/
githubmirror
/
nghttp2
Обзор
Документация
Войти
/
githubmirror
/
nghttp2
Код
Запросы
0
Пакеты
0
Релизы
0
Аналитика
Безопасность
master
src/shrpx_config.h
1 444 строки
52 KB
Tatsuhiro Tsujikawa
nghttpx: Drop connection when frontend write rate is too low
14 июн 2026, 10:01
14 июн 2026, 10:01
11af1e9
Код
Авторство
О чём код?
/* * nghttp2 - HTTP/2 C Library * * Copyright (c) 2012 Tatsuhiro Tsujikawa * * Permission is hereby granted, free of charge, to any person obtaining * a copy of this software and associated documentation files (the * "Software"), to deal in the Software without restriction, including * without limitation the rights to use, copy, modify, merge, publish, * distribute, sublicense, and/or sell copies of the Software, and to * permit persons to whom the Software is furnished to do so, subject to * the following conditions: * * The above copyright notice and this permission notice shall be * included in all copies or substantial portions of the Software. * * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. */ #ifndef SHRPX_CONFIG_H #define SHRPX_CONFIG_H #include "shrpx.h" #include <sys/types.h> #ifdef HAVE_SYS_SOCKET_H # include <sys/socket.h> #endif // defined(HAVE_SYS_SOCKET_H) #include <sys/un.h> #ifdef HAVE_NETINET_IN_H # include <netinet/in.h> #endif // defined(HAVE_NETINET_IN_H) #ifdef HAVE_ARPA_INET_H # include <arpa/inet.h> #endif // defined(HAVE_ARPA_INET_H) #include <cinttypes> #include <cstdio> #include <vector> #include <memory> #include <unordered_set> #include <unordered_map> #include <expected> #include "ssl_compat.h" #ifdef NGHTTP2_OPENSSL_IS_WOLFSSL # include <wolfssl/options.h> # include <wolfssl/openssl/ssl.h> #else // !defined(NGHTTP2_OPENSSL_IS_WOLFSSL) # include <openssl/ssl.h> #endif // !defined(NGHTTP2_OPENSSL_IS_WOLFSSL) #include <ev.h> #include <nghttp2/nghttp2.h> #include "shrpx_log.h" #include "shrpx_router.h" #ifdef ENABLE_HTTP3 # include "shrpx_quic.h" #endif // defined(ENABLE_HTTP3) #include "template.h" #include "http2.h" #include "network.h" #include "allocator.h" #include "errors.h" using namespace nghttp2; namespace shrpx { struct LogFragment; class ConnectBlocker; class Http2Session; namespace tls { class CertLookupTree; } // namespace tls inline constexpr auto SHRPX_OPT_PRIVATE_KEY_FILE = "private-key-file"sv; inline constexpr auto SHRPX_OPT_PRIVATE_KEY_PASSWD_FILE = "private-key-passwd-file"sv; inline constexpr auto SHRPX_OPT_CERTIFICATE_FILE = "certificate-file"sv; inline constexpr auto SHRPX_OPT_DH_PARAM_FILE = "dh-param-file"sv; inline constexpr auto SHRPX_OPT_SUBCERT = "subcert"sv; inline constexpr auto SHRPX_OPT_BACKEND = "backend"sv; inline constexpr auto SHRPX_OPT_FRONTEND = "frontend"sv; inline constexpr auto SHRPX_OPT_WORKERS = "workers"sv; inline constexpr auto SHRPX_OPT_HTTP2_MAX_CONCURRENT_STREAMS = "http2-max-concurrent-streams"sv; inline constexpr auto SHRPX_OPT_LOG_LEVEL = "log-level"sv; inline constexpr auto SHRPX_OPT_DAEMON = "daemon"sv; inline constexpr auto SHRPX_OPT_HTTP2_PROXY = "http2-proxy"sv; inline constexpr auto SHRPX_OPT_HTTP2_BRIDGE = "http2-bridge"sv; inline constexpr auto SHRPX_OPT_CLIENT_PROXY = "client-proxy"sv; inline constexpr auto SHRPX_OPT_ADD_X_FORWARDED_FOR = "add-x-forwarded-for"sv; inline constexpr auto SHRPX_OPT_STRIP_INCOMING_X_FORWARDED_FOR = "strip-incoming-x-forwarded-for"sv; inline constexpr auto SHRPX_OPT_NO_VIA = "no-via"sv; inline constexpr auto SHRPX_OPT_FRONTEND_HTTP2_READ_TIMEOUT = "frontend-http2-read-timeout"sv; inline constexpr auto SHRPX_OPT_FRONTEND_READ_TIMEOUT = "frontend-read-timeout"sv; inline constexpr auto SHRPX_OPT_FRONTEND_WRITE_TIMEOUT = "frontend-write-timeout"sv; inline constexpr auto SHRPX_OPT_BACKEND_READ_TIMEOUT = "backend-read-timeout"sv; inline constexpr auto SHRPX_OPT_BACKEND_WRITE_TIMEOUT = "backend-write-timeout"sv; inline constexpr auto SHRPX_OPT_STREAM_READ_TIMEOUT = "stream-read-timeout"sv; inline constexpr auto SHRPX_OPT_STREAM_WRITE_TIMEOUT = "stream-write-timeout"sv; inline constexpr auto SHRPX_OPT_ACCESSLOG_FILE = "accesslog-file"sv; inline constexpr auto SHRPX_OPT_ACCESSLOG_SYSLOG = "accesslog-syslog"sv; inline constexpr auto SHRPX_OPT_ACCESSLOG_FORMAT = "accesslog-format"sv; inline constexpr auto SHRPX_OPT_ERRORLOG_FILE = "errorlog-file"sv; inline constexpr auto SHRPX_OPT_ERRORLOG_SYSLOG = "errorlog-syslog"sv; inline constexpr auto SHRPX_OPT_BACKEND_KEEP_ALIVE_TIMEOUT = "backend-keep-alive-timeout"sv; inline constexpr auto SHRPX_OPT_FRONTEND_HTTP2_WINDOW_BITS = "frontend-http2-window-bits"sv; inline constexpr auto SHRPX_OPT_BACKEND_HTTP2_WINDOW_BITS = "backend-http2-window-bits"sv; inline constexpr auto SHRPX_OPT_FRONTEND_HTTP2_CONNECTION_WINDOW_BITS = "frontend-http2-connection-window-bits"sv; inline constexpr auto SHRPX_OPT_BACKEND_HTTP2_CONNECTION_WINDOW_BITS = "backend-http2-connection-window-bits"sv; inline constexpr auto SHRPX_OPT_FRONTEND_NO_TLS = "frontend-no-tls"sv; inline constexpr auto SHRPX_OPT_BACKEND_NO_TLS = "backend-no-tls"sv; inline constexpr auto SHRPX_OPT_BACKEND_TLS_SNI_FIELD = "backend-tls-sni-field"sv; inline constexpr auto SHRPX_OPT_PID_FILE = "pid-file"sv; inline constexpr auto SHRPX_OPT_USER = "user"sv; inline constexpr auto SHRPX_OPT_SYSLOG_FACILITY = "syslog-facility"sv; inline constexpr auto SHRPX_OPT_BACKLOG = "backlog"sv; inline constexpr auto SHRPX_OPT_CIPHERS = "ciphers"sv; inline constexpr auto SHRPX_OPT_CLIENT = "client"sv; inline constexpr auto SHRPX_OPT_INSECURE = "insecure"sv; inline constexpr auto SHRPX_OPT_CACERT = "cacert"sv; inline constexpr auto SHRPX_OPT_BACKEND_IPV4 = "backend-ipv4"sv; inline constexpr auto SHRPX_OPT_BACKEND_IPV6 = "backend-ipv6"sv; inline constexpr auto SHRPX_OPT_BACKEND_HTTP_PROXY_URI = "backend-http-proxy-uri"sv; inline constexpr auto SHRPX_OPT_READ_RATE = "read-rate"sv; inline constexpr auto SHRPX_OPT_READ_BURST = "read-burst"sv; inline constexpr auto SHRPX_OPT_WRITE_RATE = "write-rate"sv; inline constexpr auto SHRPX_OPT_WRITE_BURST = "write-burst"sv; inline constexpr auto SHRPX_OPT_WORKER_READ_RATE = "worker-read-rate"sv; inline constexpr auto SHRPX_OPT_WORKER_READ_BURST = "worker-read-burst"sv; inline constexpr auto SHRPX_OPT_WORKER_WRITE_RATE = "worker-write-rate"sv; inline constexpr auto SHRPX_OPT_WORKER_WRITE_BURST = "worker-write-burst"sv; inline constexpr auto SHRPX_OPT_NPN_LIST = "npn-list"sv; inline constexpr auto SHRPX_OPT_TLS_PROTO_LIST = "tls-proto-list"sv; inline constexpr auto SHRPX_OPT_VERIFY_CLIENT = "verify-client"sv; inline constexpr auto SHRPX_OPT_VERIFY_CLIENT_CACERT = "verify-client-cacert"sv; inline constexpr auto SHRPX_OPT_CLIENT_PRIVATE_KEY_FILE = "client-private-key-file"sv; inline constexpr auto SHRPX_OPT_CLIENT_CERT_FILE = "client-cert-file"sv; inline constexpr auto SHRPX_OPT_FRONTEND_HTTP2_DUMP_REQUEST_HEADER = "frontend-http2-dump-request-header"sv; inline constexpr auto SHRPX_OPT_FRONTEND_HTTP2_DUMP_RESPONSE_HEADER = "frontend-http2-dump-response-header"sv; inline constexpr auto SHRPX_OPT_HTTP2_NO_COOKIE_CRUMBLING = "http2-no-cookie-crumbling"sv; inline constexpr auto SHRPX_OPT_FRONTEND_FRAME_DEBUG = "frontend-frame-debug"sv; inline constexpr auto SHRPX_OPT_PADDING = "padding"sv; inline constexpr auto SHRPX_OPT_ALTSVC = "altsvc"sv; inline constexpr auto SHRPX_OPT_ADD_REQUEST_HEADER = "add-request-header"sv; inline constexpr auto SHRPX_OPT_ADD_RESPONSE_HEADER = "add-response-header"sv; inline constexpr auto SHRPX_OPT_WORKER_FRONTEND_CONNECTIONS = "worker-frontend-connections"sv; inline constexpr auto SHRPX_OPT_NO_LOCATION_REWRITE = "no-location-rewrite"sv; inline constexpr auto SHRPX_OPT_NO_HOST_REWRITE = "no-host-rewrite"sv; inline constexpr auto SHRPX_OPT_BACKEND_HTTP1_CONNECTIONS_PER_HOST = "backend-http1-connections-per-host"sv; inline constexpr auto SHRPX_OPT_BACKEND_HTTP1_CONNECTIONS_PER_FRONTEND = "backend-http1-connections-per-frontend"sv; inline constexpr auto SHRPX_OPT_LISTENER_DISABLE_TIMEOUT = "listener-disable-timeout"sv; inline constexpr auto SHRPX_OPT_TLS_TICKET_KEY_FILE = "tls-ticket-key-file"sv; inline constexpr auto SHRPX_OPT_RLIMIT_NOFILE = "rlimit-nofile"sv; inline constexpr auto SHRPX_OPT_BACKEND_REQUEST_BUFFER = "backend-request-buffer"sv; inline constexpr auto SHRPX_OPT_BACKEND_RESPONSE_BUFFER = "backend-response-buffer"sv; inline constexpr auto SHRPX_OPT_NO_SERVER_PUSH = "no-server-push"sv; inline constexpr auto SHRPX_OPT_BACKEND_HTTP2_CONNECTIONS_PER_WORKER = "backend-http2-connections-per-worker"sv; inline constexpr auto SHRPX_OPT_FETCH_OCSP_RESPONSE_FILE = "fetch-ocsp-response-file"sv; inline constexpr auto SHRPX_OPT_OCSP_UPDATE_INTERVAL = "ocsp-update-interval"sv; inline constexpr auto SHRPX_OPT_NO_OCSP = "no-ocsp"sv; inline constexpr auto SHRPX_OPT_HEADER_FIELD_BUFFER = "header-field-buffer"sv; inline constexpr auto SHRPX_OPT_MAX_HEADER_FIELDS = "max-header-fields"sv; inline constexpr auto SHRPX_OPT_INCLUDE = "include"sv; inline constexpr auto SHRPX_OPT_TLS_TICKET_KEY_CIPHER = "tls-ticket-key-cipher"sv; inline constexpr auto SHRPX_OPT_HOST_REWRITE = "host-rewrite"sv; inline constexpr auto SHRPX_OPT_TLS_SESSION_CACHE_MEMCACHED = "tls-session-cache-memcached"sv; inline constexpr auto SHRPX_OPT_TLS_TICKET_KEY_MEMCACHED = "tls-ticket-key-memcached"sv; inline constexpr auto SHRPX_OPT_TLS_TICKET_KEY_MEMCACHED_INTERVAL = "tls-ticket-key-memcached-interval"sv; inline constexpr auto SHRPX_OPT_TLS_TICKET_KEY_MEMCACHED_MAX_RETRY = "tls-ticket-key-memcached-max-retry"sv; inline constexpr auto SHRPX_OPT_TLS_TICKET_KEY_MEMCACHED_MAX_FAIL = "tls-ticket-key-memcached-max-fail"sv; inline constexpr auto SHRPX_OPT_MRUBY_FILE = "mruby-file"sv; inline constexpr auto SHRPX_OPT_ACCEPT_PROXY_PROTOCOL = "accept-proxy-protocol"sv; inline constexpr auto SHRPX_OPT_FASTOPEN = "fastopen"sv; inline constexpr auto SHRPX_OPT_TLS_DYN_REC_WARMUP_THRESHOLD = "tls-dyn-rec-warmup-threshold"sv; inline constexpr auto SHRPX_OPT_TLS_DYN_REC_IDLE_TIMEOUT = "tls-dyn-rec-idle-timeout"sv; inline constexpr auto SHRPX_OPT_ADD_FORWARDED = "add-forwarded"sv; inline constexpr auto SHRPX_OPT_STRIP_INCOMING_FORWARDED = "strip-incoming-forwarded"sv; inline constexpr auto SHRPX_OPT_FORWARDED_BY = "forwarded-by"sv; inline constexpr auto SHRPX_OPT_FORWARDED_FOR = "forwarded-for"sv; inline constexpr auto SHRPX_OPT_REQUEST_HEADER_FIELD_BUFFER = "request-header-field-buffer"sv; inline constexpr auto SHRPX_OPT_MAX_REQUEST_HEADER_FIELDS = "max-request-header-fields"sv; inline constexpr auto SHRPX_OPT_RESPONSE_HEADER_FIELD_BUFFER = "response-header-field-buffer"sv; inline constexpr auto SHRPX_OPT_MAX_RESPONSE_HEADER_FIELDS = "max-response-header-fields"sv; inline constexpr auto SHRPX_OPT_NO_HTTP2_CIPHER_BLOCK_LIST = "no-http2-cipher-block-list"sv; inline constexpr auto SHRPX_OPT_NO_HTTP2_CIPHER_BLACK_LIST = "no-http2-cipher-black-list"sv; inline constexpr auto SHRPX_OPT_BACKEND_HTTP1_TLS = "backend-http1-tls"sv; inline constexpr auto SHRPX_OPT_TLS_SESSION_CACHE_MEMCACHED_TLS = "tls-session-cache-memcached-tls"sv; inline constexpr auto SHRPX_OPT_TLS_SESSION_CACHE_MEMCACHED_CERT_FILE = "tls-session-cache-memcached-cert-file"sv; inline constexpr auto SHRPX_OPT_TLS_SESSION_CACHE_MEMCACHED_PRIVATE_KEY_FILE = "tls-session-cache-memcached-private-key-file"sv; inline constexpr auto SHRPX_OPT_TLS_SESSION_CACHE_MEMCACHED_ADDRESS_FAMILY = "tls-session-cache-memcached-address-family"sv; inline constexpr auto SHRPX_OPT_TLS_TICKET_KEY_MEMCACHED_TLS = "tls-ticket-key-memcached-tls"sv; inline constexpr auto SHRPX_OPT_TLS_TICKET_KEY_MEMCACHED_CERT_FILE = "tls-ticket-key-memcached-cert-file"sv; inline constexpr auto SHRPX_OPT_TLS_TICKET_KEY_MEMCACHED_PRIVATE_KEY_FILE = "tls-ticket-key-memcached-private-key-file"sv; inline constexpr auto SHRPX_OPT_TLS_TICKET_KEY_MEMCACHED_ADDRESS_FAMILY = "tls-ticket-key-memcached-address-family"sv; inline constexpr auto SHRPX_OPT_BACKEND_ADDRESS_FAMILY = "backend-address-family"sv; inline constexpr auto SHRPX_OPT_FRONTEND_HTTP2_MAX_CONCURRENT_STREAMS = "frontend-http2-max-concurrent-streams"sv; inline constexpr auto SHRPX_OPT_BACKEND_HTTP2_MAX_CONCURRENT_STREAMS = "backend-http2-max-concurrent-streams"sv; inline constexpr auto SHRPX_OPT_BACKEND_CONNECTIONS_PER_FRONTEND = "backend-connections-per-frontend"sv; inline constexpr auto SHRPX_OPT_BACKEND_TLS = "backend-tls"sv; inline constexpr auto SHRPX_OPT_BACKEND_CONNECTIONS_PER_HOST = "backend-connections-per-host"sv; inline constexpr auto SHRPX_OPT_ERROR_PAGE = "error-page"sv; inline constexpr auto SHRPX_OPT_NO_KQUEUE = "no-kqueue"sv; inline constexpr auto SHRPX_OPT_FRONTEND_HTTP2_SETTINGS_TIMEOUT = "frontend-http2-settings-timeout"sv; inline constexpr auto SHRPX_OPT_BACKEND_HTTP2_SETTINGS_TIMEOUT = "backend-http2-settings-timeout"sv; inline constexpr auto SHRPX_OPT_API_MAX_REQUEST_BODY = "api-max-request-body"sv; inline constexpr auto SHRPX_OPT_BACKEND_MAX_BACKOFF = "backend-max-backoff"sv; inline constexpr auto SHRPX_OPT_SERVER_NAME = "server-name"sv; inline constexpr auto SHRPX_OPT_NO_SERVER_REWRITE = "no-server-rewrite"sv; inline constexpr auto SHRPX_OPT_FRONTEND_HTTP2_OPTIMIZE_WRITE_BUFFER_SIZE = "frontend-http2-optimize-write-buffer-size"sv; inline constexpr auto SHRPX_OPT_FRONTEND_HTTP2_OPTIMIZE_WINDOW_SIZE = "frontend-http2-optimize-window-size"sv; inline constexpr auto SHRPX_OPT_FRONTEND_HTTP2_WINDOW_SIZE = "frontend-http2-window-size"sv; inline constexpr auto SHRPX_OPT_FRONTEND_HTTP2_CONNECTION_WINDOW_SIZE = "frontend-http2-connection-window-size"sv; inline constexpr auto SHRPX_OPT_BACKEND_HTTP2_WINDOW_SIZE = "backend-http2-window-size"sv; inline constexpr auto SHRPX_OPT_BACKEND_HTTP2_CONNECTION_WINDOW_SIZE = "backend-http2-connection-window-size"sv; inline constexpr auto SHRPX_OPT_FRONTEND_HTTP2_ENCODER_DYNAMIC_TABLE_SIZE = "frontend-http2-encoder-dynamic-table-size"sv; inline constexpr auto SHRPX_OPT_FRONTEND_HTTP2_DECODER_DYNAMIC_TABLE_SIZE = "frontend-http2-decoder-dynamic-table-size"sv; inline constexpr auto SHRPX_OPT_BACKEND_HTTP2_ENCODER_DYNAMIC_TABLE_SIZE = "backend-http2-encoder-dynamic-table-size"sv; inline constexpr auto SHRPX_OPT_BACKEND_HTTP2_DECODER_DYNAMIC_TABLE_SIZE = "backend-http2-decoder-dynamic-table-size"sv; inline constexpr auto SHRPX_OPT_ECDH_CURVES = "ecdh-curves"sv; inline constexpr auto SHRPX_OPT_TLS_SCT_DIR = "tls-sct-dir"sv; inline constexpr auto SHRPX_OPT_BACKEND_CONNECT_TIMEOUT = "backend-connect-timeout"sv; inline constexpr auto SHRPX_OPT_DNS_CACHE_TIMEOUT = "dns-cache-timeout"sv; inline constexpr auto SHRPX_OPT_DNS_LOOKUP_TIMEOUT = "dns-lookup-timeout"sv; inline constexpr auto SHRPX_OPT_DNS_MAX_TRY = "dns-max-try"sv; inline constexpr auto SHRPX_OPT_FRONTEND_KEEP_ALIVE_TIMEOUT = "frontend-keep-alive-timeout"sv; inline constexpr auto SHRPX_OPT_PSK_SECRETS = "psk-secrets"sv; inline constexpr auto SHRPX_OPT_CLIENT_PSK_SECRETS = "client-psk-secrets"sv; inline constexpr auto SHRPX_OPT_CLIENT_NO_HTTP2_CIPHER_BLOCK_LIST = "client-no-http2-cipher-block-list"sv; inline constexpr auto SHRPX_OPT_CLIENT_NO_HTTP2_CIPHER_BLACK_LIST = "client-no-http2-cipher-black-list"sv; inline constexpr auto SHRPX_OPT_CLIENT_CIPHERS = "client-ciphers"sv; inline constexpr auto SHRPX_OPT_ACCESSLOG_WRITE_EARLY = "accesslog-write-early"sv; inline constexpr auto SHRPX_OPT_TLS_MIN_PROTO_VERSION = "tls-min-proto-version"sv; inline constexpr auto SHRPX_OPT_TLS_MAX_PROTO_VERSION = "tls-max-proto-version"sv; inline constexpr auto SHRPX_OPT_REDIRECT_HTTPS_PORT = "redirect-https-port"sv; inline constexpr auto SHRPX_OPT_FRONTEND_MAX_REQUESTS = "frontend-max-requests"sv; inline constexpr auto SHRPX_OPT_SINGLE_THREAD = "single-thread"sv; inline constexpr auto SHRPX_OPT_SINGLE_PROCESS = "single-process"sv; inline constexpr auto SHRPX_OPT_NO_ADD_X_FORWARDED_PROTO = "no-add-x-forwarded-proto"sv; inline constexpr auto SHRPX_OPT_NO_STRIP_INCOMING_X_FORWARDED_PROTO = "no-strip-incoming-x-forwarded-proto"sv; inline constexpr auto SHRPX_OPT_OCSP_STARTUP = "ocsp-startup"sv; inline constexpr auto SHRPX_OPT_NO_VERIFY_OCSP = "no-verify-ocsp"sv; inline constexpr auto SHRPX_OPT_VERIFY_CLIENT_TOLERATE_EXPIRED = "verify-client-tolerate-expired"sv; inline constexpr auto SHRPX_OPT_IGNORE_PER_PATTERN_MRUBY_ERROR = "ignore-per-pattern-mruby-error"sv; inline constexpr auto SHRPX_OPT_TLS_NO_POSTPONE_EARLY_DATA = "tls-no-postpone-early-data"sv; inline constexpr auto SHRPX_OPT_TLS_MAX_EARLY_DATA = "tls-max-early-data"sv; inline constexpr auto SHRPX_OPT_TLS13_CIPHERS = "tls13-ciphers"sv; inline constexpr auto SHRPX_OPT_TLS13_CLIENT_CIPHERS = "tls13-client-ciphers"sv; inline constexpr auto SHRPX_OPT_NO_STRIP_INCOMING_EARLY_DATA = "no-strip-incoming-early-data"sv; inline constexpr auto SHRPX_OPT_QUIC_BPF_PROGRAM_FILE = "quic-bpf-program-file"sv; inline constexpr auto SHRPX_OPT_NO_QUIC_BPF = "no-quic-bpf"sv; inline constexpr auto SHRPX_OPT_HTTP2_ALTSVC = "http2-altsvc"sv; inline constexpr auto SHRPX_OPT_FRONTEND_HTTP3_READ_TIMEOUT = "frontend-http3-read-timeout"sv; inline constexpr auto SHRPX_OPT_FRONTEND_QUIC_IDLE_TIMEOUT = "frontend-quic-idle-timeout"sv; inline constexpr auto SHRPX_OPT_FRONTEND_QUIC_DEBUG_LOG = "frontend-quic-debug-log"sv; inline constexpr auto SHRPX_OPT_FRONTEND_HTTP3_WINDOW_SIZE = "frontend-http3-window-size"sv; inline constexpr auto SHRPX_OPT_FRONTEND_HTTP3_CONNECTION_WINDOW_SIZE = "frontend-http3-connection-window-size"sv; inline constexpr auto SHRPX_OPT_FRONTEND_HTTP3_MAX_WINDOW_SIZE = "frontend-http3-max-window-size"sv; inline constexpr auto SHRPX_OPT_FRONTEND_HTTP3_MAX_CONNECTION_WINDOW_SIZE = "frontend-http3-max-connection-window-size"sv; inline constexpr auto SHRPX_OPT_FRONTEND_HTTP3_MAX_CONCURRENT_STREAMS = "frontend-http3-max-concurrent-streams"sv; inline constexpr auto SHRPX_OPT_FRONTEND_QUIC_EARLY_DATA = "frontend-quic-early-data"sv; inline constexpr auto SHRPX_OPT_FRONTEND_QUIC_QLOG_DIR = "frontend-quic-qlog-dir"sv; inline constexpr auto SHRPX_OPT_FRONTEND_QUIC_REQUIRE_TOKEN = "frontend-quic-require-token"sv; inline constexpr auto SHRPX_OPT_FRONTEND_QUIC_CONGESTION_CONTROLLER = "frontend-quic-congestion-controller"sv; inline constexpr auto SHRPX_OPT_QUIC_SERVER_ID = "quic-server-id"sv; inline constexpr auto SHRPX_OPT_FRONTEND_QUIC_SECRET_FILE = "frontend-quic-secret-file"sv; inline constexpr auto SHRPX_OPT_RLIMIT_MEMLOCK = "rlimit-memlock"sv; inline constexpr auto SHRPX_OPT_MAX_WORKER_PROCESSES = "max-worker-processes"sv; inline constexpr auto SHRPX_OPT_WORKER_PROCESS_GRACE_SHUTDOWN_PERIOD = "worker-process-grace-shutdown-period"sv; inline constexpr auto SHRPX_OPT_FRONTEND_QUIC_INITIAL_RTT = "frontend-quic-initial-rtt"sv; inline constexpr auto SHRPX_OPT_REQUIRE_HTTP_SCHEME = "require-http-scheme"sv; inline constexpr auto SHRPX_OPT_TLS_KTLS = "tls-ktls"sv; inline constexpr auto SHRPX_OPT_ALPN_LIST = "alpn-list"sv; inline constexpr auto SHRPX_OPT_FRONTEND_HEADER_TIMEOUT = "frontend-header-timeout"sv; inline constexpr auto SHRPX_OPT_FRONTEND_HTTP2_IDLE_TIMEOUT = "frontend-http2-idle-timeout"sv; inline constexpr auto SHRPX_OPT_FRONTEND_HTTP3_IDLE_TIMEOUT = "frontend-http3-idle-timeout"sv; inline constexpr auto SHRPX_OPT_GROUPS = "groups"sv; inline constexpr auto SHRPX_OPT_ECH_CONFIG_FILE = "ech-config-file"sv; inline constexpr auto SHRPX_OPT_ECH_RETRY_CONFIG_FILE = "ech-retry-config-file"sv; inline constexpr auto SHRPX_OPT_FRONTEND_STREAM_READ_TIMEOUT = "frontend-stream-read-timeout"sv; inline constexpr auto SHRPX_OPT_FRONTEND_STREAM_WRITE_TIMEOUT = "frontend-stream-write-timeout"sv; inline constexpr auto SHRPX_OPT_BACKEND_STREAM_READ_TIMEOUT = "backend-stream-read-timeout"sv; inline constexpr auto SHRPX_OPT_BACKEND_STREAM_WRITE_TIMEOUT = "backend-stream-write-timeout"sv; inline constexpr auto SHRPX_OPT_FRONTEND_MIN_WRITE_RATE = "frontend-min-write-rate"sv; inline constexpr auto SHRPX_OPT_FRONTEND_INITIAL_WRITE_RATE_TIMEOUT = "frontend-initial-write-rate-timeout"sv; inline constexpr auto SHRPX_OPT_FRONTEND_MAX_WRITE_RATE_TIMEOUT = "frontend-max-write-rate-timeout"sv; inline constexpr size_t SHRPX_OBFUSCATED_NODE_LENGTH = 8; inline constexpr auto DEFAULT_DOWNSTREAM_HOST = "127.0.0.1"sv; inline constexpr int16_t DEFAULT_DOWNSTREAM_PORT = 80; enum class Proto { NONE, HTTP1, HTTP2, HTTP3, MEMCACHED, }; enum class SessionAffinity { // No session affinity NONE, // Client IP affinity IP, // Cookie based affinity COOKIE, }; enum class SessionAffinityCookieSecure { // Secure attribute of session affinity cookie is determined by the // request scheme. AUTO, // Secure attribute of session affinity cookie is always set. YES, // Secure attribute of session affinity cookie is always unset. NO, }; enum class SessionAffinityCookieStickiness { // Backend server might be changed when an existing backend server // is removed, or new backend server is added. LOOSE, // Backend server might be changed when a designated backend server // is removed, but adding new backend server does not cause // breakage. STRICT, }; struct AffinityConfig { // Type of session affinity. SessionAffinity type; struct { // Name of a cookie to use. std::string_view name; // Path which a cookie is applied to. std::string_view path; // Secure attribute SessionAffinityCookieSecure secure; // Affinity Stickiness SessionAffinityCookieStickiness stickiness; } cookie; }; enum shrpx_forwarded_param { FORWARDED_NONE = 0, FORWARDED_BY = 0x1, FORWARDED_FOR = 0x2, FORWARDED_HOST = 0x4, FORWARDED_PROTO = 0x8, }; enum class ForwardedNode { OBFUSCATED, IP, }; struct AltSvc { std::string_view protocol_id, host, origin, service, params; uint16_t port; }; enum class UpstreamAltMode { // No alternative mode NONE, // API processing mode API, // Health monitor mode HEALTHMON, }; struct UpstreamAddr { // The unique index of this address. size_t index; // The frontend address (e.g., FQDN, hostname, IP address). If // |host_unix| is true, this is UNIX domain socket path. This must // be NULL terminated string. std::string_view host; // For TCP socket, this is <IP address>:<PORT>. For IPv6 address, // address is surrounded by square brackets. If socket is UNIX // domain socket, this is "localhost". std::string_view hostport; // Binary representation of this address. Only filled if quic is // true. Address sockaddr; // frontend port. 0 if |host_unix| is true. uint16_t port; // For TCP socket, this is either AF_INET or AF_INET6. For UNIX // domain socket, this is 0. int family; // Alternate mode UpstreamAltMode alt_mode; // true if |host| contains UNIX domain socket path. bool host_unix; // true if TLS is enabled. bool tls; // true if SNI host should be used as a host when selecting backend // server. bool sni_fwd; // true if client is supposed to send PROXY protocol v1 header. bool accept_proxy_protocol; bool quic; // true if sockaddr contains wildcard address. bool sockaddr_any; int fd; }; struct DownstreamAddrConfig { // Resolved address if |dns| is false Address addr; // backend address. If |host_unix| is true, this is UNIX domain // socket path. This must be NULL terminated string. std::string_view host; // <HOST>:<PORT>. This does not treat 80 and 443 specially. If // |host_unix| is true, this is "localhost". std::string_view hostport; // hostname sent as SNI field std::string_view sni; // name of group which this address belongs to. std::string_view group; size_t fall; size_t rise; // weight of this address inside a weight group. Its range is [1, // 256], inclusive. uint32_t weight; // weight of the weight group. Its range is [1, 256], inclusive. uint32_t group_weight; // affinity hash for this address. It is assigned when strict // stickiness is enabled. uint32_t affinity_hash; // Application protocol used in this group Proto proto; // backend port. 0 if |host_unix| is true. uint16_t port; // true if |host| contains UNIX domain socket path. bool host_unix; bool tls; // true if dynamic DNS is enabled bool dns; // true if :scheme pseudo header field should be upgraded to secure // variant (e.g., "https") when forwarding request to a backend // connected by TLS connection. bool upgrade_scheme; // true if a request should not be forwarded to a backend. bool dnf; }; // Mapping hash to idx which is an index into // DownstreamAddrGroupConfig::addrs. struct AffinityHash { AffinityHash(size_t idx, uint32_t hash) : idx(idx), hash(hash) {} size_t idx; uint32_t hash; }; struct DownstreamAddrGroupConfig { DownstreamAddrGroupConfig(std::string_view pattern) : pattern(pattern) {} std::string_view pattern; std::string_view mruby_file; std::vector<DownstreamAddrConfig> addrs; // Bunch of session affinity hash. Only used if affinity == // SessionAffinity::IP. std::vector<AffinityHash> affinity_hash; // Maps affinity hash of each DownstreamAddrConfig to its index in // addrs. It is only assigned when strict stickiness is enabled. std::unordered_map<uint32_t, size_t> affinity_hash_map; // Cookie based session affinity configuration. AffinityConfig affinity{SessionAffinity::NONE}; // true if this group requires that client connection must be TLS, // and the request must be redirected to https URI. bool redirect_if_not_tls{}; // true if a request should not be forwarded to a backend. bool dnf{}; // Timeouts for backend connection. struct { ev_tstamp read; ev_tstamp write; } timeout{}; }; struct TicketKey { const EVP_CIPHER *cipher; const EVP_MD *hmac; size_t hmac_keylen; struct { // name of this ticket configuration std::array<uint8_t, 16> name; // encryption key for |cipher| std::array<uint8_t, 32> enc_key; // hmac key for |hmac| std::array<uint8_t, 32> hmac_key; } data; }; struct TicketKeys { ~TicketKeys(); std::vector<TicketKey> keys; }; struct TLSCertificate { TLSCertificate(std::string_view private_key_file, std::string_view cert_file, std::vector<uint8_t> sct_data) : private_key_file(std::move(private_key_file)), cert_file(std::move(cert_file)), sct_data(std::move(sct_data)) {} std::string_view private_key_file; std::string_view cert_file; std::vector<uint8_t> sct_data; }; #ifdef ENABLE_HTTP3 struct QUICKeyingMaterial { QUICKeyingMaterial() noexcept = default; // This copy constructor does not copy cid_encryption_ctx and // cid_decryption_ctx from |other|. QUICKeyingMaterial(const QUICKeyingMaterial &other) noexcept; QUICKeyingMaterial(QUICKeyingMaterial &&other) noexcept; ~QUICKeyingMaterial() noexcept; // This copy assignment operator does not copy cid_encryption_ctx // and cid_decryption_ctx from |other|. The original // cid_encryption_ctx and cid_decryption_ctx are deleted if they are // not nullptr, and initialized to nullptr. QUICKeyingMaterial &operator=(const QUICKeyingMaterial &other) noexcept; QUICKeyingMaterial &operator=(QUICKeyingMaterial &&other) noexcept; std::expected<void, Error> init_ciphers(); EVP_CIPHER_CTX *cid_encryption_ctx{}; EVP_CIPHER_CTX *cid_decryption_ctx{}; std::array<uint8_t, SHRPX_QUIC_SECRET_RESERVEDLEN> reserved; std::array<uint8_t, SHRPX_QUIC_SECRETLEN> secret; std::array<uint8_t, SHRPX_QUIC_SALTLEN> salt; std::array<uint8_t, SHRPX_QUIC_CID_ENCRYPTION_KEYLEN> cid_encryption_key; // Identifier of this keying material. Only the first 2 bits are // used. uint8_t id; }; struct QUICKeyingMaterials { std::vector<QUICKeyingMaterial> keying_materials; }; #endif // defined(ENABLE_HTTP3) struct HttpProxy { Address addr; // host in http proxy URI std::string_view host; // userinfo in http proxy URI, not percent-encoded form std::string_view userinfo; // port in http proxy URI uint16_t port; }; enum HPKEPrivateKeyType : uint16_t { HPKE_DHKEM_X25519_HKDF_SHA256 = 0x0020, }; struct HPKEPrivateKey { std::span<const uint8_t> data; HPKEPrivateKeyType type; }; struct ECHKeyConfig { HPKEPrivateKey private_key; std::vector<std::span<const uint8_t>> config_list; bool retry; }; struct TLSConfig { // RFC 5077 Session ticket related configurations struct { struct { Address addr; uint16_t port; // Hostname of memcached server. This is also used as SNI field // if TLS is enabled. std::string_view host; // Client private key and certificate for authentication std::string_view private_key_file; std::string_view cert_file; ev_tstamp interval; // Maximum number of retries when getting TLS ticket key from // mamcached, due to network error. size_t max_retry; // Maximum number of consecutive error from memcached, when this // limit reached, TLS ticket is disabled. size_t max_fail; // Address family of memcached connection. One of either // AF_INET, AF_INET6 or AF_UNSPEC. int family; bool tls; } memcached; std::vector<std::string_view> files; const EVP_CIPHER *cipher; // true if --tls-ticket-key-cipher is used bool cipher_given; } ticket; // Dynamic record sizing configurations struct { size_t warmup_threshold; ev_tstamp idle_timeout; } dyn_rec; // Client verification configurations struct { // Path to file containing CA certificate solely used for client // certificate validation std::string_view cacert; bool enabled; // true if we accept an expired client certificate. bool tolerate_expired; } client_verify; // Client (backend connection) TLS configuration. struct { // Client PSK configuration struct { // identity must be NULL terminated string. std::string_view identity; std::string_view secret; } psk; std::string_view private_key_file; std::string_view cert_file; std::string_view ciphers; std::string_view tls13_ciphers; bool no_http2_cipher_block_list; } client; // PSK secrets. The key is identity, and the associated value is // its secret. std::unordered_map<std::string_view, std::string_view> psk_secrets; // The list of additional TLS certificate pair std::vector<TLSCertificate> subcerts; std::vector<unsigned char> alpn_prefs; // list of supported ALPN protocol strings in the order of // preference. std::vector<std::string_view> alpn_list; // list of supported SSL/TLS protocol strings. std::vector<std::string_view> tls_proto_list; std::vector<uint8_t> sct_data; // ECH #ifdef NGHTTP2_OPENSSL_IS_BORINGSSL std::vector<ECHKeyConfig> ech_key_config_list; #elif OPENSSL_4_0_0_API OSSL_ECHSTORE *ech_store; #endif // OPENSSL_4_0_0_API // Bit mask to disable SSL/TLS protocol versions. This will be // passed to SSL_CTX_set_options(). nghttp2_ssl_op_type tls_proto_mask; std::string_view backend_sni_name; std::chrono::seconds session_timeout; std::string_view private_key_file; std::string_view private_key_passwd; std::string_view cert_file; std::string_view dh_param_file; std::string_view ciphers; std::string_view tls13_ciphers; std::string_view groups; std::string_view cacert; // The maximum amount of 0-RTT data that server accepts. uint32_t max_early_data; // The minimum and maximum TLS version. These values are defined in // OpenSSL header file. int min_proto_version; int max_proto_version; bool insecure; bool no_http2_cipher_block_list; // true if forwarding requests included in TLS early data should not // be postponed until TLS handshake finishes. bool no_postpone_early_data; bool ktls; }; #ifdef ENABLE_HTTP3 struct QUICConfig { struct { struct { ev_tstamp idle; } timeout; struct { bool log; } debug; struct { std::string_view dir; } qlog; ngtcp2_cc_algo congestion_controller; bool early_data; bool require_token; std::string_view secret_file; ev_tstamp initial_rtt; } upstream; struct { std::string_view prog_file; bool disabled; } bpf; uint32_t server_id; }; struct Http3Config { struct { size_t max_concurrent_streams; int32_t window_size; int32_t connection_window_size; int32_t max_window_size; int32_t max_connection_window_size; } upstream; }; #endif // defined(ENABLE_HTTP3) // custom error page struct ErrorPage { // not NULL-terminated std::vector<uint8_t> content; // 0 is special value, and it matches all HTTP status code. unsigned int http_status; }; struct HttpConfig { struct { // obfuscated value used in "by" parameter of Forwarded header // field. This is only used when user defined static obfuscated // string is provided. std::string_view by_obfuscated; // bitwise-OR of one or more of shrpx_forwarded_param values. uint32_t params; // type of value recorded in "by" parameter of Forwarded header // field. ForwardedNode by_node_type; // type of value recorded in "for" parameter of Forwarded header // field. ForwardedNode for_node_type; bool strip_incoming; } forwarded; struct { bool add; bool strip_incoming; } xff; struct { bool add; bool strip_incoming; } xfp; struct { bool strip_incoming; } early_data; struct { ev_tstamp header; } timeout; struct { struct { ev_tstamp stream_read; ev_tstamp stream_write; ev_tstamp initial_write_rate; ev_tstamp max_write_rate; } timeout; size_t min_write_rate; } upstream; struct { struct { ev_tstamp stream_read; ev_tstamp stream_write; } timeout; } downstream; std::vector<AltSvc> altsvcs; // altsvcs serialized in a wire format. std::string_view altsvc_header_value; std::vector<AltSvc> http2_altsvcs; // http2_altsvcs serialized in a wire format. std::string_view http2_altsvc_header_value; std::vector<ErrorPage> error_pages; HeaderRefs add_request_headers; HeaderRefs add_response_headers; std::string_view server_name; // Port number which appears in Location header field when https // redirect is made. std::string_view redirect_https_port; size_t request_header_field_buffer; size_t max_request_header_fields; size_t response_header_field_buffer; size_t max_response_header_fields; size_t max_requests; bool no_via; bool no_location_rewrite; bool no_host_rewrite; bool no_server_rewrite; bool require_http_scheme; }; struct Http2Config { struct { struct { struct { std::string_view request_header_file; std::string_view response_header_file; FILE *request_header; FILE *response_header; } dump; bool frame_debug; } debug; struct { ev_tstamp settings; } timeout; nghttp2_option *option; nghttp2_option *alt_mode_option; nghttp2_session_callbacks *callbacks; size_t max_concurrent_streams; size_t encoder_dynamic_table_size; size_t decoder_dynamic_table_size; int32_t window_size; int32_t connection_window_size; bool optimize_write_buffer_size; bool optimize_window_size; } upstream; struct { struct { ev_tstamp settings; } timeout; nghttp2_option *option; nghttp2_session_callbacks *callbacks; size_t encoder_dynamic_table_size; size_t decoder_dynamic_table_size; int32_t window_size; int32_t connection_window_size; size_t max_concurrent_streams; } downstream; bool no_cookie_crumbling; bool no_server_push; }; struct LoggingConfig { struct { std::vector<LogFragment> format; std::string_view file; // Send accesslog to syslog, ignoring accesslog_file. bool syslog; // Write accesslog when response headers are received from // backend, rather than response body is received and sent. bool write_early; } access; struct { std::string_view file; // Send errorlog to syslog, ignoring errorlog_file. bool syslog; } error; int syslog_facility; int severity; }; struct RateLimitConfig { size_t rate; size_t burst; }; // Wildcard host pattern routing. We strips left most '*' from host // field. router includes all path patterns sharing the same wildcard // host. struct WildcardPattern { WildcardPattern(std::string_view host) : host(host) {} // This might not be NULL terminated. Currently it is only used for // comparison. std::string_view host; Router router; }; // Configuration to select backend to forward request struct RouterConfig { Router router; // Router for reversed wildcard hosts. Since this router has // wildcard hosts reversed without '*', one should call match() // function with reversed host stripping last character. This is // because we require at least one character must match for '*'. // The index stored in this router is index of wildcard_patterns. Router rev_wildcard_router; std::vector<WildcardPattern> wildcard_patterns; }; struct DownstreamConfig { DownstreamConfig() noexcept = default; DownstreamConfig(const DownstreamConfig &) = delete; DownstreamConfig(DownstreamConfig &&) = delete; DownstreamConfig &operator=(const DownstreamConfig &) = delete; DownstreamConfig &operator=(DownstreamConfig &&) = delete; // Allocator to allocate memory for Downstream configuration. Since // we may swap around DownstreamConfig in arbitrary times with API // calls, we should use their own allocator instead of per Config // allocator. BlockAllocator balloc{1024, 1024}; struct { ev_tstamp read; ev_tstamp write; ev_tstamp idle_read; ev_tstamp connect; // The maximum backoff while checking health check for offline // backend or while detaching failed backend from load balancing // group temporarily. ev_tstamp max_backoff; } timeout{}; RouterConfig router; std::vector<DownstreamAddrGroupConfig> addr_groups; // The index of catch-all group in downstream_addr_groups. size_t addr_group_catch_all{}; size_t connections_per_host{}; size_t connections_per_frontend{}; size_t request_buffer_size{}; size_t response_buffer_size{}; // Address family of backend connection. One of either AF_INET, // AF_INET6 or AF_UNSPEC. This is ignored if backend connection // is made via Unix domain socket. int family{}; }; struct ConnectionConfig { struct { struct { ev_tstamp sleep; } timeout; // address of frontend acceptors std::vector<UpstreamAddr> addrs; int backlog; // TCP fastopen. If this is positive, it is passed to // setsockopt() along with TCP_FASTOPEN. int fastopen; } listener; #ifdef ENABLE_HTTP3 struct { std::vector<UpstreamAddr> addrs; } quic_listener; #endif // defined(ENABLE_HTTP3) struct { struct { ev_tstamp http2_idle; ev_tstamp http3_idle; ev_tstamp write; ev_tstamp idle; } timeout; struct { RateLimitConfig read; RateLimitConfig write; } ratelimit; size_t worker_connections; // Deprecated. See UpstreamAddr.accept_proxy_protocol. bool accept_proxy_protocol; } upstream; std::shared_ptr<DownstreamConfig> downstream; }; struct APIConfig { // Maximum request body size for one API request size_t max_request_body; // true if at least one of UpstreamAddr has api enabled bool enabled; }; struct DNSConfig { struct { ev_tstamp cache; ev_tstamp lookup; } timeout; // The number of tries name resolver makes before abandoning // request. size_t max_try; }; struct Config { Config() noexcept = default; ~Config(); Config(Config &&) = delete; Config(const Config &&) = delete; Config &operator=(Config &&) = delete; Config &operator=(const Config &&) = delete; // Allocator to allocate memory for this object except for // DownstreamConfig. Currently, it is used to allocate memory for // strings. BlockAllocator balloc{4096, 4096}; HttpProxy downstream_http_proxy{}; HttpConfig http{}; Http2Config http2{}; TLSConfig tls{}; #ifdef ENABLE_HTTP3 QUICConfig quic{}; Http3Config http3{}; #endif // defined(ENABLE_HTTP3) LoggingConfig logging{}; ConnectionConfig conn{}; APIConfig api{}; DNSConfig dns{}; std::string_view pid_file; std::string_view conf_path; std::string_view user; std::string_view mruby_file; // The revision of configuration which is opaque string, and changes // on each configuration reloading. This does not change on // backendconfig API call. This value is returned in health check // as "nghttpx-conf-rev" response header field. The external // program can check this value to know whether reloading has // completed or not. uint64_t config_revision{}; size_t num_worker{}; size_t padding{}; size_t rlimit_nofile{}; size_t rlimit_memlock{}; uid_t uid{}; gid_t gid{}; pid_t pid{}; bool verbose{}; bool daemon{}; bool http2_proxy{}; // Run nghttpx in single process mode. With this mode, signal // handling is omitted. bool single_process{}; bool single_thread{}; // Ignore mruby compile error for per-pattern mruby script. bool ignore_per_pattern_mruby_error{}; // flags passed to ev_default_loop() and ev_loop_new() uint32_t ev_loop_flags{}; size_t max_worker_processes{}; ev_tstamp worker_process_grace_shutdown_period{}; }; const Config *get_config(); Config *mod_config(); // Replaces the current config with given |new_config|. The old config is // returned. std::unique_ptr<Config> replace_config(std::unique_ptr<Config> new_config); void create_config(); // generated by gennghttpxfun.py enum { SHRPX_OPTID_ACCEPT_PROXY_PROTOCOL, SHRPX_OPTID_ACCESSLOG_FILE, SHRPX_OPTID_ACCESSLOG_FORMAT, SHRPX_OPTID_ACCESSLOG_SYSLOG, SHRPX_OPTID_ACCESSLOG_WRITE_EARLY, SHRPX_OPTID_ADD_FORWARDED, SHRPX_OPTID_ADD_REQUEST_HEADER, SHRPX_OPTID_ADD_RESPONSE_HEADER, SHRPX_OPTID_ADD_X_FORWARDED_FOR, SHRPX_OPTID_ALPN_LIST, SHRPX_OPTID_ALTSVC, SHRPX_OPTID_API_MAX_REQUEST_BODY, SHRPX_OPTID_BACKEND, SHRPX_OPTID_BACKEND_ADDRESS_FAMILY, SHRPX_OPTID_BACKEND_CONNECT_TIMEOUT, SHRPX_OPTID_BACKEND_CONNECTIONS_PER_FRONTEND, SHRPX_OPTID_BACKEND_CONNECTIONS_PER_HOST, SHRPX_OPTID_BACKEND_HTTP_PROXY_URI, SHRPX_OPTID_BACKEND_HTTP1_CONNECTIONS_PER_FRONTEND, SHRPX_OPTID_BACKEND_HTTP1_CONNECTIONS_PER_HOST, SHRPX_OPTID_BACKEND_HTTP1_TLS, SHRPX_OPTID_BACKEND_HTTP2_CONNECTION_WINDOW_BITS, SHRPX_OPTID_BACKEND_HTTP2_CONNECTION_WINDOW_SIZE, SHRPX_OPTID_BACKEND_HTTP2_CONNECTIONS_PER_WORKER, SHRPX_OPTID_BACKEND_HTTP2_DECODER_DYNAMIC_TABLE_SIZE, SHRPX_OPTID_BACKEND_HTTP2_ENCODER_DYNAMIC_TABLE_SIZE, SHRPX_OPTID_BACKEND_HTTP2_MAX_CONCURRENT_STREAMS, SHRPX_OPTID_BACKEND_HTTP2_SETTINGS_TIMEOUT, SHRPX_OPTID_BACKEND_HTTP2_WINDOW_BITS, SHRPX_OPTID_BACKEND_HTTP2_WINDOW_SIZE, SHRPX_OPTID_BACKEND_IPV4, SHRPX_OPTID_BACKEND_IPV6, SHRPX_OPTID_BACKEND_KEEP_ALIVE_TIMEOUT, SHRPX_OPTID_BACKEND_MAX_BACKOFF, SHRPX_OPTID_BACKEND_NO_TLS, SHRPX_OPTID_BACKEND_READ_TIMEOUT, SHRPX_OPTID_BACKEND_REQUEST_BUFFER, SHRPX_OPTID_BACKEND_RESPONSE_BUFFER, SHRPX_OPTID_BACKEND_STREAM_READ_TIMEOUT, SHRPX_OPTID_BACKEND_STREAM_WRITE_TIMEOUT, SHRPX_OPTID_BACKEND_TLS, SHRPX_OPTID_BACKEND_TLS_SNI_FIELD, SHRPX_OPTID_BACKEND_WRITE_TIMEOUT, SHRPX_OPTID_BACKLOG, SHRPX_OPTID_CACERT, SHRPX_OPTID_CERTIFICATE_FILE, SHRPX_OPTID_CIPHERS, SHRPX_OPTID_CLIENT, SHRPX_OPTID_CLIENT_CERT_FILE, SHRPX_OPTID_CLIENT_CIPHERS, SHRPX_OPTID_CLIENT_NO_HTTP2_CIPHER_BLACK_LIST, SHRPX_OPTID_CLIENT_NO_HTTP2_CIPHER_BLOCK_LIST, SHRPX_OPTID_CLIENT_PRIVATE_KEY_FILE, SHRPX_OPTID_CLIENT_PROXY, SHRPX_OPTID_CLIENT_PSK_SECRETS, SHRPX_OPTID_CONF, SHRPX_OPTID_DAEMON, SHRPX_OPTID_DH_PARAM_FILE, SHRPX_OPTID_DNS_CACHE_TIMEOUT, SHRPX_OPTID_DNS_LOOKUP_TIMEOUT, SHRPX_OPTID_DNS_MAX_TRY, SHRPX_OPTID_ECDH_CURVES, SHRPX_OPTID_ECH_CONFIG_FILE, SHRPX_OPTID_ECH_RETRY_CONFIG_FILE, SHRPX_OPTID_ERROR_PAGE, SHRPX_OPTID_ERRORLOG_FILE, SHRPX_OPTID_ERRORLOG_SYSLOG, SHRPX_OPTID_FASTOPEN, SHRPX_OPTID_FETCH_OCSP_RESPONSE_FILE, SHRPX_OPTID_FORWARDED_BY, SHRPX_OPTID_FORWARDED_FOR, SHRPX_OPTID_FRONTEND, SHRPX_OPTID_FRONTEND_FRAME_DEBUG, SHRPX_OPTID_FRONTEND_HEADER_TIMEOUT, SHRPX_OPTID_FRONTEND_HTTP2_CONNECTION_WINDOW_BITS, SHRPX_OPTID_FRONTEND_HTTP2_CONNECTION_WINDOW_SIZE, SHRPX_OPTID_FRONTEND_HTTP2_DECODER_DYNAMIC_TABLE_SIZE, SHRPX_OPTID_FRONTEND_HTTP2_DUMP_REQUEST_HEADER, SHRPX_OPTID_FRONTEND_HTTP2_DUMP_RESPONSE_HEADER, SHRPX_OPTID_FRONTEND_HTTP2_ENCODER_DYNAMIC_TABLE_SIZE, SHRPX_OPTID_FRONTEND_HTTP2_IDLE_TIMEOUT, SHRPX_OPTID_FRONTEND_HTTP2_MAX_CONCURRENT_STREAMS, SHRPX_OPTID_FRONTEND_HTTP2_OPTIMIZE_WINDOW_SIZE, SHRPX_OPTID_FRONTEND_HTTP2_OPTIMIZE_WRITE_BUFFER_SIZE, SHRPX_OPTID_FRONTEND_HTTP2_READ_TIMEOUT, SHRPX_OPTID_FRONTEND_HTTP2_SETTINGS_TIMEOUT, SHRPX_OPTID_FRONTEND_HTTP2_WINDOW_BITS, SHRPX_OPTID_FRONTEND_HTTP2_WINDOW_SIZE, SHRPX_OPTID_FRONTEND_HTTP3_CONNECTION_WINDOW_SIZE, SHRPX_OPTID_FRONTEND_HTTP3_IDLE_TIMEOUT, SHRPX_OPTID_FRONTEND_HTTP3_MAX_CONCURRENT_STREAMS, SHRPX_OPTID_FRONTEND_HTTP3_MAX_CONNECTION_WINDOW_SIZE, SHRPX_OPTID_FRONTEND_HTTP3_MAX_WINDOW_SIZE, SHRPX_OPTID_FRONTEND_HTTP3_READ_TIMEOUT, SHRPX_OPTID_FRONTEND_HTTP3_WINDOW_SIZE, SHRPX_OPTID_FRONTEND_INITIAL_WRITE_RATE_TIMEOUT, SHRPX_OPTID_FRONTEND_KEEP_ALIVE_TIMEOUT, SHRPX_OPTID_FRONTEND_MAX_REQUESTS, SHRPX_OPTID_FRONTEND_MAX_WRITE_RATE_TIMEOUT, SHRPX_OPTID_FRONTEND_MIN_WRITE_RATE, SHRPX_OPTID_FRONTEND_NO_TLS, SHRPX_OPTID_FRONTEND_QUIC_CONGESTION_CONTROLLER, SHRPX_OPTID_FRONTEND_QUIC_DEBUG_LOG, SHRPX_OPTID_FRONTEND_QUIC_EARLY_DATA, SHRPX_OPTID_FRONTEND_QUIC_IDLE_TIMEOUT, SHRPX_OPTID_FRONTEND_QUIC_INITIAL_RTT, SHRPX_OPTID_FRONTEND_QUIC_QLOG_DIR, SHRPX_OPTID_FRONTEND_QUIC_REQUIRE_TOKEN, SHRPX_OPTID_FRONTEND_QUIC_SECRET_FILE, SHRPX_OPTID_FRONTEND_READ_TIMEOUT, SHRPX_OPTID_FRONTEND_STREAM_READ_TIMEOUT, SHRPX_OPTID_FRONTEND_STREAM_WRITE_TIMEOUT, SHRPX_OPTID_FRONTEND_WRITE_TIMEOUT, SHRPX_OPTID_GROUPS, SHRPX_OPTID_HEADER_FIELD_BUFFER, SHRPX_OPTID_HOST_REWRITE, SHRPX_OPTID_HTTP2_ALTSVC, SHRPX_OPTID_HTTP2_BRIDGE, SHRPX_OPTID_HTTP2_MAX_CONCURRENT_STREAMS, SHRPX_OPTID_HTTP2_NO_COOKIE_CRUMBLING, SHRPX_OPTID_HTTP2_PROXY, SHRPX_OPTID_IGNORE_PER_PATTERN_MRUBY_ERROR, SHRPX_OPTID_INCLUDE, SHRPX_OPTID_INSECURE, SHRPX_OPTID_LISTENER_DISABLE_TIMEOUT, SHRPX_OPTID_LOG_LEVEL, SHRPX_OPTID_MAX_HEADER_FIELDS, SHRPX_OPTID_MAX_REQUEST_HEADER_FIELDS, SHRPX_OPTID_MAX_RESPONSE_HEADER_FIELDS, SHRPX_OPTID_MAX_WORKER_PROCESSES, SHRPX_OPTID_MRUBY_FILE, SHRPX_OPTID_NO_ADD_X_FORWARDED_PROTO, SHRPX_OPTID_NO_HOST_REWRITE, SHRPX_OPTID_NO_HTTP2_CIPHER_BLACK_LIST, SHRPX_OPTID_NO_HTTP2_CIPHER_BLOCK_LIST, SHRPX_OPTID_NO_KQUEUE, SHRPX_OPTID_NO_LOCATION_REWRITE, SHRPX_OPTID_NO_OCSP, SHRPX_OPTID_NO_QUIC_BPF, SHRPX_OPTID_NO_SERVER_PUSH, SHRPX_OPTID_NO_SERVER_REWRITE, SHRPX_OPTID_NO_STRIP_INCOMING_EARLY_DATA, SHRPX_OPTID_NO_STRIP_INCOMING_X_FORWARDED_PROTO, SHRPX_OPTID_NO_VERIFY_OCSP, SHRPX_OPTID_NO_VIA, SHRPX_OPTID_NPN_LIST, SHRPX_OPTID_OCSP_STARTUP, SHRPX_OPTID_OCSP_UPDATE_INTERVAL, SHRPX_OPTID_PADDING, SHRPX_OPTID_PID_FILE, SHRPX_OPTID_PRIVATE_KEY_FILE, SHRPX_OPTID_PRIVATE_KEY_PASSWD_FILE, SHRPX_OPTID_PSK_SECRETS, SHRPX_OPTID_QUIC_BPF_PROGRAM_FILE, SHRPX_OPTID_QUIC_SERVER_ID, SHRPX_OPTID_READ_BURST, SHRPX_OPTID_READ_RATE, SHRPX_OPTID_REDIRECT_HTTPS_PORT, SHRPX_OPTID_REQUEST_HEADER_FIELD_BUFFER, SHRPX_OPTID_REQUIRE_HTTP_SCHEME, SHRPX_OPTID_RESPONSE_HEADER_FIELD_BUFFER, SHRPX_OPTID_RLIMIT_MEMLOCK, SHRPX_OPTID_RLIMIT_NOFILE, SHRPX_OPTID_SERVER_NAME, SHRPX_OPTID_SINGLE_PROCESS, SHRPX_OPTID_SINGLE_THREAD, SHRPX_OPTID_STREAM_READ_TIMEOUT, SHRPX_OPTID_STREAM_WRITE_TIMEOUT, SHRPX_OPTID_STRIP_INCOMING_FORWARDED, SHRPX_OPTID_STRIP_INCOMING_X_FORWARDED_FOR, SHRPX_OPTID_SUBCERT, SHRPX_OPTID_SYSLOG_FACILITY, SHRPX_OPTID_TLS_DYN_REC_IDLE_TIMEOUT, SHRPX_OPTID_TLS_DYN_REC_WARMUP_THRESHOLD, SHRPX_OPTID_TLS_KTLS, SHRPX_OPTID_TLS_MAX_EARLY_DATA, SHRPX_OPTID_TLS_MAX_PROTO_VERSION, SHRPX_OPTID_TLS_MIN_PROTO_VERSION, SHRPX_OPTID_TLS_NO_POSTPONE_EARLY_DATA, SHRPX_OPTID_TLS_PROTO_LIST, SHRPX_OPTID_TLS_SCT_DIR, SHRPX_OPTID_TLS_SESSION_CACHE_MEMCACHED, SHRPX_OPTID_TLS_SESSION_CACHE_MEMCACHED_ADDRESS_FAMILY, SHRPX_OPTID_TLS_SESSION_CACHE_MEMCACHED_CERT_FILE, SHRPX_OPTID_TLS_SESSION_CACHE_MEMCACHED_PRIVATE_KEY_FILE, SHRPX_OPTID_TLS_SESSION_CACHE_MEMCACHED_TLS, SHRPX_OPTID_TLS_TICKET_KEY_CIPHER, SHRPX_OPTID_TLS_TICKET_KEY_FILE, SHRPX_OPTID_TLS_TICKET_KEY_MEMCACHED, SHRPX_OPTID_TLS_TICKET_KEY_MEMCACHED_ADDRESS_FAMILY, SHRPX_OPTID_TLS_TICKET_KEY_MEMCACHED_CERT_FILE, SHRPX_OPTID_TLS_TICKET_KEY_MEMCACHED_INTERVAL, SHRPX_OPTID_TLS_TICKET_KEY_MEMCACHED_MAX_FAIL, SHRPX_OPTID_TLS_TICKET_KEY_MEMCACHED_MAX_RETRY, SHRPX_OPTID_TLS_TICKET_KEY_MEMCACHED_PRIVATE_KEY_FILE, SHRPX_OPTID_TLS_TICKET_KEY_MEMCACHED_TLS, SHRPX_OPTID_TLS13_CIPHERS, SHRPX_OPTID_TLS13_CLIENT_CIPHERS, SHRPX_OPTID_USER, SHRPX_OPTID_VERIFY_CLIENT, SHRPX_OPTID_VERIFY_CLIENT_CACERT, SHRPX_OPTID_VERIFY_CLIENT_TOLERATE_EXPIRED, SHRPX_OPTID_WORKER_FRONTEND_CONNECTIONS, SHRPX_OPTID_WORKER_PROCESS_GRACE_SHUTDOWN_PERIOD, SHRPX_OPTID_WORKER_READ_BURST, SHRPX_OPTID_WORKER_READ_RATE, SHRPX_OPTID_WORKER_WRITE_BURST, SHRPX_OPTID_WORKER_WRITE_RATE, SHRPX_OPTID_WORKERS, SHRPX_OPTID_WRITE_BURST, SHRPX_OPTID_WRITE_RATE, SHRPX_OPTID_MAXIDX, }; // Looks up token for given option name |name|. int option_lookup_token(std::string_view name); // Parses option name |opt| and value |optarg|. The results are // stored into the object pointed by |config|. The |included_set| // contains the all paths already included while processing this // configuration, to avoid loop in --include option. The // |pattern_addr_indexer| contains a pair of pattern of backend, and // its index in DownstreamConfig::addr_groups. It is introduced to // speed up loading configuration file with lots of backends. std::expected<void, Error> parse_config( Config *config, std::string_view opt, std::string_view optarg, std::unordered_set<std::string_view> &included_set, std::unordered_map<std::string_view, size_t> &pattern_addr_indexer); // Similar to parse_config() above, but additional |optid| which // should be the return value of option_lookup_token(opt). std::expected<void, Error> parse_config( Config *config, int optid, std::string_view opt, std::string_view optarg, std::unordered_set<std::string_view> &included_set, std::unordered_map<std::string_view, size_t> &pattern_addr_indexer); // Loads configurations from |filename| and stores them in |config|. // See parse_config() for |include_set|. std::expected<void, Error> load_config(Config *config, const char *filename, std::unordered_set<std::string_view> &include_set, std::unordered_map<std::string_view, size_t> &pattern_addr_indexer); // Parses header field in |optarg|. We expect header field is formed // like "NAME: VALUE". We require that NAME is non empty string. ":" // is allowed at the start of the NAME, but NAME == ":" is not // allowed. This function returns pair of NAME and VALUE. std::expected<HeaderRef, Error> parse_header(BlockAllocator &balloc, std::string_view optarg); std::vector<LogFragment> parse_log_format(BlockAllocator &balloc, std::string_view optarg); // Returns string for syslog |facility|. std::string_view str_syslog_facility(int facility); // Returns integer value of syslog |facility| string. std::expected<int, Error> int_syslog_facility(std::string_view strfacility); std::expected<FILE *, Error> open_file_for_write(const char *filename); // Reads TLS ticket key file in |files| and returns TicketKey which // stores read key data. The given |cipher| and |hmac| determine the // expected file size. This function returns TicketKey if it // succeeds, or nullptr. std::unique_ptr<TicketKeys> read_tls_ticket_key_file(const std::vector<std::string_view> &files, const EVP_CIPHER *cipher, const EVP_MD *hmac); #ifdef ENABLE_HTTP3 std::expected<std::unique_ptr<QUICKeyingMaterials>, Error> read_quic_secret_file(std::string_view path); #endif // defined(ENABLE_HTTP3) // Returns string representation of |proto|. std::string_view strproto(Proto proto); std::expected<void, Error> configure_downstream_group(Config *config, bool http2_proxy, bool numeric_addr_only, const TLSConfig &tlsconf); std::expected<Address, Error> resolve_hostname(const char *hostname, uint16_t port, int family, int additional_flags = 0); } // namespace shrpx #endif // !defined(SHRPX_CONFIG_H)