nghttpx: Add --frontend-quic-require-token option

This commit is contained in:
Tatsuhiro Tsujikawa 2021-09-12 15:04:54 +09:00
parent ccaf2333ca
commit f74b6d9a43
5 changed files with 50 additions and 0 deletions

View File

@ -190,6 +190,7 @@ OPTIONS = [
"frontend-http3-max-concurrent-streams", "frontend-http3-max-concurrent-streams",
"frontend-quic-early-data", "frontend-quic-early-data",
"frontend-quic-qlog-dir", "frontend-quic-qlog-dir",
"frontend-quic-require-token",
] ]
LOGVARS = [ LOGVARS = [

View File

@ -3222,6 +3222,10 @@ HTTP/3 and QUIC:
each QUIC connection. The file name is ISO8601 basic each QUIC connection. The file name is ISO8601 basic
format, followed by "-", server Source Connection ID and format, followed by "-", server Source Connection ID and
".qlog". ".qlog".
--frontend-quic-require-token
Require an address validation token for a frontend QUIC
connection. Server sends a token in Retry packet or
NEW_TOKEN frame in the previous connection.
--no-quic-bpf --no-quic-bpf
Disable eBPF. Disable eBPF.
--frontend-http3-window-size=<SIZE> --frontend-http3-window-size=<SIZE>
@ -4011,6 +4015,8 @@ int main(int argc, char **argv) {
{SHRPX_OPT_FRONTEND_QUIC_EARLY_DATA.c_str(), no_argument, &flag, 180}, {SHRPX_OPT_FRONTEND_QUIC_EARLY_DATA.c_str(), no_argument, &flag, 180},
{SHRPX_OPT_FRONTEND_QUIC_QLOG_DIR.c_str(), required_argument, &flag, {SHRPX_OPT_FRONTEND_QUIC_QLOG_DIR.c_str(), required_argument, &flag,
181}, 181},
{SHRPX_OPT_FRONTEND_QUIC_REQUIRE_TOKEN.c_str(), no_argument, &flag,
182},
{nullptr, 0, nullptr, 0}}; {nullptr, 0, nullptr, 0}};
int option_index = 0; int option_index = 0;
@ -4878,6 +4884,11 @@ int main(int argc, char **argv) {
cmdcfgs.emplace_back(SHRPX_OPT_FRONTEND_QUIC_QLOG_DIR, cmdcfgs.emplace_back(SHRPX_OPT_FRONTEND_QUIC_QLOG_DIR,
StringRef{optarg}); StringRef{optarg});
break; break;
case 182:
// --frontend-quic-require-token
cmdcfgs.emplace_back(SHRPX_OPT_FRONTEND_QUIC_REQUIRE_TOKEN,
StringRef::from_lit("yes"));
break;
default: default:
break; break;
} }

View File

@ -2401,6 +2401,11 @@ int option_lookup_token(const char *name, size_t namelen) {
return SHRPX_OPTID_TLS_SESSION_CACHE_MEMCACHED; return SHRPX_OPTID_TLS_SESSION_CACHE_MEMCACHED;
} }
break; break;
case 'n':
if (util::strieq_l("frontend-quic-require-toke", name, 26)) {
return SHRPX_OPTID_FRONTEND_QUIC_REQUIRE_TOKEN;
}
break;
case 'r': case 'r':
if (util::strieq_l("request-header-field-buffe", name, 26)) { if (util::strieq_l("request-header-field-buffe", name, 26)) {
return SHRPX_OPTID_REQUEST_HEADER_FIELD_BUFFER; return SHRPX_OPTID_REQUEST_HEADER_FIELD_BUFFER;
@ -3986,6 +3991,12 @@ int parse_config(Config *config, int optid, const StringRef &opt,
config->quic.upstream.qlog.dir = optarg; config->quic.upstream.qlog.dir = optarg;
#endif // ENABLE_HTTP3 #endif // ENABLE_HTTP3
return 0;
case SHRPX_OPTID_FRONTEND_QUIC_REQUIRE_TOKEN:
#ifdef ENABLE_HTTP3
config->quic.upstream.require_token = util::strieq_l("yes", optarg);
#endif // ENABLE_HTTP3
return 0; return 0;
case SHRPX_OPTID_CONF: case SHRPX_OPTID_CONF:
LOG(WARN) << "conf: ignored"; LOG(WARN) << "conf: ignored";

View File

@ -387,6 +387,8 @@ constexpr auto SHRPX_OPT_FRONTEND_QUIC_EARLY_DATA =
StringRef::from_lit("frontend-quic-early-data"); StringRef::from_lit("frontend-quic-early-data");
constexpr auto SHRPX_OPT_FRONTEND_QUIC_QLOG_DIR = constexpr auto SHRPX_OPT_FRONTEND_QUIC_QLOG_DIR =
StringRef::from_lit("frontend-quic-qlog-dir"); StringRef::from_lit("frontend-quic-qlog-dir");
constexpr auto SHRPX_OPT_FRONTEND_QUIC_REQUIRE_TOKEN =
StringRef::from_lit("frontend-quic-require-token");
constexpr size_t SHRPX_OBFUSCATED_NODE_LENGTH = 8; constexpr size_t SHRPX_OBFUSCATED_NODE_LENGTH = 8;
@ -755,6 +757,7 @@ struct QUICConfig {
StringRef dir; StringRef dir;
} qlog; } qlog;
bool early_data; bool early_data;
bool require_token;
} upstream; } upstream;
struct { struct {
StringRef prog_file; StringRef prog_file;
@ -1211,6 +1214,7 @@ enum {
SHRPX_OPTID_FRONTEND_QUIC_EARLY_DATA, SHRPX_OPTID_FRONTEND_QUIC_EARLY_DATA,
SHRPX_OPTID_FRONTEND_QUIC_IDLE_TIMEOUT, SHRPX_OPTID_FRONTEND_QUIC_IDLE_TIMEOUT,
SHRPX_OPTID_FRONTEND_QUIC_QLOG_DIR, SHRPX_OPTID_FRONTEND_QUIC_QLOG_DIR,
SHRPX_OPTID_FRONTEND_QUIC_REQUIRE_TOKEN,
SHRPX_OPTID_FRONTEND_READ_TIMEOUT, SHRPX_OPTID_FRONTEND_READ_TIMEOUT,
SHRPX_OPTID_FRONTEND_WRITE_TIMEOUT, SHRPX_OPTID_FRONTEND_WRITE_TIMEOUT,
SHRPX_OPTID_HEADER_FIELD_BUFFER, SHRPX_OPTID_HEADER_FIELD_BUFFER,

View File

@ -134,6 +134,8 @@ int QUICConnectionHandler::handle_packet(const UpstreamAddr *faddr,
const uint8_t *token = nullptr; const uint8_t *token = nullptr;
size_t tokenlen = 0; size_t tokenlen = 0;
auto &quicconf = config->quic;
switch (ngtcp2_accept(&hd, data, datalen)) { switch (ngtcp2_accept(&hd, data, datalen)) {
case 0: { case 0: {
// If we get Initial and it has the CID prefix of this worker, it // If we get Initial and it has the CID prefix of this worker, it
@ -145,6 +147,13 @@ int QUICConnectionHandler::handle_packet(const UpstreamAddr *faddr,
} }
if (hd.token.len == 0) { if (hd.token.len == 0) {
if (quicconf.upstream.require_token) {
send_retry(faddr, version, dcid, dcidlen, scid, scidlen, remote_addr,
local_addr);
return 0;
}
break; break;
} }
@ -186,6 +195,13 @@ int QUICConnectionHandler::handle_packet(const UpstreamAddr *faddr,
<< util::to_numeric_addr(&remote_addr); << util::to_numeric_addr(&remote_addr);
} }
if (quicconf.upstream.require_token) {
send_retry(faddr, version, dcid, dcidlen, scid, scidlen,
remote_addr, local_addr);
return 0;
}
break; break;
} }
@ -199,6 +215,13 @@ int QUICConnectionHandler::handle_packet(const UpstreamAddr *faddr,
break; break;
default: default:
if (quicconf.upstream.require_token) {
send_retry(faddr, version, dcid, dcidlen, scid, scidlen, remote_addr,
local_addr);
return 0;
}
break; break;
} }