Dinesh Belwalkar | e63f7f9 | 2019-11-22 23:11:16 +0000 | [diff] [blame^] | 1 | // Copyright 2014 The Go Authors. All rights reserved. |
| 2 | // Use of this source code is governed by a BSD-style |
| 3 | // license that can be found in the LICENSE file. |
| 4 | |
| 5 | // TODO: turn off the serve goroutine when idle, so |
| 6 | // an idle conn only has the readFrames goroutine active. (which could |
| 7 | // also be optimized probably to pin less memory in crypto/tls). This |
| 8 | // would involve tracking when the serve goroutine is active (atomic |
| 9 | // int32 read/CAS probably?) and starting it up when frames arrive, |
| 10 | // and shutting it down when all handlers exit. the occasional PING |
| 11 | // packets could use time.AfterFunc to call sc.wakeStartServeLoop() |
| 12 | // (which is a no-op if already running) and then queue the PING write |
| 13 | // as normal. The serve loop would then exit in most cases (if no |
| 14 | // Handlers running) and not be woken up again until the PING packet |
| 15 | // returns. |
| 16 | |
| 17 | // TODO (maybe): add a mechanism for Handlers to going into |
| 18 | // half-closed-local mode (rw.(io.Closer) test?) but not exit their |
| 19 | // handler, and continue to be able to read from the |
| 20 | // Request.Body. This would be a somewhat semantic change from HTTP/1 |
| 21 | // (or at least what we expose in net/http), so I'd probably want to |
| 22 | // add it there too. For now, this package says that returning from |
| 23 | // the Handler ServeHTTP function means you're both done reading and |
| 24 | // done writing, without a way to stop just one or the other. |
| 25 | |
| 26 | package http2 |
| 27 | |
| 28 | import ( |
| 29 | "bufio" |
| 30 | "bytes" |
| 31 | "context" |
| 32 | "crypto/tls" |
| 33 | "errors" |
| 34 | "fmt" |
| 35 | "io" |
| 36 | "log" |
| 37 | "math" |
| 38 | "net" |
| 39 | "net/http" |
| 40 | "net/textproto" |
| 41 | "net/url" |
| 42 | "os" |
| 43 | "reflect" |
| 44 | "runtime" |
| 45 | "strconv" |
| 46 | "strings" |
| 47 | "sync" |
| 48 | "time" |
| 49 | |
| 50 | "golang.org/x/net/http/httpguts" |
| 51 | "golang.org/x/net/http2/hpack" |
| 52 | ) |
| 53 | |
| 54 | const ( |
| 55 | prefaceTimeout = 10 * time.Second |
| 56 | firstSettingsTimeout = 2 * time.Second // should be in-flight with preface anyway |
| 57 | handlerChunkWriteSize = 4 << 10 |
| 58 | defaultMaxStreams = 250 // TODO: make this 100 as the GFE seems to? |
| 59 | maxQueuedControlFrames = 10000 |
| 60 | ) |
| 61 | |
| 62 | var ( |
| 63 | errClientDisconnected = errors.New("client disconnected") |
| 64 | errClosedBody = errors.New("body closed by handler") |
| 65 | errHandlerComplete = errors.New("http2: request body closed due to handler exiting") |
| 66 | errStreamClosed = errors.New("http2: stream closed") |
| 67 | ) |
| 68 | |
| 69 | var responseWriterStatePool = sync.Pool{ |
| 70 | New: func() interface{} { |
| 71 | rws := &responseWriterState{} |
| 72 | rws.bw = bufio.NewWriterSize(chunkWriter{rws}, handlerChunkWriteSize) |
| 73 | return rws |
| 74 | }, |
| 75 | } |
| 76 | |
| 77 | // Test hooks. |
| 78 | var ( |
| 79 | testHookOnConn func() |
| 80 | testHookGetServerConn func(*serverConn) |
| 81 | testHookOnPanicMu *sync.Mutex // nil except in tests |
| 82 | testHookOnPanic func(sc *serverConn, panicVal interface{}) (rePanic bool) |
| 83 | ) |
| 84 | |
| 85 | // Server is an HTTP/2 server. |
| 86 | type Server struct { |
| 87 | // MaxHandlers limits the number of http.Handler ServeHTTP goroutines |
| 88 | // which may run at a time over all connections. |
| 89 | // Negative or zero no limit. |
| 90 | // TODO: implement |
| 91 | MaxHandlers int |
| 92 | |
| 93 | // MaxConcurrentStreams optionally specifies the number of |
| 94 | // concurrent streams that each client may have open at a |
| 95 | // time. This is unrelated to the number of http.Handler goroutines |
| 96 | // which may be active globally, which is MaxHandlers. |
| 97 | // If zero, MaxConcurrentStreams defaults to at least 100, per |
| 98 | // the HTTP/2 spec's recommendations. |
| 99 | MaxConcurrentStreams uint32 |
| 100 | |
| 101 | // MaxReadFrameSize optionally specifies the largest frame |
| 102 | // this server is willing to read. A valid value is between |
| 103 | // 16k and 16M, inclusive. If zero or otherwise invalid, a |
| 104 | // default value is used. |
| 105 | MaxReadFrameSize uint32 |
| 106 | |
| 107 | // PermitProhibitedCipherSuites, if true, permits the use of |
| 108 | // cipher suites prohibited by the HTTP/2 spec. |
| 109 | PermitProhibitedCipherSuites bool |
| 110 | |
| 111 | // IdleTimeout specifies how long until idle clients should be |
| 112 | // closed with a GOAWAY frame. PING frames are not considered |
| 113 | // activity for the purposes of IdleTimeout. |
| 114 | IdleTimeout time.Duration |
| 115 | |
| 116 | // MaxUploadBufferPerConnection is the size of the initial flow |
| 117 | // control window for each connections. The HTTP/2 spec does not |
| 118 | // allow this to be smaller than 65535 or larger than 2^32-1. |
| 119 | // If the value is outside this range, a default value will be |
| 120 | // used instead. |
| 121 | MaxUploadBufferPerConnection int32 |
| 122 | |
| 123 | // MaxUploadBufferPerStream is the size of the initial flow control |
| 124 | // window for each stream. The HTTP/2 spec does not allow this to |
| 125 | // be larger than 2^32-1. If the value is zero or larger than the |
| 126 | // maximum, a default value will be used instead. |
| 127 | MaxUploadBufferPerStream int32 |
| 128 | |
| 129 | // NewWriteScheduler constructs a write scheduler for a connection. |
| 130 | // If nil, a default scheduler is chosen. |
| 131 | NewWriteScheduler func() WriteScheduler |
| 132 | |
| 133 | // Internal state. This is a pointer (rather than embedded directly) |
| 134 | // so that we don't embed a Mutex in this struct, which will make the |
| 135 | // struct non-copyable, which might break some callers. |
| 136 | state *serverInternalState |
| 137 | } |
| 138 | |
| 139 | func (s *Server) initialConnRecvWindowSize() int32 { |
| 140 | if s.MaxUploadBufferPerConnection > initialWindowSize { |
| 141 | return s.MaxUploadBufferPerConnection |
| 142 | } |
| 143 | return 1 << 20 |
| 144 | } |
| 145 | |
| 146 | func (s *Server) initialStreamRecvWindowSize() int32 { |
| 147 | if s.MaxUploadBufferPerStream > 0 { |
| 148 | return s.MaxUploadBufferPerStream |
| 149 | } |
| 150 | return 1 << 20 |
| 151 | } |
| 152 | |
| 153 | func (s *Server) maxReadFrameSize() uint32 { |
| 154 | if v := s.MaxReadFrameSize; v >= minMaxFrameSize && v <= maxFrameSize { |
| 155 | return v |
| 156 | } |
| 157 | return defaultMaxReadFrameSize |
| 158 | } |
| 159 | |
| 160 | func (s *Server) maxConcurrentStreams() uint32 { |
| 161 | if v := s.MaxConcurrentStreams; v > 0 { |
| 162 | return v |
| 163 | } |
| 164 | return defaultMaxStreams |
| 165 | } |
| 166 | |
| 167 | // maxQueuedControlFrames is the maximum number of control frames like |
| 168 | // SETTINGS, PING and RST_STREAM that will be queued for writing before |
| 169 | // the connection is closed to prevent memory exhaustion attacks. |
| 170 | func (s *Server) maxQueuedControlFrames() int { |
| 171 | // TODO: if anybody asks, add a Server field, and remember to define the |
| 172 | // behavior of negative values. |
| 173 | return maxQueuedControlFrames |
| 174 | } |
| 175 | |
| 176 | type serverInternalState struct { |
| 177 | mu sync.Mutex |
| 178 | activeConns map[*serverConn]struct{} |
| 179 | } |
| 180 | |
| 181 | func (s *serverInternalState) registerConn(sc *serverConn) { |
| 182 | if s == nil { |
| 183 | return // if the Server was used without calling ConfigureServer |
| 184 | } |
| 185 | s.mu.Lock() |
| 186 | s.activeConns[sc] = struct{}{} |
| 187 | s.mu.Unlock() |
| 188 | } |
| 189 | |
| 190 | func (s *serverInternalState) unregisterConn(sc *serverConn) { |
| 191 | if s == nil { |
| 192 | return // if the Server was used without calling ConfigureServer |
| 193 | } |
| 194 | s.mu.Lock() |
| 195 | delete(s.activeConns, sc) |
| 196 | s.mu.Unlock() |
| 197 | } |
| 198 | |
| 199 | func (s *serverInternalState) startGracefulShutdown() { |
| 200 | if s == nil { |
| 201 | return // if the Server was used without calling ConfigureServer |
| 202 | } |
| 203 | s.mu.Lock() |
| 204 | for sc := range s.activeConns { |
| 205 | sc.startGracefulShutdown() |
| 206 | } |
| 207 | s.mu.Unlock() |
| 208 | } |
| 209 | |
| 210 | // ConfigureServer adds HTTP/2 support to a net/http Server. |
| 211 | // |
| 212 | // The configuration conf may be nil. |
| 213 | // |
| 214 | // ConfigureServer must be called before s begins serving. |
| 215 | func ConfigureServer(s *http.Server, conf *Server) error { |
| 216 | if s == nil { |
| 217 | panic("nil *http.Server") |
| 218 | } |
| 219 | if conf == nil { |
| 220 | conf = new(Server) |
| 221 | } |
| 222 | conf.state = &serverInternalState{activeConns: make(map[*serverConn]struct{})} |
| 223 | if h1, h2 := s, conf; h2.IdleTimeout == 0 { |
| 224 | if h1.IdleTimeout != 0 { |
| 225 | h2.IdleTimeout = h1.IdleTimeout |
| 226 | } else { |
| 227 | h2.IdleTimeout = h1.ReadTimeout |
| 228 | } |
| 229 | } |
| 230 | s.RegisterOnShutdown(conf.state.startGracefulShutdown) |
| 231 | |
| 232 | if s.TLSConfig == nil { |
| 233 | s.TLSConfig = new(tls.Config) |
| 234 | } else if s.TLSConfig.CipherSuites != nil { |
| 235 | // If they already provided a CipherSuite list, return |
| 236 | // an error if it has a bad order or is missing |
| 237 | // ECDHE_RSA_WITH_AES_128_GCM_SHA256 or ECDHE_ECDSA_WITH_AES_128_GCM_SHA256. |
| 238 | haveRequired := false |
| 239 | sawBad := false |
| 240 | for i, cs := range s.TLSConfig.CipherSuites { |
| 241 | switch cs { |
| 242 | case tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, |
| 243 | // Alternative MTI cipher to not discourage ECDSA-only servers. |
| 244 | // See http://golang.org/cl/30721 for further information. |
| 245 | tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256: |
| 246 | haveRequired = true |
| 247 | } |
| 248 | if isBadCipher(cs) { |
| 249 | sawBad = true |
| 250 | } else if sawBad { |
| 251 | return fmt.Errorf("http2: TLSConfig.CipherSuites index %d contains an HTTP/2-approved cipher suite (%#04x), but it comes after unapproved cipher suites. With this configuration, clients that don't support previous, approved cipher suites may be given an unapproved one and reject the connection.", i, cs) |
| 252 | } |
| 253 | } |
| 254 | if !haveRequired { |
| 255 | return fmt.Errorf("http2: TLSConfig.CipherSuites is missing an HTTP/2-required AES_128_GCM_SHA256 cipher (need at least one of TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 or TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256).") |
| 256 | } |
| 257 | } |
| 258 | |
| 259 | // Note: not setting MinVersion to tls.VersionTLS12, |
| 260 | // as we don't want to interfere with HTTP/1.1 traffic |
| 261 | // on the user's server. We enforce TLS 1.2 later once |
| 262 | // we accept a connection. Ideally this should be done |
| 263 | // during next-proto selection, but using TLS <1.2 with |
| 264 | // HTTP/2 is still the client's bug. |
| 265 | |
| 266 | s.TLSConfig.PreferServerCipherSuites = true |
| 267 | |
| 268 | haveNPN := false |
| 269 | for _, p := range s.TLSConfig.NextProtos { |
| 270 | if p == NextProtoTLS { |
| 271 | haveNPN = true |
| 272 | break |
| 273 | } |
| 274 | } |
| 275 | if !haveNPN { |
| 276 | s.TLSConfig.NextProtos = append(s.TLSConfig.NextProtos, NextProtoTLS) |
| 277 | } |
| 278 | |
| 279 | if s.TLSNextProto == nil { |
| 280 | s.TLSNextProto = map[string]func(*http.Server, *tls.Conn, http.Handler){} |
| 281 | } |
| 282 | protoHandler := func(hs *http.Server, c *tls.Conn, h http.Handler) { |
| 283 | if testHookOnConn != nil { |
| 284 | testHookOnConn() |
| 285 | } |
| 286 | // The TLSNextProto interface predates contexts, so |
| 287 | // the net/http package passes down its per-connection |
| 288 | // base context via an exported but unadvertised |
| 289 | // method on the Handler. This is for internal |
| 290 | // net/http<=>http2 use only. |
| 291 | var ctx context.Context |
| 292 | type baseContexter interface { |
| 293 | BaseContext() context.Context |
| 294 | } |
| 295 | if bc, ok := h.(baseContexter); ok { |
| 296 | ctx = bc.BaseContext() |
| 297 | } |
| 298 | conf.ServeConn(c, &ServeConnOpts{ |
| 299 | Context: ctx, |
| 300 | Handler: h, |
| 301 | BaseConfig: hs, |
| 302 | }) |
| 303 | } |
| 304 | s.TLSNextProto[NextProtoTLS] = protoHandler |
| 305 | return nil |
| 306 | } |
| 307 | |
| 308 | // ServeConnOpts are options for the Server.ServeConn method. |
| 309 | type ServeConnOpts struct { |
| 310 | // Context is the base context to use. |
| 311 | // If nil, context.Background is used. |
| 312 | Context context.Context |
| 313 | |
| 314 | // BaseConfig optionally sets the base configuration |
| 315 | // for values. If nil, defaults are used. |
| 316 | BaseConfig *http.Server |
| 317 | |
| 318 | // Handler specifies which handler to use for processing |
| 319 | // requests. If nil, BaseConfig.Handler is used. If BaseConfig |
| 320 | // or BaseConfig.Handler is nil, http.DefaultServeMux is used. |
| 321 | Handler http.Handler |
| 322 | } |
| 323 | |
| 324 | func (o *ServeConnOpts) context() context.Context { |
| 325 | if o != nil && o.Context != nil { |
| 326 | return o.Context |
| 327 | } |
| 328 | return context.Background() |
| 329 | } |
| 330 | |
| 331 | func (o *ServeConnOpts) baseConfig() *http.Server { |
| 332 | if o != nil && o.BaseConfig != nil { |
| 333 | return o.BaseConfig |
| 334 | } |
| 335 | return new(http.Server) |
| 336 | } |
| 337 | |
| 338 | func (o *ServeConnOpts) handler() http.Handler { |
| 339 | if o != nil { |
| 340 | if o.Handler != nil { |
| 341 | return o.Handler |
| 342 | } |
| 343 | if o.BaseConfig != nil && o.BaseConfig.Handler != nil { |
| 344 | return o.BaseConfig.Handler |
| 345 | } |
| 346 | } |
| 347 | return http.DefaultServeMux |
| 348 | } |
| 349 | |
| 350 | // ServeConn serves HTTP/2 requests on the provided connection and |
| 351 | // blocks until the connection is no longer readable. |
| 352 | // |
| 353 | // ServeConn starts speaking HTTP/2 assuming that c has not had any |
| 354 | // reads or writes. It writes its initial settings frame and expects |
| 355 | // to be able to read the preface and settings frame from the |
| 356 | // client. If c has a ConnectionState method like a *tls.Conn, the |
| 357 | // ConnectionState is used to verify the TLS ciphersuite and to set |
| 358 | // the Request.TLS field in Handlers. |
| 359 | // |
| 360 | // ServeConn does not support h2c by itself. Any h2c support must be |
| 361 | // implemented in terms of providing a suitably-behaving net.Conn. |
| 362 | // |
| 363 | // The opts parameter is optional. If nil, default values are used. |
| 364 | func (s *Server) ServeConn(c net.Conn, opts *ServeConnOpts) { |
| 365 | baseCtx, cancel := serverConnBaseContext(c, opts) |
| 366 | defer cancel() |
| 367 | |
| 368 | sc := &serverConn{ |
| 369 | srv: s, |
| 370 | hs: opts.baseConfig(), |
| 371 | conn: c, |
| 372 | baseCtx: baseCtx, |
| 373 | remoteAddrStr: c.RemoteAddr().String(), |
| 374 | bw: newBufferedWriter(c), |
| 375 | handler: opts.handler(), |
| 376 | streams: make(map[uint32]*stream), |
| 377 | readFrameCh: make(chan readFrameResult), |
| 378 | wantWriteFrameCh: make(chan FrameWriteRequest, 8), |
| 379 | serveMsgCh: make(chan interface{}, 8), |
| 380 | wroteFrameCh: make(chan frameWriteResult, 1), // buffered; one send in writeFrameAsync |
| 381 | bodyReadCh: make(chan bodyReadMsg), // buffering doesn't matter either way |
| 382 | doneServing: make(chan struct{}), |
| 383 | clientMaxStreams: math.MaxUint32, // Section 6.5.2: "Initially, there is no limit to this value" |
| 384 | advMaxStreams: s.maxConcurrentStreams(), |
| 385 | initialStreamSendWindowSize: initialWindowSize, |
| 386 | maxFrameSize: initialMaxFrameSize, |
| 387 | headerTableSize: initialHeaderTableSize, |
| 388 | serveG: newGoroutineLock(), |
| 389 | pushEnabled: true, |
| 390 | } |
| 391 | |
| 392 | s.state.registerConn(sc) |
| 393 | defer s.state.unregisterConn(sc) |
| 394 | |
| 395 | // The net/http package sets the write deadline from the |
| 396 | // http.Server.WriteTimeout during the TLS handshake, but then |
| 397 | // passes the connection off to us with the deadline already set. |
| 398 | // Write deadlines are set per stream in serverConn.newStream. |
| 399 | // Disarm the net.Conn write deadline here. |
| 400 | if sc.hs.WriteTimeout != 0 { |
| 401 | sc.conn.SetWriteDeadline(time.Time{}) |
| 402 | } |
| 403 | |
| 404 | if s.NewWriteScheduler != nil { |
| 405 | sc.writeSched = s.NewWriteScheduler() |
| 406 | } else { |
| 407 | sc.writeSched = NewRandomWriteScheduler() |
| 408 | } |
| 409 | |
| 410 | // These start at the RFC-specified defaults. If there is a higher |
| 411 | // configured value for inflow, that will be updated when we send a |
| 412 | // WINDOW_UPDATE shortly after sending SETTINGS. |
| 413 | sc.flow.add(initialWindowSize) |
| 414 | sc.inflow.add(initialWindowSize) |
| 415 | sc.hpackEncoder = hpack.NewEncoder(&sc.headerWriteBuf) |
| 416 | |
| 417 | fr := NewFramer(sc.bw, c) |
| 418 | fr.ReadMetaHeaders = hpack.NewDecoder(initialHeaderTableSize, nil) |
| 419 | fr.MaxHeaderListSize = sc.maxHeaderListSize() |
| 420 | fr.SetMaxReadFrameSize(s.maxReadFrameSize()) |
| 421 | sc.framer = fr |
| 422 | |
| 423 | if tc, ok := c.(connectionStater); ok { |
| 424 | sc.tlsState = new(tls.ConnectionState) |
| 425 | *sc.tlsState = tc.ConnectionState() |
| 426 | // 9.2 Use of TLS Features |
| 427 | // An implementation of HTTP/2 over TLS MUST use TLS |
| 428 | // 1.2 or higher with the restrictions on feature set |
| 429 | // and cipher suite described in this section. Due to |
| 430 | // implementation limitations, it might not be |
| 431 | // possible to fail TLS negotiation. An endpoint MUST |
| 432 | // immediately terminate an HTTP/2 connection that |
| 433 | // does not meet the TLS requirements described in |
| 434 | // this section with a connection error (Section |
| 435 | // 5.4.1) of type INADEQUATE_SECURITY. |
| 436 | if sc.tlsState.Version < tls.VersionTLS12 { |
| 437 | sc.rejectConn(ErrCodeInadequateSecurity, "TLS version too low") |
| 438 | return |
| 439 | } |
| 440 | |
| 441 | if sc.tlsState.ServerName == "" { |
| 442 | // Client must use SNI, but we don't enforce that anymore, |
| 443 | // since it was causing problems when connecting to bare IP |
| 444 | // addresses during development. |
| 445 | // |
| 446 | // TODO: optionally enforce? Or enforce at the time we receive |
| 447 | // a new request, and verify the ServerName matches the :authority? |
| 448 | // But that precludes proxy situations, perhaps. |
| 449 | // |
| 450 | // So for now, do nothing here again. |
| 451 | } |
| 452 | |
| 453 | if !s.PermitProhibitedCipherSuites && isBadCipher(sc.tlsState.CipherSuite) { |
| 454 | // "Endpoints MAY choose to generate a connection error |
| 455 | // (Section 5.4.1) of type INADEQUATE_SECURITY if one of |
| 456 | // the prohibited cipher suites are negotiated." |
| 457 | // |
| 458 | // We choose that. In my opinion, the spec is weak |
| 459 | // here. It also says both parties must support at least |
| 460 | // TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 so there's no |
| 461 | // excuses here. If we really must, we could allow an |
| 462 | // "AllowInsecureWeakCiphers" option on the server later. |
| 463 | // Let's see how it plays out first. |
| 464 | sc.rejectConn(ErrCodeInadequateSecurity, fmt.Sprintf("Prohibited TLS 1.2 Cipher Suite: %x", sc.tlsState.CipherSuite)) |
| 465 | return |
| 466 | } |
| 467 | } |
| 468 | |
| 469 | if hook := testHookGetServerConn; hook != nil { |
| 470 | hook(sc) |
| 471 | } |
| 472 | sc.serve() |
| 473 | } |
| 474 | |
| 475 | func serverConnBaseContext(c net.Conn, opts *ServeConnOpts) (ctx context.Context, cancel func()) { |
| 476 | ctx, cancel = context.WithCancel(opts.context()) |
| 477 | ctx = context.WithValue(ctx, http.LocalAddrContextKey, c.LocalAddr()) |
| 478 | if hs := opts.baseConfig(); hs != nil { |
| 479 | ctx = context.WithValue(ctx, http.ServerContextKey, hs) |
| 480 | } |
| 481 | return |
| 482 | } |
| 483 | |
| 484 | func (sc *serverConn) rejectConn(err ErrCode, debug string) { |
| 485 | sc.vlogf("http2: server rejecting conn: %v, %s", err, debug) |
| 486 | // ignoring errors. hanging up anyway. |
| 487 | sc.framer.WriteGoAway(0, err, []byte(debug)) |
| 488 | sc.bw.Flush() |
| 489 | sc.conn.Close() |
| 490 | } |
| 491 | |
| 492 | type serverConn struct { |
| 493 | // Immutable: |
| 494 | srv *Server |
| 495 | hs *http.Server |
| 496 | conn net.Conn |
| 497 | bw *bufferedWriter // writing to conn |
| 498 | handler http.Handler |
| 499 | baseCtx context.Context |
| 500 | framer *Framer |
| 501 | doneServing chan struct{} // closed when serverConn.serve ends |
| 502 | readFrameCh chan readFrameResult // written by serverConn.readFrames |
| 503 | wantWriteFrameCh chan FrameWriteRequest // from handlers -> serve |
| 504 | wroteFrameCh chan frameWriteResult // from writeFrameAsync -> serve, tickles more frame writes |
| 505 | bodyReadCh chan bodyReadMsg // from handlers -> serve |
| 506 | serveMsgCh chan interface{} // misc messages & code to send to / run on the serve loop |
| 507 | flow flow // conn-wide (not stream-specific) outbound flow control |
| 508 | inflow flow // conn-wide inbound flow control |
| 509 | tlsState *tls.ConnectionState // shared by all handlers, like net/http |
| 510 | remoteAddrStr string |
| 511 | writeSched WriteScheduler |
| 512 | |
| 513 | // Everything following is owned by the serve loop; use serveG.check(): |
| 514 | serveG goroutineLock // used to verify funcs are on serve() |
| 515 | pushEnabled bool |
| 516 | sawFirstSettings bool // got the initial SETTINGS frame after the preface |
| 517 | needToSendSettingsAck bool |
| 518 | unackedSettings int // how many SETTINGS have we sent without ACKs? |
| 519 | queuedControlFrames int // control frames in the writeSched queue |
| 520 | clientMaxStreams uint32 // SETTINGS_MAX_CONCURRENT_STREAMS from client (our PUSH_PROMISE limit) |
| 521 | advMaxStreams uint32 // our SETTINGS_MAX_CONCURRENT_STREAMS advertised the client |
| 522 | curClientStreams uint32 // number of open streams initiated by the client |
| 523 | curPushedStreams uint32 // number of open streams initiated by server push |
| 524 | maxClientStreamID uint32 // max ever seen from client (odd), or 0 if there have been no client requests |
| 525 | maxPushPromiseID uint32 // ID of the last push promise (even), or 0 if there have been no pushes |
| 526 | streams map[uint32]*stream |
| 527 | initialStreamSendWindowSize int32 |
| 528 | maxFrameSize int32 |
| 529 | headerTableSize uint32 |
| 530 | peerMaxHeaderListSize uint32 // zero means unknown (default) |
| 531 | canonHeader map[string]string // http2-lower-case -> Go-Canonical-Case |
| 532 | writingFrame bool // started writing a frame (on serve goroutine or separate) |
| 533 | writingFrameAsync bool // started a frame on its own goroutine but haven't heard back on wroteFrameCh |
| 534 | needsFrameFlush bool // last frame write wasn't a flush |
| 535 | inGoAway bool // we've started to or sent GOAWAY |
| 536 | inFrameScheduleLoop bool // whether we're in the scheduleFrameWrite loop |
| 537 | needToSendGoAway bool // we need to schedule a GOAWAY frame write |
| 538 | goAwayCode ErrCode |
| 539 | shutdownTimer *time.Timer // nil until used |
| 540 | idleTimer *time.Timer // nil if unused |
| 541 | |
| 542 | // Owned by the writeFrameAsync goroutine: |
| 543 | headerWriteBuf bytes.Buffer |
| 544 | hpackEncoder *hpack.Encoder |
| 545 | |
| 546 | // Used by startGracefulShutdown. |
| 547 | shutdownOnce sync.Once |
| 548 | } |
| 549 | |
| 550 | func (sc *serverConn) maxHeaderListSize() uint32 { |
| 551 | n := sc.hs.MaxHeaderBytes |
| 552 | if n <= 0 { |
| 553 | n = http.DefaultMaxHeaderBytes |
| 554 | } |
| 555 | // http2's count is in a slightly different unit and includes 32 bytes per pair. |
| 556 | // So, take the net/http.Server value and pad it up a bit, assuming 10 headers. |
| 557 | const perFieldOverhead = 32 // per http2 spec |
| 558 | const typicalHeaders = 10 // conservative |
| 559 | return uint32(n + typicalHeaders*perFieldOverhead) |
| 560 | } |
| 561 | |
| 562 | func (sc *serverConn) curOpenStreams() uint32 { |
| 563 | sc.serveG.check() |
| 564 | return sc.curClientStreams + sc.curPushedStreams |
| 565 | } |
| 566 | |
| 567 | // stream represents a stream. This is the minimal metadata needed by |
| 568 | // the serve goroutine. Most of the actual stream state is owned by |
| 569 | // the http.Handler's goroutine in the responseWriter. Because the |
| 570 | // responseWriter's responseWriterState is recycled at the end of a |
| 571 | // handler, this struct intentionally has no pointer to the |
| 572 | // *responseWriter{,State} itself, as the Handler ending nils out the |
| 573 | // responseWriter's state field. |
| 574 | type stream struct { |
| 575 | // immutable: |
| 576 | sc *serverConn |
| 577 | id uint32 |
| 578 | body *pipe // non-nil if expecting DATA frames |
| 579 | cw closeWaiter // closed wait stream transitions to closed state |
| 580 | ctx context.Context |
| 581 | cancelCtx func() |
| 582 | |
| 583 | // owned by serverConn's serve loop: |
| 584 | bodyBytes int64 // body bytes seen so far |
| 585 | declBodyBytes int64 // or -1 if undeclared |
| 586 | flow flow // limits writing from Handler to client |
| 587 | inflow flow // what the client is allowed to POST/etc to us |
| 588 | parent *stream // or nil |
| 589 | numTrailerValues int64 |
| 590 | weight uint8 |
| 591 | state streamState |
| 592 | resetQueued bool // RST_STREAM queued for write; set by sc.resetStream |
| 593 | gotTrailerHeader bool // HEADER frame for trailers was seen |
| 594 | wroteHeaders bool // whether we wrote headers (not status 100) |
| 595 | writeDeadline *time.Timer // nil if unused |
| 596 | |
| 597 | trailer http.Header // accumulated trailers |
| 598 | reqTrailer http.Header // handler's Request.Trailer |
| 599 | } |
| 600 | |
| 601 | func (sc *serverConn) Framer() *Framer { return sc.framer } |
| 602 | func (sc *serverConn) CloseConn() error { return sc.conn.Close() } |
| 603 | func (sc *serverConn) Flush() error { return sc.bw.Flush() } |
| 604 | func (sc *serverConn) HeaderEncoder() (*hpack.Encoder, *bytes.Buffer) { |
| 605 | return sc.hpackEncoder, &sc.headerWriteBuf |
| 606 | } |
| 607 | |
| 608 | func (sc *serverConn) state(streamID uint32) (streamState, *stream) { |
| 609 | sc.serveG.check() |
| 610 | // http://tools.ietf.org/html/rfc7540#section-5.1 |
| 611 | if st, ok := sc.streams[streamID]; ok { |
| 612 | return st.state, st |
| 613 | } |
| 614 | // "The first use of a new stream identifier implicitly closes all |
| 615 | // streams in the "idle" state that might have been initiated by |
| 616 | // that peer with a lower-valued stream identifier. For example, if |
| 617 | // a client sends a HEADERS frame on stream 7 without ever sending a |
| 618 | // frame on stream 5, then stream 5 transitions to the "closed" |
| 619 | // state when the first frame for stream 7 is sent or received." |
| 620 | if streamID%2 == 1 { |
| 621 | if streamID <= sc.maxClientStreamID { |
| 622 | return stateClosed, nil |
| 623 | } |
| 624 | } else { |
| 625 | if streamID <= sc.maxPushPromiseID { |
| 626 | return stateClosed, nil |
| 627 | } |
| 628 | } |
| 629 | return stateIdle, nil |
| 630 | } |
| 631 | |
| 632 | // setConnState calls the net/http ConnState hook for this connection, if configured. |
| 633 | // Note that the net/http package does StateNew and StateClosed for us. |
| 634 | // There is currently no plan for StateHijacked or hijacking HTTP/2 connections. |
| 635 | func (sc *serverConn) setConnState(state http.ConnState) { |
| 636 | if sc.hs.ConnState != nil { |
| 637 | sc.hs.ConnState(sc.conn, state) |
| 638 | } |
| 639 | } |
| 640 | |
| 641 | func (sc *serverConn) vlogf(format string, args ...interface{}) { |
| 642 | if VerboseLogs { |
| 643 | sc.logf(format, args...) |
| 644 | } |
| 645 | } |
| 646 | |
| 647 | func (sc *serverConn) logf(format string, args ...interface{}) { |
| 648 | if lg := sc.hs.ErrorLog; lg != nil { |
| 649 | lg.Printf(format, args...) |
| 650 | } else { |
| 651 | log.Printf(format, args...) |
| 652 | } |
| 653 | } |
| 654 | |
| 655 | // errno returns v's underlying uintptr, else 0. |
| 656 | // |
| 657 | // TODO: remove this helper function once http2 can use build |
| 658 | // tags. See comment in isClosedConnError. |
| 659 | func errno(v error) uintptr { |
| 660 | if rv := reflect.ValueOf(v); rv.Kind() == reflect.Uintptr { |
| 661 | return uintptr(rv.Uint()) |
| 662 | } |
| 663 | return 0 |
| 664 | } |
| 665 | |
| 666 | // isClosedConnError reports whether err is an error from use of a closed |
| 667 | // network connection. |
| 668 | func isClosedConnError(err error) bool { |
| 669 | if err == nil { |
| 670 | return false |
| 671 | } |
| 672 | |
| 673 | // TODO: remove this string search and be more like the Windows |
| 674 | // case below. That might involve modifying the standard library |
| 675 | // to return better error types. |
| 676 | str := err.Error() |
| 677 | if strings.Contains(str, "use of closed network connection") { |
| 678 | return true |
| 679 | } |
| 680 | |
| 681 | // TODO(bradfitz): x/tools/cmd/bundle doesn't really support |
| 682 | // build tags, so I can't make an http2_windows.go file with |
| 683 | // Windows-specific stuff. Fix that and move this, once we |
| 684 | // have a way to bundle this into std's net/http somehow. |
| 685 | if runtime.GOOS == "windows" { |
| 686 | if oe, ok := err.(*net.OpError); ok && oe.Op == "read" { |
| 687 | if se, ok := oe.Err.(*os.SyscallError); ok && se.Syscall == "wsarecv" { |
| 688 | const WSAECONNABORTED = 10053 |
| 689 | const WSAECONNRESET = 10054 |
| 690 | if n := errno(se.Err); n == WSAECONNRESET || n == WSAECONNABORTED { |
| 691 | return true |
| 692 | } |
| 693 | } |
| 694 | } |
| 695 | } |
| 696 | return false |
| 697 | } |
| 698 | |
| 699 | func (sc *serverConn) condlogf(err error, format string, args ...interface{}) { |
| 700 | if err == nil { |
| 701 | return |
| 702 | } |
| 703 | if err == io.EOF || err == io.ErrUnexpectedEOF || isClosedConnError(err) || err == errPrefaceTimeout { |
| 704 | // Boring, expected errors. |
| 705 | sc.vlogf(format, args...) |
| 706 | } else { |
| 707 | sc.logf(format, args...) |
| 708 | } |
| 709 | } |
| 710 | |
| 711 | func (sc *serverConn) canonicalHeader(v string) string { |
| 712 | sc.serveG.check() |
| 713 | buildCommonHeaderMapsOnce() |
| 714 | cv, ok := commonCanonHeader[v] |
| 715 | if ok { |
| 716 | return cv |
| 717 | } |
| 718 | cv, ok = sc.canonHeader[v] |
| 719 | if ok { |
| 720 | return cv |
| 721 | } |
| 722 | if sc.canonHeader == nil { |
| 723 | sc.canonHeader = make(map[string]string) |
| 724 | } |
| 725 | cv = http.CanonicalHeaderKey(v) |
| 726 | sc.canonHeader[v] = cv |
| 727 | return cv |
| 728 | } |
| 729 | |
| 730 | type readFrameResult struct { |
| 731 | f Frame // valid until readMore is called |
| 732 | err error |
| 733 | |
| 734 | // readMore should be called once the consumer no longer needs or |
| 735 | // retains f. After readMore, f is invalid and more frames can be |
| 736 | // read. |
| 737 | readMore func() |
| 738 | } |
| 739 | |
| 740 | // readFrames is the loop that reads incoming frames. |
| 741 | // It takes care to only read one frame at a time, blocking until the |
| 742 | // consumer is done with the frame. |
| 743 | // It's run on its own goroutine. |
| 744 | func (sc *serverConn) readFrames() { |
| 745 | gate := make(gate) |
| 746 | gateDone := gate.Done |
| 747 | for { |
| 748 | f, err := sc.framer.ReadFrame() |
| 749 | select { |
| 750 | case sc.readFrameCh <- readFrameResult{f, err, gateDone}: |
| 751 | case <-sc.doneServing: |
| 752 | return |
| 753 | } |
| 754 | select { |
| 755 | case <-gate: |
| 756 | case <-sc.doneServing: |
| 757 | return |
| 758 | } |
| 759 | if terminalReadFrameError(err) { |
| 760 | return |
| 761 | } |
| 762 | } |
| 763 | } |
| 764 | |
| 765 | // frameWriteResult is the message passed from writeFrameAsync to the serve goroutine. |
| 766 | type frameWriteResult struct { |
| 767 | wr FrameWriteRequest // what was written (or attempted) |
| 768 | err error // result of the writeFrame call |
| 769 | } |
| 770 | |
| 771 | // writeFrameAsync runs in its own goroutine and writes a single frame |
| 772 | // and then reports when it's done. |
| 773 | // At most one goroutine can be running writeFrameAsync at a time per |
| 774 | // serverConn. |
| 775 | func (sc *serverConn) writeFrameAsync(wr FrameWriteRequest) { |
| 776 | err := wr.write.writeFrame(sc) |
| 777 | sc.wroteFrameCh <- frameWriteResult{wr, err} |
| 778 | } |
| 779 | |
| 780 | func (sc *serverConn) closeAllStreamsOnConnClose() { |
| 781 | sc.serveG.check() |
| 782 | for _, st := range sc.streams { |
| 783 | sc.closeStream(st, errClientDisconnected) |
| 784 | } |
| 785 | } |
| 786 | |
| 787 | func (sc *serverConn) stopShutdownTimer() { |
| 788 | sc.serveG.check() |
| 789 | if t := sc.shutdownTimer; t != nil { |
| 790 | t.Stop() |
| 791 | } |
| 792 | } |
| 793 | |
| 794 | func (sc *serverConn) notePanic() { |
| 795 | // Note: this is for serverConn.serve panicking, not http.Handler code. |
| 796 | if testHookOnPanicMu != nil { |
| 797 | testHookOnPanicMu.Lock() |
| 798 | defer testHookOnPanicMu.Unlock() |
| 799 | } |
| 800 | if testHookOnPanic != nil { |
| 801 | if e := recover(); e != nil { |
| 802 | if testHookOnPanic(sc, e) { |
| 803 | panic(e) |
| 804 | } |
| 805 | } |
| 806 | } |
| 807 | } |
| 808 | |
| 809 | func (sc *serverConn) serve() { |
| 810 | sc.serveG.check() |
| 811 | defer sc.notePanic() |
| 812 | defer sc.conn.Close() |
| 813 | defer sc.closeAllStreamsOnConnClose() |
| 814 | defer sc.stopShutdownTimer() |
| 815 | defer close(sc.doneServing) // unblocks handlers trying to send |
| 816 | |
| 817 | if VerboseLogs { |
| 818 | sc.vlogf("http2: server connection from %v on %p", sc.conn.RemoteAddr(), sc.hs) |
| 819 | } |
| 820 | |
| 821 | sc.writeFrame(FrameWriteRequest{ |
| 822 | write: writeSettings{ |
| 823 | {SettingMaxFrameSize, sc.srv.maxReadFrameSize()}, |
| 824 | {SettingMaxConcurrentStreams, sc.advMaxStreams}, |
| 825 | {SettingMaxHeaderListSize, sc.maxHeaderListSize()}, |
| 826 | {SettingInitialWindowSize, uint32(sc.srv.initialStreamRecvWindowSize())}, |
| 827 | }, |
| 828 | }) |
| 829 | sc.unackedSettings++ |
| 830 | |
| 831 | // Each connection starts with intialWindowSize inflow tokens. |
| 832 | // If a higher value is configured, we add more tokens. |
| 833 | if diff := sc.srv.initialConnRecvWindowSize() - initialWindowSize; diff > 0 { |
| 834 | sc.sendWindowUpdate(nil, int(diff)) |
| 835 | } |
| 836 | |
| 837 | if err := sc.readPreface(); err != nil { |
| 838 | sc.condlogf(err, "http2: server: error reading preface from client %v: %v", sc.conn.RemoteAddr(), err) |
| 839 | return |
| 840 | } |
| 841 | // Now that we've got the preface, get us out of the |
| 842 | // "StateNew" state. We can't go directly to idle, though. |
| 843 | // Active means we read some data and anticipate a request. We'll |
| 844 | // do another Active when we get a HEADERS frame. |
| 845 | sc.setConnState(http.StateActive) |
| 846 | sc.setConnState(http.StateIdle) |
| 847 | |
| 848 | if sc.srv.IdleTimeout != 0 { |
| 849 | sc.idleTimer = time.AfterFunc(sc.srv.IdleTimeout, sc.onIdleTimer) |
| 850 | defer sc.idleTimer.Stop() |
| 851 | } |
| 852 | |
| 853 | go sc.readFrames() // closed by defer sc.conn.Close above |
| 854 | |
| 855 | settingsTimer := time.AfterFunc(firstSettingsTimeout, sc.onSettingsTimer) |
| 856 | defer settingsTimer.Stop() |
| 857 | |
| 858 | loopNum := 0 |
| 859 | for { |
| 860 | loopNum++ |
| 861 | select { |
| 862 | case wr := <-sc.wantWriteFrameCh: |
| 863 | if se, ok := wr.write.(StreamError); ok { |
| 864 | sc.resetStream(se) |
| 865 | break |
| 866 | } |
| 867 | sc.writeFrame(wr) |
| 868 | case res := <-sc.wroteFrameCh: |
| 869 | sc.wroteFrame(res) |
| 870 | case res := <-sc.readFrameCh: |
| 871 | if !sc.processFrameFromReader(res) { |
| 872 | return |
| 873 | } |
| 874 | res.readMore() |
| 875 | if settingsTimer != nil { |
| 876 | settingsTimer.Stop() |
| 877 | settingsTimer = nil |
| 878 | } |
| 879 | case m := <-sc.bodyReadCh: |
| 880 | sc.noteBodyRead(m.st, m.n) |
| 881 | case msg := <-sc.serveMsgCh: |
| 882 | switch v := msg.(type) { |
| 883 | case func(int): |
| 884 | v(loopNum) // for testing |
| 885 | case *serverMessage: |
| 886 | switch v { |
| 887 | case settingsTimerMsg: |
| 888 | sc.logf("timeout waiting for SETTINGS frames from %v", sc.conn.RemoteAddr()) |
| 889 | return |
| 890 | case idleTimerMsg: |
| 891 | sc.vlogf("connection is idle") |
| 892 | sc.goAway(ErrCodeNo) |
| 893 | case shutdownTimerMsg: |
| 894 | sc.vlogf("GOAWAY close timer fired; closing conn from %v", sc.conn.RemoteAddr()) |
| 895 | return |
| 896 | case gracefulShutdownMsg: |
| 897 | sc.startGracefulShutdownInternal() |
| 898 | default: |
| 899 | panic("unknown timer") |
| 900 | } |
| 901 | case *startPushRequest: |
| 902 | sc.startPush(v) |
| 903 | default: |
| 904 | panic(fmt.Sprintf("unexpected type %T", v)) |
| 905 | } |
| 906 | } |
| 907 | |
| 908 | // If the peer is causing us to generate a lot of control frames, |
| 909 | // but not reading them from us, assume they are trying to make us |
| 910 | // run out of memory. |
| 911 | if sc.queuedControlFrames > sc.srv.maxQueuedControlFrames() { |
| 912 | sc.vlogf("http2: too many control frames in send queue, closing connection") |
| 913 | return |
| 914 | } |
| 915 | |
| 916 | // Start the shutdown timer after sending a GOAWAY. When sending GOAWAY |
| 917 | // with no error code (graceful shutdown), don't start the timer until |
| 918 | // all open streams have been completed. |
| 919 | sentGoAway := sc.inGoAway && !sc.needToSendGoAway && !sc.writingFrame |
| 920 | gracefulShutdownComplete := sc.goAwayCode == ErrCodeNo && sc.curOpenStreams() == 0 |
| 921 | if sentGoAway && sc.shutdownTimer == nil && (sc.goAwayCode != ErrCodeNo || gracefulShutdownComplete) { |
| 922 | sc.shutDownIn(goAwayTimeout) |
| 923 | } |
| 924 | } |
| 925 | } |
| 926 | |
| 927 | func (sc *serverConn) awaitGracefulShutdown(sharedCh <-chan struct{}, privateCh chan struct{}) { |
| 928 | select { |
| 929 | case <-sc.doneServing: |
| 930 | case <-sharedCh: |
| 931 | close(privateCh) |
| 932 | } |
| 933 | } |
| 934 | |
| 935 | type serverMessage int |
| 936 | |
| 937 | // Message values sent to serveMsgCh. |
| 938 | var ( |
| 939 | settingsTimerMsg = new(serverMessage) |
| 940 | idleTimerMsg = new(serverMessage) |
| 941 | shutdownTimerMsg = new(serverMessage) |
| 942 | gracefulShutdownMsg = new(serverMessage) |
| 943 | ) |
| 944 | |
| 945 | func (sc *serverConn) onSettingsTimer() { sc.sendServeMsg(settingsTimerMsg) } |
| 946 | func (sc *serverConn) onIdleTimer() { sc.sendServeMsg(idleTimerMsg) } |
| 947 | func (sc *serverConn) onShutdownTimer() { sc.sendServeMsg(shutdownTimerMsg) } |
| 948 | |
| 949 | func (sc *serverConn) sendServeMsg(msg interface{}) { |
| 950 | sc.serveG.checkNotOn() // NOT |
| 951 | select { |
| 952 | case sc.serveMsgCh <- msg: |
| 953 | case <-sc.doneServing: |
| 954 | } |
| 955 | } |
| 956 | |
| 957 | var errPrefaceTimeout = errors.New("timeout waiting for client preface") |
| 958 | |
| 959 | // readPreface reads the ClientPreface greeting from the peer or |
| 960 | // returns errPrefaceTimeout on timeout, or an error if the greeting |
| 961 | // is invalid. |
| 962 | func (sc *serverConn) readPreface() error { |
| 963 | errc := make(chan error, 1) |
| 964 | go func() { |
| 965 | // Read the client preface |
| 966 | buf := make([]byte, len(ClientPreface)) |
| 967 | if _, err := io.ReadFull(sc.conn, buf); err != nil { |
| 968 | errc <- err |
| 969 | } else if !bytes.Equal(buf, clientPreface) { |
| 970 | errc <- fmt.Errorf("bogus greeting %q", buf) |
| 971 | } else { |
| 972 | errc <- nil |
| 973 | } |
| 974 | }() |
| 975 | timer := time.NewTimer(prefaceTimeout) // TODO: configurable on *Server? |
| 976 | defer timer.Stop() |
| 977 | select { |
| 978 | case <-timer.C: |
| 979 | return errPrefaceTimeout |
| 980 | case err := <-errc: |
| 981 | if err == nil { |
| 982 | if VerboseLogs { |
| 983 | sc.vlogf("http2: server: client %v said hello", sc.conn.RemoteAddr()) |
| 984 | } |
| 985 | } |
| 986 | return err |
| 987 | } |
| 988 | } |
| 989 | |
| 990 | var errChanPool = sync.Pool{ |
| 991 | New: func() interface{} { return make(chan error, 1) }, |
| 992 | } |
| 993 | |
| 994 | var writeDataPool = sync.Pool{ |
| 995 | New: func() interface{} { return new(writeData) }, |
| 996 | } |
| 997 | |
| 998 | // writeDataFromHandler writes DATA response frames from a handler on |
| 999 | // the given stream. |
| 1000 | func (sc *serverConn) writeDataFromHandler(stream *stream, data []byte, endStream bool) error { |
| 1001 | ch := errChanPool.Get().(chan error) |
| 1002 | writeArg := writeDataPool.Get().(*writeData) |
| 1003 | *writeArg = writeData{stream.id, data, endStream} |
| 1004 | err := sc.writeFrameFromHandler(FrameWriteRequest{ |
| 1005 | write: writeArg, |
| 1006 | stream: stream, |
| 1007 | done: ch, |
| 1008 | }) |
| 1009 | if err != nil { |
| 1010 | return err |
| 1011 | } |
| 1012 | var frameWriteDone bool // the frame write is done (successfully or not) |
| 1013 | select { |
| 1014 | case err = <-ch: |
| 1015 | frameWriteDone = true |
| 1016 | case <-sc.doneServing: |
| 1017 | return errClientDisconnected |
| 1018 | case <-stream.cw: |
| 1019 | // If both ch and stream.cw were ready (as might |
| 1020 | // happen on the final Write after an http.Handler |
| 1021 | // ends), prefer the write result. Otherwise this |
| 1022 | // might just be us successfully closing the stream. |
| 1023 | // The writeFrameAsync and serve goroutines guarantee |
| 1024 | // that the ch send will happen before the stream.cw |
| 1025 | // close. |
| 1026 | select { |
| 1027 | case err = <-ch: |
| 1028 | frameWriteDone = true |
| 1029 | default: |
| 1030 | return errStreamClosed |
| 1031 | } |
| 1032 | } |
| 1033 | errChanPool.Put(ch) |
| 1034 | if frameWriteDone { |
| 1035 | writeDataPool.Put(writeArg) |
| 1036 | } |
| 1037 | return err |
| 1038 | } |
| 1039 | |
| 1040 | // writeFrameFromHandler sends wr to sc.wantWriteFrameCh, but aborts |
| 1041 | // if the connection has gone away. |
| 1042 | // |
| 1043 | // This must not be run from the serve goroutine itself, else it might |
| 1044 | // deadlock writing to sc.wantWriteFrameCh (which is only mildly |
| 1045 | // buffered and is read by serve itself). If you're on the serve |
| 1046 | // goroutine, call writeFrame instead. |
| 1047 | func (sc *serverConn) writeFrameFromHandler(wr FrameWriteRequest) error { |
| 1048 | sc.serveG.checkNotOn() // NOT |
| 1049 | select { |
| 1050 | case sc.wantWriteFrameCh <- wr: |
| 1051 | return nil |
| 1052 | case <-sc.doneServing: |
| 1053 | // Serve loop is gone. |
| 1054 | // Client has closed their connection to the server. |
| 1055 | return errClientDisconnected |
| 1056 | } |
| 1057 | } |
| 1058 | |
| 1059 | // writeFrame schedules a frame to write and sends it if there's nothing |
| 1060 | // already being written. |
| 1061 | // |
| 1062 | // There is no pushback here (the serve goroutine never blocks). It's |
| 1063 | // the http.Handlers that block, waiting for their previous frames to |
| 1064 | // make it onto the wire |
| 1065 | // |
| 1066 | // If you're not on the serve goroutine, use writeFrameFromHandler instead. |
| 1067 | func (sc *serverConn) writeFrame(wr FrameWriteRequest) { |
| 1068 | sc.serveG.check() |
| 1069 | |
| 1070 | // If true, wr will not be written and wr.done will not be signaled. |
| 1071 | var ignoreWrite bool |
| 1072 | |
| 1073 | // We are not allowed to write frames on closed streams. RFC 7540 Section |
| 1074 | // 5.1.1 says: "An endpoint MUST NOT send frames other than PRIORITY on |
| 1075 | // a closed stream." Our server never sends PRIORITY, so that exception |
| 1076 | // does not apply. |
| 1077 | // |
| 1078 | // The serverConn might close an open stream while the stream's handler |
| 1079 | // is still running. For example, the server might close a stream when it |
| 1080 | // receives bad data from the client. If this happens, the handler might |
| 1081 | // attempt to write a frame after the stream has been closed (since the |
| 1082 | // handler hasn't yet been notified of the close). In this case, we simply |
| 1083 | // ignore the frame. The handler will notice that the stream is closed when |
| 1084 | // it waits for the frame to be written. |
| 1085 | // |
| 1086 | // As an exception to this rule, we allow sending RST_STREAM after close. |
| 1087 | // This allows us to immediately reject new streams without tracking any |
| 1088 | // state for those streams (except for the queued RST_STREAM frame). This |
| 1089 | // may result in duplicate RST_STREAMs in some cases, but the client should |
| 1090 | // ignore those. |
| 1091 | if wr.StreamID() != 0 { |
| 1092 | _, isReset := wr.write.(StreamError) |
| 1093 | if state, _ := sc.state(wr.StreamID()); state == stateClosed && !isReset { |
| 1094 | ignoreWrite = true |
| 1095 | } |
| 1096 | } |
| 1097 | |
| 1098 | // Don't send a 100-continue response if we've already sent headers. |
| 1099 | // See golang.org/issue/14030. |
| 1100 | switch wr.write.(type) { |
| 1101 | case *writeResHeaders: |
| 1102 | wr.stream.wroteHeaders = true |
| 1103 | case write100ContinueHeadersFrame: |
| 1104 | if wr.stream.wroteHeaders { |
| 1105 | // We do not need to notify wr.done because this frame is |
| 1106 | // never written with wr.done != nil. |
| 1107 | if wr.done != nil { |
| 1108 | panic("wr.done != nil for write100ContinueHeadersFrame") |
| 1109 | } |
| 1110 | ignoreWrite = true |
| 1111 | } |
| 1112 | } |
| 1113 | |
| 1114 | if !ignoreWrite { |
| 1115 | if wr.isControl() { |
| 1116 | sc.queuedControlFrames++ |
| 1117 | // For extra safety, detect wraparounds, which should not happen, |
| 1118 | // and pull the plug. |
| 1119 | if sc.queuedControlFrames < 0 { |
| 1120 | sc.conn.Close() |
| 1121 | } |
| 1122 | } |
| 1123 | sc.writeSched.Push(wr) |
| 1124 | } |
| 1125 | sc.scheduleFrameWrite() |
| 1126 | } |
| 1127 | |
| 1128 | // startFrameWrite starts a goroutine to write wr (in a separate |
| 1129 | // goroutine since that might block on the network), and updates the |
| 1130 | // serve goroutine's state about the world, updated from info in wr. |
| 1131 | func (sc *serverConn) startFrameWrite(wr FrameWriteRequest) { |
| 1132 | sc.serveG.check() |
| 1133 | if sc.writingFrame { |
| 1134 | panic("internal error: can only be writing one frame at a time") |
| 1135 | } |
| 1136 | |
| 1137 | st := wr.stream |
| 1138 | if st != nil { |
| 1139 | switch st.state { |
| 1140 | case stateHalfClosedLocal: |
| 1141 | switch wr.write.(type) { |
| 1142 | case StreamError, handlerPanicRST, writeWindowUpdate: |
| 1143 | // RFC 7540 Section 5.1 allows sending RST_STREAM, PRIORITY, and WINDOW_UPDATE |
| 1144 | // in this state. (We never send PRIORITY from the server, so that is not checked.) |
| 1145 | default: |
| 1146 | panic(fmt.Sprintf("internal error: attempt to send frame on a half-closed-local stream: %v", wr)) |
| 1147 | } |
| 1148 | case stateClosed: |
| 1149 | panic(fmt.Sprintf("internal error: attempt to send frame on a closed stream: %v", wr)) |
| 1150 | } |
| 1151 | } |
| 1152 | if wpp, ok := wr.write.(*writePushPromise); ok { |
| 1153 | var err error |
| 1154 | wpp.promisedID, err = wpp.allocatePromisedID() |
| 1155 | if err != nil { |
| 1156 | sc.writingFrameAsync = false |
| 1157 | wr.replyToWriter(err) |
| 1158 | return |
| 1159 | } |
| 1160 | } |
| 1161 | |
| 1162 | sc.writingFrame = true |
| 1163 | sc.needsFrameFlush = true |
| 1164 | if wr.write.staysWithinBuffer(sc.bw.Available()) { |
| 1165 | sc.writingFrameAsync = false |
| 1166 | err := wr.write.writeFrame(sc) |
| 1167 | sc.wroteFrame(frameWriteResult{wr, err}) |
| 1168 | } else { |
| 1169 | sc.writingFrameAsync = true |
| 1170 | go sc.writeFrameAsync(wr) |
| 1171 | } |
| 1172 | } |
| 1173 | |
| 1174 | // errHandlerPanicked is the error given to any callers blocked in a read from |
| 1175 | // Request.Body when the main goroutine panics. Since most handlers read in the |
| 1176 | // main ServeHTTP goroutine, this will show up rarely. |
| 1177 | var errHandlerPanicked = errors.New("http2: handler panicked") |
| 1178 | |
| 1179 | // wroteFrame is called on the serve goroutine with the result of |
| 1180 | // whatever happened on writeFrameAsync. |
| 1181 | func (sc *serverConn) wroteFrame(res frameWriteResult) { |
| 1182 | sc.serveG.check() |
| 1183 | if !sc.writingFrame { |
| 1184 | panic("internal error: expected to be already writing a frame") |
| 1185 | } |
| 1186 | sc.writingFrame = false |
| 1187 | sc.writingFrameAsync = false |
| 1188 | |
| 1189 | wr := res.wr |
| 1190 | |
| 1191 | if writeEndsStream(wr.write) { |
| 1192 | st := wr.stream |
| 1193 | if st == nil { |
| 1194 | panic("internal error: expecting non-nil stream") |
| 1195 | } |
| 1196 | switch st.state { |
| 1197 | case stateOpen: |
| 1198 | // Here we would go to stateHalfClosedLocal in |
| 1199 | // theory, but since our handler is done and |
| 1200 | // the net/http package provides no mechanism |
| 1201 | // for closing a ResponseWriter while still |
| 1202 | // reading data (see possible TODO at top of |
| 1203 | // this file), we go into closed state here |
| 1204 | // anyway, after telling the peer we're |
| 1205 | // hanging up on them. We'll transition to |
| 1206 | // stateClosed after the RST_STREAM frame is |
| 1207 | // written. |
| 1208 | st.state = stateHalfClosedLocal |
| 1209 | // Section 8.1: a server MAY request that the client abort |
| 1210 | // transmission of a request without error by sending a |
| 1211 | // RST_STREAM with an error code of NO_ERROR after sending |
| 1212 | // a complete response. |
| 1213 | sc.resetStream(streamError(st.id, ErrCodeNo)) |
| 1214 | case stateHalfClosedRemote: |
| 1215 | sc.closeStream(st, errHandlerComplete) |
| 1216 | } |
| 1217 | } else { |
| 1218 | switch v := wr.write.(type) { |
| 1219 | case StreamError: |
| 1220 | // st may be unknown if the RST_STREAM was generated to reject bad input. |
| 1221 | if st, ok := sc.streams[v.StreamID]; ok { |
| 1222 | sc.closeStream(st, v) |
| 1223 | } |
| 1224 | case handlerPanicRST: |
| 1225 | sc.closeStream(wr.stream, errHandlerPanicked) |
| 1226 | } |
| 1227 | } |
| 1228 | |
| 1229 | // Reply (if requested) to unblock the ServeHTTP goroutine. |
| 1230 | wr.replyToWriter(res.err) |
| 1231 | |
| 1232 | sc.scheduleFrameWrite() |
| 1233 | } |
| 1234 | |
| 1235 | // scheduleFrameWrite tickles the frame writing scheduler. |
| 1236 | // |
| 1237 | // If a frame is already being written, nothing happens. This will be called again |
| 1238 | // when the frame is done being written. |
| 1239 | // |
| 1240 | // If a frame isn't being written and we need to send one, the best frame |
| 1241 | // to send is selected by writeSched. |
| 1242 | // |
| 1243 | // If a frame isn't being written and there's nothing else to send, we |
| 1244 | // flush the write buffer. |
| 1245 | func (sc *serverConn) scheduleFrameWrite() { |
| 1246 | sc.serveG.check() |
| 1247 | if sc.writingFrame || sc.inFrameScheduleLoop { |
| 1248 | return |
| 1249 | } |
| 1250 | sc.inFrameScheduleLoop = true |
| 1251 | for !sc.writingFrameAsync { |
| 1252 | if sc.needToSendGoAway { |
| 1253 | sc.needToSendGoAway = false |
| 1254 | sc.startFrameWrite(FrameWriteRequest{ |
| 1255 | write: &writeGoAway{ |
| 1256 | maxStreamID: sc.maxClientStreamID, |
| 1257 | code: sc.goAwayCode, |
| 1258 | }, |
| 1259 | }) |
| 1260 | continue |
| 1261 | } |
| 1262 | if sc.needToSendSettingsAck { |
| 1263 | sc.needToSendSettingsAck = false |
| 1264 | sc.startFrameWrite(FrameWriteRequest{write: writeSettingsAck{}}) |
| 1265 | continue |
| 1266 | } |
| 1267 | if !sc.inGoAway || sc.goAwayCode == ErrCodeNo { |
| 1268 | if wr, ok := sc.writeSched.Pop(); ok { |
| 1269 | if wr.isControl() { |
| 1270 | sc.queuedControlFrames-- |
| 1271 | } |
| 1272 | sc.startFrameWrite(wr) |
| 1273 | continue |
| 1274 | } |
| 1275 | } |
| 1276 | if sc.needsFrameFlush { |
| 1277 | sc.startFrameWrite(FrameWriteRequest{write: flushFrameWriter{}}) |
| 1278 | sc.needsFrameFlush = false // after startFrameWrite, since it sets this true |
| 1279 | continue |
| 1280 | } |
| 1281 | break |
| 1282 | } |
| 1283 | sc.inFrameScheduleLoop = false |
| 1284 | } |
| 1285 | |
| 1286 | // startGracefulShutdown gracefully shuts down a connection. This |
| 1287 | // sends GOAWAY with ErrCodeNo to tell the client we're gracefully |
| 1288 | // shutting down. The connection isn't closed until all current |
| 1289 | // streams are done. |
| 1290 | // |
| 1291 | // startGracefulShutdown returns immediately; it does not wait until |
| 1292 | // the connection has shut down. |
| 1293 | func (sc *serverConn) startGracefulShutdown() { |
| 1294 | sc.serveG.checkNotOn() // NOT |
| 1295 | sc.shutdownOnce.Do(func() { sc.sendServeMsg(gracefulShutdownMsg) }) |
| 1296 | } |
| 1297 | |
| 1298 | // After sending GOAWAY, the connection will close after goAwayTimeout. |
| 1299 | // If we close the connection immediately after sending GOAWAY, there may |
| 1300 | // be unsent data in our kernel receive buffer, which will cause the kernel |
| 1301 | // to send a TCP RST on close() instead of a FIN. This RST will abort the |
| 1302 | // connection immediately, whether or not the client had received the GOAWAY. |
| 1303 | // |
| 1304 | // Ideally we should delay for at least 1 RTT + epsilon so the client has |
| 1305 | // a chance to read the GOAWAY and stop sending messages. Measuring RTT |
| 1306 | // is hard, so we approximate with 1 second. See golang.org/issue/18701. |
| 1307 | // |
| 1308 | // This is a var so it can be shorter in tests, where all requests uses the |
| 1309 | // loopback interface making the expected RTT very small. |
| 1310 | // |
| 1311 | // TODO: configurable? |
| 1312 | var goAwayTimeout = 1 * time.Second |
| 1313 | |
| 1314 | func (sc *serverConn) startGracefulShutdownInternal() { |
| 1315 | sc.goAway(ErrCodeNo) |
| 1316 | } |
| 1317 | |
| 1318 | func (sc *serverConn) goAway(code ErrCode) { |
| 1319 | sc.serveG.check() |
| 1320 | if sc.inGoAway { |
| 1321 | return |
| 1322 | } |
| 1323 | sc.inGoAway = true |
| 1324 | sc.needToSendGoAway = true |
| 1325 | sc.goAwayCode = code |
| 1326 | sc.scheduleFrameWrite() |
| 1327 | } |
| 1328 | |
| 1329 | func (sc *serverConn) shutDownIn(d time.Duration) { |
| 1330 | sc.serveG.check() |
| 1331 | sc.shutdownTimer = time.AfterFunc(d, sc.onShutdownTimer) |
| 1332 | } |
| 1333 | |
| 1334 | func (sc *serverConn) resetStream(se StreamError) { |
| 1335 | sc.serveG.check() |
| 1336 | sc.writeFrame(FrameWriteRequest{write: se}) |
| 1337 | if st, ok := sc.streams[se.StreamID]; ok { |
| 1338 | st.resetQueued = true |
| 1339 | } |
| 1340 | } |
| 1341 | |
| 1342 | // processFrameFromReader processes the serve loop's read from readFrameCh from the |
| 1343 | // frame-reading goroutine. |
| 1344 | // processFrameFromReader returns whether the connection should be kept open. |
| 1345 | func (sc *serverConn) processFrameFromReader(res readFrameResult) bool { |
| 1346 | sc.serveG.check() |
| 1347 | err := res.err |
| 1348 | if err != nil { |
| 1349 | if err == ErrFrameTooLarge { |
| 1350 | sc.goAway(ErrCodeFrameSize) |
| 1351 | return true // goAway will close the loop |
| 1352 | } |
| 1353 | clientGone := err == io.EOF || err == io.ErrUnexpectedEOF || isClosedConnError(err) |
| 1354 | if clientGone { |
| 1355 | // TODO: could we also get into this state if |
| 1356 | // the peer does a half close |
| 1357 | // (e.g. CloseWrite) because they're done |
| 1358 | // sending frames but they're still wanting |
| 1359 | // our open replies? Investigate. |
| 1360 | // TODO: add CloseWrite to crypto/tls.Conn first |
| 1361 | // so we have a way to test this? I suppose |
| 1362 | // just for testing we could have a non-TLS mode. |
| 1363 | return false |
| 1364 | } |
| 1365 | } else { |
| 1366 | f := res.f |
| 1367 | if VerboseLogs { |
| 1368 | sc.vlogf("http2: server read frame %v", summarizeFrame(f)) |
| 1369 | } |
| 1370 | err = sc.processFrame(f) |
| 1371 | if err == nil { |
| 1372 | return true |
| 1373 | } |
| 1374 | } |
| 1375 | |
| 1376 | switch ev := err.(type) { |
| 1377 | case StreamError: |
| 1378 | sc.resetStream(ev) |
| 1379 | return true |
| 1380 | case goAwayFlowError: |
| 1381 | sc.goAway(ErrCodeFlowControl) |
| 1382 | return true |
| 1383 | case ConnectionError: |
| 1384 | sc.logf("http2: server connection error from %v: %v", sc.conn.RemoteAddr(), ev) |
| 1385 | sc.goAway(ErrCode(ev)) |
| 1386 | return true // goAway will handle shutdown |
| 1387 | default: |
| 1388 | if res.err != nil { |
| 1389 | sc.vlogf("http2: server closing client connection; error reading frame from client %s: %v", sc.conn.RemoteAddr(), err) |
| 1390 | } else { |
| 1391 | sc.logf("http2: server closing client connection: %v", err) |
| 1392 | } |
| 1393 | return false |
| 1394 | } |
| 1395 | } |
| 1396 | |
| 1397 | func (sc *serverConn) processFrame(f Frame) error { |
| 1398 | sc.serveG.check() |
| 1399 | |
| 1400 | // First frame received must be SETTINGS. |
| 1401 | if !sc.sawFirstSettings { |
| 1402 | if _, ok := f.(*SettingsFrame); !ok { |
| 1403 | return ConnectionError(ErrCodeProtocol) |
| 1404 | } |
| 1405 | sc.sawFirstSettings = true |
| 1406 | } |
| 1407 | |
| 1408 | switch f := f.(type) { |
| 1409 | case *SettingsFrame: |
| 1410 | return sc.processSettings(f) |
| 1411 | case *MetaHeadersFrame: |
| 1412 | return sc.processHeaders(f) |
| 1413 | case *WindowUpdateFrame: |
| 1414 | return sc.processWindowUpdate(f) |
| 1415 | case *PingFrame: |
| 1416 | return sc.processPing(f) |
| 1417 | case *DataFrame: |
| 1418 | return sc.processData(f) |
| 1419 | case *RSTStreamFrame: |
| 1420 | return sc.processResetStream(f) |
| 1421 | case *PriorityFrame: |
| 1422 | return sc.processPriority(f) |
| 1423 | case *GoAwayFrame: |
| 1424 | return sc.processGoAway(f) |
| 1425 | case *PushPromiseFrame: |
| 1426 | // A client cannot push. Thus, servers MUST treat the receipt of a PUSH_PROMISE |
| 1427 | // frame as a connection error (Section 5.4.1) of type PROTOCOL_ERROR. |
| 1428 | return ConnectionError(ErrCodeProtocol) |
| 1429 | default: |
| 1430 | sc.vlogf("http2: server ignoring frame: %v", f.Header()) |
| 1431 | return nil |
| 1432 | } |
| 1433 | } |
| 1434 | |
| 1435 | func (sc *serverConn) processPing(f *PingFrame) error { |
| 1436 | sc.serveG.check() |
| 1437 | if f.IsAck() { |
| 1438 | // 6.7 PING: " An endpoint MUST NOT respond to PING frames |
| 1439 | // containing this flag." |
| 1440 | return nil |
| 1441 | } |
| 1442 | if f.StreamID != 0 { |
| 1443 | // "PING frames are not associated with any individual |
| 1444 | // stream. If a PING frame is received with a stream |
| 1445 | // identifier field value other than 0x0, the recipient MUST |
| 1446 | // respond with a connection error (Section 5.4.1) of type |
| 1447 | // PROTOCOL_ERROR." |
| 1448 | return ConnectionError(ErrCodeProtocol) |
| 1449 | } |
| 1450 | if sc.inGoAway && sc.goAwayCode != ErrCodeNo { |
| 1451 | return nil |
| 1452 | } |
| 1453 | sc.writeFrame(FrameWriteRequest{write: writePingAck{f}}) |
| 1454 | return nil |
| 1455 | } |
| 1456 | |
| 1457 | func (sc *serverConn) processWindowUpdate(f *WindowUpdateFrame) error { |
| 1458 | sc.serveG.check() |
| 1459 | switch { |
| 1460 | case f.StreamID != 0: // stream-level flow control |
| 1461 | state, st := sc.state(f.StreamID) |
| 1462 | if state == stateIdle { |
| 1463 | // Section 5.1: "Receiving any frame other than HEADERS |
| 1464 | // or PRIORITY on a stream in this state MUST be |
| 1465 | // treated as a connection error (Section 5.4.1) of |
| 1466 | // type PROTOCOL_ERROR." |
| 1467 | return ConnectionError(ErrCodeProtocol) |
| 1468 | } |
| 1469 | if st == nil { |
| 1470 | // "WINDOW_UPDATE can be sent by a peer that has sent a |
| 1471 | // frame bearing the END_STREAM flag. This means that a |
| 1472 | // receiver could receive a WINDOW_UPDATE frame on a "half |
| 1473 | // closed (remote)" or "closed" stream. A receiver MUST |
| 1474 | // NOT treat this as an error, see Section 5.1." |
| 1475 | return nil |
| 1476 | } |
| 1477 | if !st.flow.add(int32(f.Increment)) { |
| 1478 | return streamError(f.StreamID, ErrCodeFlowControl) |
| 1479 | } |
| 1480 | default: // connection-level flow control |
| 1481 | if !sc.flow.add(int32(f.Increment)) { |
| 1482 | return goAwayFlowError{} |
| 1483 | } |
| 1484 | } |
| 1485 | sc.scheduleFrameWrite() |
| 1486 | return nil |
| 1487 | } |
| 1488 | |
| 1489 | func (sc *serverConn) processResetStream(f *RSTStreamFrame) error { |
| 1490 | sc.serveG.check() |
| 1491 | |
| 1492 | state, st := sc.state(f.StreamID) |
| 1493 | if state == stateIdle { |
| 1494 | // 6.4 "RST_STREAM frames MUST NOT be sent for a |
| 1495 | // stream in the "idle" state. If a RST_STREAM frame |
| 1496 | // identifying an idle stream is received, the |
| 1497 | // recipient MUST treat this as a connection error |
| 1498 | // (Section 5.4.1) of type PROTOCOL_ERROR. |
| 1499 | return ConnectionError(ErrCodeProtocol) |
| 1500 | } |
| 1501 | if st != nil { |
| 1502 | st.cancelCtx() |
| 1503 | sc.closeStream(st, streamError(f.StreamID, f.ErrCode)) |
| 1504 | } |
| 1505 | return nil |
| 1506 | } |
| 1507 | |
| 1508 | func (sc *serverConn) closeStream(st *stream, err error) { |
| 1509 | sc.serveG.check() |
| 1510 | if st.state == stateIdle || st.state == stateClosed { |
| 1511 | panic(fmt.Sprintf("invariant; can't close stream in state %v", st.state)) |
| 1512 | } |
| 1513 | st.state = stateClosed |
| 1514 | if st.writeDeadline != nil { |
| 1515 | st.writeDeadline.Stop() |
| 1516 | } |
| 1517 | if st.isPushed() { |
| 1518 | sc.curPushedStreams-- |
| 1519 | } else { |
| 1520 | sc.curClientStreams-- |
| 1521 | } |
| 1522 | delete(sc.streams, st.id) |
| 1523 | if len(sc.streams) == 0 { |
| 1524 | sc.setConnState(http.StateIdle) |
| 1525 | if sc.srv.IdleTimeout != 0 { |
| 1526 | sc.idleTimer.Reset(sc.srv.IdleTimeout) |
| 1527 | } |
| 1528 | if h1ServerKeepAlivesDisabled(sc.hs) { |
| 1529 | sc.startGracefulShutdownInternal() |
| 1530 | } |
| 1531 | } |
| 1532 | if p := st.body; p != nil { |
| 1533 | // Return any buffered unread bytes worth of conn-level flow control. |
| 1534 | // See golang.org/issue/16481 |
| 1535 | sc.sendWindowUpdate(nil, p.Len()) |
| 1536 | |
| 1537 | p.CloseWithError(err) |
| 1538 | } |
| 1539 | st.cw.Close() // signals Handler's CloseNotifier, unblocks writes, etc |
| 1540 | sc.writeSched.CloseStream(st.id) |
| 1541 | } |
| 1542 | |
| 1543 | func (sc *serverConn) processSettings(f *SettingsFrame) error { |
| 1544 | sc.serveG.check() |
| 1545 | if f.IsAck() { |
| 1546 | sc.unackedSettings-- |
| 1547 | if sc.unackedSettings < 0 { |
| 1548 | // Why is the peer ACKing settings we never sent? |
| 1549 | // The spec doesn't mention this case, but |
| 1550 | // hang up on them anyway. |
| 1551 | return ConnectionError(ErrCodeProtocol) |
| 1552 | } |
| 1553 | return nil |
| 1554 | } |
| 1555 | if f.NumSettings() > 100 || f.HasDuplicates() { |
| 1556 | // This isn't actually in the spec, but hang up on |
| 1557 | // suspiciously large settings frames or those with |
| 1558 | // duplicate entries. |
| 1559 | return ConnectionError(ErrCodeProtocol) |
| 1560 | } |
| 1561 | if err := f.ForeachSetting(sc.processSetting); err != nil { |
| 1562 | return err |
| 1563 | } |
| 1564 | // TODO: judging by RFC 7540, Section 6.5.3 each SETTINGS frame should be |
| 1565 | // acknowledged individually, even if multiple are received before the ACK. |
| 1566 | sc.needToSendSettingsAck = true |
| 1567 | sc.scheduleFrameWrite() |
| 1568 | return nil |
| 1569 | } |
| 1570 | |
| 1571 | func (sc *serverConn) processSetting(s Setting) error { |
| 1572 | sc.serveG.check() |
| 1573 | if err := s.Valid(); err != nil { |
| 1574 | return err |
| 1575 | } |
| 1576 | if VerboseLogs { |
| 1577 | sc.vlogf("http2: server processing setting %v", s) |
| 1578 | } |
| 1579 | switch s.ID { |
| 1580 | case SettingHeaderTableSize: |
| 1581 | sc.headerTableSize = s.Val |
| 1582 | sc.hpackEncoder.SetMaxDynamicTableSize(s.Val) |
| 1583 | case SettingEnablePush: |
| 1584 | sc.pushEnabled = s.Val != 0 |
| 1585 | case SettingMaxConcurrentStreams: |
| 1586 | sc.clientMaxStreams = s.Val |
| 1587 | case SettingInitialWindowSize: |
| 1588 | return sc.processSettingInitialWindowSize(s.Val) |
| 1589 | case SettingMaxFrameSize: |
| 1590 | sc.maxFrameSize = int32(s.Val) // the maximum valid s.Val is < 2^31 |
| 1591 | case SettingMaxHeaderListSize: |
| 1592 | sc.peerMaxHeaderListSize = s.Val |
| 1593 | default: |
| 1594 | // Unknown setting: "An endpoint that receives a SETTINGS |
| 1595 | // frame with any unknown or unsupported identifier MUST |
| 1596 | // ignore that setting." |
| 1597 | if VerboseLogs { |
| 1598 | sc.vlogf("http2: server ignoring unknown setting %v", s) |
| 1599 | } |
| 1600 | } |
| 1601 | return nil |
| 1602 | } |
| 1603 | |
| 1604 | func (sc *serverConn) processSettingInitialWindowSize(val uint32) error { |
| 1605 | sc.serveG.check() |
| 1606 | // Note: val already validated to be within range by |
| 1607 | // processSetting's Valid call. |
| 1608 | |
| 1609 | // "A SETTINGS frame can alter the initial flow control window |
| 1610 | // size for all current streams. When the value of |
| 1611 | // SETTINGS_INITIAL_WINDOW_SIZE changes, a receiver MUST |
| 1612 | // adjust the size of all stream flow control windows that it |
| 1613 | // maintains by the difference between the new value and the |
| 1614 | // old value." |
| 1615 | old := sc.initialStreamSendWindowSize |
| 1616 | sc.initialStreamSendWindowSize = int32(val) |
| 1617 | growth := int32(val) - old // may be negative |
| 1618 | for _, st := range sc.streams { |
| 1619 | if !st.flow.add(growth) { |
| 1620 | // 6.9.2 Initial Flow Control Window Size |
| 1621 | // "An endpoint MUST treat a change to |
| 1622 | // SETTINGS_INITIAL_WINDOW_SIZE that causes any flow |
| 1623 | // control window to exceed the maximum size as a |
| 1624 | // connection error (Section 5.4.1) of type |
| 1625 | // FLOW_CONTROL_ERROR." |
| 1626 | return ConnectionError(ErrCodeFlowControl) |
| 1627 | } |
| 1628 | } |
| 1629 | return nil |
| 1630 | } |
| 1631 | |
| 1632 | func (sc *serverConn) processData(f *DataFrame) error { |
| 1633 | sc.serveG.check() |
| 1634 | if sc.inGoAway && sc.goAwayCode != ErrCodeNo { |
| 1635 | return nil |
| 1636 | } |
| 1637 | data := f.Data() |
| 1638 | |
| 1639 | // "If a DATA frame is received whose stream is not in "open" |
| 1640 | // or "half closed (local)" state, the recipient MUST respond |
| 1641 | // with a stream error (Section 5.4.2) of type STREAM_CLOSED." |
| 1642 | id := f.Header().StreamID |
| 1643 | state, st := sc.state(id) |
| 1644 | if id == 0 || state == stateIdle { |
| 1645 | // Section 5.1: "Receiving any frame other than HEADERS |
| 1646 | // or PRIORITY on a stream in this state MUST be |
| 1647 | // treated as a connection error (Section 5.4.1) of |
| 1648 | // type PROTOCOL_ERROR." |
| 1649 | return ConnectionError(ErrCodeProtocol) |
| 1650 | } |
| 1651 | if st == nil || state != stateOpen || st.gotTrailerHeader || st.resetQueued { |
| 1652 | // This includes sending a RST_STREAM if the stream is |
| 1653 | // in stateHalfClosedLocal (which currently means that |
| 1654 | // the http.Handler returned, so it's done reading & |
| 1655 | // done writing). Try to stop the client from sending |
| 1656 | // more DATA. |
| 1657 | |
| 1658 | // But still enforce their connection-level flow control, |
| 1659 | // and return any flow control bytes since we're not going |
| 1660 | // to consume them. |
| 1661 | if sc.inflow.available() < int32(f.Length) { |
| 1662 | return streamError(id, ErrCodeFlowControl) |
| 1663 | } |
| 1664 | // Deduct the flow control from inflow, since we're |
| 1665 | // going to immediately add it back in |
| 1666 | // sendWindowUpdate, which also schedules sending the |
| 1667 | // frames. |
| 1668 | sc.inflow.take(int32(f.Length)) |
| 1669 | sc.sendWindowUpdate(nil, int(f.Length)) // conn-level |
| 1670 | |
| 1671 | if st != nil && st.resetQueued { |
| 1672 | // Already have a stream error in flight. Don't send another. |
| 1673 | return nil |
| 1674 | } |
| 1675 | return streamError(id, ErrCodeStreamClosed) |
| 1676 | } |
| 1677 | if st.body == nil { |
| 1678 | panic("internal error: should have a body in this state") |
| 1679 | } |
| 1680 | |
| 1681 | // Sender sending more than they'd declared? |
| 1682 | if st.declBodyBytes != -1 && st.bodyBytes+int64(len(data)) > st.declBodyBytes { |
| 1683 | st.body.CloseWithError(fmt.Errorf("sender tried to send more than declared Content-Length of %d bytes", st.declBodyBytes)) |
| 1684 | // RFC 7540, sec 8.1.2.6: A request or response is also malformed if the |
| 1685 | // value of a content-length header field does not equal the sum of the |
| 1686 | // DATA frame payload lengths that form the body. |
| 1687 | return streamError(id, ErrCodeProtocol) |
| 1688 | } |
| 1689 | if f.Length > 0 { |
| 1690 | // Check whether the client has flow control quota. |
| 1691 | if st.inflow.available() < int32(f.Length) { |
| 1692 | return streamError(id, ErrCodeFlowControl) |
| 1693 | } |
| 1694 | st.inflow.take(int32(f.Length)) |
| 1695 | |
| 1696 | if len(data) > 0 { |
| 1697 | wrote, err := st.body.Write(data) |
| 1698 | if err != nil { |
| 1699 | return streamError(id, ErrCodeStreamClosed) |
| 1700 | } |
| 1701 | if wrote != len(data) { |
| 1702 | panic("internal error: bad Writer") |
| 1703 | } |
| 1704 | st.bodyBytes += int64(len(data)) |
| 1705 | } |
| 1706 | |
| 1707 | // Return any padded flow control now, since we won't |
| 1708 | // refund it later on body reads. |
| 1709 | if pad := int32(f.Length) - int32(len(data)); pad > 0 { |
| 1710 | sc.sendWindowUpdate32(nil, pad) |
| 1711 | sc.sendWindowUpdate32(st, pad) |
| 1712 | } |
| 1713 | } |
| 1714 | if f.StreamEnded() { |
| 1715 | st.endStream() |
| 1716 | } |
| 1717 | return nil |
| 1718 | } |
| 1719 | |
| 1720 | func (sc *serverConn) processGoAway(f *GoAwayFrame) error { |
| 1721 | sc.serveG.check() |
| 1722 | if f.ErrCode != ErrCodeNo { |
| 1723 | sc.logf("http2: received GOAWAY %+v, starting graceful shutdown", f) |
| 1724 | } else { |
| 1725 | sc.vlogf("http2: received GOAWAY %+v, starting graceful shutdown", f) |
| 1726 | } |
| 1727 | sc.startGracefulShutdownInternal() |
| 1728 | // http://tools.ietf.org/html/rfc7540#section-6.8 |
| 1729 | // We should not create any new streams, which means we should disable push. |
| 1730 | sc.pushEnabled = false |
| 1731 | return nil |
| 1732 | } |
| 1733 | |
| 1734 | // isPushed reports whether the stream is server-initiated. |
| 1735 | func (st *stream) isPushed() bool { |
| 1736 | return st.id%2 == 0 |
| 1737 | } |
| 1738 | |
| 1739 | // endStream closes a Request.Body's pipe. It is called when a DATA |
| 1740 | // frame says a request body is over (or after trailers). |
| 1741 | func (st *stream) endStream() { |
| 1742 | sc := st.sc |
| 1743 | sc.serveG.check() |
| 1744 | |
| 1745 | if st.declBodyBytes != -1 && st.declBodyBytes != st.bodyBytes { |
| 1746 | st.body.CloseWithError(fmt.Errorf("request declared a Content-Length of %d but only wrote %d bytes", |
| 1747 | st.declBodyBytes, st.bodyBytes)) |
| 1748 | } else { |
| 1749 | st.body.closeWithErrorAndCode(io.EOF, st.copyTrailersToHandlerRequest) |
| 1750 | st.body.CloseWithError(io.EOF) |
| 1751 | } |
| 1752 | st.state = stateHalfClosedRemote |
| 1753 | } |
| 1754 | |
| 1755 | // copyTrailersToHandlerRequest is run in the Handler's goroutine in |
| 1756 | // its Request.Body.Read just before it gets io.EOF. |
| 1757 | func (st *stream) copyTrailersToHandlerRequest() { |
| 1758 | for k, vv := range st.trailer { |
| 1759 | if _, ok := st.reqTrailer[k]; ok { |
| 1760 | // Only copy it over it was pre-declared. |
| 1761 | st.reqTrailer[k] = vv |
| 1762 | } |
| 1763 | } |
| 1764 | } |
| 1765 | |
| 1766 | // onWriteTimeout is run on its own goroutine (from time.AfterFunc) |
| 1767 | // when the stream's WriteTimeout has fired. |
| 1768 | func (st *stream) onWriteTimeout() { |
| 1769 | st.sc.writeFrameFromHandler(FrameWriteRequest{write: streamError(st.id, ErrCodeInternal)}) |
| 1770 | } |
| 1771 | |
| 1772 | func (sc *serverConn) processHeaders(f *MetaHeadersFrame) error { |
| 1773 | sc.serveG.check() |
| 1774 | id := f.StreamID |
| 1775 | if sc.inGoAway { |
| 1776 | // Ignore. |
| 1777 | return nil |
| 1778 | } |
| 1779 | // http://tools.ietf.org/html/rfc7540#section-5.1.1 |
| 1780 | // Streams initiated by a client MUST use odd-numbered stream |
| 1781 | // identifiers. [...] An endpoint that receives an unexpected |
| 1782 | // stream identifier MUST respond with a connection error |
| 1783 | // (Section 5.4.1) of type PROTOCOL_ERROR. |
| 1784 | if id%2 != 1 { |
| 1785 | return ConnectionError(ErrCodeProtocol) |
| 1786 | } |
| 1787 | // A HEADERS frame can be used to create a new stream or |
| 1788 | // send a trailer for an open one. If we already have a stream |
| 1789 | // open, let it process its own HEADERS frame (trailers at this |
| 1790 | // point, if it's valid). |
| 1791 | if st := sc.streams[f.StreamID]; st != nil { |
| 1792 | if st.resetQueued { |
| 1793 | // We're sending RST_STREAM to close the stream, so don't bother |
| 1794 | // processing this frame. |
| 1795 | return nil |
| 1796 | } |
| 1797 | // RFC 7540, sec 5.1: If an endpoint receives additional frames, other than |
| 1798 | // WINDOW_UPDATE, PRIORITY, or RST_STREAM, for a stream that is in |
| 1799 | // this state, it MUST respond with a stream error (Section 5.4.2) of |
| 1800 | // type STREAM_CLOSED. |
| 1801 | if st.state == stateHalfClosedRemote { |
| 1802 | return streamError(id, ErrCodeStreamClosed) |
| 1803 | } |
| 1804 | return st.processTrailerHeaders(f) |
| 1805 | } |
| 1806 | |
| 1807 | // [...] The identifier of a newly established stream MUST be |
| 1808 | // numerically greater than all streams that the initiating |
| 1809 | // endpoint has opened or reserved. [...] An endpoint that |
| 1810 | // receives an unexpected stream identifier MUST respond with |
| 1811 | // a connection error (Section 5.4.1) of type PROTOCOL_ERROR. |
| 1812 | if id <= sc.maxClientStreamID { |
| 1813 | return ConnectionError(ErrCodeProtocol) |
| 1814 | } |
| 1815 | sc.maxClientStreamID = id |
| 1816 | |
| 1817 | if sc.idleTimer != nil { |
| 1818 | sc.idleTimer.Stop() |
| 1819 | } |
| 1820 | |
| 1821 | // http://tools.ietf.org/html/rfc7540#section-5.1.2 |
| 1822 | // [...] Endpoints MUST NOT exceed the limit set by their peer. An |
| 1823 | // endpoint that receives a HEADERS frame that causes their |
| 1824 | // advertised concurrent stream limit to be exceeded MUST treat |
| 1825 | // this as a stream error (Section 5.4.2) of type PROTOCOL_ERROR |
| 1826 | // or REFUSED_STREAM. |
| 1827 | if sc.curClientStreams+1 > sc.advMaxStreams { |
| 1828 | if sc.unackedSettings == 0 { |
| 1829 | // They should know better. |
| 1830 | return streamError(id, ErrCodeProtocol) |
| 1831 | } |
| 1832 | // Assume it's a network race, where they just haven't |
| 1833 | // received our last SETTINGS update. But actually |
| 1834 | // this can't happen yet, because we don't yet provide |
| 1835 | // a way for users to adjust server parameters at |
| 1836 | // runtime. |
| 1837 | return streamError(id, ErrCodeRefusedStream) |
| 1838 | } |
| 1839 | |
| 1840 | initialState := stateOpen |
| 1841 | if f.StreamEnded() { |
| 1842 | initialState = stateHalfClosedRemote |
| 1843 | } |
| 1844 | st := sc.newStream(id, 0, initialState) |
| 1845 | |
| 1846 | if f.HasPriority() { |
| 1847 | if err := checkPriority(f.StreamID, f.Priority); err != nil { |
| 1848 | return err |
| 1849 | } |
| 1850 | sc.writeSched.AdjustStream(st.id, f.Priority) |
| 1851 | } |
| 1852 | |
| 1853 | rw, req, err := sc.newWriterAndRequest(st, f) |
| 1854 | if err != nil { |
| 1855 | return err |
| 1856 | } |
| 1857 | st.reqTrailer = req.Trailer |
| 1858 | if st.reqTrailer != nil { |
| 1859 | st.trailer = make(http.Header) |
| 1860 | } |
| 1861 | st.body = req.Body.(*requestBody).pipe // may be nil |
| 1862 | st.declBodyBytes = req.ContentLength |
| 1863 | |
| 1864 | handler := sc.handler.ServeHTTP |
| 1865 | if f.Truncated { |
| 1866 | // Their header list was too long. Send a 431 error. |
| 1867 | handler = handleHeaderListTooLong |
| 1868 | } else if err := checkValidHTTP2RequestHeaders(req.Header); err != nil { |
| 1869 | handler = new400Handler(err) |
| 1870 | } |
| 1871 | |
| 1872 | // The net/http package sets the read deadline from the |
| 1873 | // http.Server.ReadTimeout during the TLS handshake, but then |
| 1874 | // passes the connection off to us with the deadline already |
| 1875 | // set. Disarm it here after the request headers are read, |
| 1876 | // similar to how the http1 server works. Here it's |
| 1877 | // technically more like the http1 Server's ReadHeaderTimeout |
| 1878 | // (in Go 1.8), though. That's a more sane option anyway. |
| 1879 | if sc.hs.ReadTimeout != 0 { |
| 1880 | sc.conn.SetReadDeadline(time.Time{}) |
| 1881 | } |
| 1882 | |
| 1883 | go sc.runHandler(rw, req, handler) |
| 1884 | return nil |
| 1885 | } |
| 1886 | |
| 1887 | func (st *stream) processTrailerHeaders(f *MetaHeadersFrame) error { |
| 1888 | sc := st.sc |
| 1889 | sc.serveG.check() |
| 1890 | if st.gotTrailerHeader { |
| 1891 | return ConnectionError(ErrCodeProtocol) |
| 1892 | } |
| 1893 | st.gotTrailerHeader = true |
| 1894 | if !f.StreamEnded() { |
| 1895 | return streamError(st.id, ErrCodeProtocol) |
| 1896 | } |
| 1897 | |
| 1898 | if len(f.PseudoFields()) > 0 { |
| 1899 | return streamError(st.id, ErrCodeProtocol) |
| 1900 | } |
| 1901 | if st.trailer != nil { |
| 1902 | for _, hf := range f.RegularFields() { |
| 1903 | key := sc.canonicalHeader(hf.Name) |
| 1904 | if !httpguts.ValidTrailerHeader(key) { |
| 1905 | // TODO: send more details to the peer somehow. But http2 has |
| 1906 | // no way to send debug data at a stream level. Discuss with |
| 1907 | // HTTP folk. |
| 1908 | return streamError(st.id, ErrCodeProtocol) |
| 1909 | } |
| 1910 | st.trailer[key] = append(st.trailer[key], hf.Value) |
| 1911 | } |
| 1912 | } |
| 1913 | st.endStream() |
| 1914 | return nil |
| 1915 | } |
| 1916 | |
| 1917 | func checkPriority(streamID uint32, p PriorityParam) error { |
| 1918 | if streamID == p.StreamDep { |
| 1919 | // Section 5.3.1: "A stream cannot depend on itself. An endpoint MUST treat |
| 1920 | // this as a stream error (Section 5.4.2) of type PROTOCOL_ERROR." |
| 1921 | // Section 5.3.3 says that a stream can depend on one of its dependencies, |
| 1922 | // so it's only self-dependencies that are forbidden. |
| 1923 | return streamError(streamID, ErrCodeProtocol) |
| 1924 | } |
| 1925 | return nil |
| 1926 | } |
| 1927 | |
| 1928 | func (sc *serverConn) processPriority(f *PriorityFrame) error { |
| 1929 | if sc.inGoAway { |
| 1930 | return nil |
| 1931 | } |
| 1932 | if err := checkPriority(f.StreamID, f.PriorityParam); err != nil { |
| 1933 | return err |
| 1934 | } |
| 1935 | sc.writeSched.AdjustStream(f.StreamID, f.PriorityParam) |
| 1936 | return nil |
| 1937 | } |
| 1938 | |
| 1939 | func (sc *serverConn) newStream(id, pusherID uint32, state streamState) *stream { |
| 1940 | sc.serveG.check() |
| 1941 | if id == 0 { |
| 1942 | panic("internal error: cannot create stream with id 0") |
| 1943 | } |
| 1944 | |
| 1945 | ctx, cancelCtx := context.WithCancel(sc.baseCtx) |
| 1946 | st := &stream{ |
| 1947 | sc: sc, |
| 1948 | id: id, |
| 1949 | state: state, |
| 1950 | ctx: ctx, |
| 1951 | cancelCtx: cancelCtx, |
| 1952 | } |
| 1953 | st.cw.Init() |
| 1954 | st.flow.conn = &sc.flow // link to conn-level counter |
| 1955 | st.flow.add(sc.initialStreamSendWindowSize) |
| 1956 | st.inflow.conn = &sc.inflow // link to conn-level counter |
| 1957 | st.inflow.add(sc.srv.initialStreamRecvWindowSize()) |
| 1958 | if sc.hs.WriteTimeout != 0 { |
| 1959 | st.writeDeadline = time.AfterFunc(sc.hs.WriteTimeout, st.onWriteTimeout) |
| 1960 | } |
| 1961 | |
| 1962 | sc.streams[id] = st |
| 1963 | sc.writeSched.OpenStream(st.id, OpenStreamOptions{PusherID: pusherID}) |
| 1964 | if st.isPushed() { |
| 1965 | sc.curPushedStreams++ |
| 1966 | } else { |
| 1967 | sc.curClientStreams++ |
| 1968 | } |
| 1969 | if sc.curOpenStreams() == 1 { |
| 1970 | sc.setConnState(http.StateActive) |
| 1971 | } |
| 1972 | |
| 1973 | return st |
| 1974 | } |
| 1975 | |
| 1976 | func (sc *serverConn) newWriterAndRequest(st *stream, f *MetaHeadersFrame) (*responseWriter, *http.Request, error) { |
| 1977 | sc.serveG.check() |
| 1978 | |
| 1979 | rp := requestParam{ |
| 1980 | method: f.PseudoValue("method"), |
| 1981 | scheme: f.PseudoValue("scheme"), |
| 1982 | authority: f.PseudoValue("authority"), |
| 1983 | path: f.PseudoValue("path"), |
| 1984 | } |
| 1985 | |
| 1986 | isConnect := rp.method == "CONNECT" |
| 1987 | if isConnect { |
| 1988 | if rp.path != "" || rp.scheme != "" || rp.authority == "" { |
| 1989 | return nil, nil, streamError(f.StreamID, ErrCodeProtocol) |
| 1990 | } |
| 1991 | } else if rp.method == "" || rp.path == "" || (rp.scheme != "https" && rp.scheme != "http") { |
| 1992 | // See 8.1.2.6 Malformed Requests and Responses: |
| 1993 | // |
| 1994 | // Malformed requests or responses that are detected |
| 1995 | // MUST be treated as a stream error (Section 5.4.2) |
| 1996 | // of type PROTOCOL_ERROR." |
| 1997 | // |
| 1998 | // 8.1.2.3 Request Pseudo-Header Fields |
| 1999 | // "All HTTP/2 requests MUST include exactly one valid |
| 2000 | // value for the :method, :scheme, and :path |
| 2001 | // pseudo-header fields" |
| 2002 | return nil, nil, streamError(f.StreamID, ErrCodeProtocol) |
| 2003 | } |
| 2004 | |
| 2005 | bodyOpen := !f.StreamEnded() |
| 2006 | if rp.method == "HEAD" && bodyOpen { |
| 2007 | // HEAD requests can't have bodies |
| 2008 | return nil, nil, streamError(f.StreamID, ErrCodeProtocol) |
| 2009 | } |
| 2010 | |
| 2011 | rp.header = make(http.Header) |
| 2012 | for _, hf := range f.RegularFields() { |
| 2013 | rp.header.Add(sc.canonicalHeader(hf.Name), hf.Value) |
| 2014 | } |
| 2015 | if rp.authority == "" { |
| 2016 | rp.authority = rp.header.Get("Host") |
| 2017 | } |
| 2018 | |
| 2019 | rw, req, err := sc.newWriterAndRequestNoBody(st, rp) |
| 2020 | if err != nil { |
| 2021 | return nil, nil, err |
| 2022 | } |
| 2023 | if bodyOpen { |
| 2024 | if vv, ok := rp.header["Content-Length"]; ok { |
| 2025 | req.ContentLength, _ = strconv.ParseInt(vv[0], 10, 64) |
| 2026 | } else { |
| 2027 | req.ContentLength = -1 |
| 2028 | } |
| 2029 | req.Body.(*requestBody).pipe = &pipe{ |
| 2030 | b: &dataBuffer{expected: req.ContentLength}, |
| 2031 | } |
| 2032 | } |
| 2033 | return rw, req, nil |
| 2034 | } |
| 2035 | |
| 2036 | type requestParam struct { |
| 2037 | method string |
| 2038 | scheme, authority, path string |
| 2039 | header http.Header |
| 2040 | } |
| 2041 | |
| 2042 | func (sc *serverConn) newWriterAndRequestNoBody(st *stream, rp requestParam) (*responseWriter, *http.Request, error) { |
| 2043 | sc.serveG.check() |
| 2044 | |
| 2045 | var tlsState *tls.ConnectionState // nil if not scheme https |
| 2046 | if rp.scheme == "https" { |
| 2047 | tlsState = sc.tlsState |
| 2048 | } |
| 2049 | |
| 2050 | needsContinue := rp.header.Get("Expect") == "100-continue" |
| 2051 | if needsContinue { |
| 2052 | rp.header.Del("Expect") |
| 2053 | } |
| 2054 | // Merge Cookie headers into one "; "-delimited value. |
| 2055 | if cookies := rp.header["Cookie"]; len(cookies) > 1 { |
| 2056 | rp.header.Set("Cookie", strings.Join(cookies, "; ")) |
| 2057 | } |
| 2058 | |
| 2059 | // Setup Trailers |
| 2060 | var trailer http.Header |
| 2061 | for _, v := range rp.header["Trailer"] { |
| 2062 | for _, key := range strings.Split(v, ",") { |
| 2063 | key = http.CanonicalHeaderKey(strings.TrimSpace(key)) |
| 2064 | switch key { |
| 2065 | case "Transfer-Encoding", "Trailer", "Content-Length": |
| 2066 | // Bogus. (copy of http1 rules) |
| 2067 | // Ignore. |
| 2068 | default: |
| 2069 | if trailer == nil { |
| 2070 | trailer = make(http.Header) |
| 2071 | } |
| 2072 | trailer[key] = nil |
| 2073 | } |
| 2074 | } |
| 2075 | } |
| 2076 | delete(rp.header, "Trailer") |
| 2077 | |
| 2078 | var url_ *url.URL |
| 2079 | var requestURI string |
| 2080 | if rp.method == "CONNECT" { |
| 2081 | url_ = &url.URL{Host: rp.authority} |
| 2082 | requestURI = rp.authority // mimic HTTP/1 server behavior |
| 2083 | } else { |
| 2084 | var err error |
| 2085 | url_, err = url.ParseRequestURI(rp.path) |
| 2086 | if err != nil { |
| 2087 | return nil, nil, streamError(st.id, ErrCodeProtocol) |
| 2088 | } |
| 2089 | requestURI = rp.path |
| 2090 | } |
| 2091 | |
| 2092 | body := &requestBody{ |
| 2093 | conn: sc, |
| 2094 | stream: st, |
| 2095 | needsContinue: needsContinue, |
| 2096 | } |
| 2097 | req := &http.Request{ |
| 2098 | Method: rp.method, |
| 2099 | URL: url_, |
| 2100 | RemoteAddr: sc.remoteAddrStr, |
| 2101 | Header: rp.header, |
| 2102 | RequestURI: requestURI, |
| 2103 | Proto: "HTTP/2.0", |
| 2104 | ProtoMajor: 2, |
| 2105 | ProtoMinor: 0, |
| 2106 | TLS: tlsState, |
| 2107 | Host: rp.authority, |
| 2108 | Body: body, |
| 2109 | Trailer: trailer, |
| 2110 | } |
| 2111 | req = req.WithContext(st.ctx) |
| 2112 | |
| 2113 | rws := responseWriterStatePool.Get().(*responseWriterState) |
| 2114 | bwSave := rws.bw |
| 2115 | *rws = responseWriterState{} // zero all the fields |
| 2116 | rws.conn = sc |
| 2117 | rws.bw = bwSave |
| 2118 | rws.bw.Reset(chunkWriter{rws}) |
| 2119 | rws.stream = st |
| 2120 | rws.req = req |
| 2121 | rws.body = body |
| 2122 | |
| 2123 | rw := &responseWriter{rws: rws} |
| 2124 | return rw, req, nil |
| 2125 | } |
| 2126 | |
| 2127 | // Run on its own goroutine. |
| 2128 | func (sc *serverConn) runHandler(rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) { |
| 2129 | didPanic := true |
| 2130 | defer func() { |
| 2131 | rw.rws.stream.cancelCtx() |
| 2132 | if didPanic { |
| 2133 | e := recover() |
| 2134 | sc.writeFrameFromHandler(FrameWriteRequest{ |
| 2135 | write: handlerPanicRST{rw.rws.stream.id}, |
| 2136 | stream: rw.rws.stream, |
| 2137 | }) |
| 2138 | // Same as net/http: |
| 2139 | if e != nil && e != http.ErrAbortHandler { |
| 2140 | const size = 64 << 10 |
| 2141 | buf := make([]byte, size) |
| 2142 | buf = buf[:runtime.Stack(buf, false)] |
| 2143 | sc.logf("http2: panic serving %v: %v\n%s", sc.conn.RemoteAddr(), e, buf) |
| 2144 | } |
| 2145 | return |
| 2146 | } |
| 2147 | rw.handlerDone() |
| 2148 | }() |
| 2149 | handler(rw, req) |
| 2150 | didPanic = false |
| 2151 | } |
| 2152 | |
| 2153 | func handleHeaderListTooLong(w http.ResponseWriter, r *http.Request) { |
| 2154 | // 10.5.1 Limits on Header Block Size: |
| 2155 | // .. "A server that receives a larger header block than it is |
| 2156 | // willing to handle can send an HTTP 431 (Request Header Fields Too |
| 2157 | // Large) status code" |
| 2158 | const statusRequestHeaderFieldsTooLarge = 431 // only in Go 1.6+ |
| 2159 | w.WriteHeader(statusRequestHeaderFieldsTooLarge) |
| 2160 | io.WriteString(w, "<h1>HTTP Error 431</h1><p>Request Header Field(s) Too Large</p>") |
| 2161 | } |
| 2162 | |
| 2163 | // called from handler goroutines. |
| 2164 | // h may be nil. |
| 2165 | func (sc *serverConn) writeHeaders(st *stream, headerData *writeResHeaders) error { |
| 2166 | sc.serveG.checkNotOn() // NOT on |
| 2167 | var errc chan error |
| 2168 | if headerData.h != nil { |
| 2169 | // If there's a header map (which we don't own), so we have to block on |
| 2170 | // waiting for this frame to be written, so an http.Flush mid-handler |
| 2171 | // writes out the correct value of keys, before a handler later potentially |
| 2172 | // mutates it. |
| 2173 | errc = errChanPool.Get().(chan error) |
| 2174 | } |
| 2175 | if err := sc.writeFrameFromHandler(FrameWriteRequest{ |
| 2176 | write: headerData, |
| 2177 | stream: st, |
| 2178 | done: errc, |
| 2179 | }); err != nil { |
| 2180 | return err |
| 2181 | } |
| 2182 | if errc != nil { |
| 2183 | select { |
| 2184 | case err := <-errc: |
| 2185 | errChanPool.Put(errc) |
| 2186 | return err |
| 2187 | case <-sc.doneServing: |
| 2188 | return errClientDisconnected |
| 2189 | case <-st.cw: |
| 2190 | return errStreamClosed |
| 2191 | } |
| 2192 | } |
| 2193 | return nil |
| 2194 | } |
| 2195 | |
| 2196 | // called from handler goroutines. |
| 2197 | func (sc *serverConn) write100ContinueHeaders(st *stream) { |
| 2198 | sc.writeFrameFromHandler(FrameWriteRequest{ |
| 2199 | write: write100ContinueHeadersFrame{st.id}, |
| 2200 | stream: st, |
| 2201 | }) |
| 2202 | } |
| 2203 | |
| 2204 | // A bodyReadMsg tells the server loop that the http.Handler read n |
| 2205 | // bytes of the DATA from the client on the given stream. |
| 2206 | type bodyReadMsg struct { |
| 2207 | st *stream |
| 2208 | n int |
| 2209 | } |
| 2210 | |
| 2211 | // called from handler goroutines. |
| 2212 | // Notes that the handler for the given stream ID read n bytes of its body |
| 2213 | // and schedules flow control tokens to be sent. |
| 2214 | func (sc *serverConn) noteBodyReadFromHandler(st *stream, n int, err error) { |
| 2215 | sc.serveG.checkNotOn() // NOT on |
| 2216 | if n > 0 { |
| 2217 | select { |
| 2218 | case sc.bodyReadCh <- bodyReadMsg{st, n}: |
| 2219 | case <-sc.doneServing: |
| 2220 | } |
| 2221 | } |
| 2222 | } |
| 2223 | |
| 2224 | func (sc *serverConn) noteBodyRead(st *stream, n int) { |
| 2225 | sc.serveG.check() |
| 2226 | sc.sendWindowUpdate(nil, n) // conn-level |
| 2227 | if st.state != stateHalfClosedRemote && st.state != stateClosed { |
| 2228 | // Don't send this WINDOW_UPDATE if the stream is closed |
| 2229 | // remotely. |
| 2230 | sc.sendWindowUpdate(st, n) |
| 2231 | } |
| 2232 | } |
| 2233 | |
| 2234 | // st may be nil for conn-level |
| 2235 | func (sc *serverConn) sendWindowUpdate(st *stream, n int) { |
| 2236 | sc.serveG.check() |
| 2237 | // "The legal range for the increment to the flow control |
| 2238 | // window is 1 to 2^31-1 (2,147,483,647) octets." |
| 2239 | // A Go Read call on 64-bit machines could in theory read |
| 2240 | // a larger Read than this. Very unlikely, but we handle it here |
| 2241 | // rather than elsewhere for now. |
| 2242 | const maxUint31 = 1<<31 - 1 |
| 2243 | for n >= maxUint31 { |
| 2244 | sc.sendWindowUpdate32(st, maxUint31) |
| 2245 | n -= maxUint31 |
| 2246 | } |
| 2247 | sc.sendWindowUpdate32(st, int32(n)) |
| 2248 | } |
| 2249 | |
| 2250 | // st may be nil for conn-level |
| 2251 | func (sc *serverConn) sendWindowUpdate32(st *stream, n int32) { |
| 2252 | sc.serveG.check() |
| 2253 | if n == 0 { |
| 2254 | return |
| 2255 | } |
| 2256 | if n < 0 { |
| 2257 | panic("negative update") |
| 2258 | } |
| 2259 | var streamID uint32 |
| 2260 | if st != nil { |
| 2261 | streamID = st.id |
| 2262 | } |
| 2263 | sc.writeFrame(FrameWriteRequest{ |
| 2264 | write: writeWindowUpdate{streamID: streamID, n: uint32(n)}, |
| 2265 | stream: st, |
| 2266 | }) |
| 2267 | var ok bool |
| 2268 | if st == nil { |
| 2269 | ok = sc.inflow.add(n) |
| 2270 | } else { |
| 2271 | ok = st.inflow.add(n) |
| 2272 | } |
| 2273 | if !ok { |
| 2274 | panic("internal error; sent too many window updates without decrements?") |
| 2275 | } |
| 2276 | } |
| 2277 | |
| 2278 | // requestBody is the Handler's Request.Body type. |
| 2279 | // Read and Close may be called concurrently. |
| 2280 | type requestBody struct { |
| 2281 | stream *stream |
| 2282 | conn *serverConn |
| 2283 | closed bool // for use by Close only |
| 2284 | sawEOF bool // for use by Read only |
| 2285 | pipe *pipe // non-nil if we have a HTTP entity message body |
| 2286 | needsContinue bool // need to send a 100-continue |
| 2287 | } |
| 2288 | |
| 2289 | func (b *requestBody) Close() error { |
| 2290 | if b.pipe != nil && !b.closed { |
| 2291 | b.pipe.BreakWithError(errClosedBody) |
| 2292 | } |
| 2293 | b.closed = true |
| 2294 | return nil |
| 2295 | } |
| 2296 | |
| 2297 | func (b *requestBody) Read(p []byte) (n int, err error) { |
| 2298 | if b.needsContinue { |
| 2299 | b.needsContinue = false |
| 2300 | b.conn.write100ContinueHeaders(b.stream) |
| 2301 | } |
| 2302 | if b.pipe == nil || b.sawEOF { |
| 2303 | return 0, io.EOF |
| 2304 | } |
| 2305 | n, err = b.pipe.Read(p) |
| 2306 | if err == io.EOF { |
| 2307 | b.sawEOF = true |
| 2308 | } |
| 2309 | if b.conn == nil && inTests { |
| 2310 | return |
| 2311 | } |
| 2312 | b.conn.noteBodyReadFromHandler(b.stream, n, err) |
| 2313 | return |
| 2314 | } |
| 2315 | |
| 2316 | // responseWriter is the http.ResponseWriter implementation. It's |
| 2317 | // intentionally small (1 pointer wide) to minimize garbage. The |
| 2318 | // responseWriterState pointer inside is zeroed at the end of a |
| 2319 | // request (in handlerDone) and calls on the responseWriter thereafter |
| 2320 | // simply crash (caller's mistake), but the much larger responseWriterState |
| 2321 | // and buffers are reused between multiple requests. |
| 2322 | type responseWriter struct { |
| 2323 | rws *responseWriterState |
| 2324 | } |
| 2325 | |
| 2326 | // Optional http.ResponseWriter interfaces implemented. |
| 2327 | var ( |
| 2328 | _ http.CloseNotifier = (*responseWriter)(nil) |
| 2329 | _ http.Flusher = (*responseWriter)(nil) |
| 2330 | _ stringWriter = (*responseWriter)(nil) |
| 2331 | ) |
| 2332 | |
| 2333 | type responseWriterState struct { |
| 2334 | // immutable within a request: |
| 2335 | stream *stream |
| 2336 | req *http.Request |
| 2337 | body *requestBody // to close at end of request, if DATA frames didn't |
| 2338 | conn *serverConn |
| 2339 | |
| 2340 | // TODO: adjust buffer writing sizes based on server config, frame size updates from peer, etc |
| 2341 | bw *bufio.Writer // writing to a chunkWriter{this *responseWriterState} |
| 2342 | |
| 2343 | // mutated by http.Handler goroutine: |
| 2344 | handlerHeader http.Header // nil until called |
| 2345 | snapHeader http.Header // snapshot of handlerHeader at WriteHeader time |
| 2346 | trailers []string // set in writeChunk |
| 2347 | status int // status code passed to WriteHeader |
| 2348 | wroteHeader bool // WriteHeader called (explicitly or implicitly). Not necessarily sent to user yet. |
| 2349 | sentHeader bool // have we sent the header frame? |
| 2350 | handlerDone bool // handler has finished |
| 2351 | dirty bool // a Write failed; don't reuse this responseWriterState |
| 2352 | |
| 2353 | sentContentLen int64 // non-zero if handler set a Content-Length header |
| 2354 | wroteBytes int64 |
| 2355 | |
| 2356 | closeNotifierMu sync.Mutex // guards closeNotifierCh |
| 2357 | closeNotifierCh chan bool // nil until first used |
| 2358 | } |
| 2359 | |
| 2360 | type chunkWriter struct{ rws *responseWriterState } |
| 2361 | |
| 2362 | func (cw chunkWriter) Write(p []byte) (n int, err error) { return cw.rws.writeChunk(p) } |
| 2363 | |
| 2364 | func (rws *responseWriterState) hasTrailers() bool { return len(rws.trailers) > 0 } |
| 2365 | |
| 2366 | func (rws *responseWriterState) hasNonemptyTrailers() bool { |
| 2367 | for _, trailer := range rws.trailers { |
| 2368 | if _, ok := rws.handlerHeader[trailer]; ok { |
| 2369 | return true |
| 2370 | } |
| 2371 | } |
| 2372 | return false |
| 2373 | } |
| 2374 | |
| 2375 | // declareTrailer is called for each Trailer header when the |
| 2376 | // response header is written. It notes that a header will need to be |
| 2377 | // written in the trailers at the end of the response. |
| 2378 | func (rws *responseWriterState) declareTrailer(k string) { |
| 2379 | k = http.CanonicalHeaderKey(k) |
| 2380 | if !httpguts.ValidTrailerHeader(k) { |
| 2381 | // Forbidden by RFC 7230, section 4.1.2. |
| 2382 | rws.conn.logf("ignoring invalid trailer %q", k) |
| 2383 | return |
| 2384 | } |
| 2385 | if !strSliceContains(rws.trailers, k) { |
| 2386 | rws.trailers = append(rws.trailers, k) |
| 2387 | } |
| 2388 | } |
| 2389 | |
| 2390 | // writeChunk writes chunks from the bufio.Writer. But because |
| 2391 | // bufio.Writer may bypass its chunking, sometimes p may be |
| 2392 | // arbitrarily large. |
| 2393 | // |
| 2394 | // writeChunk is also responsible (on the first chunk) for sending the |
| 2395 | // HEADER response. |
| 2396 | func (rws *responseWriterState) writeChunk(p []byte) (n int, err error) { |
| 2397 | if !rws.wroteHeader { |
| 2398 | rws.writeHeader(200) |
| 2399 | } |
| 2400 | |
| 2401 | isHeadResp := rws.req.Method == "HEAD" |
| 2402 | if !rws.sentHeader { |
| 2403 | rws.sentHeader = true |
| 2404 | var ctype, clen string |
| 2405 | if clen = rws.snapHeader.Get("Content-Length"); clen != "" { |
| 2406 | rws.snapHeader.Del("Content-Length") |
| 2407 | clen64, err := strconv.ParseInt(clen, 10, 64) |
| 2408 | if err == nil && clen64 >= 0 { |
| 2409 | rws.sentContentLen = clen64 |
| 2410 | } else { |
| 2411 | clen = "" |
| 2412 | } |
| 2413 | } |
| 2414 | if clen == "" && rws.handlerDone && bodyAllowedForStatus(rws.status) && (len(p) > 0 || !isHeadResp) { |
| 2415 | clen = strconv.Itoa(len(p)) |
| 2416 | } |
| 2417 | _, hasContentType := rws.snapHeader["Content-Type"] |
| 2418 | // If the Content-Encoding is non-blank, we shouldn't |
| 2419 | // sniff the body. See Issue golang.org/issue/31753. |
| 2420 | ce := rws.snapHeader.Get("Content-Encoding") |
| 2421 | hasCE := len(ce) > 0 |
| 2422 | if !hasCE && !hasContentType && bodyAllowedForStatus(rws.status) && len(p) > 0 { |
| 2423 | ctype = http.DetectContentType(p) |
| 2424 | } |
| 2425 | var date string |
| 2426 | if _, ok := rws.snapHeader["Date"]; !ok { |
| 2427 | // TODO(bradfitz): be faster here, like net/http? measure. |
| 2428 | date = time.Now().UTC().Format(http.TimeFormat) |
| 2429 | } |
| 2430 | |
| 2431 | for _, v := range rws.snapHeader["Trailer"] { |
| 2432 | foreachHeaderElement(v, rws.declareTrailer) |
| 2433 | } |
| 2434 | |
| 2435 | // "Connection" headers aren't allowed in HTTP/2 (RFC 7540, 8.1.2.2), |
| 2436 | // but respect "Connection" == "close" to mean sending a GOAWAY and tearing |
| 2437 | // down the TCP connection when idle, like we do for HTTP/1. |
| 2438 | // TODO: remove more Connection-specific header fields here, in addition |
| 2439 | // to "Connection". |
| 2440 | if _, ok := rws.snapHeader["Connection"]; ok { |
| 2441 | v := rws.snapHeader.Get("Connection") |
| 2442 | delete(rws.snapHeader, "Connection") |
| 2443 | if v == "close" { |
| 2444 | rws.conn.startGracefulShutdown() |
| 2445 | } |
| 2446 | } |
| 2447 | |
| 2448 | endStream := (rws.handlerDone && !rws.hasTrailers() && len(p) == 0) || isHeadResp |
| 2449 | err = rws.conn.writeHeaders(rws.stream, &writeResHeaders{ |
| 2450 | streamID: rws.stream.id, |
| 2451 | httpResCode: rws.status, |
| 2452 | h: rws.snapHeader, |
| 2453 | endStream: endStream, |
| 2454 | contentType: ctype, |
| 2455 | contentLength: clen, |
| 2456 | date: date, |
| 2457 | }) |
| 2458 | if err != nil { |
| 2459 | rws.dirty = true |
| 2460 | return 0, err |
| 2461 | } |
| 2462 | if endStream { |
| 2463 | return 0, nil |
| 2464 | } |
| 2465 | } |
| 2466 | if isHeadResp { |
| 2467 | return len(p), nil |
| 2468 | } |
| 2469 | if len(p) == 0 && !rws.handlerDone { |
| 2470 | return 0, nil |
| 2471 | } |
| 2472 | |
| 2473 | if rws.handlerDone { |
| 2474 | rws.promoteUndeclaredTrailers() |
| 2475 | } |
| 2476 | |
| 2477 | // only send trailers if they have actually been defined by the |
| 2478 | // server handler. |
| 2479 | hasNonemptyTrailers := rws.hasNonemptyTrailers() |
| 2480 | endStream := rws.handlerDone && !hasNonemptyTrailers |
| 2481 | if len(p) > 0 || endStream { |
| 2482 | // only send a 0 byte DATA frame if we're ending the stream. |
| 2483 | if err := rws.conn.writeDataFromHandler(rws.stream, p, endStream); err != nil { |
| 2484 | rws.dirty = true |
| 2485 | return 0, err |
| 2486 | } |
| 2487 | } |
| 2488 | |
| 2489 | if rws.handlerDone && hasNonemptyTrailers { |
| 2490 | err = rws.conn.writeHeaders(rws.stream, &writeResHeaders{ |
| 2491 | streamID: rws.stream.id, |
| 2492 | h: rws.handlerHeader, |
| 2493 | trailers: rws.trailers, |
| 2494 | endStream: true, |
| 2495 | }) |
| 2496 | if err != nil { |
| 2497 | rws.dirty = true |
| 2498 | } |
| 2499 | return len(p), err |
| 2500 | } |
| 2501 | return len(p), nil |
| 2502 | } |
| 2503 | |
| 2504 | // TrailerPrefix is a magic prefix for ResponseWriter.Header map keys |
| 2505 | // that, if present, signals that the map entry is actually for |
| 2506 | // the response trailers, and not the response headers. The prefix |
| 2507 | // is stripped after the ServeHTTP call finishes and the values are |
| 2508 | // sent in the trailers. |
| 2509 | // |
| 2510 | // This mechanism is intended only for trailers that are not known |
| 2511 | // prior to the headers being written. If the set of trailers is fixed |
| 2512 | // or known before the header is written, the normal Go trailers mechanism |
| 2513 | // is preferred: |
| 2514 | // https://golang.org/pkg/net/http/#ResponseWriter |
| 2515 | // https://golang.org/pkg/net/http/#example_ResponseWriter_trailers |
| 2516 | const TrailerPrefix = "Trailer:" |
| 2517 | |
| 2518 | // promoteUndeclaredTrailers permits http.Handlers to set trailers |
| 2519 | // after the header has already been flushed. Because the Go |
| 2520 | // ResponseWriter interface has no way to set Trailers (only the |
| 2521 | // Header), and because we didn't want to expand the ResponseWriter |
| 2522 | // interface, and because nobody used trailers, and because RFC 7230 |
| 2523 | // says you SHOULD (but not must) predeclare any trailers in the |
| 2524 | // header, the official ResponseWriter rules said trailers in Go must |
| 2525 | // be predeclared, and then we reuse the same ResponseWriter.Header() |
| 2526 | // map to mean both Headers and Trailers. When it's time to write the |
| 2527 | // Trailers, we pick out the fields of Headers that were declared as |
| 2528 | // trailers. That worked for a while, until we found the first major |
| 2529 | // user of Trailers in the wild: gRPC (using them only over http2), |
| 2530 | // and gRPC libraries permit setting trailers mid-stream without |
| 2531 | // predeclaring them. So: change of plans. We still permit the old |
| 2532 | // way, but we also permit this hack: if a Header() key begins with |
| 2533 | // "Trailer:", the suffix of that key is a Trailer. Because ':' is an |
| 2534 | // invalid token byte anyway, there is no ambiguity. (And it's already |
| 2535 | // filtered out) It's mildly hacky, but not terrible. |
| 2536 | // |
| 2537 | // This method runs after the Handler is done and promotes any Header |
| 2538 | // fields to be trailers. |
| 2539 | func (rws *responseWriterState) promoteUndeclaredTrailers() { |
| 2540 | for k, vv := range rws.handlerHeader { |
| 2541 | if !strings.HasPrefix(k, TrailerPrefix) { |
| 2542 | continue |
| 2543 | } |
| 2544 | trailerKey := strings.TrimPrefix(k, TrailerPrefix) |
| 2545 | rws.declareTrailer(trailerKey) |
| 2546 | rws.handlerHeader[http.CanonicalHeaderKey(trailerKey)] = vv |
| 2547 | } |
| 2548 | |
| 2549 | if len(rws.trailers) > 1 { |
| 2550 | sorter := sorterPool.Get().(*sorter) |
| 2551 | sorter.SortStrings(rws.trailers) |
| 2552 | sorterPool.Put(sorter) |
| 2553 | } |
| 2554 | } |
| 2555 | |
| 2556 | func (w *responseWriter) Flush() { |
| 2557 | rws := w.rws |
| 2558 | if rws == nil { |
| 2559 | panic("Header called after Handler finished") |
| 2560 | } |
| 2561 | if rws.bw.Buffered() > 0 { |
| 2562 | if err := rws.bw.Flush(); err != nil { |
| 2563 | // Ignore the error. The frame writer already knows. |
| 2564 | return |
| 2565 | } |
| 2566 | } else { |
| 2567 | // The bufio.Writer won't call chunkWriter.Write |
| 2568 | // (writeChunk with zero bytes, so we have to do it |
| 2569 | // ourselves to force the HTTP response header and/or |
| 2570 | // final DATA frame (with END_STREAM) to be sent. |
| 2571 | rws.writeChunk(nil) |
| 2572 | } |
| 2573 | } |
| 2574 | |
| 2575 | func (w *responseWriter) CloseNotify() <-chan bool { |
| 2576 | rws := w.rws |
| 2577 | if rws == nil { |
| 2578 | panic("CloseNotify called after Handler finished") |
| 2579 | } |
| 2580 | rws.closeNotifierMu.Lock() |
| 2581 | ch := rws.closeNotifierCh |
| 2582 | if ch == nil { |
| 2583 | ch = make(chan bool, 1) |
| 2584 | rws.closeNotifierCh = ch |
| 2585 | cw := rws.stream.cw |
| 2586 | go func() { |
| 2587 | cw.Wait() // wait for close |
| 2588 | ch <- true |
| 2589 | }() |
| 2590 | } |
| 2591 | rws.closeNotifierMu.Unlock() |
| 2592 | return ch |
| 2593 | } |
| 2594 | |
| 2595 | func (w *responseWriter) Header() http.Header { |
| 2596 | rws := w.rws |
| 2597 | if rws == nil { |
| 2598 | panic("Header called after Handler finished") |
| 2599 | } |
| 2600 | if rws.handlerHeader == nil { |
| 2601 | rws.handlerHeader = make(http.Header) |
| 2602 | } |
| 2603 | return rws.handlerHeader |
| 2604 | } |
| 2605 | |
| 2606 | // checkWriteHeaderCode is a copy of net/http's checkWriteHeaderCode. |
| 2607 | func checkWriteHeaderCode(code int) { |
| 2608 | // Issue 22880: require valid WriteHeader status codes. |
| 2609 | // For now we only enforce that it's three digits. |
| 2610 | // In the future we might block things over 599 (600 and above aren't defined |
| 2611 | // at http://httpwg.org/specs/rfc7231.html#status.codes) |
| 2612 | // and we might block under 200 (once we have more mature 1xx support). |
| 2613 | // But for now any three digits. |
| 2614 | // |
| 2615 | // We used to send "HTTP/1.1 000 0" on the wire in responses but there's |
| 2616 | // no equivalent bogus thing we can realistically send in HTTP/2, |
| 2617 | // so we'll consistently panic instead and help people find their bugs |
| 2618 | // early. (We can't return an error from WriteHeader even if we wanted to.) |
| 2619 | if code < 100 || code > 999 { |
| 2620 | panic(fmt.Sprintf("invalid WriteHeader code %v", code)) |
| 2621 | } |
| 2622 | } |
| 2623 | |
| 2624 | func (w *responseWriter) WriteHeader(code int) { |
| 2625 | rws := w.rws |
| 2626 | if rws == nil { |
| 2627 | panic("WriteHeader called after Handler finished") |
| 2628 | } |
| 2629 | rws.writeHeader(code) |
| 2630 | } |
| 2631 | |
| 2632 | func (rws *responseWriterState) writeHeader(code int) { |
| 2633 | if !rws.wroteHeader { |
| 2634 | checkWriteHeaderCode(code) |
| 2635 | rws.wroteHeader = true |
| 2636 | rws.status = code |
| 2637 | if len(rws.handlerHeader) > 0 { |
| 2638 | rws.snapHeader = cloneHeader(rws.handlerHeader) |
| 2639 | } |
| 2640 | } |
| 2641 | } |
| 2642 | |
| 2643 | func cloneHeader(h http.Header) http.Header { |
| 2644 | h2 := make(http.Header, len(h)) |
| 2645 | for k, vv := range h { |
| 2646 | vv2 := make([]string, len(vv)) |
| 2647 | copy(vv2, vv) |
| 2648 | h2[k] = vv2 |
| 2649 | } |
| 2650 | return h2 |
| 2651 | } |
| 2652 | |
| 2653 | // The Life Of A Write is like this: |
| 2654 | // |
| 2655 | // * Handler calls w.Write or w.WriteString -> |
| 2656 | // * -> rws.bw (*bufio.Writer) -> |
| 2657 | // * (Handler might call Flush) |
| 2658 | // * -> chunkWriter{rws} |
| 2659 | // * -> responseWriterState.writeChunk(p []byte) |
| 2660 | // * -> responseWriterState.writeChunk (most of the magic; see comment there) |
| 2661 | func (w *responseWriter) Write(p []byte) (n int, err error) { |
| 2662 | return w.write(len(p), p, "") |
| 2663 | } |
| 2664 | |
| 2665 | func (w *responseWriter) WriteString(s string) (n int, err error) { |
| 2666 | return w.write(len(s), nil, s) |
| 2667 | } |
| 2668 | |
| 2669 | // either dataB or dataS is non-zero. |
| 2670 | func (w *responseWriter) write(lenData int, dataB []byte, dataS string) (n int, err error) { |
| 2671 | rws := w.rws |
| 2672 | if rws == nil { |
| 2673 | panic("Write called after Handler finished") |
| 2674 | } |
| 2675 | if !rws.wroteHeader { |
| 2676 | w.WriteHeader(200) |
| 2677 | } |
| 2678 | if !bodyAllowedForStatus(rws.status) { |
| 2679 | return 0, http.ErrBodyNotAllowed |
| 2680 | } |
| 2681 | rws.wroteBytes += int64(len(dataB)) + int64(len(dataS)) // only one can be set |
| 2682 | if rws.sentContentLen != 0 && rws.wroteBytes > rws.sentContentLen { |
| 2683 | // TODO: send a RST_STREAM |
| 2684 | return 0, errors.New("http2: handler wrote more than declared Content-Length") |
| 2685 | } |
| 2686 | |
| 2687 | if dataB != nil { |
| 2688 | return rws.bw.Write(dataB) |
| 2689 | } else { |
| 2690 | return rws.bw.WriteString(dataS) |
| 2691 | } |
| 2692 | } |
| 2693 | |
| 2694 | func (w *responseWriter) handlerDone() { |
| 2695 | rws := w.rws |
| 2696 | dirty := rws.dirty |
| 2697 | rws.handlerDone = true |
| 2698 | w.Flush() |
| 2699 | w.rws = nil |
| 2700 | if !dirty { |
| 2701 | // Only recycle the pool if all prior Write calls to |
| 2702 | // the serverConn goroutine completed successfully. If |
| 2703 | // they returned earlier due to resets from the peer |
| 2704 | // there might still be write goroutines outstanding |
| 2705 | // from the serverConn referencing the rws memory. See |
| 2706 | // issue 20704. |
| 2707 | responseWriterStatePool.Put(rws) |
| 2708 | } |
| 2709 | } |
| 2710 | |
| 2711 | // Push errors. |
| 2712 | var ( |
| 2713 | ErrRecursivePush = errors.New("http2: recursive push not allowed") |
| 2714 | ErrPushLimitReached = errors.New("http2: push would exceed peer's SETTINGS_MAX_CONCURRENT_STREAMS") |
| 2715 | ) |
| 2716 | |
| 2717 | var _ http.Pusher = (*responseWriter)(nil) |
| 2718 | |
| 2719 | func (w *responseWriter) Push(target string, opts *http.PushOptions) error { |
| 2720 | st := w.rws.stream |
| 2721 | sc := st.sc |
| 2722 | sc.serveG.checkNotOn() |
| 2723 | |
| 2724 | // No recursive pushes: "PUSH_PROMISE frames MUST only be sent on a peer-initiated stream." |
| 2725 | // http://tools.ietf.org/html/rfc7540#section-6.6 |
| 2726 | if st.isPushed() { |
| 2727 | return ErrRecursivePush |
| 2728 | } |
| 2729 | |
| 2730 | if opts == nil { |
| 2731 | opts = new(http.PushOptions) |
| 2732 | } |
| 2733 | |
| 2734 | // Default options. |
| 2735 | if opts.Method == "" { |
| 2736 | opts.Method = "GET" |
| 2737 | } |
| 2738 | if opts.Header == nil { |
| 2739 | opts.Header = http.Header{} |
| 2740 | } |
| 2741 | wantScheme := "http" |
| 2742 | if w.rws.req.TLS != nil { |
| 2743 | wantScheme = "https" |
| 2744 | } |
| 2745 | |
| 2746 | // Validate the request. |
| 2747 | u, err := url.Parse(target) |
| 2748 | if err != nil { |
| 2749 | return err |
| 2750 | } |
| 2751 | if u.Scheme == "" { |
| 2752 | if !strings.HasPrefix(target, "/") { |
| 2753 | return fmt.Errorf("target must be an absolute URL or an absolute path: %q", target) |
| 2754 | } |
| 2755 | u.Scheme = wantScheme |
| 2756 | u.Host = w.rws.req.Host |
| 2757 | } else { |
| 2758 | if u.Scheme != wantScheme { |
| 2759 | return fmt.Errorf("cannot push URL with scheme %q from request with scheme %q", u.Scheme, wantScheme) |
| 2760 | } |
| 2761 | if u.Host == "" { |
| 2762 | return errors.New("URL must have a host") |
| 2763 | } |
| 2764 | } |
| 2765 | for k := range opts.Header { |
| 2766 | if strings.HasPrefix(k, ":") { |
| 2767 | return fmt.Errorf("promised request headers cannot include pseudo header %q", k) |
| 2768 | } |
| 2769 | // These headers are meaningful only if the request has a body, |
| 2770 | // but PUSH_PROMISE requests cannot have a body. |
| 2771 | // http://tools.ietf.org/html/rfc7540#section-8.2 |
| 2772 | // Also disallow Host, since the promised URL must be absolute. |
| 2773 | switch strings.ToLower(k) { |
| 2774 | case "content-length", "content-encoding", "trailer", "te", "expect", "host": |
| 2775 | return fmt.Errorf("promised request headers cannot include %q", k) |
| 2776 | } |
| 2777 | } |
| 2778 | if err := checkValidHTTP2RequestHeaders(opts.Header); err != nil { |
| 2779 | return err |
| 2780 | } |
| 2781 | |
| 2782 | // The RFC effectively limits promised requests to GET and HEAD: |
| 2783 | // "Promised requests MUST be cacheable [GET, HEAD, or POST], and MUST be safe [GET or HEAD]" |
| 2784 | // http://tools.ietf.org/html/rfc7540#section-8.2 |
| 2785 | if opts.Method != "GET" && opts.Method != "HEAD" { |
| 2786 | return fmt.Errorf("method %q must be GET or HEAD", opts.Method) |
| 2787 | } |
| 2788 | |
| 2789 | msg := &startPushRequest{ |
| 2790 | parent: st, |
| 2791 | method: opts.Method, |
| 2792 | url: u, |
| 2793 | header: cloneHeader(opts.Header), |
| 2794 | done: errChanPool.Get().(chan error), |
| 2795 | } |
| 2796 | |
| 2797 | select { |
| 2798 | case <-sc.doneServing: |
| 2799 | return errClientDisconnected |
| 2800 | case <-st.cw: |
| 2801 | return errStreamClosed |
| 2802 | case sc.serveMsgCh <- msg: |
| 2803 | } |
| 2804 | |
| 2805 | select { |
| 2806 | case <-sc.doneServing: |
| 2807 | return errClientDisconnected |
| 2808 | case <-st.cw: |
| 2809 | return errStreamClosed |
| 2810 | case err := <-msg.done: |
| 2811 | errChanPool.Put(msg.done) |
| 2812 | return err |
| 2813 | } |
| 2814 | } |
| 2815 | |
| 2816 | type startPushRequest struct { |
| 2817 | parent *stream |
| 2818 | method string |
| 2819 | url *url.URL |
| 2820 | header http.Header |
| 2821 | done chan error |
| 2822 | } |
| 2823 | |
| 2824 | func (sc *serverConn) startPush(msg *startPushRequest) { |
| 2825 | sc.serveG.check() |
| 2826 | |
| 2827 | // http://tools.ietf.org/html/rfc7540#section-6.6. |
| 2828 | // PUSH_PROMISE frames MUST only be sent on a peer-initiated stream that |
| 2829 | // is in either the "open" or "half-closed (remote)" state. |
| 2830 | if msg.parent.state != stateOpen && msg.parent.state != stateHalfClosedRemote { |
| 2831 | // responseWriter.Push checks that the stream is peer-initiated. |
| 2832 | msg.done <- errStreamClosed |
| 2833 | return |
| 2834 | } |
| 2835 | |
| 2836 | // http://tools.ietf.org/html/rfc7540#section-6.6. |
| 2837 | if !sc.pushEnabled { |
| 2838 | msg.done <- http.ErrNotSupported |
| 2839 | return |
| 2840 | } |
| 2841 | |
| 2842 | // PUSH_PROMISE frames must be sent in increasing order by stream ID, so |
| 2843 | // we allocate an ID for the promised stream lazily, when the PUSH_PROMISE |
| 2844 | // is written. Once the ID is allocated, we start the request handler. |
| 2845 | allocatePromisedID := func() (uint32, error) { |
| 2846 | sc.serveG.check() |
| 2847 | |
| 2848 | // Check this again, just in case. Technically, we might have received |
| 2849 | // an updated SETTINGS by the time we got around to writing this frame. |
| 2850 | if !sc.pushEnabled { |
| 2851 | return 0, http.ErrNotSupported |
| 2852 | } |
| 2853 | // http://tools.ietf.org/html/rfc7540#section-6.5.2. |
| 2854 | if sc.curPushedStreams+1 > sc.clientMaxStreams { |
| 2855 | return 0, ErrPushLimitReached |
| 2856 | } |
| 2857 | |
| 2858 | // http://tools.ietf.org/html/rfc7540#section-5.1.1. |
| 2859 | // Streams initiated by the server MUST use even-numbered identifiers. |
| 2860 | // A server that is unable to establish a new stream identifier can send a GOAWAY |
| 2861 | // frame so that the client is forced to open a new connection for new streams. |
| 2862 | if sc.maxPushPromiseID+2 >= 1<<31 { |
| 2863 | sc.startGracefulShutdownInternal() |
| 2864 | return 0, ErrPushLimitReached |
| 2865 | } |
| 2866 | sc.maxPushPromiseID += 2 |
| 2867 | promisedID := sc.maxPushPromiseID |
| 2868 | |
| 2869 | // http://tools.ietf.org/html/rfc7540#section-8.2. |
| 2870 | // Strictly speaking, the new stream should start in "reserved (local)", then |
| 2871 | // transition to "half closed (remote)" after sending the initial HEADERS, but |
| 2872 | // we start in "half closed (remote)" for simplicity. |
| 2873 | // See further comments at the definition of stateHalfClosedRemote. |
| 2874 | promised := sc.newStream(promisedID, msg.parent.id, stateHalfClosedRemote) |
| 2875 | rw, req, err := sc.newWriterAndRequestNoBody(promised, requestParam{ |
| 2876 | method: msg.method, |
| 2877 | scheme: msg.url.Scheme, |
| 2878 | authority: msg.url.Host, |
| 2879 | path: msg.url.RequestURI(), |
| 2880 | header: cloneHeader(msg.header), // clone since handler runs concurrently with writing the PUSH_PROMISE |
| 2881 | }) |
| 2882 | if err != nil { |
| 2883 | // Should not happen, since we've already validated msg.url. |
| 2884 | panic(fmt.Sprintf("newWriterAndRequestNoBody(%+v): %v", msg.url, err)) |
| 2885 | } |
| 2886 | |
| 2887 | go sc.runHandler(rw, req, sc.handler.ServeHTTP) |
| 2888 | return promisedID, nil |
| 2889 | } |
| 2890 | |
| 2891 | sc.writeFrame(FrameWriteRequest{ |
| 2892 | write: &writePushPromise{ |
| 2893 | streamID: msg.parent.id, |
| 2894 | method: msg.method, |
| 2895 | url: msg.url, |
| 2896 | h: msg.header, |
| 2897 | allocatePromisedID: allocatePromisedID, |
| 2898 | }, |
| 2899 | stream: msg.parent, |
| 2900 | done: msg.done, |
| 2901 | }) |
| 2902 | } |
| 2903 | |
| 2904 | // foreachHeaderElement splits v according to the "#rule" construction |
| 2905 | // in RFC 7230 section 7 and calls fn for each non-empty element. |
| 2906 | func foreachHeaderElement(v string, fn func(string)) { |
| 2907 | v = textproto.TrimString(v) |
| 2908 | if v == "" { |
| 2909 | return |
| 2910 | } |
| 2911 | if !strings.Contains(v, ",") { |
| 2912 | fn(v) |
| 2913 | return |
| 2914 | } |
| 2915 | for _, f := range strings.Split(v, ",") { |
| 2916 | if f = textproto.TrimString(f); f != "" { |
| 2917 | fn(f) |
| 2918 | } |
| 2919 | } |
| 2920 | } |
| 2921 | |
| 2922 | // From http://httpwg.org/specs/rfc7540.html#rfc.section.8.1.2.2 |
| 2923 | var connHeaders = []string{ |
| 2924 | "Connection", |
| 2925 | "Keep-Alive", |
| 2926 | "Proxy-Connection", |
| 2927 | "Transfer-Encoding", |
| 2928 | "Upgrade", |
| 2929 | } |
| 2930 | |
| 2931 | // checkValidHTTP2RequestHeaders checks whether h is a valid HTTP/2 request, |
| 2932 | // per RFC 7540 Section 8.1.2.2. |
| 2933 | // The returned error is reported to users. |
| 2934 | func checkValidHTTP2RequestHeaders(h http.Header) error { |
| 2935 | for _, k := range connHeaders { |
| 2936 | if _, ok := h[k]; ok { |
| 2937 | return fmt.Errorf("request header %q is not valid in HTTP/2", k) |
| 2938 | } |
| 2939 | } |
| 2940 | te := h["Te"] |
| 2941 | if len(te) > 0 && (len(te) > 1 || (te[0] != "trailers" && te[0] != "")) { |
| 2942 | return errors.New(`request header "TE" may only be "trailers" in HTTP/2`) |
| 2943 | } |
| 2944 | return nil |
| 2945 | } |
| 2946 | |
| 2947 | func new400Handler(err error) http.HandlerFunc { |
| 2948 | return func(w http.ResponseWriter, r *http.Request) { |
| 2949 | http.Error(w, err.Error(), http.StatusBadRequest) |
| 2950 | } |
| 2951 | } |
| 2952 | |
| 2953 | // h1ServerKeepAlivesDisabled reports whether hs has its keep-alives |
| 2954 | // disabled. See comments on h1ServerShutdownChan above for why |
| 2955 | // the code is written this way. |
| 2956 | func h1ServerKeepAlivesDisabled(hs *http.Server) bool { |
| 2957 | var x interface{} = hs |
| 2958 | type I interface { |
| 2959 | doKeepAlives() bool |
| 2960 | } |
| 2961 | if hs, ok := x.(I); ok { |
| 2962 | return !hs.doKeepAlives() |
| 2963 | } |
| 2964 | return false |
| 2965 | } |