varnish-cache/bin/varnishd/http2/cache_http2_proto.c
0
/*-
1
 * Copyright (c) 2016-2019 Varnish Software AS
2
 * All rights reserved.
3
 *
4
 * Author: Poul-Henning Kamp <phk@phk.freebsd.dk>
5
 *
6
 * SPDX-License-Identifier: BSD-2-Clause
7
 *
8
 * Redistribution and use in source and binary forms, with or without
9
 * modification, are permitted provided that the following conditions
10
 * are met:
11
 * 1. Redistributions of source code must retain the above copyright
12
 *    notice, this list of conditions and the following disclaimer.
13
 * 2. Redistributions in binary form must reproduce the above copyright
14
 *    notice, this list of conditions and the following disclaimer in the
15
 *    documentation and/or other materials provided with the distribution.
16
 *
17
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20
 * ARE DISCLAIMED.  IN NO EVENT SHALL AUTHOR OR CONTRIBUTORS BE LIABLE
21
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27
 * SUCH DAMAGE.
28
 *
29
 */
30
31
#include "config.h"
32
33
#include "cache/cache_varnishd.h"
34
35
#include <stdio.h>
36
#include <stdlib.h>
37
38
#include "cache/cache_transport.h"
39
#include "cache/cache_filter.h"
40
#include "http2/cache_http2.h"
41
#include "cache/cache_objhead.h"
42
#include "storage/storage.h"
43
44
#include "vend.h"
45
#include "vtcp.h"
46
#include "vtim.h"
47
48
#define H2_CUSTOM_ERRORS
49
#define H2EC1(U,v,g,r,d)        \
50
        const struct h2_error_s H2CE_##U[1] = {{"H2CE_" #U,d,v,0,1,g,r}};
51
#define H2EC2(U,v,g,r,d)        \
52
        const struct h2_error_s H2SE_##U[1] = {{"H2SE_" #U,d,v,1,0,g,r}};
53
#define H2EC3(U,v,g,r,d) H2EC1(U,v,g,r,d) H2EC2(U,v,g,r,d)
54
#define H2_ERROR(NAME, val, sc, goaway, reason, desc)   \
55
        H2EC##sc(NAME, val, goaway, reason, desc)
56
#include "tbl/h2_error.h"
57
#undef H2EC1
58
#undef H2EC2
59
#undef H2EC3
60
61
static const struct h2_error_s H2NN_ERROR[1] = {{
62
        "UNKNOWN_ERROR",
63
        "Unknown error number",
64
        0xffffffff,
65
        1,
66
        1,
67
        0,
68
        SC_RX_JUNK
69
}};
70
71
enum h2frame {
72
#define H2_FRAME(l,u,t,f,...)   H2F_##u = t,
73
#include "tbl/h2_frames.h"
74
};
75
76
static const char *
77 34920
h2_framename(enum h2frame h2f)
78
{
79
80 34920
        switch (h2f) {
81
#define H2_FRAME(l,u,t,f,...)   case H2F_##u: return (#u);
82
#include "tbl/h2_frames.h"
83
        default:
84
                return (NULL);
85
        }
86 34920
}
87
88
#define H2_FRAME_FLAGS(l,u,v)   const uint8_t H2FF_##u = v;
89
#include "tbl/h2_frames.h"
90
91
/**********************************************************************
92
 */
93
94
static const h2_error stream_errors[] = {
95
#define H2EC1(U,v,g,r,d)
96
#define H2EC2(U,v,g,r,d) [v] = H2SE_##U,
97
#define H2EC3(U,v,g,r,d) H2EC1(U,v,g,r,d) H2EC2(U,v,g,r,d)
98
#define H2_ERROR(NAME, val, sc, goaway, reason, desc)   \
99
        H2EC##sc(NAME, val, goaway, reason, desc)
100
#include "tbl/h2_error.h"
101
#undef H2EC1
102
#undef H2EC2
103
#undef H2EC3
104
};
105
106
#define NSTREAMERRORS vcountof(stream_errors)
107
108
static h2_error
109 600
h2_streamerror(uint32_t u)
110
{
111 600
        if (u < NSTREAMERRORS && stream_errors[u] != NULL)
112 520
                return (stream_errors[u]);
113
        else
114 80
                return (H2NN_ERROR);
115 600
}
116
117
/**********************************************************************
118
 */
119
120
static const h2_error conn_errors[] = {
121
#define H2EC1(U,v,g,r,d) [v] = H2CE_##U,
122
#define H2EC2(U,v,g,r,d)
123
#define H2EC3(U,v,g,r,d) H2EC1(U,v,g,r,d) H2EC2(U,v,g,r,d)
124
#define H2_ERROR(NAME, val, sc, goaway, reason, desc)   \
125
        H2EC##sc(NAME, val, goaway, reason, desc)
126
#include "tbl/h2_error.h"
127
#undef H2EC1
128
#undef H2EC2
129
#undef H2EC3
130
};
131
132
#define NCONNERRORS vcountof(conn_errors)
133
134
static h2_error
135 120
h2_connectionerror(uint32_t u)
136
{
137 120
        if (u < NCONNERRORS && conn_errors[u] != NULL)
138 80
                return (conn_errors[u]);
139
        else
140 40
                return (H2NN_ERROR);
141 120
}
142
143
/**********************************************************************/
144
145
struct h2_req *
146 13799
h2_new_req(struct h2_sess *h2, unsigned stream, struct req *req)
147
{
148
        struct h2_req *r2;
149
150 13799
        ASSERT_RXTHR(h2);
151 13799
        if (req == NULL)
152 13600
                req = Req_New(h2->sess, NULL);
153 13799
        CHECK_OBJ_NOTNULL(req, REQ_MAGIC);
154
155 13799
        r2 = WS_Alloc(req->ws, sizeof *r2);
156 13799
        AN(r2);
157 13799
        INIT_OBJ(r2, H2_REQ_MAGIC);
158 13799
        r2->state = H2_S_IDLE;
159 13799
        r2->h2sess = h2;
160 13799
        r2->stream = stream;
161 13799
        r2->req = req;
162 13799
        if (stream)
163 7640
                r2->counted = 1;
164 13799
        r2->r_window = h2->local_settings.initial_window_size;
165 13799
        r2->t_window = h2->remote_settings.initial_window_size;
166 13799
        req->transport_priv = r2;
167 13799
        Lck_Lock(&h2->sess->mtx);
168 13799
        if (stream)
169 7640
                h2->open_streams++;
170 13799
        VTAILQ_INSERT_TAIL(&h2->streams, r2, list);
171 13799
        Lck_Unlock(&h2->sess->mtx);
172 13799
        h2->refcnt++;
173 13799
        return (r2);
174
}
175
176
void
177 13719
h2_del_req(struct worker *wrk, struct h2_req *r2)
178
{
179
        struct h2_sess *h2;
180
        struct sess *sp;
181
        struct stv_buffer *stvbuf;
182
183 13719
        CHECK_OBJ_NOTNULL(r2, H2_REQ_MAGIC);
184 13719
        AZ(r2->scheduled);
185 13719
        h2 = r2->h2sess;
186 13719
        CHECK_OBJ_NOTNULL(h2, H2_SESS_MAGIC);
187 13719
        ASSERT_RXTHR(h2);
188 13719
        sp = h2->sess;
189 13719
        Lck_Lock(&sp->mtx);
190 13719
        assert(h2->refcnt > 0);
191 13719
        --h2->refcnt;
192
        /* XXX: PRIORITY reshuffle */
193 13719
        VTAILQ_REMOVE(&h2->streams, r2, list);
194 13719
        if (r2->req == h2->new_req)
195 1560
                h2->new_req = NULL;
196 13719
        Lck_Unlock(&sp->mtx);
197
198 13719
        assert(!WS_IsReserved(r2->req->ws));
199 13719
        AZ(r2->req->ws->r);
200
201 13719
        CHECK_OBJ_ORNULL(r2->rxbuf, H2_RXBUF_MAGIC);
202 13719
        if (r2->rxbuf) {
203 160
                stvbuf = r2->rxbuf->stvbuf;
204 160
                r2->rxbuf = NULL;
205 160
                STV_FreeBuf(wrk, &stvbuf);
206 160
                AZ(stvbuf);
207 160
        }
208
209 13719
        Req_Cleanup(sp, wrk, r2->req);
210 13719
        if (FEATURE(FEATURE_BUSY_STATS_RATE))
211 0
                WRK_AddStat(wrk);
212 13719
        Req_Release(r2->req);
213 13719
}
214
215
void
216 6994
h2_kill_req(struct worker *wrk, struct h2_sess *h2,
217
    struct h2_req *r2, h2_error h2e)
218
{
219
220 6994
        ASSERT_RXTHR(h2);
221 6994
        AN(h2e);
222 6994
        Lck_Lock(&h2->sess->mtx);
223 13988
        VSLb(h2->vsl, SLT_Debug, "KILL st=%u state=%d sched=%d",
224 6994
            r2->stream, r2->state, r2->scheduled);
225 6994
        if (r2->counted) {
226 2021
                assert(h2->open_streams > 0);
227 2021
                h2->open_streams--;
228 2021
                r2->counted = 0;
229 2021
        }
230 6994
        if (r2->error == NULL)
231 600
                r2->error = h2e;
232 6994
        if (r2->scheduled) {
233 2489
                if (r2->cond != NULL)
234 232
                        PTOK(pthread_cond_signal(r2->cond));
235 2489
                r2 = NULL;
236 2489
                Lck_Unlock(&h2->sess->mtx);
237 2489
        } else {
238 4505
                Lck_Unlock(&h2->sess->mtx);
239 4505
                if (r2->state == H2_S_OPEN && h2->new_req == r2->req)
240 200
                        (void)h2h_decode_hdr_fini(h2);
241
        }
242 6994
        if (r2 != NULL)
243 4505
                h2_del_req(wrk, r2);
244 6994
}
245
246
/**********************************************************************/
247
248
static void
249 35520
h2_vsl_frame(const struct h2_sess *h2, const void *ptr, size_t len)
250
{
251
        const uint8_t *b;
252
        struct vsb *vsb;
253
        const char *p;
254
        unsigned u;
255
256 35520
        if (VSL_tag_is_masked(SLT_H2RxHdr) &&
257 600
            VSL_tag_is_masked(SLT_H2RxBody))
258 600
                return;
259
260 34920
        AN(ptr);
261 34920
        assert(len >= 9);
262 34920
        b = ptr;
263
264 34920
        vsb = VSB_new_auto();
265 34920
        AN(vsb);
266 34920
        p = h2_framename((enum h2frame)b[3]);
267 34920
        if (p != NULL)
268 34880
                VSB_cat(vsb, p);
269
        else
270 40
                VSB_quote(vsb, b + 3, 1, VSB_QUOTE_HEX);
271
272 34920
        u = vbe32dec(b) >> 8;
273 34920
        VSB_printf(vsb, "[%u] ", u);
274 34920
        VSB_quote(vsb, b + 4, 1, VSB_QUOTE_HEX);
275 34920
        VSB_putc(vsb, ' ');
276 34920
        VSB_quote(vsb, b + 5, 4, VSB_QUOTE_HEX);
277 34920
        if (u > 0) {
278 23400
                VSB_putc(vsb, ' ');
279 23400
                VSB_quote(vsb, b + 9, len - 9, VSB_QUOTE_HEX);
280 23400
        }
281 34920
        AZ(VSB_finish(vsb));
282 34920
        Lck_Lock(&h2->sess->mtx);
283 34920
        VSLb_bin(h2->vsl, SLT_H2RxHdr, 9, b);
284 34920
        if (len > 9)
285 23400
                VSLb_bin(h2->vsl, SLT_H2RxBody, len - 9, b + 9);
286
287 34920
        VSLb(h2->vsl, SLT_Debug, "H2RXF %s", VSB_data(vsb));
288 34920
        Lck_Unlock(&h2->sess->mtx);
289 34920
        VSB_destroy(&vsb);
290 35520
}
291
292
293
/**********************************************************************
294
 */
295
296
static h2_error v_matchproto_(h2_rxframe_f)
297 240
h2_rx_ping(struct worker *wrk, struct h2_sess *h2, struct h2_req *r2)
298
{
299
300 240
        CHECK_OBJ_NOTNULL(wrk, WORKER_MAGIC);
301 240
        ASSERT_RXTHR(h2);
302 240
        CHECK_OBJ_NOTNULL(r2, H2_REQ_MAGIC);
303 240
        assert(r2 == h2->req0);
304
305 240
        if (h2->rxf_len != 8) {                         // rfc7540,l,2364,2366
306 40
                H2S_Lock_VSLb(h2, SLT_SessError, "H2: rx ping with (len != 8)");
307 40
                return (H2CE_FRAME_SIZE_ERROR);
308
        }
309 200
        AZ(h2->rxf_stream);                             // rfc7540,l,2359,2362
310 200
        if (h2->rxf_flags != 0) {                       // We never send pings
311 40
                H2S_Lock_VSLb(h2, SLT_SessError, "H2: rx ping ack");
312 40
                return (H2SE_PROTOCOL_ERROR);
313
        }
314 160
        H2_Send_Get(wrk, h2, r2);
315 320
        H2_Send_Frame(wrk, h2,
316 160
            H2_F_PING, H2FF_PING_ACK, 8, 0, h2->rxf_data);
317 160
        H2_Send_Rel(h2, r2);
318 160
        return (0);
319 240
}
320
321
/**********************************************************************
322
 */
323
324
static h2_error v_matchproto_(h2_rxframe_f)
325 80
h2_rx_push_promise(struct worker *wrk, struct h2_sess *h2, struct h2_req *r2)
326
{
327
328 80
        CHECK_OBJ_NOTNULL(wrk, WORKER_MAGIC);
329 80
        ASSERT_RXTHR(h2);
330 80
        CHECK_OBJ_ORNULL(r2, H2_REQ_MAGIC);
331
332
        // rfc7540,l,2262,2267
333 80
        H2S_Lock_VSLb(h2, SLT_SessError, "H2: rx push promise");
334 80
        return (H2CE_PROTOCOL_ERROR);
335
}
336
337
/**********************************************************************
338
 */
339
340
int
341 3013
h2_rapid_reset_check(struct worker *wrk, struct h2_sess *h2,
342
    const struct h2_req *r2)
343
{
344
        vtim_real now;
345
346 3013
        CHECK_OBJ_NOTNULL(wrk, WORKER_MAGIC);
347 3013
        CHECK_OBJ_NOTNULL(h2, H2_SESS_MAGIC);
348 3013
        CHECK_OBJ_NOTNULL(r2, H2_REQ_MAGIC);
349
350 3013
        if (h2->rapid_reset_limit == 0)
351 0
                return (0);
352
353 3013
        now = VTIM_real();
354 3013
        CHECK_OBJ_NOTNULL(r2->req, REQ_MAGIC);
355 3013
        AN(r2->req->t_first);
356 3013
        if (now - r2->req->t_first > h2->rapid_reset)
357 253
                return (0);
358
359 2760
        return (1);
360 3013
}
361
362
h2_error
363 2760
h2_rapid_reset_charge(struct worker *wrk, struct h2_sess *h2,
364
    const struct h2_req *r2)
365
{
366
        vtim_real now;
367
        vtim_dur d;
368 2760
        h2_error h2e = NULL;
369
370 2760
        CHECK_OBJ_NOTNULL(wrk, WORKER_MAGIC);
371 2760
        AN(H2_SEND_HELD(h2, r2));
372 2760
        CHECK_OBJ_NOTNULL(r2, H2_REQ_MAGIC);
373
374 2760
        now = VTIM_real();
375
376 2760
        d = now - h2->last_rst;
377 5520
        h2->rst_budget += h2->rapid_reset_limit * d /
378 2760
            h2->rapid_reset_period;
379 2760
        h2->rst_budget = vmin_t(double, h2->rst_budget,
380
            h2->rapid_reset_limit);
381 2760
        h2->last_rst = now;
382
383 2760
        h2->rst_budget -= 1.0;
384
385 2760
        if (h2->rst_budget < 0) {
386 120
                H2S_Lock_VSLb(h2, SLT_SessError, "H2: Hit RST limit. Closing session.");
387 120
                h2e = H2CE_RAPID_RESET;
388 120
                H2_Send_GOAWAY(wrk, h2, r2, h2e);
389 120
        }
390
391 2760
        return (h2e);
392
}
393
394
static h2_error v_matchproto_(h2_rxframe_f)
395 760
h2_rx_rst_stream(struct worker *wrk, struct h2_sess *h2, struct h2_req *r2)
396
{
397 760
        h2_error h2e = NULL;
398
399 760
        CHECK_OBJ_NOTNULL(wrk, WORKER_MAGIC);
400 760
        ASSERT_RXTHR(h2);
401 760
        CHECK_OBJ_ORNULL(r2, H2_REQ_MAGIC);
402
403 760
        if (h2->rxf_len != 4) {                 // rfc7540,l,2003,2004
404 40
                H2S_Lock_VSLb(h2, SLT_SessError, "H2: rx rst with (len != 4)");
405 40
                return (H2CE_FRAME_SIZE_ERROR);
406
        }
407 720
        if (r2 == NULL)
408 120
                return (0);
409 600
        if (h2_rapid_reset_check(wrk, h2, r2)) {
410 600
                H2_Send_Get(wrk, h2, h2->req0);
411 600
                h2e = h2_rapid_reset_charge(wrk, h2, h2->req0);
412 600
                H2_Send_Rel(h2, h2->req0);
413 600
        }
414 600
        h2_kill_req(wrk, h2, r2, h2_streamerror(vbe32dec(h2->rxf_data)));
415 600
        return (h2e);
416 760
}
417
418
/**********************************************************************
419
 */
420
421
static h2_error v_matchproto_(h2_rxframe_f)
422 120
h2_rx_goaway(struct worker *wrk, struct h2_sess *h2, struct h2_req *r2)
423
{
424
425 120
        CHECK_OBJ_NOTNULL(wrk, WORKER_MAGIC);
426 120
        ASSERT_RXTHR(h2);
427 120
        CHECK_OBJ_NOTNULL(r2, H2_REQ_MAGIC);
428 120
        assert(r2 == h2->req0);
429
430 120
        h2->goaway = 1;
431 120
        h2->goaway_last_stream = vbe32dec(h2->rxf_data);
432 120
        h2->error = h2_connectionerror(vbe32dec(h2->rxf_data + 4));
433 120
        H2S_Lock_VSLb(h2, SLT_Debug, "GOAWAY %s", h2->error->name);
434 120
        return (h2->error);
435
}
436
437
static void
438 5800
h2_tx_goaway(struct worker *wrk, struct h2_sess *h2, h2_error h2e)
439
{
440 5800
        ASSERT_RXTHR(h2);
441 5800
        AN(h2e);
442
443 5800
        if (h2->goaway || !h2e->send_goaway)
444 80
                return;
445
446 5720
        H2_Send_Get(wrk, h2, h2->req0);
447 5720
        H2_Send_GOAWAY(wrk, h2, h2->req0, h2e);
448 5720
        H2_Send_Rel(h2, h2->req0);
449 5800
}
450
451
/**********************************************************************
452
 */
453
454
static h2_error v_matchproto_(h2_rxframe_f)
455 1040
h2_rx_window_update(struct worker *wrk, struct h2_sess *h2, struct h2_req *r2)
456
{
457
        uint32_t wu;
458
459 1040
        CHECK_OBJ_NOTNULL(wrk, WORKER_MAGIC);
460 1040
        ASSERT_RXTHR(h2);
461 1040
        CHECK_OBJ_ORNULL(r2, H2_REQ_MAGIC);
462
463 1040
        if (h2->rxf_len != 4) {
464 40
                H2S_Lock_VSLb(h2, SLT_SessError, "H2: rx winup with (len != 4)");
465 40
                return (H2CE_FRAME_SIZE_ERROR);
466
        }
467 1000
        wu = vbe32dec(h2->rxf_data) & ~(1LU<<31);
468 1000
        if (wu == 0)
469 200
                return (H2SE_PROTOCOL_ERROR);
470 800
        if (r2 == NULL)
471 40
                return (0);
472 760
        Lck_Lock(&h2->sess->mtx);
473 760
        r2->t_window += wu;
474 760
        if (r2 == h2->req0)
475 320
                PTOK(pthread_cond_broadcast(h2->winupd_cond));
476 440
        else if (r2->cond != NULL)
477 320
                PTOK(pthread_cond_signal(r2->cond));
478 760
        Lck_Unlock(&h2->sess->mtx);
479 760
        if (r2->t_window >= (1LL << 31))
480 80
                return (H2SE_FLOW_CONTROL_ERROR);
481 680
        return (0);
482 1040
}
483
484
/**********************************************************************
485
 * Incoming PRIORITY, possibly an ACK of one we sent.
486
 *
487
 * deprecated, rfc9113,l,1103,1104
488
 */
489
490
static h2_error v_matchproto_(h2_rxframe_f)
491 360
h2_rx_priority(struct worker *wrk, struct h2_sess *h2, struct h2_req *r2)
492
{
493
494 360
        CHECK_OBJ_NOTNULL(wrk, WORKER_MAGIC);
495 360
        ASSERT_RXTHR(h2);
496 360
        CHECK_OBJ_ORNULL(r2, H2_REQ_MAGIC);
497 360
        return (0);
498
}
499
500
/**********************************************************************
501
 * Incoming SETTINGS, possibly an ACK of one we sent.
502
 */
503
504
#define H2_SETTING(U,l, ...)                                    \
505
static void v_matchproto_(h2_setsetting_f)                      \
506
h2_setting_##l(struct h2_settings* s, uint32_t v)               \
507
{                                                               \
508
        s -> l = v;                                             \
509
}
510
#include <tbl/h2_settings.h>
511
512
#define H2_SETTING(U, l, ...)                                   \
513
const struct h2_setting_s H2_SET_##U[1] = {{                    \
514
        #l,                                                     \
515
        h2_setting_##l,                                         \
516
        __VA_ARGS__                                             \
517
}};
518
#include <tbl/h2_settings.h>
519
520
static const struct h2_setting_s * const h2_setting_tbl[] = {
521
#define H2_SETTING(U,l,v, ...) [v] = H2_SET_##U,
522
#include <tbl/h2_settings.h>
523
};
524
525
#define H2_SETTING_TBL_LEN vcountof(h2_setting_tbl)
526
527
static void
528 360
h2_win_adjust(const struct h2_sess *h2, uint32_t oldval, uint32_t newval)
529
{
530
        struct h2_req *r2;
531
532 360
        Lck_AssertHeld(&h2->sess->mtx);
533
        // rfc7540,l,2668,2674
534 720
        VTAILQ_FOREACH(r2, &h2->streams, list) {
535 360
                CHECK_OBJ_NOTNULL(r2, H2_REQ_MAGIC);
536 360
                if (r2 == h2->req0)
537 360
                        continue; // rfc7540,l,2699,2699
538 0
                switch (r2->state) {
539
                case H2_S_IDLE:
540
                case H2_S_OPEN:
541
                case H2_S_CLOS_REM:
542
                        /*
543
                         * We allow a window to go negative, as per
544
                         * rfc7540,l,2676,2680
545
                         */
546 0
                        r2->t_window += (int64_t)newval - oldval;
547 0
                        break;
548
                default:
549 0
                        break;
550
                }
551 0
        }
552 360
}
553
554
h2_error
555 720
h2_set_setting(struct h2_sess *h2, const uint8_t *d)
556
{
557
        const struct h2_setting_s *s;
558
        uint16_t x;
559
        uint32_t y;
560
561 720
        x = vbe16dec(d);
562 720
        y = vbe32dec(d + 2);
563 720
        if (x >= H2_SETTING_TBL_LEN || h2_setting_tbl[x] == NULL) {
564
                // rfc7540,l,2181,2182
565 80
                H2S_Lock_VSLb(h2, SLT_Debug,
566 40
                    "H2SETTING unknown setting 0x%04x=%08x (ignored)", x, y);
567 40
                return (0);
568
        }
569 680
        s = h2_setting_tbl[x];
570 680
        AN(s);
571 680
        if (y < s->minval || y > s->maxval) {
572 240
                H2S_Lock_VSLb(h2, SLT_Debug, "H2SETTING invalid %s=0x%08x",
573 120
                    s->name, y);
574 120
                AN(s->range_error);
575 120
                if (!DO_DEBUG(DBG_H2_NOCHECK))
576 40
                        return (s->range_error);
577 80
        }
578 640
        Lck_Lock(&h2->sess->mtx);
579 640
        if (s == H2_SET_INITIAL_WINDOW_SIZE)
580 360
                h2_win_adjust(h2, h2->remote_settings.initial_window_size, y);
581 640
        VSLb(h2->vsl, SLT_Debug, "H2SETTING %s=0x%08x", s->name, y);
582 640
        Lck_Unlock(&h2->sess->mtx);
583 640
        AN(s->setfunc);
584 640
        s->setfunc(&h2->remote_settings, y);
585 640
        return (0);
586 720
}
587
588
static h2_error v_matchproto_(h2_rxframe_f)
589 11760
h2_rx_settings(struct worker *wrk, struct h2_sess *h2, struct h2_req *r2)
590
{
591
        const uint8_t *p;
592
        unsigned l;
593 11760
        h2_error retval = 0;
594
595 11760
        CHECK_OBJ_NOTNULL(wrk, WORKER_MAGIC);
596 11760
        ASSERT_RXTHR(h2);
597 11760
        CHECK_OBJ_NOTNULL(r2, H2_REQ_MAGIC);
598 11760
        assert(r2 == h2->req0);
599 11760
        AZ(h2->rxf_stream);
600
601 11760
        if (h2->rxf_flags == H2FF_SETTINGS_ACK) {
602 5800
                if (h2->rxf_len > 0) {                  // rfc7540,l,2047,2049
603 40
                        H2S_Lock_VSLb(h2, SLT_SessError, "H2: rx settings ack with "
604
                            "(len > 0)");
605 40
                        return (H2CE_FRAME_SIZE_ERROR);
606
                }
607 5760
                return (0);
608
        } else {
609 5960
                if (h2->rxf_len % 6) {                  // rfc7540,l,2062,2064
610 40
                        H2S_Lock_VSLb(h2, SLT_SessError, "H2: rx settings with "
611
                            "((len %% 6) != 0)");
612 40
                        return (H2CE_PROTOCOL_ERROR);
613
                }
614 5920
                p = h2->rxf_data;
615 6200
                for (l = h2->rxf_len; l >= 6; l -= 6, p += 6) {
616 320
                        retval = h2_set_setting(h2, p);
617 320
                        if (retval)
618 40
                                return (retval);
619 280
                }
620 5880
                H2_Send_Get(wrk, h2, r2);
621 5880
                H2_Send_Frame(wrk, h2,
622
                    H2_F_SETTINGS, H2FF_SETTINGS_ACK, 0, 0, NULL);
623 5880
                H2_Send_Rel(h2, r2);
624
        }
625 5880
        return (0);
626 11760
}
627
628
/**********************************************************************
629
 * Incoming HEADERS, this is where the party's at...
630
 */
631
632
void v_matchproto_(task_func_t)
633 5984
h2_do_req(struct worker *wrk, void *priv)
634
{
635
        struct req *req;
636
        struct h2_req *r2;
637
        struct h2_sess *h2;
638
639 5984
        CAST_OBJ_NOTNULL(req, priv, REQ_MAGIC);
640 5984
        CAST_OBJ_NOTNULL(r2, req->transport_priv, H2_REQ_MAGIC);
641 5984
        THR_SetRequest(req);
642 5984
        CNT_Embark(wrk, req);
643
644 5984
        if (CNT_Request(req) != REQ_FSM_DISEMBARK) {
645 5480
                wrk->stats->client_req++;
646 5480
                assert(!WS_IsReserved(req->ws));
647 5480
                AZ(req->top->vcl0);
648 5480
                h2 = r2->h2sess;
649 5480
                CHECK_OBJ_NOTNULL(h2, H2_SESS_MAGIC);
650 5480
                Lck_Lock(&h2->sess->mtx);
651 5480
                r2->scheduled = 0;
652 5480
                r2->state = H2_S_CLOSED;
653 5480
                r2->h2sess->do_sweep = 1;
654 5480
                Lck_Unlock(&h2->sess->mtx);
655 5480
        }
656 5984
        THR_SetRequest(NULL);
657 5984
}
658
659
static h2_error
660 5880
h2_end_headers(struct worker *wrk, struct h2_sess *h2,
661
    struct req *req, struct h2_req *r2)
662
{
663
        h2_error h2e;
664
        ssize_t cl;
665
666 5880
        ASSERT_RXTHR(h2);
667 5880
        assert(r2->state == H2_S_OPEN);
668 5880
        h2e = h2h_decode_hdr_fini(h2);
669 5880
        h2->new_req = NULL;
670 5880
        if (h2e != NULL) {
671 200
                H2S_Lock_VSLb(h2, SLT_Debug, "HPACK/FINI %s", h2e->name);
672 200
                assert(!WS_IsReserved(r2->req->ws));
673 200
                h2_del_req(wrk, r2);
674 200
                return (h2e);
675
        }
676 5680
        req->t_req = VTIM_real();
677 5680
        VSLb_ts_req(req, "Req", req->t_req);
678
679
        // XXX: Smarter to do this already at HPACK time into tail end of
680
        // XXX: WS, then copy back once all headers received.
681
        // XXX: Have I mentioned H/2 Is hodge-podge ?
682 5680
        http_CollectHdrSep(req->http, H_Cookie, "; ");  // rfc7540,l,3114,3120
683
684 5680
        cl = http_GetContentLength(req->http);
685 5680
        assert(cl >= -2);
686 5680
        if (cl == -2) {
687 0
                H2S_Lock_VSLb(h2, SLT_Debug, "Non-parseable Content-Length");
688 0
                return (H2SE_PROTOCOL_ERROR);
689
        }
690
691 5680
        if (req->req_body_status == NULL) {
692 1440
                if (cl == -1)
693 760
                        req->req_body_status = BS_EOF;
694
                else {
695
                        /* Note: If cl==0 here, we still need to have
696
                         * req_body_status==BS_LENGTH, so that there will
697
                         * be a wait for the stream to reach H2_S_CLOS_REM
698
                         * while dealing with the request body. */
699 680
                        req->req_body_status = BS_LENGTH;
700
                }
701
                /* Set req->htc->content_length because this is used as
702
                 * the hint in vrb_pull() for how large the storage
703
                 * buffers need to be */
704 1440
                req->htc->content_length = cl;
705 1440
        } else {
706
                /* A HEADER frame contained END_STREAM */
707 4240
                assert (req->req_body_status == BS_NONE);
708 4240
                r2->state = H2_S_CLOS_REM;
709 4240
                if (cl > 0) {
710 40
                        H2S_Lock_VSLb(h2, SLT_SessError, "H2: rx header with END_STREAM "
711
                            "and content-length > 0");
712 40
                        return (H2CE_PROTOCOL_ERROR); //rfc7540,l,1838,1840
713
                }
714
        }
715
716 5640
        if (req->http->hd[HTTP_HDR_METHOD].b == NULL) {
717 40
                H2S_Lock_VSLb(h2, SLT_Debug, "Missing :method");
718 40
                return (H2SE_PROTOCOL_ERROR); //rfc7540,l,3087,3090
719
        }
720
721 5600
        if (req->http->hd[HTTP_HDR_URL].b == NULL) {
722 40
                H2S_Lock_VSLb(h2, SLT_Debug, "Missing :path");
723 40
                return (H2SE_PROTOCOL_ERROR); //rfc7540,l,3087,3090
724
        }
725
726 5560
        AN(req->http->hd[HTTP_HDR_PROTO].b);
727
728 5640
        if (*req->http->hd[HTTP_HDR_URL].b == '*' &&
729 160
            (Tlen(req->http->hd[HTTP_HDR_METHOD]) != 7 ||
730 80
            strncmp(req->http->hd[HTTP_HDR_METHOD].b, "OPTIONS", 7))) {
731 120
                H2S_Lock_VSLb(h2, SLT_BogoHeader, "Illegal :path pseudo-header");
732 120
                return (H2SE_PROTOCOL_ERROR); //rfc7540,l,3068,3071
733
        }
734
735 5440
        assert(req->req_step == R_STP_TRANSPORT);
736 5440
        VCL_TaskEnter(req->privs);
737 5440
        VCL_TaskEnter(req->top->privs);
738 5440
        req->task->func = h2_do_req;
739 5440
        req->task->priv = req;
740 5440
        r2->scheduled = 1;
741 5440
        if (Pool_Task(wrk->pool, req->task, TASK_QUEUE_STR) != 0) {
742 40
                r2->scheduled = 0;
743 40
                r2->state = H2_S_CLOSED;
744 40
                return (H2SE_REFUSED_STREAM); //rfc7540,l,3326,3329
745
        }
746 5400
        return (0);
747 5880
}
748
749
static h2_error v_matchproto_(h2_rxframe_f)
750 7560
h2_rx_headers(struct worker *wrk, struct h2_sess *h2, struct h2_req *r2)
751
{
752
        struct req *req;
753
        h2_error h2e;
754
        const uint8_t *p;
755
        size_t l;
756
757 7560
        CHECK_OBJ_NOTNULL(wrk, WORKER_MAGIC);
758 7560
        ASSERT_RXTHR(h2);
759
760 7560
        if (r2 != NULL) {
761 40
                H2S_Lock_VSLb(h2, SLT_SessError, "H2: rx headers on non-idle stream");
762 40
                return (H2CE_PROTOCOL_ERROR);   // rfc9113,l,887,891
763
        }
764
765 7520
        if (h2->rxf_stream <= h2->highest_stream) {
766 40
                H2S_Lock_VSLb(h2, SLT_SessError, "H2: new stream ID < highest stream");
767 40
                return (H2CE_PROTOCOL_ERROR);   // rfc7540,l,1153,1158
768
        }
769
        /* NB: we don't need to guard the read of h2->open_streams
770
         * because headers are handled sequentially so it cannot
771
         * increase under our feet.
772
         */
773 14960
        if (h2->open_streams >=
774 7480
            (int)h2->local_settings.max_concurrent_streams) {
775 80
                H2S_Lock_VSLb(h2, SLT_Debug,
776
                    "H2: stream %u: Hit maximum number of "
777 40
                    "concurrent streams", h2->rxf_stream);
778 40
                return (H2SE_REFUSED_STREAM);   // rfc7540,l,1200,1205
779
        }
780 7440
        h2->highest_stream = h2->rxf_stream;
781 7440
        r2 = h2_new_req(h2, h2->rxf_stream, NULL);
782 7440
        CHECK_OBJ_NOTNULL(r2, H2_REQ_MAGIC);
783 7440
        assert(r2->state == H2_S_IDLE);
784 7440
        r2->state = H2_S_OPEN;
785
786 7440
        req = r2->req;
787 7440
        CHECK_OBJ_NOTNULL(req, REQ_MAGIC);
788
789 7440
        req->vsl->wid = VXID_Get(wrk, VSL_CLIENTMARKER);
790 7440
        VSLb(req->vsl, SLT_Begin, "req %ju rxreq", VXID(req->sp->vxid));
791 7440
        VSL(SLT_Link, req->sp->vxid, "req %ju rxreq", VXID(req->vsl->wid));
792
793 7440
        h2->new_req = req;
794 7440
        req->sp = h2->sess;
795 7440
        req->transport = &HTTP2_transport;
796
797 7440
        req->t_first = h2->t1;
798 7440
        req->t_prev = req->t_first;
799 7440
        VSLb_ts_req(req, "Start", req->t_first);
800 7440
        req->acct.req_hdrbytes += h2->rxf_len;
801
802 7440
        HTTP_Setup(req->http, req->ws, req->vsl, SLT_ReqMethod);
803 7440
        http_SetH(req->http, HTTP_HDR_PROTO, "HTTP/2.0");
804
805 7440
        h2h_decode_hdr_init(h2);
806
807 7440
        p = h2->rxf_data;
808 7440
        l = h2->rxf_len;
809 7440
        if (h2->rxf_flags & H2FF_HEADERS_PADDED) {
810 280
                if (*p + 1 > l) {
811 80
                        H2S_Lock_VSLb(h2, SLT_SessError, "H2: rx headers with pad length > frame len");
812 80
                        return (H2CE_PROTOCOL_ERROR);   // rfc7540,l,1884,1887
813
                }
814 200
                l -= 1 + *p;
815 200
                p += 1;
816 200
        }
817 7360
        if (h2->rxf_flags & H2FF_HEADERS_PRIORITY) {
818 120
                if (l < 5) {
819 40
                        H2S_Lock_VSLb(h2, SLT_SessError, "H2: rx headers with incorrect "
820
                            "priority data");
821 40
                        return (H2CE_PROTOCOL_ERROR);
822
                }
823 80
                l -= 5;
824 80
                p += 5;
825 80
        }
826 7320
        h2e = h2h_decode_bytes(h2, p, l);
827 7320
        if (h2e != NULL) {
828 1280
                H2S_Lock_VSLb(h2, SLT_Debug, "HPACK(hdr) %s", h2e->name);
829 1280
                (void)h2h_decode_hdr_fini(h2);
830 1280
                assert(!WS_IsReserved(r2->req->ws));
831 1280
                h2_del_req(wrk, r2);
832 1280
                return (h2e);
833
        }
834
835 6040
        if (h2->rxf_flags & H2FF_HEADERS_END_STREAM)
836 4600
                req->req_body_status = BS_NONE;
837
838 6040
        if (h2->rxf_flags & H2FF_HEADERS_END_HEADERS)
839 5760
                return (h2_end_headers(wrk, h2, req, r2));
840 280
        return (0);
841 7560
}
842
843
/**********************************************************************/
844
845
static h2_error v_matchproto_(h2_rxframe_f)
846 760
h2_rx_continuation(struct worker *wrk, struct h2_sess *h2, struct h2_req *r2)
847
{
848
        struct req *req;
849
        h2_error h2e;
850
851 760
        CHECK_OBJ_NOTNULL(wrk, WORKER_MAGIC);
852 760
        ASSERT_RXTHR(h2);
853 760
        CHECK_OBJ_ORNULL(r2, H2_REQ_MAGIC);
854
855 760
        if (r2 == NULL || r2->state != H2_S_OPEN || r2->req != h2->new_req) {
856 160
                H2S_Lock_VSLb(h2, SLT_SessError, "H2: rx unexpected CONT frame"
857 80
                    " on stream %d", h2->rxf_stream);
858 80
                return (H2CE_PROTOCOL_ERROR);   // XXX spec ?
859
        }
860 680
        req = r2->req;
861 680
        h2e = h2h_decode_bytes(h2, h2->rxf_data, h2->rxf_len);
862 680
        r2->req->acct.req_hdrbytes += h2->rxf_len;
863 680
        if (h2e != NULL) {
864 80
                H2S_Lock_VSLb(h2, SLT_Debug, "HPACK(cont) %s", h2e->name);
865 80
                (void)h2h_decode_hdr_fini(h2);
866 80
                assert(!WS_IsReserved(r2->req->ws));
867 80
                h2_del_req(wrk, r2);
868 80
                return (h2e);
869
        }
870 600
        if (h2->rxf_flags & H2FF_HEADERS_END_HEADERS)
871 120
                return (h2_end_headers(wrk, h2, req, r2));
872 480
        return (0);
873 760
}
874
875
/**********************************************************************/
876
877
static h2_error v_matchproto_(h2_rxframe_f)
878 12560
h2_rx_data(struct worker *wrk, struct h2_sess *h2, struct h2_req *r2)
879
{
880
        char buf[4];
881
        ssize_t l;
882
        uint64_t l2, head;
883
        const uint8_t *src;
884
        unsigned len;
885
886
        /* XXX: Shouldn't error handling, setting of r2->error and
887
         * r2->cond signalling be handled more generally at the end of
888
         * procframe()??? */
889
890 12560
        CHECK_OBJ_NOTNULL(wrk, WORKER_MAGIC);
891 12560
        ASSERT_RXTHR(h2);
892 12560
        CHECK_OBJ_ORNULL(r2, H2_REQ_MAGIC);
893
894 12560
        if (r2 == NULL)
895 40
                return (0);
896
897 12520
        if (r2->state >= H2_S_CLOS_REM) {
898 80
                r2->error = H2SE_STREAM_CLOSED;
899 80
                return (H2SE_STREAM_CLOSED); // rfc7540,l,1766,1769
900
        }
901
902 12440
        Lck_Lock(&h2->sess->mtx);
903 12440
        CHECK_OBJ_ORNULL(r2->rxbuf, H2_RXBUF_MAGIC);
904
905 12440
        if (h2->error != NULL || r2->error != NULL) {
906 40
                if (r2->cond)
907 0
                        PTOK(pthread_cond_signal(r2->cond));
908 40
                Lck_Unlock(&h2->sess->mtx);
909 40
                return (h2->error != NULL ? h2->error : r2->error);
910
        }
911
912
        /* Check padding if present */
913 12400
        src = h2->rxf_data;
914 12400
        len = h2->rxf_len;
915 12400
        if (h2->rxf_flags & H2FF_DATA_PADDED) {
916 10640
                if (*src >= len) {
917 0
                        VSLb(h2->vsl, SLT_SessError,
918
                            "H2: stream %u: Padding larger than frame length",
919 0
                            h2->rxf_stream);
920 0
                        r2->error = H2CE_PROTOCOL_ERROR;
921 0
                        if (r2->cond)
922 0
                                PTOK(pthread_cond_signal(r2->cond));
923 0
                        Lck_Unlock(&h2->sess->mtx);
924 0
                        return (H2CE_PROTOCOL_ERROR);
925
                }
926 10640
                len -= 1 + *src;
927 10640
                src += 1;
928 10640
        }
929
930
        /* Check against the Content-Length header if given */
931 12400
        if (r2->req->htc->content_length >= 0) {
932 12040
                if (r2->rxbuf)
933 1120
                        l = r2->rxbuf->head;
934
                else
935 10920
                        l = 0;
936 12040
                l += len;
937 12600
                if (l > r2->req->htc->content_length ||
938 11920
                    ((h2->rxf_flags & H2FF_DATA_END_STREAM) &&
939 560
                     l != r2->req->htc->content_length)) {
940 240
                        VSLb(h2->vsl, SLT_Debug,
941
                            "H2: stream %u: Received data and Content-Length"
942 120
                            " mismatch", h2->rxf_stream);
943 120
                        r2->error = H2SE_PROTOCOL_ERROR;
944 120
                        if (r2->cond)
945 40
                                PTOK(pthread_cond_signal(r2->cond));
946 120
                        Lck_Unlock(&h2->sess->mtx);
947 120
                        return (H2SE_PROTOCOL_ERROR);
948
                }
949 11920
        }
950
951
        /* Check and charge connection window. The entire frame including
952
         * padding (h2->rxf_len) counts towards the window. */
953 12280
        if (h2->rxf_len > h2->req0->r_window) {
954 0
                VSLb(h2->vsl, SLT_SessError,
955
                    "H2: stream %u: Exceeded connection receive window",
956 0
                    h2->rxf_stream);
957 0
                r2->error = H2CE_FLOW_CONTROL_ERROR;
958 0
                if (r2->cond)
959 0
                        PTOK(pthread_cond_signal(r2->cond));
960 0
                Lck_Unlock(&h2->sess->mtx);
961 0
                return (H2CE_FLOW_CONTROL_ERROR);
962
        }
963 12280
        h2->req0->r_window -= h2->rxf_len;
964 12280
        if (h2->req0->r_window < cache_param->h2_rx_window_low_water) {
965 1720
                h2->req0->r_window += cache_param->h2_rx_window_increment;
966 1720
                vbe32enc(buf, cache_param->h2_rx_window_increment);
967 1720
                Lck_Unlock(&h2->sess->mtx);
968 1720
                H2_Send_Get(wrk, h2, h2->req0);
969 1720
                H2_Send_Frame(wrk, h2, H2_F_WINDOW_UPDATE, 0, 4, 0, buf);
970 1720
                H2_Send_Rel(h2, h2->req0);
971 1720
                Lck_Lock(&h2->sess->mtx);
972 1720
        }
973
974
        /* Check stream window. The entire frame including padding
975
         * (h2->rxf_len) counts towards the window. */
976 12280
        if (h2->rxf_len > r2->r_window) {
977 0
                VSLb(h2->vsl, SLT_Debug,
978
                    "H2: stream %u: Exceeded stream receive window",
979 0
                    h2->rxf_stream);
980 0
                r2->error = H2SE_FLOW_CONTROL_ERROR;
981 0
                if (r2->cond)
982 0
                        PTOK(pthread_cond_signal(r2->cond));
983 0
                Lck_Unlock(&h2->sess->mtx);
984 0
                return (H2SE_FLOW_CONTROL_ERROR);
985
        }
986
987
        /* Handle zero size frame before starting to allocate buffers */
988 12280
        if (len == 0) {
989 10360
                r2->r_window -= h2->rxf_len;
990
991
                /* Handle the specific corner case where the entire window
992
                 * has been exhausted using nothing but padding
993
                 * bytes. Since no bytes have been buffered, no bytes
994
                 * would be consumed by the request thread and no stream
995
                 * window updates sent. Unpaint ourselves from this corner
996
                 * by sending a stream window update here. */
997 10360
                CHECK_OBJ_ORNULL(r2->rxbuf, H2_RXBUF_MAGIC);
998 10360
                if (r2->r_window == 0 &&
999 40
                    (r2->rxbuf == NULL || r2->rxbuf->tail == r2->rxbuf->head)) {
1000 40
                        if (r2->rxbuf)
1001 0
                                l = r2->rxbuf->size;
1002
                        else
1003 40
                                l = h2->local_settings.initial_window_size;
1004 40
                        r2->r_window += l;
1005 40
                        Lck_Unlock(&h2->sess->mtx);
1006 40
                        vbe32enc(buf, l);
1007 40
                        H2_Send_Get(wrk, h2, h2->req0);
1008 80
                        H2_Send_Frame(wrk, h2, H2_F_WINDOW_UPDATE, 0, 4,
1009 40
                            r2->stream, buf);
1010 40
                        H2_Send_Rel(h2, h2->req0);
1011 40
                        Lck_Lock(&h2->sess->mtx);
1012 40
                }
1013
1014 10360
                if (h2->rxf_flags & H2FF_DATA_END_STREAM)
1015 120
                        r2->state = H2_S_CLOS_REM;
1016 10360
                if (r2->cond)
1017 10060
                        PTOK(pthread_cond_signal(r2->cond));
1018 10360
                Lck_Unlock(&h2->sess->mtx);
1019 10360
                return (0);
1020
        }
1021
1022
        /* Make the buffer on demand */
1023 1920
        if (r2->rxbuf == NULL) {
1024
                unsigned bufsize;
1025
                size_t bstest;
1026
                struct stv_buffer *stvbuf;
1027
                struct h2_rxbuf *rxbuf;
1028
1029 880
                Lck_Unlock(&h2->sess->mtx);
1030
1031 880
                bufsize = h2->local_settings.initial_window_size;
1032 880
                if (bufsize < r2->r_window) {
1033
                        /* This will not happen because we do not have any
1034
                         * mechanism to change the initial window size on
1035
                         * a running session. But if we gain that ability,
1036
                         * this future proofs it. */
1037 0
                        bufsize = r2->r_window;
1038 0
                }
1039 880
                assert(bufsize > 0);
1040 880
                if ((h2->rxf_flags & H2FF_DATA_END_STREAM) &&
1041 520
                    bufsize > len)
1042
                        /* Cap the buffer size when we know this is the
1043
                         * single data frame. */
1044 520
                        bufsize = len;
1045 880
                CHECK_OBJ_NOTNULL(stv_h2_rxbuf, STEVEDORE_MAGIC);
1046 1760
                stvbuf = STV_AllocBuf(wrk, stv_h2_rxbuf,
1047 880
                    bufsize + sizeof *rxbuf);
1048 880
                if (stvbuf == NULL) {
1049 0
                        Lck_Lock(&h2->sess->mtx);
1050 0
                        VSLb(h2->vsl, SLT_Debug,
1051
                            "H2: stream %u: Failed to allocate request body"
1052
                            " buffer",
1053 0
                            h2->rxf_stream);
1054 0
                        r2->error = H2SE_INTERNAL_ERROR;
1055 0
                        if (r2->cond)
1056 0
                                PTOK(pthread_cond_signal(r2->cond));
1057 0
                        Lck_Unlock(&h2->sess->mtx);
1058 0
                        return (H2SE_INTERNAL_ERROR);
1059
                }
1060 880
                rxbuf = STV_GetBufPtr(stvbuf, &bstest);
1061 880
                AN(rxbuf);
1062 880
                assert(bstest >= bufsize + sizeof *rxbuf);
1063 880
                assert(PAOK(rxbuf));
1064 880
                INIT_OBJ(rxbuf, H2_RXBUF_MAGIC);
1065 880
                rxbuf->size = bufsize;
1066 880
                rxbuf->stvbuf = stvbuf;
1067
1068 880
                r2->rxbuf = rxbuf;
1069
1070 880
                Lck_Lock(&h2->sess->mtx);
1071 880
        }
1072
1073 1920
        CHECK_OBJ_NOTNULL(r2->rxbuf, H2_RXBUF_MAGIC);
1074 1920
        assert(r2->rxbuf->tail <= r2->rxbuf->head);
1075 1920
        l = r2->rxbuf->head - r2->rxbuf->tail;
1076 1920
        assert(l <= r2->rxbuf->size);
1077 1920
        l = r2->rxbuf->size - l;
1078 1920
        assert(len <= l); /* Stream window handling ensures this */
1079
1080 1920
        Lck_Unlock(&h2->sess->mtx);
1081
1082 1920
        l = len;
1083 1920
        head = r2->rxbuf->head;
1084 1920
        do {
1085 2120
                l2 = l;
1086 2120
                if ((head % r2->rxbuf->size) + l2 > r2->rxbuf->size)
1087 200
                        l2 = r2->rxbuf->size - (head % r2->rxbuf->size);
1088 2120
                assert(l2 > 0);
1089 2120
                memcpy(&r2->rxbuf->data[head % r2->rxbuf->size], src, l2);
1090 2120
                src += l2;
1091 2120
                head += l2;
1092 2120
                l -= l2;
1093 2120
        } while (l > 0);
1094
1095 1920
        Lck_Lock(&h2->sess->mtx);
1096
1097
        /* Charge stream window. The entire frame including padding
1098
         * (h2->rxf_len) counts towards the window. The used padding
1099
         * bytes will be included in the next connection window update
1100
         * sent when the buffer bytes are consumed because that is
1101
         * calculated against the available buffer space. */
1102 1920
        r2->r_window -= h2->rxf_len;
1103 1920
        r2->rxbuf->head += len;
1104 1920
        assert(r2->rxbuf->tail <= r2->rxbuf->head);
1105 1920
        if (h2->rxf_flags & H2FF_DATA_END_STREAM)
1106 720
                r2->state = H2_S_CLOS_REM;
1107 1920
        if (r2->cond)
1108 1075
                PTOK(pthread_cond_signal(r2->cond));
1109 1920
        Lck_Unlock(&h2->sess->mtx);
1110
1111 1920
        return (0);
1112 12560
}
1113
1114
static enum vfp_status v_matchproto_(vfp_pull_f)
1115 1999
h2_vfp_body(struct vfp_ctx *vc, struct vfp_entry *vfe, void *ptr, ssize_t *lp)
1116
{
1117
        struct h2_req *r2;
1118
        struct h2_sess *h2;
1119
        enum vfp_status retval;
1120
        ssize_t l, l2;
1121
        uint64_t tail;
1122
        uint8_t *dst;
1123
        char buf[4];
1124
        int i;
1125
1126 1999
        CHECK_OBJ_NOTNULL(vc, VFP_CTX_MAGIC);
1127 1999
        CHECK_OBJ_NOTNULL(vfe, VFP_ENTRY_MAGIC);
1128 1999
        CAST_OBJ_NOTNULL(r2, vfe->priv1, H2_REQ_MAGIC);
1129 1999
        h2 = r2->h2sess;
1130
1131 1999
        AN(ptr);
1132 1999
        AN(lp);
1133 1999
        assert(*lp >= 0);
1134
1135 1999
        Lck_Lock(&h2->sess->mtx);
1136
1137 1999
        r2->cond = &vc->wrk->cond;
1138 13362
        while (1) {
1139 13362
                CHECK_OBJ_ORNULL(r2->rxbuf, H2_RXBUF_MAGIC);
1140 13362
                if (r2->rxbuf) {
1141 2719
                        assert(r2->rxbuf->tail <= r2->rxbuf->head);
1142 2719
                        l = r2->rxbuf->head - r2->rxbuf->tail;
1143 2719
                } else
1144 10643
                        l = 0;
1145
1146 13362
                if (h2->error != NULL || r2->error != NULL)
1147 244
                        retval = VFP_ERROR;
1148 13118
                else if (r2->state >= H2_S_CLOS_REM && l <= *lp)
1149 795
                        retval = VFP_END;
1150
                else {
1151 12323
                        if (l > *lp)
1152 0
                                l = *lp;
1153 12323
                        retval = VFP_OK;
1154
                }
1155
1156 13362
                if (retval != VFP_OK || l > 0)
1157 1999
                        break;
1158
1159 22726
                i = Lck_CondWaitTimeout(r2->cond, &h2->sess->mtx,
1160 11363
                    SESS_TMO(h2->sess, timeout_idle));
1161 11363
                if (i == ETIMEDOUT) {
1162 0
                        retval = VFP_ERROR;
1163 0
                        break;
1164
                }
1165
        }
1166 1999
        r2->cond = NULL;
1167
1168 1999
        Lck_Unlock(&h2->sess->mtx);
1169
1170 1999
        if (l == 0 || retval == VFP_ERROR) {
1171 359
                *lp = 0;
1172 359
                return (retval);
1173
        }
1174
1175 1640
        *lp = l;
1176 1640
        dst = ptr;
1177 1640
        tail = r2->rxbuf->tail;
1178 1640
        do {
1179 1840
                l2 = l;
1180 1840
                if ((tail % r2->rxbuf->size) + l2 > r2->rxbuf->size)
1181 200
                        l2 = r2->rxbuf->size - (tail % r2->rxbuf->size);
1182 1840
                assert(l2 > 0);
1183 1840
                memcpy(dst, &r2->rxbuf->data[tail % r2->rxbuf->size], l2);
1184 1840
                dst += l2;
1185 1840
                tail += l2;
1186 1840
                l -= l2;
1187 1840
        } while (l > 0);
1188
1189 1640
        Lck_Lock(&h2->sess->mtx);
1190
1191 1640
        CHECK_OBJ_NOTNULL(r2->rxbuf, H2_RXBUF_MAGIC);
1192 1640
        r2->rxbuf->tail = tail;
1193 1640
        assert(r2->rxbuf->tail <= r2->rxbuf->head);
1194
1195 1640
        if (r2->r_window < cache_param->h2_rx_window_low_water &&
1196 1160
            r2->state < H2_S_CLOS_REM) {
1197
                /* l is free buffer space */
1198
                /* l2 is calculated window increment */
1199 760
                l = r2->rxbuf->size - (r2->rxbuf->head - r2->rxbuf->tail);
1200 760
                assert(r2->r_window <= l);
1201 760
                l2 = cache_param->h2_rx_window_increment;
1202 760
                if (r2->r_window + l2 > l)
1203 760
                        l2 = l - r2->r_window;
1204 760
                r2->r_window += l2;
1205 760
        } else
1206 880
                l2 = 0;
1207
1208 1640
        Lck_Unlock(&h2->sess->mtx);
1209
1210 1640
        if (l2 > 0) {
1211 760
                vbe32enc(buf, l2);
1212 760
                H2_Send_Get(vc->wrk, h2, r2);
1213 1520
                H2_Send_Frame(vc->wrk, h2, H2_F_WINDOW_UPDATE, 0, 4,
1214 760
                    r2->stream, buf);
1215 760
                H2_Send_Rel(h2, r2);
1216 760
        }
1217
1218 1640
        return (retval);
1219 1999
}
1220
1221
static void
1222 1040
h2_vfp_body_fini(struct vfp_ctx *vc, struct vfp_entry *vfe)
1223
{
1224
        struct h2_req *r2;
1225
        struct h2_sess *h2;
1226 1040
        struct stv_buffer *stvbuf = NULL;
1227
1228 1040
        CHECK_OBJ_NOTNULL(vc, VFP_CTX_MAGIC);
1229 1040
        CHECK_OBJ_NOTNULL(vfe, VFP_ENTRY_MAGIC);
1230 1040
        CAST_OBJ_NOTNULL(r2, vfe->priv1, H2_REQ_MAGIC);
1231 1040
        CHECK_OBJ_NOTNULL(r2->req, REQ_MAGIC);
1232 1040
        h2 = r2->h2sess;
1233
1234 1040
        if (vc->failed) {
1235 0
                CHECK_OBJ_NOTNULL(r2->req->wrk, WORKER_MAGIC);
1236 0
                H2_Send_Get(r2->req->wrk, h2, r2);
1237 0
                H2_Send_RST(r2->req->wrk, h2, r2, r2->stream,
1238
                    H2SE_REFUSED_STREAM);
1239 0
                H2_Send_Rel(h2, r2);
1240 0
                Lck_Lock(&h2->sess->mtx);
1241 0
                r2->error = H2SE_REFUSED_STREAM;
1242 0
                Lck_Unlock(&h2->sess->mtx);
1243 0
        }
1244
1245 1040
        if (r2->state >= H2_S_CLOS_REM && r2->rxbuf != NULL) {
1246 720
                Lck_Lock(&h2->sess->mtx);
1247 720
                CHECK_OBJ_ORNULL(r2->rxbuf, H2_RXBUF_MAGIC);
1248 720
                if (r2->rxbuf != NULL) {
1249 720
                        stvbuf = r2->rxbuf->stvbuf;
1250 720
                        r2->rxbuf = NULL;
1251 720
                }
1252 720
                Lck_Unlock(&h2->sess->mtx);
1253 720
                if (stvbuf != NULL) {
1254 720
                        STV_FreeBuf(vc->wrk, &stvbuf);
1255 720
                        AZ(stvbuf);
1256 720
                }
1257 720
        }
1258 1040
}
1259
1260
static const struct vfp h2_body = {
1261
        .name = "H2_BODY",
1262
        .pull = h2_vfp_body,
1263
        .fini = h2_vfp_body_fini
1264
};
1265
1266
void v_matchproto_(vtr_req_body_t)
1267 1440
h2_req_body(struct req *req)
1268
{
1269
        struct h2_req *r2;
1270
        struct vfp_entry *vfe;
1271
1272 1440
        CHECK_OBJ(req, REQ_MAGIC);
1273 1440
        CAST_OBJ_NOTNULL(r2, req->transport_priv, H2_REQ_MAGIC);
1274 1440
        vfe = VFP_Push(req->vfc, &h2_body);
1275 1440
        AN(vfe);
1276 1440
        vfe->priv1 = r2;
1277 1440
}
1278
1279
/**********************************************************************/
1280
1281
void v_matchproto_(vtr_req_fail_f)
1282 40
h2_req_fail(struct req *req, stream_close_t reason)
1283
{
1284 40
        assert(reason != SC_NULL);
1285 40
        assert(req->sp->fd != 0);
1286 40
        VSLb(req->vsl, SLT_Debug, "H2FAILREQ");
1287 40
}
1288
1289
/**********************************************************************/
1290
1291
static enum htc_status_e v_matchproto_(htc_complete_f)
1292 69899
h2_frame_complete(struct http_conn *htc)
1293
{
1294
        struct h2_sess *h2;
1295
1296 69899
        CHECK_OBJ_NOTNULL(htc, HTTP_CONN_MAGIC);
1297 69899
        CAST_OBJ_NOTNULL(h2, htc->priv, H2_SESS_MAGIC);
1298 69899
        if (htc->rxbuf_b + 9 > htc->rxbuf_e ||
1299 36449
            htc->rxbuf_b + 9 + (vbe32dec(htc->rxbuf_b) >> 8) > htc->rxbuf_e)
1300 34379
                return (HTC_S_MORE);
1301 35520
        return (HTC_S_COMPLETE);
1302 69899
}
1303
1304
/**********************************************************************/
1305
1306
static h2_error
1307 35480
h2_procframe(struct worker *wrk, struct h2_sess *h2, h2_frame h2f)
1308
{
1309
        struct h2_req *r2;
1310
        h2_error h2e;
1311
1312 35480
        ASSERT_RXTHR(h2);
1313 35480
        if (h2->rxf_stream == 0 && h2f->act_szero != 0) {
1314 80
                H2S_Lock_VSLb(h2, SLT_SessError, "H2: unexpected %s frame on stream 0",
1315 40
                    h2f->name);
1316 40
                return (h2f->act_szero);
1317
        }
1318
1319 35440
        if (h2->rxf_stream != 0 && h2f->act_snonzero != 0) {
1320 80
                H2S_Lock_VSLb(h2, SLT_SessError, "H2: unexpected %s frame on stream %d",
1321 40
                    h2f->name, h2->rxf_stream);
1322 40
                return (h2f->act_snonzero);
1323
        }
1324
1325 35400
        if (h2->rxf_stream > h2->highest_stream && h2f->act_sidle != 0) {
1326 160
                H2S_Lock_VSLb(h2, SLT_SessError, "H2: unexpected %s frame on idle stream "
1327 80
                    "%d", h2f->name, h2->rxf_stream);
1328 80
                return (h2f->act_sidle);
1329
        }
1330
1331 35320
        if (h2->rxf_stream != 0 && !(h2->rxf_stream & 1)) {
1332
                // rfc7540,l,1140,1145
1333
                // rfc7540,l,1153,1158
1334
                /* No even streams, we don't do PUSH_PROMISE */
1335 80
                H2S_Lock_VSLb(h2, SLT_SessError, "H2: illegal stream (=%u)",
1336 40
                    h2->rxf_stream);
1337 40
                return (H2CE_PROTOCOL_ERROR);
1338
        }
1339
1340 61210
        VTAILQ_FOREACH(r2, &h2->streams, list)
1341 53010
                if (r2->stream == h2->rxf_stream)
1342 27080
                        break;
1343
1344 35280
        if (h2->new_req != NULL && h2f != H2_F_CONTINUATION) {
1345 80
                H2S_Lock_VSLb(h2, SLT_SessError, "H2: expected continuation but "
1346 40
                    " received %s on stream %d", h2f->name, h2->rxf_stream);
1347 40
                return (H2CE_PROTOCOL_ERROR);   // rfc7540,l,1859,1863
1348
        }
1349
1350 35240
        h2e = h2f->rxfunc(wrk, h2, r2);
1351 35240
        if (h2e == NULL)
1352 32000
                return (NULL);
1353 3240
        if (h2->rxf_stream == 0 || h2e->connection)
1354 1080
                return (h2e);   // Connection errors one level up
1355
1356 2160
        H2_Send_Get(wrk, h2, h2->req0);
1357 2160
        H2_Send_RST(wrk, h2, h2->req0, h2->rxf_stream, h2e);
1358 2160
        H2_Send_Rel(h2, h2->req0);
1359 2160
        return (NULL);
1360 35480
}
1361
1362
h2_error
1363 3065
h2_stream_tmo(struct h2_sess *h2, const struct h2_req *r2, vtim_real now)
1364
{
1365 3065
        h2_error h2e = NULL;
1366
1367 3065
        CHECK_OBJ_NOTNULL(h2, H2_SESS_MAGIC);
1368 3065
        CHECK_OBJ_NOTNULL(r2, H2_REQ_MAGIC);
1369 3065
        Lck_AssertHeld(&h2->sess->mtx);
1370
1371
        /* NB: when now is NAN, it means that h2_window_timeout was hit
1372
         * on a lock condwait operation.
1373
         */
1374 3065
        if (isnan(now))
1375 40
                AN(r2->t_winupd);
1376
1377 3065
        if (h2->error != NULL && h2->error->connection &&
1378 0
            !h2->error->send_goaway)
1379 0
                return (h2->error);
1380
1381 3065
        if (r2->t_winupd == 0 && r2->t_send == 0)
1382 1926
                return (NULL);
1383
1384 1139
        if (isnan(now) || (r2->t_winupd != 0 &&
1385 947
            now - r2->t_winupd > cache_param->h2_window_timeout)) {
1386 160
                VSLb(h2->vsl, SLT_Debug,
1387 80
                     "H2: stream %u: Hit h2_window_timeout", r2->stream);
1388 80
                h2e = H2SE_BROKE_WINDOW;
1389 80
        }
1390
1391 2198
        if (h2e == NULL && r2->t_send != 0 &&
1392 1059
            now - r2->t_send > SESS_TMO(h2->sess, send_timeout)) {
1393 80
                VSLb(h2->vsl, SLT_Debug,
1394 40
                     "H2: stream %u: Hit send_timeout", r2->stream);
1395 40
                h2e = H2SE_CANCEL;
1396 40
        }
1397
1398 1139
        return (h2e);
1399 3065
}
1400
1401
static h2_error
1402 2537
h2_stream_tmo_unlocked(struct h2_sess *h2, const struct h2_req *r2)
1403
{
1404
        h2_error h2e;
1405
1406 2537
        Lck_Lock(&h2->sess->mtx);
1407 2537
        h2e = h2_stream_tmo(h2, r2, h2->sess->t_idle);
1408 2537
        Lck_Unlock(&h2->sess->mtx);
1409
1410 2537
        return (h2e);
1411
}
1412
1413
/*
1414
 * This is the janitorial task of cleaning up any closed & refused
1415
 * streams, and checking if the session is timed out.
1416
 */
1417
static h2_error
1418 4545
h2_sweep(struct worker *wrk, struct h2_sess *h2)
1419
{
1420
        struct h2_req *r2, *r22;
1421
        h2_error h2e, tmo;
1422
        vtim_real now;
1423
1424 4545
        ASSERT_RXTHR(h2);
1425
1426 4545
        h2e = h2->error;
1427 4545
        now = VTIM_real();
1428 4545
        if (h2e == NULL && h2->open_streams == 0 &&
1429 2851
            h2->sess->t_idle + cache_param->timeout_idle < now)
1430 121
                h2e = H2CE_NO_ERROR;
1431
1432 4579
        h2->do_sweep = 0;
1433 13133
        VTAILQ_FOREACH_SAFE(r2, &h2->streams, list, r22) {
1434 8554
                if (r2 == h2->req0) {
1435 4562
                        assert (r2->state == H2_S_IDLE);
1436 4562
                        continue;
1437
                }
1438 3992
                switch (r2->state) {
1439
                case H2_S_CLOSED:
1440 1455
                        AZ(r2->scheduled);
1441 1455
                        h2_del_req(wrk, r2);
1442 1455
                        break;
1443
                case H2_S_CLOS_REM:
1444 2203
                        if (!r2->scheduled) {
1445 0
                                H2_Send_Get(wrk, h2, h2->req0);
1446 0
                                H2_Send_RST(wrk, h2, h2->req0, r2->stream,
1447
                                    H2SE_REFUSED_STREAM);
1448 0
                                H2_Send_Rel(h2, h2->req0);
1449 0
                                h2_del_req(wrk, r2);
1450 0
                                continue;
1451
                        }
1452
                        /* FALLTHROUGH */
1453
                case H2_S_CLOS_LOC:
1454
                case H2_S_OPEN:
1455 2537
                        tmo = h2_stream_tmo_unlocked(h2, r2);
1456 2537
                        if (h2e == NULL)
1457 2537
                                h2e = tmo;
1458 2537
                        break;
1459 0
                case H2_S_IDLE:
1460
                        /* Current code make this unreachable: h2_new_req is
1461
                         * only called inside h2_rx_headers, which immediately
1462
                         * sets the new stream state to H2_S_OPEN */
1463
                        /* FALLTHROUGH */
1464
                default:
1465 0
                        WRONG("Wrong h2 stream state");
1466 0
                        break;
1467
                }
1468 3992
        }
1469 4579
        return (h2e);
1470
}
1471
1472
/*
1473
 * if we have received end_headers, the new request is started
1474
 * if we have not received end_stream, DATA frames are expected later
1475
 *
1476
 * neither of these make much sense to output here
1477
 *
1478
 * goaway currently is always 0, see #4285
1479
 */
1480
static void
1481 4479
h2_htc_debug(enum htc_status_e hs, struct h2_sess *h2)
1482
{
1483
        const char *s, *r;
1484
1485 4479
        if (LIKELY(VSL_tag_is_masked(SLT_Debug)))
1486 0
                return;
1487
1488 4479
        HTC_Status(hs, &s, &r);
1489 8958
        H2S_Lock_VSLb(h2, SLT_Debug, "H2: HTC %s (%s) frame=%s goaway=%d",
1490 4479
            s, r, h2->htc->rxbuf_b == h2->htc->rxbuf_e ? "complete" : "partial",
1491 4479
            h2->goaway);
1492 4479
}
1493
1494
/***********************************************************************
1495
 * Called in loop from h2_new_session()
1496
 */
1497
1498
#define H2_FRAME(l,U,...) const struct h2_frame_s H2_F_##U[1] = \
1499
    {{ #U, h2_rx_##l, __VA_ARGS__ }};
1500
#include "tbl/h2_frames.h"
1501
1502
static const h2_frame h2flist[] = {
1503
#define H2_FRAME(l,U,t,...) [t] = H2_F_##U,
1504
#include "tbl/h2_frames.h"
1505
};
1506
1507
#define H2FMAX vcountof(h2flist)
1508
1509
int
1510 43709
h2_rxframe(struct worker *wrk, struct h2_sess *h2)
1511
{
1512
        enum htc_status_e hs;
1513
        h2_frame h2f;
1514
        h2_error h2e;
1515
        const char *s, *r;
1516
1517 43709
        ASSERT_RXTHR(h2);
1518
1519 43709
        if (h2->goaway && h2->open_streams == 0) {
1520
                // h2 WS must always be released before returning
1521 0
                WS_ReleaseP(h2->ws, h2->htc->rxbuf_b);
1522 0
                return (0);
1523
        }
1524
1525 43709
        h2->t1 = NAN;
1526 43709
        VTCP_blocking(*h2->htc->rfd);
1527 87418
        hs = HTC_RxStuff(h2->htc, h2_frame_complete, &h2->t1, NULL, NAN,
1528 43709
            VTIM_real() + 0.5, NAN, h2->local_settings.max_frame_size + 9);
1529
1530 43709
        h2e = NULL;
1531 43709
        switch (hs) {
1532
        case HTC_S_EOF:
1533 4479
                h2_htc_debug(hs, h2);
1534 4479
                h2e = H2CE_NO_ERROR;
1535 4479
                break;
1536
        case HTC_S_COMPLETE:
1537 35520
                h2->sess->t_idle = VTIM_real();
1538 35520
                if (h2->do_sweep)
1539 836
                        h2e = h2_sweep(wrk, h2);
1540 35520
                break;
1541
        case HTC_S_TIMEOUT:
1542
                //// #4279
1543
                // h2_htc_debug(hs, h2);
1544 3710
                h2e = h2_sweep(wrk, h2);
1545 3710
                break;
1546
        default:
1547 0
                HTC_Status(hs, &s, &r);
1548 0
                H2S_Lock_VSLb(h2, SLT_SessError, "H2: HTC %s (%s)", s, r);
1549 0
                h2e = H2CE_ENHANCE_YOUR_CALM;
1550 0
        }
1551
1552 43709
        if (h2e != NULL && h2e->connection) {
1553 4585
                h2->error = h2e;
1554 4585
                h2_tx_goaway(wrk, h2, h2e);
1555 4585
                return (0);
1556
        }
1557
1558 39124
        if (hs != HTC_S_COMPLETE)
1559 3604
                return (1);
1560
1561 35520
        h2->rxf_len = vbe32dec(h2->htc->rxbuf_b) >> 8;
1562 35520
        h2->rxf_type = h2->htc->rxbuf_b[3];
1563 35520
        h2->rxf_flags = h2->htc->rxbuf_b[4];
1564 35520
        h2->rxf_stream = vbe32dec(h2->htc->rxbuf_b + 5);
1565 35520
        h2->rxf_stream &= ~(1LU<<31);                   // rfc7540,l,690,692
1566 35520
        h2->rxf_data = (void*)(h2->htc->rxbuf_b + 9);
1567
        /* XXX: later full DATA will not be rx'ed yet. */
1568 35520
        HTC_RxPipeline(h2->htc, h2->htc->rxbuf_b + h2->rxf_len + 9);
1569
1570 35520
        h2_vsl_frame(h2, h2->htc->rxbuf_b, 9L + h2->rxf_len);
1571 35520
        h2->srq->acct.req_hdrbytes += 9;
1572
1573 35520
        if (h2->rxf_type >= H2FMAX) {
1574
                // rfc7540,l,679,681
1575
                // XXX: later, drain rest of frame
1576 40
                h2->bogosity++;
1577 80
                H2S_Lock_VSLb(h2, SLT_Debug,
1578
                    "H2: Unknown frame type 0x%02x (ignored)",
1579 40
                    (uint8_t)h2->rxf_type);
1580 40
                h2->srq->acct.req_bodybytes += h2->rxf_len;
1581 40
                return (1);
1582
        }
1583 35480
        h2f = h2flist[h2->rxf_type];
1584
1585 35480
        AN(h2f->name);
1586 35480
        AN(h2f->rxfunc);
1587 35480
        if (h2f->overhead)
1588 14520
                h2->srq->acct.req_bodybytes += h2->rxf_len;
1589
1590 35480
        if (h2->rxf_flags & ~h2f->flags) {
1591
                // rfc7540,l,687,688
1592 80
                h2->bogosity++;
1593 160
                H2S_Lock_VSLb(h2, SLT_Debug,
1594
                    "H2: Unknown flags 0x%02x on %s (ignored)",
1595 80
                    (uint8_t)h2->rxf_flags & ~h2f->flags, h2f->name);
1596 80
                h2->rxf_flags &= h2f->flags;
1597 80
        }
1598
1599 35480
        h2e = h2_procframe(wrk, h2, h2f);
1600 35480
        if (h2->error == NULL && h2e != NULL) {
1601 1200
                h2->error = h2e;
1602 1200
                h2_tx_goaway(wrk, h2, h2e);
1603 1200
        }
1604
1605 35480
        return (h2->error != NULL ? 0 : 1);
1606 43709
}