Update contrib/libs/nghttp2 to 1.49.0

contrib/libs/nghttp2/AUTHORS

@@ -40,6 +40,7 @@ Daniel Evers
 Daniel Stenberg
 Dave Reisner
 David Beitey
+David Korczynski
 David Weekly
 Dimitris Apostolou
 Dmitri Tikhonov
@@ -90,6 +91,7 @@ Mike Frysinger
 Mike Lothian
 Nicholas Hurley
 Nora Shoemaker
+Paweł Wegner
 Pedro Santos
 Peeyush Aggarwal
 Peter Wu

contrib/libs/nghttp2/README.rst

@@ -11,11 +11,6 @@ HTTP/2.
 
 An HPACK encoder and decoder are available as a public API.
 
-An experimental high level C++ library is also available.
-
-We have Python bindings of this library, but we do not have full
-code coverage yet.
-
 Development Status
 ------------------
 
@@ -106,12 +101,14 @@ To mitigate heap fragmentation in long running server programs
      Alpine Linux currently does not support malloc replacement
      due to musl limitations. See details in issue `#762 <https://github.com/nghttp2/nghttp2/issues/762>`_.
 
-libnghttp2_asio C++ library requires the following packages:
+libnghttp2_asio C++ library (deprecated, has moved to
+https://github.com/nghttp2/nghttp2-asio) requires the following
+packages:
 
 * libboost-dev >= 1.54.0
 * libboost-thread-dev >= 1.54.0
 
-The Python bindings require the following packages:
+The Python bindings (deprecated) require the following packages:
 
 * cython >= 0.19
 * python >= 3.8
@@ -151,11 +148,11 @@ To enable the experimental HTTP/3 support for h2load and nghttpx, the
 following libraries are required:
 
 * `OpenSSL with QUIC support
-  <https://github.com/quictls/openssl/tree/OpenSSL_1_1_1p+quic>`_; or
+  <https://github.com/quictls/openssl/tree/OpenSSL_1_1_1q+quic>`_; or
   `BoringSSL <https://boringssl.googlesource.com/boringssl/>`_ (commit
-  27ffcc6e19bbafddf1b59ec0bc6df2904de7eb2c)
-* `ngtcp2 <https://github.com/ngtcp2/ngtcp2>`_ >= 0.6.0
-* `nghttp3 <https://github.com/ngtcp2/nghttp3>`_ >= 0.4.0
+  a6d321b11fa80496b7c8ae6405468c212d4f5c87)
+* `ngtcp2 <https://github.com/ngtcp2/ngtcp2>`_ >= 0.8.0
+* `nghttp3 <https://github.com/ngtcp2/nghttp3>`_ >= 0.7.0
 
 Use ``--enable-http3`` configure option to enable HTTP/3 feature for
 h2load and nghttpx.
@@ -170,7 +167,7 @@ Use ``--with-libbpf`` configure option to build eBPF program.
 libelf-dev is needed to build libbpf.
 
 For Ubuntu 20.04, you can build libbpf from `the source code
-<https://github.com/libbpf/libbpf/releases/tag/v0.8.0>`_.  nghttpx
+<https://github.com/libbpf/libbpf/releases/tag/v0.8.1>`_.  nghttpx
 requires eBPF program for reloading its configuration and hot swapping
 its executable.
 
@@ -355,7 +352,7 @@ Build custom OpenSSL:
 
 .. code-block:: text
 
-   $ git clone --depth 1 -b OpenSSL_1_1_1p+quic https://github.com/quictls/openssl
+   $ git clone --depth 1 -b OpenSSL_1_1_1q+quic https://github.com/quictls/openssl
    $ cd openssl
    $ ./config --prefix=$PWD/build --openssldir=/etc/ssl
    $ make -j$(nproc)
@@ -366,7 +363,7 @@ Build nghttp3:
 
 .. code-block:: text
 
-   $ git clone --depth 1 -b v0.5.0 https://github.com/ngtcp2/nghttp3
+   $ git clone --depth 1 -b v0.7.0 https://github.com/ngtcp2/nghttp3
    $ cd nghttp3
    $ autoreconf -i
    $ ./configure --prefix=$PWD/build --enable-lib-only
@@ -378,7 +375,7 @@ Build ngtcp2:
 
 .. code-block:: text
 
-   $ git clone --depth 1 -b v0.6.0 https://github.com/ngtcp2/ngtcp2
+   $ git clone --depth 1 -b v0.8.0 https://github.com/ngtcp2/ngtcp2
    $ cd ngtcp2
    $ autoreconf -i
    $ ./configure --prefix=$PWD/build --enable-lib-only \
@@ -392,7 +389,7 @@ from source:
 
 .. code-block:: text
 
-   $ git clone --depth 1 -b v0.8.0 https://github.com/libbpf/libbpf
+   $ git clone --depth 1 -b v0.8.1 https://github.com/libbpf/libbpf
    $ cd libbpf
    $ PREFIX=$PWD/build make -C src install
    $ cd ..
@@ -1434,6 +1431,9 @@ corresponding header set was processed.  The format is the same as
 libnghttp2_asio: High level HTTP/2 C++ library
 ----------------------------------------------
 
+libnghttp2_asio has been deprecated, and moved to
+https://github.com/nghttp2/nghttp2-asio.
+
 libnghttp2_asio is C++ library built on top of libnghttp2 and provides
 high level abstraction API to build HTTP/2 applications.  It depends
 on the Boost::ASIO library and OpenSSL.  Currently libnghttp2_asio
@@ -1531,6 +1531,8 @@ For more details, see the documentation of libnghttp2_asio.
 Python bindings
 ---------------
 
+Python bindings have been deprecated.
+
 The ``python`` directory contains nghttp2 Python bindings.  The
 bindings currently provide HPACK compressor and decompressor classes
 and an HTTP/2 server.

contrib/libs/nghttp2/config.h

@@ -259,7 +259,7 @@
 #define PACKAGE_NAME "nghttp2"
 
 /* Define to the full name and version of this package. */
-#define PACKAGE_STRING "nghttp2 1.48.0"
+#define PACKAGE_STRING "nghttp2 1.49.0"
 
 /* Define to the one symbol short name of this package. */
 #define PACKAGE_TARNAME "nghttp2"
@@ -268,7 +268,7 @@
 #define PACKAGE_URL ""
 
 /* Define to the version of this package. */
-#define PACKAGE_VERSION "1.48.0"
+#define PACKAGE_VERSION "1.49.0"
 
 /* The size of `int *', as computed by sizeof. */
 #define SIZEOF_INT_P 8
@@ -373,7 +373,7 @@
 
 
 /* Version number of package */
-#define VERSION "1.48.0"
+#define VERSION "1.49.0"
 
 /* Define WORDS_BIGENDIAN to 1 if your processor stores words with the most
    significant byte first (like Motorola and SPARC, unlike Intel). */

contrib/libs/nghttp2/lib/includes/nghttp2/nghttp2.h

@@ -5046,9 +5046,23 @@ NGHTTP2_EXTERN int nghttp2_check_header_name(const uint8_t *name, size_t len);
  * Returns nonzero if HTTP header field value |value| of length |len|
  * is valid according to
  * http://tools.ietf.org/html/rfc7230#section-3.2
+ *
+ * This function is considered obsolete, and application should
+ * consider to use `nghttp2_check_header_value_rfc9113()` instead.
  */
 NGHTTP2_EXTERN int nghttp2_check_header_value(const uint8_t *value, size_t len);
 
+/**
+ * @function
+ *
+ * Returns nonzero if HTTP header field value |value| of length |len|
+ * is valid according to
+ * http://tools.ietf.org/html/rfc7230#section-3.2, plus
+ * https://datatracker.ietf.org/doc/html/rfc9113#section-8.2.1
+ */
+NGHTTP2_EXTERN int nghttp2_check_header_value_rfc9113(const uint8_t *value,
+                                                      size_t len);
+
 /**
  * @function
  *

contrib/libs/nghttp2/lib/includes/nghttp2/nghttp2ver.h

@@ -29,7 +29,7 @@
  * @macro
  * Version number of the nghttp2 library release
  */
-#define NGHTTP2_VERSION "1.48.0"
+#define NGHTTP2_VERSION "1.49.0"
 
 /**
  * @macro
@@ -37,6 +37,6 @@
  * release. This is a 24 bit number with 8 bits for major number, 8 bits
  * for minor and 8 bits for patch. Version 1.2.3 becomes 0x010203.
  */
-#define NGHTTP2_VERSION_NUM 0x013000
+#define NGHTTP2_VERSION_NUM 0x013100
 
 #endif /* NGHTTP2VER_H */

contrib/libs/nghttp2/lib/nghttp2_helper.c

@@ -507,6 +507,19 @@ int nghttp2_check_header_value(const uint8_t *value, size_t len) {
   return 1;
 }
 
+int nghttp2_check_header_value_rfc9113(const uint8_t *value, size_t len) {
+  if (len == 0) {
+    return 1;
+  }
+
+  if (*value == ' ' || *value == '\t' || *(value + len - 1) == ' ' ||
+      *(value + len - 1) == '\t') {
+    return 0;
+  }
+
+  return nghttp2_check_header_value(value, len);
+}
+
 /* Generated by genmethodchartbl.py */
 static char VALID_METHOD_CHARS[] = {
     0 /* NUL  */, 0 /* SOH  */, 0 /* STX  */, 0 /* ETX  */,

contrib/libs/nghttp2/lib/nghttp2_http.c

@@ -73,22 +73,9 @@ static int64_t parse_uint(const uint8_t *s, size_t len) {
   return n;
 }
 
-static int lws(const uint8_t *s, size_t n) {
-  size_t i;
-  for (i = 0; i < n; ++i) {
-    if (s[i] != ' ' && s[i] != '\t') {
-      return 0;
-    }
-  }
-  return 1;
-}
-
 static int check_pseudo_header(nghttp2_stream *stream, const nghttp2_hd_nv *nv,
                                uint32_t flag) {
-  if (stream->http_flags & flag) {
-    return 0;
-  }
-  if (lws(nv->value->base, nv->value->len)) {
+  if ((stream->http_flags & flag) || nv->value->len == 0) {
     return 0;
   }
   stream->http_flags = stream->http_flags | flag;
@@ -392,14 +379,14 @@ int nghttp2_http_on_header(nghttp2_session *session, nghttp2_stream *stream,
     if (session->server || frame->hd.type == NGHTTP2_PUSH_PROMISE) {
       rv = nghttp2_check_authority(nv->value->base, nv->value->len);
     } else {
-      rv = nghttp2_check_header_value(nv->value->base, nv->value->len);
+      rv = nghttp2_check_header_value_rfc9113(nv->value->base, nv->value->len);
     }
     break;
   case NGHTTP2_TOKEN__SCHEME:
     rv = check_scheme(nv->value->base, nv->value->len);
     break;
   default:
-    rv = nghttp2_check_header_value(nv->value->base, nv->value->len);
+    rv = nghttp2_check_header_value_rfc9113(nv->value->base, nv->value->len);
   }
 
   if (rv == 0) {

contrib/libs/nghttp2/lib/nghttp2_net.h

@@ -53,7 +53,7 @@
 STIN uint32_t htonl(uint32_t hostlong) {
   uint32_t res;
   unsigned char *p = (unsigned char *)&res;
-  *p++ = hostlong >> 24;
+  *p++ = (unsigned char)(hostlong >> 24);
   *p++ = (hostlong >> 16) & 0xffu;
   *p++ = (hostlong >> 8) & 0xffu;
   *p = hostlong & 0xffu;
@@ -63,7 +63,7 @@ STIN uint32_t htonl(uint32_t hostlong) {
 STIN uint16_t htons(uint16_t hostshort) {
   uint16_t res;
   unsigned char *p = (unsigned char *)&res;
-  *p++ = hostshort >> 8;
+  *p++ = (unsigned char)(hostshort >> 8);
   *p = hostshort & 0xffu;
   return res;
 }