blob: 3696521bb28340dd0ad5bfc8948df579170b3a89 [file] [log] [blame]
Willy Tarreau62f52692017-10-08 23:01:42 +02001/*
2 * HTTP/2 mux-demux for connections
3 *
4 * Copyright 2017 Willy Tarreau <w@1wt.eu>
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
13#include <common/cfgparse.h>
14#include <common/config.h>
Willy Tarreau5ab6b572017-09-22 08:05:00 +020015#include <common/h2.h>
Willy Tarreau13278b42017-10-13 19:23:14 +020016#include <common/hpack-dec.h>
Willy Tarreau9e5ae1d2017-10-17 19:58:20 +020017#include <common/hpack-enc.h>
Willy Tarreau5ab6b572017-09-22 08:05:00 +020018#include <common/hpack-tbl.h>
Willy Tarreaue4820742017-07-27 13:37:23 +020019#include <common/net_helper.h>
Willy Tarreau35dbd5d2017-09-22 09:13:49 +020020#include <proto/applet.h>
Willy Tarreau62f52692017-10-08 23:01:42 +020021#include <proto/connection.h>
Willy Tarreau3ccf4b22017-10-13 19:07:26 +020022#include <proto/h1.h>
Willy Tarreau62f52692017-10-08 23:01:42 +020023#include <proto/stream.h>
Willy Tarreauea392822017-10-31 10:02:25 +010024#include <types/session.h>
Willy Tarreau5ab6b572017-09-22 08:05:00 +020025#include <eb32tree.h>
Willy Tarreau62f52692017-10-08 23:01:42 +020026
27
Willy Tarreau2a856182017-05-16 15:20:39 +020028/* dummy streams returned for idle and closed states */
29static const struct h2s *h2_closed_stream;
30static const struct h2s *h2_idle_stream;
31
Willy Tarreau5ab6b572017-09-22 08:05:00 +020032/* the h2c connection pool */
33static struct pool_head *pool2_h2c;
Willy Tarreau18312642017-10-11 07:57:07 +020034/* the h2s stream pool */
35static struct pool_head *pool2_h2s;
Willy Tarreau5ab6b572017-09-22 08:05:00 +020036
37/* Connection flags (32 bit), in h2c->flags */
38#define H2_CF_NONE 0x00000000
39
Willy Tarreau2e5b60e2017-09-25 11:49:03 +020040/* Flags indicating why writing to the mux is blocked. */
41#define H2_CF_MUX_MALLOC 0x00000001 // mux blocked on lack of connection's mux buffer
42#define H2_CF_MUX_MFULL 0x00000002 // mux blocked on connection's mux buffer full
43#define H2_CF_MUX_BLOCK_ANY 0x00000003 // aggregate of the mux flags above
44
45/* Flags indicating why writing to the demux is blocked. */
46#define H2_CF_DEM_DALLOC 0x00000004 // demux blocked on lack of connection's demux buffer
47#define H2_CF_DEM_DFULL 0x00000008 // demux blocked on connection's demux buffer full
48#define H2_CF_DEM_MBUSY 0x00000010 // demux blocked on connection's mux side busy
49#define H2_CF_DEM_MROOM 0x00000020 // demux blocked on lack of room in mux buffer
50#define H2_CF_DEM_SALLOC 0x00000040 // demux blocked on lack of stream's request buffer
51#define H2_CF_DEM_SFULL 0x00000080 // demux blocked on stream request buffer full
52#define H2_CF_DEM_BLOCK_ANY 0x000000FC // aggregate of the demux flags above
53
Willy Tarreau081d4722017-05-16 21:51:05 +020054/* other flags */
55#define H2_CF_GOAWAY_SENT 0x00000100 // a GOAWAY frame was successfully sent
56#define H2_CF_GOAWAY_FAILED 0x00000200 // a GOAWAY frame failed to be sent
57
58
Willy Tarreau5ab6b572017-09-22 08:05:00 +020059/* H2 connection state, in h2c->st0 */
60enum h2_cs {
61 H2_CS_PREFACE, // init done, waiting for connection preface
62 H2_CS_SETTINGS1, // preface OK, waiting for first settings frame
63 H2_CS_FRAME_H, // first settings frame ok, waiting for frame header
64 H2_CS_FRAME_P, // frame header OK, waiting for frame payload
65 H2_CS_FRAME_A, // frame payload OK, trying to send ACK/RST frame
66 H2_CS_ERROR, // send GOAWAY(errcode) and close the connection ASAP
67 H2_CS_ERROR2, // GOAWAY(errcode) sent, close the connection ASAP
68 H2_CS_ENTRIES // must be last
69} __attribute__((packed));
70
71/* H2 connection descriptor */
72struct h2c {
73 struct connection *conn;
74
75 enum h2_cs st0; /* mux state */
76 enum h2_err errcode; /* H2 err code (H2_ERR_*) */
77
78 /* 16 bit hole here */
79 uint32_t flags; /* connection flags: H2_CF_* */
80 int32_t max_id; /* highest ID known on this connection, <0 before preface */
81 uint32_t rcvd_c; /* newly received data to ACK for the connection */
82 uint32_t rcvd_s; /* newly received data to ACK for the current stream (dsi) */
83
84 /* states for the demux direction */
85 struct hpack_dht *ddht; /* demux dynamic header table */
86 struct buffer *dbuf; /* demux buffer */
87
88 int32_t dsi; /* demux stream ID (<0 = idle) */
89 int32_t dfl; /* demux frame length (if dsi >= 0) */
90 int8_t dft; /* demux frame type (if dsi >= 0) */
91 int8_t dff; /* demux frame flags (if dsi >= 0) */
92 /* 16 bit hole here */
93 int32_t last_sid; /* last processed stream ID for GOAWAY, <0 before preface */
94
95 /* states for the mux direction */
96 struct buffer *mbuf; /* mux buffer */
97 int32_t msi; /* mux stream ID (<0 = idle) */
98 int32_t mfl; /* mux frame length (if dsi >= 0) */
99 int8_t mft; /* mux frame type (if dsi >= 0) */
100 int8_t mff; /* mux frame flags (if dsi >= 0) */
101 /* 16 bit hole here */
102 int32_t miw; /* mux initial window size for all new streams */
103 int32_t mws; /* mux window size. Can be negative. */
104 int32_t mfs; /* mux's max frame size */
105
Willy Tarreauea392822017-10-31 10:02:25 +0100106 int timeout; /* idle timeout duration in ticks */
107 struct task *task; /* timeout management task */
Willy Tarreau5ab6b572017-09-22 08:05:00 +0200108 struct eb_root streams_by_id; /* all active streams by their ID */
109 struct list send_list; /* list of blocked streams requesting to send */
110 struct list fctl_list; /* list of streams blocked by connection's fctl */
Willy Tarreau35dbd5d2017-09-22 09:13:49 +0200111 struct buffer_wait dbuf_wait; /* wait list for demux buffer allocation */
Willy Tarreau14398122017-09-22 14:26:04 +0200112 struct buffer_wait mbuf_wait; /* wait list for mux buffer allocation */
Willy Tarreau5ab6b572017-09-22 08:05:00 +0200113};
114
Willy Tarreau18312642017-10-11 07:57:07 +0200115/* H2 stream state, in h2s->st */
116enum h2_ss {
117 H2_SS_IDLE = 0, // idle
118 H2_SS_RLOC, // reserved(local)
119 H2_SS_RREM, // reserved(remote)
120 H2_SS_OPEN, // open
121 H2_SS_HREM, // half-closed(remote)
122 H2_SS_HLOC, // half-closed(local)
Willy Tarreau96060ba2017-10-16 18:34:34 +0200123 H2_SS_ERROR, // an error needs to be sent using RST_STREAM
Willy Tarreau18312642017-10-11 07:57:07 +0200124 H2_SS_CLOSED, // closed
125 H2_SS_ENTRIES // must be last
126} __attribute__((packed));
127
128/* HTTP/2 stream flags (32 bit), in h2s->flags */
129#define H2_SF_NONE 0x00000000
130#define H2_SF_ES_RCVD 0x00000001
131#define H2_SF_ES_SENT 0x00000002
132
133#define H2_SF_RST_RCVD 0x00000004 // received RST_STREAM
134#define H2_SF_RST_SENT 0x00000008 // sent RST_STREAM
135
Willy Tarreau2e5b60e2017-09-25 11:49:03 +0200136/* stream flags indicating the reason the stream is blocked */
137#define H2_SF_BLK_MBUSY 0x00000010 // blocked waiting for mux access (transient)
138#define H2_SF_BLK_MROOM 0x00000020 // blocked waiting for room in the mux
139#define H2_SF_BLK_MFCTL 0x00000040 // blocked due to mux fctl
140#define H2_SF_BLK_SFCTL 0x00000080 // blocked due to stream fctl
141#define H2_SF_BLK_ANY 0x000000F0 // any of the reasons above
142
Willy Tarreau454f9052017-10-26 19:40:35 +0200143/* stream flags indicating how data is supposed to be sent */
144#define H2_SF_DATA_CLEN 0x00000100 // data sent using content-length
145#define H2_SF_DATA_CHNK 0x00000200 // data sent using chunked-encoding
146
147/* step we're currently in when sending chunks. This is needed because we may
148 * have to transfer chunks as large as a full buffer so there's no room left
149 * for size nor crlf around.
150 */
151#define H2_SF_CHNK_SIZE 0x00000000 // trying to send chunk size
152#define H2_SF_CHNK_DATA 0x00000400 // trying to send chunk data
153#define H2_SF_CHNK_CRLF 0x00000800 // trying to send chunk crlf after data
154
155#define H2_SF_CHNK_MASK 0x00000C00 // trying to send chunk size
156
Willy Tarreau67434202017-11-06 20:20:51 +0100157#define H2_SF_HEADERS_SENT 0x00001000 // a HEADERS frame was sent for this stream
Willy Tarreauc4312d32017-11-07 12:01:53 +0100158#define H2_SF_OUTGOING_DATA 0x00002000 // set whenever we've seen outgoing data
Willy Tarreau67434202017-11-06 20:20:51 +0100159
Willy Tarreau18312642017-10-11 07:57:07 +0200160/* H2 stream descriptor, describing the stream as it appears in the H2C, and as
161 * it is being processed in the internal HTTP representation (H1 for now).
162 */
163struct h2s {
164 struct conn_stream *cs;
165 struct h2c *h2c;
166 struct h1m req, res; /* request and response parser state for H1 */
167 struct eb32_node by_id; /* place in h2c's streams_by_id */
168 struct list list; /* position in active/blocked lists if blocked>0 */
169 int32_t id; /* stream ID */
170 uint32_t flags; /* H2_SF_* */
171 int mws; /* mux window size for this stream */
172 enum h2_err errcode; /* H2 err code (H2_ERR_*) */
173 enum h2_ss st;
174};
Willy Tarreau5ab6b572017-09-22 08:05:00 +0200175
Willy Tarreauc6405142017-09-21 20:23:50 +0200176/* descriptor for an h2 frame header */
177struct h2_fh {
178 uint32_t len; /* length, host order, 24 bits */
179 uint32_t sid; /* stream id, host order, 31 bits */
180 uint8_t ft; /* frame type */
181 uint8_t ff; /* frame flags */
182};
183
Willy Tarreaufe20e5b2017-07-27 11:42:14 +0200184/* a few settings from the global section */
185static int h2_settings_header_table_size = 4096; /* initial value */
Willy Tarreaue6baec02017-07-27 11:45:11 +0200186static int h2_settings_initial_window_size = 65535; /* initial value */
Willy Tarreau5242ef82017-07-27 11:47:28 +0200187static int h2_settings_max_concurrent_streams = 100;
Willy Tarreaufe20e5b2017-07-27 11:42:14 +0200188
Willy Tarreau2a856182017-05-16 15:20:39 +0200189/* a dmumy closed stream */
190static const struct h2s *h2_closed_stream = &(const struct h2s){
191 .cs = NULL,
192 .h2c = NULL,
193 .st = H2_SS_CLOSED,
194 .id = 0,
195};
196
197/* and a dummy idle stream for use with any unannounced stream */
198static const struct h2s *h2_idle_stream = &(const struct h2s){
199 .cs = NULL,
200 .h2c = NULL,
201 .st = H2_SS_IDLE,
202 .id = 0,
203};
204
Willy Tarreauea392822017-10-31 10:02:25 +0100205static struct task *h2_timeout_task(struct task *t);
Willy Tarreaufe20e5b2017-07-27 11:42:14 +0200206
Willy Tarreau35dbd5d2017-09-22 09:13:49 +0200207/*****************************************************/
208/* functions below are for dynamic buffer management */
209/*****************************************************/
210
211/* re-enables receiving on mux <target> after a buffer was allocated. It returns
212 * 1 if the allocation succeeds, in which case the connection is woken up, or 0
213 * if it's impossible to wake up and we prefer to be woken up later.
214 */
215static int h2_dbuf_available(void *target)
216{
217 struct h2c *h2c = target;
218
219 /* take the buffer now as we'll get scheduled waiting for ->wake() */
220 if (b_alloc_margin(&h2c->dbuf, 0)) {
Willy Tarreau1b62c5c2017-09-25 11:55:01 +0200221 h2c->flags &= ~H2_CF_DEM_DALLOC;
222 if (!(h2c->flags & H2_CF_DEM_BLOCK_ANY))
223 conn_xprt_want_recv(h2c->conn);
Willy Tarreau35dbd5d2017-09-22 09:13:49 +0200224 return 1;
225 }
226 return 0;
227}
228
229static inline struct buffer *h2_get_dbuf(struct h2c *h2c)
230{
231 struct buffer *buf = NULL;
232
233 if (likely(LIST_ISEMPTY(&h2c->dbuf_wait.list)) &&
234 unlikely((buf = b_alloc_margin(&h2c->dbuf, 0)) == NULL)) {
235 h2c->dbuf_wait.target = h2c->conn;
236 h2c->dbuf_wait.wakeup_cb = h2_dbuf_available;
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100237 HA_SPIN_LOCK(BUF_WQ_LOCK, &buffer_wq_lock);
Willy Tarreau35dbd5d2017-09-22 09:13:49 +0200238 LIST_ADDQ(&buffer_wq, &h2c->dbuf_wait.list);
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100239 HA_SPIN_UNLOCK(BUF_WQ_LOCK, &buffer_wq_lock);
Willy Tarreau35dbd5d2017-09-22 09:13:49 +0200240 __conn_xprt_stop_recv(h2c->conn);
241 }
242 return buf;
243}
244
245static inline void h2_release_dbuf(struct h2c *h2c)
246{
247 if (h2c->dbuf->size) {
248 b_free(&h2c->dbuf);
249 offer_buffers(h2c->dbuf_wait.target,
250 tasks_run_queue + applets_active_queue);
251 }
252}
253
Willy Tarreau14398122017-09-22 14:26:04 +0200254/* re-enables sending on mux <target> after a buffer was allocated. It returns
255 * 1 if the allocation succeeds, in which case the connection is woken up, or 0
256 * if it's impossible to wake up and we prefer to be woken up later.
257 */
258static int h2_mbuf_available(void *target)
259{
260 struct h2c *h2c = target;
261
262 /* take the buffer now as we'll get scheduled waiting for ->wake(). */
263 if (b_alloc_margin(&h2c->mbuf, 0)) {
Willy Tarreau1b62c5c2017-09-25 11:55:01 +0200264 if (h2c->flags & H2_CF_MUX_MALLOC) {
265 h2c->flags &= ~H2_CF_MUX_MALLOC;
266 if (!(h2c->flags & H2_CF_MUX_BLOCK_ANY))
267 conn_xprt_want_send(h2c->conn);
268 }
269
270 if (h2c->flags & H2_CF_DEM_MROOM) {
271 h2c->flags &= ~H2_CF_DEM_MROOM;
272 if (!(h2c->flags & H2_CF_DEM_BLOCK_ANY))
273 conn_xprt_want_recv(h2c->conn);
274 }
275
Willy Tarreau14398122017-09-22 14:26:04 +0200276 /* FIXME: we should in fact call something like h2_update_poll()
277 * now to recompte the polling. For now it will be enough like
278 * this.
279 */
Willy Tarreau14398122017-09-22 14:26:04 +0200280 return 1;
281 }
282 return 0;
283}
284
285static inline struct buffer *h2_get_mbuf(struct h2c *h2c)
286{
287 struct buffer *buf = NULL;
288
289 if (likely(LIST_ISEMPTY(&h2c->mbuf_wait.list)) &&
290 unlikely((buf = b_alloc_margin(&h2c->mbuf, 0)) == NULL)) {
291 h2c->mbuf_wait.target = h2c;
292 h2c->mbuf_wait.wakeup_cb = h2_mbuf_available;
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100293 HA_SPIN_LOCK(BUF_WQ_LOCK, &buffer_wq_lock);
Willy Tarreau14398122017-09-22 14:26:04 +0200294 LIST_ADDQ(&buffer_wq, &h2c->mbuf_wait.list);
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100295 HA_SPIN_UNLOCK(BUF_WQ_LOCK, &buffer_wq_lock);
Willy Tarreau14398122017-09-22 14:26:04 +0200296
297 /* FIXME: we should in fact only block the direction being
298 * currently used. For now it will be enough like this.
299 */
300 __conn_xprt_stop_send(h2c->conn);
301 __conn_xprt_stop_recv(h2c->conn);
302 }
303 return buf;
304}
305
306static inline void h2_release_mbuf(struct h2c *h2c)
307{
308 if (h2c->mbuf->size) {
309 b_free(&h2c->mbuf);
310 offer_buffers(h2c->mbuf_wait.target,
311 tasks_run_queue + applets_active_queue);
312 }
313}
314
Willy Tarreau35dbd5d2017-09-22 09:13:49 +0200315
Willy Tarreau62f52692017-10-08 23:01:42 +0200316/*****************************************************************/
317/* functions below are dedicated to the mux setup and management */
318/*****************************************************************/
319
Willy Tarreau32218eb2017-09-22 08:07:25 +0200320/* tries to initialize the inbound h2c mux. Returns < 0 in case of failure. */
321static int h2c_frt_init(struct connection *conn)
322{
323 struct h2c *h2c;
Willy Tarreauea392822017-10-31 10:02:25 +0100324 struct task *t = NULL;
325 struct session *sess = conn->owner;
Willy Tarreau32218eb2017-09-22 08:07:25 +0200326
327 h2c = pool_alloc2(pool2_h2c);
328 if (!h2c)
329 goto fail;
330
Willy Tarreau3f133572017-10-31 19:21:06 +0100331
332 h2c->timeout = sess->fe->timeout.client;
Willy Tarreau33400292017-11-05 11:23:40 +0100333 h2c->task = NULL;
Willy Tarreau3f133572017-10-31 19:21:06 +0100334 if (tick_isset(h2c->timeout)) {
335 t = task_new(tid_bit);
336 if (!t)
337 goto fail;
338
339 h2c->task = t;
340 t->process = h2_timeout_task;
341 t->context = h2c;
342 t->expire = tick_add(now_ms, h2c->timeout);
343 }
Willy Tarreauea392822017-10-31 10:02:25 +0100344
Willy Tarreau32218eb2017-09-22 08:07:25 +0200345 h2c->ddht = hpack_dht_alloc(h2_settings_header_table_size);
346 if (!h2c->ddht)
347 goto fail;
348
349 /* Initialise the context. */
350 h2c->st0 = H2_CS_PREFACE;
351 h2c->conn = conn;
352 h2c->max_id = -1;
353 h2c->errcode = H2_ERR_NO_ERROR;
354 h2c->flags = H2_CF_NONE;
355 h2c->rcvd_c = 0;
356 h2c->rcvd_s = 0;
357
358 h2c->dbuf = &buf_empty;
359 h2c->dsi = -1;
360 h2c->msi = -1;
361 h2c->last_sid = -1;
362
363 h2c->mbuf = &buf_empty;
364 h2c->miw = 65535; /* mux initial window size */
365 h2c->mws = 65535; /* mux window size */
366 h2c->mfs = 16384; /* initial max frame size */
367 h2c->streams_by_id = EB_ROOT_UNIQUE;
368 LIST_INIT(&h2c->send_list);
369 LIST_INIT(&h2c->fctl_list);
Willy Tarreau35dbd5d2017-09-22 09:13:49 +0200370 LIST_INIT(&h2c->dbuf_wait.list);
Willy Tarreau14398122017-09-22 14:26:04 +0200371 LIST_INIT(&h2c->mbuf_wait.list);
Willy Tarreau32218eb2017-09-22 08:07:25 +0200372 conn->mux_ctx = h2c;
373
Willy Tarreau3f133572017-10-31 19:21:06 +0100374 if (t)
375 task_queue(t);
Willy Tarreau32218eb2017-09-22 08:07:25 +0200376 conn_xprt_want_recv(conn);
Willy Tarreauea392822017-10-31 10:02:25 +0100377
Willy Tarreau32218eb2017-09-22 08:07:25 +0200378 /* mux->wake will be called soon to complete the operation */
379 return 0;
380 fail:
Willy Tarreauea392822017-10-31 10:02:25 +0100381 if (t)
382 task_free(t);
Willy Tarreau32218eb2017-09-22 08:07:25 +0200383 pool_free2(pool2_h2c, h2c);
384 return -1;
385}
386
Willy Tarreau62f52692017-10-08 23:01:42 +0200387/* Initialize the mux once it's attached. For outgoing connections, the context
388 * is already initialized before installing the mux, so we detect incoming
389 * connections from the fact that the context is still NULL. Returns < 0 on
390 * error.
391 */
392static int h2_init(struct connection *conn)
393{
394 if (conn->mux_ctx) {
395 /* we don't support outgoing connections for now */
396 return -1;
397 }
398
Willy Tarreau32218eb2017-09-22 08:07:25 +0200399 return h2c_frt_init(conn);
Willy Tarreau62f52692017-10-08 23:01:42 +0200400}
401
Willy Tarreau2373acc2017-10-12 17:35:14 +0200402/* returns the stream associated with id <id> or NULL if not found */
403static inline struct h2s *h2c_st_by_id(struct h2c *h2c, int id)
404{
405 struct eb32_node *node;
406
Willy Tarreau2a856182017-05-16 15:20:39 +0200407 if (id > h2c->max_id)
408 return (struct h2s *)h2_idle_stream;
409
Willy Tarreau2373acc2017-10-12 17:35:14 +0200410 node = eb32_lookup(&h2c->streams_by_id, id);
411 if (!node)
Willy Tarreau2a856182017-05-16 15:20:39 +0200412 return (struct h2s *)h2_closed_stream;
Willy Tarreau2373acc2017-10-12 17:35:14 +0200413
414 return container_of(node, struct h2s, by_id);
415}
416
Willy Tarreau62f52692017-10-08 23:01:42 +0200417/* release function for a connection. This one should be called to free all
418 * resources allocated to the mux.
419 */
420static void h2_release(struct connection *conn)
421{
Willy Tarreau32218eb2017-09-22 08:07:25 +0200422 struct h2c *h2c = conn->mux_ctx;
423
424 LIST_DEL(&conn->list);
425
426 if (h2c) {
427 hpack_dht_free(h2c->ddht);
Willy Tarreau35dbd5d2017-09-22 09:13:49 +0200428 h2_release_dbuf(h2c);
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100429 HA_SPIN_LOCK(BUF_WQ_LOCK, &buffer_wq_lock);
Willy Tarreau35dbd5d2017-09-22 09:13:49 +0200430 LIST_DEL(&h2c->dbuf_wait.list);
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100431 HA_SPIN_UNLOCK(BUF_WQ_LOCK, &buffer_wq_lock);
Willy Tarreau14398122017-09-22 14:26:04 +0200432
433 h2_release_mbuf(h2c);
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100434 HA_SPIN_LOCK(BUF_WQ_LOCK, &buffer_wq_lock);
Willy Tarreau14398122017-09-22 14:26:04 +0200435 LIST_DEL(&h2c->mbuf_wait.list);
Christopher Faulet2a944ee2017-11-07 10:42:54 +0100436 HA_SPIN_UNLOCK(BUF_WQ_LOCK, &buffer_wq_lock);
Willy Tarreau14398122017-09-22 14:26:04 +0200437
Willy Tarreauea392822017-10-31 10:02:25 +0100438 if (h2c->task) {
439 task_delete(h2c->task);
440 task_free(h2c->task);
441 h2c->task = NULL;
442 }
443
Willy Tarreau32218eb2017-09-22 08:07:25 +0200444 pool_free2(pool2_h2c, h2c);
445 }
446
447 conn->mux = NULL;
448 conn->mux_ctx = NULL;
449
450 conn_stop_tracking(conn);
451 conn_full_close(conn);
452 if (conn->destroy_cb)
453 conn->destroy_cb(conn);
454 conn_free(conn);
Willy Tarreau62f52692017-10-08 23:01:42 +0200455}
456
457
Willy Tarreau71681172017-10-23 14:39:06 +0200458/******************************************************/
459/* functions below are for the H2 protocol processing */
460/******************************************************/
461
462/* returns the stream if of stream <h2s> or 0 if <h2s> is NULL */
463static inline int h2s_id(const struct h2s *h2s)
464{
465 return h2s ? h2s->id : 0;
466}
467
Willy Tarreau5b5e6872017-09-25 16:17:25 +0200468/* returns true of the mux is currently busy as seen from stream <h2s> */
469static inline int h2c_mux_busy(const struct h2c *h2c, const struct h2s *h2s)
470{
471 if (h2c->msi < 0)
472 return 0;
473
474 if (h2c->msi == h2s_id(h2s))
475 return 0;
476
477 return 1;
478}
479
Willy Tarreau741d6df2017-10-17 08:00:59 +0200480/* marks an error on the connection */
481static inline void h2c_error(struct h2c *h2c, enum h2_err err)
482{
483 h2c->errcode = err;
484 h2c->st0 = H2_CS_ERROR;
485}
486
Willy Tarreau2e43f082017-10-17 08:03:59 +0200487/* marks an error on the stream */
488static inline void h2s_error(struct h2s *h2s, enum h2_err err)
489{
490 if (h2s->st > H2_SS_IDLE && h2s->st < H2_SS_ERROR) {
491 h2s->errcode = err;
492 h2s->st = H2_SS_ERROR;
493 if (h2s->cs)
494 h2s->cs->flags |= CS_FL_ERROR;
495 }
496}
497
Willy Tarreaue4820742017-07-27 13:37:23 +0200498/* writes the 24-bit frame size <len> at address <frame> */
499static inline void h2_set_frame_size(void *frame, uint32_t len)
500{
501 uint8_t *out = frame;
502
503 *out = len >> 16;
504 write_n16(out + 1, len);
505}
506
Willy Tarreau54c15062017-10-10 17:10:03 +0200507/* reads <bytes> bytes from buffer <b> starting at relative offset <o> from the
508 * current pointer, dealing with wrapping, and stores the result in <dst>. It's
509 * the caller's responsibility to verify that there are at least <bytes> bytes
510 * available in the buffer's input prior to calling this function.
511 */
512static inline void h2_get_buf_bytes(void *dst, size_t bytes,
513 const struct buffer *b, int o)
514{
515 readv_bytes(dst, bytes, b_ptr(b, o), b_end(b) - b_ptr(b, o), b->data);
516}
517
518static inline uint16_t h2_get_n16(const struct buffer *b, int o)
519{
520 return readv_n16(b_ptr(b, o), b_end(b) - b_ptr(b, o), b->data);
521}
522
523static inline uint32_t h2_get_n32(const struct buffer *b, int o)
524{
525 return readv_n32(b_ptr(b, o), b_end(b) - b_ptr(b, o), b->data);
526}
527
528static inline uint64_t h2_get_n64(const struct buffer *b, int o)
529{
530 return readv_n64(b_ptr(b, o), b_end(b) - b_ptr(b, o), b->data);
531}
532
533
Willy Tarreau715d5312017-07-11 15:20:24 +0200534/* Peeks an H2 frame header from buffer <b> into descriptor <h>. The algorithm
535 * is not obvious. It turns out that H2 headers are neither aligned nor do they
536 * use regular sizes. And to add to the trouble, the buffer may wrap so each
537 * byte read must be checked. The header is formed like this :
538 *
539 * b0 b1 b2 b3 b4 b5..b8
540 * +----------+---------+--------+----+----+----------------------+
541 * |len[23:16]|len[15:8]|len[7:0]|type|flag|sid[31:0] (big endian)|
542 * +----------+---------+--------+----+----+----------------------+
543 *
544 * Here we read a big-endian 64 bit word from h[1]. This way in a single read
545 * we get the sid properly aligned and ordered, and 16 bits of len properly
546 * ordered as well. The type and flags can be extracted using bit shifts from
547 * the word, and only one extra read is needed to fetch len[16:23].
548 * Returns zero if some bytes are missing, otherwise non-zero on success.
549 */
550static int h2_peek_frame_hdr(const struct buffer *b, struct h2_fh *h)
551{
552 uint64_t w;
553
554 if (b->i < 9)
555 return 0;
556
557 w = readv_n64(b_ptr(b,1), b_end(b) - b_ptr(b,1), b->data);
558 h->len = *b->p << 16;
559 h->sid = w & 0x7FFFFFFF; /* RFC7540#4.1: R bit must be ignored */
560 h->ff = w >> 32;
561 h->ft = w >> 40;
562 h->len += w >> 48;
563 return 1;
564}
565
566/* skip the next 9 bytes corresponding to the frame header possibly parsed by
567 * h2_peek_frame_hdr() above.
568 */
569static inline void h2_skip_frame_hdr(struct buffer *b)
570{
571 bi_del(b, 9);
572}
573
574/* same as above, automatically advances the buffer on success */
575static inline int h2_get_frame_hdr(struct buffer *b, struct h2_fh *h)
576{
577 int ret;
578
579 ret = h2_peek_frame_hdr(b, h);
580 if (ret > 0)
581 h2_skip_frame_hdr(b);
582 return ret;
583}
584
Willy Tarreau3ccf4b22017-10-13 19:07:26 +0200585/* creates a new stream <id> on the h2c connection and returns it, or NULL in
586 * case of memory allocation error.
587 */
588static struct h2s *h2c_stream_new(struct h2c *h2c, int id)
589{
590 struct conn_stream *cs;
591 struct h2s *h2s;
592
593 h2s = pool_alloc2(pool2_h2s);
594 if (!h2s)
595 goto out;
596
597 h2s->h2c = h2c;
598 h2s->mws = h2c->miw;
599 h2s->flags = H2_SF_NONE;
600 h2s->errcode = H2_ERR_NO_ERROR;
601 h2s->st = H2_SS_IDLE;
602 h1m_init(&h2s->req);
603 h1m_init(&h2s->res);
604 h2s->by_id.key = h2s->id = id;
605 h2c->max_id = id;
606 LIST_INIT(&h2s->list);
607
608 eb32_insert(&h2c->streams_by_id, &h2s->by_id);
609
610 cs = cs_new(h2c->conn);
611 if (!cs)
612 goto out_close;
613
614 h2s->cs = cs;
615 cs->ctx = h2s;
616
617 if (stream_create_from_cs(cs) < 0)
618 goto out_free_cs;
619
620 /* OK done, the stream lives its own life now */
621 return h2s;
622
623 out_free_cs:
624 cs_free(cs);
625 out_close:
626 eb32_delete(&h2s->by_id);
627 pool_free2(pool2_h2s, h2s);
628 h2s = NULL;
629 out:
630 return h2s;
631}
632
Willy Tarreaube5b7152017-09-25 16:25:39 +0200633/* try to send a settings frame on the connection. Returns > 0 on success, 0 if
634 * it couldn't do anything. It may return an error in h2c. See RFC7540#11.3 for
635 * the various settings codes.
636 */
637static int h2c_snd_settings(struct h2c *h2c)
638{
639 struct buffer *res;
640 char buf_data[100]; // enough for 15 settings
641 struct chunk buf;
642 int ret;
643
644 if (h2c_mux_busy(h2c, NULL)) {
645 h2c->flags |= H2_CF_DEM_MBUSY;
646 return 0;
647 }
648
649 res = h2_get_mbuf(h2c);
650 if (!res) {
651 h2c->flags |= H2_CF_MUX_MALLOC;
652 h2c->flags |= H2_CF_DEM_MROOM;
653 return 0;
654 }
655
656 chunk_init(&buf, buf_data, sizeof(buf_data));
657 chunk_memcpy(&buf,
658 "\x00\x00\x00" /* length : 0 for now */
659 "\x04\x00" /* type : 4 (settings), flags : 0 */
660 "\x00\x00\x00\x00", /* stream ID : 0 */
661 9);
662
663 if (h2_settings_header_table_size != 4096) {
664 char str[6] = "\x00\x01"; /* header_table_size */
665
666 write_n32(str + 2, h2_settings_header_table_size);
667 chunk_memcat(&buf, str, 6);
668 }
669
670 if (h2_settings_initial_window_size != 65535) {
671 char str[6] = "\x00\x04"; /* initial_window_size */
672
673 write_n32(str + 2, h2_settings_initial_window_size);
674 chunk_memcat(&buf, str, 6);
675 }
676
677 if (h2_settings_max_concurrent_streams != 0) {
678 char str[6] = "\x00\x03"; /* max_concurrent_streams */
679
680 /* Note: 0 means "unlimited" for haproxy's config but not for
681 * the protocol, so never send this value!
682 */
683 write_n32(str + 2, h2_settings_max_concurrent_streams);
684 chunk_memcat(&buf, str, 6);
685 }
686
687 if (global.tune.bufsize != 16384) {
688 char str[6] = "\x00\x05"; /* max_frame_size */
689
690 /* note: similarly we could also emit MAX_HEADER_LIST_SIZE to
691 * match bufsize - rewrite size, but at the moment it seems
692 * that clients don't take care of it.
693 */
694 write_n32(str + 2, global.tune.bufsize);
695 chunk_memcat(&buf, str, 6);
696 }
697
698 h2_set_frame_size(buf.str, buf.len - 9);
699 ret = bo_istput(res, ist2(buf.str, buf.len));
700 if (unlikely(ret <= 0)) {
701 if (!ret) {
702 h2c->flags |= H2_CF_MUX_MFULL;
703 h2c->flags |= H2_CF_DEM_MROOM;
704 return 0;
705 }
706 else {
707 h2c_error(h2c, H2_ERR_INTERNAL_ERROR);
708 return 0;
709 }
710 }
711 return ret;
712}
713
Willy Tarreau52eed752017-09-22 15:05:09 +0200714/* Try to receive a connection preface, then upon success try to send our
715 * preface which is a SETTINGS frame. Returns > 0 on success or zero on
716 * missing data. It may return an error in h2c.
717 */
718static int h2c_frt_recv_preface(struct h2c *h2c)
719{
720 int ret1;
Willy Tarreaube5b7152017-09-25 16:25:39 +0200721 int ret2;
Willy Tarreau52eed752017-09-22 15:05:09 +0200722
723 ret1 = b_isteq(h2c->dbuf, 0, h2c->dbuf->i, ist(H2_CONN_PREFACE));
724
725 if (unlikely(ret1 <= 0)) {
726 if (ret1 < 0 || conn_xprt_read0_pending(h2c->conn))
727 h2c_error(h2c, H2_ERR_PROTOCOL_ERROR);
728 return 0;
729 }
730
Willy Tarreaube5b7152017-09-25 16:25:39 +0200731 ret2 = h2c_snd_settings(h2c);
732 if (ret2 > 0)
733 bi_del(h2c->dbuf, ret1);
Willy Tarreau52eed752017-09-22 15:05:09 +0200734
Willy Tarreaube5b7152017-09-25 16:25:39 +0200735 return ret2;
Willy Tarreau52eed752017-09-22 15:05:09 +0200736}
737
Willy Tarreau081d4722017-05-16 21:51:05 +0200738/* try to send a GOAWAY frame on the connection to report an error or a graceful
739 * shutdown, with h2c->errcode as the error code. Returns > 0 on success or zero
740 * if nothing was done. It uses h2c->last_sid as the advertised ID, or copies it
741 * from h2c->max_id if it's not set yet (<0). In case of lack of room to write
742 * the message, it subscribes the requester (either <h2s> or <h2c>) to future
743 * notifications. It sets H2_CF_GOAWAY_SENT on success, and H2_CF_GOAWAY_FAILED
744 * on unrecoverable failure. It will not attempt to send one again in this last
745 * case so that it is safe to use h2c_error() to report such errors.
746 */
747static int h2c_send_goaway_error(struct h2c *h2c, struct h2s *h2s)
748{
749 struct buffer *res;
750 char str[17];
751 int ret;
752
753 if (h2c->flags & H2_CF_GOAWAY_FAILED)
754 return 1; // claim that it worked
755
756 if (h2c_mux_busy(h2c, h2s)) {
757 if (h2s)
758 h2s->flags |= H2_SF_BLK_MBUSY;
759 else
760 h2c->flags |= H2_CF_DEM_MBUSY;
761 return 0;
762 }
763
764 res = h2_get_mbuf(h2c);
765 if (!res) {
766 h2c->flags |= H2_CF_MUX_MALLOC;
767 if (h2s)
768 h2s->flags |= H2_SF_BLK_MROOM;
769 else
770 h2c->flags |= H2_CF_DEM_MROOM;
771 return 0;
772 }
773
774 /* len: 8, type: 7, flags: none, sid: 0 */
775 memcpy(str, "\x00\x00\x08\x07\x00\x00\x00\x00\x00", 9);
776
777 if (h2c->last_sid < 0)
778 h2c->last_sid = h2c->max_id;
779
780 write_n32(str + 9, h2c->last_sid);
781 write_n32(str + 13, h2c->errcode);
782 ret = bo_istput(res, ist2(str, 17));
783 if (unlikely(ret <= 0)) {
784 if (!ret) {
785 h2c->flags |= H2_CF_MUX_MFULL;
786 if (h2s)
787 h2s->flags |= H2_SF_BLK_MROOM;
788 else
789 h2c->flags |= H2_CF_DEM_MROOM;
790 return 0;
791 }
792 else {
793 /* we cannot report this error using GOAWAY, so we mark
794 * it and claim a success.
795 */
796 h2c_error(h2c, H2_ERR_INTERNAL_ERROR);
797 h2c->flags |= H2_CF_GOAWAY_FAILED;
798 return 1;
799 }
800 }
801 h2c->flags |= H2_CF_GOAWAY_SENT;
802 return ret;
803}
804
Willy Tarreau27a84c92017-10-17 08:10:17 +0200805/* try to send an RST_STREAM frame on the connection for the current demuxed
806 * stream to report an error, with h2s->errcode as the error code. Returns > 0
807 * on success or zero if nothing was done. It uses h2c->dsi as the stream ID
808 * and h2s->errcode for the error code. In case of lack of room to write the
809 * message, it subscribes the requester (either <h2s> or <h2c>) to future
810 * notifications. It's worth mentionning that an RST may even be sent for a
811 * closed stream with error 0 in this case.
812 */
813static int h2c_send_rst_stream(struct h2c *h2c, struct h2s *h2s)
814{
815 struct buffer *res;
816 char str[13];
817 int ret;
818
819 if (h2c_mux_busy(h2c, h2s)) {
820 if (h2s)
821 h2s->flags |= H2_SF_BLK_MBUSY;
822 else
823 h2c->flags |= H2_CF_DEM_MBUSY;
824 return 0;
825 }
826
827 res = h2_get_mbuf(h2c);
828 if (!res) {
829 h2c->flags |= H2_CF_MUX_MALLOC;
830 if (h2s)
831 h2s->flags |= H2_SF_BLK_MROOM;
832 else
833 h2c->flags |= H2_CF_DEM_MROOM;
834 return 0;
835 }
836
837 /* len: 4, type: 3, flags: none */
838 memcpy(str, "\x00\x00\x04\x03\x00", 5);
839 write_n32(str + 5, h2c->dsi);
Willy Tarreau721c9742017-11-07 11:05:42 +0100840 write_n32(str + 9, (h2s->st > H2_SS_IDLE && h2s->st < H2_SS_CLOSED) ?
Willy Tarreau27a84c92017-10-17 08:10:17 +0200841 h2s->errcode : H2_ERR_STREAM_CLOSED);
842 ret = bo_istput(res, ist2(str, 13));
843 if (unlikely(ret <= 0)) {
844 if (!ret) {
845 h2c->flags |= H2_CF_MUX_MFULL;
846 if (h2s)
847 h2s->flags |= H2_SF_BLK_MROOM;
848 else
849 h2c->flags |= H2_CF_DEM_MROOM;
850 return 0;
851 }
852 else {
853 h2c_error(h2c, H2_ERR_INTERNAL_ERROR);
854 return 0;
855 }
856 }
857
858 if (h2s)
859 h2s->flags |= H2_SF_RST_SENT;
860 return ret;
861}
862
Willy Tarreauc7576ea2017-10-29 22:00:09 +0100863/* try to send an empty DATA frame with the ES flag set to notify about the
864 * end of stream and match a shutdown(write). If an ES was already sent as
865 * indicated by HLOC/ERROR/RESET/CLOSED states, nothing is done. Returns > 0
866 * on success or zero if nothing was done. In case of lack of room to write the
867 * message, it subscribes the requesting stream to future notifications.
868 */
869static int h2_send_empty_data_es(struct h2s *h2s)
870{
871 struct h2c *h2c = h2s->h2c;
872 struct buffer *res;
873 char str[9];
874 int ret;
875
Willy Tarreau721c9742017-11-07 11:05:42 +0100876 if (h2s->st == H2_SS_HLOC || h2s->st == H2_SS_ERROR || h2s->st == H2_SS_CLOSED)
Willy Tarreauc7576ea2017-10-29 22:00:09 +0100877 return 1;
878
879 if (h2c_mux_busy(h2c, h2s)) {
880 h2s->flags |= H2_SF_BLK_MBUSY;
881 return 0;
882 }
883
884 res = h2_get_mbuf(h2c);
885 if (!res) {
886 h2c->flags |= H2_CF_MUX_MALLOC;
887 h2s->flags |= H2_SF_BLK_MROOM;
888 return 0;
889 }
890
891 /* len: 0x000000, type: 0(DATA), flags: ES=1 */
892 memcpy(str, "\x00\x00\x00\x00\x01", 5);
893 write_n32(str + 5, h2s->id);
894 ret = bo_istput(res, ist2(str, 9));
Willy Tarreau6d8b6822017-11-07 14:39:09 +0100895 if (likely(ret > 0)) {
896 h2s->flags |= H2_SF_ES_SENT;
897 }
898 else if (!ret) {
899 h2c->flags |= H2_CF_MUX_MFULL;
900 h2s->flags |= H2_SF_BLK_MROOM;
901 return 0;
902 }
903 else {
904 h2c_error(h2c, H2_ERR_INTERNAL_ERROR);
905 return 0;
Willy Tarreauc7576ea2017-10-29 22:00:09 +0100906 }
907 return ret;
908}
909
Willy Tarreau23b92aa2017-10-30 00:26:54 +0100910/* wake the streams attached to the connection, whose id is greater than <last>,
911 * and assign their conn_stream the CS_FL_* flags <flags> in addition to
912 * CS_FL_ERROR in case of error and CS_FL_EOS in case of closed connection. The
913 * stream's state is automatically updated accordingly.
914 */
915static void h2_wake_some_streams(struct h2c *h2c, int last, uint32_t flags)
916{
917 struct eb32_node *node;
918 struct h2s *h2s;
919
920 if (h2c->st0 >= H2_CS_ERROR || h2c->conn->flags & CO_FL_ERROR)
921 flags |= CS_FL_ERROR;
922
923 if (conn_xprt_read0_pending(h2c->conn))
924 flags |= CS_FL_EOS;
925
926 node = eb32_lookup_ge(&h2c->streams_by_id, last + 1);
927 while (node) {
928 h2s = container_of(node, struct h2s, by_id);
929 if (h2s->id <= last)
930 break;
931 node = eb32_next(node);
932 if (h2s->cs) {
933 h2s->cs->flags |= flags;
934 /* recv is used to force to detect CS_FL_EOS that wake()
935 * doesn't handle in the stream int code.
936 */
937 h2s->cs->data_cb->recv(h2s->cs);
938 h2s->cs->data_cb->wake(h2s->cs);
939 }
940 if (flags & CS_FL_ERROR && h2s->st < H2_SS_ERROR)
941 h2s->st = H2_SS_ERROR;
942 else if (flags & CS_FL_EOS && h2s->st == H2_SS_OPEN)
943 h2s->st = H2_SS_HREM;
944 else if (flags & CS_FL_EOS && h2s->st == H2_SS_HLOC)
945 h2s->st = H2_SS_CLOSED;
946 }
947}
948
Willy Tarreau3421aba2017-07-27 15:41:03 +0200949/* Increase all streams' outgoing window size by the difference passed in
950 * argument. This is needed upon receipt of the settings frame if the initial
951 * window size is different. The difference may be negative and the resulting
952 * window size as well, for the time it takes to receive some window updates.
953 */
954static void h2c_update_all_ws(struct h2c *h2c, int diff)
955{
956 struct h2s *h2s;
957 struct eb32_node *node;
958
959 if (!diff)
960 return;
961
962 node = eb32_first(&h2c->streams_by_id);
963 while (node) {
964 h2s = container_of(node, struct h2s, by_id);
965 h2s->mws += diff;
966 node = eb32_next(node);
967 }
968}
969
970/* processes a SETTINGS frame whose payload is <payload> for <plen> bytes, and
971 * ACKs it if needed. Returns > 0 on success or zero on missing data. It may
972 * return an error in h2c. Described in RFC7540#6.5.
973 */
974static int h2c_handle_settings(struct h2c *h2c)
975{
976 unsigned int offset;
977 int error;
978
979 if (h2c->dff & H2_F_SETTINGS_ACK) {
980 if (h2c->dfl) {
981 error = H2_ERR_FRAME_SIZE_ERROR;
982 goto fail;
983 }
984 return 1;
985 }
986
987 if (h2c->dsi != 0) {
988 error = H2_ERR_PROTOCOL_ERROR;
989 goto fail;
990 }
991
992 if (h2c->dfl % 6) {
993 error = H2_ERR_FRAME_SIZE_ERROR;
994 goto fail;
995 }
996
997 /* that's the limit we can process */
998 if (h2c->dfl > global.tune.bufsize) {
999 error = H2_ERR_FRAME_SIZE_ERROR;
1000 goto fail;
1001 }
1002
1003 /* process full frame only */
1004 if (h2c->dbuf->i < h2c->dfl)
1005 return 0;
1006
1007 /* parse the frame */
1008 for (offset = 0; offset < h2c->dfl; offset += 6) {
1009 uint16_t type = h2_get_n16(h2c->dbuf, offset);
1010 int32_t arg = h2_get_n32(h2c->dbuf, offset + 2);
1011
1012 switch (type) {
1013 case H2_SETTINGS_INITIAL_WINDOW_SIZE:
1014 /* we need to update all existing streams with the
1015 * difference from the previous iws.
1016 */
1017 if (arg < 0) { // RFC7540#6.5.2
1018 error = H2_ERR_FLOW_CONTROL_ERROR;
1019 goto fail;
1020 }
1021 h2c_update_all_ws(h2c, arg - h2c->miw);
1022 h2c->miw = arg;
1023 break;
1024 case H2_SETTINGS_MAX_FRAME_SIZE:
1025 if (arg < 16384 || arg > 16777215) { // RFC7540#6.5.2
1026 error = H2_ERR_PROTOCOL_ERROR;
1027 goto fail;
1028 }
1029 h2c->mfs = arg;
1030 break;
1031 }
1032 }
1033
1034 /* need to ACK this frame now */
1035 h2c->st0 = H2_CS_FRAME_A;
1036 return 1;
1037 fail:
1038 h2c_error(h2c, error);
1039 return 0;
1040}
1041
1042/* try to send an ACK for a settings frame on the connection. Returns > 0 on
1043 * success or one of the h2_status values.
1044 */
1045static int h2c_ack_settings(struct h2c *h2c)
1046{
1047 struct buffer *res;
1048 char str[9];
1049 int ret = -1;
1050
1051 if (h2c_mux_busy(h2c, NULL)) {
1052 h2c->flags |= H2_CF_DEM_MBUSY;
1053 return 0;
1054 }
1055
1056 res = h2_get_mbuf(h2c);
1057 if (!res) {
1058 h2c->flags |= H2_CF_MUX_MALLOC;
1059 h2c->flags |= H2_CF_DEM_MROOM;
1060 return 0;
1061 }
1062
1063 memcpy(str,
1064 "\x00\x00\x00" /* length : 0 (no data) */
1065 "\x04" "\x01" /* type : 4, flags : ACK */
1066 "\x00\x00\x00\x00" /* stream ID */, 9);
1067
1068 ret = bo_istput(res, ist2(str, 9));
1069 if (unlikely(ret <= 0)) {
1070 if (!ret) {
1071 h2c->flags |= H2_CF_MUX_MFULL;
1072 h2c->flags |= H2_CF_DEM_MROOM;
1073 return 0;
1074 }
1075 else {
1076 h2c_error(h2c, H2_ERR_INTERNAL_ERROR);
1077 return 0;
1078 }
1079 }
1080 return ret;
1081}
1082
Willy Tarreaucf68c782017-10-10 17:11:41 +02001083/* processes a PING frame and schedules an ACK if needed. The caller must pass
1084 * the pointer to the payload in <payload>. Returns > 0 on success or zero on
1085 * missing data. It may return an error in h2c.
1086 */
1087static int h2c_handle_ping(struct h2c *h2c)
1088{
1089 /* frame length must be exactly 8 */
1090 if (h2c->dfl != 8) {
1091 h2c_error(h2c, H2_ERR_FRAME_SIZE_ERROR);
1092 return 0;
1093 }
1094
1095 /* schedule a response */
1096 if (!(h2c->dft & H2_F_PING_ACK))
1097 h2c->st0 = H2_CS_FRAME_A;
1098 return 1;
1099}
1100
Willy Tarreaucc0b8c32017-10-26 16:55:59 +02001101/* Try to send a window update for stream id <sid> and value <increment>.
1102 * Returns > 0 on success or zero on missing room or failure. It may return an
1103 * error in h2c.
1104 */
1105static int h2c_send_window_update(struct h2c *h2c, int sid, uint32_t increment)
1106{
1107 struct buffer *res;
1108 char str[13];
1109 int ret = -1;
1110
1111 if (h2c_mux_busy(h2c, NULL)) {
1112 h2c->flags |= H2_CF_DEM_MBUSY;
1113 return 0;
1114 }
1115
1116 res = h2_get_mbuf(h2c);
1117 if (!res) {
1118 h2c->flags |= H2_CF_MUX_MALLOC;
1119 h2c->flags |= H2_CF_DEM_MROOM;
1120 return 0;
1121 }
1122
1123 /* length: 4, type: 8, flags: none */
1124 memcpy(str, "\x00\x00\x04\x08\x00", 5);
1125 write_n32(str + 5, sid);
1126 write_n32(str + 9, increment);
1127
1128 ret = bo_istput(res, ist2(str, 13));
1129
1130 if (unlikely(ret <= 0)) {
1131 if (!ret) {
1132 h2c->flags |= H2_CF_MUX_MFULL;
1133 h2c->flags |= H2_CF_DEM_MROOM;
1134 return 0;
1135 }
1136 else {
1137 h2c_error(h2c, H2_ERR_INTERNAL_ERROR);
1138 return 0;
1139 }
1140 }
1141 return ret;
1142}
1143
1144/* try to send pending window update for the connection. It's safe to call it
1145 * with no pending updates. Returns > 0 on success or zero on missing room or
1146 * failure. It may return an error in h2c.
1147 */
1148static int h2c_send_conn_wu(struct h2c *h2c)
1149{
1150 int ret = 1;
1151
1152 if (h2c->rcvd_c <= 0)
1153 return 1;
1154
1155 /* send WU for the connection */
1156 ret = h2c_send_window_update(h2c, 0, h2c->rcvd_c);
1157 if (ret > 0)
1158 h2c->rcvd_c = 0;
1159
1160 return ret;
1161}
1162
1163/* try to send pending window update for the current dmux stream. It's safe to
1164 * call it with no pending updates. Returns > 0 on success or zero on missing
1165 * room or failure. It may return an error in h2c.
1166 */
1167static int h2c_send_strm_wu(struct h2c *h2c)
1168{
1169 int ret = 1;
1170
1171 if (h2c->rcvd_s <= 0)
1172 return 1;
1173
1174 /* send WU for the stream */
1175 ret = h2c_send_window_update(h2c, h2c->dsi, h2c->rcvd_s);
1176 if (ret > 0)
1177 h2c->rcvd_s = 0;
1178
1179 return ret;
1180}
1181
Willy Tarreaucf68c782017-10-10 17:11:41 +02001182/* try to send an ACK for a ping frame on the connection. Returns > 0 on
1183 * success, 0 on missing data or one of the h2_status values.
1184 */
1185static int h2c_ack_ping(struct h2c *h2c)
1186{
1187 struct buffer *res;
1188 char str[17];
1189 int ret = -1;
1190
1191 if (h2c->dbuf->i < 8)
1192 return 0;
1193
1194 if (h2c_mux_busy(h2c, NULL)) {
1195 h2c->flags |= H2_CF_DEM_MBUSY;
1196 return 0;
1197 }
1198
1199 res = h2_get_mbuf(h2c);
1200 if (!res) {
1201 h2c->flags |= H2_CF_MUX_MALLOC;
1202 h2c->flags |= H2_CF_DEM_MROOM;
1203 return 0;
1204 }
1205
1206 memcpy(str,
1207 "\x00\x00\x08" /* length : 8 (same payload) */
1208 "\x06" "\x01" /* type : 6, flags : ACK */
1209 "\x00\x00\x00\x00" /* stream ID */, 9);
1210
1211 /* copy the original payload */
1212 h2_get_buf_bytes(str + 9, 8, h2c->dbuf, 0);
1213
1214 ret = bo_istput(res, ist2(str, 17));
1215 if (unlikely(ret <= 0)) {
1216 if (!ret) {
1217 h2c->flags |= H2_CF_MUX_MFULL;
1218 h2c->flags |= H2_CF_DEM_MROOM;
1219 return 0;
1220 }
1221 else {
1222 h2c_error(h2c, H2_ERR_INTERNAL_ERROR);
1223 return 0;
1224 }
1225 }
1226 return ret;
1227}
1228
Willy Tarreau26f95952017-07-27 17:18:30 +02001229/* processes a WINDOW_UPDATE frame whose payload is <payload> for <plen> bytes.
1230 * Returns > 0 on success or zero on missing data. It may return an error in
1231 * h2c or h2s. Described in RFC7540#6.9.
1232 */
1233static int h2c_handle_window_update(struct h2c *h2c, struct h2s *h2s)
1234{
1235 int32_t inc;
1236 int error;
1237
1238 if (h2c->dfl != 4) {
1239 error = H2_ERR_FRAME_SIZE_ERROR;
1240 goto conn_err;
1241 }
1242
1243 /* process full frame only */
1244 if (h2c->dbuf->i < h2c->dfl)
1245 return 0;
1246
1247 inc = h2_get_n32(h2c->dbuf, 0);
1248
1249 if (h2c->dsi != 0) {
1250 /* stream window update */
Willy Tarreau26f95952017-07-27 17:18:30 +02001251
1252 /* it's not an error to receive WU on a closed stream */
1253 if (h2s->st == H2_SS_CLOSED)
1254 return 1;
1255
1256 if (!inc) {
1257 error = H2_ERR_PROTOCOL_ERROR;
1258 goto strm_err;
1259 }
1260
1261 if (h2s->mws >= 0 && h2s->mws + inc < 0) {
1262 error = H2_ERR_FLOW_CONTROL_ERROR;
1263 goto strm_err;
1264 }
1265
1266 h2s->mws += inc;
1267 if (h2s->mws > 0 && (h2s->flags & H2_SF_BLK_SFCTL)) {
1268 h2s->flags &= ~H2_SF_BLK_SFCTL;
1269 if (h2s->cs && LIST_ISEMPTY(&h2s->list) &&
1270 (h2s->cs->flags & CS_FL_DATA_WR_ENA)) {
1271 /* This stream wanted to send but could not due to its
1272 * own flow control. We can put it back into the send
1273 * list now, it will be handled upon next send() call.
1274 */
1275 LIST_ADDQ(&h2c->send_list, &h2s->list);
1276 }
1277 }
1278 }
1279 else {
1280 /* connection window update */
1281 if (!inc) {
1282 error = H2_ERR_PROTOCOL_ERROR;
1283 goto conn_err;
1284 }
1285
1286 if (h2c->mws >= 0 && h2c->mws + inc < 0) {
1287 error = H2_ERR_FLOW_CONTROL_ERROR;
1288 goto conn_err;
1289 }
1290
1291 h2c->mws += inc;
1292 }
1293
1294 return 1;
1295
1296 conn_err:
1297 h2c_error(h2c, error);
1298 return 0;
1299
1300 strm_err:
1301 if (h2s) {
1302 h2s_error(h2s, error);
1303 h2c->st0 = H2_CS_FRAME_A;
1304 }
1305 else
1306 h2c_error(h2c, error);
1307 return 0;
1308}
1309
Willy Tarreaue96b0922017-10-30 00:28:29 +01001310/* processes a GOAWAY frame, and signals all streams whose ID is greater than
1311 * the last ID. Returns > 0 on success or zero on missing data. It may return
1312 * an error in h2c. Described in RFC7540#6.8.
1313 */
1314static int h2c_handle_goaway(struct h2c *h2c)
1315{
1316 int error;
1317 int last;
1318
1319 if (h2c->dsi != 0) {
1320 error = H2_ERR_PROTOCOL_ERROR;
1321 goto conn_err;
1322 }
1323
1324 if (h2c->dfl < 8) {
1325 error = H2_ERR_FRAME_SIZE_ERROR;
1326 goto conn_err;
1327 }
1328
1329 /* process full frame only */
1330 if (h2c->dbuf->i < h2c->dfl)
1331 return 0;
1332
1333 last = h2_get_n32(h2c->dbuf, 0);
1334 h2c->errcode = h2_get_n32(h2c->dbuf, 4);
1335 h2_wake_some_streams(h2c, last, CS_FL_ERROR);
1336 return 1;
1337
1338 conn_err:
1339 h2c_error(h2c, error);
1340 return 0;
1341}
1342
Willy Tarreaucd234e92017-08-18 10:59:39 +02001343/* processes an RST_STREAM frame, and sets the 32-bit error code on the stream.
1344 * Returns > 0 on success or zero on missing data. It may return an error in
1345 * h2c. Described in RFC7540#6.4.
1346 */
1347static int h2c_handle_rst_stream(struct h2c *h2c, struct h2s *h2s)
1348{
1349 int error;
1350
1351 if (h2c->dsi == 0) {
1352 error = H2_ERR_PROTOCOL_ERROR;
1353 goto conn_err;
1354 }
1355
Willy Tarreaucd234e92017-08-18 10:59:39 +02001356 if (h2c->dfl != 4) {
1357 error = H2_ERR_FRAME_SIZE_ERROR;
1358 goto conn_err;
1359 }
1360
1361 /* process full frame only */
1362 if (h2c->dbuf->i < h2c->dfl)
1363 return 0;
1364
1365 /* late RST, already handled */
1366 if (h2s->st == H2_SS_CLOSED)
1367 return 1;
1368
1369 h2s->errcode = h2_get_n32(h2c->dbuf, 0);
1370 h2s->st = H2_SS_CLOSED;
1371
1372 if (h2s->cs) {
1373 h2s->cs->flags |= CS_FL_EOS;
1374 /* recv is used to force to detect CS_FL_EOS that wake()
1375 * doesn't handle in the stream-int code.
1376 */
1377 h2s->cs->data_cb->recv(h2s->cs);
1378 h2s->cs->data_cb->wake(h2s->cs);
1379 }
1380
1381 h2s->flags |= H2_SF_RST_RCVD;
1382 return 1;
1383
1384 conn_err:
1385 h2c_error(h2c, error);
1386 return 0;
1387}
1388
Willy Tarreau13278b42017-10-13 19:23:14 +02001389/* processes a HEADERS frame. Returns > 0 on success or zero on missing data.
1390 * It may return an error in h2c or h2s. Described in RFC7540#6.2. Most of the
1391 * errors here are reported as connection errors since it's impossible to
1392 * recover from such errors after the compression context has been altered.
1393 */
1394static int h2c_frt_handle_headers(struct h2c *h2c, struct h2s *h2s)
1395{
1396 int error;
1397
1398 if (!h2c->dfl) {
1399 error = H2_ERR_PROTOCOL_ERROR; // empty headers frame!
1400 goto strm_err;
1401 }
1402
1403 if (!h2c->dbuf->size)
1404 return 0; // empty buffer
1405
1406 if (h2c->dbuf->i < h2c->dfl && h2c->dbuf->i < h2c->dbuf->size)
1407 return 0; // incomplete frame
1408
1409 /* now either the frame is complete or the buffer is complete */
1410 if (h2s->st != H2_SS_IDLE) {
1411 /* FIXME: stream already exists, this is only allowed for
1412 * trailers (not supported for now).
1413 */
1414 error = H2_ERR_PROTOCOL_ERROR;
1415 goto conn_err;
1416 }
1417 else if (h2c->dsi <= h2c->max_id || !(h2c->dsi & 1)) {
1418 /* RFC7540#5.1.1 stream id > prev ones, and must be odd here */
1419 error = H2_ERR_PROTOCOL_ERROR;
1420 goto conn_err;
1421 }
1422
1423 h2s = h2c_stream_new(h2c, h2c->dsi);
1424 if (!h2s) {
1425 error = H2_ERR_INTERNAL_ERROR;
1426 goto conn_err;
1427 }
1428
1429 h2s->st = H2_SS_OPEN;
1430 if (h2c->dff & H2_F_HEADERS_END_STREAM) {
1431 h2s->st = H2_SS_HREM;
1432 h2s->flags |= H2_SF_ES_RCVD;
1433 }
1434
1435 /* call the upper layers to process the frame, then let the upper layer
1436 * notify the stream about any change.
1437 */
1438 h2s->cs->data_cb->recv(h2s->cs);
1439
1440 if (h2s->cs->data_cb->wake(h2s->cs) < 0) {
1441 /* FIXME: cs has already been destroyed, but we have to kill h2s. */
1442 error = H2_ERR_INTERNAL_ERROR;
1443 goto conn_err;
1444 }
1445
Willy Tarreau721c9742017-11-07 11:05:42 +01001446 if (h2s->st >= H2_SS_ERROR) {
Willy Tarreau13278b42017-10-13 19:23:14 +02001447 /* stream error : send RST_STREAM */
1448 h2c->st0 = H2_CS_FRAME_A;
1449 }
1450 else {
1451 /* update the max stream ID if the request is being processed */
1452 if (h2s->id > h2c->max_id)
1453 h2c->max_id = h2s->id;
1454 }
1455
1456 return 1;
1457
1458 conn_err:
1459 h2c_error(h2c, error);
1460 return 0;
1461
1462 strm_err:
1463 if (h2s) {
1464 h2s_error(h2s, error);
1465 h2c->st0 = H2_CS_FRAME_A;
1466 }
1467 else
1468 h2c_error(h2c, error);
1469 return 0;
1470}
1471
Willy Tarreau454f9052017-10-26 19:40:35 +02001472/* processes a DATA frame. Returns > 0 on success or zero on missing data.
1473 * It may return an error in h2c or h2s. Described in RFC7540#6.1.
1474 */
1475static int h2c_frt_handle_data(struct h2c *h2c, struct h2s *h2s)
1476{
1477 int error;
1478
1479 /* note that empty DATA frames are perfectly valid and sometimes used
1480 * to signal an end of stream (with the ES flag).
1481 */
1482
1483 if (!h2c->dbuf->size && h2c->dfl)
1484 return 0; // empty buffer
1485
1486 if (h2c->dbuf->i < h2c->dfl && h2c->dbuf->i < h2c->dbuf->size)
1487 return 0; // incomplete frame
1488
1489 /* now either the frame is complete or the buffer is complete */
1490
1491 if (!h2c->dsi) {
1492 /* RFC7540#6.1 */
1493 error = H2_ERR_PROTOCOL_ERROR;
1494 goto conn_err;
1495 }
1496
1497 if (h2s->st != H2_SS_OPEN && h2s->st != H2_SS_HLOC) {
1498 /* RFC7540#6.1 */
1499 error = H2_ERR_STREAM_CLOSED;
1500 goto strm_err;
1501 }
1502
1503 /* last frame */
1504 if (h2c->dff & H2_F_HEADERS_END_STREAM) {
1505 h2s->st = H2_SS_HREM;
1506 h2s->flags |= H2_SF_ES_RCVD;
1507 }
1508
1509 /* call the upper layers to process the frame, then let the upper layer
1510 * notify the stream about any change.
1511 */
1512 if (!h2s->cs) {
1513 error = H2_ERR_STREAM_CLOSED;
1514 goto strm_err;
1515 }
1516
1517 h2s->cs->data_cb->recv(h2s->cs);
1518 if (h2s->cs->data_cb->wake(h2s->cs) < 0) {
1519 /* cs has just been destroyed, we have to kill h2s. */
1520 error = H2_ERR_STREAM_CLOSED;
1521 goto strm_err;
1522 }
1523
Willy Tarreau721c9742017-11-07 11:05:42 +01001524 if (h2s->st >= H2_SS_ERROR) {
Willy Tarreau454f9052017-10-26 19:40:35 +02001525 /* stream error : send RST_STREAM */
1526 h2c->st0 = H2_CS_FRAME_A;
1527 }
1528
1529 /* check for completion : the callee will change this to FRAME_A or
1530 * FRAME_H once done.
1531 */
1532 if (h2c->st0 == H2_CS_FRAME_P)
1533 return 0;
1534
1535 return 1;
1536
1537 conn_err:
1538 h2c_error(h2c, error);
1539 return 0;
1540
1541 strm_err:
1542 if (h2s) {
1543 h2s_error(h2s, error);
1544 h2c->st0 = H2_CS_FRAME_A;
1545 }
1546 else
1547 h2c_error(h2c, error);
1548 return 0;
1549}
1550
Willy Tarreaubc933932017-10-09 16:21:43 +02001551/* process Rx frames to be demultiplexed */
1552static void h2_process_demux(struct h2c *h2c)
1553{
Willy Tarreauf3ee0692017-10-17 08:18:25 +02001554 struct h2s *h2s;
1555
Willy Tarreau081d4722017-05-16 21:51:05 +02001556 if (h2c->st0 >= H2_CS_ERROR)
1557 return;
Willy Tarreau52eed752017-09-22 15:05:09 +02001558
1559 if (unlikely(h2c->st0 < H2_CS_FRAME_H)) {
1560 if (h2c->st0 == H2_CS_PREFACE) {
1561 if (unlikely(h2c_frt_recv_preface(h2c) <= 0)) {
1562 /* RFC7540#3.5: a GOAWAY frame MAY be omitted */
1563 if (h2c->st0 == H2_CS_ERROR)
1564 h2c->st0 = H2_CS_ERROR2;
1565 goto fail;
1566 }
1567
1568 h2c->max_id = 0;
1569 h2c->st0 = H2_CS_SETTINGS1;
1570 }
Willy Tarreau4c3690b2017-10-10 15:16:55 +02001571
1572 if (h2c->st0 == H2_CS_SETTINGS1) {
1573 struct h2_fh hdr;
1574
1575 /* ensure that what is pending is a valid SETTINGS frame
1576 * without an ACK.
1577 */
1578 if (!h2_get_frame_hdr(h2c->dbuf, &hdr)) {
1579 /* RFC7540#3.5: a GOAWAY frame MAY be omitted */
1580 if (h2c->st0 == H2_CS_ERROR)
1581 h2c->st0 = H2_CS_ERROR2;
1582 goto fail;
1583 }
1584
1585 if (hdr.sid || hdr.ft != H2_FT_SETTINGS || hdr.ff & H2_F_SETTINGS_ACK) {
1586 /* RFC7540#3.5: a GOAWAY frame MAY be omitted */
1587 h2c_error(h2c, H2_ERR_PROTOCOL_ERROR);
1588 h2c->st0 = H2_CS_ERROR2;
1589 goto fail;
1590 }
1591
1592 if ((int)hdr.len < 0 || (int)hdr.len > h2c->mfs) {
1593 /* RFC7540#3.5: a GOAWAY frame MAY be omitted */
1594 h2c_error(h2c, H2_ERR_FRAME_SIZE_ERROR);
1595 h2c->st0 = H2_CS_ERROR2;
1596 goto fail;
1597 }
1598
1599 /* that's OK, switch to FRAME_P to process it */
1600 h2c->dfl = hdr.len;
1601 h2c->dsi = hdr.sid;
1602 h2c->dft = hdr.ft;
1603 h2c->dff = hdr.ff;
1604 h2c->st0 = H2_CS_FRAME_P;
1605 }
Willy Tarreau52eed752017-09-22 15:05:09 +02001606 }
Willy Tarreau7e98c052017-10-10 15:56:59 +02001607
1608 /* process as many incoming frames as possible below */
1609 while (h2c->dbuf->i) {
1610 int ret = 0;
1611
1612 if (h2c->st0 >= H2_CS_ERROR)
1613 break;
1614
1615 if (h2c->st0 == H2_CS_FRAME_H) {
1616 struct h2_fh hdr;
1617
1618 if (!h2_peek_frame_hdr(h2c->dbuf, &hdr))
1619 break;
1620
1621 if ((int)hdr.len < 0 || (int)hdr.len > h2c->mfs) {
1622 h2c_error(h2c, H2_ERR_FRAME_SIZE_ERROR);
1623 h2c->st0 = H2_CS_ERROR;
1624 break;
1625 }
1626
1627 h2c->dfl = hdr.len;
1628 h2c->dsi = hdr.sid;
1629 h2c->dft = hdr.ft;
1630 h2c->dff = hdr.ff;
1631 h2c->st0 = H2_CS_FRAME_P;
1632 h2_skip_frame_hdr(h2c->dbuf);
1633 }
1634
1635 /* Only H2_CS_FRAME_P and H2_CS_FRAME_A here */
Willy Tarreauf3ee0692017-10-17 08:18:25 +02001636 h2s = h2c_st_by_id(h2c, h2c->dsi);
Willy Tarreau7e98c052017-10-10 15:56:59 +02001637
Willy Tarreauf65b80d2017-10-30 11:46:49 +01001638 if (h2s->st == H2_SS_IDLE &&
1639 h2c->dft != H2_FT_HEADERS && h2c->dft != H2_FT_PRIORITY) {
1640 /* RFC7540#5.1: any frame other than HEADERS or PRIORITY in
1641 * this state MUST be treated as a connection error
1642 */
1643 h2c_error(h2c, H2_ERR_PROTOCOL_ERROR);
1644 h2c->st0 = H2_CS_ERROR;
1645 break;
1646 }
1647
Willy Tarreauf182a9a2017-10-30 12:03:50 +01001648 if (h2s->st == H2_SS_HREM && h2c->dft != H2_FT_WINDOW_UPDATE &&
1649 h2c->dft != H2_FT_RST_STREAM && h2c->dft != H2_FT_PRIORITY) {
1650 /* RFC7540#5.1: any frame other than WU/PRIO/RST in
1651 * this state MUST be treated as a stream error
1652 */
1653 h2s_error(h2s, H2_ERR_STREAM_CLOSED);
1654 goto strm_err;
1655 }
1656
Willy Tarreauc0da1962017-10-30 18:38:00 +01001657#if 0
1658 // problem below: it is not possible to completely ignore such
1659 // streams as we need to maintain the compression state as well
1660 // and for this we need to completely process these frames (eg:
1661 // HEADERS frames) as well as counting DATA frames to emit
1662 // proper WINDOW UPDATES and ensure the connection doesn't stall.
1663 // This is a typical case of layer violation where the
1664 // transported contents are critical to the connection's
1665 // validity and must be ignored at the same time :-(
1666
1667 /* graceful shutdown, ignore streams whose ID is higher than
1668 * the one advertised in GOAWAY. RFC7540#6.8.
1669 */
1670 if (unlikely(h2c->last_sid >= 0) && h2c->dsi > h2c->last_sid) {
1671 ret = MIN(h2c->dbuf->i, h2c->dfl);
1672 bi_del(h2c->dbuf, ret);
1673 h2c->dfl -= ret;
1674 ret = h2c->dfl == 0;
1675 goto strm_err;
1676 }
1677#endif
1678
Willy Tarreau7e98c052017-10-10 15:56:59 +02001679 switch (h2c->dft) {
Willy Tarreau3421aba2017-07-27 15:41:03 +02001680 case H2_FT_SETTINGS:
1681 if (h2c->st0 == H2_CS_FRAME_P)
1682 ret = h2c_handle_settings(h2c);
1683
1684 if (h2c->st0 == H2_CS_FRAME_A)
1685 ret = h2c_ack_settings(h2c);
1686 break;
1687
Willy Tarreaucf68c782017-10-10 17:11:41 +02001688 case H2_FT_PING:
1689 if (h2c->st0 == H2_CS_FRAME_P)
1690 ret = h2c_handle_ping(h2c);
1691
1692 if (h2c->st0 == H2_CS_FRAME_A)
1693 ret = h2c_ack_ping(h2c);
1694 break;
1695
Willy Tarreau26f95952017-07-27 17:18:30 +02001696 case H2_FT_WINDOW_UPDATE:
1697 if (h2c->st0 == H2_CS_FRAME_P)
1698 ret = h2c_handle_window_update(h2c, h2s);
1699 break;
1700
Willy Tarreau61290ec2017-10-17 08:19:21 +02001701 case H2_FT_CONTINUATION:
1702 /* we currently don't support CONTINUATION frames since
1703 * we have nowhere to store the partial HEADERS frame.
1704 * Let's abort the stream on an INTERNAL_ERROR here.
1705 */
1706 if (h2c->st0 == H2_CS_FRAME_P)
1707 h2s_error(h2s, H2_ERR_INTERNAL_ERROR);
1708 break;
1709
Willy Tarreau13278b42017-10-13 19:23:14 +02001710 case H2_FT_HEADERS:
1711 if (h2c->st0 == H2_CS_FRAME_P)
1712 ret = h2c_frt_handle_headers(h2c, h2s);
1713 break;
1714
Willy Tarreau454f9052017-10-26 19:40:35 +02001715 case H2_FT_DATA:
1716 if (h2c->st0 == H2_CS_FRAME_P)
1717 ret = h2c_frt_handle_data(h2c, h2s);
1718
1719 if (h2c->st0 == H2_CS_FRAME_A)
1720 ret = h2c_send_strm_wu(h2c);
1721 break;
Willy Tarreaucd234e92017-08-18 10:59:39 +02001722
1723 case H2_FT_RST_STREAM:
1724 if (h2c->st0 == H2_CS_FRAME_P)
1725 ret = h2c_handle_rst_stream(h2c, h2s);
1726 break;
1727
Willy Tarreaue96b0922017-10-30 00:28:29 +01001728 case H2_FT_GOAWAY:
1729 if (h2c->st0 == H2_CS_FRAME_P)
1730 ret = h2c_handle_goaway(h2c);
1731 break;
1732
Willy Tarreau1c661982017-10-30 13:52:01 +01001733 case H2_FT_PUSH_PROMISE:
1734 /* not permitted here, RFC7540#5.1 */
1735 h2c_error(h2c, H2_ERR_PROTOCOL_ERROR);
Willy Tarreau1c661982017-10-30 13:52:01 +01001736 break;
1737
1738 /* implement all extra frame types here */
Willy Tarreau7e98c052017-10-10 15:56:59 +02001739 default:
1740 /* drop frames that we ignore. They may be larger than
1741 * the buffer so we drain all of their contents until
1742 * we reach the end.
1743 */
1744 ret = MIN(h2c->dbuf->i, h2c->dfl);
1745 bi_del(h2c->dbuf, ret);
1746 h2c->dfl -= ret;
1747 ret = h2c->dfl == 0;
1748 }
1749
Willy Tarreauf182a9a2017-10-30 12:03:50 +01001750 strm_err:
Willy Tarreau27a84c92017-10-17 08:10:17 +02001751 /* RST are sent similarly to frame acks */
1752 if (h2s->st == H2_SS_ERROR) {
1753 if (h2c->st0 == H2_CS_FRAME_P)
1754 h2c->st0 = H2_CS_FRAME_A;
1755
1756 if (h2c->st0 == H2_CS_FRAME_A)
1757 ret = h2c_send_rst_stream(h2c, h2s);
1758 }
1759
Willy Tarreau7e98c052017-10-10 15:56:59 +02001760 /* error or missing data condition met above ? */
1761 if (ret <= 0)
1762 break;
1763
1764 if (h2c->st0 != H2_CS_FRAME_H) {
1765 bi_del(h2c->dbuf, h2c->dfl);
1766 h2c->st0 = H2_CS_FRAME_H;
1767 }
1768 }
Willy Tarreau52eed752017-09-22 15:05:09 +02001769
Willy Tarreaucc0b8c32017-10-26 16:55:59 +02001770 if (h2c->rcvd_c > 0 &&
1771 !(h2c->flags & (H2_CF_MUX_MFULL | H2_CF_DEM_MBUSY | H2_CF_DEM_MROOM)))
1772 h2c_send_conn_wu(h2c);
1773
Willy Tarreau52eed752017-09-22 15:05:09 +02001774 fail:
1775 /* we can go here on missing data, blocked response or error */
1776 return;
Willy Tarreaubc933932017-10-09 16:21:43 +02001777}
1778
1779/* process Tx frames from streams to be multiplexed. Returns > 0 if it reached
1780 * the end.
1781 */
1782static int h2_process_mux(struct h2c *h2c)
1783{
Willy Tarreaubacdf5a2017-10-17 10:57:04 +02001784 struct h2s *h2s, *h2s_back;
1785
Willy Tarreaucc0b8c32017-10-26 16:55:59 +02001786 /* start by sending possibly pending window updates */
1787 if (h2c->rcvd_c > 0 &&
1788 !(h2c->flags & (H2_CF_MUX_MFULL | H2_CF_MUX_MALLOC)) &&
1789 h2c_send_conn_wu(h2c) < 0)
1790 goto fail;
1791
Willy Tarreaubacdf5a2017-10-17 10:57:04 +02001792 /* First we always process the flow control list because the streams
1793 * waiting there were already elected for immediate emission but were
1794 * blocked just on this.
1795 */
1796
1797 list_for_each_entry_safe(h2s, h2s_back, &h2c->fctl_list, list) {
1798 if (h2c->mws <= 0 || h2c->flags & H2_CF_MUX_BLOCK_ANY ||
1799 h2c->st0 >= H2_CS_ERROR)
1800 break;
1801
1802 /* In theory it's possible that h2s->cs == NULL here :
1803 * - client sends crap that causes a parse error
1804 * - RST_STREAM is produced and CS_FL_ERROR at the same time
1805 * - RST_STREAM cannot be emitted because mux is busy/full
1806 * - stream gets notified, detaches and quits
1807 * - mux buffer gets ready and wakes pending streams up
1808 * - bam!
1809 */
1810 h2s->flags &= ~H2_SF_BLK_ANY;
1811
1812 if (h2s->cs) {
1813 h2s->cs->data_cb->send(h2s->cs);
1814 h2s->cs->data_cb->wake(h2s->cs);
Willy Tarreau27a84c92017-10-17 08:10:17 +02001815 } else {
1816 h2c_send_rst_stream(h2c, h2s);
Willy Tarreaubacdf5a2017-10-17 10:57:04 +02001817 }
1818
1819 /* depending on callee's blocking reasons, we may queue in send
1820 * list or completely dequeue.
1821 */
1822 if ((h2s->flags & H2_SF_BLK_MFCTL) == 0) {
1823 if (h2s->flags & H2_SF_BLK_ANY) {
1824 LIST_DEL(&h2s->list);
1825 LIST_ADDQ(&h2c->send_list, &h2s->list);
1826 }
1827 else {
1828 LIST_DEL(&h2s->list);
1829 LIST_INIT(&h2s->list);
1830 if (h2s->cs)
1831 h2s->cs->flags &= ~CS_FL_DATA_WR_ENA;
1832 }
1833 }
1834 }
1835
1836 list_for_each_entry_safe(h2s, h2s_back, &h2c->send_list, list) {
1837 if (h2c->st0 >= H2_CS_ERROR || h2c->flags & H2_CF_MUX_BLOCK_ANY)
1838 break;
1839
1840 /* In theory it's possible that h2s->cs == NULL here :
1841 * - client sends crap that causes a parse error
1842 * - RST_STREAM is produced and CS_FL_ERROR at the same time
1843 * - RST_STREAM cannot be emitted because mux is busy/full
1844 * - stream gets notified, detaches and quits
1845 * - mux buffer gets ready and wakes pending streams up
1846 * - bam!
1847 */
1848 h2s->flags &= ~H2_SF_BLK_ANY;
1849
1850 if (h2s->cs) {
1851 h2s->cs->data_cb->send(h2s->cs);
1852 h2s->cs->data_cb->wake(h2s->cs);
Willy Tarreau27a84c92017-10-17 08:10:17 +02001853 } else {
1854 h2c_send_rst_stream(h2c, h2s);
Willy Tarreaubacdf5a2017-10-17 10:57:04 +02001855 }
1856 /* depending on callee's blocking reasons, we may queue in fctl
1857 * list or completely dequeue.
1858 */
1859 if (h2s->flags & H2_SF_BLK_MFCTL) {
1860 /* stream hit the connection's flow control */
1861 LIST_DEL(&h2s->list);
1862 LIST_ADDQ(&h2c->fctl_list, &h2s->list);
1863 }
1864 else if (!(h2s->flags & H2_SF_BLK_ANY)) {
1865 LIST_DEL(&h2s->list);
1866 LIST_INIT(&h2s->list);
1867 if (h2s->cs)
1868 h2s->cs->flags &= ~CS_FL_DATA_WR_ENA;
1869 }
1870 }
1871
Willy Tarreaucc0b8c32017-10-26 16:55:59 +02001872 fail:
Willy Tarreau3eabe9b2017-11-07 11:03:01 +01001873 if (unlikely(h2c->st0 >= H2_CS_ERROR)) {
Willy Tarreau081d4722017-05-16 21:51:05 +02001874 if (h2c->st0 == H2_CS_ERROR) {
1875 if (h2c->max_id >= 0) {
1876 h2c_send_goaway_error(h2c, NULL);
1877 if (h2c->flags & H2_CF_MUX_BLOCK_ANY)
1878 return 0;
1879 }
1880
1881 h2c->st0 = H2_CS_ERROR2; // sent (or failed hard) !
1882 }
1883 return 1;
1884 }
Willy Tarreaubacdf5a2017-10-17 10:57:04 +02001885 return (h2c->mws <= 0 || LIST_ISEMPTY(&h2c->fctl_list)) && LIST_ISEMPTY(&h2c->send_list);
Willy Tarreaubc933932017-10-09 16:21:43 +02001886}
1887
Willy Tarreau71681172017-10-23 14:39:06 +02001888
Willy Tarreau62f52692017-10-08 23:01:42 +02001889/*********************************************************/
1890/* functions below are I/O callbacks from the connection */
1891/*********************************************************/
1892
1893/* callback called on recv event by the connection handler */
1894static void h2_recv(struct connection *conn)
1895{
Willy Tarreaua2af5122017-10-09 11:56:46 +02001896 struct h2c *h2c = conn->mux_ctx;
Willy Tarreau35dbd5d2017-09-22 09:13:49 +02001897 struct buffer *buf;
Willy Tarreaua2af5122017-10-09 11:56:46 +02001898 int max;
1899
1900 if (conn->flags & CO_FL_ERROR)
Willy Tarreaufbe3b4f2017-10-09 15:14:19 +02001901 return;
1902
1903 if (h2c->flags & H2_CF_DEM_BLOCK_ANY)
1904 return;
Willy Tarreaua2af5122017-10-09 11:56:46 +02001905
Willy Tarreau35dbd5d2017-09-22 09:13:49 +02001906 buf = h2_get_dbuf(h2c);
Willy Tarreau1b62c5c2017-09-25 11:55:01 +02001907 if (!buf) {
1908 h2c->flags |= H2_CF_DEM_DALLOC;
Willy Tarreau35dbd5d2017-09-22 09:13:49 +02001909 return;
Willy Tarreau1b62c5c2017-09-25 11:55:01 +02001910 }
Willy Tarreau35dbd5d2017-09-22 09:13:49 +02001911
Willy Tarreaua2af5122017-10-09 11:56:46 +02001912 /* note: buf->o == 0 */
1913 max = buf->size - buf->i;
1914 if (!max) {
Willy Tarreaufbe3b4f2017-10-09 15:14:19 +02001915 h2c->flags |= H2_CF_DEM_DFULL;
Willy Tarreaua2af5122017-10-09 11:56:46 +02001916 return;
1917 }
1918
1919 conn->xprt->rcv_buf(conn, buf, max);
1920 if (conn->flags & CO_FL_ERROR)
Willy Tarreaufbe3b4f2017-10-09 15:14:19 +02001921 return;
Willy Tarreaua2af5122017-10-09 11:56:46 +02001922
Willy Tarreaufbe3b4f2017-10-09 15:14:19 +02001923 if (!buf->i) {
Willy Tarreau35dbd5d2017-09-22 09:13:49 +02001924 h2_release_dbuf(h2c);
Willy Tarreaua2af5122017-10-09 11:56:46 +02001925 return;
1926 }
1927
Willy Tarreaufbe3b4f2017-10-09 15:14:19 +02001928 if (buf->i == buf->size)
1929 h2c->flags |= H2_CF_DEM_DFULL;
1930
Willy Tarreaubc933932017-10-09 16:21:43 +02001931 h2_process_demux(h2c);
Willy Tarreaua2af5122017-10-09 11:56:46 +02001932
Willy Tarreaufbe3b4f2017-10-09 15:14:19 +02001933 /* after streams have been processed, we should have made some room */
Willy Tarreau081d4722017-05-16 21:51:05 +02001934 if (h2c->st0 >= H2_CS_ERROR)
1935 buf->i = 0;
1936
Willy Tarreaufbe3b4f2017-10-09 15:14:19 +02001937 if (buf->i != buf->size)
1938 h2c->flags &= ~H2_CF_DEM_DFULL;
Willy Tarreaua2af5122017-10-09 11:56:46 +02001939 return;
Willy Tarreau62f52692017-10-08 23:01:42 +02001940}
1941
1942/* callback called on send event by the connection handler */
1943static void h2_send(struct connection *conn)
1944{
Willy Tarreaua2af5122017-10-09 11:56:46 +02001945 struct h2c *h2c = conn->mux_ctx;
Willy Tarreaubc933932017-10-09 16:21:43 +02001946 int done;
Willy Tarreaua2af5122017-10-09 11:56:46 +02001947
1948 if (conn->flags & CO_FL_ERROR)
Willy Tarreaufbe3b4f2017-10-09 15:14:19 +02001949 return;
Willy Tarreaua2af5122017-10-09 11:56:46 +02001950
1951 if (conn->flags & (CO_FL_HANDSHAKE|CO_FL_WAIT_L4_CONN|CO_FL_WAIT_L6_CONN)) {
1952 /* a handshake was requested */
1953 return;
1954 }
1955
Willy Tarreaubc933932017-10-09 16:21:43 +02001956 /* This loop is quite simple : it tries to fill as much as it can from
1957 * pending streams into the existing buffer until it's reportedly full
1958 * or the end of send requests is reached. Then it tries to send this
1959 * buffer's contents out, marks it not full if at least one byte could
1960 * be sent, and tries again.
1961 *
1962 * The snd_buf() function normally takes a "flags" argument which may
1963 * be made of a combination of CO_SFL_MSG_MORE to indicate that more
1964 * data immediately comes and CO_SFL_STREAMER to indicate that the
1965 * connection is streaming lots of data (used to increase TLS record
1966 * size at the expense of latency). The former can be sent any time
1967 * there's a buffer full flag, as it indicates at least one stream
1968 * attempted to send and failed so there are pending data. An
1969 * alternative would be to set it as long as there's an active stream
1970 * but that would be problematic for ACKs until we have an absolute
1971 * guarantee that all waiters have at least one byte to send. The
1972 * latter should possibly not be set for now.
1973 */
1974
1975 done = 0;
1976 while (!done) {
1977 unsigned int flags = 0;
1978
1979 /* fill as much as we can into the current buffer */
1980 while (((h2c->flags & (H2_CF_MUX_MFULL|H2_CF_MUX_MALLOC)) == 0) && !done)
1981 done = h2_process_mux(h2c);
1982
1983 if (conn->flags & CO_FL_ERROR)
1984 break;
1985
1986 if (h2c->flags & (H2_CF_MUX_MFULL | H2_CF_DEM_MBUSY | H2_CF_DEM_MROOM))
1987 flags |= CO_SFL_MSG_MORE;
1988
Willy Tarreau319994a2017-11-07 11:03:56 +01001989 if (h2c->mbuf->o && conn->xprt->snd_buf(conn, h2c->mbuf, flags) <= 0)
Willy Tarreaubc933932017-10-09 16:21:43 +02001990 break;
1991
1992 /* wrote at least one byte, the buffer is not full anymore */
1993 h2c->flags &= ~(H2_CF_MUX_MFULL | H2_CF_DEM_MROOM);
1994 }
1995
Willy Tarreaua2af5122017-10-09 11:56:46 +02001996 if (conn->flags & CO_FL_SOCK_WR_SH) {
1997 /* output closed, nothing to send, clear the buffer to release it */
1998 h2c->mbuf->o = 0;
Willy Tarreaua2af5122017-10-09 11:56:46 +02001999 }
Willy Tarreaufbe3b4f2017-10-09 15:14:19 +02002000}
Willy Tarreaua2af5122017-10-09 11:56:46 +02002001
Willy Tarreau62f52692017-10-08 23:01:42 +02002002/* callback called on any event by the connection handler.
2003 * It applies changes and returns zero, or < 0 if it wants immediate
2004 * destruction of the connection (which normally doesn not happen in h2).
2005 */
2006static int h2_wake(struct connection *conn)
2007{
Willy Tarreaua2af5122017-10-09 11:56:46 +02002008 struct h2c *h2c = conn->mux_ctx;
2009
Willy Tarreau26bd7612017-10-09 16:47:04 +02002010 if (conn->flags & CO_FL_ERROR || conn_xprt_read0_pending(conn) ||
Willy Tarreau29a98242017-10-31 06:59:15 +01002011 h2c->st0 == H2_CS_ERROR2 || h2c->flags & H2_CF_GOAWAY_FAILED ||
2012 (eb_is_empty(&h2c->streams_by_id) && h2c->last_sid >= 0 &&
2013 h2c->max_id >= h2c->last_sid)) {
Willy Tarreau23b92aa2017-10-30 00:26:54 +01002014 h2_wake_some_streams(h2c, 0, 0);
Willy Tarreaufbe3b4f2017-10-09 15:14:19 +02002015
2016 if (eb_is_empty(&h2c->streams_by_id)) {
2017 /* no more stream, kill the connection now */
2018 h2_release(conn);
2019 return -1;
2020 }
2021 else {
2022 /* some streams still there, we need to signal them all and
2023 * wait for their departure.
2024 */
2025 __conn_xprt_stop_recv(conn);
2026 __conn_xprt_stop_send(conn);
2027 return 0;
2028 }
2029 }
2030
2031 if (!h2c->dbuf->i)
2032 h2_release_dbuf(h2c);
2033
2034 /* stop being notified of incoming data if we can't process them */
2035 if (h2c->st0 >= H2_CS_ERROR ||
2036 (h2c->flags & H2_CF_DEM_BLOCK_ANY) || conn_xprt_read0_pending(conn)) {
Willy Tarreaufbe3b4f2017-10-09 15:14:19 +02002037 __conn_xprt_stop_recv(conn);
2038 }
2039 else {
Willy Tarreaufbe3b4f2017-10-09 15:14:19 +02002040 __conn_xprt_want_recv(conn);
2041 }
2042
2043 /* adjust output polling */
Willy Tarreau51606832017-10-17 15:30:07 +02002044 if (!(conn->flags & CO_FL_SOCK_WR_SH) &&
2045 (h2c->st0 == H2_CS_ERROR ||
2046 h2c->mbuf->o ||
2047 (h2c->mws > 0 && !LIST_ISEMPTY(&h2c->fctl_list)) ||
2048 (!(h2c->flags & H2_CF_MUX_BLOCK_ANY) && !LIST_ISEMPTY(&h2c->send_list)))) {
Willy Tarreaufbe3b4f2017-10-09 15:14:19 +02002049 __conn_xprt_want_send(conn);
2050 }
2051 else {
Willy Tarreaufbe3b4f2017-10-09 15:14:19 +02002052 h2_release_mbuf(h2c);
2053 __conn_xprt_stop_send(conn);
Willy Tarreaua2af5122017-10-09 11:56:46 +02002054 }
2055
Willy Tarreau3f133572017-10-31 19:21:06 +01002056 if (h2c->task) {
2057 if (eb_is_empty(&h2c->streams_by_id)) {
2058 h2c->task->expire = tick_add(now_ms, h2c->timeout);
2059 task_queue(h2c->task);
2060 }
2061 else
2062 h2c->task->expire = TICK_ETERNITY;
Willy Tarreauea392822017-10-31 10:02:25 +01002063 }
Willy Tarreau62f52692017-10-08 23:01:42 +02002064 return 0;
2065}
2066
Willy Tarreauea392822017-10-31 10:02:25 +01002067/* Connection timeout management. The principle is that if there's no receipt
2068 * nor sending for a certain amount of time, the connection is closed. If the
2069 * MUX buffer still has lying data or is not allocatable, the connection is
2070 * immediately killed. If it's allocatable and empty, we attempt to send a
2071 * GOAWAY frame.
2072 */
2073static struct task *h2_timeout_task(struct task *t)
2074{
2075 struct h2c *h2c = t->context;
2076 int expired = tick_is_expired(t->expire, now_ms);
2077
2078 if (!expired)
2079 return t;
2080
2081 h2c_error(h2c, H2_ERR_NO_ERROR);
2082 h2_wake_some_streams(h2c, 0, 0);
2083
2084 if (h2c->mbuf->o) {
2085 /* don't even try to send a GOAWAY, the buffer is stuck */
2086 h2c->flags |= H2_CF_GOAWAY_FAILED;
2087 }
2088
2089 /* try to send but no need to insist */
2090 if (h2c_send_goaway_error(h2c, NULL) <= 0)
2091 h2c->flags |= H2_CF_GOAWAY_FAILED;
2092
2093 if (h2c->mbuf->o && !(h2c->flags & H2_CF_GOAWAY_FAILED) && conn_xprt_ready(h2c->conn))
2094 h2c->conn->xprt->snd_buf(h2c->conn, h2c->mbuf, 0);
2095
2096 if (!eb_is_empty(&h2c->streams_by_id))
2097 goto wait;
2098
2099 h2_release(h2c->conn);
2100 return NULL;
2101
2102 wait:
2103 /* the streams have been notified, we must let them finish and close */
2104 h2c->task = NULL;
2105 task_delete(t);
2106 task_free(t);
2107 return NULL;
2108}
2109
2110
Willy Tarreau62f52692017-10-08 23:01:42 +02002111/*******************************************/
2112/* functions below are used by the streams */
2113/*******************************************/
2114
2115/*
2116 * Attach a new stream to a connection
2117 * (Used for outgoing connections)
2118 */
2119static struct conn_stream *h2_attach(struct connection *conn)
2120{
2121 return NULL;
2122}
2123
2124/* callback used to update the mux's polling flags after changing a cs' status.
2125 * The caller (cs_update_mux_polling) will take care of propagating any changes
2126 * to the transport layer.
2127 */
2128static void h2_update_poll(struct conn_stream *cs)
2129{
Willy Tarreau1d393222017-10-17 10:26:19 +02002130 struct h2s *h2s = cs->ctx;
2131
2132 if (!h2s)
2133 return;
2134
Willy Tarreaud7739c82017-10-30 15:38:23 +01002135 /* we may unblock a blocked read */
2136
2137 if (cs->flags & CS_FL_DATA_RD_ENA &&
2138 h2s->h2c->flags & H2_CF_DEM_SFULL && h2s->h2c->dsi == h2s->id) {
2139 h2s->h2c->flags &= ~H2_CF_DEM_SFULL;
2140 conn_xprt_want_recv(cs->conn);
2141 }
2142
Willy Tarreau1d393222017-10-17 10:26:19 +02002143 /* Note: the stream and stream-int code doesn't allow us to perform a
2144 * synchronous send() here unfortunately, because this code is called
2145 * as si_update() from the process_stream() context. This means that
2146 * we have to queue the current cs and defer its processing after the
2147 * connection's cs list is processed anyway.
2148 */
2149
2150 if (cs->flags & CS_FL_DATA_WR_ENA) {
2151 if (LIST_ISEMPTY(&h2s->list)) {
2152 if (LIST_ISEMPTY(&h2s->h2c->send_list) &&
2153 !h2s->h2c->mbuf->o && // not yet subscribed
2154 !(cs->conn->flags & CO_FL_SOCK_WR_SH))
2155 conn_xprt_want_send(cs->conn);
2156 LIST_ADDQ(&h2s->h2c->send_list, &h2s->list);
2157 }
2158 }
2159 else if (!LIST_ISEMPTY(&h2s->list)) {
2160 LIST_DEL(&h2s->list);
2161 LIST_INIT(&h2s->list);
2162 h2s->flags &= ~(H2_SF_BLK_MBUSY | H2_SF_BLK_MROOM | H2_SF_BLK_MFCTL);
2163 }
2164
2165 /* this can happen from within si_chk_snd() */
2166 if (h2s->h2c->mbuf->o && !(cs->conn->flags & CO_FL_XPRT_WR_ENA))
2167 conn_xprt_want_send(cs->conn);
Willy Tarreau62f52692017-10-08 23:01:42 +02002168}
2169
2170/*
2171 * Detach the stream from the connection and possibly release the connection.
2172 */
2173static void h2_detach(struct conn_stream *cs)
2174{
Willy Tarreau60935142017-10-16 18:11:19 +02002175 struct h2s *h2s = cs->ctx;
2176 struct h2c *h2c;
2177
2178 cs->ctx = NULL;
2179 if (!h2s)
2180 return;
2181
2182 h2c = h2s->h2c;
2183 h2s->cs = NULL;
2184
Willy Tarreau45f752e2017-10-30 15:44:59 +01002185 if ((h2c->flags & H2_CF_DEM_BLOCK_ANY && h2s->id == h2c->dsi) ||
2186 (h2c->flags & H2_CF_MUX_BLOCK_ANY && h2s->id == h2c->msi)) {
2187 /* unblock the connection if it was blocked on this
2188 * stream.
2189 */
2190 h2c->flags &= ~H2_CF_DEM_BLOCK_ANY;
2191 h2c->flags &= ~H2_CF_MUX_BLOCK_ANY;
2192 conn_xprt_want_recv(cs->conn);
2193 conn_xprt_want_send(cs->conn);
2194 }
2195
Willy Tarreau60935142017-10-16 18:11:19 +02002196 if (h2s->by_id.node.leaf_p) {
2197 /* h2s still attached to the h2c */
2198 eb32_delete(&h2s->by_id);
2199
2200 /* We don't want to close right now unless we're removing the
2201 * last stream, and either the connection is in error, or it
2202 * reached the ID already specified in a GOAWAY frame received
Willy Tarreaue6ae77f2017-11-07 11:59:51 +01002203 * or sent (as seen by last_sid >= 0).
Willy Tarreau60935142017-10-16 18:11:19 +02002204 */
Willy Tarreau83906c22017-11-07 11:48:46 +01002205 if (eb_is_empty(&h2c->streams_by_id) && /* don't close if streams exist */
2206 ((h2c->conn->flags & CO_FL_ERROR) || /* errors close immediately */
Willy Tarreau60935142017-10-16 18:11:19 +02002207 (h2c->flags & H2_CF_GOAWAY_FAILED) ||
Willy Tarreau83906c22017-11-07 11:48:46 +01002208 (!h2c->mbuf->o && /* mux buffer empty, also process clean events below */
2209 (conn_xprt_read0_pending(h2c->conn) ||
2210 (h2c->last_sid >= 0 && h2c->max_id >= h2c->last_sid))))) {
Willy Tarreau60935142017-10-16 18:11:19 +02002211 /* no more stream will come, kill it now */
2212 h2_release(h2c->conn);
2213 }
Willy Tarreaue6ae77f2017-11-07 11:59:51 +01002214 else if (h2c->task) {
2215 if (eb_is_empty(&h2c->streams_by_id)) {
2216 h2c->task->expire = tick_add(now_ms, h2c->timeout);
2217 task_queue(h2c->task);
2218 }
2219 else
2220 h2c->task->expire = TICK_ETERNITY;
2221 }
Willy Tarreau60935142017-10-16 18:11:19 +02002222 }
2223 pool_free2(pool2_h2s, h2s);
Willy Tarreau62f52692017-10-08 23:01:42 +02002224}
2225
2226static void h2_shutr(struct conn_stream *cs, enum cs_shr_mode mode)
2227{
Willy Tarreauc7576ea2017-10-29 22:00:09 +01002228 struct h2s *h2s = cs->ctx;
2229
2230 if (!mode)
2231 return;
2232
Willy Tarreau721c9742017-11-07 11:05:42 +01002233 if (h2s->st == H2_SS_HLOC || h2s->st == H2_SS_ERROR || h2s->st == H2_SS_CLOSED)
Willy Tarreauc7576ea2017-10-29 22:00:09 +01002234 return;
2235
Willy Tarreau926fa4c2017-11-07 14:42:12 +01002236 /* if no outgoing data was seen on this stream, it means it was
2237 * closed with a "tcp-request content" rule that is normally
2238 * used to kill the connection ASAP (eg: limit abuse). In this
2239 * case we send a goaway to close the connection.
2240 */
2241 if (!(h2s->flags & H2_SF_OUTGOING_DATA) &&
2242 !(h2s->h2c->flags & (H2_CF_GOAWAY_SENT|H2_CF_GOAWAY_FAILED)) &&
2243 h2c_send_goaway_error(h2s->h2c, h2s) <= 0)
2244 return;
2245
Willy Tarreauc7576ea2017-10-29 22:00:09 +01002246 if (h2c_send_rst_stream(h2s->h2c, h2s) <= 0)
2247 return;
2248
2249 if (h2s->h2c->mbuf->o && !(cs->conn->flags & CO_FL_XPRT_WR_ENA))
2250 conn_xprt_want_send(cs->conn);
2251
2252 h2s->st = H2_SS_CLOSED;
Willy Tarreau62f52692017-10-08 23:01:42 +02002253}
2254
2255static void h2_shutw(struct conn_stream *cs, enum cs_shw_mode mode)
2256{
Willy Tarreauc7576ea2017-10-29 22:00:09 +01002257 struct h2s *h2s = cs->ctx;
2258
Willy Tarreau721c9742017-11-07 11:05:42 +01002259 if (h2s->st == H2_SS_HLOC || h2s->st == H2_SS_ERROR || h2s->st == H2_SS_CLOSED)
Willy Tarreauc7576ea2017-10-29 22:00:09 +01002260 return;
2261
Willy Tarreau67434202017-11-06 20:20:51 +01002262 if (h2s->flags & H2_SF_HEADERS_SENT) {
Willy Tarreau58e32082017-11-07 14:41:09 +01002263 /* we can cleanly close using an empty data frame only after headers */
2264
2265 if (!(h2s->flags & (H2_SF_ES_SENT|H2_SF_RST_SENT)) &&
2266 h2_send_empty_data_es(h2s) <= 0)
Willy Tarreauc7576ea2017-10-29 22:00:09 +01002267 return;
Willy Tarreau58e32082017-11-07 14:41:09 +01002268
2269 if (h2s->st == H2_SS_HREM)
2270 h2s->st = H2_SS_CLOSED;
2271 else
2272 h2s->st = H2_SS_HLOC;
Willy Tarreauc7576ea2017-10-29 22:00:09 +01002273 } else {
Willy Tarreau926fa4c2017-11-07 14:42:12 +01002274 /* if no outgoing data was seen on this stream, it means it was
2275 * closed with a "tcp-request content" rule that is normally
2276 * used to kill the connection ASAP (eg: limit abuse). In this
2277 * case we send a goaway to close the connection.
Willy Tarreaua1349f02017-10-31 07:41:55 +01002278 */
Willy Tarreau926fa4c2017-11-07 14:42:12 +01002279 if (!(h2s->flags & H2_SF_OUTGOING_DATA) &&
2280 !(h2s->h2c->flags & (H2_CF_GOAWAY_SENT|H2_CF_GOAWAY_FAILED)) &&
Willy Tarreaua1349f02017-10-31 07:41:55 +01002281 h2c_send_goaway_error(h2s->h2c, h2s) <= 0)
2282 return;
2283
Willy Tarreau58e32082017-11-07 14:41:09 +01002284 if (!(h2s->flags & H2_SF_RST_SENT) &&
2285 h2c_send_rst_stream(h2s->h2c, h2s) <= 0)
Willy Tarreauc7576ea2017-10-29 22:00:09 +01002286 return;
Willy Tarreau58e32082017-11-07 14:41:09 +01002287
2288 h2s->st = H2_SS_CLOSED;
Willy Tarreauc7576ea2017-10-29 22:00:09 +01002289 }
2290
2291 if (h2s->h2c->mbuf->o && !(cs->conn->flags & CO_FL_XPRT_WR_ENA))
2292 conn_xprt_want_send(cs->conn);
Willy Tarreau62f52692017-10-08 23:01:42 +02002293}
2294
Willy Tarreau13278b42017-10-13 19:23:14 +02002295/* Decode the payload of a HEADERS frame and produce the equivalent HTTP/1
2296 * request. Returns the number of bytes emitted if > 0, or 0 if it couldn't
2297 * proceed. Stream errors are reported in h2s->errcode and connection errors
2298 * in h2c->errcode. The caller must already have checked the frame header and
2299 * ensured that the frame was complete or the buffer full.
2300 */
2301static int h2_frt_decode_headers(struct h2s *h2s, struct buffer *buf, int count)
2302{
2303 struct h2c *h2c = h2s->h2c;
2304 const uint8_t *hdrs = (uint8_t *)h2c->dbuf->p;
Willy Tarreau68dd9852017-07-03 14:44:26 +02002305 struct chunk *copy = NULL;
Willy Tarreau13278b42017-10-13 19:23:14 +02002306 int flen = h2c->dfl;
2307 int outlen = 0;
2308 int wrap;
2309 int try;
2310
2311 if (!h2c->dfl) {
2312 h2s_error(h2s, H2_ERR_PROTOCOL_ERROR); // empty headers frame!
2313 return 0;
2314 }
2315
2316 /* if the input buffer wraps, take a temporary copy of it (rare) */
2317 wrap = h2c->dbuf->data + h2c->dbuf->size - h2c->dbuf->p;
2318 if (wrap < h2c->dfl) {
Willy Tarreau68dd9852017-07-03 14:44:26 +02002319 copy = alloc_trash_chunk();
2320 if (!copy) {
2321 h2c_error(h2c, H2_ERR_INTERNAL_ERROR);
2322 goto fail;
2323 }
2324 memcpy(copy->str, h2c->dbuf->p, wrap);
2325 memcpy(copy->str + wrap, h2c->dbuf->data, h2c->dfl - wrap);
2326 hdrs = (uint8_t *)copy->str;
Willy Tarreau13278b42017-10-13 19:23:14 +02002327 }
2328
2329 /* The padlen is the first byte before data, and the padding appears
2330 * after data. padlen+data+padding are included in flen.
2331 */
2332 if (h2c->dff & H2_F_HEADERS_PADDED) {
2333 if (*hdrs >= flen) {
2334 /* RFC7540#6.2 : pad length = length of frame payload or greater */
2335 h2c_error(h2c, H2_ERR_PROTOCOL_ERROR);
Willy Tarreau13278b42017-10-13 19:23:14 +02002336 return 0;
2337 }
2338 flen -= *hdrs + 1;
2339 hdrs += 1; // skip Pad Length
2340 }
2341
2342 /* Skip StreamDep and weight for now (we don't support PRIORITY) */
2343 if (h2c->dff & H2_F_HEADERS_PRIORITY) {
2344 hdrs += 5; // stream dep = 4, weight = 1
2345 flen -= 5;
2346 }
2347
2348 /* FIXME: lack of END_HEADERS means there's a continuation frame, we
2349 * don't support this for now and can't even decompress so we have to
2350 * break the connection.
2351 */
2352 if (!(h2c->dff & H2_F_HEADERS_END_HEADERS)) {
2353 h2c_error(h2c, H2_ERR_INTERNAL_ERROR);
Willy Tarreau68dd9852017-07-03 14:44:26 +02002354 goto fail;
Willy Tarreau13278b42017-10-13 19:23:14 +02002355 }
2356
2357 do {
2358 /* first check if we have some room after p+i */
2359 try = buf->data + buf->size - (buf->p + buf->i);
2360
2361 /* otherwise continue between data and p-o */
2362 if (try <= 0) {
2363 try = buf->p - (buf->data + buf->o);
2364 if (try <= 0)
Willy Tarreau68dd9852017-07-03 14:44:26 +02002365 goto fail;
Willy Tarreau13278b42017-10-13 19:23:14 +02002366 }
2367 if (try > count)
2368 try = count;
2369
2370 outlen = hpack_decode_frame(h2c->ddht, hdrs, flen, bi_end(buf), try);
2371 if (outlen == -HPACK_ERR_TOO_LARGE) {
2372 if (buffer_space_wraps(buf)) {
2373 /* it doesn't fit and the buffer is fragmented,
2374 * so let's defragment it and try again.
2375 */
2376 buffer_slow_realign(buf);
2377 }
2378 else if (buf->o) {
2379 /* need to let the output buffer flush and
2380 * mark the buffer for later wake up.
2381 */
Willy Tarreau68dd9852017-07-03 14:44:26 +02002382 goto fail;
Willy Tarreau13278b42017-10-13 19:23:14 +02002383 }
2384 else {
2385 /* no other way around */
2386 h2c_error(h2c, H2_ERR_COMPRESSION_ERROR);
Willy Tarreau68dd9852017-07-03 14:44:26 +02002387 goto fail;
Willy Tarreau13278b42017-10-13 19:23:14 +02002388 }
2389 }
2390 else if (outlen < 0) {
2391 h2c_error(h2c, H2_ERR_COMPRESSION_ERROR);
Willy Tarreau68dd9852017-07-03 14:44:26 +02002392 goto fail;
Willy Tarreau13278b42017-10-13 19:23:14 +02002393 }
2394 } while (outlen < 0);
2395
2396 /* now consume the input data */
2397 bi_del(h2c->dbuf, h2c->dfl);
2398 h2c->st0 = H2_CS_FRAME_H;
2399 buf->i += outlen;
2400
2401 /* don't send it before returning data!
2402 * FIXME: should we instead try to send it much later, after the
2403 * response ? This would require that we keep a copy of it in h2s.
2404 */
2405 if (h2c->dff & H2_F_HEADERS_END_STREAM) {
2406 h2s->cs->flags |= CS_FL_EOS;
2407 h2s->flags |= H2_SF_ES_RCVD;
2408 }
2409
Willy Tarreau68dd9852017-07-03 14:44:26 +02002410 leave:
2411 free_trash_chunk(copy);
Willy Tarreau13278b42017-10-13 19:23:14 +02002412 return outlen;
Willy Tarreau68dd9852017-07-03 14:44:26 +02002413 fail:
2414 outlen = 0;
2415 goto leave;
Willy Tarreau13278b42017-10-13 19:23:14 +02002416}
2417
Willy Tarreau454f9052017-10-26 19:40:35 +02002418/* Transfer the payload of a DATA frame to the HTTP/1 side. When content-length
2419 * or a tunnel is used, the contents are copied as-is. When chunked encoding is
2420 * in use, a new chunk is emitted for each frame. This is supposed to fit
2421 * because the smallest chunk takes 1 byte for the size, 2 for CRLF, X for the
2422 * data, 2 for the extra CRLF, so that's 5+X, while on the H2 side the smallest
2423 * frame will be 9+X bytes based on the same buffer size. The HTTP/2 frame
2424 * parser state is automatically updated. Returns the number of bytes emitted
2425 * if > 0, or 0 if it couldn't proceed. Stream errors are reported in
2426 * h2s->errcode and connection errors in h2c->errcode. The caller must already
2427 * have checked the frame header and ensured that the frame was complete or the
2428 * buffer full. It changes the frame state to FRAME_A once done.
2429 */
2430static int h2_frt_transfer_data(struct h2s *h2s, struct buffer *buf, int count)
2431{
2432 struct h2c *h2c = h2s->h2c;
2433 int block1, block2;
2434 unsigned int flen = h2c->dfl;
2435 unsigned int padlen = 0;
2436 int offset = 0;
2437
2438 if (h2c->dbuf->i < flen)
2439 return 0;
2440
2441 /* The padlen is the first byte before data, and the padding appears
2442 * after data. padlen+data+padding are included in flen.
2443 */
2444 if (h2c->dff & H2_F_HEADERS_PADDED) {
2445 padlen = *(uint8_t *)bi_ptr(h2c->dbuf);
2446 if (padlen >= flen) {
2447 /* RFC7540#6.1 : pad length = length of frame payload or greater */
2448 h2c_error(h2c, H2_ERR_PROTOCOL_ERROR);
Willy Tarreau454f9052017-10-26 19:40:35 +02002449 return 0;
2450 }
2451 flen -= padlen + 1;
2452 offset = 1; // skip Pad Length
2453 }
2454
2455 /* does it fit in output buffer or should we wait ? */
2456 if (buf->i + buf->o + flen > buf->size) {
2457 h2c->flags |= H2_CF_DEM_SFULL;
2458 return 0;
2459 }
2460
2461 /* Block1 is the length of the first block before the buffer wraps,
2462 * block2 is the optional second block to reach the end of the frame.
2463 */
2464 block1 = bi_contig_data(h2c->dbuf);
2465 if (block1 > offset + flen)
2466 block1 = offset + flen;
2467 block1 -= offset; // skip Pad Length
2468 block2 = flen - block1;
2469
2470 if (block1)
2471 bi_putblk(buf, b_ptr(h2c->dbuf, offset), block1);
2472
2473 if (block2)
2474 bi_putblk(buf, b_ptr(h2c->dbuf, offset + block1), block2);
2475
2476 /* now mark the input data as consumed (will be deleted from the buffer
2477 * by the caller when seeing FRAME_A after sending the window update).
2478 */
2479 h2c->rcvd_c += h2c->dfl;
2480 h2c->rcvd_s += h2c->dfl; // warning, this can also affect the closed streams!
2481 h2c->st0 = H2_CS_FRAME_A; // send the corresponding window update
2482
2483 /* don't send it before returning data!
2484 * FIXME: should we instead try to send it much later, after the
2485 * response ? This would require that we keep a copy of it in h2s.
2486 */
2487 if (h2c->dff & H2_F_HEADERS_END_STREAM) {
2488 h2s->cs->flags |= CS_FL_EOS;
2489 h2s->flags |= H2_SF_ES_RCVD;
2490 }
2491
2492 return flen;
2493}
2494
Willy Tarreau62f52692017-10-08 23:01:42 +02002495/*
Willy Tarreau13278b42017-10-13 19:23:14 +02002496 * Called from the upper layer to get more data, up to <count> bytes. The
2497 * caller is responsible for never asking for more data than what is available
2498 * in the buffer.
Willy Tarreau62f52692017-10-08 23:01:42 +02002499 */
2500static int h2_rcv_buf(struct conn_stream *cs, struct buffer *buf, int count)
2501{
Willy Tarreau13278b42017-10-13 19:23:14 +02002502 struct h2s *h2s = cs->ctx;
2503 struct h2c *h2c = h2s->h2c;
2504 int ret = 0;
2505
2506 if (h2c->st0 != H2_CS_FRAME_P)
2507 return 0; // no pre-parsed frame yet
2508
2509 if (h2c->dsi != h2s->id)
2510 return 0; // not for us
2511
2512 if (!h2c->dbuf->size)
2513 return 0; // empty buffer
2514
2515 if (h2c->dbuf->i < h2c->dfl && h2c->dbuf->i < h2c->dbuf->size)
2516 return 0; // incomplete input frame
2517
2518 switch (h2c->dft) {
2519 case H2_FT_HEADERS:
2520 ret = h2_frt_decode_headers(h2s, buf, count);
2521 break;
2522
Willy Tarreau454f9052017-10-26 19:40:35 +02002523 case H2_FT_DATA:
2524 ret = h2_frt_transfer_data(h2s, buf, count);
2525 break;
2526
Willy Tarreau13278b42017-10-13 19:23:14 +02002527 default:
2528 ret = 0;
2529 }
2530 return ret;
Willy Tarreau62f52692017-10-08 23:01:42 +02002531}
2532
Willy Tarreau9e5ae1d2017-10-17 19:58:20 +02002533/* Try to send a HEADERS frame matching HTTP/1 response present in buffer <buf>
2534 * for the H2 stream <h2s>. Returns 0 if not possible yet, <0 on error (one of
2535 * the H2_ERR* or h2_status codes), >0 on success in which case it corresponds
2536 * to the number of buffer bytes consumed.
2537 */
2538static int h2s_frt_make_resp_headers(struct h2s *h2s, struct buffer *buf)
2539{
2540 struct http_hdr list[MAX_HTTP_HDR];
2541 struct h2c *h2c = h2s->h2c;
2542 struct h1m *h1m = &h2s->res;
2543 struct chunk outbuf;
2544 int es_now = 0;
2545 int ret = 0;
2546 int hdr;
2547
2548 if (h2c_mux_busy(h2c, h2s)) {
2549 h2s->flags |= H2_SF_BLK_MBUSY;
2550 return 0;
2551 }
2552
2553 if (!h2_get_mbuf(h2c)) {
2554 h2c->flags |= H2_CF_MUX_MALLOC;
2555 h2s->flags |= H2_SF_BLK_MROOM;
2556 return 0;
2557 }
2558
2559 /* First, try to parse the H1 response and index it into <list>.
2560 * NOTE! Since it comes from haproxy, we *know* that a response header
2561 * block does not wrap and we can safely read it this way without
2562 * having to realign the buffer.
2563 */
Willy Tarreauc199faf2017-10-31 08:35:27 +01002564 next_header_block:
Willy Tarreau9e5ae1d2017-10-17 19:58:20 +02002565 ret = h1_headers_to_hdr_list(bo_ptr(buf), bo_ptr(buf) + buf->o,
2566 list, sizeof(list)/sizeof(list[0]), h1m);
2567 if (ret <= 0) {
Willy Tarreauf13ef962017-11-02 15:14:19 +01002568 /* incomplete or invalid response, this is abnormal coming from
2569 * haproxy and may only result in a bad errorfile or bad Lua code
2570 * so that won't be fixed, raise an error now.
2571 *
Willy Tarreau9e5ae1d2017-10-17 19:58:20 +02002572 * FIXME: we should instead add the ability to only return a
2573 * 502 bad gateway. But in theory this is not supposed to
2574 * happen.
2575 */
2576 h2s_error(h2s, H2_ERR_INTERNAL_ERROR);
2577 ret = 0;
2578 goto end;
2579 }
2580
2581 chunk_reset(&outbuf);
2582
Willy Tarreauaf1e4f52017-10-30 21:54:49 +01002583 try_again:
Willy Tarreau9e5ae1d2017-10-17 19:58:20 +02002584 while (1) {
2585 outbuf.str = bo_end(h2c->mbuf);
2586 outbuf.size = bo_contig_space(h2c->mbuf);
2587 outbuf.len = 0;
2588
2589 if (outbuf.size >= 9 || !buffer_space_wraps(h2c->mbuf))
2590 break;
2591 realign_again:
2592 buffer_slow_realign(h2c->mbuf);
2593 }
2594
2595 if (outbuf.size < 9) {
2596 h2c->flags |= H2_CF_MUX_MFULL;
2597 h2s->flags |= H2_SF_BLK_MROOM;
2598 ret = 0;
2599 goto end;
2600 }
2601
2602 /* len: 0x000000 (fill later), type: 1(HEADERS), flags: ENDH=4 */
2603 memcpy(outbuf.str, "\x00\x00\x00\x01\x04", 5);
2604 write_n32(outbuf.str + 5, h2s->id); // 4 bytes
2605 outbuf.len = 9;
2606
2607 /* encode status, which necessarily is the first one */
2608 if (outbuf.len < outbuf.size && h1m->status == 200)
2609 outbuf.str[outbuf.len++] = 0x88; // indexed field : idx[08]=(":status", "200")
2610 else if (outbuf.len < outbuf.size && h1m->status == 304)
2611 outbuf.str[outbuf.len++] = 0x8b; // indexed field : idx[11]=(":status", "304")
2612 else if (list[0].v.len == 3 && outbuf.len + 2 + 3 <= outbuf.size) {
2613 /* basic encoding of the status code */
2614 outbuf.str[outbuf.len++] = 0x48; // indexed name -- name=":status" (idx 8)
2615 outbuf.str[outbuf.len++] = 0x03; // 3 bytes status
2616 outbuf.str[outbuf.len++] = list[0].v.ptr[0];
2617 outbuf.str[outbuf.len++] = list[0].v.ptr[1];
2618 outbuf.str[outbuf.len++] = list[0].v.ptr[2];
2619 }
2620 else {
2621 if (buffer_space_wraps(h2c->mbuf))
2622 goto realign_again;
2623
2624 h2c->flags |= H2_CF_MUX_MFULL;
2625 h2s->flags |= H2_SF_BLK_MROOM;
2626 ret = 0;
2627 goto end;
2628 }
2629
2630 /* encode all headers, stop at empty name */
2631 for (hdr = 1; hdr < sizeof(list)/sizeof(list[0]); hdr++) {
Willy Tarreauaf1e4f52017-10-30 21:54:49 +01002632 /* these ones do not exist in H2 and must be dropped. But if we
2633 * see "connection: close", we also perform a graceful shutdown
2634 * on the connection. Note that the match is not perfect but it
2635 * is sufficient for dealing with some deny rules.
2636 */
2637 if (isteq(list[hdr].n, ist("connection"))) {
2638 if (!(h2c->flags & (H2_CF_GOAWAY_SENT|H2_CF_GOAWAY_FAILED)) &&
2639 word_match(list[hdr].v.ptr, list[hdr].v.len, "close", 5)) {
2640 if (h2c->last_sid < 0)
2641 h2c->last_sid = (1U << 31) - 1;
2642 if (h2c_send_goaway_error(h2c, h2s) <= 0) {
2643 ret = 0;
2644 goto end;
2645 }
2646 /* OK sent, but this changed the output buffer's
2647 * contents hence the write position.
2648 */
2649 goto try_again;
2650 }
2651 continue;
2652 }
2653 else if (isteq(list[hdr].n, ist("proxy-connection")) ||
2654 isteq(list[hdr].n, ist("keep-alive")) ||
2655 isteq(list[hdr].n, ist("upgrade")) ||
2656 isteq(list[hdr].n, ist("transfer-encoding")))
Willy Tarreau9e5ae1d2017-10-17 19:58:20 +02002657 continue;
2658
2659 if (isteq(list[hdr].n, ist("")))
2660 break; // end
2661
2662 if (!hpack_encode_header(&outbuf, list[hdr].n, list[hdr].v)) {
2663 /* output full */
2664 if (buffer_space_wraps(h2c->mbuf))
2665 goto realign_again;
2666
2667 h2c->flags |= H2_CF_MUX_MFULL;
2668 h2s->flags |= H2_SF_BLK_MROOM;
2669 ret = 0;
2670 goto end;
2671 }
2672 }
2673
2674 /* we may need to add END_STREAM */
2675 if (((h1m->flags & H1_MF_CLEN) && !h1m->body_len) || h2s->cs->flags & CS_FL_SHW)
2676 es_now = 1;
2677
2678 /* update the frame's size */
2679 h2_set_frame_size(outbuf.str, outbuf.len - 9);
2680
2681 if (es_now)
2682 outbuf.str[4] |= H2_F_HEADERS_END_STREAM;
2683
2684 /* consume incoming H1 response */
2685 bo_del(buf, ret);
2686
2687 /* commit the H2 response */
2688 h2c->mbuf->o += outbuf.len;
2689 h2c->mbuf->p = b_ptr(h2c->mbuf, outbuf.len);
Willy Tarreau67434202017-11-06 20:20:51 +01002690 h2s->flags |= H2_SF_HEADERS_SENT;
Willy Tarreau9e5ae1d2017-10-17 19:58:20 +02002691
2692 /* for now we don't implemented CONTINUATION, so we wait for a
2693 * body or directly end in TRL2.
2694 */
2695 if (es_now) {
2696 h1m->state = HTTP_MSG_DONE;
2697 h2s->flags |= H2_SF_ES_SENT;
2698 if (h2s->st == H2_SS_OPEN)
2699 h2s->st = H2_SS_HLOC;
2700 else
2701 h2s->st = H2_SS_CLOSED;
2702 }
Willy Tarreauc199faf2017-10-31 08:35:27 +01002703 else if (h1m->status >= 100 && h1m->status < 200) {
2704 h1m->state = HTTP_MSG_RPBEFORE;
2705 h1m->status = 0;
2706 h1m->flags = 0;
2707 goto next_header_block;
2708 }
Willy Tarreau9e5ae1d2017-10-17 19:58:20 +02002709 else
2710 h1m->state = (h1m->flags & H1_MF_CLEN) ? HTTP_MSG_BODY : HTTP_MSG_CHUNK_SIZE;
2711
2712 end:
2713 //fprintf(stderr, "[%d] sent simple H2 response (sid=%d) = %d bytes (%d in, ep=%u, es=%s)\n", h2c->st0, h2s->id, outbuf.len, ret, h1m->err_pos, h1_msg_state_str(h1m->err_state));
2714 return ret;
2715}
2716
Willy Tarreauc652dbd2017-10-19 11:16:37 +02002717/* Try to send a DATA frame matching HTTP/1 response present in the response
2718 * buffer <buf>, for stream <h2s>. Returns 0 if not possible yet, <0 on error
2719 * (one of the H2_ERR* or h2_status codes), >0 on success in which case it
2720 * corresponds to the number of buffer bytes consumed.
2721 */
2722static int h2s_frt_make_resp_data(struct h2s *h2s, struct buffer *buf)
2723{
2724 struct h2c *h2c = h2s->h2c;
2725 struct h1m *h1m = &h2s->res;
2726 struct chunk outbuf;
2727 int ret = 0;
2728 int total = 0;
2729 int es_now = 0;
2730 int size = 0;
2731 char *blk1, *blk2;
2732 int len1, len2;
2733
2734 if (h2c_mux_busy(h2c, h2s)) {
2735 h2s->flags |= H2_SF_BLK_MBUSY;
2736 goto end;
2737 }
2738
2739 if (!h2_get_mbuf(h2c)) {
2740 h2c->flags |= H2_CF_MUX_MALLOC;
2741 h2s->flags |= H2_SF_BLK_MROOM;
2742 goto end;
2743 }
2744
2745 new_frame:
2746 if (!buf->o)
2747 goto end;
2748
2749 chunk_reset(&outbuf);
2750
2751 while (1) {
2752 outbuf.str = bo_end(h2c->mbuf);
2753 outbuf.size = bo_contig_space(h2c->mbuf);
2754 outbuf.len = 0;
2755
2756 if (outbuf.size >= 9 || !buffer_space_wraps(h2c->mbuf))
2757 break;
2758 realign_again:
2759 buffer_slow_realign(h2c->mbuf);
2760 }
2761
2762 if (outbuf.size < 9) {
2763 h2c->flags |= H2_CF_MUX_MFULL;
2764 h2s->flags |= H2_SF_BLK_MROOM;
2765 goto end;
2766 }
2767
2768 /* len: 0x000000 (fill later), type: 0(DATA), flags: none=0 */
2769 memcpy(outbuf.str, "\x00\x00\x00\x00\x00", 5);
2770 write_n32(outbuf.str + 5, h2s->id); // 4 bytes
2771 outbuf.len = 9;
2772
2773 switch (h1m->flags & (H1_MF_CLEN|H1_MF_CHNK)) {
2774 case 0: /* no content length, read till SHUTW */
2775 size = buf->o;
2776 break;
2777 case H1_MF_CLEN: /* content-length: read only h2m->body_len */
2778 size = buf->o;
2779 if ((long long)size > h1m->curr_len)
2780 size = h1m->curr_len;
2781 break;
2782 default: /* te:chunked : parse chunks */
2783 if (h1m->state == HTTP_MSG_CHUNK_CRLF) {
2784 ret = h1_skip_chunk_crlf(buf, -buf->o, 0);
2785 if (!ret)
2786 goto end;
2787
2788 if (ret < 0) {
2789 /* FIXME: bad contents. how to proceed here when we're in H2 ? */
2790 h1m->err_pos = ret;
2791 h2s_error(h2s, H2_ERR_INTERNAL_ERROR);
2792 goto end;
2793 }
2794 bo_del(buf, ret);
2795 total += ret;
2796 h1m->state = HTTP_MSG_CHUNK_SIZE;
2797 }
2798
2799 if (h1m->state == HTTP_MSG_CHUNK_SIZE) {
2800 unsigned int chunk;
2801
2802 ret = h1_parse_chunk_size(buf, -buf->o, 0, &chunk);
2803 if (!ret)
2804 goto end;
2805
2806 if (ret < 0) {
2807 /* FIXME: bad contents. how to proceed here when we're in H2 ? */
2808 h1m->err_pos = ret;
2809 h2s_error(h2s, H2_ERR_INTERNAL_ERROR);
2810 goto end;
2811 }
2812
2813 size = chunk;
2814 h1m->curr_len = chunk;
2815 h1m->body_len += chunk;
2816 bo_del(buf, ret);
2817 total += ret;
2818 h1m->state = size ? HTTP_MSG_DATA : HTTP_MSG_TRAILERS;
2819 if (!size)
2820 goto send_empty;
2821 }
2822
2823 /* in MSG_DATA state, continue below */
2824 size = h1m->curr_len;
2825 break;
2826 }
2827
2828 /* we have in <size> the exact number of bytes we need to copy from
2829 * the H1 buffer. We need to check this against the connection's and
2830 * the stream's send windows, and to ensure that this fits in the max
2831 * frame size and in the buffer's available space minus 9 bytes (for
2832 * the frame header). The connection's flow control is applied last so
2833 * that we can use a separate list of streams which are immediately
2834 * unblocked on window opening. Note: we don't implement padding.
2835 */
2836
2837 if (size > buf->o)
2838 size = buf->o;
2839
2840 if (size > h2s->mws)
2841 size = h2s->mws;
2842
2843 if (size <= 0) {
2844 h2s->flags |= H2_SF_BLK_SFCTL;
2845 goto end;
2846 }
2847
2848 if (h2c->mfs && size > h2c->mfs)
2849 size = h2c->mfs;
2850
2851 if (size + 9 > outbuf.size) {
2852 /* we have an opportunity for enlarging the too small
2853 * available space, let's try.
2854 */
2855 if (buffer_space_wraps(h2c->mbuf))
2856 goto realign_again;
2857 size = outbuf.size - 9;
2858 }
2859
2860 if (size <= 0) {
2861 h2c->flags |= H2_CF_MUX_MFULL;
2862 h2s->flags |= H2_SF_BLK_MROOM;
2863 goto end;
2864 }
2865
2866 if (size > h2c->mws)
2867 size = h2c->mws;
2868
2869 if (size <= 0) {
2870 h2s->flags |= H2_SF_BLK_MFCTL;
2871 goto end;
2872 }
2873
2874 /* copy whatever we can */
2875 blk1 = blk2 = NULL; // silence a maybe-uninitialized warning
2876 ret = bo_getblk_nc(buf, &blk1, &len1, &blk2, &len2);
2877 if (ret == 1)
2878 len2 = 0;
2879
2880 if (!ret || len1 + len2 < size) {
2881 /* FIXME: must normally never happen */
2882 h2s_error(h2s, H2_ERR_INTERNAL_ERROR);
2883 goto end;
2884 }
2885
2886 /* limit len1/len2 to size */
2887 if (len1 + len2 > size) {
2888 int sub = len1 + len2 - size;
2889
2890 if (len2 > sub)
2891 len2 -= sub;
2892 else {
2893 sub -= len2;
2894 len2 = 0;
2895 len1 -= sub;
2896 }
2897 }
2898
2899 /* now let's copy this this into the output buffer */
2900 memcpy(outbuf.str + 9, blk1, len1);
2901 if (len2)
2902 memcpy(outbuf.str + 9 + len1, blk2, len2);
2903
2904 send_empty:
2905 /* we may need to add END_STREAM */
2906 /* FIXME: we should also detect shutdown(w) below, but how ? Maybe we
2907 * could rely on the MSG_MORE flag as a hint for this ?
2908 */
2909 if (((h1m->flags & H1_MF_CLEN) && !(h1m->curr_len - size)) ||
2910 !h1m->curr_len || h1m->state >= HTTP_MSG_DONE)
2911 es_now = 1;
2912
2913 /* update the frame's size */
2914 h2_set_frame_size(outbuf.str, size);
2915
2916 if (es_now)
2917 outbuf.str[4] |= H2_F_DATA_END_STREAM;
2918
2919 /* commit the H2 response */
2920 h2c->mbuf->o += size + 9;
2921 h2c->mbuf->p = b_ptr(h2c->mbuf, size + 9);
2922
2923 /* consume incoming H1 response */
2924 if (size > 0) {
2925 bo_del(buf, size);
2926 total += size;
2927 h1m->curr_len -= size;
2928 h2s->mws -= size;
2929 h2c->mws -= size;
2930
2931 if (size && !h1m->curr_len && (h1m->flags & H1_MF_CHNK)) {
2932 h1m->state = HTTP_MSG_CHUNK_CRLF;
2933 goto new_frame;
2934 }
2935 }
2936
2937 if (es_now) {
2938 if (h2s->st == H2_SS_OPEN)
2939 h2s->st = H2_SS_HLOC;
2940 else
2941 h2s->st = H2_SS_CLOSED;
Willy Tarreau9d89ac82017-10-31 17:15:59 +01002942
2943 if (!(h1m->flags & H1_MF_CHNK))
2944 h1m->state = HTTP_MSG_DONE;
2945
Willy Tarreauc652dbd2017-10-19 11:16:37 +02002946 h2s->flags |= H2_SF_ES_SENT;
2947 }
2948
2949 end:
2950 trace("[%d] sent simple H2 DATA response (sid=%d) = %d bytes out (%d in, st=%s, ep=%u, es=%s, h2cws=%d h2sws=%d) buf->o=%d", h2c->st0, h2s->id, size+9, total, h1_msg_state_str(h1m->state), h1m->err_pos, h1_msg_state_str(h1m->err_state), h2c->mws, h2s->mws, buf->o);
2951 return total;
2952}
2953
Willy Tarreau62f52692017-10-08 23:01:42 +02002954/* Called from the upper layer, to send data */
2955static int h2_snd_buf(struct conn_stream *cs, struct buffer *buf, int flags)
2956{
Willy Tarreau9e5ae1d2017-10-17 19:58:20 +02002957 struct h2s *h2s = cs->ctx;
2958 int total = 0;
2959
Willy Tarreauc4312d32017-11-07 12:01:53 +01002960 if (!(h2s->flags & H2_SF_OUTGOING_DATA) && buf->o)
2961 h2s->flags |= H2_SF_OUTGOING_DATA;
2962
Willy Tarreau9e5ae1d2017-10-17 19:58:20 +02002963 while (h2s->res.state < HTTP_MSG_DONE && buf->o) {
2964 if (h2s->res.state < HTTP_MSG_BODY) {
2965 total += h2s_frt_make_resp_headers(h2s, buf);
2966
2967 if (h2s->st == H2_SS_ERROR)
2968 break;
2969
2970 if (h2s->flags & H2_SF_BLK_ANY)
2971 break;
2972 }
Willy Tarreauc652dbd2017-10-19 11:16:37 +02002973 else if (h2s->res.state < HTTP_MSG_TRAILERS) {
2974 total += h2s_frt_make_resp_data(h2s, buf);
2975
2976 if (h2s->st == H2_SS_ERROR)
2977 break;
2978
2979 if (h2s->flags & H2_SF_BLK_ANY)
2980 break;
Willy Tarreau9d89ac82017-10-31 17:15:59 +01002981 }
2982 else if (h2s->res.state == HTTP_MSG_TRAILERS) {
2983 /* consume the trailers if any (we don't forward them for now) */
2984 int count = h1_measure_trailers(buf);
2985
2986 if (unlikely(count <= 0)) {
2987 if (count < 0)
2988 h2s_error(h2s, H2_ERR_INTERNAL_ERROR);
2989 break;
2990 }
2991 total += count;
2992 bo_del(buf, count);
2993 h2s->res.state = HTTP_MSG_DONE;
2994 break;
Willy Tarreauc652dbd2017-10-19 11:16:37 +02002995 }
Willy Tarreau9e5ae1d2017-10-17 19:58:20 +02002996 else {
Willy Tarreau9e5ae1d2017-10-17 19:58:20 +02002997 cs->flags |= CS_FL_ERROR;
2998 break;
2999 }
3000 }
3001
Willy Tarreauc6795ca2017-11-07 09:43:06 +01003002 /* RST are sent similarly to frame acks */
3003 if (h2s->st == H2_SS_ERROR) {
3004 cs->flags |= CS_FL_ERROR;
3005 if (h2c_send_rst_stream(h2s->h2c, h2s) > 0)
3006 h2s->st = H2_SS_CLOSED;
3007 }
3008
Willy Tarreauc652dbd2017-10-19 11:16:37 +02003009 if (h2s->flags & H2_SF_BLK_SFCTL) {
3010 /* stream flow control, quit the list */
3011 LIST_DEL(&h2s->list);
3012 LIST_INIT(&h2s->list);
3013 }
3014
Willy Tarreau9e5ae1d2017-10-17 19:58:20 +02003015 return total;
Willy Tarreau62f52692017-10-08 23:01:42 +02003016}
3017
3018
3019/*******************************************************/
3020/* functions below are dedicated to the config parsers */
3021/*******************************************************/
3022
Willy Tarreaufe20e5b2017-07-27 11:42:14 +02003023/* config parser for global "tune.h2.header-table-size" */
3024static int h2_parse_header_table_size(char **args, int section_type, struct proxy *curpx,
3025 struct proxy *defpx, const char *file, int line,
3026 char **err)
3027{
3028 if (too_many_args(1, args, err, NULL))
3029 return -1;
3030
3031 h2_settings_header_table_size = atoi(args[1]);
3032 if (h2_settings_header_table_size < 4096 || h2_settings_header_table_size > 65536) {
3033 memprintf(err, "'%s' expects a numeric value between 4096 and 65536.", args[0]);
3034 return -1;
3035 }
3036 return 0;
3037}
Willy Tarreau62f52692017-10-08 23:01:42 +02003038
Willy Tarreaue6baec02017-07-27 11:45:11 +02003039/* config parser for global "tune.h2.initial-window-size" */
3040static int h2_parse_initial_window_size(char **args, int section_type, struct proxy *curpx,
3041 struct proxy *defpx, const char *file, int line,
3042 char **err)
3043{
3044 if (too_many_args(1, args, err, NULL))
3045 return -1;
3046
3047 h2_settings_initial_window_size = atoi(args[1]);
3048 if (h2_settings_initial_window_size < 0) {
3049 memprintf(err, "'%s' expects a positive numeric value.", args[0]);
3050 return -1;
3051 }
3052 return 0;
3053}
3054
Willy Tarreau5242ef82017-07-27 11:47:28 +02003055/* config parser for global "tune.h2.max-concurrent-streams" */
3056static int h2_parse_max_concurrent_streams(char **args, int section_type, struct proxy *curpx,
3057 struct proxy *defpx, const char *file, int line,
3058 char **err)
3059{
3060 if (too_many_args(1, args, err, NULL))
3061 return -1;
3062
3063 h2_settings_max_concurrent_streams = atoi(args[1]);
3064 if (h2_settings_max_concurrent_streams < 0) {
3065 memprintf(err, "'%s' expects a positive numeric value.", args[0]);
3066 return -1;
3067 }
3068 return 0;
3069}
3070
Willy Tarreau62f52692017-10-08 23:01:42 +02003071
3072/****************************************/
3073/* MUX initialization and instanciation */
3074/***************************************/
3075
3076/* The mux operations */
3077const struct mux_ops h2_ops = {
3078 .init = h2_init,
3079 .recv = h2_recv,
3080 .send = h2_send,
3081 .wake = h2_wake,
3082 .update_poll = h2_update_poll,
3083 .rcv_buf = h2_rcv_buf,
3084 .snd_buf = h2_snd_buf,
3085 .attach = h2_attach,
3086 .detach = h2_detach,
3087 .shutr = h2_shutr,
3088 .shutw = h2_shutw,
3089 .release = h2_release,
3090 .name = "H2",
3091};
3092
3093/* ALPN selection : this mux registers ALPN tolen "h2" */
3094static struct alpn_mux_list alpn_mux_h2 =
3095 { .token = IST("h2"), .mode = ALPN_MODE_HTTP, .mux = &h2_ops };
3096
3097/* config keyword parsers */
3098static struct cfg_kw_list cfg_kws = {ILH, {
Willy Tarreaufe20e5b2017-07-27 11:42:14 +02003099 { CFG_GLOBAL, "tune.h2.header-table-size", h2_parse_header_table_size },
Willy Tarreaue6baec02017-07-27 11:45:11 +02003100 { CFG_GLOBAL, "tune.h2.initial-window-size", h2_parse_initial_window_size },
Willy Tarreau5242ef82017-07-27 11:47:28 +02003101 { CFG_GLOBAL, "tune.h2.max-concurrent-streams", h2_parse_max_concurrent_streams },
Willy Tarreau62f52692017-10-08 23:01:42 +02003102 { 0, NULL, NULL }
3103}};
3104
Willy Tarreau5ab6b572017-09-22 08:05:00 +02003105static void __h2_deinit(void)
3106{
Willy Tarreau18312642017-10-11 07:57:07 +02003107 pool_destroy2(pool2_h2s);
Willy Tarreau5ab6b572017-09-22 08:05:00 +02003108 pool_destroy2(pool2_h2c);
3109}
3110
Willy Tarreau62f52692017-10-08 23:01:42 +02003111__attribute__((constructor))
3112static void __h2_init(void)
3113{
3114 alpn_register_mux(&alpn_mux_h2);
3115 cfg_register_keywords(&cfg_kws);
Willy Tarreau5ab6b572017-09-22 08:05:00 +02003116 hap_register_post_deinit(__h2_deinit);
3117 pool2_h2c = create_pool("h2c", sizeof(struct h2c), MEM_F_SHARED);
Willy Tarreau18312642017-10-11 07:57:07 +02003118 pool2_h2s = create_pool("h2s", sizeof(struct h2s), MEM_F_SHARED);
Willy Tarreau62f52692017-10-08 23:01:42 +02003119}