Merge pull request #1762 from nghttp2/bump-llhttp

Bump llhttp

integration-tests/nghttpx_http1_test.go

@@ -91,13 +91,8 @@ func TestH1H1MultipleRequestCL(t *testing.T) {
 	st := newServerTester(t, opts)
 	defer st.Close()
 
-	if _, err := io.WriteString(st.conn, fmt.Sprintf(`GET / HTTP/1.1
+	if _, err := io.WriteString(st.conn, fmt.Sprintf("GET / HTTP/1.1\r\nHost: %v\r\nTest-Case: TestH1H1MultipleRequestCL\r\nContent-Length: 0\r\nContent-Length: 0\r\n\r\n",
-Host: %v
+		st.authority)); err != nil {
-Test-Case: TestH1H1MultipleRequestCL
-Content-Length: 0
-Content-Length: 0
-
-`, st.authority)); err != nil {
 		t.Fatalf("Error io.WriteString() = %v", err)
 	}
 
@@ -1309,12 +1304,8 @@ func TestH1ResponseBeforeRequestEnd(t *testing.T) {
 	st := newServerTester(t, opts)
 	defer st.Close()
 
-	if _, err := io.WriteString(st.conn, fmt.Sprintf(`POST / HTTP/1.1
+	if _, err := io.WriteString(st.conn, fmt.Sprintf("POST / HTTP/1.1\r\nHost: %v\r\nTest-Case: TestH1ResponseBeforeRequestEnd\r\nContent-Length: 1000000\r\n\r\n",
-Host: %v
+		st.authority)); err != nil {
-Test-Case: TestH1ResponseBeforeRequestEnd
-Content-Length: 1000000
-
-`, st.authority)); err != nil {
 		t.Fatalf("Error io.WriteString() = %v", err)
 	}
 

third-party/llhttp/include/llhttp.h

@@ -3,7 +3,7 @@
 
 #define LLHTTP_VERSION_MAJOR 6
 #define LLHTTP_VERSION_MINOR 0
-#define LLHTTP_VERSION_PATCH 6
+#define LLHTTP_VERSION_PATCH 7
 
 #ifndef LLHTTP_STRICT_MODE
 # define LLHTTP_STRICT_MODE 0
@@ -59,6 +59,7 @@ enum llhttp_errno {
   HPE_OK = 0,
   HPE_INTERNAL = 1,
   HPE_STRICT = 2,
+  HPE_CR_EXPECTED = 25,
   HPE_LF_EXPECTED = 3,
   HPE_UNEXPECTED_CONTENT_LENGTH = 4,
   HPE_CLOSED_CONNECTION = 5,
@@ -100,7 +101,8 @@ typedef enum llhttp_flags llhttp_flags_t;
 enum llhttp_lenient_flags {
   LENIENT_HEADERS = 0x1,
   LENIENT_CHUNKED_LENGTH = 0x2,
-  LENIENT_KEEP_ALIVE = 0x4
+  LENIENT_KEEP_ALIVE = 0x4,
+  LENIENT_TRANSFER_ENCODING = 0x8
 };
 typedef enum llhttp_lenient_flags llhttp_lenient_flags_t;
 
@@ -172,6 +174,7 @@ typedef enum llhttp_method llhttp_method_t;
   XX(0, OK, OK) \
   XX(1, INTERNAL, INTERNAL) \
   XX(2, STRICT, STRICT) \
+  XX(25, CR_EXPECTED, CR_EXPECTED) \
   XX(3, LF_EXPECTED, LF_EXPECTED) \
   XX(4, UNEXPECTED_CONTENT_LENGTH, UNEXPECTED_CONTENT_LENGTH) \
   XX(5, CLOSED_CONNECTION, CLOSED_CONNECTION) \
@@ -552,6 +555,19 @@ void llhttp_set_lenient_chunked_length(llhttp_t* parser, int enabled);
  */
 void llhttp_set_lenient_keep_alive(llhttp_t* parser, int enabled);
 
+/* Enables/disables lenient handling of `Transfer-Encoding` header.
+ *
+ * Normally `llhttp` would error when a `Transfer-Encoding` has `chunked` value
+ * and another value after it (either in a single header or in multiple
+ * headers whose value are internally joined using `, `).
+ * This is mandated by the spec to reliably determine request body size and thus
+ * avoid request smuggling.
+ * With this flag the extra value will be parsed normally.
+ *
+ * **(USE AT YOUR OWN RISK)**
+ */
+void llhttp_set_lenient_transfer_encoding(llhttp_t* parser, int enabled);
+
 #ifdef __cplusplus
 }  /* extern "C" */
 #endif

third-party/llhttp/src/api.c

@@ -253,6 +253,14 @@ void llhttp_set_lenient_keep_alive(llhttp_t* parser, int enabled) {
   }
 }
 
+void llhttp_set_lenient_transfer_encoding(llhttp_t* parser, int enabled) {
+  if (enabled) {
+    parser->lenient_flags |= LENIENT_TRANSFER_ENCODING;
+  } else {
+    parser->lenient_flags &= ~LENIENT_TRANSFER_ENCODING;
+  }
+}
+
 /* Callbacks */
 
 

third-party/llhttp/src/http.c

@@ -52,7 +52,8 @@ int llhttp__after_headers_complete(llhttp_t* parser, const char* p,
     return 2;
   } else if (parser->flags & F_TRANSFER_ENCODING) {
     if (parser->type == HTTP_REQUEST &&
-        (parser->lenient_flags & LENIENT_CHUNKED_LENGTH) == 0) {
+        (parser->lenient_flags & LENIENT_CHUNKED_LENGTH) == 0 &&
+        (parser->lenient_flags & LENIENT_TRANSFER_ENCODING) == 0) {
       /* RFC 7230 3.3.3 */
 
       /* If a Transfer-Encoding header field