From e0d38508fc8b6bc3915b2235a85a068eacfb87bf Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Tue, 11 Jun 2024 18:46:31 +0200 Subject: Merging upstream version 1.62.1. Signed-off-by: Daniel Baumann --- src/shrpx_quic_connection_handler.cc | 172 ++++++++++++++++++----------------- 1 file changed, 89 insertions(+), 83 deletions(-) (limited to 'src/shrpx_quic_connection_handler.cc') diff --git a/src/shrpx_quic_connection_handler.cc b/src/shrpx_quic_connection_handler.cc index b810aa6..f10cc83 100644 --- a/src/shrpx_quic_connection_handler.cc +++ b/src/shrpx_quic_connection_handler.cc @@ -63,17 +63,18 @@ int QUICConnectionHandler::handle_packet(const UpstreamAddr *faddr, const Address &remote_addr, const Address &local_addr, const ngtcp2_pkt_info &pi, - const uint8_t *data, size_t datalen) { + std::span data) { int rv; ngtcp2_version_cid vc; - rv = ngtcp2_pkt_decode_version_cid(&vc, data, datalen, SHRPX_QUIC_SCIDLEN); + rv = ngtcp2_pkt_decode_version_cid(&vc, data.data(), data.size(), + SHRPX_QUIC_SCIDLEN); switch (rv) { case 0: break; case NGTCP2_ERR_VERSION_NEGOTIATION: - send_version_negotiation(faddr, vc.version, vc.dcid, vc.dcidlen, vc.scid, - vc.scidlen, remote_addr, local_addr); + send_version_negotiation(faddr, vc.version, {vc.dcid, vc.dcidlen}, + {vc.scid, vc.scidlen}, remote_addr, local_addr); return 0; default: @@ -97,7 +98,7 @@ int QUICConnectionHandler::handle_packet(const UpstreamAddr *faddr, if (cwit != std::end(close_waits_)) { auto cw = (*cwit).second; - cw->handle_packet(faddr, remote_addr, local_addr, pi, data, datalen); + cw->handle_packet(faddr, remote_addr, local_addr, pi, data); return 0; } @@ -114,7 +115,7 @@ int QUICConnectionHandler::handle_packet(const UpstreamAddr *faddr, if (cwit != std::end(close_waits_)) { auto cw = (*cwit).second; - cw->handle_packet(faddr, remote_addr, local_addr, pi, data, datalen); + cw->handle_packet(faddr, remote_addr, local_addr, pi, data); return 0; } @@ -145,7 +146,7 @@ int QUICConnectionHandler::handle_packet(const UpstreamAddr *faddr, decrypted_dcid.worker); if (quic_lwp) { if (conn_handler->forward_quic_packet_to_lingering_worker_process( - quic_lwp, remote_addr, local_addr, pi, data, datalen) == 0) { + quic_lwp, remote_addr, local_addr, pi, data) == 0) { return 0; } @@ -169,11 +170,10 @@ int QUICConnectionHandler::handle_packet(const UpstreamAddr *faddr, ngtcp2_pkt_hd hd; ngtcp2_cid odcid, *podcid = nullptr; - const uint8_t *token = nullptr; - size_t tokenlen = 0; + std::span token; ngtcp2_token_type token_type = NGTCP2_TOKEN_TYPE_UNKNOWN; - switch (ngtcp2_accept(&hd, data, datalen)) { + switch (ngtcp2_accept(&hd, data.data(), data.size())) { case 0: { // If we get Initial and it has the Worker ID of this worker, it // is likely that client is intentionally use the prefix. Just @@ -197,14 +197,15 @@ int QUICConnectionHandler::handle_packet(const UpstreamAddr *faddr, if (worker_->get_graceful_shutdown()) { send_connection_close(faddr, hd.version, hd.dcid, hd.scid, remote_addr, local_addr, NGTCP2_CONNECTION_REFUSED, - datalen * 3); + data.size() * 3); return 0; } if (hd.tokenlen == 0) { if (quicconf.upstream.require_token) { - send_retry(faddr, vc.version, vc.dcid, vc.dcidlen, vc.scid, - vc.scidlen, remote_addr, local_addr, datalen * 3); + send_retry(faddr, vc.version, {vc.dcid, vc.dcidlen}, + {vc.scid, vc.scidlen}, remote_addr, local_addr, + data.size() * 3); return 0; } @@ -223,9 +224,9 @@ int QUICConnectionHandler::handle_packet(const UpstreamAddr *faddr, auto qkm = select_quic_keying_material( *qkms.get(), vc.dcid[0] & SHRPX_QUIC_DCID_KM_ID_MASK); - if (verify_retry_token(odcid, hd.token, hd.tokenlen, hd.version, + if (verify_retry_token(odcid, {hd.token, hd.tokenlen}, hd.version, hd.dcid, &remote_addr.su.sa, remote_addr.len, - qkm->secret.data(), qkm->secret.size()) != 0) { + qkm->secret) != 0) { if (LOG_ENABLED(INFO)) { LOG(INFO) << "Failed to validate Retry token from remote=" << util::to_numeric_addr(&remote_addr); @@ -235,7 +236,7 @@ int QUICConnectionHandler::handle_packet(const UpstreamAddr *faddr, // with INVALID_TOKEN. send_connection_close(faddr, hd.version, hd.dcid, hd.scid, remote_addr, local_addr, NGTCP2_INVALID_TOKEN, - datalen * 3); + data.size() * 3); return 0; } @@ -245,8 +246,7 @@ int QUICConnectionHandler::handle_packet(const UpstreamAddr *faddr, } podcid = &odcid; - token = hd.token; - tokenlen = hd.tokenlen; + token = {hd.token, hd.tokenlen}; token_type = NGTCP2_TOKEN_TYPE_RETRY; break; @@ -265,8 +265,9 @@ int QUICConnectionHandler::handle_packet(const UpstreamAddr *faddr, } if (quicconf.upstream.require_token) { - send_retry(faddr, vc.version, vc.dcid, vc.dcidlen, vc.scid, - vc.scidlen, remote_addr, local_addr, datalen * 3); + send_retry(faddr, vc.version, {vc.dcid, vc.dcidlen}, + {vc.scid, vc.scidlen}, remote_addr, local_addr, + data.size() * 3); return 0; } @@ -277,17 +278,17 @@ int QUICConnectionHandler::handle_packet(const UpstreamAddr *faddr, auto qkm = select_quic_keying_material( *qkms.get(), hd.token[NGTCP2_CRYPTO_MAX_REGULAR_TOKENLEN]); - if (verify_token(hd.token, hd.tokenlen - 1, &remote_addr.su.sa, - remote_addr.len, qkm->secret.data(), - qkm->secret.size()) != 0) { + if (verify_token({hd.token, hd.tokenlen}, &remote_addr.su.sa, + remote_addr.len, qkm->secret) != 0) { if (LOG_ENABLED(INFO)) { LOG(INFO) << "Failed to validate token from remote=" << util::to_numeric_addr(&remote_addr); } if (quicconf.upstream.require_token) { - send_retry(faddr, vc.version, vc.dcid, vc.dcidlen, vc.scid, - vc.scidlen, remote_addr, local_addr, datalen * 3); + send_retry(faddr, vc.version, {vc.dcid, vc.dcidlen}, + {vc.scid, vc.scidlen}, remote_addr, local_addr, + data.size() * 3); return 0; } @@ -300,16 +301,16 @@ int QUICConnectionHandler::handle_packet(const UpstreamAddr *faddr, << util::to_numeric_addr(&remote_addr); } - token = hd.token; - tokenlen = hd.tokenlen; + token = {hd.token, hd.tokenlen}; token_type = NGTCP2_TOKEN_TYPE_NEW_TOKEN; break; } default: if (quicconf.upstream.require_token) { - send_retry(faddr, vc.version, vc.dcid, vc.dcidlen, vc.scid, - vc.scidlen, remote_addr, local_addr, datalen * 3); + send_retry(faddr, vc.version, {vc.dcid, vc.dcidlen}, + {vc.scid, vc.scidlen}, remote_addr, local_addr, + data.size() * 3); return 0; } @@ -322,16 +323,15 @@ int QUICConnectionHandler::handle_packet(const UpstreamAddr *faddr, default: if (!(data[0] & 0x80) && vc.dcidlen == SHRPX_QUIC_SCIDLEN && decrypted_dcid.worker != worker_->get_worker_id()) { - if (!config->single_thread && - conn_handler->forward_quic_packet(faddr, remote_addr, local_addr, - pi, decrypted_dcid.worker, data, - datalen) == 0) { + if (!config->single_thread && conn_handler->forward_quic_packet( + faddr, remote_addr, local_addr, pi, + decrypted_dcid.worker, data) == 0) { return 0; } - if (datalen >= SHRPX_QUIC_SCIDLEN + 22) { - send_stateless_reset(faddr, datalen, vc.dcid, vc.dcidlen, remote_addr, - local_addr); + if (data.size() >= SHRPX_QUIC_SCIDLEN + 22) { + send_stateless_reset(faddr, data.size(), {vc.dcid, vc.dcidlen}, + remote_addr, local_addr); } } @@ -339,7 +339,7 @@ int QUICConnectionHandler::handle_packet(const UpstreamAddr *faddr, } handler = handle_new_connection(faddr, remote_addr, local_addr, hd, podcid, - token, tokenlen, token_type); + token, token_type); if (handler == nullptr) { return 0; } @@ -347,8 +347,7 @@ int QUICConnectionHandler::handle_packet(const UpstreamAddr *faddr, handler = (*it).second; } - if (handler->read_quic(faddr, remote_addr, local_addr, pi, data, datalen) != - 0) { + if (handler->read_quic(faddr, remote_addr, local_addr, pi, data) != 0) { delete handler; return 0; } @@ -361,7 +360,7 @@ int QUICConnectionHandler::handle_packet(const UpstreamAddr *faddr, ClientHandler *QUICConnectionHandler::handle_new_connection( const UpstreamAddr *faddr, const Address &remote_addr, const Address &local_addr, const ngtcp2_pkt_hd &hd, const ngtcp2_cid *odcid, - const uint8_t *token, size_t tokenlen, ngtcp2_token_type token_type) { + std::span token, ngtcp2_token_type token_type) { std::array host; std::array service; int rv; @@ -412,7 +411,7 @@ ClientHandler *QUICConnectionHandler::handle_new_connection( StringRef{service.data()}, remote_addr.su.sa.sa_family, faddr); auto upstream = std::make_unique(handler.get()); - if (upstream->init(faddr, remote_addr, local_addr, hd, odcid, token, tokenlen, + if (upstream->init(faddr, remote_addr, local_addr, hd, odcid, token, token_type) != 0) { return nullptr; } @@ -450,8 +449,8 @@ uint32_t generate_reserved_version(const Address &addr, uint32_t version) { } // namespace int QUICConnectionHandler::send_retry( - const UpstreamAddr *faddr, uint32_t version, const uint8_t *ini_dcid, - size_t ini_dcidlen, const uint8_t *ini_scid, size_t ini_scidlen, + const UpstreamAddr *faddr, uint32_t version, + std::span ini_dcid, std::span ini_scid, const Address &remote_addr, const Address &local_addr, size_t max_pktlen) { std::array host; std::array port; @@ -476,25 +475,25 @@ int QUICConnectionHandler::send_retry( return -1; } - std::array token; - size_t tokenlen; - ngtcp2_cid idcid, iscid; - ngtcp2_cid_init(&idcid, ini_dcid, ini_dcidlen); - ngtcp2_cid_init(&iscid, ini_scid, ini_scidlen); + ngtcp2_cid_init(&idcid, ini_dcid.data(), ini_dcid.size()); + ngtcp2_cid_init(&iscid, ini_scid.data(), ini_scid.size()); + + std::array tokenbuf; - if (generate_retry_token(token.data(), tokenlen, version, &remote_addr.su.sa, - remote_addr.len, retry_scid, idcid, - qkm.secret.data(), qkm.secret.size()) != 0) { + auto token = + generate_retry_token(tokenbuf, version, &remote_addr.su.sa, + remote_addr.len, retry_scid, idcid, qkm.secret); + if (!token) { return -1; } std::vector buf; buf.resize(std::min(max_pktlen, static_cast(256))); - auto nwrite = - ngtcp2_crypto_write_retry(buf.data(), buf.size(), version, &iscid, - &retry_scid, &idcid, token.data(), tokenlen); + auto nwrite = ngtcp2_crypto_write_retry(buf.data(), buf.size(), version, + &iscid, &retry_scid, &idcid, + token->data(), token->size()); if (nwrite < 0) { LOG(ERROR) << "ngtcp2_crypto_write_retry: " << ngtcp2_strerror(nwrite); return -1; @@ -503,8 +502,8 @@ int QUICConnectionHandler::send_retry( buf.resize(nwrite); quic_send_packet(faddr, &remote_addr.su.sa, remote_addr.len, - &local_addr.su.sa, local_addr.len, ngtcp2_pkt_info{}, - buf.data(), buf.size(), 0); + &local_addr.su.sa, local_addr.len, ngtcp2_pkt_info{}, buf, + buf.size()); if (generate_quic_hashed_connection_id(idcid, remote_addr, local_addr, idcid) != 0) { @@ -528,13 +527,13 @@ int QUICConnectionHandler::send_retry( } int QUICConnectionHandler::send_version_negotiation( - const UpstreamAddr *faddr, uint32_t version, const uint8_t *ini_dcid, - size_t ini_dcidlen, const uint8_t *ini_scid, size_t ini_scidlen, + const UpstreamAddr *faddr, uint32_t version, + std::span ini_dcid, std::span ini_scid, const Address &remote_addr, const Address &local_addr) { - std::array sv{ + auto sv = std::to_array({ generate_reserved_version(remote_addr, version), NGTCP2_PROTO_VER_V1, - }; + }); std::array buf; @@ -542,22 +541,25 @@ int QUICConnectionHandler::send_version_negotiation( util::random_bytes(&rand_byte, &rand_byte + 1, worker_->get_randgen()); auto nwrite = ngtcp2_pkt_write_version_negotiation( - buf.data(), buf.size(), rand_byte, ini_scid, ini_scidlen, ini_dcid, - ini_dcidlen, sv.data(), sv.size()); + buf.data(), buf.size(), rand_byte, ini_scid.data(), ini_scid.size(), + ini_dcid.data(), ini_dcid.size(), sv.data(), sv.size()); if (nwrite < 0) { LOG(ERROR) << "ngtcp2_pkt_write_version_negotiation: " << ngtcp2_strerror(nwrite); return -1; } + auto pkt = std::span{std::begin(buf), static_cast(nwrite)}; return quic_send_packet(faddr, &remote_addr.su.sa, remote_addr.len, &local_addr.su.sa, local_addr.len, ngtcp2_pkt_info{}, - buf.data(), nwrite, 0); + pkt, pkt.size()); } -int QUICConnectionHandler::send_stateless_reset( - const UpstreamAddr *faddr, size_t pktlen, const uint8_t *dcid, - size_t dcidlen, const Address &remote_addr, const Address &local_addr) { +int QUICConnectionHandler::send_stateless_reset(const UpstreamAddr *faddr, + size_t pktlen, + std::span dcid, + const Address &remote_addr, + const Address &local_addr) { if (stateless_reset_bucket_ == 0) { if (LOG_ENABLED(INFO)) { LOG(INFO) << "Stateless Reset bucket has been depleted"; @@ -572,25 +574,24 @@ int QUICConnectionHandler::send_stateless_reset( ev_timer_again(worker_->get_loop(), &stateless_reset_bucket_regen_timer_); } - int rv; std::array token; ngtcp2_cid cid; - ngtcp2_cid_init(&cid, dcid, dcidlen); + ngtcp2_cid_init(&cid, dcid.data(), dcid.size()); auto conn_handler = worker_->get_connection_handler(); auto &qkms = conn_handler->get_quic_keying_materials(); auto &qkm = qkms->keying_materials.front(); - rv = generate_quic_stateless_reset_token(token.data(), cid, qkm.secret.data(), - qkm.secret.size()); - if (rv != 0) { + if (auto rv = generate_quic_stateless_reset_token( + token.data(), cid, qkm.secret.data(), qkm.secret.size()); + rv != 0) { return -1; } // SCID + minimum expansion - NGTCP2_STATELESS_RESET_TOKENLEN constexpr size_t max_rand_byteslen = - SHRPX_QUIC_SCIDLEN + 22 - NGTCP2_STATELESS_RESET_TOKENLEN; + NGTCP2_MAX_CIDLEN + 22 - NGTCP2_STATELESS_RESET_TOKENLEN; size_t rand_byteslen; @@ -621,12 +622,13 @@ int QUICConnectionHandler::send_stateless_reset( if (LOG_ENABLED(INFO)) { LOG(INFO) << "Send stateless_reset to remote=" << util::to_numeric_addr(&remote_addr) - << " dcid=" << util::format_hex(dcid, dcidlen); + << " dcid=" << util::format_hex(dcid); } + auto pkt = std::span{std::begin(buf), static_cast(nwrite)}; return quic_send_packet(faddr, &remote_addr.su.sa, remote_addr.len, &local_addr.su.sa, local_addr.len, ngtcp2_pkt_info{}, - buf.data(), nwrite, 0); + pkt, pkt.size()); } int QUICConnectionHandler::send_connection_close( @@ -649,13 +651,16 @@ int QUICConnectionHandler::send_connection_close( LOG(INFO) << "Send Initial CONNECTION_CLOSE with error_code=" << log::hex << error_code << log::dec << " to remote=" << util::to_numeric_addr(&remote_addr) - << " dcid=" << util::format_hex(ini_scid.data, ini_scid.datalen) - << " scid=" << util::format_hex(ini_dcid.data, ini_dcid.datalen); + << " dcid=" + << util::format_hex(std::span{ini_scid.data, ini_scid.datalen}) + << " scid=" + << util::format_hex(std::span{ini_dcid.data, ini_dcid.datalen}); } + auto pkt = std::span{std::begin(buf), static_cast(nwrite)}; return quic_send_packet(faddr, &remote_addr.su.sa, remote_addr.len, &local_addr.su.sa, local_addr.len, ngtcp2_pkt_info{}, - buf.data(), nwrite, 0); + pkt, pkt.size()); } void QUICConnectionHandler::add_connection_id(const ngtcp2_cid &cid, @@ -735,23 +740,24 @@ CloseWait::~CloseWait() { int CloseWait::handle_packet(const UpstreamAddr *faddr, const Address &remote_addr, const Address &local_addr, - const ngtcp2_pkt_info &pi, const uint8_t *data, - size_t datalen) { + const ngtcp2_pkt_info &pi, + std::span data) { if (pkt.empty()) { return 0; } ++num_pkts_recv; - bytes_recv += datalen; + bytes_recv += data.size(); if (bytes_sent + pkt.size() > 3 * bytes_recv || next_pkts_recv > num_pkts_recv) { return 0; } - if (quic_send_packet(faddr, &remote_addr.su.sa, remote_addr.len, - &local_addr.su.sa, local_addr.len, ngtcp2_pkt_info{}, - pkt.data(), pkt.size(), 0) != 0) { + auto rv = quic_send_packet(faddr, &remote_addr.su.sa, remote_addr.len, + &local_addr.su.sa, local_addr.len, + ngtcp2_pkt_info{}, pkt, pkt.size()); + if (rv != 0) { return -1; } -- cgit v1.2.3