[nginx] QUIC: do not increase underutilized congestion window.

[Sergey Kandaurov]

> On 25 Apr 2025, at 14:51, Vladimir Homutov via nginx-devel <nginx-devel at nginx.org> wrote:
> 
> On Tue, Apr 15, 2025 at 03:02:02PM +0000, noreply at nginx.com wrote:
>> details:   https://github.com/nginx/nginx/commit/cd5e4fa1446dff86fafc3b6ffcc11afd527a024f
>> branches:  master
>> commit:    cd5e4fa1446dff86fafc3b6ffcc11afd527a024f
>> user:      Roman Arutyunyan <arut at nginx.com>
>> date:      Sat, 4 Jan 2025 18:03:46 +0400
>> description:
>> QUIC: do not increase underutilized congestion window.
>> 
>> As per RFC 9002, Section 7.8, congestion window should not be increased
>> when it's underutilized.
>> 
> 
> Hello,
> 
> it looks like this patch triggers some issues with ack processing
> (possible previously, but now more probable): see details in suggested
> patch.
> 
> I'm also attaching bad.log and good.log. The first one demonstrates that
> nginx is not sending any ACKs since it is switched into idle mode and
> the window is not increasing. Since the client code is symmetric, deadlock
> occurs.

cd5e4fa14 is not the only one to blame uncovering this apparently old bug.

Few more things to consider:
- 53e7e9eb5 initial congestion window reduction made this easier to trigger
- a40cc7002 to ignore congestion in MTU probes made this easier to trigger

The fix is to teach ngx_quic_output() to send ACKs on congested links.
This meets RFC 9002, 7 and B.2

: An endpoint MUST NOT send a packet if it would cause bytes_in_flight
: (see Appendix B.2) to be larger than the congestion window

: bytes_in_flight:
: Packets only containing ACK frames do not count toward
: bytes_in_flight to ensure congestion control does not impede
: congestion feedback.


A simple reproducer attached.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: h3_congestion_ack.t
Type: application/octet-stream
Size: 2056 bytes
Desc: not available
URL: <http://mailman.nginx.org/pipermail/nginx-devel/attachments/20250425/35ee9ffd/attachment.obj>
-------------- next part --------------


-- 
Sergey Kandaurov