blob: 84aa660b70162bf27b6f5ec8be3aff89382b2390 [file] [log] [blame]
Willy Tarreauf24ea8e2017-11-21 19:55:27 +01001/*
2 * HTTP/2 protocol processing
3 *
4 * Copyright 2017 Willy Tarreau <w@1wt.eu>
5 * Copyright (C) 2017 HAProxy Technologies
6 *
7 * Permission is hereby granted, free of charge, to any person obtaining
8 * a copy of this software and associated documentation files (the
9 * "Software"), to deal in the Software without restriction, including
10 * without limitation the rights to use, copy, modify, merge, publish,
11 * distribute, sublicense, and/or sell copies of the Software, and to
12 * permit persons to whom the Software is furnished to do so, subject to
13 * the following conditions:
14 *
15 * The above copyright notice and this permission notice shall be
16 * included in all copies or substantial portions of the Software.
17 *
18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
19 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
20 * OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
21 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
22 * HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
23 * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
24 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
25 * OTHER DEALINGS IN THE SOFTWARE.
26 */
27
Willy Tarreaua1bd1fa2019-03-29 17:26:33 +010028#include <inttypes.h>
Willy Tarreau4c7e4b72020-05-27 12:58:42 +020029#include <haproxy/api.h>
Willy Tarreaub2551052020-06-09 09:07:15 +020030#include <haproxy/global.h>
Willy Tarreaubf073142020-06-03 12:04:01 +020031#include <haproxy/h2.h>
Willy Tarreau0017be02020-06-02 19:25:28 +020032#include <haproxy/http-hdr-t.h>
Willy Tarreaub2551052020-06-09 09:07:15 +020033#include <haproxy/http.h>
Willy Tarreau16f958c2020-06-03 08:44:35 +020034#include <haproxy/htx.h>
Willy Tarreaueb6f7012020-05-27 16:21:26 +020035#include <import/ist.h>
Willy Tarreaub2551052020-06-09 09:07:15 +020036
Willy Tarreauf24ea8e2017-11-21 19:55:27 +010037
Willy Tarreau9c84d822019-01-30 15:09:21 +010038struct h2_frame_definition h2_frame_definition[H2_FT_ENTRIES] = {
39 [H2_FT_DATA ] = { .dir = 3, .min_id = 1, .max_id = H2_MAX_STREAM_ID, .min_len = 0, .max_len = H2_MAX_FRAME_LEN, },
40 [H2_FT_HEADERS ] = { .dir = 3, .min_id = 1, .max_id = H2_MAX_STREAM_ID, .min_len = 1, .max_len = H2_MAX_FRAME_LEN, },
41 [H2_FT_PRIORITY ] = { .dir = 3, .min_id = 1, .max_id = H2_MAX_STREAM_ID, .min_len = 5, .max_len = 5, },
42 [H2_FT_RST_STREAM ] = { .dir = 3, .min_id = 1, .max_id = H2_MAX_STREAM_ID, .min_len = 4, .max_len = 4, },
43 [H2_FT_SETTINGS ] = { .dir = 3, .min_id = 0, .max_id = 0, .min_len = 0, .max_len = H2_MAX_FRAME_LEN, },
44 [H2_FT_PUSH_PROMISE ] = { .dir = 0, .min_id = 1, .max_id = H2_MAX_STREAM_ID, .min_len = 4, .max_len = H2_MAX_FRAME_LEN, },
45 [H2_FT_PING ] = { .dir = 3, .min_id = 0, .max_id = 0, .min_len = 8, .max_len = 8, },
46 [H2_FT_GOAWAY ] = { .dir = 3, .min_id = 0, .max_id = 0, .min_len = 8, .max_len = H2_MAX_FRAME_LEN, },
47 [H2_FT_WINDOW_UPDATE] = { .dir = 3, .min_id = 0, .max_id = H2_MAX_STREAM_ID, .min_len = 4, .max_len = 4, },
48 [H2_FT_CONTINUATION ] = { .dir = 3, .min_id = 1, .max_id = H2_MAX_STREAM_ID, .min_len = 0, .max_len = H2_MAX_FRAME_LEN, },
49};
Willy Tarreauf24ea8e2017-11-21 19:55:27 +010050
Willy Tarreau54f53ef2019-11-22 16:02:43 +010051/* Looks into <ist> for forbidden characters for header values (0x00, 0x0A,
52 * 0x0D), starting at pointer <start> which must be within <ist>. Returns
53 * non-zero if such a character is found, 0 otherwise. When run on unlikely
54 * header match, it's recommended to first check for the presence of control
55 * chars using ist_find_ctl().
56 */
57static int has_forbidden_char(const struct ist ist, const char *start)
58{
59 do {
60 if ((uint8_t)*start <= 0x0d &&
61 (1U << (uint8_t)*start) & ((1<<13) | (1<<10) | (1<<0)))
62 return 1;
63 start++;
64 } while (start < ist.ptr + ist.len);
65 return 0;
66}
67
Willy Tarreaubeefaee2018-12-19 13:08:08 +010068/* Parse the Content-Length header field of an HTTP/2 request. The function
69 * checks all possible occurrences of a comma-delimited value, and verifies
70 * if any of them doesn't match a previous value. It returns <0 if a value
71 * differs, 0 if the whole header can be dropped (i.e. already known), or >0
72 * if the value can be indexed (first one). In the last case, the value might
73 * be adjusted and the caller must only add the updated value.
74 */
75int h2_parse_cont_len_header(unsigned int *msgf, struct ist *value, unsigned long long *body_len)
76{
77 char *e, *n;
78 unsigned long long cl;
79 int not_first = !!(*msgf & H2_MSGF_BODY_CL);
80 struct ist word;
81
82 word.ptr = value->ptr - 1; // -1 for next loop's pre-increment
83 e = value->ptr + value->len;
84
85 while (++word.ptr < e) {
Ilya Shipitsin6fb0f212020-04-02 15:25:26 +050086 /* skip leading delimiter and blanks */
Willy Tarreaubeefaee2018-12-19 13:08:08 +010087 if (unlikely(HTTP_IS_LWS(*word.ptr)))
88 continue;
89
90 /* digits only now */
91 for (cl = 0, n = word.ptr; n < e; n++) {
92 unsigned int c = *n - '0';
93 if (unlikely(c > 9)) {
94 /* non-digit */
95 if (unlikely(n == word.ptr)) // spaces only
96 goto fail;
97 break;
98 }
99 if (unlikely(cl > ULLONG_MAX / 10ULL))
100 goto fail; /* multiply overflow */
101 cl = cl * 10ULL;
102 if (unlikely(cl + c < cl))
103 goto fail; /* addition overflow */
104 cl = cl + c;
105 }
106
107 /* keep a copy of the exact cleaned value */
108 word.len = n - word.ptr;
109
110 /* skip trailing LWS till next comma or EOL */
111 for (; n < e; n++) {
112 if (!HTTP_IS_LWS(*n)) {
113 if (unlikely(*n != ','))
114 goto fail;
115 break;
116 }
117 }
118
119 /* if duplicate, must be equal */
120 if (*msgf & H2_MSGF_BODY_CL && cl != *body_len)
121 goto fail;
122
123 /* OK, store this result as the one to be indexed */
124 *msgf |= H2_MSGF_BODY_CL;
125 *body_len = cl;
126 *value = word;
127 word.ptr = n;
128 }
129 /* here we've reached the end with a single value or a series of
130 * identical values, all matching previous series if any. The last
131 * parsed value was sent back into <value>. We just have to decide
132 * if this occurrence has to be indexed (it's the first one) or
133 * silently skipped (it's not the first one)
134 */
135 return !not_first;
136 fail:
137 return -1;
138}
139
Willy Tarreau6deb4122018-11-27 15:34:18 +0100140/* Prepare the request line into <htx> from pseudo headers stored in <phdr[]>.
141 * <fields> indicates what was found so far. This should be called once at the
142 * detection of the first general header field or at the end of the request if
143 * no general header field was found yet. Returns the created start line on
144 * success, or NULL on failure. Upon success, <msgf> is updated with a few
145 * H2_MSGF_* flags indicating what was found while parsing.
Willy Tarreau2be362c2019-10-08 11:59:37 +0200146 *
147 * The rules below deserve a bit of explanation. There tends to be some
148 * confusion regarding H2's authority vs the Host header. They are different
149 * though may sometimes be exchanged. In H2, the request line is broken into :
150 * - :method
151 * - :scheme
152 * - :authority
153 * - :path
154 *
155 * An equivalent HTTP/1.x absolute-form request would then look like :
156 * <:method> <:scheme>://<:authority><:path> HTTP/x.y
157 *
158 * Except for CONNECT which doesn't have scheme nor path and looks like :
159 * <:method> <:authority> HTTP/x.y
160 *
161 * It's worth noting that H2 still supports an encoding to map H1 origin-form
162 * and asterisk-form requests. These ones do not specify the authority. However
163 * in H2 they must still specify the scheme, which is not present in H1. Also,
164 * when encoding an absolute-form H1 request without a path, the path
165 * automatically becomes "/" except for the OPTIONS method where it
166 * becomes "*".
167 *
168 * As such it is explicitly permitted for an H2 client to send a request
169 * featuring a Host header and no :authority, though it's not the recommended
170 * way to use H2 for a client. It is however the only permitted way to encode
171 * an origin-form H1 request over H2. Thus we need to respect such differences
172 * as much as possible when re-encoding the H2 request into HTX.
Willy Tarreau6deb4122018-11-27 15:34:18 +0100173 */
174static struct htx_sl *h2_prepare_htx_reqline(uint32_t fields, struct ist *phdr, struct htx *htx, unsigned int *msgf)
175{
Amaury Denoyellec9a0afc2020-12-11 17:53:09 +0100176 struct ist uri, meth_sl;
Willy Tarreau6deb4122018-11-27 15:34:18 +0100177 unsigned int flags = HTX_SL_F_NONE;
178 struct htx_sl *sl;
Willy Tarreau9255e7e2019-03-05 10:47:37 +0100179 size_t i;
Willy Tarreau6deb4122018-11-27 15:34:18 +0100180
181 if ((fields & H2_PHDR_FND_METH) && isteq(phdr[H2_PHDR_IDX_METH], ist("CONNECT"))) {
Amaury Denoyellec9a0afc2020-12-11 17:53:09 +0100182 if (fields & H2_PHDR_FND_PROT) {
183 /* rfc 8441 Extended Connect Protocol
184 * #4 :scheme and :path must be present, as well as
185 * :authority like all h2 requests
186 */
187 if (!(fields & H2_PHDR_FND_SCHM)) {
188 /* missing scheme */
189 goto fail;
190 }
191 else if (!(fields & H2_PHDR_FND_PATH)) {
192 /* missing path */
193 goto fail;
194 }
195 else if (!(fields & H2_PHDR_FND_AUTH)) {
196 /* missing authority */
197 goto fail;
198 }
199
200 flags |= HTX_SL_F_HAS_SCHM;
201 if (isteqi(phdr[H2_PHDR_IDX_SCHM], ist("http")))
202 flags |= HTX_SL_F_SCHM_HTTP;
203 else if (isteqi(phdr[H2_PHDR_IDX_SCHM], ist("https")))
204 flags |= HTX_SL_F_SCHM_HTTPS;
205
206 meth_sl = ist("GET");
207
208 *msgf |= H2_MSGF_EXT_CONNECT;
209 /* no ES on the HEADERS frame but no body either for
210 * Extended CONNECT */
211 *msgf &= ~H2_MSGF_BODY;
Willy Tarreau6deb4122018-11-27 15:34:18 +0100212 }
Amaury Denoyellec9a0afc2020-12-11 17:53:09 +0100213 else {
214 /* RFC 7540 #8.2.6 regarding CONNECT: ":scheme" and ":path"
215 * MUST be omitted ; ":authority" contains the host and port
216 * to connect to.
217 */
218 if (fields & H2_PHDR_FND_SCHM) {
219 /* scheme not allowed */
220 goto fail;
221 }
222 else if (fields & H2_PHDR_FND_PATH) {
223 /* path not allowed */
224 goto fail;
225 }
226 else if (!(fields & H2_PHDR_FND_AUTH)) {
227 /* missing authority */
228 goto fail;
229 }
230
231 meth_sl = phdr[H2_PHDR_IDX_METH];
Willy Tarreau6deb4122018-11-27 15:34:18 +0100232 }
Amaury Denoyellec9a0afc2020-12-11 17:53:09 +0100233
Willy Tarreau6deb4122018-11-27 15:34:18 +0100234 *msgf |= H2_MSGF_BODY_TUNNEL;
235 }
236 else if ((fields & (H2_PHDR_FND_METH|H2_PHDR_FND_SCHM|H2_PHDR_FND_PATH)) !=
237 (H2_PHDR_FND_METH|H2_PHDR_FND_SCHM|H2_PHDR_FND_PATH)) {
238 /* RFC 7540 #8.1.2.3 : all requests MUST include exactly one
239 * valid value for the ":method", ":scheme" and ":path" phdr
240 * unless it is a CONNECT request.
241 */
242 if (!(fields & H2_PHDR_FND_METH)) {
243 /* missing method */
244 goto fail;
245 }
246 else if (!(fields & H2_PHDR_FND_SCHM)) {
247 /* missing scheme */
248 goto fail;
249 }
250 else {
251 /* missing path */
252 goto fail;
253 }
254 }
Willy Tarreau2be362c2019-10-08 11:59:37 +0200255 else { /* regular methods */
Willy Tarreau92919f72019-10-08 16:53:07 +0200256 /* RFC3986#6.2.2.1: scheme is case-insensitive. We need to
257 * classify the scheme as "present/http", "present/https",
258 * "present/other", "absent" so as to decide whether or not
259 * we're facing a normalized URI that will have to be encoded
260 * in origin or absolute form. Indeed, 7540#8.1.2.3 says that
261 * clients should use the absolute form, thus we cannot infer
262 * whether or not the client wanted to use a proxy here.
263 */
264 flags |= HTX_SL_F_HAS_SCHM;
265 if (isteqi(phdr[H2_PHDR_IDX_SCHM], ist("http")))
266 flags |= HTX_SL_F_SCHM_HTTP;
267 else if (isteqi(phdr[H2_PHDR_IDX_SCHM], ist("https")))
268 flags |= HTX_SL_F_SCHM_HTTPS;
Amaury Denoyellec9a0afc2020-12-11 17:53:09 +0100269
270 meth_sl = phdr[H2_PHDR_IDX_METH];
Willy Tarreau92919f72019-10-08 16:53:07 +0200271 }
272
273 if (!(flags & HTX_SL_F_HAS_SCHM)) {
274 /* no scheme, use authority only (CONNECT) */
275 uri = phdr[H2_PHDR_IDX_AUTH];
Willy Tarreau1440fe82019-10-08 17:34:50 +0200276 flags |= HTX_SL_F_HAS_AUTHORITY;
Willy Tarreau92919f72019-10-08 16:53:07 +0200277 }
Willy Tarreau30ee1ef2019-10-08 18:33:19 +0200278 else if (fields & H2_PHDR_FND_AUTH) {
279 /* authority is present, let's use the absolute form. We simply
280 * use the trash to concatenate them since all of them MUST fit
281 * in a bufsize since it's where they come from.
Willy Tarreau92919f72019-10-08 16:53:07 +0200282 */
Willy Tarreaufd2658c2020-02-26 13:51:38 +0100283 if (unlikely(!phdr[H2_PHDR_IDX_PATH].len))
284 goto fail; // 7540#8.1.2.3: :path must not be empty
285
Willy Tarreau92919f72019-10-08 16:53:07 +0200286 uri = ist2bin(trash.area, phdr[H2_PHDR_IDX_SCHM]);
287 istcat(&uri, ist("://"), trash.size);
288 istcat(&uri, phdr[H2_PHDR_IDX_AUTH], trash.size);
289 if (!isteq(phdr[H2_PHDR_IDX_PATH], ist("*")))
290 istcat(&uri, phdr[H2_PHDR_IDX_PATH], trash.size);
Willy Tarreau1440fe82019-10-08 17:34:50 +0200291 flags |= HTX_SL_F_HAS_AUTHORITY;
Willy Tarreau30ee1ef2019-10-08 18:33:19 +0200292
293 if (flags & (HTX_SL_F_SCHM_HTTP|HTX_SL_F_SCHM_HTTPS)) {
294 /* we don't know if it was originally an absolute or a
295 * relative request because newer versions of HTTP use
296 * the absolute URI format by default, which we call
297 * the normalized URI format internally. This is the
298 * strongly recommended way of sending a request for
299 * a regular client, so we cannot distinguish this
300 * from a request intended for a proxy. For other
301 * schemes however there is no doubt.
302 */
303 flags |= HTX_SL_F_NORMALIZED_URI;
304 }
Willy Tarreau92919f72019-10-08 16:53:07 +0200305 }
306 else {
307 /* usual schemes with or without authority, use origin form */
308 uri = phdr[H2_PHDR_IDX_PATH];
Willy Tarreau1440fe82019-10-08 17:34:50 +0200309 if (fields & H2_PHDR_FND_AUTH)
310 flags |= HTX_SL_F_HAS_AUTHORITY;
Willy Tarreau2be362c2019-10-08 11:59:37 +0200311 }
Willy Tarreau6deb4122018-11-27 15:34:18 +0100312
Willy Tarreau2be362c2019-10-08 11:59:37 +0200313 /* make sure the final URI isn't empty. Note that 7540#8.1.2.3 states
314 * that :path must not be empty.
315 */
Willy Tarreau92919f72019-10-08 16:53:07 +0200316 if (!uri.len)
Willy Tarreau6deb4122018-11-27 15:34:18 +0100317 goto fail;
318
Willy Tarreau2be362c2019-10-08 11:59:37 +0200319 /* The final URI must not contain LWS nor CTL characters */
Willy Tarreau92919f72019-10-08 16:53:07 +0200320 for (i = 0; i < uri.len; i++) {
321 unsigned char c = uri.ptr[i];
Willy Tarreau9255e7e2019-03-05 10:47:37 +0100322 if (HTTP_IS_LWS(c) || HTTP_IS_CTL(c))
323 htx->flags |= HTX_FL_PARSING_ERROR;
324 }
325
Willy Tarreau6deb4122018-11-27 15:34:18 +0100326 /* Set HTX start-line flags */
327 flags |= HTX_SL_F_VER_11; // V2 in fact
328 flags |= HTX_SL_F_XFER_LEN; // xfer len always known with H2
329
Amaury Denoyellec9a0afc2020-12-11 17:53:09 +0100330 sl = htx_add_stline(htx, HTX_BLK_REQ_SL, flags, meth_sl, uri, ist("HTTP/2.0"));
Willy Tarreau6deb4122018-11-27 15:34:18 +0100331 if (!sl)
332 goto fail;
333
Amaury Denoyellec9a0afc2020-12-11 17:53:09 +0100334 sl->info.req.meth = find_http_meth(meth_sl.ptr, meth_sl.len);
Christopher Faulet7d247f02020-12-02 14:26:36 +0100335 if (sl->info.req.meth == HTTP_METH_HEAD)
336 *msgf |= H2_MSGF_BODYLESS_RSP;
Willy Tarreau6deb4122018-11-27 15:34:18 +0100337 return sl;
338 fail:
339 return NULL;
340}
341
342/* Takes an H2 request present in the headers list <list> terminated by a name
343 * being <NULL,0> and emits the equivalent HTX request according to the rules
344 * documented in RFC7540 #8.1.2. The output contents are emitted in <htx>, and
345 * non-zero is returned if some bytes were emitted. In case of error, a
346 * negative error code is returned.
347 *
348 * Upon success, <msgf> is filled with a few H2_MSGF_* flags indicating what
349 * was found while parsing. The caller must set it to zero in or H2_MSGF_BODY
350 * if a body is detected (!ES).
351 *
352 * The headers list <list> must be composed of :
353 * - n.name != NULL, n.len > 0 : literal header name
354 * - n.name == NULL, n.len > 0 : indexed pseudo header name number <n.len>
355 * among H2_PHDR_IDX_*
356 * - n.name ignored, n.len == 0 : end of list
357 * - in all cases except the end of list, v.name and v.len must designate a
358 * valid value.
359 *
360 * The Cookie header will be reassembled at the end, and for this, the <list>
361 * will be used to create a linked list, so its contents may be destroyed.
362 */
Willy Tarreau4790f7c2019-01-24 11:33:02 +0100363int h2_make_htx_request(struct http_hdr *list, struct htx *htx, unsigned int *msgf, unsigned long long *body_len)
Willy Tarreau6deb4122018-11-27 15:34:18 +0100364{
365 struct ist phdr_val[H2_PHDR_NUM_ENTRIES];
366 uint32_t fields; /* bit mask of H2_PHDR_FND_* */
367 uint32_t idx;
368 int ck, lck; /* cookie index and last cookie index */
369 int phdr;
370 int ret;
371 int i;
Christopher Faulet33543e72019-05-15 15:53:20 +0200372 uint32_t used = htx_used_space(htx);
Willy Tarreau6deb4122018-11-27 15:34:18 +0100373 struct htx_sl *sl = NULL;
374 unsigned int sl_flags = 0;
Willy Tarreau54f53ef2019-11-22 16:02:43 +0100375 const char *ctl;
Willy Tarreau6deb4122018-11-27 15:34:18 +0100376
377 lck = ck = -1; // no cookie for now
378 fields = 0;
379 for (idx = 0; list[idx].n.len != 0; idx++) {
380 if (!list[idx].n.ptr) {
381 /* this is an indexed pseudo-header */
382 phdr = list[idx].n.len;
383 }
384 else {
385 /* this can be any type of header */
Willy Tarreau146f53a2019-11-24 10:34:39 +0100386 /* RFC7540#8.1.2: upper case not allowed in header field names.
387 * #10.3: header names must be valid (i.e. match a token).
388 * For pseudo-headers we check from 2nd char and for other ones
389 * from the first char, because HTTP_IS_TOKEN() also excludes
390 * the colon.
391 */
Willy Tarreau6deb4122018-11-27 15:34:18 +0100392 phdr = h2_str_to_phdr(list[idx].n);
Willy Tarreau146f53a2019-11-24 10:34:39 +0100393
394 for (i = !!phdr; i < list[idx].n.len; i++)
395 if ((uint8_t)(list[idx].n.ptr[i] - 'A') < 'Z' - 'A' || !HTTP_IS_TOKEN(list[idx].n.ptr[i]))
396 goto fail;
Willy Tarreau6deb4122018-11-27 15:34:18 +0100397 }
398
Willy Tarreau54f53ef2019-11-22 16:02:43 +0100399 /* RFC7540#10.3: intermediaries forwarding to HTTP/1 must take care of
400 * rejecting NUL, CR and LF characters.
401 */
402 ctl = ist_find_ctl(list[idx].v);
403 if (unlikely(ctl) && has_forbidden_char(list[idx].v, ctl))
404 goto fail;
405
Willy Tarreau6deb4122018-11-27 15:34:18 +0100406 if (phdr > 0 && phdr < H2_PHDR_NUM_ENTRIES) {
407 /* insert a pseudo header by its index (in phdr) and value (in value) */
408 if (fields & ((1 << phdr) | H2_PHDR_FND_NONE)) {
409 if (fields & H2_PHDR_FND_NONE) {
410 /* pseudo header field after regular headers */
411 goto fail;
412 }
413 else {
414 /* repeated pseudo header field */
415 goto fail;
416 }
417 }
418 fields |= 1 << phdr;
419 phdr_val[phdr] = list[idx].v;
420 continue;
421 }
422 else if (phdr != 0) {
423 /* invalid pseudo header -- should never happen here */
424 goto fail;
425 }
426
427 /* regular header field in (name,value) */
428 if (unlikely(!(fields & H2_PHDR_FND_NONE))) {
429 /* no more pseudo-headers, time to build the request line */
430 sl = h2_prepare_htx_reqline(fields, phdr_val, htx, msgf);
431 if (!sl)
432 goto fail;
433 fields |= H2_PHDR_FND_NONE;
434 }
435
436 if (isteq(list[idx].n, ist("host")))
437 fields |= H2_PHDR_FND_HOST;
438
Willy Tarreaubeefaee2018-12-19 13:08:08 +0100439 if (isteq(list[idx].n, ist("content-length"))) {
Willy Tarreau4790f7c2019-01-24 11:33:02 +0100440 ret = h2_parse_cont_len_header(msgf, &list[idx].v, body_len);
Willy Tarreaubeefaee2018-12-19 13:08:08 +0100441 if (ret < 0)
442 goto fail;
443
Willy Tarreau6deb4122018-11-27 15:34:18 +0100444 sl_flags |= HTX_SL_F_CLEN;
Willy Tarreaubeefaee2018-12-19 13:08:08 +0100445 if (ret == 0)
446 continue; // skip this duplicate
Willy Tarreau6deb4122018-11-27 15:34:18 +0100447 }
448
449 /* these ones are forbidden in requests (RFC7540#8.1.2.2) */
450 if (isteq(list[idx].n, ist("connection")) ||
451 isteq(list[idx].n, ist("proxy-connection")) ||
452 isteq(list[idx].n, ist("keep-alive")) ||
453 isteq(list[idx].n, ist("upgrade")) ||
454 isteq(list[idx].n, ist("transfer-encoding")))
455 goto fail;
456
457 if (isteq(list[idx].n, ist("te")) && !isteq(list[idx].v, ist("trailers")))
458 goto fail;
459
460 /* cookie requires special processing at the end */
461 if (isteq(list[idx].n, ist("cookie"))) {
462 list[idx].n.len = -1;
463
464 if (ck < 0)
465 ck = idx;
466 else
467 list[lck].n.len = idx;
468
469 lck = idx;
470 continue;
471 }
472
473 if (!htx_add_header(htx, list[idx].n, list[idx].v))
474 goto fail;
475 }
476
477 /* RFC7540#8.1.2.1 mandates to reject response pseudo-headers (:status) */
478 if (fields & H2_PHDR_FND_STAT)
479 goto fail;
480
481 /* Let's dump the request now if not yet emitted. */
482 if (!(fields & H2_PHDR_FND_NONE)) {
483 sl = h2_prepare_htx_reqline(fields, phdr_val, htx, msgf);
484 if (!sl)
485 goto fail;
486 }
487
Christopher Fauletd0db4232021-01-22 11:46:30 +0100488 if (*msgf & H2_MSGF_BODY_TUNNEL)
489 *msgf &= ~(H2_MSGF_BODY|H2_MSGF_BODY_CL);
490
Christopher Fauletd1ac2b92020-12-02 19:12:22 +0100491 if (!(*msgf & H2_MSGF_BODY) || ((*msgf & H2_MSGF_BODY_CL) && *body_len == 0) ||
492 (*msgf & H2_MSGF_BODY_TUNNEL)) {
493 /* Request without body or tunnel requested */
Christopher Faulet44af3cf2019-02-18 10:12:56 +0100494 sl_flags |= HTX_SL_F_BODYLESS;
Christopher Fauletd1ac2b92020-12-02 19:12:22 +0100495 htx->flags |= HTX_FL_EOM;
496 }
Christopher Faulet44af3cf2019-02-18 10:12:56 +0100497
Amaury Denoyellec9a0afc2020-12-11 17:53:09 +0100498 if (*msgf & H2_MSGF_EXT_CONNECT) {
499 if (!htx_add_header(htx, ist("upgrade"), phdr_val[H2_PHDR_IDX_PROT]))
500 goto fail;
501 if (!htx_add_header(htx, ist("connection"), ist("upgrade")))
502 goto fail;
503 sl_flags |= HTX_SL_F_CONN_UPG;
504 }
505
Willy Tarreau6deb4122018-11-27 15:34:18 +0100506 /* update the start line with last detected header info */
507 sl->flags |= sl_flags;
508
509 /* complete with missing Host if needed */
510 if ((fields & (H2_PHDR_FND_HOST|H2_PHDR_FND_AUTH)) == H2_PHDR_FND_AUTH) {
511 /* missing Host field, use :authority instead */
512 if (!htx_add_header(htx, ist("host"), phdr_val[H2_PHDR_IDX_AUTH]))
513 goto fail;
514 }
515
516 /* now we may have to build a cookie list. We'll dump the values of all
517 * visited headers.
518 */
519 if (ck >= 0) {
520 uint32_t fs; // free space
521 uint32_t bs; // block size
522 uint32_t vl; // value len
Willy Tarreau164e0612018-12-18 11:00:41 +0100523 uint32_t tl; // total length
Willy Tarreau6deb4122018-11-27 15:34:18 +0100524 struct htx_blk *blk;
525
526 blk = htx_add_header(htx, ist("cookie"), list[ck].v);
527 if (!blk)
528 goto fail;
529
Willy Tarreau164e0612018-12-18 11:00:41 +0100530 tl = list[ck].v.len;
Willy Tarreau6deb4122018-11-27 15:34:18 +0100531 fs = htx_free_data_space(htx);
532 bs = htx_get_blksz(blk);
533
534 /* for each extra cookie, we'll extend the cookie's value and
535 * insert "; " before the new value.
536 */
Willy Tarreau164e0612018-12-18 11:00:41 +0100537 fs += tl; // first one is already counted
538 for (; (ck = list[ck].n.len) >= 0 ; ) {
Willy Tarreau6deb4122018-11-27 15:34:18 +0100539 vl = list[ck].v.len;
Willy Tarreau164e0612018-12-18 11:00:41 +0100540 tl += vl + 2;
541 if (tl > fs)
Willy Tarreau6deb4122018-11-27 15:34:18 +0100542 goto fail;
543
Christopher Faulet3e2638e2019-06-18 09:49:16 +0200544 htx_change_blk_value_len(htx, blk, tl);
Willy Tarreau6deb4122018-11-27 15:34:18 +0100545 *(char *)(htx_get_blk_ptr(htx, blk) + bs + 0) = ';';
546 *(char *)(htx_get_blk_ptr(htx, blk) + bs + 1) = ' ';
547 memcpy(htx_get_blk_ptr(htx, blk) + bs + 2, list[ck].v.ptr, vl);
548 bs += vl + 2;
Willy Tarreau6deb4122018-11-27 15:34:18 +0100549 }
550
551 }
552
553 /* now send the end of headers marker */
Christopher Faulet5be651d2021-01-22 15:28:03 +0100554 if (!htx_add_endof(htx, HTX_BLK_EOH))
555 goto fail;
Willy Tarreau6deb4122018-11-27 15:34:18 +0100556
Ilya Shipitsin6fb0f212020-04-02 15:25:26 +0500557 /* Set bytes used in the HTX message for the headers now */
Christopher Faulet33543e72019-05-15 15:53:20 +0200558 sl->hdrs_bytes = htx_used_space(htx) - used;
559
Willy Tarreau6deb4122018-11-27 15:34:18 +0100560 ret = 1;
561 return ret;
562
563 fail:
564 return -1;
565}
Willy Tarreau1329b5b2018-10-08 14:49:20 +0200566
567/* Prepare the status line into <htx> from pseudo headers stored in <phdr[]>.
568 * <fields> indicates what was found so far. This should be called once at the
569 * detection of the first general header field or at the end of the message if
570 * no general header field was found yet. Returns the created start line on
571 * success, or NULL on failure. Upon success, <msgf> is updated with a few
572 * H2_MSGF_* flags indicating what was found while parsing.
573 */
574static struct htx_sl *h2_prepare_htx_stsline(uint32_t fields, struct ist *phdr, struct htx *htx, unsigned int *msgf)
575{
Christopher Faulet89899422020-12-07 18:24:43 +0100576 unsigned int status, flags = HTX_SL_F_NONE;
Willy Tarreau1329b5b2018-10-08 14:49:20 +0200577 struct htx_sl *sl;
Amaury Denoyelle74162742020-12-11 17:53:05 +0100578 struct ist stat;
Willy Tarreau1329b5b2018-10-08 14:49:20 +0200579
580 /* only :status is allowed as a pseudo header */
581 if (!(fields & H2_PHDR_FND_STAT))
582 goto fail;
583
584 if (phdr[H2_PHDR_IDX_STAT].len != 3)
585 goto fail;
586
Amaury Denoyelle74162742020-12-11 17:53:05 +0100587 /* if Extended CONNECT is used, convert status code from 200 to htx 101
588 * following rfc 8441 */
589 if (unlikely(*msgf & H2_MSGF_EXT_CONNECT) &&
590 isteq(phdr[H2_PHDR_IDX_STAT], ist("200"))) {
591 stat = ist("101");
592 status = 101;
593 }
594 else {
595 unsigned char h, t, u;
596
597 stat = phdr[H2_PHDR_IDX_STAT];
598
599 h = stat.ptr[0] - '0';
600 t = stat.ptr[1] - '0';
601 u = stat.ptr[2] - '0';
602 if (h > 9 || t > 9 || u > 9)
603 goto fail;
604 status = h * 100 + t * 10 + u;
605 }
Willy Tarreau1329b5b2018-10-08 14:49:20 +0200606
Christopher Faulet89899422020-12-07 18:24:43 +0100607 /* 101 responses are not supported in H2, so return a error.
608 * On 1xx responses there is no ES on the HEADERS frame but there is no
609 * body. So remove the flag H2_MSGF_BODY and add H2_MSGF_RSP_1XX to
610 * notify the decoder another HEADERS frame is expected.
Ilya Shipitsinacf84592021-02-06 22:29:08 +0500611 * 204/304 response have no body by definition. So remove the flag
Christopher Faulet7d247f02020-12-02 14:26:36 +0100612 * H2_MSGF_BODY and set H2_MSGF_BODYLESS_RSP.
Amaury Denoyelle74162742020-12-11 17:53:05 +0100613 *
614 * Note however that there is a special condition for Extended CONNECT.
615 * In this case, we explicitly convert it to HTX 101 to mimic
616 * Get+Upgrade HTTP/1.1 mechanism
Christopher Faulet0b465482019-02-19 15:14:23 +0100617 */
Amaury Denoyelle74162742020-12-11 17:53:05 +0100618 if (status == 101) {
619 if (!(*msgf & H2_MSGF_EXT_CONNECT))
620 goto fail;
621 }
Christopher Faulet89899422020-12-07 18:24:43 +0100622 else if (status < 200) {
Christopher Faulet0b465482019-02-19 15:14:23 +0100623 *msgf |= H2_MSGF_RSP_1XX;
624 *msgf &= ~H2_MSGF_BODY;
625 }
Amaury Denoyelle74162742020-12-11 17:53:05 +0100626 else if (status == 204 || status == 304) {
Christopher Faulet7d247f02020-12-02 14:26:36 +0100627 *msgf &= ~H2_MSGF_BODY;
628 *msgf |= H2_MSGF_BODYLESS_RSP;
629 }
Christopher Faulet0b465482019-02-19 15:14:23 +0100630
Christopher Faulet89899422020-12-07 18:24:43 +0100631 /* Set HTX start-line flags */
632 flags |= HTX_SL_F_VER_11; // V2 in fact
633 flags |= HTX_SL_F_XFER_LEN; // xfer len always known with H2
634
Amaury Denoyelle74162742020-12-11 17:53:05 +0100635 sl = htx_add_stline(htx, HTX_BLK_RES_SL, flags, ist("HTTP/2.0"), stat, ist(""));
Christopher Faulet89899422020-12-07 18:24:43 +0100636 if (!sl)
637 goto fail;
638 sl->info.res.status = status;
Willy Tarreau1329b5b2018-10-08 14:49:20 +0200639 return sl;
640 fail:
641 return NULL;
642}
643
644/* Takes an H2 response present in the headers list <list> terminated by a name
645 * being <NULL,0> and emits the equivalent HTX response according to the rules
646 * documented in RFC7540 #8.1.2. The output contents are emitted in <htx>, and
647 * a positive value is returned if some bytes were emitted. In case of error, a
648 * negative error code is returned.
649 *
650 * Upon success, <msgf> is filled with a few H2_MSGF_* flags indicating what
651 * was found while parsing. The caller must set it to zero in or H2_MSGF_BODY
652 * if a body is detected (!ES).
653 *
654 * The headers list <list> must be composed of :
655 * - n.name != NULL, n.len > 0 : literal header name
656 * - n.name == NULL, n.len > 0 : indexed pseudo header name number <n.len>
657 * among H2_PHDR_IDX_*
658 * - n.name ignored, n.len == 0 : end of list
659 * - in all cases except the end of list, v.name and v.len must designate a
660 * valid value.
Amaury Denoyelle74162742020-12-11 17:53:05 +0100661 *
662 * <upgrade_protocol> is only used if the htx status code is 101 indicating a
663 * response to an upgrade or h2-equivalent request.
Willy Tarreau1329b5b2018-10-08 14:49:20 +0200664 */
Amaury Denoyelle74162742020-12-11 17:53:05 +0100665int h2_make_htx_response(struct http_hdr *list, struct htx *htx, unsigned int *msgf, unsigned long long *body_len, char *upgrade_protocol)
Willy Tarreau1329b5b2018-10-08 14:49:20 +0200666{
667 struct ist phdr_val[H2_PHDR_NUM_ENTRIES];
668 uint32_t fields; /* bit mask of H2_PHDR_FND_* */
669 uint32_t idx;
670 int phdr;
671 int ret;
672 int i;
Christopher Faulet33543e72019-05-15 15:53:20 +0200673 uint32_t used = htx_used_space(htx);
Willy Tarreau1329b5b2018-10-08 14:49:20 +0200674 struct htx_sl *sl = NULL;
675 unsigned int sl_flags = 0;
Willy Tarreau54f53ef2019-11-22 16:02:43 +0100676 const char *ctl;
Willy Tarreau1329b5b2018-10-08 14:49:20 +0200677
678 fields = 0;
679 for (idx = 0; list[idx].n.len != 0; idx++) {
680 if (!list[idx].n.ptr) {
681 /* this is an indexed pseudo-header */
682 phdr = list[idx].n.len;
683 }
684 else {
685 /* this can be any type of header */
Willy Tarreau146f53a2019-11-24 10:34:39 +0100686 /* RFC7540#8.1.2: upper case not allowed in header field names.
687 * #10.3: header names must be valid (i.e. match a token).
688 * For pseudo-headers we check from 2nd char and for other ones
689 * from the first char, because HTTP_IS_TOKEN() also excludes
690 * the colon.
691 */
Willy Tarreau1329b5b2018-10-08 14:49:20 +0200692 phdr = h2_str_to_phdr(list[idx].n);
Willy Tarreau146f53a2019-11-24 10:34:39 +0100693
694 for (i = !!phdr; i < list[idx].n.len; i++)
695 if ((uint8_t)(list[idx].n.ptr[i] - 'A') < 'Z' - 'A' || !HTTP_IS_TOKEN(list[idx].n.ptr[i]))
696 goto fail;
Willy Tarreau1329b5b2018-10-08 14:49:20 +0200697 }
698
Willy Tarreau54f53ef2019-11-22 16:02:43 +0100699 /* RFC7540#10.3: intermediaries forwarding to HTTP/1 must take care of
700 * rejecting NUL, CR and LF characters.
701 */
702 ctl = ist_find_ctl(list[idx].v);
703 if (unlikely(ctl) && has_forbidden_char(list[idx].v, ctl))
704 goto fail;
705
Willy Tarreau1329b5b2018-10-08 14:49:20 +0200706 if (phdr > 0 && phdr < H2_PHDR_NUM_ENTRIES) {
707 /* insert a pseudo header by its index (in phdr) and value (in value) */
708 if (fields & ((1 << phdr) | H2_PHDR_FND_NONE)) {
709 if (fields & H2_PHDR_FND_NONE) {
710 /* pseudo header field after regular headers */
711 goto fail;
712 }
713 else {
714 /* repeated pseudo header field */
715 goto fail;
716 }
717 }
718 fields |= 1 << phdr;
719 phdr_val[phdr] = list[idx].v;
720 continue;
721 }
722 else if (phdr != 0) {
723 /* invalid pseudo header -- should never happen here */
724 goto fail;
725 }
726
727 /* regular header field in (name,value) */
728 if (!(fields & H2_PHDR_FND_NONE)) {
729 /* no more pseudo-headers, time to build the status line */
730 sl = h2_prepare_htx_stsline(fields, phdr_val, htx, msgf);
731 if (!sl)
732 goto fail;
733 fields |= H2_PHDR_FND_NONE;
734 }
735
Willy Tarreaubeefaee2018-12-19 13:08:08 +0100736 if (isteq(list[idx].n, ist("content-length"))) {
Willy Tarreau4790f7c2019-01-24 11:33:02 +0100737 ret = h2_parse_cont_len_header(msgf, &list[idx].v, body_len);
Willy Tarreaubeefaee2018-12-19 13:08:08 +0100738 if (ret < 0)
739 goto fail;
740
Willy Tarreau1329b5b2018-10-08 14:49:20 +0200741 sl_flags |= HTX_SL_F_CLEN;
Willy Tarreaubeefaee2018-12-19 13:08:08 +0100742 if (ret == 0)
743 continue; // skip this duplicate
Willy Tarreau1329b5b2018-10-08 14:49:20 +0200744 }
745
746 /* these ones are forbidden in responses (RFC7540#8.1.2.2) */
747 if (isteq(list[idx].n, ist("connection")) ||
748 isteq(list[idx].n, ist("proxy-connection")) ||
749 isteq(list[idx].n, ist("keep-alive")) ||
750 isteq(list[idx].n, ist("upgrade")) ||
751 isteq(list[idx].n, ist("transfer-encoding")))
752 goto fail;
753
754 if (!htx_add_header(htx, list[idx].n, list[idx].v))
755 goto fail;
756 }
757
758 /* RFC7540#8.1.2.1 mandates to reject request pseudo-headers */
759 if (fields & (H2_PHDR_FND_AUTH|H2_PHDR_FND_METH|H2_PHDR_FND_PATH|H2_PHDR_FND_SCHM))
760 goto fail;
761
762 /* Let's dump the request now if not yet emitted. */
763 if (!(fields & H2_PHDR_FND_NONE)) {
764 sl = h2_prepare_htx_stsline(fields, phdr_val, htx, msgf);
765 if (!sl)
766 goto fail;
Amaury Denoyelle74162742020-12-11 17:53:05 +0100767 }
768
769 if (sl->info.res.status == 101 && upgrade_protocol) {
770 if (!htx_add_header(htx, ist("connection"), ist("upgrade")))
771 goto fail;
772 if (!htx_add_header(htx, ist("upgrade"), ist(upgrade_protocol)))
773 goto fail;
774 sl_flags |= HTX_SL_F_CONN_UPG;
Willy Tarreau1329b5b2018-10-08 14:49:20 +0200775 }
776
Amaury Denoyelle74162742020-12-11 17:53:05 +0100777 if ((*msgf & H2_MSGF_BODY_TUNNEL) &&
778 ((sl->info.res.status >= 200 && sl->info.res.status < 300) || sl->info.res.status == 101))
Christopher Fauletd0db4232021-01-22 11:46:30 +0100779 *msgf &= ~(H2_MSGF_BODY|H2_MSGF_BODY_CL);
780 else
781 *msgf &= ~H2_MSGF_BODY_TUNNEL;
782
Christopher Fauletd1ac2b92020-12-02 19:12:22 +0100783 if (!(*msgf & H2_MSGF_BODY) || ((*msgf & H2_MSGF_BODY_CL) && *body_len == 0) ||
784 (*msgf & H2_MSGF_BODY_TUNNEL)) {
Ilya Shipitsinacf84592021-02-06 22:29:08 +0500785 /* Response without body or tunnel successfully established */
Christopher Faulet44af3cf2019-02-18 10:12:56 +0100786 sl_flags |= HTX_SL_F_BODYLESS;
Christopher Fauletd1ac2b92020-12-02 19:12:22 +0100787 htx->flags |= HTX_FL_EOM;
788 }
Christopher Faulet44af3cf2019-02-18 10:12:56 +0100789
Willy Tarreau1329b5b2018-10-08 14:49:20 +0200790 /* update the start line with last detected header info */
791 sl->flags |= sl_flags;
792
793 if ((*msgf & (H2_MSGF_BODY|H2_MSGF_BODY_TUNNEL|H2_MSGF_BODY_CL)) == H2_MSGF_BODY) {
794 /* FIXME: Do we need to signal anything when we have a body and
795 * no content-length, to have the equivalent of H1's chunked
796 * encoding?
797 */
798 }
799
800 /* now send the end of headers marker */
Christopher Faulet5be651d2021-01-22 15:28:03 +0100801 if (!htx_add_endof(htx, HTX_BLK_EOH))
802 goto fail;
Willy Tarreau1329b5b2018-10-08 14:49:20 +0200803
Ilya Shipitsin6fb0f212020-04-02 15:25:26 +0500804 /* Set bytes used in the HTX message for the headers now */
Christopher Faulet33543e72019-05-15 15:53:20 +0200805 sl->hdrs_bytes = htx_used_space(htx) - used;
806
Willy Tarreau1329b5b2018-10-08 14:49:20 +0200807 ret = 1;
808 return ret;
809
810 fail:
811 return -1;
812}
Willy Tarreau1e1f27c2019-01-03 18:39:54 +0100813
Christopher Faulet2d7c5392019-06-03 10:41:26 +0200814/* Takes an H2 headers list <list> terminated by a name being <NULL,0> and emits
815 * the equivalent HTX trailers blocks. The output contents are emitted in <htx>,
816 * and a positive value is returned if some bytes were emitted. In case of
817 * error, a negative error code is returned. The caller must have verified that
818 * the message in the buffer is compatible with receipt of trailers.
Willy Tarreau1e1f27c2019-01-03 18:39:54 +0100819 *
820 * The headers list <list> must be composed of :
821 * - n.name != NULL, n.len > 0 : literal header name
822 * - n.name == NULL, n.len > 0 : indexed pseudo header name number <n.len>
823 * among H2_PHDR_IDX_* (illegal here)
824 * - n.name ignored, n.len == 0 : end of list
825 * - in all cases except the end of list, v.name and v.len must designate a
826 * valid value.
827 */
828int h2_make_htx_trailers(struct http_hdr *list, struct htx *htx)
829{
Willy Tarreau54f53ef2019-11-22 16:02:43 +0100830 const char *ctl;
Willy Tarreau1e1f27c2019-01-03 18:39:54 +0100831 uint32_t idx;
Willy Tarreau1e1f27c2019-01-03 18:39:54 +0100832 int i;
833
Willy Tarreau1e1f27c2019-01-03 18:39:54 +0100834 for (idx = 0; list[idx].n.len != 0; idx++) {
835 if (!list[idx].n.ptr) {
836 /* This is an indexed pseudo-header (RFC7540#8.1.2.1) */
837 goto fail;
838 }
839
Willy Tarreau146f53a2019-11-24 10:34:39 +0100840 /* RFC7540#8.1.2: upper case not allowed in header field names.
841 * #10.3: header names must be valid (i.e. match a token). This
842 * also catches pseudo-headers which are forbidden in trailers.
843 */
Willy Tarreau1e1f27c2019-01-03 18:39:54 +0100844 for (i = 0; i < list[idx].n.len; i++)
Willy Tarreau146f53a2019-11-24 10:34:39 +0100845 if ((uint8_t)(list[idx].n.ptr[i] - 'A') < 'Z' - 'A' || !HTTP_IS_TOKEN(list[idx].n.ptr[i]))
Willy Tarreau1e1f27c2019-01-03 18:39:54 +0100846 goto fail;
847
Willy Tarreau1e1f27c2019-01-03 18:39:54 +0100848 /* these ones are forbidden in trailers (RFC7540#8.1.2.2) */
849 if (isteq(list[idx].n, ist("host")) ||
850 isteq(list[idx].n, ist("content-length")) ||
851 isteq(list[idx].n, ist("connection")) ||
852 isteq(list[idx].n, ist("proxy-connection")) ||
853 isteq(list[idx].n, ist("keep-alive")) ||
854 isteq(list[idx].n, ist("upgrade")) ||
855 isteq(list[idx].n, ist("te")) ||
856 isteq(list[idx].n, ist("transfer-encoding")))
857 goto fail;
858
Willy Tarreau54f53ef2019-11-22 16:02:43 +0100859 /* RFC7540#10.3: intermediaries forwarding to HTTP/1 must take care of
860 * rejecting NUL, CR and LF characters.
861 */
862 ctl = ist_find_ctl(list[idx].v);
863 if (unlikely(ctl) && has_forbidden_char(list[idx].v, ctl))
864 goto fail;
865
Christopher Faulet2d7c5392019-06-03 10:41:26 +0200866 if (!htx_add_trailer(htx, list[idx].n, list[idx].v))
867 goto fail;
Willy Tarreau1e1f27c2019-01-03 18:39:54 +0100868 }
869
Christopher Faulet2d7c5392019-06-03 10:41:26 +0200870 if (!htx_add_endof(htx, HTX_BLK_EOT))
Willy Tarreau1e1f27c2019-01-03 18:39:54 +0100871 goto fail;
872
Willy Tarreau1e1f27c2019-01-03 18:39:54 +0100873 return 1;
874
875 fail:
876 return -1;
877}