Land recent SPDY changes (through 67282679)

net/spdy/spdy_framer.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/spdy/spdy_framer.h"
 
 #include "base/lazy_instance.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/metrics/stats_counters.h"
 #include "base/third_party/valgrind/memcheck.h"
 #include "net/spdy/spdy_frame_builder.h"
 #include "net/spdy/spdy_frame_reader.h"
 #include "net/spdy/spdy_bitmasks.h"
 #include "third_party/zlib/zlib.h"
 
+using base::StringPiece;
 using std::string;
 using std::vector;
 
 namespace net {
 
 namespace {
 
 // Compute the id of our dictionary so that we know we're using the
 // right one when asked for it.
 uLong CalculateDictionaryId(const char* dictionary,
@@ skipping 17 matching lines @@
 // initialized lazily to avoid static initializers.
 base::LazyInstance<DictionaryIds>::Leaky g_dictionary_ids;
 
 // Used to indicate no flags in a SPDY flags field.
 const uint8 kNoFlags = 0;
 
 }  // namespace
 
 const SpdyStreamId SpdyFramer::kInvalidStream = -1;
 const size_t SpdyFramer::kHeaderDataChunkMaxSize = 1024;
-// The size of the control frame buffer. Must be >= the minimum size of the
 // largest control frame, which is SYN_STREAM. See GetSynStreamMinimumSize() for
 // calculation details.
 const size_t SpdyFramer::kControlFrameBufferSize = 18;
 
 #ifdef DEBUG_SPDY_STATE_CHANGES
 #define CHANGE_STATE(newstate)                                  \
   do {                                                          \
     DVLOG(1) << "Changing state from: "                         \
              << StateToString(state_)                           \
              << " to " << StateToString(newstate) << "\n";      \
@@ skipping 38 matching lines @@
 // This method is used to preserve buggy behavior and works on both
 // little-endian and big-endian hosts.
 // This method is also bidirectional (can be used to translate SPDY 2 to SPDY 3
 // as well as vice versa).
 void SettingsFlagsAndId::ConvertFlagsAndIdForSpdy2(uint32* val) {
     uint8* wire_array = reinterpret_cast<uint8*>(val);
     std::swap(wire_array[0], wire_array[3]);
     std::swap(wire_array[1], wire_array[2]);
 }
 
+SpdyAltSvcScratch::SpdyAltSvcScratch() { Reset(); }
+SpdyAltSvcScratch::~SpdyAltSvcScratch() {}
+
 bool SpdyFramerVisitorInterface::OnGoAwayFrameData(const char* goaway_data,
                                                    size_t len) {
   return true;
 }
 
 bool SpdyFramerVisitorInterface::OnRstStreamFrameData(
     const char* rst_stream_data,
     size_t len) {
   return true;
 }
 
 SpdyFramer::SpdyFramer(SpdyMajorVersion version)
     : current_frame_buffer_(new char[kControlFrameBufferSize]),
       enable_compression_(true),
       visitor_(NULL),
       debug_visitor_(NULL),
       display_protocol_("SPDY"),
       spdy_version_(version),
       syn_frame_processed_(false),
       probable_http_response_(false),
       expect_continuation_(0),
       end_stream_when_done_(false) {
   DCHECK_GE(spdy_version_, SPDY_MIN_VERSION);
   DCHECK_LE(spdy_version_, SPDY_MAX_VERSION);
   Reset();
-
-  // SPDY4 and up use HPACK. Allocate instances for these protocol versions.
-  if (spdy_version_ > SPDY3) {
-    hpack_encoder_.reset(new HpackEncoder(ObtainHpackHuffmanTable()));
-    hpack_decoder_.reset(new HpackDecoder(ObtainHpackHuffmanTable()));
-  }
 }
 
 SpdyFramer::~SpdyFramer() {
   if (header_compressor_.get()) {
     deflateEnd(header_compressor_.get());
   }
   if (header_decompressor_.get()) {
     inflateEnd(header_decompressor_.get());
   }
 }
 
 void SpdyFramer::Reset() {
   state_ = SPDY_RESET;
   previous_state_ = SPDY_RESET;
   error_code_ = SPDY_NO_ERROR;
   remaining_data_length_ = 0;
   remaining_control_header_ = 0;
   current_frame_buffer_length_ = 0;
   current_frame_type_ = DATA;
   current_frame_flags_ = 0;
   current_frame_length_ = 0;
   current_frame_stream_id_ = kInvalidStream;
   settings_scratch_.Reset();
+  altsvc_scratch_.Reset();
   remaining_padding_payload_length_ = 0;
   remaining_padding_length_fields_ = 0;
 }
 
 size_t SpdyFramer::GetDataFrameMinimumSize() const {
   return SpdyConstants::GetDataFrameMinimumSize();
 }
 
 // Size, in bytes, of the control frame header.
 size_t SpdyFramer::GetControlFrameHeaderSize() const {
@@ skipping 124 matching lines @@
   return GetControlFrameHeaderSize();
 }
 
 size_t SpdyFramer::GetPushPromiseMinimumSize() const {
   DCHECK_LT(SPDY3, protocol_version());
   // Size, in bytes, of a PUSH_PROMISE frame, sans the embedded header block.
   // Calculated as frame prefix + 4 (promised stream id).
   return GetControlFrameHeaderSize() + 4;
 }
 
-size_t SpdyFramer::GetContinuationMinimumSize() const  {
+size_t SpdyFramer::GetContinuationMinimumSize() const {
   // Size, in bytes, of a CONTINUATION frame not including the variable-length
   // headers fragments.
   return GetControlFrameHeaderSize();
 }
 
+size_t SpdyFramer::GetAltSvcMinimumSize() const {
+  // Size, in bytes, of an ALTSVC frame not including the Protocol-ID, Host, and
+  // (optional) Origin fields, all of which can vary in length.
+  // Note that this gives a lower bound on the frame size rather than a true
+  // minimum; the actual frame should always be larger than this.
+  // Calculated as frame prefix + 4 (max-age) + 2 (port) + 1 (reserved byte)
+  // + 1 (pid_len) + 1 (host_len).
+  return GetControlFrameHeaderSize() + 9;
+}
+
+size_t SpdyFramer::GetPrioritySize() const {
+  // Size, in bytes, of a PRIORITY frame.
+  // Calculated as frame prefix + 4 (stream dependency) + 1 (weight)
+  return GetControlFrameHeaderSize() + 5;
+}
+
 size_t SpdyFramer::GetFrameMinimumSize() const {
   return std::min(GetDataFrameMinimumSize(), GetControlFrameHeaderSize());
 }
 
 size_t SpdyFramer::GetFrameMaximumSize() const {
   return SpdyConstants::GetFrameMaximumSize(protocol_version());
 }
 
 size_t SpdyFramer::GetDataFrameMaximumPayload() const {
   return GetFrameMaximumSize() - GetDataFrameMinimumSize();
@@ skipping 26 matching lines @@
     case SPDY_CONTROL_FRAME_BEFORE_HEADER_BLOCK:
       return "SPDY_CONTROL_FRAME_BEFORE_HEADER_BLOCK";
     case SPDY_CONTROL_FRAME_HEADER_BLOCK:
       return "SPDY_CONTROL_FRAME_HEADER_BLOCK";
     case SPDY_GOAWAY_FRAME_PAYLOAD:
       return "SPDY_GOAWAY_FRAME_PAYLOAD";
     case SPDY_RST_STREAM_FRAME_PAYLOAD:
       return "SPDY_RST_STREAM_FRAME_PAYLOAD";
     case SPDY_SETTINGS_FRAME_PAYLOAD:
       return "SPDY_SETTINGS_FRAME_PAYLOAD";
+    case SPDY_ALTSVC_FRAME_PAYLOAD:
+      return "SPDY_ALTSVC_FRAME_PAYLOAD";
   }
   return "UNKNOWN_STATE";
 }
 
 void SpdyFramer::set_error(SpdyError error) {
   DCHECK(visitor_);
   error_code_ = error;
   // These values will usually get reset once we come to the end
   // of a header block, but if we run into an error that
   // might not happen, so reset them here.
@@ skipping 87 matching lines @@
     case WINDOW_UPDATE:
       return "WINDOW_UPDATE";
     case CREDENTIAL:
       return "CREDENTIAL";
     case BLOCKED:
       return "BLOCKED";
     case PUSH_PROMISE:
       return "PUSH_PROMISE";
     case CONTINUATION:
       return "CONTINUATION";
+    case ALTSVC:
+      return "ALTSVC";
+    case PRIORITY:
+      return "PRIORITY";
   }
   return "UNKNOWN_CONTROL_TYPE";
 }
 
 size_t SpdyFramer::ProcessInput(const char* data, size_t len) {
   DCHECK(visitor_);
   DCHECK(data);
 
   size_t original_len = len;
   do {
@@ skipping 59 matching lines @@
         break;
       }
 
       case SPDY_GOAWAY_FRAME_PAYLOAD: {
         size_t bytes_read = ProcessGoAwayFramePayload(data, len);
         len -= bytes_read;
         data += bytes_read;
         break;
       }
 
+      case SPDY_ALTSVC_FRAME_PAYLOAD: {
+        size_t bytes_read = ProcessAltSvcFramePayload(data, len);
+        len -= bytes_read;
+        data += bytes_read;
+        break;
+      }
+
       case SPDY_CONTROL_FRAME_PAYLOAD: {
         size_t bytes_read = ProcessControlFramePayload(data, len);
         len -= bytes_read;
         data += bytes_read;
         break;
       }
 
       case SPDY_READ_PADDING_LENGTH: {
         size_t bytes_read = ProcessFramePaddingLength(data, len);
         len -= bytes_read;
@@ skipping 337 matching lines @@
         size_t min_size = GetHeadersMinimumSize();
         if (protocol_version() > SPDY3 &&
             (current_frame_flags_ & HEADERS_FLAG_PRIORITY)) {
           min_size += 4;
         }
         if (current_frame_length_ < min_size) {
           set_error(SPDY_INVALID_CONTROL_FRAME);
         } else if (protocol_version() <= SPDY3 &&
                    current_frame_flags_ & ~CONTROL_FLAG_FIN) {
           set_error(SPDY_INVALID_CONTROL_FRAME_FLAGS);
-        } else if (protocol_version() > SPDY3 && current_frame_flags_ &
-                   ~(CONTROL_FLAG_FIN | HEADERS_FLAG_PRIORITY |
-                     HEADERS_FLAG_END_HEADERS)) {
+        } else if (protocol_version() > SPDY3 &&
+                   current_frame_flags_ &
+                       ~(CONTROL_FLAG_FIN | HEADERS_FLAG_PRIORITY |
+                         HEADERS_FLAG_END_HEADERS | HEADERS_FLAG_END_SEGMENT |
+                         HEADERS_FLAG_PAD_LOW | HEADERS_FLAG_PAD_HIGH)) {
           set_error(SPDY_INVALID_CONTROL_FRAME_FLAGS);
         }
       }
       break;
     case WINDOW_UPDATE:
       if (current_frame_length_ != GetWindowUpdateSize()) {
         set_error(SPDY_INVALID_CONTROL_FRAME);
       } else if (current_frame_flags_ != 0) {
         set_error(SPDY_INVALID_CONTROL_FRAME_FLAGS);
       }
       break;
     case BLOCKED:
-      if (current_frame_length_ != GetBlockedSize()) {
+      if (current_frame_length_ != GetBlockedSize() ||
+          protocol_version() <= SPDY3) {
+        // TODO(mlavan): BLOCKED frames are no longer part of SPDY4.
         set_error(SPDY_INVALID_CONTROL_FRAME);
       } else if (current_frame_flags_ != 0) {
         set_error(SPDY_INVALID_CONTROL_FRAME_FLAGS);
       }
       break;
     case PUSH_PROMISE:
       if (current_frame_length_ < GetPushPromiseMinimumSize()) {
         set_error(SPDY_INVALID_CONTROL_FRAME);
       } else if (protocol_version() <= SPDY3 && current_frame_flags_ != 0) {
         set_error(SPDY_INVALID_CONTROL_FRAME_FLAGS);
-      } else if (protocol_version() > SPDY3 && current_frame_flags_ &
-                 ~PUSH_PROMISE_FLAG_END_PUSH_PROMISE) {
+      } else if (protocol_version() > SPDY3 &&
+                 current_frame_flags_ &
+                     ~(PUSH_PROMISE_FLAG_END_PUSH_PROMISE |
+                       HEADERS_FLAG_PAD_LOW | HEADERS_FLAG_PAD_HIGH)) {
         set_error(SPDY_INVALID_CONTROL_FRAME_FLAGS);
       }
       break;
     case CONTINUATION:
       if (current_frame_length_ < GetContinuationMinimumSize() ||
           protocol_version() <= SPDY3) {
         set_error(SPDY_INVALID_CONTROL_FRAME);
-      } else if (current_frame_flags_ & ~HEADERS_FLAG_END_HEADERS) {
+      } else if (current_frame_flags_ &
+                 ~(HEADERS_FLAG_END_HEADERS | HEADERS_FLAG_PAD_LOW |
+                   HEADERS_FLAG_PAD_HIGH)) {
         set_error(SPDY_INVALID_CONTROL_FRAME_FLAGS);
       }
       break;
+    case ALTSVC:
+      if (current_frame_length_ <= GetAltSvcMinimumSize()) {
+        set_error(SPDY_INVALID_CONTROL_FRAME);
+      } else if (current_frame_flags_ != 0) {
+        set_error(SPDY_INVALID_CONTROL_FRAME_FLAGS);
+      }
+      break;
+    case PRIORITY:
+      if (current_frame_length_ != GetPrioritySize() ||
+          protocol_version() <= SPDY3) {
+        set_error(SPDY_INVALID_CONTROL_FRAME);
+      } else if (current_frame_flags_ != 0) {
+        set_error(SPDY_INVALID_CONTROL_FRAME_FLAGS);
+      }
+      break;
     default:
       LOG(WARNING) << "Valid " << display_protocol_
                    << " control frame with unhandled type: "
                    << current_frame_type_;
       // This branch should be unreachable because of the frame type bounds
       // check above. However, we DLOG(FATAL) here in an effort to painfully
       // club the head of the developer who failed to keep this file in sync
       // with spdy_protocol.h.
       DLOG(FATAL);
       set_error(SPDY_INVALID_CONTROL_FRAME);
@@ skipping 14 matching lines @@
   if (current_frame_type_ == GOAWAY) {
     CHANGE_STATE(SPDY_GOAWAY_FRAME_PAYLOAD);
     return;
   }
 
   if (current_frame_type_ == RST_STREAM) {
     CHANGE_STATE(SPDY_RST_STREAM_FRAME_PAYLOAD);
     return;
   }
 
+  if (current_frame_type_ == ALTSVC) {
+    CHANGE_STATE(SPDY_ALTSVC_FRAME_PAYLOAD);
+    return;
+  }
   // Determine the frame size without variable-length data.
   int32 frame_size_without_variable_data;
   switch (current_frame_type_) {
     case SYN_STREAM:
       syn_frame_processed_ = true;
       frame_size_without_variable_data = GetSynStreamMinimumSize();
       break;
     case SYN_REPLY:
       syn_frame_processed_ = true;
       frame_size_without_variable_data = GetSynReplyMinimumSize();
@@ skipping 401 matching lines @@
                 priority,
                 current_frame_flags_ & CONTROL_FLAG_FIN,
                 false);  // unidirectional
           } else {
             visitor_->OnHeaders(
                 current_frame_stream_id_,
                 (current_frame_flags_ & CONTROL_FLAG_FIN) != 0,
                 expect_continuation_ == 0);
           }
         }
-        CHANGE_STATE(SPDY_CONTROL_FRAME_HEADER_BLOCK);
+        CHANGE_STATE(SPDY_READ_PADDING_LENGTH);
         break;
       case PUSH_PROMISE:
         {
           DCHECK_LT(SPDY3, protocol_version());
           if (current_frame_stream_id_ == 0) {
             set_error(SPDY_INVALID_CONTROL_FRAME);
             break;
           }
           SpdyStreamId promised_stream_id = kInvalidStream;
           bool successful_read = reader.ReadUInt31(&promised_stream_id);
@@ skipping 10 matching lines @@
             debug_visitor_->OnReceiveCompressedFrame(
                 current_frame_stream_id_,
                 current_frame_type_,
                 current_frame_length_);
           }
           visitor_->OnPushPromise(current_frame_stream_id_,
                                   promised_stream_id,
                                   (current_frame_flags_ &
                                    PUSH_PROMISE_FLAG_END_PUSH_PROMISE) != 0);
         }
-        CHANGE_STATE(SPDY_CONTROL_FRAME_HEADER_BLOCK);
+        CHANGE_STATE(SPDY_READ_PADDING_LENGTH);
         break;
       case CONTINUATION:
         {
           // Check to make sure the stream id of the current frame is
           // the same as that of the preceding frame.
           // If we're at this point we should already know that
           // expect_continuation_ != 0, so this doubles as a check
           // that current_frame_stream_id != 0.
           if (current_frame_stream_id_ != expect_continuation_) {
             set_error(SPDY_INVALID_CONTROL_FRAME);
             break;
           }
           if (current_frame_flags_ & HEADERS_FLAG_END_HEADERS) {
             expect_continuation_ = 0;
           }
           if (debug_visitor_) {
             debug_visitor_->OnReceiveCompressedFrame(
                 current_frame_stream_id_,
                 current_frame_type_,
                 current_frame_length_);
           }
           visitor_->OnContinuation(current_frame_stream_id_,
                                    (current_frame_flags_ &
                                     HEADERS_FLAG_END_HEADERS) != 0);
         }
-        CHANGE_STATE(SPDY_CONTROL_FRAME_HEADER_BLOCK);
+        CHANGE_STATE(SPDY_READ_PADDING_LENGTH);
         break;
       default:
         DCHECK(false);
     }
   }
   return original_len - len;
 }
 
 // Does not buffer the control payload. Instead, either passes directly to the
 // visitor or decompresses and then passes directly to the visitor, via
 // IncrementallyDeliverControlFrameHeaderData() or
 // IncrementallyDecompressControlFrameHeaderData() respectively.
 size_t SpdyFramer::ProcessControlFrameHeaderBlock(const char* data,
                                                   size_t data_len,
                                                   bool is_hpack_header_block) {
   DCHECK_EQ(SPDY_CONTROL_FRAME_HEADER_BLOCK, state_);
 
   bool processed_successfully = true;
   if (current_frame_type_ != SYN_STREAM &&
       current_frame_type_ != SYN_REPLY &&
       current_frame_type_ != HEADERS &&
       current_frame_type_ != PUSH_PROMISE &&
       current_frame_type_ != CONTINUATION) {
     LOG(DFATAL) << "Unhandled frame type in ProcessControlFrameHeaderBlock.";
   }
-  size_t process_bytes = std::min(data_len, remaining_data_length_);
+  size_t process_bytes = std::min(
+      data_len, remaining_data_length_ - remaining_padding_payload_length_);
   if (is_hpack_header_block) {
-    if (!hpack_decoder_->HandleControlFrameHeadersData(current_frame_stream_id_,
-                                                       data,
-                                                       process_bytes)) {
+    if (!GetHpackDecoder()->HandleControlFrameHeadersData(
+            current_frame_stream_id_, data, process_bytes)) {
       // TODO(jgraettinger): Finer-grained HPACK error codes.
       set_error(SPDY_DECOMPRESS_FAILURE);
       processed_successfully = false;
     }
   } else if (process_bytes > 0) {
     if (enable_compression_ && protocol_version() <= SPDY3) {
       processed_successfully = IncrementallyDecompressControlFrameHeaderData(
           current_frame_stream_id_, data, process_bytes);
     } else {
       processed_successfully = IncrementallyDeliverControlFrameHeaderData(
           current_frame_stream_id_, data, process_bytes);
     }
   }
   remaining_data_length_ -= process_bytes;
 
   // Handle the case that there is no futher data in this frame.
-  if (remaining_data_length_ == 0 && processed_successfully) {
+  if (remaining_data_length_ == remaining_padding_payload_length_ &&
+      processed_successfully) {
     if (expect_continuation_ == 0) {
       if (is_hpack_header_block) {
-        if (!hpack_decoder_->HandleControlFrameHeadersComplete(
-            current_frame_stream_id_)) {
+        if (!GetHpackDecoder()->HandleControlFrameHeadersComplete(
+                current_frame_stream_id_)) {
           set_error(SPDY_DECOMPRESS_FAILURE);
           processed_successfully = false;
         } else {
           // TODO(jgraettinger): To be removed with migration to
           // SpdyHeadersHandlerInterface. Serializes the HPACK block as a SPDY3
           // block, delivered via reentrant call to
           // ProcessControlFrameHeaderBlock().
           DeliverHpackBlockAsSpdy3Block();
           return process_bytes;
         }
       } else {
         // The complete header block has been delivered. We send a zero-length
         // OnControlFrameHeaderData() to indicate this.
         visitor_->OnControlFrameHeaderData(current_frame_stream_id_, NULL, 0);
       }
-      // If this is a FIN, tell the caller.
-      if ((current_frame_flags_ & CONTROL_FLAG_FIN) || end_stream_when_done_) {
-        end_stream_when_done_ = false;
-        visitor_->OnStreamFrameData(current_frame_stream_id_, NULL, 0, true);
-      }
     }
-    if (processed_successfully)
-      CHANGE_STATE(SPDY_AUTO_RESET);
+    if (processed_successfully) {
+      CHANGE_STATE(SPDY_CONSUME_PADDING);
+    }
   }
 
   // Handle error.
   if (!processed_successfully) {
     return data_len;
   }
 
   // Return amount processed.
   return process_bytes;
 }
@@ skipping 49 matching lines @@
   if (remaining_data_length_ == 0) {
     visitor_->OnSettingsEnd();
     CHANGE_STATE(SPDY_AUTO_RESET);
   }
 
   return processed_bytes;
 }
 
 void SpdyFramer::DeliverHpackBlockAsSpdy3Block() {
   DCHECK_LT(SPDY3, protocol_version());
-  DCHECK_EQ(0u, remaining_data_length_);
+  DCHECK_EQ(remaining_padding_payload_length_, remaining_data_length_);
 
-  const SpdyNameValueBlock& block = hpack_decoder_->decoded_block();
+  const SpdyNameValueBlock& block = GetHpackDecoder()->decoded_block();
   if (block.empty()) {
     // Special-case this to make tests happy.
     ProcessControlFrameHeaderBlock(NULL, 0, false);
     return;
   }
   SpdyFrameBuilder builder(
       GetSerializedLength(protocol_version(), &block),
       SPDY3);
 
   SerializeNameValueBlockWithoutCompression(&builder, block);
   scoped_ptr<SpdyFrame> frame(builder.take());
 
+  // Preserve padding length, and reset it after the re-entrant call.
+  size_t remaining_padding = remaining_padding_payload_length_;
+
+  remaining_padding_payload_length_ = 0;
   remaining_data_length_ = frame->size();
+
   ProcessControlFrameHeaderBlock(frame->data(), frame->size(), false);
+
+  remaining_padding_payload_length_ = remaining_padding;
+  remaining_data_length_ = remaining_padding;
 }
 
 bool SpdyFramer::ProcessSetting(const char* data) {
   int id_field;
   SpdySettingsIds id;
   uint8 flags = 0;
   uint32 value;
 
   // Extract fields.
   // Maintain behavior of old SPDY 2 bug with byte ordering of flags/id.
@@ skipping 83 matching lines @@
           visitor_->OnWindowUpdate(current_frame_stream_id_,
                                    delta_window_size);
         }
         break;
       case BLOCKED: {
           DCHECK_LT(SPDY3, protocol_version());
           DCHECK(reader.IsDoneReading());
           visitor_->OnBlocked(current_frame_stream_id_);
         }
         break;
+      case PRIORITY: {
+          DCHECK_LT(SPDY3, protocol_version());
+          // TODO(hkhalil): Process PRIORITY frames rather than ignore them.
+          reader.Seek(5);
+          DCHECK(reader.IsDoneReading());
+        }
+        break;
       default:
         // Unreachable.
         LOG(FATAL) << "Unhandled control frame " << current_frame_type_;
     }
 
     CHANGE_STATE(SPDY_IGNORE_REMAINING_PAYLOAD);
   }
   return original_len - len;
 }
 
@@ skipping 126 matching lines @@
   if (!processed_successfully) {
     set_error(SPDY_RST_STREAM_FRAME_CORRUPT);
   } else if (remaining_data_length_ == 0) {
     // Signal that there is not more opaque data.
     visitor_->OnRstStreamFrameData(NULL, 0);
     CHANGE_STATE(SPDY_AUTO_RESET);
   }
   return original_len;
 }
 
+size_t SpdyFramer::ProcessAltSvcFramePayload(const char* data, size_t len) {
+  if (len == 0) {
+    return 0;
+  }
+
+  // Clamp to the actual remaining payload.
+  len = std::min(len, remaining_data_length_);
+
+  size_t processed_bytes = 0;
+  size_t processing = 0;
+  size_t bytes_remaining;
+  char* buffer;
+  size_t* buffer_len;
+
+  while (len > 0) {
+    if (altsvc_scratch_.pid_len == 0) {
+      // The size of the frame up to the PID_LEN field.
+      size_t fixed_len_portion = GetAltSvcMinimumSize() - 1;
+      bytes_remaining = fixed_len_portion - current_frame_buffer_length_;
+      processing = std::min(len, bytes_remaining);
+      // Buffer the new ALTSVC bytes we got.
+      UpdateCurrentFrameBuffer(&data, &len, processing);
+
+      // Do we have enough to parse the length of the protocol id?
+      if (current_frame_buffer_length_ == fixed_len_portion) {
+        // Parse out the max age, port, and pid_len.
+        SpdyFrameReader reader(current_frame_buffer_.get(),
+                               current_frame_buffer_length_);
+        reader.Seek(GetControlFrameHeaderSize());  // Seek past frame header.
+        bool successful_read = reader.ReadUInt32(&altsvc_scratch_.max_age);
+        reader.ReadUInt16(&altsvc_scratch_.port);
+        reader.Seek(1);  // Reserved byte.
+        successful_read = successful_read &&
+                          reader.ReadUInt8(&altsvc_scratch_.pid_len);
+        DCHECK(successful_read);
+        // Sanity check length value.
+        if (GetAltSvcMinimumSize() + altsvc_scratch_.pid_len >=
+            current_frame_length_) {
+          set_error(SPDY_INVALID_CONTROL_FRAME);
+          return 0;
+        }
+        altsvc_scratch_.protocol_id.reset(
+            new char[size_t(altsvc_scratch_.pid_len)]);
+      }
+      processed_bytes += processing;
+      continue;
+    } else if (altsvc_scratch_.pid_buf_len < altsvc_scratch_.pid_len) {
+      // Buffer protocol id field as in comes in.
+      buffer = altsvc_scratch_.protocol_id.get();
+      buffer_len = &altsvc_scratch_.pid_buf_len;
+      bytes_remaining = altsvc_scratch_.pid_len - altsvc_scratch_.pid_buf_len;
+    } else if (altsvc_scratch_.host_len == 0) {
+      // Parse out the host length.
+      processing = 1;
+      altsvc_scratch_.host_len = *reinterpret_cast<const uint8*>(data);
+      // Sanity check length value.
+      if (GetAltSvcMinimumSize() + altsvc_scratch_.pid_len +
+          altsvc_scratch_.host_len > current_frame_length_) {
+        set_error(SPDY_INVALID_CONTROL_FRAME);
+        return 0;
+      }
+      altsvc_scratch_.host.reset(new char[altsvc_scratch_.host_len]);
+      // Once we have host length, we can also determine the origin length
+      // by process of elimination.
+      altsvc_scratch_.origin_len = current_frame_length_ -
+        GetAltSvcMinimumSize() -
+        altsvc_scratch_.pid_len -
+        altsvc_scratch_.host_len;
+      if (altsvc_scratch_.origin_len > 0) {
+        altsvc_scratch_.origin.reset(new char[altsvc_scratch_.origin_len]);
+      }
+      data += processing;
+      processed_bytes += processing;
+      len -= processing;
+      continue;
+    } else if (altsvc_scratch_.host_buf_len < altsvc_scratch_.host_len) {
+      // Buffer host field as it comes in.
+      // TODO(mlavan): check formatting for host and origin
+      buffer = altsvc_scratch_.host.get();
+      buffer_len = &altsvc_scratch_.host_buf_len;
+      bytes_remaining = altsvc_scratch_.host_len - altsvc_scratch_.host_buf_len;
+    } else {
+      // Buffer (optional) origin field as it comes in.
+      if (altsvc_scratch_.origin_len <= 0) {
+        set_error(SPDY_INVALID_CONTROL_FRAME);
+        return 0;
+      }
+      buffer = altsvc_scratch_.origin.get();
+      buffer_len = &altsvc_scratch_.origin_buf_len;
+      bytes_remaining = remaining_data_length_ -
+        processed_bytes -
+        altsvc_scratch_.origin_buf_len;
+      if (len > bytes_remaining) {
+        // This is our last field; there shouldn't be any more bytes.
+        set_error(SPDY_INVALID_CONTROL_FRAME);
+        return 0;
+      }
+    }
+
+    // Copy data bytes into the appropriate field.
+    processing = std::min(len, bytes_remaining);
+    memcpy(buffer + *buffer_len,
+           data,
+           processing);
+    *buffer_len += processing;
+    data += processing;
+    processed_bytes += processing;
+    len -= processing;
+  }
+
+  remaining_data_length_ -= processed_bytes;
+  if (remaining_data_length_ == 0) {
+    visitor_->OnAltSvc(current_frame_stream_id_,
+                       altsvc_scratch_.max_age,
+                       altsvc_scratch_.port,
+                       StringPiece(altsvc_scratch_.protocol_id.get(),
+                                   altsvc_scratch_.pid_len),
+                       StringPiece(altsvc_scratch_.host.get(),
+                                   altsvc_scratch_.host_len),
+                       StringPiece(altsvc_scratch_.origin.get(),
+                                   altsvc_scratch_.origin_len));
+    CHANGE_STATE(SPDY_AUTO_RESET);
+  }
+
+  return processed_bytes;
+}
+
 size_t SpdyFramer::ProcessFramePaddingLength(const char* data, size_t len) {
   DCHECK_EQ(SPDY_READ_PADDING_LENGTH, state_);
 
   size_t original_len = len;
   if (remaining_padding_length_fields_ == 0) {
     DCHECK_EQ(remaining_padding_payload_length_, 0u);
     bool pad_low = false;
     bool pad_high = false;
     if (current_frame_flags_ & DATA_FLAG_PAD_LOW) {
       pad_low = true;
@@ skipping 19 matching lines @@
     --len;
     --remaining_padding_length_fields_;
     --remaining_data_length_;
   }
 
   if (remaining_padding_length_fields_ == 0) {
     if (remaining_padding_payload_length_ > remaining_data_length_) {
       set_error(SPDY_INVALID_DATA_FRAME_FLAGS);
       return 0;
     }
-    CHANGE_STATE(SPDY_FORWARD_STREAM_FRAME);
+    if (current_frame_type_ == DATA) {
+      CHANGE_STATE(SPDY_FORWARD_STREAM_FRAME);
+    } else {
+      DCHECK(current_frame_type_ == HEADERS ||
+             current_frame_type_ == PUSH_PROMISE ||
+             current_frame_type_ == CONTINUATION ||
+             current_frame_type_ == SYN_STREAM ||
+             current_frame_type_ == SYN_REPLY)
+          << current_frame_type_;
+      CHANGE_STATE(SPDY_CONTROL_FRAME_HEADER_BLOCK);
+    }
   }
   return original_len - len;
 }
 
 size_t SpdyFramer::ProcessFramePadding(const char* data, size_t len) {
   DCHECK_EQ(SPDY_CONSUME_PADDING, state_);
 
   size_t original_len = len;
   if (remaining_padding_payload_length_ > 0) {
     DCHECK_EQ(remaining_padding_payload_length_, remaining_data_length_);
     size_t amount_to_discard = std::min(remaining_padding_payload_length_, len);
-    // The visitor needs to know about padding so it can send window updates.
-    // Communicate the padding to the visitor through a NULL data pointer, with
-    // a nonzero size.
-    if (amount_to_discard) {
+    if (current_frame_type_ == DATA && amount_to_discard > 0) {
+      // The visitor needs to know about padding so it can send window updates.
+      // Communicate the padding to the visitor through a NULL data pointer,
+      // with a nonzero size.
       visitor_->OnStreamFrameData(
           current_frame_stream_id_, NULL, amount_to_discard, false);
     }
     data += amount_to_discard;
     len -= amount_to_discard;
     remaining_padding_payload_length_ -= amount_to_discard;
     remaining_data_length_ -= amount_to_discard;
   }
 
   if (remaining_data_length_ == 0) {
-    // If the FIN flag is set, and there is no more data in this data frame,
+    // If the FIN flag is set, or this ends a header block which set FIN,
     // inform the visitor of EOF via a 0-length data frame.
-    if (current_frame_flags_ & DATA_FLAG_FIN) {
+    if (expect_continuation_ == 0 &&
+        ((current_frame_flags_ & CONTROL_FLAG_FIN) != 0 ||
+         end_stream_when_done_)) {
+      end_stream_when_done_ = false;
       visitor_->OnStreamFrameData(current_frame_stream_id_, NULL, 0, true);
     }
-
     CHANGE_STATE(SPDY_AUTO_RESET);
   }
   return original_len - len;
 }
 
 size_t SpdyFramer::ProcessDataFramePayload(const char* data, size_t len) {
   size_t original_len = len;
   if (remaining_data_length_ - remaining_padding_payload_length_ > 0) {
     size_t amount_to_forward = std::min(
         remaining_data_length_ - remaining_padding_payload_length_, len);
@@ skipping 194 matching lines @@
     DLOG(DFATAL) << "Priority out-of-bounds.";
     priority = GetLowestPriority();
   }
 
   // The size of this frame, including variable-length name-value block.
   size_t size = GetSynStreamMinimumSize();
 
   string hpack_encoding;
   if (protocol_version() > SPDY3) {
     if (enable_compression_) {
-      hpack_encoder_->EncodeHeaderSet(
+      GetHpackEncoder()->EncodeHeaderSet(
           syn_stream.name_value_block(), &hpack_encoding);
     } else {
-      hpack_encoder_->EncodeHeaderSetWithoutCompression(
+      GetHpackEncoder()->EncodeHeaderSetWithoutCompression(
           syn_stream.name_value_block(), &hpack_encoding);
     }
     size += hpack_encoding.size();
   } else {
     size += GetSerializedLength(syn_stream.name_value_block());
   }
 
   SpdyFrameBuilder builder(size, protocol_version());
   if (protocol_version() <= SPDY3) {
     builder.WriteControlFrameHeader(*this, SYN_STREAM, flags);
@@ skipping 41 matching lines @@
   if (protocol_version() > SPDY3) {
     flags |= HEADERS_FLAG_END_HEADERS;
   }
 
   // The size of this frame, including variable-length name-value block.
   size_t size = GetSynReplyMinimumSize();
 
   string hpack_encoding;
   if (protocol_version() > SPDY3) {
     if (enable_compression_) {
-      hpack_encoder_->EncodeHeaderSet(
+      GetHpackEncoder()->EncodeHeaderSet(
           syn_reply.name_value_block(), &hpack_encoding);
     } else {
-      hpack_encoder_->EncodeHeaderSetWithoutCompression(
+      GetHpackEncoder()->EncodeHeaderSetWithoutCompression(
           syn_reply.name_value_block(), &hpack_encoding);
     }
     size += hpack_encoding.size();
   } else {
     size += GetSerializedLength(syn_reply.name_value_block());
   }
 
   SpdyFrameBuilder builder(size, protocol_version());
   if (protocol_version() <= SPDY3) {
     builder.WriteControlFrameHeader(*this, SYN_REPLY, flags);
@@ skipping 196 matching lines @@
     if (priority > GetLowestPriority()) {
       DLOG(DFATAL) << "Priority out-of-bounds.";
       priority = GetLowestPriority();
     }
     size += 4;
   }
 
   string hpack_encoding;
   if (protocol_version() > SPDY3) {
     if (enable_compression_) {
-      hpack_encoder_->EncodeHeaderSet(
+      GetHpackEncoder()->EncodeHeaderSet(
           headers.name_value_block(), &hpack_encoding);
     } else {
-      hpack_encoder_->EncodeHeaderSetWithoutCompression(
+      GetHpackEncoder()->EncodeHeaderSetWithoutCompression(
           headers.name_value_block(), &hpack_encoding);
     }
     size += hpack_encoding.size();
     if (size > GetControlFrameBufferMaxSize()) {
       size += GetNumberRequiredContinuationFrames(size) *
               GetContinuationMinimumSize();
       flags &= ~HEADERS_FLAG_END_HEADERS;
     }
   } else {
     size += GetSerializedLength(headers.name_value_block());
@@ skipping 69 matching lines @@
   DCHECK_LT(SPDY3, protocol_version());
   uint8 flags = 0;
   // This will get overwritten if we overflow into a CONTINUATION frame.
   flags |= PUSH_PROMISE_FLAG_END_PUSH_PROMISE;
   // The size of this frame, including variable-length name-value block.
   size_t size = GetPushPromiseMinimumSize();
 
   string hpack_encoding;
   if (protocol_version() > SPDY3) {
     if (enable_compression_) {
-      hpack_encoder_->EncodeHeaderSet(
+      GetHpackEncoder()->EncodeHeaderSet(
           push_promise.name_value_block(), &hpack_encoding);
     } else {
-      hpack_encoder_->EncodeHeaderSetWithoutCompression(
+      GetHpackEncoder()->EncodeHeaderSetWithoutCompression(
           push_promise.name_value_block(), &hpack_encoding);
     }
     size += hpack_encoding.size();
     if (size > GetControlFrameBufferMaxSize()) {
       size += GetNumberRequiredContinuationFrames(size) *
               GetContinuationMinimumSize();
       flags &= ~PUSH_PROMISE_FLAG_END_PUSH_PROMISE;
     }
   } else {
     size += GetSerializedLength(push_promise.name_value_block());
@@ skipping 36 matching lines @@
   CHECK_LT(SPDY3, protocol_version());
   uint8 flags = 0;
   if (continuation.end_headers()) {
     flags |= HEADERS_FLAG_END_HEADERS;
   }
 
   // The size of this frame, including variable-length name-value block.
   size_t size = GetContinuationMinimumSize();
   string hpack_encoding;
   if (enable_compression_) {
-    hpack_encoder_->EncodeHeaderSet(
+    GetHpackEncoder()->EncodeHeaderSet(
         continuation.name_value_block(), &hpack_encoding);
   } else {
-    hpack_encoder_->EncodeHeaderSetWithoutCompression(
+    GetHpackEncoder()->EncodeHeaderSetWithoutCompression(
         continuation.name_value_block(), &hpack_encoding);
   }
   size += hpack_encoding.size();
 
   SpdyFrameBuilder builder(size, protocol_version());
   builder.BeginNewFrame(*this, CONTINUATION, flags,
       continuation.stream_id());
   DCHECK_EQ(GetContinuationMinimumSize(), builder.length());
 
   builder.WriteBytes(&hpack_encoding[0], hpack_encoding.size());
 
   if (debug_visitor_) {
     const size_t payload_len = hpack_encoding.size();
     debug_visitor_->OnSendCompressedFrame(continuation.stream_id(),
         CONTINUATION, payload_len, builder.length());
   }
 
   return builder.take();
 }
 
+SpdyFrame* SpdyFramer::SerializeAltSvc(const SpdyAltSvcIR& altsvc) {
+  DCHECK_LT(SPDY3, protocol_version());
+  size_t size = GetAltSvcMinimumSize();
+  size += altsvc.protocol_id().length();
+  size += altsvc.host().length();
+  size += altsvc.origin().length();
+
+  SpdyFrameBuilder builder(size, protocol_version());
+  builder.BeginNewFrame(*this, ALTSVC, kNoFlags, altsvc.stream_id());
+
+  builder.WriteUInt32(altsvc.max_age());
+  builder.WriteUInt16(altsvc.port());
+  builder.WriteUInt8(0);  // Reserved.
+  builder.WriteUInt8(altsvc.protocol_id().length());
+  builder.WriteBytes(altsvc.protocol_id().data(),
+                     altsvc.protocol_id().length());
+  builder.WriteUInt8(altsvc.host().length());
+  builder.WriteBytes(altsvc.host().data(), altsvc.host().length());
+  builder.WriteBytes(altsvc.origin().data(), altsvc.origin().length());
+  DCHECK_LT(GetAltSvcMinimumSize(), builder.length());
+  return builder.take();
+}
+
 namespace {
 
 class FrameSerializationVisitor : public SpdyFrameVisitor {
  public:
   explicit FrameSerializationVisitor(SpdyFramer* framer) : framer_(framer) {}
   virtual ~FrameSerializationVisitor() {}
 
   SpdySerializedFrame* ReleaseSerializedFrame() { return frame_.release(); }
 
   virtual void VisitData(const SpdyDataIR& data) OVERRIDE {
@@ skipping 28 matching lines @@
     frame_.reset(framer_->SerializeBlocked(blocked));
   }
   virtual void VisitPushPromise(
       const SpdyPushPromiseIR& push_promise) OVERRIDE {
     frame_.reset(framer_->SerializePushPromise(push_promise));
   }
   virtual void VisitContinuation(
       const SpdyContinuationIR& continuation) OVERRIDE {
     frame_.reset(framer_->SerializeContinuation(continuation));
   }
+  virtual void VisitAltSvc(const SpdyAltSvcIR& altsvc) OVERRIDE {
+    frame_.reset(framer_->SerializeAltSvc(altsvc));
+  }
 
  private:
   SpdyFramer* framer_;
   scoped_ptr<SpdySerializedFrame> frame_;
 };
 
 }  // namespace
 
 SpdySerializedFrame* SpdyFramer::SerializeFrame(const SpdyFrameIR& frame) {
   FrameSerializationVisitor visitor(this);
@@ skipping 130 matching lines @@
 
   int success = inflateInit(header_decompressor_.get());
   if (success != Z_OK) {
     LOG(WARNING) << "inflateInit failure: " << success;
     header_decompressor_.reset(NULL);
     return NULL;
   }
   return header_decompressor_.get();
 }
 
+HpackEncoder* SpdyFramer::GetHpackEncoder() {
+  DCHECK_LT(SPDY3, spdy_version_);
+  if (hpack_encoder_.get() == NULL) {
+    hpack_encoder_.reset(new HpackEncoder(ObtainHpackHuffmanTable()));
+  }
+  return hpack_encoder_.get();
+}
+
+HpackDecoder* SpdyFramer::GetHpackDecoder() {
+  DCHECK_LT(SPDY3, spdy_version_);
+  if (hpack_decoder_.get() == NULL) {
+    hpack_decoder_.reset(new HpackDecoder(ObtainHpackHuffmanTable()));
+  }
+  return hpack_decoder_.get();
+}
+
 // Incrementally decompress the control frame's header block, feeding the
 // result to the visitor in chunks. Continue this until the visitor
 // indicates that it cannot process any more data, or (more commonly) we
 // run out of data to deliver.
 bool SpdyFramer::IncrementallyDecompressControlFrameHeaderData(
     SpdyStreamId stream_id,
     const char* data,
     size_t len) {
   // Get a decompressor or set error.
   z_stream* decomp = GetHeaderDecompressor();
@@ skipping 166 matching lines @@
   builder->Seek(compressed_size);
   builder->RewriteLength(*this);
 
   pre_compress_bytes.Add(uncompressed_len);
   post_compress_bytes.Add(compressed_size);
 
   compressed_frames.Increment();
 }
 
 }  // namespace net