_connection_t *c, ngx_chain_t **chain, off_t limit) { off_t n; ngx_buf_t *b; ngx_chain_t *out, *cl, **ll; out = *chain; for (ll = &out; *ll; ll = &(*ll)->next) { b = (*ll)->buf; if (b->sync) { /* hole */ break; } if (limit == 0) { break; } n = b->last - b->pos; if (n > limit) { goto split; } limit -= n; } *chain = *ll; *ll = NULL; return out; split: cl = ngx_alloc_chain_link(c->pool); if (cl == NULL) { return NGX_CHAIN_ERROR; } cl->buf = ngx_quic_clone_buf(c, b); if (cl->buf == NULL) { return NGX_CHAIN_ERROR; } cl->buf->pos += limit; b->last = cl->buf->pos; b->last_buf = 0; ll = &(*ll)->next; cl->next = *ll; *ll = NULL; *chain = cl; return out; } ngx_chain_t * ngx_quic_alloc_chain(ngx_connection_t *c) { ngx_chain_t *cl; cl = ngx_alloc_chain_link(c->pool); if (cl == NULL) { return NULL; } cl->buf = ngx_quic_alloc_buf(c); if (cl->buf == NULL) { return NULL; } return cl; } ngx_chain_t * ngx_quic_copy_buf(ngx_connection_t *c, u_char *data, size_t len) { size_t n; ngx_buf_t *b; ngx_chain_t *cl, *out, **ll; out = NULL; ll = &out; while (len) { cl = ngx_quic_alloc_chain(c); if (cl == NULL) { return NGX_CHAIN_ERROR; } b = cl->buf; n = ngx_min((size_t) (b->end - b->last), len); b->last = ngx_cpymem(b->last, data, n); data += n; len -= n; *ll = cl; ll = &cl->next; } *ll = NULL; return out; } ngx_chain_t * ngx_quic_write_chain(ngx_connection_t *c, ngx_chain_t **chain, ngx_chain_t *in, off_t limit, off_t offset) { off_t n; u_char *p; ngx_buf_t *b; ngx_chain_t *cl, *sl; while (in && limit) { cl = *chain; if (cl == NULL) { cl = ngx_quic_alloc_chain(c); if (cl == NULL) { return NGX_CHAIN_ERROR; } cl->buf->last = cl->buf->end; cl->buf->sync = 1; /* hole */ cl->next = NULL; *chain = cl; } b = cl->buf; n = b->last - b->pos; if (n <= offset) { offset -= n; chain = &cl->next; continue; } if (b->sync && offset > 0) { /* split hole at offset */ b->sync = 0; sl = ngx_quic_read_chain(c, &cl, offset); if (cl == NGX_CHAIN_ERROR) { return NGX_CHAIN_ERROR; } sl->buf->sync = 1; cl->buf->sync = 1; *chain = sl; sl->next = cl; continue; } for (p = b->pos + offset; p != b->last && in; /* void */ ) { if (!ngx_buf_in_memory(in->buf) || in->buf->pos == in->buf->last) { in = in->next; continue; } if (limit == 0) { break; } n = ngx_min(b->last - p, in->buf->last - in->buf->pos); n = ngx_min(n, limit); if (b->sync) { ngx_memcpy(p, in->buf->pos, n); } p += n; in->buf->pos += n; offset += n; limit -= n; } if (b->sync && p == b->last) { b->sync = 0; continue; } if (b->sync && p != b->pos) { /* split hole at p - b->pos */ b->sync = 0; sl = ngx_quic_read_chain(c, &cl, p - b->pos); if (sl == NGX_CHAIN_ERROR) { return NGX_CHAIN_ERROR; } cl->buf->sync = 1; *chain = sl; sl->next = cl; } } return in; } #if (NGX_DEBUG) void ngx_quic_log_frame(ngx_log_t *log, ngx_quic_frame_t *f, ngx_uint_t tx) { u_char *p, *last, *pos, *end; ssize_t n; uint64_t gap, range, largest, smallest; ngx_uint_t i; u_char buf[NGX_MAX_ERROR_STR]; p = buf; last = buf + sizeof(buf); switch (f->type) { case NGX_QUIC_FT_CRYPTO: p = ngx_slprintf(p, last, "CRYPTO len:%uL off:%uL", f->u.crypto.length, f->u.crypto.offset); #ifdef NGX_QUIC_DEBUG_FRAMES { ngx_chain_t *cl; p = ngx_slprintf(p, last, " data:"); for (cl = f->data; cl; cl = cl->next) { p = ngx_slprintf(p, last, "%*xs", cl->buf->last - cl->buf->pos, cl->buf->pos); } } #endif break; case NGX_QUIC_FT_PADDING: p = ngx_slprintf(p, last, "PADDING"); break; case NGX_QUIC_FT_ACK: case NGX_QUIC_FT_ACK_ECN: p = ngx_slprintf(p, last, "ACK n:%ui delay:%uL ", f->u.ack.range_count, f->u.ack.delay); if (f->data) { pos = f->data->buf->pos; end = f->data->buf->last; } else { pos = NULL; end = NULL; } largest = f->u.ack.largest; smallest = f->u.ack.largest - f->u.ack.first_range; if (largest == smallest) { p = ngx_slprintf(p, last, "%uL", largest); } else { p = ngx_slprintf(p, last, "%uL-%uL", largest, smallest); } for (i = 0; i < f->u.ack.range_count; i++) { n = ngx_quic_parse_ack_range(log, pos, end, &gap, &range); if (n == NGX_ERROR) { break; } pos += n; largest = smallest - gap - 2; smallest = largest - range; if (largest == smallest) { p = ngx_slprintf(p, last, " %uL", largest); } else { p = ngx_slprintf(p, last, " %uL-%uL", largest, smallest); } } if (f->type == NGX_QUIC_FT_ACK_ECN) { p = ngx_slprintf(p, last, " ECN counters ect0:%uL ect1:%uL ce:%uL", f->u.ack.ect0, f->u.ack.ect1, f->u.ack.ce); } break; case NGX_QUIC_FT_PING: p = ngx_slprintf(p, last, "PING"); break; case NGX_QUIC_FT_NEW_CONNECTION_ID: p = ngx_slprintf(p, last, "NEW_CONNECTION_ID seq:%uL retire:%uL len:%ud", f->u.ncid.seqnum, f->u.ncid.retire, f->u.ncid.len); break; case NGX_QUIC_FT_RETIRE_CONNECTION_ID: p = ngx_slprintf(p, last, "RETIRE_CONNECTION_ID seqnum:%uL", f->u.retire_cid.sequence_number); break; case NGX_QUIC_FT_CONNECTION_CLOSE: case NGX_QUIC_FT_CONNECTION_CLOSE_APP: p = ngx_slprintf(p, last, "CONNECTION_CLOSE%s err:%ui", f->type == NGX_QUIC_FT_CONNECTION_CLOSE ? "" : "_APP", f->u.close.error_code); if (f->u.close.reason.len) { p = ngx_slprintf(p, last, " %V", &f->u.close.reason); } if (f->type == NGX_QUIC_FT_CONNECTION_CLOSE) { p = ngx_slprintf(p, last, " ft:%ui", f->u.close.frame_type); } break; case NGX_QUIC_FT_STREAM: p = ngx_slprintf(p, last, "STREAM id:0x%xL", f->u.stream.stream_id); if (f->u.stream.off) { p = ngx_slprintf(p, last, " off:%uL", f->u.stream.offset); } if (f->u.stream.len) { p = ngx_slprintf(p, last, " len:%uL", f->u.stream.length); } if (f->u.stream.fin) { p = ngx_slprintf(p, last, " fin:1"); } #ifdef NGX_QUIC_DEBUG_FRAMES { ngx_chain_t *cl; p = ngx_slprintf(p, last, " data:"); for (cl = f->data; cl; cl = cl->next) { p = ngx_slprintf(p, last, "%*xs", cl->buf->last - cl->buf->pos, cl->buf->pos); } } #endif break; case NGX_QUIC_FT_MAX_DATA: p = ngx_slprintf(p, last, "MAX_DATA max_data:%uL on recv", f->u.max_data.max_data); break; case NGX_QUIC_FT_RESET_STREAM: p = ngx_slprintf(p, last, "RESET_STREAM" " id:0x%xL error_code:0x%xL final_size:0x%xL", f->u.reset_stream.id, f->u.reset_stream.error_code, f->u.reset_stream.final_size); break; case NGX_QUIC_FT_STOP_SENDING: p = ngx_slprintf(p, last, "STOP_SENDING id:0x%xL err:0x%xL", f->u.stop_sending.id, f->u.stop_sending.error_code); break; case NGX_QUIC_FT_STREAMS_BLOCKED: case NGX_QUIC_FT_STREAMS_BLOCKED2: p = ngx_slprintf(p, last, "STREAMS_BLOCKED limit:%uL bidi:%ui", f->u.streams_blocked.limit, f->u.streams_blocked.bidi); break; case NGX_QUIC_FT_MAX_STREAMS: case NGX_QUIC_FT_MAX_STREAMS2: p = ngx_slprintf(p, last, "MAX_STREAMS limit:%uL bidi:%ui", f->u.max_streams.limit, f->u.max_streams.bidi); break; case NGX_QUIC_FT_MAX_STREAM_DATA: p = ngx_slprintf(p, last, "MAX_STREAM_DATA id:0x%xL limit:%uL", f->u.max_stream_data.id, f->u.max_stream_data.limit); break; case NGX_QUIC_FT_DATA_BLOCKED: p = ngx_slprintf(p, last, "DATA_BLOCKED limit:%uL", f->u.data_blocked.limit); break; case NGX_QUIC_FT_STREAM_DATA_BLOCKED: p = ngx_slprintf(p, last, "STREAM_DATA_BLOCKED id:0x%xL limit:%uL", f->u.stream_data_blocked.id, f->u.stream_data_blocked.limit); break; case NGX_QUIC_FT_PATH_CHALLENGE: p = ngx_slprintf(p, last, "PATH_CHALLENGE data:0x%*xs", sizeof(f->u.path_challenge.data), f->u.path_challenge.data); break; case NGX_QUIC_FT_PATH_RESPONSE: p = ngx_slprintf(p, last, "PATH_RESPONSE data:0x%*xs", sizeof(f->u.path_challenge.data), f->u.path_challenge.data); break; case NGX_QUIC_FT_NEW_TOKEN: p = ngx_slprintf(p, last, "NEW_TOKEN"); break; case NGX_QUIC_FT_HANDSHAKE_DONE: p = ngx_slprintf(p, last, "HANDSHAKE DONE"); break; default: p = ngx_slprintf(p, last, "unknown type 0x%xi", f->type); break; } ngx_log_debug4(NGX_LOG_DEBUG_EVENT, log, 0, "quic frame %s %s %*s", tx ? "tx" : "rx", ngx_quic_level_name(f->level), p - buf, buf); } #endif