%% Copyright (c) 2018-2019, Loïc Hoguin %% %% Permission to use, copy, modify, and/or distribute this software for any %% purpose with or without fee is hereby granted, provided that the above %% copyright notice and this permission notice appear in all copies. %% %% THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES %% WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF %% MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR %% ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES %% WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN %% ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF %% OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. -module(rfc7540_SUITE). -compile(export_all). -compile(nowarn_export_all). -import(ct_helper, [doc/1]). -import(gun_test, [init_origin/2]). -import(gun_test, [init_origin/3]). -import(gun_test, [receive_from/1]). all() -> ct_helper:all(?MODULE). %% Proxy helpers. -record(proxy_stream, { id, status, resp_headers = [], delay = 0, origin_socket }). -record(proxy, { parent, socket, transport, streams = [], decode_state = cow_hpack:init(), encode_state = cow_hpack:init() }). do_proxy_start(Transport) -> do_proxy_start(Transport, [#proxy_stream{id=1, status=200, resp_headers=[], delay=0}]). do_proxy_start(Transport0, Streams) -> Transport = case Transport0 of tcp -> gun_tcp; tls -> gun_tls end, Proxy = #proxy{parent=self(), transport=Transport, streams=Streams}, Pid = spawn_link(fun() -> do_proxy_init(Proxy) end), Port = receive_from(Pid), {ok, Pid, Port}. do_proxy_init(Proxy=#proxy{parent=Parent, transport=Transport}) -> {ok, ListenSocket} = case Transport of gun_tcp -> gen_tcp:listen(0, [binary, {active, false}]); gun_tls -> Opts = ct_helper:get_certs_from_ets(), ssl:listen(0, [binary, {active, false}|Opts]) end, {ok, {_, Port}} = Transport:sockname(ListenSocket), Parent ! {self(), Port}, {ok, Socket} = case Transport of gun_tcp -> gen_tcp:accept(ListenSocket, 5000); gun_tls -> {ok, Socket0} = ssl:transport_accept(ListenSocket, 5000), ssl:handshake(Socket0, 5000), {ok, <<"h2">>} = ssl:negotiated_protocol(Socket0), {ok, Socket0} end, gun_test:http2_handshake(Socket, case Transport of gun_tcp -> gen_tcp; gun_tls -> ssl end), Parent ! {self(), handshake_completed}, Transport:setopts(Socket, [{active, true}]), do_proxy_receive(<<>>, Proxy#proxy{socket=Socket}). do_proxy_receive(Buffer, Proxy=#proxy{socket=Socket, transport=Transport}) -> {OK, _, _} = Transport:messages(), receive {OK, Socket, Data0} -> do_proxy_parse(<>, Proxy); {tcp, OriginSocket, OriginData} -> do_proxy_forward(Buffer, Proxy, OriginSocket, OriginData); {tcp_closed, _} -> ok; {ssl_closed, _} -> ok; Msg -> error(Msg) end. %% We only expect to receive data on a CONNECT stream. do_proxy_parse(<>, Proxy=#proxy{streams=Streams}) -> #proxy_stream{origin_socket=OriginSocket} = lists:keyfind(StreamID, #proxy_stream.id, Streams), case gen_tcp:send(OriginSocket, Payload) of ok -> do_proxy_parse(Rest, Proxy); {error, _} -> ok end; do_proxy_parse(<>, Proxy=#proxy{parent=Parent, socket=Socket, transport=Transport, streams=Streams0, decode_state=DecodeState0, encode_state=EncodeState0}) -> #proxy_stream{status=Status, resp_headers=RespHeaders, delay=Delay} = Stream = lists:keyfind(StreamID, #proxy_stream.id, Streams0), {ReqHeaders0, DecodeState} = cow_hpack:decode(ReqHeadersBlock, DecodeState0), ReqHeaders = maps:from_list(ReqHeaders0), timer:sleep(Delay), Parent ! {self(), {request, ReqHeaders}}, {IsFin, OriginSocket} = case ReqHeaders of #{<<":method">> := <<"CONNECT">>, <<":authority">> := Authority} when Status >= 200, Status < 300 -> {OriginHost, OriginPort} = cow_http_hd:parse_host(Authority), {ok, OriginSocket0} = gen_tcp:connect( binary_to_list(OriginHost), OriginPort, [binary, {active, true}]), {nofin, OriginSocket0}; #{} -> {fin, undefined} end, {RespHeadersBlock, EncodeState} = cow_hpack:encode([ {<<":status">>, integer_to_binary(Status)} |RespHeaders], EncodeState0), ok = Transport:send(Socket, [ cow_http2:headers(StreamID, IsFin, RespHeadersBlock) ]), Streams = lists:keystore(StreamID, #proxy_stream.id, Streams0, Stream#proxy_stream{origin_socket=OriginSocket}), do_proxy_parse(Rest, Proxy#proxy{streams=Streams, decode_state=DecodeState, encode_state=EncodeState}); do_proxy_parse(<>, Proxy) -> ct:pal("Ignoring packet header ~0p~npayload ~p", [Header, Payload]), do_proxy_parse(Rest, Proxy); do_proxy_parse(Rest, Proxy) -> do_proxy_receive(Rest, Proxy). do_proxy_forward(Buffer, Proxy=#proxy{socket=Socket, transport=Transport, streams=Streams}, OriginSocket, OriginData) -> #proxy_stream{id=StreamID} = lists:keyfind(OriginSocket, #proxy_stream.origin_socket, Streams), Len = byte_size(OriginData), Data = [<>, OriginData], case Transport:send(Socket, Data) of ok -> do_proxy_receive(Buffer, Proxy); {error, _} -> ok end. %% Tests. authority_default_port_http(_) -> doc("The default port for http should not be sent in " "the :authority pseudo-header. (RFC7540 3, RFC7230 2.7.1)"), do_authority_port(tcp, 80, <<>>). authority_default_port_https(_) -> doc("The default port for https should not be sent in " "the :authority pseudo-header. (RFC7540 3, RFC7230 2.7.2)"), do_authority_port(tls, 443, <<>>). authority_ipv6(_) -> doc("When connecting to a server using an IPv6 address the :authority " "pseudo-header must wrap the address with brackets. (RFC7540 8.1.2.3, RFC3986 3.2.2)"), {ok, OriginPid, OriginPort} = init_origin(tcp6, http2, fun(Parent, Socket, Transport) -> %% Receive the HEADERS frame and send the headers decoded. {ok, <>} = Transport:recv(Socket, 9, 1000), {ok, ReqHeadersBlock} = Transport:recv(Socket, Len, 1000), {ReqHeaders, _} = cow_hpack:decode(ReqHeadersBlock), Parent ! {self(), ReqHeaders} end), {ok, ConnPid} = gun:open({0,0,0,0,0,0,0,1}, OriginPort, #{ transport => tcp, protocols => [http2] }), {ok, http2} = gun:await_up(ConnPid), handshake_completed = receive_from(OriginPid), _ = gun:get(ConnPid, "/"), ReqHeaders = receive_from(OriginPid), {_, <<"[::1]", _/bits>>} = lists:keyfind(<<":authority">>, 1, ReqHeaders), gun:close(ConnPid). authority_other_port_http(_) -> doc("Non-default ports for http must be sent in " "the :authority pseudo-header. (RFC7540 3, RFC7230 2.7.1)"), do_authority_port(tcp, 443, <<":443">>). authority_other_port_https(_) -> doc("Non-default ports for https must be sent in " "the :authority pseudo-header. (RFC7540 3, RFC7230 2.7.2)"), do_authority_port(tls, 80, <<":80">>). do_authority_port(Transport0, DefaultPort, AuthorityHeaderPort) -> {ok, OriginPid, OriginPort} = init_origin(Transport0, http2, fun(Parent, Socket, Transport) -> %% Receive the HEADERS frame and send the headers decoded. {ok, <>} = Transport:recv(Socket, 9, 1000), {ok, ReqHeadersBlock} = Transport:recv(Socket, Len, 1000), {ReqHeaders, _} = cow_hpack:decode(ReqHeadersBlock), Parent ! {self(), ReqHeaders} end), {ok, ConnPid} = gun:open("localhost", OriginPort, #{ transport => Transport0, protocols => [http2] }), {ok, http2} = gun:await_up(ConnPid), handshake_completed = receive_from(OriginPid), %% Change the origin's port in the state to trigger the default port behavior. _ = sys:replace_state(ConnPid, fun({StateName, StateData}) -> {StateName, setelement(8, StateData, DefaultPort)} end, 5000), %% Confirm the default port is not sent in the request. _ = gun:get(ConnPid, "/"), ReqHeaders = receive_from(OriginPid), {_, <<"localhost", Rest/bits>>} = lists:keyfind(<<":authority">>, 1, ReqHeaders), AuthorityHeaderPort = Rest, gun:close(ConnPid). prior_knowledge_preface_garbage(_) -> doc("A PROTOCOL_ERROR connection error must result from the server sending " "an invalid preface in the form of garbage when connecting " "using the prior knowledge method. (RFC7540 3.4, RFC7540 3.5)"), %% We use 'http' here because we are going to do the handshake manually. {ok, OriginPid, Port} = init_origin(tcp, http, fun(_, Socket, Transport) -> ok = Transport:send(Socket, <<0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15>>), timer:sleep(100) end), {ok, ConnPid} = gun:open("localhost", Port, #{protocols => [http2]}), {ok, http2} = gun:await_up(ConnPid), handshake_completed = receive_from(OriginPid), receive {gun_down, ConnPid, http2, {error, {connection_error, protocol_error, 'Invalid connection preface received. (RFC7540 3.5)'}}, []} -> gun:close(ConnPid); Msg -> error({unexpected_msg, Msg}) after 1000 -> error(timeout) end. prior_knowledge_preface_http1(_) -> doc("A PROTOCOL_ERROR connection error must result from the server sending " "an invalid preface in the form of an HTTP/1.1 response when connecting " "using the prior knowledge method. (RFC7540 3.4, RFC7540 3.5)"), %% We use 'http' here because we are going to do the handshake manually. {ok, OriginPid, Port} = init_origin(tcp, http, fun(_, Socket, Transport) -> ok = Transport:send(Socket, << "HTTP/1.1 400 Bad Request\r\n" "Connection: close\r\n" "Content-Length: 0\r\n" "Date: Thu, 27 Feb 2020 09:32:17 GMT\r\n" "\r\n">>), timer:sleep(100) end), {ok, ConnPid} = gun:open("localhost", Port, #{protocols => [http2]}), {ok, http2} = gun:await_up(ConnPid), handshake_completed = receive_from(OriginPid), receive {gun_down, ConnPid, http2, {error, {connection_error, protocol_error, 'Invalid connection preface received. Appears to be an HTTP/1 response? (RFC7540 3.5)'}}, []} -> gun:close(ConnPid); Msg -> error({unexpected_msg, Msg}) after 1000 -> error(timeout) end. prior_knowledge_preface_http1_await(_) -> doc("A PROTOCOL_ERROR connection error must result from the server sending " "an invalid preface in the form of an HTTP/1.1 response when connecting " "using the prior knowledge method. (RFC7540 3.4, RFC7540 3.5)"), %% We use 'http' here because we are going to do the handshake manually. {ok, OriginPid, Port} = init_origin(tcp, http, fun(_, Socket, Transport) -> timer:sleep(100), ok = Transport:send(Socket, << "HTTP/1.1 400 Bad Request\r\n" "Connection: close\r\n" "Content-Length: 0\r\n" "Date: Thu, 27 Feb 2020 09:32:17 GMT\r\n" "\r\n">>), timer:sleep(100) end), {ok, ConnPid} = gun:open("localhost", Port, #{protocols => [http2], retry => 0}), {ok, http2} = gun:await_up(ConnPid), handshake_completed = receive_from(OriginPid), {error, {down, {shutdown, {error, {connection_error, protocol_error, 'Invalid connection preface received. Appears to be an HTTP/1 response? (RFC7540 3.5)'}}}}} = gun:await(ConnPid, make_ref()), gun:close(ConnPid). prior_knowledge_preface_other_frame(_) -> doc("A PROTOCOL_ERROR connection error must result from the server sending " "an invalid preface in the form of a non-SETTINGS frame when connecting " "using the prior knowledge method. (RFC7540 3.4, RFC7540 3.5)"), %% We use 'http' here because we are going to do the handshake manually. {ok, OriginPid, Port} = init_origin(tcp, http, fun(_, Socket, Transport) -> ok = Transport:send(Socket, cow_http2:window_update(1)), timer:sleep(100) end), {ok, ConnPid} = gun:open("localhost", Port, #{protocols => [http2]}), {ok, http2} = gun:await_up(ConnPid), handshake_completed = receive_from(OriginPid), receive {gun_down, ConnPid, http2, {error, {connection_error, protocol_error, 'Invalid connection preface received. (RFC7540 3.5)'}}, []} -> gun:close(ConnPid); Msg -> error({unexpected_msg, Msg}) after 1000 -> error(timeout) end. lingering_data_counts_toward_connection_window(_) -> doc("DATA frames received after sending RST_STREAM must be counted " "toward the connection flow-control window. (RFC7540 5.1)"), {ok, OriginPid, Port} = init_origin(tcp, http2, fun(_, Socket, Transport) -> %% Step 2. %% Receive a HEADERS frame. {ok, <>} = Transport:recv(Socket, 9, 1000), %% Skip the header. {ok, _} = gen_tcp:recv(Socket, SkipLen, 1000), %% Step 3. %% Send a HEADERS frame. {HeadersBlock, _} = cow_hpack:encode([ {<<":status">>, <<"200">>} ]), ok = Transport:send(Socket, [ cow_http2:headers(1, nofin, HeadersBlock) ]), %% Step 5. %% Make sure Gun sends the RST_STREAM. timer:sleep(100), %% Step 7. ok = Transport:send(Socket, [ cow_http2:data(1, nofin, <<0:0/unit:8>>), cow_http2:data(1, nofin, <<0:1000/unit:8>>) ]), %% Skip RST_STREAM. {ok, << 4:24, 3:8, 1:40, _:32 >>} = gen_tcp:recv(Socket, 13, 1000), %% Received a WINDOW_UPDATE frame after we got RST_STREAM. {ok, << 4:24, 8:8, 0:40, Increment:32 >>} = gen_tcp:recv(Socket, 13, 1000), true = Increment > 0 end), {ok, ConnPid} = gun:open("localhost", Port, #{ protocols => [http2], http2_opts => #{ %% We don't set 65535 because we still want to have an initial WINDOW_UPDATE. initial_connection_window_size => 65536, initial_stream_window_size => 65535 } }), {ok, http2} = gun:await_up(ConnPid), handshake_completed = receive_from(OriginPid), %% Step 1. StreamRef = gun:get(ConnPid, "/"), %% Step 4. {response, nofin, 200, _} = gun:await(ConnPid, StreamRef), %% Step 6. gun:cancel(ConnPid, StreamRef), %% Make sure Gun sends the WINDOW_UPDATE and the server test passes. timer:sleep(300), gun:close(ConnPid). headers_priority_flag(_) -> doc("HEADERS frames may include a PRIORITY flag indicating " "that stream dependency information is attached. (RFC7540 6.2)"), {ok, OriginPid, Port} = init_origin(tcp, http2, fun(_, Socket, Transport) -> %% Receive a HEADERS frame. {ok, <<_:24, 1:8, _:8, 1:32>>} = Transport:recv(Socket, 9, 1000), %% Send a HEADERS frame with PRIORITY back. {HeadersBlock, _} = cow_hpack:encode([ {<<":status">>, <<"200">>} ]), Len = iolist_size(HeadersBlock) + 5, ok = Transport:send(Socket, [ <>, %% Weight. HeadersBlock ]), timer:sleep(1000) end), {ok, ConnPid} = gun:open("localhost", Port, #{protocols => [http2]}), {ok, http2} = gun:await_up(ConnPid), handshake_completed = receive_from(OriginPid), StreamRef = gun:get(ConnPid, "/"), {response, fin, 200, _} = gun:await(ConnPid, StreamRef), gun:close(ConnPid). settings_ack_timeout(_) -> doc("Failure to acknowledge the client's SETTINGS frame " "results in a SETTINGS_TIMEOUT connection error. (RFC7540 6.5.3)"), %% We use 'http' here because we are going to do the handshake manually. {ok, _, Port} = init_origin(tcp, http, fun(_, Socket, Transport) -> %% Send a valid preface. ok = Transport:send(Socket, cow_http2:settings(#{})), %% Receive the fixed sequence from the preface. Preface = <<"PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n">>, {ok, Preface} = Transport:recv(Socket, byte_size(Preface), 5000), %% Receive the SETTINGS from the preface. {ok, <>} = Transport:recv(Socket, 3, 5000), {ok, <<4:8, 0:40, _:Len/binary>>} = Transport:recv(Socket, 6 + Len, 5000), %% Receive the WINDOW_UPDATE sent with the preface. {ok, <<4:24, 8:8, 0:40, _:32>>} = Transport:recv(Socket, 13, 5000), %% Receive the SETTINGS ack. {ok, <<0:24, 4:8, 1:8, 0:32>>} = Transport:recv(Socket, 9, 5000), %% Do not ack the client preface. Expect a GOAWAY with reason SETTINGS_TIMEOUT. {ok, << _:24, 7:8, _:72, 4:32 >>} = Transport:recv(Socket, 17, 6000) end), {ok, ConnPid} = gun:open("localhost", Port, #{protocols => [http2]}), {ok, http2} = gun:await_up(ConnPid), timer:sleep(6000), gun:close(ConnPid). connect_http(_) -> doc("CONNECT can be used to establish a TCP connection " "to an HTTP/1.1 server via a TCP HTTP/2 proxy. (RFC7540 8.3)"), do_connect_http(<<"http">>, tcp, <<"http">>, tcp). do_connect_http(OriginScheme, OriginTransport, ProxyScheme, ProxyTransport) -> {ok, OriginPid, OriginPort} = init_origin(OriginTransport, http), {ok, ProxyPid, ProxyPort} = do_proxy_start(ProxyTransport, [ #proxy_stream{id=1, status=200} ]), Authority = iolist_to_binary(["localhost:", integer_to_binary(OriginPort)]), {ok, ConnPid} = gun:open("localhost", ProxyPort, #{ transport => ProxyTransport, protocols => [http2] }), {ok, http2} = gun:await_up(ConnPid), handshake_completed = receive_from(ProxyPid), StreamRef = gun:connect(ConnPid, #{ host => "localhost", port => OriginPort, transport => OriginTransport }), {request, #{ <<":method">> := <<"CONNECT">>, <<":authority">> := Authority }} = receive_from(ProxyPid), {response, nofin, 200, _} = gun:await(ConnPid, StreamRef), handshake_completed = receive_from(OriginPid), ProxiedStreamRef = gun:get(ConnPid, "/proxied", #{}, #{tunnel => StreamRef}), Data = receive_from(OriginPid), Lines = binary:split(Data, <<"\r\n">>, [global]), [<<"host: ", Authority/bits>>] = [L || <<"host: ", _/bits>> = L <- Lines], #{ transport := ProxyTransport, protocol := http2, origin_scheme := ProxyScheme, origin_host := "localhost", origin_port := ProxyPort, intermediaries := [] %% Intermediaries are specific to the CONNECT stream. } = gun:info(ConnPid), {ok, #{ ref := StreamRef, reply_to := Self, state := running, tunnel := #{ transport := OriginTransport, protocol := http, origin_scheme := OriginScheme, origin_host := "localhost", origin_port := OriginPort } }} = gun:stream_info(ConnPid, StreamRef), {ok, #{ ref := ProxiedStreamRef, reply_to := Self, state := running }} = gun:stream_info(ConnPid, ProxiedStreamRef), gun:close(ConnPid).