{{ message }}
Repository navigation
Expand file tree
/
Copy pathh3.c
More file actions
3868 lines (3372 loc) · 119 KB
/
Copy pathh3.c
File metadata and controls
3868 lines (3372 loc) · 119 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
/*
* HTTP/3 protocol processing
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation, version 2.1
* exclusively.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*/
#include <import/ist.h>
#include <haproxy/api.h>
#include <haproxy/buf.h>
#include <haproxy/chunk.h>
#include <haproxy/connection.h>
#include <haproxy/dynbuf.h>
#include <haproxy/h3.h>
#include <haproxy/h3_stats.h>
#include <haproxy/http.h>
#include <haproxy/http-hdr-t.h>
#include <haproxy/http_htx.h>
#include <haproxy/htx.h>
#include <haproxy/intops.h>
#include <haproxy/istbuf.h>
#include <haproxy/mux_quic.h>
#include <haproxy/pool.h>
#include <haproxy/qcm_http.h>
#include <haproxy/qpack-dec.h>
#include <haproxy/qpack-enc.h>
#include <haproxy/quic_conn.h>
#include <haproxy/quic_enc.h>
#include <haproxy/quic_fctl.h>
#include <haproxy/quic_frame.h>
#include <haproxy/quic_utils.h>
#include <haproxy/tools.h>
#include <haproxy/trace.h>
/* trace source and events */
static const struct trace_event h3_trace_events[] __maybe_unused = {
#define H3_EV_RX_FRAME (1ULL << 0)
{ .mask = H3_EV_RX_FRAME, .name = "rx_frame", .desc = "receipt of any H3 frame" },
#define H3_EV_RX_DATA (1ULL << 1)
{ .mask = H3_EV_RX_DATA, .name = "rx_data", .desc = "receipt of H3 DATA frame" },
#define H3_EV_RX_HDR (1ULL << 2)
{ .mask = H3_EV_RX_HDR, .name = "rx_hdr", .desc = "receipt of H3 HEADERS frame" },
#define H3_EV_RX_SETTINGS (1ULL << 3)
{ .mask = H3_EV_RX_SETTINGS, .name = "rx_settings", .desc = "receipt of H3 SETTINGS frame" },
#define H3_EV_TX_FRAME (1ULL << 4)
{ .mask = H3_EV_TX_FRAME, .name = "tx_frame", .desc = "transmission of any H3 frame" },
#define H3_EV_TX_DATA (1ULL << 5)
{ .mask = H3_EV_TX_DATA, .name = "tx_data", .desc = "transmission of H3 DATA frame" },
#define H3_EV_TX_HDR (1ULL << 6)
{ .mask = H3_EV_TX_HDR, .name = "tx_hdr", .desc = "transmission of H3 HEADERS frame" },
#define H3_EV_TX_SETTINGS (1ULL << 7)
{ .mask = H3_EV_TX_SETTINGS, .name = "tx_settings", .desc = "transmission of H3 SETTINGS frame" },
#define H3_EV_H3S_NEW (1ULL << 8)
{ .mask = H3_EV_H3S_NEW, .name = "h3s_new", .desc = "new H3 stream" },
#define H3_EV_H3S_END (1ULL << 9)
{ .mask = H3_EV_H3S_END, .name = "h3s_end", .desc = "H3 stream terminated" },
#define H3_EV_H3C_NEW (1ULL << 10)
{ .mask = H3_EV_H3C_NEW, .name = "h3c_new", .desc = "new H3 connection" },
#define H3_EV_H3C_END (1ULL << 11)
{ .mask = H3_EV_H3C_END, .name = "h3c_end", .desc = "H3 connection terminated" },
#define H3_EV_STRM_SEND (1ULL << 12)
{ .mask = H3_EV_STRM_SEND, .name = "strm_send", .desc = "sending data for stream" },
{ }
};
#if defined(USE_TRACE)
static void h3_trace(enum trace_level level, uint64_t mask,
const struct trace_source *src,
const struct ist where, const struct ist func,
const void *a1, const void *a2, const void *a3, const void *a4);
static const struct name_desc h3_trace_lockon_args[4] = {
/* arg1 */ { /* already used by the connection */ },
/* arg2 */ { .name="qcs", .desc="QUIC stream" },
/* arg3 */ { },
/* arg4 */ { }
};
static const struct name_desc h3_trace_decoding[] = {
#define H3_VERB_CLEAN 1
{ .name="clean", .desc="only user-friendly stuff, generally suitable for level \"user\"" },
#define H3_VERB_MINIMAL 2
{ .name="minimal", .desc="report only qcc/qcs state and flags, no real decoding" },
#define H3_VERB_SIMPLE 3
{ .name="simple", .desc="add request/response status line or frame info when available" },
#define H3_VERB_ADVANCED 4
{ .name="advanced", .desc="add header fields or frame decoding when available" },
{ /* end */ }
};
struct trace_source trace_h3 = {
.name = IST("h3"),
.desc = "HTTP/3 transcoder",
.arg_def = TRC_ARG1_CONN, /* TRACE()'s first argument is always a connection */
.default_cb = h3_trace,
.known_events = h3_trace_events,
.lockon_args = h3_trace_lockon_args,
.decoding = h3_trace_decoding,
.report_events = ~0, /* report everything by default */
};
#define TRACE_SOURCE &trace_h3
INITCALL1(STG_REGISTER, trace_register_source, TRACE_SOURCE);
#endif /* USE_TRACE */
#if defined(DEBUG_H3)
#define h3_debug_printf fprintf
#define h3_debug_hexdump debug_hexdump
#else
#define h3_debug_printf(...) do { } while (0)
#define h3_debug_hexdump(...) do { } while (0)
#endif
#define H3_CF_SETTINGS_SENT 0x00000001 /* SETTINGS frame already sent on local control stream */
#define H3_CF_SETTINGS_RECV 0x00000002 /* SETTINGS frame already received on remote control stream */
#define H3_CF_UNI_CTRL_SET 0x00000004 /* Remote H3 Control stream opened */
#define H3_CF_UNI_QPACK_DEC_SET 0x00000008 /* Remote QPACK decoder stream opened */
#define H3_CF_UNI_QPACK_ENC_SET 0x00000010 /* Remote QPACK encoder stream opened */
#define H3_CF_GOAWAY_SENT 0x00000020 /* GOAWAY sent on local control stream */
#define H3_CF_GOAWAY_RECV 0x00000040 /* GOAWAY received from the peer */
/* Default settings */
static uint64_t h3_settings_qpack_max_table_capacity = 0;
static uint64_t h3_settings_qpack_blocked_streams = 4096;
static uint64_t h3_settings_max_field_section_size = QUIC_VARINT_8_BYTE_MAX; /* Unlimited */
struct h3c {
struct qcc *qcc;
struct qcs *ctrl_strm; /* Control stream */
int err;
uint32_t flags;
/* Settings */
uint64_t qpack_max_table_capacity;
uint64_t qpack_blocked_streams;
uint64_t max_field_section_size;
uint64_t id_shut_l; /* GOAWAY ID locally emitted */
uint64_t id_shut_r; /* GOAWAY ID emitted by the peer */
struct buffer_wait buf_wait; /* wait list for buffer allocations */
/* Stats counters */
struct h3_counters *prx_counters;
};
DECLARE_STATIC_TYPED_POOL(pool_head_h3c, "h3c", struct h3c);
#define H3_SF_UNI_INIT 0x00000001 /* stream type not parsed for unidirectional stream */
#define H3_SF_UNI_NO_H3 0x00000002 /* unidirectional stream does not carry H3 frames */
#define H3_SF_HAVE_CLEN 0x00000004 /* content-length header is present; relevant either for request or response depending on the side of the connection */
#define H3_SF_SENT_INTERIM 0x00000008 /* last response sent is 1xx interim. Used on FE side only. */
#define H3_SF_RECV_INTERIM 0x00000010 /* last response sent is 1xx interim. Used on BE side only. */
struct h3s {
struct h3c *h3c;
enum h3s_t type;
enum h3s_st_req st_req; /* only used for request streams */
uint64_t demux_frame_len; /* current parser frame remaining content to read */
uint64_t demux_frame_type; /* current parser frame type */
unsigned long long body_len; /* known request body length from content-length header if present */
unsigned long long data_len; /* total length of all parsed DATA */
int flags;
int err; /* used for stream reset */
};
DECLARE_STATIC_TYPED_POOL(pool_head_h3s, "h3s", struct h3s);
/* Initialize an uni-stream <qcs> by reading its type from <b>.
*
* Returns the count of consumed bytes or a negative error code.
*/
static ssize_t h3_init_uni_stream(struct h3c *h3c, struct qcs *qcs,
struct buffer *b)
{
/* decode unidirectional stream type */
struct h3s *h3s = qcs->ctx;
uint64_t type;
size_t len = 0, ret;
TRACE_ENTER(H3_EV_H3S_NEW, qcs->qcc->conn, qcs);
/* Function reserved to uni streams. Must be called only once per stream instance. */
BUG_ON(!quic_stream_is_uni(qcs->id) || h3s->flags & H3_SF_UNI_INIT);
ret = b_quic_dec_int(&type, b, &len);
if (!ret) {
/* not enough data to decode uni stream type, retry later */
TRACE_DATA("cannot decode uni stream type due to incomplete data", H3_EV_H3S_NEW, qcs->qcc->conn, qcs);
goto out;
}
switch (type) {
case H3_UNI_S_T_CTRL:
if (h3c->flags & H3_CF_UNI_CTRL_SET) {
TRACE_ERROR("duplicated control stream", H3_EV_H3S_NEW, qcs->qcc->conn, qcs);
qcc_set_error(qcs->qcc, H3_ERR_STREAM_CREATION_ERROR, 1,
muxc_tevt_type_proto_err);
qcc_report_glitch(qcs->qcc, 1);
goto err;
}
h3c->flags |= H3_CF_UNI_CTRL_SET;
h3s->type = H3S_T_CTRL;
break;
case H3_UNI_S_T_PUSH:
if (!conn_is_back(qcs->qcc->conn)) {
/* RFC 9114 6.2.2. Push Streams
*
* Only servers can push; if a server receives a client-initiated push
* stream, this MUST be treated as a connection error of type
* H3_STREAM_CREATION_ERROR.
*/
TRACE_ERROR("reject push from client", H3_EV_H3S_NEW, qcs->qcc->conn, qcs);
qcc_set_error(qcs->qcc, H3_ERR_STREAM_CREATION_ERROR, 1,
muxc_tevt_type_proto_err);
qcc_report_glitch(qcs->qcc, 1);
goto err;
}
else {
/* RFC 9114 4.6. Server Push
*
* A client MUST treat receipt of a push stream as a connection
* error of type H3_ID_ERROR when no MAX_PUSH_ID frame has been sent or
* when the stream references a push ID that is greater than the maximum
* push ID.
*/
TRACE_ERROR("reject push from server outside of MAX_PUSH_ID", H3_EV_H3S_NEW, qcs->qcc->conn, qcs);
qcc_set_error(qcs->qcc, H3_ERR_ID_ERROR, 1,
muxc_tevt_type_proto_err);
qcc_report_glitch(qcs->qcc, 1);
goto err;
}
break;
case H3_UNI_S_T_QPACK_DEC:
if (h3c->flags & H3_CF_UNI_QPACK_DEC_SET) {
TRACE_ERROR("duplicated qpack decoder stream", H3_EV_H3S_NEW, qcs->qcc->conn, qcs);
qcc_set_error(qcs->qcc, H3_ERR_STREAM_CREATION_ERROR, 1,
muxc_tevt_type_proto_err);
qcc_report_glitch(qcs->qcc, 1);
goto err;
}
h3c->flags |= H3_CF_UNI_QPACK_DEC_SET;
h3s->type = H3S_T_QPACK_DEC;
h3s->flags |= H3_SF_UNI_NO_H3;
break;
case H3_UNI_S_T_QPACK_ENC:
if (h3c->flags & H3_CF_UNI_QPACK_ENC_SET) {
TRACE_ERROR("duplicated qpack encoder stream", H3_EV_H3S_NEW, qcs->qcc->conn, qcs);
qcc_set_error(qcs->qcc, H3_ERR_STREAM_CREATION_ERROR, 1,
muxc_tevt_type_proto_err);
qcc_report_glitch(qcs->qcc, 1);
goto err;
}
h3c->flags |= H3_CF_UNI_QPACK_ENC_SET;
h3s->type = H3S_T_QPACK_ENC;
h3s->flags |= H3_SF_UNI_NO_H3;
break;
default:
/* RFC 9114 Section 9. Extensions to HTTP/3
*
* Implementations MUST abort reading on unidirectional
* streams that have unknown or unsupported types.
*/
TRACE_STATE("abort reading on unknown uni stream type", H3_EV_H3S_NEW, qcs->qcc->conn, qcs);
qcc_abort_stream_read(qcs, H3_ERR_NO_ERROR);
goto err;
}
h3s->flags |= H3_SF_UNI_INIT;
out:
TRACE_LEAVE(H3_EV_H3S_NEW, qcs->qcc->conn, qcs);
return len;
err:
TRACE_DEVEL("leaving on error", H3_EV_H3S_NEW, qcs->qcc->conn, qcs);
return -1;
}
/* Parse a buffer <b> for a <qcs> uni-stream which does not contains H3 frames.
* This may be used for QPACK encoder/decoder streams for example. <fin> is set
* if this is the last frame of the stream.
*
* Returns the number of consumed bytes or a negative error code.
*/
static ssize_t h3_parse_uni_stream_no_h3(struct qcs *qcs, struct buffer *b, int fin)
{
struct h3s *h3s = qcs->ctx;
int ret = -1;
/* Function reserved to non-HTTP/3 unidirectional streams. */
BUG_ON(!quic_stream_is_uni(qcs->id) || !(h3s->flags & H3_SF_UNI_NO_H3));
switch (h3s->type) {
case H3S_T_QPACK_DEC:
ret = qpack_decode_dec(b, fin, qcs);
break;
case H3S_T_QPACK_ENC:
ret = qpack_decode_enc(b, fin, qcs);
break;
case H3S_T_UNKNOWN:
default:
/* Unknown stream should be flagged with QC_SF_READ_ABORTED. */
ABORT_NOW();
}
return ret;
}
/* Decode a H3 frame header from <rxbuf> buffer. The frame type is stored in
* <ftype> and length in <flen>.
*
* Returns the size of the H3 frame header. Note that the input buffer is not
* consumed.
*/
static inline size_t h3_decode_frm_header(uint64_t *ftype, uint64_t *flen,
struct buffer *b)
{
size_t hlen;
hlen = 0;
if (!b_quic_dec_int(ftype, b, &hlen) ||
!b_quic_dec_int(flen, b, &hlen)) {
return 0;
}
return hlen;
}
/* Check if H3 frame of type <ftype> is valid when received on stream <qcs>.
*
* Returns 0 if frame valid, otherwise HTTP/3 error code.
*/
static int h3_check_frame_valid(struct h3c *h3c, struct qcs *qcs, uint64_t ftype)
{
struct h3s *h3s = qcs->ctx;
int ret = 0;
/* Stream type must be known to ensure frame is valid for this stream. */
BUG_ON(h3s->type == H3S_T_UNKNOWN);
switch (ftype) {
case H3_FT_DATA:
/* cf H3_FT_HEADERS case. */
if (h3s->type == H3S_T_CTRL ||
(h3s->st_req != H3S_ST_REQ_HEADERS && h3s->st_req != H3S_ST_REQ_DATA)) {
ret = H3_ERR_FRAME_UNEXPECTED;
}
break;
case H3_FT_HEADERS:
/* RFC 9114 4.1. HTTP Message Framing
*
*
* An HTTP message (request or response) consists of:
* 1. the header section, including message control data, sent as a
* single HEADERS frame,
* 2. optionally, the content, if present, sent as a series of DATA
* frames, and
* 3. optionally, the trailer section, if present, sent as a single
* HEADERS frame.
*
* [...]
*
* Receipt of an invalid sequence of frames MUST be treated as a
* connection error of type H3_FRAME_UNEXPECTED. In particular, a DATA
* frame before any HEADERS frame, or a HEADERS or DATA frame after the
* trailing HEADERS frame, is considered invalid. Other frame types,
* especially unknown frame types, might be permitted subject to their
* own rules; see Section 9.
*/
if (h3s->type == H3S_T_CTRL || h3s->st_req == H3S_ST_REQ_TRAILERS)
ret = H3_ERR_FRAME_UNEXPECTED;
break;
case H3_FT_CANCEL_PUSH:
case H3_FT_GOAWAY:
/* RFC 9114 7.2.3. CANCEL_PUSH
*
* A CANCEL_PUSH frame is sent on the control stream. Receiving a
* CANCEL_PUSH frame on a stream other than the control stream MUST be
* treated as a connection error of type H3_FRAME_UNEXPECTED.
*/
/* RFC 9114 7.2.6. GOAWAY
*
* A client MUST treat a GOAWAY frame on a stream other than the
* control stream as a connection error of type H3_FRAME_UNEXPECTED.
*/
if (h3s->type != H3S_T_CTRL)
ret = H3_ERR_FRAME_UNEXPECTED;
else if (!(h3c->flags & H3_CF_SETTINGS_RECV))
ret = H3_ERR_MISSING_SETTINGS;
break;
case H3_FT_SETTINGS:
/* RFC 9114 7.2.4. SETTINGS
*
* A SETTINGS frame MUST be sent as the first frame of
* each control stream (see Section 6.2.1) by each peer, and it MUST NOT
* be sent subsequently. If an endpoint receives a second SETTINGS frame
* on the control stream, the endpoint MUST respond with a connection
* error of type H3_FRAME_UNEXPECTED.
*
* SETTINGS frames MUST NOT be sent on any stream other than the control
* stream. If an endpoint receives a SETTINGS frame on a different
* stream, the endpoint MUST respond with a connection error of type
* H3_FRAME_UNEXPECTED.
*/
if (h3s->type != H3S_T_CTRL || h3c->flags & H3_CF_SETTINGS_RECV)
ret = H3_ERR_FRAME_UNEXPECTED;
break;
case H3_FT_PUSH_PROMISE:
/* RFC 9114 7.2.5. PUSH_PROMISE
*
* If a PUSH_PROMISE frame is received on the control stream, the client
* MUST respond with a connection error of type H3_FRAME_UNEXPECTED.
*
* A client MUST NOT send a PUSH_PROMISE frame. A server MUST treat the
* receipt of a PUSH_PROMISE frame as a connection error of type
* H3_FRAME_UNEXPECTED.
*/
if (h3s->type == H3S_T_CTRL || !conn_is_back(qcs->qcc->conn))
ret = H3_ERR_FRAME_UNEXPECTED;
break;
case H3_FT_MAX_PUSH_ID:
/* RFC 9114 7.2.7. MAX_PUSH_ID
*
* The MAX_PUSH_ID frame is always sent on the control stream. Receipt
* of a MAX_PUSH_ID frame on any other stream MUST be treated as a
* connection error of type H3_FRAME_UNEXPECTED.
*
* A server MUST NOT send a MAX_PUSH_ID frame. A client MUST treat the
* receipt of a MAX_PUSH_ID frame as a connection error of type
* H3_FRAME_UNEXPECTED.
*/
if (h3s->type != H3S_T_CTRL || conn_is_back(qcs->qcc->conn))
ret = H3_ERR_FRAME_UNEXPECTED;
else if (!(h3c->flags & H3_CF_SETTINGS_RECV))
ret = H3_ERR_MISSING_SETTINGS;
break;
default:
/* RFC 9114 9. Extensions to HTTP/3
*
* Implementations MUST ignore unknown or unsupported values in all
* extensible protocol elements. [...]
* However, where a known frame type is required to be in a
* specific location, such as the SETTINGS frame as the first frame of
* the control stream (see Section 6.2.1), an unknown frame type does
* not satisfy that requirement and SHOULD be treated as an error.
*/
if (h3s->type == H3S_T_CTRL && !(h3c->flags & H3_CF_SETTINGS_RECV))
ret = H3_ERR_MISSING_SETTINGS;
break;
}
return ret;
}
/* Check from stream <qcs> that length of all DATA frames does not exceed with
* a previously parsed content-length header. <fin> must be set for the last
* data of the stream so that length of DATA frames must be equal to the
* content-length.
*
* This must only be called for a stream with H3_SF_HAVE_CLEN flag.
*
* Return 0 on valid else non-zero.
*/
static int h3_check_body_size(struct qcs *qcs, int fin)
{
struct h3s *h3s = qcs->ctx;
int ret = 0;
TRACE_ENTER(H3_EV_RX_FRAME, qcs->qcc->conn, qcs);
/* Reserved for streams with a previously parsed content-length header. */
BUG_ON(!(h3s->flags & H3_SF_HAVE_CLEN));
/* RFC 9114 4.1.2. Malformed Requests and Responses
*
* A request or response that is defined as having content when it
* contains a Content-Length header field (Section 8.6 of [HTTP]) is
* malformed if the value of the Content-Length header field does not
* equal the sum of the DATA frame lengths received.
*
* TODO for backend support
* A response that is
* defined as never having content, even when a Content-Length is
* present, can have a non-zero Content-Length header field even though
* no content is included in DATA frames.
*/
if (h3s->data_len > h3s->body_len ||
(fin && h3s->data_len < h3s->body_len)) {
TRACE_ERROR("Content-length does not match DATA frame size", H3_EV_RX_FRAME|H3_EV_RX_DATA, qcs->qcc->conn, qcs);
h3s->err = H3_ERR_MESSAGE_ERROR;
qcc_report_glitch(qcs->qcc, 1);
ret = -1;
}
TRACE_LEAVE(H3_EV_RX_FRAME, qcs->qcc->conn, qcs);
return ret;
}
/* Set <auth> authority header to the new value <value> for <qcs> stream. This
* ensures that value is conformant to the specification. If <auth> is a
* non-null length string, it ensures that <value> is identical to it.
*
* Returns 0 on success else non-zero.
*/
static int h3_set_authority(struct qcs *qcs, struct ist *auth, const struct ist value)
{
/* RFC 9114 4.3.1. Request Pseudo-Header Fields
*
* If the :scheme pseudo-header field identifies a scheme that has a
* mandatory authority component (including "http" and "https"), the
* request MUST contain either an :authority pseudo-header field or a
* Host header field. If these fields are present, they MUST NOT be
* empty. If both fields are present, they MUST contain the same value.
*/
/* Check that if a previous value is set the new value is identical. */
if (isttest(*auth) && !isteq(*auth, value)) {
TRACE_ERROR("difference between :authority and host headers", H3_EV_RX_FRAME|H3_EV_RX_HDR, qcs->qcc->conn, qcs);
return 1;
}
/* Check that value is not empty. */
if (!istlen(value)) {
TRACE_ERROR("empty :authority/host header", H3_EV_RX_FRAME|H3_EV_RX_HDR, qcs->qcc->conn, qcs);
return 1;
}
*auth = value;
return 0;
}
/* Ensure pseudo-header <h> is valid as it does not contains any invalid character. */
static int _h3_handle_phdr(struct qcs *qcs, const struct http_hdr *h)
{
/* look for forbidden control characters in the pseudo-header value */
const char *ctl = ist_find_ctl(h->v);
if (unlikely(ctl) && http_header_has_forbidden_char(h->v, ctl)) {
TRACE_ERROR("control character present in pseudo-header value", H3_EV_RX_FRAME|H3_EV_RX_HDR, qcs->qcc->conn, qcs);
goto err;
}
return 0;
err:
return 1;
}
/* Ensure header <hdr> is valid. */
static int _h3_handle_hdr(struct qcs *qcs, const struct http_hdr *hdr)
{
const struct ist name = hdr->n;
const struct ist value = hdr->v;
const char *ctl;
int i;
if (isteq(name, ist("")))
return 1;
if (istmatch(name, ist(":"))) {
TRACE_ERROR("pseudo-header field after fields", H3_EV_RX_FRAME|H3_EV_RX_HDR, qcs->qcc->conn, qcs);
goto err;
}
for (i = 0; i < istlen(name); ++i) {
const char c = istptr(name)[i];
if ((uint8_t)(c - 'A') <= 'Z' - 'A' || !HTTP_IS_TOKEN(c)) {
TRACE_ERROR("invalid characters in field name", H3_EV_RX_FRAME|H3_EV_RX_HDR, qcs->qcc->conn, qcs);
goto err;
}
}
/* RFC 9114 10.3 Intermediary-Encapsulation Attacks
*
* While most values that can be encoded will not alter field
* parsing, carriage return (ASCII 0x0d), line feed (ASCII 0x0a),
* and the null character (ASCII 0x00) might be exploited by an
* attacker if they are translated verbatim. Any request or
* response that contains a character not permitted in a field
* value MUST be treated as malformed
*/
/* look for forbidden control characters in the header value */
ctl = ist_find_ctl(value);
if (unlikely(ctl) && http_header_has_forbidden_char(value, ctl)) {
TRACE_ERROR("control character present in header value", H3_EV_RX_FRAME|H3_EV_RX_HDR, qcs->qcc->conn, qcs);
goto err;
}
return 0;
err:
return 1;
}
/* Remove any leading/trailing HTTP whitespace from <value>. Used to sanitize HTTP header values. */
static struct ist _h3_trim_header(struct ist value)
{
struct ist v;
for (v = value; v.len; v.len--) {
if (unlikely(HTTP_IS_LWS(*v.ptr)))
v.ptr++;
else if (!unlikely(HTTP_IS_LWS(v.ptr[v.len - 1])))
break;
}
return v;
}
#if defined(USE_TRACE)
static void _h3_trace_header(const struct ist n, const struct ist v,
uint64_t mask, const struct ist trc_loc, const char *func,
const struct qcc *qcc, const struct qcs *qcs)
{
struct ist n_short, v_short;
const char *c_str __maybe_unused;
const char *s_str __maybe_unused;
chunk_reset(&trash);
c_str = chunk_newstr(&trash);
if (qcc)
chunk_appendf(&trash, "qcc=%p(%c)", qcc, (qcc->flags & QC_CF_IS_BACK) ? 'B' : 'F');
s_str = chunk_newstr(&trash);
if (qcs)
chunk_appendf(&trash, " qcs=%p(%llu)", qcs, (ullong)qcs->id);
n_short = ist2(chunk_newstr(&trash), 0);
istscpy(&n_short, n, 256);
trash.data += n_short.len;
if (n_short.len != n.len)
chunk_appendf(&trash, " (... +%ld)", (long)(n.len - n_short.len));
v_short = ist2(chunk_newstr(&trash), 0);
istscpy(&v_short, v, 1024);
trash.data += v_short.len;
if (v_short.len != v.len)
chunk_appendf(&trash, " (... +%ld)", (long)(v.len - v_short.len));
TRACE_PRINTF_LOC(TRACE_LEVEL_USER, mask, trc_loc, func,
qcc ? qcc->conn : NULL, qcs, 0, 0, "%s%s %s %s: %s", c_str, s_str,
mask & H3_EV_TX_HDR ? "sndh" : "rcvh",
istptr(n_short), istptr(v_short));
}
/* Output a trace for HTTP/3 header <n>:<v> if tracing is enabled. */
static void h3_trace_header(const struct ist n, const struct ist v,
uint64_t mask, const struct ist trc_loc, const char *func,
const struct qcc *qcc, const struct qcs *qcs)
{
if ((TRACE_SOURCE)->verbosity >= H3_VERB_ADVANCED &&
TRACE_ENABLED(TRACE_LEVEL_USER, mask, qcc ? qcc->conn : 0, qcs, 0, 0))
_h3_trace_header(n, v, mask, trc_loc, func, qcc, qcs);
}
#else /* USE_TRACE not defined */
/* dummy function */
static inline void h3_trace_header(const struct ist n, const struct ist v,
uint64_t mask, const struct ist trc_loc, const char *func,
const struct qcc *qcc, const struct qcs *qcs)
{
}
#endif /* USE_TRACE */
/* Parse from buffer <buf> a H3 HEADERS frame of length <len>. Data are copied
* in a local HTX buffer and transfer to the stream connector layer. <fin> must be
* set if this is the last data to transfer from this stream.
*
* Returns the number of consumed bytes or a negative error code. On error
* either the connection should be closed or the stream reset using codes
* provided in h3c.err / h3s.err.
*/
static ssize_t h3_req_headers_to_htx(struct qcs *qcs, const struct buffer *buf,
uint64_t len, char fin)
{
struct h3s *h3s = qcs->ctx;
struct h3c *h3c = h3s->h3c;
struct buffer htx_buf = BUF_NULL;
struct buffer *tmp = get_trash_chunk();
struct htx *htx = NULL;
struct htx_sl *sl;
struct http_hdr list[global.tune.max_http_hdr * 2];
unsigned int flags = HTX_SL_F_NONE;
struct ist meth = IST_NULL, path = IST_NULL;
struct ist scheme = IST_NULL, authority = IST_NULL;
struct ist uri;
int hdr_idx, ret;
int cookie = -1, last_cookie = -1, i;
int relaxed = !!(h3c->qcc->proxy->options2 & PR_O2_REQBUG_OK);
int qpack_err;
/* RFC 9114 4.1.2. Malformed Requests and Responses
*
* A malformed request or response is one that is an otherwise valid
* sequence of frames but is invalid due to:
* - the presence of prohibited fields or pseudo-header fields,
* - the absence of mandatory pseudo-header fields,
* - invalid values for pseudo-header fields,
* - pseudo-header fields after fields,
* - an invalid sequence of HTTP messages,
* - the inclusion of uppercase field names, or
* - the inclusion of invalid characters in field names or values.
*
* [...]
*
* Intermediaries that process HTTP requests or responses (i.e., any
* intermediary not acting as a tunnel) MUST NOT forward a malformed
* request or response. Malformed requests or responses that are
* detected MUST be treated as a stream error of type H3_MESSAGE_ERROR.
*/
TRACE_ENTER(H3_EV_RX_FRAME|H3_EV_RX_HDR, qcs->qcc->conn, qcs);
if (!len) {
/* Reject empty frame as it lacks at least any mandatory pseudo-header. */
TRACE_ERROR("reject empty HEADERS frame", H3_EV_RX_FRAME|H3_EV_RX_HDR, qcs->qcc->conn, qcs);
h3s->err = H3_ERR_MESSAGE_ERROR;
qcc_report_glitch(h3c->qcc, 1);
len = -1;
goto out;
}
/* TODO support trailer parsing in this function */
/* TODO support buffer wrapping */
BUG_ON(b_head(buf) + len > b_wrap(buf));
ret = qpack_decode_fs((const unsigned char *)b_head(buf), len, tmp,
list, sizeof(list) / sizeof(list[0]));
if (ret < 0) {
TRACE_ERROR("QPACK decoding error", H3_EV_RX_FRAME|H3_EV_RX_HDR, qcs->qcc->conn, qcs);
if ((qpack_err = qpack_err_decode(ret)) >= 0) {
h3c->err = qpack_err;
qcc_report_glitch(qcs->qcc, 1);
}
len = -1;
goto out;
}
#if defined(USE_TRACE)
if ((TRACE_SOURCE)->verbosity >= H3_VERB_ADVANCED &&
TRACE_ENABLED(TRACE_LEVEL_USER, H3_EV_RX_FRAME|H3_EV_RX_HDR, qcs->qcc->conn, 0, 0, 0)) {
for (i = 0; list[i].n.len; ++i)
h3_trace_header(list[i].n, list[i].v, H3_EV_RX_HDR, ist(TRC_LOC), __FUNCTION__, qcs->qcc, qcs);
}
#endif
if (!b_alloc(&htx_buf, DB_SE_RX)) {
TRACE_ERROR("HTX buffer alloc failure", H3_EV_RX_FRAME|H3_EV_RX_HDR, qcs->qcc->conn, qcs);
len = -1;
goto out;
}
BUG_ON(!b_size(&htx_buf)); /* TODO */
htx = htx_from_buf(&htx_buf);
/* first treat pseudo-header to build the start line */
hdr_idx = 0;
while (1) {
/* RFC 9114 4.3. HTTP Control Data
*
* Endpoints MUST treat a request or response that contains
* undefined or invalid pseudo-header fields as malformed.
*
* All pseudo-header fields MUST appear in the header section before
* regular header fields. Any request or response that contains a
* pseudo-header field that appears in a header section after a regular
* header field MUST be treated as malformed.
*/
/* Stop at first non pseudo-header. */
if (!istmatch(list[hdr_idx].n, ist(":")))
break;
/* RFC 9114 10.3 Intermediary-Encapsulation Attacks
*
* While most values that can be encoded will not alter field
* parsing, carriage return (ASCII 0x0d), line feed (ASCII 0x0a),
* and the null character (ASCII 0x00) might be exploited by an
* attacker if they are translated verbatim. Any request or
* response that contains a character not permitted in a field
* value MUST be treated as malformed
*/
if (_h3_handle_phdr(qcs, &list[hdr_idx])) {
h3s->err = H3_ERR_MESSAGE_ERROR;
qcc_report_glitch(h3c->qcc, 1);
len = -1;
goto out;
}
/* pseudo-header. Malformed name with uppercase character or
* invalid token will be rejected in the else clause.
*/
if (isteq(list[hdr_idx].n, ist(":method"))) {
if (isttest(meth)) {
TRACE_ERROR("duplicated method pseudo-header", H3_EV_RX_FRAME|H3_EV_RX_HDR, qcs->qcc->conn, qcs);
h3s->err = H3_ERR_MESSAGE_ERROR;
qcc_report_glitch(h3c->qcc, 1);
len = -1;
goto out;
}
if (!istlen(list[hdr_idx].v) || http_method_has_forbidden_char(list[hdr_idx].v)) {
TRACE_ERROR("invalid method pseudo-header", H3_EV_RX_FRAME|H3_EV_RX_HDR, qcs->qcc->conn, qcs);
h3s->err = H3_ERR_MESSAGE_ERROR;
qcc_report_glitch(h3c->qcc, 1);
len = -1;
goto out;
}
meth = list[hdr_idx].v;
}
else if (isteq(list[hdr_idx].n, ist(":path"))) {
if (isttest(path)) {
TRACE_ERROR("duplicated path pseudo-header", H3_EV_RX_FRAME|H3_EV_RX_HDR, qcs->qcc->conn, qcs);
h3s->err = H3_ERR_MESSAGE_ERROR;
qcc_report_glitch(h3c->qcc, 1);
len = -1;
goto out;
}
if (!relaxed) {
/* we need to reject any control chars or '#' from the path,
* unless option accept-unsafe-violations-in-http-request is set.
*/
const char *ctl = ist_find_range(list[hdr_idx].v, 0, '#');
if (unlikely(ctl) && http_path_has_forbidden_char(list[hdr_idx].v, ctl)) {
TRACE_ERROR("forbidden character in ':path' pseudo-header", H3_EV_RX_FRAME|H3_EV_RX_HDR, qcs->qcc->conn, qcs);
h3s->err = H3_ERR_MESSAGE_ERROR;
qcc_report_glitch(h3c->qcc, 1);
len = -1;
goto out;
}
}
path = list[hdr_idx].v;
}
else if (isteq(list[hdr_idx].n, ist(":scheme"))) {
if (isttest(scheme)) {
/* duplicated pseudo-header */
TRACE_ERROR("duplicated scheme pseudo-header", H3_EV_RX_FRAME|H3_EV_RX_HDR, qcs->qcc->conn, qcs);
h3s->err = H3_ERR_MESSAGE_ERROR;
qcc_report_glitch(h3c->qcc, 1);
len = -1;
goto out;
}
flags |= HTX_SL_F_HAS_SCHM;
if (isteqi(list[hdr_idx].v, ist("http")))
flags |= HTX_SL_F_SCHM_HTTP;
else if (isteqi(list[hdr_idx].v, ist("https")))
flags |= HTX_SL_F_SCHM_HTTPS;
else if (!http_validate_scheme(list[hdr_idx].v)) {
TRACE_ERROR("invalid scheme pseudo-header", H3_EV_RX_FRAME|H3_EV_RX_HDR, qcs->qcc->conn, qcs);
h3s->err = H3_ERR_MESSAGE_ERROR;
qcc_report_glitch(h3c->qcc, 1);
len = -1;
goto out;
}
scheme = list[hdr_idx].v;
}
else if (isteq(list[hdr_idx].n, ist(":authority"))) {
if (isttest(authority)) {
TRACE_ERROR("duplicated authority pseudo-header", H3_EV_RX_FRAME|H3_EV_RX_HDR, qcs->qcc->conn, qcs);
h3s->err = H3_ERR_MESSAGE_ERROR;
qcc_report_glitch(h3c->qcc, 1);
len = -1;
goto out;
}
if (h3_set_authority(qcs, &authority, list[hdr_idx].v)) {
h3s->err = H3_ERR_MESSAGE_ERROR;
qcc_report_glitch(h3c->qcc, 1);
len = -1;
goto out;
}
}
else {
TRACE_ERROR("unknown pseudo-header", H3_EV_RX_FRAME|H3_EV_RX_HDR, qcs->qcc->conn, qcs);
h3s->err = H3_ERR_MESSAGE_ERROR;
qcc_report_glitch(h3c->qcc, 1);
len = -1;
goto out;
}
++hdr_idx;
}
if (!istmatch(meth, ist("CONNECT"))) {
/* RFC 9114 4.3.1. Request Pseudo-Header Fields
*
* All HTTP/3 requests MUST include exactly one value for the :method,
* :scheme, and :path pseudo-header fields, unless the request is a
* CONNECT request; see Section 4.4.
*/
if (!isttest(meth) || !isttest(scheme) || !isttest(path)) {
TRACE_ERROR("missing mandatory pseudo-header", H3_EV_RX_FRAME|H3_EV_RX_HDR, qcs->qcc->conn, qcs);
h3s->err = H3_ERR_MESSAGE_ERROR;
qcc_report_glitch(h3c->qcc, 1);
len = -1;
goto out;
}
}
else {
h3s->err = H3_ERR_REQUEST_REJECTED;
len = -1;
goto out;
}
flags |= HTX_SL_F_VER_11;
flags |= HTX_SL_F_XFER_LEN;
/* RFC 9114 4.3.1. Request Pseudo-Header Fields
*
* This pseudo-header field MUST NOT be empty for "http" or "https"
* URIs; "http" or "https" URIs that do not contain a path component
* MUST include a value of / (ASCII 0x2f). An OPTIONS request that
* does not include a path component includes the value * (ASCII
* 0x2a) for the :path pseudo-header field; see Section 7.1 of
* [HTTP].
*/
if ((isteqi(scheme, ist("http")) || isteqi(scheme, ist("https"))) &&
(!istlen(path) ||
(istptr(path)[0] != '/' && !isteq(path, ist("*"))))) {
TRACE_ERROR("invalid ':path' pseudo-header", H3_EV_RX_FRAME|H3_EV_RX_HDR, qcs->qcc->conn, qcs);
h3s->err = H3_ERR_MESSAGE_ERROR;
qcc_report_glitch(h3c->qcc, 1);
len = -1;
goto out;
}
/* We're going to concatenate :authority with :path to form a URI. Some
* characters must absolutely be avoided in :authority to make sure not
* to result in a broken concatenation. See the following links for a
* discussion on this topic:
* https://github.com/httpwg/http2-spec/pull/936
* https://github.com/haproxy/haproxy/issues/2941
*/
if (http_authority_has_forbidden_char(authority)) {
TRACE_ERROR("invalid character in authority", H3_EV_RX_FRAME|H3_EV_RX_HDR, qcs->qcc->conn, qcs);
h3s->err = H3_ERR_MESSAGE_ERROR;
qcc_report_glitch(h3c->qcc, 1);
len = -1;
goto out;
}
if (!istlen(scheme)) {
/* No scheme (CONNECT), use :authority only. */
uri = authority;
flags |= HTX_SL_F_HAS_AUTHORITY;
}
else if (isttest(authority)) {
/* Use absolute URI form as :authority is present. */
uri = ist2bin(trash.area, scheme);
istcat(&uri, ist("://"), trash.size);
istcat(&uri, authority, trash.size);
if (!isteq(path, ist("*")))
istcat(&uri, path, trash.size);
flags |= HTX_SL_F_HAS_AUTHORITY;
if (flags & (HTX_SL_F_SCHM_HTTP|HTX_SL_F_SCHM_HTTPS)) {
/* we don't know if it was originally an absolute or a
* relative request because newer versions of HTTP use
* the absolute URI format by default, which we call
* the normalized URI format internally. This is the
* strongly recommended way of sending a request for
* a regular client, so we cannot distinguish this
You can’t perform that action at this time.