One Level Up Top Level

src/event/quic/ngx_event_quic_migration.c - nginx source code

Functions defined

Macros defined

Source code


  2. /*
  3. * Copyright (C) Nginx, Inc.
  4. */


  7. #include <ngx_config.h>
  8. #include <ngx_core.h>
  9. #include <ngx_event.h>
  10. #include <ngx_event_quic_connection.h>


  13. ‌#define NGX_QUIC_PATH_MTU_DELAY       100
  14. ‌#define NGX_QUIC_PATH_MTU_PRECISION   16


  17. static void ngx_quic_set_connection_path(ngx_connection_t *c,
  18.     ngx_quic_path_t *path);
  19. static ngx_int_t ngx_quic_validate_path(ngx_connection_t *c,
  20.     ngx_quic_path_t *path);
  21. static ngx_int_t ngx_quic_send_path_challenge(ngx_connection_t *c,
  22.     ngx_quic_path_t *path);
  23. static void ngx_quic_set_path_timer(ngx_connection_t *c);
  24. static ngx_int_t ngx_quic_expire_path_validation(ngx_connection_t *c,
  25.     ngx_quic_path_t *path);
  26. static ngx_int_t ngx_quic_expire_path_mtu_delay(ngx_connection_t *c,
  27.     ngx_quic_path_t *path);
  28. static ngx_int_t ngx_quic_expire_path_mtu_discovery(ngx_connection_t *c,
  29.     ngx_quic_path_t *path);
  30. static ngx_quic_path_t *ngx_quic_get_path(ngx_connection_t *c, ngx_uint_t tag);
  31. static ngx_int_t ngx_quic_send_path_mtu_probe(ngx_connection_t *c,
  32.     ngx_quic_path_t *path);


  35. ngx_int_t
  36. ‌ngx_quic_handle_path_challenge_frame(ngx_connection_t *c,
  37.     ngx_quic_header_t *pkt, ngx_quic_path_challenge_frame_t *f)
  38. {
  39.     size_t                  min;
  40.     ngx_quic_frame_t       *fp;
  41.     ngx_quic_connection_t  *qc;

  43.     if (pkt->level != ssl_encryption_application || pkt->path_challenged) {
  44.         ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
  45.                        "quic ignoring PATH_CHALLENGE");
  46.         return NGX_OK;
  47.     }

  49.     pkt->path_challenged = 1;

  51.     qc = ngx_quic_get_connection(c);

  53.     fp = ngx_quic_alloc_frame(c);
  54.     if (fp == NULL) {
  55.         return NGX_ERROR;
  56.     }

  58.     fp->level = ssl_encryption_application;
  59.     fp->type = NGX_QUIC_FT_PATH_RESPONSE;
  60.     fp->u.path_response = *f;

  62.     /*
  63.      * RFC 9000, 8.2.2.  Path Validation Responses
  64.      *
  65.      * A PATH_RESPONSE frame MUST be sent on the network path where the
  66.      * PATH_CHALLENGE frame was received.
  67.      */

  69.     /*
  70.      * An endpoint MUST expand datagrams that contain a PATH_RESPONSE frame
  71.      * to at least the smallest allowed maximum datagram size of 1200 bytes.
  72.      * ...
  73.      * However, an endpoint MUST NOT expand the datagram containing the
  74.      * PATH_RESPONSE if the resulting data exceeds the anti-amplification limit.
  75.      */

  77.     min = (ngx_quic_path_limit(c, pkt->path, 1200) < 1200) ? 0 : 1200;

  79.     if (ngx_quic_frame_sendto(c, fp, min, pkt->path) == NGX_ERROR) {
  80.         return NGX_ERROR;
  81.     }

  83.     if (pkt->path == qc->path) {
  84.         /*
  85.          * RFC 9000, 9.3.3.  Off-Path Packet Forwarding
  86.          *
  87.          * An endpoint that receives a PATH_CHALLENGE on an active path SHOULD
  88.          * send a non-probing packet in response.
  89.          */

  91.         fp = ngx_quic_alloc_frame(c);
  92.         if (fp == NULL) {
  93.             return NGX_ERROR;
  94.         }

  96.         fp->level = ssl_encryption_application;
  97.         fp->type = NGX_QUIC_FT_PING;

  99.         ngx_quic_queue_frame(qc, fp);
  100.     }

  102.     return NGX_OK;
  103. }


  106. ngx_int_t
  107. ‌ngx_quic_handle_path_response_frame(ngx_connection_t *c,
  108.     ngx_quic_path_challenge_frame_t *f)
  109. {
  110.     ngx_uint_t              rst;
  111.     ngx_queue_t            *q;
  112.     ngx_quic_path_t        *path, *prev;
  113.     ngx_quic_send_ctx_t    *ctx;
  114.     ngx_quic_connection_t  *qc;

  116.     qc = ngx_quic_get_connection(c);

  118.     /*
  119.      * RFC 9000, 8.2.3.  Successful Path Validation
  120.      *
  121.      * A PATH_RESPONSE frame received on any network path validates the path
  122.      * on which the PATH_CHALLENGE was sent.
  123.      */

  125.     for (q = ngx_queue_head(&qc->paths);
  126.          q != ngx_queue_sentinel(&qc->paths);
  127.          q = ngx_queue_next(q))
  128.     {
  129.         path = ngx_queue_data(q, ngx_quic_path_t, queue);

  131.         if (path->state != NGX_QUIC_PATH_VALIDATING) {
  132.             continue;
  133.         }

  135.         if (ngx_memcmp(path->challenge[0], f->data, sizeof(f->data)) == 0
  136.             || ngx_memcmp(path->challenge[1], f->data, sizeof(f->data)) == 0)
  137.         {
  138.             goto valid;
  139.         }
  140.     }

  142.     ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
  143.                    "quic stale PATH_RESPONSE ignored");

  145.     return NGX_OK;

  147. valid:

  149.     /*
  150.      * RFC 9000, 9.4.  Loss Detection and Congestion Control
  151.      *
  152.      * On confirming a peer's ownership of its new address,
  153.      * an endpoint MUST immediately reset the congestion controller
  154.      * and round-trip time estimator for the new path to initial values
  155.      * unless the only change in the peer's address is its port number.
  156.      */

  158.     rst = 1;

  160.     prev = ngx_quic_get_path(c, NGX_QUIC_PATH_BACKUP);

  162.     if (prev != NULL) {

  164.         if (ngx_cmp_sockaddr(prev->sockaddr, prev->socklen,
  165.                              path->sockaddr, path->socklen, 0)
  166.             == NGX_OK)
  167.         {
  168.             /* address did not change */
  169.             rst = 0;

  171.             path->mtu = prev->mtu;
  172.             path->max_mtu = prev->max_mtu;
  173.             path->mtu_unvalidated = 0;
  174.         }
  175.     }

  177.     if (rst) {
  178.         /* prevent old path packets contribution to congestion control */

  180.         ctx = ngx_quic_get_send_ctx(qc, ssl_encryption_application);
  181.         qc->rst_pnum = ctx->pnum;

  183.         ngx_memzero(&qc->congestion, sizeof(ngx_quic_congestion_t));

  185.         qc->congestion.window = ngx_min(10 * qc->tp.max_udp_payload_size,
  186.                                    ngx_max(2 * qc->tp.max_udp_payload_size,
  187.                                            14720));
  188.         qc->congestion.ssthresh = (size_t) -1;
  189.         qc->congestion.recovery_start = ngx_current_msec;

  191.         ngx_quic_init_rtt(qc);
  192.     }

  194.     path->validated = 1;

  196.     if (path->mtu_unvalidated) {
  197.         path->mtu_unvalidated = 0;
  198.         return ngx_quic_validate_path(c, path);
  199.     }

  201.     /*
  202.      * RFC 9000, 9.3.  Responding to Connection Migration
  203.      *
  204.      *  After verifying a new client address, the server SHOULD
  205.      *  send new address validation tokens (Section 8) to the client.
  206.      */

  208.     if (ngx_quic_send_new_token(c, path) != NGX_OK) {
  209.         return NGX_ERROR;
  210.     }

  212.     ngx_log_error(NGX_LOG_INFO, c->log, 0,
  213.                   "quic path seq:%uL addr:%V successfully validated",
  214.                   path->seqnum, &path->addr_text);

  216.     ngx_quic_path_dbg(c, "is validated", path);

  218.     ngx_quic_discover_path_mtu(c, path);

  220.     return NGX_OK;
  221. }


  224. ngx_quic_path_t *
  225. ‌ngx_quic_new_path(ngx_connection_t *c,
  226.     struct sockaddr *sockaddr, socklen_t socklen, ngx_quic_client_id_t *cid)
  227. {
  228.     ngx_queue_t            *q;
  229.     ngx_quic_path_t        *path;
  230.     ngx_quic_connection_t  *qc;

  232.     qc = ngx_quic_get_connection(c);

  234.     if (!ngx_queue_empty(&qc->free_paths)) {

  236.         q = ngx_queue_head(&qc->free_paths);
  237.         path = ngx_queue_data(q, ngx_quic_path_t, queue);

  239.         ngx_queue_remove(&path->queue);

  241.         ngx_memzero(path, sizeof(ngx_quic_path_t));

  243.     } else {

  245.         path = ngx_pcalloc(c->pool, sizeof(ngx_quic_path_t));
  246.         if (path == NULL) {
  247.             return NULL;
  248.         }
  249.     }

  251.     ngx_queue_insert_tail(&qc->paths, &path->queue);

  253.     path->cid = cid;
  254.     cid->used = 1;

  256.     path->seqnum = qc->path_seqnum++;

  258.     path->sockaddr = &path->sa.sockaddr;
  259.     path->socklen = socklen;
  260.     ngx_memcpy(path->sockaddr, sockaddr, socklen);

  262.     path->addr_text.data = path->text;
  263.     path->addr_text.len = ngx_sock_ntop(sockaddr, socklen, path->text,
  264.                                         NGX_SOCKADDR_STRLEN, 1);

  266.     path->mtu = NGX_QUIC_MIN_INITIAL_SIZE;

  268.     ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
  269.                    "quic path seq:%uL created addr:%V",
  270.                    path->seqnum, &path->addr_text);
  271.     return path;
  272. }


  275. static ngx_quic_path_t *
  276. ‌ngx_quic_get_path(ngx_connection_t *c, ngx_uint_t tag)
  277. {
  278.     ngx_queue_t            *q;
  279.     ngx_quic_path_t        *path;
  280.     ngx_quic_connection_t  *qc;

  282.     qc = ngx_quic_get_connection(c);

  284.     for (q = ngx_queue_head(&qc->paths);
  285.          q != ngx_queue_sentinel(&qc->paths);
  286.          q = ngx_queue_next(q))
  287.     {
  288.         path = ngx_queue_data(q, ngx_quic_path_t, queue);

  290.         if (path->tag == tag) {
  291.             return path;
  292.         }
  293.     }

  295.     return NULL;
  296. }


  299. ngx_int_t
  300. ‌ngx_quic_set_path(ngx_connection_t *c, ngx_quic_header_t *pkt)
  301. {
  302.     off_t                   len;
  303.     ngx_queue_t            *q;
  304.     ngx_quic_path_t        *path, *probe;
  305.     ngx_quic_socket_t      *qsock;
  306.     ngx_quic_send_ctx_t    *ctx;
  307.     ngx_quic_client_id_t   *cid;
  308.     ngx_quic_connection_t  *qc;

  310.     qc = ngx_quic_get_connection(c);
  311.     qsock = ngx_quic_get_socket(c);

  313.     len = pkt->raw->last - pkt->raw->start;

  315.     if (c->udp->buffer == NULL) {
  316.         /* first ever packet in connection, path already exists  */
  317.         path = qc->path;
  318.         goto update;
  319.     }

  321.     probe = NULL;

  323.     for (q = ngx_queue_head(&qc->paths);
  324.          q != ngx_queue_sentinel(&qc->paths);
  325.          q = ngx_queue_next(q))
  326.     {
  327.         path = ngx_queue_data(q, ngx_quic_path_t, queue);

  329.         if (ngx_cmp_sockaddr(&qsock->sockaddr.sockaddr, qsock->socklen,
  330.                              path->sockaddr, path->socklen, 1)
  331.             == NGX_OK)
  332.         {
  333.             goto update;
  334.         }

  336.         if (path->tag == NGX_QUIC_PATH_PROBE) {
  337.             probe = path;
  338.         }
  339.     }

  341.     /* packet from new path, drop current probe, if any */

  343.     ctx = ngx_quic_get_send_ctx(qc, pkt->level);

  345.     /*
  346.      * only accept highest-numbered packets to prevent connection id
  347.      * exhaustion by excessive probing packets from unknown paths
  348.      */
  349.     if (pkt->pn != ctx->largest_pn) {
  350.         return NGX_DONE;
  351.     }

  353.     if (probe && ngx_quic_free_path(c, probe) != NGX_OK) {
  354.         return NGX_ERROR;
  355.     }

  357.     /* new path requires new client id */
  358.     cid = ngx_quic_next_client_id(c);
  359.     if (cid == NULL) {
  360.         ngx_log_error(NGX_LOG_INFO, c->log, 0,
  361.                       "quic no available client ids for new path");
  362.         /* stop processing of this datagram */
  363.         return NGX_DONE;
  364.     }

  366.     path = ngx_quic_new_path(c, &qsock->sockaddr.sockaddr, qsock->socklen, cid);
  367.     if (path == NULL) {
  368.         return NGX_ERROR;
  369.     }

  371.     path->tag = NGX_QUIC_PATH_PROBE;

  373.     /*
  374.      * client arrived using new path and previously seen DCID,
  375.      * this indicates NAT rebinding (or bad client)
  376.      */
  377.     if (qsock->used) {
  378.         pkt->rebound = 1;
  379.     }

  381. update:

  383.     qsock->used = 1;
  384.     pkt->path = path;

  386.     /* TODO: this may be too late in some cases;
  387.      *       for example, if error happens during decrypt(), we cannot
  388.      *       send CC, if error happens in 1st packet, due to amplification
  389.      *       limit, because path->received = 0
  390.      *
  391.      *       should we account garbage as received or only decrypting packets?
  392.      */
  393.     path->received += len;

  395.     ngx_log_debug3(NGX_LOG_DEBUG_EVENT, c->log, 0,
  396.                    "quic packet len:%O via sock seq:%L path seq:%uL",
  397.                    len, (int64_t) qsock->sid.seqnum, path->seqnum);
  398.     ngx_quic_path_dbg(c, "status", path);

  400.     return NGX_OK;
  401. }


  404. ngx_int_t
  405. ‌ngx_quic_free_path(ngx_connection_t *c, ngx_quic_path_t *path)
  406. {
  407.     ngx_quic_connection_t  *qc;

  409.     qc = ngx_quic_get_connection(c);

  411.     ngx_queue_remove(&path->queue);
  412.     ngx_queue_insert_head(&qc->free_paths, &path->queue);

  414.     /*
  415.      * invalidate CID that is no longer usable for any other path;
  416.      * this also requests new CIDs from client
  417.      */
  418.     if (path->cid) {
  419.         if (ngx_quic_free_client_id(c, path->cid) != NGX_OK) {
  420.             return NGX_ERROR;
  421.         }
  422.     }

  424.     ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
  425.                    "quic path seq:%uL addr:%V retired",
  426.                    path->seqnum, &path->addr_text);

  428.     return NGX_OK;
  429. }


  432. static void
  433. ‌ngx_quic_set_connection_path(ngx_connection_t *c, ngx_quic_path_t *path)
  434. {
  435.     ngx_memcpy(c->sockaddr, path->sockaddr, path->socklen);
  436.     c->socklen = path->socklen;

  438.     if (c->addr_text.data) {
  439.         c->addr_text.len = ngx_sock_ntop(c->sockaddr, c->socklen,
  440.                                          c->addr_text.data,
  441.                                          c->listening->addr_text_max_len, 0);
  442.     }

  444.     ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
  445.                    "quic send path set to seq:%uL addr:%V",
  446.                    path->seqnum, &path->addr_text);
  447. }


  450. ngx_int_t
  451. ‌ngx_quic_handle_migration(ngx_connection_t *c, ngx_quic_header_t *pkt)
  452. {
  453.     ngx_quic_path_t        *next, *bkp;
  454.     ngx_quic_send_ctx_t    *ctx;
  455.     ngx_quic_connection_t  *qc;

  457.     /* got non-probing packet via non-active path */

  459.     qc = ngx_quic_get_connection(c);

  461.     ctx = ngx_quic_get_send_ctx(qc, pkt->level);

  463.     /*
  464.      * RFC 9000, 9.3.  Responding to Connection Migration
  465.      *
  466.      * An endpoint only changes the address to which it sends packets in
  467.      * response to the highest-numbered non-probing packet.
  468.      */
  469.     if (pkt->pn != ctx->largest_pn) {
  470.         return NGX_OK;
  471.     }

  473.     next = pkt->path;

  475.     /*
  476.      * RFC 9000, 9.3.3:
  477.      *
  478.      * In response to an apparent migration, endpoints MUST validate the
  479.      * previously active path using a PATH_CHALLENGE frame.
  480.      */
  481.     if (pkt->rebound) {

  483.         /* NAT rebinding: client uses new path with old SID */
  484.         if (ngx_quic_validate_path(c, qc->path) != NGX_OK) {
  485.             return NGX_ERROR;
  486.         }
  487.     }

  489.     if (qc->path->validated) {

  491.         if (next->tag != NGX_QUIC_PATH_BACKUP) {
  492.             /* can delete backup path, if any */
  493.             bkp = ngx_quic_get_path(c, NGX_QUIC_PATH_BACKUP);

  495.             if (bkp && ngx_quic_free_path(c, bkp) != NGX_OK) {
  496.                 return NGX_ERROR;
  497.             }
  498.         }

  500.         qc->path->tag = NGX_QUIC_PATH_BACKUP;
  501.         ngx_quic_path_dbg(c, "is now backup", qc->path);

  503.     } else {
  504.         if (ngx_quic_free_path(c, qc->path) != NGX_OK) {
  505.             return NGX_ERROR;
  506.         }
  507.     }

  509.     /* switch active path to migrated */
  510.     qc->path = next;
  511.     qc->path->tag = NGX_QUIC_PATH_ACTIVE;

  513.     ngx_quic_set_connection_path(c, next);

  515.     if (!next->validated && next->state != NGX_QUIC_PATH_VALIDATING) {
  516.         if (ngx_quic_validate_path(c, next) != NGX_OK) {
  517.             return NGX_ERROR;
  518.         }
  519.     }

  521.     ngx_log_error(NGX_LOG_INFO, c->log, 0,
  522.                   "quic migrated to path seq:%uL addr:%V",
  523.                   qc->path->seqnum, &qc->path->addr_text);

  525.     ngx_quic_path_dbg(c, "is now active", qc->path);

  527.     return NGX_OK;
  528. }


  531. static ngx_int_t
  532. ‌ngx_quic_validate_path(ngx_connection_t *c, ngx_quic_path_t *path)
  533. {
  534.     ngx_msec_t              pto;
  535.     ngx_quic_send_ctx_t    *ctx;
  536.     ngx_quic_connection_t  *qc;

  538.     qc = ngx_quic_get_connection(c);

  540.     ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
  541.                    "quic initiated validation of path seq:%uL", path->seqnum);

  543.     path->tries = 0;

  545.     if (RAND_bytes((u_char *) path->challenge, sizeof(path->challenge)) != 1) {
  546.         return NGX_ERROR;
  547.     }

  549.     (void) ngx_quic_send_path_challenge(c, path);

  551.     ctx = ngx_quic_get_send_ctx(qc, ssl_encryption_application);
  552.     pto = ngx_max(ngx_quic_pto(c, ctx), 1000);

  554.     path->expires = ngx_current_msec + pto;
  555.     path->state = NGX_QUIC_PATH_VALIDATING;

  557.     ngx_quic_set_path_timer(c);

  559.     return NGX_OK;
  560. }


  563. static ngx_int_t
  564. ‌ngx_quic_send_path_challenge(ngx_connection_t *c, ngx_quic_path_t *path)
  565. {
  566.     size_t             min;
  567.     ngx_uint_t         n;
  568.     ngx_quic_frame_t  *frame;

  570.     ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
  571.                    "quic path seq:%uL send path_challenge tries:%ui",
  572.                    path->seqnum, path->tries);

  574.     for (n = 0; n < 2; n++) {

  576.         frame = ngx_quic_alloc_frame(c);
  577.         if (frame == NULL) {
  578.             return NGX_ERROR;
  579.         }

  581.         frame->level = ssl_encryption_application;
  582.         frame->type = NGX_QUIC_FT_PATH_CHALLENGE;

  584.         ngx_memcpy(frame->u.path_challenge.data, path->challenge[n], 8);

  586.         /*
  587.          * RFC 9000, 8.2.1.  Initiating Path Validation
  588.          *
  589.          * An endpoint MUST expand datagrams that contain a PATH_CHALLENGE frame
  590.          * to at least the smallest allowed maximum datagram size of 1200 bytes,
  591.          * unless the anti-amplification limit for the path does not permit
  592.          * sending a datagram of this size.
  593.          */

  595.         if (path->mtu_unvalidated
  596.             || ngx_quic_path_limit(c, path, 1200) < 1200)
  597.         {
  598.             min = 0;
  599.             path->mtu_unvalidated = 1;

  601.         } else {
  602.             min = 1200;
  603.         }

  605.         if (ngx_quic_frame_sendto(c, frame, min, path) == NGX_ERROR) {
  606.             return NGX_ERROR;
  607.         }
  608.     }

  610.     return NGX_OK;
  611. }


  614. void
  615. ‌ngx_quic_discover_path_mtu(ngx_connection_t *c, ngx_quic_path_t *path)
  616. {
  617.     ngx_quic_connection_t  *qc;

  619.     qc = ngx_quic_get_connection(c);

  621.     if (path->max_mtu) {
  622.         if (path->max_mtu - path->mtu <= NGX_QUIC_PATH_MTU_PRECISION) {
  623.             path->state = NGX_QUIC_PATH_IDLE;
  624.             ngx_quic_set_path_timer(c);
  625.             return;
  626.         }

  628.         path->mtud = (path->mtu + path->max_mtu) / 2;

  630.     } else {
  631.         path->mtud = path->mtu * 2;

  633.         if (path->mtud >= qc->ctp.max_udp_payload_size) {
  634.             path->mtud = qc->ctp.max_udp_payload_size;
  635.             path->max_mtu = qc->ctp.max_udp_payload_size;
  636.         }
  637.     }

  639.     path->state = NGX_QUIC_PATH_WAITING;
  640.     path->expires = ngx_current_msec + NGX_QUIC_PATH_MTU_DELAY;

  642.     ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
  643.                    "quic path seq:%uL schedule mtu:%uz",
  644.                    path->seqnum, path->mtud);

  646.     ngx_quic_set_path_timer(c);
  647. }


  650. static void
  651. ‌ngx_quic_set_path_timer(ngx_connection_t *c)
  652. {
  653.     ngx_msec_t              now;
  654.     ngx_queue_t            *q;
  655.     ngx_msec_int_t          left, next;
  656.     ngx_quic_path_t        *path;
  657.     ngx_quic_connection_t  *qc;

  659.     qc = ngx_quic_get_connection(c);

  661.     now = ngx_current_msec;
  662.     next = -1;

  664.     for (q = ngx_queue_head(&qc->paths);
  665.          q != ngx_queue_sentinel(&qc->paths);
  666.          q = ngx_queue_next(q))
  667.     {
  668.         path = ngx_queue_data(q, ngx_quic_path_t, queue);

  670.         if (path->state == NGX_QUIC_PATH_IDLE) {
  671.             continue;
  672.         }

  674.         left = path->expires - now;
  675.         left = ngx_max(left, 1);

  677.         if (next == -1 || left < next) {
  678.             next = left;
  679.         }
  680.     }

  682.     if (next != -1) {
  683.         ngx_add_timer(&qc->path_validation, next);

  685.     } else if (qc->path_validation.timer_set) {
  686.         ngx_del_timer(&qc->path_validation);
  687.     }
  688. }


  691. void
  692. ‌ngx_quic_path_handler(ngx_event_t *ev)
  693. {
  694.     ngx_msec_t              now;
  695.     ngx_queue_t            *q;
  696.     ngx_msec_int_t          left;
  697.     ngx_quic_path_t        *path;
  698.     ngx_connection_t       *c;
  699.     ngx_quic_connection_t  *qc;

  701.     c = ev->data;
  702.     qc = ngx_quic_get_connection(c);

  704.     now = ngx_current_msec;

  706.     q = ngx_queue_head(&qc->paths);

  708.     while (q != ngx_queue_sentinel(&qc->paths)) {

  710.         path = ngx_queue_data(q, ngx_quic_path_t, queue);
  711.         q = ngx_queue_next(q);

  713.         if (path->state == NGX_QUIC_PATH_IDLE) {
  714.             continue;
  715.         }

  717.         left = path->expires - now;

  719.         if (left > 0) {
  720.             continue;
  721.         }

  723.         switch (path->state) {
  724.         case NGX_QUIC_PATH_VALIDATING:
  725.             if (ngx_quic_expire_path_validation(c, path) != NGX_OK) {
  726.                 goto failed;
  727.             }

  729.             break;

  731.         case NGX_QUIC_PATH_WAITING:
  732.             if (ngx_quic_expire_path_mtu_delay(c, path) != NGX_OK) {
  733.                 goto failed;
  734.             }

  736.             break;

  738.         case NGX_QUIC_PATH_MTUD:
  739.             if (ngx_quic_expire_path_mtu_discovery(c, path) != NGX_OK) {
  740.                 goto failed;
  741.             }

  743.             break;

  745.         default:
  746.             break;
  747.         }
  748.     }

  750.     ngx_quic_set_path_timer(c);

  752.     return;

  754. failed:

  756.     ngx_quic_close_connection(c, NGX_ERROR);
  757. }


  760. static ngx_int_t
  761. ‌ngx_quic_expire_path_validation(ngx_connection_t *c, ngx_quic_path_t *path)
  762. {
  763.     ngx_msec_int_t          pto;
  764.     ngx_quic_path_t        *bkp;
  765.     ngx_quic_send_ctx_t    *ctx;
  766.     ngx_quic_connection_t  *qc;

  768.     qc = ngx_quic_get_connection(c);
  769.     ctx = ngx_quic_get_send_ctx(qc, ssl_encryption_application);

  771.     if (++path->tries < NGX_QUIC_PATH_RETRIES) {
  772.         pto = ngx_max(ngx_quic_pto(c, ctx), 1000) << path->tries;
  773.         path->expires = ngx_current_msec + pto;

  775.         (void) ngx_quic_send_path_challenge(c, path);

  777.         return NGX_OK;
  778.     }

  780.     ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
  781.                    "quic path seq:%uL validation failed", path->seqnum);

  783.     /* found expired path */

  785.     path->validated = 0;


  788.     /* RFC 9000, 9.3.2.  On-Path Address Spoofing
  789.      *
  790.      * To protect the connection from failing due to such a spurious
  791.      * migration, an endpoint MUST revert to using the last validated
  792.      * peer address when validation of a new peer address fails.
  793.      */

  795.     if (qc->path == path) {
  796.         /* active path validation failed */

  798.         bkp = ngx_quic_get_path(c, NGX_QUIC_PATH_BACKUP);

  800.         if (bkp == NULL) {
  801.             qc->error = NGX_QUIC_ERR_NO_VIABLE_PATH;
  802.             qc->error_reason = "no viable path";
  803.             return NGX_ERROR;
  804.         }

  806.         qc->path = bkp;
  807.         qc->path->tag = NGX_QUIC_PATH_ACTIVE;

  809.         ngx_quic_set_connection_path(c, qc->path);

  811.         ngx_log_error(NGX_LOG_INFO, c->log, 0,
  812.                       "quic path seq:%uL addr:%V is restored from backup",
  813.                       qc->path->seqnum, &qc->path->addr_text);

  815.         ngx_quic_path_dbg(c, "is active", qc->path);
  816.     }

  818.     return ngx_quic_free_path(c, path);
  819. }


  822. static ngx_int_t
  823. ‌ngx_quic_expire_path_mtu_delay(ngx_connection_t *c, ngx_quic_path_t *path)
  824. {
  825.     ngx_int_t               rc;
  826.     ngx_uint_t              i;
  827.     ngx_msec_t              pto;
  828.     ngx_quic_send_ctx_t    *ctx;
  829.     ngx_quic_connection_t  *qc;

  831.     qc = ngx_quic_get_connection(c);
  832.     ctx = ngx_quic_get_send_ctx(qc, ssl_encryption_application);

  834.     path->tries = 0;

  836.     for ( ;; ) {

  838.         for (i = 0; i < NGX_QUIC_PATH_RETRIES; i++) {
  839.             path->mtu_pnum[i] = NGX_QUIC_UNSET_PN;
  840.         }

  842.         rc = ngx_quic_send_path_mtu_probe(c, path);

  844.         if (rc == NGX_ERROR) {
  845.             return NGX_ERROR;
  846.         }

  848.         if (rc == NGX_OK) {
  849.             pto = ngx_quic_pto(c, ctx);
  850.             path->expires = ngx_current_msec + pto;
  851.             path->state = NGX_QUIC_PATH_MTUD;
  852.             return NGX_OK;
  853.         }

  855.         /* rc == NGX_DECLINED */

  857.         path->max_mtu = path->mtud;

  859.         if (path->max_mtu - path->mtu <= NGX_QUIC_PATH_MTU_PRECISION) {
  860.             path->state = NGX_QUIC_PATH_IDLE;
  861.             return NGX_OK;
  862.         }

  864.         path->mtud = (path->mtu + path->max_mtu) / 2;
  865.     }
  866. }


  869. static ngx_int_t
  870. ‌ngx_quic_expire_path_mtu_discovery(ngx_connection_t *c, ngx_quic_path_t *path)
  871. {
  872.     ngx_int_t               rc;
  873.     ngx_msec_int_t          pto;
  874.     ngx_quic_send_ctx_t    *ctx;
  875.     ngx_quic_connection_t  *qc;

  877.     qc = ngx_quic_get_connection(c);
  878.     ctx = ngx_quic_get_send_ctx(qc, ssl_encryption_application);

  880.     if (++path->tries < NGX_QUIC_PATH_RETRIES) {
  881.         rc = ngx_quic_send_path_mtu_probe(c, path);

  883.         if (rc == NGX_ERROR) {
  884.             return NGX_ERROR;
  885.         }

  887.         if (rc == NGX_OK) {
  888.             pto = ngx_quic_pto(c, ctx) << path->tries;
  889.             path->expires = ngx_current_msec + pto;
  890.             return NGX_OK;
  891.         }

  893.         /* rc == NGX_DECLINED */
  894.     }

  896.     ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
  897.                    "quic path seq:%uL expired mtu:%uz",
  898.                    path->seqnum, path->mtud);

  900.     path->max_mtu = path->mtud;

  902.     ngx_quic_discover_path_mtu(c, path);

  904.     return NGX_OK;
  905. }


  908. static ngx_int_t
  909. ‌ngx_quic_send_path_mtu_probe(ngx_connection_t *c, ngx_quic_path_t *path)
  910. {
  911.     size_t                  mtu;
  912.     uint64_t                pnum;
  913.     ngx_int_t               rc;
  914.     ngx_uint_t              log_error;
  915.     ngx_quic_frame_t       *frame;
  916.     ngx_quic_send_ctx_t    *ctx;
  917.     ngx_quic_connection_t  *qc;

  919.     frame = ngx_quic_alloc_frame(c);
  920.     if (frame == NULL) {
  921.         return NGX_ERROR;
  922.     }

  924.     frame->level = ssl_encryption_application;
  925.     frame->type = NGX_QUIC_FT_PING;

  927.     qc = ngx_quic_get_connection(c);
  928.     ctx = ngx_quic_get_send_ctx(qc, ssl_encryption_application);
  929.     pnum = ctx->pnum;

  931.     ngx_log_debug4(NGX_LOG_DEBUG_EVENT, c->log, 0,
  932.                    "quic path seq:%uL send probe "
  933.                    "mtu:%uz pnum:%uL tries:%ui",
  934.                    path->seqnum, path->mtud, ctx->pnum, path->tries);

  936.     log_error = c->log_error;
  937.     c->log_error = NGX_ERROR_IGNORE_EMSGSIZE;

  939.     mtu = path->mtu;
  940.     path->mtu = path->mtud;

  942.     rc = ngx_quic_frame_sendto(c, frame, path->mtud, path);

  944.     path->mtu = mtu;
  945.     c->log_error = log_error;

  947.     if (rc == NGX_OK) {
  948.         path->mtu_pnum[path->tries] = pnum;
  949.         return NGX_OK;
  950.     }

  952.     ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
  953.                    "quic path seq:%uL rejected mtu:%uz",
  954.                    path->seqnum, path->mtud);

  956.     if (rc == NGX_ERROR) {
  957.         if (c->write->error) {
  958.             c->write->error = 0;
  959.             return NGX_DECLINED;
  960.         }

  962.         return NGX_ERROR;
  963.     }

  965.     return NGX_OK;
  966. }


  969. ngx_int_t
  970. ‌ngx_quic_handle_path_mtu(ngx_connection_t *c, ngx_quic_path_t *path,
  971.     uint64_t min, uint64_t max)
  972. {
  973.     uint64_t    pnum;
  974.     ngx_uint_t  i;

  976.     if (path->state != NGX_QUIC_PATH_MTUD) {
  977.         return NGX_OK;
  978.     }

  980.     for (i = 0; i < NGX_QUIC_PATH_RETRIES; i++) {
  981.         pnum = path->mtu_pnum[i];

  983.         if (pnum == NGX_QUIC_UNSET_PN) {
  984.             continue;
  985.         }

  987.         if (pnum < min || pnum > max) {
  988.             continue;
  989.         }

  991.         path->mtu = path->mtud;

  993.         ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
  994.                        "quic path seq:%uL ack mtu:%uz",
  995.                        path->seqnum, path->mtu);

  997.         ngx_quic_discover_path_mtu(c, path);

  999.         break;
  1000.     }

  1002.     return NGX_OK;
  1003. }

One Level Up Top Level