server.mx raw

   1  // Copyright 2009 The Go Authors. All rights reserved.
   2  // Use of this source code is governed by a BSD-style
   3  // license that can be found in the LICENSE file.
   4  
   5  // HTTP server. See RFC 7230 through 7235.
   6  
   7  package http
   8  
   9  import (
  10  	"bufio"
  11  	"bytes"
  12  	"context"
  13  	"crypto/tls"
  14  	"errors"
  15  	"fmt"
  16  	"internal/godebug"
  17  	"io"
  18  	"log"
  19  	"maps"
  20  	"math/rand"
  21  	"net"
  22  	"net/textproto"
  23  	"net/url"
  24  	urlpkg "net/url"
  25  	"path"
  26  	"runtime"
  27  	"slices"
  28  	"strconv"
  29  	"sync"
  30  	"sync/atomic"
  31  	"time"
  32  	_ "unsafe" // for linkname
  33  
  34  	"golang.org/x/net/http/httpguts"
  35  )
  36  
  37  // Errors used by the HTTP server.
  38  var (
  39  	// ErrBodyNotAllowed is returned by ResponseWriter.Write calls
  40  	// when the HTTP method or response code does not permit a
  41  	// body.
  42  	ErrBodyNotAllowed = errors.New("http: request method or response status code does not allow body")
  43  
  44  	// ErrHijacked is returned by ResponseWriter.Write calls when
  45  	// the underlying connection has been hijacked using the
  46  	// Hijacker interface. A zero-byte write on a hijacked
  47  	// connection will return ErrHijacked without any other side
  48  	// effects.
  49  	ErrHijacked = errors.New("http: connection has been hijacked")
  50  
  51  	// ErrContentLength is returned by ResponseWriter.Write calls
  52  	// when a Handler set a Content-Length response header with a
  53  	// declared size and then attempted to write more bytes than
  54  	// declared.
  55  	ErrContentLength = errors.New("http: wrote more than the declared Content-Length")
  56  
  57  	// Deprecated: ErrWriteAfterFlush is no longer returned by
  58  	// anything in the net/http package. Callers should not
  59  	// compare errors against this variable.
  60  	ErrWriteAfterFlush = errors.New("unused")
  61  )
  62  
  63  // A Handler responds to an HTTP request.
  64  //
  65  // [Handler.ServeHTTP] should write reply headers and data to the [ResponseWriter]
  66  // and then return. Returning signals that the request is finished; it
  67  // is not valid to use the [ResponseWriter] or read from the
  68  // [Request.Body] after or concurrently with the completion of the
  69  // ServeHTTP call.
  70  //
  71  // Depending on the HTTP client software, HTTP protocol version, and
  72  // any intermediaries between the client and the Go server, it may not
  73  // be possible to read from the [Request.Body] after writing to the
  74  // [ResponseWriter]. Cautious handlers should read the [Request.Body]
  75  // first, and then reply.
  76  //
  77  // Except for reading the body, handlers should not modify the
  78  // provided Request.
  79  //
  80  // If ServeHTTP panics, the server (the caller of ServeHTTP) assumes
  81  // that the effect of the panic was isolated to the active request.
  82  // It recovers the panic, logs a stack trace to the server error log,
  83  // and either closes the network connection or sends an HTTP/2
  84  // RST_STREAM, depending on the HTTP protocol. To abort a handler so
  85  // the client sees an interrupted response but the server doesn't log
  86  // an error, panic with the value [ErrAbortHandler].
  87  type Handler interface {
  88  	ServeHTTP(ResponseWriter, *Request)
  89  }
  90  
  91  // A ResponseWriter interface is used by an HTTP handler to
  92  // construct an HTTP response.
  93  //
  94  // A ResponseWriter may not be used after [Handler.ServeHTTP] has returned.
  95  type ResponseWriter interface {
  96  	// Header returns the header map that will be sent by
  97  	// [ResponseWriter.WriteHeader]. The [Header] map also is the mechanism with which
  98  	// [Handler] implementations can set HTTP trailers.
  99  	//
 100  	// Changing the header map after a call to [ResponseWriter.WriteHeader] (or
 101  	// [ResponseWriter.Write]) has no effect unless the HTTP status code was of the
 102  	// 1xx class or the modified headers are trailers.
 103  	//
 104  	// There are two ways to set Trailers. The preferred way is to
 105  	// predeclare in the headers which trailers you will later
 106  	// send by setting the "Trailer" header to the names of the
 107  	// trailer keys which will come later. In this case, those
 108  	// keys of the Header map are treated as if they were
 109  	// trailers. See the example. The second way, for trailer
 110  	// keys not known to the [Handler] until after the first [ResponseWriter.Write],
 111  	// is to prefix the [Header] map keys with the [TrailerPrefix]
 112  	// constant value.
 113  	//
 114  	// To suppress automatic response headers (such as "Date"), set
 115  	// their value to nil.
 116  	Header() Header
 117  
 118  	// Write writes the data to the connection as part of an HTTP reply.
 119  	//
 120  	// If [ResponseWriter.WriteHeader] has not yet been called, Write calls
 121  	// WriteHeader(http.StatusOK) before writing the data. If the Header
 122  	// does not contain a Content-Type line, Write adds a Content-Type set
 123  	// to the result of passing the initial 512 bytes of written data to
 124  	// [DetectContentType]. Additionally, if the total size of all written
 125  	// data is under a few KB and there are no Flush calls, the
 126  	// Content-Length header is added automatically.
 127  	//
 128  	// Depending on the HTTP protocol version and the client, calling
 129  	// Write or WriteHeader may prevent future reads on the
 130  	// Request.Body. For HTTP/1.x requests, handlers should read any
 131  	// needed request body data before writing the response. Once the
 132  	// headers have been flushed (due to either an explicit Flusher.Flush
 133  	// call or writing enough data to trigger a flush), the request body
 134  	// may be unavailable. For HTTP/2 requests, the Go HTTP server permits
 135  	// handlers to continue to read the request body while concurrently
 136  	// writing the response. However, such behavior may not be supported
 137  	// by all HTTP/2 clients. Handlers should read before writing if
 138  	// possible to maximize compatibility.
 139  	Write([]byte) (int, error)
 140  
 141  	// WriteHeader sends an HTTP response header with the provided
 142  	// status code.
 143  	//
 144  	// If WriteHeader is not called explicitly, the first call to Write
 145  	// will trigger an implicit WriteHeader(http.StatusOK).
 146  	// Thus explicit calls to WriteHeader are mainly used to
 147  	// send error codes or 1xx informational responses.
 148  	//
 149  	// The provided code must be a valid HTTP 1xx-5xx status code.
 150  	// Any number of 1xx headers may be written, followed by at most
 151  	// one 2xx-5xx header. 1xx headers are sent immediately, but 2xx-5xx
 152  	// headers may be buffered. Use the Flusher interface to send
 153  	// buffered data. The header map is cleared when 2xx-5xx headers are
 154  	// sent, but not with 1xx headers.
 155  	//
 156  	// The server will automatically send a 100 (Continue) header
 157  	// on the first read from the request body if the request has
 158  	// an "Expect: 100-continue" header.
 159  	WriteHeader(statusCode int)
 160  }
 161  
 162  // The Flusher interface is implemented by ResponseWriters that allow
 163  // an HTTP handler to flush buffered data to the client.
 164  //
 165  // The default HTTP/1.x and HTTP/2 [ResponseWriter] implementations
 166  // support [Flusher], but ResponseWriter wrappers may not. Handlers
 167  // should always test for this ability at runtime.
 168  //
 169  // Note that even for ResponseWriters that support Flush,
 170  // if the client is connected through an HTTP proxy,
 171  // the buffered data may not reach the client until the response
 172  // completes.
 173  type Flusher interface {
 174  	// Flush sends any buffered data to the client.
 175  	Flush()
 176  }
 177  
 178  // The Hijacker interface is implemented by ResponseWriters that allow
 179  // an HTTP handler to take over the connection.
 180  //
 181  // The default [ResponseWriter] for HTTP/1.x connections supports
 182  // Hijacker, but HTTP/2 connections intentionally do not.
 183  // ResponseWriter wrappers may also not support Hijacker. Handlers
 184  // should always test for this ability at runtime.
 185  type Hijacker interface {
 186  	// Hijack lets the caller take over the connection.
 187  	// After a call to Hijack the HTTP server library
 188  	// will not do anything else with the connection.
 189  	//
 190  	// It becomes the caller's responsibility to manage
 191  	// and close the connection.
 192  	//
 193  	// The returned net.Conn may have read or write deadlines
 194  	// already set, depending on the configuration of the
 195  	// Server. It is the caller's responsibility to set
 196  	// or clear those deadlines as needed.
 197  	//
 198  	// The returned bufio.Reader may contain unprocessed buffered
 199  	// data from the client.
 200  	//
 201  	// After a call to Hijack, the original Request.Body must not
 202  	// be used. The original Request's Context remains valid and
 203  	// is not canceled until the Request's ServeHTTP method
 204  	// returns.
 205  	Hijack() (net.Conn, *bufio.ReadWriter, error)
 206  }
 207  
 208  // The CloseNotifier interface is implemented by ResponseWriters which
 209  // allow detecting when the underlying connection has gone away.
 210  //
 211  // This mechanism can be used to cancel long operations on the server
 212  // if the client has disconnected before the response is ready.
 213  //
 214  // Deprecated: the CloseNotifier interface predates Go's context package.
 215  // New code should use [Request.Context] instead.
 216  type CloseNotifier interface {
 217  	// CloseNotify returns a channel that receives at most a
 218  	// single value (true) when the client connection has gone
 219  	// away.
 220  	//
 221  	// CloseNotify may wait to notify until Request.Body has been
 222  	// fully read.
 223  	//
 224  	// After the Handler has returned, there is no guarantee
 225  	// that the channel receives a value.
 226  	//
 227  	// If the protocol is HTTP/1.1 and CloseNotify is called while
 228  	// processing an idempotent request (such as GET) while
 229  	// HTTP/1.1 pipelining is in use, the arrival of a subsequent
 230  	// pipelined request may cause a value to be sent on the
 231  	// returned channel. In practice HTTP/1.1 pipelining is not
 232  	// enabled in browsers and not seen often in the wild. If this
 233  	// is a problem, use HTTP/2 or only use CloseNotify on methods
 234  	// such as POST.
 235  	CloseNotify() <-chan bool
 236  }
 237  
 238  var (
 239  	// ServerContextKey is a context key. It can be used in HTTP
 240  	// handlers with Context.Value to access the server that
 241  	// started the handler. The associated value will be of
 242  	// type *Server.
 243  	ServerContextKey = &contextKey{"http-server"}
 244  
 245  	// LocalAddrContextKey is a context key. It can be used in
 246  	// HTTP handlers with Context.Value to access the local
 247  	// address the connection arrived on.
 248  	// The associated value will be of type net.Addr.
 249  	LocalAddrContextKey = &contextKey{"local-addr"}
 250  )
 251  
 252  // A conn represents the server side of an HTTP connection.
 253  type conn struct {
 254  	// server is the server on which the connection arrived.
 255  	// Immutable; never nil.
 256  	server *Server
 257  
 258  	// cancelCtx cancels the connection-level context.
 259  	cancelCtx context.CancelFunc
 260  
 261  	// rwc is the underlying network connection.
 262  	// This is never wrapped by other types and is the value given out
 263  	// to [Hijacker] callers. It is usually of type *net.TCPConn or
 264  	// *tls.Conn.
 265  	rwc net.Conn
 266  
 267  	// remoteAddr is rwc.RemoteAddr().String(). It is not populated synchronously
 268  	// inside the Listener's Accept goroutine, as some implementations block.
 269  	// It is populated immediately inside the (*conn).serve goroutine.
 270  	// This is the value of a Handler's (*Request).RemoteAddr.
 271  	remoteAddr string
 272  
 273  	// tlsState is the TLS connection state when using TLS.
 274  	// nil means not TLS.
 275  	tlsState *tls.ConnectionState
 276  
 277  	// werr is set to the first write error to rwc.
 278  	// It is set via checkConnErrorWriter{w}, where bufw writes.
 279  	werr error
 280  
 281  	// r is bufr's read source. It's a wrapper around rwc that provides
 282  	// io.LimitedReader-style limiting (while reading request headers)
 283  	// and functionality to support CloseNotifier. See *connReader docs.
 284  	r *connReader
 285  
 286  	// bufr reads from r.
 287  	bufr *bufio.Reader
 288  
 289  	// bufw writes to checkConnErrorWriter{c}, which populates werr on error.
 290  	bufw *bufio.Writer
 291  
 292  	// lastMethod is the method of the most recent request
 293  	// on this connection, if any.
 294  	lastMethod string
 295  
 296  	curReq atomic.Pointer[response] // (which has a Request in it)
 297  
 298  	curState atomic.Uint64 // packed (unixtime<<8|uint8(ConnState))
 299  
 300  	// mu guards hijackedv
 301  	mu sync.Mutex
 302  
 303  	// hijackedv is whether this connection has been hijacked
 304  	// by a Handler with the Hijacker interface.
 305  	// It is guarded by mu.
 306  	hijackedv bool
 307  }
 308  
 309  func (c *conn) hijacked() bool {
 310  	c.mu.Lock()
 311  	defer c.mu.Unlock()
 312  	return c.hijackedv
 313  }
 314  
 315  // c.mu must be held.
 316  func (c *conn) hijackLocked() (rwc net.Conn, buf *bufio.ReadWriter, err error) {
 317  	if c.hijackedv {
 318  		return nil, nil, ErrHijacked
 319  	}
 320  	c.r.abortPendingRead()
 321  
 322  	c.hijackedv = true
 323  	rwc = c.rwc
 324  	rwc.SetDeadline(time.Time{})
 325  
 326  	if c.r.hasByte {
 327  		if _, err := c.bufr.Peek(c.bufr.Buffered() + 1); err != nil {
 328  			return nil, nil, fmt.Errorf("unexpected Peek failure reading buffered byte: %v", err)
 329  		}
 330  	}
 331  	c.bufw.Reset(rwc)
 332  	buf = bufio.NewReadWriter(c.bufr, c.bufw)
 333  
 334  	c.setState(rwc, StateHijacked, runHooks)
 335  	return
 336  }
 337  
 338  // This should be >= 512 bytes for DetectContentType,
 339  // but otherwise it's somewhat arbitrary.
 340  const bufferBeforeChunkingSize = 2048
 341  
 342  // chunkWriter writes to a response's conn buffer, and is the writer
 343  // wrapped by the response.w buffered writer.
 344  //
 345  // chunkWriter also is responsible for finalizing the Header, including
 346  // conditionally setting the Content-Type and setting a Content-Length
 347  // in cases where the handler's final output is smaller than the buffer
 348  // size. It also conditionally adds chunk headers, when in chunking mode.
 349  //
 350  // See the comment above (*response).Write for the entire write flow.
 351  type chunkWriter struct {
 352  	res *response
 353  
 354  	// header is either nil or a deep clone of res.handlerHeader
 355  	// at the time of res.writeHeader, if res.writeHeader is
 356  	// called and extra buffering is being done to calculate
 357  	// Content-Type and/or Content-Length.
 358  	header Header
 359  
 360  	// wroteHeader tells whether the header's been written to "the
 361  	// wire" (or rather: w.conn.buf). this is unlike
 362  	// (*response).wroteHeader, which tells only whether it was
 363  	// logically written.
 364  	wroteHeader bool
 365  
 366  	// set by the writeHeader method:
 367  	chunking bool // using chunked transfer encoding for reply body
 368  }
 369  
 370  var (
 371  	crlf       = []byte("\r\n")
 372  	colonSpace = []byte(": ")
 373  )
 374  
 375  func (cw *chunkWriter) Write(p []byte) (n int, err error) {
 376  	if !cw.wroteHeader {
 377  		cw.writeHeader(p)
 378  	}
 379  	if cw.res.req.Method == "HEAD" {
 380  		// Eat writes.
 381  		return len(p), nil
 382  	}
 383  	if cw.chunking {
 384  		_, err = fmt.Fprintf(cw.res.conn.bufw, "%x\r\n", len(p))
 385  		if err != nil {
 386  			cw.res.conn.rwc.Close()
 387  			return
 388  		}
 389  	}
 390  	n, err = cw.res.conn.bufw.Write(p)
 391  	if cw.chunking && err == nil {
 392  		_, err = cw.res.conn.bufw.Write(crlf)
 393  	}
 394  	if err != nil {
 395  		cw.res.conn.rwc.Close()
 396  	}
 397  	return
 398  }
 399  
 400  func (cw *chunkWriter) flush() error {
 401  	if !cw.wroteHeader {
 402  		cw.writeHeader(nil)
 403  	}
 404  	return cw.res.conn.bufw.Flush()
 405  }
 406  
 407  func (cw *chunkWriter) close() {
 408  	if !cw.wroteHeader {
 409  		cw.writeHeader(nil)
 410  	}
 411  	if cw.chunking {
 412  		bw := cw.res.conn.bufw // conn's bufio writer
 413  		// zero chunk to mark EOF
 414  		bw.WriteString("0\r\n")
 415  		if trailers := cw.res.finalTrailers(); trailers != nil {
 416  			trailers.Write(bw) // the writer handles noting errors
 417  		}
 418  		// final blank line after the trailers (whether
 419  		// present or not)
 420  		bw.WriteString("\r\n")
 421  	}
 422  }
 423  
 424  // A response represents the server side of an HTTP response.
 425  type response struct {
 426  	conn             *conn
 427  	req              *Request // request for this response
 428  	reqBody          io.ReadCloser
 429  	cancelCtx        context.CancelFunc // when ServeHTTP exits
 430  	wroteHeader      bool               // a non-1xx header has been (logically) written
 431  	wants10KeepAlive bool               // HTTP/1.0 w/ Connection "keep-alive"
 432  	wantsClose       bool               // HTTP request has Connection "close"
 433  
 434  	// canWriteContinue is an atomic boolean that says whether or
 435  	// not a 100 Continue header can be written to the
 436  	// connection.
 437  	// writeContinueMu must be held while writing the header.
 438  	// These two fields together synchronize the body reader (the
 439  	// expectContinueReader, which wants to write 100 Continue)
 440  	// against the main writer.
 441  	writeContinueMu  sync.Mutex
 442  	canWriteContinue atomic.Bool
 443  
 444  	w  *bufio.Writer // buffers output in chunks to chunkWriter
 445  	cw chunkWriter
 446  
 447  	// handlerHeader is the Header that Handlers get access to,
 448  	// which may be retained and mutated even after WriteHeader.
 449  	// handlerHeader is copied into cw.header at WriteHeader
 450  	// time, and privately mutated thereafter.
 451  	handlerHeader Header
 452  	calledHeader  bool // handler accessed handlerHeader via Header
 453  
 454  	written       int64 // number of bytes written in body
 455  	contentLength int64 // explicitly-declared Content-Length; or -1
 456  	status        int   // status code passed to WriteHeader
 457  
 458  	// close connection after this reply.  set on request and
 459  	// updated after response from handler if there's a
 460  	// "Connection: keep-alive" response header and a
 461  	// Content-Length.
 462  	closeAfterReply bool
 463  
 464  	// When fullDuplex is false (the default), we consume any remaining
 465  	// request body before starting to write a response.
 466  	fullDuplex bool
 467  
 468  	// requestBodyLimitHit is set by requestTooLarge when
 469  	// maxBytesReader hits its max size. It is checked in
 470  	// WriteHeader, to make sure we don't consume the
 471  	// remaining request body to try to advance to the next HTTP
 472  	// request. Instead, when this is set, we stop reading
 473  	// subsequent requests on this connection and stop reading
 474  	// input from it.
 475  	requestBodyLimitHit bool
 476  
 477  	// trailers are the headers to be sent after the handler
 478  	// finishes writing the body. This field is initialized from
 479  	// the Trailer response header when the response header is
 480  	// written.
 481  	trailers [][]byte
 482  
 483  	handlerDone atomic.Bool // set true when the handler exits
 484  
 485  	// Buffers for Date, Content-Length, and status code
 486  	dateBuf   [29]byte // len(TimeFormat)
 487  	clenBuf   [10]byte
 488  	statusBuf [3]byte
 489  
 490  	// lazyCloseNotifyMu protects closeNotifyCh and closeNotifyTriggered.
 491  	lazyCloseNotifyMu sync.Mutex
 492  	// closeNotifyCh is the channel returned by CloseNotify.
 493  	closeNotifyCh chan bool
 494  	// closeNotifyTriggered tracks prior closeNotify calls.
 495  	closeNotifyTriggered bool
 496  }
 497  
 498  func (c *response) SetReadDeadline(deadline time.Time) error {
 499  	return c.conn.rwc.SetReadDeadline(deadline)
 500  }
 501  
 502  func (c *response) SetWriteDeadline(deadline time.Time) error {
 503  	return c.conn.rwc.SetWriteDeadline(deadline)
 504  }
 505  
 506  func (c *response) EnableFullDuplex() error {
 507  	c.fullDuplex = true
 508  	return nil
 509  }
 510  
 511  // TrailerPrefix is a magic prefix for [ResponseWriter.Header] map keys
 512  // that, if present, signals that the map entry is actually for
 513  // the response trailers, and not the response headers. The prefix
 514  // is stripped after the ServeHTTP call finishes and the values are
 515  // sent in the trailers.
 516  //
 517  // This mechanism is intended only for trailers that are not known
 518  // prior to the headers being written. If the set of trailers is fixed
 519  // or known before the header is written, the normal Go trailers mechanism
 520  // is preferred:
 521  //
 522  //	https://pkg.go.dev/net/http#ResponseWriter
 523  //	https://pkg.go.dev/net/http#example-ResponseWriter-Trailers
 524  const TrailerPrefix = "Trailer:"
 525  
 526  // finalTrailers is called after the Handler exits and returns a non-nil
 527  // value if the Handler set any trailers.
 528  func (w *response) finalTrailers() Header {
 529  	var t Header
 530  	for k, vv := range w.handlerHeader {
 531  		if kk, found := bytes.CutPrefix(k, TrailerPrefix); found {
 532  			if t == nil {
 533  				t = make(Header)
 534  			}
 535  			t[kk] = vv
 536  		}
 537  	}
 538  	for _, k := range w.trailers {
 539  		if t == nil {
 540  			t = make(Header)
 541  		}
 542  		for _, v := range w.handlerHeader[k] {
 543  			t.Add(k, v)
 544  		}
 545  	}
 546  	return t
 547  }
 548  
 549  // declareTrailer is called for each Trailer header when the
 550  // response header is written. It notes that a header will need to be
 551  // written in the trailers at the end of the response.
 552  func (w *response) declareTrailer(k string) {
 553  	k = CanonicalHeaderKey(k)
 554  	if !httpguts.ValidTrailerHeader(k) {
 555  		// Forbidden by RFC 7230, section 4.1.2
 556  		return
 557  	}
 558  	w.trailers = append(w.trailers, k)
 559  }
 560  
 561  // requestTooLarge is called by maxBytesReader when too much input has
 562  // been read from the client.
 563  func (w *response) requestTooLarge() {
 564  	w.closeAfterReply = true
 565  	w.requestBodyLimitHit = true
 566  	if !w.wroteHeader {
 567  		w.Header().Set("Connection", "close")
 568  	}
 569  }
 570  
 571  // disableWriteContinue stops Request.Body.Read from sending an automatic 100-Continue.
 572  // If a 100-Continue is being written, it waits for it to complete before continuing.
 573  func (w *response) disableWriteContinue() {
 574  	w.writeContinueMu.Lock()
 575  	w.canWriteContinue.Store(false)
 576  	w.writeContinueMu.Unlock()
 577  }
 578  
 579  // writerOnly hides an io.Writer value's optional ReadFrom method
 580  // from io.Copy.
 581  type writerOnly struct {
 582  	io.Writer
 583  }
 584  
 585  // ReadFrom is here to optimize copying from an [*os.File] regular file
 586  // to a [*net.TCPConn] with sendfile, or from a supported src type such
 587  // as a *net.TCPConn on Linux with splice.
 588  func (w *response) ReadFrom(src io.Reader) (n int64, err error) {
 589  	buf := getCopyBuf()
 590  	defer putCopyBuf(buf)
 591  
 592  	// Our underlying w.conn.rwc is usually a *TCPConn (with its
 593  	// own ReadFrom method). If not, just fall back to the normal
 594  	// copy method.
 595  	rf, ok := w.conn.rwc.(io.ReaderFrom)
 596  	if !ok {
 597  		return io.CopyBuffer(writerOnly{w}, src, buf)
 598  	}
 599  
 600  	// Copy the first sniffLen bytes before switching to ReadFrom.
 601  	// This ensures we don't start writing the response before the
 602  	// source is available (see golang.org/issue/5660) and provides
 603  	// enough bytes to perform Content-Type sniffing when required.
 604  	if !w.cw.wroteHeader {
 605  		n0, err := io.CopyBuffer(writerOnly{w}, io.LimitReader(src, sniffLen), buf)
 606  		n += n0
 607  		if err != nil || n0 < sniffLen {
 608  			return n, err
 609  		}
 610  	}
 611  
 612  	w.w.Flush()  // get rid of any previous writes
 613  	w.cw.flush() // make sure Header is written; flush data to rwc
 614  
 615  	// Now that cw has been flushed, its chunking field is guaranteed initialized.
 616  	if !w.cw.chunking && w.bodyAllowed() && w.req.Method != "HEAD" {
 617  		n0, err := rf.ReadFrom(src)
 618  		n += n0
 619  		w.written += n0
 620  		return n, err
 621  	}
 622  
 623  	n0, err := io.CopyBuffer(writerOnly{w}, src, buf)
 624  	n += n0
 625  	return n, err
 626  }
 627  
 628  // debugServerConnections controls whether all server connections are wrapped
 629  // with a verbose logging wrapper.
 630  const debugServerConnections = false
 631  
 632  // Create new connection from rwc.
 633  func (s *Server) newConn(rwc net.Conn) *conn {
 634  	c := &conn{
 635  		server: s,
 636  		rwc:    rwc,
 637  	}
 638  	if debugServerConnections {
 639  		c.rwc = newLoggingConn("server", c.rwc)
 640  	}
 641  	return c
 642  }
 643  
 644  type readResult struct {
 645  	_   incomparable
 646  	n   int
 647  	err error
 648  	b   byte // byte read, if n == 1
 649  }
 650  
 651  // connReader is the io.Reader wrapper used by *conn. It combines a
 652  // selectively-activated io.LimitedReader (to bound request header
 653  // read sizes) with support for selectively keeping an io.Reader.Read
 654  // call blocked in a background goroutine to wait for activity and
 655  // trigger a CloseNotifier channel.
 656  // After a Handler has hijacked the conn and exited, connReader behaves like a
 657  // proxy for the net.Conn and the aforementioned behavior is bypassed.
 658  type connReader struct {
 659  	rwc net.Conn // rwc is the underlying network connection.
 660  
 661  	mu      sync.Mutex // guards following
 662  	conn    *conn      // conn is nil after handler exit.
 663  	hasByte bool
 664  	byteBuf [1]byte
 665  	cond    *sync.Cond
 666  	inRead  bool
 667  	aborted bool  // set true before conn.rwc deadline is set to past
 668  	remain  int64 // bytes remaining
 669  }
 670  
 671  func (cr *connReader) lock() {
 672  	cr.mu.Lock()
 673  	if cr.cond == nil {
 674  		cr.cond = sync.NewCond(&cr.mu)
 675  	}
 676  }
 677  
 678  func (cr *connReader) unlock() { cr.mu.Unlock() }
 679  
 680  func (cr *connReader) releaseConn() {
 681  	cr.lock()
 682  	defer cr.unlock()
 683  	cr.conn = nil
 684  }
 685  
 686  func (cr *connReader) startBackgroundRead() {
 687  	// Moxie: no goroutines. The original code launched backgroundRead in a
 688  	// goroutine to detect pipelined requests while the handler runs.
 689  	// Without goroutines, this would block forever waiting for the next
 690  	// request byte before the current request is even handled. No-op.
 691  }
 692  
 693  func (cr *connReader) backgroundRead() {
 694  	n, err := cr.rwc.Read(cr.byteBuf[:])
 695  	cr.lock()
 696  	if n == 1 {
 697  		cr.hasByte = true
 698  		// We were past the end of the previous request's body already
 699  		// (since we wouldn't be in a background read otherwise), so
 700  		// this is a pipelined HTTP request. Prior to Go 1.11 we used to
 701  		// send on the CloseNotify channel and cancel the context here,
 702  		// but the behavior was documented as only "may", and we only
 703  		// did that because that's how CloseNotify accidentally behaved
 704  		// in very early Go releases prior to context support. Once we
 705  		// added context support, people used a Handler's
 706  		// Request.Context() and passed it along. Having that context
 707  		// cancel on pipelined HTTP requests caused problems.
 708  		// Fortunately, almost nothing uses HTTP/1.x pipelining.
 709  		// Unfortunately, apt-get does, or sometimes does.
 710  		// New Go 1.11 behavior: don't fire CloseNotify or cancel
 711  		// contexts on pipelined requests. Shouldn't affect people, but
 712  		// fixes cases like Issue 23921. This does mean that a client
 713  		// closing their TCP connection after sending a pipelined
 714  		// request won't cancel the context, but we'll catch that on any
 715  		// write failure (in checkConnErrorWriter.Write).
 716  		// If the server never writes, yes, there are still contrived
 717  		// server & client behaviors where this fails to ever cancel the
 718  		// context, but that's kinda why HTTP/1.x pipelining died
 719  		// anyway.
 720  	}
 721  	if ne, ok := err.(net.Error); ok && cr.aborted && ne.Timeout() {
 722  		// Ignore this error. It's the expected error from
 723  		// another goroutine calling abortPendingRead.
 724  	} else if err != nil {
 725  		cr.handleReadErrorLocked(err)
 726  	}
 727  	cr.aborted = false
 728  	cr.inRead = false
 729  	cr.unlock()
 730  	cr.cond.Broadcast()
 731  }
 732  
 733  func (cr *connReader) abortPendingRead() {
 734  	cr.lock()
 735  	defer cr.unlock()
 736  	if !cr.inRead {
 737  		return
 738  	}
 739  	cr.aborted = true
 740  	cr.rwc.SetReadDeadline(aLongTimeAgo)
 741  	for cr.inRead {
 742  		cr.cond.Wait()
 743  	}
 744  	cr.rwc.SetReadDeadline(time.Time{})
 745  }
 746  
 747  func (cr *connReader) setReadLimit(remain int64) { cr.remain = remain }
 748  func (cr *connReader) setInfiniteReadLimit()     { cr.remain = maxInt64 }
 749  func (cr *connReader) hitReadLimit() bool        { return cr.remain <= 0 }
 750  
 751  // handleReadErrorLocked is called whenever a Read from the client returns a
 752  // non-nil error.
 753  //
 754  // The provided non-nil err is almost always io.EOF or a "use of
 755  // closed network connection". In any case, the error is not
 756  // particularly interesting, except perhaps for debugging during
 757  // development. Any error means the connection is dead and we should
 758  // down its context.
 759  //
 760  // The caller must hold connReader.mu.
 761  func (cr *connReader) handleReadErrorLocked(_ error) {
 762  	if cr.conn == nil {
 763  		return
 764  	}
 765  	cr.conn.cancelCtx()
 766  	if res := cr.conn.curReq.Load(); res != nil {
 767  		res.closeNotify()
 768  	}
 769  }
 770  
 771  func (cr *connReader) Read(p []byte) (n int, err error) {
 772  	cr.lock()
 773  	if cr.conn == nil {
 774  		cr.unlock()
 775  		return cr.rwc.Read(p)
 776  	}
 777  	if cr.inRead {
 778  		hijacked := cr.conn.hijacked()
 779  		cr.unlock()
 780  		if hijacked {
 781  			panic("invalid Body.Read call. After hijacked, the original Request must not be used")
 782  		}
 783  		panic("invalid concurrent Body.Read call")
 784  	}
 785  	if cr.hitReadLimit() {
 786  		cr.unlock()
 787  		return 0, io.EOF
 788  	}
 789  	if len(p) == 0 {
 790  		cr.unlock()
 791  		return 0, nil
 792  	}
 793  	if int64(len(p)) > cr.remain {
 794  		p = p[:cr.remain]
 795  	}
 796  	if cr.hasByte {
 797  		p[0] = cr.byteBuf[0]
 798  		cr.hasByte = false
 799  		cr.unlock()
 800  		return 1, nil
 801  	}
 802  	cr.inRead = true
 803  	cr.unlock()
 804  	n, err = cr.rwc.Read(p)
 805  
 806  	cr.lock()
 807  	cr.inRead = false
 808  	if err != nil {
 809  		cr.handleReadErrorLocked(err)
 810  	}
 811  	cr.remain -= int64(n)
 812  	cr.unlock()
 813  
 814  	cr.cond.Broadcast()
 815  	return n, err
 816  }
 817  
 818  var (
 819  	bufioReaderPool   sync.Pool
 820  	bufioWriter2kPool sync.Pool
 821  	bufioWriter4kPool sync.Pool
 822  )
 823  
 824  const copyBufPoolSize = 32 * 1024
 825  
 826  var copyBufPool = sync.Pool{New: func() any { return &[copyBufPoolSize]byte{} }}
 827  
 828  func getCopyBuf() []byte {
 829  	return copyBufPool.Get().(*[copyBufPoolSize]byte)[:]
 830  }
 831  
 832  func putCopyBuf(b []byte) {
 833  	if len(b) != copyBufPoolSize {
 834  		panic("trying to put back buffer of the wrong size in the copyBufPool")
 835  	}
 836  	copyBufPool.Put((*[copyBufPoolSize]byte)(b))
 837  }
 838  
 839  func bufioWriterPool(size int) *sync.Pool {
 840  	switch size {
 841  	case 2 << 10:
 842  		return &bufioWriter2kPool
 843  	case 4 << 10:
 844  		return &bufioWriter4kPool
 845  	}
 846  	return nil
 847  }
 848  
 849  // newBufioReader should be an internal detail,
 850  // but widely used packages access it using linkname.
 851  // Notable members of the hall of shame include:
 852  //   - github.com/gobwas/ws
 853  //
 854  // Do not remove or change the type signature.
 855  // See go.dev/issue/67401.
 856  //
 857  //go:linkname newBufioReader
 858  func newBufioReader(r io.Reader) *bufio.Reader {
 859  	if v := bufioReaderPool.Get(); v != nil {
 860  		br := v.(*bufio.Reader)
 861  		br.Reset(r)
 862  		return br
 863  	}
 864  	// Note: if this reader size is ever changed, update
 865  	// TestHandlerBodyClose's assumptions.
 866  	return bufio.NewReader(r)
 867  }
 868  
 869  // putBufioReader should be an internal detail,
 870  // but widely used packages access it using linkname.
 871  // Notable members of the hall of shame include:
 872  //   - github.com/gobwas/ws
 873  //
 874  // Do not remove or change the type signature.
 875  // See go.dev/issue/67401.
 876  //
 877  //go:linkname putBufioReader
 878  func putBufioReader(br *bufio.Reader) {
 879  	br.Reset(nil)
 880  	bufioReaderPool.Put(br)
 881  }
 882  
 883  // newBufioWriterSize should be an internal detail,
 884  // but widely used packages access it using linkname.
 885  // Notable members of the hall of shame include:
 886  //   - github.com/gobwas/ws
 887  //
 888  // Do not remove or change the type signature.
 889  // See go.dev/issue/67401.
 890  //
 891  //go:linkname newBufioWriterSize
 892  func newBufioWriterSize(w io.Writer, size int) *bufio.Writer {
 893  	pool := bufioWriterPool(size)
 894  	if pool != nil {
 895  		if v := pool.Get(); v != nil {
 896  			bw := v.(*bufio.Writer)
 897  			bw.Reset(w)
 898  			return bw
 899  		}
 900  	}
 901  	return bufio.NewWriterSize(w, size)
 902  }
 903  
 904  // putBufioWriter should be an internal detail,
 905  // but widely used packages access it using linkname.
 906  // Notable members of the hall of shame include:
 907  //   - github.com/gobwas/ws
 908  //
 909  // Do not remove or change the type signature.
 910  // See go.dev/issue/67401.
 911  //
 912  //go:linkname putBufioWriter
 913  func putBufioWriter(bw *bufio.Writer) {
 914  	bw.Reset(nil)
 915  	if pool := bufioWriterPool(bw.Available()); pool != nil {
 916  		pool.Put(bw)
 917  	}
 918  }
 919  
 920  // DefaultMaxHeaderBytes is the maximum permitted size of the headers
 921  // in an HTTP request.
 922  // This can be overridden by setting [Server.MaxHeaderBytes].
 923  const DefaultMaxHeaderBytes = 1 << 20 // 1 MB
 924  
 925  func (s *Server) maxHeaderBytes() int {
 926  	if s.MaxHeaderBytes > 0 {
 927  		return s.MaxHeaderBytes
 928  	}
 929  	return DefaultMaxHeaderBytes
 930  }
 931  
 932  func (s *Server) initialReadLimitSize() int64 {
 933  	return int64(s.maxHeaderBytes()) + 4096 // bufio slop
 934  }
 935  
 936  // tlsHandshakeTimeout returns the time limit permitted for the TLS
 937  // handshake, or zero for unlimited.
 938  //
 939  // It returns the minimum of any positive ReadHeaderTimeout,
 940  // ReadTimeout, or WriteTimeout.
 941  func (s *Server) tlsHandshakeTimeout() time.Duration {
 942  	var ret time.Duration
 943  	for _, v := range [...]time.Duration{
 944  		s.ReadHeaderTimeout,
 945  		s.ReadTimeout,
 946  		s.WriteTimeout,
 947  	} {
 948  		if v <= 0 {
 949  			continue
 950  		}
 951  		if ret == 0 || v < ret {
 952  			ret = v
 953  		}
 954  	}
 955  	return ret
 956  }
 957  
 958  // wrapper around io.ReadCloser which on first read, sends an
 959  // HTTP/1.1 100 Continue header
 960  type expectContinueReader struct {
 961  	resp       *response
 962  	readCloser io.ReadCloser
 963  	closed     atomic.Bool
 964  	sawEOF     atomic.Bool
 965  }
 966  
 967  func (ecr *expectContinueReader) Read(p []byte) (n int, err error) {
 968  	if ecr.closed.Load() {
 969  		return 0, ErrBodyReadAfterClose
 970  	}
 971  	w := ecr.resp
 972  	if w.canWriteContinue.Load() {
 973  		w.writeContinueMu.Lock()
 974  		if w.canWriteContinue.Load() {
 975  			w.conn.bufw.WriteString("HTTP/1.1 100 Continue\r\n\r\n")
 976  			w.conn.bufw.Flush()
 977  			w.canWriteContinue.Store(false)
 978  		}
 979  		w.writeContinueMu.Unlock()
 980  	}
 981  	n, err = ecr.readCloser.Read(p)
 982  	if err == io.EOF {
 983  		ecr.sawEOF.Store(true)
 984  	}
 985  	return
 986  }
 987  
 988  func (ecr *expectContinueReader) Close() error {
 989  	ecr.closed.Store(true)
 990  	return ecr.readCloser.Close()
 991  }
 992  
 993  // TimeFormat is the time format to use when generating times in HTTP
 994  // headers. It is like [time.RFC1123] but hard-codes GMT as the time
 995  // zone. The time being formatted must be in UTC for Format to
 996  // generate the correct format.
 997  //
 998  // For parsing this time format, see [ParseTime].
 999  const TimeFormat = "Mon, 02 Jan 2006 15:04:05 GMT"
1000  
1001  var errTooLarge = errors.New("http: request too large")
1002  
1003  // Read next request from connection.
1004  func (c *conn) readRequest(ctx context.Context) (w *response, err error) {
1005  	if c.hijacked() {
1006  		return nil, ErrHijacked
1007  	}
1008  
1009  	var (
1010  		wholeReqDeadline time.Time // or zero if none
1011  		hdrDeadline      time.Time // or zero if none
1012  	)
1013  	t0 := time.Now()
1014  	if d := c.server.readHeaderTimeout(); d > 0 {
1015  		hdrDeadline = t0.Add(d)
1016  	}
1017  	if d := c.server.ReadTimeout; d > 0 {
1018  		wholeReqDeadline = t0.Add(d)
1019  	}
1020  	c.rwc.SetReadDeadline(hdrDeadline)
1021  	if d := c.server.WriteTimeout; d > 0 {
1022  		defer func() {
1023  			c.rwc.SetWriteDeadline(time.Now().Add(d))
1024  		}()
1025  	}
1026  
1027  	c.r.setReadLimit(c.server.initialReadLimitSize())
1028  	if c.lastMethod == "POST" {
1029  		// RFC 7230 section 3 tolerance for old buggy clients.
1030  		peek, _ := c.bufr.Peek(4) // ReadRequest will get err below
1031  		c.bufr.Discard(numLeadingCRorLF(peek))
1032  	}
1033  	req, err := readRequest(c.bufr)
1034  	if err != nil {
1035  		if c.r.hitReadLimit() {
1036  			return nil, errTooLarge
1037  		}
1038  		return nil, err
1039  	}
1040  
1041  	if !http1ServerSupportsRequest(req) {
1042  		return nil, statusError{StatusHTTPVersionNotSupported, "unsupported protocol version"}
1043  	}
1044  
1045  	c.lastMethod = req.Method
1046  	c.r.setInfiniteReadLimit()
1047  
1048  	hosts, haveHost := req.Header["Host"]
1049  	isH2Upgrade := req.isH2Upgrade()
1050  	if req.ProtoAtLeast(1, 1) && (!haveHost || len(hosts) == 0) && !isH2Upgrade && req.Method != "CONNECT" {
1051  		return nil, badRequestError("missing required Host header")
1052  	}
1053  	if len(hosts) == 1 && !httpguts.ValidHostHeader(hosts[0]) {
1054  		return nil, badRequestError("malformed Host header")
1055  	}
1056  	for k, vv := range req.Header {
1057  		if !httpguts.ValidHeaderFieldName(k) {
1058  			return nil, badRequestError("invalid header name")
1059  		}
1060  		for _, v := range vv {
1061  			if !httpguts.ValidHeaderFieldValue(v) {
1062  				return nil, badRequestError("invalid header value")
1063  			}
1064  		}
1065  	}
1066  	delete(req.Header, "Host")
1067  
1068  	ctx, cancelCtx := context.WithCancel(ctx)
1069  	req.ctx = ctx
1070  	req.RemoteAddr = c.remoteAddr
1071  	req.TLS = c.tlsState
1072  	if body, ok := req.Body.(*body); ok {
1073  		body.doEarlyClose = true
1074  	}
1075  
1076  	// Adjust the read deadline if necessary.
1077  	if !hdrDeadline.Equal(wholeReqDeadline) {
1078  		c.rwc.SetReadDeadline(wholeReqDeadline)
1079  	}
1080  
1081  	w = &response{
1082  		conn:          c,
1083  		cancelCtx:     cancelCtx,
1084  		req:           req,
1085  		reqBody:       req.Body,
1086  		handlerHeader: make(Header),
1087  		contentLength: -1,
1088  
1089  		// We populate these ahead of time so we're not
1090  		// reading from req.Header after their Handler starts
1091  		// and maybe mutates it (Issue 14940)
1092  		wants10KeepAlive: req.wantsHttp10KeepAlive(),
1093  		wantsClose:       req.wantsClose(),
1094  	}
1095  	if isH2Upgrade {
1096  		w.closeAfterReply = true
1097  	}
1098  	w.cw.res = w
1099  	w.w = newBufioWriterSize(&w.cw, bufferBeforeChunkingSize)
1100  	return w, nil
1101  }
1102  
1103  // http1ServerSupportsRequest reports whether Go's HTTP/1.x server
1104  // supports the given request.
1105  func http1ServerSupportsRequest(req *Request) bool {
1106  	if req.ProtoMajor == 1 {
1107  		return true
1108  	}
1109  	// Accept "PRI * HTTP/2.0" upgrade requests, so Handlers can
1110  	// wire up their own HTTP/2 upgrades.
1111  	if req.ProtoMajor == 2 && req.ProtoMinor == 0 &&
1112  		req.Method == "PRI" && req.RequestURI == "*" {
1113  		return true
1114  	}
1115  	// Reject HTTP/0.x, and all other HTTP/2+ requests (which
1116  	// aren't encoded in ASCII anyway).
1117  	return false
1118  }
1119  
1120  func (w *response) Header() Header {
1121  	if w.cw.header == nil && w.wroteHeader && !w.cw.wroteHeader {
1122  		// Accessing the header between logically writing it
1123  		// and physically writing it means we need to allocate
1124  		// a clone to snapshot the logically written state.
1125  		w.cw.header = w.handlerHeader.Clone()
1126  	}
1127  	w.calledHeader = true
1128  	return w.handlerHeader
1129  }
1130  
1131  // maxPostHandlerReadBytes is the max number of Request.Body bytes not
1132  // consumed by a handler that the server will read from the client
1133  // in order to keep a connection alive. If there are more bytes
1134  // than this, the server, to be paranoid, instead sends a
1135  // "Connection close" response.
1136  //
1137  // This number is approximately what a typical machine's TCP buffer
1138  // size is anyway.  (if we have the bytes on the machine, we might as
1139  // well read them)
1140  const maxPostHandlerReadBytes = 256 << 10
1141  
1142  func checkWriteHeaderCode(code int) {
1143  	// Issue 22880: require valid WriteHeader status codes.
1144  	// For now we only enforce that it's three digits.
1145  	// In the future we might block things over 599 (600 and above aren't defined
1146  	// at https://httpwg.org/specs/rfc7231.html#status.codes).
1147  	// But for now any three digits.
1148  	//
1149  	// We used to send "HTTP/1.1 000 0" on the wire in responses but there's
1150  	// no equivalent bogus thing we can realistically send in HTTP/2,
1151  	// so we'll consistently panic instead and help people find their bugs
1152  	// early. (We can't return an error from WriteHeader even if we wanted to.)
1153  	if code < 100 || code > 999 {
1154  		panic(fmt.Sprintf("invalid WriteHeader code %v", code))
1155  	}
1156  }
1157  
1158  // relevantCaller searches the call stack for the first function outside of net/http.
1159  // The purpose of this function is to provide more helpful error messages.
1160  func relevantCaller() runtime.Frame {
1161  	pc := []uintptr{:16}
1162  	n := runtime.Callers(1, pc)
1163  	frames := runtime.CallersFrames(pc[:n])
1164  	var frame runtime.Frame
1165  	for {
1166  		frame, more := frames.Next()
1167  		if !bytes.HasPrefix(frame.Function, "net/http.") {
1168  			return frame
1169  		}
1170  		if !more {
1171  			break
1172  		}
1173  	}
1174  	return frame
1175  }
1176  
1177  func (w *response) WriteHeader(code int) {
1178  	if w.conn.hijacked() {
1179  		caller := relevantCaller()
1180  		w.conn.server.logf("http: response.WriteHeader on hijacked connection from %s (%s:%d)", caller.Function, path.Base(caller.File), caller.Line)
1181  		return
1182  	}
1183  	if w.wroteHeader {
1184  		caller := relevantCaller()
1185  		w.conn.server.logf("http: superfluous response.WriteHeader call from %s (%s:%d)", caller.Function, path.Base(caller.File), caller.Line)
1186  		return
1187  	}
1188  	checkWriteHeaderCode(code)
1189  
1190  	if code < 101 || code > 199 {
1191  		// Sending a 100 Continue or any non-1xx header disables the
1192  		// automatically-sent 100 Continue from Request.Body.Read.
1193  		w.disableWriteContinue()
1194  	}
1195  
1196  	// Handle informational headers.
1197  	//
1198  	// We shouldn't send any further headers after 101 Switching Protocols,
1199  	// so it takes the non-informational path.
1200  	if code >= 100 && code <= 199 && code != StatusSwitchingProtocols {
1201  		writeStatusLine(w.conn.bufw, w.req.ProtoAtLeast(1, 1), code, w.statusBuf[:])
1202  
1203  		// Per RFC 8297 we must not clear the current header map
1204  		w.handlerHeader.WriteSubset(w.conn.bufw, excludedHeadersNoBody)
1205  		w.conn.bufw.Write(crlf)
1206  		w.conn.bufw.Flush()
1207  
1208  		return
1209  	}
1210  
1211  	w.wroteHeader = true
1212  	w.status = code
1213  
1214  	if w.calledHeader && w.cw.header == nil {
1215  		w.cw.header = w.handlerHeader.Clone()
1216  	}
1217  
1218  	if cl := w.handlerHeader.get("Content-Length"); cl != "" {
1219  		v, err := strconv.ParseInt(cl, 10, 64)
1220  		if err == nil && v >= 0 {
1221  			w.contentLength = v
1222  		} else {
1223  			w.conn.server.logf("http: invalid Content-Length of %q", cl)
1224  			w.handlerHeader.Del("Content-Length")
1225  		}
1226  	}
1227  }
1228  
1229  // extraHeader is the set of headers sometimes added by chunkWriter.writeHeader.
1230  // This type is used to avoid extra allocations from cloning and/or populating
1231  // the response Header map and all its 1-element slices.
1232  type extraHeader struct {
1233  	contentType      string
1234  	connection       string
1235  	transferEncoding string
1236  	date             []byte // written if not nil
1237  	contentLength    []byte // written if not nil
1238  }
1239  
1240  // Sorted the same as extraHeader.Write's loop.
1241  var extraHeaderKeys = [][]byte{
1242  	[]byte("Content-Type"),
1243  	[]byte("Connection"),
1244  	[]byte("Transfer-Encoding"),
1245  }
1246  
1247  var (
1248  	headerContentLength = []byte("Content-Length: ")
1249  	headerDate          = []byte("Date: ")
1250  )
1251  
1252  // Write writes the headers described in h to w.
1253  //
1254  // This method has a value receiver, despite the somewhat large size
1255  // of h, because it prevents an allocation. The escape analysis isn't
1256  // smart enough to realize this function doesn't mutate h.
1257  func (h extraHeader) Write(w *bufio.Writer) {
1258  	if h.date != nil {
1259  		w.Write(headerDate)
1260  		w.Write(h.date)
1261  		w.Write(crlf)
1262  	}
1263  	if h.contentLength != nil {
1264  		w.Write(headerContentLength)
1265  		w.Write(h.contentLength)
1266  		w.Write(crlf)
1267  	}
1268  	for i, v := range [][]byte{h.contentType, h.connection, h.transferEncoding} {
1269  		if v != "" {
1270  			w.Write(extraHeaderKeys[i])
1271  			w.Write(colonSpace)
1272  			w.WriteString(v)
1273  			w.Write(crlf)
1274  		}
1275  	}
1276  }
1277  
1278  // writeHeader finalizes the header sent to the client and writes it
1279  // to cw.res.conn.bufw.
1280  //
1281  // p is not written by writeHeader, but is the first chunk of the body
1282  // that will be written. It is sniffed for a Content-Type if none is
1283  // set explicitly. It's also used to set the Content-Length, if the
1284  // total body size was small and the handler has already finished
1285  // running.
1286  func (cw *chunkWriter) writeHeader(p []byte) {
1287  	if cw.wroteHeader {
1288  		return
1289  	}
1290  	cw.wroteHeader = true
1291  
1292  	w := cw.res
1293  	keepAlivesEnabled := w.conn.server.doKeepAlives()
1294  	isHEAD := w.req.Method == "HEAD"
1295  
1296  	// header is written out to w.conn.buf below. Depending on the
1297  	// state of the handler, we either own the map or not. If we
1298  	// don't own it, the exclude map is created lazily for
1299  	// WriteSubset to remove headers. The setHeader struct holds
1300  	// headers we need to add.
1301  	header := cw.header
1302  	owned := header != nil
1303  	if !owned {
1304  		header = w.handlerHeader
1305  	}
1306  	var excludeHeader map[string]bool
1307  	delHeader := func(key string) {
1308  		if owned {
1309  			header.Del(key)
1310  			return
1311  		}
1312  		if _, ok := header[key]; !ok {
1313  			return
1314  		}
1315  		if excludeHeader == nil {
1316  			excludeHeader = map[string]bool{}
1317  		}
1318  		excludeHeader[key] = true
1319  	}
1320  	var setHeader extraHeader
1321  
1322  	// Don't write out the fake "Trailer:foo" keys. See TrailerPrefix.
1323  	trailers := false
1324  	for k := range cw.header {
1325  		if bytes.HasPrefix(k, TrailerPrefix) {
1326  			if excludeHeader == nil {
1327  				excludeHeader = map[string]bool{}
1328  			}
1329  			excludeHeader[k] = true
1330  			trailers = true
1331  		}
1332  	}
1333  	for _, v := range cw.header["Trailer"] {
1334  		trailers = true
1335  		foreachHeaderElement(v, cw.res.declareTrailer)
1336  	}
1337  
1338  	te := header.get("Transfer-Encoding")
1339  	hasTE := te != ""
1340  
1341  	// If the handler is done but never sent a Content-Length
1342  	// response header and this is our first (and last) write, set
1343  	// it, even to zero. This helps HTTP/1.0 clients keep their
1344  	// "keep-alive" connections alive.
1345  	// Exceptions: 304/204/1xx responses never get Content-Length, and if
1346  	// it was a HEAD request, we don't know the difference between
1347  	// 0 actual bytes and 0 bytes because the handler noticed it
1348  	// was a HEAD request and chose not to write anything. So for
1349  	// HEAD, the handler should either write the Content-Length or
1350  	// write non-zero bytes. If it's actually 0 bytes and the
1351  	// handler never looked at the Request.Method, we just don't
1352  	// send a Content-Length header.
1353  	// Further, we don't send an automatic Content-Length if they
1354  	// set a Transfer-Encoding, because they're generally incompatible.
1355  	if w.handlerDone.Load() && !trailers && !hasTE && bodyAllowedForStatus(w.status) && !header.has("Content-Length") && (!isHEAD || len(p) > 0) {
1356  		w.contentLength = int64(len(p))
1357  		setHeader.contentLength = strconv.AppendInt(cw.res.clenBuf[:0], int64(len(p)), 10)
1358  	}
1359  
1360  	// If this was an HTTP/1.0 request with keep-alive and we sent a
1361  	// Content-Length back, we can make this a keep-alive response ...
1362  	if w.wants10KeepAlive && keepAlivesEnabled {
1363  		sentLength := header.get("Content-Length") != ""
1364  		if sentLength && header.get("Connection") == "keep-alive" {
1365  			w.closeAfterReply = false
1366  		}
1367  	}
1368  
1369  	// Check for an explicit (and valid) Content-Length header.
1370  	hasCL := w.contentLength != -1
1371  
1372  	if w.wants10KeepAlive && (isHEAD || hasCL || !bodyAllowedForStatus(w.status)) {
1373  		_, connectionHeaderSet := header["Connection"]
1374  		if !connectionHeaderSet {
1375  			setHeader.connection = "keep-alive"
1376  		}
1377  	} else if !w.req.ProtoAtLeast(1, 1) || w.wantsClose {
1378  		w.closeAfterReply = true
1379  	}
1380  
1381  	if header.get("Connection") == "close" || !keepAlivesEnabled {
1382  		w.closeAfterReply = true
1383  	}
1384  
1385  	// If the client wanted a 100-continue but we never sent it to
1386  	// them (or, more strictly: we never finished reading their
1387  	// request body), don't reuse this connection.
1388  	//
1389  	// This behavior was first added on the theory that we don't know
1390  	// if the next bytes on the wire are going to be the remainder of
1391  	// the request body or the subsequent request (see issue 11549),
1392  	// but that's not correct: If we keep using the connection,
1393  	// the client is required to send the request body whether we
1394  	// asked for it or not.
1395  	//
1396  	// We probably do want to skip reusing the connection in most cases,
1397  	// however. If the client is offering a large request body that we
1398  	// don't intend to use, then it's better to close the connection
1399  	// than to read the body. For now, assume that if we're sending
1400  	// headers, the handler is done reading the body and we should
1401  	// drop the connection if we haven't seen EOF.
1402  	if ecr, ok := w.req.Body.(*expectContinueReader); ok && !ecr.sawEOF.Load() {
1403  		w.closeAfterReply = true
1404  	}
1405  
1406  	// We do this by default because there are a number of clients that
1407  	// send a full request before starting to read the response, and they
1408  	// can deadlock if we start writing the response with unconsumed body
1409  	// remaining. See Issue 15527 for some history.
1410  	//
1411  	// If full duplex mode has been enabled with ResponseController.EnableFullDuplex,
1412  	// then leave the request body alone.
1413  	//
1414  	// We don't take this path when w.closeAfterReply is set.
1415  	// We may not need to consume the request to get ready for the next one
1416  	// (since we're closing the conn), but a client which sends a full request
1417  	// before reading a response may deadlock in this case.
1418  	// This behavior has been present since CL 5268043 (2011), however,
1419  	// so it doesn't seem to be causing problems.
1420  	if w.req.ContentLength != 0 && !w.closeAfterReply && !w.fullDuplex {
1421  		var discard, tooBig bool
1422  
1423  		switch bdy := w.req.Body.(type) {
1424  		case *expectContinueReader:
1425  			// We only get here if we have already fully consumed the request body
1426  			// (see above).
1427  		case *body:
1428  			bdy.mu.Lock()
1429  			switch {
1430  			case bdy.closed:
1431  				if !bdy.sawEOF {
1432  					// Body was closed in handler with non-EOF error.
1433  					w.closeAfterReply = true
1434  				}
1435  			case bdy.unreadDataSizeLocked() >= maxPostHandlerReadBytes:
1436  				tooBig = true
1437  			default:
1438  				discard = true
1439  			}
1440  			bdy.mu.Unlock()
1441  		default:
1442  			discard = true
1443  		}
1444  
1445  		if discard {
1446  			_, err := io.CopyN(io.Discard, w.reqBody, maxPostHandlerReadBytes+1)
1447  			switch err {
1448  			case nil:
1449  				// There must be even more data left over.
1450  				tooBig = true
1451  			case ErrBodyReadAfterClose:
1452  				// Body was already consumed and closed.
1453  			case io.EOF:
1454  				// The remaining body was just consumed, close it.
1455  				err = w.reqBody.Close()
1456  				if err != nil {
1457  					w.closeAfterReply = true
1458  				}
1459  			default:
1460  				// Some other kind of error occurred, like a read timeout, or
1461  				// corrupt chunked encoding. In any case, whatever remains
1462  				// on the wire must not be parsed as another HTTP request.
1463  				w.closeAfterReply = true
1464  			}
1465  		}
1466  
1467  		if tooBig {
1468  			w.requestTooLarge()
1469  			delHeader("Connection")
1470  			setHeader.connection = "close"
1471  		}
1472  	}
1473  
1474  	code := w.status
1475  	if bodyAllowedForStatus(code) {
1476  		// If no content type, apply sniffing algorithm to body.
1477  		_, haveType := header["Content-Type"]
1478  
1479  		// If the Content-Encoding was set and is non-blank,
1480  		// we shouldn't sniff the body. See Issue 31753.
1481  		ce := header.Get("Content-Encoding")
1482  		hasCE := len(ce) > 0
1483  		if !hasCE && !haveType && !hasTE && len(p) > 0 {
1484  			setHeader.contentType = DetectContentType(p)
1485  		}
1486  	} else {
1487  		for _, k := range suppressedHeaders(code) {
1488  			delHeader(k)
1489  		}
1490  	}
1491  
1492  	if !header.has("Date") {
1493  		setHeader.date = time.Now().UTC().AppendFormat(cw.res.dateBuf[:0], TimeFormat)
1494  	}
1495  
1496  	if hasCL && hasTE && te != "identity" {
1497  		// TODO: return an error if WriteHeader gets a return parameter
1498  		// For now just ignore the Content-Length.
1499  		w.conn.server.logf("http: WriteHeader called with both Transfer-Encoding of %q and a Content-Length of %d",
1500  			te, w.contentLength)
1501  		delHeader("Content-Length")
1502  		hasCL = false
1503  	}
1504  
1505  	if w.req.Method == "HEAD" || !bodyAllowedForStatus(code) || code == StatusNoContent {
1506  		// Response has no body.
1507  		delHeader("Transfer-Encoding")
1508  	} else if hasCL {
1509  		// Content-Length has been provided, so no chunking is to be done.
1510  		delHeader("Transfer-Encoding")
1511  	} else if w.req.ProtoAtLeast(1, 1) {
1512  		// HTTP/1.1 or greater: Transfer-Encoding has been set to identity, and no
1513  		// content-length has been provided. The connection must be closed after the
1514  		// reply is written, and no chunking is to be done. This is the setup
1515  		// recommended in the Server-Sent Events candidate recommendation 11,
1516  		// section 8.
1517  		if hasTE && te == "identity" {
1518  			cw.chunking = false
1519  			w.closeAfterReply = true
1520  			delHeader("Transfer-Encoding")
1521  		} else {
1522  			// HTTP/1.1 or greater: use chunked transfer encoding
1523  			// to avoid closing the connection at EOF.
1524  			cw.chunking = true
1525  			setHeader.transferEncoding = "chunked"
1526  			if hasTE && te == "chunked" {
1527  				// We will send the chunked Transfer-Encoding header later.
1528  				delHeader("Transfer-Encoding")
1529  			}
1530  		}
1531  	} else {
1532  		// HTTP version < 1.1: cannot do chunked transfer
1533  		// encoding and we don't know the Content-Length so
1534  		// signal EOF by closing connection.
1535  		w.closeAfterReply = true
1536  		delHeader("Transfer-Encoding") // in case already set
1537  	}
1538  
1539  	// Cannot use Content-Length with non-identity Transfer-Encoding.
1540  	if cw.chunking {
1541  		delHeader("Content-Length")
1542  	}
1543  	if !w.req.ProtoAtLeast(1, 0) {
1544  		return
1545  	}
1546  
1547  	// Only override the Connection header if it is not a successful
1548  	// protocol switch response and if KeepAlives are not enabled.
1549  	// See https://golang.org/issue/36381.
1550  	delConnectionHeader := w.closeAfterReply &&
1551  		(!keepAlivesEnabled || !hasToken(cw.header.get("Connection"), "close")) &&
1552  		!isProtocolSwitchResponse(w.status, header)
1553  	if delConnectionHeader {
1554  		delHeader("Connection")
1555  		if w.req.ProtoAtLeast(1, 1) {
1556  			setHeader.connection = "close"
1557  		}
1558  	}
1559  
1560  	writeStatusLine(w.conn.bufw, w.req.ProtoAtLeast(1, 1), code, w.statusBuf[:])
1561  	cw.header.WriteSubset(w.conn.bufw, excludeHeader)
1562  	setHeader.Write(w.conn.bufw)
1563  	w.conn.bufw.Write(crlf)
1564  }
1565  
1566  // foreachHeaderElement splits v according to the "#rule" construction
1567  // in RFC 7230 section 7 and calls fn for each non-empty element.
1568  func foreachHeaderElement(v string, fn func(string)) {
1569  	v = textproto.TrimString(v)
1570  	if v == "" {
1571  		return
1572  	}
1573  	if !bytes.Contains(v, ",") {
1574  		fn(v)
1575  		return
1576  	}
1577  	for f := range bytes.SplitSeq(v, ",") {
1578  		if f = textproto.TrimString(f); f != "" {
1579  			fn(f)
1580  		}
1581  	}
1582  }
1583  
1584  // writeStatusLine writes an HTTP/1.x Status-Line (RFC 7230 Section 3.1.2)
1585  // to bw. is11 is whether the HTTP request is HTTP/1.1. false means HTTP/1.0.
1586  // code is the response status code.
1587  // scratch is an optional scratch buffer. If it has at least capacity 3, it's used.
1588  func writeStatusLine(bw *bufio.Writer, is11 bool, code int, scratch []byte) {
1589  	if is11 {
1590  		bw.WriteString("HTTP/1.1 ")
1591  	} else {
1592  		bw.WriteString("HTTP/1.0 ")
1593  	}
1594  	if text := StatusText(code); text != "" {
1595  		bw.Write(strconv.AppendInt(scratch[:0], int64(code), 10))
1596  		bw.WriteByte(' ')
1597  		bw.WriteString(text)
1598  		bw.WriteString("\r\n")
1599  	} else {
1600  		// don't worry about performance
1601  		fmt.Fprintf(bw, "%03d status code %d\r\n", code, code)
1602  	}
1603  }
1604  
1605  // bodyAllowed reports whether a Write is allowed for this response type.
1606  // It's illegal to call this before the header has been flushed.
1607  func (w *response) bodyAllowed() bool {
1608  	if !w.wroteHeader {
1609  		panic("")
1610  	}
1611  	return bodyAllowedForStatus(w.status)
1612  }
1613  
1614  // The Life Of A Write is like this:
1615  //
1616  // Handler starts. No header has been sent. The handler can either
1617  // write a header, or just start writing. Writing before sending a header
1618  // sends an implicitly empty 200 OK header.
1619  //
1620  // If the handler didn't declare a Content-Length up front, we either
1621  // go into chunking mode or, if the handler finishes running before
1622  // the chunking buffer size, we compute a Content-Length and send that
1623  // in the header instead.
1624  //
1625  // Likewise, if the handler didn't set a Content-Type, we sniff that
1626  // from the initial chunk of output.
1627  //
1628  // The Writers are wired together like:
1629  //
1630  //  1. *response (the ResponseWriter) ->
1631  //  2. (*response).w, a [*bufio.Writer] of bufferBeforeChunkingSize bytes ->
1632  //  3. chunkWriter.Writer (whose writeHeader finalizes Content-Length/Type)
1633  //     and which writes the chunk headers, if needed ->
1634  //  4. conn.bufw, a *bufio.Writer of default (4kB) bytes, writing to ->
1635  //  5. checkConnErrorWriter{c}, which notes any non-nil error on Write
1636  //     and populates c.werr with it if so, but otherwise writes to ->
1637  //  6. the rwc, the [net.Conn].
1638  //
1639  // TODO(bradfitz): short-circuit some of the buffering when the
1640  // initial header contains both a Content-Type and Content-Length.
1641  // Also short-circuit in (1) when the header's been sent and not in
1642  // chunking mode, writing directly to (4) instead, if (2) has no
1643  // buffered data. More generally, we could short-circuit from (1) to
1644  // (3) even in chunking mode if the write size from (1) is over some
1645  // threshold and nothing is in (2).  The answer might be mostly making
1646  // bufferBeforeChunkingSize smaller and having bufio's fast-paths deal
1647  // with this instead.
1648  func (w *response) Write(data []byte) (n int, err error) {
1649  	return w.write(len(data), data, "")
1650  }
1651  
1652  func (w *response) WriteString(data string) (n int, err error) {
1653  	return w.write(len(data), nil, data)
1654  }
1655  
1656  // either dataB or dataS is non-zero.
1657  func (w *response) write(lenData int, dataB []byte, dataS string) (n int, err error) {
1658  	if w.conn.hijacked() {
1659  		if lenData > 0 {
1660  			caller := relevantCaller()
1661  			w.conn.server.logf("http: response.Write on hijacked connection from %s (%s:%d)", caller.Function, path.Base(caller.File), caller.Line)
1662  		}
1663  		return 0, ErrHijacked
1664  	}
1665  
1666  	if w.canWriteContinue.Load() {
1667  		// Body reader wants to write 100 Continue but hasn't yet. Tell it not to.
1668  		w.disableWriteContinue()
1669  	}
1670  
1671  	if !w.wroteHeader {
1672  		w.WriteHeader(StatusOK)
1673  	}
1674  	if lenData == 0 {
1675  		return 0, nil
1676  	}
1677  	if !w.bodyAllowed() {
1678  		return 0, ErrBodyNotAllowed
1679  	}
1680  
1681  	w.written += int64(lenData) // ignoring errors, for errorKludge
1682  	if w.contentLength != -1 && w.written > w.contentLength {
1683  		return 0, ErrContentLength
1684  	}
1685  	if dataB != nil {
1686  		return w.w.Write(dataB)
1687  	} else {
1688  		return w.w.WriteString(dataS)
1689  	}
1690  }
1691  
1692  func (w *response) finishRequest() {
1693  	w.handlerDone.Store(true)
1694  
1695  	if !w.wroteHeader {
1696  		w.WriteHeader(StatusOK)
1697  	}
1698  
1699  	w.w.Flush()
1700  	putBufioWriter(w.w)
1701  	w.cw.close()
1702  	w.conn.bufw.Flush()
1703  
1704  	w.conn.r.abortPendingRead()
1705  
1706  	// Close the body (regardless of w.closeAfterReply) so we can
1707  	// re-use its bufio.Reader later safely.
1708  	w.reqBody.Close()
1709  
1710  	if w.req.MultipartForm != nil {
1711  		w.req.MultipartForm.RemoveAll()
1712  	}
1713  }
1714  
1715  // shouldReuseConnection reports whether the underlying TCP connection can be reused.
1716  // It must only be called after the handler is done executing.
1717  func (w *response) shouldReuseConnection() bool {
1718  	if w.closeAfterReply {
1719  		// The request or something set while executing the
1720  		// handler indicated we shouldn't reuse this
1721  		// connection.
1722  		return false
1723  	}
1724  
1725  	if w.req.Method != "HEAD" && w.contentLength != -1 && w.bodyAllowed() && w.contentLength != w.written {
1726  		// Did not write enough. Avoid getting out of sync.
1727  		return false
1728  	}
1729  
1730  	// There was some error writing to the underlying connection
1731  	// during the request, so don't re-use this conn.
1732  	if w.conn.werr != nil {
1733  		return false
1734  	}
1735  
1736  	if w.closedRequestBodyEarly() {
1737  		return false
1738  	}
1739  
1740  	return true
1741  }
1742  
1743  func (w *response) closedRequestBodyEarly() bool {
1744  	body, ok := w.req.Body.(*body)
1745  	return ok && body.didEarlyClose()
1746  }
1747  
1748  func (w *response) Flush() {
1749  	w.FlushError()
1750  }
1751  
1752  func (w *response) FlushError() error {
1753  	if !w.wroteHeader {
1754  		w.WriteHeader(StatusOK)
1755  	}
1756  	err := w.w.Flush()
1757  	e2 := w.cw.flush()
1758  	if err == nil {
1759  		err = e2
1760  	}
1761  	return err
1762  }
1763  
1764  func (c *conn) finalFlush() {
1765  	if c.bufr != nil {
1766  		// Steal the bufio.Reader (~4KB worth of memory) and its associated
1767  		// reader for a future connection.
1768  		putBufioReader(c.bufr)
1769  		c.bufr = nil
1770  	}
1771  
1772  	if c.bufw != nil {
1773  		c.bufw.Flush()
1774  		// Steal the bufio.Writer (~4KB worth of memory) and its associated
1775  		// writer for a future connection.
1776  		putBufioWriter(c.bufw)
1777  		c.bufw = nil
1778  	}
1779  }
1780  
1781  // Close the connection.
1782  func (c *conn) close() {
1783  	c.finalFlush()
1784  	c.rwc.Close()
1785  }
1786  
1787  // rstAvoidanceDelay is the amount of time we sleep after closing the
1788  // write side of a TCP connection before closing the entire socket.
1789  // By sleeping, we increase the chances that the client sees our FIN
1790  // and processes its final data before they process the subsequent RST
1791  // from closing a connection with known unread data.
1792  // This RST seems to occur mostly on BSD systems. (And Windows?)
1793  // This timeout is somewhat arbitrary (~latency around the planet),
1794  // and may be modified by tests.
1795  //
1796  // TODO(bcmills): This should arguably be a server configuration parameter,
1797  // not a hard-coded value.
1798  var rstAvoidanceDelay = 500 * time.Millisecond
1799  
1800  type closeWriter interface {
1801  	CloseWrite() error
1802  }
1803  
1804  var _ closeWriter = (*net.TCPConn)(nil)
1805  
1806  // closeWriteAndWait flushes any outstanding data and sends a FIN packet (if
1807  // client is connected via TCP), signaling that we're done. We then
1808  // pause for a bit, hoping the client processes it before any
1809  // subsequent RST.
1810  //
1811  // See https://golang.org/issue/3595
1812  func (c *conn) closeWriteAndWait() {
1813  	c.finalFlush()
1814  	if tcp, ok := c.rwc.(closeWriter); ok {
1815  		tcp.CloseWrite()
1816  	}
1817  
1818  	// When we return from closeWriteAndWait, the caller will fully close the
1819  	// connection. If client is still writing to the connection, this will cause
1820  	// the write to fail with ECONNRESET or similar. Unfortunately, many TCP
1821  	// implementations will also drop unread packets from the client's read buffer
1822  	// when a write fails, causing our final response to be truncated away too.
1823  	//
1824  	// As a result, https://www.rfc-editor.org/rfc/rfc7230#section-6.6 recommends
1825  	// that “[t]he server … continues to read from the connection until it
1826  	// receives a corresponding close by the client, or until the server is
1827  	// reasonably certain that its own TCP stack has received the client's
1828  	// acknowledgement of the packet(s) containing the server's last response.”
1829  	//
1830  	// Unfortunately, we have no straightforward way to be “reasonably certain”
1831  	// that we have received the client's ACK, and at any rate we don't want to
1832  	// allow a misbehaving client to soak up server connections indefinitely by
1833  	// withholding an ACK, nor do we want to go through the complexity or overhead
1834  	// of using low-level APIs to figure out when a TCP round-trip has completed.
1835  	//
1836  	// Instead, we declare that we are “reasonably certain” that we received the
1837  	// ACK if maxRSTAvoidanceDelay has elapsed.
1838  	time.Sleep(rstAvoidanceDelay)
1839  }
1840  
1841  // validNextProto reports whether the proto is a valid ALPN protocol name.
1842  // Everything is valid except the empty string and built-in protocol types,
1843  // so that those can't be overridden with alternate implementations.
1844  func validNextProto(proto string) bool {
1845  	switch proto {
1846  	case "", "http/1.1", "http/1.0":
1847  		return false
1848  	}
1849  	return true
1850  }
1851  
1852  const (
1853  	runHooks  = true
1854  	skipHooks = false
1855  )
1856  
1857  func (c *conn) setState(nc net.Conn, state ConnState, runHook bool) {
1858  	srv := c.server
1859  	switch state {
1860  	case StateNew:
1861  		srv.trackConn(c, true)
1862  	case StateHijacked, StateClosed:
1863  		srv.trackConn(c, false)
1864  	}
1865  	if state > 0xff || state < 0 {
1866  		panic("internal error")
1867  	}
1868  	packedState := uint64(time.Now().Unix()<<8) | uint64(state)
1869  	c.curState.Store(packedState)
1870  	if !runHook {
1871  		return
1872  	}
1873  	if hook := srv.ConnState; hook != nil {
1874  		hook(nc, state)
1875  	}
1876  }
1877  
1878  func (c *conn) getState() (state ConnState, unixSec int64) {
1879  	packedState := c.curState.Load()
1880  	return ConnState(packedState & 0xff), int64(packedState >> 8)
1881  }
1882  
1883  // badRequestError is a literal string (used by in the server in HTML,
1884  // unescaped) to tell the user why their request was bad. It should
1885  // be plain text without user info or other embedded errors.
1886  func badRequestError(e string) error { return statusError{StatusBadRequest, e} }
1887  
1888  // statusError is an error used to respond to a request with an HTTP status.
1889  // The text should be plain text without user info or other embedded errors.
1890  type statusError struct {
1891  	code int
1892  	text string
1893  }
1894  
1895  func (e statusError) Error() string { return StatusText(e.code) + ": " + e.text }
1896  
1897  // ErrAbortHandler is a sentinel panic value to abort a handler.
1898  // While any panic from ServeHTTP aborts the response to the client,
1899  // panicking with ErrAbortHandler also suppresses logging of a stack
1900  // trace to the server's error log.
1901  var ErrAbortHandler = errors.New("net/http: abort Handler")
1902  
1903  // isCommonNetReadError reports whether err is a common error
1904  // encountered during reading a request off the network when the
1905  // client has gone away or had its read fail somehow. This is used to
1906  // determine which logs are interesting enough to log about.
1907  func isCommonNetReadError(err error) bool {
1908  	if err == io.EOF {
1909  		return true
1910  	}
1911  	if neterr, ok := err.(net.Error); ok && neterr.Timeout() {
1912  		return true
1913  	}
1914  	if oe, ok := err.(*net.OpError); ok && oe.Op == "read" {
1915  		return true
1916  	}
1917  	return false
1918  }
1919  
1920  type connectionStater interface {
1921  	ConnectionState() tls.ConnectionState
1922  }
1923  
1924  // Serve a new connection.
1925  func (c *conn) serve(ctx context.Context) {
1926  	if ra := c.rwc.RemoteAddr(); ra != nil {
1927  		c.remoteAddr = ra.String()
1928  	}
1929  	ctx = context.WithValue(ctx, LocalAddrContextKey, c.rwc.LocalAddr())
1930  	var inFlightResponse *response
1931  	defer func() {
1932  		if err := recover(); err != nil && err != ErrAbortHandler {
1933  			const size = 64 << 10
1934  			buf := []byte{:size}
1935  			buf = buf[:runtime.Stack(buf, false)]
1936  			c.server.logf("http: panic serving %v: %v\n%s", c.remoteAddr, err, buf)
1937  		}
1938  		if inFlightResponse != nil {
1939  			inFlightResponse.cancelCtx()
1940  			inFlightResponse.disableWriteContinue()
1941  		}
1942  		if !c.hijacked() {
1943  			if inFlightResponse != nil {
1944  				inFlightResponse.conn.r.abortPendingRead()
1945  				inFlightResponse.reqBody.Close()
1946  			}
1947  			c.close()
1948  			c.setState(c.rwc, StateClosed, runHooks)
1949  		}
1950  	}()
1951  
1952  	if tlsConn, ok := c.rwc.(*tls.Conn); ok {
1953  		tlsTO := c.server.tlsHandshakeTimeout()
1954  		if tlsTO > 0 {
1955  			dl := time.Now().Add(tlsTO)
1956  			c.rwc.SetReadDeadline(dl)
1957  			c.rwc.SetWriteDeadline(dl)
1958  		}
1959  		if err := tlsConn.HandshakeContext(ctx); err != nil {
1960  			// If the handshake failed due to the client not speaking
1961  			// TLS, assume they're speaking plaintext HTTP and write a
1962  			// 400 response on the TLS conn's underlying net.Conn.
1963  			var reason string
1964  			if re, ok := err.(tls.RecordHeaderError); ok && re.Conn != nil && tlsRecordHeaderLooksLikeHTTP(re.RecordHeader) {
1965  				io.WriteString(re.Conn, "HTTP/1.0 400 Bad Request\r\n\r\nClient sent an HTTP request to an HTTPS server.\n")
1966  				re.Conn.Close()
1967  				reason = "client sent an HTTP request to an HTTPS server"
1968  			} else {
1969  				reason = err.Error()
1970  			}
1971  			c.server.logf("http: TLS handshake error from %s: %v", c.rwc.RemoteAddr(), reason)
1972  			return
1973  		}
1974  		// Restore Conn-level deadlines.
1975  		if tlsTO > 0 {
1976  			c.rwc.SetReadDeadline(time.Time{})
1977  			c.rwc.SetWriteDeadline(time.Time{})
1978  		}
1979  		c.tlsState = &tls.ConnectionState{}
1980  		*c.tlsState = tlsConn.ConnectionState()
1981  		if proto := c.tlsState.NegotiatedProtocol; validNextProto(proto) {
1982  			if fn := c.server.TLSNextProto[proto]; fn != nil {
1983  				h := initALPNRequest{ctx, tlsConn, serverHandler{c.server}}
1984  				// Mark freshly created HTTP/2 as active and prevent any server state hooks
1985  				// from being run on these connections. This prevents closeIdleConns from
1986  				// closing such connections. See issue https://golang.org/issue/39776.
1987  				c.setState(c.rwc, StateActive, skipHooks)
1988  				fn(c.server, tlsConn, h)
1989  			}
1990  			return
1991  		}
1992  	}
1993  
1994  	// HTTP/1.x from here on.
1995  
1996  	// Set Request.TLS if the conn is not a *tls.Conn, but implements ConnectionState.
1997  	if c.tlsState == nil {
1998  		if tc, ok := c.rwc.(connectionStater); ok {
1999  			c.tlsState = &tls.ConnectionState{}
2000  			*c.tlsState = tc.ConnectionState()
2001  		}
2002  	}
2003  
2004  	ctx, cancelCtx := context.WithCancel(ctx)
2005  	c.cancelCtx = cancelCtx
2006  	defer cancelCtx()
2007  
2008  	c.r = &connReader{conn: c, rwc: c.rwc}
2009  	c.bufr = newBufioReader(c.r)
2010  	c.bufw = newBufioWriterSize(checkConnErrorWriter{c}, 4<<10)
2011  
2012  	protos := c.server.protocols()
2013  	if c.tlsState == nil && protos.UnencryptedHTTP2() {
2014  		if c.maybeServeUnencryptedHTTP2(ctx) {
2015  			return
2016  		}
2017  	}
2018  	if !protos.HTTP1() {
2019  		return
2020  	}
2021  
2022  	for {
2023  		w, err := c.readRequest(ctx)
2024  		if c.r.remain != c.server.initialReadLimitSize() {
2025  			// If we read any bytes off the wire, we're active.
2026  			c.setState(c.rwc, StateActive, runHooks)
2027  		}
2028  		if c.server.shuttingDown() {
2029  			return
2030  		}
2031  		if err != nil {
2032  			const errorHeaders = "\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\n"
2033  
2034  			switch {
2035  			case err == errTooLarge:
2036  				// Their HTTP client may or may not be
2037  				// able to read this if we're
2038  				// responding to them and hanging up
2039  				// while they're still writing their
2040  				// request. Undefined behavior.
2041  				const publicErr = "431 Request Header Fields Too Large"
2042  				fmt.Fprintf(c.rwc, "HTTP/1.1 "+publicErr+errorHeaders+publicErr)
2043  				c.closeWriteAndWait()
2044  				return
2045  
2046  			case isUnsupportedTEError(err):
2047  				// Respond as per RFC 7230 Section 3.3.1 which says,
2048  				//      A server that receives a request message with a
2049  				//      transfer coding it does not understand SHOULD
2050  				//      respond with 501 (Unimplemented).
2051  				code := StatusNotImplemented
2052  
2053  				// We purposefully aren't echoing back the transfer-encoding's value,
2054  				// so as to mitigate the risk of cross side scripting by an attacker.
2055  				fmt.Fprintf(c.rwc, "HTTP/1.1 %d %s%sUnsupported transfer encoding", code, StatusText(code), errorHeaders)
2056  				return
2057  
2058  			case isCommonNetReadError(err):
2059  				return // don't reply
2060  
2061  			default:
2062  				if v, ok := err.(statusError); ok {
2063  					fmt.Fprintf(c.rwc, "HTTP/1.1 %d %s: %s%s%d %s: %s", v.code, StatusText(v.code), v.text, errorHeaders, v.code, StatusText(v.code), v.text)
2064  					return
2065  				}
2066  				const publicErr = "400 Bad Request"
2067  				fmt.Fprintf(c.rwc, "HTTP/1.1 "+publicErr+errorHeaders+publicErr)
2068  				return
2069  			}
2070  		}
2071  
2072  		// Expect 100 Continue support
2073  		req := w.req
2074  		if req.expectsContinue() {
2075  			if req.ProtoAtLeast(1, 1) && req.ContentLength != 0 {
2076  				// Wrap the Body reader with one that replies on the connection
2077  				req.Body = &expectContinueReader{readCloser: req.Body, resp: w}
2078  				w.canWriteContinue.Store(true)
2079  			}
2080  		} else if req.Header.get("Expect") != "" {
2081  			w.sendExpectationFailed()
2082  			return
2083  		}
2084  
2085  		c.curReq.Store(w)
2086  
2087  		if requestBodyRemains(req.Body) {
2088  			registerOnHitEOF(req.Body, w.conn.r.startBackgroundRead)
2089  		} else {
2090  			w.conn.r.startBackgroundRead()
2091  		}
2092  
2093  		// HTTP cannot have multiple simultaneous active requests.[*]
2094  		// Until the server replies to this request, it can't read another,
2095  		// so we might as well run the handler in this goroutine.
2096  		// [*] Not strictly true: HTTP pipelining. We could let them all process
2097  		// in parallel even if their responses need to be serialized.
2098  		// But we're not going to implement HTTP pipelining because it
2099  		// was never deployed in the wild and the answer is HTTP/2.
2100  		inFlightResponse = w
2101  		serverHandler{c.server}.ServeHTTP(w, w.req)
2102  		inFlightResponse = nil
2103  		w.cancelCtx()
2104  		if c.hijacked() {
2105  			c.r.releaseConn()
2106  			return
2107  		}
2108  		w.finishRequest()
2109  		c.rwc.SetWriteDeadline(time.Time{})
2110  		if !w.shouldReuseConnection() {
2111  			if w.requestBodyLimitHit || w.closedRequestBodyEarly() {
2112  				c.closeWriteAndWait()
2113  			}
2114  			return
2115  		}
2116  		c.setState(c.rwc, StateIdle, runHooks)
2117  		c.curReq.Store(nil)
2118  
2119  		if !w.conn.server.doKeepAlives() {
2120  			// We're in shutdown mode. We might've replied
2121  			// to the user without "Connection: close" and
2122  			// they might think they can send another
2123  			// request, but such is life with HTTP/1.1.
2124  			return
2125  		}
2126  
2127  		if d := c.server.idleTimeout(); d > 0 {
2128  			c.rwc.SetReadDeadline(time.Now().Add(d))
2129  		} else {
2130  			c.rwc.SetReadDeadline(time.Time{})
2131  		}
2132  
2133  		// Wait for the connection to become readable again before trying to
2134  		// read the next request. This prevents a ReadHeaderTimeout or
2135  		// ReadTimeout from starting until the first bytes of the next request
2136  		// have been received.
2137  		if _, err := c.bufr.Peek(4); err != nil {
2138  			return
2139  		}
2140  
2141  		c.rwc.SetReadDeadline(time.Time{})
2142  	}
2143  }
2144  
2145  // unencryptedHTTP2Request is an HTTP handler that initializes
2146  // certain uninitialized fields in its *Request.
2147  //
2148  // It's the unencrypted version of initALPNRequest.
2149  type unencryptedHTTP2Request struct {
2150  	ctx context.Context
2151  	c   net.Conn
2152  	h   serverHandler
2153  }
2154  
2155  func (h unencryptedHTTP2Request) BaseContext() context.Context { return h.ctx }
2156  
2157  func (h unencryptedHTTP2Request) ServeHTTP(rw ResponseWriter, req *Request) {
2158  	if req.Body == nil {
2159  		req.Body = NoBody
2160  	}
2161  	if req.RemoteAddr == "" {
2162  		req.RemoteAddr = h.c.RemoteAddr().String()
2163  	}
2164  	h.h.ServeHTTP(rw, req)
2165  }
2166  
2167  // unencryptedNetConnInTLSConn is used to pass an unencrypted net.Conn to
2168  // functions that only accept a *tls.Conn.
2169  type unencryptedNetConnInTLSConn struct {
2170  	net.Conn // panic on all net.Conn methods
2171  	conn     net.Conn
2172  }
2173  
2174  func (c unencryptedNetConnInTLSConn) UnencryptedNetConn() net.Conn {
2175  	return c.conn
2176  }
2177  
2178  func unencryptedTLSConn(c net.Conn) *tls.Conn {
2179  	return tls.Client(unencryptedNetConnInTLSConn{conn: c}, nil)
2180  }
2181  
2182  // TLSNextProto key to use for unencrypted HTTP/2 connections.
2183  // Not actually a TLS-negotiated protocol.
2184  const nextProtoUnencryptedHTTP2 = "unencrypted_http2"
2185  
2186  func (c *conn) maybeServeUnencryptedHTTP2(ctx context.Context) bool {
2187  	fn, ok := c.server.TLSNextProto[nextProtoUnencryptedHTTP2]
2188  	if !ok {
2189  		return false
2190  	}
2191  	hasPreface := func(c *conn, preface []byte) bool {
2192  		c.r.setReadLimit(int64(len(preface)) - int64(c.bufr.Buffered()))
2193  		got, err := c.bufr.Peek(len(preface))
2194  		c.r.setInfiniteReadLimit()
2195  		return err == nil && bytes.Equal(got, preface)
2196  	}
2197  	if !hasPreface(c, []byte("PRI * HTTP/2.0")) {
2198  		return false
2199  	}
2200  	if !hasPreface(c, []byte("PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n")) {
2201  		return false
2202  	}
2203  	c.setState(c.rwc, StateActive, skipHooks)
2204  	h := unencryptedHTTP2Request{ctx, c.rwc, serverHandler{c.server}}
2205  	fn(c.server, unencryptedTLSConn(c.rwc), h)
2206  	return true
2207  }
2208  
2209  func (w *response) sendExpectationFailed() {
2210  	// TODO(bradfitz): let ServeHTTP handlers handle
2211  	// requests with non-standard expectation[s]? Seems
2212  	// theoretical at best, and doesn't fit into the
2213  	// current ServeHTTP model anyway. We'd need to
2214  	// make the ResponseWriter an optional
2215  	// "ExpectReplier" interface or something.
2216  	//
2217  	// For now we'll just obey RFC 7231 5.1.1 which says
2218  	// "A server that receives an Expect field-value other
2219  	// than 100-continue MAY respond with a 417 (Expectation
2220  	// Failed) status code to indicate that the unexpected
2221  	// expectation cannot be met."
2222  	w.Header().Set("Connection", "close")
2223  	w.WriteHeader(StatusExpectationFailed)
2224  	w.finishRequest()
2225  }
2226  
2227  // Hijack implements the [Hijacker.Hijack] method. Our response is both a [ResponseWriter]
2228  // and a [Hijacker].
2229  func (w *response) Hijack() (rwc net.Conn, buf *bufio.ReadWriter, err error) {
2230  	if w.handlerDone.Load() {
2231  		panic("net/http: Hijack called after ServeHTTP finished")
2232  	}
2233  	w.disableWriteContinue()
2234  	if w.wroteHeader {
2235  		w.cw.flush()
2236  	}
2237  
2238  	c := w.conn
2239  	c.mu.Lock()
2240  	defer c.mu.Unlock()
2241  
2242  	// Release the bufioWriter that writes to the chunk writer, it is not
2243  	// used after a connection has been hijacked.
2244  	rwc, buf, err = c.hijackLocked()
2245  	if err == nil {
2246  		putBufioWriter(w.w)
2247  		w.w = nil
2248  	}
2249  	return rwc, buf, err
2250  }
2251  
2252  func (w *response) CloseNotify() <-chan bool {
2253  	w.lazyCloseNotifyMu.Lock()
2254  	defer w.lazyCloseNotifyMu.Unlock()
2255  	if w.handlerDone.Load() {
2256  		panic("net/http: CloseNotify called after ServeHTTP finished")
2257  	}
2258  	if w.closeNotifyCh == nil {
2259  		w.closeNotifyCh = chan bool{1}
2260  		if w.closeNotifyTriggered {
2261  			w.closeNotifyCh <- true // action prior closeNotify call
2262  		}
2263  	}
2264  	return w.closeNotifyCh
2265  }
2266  
2267  func (w *response) closeNotify() {
2268  	w.lazyCloseNotifyMu.Lock()
2269  	defer w.lazyCloseNotifyMu.Unlock()
2270  	if w.closeNotifyTriggered {
2271  		return // already triggered
2272  	}
2273  	w.closeNotifyTriggered = true
2274  	if w.closeNotifyCh != nil {
2275  		w.closeNotifyCh <- true
2276  	}
2277  }
2278  
2279  func registerOnHitEOF(rc io.ReadCloser, fn func()) {
2280  	switch v := rc.(type) {
2281  	case *expectContinueReader:
2282  		registerOnHitEOF(v.readCloser, fn)
2283  	case *body:
2284  		v.registerOnHitEOF(fn)
2285  	default:
2286  		panic("unexpected type " + fmt.Sprintf("%T", rc))
2287  	}
2288  }
2289  
2290  // requestBodyRemains reports whether future calls to Read
2291  // on rc might yield more data.
2292  func requestBodyRemains(rc io.ReadCloser) bool {
2293  	if rc == NoBody {
2294  		return false
2295  	}
2296  	switch v := rc.(type) {
2297  	case *expectContinueReader:
2298  		return requestBodyRemains(v.readCloser)
2299  	case *body:
2300  		return v.bodyRemains()
2301  	default:
2302  		panic("unexpected type " + fmt.Sprintf("%T", rc))
2303  	}
2304  }
2305  
2306  // The HandlerFunc type is an adapter to allow the use of
2307  // ordinary functions as HTTP handlers. If f is a function
2308  // with the appropriate signature, HandlerFunc(f) is a
2309  // [Handler] that calls f.
2310  type HandlerFunc func(ResponseWriter, *Request)
2311  
2312  // ServeHTTP calls f(w, r).
2313  func (f HandlerFunc) ServeHTTP(w ResponseWriter, r *Request) {
2314  	f(w, r)
2315  }
2316  
2317  // Helper handlers
2318  
2319  // Error replies to the request with the specified error message and HTTP code.
2320  // It does not otherwise end the request; the caller should ensure no further
2321  // writes are done to w.
2322  // The error message should be plain text.
2323  //
2324  // Error deletes the Content-Length header,
2325  // sets Content-Type to “text/plain; charset=utf-8”,
2326  // and sets X-Content-Type-Options to “nosniff”.
2327  // This configures the header properly for the error message,
2328  // in case the caller had set it up expecting a successful output.
2329  func Error(w ResponseWriter, error string, code int) {
2330  	h := w.Header()
2331  
2332  	// Delete the Content-Length header, which might be for some other content.
2333  	// Assuming the error string fits in the writer's buffer, we'll figure
2334  	// out the correct Content-Length for it later.
2335  	//
2336  	// We don't delete Content-Encoding, because some middleware sets
2337  	// Content-Encoding: gzip and wraps the ResponseWriter to compress on-the-fly.
2338  	// See https://go.dev/issue/66343.
2339  	h.Del("Content-Length")
2340  
2341  	// There might be content type already set, but we reset it to
2342  	// text/plain for the error message.
2343  	h.Set("Content-Type", "text/plain; charset=utf-8")
2344  	h.Set("X-Content-Type-Options", "nosniff")
2345  	w.WriteHeader(code)
2346  	fmt.Fprintln(w, error)
2347  }
2348  
2349  // NotFound replies to the request with an HTTP 404 not found error.
2350  func NotFound(w ResponseWriter, r *Request) { Error(w, "404 page not found", StatusNotFound) }
2351  
2352  // NotFoundHandler returns a simple request handler
2353  // that replies to each request with a “404 page not found” reply.
2354  func NotFoundHandler() Handler { return HandlerFunc(NotFound) }
2355  
2356  // StripPrefix returns a handler that serves HTTP requests by removing the
2357  // given prefix from the request URL's Path (and RawPath if set) and invoking
2358  // the handler h. StripPrefix handles a request for a path that doesn't begin
2359  // with prefix by replying with an HTTP 404 not found error. The prefix must
2360  // match exactly: if the prefix in the request contains escaped characters
2361  // the reply is also an HTTP 404 not found error.
2362  func StripPrefix(prefix string, h Handler) Handler {
2363  	if prefix == "" {
2364  		return h
2365  	}
2366  	return HandlerFunc(func(w ResponseWriter, r *Request) {
2367  		p := bytes.TrimPrefix(r.URL.Path, prefix)
2368  		rp := bytes.TrimPrefix(r.URL.RawPath, prefix)
2369  		if len(p) < len(r.URL.Path) && (r.URL.RawPath == "" || len(rp) < len(r.URL.RawPath)) {
2370  			r2 := &Request{}
2371  			*r2 = *r
2372  			r2.URL = &url.URL{}
2373  			*r2.URL = *r.URL
2374  			r2.URL.Path = p
2375  			r2.URL.RawPath = rp
2376  			h.ServeHTTP(w, r2)
2377  		} else {
2378  			NotFound(w, r)
2379  		}
2380  	})
2381  }
2382  
2383  // Redirect replies to the request with a redirect to url,
2384  // which may be a path relative to the request path.
2385  // Any non-ASCII characters in url will be percent-encoded,
2386  // but existing percent encodings will not be changed.
2387  //
2388  // The provided code should be in the 3xx range and is usually
2389  // [StatusMovedPermanently], [StatusFound] or [StatusSeeOther].
2390  //
2391  // If the Content-Type header has not been set, [Redirect] sets it
2392  // to "text/html; charset=utf-8" and writes a small HTML body.
2393  // Setting the Content-Type header to any value, including nil,
2394  // disables that behavior.
2395  func Redirect(w ResponseWriter, r *Request, url string, code int) {
2396  	if u, err := urlpkg.Parse(url); err == nil {
2397  		// If url was relative, make its path absolute by
2398  		// combining with request path.
2399  		// The client would probably do this for us,
2400  		// but doing it ourselves is more reliable.
2401  		// See RFC 7231, section 7.1.2
2402  		if u.Scheme == "" && u.Host == "" {
2403  			oldpath := r.URL.Path
2404  			if oldpath == "" { // should not happen, but avoid a crash if it does
2405  				oldpath = "/"
2406  			}
2407  
2408  			// no leading http://server
2409  			if url == "" || url[0] != '/' {
2410  				// make relative path absolute
2411  				olddir, _ := path.Split(oldpath)
2412  				url = olddir + url
2413  			}
2414  
2415  			var query string
2416  			if i := bytes.Index(url, "?"); i != -1 {
2417  				url, query = url[:i], url[i:]
2418  			}
2419  
2420  			// clean up but preserve trailing slash
2421  			trailing := bytes.HasSuffix(url, "/")
2422  			url = path.Clean(url)
2423  			if trailing && !bytes.HasSuffix(url, "/") {
2424  				url += "/"
2425  			}
2426  			url += query
2427  		}
2428  	}
2429  
2430  	h := w.Header()
2431  
2432  	// RFC 7231 notes that a short HTML body is usually included in
2433  	// the response because older user agents may not understand 301/307.
2434  	// Do it only if the request didn't already have a Content-Type header.
2435  	_, hadCT := h["Content-Type"]
2436  
2437  	h.Set("Location", hexEscapeNonASCII(url))
2438  	if !hadCT && (r.Method == "GET" || r.Method == "HEAD") {
2439  		h.Set("Content-Type", "text/html; charset=utf-8")
2440  	}
2441  	w.WriteHeader(code)
2442  
2443  	// Shouldn't send the body for POST or HEAD; that leaves GET.
2444  	if !hadCT && r.Method == "GET" {
2445  		body := "<a href=\"" + htmlEscape(url) + "\">" + StatusText(code) + "</a>.\n"
2446  		fmt.Fprintln(w, body)
2447  	}
2448  }
2449  
2450  var htmlReplacer = bytes.NewReplacer(
2451  	"&", "&amp;",
2452  	"<", "&lt;",
2453  	">", "&gt;",
2454  	// "&#34;" is shorter than "&quot;".
2455  	`"`, "&#34;",
2456  	// "&#39;" is shorter than "&apos;" and apos was not in HTML until HTML5.
2457  	"'", "&#39;",
2458  )
2459  
2460  func htmlEscape(s string) string {
2461  	return htmlReplacer.Replace(s)
2462  }
2463  
2464  // Redirect to a fixed URL
2465  type redirectHandler struct {
2466  	url  string
2467  	code int
2468  }
2469  
2470  func (rh *redirectHandler) ServeHTTP(w ResponseWriter, r *Request) {
2471  	Redirect(w, r, rh.url, rh.code)
2472  }
2473  
2474  // RedirectHandler returns a request handler that redirects
2475  // each request it receives to the given url using the given
2476  // status code.
2477  //
2478  // The provided code should be in the 3xx range and is usually
2479  // [StatusMovedPermanently], [StatusFound] or [StatusSeeOther].
2480  func RedirectHandler(url string, code int) Handler {
2481  	return &redirectHandler{url, code}
2482  }
2483  
2484  // ServeMux is an HTTP request multiplexer.
2485  // It matches the URL of each incoming request against a list of registered
2486  // patterns and calls the handler for the pattern that
2487  // most closely matches the URL.
2488  //
2489  // # Patterns
2490  //
2491  // Patterns can match the method, host and path of a request.
2492  // Some examples:
2493  //
2494  //   - "/index.html" matches the path "/index.html" for any host and method.
2495  //   - "GET /static/" matches a GET request whose path begins with "/static/".
2496  //   - "example.com/" matches any request to the host "example.com".
2497  //   - "example.com/{$}" matches requests with host "example.com" and path "/".
2498  //   - "/b/{bucket}/o/{objectname...}" matches paths whose first segment is "b"
2499  //     and whose third segment is "o". The name "bucket" denotes the second
2500  //     segment and "objectname" denotes the remainder of the path.
2501  //
2502  // In general, a pattern looks like
2503  //
2504  //	[METHOD ][HOST]/[PATH]
2505  //
2506  // All three parts are optional; "/" is a valid pattern.
2507  // If METHOD is present, it must be followed by at least one space or tab.
2508  //
2509  // Literal (that is, non-wildcard) parts of a pattern match
2510  // the corresponding parts of a request case-sensitively.
2511  //
2512  // A pattern with no method matches every method. A pattern
2513  // with the method GET matches both GET and HEAD requests.
2514  // Otherwise, the method must match exactly.
2515  //
2516  // A pattern with no host matches every host.
2517  // A pattern with a host matches URLs on that host only.
2518  //
2519  // A path can include wildcard segments of the form {NAME} or {NAME...}.
2520  // For example, "/b/{bucket}/o/{objectname...}".
2521  // The wildcard name must be a valid Go identifier.
2522  // Wildcards must be full path segments: they must be preceded by a slash and followed by
2523  // either a slash or the end of the string.
2524  // For example, "/b_{bucket}" is not a valid pattern.
2525  //
2526  // Normally a wildcard matches only a single path segment,
2527  // ending at the next literal slash (not %2F) in the request URL.
2528  // But if the "..." is present, then the wildcard matches the remainder of the URL path, including slashes.
2529  // (Therefore it is invalid for a "..." wildcard to appear anywhere but at the end of a pattern.)
2530  // The match for a wildcard can be obtained by calling [Request.PathValue] with the wildcard's name.
2531  // A trailing slash in a path acts as an anonymous "..." wildcard.
2532  //
2533  // The special wildcard {$} matches only the end of the URL.
2534  // For example, the pattern "/{$}" matches only the path "/",
2535  // whereas the pattern "/" matches every path.
2536  //
2537  // For matching, both pattern paths and incoming request paths are unescaped segment by segment.
2538  // So, for example, the path "/a%2Fb/100%25" is treated as having two segments, "a/b" and "100%".
2539  // The pattern "/a%2fb/" matches it, but the pattern "/a/b/" does not.
2540  //
2541  // # Precedence
2542  //
2543  // If two or more patterns match a request, then the most specific pattern takes precedence.
2544  // A pattern P1 is more specific than P2 if P1 matches a strict subset of P2’s requests;
2545  // that is, if P2 matches all the requests of P1 and more.
2546  // If neither is more specific, then the patterns conflict.
2547  // There is one exception to this rule, for backwards compatibility:
2548  // if two patterns would otherwise conflict and one has a host while the other does not,
2549  // then the pattern with the host takes precedence.
2550  // If a pattern passed to [ServeMux.Handle] or [ServeMux.HandleFunc] conflicts with
2551  // another pattern that is already registered, those functions panic.
2552  //
2553  // As an example of the general rule, "/images/thumbnails/" is more specific than "/images/",
2554  // so both can be registered.
2555  // The former matches paths beginning with "/images/thumbnails/"
2556  // and the latter will match any other path in the "/images/" subtree.
2557  //
2558  // As another example, consider the patterns "GET /" and "/index.html":
2559  // both match a GET request for "/index.html", but the former pattern
2560  // matches all other GET and HEAD requests, while the latter matches any
2561  // request for "/index.html" that uses a different method.
2562  // The patterns conflict.
2563  //
2564  // # Trailing-slash redirection
2565  //
2566  // Consider a [ServeMux] with a handler for a subtree, registered using a trailing slash or "..." wildcard.
2567  // If the ServeMux receives a request for the subtree root without a trailing slash,
2568  // it redirects the request by adding the trailing slash.
2569  // This behavior can be overridden with a separate registration for the path without
2570  // the trailing slash or "..." wildcard. For example, registering "/images/" causes ServeMux
2571  // to redirect a request for "/images" to "/images/", unless "/images" has
2572  // been registered separately.
2573  //
2574  // # Request sanitizing
2575  //
2576  // ServeMux also takes care of sanitizing the URL request path and the Host
2577  // header, stripping the port number and redirecting any request containing . or
2578  // .. segments or repeated slashes to an equivalent, cleaner URL.
2579  // Escaped path elements such as "%2e" for "." and "%2f" for "/" are preserved
2580  // and aren't considered separators for request routing.
2581  //
2582  // # Compatibility
2583  //
2584  // The pattern syntax and matching behavior of ServeMux changed significantly
2585  // in Go 1.22. To restore the old behavior, set the GODEBUG environment variable
2586  // to "httpmuxgo121=1". This setting is read once, at program startup; changes
2587  // during execution will be ignored.
2588  //
2589  // The backwards-incompatible changes include:
2590  //   - Wildcards are just ordinary literal path segments in 1.21.
2591  //     For example, the pattern "/{x}" will match only that path in 1.21,
2592  //     but will match any one-segment path in 1.22.
2593  //   - In 1.21, no pattern was rejected, unless it was empty or conflicted with an existing pattern.
2594  //     In 1.22, syntactically invalid patterns will cause [ServeMux.Handle] and [ServeMux.HandleFunc] to panic.
2595  //     For example, in 1.21, the patterns "/{"  and "/a{x}" match themselves,
2596  //     but in 1.22 they are invalid and will cause a panic when registered.
2597  //   - In 1.22, each segment of a pattern is unescaped; this was not done in 1.21.
2598  //     For example, in 1.22 the pattern "/%61" matches the path "/a" ("%61" being the URL escape sequence for "a"),
2599  //     but in 1.21 it would match only the path "/%2561" (where "%25" is the escape for the percent sign).
2600  //   - When matching patterns to paths, in 1.22 each segment of the path is unescaped; in 1.21, the entire path is unescaped.
2601  //     This change mostly affects how paths with %2F escapes adjacent to slashes are treated.
2602  //     See https://go.dev/issue/21955 for details.
2603  type ServeMux struct {
2604  	mu     sync.RWMutex
2605  	tree   routingNode
2606  	index  routingIndex
2607  	mux121 serveMux121 // used only when GODEBUG=httpmuxgo121=1
2608  }
2609  
2610  // NewServeMux allocates and returns a new [ServeMux].
2611  func NewServeMux() *ServeMux {
2612  	return &ServeMux{}
2613  }
2614  
2615  // DefaultServeMux is the default [ServeMux] used by [Serve].
2616  var DefaultServeMux = &defaultServeMux
2617  
2618  var defaultServeMux ServeMux
2619  
2620  // cleanPath returns the canonical path for p, eliminating . and .. elements.
2621  func cleanPath(p string) string {
2622  	if p == "" {
2623  		return "/"
2624  	}
2625  	if p[0] != '/' {
2626  		p = "/" + p
2627  	}
2628  	np := path.Clean(p)
2629  	// path.Clean removes trailing slash except for root;
2630  	// put the trailing slash back if necessary.
2631  	if p[len(p)-1] == '/' && np != "/" {
2632  		// Fast path for common case of p being the string we want:
2633  		if len(p) == len(np)+1 && bytes.HasPrefix(p, np) {
2634  			np = p
2635  		} else {
2636  			np += "/"
2637  		}
2638  	}
2639  	return np
2640  }
2641  
2642  // stripHostPort returns h without any trailing ":<port>".
2643  func stripHostPort(h string) string {
2644  	// If no port on host, return unchanged
2645  	if !bytes.Contains(h, ":") {
2646  		return h
2647  	}
2648  	host, _, err := net.SplitHostPort(h)
2649  	if err != nil {
2650  		return h // on error, return unchanged
2651  	}
2652  	return host
2653  }
2654  
2655  // Handler returns the handler to use for the given request,
2656  // consulting r.Method, r.Host, and r.URL.Path. It always returns
2657  // a non-nil handler. If the path is not in its canonical form, the
2658  // handler will be an internally-generated handler that redirects
2659  // to the canonical path. If the host contains a port, it is ignored
2660  // when matching handlers.
2661  //
2662  // The path and host are used unchanged for CONNECT requests.
2663  //
2664  // Handler also returns the registered pattern that matches the
2665  // request or, in the case of internally-generated redirects,
2666  // the path that will match after following the redirect.
2667  //
2668  // If there is no registered handler that applies to the request,
2669  // Handler returns a “page not found” or “method not supported”
2670  // handler and an empty pattern.
2671  //
2672  // Handler does not modify its argument. In particular, it does not
2673  // populate named path wildcards, so r.PathValue will always return
2674  // the empty string.
2675  func (mux *ServeMux) Handler(r *Request) (h Handler, pattern string) {
2676  	if use121 {
2677  		return mux.mux121.findHandler(r)
2678  	}
2679  	h, p, _, _ := mux.findHandler(r)
2680  	return h, p
2681  }
2682  
2683  // findHandler finds a handler for a request.
2684  // If there is a matching handler, it returns it and the pattern that matched.
2685  // Otherwise it returns a Redirect or NotFound handler with the path that would match
2686  // after the redirect.
2687  func (mux *ServeMux) findHandler(r *Request) (h Handler, patStr string, _ *pattern, matches [][]byte) {
2688  	var n *routingNode
2689  	host := r.URL.Host
2690  	escapedPath := r.URL.EscapedPath()
2691  	path := escapedPath
2692  	// CONNECT requests are not canonicalized.
2693  	if r.Method == "CONNECT" {
2694  		// If r.URL.Path is /tree and its handler is not registered,
2695  		// the /tree -> /tree/ redirect applies to CONNECT requests
2696  		// but the path canonicalization does not.
2697  		_, _, u := mux.matchOrRedirect(host, r.Method, path, r.URL)
2698  		if u != nil {
2699  			return RedirectHandler(u.String(), StatusMovedPermanently), u.Path, nil, nil
2700  		}
2701  		// Redo the match, this time with r.Host instead of r.URL.Host.
2702  		// Pass a nil URL to skip the trailing-slash redirect logic.
2703  		n, matches, _ = mux.matchOrRedirect(r.Host, r.Method, path, nil)
2704  	} else {
2705  		// All other requests have any port stripped and path cleaned
2706  		// before passing to mux.handler.
2707  		host = stripHostPort(r.Host)
2708  		path = cleanPath(path)
2709  
2710  		// If the given path is /tree and its handler is not registered,
2711  		// redirect for /tree/.
2712  		var u *url.URL
2713  		n, matches, u = mux.matchOrRedirect(host, r.Method, path, r.URL)
2714  		if u != nil {
2715  			return RedirectHandler(u.String(), StatusMovedPermanently), n.pattern.String(), nil, nil
2716  		}
2717  		if path != escapedPath {
2718  			// Redirect to cleaned path.
2719  			patStr := ""
2720  			if n != nil {
2721  				patStr = n.pattern.String()
2722  			}
2723  			u := &url.URL{Path: path, RawQuery: r.URL.RawQuery}
2724  			return RedirectHandler(u.String(), StatusMovedPermanently), patStr, nil, nil
2725  		}
2726  	}
2727  	if n == nil {
2728  		// We didn't find a match with the request method. To distinguish between
2729  		// Not Found and Method Not Allowed, see if there is another pattern that
2730  		// matches except for the method.
2731  		allowedMethods := mux.matchingMethods(host, path)
2732  		if len(allowedMethods) > 0 {
2733  			return HandlerFunc(func(w ResponseWriter, r *Request) {
2734  				w.Header().Set("Allow", bytes.Join(allowedMethods, ", "))
2735  				Error(w, StatusText(StatusMethodNotAllowed), StatusMethodNotAllowed)
2736  			}), "", nil, nil
2737  		}
2738  		return NotFoundHandler(), "", nil, nil
2739  	}
2740  	return n.handler, n.pattern.String(), n.pattern, matches
2741  }
2742  
2743  // matchOrRedirect looks up a node in the tree that matches the host, method and path.
2744  //
2745  // If the url argument is non-nil, handler also deals with trailing-slash
2746  // redirection: when a path doesn't match exactly, the match is tried again
2747  // after appending "/" to the path. If that second match succeeds, the last
2748  // return value is the URL to redirect to.
2749  func (mux *ServeMux) matchOrRedirect(host, method, path string, u *url.URL) (_ *routingNode, matches [][]byte, redirectTo *url.URL) {
2750  	mux.mu.RLock()
2751  	defer mux.mu.RUnlock()
2752  
2753  	n, matches := mux.tree.match(host, method, path)
2754  	// If we have an exact match, or we were asked not to try trailing-slash redirection,
2755  	// or the URL already has a trailing slash, then we're done.
2756  	if !exactMatch(n, path) && u != nil && !bytes.HasSuffix(path, "/") {
2757  		// If there is an exact match with a trailing slash, then redirect.
2758  		path += "/"
2759  		n2, _ := mux.tree.match(host, method, path)
2760  		if exactMatch(n2, path) {
2761  			// It is safe to return n2 here: it is used only in the second RedirectHandler case
2762  			// of findHandler, and that method returns before it does the "n == nil" check where
2763  			// the first return value matters. We return it here only to make the pattern available
2764  			// to findHandler.
2765  			return n2, nil, &url.URL{Path: cleanPath(u.Path) + "/", RawQuery: u.RawQuery}
2766  		}
2767  	}
2768  	return n, matches, nil
2769  }
2770  
2771  // exactMatch reports whether the node's pattern exactly matches the path.
2772  // As a special case, if the node is nil, exactMatch return false.
2773  //
2774  // Before wildcards were introduced, it was clear that an exact match meant
2775  // that the pattern and path were the same string. The only other possibility
2776  // was that a trailing-slash pattern, like "/", matched a path longer than
2777  // it, like "/a".
2778  //
2779  // With wildcards, we define an inexact match as any one where a multi wildcard
2780  // matches a non-empty string. All other matches are exact.
2781  // For example, these are all exact matches:
2782  //
2783  //	pattern   path
2784  //	/a        /a
2785  //	/{x}      /a
2786  //	/a/{$}    /a/
2787  //	/a/       /a/
2788  //
2789  // The last case has a multi wildcard (implicitly), but the match is exact because
2790  // the wildcard matches the empty string.
2791  //
2792  // Examples of matches that are not exact:
2793  //
2794  //	pattern   path
2795  //	/         /a
2796  //	/a/{x...} /a/b
2797  func exactMatch(n *routingNode, path string) bool {
2798  	if n == nil {
2799  		return false
2800  	}
2801  	// We can't directly implement the definition (empty match for multi
2802  	// wildcard) because we don't record a match for anonymous multis.
2803  
2804  	// If there is no multi, the match is exact.
2805  	if !n.pattern.lastSegment().multi {
2806  		return true
2807  	}
2808  
2809  	// If the path doesn't end in a trailing slash, then the multi match
2810  	// is non-empty.
2811  	if len(path) > 0 && path[len(path)-1] != '/' {
2812  		return false
2813  	}
2814  	// Only patterns ending in {$} or a multi wildcard can
2815  	// match a path with a trailing slash.
2816  	// For the match to be exact, the number of pattern
2817  	// segments should be the same as the number of slashes in the path.
2818  	// E.g. "/a/b/{$}" and "/a/b/{...}" exactly match "/a/b/", but "/a/" does not.
2819  	return len(n.pattern.segments) == bytes.Count(path, "/")
2820  }
2821  
2822  // matchingMethods return a sorted list of all methods that would match with the given host and path.
2823  func (mux *ServeMux) matchingMethods(host, path string) [][]byte {
2824  	// Hold the read lock for the entire method so that the two matches are done
2825  	// on the same set of registered patterns.
2826  	mux.mu.RLock()
2827  	defer mux.mu.RUnlock()
2828  	ms := map[string]bool{}
2829  	mux.tree.matchingMethods(host, path, ms)
2830  	// matchOrRedirect will try appending a trailing slash if there is no match.
2831  	if !bytes.HasSuffix(path, "/") {
2832  		mux.tree.matchingMethods(host, path+"/", ms)
2833  	}
2834  	return slices.Sorted(maps.Keys(ms))
2835  }
2836  
2837  // ServeHTTP dispatches the request to the handler whose
2838  // pattern most closely matches the request URL.
2839  func (mux *ServeMux) ServeHTTP(w ResponseWriter, r *Request) {
2840  	if r.RequestURI == "*" {
2841  		if r.ProtoAtLeast(1, 1) {
2842  			w.Header().Set("Connection", "close")
2843  		}
2844  		w.WriteHeader(StatusBadRequest)
2845  		return
2846  	}
2847  	var h Handler
2848  	if use121 {
2849  		h, _ = mux.mux121.findHandler(r)
2850  	} else {
2851  		h, r.Pattern, r.pat, r.matches = mux.findHandler(r)
2852  	}
2853  	h.ServeHTTP(w, r)
2854  }
2855  
2856  // The four functions below all call ServeMux.register so that callerLocation
2857  // always refers to user code.
2858  
2859  // Handle registers the handler for the given pattern.
2860  // If the given pattern conflicts with one that is already registered, Handle
2861  // panics.
2862  func (mux *ServeMux) Handle(pattern string, handler Handler) {
2863  	if use121 {
2864  		mux.mux121.handle(pattern, handler)
2865  	} else {
2866  		mux.register(pattern, handler)
2867  	}
2868  }
2869  
2870  // HandleFunc registers the handler function for the given pattern.
2871  // If the given pattern conflicts with one that is already registered, HandleFunc
2872  // panics.
2873  func (mux *ServeMux) HandleFunc(pattern string, handler func(ResponseWriter, *Request)) {
2874  	if use121 {
2875  		mux.mux121.handleFunc(pattern, handler)
2876  	} else {
2877  		mux.register(pattern, HandlerFunc(handler))
2878  	}
2879  }
2880  
2881  // Handle registers the handler for the given pattern in [DefaultServeMux].
2882  // The documentation for [ServeMux] explains how patterns are matched.
2883  func Handle(pattern string, handler Handler) {
2884  	if use121 {
2885  		DefaultServeMux.mux121.handle(pattern, handler)
2886  	} else {
2887  		DefaultServeMux.register(pattern, handler)
2888  	}
2889  }
2890  
2891  // HandleFunc registers the handler function for the given pattern in [DefaultServeMux].
2892  // The documentation for [ServeMux] explains how patterns are matched.
2893  func HandleFunc(pattern string, handler func(ResponseWriter, *Request)) {
2894  	if use121 {
2895  		DefaultServeMux.mux121.handleFunc(pattern, handler)
2896  	} else {
2897  		DefaultServeMux.register(pattern, HandlerFunc(handler))
2898  	}
2899  }
2900  
2901  func (mux *ServeMux) register(pattern string, handler Handler) {
2902  	if err := mux.registerErr(pattern, handler); err != nil {
2903  		panic(err)
2904  	}
2905  }
2906  
2907  func (mux *ServeMux) registerErr(patstr string, handler Handler) error {
2908  	if patstr == "" {
2909  		return errors.New("http: invalid pattern")
2910  	}
2911  	if handler == nil {
2912  		return errors.New("http: nil handler")
2913  	}
2914  	if f, ok := handler.(HandlerFunc); ok && f == nil {
2915  		return errors.New("http: nil handler")
2916  	}
2917  
2918  	pat, err := parsePattern(patstr)
2919  	if err != nil {
2920  		return fmt.Errorf("parsing %q: %w", patstr, err)
2921  	}
2922  
2923  	// Get the caller's location, for better conflict error messages.
2924  	// Skip register and whatever calls it.
2925  	_, file, line, ok := runtime.Caller(3)
2926  	if !ok {
2927  		pat.loc = "unknown location"
2928  	} else {
2929  		pat.loc = fmt.Sprintf("%s:%d", file, line)
2930  	}
2931  
2932  	mux.mu.Lock()
2933  	defer mux.mu.Unlock()
2934  	// Check for conflict.
2935  	if err := mux.index.possiblyConflictingPatterns(pat, func(pat2 *pattern) error {
2936  		if pat.conflictsWith(pat2) {
2937  			d := describeConflict(pat, pat2)
2938  			return fmt.Errorf("pattern %q (registered at %s) conflicts with pattern %q (registered at %s):\n%s",
2939  				pat, pat.loc, pat2, pat2.loc, d)
2940  		}
2941  		return nil
2942  	}); err != nil {
2943  		return err
2944  	}
2945  	mux.tree.addPattern(pat, handler)
2946  	mux.index.addPattern(pat)
2947  	return nil
2948  }
2949  
2950  // Serve accepts incoming HTTP connections on the listener l,
2951  // creating a new service goroutine for each. The service goroutines
2952  // read requests and then call handler to reply to them.
2953  //
2954  // The handler is typically nil, in which case [DefaultServeMux] is used.
2955  //
2956  // HTTP/2 support is only enabled if the Listener returns [*tls.Conn]
2957  // connections and they were configured with "h2" in the TLS
2958  // Config.NextProtos.
2959  //
2960  // Serve always returns a non-nil error.
2961  func Serve(l net.Listener, handler Handler) error {
2962  	srv := &Server{Handler: handler}
2963  	return srv.Serve(l)
2964  }
2965  
2966  // ServeTLS accepts incoming HTTPS connections on the listener l,
2967  // creating a new service goroutine for each. The service goroutines
2968  // read requests and then call handler to reply to them.
2969  //
2970  // The handler is typically nil, in which case [DefaultServeMux] is used.
2971  //
2972  // Additionally, files containing a certificate and matching private key
2973  // for the server must be provided. If the certificate is signed by a
2974  // certificate authority, the certFile should be the concatenation
2975  // of the server's certificate, any intermediates, and the CA's certificate.
2976  //
2977  // ServeTLS always returns a non-nil error.
2978  func ServeTLS(l net.Listener, handler Handler, certFile, keyFile string) error {
2979  	srv := &Server{Handler: handler}
2980  	return srv.ServeTLS(l, certFile, keyFile)
2981  }
2982  
2983  // A Server defines parameters for running an HTTP server.
2984  // The zero value for Server is a valid configuration.
2985  type Server struct {
2986  	// Addr optionally specifies the TCP address for the server to listen on,
2987  	// in the form "host:port". If empty, ":http" (port 80) is used.
2988  	// The service names are defined in RFC 6335 and assigned by IANA.
2989  	// See net.Dial for details of the address format.
2990  	Addr string
2991  
2992  	Handler Handler // handler to invoke, http.DefaultServeMux if nil
2993  
2994  	// DisableGeneralOptionsHandler, if true, passes "OPTIONS *" requests to the Handler,
2995  	// otherwise responds with 200 OK and Content-Length: 0.
2996  	DisableGeneralOptionsHandler bool
2997  
2998  	// TLSConfig optionally provides a TLS configuration for use
2999  	// by ServeTLS and ListenAndServeTLS. Note that this value is
3000  	// cloned by ServeTLS and ListenAndServeTLS, so it's not
3001  	// possible to modify the configuration with methods like
3002  	// tls.Config.SetSessionTicketKeys. To use
3003  	// SetSessionTicketKeys, use Server.Serve with a TLS Listener
3004  	// instead.
3005  	TLSConfig *tls.Config
3006  
3007  	// ReadTimeout is the maximum duration for reading the entire
3008  	// request, including the body. A zero or negative value means
3009  	// there will be no timeout.
3010  	//
3011  	// Because ReadTimeout does not let Handlers make per-request
3012  	// decisions on each request body's acceptable deadline or
3013  	// upload rate, most users will prefer to use
3014  	// ReadHeaderTimeout. It is valid to use them both.
3015  	ReadTimeout time.Duration
3016  
3017  	// ReadHeaderTimeout is the amount of time allowed to read
3018  	// request headers. The connection's read deadline is reset
3019  	// after reading the headers and the Handler can decide what
3020  	// is considered too slow for the body. If zero, the value of
3021  	// ReadTimeout is used. If negative, or if zero and ReadTimeout
3022  	// is zero or negative, there is no timeout.
3023  	ReadHeaderTimeout time.Duration
3024  
3025  	// WriteTimeout is the maximum duration before timing out
3026  	// writes of the response. It is reset whenever a new
3027  	// request's header is read. Like ReadTimeout, it does not
3028  	// let Handlers make decisions on a per-request basis.
3029  	// A zero or negative value means there will be no timeout.
3030  	WriteTimeout time.Duration
3031  
3032  	// IdleTimeout is the maximum amount of time to wait for the
3033  	// next request when keep-alives are enabled. If zero, the value
3034  	// of ReadTimeout is used. If negative, or if zero and ReadTimeout
3035  	// is zero or negative, there is no timeout.
3036  	IdleTimeout time.Duration
3037  
3038  	// MaxHeaderBytes controls the maximum number of bytes the
3039  	// server will read parsing the request header's keys and
3040  	// values, including the request line. It does not limit the
3041  	// size of the request body.
3042  	// If zero, DefaultMaxHeaderBytes is used.
3043  	MaxHeaderBytes int
3044  
3045  	// TLSNextProto optionally specifies a function to take over
3046  	// ownership of the provided TLS connection when an ALPN
3047  	// protocol upgrade has occurred. The map key is the protocol
3048  	// name negotiated. The Handler argument should be used to
3049  	// handle HTTP requests and will initialize the Request's TLS
3050  	// and RemoteAddr if not already set. The connection is
3051  	// automatically closed when the function returns.
3052  	// If TLSNextProto is not nil, HTTP/2 support is not enabled
3053  	// automatically.
3054  	TLSNextProto map[string]func(*Server, *tls.Conn, Handler)
3055  
3056  	// ConnState specifies an optional callback function that is
3057  	// called when a client connection changes state. See the
3058  	// ConnState type and associated constants for details.
3059  	ConnState func(net.Conn, ConnState)
3060  
3061  	// ErrorLog specifies an optional logger for errors accepting
3062  	// connections, unexpected behavior from handlers, and
3063  	// underlying FileSystem errors.
3064  	// If nil, logging is done via the log package's standard logger.
3065  	ErrorLog *log.Logger
3066  
3067  	// BaseContext optionally specifies a function that returns
3068  	// the base context for incoming requests on this server.
3069  	// The provided Listener is the specific Listener that's
3070  	// about to start accepting requests.
3071  	// If BaseContext is nil, the default is context.Background().
3072  	// If non-nil, it must return a non-nil context.
3073  	BaseContext func(net.Listener) context.Context
3074  
3075  	// ConnContext optionally specifies a function that modifies
3076  	// the context used for a new connection c. The provided ctx
3077  	// is derived from the base context and has a ServerContextKey
3078  	// value.
3079  	ConnContext func(ctx context.Context, c net.Conn) context.Context
3080  
3081  	// HTTP2 configures HTTP/2 connections.
3082  	//
3083  	// This field does not yet have any effect.
3084  	// See https://go.dev/issue/67813.
3085  	HTTP2 *HTTP2Config
3086  
3087  	// Protocols is the set of protocols accepted by the server.
3088  	//
3089  	// If Protocols includes UnencryptedHTTP2, the server will accept
3090  	// unencrypted HTTP/2 connections. The server can serve both
3091  	// HTTP/1 and unencrypted HTTP/2 on the same address and port.
3092  	//
3093  	// If Protocols is nil, the default is usually HTTP/1 and HTTP/2.
3094  	// If TLSNextProto is non-nil and does not contain an "h2" entry,
3095  	// the default is HTTP/1 only.
3096  	Protocols *Protocols
3097  
3098  	inShutdown atomic.Bool // true when server is in shutdown
3099  
3100  	disableKeepAlives atomic.Bool
3101  	nextProtoOnce     sync.Once // guards setupHTTP2_* init
3102  	nextProtoErr      error     // result of http2.ConfigureServer if used
3103  
3104  	mu         sync.Mutex
3105  	listeners  map[*net.Listener]struct{}
3106  	activeConn map[*conn]struct{}
3107  	onShutdown []func()
3108  
3109  	listenerGroup sync.WaitGroup
3110  }
3111  
3112  // Close immediately closes all active net.Listeners and any
3113  // connections in state [StateNew], [StateActive], or [StateIdle]. For a
3114  // graceful shutdown, use [Server.Shutdown].
3115  //
3116  // Close does not attempt to close (and does not even know about)
3117  // any hijacked connections, such as WebSockets.
3118  //
3119  // Close returns any error returned from closing the [Server]'s
3120  // underlying Listener(s).
3121  func (s *Server) Close() error {
3122  	s.inShutdown.Store(true)
3123  	s.mu.Lock()
3124  	defer s.mu.Unlock()
3125  	err := s.closeListenersLocked()
3126  
3127  	// Unlock s.mu while waiting for listenerGroup.
3128  	// The group Add and Done calls are made with s.mu held,
3129  	// to avoid adding a new listener in the window between
3130  	// us setting inShutdown above and waiting here.
3131  	s.mu.Unlock()
3132  	s.listenerGroup.Wait()
3133  	s.mu.Lock()
3134  
3135  	for c := range s.activeConn {
3136  		c.rwc.Close()
3137  		delete(s.activeConn, c)
3138  	}
3139  	return err
3140  }
3141  
3142  // shutdownPollIntervalMax is the max polling interval when checking
3143  // quiescence during Server.Shutdown. Polling starts with a small
3144  // interval and backs off to the max.
3145  // Ideally we could find a solution that doesn't involve polling,
3146  // but which also doesn't have a high runtime cost (and doesn't
3147  // involve any contentious mutexes), but that is left as an
3148  // exercise for the reader.
3149  const shutdownPollIntervalMax = 500 * time.Millisecond
3150  
3151  // Shutdown gracefully shuts down the server without interrupting any
3152  // active connections. Shutdown works by first closing all open
3153  // listeners, then closing all idle connections, and then waiting
3154  // indefinitely for connections to return to idle and then shut down.
3155  // If the provided context expires before the shutdown is complete,
3156  // Shutdown returns the context's error, otherwise it returns any
3157  // error returned from closing the [Server]'s underlying Listener(s).
3158  //
3159  // When Shutdown is called, [Serve], [ServeTLS], [ListenAndServe], and
3160  // [ListenAndServeTLS] immediately return [ErrServerClosed]. Make sure the
3161  // program doesn't exit and waits instead for Shutdown to return.
3162  //
3163  // Shutdown does not attempt to close nor wait for hijacked
3164  // connections such as WebSockets. The caller of Shutdown should
3165  // separately notify such long-lived connections of shutdown and wait
3166  // for them to close, if desired. See [Server.RegisterOnShutdown] for a way to
3167  // register shutdown notification functions.
3168  //
3169  // Once Shutdown has been called on a server, it may not be reused;
3170  // future calls to methods such as Serve will return ErrServerClosed.
3171  func (s *Server) Shutdown(ctx context.Context) error {
3172  	s.inShutdown.Store(true)
3173  
3174  	s.mu.Lock()
3175  	lnerr := s.closeListenersLocked()
3176  	for _, f := range s.onShutdown {
3177  		f()
3178  	}
3179  	s.mu.Unlock()
3180  	s.listenerGroup.Wait()
3181  
3182  	pollIntervalBase := time.Millisecond
3183  	nextPollInterval := func() time.Duration {
3184  		// Add 10% jitter.
3185  		interval := pollIntervalBase + time.Duration(rand.Intn(int(pollIntervalBase/10)))
3186  		// Double and clamp for next time.
3187  		pollIntervalBase *= 2
3188  		if pollIntervalBase > shutdownPollIntervalMax {
3189  			pollIntervalBase = shutdownPollIntervalMax
3190  		}
3191  		return interval
3192  	}
3193  
3194  	timer := time.NewTimer(nextPollInterval())
3195  	defer timer.Stop()
3196  	for {
3197  		if s.closeIdleConns() {
3198  			return lnerr
3199  		}
3200  		select {
3201  		case <-ctx.Done():
3202  			return ctx.Err()
3203  		case <-timer.C:
3204  			timer.Reset(nextPollInterval())
3205  		}
3206  	}
3207  }
3208  
3209  // RegisterOnShutdown registers a function to call on [Server.Shutdown].
3210  // This can be used to gracefully shutdown connections that have
3211  // undergone ALPN protocol upgrade or that have been hijacked.
3212  // This function should start protocol-specific graceful shutdown,
3213  // but should not wait for shutdown to complete.
3214  func (s *Server) RegisterOnShutdown(f func()) {
3215  	s.mu.Lock()
3216  	s.onShutdown = append(s.onShutdown, f)
3217  	s.mu.Unlock()
3218  }
3219  
3220  // closeIdleConns closes all idle connections and reports whether the
3221  // server is quiescent.
3222  func (s *Server) closeIdleConns() bool {
3223  	s.mu.Lock()
3224  	defer s.mu.Unlock()
3225  	quiescent := true
3226  	for c := range s.activeConn {
3227  		st, unixSec := c.getState()
3228  		// Issue 22682: treat StateNew connections as if
3229  		// they're idle if we haven't read the first request's
3230  		// header in over 5 seconds.
3231  		if st == StateNew && unixSec < time.Now().Unix()-5 {
3232  			st = StateIdle
3233  		}
3234  		if st != StateIdle || unixSec == 0 {
3235  			// Assume unixSec == 0 means it's a very new
3236  			// connection, without state set yet.
3237  			quiescent = false
3238  			continue
3239  		}
3240  		c.rwc.Close()
3241  		delete(s.activeConn, c)
3242  	}
3243  	return quiescent
3244  }
3245  
3246  func (s *Server) closeListenersLocked() error {
3247  	var err error
3248  	for ln := range s.listeners {
3249  		if cerr := (*ln).Close(); cerr != nil && err == nil {
3250  			err = cerr
3251  		}
3252  	}
3253  	return err
3254  }
3255  
3256  // A ConnState represents the state of a client connection to a server.
3257  // It's used by the optional [Server.ConnState] hook.
3258  type ConnState int
3259  
3260  const (
3261  	// StateNew represents a new connection that is expected to
3262  	// send a request immediately. Connections begin at this
3263  	// state and then transition to either StateActive or
3264  	// StateClosed.
3265  	StateNew ConnState = iota
3266  
3267  	// StateActive represents a connection that has read 1 or more
3268  	// bytes of a request. The Server.ConnState hook for
3269  	// StateActive fires before the request has entered a handler
3270  	// and doesn't fire again until the request has been
3271  	// handled. After the request is handled, the state
3272  	// transitions to StateClosed, StateHijacked, or StateIdle.
3273  	// For HTTP/2, StateActive fires on the transition from zero
3274  	// to one active request, and only transitions away once all
3275  	// active requests are complete. That means that ConnState
3276  	// cannot be used to do per-request work; ConnState only notes
3277  	// the overall state of the connection.
3278  	StateActive
3279  
3280  	// StateIdle represents a connection that has finished
3281  	// handling a request and is in the keep-alive state, waiting
3282  	// for a new request. Connections transition from StateIdle
3283  	// to either StateActive or StateClosed.
3284  	StateIdle
3285  
3286  	// StateHijacked represents a hijacked connection.
3287  	// This is a terminal state. It does not transition to StateClosed.
3288  	StateHijacked
3289  
3290  	// StateClosed represents a closed connection.
3291  	// This is a terminal state. Hijacked connections do not
3292  	// transition to StateClosed.
3293  	StateClosed
3294  )
3295  
3296  var stateName = map[ConnState]string{
3297  	StateNew:      "new",
3298  	StateActive:   "active",
3299  	StateIdle:     "idle",
3300  	StateHijacked: "hijacked",
3301  	StateClosed:   "closed",
3302  }
3303  
3304  func (c ConnState) String() string {
3305  	return stateName[c]
3306  }
3307  
3308  // serverHandler delegates to either the server's Handler or
3309  // DefaultServeMux and also handles "OPTIONS *" requests.
3310  type serverHandler struct {
3311  	srv *Server
3312  }
3313  
3314  // ServeHTTP should be an internal detail,
3315  // but widely used packages access it using linkname.
3316  // Notable members of the hall of shame include:
3317  //   - github.com/erda-project/erda-infra
3318  //
3319  // Do not remove or change the type signature.
3320  // See go.dev/issue/67401.
3321  //
3322  //go:linkname badServeHTTP net/http.serverHandler.ServeHTTP
3323  func (sh serverHandler) ServeHTTP(rw ResponseWriter, req *Request) {
3324  	handler := sh.srv.Handler
3325  	if handler == nil {
3326  		handler = DefaultServeMux
3327  	}
3328  	if !sh.srv.DisableGeneralOptionsHandler && req.RequestURI == "*" && req.Method == "OPTIONS" {
3329  		handler = globalOptionsHandler{}
3330  	}
3331  
3332  	handler.ServeHTTP(rw, req)
3333  }
3334  
3335  func badServeHTTP(serverHandler, ResponseWriter, *Request)
3336  
3337  // AllowQuerySemicolons returns a handler that serves requests by converting any
3338  // unescaped semicolons in the URL query to ampersands, and invoking the handler h.
3339  //
3340  // This restores the pre-Go 1.17 behavior of splitting query parameters on both
3341  // semicolons and ampersands. (See golang.org/issue/25192). Note that this
3342  // behavior doesn't match that of many proxies, and the mismatch can lead to
3343  // security issues.
3344  //
3345  // AllowQuerySemicolons should be invoked before [Request.ParseForm] is called.
3346  func AllowQuerySemicolons(h Handler) Handler {
3347  	return HandlerFunc(func(w ResponseWriter, r *Request) {
3348  		if bytes.Contains(r.URL.RawQuery, ";") {
3349  			r2 := &Request{}
3350  			*r2 = *r
3351  			r2.URL = &url.URL{}
3352  			*r2.URL = *r.URL
3353  			r2.URL.RawQuery = bytes.ReplaceAll(r.URL.RawQuery, ";", "&")
3354  			h.ServeHTTP(w, r2)
3355  		} else {
3356  			h.ServeHTTP(w, r)
3357  		}
3358  	})
3359  }
3360  
3361  // ListenAndServe listens on the TCP network address s.Addr and then
3362  // calls [Serve] to handle requests on incoming connections.
3363  // Accepted connections are configured to enable TCP keep-alives.
3364  //
3365  // If s.Addr is blank, ":http" is used.
3366  //
3367  // ListenAndServe always returns a non-nil error. After [Server.Shutdown] or [Server.Close],
3368  // the returned error is [ErrServerClosed].
3369  func (s *Server) ListenAndServe() error {
3370  	if s.shuttingDown() {
3371  		return ErrServerClosed
3372  	}
3373  	addr := s.Addr
3374  	if addr == "" {
3375  		addr = ":http"
3376  	}
3377  	ln, err := net.Listen("tcp", addr)
3378  	if err != nil {
3379  		return err
3380  	}
3381  	return s.Serve(ln)
3382  }
3383  
3384  var testHookServerServe func(*Server, net.Listener) // used if non-nil
3385  
3386  // shouldConfigureHTTP2ForServe reports whether Server.Serve should configure
3387  // automatic HTTP/2. (which sets up the s.TLSNextProto map)
3388  func (s *Server) shouldConfigureHTTP2ForServe() bool {
3389  	if s.TLSConfig == nil {
3390  		// Compatibility with Go 1.6:
3391  		// If there's no TLSConfig, it's possible that the user just
3392  		// didn't set it on the http.Server, but did pass it to
3393  		// tls.NewListener and passed that listener to Serve.
3394  		// So we should configure HTTP/2 (to set up s.TLSNextProto)
3395  		// in case the listener returns an "h2" *tls.Conn.
3396  		return true
3397  	}
3398  	if s.protocols().UnencryptedHTTP2() {
3399  		return true
3400  	}
3401  	// The user specified a TLSConfig on their http.Server.
3402  	// In this, case, only configure HTTP/2 if their tls.Config
3403  	// explicitly mentions "h2". Otherwise http2.ConfigureServer
3404  	// would modify the tls.Config to add it, but they probably already
3405  	// passed this tls.Config to tls.NewListener. And if they did,
3406  	// it's too late anyway to fix it. It would only be potentially racy.
3407  	// See Issue 15908.
3408  	return slices.Contains(s.TLSConfig.NextProtos, http2NextProtoTLS)
3409  }
3410  
3411  // ErrServerClosed is returned by the [Server.Serve], [ServeTLS], [ListenAndServe],
3412  // and [ListenAndServeTLS] methods after a call to [Server.Shutdown] or [Server.Close].
3413  var ErrServerClosed = errors.New("http: Server closed")
3414  
3415  // Serve accepts incoming connections on the Listener l, creating a
3416  // new service goroutine for each. The service goroutines read requests and
3417  // then call s.Handler to reply to them.
3418  //
3419  // HTTP/2 support is only enabled if the Listener returns [*tls.Conn]
3420  // connections and they were configured with "h2" in the TLS
3421  // Config.NextProtos.
3422  //
3423  // Serve always returns a non-nil error and closes l.
3424  // After [Server.Shutdown] or [Server.Close], the returned error is [ErrServerClosed].
3425  func (s *Server) Serve(l net.Listener) error {
3426  	if fn := testHookServerServe; fn != nil {
3427  		fn(s, l) // call hook with unwrapped listener
3428  	}
3429  
3430  	origListener := l
3431  	l = &onceCloseListener{Listener: l}
3432  	defer l.Close()
3433  
3434  	if err := s.setupHTTP2_Serve(); err != nil {
3435  		return err
3436  	}
3437  
3438  	if !s.trackListener(&l, true) {
3439  		return ErrServerClosed
3440  	}
3441  	defer s.trackListener(&l, false)
3442  
3443  	baseCtx := context.Background()
3444  	if s.BaseContext != nil {
3445  		baseCtx = s.BaseContext(origListener)
3446  		if baseCtx == nil {
3447  			panic("BaseContext returned a nil context")
3448  		}
3449  	}
3450  
3451  	var tempDelay time.Duration // how long to sleep on accept failure
3452  
3453  	ctx := context.WithValue(baseCtx, ServerContextKey, s)
3454  	for {
3455  		rw, err := l.Accept()
3456  		if err != nil {
3457  			if s.shuttingDown() {
3458  				return ErrServerClosed
3459  			}
3460  			if ne, ok := err.(net.Error); ok && ne.Temporary() {
3461  				if tempDelay == 0 {
3462  					tempDelay = 5 * time.Millisecond
3463  				} else {
3464  					tempDelay *= 2
3465  				}
3466  				if max := 1 * time.Second; tempDelay > max {
3467  					tempDelay = max
3468  				}
3469  				s.logf("http: Accept error: %v; retrying in %v", err, tempDelay)
3470  				time.Sleep(tempDelay)
3471  				continue
3472  			}
3473  			return err
3474  		}
3475  		connCtx := ctx
3476  		if cc := s.ConnContext; cc != nil {
3477  			connCtx = cc(connCtx, rw)
3478  			if connCtx == nil {
3479  				panic("ConnContext returned nil")
3480  			}
3481  		}
3482  		tempDelay = 0
3483  		c := s.newConn(rw)
3484  		c.setState(c.rwc, StateNew, runHooks) // before Serve can return
3485  		c.serve(connCtx)
3486  	}
3487  }
3488  
3489  // ServeTLS accepts incoming connections on the Listener l, creating a
3490  // new service goroutine for each. The service goroutines perform TLS
3491  // setup and then read requests, calling s.Handler to reply to them.
3492  //
3493  // Files containing a certificate and matching private key for the
3494  // server must be provided if neither the [Server]'s
3495  // TLSConfig.Certificates, TLSConfig.GetCertificate nor
3496  // config.GetConfigForClient are populated.
3497  // If the certificate is signed by a certificate authority, the
3498  // certFile should be the concatenation of the server's certificate,
3499  // any intermediates, and the CA's certificate.
3500  //
3501  // ServeTLS always returns a non-nil error. After [Server.Shutdown] or [Server.Close], the
3502  // returned error is [ErrServerClosed].
3503  func (s *Server) ServeTLS(l net.Listener, certFile, keyFile string) error {
3504  	// Setup HTTP/2 before s.Serve, to initialize s.TLSConfig
3505  	// before we clone it and create the TLS Listener.
3506  	if err := s.setupHTTP2_ServeTLS(); err != nil {
3507  		return err
3508  	}
3509  
3510  	config := cloneTLSConfig(s.TLSConfig)
3511  	config.NextProtos = adjustNextProtos(config.NextProtos, s.protocols())
3512  
3513  	configHasCert := len(config.Certificates) > 0 || config.GetCertificate != nil || config.GetConfigForClient != nil
3514  	if !configHasCert || certFile != "" || keyFile != "" {
3515  		var err error
3516  		config.Certificates = []tls.Certificate{:1}
3517  		config.Certificates[0], err = tls.LoadX509KeyPair(certFile, keyFile)
3518  		if err != nil {
3519  			return err
3520  		}
3521  	}
3522  
3523  	tlsListener := tls.NewListener(l, config)
3524  	return s.Serve(tlsListener)
3525  }
3526  
3527  func (s *Server) protocols() Protocols {
3528  	if s.Protocols != nil {
3529  		return *s.Protocols // user-configured set
3530  	}
3531  
3532  	// The historic way of disabling HTTP/2 is to set TLSNextProto to
3533  	// a non-nil map with no "h2" entry.
3534  	_, hasH2 := s.TLSNextProto["h2"]
3535  	http2Disabled := s.TLSNextProto != nil && !hasH2
3536  
3537  	// If GODEBUG=http2server=0, then HTTP/2 is disabled unless
3538  	// the user has manually added an "h2" entry to TLSNextProto
3539  	// (probably by using x/net/http2 directly).
3540  	if http2server.Value() == "0" && !hasH2 {
3541  		http2Disabled = true
3542  	}
3543  
3544  	var p Protocols
3545  	p.SetHTTP1(true) // default always includes HTTP/1
3546  	if !http2Disabled {
3547  		p.SetHTTP2(true)
3548  	}
3549  	return p
3550  }
3551  
3552  // adjustNextProtos adds or removes "http/1.1" and "h2" entries from
3553  // a tls.Config.NextProtos list, according to the set of protocols in protos.
3554  func adjustNextProtos(nextProtos [][]byte, protos Protocols) [][]byte {
3555  	// Make a copy of NextProtos since it might be shared with some other tls.Config.
3556  	// (tls.Config.Clone doesn't do a deep copy.)
3557  	//
3558  	// We could avoid an allocation in the common case by checking to see if the slice
3559  	// is already in order, but this is just one small allocation per connection.
3560  	nextProtos = slices.Clone(nextProtos)
3561  	var have Protocols
3562  	nextProtos = slices.DeleteFunc(nextProtos, func(s []byte) bool {
3563  		switch s {
3564  		case "http/1.1":
3565  			if !protos.HTTP1() {
3566  				return true
3567  			}
3568  			have.SetHTTP1(true)
3569  		case "h2":
3570  			if !protos.HTTP2() {
3571  				return true
3572  			}
3573  			have.SetHTTP2(true)
3574  		}
3575  		return false
3576  	})
3577  	if protos.HTTP2() && !have.HTTP2() {
3578  		nextProtos = append(nextProtos, "h2")
3579  	}
3580  	if protos.HTTP1() && !have.HTTP1() {
3581  		nextProtos = append(nextProtos, "http/1.1")
3582  	}
3583  	return nextProtos
3584  }
3585  
3586  // trackListener adds or removes a net.Listener to the set of tracked
3587  // listeners.
3588  //
3589  // We store a pointer to interface in the map set, in case the
3590  // net.Listener is not comparable. This is safe because we only call
3591  // trackListener via Serve and can track+defer untrack the same
3592  // pointer to local variable there. We never need to compare a
3593  // Listener from another caller.
3594  //
3595  // It reports whether the server is still up (not Shutdown or Closed).
3596  func (s *Server) trackListener(ln *net.Listener, add bool) bool {
3597  	s.mu.Lock()
3598  	defer s.mu.Unlock()
3599  	if s.listeners == nil {
3600  		s.listeners = map[*net.Listener]struct{}{}
3601  	}
3602  	if add {
3603  		if s.shuttingDown() {
3604  			return false
3605  		}
3606  		s.listeners[ln] = struct{}{}
3607  		s.listenerGroup.Add(1)
3608  	} else {
3609  		delete(s.listeners, ln)
3610  		s.listenerGroup.Done()
3611  	}
3612  	return true
3613  }
3614  
3615  func (s *Server) trackConn(c *conn, add bool) {
3616  	s.mu.Lock()
3617  	defer s.mu.Unlock()
3618  	if s.activeConn == nil {
3619  		s.activeConn = map[*conn]struct{}{}
3620  	}
3621  	if add {
3622  		s.activeConn[c] = struct{}{}
3623  	} else {
3624  		delete(s.activeConn, c)
3625  	}
3626  }
3627  
3628  func (s *Server) idleTimeout() time.Duration {
3629  	if s.IdleTimeout != 0 {
3630  		return s.IdleTimeout
3631  	}
3632  	return s.ReadTimeout
3633  }
3634  
3635  func (s *Server) readHeaderTimeout() time.Duration {
3636  	if s.ReadHeaderTimeout != 0 {
3637  		return s.ReadHeaderTimeout
3638  	}
3639  	return s.ReadTimeout
3640  }
3641  
3642  func (s *Server) doKeepAlives() bool {
3643  	return !s.disableKeepAlives.Load() && !s.shuttingDown()
3644  }
3645  
3646  func (s *Server) shuttingDown() bool {
3647  	return s.inShutdown.Load()
3648  }
3649  
3650  // SetKeepAlivesEnabled controls whether HTTP keep-alives are enabled.
3651  // By default, keep-alives are always enabled. Only very
3652  // resource-constrained environments or servers in the process of
3653  // shutting down should disable them.
3654  func (s *Server) SetKeepAlivesEnabled(v bool) {
3655  	if v {
3656  		s.disableKeepAlives.Store(false)
3657  		return
3658  	}
3659  	s.disableKeepAlives.Store(true)
3660  
3661  	// Close idle HTTP/1 conns:
3662  	s.closeIdleConns()
3663  
3664  	// TODO: Issue 26303: close HTTP/2 conns as soon as they become idle.
3665  }
3666  
3667  func (s *Server) logf(format string, args ...any) {
3668  	if s.ErrorLog != nil {
3669  		s.ErrorLog.Printf(format, args...)
3670  	} else {
3671  		log.Printf(format, args...)
3672  	}
3673  }
3674  
3675  // logf prints to the ErrorLog of the *Server associated with request r
3676  // via ServerContextKey. If there's no associated server, or if ErrorLog
3677  // is nil, logging is done via the log package's standard logger.
3678  func logf(r *Request, format string, args ...any) {
3679  	s, _ := r.Context().Value(ServerContextKey).(*Server)
3680  	if s != nil && s.ErrorLog != nil {
3681  		s.ErrorLog.Printf(format, args...)
3682  	} else {
3683  		log.Printf(format, args...)
3684  	}
3685  }
3686  
3687  // ListenAndServe listens on the TCP network address addr and then calls
3688  // [Serve] with handler to handle requests on incoming connections.
3689  // Accepted connections are configured to enable TCP keep-alives.
3690  //
3691  // The handler is typically nil, in which case [DefaultServeMux] is used.
3692  //
3693  // ListenAndServe always returns a non-nil error.
3694  func ListenAndServe(addr string, handler Handler) error {
3695  	server := &Server{Addr: addr, Handler: handler}
3696  	return server.ListenAndServe()
3697  }
3698  
3699  // ListenAndServeTLS acts identically to [ListenAndServe], except that it
3700  // expects HTTPS connections. Additionally, files containing a certificate and
3701  // matching private key for the server must be provided. If the certificate
3702  // is signed by a certificate authority, the certFile should be the concatenation
3703  // of the server's certificate, any intermediates, and the CA's certificate.
3704  func ListenAndServeTLS(addr, certFile, keyFile string, handler Handler) error {
3705  	server := &Server{Addr: addr, Handler: handler}
3706  	return server.ListenAndServeTLS(certFile, keyFile)
3707  }
3708  
3709  // ListenAndServeTLS listens on the TCP network address s.Addr and
3710  // then calls [ServeTLS] to handle requests on incoming TLS connections.
3711  // Accepted connections are configured to enable TCP keep-alives.
3712  //
3713  // Filenames containing a certificate and matching private key for the
3714  // server must be provided if neither the [Server]'s TLSConfig.Certificates
3715  // nor TLSConfig.GetCertificate are populated. If the certificate is
3716  // signed by a certificate authority, the certFile should be the
3717  // concatenation of the server's certificate, any intermediates, and
3718  // the CA's certificate.
3719  //
3720  // If s.Addr is blank, ":https" is used.
3721  //
3722  // ListenAndServeTLS always returns a non-nil error. After [Server.Shutdown] or
3723  // [Server.Close], the returned error is [ErrServerClosed].
3724  func (s *Server) ListenAndServeTLS(certFile, keyFile string) error {
3725  	if s.shuttingDown() {
3726  		return ErrServerClosed
3727  	}
3728  	addr := s.Addr
3729  	if addr == "" {
3730  		addr = ":https"
3731  	}
3732  
3733  	ln, err := net.Listen("tcp", addr)
3734  	if err != nil {
3735  		return err
3736  	}
3737  
3738  	defer ln.Close()
3739  
3740  	return s.ServeTLS(ln, certFile, keyFile)
3741  }
3742  
3743  // setupHTTP2_ServeTLS conditionally configures HTTP/2 on
3744  // s and reports whether there was an error setting it up. If it is
3745  // not configured for policy reasons, nil is returned.
3746  func (s *Server) setupHTTP2_ServeTLS() error {
3747  	s.nextProtoOnce.Do(s.onceSetNextProtoDefaults)
3748  	return s.nextProtoErr
3749  }
3750  
3751  // setupHTTP2_Serve is called from (*Server).Serve and conditionally
3752  // configures HTTP/2 on s using a more conservative policy than
3753  // setupHTTP2_ServeTLS because Serve is called after tls.Listen,
3754  // and may be called concurrently. See shouldConfigureHTTP2ForServe.
3755  //
3756  // The tests named TestTransportAutomaticHTTP2* and
3757  // TestConcurrentServerServe in server_test.go demonstrate some
3758  // of the supported use cases and motivations.
3759  func (s *Server) setupHTTP2_Serve() error {
3760  	s.nextProtoOnce.Do(s.onceSetNextProtoDefaults_Serve)
3761  	return s.nextProtoErr
3762  }
3763  
3764  func (s *Server) onceSetNextProtoDefaults_Serve() {
3765  	if s.shouldConfigureHTTP2ForServe() {
3766  		s.onceSetNextProtoDefaults()
3767  	}
3768  }
3769  
3770  var http2server = godebug.New("http2server")
3771  
3772  // onceSetNextProtoDefaults configures HTTP/2, if the user hasn't
3773  // configured otherwise. (by setting s.TLSNextProto non-nil)
3774  // It must only be called via s.nextProtoOnce (use s.setupHTTP2_*).
3775  func (s *Server) onceSetNextProtoDefaults() {
3776  	if omitBundledHTTP2 {
3777  		return
3778  	}
3779  	p := s.protocols()
3780  	if !p.HTTP2() && !p.UnencryptedHTTP2() {
3781  		return
3782  	}
3783  	if http2server.Value() == "0" {
3784  		http2server.IncNonDefault()
3785  		return
3786  	}
3787  	if _, ok := s.TLSNextProto["h2"]; ok {
3788  		// TLSNextProto already contains an HTTP/2 implementation.
3789  		// The user probably called golang.org/x/net/http2.ConfigureServer
3790  		// to add it.
3791  		return
3792  	}
3793  	conf := &http2Server{}
3794  	s.nextProtoErr = http2ConfigureServer(s, conf)
3795  }
3796  
3797  // TimeoutHandler returns a [Handler] that runs h with the given time limit.
3798  //
3799  // The new Handler calls h.ServeHTTP to handle each request, but if a
3800  // call runs for longer than its time limit, the handler responds with
3801  // a 503 Service Unavailable error and the given message in its body.
3802  // (If msg is empty, a suitable default message will be sent.)
3803  // After such a timeout, writes by h to its [ResponseWriter] will return
3804  // [ErrHandlerTimeout].
3805  //
3806  // TimeoutHandler supports the [Pusher] interface but does not support
3807  // the [Hijacker] or [Flusher] interfaces.
3808  func TimeoutHandler(h Handler, dt time.Duration, msg string) Handler {
3809  	return &timeoutHandler{
3810  		handler: h,
3811  		body:    msg,
3812  		dt:      dt,
3813  	}
3814  }
3815  
3816  // ErrHandlerTimeout is returned on [ResponseWriter] Write calls
3817  // in handlers which have timed out.
3818  var ErrHandlerTimeout = errors.New("http: Handler timeout")
3819  
3820  type timeoutHandler struct {
3821  	handler Handler
3822  	body    string
3823  	dt      time.Duration
3824  
3825  	// When set, no context will be created and this context will
3826  	// be used instead.
3827  	testContext context.Context
3828  }
3829  
3830  func (h *timeoutHandler) errorBody() string {
3831  	if h.body != "" {
3832  		return h.body
3833  	}
3834  	return "<html><head><title>Timeout</title></head><body><h1>Timeout</h1></body></html>"
3835  }
3836  
3837  func (h *timeoutHandler) ServeHTTP(w ResponseWriter, r *Request) {
3838  	ctx := h.testContext
3839  	if ctx == nil {
3840  		var cancelCtx context.CancelFunc
3841  		ctx, cancelCtx = context.WithTimeout(r.Context(), h.dt)
3842  		defer cancelCtx()
3843  	}
3844  	r = r.WithContext(ctx)
3845  	done := chan struct{}{}
3846  	tw := &timeoutWriter{
3847  		w:   w,
3848  		h:   make(Header),
3849  		req: r,
3850  	}
3851  	panicChan := chan any{1}
3852  	func() {
3853  		defer func() {
3854  			if p := recover(); p != nil {
3855  				panicChan <- p
3856  			}
3857  		}()
3858  		h.handler.ServeHTTP(tw, r)
3859  		close(done)
3860  	}()
3861  	select {
3862  	case p := <-panicChan:
3863  		panic(p)
3864  	case <-done:
3865  		tw.mu.Lock()
3866  		defer tw.mu.Unlock()
3867  		dst := w.Header()
3868  		maps.Copy(dst, tw.h)
3869  		if !tw.wroteHeader {
3870  			tw.code = StatusOK
3871  		}
3872  		w.WriteHeader(tw.code)
3873  		w.Write(tw.wbuf.Bytes())
3874  	case <-ctx.Done():
3875  		tw.mu.Lock()
3876  		defer tw.mu.Unlock()
3877  		switch err := ctx.Err(); err {
3878  		case context.DeadlineExceeded:
3879  			w.WriteHeader(StatusServiceUnavailable)
3880  			io.WriteString(w, h.errorBody())
3881  			tw.err = ErrHandlerTimeout
3882  		default:
3883  			w.WriteHeader(StatusServiceUnavailable)
3884  			tw.err = err
3885  		}
3886  	}
3887  }
3888  
3889  type timeoutWriter struct {
3890  	w    ResponseWriter
3891  	h    Header
3892  	wbuf bytes.Buffer
3893  	req  *Request
3894  
3895  	mu          sync.Mutex
3896  	err         error
3897  	wroteHeader bool
3898  	code        int
3899  }
3900  
3901  var _ Pusher = (*timeoutWriter)(nil)
3902  
3903  // Push implements the [Pusher] interface.
3904  func (tw *timeoutWriter) Push(target string, opts *PushOptions) error {
3905  	if pusher, ok := tw.w.(Pusher); ok {
3906  		return pusher.Push(target, opts)
3907  	}
3908  	return ErrNotSupported
3909  }
3910  
3911  func (tw *timeoutWriter) Header() Header { return tw.h }
3912  
3913  func (tw *timeoutWriter) Write(p []byte) (int, error) {
3914  	tw.mu.Lock()
3915  	defer tw.mu.Unlock()
3916  	if tw.err != nil {
3917  		return 0, tw.err
3918  	}
3919  	if !tw.wroteHeader {
3920  		tw.writeHeaderLocked(StatusOK)
3921  	}
3922  	return tw.wbuf.Write(p)
3923  }
3924  
3925  func (tw *timeoutWriter) writeHeaderLocked(code int) {
3926  	checkWriteHeaderCode(code)
3927  
3928  	switch {
3929  	case tw.err != nil:
3930  		return
3931  	case tw.wroteHeader:
3932  		if tw.req != nil {
3933  			caller := relevantCaller()
3934  			logf(tw.req, "http: superfluous response.WriteHeader call from %s (%s:%d)", caller.Function, path.Base(caller.File), caller.Line)
3935  		}
3936  	default:
3937  		tw.wroteHeader = true
3938  		tw.code = code
3939  	}
3940  }
3941  
3942  func (tw *timeoutWriter) WriteHeader(code int) {
3943  	tw.mu.Lock()
3944  	defer tw.mu.Unlock()
3945  	tw.writeHeaderLocked(code)
3946  }
3947  
3948  // onceCloseListener wraps a net.Listener, protecting it from
3949  // multiple Close calls.
3950  type onceCloseListener struct {
3951  	net.Listener
3952  	once     sync.Once
3953  	closeErr error
3954  }
3955  
3956  func (oc *onceCloseListener) Close() error {
3957  	oc.once.Do(oc.close)
3958  	return oc.closeErr
3959  }
3960  
3961  func (oc *onceCloseListener) close() { oc.closeErr = oc.Listener.Close() }
3962  
3963  // globalOptionsHandler responds to "OPTIONS *" requests.
3964  type globalOptionsHandler struct{}
3965  
3966  func (globalOptionsHandler) ServeHTTP(w ResponseWriter, r *Request) {
3967  	w.Header().Set("Content-Length", "0")
3968  	if r.ContentLength != 0 {
3969  		// Read up to 4KB of OPTIONS body (as mentioned in the
3970  		// spec as being reserved for future use), but anything
3971  		// over that is considered a waste of server resources
3972  		// (or an attack) and we abort and close the connection,
3973  		// courtesy of MaxBytesReader's EOF behavior.
3974  		mb := MaxBytesReader(w, r.Body, 4<<10)
3975  		io.Copy(io.Discard, mb)
3976  	}
3977  }
3978  
3979  // initALPNRequest is an HTTP handler that initializes certain
3980  // uninitialized fields in its *Request. Such partially-initialized
3981  // Requests come from ALPN protocol handlers.
3982  type initALPNRequest struct {
3983  	ctx context.Context
3984  	c   *tls.Conn
3985  	h   serverHandler
3986  }
3987  
3988  // BaseContext is an exported but unadvertised [http.Handler] method
3989  // recognized by x/net/http2 to pass down a context; the TLSNextProto
3990  // API predates context support so we shoehorn through the only
3991  // interface we have available.
3992  func (h initALPNRequest) BaseContext() context.Context { return h.ctx }
3993  
3994  func (h initALPNRequest) ServeHTTP(rw ResponseWriter, req *Request) {
3995  	if req.TLS == nil {
3996  		req.TLS = &tls.ConnectionState{}
3997  		*req.TLS = h.c.ConnectionState()
3998  	}
3999  	if req.Body == nil {
4000  		req.Body = NoBody
4001  	}
4002  	if req.RemoteAddr == "" {
4003  		req.RemoteAddr = h.c.RemoteAddr().String()
4004  	}
4005  	h.h.ServeHTTP(rw, req)
4006  }
4007  
4008  // loggingConn is used for debugging.
4009  type loggingConn struct {
4010  	name string
4011  	net.Conn
4012  }
4013  
4014  var (
4015  	uniqNameMu   sync.Mutex
4016  	uniqNameNext = map[string]int{}
4017  )
4018  
4019  func newLoggingConn(baseName string, c net.Conn) net.Conn {
4020  	uniqNameMu.Lock()
4021  	defer uniqNameMu.Unlock()
4022  	uniqNameNext[baseName]++
4023  	return &loggingConn{
4024  		name: fmt.Sprintf("%s-%d", baseName, uniqNameNext[baseName]),
4025  		Conn: c,
4026  	}
4027  }
4028  
4029  func (c *loggingConn) Write(p []byte) (n int, err error) {
4030  	log.Printf("%s.Write(%d) = ....", c.name, len(p))
4031  	n, err = c.Conn.Write(p)
4032  	log.Printf("%s.Write(%d) = %d, %v", c.name, len(p), n, err)
4033  	return
4034  }
4035  
4036  func (c *loggingConn) Read(p []byte) (n int, err error) {
4037  	log.Printf("%s.Read(%d) = ....", c.name, len(p))
4038  	n, err = c.Conn.Read(p)
4039  	log.Printf("%s.Read(%d) = %d, %v", c.name, len(p), n, err)
4040  	return
4041  }
4042  
4043  func (c *loggingConn) Close() (err error) {
4044  	log.Printf("%s.Close() = ...", c.name)
4045  	err = c.Conn.Close()
4046  	log.Printf("%s.Close() = %v", c.name, err)
4047  	return
4048  }
4049  
4050  // checkConnErrorWriter writes to c.rwc and records any write errors to c.werr.
4051  // It only contains one field (and a pointer field at that), so it
4052  // fits in an interface value without an extra allocation.
4053  type checkConnErrorWriter struct {
4054  	c *conn
4055  }
4056  
4057  func (w checkConnErrorWriter) Write(p []byte) (n int, err error) {
4058  	n, err = w.c.rwc.Write(p)
4059  	if err != nil && w.c.werr == nil {
4060  		w.c.werr = err
4061  		w.c.cancelCtx()
4062  	}
4063  	return
4064  }
4065  
4066  func numLeadingCRorLF(v []byte) (n int) {
4067  	for _, b := range v {
4068  		if b == '\r' || b == '\n' {
4069  			n++
4070  			continue
4071  		}
4072  		break
4073  	}
4074  	return
4075  }
4076  
4077  // tlsRecordHeaderLooksLikeHTTP reports whether a TLS record header
4078  // looks like it might've been a misdirected plaintext HTTP request.
4079  func tlsRecordHeaderLooksLikeHTTP(hdr [5]byte) bool {
4080  	switch string(hdr[:]) {
4081  	case "GET /", "HEAD ", "POST ", "PUT /", "OPTIO":
4082  		return true
4083  	}
4084  	return false
4085  }
4086  
4087  // MaxBytesHandler returns a [Handler] that runs h with its [ResponseWriter] and [Request.Body] wrapped by a MaxBytesReader.
4088  func MaxBytesHandler(h Handler, n int64) Handler {
4089  	return HandlerFunc(func(w ResponseWriter, r *Request) {
4090  		r2 := *r
4091  		r2.Body = MaxBytesReader(w, r.Body, n)
4092  		h.ServeHTTP(w, &r2)
4093  	})
4094  }
4095