luna - curl/lib/cf-h1-proxy.c

  1/***************************************************************************
  2 *                                  _   _ ____  _
  3 *  Project                     ___| | | |  _ \| |
  4 *                             / __| | | | |_) | |
  5 *                            | (__| |_| |  _ <| |___
  6 *                             \___|\___/|_| \_\_____|
  7 *
  8 * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
  9 *
 10 * This software is licensed as described in the file COPYING, which
 11 * you should have received as part of this distribution. The terms
 12 * are also available at https://curl.se/docs/copyright.html.
 13 *
 14 * You may opt to use, copy, modify, merge, publish, distribute and/or sell
 15 * copies of the Software, and permit persons to whom the Software is
 16 * furnished to do so, under the terms of the COPYING file.
 17 *
 18 * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
 19 * KIND, either express or implied.
 20 *
 21 * SPDX-License-Identifier: curl
 22 *
 23 ***************************************************************************/
 24#include "curl_setup.h"
 25
 26#if !defined(CURL_DISABLE_PROXY) && !defined(CURL_DISABLE_HTTP)
 27
 28#include "urldata.h"
 29#include "curlx/dynbuf.h"
 30#include "sendf.h"
 31#include "http.h"
 32#include "http1.h"
 33#include "http_proxy.h"
 34#include "select.h"
 35#include "progress.h"
 36#include "cfilters.h"
 37#include "cf-h1-proxy.h"
 38#include "connect.h"
 39#include "curl_trc.h"
 40#include "strcase.h"
 41#include "curlx/strparse.h"
 42
 43
 44typedef enum {
 45  H1_TUNNEL_INIT,     /* init/default/no tunnel state */
 46  H1_TUNNEL_CONNECT,  /* CONNECT request is being send */
 47  H1_TUNNEL_RECEIVE,  /* CONNECT answer is being received */
 48  H1_TUNNEL_RESPONSE, /* CONNECT response received completely */
 49  H1_TUNNEL_ESTABLISHED,
 50  H1_TUNNEL_FAILED
 51} h1_tunnel_state;
 52
 53/* struct for HTTP CONNECT tunneling */
 54struct h1_tunnel_state {
 55  struct Curl_peer *dest;
 56  struct dynbuf rcvbuf;
 57  struct dynbuf request_data;
 58  size_t nsent;
 59  size_t headerlines;
 60  struct Curl_chunker ch;
 61  int httpversion;
 62  enum keeponval {
 63    KEEPON_DONE,
 64    KEEPON_CONNECT,
 65    KEEPON_IGNORE
 66  } keepon;
 67  curl_off_t cl; /* size of content to read and ignore */
 68  h1_tunnel_state tunnel_state;
 69  BIT(chunked_encoding);
 70  BIT(close_connection);
 71  BIT(maybe_folded);
 72  BIT(leading_unfold);
 73};
 74
 75static bool tunnel_is_established(struct h1_tunnel_state *ts)
 76{
 77  return ts && (ts->tunnel_state == H1_TUNNEL_ESTABLISHED);
 78}
 79
 80static bool tunnel_is_failed(struct h1_tunnel_state *ts)
 81{
 82  return ts && (ts->tunnel_state == H1_TUNNEL_FAILED);
 83}
 84
 85static CURLcode tunnel_reinit(struct Curl_cfilter *cf,
 86                              struct Curl_easy *data,
 87                              struct h1_tunnel_state *ts)
 88{
 89  (void)data;
 90  (void)cf;
 91  DEBUGASSERT(ts);
 92  curlx_dyn_reset(&ts->rcvbuf);
 93  curlx_dyn_reset(&ts->request_data);
 94  ts->tunnel_state = H1_TUNNEL_INIT;
 95  ts->keepon = KEEPON_CONNECT;
 96  ts->cl = 0;
 97  ts->close_connection = FALSE;
 98  ts->maybe_folded = FALSE;
 99  ts->leading_unfold = FALSE;
100  return CURLE_OK;
101}
102
103static CURLcode tunnel_init(struct Curl_cfilter *cf,
104                            struct Curl_easy *data,
105                            struct h1_tunnel_state **pts)
106{
107  struct h1_tunnel_state *ts;
108
109  if(cf->conn->scheme->flags & PROTOPT_NOTCPPROXY) {
110    failf(data, "%s cannot be done over CONNECT", cf->conn->scheme->name);
111    return CURLE_UNSUPPORTED_PROTOCOL;
112  }
113
114  ts = curlx_calloc(1, sizeof(*ts));
115  if(!ts)
116    return CURLE_OUT_OF_MEMORY;
117
118  infof(data, "allocate connect buffer");
119
120  curlx_dyn_init(&ts->rcvbuf, DYN_PROXY_CONNECT_HEADERS);
121  curlx_dyn_init(&ts->request_data, DYN_HTTP_REQUEST);
122  Curl_httpchunk_init(data, &ts->ch, TRUE);
123
124  *pts = ts;
125  return tunnel_reinit(cf, data, ts);
126}
127
128static void h1_tunnel_go_state(struct Curl_cfilter *cf,
129                               struct h1_tunnel_state *ts,
130                               h1_tunnel_state new_state,
131                               struct Curl_easy *data)
132{
133  if(ts->tunnel_state == new_state)
134    return;
135  /* entering this one */
136  switch(new_state) {
137  case H1_TUNNEL_INIT:
138    CURL_TRC_CF(data, cf, "new tunnel state 'init'");
139    tunnel_reinit(cf, data, ts);
140    break;
141
142  case H1_TUNNEL_CONNECT:
143    CURL_TRC_CF(data, cf, "new tunnel state 'connect'");
144    ts->tunnel_state = H1_TUNNEL_CONNECT;
145    ts->keepon = KEEPON_CONNECT;
146    curlx_dyn_reset(&ts->rcvbuf);
147    break;
148
149  case H1_TUNNEL_RECEIVE:
150    CURL_TRC_CF(data, cf, "new tunnel state 'receive'");
151    ts->tunnel_state = H1_TUNNEL_RECEIVE;
152    break;
153
154  case H1_TUNNEL_RESPONSE:
155    CURL_TRC_CF(data, cf, "new tunnel state 'response'");
156    ts->tunnel_state = H1_TUNNEL_RESPONSE;
157    break;
158
159  case H1_TUNNEL_ESTABLISHED:
160    CURL_TRC_CF(data, cf, "new tunnel state 'established'");
161    infof(data, "CONNECT phase completed");
162    data->state.authproxy.done = TRUE;
163    data->state.authproxy.multipass = FALSE;
164    FALLTHROUGH();
165  case H1_TUNNEL_FAILED:
166    if(new_state == H1_TUNNEL_FAILED)
167      CURL_TRC_CF(data, cf, "new tunnel state 'failed'");
168    ts->tunnel_state = new_state;
169    curlx_dyn_reset(&ts->rcvbuf);
170    curlx_dyn_reset(&ts->request_data);
171    /* restore the protocol pointer */
172    data->info.httpcode = 0; /* clear it as it might have been used for the
173                                proxy */
174    /* If a proxy-authorization header was used for the proxy, then we should
175       make sure that it is not accidentally used for the document request
176       after we have connected. Let's thus free and clear it here. */
177    curlx_safefree(data->req.hd_proxy_auth);
178    break;
179  }
180}
181
182static void tunnel_free(struct h1_tunnel_state *ts,
183                        struct Curl_easy *data)
184{
185  if(ts) {
186    Curl_peer_unlink(&ts->dest);
187    curlx_dyn_free(&ts->rcvbuf);
188    curlx_dyn_free(&ts->request_data);
189    Curl_httpchunk_free(data, &ts->ch);
190    curlx_free(ts);
191  }
192}
193
194static void cf_tunnel_free(struct Curl_cfilter *cf,
195                           struct Curl_easy *data)
196{
197  if(cf) {
198    struct h1_tunnel_state *ts = cf->ctx;
199    if(ts) {
200      h1_tunnel_go_state(cf, ts, H1_TUNNEL_FAILED, data);
201      tunnel_free(ts, data);
202      cf->ctx = NULL;
203    }
204  }
205}
206
207static bool tunnel_want_send(struct h1_tunnel_state *ts)
208{
209  return ts->tunnel_state == H1_TUNNEL_CONNECT;
210}
211
212static CURLcode start_CONNECT(struct Curl_cfilter *cf,
213                              struct Curl_easy *data,
214                              struct h1_tunnel_state *ts)
215{
216  struct httpreq *req = NULL;
217  int http_minor;
218  CURLcode result;
219
220  /* This only happens if we have looped here due to authentication reasons,
221     and we do not really use the newly cloned URL here then. Free it. */
222  curlx_safefree(data->req.newurl);
223
224  result = Curl_http_proxy_create_CONNECT(&req, cf, data,
225                                          ts->dest, ts->httpversion);
226  if(result)
227    goto out;
228
229  infof(data, "Establish HTTP proxy tunnel to %s", req->authority);
230
231  curlx_dyn_reset(&ts->request_data);
232  ts->nsent = 0;
233  ts->headerlines = 0;
234  http_minor = ts->httpversion % 10;
235
236  result = Curl_h1_req_write_head(req, http_minor, &ts->request_data);
237  if(!result)
238    result = Curl_creader_set_null(data);
239
240out:
241  if(result)
242    failf(data, "Failed sending CONNECT to proxy");
243  if(req)
244    Curl_http_req_free(req);
245  return result;
246}
247
248static CURLcode send_CONNECT(struct Curl_cfilter *cf,
249                             struct Curl_easy *data,
250                             struct h1_tunnel_state *ts,
251                             bool *done)
252{
253  const uint8_t *buf = curlx_dyn_uptr(&ts->request_data);
254  size_t request_len = curlx_dyn_len(&ts->request_data);
255  size_t blen = request_len;
256  CURLcode result = CURLE_OK;
257  size_t nwritten;
258
259  if(blen <= ts->nsent)
260    goto out;  /* we are done */
261
262  blen -= ts->nsent;
263  buf += ts->nsent;
264
265  result = cf->next->cft->do_send(cf->next, data, buf, blen, FALSE, &nwritten);
266  if(result) {
267    if(result == CURLE_AGAIN)
268      result = CURLE_OK;
269    goto out;
270  }
271
272  DEBUGASSERT(blen >= nwritten);
273  ts->nsent += nwritten;
274  Curl_debug(data, CURLINFO_HEADER_OUT, (const char *)buf, nwritten);
275
276out:
277  if(result)
278    failf(data, "Failed sending CONNECT to proxy");
279  *done = (!result && (ts->nsent >= request_len));
280  return result;
281}
282
283static CURLcode on_resp_header(struct Curl_cfilter *cf,
284                               struct Curl_easy *data,
285                               struct h1_tunnel_state *ts,
286                               const char *header)
287{
288  CURLcode result = CURLE_OK;
289  struct SingleRequest *k = &data->req;
290  (void)cf;
291
292  if((checkprefix("WWW-Authenticate:", header) && (401 == k->httpcode)) ||
293     (checkprefix("Proxy-authenticate:", header) && (407 == k->httpcode))) {
294
295    bool proxy = (k->httpcode == 407);
296    char *auth = Curl_copy_header_value(header);
297    if(!auth)
298      return CURLE_OUT_OF_MEMORY;
299
300    CURL_TRC_CF(data, cf, "CONNECT: fwd auth header '%s'", header);
301    result = Curl_http_input_auth(data, proxy, auth);
302
303    curlx_free(auth);
304
305    if(result)
306      return result;
307  }
308  else if(checkprefix("Content-Length:", header)) {
309    if(k->httpcode / 100 == 2) {
310      /* A client MUST ignore any Content-Length or Transfer-Encoding
311         header fields received in a successful response to CONNECT.
312         "Successful" described as: 2xx (Successful). RFC 7231 4.3.6 */
313      infof(data, "Ignoring Content-Length in CONNECT %03d response",
314            k->httpcode);
315    }
316    else {
317      const char *p = header + strlen("Content-Length:");
318      if(curlx_str_numblanks(&p, &ts->cl)) {
319        failf(data, "Unsupported Content-Length value");
320        return CURLE_WEIRD_SERVER_REPLY;
321      }
322    }
323  }
324  else if(Curl_compareheader(header,
325                             STRCONST("Connection:"), STRCONST("close")))
326    ts->close_connection = TRUE;
327  else if(checkprefix("Transfer-Encoding:", header)) {
328    if(k->httpcode / 100 == 2) {
329      /* A client MUST ignore any Content-Length or Transfer-Encoding
330         header fields received in a successful response to CONNECT.
331         "Successful" described as: 2xx (Successful). RFC 7231 4.3.6 */
332      infof(data, "Ignoring Transfer-Encoding in "
333            "CONNECT %03d response", k->httpcode);
334    }
335    else if(Curl_compareheader(header,
336                               STRCONST("Transfer-Encoding:"),
337                               STRCONST("chunked"))) {
338      infof(data, "CONNECT responded chunked");
339      ts->chunked_encoding = TRUE;
340      /* reset our chunky engine */
341      Curl_httpchunk_reset(data, &ts->ch, TRUE);
342    }
343  }
344  else if(Curl_compareheader(header,
345                             STRCONST("Proxy-Connection:"),
346                             STRCONST("close")))
347    ts->close_connection = TRUE;
348  else if(!strncmp(header, "HTTP/1.", 7) &&
349          ((header[7] == '0') || (header[7] == '1')) &&
350          (header[8] == ' ') &&
351          ISDIGIT(header[9]) && ISDIGIT(header[10]) && ISDIGIT(header[11]) &&
352          !ISDIGIT(header[12])) {
353    /* store the HTTP code from the proxy */
354    data->info.httpproxycode = k->httpcode = ((header[9] - '0') * 100) +
355      ((header[10] - '0') * 10) + (header[11] - '0');
356  }
357  return result;
358}
359
360static CURLcode single_header(struct Curl_cfilter *cf,
361                              struct Curl_easy *data,
362                              struct h1_tunnel_state *ts)
363{
364  CURLcode result = CURLE_OK;
365  const char *linep = curlx_dyn_ptr(&ts->rcvbuf);
366  size_t line_len = curlx_dyn_len(&ts->rcvbuf); /* bytes in this line */
367  const struct SingleRequest *k = &data->req;
368  int writetype;
369  ts->headerlines++;
370
371  /* output debug if that is requested */
372  Curl_debug(data, CURLINFO_HEADER_IN, linep, line_len);
373
374  /* send the header to the callback */
375  writetype = CLIENTWRITE_HEADER | CLIENTWRITE_CONNECT |
376    (ts->headerlines == 1 ? CLIENTWRITE_STATUS : 0);
377  result = Curl_client_write(data, writetype, linep, line_len);
378  if(result)
379    return result;
380
381  result = Curl_bump_headersize(data, line_len, TRUE);
382  if(result)
383    return result;
384
385  /* Newlines are CRLF, so the CR is ignored as the line is not
386     really terminated until the LF comes. Treat a following CR
387     as end-of-headers as well.*/
388
389  if(ISNEWLINE(linep[0])) {
390    /* end of response-headers from the proxy */
391
392    if((407 == k->httpcode) && !data->state.authproblem) {
393      /* If we get a 407 response code with content length
394         when we have no auth problem, we must ignore the
395         whole response-body */
396      ts->keepon = KEEPON_IGNORE;
397
398      if(ts->cl) {
399        infof(data, "Ignore %" FMT_OFF_T " bytes of response-body", ts->cl);
400      }
401      else if(ts->chunked_encoding) {
402        infof(data, "Ignore chunked response-body");
403      }
404      else {
405        /* without content-length or chunked encoding, we
406           cannot keep the connection alive since the close is
407           the end signal so we bail out at once instead */
408        CURL_TRC_CF(data, cf, "CONNECT: no content-length or chunked");
409        ts->keepon = KEEPON_DONE;
410      }
411    }
412    else {
413      ts->keepon = KEEPON_DONE;
414    }
415
416    DEBUGASSERT(ts->keepon == KEEPON_IGNORE ||
417                ts->keepon == KEEPON_DONE);
418    return result;
419  }
420
421  result = on_resp_header(cf, data, ts, linep);
422  if(result)
423    return result;
424
425  curlx_dyn_reset(&ts->rcvbuf);
426  return result;
427}
428
429static CURLcode recv_CONNECT_resp(struct Curl_cfilter *cf,
430                                  struct Curl_easy *data,
431                                  struct h1_tunnel_state *ts,
432                                  bool *done)
433{
434  CURLcode result = CURLE_OK;
435  int error;
436
437#define SELECT_OK      0
438#define SELECT_ERROR   1
439
440  error = SELECT_OK;
441  *done = FALSE;
442
443  while(ts->keepon) {
444    size_t nread;
445    char byte;
446
447    /* Read one byte at a time to avoid a race condition. Wait at most one
448       second before looping to ensure continuous pgrsUpdates. */
449    result = Curl_conn_recv(data, cf->sockindex, &byte, 1, &nread);
450    if(result == CURLE_AGAIN)
451      /* socket buffer drained, return */
452      return CURLE_OK;
453
454    if(!result)
455      result = Curl_pgrsUpdate(data);
456
457    if(result) {
458      ts->keepon = KEEPON_DONE;
459      break;
460    }
461
462    if(!nread) {
463      if(data->set.proxyauth && data->state.authproxy.avail &&
464         data->req.hd_proxy_auth) {
465        /* proxy auth was requested and there was proxy auth available,
466           then deem this as "mere" proxy disconnect */
467        ts->close_connection = TRUE;
468        infof(data, "Proxy CONNECT connection closed");
469      }
470      else {
471        error = SELECT_ERROR;
472        failf(data, "Proxy CONNECT aborted");
473      }
474      ts->keepon = KEEPON_DONE;
475      break;
476    }
477
478    if(ts->keepon == KEEPON_IGNORE) {
479      /* This means we are currently ignoring a response-body */
480      if(ts->chunked_encoding) {
481        /* chunked-encoded body, so we need to do the chunked dance
482           properly to know when the end of the body is reached */
483        size_t consumed = 0;
484
485        /* now parse the chunked piece of data so that we can
486           properly tell when the stream ends */
487        result = Curl_httpchunk_read(data, &ts->ch, &byte, 1, &consumed);
488        if(result)
489          return result;
490        if(Curl_httpchunk_is_done(data, &ts->ch)) {
491          /* we are done reading chunks! */
492          infof(data, "chunk reading DONE");
493          ts->keepon = KEEPON_DONE;
494        }
495      }
496      else if(ts->cl) {
497        /* A Content-Length based body: count down the counter
498           and make sure to break out of the loop when we are done! */
499        ts->cl--;
500        if(ts->cl <= 0) {
501          ts->keepon = KEEPON_DONE;
502          break;
503        }
504      }
505      continue;
506    }
507
508    if(ts->maybe_folded) {
509      if(ISBLANK(byte)) {
510        Curl_http_to_fold(&ts->rcvbuf);
511        ts->leading_unfold = TRUE;
512      }
513      else {
514        result = single_header(cf, data, ts);
515        if(result)
516          return result;
517        /* now handle the new byte */
518      }
519      ts->maybe_folded = FALSE;
520    }
521
522    if(ts->leading_unfold) {
523      if(ISBLANK(byte))
524        /* skip a bit brother */
525        continue;
526      /* non-blank, insert a space then continue the unfolding */
527      if(curlx_dyn_addn(&ts->rcvbuf, " ", 1)) {
528        failf(data, "CONNECT response too large");
529        return CURLE_RECV_ERROR;
530      }
531      ts->leading_unfold = FALSE;
532    }
533    if(curlx_dyn_addn(&ts->rcvbuf, &byte, 1)) {
534      failf(data, "CONNECT response too large");
535      return CURLE_RECV_ERROR;
536    }
537
538    /* if this is not the end of a header line then continue */
539    if(byte != 0x0a)
540      continue;
541    else {
542      const char *linep = curlx_dyn_ptr(&ts->rcvbuf);
543      size_t hlen = curlx_dyn_len(&ts->rcvbuf);
544      if(hlen && ISNEWLINE(linep[0])) {
545        /* end of headers */
546        result = single_header(cf, data, ts);
547        if(result)
548          return result;
549      }
550      else
551        ts->maybe_folded = TRUE;
552    }
553
554  } /* while there is buffer left and loop is requested */
555
556  if(error)
557    result = CURLE_RECV_ERROR;
558  *done = (ts->keepon == KEEPON_DONE);
559  if(!result && *done && data->info.httpproxycode / 100 != 2) {
560    /* Deal with the possibly already received authenticate
561       headers. 'newurl' is set to a new URL if we must loop. */
562    result = Curl_http_auth_act(data);
563  }
564  return result;
565}
566
567static CURLcode H1_CONNECT(struct Curl_cfilter *cf,
568                           struct Curl_easy *data,
569                           struct h1_tunnel_state *ts)
570{
571  struct connectdata *conn = cf->conn;
572  CURLcode result;
573  bool done;
574
575  if(tunnel_is_established(ts))
576    return CURLE_OK;
577  if(tunnel_is_failed(ts))
578    return CURLE_RECV_ERROR; /* Need a cfilter close and new bootstrap */
579
580  do {
581
582    if(Curl_timeleft_ms(data) < 0) {
583      failf(data, "Proxy CONNECT aborted due to timeout");
584      result = CURLE_OPERATION_TIMEDOUT;
585      goto out;
586    }
587
588    switch(ts->tunnel_state) {
589    case H1_TUNNEL_INIT:
590      /* Prepare the CONNECT request and make a first attempt to send. */
591      CURL_TRC_CF(data, cf, "CONNECT start");
592      result = start_CONNECT(cf, data, ts);
593      if(result)
594        goto out;
595      h1_tunnel_go_state(cf, ts, H1_TUNNEL_CONNECT, data);
596      FALLTHROUGH();
597
598    case H1_TUNNEL_CONNECT:
599      /* see that the request is completely sent */
600      CURL_TRC_CF(data, cf, "CONNECT send");
601      result = send_CONNECT(cf, data, ts, &done);
602      if(result || !done)
603        goto out;
604      h1_tunnel_go_state(cf, ts, H1_TUNNEL_RECEIVE, data);
605      FALLTHROUGH();
606
607    case H1_TUNNEL_RECEIVE:
608      /* read what is there */
609      CURL_TRC_CF(data, cf, "CONNECT receive");
610      result = recv_CONNECT_resp(cf, data, ts, &done);
611      if(result)
612        CURL_TRC_CF(data, cf, "error receiving CONNECT response: %d", result);
613      if(!result)
614        result = Curl_pgrsUpdate(data);
615      /* error or not complete yet. return for more multi-multi */
616      if(result || !done)
617        goto out;
618      /* got it */
619      h1_tunnel_go_state(cf, ts, H1_TUNNEL_RESPONSE, data);
620      FALLTHROUGH();
621
622    case H1_TUNNEL_RESPONSE:
623      CURL_TRC_CF(data, cf, "CONNECT response");
624      if(data->req.newurl) {
625        /* not the "final" response, we need to do a follow up request.
626         * If the other side indicated a connection close, or if someone
627         * else told us to close this connection, do so now.
628         */
629        Curl_req_soft_reset(&data->req, data);
630        if(ts->close_connection || conn->bits.close) {
631          /* Close this filter and the sub-chain, re-connect the
632           * sub-chain and continue. Closing this filter will
633           * reset our tunnel state. To avoid recursion, we return
634           * and expect to be called again.
635           */
636          CURL_TRC_CF(data, cf, "CONNECT need to close+open");
637          infof(data, "Connect me again please");
638          Curl_conn_cf_close(cf, data);
639          result = Curl_conn_cf_connect(cf->next, data, &done);
640          goto out;
641        }
642        else {
643          /* staying on this connection, reset state */
644          h1_tunnel_go_state(cf, ts, H1_TUNNEL_INIT, data);
645        }
646      }
647      break;
648
649    default:
650      break;
651    }
652
653  } while(data->req.newurl);
654
655  DEBUGASSERT(ts->tunnel_state == H1_TUNNEL_RESPONSE);
656  if(data->info.httpproxycode / 100 != 2) {
657    /* a non-2xx response and we have no next URL to try. */
658    curlx_safefree(data->req.newurl);
659    h1_tunnel_go_state(cf, ts, H1_TUNNEL_FAILED, data);
660    failf(data, "CONNECT tunnel failed, response %d", data->req.httpcode);
661    return CURLE_COULDNT_CONNECT;
662  }
663  /* 2xx response, SUCCESS! */
664  h1_tunnel_go_state(cf, ts, H1_TUNNEL_ESTABLISHED, data);
665  infof(data, "CONNECT tunnel established, response %d",
666        data->info.httpproxycode);
667  result = CURLE_OK;
668
669out:
670  if(result)
671    h1_tunnel_go_state(cf, ts, H1_TUNNEL_FAILED, data);
672  return result;
673}
674
675static CURLcode cf_h1_proxy_connect(struct Curl_cfilter *cf,
676                                    struct Curl_easy *data,
677                                    bool *done)
678{
679  CURLcode result;
680  struct h1_tunnel_state *ts = cf->ctx;
681
682  if(cf->connected) {
683    *done = TRUE;
684    return CURLE_OK;
685  }
686
687  CURL_TRC_CF(data, cf, "connect");
688  result = cf->next->cft->do_connect(cf->next, data, done);
689  if(result || !*done)
690    return result;
691
692  *done = FALSE;
693  if(!ts) {
694    result = tunnel_init(cf, data, &ts);
695    if(result)
696      return result;
697    cf->ctx = ts;
698  }
699
700  /* We want "seamless" operations through HTTP proxy tunnel */
701
702  result = H1_CONNECT(cf, data, ts);
703  if(result)
704    goto out;
705  curlx_safefree(data->req.hd_proxy_auth);
706
707out:
708  *done = (result == CURLE_OK) && tunnel_is_established(cf->ctx);
709  if(*done) {
710    cf->connected = TRUE;
711    /* The real request will follow the CONNECT, reset request partially */
712    Curl_req_soft_reset(&data->req, data);
713    Curl_client_reset(data);
714    Curl_pgrsReset(data);
715
716    cf_tunnel_free(cf, data);
717  }
718  return result;
719}
720
721static CURLcode cf_h1_proxy_adjust_pollset(struct Curl_cfilter *cf,
722                                           struct Curl_easy *data,
723                                           struct easy_pollset *ps)
724{
725  struct h1_tunnel_state *ts = cf->ctx;
726  CURLcode result = CURLE_OK;
727
728  if(!cf->connected) {
729    /* If we are not connected, but the filter "below" is
730     * and not waiting on something, we are tunneling. */
731    curl_socket_t sock = Curl_conn_cf_get_socket(cf, data);
732    if(ts) {
733      /* when we have sent a CONNECT to a proxy, we should rather either
734         wait for the socket to become readable to be able to get the
735         response headers or if we are still sending the request, wait
736         for write. */
737      if(tunnel_want_send(ts))
738        result = Curl_pollset_set_out_only(data, ps, sock);
739      else
740        result = Curl_pollset_set_in_only(data, ps, sock);
741    }
742    else
743      result = Curl_pollset_set_out_only(data, ps, sock);
744  }
745  return result;
746}
747
748static void cf_h1_proxy_destroy(struct Curl_cfilter *cf,
749                                struct Curl_easy *data)
750{
751  CURL_TRC_CF(data, cf, "destroy");
752  cf_tunnel_free(cf, data);
753}
754
755static void cf_h1_proxy_close(struct Curl_cfilter *cf,
756                              struct Curl_easy *data)
757{
758  CURL_TRC_CF(data, cf, "close");
759  if(cf) {
760    cf->connected = FALSE;
761    if(cf->ctx) {
762      h1_tunnel_go_state(cf, cf->ctx, H1_TUNNEL_INIT, data);
763    }
764    if(cf->next)
765      cf->next->cft->do_close(cf->next, data);
766  }
767}
768
769static CURLcode cf_h1_proxy_query(struct Curl_cfilter *cf,
770                                  struct Curl_easy *data,
771                                  int query, int *pres1, void *pres2)
772{
773  struct h1_tunnel_state *ts = cf->ctx;
774  switch(query) {
775  case CF_QUERY_HOST_PORT:
776    *pres1 = (int)ts->dest->port;
777    *((const char **)pres2) = ts->dest->hostname;
778    return CURLE_OK;
779  case CF_QUERY_ALPN_NEGOTIATED: {
780    const char **palpn = pres2;
781    DEBUGASSERT(palpn);
782    *palpn = NULL;
783    return CURLE_OK;
784  }
785  default:
786    break;
787  }
788  return cf->next ?
789    cf->next->cft->query(cf->next, data, query, pres1, pres2) :
790    CURLE_UNKNOWN_OPTION;
791}
792
793struct Curl_cftype Curl_cft_h1_proxy = {
794  "H1-PROXY",
795  CF_TYPE_IP_CONNECT | CF_TYPE_PROXY,
796  0,
797  cf_h1_proxy_destroy,
798  cf_h1_proxy_connect,
799  cf_h1_proxy_close,
800  Curl_cf_def_shutdown,
801  cf_h1_proxy_adjust_pollset,
802  Curl_cf_def_data_pending,
803  Curl_cf_def_send,
804  Curl_cf_def_recv,
805  Curl_cf_def_cntrl,
806  Curl_cf_def_conn_is_alive,
807  Curl_cf_def_conn_keep_alive,
808  cf_h1_proxy_query,
809};
810
811CURLcode Curl_cf_h1_proxy_insert_after(struct Curl_cfilter *cf_at,
812                                       struct Curl_easy *data,
813                                       struct Curl_peer *dest,
814                                       int httpversion)
815{
816  struct Curl_cfilter *cf;
817  struct h1_tunnel_state *ts;
818  CURLcode result;
819
820  (void)data;
821  if(!dest)
822    return CURLE_FAILED_INIT;
823  if((httpversion < 10) || (httpversion >= 20))
824    return CURLE_FAILED_INIT;
825
826  ts = curlx_calloc(1, sizeof(*ts));
827  if(!ts) {
828    result = CURLE_OUT_OF_MEMORY;
829    goto out;
830  }
831  Curl_peer_link(&ts->dest, dest);
832  ts->httpversion = httpversion;
833  curlx_dyn_init(&ts->rcvbuf, DYN_PROXY_CONNECT_HEADERS);
834  curlx_dyn_init(&ts->request_data, DYN_HTTP_REQUEST);
835  Curl_httpchunk_init(data, &ts->ch, TRUE);
836
837  result = Curl_cf_create(&cf, &Curl_cft_h1_proxy, ts);
838  if(result)
839    goto out;
840  ts = NULL;
841  Curl_conn_cf_insert_after(cf_at, cf);
842
843out:
844  tunnel_free(ts, data);
845  return result;
846}
847
848#endif /* !CURL_DISABLE_PROXY && !CURL_DISABLE_HTTP */