Copilot commented on code in PR #13186:
URL: https://github.com/apache/trafficserver/pull/13186#discussion_r3318901180
##########
tests/gold_tests/timeout/quic_no_activity_timeout.test.py:
##########
@@ -117,18 +117,19 @@ def run(self, check_for_max_idle_timeout=False):
replay_keys="nodelays")
test0.run()
-test1 = Test_quic_no_activity_timeout(
- "Test ts.quic.no_activity_timeout_in(quic max_idle_timeout) with a 5s
delay",
- no_activity_timeout_in=3000, # 3s `max_idle_timeout`
- replay_keys="delay5s",
- gold_file="gold/quic_no_activity_timeout.gold")
-test1.run(check_for_max_idle_timeout=True)
-
-# QUIC Ignores the default_inactivity_timeout config, so the
ts.quic.no_activity_timeout_in
-# should be honor
-test2 = Test_quic_no_activity_timeout(
- "Ignoring default_inactivity_timeout and use the
ts.quic.no_activity_timeout_in instead",
- replay_keys="delay5s",
- no_activity_timeout_in=3000,
- extra_recs={'proxy.config.net.default_inactivity_timeout': 1})
-test2.run(check_for_max_idle_timeout=True)
+if Condition.HasATSFeature('TS_HAS_QUICHE'):
+ test1 = Test_quic_no_activity_timeout(
+ "Test ts.quic.no_activity_timeout_in(quic max_idle_timeout) with a 5s
delay",
+ no_activity_timeout_in=3000, # 3s `max_idle_timeout`
+ replay_keys="delay5s",
+ gold_file="gold/quic_no_activity_timeout.gold")
+ test1.run(check_for_max_idle_timeout=True)
+
+ # QUIC Ignores the default_inactivity_timeout config, so the
ts.quic.no_activity_timeout_in
+ # should be honor
+ test2 = Test_quic_no_activity_timeout(
Review Comment:
Grammar: "should be honor" should be "should be honored".
##########
tests/gold_tests/h3/h3_session_ticket.test.py:
##########
@@ -0,0 +1,111 @@
+'''
+Verify HTTP/3 QUIC TLS session ticket handling.
+'''
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information regarding
+# copyright ownership. The ASF licenses this file to you under
+# the Apache License, Version 2.0 (the "License"); you may not
+# use this file except in compliance with the License. You may
+# obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import os
+
+Test.Summary = '''
+Verify that HTTP/3 QUIC connections can receive and offer TLS session tickets.
+'''
+
+Test.SkipUnless(
+ Condition.HasATSFeature('TS_USE_QUIC'),
+ Condition.HasOpenSSLVersion('3.5.0'),
+)
+Test.Setup.Copy('../tls/file.ticket')
+
+
+class TestHttp3SessionTicket:
+ """Configure an HTTP/3 QUIC TLS session ticket test."""
+
+ def __init__(self, name: str):
+ """Initialize the test."""
+ self.name = name
+ self.session_file = os.path.join(Test.RunDirectory,
"h3-quic-session.pem")
+ self.ticket_file = os.path.join(Test.RunDirectory, "file.ticket")
+
+ def _configure_traffic_server(self):
+ """Configure Traffic Server."""
+ ts = Test.MakeATSProcess("ts", enable_tls=True, enable_quic=True)
+ ts.addDefaultSSLFiles()
+ ts.Disk.ssl_multicert_yaml.AddLines(
+ """
+ssl_multicert:
+ - dest_ip: "*"
+ ssl_cert_name: server.pem
+ ssl_key_name: server.key
+""".split("\n"))
+ ts.Disk.records_config.update(
+ {
+ 'proxy.config.diags.debug.enabled': 1,
+ 'proxy.config.diags.debug.tags': 'quic|quic_net|ssl',
+ 'proxy.config.quic.server.stateless_retry_enabled': 0,
+ 'proxy.config.ssl.server.cert.path':
'{0}'.format(ts.Variables.SSLDir),
+ 'proxy.config.ssl.server.private_key.path':
'{0}'.format(ts.Variables.SSLDir),
+ 'proxy.config.ssl.server.session_ticket.enable': 1,
+ 'proxy.config.ssl.server.session_ticket.number': 2,
+ 'proxy.config.ssl.server.ticket_key.filename':
self.ticket_file,
+ })
+
+ self._ts = ts
+
+ def _s_client_command(self, session_option: str):
+ """Build an OpenSSL QUIC client command for ticket save or reuse."""
+ return (
+ 'session_path="{session_file}"; '
+ 'timeout 5 bash -c \'sleep 1 | '
+ 'openssl s_client -quic -alpn h3 '
+ '-connect 127.0.0.1:{port} -servername foo.com '
+ '{session_option} "$$0" -brief -ign_eof\' "$$session_path"; '
+ 'status=$$?; '
+ 'if [ "$$status" -ne 0 ] && [ "$$status" -ne 124 ]; then exit
"$$status"; fi; '
+ 'test -s "$$session_path"'.format(
+ session_file=self.session_file,
port=self._ts.Variables.ssl_port, session_option=session_option))
Review Comment:
The command string uses `$$` (e.g., `"$$0"`, `$$?`, `"$$status"`,
`"$$session_path"`). In `bash`, `$$` expands to the PID, so these expansions
will not refer to `$0`, `$?`, `$status`, or `$session_path` as intended,
causing the session file path and status handling to break and making the test
unreliable.
##########
include/iocore/net/quic/QUICStreamAdapter.h:
##########
@@ -39,6 +39,7 @@ class QUICStreamAdapter
virtual int64_t write(QUICOffset offset, const uint8_t *data, uint64_t
data_length, bool fin) = 0;
Ptr<IOBufferBlock> read(size_t len);
+ void consume(size_t len);
virtual bool is_eos() = 0;
Review Comment:
`QUICStreamAdapter::read()` no longer advances/consumes the underlying data;
consumption is now done via the new `consume()` method. At least one existing
caller reads via `adapter->read()` without calling `consume()` (e.g.,
`src/proxy/http3/test/test_QPACK.cc`), which will now repeatedly observe the
same data (potential infinite loops / failing unit tests). Call sites that pull
data from the adapter need to be updated to call `consume(n)` after
successfully processing/sending bytes.
##########
src/iocore/net/OpenSSLQUICPacketHandler.cc:
##########
@@ -0,0 +1,281 @@
+/** @file
+
+ OpenSSL native QUIC listener support.
+
+ @section license License
+
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+ */
+
+#include "P_QUICPacketHandler.h"
+#include "P_QUICNetProcessor.h"
+#include "P_QUICNetVConnection.h"
+#include "P_SSLCertLookup.h"
+#include "P_UnixNet.h"
+#include "iocore/net/QUICMultiCertConfigLoader.h"
+#include "iocore/net/quic/QUICConfig.h"
+#include "tscore/ink_atomic.h"
+#include "tscore/ink_sock.h"
+
+#include <openssl/err.h>
+#include <openssl/ssl.h>
+
+#include <cerrno>
+
+namespace
+{
+constexpr ink_hrtime OPENSSL_QUIC_EVENT_INTERVAL = HRTIME_MSECONDS(2);
+
+DbgCtl dbg_ctl_openssl_quic{"openssl_quic"};
+
+} // end anonymous namespace
+
+QUICPacketHandler::QUICPacketHandler()
+{
+ this->_closed_con_collector =
std::make_unique<QUICClosedConCollector>();
+ this->_closed_con_collector->mutex = new_ProxyMutex();
+}
+
+QUICPacketHandler::~QUICPacketHandler()
+{
+ if (this->_collector_event != nullptr) {
+ this->_collector_event->cancel();
+ this->_collector_event = nullptr;
+ }
+}
+
+void
+QUICPacketHandler::close_connection(QUICNetVConnection *conn)
+{
+ int isin = ink_atomic_swap(&conn->in_closed_queue, 1);
+ if (!isin) {
+ this->_closed_con_collector->closedQueue.push(conn);
+ }
+}
+
+void
+QUICPacketHandler::send_packet(UDPConnection * /* udp_con ATS_UNUSED */,
IpEndpoint & /* addr ATS_UNUSED */,
+ Ptr<IOBufferBlock> /* udp_payload ATS_UNUSED
*/, uint16_t /* segment_size ATS_UNUSED */,
+ struct timespec * /* send_at_hint ATS_UNUSED */)
+{
+}
+
+QUICPacketHandlerIn::QUICPacketHandlerIn(NetProcessor::AcceptOptions const
&opt) : NetAccept(opt), QUICPacketHandler()
+{
+ this->mutex = new_ProxyMutex();
+}
+
+QUICPacketHandlerIn::~QUICPacketHandlerIn()
+{
+ if (this->_event != nullptr) {
+ this->_event->cancel();
+ this->_event = nullptr;
+ }
+ if (this->_listener != nullptr) {
+ SSL_free(this->_listener);
+ this->_listener = nullptr;
+ }
+}
+
+NetProcessor *
+QUICPacketHandlerIn::getNetProcessor() const
+{
+ return &quic_NetProcessor;
+}
+
+NetAccept *
+QUICPacketHandlerIn::clone() const
+{
+ return new QUICPacketHandlerIn(this->opt);
+}
+
+int
+QUICPacketHandlerIn::acceptEvent(int /* event ATS_UNUSED */, void * /* data
ATS_UNUSED */)
+{
+ this->setThreadAffinity(this_ethread());
+
+ if (this->_collector_event == nullptr) {
+ this->_collector_event =
this_ethread()->schedule_every(this->_closed_con_collector.get(),
HRTIME_MSECONDS(100));
+ }
+
+ if (this->_listener == nullptr && !this->_start_listener()) {
+ return EVENT_DONE;
+ }
+
+ this->_event = nullptr;
+ this->_service_listener();
+ this->_schedule_event();
+
+ return EVENT_CONT;
+}
+
+void
+QUICPacketHandlerIn::init_accept(EThread *t)
+{
+ SET_HANDLER(&QUICPacketHandlerIn::acceptEvent);
+
+ if (t == nullptr) {
+ t = eventProcessor.assign_thread(ET_NET);
+ }
+
+ if (!this->action_->continuation->mutex) {
+ this->action_->continuation->mutex = t->mutex;
+ this->action_->mutex = t->mutex;
+ }
+
+ this->mutex = get_NetHandler(t)->mutex;
+ t->schedule_imm(this);
+}
+
+Continuation *
+QUICPacketHandlerIn::_get_continuation()
+{
+ return this;
+}
+
+void
+QUICPacketHandlerIn::_recv_packet(int /* event ATS_UNUSED */, UDPPacket * /*
udpPacket ATS_UNUSED */)
+{
+}
+
+bool
+QUICPacketHandlerIn::_start_listener()
+{
+ if (!this->server.sock.is_ok()) {
+ this->server.sock = UnixSocket{this->server.accept_addr.sa.sa_family,
SOCK_DGRAM, 0};
+ if (!this->server.sock.is_ok()) {
+ Error("failed to create OpenSSL QUIC UDP socket: %s", strerror(errno));
+ return false;
+ }
+
+ if (this->server.accept_addr.sa.sa_family == AF_INET6 &&
this->server.sock.enable_option(IPPROTO_IPV6, IPV6_V6ONLY) < 0) {
+ Error("failed to set IPV6_V6ONLY on OpenSSL QUIC socket: %s",
strerror(errno));
+ return false;
+ }
+ if (this->server.sock.enable_option(SOL_SOCKET, SO_REUSEADDR) < 0) {
+ Error("failed to set SO_REUSEADDR on OpenSSL QUIC socket: %s",
strerror(errno));
+ return false;
+ }
+ if (this->server.sock.bind(&this->server.accept_addr.sa,
ats_ip_size(&this->server.accept_addr.sa)) < 0) {
+ Error("failed to bind OpenSSL QUIC socket: %s", strerror(errno));
+ return false;
+ }
+ }
+
+ if (this->server.sock.set_nonblocking() < 0) {
+ Error("failed to make OpenSSL QUIC socket nonblocking: %s",
strerror(errno));
+ return false;
+ }
+ if (this->opt.recv_bufsize > 0) {
+ this->server.sock.set_rcvbuf_size(this->opt.recv_bufsize);
+ }
+ if (this->opt.send_bufsize > 0) {
+ this->server.sock.set_sndbuf_size(this->opt.send_bufsize);
+ }
+
+ QUICCertConfig::scoped_config server_cert;
+ QUICConfig::scoped_config params;
+ uint64_t listener_flags = 0;
+ if (!params->stateless_retry()) {
+ listener_flags |= SSL_LISTENER_FLAG_NO_VALIDATE;
+ }
+
+ this->_listener = SSL_new_listener(server_cert->defaultContext(),
listener_flags);
+ if (this->_listener == nullptr) {
+ Error("failed to create OpenSSL QUIC listener");
+ return false;
+ }
+
+ if (SSL_set_fd(this->_listener, this->server.sock.get_fd()) != 1) {
+ Error("failed to configure OpenSSL QUIC listener socket");
+ return false;
+ }
+ SSL_set_blocking_mode(this->_listener, 0);
+ SSL_set_event_handling_mode(this->_listener,
SSL_VALUE_EVENT_HANDLING_MODE_EXPLICIT);
+
+ SSL_set_feature_request_uint(this->_listener, SSL_VALUE_QUIC_IDLE_TIMEOUT,
params->no_activity_timeout_in());
+ SSL_set_feature_request_uint(this->_listener,
SSL_VALUE_QUIC_STREAM_BIDI_LOCAL_AVAIL, params->initial_max_streams_bidi_in());
+ SSL_set_feature_request_uint(this->_listener,
SSL_VALUE_QUIC_STREAM_UNI_LOCAL_AVAIL, params->initial_max_streams_uni_in());
+ SSL_set_incoming_stream_policy(this->_listener,
SSL_INCOMING_STREAM_POLICY_ACCEPT, 0);
+
+ if (SSL_listen(this->_listener) != 1) {
+ Error("failed to start OpenSSL QUIC listener");
+ return false;
+ }
+
+ Dbg(dbg_ctl_openssl_quic, "OpenSSL QUIC listener started on fd %d",
this->server.sock.get_fd());
+ return true;
+}
+
+void
+QUICPacketHandlerIn::_service_listener()
+{
+ SSL_handle_events(this->_listener);
+
+ while (SSL *ssl = SSL_accept_connection(this->_listener,
SSL_ACCEPT_CONNECTION_NO_BLOCK)) {
+ SSL_set_blocking_mode(ssl, 0);
+ SSL_set_event_handling_mode(ssl, SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT);
+ SSL_set_incoming_stream_policy(ssl, SSL_INCOMING_STREAM_POLICY_ACCEPT, 0);
+ SSL_set_default_stream_mode(ssl, SSL_DEFAULT_STREAM_MODE_NONE);
+
+ auto *vc = static_cast<QUICNetVConnection
*>(getNetProcessor()->allocate_vc(this_ethread()));
+ if (vc == nullptr) {
+ SSL_free(ssl);
+ continue;
+ }
+
+ IpEndpoint remote_addr;
+ remote_addr.setToAnyAddr(this->server.accept_addr.sa.sa_family);
+
+ vc->init(ssl, this);
+ vc->id = net_next_connection_number();
+ vc->set_quic_endpoints(this->server.accept_addr, remote_addr);
Review Comment:
The accepted connection's `remote_addr` is set to an "any" address
(`0.0.0.0`/`::`) instead of the actual peer address. This will propagate an
incorrect client IP through the NetVC (access logs, ACLs, plugins, etc.). The
remote endpoint should be obtained from the OpenSSL QUIC connection (or its
underlying BIO/socket peer info) and stored on the `QUICNetVConnection`.
##########
src/iocore/net/OpenSSLQUICNetVConnection.cc:
##########
@@ -0,0 +1,1042 @@
+/** @file
+
+ OpenSSL native QUIC NetVConnection support.
+
+ @section license License
+
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+ */
+
+#include "P_SSLUtils.h"
+#include "P_QUICNetVConnection.h"
+#include "P_QUICPacketHandler.h"
+#include "P_UnixNet.h"
+#include "api/APIHook.h"
+#include "iocore/eventsystem/EThread.h"
+#include "iocore/net/QUICMultiCertConfigLoader.h"
+#include "iocore/net/SSLAPIHooks.h"
+#include "iocore/net/quic/QUICApplicationMap.h"
+#include "iocore/net/quic/QUICEvents.h"
+#include "iocore/net/quic/QUICGlobals.h"
+#include "iocore/net/quic/QUICStream.h"
+#include "iocore/net/quic/QUICStreamManager.h"
+#include "tscore/ink_config.h"
+
+#include <openssl/err.h>
+#include <openssl/quic.h>
+#include <openssl/ssl.h>
+
+#include <algorithm>
+#include <cerrno>
+#include <cstring>
+
+namespace
+{
+constexpr ink_hrtime OPENSSL_QUIC_EVENT_INTERVAL = HRTIME_MSECONDS(2);
+
+DbgCtl dbg_ctl_quic_net{"quic_net"};
+DbgCtl dbg_ctl_v_quic_net{"v_quic_net"};
+
+class OpenSSLQUICStreamManager : public QUICStreamManager
+{
+public:
+ OpenSSLQUICStreamManager(QUICContext *context, QUICApplicationMap *app_map,
QUICNetVConnection *vc)
+ : QUICStreamManager(context, app_map), _vc(vc)
+ {
+ }
+
+ QUICConnectionErrorUPtr
+ create_uni_stream(QUICStreamId &new_stream_id) override
+ {
+ return this->_vc->create_openssl_stream(SSL_STREAM_FLAG_UNI |
SSL_STREAM_FLAG_NO_BLOCK, new_stream_id);
+ }
+
+ QUICConnectionErrorUPtr
+ create_bidi_stream(QUICStreamId &new_stream_id) override
+ {
+ return this->_vc->create_openssl_stream(SSL_STREAM_FLAG_NO_BLOCK,
new_stream_id);
+ }
+
+private:
+ QUICNetVConnection *_vc = nullptr;
+};
+
+} // end anonymous namespace
+
+#define QUICConDebug(fmt, ...) Dbg(dbg_ctl_quic_net, "[%s] " fmt,
this->cids().data(), ##__VA_ARGS__)
+#define QUICConVDebug(fmt, ...) Dbg(dbg_ctl_v_quic_net, "[%s] " fmt,
this->cids().data(), ##__VA_ARGS__)
+
+ClassAllocator<QUICNetVConnection, false>
quicNetVCAllocator("quicNetVCAllocator");
+
+QUICNetVConnection::QUICNetVConnection()
+{
+ this->_set_service(static_cast<ALPNSupport *>(this));
+ this->_set_service(static_cast<TLSBasicSupport *>(this));
+ this->_set_service(static_cast<TLSEventSupport *>(this));
+ this->_set_service(static_cast<TLSCertSwitchSupport *>(this));
+ this->_set_service(static_cast<TLSSNISupport *>(this));
+ this->_set_service(static_cast<TLSSessionResumptionSupport *>(this));
+ this->_set_service(static_cast<QUICSupport *>(this));
+}
+
+QUICNetVConnection::~QUICNetVConnection() {}
+
+void
+QUICNetVConnection::init(SSL *ssl, QUICPacketHandler *packet_handler)
+{
+ SET_HANDLER((NetVConnHandler)&QUICNetVConnection::acceptEvent);
+
+ this->_ssl = ssl;
+ this->_packet_handler = packet_handler;
+ this->_quic_connection_id.randomize();
+ this->_initial_source_connection_id = this->_quic_connection_id;
+ this->_cid_text = this->_quic_connection_id.hex();
+
+ SSL_set_ex_data(ssl, QUIC::ssl_quic_qc_index, static_cast<QUICConnection
*>(this));
+ SSL_set_blocking_mode(ssl, 0);
+ SSL_set_event_handling_mode(ssl, SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT);
+ SSL_set_incoming_stream_policy(ssl, SSL_INCOMING_STREAM_POLICY_ACCEPT, 0);
+ SSL_set_default_stream_mode(ssl, SSL_DEFAULT_STREAM_MODE_NONE);
+
+ QUICConfig::scoped_config params;
+ SSL_set_feature_request_uint(ssl, SSL_VALUE_QUIC_IDLE_TIMEOUT,
params->no_activity_timeout_in());
+ SSL_set_feature_request_uint(ssl, SSL_VALUE_QUIC_STREAM_BIDI_LOCAL_AVAIL,
params->initial_max_streams_bidi_in());
+ SSL_set_feature_request_uint(ssl, SSL_VALUE_QUIC_STREAM_UNI_LOCAL_AVAIL,
params->initial_max_streams_uni_in());
+
+ this->_bindSSLObject();
+}
+
+void
+QUICNetVConnection::set_quic_endpoints(IpEndpoint const &local, IpEndpoint
const &remote)
+{
+ this->local_addr = local;
+ this->remote_addr = remote;
+ this->got_local_addr = true;
+ this->got_remote_addr = true;
+}
+
+QUICConnectionErrorUPtr
+QUICNetVConnection::create_openssl_stream(uint64_t flags, QUICStreamId
&new_stream_id)
+{
+ if (this->_ssl == nullptr) {
+ return
std::make_unique<QUICConnectionError>(QUICTransErrorCode::INTERNAL_ERROR, "QUIC
connection is not initialized");
+ }
+
+ SSL *stream_ssl = SSL_new_stream(this->_ssl, flags |
SSL_STREAM_FLAG_NO_BLOCK);
+ if (stream_ssl == nullptr) {
+ return
std::make_unique<QUICConnectionError>(QUICTransErrorCode::STREAM_LIMIT_ERROR,
"Failed to create QUIC stream");
+ }
+
+ SSL_set_blocking_mode(stream_ssl, 0);
+ SSL_set_event_handling_mode(stream_ssl,
SSL_VALUE_EVENT_HANDLING_MODE_IMPLICIT);
+ SSL_set_mode(stream_ssl, SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER |
SSL_MODE_ENABLE_PARTIAL_WRITE);
+
+ new_stream_id = SSL_get_stream_id(stream_ssl);
+ this->_openssl_streams.emplace(new_stream_id, stream_ssl);
+
+ [[maybe_unused]] QUICConnectionError err;
+ this->_stream_manager->create_stream(new_stream_id, err);
+
+ return nullptr;
+}
+
+void
+QUICNetVConnection::free()
+{
+ this->free_thread(this_ethread());
+}
+
+void
+QUICNetVConnection::remove_connection_ids()
+{
+}
+
+void
+QUICNetVConnection::destroy(EThread *t)
+{
+ QUICConDebug("Destroy connection");
+ if (from_accept_thread) {
+ quicNetVCAllocator.free(this);
+ } else {
+ THREAD_FREE(this, quicNetVCAllocator, t);
+ }
+}
+
+void
+QUICNetVConnection::set_local_addr()
+{
+}
+
+void
+QUICNetVConnection::free_thread(EThread * /* t ATS_UNUSED */)
+{
+ QUICConDebug("Free connection");
+
+ this->_unschedule_openssl_event();
+
+ for (auto &[stream_id, stream_ssl] : this->_openssl_streams) {
+ SSL_free(stream_ssl);
+ }
+ this->_openssl_streams.clear();
+
+ if (this->_ssl != nullptr) {
+ this->_unbindSSLObject();
+ SSL_free(this->_ssl);
+ this->_ssl = nullptr;
+ }
+
+ this->_application_map.reset();
+ this->_stream_manager.reset();
+
+ super::clear();
+ ALPNSupport::clear();
+ TLSBasicSupport::clear();
+ TLSEventSupport::clear();
+ TLSCertSwitchSupport::_clear();
+
+ if (this->_packet_handler != nullptr) {
+ this->_packet_handler->close_connection(this);
+ this->_packet_handler = nullptr;
+ }
+}
+
+void
+QUICNetVConnection::reenable(VIO * /* vio ATS_UNUSED */)
+{
+}
+
+int
+QUICNetVConnection::state_handshake(int event, Event *data)
+{
+ if (data == this->_packet_write_ready) {
+ this->_packet_write_ready = nullptr;
+ }
+
+ switch (event) {
+ case EVENT_IMMEDIATE:
+ case EVENT_INTERVAL:
+ case QUIC_EVENT_PACKET_READ_READY:
+ case QUIC_EVENT_PACKET_WRITE_READY:
+ this->_handle_openssl_events();
+ break;
+ case VC_EVENT_EOS:
+ case VC_EVENT_ERROR:
+ case VC_EVENT_ACTIVE_TIMEOUT:
+ case VC_EVENT_INACTIVITY_TIMEOUT:
+ this->_unschedule_openssl_event();
+ this->_propagate_event(event);
+ this->closed = 1;
+ break;
+ default:
+ QUICConDebug("Unhandled event: %d", event);
+ break;
+ }
+
+ if (this->closed != 1 && SSL_is_init_finished(this->_ssl)) {
+ this->_switch_to_established_state();
+ this->_handle_openssl_events();
+ }
+
+ if (this->closed != 1 && this->_openssl_connection_closed()) {
+ this->_schedule_closing_event();
+ } else if (this->closed != 1) {
+ this->_schedule_openssl_event();
+ }
+
+ return EVENT_DONE;
+}
+
+int
+QUICNetVConnection::state_established(int event, Event *data)
+{
+ if (this->_ssl == nullptr) {
+ return EVENT_DONE;
+ }
+
+ if (data == this->_packet_write_ready) {
+ this->_packet_write_ready = nullptr;
+ }
+
+ switch (event) {
+ case EVENT_IMMEDIATE:
+ case EVENT_INTERVAL:
+ case QUIC_EVENT_PACKET_READ_READY:
+ case QUIC_EVENT_PACKET_WRITE_READY:
+ this->_handle_openssl_events();
+ break;
+ case VC_EVENT_EOS:
+ case VC_EVENT_ERROR:
+ case VC_EVENT_ACTIVE_TIMEOUT:
+ case VC_EVENT_INACTIVITY_TIMEOUT:
+ this->_unschedule_openssl_event();
+ this->_propagate_event(event);
+ this->closed = 1;
+ break;
+ default:
+ QUICConDebug("Unhandled event: %d", event);
+ break;
+ }
+
+ if (this->closed != 1 && this->_openssl_connection_closed()) {
+ this->_schedule_closing_event();
+ } else if (this->closed != 1) {
+ this->_schedule_openssl_event();
+ }
+
+ return EVENT_DONE;
+}
+
+void
+QUICNetVConnection::_switch_to_established_state()
+{
+ QUICConDebug("Enter state_connection_established");
+ this->_record_tls_handshake_end_time();
+ this->_update_end_of_handshake_stats();
+ SET_HANDLER((NetVConnHandler)&QUICNetVConnection::state_established);
+ this->_handshake_completed = true;
+ this->_start_application();
+}
+
+void
+QUICNetVConnection::_start_application()
+{
+ if (this->_application_started) {
+ return;
+ }
+
+ this->_application_started = true;
+
+ unsigned char const *app_name = nullptr;
+ unsigned int app_name_len = 0;
+ SSL_get0_alpn_selected(this->_ssl, &app_name, &app_name_len);
+
+ if (app_name == nullptr || app_name_len == 0) {
+ app_name = reinterpret_cast<unsigned char const
*>(IP_PROTO_TAG_HTTP_QUIC.data());
+ app_name_len = IP_PROTO_TAG_HTTP_QUIC.size();
+ }
+
+ this->_negotiated_alpn.assign(reinterpret_cast<char const *>(app_name),
app_name_len);
+ this->set_negotiated_protocol_id(this->_negotiated_alpn);
+
+ if (netvc_context == NET_VCONNECTION_IN) {
+ if (this->setSelectedProtocol(app_name, app_name_len)) {
+ this->endpoint()->handleEvent(NET_EVENT_ACCEPT, this);
+ }
+ } else {
+ this->action_.continuation->handleEvent(NET_EVENT_OPEN, this);
+ }
+}
+
+void
+QUICNetVConnection::_propagate_event(int event)
+{
+ QUICConVDebug("Propagating: %d", event);
+ if (this->read.vio.cont && this->read.vio.mutex ==
this->read.vio.cont->mutex) {
+ this->read.vio.cont->handleEvent(event, &this->read.vio);
+ } else if (this->write.vio.cont && this->write.vio.mutex ==
this->write.vio.cont->mutex) {
+ this->write.vio.cont->handleEvent(event, &this->write.vio);
+ } else {
+ QUICConVDebug("Session does not exist");
+ }
+}
+
+bool
+QUICNetVConnection::shouldDestroy()
+{
+ return this->refcount() == 0;
+}
+
+VIO *
+QUICNetVConnection::do_io_read(Continuation *c, int64_t nbytes, MIOBuffer *buf)
+{
+ auto vio = super::do_io_read(c, nbytes, buf);
+ this->read.enabled = 1;
+ return vio;
+}
+
+VIO *
+QUICNetVConnection::do_io_write(Continuation *c, int64_t nbytes,
IOBufferReader *buf, bool /* owner ATS_UNUSED */)
+{
+ auto vio = super::do_io_write(c, nbytes, buf);
+ this->write.enabled = 1;
+ this->_schedule_openssl_event(false);
+ return vio;
+}
+
+int
+QUICNetVConnection::acceptEvent(int event, Event *e)
+{
+ EThread *t = (e == nullptr) ? this_ethread() : e->ethread;
+ NetHandler *h = get_NetHandler(t);
+
+ MUTEX_TRY_LOCK(lock, h->mutex, t);
+ if (!lock.is_locked()) {
+ if (event == EVENT_NONE) {
+ t->schedule_in(this, HRTIME_MSECONDS(net_retry_delay));
+ return EVENT_DONE;
+ } else {
+ e->schedule_in(HRTIME_MSECONDS(net_retry_delay));
+ return EVENT_CONT;
+ }
+ }
+
+ this->_context = std::make_unique<QUICContext>(this);
+ this->_application_map = std::make_unique<QUICApplicationMap>();
+ this->_stream_manager =
std::make_unique<OpenSSLQUICStreamManager>(this->_context.get(),
this->_application_map.get(), this);
+
+ ink_assert(this->thread == this_ethread());
+
+ if (h->startIO(this) < 0) {
+ this->free_thread(t);
+ return EVENT_DONE;
+ }
+
+ this->read.enabled = 1;
+ this->write.enabled = 1;
+
+ SET_HANDLER((NetVConnHandler)&QUICNetVConnection::state_handshake);
+
+ nh->startCop(this);
+ this->set_default_inactivity_timeout(0);
+
+ if (inactivity_timeout_in) {
+ this->set_inactivity_timeout(inactivity_timeout_in);
+ }
+
+ if (active_timeout_in) {
+ set_active_timeout(active_timeout_in);
+ }
+
+ action_.continuation->handleEvent(NET_EVENT_ACCEPT, this);
+ this->_schedule_openssl_event(false);
+
+ return EVENT_DONE;
+}
+
+int
+QUICNetVConnection::connectUp(EThread * /* t ATS_UNUSED */, int /* fd
ATS_UNUSED */)
+{
+ return 0;
+}
+
+QUICStreamManager *
+QUICNetVConnection::stream_manager()
+{
+ return this->_stream_manager.get();
+}
+
+void
+QUICNetVConnection::close_quic_connection(QUICConnectionErrorUPtr error)
+{
+ if (this->_ssl != nullptr) {
+ SSL_SHUTDOWN_EX_ARGS args = {};
+ if (error != nullptr) {
+ args.quic_error_code = error->code;
+ args.quic_reason = error->msg;
+ }
+ SSL_shutdown_ex(this->_ssl, SSL_SHUTDOWN_FLAG_NO_BLOCK, &args,
sizeof(args));
+ }
+}
+
+void
+QUICNetVConnection::reset_quic_connection()
+{
+ if (this->_ssl != nullptr) {
+ SSL_shutdown_ex(this->_ssl, SSL_SHUTDOWN_FLAG_RAPID |
SSL_SHUTDOWN_FLAG_NO_BLOCK, nullptr, 0);
+ }
+}
+
+void
+QUICNetVConnection::handle_received_packet(UDPPacket * /* packet ATS_UNUSED */)
+{
+}
+
+void
+QUICNetVConnection::ping()
+{
+}
+
+QUICConnectionId
+QUICNetVConnection::peer_connection_id() const
+{
+ return {};
+}
+
+QUICConnectionId
+QUICNetVConnection::original_connection_id() const
+{
+ return {};
+}
+
+QUICConnectionId
+QUICNetVConnection::first_connection_id() const
+{
+ return {};
+}
+
+QUICConnectionId
+QUICNetVConnection::retry_source_connection_id() const
+{
+ return {};
+}
+
+QUICConnectionId
+QUICNetVConnection::initial_source_connection_id() const
+{
+ return this->_initial_source_connection_id;
+}
+
+QUICConnectionId
+QUICNetVConnection::connection_id() const
+{
+ return this->_quic_connection_id;
+}
+
+std::string_view
+QUICNetVConnection::cids() const
+{
+ return this->_cid_text;
+}
+
+QUICFiveTuple const
+QUICNetVConnection::five_tuple() const
+{
+ return {};
+}
Review Comment:
`five_tuple()` currently returns `{}`. `QUICFiveTuple`'s default constructor
does not initialize `_protocol`, so this can yield an indeterminate protocol
value (UB) and it also loses the actual source/destination endpoints. This
should return a properly constructed `QUICFiveTuple` using the connection's
local/remote endpoints (and the correct transport protocol).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
