One Level Up Top Level

src/event/quic/ngx_event_quic_migration.c - nginx

Functions defined

Macros defined

Source code


  2. /*
  3. * Copyright (C) Nginx, Inc.
  4. */


  7. #include <ngx_config.h>
  8. #include <ngx_core.h>
  9. #include <ngx_event.h>
  10. #include <ngx_event_quic_connection.h>


  13. ‌#define NGX_QUIC_PATH_MTU_DELAY       100
  14. ‌#define NGX_QUIC_PATH_MTU_PRECISION   16


  17. static void ngx_quic_set_connection_path(ngx_connection_t *c,
  18.     ngx_quic_path_t *path);
  19. static ngx_int_t ngx_quic_validate_path(ngx_connection_t *c,
  20.     ngx_quic_path_t *path);
  21. static ngx_int_t ngx_quic_send_path_challenge(ngx_connection_t *c,
  22.     ngx_quic_path_t *path);
  23. static void ngx_quic_set_path_timer(ngx_connection_t *c);
  24. static ngx_int_t ngx_quic_expire_path_validation(ngx_connection_t *c,
  25.     ngx_quic_path_t *path);
  26. static ngx_int_t ngx_quic_expire_path_mtu_delay(ngx_connection_t *c,
  27.     ngx_quic_path_t *path);
  28. static ngx_int_t ngx_quic_expire_path_mtu_discovery(ngx_connection_t *c,
  29.     ngx_quic_path_t *path);
  30. static ngx_quic_path_t *ngx_quic_get_path(ngx_connection_t *c, ngx_uint_t tag);
  31. static ngx_int_t ngx_quic_send_path_mtu_probe(ngx_connection_t *c,
  32.     ngx_quic_path_t *path);


  35. ngx_int_t
  36. ‌ngx_quic_handle_path_challenge_frame(ngx_connection_t *c,
  37.     ngx_quic_header_t *pkt, ngx_quic_path_challenge_frame_t *f)
  38. {
  39.     size_t                  min;
  40.     ngx_quic_frame_t       *fp;
  41.     ngx_quic_connection_t  *qc;

  43.     if (pkt->level != NGX_QUIC_ENCRYPTION_APPLICATION || pkt->path_challenged) {
  44.         ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
  45.                        "quic ignoring PATH_CHALLENGE");
  46.         return NGX_OK;
  47.     }

  49.     pkt->path_challenged = 1;

  51.     qc = ngx_quic_get_connection(c);

  53.     fp = ngx_quic_alloc_frame(c);
  54.     if (fp == NULL) {
  55.         return NGX_ERROR;
  56.     }

  58.     fp->level = NGX_QUIC_ENCRYPTION_APPLICATION;
  59.     fp->type = NGX_QUIC_FT_PATH_RESPONSE;
  60.     fp->u.path_response = *f;

  62.     /*
  63.      * RFC 9000, 8.2.2.  Path Validation Responses
  64.      *
  65.      * A PATH_RESPONSE frame MUST be sent on the network path where the
  66.      * PATH_CHALLENGE frame was received.
  67.      */

  69.     /*
  70.      * An endpoint MUST expand datagrams that contain a PATH_RESPONSE frame
  71.      * to at least the smallest allowed maximum datagram size of 1200 bytes.
  72.      * ...
  73.      * However, an endpoint MUST NOT expand the datagram containing the
  74.      * PATH_RESPONSE if the resulting data exceeds the anti-amplification limit.
  75.      */

  77.     min = (ngx_quic_path_limit(c, pkt->path, 1200) < 1200) ? 0 : 1200;

  79.     if (ngx_quic_frame_sendto(c, fp, min, pkt->path) == NGX_ERROR) {
  80.         return NGX_ERROR;
  81.     }

  83.     if (pkt->path == qc->path) {
  84.         /*
  85.          * RFC 9000, 9.3.3.  Off-Path Packet Forwarding
  86.          *
  87.          * An endpoint that receives a PATH_CHALLENGE on an active path SHOULD
  88.          * send a non-probing packet in response.
  89.          */

  91.         fp = ngx_quic_alloc_frame(c);
  92.         if (fp == NULL) {
  93.             return NGX_ERROR;
  94.         }

  96.         fp->level = NGX_QUIC_ENCRYPTION_APPLICATION;
  97.         fp->type = NGX_QUIC_FT_PING;

  99.         ngx_quic_queue_frame(qc, fp);
  100.     }

  102.     return NGX_OK;
  103. }


  106. ngx_int_t
  107. ‌ngx_quic_handle_path_response_frame(ngx_connection_t *c,
  108.     ngx_quic_path_challenge_frame_t *f)
  109. {
  110.     ngx_uint_t              rst;
  111.     ngx_queue_t            *q;
  112.     ngx_quic_path_t        *path, *prev;
  113.     ngx_quic_send_ctx_t    *ctx;
  114.     ngx_quic_connection_t  *qc;

  116.     qc = ngx_quic_get_connection(c);

  118.     /*
  119.      * RFC 9000, 8.2.3.  Successful Path Validation
  120.      *
  121.      * A PATH_RESPONSE frame received on any network path validates the path
  122.      * on which the PATH_CHALLENGE was sent.
  123.      */

  125.     for (q = ngx_queue_head(&qc->paths);
  126.          q != ngx_queue_sentinel(&qc->paths);
  127.          q = ngx_queue_next(q))
  128.     {
  129.         path = ngx_queue_data(q, ngx_quic_path_t, queue);

  131.         if (path->state != NGX_QUIC_PATH_VALIDATING) {
  132.             continue;
  133.         }

  135.         if (ngx_memcmp(path->challenge[0], f->data, sizeof(f->data)) == 0
  136.             || ngx_memcmp(path->challenge[1], f->data, sizeof(f->data)) == 0)
  137.         {
  138.             goto valid;
  139.         }
  140.     }

  142.     ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0,
  143.                    "quic stale PATH_RESPONSE ignored");

  145.     return NGX_OK;

  147. valid:

  149.     /*
  150.      * RFC 9000, 9.4.  Loss Detection and Congestion Control
  151.      *
  152.      * On confirming a peer's ownership of its new address,
  153.      * an endpoint MUST immediately reset the congestion controller
  154.      * and round-trip time estimator for the new path to initial values
  155.      * unless the only change in the peer's address is its port number.
  156.      */

  158.     rst = 1;

  160.     prev = ngx_quic_get_path(c, NGX_QUIC_PATH_BACKUP);

  162.     if (prev != NULL) {

  164.         if (ngx_cmp_sockaddr(prev->sockaddr, prev->socklen,
  165.                              path->sockaddr, path->socklen, 0)
  166.             == NGX_OK)
  167.         {
  168.             /* address did not change */
  169.             rst = 0;

  171.             path->mtu = prev->mtu;
  172.             path->max_mtu = prev->max_mtu;
  173.             path->mtu_unvalidated = 0;
  174.         }
  175.     }

  177.     if (rst) {
  178.         /* prevent old path packets contribution to congestion control */

  180.         ctx = ngx_quic_get_send_ctx(qc, NGX_QUIC_ENCRYPTION_APPLICATION);
  181.         qc->rst_pnum = ctx->pnum;

  183.         ngx_memzero(&qc->congestion, sizeof(ngx_quic_congestion_t));

  185.         qc->congestion.window = ngx_min(10 * NGX_QUIC_MIN_INITIAL_SIZE,
  186.                                    ngx_max(2 * NGX_QUIC_MIN_INITIAL_SIZE,
  187.                                            14720));
  188.         qc->congestion.ssthresh = (size_t) -1;
  189.         qc->congestion.mtu = NGX_QUIC_MIN_INITIAL_SIZE;
  190.         qc->congestion.recovery_start = ngx_current_msec - 1;

  192.         ngx_quic_init_rtt(qc);
  193.     }

  195.     path->validated = 1;

  197.     ngx_quic_set_connection_path(c, path);

  199.     if (path->mtu_unvalidated) {
  200.         path->mtu_unvalidated = 0;
  201.         return ngx_quic_validate_path(c, path);
  202.     }

  204.     /*
  205.      * RFC 9000, 9.3.  Responding to Connection Migration
  206.      *
  207.      *  After verifying a new client address, the server SHOULD
  208.      *  send new address validation tokens (Section 8) to the client.
  209.      */

  211.     if (ngx_quic_send_new_token(c, path) != NGX_OK) {
  212.         return NGX_ERROR;
  213.     }

  215.     ngx_log_error(NGX_LOG_INFO, c->log, 0,
  216.                   "quic path seq:%uL addr:%V successfully validated",
  217.                   path->seqnum, &path->addr_text);

  219.     ngx_quic_path_dbg(c, "is validated", path);

  221.     ngx_quic_discover_path_mtu(c, path);

  223.     return NGX_OK;
  224. }


  227. ngx_quic_path_t *
  228. ‌ngx_quic_new_path(ngx_connection_t *c,
  229.     struct sockaddr *sockaddr, socklen_t socklen, ngx_quic_client_id_t *cid)
  230. {
  231.     ngx_queue_t            *q;
  232.     ngx_quic_path_t        *path;
  233.     ngx_quic_connection_t  *qc;

  235.     qc = ngx_quic_get_connection(c);

  237.     if (!ngx_queue_empty(&qc->free_paths)) {

  239.         q = ngx_queue_head(&qc->free_paths);
  240.         path = ngx_queue_data(q, ngx_quic_path_t, queue);

  242.         ngx_queue_remove(&path->queue);

  244.         ngx_memzero(path, sizeof(ngx_quic_path_t));

  246.     } else {

  248.         path = ngx_pcalloc(c->pool, sizeof(ngx_quic_path_t));
  249.         if (path == NULL) {
  250.             return NULL;
  251.         }
  252.     }

  254.     ngx_queue_insert_tail(&qc->paths, &path->queue);

  256.     path->cid = cid;
  257.     cid->used = 1;

  259.     path->seqnum = qc->path_seqnum++;

  261.     path->sockaddr = &path->sa.sockaddr;
  262.     path->socklen = socklen;
  263.     ngx_memcpy(path->sockaddr, sockaddr, socklen);

  265.     path->addr_text.data = path->text;
  266.     path->addr_text.len = ngx_sock_ntop(sockaddr, socklen, path->text,
  267.                                         NGX_SOCKADDR_STRLEN, 1);

  269.     path->mtu = NGX_QUIC_MIN_INITIAL_SIZE;

  271.     ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
  272.                    "quic path seq:%uL created addr:%V",
  273.                    path->seqnum, &path->addr_text);
  274.     return path;
  275. }


  278. static ngx_quic_path_t *
  279. ‌ngx_quic_get_path(ngx_connection_t *c, ngx_uint_t tag)
  280. {
  281.     ngx_queue_t            *q;
  282.     ngx_quic_path_t        *path;
  283.     ngx_quic_connection_t  *qc;

  285.     qc = ngx_quic_get_connection(c);

  287.     for (q = ngx_queue_head(&qc->paths);
  288.          q != ngx_queue_sentinel(&qc->paths);
  289.          q = ngx_queue_next(q))
  290.     {
  291.         path = ngx_queue_data(q, ngx_quic_path_t, queue);

  293.         if (path->tag == tag) {
  294.             return path;
  295.         }
  296.     }

  298.     return NULL;
  299. }


  302. ngx_int_t
  303. ‌ngx_quic_set_path(ngx_connection_t *c, ngx_quic_header_t *pkt)
  304. {
  305.     off_t                   len;
  306.     ngx_queue_t            *q;
  307.     ngx_quic_path_t        *path, *probe;
  308.     ngx_quic_socket_t      *qsock;
  309.     ngx_quic_send_ctx_t    *ctx;
  310.     ngx_quic_client_id_t   *cid;
  311.     ngx_quic_connection_t  *qc;

  313.     qc = ngx_quic_get_connection(c);
  314.     qsock = ngx_quic_get_socket(c);

  316.     len = pkt->raw->last - pkt->raw->start;

  318.     if (c->udp->buffer == NULL) {
  319.         /* first ever packet in connection, path already exists  */
  320.         path = qc->path;
  321.         goto update;
  322.     }

  324.     probe = NULL;

  326.     for (q = ngx_queue_head(&qc->paths);
  327.          q != ngx_queue_sentinel(&qc->paths);
  328.          q = ngx_queue_next(q))
  329.     {
  330.         path = ngx_queue_data(q, ngx_quic_path_t, queue);

  332.         if (ngx_cmp_sockaddr(&qsock->sockaddr.sockaddr, qsock->socklen,
  333.                              path->sockaddr, path->socklen, 1)
  334.             == NGX_OK)
  335.         {
  336.             goto update;
  337.         }

  339.         if (path->tag == NGX_QUIC_PATH_PROBE) {
  340.             probe = path;
  341.         }
  342.     }

  344.     /* packet from new path, drop current probe, if any */

  346.     ctx = ngx_quic_get_send_ctx(qc, pkt->level);

  348.     /*
  349.      * only accept highest-numbered packets to prevent connection id
  350.      * exhaustion by excessive probing packets from unknown paths
  351.      */
  352.     if (pkt->pn != ctx->largest_pn) {
  353.         return NGX_DONE;
  354.     }

  356.     if (probe && ngx_quic_free_path(c, probe) != NGX_OK) {
  357.         return NGX_ERROR;
  358.     }

  360.     /* new path requires new client id */
  361.     cid = ngx_quic_next_client_id(c);
  362.     if (cid == NULL) {
  363.         ngx_log_error(NGX_LOG_INFO, c->log, 0,
  364.                       "quic no available client ids for new path");
  365.         /* stop processing of this datagram */
  366.         return NGX_DONE;
  367.     }

  369.     path = ngx_quic_new_path(c, &qsock->sockaddr.sockaddr, qsock->socklen, cid);
  370.     if (path == NULL) {
  371.         return NGX_ERROR;
  372.     }

  374.     path->tag = NGX_QUIC_PATH_PROBE;

  376.     /*
  377.      * client arrived using new path and previously seen DCID,
  378.      * this indicates NAT rebinding (or bad client)
  379.      */
  380.     if (qsock->used) {
  381.         pkt->rebound = 1;
  382.     }

  384. update:

  386.     qsock->used = 1;
  387.     pkt->path = path;

  389.     /* TODO: this may be too late in some cases;
  390.      *       for example, if error happens during decrypt(), we cannot
  391.      *       send CC, if error happens in 1st packet, due to amplification
  392.      *       limit, because path->received = 0
  393.      *
  394.      *       should we account garbage as received or only decrypting packets?
  395.      */
  396.     path->received += len;

  398.     ngx_log_debug3(NGX_LOG_DEBUG_EVENT, c->log, 0,
  399.                    "quic packet len:%O via sock seq:%L path seq:%uL",
  400.                    len, (int64_t) qsock->sid.seqnum, path->seqnum);
  401.     ngx_quic_path_dbg(c, "status", path);

  403.     return NGX_OK;
  404. }


  407. ngx_int_t
  408. ‌ngx_quic_free_path(ngx_connection_t *c, ngx_quic_path_t *path)
  409. {
  410.     ngx_quic_connection_t  *qc;

  412.     qc = ngx_quic_get_connection(c);

  414.     ngx_queue_remove(&path->queue);
  415.     ngx_queue_insert_head(&qc->free_paths, &path->queue);

  417.     /*
  418.      * invalidate CID that is no longer usable for any other path;
  419.      * this also requests new CIDs from client
  420.      */
  421.     if (path->cid) {
  422.         if (ngx_quic_free_client_id(c, path->cid) != NGX_OK) {
  423.             return NGX_ERROR;
  424.         }
  425.     }

  427.     ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
  428.                    "quic path seq:%uL addr:%V retired",
  429.                    path->seqnum, &path->addr_text);

  431.     return NGX_OK;
  432. }


  435. static void
  436. ‌ngx_quic_set_connection_path(ngx_connection_t *c, ngx_quic_path_t *path)
  437. {
  438.     ngx_memcpy(c->sockaddr, path->sockaddr, path->socklen);
  439.     c->socklen = path->socklen;

  441.     if (c->addr_text.data) {
  442.         c->addr_text.len = ngx_sock_ntop(c->sockaddr, c->socklen,
  443.                                          c->addr_text.data,
  444.                                          c->listening->addr_text_max_len, 0);
  445.     }

  447.     ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
  448.                    "quic send path set to seq:%uL addr:%V",
  449.                    path->seqnum, &path->addr_text);
  450. }


  453. ngx_int_t
  454. ‌ngx_quic_handle_migration(ngx_connection_t *c, ngx_quic_header_t *pkt)
  455. {
  456.     ngx_quic_path_t        *next, *bkp;
  457.     ngx_quic_send_ctx_t    *ctx;
  458.     ngx_quic_connection_t  *qc;

  460.     /* got non-probing packet via non-active path */

  462.     qc = ngx_quic_get_connection(c);

  464.     ctx = ngx_quic_get_send_ctx(qc, pkt->level);

  466.     /*
  467.      * RFC 9000, 9.3.  Responding to Connection Migration
  468.      *
  469.      * An endpoint only changes the address to which it sends packets in
  470.      * response to the highest-numbered non-probing packet.
  471.      */
  472.     if (pkt->pn != ctx->largest_pn) {
  473.         return NGX_OK;
  474.     }

  476.     next = pkt->path;

  478.     /*
  479.      * RFC 9000, 9.3.3:
  480.      *
  481.      * In response to an apparent migration, endpoints MUST validate the
  482.      * previously active path using a PATH_CHALLENGE frame.
  483.      */
  484.     if (pkt->rebound) {

  486.         /* NAT rebinding: client uses new path with old SID */
  487.         if (ngx_quic_validate_path(c, qc->path) != NGX_OK) {
  488.             return NGX_ERROR;
  489.         }
  490.     }

  492.     if (qc->path->validated) {

  494.         if (next->tag != NGX_QUIC_PATH_BACKUP) {
  495.             /* can delete backup path, if any */
  496.             bkp = ngx_quic_get_path(c, NGX_QUIC_PATH_BACKUP);

  498.             if (bkp && ngx_quic_free_path(c, bkp) != NGX_OK) {
  499.                 return NGX_ERROR;
  500.             }
  501.         }

  503.         qc->path->tag = NGX_QUIC_PATH_BACKUP;
  504.         ngx_quic_path_dbg(c, "is now backup", qc->path);

  506.     } else {
  507.         if (ngx_quic_free_path(c, qc->path) != NGX_OK) {
  508.             return NGX_ERROR;
  509.         }
  510.     }

  512.     /* switch active path to migrated */
  513.     qc->path = next;
  514.     qc->path->tag = NGX_QUIC_PATH_ACTIVE;

  516.     if (next->validated) {
  517.         ngx_quic_set_connection_path(c, next);

  519.     } else if (next->state != NGX_QUIC_PATH_VALIDATING) {
  520.         if (ngx_quic_validate_path(c, next) != NGX_OK) {
  521.             return NGX_ERROR;
  522.         }
  523.     }

  525.     ngx_log_error(NGX_LOG_INFO, c->log, 0,
  526.                   "quic migrated to path seq:%uL addr:%V",
  527.                   qc->path->seqnum, &qc->path->addr_text);

  529.     ngx_quic_path_dbg(c, "is now active", qc->path);

  531.     return NGX_OK;
  532. }


  535. static ngx_int_t
  536. ‌ngx_quic_validate_path(ngx_connection_t *c, ngx_quic_path_t *path)
  537. {
  538.     ngx_msec_t              pto;
  539.     ngx_quic_send_ctx_t    *ctx;
  540.     ngx_quic_connection_t  *qc;

  542.     qc = ngx_quic_get_connection(c);

  544.     ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
  545.                    "quic initiated validation of path seq:%uL", path->seqnum);

  547.     path->tries = 0;

  549.     if (RAND_bytes((u_char *) path->challenge, sizeof(path->challenge)) != 1) {
  550.         return NGX_ERROR;
  551.     }

  553.     (void) ngx_quic_send_path_challenge(c, path);

  555.     ctx = ngx_quic_get_send_ctx(qc, NGX_QUIC_ENCRYPTION_APPLICATION);
  556.     pto = ngx_max(ngx_quic_pto(c, ctx), 1000);

  558.     path->expires = ngx_current_msec + pto;
  559.     path->state = NGX_QUIC_PATH_VALIDATING;

  561.     ngx_quic_set_path_timer(c);

  563.     return NGX_OK;
  564. }


  567. static ngx_int_t
  568. ‌ngx_quic_send_path_challenge(ngx_connection_t *c, ngx_quic_path_t *path)
  569. {
  570.     size_t             min;
  571.     ngx_uint_t         n;
  572.     ngx_quic_frame_t  *frame;

  574.     ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
  575.                    "quic path seq:%uL send path_challenge tries:%ui",
  576.                    path->seqnum, path->tries);

  578.     for (n = 0; n < 2; n++) {

  580.         frame = ngx_quic_alloc_frame(c);
  581.         if (frame == NULL) {
  582.             return NGX_ERROR;
  583.         }

  585.         frame->level = NGX_QUIC_ENCRYPTION_APPLICATION;
  586.         frame->type = NGX_QUIC_FT_PATH_CHALLENGE;

  588.         ngx_memcpy(frame->u.path_challenge.data, path->challenge[n], 8);

  590.         /*
  591.          * RFC 9000, 8.2.1.  Initiating Path Validation
  592.          *
  593.          * An endpoint MUST expand datagrams that contain a PATH_CHALLENGE frame
  594.          * to at least the smallest allowed maximum datagram size of 1200 bytes,
  595.          * unless the anti-amplification limit for the path does not permit
  596.          * sending a datagram of this size.
  597.          */

  599.         if (path->mtu_unvalidated
  600.             || ngx_quic_path_limit(c, path, 1200) < 1200)
  601.         {
  602.             min = 0;
  603.             path->mtu_unvalidated = 1;

  605.         } else {
  606.             min = 1200;
  607.         }

  609.         if (ngx_quic_frame_sendto(c, frame, min, path) == NGX_ERROR) {
  610.             return NGX_ERROR;
  611.         }
  612.     }

  614.     return NGX_OK;
  615. }


  618. void
  619. ‌ngx_quic_discover_path_mtu(ngx_connection_t *c, ngx_quic_path_t *path)
  620. {
  621.     ngx_quic_connection_t  *qc;

  623.     qc = ngx_quic_get_connection(c);

  625.     if (path->max_mtu) {
  626.         if (path->max_mtu - path->mtu <= NGX_QUIC_PATH_MTU_PRECISION) {
  627.             path->state = NGX_QUIC_PATH_IDLE;
  628.             ngx_quic_set_path_timer(c);
  629.             return;
  630.         }

  632.         path->mtud = (path->mtu + path->max_mtu) / 2;

  634.     } else {
  635.         path->mtud = path->mtu * 2;

  637.         if (path->mtud >= qc->ctp.max_udp_payload_size) {
  638.             path->mtud = qc->ctp.max_udp_payload_size;
  639.             path->max_mtu = qc->ctp.max_udp_payload_size;
  640.         }
  641.     }

  643.     path->state = NGX_QUIC_PATH_WAITING;
  644.     path->expires = ngx_current_msec + NGX_QUIC_PATH_MTU_DELAY;

  646.     ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
  647.                    "quic path seq:%uL schedule mtu:%uz",
  648.                    path->seqnum, path->mtud);

  650.     ngx_quic_set_path_timer(c);
  651. }


  654. static void
  655. ‌ngx_quic_set_path_timer(ngx_connection_t *c)
  656. {
  657.     ngx_msec_t              now;
  658.     ngx_queue_t            *q;
  659.     ngx_msec_int_t          left, next;
  660.     ngx_quic_path_t        *path;
  661.     ngx_quic_connection_t  *qc;

  663.     qc = ngx_quic_get_connection(c);

  665.     now = ngx_current_msec;
  666.     next = -1;

  668.     for (q = ngx_queue_head(&qc->paths);
  669.          q != ngx_queue_sentinel(&qc->paths);
  670.          q = ngx_queue_next(q))
  671.     {
  672.         path = ngx_queue_data(q, ngx_quic_path_t, queue);

  674.         if (path->state == NGX_QUIC_PATH_IDLE) {
  675.             continue;
  676.         }

  678.         left = path->expires - now;
  679.         left = ngx_max(left, 1);

  681.         if (next == -1 || left < next) {
  682.             next = left;
  683.         }
  684.     }

  686.     if (next != -1) {
  687.         ngx_add_timer(&qc->path_validation, next);

  689.     } else if (qc->path_validation.timer_set) {
  690.         ngx_del_timer(&qc->path_validation);
  691.     }
  692. }


  695. void
  696. ‌ngx_quic_path_handler(ngx_event_t *ev)
  697. {
  698.     ngx_msec_t              now;
  699.     ngx_queue_t            *q;
  700.     ngx_msec_int_t          left;
  701.     ngx_quic_path_t        *path;
  702.     ngx_connection_t       *c;
  703.     ngx_quic_connection_t  *qc;

  705.     c = ev->data;
  706.     qc = ngx_quic_get_connection(c);

  708.     now = ngx_current_msec;

  710.     q = ngx_queue_head(&qc->paths);

  712.     while (q != ngx_queue_sentinel(&qc->paths)) {

  714.         path = ngx_queue_data(q, ngx_quic_path_t, queue);
  715.         q = ngx_queue_next(q);

  717.         if (path->state == NGX_QUIC_PATH_IDLE) {
  718.             continue;
  719.         }

  721.         left = path->expires - now;

  723.         if (left > 0) {
  724.             continue;
  725.         }

  727.         switch (path->state) {
  728.         case NGX_QUIC_PATH_VALIDATING:
  729.             if (ngx_quic_expire_path_validation(c, path) != NGX_OK) {
  730.                 goto failed;
  731.             }

  733.             break;

  735.         case NGX_QUIC_PATH_WAITING:
  736.             if (ngx_quic_expire_path_mtu_delay(c, path) != NGX_OK) {
  737.                 goto failed;
  738.             }

  740.             break;

  742.         case NGX_QUIC_PATH_MTUD:
  743.             if (ngx_quic_expire_path_mtu_discovery(c, path) != NGX_OK) {
  744.                 goto failed;
  745.             }

  747.             break;

  749.         default:
  750.             break;
  751.         }
  752.     }

  754.     ngx_quic_set_path_timer(c);

  756.     return;

  758. failed:

  760.     ngx_quic_close_connection(c, NGX_ERROR);
  761. }


  764. static ngx_int_t
  765. ‌ngx_quic_expire_path_validation(ngx_connection_t *c, ngx_quic_path_t *path)
  766. {
  767.     ngx_msec_int_t          pto;
  768.     ngx_quic_path_t        *bkp;
  769.     ngx_quic_send_ctx_t    *ctx;
  770.     ngx_quic_connection_t  *qc;

  772.     qc = ngx_quic_get_connection(c);
  773.     ctx = ngx_quic_get_send_ctx(qc, NGX_QUIC_ENCRYPTION_APPLICATION);

  775.     if (++path->tries < NGX_QUIC_PATH_RETRIES) {
  776.         pto = ngx_max(ngx_quic_pto(c, ctx), 1000) << path->tries;
  777.         path->expires = ngx_current_msec + pto;

  779.         (void) ngx_quic_send_path_challenge(c, path);

  781.         return NGX_OK;
  782.     }

  784.     ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0,
  785.                    "quic path seq:%uL validation failed", path->seqnum);

  787.     /* found expired path */

  789.     path->validated = 0;


  792.     /* RFC 9000, 9.3.2.  On-Path Address Spoofing
  793.      *
  794.      * To protect the connection from failing due to such a spurious
  795.      * migration, an endpoint MUST revert to using the last validated
  796.      * peer address when validation of a new peer address fails.
  797.      */

  799.     if (qc->path == path) {
  800.         /* active path validation failed */

  802.         bkp = ngx_quic_get_path(c, NGX_QUIC_PATH_BACKUP);

  804.         if (bkp == NULL) {
  805.             qc->error = NGX_QUIC_ERR_NO_VIABLE_PATH;
  806.             qc->error_reason = "no viable path";
  807.             return NGX_ERROR;
  808.         }

  810.         qc->path = bkp;
  811.         qc->path->tag = NGX_QUIC_PATH_ACTIVE;

  813.         ngx_log_error(NGX_LOG_INFO, c->log, 0,
  814.                       "quic path seq:%uL addr:%V is restored from backup",
  815.                       qc->path->seqnum, &qc->path->addr_text);

  817.         ngx_quic_path_dbg(c, "is active", qc->path);
  818.     }

  820.     return ngx_quic_free_path(c, path);
  821. }


  824. static ngx_int_t
  825. ‌ngx_quic_expire_path_mtu_delay(ngx_connection_t *c, ngx_quic_path_t *path)
  826. {
  827.     ngx_int_t               rc;
  828.     ngx_uint_t              i;
  829.     ngx_msec_t              pto;
  830.     ngx_quic_send_ctx_t    *ctx;
  831.     ngx_quic_connection_t  *qc;

  833.     qc = ngx_quic_get_connection(c);
  834.     ctx = ngx_quic_get_send_ctx(qc, NGX_QUIC_ENCRYPTION_APPLICATION);

  836.     path->tries = 0;

  838.     for ( ;; ) {

  840.         for (i = 0; i < NGX_QUIC_PATH_RETRIES; i++) {
  841.             path->mtu_pnum[i] = NGX_QUIC_UNSET_PN;
  842.         }

  844.         rc = ngx_quic_send_path_mtu_probe(c, path);

  846.         if (rc == NGX_ERROR) {
  847.             return NGX_ERROR;
  848.         }

  850.         if (rc == NGX_OK) {
  851.             pto = ngx_quic_pto(c, ctx);
  852.             path->expires = ngx_current_msec + pto;
  853.             path->state = NGX_QUIC_PATH_MTUD;
  854.             return NGX_OK;
  855.         }

  857.         /* rc == NGX_DECLINED */

  859.         path->max_mtu = path->mtud;

  861.         if (path->max_mtu - path->mtu <= NGX_QUIC_PATH_MTU_PRECISION) {
  862.             path->state = NGX_QUIC_PATH_IDLE;
  863.             return NGX_OK;
  864.         }

  866.         path->mtud = (path->mtu + path->max_mtu) / 2;
  867.     }
  868. }


  871. static ngx_int_t
  872. ‌ngx_quic_expire_path_mtu_discovery(ngx_connection_t *c, ngx_quic_path_t *path)
  873. {
  874.     ngx_int_t               rc;
  875.     ngx_msec_int_t          pto;
  876.     ngx_quic_send_ctx_t    *ctx;
  877.     ngx_quic_connection_t  *qc;

  879.     qc = ngx_quic_get_connection(c);
  880.     ctx = ngx_quic_get_send_ctx(qc, NGX_QUIC_ENCRYPTION_APPLICATION);

  882.     if (++path->tries < NGX_QUIC_PATH_RETRIES) {
  883.         rc = ngx_quic_send_path_mtu_probe(c, path);

  885.         if (rc == NGX_ERROR) {
  886.             return NGX_ERROR;
  887.         }

  889.         if (rc == NGX_OK) {
  890.             pto = ngx_quic_pto(c, ctx) << path->tries;
  891.             path->expires = ngx_current_msec + pto;
  892.             return NGX_OK;
  893.         }

  895.         /* rc == NGX_DECLINED */
  896.     }

  898.     ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
  899.                    "quic path seq:%uL expired mtu:%uz",
  900.                    path->seqnum, path->mtud);

  902.     path->max_mtu = path->mtud;

  904.     ngx_quic_discover_path_mtu(c, path);

  906.     return NGX_OK;
  907. }


  910. static ngx_int_t
  911. ‌ngx_quic_send_path_mtu_probe(ngx_connection_t *c, ngx_quic_path_t *path)
  912. {
  913.     size_t                  mtu;
  914.     uint64_t                pnum;
  915.     ngx_int_t               rc;
  916.     ngx_uint_t              log_error;
  917.     ngx_quic_frame_t       *frame;
  918.     ngx_quic_send_ctx_t    *ctx;
  919.     ngx_quic_connection_t  *qc;

  921.     frame = ngx_quic_alloc_frame(c);
  922.     if (frame == NULL) {
  923.         return NGX_ERROR;
  924.     }

  926.     frame->level = NGX_QUIC_ENCRYPTION_APPLICATION;
  927.     frame->type = NGX_QUIC_FT_PING;
  928.     frame->ignore_loss = 1;
  929.     frame->ignore_congestion = 1;

  931.     qc = ngx_quic_get_connection(c);
  932.     ctx = ngx_quic_get_send_ctx(qc, NGX_QUIC_ENCRYPTION_APPLICATION);
  933.     pnum = ctx->pnum;

  935.     ngx_log_debug4(NGX_LOG_DEBUG_EVENT, c->log, 0,
  936.                    "quic path seq:%uL send probe "
  937.                    "mtu:%uz pnum:%uL tries:%ui",
  938.                    path->seqnum, path->mtud, ctx->pnum, path->tries);

  940.     log_error = c->log_error;
  941.     c->log_error = NGX_ERROR_IGNORE_EMSGSIZE;

  943.     mtu = path->mtu;
  944.     path->mtu = path->mtud;

  946.     rc = ngx_quic_frame_sendto(c, frame, path->mtud, path);

  948.     path->mtu = mtu;
  949.     c->log_error = log_error;

  951.     if (rc == NGX_OK) {
  952.         path->mtu_pnum[path->tries] = pnum;
  953.         return NGX_OK;
  954.     }

  956.     ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
  957.                    "quic path seq:%uL rejected mtu:%uz",
  958.                    path->seqnum, path->mtud);

  960.     if (rc == NGX_ERROR) {
  961.         if (c->write->error) {
  962.             c->write->error = 0;
  963.             return NGX_DECLINED;
  964.         }

  966.         return NGX_ERROR;
  967.     }

  969.     return NGX_OK;
  970. }


  973. ngx_int_t
  974. ‌ngx_quic_handle_path_mtu(ngx_connection_t *c, ngx_quic_path_t *path,
  975.     uint64_t min, uint64_t max)
  976. {
  977.     uint64_t    pnum;
  978.     ngx_uint_t  i;

  980.     if (path->state != NGX_QUIC_PATH_MTUD) {
  981.         return NGX_OK;
  982.     }

  984.     for (i = 0; i < NGX_QUIC_PATH_RETRIES; i++) {
  985.         pnum = path->mtu_pnum[i];

  987.         if (pnum == NGX_QUIC_UNSET_PN) {
  988.             continue;
  989.         }

  991.         if (pnum < min || pnum > max) {
  992.             continue;
  993.         }

  995.         path->mtu = path->mtud;

  997.         ngx_log_debug2(NGX_LOG_DEBUG_EVENT, c->log, 0,
  998.                        "quic path seq:%uL ack mtu:%uz",
  999.                        path->seqnum, path->mtu);

  1001.         ngx_quic_discover_path_mtu(c, path);

  1003.         break;
  1004.     }

  1006.     return NGX_OK;
  1007. }

One Level Up Top Level