Update from chromium a8e7c94b1b79a0948d05a1fcfff53391d22ce37a

net/spdy/spdy_framer.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/spdy/spdy_framer.h"
 
 #include "base/lazy_instance.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/metrics/stats_counters.h"
 #include "base/third_party/valgrind/memcheck.h"
@@ skipping 52 matching lines @@
 // initialized lazily to avoid static initializers.
 base::LazyInstance<DictionaryIds>::Leaky g_dictionary_ids;
 
 // Used to indicate no flags in a SPDY flags field.
 const uint8 kNoFlags = 0;
 
 // Wire sizes of priority payloads.
 const size_t kPriorityDependencyPayloadSize = 4;
 const size_t kPriorityWeightPayloadSize = 1;
 
+// Wire size of pad length field.
+const size_t kPadLengthFieldSize = 1;
+
 }  // namespace
 
 const SpdyStreamId SpdyFramer::kInvalidStream = static_cast<SpdyStreamId>(-1);
 const size_t SpdyFramer::kHeaderDataChunkMaxSize = 1024;
 // The size of the control frame buffer. Must be >= the minimum size of the
 // largest control frame, which is SYN_STREAM. See GetSynStreamMinimumSize() for
 // calculation details.
 const size_t SpdyFramer::kControlFrameBufferSize = 19;
 
 #ifdef DEBUG_SPDY_STATE_CHANGES
@@ skipping 289 matching lines @@
     case SPDY_ERROR:
       return "ERROR";
     case SPDY_AUTO_RESET:
       return "AUTO_RESET";
     case SPDY_RESET:
       return "RESET";
     case SPDY_READING_COMMON_HEADER:
       return "READING_COMMON_HEADER";
     case SPDY_CONTROL_FRAME_PAYLOAD:
       return "CONTROL_FRAME_PAYLOAD";
-    case SPDY_READ_PADDING_LENGTH:
-      return "SPDY_READ_PADDING_LENGTH";
+    case SPDY_READ_DATA_FRAME_PADDING_LENGTH:
+      return "SPDY_READ_DATA_FRAME_PADDING_LENGTH";
     case SPDY_CONSUME_PADDING:
       return "SPDY_CONSUME_PADDING";
     case SPDY_IGNORE_REMAINING_PAYLOAD:
       return "IGNORE_REMAINING_PAYLOAD";
     case SPDY_FORWARD_STREAM_FRAME:
       return "FORWARD_STREAM_FRAME";
     case SPDY_CONTROL_FRAME_BEFORE_HEADER_BLOCK:
       return "SPDY_CONTROL_FRAME_BEFORE_HEADER_BLOCK";
     case SPDY_CONTROL_FRAME_HEADER_BLOCK:
       return "SPDY_CONTROL_FRAME_HEADER_BLOCK";
@@ skipping 200 matching lines @@
         break;
       }
 
       case SPDY_CONTROL_FRAME_PAYLOAD: {
         size_t bytes_read = ProcessControlFramePayload(data, len);
         len -= bytes_read;
         data += bytes_read;
         break;
       }
 
-      case SPDY_READ_PADDING_LENGTH: {
-        size_t bytes_read = ProcessFramePaddingLength(data, len);
+      case SPDY_READ_DATA_FRAME_PADDING_LENGTH: {
+        size_t bytes_read = ProcessDataFramePaddingLength(data, len);
         len -= bytes_read;
         data += bytes_read;
         break;
       }
 
       case SPDY_CONSUME_PADDING: {
         size_t bytes_read = ProcessFramePadding(data, len);
         len -= bytes_read;
         data += bytes_read;
         break;
@@ skipping 186 matching lines @@
       valid_data_flags = DATA_FLAG_FIN;
     }
 
     if (current_frame_flags_ & ~valid_data_flags) {
       set_error(SPDY_INVALID_DATA_FRAME_FLAGS);
     } else {
       visitor_->OnDataFrameHeader(current_frame_stream_id_,
                                   remaining_data_length_,
                                   current_frame_flags_ & DATA_FLAG_FIN);
       if (remaining_data_length_ > 0) {
-        CHANGE_STATE(SPDY_READ_PADDING_LENGTH);
+        CHANGE_STATE(SPDY_READ_DATA_FRAME_PADDING_LENGTH);
       } else {
         // Empty data frame.
         if (current_frame_flags_ & DATA_FLAG_FIN) {
           visitor_->OnStreamFrameData(
               current_frame_stream_id_, NULL, 0, true);
         }
         CHANGE_STATE(SPDY_AUTO_RESET);
       }
     }
   } else {
@@ skipping 253 matching lines @@
       break;
     case SYN_REPLY:
       syn_frame_processed_ = true;
       frame_size_without_variable_data = GetSynReplyMinimumSize();
       break;
     case SETTINGS:
       frame_size_without_variable_data = GetSettingsMinimumSize();
       break;
     case HEADERS:
       frame_size_without_variable_data = GetHeadersMinimumSize();
-      if (protocol_version() > SPDY3 &&
-          current_frame_flags_ & HEADERS_FLAG_PRIORITY) {
+      if (protocol_version() > SPDY3) {
+        if (current_frame_flags_ & HEADERS_FLAG_PADDED) {
+          frame_size_without_variable_data += kPadLengthFieldSize;
+        }
+        if (current_frame_flags_ & HEADERS_FLAG_PRIORITY) {
         frame_size_without_variable_data +=
             kPriorityDependencyPayloadSize +
             kPriorityWeightPayloadSize;
+        }
       }
       break;
     case PUSH_PROMISE:
       frame_size_without_variable_data = GetPushPromiseMinimumSize();
+      if (protocol_version() > SPDY3 &&
+          current_frame_flags_ & PUSH_PROMISE_FLAG_PADDED) {
+        frame_size_without_variable_data += kPadLengthFieldSize;
+      }
       break;
     case CONTINUATION:
       frame_size_without_variable_data = GetContinuationMinimumSize();
       break;
     default:
       frame_size_without_variable_data = -1;
       break;
   }
 
   if ((frame_size_without_variable_data == -1) &&
@@ skipping 345 matching lines @@
           if (protocol_version() <= SPDY2) {
             // SPDY 2 had two unused bytes here. Seek past them.
             reader.Seek(2);
           }
           if (protocol_version() > SPDY3 &&
              !(current_frame_flags_ & HEADERS_FLAG_END_HEADERS) &&
              current_frame_type_ == HEADERS) {
             expect_continuation_ = current_frame_stream_id_;
             end_stream_when_done_ = current_frame_flags_ & CONTROL_FLAG_FIN;
           }
+          if (protocol_version() > SPDY3 &&
+              current_frame_flags_ & HEADERS_FLAG_PADDED) {
+            uint8 pad_payload_len = 0;
+            DCHECK_EQ(remaining_padding_payload_length_, 0u);
+            successful_read = reader.ReadUInt8(&pad_payload_len);
+            DCHECK(successful_read);
+            remaining_padding_payload_length_ = pad_payload_len;
+          }
           const bool has_priority =
               (current_frame_flags_ & HEADERS_FLAG_PRIORITY) != 0;
           uint32 priority = 0;
           if (protocol_version() > SPDY3 && has_priority) {
             // TODO(jgraettinger): Process dependency rather than ignoring it.
             reader.Seek(kPriorityDependencyPayloadSize);
             uint8 weight = 0;
             successful_read = reader.ReadUInt8(&weight);
             if (successful_read) {
               priority = MapWeightToPriority(weight);
@@ skipping 25 matching lines @@
                 priority,
                 current_frame_flags_ & CONTROL_FLAG_FIN,
                 false);  // unidirectional
           } else {
             visitor_->OnHeaders(
                 current_frame_stream_id_,
                 (current_frame_flags_ & CONTROL_FLAG_FIN) != 0,
                 expect_continuation_ == 0);
           }
         }
-        CHANGE_STATE(SPDY_READ_PADDING_LENGTH);
+        CHANGE_STATE(SPDY_CONTROL_FRAME_HEADER_BLOCK);
         break;
       case PUSH_PROMISE:
         {
           DCHECK_LT(SPDY3, protocol_version());
           if (current_frame_stream_id_ == 0) {
             set_error(SPDY_INVALID_CONTROL_FRAME);
             break;
           }
+          bool successful_read = true;
+          if (protocol_version() > SPDY3 &&
+              current_frame_flags_ & PUSH_PROMISE_FLAG_PADDED) {
+            DCHECK_EQ(remaining_padding_payload_length_, 0u);
+            uint8 pad_payload_len = 0;
+            successful_read = reader.ReadUInt8(&pad_payload_len);
+            DCHECK(successful_read);
+            remaining_padding_payload_length_ = pad_payload_len;
+          }
+        }
+        {
           SpdyStreamId promised_stream_id = kInvalidStream;
           bool successful_read = reader.ReadUInt31(&promised_stream_id);
           DCHECK(successful_read);
           DCHECK(reader.IsDoneReading());
           if (promised_stream_id == 0) {
             set_error(SPDY_INVALID_CONTROL_FRAME);
             break;
           }
           if (!(current_frame_flags_ & PUSH_PROMISE_FLAG_END_PUSH_PROMISE)) {
             expect_continuation_ = current_frame_stream_id_;
           }
           if (debug_visitor_) {
             debug_visitor_->OnReceiveCompressedFrame(
                 current_frame_stream_id_,
                 current_frame_type_,
                 current_frame_length_);
           }
           visitor_->OnPushPromise(current_frame_stream_id_,
                                   promised_stream_id,
                                   (current_frame_flags_ &
                                    PUSH_PROMISE_FLAG_END_PUSH_PROMISE) != 0);
         }
-        CHANGE_STATE(SPDY_READ_PADDING_LENGTH);
+        CHANGE_STATE(SPDY_CONTROL_FRAME_HEADER_BLOCK);
         break;
       case CONTINUATION:
         {
           // Check to make sure the stream id of the current frame is
           // the same as that of the preceding frame.
           // If we're at this point we should already know that
           // expect_continuation_ != 0, so this doubles as a check
           // that current_frame_stream_id != 0.
           if (current_frame_stream_id_ != expect_continuation_) {
             set_error(SPDY_INVALID_CONTROL_FRAME);
@@ skipping 566 matching lines @@
                        StringPiece(altsvc_scratch_.host.get(),
                                    altsvc_scratch_.host_len),
                        StringPiece(altsvc_scratch_.origin.get(),
                                    altsvc_scratch_.origin_len));
     CHANGE_STATE(SPDY_AUTO_RESET);
   }
 
   return processed_bytes;
 }
 
-// TODO(raullenchai): ProcessFramePaddingLength should be able to deal with
-// HEADERS_FLAG_PADDED and PUSH_PROMISE_FLAG_PADDED as well (see b/15777051).
-size_t SpdyFramer::ProcessFramePaddingLength(const char* data, size_t len) {
-  DCHECK_EQ(SPDY_READ_PADDING_LENGTH, state_);
-  DCHECK_EQ(remaining_padding_payload_length_, 0u);
+size_t SpdyFramer::ProcessDataFramePaddingLength(const char* data, size_t len) {
+  DCHECK_EQ(SPDY_READ_DATA_FRAME_PADDING_LENGTH, state_);
+  DCHECK_EQ(0u, remaining_padding_payload_length_);
+  DCHECK_EQ(DATA, current_frame_type_);
 
   size_t original_len = len;
   if (current_frame_flags_ & DATA_FLAG_PADDED) {
     if (len != 0) {
       if (remaining_data_length_ < 1) {
         set_error(SPDY_INVALID_DATA_FRAME_FLAGS);
         return 0;
       }
 
       remaining_padding_payload_length_ = *reinterpret_cast<const uint8*>(data);
       ++data;
       --len;
       --remaining_data_length_;
     } else {
       // We don't have the data available for parsing the pad length field. Keep
       // waiting.
       return 0;
     }
   }
 
   if (remaining_padding_payload_length_ > remaining_data_length_) {
     set_error(SPDY_INVALID_DATA_FRAME_FLAGS);
     return 0;
   }
-  if (current_frame_type_ == DATA) {
-    CHANGE_STATE(SPDY_FORWARD_STREAM_FRAME);
-  } else {
-    DCHECK(current_frame_type_ == HEADERS ||
-           current_frame_type_ == PUSH_PROMISE ||
-           current_frame_type_ == SYN_STREAM ||
-           current_frame_type_ == SYN_REPLY)
-        << current_frame_type_;
-    CHANGE_STATE(SPDY_CONTROL_FRAME_HEADER_BLOCK);
-  }
+  CHANGE_STATE(SPDY_FORWARD_STREAM_FRAME);
   return original_len - len;
 }
 
 size_t SpdyFramer::ProcessFramePadding(const char* data, size_t len) {
   DCHECK_EQ(SPDY_CONSUME_PADDING, state_);
 
   size_t original_len = len;
   if (remaining_padding_payload_length_ > 0) {
     DCHECK_EQ(remaining_padding_payload_length_, remaining_data_length_);
     size_t amount_to_discard = std::min(remaining_padding_payload_length_, len);
@@ skipping 427 matching lines @@
   uint8 flags = 0;
   if (headers.fin()) {
     flags |= CONTROL_FLAG_FIN;
   }
   if (protocol_version() > SPDY3) {
     // This will get overwritten if we overflow into a CONTINUATION frame.
     flags |= HEADERS_FLAG_END_HEADERS;
     if (headers.has_priority()) {
       flags |= HEADERS_FLAG_PRIORITY;
     }
+    if (headers.padded()) {
+      flags |= HEADERS_FLAG_PADDED;
+    }
   }
 
-  // The size of this frame, including variable-length name-value block.
+  // The size of this frame, including padding (if there is any)
+  // and variable-length name-value block.
   size_t size = GetHeadersMinimumSize();
 
+  if (protocol_version() > SPDY3 && headers.padded()) {
+    size += kPadLengthFieldSize;
+    size += headers.padding_payload_len();
+  }
+
   uint32 priority = headers.priority();
   if (headers.has_priority()) {
     if (priority > GetLowestPriority()) {
       DLOG(DFATAL) << "Priority out-of-bounds.";
       priority = GetLowestPriority();
     }
     size += 5;
   }
 
   string hpack_encoding;
@@ skipping 24 matching lines @@
                           HEADERS,
                           flags,
                           headers.stream_id());
   }
   if (protocol_version() <= SPDY2) {
     builder.WriteUInt16(0);  // Unused.
   }
   DCHECK_EQ(GetHeadersMinimumSize(), builder.length());
 
   if (protocol_version() > SPDY3) {
+    int padding_payload_len = 0;
+    if (headers.padded()) {
+      builder.WriteUInt8(headers.padding_payload_len());
+      padding_payload_len = headers.padding_payload_len();
+    }
     if (headers.has_priority()) {
       // TODO(jgraettinger): Plumb priorities and stream dependencies.
       builder.WriteUInt32(0);  // Non-exclusive bit and root stream ID.
       builder.WriteUInt8(MapPriorityToWeight(priority));
     }
     WritePayloadWithContinuation(&builder,
                                  hpack_encoding,
                                  headers.stream_id(),
-                                 HEADERS);
+                                 HEADERS,
+                                 padding_payload_len);
   } else {
     SerializeNameValueBlock(&builder, headers);
   }
 
   if (debug_visitor_) {
     // SPDY4 uses HPACK for header compression. However, continue to
     // use GetSerializedLength() for an apples-to-apples comparision of
     // compression performance between HPACK and SPDY w/ deflate.
     const size_t payload_len =
         GetSerializedLength(protocol_version(),
@@ skipping 33 matching lines @@
 
 SpdyFrame* SpdyFramer::SerializePushPromise(
     const SpdyPushPromiseIR& push_promise) {
   DCHECK_LT(SPDY3, protocol_version());
   uint8 flags = 0;
   // This will get overwritten if we overflow into a CONTINUATION frame.
   flags |= PUSH_PROMISE_FLAG_END_PUSH_PROMISE;
   // The size of this frame, including variable-length name-value block.
   size_t size = GetPushPromiseMinimumSize();
 
+  if (push_promise.padded()) {
+    flags |= PUSH_PROMISE_FLAG_PADDED;
+    size += kPadLengthFieldSize;
+    size += push_promise.padding_payload_len();
+  }
+
   string hpack_encoding;
   if (enable_compression_) {
     GetHpackEncoder()->EncodeHeaderSet(
         push_promise.name_value_block(), &hpack_encoding);
   } else {
     GetHpackEncoder()->EncodeHeaderSetWithoutCompression(
         push_promise.name_value_block(), &hpack_encoding);
   }
   size += hpack_encoding.size();
   if (size > GetHeaderFragmentMaxSize()) {
     size += GetNumberRequiredContinuationFrames(size) *
             GetContinuationMinimumSize();
     flags &= ~PUSH_PROMISE_FLAG_END_PUSH_PROMISE;
   }
 
   SpdyFrameBuilder builder(size, protocol_version());
   builder.BeginNewFrame(*this,
                         PUSH_PROMISE,
                         flags,
                         push_promise.stream_id());
-  builder.WriteUInt32(push_promise.promised_stream_id());
-  DCHECK_EQ(GetPushPromiseMinimumSize(), builder.length());
+  int padding_payload_len = 0;
+  if (push_promise.padded()) {
+    builder.WriteUInt8(push_promise.padding_payload_len());
+    builder.WriteUInt32(push_promise.promised_stream_id());
+    DCHECK_EQ(GetPushPromiseMinimumSize() + kPadLengthFieldSize,
+              builder.length());
+
+    padding_payload_len = push_promise.padding_payload_len();
+  } else {
+    builder.WriteUInt32(push_promise.promised_stream_id());
+    DCHECK_EQ(GetPushPromiseMinimumSize(), builder.length());
+  }
 
   WritePayloadWithContinuation(&builder,
                                hpack_encoding,
                                push_promise.stream_id(),
-                               PUSH_PROMISE);
+                               PUSH_PROMISE,
+                               padding_payload_len);
 
   if (debug_visitor_) {
     // SPDY4 uses HPACK for header compression. However, continue to
     // use GetSerializedLength() for an apples-to-apples comparision of
     // compression performance between HPACK and SPDY w/ deflate.
     const size_t payload_len =
         GetSerializedLength(protocol_version(),
                             &(push_promise.name_value_block()));
     debug_visitor_->OnSendCompressedFrame(push_promise.stream_id(),
                                           PUSH_PROMISE,
@@ skipping 159 matching lines @@
   const size_t kMaxControlFrameSize = GetHeaderFragmentMaxSize();
   DCHECK_GT(protocol_version(), SPDY3);
   DCHECK_GT(size, kMaxControlFrameSize);
   size_t overflow = size - kMaxControlFrameSize;
   return overflow / (kMaxControlFrameSize - GetContinuationMinimumSize()) + 1;
 }
 
 void SpdyFramer::WritePayloadWithContinuation(SpdyFrameBuilder* builder,
                                               const string& hpack_encoding,
                                               SpdyStreamId stream_id,
-                                              SpdyFrameType type) {
+                                              SpdyFrameType type,
+                                              int padding_payload_len) {
   const size_t kMaxControlFrameSize = GetHeaderFragmentMaxSize();
 
-    // In addition to the prefix, fixed_field_size includes the size of
-    // any fields that come before the variable-length name/value block.
-    size_t fixed_field_size = 0;
     uint8 end_flag = 0;
     uint8 flags = 0;
     if (type == HEADERS) {
-      fixed_field_size = GetHeadersMinimumSize();
       end_flag = HEADERS_FLAG_END_HEADERS;
     } else if (type == PUSH_PROMISE) {
-      fixed_field_size = GetPushPromiseMinimumSize();
       end_flag = PUSH_PROMISE_FLAG_END_PUSH_PROMISE;
     } else {
       DLOG(FATAL) << "CONTINUATION frames cannot be used with frame type "
                   << FrameTypeToString(type);
     }
 
-    // Write as much of the payload as possible into the initial frame.
-    size_t bytes_remaining = hpack_encoding.size() -
-        std::min(hpack_encoding.size(),
-                 kMaxControlFrameSize - fixed_field_size);
+    // Write all the padding payload and as much of the data payload as possible
+    // into the initial frame.
+    size_t bytes_remaining = 0;
+    bytes_remaining = hpack_encoding.size() -
+                      std::min(hpack_encoding.size(),
+                               kMaxControlFrameSize - builder->length() -
+                                   padding_payload_len);
     builder->WriteBytes(&hpack_encoding[0],
                         hpack_encoding.size() - bytes_remaining);
-
+    if (padding_payload_len > 0) {
+      string padding = string(padding_payload_len, 0);
+      builder->WriteBytes(padding.data(), padding.length());
+    }
     if (bytes_remaining > 0) {
       builder->OverwriteLength(*this,
           kMaxControlFrameSize - GetControlFrameHeaderSize());
     }
 
     // Tack on CONTINUATION frames for the overflow.
     while (bytes_remaining > 0) {
       size_t bytes_to_write = std::min(bytes_remaining,
                                        kMaxControlFrameSize -
                                        GetContinuationMinimumSize());
@@ skipping 278 matching lines @@
   builder->Seek(compressed_size);
   builder->RewriteLength(*this);
 
   pre_compress_bytes.Add(uncompressed_len);
   post_compress_bytes.Add(compressed_size);
 
   compressed_frames.Increment();
 }
 
 }  // namespace net