luna - curl/lib/cf-h2-proxy.c

   1/***************************************************************************
   2 *                                  _   _ ____  _
   3 *  Project                     ___| | | |  _ \| |
   4 *                             / __| | | | |_) | |
   5 *                            | (__| |_| |  _ <| |___
   6 *                             \___|\___/|_| \_\_____|
   7 *
   8 * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
   9 *
  10 * This software is licensed as described in the file COPYING, which
  11 * you should have received as part of this distribution. The terms
  12 * are also available at https://curl.se/docs/copyright.html.
  13 *
  14 * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  15 * copies of the Software, and permit persons to whom the Software is
  16 * furnished to do so, under the terms of the COPYING file.
  17 *
  18 * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  19 * KIND, either express or implied.
  20 *
  21 * SPDX-License-Identifier: curl
  22 *
  23 ***************************************************************************/
  24#include "curl_setup.h"
  25
  26#if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_PROXY) && \
  27  defined(USE_NGHTTP2)
  28
  29#include <nghttp2/nghttp2.h>
  30
  31#include "urldata.h"
  32#include "url.h"
  33#include "cfilters.h"
  34#include "connect.h"
  35#include "curl_trc.h"
  36#include "bufq.h"
  37#include "curlx/dynbuf.h"
  38#include "dynhds.h"
  39#include "http2.h"
  40#include "http_proxy.h"
  41#include "multiif.h"
  42#include "sendf.h"
  43#include "select.h"
  44#include "cf-h2-proxy.h"
  45
  46#define PROXY_H2_CHUNK_SIZE  (16 * 1024)
  47
  48#define PROXY_HTTP2_HUGE_WINDOW_SIZE (100 * 1024 * 1024)
  49#define H2_TUNNEL_WINDOW_SIZE        (10 * 1024 * 1024)
  50
  51#define PROXY_H2_NW_RECV_CHUNKS   (H2_TUNNEL_WINDOW_SIZE / PROXY_H2_CHUNK_SIZE)
  52#define PROXY_H2_NW_SEND_CHUNKS   1
  53
  54#define H2_TUNNEL_RECV_CHUNKS   (H2_TUNNEL_WINDOW_SIZE / PROXY_H2_CHUNK_SIZE)
  55#define H2_TUNNEL_SEND_CHUNKS   ((128 * 1024) / PROXY_H2_CHUNK_SIZE)
  56
  57
  58typedef enum {
  59  H2_TUNNEL_INIT,     /* init/default/no tunnel state */
  60  H2_TUNNEL_CONNECT,  /* CONNECT request is being send */
  61  H2_TUNNEL_RESPONSE, /* CONNECT response received completely */
  62  H2_TUNNEL_ESTABLISHED,
  63  H2_TUNNEL_FAILED
  64} h2_tunnel_state;
  65
  66struct tunnel_stream {
  67  struct http_resp *resp;
  68  struct bufq recvbuf;
  69  struct bufq sendbuf;
  70  char *authority;
  71  int32_t stream_id;
  72  uint32_t error;
  73  h2_tunnel_state state;
  74  BIT(has_final_response);
  75  BIT(closed);
  76  BIT(reset);
  77};
  78
  79static CURLcode tunnel_stream_init(struct tunnel_stream *ts,
  80                                   struct Curl_peer *dest)
  81{
  82  ts->state = H2_TUNNEL_INIT;
  83  ts->stream_id = -1;
  84  Curl_bufq_init2(&ts->recvbuf, PROXY_H2_CHUNK_SIZE, H2_TUNNEL_RECV_CHUNKS,
  85                  BUFQ_OPT_SOFT_LIMIT);
  86  Curl_bufq_init(&ts->sendbuf, PROXY_H2_CHUNK_SIZE, H2_TUNNEL_SEND_CHUNKS);
  87
  88  /* host:port with IPv6 support */
  89  ts->authority = curl_maprintf("%s%s%s:%u", dest->ipv6 ? "[" : "",
  90                                dest->hostname,
  91                                dest->ipv6 ? "]" : "",
  92                                dest->port);
  93  if(!ts->authority)
  94    return CURLE_OUT_OF_MEMORY;
  95
  96  return CURLE_OK;
  97}
  98
  99static void tunnel_stream_clear(struct tunnel_stream *ts)
 100{
 101  Curl_http_resp_free(ts->resp);
 102  Curl_bufq_free(&ts->recvbuf);
 103  Curl_bufq_free(&ts->sendbuf);
 104  curlx_safefree(ts->authority);
 105  memset(ts, 0, sizeof(*ts));
 106  ts->state = H2_TUNNEL_INIT;
 107}
 108
 109static void h2_tunnel_go_state(struct Curl_cfilter *cf,
 110                               struct tunnel_stream *ts,
 111                               h2_tunnel_state new_state,
 112                               struct Curl_easy *data)
 113{
 114  (void)cf;
 115
 116  if(ts->state == new_state)
 117    return;
 118  /* leaving this one */
 119  switch(ts->state) {
 120  case H2_TUNNEL_CONNECT:
 121    data->req.ignorebody = FALSE;
 122    break;
 123  default:
 124    break;
 125  }
 126  /* entering this one */
 127  switch(new_state) {
 128  case H2_TUNNEL_INIT:
 129    CURL_TRC_CF(data, cf, "[%d] new tunnel state 'init'", ts->stream_id);
 130    tunnel_stream_clear(ts);
 131    break;
 132
 133  case H2_TUNNEL_CONNECT:
 134    CURL_TRC_CF(data, cf, "[%d] new tunnel state 'connect'", ts->stream_id);
 135    ts->state = H2_TUNNEL_CONNECT;
 136    break;
 137
 138  case H2_TUNNEL_RESPONSE:
 139    CURL_TRC_CF(data, cf, "[%d] new tunnel state 'response'", ts->stream_id);
 140    ts->state = H2_TUNNEL_RESPONSE;
 141    break;
 142
 143  case H2_TUNNEL_ESTABLISHED:
 144    CURL_TRC_CF(data, cf, "[%d] new tunnel state 'established'",
 145                ts->stream_id);
 146    infof(data, "CONNECT phase completed");
 147    data->state.authproxy.done = TRUE;
 148    data->state.authproxy.multipass = FALSE;
 149    FALLTHROUGH();
 150  case H2_TUNNEL_FAILED:
 151    if(new_state == H2_TUNNEL_FAILED)
 152      CURL_TRC_CF(data, cf, "[%d] new tunnel state 'failed'", ts->stream_id);
 153    ts->state = new_state;
 154    /* If a proxy-authorization header was used for the proxy, then we should
 155       make sure that it is not accidentally used for the document request
 156       after we have connected. Let's thus free and clear it here. */
 157    curlx_safefree(data->req.hd_proxy_auth);
 158    break;
 159  }
 160}
 161
 162struct cf_h2_proxy_ctx {
 163  nghttp2_session *h2;
 164  /* The easy handle used in the current filter call, cleared at return */
 165  struct cf_call_data call_data;
 166
 167  struct bufq inbufq;  /* network receive buffer */
 168  struct bufq outbufq; /* network send buffer */
 169
 170  struct Curl_peer *dest; /* where to tunnel to */
 171  struct tunnel_stream tunnel; /* our tunnel CONNECT stream */
 172  int32_t goaway_error;
 173  int32_t last_stream_id;
 174  BIT(conn_closed);
 175  BIT(rcvd_goaway);
 176  BIT(sent_goaway);
 177  BIT(nw_out_blocked);
 178};
 179
 180/* How to access `call_data` from a cf_h2 filter */
 181#undef CF_CTX_CALL_DATA
 182#define CF_CTX_CALL_DATA(cf) ((struct cf_h2_proxy_ctx *)(cf)->ctx)->call_data
 183
 184static void cf_h2_proxy_ctx_clear(struct cf_h2_proxy_ctx *ctx)
 185{
 186  struct cf_call_data save = ctx->call_data;
 187
 188  if(ctx->h2) {
 189    nghttp2_session_del(ctx->h2);
 190  }
 191  Curl_bufq_free(&ctx->inbufq);
 192  Curl_bufq_free(&ctx->outbufq);
 193  tunnel_stream_clear(&ctx->tunnel);
 194  memset(ctx, 0, sizeof(*ctx));
 195  ctx->call_data = save;
 196}
 197
 198static void cf_h2_proxy_ctx_free(struct cf_h2_proxy_ctx *ctx)
 199{
 200  if(ctx) {
 201    cf_h2_proxy_ctx_clear(ctx);
 202    Curl_peer_unlink(&ctx->dest);
 203    curlx_free(ctx);
 204  }
 205}
 206
 207static void drain_tunnel(struct Curl_cfilter *cf,
 208                         struct Curl_easy *data,
 209                         struct tunnel_stream *tunnel)
 210{
 211  struct cf_h2_proxy_ctx *ctx = cf->ctx;
 212  (void)cf;
 213  if(!tunnel->closed && !tunnel->reset &&
 214     !Curl_bufq_is_empty(&ctx->tunnel.sendbuf))
 215    Curl_multi_mark_dirty(data);
 216}
 217
 218static CURLcode proxy_h2_nw_out_writer(void *writer_ctx,
 219                                       const uint8_t *buf, size_t buflen,
 220                                       size_t *pnwritten)
 221{
 222  struct Curl_cfilter *cf = writer_ctx;
 223  *pnwritten = 0;
 224  if(cf) {
 225    struct Curl_easy *data = CF_DATA_CURRENT(cf);
 226    CURLcode result;
 227    result = Curl_conn_cf_send(cf->next, data, buf, buflen, FALSE, pnwritten);
 228    CURL_TRC_CF(data, cf, "[0] nw_out_writer(len=%zu) -> %d, %zu",
 229                buflen, result, *pnwritten);
 230    return result;
 231  }
 232  return CURLE_FAILED_INIT;
 233}
 234
 235static int proxy_h2_client_new(struct Curl_cfilter *cf,
 236                               nghttp2_session_callbacks *cbs)
 237{
 238  struct cf_h2_proxy_ctx *ctx = cf->ctx;
 239  nghttp2_option *o;
 240  nghttp2_mem mem = { NULL, Curl_nghttp2_malloc, Curl_nghttp2_free,
 241                      Curl_nghttp2_calloc, Curl_nghttp2_realloc };
 242
 243  int rc = nghttp2_option_new(&o);
 244  if(rc)
 245    return rc;
 246  /* We handle window updates ourself to enforce buffer limits */
 247  nghttp2_option_set_no_auto_window_update(o, 1);
 248#if NGHTTP2_VERSION_NUM >= 0x013200
 249  /* with 1.50.0 */
 250  /* turn off RFC 9113 leading and trailing white spaces validation against
 251     HTTP field value. */
 252  nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation(o, 1);
 253#endif
 254  rc = nghttp2_session_client_new3(&ctx->h2, cbs, cf, o, &mem);
 255  nghttp2_option_del(o);
 256  return rc;
 257}
 258
 259static int proxy_h2_should_close_session(struct cf_h2_proxy_ctx *ctx)
 260{
 261  return !nghttp2_session_want_read(ctx->h2) &&
 262    !nghttp2_session_want_write(ctx->h2);
 263}
 264
 265static CURLcode proxy_h2_nw_out_flush(struct Curl_cfilter *cf,
 266                                      struct Curl_easy *data)
 267{
 268  struct cf_h2_proxy_ctx *ctx = cf->ctx;
 269  size_t nwritten;
 270  CURLcode result;
 271
 272  if(Curl_bufq_is_empty(&ctx->outbufq))
 273    return CURLE_OK;
 274
 275  result = Curl_bufq_pass(&ctx->outbufq, proxy_h2_nw_out_writer, cf,
 276                          &nwritten);
 277  if(result) {
 278    if(result == CURLE_AGAIN) {
 279      CURL_TRC_CF(data, cf, "[0] flush nw send buffer(%zu) -> EAGAIN",
 280                  Curl_bufq_len(&ctx->outbufq));
 281      ctx->nw_out_blocked = 1;
 282    }
 283    return result;
 284  }
 285  CURL_TRC_CF(data, cf, "[0] nw send buffer flushed");
 286  return Curl_bufq_is_empty(&ctx->outbufq) ? CURLE_OK : CURLE_AGAIN;
 287}
 288
 289/*
 290 * Processes pending input left in network input buffer.
 291 * This function returns 0 if it succeeds, or -1 and error code will
 292 * be assigned to *err.
 293 */
 294static CURLcode proxy_h2_process_pending_input(struct Curl_cfilter *cf,
 295                                               struct Curl_easy *data)
 296{
 297  struct cf_h2_proxy_ctx *ctx = cf->ctx;
 298  const unsigned char *buf;
 299  size_t blen, nread;
 300  ssize_t rv;
 301
 302  while(Curl_bufq_peek(&ctx->inbufq, &buf, &blen)) {
 303
 304    rv = nghttp2_session_mem_recv(ctx->h2, (const uint8_t *)buf, blen);
 305    CURL_TRC_CF(data, cf, "[0] %zu bytes to nghttp2 -> %zd", blen, rv);
 306    if(!curlx_sztouz(rv, &nread)) {
 307      failf(data,
 308            "process_pending_input: nghttp2_session_mem_recv() returned "
 309            "%zd:%s", rv, nghttp2_strerror((int)rv));
 310      return CURLE_RECV_ERROR;
 311    }
 312    else if(!nread) {
 313      /* nghttp2 does not want to process more, but has no error. This
 314       * probably cannot happen, but be safe. */
 315      break;
 316    }
 317    Curl_bufq_skip(&ctx->inbufq, nread);
 318    if(Curl_bufq_is_empty(&ctx->inbufq)) {
 319      CURL_TRC_CF(data, cf, "[0] all data in connection buffer processed");
 320      break;
 321    }
 322    else {
 323      CURL_TRC_CF(data, cf, "[0] process_pending_input: %zu bytes left "
 324                  "in connection buffer", Curl_bufq_len(&ctx->inbufq));
 325    }
 326  }
 327  return CURLE_OK;
 328}
 329
 330static CURLcode proxy_h2_progress_ingress(struct Curl_cfilter *cf,
 331                                          struct Curl_easy *data)
 332{
 333  struct cf_h2_proxy_ctx *ctx = cf->ctx;
 334  CURLcode result = CURLE_OK;
 335  size_t nread;
 336
 337  /* Process network input buffer first */
 338  if(!Curl_bufq_is_empty(&ctx->inbufq)) {
 339    CURL_TRC_CF(data, cf, "[0] process %zu bytes in connection buffer",
 340                Curl_bufq_len(&ctx->inbufq));
 341    result = proxy_h2_process_pending_input(cf, data);
 342    if(result)
 343      return result;
 344  }
 345
 346  /* Receive data from the "lower" filters, e.g. network until
 347   * it is time to stop or we have enough data for this stream */
 348  while(!ctx->conn_closed &&                /* not closed the connection */
 349        !ctx->tunnel.closed &&              /* nor the tunnel */
 350        Curl_bufq_is_empty(&ctx->inbufq) && /* and we consumed our input */
 351        !Curl_bufq_is_full(&ctx->tunnel.recvbuf)) {
 352
 353    result = Curl_cf_recv_bufq(cf->next, data, &ctx->inbufq, 0, &nread);
 354    CURL_TRC_CF(data, cf, "[0] read %zu bytes nw data -> %d, %zu",
 355                Curl_bufq_len(&ctx->inbufq), result, nread);
 356    if(result) {
 357      if(result != CURLE_AGAIN) {
 358        failf(data, "Failed receiving HTTP2 proxy data");
 359        return result;
 360      }
 361      break;
 362    }
 363    else if(nread == 0) {
 364      ctx->conn_closed = TRUE;
 365      break;
 366    }
 367
 368    result = proxy_h2_process_pending_input(cf, data);
 369    if(result)
 370      return result;
 371  }
 372
 373  return CURLE_OK;
 374}
 375
 376static CURLcode proxy_h2_progress_egress(struct Curl_cfilter *cf,
 377                                         struct Curl_easy *data)
 378{
 379  struct cf_h2_proxy_ctx *ctx = cf->ctx;
 380  int rv = 0;
 381
 382  ctx->nw_out_blocked = 0;
 383  while(!rv && !ctx->nw_out_blocked && nghttp2_session_want_write(ctx->h2))
 384    rv = nghttp2_session_send(ctx->h2);
 385
 386  if(nghttp2_is_fatal(rv)) {
 387    CURL_TRC_CF(data, cf, "[0] nghttp2_session_send error (%s)%d",
 388                nghttp2_strerror(rv), rv);
 389    return CURLE_SEND_ERROR;
 390  }
 391  return proxy_h2_nw_out_flush(cf, data);
 392}
 393
 394static ssize_t on_session_send(nghttp2_session *h2,
 395                               const uint8_t *buf, size_t blen, int flags,
 396                               void *userp)
 397{
 398  struct Curl_cfilter *cf = userp;
 399  struct cf_h2_proxy_ctx *ctx = cf->ctx;
 400  struct Curl_easy *data = CF_DATA_CURRENT(cf);
 401  size_t nwritten;
 402  CURLcode result = CURLE_OK;
 403
 404  (void)h2;
 405  (void)flags;
 406  DEBUGASSERT(data);
 407
 408  result = Curl_bufq_write_pass(&ctx->outbufq, buf, blen,
 409                                proxy_h2_nw_out_writer, cf, &nwritten);
 410  if(result) {
 411    if(result == CURLE_AGAIN) {
 412      ctx->nw_out_blocked = 1;
 413      return NGHTTP2_ERR_WOULDBLOCK;
 414    }
 415    failf(data, "Failed sending HTTP2 data");
 416    return NGHTTP2_ERR_CALLBACK_FAILURE;
 417  }
 418
 419  if(!nwritten)
 420    return NGHTTP2_ERR_WOULDBLOCK;
 421
 422  return (nwritten > SSIZE_MAX) ?
 423    NGHTTP2_ERR_CALLBACK_FAILURE : (ssize_t)nwritten;
 424}
 425
 426#ifdef CURLVERBOSE
 427static int proxy_h2_on_frame_send(nghttp2_session *session,
 428                                  const nghttp2_frame *frame,
 429                                  void *userp)
 430{
 431  struct Curl_cfilter *cf = userp;
 432  struct Curl_easy *data = CF_DATA_CURRENT(cf);
 433
 434  (void)session;
 435  DEBUGASSERT(data);
 436  if(Curl_trc_cf_is_verbose(cf, data)) {
 437    char buffer[256];
 438    int len;
 439    len = Curl_nghttp2_fr_print(frame, buffer, sizeof(buffer) - 1);
 440    buffer[len] = 0;
 441    CURL_TRC_CF(data, cf, "[%d] -> %s", frame->hd.stream_id, buffer);
 442  }
 443  return 0;
 444}
 445#endif /* CURLVERBOSE */
 446
 447static int proxy_h2_on_frame_recv(nghttp2_session *session,
 448                                  const nghttp2_frame *frame,
 449                                  void *userp)
 450{
 451  struct Curl_cfilter *cf = userp;
 452  struct cf_h2_proxy_ctx *ctx = cf->ctx;
 453  struct Curl_easy *data = CF_DATA_CURRENT(cf);
 454  int32_t stream_id = frame->hd.stream_id;
 455
 456  (void)session;
 457  DEBUGASSERT(data);
 458#ifdef CURLVERBOSE
 459  if(Curl_trc_cf_is_verbose(cf, data)) {
 460    char buffer[256];
 461    int len;
 462    len = Curl_nghttp2_fr_print(frame, buffer, sizeof(buffer) - 1);
 463    buffer[len] = 0;
 464    CURL_TRC_CF(data, cf, "[%d] <- %s", frame->hd.stream_id, buffer);
 465  }
 466#endif /* CURLVERBOSE */
 467
 468  if(!stream_id) {
 469    /* stream ID zero is for connection-oriented stuff */
 470    DEBUGASSERT(data);
 471    switch(frame->hd.type) {
 472    case NGHTTP2_SETTINGS:
 473      /* Since the initial stream window is 64K, a request might be on HOLD,
 474       * due to exhaustion. The (initial) SETTINGS may announce a much larger
 475       * window and *assume* that we treat this like a WINDOW_UPDATE. Some
 476       * servers send an explicit WINDOW_UPDATE, but not all seem to do that.
 477       * To be safe, we UNHOLD a stream in order not to stall. */
 478      if(CURL_REQ_WANT_SEND(data)) {
 479        drain_tunnel(cf, data, &ctx->tunnel);
 480      }
 481      break;
 482    case NGHTTP2_GOAWAY:
 483      ctx->rcvd_goaway = TRUE;
 484      break;
 485    default:
 486      break;
 487    }
 488    return 0;
 489  }
 490
 491  if(stream_id != ctx->tunnel.stream_id) {
 492    CURL_TRC_CF(data, cf, "[%d] rcvd FRAME not for tunnel", stream_id);
 493    return NGHTTP2_ERR_CALLBACK_FAILURE;
 494  }
 495
 496  switch(frame->hd.type) {
 497  case NGHTTP2_HEADERS:
 498    /* nghttp2 guarantees that :status is received, and we store it to
 499       stream->status_code. Fuzzing has proven this can still be reached
 500       without status code having been set. */
 501    if(!ctx->tunnel.resp)
 502      return NGHTTP2_ERR_CALLBACK_FAILURE;
 503    /* Only final status code signals the end of header */
 504    CURL_TRC_CF(data, cf, "[%d] got http status: %d",
 505                stream_id, ctx->tunnel.resp->status);
 506    if(!ctx->tunnel.has_final_response) {
 507      if(ctx->tunnel.resp->status / 100 != 1) {
 508        ctx->tunnel.has_final_response = TRUE;
 509      }
 510    }
 511    break;
 512  case NGHTTP2_WINDOW_UPDATE:
 513    if(CURL_REQ_WANT_SEND(data)) {
 514      drain_tunnel(cf, data, &ctx->tunnel);
 515    }
 516    break;
 517  case NGHTTP2_RST_STREAM:
 518    if(frame->rst_stream.error_code)
 519      ctx->tunnel.reset = TRUE;
 520    break;
 521  default:
 522    break;
 523  }
 524  return 0;
 525}
 526
 527static int proxy_h2_on_header(nghttp2_session *session,
 528                              const nghttp2_frame *frame,
 529                              const uint8_t *name, size_t namelen,
 530                              const uint8_t *value, size_t valuelen,
 531                              uint8_t flags,
 532                              void *userp)
 533{
 534  struct Curl_cfilter *cf = userp;
 535  struct cf_h2_proxy_ctx *ctx = cf->ctx;
 536  struct Curl_easy *data = CF_DATA_CURRENT(cf);
 537  int32_t stream_id = frame->hd.stream_id;
 538  CURLcode result;
 539
 540  (void)flags;
 541  (void)session;
 542  DEBUGASSERT(stream_id); /* should never be a zero stream ID here */
 543  if(stream_id != ctx->tunnel.stream_id) {
 544    CURL_TRC_CF(data, cf, "[%d] header for non-tunnel stream: "
 545                "%.*s: %.*s", stream_id,
 546                (int)namelen, name, (int)valuelen, value);
 547    return NGHTTP2_ERR_CALLBACK_FAILURE;
 548  }
 549
 550  if(frame->hd.type == NGHTTP2_PUSH_PROMISE)
 551    return NGHTTP2_ERR_CALLBACK_FAILURE;
 552
 553  if(ctx->tunnel.has_final_response) {
 554    /* we do not do anything with trailers for tunnel streams */
 555    return 0;
 556  }
 557
 558  if(namelen == sizeof(HTTP_PSEUDO_STATUS) - 1 &&
 559     memcmp(HTTP_PSEUDO_STATUS, name, namelen) == 0) {
 560    int http_status;
 561    struct http_resp *resp;
 562
 563    /* status: always comes first, we might get more than one response,
 564     * discard previous, interim responses */
 565    result = Curl_http_decode_status(&http_status,
 566                                    (const char *)value, valuelen);
 567    if(result)
 568      return NGHTTP2_ERR_CALLBACK_FAILURE;
 569    result = Curl_http_resp_make(&resp, http_status, NULL);
 570    if(result)
 571      return NGHTTP2_ERR_CALLBACK_FAILURE;
 572    if(ctx->tunnel.resp)
 573      Curl_http_resp_free(ctx->tunnel.resp);
 574    ctx->tunnel.resp = resp;
 575    CURL_TRC_CF(data, cf, "[%d] status: HTTP/2 %03d",
 576                stream_id, ctx->tunnel.resp->status);
 577    return 0;
 578  }
 579
 580  if(!ctx->tunnel.resp)
 581    return NGHTTP2_ERR_CALLBACK_FAILURE;
 582
 583  result = Curl_dynhds_add(&ctx->tunnel.resp->headers,
 584                           (const char *)name, namelen,
 585                           (const char *)value, valuelen);
 586  if(result)
 587    return NGHTTP2_ERR_CALLBACK_FAILURE;
 588
 589  CURL_TRC_CF(data, cf, "[%d] header: %.*s: %.*s",
 590              stream_id, (int)namelen, name, (int)valuelen, value);
 591
 592  return 0; /* 0 is successful */
 593}
 594
 595static ssize_t tunnel_send_callback(nghttp2_session *session,
 596                                    int32_t stream_id,
 597                                    uint8_t *buf, size_t length,
 598                                    uint32_t *data_flags,
 599                                    nghttp2_data_source *source,
 600                                    void *userp)
 601{
 602  struct Curl_cfilter *cf = userp;
 603  struct cf_h2_proxy_ctx *ctx = cf->ctx;
 604  struct Curl_easy *data = CF_DATA_CURRENT(cf);
 605  struct tunnel_stream *ts;
 606  CURLcode result;
 607  size_t nread;
 608
 609  (void)source;
 610  (void)ctx;
 611
 612  if(!stream_id)
 613    return NGHTTP2_ERR_INVALID_ARGUMENT;
 614
 615  ts = nghttp2_session_get_stream_user_data(session, stream_id);
 616  if(!ts)
 617    return NGHTTP2_ERR_CALLBACK_FAILURE;
 618  DEBUGASSERT(ts == &ctx->tunnel);
 619
 620  result = Curl_bufq_read(&ts->sendbuf, buf, length, &nread);
 621  if(result) {
 622    if(result != CURLE_AGAIN)
 623      return NGHTTP2_ERR_CALLBACK_FAILURE;
 624    return NGHTTP2_ERR_DEFERRED;
 625  }
 626  if(ts->closed && Curl_bufq_is_empty(&ts->sendbuf))
 627    *data_flags = NGHTTP2_DATA_FLAG_EOF;
 628
 629  CURL_TRC_CF(data, cf, "[%d] tunnel_send_callback -> %zu",
 630              ts->stream_id, nread);
 631  return (nread  > SSIZE_MAX) ?
 632    NGHTTP2_ERR_CALLBACK_FAILURE : (ssize_t)nread;
 633}
 634
 635static int tunnel_recv_callback(nghttp2_session *session, uint8_t flags,
 636                                int32_t stream_id,
 637                                const uint8_t *mem, size_t len, void *userp)
 638{
 639  struct Curl_cfilter *cf = userp;
 640  struct cf_h2_proxy_ctx *ctx = cf->ctx;
 641  size_t nwritten;
 642  CURLcode result;
 643
 644  (void)flags;
 645  (void)session;
 646  DEBUGASSERT(stream_id); /* should never be a zero stream ID here */
 647
 648  if(stream_id != ctx->tunnel.stream_id)
 649    return NGHTTP2_ERR_CALLBACK_FAILURE;
 650
 651  result = Curl_bufq_write(&ctx->tunnel.recvbuf, mem, len, &nwritten);
 652  if(result) {
 653    if(result != CURLE_AGAIN)
 654      return NGHTTP2_ERR_CALLBACK_FAILURE;
 655#ifdef DEBUGBUILD
 656    nwritten = 0;
 657#endif
 658  }
 659  /* tunnel.recbuf has soft limit, any success MUST add all data */
 660  DEBUGASSERT(nwritten == len);
 661  return 0;
 662}
 663
 664static int proxy_h2_on_stream_close(nghttp2_session *session,
 665                                    int32_t stream_id,
 666                                    uint32_t error_code, void *userp)
 667{
 668  struct Curl_cfilter *cf = userp;
 669  struct cf_h2_proxy_ctx *ctx = cf->ctx;
 670  struct Curl_easy *data = CF_DATA_CURRENT(cf);
 671
 672  (void)session;
 673
 674  if(stream_id != ctx->tunnel.stream_id)
 675    return 0;
 676
 677  CURL_TRC_CF(data, cf, "[%d] proxy_h2_on_stream_close, %s (err %u)",
 678              stream_id, nghttp2_http2_strerror(error_code), error_code);
 679  ctx->tunnel.closed = TRUE;
 680  ctx->tunnel.error = error_code;
 681  if(error_code)
 682    ctx->tunnel.reset = TRUE;
 683
 684  return 0;
 685}
 686
 687static CURLcode proxy_h2_submit(
 688  int32_t *pstream_id,
 689  struct Curl_cfilter *cf,
 690  struct Curl_easy *data,
 691  nghttp2_session *h2,
 692  struct httpreq *req,
 693  const nghttp2_priority_spec *pri_spec,
 694  void *stream_user_data,
 695  nghttp2_data_source_read_callback read_callback,
 696  void *read_ctx)
 697{
 698  struct dynhds h2_headers;
 699  nghttp2_nv *nva = NULL;
 700  int32_t stream_id = -1;
 701  size_t nheader;
 702  CURLcode result;
 703
 704  (void)cf;
 705  Curl_dynhds_init(&h2_headers, 0, DYN_HTTP_REQUEST);
 706  result = Curl_http_req_to_h2(&h2_headers, req, data);
 707  if(result)
 708    goto out;
 709
 710  nva = Curl_dynhds_to_nva(&h2_headers, &nheader);
 711  if(!nva) {
 712    result = CURLE_OUT_OF_MEMORY;
 713    goto out;
 714  }
 715
 716  if(read_callback) {
 717    nghttp2_data_provider data_prd;
 718
 719    data_prd.read_callback = read_callback;
 720    data_prd.source.ptr = read_ctx;
 721    stream_id = nghttp2_submit_request(h2, pri_spec, nva, nheader,
 722                                       &data_prd, stream_user_data);
 723  }
 724  else {
 725    stream_id = nghttp2_submit_request(h2, pri_spec, nva, nheader,
 726                                       NULL, stream_user_data);
 727  }
 728
 729  if(stream_id < 0) {
 730    failf(data, "nghttp2_session_upgrade2() failed: %s(%d)",
 731          nghttp2_strerror(stream_id), stream_id);
 732    result = CURLE_SEND_ERROR;
 733    goto out;
 734  }
 735  result = CURLE_OK;
 736
 737out:
 738  curlx_free(nva);
 739  Curl_dynhds_free(&h2_headers);
 740  *pstream_id = stream_id;
 741  return result;
 742}
 743
 744static CURLcode submit_CONNECT(struct Curl_cfilter *cf,
 745                               struct Curl_easy *data,
 746                               struct tunnel_stream *ts)
 747{
 748  struct cf_h2_proxy_ctx *ctx = cf->ctx;
 749  CURLcode result;
 750  struct httpreq *req = NULL;
 751
 752  result = Curl_http_proxy_create_CONNECT(&req, cf, data, ctx->dest, 20);
 753  if(result)
 754    goto out;
 755  result = Curl_creader_set_null(data);
 756  if(result)
 757    goto out;
 758
 759  infof(data, "Establish HTTP/2 proxy tunnel to %s", req->authority);
 760
 761  result = proxy_h2_submit(&ts->stream_id, cf, data, ctx->h2, req,
 762                           NULL, ts, tunnel_send_callback, cf);
 763  if(result) {
 764    CURL_TRC_CF(data, cf, "[%d] send, nghttp2_submit_request error: %s",
 765                ts->stream_id, nghttp2_strerror(ts->stream_id));
 766  }
 767
 768out:
 769  if(req)
 770    Curl_http_req_free(req);
 771  if(result)
 772    failf(data, "Failed sending CONNECT to proxy");
 773  return result;
 774}
 775
 776static CURLcode inspect_response(struct Curl_cfilter *cf,
 777                                 struct Curl_easy *data,
 778                                 struct tunnel_stream *ts)
 779{
 780  CURLcode result = CURLE_OK;
 781  struct dynhds_entry *auth_reply = NULL;
 782  (void)cf;
 783
 784  DEBUGASSERT(ts->resp);
 785  if(ts->resp->status / 100 == 2) {
 786    infof(data, "CONNECT tunnel established, response %d", ts->resp->status);
 787    h2_tunnel_go_state(cf, ts, H2_TUNNEL_ESTABLISHED, data);
 788    return CURLE_OK;
 789  }
 790
 791  if(ts->resp->status == 401) {
 792    auth_reply = Curl_dynhds_cget(&ts->resp->headers, "WWW-Authenticate");
 793  }
 794  else if(ts->resp->status == 407) {
 795    auth_reply = Curl_dynhds_cget(&ts->resp->headers, "Proxy-Authenticate");
 796  }
 797
 798  if(auth_reply) {
 799    CURL_TRC_CF(data, cf, "[0] CONNECT: fwd auth header '%s'",
 800                auth_reply->value);
 801    result = Curl_http_input_auth(data, ts->resp->status == 407,
 802                                  auth_reply->value);
 803    if(result)
 804      return result;
 805    if(data->req.newurl) {
 806      /* Indicator that we should try again */
 807      curlx_safefree(data->req.newurl);
 808      h2_tunnel_go_state(cf, ts, H2_TUNNEL_INIT, data);
 809      return CURLE_OK;
 810    }
 811  }
 812
 813  /* Seems to have failed */
 814  return CURLE_COULDNT_CONNECT;
 815}
 816
 817static CURLcode H2_CONNECT(struct Curl_cfilter *cf,
 818                           struct Curl_easy *data,
 819                           struct tunnel_stream *ts)
 820{
 821  struct cf_h2_proxy_ctx *ctx = cf->ctx;
 822  CURLcode result = CURLE_OK;
 823
 824  DEBUGASSERT(ts);
 825  DEBUGASSERT(ts->authority);
 826  do {
 827    switch(ts->state) {
 828    case H2_TUNNEL_INIT:
 829      /* Prepare the CONNECT request and make a first attempt to send. */
 830      CURL_TRC_CF(data, cf, "[0] CONNECT start for %s", ts->authority);
 831      result = submit_CONNECT(cf, data, ts);
 832      if(result)
 833        goto out;
 834      h2_tunnel_go_state(cf, ts, H2_TUNNEL_CONNECT, data);
 835      FALLTHROUGH();
 836
 837    case H2_TUNNEL_CONNECT:
 838      /* see that the request is completely sent */
 839      result = proxy_h2_progress_ingress(cf, data);
 840      if(!result)
 841        result = proxy_h2_progress_egress(cf, data);
 842      if(result && result != CURLE_AGAIN) {
 843        h2_tunnel_go_state(cf, ts, H2_TUNNEL_FAILED, data);
 844        break;
 845      }
 846
 847      if(ts->has_final_response) {
 848        h2_tunnel_go_state(cf, ts, H2_TUNNEL_RESPONSE, data);
 849      }
 850      else {
 851        result = CURLE_OK;
 852        goto out;
 853      }
 854      FALLTHROUGH();
 855
 856    case H2_TUNNEL_RESPONSE:
 857      DEBUGASSERT(ts->has_final_response);
 858      result = inspect_response(cf, data, ts);
 859      if(result)
 860        goto out;
 861      break;
 862
 863    case H2_TUNNEL_ESTABLISHED:
 864      return CURLE_OK;
 865
 866    case H2_TUNNEL_FAILED:
 867      return CURLE_RECV_ERROR;
 868
 869    default:
 870      break;
 871    }
 872
 873  } while(ts->state == H2_TUNNEL_INIT);
 874
 875out:
 876  if((result && (result != CURLE_AGAIN)) || ctx->tunnel.closed)
 877    h2_tunnel_go_state(cf, ts, H2_TUNNEL_FAILED, data);
 878  return result;
 879}
 880
 881/*
 882 * Initialize the cfilter context
 883 */
 884static CURLcode cf_h2_proxy_ctx_init(struct Curl_cfilter *cf,
 885                                     struct Curl_easy *data)
 886{
 887  struct cf_h2_proxy_ctx *ctx = cf->ctx;
 888  CURLcode result = CURLE_OUT_OF_MEMORY;
 889  nghttp2_session_callbacks *cbs = NULL;
 890  int rc;
 891
 892  DEBUGASSERT(!ctx->h2);
 893  memset(&ctx->tunnel, 0, sizeof(ctx->tunnel));
 894
 895  Curl_bufq_init(&ctx->inbufq, PROXY_H2_CHUNK_SIZE, PROXY_H2_NW_RECV_CHUNKS);
 896  Curl_bufq_init(&ctx->outbufq, PROXY_H2_CHUNK_SIZE, PROXY_H2_NW_SEND_CHUNKS);
 897
 898  if(tunnel_stream_init(&ctx->tunnel, ctx->dest))
 899    goto out;
 900
 901  rc = nghttp2_session_callbacks_new(&cbs);
 902  if(rc) {
 903    failf(data, "Could not initialize nghttp2 callbacks");
 904    goto out;
 905  }
 906
 907  nghttp2_session_callbacks_set_send_callback(cbs, on_session_send);
 908  nghttp2_session_callbacks_set_on_frame_recv_callback(
 909    cbs, proxy_h2_on_frame_recv);
 910#ifdef CURLVERBOSE
 911  nghttp2_session_callbacks_set_on_frame_send_callback(cbs,
 912                                                       proxy_h2_on_frame_send);
 913#endif
 914  nghttp2_session_callbacks_set_on_data_chunk_recv_callback(
 915    cbs, tunnel_recv_callback);
 916  nghttp2_session_callbacks_set_on_stream_close_callback(
 917    cbs, proxy_h2_on_stream_close);
 918  nghttp2_session_callbacks_set_on_header_callback(cbs, proxy_h2_on_header);
 919
 920  /* The nghttp2 session is not yet setup, do it */
 921  rc = proxy_h2_client_new(cf, cbs);
 922  if(rc) {
 923    failf(data, "Could not initialize nghttp2");
 924    goto out;
 925  }
 926
 927  {
 928    nghttp2_settings_entry iv[3];
 929
 930    iv[0].settings_id = NGHTTP2_SETTINGS_MAX_CONCURRENT_STREAMS;
 931    iv[0].value = Curl_multi_max_concurrent_streams(data->multi);
 932    iv[1].settings_id = NGHTTP2_SETTINGS_INITIAL_WINDOW_SIZE;
 933    iv[1].value = H2_TUNNEL_WINDOW_SIZE;
 934    iv[2].settings_id = NGHTTP2_SETTINGS_ENABLE_PUSH;
 935    iv[2].value = 0;
 936    rc = nghttp2_submit_settings(ctx->h2, NGHTTP2_FLAG_NONE, iv, 3);
 937    if(rc) {
 938      failf(data, "nghttp2_submit_settings() failed: %s(%d)",
 939            nghttp2_strerror(rc), rc);
 940      result = CURLE_HTTP2;
 941      goto out;
 942    }
 943  }
 944
 945  rc = nghttp2_session_set_local_window_size(ctx->h2, NGHTTP2_FLAG_NONE, 0,
 946                                             PROXY_HTTP2_HUGE_WINDOW_SIZE);
 947  if(rc) {
 948    failf(data, "nghttp2_session_set_local_window_size() failed: %s(%d)",
 949          nghttp2_strerror(rc), rc);
 950    result = CURLE_HTTP2;
 951    goto out;
 952  }
 953
 954  /* all set, traffic will be send on connect */
 955  result = CURLE_OK;
 956
 957out:
 958  if(cbs)
 959    nghttp2_session_callbacks_del(cbs);
 960  CURL_TRC_CF(data, cf, "[0] init proxy ctx -> %d", result);
 961  return result;
 962}
 963
 964static CURLcode cf_h2_proxy_connect(struct Curl_cfilter *cf,
 965                                    struct Curl_easy *data,
 966                                    bool *done)
 967{
 968  struct cf_h2_proxy_ctx *ctx = cf->ctx;
 969  CURLcode result = CURLE_OK;
 970  struct cf_call_data save;
 971  struct tunnel_stream *ts = &ctx->tunnel;
 972
 973  if(cf->connected) {
 974    *done = TRUE;
 975    return CURLE_OK;
 976  }
 977
 978  /* Connect the lower filters first */
 979  if(!cf->next->connected) {
 980    result = Curl_conn_cf_connect(cf->next, data, done);
 981    if(result || !*done)
 982      return result;
 983  }
 984
 985  *done = FALSE;
 986
 987  CF_DATA_SAVE(save, cf, data);
 988  if(!ctx->h2) {
 989    result = cf_h2_proxy_ctx_init(cf, data);
 990    if(result)
 991      goto out;
 992  }
 993  DEBUGASSERT(ts->authority);
 994
 995  if(Curl_timeleft_ms(data) < 0) {
 996    failf(data, "Proxy CONNECT aborted due to timeout");
 997    result = CURLE_OPERATION_TIMEDOUT;
 998    goto out;
 999  }
1000
1001  /* for the secondary socket (FTP), use the "connect to host"
1002   * but ignore the "connect to port" (use the secondary port)
1003   */
1004  result = H2_CONNECT(cf, data, ts);
1005
1006out:
1007  *done = (result == CURLE_OK) && (ts->state == H2_TUNNEL_ESTABLISHED);
1008  if(*done) {
1009    cf->connected = TRUE;
1010    /* The real request will follow the CONNECT, reset request partially */
1011    Curl_req_soft_reset(&data->req, data);
1012    Curl_client_reset(data);
1013  }
1014  CF_DATA_RESTORE(cf, save);
1015  return result;
1016}
1017
1018static void cf_h2_proxy_close(struct Curl_cfilter *cf, struct Curl_easy *data)
1019{
1020  struct cf_h2_proxy_ctx *ctx = cf->ctx;
1021
1022  if(ctx) {
1023    struct cf_call_data save;
1024
1025    CF_DATA_SAVE(save, cf, data);
1026    cf_h2_proxy_ctx_clear(ctx);
1027    CF_DATA_RESTORE(cf, save);
1028  }
1029  if(cf->next)
1030    cf->next->cft->do_close(cf->next, data);
1031}
1032
1033static void cf_h2_proxy_destroy(struct Curl_cfilter *cf,
1034                                struct Curl_easy *data)
1035{
1036  struct cf_h2_proxy_ctx *ctx = cf->ctx;
1037
1038  (void)data;
1039  if(ctx) {
1040    cf_h2_proxy_ctx_free(ctx);
1041    cf->ctx = NULL;
1042  }
1043}
1044
1045static CURLcode cf_h2_proxy_shutdown(struct Curl_cfilter *cf,
1046                                     struct Curl_easy *data, bool *done)
1047{
1048  struct cf_h2_proxy_ctx *ctx = cf->ctx;
1049  struct cf_call_data save;
1050  CURLcode result;
1051  int rv;
1052
1053  if(!cf->connected || !ctx->h2 || cf->shutdown || ctx->conn_closed) {
1054    *done = TRUE;
1055    return CURLE_OK;
1056  }
1057
1058  CF_DATA_SAVE(save, cf, data);
1059
1060  if(!ctx->sent_goaway) {
1061    rv = nghttp2_submit_goaway(ctx->h2, NGHTTP2_FLAG_NONE,
1062                               0, 0,
1063                               (const uint8_t *)"shutdown",
1064                               sizeof("shutdown"));
1065    if(rv) {
1066      failf(data, "nghttp2_submit_goaway() failed: %s(%d)",
1067            nghttp2_strerror(rv), rv);
1068      result = CURLE_SEND_ERROR;
1069      goto out;
1070    }
1071    ctx->sent_goaway = TRUE;
1072  }
1073  /* GOAWAY submitted, process egress and ingress until nghttp2 is done. */
1074  result = CURLE_OK;
1075  if(nghttp2_session_want_write(ctx->h2))
1076    result = proxy_h2_progress_egress(cf, data);
1077  if(!result && nghttp2_session_want_read(ctx->h2))
1078    result = proxy_h2_progress_ingress(cf, data);
1079
1080  *done = (ctx->conn_closed ||
1081           (!result && !nghttp2_session_want_write(ctx->h2) &&
1082            !nghttp2_session_want_read(ctx->h2)));
1083out:
1084  CF_DATA_RESTORE(cf, save);
1085  cf->shutdown = (result || *done);
1086  return result;
1087}
1088
1089static bool cf_h2_proxy_data_pending(struct Curl_cfilter *cf,
1090                                     const struct Curl_easy *data)
1091{
1092  struct cf_h2_proxy_ctx *ctx = cf->ctx;
1093  if((ctx && !Curl_bufq_is_empty(&ctx->inbufq)) ||
1094     (ctx && ctx->tunnel.state == H2_TUNNEL_ESTABLISHED &&
1095      !Curl_bufq_is_empty(&ctx->tunnel.recvbuf)))
1096    return TRUE;
1097  return cf->next ? cf->next->cft->has_data_pending(cf->next, data) : FALSE;
1098}
1099
1100static CURLcode cf_h2_proxy_adjust_pollset(struct Curl_cfilter *cf,
1101                                           struct Curl_easy *data,
1102                                           struct easy_pollset *ps)
1103{
1104  struct cf_h2_proxy_ctx *ctx = cf->ctx;
1105  struct cf_call_data save;
1106  curl_socket_t sock = Curl_conn_cf_get_socket(cf, data);
1107  bool want_recv, want_send;
1108  CURLcode result = CURLE_OK;
1109
1110  if(!cf->connected && ctx->h2) {
1111    want_send = nghttp2_session_want_write(ctx->h2) ||
1112                !Curl_bufq_is_empty(&ctx->outbufq) ||
1113                !Curl_bufq_is_empty(&ctx->tunnel.sendbuf);
1114    want_recv = nghttp2_session_want_read(ctx->h2);
1115  }
1116  else
1117    Curl_pollset_check(data, ps, sock, &want_recv, &want_send);
1118
1119  if(ctx->h2 && (want_recv || want_send)) {
1120    bool c_exhaust, s_exhaust;
1121
1122    CF_DATA_SAVE(save, cf, data);
1123    c_exhaust = !nghttp2_session_get_remote_window_size(ctx->h2);
1124    s_exhaust = ctx->tunnel.stream_id >= 0 &&
1125                !nghttp2_session_get_stream_remote_window_size(
1126                  ctx->h2, ctx->tunnel.stream_id);
1127    want_recv = (want_recv || c_exhaust || s_exhaust);
1128    want_send = (!s_exhaust && want_send) ||
1129                (!c_exhaust && nghttp2_session_want_write(ctx->h2)) ||
1130                !Curl_bufq_is_empty(&ctx->outbufq) ||
1131                !Curl_bufq_is_empty(&ctx->tunnel.sendbuf);
1132
1133    result = Curl_pollset_set(data, ps, sock, want_recv, want_send);
1134    CURL_TRC_CF(data, cf, "adjust_pollset, want_recv=%d want_send=%d -> %d",
1135                want_recv, want_send, result);
1136    CF_DATA_RESTORE(cf, save);
1137  }
1138  else if(ctx->sent_goaway && !cf->shutdown) {
1139    /* shutdown in progress */
1140    CF_DATA_SAVE(save, cf, data);
1141    want_send = nghttp2_session_want_write(ctx->h2) ||
1142                !Curl_bufq_is_empty(&ctx->outbufq) ||
1143                !Curl_bufq_is_empty(&ctx->tunnel.sendbuf);
1144    want_recv = nghttp2_session_want_read(ctx->h2);
1145    result = Curl_pollset_set(data, ps, sock, want_recv, want_send);
1146    CURL_TRC_CF(data, cf, "adjust_pollset, want_recv=%d want_send=%d -> %d",
1147                want_recv, want_send, result);
1148    CF_DATA_RESTORE(cf, save);
1149  }
1150  return result;
1151}
1152
1153static CURLcode h2_handle_tunnel_close(struct Curl_cfilter *cf,
1154                                       struct Curl_easy *data,
1155                                       size_t *pnread)
1156{
1157  struct cf_h2_proxy_ctx *ctx = cf->ctx;
1158
1159  *pnread = 0;
1160  if(ctx->tunnel.error) {
1161    failf(data, "HTTP/2 stream %d reset by %s (error 0x%x %s)",
1162          ctx->tunnel.stream_id, ctx->tunnel.reset ? "server" : "curl",
1163          ctx->tunnel.error, nghttp2_http2_strerror(ctx->tunnel.error));
1164    return CURLE_RECV_ERROR;
1165  }
1166
1167  CURL_TRC_CF(data, cf, "[%d] handle_tunnel_close -> 0",
1168              ctx->tunnel.stream_id);
1169  return CURLE_OK;
1170}
1171
1172static CURLcode tunnel_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
1173                            char *buf, size_t len, size_t *pnread)
1174{
1175  struct cf_h2_proxy_ctx *ctx = cf->ctx;
1176  CURLcode result = CURLE_AGAIN;
1177
1178  *pnread = 0;
1179  if(!Curl_bufq_is_empty(&ctx->tunnel.recvbuf))
1180    result = Curl_bufq_cread(&ctx->tunnel.recvbuf, buf, len, pnread);
1181  else {
1182    if(ctx->tunnel.closed) {
1183      result = h2_handle_tunnel_close(cf, data, pnread);
1184    }
1185    else if(ctx->tunnel.reset ||
1186            (ctx->conn_closed && Curl_bufq_is_empty(&ctx->inbufq)) ||
1187            (ctx->rcvd_goaway &&
1188             ctx->last_stream_id < ctx->tunnel.stream_id)) {
1189      result = CURLE_RECV_ERROR;
1190    }
1191    else
1192      result = CURLE_AGAIN;
1193  }
1194
1195  CURL_TRC_CF(data, cf, "[%d] tunnel_recv(len=%zu) -> %d, %zu",
1196              ctx->tunnel.stream_id, len, result, *pnread);
1197  return result;
1198}
1199
1200static CURLcode cf_h2_proxy_recv(struct Curl_cfilter *cf,
1201                                 struct Curl_easy *data,
1202                                 char *buf, size_t len,
1203                                 size_t *pnread)
1204{
1205  struct cf_h2_proxy_ctx *ctx = cf->ctx;
1206  struct cf_call_data save;
1207  CURLcode result;
1208
1209  *pnread = 0;
1210  CF_DATA_SAVE(save, cf, data);
1211
1212  if(ctx->tunnel.state != H2_TUNNEL_ESTABLISHED) {
1213    result = CURLE_RECV_ERROR;
1214    goto out;
1215  }
1216
1217  if(Curl_bufq_is_empty(&ctx->tunnel.recvbuf)) {
1218    result = proxy_h2_progress_ingress(cf, data);
1219    if(result)
1220      goto out;
1221  }
1222
1223  result = tunnel_recv(cf, data, buf, len, pnread);
1224
1225  if(!result) {
1226    CURL_TRC_CF(data, cf, "[%d] increase window by %zu",
1227                ctx->tunnel.stream_id, *pnread);
1228    nghttp2_session_consume(ctx->h2, ctx->tunnel.stream_id, *pnread);
1229  }
1230
1231  result = Curl_1st_fatal(result, proxy_h2_progress_egress(cf, data));
1232
1233out:
1234  if(!Curl_bufq_is_empty(&ctx->tunnel.recvbuf) &&
1235     (!result || (result == CURLE_AGAIN))) {
1236    /* data pending and no fatal error to report. Need to trigger
1237     * draining to avoid stalling when no socket events happen. */
1238    drain_tunnel(cf, data, &ctx->tunnel);
1239  }
1240  CURL_TRC_CF(data, cf, "[%d] cf_recv(len=%zu) -> %d, %zu",
1241              ctx->tunnel.stream_id, len, result, *pnread);
1242  CF_DATA_RESTORE(cf, save);
1243  return result;
1244}
1245
1246static CURLcode cf_h2_proxy_send(struct Curl_cfilter *cf,
1247                                 struct Curl_easy *data,
1248                                 const uint8_t *buf, size_t len, bool eos,
1249                                 size_t *pnwritten)
1250{
1251  struct cf_h2_proxy_ctx *ctx = cf->ctx;
1252  struct cf_call_data save;
1253  int rv;
1254  CURLcode result;
1255
1256  (void)eos;
1257  *pnwritten = 0;
1258  CF_DATA_SAVE(save, cf, data);
1259
1260  if(ctx->tunnel.state != H2_TUNNEL_ESTABLISHED) {
1261    result = CURLE_SEND_ERROR;
1262    goto out;
1263  }
1264
1265  if(ctx->tunnel.closed) {
1266    result = CURLE_SEND_ERROR;
1267    goto out;
1268  }
1269
1270  result = Curl_bufq_write(&ctx->tunnel.sendbuf, buf, len, pnwritten);
1271  CURL_TRC_CF(data, cf, "cf_send(), bufq_write %d, %zu", result, *pnwritten);
1272  if(result && (result != CURLE_AGAIN))
1273    goto out;
1274
1275  if(!Curl_bufq_is_empty(&ctx->tunnel.sendbuf)) {
1276    /* req body data is buffered, resume the potentially suspended stream */
1277    rv = nghttp2_session_resume_data(ctx->h2, ctx->tunnel.stream_id);
1278    if(nghttp2_is_fatal(rv)) {
1279      result = CURLE_SEND_ERROR;
1280      goto out;
1281    }
1282  }
1283
1284  result = Curl_1st_fatal(result, proxy_h2_progress_ingress(cf, data));
1285  result = Curl_1st_fatal(result, proxy_h2_progress_egress(cf, data));
1286
1287  if(!result && proxy_h2_should_close_session(ctx)) {
1288    /* nghttp2 thinks this session is done. If the stream has not been
1289     * closed, this is an error state for out transfer */
1290    if(ctx->tunnel.closed) {
1291      result = CURLE_SEND_ERROR;
1292    }
1293    else {
1294      CURL_TRC_CF(data, cf, "[0] send: nothing to do in this session");
1295      result = CURLE_HTTP2;
1296    }
1297  }
1298
1299out:
1300  if(!Curl_bufq_is_empty(&ctx->tunnel.recvbuf) &&
1301     (!result || (result == CURLE_AGAIN))) {
1302    /* data pending and no fatal error to report. Need to trigger
1303     * draining to avoid stalling when no socket events happen. */
1304    drain_tunnel(cf, data, &ctx->tunnel);
1305  }
1306  CURL_TRC_CF(data, cf, "[%d] cf_send(len=%zu) -> %d, %zu, "
1307              "h2 windows %d-%d (stream-conn), buffers %zu-%zu (stream-conn)",
1308              ctx->tunnel.stream_id, len, result, *pnwritten,
1309              nghttp2_session_get_stream_remote_window_size(
1310                ctx->h2, ctx->tunnel.stream_id),
1311              nghttp2_session_get_remote_window_size(ctx->h2),
1312              Curl_bufq_len(&ctx->tunnel.sendbuf),
1313              Curl_bufq_len(&ctx->outbufq));
1314  CF_DATA_RESTORE(cf, save);
1315  return result;
1316}
1317
1318static CURLcode cf_h2_proxy_flush(struct Curl_cfilter *cf,
1319                                  struct Curl_easy *data)
1320{
1321  struct cf_h2_proxy_ctx *ctx = cf->ctx;
1322  struct cf_call_data save;
1323  CURLcode result = CURLE_OK;
1324
1325  CF_DATA_SAVE(save, cf, data);
1326  if(!Curl_bufq_is_empty(&ctx->tunnel.sendbuf)) {
1327    /* resume the potentially suspended tunnel */
1328    int rv = nghttp2_session_resume_data(ctx->h2, ctx->tunnel.stream_id);
1329    if(nghttp2_is_fatal(rv)) {
1330      result = CURLE_SEND_ERROR;
1331      goto out;
1332    }
1333  }
1334
1335  result = proxy_h2_progress_egress(cf, data);
1336
1337out:
1338  CURL_TRC_CF(data, cf, "[%d] flush -> %d, "
1339              "h2 windows %d-%d (stream-conn), buffers %zu-%zu (stream-conn)",
1340              ctx->tunnel.stream_id, result,
1341              nghttp2_session_get_stream_remote_window_size(
1342                ctx->h2, ctx->tunnel.stream_id),
1343              nghttp2_session_get_remote_window_size(ctx->h2),
1344              Curl_bufq_len(&ctx->tunnel.sendbuf),
1345              Curl_bufq_len(&ctx->outbufq));
1346  CF_DATA_RESTORE(cf, save);
1347  return result;
1348}
1349
1350static bool proxy_h2_connisalive(struct Curl_cfilter *cf,
1351                                 struct Curl_easy *data,
1352                                 bool *input_pending)
1353{
1354  struct cf_h2_proxy_ctx *ctx = cf->ctx;
1355  bool alive = TRUE;
1356
1357  *input_pending = FALSE;
1358  if(!cf->next || !cf->next->cft->is_alive(cf->next, data, input_pending))
1359    return FALSE;
1360
1361  if(*input_pending) {
1362    /* This happens before we have sent off a request and the connection is
1363       not in use by any other transfer, there should not be any data here,
1364       only "protocol frames" */
1365    CURLcode result;
1366    size_t nread;
1367
1368    *input_pending = FALSE;
1369    result = Curl_cf_recv_bufq(cf->next, data, &ctx->inbufq, 0, &nread);
1370    if(!result) {
1371      if(proxy_h2_process_pending_input(cf, data))
1372        /* immediate error, considered dead */
1373        alive = FALSE;
1374      else {
1375        alive = !proxy_h2_should_close_session(ctx);
1376      }
1377    }
1378    else if(result != CURLE_AGAIN) {
1379      /* the read failed so let's say this is dead anyway */
1380      alive = FALSE;
1381    }
1382  }
1383
1384  return alive;
1385}
1386
1387static bool cf_h2_proxy_is_alive(struct Curl_cfilter *cf,
1388                                 struct Curl_easy *data,
1389                                 bool *input_pending)
1390{
1391  struct cf_h2_proxy_ctx *ctx = cf->ctx;
1392  bool alive;
1393  struct cf_call_data save;
1394
1395  *input_pending = FALSE;
1396  CF_DATA_SAVE(save, cf, data);
1397  alive = (ctx && ctx->h2 && proxy_h2_connisalive(cf, data, input_pending));
1398  CURL_TRC_CF(data, cf, "[0] conn alive -> %d, input_pending=%d",
1399              alive, *input_pending);
1400  CF_DATA_RESTORE(cf, save);
1401  return alive;
1402}
1403
1404static CURLcode cf_h2_proxy_query(struct Curl_cfilter *cf,
1405                                  struct Curl_easy *data,
1406                                  int query, int *pres1, void *pres2)
1407{
1408  struct cf_h2_proxy_ctx *ctx = cf->ctx;
1409
1410  switch(query) {
1411  case CF_QUERY_HOST_PORT:
1412    *pres1 = (int)ctx->dest->port;
1413    *((const char **)pres2) = ctx->dest->hostname;
1414    return CURLE_OK;
1415  case CF_QUERY_NEED_FLUSH: {
1416    if(!Curl_bufq_is_empty(&ctx->outbufq) ||
1417       !Curl_bufq_is_empty(&ctx->tunnel.sendbuf)) {
1418      CURL_TRC_CF(data, cf, "needs flush");
1419      *pres1 = TRUE;
1420      return CURLE_OK;
1421    }
1422    break;
1423  }
1424  case CF_QUERY_ALPN_NEGOTIATED: {
1425    const char **palpn = pres2;
1426    DEBUGASSERT(palpn);
1427    *palpn = NULL;
1428    return CURLE_OK;
1429  }
1430  default:
1431    break;
1432  }
1433  return cf->next ?
1434    cf->next->cft->query(cf->next, data, query, pres1, pres2) :
1435    CURLE_UNKNOWN_OPTION;
1436}
1437
1438static CURLcode cf_h2_proxy_cntrl(struct Curl_cfilter *cf,
1439                                  struct Curl_easy *data,
1440                                  int event, int arg1, void *arg2)
1441{
1442  CURLcode result = CURLE_OK;
1443  struct cf_call_data save;
1444
1445  (void)arg1;
1446  (void)arg2;
1447
1448  switch(event) {
1449  case CF_CTRL_FLUSH:
1450    CF_DATA_SAVE(save, cf, data);
1451    result = cf_h2_proxy_flush(cf, data);
1452    CF_DATA_RESTORE(cf, save);
1453    break;
1454  default:
1455    break;
1456  }
1457  return result;
1458}
1459
1460struct Curl_cftype Curl_cft_h2_proxy = {
1461  "H2-PROXY",
1462  CF_TYPE_IP_CONNECT | CF_TYPE_PROXY,
1463  CURL_LOG_LVL_NONE,
1464  cf_h2_proxy_destroy,
1465  cf_h2_proxy_connect,
1466  cf_h2_proxy_close,
1467  cf_h2_proxy_shutdown,
1468  cf_h2_proxy_adjust_pollset,
1469  cf_h2_proxy_data_pending,
1470  cf_h2_proxy_send,
1471  cf_h2_proxy_recv,
1472  cf_h2_proxy_cntrl,
1473  cf_h2_proxy_is_alive,
1474  Curl_cf_def_conn_keep_alive,
1475  cf_h2_proxy_query,
1476};
1477
1478CURLcode Curl_cf_h2_proxy_insert_after(struct Curl_cfilter *cf,
1479                                       struct Curl_easy *data,
1480                                       struct Curl_peer *dest)
1481{
1482  struct Curl_cfilter *cf_h2_proxy = NULL;
1483  struct cf_h2_proxy_ctx *ctx;
1484  CURLcode result = CURLE_OUT_OF_MEMORY;
1485
1486  (void)data;
1487  ctx = curlx_calloc(1, sizeof(*ctx));
1488  if(!ctx)
1489    goto out;
1490  Curl_peer_link(&ctx->dest, dest);
1491
1492  result = Curl_cf_create(&cf_h2_proxy, &Curl_cft_h2_proxy, ctx);
1493  if(result)
1494    goto out;
1495  ctx = NULL;
1496  Curl_conn_cf_insert_after(cf, cf_h2_proxy);
1497
1498out:
1499  cf_h2_proxy_ctx_free(ctx);
1500  return result;
1501}
1502
1503#endif /* !CURL_DISABLE_HTTP && !CURL_DISABLE_PROXY && USE_NGHTTP2 */