Update manual pages

Bump ngtcp2 and its dependencies

.clang-format

@@ -8,56 +8,91 @@ AlignConsecutiveAssignments:
   AcrossEmptyLines: false
   AcrossComments:  false
   AlignCompound:   false
+  AlignFunctionPointers: false
   PadOperators:    true
 AlignConsecutiveBitFields:
   Enabled:         false
   AcrossEmptyLines: false
   AcrossComments:  false
   AlignCompound:   false
+  AlignFunctionPointers: false
   PadOperators:    true
 AlignConsecutiveDeclarations:
   Enabled:         false
   AcrossEmptyLines: false
   AcrossComments:  false
   AlignCompound:   false
+  AlignFunctionPointers: false
   PadOperators:    true
 AlignConsecutiveMacros:
   Enabled:         false
   AcrossEmptyLines: false
   AcrossComments:  false
   AlignCompound:   false
+  AlignFunctionPointers: false
   PadOperators:    true
+AlignConsecutiveShortCaseStatements:
+  Enabled:         false
+  AcrossEmptyLines: false
+  AcrossComments:  false
+  AlignCaseArrows: false
+  AlignCaseColons: false
+AlignConsecutiveTableGenBreakingDAGArgColons:
+  Enabled:         false
+  AcrossEmptyLines: false
+  AcrossComments:  false
+  AlignCompound:   false
+  AlignFunctionPointers: false
+  PadOperators:    false
+AlignConsecutiveTableGenCondOperatorColons:
+  Enabled:         false
+  AcrossEmptyLines: false
+  AcrossComments:  false
+  AlignCompound:   false
+  AlignFunctionPointers: false
+  PadOperators:    false
+AlignConsecutiveTableGenDefinitionColons:
+  Enabled:         false
+  AcrossEmptyLines: false
+  AcrossComments:  false
+  AlignCompound:   false
+  AlignFunctionPointers: false
+  PadOperators:    false
 AlignEscapedNewlines: Right
 AlignOperands:   Align
-AlignTrailingComments: true
+AlignTrailingComments:
+  Kind:            Always
+  OverEmptyLines:  0
 AllowAllArgumentsOnNextLine: true
 AllowAllParametersOfDeclarationOnNextLine: true
-AllowShortEnumsOnASingleLine: true
+AllowBreakBeforeNoexceptSpecifier: Never
 AllowShortBlocksOnASingleLine: Never
+AllowShortCaseExpressionOnASingleLine: true
 AllowShortCaseLabelsOnASingleLine: false
+AllowShortCompoundRequirementOnASingleLine: true
+AllowShortEnumsOnASingleLine: true
 AllowShortFunctionsOnASingleLine: All
-AllowShortLambdasOnASingleLine: All
 AllowShortIfStatementsOnASingleLine: Never
+AllowShortLambdasOnASingleLine: All
 AllowShortLoopsOnASingleLine: false
 AlwaysBreakAfterDefinitionReturnType: None
-AlwaysBreakAfterReturnType: None
 AlwaysBreakBeforeMultilineStrings: false
-AlwaysBreakTemplateDeclarations: MultiLine
 AttributeMacros:
   - __capability
 BinPackArguments: true
 BinPackParameters: true
+BitFieldColonSpacing: Both
 BraceWrapping:
   AfterCaseLabel:  false
   AfterClass:      false
   AfterControlStatement: Never
   AfterEnum:       false
+  AfterExternBlock: false
   AfterFunction:   false
   AfterNamespace:  false
   AfterObjCDeclaration: false
   AfterStruct:     false
   AfterUnion:      false
-  AfterExternBlock: false
   BeforeCatch:     false
   BeforeElse:      false
   BeforeLambdaBody: false
@@ -66,33 +101,32 @@ BraceWrapping:
   SplitEmptyFunction: true
   SplitEmptyRecord: true
   SplitEmptyNamespace: true
+BreakAdjacentStringLiterals: true
+BreakAfterAttributes: Leave
+BreakAfterJavaFieldAnnotations: false
+BreakAfterReturnType: None
+BreakArrays:     true
 BreakBeforeBinaryOperators: None
 BreakBeforeConceptDeclarations: Always
 BreakBeforeBraces: Attach
-BreakBeforeInheritanceComma: false
+BreakBeforeInlineASMColon: OnlyMultiline
-BreakInheritanceList: BeforeColon
 BreakBeforeTernaryOperators: true
-BreakConstructorInitializersBeforeComma: false
 BreakConstructorInitializers: BeforeColon
-BreakAfterJavaFieldAnnotations: false
+BreakFunctionDefinitionParameters: false
+BreakInheritanceList: BeforeColon
 BreakStringLiterals: true
+BreakTemplateDeclarations: MultiLine
 ColumnLimit:     80
 CommentPragmas:  '^ IWYU pragma:'
-QualifierAlignment: Leave
 CompactNamespaces: false
-ConstructorInitializerIndentWidth: 4
+ConstructorInitializerIndentWidth: 2
-ContinuationIndentWidth: 4
+ContinuationIndentWidth: 2
 Cpp11BracedListStyle: true
-DeriveLineEnding: true
 DerivePointerAlignment: false
 DisableFormat:   false
 EmptyLineAfterAccessModifier: Never
 EmptyLineBeforeAccessModifier: LogicalBlock
 ExperimentalAutoDetectBinPacking: false
-PackConstructorInitializers: NextLine
-BasedOnStyle:    ''
-ConstructorInitializerAllOnOneLineOrOnePerLine: false
-AllowAllConstructorInitializersOnNextLine: true
 FixNamespaceComments: true
 ForEachMacros:
   - foreach
@@ -117,22 +151,35 @@ IncludeCategories:
 IncludeIsMainRegex: '$'
 IncludeIsMainSourceRegex: ''
 IndentAccessModifiers: false
-IndentCaseLabels: false
 IndentCaseBlocks: false
+IndentCaseLabels: false
+IndentExternBlock: AfterExternBlock
 IndentGotoLabels: true
 IndentPPDirectives: AfterHash
-IndentExternBlock: AfterExternBlock
 IndentRequiresClause: false
 IndentWidth:     2
 IndentWrappedFunctionNames: false
 InsertBraces:    false
+InsertNewlineAtEOF: false
 InsertTrailingCommas: None
+IntegerLiteralSeparator:
+  Binary:          0
+  BinaryMinDigits: 0
+  Decimal:         0
+  DecimalMinDigits: 0
+  Hex:             0
+  HexMinDigits:    0
 JavaScriptQuotes: Leave
 JavaScriptWrapImports: true
-KeepEmptyLinesAtTheStartOfBlocks: true
+KeepEmptyLines:
+  AtEndOfFile:     false
+  AtStartOfBlock:  false
+  AtStartOfFile:   true
 LambdaBodyIndentation: Signature
+LineEnding:      DeriveLF
 MacroBlockBegin: ''
 MacroBlockEnd:   ''
+MainIncludeChar: Quote
 MaxEmptyLinesToKeep: 1
 NamespaceIndentation: None
 ObjCBinPackProtocolList: Auto
@@ -140,35 +187,44 @@ ObjCBlockIndentWidth: 2
 ObjCBreakBeforeNestedBlockParam: true
 ObjCSpaceAfterProperty: false
 ObjCSpaceBeforeProtocolList: true
+PackConstructorInitializers: NextLine
 PenaltyBreakAssignment: 2
 PenaltyBreakBeforeFirstCallParameter: 19
 PenaltyBreakComment: 300
 PenaltyBreakFirstLessLess: 120
 PenaltyBreakOpenParenthesis: 0
+PenaltyBreakScopeResolution: 500
 PenaltyBreakString: 1000
 PenaltyBreakTemplateDeclaration: 10
 PenaltyExcessCharacter: 1000000
-PenaltyReturnTypeOnItsOwnLine: 60
 PenaltyIndentedWhitespace: 0
+PenaltyReturnTypeOnItsOwnLine: 60
 PointerAlignment: Right
 PPIndentWidth:   -1
+QualifierAlignment: Leave
 ReferenceAlignment: Pointer
 ReflowComments:  true
 RemoveBracesLLVM: false
+RemoveParentheses: Leave
+RemoveSemicolon: false
 RequiresClausePosition: OwnLine
+RequiresExpressionIndentation: OuterScope
 SeparateDefinitionBlocks: Leave
 ShortNamespaceLines: 1
+SkipMacroDefinitionBody: false
 SortIncludes:    Never
 SortJavaStaticImport: Before
-SortUsingDeclarations: true
+SortUsingDeclarations: LexicographicNumeric
 SpaceAfterCStyleCast: false
 SpaceAfterLogicalNot: false
 SpaceAfterTemplateKeyword: true
+SpaceAroundPointerQualifiers: Default
 SpaceBeforeAssignmentOperators: true
 SpaceBeforeCaseColon: false
 SpaceBeforeCpp11BracedList: false
 SpaceBeforeCtorInitializerColon: true
 SpaceBeforeInheritanceColon: true
+SpaceBeforeJsonColon: false
 SpaceBeforeParens: ControlStatements
 SpaceBeforeParensOptions:
   AfterControlStatements: true
@@ -177,34 +233,40 @@ SpaceBeforeParensOptions:
   AfterFunctionDeclarationName: false
   AfterIfMacros:   true
   AfterOverloadedOperator: false
+  AfterPlacementOperator: true
   AfterRequiresInClause: false
   AfterRequiresInExpression: false
   BeforeNonEmptyParentheses: false
-SpaceAroundPointerQualifiers: Default
 SpaceBeforeRangeBasedForLoopColon: true
+SpaceBeforeSquareBrackets: false
 SpaceInEmptyBlock: false
-SpaceInEmptyParentheses: false
 SpacesBeforeTrailingComments: 1
 SpacesInAngles:  Never
-SpacesInConditionalStatement: false
 SpacesInContainerLiterals: true
-SpacesInCStyleCastParentheses: false
 SpacesInLineCommentPrefix:
   Minimum:         1
   Maximum:         -1
-SpacesInParentheses: false
+SpacesInParens:  Never
+SpacesInParensOptions:
+  ExceptDoubleParentheses: false
+  InCStyleCasts:   false
+  InConditionalStatements: false
+  InEmptyParentheses: false
+  Other:           false
 SpacesInSquareBrackets: false
-SpaceBeforeSquareBrackets: false
-BitFieldColonSpacing: Both
 Standard:        Latest
 StatementAttributeLikeMacros:
   - Q_EMIT
 StatementMacros:
   - Q_UNUSED
   - QT_REQUIRE_VERSION
+  - munit_void_test_decl
+  - nghttp2_max_def
+  - nghttp2_min_def
+TableGenBreakInsideDAGArg: DontBreak
 TabWidth:        8
-UseCRLF:         false
 UseTab:          Never
+VerilogBreakBetweenInstancePorts: true
 WhitespaceSensitiveMacros:
   - STRINGIZE
   - PP_STRINGIZE

.github/workflows/android.yml

@@ -0,0 +1,24 @@
+name: android
+
+on:
+  push:
+    paths:
+    - Dockerfile.android
+    - .github/workflows/android.yml
+    branches:
+    - '**'
+
+permissions: read-all
+
+jobs:
+  build:
+    runs-on: ubuntu-24.04
+
+    steps:
+    - uses: actions/checkout@v5
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+    - name: Build
+      uses: docker/build-push-action@v6
+      with:
+        file: Dockerfile.android

.github/workflows/build.yml

@@ -5,25 +5,26 @@ on: [push, pull_request]
 permissions: read-all
 
 env:
-  LIBBPF_VERSION: v1.3.0
+  LIBBPF_VERSION: v1.6.2
   OPENSSL1_VERSION: 1_1_1w+quic
-  OPENSSL3_VERSION: 3.1.5+quic
+  OPENSSL3_VERSION: 3.6.0
-  BORINGSSL_VERSION: 6ab7c1482bf4cdc91c87bc512aaf68ffb18975ec
+  BORINGSSL_VERSION: db1a8456167249f95b854a1cd24c6b553d0f1567
-  AWSLC_VERSION: v1.26.0
+  AWSLC_VERSION: v1.62.0
-  NGHTTP3_VERSION: v1.3.0
+  NGHTTP3_VERSION: v1.12.0
-  NGTCP2_VERSION: v1.5.0
+  NGTCP2_VERSION: v1.17.0
+  WOLFSSL_VERSION: v5.8.2-stable
 
 jobs:
   build-cache:
     strategy:
       matrix:
-        os: [ubuntu-22.04, macos-13, macos-14]
+        os: [ubuntu-24.04, macos-14, macos-15]
 
     runs-on: ${{ matrix.os }}
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
     - name: Restore libbpf cache
       id: cache-libbpf
       uses: actions/cache@v4
@@ -48,8 +49,8 @@ jobs:
       uses: actions/cache@v4
       with:
         path: |
-          boringssl/build/crypto/libcrypto.a
+          boringssl/build/libcrypto.a
-          boringssl/build/ssl/libssl.a
+          boringssl/build/libssl.a
           boringssl/include
         key: ${{ matrix.os }}-boringssl-${{ env.BORINGSSL_VERSION }}
     - name: Restore aws-lc cache
@@ -61,6 +62,12 @@ jobs:
           aws-lc/build/ssl/libssl.a
           aws-lc/include
         key: ${{ matrix.os }}-awslc-${{ env.AWSLC_VERSION }}
+    - name: Restore wolfSSL cache
+      id: cache-wolfssl
+      uses: actions/cache@v4
+      with:
+        path: wolfssl/build
+        key: ${{ matrix.os }}-wolfssl-${{ env.WOLFSSL_VERSION }}
     - name: Restore nghttp3 cache
       id: cache-nghttp3
       uses: actions/cache@v4
@@ -86,6 +93,7 @@ jobs:
         steps.cache-openssl3.outputs.cache-hit != 'true' ||
         steps.cache-boringssl.outputs.cache-hit != 'true' ||
         steps.cache-awslc.outputs.cache-hit != 'true' ||
+        steps.cache-wolfssl.outputs.cache-hit != 'true' ||
         steps.cache-nghttp3.outputs.cache-hit != 'true' ||
         steps.cache-ngtcp2-openssl1.outputs.cache-hit != 'true' ||
         steps.cache-ngtcp2-openssl3.outputs.cache-hit != 'true'
@@ -96,8 +104,6 @@ jobs:
       run: |
         sudo apt-get update
         sudo apt-get install \
-          g++-12 \
-          clang-15 \
           autoconf \
           automake \
           autotools-dev \
@@ -112,28 +118,27 @@ jobs:
         brew install \
           autoconf \
           automake \
-          pkg-config \
           libtool
     - name: Build libbpf
       if: steps.cache-libbpf.outputs.cache-hit != 'true' && runner.os == 'Linux'
       run: |
-        git clone --recursive -b ${{ env.LIBBPF_VERSION }} https://github.com/libbpf/libbpf
+        git clone --recursive --shallow-submodules -b ${{ env.LIBBPF_VERSION }} https://github.com/libbpf/libbpf
         cd libbpf
         make -C src install PREFIX=$PWD/build
     - name: Build quictls/openssl v1.1.1
       if: steps.cache-openssl1.outputs.cache-hit != 'true'
       run: |
-        git clone --recursive --depth 1 -b OpenSSL_${{ env.OPENSSL1_VERSION }} https://github.com/quictls/openssl openssl1
+        git clone --recursive --shallow-submodules --depth 1 -b OpenSSL_${{ env.OPENSSL1_VERSION }} https://github.com/quictls/openssl openssl1
         cd openssl1
         ./config --prefix=$PWD/build
         make -j"$(nproc 2> /dev/null || sysctl -n hw.ncpu)"
         make install_sw
-    - name: Build quictls/openssl v3.x
+    - name: Build openssl/openssl v3.x
       if: steps.cache-openssl3.outputs.cache-hit != 'true'
       run: |
-        git clone --recursive --depth 1 -b openssl-${{ env.OPENSSL3_VERSION }} https://github.com/quictls/openssl openssl3
+        git clone --recursive --shallow-submodules --depth 1 -b openssl-${{ env.OPENSSL3_VERSION }} https://github.com/openssl/openssl openssl3
         cd openssl3
-        ./config enable-ktls --prefix=$PWD/build --libdir=$PWD/build/lib
+        ./config enable-ktls --prefix=$PWD/build
         make -j"$(nproc 2> /dev/null || sysctl -n hw.ncpu)"
         make install_sw
     - name: Build BoringSSL
@@ -152,42 +157,56 @@ jobs:
     - name: Build aws-lc
       if: steps.cache-awslc.outputs.cache-hit != 'true'
       run: |
-        git clone --recursive --depth 1 -b "${AWSLC_VERSION}" https://github.com/aws/aws-lc
+        git clone --recursive --shallow-submodules --depth 1 -b "${AWSLC_VERSION}" https://github.com/aws/aws-lc
         cd aws-lc
         cmake -B build -DDISABLE_GO=ON
         make -j"$(nproc 2> /dev/null || sysctl -n hw.ncpu)" -C build
+    - name: Build wolfSSL
+      if: steps.cache-wolfssl.outputs.cache-hit != 'true'
+      run: |
+        git clone --depth 1 -b ${{ env.WOLFSSL_VERSION }} https://github.com/wolfSSL/wolfssl
+        cd wolfssl
+        autoreconf -i
+        ./configure --disable-dependency-tracking --prefix=$PWD/build \
+          --enable-all --enable-harden --disable-ech
+        make -j"$(nproc 2> /dev/null || sysctl -n hw.ncpu)"
+        make install
     - name: Build nghttp3
       if: steps.cache-nghttp3.outputs.cache-hit != 'true'
       run: |
-        git clone --recursive --depth 1 -b ${{ env.NGHTTP3_VERSION}} https://github.com/ngtcp2/nghttp3
+        git clone --recursive --shallow-submodules --depth 1 -b ${{ env.NGHTTP3_VERSION}} https://github.com/ngtcp2/nghttp3
         cd nghttp3
         autoreconf -i
-        ./configure --prefix=$PWD/build --enable-lib-only
+        ./configure --disable-dependency-tracking --prefix=$PWD/build \
+          --enable-lib-only
         make -j"$(nproc 2> /dev/null || sysctl -n hw.ncpu)" check
         make install
     - name: Build ngtcp2 + quictls/openssl v1.1.1 + BoringSSL
       if: steps.cache-ngtcp2-openssl1.outputs.cache-hit != 'true'
       run: |
-        git clone --recursive --depth 1 -b ${{ env.NGTCP2_VERSION }} https://github.com/ngtcp2/ngtcp2 ngtcp2-openssl1
+        git clone --recursive --shallow-submodules --depth 1 -b ${{ env.NGTCP2_VERSION }} https://github.com/ngtcp2/ngtcp2 ngtcp2-openssl1
         cd ngtcp2-openssl1
         autoreconf -i
         ./configure --prefix=$PWD/build --enable-lib-only \
-          PKG_CONFIG_PATH="../openssl1/build/lib/pkgconfig" \
+          PKG_CONFIG_PATH="../openssl1/build/lib/pkgconfig:../wolfssl/build/lib/pkgconfig" \
           BORINGSSL_CFLAGS="-I$PWD/../boringssl/include/" \
-          BORINGSSL_LIBS="-L$PWD/../boringssl/build/ssl -lssl -L$PWD/../boringssl/build/crypto -lcrypto" \
+          BORINGSSL_LIBS="-L$PWD/../boringssl/build -lssl -lcrypto" \
-          --with-boringssl
+          --disable-dependency-tracking \
+          --with-boringssl \
+          --with-wolfssl
         make -j"$(nproc 2> /dev/null || sysctl -n hw.ncpu)" check
         make install
     - name: Build ngtcp2 + quictls/openssl v3.x + aws-lc
       if: steps.cache-ngtcp2-openssl3.outputs.cache-hit != 'true'
       run: |
-        git clone --recursive --depth 1 -b ${{ env.NGTCP2_VERSION }} https://github.com/ngtcp2/ngtcp2 ngtcp2-openssl3
+        git clone --recursive --shallow-submodules --depth 1 -b ${{ env.NGTCP2_VERSION }} https://github.com/ngtcp2/ngtcp2 ngtcp2-openssl3
         cd ngtcp2-openssl3
         autoreconf -i
         ./configure --prefix=$PWD/build --enable-lib-only \
-          PKG_CONFIG_PATH="../openssl3/build/lib/pkgconfig" \
+          PKG_CONFIG_PATH="../openssl3/build/lib64/pkgconfig:../openssl3/build/lib/pkgconfig" \
           BORINGSSL_CFLAGS="-I$PWD/../aws-lc/include/" \
           BORINGSSL_LIBS="-L$PWD/../aws-lc/build/ssl -lssl -L$PWD/../aws-lc/build/crypto -lcrypto" \
+          --disable-dependency-tracking \
           --with-boringssl
         make -j"$(nproc 2> /dev/null || sysctl -n hw.ncpu)" check
         make install
@@ -198,46 +217,42 @@ jobs:
 
     strategy:
       matrix:
-        os: [ubuntu-22.04, macos-13, macos-14]
+        os: [ubuntu-24.04, macos-14, macos-15]
         compiler: [gcc, clang]
         buildtool: [autotools, cmake]
         http3: [http3, no-http3]
-        openssl: [openssl1, openssl3, boringssl, awslc]
+        openssl: [openssl1, openssl3, boringssl, awslc, wolfssl]
         exclude:
-        - os: macos-13
-          openssl: openssl3
-        - os: macos-14
-          openssl: openssl3
         - http3: no-http3
           openssl: openssl3
-        - os: macos-13
-          compiler: gcc
         - os: macos-14
           compiler: gcc
-        - # disable macos cmake because of include path issue
+        - os: macos-15
-          os: macos-13
+          compiler: gcc
-          buildtool: cmake
         - # disable macos cmake because of include path issue
           os: macos-14
           buildtool: cmake
-        - os: macos-13
+        - # disable macos cmake because of include path issue
-          openssl: boringssl
+          os: macos-15
+          buildtool: cmake
         - os: macos-14
           openssl: boringssl
+        - os: macos-15
+          openssl: boringssl
         - openssl: boringssl
           buildtool: cmake
         - openssl: boringssl
           compiler: gcc
-        - os: macos-13
-          openssl: awslc
         - os: macos-14
           openssl: awslc
+        - os: macos-15
+          openssl: awslc
         - openssl: awslc
           buildtool: cmake
         - openssl: awslc
           compiler: gcc
         include:
-        - os: ubuntu-22.04
+        - os: ubuntu-24.04
           compiler: clang
           buildtool: distcheck
           http3: http3
@@ -247,7 +262,7 @@ jobs:
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
       with:
         submodules: recursive
     - name: Linux setup
@@ -255,8 +270,8 @@ jobs:
       run: |
         sudo apt-get update
         sudo apt-get install \
-          g++-12 \
+          g++-14 \
-          clang-15 \
+          clang-19 \
           autoconf \
           automake \
           autotools-dev \
@@ -287,20 +302,16 @@ jobs:
       run: |
         brew install \
           libev \
-          libevent \
-          c-ares \
           libressl \
-          brotli \
           autoconf \
           automake \
-          pkg-config \
           libtool
         echo 'PKG_CONFIG_PATH=/usr/local/opt/libressl/lib/pkgconfig:/usr/local/opt/libxml2/lib/pkgconfig' >> $GITHUB_ENV
     - name: Setup clang (Linux)
       if: runner.os == 'Linux' && matrix.compiler == 'clang'
       run: |
-        echo 'CC=clang-15' >> $GITHUB_ENV
+        echo 'CC=clang-19' >> $GITHUB_ENV
-        echo 'CXX=clang++-15' >> $GITHUB_ENV
+        echo 'CXX=clang++-19' >> $GITHUB_ENV
     - name: Setup clang (MacOS)
       if: runner.os == 'macOS' && matrix.compiler == 'clang'
       run: |
@@ -309,8 +320,8 @@ jobs:
     - name: Setup gcc (Linux)
       if: runner.os == 'Linux' && matrix.compiler == 'gcc'
       run: |
-        echo 'CC=gcc-12' >> $GITHUB_ENV
+        echo 'CC=gcc-14' >> $GITHUB_ENV
-        echo 'CXX=g++-12' >> $GITHUB_ENV
+        echo 'CXX=g++-14' >> $GITHUB_ENV
         # g++-12 is known to produce false positive warnings.
         echo 'CXXFLAGS=-Wno-restrict' >> $GITHUB_ENV
     - name: Setup gcc (MacOS)
@@ -330,13 +341,13 @@ jobs:
       run: |
         cd libbpf
 
-        EXTRA_AUTOTOOLS_OPTS="--with-libbpf"
+        EXTRA_AUTOTOOLS_OPTS="$EXTRA_AUTOTOOLS_OPTS --with-libbpf"
-        EXTRA_CMAKE_OPTS="-DWITH_LIBBPF=1"
+        EXTRA_CMAKE_OPTS="$EXTRA_CMAKE_OPTS -DWITH_LIBBPF=1"
 
         echo 'EXTRA_AUTOTOOLS_OPTS='"$EXTRA_AUTOTOOLS_OPTS" >> $GITHUB_ENV
         echo 'EXTRA_CMAKE_OPTS='"$EXTRA_CMAKE_OPTS" >> $GITHUB_ENV
     - name: Setup libev variables
-      if: matrix.os == 'macos-14'
+      if: runner.os == 'macOS'
       run: |
         LIBEV_CFLAGS="-I/opt/homebrew/Cellar/libev/4.33/include"
         LIBEV_LIBS="-L/opt/homebrew/Cellar/libev/4.33/lib -lev"
@@ -350,7 +361,7 @@ jobs:
         path: openssl1/build
         key: ${{ matrix.os }}-openssl-${{ env.OPENSSL1_VERSION }}
         fail-on-cache-miss: true
-    - name: Restore quictls/openssl v3.x cache
+    - name: Restore openssl/openssl v3.x cache
       uses: actions/cache/restore@v4
       if: matrix.openssl == 'openssl3'
       with:
@@ -362,8 +373,8 @@ jobs:
       if: matrix.openssl == 'boringssl'
       with:
         path: |
-          boringssl/build/crypto/libcrypto.a
+          boringssl/build/libcrypto.a
-          boringssl/build/ssl/libssl.a
+          boringssl/build/libssl.a
           boringssl/include
         key: ${{ matrix.os }}-boringssl-${{ env.BORINGSSL_VERSION }}
         fail-on-cache-miss: true
@@ -383,7 +394,7 @@ jobs:
         cd boringssl
 
         OPENSSL_CFLAGS="-I$PWD/include/"
-        OPENSSL_LIBS="-L$PWD/build/ssl -lssl -L$PWD/build/crypto -lcrypto -pthread"
+        OPENSSL_LIBS="-L$PWD/build -lssl -lcrypto -pthread"
         EXTRA_AUTOTOOLS_OPTS="$EXTRA_AUTOTOOLS_OPTS --without-neverbleed --without-jemalloc --disable-examples"
 
         echo 'OPENSSL_CFLAGS='"$OPENSSL_CFLAGS" >> $GITHUB_ENV
@@ -405,6 +416,21 @@ jobs:
         echo 'BORINGSSL_CFLAGS='"$OPENSSL_CFLAGS" >> $GITHUB_ENV
         echo 'BORINGSSL_LIBS='"$OPENSSL_LIBS" >> $GITHUB_ENV
         echo 'EXTRA_AUTOTOOLS_OPTS='"$EXTRA_AUTOTOOLS_OPTS" >> $GITHUB_ENV
+    - name: Restore wolfSSL cache
+      uses: actions/cache/restore@v4
+      if: matrix.openssl == 'wolfssl'
+      with:
+        path: wolfssl/build
+        key: ${{ matrix.os }}-wolfssl-${{ env.WOLFSSL_VERSION }}
+        fail-on-cache-miss: true
+    - name: Set wolfSSL variables
+      if: matrix.openssl == 'wolfssl'
+      run: |
+        EXTRA_AUTOTOOLS_OPTS="$EXTRA_AUTOTOOLS_OPTS --with-wolfssl --without-neverbleed"
+        EXTRA_CMAKE_OPTS="$EXTRA_CMAKE_OPTS -DWITH_WOLFSSL=1 -DWITH_NEVERBLEED=0 -DENABLE_EXAMPLES=0"
+
+        echo 'EXTRA_AUTOTOOLS_OPTS='"$EXTRA_AUTOTOOLS_OPTS" >> $GITHUB_ENV
+        echo 'EXTRA_CMAKE_OPTS='"$EXTRA_CMAKE_OPTS" >> $GITHUB_ENV
     - name: Restore nghttp3 cache
       uses: actions/cache/restore@v4
       if: matrix.http3 == 'http3'
@@ -414,7 +440,7 @@ jobs:
         fail-on-cache-miss: true
     - name: Restore ngtcp2 + quictls/openssl v1.1.1 cache + BoringSSL
       uses: actions/cache/restore@v4
-      if: matrix.http3 == 'http3' && (matrix.openssl == 'openssl1' || matrix.openssl == 'boringssl')
+      if: matrix.http3 == 'http3' && (matrix.openssl == 'openssl1' || matrix.openssl == 'boringssl' || matrix.openssl == 'wolfssl')
       with:
         path: ngtcp2-openssl1/build
         key: ${{ matrix.os }}-ngtcp2-${{ env.NGTCP2_VERSION }}-openssl-${{ env.OPENSSL1_VERSION }}
@@ -429,18 +455,18 @@ jobs:
     - name: Setup extra environment variables
       if: matrix.http3 == 'no-http3'
       run: |
-        PKG_CONFIG_PATH="$PWD/openssl1/build/lib/pkgconfig:$PWD/openssl3/build/lib/pkgconfig"
+        PKG_CONFIG_PATH="$PWD/openssl1/build/lib/pkgconfig:$PWD/openssl3/build/lib64/pkgconfig:$PWD/openssl3/build/lib/pkgconfig:$PWD/wolfssl/build/lib/pkgconfig:$PKG_CONFIG_PATH"
-        LDFLAGS="$LDFLAGS -Wl,-rpath,$PWD/openssl1/build/lib -Wl,-rpath,$PWD/openssl3/build/lib"
+        LDFLAGS="$LDFLAGS -Wl,-rpath,$PWD/openssl1/build/lib -Wl,-rpath,$PWD/openssl3/build/lib64 -Wl,-rpath,$PWD/openssl3/build/lib"
 
         echo 'PKG_CONFIG_PATH='"$PKG_CONFIG_PATH" >> $GITHUB_ENV
         echo 'LDFLAGS='"$LDFLAGS" >> $GITHUB_ENV
     - name: Setup extra environment variables for HTTP/3
       if: matrix.http3 == 'http3'
       run: |
-        PKG_CONFIG_PATH="$PWD/openssl1/build/lib/pkgconfig:$PWD/openssl3/build/lib/pkgconfig:$PWD/nghttp3/build/lib/pkgconfig:$PWD/ngtcp2-openssl1/build/lib/pkgconfig:$PWD/ngtcp2-openssl3/build/lib/pkgconfig:$PWD/libbpf/build/lib64/pkgconfig:$PKG_CONFIG_PATH"
+        PKG_CONFIG_PATH="$PWD/openssl1/build/lib/pkgconfig:$PWD/openssl3/build/lib64/pkgconfig:$PWD/openssl3/build/lib/pkgconfig:$PWD/wolfssl/build/lib/pkgconfig:$PWD/nghttp3/build/lib/pkgconfig:$PWD/ngtcp2-openssl1/build/lib/pkgconfig:$PWD/ngtcp2-openssl3/build/lib/pkgconfig:$PWD/libbpf/build/lib64/pkgconfig:$PKG_CONFIG_PATH"
-        LDFLAGS="$LDFLAGS -Wl,-rpath,$PWD/openssl1/build/lib -Wl,-rpath,$PWD/openssl3/build/lib -Wl,-rpath,$PWD/libbpf/build/lib64"
+        LDFLAGS="$LDFLAGS -Wl,-rpath,$PWD/openssl1/build/lib -Wl,-rpath,$PWD/openssl3/build/lib64 -Wl,-rpath,$PWD/openssl3/build/lib -Wl,-rpath,$PWD/libbpf/build/lib64"
-        EXTRA_AUTOTOOLS_OPTS="--enable-http3 $EXTRA_AUTOTOOLS_OPTS"
+        EXTRA_AUTOTOOLS_OPTS="$EXTRA_AUTOTOOLS_OPTS --enable-http3"
-        EXTRA_CMAKE_OPTS="-DENABLE_HTTP3=1 $EXTRA_CMAKE_OPTS"
+        EXTRA_CMAKE_OPTS="$EXTRA_CMAKE_OPTS -DENABLE_HTTP3=1"
 
         echo 'PKG_CONFIG_PATH='"$PKG_CONFIG_PATH" >> $GITHUB_ENV
         echo 'LDFLAGS='"$LDFLAGS" >> $GITHUB_ENV
@@ -449,7 +475,7 @@ jobs:
     - name: Configure autotools
       run: |
         autoreconf -i
-        ./configure
+        ./configure --disable-dependency-tracking
     - name: Make distribution and unpack
       if: matrix.buildtool != 'distcheck'
       run: |
@@ -478,14 +504,14 @@ jobs:
       run: |
         cd $NGHTTP2_BUILD_DIR
 
-        ./configure --with-mruby --with-neverbleed --with-libev --with-libbrotlienc --with-libbrotlidec --enable-werror $EXTRA_AUTOTOOLS_OPTS
+        ./configure --disable-dependency-tracking --with-mruby --with-neverbleed --with-libev --with-libbrotlienc --with-libbrotlidec --enable-werror $EXTRA_AUTOTOOLS_OPTS
         make -j"$(nproc)" check
     - name: Build nghttp2 with autotools (MacOS)
       if: matrix.buildtool == 'autotools' && runner.os == 'macOS'
       run: |
         cd $NGHTTP2_BUILD_DIR
 
-        ./configure --with-mruby --with-libev --with-libbrotlienc --with-libbrotlidec --enable-werror $EXTRA_AUTOTOOLS_OPTS
+        ./configure --disable-dependency-tracking --with-mruby --with-libev --with-libbrotlienc --with-libbrotlidec --enable-werror $EXTRA_AUTOTOOLS_OPTS
         make -j"$(sysctl -n hw.ncpu)" check
     - name: Build nghttp2 with autotools (distcheck)
       if: matrix.buildtool == 'distcheck'
@@ -498,15 +524,16 @@ jobs:
         cd $NGHTTP2_BUILD_DIR
         make -j"$(nproc 2> /dev/null || sysctl -n hw.ncpu)"
         make -j"$(nproc 2> /dev/null || sysctl -n hw.ncpu)" check
-    - uses: actions/setup-go@v5
+    - uses: actions/setup-go@v6
       if: matrix.buildtool != 'distcheck'
       with:
-        go-version-file: go.mod
+        go-version: "1.24"
     - name: Integration test
       # Integration tests for nghttpx; autotools erases build
       # artifacts.
       if: matrix.buildtool != 'distcheck'
       run: |
+        sudo sh -c 'echo "127.0.0.1 127.0.0.1.nip.io" >> /etc/hosts'
         cd $NGHTTP2_BUILD_DIR/integration-tests
         make it
 
@@ -515,19 +542,22 @@ jobs:
       matrix:
         host: [x86_64-w64-mingw32, i686-w64-mingw32]
 
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
 
     env:
       HOST: ${{ matrix.host }}
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
       with:
         submodules: recursive
-    - name: Linux setup
+    - name: Prepare for i386
+      if: matrix.host == 'i686-w64-mingw32'
       run: |
         sudo dpkg --add-architecture i386
+    - name: Linux setup
+      run: |
         sudo apt-get update
         sudo apt-get install \
           gcc-mingw-w64 \
@@ -540,16 +570,16 @@ jobs:
     - name: Configure autotools
       run: |
         autoreconf -i && \
-        ./configure --enable-werror --enable-lib-only  --host="$HOST" \
+        ./configure --disable-dependency-tracking --enable-werror \
+          --enable-lib-only  --host="$HOST" \
           CFLAGS="-g -O2 -D_WIN32_WINNT=0x0600" LIBS="-pthread"
     - name: Build nghttp2
       run: |
         make -j$(nproc)
         make -j$(nproc) check TESTS=""
     - name: Run tests
-      if: matrix.host == 'x86_64-w64-mingw32'
       run: |
-        export WINEPATH=/usr/x86_64-w64-mingw32/lib
+        export WINEPATH="/usr/${{ matrix.host }}/lib;$(winepath -w /usr/lib/x86_64-linux-gnu/wine/x86_64-windows)"
         cd tests
         wine main.exe
 
@@ -567,7 +597,7 @@ jobs:
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
       with:
         submodules: recursive
     - uses: microsoft/setup-msbuild@v2
@@ -589,10 +619,10 @@ jobs:
     permissions:
       contents: write
 
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
       with:
         fetch-depth: 0
         submodules: recursive
@@ -609,7 +639,7 @@ jobs:
         GPG_KEY: ${{ secrets.GPG_KEY }}
         GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
     - name: Make release
-      uses: actions/github-script@v7
+      uses: actions/github-script@v8
       with:
         script: |
           const fs = require('fs')

.github/workflows/docker.yaml

@@ -11,14 +11,14 @@ permissions: read-all
 
 jobs:
   build:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v3
     - name: Build
-      uses: docker/build-push-action@v5
+      uses: docker/build-push-action@v6
       with:
         context: docker
         build-args: NGHTTP2_BRANCH=${{ github.ref_name }}

.github/workflows/stale.yaml

@@ -6,15 +6,17 @@ on:
 
 permissions:
   issues: write
+  actions: write
 
 jobs:
   stale:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
 
     steps:
-    - uses: actions/stale@v9
+    - uses: actions/stale@v10
       with:
         stale-issue-message: 'This issue is stale because it has been open 30 days with no activity.  Remove stale label or comment or this will be closed in 7 days.'
         days-before-stale: 30
         days-before-close: 7
+        days-before-pr-stale: -1
         exempt-all-milestones: true

.gitmodules

@@ -8,3 +8,6 @@
 [submodule "tests/munit"]
 	path = tests/munit
 	url = https://github.com/ngtcp2/munit
+[submodule "third-party/urlparse"]
+	path = third-party/urlparse
+	url = https://github.com/ngtcp2/urlparse

AUTHORS

@@ -47,6 +47,7 @@ David Beitey
 David Korczynski
 David Weekly
 Deel
+Deep Chordia
 Dimitris Apostolou
 Dmitri Tikhonov
 Dmitriy Vetutnev
@@ -79,6 +80,7 @@ Jonas Kvinge
 Josh Braegger
 José F. Calcerrada
 Kamil Dudka
+Karthik Dasari
 Kazuho Oku
 Kenny (kang-yen) Peng
 Kenny Peng
@@ -88,9 +90,11 @@ LazyHamster
 Leo Neat
 Lorenz Nickel
 Lucas Pardue
+Lukas Märdian
 MATSUMOTO Ryosuke
 Marc Bachmann
 Marcelo Trylesinski
+Mark Boddington
 Matt Rudary
 Matt Way
 Michael Kaufmann
@@ -102,6 +106,7 @@ Nora Shoemaker
 Paweł Wegner
 Pedro Santos
 Peeyush Aggarwal
+Peng-Yu Chen
 Peter Wu
 Piotr Sikora
 PufferOverflow
@@ -113,9 +118,11 @@ Richard Wolfert
 Rick Lei
 Ross Smith II
 Rudi Heitbaum
+Ryan Carsten Schmidt
 Ryo Ota
 Scott Mitchell
 Sebastiaan Deckers
+Sergei Trofimovich
 Sergey Fedorov
 Shelley Vohr
 Simon Frankenberger
@@ -129,6 +136,7 @@ Syohei YOSHIDA
 Tapanito
 Tatsuhiko Kubo
 Tatsuhiro Tsujikawa
+Thomas Devoogdt
 Tobias Geerinckx-Rice
 Tom Harwood
 Tomas Krizek
@@ -138,18 +146,22 @@ Vernon Tang
 Viacheslav Biriukov
 Viktor Szakats
 Viktor Szépe
+Ville Vesilehto
 Wenfeng Liu
 William A Rowe Jr
 Xiaoguang Sun
+Zachary Turner
 Zhuoyun Wei
 acesso
 ayanamist
+bmarques1995
 bxshi
 clemahieu
 dalf
 dawg
 es
 fangdingjun
+feicong
 hrxi
 jwchoi
 kumagi

CMakeLists.txt

@@ -24,13 +24,13 @@
 
 cmake_minimum_required(VERSION 3.14)
 # XXX using 1.8.90 instead of 1.9.0-DEV
-project(nghttp2 VERSION 1.62.1)
+project(nghttp2 VERSION 1.68.1 LANGUAGES C)
 
 # See versioning rule:
 #  https://www.gnu.org/software/libtool/manual/html_node/Updating-version-info.html
-set(LT_CURRENT  42)
+set(LT_CURRENT  43)
-set(LT_REVISION 1)
+set(LT_REVISION 3)
-set(LT_AGE      28)
+set(LT_AGE      29)
 
 set(CMAKE_MODULE_PATH "${CMAKE_CURRENT_SOURCE_DIR}/cmake" ${CMAKE_MODULE_PATH})
 include(Version)
@@ -58,6 +58,7 @@ find_package(Python3 COMPONENTS Interpreter)
 
 # Auto-detection of features that can be toggled
 if(NOT ENABLE_LIB_ONLY)
+  enable_language(CXX)
   find_package(Libev 4.11)
   find_package(Libcares 1.7.5)
   find_package(ZLIB 1.2.3)
@@ -65,20 +66,20 @@ if(NOT ENABLE_LIB_ONLY)
   find_package(Libbrotlidec 1.0.9)
 endif()
 
-find_package(OpenSSL 1.1.1)
+if(WITH_WOLFSSL)
-find_package(Libngtcp2 1.0.0)
+  find_package(WolfSSL 5.7.0)
-find_package(Libngtcp2_crypto_quictls 1.0.0)
+else()
-if(LIBNGTCP2_CRYPTO_QUICTLS_FOUND)
+  find_package(OpenSSL 1.1.1)
-  set(HAVE_LIBNGTCP2_CRYPTO_QUICTLS 1)
 endif()
-find_package(Libnghttp3 1.1.0)
+find_package(Libngtcp2 1.15.0)
+find_package(Libnghttp3 1.11.0)
 if(WITH_LIBBPF)
   find_package(Libbpf 0.7.0)
   if(NOT LIBBPF_FOUND)
     message(FATAL_ERROR "libbpf was requested (WITH_LIBBPF=1) but not found.")
   endif()
 endif()
-if(OPENSSL_FOUND AND LIBEV_FOUND AND ZLIB_FOUND)
+if((OPENSSL_FOUND OR WOLFSSL_FOUND) AND LIBEV_FOUND AND ZLIB_FOUND)
   set(ENABLE_APP_DEFAULT ON)
 else()
   set(ENABLE_APP_DEFAULT OFF)
@@ -123,30 +124,31 @@ else()
   set(HINT_NORETURN)
 endif()
 
-include(ExtractValidFlags)
+if(NOT ENABLE_LIB_ONLY)
-foreach(_cxx1x_flag -std=c++20)
+  include(ExtractValidFlags)
-  extract_valid_cxx_flags(_cxx1x_flag_supported ${_cxx1x_flag})
+  foreach(_cxx1x_flag -std=c++20)
-  if(_cxx1x_flag_supported)
+    extract_valid_cxx_flags(_cxx1x_flag_supported ${_cxx1x_flag})
-    set(CXX1XCXXFLAGS ${_cxx1x_flag})
+    if(_cxx1x_flag_supported)
-    break()
+      set(CXX1XCXXFLAGS ${_cxx1x_flag})
-  endif()
+      break()
-endforeach()
+    endif()
-
+  endforeach()
-include(CMakePushCheckState)
-include(CheckCXXSourceCompiles)
-cmake_push_check_state()
-set(CMAKE_REQUIRED_DEFINITIONS "${CXX1XCXXFLAGS}")
-# Check that std::future is available.
-check_cxx_source_compiles("
-#include <vector>
-#include <future>
-int main() { std::vector<std::future<int>> v; }" HAVE_STD_FUTURE)
-# Check that std::map::emplace is available for g++-4.7.
-check_cxx_source_compiles("
-#include <map>
-int main() { std::map<int, int>().emplace(1, 2); }" HAVE_STD_MAP_EMPLACE)
-cmake_pop_check_state()
 
+  include(CMakePushCheckState)
+  include(CheckCXXSourceCompiles)
+  cmake_push_check_state()
+  set(CMAKE_REQUIRED_DEFINITIONS "${CXX1XCXXFLAGS}")
+  # Check that std::future is available.
+  check_cxx_source_compiles("
+  #include <vector>
+  #include <future>
+  int main() { std::vector<std::future<int>> v; }" HAVE_STD_FUTURE)
+  # Check that std::chrono::time_zone is available.
+  check_cxx_source_compiles("
+  #include <chrono>
+  int main() { auto tz = std::chrono::current_zone(); (void)tz; }" HAVE_STD_CHRONO_TIME_ZONE)
+  cmake_pop_check_state()
+endif()
 
 # Checks for libraries.
 # Additional libraries required for programs under src directory.
@@ -174,7 +176,7 @@ add_custom_target(check COMMAND ${CMAKE_CTEST_COMMAND})
 # openssl (for src)
 include(CheckSymbolExists)
 set(HAVE_OPENSSL    ${OPENSSL_FOUND})
-if(OPENSSL_FOUND)
+if(NOT ENABLE_LIB_ONLY AND OPENSSL_FOUND)
   set(OPENSSL_INCLUDE_DIRS  ${OPENSSL_INCLUDE_DIR})
   cmake_push_check_state()
   set(CMAKE_REQUIRED_INCLUDES   "${OPENSSL_INCLUDE_DIR}")
@@ -182,10 +184,14 @@ if(OPENSSL_FOUND)
   if(WIN32)
     set(CMAKE_REQUIRED_LIBRARIES "${CMAKE_REQUIRED_LIBRARIES}" "ws2_32" "bcrypt")
   endif()
+  check_symbol_exists("LIBRESSL_VERSION_NUMBER" "openssl/opensslv.h" LIBRESSL_FOUND)
   if(ENABLE_HTTP3)
     check_symbol_exists(SSL_provide_quic_data "openssl/ssl.h" HAVE_SSL_PROVIDE_QUIC_DATA)
     if(NOT HAVE_SSL_PROVIDE_QUIC_DATA)
-        message(WARNING "OpenSSL in ${OPENSSL_LIBRARIES} does not have SSL_provide_quic_data.  HTTP/3 support cannot be enabled")
+      check_symbol_exists(SSL_set_quic_tls_cbs "openssl/ssl.h" HAVE_SSL_SET_QUIC_TLS_CBS)
+      if(NOT HAVE_SSL_SET_QUIC_TLS_CBS)
+        message(WARNING "OpenSSL in ${OPENSSL_LIBRARIES} has neither SSL_provide_quic_data nor SSL_set_quic_tls_cbs.  HTTP/3 support cannot be enabled")
+      endif()
     endif()
   endif()
   cmake_pop_check_state()
@@ -193,6 +199,22 @@ else()
   set(OPENSSL_INCLUDE_DIRS  "")
   set(OPENSSL_LIBRARIES     "")
 endif()
+# wolfSSL (for src)
+set(HAVE_WOLFSSL ${WOLFSSL_FOUND})
+if(WOLFSSL_FOUND)
+  set(WOLFSSL_INCLUDE_DIRS ${WOLFSSL_INCLUDE_DIR})
+  cmake_push_check_state()
+  set(CMAKE_REQUIRED_INCLUDES   "${WOLFSSL_INCLUDE_DIR}")
+  set(CMAKE_REQUIRED_LIBRARIES  "${WOLFSSL_LIBRARIES}")
+  check_symbol_exists(SSL_provide_quic_data "wolfssl/options.h;wolfssl/ssl.h" HAVE_WOLFSSL_SSL_PROVIDE_QUIC_DATA)
+  if(NOT HAVE_WOLFSSL_SSL_PROVIDE_QUIC_DATA)
+    message(WARNING "wolfSSL in ${WOLFSSL_LIBRARIES} does not have SSL_provide_quic_data.  HTTP/3 support cannot be enabled")
+  endif()
+  cmake_pop_check_state()
+else()
+  set(WOLFSSL_INCLUDE_DIRS "")
+  set(WOLFSSL_LIBRARIES    "")
+endif()
 # libev (for src)
 set(HAVE_LIBEV      ${LIBEV_FOUND})
 set(HAVE_ZLIB       ${ZLIB_FOUND})
@@ -245,13 +267,45 @@ int main() { enum bpf_stats_type foo; (void)foo; }" HAVE_BPF_STATS_TYPE)
 endif()
 
 # The nghttp, nghttpd and nghttpx under src depend on zlib, OpenSSL and libev
-if(ENABLE_APP AND NOT (ZLIB_FOUND AND OPENSSL_FOUND AND LIBEV_FOUND))
+if(ENABLE_APP AND NOT (ZLIB_FOUND AND (OPENSSL_FOUND OR WOLFSSL_FOUND) AND LIBEV_FOUND))
   message(FATAL_ERROR "Applications were requested (ENABLE_APP=1) but dependencies are not met.")
 endif()
 
-# HTTP/3 requires quictls/openssl, libngtcp2, libngtcp2_crypto_quictls
+if(ENABLE_HTTP3)
-# and libnghttp3.
+  if(HAVE_SSL_PROVIDE_QUIC_DATA AND NOT LIBRESSL_FOUND)
-if(ENABLE_HTTP3 AND NOT (HAVE_SSL_PROVIDE_QUIC_DATA AND LIBNGTCP2_FOUND AND LIBNGTCP2_CRYPTO_QUICTLS_FOUND AND LIBNGHTTP3_FOUND))
+    find_package(Libngtcp2_crypto_quictls 1.15.0)
+    if(LIBNGTCP2_CRYPTO_QUICTLS_FOUND)
+      set(HAVE_LIBNGTCP2_CRYPTO_QUICTLS 1)
+    endif()
+  elseif(HAVE_SSL_PROVIDE_QUIC_DATA AND LIBRESSL_FOUND)
+    find_package(Libngtcp2_crypto_libressl 1.15.0)
+    if(LIBNGTCP2_CRYPTO_LIBRESSL_FOUND)
+      set(HAVE_LIBNGTCP2_CRYPTO_LIBRESSL 1)
+    endif()
+  elseif(HAVE_WOLFSSL_SSL_PROVIDE_QUIC_DATA)
+    find_package(Libngtcp2_crypto_wolfssl 1.15.0)
+    if(LIBNGTCP2_CRYPTO_WOLFSSL_FOUND)
+      set(HAVE_LIBNGTCP2_CRYPTO_WOLFSSL 1)
+    endif()
+  elseif(HAVE_SSL_SET_QUIC_TLS_CBS)
+    find_package(Libngtcp2_crypto_ossl 1.15.0)
+    if(LIBNGTCP2_CRYPTO_OSSL_FOUND)
+      set(HAVE_LIBNGTCP2_CRYPTO_OSSL 1)
+    endif()
+  endif()
+endif()
+
+# HTTP/3 requires libngtcp2 + nghttp3 + one of:
+#
+# - quictls/openssl + libngtcp2_crypto_quictls
+# - libressl + libngtcp2_crypto_libressl
+# - wolfSSL + libngtcp2_crypto_wolfssl
+# - openssl/openssl + libngtcp2_crypto_ossl
+if(ENABLE_HTTP3 AND NOT (LIBNGTCP2_FOUND AND LIBNGHTTP3_FOUND AND
+      ((HAVE_SSL_PROVIDE_QUIC_DATA AND NOT LIBRESSL_FOUND AND LIBNGTCP2_CRYPTO_QUICTLS_FOUND) OR
+	(HAVE_SSL_PROVIDE_QUIC_DATA AND LIBRESSL_FOUND AND LIBNGTCP2_CRYPTO_LIBRESSL_FOUND) OR
+	(HAVE_WOLFSSL_SSL_PROVIDE_QUIC_DATA AND LIBNGTCP2_CRYPTO_WOLFSSL_FOUND) OR
+	(HAVE_SSL_SET_QUIC_TLS_CBS AND LIBNGTCP2_CRYPTO_OSSL_FOUND))))
   message(FATAL_ERROR "HTTP/3 was requested (ENABLE_HTTP3=1) but dependencies are not met.")
 endif()
 
@@ -326,8 +380,9 @@ check_function_exists(_Exit     HAVE__EXIT)
 check_function_exists(accept4   HAVE_ACCEPT4)
 check_function_exists(clock_gettime HAVE_CLOCK_GETTIME)
 check_function_exists(mkostemp  HAVE_MKOSTEMP)
+check_function_exists(pipe2     HAVE_PIPE2)
 
-check_symbol_exists(GetTickCount64 sysinfoapi.h HAVE_GETTICKCOUNT64)
+check_symbol_exists(GetTickCount64 "windows.h;sysinfoapi.h" HAVE_GETTICKCOUNT64)
 
 include(CheckSymbolExists)
 # XXX does this correctly detect initgroups (un)availability on cygwin?
@@ -444,7 +499,6 @@ if(ENABLE_DOC)
   add_subdirectory(doc)
 endif()
 add_subdirectory(contrib)
-add_subdirectory(script)
 add_subdirectory(bpf)
 
 
@@ -472,11 +526,14 @@ message(STATUS "summary of build options:
       Build Test:     ${BUILD_TESTING}
     Libs:
       OpenSSL:        ${HAVE_OPENSSL} (LIBS='${OPENSSL_LIBRARIES}')
+      wolfSSL:        ${HAVE_WOLFSSL} (LIBS='${WOLFSSL_LIBRARIES}')
       Libxml2:        ${HAVE_LIBXML2} (LIBS='${LIBXML2_LIBRARIES}')
       Libev:          ${HAVE_LIBEV} (LIBS='${LIBEV_LIBRARIES}')
       Libc-ares:      ${HAVE_LIBCARES} (LIBS='${LIBCARES_LIBRARIES}')
       Libngtcp2:      ${HAVE_LIBNGTCP2} (LIBS='${LIBNGTCP2_LIBRARIES}')
       Libngtcp2_crypto_quictls: ${HAVE_LIBNGTCP2_CRYPTO_QUICTLS} (LIBS='${LIBNGTCP2_CRYPTO_QUICTLS_LIBRARIES}')
+      Libngtcp2_crypto_libressl: ${HAVE_LIBNGTCP2_CRYPTO_LIBRESSL} (LIBS='${LIBNGTCP2_CRYPTO_LIBRESSL_LIBRARIES}')
+      Libngtcp2_crypto_wolfssl: ${HAVE_LIBNGTCP2_CRYPTO_WOLFSSL} (LIBS='${LIBNGTCP2_CRYPTO_WOLFSSL_LIBRARIES}')
       Libnghttp3:     ${HAVE_LIBNGHTTP3} (LIBS='${LIBNGHTTP3_LIBRARIES}')
       Libbpf:         ${HAVE_LIBBPF} (LIBS='${LIBBPF_LIBRARIES}')
       Libevent(SSL):  ${HAVE_LIBEVENT_OPENSSL} (LIBS='${LIBEVENT_OPENSSL_LIBRARIES}')

CMakeOptions.txt

@@ -25,5 +25,6 @@ option(WITH_JEMALLOC    "Use jemalloc"
 option(WITH_MRUBY       "Use mruby")
 option(WITH_NEVERBLEED  "Use neverbleed")
 option(WITH_LIBBPF      "Use libbpf")
+option(WITH_WOLFSSL     "Use wolfSSL")
 
 # vim: ft=cmake:

Dockerfile.android

@@ -12,21 +12,21 @@
 
 
 # Only use standalone-toolchain for reduce size
-FROM ubuntu:22.04
+FROM ubuntu:24.04
-MAINTAINER Tatsuhiro Tsujikawa
+LABEL org.opencontainers.image.authors="Tatsuhiro Tsujikawa"
 
-ENV NDK_VERSION r25b
+ARG NDK_VERSION=r27c
-ENV NDK /root/android-ndk-$NDK_VERSION
+ARG NDK=/root/android-ndk-$NDK_VERSION
-ENV TOOLCHAIN $NDK/toolchains/llvm/prebuilt/linux-x86_64
+ARG TOOLCHAIN=$NDK/toolchains/llvm/prebuilt/linux-x86_64
-ENV TARGET aarch64-linux-android
+ARG TARGET=aarch64-linux-android
-ENV API 33
+ARG API=33
-ENV AR $TOOLCHAIN/bin/llvm-ar
+ARG AR=$TOOLCHAIN/bin/llvm-ar
-ENV CC $TOOLCHAIN/bin/$TARGET$API-clang
+ARG CC=$TOOLCHAIN/bin/$TARGET$API-clang
-ENV CXX $TOOLCHAIN/bin/$TARGET$API-clang++
+ARG CXX=$TOOLCHAIN/bin/$TARGET$API-clang++
-ENV LD $TOOLCHAIN/bin/ld
+ARG LD=$TOOLCHAIN/bin/ld
-ENV RANDLIB $TOOLCHAIN/bin/llvm-ranlib
+ARG RANDLIB=$TOOLCHAIN/bin/llvm-ranlib
-ENV STRIP $TOOLCHAIN/bin/llvm-strip
+ARG STRIP=$TOOLCHAIN/bin/llvm-strip
-ENV PREFIX /root/usr/local
+ARG PREFIX=/root/usr/local
 
 WORKDIR /root
 RUN apt-get update && \
@@ -42,11 +42,11 @@ RUN curl -L -O https://dl.google.com/android/repository/android-ndk-$NDK_VERSION
    rm android-ndk-$NDK_VERSION-linux.zip
 
 # Setup version of libraries
-ENV OPENSSL_VERSION 1.1.1q
+ARG OPENSSL_VERSION=1.1.1w
-ENV LIBEV_VERSION 4.33
+ARG LIBEV_VERSION=4.33
-ENV ZLIB_VERSION 1.2.13
+ARG ZLIB_VERSION=1.3.1
-ENV CARES_VERSION 1.18.1
+ARG CARES_VERSION=1.18.1
-ENV NGHTTP2_VERSION master
+ARG NGHTTP2_VERSION=master
 
 WORKDIR /root/build
 RUN curl -L -O https://www.openssl.org/source/openssl-$OPENSSL_VERSION.tar.gz && \
@@ -65,6 +65,7 @@ RUN curl -L -O http://dist.schmorp.de/libev/Attic/libev-$LIBEV_VERSION.tar.gz &&
 
 WORKDIR /root/build/libev-$LIBEV_VERSION
 RUN ./configure \
+    --disable-dependency-tracking \
     --host=$TARGET \
     --build=`dpkg-architecture -qDEB_BUILD_GNU_TYPE` \
     --prefix=$PREFIX \
@@ -75,7 +76,7 @@ RUN ./configure \
     make install
 
 WORKDIR /root/build
-RUN curl -L -O https://zlib.net/zlib-$ZLIB_VERSION.tar.gz && \
+RUN curl -L -O https://github.com/madler/zlib/releases/download/v$ZLIB_VERSION/zlib-$ZLIB_VERSION.tar.gz && \
     tar xf zlib-$ZLIB_VERSION.tar.gz && \
     rm zlib-$ZLIB_VERSION.tar.gz
 
@@ -90,12 +91,13 @@ RUN HOST=$TARGET \
 
 
 WORKDIR /root/build
-RUN curl -L -O https://c-ares.haxx.se/download/c-ares-$CARES_VERSION.tar.gz && \
+RUN curl -L -O https://github.com/c-ares/c-ares/releases/download/cares-1_18_1/c-ares-$CARES_VERSION.tar.gz && \
     tar xf c-ares-$CARES_VERSION.tar.gz && \
     rm c-ares-$CARES_VERSION.tar.gz
 
 WORKDIR /root/build/c-ares-$CARES_VERSION
 RUN ./configure \
+      --disable-dependency-tracking \
       --host=$TARGET \
       --build=`dpkg-architecture -qDEB_BUILD_GNU_TYPE` \
       --prefix=$PREFIX \
@@ -103,10 +105,11 @@ RUN ./configure \
     make install
 
 WORKDIR /root/build
-RUN git clone https://github.com/nghttp2/nghttp2 -b $NGHTTP2_VERSION --depth 1
+RUN git clone --recursive --shallow-submodules https://github.com/nghttp2/nghttp2 -b $NGHTTP2_VERSION --depth 1
 WORKDIR /root/build/nghttp2
 RUN autoreconf -i && \
     ./configure \
+    --disable-dependency-tracking \
     --enable-app \
     --disable-shared \
     --host=$TARGET \
@@ -116,6 +119,6 @@ RUN autoreconf -i && \
     --disable-threads \
       CPPFLAGS="-fPIE -I$PREFIX/include" \
       PKG_CONFIG_LIBDIR="$PREFIX/lib/pkgconfig" \
-      LDFLAGS="-fPIE -pie -L$PREFIX/lib" && \
+      LDFLAGS="-static-libstdc++ -static-libgcc -fPIE -pie -L$PREFIX/lib" && \
     make && \
     $STRIP src/nghttpx src/nghttpd src/nghttp

Makefile.am

@@ -20,8 +20,8 @@
 # LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
 # OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
 # WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-SUBDIRS = lib third-party src bpf examples tests integration-tests \
+SUBDIRS = lib tests third-party src bpf examples integration-tests \
-	doc contrib script
+	doc contrib
 
 ACLOCAL_AMFLAGS = -I m4
 
@@ -46,6 +46,9 @@ EXTRA_DIST = nghttpx.conf.sample proxy.pac.sample android-config android-env \
 	cmake/FindLibngtcp2_crypto_quictls.cmake \
 	cmake/FindLibbrotlienc.cmake \
 	cmake/FindLibbrotlidec.cmake \
+	cmake/FindLibngtcp2_crypto_wolfssl.cmake \
+	cmake/FindLibngtcp2_crypto_ossl.cmake \
+	cmake/FindWolfSSL.cmake \
 	cmake/PickyWarningsC.cmake \
 	cmake/PickyWarningsCXX.cmake
 

README.rst

@@ -31,9 +31,8 @@ implementation.
 
 * https://nghttp2.org/ (TLS + ALPN and HTTP/3)
 
-  This endpoint supports ``h2``, ``h2-16``, ``h2-14``, and
+  This endpoint supports ``h2`` and ``http/1.1`` via ALPN and requires
-  ``http/1.1`` via ALPN and requires TLSv1.2 for HTTP/2
+  TLSv1.2 for HTTP/2 connection.
-  connection.
 
   It also supports HTTP/3.
 
@@ -61,8 +60,8 @@ To build and run the application programs (``nghttp``, ``nghttpd``,
 ``nghttpx`` and ``h2load``) in the ``src`` directory, the following packages
 are required:
 
-* OpenSSL >= 1.1.1; or LibreSSL >= 3.8.1; or aws-lc >= 1.19.0; or
+* OpenSSL >= 1.1.1; or wolfSSL >= 5.7.0; or LibreSSL >= 3.8.1; or
-  BoringSSL
+  aws-lc >= 1.19.0; or BoringSSL
 * libev >= 4.11
 * zlib >= 1.2.3
 * libc-ares >= 1.7.5
@@ -123,13 +122,13 @@ exploited.  The neverbleed is disabled by default.  To enable it, use
 To enable the experimental HTTP/3 support for h2load and nghttpx, the
 following libraries are required:
 
-* `OpenSSL with QUIC support
+* `quictls
   <https://github.com/quictls/openssl/tree/OpenSSL_1_1_1w+quic>`_; or
-  LibreSSL (does not support 0RTT); or aws-lc; or
+  wolfSSL; or LibreSSL (does not support 0RTT); or aws-lc; or
   `BoringSSL <https://boringssl.googlesource.com/boringssl/>`_ (commit
-  6ab7c1482bf4cdc91c87bc512aaf68ffb18975ec)
+  db1a8456167249f95b854a1cd24c6b553d0f1567); or OpenSSL >= 3.5.0
-* `ngtcp2 <https://github.com/ngtcp2/ngtcp2>`_ >= 1.4.0
+* `ngtcp2 <https://github.com/ngtcp2/ngtcp2>`_ >= 1.16.0
-* `nghttp3 <https://github.com/ngtcp2/nghttp3>`_ >= 1.1.0
+* `nghttp3 <https://github.com/ngtcp2/nghttp3>`_ >= 1.12.0
 
 Use ``--enable-http3`` configure option to enable HTTP/3 feature for
 h2load and nghttpx.
@@ -144,14 +143,14 @@ Use ``--with-libbpf`` configure option to build eBPF program.
 libelf-dev is needed to build libbpf.
 
 For Ubuntu 20.04, you can build libbpf from `the source code
-<https://github.com/libbpf/libbpf/releases/tag/v1.3.0>`_.  nghttpx
+<https://github.com/libbpf/libbpf/releases>`_.  nghttpx requires eBPF
-requires eBPF program for reloading its configuration and hot swapping
+program for reloading its configuration and hot swapping its
-its executable.
+executable.
 
 Compiling libnghttp2 C source code requires a C99 compiler.  gcc 4.8
 is known to be adequate.  In order to compile the C++ source code,
-C++20 compliant compiler is required.  At least g++ >= 1.12 and
+C++20 compliant compiler is required.  At least g++ >= 12 and
-clang++ >= 1.15 are known to work.
+clang++ >= 18 are known to work.
 
 .. note::
 
@@ -341,7 +340,7 @@ Build aws-lc:
 
 .. code-block:: text
 
-   $ git clone --depth 1 -b v1.26.0 https://github.com/aws/aws-lc
+   $ git clone --depth 1 -b v1.62.0 https://github.com/aws/aws-lc
    $ cd aws-lc
    $ cmake -B build -DDISABLE_GO=ON --install-prefix=$PWD/opt
    $ make -j$(nproc) -C build
@@ -352,7 +351,7 @@ Build nghttp3:
 
 .. code-block:: text
 
-   $ git clone --depth 1 -b v1.3.0 https://github.com/ngtcp2/nghttp3
+   $ git clone --depth 1 -b v1.12.0 https://github.com/ngtcp2/nghttp3
    $ cd nghttp3
    $ git submodule update --init --depth 1
    $ autoreconf -i
@@ -365,7 +364,7 @@ Build ngtcp2:
 
 .. code-block:: text
 
-   $ git clone --depth 1 -b v1.5.0 https://github.com/ngtcp2/ngtcp2
+   $ git clone --depth 1 -b v1.17.0 https://github.com/ngtcp2/ngtcp2
    $ cd ngtcp2
    $ git submodule update --init --depth 1
    $ autoreconf -i
@@ -381,7 +380,7 @@ from source:
 
 .. code-block:: text
 
-   $ git clone --depth 1 -b v1.3.0 https://github.com/libbpf/libbpf
+   $ git clone --depth 1 -b v1.6.2 https://github.com/libbpf/libbpf
    $ cd libbpf
    $ PREFIX=$PWD/build make -C src install
    $ cd ..
@@ -395,7 +394,7 @@ Build nghttp2:
    $ git submodule update --init
    $ autoreconf -i
    $ ./configure --with-mruby --enable-http3 --with-libbpf \
-         CC=clang-15 CXX=clang++-15 \
+         CC=clang-19 CXX=clang++-19 \
          PKG_CONFIG_PATH="$PWD/../aws-lc/opt/lib/pkgconfig:$PWD/../nghttp3/build/lib/pkgconfig:$PWD/../ngtcp2/build/lib/pkgconfig:$PWD/../libbpf/build/lib64/pkgconfig" \
          LDFLAGS="$LDFLAGS -Wl,-rpath,$PWD/../aws-lc/opt/lib -Wl,-rpath,$PWD/../libbpf/build/lib64"
    $ make -j$(nproc)
@@ -847,10 +846,10 @@ to know how to migrate from earlier releases.
 
 ``nghttpx`` implements `important performance-oriented features
 <https://istlsfastyet.com/#server-performance>`_ in TLS, such as
-session IDs, session tickets (with automatic key rotation), OCSP
+session IDs, session tickets (with automatic key rotation), dynamic
-stapling, dynamic record sizing, ALPN, forward secrecy and HTTP/2.
+record sizing, ALPN, forward secrecy and HTTP/2.  ``nghttpx`` also
-``nghttpx`` also offers the functionality to share session cache and
+offers the functionality to share ticket keys among multiple
-ticket keys among multiple ``nghttpx`` instances via memcached.
+``nghttpx`` instances via memcached.
 
 ``nghttpx`` has 2 operation modes:
 

bpf/reuseport_kern.c

@@ -63,28 +63,26 @@ typedef __u8 state_t[4][4];
    dynamically trading ROM for RAM - This can be useful in (embedded)
    bootloader applications, where ROM is often limited. */
 static const __u8 rsbox[256] = {
-    0x52, 0x09, 0x6a, 0xd5, 0x30, 0x36, 0xa5, 0x38, 0xbf, 0x40, 0xa3, 0x9e,
+  0x52, 0x09, 0x6a, 0xd5, 0x30, 0x36, 0xa5, 0x38, 0xbf, 0x40, 0xa3, 0x9e, 0x81,
-    0x81, 0xf3, 0xd7, 0xfb, 0x7c, 0xe3, 0x39, 0x82, 0x9b, 0x2f, 0xff, 0x87,
+  0xf3, 0xd7, 0xfb, 0x7c, 0xe3, 0x39, 0x82, 0x9b, 0x2f, 0xff, 0x87, 0x34, 0x8e,
-    0x34, 0x8e, 0x43, 0x44, 0xc4, 0xde, 0xe9, 0xcb, 0x54, 0x7b, 0x94, 0x32,
+  0x43, 0x44, 0xc4, 0xde, 0xe9, 0xcb, 0x54, 0x7b, 0x94, 0x32, 0xa6, 0xc2, 0x23,
-    0xa6, 0xc2, 0x23, 0x3d, 0xee, 0x4c, 0x95, 0x0b, 0x42, 0xfa, 0xc3, 0x4e,
+  0x3d, 0xee, 0x4c, 0x95, 0x0b, 0x42, 0xfa, 0xc3, 0x4e, 0x08, 0x2e, 0xa1, 0x66,
-    0x08, 0x2e, 0xa1, 0x66, 0x28, 0xd9, 0x24, 0xb2, 0x76, 0x5b, 0xa2, 0x49,
+  0x28, 0xd9, 0x24, 0xb2, 0x76, 0x5b, 0xa2, 0x49, 0x6d, 0x8b, 0xd1, 0x25, 0x72,
-    0x6d, 0x8b, 0xd1, 0x25, 0x72, 0xf8, 0xf6, 0x64, 0x86, 0x68, 0x98, 0x16,
+  0xf8, 0xf6, 0x64, 0x86, 0x68, 0x98, 0x16, 0xd4, 0xa4, 0x5c, 0xcc, 0x5d, 0x65,
-    0xd4, 0xa4, 0x5c, 0xcc, 0x5d, 0x65, 0xb6, 0x92, 0x6c, 0x70, 0x48, 0x50,
+  0xb6, 0x92, 0x6c, 0x70, 0x48, 0x50, 0xfd, 0xed, 0xb9, 0xda, 0x5e, 0x15, 0x46,
-    0xfd, 0xed, 0xb9, 0xda, 0x5e, 0x15, 0x46, 0x57, 0xa7, 0x8d, 0x9d, 0x84,
+  0x57, 0xa7, 0x8d, 0x9d, 0x84, 0x90, 0xd8, 0xab, 0x00, 0x8c, 0xbc, 0xd3, 0x0a,
-    0x90, 0xd8, 0xab, 0x00, 0x8c, 0xbc, 0xd3, 0x0a, 0xf7, 0xe4, 0x58, 0x05,
+  0xf7, 0xe4, 0x58, 0x05, 0xb8, 0xb3, 0x45, 0x06, 0xd0, 0x2c, 0x1e, 0x8f, 0xca,
-    0xb8, 0xb3, 0x45, 0x06, 0xd0, 0x2c, 0x1e, 0x8f, 0xca, 0x3f, 0x0f, 0x02,
+  0x3f, 0x0f, 0x02, 0xc1, 0xaf, 0xbd, 0x03, 0x01, 0x13, 0x8a, 0x6b, 0x3a, 0x91,
-    0xc1, 0xaf, 0xbd, 0x03, 0x01, 0x13, 0x8a, 0x6b, 0x3a, 0x91, 0x11, 0x41,
+  0x11, 0x41, 0x4f, 0x67, 0xdc, 0xea, 0x97, 0xf2, 0xcf, 0xce, 0xf0, 0xb4, 0xe6,
-    0x4f, 0x67, 0xdc, 0xea, 0x97, 0xf2, 0xcf, 0xce, 0xf0, 0xb4, 0xe6, 0x73,
+  0x73, 0x96, 0xac, 0x74, 0x22, 0xe7, 0xad, 0x35, 0x85, 0xe2, 0xf9, 0x37, 0xe8,
-    0x96, 0xac, 0x74, 0x22, 0xe7, 0xad, 0x35, 0x85, 0xe2, 0xf9, 0x37, 0xe8,
+  0x1c, 0x75, 0xdf, 0x6e, 0x47, 0xf1, 0x1a, 0x71, 0x1d, 0x29, 0xc5, 0x89, 0x6f,
-    0x1c, 0x75, 0xdf, 0x6e, 0x47, 0xf1, 0x1a, 0x71, 0x1d, 0x29, 0xc5, 0x89,
+  0xb7, 0x62, 0x0e, 0xaa, 0x18, 0xbe, 0x1b, 0xfc, 0x56, 0x3e, 0x4b, 0xc6, 0xd2,
-    0x6f, 0xb7, 0x62, 0x0e, 0xaa, 0x18, 0xbe, 0x1b, 0xfc, 0x56, 0x3e, 0x4b,
+  0x79, 0x20, 0x9a, 0xdb, 0xc0, 0xfe, 0x78, 0xcd, 0x5a, 0xf4, 0x1f, 0xdd, 0xa8,
-    0xc6, 0xd2, 0x79, 0x20, 0x9a, 0xdb, 0xc0, 0xfe, 0x78, 0xcd, 0x5a, 0xf4,
+  0x33, 0x88, 0x07, 0xc7, 0x31, 0xb1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xec, 0x5f,
-    0x1f, 0xdd, 0xa8, 0x33, 0x88, 0x07, 0xc7, 0x31, 0xb1, 0x12, 0x10, 0x59,
+  0x60, 0x51, 0x7f, 0xa9, 0x19, 0xb5, 0x4a, 0x0d, 0x2d, 0xe5, 0x7a, 0x9f, 0x93,
-    0x27, 0x80, 0xec, 0x5f, 0x60, 0x51, 0x7f, 0xa9, 0x19, 0xb5, 0x4a, 0x0d,
+  0xc9, 0x9c, 0xef, 0xa0, 0xe0, 0x3b, 0x4d, 0xae, 0x2a, 0xf5, 0xb0, 0xc8, 0xeb,
-    0x2d, 0xe5, 0x7a, 0x9f, 0x93, 0xc9, 0x9c, 0xef, 0xa0, 0xe0, 0x3b, 0x4d,
+  0xbb, 0x3c, 0x83, 0x53, 0x99, 0x61, 0x17, 0x2b, 0x04, 0x7e, 0xba, 0x77, 0xd6,
-    0xae, 0x2a, 0xf5, 0xb0, 0xc8, 0xeb, 0xbb, 0x3c, 0x83, 0x53, 0x99, 0x61,
+  0x26, 0xe1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0c, 0x7d};
-    0x17, 0x2b, 0x04, 0x7e, 0xba, 0x77, 0xd6, 0x26, 0xe1, 0x69, 0x14, 0x63,
-    0x55, 0x21, 0x0c, 0x7d};
 
 /* This function adds the round key to state.  The round key is added
    to the state by an XOR function. */

cmake/FindLibcares.cmake

@@ -17,12 +17,18 @@ find_library(LIBCARES_LIBRARY
 )
 
 if(LIBCARES_INCLUDE_DIR)
-  set(_version_regex "^#define[ \t]+ARES_VERSION_STR[ \t]+\"([^\"]+)\".*")
+  file(READ "${LIBCARES_INCLUDE_DIR}/ares_version.h" _ares_version_h)
-  file(STRINGS "${LIBCARES_INCLUDE_DIR}/ares_version.h"
+  string(REGEX REPLACE ".*#define[ \t]+ARES_VERSION_MAJOR[ \t]+([0-9]+).*" "\\1"
-    LIBCARES_VERSION REGEX "${_version_regex}")
+    _ares_version_major ${_ares_version_h})
-  string(REGEX REPLACE "${_version_regex}" "\\1"
+  string(REGEX REPLACE ".*#define[ \t]+ARES_VERSION_MINOR[ \t]+([0-9]+).*" "\\1"
-    LIBCARES_VERSION "${LIBCARES_VERSION}")
+    _ares_version_minor ${_ares_version_h})
-  unset(_version_regex)
+  string(REGEX REPLACE ".*#define[ \t]+ARES_VERSION_PATCH[ \t]+([0-9]+).*" "\\1"
+    _ares_version_patch ${_ares_version_h})
+  set(LIBCARES_VERSION "${_ares_version_major}.${_ares_version_minor}.${_ares_version_patch}")
+  unset(_ares_version_patch)
+  unset(_ares_version_minor)
+  unset(_ares_version_major)
+  unset(_ares_version_h)
 endif()
 
 include(FindPackageHandleStandardArgs)

cmake/FindLibngtcp2_crypto_libressl.cmake

@@ -0,0 +1,43 @@
+# - Try to find libngtcp2_crypto_libressl
+# Once done this will define
+#  LIBNGTCP2_CRYPTO_LIBRESSL_FOUND        - System has libngtcp2_crypto_libressl
+#  LIBNGTCP2_CRYPTO_LIBRESSL_INCLUDE_DIRS - The libngtcp2_crypto_libressl include directories
+#  LIBNGTCP2_CRYPTO_LIBRESSL_LIBRARIES    - The libraries needed to use libngtcp2_crypto_libressl
+
+find_package(PkgConfig QUIET)
+pkg_check_modules(PC_LIBNGTCP2_CRYPTO_LIBRESSL QUIET libngtcp2_crypto_libressl)
+
+find_path(LIBNGTCP2_CRYPTO_LIBRESSL_INCLUDE_DIR
+  NAMES ngtcp2/ngtcp2_crypto_quictls.h
+  HINTS ${PC_LIBNGTCP2_CRYPTO_LIBRESSL_INCLUDE_DIRS}
+)
+find_library(LIBNGTCP2_CRYPTO_LIBRESSL_LIBRARY
+  NAMES ngtcp2_crypto_libressl
+  HINTS ${PC_LIBNGTCP2_CRYPTO_LIBRESSL_LIBRARY_DIRS}
+)
+
+if(LIBNGTCP2_CRYPTO_LIBRESSL_INCLUDE_DIR)
+  set(_version_regex "^#define[ \t]+NGTCP2_VERSION[ \t]+\"([^\"]+)\".*")
+  file(STRINGS "${LIBNGTCP2_CRYPTO_LIBRESSL_INCLUDE_DIR}/ngtcp2/version.h"
+    LIBNGTCP2_CRYPTO_LIBRESSL_VERSION REGEX "${_version_regex}")
+  string(REGEX REPLACE "${_version_regex}" "\\1"
+    LIBNGTCP2_CRYPTO_LIBRESSL_VERSION "${LIBNGTCP2_CRYPTO_LIBRESSL_VERSION}")
+  unset(_version_regex)
+endif()
+
+include(FindPackageHandleStandardArgs)
+# handle the QUIETLY and REQUIRED arguments and set
+# LIBNGTCP2_CRYPTO_LIBRESSL_FOUND to TRUE if all listed variables are
+# TRUE and the requested version matches.
+find_package_handle_standard_args(Libngtcp2_crypto_libressl REQUIRED_VARS
+                                  LIBNGTCP2_CRYPTO_LIBRESSL_LIBRARY
+                                  LIBNGTCP2_CRYPTO_LIBRESSL_INCLUDE_DIR
+                                  VERSION_VAR LIBNGTCP2_CRYPTO_LIBRESSL_VERSION)
+
+if(LIBNGTCP2_CRYPTO_LIBRESSL_FOUND)
+  set(LIBNGTCP2_CRYPTO_LIBRESSL_LIBRARIES ${LIBNGTCP2_CRYPTO_LIBRESSL_LIBRARY})
+  set(LIBNGTCP2_CRYPTO_LIBRESSL_INCLUDE_DIRS ${LIBNGTCP2_CRYPTO_LIBRESSL_INCLUDE_DIR})
+endif()
+
+mark_as_advanced(LIBNGTCP2_CRYPTO_LIBRESSL_INCLUDE_DIR
+                 LIBNGTCP2_CRYPTO_LIBRESSL_LIBRARY)

cmake/FindLibngtcp2_crypto_ossl.cmake

@@ -0,0 +1,43 @@
+# - Try to find libngtcp2_crypto_ossl
+# Once done this will define
+#  LIBNGTCP2_CRYPTO_OSSL_FOUND        - System has libngtcp2_crypto_ossl
+#  LIBNGTCP2_CRYPTO_OSSL_INCLUDE_DIRS - The libngtcp2_crypto_ossl include directories
+#  LIBNGTCP2_CRYPTO_OSSL_LIBRARIES    - The libraries needed to use libngtcp2_crypto_ossl
+
+find_package(PkgConfig QUIET)
+pkg_check_modules(PC_LIBNGTCP2_CRYPTO_OSSL QUIET libngtcp2_crypto_ossl)
+
+find_path(LIBNGTCP2_CRYPTO_OSSL_INCLUDE_DIR
+  NAMES ngtcp2/ngtcp2_crypto_ossl.h
+  HINTS ${PC_LIBNGTCP2_CRYPTO_OSSL_INCLUDE_DIRS}
+)
+find_library(LIBNGTCP2_CRYPTO_OSSL_LIBRARY
+  NAMES ngtcp2_crypto_ossl
+  HINTS ${PC_LIBNGTCP2_CRYPTO_OSSL_LIBRARY_DIRS}
+)
+
+if(LIBNGTCP2_CRYPTO_OSSL_INCLUDE_DIR)
+  set(_version_regex "^#define[ \t]+NGTCP2_VERSION[ \t]+\"([^\"]+)\".*")
+  file(STRINGS "${LIBNGTCP2_CRYPTO_OSSL_INCLUDE_DIR}/ngtcp2/version.h"
+    LIBNGTCP2_CRYPTO_OSSL_VERSION REGEX "${_version_regex}")
+  string(REGEX REPLACE "${_version_regex}" "\\1"
+    LIBNGTCP2_CRYPTO_OSSL_VERSION "${LIBNGTCP2_CRYPTO_OSSL_VERSION}")
+  unset(_version_regex)
+endif()
+
+include(FindPackageHandleStandardArgs)
+# handle the QUIETLY and REQUIRED arguments and set
+# LIBNGTCP2_CRYPTO_OSSL_FOUND to TRUE if all listed variables are
+# TRUE and the requested version matches.
+find_package_handle_standard_args(Libngtcp2_crypto_ossl REQUIRED_VARS
+                                  LIBNGTCP2_CRYPTO_OSSL_LIBRARY
+                                  LIBNGTCP2_CRYPTO_OSSL_INCLUDE_DIR
+                                  VERSION_VAR LIBNGTCP2_CRYPTO_OSSL_VERSION)
+
+if(LIBNGTCP2_CRYPTO_OSSL_FOUND)
+  set(LIBNGTCP2_CRYPTO_OSSL_LIBRARIES ${LIBNGTCP2_CRYPTO_OSSL_LIBRARY})
+  set(LIBNGTCP2_CRYPTO_OSSL_INCLUDE_DIRS ${LIBNGTCP2_CRYPTO_OSSL_INCLUDE_DIR})
+endif()
+
+mark_as_advanced(LIBNGTCP2_CRYPTO_OSSL_INCLUDE_DIR
+                 LIBNGTCP2_CRYPTO_OSSL_LIBRARY)

cmake/FindLibngtcp2_crypto_wolfssl.cmake

@@ -0,0 +1,43 @@
+# - Try to find libngtcp2_crypto_wolfssl
+# Once done this will define
+#  LIBNGTCP2_CRYPTO_WOLFSSL_FOUND        - System has libngtcp2_crypto_wolfssl
+#  LIBNGTCP2_CRYPTO_WOLFSSL_INCLUDE_DIRS - The libngtcp2_crypto_wolfssl include directories
+#  LIBNGTCP2_CRYPTO_WOLFSSL_LIBRARIES    - The libraries needed to use libngtcp2_crypto_wolfssl
+
+find_package(PkgConfig QUIET)
+pkg_check_modules(PC_LIBNGTCP2_CRYPTO_WOLFSSL QUIET libngtcp2_crypto_wolfssl)
+
+find_path(LIBNGTCP2_CRYPTO_WOLFSSL_INCLUDE_DIR
+  NAMES ngtcp2/ngtcp2_crypto_wolfssl.h
+  HINTS ${PC_LIBNGTCP2_CRYPTO_WOLFSSL_INCLUDE_DIRS}
+)
+find_library(LIBNGTCP2_CRYPTO_WOLFSSL_LIBRARY
+  NAMES ngtcp2_crypto_wolfssl
+  HINTS ${PC_LIBNGTCP2_CRYPTO_WOLFSSL_LIBRARY_DIRS}
+)
+
+if(LIBNGTCP2_CRYPTO_WOLFSSL_INCLUDE_DIR)
+  set(_version_regex "^#define[ \t]+NGTCP2_VERSION[ \t]+\"([^\"]+)\".*")
+  file(STRINGS "${LIBNGTCP2_CRYPTO_WOLFSSL_INCLUDE_DIR}/ngtcp2/version.h"
+    LIBNGTCP2_CRYPTO_WOLFSSL_VERSION REGEX "${_version_regex}")
+  string(REGEX REPLACE "${_version_regex}" "\\1"
+    LIBNGTCP2_CRYPTO_WOLFSSL_VERSION "${LIBNGTCP2_CRYPTO_WOLFSSL_VERSION}")
+  unset(_version_regex)
+endif()
+
+include(FindPackageHandleStandardArgs)
+# handle the QUIETLY and REQUIRED arguments and set
+# LIBNGTCP2_CRYPTO_WOLFSSL_FOUND to TRUE if all listed variables are
+# TRUE and the requested version matches.
+find_package_handle_standard_args(Libngtcp2_crypto_wolfssl REQUIRED_VARS
+                                  LIBNGTCP2_CRYPTO_WOLFSSL_LIBRARY
+                                  LIBNGTCP2_CRYPTO_WOLFSSL_INCLUDE_DIR
+                                  VERSION_VAR LIBNGTCP2_CRYPTO_WOLFSSL_VERSION)
+
+if(LIBNGTCP2_CRYPTO_WOLFSSL_FOUND)
+  set(LIBNGTCP2_CRYPTO_WOLFSSL_LIBRARIES ${LIBNGTCP2_CRYPTO_WOLFSSL_LIBRARY})
+  set(LIBNGTCP2_CRYPTO_WOLFSSL_INCLUDE_DIRS ${LIBNGTCP2_CRYPTO_WOLFSSL_INCLUDE_DIR})
+endif()
+
+mark_as_advanced(LIBNGTCP2_CRYPTO_WOLFSSL_INCLUDE_DIR
+                 LIBNGTCP2_CRYPTO_WOLFSSL_LIBRARY)

cmake/FindWolfSSL.cmake

@@ -0,0 +1,41 @@
+# - Try to find wolfssl
+# Once done this will define
+#  WOLFSSL_FOUND        - System has wolfssl
+#  WOLFSSL_INCLUDE_DIRS - The wolfssl include directories
+#  WOLFSSL_LIBRARIES    - The libraries needed to use wolfssl
+
+find_package(PkgConfig QUIET)
+pkg_check_modules(PC_WOLFSSL QUIET wolfssl)
+
+find_path(WOLFSSL_INCLUDE_DIR
+  NAMES wolfssl/ssl.h
+  HINTS ${PC_WOLFSSL_INCLUDE_DIRS}
+)
+find_library(WOLFSSL_LIBRARY
+  NAMES wolfssl
+  HINTS ${PC_WOLFSSL_LIBRARY_DIRS}
+)
+
+if(WOLFSSL_INCLUDE_DIR)
+  set(_version_regex "^#define[ \t]+LIBWOLFSSL_VERSION_STRING[ \t]+\"([^\"]+)\".*")
+  file(STRINGS "${WOLFSSL_INCLUDE_DIR}/wolfssl/version.h"
+    WOLFSSL_VERSION REGEX "${_version_regex}")
+  string(REGEX REPLACE "${_version_regex}" "\\1"
+    WOLFSSL_VERSION "${WOLFSSL_VERSION}")
+  unset(_version_regex)
+endif()
+
+include(FindPackageHandleStandardArgs)
+# handle the QUIETLY and REQUIRED arguments and set WOLFSSL_FOUND
+# to TRUE if all listed variables are TRUE and the requested version
+# matches.
+find_package_handle_standard_args(WolfSSL REQUIRED_VARS
+                                  WOLFSSL_LIBRARY WOLFSSL_INCLUDE_DIR
+                                  VERSION_VAR WOLFSSL_VERSION)
+
+if(WOLFSSL_FOUND)
+  set(WOLFSSL_LIBRARIES     ${WOLFSSL_LIBRARY})
+  set(WOLFSSL_INCLUDE_DIRS  ${WOLFSSL_INCLUDE_DIR})
+endif()
+
+mark_as_advanced(WOLFSSL_INCLUDE_DIR WOLFSSL_LIBRARY)

cmake/PickyWarningsCXX.cmake

@@ -58,6 +58,10 @@ if(CMAKE_COMPILER_IS_GNUCC OR CMAKE_COMPILER_IS_GNUCXX OR CMAKE_CXX_COMPILER_ID
     list(APPEND WPICKY_ENABLE
       ${WPICKY_COMMON_OLD}
     )
+    list(APPEND WPICKY_ENABLE
+      # clang++-18 warns this when building with wolfSSL >= v5.7.6-stable.
+      -Wno-extern-c-compat
+    )
     # Enable based on compiler version
     if((CMAKE_CXX_COMPILER_ID STREQUAL "Clang"      AND NOT CMAKE_CXX_COMPILER_VERSION VERSION_LESS 3.6) OR
        (CMAKE_CXX_COMPILER_ID STREQUAL "AppleClang" AND NOT CMAKE_CXX_COMPILER_VERSION VERSION_LESS 6.3))

cmakeconfig.h.in

@@ -4,8 +4,8 @@
 /* Define to `int' if <sys/types.h> does not define. */
 #cmakedefine ssize_t @ssize_t@
 
-/* Define to 1 if you have the `std::map::emplace`. */
+/* Define to 1 if you have the `std::chrono::time_zone`. */
-#cmakedefine HAVE_STD_MAP_EMPLACE 1
+#cmakedefine HAVE_STD_CHRONO_TIME_ZONE 1
 
 /* Define to 1 if you have `libjansson` library. */
 #cmakedefine HAVE_JANSSON 1
@@ -31,6 +31,9 @@
 /* Define to 1 if you have the `mkostemp` function. */
 #cmakedefine HAVE_MKOSTEMP 1
 
+/* Define to 1 if you have the `pipe2` function. */
+#cmakedefine HAVE_PIPE2 1
+
 /* Define to 1 if you have the `GetTickCount64` function. */
 #cmakedefine HAVE_GETTICKCOUNT64 1
 
@@ -97,8 +100,17 @@
 /* Define to 1 if you have `libngtcp2_crypto_quictls` library. */
 #cmakedefine HAVE_LIBNGTCP2_CRYPTO_QUICTLS
 
+/* Define to 1 if you have `libngtcp2_crypto_libressl` library. */
+#cmakedefine HAVE_LIBNGTCP2_CRYPTO_LIBRESSL
+
+/* Define to 1 if you have `libngtcp2_crypto_wolfssl` library. */
+#cmakedefine HAVE_LIBNGTCP2_CRYPTO_WOLFSSL 1
+
 /* Define to 1 if you have `libev` library. */
 #cmakedefine HAVE_LIBEV 1
 
 /* Define to 1 if you have `libbrotlienc` and `libbrotlidec` libraries. */
 #cmakedefine HAVE_LIBBROTLI 1
+
+/* Define to 1 if you have `wolfssl` library. */
+#cmakedefine HAVE_WOLFSSL 1

configure.ac

@@ -25,7 +25,7 @@ dnl Do not change user variables!
 dnl https://www.gnu.org/software/automake/manual/html_node/Flag-Variables-Ordering.html
 
 AC_PREREQ(2.61)
-AC_INIT([nghttp2], [1.62.1], [t-tujikawa@users.sourceforge.net])
+AC_INIT([nghttp2], [1.68.1], [t-tujikawa@users.sourceforge.net])
 AC_CONFIG_AUX_DIR([.])
 AC_CONFIG_MACRO_DIR([m4])
 AC_CONFIG_HEADERS([config.h])
@@ -44,9 +44,9 @@ m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])
 
 dnl See versioning rule:
 dnl  https://www.gnu.org/software/libtool/manual/html_node/Updating-version-info.html
-AC_SUBST(LT_CURRENT, 42)
+AC_SUBST(LT_CURRENT, 43)
-AC_SUBST(LT_REVISION, 1)
+AC_SUBST(LT_REVISION, 3)
-AC_SUBST(LT_AGE, 28)
+AC_SUBST(LT_AGE, 29)
 
 major=`echo $PACKAGE_VERSION |cut -d. -f1 | sed -e "s/[^0-9]//g"`
 minor=`echo $PACKAGE_VERSION |cut -d. -f2 | sed -e "s/[^0-9]//g"`
@@ -127,6 +127,11 @@ AC_ARG_WITH([libcares],
                     [Use libc-ares [default=check]])],
     [request_libcares=$withval], [request_libcares=check])
 
+AC_ARG_WITH([wolfssl],
+    [AS_HELP_STRING([--with-wolfssl],
+                    [Use wolfSSL [default=check]])],
+    [request_wolfssl=$withval], [request_wolfssl=check])
+
 AC_ARG_WITH([openssl],
     [AS_HELP_STRING([--with-openssl],
                     [Use openssl [default=check]])],
@@ -267,22 +272,6 @@ std::vector<std::future<int>> v;
     [have_std_future=no
      AC_MSG_RESULT([no])])
 
-# Check that std::map::emplace is available for g++-4.7.
-AC_MSG_CHECKING([whether std::map::emplace is available])
-AC_COMPILE_IFELSE([AC_LANG_PROGRAM(
-[[
-#include <map>
-]],
-[[
-std::map<int, int>().emplace(1, 2);
-]])],
-    [AC_DEFINE([HAVE_STD_MAP_EMPLACE], [1],
-               [Define to 1 if you have the `std::map::emplace`.])
-     have_std_map_emplace=yes
-     AC_MSG_RESULT([yes])],
-    [have_std_map_emplace=no
-     AC_MSG_RESULT([no])])
-
 # Check that std::atomic<std::shared_ptr<T>> is supported.
 AC_MSG_CHECKING([whether std::atomic<std::shared_ptr<T>> is supported])
 AC_COMPILE_IFELSE([AC_LANG_PROGRAM(
@@ -302,19 +291,21 @@ a.store(p);
     [have_atomic_std_shared_ptr=no
      AC_MSG_RESULT([no])])
 
-# Check that thread_local storage specifier is available
+# Check that std::chrono::time_zone is available.
-AC_MSG_CHECKING([whether thread_local storage class specifier is available.])
+AC_MSG_CHECKING([whether std::chrono::time_zone is available])
 AC_COMPILE_IFELSE([AC_LANG_PROGRAM(
-,
 [[
-thread_local int a = 0;
+#include <chrono>
-(void)a;
+]],
+[[
+auto tz = std::chrono::current_zone();
+(void)tz;
 ]])],
-    [AC_DEFINE([HAVE_THREAD_LOCAL], [1],
+    [AC_DEFINE([HAVE_STD_CHRONO_TIME_ZONE], [1],
-               [Define to 1 if you have thread_local storage specifier.])
+               [Define to 1 if you have the `std::chrono::time_zone`.])
-     have_thread_local=yes
+     have_std_chrono_time_zone=yes
      AC_MSG_RESULT([yes])],
-    [have_Thread_local=no
+    [have_std_chrono_time_zone=no
      AC_MSG_RESULT([no])])
 
 CXXFLAGS=$save_CXXFLAGS
@@ -333,7 +324,7 @@ case "$host_os" in
   *android*)
     android_build=yes
     # android does not need -pthread, but needs following 2 libs for C++
-    APPLDFLAGS="$APPLDFLAGS -lstdc++ -latomic"
+    APPLDFLAGS="$APPLDFLAGS -latomic"
     ;;
   *)
     PTHREAD_LDFLAGS="-pthread"
@@ -411,9 +402,15 @@ if test "x${request_libev}" = "xyes" &&
   AC_MSG_ERROR([libev was requested (--with-libev) but not found])
 fi
 
+if test "x${request_openssl}" = "xyes" &&
+   test "x${request_wolfssl}" = "xyes"; then
+  AC_MSG_ERROR([Requesting both OpenSSL and wolfSSL is not allowed])
+fi
+
 # openssl (for src)
 have_openssl=no
-if test "x${request_openssl}" != "xno"; then
+if test "x${request_openssl}" != "xno" &&
+   test "x${request_wolfssl}" != "xyes"; then
   PKG_CHECK_MODULES([OPENSSL], [openssl >= 1.1.1],
                     [have_openssl=yes], [have_openssl=no])
   if test "x${have_openssl}" = "xno"; then
@@ -439,6 +436,22 @@ if test "x${request_openssl}" != "xno"; then
     [AC_MSG_RESULT([yes]); have_ssl_provide_quic_data=yes],
     [AC_MSG_RESULT([no]); have_ssl_provide_quic_data=no])
 
+    # Check whether this is libressl or not
+    AC_CHECK_DECLS([LIBRESSL_VERSION_NUMBER],
+                   [have_libressl=yes], [have_libressl=no],
+    [[
+    #include <openssl/opensslv.h>
+    ]])
+
+    AC_MSG_CHECKING([for SSL_set_quic_tls_cbs])
+    AC_LINK_IFELSE([AC_LANG_PROGRAM([[
+      #include <openssl/ssl.h>
+    ]], [[
+      SSL_set_quic_tls_cbs(NULL, NULL, NULL);
+    ]])],
+    [AC_MSG_RESULT([yes]); have_ossl_quic=yes],
+    [AC_MSG_RESULT([no]); have_ossl_quic=no])
+
     # boringssl has SSL_set_quic_early_data_context.
     AC_MSG_CHECKING([for SSL_set_quic_early_data_context])
     AC_LINK_IFELSE([AC_LANG_PROGRAM([[
@@ -462,6 +475,45 @@ if test "x${request_openssl}" = "xyes" &&
   AC_MSG_ERROR([openssl was requested (--with-openssl) but not found])
 fi
 
+# wolfSSL (for src)
+have_wolfssl=no
+if test "x${request_wolfssl}" != "xno" &&
+   test "x${request_openssl}" != "xyes" &&
+   test "x${have_openssl}" != "xyes"; then
+  PKG_CHECK_MODULES([WOLFSSL], [wolfssl >= 5.7.0],
+                    [have_wolfssl=yes], [have_wolfssl=no])
+  if test "x${have_wolfssl}" = "xno"; then
+    AC_MSG_NOTICE($WOLFSSL_PKG_ERRORS)
+  else
+    AC_DEFINE([HAVE_WOLFSSL], [1],
+              [Define to 1 if you have 'wolfssl' library.])
+
+    save_CFLAGS="$CFLAGS"
+    save_LIBS="$LIBS"
+    CFLAGS="$WOLFSSL_CFLAGS $CFLAGS"
+    LIBS="$WOLFSSL_LIBS $LIBS"
+
+    have_wolfssl_quic=no
+    AC_MSG_CHECKING([for wolfSSL QUIC])
+    AC_LINK_IFELSE([AC_LANG_PROGRAM([[
+      #include <wolfssl/options.h>
+      #include <wolfssl/openssl/ssl.h>
+    ]], [[
+      SSL_provide_quic_data(NULL, 0, NULL, 0);
+    ]])],
+    [AC_MSG_RESULT([yes]); have_wolfssl_quic=yes],
+    [AC_MSG_RESULT([no]); have_wolfssl_quic=no])
+
+    CFLAGS="$save_CFLAGS"
+    LIBS="$save_LIBS"
+  fi
+fi
+
+if test "x${request_wolfssl}" = "xyes" &&
+   test "x${have_wolfssl}" != "xyes"; then
+  AC_MSG_ERROR([wolfSSL was requested (--with-wolfssl) but not found])
+fi
+
 # c-ares (for src)
 have_libcares=no
 if test "x${request_libcares}" != "xno"; then
@@ -480,7 +532,7 @@ fi
 # ngtcp2 (for src)
 have_libngtcp2=no
 if test "x${request_libngtcp2}" != "xno"; then
-  PKG_CHECK_MODULES([LIBNGTCP2], [libngtcp2 >= 1.4.0], [have_libngtcp2=yes],
+  PKG_CHECK_MODULES([LIBNGTCP2], [libngtcp2 >= 1.16.0], [have_libngtcp2=yes],
                     [have_libngtcp2=no])
   if test "x${have_libngtcp2}" = "xno"; then
     AC_MSG_NOTICE($LIBNGTCP2_PKG_ERRORS)
@@ -492,13 +544,36 @@ if test "x${request_libngtcp2}" = "xyes" &&
   AC_MSG_ERROR([libngtcp2 was requested (--with-libngtcp2) but not found])
 fi
 
+# ngtcp2_crypto_wolfssl (for src)
+have_libngtcp2_crypto_wolfssl=no
+if test "x${have_wolfssl_quic}" = "xyes" &&
+   test "x${request_libngtcp2}" != "xno"; then
+  PKG_CHECK_MODULES([LIBNGTCP2_CRYPTO_WOLFSSL],
+                    [libngtcp2_crypto_wolfssl >= 1.16.0],
+                    [have_libngtcp2_crypto_wolfssl=yes],
+                    [have_libngtcp2_crypto_wolfssl=no])
+  if test "x${have_libngtcp2_crypto_wolfssl}" = "xno"; then
+    AC_MSG_NOTICE($LIBNGTCP2_CRYPTO_WOLFSSL_PKG_ERRORS)
+  else
+    AC_DEFINE([HAVE_LIBNGTCP2_CRYPTO_WOLFSSL], [1],
+              [Define to 1 if you have `libngtcp2_crypto_wolfssl` library.])
+  fi
+fi
+
+if test "x${have_wolfssl_quic}" = "xyes" &&
+   test "x${request_libngtcp2}" = "xyes" &&
+   test "x${have_libngtcp2_crypto_wolfssl}" != "xyes"; then
+  AC_MSG_ERROR([libngtcp2_crypto_wolfssl was requested (--with-libngtcp2) but not found])
+fi
+
 # ngtcp2_crypto_quictls (for src)
 have_libngtcp2_crypto_quictls=no
 if test "x${have_ssl_provide_quic_data}" = "xyes" &&
+   test "x${have_libressl}" != "xyes" &&
    test "x${have_boringssl_quic}" != "xyes" &&
    test "x${request_libngtcp2}" != "xno"; then
   PKG_CHECK_MODULES([LIBNGTCP2_CRYPTO_QUICTLS],
-                    [libngtcp2_crypto_quictls >= 1.0.0],
+                    [libngtcp2_crypto_quictls >= 1.16.0],
                     [have_libngtcp2_crypto_quictls=yes],
                     [have_libngtcp2_crypto_quictls=no])
   if test "x${have_libngtcp2_crypto_quictls}" = "xno"; then
@@ -510,12 +585,37 @@ if test "x${have_ssl_provide_quic_data}" = "xyes" &&
 fi
 
 if test "x${have_ssl_provide_quic_data}" = "xyes" &&
+   test "x${have_libressl}" != "xyes" &&
    test "x${have_boringssl_quic}" != "xyes" &&
    test "x${request_libngtcp2}" = "xyes" &&
    test "x${have_libngtcp2_crypto_quictls}" != "xyes"; then
   AC_MSG_ERROR([libngtcp2_crypto_quictls was requested (--with-libngtcp2) but not found])
 fi
 
+# ngtcp2_crypto_libressl (for src)
+have_libngtcp2_crypto_libressl=no
+if test "x${have_ssl_provide_quic_data}" = "xyes" &&
+   test "x${have_libressl}" = "xyes" &&
+   test "x${request_libngtcp2}" != "xno"; then
+  PKG_CHECK_MODULES([LIBNGTCP2_CRYPTO_LIBRESSL],
+                    [libngtcp2_crypto_libressl >= 1.16.0],
+                    [have_libngtcp2_crypto_libressl=yes],
+                    [have_libngtcp2_crypto_libressl=no])
+  if test "x${have_libngtcp2_crypto_libressl}" = "xno"; then
+    AC_MSG_NOTICE($LIBNGTCP2_CRYPTO_LIBRESSL_PKG_ERRORS)
+  else
+    AC_DEFINE([HAVE_LIBNGTCP2_CRYPTO_LIBRESSL], [1],
+              [Define to 1 if you have `libngtcp2_crypto_libressl` library.])
+  fi
+fi
+
+if test "x${have_ssl_provide_quic_data}" = "xyes" &&
+   test "x${have_libressl}" = "xyes" &&
+   test "x${request_libngtcp2}" = "xyes" &&
+   test "x${have_libngtcp2_crypto_libressl}" != "xyes"; then
+  AC_MSG_ERROR([libngtcp2_crypto_libressl was requested (--with-libngtcp2) but not found])
+fi
+
 # ngtcp2_crypto_boringssl (for src)
 have_libngtcp2_crypto_boringssl=no
 if test "x${have_boringssl_quic}" = "xyes" &&
@@ -538,10 +638,32 @@ if test "x${have_boringssl_quic}" = "xyes" &&
   AC_MSG_ERROR([libngtcp2_crypto_boringssl was requested (--with-libngtcp2) but not found])
 fi
 
+# ngtcp2_crypto_ossl (for src)
+have_libngtcp2_crypto_ossl=no
+if test "x${have_ossl_quic}" = "xyes" &&
+   test "x${request_libngtcp2}" != "xno"; then
+  PKG_CHECK_MODULES([LIBNGTCP2_CRYPTO_OSSL],
+                    [libngtcp2_crypto_ossl >= 1.16.0],
+                    [have_libngtcp2_crypto_ossl=yes],
+                    [have_libngtcp2_crypto_ossl=no])
+  if test "x${have_libngtcp2_crypto_ossl}" = "xno"; then
+    AC_MSG_NOTICE($LIBNGTCP2_CRYPTO_OSSL_PKG_ERRORS)
+  else
+    AC_DEFINE([HAVE_LIBNGTCP2_CRYPTO_OSSL], [1],
+              [Define to 1 if you have `libngtcp2_crypto_ossl` library.])
+  fi
+fi
+
+if test "x${have_ossl_quic}" = "xyes" &&
+   test "x${request_libngtcp2}" = "xyes" &&
+   test "x${have_libngtcp2_crypto_ossl}" != "xyes"; then
+  AC_MSG_ERROR([libngtcp2_crypto_ossl was requested (--with-libngtcp2) but not found])
+fi
+
 # nghttp3 (for src)
 have_libnghttp3=no
 if test "x${request_libnghttp3}" != "xno"; then
-  PKG_CHECK_MODULES([LIBNGHTTP3], [libnghttp3 >= 1.1.0], [have_libnghttp3=yes],
+  PKG_CHECK_MODULES([LIBNGHTTP3], [libnghttp3 >= 1.12.0], [have_libnghttp3=yes],
                     [have_libnghttp3=no])
   if test "x${have_libnghttp3}" = "xno"; then
     AC_MSG_NOTICE($LIBNGHTTP3_PKG_ERRORS)
@@ -751,7 +873,7 @@ fi
 enable_app=no
 if test "x${request_app}" != "xno" &&
    test "x${have_zlib}" = "xyes" &&
-   test "x${have_openssl}" = "xyes" &&
+   (test "x${have_openssl}" = "xyes" || test "x${have_wolfssl}" = "xyes") &&
    test "x${have_libev}" = "xyes" &&
    test "x${have_libcares}" = "xyes"; then
   enable_app=yes
@@ -768,8 +890,11 @@ AM_CONDITIONAL([ENABLE_APP], [ test "x${enable_app}" = "xyes" ])
 enable_http3=no
 if test "x${request_http3}" != "xno" &&
    test "x${have_libngtcp2}" = "xyes" &&
-   (test "x${have_libngtcp2_crypto_quictls}" = "xyes" ||
+   (test "x${have_libngtcp2_crypto_wolfssl}" = "xyes" ||
-    test "x${have_libngtcp2_crypto_boringssl}" = "xyes") &&
+    test "x${have_libngtcp2_crypto_quictls}" = "xyes" ||
+    test "x${have_libngtcp2_crypto_libressl}" = "xyes" ||
+    test "x${have_libngtcp2_crypto_boringssl}" = "xyes" ||
+    test "x${have_libngtcp2_crypto_ossl}" = "xyes") &&
    test "x${have_libnghttp3}" = "xyes"; then
   enable_http3=yes
   AC_DEFINE([ENABLE_HTTP3], [1], [Define to 1 if HTTP/3 is enabled.])
@@ -945,6 +1070,7 @@ AC_CHECK_FUNCS([ \
   memmove \
   memset \
   mkostemp \
+  pipe2 \
   socket \
   sqrt \
   strchr \
@@ -1049,6 +1175,7 @@ if test "x$werror" != "xno"; then
     # Only work with Clang for the moment
     AX_CHECK_COMPILE_FLAG([-Wheader-guard], [CFLAGS="$CFLAGS -Wheader-guard"])
     AX_CHECK_COMPILE_FLAG([-Wsometimes-uninitialized], [CFLAGS="$CFLAGS -Wsometimes-uninitialized"])
+    AX_CHECK_COMPILE_FLAG([-Wextra-semi], [CFLAGS="$CFLAGS -Wextra-semi"])
 
     # This is required because we pass format string as "const char*.
     AX_CHECK_COMPILE_FLAG([-Wno-format-nonliteral], [CFLAGS="$CFLAGS -Wno-format-nonliteral"])
@@ -1059,9 +1186,13 @@ if test "x$werror" != "xno"; then
     AX_CHECK_COMPILE_FLAG([-Werror], [CXXFLAGS="$CXXFLAGS -Werror"])
     AX_CHECK_COMPILE_FLAG([-Wformat-security], [CXXFLAGS="$CXXFLAGS -Wformat-security"])
     AX_CHECK_COMPILE_FLAG([-Wsometimes-uninitialized], [CXXFLAGS="$CXXFLAGS -Wsometimes-uninitialized"])
+    AX_CHECK_COMPILE_FLAG([-Wextra-semi], [CXXFLAGS="$CXXFLAGS -Wextra-semi"])
+    AX_CHECK_COMPILE_FLAG([-Wconversion], [CXXFLAGS="$CXXFLAGS -Wconversion"])
     # Disable noexcept-type warning of g++-7.  This is not harmful as
     # long as all source files are compiled with the same compiler.
     AX_CHECK_COMPILE_FLAG([-Wno-noexcept-type], [CXXFLAGS="$CXXFLAGS -Wno-noexcept-type"])
+    # clang++-18 warns this when building with wolfSSL >= v5.7.6-stable.
+    AX_CHECK_COMPILE_FLAG([-Wno-extern-c-compat], [CXXFLAGS="$CXXFLAGS -Wno-extern-c-compat"])
     AC_LANG_POP()
 fi
 
@@ -1128,7 +1259,6 @@ AC_CONFIG_FILES([
   doc/nghttp2ver.h.rst
   doc/contribute.rst
   contrib/Makefile
-  script/Makefile
 ])
 AC_OUTPUT
 
@@ -1170,13 +1300,16 @@ AC_MSG_NOTICE([summary of build options:
     Test:
       Failmalloc:     ${enable_failmalloc}
     Libs:
+      wolfSSL:        ${have_wolfssl} (CFLAGS='${WOLFSSL_CFLAGS}' LIBS='${WOLFSSL_LIBS}')
       OpenSSL:        ${have_openssl} (CFLAGS='${OPENSSL_CFLAGS}' LIBS='${OPENSSL_LIBS}')
       Libxml2:        ${have_libxml2} (CFLAGS='${LIBXML2_CFLAGS}' LIBS='${LIBXML2_LIBS}')
       Libev:          ${have_libev} (CFLAGS='${LIBEV_CFLAGS}' LIBS='${LIBEV_LIBS}')
       Libc-ares:      ${have_libcares} (CFLAGS='${LIBCARES_CFLAGS}' LIBS='${LIBCARES_LIBS}')
       libngtcp2:      ${have_libngtcp2} (CFLAGS='${LIBNGTCP2_CFLAGS}' LIBS='${LIBNGTCP2_LIBS}')
       libngtcp2_crypto_quictls: ${have_libngtcp2_crypto_quictls} (CFLAGS='${LIBNGTCP2_CRYPTO_QUICTLS_CFLAGS}' LIBS='${LIBNGTCP2_CRYPTO_QUICTLS_LIBS}')
+      libngtcp2_crypto_libressl: ${have_libngtcp2_crypto_libressl} (CFLAGS='${LIBNGTCP2_CRYPTO_LIBRESSL_CFLAGS}' LIBS='${LIBNGTCP2_CRYPTO_LIBRESSL_LIBS}')
       libngtcp2_crypto_boringssl: ${have_libngtcp2_crypto_boringssl} (CFLAGS='${LIBNGTCP2_CRYPTO_BORINGSSL_CFLAGS}' LIBS='${LIBNGTCP2_CRYPTO_BORINGSSL_LIBS}')
+      libngtcp2_crypto_ossl: ${have_libngtcp2_crypto_ossl} (CFLAGS='${LIBNGTCP2_CRYPTO_OSSL_CFLAGS}' LIBS='${LIBNGTCP2_CRYPTO_OSSL_LIBS}')
       libnghttp3:     ${have_libnghttp3} (CFLAGS='${LIBNGHTTP3_CFLAGS}' LIBS='${LIBNGHTTP3_LIBS}')
       libbpf:         ${have_libbpf} (CFLAGS='${LIBBPF_CFLAGS}' LIBS='${LIBBPF_LIBS}')
       Libevent(SSL):  ${have_libevent_openssl} (CFLAGS='${LIBEVENT_OPENSSL_CFLAGS}' LIBS='${LIBEVENT_OPENSSL_LIBS}')

doc/Makefile.am

@@ -81,6 +81,7 @@ APIDOCS= \
 	nghttp2_option_set_max_outbound_ack.rst \
 	nghttp2_option_set_max_settings.rst \
 	nghttp2_option_set_stream_reset_rate_limit.rst \
+	nghttp2_option_set_glitch_rate_limit.rst \
 	nghttp2_pack_settings_payload.rst \
 	nghttp2_pack_settings_payload2.rst \
 	nghttp2_priority_spec_check_default.rst \
@@ -114,6 +115,7 @@ APIDOCS= \
 	nghttp2_session_callbacks_set_on_stream_close_callback.rst \
 	nghttp2_session_callbacks_set_pack_extension_callback.rst \
 	nghttp2_session_callbacks_set_pack_extension_callback2.rst \
+	nghttp2_session_callbacks_set_rand_callback.rst \
 	nghttp2_session_callbacks_set_recv_callback.rst \
 	nghttp2_session_callbacks_set_recv_callback2.rst \
 	nghttp2_session_callbacks_set_select_padding_callback.rst \

doc/README.rst

@@ -111,7 +111,7 @@ The example follows::
 
 ``@struct`` is used to refer to the struct. Currently, only struct
 typedefs are supported. The comment block is used for the document for
-the struct type itself.To document each member, put comment block
+the struct type itself. To document each member, put comment block
 starting with the line ``/**`` and ending with the ``*/`` just before
 the member.  When the line starts with ``}`` is encountered, the
 ``mkapiref.py`` extracts strings next to ``}`` as the name of struct.

doc/_exts/rubydomain/__init__.py

@@ -1,14 +0,0 @@
-# -*- coding: utf-8 -*-
-"""
-    sphinxcontrib
-    ~~~~~~~~~~~~~
-
-    This package is a namespace package that contains all extensions
-    distributed in the ``sphinx-contrib`` distribution.
-
-    :copyright: Copyright 2007-2009 by the Sphinx team, see AUTHORS.
-    :license: BSD, see LICENSE for details.
-"""
-
-__import__('pkg_resources').declare_namespace(__name__)
-

doc/bash_completion/nghttp

@@ -8,7 +8,7 @@ _nghttp()
     _get_comp_words_by_ref cur prev
     case $cur in
         -*)
-            COMPREPLY=( $( compgen -W '--verbose --null-out --remote-name --timeout --window-bits --connection-window-bits --get-assets --stat --header --trailer --cert --key --data --multiply --upgrade --weight --peer-max-concurrent-streams --header-table-size --encoder-header-table-size --padding --har --color --continuation --no-content-length --no-dep --hexdump --no-push --max-concurrent-streams --expect-continue --no-verify-peer --ktls --no-rfc7540-pri --version --help ' -- "$cur" ) )
+            COMPREPLY=( $( compgen -W '--verbose --null-out --remote-name --timeout --window-bits --connection-window-bits --get-assets --stat --header --trailer --cert --key --data --multiply --upgrade --extpri --peer-max-concurrent-streams --header-table-size --encoder-header-table-size --padding --har --color --continuation --no-content-length --hexdump --no-push --max-concurrent-streams --expect-continue --no-verify-peer --ktls --version --help ' -- "$cur" ) )
             ;;
         *)
             _filedir

doc/bash_completion/nghttpd

@@ -8,7 +8,7 @@ _nghttpd()
     _get_comp_words_by_ref cur prev
     case $cur in
         -*)
-            COMPREPLY=( $( compgen -W '--address --daemon --verify-client --htdocs --verbose --no-tls --header-table-size --encoder-header-table-size --color --push --padding --max-concurrent-streams --workers --error-gzip --window-bits --connection-window-bits --dh-param-file --early-response --trailer --hexdump --echo-upload --mime-types-file --no-content-length --ktls --no-rfc7540-pri --version --help ' -- "$cur" ) )
+            COMPREPLY=( $( compgen -W '--address --daemon --verify-client --htdocs --verbose --no-tls --header-table-size --encoder-header-table-size --color --push --padding --max-concurrent-streams --workers --error-gzip --window-bits --connection-window-bits --dh-param-file --early-response --trailer --hexdump --echo-upload --mime-types-file --no-content-length --groups --ktls --version --help ' -- "$cur" ) )
             ;;
         *)
             _filedir

doc/bash_completion/nghttpx

@@ -8,7 +8,7 @@ _nghttpx()
     _get_comp_words_by_ref cur prev
     case $cur in
         -*)
-            COMPREPLY=( $( compgen -W '--backend --frontend --backlog --backend-address-family --backend-http-proxy-uri --workers --single-thread --read-rate --read-burst --write-rate --write-burst --worker-read-rate --worker-read-burst --worker-write-rate --worker-write-burst --worker-frontend-connections --backend-connections-per-host --backend-connections-per-frontend --rlimit-nofile --rlimit-memlock --backend-request-buffer --backend-response-buffer --fastopen --no-kqueue --frontend-http2-idle-timeout --frontend-http3-idle-timeout --frontend-write-timeout --frontend-keep-alive-timeout --frontend-header-timeout --stream-read-timeout --stream-write-timeout --backend-read-timeout --backend-write-timeout --backend-connect-timeout --backend-keep-alive-timeout --listener-disable-timeout --frontend-http2-setting-timeout --backend-http2-settings-timeout --backend-max-backoff --ciphers --tls13-ciphers --client-ciphers --tls13-client-ciphers --ecdh-curves --insecure --cacert --private-key-passwd-file --subcert --dh-param-file --alpn-list --verify-client --verify-client-cacert --verify-client-tolerate-expired --client-private-key-file --client-cert-file --tls-min-proto-version --tls-max-proto-version --tls-ticket-key-file --tls-ticket-key-memcached --tls-ticket-key-memcached-address-family --tls-ticket-key-memcached-interval --tls-ticket-key-memcached-max-retry --tls-ticket-key-memcached-max-fail --tls-ticket-key-cipher --tls-ticket-key-memcached-cert-file --tls-ticket-key-memcached-private-key-file --fetch-ocsp-response-file --ocsp-update-interval --ocsp-startup --no-verify-ocsp --no-ocsp --tls-session-cache-memcached --tls-session-cache-memcached-address-family --tls-session-cache-memcached-cert-file --tls-session-cache-memcached-private-key-file --tls-dyn-rec-warmup-threshold --tls-dyn-rec-idle-timeout --no-http2-cipher-block-list --client-no-http2-cipher-block-list --tls-sct-dir --psk-secrets --client-psk-secrets --tls-no-postpone-early-data --tls-max-early-data --tls-ktls --frontend-http2-max-concurrent-streams --backend-http2-max-concurrent-streams --frontend-http2-window-size --frontend-http2-connection-window-size --backend-http2-window-size --backend-http2-connection-window-size --http2-no-cookie-crumbling --padding --no-server-push --frontend-http2-optimize-write-buffer-size --frontend-http2-optimize-window-size --frontend-http2-encoder-dynamic-table-size --frontend-http2-decoder-dynamic-table-size --backend-http2-encoder-dynamic-table-size --backend-http2-decoder-dynamic-table-size --http2-proxy --log-level --accesslog-file --accesslog-syslog --accesslog-format --accesslog-write-early --errorlog-file --errorlog-syslog --syslog-facility --add-x-forwarded-for --strip-incoming-x-forwarded-for --no-add-x-forwarded-proto --no-strip-incoming-x-forwarded-proto --add-forwarded --strip-incoming-forwarded --forwarded-by --forwarded-for --no-via --no-strip-incoming-early-data --no-location-rewrite --host-rewrite --altsvc --http2-altsvc --add-request-header --add-response-header --request-header-field-buffer --max-request-header-fields --response-header-field-buffer --max-response-header-fields --error-page --server-name --no-server-rewrite --redirect-https-port --require-http-scheme --api-max-request-body --dns-cache-timeout --dns-lookup-timeout --dns-max-try --frontend-max-requests --frontend-http2-dump-request-header --frontend-http2-dump-response-header --frontend-frame-debug --daemon --pid-file --user --single-process --max-worker-processes --worker-process-grace-shutdown-period --mruby-file --ignore-per-pattern-mruby-error --frontend-quic-idle-timeout --frontend-quic-debug-log --quic-bpf-program-file --frontend-quic-early-data --frontend-quic-qlog-dir --frontend-quic-require-token --frontend-quic-congestion-controller --frontend-quic-secret-file --quic-server-id --frontend-quic-initial-rtt --no-quic-bpf --frontend-http3-window-size --frontend-http3-connection-window-size --frontend-http3-max-window-size --frontend-http3-max-connection-window-size --frontend-http3-max-concurrent-streams --conf --include --version --help ' -- "$cur" ) )
+            COMPREPLY=( $( compgen -W '--backend --frontend --backlog --backend-address-family --backend-http-proxy-uri --workers --single-thread --read-rate --read-burst --write-rate --write-burst --worker-read-rate --worker-read-burst --worker-write-rate --worker-write-burst --worker-frontend-connections --backend-connections-per-host --backend-connections-per-frontend --rlimit-nofile --rlimit-memlock --backend-request-buffer --backend-response-buffer --fastopen --no-kqueue --frontend-http2-idle-timeout --frontend-http3-idle-timeout --frontend-write-timeout --frontend-keep-alive-timeout --frontend-header-timeout --stream-read-timeout --stream-write-timeout --backend-read-timeout --backend-write-timeout --backend-connect-timeout --backend-keep-alive-timeout --listener-disable-timeout --frontend-http2-setting-timeout --backend-http2-settings-timeout --backend-max-backoff --ciphers --tls13-ciphers --client-ciphers --tls13-client-ciphers --groups --insecure --cacert --private-key-passwd-file --subcert --dh-param-file --alpn-list --verify-client --verify-client-cacert --verify-client-tolerate-expired --client-private-key-file --client-cert-file --tls-min-proto-version --tls-max-proto-version --tls-ticket-key-file --tls-ticket-key-memcached --tls-ticket-key-memcached-address-family --tls-ticket-key-memcached-interval --tls-ticket-key-memcached-max-retry --tls-ticket-key-memcached-max-fail --tls-ticket-key-cipher --tls-ticket-key-memcached-cert-file --tls-ticket-key-memcached-private-key-file --tls-dyn-rec-warmup-threshold --tls-dyn-rec-idle-timeout --no-http2-cipher-block-list --client-no-http2-cipher-block-list --tls-sct-dir --psk-secrets --client-psk-secrets --tls-no-postpone-early-data --tls-max-early-data --tls-ktls --frontend-http2-max-concurrent-streams --backend-http2-max-concurrent-streams --frontend-http2-window-size --frontend-http2-connection-window-size --backend-http2-window-size --backend-http2-connection-window-size --http2-no-cookie-crumbling --padding --no-server-push --frontend-http2-optimize-write-buffer-size --frontend-http2-optimize-window-size --frontend-http2-encoder-dynamic-table-size --frontend-http2-decoder-dynamic-table-size --backend-http2-encoder-dynamic-table-size --backend-http2-decoder-dynamic-table-size --http2-proxy --log-level --accesslog-file --accesslog-syslog --accesslog-format --accesslog-write-early --errorlog-file --errorlog-syslog --syslog-facility --add-x-forwarded-for --strip-incoming-x-forwarded-for --no-add-x-forwarded-proto --no-strip-incoming-x-forwarded-proto --add-forwarded --strip-incoming-forwarded --forwarded-by --forwarded-for --no-via --no-strip-incoming-early-data --no-location-rewrite --host-rewrite --altsvc --http2-altsvc --add-request-header --add-response-header --request-header-field-buffer --max-request-header-fields --response-header-field-buffer --max-response-header-fields --error-page --server-name --no-server-rewrite --redirect-https-port --require-http-scheme --api-max-request-body --dns-cache-timeout --dns-lookup-timeout --dns-max-try --frontend-max-requests --frontend-http2-dump-request-header --frontend-http2-dump-response-header --frontend-frame-debug --daemon --pid-file --user --single-process --max-worker-processes --worker-process-grace-shutdown-period --mruby-file --ignore-per-pattern-mruby-error --frontend-quic-idle-timeout --frontend-quic-debug-log --quic-bpf-program-file --frontend-quic-early-data --frontend-quic-qlog-dir --frontend-quic-require-token --frontend-quic-congestion-controller --frontend-quic-secret-file --quic-server-id --frontend-quic-initial-rtt --no-quic-bpf --frontend-http3-window-size --frontend-http3-connection-window-size --frontend-http3-max-window-size --frontend-http3-max-connection-window-size --frontend-http3-max-concurrent-streams --conf --include --version --help ' -- "$cur" ) )
             ;;
         *)
             _filedir

doc/h2load.1

@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "H2LOAD" "1" "May 19, 2024" "1.62.1" "nghttp2"
+.TH "H2LOAD" "1" "Mar 18, 2026" "1.68.1" "nghttp2"
 .SH NAME
 h2load \- HTTP/2 benchmarking tool
 .SH SYNOPSIS
@@ -109,9 +109,9 @@ Default: \fB16K\fP
 .TP
 .B \-w, \-\-window\-bits=<N>
 Sets the stream level initial window size to (2**<N>)\-1.
-For QUIC, <N> is capped to 26 (roughly 64MiB).
+For  QUIC, <N>  is  capped to  26  (roughly 64MiB).   It
-.sp
+defaults  to  24 (16MiB)  for  QUIC,  and 30  for  other
-Default: \fB30\fP
+protocols.
 .UNINDENT
 .INDENT 0.0
 .TP
@@ -262,7 +262,7 @@ protocol comes  first.  The parameter must  be delimited
 by a single comma only  and any white spaces are treated
 as a part of protocol string.
 .sp
-Default: \fBh2,h2\-16,h2\-14,http/1.1\fP
+Default: \fBh2,http/1.1\fP
 .UNINDENT
 .INDENT 0.0
 .TP
@@ -388,7 +388,7 @@ The number of requests completed.
 .TP
 .B succeeded
 The number of requests completed successfully.  Only HTTP status
-code 2xx or3xx are considered as success.
+code 2xx or 3xx are considered as success.
 .TP
 .B failed
 The number of requests failed, including HTTP level failures

doc/h2load.1.rst

@@ -83,9 +83,9 @@ OPTIONS
 .. option:: -w, --window-bits=<N>
 
     Sets the stream level initial window size to (2\*\*<N>)-1.
-    For QUIC, <N> is capped to 26 (roughly 64MiB).
+    For  QUIC, <N>  is  capped to  26  (roughly 64MiB).   It
-
+    defaults  to  24 (16MiB)  for  QUIC,  and 30  for  other
-    Default: ``30``
+    protocols.
 
 .. option:: -W, --connection-window-bits=<N>
 
@@ -221,7 +221,7 @@ OPTIONS
     by a single comma only  and any white spaces are treated
     as a part of protocol string.
 
-    Default: ``h2,h2-16,h2-14,http/1.1``
+    Default: ``h2,http/1.1``
 
 .. option:: --h1
 
@@ -331,7 +331,7 @@ requests
     The number of requests completed.
   succeeded
     The number of requests completed successfully.  Only HTTP status
-    code 2xx or3xx are considered as success.
+    code 2xx or 3xx are considered as success.
   failed
     The number of requests failed, including HTTP level failures
     (non-successful HTTP status code).

doc/h2load.h2r

@@ -12,7 +12,7 @@ requests
     The number of requests completed.
   succeeded
     The number of requests completed successfully.  Only HTTP status
-    code 2xx or3xx are considered as success.
+    code 2xx or 3xx are considered as success.
   failed
     The number of requests failed, including HTTP level failures
     (non-successful HTTP status code).

doc/nghttp.1

@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "NGHTTP" "1" "May 19, 2024" "1.62.1" "nghttp2"
+.TH "NGHTTP" "1" "Mar 18, 2026" "1.68.1" "nghttp2"
 .SH NAME
 nghttp \- HTTP/2 client
 .SH SYNOPSIS
@@ -141,14 +141,15 @@ HTTP upgrade request is performed with OPTIONS method.
 .UNINDENT
 .INDENT 0.0
 .TP
-.B \-p, \-\-weight=<WEIGHT>
+.B \-\-extpri=<PRI>
-Sets  weight of  given  URI.  This  option  can be  used
+Sets RFC 9218 priority of  given URI.  <PRI> must be the
-multiple times, and  N\-th \fI\%\-p\fP option sets  weight of N\-th
+wire format  of priority  header field  (e.g., \(dqu=3,i\(dq).
-URI in the command line.  If  the number of \fI\%\-p\fP option is
+This  option  can  be  used  multiple  times,  and  N\-th
-less than the number of URI, the last \fI\%\-p\fP option value is
+\fI\%\-\-extpri\fP option sets priority of N\-th URI in the command
-repeated.  If there is no \fI\%\-p\fP option, default weight, 16,
+line.  If  the number  of this option  is less  than the
-is assumed.  The valid value range is
+number of  URI, the last  option value is  repeated.  If
-[1, 256], inclusive.
+there  is   no  \fI\%\-\-extpri\fP  option,  urgency   is  3,  and
+incremental is false.
 .UNINDENT
 .INDENT 0.0
 .TP
@@ -205,11 +206,6 @@ Don\(aqt send content\-length header field.
 .UNINDENT
 .INDENT 0.0
 .TP
-.B \-\-no\-dep
-Don\(aqt send dependency based priority hint to server.
-.UNINDENT
-.INDENT 0.0
-.TP
 .B \-\-hexdump
 Display the  incoming traffic in  hexadecimal (Canonical
 hex+ASCII display).  If SSL/TLS  is used, decrypted data
@@ -247,11 +243,6 @@ Enable ktls.
 .UNINDENT
 .INDENT 0.0
 .TP
-.B \-\-no\-rfc7540\-pri
-Disable RFC7540 priorities.
-.UNINDENT
-.INDENT 0.0
-.TP
 .B \-\-version
 Display version information and exit.
 .UNINDENT
@@ -268,63 +259,6 @@ The <DURATION> argument is an integer and an optional unit (e.g., 1s
 is 1 second and 500ms is 500 milliseconds).  Units are h, m, s or ms
 (hours, minutes, seconds and milliseconds, respectively).  If a unit
 is omitted, a second is used as unit.
-.SH DEPENDENCY BASED PRIORITY
-.sp
-nghttp sends priority hints to server by default unless
-\fI\%\-\-no\-dep\fP is used.  nghttp mimics the way Firefox employs to
-manages dependency using idle streams.  We follows the behaviour of
-Firefox Nightly as of April, 2015, and nghttp\(aqs behaviour is very
-static and could be different from Firefox in detail.  But reproducing
-the same behaviour of Firefox is not our goal.  The goal is provide
-the easy way to test out the dependency priority in server
-implementation.
-.sp
-When connection is established, nghttp sends 5 PRIORITY frames to idle
-streams 3, 5, 7, 9 and 11 to create \(dqanchor\(dq nodes in dependency
-tree:
-.INDENT 0.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
-         +\-\-\-\-\-+
-         |id=0 |
-         +\-\-\-\-\-+
-        ^   ^   ^
- w=201 /    |    \e w=1
-      /     |     \e
-     / w=101|      \e
- +\-\-\-\-\-+ +\-\-\-\-\-+ +\-\-\-\-\-+
- |id=3 | |id=5 | |id=7 |
- +\-\-\-\-\-+ +\-\-\-\-\-+ +\-\-\-\-\-+
-    ^               ^
-w=1 |           w=1 |
-    |               |
- +\-\-\-\-\-+         +\-\-\-\-\-+
- |id=11|         |id=9 |
- +\-\-\-\-\-+         +\-\-\-\-\-+
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.sp
-In the above figure, \fBid\fP means stream ID, and \fBw\fP means weight.
-The stream 0 is non\-existence stream, and forms the root of the tree.
-The stream 7 and 9 are not used for now.
-.sp
-The URIs given in the command\-line depend on stream 11 with the weight
-given in \fI\%\-p\fP option, which defaults to 16.
-.sp
-If \fI\%\-a\fP option is used, nghttp parses the resource pointed by
-URI given in command\-line as html, and extracts resource links from
-it.  When requesting those resources, nghttp uses dependency according
-to its resource type.
-.sp
-For CSS, and Javascript files inside \(dqhead\(dq element, they depend on
-stream 3 with the weight 2.  The Javascript files outside \(dqhead\(dq
-element depend on stream 5 with the weight 2.  The mages depend on
-stream 11 with the weight 12.  The other resources (e.g., icon) depend
-on stream 11 with the weight 2.
 .SH SEE ALSO
 .sp
 \fBnghttpd(1)\fP, \fBnghttpx(1)\fP, \fBh2load(1)\fP

doc/nghttp.1.rst

@@ -105,15 +105,16 @@ OPTIONS
     if the request URI has https scheme.  If :option:`-d` is used, the
     HTTP upgrade request is performed with OPTIONS method.
 
-.. option:: -p, --weight=<WEIGHT>
+.. option:: --extpri=<PRI>
 
-    Sets  weight of  given  URI.  This  option  can be  used
+    Sets RFC 9218 priority of  given URI.  <PRI> must be the
-    multiple times, and  N-th :option:`-p` option sets  weight of N-th
+    wire format  of priority  header field  (e.g., "u=3,i").
-    URI in the command line.  If  the number of :option:`-p` option is
+    This  option  can  be  used  multiple  times,  and  N-th
-    less than the number of URI, the last :option:`-p` option value is
+    :option:`--extpri` option sets priority of N-th URI in the command
-    repeated.  If there is no :option:`-p` option, default weight, 16,
+    line.  If  the number  of this option  is less  than the
-    is assumed.  The valid value range is
+    number of  URI, the last  option value is  repeated.  If
-    [1, 256], inclusive.
+    there  is   no  :option:`--extpri`  option,  urgency   is  3,  and
+    incremental is false.
 
 .. option:: -M, --peer-max-concurrent-streams=<N>
 
@@ -160,10 +161,6 @@ OPTIONS
 
     Don't send content-length header field.
 
-.. option:: --no-dep
-
-    Don't send dependency based priority hint to server.
-
 .. option:: --hexdump
 
     Display the  incoming traffic in  hexadecimal (Canonical
@@ -195,10 +192,6 @@ OPTIONS
 
     Enable ktls.
 
-.. option:: --no-rfc7540-pri
-
-    Disable RFC7540 priorities.
-
 .. option:: --version
 
     Display version information and exit.
@@ -217,59 +210,6 @@ is 1 second and 500ms is 500 milliseconds).  Units are h, m, s or ms
 (hours, minutes, seconds and milliseconds, respectively).  If a unit
 is omitted, a second is used as unit.
 
-DEPENDENCY BASED PRIORITY
--------------------------
-
-nghttp sends priority hints to server by default unless
-:option:`--no-dep` is used.  nghttp mimics the way Firefox employs to
-manages dependency using idle streams.  We follows the behaviour of
-Firefox Nightly as of April, 2015, and nghttp's behaviour is very
-static and could be different from Firefox in detail.  But reproducing
-the same behaviour of Firefox is not our goal.  The goal is provide
-the easy way to test out the dependency priority in server
-implementation.
-
-When connection is established, nghttp sends 5 PRIORITY frames to idle
-streams 3, 5, 7, 9 and 11 to create "anchor" nodes in dependency
-tree:
-
-.. code-block:: text
-
-                      +-----+
-                      |id=0 |
-                      +-----+
-                     ^   ^   ^
-              w=201 /    |    \ w=1
-                   /     |     \
-                  / w=101|      \
-              +-----+ +-----+ +-----+
-              |id=3 | |id=5 | |id=7 |
-              +-----+ +-----+ +-----+
-                 ^               ^
-             w=1 |           w=1 |
-                 |               |
-              +-----+         +-----+
-              |id=11|         |id=9 |
-              +-----+         +-----+
-
-In the above figure, ``id`` means stream ID, and ``w`` means weight.
-The stream 0 is non-existence stream, and forms the root of the tree.
-The stream 7 and 9 are not used for now.
-
-The URIs given in the command-line depend on stream 11 with the weight
-given in :option:`-p` option, which defaults to 16.
-
-If :option:`-a` option is used, nghttp parses the resource pointed by
-URI given in command-line as html, and extracts resource links from
-it.  When requesting those resources, nghttp uses dependency according
-to its resource type.
-
-For CSS, and Javascript files inside "head" element, they depend on
-stream 3 with the weight 2.  The Javascript files outside "head"
-element depend on stream 5 with the weight 2.  The mages depend on
-stream 11 with the weight 12.  The other resources (e.g., icon) depend
-on stream 11 with the weight 2.
-
 SEE ALSO
 --------
 

doc/nghttp.h2r

@@ -1,56 +1,3 @@
-DEPENDENCY BASED PRIORITY
--------------------------
-
-nghttp sends priority hints to server by default unless
-:option:`--no-dep` is used.  nghttp mimics the way Firefox employs to
-manages dependency using idle streams.  We follows the behaviour of
-Firefox Nightly as of April, 2015, and nghttp's behaviour is very
-static and could be different from Firefox in detail.  But reproducing
-the same behaviour of Firefox is not our goal.  The goal is provide
-the easy way to test out the dependency priority in server
-implementation.
-
-When connection is established, nghttp sends 5 PRIORITY frames to idle
-streams 3, 5, 7, 9 and 11 to create "anchor" nodes in dependency
-tree:
-
-.. code-block:: text
-
-                      +-----+
-                      |id=0 |
-                      +-----+
-                     ^   ^   ^
-              w=201 /    |    \ w=1
-                   /     |     \
-                  / w=101|      \
-              +-----+ +-----+ +-----+
-              |id=3 | |id=5 | |id=7 |
-              +-----+ +-----+ +-----+
-                 ^               ^
-             w=1 |           w=1 |
-                 |               |
-              +-----+         +-----+
-              |id=11|         |id=9 |
-              +-----+         +-----+
-
-In the above figure, ``id`` means stream ID, and ``w`` means weight.
-The stream 0 is non-existence stream, and forms the root of the tree.
-The stream 7 and 9 are not used for now.
-
-The URIs given in the command-line depend on stream 11 with the weight
-given in :option:`-p` option, which defaults to 16.
-
-If :option:`-a` option is used, nghttp parses the resource pointed by
-URI given in command-line as html, and extracts resource links from
-it.  When requesting those resources, nghttp uses dependency according
-to its resource type.
-
-For CSS, and Javascript files inside "head" element, they depend on
-stream 3 with the weight 2.  The Javascript files outside "head"
-element depend on stream 5 with the weight 2.  The mages depend on
-stream 11 with the weight 12.  The other resources (e.g., icon) depend
-on stream 11 with the weight 2.
-
 SEE ALSO
 --------
 

doc/nghttpd.1

@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "NGHTTPD" "1" "May 19, 2024" "1.62.1" "nghttp2"
+.TH "NGHTTPD" "1" "Mar 18, 2026" "1.68.1" "nghttp2"
 .SH NAME
 nghttpd \- HTTP/2 server
 .SH SYNOPSIS
@@ -204,13 +204,15 @@ Don\(aqt send content\-length header field.
 .UNINDENT
 .INDENT 0.0
 .TP
-.B \-\-ktls
+.B \-\-groups=<GROUPS>
-Enable ktls.
+Specify the supported groups.
+.sp
+Default: \fBX25519:P\-256:P\-384:P\-521\fP
 .UNINDENT
 .INDENT 0.0
 .TP
-.B \-\-no\-rfc7540\-pri
+.B \-\-ktls
-Disable RFC7540 priorities.
+Enable ktls.
 .UNINDENT
 .INDENT 0.0
 .TP

doc/nghttpd.1.rst

@@ -159,14 +159,16 @@ OPTIONS
 
     Don't send content-length header field.
 
+.. option:: --groups=<GROUPS>
+
+    Specify the supported groups.
+
+    Default: ``X25519:P-256:P-384:P-521``
+
 .. option:: --ktls
 
     Enable ktls.
 
-.. option:: --no-rfc7540-pri
-
-    Disable RFC7540 priorities.
-
 .. option:: --version
 
     Display version information and exit.

doc/nghttpx.1

@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "NGHTTPX" "1" "May 19, 2024" "1.62.1" "nghttp2"
+.TH "NGHTTPX" "1" "Mar 18, 2026" "1.68.1" "nghttp2"
 .SH NAME
 nghttpx \- HTTP/2 proxy
 .SH SYNOPSIS
@@ -46,8 +46,7 @@ Set  path  to  server\(aqs private  key.   Required  unless
 .TP
 .B <CERT>
 Set  path  to  server\(aqs  certificate.   Required  unless
-\(dqno\-tls\(dq  parameter is  used in  \fI\%\-\-frontend\fP option.   To
+\(dqno\-tls\(dq  parameter is  used in  \fI\%\-\-frontend\fP option.
-make OCSP stapling work, this must be an absolute path.
 .UNINDENT
 .SH OPTIONS
 .sp
@@ -688,8 +687,8 @@ Default: \fB2m\fP
 .B \-\-ciphers=<SUITE>
 Set allowed  cipher list  for frontend  connection.  The
 format of the string is described in OpenSSL ciphers(1).
-This option  sets cipher suites for  TLSv1.2 or earlier.
+This  option  sets  cipher   suites  for  TLSv1.2.   Use
-Use \fI\%\-\-tls13\-ciphers\fP for TLSv1.3.
+\fI\%\-\-tls13\-ciphers\fP for TLSv1.3.
 .sp
 Default: \fBECDHE\-ECDSA\-AES128\-GCM\-SHA256:ECDHE\-RSA\-AES128\-GCM\-SHA256:ECDHE\-ECDSA\-AES256\-GCM\-SHA384:ECDHE\-RSA\-AES256\-GCM\-SHA384:ECDHE\-ECDSA\-CHACHA20\-POLY1305:ECDHE\-RSA\-CHACHA20\-POLY1305:DHE\-RSA\-AES128\-GCM\-SHA256:DHE\-RSA\-AES256\-GCM\-SHA384\fP
 .UNINDENT
@@ -699,7 +698,7 @@ Default: \fBECDHE\-ECDSA\-AES128\-GCM\-SHA256:ECDHE\-RSA\-AES128\-GCM\-SHA256:EC
 Set allowed  cipher list  for frontend  connection.  The
 format of the string is described in OpenSSL ciphers(1).
 This  option  sets  cipher   suites  for  TLSv1.3.   Use
-\fI\%\-\-ciphers\fP for TLSv1.2 or earlier.
+\fI\%\-\-ciphers\fP for TLSv1.2.
 .sp
 Default: \fBTLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256\fP
 .UNINDENT
@@ -708,8 +707,8 @@ Default: \fBTLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_
 .B \-\-client\-ciphers=<SUITE>
 Set  allowed cipher  list for  backend connection.   The
 format of the string is described in OpenSSL ciphers(1).
-This option  sets cipher suites for  TLSv1.2 or earlier.
+This  option  sets  cipher   suites  for  TLSv1.2.   Use
-Use \fI\%\-\-tls13\-client\-ciphers\fP for TLSv1.3.
+\fI\%\-\-tls13\-client\-ciphers\fP for TLSv1.3.
 .sp
 Default: \fBECDHE\-ECDSA\-AES128\-GCM\-SHA256:ECDHE\-RSA\-AES128\-GCM\-SHA256:ECDHE\-ECDSA\-AES256\-GCM\-SHA384:ECDHE\-RSA\-AES256\-GCM\-SHA384:ECDHE\-ECDSA\-CHACHA20\-POLY1305:ECDHE\-RSA\-CHACHA20\-POLY1305:DHE\-RSA\-AES128\-GCM\-SHA256:DHE\-RSA\-AES256\-GCM\-SHA384\fP
 .UNINDENT
@@ -719,15 +718,15 @@ Default: \fBECDHE\-ECDSA\-AES128\-GCM\-SHA256:ECDHE\-RSA\-AES128\-GCM\-SHA256:EC
 Set  allowed cipher  list for  backend connection.   The
 format of the string is described in OpenSSL ciphers(1).
 This  option  sets  cipher   suites  for  TLSv1.3.   Use
-\fI\%\-\-tls13\-client\-ciphers\fP for TLSv1.2 or earlier.
+\fI\%\-\-client\-ciphers\fP for TLSv1.2.
 .sp
 Default: \fBTLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256\fP
 .UNINDENT
 .INDENT 0.0
 .TP
-.B \-\-ecdh\-curves=<LIST>
+.B \-\-groups=<LIST>
-Set  supported  curve  list  for  frontend  connections.
+Set the  supported group list for  frontend connections.
-<LIST> is a  colon separated list of curve  NID or names
+<LIST> is a  colon separated list of group  NID or names
 in the preference order.  The supported curves depend on
 the  linked  OpenSSL  library.  This  function  requires
 OpenSSL >= 1.0.2.
@@ -745,12 +744,10 @@ enabled for backend connections.
 .B \-\-cacert=<PATH>
 Set path to trusted CA  certificate file.  It is used in
 backend  TLS connections  to verify  peer\(aqs certificate.
-It is also used to  verify OCSP response from the script
+The file must be in PEM format.  It can contain multiple
-set by \fI\%\-\-fetch\-ocsp\-response\-file\fP\&.  The  file must be in
+certificates.  If  the linked  OpenSSL is  configured to
-PEM format.   It can contain multiple  certificates.  If
+load  system  wide  certificates,  they  are  loaded  at
-the  linked OpenSSL  is configured  to load  system wide
+startup regardless of this option.
-certificates, they  are loaded at startup  regardless of
-this option.
 .UNINDENT
 .INDENT 0.0
 .TP
@@ -765,13 +762,12 @@ password protected it\(aqll be requested interactively.
 Specify  additional certificate  and  private key  file.
 nghttpx will  choose certificates based on  the hostname
 indicated by client using TLS SNI extension.  If nghttpx
-is  built with  OpenSSL  >= 1.0.2,  the shared  elliptic
+is built with OpenSSL >= 1.0.2, the signature algorithms
-curves (e.g., P\-256) between  client and server are also
+(e.g., ECDSA+SHA256) presented by  client are also taken
-taken into  consideration.  This allows nghttpx  to send
+into consideration.  This allows  nghttpx to send ML\-DSA
-ECDSA certificate  to modern clients, while  sending RSA
+or ECDSA  certificate to  modern clients,  while sending
-based certificate to older  clients.  This option can be
+RSA based certificate to older clients.  This option can
-used  multiple  times.   To  make  OCSP  stapling  work,
+be used multiple times.
-<CERTPATH> must be absolute path.
 .sp
 Additional parameter  can be specified in  <PARAM>.  The
 available <PARAM> is \(dqsct\-dir=<DIR>\(dq.
@@ -798,7 +794,7 @@ protocol comes  first.  The parameter must  be delimited
 by a single comma only  and any white spaces are treated
 as a part of protocol string.
 .sp
-Default: \fBh2,h2\-16,h2\-14,http/1.1\fP
+Default: \fBh2,http/1.1\fP
 .UNINDENT
 .INDENT 0.0
 .TP
@@ -840,12 +836,8 @@ done in  case\-insensitive manner.  The  versions between
 \fI\%\-\-tls\-min\-proto\-version\fP and  \fI\%\-\-tls\-max\-proto\-version\fP are
 enabled.  If the protocol list advertised by client does
 not  overlap  this range,  you  will  receive the  error
-message \(dqunknown protocol\(dq.  If a protocol version lower
+message \(dqunknown protocol\(dq.  The available versions are:
-than TLSv1.2 is specified, make sure that the compatible
+TLSv1.3 and TLSv1.2
-ciphers are  included in \fI\%\-\-ciphers\fP option.   The default
-cipher  list  only   includes  ciphers  compatible  with
-TLSv1.2 or above.  The available versions are:
-TLSv1.3, TLSv1.2, TLSv1.1, and TLSv1.0
 .sp
 Default: \fBTLSv1.2\fP
 .UNINDENT
@@ -858,7 +850,7 @@ done in  case\-insensitive manner.  The  versions between
 enabled.  If the protocol list advertised by client does
 not  overlap  this range,  you  will  receive the  error
 message \(dqunknown protocol\(dq.  The available versions are:
-TLSv1.3, TLSv1.2, TLSv1.1, and TLSv1.0
+TLSv1.3 and TLSv1.2
 .sp
 Default: \fBTLSv1.3\fP
 .UNINDENT
@@ -962,72 +954,6 @@ get TLS ticket keys.
 .UNINDENT
 .INDENT 0.0
 .TP
-.B \-\-fetch\-ocsp\-response\-file=<PATH>
-Path to  fetch\-ocsp\-response script file.  It  should be
-absolute path.
-.sp
-Default: \fB/usr/local/share/nghttp2/fetch\-ocsp\-response\fP
-.UNINDENT
-.INDENT 0.0
-.TP
-.B \-\-ocsp\-update\-interval=<DURATION>
-Set interval to update OCSP response cache.
-.sp
-Default: \fB4h\fP
-.UNINDENT
-.INDENT 0.0
-.TP
-.B \-\-ocsp\-startup
-Start  accepting connections  after initial  attempts to
-get OCSP responses  finish.  It does not  matter some of
-the  attempts  fail.  This  feature  is  useful if  OCSP
-responses   must    be   available    before   accepting
-connections.
-.UNINDENT
-.INDENT 0.0
-.TP
-.B \-\-no\-verify\-ocsp
-nghttpx does not verify OCSP response.
-.UNINDENT
-.INDENT 0.0
-.TP
-.B \-\-no\-ocsp
-Disable OCSP stapling.
-.UNINDENT
-.INDENT 0.0
-.TP
-.B \-\-tls\-session\-cache\-memcached=<HOST>,<PORT>[;tls]
-Specify  address of  memcached server  to store  session
-cache.   This  enables   shared  session  cache  between
-multiple   nghttpx  instances.    Optionally,  memcached
-connection can be encrypted with TLS by specifying \(dqtls\(dq
-parameter.
-.UNINDENT
-.INDENT 0.0
-.TP
-.B \-\-tls\-session\-cache\-memcached\-address\-family=(auto|IPv4|IPv6)
-Specify address family of memcached connections to store
-session cache.  If  \(dqauto\(dq is given, both  IPv4 and IPv6
-are considered.   If \(dqIPv4\(dq is given,  only IPv4 address
-is considered.  If \(dqIPv6\(dq is given, only IPv6 address is
-considered.
-.sp
-Default: \fBauto\fP
-.UNINDENT
-.INDENT 0.0
-.TP
-.B \-\-tls\-session\-cache\-memcached\-cert\-file=<PATH>
-Path to client certificate  for memcached connections to
-store session cache.
-.UNINDENT
-.INDENT 0.0
-.TP
-.B \-\-tls\-session\-cache\-memcached\-private\-key\-file=<PATH>
-Path to client private  key for memcached connections to
-store session cache.
-.UNINDENT
-.INDENT 0.0
-.TP
 .B \-\-tls\-dyn\-rec\-warmup\-threshold=<SIZE>
 Specify the  threshold size for TLS  dynamic record size
 behaviour.  During  a TLS  session, after  the threshold
@@ -1135,8 +1061,7 @@ Default: \fB16K\fP
 .INDENT 0.0
 .TP
 .B \-\-tls\-ktls
-Enable   ktls.    For   server,  ktls   is   enable   if
+Enable ktls.
-\fI\%\-\-tls\-session\-cache\-memcached\fP is not configured.
 .UNINDENT
 .SS HTTP/2
 .INDENT 0.0
@@ -1675,7 +1600,7 @@ initial  DNS  query.  For  the  2nd  and later  queries,
 server is  given time based  on this timeout, and  it is
 scaled linearly.
 .sp
-Default: \fB5s\fP
+Default: \fB250ms\fP
 .UNINDENT
 .INDENT 0.0
 .TP
@@ -1683,7 +1608,7 @@ Default: \fB5s\fP
 Set the number of DNS query before nghttpx gives up name
 lookup.
 .sp
-Default: \fB2\fP
+Default: \fB3\fP
 .UNINDENT
 .INDENT 0.0
 .TP
@@ -2003,11 +1928,9 @@ request header field, do this:
 .INDENT 7.0
 .INDENT 3.5
 .sp
-.nf
+.EX
-.ft C
 add\-request\-header=foo: bar
-.ft P
+.EE
-.fi
 .UNINDENT
 .UNINDENT
 .sp
@@ -2015,11 +1938,9 @@ instead of:
 .INDENT 7.0
 .INDENT 3.5
 .sp
-.nf
+.EX
-.ft C
 add\-request\-header=\(dqfoo: bar\(dq
-.ft P
+.EE
-.fi
 .UNINDENT
 .UNINDENT
 .sp
@@ -2124,12 +2045,10 @@ header field to initiate server push:
 .INDENT 0.0
 .INDENT 3.5
 .sp
-.nf
+.EX
-.ft C
 Link: </fonts/font.woff>; rel=preload
 Link: </css/theme.css>; rel=preload
-.ft P
+.EE
-.fi
 .UNINDENT
 .UNINDENT
 .sp
@@ -2160,35 +2079,6 @@ specified socket already exists in the file system, nghttpx first
 deletes it.  However, if SIGUSR2 is used to execute new binary and
 both old and new configurations use same filename, new binary does not
 delete the socket and continues to use it.
-.SH OCSP STAPLING
-.sp
-OCSP query is done using external Python script
-\fBfetch\-ocsp\-response\fP, which has been originally developed in Perl
-as part of h2o project (\X'tty: link https://github.com/h2o/h2o'\fI\%https://github.com/h2o/h2o\fP\X'tty: link'), and was
-translated into Python.
-.sp
-The script file is usually installed under
-\fB$(prefix)/share/nghttp2/\fP directory.  The actual path to script can
-be customized using \fI\%\-\-fetch\-ocsp\-response\-file\fP option.
-.sp
-If OCSP query is failed, previous OCSP response, if any, is continued
-to be used.
-.sp
-\fI\%\-\-fetch\-ocsp\-response\-file\fP option provides wide range of
-possibility to manage OCSP response.  It can take an arbitrary script
-or executable.  The requirement is that it supports the command\-line
-interface of \fBfetch\-ocsp\-response\fP script, and it must return a
-valid DER encoded OCSP response on success.  It must return exit code
-0 on success, and 75 for temporary error, and the other error code for
-generic failure.  For large cluster of servers, it is not efficient
-for each server to perform OCSP query using \fBfetch\-ocsp\-response\fP\&.
-Instead, you can retrieve OCSP response in some way, and store it in a
-disk or a shared database.  Then specify a program in
-\fI\%\-\-fetch\-ocsp\-response\-file\fP to fetch it from those stores.
-This could provide a way to share the OCSP response between fleet of
-servers, and also any OCSP query strategy can be applied which may be
-beyond the ability of nghttpx itself or \fBfetch\-ocsp\-response\fP
-script.
 .SH TLS SESSION RESUMPTION
 .sp
 nghttpx supports TLS session resumption through both session ID and
@@ -2196,16 +2086,6 @@ session ticket.
 .SS SESSION ID RESUMPTION
 .sp
 By default, session ID is shared by all worker threads.
-.sp
-If \fI\%\-\-tls\-session\-cache\-memcached\fP is given, nghttpx will
-insert serialized session data to memcached with
-\fBnghttpx:tls\-session\-cache:\fP + lowercase hex string of session ID
-as a memcached entry key, with expiry time 12 hours.  Session timeout
-is set to 12 hours.
-.sp
-By default, connections to memcached server are not encrypted.  To
-enable encryption, use \fBtls\fP keyword in
-\fI\%\-\-tls\-session\-cache\-memcached\fP option.
 .SS TLS SESSION TICKET RESUMPTION
 .sp
 By default, session ticket is shared by all worker threads.  The
@@ -2224,8 +2104,7 @@ memcached is the binary format described below:
 .INDENT 0.0
 .INDENT 3.5
 .sp
-.nf
+.EX
-.ft C
 +\-\-\-\-\-\-\-\-\-\-\-\-\-\-+\-\-\-\-\-\-\-+\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-+
 | VERSION (4)  |LEN (2)|KEY(48 or 80) ...
 +\-\-\-\-\-\-\-\-\-\-\-\-\-\-+\-\-\-\-\-\-\-+\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-+
@@ -2233,8 +2112,7 @@ memcached is the binary format described below:
                |                        |
                +\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-+
                (LEN, KEY) pair can be repeated
-.ft P
+.EE
-.fi
 .UNINDENT
 .UNINDENT
 .sp
@@ -2651,8 +2529,7 @@ Modify request path:
 .INDENT 0.0
 .INDENT 3.5
 .sp
-.nf
+.EX
-.ft C
 class App
   def on_req(env)
     env.req.path = \(dq/apps#{env.req.path}\(dq
@@ -2660,8 +2537,7 @@ class App
 end
 
 App.new
-.ft P
+.EE
-.fi
 .UNINDENT
 .UNINDENT
 .sp
@@ -2672,8 +2548,7 @@ addresses:
 .INDENT 0.0
 .INDENT 3.5
 .sp
-.nf
+.EX
-.ft C
 class App
   def on_req(env)
     allowed_clients = [\(dq127.0.0.1\(dq, \(dq::1\(dq]
@@ -2687,8 +2562,7 @@ class App
 end
 
 App.new
-.ft P
+.EE
-.fi
 .UNINDENT
 .UNINDENT
 .SH API ENDPOINTS

doc/nghttpx.1.rst

@@ -25,8 +25,7 @@ A reverse proxy for HTTP/3, HTTP/2, and HTTP/1.
 .. describe:: <CERT>
 
     Set  path  to  server's  certificate.   Required  unless
-    "no-tls"  parameter is  used in  :option:`--frontend` option.   To
+    "no-tls"  parameter is  used in  :option:`--frontend` option.
-    make OCSP stapling work, this must be an absolute path.
 
 
 OPTIONS
@@ -644,8 +643,8 @@ SSL/TLS
 
     Set allowed  cipher list  for frontend  connection.  The
     format of the string is described in OpenSSL ciphers(1).
-    This option  sets cipher suites for  TLSv1.2 or earlier.
+    This  option  sets  cipher   suites  for  TLSv1.2.   Use
-    Use :option:`--tls13-ciphers` for TLSv1.3.
+    :option:`--tls13-ciphers` for TLSv1.3.
 
     Default: ``ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384``
 
@@ -654,7 +653,7 @@ SSL/TLS
     Set allowed  cipher list  for frontend  connection.  The
     format of the string is described in OpenSSL ciphers(1).
     This  option  sets  cipher   suites  for  TLSv1.3.   Use
-    :option:`--ciphers` for TLSv1.2 or earlier.
+    :option:`--ciphers` for TLSv1.2.
 
     Default: ``TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256``
 
@@ -662,8 +661,8 @@ SSL/TLS
 
     Set  allowed cipher  list for  backend connection.   The
     format of the string is described in OpenSSL ciphers(1).
-    This option  sets cipher suites for  TLSv1.2 or earlier.
+    This  option  sets  cipher   suites  for  TLSv1.2.   Use
-    Use :option:`--tls13-client-ciphers` for TLSv1.3.
+    :option:`--tls13-client-ciphers` for TLSv1.3.
 
     Default: ``ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384``
 
@@ -672,14 +671,14 @@ SSL/TLS
     Set  allowed cipher  list for  backend connection.   The
     format of the string is described in OpenSSL ciphers(1).
     This  option  sets  cipher   suites  for  TLSv1.3.   Use
-    :option:`--tls13-client-ciphers` for TLSv1.2 or earlier.
+    :option:`--client-ciphers` for TLSv1.2.
 
     Default: ``TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256``
 
-.. option:: --ecdh-curves=<LIST>
+.. option:: --groups=<LIST>
 
-    Set  supported  curve  list  for  frontend  connections.
+    Set the  supported group list for  frontend connections.
-    <LIST> is a  colon separated list of curve  NID or names
+    <LIST> is a  colon separated list of group  NID or names
     in the preference order.  The supported curves depend on
     the  linked  OpenSSL  library.  This  function  requires
     OpenSSL >= 1.0.2.
@@ -695,12 +694,10 @@ SSL/TLS
 
     Set path to trusted CA  certificate file.  It is used in
     backend  TLS connections  to verify  peer's certificate.
-    It is also used to  verify OCSP response from the script
+    The file must be in PEM format.  It can contain multiple
-    set by :option:`--fetch-ocsp-response-file`\.  The  file must be in
+    certificates.  If  the linked  OpenSSL is  configured to
-    PEM format.   It can contain multiple  certificates.  If
+    load  system  wide  certificates,  they  are  loaded  at
-    the  linked OpenSSL  is configured  to load  system wide
+    startup regardless of this option.
-    certificates, they  are loaded at startup  regardless of
-    this option.
 
 .. option:: --private-key-passwd-file=<PATH>
 
@@ -713,13 +710,12 @@ SSL/TLS
     Specify  additional certificate  and  private key  file.
     nghttpx will  choose certificates based on  the hostname
     indicated by client using TLS SNI extension.  If nghttpx
-    is  built with  OpenSSL  >= 1.0.2,  the shared  elliptic
+    is built with OpenSSL >= 1.0.2, the signature algorithms
-    curves (e.g., P-256) between  client and server are also
+    (e.g., ECDSA+SHA256) presented by  client are also taken
-    taken into  consideration.  This allows nghttpx  to send
+    into consideration.  This allows  nghttpx to send ML-DSA
-    ECDSA certificate  to modern clients, while  sending RSA
+    or ECDSA  certificate to  modern clients,  while sending
-    based certificate to older  clients.  This option can be
+    RSA based certificate to older clients.  This option can
-    used  multiple  times.   To  make  OCSP  stapling  work,
+    be used multiple times.
-    <CERTPATH> must be absolute path.
 
     Additional parameter  can be specified in  <PARAM>.  The
     available <PARAM> is "sct-dir=<DIR>".
@@ -744,7 +740,7 @@ SSL/TLS
     by a single comma only  and any white spaces are treated
     as a part of protocol string.
 
-    Default: ``h2,h2-16,h2-14,http/1.1``
+    Default: ``h2,http/1.1``
 
 .. option:: --verify-client
 
@@ -780,12 +776,8 @@ SSL/TLS
     :option:`--tls-min-proto-version` and  :option:`\--tls-max-proto-version` are
     enabled.  If the protocol list advertised by client does
     not  overlap  this range,  you  will  receive the  error
-    message "unknown protocol".  If a protocol version lower
+    message "unknown protocol".  The available versions are:
-    than TLSv1.2 is specified, make sure that the compatible
+    TLSv1.3 and TLSv1.2
-    ciphers are  included in :option:`--ciphers` option.   The default
-    cipher  list  only   includes  ciphers  compatible  with
-    TLSv1.2 or above.  The available versions are:
-    TLSv1.3, TLSv1.2, TLSv1.1, and TLSv1.0
 
     Default: ``TLSv1.2``
 
@@ -797,7 +789,7 @@ SSL/TLS
     enabled.  If the protocol list advertised by client does
     not  overlap  this range,  you  will  receive the  error
     message "unknown protocol".  The available versions are:
-    TLSv1.3, TLSv1.2, TLSv1.1, and TLSv1.0
+    TLSv1.3 and TLSv1.2
 
     Default: ``TLSv1.3``
 
@@ -890,63 +882,6 @@ SSL/TLS
     Path to client private  key for memcached connections to
     get TLS ticket keys.
 
-.. option:: --fetch-ocsp-response-file=<PATH>
-
-    Path to  fetch-ocsp-response script file.  It  should be
-    absolute path.
-
-    Default: ``/usr/local/share/nghttp2/fetch-ocsp-response``
-
-.. option:: --ocsp-update-interval=<DURATION>
-
-    Set interval to update OCSP response cache.
-
-    Default: ``4h``
-
-.. option:: --ocsp-startup
-
-    Start  accepting connections  after initial  attempts to
-    get OCSP responses  finish.  It does not  matter some of
-    the  attempts  fail.  This  feature  is  useful if  OCSP
-    responses   must    be   available    before   accepting
-    connections.
-
-.. option:: --no-verify-ocsp
-
-    nghttpx does not verify OCSP response.
-
-.. option:: --no-ocsp
-
-    Disable OCSP stapling.
-
-.. option:: --tls-session-cache-memcached=<HOST>,<PORT>[;tls]
-
-    Specify  address of  memcached server  to store  session
-    cache.   This  enables   shared  session  cache  between
-    multiple   nghttpx  instances.    Optionally,  memcached
-    connection can be encrypted with TLS by specifying "tls"
-    parameter.
-
-.. option:: --tls-session-cache-memcached-address-family=(auto|IPv4|IPv6)
-
-    Specify address family of memcached connections to store
-    session cache.  If  "auto" is given, both  IPv4 and IPv6
-    are considered.   If "IPv4" is given,  only IPv4 address
-    is considered.  If "IPv6" is given, only IPv6 address is
-    considered.
-
-    Default: ``auto``
-
-.. option:: --tls-session-cache-memcached-cert-file=<PATH>
-
-    Path to client certificate  for memcached connections to
-    store session cache.
-
-.. option:: --tls-session-cache-memcached-private-key-file=<PATH>
-
-    Path to client private  key for memcached connections to
-    store session cache.
-
 .. option:: --tls-dyn-rec-warmup-threshold=<SIZE>
 
     Specify the  threshold size for TLS  dynamic record size
@@ -1046,8 +981,7 @@ SSL/TLS
 
 .. option:: --tls-ktls
 
-    Enable   ktls.    For   server,  ktls   is   enable   if
+    Enable ktls.
-    :option:`--tls-session-cache-memcached` is not configured.
 
 
 HTTP/2
@@ -1524,14 +1458,14 @@ DNS
     server is  given time based  on this timeout, and  it is
     scaled linearly.
 
-    Default: ``5s``
+    Default: ``250ms``
 
 .. option:: --dns-max-try=<N>
 
     Set the number of DNS query before nghttpx gives up name
     lookup.
 
-    Default: ``2``
+    Default: ``3``
 
 .. option:: --frontend-max-requests=<N>
 
@@ -1971,37 +1905,6 @@ deletes it.  However, if SIGUSR2 is used to execute new binary and
 both old and new configurations use same filename, new binary does not
 delete the socket and continues to use it.
 
-OCSP STAPLING
--------------
-
-OCSP query is done using external Python script
-``fetch-ocsp-response``, which has been originally developed in Perl
-as part of h2o project (https://github.com/h2o/h2o), and was
-translated into Python.
-
-The script file is usually installed under
-``$(prefix)/share/nghttp2/`` directory.  The actual path to script can
-be customized using :option:`--fetch-ocsp-response-file` option.
-
-If OCSP query is failed, previous OCSP response, if any, is continued
-to be used.
-
-:option:`--fetch-ocsp-response-file` option provides wide range of
-possibility to manage OCSP response.  It can take an arbitrary script
-or executable.  The requirement is that it supports the command-line
-interface of ``fetch-ocsp-response`` script, and it must return a
-valid DER encoded OCSP response on success.  It must return exit code
-0 on success, and 75 for temporary error, and the other error code for
-generic failure.  For large cluster of servers, it is not efficient
-for each server to perform OCSP query using ``fetch-ocsp-response``.
-Instead, you can retrieve OCSP response in some way, and store it in a
-disk or a shared database.  Then specify a program in
-:option:`--fetch-ocsp-response-file` to fetch it from those stores.
-This could provide a way to share the OCSP response between fleet of
-servers, and also any OCSP query strategy can be applied which may be
-beyond the ability of nghttpx itself or ``fetch-ocsp-response``
-script.
-
 TLS SESSION RESUMPTION
 ----------------------
 
@@ -2013,16 +1916,6 @@ SESSION ID RESUMPTION
 
 By default, session ID is shared by all worker threads.
 
-If :option:`--tls-session-cache-memcached` is given, nghttpx will
-insert serialized session data to memcached with
-``nghttpx:tls-session-cache:`` + lowercase hex string of session ID
-as a memcached entry key, with expiry time 12 hours.  Session timeout
-is set to 12 hours.
-
-By default, connections to memcached server are not encrypted.  To
-enable encryption, use ``tls`` keyword in
-:option:`--tls-session-cache-memcached` option.
-
 TLS SESSION TICKET RESUMPTION
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

doc/nghttpx.h2r

@@ -156,37 +156,6 @@ deletes it.  However, if SIGUSR2 is used to execute new binary and
 both old and new configurations use same filename, new binary does not
 delete the socket and continues to use it.
 
-OCSP STAPLING
--------------
-
-OCSP query is done using external Python script
-``fetch-ocsp-response``, which has been originally developed in Perl
-as part of h2o project (https://github.com/h2o/h2o), and was
-translated into Python.
-
-The script file is usually installed under
-``$(prefix)/share/nghttp2/`` directory.  The actual path to script can
-be customized using :option:`--fetch-ocsp-response-file` option.
-
-If OCSP query is failed, previous OCSP response, if any, is continued
-to be used.
-
-:option:`--fetch-ocsp-response-file` option provides wide range of
-possibility to manage OCSP response.  It can take an arbitrary script
-or executable.  The requirement is that it supports the command-line
-interface of ``fetch-ocsp-response`` script, and it must return a
-valid DER encoded OCSP response on success.  It must return exit code
-0 on success, and 75 for temporary error, and the other error code for
-generic failure.  For large cluster of servers, it is not efficient
-for each server to perform OCSP query using ``fetch-ocsp-response``.
-Instead, you can retrieve OCSP response in some way, and store it in a
-disk or a shared database.  Then specify a program in
-:option:`--fetch-ocsp-response-file` to fetch it from those stores.
-This could provide a way to share the OCSP response between fleet of
-servers, and also any OCSP query strategy can be applied which may be
-beyond the ability of nghttpx itself or ``fetch-ocsp-response``
-script.
-
 TLS SESSION RESUMPTION
 ----------------------
 
@@ -198,16 +167,6 @@ SESSION ID RESUMPTION
 
 By default, session ID is shared by all worker threads.
 
-If :option:`--tls-session-cache-memcached` is given, nghttpx will
-insert serialized session data to memcached with
-``nghttpx:tls-session-cache:`` + lowercase hex string of session ID
-as a memcached entry key, with expiry time 12 hours.  Session timeout
-is set to 12 hours.
-
-By default, connections to memcached server are not encrypted.  To
-enable encryption, use ``tls`` keyword in
-:option:`--tls-session-cache-memcached` option.
-
 TLS SESSION TICKET RESUMPTION
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

doc/programmers-guide.rst

@@ -482,20 +482,22 @@ be called as usual.
 Stream priorities
 -----------------
 
-By default, the stream prioritization scheme described in :rfc:`7540`
+The stream prioritization scheme described in :rfc:`7540`, which has
-is used.  This scheme has been formally deprecated by :rfc:`9113`.  In
+been formally deprecated by :rfc:`9113`, has been removed.  An
-order to disable it, send
+application is advised to send
 :enum:`nghttp2_settings_id.NGHTTP2_SETTINGS_NO_RFC7540_PRIORITIES` of
-value of 1 via `nghttp2_submit_settings()`.  This settings ID is
+value of 1 via `nghttp2_submit_settings()`, and migrate to
-defined by :rfc:`9218`.  The sender of this settings value disables
+:rfc:`9218`.
-RFC 7540 priorities, and instead it enables RFC 9218 Extensible
+
-Prioritization Scheme.  This new prioritization scheme has 2 methods
+The sender of this settings value disables :rfc:`7540` priorities, and
-to convey the stream priorities to a remote endpoint: Priority header
+instead it enables :rfc:`9218` Extensible Prioritization Scheme.  This
-field and PRIORITY_UPDATE frame.  nghttp2 supports both methods.  In
+new prioritization scheme has 2 methods to convey the stream
-order to receive and process PRIORITY_UPDATE frame, server has to call
+priorities to a remote endpoint: Priority header field and
-``nghttp2_option_set_builtin_recv_extension_type(option,
+PRIORITY_UPDATE frame.  nghttp2 supports both methods.  In order to
-NGHTTP2_PRIORITY_UPDATE)`` (see the above section), and pass the
+receive and process PRIORITY_UPDATE frame, server has to call
-option to `nghttp2_session_server_new2()` or
+`nghttp2_option_set_builtin_recv_extension_type()` with
+NGHTTP2_PRIORITY_UPDATE as type argument (see the above section), and
+pass the option to `nghttp2_session_server_new2()` or
 `nghttp2_session_server_new3()` to create a server session.  Client
 can send Priority header field via `nghttp2_submit_request2()`.  It
 can also send PRIORITY_UPDATE frame via
@@ -503,24 +505,3 @@ can also send PRIORITY_UPDATE frame via
 field in a request header field and updates the stream priority unless
 HTTP messaging rule enforcement is disabled (see
 `nghttp2_option_set_no_http_messaging()`).
-
-For the purpose of smooth migration from RFC 7540 priorities, client
-is advised to send
-:enum:`nghttp2_settings_id.NGHTTP2_SETTINGS_NO_RFC7540_PRIORITIES` of
-value of 1.  Until it receives the first server SETTINGS frame, it can
-send both RFC 7540 and RFC 9128 priority signals.  If client receives
-SETTINGS_NO_RFC7540_PRIORITIES of value of 0, or it is omitted ,
-client stops sending PRIORITY_UPDATE frame.  Priority header field
-will be sent in anyway since it is an end-to-end signal.  If
-SETTINGS_NO_RFC7540_PRIORITIES of value of 1 is received, client stops
-sending RFC 7540 priority signals.  This is the advice described in
-:rfc:`9218#section-2.1.1`.
-
-Server has an optional mechanism to fallback to RFC 7540 priorities.
-By default, if server sends SETTINGS_NO_RFC7540_PRIORITIES of value of
-1, it completely disables RFC 7540 priorities and no fallback.  By
-setting nonzero value to
-`nghttp2_option_set_server_fallback_rfc7540_priorities()`, server
-falls back to RFC 7540 priorities if it sends
-SETTINGS_NO_RFC7540_PRIORITIES value of value of 1, and client omits
-SETTINGS_NO_RFC7540_PRIORITIES in its SETTINGS frame.

doc/sources/contribute.rst

@@ -26,7 +26,7 @@ Coding style
 We use clang-format to format source code consistently.  The
 clang-format configuration file .clang-format is located at the root
 directory.  Since clang-format produces slightly different results
-between versions, we currently use clang-format-15.
+between versions, we currently use clang-format-19.
 
 To detect any violation to the coding style, we recommend to setup git
 pre-commit hook to check coding style of the changes you introduced.
@@ -34,7 +34,7 @@ The pre-commit file is located at the root directory.  Copy it under
 .git/hooks and make sure that it is executable.  The pre-commit script
 uses clang-format-diff.py to detect any style errors.  If it is not in
 your PATH or it exists under different name (e.g.,
-clang-format-diff-14 in debian), either add it to PATH variable or add
+clang-format-diff-18 in debian), either add it to PATH variable or add
 git option ``clangformatdiff.binary`` to point to the script.
 
 For emacs users, integrating clang-format to emacs is very easy.

doc/sources/nghttpx-howto.rst

@@ -167,8 +167,7 @@ Enable SSL/TLS on memcached connection
 
 By default, memcached connection is not encrypted.  To enable
 encryption, use ``tls`` keyword in
-:option:`--tls-ticket-key-memcached` for TLS ticket key, and
+:option:`--tls-ticket-key-memcached`.
-:option:`--tls-session-cache-memcached` for TLS session cache.
 
 Specifying additional server certificates
 -----------------------------------------

doc/sources/tutorial-client.rst

@@ -63,7 +63,7 @@ structure is defined as follows::
       /* The NULL-terminated URI string to retrieve. */
       const char *uri;
       /* Parsed result of the |uri| */
-      struct http_parser_url *u;
+      urlparse_url *u;
       /* The authority portion of the |uri|, not NULL-terminated */
       char *authority;
       /* The path portion of the |uri|, including query, not
@@ -237,11 +237,11 @@ HTTP request in the ``submit_request()`` function::
       int32_t stream_id;
       http2_stream_data *stream_data = session_data->stream_data;
       const char *uri = stream_data->uri;
-      const struct http_parser_url *u = stream_data->u;
+      const urlparse_url *u = stream_data->u;
       nghttp2_nv hdrs[] = {
           MAKE_NV2(":method", "GET"),
-          MAKE_NV(":scheme", &uri[u->field_data[UF_SCHEMA].off],
+          MAKE_NV(":scheme", &uri[u->field_data[URLPARSE_SCHEMA].off],
-                  u->field_data[UF_SCHEMA].len),
+                  u->field_data[URLPARSE_SCHEMA].len),
           MAKE_NV(":authority", stream_data->authority, stream_data->authoritylen),
           MAKE_NV(":path", stream_data->path, stream_data->pathlen)};
       fprintf(stderr, "Request headers:\n");

docker/Dockerfile

@@ -4,32 +4,36 @@ ARG NGHTTP2_BRANCH=master
 
 RUN apt-get update && \
     DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
-        git clang make binutils autoconf automake autotools-dev libtool \
+        git clang-19 make binutils autoconf automake autotools-dev libtool \
         pkg-config cmake cmake-data \
         zlib1g-dev libev-dev libjemalloc-dev ruby-dev libc-ares-dev bison \
         libelf-dev libbrotli-dev
 
-RUN git clone --recursive --depth 1 -b v1.26.0 https://github.com/aws/aws-lc && \
+RUN git clone --recursive --shallow-submodules --depth 1 -b v1.62.0 https://github.com/aws/aws-lc && \
     cd aws-lc && \
+    export CC=clang-19 CXX=clang++-19 && \
     cmake -B build -DDISABLE_GO=ON && \
     make -j$(nproc) -C build && \
     cmake --install build && \
     cd .. && \
     rm -rf aws-lc
 
-RUN git clone --recursive --depth 1 -b v1.3.0 https://github.com/ngtcp2/nghttp3 && \
+RUN git clone --recursive --shallow-submodules --depth 1 -b v1.12.0 https://github.com/ngtcp2/nghttp3 && \
     cd nghttp3 && \
     autoreconf -i && \
-    ./configure --enable-lib-only && \
+    ./configure --disable-dependency-tracking --enable-lib-only \
+        CC=clang-19 CXX=clang++-19 && \
     make -j$(nproc) && \
     make install-strip && \
     cd .. && \
     rm -rf nghttp3
 
-RUN git clone --recursive --depth 1 -b v1.5.0 https://github.com/ngtcp2/ngtcp2 && \
+RUN git clone --recursive --shallow-submodules --depth 1 -b v1.17.0 https://github.com/ngtcp2/ngtcp2 && \
     cd ngtcp2 && \
     autoreconf -i && \
-    ./configure --enable-lib-only --with-boringssl \
+    ./configure --disable-dependency-tracking --enable-lib-only \
+        --with-boringssl \
+        CC=clang-19 CXX=clang++-19 \
         LIBTOOL_LDFLAGS="-static-libtool-libs" \
         BORINGSSL_LIBS="-l:libssl.a -l:libcrypto.a" \
         PKG_CONFIG_PATH="/usr/local/lib64/pkgconfig" && \
@@ -38,20 +42,21 @@ RUN git clone --recursive --depth 1 -b v1.5.0 https://github.com/ngtcp2/ngtcp2 &
     cd .. && \
     rm -rf ngtcp2
 
-RUN git clone --depth 1 -b v1.3.0 https://github.com/libbpf/libbpf && \
+RUN git clone --depth 1 -b v1.6.2 https://github.com/libbpf/libbpf && \
     cd libbpf && \
-    PREFIX=/usr/local make -C src install && \
+    CC=clang-19 PREFIX=/usr/local make -C src install && \
     cd .. && \
     rm -rf libbpf
 
-RUN git clone --recursive --depth 1 -b $NGHTTP2_BRANCH https://github.com/nghttp2/nghttp2 && \
+RUN git clone --recursive --shallow-submodules --depth 1 -b $NGHTTP2_BRANCH https://github.com/nghttp2/nghttp2 && \
     cd nghttp2 && \
     autoreconf -i && \
-    ./configure --disable-examples --disable-hpack-tools \
+    ./configure --disable-dependency-tracking --disable-examples \
+        --disable-hpack-tools \
         --with-mruby \
         --enable-http3 --with-libbpf \
         --with-libbrotlienc --with-libbrotlidec \
-        CC=clang CXX=clang++ \
+        CC=clang-19 CXX=clang++-19 \
         LIBTOOL_LDFLAGS="-static-libtool-libs" \
         OPENSSL_LIBS="-l:libssl.a -l:libcrypto.a" \
         LIBEV_LIBS="-l:libev.a" \
@@ -69,9 +74,6 @@ RUN git clone --recursive --depth 1 -b $NGHTTP2_BRANCH https://github.com/nghttp
 
 FROM gcr.io/distroless/base-nossl-debian12
 
-COPY --from=build --link \
-    /usr/local/share/nghttp2/ \
-    /usr/local/share/nghttp2/
 COPY --from=build --link \
     /usr/local/bin/h2load \
     /usr/local/bin/nghttpx \

examples/CMakeLists.txt

@@ -8,7 +8,7 @@ if(ENABLE_EXAMPLES)
 
   include_directories(
     ${CMAKE_CURRENT_SOURCE_DIR}
-    "${CMAKE_CURRENT_SOURCE_DIR}/../third-party"
+    "${CMAKE_CURRENT_SOURCE_DIR}/../third-party/urlparse"
     "${CMAKE_CURRENT_SOURCE_DIR}/../third-party/llhttp/include"
 
     ${LIBEVENT_INCLUDE_DIRS}
@@ -23,15 +23,15 @@ if(ENABLE_EXAMPLES)
   )
 
   add_executable(client           client.c $<TARGET_OBJECTS:llhttp>
-    $<TARGET_OBJECTS:url-parser>
+    $<TARGET_OBJECTS:urlparse>
   )
   add_executable(libevent-client  libevent-client.c $<TARGET_OBJECTS:llhttp>
-    $<TARGET_OBJECTS:url-parser>
+    $<TARGET_OBJECTS:urlparse>
   )
   add_executable(libevent-server  libevent-server.c $<TARGET_OBJECTS:llhttp>
-    $<TARGET_OBJECTS:url-parser>
+    $<TARGET_OBJECTS:urlparse>
   )
   add_executable(deflate          deflate.c $<TARGET_OBJECTS:llhttp>
-    $<TARGET_OBJECTS:url-parser>
+    $<TARGET_OBJECTS:urlparse>
   )
 endif()

examples/Makefile.am

@@ -30,13 +30,13 @@ AM_CXXFLAGS = $(WARNCXXFLAGS) $(CXX1XCXXFLAGS)
 AM_CPPFLAGS = \
 	-I$(top_srcdir)/lib/includes \
 	-I$(top_builddir)/lib/includes \
-	-I$(top_srcdir)/third-party \
+	-I$(top_srcdir)/third-party/urlparse \
 	@LIBEVENT_OPENSSL_CFLAGS@ \
 	@OPENSSL_CFLAGS@ \
 	@DEFS@
 AM_LDFLAGS = @LIBTOOL_LDFLAGS@
 LDADD = $(top_builddir)/lib/libnghttp2.la \
-	$(top_builddir)/third-party/liburl-parser.la \
+	$(top_builddir)/third-party/liburlparse.la \
 	@LIBEVENT_OPENSSL_LIBS@ \
 	@OPENSSL_LIBS@ \
 	@APPLDFLAGS@

examples/client.c

@@ -28,26 +28,26 @@
  */
 #ifdef HAVE_CONFIG_H
 #  include <config.h>
-#endif /* HAVE_CONFIG_H */
+#endif /* defined(HAVE_CONFIG_H) */
 
 #include <inttypes.h>
 #include <stdlib.h>
 #ifdef HAVE_UNISTD_H
 #  include <unistd.h>
-#endif /* HAVE_UNISTD_H */
+#endif /* defined(HAVE_UNISTD_H) */
 #ifdef HAVE_FCNTL_H
 #  include <fcntl.h>
-#endif /* HAVE_FCNTL_H */
+#endif /* defined(HAVE_FCNTL_H) */
 #include <sys/types.h>
 #ifdef HAVE_SYS_SOCKET_H
 #  include <sys/socket.h>
-#endif /* HAVE_SYS_SOCKET_H */
+#endif /* defined(HAVE_SYS_SOCKET_H) */
 #ifdef HAVE_NETDB_H
 #  include <netdb.h>
-#endif /* HAVE_NETDB_H */
+#endif /* defined(HAVE_NETDB_H) */
 #ifdef HAVE_NETINET_IN_H
 #  include <netinet/in.h>
-#endif /* HAVE_NETINET_IN_H */
+#endif /* defined(HAVE_NETINET_IN_H) */
 #include <netinet/tcp.h>
 #include <poll.h>
 #include <signal.h>
@@ -67,14 +67,14 @@ enum { IO_NONE, WANT_READ, WANT_WRITE };
 
 #define MAKE_NV(NAME, VALUE)                                                   \
   {                                                                            \
-    (uint8_t *)NAME, (uint8_t *)VALUE, sizeof(NAME) - 1, sizeof(VALUE) - 1,    \
+    (uint8_t *)NAME,   (uint8_t *)VALUE,     sizeof(NAME) - 1,                 \
-        NGHTTP2_NV_FLAG_NONE                                                   \
+    sizeof(VALUE) - 1, NGHTTP2_NV_FLAG_NONE,                                   \
   }
 
 #define MAKE_NV_CS(NAME, VALUE)                                                \
   {                                                                            \
-    (uint8_t *)NAME, (uint8_t *)VALUE, sizeof(NAME) - 1, strlen(VALUE),        \
+    (uint8_t *)NAME, (uint8_t *)VALUE,     sizeof(NAME) - 1,                   \
-        NGHTTP2_NV_FLAG_NONE                                                   \
+    strlen(VALUE),   NGHTTP2_NV_FLAG_NONE,                                     \
   }
 
 struct Connection {
@@ -176,7 +176,7 @@ static nghttp2_ssize send_callback(nghttp2_session *session,
     int err = SSL_get_error(connection->ssl, rv);
     if (err == SSL_ERROR_WANT_WRITE || err == SSL_ERROR_WANT_READ) {
       connection->want_io =
-          (err == SSL_ERROR_WANT_READ ? WANT_READ : WANT_WRITE);
+        (err == SSL_ERROR_WANT_READ ? WANT_READ : WANT_WRITE);
       rv = NGHTTP2_ERR_WOULDBLOCK;
     } else {
       rv = NGHTTP2_ERR_CALLBACK_FAILURE;
@@ -207,7 +207,7 @@ static nghttp2_ssize recv_callback(nghttp2_session *session, uint8_t *buf,
     int err = SSL_get_error(connection->ssl, rv);
     if (err == SSL_ERROR_WANT_WRITE || err == SSL_ERROR_WANT_READ) {
       connection->want_io =
-          (err == SSL_ERROR_WANT_READ ? WANT_READ : WANT_WRITE);
+        (err == SSL_ERROR_WANT_READ ? WANT_READ : WANT_WRITE);
       rv = NGHTTP2_ERR_WOULDBLOCK;
     } else {
       rv = NGHTTP2_ERR_CALLBACK_FAILURE;
@@ -342,10 +342,10 @@ static void setup_nghttp2_callbacks(nghttp2_session_callbacks *callbacks) {
                                                        on_frame_recv_callback);
 
   nghttp2_session_callbacks_set_on_stream_close_callback(
-      callbacks, on_stream_close_callback);
+    callbacks, on_stream_close_callback);
 
   nghttp2_session_callbacks_set_on_data_chunk_recv_callback(
-      callbacks, on_data_chunk_recv_callback);
+    callbacks, on_data_chunk_recv_callback);
 }
 
 /*

examples/deflate.c

@@ -24,7 +24,7 @@
  */
 #ifdef HAVE_CONFIG_H
 #  include <config.h>
-#endif /* !HAVE_CONFIG_H */
+#endif /* defined(HAVE_CONFIG_H) */
 
 #include <stdio.h>
 #include <string.h>
@@ -34,8 +34,8 @@
 
 #define MAKE_NV(K, V)                                                          \
   {                                                                            \
-    (uint8_t *)K, (uint8_t *)V, sizeof(K) - 1, sizeof(V) - 1,                  \
+    (uint8_t *)K,  (uint8_t *)V,         sizeof(K) - 1,                        \
-        NGHTTP2_NV_FLAG_NONE                                                   \
+    sizeof(V) - 1, NGHTTP2_NV_FLAG_NONE,                                       \
   }
 
 static void deflate(nghttp2_hd_deflater *deflater,
@@ -51,9 +51,9 @@ int main(void) {
   nghttp2_hd_inflater *inflater;
   /* Define 1st header set.  This is looks like a HTTP request. */
   nghttp2_nv nva1[] = {
-      MAKE_NV(":scheme", "https"), MAKE_NV(":authority", "example.org"),
+    MAKE_NV(":scheme", "https"), MAKE_NV(":authority", "example.org"),
-      MAKE_NV(":path", "/"), MAKE_NV("user-agent", "libnghttp2"),
+    MAKE_NV(":path", "/"), MAKE_NV("user-agent", "libnghttp2"),
-      MAKE_NV("accept-encoding", "gzip, deflate")};
+    MAKE_NV("accept-encoding", "gzip, deflate")};
   /* Define 2nd header set */
   nghttp2_nv nva2[] = {MAKE_NV(":scheme", "https"),
                        MAKE_NV(":authority", "example.org"),
@@ -175,7 +175,7 @@ int inflate_header_block(nghttp2_hd_inflater *inflater, uint8_t *in,
     size_t proclen;
 
     rv =
-        nghttp2_hd_inflate_hd3(inflater, &nv, &inflate_flags, in, inlen, final);
+      nghttp2_hd_inflate_hd3(inflater, &nv, &inflate_flags, in, inlen, final);
 
     if (rv < 0) {
       fprintf(stderr, "inflate failed with error code %td", rv);

examples/libevent-client.c

@@ -31,26 +31,26 @@
     }
 #  define warnx(format, args...) fprintf(stderr, format "\n", ##args)
 char *strndup(const char *s, size_t size);
-#endif
+#endif /* defined(__sgi) */
 
 #ifdef HAVE_CONFIG_H
 #  include <config.h>
-#endif /* HAVE_CONFIG_H */
+#endif /* defined(HAVE_CONFIG_H) */
 
 #include <sys/types.h>
 #ifdef HAVE_UNISTD_H
 #  include <unistd.h>
-#endif /* HAVE_UNISTD_H */
+#endif /* defined(HAVE_UNISTD_H) */
 #ifdef HAVE_SYS_SOCKET_H
 #  include <sys/socket.h>
-#endif /* HAVE_SYS_SOCKET_H */
+#endif /* defined(HAVE_SYS_SOCKET_H) */
 #ifdef HAVE_NETINET_IN_H
 #  include <netinet/in.h>
-#endif /* HAVE_NETINET_IN_H */
+#endif /* defined(HAVE_NETINET_IN_H) */
 #include <netinet/tcp.h>
 #ifndef __sgi
 #  include <err.h>
-#endif
+#endif /* !defined(__sgi) */
 #include <signal.h>
 #include <string.h>
 
@@ -66,7 +66,7 @@ char *strndup(const char *s, size_t size);
 #define NGHTTP2_NO_SSIZE_T
 #include <nghttp2/nghttp2.h>
 
-#include "url-parser/url_parser.h"
+#include "urlparse.h"
 
 #define ARRLEN(x) (sizeof(x) / sizeof(x[0]))
 
@@ -74,7 +74,7 @@ typedef struct {
   /* The NULL-terminated URI string to retrieve. */
   const char *uri;
   /* Parsed result of the |uri| */
-  struct http_parser_url *u;
+  urlparse_url *u;
   /* The authority portion of the |uri|, not NULL-terminated */
   char *authority;
   /* The path portion of the |uri|, including query, not
@@ -96,7 +96,7 @@ typedef struct {
 } http2_session_data;
 
 static http2_stream_data *create_http2_stream_data(const char *uri,
-                                                   struct http_parser_url *u) {
+                                                   urlparse_url *u) {
   /* MAX 5 digits (max 65535) + 1 ':' + 1 NULL (because of snprintf) */
   size_t extra = 7;
   http2_stream_data *stream_data = malloc(sizeof(http2_stream_data));
@@ -105,39 +105,41 @@ static http2_stream_data *create_http2_stream_data(const char *uri,
   stream_data->u = u;
   stream_data->stream_id = -1;
 
-  stream_data->authoritylen = u->field_data[UF_HOST].len;
+  stream_data->authoritylen = u->field_data[URLPARSE_HOST].len;
   stream_data->authority = malloc(stream_data->authoritylen + extra);
-  memcpy(stream_data->authority, &uri[u->field_data[UF_HOST].off],
+  memcpy(stream_data->authority, &uri[u->field_data[URLPARSE_HOST].off],
-         u->field_data[UF_HOST].len);
+         u->field_data[URLPARSE_HOST].len);
-  if (u->field_set & (1 << UF_PORT)) {
+  if (u->field_set & (1 << URLPARSE_PORT)) {
-    stream_data->authoritylen +=
+    stream_data->authoritylen += (size_t)snprintf(
-        (size_t)snprintf(stream_data->authority + u->field_data[UF_HOST].len,
+      stream_data->authority + u->field_data[URLPARSE_HOST].len, extra, ":%u",
-                         extra, ":%u", u->port);
+      u->port);
   }
 
   /* If we don't have path in URI, we use "/" as path. */
   stream_data->pathlen = 1;
-  if (u->field_set & (1 << UF_PATH)) {
+  if (u->field_set & (1 << URLPARSE_PATH)) {
-    stream_data->pathlen = u->field_data[UF_PATH].len;
+    stream_data->pathlen = u->field_data[URLPARSE_PATH].len;
   }
-  if (u->field_set & (1 << UF_QUERY)) {
+  if (u->field_set & (1 << URLPARSE_QUERY)) {
     /* +1 for '?' character */
-    stream_data->pathlen += (size_t)(u->field_data[UF_QUERY].len + 1);
+    stream_data->pathlen += (size_t)(u->field_data[URLPARSE_QUERY].len + 1);
   }
 
   stream_data->path = malloc(stream_data->pathlen);
-  if (u->field_set & (1 << UF_PATH)) {
+  if (u->field_set & (1 << URLPARSE_PATH)) {
-    memcpy(stream_data->path, &uri[u->field_data[UF_PATH].off],
+    memcpy(stream_data->path, &uri[u->field_data[URLPARSE_PATH].off],
-           u->field_data[UF_PATH].len);
+           u->field_data[URLPARSE_PATH].len);
   } else {
     stream_data->path[0] = '/';
   }
-  if (u->field_set & (1 << UF_QUERY)) {
+  if (u->field_set & (1 << URLPARSE_QUERY)) {
-    stream_data->path[stream_data->pathlen - u->field_data[UF_QUERY].len - 1] =
+    stream_data
-        '?';
+      ->path[stream_data->pathlen - u->field_data[URLPARSE_QUERY].len - 1] =
+      '?';
     memcpy(stream_data->path + stream_data->pathlen -
-               u->field_data[UF_QUERY].len,
+             u->field_data[URLPARSE_QUERY].len,
-           &uri[u->field_data[UF_QUERY].off], u->field_data[UF_QUERY].len);
+           &uri[u->field_data[URLPARSE_QUERY].off],
+           u->field_data[URLPARSE_QUERY].len);
   }
 
   return stream_data;
@@ -318,10 +320,9 @@ static SSL_CTX *create_ssl_ctx(void) {
     errx(1, "Could not create SSL/TLS context: %s",
          ERR_error_string(ERR_get_error(), NULL));
   }
-  SSL_CTX_set_options(ssl_ctx,
+  SSL_CTX_set_options(ssl_ctx, SSL_OP_ALL | SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 |
-                      SSL_OP_ALL | SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 |
+                                 SSL_OP_NO_COMPRESSION |
-                          SSL_OP_NO_COMPRESSION |
+                                 SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION);
-                          SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION);
 
   SSL_CTX_set_alpn_protos(ssl_ctx, (const unsigned char *)"\x02h2", 3);
 
@@ -350,16 +351,16 @@ static void initialize_nghttp2_session(http2_session_data *session_data) {
                                                        on_frame_recv_callback);
 
   nghttp2_session_callbacks_set_on_data_chunk_recv_callback(
-      callbacks, on_data_chunk_recv_callback);
+    callbacks, on_data_chunk_recv_callback);
 
   nghttp2_session_callbacks_set_on_stream_close_callback(
-      callbacks, on_stream_close_callback);
+    callbacks, on_stream_close_callback);
 
   nghttp2_session_callbacks_set_on_header_callback(callbacks,
                                                    on_header_callback);
 
   nghttp2_session_callbacks_set_on_begin_headers_callback(
-      callbacks, on_begin_headers_callback);
+    callbacks, on_begin_headers_callback);
 
   nghttp2_session_client_new(&session_data->session, callbacks, session_data);
 
@@ -368,7 +369,7 @@ static void initialize_nghttp2_session(http2_session_data *session_data) {
 
 static void send_client_connection_header(http2_session_data *session_data) {
   nghttp2_settings_entry iv[1] = {
-      {NGHTTP2_SETTINGS_MAX_CONCURRENT_STREAMS, 100}};
+    {NGHTTP2_SETTINGS_MAX_CONCURRENT_STREAMS, 100}};
   int rv;
 
   /* client 24 bytes magic string will be sent by nghttp2 library */
@@ -381,14 +382,14 @@ static void send_client_connection_header(http2_session_data *session_data) {
 
 #define MAKE_NV(NAME, VALUE, VALUELEN)                                         \
   {                                                                            \
-    (uint8_t *)NAME, (uint8_t *)VALUE, sizeof(NAME) - 1, VALUELEN,             \
+    (uint8_t *)NAME, (uint8_t *)VALUE,     sizeof(NAME) - 1,                   \
-        NGHTTP2_NV_FLAG_NONE                                                   \
+    VALUELEN,        NGHTTP2_NV_FLAG_NONE,                                     \
   }
 
 #define MAKE_NV2(NAME, VALUE)                                                  \
   {                                                                            \
-    (uint8_t *)NAME, (uint8_t *)VALUE, sizeof(NAME) - 1, sizeof(VALUE) - 1,    \
+    (uint8_t *)NAME,   (uint8_t *)VALUE,     sizeof(NAME) - 1,                 \
-        NGHTTP2_NV_FLAG_NONE                                                   \
+    sizeof(VALUE) - 1, NGHTTP2_NV_FLAG_NONE,                                   \
   }
 
 /* Send HTTP request to the remote peer */
@@ -396,13 +397,13 @@ static void submit_request(http2_session_data *session_data) {
   int32_t stream_id;
   http2_stream_data *stream_data = session_data->stream_data;
   const char *uri = stream_data->uri;
-  const struct http_parser_url *u = stream_data->u;
+  const urlparse_url *u = stream_data->u;
   nghttp2_nv hdrs[] = {
-      MAKE_NV2(":method", "GET"),
+    MAKE_NV2(":method", "GET"),
-      MAKE_NV(":scheme", &uri[u->field_data[UF_SCHEMA].off],
+    MAKE_NV(":scheme", &uri[u->field_data[URLPARSE_SCHEMA].off],
-              u->field_data[UF_SCHEMA].len),
+            u->field_data[URLPARSE_SCHEMA].len),
-      MAKE_NV(":authority", stream_data->authority, stream_data->authoritylen),
+    MAKE_NV(":authority", stream_data->authority, stream_data->authoritylen),
-      MAKE_NV(":path", stream_data->path, stream_data->pathlen)};
+    MAKE_NV(":path", stream_data->path, stream_data->pathlen)};
   fprintf(stderr, "Request headers:\n");
   print_headers(stderr, hdrs, ARRLEN(hdrs));
   stream_id = nghttp2_submit_request2(session_data->session, NULL, hdrs,
@@ -527,8 +528,8 @@ static void initiate_connection(struct event_base *evbase, SSL_CTX *ssl_ctx,
 
   ssl = create_ssl(ssl_ctx);
   bev = bufferevent_openssl_socket_new(
-      evbase, -1, ssl, BUFFEREVENT_SSL_CONNECTING,
+    evbase, -1, ssl, BUFFEREVENT_SSL_CONNECTING,
-      BEV_OPT_DEFER_CALLBACKS | BEV_OPT_CLOSE_ON_FREE);
+    BEV_OPT_DEFER_CALLBACKS | BEV_OPT_CLOSE_ON_FREE);
   bufferevent_enable(bev, EV_READ | EV_WRITE);
   bufferevent_setcb(bev, readcb, writecb, eventcb, session_data);
   rv = bufferevent_socket_connect_hostname(bev, session_data->dnsbase,
@@ -543,7 +544,7 @@ static void initiate_connection(struct event_base *evbase, SSL_CTX *ssl_ctx,
 /* Get resource denoted by the |uri|. The debug and error messages are
    printed in stderr, while the response body is printed in stdout. */
 static void run(const char *uri) {
-  struct http_parser_url u;
+  urlparse_url u;
   char *host;
   uint16_t port;
   int rv;
@@ -552,12 +553,13 @@ static void run(const char *uri) {
   http2_session_data *session_data;
 
   /* Parse the |uri| and stores its components in |u| */
-  rv = http_parser_parse_url(uri, strlen(uri), 0, &u);
+  rv = urlparse_parse_url(uri, strlen(uri), 0, &u);
   if (rv != 0) {
     errx(1, "Could not parse URI %s", uri);
   }
-  host = strndup(&uri[u.field_data[UF_HOST].off], u.field_data[UF_HOST].len);
+  host = strndup(&uri[u.field_data[URLPARSE_HOST].off],
-  if (!(u.field_set & (1 << UF_PORT))) {
+                 u.field_data[URLPARSE_HOST].len);
+  if (!(u.field_set & (1 << URLPARSE_PORT))) {
     port = 443;
   } else {
     port = u.port;

examples/libevent-server.c

@@ -30,35 +30,35 @@
     }
 #  define warn(format, args...) warnx(format ": %s", ##args, strerror(errno))
 #  define warnx(format, args...) fprintf(stderr, format "\n", ##args)
-#endif
+#endif /* defined(__sgi) */
 
 #ifdef HAVE_CONFIG_H
 #  include <config.h>
-#endif /* HAVE_CONFIG_H */
+#endif /* defined(HAVE_CONFIG_H) */
 
 #include <sys/types.h>
 #ifdef HAVE_SYS_SOCKET_H
 #  include <sys/socket.h>
-#endif /* HAVE_SYS_SOCKET_H */
+#endif /* defined(HAVE_SYS_SOCKET_H) */
 #ifdef HAVE_NETDB_H
 #  include <netdb.h>
-#endif /* HAVE_NETDB_H */
+#endif /* defined(HAVE_NETDB_H) */
 #include <signal.h>
 #ifdef HAVE_UNISTD_H
 #  include <unistd.h>
-#endif /* HAVE_UNISTD_H */
+#endif /* defined(HAVE_UNISTD_H) */
 #include <sys/stat.h>
 #ifdef HAVE_FCNTL_H
 #  include <fcntl.h>
-#endif /* HAVE_FCNTL_H */
+#endif /* defined(HAVE_FCNTL_H) */
 #include <ctype.h>
 #ifdef HAVE_NETINET_IN_H
 #  include <netinet/in.h>
-#endif /* HAVE_NETINET_IN_H */
+#endif /* defined(HAVE_NETINET_IN_H) */
 #include <netinet/tcp.h>
 #ifndef __sgi
 #  include <err.h>
-#endif
+#endif /* !defined(__sgi) */
 #include <string.h>
 #include <errno.h>
 
@@ -80,8 +80,8 @@
 
 #define MAKE_NV(NAME, VALUE)                                                   \
   {                                                                            \
-    (uint8_t *)NAME, (uint8_t *)VALUE, sizeof(NAME) - 1, sizeof(VALUE) - 1,    \
+    (uint8_t *)NAME,   (uint8_t *)VALUE,     sizeof(NAME) - 1,                 \
-        NGHTTP2_NV_FLAG_NONE                                                   \
+    sizeof(VALUE) - 1, NGHTTP2_NV_FLAG_NONE,                                   \
   }
 
 struct app_context;
@@ -132,16 +132,15 @@ static SSL_CTX *create_ssl_ctx(const char *key_file, const char *cert_file) {
     errx(1, "Could not create SSL/TLS context: %s",
          ERR_error_string(ERR_get_error(), NULL));
   }
-  SSL_CTX_set_options(ssl_ctx,
+  SSL_CTX_set_options(ssl_ctx, SSL_OP_ALL | SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 |
-                      SSL_OP_ALL | SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 |
+                                 SSL_OP_NO_COMPRESSION |
-                          SSL_OP_NO_COMPRESSION |
+                                 SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION);
-                          SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION);
 #if OPENSSL_VERSION_NUMBER >= 0x30000000L
-  if (SSL_CTX_set1_curves_list(ssl_ctx, "P-256") != 1) {
+  if (SSL_CTX_set1_groups_list(ssl_ctx, "P-256") != 1) {
-    errx(1, "SSL_CTX_set1_curves_list failed: %s",
+    errx(1, "SSL_CTX_set1_groups_list failed: %s",
          ERR_error_string(ERR_get_error(), NULL));
   }
-#else  /* !(OPENSSL_VERSION_NUMBER >= 0x30000000L) */
+#else  /* OPENSSL_VERSION_NUMBER < 0x30000000L */
   {
     EC_KEY *ecdh;
     ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
@@ -152,7 +151,7 @@ static SSL_CTX *create_ssl_ctx(const char *key_file, const char *cert_file) {
     SSL_CTX_set_tmp_ecdh(ssl_ctx, ecdh);
     EC_KEY_free(ecdh);
   }
-#endif /* !(OPENSSL_VERSION_NUMBER >= 0x30000000L) */
+#endif /* OPENSSL_VERSION_NUMBER < 0x30000000L */
 
   if (SSL_CTX_use_PrivateKey_file(ssl_ctx, key_file, SSL_FILETYPE_PEM) != 1) {
     errx(1, "Could not read private key file %s", key_file);
@@ -233,8 +232,8 @@ static http2_session_data *create_http2_session_data(app_context *app_ctx,
   session_data->app_ctx = app_ctx;
   setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, (char *)&val, sizeof(val));
   session_data->bev = bufferevent_openssl_socket_new(
-      app_ctx->evbase, fd, ssl, BUFFEREVENT_SSL_ACCEPTING,
+    app_ctx->evbase, fd, ssl, BUFFEREVENT_SSL_ACCEPTING,
-      BEV_OPT_CLOSE_ON_FREE | BEV_OPT_DEFER_CALLBACKS);
+    BEV_OPT_CLOSE_ON_FREE | BEV_OPT_DEFER_CALLBACKS);
   bufferevent_enable(session_data->bev, EV_READ | EV_WRITE);
   rv = getnameinfo(addr, (socklen_t)addrlen, host, sizeof(host), NULL, 0,
                    NI_NUMERICHOST);
@@ -360,7 +359,7 @@ static char *percent_decode(const uint8_t *value, size_t valuelen) {
         continue;
       }
       res[j++] =
-          (char)((hex_to_uint(value[i + 1]) << 4) + hex_to_uint(value[i + 2]));
+        (char)((hex_to_uint(value[i + 1]) << 4) + hex_to_uint(value[i + 2]));
       i += 3;
     }
     memcpy(&res[j], &value[i], 2);
@@ -422,9 +421,9 @@ static int error_reply(nghttp2_session *session,
   rv = pipe(pipefd);
   if (rv != 0) {
     warn("Could not create pipe");
-    rv = nghttp2_submit_rst_stream(session, NGHTTP2_FLAG_NONE,
+    rv =
-                                   stream_data->stream_id,
+      nghttp2_submit_rst_stream(session, NGHTTP2_FLAG_NONE,
-                                   NGHTTP2_INTERNAL_ERROR);
+                                stream_data->stream_id, NGHTTP2_INTERNAL_ERROR);
     if (rv != 0) {
       warnx("Fatal error: %s", nghttp2_strerror(rv));
       return -1;
@@ -467,7 +466,7 @@ static int on_header_callback(nghttp2_session *session,
       break;
     }
     stream_data =
-        nghttp2_session_get_stream_user_data(session, frame->hd.stream_id);
+      nghttp2_session_get_stream_user_data(session, frame->hd.stream_id);
     if (!stream_data || stream_data->request_path) {
       break;
     }
@@ -557,7 +556,7 @@ static int on_frame_recv_callback(nghttp2_session *session,
     /* Check that the client request has finished */
     if (frame->hd.flags & NGHTTP2_FLAG_END_STREAM) {
       stream_data =
-          nghttp2_session_get_stream_user_data(session, frame->hd.stream_id);
+        nghttp2_session_get_stream_user_data(session, frame->hd.stream_id);
       /* For DATA and HEADERS frame, this callback may be called after
          on_stream_close_callback. Check that stream still alive. */
       if (!stream_data) {
@@ -598,13 +597,13 @@ static void initialize_nghttp2_session(http2_session_data *session_data) {
                                                        on_frame_recv_callback);
 
   nghttp2_session_callbacks_set_on_stream_close_callback(
-      callbacks, on_stream_close_callback);
+    callbacks, on_stream_close_callback);
 
   nghttp2_session_callbacks_set_on_header_callback(callbacks,
                                                    on_header_callback);
 
   nghttp2_session_callbacks_set_on_begin_headers_callback(
-      callbacks, on_begin_headers_callback);
+    callbacks, on_begin_headers_callback);
 
   nghttp2_session_server_new(&session_data->session, callbacks, session_data);
 
@@ -615,7 +614,7 @@ static void initialize_nghttp2_session(http2_session_data *session_data) {
    magic octets and SETTINGS frame */
 static int send_server_connection_header(http2_session_data *session_data) {
   nghttp2_settings_entry iv[1] = {
-      {NGHTTP2_SETTINGS_MAX_CONCURRENT_STREAMS, 100}};
+    {NGHTTP2_SETTINGS_MAX_CONCURRENT_STREAMS, 100}};
   int rv;
 
   rv = nghttp2_submit_settings(session_data->session, NGHTTP2_FLAG_NONE, iv,
@@ -728,7 +727,7 @@ static void start_listen(struct event_base *evbase, const char *service,
   hints.ai_flags = AI_PASSIVE;
 #ifdef AI_ADDRCONFIG
   hints.ai_flags |= AI_ADDRCONFIG;
-#endif /* AI_ADDRCONFIG */
+#endif /* defined(AI_ADDRCONFIG) */
 
   rv = getaddrinfo(NULL, service, &hints, &res);
   if (rv != 0) {
@@ -737,8 +736,8 @@ static void start_listen(struct event_base *evbase, const char *service,
   for (rp = res; rp; rp = rp->ai_next) {
     struct evconnlistener *listener;
     listener = evconnlistener_new_bind(
-        evbase, acceptcb, app_ctx, LEV_OPT_CLOSE_ON_FREE | LEV_OPT_REUSEABLE,
+      evbase, acceptcb, app_ctx, LEV_OPT_CLOSE_ON_FREE | LEV_OPT_REUSEABLE, 16,
-        16, rp->ai_addr, (int)rp->ai_addrlen);
+      rp->ai_addr, (int)rp->ai_addrlen);
     if (listener) {
       freeaddrinfo(res);
 

fuzz/fuzz_frames.cc

@@ -62,8 +62,8 @@ void check_frame_pack_headers(FuzzedDataProvider *data_provider) {
   nvlen = HEADERS_LENGTH;
   nghttp2_priority_spec_default_init(&pri_spec);
   nghttp2_frame_headers_init(
-      &frame, NGHTTP2_FLAG_END_STREAM | NGHTTP2_FLAG_END_HEADERS, 1000000007,
+    &frame, NGHTTP2_FLAG_END_STREAM | NGHTTP2_FLAG_END_HEADERS, 1000000007,
-      NGHTTP2_HCAT_REQUEST, &pri_spec, nva, nvlen);
+    NGHTTP2_HCAT_REQUEST, &pri_spec, nva, nvlen);
 
   /* Perform a set of operations with the fuzz data */
   rv = nghttp2_frame_pack_headers(&bufs, &frame, &deflater);

fuzz/fuzz_target.cc

@@ -56,11 +56,11 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
   nghttp2_session_callbacks_set_on_frame_recv_callback(callbacks,
                                                        on_frame_recv_callback);
   nghttp2_session_callbacks_set_on_begin_headers_callback(
-      callbacks, on_begin_headers_callback);
+    callbacks, on_begin_headers_callback);
   nghttp2_session_callbacks_set_on_header_callback2(callbacks,
                                                     on_header_callback2);
   nghttp2_session_callbacks_set_before_frame_send_callback(
-      callbacks, before_frame_send_callback);
+    callbacks, before_frame_send_callback);
   nghttp2_session_callbacks_set_on_frame_send_callback(callbacks,
                                                        on_frame_send_callback);
 

fuzz/fuzz_target_fdp.cc

@@ -60,11 +60,11 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
   nghttp2_session_callbacks_set_on_frame_recv_callback(callbacks,
                                                        on_frame_recv_callback);
   nghttp2_session_callbacks_set_on_begin_headers_callback(
-      callbacks, on_begin_headers_callback);
+    callbacks, on_begin_headers_callback);
   nghttp2_session_callbacks_set_on_header_callback2(callbacks,
                                                     on_header_callback2);
   nghttp2_session_callbacks_set_before_frame_send_callback(
-      callbacks, before_frame_send_callback);
+    callbacks, before_frame_send_callback);
   nghttp2_session_callbacks_set_on_frame_send_callback(callbacks,
                                                        on_frame_send_callback);
 

gennghttpxfun.py

@@ -204,6 +204,7 @@ OPTIONS = [
     "frontend-header-timeout",
     "frontend-http2-idle-timeout",
     "frontend-http3-idle-timeout",
+    "groups",
 ]
 
 LOGVARS = [

gentokenlookup.py

@@ -35,7 +35,7 @@ enum {''')
 
 def gen_index_header(tokens, prefix, comp_fun, return_type, fail_value):
     print('''\
-{} lookup_token(const StringRef &name) {{
+{} lookup_token(const std::string_view &name) {{
   switch (name.size()) {{'''.format(return_type))
     b = build_header(tokens)
     for size in sorted(b.keys()):
@@ -50,7 +50,7 @@ def gen_index_header(tokens, prefix, comp_fun, return_type, fail_value):
     case '{}':'''.format(c))
             for k in headers:
                 print('''\
-      if ({}("{}"_sr, name, {})) {{
+      if ({}("{}"sv, name.substr(0, {}))) {{
         return {};
       }}'''.format(comp_fun, k[:-1], size - 1, to_enum_hd(k, prefix)))
             print('''\

go.mod

@@ -1,24 +1,20 @@
 module github.com/nghttp2/nghttp2
 
-go 1.21.1
+go 1.24.0
 
 require (
 	github.com/bradfitz/gomemcache v0.0.0-20230905024940-24af94b03874
-	github.com/quic-go/quic-go v0.43.1
+	github.com/quic-go/quic-go v0.55.0
 	github.com/tatsuhiro-t/go-nghttp2 v0.0.0-20240121064059-46ccb0a462a8
-	golang.org/x/net v0.24.0
+	golang.org/x/net v0.46.0
 )
 
 require (
-	github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 // indirect
+	github.com/quic-go/qpack v0.5.1 // indirect
-	github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38 // indirect
+	golang.org/x/crypto v0.43.0 // indirect
-	github.com/onsi/ginkgo/v2 v2.9.5 // indirect
+	golang.org/x/mod v0.28.0 // indirect
-	github.com/quic-go/qpack v0.4.0 // indirect
+	golang.org/x/sync v0.17.0 // indirect
-	go.uber.org/mock v0.4.0 // indirect
+	golang.org/x/sys v0.37.0 // indirect
-	golang.org/x/crypto v0.22.0 // indirect
+	golang.org/x/text v0.30.0 // indirect
-	golang.org/x/exp v0.0.0-20221205204356-47842c84f3db // indirect
+	golang.org/x/tools v0.37.0 // indirect
-	golang.org/x/mod v0.11.0 // indirect
-	golang.org/x/sys v0.19.0 // indirect
-	golang.org/x/text v0.14.0 // indirect
-	golang.org/x/tools v0.9.1 // indirect
 )

go.sum

@@ -1,59 +1,34 @@
 github.com/bradfitz/gomemcache v0.0.0-20230905024940-24af94b03874 h1:N7oVaKyGp8bttX0bfZGmcGkjz7DLQXhAn3DNd3T0ous=
 github.com/bradfitz/gomemcache v0.0.0-20230905024940-24af94b03874/go.mod h1:r5xuitiExdLAJ09PR7vBVENGvp4ZuTBeWTGtxuX3K+c=
-github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
-github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
-github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
-github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/go-logr/logr v1.2.4 h1:g01GSCwiDw2xSZfjJ2/T9M+S6pFdcNtFYsp+Y43HYDQ=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
-github.com/go-logr/logr v1.2.4/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI=
-github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572/go.mod h1:9Pwr4B2jHnOSGXyyzV8ROjYa2ojvAY6HCGYYfMoC3Ls=
-github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
-github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38 h1:yAJXTCF9TqKcTiHJAE8dj7HMvPfh66eeA2JYW7eFpSE=
-github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
-github.com/onsi/ginkgo/v2 v2.9.5 h1:+6Hr4uxzP4XIUyAkg61dWBw8lb/gc4/X5luuxN/EC+Q=
-github.com/onsi/ginkgo/v2 v2.9.5/go.mod h1:tvAoo1QUJwNEU2ITftXTpR7R1RbCzoZUOs3RonqW57k=
-github.com/onsi/gomega v1.27.6 h1:ENqfyGeS5AX/rlXDd/ETokDz93u0YufY1Pgxuy/PvWE=
-github.com/onsi/gomega v1.27.6/go.mod h1:PIQNjfQwkP3aQAH7lf7j87O/5FiNr+ZR8+ipb+qQlhg=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/quic-go/qpack v0.4.0 h1:Cr9BXA1sQS2SmDUWjSofMPNKmvF6IiIfDRmgU0w1ZCo=
+github.com/quic-go/qpack v0.5.1 h1:giqksBPnT/HDtZ6VhtFKgoLOWmlyo9Ei6u9PqzIMbhI=
-github.com/quic-go/qpack v0.4.0/go.mod h1:UZVnYIfi5GRk+zI9UMaCPsmZ2xKJP7XBUvVyT1Knj9A=
+github.com/quic-go/qpack v0.5.1/go.mod h1:+PC4XFrEskIVkcLzpEkbLqq1uCoxPhQuvK5rH1ZgaEg=
-github.com/quic-go/quic-go v0.43.1 h1:fLiMNfQVe9q2JvSsiXo4fXOEguXHGGl9+6gLp4RPeZQ=
+github.com/quic-go/quic-go v0.55.0 h1:zccPQIqYCXDt5NmcEabyYvOnomjs8Tlwl7tISjJh9Mk=
-github.com/quic-go/quic-go v0.43.1/go.mod h1:132kz4kL3F9vxhW3CtQJLDVwcFe5wdWeJXXijhsO57M=
+github.com/quic-go/quic-go v0.55.0/go.mod h1:DR51ilwU1uE164KuWXhinFcKWGlEjzys2l8zUl5Ss1U=
-github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
-github.com/stretchr/testify v1.6.1 h1:hDPOHmpOpP40lSULcqw7IrRb/u7w6RpDC9399XyoNd0=
+github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
-github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/tatsuhiro-t/go-nghttp2 v0.0.0-20240121064059-46ccb0a462a8 h1:zKJxuRe+a0O34V81GAZWOrotuU6mveT30QLjJ7OPMMg=
 github.com/tatsuhiro-t/go-nghttp2 v0.0.0-20240121064059-46ccb0a462a8/go.mod h1:gTqc3Q4boc+cKRlSFywTYdX9t6VGRcsThlNIWwaL3Dc=
-go.uber.org/mock v0.4.0 h1:VcM4ZOtdbR4f6VXfiOpwpVJDL6lCReaZ6mw31wqh7KU=
+go.uber.org/mock v0.5.2 h1:LbtPTcP8A5k9WPXj54PPPbjcI4Y6lhyOZXn+VS7wNko=
-go.uber.org/mock v0.4.0/go.mod h1:a6FSlNadKUHUa9IP5Vyt1zh4fC7uAwxMutEAscFbkZc=
+go.uber.org/mock v0.5.2/go.mod h1:wLlUxC2vVTPTaE3UD51E0BGOAElKrILxhVSDYQLld5o=
-golang.org/x/crypto v0.22.0 h1:g1v0xeRhjcugydODzvb3mEM9SQ0HGp9s/nh3COQ/C30=
+golang.org/x/crypto v0.43.0 h1:dduJYIi3A3KOfdGOHX8AVZ/jGiyPa3IbBozJ5kNuE04=
-golang.org/x/crypto v0.22.0/go.mod h1:vr6Su+7cTlO45qkww3VDJlzDn0ctJvRgYbC2NvXHt+M=
+golang.org/x/crypto v0.43.0/go.mod h1:BFbav4mRNlXJL4wNeejLpWxB7wMbc79PdRGhWKncxR0=
-golang.org/x/exp v0.0.0-20221205204356-47842c84f3db h1:D/cFflL63o2KSLJIwjlcIt8PR064j/xsmdEJL/YvY/o=
+golang.org/x/mod v0.28.0 h1:gQBtGhjxykdjY9YhZpSlZIsbnaE2+PgjfLWUQTnoZ1U=
-golang.org/x/exp v0.0.0-20221205204356-47842c84f3db/go.mod h1:CxIveKay+FTh1D0yPZemJVgC/95VzuuOLq5Qi4xnoYc=
+golang.org/x/mod v0.28.0/go.mod h1:yfB/L0NOf/kmEbXjzCPOx1iK1fRutOydrCMsqRhEBxI=
-golang.org/x/mod v0.11.0 h1:bUO06HqtnRcc/7l71XBe4WcqTZ+3AH1J59zWDDwLKgU=
+golang.org/x/net v0.46.0 h1:giFlY12I07fugqwPuWJi68oOnpfqFnJIJzaIIm2JVV4=
-golang.org/x/mod v0.11.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/net v0.46.0/go.mod h1:Q9BGdFy1y4nkUwiLvT5qtyhAnEHgnQ/zd8PfU6nc210=
-golang.org/x/net v0.24.0 h1:1PcaxkF854Fu3+lvBIx5SYn9wRlBzzcnHZSiaFFAb0w=
+golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug=
-golang.org/x/net v0.24.0/go.mod h1:2Q7sJY5mzlzWjKtYUEXSlBWCdyaioyXzRB2RtU8KVE8=
+golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
-golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.37.0 h1:fdNQudmxPjkdUTPnLn5mdQv7Zwvbvpaxqs831goi9kQ=
-golang.org/x/sys v0.19.0 h1:q5f1RH2jigJ1MoAWp2KTp3gm5zAGFUTarQZ5U386+4o=
+golang.org/x/sys v0.37.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
-golang.org/x/sys v0.19.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/text v0.30.0 h1:yznKA/E9zq54KzlzBEAWn1NXSQ8DIp/NYMy88xJjl4k=
-golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
+golang.org/x/text v0.30.0/go.mod h1:yDdHFIX9t+tORqspjENWgzaCVXgk0yYnYuSZ8UzzBVM=
-golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/tools v0.37.0 h1:DVSRzp7FwePZW356yEAChSdNcQo6Nsp+fex1SUW09lE=
-golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
+golang.org/x/tools v0.37.0/go.mod h1:MBN5QPQtLMHVdvsbtarmTNukZDdgwdwlO5qGacAzF0w=
-golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
-golang.org/x/tools v0.9.1 h1:8WMNJAz3zrtPmnYC7ISf5dEn3MT0gY7jBJfw27yrrLo=
-golang.org/x/tools v0.9.1/go.mod h1:owI94Op576fPu3cIGQeHs3joujW/2Oc6MtlxbF5dfNc=
-google.golang.org/protobuf v1.28.0 h1:w43yiav+6bVFTBQFZX0r7ipe9JQ1QsbMgHwbBziscLw=
-google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

integration-tests/nghttpx_http1_test.go

@@ -4,6 +4,7 @@ import (
 	"bufio"
 	"bytes"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -62,6 +63,7 @@ func TestH1H1InvalidMethod(t *testing.T) {
 			t.Errorf("server should not forward this request")
 		},
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -86,6 +88,7 @@ func TestH1H1MultipleRequestCL(t *testing.T) {
 			t.Errorf("server should not forward bad request")
 		},
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -133,6 +136,7 @@ func TestH1H1AffinityCookie(t *testing.T) {
 	opts := options{
 		args: []string{"--affinity-cookie"},
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -149,6 +153,7 @@ func TestH1H1AffinityCookie(t *testing.T) {
 
 	const pattern = `affinity=[0-9a-f]{8}; Path=/foo/bar`
 	validCookie := regexp.MustCompile(pattern)
+
 	if got := res.header.Get("Set-Cookie"); !validCookie.MatchString(got) {
 		t.Errorf("Set-Cookie: %v; want pattern %v", got, pattern)
 	}
@@ -161,6 +166,7 @@ func TestH1H1AffinityCookieTLS(t *testing.T) {
 		args: []string{"--alpn-h1", "--affinity-cookie"},
 		tls:  true,
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -177,6 +183,7 @@ func TestH1H1AffinityCookieTLS(t *testing.T) {
 
 	const pattern = `affinity=[0-9a-f]{8}; Path=/foo/bar; Secure`
 	validCookie := regexp.MustCompile(pattern)
+
 	if got := res.header.Get("Set-Cookie"); !validCookie.MatchString(got) {
 		t.Errorf("Set-Cookie: %v; want pattern %v", got, pattern)
 	}
@@ -221,7 +228,8 @@ func TestH1H1GracefulShutdown(t *testing.T) {
 
 	want := io.EOF
 	b := make([]byte, 256)
-	if _, err := st.conn.Read(b); err == nil || err != want {
+
+	if _, err := st.conn.Read(b); !errors.Is(err, want) {
 		t.Errorf("st.conn.Read(): %v; want %v", err, want)
 	}
 }
@@ -234,6 +242,7 @@ func TestH1H1HostRewrite(t *testing.T) {
 			w.Header().Add("request-host", r.Host)
 		},
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -243,9 +252,11 @@ func TestH1H1HostRewrite(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Error st.http1() = %v", err)
 	}
+
 	if got, want := res.status, http.StatusOK; got != want {
 		t.Errorf("status: %v; want %v", got, want)
 	}
+
 	if got, want := res.header.Get("request-host"), st.backendHost; got != want {
 		t.Errorf("request-host: %v; want %v", got, want)
 	}
@@ -259,12 +270,14 @@ func TestH1H1BadHost(t *testing.T) {
 			t.Errorf("server should not forward this request")
 		},
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
 	if _, err := io.WriteString(st.conn, "GET / HTTP/1.1\r\nTest-Case: TestH1H1HBadHost\r\nHost: foo\"bar\r\n\r\n"); err != nil {
 		t.Fatalf("Error io.WriteString() = %v", err)
 	}
+
 	resp, err := http.ReadResponse(bufio.NewReader(st.conn), nil)
 	if err != nil {
 		t.Fatalf("Error http.ReadResponse() = %v", err)
@@ -285,12 +298,14 @@ func TestH1H1BadAuthority(t *testing.T) {
 			t.Errorf("server should not forward this request")
 		},
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
 	if _, err := io.WriteString(st.conn, "GET http://foo\"bar/ HTTP/1.1\r\nTest-Case: TestH1H1HBadAuthority\r\nHost: foobar\r\n\r\n"); err != nil {
 		t.Fatalf("Error io.WriteString() = %v", err)
 	}
+
 	resp, err := http.ReadResponse(bufio.NewReader(st.conn), nil)
 	if err != nil {
 		t.Fatalf("Error http.ReadResponse() = %v", err)
@@ -311,12 +326,14 @@ func TestH1H1BadScheme(t *testing.T) {
 			t.Errorf("server should not forward this request")
 		},
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
 	if _, err := io.WriteString(st.conn, "GET http*://example.com/ HTTP/1.1\r\nTest-Case: TestH1H1HBadScheme\r\nHost: example.com\r\n\r\n"); err != nil {
 		t.Fatalf("Error io.WriteString() = %v", err)
 	}
+
 	resp, err := http.ReadResponse(bufio.NewReader(st.conn), nil)
 	if err != nil {
 		t.Fatalf("Error http.ReadResponse() = %v", err)
@@ -337,6 +354,7 @@ func TestH1H1HTTP10(t *testing.T) {
 			w.Header().Add("request-host", r.Host)
 		},
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -354,6 +372,7 @@ func TestH1H1HTTP10(t *testing.T) {
 	if got, want := resp.StatusCode, http.StatusOK; got != want {
 		t.Errorf("status: %v; want %v", got, want)
 	}
+
 	if got, want := resp.Header.Get("request-host"), st.backendHost; got != want {
 		t.Errorf("request-host: %v; want %v", got, want)
 	}
@@ -368,6 +387,7 @@ func TestH1H1HTTP10NoHostRewrite(t *testing.T) {
 			w.Header().Add("request-host", r.Host)
 		},
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -385,6 +405,7 @@ func TestH1H1HTTP10NoHostRewrite(t *testing.T) {
 	if got, want := resp.StatusCode, http.StatusOK; got != want {
 		t.Errorf("status: %v; want %v", got, want)
 	}
+
 	if got, want := resp.Header.Get("request-host"), st.backendHost; got != want {
 		t.Errorf("request-host: %v; want %v", got, want)
 	}
@@ -398,10 +419,11 @@ func TestH1H1RequestTrailer(t *testing.T) {
 			buf := make([]byte, 4096)
 			for {
 				_, err := r.Body.Read(buf)
-				if err == io.EOF {
-					break
-				}
 				if err != nil {
+					if errors.Is(err, io.EOF) {
+						break
+					}
+
 					t.Fatalf("r.Body.Read() = %v", err)
 				}
 			}
@@ -410,6 +432,7 @@ func TestH1H1RequestTrailer(t *testing.T) {
 			}
 		},
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -423,6 +446,7 @@ func TestH1H1RequestTrailer(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Error st.http1() = %v", err)
 	}
+
 	if got, want := res.status, http.StatusOK; got != want {
 		t.Errorf("res.status: %v; want %v", got, want)
 	}
@@ -440,6 +464,7 @@ func TestH1H1HeaderFieldBufferPath(t *testing.T) {
 			t.Fatal("execution path should not be here")
 		},
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -450,6 +475,7 @@ func TestH1H1HeaderFieldBufferPath(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Error st.http1() = %v", err)
 	}
+
 	if got, want := res.status, http.StatusRequestHeaderFieldsTooLarge; got != want {
 		t.Errorf("status: %v; want %v", got, want)
 	}
@@ -464,6 +490,7 @@ func TestH1H1HeaderFieldBuffer(t *testing.T) {
 			t.Fatal("execution path should not be here")
 		},
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -473,6 +500,7 @@ func TestH1H1HeaderFieldBuffer(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Error st.http1() = %v", err)
 	}
+
 	if got, want := res.status, http.StatusRequestHeaderFieldsTooLarge; got != want {
 		t.Errorf("status: %v; want %v", got, want)
 	}
@@ -487,6 +515,7 @@ func TestH1H1HeaderFields(t *testing.T) {
 			t.Fatal("execution path should not be here")
 		},
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -501,6 +530,7 @@ func TestH1H1HeaderFields(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Error st.http1() = %v", err)
 	}
+
 	if got, want := res.status, http.StatusRequestHeaderFieldsTooLarge; got != want {
 		t.Errorf("status: %v; want %v", got, want)
 	}
@@ -515,6 +545,7 @@ func TestH1H1Websocket(t *testing.T) {
 			}
 		}).ServeHTTP,
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -523,6 +554,7 @@ func TestH1H1Websocket(t *testing.T) {
 		name: "TestH1H1Websocket",
 		body: content,
 	})
+
 	if got, want := res.body, content; !bytes.Equal(got, want) {
 		t.Errorf("echo: %q; want %q", got, want)
 	}
@@ -539,6 +571,7 @@ func TestH1H1ReqPhaseSetHeader(t *testing.T) {
 			}
 		},
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -563,6 +596,7 @@ func TestH1H1ReqPhaseReturn(t *testing.T) {
 			t.Fatalf("request should not be forwarded")
 		},
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -603,6 +637,7 @@ func TestH1H1ReqPhaseReturnCONNECTMethod(t *testing.T) {
 			t.Fatalf("request should not be forwarded")
 		},
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -670,6 +705,7 @@ func TestH1H1RespPhaseSetHeader(t *testing.T) {
 	opts := options{
 		args: []string{"--mruby-file=" + testDir + "/resp-set-header.rb"},
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -695,6 +731,7 @@ func TestH1H1RespPhaseReturn(t *testing.T) {
 	opts := options{
 		args: []string{"--mruby-file=" + testDir + "/resp-return.rb"},
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -732,6 +769,7 @@ func TestH1H1HTTPSRedirect(t *testing.T) {
 	opts := options{
 		args: []string{"--redirect-if-not-tls"},
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -745,6 +783,7 @@ func TestH1H1HTTPSRedirect(t *testing.T) {
 	if got, want := res.status, http.StatusPermanentRedirect; got != want {
 		t.Errorf("status = %v; want %v", got, want)
 	}
+
 	if got, want := res.header.Get("location"), "https://127.0.0.1/"; got != want {
 		t.Errorf("location: %v; want %v", got, want)
 	}
@@ -759,6 +798,7 @@ func TestH1H1HTTPSRedirectPort(t *testing.T) {
 			"--redirect-https-port=8443",
 		},
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -773,6 +813,7 @@ func TestH1H1HTTPSRedirectPort(t *testing.T) {
 	if got, want := res.status, http.StatusPermanentRedirect; got != want {
 		t.Errorf("status = %v; want %v", got, want)
 	}
+
 	if got, want := res.header.Get("location"), "https://127.0.0.1:8443/foo?bar"; got != want {
 		t.Errorf("location: %v; want %v", got, want)
 	}
@@ -791,6 +832,7 @@ func TestH1H1POSTRequests(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Error st.http1() = %v", err)
 	}
+
 	if got, want := res.status, http.StatusOK; got != want {
 		t.Errorf("res.status: %v; want %v", got, want)
 	}
@@ -802,6 +844,7 @@ func TestH1H1POSTRequests(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Error st.http1() = %v", err)
 	}
+
 	if got, want := res.status, http.StatusOK; got != want {
 		t.Errorf("res.status: %v; want %v", got, want)
 	}
@@ -817,6 +860,7 @@ func TestH1H1CONNECTMethodFailure(t *testing.T) {
 			}
 		},
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -838,12 +882,39 @@ func TestH1H1CONNECTMethodFailure(t *testing.T) {
 	if _, err := io.ReadAll(resp.Body); err != nil {
 		t.Fatalf("Error io.ReadAll() = %v", err)
 	}
+}
 
-	if _, err := io.WriteString(st.conn, "CONNECT 127.0.0.1:443 HTTP/1.1\r\nTest-Case: TestH1H1CONNECTMethodFailure\r\nHost: 127.0.0.1:443\r\nrequired-header: foo\r\n\r\n"); err != nil {
+// TestH1H1CONNECTMethod tests that CONNECT request succeeds.
+func TestH1H1CONNECTMethod(t *testing.T) {
+	opts := options{
+		handler: func(w http.ResponseWriter, r *http.Request) {
+			hj, ok := w.(http.Hijacker)
+			if !ok {
+				http.Error(w, "Could not hijack the connection", http.StatusInternalServerError)
+				return
+			}
+			_, bufrw, err := hj.Hijack()
+			if err != nil {
+				http.Error(w, err.Error(), http.StatusInternalServerError)
+				return
+			}
+
+			if _, err := bufrw.WriteString("HTTP/1.1 200\r\n\r\n"); err != nil {
+				t.Fatalf("Error bufrw.WriteString() = %v", err)
+			}
+
+			bufrw.Flush()
+		},
+	}
+
+	st := newServerTester(t, opts)
+	defer st.Close()
+
+	if _, err := io.WriteString(st.conn, "CONNECT 127.0.0.1:443 HTTP/1.1\r\nTest-Case: TestH1H1CONNECTMethod\r\nHost: 127.0.0.1:443\r\n\r\n"); err != nil {
 		t.Fatalf("Error io.WriteString() = %v", err)
 	}
 
-	resp, err = http.ReadResponse(bufio.NewReader(st.conn), nil)
+	resp, err := http.ReadResponse(bufio.NewReader(st.conn), nil)
 	if err != nil {
 		t.Fatalf("Error http.ReadResponse() = %v", err)
 	}
@@ -888,6 +959,7 @@ func TestH1H2NoHost(t *testing.T) {
 			t.Errorf("server should not forward bad request")
 		},
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -917,6 +989,7 @@ func TestH1H2HTTP10(t *testing.T) {
 			w.Header().Add("request-host", r.Host)
 		},
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -934,6 +1007,7 @@ func TestH1H2HTTP10(t *testing.T) {
 	if got, want := resp.StatusCode, http.StatusOK; got != want {
 		t.Errorf("status: %v; want %v", got, want)
 	}
+
 	if got, want := resp.Header.Get("request-host"), st.backendHost; got != want {
 		t.Errorf("request-host: %v; want %v", got, want)
 	}
@@ -949,6 +1023,7 @@ func TestH1H2HTTP10NoHostRewrite(t *testing.T) {
 			w.Header().Add("request-host", r.Host)
 		},
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -966,6 +1041,7 @@ func TestH1H2HTTP10NoHostRewrite(t *testing.T) {
 	if got, want := resp.StatusCode, http.StatusOK; got != want {
 		t.Errorf("status: %v; want %v", got, want)
 	}
+
 	if got, want := resp.Header.Get("request-host"), st.backendHost; got != want {
 		t.Errorf("request-host: %v; want %v", got, want)
 	}
@@ -984,6 +1060,7 @@ func TestH1H2CrumbleCookie(t *testing.T) {
 			}
 		},
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -996,6 +1073,7 @@ func TestH1H2CrumbleCookie(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Error st.http1() = %v", err)
 	}
+
 	if got, want := res.status, http.StatusOK; got != want {
 		t.Errorf("status: %v; want %v", got, want)
 	}
@@ -1012,6 +1090,7 @@ func TestH1H2GenerateVia(t *testing.T) {
 			}
 		},
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -1021,6 +1100,7 @@ func TestH1H2GenerateVia(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Error st.http1() = %v", err)
 	}
+
 	if got, want := res.header.Get("Via"), "2 nghttpx"; got != want {
 		t.Errorf("Via: %v; want %v", got, want)
 	}
@@ -1038,6 +1118,7 @@ func TestH1H2AppendVia(t *testing.T) {
 			w.Header().Add("Via", "bar")
 		},
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -1050,6 +1131,7 @@ func TestH1H2AppendVia(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Error st.http1() = %v", err)
 	}
+
 	if got, want := res.header.Get("Via"), "bar, 2 nghttpx"; got != want {
 		t.Errorf("Via: %v; want %v", got, want)
 	}
@@ -1067,6 +1149,7 @@ func TestH1H2NoVia(t *testing.T) {
 			w.Header().Add("Via", "bar")
 		},
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -1079,6 +1162,7 @@ func TestH1H2NoVia(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Error st.http1() = %v", err)
 	}
+
 	if got, want := res.header.Get("Via"), "bar"; got != want {
 		t.Errorf("Via: %v; want %v", got, want)
 	}
@@ -1096,6 +1180,7 @@ func TestH1H2ReqPhaseReturn(t *testing.T) {
 			t.Fatalf("request should not be forwarded")
 		},
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -1136,6 +1221,7 @@ func TestH1H2RespPhaseReturn(t *testing.T) {
 			"--mruby-file=" + testDir + "/resp-return.rb",
 		},
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -1178,6 +1264,7 @@ func TestH1H2TE(t *testing.T) {
 			}
 		},
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -1190,6 +1277,7 @@ func TestH1H2TE(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Error st.http1() = %v", err)
 	}
+
 	if got, want := res.status, http.StatusOK; got != want {
 		t.Errorf("status: %v; want %v", got, want)
 	}
@@ -1205,6 +1293,7 @@ func TestH1APIBackendconfig(t *testing.T) {
 		},
 		connectPort: 3010,
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -1220,18 +1309,21 @@ backend=127.0.0.1,3011
 	if err != nil {
 		t.Fatalf("Error st.http1() = %v", err)
 	}
+
 	if got, want := res.status, http.StatusOK; got != want {
 		t.Errorf("res.status: %v; want %v", got, want)
 	}
 
 	var apiResp APIResponse
-	err = json.Unmarshal(res.body, &apiResp)
+
-	if err != nil {
+	if err := json.Unmarshal(res.body, &apiResp); err != nil {
 		t.Fatalf("Error unmarshaling API response: %v", err)
 	}
+
 	if got, want := apiResp.Status, "Success"; got != want {
 		t.Errorf("apiResp.Status: %v; want %v", got, want)
 	}
+
 	if got, want := apiResp.Code, 200; got != want {
 		t.Errorf("apiResp.Status: %v; want %v", got, want)
 	}
@@ -1247,6 +1339,7 @@ func TestH1APIBackendconfigQuery(t *testing.T) {
 		},
 		connectPort: 3010,
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -1262,18 +1355,21 @@ backend=127.0.0.1,3011
 	if err != nil {
 		t.Fatalf("Error st.http1() = %v", err)
 	}
+
 	if got, want := res.status, http.StatusOK; got != want {
 		t.Errorf("res.status: %v; want %v", got, want)
 	}
 
 	var apiResp APIResponse
-	err = json.Unmarshal(res.body, &apiResp)
+
-	if err != nil {
+	if err := json.Unmarshal(res.body, &apiResp); err != nil {
 		t.Fatalf("Error unmarshaling API response: %v", err)
 	}
+
 	if got, want := apiResp.Status, "Success"; got != want {
 		t.Errorf("apiResp.Status: %v; want %v", got, want)
 	}
+
 	if got, want := apiResp.Code, 200; got != want {
 		t.Errorf("apiResp.Status: %v; want %v", got, want)
 	}
@@ -1289,6 +1385,7 @@ func TestH1APIBackendconfigBadMethod(t *testing.T) {
 		},
 		connectPort: 3010,
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -1304,18 +1401,21 @@ backend=127.0.0.1,3011
 	if err != nil {
 		t.Fatalf("Error st.http1() = %v", err)
 	}
+
 	if got, want := res.status, http.StatusMethodNotAllowed; got != want {
 		t.Errorf("res.status: %v; want %v", got, want)
 	}
 
 	var apiResp APIResponse
-	err = json.Unmarshal(res.body, &apiResp)
+
-	if err != nil {
+	if err := json.Unmarshal(res.body, &apiResp); err != nil {
 		t.Fatalf("Error unmarshaling API response: %v", err)
 	}
+
 	if got, want := apiResp.Status, "Failure"; got != want {
 		t.Errorf("apiResp.Status: %v; want %v", got, want)
 	}
+
 	if got, want := apiResp.Code, 405; got != want {
 		t.Errorf("apiResp.Status: %v; want %v", got, want)
 	}
@@ -1330,6 +1430,7 @@ func TestH1APIConfigrevision(t *testing.T) {
 		},
 		connectPort: 3010,
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -1341,23 +1442,28 @@ func TestH1APIConfigrevision(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Error st.http1() = %v", err)
 	}
+
 	if got, want := res.status, http.StatusOK; got != want {
 		t.Errorf("res.status: %v; want = %v", got, want)
 	}
 
 	var apiResp APIResponse
+
 	d := json.NewDecoder(bytes.NewBuffer(res.body))
 	d.UseNumber()
-	err = d.Decode(&apiResp)
+
-	if err != nil {
+	if err := d.Decode(&apiResp); err != nil {
 		t.Fatalf("Error unmarshalling API response: %v", err)
 	}
+
 	if got, want := apiResp.Status, "Success"; got != want {
 		t.Errorf("apiResp.Status: %v; want %v", got, want)
 	}
+
 	if got, want := apiResp.Code, 200; got != want {
 		t.Errorf("apiResp.Status: %v; want %v", got, want)
 	}
+
 	if got, want := apiResp.Data["configRevision"], json.Number("0"); got != want {
 		t.Errorf(`apiResp.Data["configRevision"]: %v %t; want %v`, got, got, want)
 	}
@@ -1373,6 +1479,7 @@ func TestH1APINotFound(t *testing.T) {
 		},
 		connectPort: 3010,
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -1388,18 +1495,21 @@ backend=127.0.0.1,3011
 	if err != nil {
 		t.Fatalf("Error st.http1() = %v", err)
 	}
+
 	if got, want := res.status, http.StatusNotFound; got != want {
 		t.Errorf("res.status: %v; want %v", got, want)
 	}
 
 	var apiResp APIResponse
-	err = json.Unmarshal(res.body, &apiResp)
+
-	if err != nil {
+	if err := json.Unmarshal(res.body, &apiResp); err != nil {
 		t.Fatalf("Error unmarshaling API response: %v", err)
 	}
+
 	if got, want := apiResp.Status, "Failure"; got != want {
 		t.Errorf("apiResp.Status: %v; want %v", got, want)
 	}
+
 	if got, want := apiResp.Code, 404; got != want {
 		t.Errorf("apiResp.Status: %v; want %v", got, want)
 	}
@@ -1414,6 +1524,7 @@ func TestH1Healthmon(t *testing.T) {
 		},
 		connectPort: 3011,
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -1424,6 +1535,7 @@ func TestH1Healthmon(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Error st.http1() = %v", err)
 	}
+
 	if got, want := res.status, http.StatusOK; got != want {
 		t.Errorf("res.status: %v; want %v", got, want)
 	}
@@ -1438,6 +1550,7 @@ func TestH1ResponseBeforeRequestEnd(t *testing.T) {
 			t.Fatal("request should not be forwarded")
 		},
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -1480,6 +1593,7 @@ func TestH1H1ChunkedEndsPrematurely(t *testing.T) {
 			bufrw.Flush()
 		},
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -1499,6 +1613,7 @@ func TestH1H1RequestMalformedTransferEncoding(t *testing.T) {
 			t.Errorf("server should not forward bad request")
 		},
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -1541,6 +1656,7 @@ func TestH1H1ResponseMalformedTransferEncoding(t *testing.T) {
 			bufrw.Flush()
 		},
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -1550,6 +1666,7 @@ func TestH1H1ResponseMalformedTransferEncoding(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Error st.http1() = %v", err)
 	}
+
 	if got, want := res.status, http.StatusBadGateway; got != want {
 		t.Errorf("res.status: %v; want %v", got, want)
 	}
@@ -1577,6 +1694,7 @@ func TestH1H1ResponseUnknownTransferEncoding(t *testing.T) {
 			bufrw.Flush()
 		},
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -1611,6 +1729,7 @@ func TestH1H1RequestHTTP10TransferEncoding(t *testing.T) {
 			t.Errorf("server should not forward bad request")
 		},
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 

integration-tests/nghttpx_http3_test.go

@@ -5,6 +5,7 @@ package nghttp2
 import (
 	"bytes"
 	"crypto/rand"
+	"errors"
 	"io"
 	"net/http"
 	"regexp"
@@ -35,6 +36,7 @@ func TestH3H1PlainGET(t *testing.T) {
 // TestH3H1RequestBody tests HTTP/3 request with body works.
 func TestH3H1RequestBody(t *testing.T) {
 	body := make([]byte, 3333)
+
 	_, err := rand.Read(body)
 	if err != nil {
 		t.Fatalf("Unable to create request body: %v", err)
@@ -57,7 +59,7 @@ func TestH3H1RequestBody(t *testing.T) {
 				buflen += n
 
 				if err != nil {
-					if err == io.EOF {
+					if errors.Is(err, io.EOF) {
 						break
 					}
 
@@ -73,6 +75,7 @@ func TestH3H1RequestBody(t *testing.T) {
 		},
 		quic: true,
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -83,6 +86,7 @@ func TestH3H1RequestBody(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Error st.http3() = %v", err)
 	}
+
 	if got, want := res.status, http.StatusOK; got != want {
 		t.Errorf("res.status: %v; want %v", got, want)
 	}
@@ -99,6 +103,7 @@ func TestH3H1GenerateVia(t *testing.T) {
 		},
 		quic: true,
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -108,6 +113,7 @@ func TestH3H1GenerateVia(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Error st.http3() = %v", err)
 	}
+
 	if got, want := res.header.Get("Via"), "1.1 nghttpx"; got != want {
 		t.Errorf("Via: %v; want %v", got, want)
 	}
@@ -125,6 +131,7 @@ func TestH3H1AppendVia(t *testing.T) {
 		},
 		quic: true,
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -137,6 +144,7 @@ func TestH3H1AppendVia(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Error st.http3() = %v", err)
 	}
+
 	if got, want := res.header.Get("Via"), "bar, 1.1 nghttpx"; got != want {
 		t.Errorf("Via: %v; want %v", got, want)
 	}
@@ -155,6 +163,7 @@ func TestH3H1NoVia(t *testing.T) {
 		},
 		quic: true,
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -167,6 +176,7 @@ func TestH3H1NoVia(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Error st.http3() = %v", err)
 	}
+
 	if got, want := res.header.Get("Via"), "bar"; got != want {
 		t.Errorf("Via: %v; want %v", got, want)
 	}
@@ -186,6 +196,7 @@ func TestH3H1BadResponseCL(t *testing.T) {
 		},
 		quic: true,
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -204,6 +215,7 @@ func TestH3H1HTTPSRedirect(t *testing.T) {
 		args: []string{"--redirect-if-not-tls"},
 		quic: true,
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -226,6 +238,7 @@ func TestH3H1AffinityCookieTLS(t *testing.T) {
 		args: []string{"--affinity-cookie"},
 		quic: true,
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -243,6 +256,7 @@ func TestH3H1AffinityCookieTLS(t *testing.T) {
 
 	const pattern = `affinity=[0-9a-f]{8}; Path=/foo/bar; Secure`
 	validCookie := regexp.MustCompile(pattern)
+
 	if got := res.header.Get("Set-Cookie"); !validCookie.MatchString(got) {
 		t.Errorf("Set-Cookie: %v; want pattern %v", got, pattern)
 	}
@@ -261,6 +275,7 @@ func TestH3H2ReqPhaseReturn(t *testing.T) {
 		},
 		quic: true,
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -302,6 +317,7 @@ func TestH3H2RespPhaseReturn(t *testing.T) {
 		},
 		quic: true,
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -343,6 +359,7 @@ func TestH3ResponseBeforeRequestEnd(t *testing.T) {
 		},
 		quic: true,
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 
@@ -353,6 +370,7 @@ func TestH3ResponseBeforeRequestEnd(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Error st.http3() = %v", err)
 	}
+
 	if got, want := res.status, http.StatusNotFound; got != want {
 		t.Errorf("res.status: %v; want %v", got, want)
 	}
@@ -381,6 +399,7 @@ func TestH3H1ChunkedEndsPrematurely(t *testing.T) {
 		},
 		quic: true,
 	}
+
 	st := newServerTester(t, opts)
 	defer st.Close()
 

integration-tests/server_tester.go

@@ -3,6 +3,7 @@ package nghttp2
 import (
 	"bufio"
 	"bytes"
+	"cmp"
 	"context"
 	"crypto/tls"
 	"encoding/binary"
@@ -15,7 +16,7 @@ import (
 	"net/url"
 	"os"
 	"os/exec"
-	"sort"
+	"slices"
 	"strconv"
 	"strings"
 	"syscall"
@@ -94,14 +95,17 @@ func newServerTester(t *testing.T, opts options) *serverTester {
 	if opts.handler == nil {
 		opts.handler = noopHandler
 	}
+
 	if opts.connectPort == 0 {
 		opts.connectPort = serverPort
 	}
 
 	ts := httptest.NewUnstartedServer(opts.handler)
 
-	var args []string
+	var (
-	var backendTLS, dns, externalDNS, acceptProxyProtocol, redirectIfNotTLS, affinityCookie, alpnH1 bool
+		args                                                                                        []string
+		backendTLS, dns, externalDNS, acceptProxyProtocol, redirectIfNotTLS, affinityCookie, alpnH1 bool
+	)
 
 	for _, k := range opts.args {
 		switch k {
@@ -124,6 +128,7 @@ func newServerTester(t *testing.T, opts options) *serverTester {
 			args = append(args, k)
 		}
 	}
+
 	if backendTLS {
 		nghttp2.ConfigureServer(ts.Config, &nghttp2.Server{})
 		// According to httptest/server.go, we have to set
@@ -132,13 +137,17 @@ func newServerTester(t *testing.T, opts options) *serverTester {
 		ts.TLS = new(tls.Config)
 		ts.TLS.NextProtos = append(ts.TLS.NextProtos, "h2")
 		ts.StartTLS()
+
 		args = append(args, "-k")
 	} else {
 		ts.Start()
 	}
+
 	scheme := "http"
+
 	if opts.tls {
 		scheme = "https"
+
 		args = append(args, testDir+"/server.key", testDir+"/server.crt")
 	}
 
@@ -150,20 +159,25 @@ func newServerTester(t *testing.T, opts options) *serverTester {
 	// URL.Host looks like "127.0.0.1:8080", but we want
 	// "127.0.0.1,8080"
 	b := "-b"
+
 	if !externalDNS {
-		b += fmt.Sprintf("%v;", strings.Replace(backendURL.Host, ":", ",", -1))
+		b += fmt.Sprintf("%v;", strings.ReplaceAll(backendURL.Host, ":", ","))
 	} else {
 		sep := strings.LastIndex(backendURL.Host, ":")
 		if sep == -1 {
 			t.Fatalf("backendURL.Host %v does not contain separator ':'", backendURL.Host)
 		}
+
 		// We use awesome service nip.io.
 		b += fmt.Sprintf("%v.nip.io,%v;", backendURL.Host[:sep], backendURL.Host[sep+1:])
+		// Make external DNS tests less flaky.
+		args = append(args, "--backend-address-family=IPv4")
 	}
 
 	if backendTLS {
 		b += ";proto=h2;tls"
 	}
+
 	if dns {
 		b += ";dns"
 	}
@@ -177,11 +191,13 @@ func newServerTester(t *testing.T, opts options) *serverTester {
 	}
 
 	noTLS := ";no-tls"
+
 	if opts.tls {
 		noTLS = ""
 	}
 
 	var proxyProto string
+
 	if acceptProxyProtocol {
 		proxyProto = ";proxyproto"
 	}
@@ -192,7 +208,19 @@ func newServerTester(t *testing.T, opts options) *serverTester {
 	if opts.quic {
 		args = append(args,
 			fmt.Sprintf("-f127.0.0.1,%v;quic", serverPort),
-			"--no-quic-bpf")
+			"--no-quic-bpf",
+			// quic-go client just closes connection after
+			// receiving the first GOAWAY without any
+			// indication like sending CONNECTION_CLOSE if
+			// there is no active stream.  If that
+			// happens, server keeps resending 2nd GOAWAY
+			// until idle timeout passes.  If that happens
+			// during Close(), the process will be killed
+			// because the default idle timeout is longer
+			// than the close timeout.  Shorten the idle
+			// timeout to prevent it from happening.
+			"--frontend-quic-idle-timeout=5",
+		)
 	}
 
 	authority := fmt.Sprintf("127.0.0.1:%v", opts.connectPort)
@@ -218,6 +246,7 @@ func newServerTester(t *testing.T, opts options) *serverTester {
 	}
 
 	retry := 0
+
 	for {
 		time.Sleep(50 * time.Millisecond)
 
@@ -231,32 +260,41 @@ func newServerTester(t *testing.T, opts options) *serverTester {
 			}
 
 			var tlsConfig *tls.Config
+
 			if opts.tlsConfig == nil {
 				tlsConfig = new(tls.Config)
 			} else {
 				tlsConfig = opts.tlsConfig.Clone()
 			}
+
 			tlsConfig.InsecureSkipVerify = true
+
 			if alpnH1 {
 				tlsConfig.NextProtos = []string{"http/1.1"}
 			} else {
 				tlsConfig.NextProtos = []string{"h2"}
 			}
+
 			tlsConn := tls.Client(conn, tlsConfig)
+
 			err = tlsConn.Handshake()
 			if err == nil {
 				conn = tlsConn
 			}
 		}
+
 		if err != nil {
 			retry++
 			if retry >= 100 {
 				st.Close()
 				st.t.Fatalf("Error server is not responding too long; server command-line arguments may be invalid")
 			}
+
 			continue
 		}
+
 		st.conn = conn
+
 		break
 	}
 
@@ -273,12 +311,15 @@ func (st *serverTester) Close() {
 	if st.conn != nil {
 		st.conn.Close()
 	}
+
 	if st.cmd != nil {
 		done := make(chan struct{})
+
 		go func() {
 			if err := st.cmd.Wait(); err != nil {
 				st.t.Errorf("Error st.cmd.Wait() = %v", err)
 			}
+
 			close(done)
 		}()
 
@@ -292,9 +333,11 @@ func (st *serverTester) Close() {
 			if err := st.cmd.Process.Kill(); err != nil {
 				st.t.Errorf("Error st.cmd.Process.Kill() = %v", err)
 			}
+
 			<-done
 		}
 	}
+
 	if st.ts != nil {
 		st.ts.Close()
 	}
@@ -307,6 +350,7 @@ func (st *serverTester) readFrame() (http2.Frame, error) {
 			st.errCh <- err
 			return
 		}
+
 		st.frCh <- f
 	}()
 
@@ -347,10 +391,12 @@ func (cbr *chunkedBodyReader) Read(p []byte) (n int, err error) {
 	// after request was sent and before body returns EOF.
 	if !cbr.trailerWritten {
 		cbr.trailerWritten = true
+
 		for _, h := range cbr.trailer {
 			cbr.req.Trailer.Set(h.Name, h.Value)
 		}
 	}
+
 	return cbr.body.Read(p)
 }
 
@@ -363,6 +409,7 @@ func (st *serverTester) websocket(rp requestParam) *serverResponse {
 	}
 
 	config.Header.Add("Test-Case", rp.name)
+
 	for _, h := range rp.header {
 		config.Header.Add(h.Name, h.Value)
 	}
@@ -377,7 +424,9 @@ func (st *serverTester) websocket(rp requestParam) *serverResponse {
 	}
 
 	msg := make([]byte, 1024)
+
 	var n int
+
 	if n, err = ws.Read(msg); err != nil {
 		st.t.Fatalf("ws.Read() returned error: %v", err)
 	}
@@ -391,19 +440,25 @@ func (st *serverTester) websocket(rp requestParam) *serverResponse {
 
 func (st *serverTester) http1(rp requestParam) (*serverResponse, error) {
 	method := "GET"
+
 	if rp.method != "" {
 		method = rp.method
 	}
 
-	var body io.Reader
+	var (
-	var cbr *chunkedBodyReader
+		body io.Reader
+		cbr  *chunkedBodyReader
+	)
+
 	if rp.body != nil {
 		body = bytes.NewBuffer(rp.body)
+
 		if len(rp.trailer) != 0 {
 			cbr = &chunkedBodyReader{
 				trailer: rp.trailer,
 				body:    body,
 			}
+
 			body = cbr
 		}
 	}
@@ -415,6 +470,7 @@ func (st *serverTester) http1(rp requestParam) (*serverResponse, error) {
 		if err != nil {
 			st.t.Fatalf("Error parsing URL from st.url %v: %v", st.url, err)
 		}
+
 		u.Path = ""
 		u.RawQuery = ""
 		reqURL = u.String() + rp.path
@@ -427,30 +483,38 @@ func (st *serverTester) http1(rp requestParam) (*serverResponse, error) {
 	if err != nil {
 		return nil, err
 	}
+
 	for _, h := range rp.header {
 		req.Header.Add(h.Name, h.Value)
 	}
+
 	req.Header.Add("Test-Case", rp.name)
+
 	if cbr != nil {
 		cbr.req = req
 		// this makes request use chunked encoding
 		req.ContentLength = -1
 		req.Trailer = make(http.Header)
+
 		for _, h := range cbr.trailer {
 			req.Trailer.Set(h.Name, "")
 		}
 	}
+
 	if err := req.Write(st.conn); err != nil {
 		return nil, err
 	}
+
 	resp, err := http.ReadResponse(bufio.NewReader(st.conn), req)
 	if err != nil {
 		return nil, err
 	}
+
 	respBody, err := io.ReadAll(resp.Body)
 	if err != nil {
 		return nil, err
 	}
+
 	resp.Body.Close()
 
 	res := &serverResponse{
@@ -468,6 +532,7 @@ func (st *serverTester) http2(rp requestParam) (*serverResponse, error) {
 	st.header = make(http.Header)
 
 	var id uint32
+
 	if rp.streamID != 0 {
 		id = rp.streamID
 		if id >= st.nextStreamID && id%2 == 1 {
@@ -481,6 +546,7 @@ func (st *serverTester) http2(rp requestParam) (*serverResponse, error) {
 	if !st.h2PrefaceSent {
 		st.h2PrefaceSent = true
 		fmt.Fprint(st.conn, "PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n")
+
 		if err := st.fr.WriteSettings(); err != nil {
 			return nil, err
 		}
@@ -498,26 +564,32 @@ func (st *serverTester) http2(rp requestParam) (*serverResponse, error) {
 		if rp.method != "" {
 			method = rp.method
 		}
+
 		_ = st.enc.WriteField(pair(":method", method))
 
 		scheme := "http"
+
 		if rp.scheme != "" {
 			scheme = rp.scheme
 		}
+
 		_ = st.enc.WriteField(pair(":scheme", scheme))
 
 		authority := st.authority
+
 		if rp.authority != "" {
 			authority = rp.authority
 		}
+
 		_ = st.enc.WriteField(pair(":authority", authority))
 
 		path := "/"
+
 		if rp.path != "" {
 			path = rp.path
 		}
-		_ = st.enc.WriteField(pair(":path", path))
 
+		_ = st.enc.WriteField(pair(":path", path))
 		_ = st.enc.WriteField(pair("test-case", rp.name))
 
 		for _, h := range rp.header {
@@ -543,9 +615,11 @@ func (st *serverTester) http2(rp requestParam) (*serverResponse, error) {
 
 		if len(rp.trailer) != 0 {
 			st.headerBlkBuf.Reset()
+
 			for _, h := range rp.trailer {
 				_ = st.enc.WriteField(h)
 			}
+
 			err := st.fr.WriteHeaders(http2.HeadersFrameParam{
 				StreamID:      id,
 				EndStream:     true,
@@ -563,56 +637,65 @@ loop:
 		if err != nil {
 			return res, err
 		}
+
 		switch f := fr.(type) {
 		case *http2.HeadersFrame:
 			_, err := st.dec.Write(f.HeaderBlockFragment())
 			if err != nil {
 				return res, err
 			}
-			sr, ok := streams[f.FrameHeader.StreamID]
+
+			sr, ok := streams[f.StreamID]
 			if !ok {
 				st.header = make(http.Header)
 				break
 			}
+
 			sr.header = cloneHeader(st.header)
+
 			var status int
+
 			status, err = strconv.Atoi(sr.header.Get(":status"))
 			if err != nil {
-				return res, fmt.Errorf("Error parsing status code: %w", err)
+				return res, fmt.Errorf("could not parse :status: %w", err)
 			}
+
 			sr.status = status
-			if f.StreamEnded() {
+
-				if streamEnded(res, streams, sr) {
+			if f.StreamEnded() && streamEnded(res, streams, sr) {
-					break loop
+				break loop
-				}
 			}
 		case *http2.PushPromiseFrame:
 			_, err := st.dec.Write(f.HeaderBlockFragment())
 			if err != nil {
 				return res, err
 			}
+
 			sr := &serverResponse{
 				streamID:  f.PromiseID,
 				reqHeader: cloneHeader(st.header),
 			}
+
 			streams[sr.streamID] = sr
 		case *http2.DataFrame:
-			sr, ok := streams[f.FrameHeader.StreamID]
+			sr, ok := streams[f.StreamID]
 			if !ok {
 				break
 			}
+
 			sr.body = append(sr.body, f.Data()...)
-			if f.StreamEnded() {
+
-				if streamEnded(res, streams, sr) {
+			if f.StreamEnded() && streamEnded(res, streams, sr) {
-					break loop
+				break loop
-				}
 			}
 		case *http2.RSTStreamFrame:
-			sr, ok := streams[f.FrameHeader.StreamID]
+			sr, ok := streams[f.StreamID]
 			if !ok {
 				break
 			}
+
 			sr.errCode = f.ErrCode
+
 			if streamEnded(res, streams, sr) {
 				break loop
 			}
@@ -620,27 +703,36 @@ loop:
 			if f.ErrCode == http2.ErrCodeNo {
 				break
 			}
+
 			res.errCode = f.ErrCode
 			res.connErr = true
+
 			break loop
 		case *http2.SettingsFrame:
 			if f.IsAck() {
 				break
 			}
+
 			if err := st.fr.WriteSettingsAck(); err != nil {
 				return res, err
 			}
 		}
 	}
-	sort.Sort(ByStreamID(res.pushResponse))
+
+	slices.SortFunc(res.pushResponse, func(a, b *serverResponse) int {
+		return cmp.Compare(a.streamID, b.streamID)
+	})
+
 	return res, nil
 }
 
 func streamEnded(mainSr *serverResponse, streams map[uint32]*serverResponse, sr *serverResponse) bool {
 	delete(streams, sr.streamID)
+
 	if mainSr.streamID != sr.streamID {
 		mainSr.pushResponse = append(mainSr.pushResponse, sr)
 	}
+
 	return len(streams) == 0
 }
 
@@ -656,27 +748,15 @@ type serverResponse struct {
 	pushResponse []*serverResponse // pushed response
 }
 
-type ByStreamID []*serverResponse
-
-func (b ByStreamID) Len() int {
-	return len(b)
-}
-
-func (b ByStreamID) Swap(i, j int) {
-	b[i], b[j] = b[j], b[i]
-}
-
-func (b ByStreamID) Less(i, j int) bool {
-	return b[i].streamID < b[j].streamID
-}
-
 func cloneHeader(h http.Header) http.Header {
 	h2 := make(http.Header, len(h))
+
 	for k, vv := range h {
 		vv2 := make([]string, len(vv))
 		copy(vv2, vv)
 		h2[k] = vv2
 	}
+
 	return h2
 }
 
@@ -727,6 +807,7 @@ func writeProxyProtocolV2(w io.Writer, hdr proxyProtocolV2) error {
 	if _, err := w.Write([]byte{0x0D, 0x0A, 0x0D, 0x0A, 0x00, 0x0D, 0x0A, 0x51, 0x55, 0x49, 0x54, 0x0A}); err != nil {
 		return err
 	}
+
 	if _, err := w.Write([]byte{byte(0x20 | hdr.command)}); err != nil {
 		return err
 	}
@@ -734,44 +815,59 @@ func writeProxyProtocolV2(w io.Writer, hdr proxyProtocolV2) error {
 	switch srcAddr := hdr.sourceAddress.(type) {
 	case *net.TCPAddr:
 		dstAddr := hdr.destinationAddress.(*net.TCPAddr)
+
 		if len(srcAddr.IP) != len(dstAddr.IP) {
 			panic("len(srcAddr.IP) != len(dstAddr.IP)")
 		}
+
 		var fam byte
+
 		if len(srcAddr.IP) == 4 {
 			fam = byte(proxyProtocolV2FamilyInet << 4)
 		} else {
 			fam = byte(proxyProtocolV2FamilyInet6 << 4)
 		}
+
 		fam |= byte(proxyProtocolV2ProtocolStream)
+
 		if _, err := w.Write([]byte{fam}); err != nil {
 			return err
 		}
+
 		length := uint16(len(srcAddr.IP)*2 + 4 + len(hdr.additionalData))
+
 		if err := binary.Write(w, binary.BigEndian, length); err != nil {
 			return err
 		}
+
 		if _, err := w.Write(srcAddr.IP); err != nil {
 			return err
 		}
+
 		if _, err := w.Write(dstAddr.IP); err != nil {
 			return err
 		}
+
 		if err := binary.Write(w, binary.BigEndian, uint16(srcAddr.Port)); err != nil {
 			return err
 		}
+
 		if err := binary.Write(w, binary.BigEndian, uint16(dstAddr.Port)); err != nil {
 			return err
 		}
 	case *net.UnixAddr:
 		dstAddr := hdr.destinationAddress.(*net.UnixAddr)
+
 		if len(srcAddr.Name) > 108 {
 			panic("too long Unix source address")
 		}
+
 		if len(dstAddr.Name) > 108 {
 			panic("too long Unix destination address")
 		}
+
 		fam := byte(proxyProtocolV2FamilyUnix << 4)
+
 		switch srcAddr.Net {
 		case "unix":
 			fam |= byte(proxyProtocolV2ProtocolStream)
@@ -780,32 +876,43 @@ func writeProxyProtocolV2(w io.Writer, hdr proxyProtocolV2) error {
 		default:
 			fam |= byte(proxyProtocolV2ProtocolUnspec)
 		}
+
 		if _, err := w.Write([]byte{fam}); err != nil {
 			return err
 		}
+
 		length := uint16(216 + len(hdr.additionalData))
+
 		if err := binary.Write(w, binary.BigEndian, length); err != nil {
 			return err
 		}
+
 		zeros := make([]byte, 108)
+
 		if _, err := w.Write([]byte(srcAddr.Name)); err != nil {
 			return err
 		}
+
 		if _, err := w.Write(zeros[:108-len(srcAddr.Name)]); err != nil {
 			return err
 		}
+
 		if _, err := w.Write([]byte(dstAddr.Name)); err != nil {
 			return err
 		}
+
 		if _, err := w.Write(zeros[:108-len(dstAddr.Name)]); err != nil {
 			return err
 		}
 	default:
 		fam := byte(proxyProtocolV2FamilyUnspec<<4) | byte(proxyProtocolV2ProtocolUnspec)
+
 		if _, err := w.Write([]byte{fam}); err != nil {
 			return err
 		}
+
 		length := uint16(len(hdr.additionalData))
+
 		if err := binary.Write(w, binary.BigEndian, length); err != nil {
 			return err
 		}

integration-tests/server_tester_http3.go

@@ -15,7 +15,7 @@ import (
 )
 
 func (st *serverTester) http3(rp requestParam) (*serverResponse, error) {
-	rt := &http3.RoundTripper{
+	rt := &http3.Transport{
 		TLSClientConfig: &tls.Config{
 			InsecureSkipVerify: true,
 		},
@@ -45,6 +45,7 @@ func (st *serverTester) http3(rp requestParam) (*serverResponse, error) {
 		if err != nil {
 			st.t.Fatalf("Error parsing URL from st.url %v: %v", st.url, err)
 		}
+
 		u.Path = ""
 		u.RawQuery = ""
 		reqURL = u.String() + rp.path

lib/CMakeLists.txt

@@ -47,7 +47,29 @@ if(WIN32)
   set(NGHTTP2_RES ${CMAKE_CURRENT_BINARY_DIR}/version.rc)
 endif()
 
-set(EXPORT_SET "${PROJECT_NAME}-targets")
+set(NGHTTP2_GENERATED_DIR "${CMAKE_CURRENT_BINARY_DIR}/generated")
+set(NGHTTP2_VERSION_CONFIG "${NGHTTP2_GENERATED_DIR}/${PROJECT_NAME}ConfigVersion.cmake")
+set(NGHTTP2_PROJECT_CONFIG "${NGHTTP2_GENERATED_DIR}/${PROJECT_NAME}Config.cmake")
+set(NGHTTP2_TARGETS_EXPORT_NAME "${PROJECT_NAME}Targets")
+set(NGHTTP2_CONFIG_INSTALL_DIR "lib/cmake/${PROJECT_NAME}")
+set(NGHTTP2_NAMESPACE "${PROJECT_NAME}::")
+set(NGHTTP2_VERSION ${PROJECT_VERSION})
+
+include(CMakePackageConfigHelpers)
+write_basic_package_version_file(
+  "${NGHTTP2_VERSION_CONFIG}" VERSION ${NGHTTP2_VERSION} COMPATIBILITY SameMajorVersion
+)
+configure_file("${CMAKE_CURRENT_SOURCE_DIR}/config.cmake.in" "${NGHTTP2_PROJECT_CONFIG}" @ONLY)
+
+# Install cmake config files
+install(
+  FILES "${NGHTTP2_PROJECT_CONFIG}" "${NGHTTP2_VERSION_CONFIG}"
+  DESTINATION "${NGHTTP2_CONFIG_INSTALL_DIR}")
+
+install(
+  EXPORT "${NGHTTP2_TARGETS_EXPORT_NAME}"
+  NAMESPACE "${NGHTTP2_NAMESPACE}"
+  DESTINATION "${NGHTTP2_CONFIG_INSTALL_DIR}")
 
 # Public shared library
 if(BUILD_SHARED_LIBS)
@@ -65,7 +87,11 @@ if(BUILD_SHARED_LIBS)
     $<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>
   )
 
-  install(TARGETS ${SHARED_LIB} EXPORT ${EXPORT_SET})
+  install(TARGETS ${SHARED_LIB}
+    EXPORT ${NGHTTP2_TARGETS_EXPORT_NAME}
+    ARCHIVE DESTINATION "${CMAKE_INSTALL_LIBDIR}"
+    LIBRARY DESTINATION "${CMAKE_INSTALL_LIBDIR}"
+    RUNTIME DESTINATION "${CMAKE_INSTALL_BINDIR}")
   list(APPEND nghttp2_exports ${SHARED_LIB})
 endif()
 
@@ -87,7 +113,9 @@ if(BUILD_STATIC_LIBS)
 
   target_compile_definitions(${STATIC_LIB} PUBLIC "-DNGHTTP2_STATICLIB")
 
-  install(TARGETS ${STATIC_LIB} EXPORT ${EXPORT_SET})
+  install(TARGETS ${STATIC_LIB}
+    EXPORT ${NGHTTP2_TARGETS_EXPORT_NAME}
+    ARCHIVE DESTINATION "${CMAKE_INSTALL_LIBDIR}")
   list(APPEND nghttp2_exports ${STATIC_LIB})
 endif()
 
@@ -97,11 +125,7 @@ else()
   set(LIB_SELECTED ${STATIC_LIB})
 endif()
 
-add_library(${PROJECT_NAME}::nghttp2 ALIAS ${LIB_SELECTED})
+add_library(nghttp2 ALIAS ${LIB_SELECTED})
 
 install(FILES "${CMAKE_CURRENT_BINARY_DIR}/libnghttp2.pc"
   DESTINATION "${CMAKE_INSTALL_LIBDIR}/pkgconfig")
-
-install(EXPORT ${EXPORT_SET}
-  DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/${PROJECT_NAME}
-  NAMESPACE ${PROJECT_NAME}::)

lib/Makefile.am

@@ -22,7 +22,7 @@
 # WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 SUBDIRS = includes
 
-EXTRA_DIST = Makefile.msvc CMakeLists.txt version.rc.in
+EXTRA_DIST = Makefile.msvc CMakeLists.txt version.rc.in config.cmake.in
 
 AM_CFLAGS = $(WARNCFLAGS) $(EXTRACFLAG)
 AM_CPPFLAGS = -I$(srcdir)/includes -I$(builddir)/includes -DBUILDING_NGHTTP2 \

lib/config.cmake.in

@@ -0,0 +1,3 @@
+include(CMakeFindDependencyMacro)
+
+include("${CMAKE_CURRENT_LIST_DIR}/@NGHTTP2_TARGETS_EXPORT_NAME@.cmake")

lib/nghttp2_alpn.h

@@ -27,8 +27,8 @@
 
 #ifdef HAVE_CONFIG_H
 #  include <config.h>
-#endif /* HAVE_CONFIG_H */
+#endif /* defined(HAVE_CONFIG_H) */
 
 #include <nghttp2/nghttp2.h>
 
-#endif /* NGHTTP2_ALPN_H */
+#endif /* !defined(NGHTTP2_ALPN_H) */

lib/nghttp2_buf.h

@@ -27,7 +27,7 @@
 
 #ifdef HAVE_CONFIG_H
 #  include <config.h>
-#endif /* HAVE_CONFIG_H */
+#endif /* defined(HAVE_CONFIG_H) */
 
 #include <nghttp2/nghttp2.h>
 
@@ -409,4 +409,4 @@ int nghttp2_bufs_next_present(nghttp2_bufs *bufs);
  */
 size_t nghttp2_bufs_len(nghttp2_bufs *bufs);
 
-#endif /* NGHTTP2_BUF_H */
+#endif /* !defined(NGHTTP2_BUF_H) */

lib/nghttp2_callbacks.c

@@ -41,163 +41,168 @@ void nghttp2_session_callbacks_del(nghttp2_session_callbacks *callbacks) {
 }
 
 void nghttp2_session_callbacks_set_send_callback(
-    nghttp2_session_callbacks *cbs, nghttp2_send_callback send_callback) {
+  nghttp2_session_callbacks *cbs, nghttp2_send_callback send_callback) {
   cbs->send_callback = send_callback;
 }
 
 void nghttp2_session_callbacks_set_send_callback2(
-    nghttp2_session_callbacks *cbs, nghttp2_send_callback2 send_callback) {
+  nghttp2_session_callbacks *cbs, nghttp2_send_callback2 send_callback) {
   cbs->send_callback2 = send_callback;
 }
 
 void nghttp2_session_callbacks_set_recv_callback(
-    nghttp2_session_callbacks *cbs, nghttp2_recv_callback recv_callback) {
+  nghttp2_session_callbacks *cbs, nghttp2_recv_callback recv_callback) {
   cbs->recv_callback = recv_callback;
 }
 
 void nghttp2_session_callbacks_set_recv_callback2(
-    nghttp2_session_callbacks *cbs, nghttp2_recv_callback2 recv_callback) {
+  nghttp2_session_callbacks *cbs, nghttp2_recv_callback2 recv_callback) {
   cbs->recv_callback2 = recv_callback;
 }
 
 void nghttp2_session_callbacks_set_on_frame_recv_callback(
-    nghttp2_session_callbacks *cbs,
+  nghttp2_session_callbacks *cbs,
-    nghttp2_on_frame_recv_callback on_frame_recv_callback) {
+  nghttp2_on_frame_recv_callback on_frame_recv_callback) {
   cbs->on_frame_recv_callback = on_frame_recv_callback;
 }
 
 void nghttp2_session_callbacks_set_on_invalid_frame_recv_callback(
-    nghttp2_session_callbacks *cbs,
+  nghttp2_session_callbacks *cbs,
-    nghttp2_on_invalid_frame_recv_callback on_invalid_frame_recv_callback) {
+  nghttp2_on_invalid_frame_recv_callback on_invalid_frame_recv_callback) {
   cbs->on_invalid_frame_recv_callback = on_invalid_frame_recv_callback;
 }
 
 void nghttp2_session_callbacks_set_on_data_chunk_recv_callback(
-    nghttp2_session_callbacks *cbs,
+  nghttp2_session_callbacks *cbs,
-    nghttp2_on_data_chunk_recv_callback on_data_chunk_recv_callback) {
+  nghttp2_on_data_chunk_recv_callback on_data_chunk_recv_callback) {
   cbs->on_data_chunk_recv_callback = on_data_chunk_recv_callback;
 }
 
 void nghttp2_session_callbacks_set_before_frame_send_callback(
-    nghttp2_session_callbacks *cbs,
+  nghttp2_session_callbacks *cbs,
-    nghttp2_before_frame_send_callback before_frame_send_callback) {
+  nghttp2_before_frame_send_callback before_frame_send_callback) {
   cbs->before_frame_send_callback = before_frame_send_callback;
 }
 
 void nghttp2_session_callbacks_set_on_frame_send_callback(
-    nghttp2_session_callbacks *cbs,
+  nghttp2_session_callbacks *cbs,
-    nghttp2_on_frame_send_callback on_frame_send_callback) {
+  nghttp2_on_frame_send_callback on_frame_send_callback) {
   cbs->on_frame_send_callback = on_frame_send_callback;
 }
 
 void nghttp2_session_callbacks_set_on_frame_not_send_callback(
-    nghttp2_session_callbacks *cbs,
+  nghttp2_session_callbacks *cbs,
-    nghttp2_on_frame_not_send_callback on_frame_not_send_callback) {
+  nghttp2_on_frame_not_send_callback on_frame_not_send_callback) {
   cbs->on_frame_not_send_callback = on_frame_not_send_callback;
 }
 
 void nghttp2_session_callbacks_set_on_stream_close_callback(
-    nghttp2_session_callbacks *cbs,
+  nghttp2_session_callbacks *cbs,
-    nghttp2_on_stream_close_callback on_stream_close_callback) {
+  nghttp2_on_stream_close_callback on_stream_close_callback) {
   cbs->on_stream_close_callback = on_stream_close_callback;
 }
 
 void nghttp2_session_callbacks_set_on_begin_headers_callback(
-    nghttp2_session_callbacks *cbs,
+  nghttp2_session_callbacks *cbs,
-    nghttp2_on_begin_headers_callback on_begin_headers_callback) {
+  nghttp2_on_begin_headers_callback on_begin_headers_callback) {
   cbs->on_begin_headers_callback = on_begin_headers_callback;
 }
 
 void nghttp2_session_callbacks_set_on_header_callback(
-    nghttp2_session_callbacks *cbs,
+  nghttp2_session_callbacks *cbs,
-    nghttp2_on_header_callback on_header_callback) {
+  nghttp2_on_header_callback on_header_callback) {
   cbs->on_header_callback = on_header_callback;
 }
 
 void nghttp2_session_callbacks_set_on_header_callback2(
-    nghttp2_session_callbacks *cbs,
+  nghttp2_session_callbacks *cbs,
-    nghttp2_on_header_callback2 on_header_callback2) {
+  nghttp2_on_header_callback2 on_header_callback2) {
   cbs->on_header_callback2 = on_header_callback2;
 }
 
 void nghttp2_session_callbacks_set_on_invalid_header_callback(
-    nghttp2_session_callbacks *cbs,
+  nghttp2_session_callbacks *cbs,
-    nghttp2_on_invalid_header_callback on_invalid_header_callback) {
+  nghttp2_on_invalid_header_callback on_invalid_header_callback) {
   cbs->on_invalid_header_callback = on_invalid_header_callback;
 }
 
 void nghttp2_session_callbacks_set_on_invalid_header_callback2(
-    nghttp2_session_callbacks *cbs,
+  nghttp2_session_callbacks *cbs,
-    nghttp2_on_invalid_header_callback2 on_invalid_header_callback2) {
+  nghttp2_on_invalid_header_callback2 on_invalid_header_callback2) {
   cbs->on_invalid_header_callback2 = on_invalid_header_callback2;
 }
 
 void nghttp2_session_callbacks_set_select_padding_callback(
-    nghttp2_session_callbacks *cbs,
+  nghttp2_session_callbacks *cbs,
-    nghttp2_select_padding_callback select_padding_callback) {
+  nghttp2_select_padding_callback select_padding_callback) {
   cbs->select_padding_callback = select_padding_callback;
 }
 
 void nghttp2_session_callbacks_set_select_padding_callback2(
-    nghttp2_session_callbacks *cbs,
+  nghttp2_session_callbacks *cbs,
-    nghttp2_select_padding_callback2 select_padding_callback) {
+  nghttp2_select_padding_callback2 select_padding_callback) {
   cbs->select_padding_callback2 = select_padding_callback;
 }
 
 void nghttp2_session_callbacks_set_data_source_read_length_callback(
-    nghttp2_session_callbacks *cbs,
+  nghttp2_session_callbacks *cbs,
-    nghttp2_data_source_read_length_callback data_source_read_length_callback) {
+  nghttp2_data_source_read_length_callback data_source_read_length_callback) {
   cbs->read_length_callback = data_source_read_length_callback;
 }
 
 void nghttp2_session_callbacks_set_data_source_read_length_callback2(
-    nghttp2_session_callbacks *cbs, nghttp2_data_source_read_length_callback2
+  nghttp2_session_callbacks *cbs,
-                                        data_source_read_length_callback) {
+  nghttp2_data_source_read_length_callback2 data_source_read_length_callback) {
   cbs->read_length_callback2 = data_source_read_length_callback;
 }
 
 void nghttp2_session_callbacks_set_on_begin_frame_callback(
-    nghttp2_session_callbacks *cbs,
+  nghttp2_session_callbacks *cbs,
-    nghttp2_on_begin_frame_callback on_begin_frame_callback) {
+  nghttp2_on_begin_frame_callback on_begin_frame_callback) {
   cbs->on_begin_frame_callback = on_begin_frame_callback;
 }
 
 void nghttp2_session_callbacks_set_send_data_callback(
-    nghttp2_session_callbacks *cbs,
+  nghttp2_session_callbacks *cbs,
-    nghttp2_send_data_callback send_data_callback) {
+  nghttp2_send_data_callback send_data_callback) {
   cbs->send_data_callback = send_data_callback;
 }
 
 void nghttp2_session_callbacks_set_pack_extension_callback(
-    nghttp2_session_callbacks *cbs,
+  nghttp2_session_callbacks *cbs,
-    nghttp2_pack_extension_callback pack_extension_callback) {
+  nghttp2_pack_extension_callback pack_extension_callback) {
   cbs->pack_extension_callback = pack_extension_callback;
 }
 
 void nghttp2_session_callbacks_set_pack_extension_callback2(
-    nghttp2_session_callbacks *cbs,
+  nghttp2_session_callbacks *cbs,
-    nghttp2_pack_extension_callback2 pack_extension_callback) {
+  nghttp2_pack_extension_callback2 pack_extension_callback) {
   cbs->pack_extension_callback2 = pack_extension_callback;
 }
 
 void nghttp2_session_callbacks_set_unpack_extension_callback(
-    nghttp2_session_callbacks *cbs,
+  nghttp2_session_callbacks *cbs,
-    nghttp2_unpack_extension_callback unpack_extension_callback) {
+  nghttp2_unpack_extension_callback unpack_extension_callback) {
   cbs->unpack_extension_callback = unpack_extension_callback;
 }
 
 void nghttp2_session_callbacks_set_on_extension_chunk_recv_callback(
-    nghttp2_session_callbacks *cbs,
+  nghttp2_session_callbacks *cbs,
-    nghttp2_on_extension_chunk_recv_callback on_extension_chunk_recv_callback) {
+  nghttp2_on_extension_chunk_recv_callback on_extension_chunk_recv_callback) {
   cbs->on_extension_chunk_recv_callback = on_extension_chunk_recv_callback;
 }
 
 void nghttp2_session_callbacks_set_error_callback(
-    nghttp2_session_callbacks *cbs, nghttp2_error_callback error_callback) {
+  nghttp2_session_callbacks *cbs, nghttp2_error_callback error_callback) {
   cbs->error_callback = error_callback;
 }
 
 void nghttp2_session_callbacks_set_error_callback2(
-    nghttp2_session_callbacks *cbs, nghttp2_error_callback2 error_callback2) {
+  nghttp2_session_callbacks *cbs, nghttp2_error_callback2 error_callback2) {
   cbs->error_callback2 = error_callback2;
 }
+
+void nghttp2_session_callbacks_set_rand_callback(
+  nghttp2_session_callbacks *cbs, nghttp2_rand_callback rand_callback) {
+  cbs->rand_callback = rand_callback;
+}

lib/nghttp2_callbacks.h

@@ -27,7 +27,7 @@
 
 #ifdef HAVE_CONFIG_H
 #  include <config.h>
-#endif /* HAVE_CONFIG_H */
+#endif /* defined(HAVE_CONFIG_H) */
 
 #include <nghttp2/nghttp2.h>
 
@@ -151,6 +151,7 @@ struct nghttp2_session_callbacks {
   nghttp2_on_extension_chunk_recv_callback on_extension_chunk_recv_callback;
   nghttp2_error_callback error_callback;
   nghttp2_error_callback2 error_callback2;
+  nghttp2_rand_callback rand_callback;
 };
 
-#endif /* NGHTTP2_CALLBACKS_H */
+#endif /* !defined(NGHTTP2_CALLBACKS_H) */

lib/nghttp2_debug.c

@@ -34,7 +34,7 @@ static void nghttp2_default_debug_vfprintf_callback(const char *fmt,
 }
 
 static nghttp2_debug_vprintf_callback static_debug_vprintf_callback =
-    nghttp2_default_debug_vfprintf_callback;
+  nghttp2_default_debug_vfprintf_callback;
 
 void nghttp2_debug_vprintf(const char *format, ...) {
   if (static_debug_vprintf_callback) {
@@ -46,15 +46,15 @@ void nghttp2_debug_vprintf(const char *format, ...) {
 }
 
 void nghttp2_set_debug_vprintf_callback(
-    nghttp2_debug_vprintf_callback debug_vprintf_callback) {
+  nghttp2_debug_vprintf_callback debug_vprintf_callback) {
   static_debug_vprintf_callback = debug_vprintf_callback;
 }
 
-#else /* !DEBUGBUILD */
+#else /* !defined(DEBUGBUILD) */
 
 void nghttp2_set_debug_vprintf_callback(
-    nghttp2_debug_vprintf_callback debug_vprintf_callback) {
+  nghttp2_debug_vprintf_callback debug_vprintf_callback) {
   (void)debug_vprintf_callback;
 }
 
-#endif /* !DEBUGBUILD */
+#endif /* !defined(DEBUGBUILD) */

lib/nghttp2_debug.h

@@ -27,17 +27,17 @@
 
 #ifdef HAVE_CONFIG_H
 #  include <config.h>
-#endif /* HAVE_CONFIG_H */
+#endif /* defined(HAVE_CONFIG_H) */
 
 #include <nghttp2/nghttp2.h>
 
 #ifdef DEBUGBUILD
 #  define DEBUGF(...) nghttp2_debug_vprintf(__VA_ARGS__)
 void nghttp2_debug_vprintf(const char *format, ...);
-#else
+#else /* !defined(DEBUGBUILD) */
 #  define DEBUGF(...)                                                          \
     do {                                                                       \
     } while (0)
-#endif
+#endif /* !defined(DEBUGBUILD) */
 
-#endif /* NGHTTP2_DEBUG_H */
+#endif /* !defined(NGHTTP2_DEBUG_H) */

lib/nghttp2_extpri.h

@@ -28,7 +28,7 @@
 
 #ifdef HAVE_CONFIG_H
 #  include <config.h>
-#endif /* HAVE_CONFIG_H */
+#endif /* defined(HAVE_CONFIG_H) */
 
 #include <nghttp2/nghttp2.h>
 
@@ -60,6 +60,6 @@ void nghttp2_extpri_from_uint8(nghttp2_extpri *extpri, uint8_t u8extpri);
  * nghttp2_extpri_uint8_inc extracts inc from |PRI| which is supposed to
  * be constructed by nghttp2_extpri_to_uint8.
  */
-#define nghttp2_extpri_uint8_inc(PRI) (((PRI)&NGHTTP2_EXTPRI_INC_MASK) != 0)
+#define nghttp2_extpri_uint8_inc(PRI) (((PRI) & NGHTTP2_EXTPRI_INC_MASK) != 0)
 
-#endif /* NGHTTP2_EXTPRI_H */
+#endif /* !defined(NGHTTP2_EXTPRI_H) */

lib/nghttp2_frame.c

@@ -492,7 +492,7 @@ int nghttp2_frame_pack_settings(nghttp2_bufs *bufs, nghttp2_settings *frame) {
   nghttp2_frame_pack_frame_hd(buf->pos, &frame->hd);
 
   buf->last +=
-      nghttp2_frame_pack_settings_payload(buf->last, frame->iv, frame->niv);
+    nghttp2_frame_pack_settings_payload(buf->last, frame->iv, frame->niv);
 
   return 0;
 }
@@ -537,7 +537,7 @@ int nghttp2_frame_unpack_settings_payload2(nghttp2_settings_entry **iv_ptr,
   }
 
   *iv_ptr =
-      nghttp2_mem_malloc(mem, (*niv_ptr) * sizeof(nghttp2_settings_entry));
+    nghttp2_mem_malloc(mem, (*niv_ptr) * sizeof(nghttp2_settings_entry));
 
   if (*iv_ptr == NULL) {
     return NGHTTP2_ERR_NOMEM;
@@ -589,7 +589,7 @@ int nghttp2_frame_pack_push_promise(nghttp2_bufs *bufs,
 void nghttp2_frame_unpack_push_promise_payload(nghttp2_push_promise *frame,
                                                const uint8_t *payload) {
   frame->promised_stream_id =
-      nghttp2_get_uint32(payload) & NGHTTP2_STREAM_ID_MASK;
+    nghttp2_get_uint32(payload) & NGHTTP2_STREAM_ID_MASK;
   frame->nva = NULL;
   frame->nvlen = 0;
 }
@@ -608,7 +608,7 @@ void nghttp2_frame_pack_ping(nghttp2_bufs *bufs, nghttp2_ping *frame) {
   nghttp2_frame_pack_frame_hd(buf->pos, &frame->hd);
 
   buf->last =
-      nghttp2_cpymem(buf->last, frame->opaque_data, sizeof(frame->opaque_data));
+    nghttp2_cpymem(buf->last, frame->opaque_data, sizeof(frame->opaque_data));
 }
 
 void nghttp2_frame_unpack_ping_payload(nghttp2_ping *frame,
@@ -709,7 +709,7 @@ void nghttp2_frame_pack_window_update(nghttp2_bufs *bufs,
 void nghttp2_frame_unpack_window_update_payload(nghttp2_window_update *frame,
                                                 const uint8_t *payload) {
   frame->window_size_increment =
-      nghttp2_get_uint32(payload) & NGHTTP2_WINDOW_SIZE_INCREMENT_MASK;
+    nghttp2_get_uint32(payload) & NGHTTP2_WINDOW_SIZE_INCREMENT_MASK;
 }
 
 void nghttp2_frame_pack_altsvc(nghttp2_bufs *bufs, nghttp2_extension *frame) {
@@ -750,6 +750,16 @@ void nghttp2_frame_unpack_altsvc_payload(nghttp2_extension *frame,
   uint8_t *p;
 
   altsvc = frame->payload;
+
+  if (payloadlen == 0) {
+    altsvc->origin = NULL;
+    altsvc->origin_len = 0;
+    altsvc->field_value = NULL;
+    altsvc->field_value_len = 0;
+
+    return;
+  }
+
   p = payload;
 
   altsvc->origin = p;
@@ -926,7 +936,7 @@ void nghttp2_frame_unpack_priority_update_payload(nghttp2_extension *frame,
   priority_update = frame->payload;
 
   priority_update->stream_id =
-      nghttp2_get_uint32(payload) & NGHTTP2_STREAM_ID_MASK;
+    nghttp2_get_uint32(payload) & NGHTTP2_STREAM_ID_MASK;
 
   if (payloadlen > 4) {
     priority_update->field_value = payload + 4;

lib/nghttp2_frame.h

@@ -27,7 +27,7 @@
 
 #ifdef HAVE_CONFIG_H
 #  include <config.h>
-#endif /* HAVE_CONFIG_H */
+#endif /* defined(HAVE_CONFIG_H) */
 
 #include <nghttp2/nghttp2.h>
 #include "nghttp2_hd.h"
@@ -634,4 +634,4 @@ int nghttp2_iv_check(const nghttp2_settings_entry *iv, size_t niv);
 void nghttp2_frame_add_pad(nghttp2_bufs *bufs, nghttp2_frame_hd *hd,
                            size_t padlen, int framehd_only);
 
-#endif /* NGHTTP2_FRAME_H */
+#endif /* !defined(NGHTTP2_FRAME_H) */

lib/nghttp2_hd.c

@@ -36,9 +36,10 @@
 #define MAKE_STATIC_ENT(N, V, T, H)                                            \
   {                                                                            \
     {NULL, NULL, (uint8_t *)(N), sizeof((N)) - 1, -1},                         \
-        {NULL, NULL, (uint8_t *)(V), sizeof((V)) - 1, -1},                     \
+    {NULL, NULL, (uint8_t *)(V), sizeof((V)) - 1, -1},                         \
-        {(uint8_t *)(N), (uint8_t *)(V), sizeof((N)) - 1, sizeof((V)) - 1, 0}, \
+    {(uint8_t *)(N), (uint8_t *)(V), sizeof((N)) - 1, sizeof((V)) - 1, 0},     \
-        T, H                                                                   \
+    T,                                                                         \
+    H,                                                                         \
   }
 
 /* Generated by mkstatictbl.py */
@@ -46,67 +47,67 @@
    first enum value if same header names are repeated (e.g.,
    :status). */
 static const nghttp2_hd_static_entry static_table[] = {
-    MAKE_STATIC_ENT(":authority", "", 0, 3153725150u),
+  MAKE_STATIC_ENT(":authority", "", 0, 3153725150u),
-    MAKE_STATIC_ENT(":method", "GET", 1, 695666056u),
+  MAKE_STATIC_ENT(":method", "GET", 1, 695666056u),
-    MAKE_STATIC_ENT(":method", "POST", 1, 695666056u),
+  MAKE_STATIC_ENT(":method", "POST", 1, 695666056u),
-    MAKE_STATIC_ENT(":path", "/", 3, 3292848686u),
+  MAKE_STATIC_ENT(":path", "/", 3, 3292848686u),
-    MAKE_STATIC_ENT(":path", "/index.html", 3, 3292848686u),
+  MAKE_STATIC_ENT(":path", "/index.html", 3, 3292848686u),
-    MAKE_STATIC_ENT(":scheme", "http", 5, 2510477674u),
+  MAKE_STATIC_ENT(":scheme", "http", 5, 2510477674u),
-    MAKE_STATIC_ENT(":scheme", "https", 5, 2510477674u),
+  MAKE_STATIC_ENT(":scheme", "https", 5, 2510477674u),
-    MAKE_STATIC_ENT(":status", "200", 7, 4000288983u),
+  MAKE_STATIC_ENT(":status", "200", 7, 4000288983u),
-    MAKE_STATIC_ENT(":status", "204", 7, 4000288983u),
+  MAKE_STATIC_ENT(":status", "204", 7, 4000288983u),
-    MAKE_STATIC_ENT(":status", "206", 7, 4000288983u),
+  MAKE_STATIC_ENT(":status", "206", 7, 4000288983u),
-    MAKE_STATIC_ENT(":status", "304", 7, 4000288983u),
+  MAKE_STATIC_ENT(":status", "304", 7, 4000288983u),
-    MAKE_STATIC_ENT(":status", "400", 7, 4000288983u),
+  MAKE_STATIC_ENT(":status", "400", 7, 4000288983u),
-    MAKE_STATIC_ENT(":status", "404", 7, 4000288983u),
+  MAKE_STATIC_ENT(":status", "404", 7, 4000288983u),
-    MAKE_STATIC_ENT(":status", "500", 7, 4000288983u),
+  MAKE_STATIC_ENT(":status", "500", 7, 4000288983u),
-    MAKE_STATIC_ENT("accept-charset", "", 14, 3664010344u),
+  MAKE_STATIC_ENT("accept-charset", "", 14, 3664010344u),
-    MAKE_STATIC_ENT("accept-encoding", "gzip, deflate", 15, 3379649177u),
+  MAKE_STATIC_ENT("accept-encoding", "gzip, deflate", 15, 3379649177u),
-    MAKE_STATIC_ENT("accept-language", "", 16, 1979086614u),
+  MAKE_STATIC_ENT("accept-language", "", 16, 1979086614u),
-    MAKE_STATIC_ENT("accept-ranges", "", 17, 1713753958u),
+  MAKE_STATIC_ENT("accept-ranges", "", 17, 1713753958u),
-    MAKE_STATIC_ENT("accept", "", 18, 136609321u),
+  MAKE_STATIC_ENT("accept", "", 18, 136609321u),
-    MAKE_STATIC_ENT("access-control-allow-origin", "", 19, 2710797292u),
+  MAKE_STATIC_ENT("access-control-allow-origin", "", 19, 2710797292u),
-    MAKE_STATIC_ENT("age", "", 20, 742476188u),
+  MAKE_STATIC_ENT("age", "", 20, 742476188u),
-    MAKE_STATIC_ENT("allow", "", 21, 2930878514u),
+  MAKE_STATIC_ENT("allow", "", 21, 2930878514u),
-    MAKE_STATIC_ENT("authorization", "", 22, 2436257726u),
+  MAKE_STATIC_ENT("authorization", "", 22, 2436257726u),
-    MAKE_STATIC_ENT("cache-control", "", 23, 1355326669u),
+  MAKE_STATIC_ENT("cache-control", "", 23, 1355326669u),
-    MAKE_STATIC_ENT("content-disposition", "", 24, 3889184348u),
+  MAKE_STATIC_ENT("content-disposition", "", 24, 3889184348u),
-    MAKE_STATIC_ENT("content-encoding", "", 25, 65203592u),
+  MAKE_STATIC_ENT("content-encoding", "", 25, 65203592u),
-    MAKE_STATIC_ENT("content-language", "", 26, 24973587u),
+  MAKE_STATIC_ENT("content-language", "", 26, 24973587u),
-    MAKE_STATIC_ENT("content-length", "", 27, 1308181789u),
+  MAKE_STATIC_ENT("content-length", "", 27, 1308181789u),
-    MAKE_STATIC_ENT("content-location", "", 28, 2302364718u),
+  MAKE_STATIC_ENT("content-location", "", 28, 2302364718u),
-    MAKE_STATIC_ENT("content-range", "", 29, 3555523146u),
+  MAKE_STATIC_ENT("content-range", "", 29, 3555523146u),
-    MAKE_STATIC_ENT("content-type", "", 30, 4244048277u),
+  MAKE_STATIC_ENT("content-type", "", 30, 4244048277u),
-    MAKE_STATIC_ENT("cookie", "", 31, 2007449791u),
+  MAKE_STATIC_ENT("cookie", "", 31, 2007449791u),
-    MAKE_STATIC_ENT("date", "", 32, 3564297305u),
+  MAKE_STATIC_ENT("date", "", 32, 3564297305u),
-    MAKE_STATIC_ENT("etag", "", 33, 113792960u),
+  MAKE_STATIC_ENT("etag", "", 33, 113792960u),
-    MAKE_STATIC_ENT("expect", "", 34, 2530896728u),
+  MAKE_STATIC_ENT("expect", "", 34, 2530896728u),
-    MAKE_STATIC_ENT("expires", "", 35, 1049544579u),
+  MAKE_STATIC_ENT("expires", "", 35, 1049544579u),
-    MAKE_STATIC_ENT("from", "", 36, 2513272949u),
+  MAKE_STATIC_ENT("from", "", 36, 2513272949u),
-    MAKE_STATIC_ENT("host", "", 37, 2952701295u),
+  MAKE_STATIC_ENT("host", "", 37, 2952701295u),
-    MAKE_STATIC_ENT("if-match", "", 38, 3597694698u),
+  MAKE_STATIC_ENT("if-match", "", 38, 3597694698u),
-    MAKE_STATIC_ENT("if-modified-since", "", 39, 2213050793u),
+  MAKE_STATIC_ENT("if-modified-since", "", 39, 2213050793u),
-    MAKE_STATIC_ENT("if-none-match", "", 40, 2536202615u),
+  MAKE_STATIC_ENT("if-none-match", "", 40, 2536202615u),
-    MAKE_STATIC_ENT("if-range", "", 41, 2340978238u),
+  MAKE_STATIC_ENT("if-range", "", 41, 2340978238u),
-    MAKE_STATIC_ENT("if-unmodified-since", "", 42, 3794814858u),
+  MAKE_STATIC_ENT("if-unmodified-since", "", 42, 3794814858u),
-    MAKE_STATIC_ENT("last-modified", "", 43, 3226950251u),
+  MAKE_STATIC_ENT("last-modified", "", 43, 3226950251u),
-    MAKE_STATIC_ENT("link", "", 44, 232457833u),
+  MAKE_STATIC_ENT("link", "", 44, 232457833u),
-    MAKE_STATIC_ENT("location", "", 45, 200649126u),
+  MAKE_STATIC_ENT("location", "", 45, 200649126u),
-    MAKE_STATIC_ENT("max-forwards", "", 46, 1826162134u),
+  MAKE_STATIC_ENT("max-forwards", "", 46, 1826162134u),
-    MAKE_STATIC_ENT("proxy-authenticate", "", 47, 2709445359u),
+  MAKE_STATIC_ENT("proxy-authenticate", "", 47, 2709445359u),
-    MAKE_STATIC_ENT("proxy-authorization", "", 48, 2686392507u),
+  MAKE_STATIC_ENT("proxy-authorization", "", 48, 2686392507u),
-    MAKE_STATIC_ENT("range", "", 49, 4208725202u),
+  MAKE_STATIC_ENT("range", "", 49, 4208725202u),
-    MAKE_STATIC_ENT("referer", "", 50, 3969579366u),
+  MAKE_STATIC_ENT("referer", "", 50, 3969579366u),
-    MAKE_STATIC_ENT("refresh", "", 51, 3572655668u),
+  MAKE_STATIC_ENT("refresh", "", 51, 3572655668u),
-    MAKE_STATIC_ENT("retry-after", "", 52, 3336180598u),
+  MAKE_STATIC_ENT("retry-after", "", 52, 3336180598u),
-    MAKE_STATIC_ENT("server", "", 53, 1085029842u),
+  MAKE_STATIC_ENT("server", "", 53, 1085029842u),
-    MAKE_STATIC_ENT("set-cookie", "", 54, 1848371000u),
+  MAKE_STATIC_ENT("set-cookie", "", 54, 1848371000u),
-    MAKE_STATIC_ENT("strict-transport-security", "", 55, 4138147361u),
+  MAKE_STATIC_ENT("strict-transport-security", "", 55, 4138147361u),
-    MAKE_STATIC_ENT("transfer-encoding", "", 56, 3719590988u),
+  MAKE_STATIC_ENT("transfer-encoding", "", 56, 3719590988u),
-    MAKE_STATIC_ENT("user-agent", "", 57, 606444526u),
+  MAKE_STATIC_ENT("user-agent", "", 57, 606444526u),
-    MAKE_STATIC_ENT("vary", "", 58, 1085005381u),
+  MAKE_STATIC_ENT("vary", "", 58, 1085005381u),
-    MAKE_STATIC_ENT("via", "", 59, 1762798611u),
+  MAKE_STATIC_ENT("via", "", 59, 1762798611u),
-    MAKE_STATIC_ENT("www-authenticate", "", 60, 779865858u),
+  MAKE_STATIC_ENT("www-authenticate", "", 60, 779865858u),
 };
 
 static int memeq(const void *s1, const void *s2, size_t n) {
@@ -593,8 +594,19 @@ static void hd_map_remove(nghttp2_hd_map *map, nghttp2_hd_entry *ent) {
 static int hd_ringbuf_init(nghttp2_hd_ringbuf *ringbuf, size_t bufsize,
                            nghttp2_mem *mem) {
   size_t size;
+  const size_t max_size = SIZE_MAX / sizeof(nghttp2_hd_entry *);
+
+  if (bufsize > max_size) {
+    return NGHTTP2_ERR_NOMEM;
+  }
+
   for (size = 1; size < bufsize; size <<= 1)
     ;
+
+  if (size > max_size) {
+    return NGHTTP2_ERR_NOMEM;
+  }
+
   ringbuf->buffer = nghttp2_mem_malloc(mem, sizeof(nghttp2_hd_entry *) * size);
   if (ringbuf->buffer == NULL) {
     return NGHTTP2_ERR_NOMEM;
@@ -677,8 +689,8 @@ static int hd_context_init(nghttp2_hd_context *context, nghttp2_mem *mem) {
   context->bad = 0;
   context->hd_table_bufsize_max = NGHTTP2_HD_DEFAULT_MAX_BUFFER_SIZE;
   rv = hd_ringbuf_init(
-      &context->hd_table,
+    &context->hd_table,
-      context->hd_table_bufsize_max / NGHTTP2_HD_ENTRY_OVERHEAD, mem);
+    context->hd_table_bufsize_max / NGHTTP2_HD_ENTRY_OVERHEAD, mem);
   if (rv != 0) {
     return rv;
   }
@@ -695,7 +707,7 @@ static void hd_context_free(nghttp2_hd_context *context) {
 
 int nghttp2_hd_deflate_init(nghttp2_hd_deflater *deflater, nghttp2_mem *mem) {
   return nghttp2_hd_deflate_init2(
-      deflater, NGHTTP2_HD_DEFAULT_MAX_DEFLATE_BUFFER_SIZE, mem);
+    deflater, NGHTTP2_HD_DEFAULT_MAX_DEFLATE_BUFFER_SIZE, mem);
 }
 
 int nghttp2_hd_deflate_init2(nghttp2_hd_deflater *deflater,
@@ -1077,8 +1089,8 @@ static int emit_newname_block(nghttp2_bufs *bufs, const nghttp2_nv *nv,
   int rv;
 
   DEBUGF(
-      "deflatehd: emit newname namelen=%zu, valuelen=%zu, indexing_mode=%d\n",
+    "deflatehd: emit newname namelen=%zu, valuelen=%zu, indexing_mode=%d\n",
-      nv->namelen, nv->valuelen, indexing_mode);
+    nv->namelen, nv->valuelen, indexing_mode);
 
   rv = nghttp2_bufs_addb(bufs, pack_first_byte(indexing_mode));
   if (rv != 0) {
@@ -1111,12 +1123,11 @@ static int add_hd_table_incremental(nghttp2_hd_context *context,
 
   while (context->hd_table_bufsize + room > context->hd_table_bufsize_max &&
          context->hd_table.len > 0) {
-
     size_t idx = context->hd_table.len - 1;
     nghttp2_hd_entry *ent = hd_ringbuf_get(&context->hd_table, idx);
 
     context->hd_table_bufsize -=
-        entry_room(ent->nv.name->len, ent->nv.value->len);
+      entry_room(ent->nv.name->len, ent->nv.value->len);
 
     DEBUGF("hpack: remove item from header table: %s: %s\n",
            (char *)ent->nv.name->base, (char *)ent->nv.value->base);
@@ -1232,7 +1243,7 @@ static void hd_context_shrink_table_size(nghttp2_hd_context *context,
     size_t idx = context->hd_table.len - 1;
     nghttp2_hd_entry *ent = hd_ringbuf_get(&context->hd_table, idx);
     context->hd_table_bufsize -=
-        entry_room(ent->nv.name->len, ent->nv.value->len);
+      entry_room(ent->nv.name->len, ent->nv.value->len);
     hd_ringbuf_pop_back(&context->hd_table);
     if (map) {
       hd_map_remove(map, ent);
@@ -1244,14 +1255,14 @@ static void hd_context_shrink_table_size(nghttp2_hd_context *context,
 }
 
 int nghttp2_hd_deflate_change_table_size(
-    nghttp2_hd_deflater *deflater, size_t settings_max_dynamic_table_size) {
+  nghttp2_hd_deflater *deflater, size_t settings_max_dynamic_table_size) {
   size_t next_bufsize = nghttp2_min_size(
-      settings_max_dynamic_table_size, deflater->deflate_hd_table_bufsize_max);
+    settings_max_dynamic_table_size, deflater->deflate_hd_table_bufsize_max);
 
   deflater->ctx.hd_table_bufsize_max = next_bufsize;
 
   deflater->min_hd_table_bufsize_max =
-      nghttp2_min_size(deflater->min_hd_table_bufsize_max, next_bufsize);
+    nghttp2_min_size(deflater->min_hd_table_bufsize_max, next_bufsize);
 
   deflater->notify_table_size_change = 1;
 
@@ -1260,7 +1271,7 @@ int nghttp2_hd_deflate_change_table_size(
 }
 
 int nghttp2_hd_inflate_change_table_size(
-    nghttp2_hd_inflater *inflater, size_t settings_max_dynamic_table_size) {
+  nghttp2_hd_inflater *inflater, size_t settings_max_dynamic_table_size) {
   switch (inflater->state) {
   case NGHTTP2_HD_STATE_EXPECT_TABLE_SIZE:
   case NGHTTP2_HD_STATE_INFLATE_START:
@@ -1303,7 +1314,7 @@ nghttp2_hd_nv nghttp2_hd_table_get(nghttp2_hd_context *context, size_t idx) {
   assert(INDEX_RANGE_VALID(context, idx));
   if (idx >= NGHTTP2_STATIC_TABLE_LENGTH) {
     return hd_ringbuf_get(&context->hd_table, idx - NGHTTP2_STATIC_TABLE_LENGTH)
-        ->nv;
+      ->nv;
   } else {
     const nghttp2_hd_static_entry *ent = &static_table[idx];
     nghttp2_hd_nv nv = {(nghttp2_rcbuf *)&ent->name,
@@ -1319,7 +1330,7 @@ static const nghttp2_nv *nghttp2_hd_table_get2(nghttp2_hd_context *context,
   if (idx >= NGHTTP2_STATIC_TABLE_LENGTH) {
     return &hd_ringbuf_get(&context->hd_table,
                            idx - NGHTTP2_STATIC_TABLE_LENGTH)
-                ->cnv;
+              ->cnv;
   }
 
   return &static_table[idx].cnv;
@@ -1333,7 +1344,7 @@ static int hd_deflate_decide_indexing(nghttp2_hd_deflater *deflater,
       token == NGHTTP2_TOKEN_IF_NONE_MATCH || token == NGHTTP2_TOKEN_LOCATION ||
       token == NGHTTP2_TOKEN_SET_COOKIE ||
       entry_room(nv->namelen, nv->valuelen) >
-          deflater->ctx.hd_table_bufsize_max * 3 / 4) {
+        deflater->ctx.hd_table_bufsize_max * 3 / 4) {
     return NGHTTP2_HD_WITHOUT_INDEXING;
   }
 
@@ -1366,12 +1377,11 @@ static int deflate_nv(nghttp2_hd_deflater *deflater, nghttp2_bufs *bufs,
      entropy secret data (e.g., id/password).  Also cookie header
      field with less than 20 bytes value is also never indexed.  This
      is the same criteria used in Firefox codebase. */
-  indexing_mode =
+  indexing_mode = token == NGHTTP2_TOKEN_AUTHORIZATION ||
-      token == NGHTTP2_TOKEN_AUTHORIZATION ||
+                      (token == NGHTTP2_TOKEN_COOKIE && nv->valuelen < 20) ||
-              (token == NGHTTP2_TOKEN_COOKIE && nv->valuelen < 20) ||
+                      (nv->flags & NGHTTP2_NV_FLAG_NO_INDEX)
-              (nv->flags & NGHTTP2_NV_FLAG_NO_INDEX)
+                    ? NGHTTP2_HD_NEVER_INDEXING
-          ? NGHTTP2_HD_NEVER_INDEXING
+                    : hd_deflate_decide_indexing(deflater, nv, token);
-          : hd_deflate_decide_indexing(deflater, nv, token);
 
   res = search_hd_table(&deflater->ctx, nv, token, indexing_mode,
                         &deflater->map, hash);
@@ -1379,7 +1389,6 @@ static int deflate_nv(nghttp2_hd_deflater *deflater, nghttp2_bufs *bufs,
   idx = res.index;
 
   if (res.name_value_match) {
-
     DEBUGF("deflatehd: name/value match index=%td\n", idx);
 
     rv = emit_indexed_block(bufs, (size_t)idx);
@@ -1457,7 +1466,6 @@ int nghttp2_hd_deflate_hd_bufs(nghttp2_hd_deflater *deflater,
     deflater->min_hd_table_bufsize_max = UINT32_MAX;
 
     if (deflater->ctx.hd_table_bufsize_max > min_hd_table_bufsize_max) {
-
       rv = emit_table_size(bufs, min_hd_table_bufsize_max);
 
       if (rv != 0) {
@@ -1961,9 +1969,9 @@ nghttp2_ssize nghttp2_hd_inflate_hd_nv(nghttp2_hd_inflater *inflater,
     case NGHTTP2_HD_STATE_READ_TABLE_SIZE:
       rfin = 0;
       rv = hd_inflate_read_len(
-          inflater, &rfin, in, last, 5,
+        inflater, &rfin, in, last, 5,
-          nghttp2_min_size(inflater->min_hd_table_bufsize_max,
+        nghttp2_min_size(inflater->min_hd_table_bufsize_max,
-                           inflater->settings_hd_table_bufsize_max));
+                         inflater->settings_hd_table_bufsize_max));
       if (rv < 0) {
         goto fail;
       }
@@ -2050,8 +2058,8 @@ nghttp2_ssize nghttp2_hd_inflate_hd_nv(nghttp2_hd_inflater *inflater,
 
         inflater->state = NGHTTP2_HD_STATE_NEWNAME_READ_NAMEHUFF;
 
-        rv = nghttp2_rcbuf_new(&inflater->namercbuf, inflater->left * 2 + 1,
+        rv =
-                               mem);
+          nghttp2_rcbuf_new(&inflater->namercbuf, inflater->left * 2 + 1, mem);
       } else {
         inflater->state = NGHTTP2_HD_STATE_NEWNAME_READ_NAME;
         rv = nghttp2_rcbuf_new(&inflater->namercbuf, inflater->left + 1, mem);
@@ -2135,8 +2143,8 @@ nghttp2_ssize nghttp2_hd_inflate_hd_nv(nghttp2_hd_inflater *inflater,
 
         inflater->state = NGHTTP2_HD_STATE_READ_VALUEHUFF;
 
-        rv = nghttp2_rcbuf_new(&inflater->valuercbuf, inflater->left * 2 + 1,
+        rv =
-                               mem);
+          nghttp2_rcbuf_new(&inflater->valuercbuf, inflater->left * 2 + 1, mem);
       } else {
         inflater->state = NGHTTP2_HD_STATE_READ_VALUE;
 
@@ -2307,7 +2315,6 @@ void nghttp2_hd_inflate_del(nghttp2_hd_inflater *inflater) {
 
 int nghttp2_hd_emit_indname_block(nghttp2_bufs *bufs, size_t idx,
                                   nghttp2_nv *nv, int indexing_mode) {
-
   return emit_indname_block(bufs, idx, nv, indexing_mode);
 }
 

lib/nghttp2_hd.h

@@ -27,7 +27,7 @@
 
 #ifdef HAVE_CONFIG_H
 #  include <config.h>
-#endif /* HAVE_CONFIG_H */
+#endif /* defined(HAVE_CONFIG_H) */
 
 #include <nghttp2/nghttp2.h>
 
@@ -439,4 +439,4 @@ nghttp2_ssize nghttp2_hd_huff_decode(nghttp2_hd_huff_decode_context *ctx,
  */
 int nghttp2_hd_huff_decode_failure_state(nghttp2_hd_huff_decode_context *ctx);
 
-#endif /* NGHTTP2_HD_H */
+#endif /* !defined(NGHTTP2_HD_H) */

lib/nghttp2_hd_huffman.c

@@ -94,7 +94,7 @@ int nghttp2_hd_huff_encode(nghttp2_bufs *bufs, const uint8_t *src,
 
   if (nbits) {
     rv = nghttp2_bufs_addb(
-        bufs, (uint8_t)((uint8_t)(code >> 56) | ((1 << (8 - nbits)) - 1)));
+      bufs, (uint8_t)((uint8_t)(code >> 56) | ((1 << (8 - nbits)) - 1)));
     if (rv != 0) {
       return rv;
     }

lib/nghttp2_hd_huffman.h

@@ -27,7 +27,7 @@
 
 #ifdef HAVE_CONFIG_H
 #  include <config.h>
-#endif /* HAVE_CONFIG_H */
+#endif /* defined(HAVE_CONFIG_H) */
 
 #include <nghttp2/nghttp2.h>
 
@@ -69,4 +69,4 @@ typedef struct {
 extern const nghttp2_huff_sym huff_sym_table[];
 extern const nghttp2_huff_decode huff_decode_table[][16];
 
-#endif /* NGHTTP2_HD_HUFFMAN_H */
+#endif /* !defined(NGHTTP2_HD_HUFFMAN_H) */

lib/nghttp2_helper.c

@@ -53,70 +53,70 @@ uint32_t nghttp2_get_uint32(const uint8_t *data) {
 
 /* Generated by gendowncasetbl.py */
 static const uint8_t DOWNCASE_TBL[] = {
-    0 /* NUL  */,   1 /* SOH  */,   2 /* STX  */,   3 /* ETX  */,
+  0 /* NUL  */,   1 /* SOH  */,   2 /* STX  */,   3 /* ETX  */,
-    4 /* EOT  */,   5 /* ENQ  */,   6 /* ACK  */,   7 /* BEL  */,
+  4 /* EOT  */,   5 /* ENQ  */,   6 /* ACK  */,   7 /* BEL  */,
-    8 /* BS   */,   9 /* HT   */,   10 /* LF   */,  11 /* VT   */,
+  8 /* BS   */,   9 /* HT   */,   10 /* LF   */,  11 /* VT   */,
-    12 /* FF   */,  13 /* CR   */,  14 /* SO   */,  15 /* SI   */,
+  12 /* FF   */,  13 /* CR   */,  14 /* SO   */,  15 /* SI   */,
-    16 /* DLE  */,  17 /* DC1  */,  18 /* DC2  */,  19 /* DC3  */,
+  16 /* DLE  */,  17 /* DC1  */,  18 /* DC2  */,  19 /* DC3  */,
-    20 /* DC4  */,  21 /* NAK  */,  22 /* SYN  */,  23 /* ETB  */,
+  20 /* DC4  */,  21 /* NAK  */,  22 /* SYN  */,  23 /* ETB  */,
-    24 /* CAN  */,  25 /* EM   */,  26 /* SUB  */,  27 /* ESC  */,
+  24 /* CAN  */,  25 /* EM   */,  26 /* SUB  */,  27 /* ESC  */,
-    28 /* FS   */,  29 /* GS   */,  30 /* RS   */,  31 /* US   */,
+  28 /* FS   */,  29 /* GS   */,  30 /* RS   */,  31 /* US   */,
-    32 /* SPC  */,  33 /* !    */,  34 /* "    */,  35 /* #    */,
+  32 /* SPC  */,  33 /* !    */,  34 /* "    */,  35 /* #    */,
-    36 /* $    */,  37 /* %    */,  38 /* &    */,  39 /* '    */,
+  36 /* $    */,  37 /* %    */,  38 /* &    */,  39 /* '    */,
-    40 /* (    */,  41 /* )    */,  42 /* *    */,  43 /* +    */,
+  40 /* (    */,  41 /* )    */,  42 /* *    */,  43 /* +    */,
-    44 /* ,    */,  45 /* -    */,  46 /* .    */,  47 /* /    */,
+  44 /* ,    */,  45 /* -    */,  46 /* .    */,  47 /* /    */,
-    48 /* 0    */,  49 /* 1    */,  50 /* 2    */,  51 /* 3    */,
+  48 /* 0    */,  49 /* 1    */,  50 /* 2    */,  51 /* 3    */,
-    52 /* 4    */,  53 /* 5    */,  54 /* 6    */,  55 /* 7    */,
+  52 /* 4    */,  53 /* 5    */,  54 /* 6    */,  55 /* 7    */,
-    56 /* 8    */,  57 /* 9    */,  58 /* :    */,  59 /* ;    */,
+  56 /* 8    */,  57 /* 9    */,  58 /* :    */,  59 /* ;    */,
-    60 /* <    */,  61 /* =    */,  62 /* >    */,  63 /* ?    */,
+  60 /* <    */,  61 /* =    */,  62 /* >    */,  63 /* ?    */,
-    64 /* @    */,  97 /* A    */,  98 /* B    */,  99 /* C    */,
+  64 /* @    */,  97 /* A    */,  98 /* B    */,  99 /* C    */,
-    100 /* D    */, 101 /* E    */, 102 /* F    */, 103 /* G    */,
+  100 /* D    */, 101 /* E    */, 102 /* F    */, 103 /* G    */,
-    104 /* H    */, 105 /* I    */, 106 /* J    */, 107 /* K    */,
+  104 /* H    */, 105 /* I    */, 106 /* J    */, 107 /* K    */,
-    108 /* L    */, 109 /* M    */, 110 /* N    */, 111 /* O    */,
+  108 /* L    */, 109 /* M    */, 110 /* N    */, 111 /* O    */,
-    112 /* P    */, 113 /* Q    */, 114 /* R    */, 115 /* S    */,
+  112 /* P    */, 113 /* Q    */, 114 /* R    */, 115 /* S    */,
-    116 /* T    */, 117 /* U    */, 118 /* V    */, 119 /* W    */,
+  116 /* T    */, 117 /* U    */, 118 /* V    */, 119 /* W    */,
-    120 /* X    */, 121 /* Y    */, 122 /* Z    */, 91 /* [    */,
+  120 /* X    */, 121 /* Y    */, 122 /* Z    */, 91 /* [    */,
-    92 /* \    */,  93 /* ]    */,  94 /* ^    */,  95 /* _    */,
+  92 /* \    */,  93 /* ]    */,  94 /* ^    */,  95 /* _    */,
-    96 /* `    */,  97 /* a    */,  98 /* b    */,  99 /* c    */,
+  96 /* `    */,  97 /* a    */,  98 /* b    */,  99 /* c    */,
-    100 /* d    */, 101 /* e    */, 102 /* f    */, 103 /* g    */,
+  100 /* d    */, 101 /* e    */, 102 /* f    */, 103 /* g    */,
-    104 /* h    */, 105 /* i    */, 106 /* j    */, 107 /* k    */,
+  104 /* h    */, 105 /* i    */, 106 /* j    */, 107 /* k    */,
-    108 /* l    */, 109 /* m    */, 110 /* n    */, 111 /* o    */,
+  108 /* l    */, 109 /* m    */, 110 /* n    */, 111 /* o    */,
-    112 /* p    */, 113 /* q    */, 114 /* r    */, 115 /* s    */,
+  112 /* p    */, 113 /* q    */, 114 /* r    */, 115 /* s    */,
-    116 /* t    */, 117 /* u    */, 118 /* v    */, 119 /* w    */,
+  116 /* t    */, 117 /* u    */, 118 /* v    */, 119 /* w    */,
-    120 /* x    */, 121 /* y    */, 122 /* z    */, 123 /* {    */,
+  120 /* x    */, 121 /* y    */, 122 /* z    */, 123 /* {    */,
-    124 /* |    */, 125 /* }    */, 126 /* ~    */, 127 /* DEL  */,
+  124 /* |    */, 125 /* }    */, 126 /* ~    */, 127 /* DEL  */,
-    128 /* 0x80 */, 129 /* 0x81 */, 130 /* 0x82 */, 131 /* 0x83 */,
+  128 /* 0x80 */, 129 /* 0x81 */, 130 /* 0x82 */, 131 /* 0x83 */,
-    132 /* 0x84 */, 133 /* 0x85 */, 134 /* 0x86 */, 135 /* 0x87 */,
+  132 /* 0x84 */, 133 /* 0x85 */, 134 /* 0x86 */, 135 /* 0x87 */,
-    136 /* 0x88 */, 137 /* 0x89 */, 138 /* 0x8a */, 139 /* 0x8b */,
+  136 /* 0x88 */, 137 /* 0x89 */, 138 /* 0x8a */, 139 /* 0x8b */,
-    140 /* 0x8c */, 141 /* 0x8d */, 142 /* 0x8e */, 143 /* 0x8f */,
+  140 /* 0x8c */, 141 /* 0x8d */, 142 /* 0x8e */, 143 /* 0x8f */,
-    144 /* 0x90 */, 145 /* 0x91 */, 146 /* 0x92 */, 147 /* 0x93 */,
+  144 /* 0x90 */, 145 /* 0x91 */, 146 /* 0x92 */, 147 /* 0x93 */,
-    148 /* 0x94 */, 149 /* 0x95 */, 150 /* 0x96 */, 151 /* 0x97 */,
+  148 /* 0x94 */, 149 /* 0x95 */, 150 /* 0x96 */, 151 /* 0x97 */,
-    152 /* 0x98 */, 153 /* 0x99 */, 154 /* 0x9a */, 155 /* 0x9b */,
+  152 /* 0x98 */, 153 /* 0x99 */, 154 /* 0x9a */, 155 /* 0x9b */,
-    156 /* 0x9c */, 157 /* 0x9d */, 158 /* 0x9e */, 159 /* 0x9f */,
+  156 /* 0x9c */, 157 /* 0x9d */, 158 /* 0x9e */, 159 /* 0x9f */,
-    160 /* 0xa0 */, 161 /* 0xa1 */, 162 /* 0xa2 */, 163 /* 0xa3 */,
+  160 /* 0xa0 */, 161 /* 0xa1 */, 162 /* 0xa2 */, 163 /* 0xa3 */,
-    164 /* 0xa4 */, 165 /* 0xa5 */, 166 /* 0xa6 */, 167 /* 0xa7 */,
+  164 /* 0xa4 */, 165 /* 0xa5 */, 166 /* 0xa6 */, 167 /* 0xa7 */,
-    168 /* 0xa8 */, 169 /* 0xa9 */, 170 /* 0xaa */, 171 /* 0xab */,
+  168 /* 0xa8 */, 169 /* 0xa9 */, 170 /* 0xaa */, 171 /* 0xab */,
-    172 /* 0xac */, 173 /* 0xad */, 174 /* 0xae */, 175 /* 0xaf */,
+  172 /* 0xac */, 173 /* 0xad */, 174 /* 0xae */, 175 /* 0xaf */,
-    176 /* 0xb0 */, 177 /* 0xb1 */, 178 /* 0xb2 */, 179 /* 0xb3 */,
+  176 /* 0xb0 */, 177 /* 0xb1 */, 178 /* 0xb2 */, 179 /* 0xb3 */,
-    180 /* 0xb4 */, 181 /* 0xb5 */, 182 /* 0xb6 */, 183 /* 0xb7 */,
+  180 /* 0xb4 */, 181 /* 0xb5 */, 182 /* 0xb6 */, 183 /* 0xb7 */,
-    184 /* 0xb8 */, 185 /* 0xb9 */, 186 /* 0xba */, 187 /* 0xbb */,
+  184 /* 0xb8 */, 185 /* 0xb9 */, 186 /* 0xba */, 187 /* 0xbb */,
-    188 /* 0xbc */, 189 /* 0xbd */, 190 /* 0xbe */, 191 /* 0xbf */,
+  188 /* 0xbc */, 189 /* 0xbd */, 190 /* 0xbe */, 191 /* 0xbf */,
-    192 /* 0xc0 */, 193 /* 0xc1 */, 194 /* 0xc2 */, 195 /* 0xc3 */,
+  192 /* 0xc0 */, 193 /* 0xc1 */, 194 /* 0xc2 */, 195 /* 0xc3 */,
-    196 /* 0xc4 */, 197 /* 0xc5 */, 198 /* 0xc6 */, 199 /* 0xc7 */,
+  196 /* 0xc4 */, 197 /* 0xc5 */, 198 /* 0xc6 */, 199 /* 0xc7 */,
-    200 /* 0xc8 */, 201 /* 0xc9 */, 202 /* 0xca */, 203 /* 0xcb */,
+  200 /* 0xc8 */, 201 /* 0xc9 */, 202 /* 0xca */, 203 /* 0xcb */,
-    204 /* 0xcc */, 205 /* 0xcd */, 206 /* 0xce */, 207 /* 0xcf */,
+  204 /* 0xcc */, 205 /* 0xcd */, 206 /* 0xce */, 207 /* 0xcf */,
-    208 /* 0xd0 */, 209 /* 0xd1 */, 210 /* 0xd2 */, 211 /* 0xd3 */,
+  208 /* 0xd0 */, 209 /* 0xd1 */, 210 /* 0xd2 */, 211 /* 0xd3 */,
-    212 /* 0xd4 */, 213 /* 0xd5 */, 214 /* 0xd6 */, 215 /* 0xd7 */,
+  212 /* 0xd4 */, 213 /* 0xd5 */, 214 /* 0xd6 */, 215 /* 0xd7 */,
-    216 /* 0xd8 */, 217 /* 0xd9 */, 218 /* 0xda */, 219 /* 0xdb */,
+  216 /* 0xd8 */, 217 /* 0xd9 */, 218 /* 0xda */, 219 /* 0xdb */,
-    220 /* 0xdc */, 221 /* 0xdd */, 222 /* 0xde */, 223 /* 0xdf */,
+  220 /* 0xdc */, 221 /* 0xdd */, 222 /* 0xde */, 223 /* 0xdf */,
-    224 /* 0xe0 */, 225 /* 0xe1 */, 226 /* 0xe2 */, 227 /* 0xe3 */,
+  224 /* 0xe0 */, 225 /* 0xe1 */, 226 /* 0xe2 */, 227 /* 0xe3 */,
-    228 /* 0xe4 */, 229 /* 0xe5 */, 230 /* 0xe6 */, 231 /* 0xe7 */,
+  228 /* 0xe4 */, 229 /* 0xe5 */, 230 /* 0xe6 */, 231 /* 0xe7 */,
-    232 /* 0xe8 */, 233 /* 0xe9 */, 234 /* 0xea */, 235 /* 0xeb */,
+  232 /* 0xe8 */, 233 /* 0xe9 */, 234 /* 0xea */, 235 /* 0xeb */,
-    236 /* 0xec */, 237 /* 0xed */, 238 /* 0xee */, 239 /* 0xef */,
+  236 /* 0xec */, 237 /* 0xed */, 238 /* 0xee */, 239 /* 0xef */,
-    240 /* 0xf0 */, 241 /* 0xf1 */, 242 /* 0xf2 */, 243 /* 0xf3 */,
+  240 /* 0xf0 */, 241 /* 0xf1 */, 242 /* 0xf2 */, 243 /* 0xf3 */,
-    244 /* 0xf4 */, 245 /* 0xf5 */, 246 /* 0xf6 */, 247 /* 0xf7 */,
+  244 /* 0xf4 */, 245 /* 0xf5 */, 246 /* 0xf6 */, 247 /* 0xf7 */,
-    248 /* 0xf8 */, 249 /* 0xf9 */, 250 /* 0xfa */, 251 /* 0xfb */,
+  248 /* 0xf8 */, 249 /* 0xf9 */, 250 /* 0xfa */, 251 /* 0xfb */,
-    252 /* 0xfc */, 253 /* 0xfd */, 254 /* 0xfe */, 255 /* 0xff */,
+  252 /* 0xfc */, 253 /* 0xfd */, 254 /* 0xfe */, 255 /* 0xff */,
 };
 
 void nghttp2_downcase(uint8_t *s, size_t len) {
@@ -160,7 +160,7 @@ int nghttp2_adjust_local_window_size(int32_t *local_window_size_ptr,
     int32_t recv_reduction_delta;
     int32_t delta;
     int32_t new_recv_window_size =
-        nghttp2_max_int32(0, *recv_window_size_ptr) - *delta_ptr;
+      nghttp2_max_int32(0, *recv_window_size_ptr) - *delta_ptr;
 
     if (new_recv_window_size >= 0) {
       *recv_window_size_ptr = new_recv_window_size;
@@ -345,70 +345,70 @@ const char *nghttp2_strerror(int error_code) {
 
 /* Generated by gennmchartbl.py */
 static const int VALID_HD_NAME_CHARS[] = {
-    0 /* NUL  */, 0 /* SOH  */, 0 /* STX  */, 0 /* ETX  */,
+  0 /* NUL  */, 0 /* SOH  */, 0 /* STX  */, 0 /* ETX  */,
-    0 /* EOT  */, 0 /* ENQ  */, 0 /* ACK  */, 0 /* BEL  */,
+  0 /* EOT  */, 0 /* ENQ  */, 0 /* ACK  */, 0 /* BEL  */,
-    0 /* BS   */, 0 /* HT   */, 0 /* LF   */, 0 /* VT   */,
+  0 /* BS   */, 0 /* HT   */, 0 /* LF   */, 0 /* VT   */,
-    0 /* FF   */, 0 /* CR   */, 0 /* SO   */, 0 /* SI   */,
+  0 /* FF   */, 0 /* CR   */, 0 /* SO   */, 0 /* SI   */,
-    0 /* DLE  */, 0 /* DC1  */, 0 /* DC2  */, 0 /* DC3  */,
+  0 /* DLE  */, 0 /* DC1  */, 0 /* DC2  */, 0 /* DC3  */,
-    0 /* DC4  */, 0 /* NAK  */, 0 /* SYN  */, 0 /* ETB  */,
+  0 /* DC4  */, 0 /* NAK  */, 0 /* SYN  */, 0 /* ETB  */,
-    0 /* CAN  */, 0 /* EM   */, 0 /* SUB  */, 0 /* ESC  */,
+  0 /* CAN  */, 0 /* EM   */, 0 /* SUB  */, 0 /* ESC  */,
-    0 /* FS   */, 0 /* GS   */, 0 /* RS   */, 0 /* US   */,
+  0 /* FS   */, 0 /* GS   */, 0 /* RS   */, 0 /* US   */,
-    0 /* SPC  */, 1 /* !    */, 0 /* "    */, 1 /* #    */,
+  0 /* SPC  */, 1 /* !    */, 0 /* "    */, 1 /* #    */,
-    1 /* $    */, 1 /* %    */, 1 /* &    */, 1 /* '    */,
+  1 /* $    */, 1 /* %    */, 1 /* &    */, 1 /* '    */,
-    0 /* (    */, 0 /* )    */, 1 /* *    */, 1 /* +    */,
+  0 /* (    */, 0 /* )    */, 1 /* *    */, 1 /* +    */,
-    0 /* ,    */, 1 /* -    */, 1 /* .    */, 0 /* /    */,
+  0 /* ,    */, 1 /* -    */, 1 /* .    */, 0 /* /    */,
-    1 /* 0    */, 1 /* 1    */, 1 /* 2    */, 1 /* 3    */,
+  1 /* 0    */, 1 /* 1    */, 1 /* 2    */, 1 /* 3    */,
-    1 /* 4    */, 1 /* 5    */, 1 /* 6    */, 1 /* 7    */,
+  1 /* 4    */, 1 /* 5    */, 1 /* 6    */, 1 /* 7    */,
-    1 /* 8    */, 1 /* 9    */, 0 /* :    */, 0 /* ;    */,
+  1 /* 8    */, 1 /* 9    */, 0 /* :    */, 0 /* ;    */,
-    0 /* <    */, 0 /* =    */, 0 /* >    */, 0 /* ?    */,
+  0 /* <    */, 0 /* =    */, 0 /* >    */, 0 /* ?    */,
-    0 /* @    */, 0 /* A    */, 0 /* B    */, 0 /* C    */,
+  0 /* @    */, 0 /* A    */, 0 /* B    */, 0 /* C    */,
-    0 /* D    */, 0 /* E    */, 0 /* F    */, 0 /* G    */,
+  0 /* D    */, 0 /* E    */, 0 /* F    */, 0 /* G    */,
-    0 /* H    */, 0 /* I    */, 0 /* J    */, 0 /* K    */,
+  0 /* H    */, 0 /* I    */, 0 /* J    */, 0 /* K    */,
-    0 /* L    */, 0 /* M    */, 0 /* N    */, 0 /* O    */,
+  0 /* L    */, 0 /* M    */, 0 /* N    */, 0 /* O    */,
-    0 /* P    */, 0 /* Q    */, 0 /* R    */, 0 /* S    */,
+  0 /* P    */, 0 /* Q    */, 0 /* R    */, 0 /* S    */,
-    0 /* T    */, 0 /* U    */, 0 /* V    */, 0 /* W    */,
+  0 /* T    */, 0 /* U    */, 0 /* V    */, 0 /* W    */,
-    0 /* X    */, 0 /* Y    */, 0 /* Z    */, 0 /* [    */,
+  0 /* X    */, 0 /* Y    */, 0 /* Z    */, 0 /* [    */,
-    0 /* \    */, 0 /* ]    */, 1 /* ^    */, 1 /* _    */,
+  0 /* \    */, 0 /* ]    */, 1 /* ^    */, 1 /* _    */,
-    1 /* `    */, 1 /* a    */, 1 /* b    */, 1 /* c    */,
+  1 /* `    */, 1 /* a    */, 1 /* b    */, 1 /* c    */,
-    1 /* d    */, 1 /* e    */, 1 /* f    */, 1 /* g    */,
+  1 /* d    */, 1 /* e    */, 1 /* f    */, 1 /* g    */,
-    1 /* h    */, 1 /* i    */, 1 /* j    */, 1 /* k    */,
+  1 /* h    */, 1 /* i    */, 1 /* j    */, 1 /* k    */,
-    1 /* l    */, 1 /* m    */, 1 /* n    */, 1 /* o    */,
+  1 /* l    */, 1 /* m    */, 1 /* n    */, 1 /* o    */,
-    1 /* p    */, 1 /* q    */, 1 /* r    */, 1 /* s    */,
+  1 /* p    */, 1 /* q    */, 1 /* r    */, 1 /* s    */,
-    1 /* t    */, 1 /* u    */, 1 /* v    */, 1 /* w    */,
+  1 /* t    */, 1 /* u    */, 1 /* v    */, 1 /* w    */,
-    1 /* x    */, 1 /* y    */, 1 /* z    */, 0 /* {    */,
+  1 /* x    */, 1 /* y    */, 1 /* z    */, 0 /* {    */,
-    1 /* |    */, 0 /* }    */, 1 /* ~    */, 0 /* DEL  */,
+  1 /* |    */, 0 /* }    */, 1 /* ~    */, 0 /* DEL  */,
-    0 /* 0x80 */, 0 /* 0x81 */, 0 /* 0x82 */, 0 /* 0x83 */,
+  0 /* 0x80 */, 0 /* 0x81 */, 0 /* 0x82 */, 0 /* 0x83 */,
-    0 /* 0x84 */, 0 /* 0x85 */, 0 /* 0x86 */, 0 /* 0x87 */,
+  0 /* 0x84 */, 0 /* 0x85 */, 0 /* 0x86 */, 0 /* 0x87 */,
-    0 /* 0x88 */, 0 /* 0x89 */, 0 /* 0x8a */, 0 /* 0x8b */,
+  0 /* 0x88 */, 0 /* 0x89 */, 0 /* 0x8a */, 0 /* 0x8b */,
-    0 /* 0x8c */, 0 /* 0x8d */, 0 /* 0x8e */, 0 /* 0x8f */,
+  0 /* 0x8c */, 0 /* 0x8d */, 0 /* 0x8e */, 0 /* 0x8f */,
-    0 /* 0x90 */, 0 /* 0x91 */, 0 /* 0x92 */, 0 /* 0x93 */,
+  0 /* 0x90 */, 0 /* 0x91 */, 0 /* 0x92 */, 0 /* 0x93 */,
-    0 /* 0x94 */, 0 /* 0x95 */, 0 /* 0x96 */, 0 /* 0x97 */,
+  0 /* 0x94 */, 0 /* 0x95 */, 0 /* 0x96 */, 0 /* 0x97 */,
-    0 /* 0x98 */, 0 /* 0x99 */, 0 /* 0x9a */, 0 /* 0x9b */,
+  0 /* 0x98 */, 0 /* 0x99 */, 0 /* 0x9a */, 0 /* 0x9b */,
-    0 /* 0x9c */, 0 /* 0x9d */, 0 /* 0x9e */, 0 /* 0x9f */,
+  0 /* 0x9c */, 0 /* 0x9d */, 0 /* 0x9e */, 0 /* 0x9f */,
-    0 /* 0xa0 */, 0 /* 0xa1 */, 0 /* 0xa2 */, 0 /* 0xa3 */,
+  0 /* 0xa0 */, 0 /* 0xa1 */, 0 /* 0xa2 */, 0 /* 0xa3 */,
-    0 /* 0xa4 */, 0 /* 0xa5 */, 0 /* 0xa6 */, 0 /* 0xa7 */,
+  0 /* 0xa4 */, 0 /* 0xa5 */, 0 /* 0xa6 */, 0 /* 0xa7 */,
-    0 /* 0xa8 */, 0 /* 0xa9 */, 0 /* 0xaa */, 0 /* 0xab */,
+  0 /* 0xa8 */, 0 /* 0xa9 */, 0 /* 0xaa */, 0 /* 0xab */,
-    0 /* 0xac */, 0 /* 0xad */, 0 /* 0xae */, 0 /* 0xaf */,
+  0 /* 0xac */, 0 /* 0xad */, 0 /* 0xae */, 0 /* 0xaf */,
-    0 /* 0xb0 */, 0 /* 0xb1 */, 0 /* 0xb2 */, 0 /* 0xb3 */,
+  0 /* 0xb0 */, 0 /* 0xb1 */, 0 /* 0xb2 */, 0 /* 0xb3 */,
-    0 /* 0xb4 */, 0 /* 0xb5 */, 0 /* 0xb6 */, 0 /* 0xb7 */,
+  0 /* 0xb4 */, 0 /* 0xb5 */, 0 /* 0xb6 */, 0 /* 0xb7 */,
-    0 /* 0xb8 */, 0 /* 0xb9 */, 0 /* 0xba */, 0 /* 0xbb */,
+  0 /* 0xb8 */, 0 /* 0xb9 */, 0 /* 0xba */, 0 /* 0xbb */,
-    0 /* 0xbc */, 0 /* 0xbd */, 0 /* 0xbe */, 0 /* 0xbf */,
+  0 /* 0xbc */, 0 /* 0xbd */, 0 /* 0xbe */, 0 /* 0xbf */,
-    0 /* 0xc0 */, 0 /* 0xc1 */, 0 /* 0xc2 */, 0 /* 0xc3 */,
+  0 /* 0xc0 */, 0 /* 0xc1 */, 0 /* 0xc2 */, 0 /* 0xc3 */,
-    0 /* 0xc4 */, 0 /* 0xc5 */, 0 /* 0xc6 */, 0 /* 0xc7 */,
+  0 /* 0xc4 */, 0 /* 0xc5 */, 0 /* 0xc6 */, 0 /* 0xc7 */,
-    0 /* 0xc8 */, 0 /* 0xc9 */, 0 /* 0xca */, 0 /* 0xcb */,
+  0 /* 0xc8 */, 0 /* 0xc9 */, 0 /* 0xca */, 0 /* 0xcb */,
-    0 /* 0xcc */, 0 /* 0xcd */, 0 /* 0xce */, 0 /* 0xcf */,
+  0 /* 0xcc */, 0 /* 0xcd */, 0 /* 0xce */, 0 /* 0xcf */,
-    0 /* 0xd0 */, 0 /* 0xd1 */, 0 /* 0xd2 */, 0 /* 0xd3 */,
+  0 /* 0xd0 */, 0 /* 0xd1 */, 0 /* 0xd2 */, 0 /* 0xd3 */,
-    0 /* 0xd4 */, 0 /* 0xd5 */, 0 /* 0xd6 */, 0 /* 0xd7 */,
+  0 /* 0xd4 */, 0 /* 0xd5 */, 0 /* 0xd6 */, 0 /* 0xd7 */,
-    0 /* 0xd8 */, 0 /* 0xd9 */, 0 /* 0xda */, 0 /* 0xdb */,
+  0 /* 0xd8 */, 0 /* 0xd9 */, 0 /* 0xda */, 0 /* 0xdb */,
-    0 /* 0xdc */, 0 /* 0xdd */, 0 /* 0xde */, 0 /* 0xdf */,
+  0 /* 0xdc */, 0 /* 0xdd */, 0 /* 0xde */, 0 /* 0xdf */,
-    0 /* 0xe0 */, 0 /* 0xe1 */, 0 /* 0xe2 */, 0 /* 0xe3 */,
+  0 /* 0xe0 */, 0 /* 0xe1 */, 0 /* 0xe2 */, 0 /* 0xe3 */,
-    0 /* 0xe4 */, 0 /* 0xe5 */, 0 /* 0xe6 */, 0 /* 0xe7 */,
+  0 /* 0xe4 */, 0 /* 0xe5 */, 0 /* 0xe6 */, 0 /* 0xe7 */,
-    0 /* 0xe8 */, 0 /* 0xe9 */, 0 /* 0xea */, 0 /* 0xeb */,
+  0 /* 0xe8 */, 0 /* 0xe9 */, 0 /* 0xea */, 0 /* 0xeb */,
-    0 /* 0xec */, 0 /* 0xed */, 0 /* 0xee */, 0 /* 0xef */,
+  0 /* 0xec */, 0 /* 0xed */, 0 /* 0xee */, 0 /* 0xef */,
-    0 /* 0xf0 */, 0 /* 0xf1 */, 0 /* 0xf2 */, 0 /* 0xf3 */,
+  0 /* 0xf0 */, 0 /* 0xf1 */, 0 /* 0xf2 */, 0 /* 0xf3 */,
-    0 /* 0xf4 */, 0 /* 0xf5 */, 0 /* 0xf6 */, 0 /* 0xf7 */,
+  0 /* 0xf4 */, 0 /* 0xf5 */, 0 /* 0xf6 */, 0 /* 0xf7 */,
-    0 /* 0xf8 */, 0 /* 0xf9 */, 0 /* 0xfa */, 0 /* 0xfb */,
+  0 /* 0xf8 */, 0 /* 0xf9 */, 0 /* 0xfa */, 0 /* 0xfb */,
-    0 /* 0xfc */, 0 /* 0xfd */, 0 /* 0xfe */, 0 /* 0xff */
+  0 /* 0xfc */, 0 /* 0xfd */, 0 /* 0xfe */, 0 /* 0xff */
 };
 
 int nghttp2_check_header_name(const uint8_t *name, size_t len) {
@@ -433,70 +433,70 @@ int nghttp2_check_header_name(const uint8_t *name, size_t len) {
 
 /* Generated by genvchartbl.py */
 static const int VALID_HD_VALUE_CHARS[] = {
-    0 /* NUL  */, 0 /* SOH  */, 0 /* STX  */, 0 /* ETX  */,
+  0 /* NUL  */, 0 /* SOH  */, 0 /* STX  */, 0 /* ETX  */,
-    0 /* EOT  */, 0 /* ENQ  */, 0 /* ACK  */, 0 /* BEL  */,
+  0 /* EOT  */, 0 /* ENQ  */, 0 /* ACK  */, 0 /* BEL  */,
-    0 /* BS   */, 1 /* HT   */, 0 /* LF   */, 0 /* VT   */,
+  0 /* BS   */, 1 /* HT   */, 0 /* LF   */, 0 /* VT   */,
-    0 /* FF   */, 0 /* CR   */, 0 /* SO   */, 0 /* SI   */,
+  0 /* FF   */, 0 /* CR   */, 0 /* SO   */, 0 /* SI   */,
-    0 /* DLE  */, 0 /* DC1  */, 0 /* DC2  */, 0 /* DC3  */,
+  0 /* DLE  */, 0 /* DC1  */, 0 /* DC2  */, 0 /* DC3  */,
-    0 /* DC4  */, 0 /* NAK  */, 0 /* SYN  */, 0 /* ETB  */,
+  0 /* DC4  */, 0 /* NAK  */, 0 /* SYN  */, 0 /* ETB  */,
-    0 /* CAN  */, 0 /* EM   */, 0 /* SUB  */, 0 /* ESC  */,
+  0 /* CAN  */, 0 /* EM   */, 0 /* SUB  */, 0 /* ESC  */,
-    0 /* FS   */, 0 /* GS   */, 0 /* RS   */, 0 /* US   */,
+  0 /* FS   */, 0 /* GS   */, 0 /* RS   */, 0 /* US   */,
-    1 /* SPC  */, 1 /* !    */, 1 /* "    */, 1 /* #    */,
+  1 /* SPC  */, 1 /* !    */, 1 /* "    */, 1 /* #    */,
-    1 /* $    */, 1 /* %    */, 1 /* &    */, 1 /* '    */,
+  1 /* $    */, 1 /* %    */, 1 /* &    */, 1 /* '    */,
-    1 /* (    */, 1 /* )    */, 1 /* *    */, 1 /* +    */,
+  1 /* (    */, 1 /* )    */, 1 /* *    */, 1 /* +    */,
-    1 /* ,    */, 1 /* -    */, 1 /* .    */, 1 /* /    */,
+  1 /* ,    */, 1 /* -    */, 1 /* .    */, 1 /* /    */,
-    1 /* 0    */, 1 /* 1    */, 1 /* 2    */, 1 /* 3    */,
+  1 /* 0    */, 1 /* 1    */, 1 /* 2    */, 1 /* 3    */,
-    1 /* 4    */, 1 /* 5    */, 1 /* 6    */, 1 /* 7    */,
+  1 /* 4    */, 1 /* 5    */, 1 /* 6    */, 1 /* 7    */,
-    1 /* 8    */, 1 /* 9    */, 1 /* :    */, 1 /* ;    */,
+  1 /* 8    */, 1 /* 9    */, 1 /* :    */, 1 /* ;    */,
-    1 /* <    */, 1 /* =    */, 1 /* >    */, 1 /* ?    */,
+  1 /* <    */, 1 /* =    */, 1 /* >    */, 1 /* ?    */,
-    1 /* @    */, 1 /* A    */, 1 /* B    */, 1 /* C    */,
+  1 /* @    */, 1 /* A    */, 1 /* B    */, 1 /* C    */,
-    1 /* D    */, 1 /* E    */, 1 /* F    */, 1 /* G    */,
+  1 /* D    */, 1 /* E    */, 1 /* F    */, 1 /* G    */,
-    1 /* H    */, 1 /* I    */, 1 /* J    */, 1 /* K    */,
+  1 /* H    */, 1 /* I    */, 1 /* J    */, 1 /* K    */,
-    1 /* L    */, 1 /* M    */, 1 /* N    */, 1 /* O    */,
+  1 /* L    */, 1 /* M    */, 1 /* N    */, 1 /* O    */,
-    1 /* P    */, 1 /* Q    */, 1 /* R    */, 1 /* S    */,
+  1 /* P    */, 1 /* Q    */, 1 /* R    */, 1 /* S    */,
-    1 /* T    */, 1 /* U    */, 1 /* V    */, 1 /* W    */,
+  1 /* T    */, 1 /* U    */, 1 /* V    */, 1 /* W    */,
-    1 /* X    */, 1 /* Y    */, 1 /* Z    */, 1 /* [    */,
+  1 /* X    */, 1 /* Y    */, 1 /* Z    */, 1 /* [    */,
-    1 /* \    */, 1 /* ]    */, 1 /* ^    */, 1 /* _    */,
+  1 /* \    */, 1 /* ]    */, 1 /* ^    */, 1 /* _    */,
-    1 /* `    */, 1 /* a    */, 1 /* b    */, 1 /* c    */,
+  1 /* `    */, 1 /* a    */, 1 /* b    */, 1 /* c    */,
-    1 /* d    */, 1 /* e    */, 1 /* f    */, 1 /* g    */,
+  1 /* d    */, 1 /* e    */, 1 /* f    */, 1 /* g    */,
-    1 /* h    */, 1 /* i    */, 1 /* j    */, 1 /* k    */,
+  1 /* h    */, 1 /* i    */, 1 /* j    */, 1 /* k    */,
-    1 /* l    */, 1 /* m    */, 1 /* n    */, 1 /* o    */,
+  1 /* l    */, 1 /* m    */, 1 /* n    */, 1 /* o    */,
-    1 /* p    */, 1 /* q    */, 1 /* r    */, 1 /* s    */,
+  1 /* p    */, 1 /* q    */, 1 /* r    */, 1 /* s    */,
-    1 /* t    */, 1 /* u    */, 1 /* v    */, 1 /* w    */,
+  1 /* t    */, 1 /* u    */, 1 /* v    */, 1 /* w    */,
-    1 /* x    */, 1 /* y    */, 1 /* z    */, 1 /* {    */,
+  1 /* x    */, 1 /* y    */, 1 /* z    */, 1 /* {    */,
-    1 /* |    */, 1 /* }    */, 1 /* ~    */, 0 /* DEL  */,
+  1 /* |    */, 1 /* }    */, 1 /* ~    */, 0 /* DEL  */,
-    1 /* 0x80 */, 1 /* 0x81 */, 1 /* 0x82 */, 1 /* 0x83 */,
+  1 /* 0x80 */, 1 /* 0x81 */, 1 /* 0x82 */, 1 /* 0x83 */,
-    1 /* 0x84 */, 1 /* 0x85 */, 1 /* 0x86 */, 1 /* 0x87 */,
+  1 /* 0x84 */, 1 /* 0x85 */, 1 /* 0x86 */, 1 /* 0x87 */,
-    1 /* 0x88 */, 1 /* 0x89 */, 1 /* 0x8a */, 1 /* 0x8b */,
+  1 /* 0x88 */, 1 /* 0x89 */, 1 /* 0x8a */, 1 /* 0x8b */,
-    1 /* 0x8c */, 1 /* 0x8d */, 1 /* 0x8e */, 1 /* 0x8f */,
+  1 /* 0x8c */, 1 /* 0x8d */, 1 /* 0x8e */, 1 /* 0x8f */,
-    1 /* 0x90 */, 1 /* 0x91 */, 1 /* 0x92 */, 1 /* 0x93 */,
+  1 /* 0x90 */, 1 /* 0x91 */, 1 /* 0x92 */, 1 /* 0x93 */,
-    1 /* 0x94 */, 1 /* 0x95 */, 1 /* 0x96 */, 1 /* 0x97 */,
+  1 /* 0x94 */, 1 /* 0x95 */, 1 /* 0x96 */, 1 /* 0x97 */,
-    1 /* 0x98 */, 1 /* 0x99 */, 1 /* 0x9a */, 1 /* 0x9b */,
+  1 /* 0x98 */, 1 /* 0x99 */, 1 /* 0x9a */, 1 /* 0x9b */,
-    1 /* 0x9c */, 1 /* 0x9d */, 1 /* 0x9e */, 1 /* 0x9f */,
+  1 /* 0x9c */, 1 /* 0x9d */, 1 /* 0x9e */, 1 /* 0x9f */,
-    1 /* 0xa0 */, 1 /* 0xa1 */, 1 /* 0xa2 */, 1 /* 0xa3 */,
+  1 /* 0xa0 */, 1 /* 0xa1 */, 1 /* 0xa2 */, 1 /* 0xa3 */,
-    1 /* 0xa4 */, 1 /* 0xa5 */, 1 /* 0xa6 */, 1 /* 0xa7 */,
+  1 /* 0xa4 */, 1 /* 0xa5 */, 1 /* 0xa6 */, 1 /* 0xa7 */,
-    1 /* 0xa8 */, 1 /* 0xa9 */, 1 /* 0xaa */, 1 /* 0xab */,
+  1 /* 0xa8 */, 1 /* 0xa9 */, 1 /* 0xaa */, 1 /* 0xab */,
-    1 /* 0xac */, 1 /* 0xad */, 1 /* 0xae */, 1 /* 0xaf */,
+  1 /* 0xac */, 1 /* 0xad */, 1 /* 0xae */, 1 /* 0xaf */,
-    1 /* 0xb0 */, 1 /* 0xb1 */, 1 /* 0xb2 */, 1 /* 0xb3 */,
+  1 /* 0xb0 */, 1 /* 0xb1 */, 1 /* 0xb2 */, 1 /* 0xb3 */,
-    1 /* 0xb4 */, 1 /* 0xb5 */, 1 /* 0xb6 */, 1 /* 0xb7 */,
+  1 /* 0xb4 */, 1 /* 0xb5 */, 1 /* 0xb6 */, 1 /* 0xb7 */,
-    1 /* 0xb8 */, 1 /* 0xb9 */, 1 /* 0xba */, 1 /* 0xbb */,
+  1 /* 0xb8 */, 1 /* 0xb9 */, 1 /* 0xba */, 1 /* 0xbb */,
-    1 /* 0xbc */, 1 /* 0xbd */, 1 /* 0xbe */, 1 /* 0xbf */,
+  1 /* 0xbc */, 1 /* 0xbd */, 1 /* 0xbe */, 1 /* 0xbf */,
-    1 /* 0xc0 */, 1 /* 0xc1 */, 1 /* 0xc2 */, 1 /* 0xc3 */,
+  1 /* 0xc0 */, 1 /* 0xc1 */, 1 /* 0xc2 */, 1 /* 0xc3 */,
-    1 /* 0xc4 */, 1 /* 0xc5 */, 1 /* 0xc6 */, 1 /* 0xc7 */,
+  1 /* 0xc4 */, 1 /* 0xc5 */, 1 /* 0xc6 */, 1 /* 0xc7 */,
-    1 /* 0xc8 */, 1 /* 0xc9 */, 1 /* 0xca */, 1 /* 0xcb */,
+  1 /* 0xc8 */, 1 /* 0xc9 */, 1 /* 0xca */, 1 /* 0xcb */,
-    1 /* 0xcc */, 1 /* 0xcd */, 1 /* 0xce */, 1 /* 0xcf */,
+  1 /* 0xcc */, 1 /* 0xcd */, 1 /* 0xce */, 1 /* 0xcf */,
-    1 /* 0xd0 */, 1 /* 0xd1 */, 1 /* 0xd2 */, 1 /* 0xd3 */,
+  1 /* 0xd0 */, 1 /* 0xd1 */, 1 /* 0xd2 */, 1 /* 0xd3 */,
-    1 /* 0xd4 */, 1 /* 0xd5 */, 1 /* 0xd6 */, 1 /* 0xd7 */,
+  1 /* 0xd4 */, 1 /* 0xd5 */, 1 /* 0xd6 */, 1 /* 0xd7 */,
-    1 /* 0xd8 */, 1 /* 0xd9 */, 1 /* 0xda */, 1 /* 0xdb */,
+  1 /* 0xd8 */, 1 /* 0xd9 */, 1 /* 0xda */, 1 /* 0xdb */,
-    1 /* 0xdc */, 1 /* 0xdd */, 1 /* 0xde */, 1 /* 0xdf */,
+  1 /* 0xdc */, 1 /* 0xdd */, 1 /* 0xde */, 1 /* 0xdf */,
-    1 /* 0xe0 */, 1 /* 0xe1 */, 1 /* 0xe2 */, 1 /* 0xe3 */,
+  1 /* 0xe0 */, 1 /* 0xe1 */, 1 /* 0xe2 */, 1 /* 0xe3 */,
-    1 /* 0xe4 */, 1 /* 0xe5 */, 1 /* 0xe6 */, 1 /* 0xe7 */,
+  1 /* 0xe4 */, 1 /* 0xe5 */, 1 /* 0xe6 */, 1 /* 0xe7 */,
-    1 /* 0xe8 */, 1 /* 0xe9 */, 1 /* 0xea */, 1 /* 0xeb */,
+  1 /* 0xe8 */, 1 /* 0xe9 */, 1 /* 0xea */, 1 /* 0xeb */,
-    1 /* 0xec */, 1 /* 0xed */, 1 /* 0xee */, 1 /* 0xef */,
+  1 /* 0xec */, 1 /* 0xed */, 1 /* 0xee */, 1 /* 0xef */,
-    1 /* 0xf0 */, 1 /* 0xf1 */, 1 /* 0xf2 */, 1 /* 0xf3 */,
+  1 /* 0xf0 */, 1 /* 0xf1 */, 1 /* 0xf2 */, 1 /* 0xf3 */,
-    1 /* 0xf4 */, 1 /* 0xf5 */, 1 /* 0xf6 */, 1 /* 0xf7 */,
+  1 /* 0xf4 */, 1 /* 0xf5 */, 1 /* 0xf6 */, 1 /* 0xf7 */,
-    1 /* 0xf8 */, 1 /* 0xf9 */, 1 /* 0xfa */, 1 /* 0xfb */,
+  1 /* 0xf8 */, 1 /* 0xf9 */, 1 /* 0xfa */, 1 /* 0xfb */,
-    1 /* 0xfc */, 1 /* 0xfd */, 1 /* 0xfe */, 1 /* 0xff */
+  1 /* 0xfc */, 1 /* 0xfd */, 1 /* 0xfe */, 1 /* 0xff */
 };
 
 int nghttp2_check_header_value(const uint8_t *value, size_t len) {
@@ -524,70 +524,70 @@ int nghttp2_check_header_value_rfc9113(const uint8_t *value, size_t len) {
 
 /* Generated by genmethodchartbl.py */
 static char VALID_METHOD_CHARS[] = {
-    0 /* NUL  */, 0 /* SOH  */, 0 /* STX  */, 0 /* ETX  */,
+  0 /* NUL  */, 0 /* SOH  */, 0 /* STX  */, 0 /* ETX  */,
-    0 /* EOT  */, 0 /* ENQ  */, 0 /* ACK  */, 0 /* BEL  */,
+  0 /* EOT  */, 0 /* ENQ  */, 0 /* ACK  */, 0 /* BEL  */,
-    0 /* BS   */, 0 /* HT   */, 0 /* LF   */, 0 /* VT   */,
+  0 /* BS   */, 0 /* HT   */, 0 /* LF   */, 0 /* VT   */,
-    0 /* FF   */, 0 /* CR   */, 0 /* SO   */, 0 /* SI   */,
+  0 /* FF   */, 0 /* CR   */, 0 /* SO   */, 0 /* SI   */,
-    0 /* DLE  */, 0 /* DC1  */, 0 /* DC2  */, 0 /* DC3  */,
+  0 /* DLE  */, 0 /* DC1  */, 0 /* DC2  */, 0 /* DC3  */,
-    0 /* DC4  */, 0 /* NAK  */, 0 /* SYN  */, 0 /* ETB  */,
+  0 /* DC4  */, 0 /* NAK  */, 0 /* SYN  */, 0 /* ETB  */,
-    0 /* CAN  */, 0 /* EM   */, 0 /* SUB  */, 0 /* ESC  */,
+  0 /* CAN  */, 0 /* EM   */, 0 /* SUB  */, 0 /* ESC  */,
-    0 /* FS   */, 0 /* GS   */, 0 /* RS   */, 0 /* US   */,
+  0 /* FS   */, 0 /* GS   */, 0 /* RS   */, 0 /* US   */,
-    0 /* SPC  */, 1 /* !    */, 0 /* "    */, 1 /* #    */,
+  0 /* SPC  */, 1 /* !    */, 0 /* "    */, 1 /* #    */,
-    1 /* $    */, 1 /* %    */, 1 /* &    */, 1 /* '    */,
+  1 /* $    */, 1 /* %    */, 1 /* &    */, 1 /* '    */,
-    0 /* (    */, 0 /* )    */, 1 /* *    */, 1 /* +    */,
+  0 /* (    */, 0 /* )    */, 1 /* *    */, 1 /* +    */,
-    0 /* ,    */, 1 /* -    */, 1 /* .    */, 0 /* /    */,
+  0 /* ,    */, 1 /* -    */, 1 /* .    */, 0 /* /    */,
-    1 /* 0    */, 1 /* 1    */, 1 /* 2    */, 1 /* 3    */,
+  1 /* 0    */, 1 /* 1    */, 1 /* 2    */, 1 /* 3    */,
-    1 /* 4    */, 1 /* 5    */, 1 /* 6    */, 1 /* 7    */,
+  1 /* 4    */, 1 /* 5    */, 1 /* 6    */, 1 /* 7    */,
-    1 /* 8    */, 1 /* 9    */, 0 /* :    */, 0 /* ;    */,
+  1 /* 8    */, 1 /* 9    */, 0 /* :    */, 0 /* ;    */,
-    0 /* <    */, 0 /* =    */, 0 /* >    */, 0 /* ?    */,
+  0 /* <    */, 0 /* =    */, 0 /* >    */, 0 /* ?    */,
-    0 /* @    */, 1 /* A    */, 1 /* B    */, 1 /* C    */,
+  0 /* @    */, 1 /* A    */, 1 /* B    */, 1 /* C    */,
-    1 /* D    */, 1 /* E    */, 1 /* F    */, 1 /* G    */,
+  1 /* D    */, 1 /* E    */, 1 /* F    */, 1 /* G    */,
-    1 /* H    */, 1 /* I    */, 1 /* J    */, 1 /* K    */,
+  1 /* H    */, 1 /* I    */, 1 /* J    */, 1 /* K    */,
-    1 /* L    */, 1 /* M    */, 1 /* N    */, 1 /* O    */,
+  1 /* L    */, 1 /* M    */, 1 /* N    */, 1 /* O    */,
-    1 /* P    */, 1 /* Q    */, 1 /* R    */, 1 /* S    */,
+  1 /* P    */, 1 /* Q    */, 1 /* R    */, 1 /* S    */,
-    1 /* T    */, 1 /* U    */, 1 /* V    */, 1 /* W    */,
+  1 /* T    */, 1 /* U    */, 1 /* V    */, 1 /* W    */,
-    1 /* X    */, 1 /* Y    */, 1 /* Z    */, 0 /* [    */,
+  1 /* X    */, 1 /* Y    */, 1 /* Z    */, 0 /* [    */,
-    0 /* \    */, 0 /* ]    */, 1 /* ^    */, 1 /* _    */,
+  0 /* \    */, 0 /* ]    */, 1 /* ^    */, 1 /* _    */,
-    1 /* `    */, 1 /* a    */, 1 /* b    */, 1 /* c    */,
+  1 /* `    */, 1 /* a    */, 1 /* b    */, 1 /* c    */,
-    1 /* d    */, 1 /* e    */, 1 /* f    */, 1 /* g    */,
+  1 /* d    */, 1 /* e    */, 1 /* f    */, 1 /* g    */,
-    1 /* h    */, 1 /* i    */, 1 /* j    */, 1 /* k    */,
+  1 /* h    */, 1 /* i    */, 1 /* j    */, 1 /* k    */,
-    1 /* l    */, 1 /* m    */, 1 /* n    */, 1 /* o    */,
+  1 /* l    */, 1 /* m    */, 1 /* n    */, 1 /* o    */,
-    1 /* p    */, 1 /* q    */, 1 /* r    */, 1 /* s    */,
+  1 /* p    */, 1 /* q    */, 1 /* r    */, 1 /* s    */,
-    1 /* t    */, 1 /* u    */, 1 /* v    */, 1 /* w    */,
+  1 /* t    */, 1 /* u    */, 1 /* v    */, 1 /* w    */,
-    1 /* x    */, 1 /* y    */, 1 /* z    */, 0 /* {    */,
+  1 /* x    */, 1 /* y    */, 1 /* z    */, 0 /* {    */,
-    1 /* |    */, 0 /* }    */, 1 /* ~    */, 0 /* DEL  */,
+  1 /* |    */, 0 /* }    */, 1 /* ~    */, 0 /* DEL  */,
-    0 /* 0x80 */, 0 /* 0x81 */, 0 /* 0x82 */, 0 /* 0x83 */,
+  0 /* 0x80 */, 0 /* 0x81 */, 0 /* 0x82 */, 0 /* 0x83 */,
-    0 /* 0x84 */, 0 /* 0x85 */, 0 /* 0x86 */, 0 /* 0x87 */,
+  0 /* 0x84 */, 0 /* 0x85 */, 0 /* 0x86 */, 0 /* 0x87 */,
-    0 /* 0x88 */, 0 /* 0x89 */, 0 /* 0x8a */, 0 /* 0x8b */,
+  0 /* 0x88 */, 0 /* 0x89 */, 0 /* 0x8a */, 0 /* 0x8b */,
-    0 /* 0x8c */, 0 /* 0x8d */, 0 /* 0x8e */, 0 /* 0x8f */,
+  0 /* 0x8c */, 0 /* 0x8d */, 0 /* 0x8e */, 0 /* 0x8f */,
-    0 /* 0x90 */, 0 /* 0x91 */, 0 /* 0x92 */, 0 /* 0x93 */,
+  0 /* 0x90 */, 0 /* 0x91 */, 0 /* 0x92 */, 0 /* 0x93 */,
-    0 /* 0x94 */, 0 /* 0x95 */, 0 /* 0x96 */, 0 /* 0x97 */,
+  0 /* 0x94 */, 0 /* 0x95 */, 0 /* 0x96 */, 0 /* 0x97 */,
-    0 /* 0x98 */, 0 /* 0x99 */, 0 /* 0x9a */, 0 /* 0x9b */,
+  0 /* 0x98 */, 0 /* 0x99 */, 0 /* 0x9a */, 0 /* 0x9b */,
-    0 /* 0x9c */, 0 /* 0x9d */, 0 /* 0x9e */, 0 /* 0x9f */,
+  0 /* 0x9c */, 0 /* 0x9d */, 0 /* 0x9e */, 0 /* 0x9f */,
-    0 /* 0xa0 */, 0 /* 0xa1 */, 0 /* 0xa2 */, 0 /* 0xa3 */,
+  0 /* 0xa0 */, 0 /* 0xa1 */, 0 /* 0xa2 */, 0 /* 0xa3 */,
-    0 /* 0xa4 */, 0 /* 0xa5 */, 0 /* 0xa6 */, 0 /* 0xa7 */,
+  0 /* 0xa4 */, 0 /* 0xa5 */, 0 /* 0xa6 */, 0 /* 0xa7 */,
-    0 /* 0xa8 */, 0 /* 0xa9 */, 0 /* 0xaa */, 0 /* 0xab */,
+  0 /* 0xa8 */, 0 /* 0xa9 */, 0 /* 0xaa */, 0 /* 0xab */,
-    0 /* 0xac */, 0 /* 0xad */, 0 /* 0xae */, 0 /* 0xaf */,
+  0 /* 0xac */, 0 /* 0xad */, 0 /* 0xae */, 0 /* 0xaf */,
-    0 /* 0xb0 */, 0 /* 0xb1 */, 0 /* 0xb2 */, 0 /* 0xb3 */,
+  0 /* 0xb0 */, 0 /* 0xb1 */, 0 /* 0xb2 */, 0 /* 0xb3 */,
-    0 /* 0xb4 */, 0 /* 0xb5 */, 0 /* 0xb6 */, 0 /* 0xb7 */,
+  0 /* 0xb4 */, 0 /* 0xb5 */, 0 /* 0xb6 */, 0 /* 0xb7 */,
-    0 /* 0xb8 */, 0 /* 0xb9 */, 0 /* 0xba */, 0 /* 0xbb */,
+  0 /* 0xb8 */, 0 /* 0xb9 */, 0 /* 0xba */, 0 /* 0xbb */,
-    0 /* 0xbc */, 0 /* 0xbd */, 0 /* 0xbe */, 0 /* 0xbf */,
+  0 /* 0xbc */, 0 /* 0xbd */, 0 /* 0xbe */, 0 /* 0xbf */,
-    0 /* 0xc0 */, 0 /* 0xc1 */, 0 /* 0xc2 */, 0 /* 0xc3 */,
+  0 /* 0xc0 */, 0 /* 0xc1 */, 0 /* 0xc2 */, 0 /* 0xc3 */,
-    0 /* 0xc4 */, 0 /* 0xc5 */, 0 /* 0xc6 */, 0 /* 0xc7 */,
+  0 /* 0xc4 */, 0 /* 0xc5 */, 0 /* 0xc6 */, 0 /* 0xc7 */,
-    0 /* 0xc8 */, 0 /* 0xc9 */, 0 /* 0xca */, 0 /* 0xcb */,
+  0 /* 0xc8 */, 0 /* 0xc9 */, 0 /* 0xca */, 0 /* 0xcb */,
-    0 /* 0xcc */, 0 /* 0xcd */, 0 /* 0xce */, 0 /* 0xcf */,
+  0 /* 0xcc */, 0 /* 0xcd */, 0 /* 0xce */, 0 /* 0xcf */,
-    0 /* 0xd0 */, 0 /* 0xd1 */, 0 /* 0xd2 */, 0 /* 0xd3 */,
+  0 /* 0xd0 */, 0 /* 0xd1 */, 0 /* 0xd2 */, 0 /* 0xd3 */,
-    0 /* 0xd4 */, 0 /* 0xd5 */, 0 /* 0xd6 */, 0 /* 0xd7 */,
+  0 /* 0xd4 */, 0 /* 0xd5 */, 0 /* 0xd6 */, 0 /* 0xd7 */,
-    0 /* 0xd8 */, 0 /* 0xd9 */, 0 /* 0xda */, 0 /* 0xdb */,
+  0 /* 0xd8 */, 0 /* 0xd9 */, 0 /* 0xda */, 0 /* 0xdb */,
-    0 /* 0xdc */, 0 /* 0xdd */, 0 /* 0xde */, 0 /* 0xdf */,
+  0 /* 0xdc */, 0 /* 0xdd */, 0 /* 0xde */, 0 /* 0xdf */,
-    0 /* 0xe0 */, 0 /* 0xe1 */, 0 /* 0xe2 */, 0 /* 0xe3 */,
+  0 /* 0xe0 */, 0 /* 0xe1 */, 0 /* 0xe2 */, 0 /* 0xe3 */,
-    0 /* 0xe4 */, 0 /* 0xe5 */, 0 /* 0xe6 */, 0 /* 0xe7 */,
+  0 /* 0xe4 */, 0 /* 0xe5 */, 0 /* 0xe6 */, 0 /* 0xe7 */,
-    0 /* 0xe8 */, 0 /* 0xe9 */, 0 /* 0xea */, 0 /* 0xeb */,
+  0 /* 0xe8 */, 0 /* 0xe9 */, 0 /* 0xea */, 0 /* 0xeb */,
-    0 /* 0xec */, 0 /* 0xed */, 0 /* 0xee */, 0 /* 0xef */,
+  0 /* 0xec */, 0 /* 0xed */, 0 /* 0xee */, 0 /* 0xef */,
-    0 /* 0xf0 */, 0 /* 0xf1 */, 0 /* 0xf2 */, 0 /* 0xf3 */,
+  0 /* 0xf0 */, 0 /* 0xf1 */, 0 /* 0xf2 */, 0 /* 0xf3 */,
-    0 /* 0xf4 */, 0 /* 0xf5 */, 0 /* 0xf6 */, 0 /* 0xf7 */,
+  0 /* 0xf4 */, 0 /* 0xf5 */, 0 /* 0xf6 */, 0 /* 0xf7 */,
-    0 /* 0xf8 */, 0 /* 0xf9 */, 0 /* 0xfa */, 0 /* 0xfb */,
+  0 /* 0xf8 */, 0 /* 0xf9 */, 0 /* 0xfa */, 0 /* 0xfb */,
-    0 /* 0xfc */, 0 /* 0xfd */, 0 /* 0xfe */, 0 /* 0xff */
+  0 /* 0xfc */, 0 /* 0xfd */, 0 /* 0xfe */, 0 /* 0xff */
 };
 
 int nghttp2_check_method(const uint8_t *value, size_t len) {
@@ -605,70 +605,70 @@ int nghttp2_check_method(const uint8_t *value, size_t len) {
 
 /* Generated by genpathchartbl.py */
 static char VALID_PATH_CHARS[] = {
-    0 /* NUL  */, 0 /* SOH  */, 0 /* STX  */, 0 /* ETX  */,
+  0 /* NUL  */, 0 /* SOH  */, 0 /* STX  */, 0 /* ETX  */,
-    0 /* EOT  */, 0 /* ENQ  */, 0 /* ACK  */, 0 /* BEL  */,
+  0 /* EOT  */, 0 /* ENQ  */, 0 /* ACK  */, 0 /* BEL  */,
-    0 /* BS   */, 0 /* HT   */, 0 /* LF   */, 0 /* VT   */,
+  0 /* BS   */, 0 /* HT   */, 0 /* LF   */, 0 /* VT   */,
-    0 /* FF   */, 0 /* CR   */, 0 /* SO   */, 0 /* SI   */,
+  0 /* FF   */, 0 /* CR   */, 0 /* SO   */, 0 /* SI   */,
-    0 /* DLE  */, 0 /* DC1  */, 0 /* DC2  */, 0 /* DC3  */,
+  0 /* DLE  */, 0 /* DC1  */, 0 /* DC2  */, 0 /* DC3  */,
-    0 /* DC4  */, 0 /* NAK  */, 0 /* SYN  */, 0 /* ETB  */,
+  0 /* DC4  */, 0 /* NAK  */, 0 /* SYN  */, 0 /* ETB  */,
-    0 /* CAN  */, 0 /* EM   */, 0 /* SUB  */, 0 /* ESC  */,
+  0 /* CAN  */, 0 /* EM   */, 0 /* SUB  */, 0 /* ESC  */,
-    0 /* FS   */, 0 /* GS   */, 0 /* RS   */, 0 /* US   */,
+  0 /* FS   */, 0 /* GS   */, 0 /* RS   */, 0 /* US   */,
-    0 /* SPC  */, 1 /* !    */, 1 /* "    */, 1 /* #    */,
+  0 /* SPC  */, 1 /* !    */, 1 /* "    */, 1 /* #    */,
-    1 /* $    */, 1 /* %    */, 1 /* &    */, 1 /* '    */,
+  1 /* $    */, 1 /* %    */, 1 /* &    */, 1 /* '    */,
-    1 /* (    */, 1 /* )    */, 1 /* *    */, 1 /* +    */,
+  1 /* (    */, 1 /* )    */, 1 /* *    */, 1 /* +    */,
-    1 /* ,    */, 1 /* -    */, 1 /* .    */, 1 /* /    */,
+  1 /* ,    */, 1 /* -    */, 1 /* .    */, 1 /* /    */,
-    1 /* 0    */, 1 /* 1    */, 1 /* 2    */, 1 /* 3    */,
+  1 /* 0    */, 1 /* 1    */, 1 /* 2    */, 1 /* 3    */,
-    1 /* 4    */, 1 /* 5    */, 1 /* 6    */, 1 /* 7    */,
+  1 /* 4    */, 1 /* 5    */, 1 /* 6    */, 1 /* 7    */,
-    1 /* 8    */, 1 /* 9    */, 1 /* :    */, 1 /* ;    */,
+  1 /* 8    */, 1 /* 9    */, 1 /* :    */, 1 /* ;    */,
-    1 /* <    */, 1 /* =    */, 1 /* >    */, 1 /* ?    */,
+  1 /* <    */, 1 /* =    */, 1 /* >    */, 1 /* ?    */,
-    1 /* @    */, 1 /* A    */, 1 /* B    */, 1 /* C    */,
+  1 /* @    */, 1 /* A    */, 1 /* B    */, 1 /* C    */,
-    1 /* D    */, 1 /* E    */, 1 /* F    */, 1 /* G    */,
+  1 /* D    */, 1 /* E    */, 1 /* F    */, 1 /* G    */,
-    1 /* H    */, 1 /* I    */, 1 /* J    */, 1 /* K    */,
+  1 /* H    */, 1 /* I    */, 1 /* J    */, 1 /* K    */,
-    1 /* L    */, 1 /* M    */, 1 /* N    */, 1 /* O    */,
+  1 /* L    */, 1 /* M    */, 1 /* N    */, 1 /* O    */,
-    1 /* P    */, 1 /* Q    */, 1 /* R    */, 1 /* S    */,
+  1 /* P    */, 1 /* Q    */, 1 /* R    */, 1 /* S    */,
-    1 /* T    */, 1 /* U    */, 1 /* V    */, 1 /* W    */,
+  1 /* T    */, 1 /* U    */, 1 /* V    */, 1 /* W    */,
-    1 /* X    */, 1 /* Y    */, 1 /* Z    */, 1 /* [    */,
+  1 /* X    */, 1 /* Y    */, 1 /* Z    */, 1 /* [    */,
-    1 /* \    */, 1 /* ]    */, 1 /* ^    */, 1 /* _    */,
+  1 /* \    */, 1 /* ]    */, 1 /* ^    */, 1 /* _    */,
-    1 /* `    */, 1 /* a    */, 1 /* b    */, 1 /* c    */,
+  1 /* `    */, 1 /* a    */, 1 /* b    */, 1 /* c    */,
-    1 /* d    */, 1 /* e    */, 1 /* f    */, 1 /* g    */,
+  1 /* d    */, 1 /* e    */, 1 /* f    */, 1 /* g    */,
-    1 /* h    */, 1 /* i    */, 1 /* j    */, 1 /* k    */,
+  1 /* h    */, 1 /* i    */, 1 /* j    */, 1 /* k    */,
-    1 /* l    */, 1 /* m    */, 1 /* n    */, 1 /* o    */,
+  1 /* l    */, 1 /* m    */, 1 /* n    */, 1 /* o    */,
-    1 /* p    */, 1 /* q    */, 1 /* r    */, 1 /* s    */,
+  1 /* p    */, 1 /* q    */, 1 /* r    */, 1 /* s    */,
-    1 /* t    */, 1 /* u    */, 1 /* v    */, 1 /* w    */,
+  1 /* t    */, 1 /* u    */, 1 /* v    */, 1 /* w    */,
-    1 /* x    */, 1 /* y    */, 1 /* z    */, 1 /* {    */,
+  1 /* x    */, 1 /* y    */, 1 /* z    */, 1 /* {    */,
-    1 /* |    */, 1 /* }    */, 1 /* ~    */, 0 /* DEL  */,
+  1 /* |    */, 1 /* }    */, 1 /* ~    */, 0 /* DEL  */,
-    1 /* 0x80 */, 1 /* 0x81 */, 1 /* 0x82 */, 1 /* 0x83 */,
+  1 /* 0x80 */, 1 /* 0x81 */, 1 /* 0x82 */, 1 /* 0x83 */,
-    1 /* 0x84 */, 1 /* 0x85 */, 1 /* 0x86 */, 1 /* 0x87 */,
+  1 /* 0x84 */, 1 /* 0x85 */, 1 /* 0x86 */, 1 /* 0x87 */,
-    1 /* 0x88 */, 1 /* 0x89 */, 1 /* 0x8a */, 1 /* 0x8b */,
+  1 /* 0x88 */, 1 /* 0x89 */, 1 /* 0x8a */, 1 /* 0x8b */,
-    1 /* 0x8c */, 1 /* 0x8d */, 1 /* 0x8e */, 1 /* 0x8f */,
+  1 /* 0x8c */, 1 /* 0x8d */, 1 /* 0x8e */, 1 /* 0x8f */,
-    1 /* 0x90 */, 1 /* 0x91 */, 1 /* 0x92 */, 1 /* 0x93 */,
+  1 /* 0x90 */, 1 /* 0x91 */, 1 /* 0x92 */, 1 /* 0x93 */,
-    1 /* 0x94 */, 1 /* 0x95 */, 1 /* 0x96 */, 1 /* 0x97 */,
+  1 /* 0x94 */, 1 /* 0x95 */, 1 /* 0x96 */, 1 /* 0x97 */,
-    1 /* 0x98 */, 1 /* 0x99 */, 1 /* 0x9a */, 1 /* 0x9b */,
+  1 /* 0x98 */, 1 /* 0x99 */, 1 /* 0x9a */, 1 /* 0x9b */,
-    1 /* 0x9c */, 1 /* 0x9d */, 1 /* 0x9e */, 1 /* 0x9f */,
+  1 /* 0x9c */, 1 /* 0x9d */, 1 /* 0x9e */, 1 /* 0x9f */,
-    1 /* 0xa0 */, 1 /* 0xa1 */, 1 /* 0xa2 */, 1 /* 0xa3 */,
+  1 /* 0xa0 */, 1 /* 0xa1 */, 1 /* 0xa2 */, 1 /* 0xa3 */,
-    1 /* 0xa4 */, 1 /* 0xa5 */, 1 /* 0xa6 */, 1 /* 0xa7 */,
+  1 /* 0xa4 */, 1 /* 0xa5 */, 1 /* 0xa6 */, 1 /* 0xa7 */,
-    1 /* 0xa8 */, 1 /* 0xa9 */, 1 /* 0xaa */, 1 /* 0xab */,
+  1 /* 0xa8 */, 1 /* 0xa9 */, 1 /* 0xaa */, 1 /* 0xab */,
-    1 /* 0xac */, 1 /* 0xad */, 1 /* 0xae */, 1 /* 0xaf */,
+  1 /* 0xac */, 1 /* 0xad */, 1 /* 0xae */, 1 /* 0xaf */,
-    1 /* 0xb0 */, 1 /* 0xb1 */, 1 /* 0xb2 */, 1 /* 0xb3 */,
+  1 /* 0xb0 */, 1 /* 0xb1 */, 1 /* 0xb2 */, 1 /* 0xb3 */,
-    1 /* 0xb4 */, 1 /* 0xb5 */, 1 /* 0xb6 */, 1 /* 0xb7 */,
+  1 /* 0xb4 */, 1 /* 0xb5 */, 1 /* 0xb6 */, 1 /* 0xb7 */,
-    1 /* 0xb8 */, 1 /* 0xb9 */, 1 /* 0xba */, 1 /* 0xbb */,
+  1 /* 0xb8 */, 1 /* 0xb9 */, 1 /* 0xba */, 1 /* 0xbb */,
-    1 /* 0xbc */, 1 /* 0xbd */, 1 /* 0xbe */, 1 /* 0xbf */,
+  1 /* 0xbc */, 1 /* 0xbd */, 1 /* 0xbe */, 1 /* 0xbf */,
-    1 /* 0xc0 */, 1 /* 0xc1 */, 1 /* 0xc2 */, 1 /* 0xc3 */,
+  1 /* 0xc0 */, 1 /* 0xc1 */, 1 /* 0xc2 */, 1 /* 0xc3 */,
-    1 /* 0xc4 */, 1 /* 0xc5 */, 1 /* 0xc6 */, 1 /* 0xc7 */,
+  1 /* 0xc4 */, 1 /* 0xc5 */, 1 /* 0xc6 */, 1 /* 0xc7 */,
-    1 /* 0xc8 */, 1 /* 0xc9 */, 1 /* 0xca */, 1 /* 0xcb */,
+  1 /* 0xc8 */, 1 /* 0xc9 */, 1 /* 0xca */, 1 /* 0xcb */,
-    1 /* 0xcc */, 1 /* 0xcd */, 1 /* 0xce */, 1 /* 0xcf */,
+  1 /* 0xcc */, 1 /* 0xcd */, 1 /* 0xce */, 1 /* 0xcf */,
-    1 /* 0xd0 */, 1 /* 0xd1 */, 1 /* 0xd2 */, 1 /* 0xd3 */,
+  1 /* 0xd0 */, 1 /* 0xd1 */, 1 /* 0xd2 */, 1 /* 0xd3 */,
-    1 /* 0xd4 */, 1 /* 0xd5 */, 1 /* 0xd6 */, 1 /* 0xd7 */,
+  1 /* 0xd4 */, 1 /* 0xd5 */, 1 /* 0xd6 */, 1 /* 0xd7 */,
-    1 /* 0xd8 */, 1 /* 0xd9 */, 1 /* 0xda */, 1 /* 0xdb */,
+  1 /* 0xd8 */, 1 /* 0xd9 */, 1 /* 0xda */, 1 /* 0xdb */,
-    1 /* 0xdc */, 1 /* 0xdd */, 1 /* 0xde */, 1 /* 0xdf */,
+  1 /* 0xdc */, 1 /* 0xdd */, 1 /* 0xde */, 1 /* 0xdf */,
-    1 /* 0xe0 */, 1 /* 0xe1 */, 1 /* 0xe2 */, 1 /* 0xe3 */,
+  1 /* 0xe0 */, 1 /* 0xe1 */, 1 /* 0xe2 */, 1 /* 0xe3 */,
-    1 /* 0xe4 */, 1 /* 0xe5 */, 1 /* 0xe6 */, 1 /* 0xe7 */,
+  1 /* 0xe4 */, 1 /* 0xe5 */, 1 /* 0xe6 */, 1 /* 0xe7 */,
-    1 /* 0xe8 */, 1 /* 0xe9 */, 1 /* 0xea */, 1 /* 0xeb */,
+  1 /* 0xe8 */, 1 /* 0xe9 */, 1 /* 0xea */, 1 /* 0xeb */,
-    1 /* 0xec */, 1 /* 0xed */, 1 /* 0xee */, 1 /* 0xef */,
+  1 /* 0xec */, 1 /* 0xed */, 1 /* 0xee */, 1 /* 0xef */,
-    1 /* 0xf0 */, 1 /* 0xf1 */, 1 /* 0xf2 */, 1 /* 0xf3 */,
+  1 /* 0xf0 */, 1 /* 0xf1 */, 1 /* 0xf2 */, 1 /* 0xf3 */,
-    1 /* 0xf4 */, 1 /* 0xf5 */, 1 /* 0xf6 */, 1 /* 0xf7 */,
+  1 /* 0xf4 */, 1 /* 0xf5 */, 1 /* 0xf6 */, 1 /* 0xf7 */,
-    1 /* 0xf8 */, 1 /* 0xf9 */, 1 /* 0xfa */, 1 /* 0xfb */,
+  1 /* 0xf8 */, 1 /* 0xf9 */, 1 /* 0xfa */, 1 /* 0xfb */,
-    1 /* 0xfc */, 1 /* 0xfd */, 1 /* 0xfe */, 1 /* 0xff */
+  1 /* 0xfc */, 1 /* 0xfd */, 1 /* 0xfe */, 1 /* 0xff */
 };
 
 int nghttp2_check_path(const uint8_t *value, size_t len) {
@@ -683,70 +683,70 @@ int nghttp2_check_path(const uint8_t *value, size_t len) {
 
 /* Generated by genauthoritychartbl.py */
 static char VALID_AUTHORITY_CHARS[] = {
-    0 /* NUL  */, 0 /* SOH  */, 0 /* STX  */, 0 /* ETX  */,
+  0 /* NUL  */, 0 /* SOH  */, 0 /* STX  */, 0 /* ETX  */,
-    0 /* EOT  */, 0 /* ENQ  */, 0 /* ACK  */, 0 /* BEL  */,
+  0 /* EOT  */, 0 /* ENQ  */, 0 /* ACK  */, 0 /* BEL  */,
-    0 /* BS   */, 0 /* HT   */, 0 /* LF   */, 0 /* VT   */,
+  0 /* BS   */, 0 /* HT   */, 0 /* LF   */, 0 /* VT   */,
-    0 /* FF   */, 0 /* CR   */, 0 /* SO   */, 0 /* SI   */,
+  0 /* FF   */, 0 /* CR   */, 0 /* SO   */, 0 /* SI   */,
-    0 /* DLE  */, 0 /* DC1  */, 0 /* DC2  */, 0 /* DC3  */,
+  0 /* DLE  */, 0 /* DC1  */, 0 /* DC2  */, 0 /* DC3  */,
-    0 /* DC4  */, 0 /* NAK  */, 0 /* SYN  */, 0 /* ETB  */,
+  0 /* DC4  */, 0 /* NAK  */, 0 /* SYN  */, 0 /* ETB  */,
-    0 /* CAN  */, 0 /* EM   */, 0 /* SUB  */, 0 /* ESC  */,
+  0 /* CAN  */, 0 /* EM   */, 0 /* SUB  */, 0 /* ESC  */,
-    0 /* FS   */, 0 /* GS   */, 0 /* RS   */, 0 /* US   */,
+  0 /* FS   */, 0 /* GS   */, 0 /* RS   */, 0 /* US   */,
-    0 /* SPC  */, 1 /* !    */, 0 /* "    */, 0 /* #    */,
+  0 /* SPC  */, 1 /* !    */, 0 /* "    */, 0 /* #    */,
-    1 /* $    */, 1 /* %    */, 1 /* &    */, 1 /* '    */,
+  1 /* $    */, 1 /* %    */, 1 /* &    */, 1 /* '    */,
-    1 /* (    */, 1 /* )    */, 1 /* *    */, 1 /* +    */,
+  1 /* (    */, 1 /* )    */, 1 /* *    */, 1 /* +    */,
-    1 /* ,    */, 1 /* -    */, 1 /* .    */, 0 /* /    */,
+  1 /* ,    */, 1 /* -    */, 1 /* .    */, 0 /* /    */,
-    1 /* 0    */, 1 /* 1    */, 1 /* 2    */, 1 /* 3    */,
+  1 /* 0    */, 1 /* 1    */, 1 /* 2    */, 1 /* 3    */,
-    1 /* 4    */, 1 /* 5    */, 1 /* 6    */, 1 /* 7    */,
+  1 /* 4    */, 1 /* 5    */, 1 /* 6    */, 1 /* 7    */,
-    1 /* 8    */, 1 /* 9    */, 1 /* :    */, 1 /* ;    */,
+  1 /* 8    */, 1 /* 9    */, 1 /* :    */, 1 /* ;    */,
-    0 /* <    */, 1 /* =    */, 0 /* >    */, 0 /* ?    */,
+  0 /* <    */, 1 /* =    */, 0 /* >    */, 0 /* ?    */,
-    1 /* @    */, 1 /* A    */, 1 /* B    */, 1 /* C    */,
+  1 /* @    */, 1 /* A    */, 1 /* B    */, 1 /* C    */,
-    1 /* D    */, 1 /* E    */, 1 /* F    */, 1 /* G    */,
+  1 /* D    */, 1 /* E    */, 1 /* F    */, 1 /* G    */,
-    1 /* H    */, 1 /* I    */, 1 /* J    */, 1 /* K    */,
+  1 /* H    */, 1 /* I    */, 1 /* J    */, 1 /* K    */,
-    1 /* L    */, 1 /* M    */, 1 /* N    */, 1 /* O    */,
+  1 /* L    */, 1 /* M    */, 1 /* N    */, 1 /* O    */,
-    1 /* P    */, 1 /* Q    */, 1 /* R    */, 1 /* S    */,
+  1 /* P    */, 1 /* Q    */, 1 /* R    */, 1 /* S    */,
-    1 /* T    */, 1 /* U    */, 1 /* V    */, 1 /* W    */,
+  1 /* T    */, 1 /* U    */, 1 /* V    */, 1 /* W    */,
-    1 /* X    */, 1 /* Y    */, 1 /* Z    */, 1 /* [    */,
+  1 /* X    */, 1 /* Y    */, 1 /* Z    */, 1 /* [    */,
-    0 /* \    */, 1 /* ]    */, 0 /* ^    */, 1 /* _    */,
+  0 /* \    */, 1 /* ]    */, 0 /* ^    */, 1 /* _    */,
-    0 /* `    */, 1 /* a    */, 1 /* b    */, 1 /* c    */,
+  0 /* `    */, 1 /* a    */, 1 /* b    */, 1 /* c    */,
-    1 /* d    */, 1 /* e    */, 1 /* f    */, 1 /* g    */,
+  1 /* d    */, 1 /* e    */, 1 /* f    */, 1 /* g    */,
-    1 /* h    */, 1 /* i    */, 1 /* j    */, 1 /* k    */,
+  1 /* h    */, 1 /* i    */, 1 /* j    */, 1 /* k    */,
-    1 /* l    */, 1 /* m    */, 1 /* n    */, 1 /* o    */,
+  1 /* l    */, 1 /* m    */, 1 /* n    */, 1 /* o    */,
-    1 /* p    */, 1 /* q    */, 1 /* r    */, 1 /* s    */,
+  1 /* p    */, 1 /* q    */, 1 /* r    */, 1 /* s    */,
-    1 /* t    */, 1 /* u    */, 1 /* v    */, 1 /* w    */,
+  1 /* t    */, 1 /* u    */, 1 /* v    */, 1 /* w    */,
-    1 /* x    */, 1 /* y    */, 1 /* z    */, 0 /* {    */,
+  1 /* x    */, 1 /* y    */, 1 /* z    */, 0 /* {    */,
-    0 /* |    */, 0 /* }    */, 1 /* ~    */, 0 /* DEL  */,
+  0 /* |    */, 0 /* }    */, 1 /* ~    */, 0 /* DEL  */,
-    0 /* 0x80 */, 0 /* 0x81 */, 0 /* 0x82 */, 0 /* 0x83 */,
+  0 /* 0x80 */, 0 /* 0x81 */, 0 /* 0x82 */, 0 /* 0x83 */,
-    0 /* 0x84 */, 0 /* 0x85 */, 0 /* 0x86 */, 0 /* 0x87 */,
+  0 /* 0x84 */, 0 /* 0x85 */, 0 /* 0x86 */, 0 /* 0x87 */,
-    0 /* 0x88 */, 0 /* 0x89 */, 0 /* 0x8a */, 0 /* 0x8b */,
+  0 /* 0x88 */, 0 /* 0x89 */, 0 /* 0x8a */, 0 /* 0x8b */,
-    0 /* 0x8c */, 0 /* 0x8d */, 0 /* 0x8e */, 0 /* 0x8f */,
+  0 /* 0x8c */, 0 /* 0x8d */, 0 /* 0x8e */, 0 /* 0x8f */,
-    0 /* 0x90 */, 0 /* 0x91 */, 0 /* 0x92 */, 0 /* 0x93 */,
+  0 /* 0x90 */, 0 /* 0x91 */, 0 /* 0x92 */, 0 /* 0x93 */,
-    0 /* 0x94 */, 0 /* 0x95 */, 0 /* 0x96 */, 0 /* 0x97 */,
+  0 /* 0x94 */, 0 /* 0x95 */, 0 /* 0x96 */, 0 /* 0x97 */,
-    0 /* 0x98 */, 0 /* 0x99 */, 0 /* 0x9a */, 0 /* 0x9b */,
+  0 /* 0x98 */, 0 /* 0x99 */, 0 /* 0x9a */, 0 /* 0x9b */,
-    0 /* 0x9c */, 0 /* 0x9d */, 0 /* 0x9e */, 0 /* 0x9f */,
+  0 /* 0x9c */, 0 /* 0x9d */, 0 /* 0x9e */, 0 /* 0x9f */,
-    0 /* 0xa0 */, 0 /* 0xa1 */, 0 /* 0xa2 */, 0 /* 0xa3 */,
+  0 /* 0xa0 */, 0 /* 0xa1 */, 0 /* 0xa2 */, 0 /* 0xa3 */,
-    0 /* 0xa4 */, 0 /* 0xa5 */, 0 /* 0xa6 */, 0 /* 0xa7 */,
+  0 /* 0xa4 */, 0 /* 0xa5 */, 0 /* 0xa6 */, 0 /* 0xa7 */,
-    0 /* 0xa8 */, 0 /* 0xa9 */, 0 /* 0xaa */, 0 /* 0xab */,
+  0 /* 0xa8 */, 0 /* 0xa9 */, 0 /* 0xaa */, 0 /* 0xab */,
-    0 /* 0xac */, 0 /* 0xad */, 0 /* 0xae */, 0 /* 0xaf */,
+  0 /* 0xac */, 0 /* 0xad */, 0 /* 0xae */, 0 /* 0xaf */,
-    0 /* 0xb0 */, 0 /* 0xb1 */, 0 /* 0xb2 */, 0 /* 0xb3 */,
+  0 /* 0xb0 */, 0 /* 0xb1 */, 0 /* 0xb2 */, 0 /* 0xb3 */,
-    0 /* 0xb4 */, 0 /* 0xb5 */, 0 /* 0xb6 */, 0 /* 0xb7 */,
+  0 /* 0xb4 */, 0 /* 0xb5 */, 0 /* 0xb6 */, 0 /* 0xb7 */,
-    0 /* 0xb8 */, 0 /* 0xb9 */, 0 /* 0xba */, 0 /* 0xbb */,
+  0 /* 0xb8 */, 0 /* 0xb9 */, 0 /* 0xba */, 0 /* 0xbb */,
-    0 /* 0xbc */, 0 /* 0xbd */, 0 /* 0xbe */, 0 /* 0xbf */,
+  0 /* 0xbc */, 0 /* 0xbd */, 0 /* 0xbe */, 0 /* 0xbf */,
-    0 /* 0xc0 */, 0 /* 0xc1 */, 0 /* 0xc2 */, 0 /* 0xc3 */,
+  0 /* 0xc0 */, 0 /* 0xc1 */, 0 /* 0xc2 */, 0 /* 0xc3 */,
-    0 /* 0xc4 */, 0 /* 0xc5 */, 0 /* 0xc6 */, 0 /* 0xc7 */,
+  0 /* 0xc4 */, 0 /* 0xc5 */, 0 /* 0xc6 */, 0 /* 0xc7 */,
-    0 /* 0xc8 */, 0 /* 0xc9 */, 0 /* 0xca */, 0 /* 0xcb */,
+  0 /* 0xc8 */, 0 /* 0xc9 */, 0 /* 0xca */, 0 /* 0xcb */,
-    0 /* 0xcc */, 0 /* 0xcd */, 0 /* 0xce */, 0 /* 0xcf */,
+  0 /* 0xcc */, 0 /* 0xcd */, 0 /* 0xce */, 0 /* 0xcf */,
-    0 /* 0xd0 */, 0 /* 0xd1 */, 0 /* 0xd2 */, 0 /* 0xd3 */,
+  0 /* 0xd0 */, 0 /* 0xd1 */, 0 /* 0xd2 */, 0 /* 0xd3 */,
-    0 /* 0xd4 */, 0 /* 0xd5 */, 0 /* 0xd6 */, 0 /* 0xd7 */,
+  0 /* 0xd4 */, 0 /* 0xd5 */, 0 /* 0xd6 */, 0 /* 0xd7 */,
-    0 /* 0xd8 */, 0 /* 0xd9 */, 0 /* 0xda */, 0 /* 0xdb */,
+  0 /* 0xd8 */, 0 /* 0xd9 */, 0 /* 0xda */, 0 /* 0xdb */,
-    0 /* 0xdc */, 0 /* 0xdd */, 0 /* 0xde */, 0 /* 0xdf */,
+  0 /* 0xdc */, 0 /* 0xdd */, 0 /* 0xde */, 0 /* 0xdf */,
-    0 /* 0xe0 */, 0 /* 0xe1 */, 0 /* 0xe2 */, 0 /* 0xe3 */,
+  0 /* 0xe0 */, 0 /* 0xe1 */, 0 /* 0xe2 */, 0 /* 0xe3 */,
-    0 /* 0xe4 */, 0 /* 0xe5 */, 0 /* 0xe6 */, 0 /* 0xe7 */,
+  0 /* 0xe4 */, 0 /* 0xe5 */, 0 /* 0xe6 */, 0 /* 0xe7 */,
-    0 /* 0xe8 */, 0 /* 0xe9 */, 0 /* 0xea */, 0 /* 0xeb */,
+  0 /* 0xe8 */, 0 /* 0xe9 */, 0 /* 0xea */, 0 /* 0xeb */,
-    0 /* 0xec */, 0 /* 0xed */, 0 /* 0xee */, 0 /* 0xef */,
+  0 /* 0xec */, 0 /* 0xed */, 0 /* 0xee */, 0 /* 0xef */,
-    0 /* 0xf0 */, 0 /* 0xf1 */, 0 /* 0xf2 */, 0 /* 0xf3 */,
+  0 /* 0xf0 */, 0 /* 0xf1 */, 0 /* 0xf2 */, 0 /* 0xf3 */,
-    0 /* 0xf4 */, 0 /* 0xf5 */, 0 /* 0xf6 */, 0 /* 0xf7 */,
+  0 /* 0xf4 */, 0 /* 0xf5 */, 0 /* 0xf6 */, 0 /* 0xf7 */,
-    0 /* 0xf8 */, 0 /* 0xf9 */, 0 /* 0xfa */, 0 /* 0xfb */,
+  0 /* 0xf8 */, 0 /* 0xf9 */, 0 /* 0xfa */, 0 /* 0xfb */,
-    0 /* 0xfc */, 0 /* 0xfd */, 0 /* 0xfe */, 0 /* 0xff */
+  0 /* 0xfc */, 0 /* 0xfd */, 0 /* 0xfe */, 0 /* 0xff */
 };
 
 int nghttp2_check_authority(const uint8_t *value, size_t len) {

lib/nghttp2_helper.h

@@ -27,7 +27,7 @@
 
 #ifdef HAVE_CONFIG_H
 #  include <config.h>
-#endif /* HAVE_CONFIG_H */
+#endif /* defined(HAVE_CONFIG_H) */
 
 #include <string.h>
 #include <stddef.h>
@@ -38,33 +38,33 @@
 #define nghttp2_max_def(SUFFIX, T)                                             \
   static inline T nghttp2_max_##SUFFIX(T a, T b) { return a < b ? b : a; }
 
-nghttp2_max_def(int8, int8_t);
+nghttp2_max_def(int8, int8_t)
-nghttp2_max_def(int16, int16_t);
+nghttp2_max_def(int16, int16_t)
-nghttp2_max_def(int32, int32_t);
+nghttp2_max_def(int32, int32_t)
-nghttp2_max_def(int64, int64_t);
+nghttp2_max_def(int64, int64_t)
-nghttp2_max_def(uint8, uint8_t);
+nghttp2_max_def(uint8, uint8_t)
-nghttp2_max_def(uint16, uint16_t);
+nghttp2_max_def(uint16, uint16_t)
-nghttp2_max_def(uint32, uint32_t);
+nghttp2_max_def(uint32, uint32_t)
-nghttp2_max_def(uint64, uint64_t);
+nghttp2_max_def(uint64, uint64_t)
-nghttp2_max_def(size, size_t);
+nghttp2_max_def(size, size_t)
 
 #define nghttp2_min_def(SUFFIX, T)                                             \
   static inline T nghttp2_min_##SUFFIX(T a, T b) { return a < b ? a : b; }
 
-nghttp2_min_def(int8, int8_t);
+nghttp2_min_def(int8, int8_t)
-nghttp2_min_def(int16, int16_t);
+nghttp2_min_def(int16, int16_t)
-nghttp2_min_def(int32, int32_t);
+nghttp2_min_def(int32, int32_t)
-nghttp2_min_def(int64, int64_t);
+nghttp2_min_def(int64, int64_t)
-nghttp2_min_def(uint8, uint8_t);
+nghttp2_min_def(uint8, uint8_t)
-nghttp2_min_def(uint16, uint16_t);
+nghttp2_min_def(uint16, uint16_t)
-nghttp2_min_def(uint32, uint32_t);
+nghttp2_min_def(uint32, uint32_t)
-nghttp2_min_def(uint64, uint64_t);
+nghttp2_min_def(uint64, uint64_t)
-nghttp2_min_def(size, size_t);
+nghttp2_min_def(size, size_t)
 
 #define lstreq(A, B, N) ((sizeof((A)) - 1) == (N) && memcmp((A), (B), (N)) == 0)
 
 #define nghttp2_struct_of(ptr, type, member)                                   \
-  ((type *)(void *)((char *)(ptr)-offsetof(type, member)))
+  ((type *)(void *)((char *)(ptr) - offsetof(type, member)))
 
 /*
  * Copies 2 byte unsigned integer |n| in host byte order to |buf| in
@@ -142,4 +142,4 @@ int nghttp2_should_send_window_update(int32_t local_window_size,
  */
 uint8_t *nghttp2_cpymem(uint8_t *dest, const void *src, size_t len);
 
-#endif /* NGHTTP2_HELPER_H */
+#endif /* !defined(NGHTTP2_HELPER_H) */

lib/nghttp2_http.c

@@ -207,7 +207,6 @@ static int http_request_on_header(nghttp2_stream *stream, nghttp2_hd_nv *nv,
     if (!trailer &&
         /* Do not parse the header field in PUSH_PROMISE. */
         (stream->stream_id & 1) &&
-        (stream->flags & NGHTTP2_STREAM_FLAG_NO_RFC7540_PRIORITIES) &&
         !(stream->http_flags & NGHTTP2_HTTP_FLAG_BAD_PRIORITY)) {
       nghttp2_extpri_from_uint8(&extpri, stream->http_extpri);
       if (nghttp2_http_parse_priority(&extpri, nv->value->base,
@@ -347,6 +346,84 @@ static int lws(const uint8_t *s, size_t n) {
   return 1;
 }
 
+/* Generated by genauthoritychartbl.py, but '@' is not allowed */
+static char VALID_AUTHORITY_CHARS[] = {
+  0 /* NUL  */, 0 /* SOH  */, 0 /* STX  */, 0 /* ETX  */,
+  0 /* EOT  */, 0 /* ENQ  */, 0 /* ACK  */, 0 /* BEL  */,
+  0 /* BS   */, 0 /* HT   */, 0 /* LF   */, 0 /* VT   */,
+  0 /* FF   */, 0 /* CR   */, 0 /* SO   */, 0 /* SI   */,
+  0 /* DLE  */, 0 /* DC1  */, 0 /* DC2  */, 0 /* DC3  */,
+  0 /* DC4  */, 0 /* NAK  */, 0 /* SYN  */, 0 /* ETB  */,
+  0 /* CAN  */, 0 /* EM   */, 0 /* SUB  */, 0 /* ESC  */,
+  0 /* FS   */, 0 /* GS   */, 0 /* RS   */, 0 /* US   */,
+  0 /* SPC  */, 1 /* !    */, 0 /* "    */, 0 /* #    */,
+  1 /* $    */, 1 /* %    */, 1 /* &    */, 1 /* '    */,
+  1 /* (    */, 1 /* )    */, 1 /* *    */, 1 /* +    */,
+  1 /* ,    */, 1 /* -    */, 1 /* .    */, 0 /* /    */,
+  1 /* 0    */, 1 /* 1    */, 1 /* 2    */, 1 /* 3    */,
+  1 /* 4    */, 1 /* 5    */, 1 /* 6    */, 1 /* 7    */,
+  1 /* 8    */, 1 /* 9    */, 1 /* :    */, 1 /* ;    */,
+  0 /* <    */, 1 /* =    */, 0 /* >    */, 0 /* ?    */,
+  0 /* @    */, 1 /* A    */, 1 /* B    */, 1 /* C    */,
+  1 /* D    */, 1 /* E    */, 1 /* F    */, 1 /* G    */,
+  1 /* H    */, 1 /* I    */, 1 /* J    */, 1 /* K    */,
+  1 /* L    */, 1 /* M    */, 1 /* N    */, 1 /* O    */,
+  1 /* P    */, 1 /* Q    */, 1 /* R    */, 1 /* S    */,
+  1 /* T    */, 1 /* U    */, 1 /* V    */, 1 /* W    */,
+  1 /* X    */, 1 /* Y    */, 1 /* Z    */, 1 /* [    */,
+  0 /* \    */, 1 /* ]    */, 0 /* ^    */, 1 /* _    */,
+  0 /* `    */, 1 /* a    */, 1 /* b    */, 1 /* c    */,
+  1 /* d    */, 1 /* e    */, 1 /* f    */, 1 /* g    */,
+  1 /* h    */, 1 /* i    */, 1 /* j    */, 1 /* k    */,
+  1 /* l    */, 1 /* m    */, 1 /* n    */, 1 /* o    */,
+  1 /* p    */, 1 /* q    */, 1 /* r    */, 1 /* s    */,
+  1 /* t    */, 1 /* u    */, 1 /* v    */, 1 /* w    */,
+  1 /* x    */, 1 /* y    */, 1 /* z    */, 0 /* {    */,
+  0 /* |    */, 0 /* }    */, 1 /* ~    */, 0 /* DEL  */,
+  0 /* 0x80 */, 0 /* 0x81 */, 0 /* 0x82 */, 0 /* 0x83 */,
+  0 /* 0x84 */, 0 /* 0x85 */, 0 /* 0x86 */, 0 /* 0x87 */,
+  0 /* 0x88 */, 0 /* 0x89 */, 0 /* 0x8a */, 0 /* 0x8b */,
+  0 /* 0x8c */, 0 /* 0x8d */, 0 /* 0x8e */, 0 /* 0x8f */,
+  0 /* 0x90 */, 0 /* 0x91 */, 0 /* 0x92 */, 0 /* 0x93 */,
+  0 /* 0x94 */, 0 /* 0x95 */, 0 /* 0x96 */, 0 /* 0x97 */,
+  0 /* 0x98 */, 0 /* 0x99 */, 0 /* 0x9a */, 0 /* 0x9b */,
+  0 /* 0x9c */, 0 /* 0x9d */, 0 /* 0x9e */, 0 /* 0x9f */,
+  0 /* 0xa0 */, 0 /* 0xa1 */, 0 /* 0xa2 */, 0 /* 0xa3 */,
+  0 /* 0xa4 */, 0 /* 0xa5 */, 0 /* 0xa6 */, 0 /* 0xa7 */,
+  0 /* 0xa8 */, 0 /* 0xa9 */, 0 /* 0xaa */, 0 /* 0xab */,
+  0 /* 0xac */, 0 /* 0xad */, 0 /* 0xae */, 0 /* 0xaf */,
+  0 /* 0xb0 */, 0 /* 0xb1 */, 0 /* 0xb2 */, 0 /* 0xb3 */,
+  0 /* 0xb4 */, 0 /* 0xb5 */, 0 /* 0xb6 */, 0 /* 0xb7 */,
+  0 /* 0xb8 */, 0 /* 0xb9 */, 0 /* 0xba */, 0 /* 0xbb */,
+  0 /* 0xbc */, 0 /* 0xbd */, 0 /* 0xbe */, 0 /* 0xbf */,
+  0 /* 0xc0 */, 0 /* 0xc1 */, 0 /* 0xc2 */, 0 /* 0xc3 */,
+  0 /* 0xc4 */, 0 /* 0xc5 */, 0 /* 0xc6 */, 0 /* 0xc7 */,
+  0 /* 0xc8 */, 0 /* 0xc9 */, 0 /* 0xca */, 0 /* 0xcb */,
+  0 /* 0xcc */, 0 /* 0xcd */, 0 /* 0xce */, 0 /* 0xcf */,
+  0 /* 0xd0 */, 0 /* 0xd1 */, 0 /* 0xd2 */, 0 /* 0xd3 */,
+  0 /* 0xd4 */, 0 /* 0xd5 */, 0 /* 0xd6 */, 0 /* 0xd7 */,
+  0 /* 0xd8 */, 0 /* 0xd9 */, 0 /* 0xda */, 0 /* 0xdb */,
+  0 /* 0xdc */, 0 /* 0xdd */, 0 /* 0xde */, 0 /* 0xdf */,
+  0 /* 0xe0 */, 0 /* 0xe1 */, 0 /* 0xe2 */, 0 /* 0xe3 */,
+  0 /* 0xe4 */, 0 /* 0xe5 */, 0 /* 0xe6 */, 0 /* 0xe7 */,
+  0 /* 0xe8 */, 0 /* 0xe9 */, 0 /* 0xea */, 0 /* 0xeb */,
+  0 /* 0xec */, 0 /* 0xed */, 0 /* 0xee */, 0 /* 0xef */,
+  0 /* 0xf0 */, 0 /* 0xf1 */, 0 /* 0xf2 */, 0 /* 0xf3 */,
+  0 /* 0xf4 */, 0 /* 0xf5 */, 0 /* 0xf6 */, 0 /* 0xf7 */,
+  0 /* 0xf8 */, 0 /* 0xf9 */, 0 /* 0xfa */, 0 /* 0xfb */,
+  0 /* 0xfc */, 0 /* 0xfd */, 0 /* 0xfe */, 0 /* 0xff */
+};
+
+static int check_authority(const uint8_t *value, size_t len) {
+  const uint8_t *last;
+  for (last = value + len; value != last; ++value) {
+    if (!VALID_AUTHORITY_CHARS[*value]) {
+      return 0;
+    }
+  }
+  return 1;
+}
+
 int nghttp2_http_on_header(nghttp2_session *session, nghttp2_stream *stream,
                            nghttp2_frame *frame, nghttp2_hd_nv *nv,
                            int trailer) {
@@ -388,10 +465,10 @@ int nghttp2_http_on_header(nghttp2_session *session, nghttp2_stream *stream,
   case NGHTTP2_TOKEN__AUTHORITY:
   case NGHTTP2_TOKEN_HOST:
     if (session->server || frame->hd.type == NGHTTP2_PUSH_PROMISE) {
-      rv = nghttp2_check_authority(nv->value->base, nv->value->len);
+      rv = check_authority(nv->value->base, nv->value->len);
     } else if (
-        stream->flags &
+      stream->flags &
-        NGHTTP2_STREAM_FLAG_NO_RFC9113_LEADING_AND_TRAILING_WS_VALIDATION) {
+      NGHTTP2_STREAM_FLAG_NO_RFC9113_LEADING_AND_TRAILING_WS_VALIDATION) {
       rv = nghttp2_check_header_value(nv->value->base, nv->value->len);
     } else {
       rv = nghttp2_check_header_value_rfc9113(nv->value->base, nv->value->len);
@@ -435,7 +512,7 @@ int nghttp2_http_on_header(nghttp2_session *session, nghttp2_stream *stream,
   if (session->server || frame->hd.type == NGHTTP2_PUSH_PROMISE) {
     return http_request_on_header(stream, nv, trailer,
                                   session->server &&
-                                      session->pending_enable_connect_protocol);
+                                    session->pending_enable_connect_protocol);
   }
 
   return http_response_on_header(stream, nv, trailer);
@@ -453,7 +530,7 @@ int nghttp2_http_on_request_headers(nghttp2_stream *stream,
     stream->content_length = -1;
   } else {
     if ((stream->http_flags & NGHTTP2_HTTP_FLAG_REQ_HEADERS) !=
-            NGHTTP2_HTTP_FLAG_REQ_HEADERS ||
+          NGHTTP2_HTTP_FLAG_REQ_HEADERS ||
         (stream->http_flags &
          (NGHTTP2_HTTP_FLAG__AUTHORITY | NGHTTP2_HTTP_FLAG_HOST)) == 0) {
       return -1;
@@ -493,7 +570,7 @@ int nghttp2_http_on_response_headers(nghttp2_stream *stream) {
   }
 
   stream->http_flags =
-      stream->http_flags & (uint32_t)~NGHTTP2_HTTP_FLAG_EXPECT_FINAL_RESPONSE;
+    stream->http_flags & (uint32_t)~NGHTTP2_HTTP_FLAG_EXPECT_FINAL_RESPONSE;
 
   if (!expect_response_body(stream)) {
     stream->content_length = 0;
@@ -582,17 +659,17 @@ void nghttp2_http_record_request_method(nghttp2_stream *stream,
 int nghttp2_http_parse_priority(nghttp2_extpri *dest, const uint8_t *value,
                                 size_t valuelen) {
   nghttp2_extpri pri = *dest;
-  sf_parser sfp;
+  sfparse_parser sfp;
-  sf_vec key;
+  sfparse_vec key;
-  sf_value val;
+  sfparse_value val;
   int rv;
 
-  sf_parser_init(&sfp, value, valuelen);
+  sfparse_parser_init(&sfp, value, valuelen);
 
   for (;;) {
-    rv = sf_parser_dict(&sfp, &key, &val);
+    rv = sfparse_parser_dict(&sfp, &key, &val);
     if (rv != 0) {
-      if (rv == SF_ERR_EOF) {
+      if (rv == SFPARSE_ERR_EOF) {
         break;
       }
 
@@ -605,7 +682,7 @@ int nghttp2_http_parse_priority(nghttp2_extpri *dest, const uint8_t *value,
 
     switch (key.base[0]) {
     case 'i':
-      if (val.type != SF_TYPE_BOOLEAN) {
+      if (val.type != SFPARSE_TYPE_BOOLEAN) {
         return NGHTTP2_ERR_INVALID_ARGUMENT;
       }
 
@@ -613,7 +690,7 @@ int nghttp2_http_parse_priority(nghttp2_extpri *dest, const uint8_t *value,
 
       break;
     case 'u':
-      if (val.type != SF_TYPE_INTEGER ||
+      if (val.type != SFPARSE_TYPE_INTEGER ||
           val.integer < NGHTTP2_EXTPRI_URGENCY_HIGH ||
           NGHTTP2_EXTPRI_URGENCY_LOW < val.integer) {
         return NGHTTP2_ERR_INVALID_ARGUMENT;

lib/nghttp2_http.h

@@ -27,7 +27,7 @@
 
 #ifdef HAVE_CONFIG_H
 #  include <config.h>
-#endif /* HAVE_CONFIG_H */
+#endif /* defined(HAVE_CONFIG_H) */
 
 #include <nghttp2/nghttp2.h>
 #include "nghttp2_session.h"
@@ -97,4 +97,4 @@ void nghttp2_http_record_request_method(nghttp2_stream *stream,
 int nghttp2_http_parse_priority(nghttp2_extpri *dest, const uint8_t *value,
                                 size_t valuelen);
 
-#endif /* NGHTTP2_HTTP_H */
+#endif /* !defined(NGHTTP2_HTTP_H) */

lib/nghttp2_int.h

@@ -27,7 +27,7 @@
 
 #ifdef HAVE_CONFIG_H
 #  include <config.h>
-#endif /* HAVE_CONFIG_H */
+#endif /* defined(HAVE_CONFIG_H) */
 
 #include <nghttp2/nghttp2.h>
 
@@ -52,7 +52,11 @@ typedef enum {
    * Unlike NGHTTP2_ERR_IGN_HTTP_HEADER, this does not invoke
    * nghttp2_on_invalid_header_callback.
    */
-  NGHTTP2_ERR_REMOVE_HTTP_HEADER = -106
+  NGHTTP2_ERR_REMOVE_HTTP_HEADER = -106,
+  /*
+   * Cancel pushed stream.
+   */
+  NGHTTP2_ERR_PUSH_CANCEL = -107,
 } nghttp2_internal_error;
 
-#endif /* NGHTTP2_INT_H */
+#endif /* !defined(NGHTTP2_INT_H) */

lib/nghttp2_map.c

@@ -31,13 +31,13 @@
 
 #include "nghttp2_helper.h"
 
-#define NGHTTP2_INITIAL_TABLE_LENBITS 4
+#define NGHTTP2_INITIAL_HASHBITS 4
 
-void nghttp2_map_init(nghttp2_map *map, nghttp2_mem *mem) {
+void nghttp2_map_init(nghttp2_map *map, uint32_t seed, nghttp2_mem *mem) {
   map->mem = mem;
-  map->tablelen = 0;
+  map->hashbits = 0;
-  map->tablelenbits = 0;
   map->table = NULL;
+  map->seed = seed;
   map->size = 0;
 }
 
@@ -49,33 +49,20 @@ void nghttp2_map_free(nghttp2_map *map) {
   nghttp2_mem_free(map->mem, map->table);
 }
 
-void nghttp2_map_each_free(nghttp2_map *map, int (*func)(void *data, void *ptr),
+int nghttp2_map_each(const nghttp2_map *map, int (*func)(void *data, void *ptr),
-                           void *ptr) {
-  uint32_t i;
-  nghttp2_map_bucket *bkt;
-
-  for (i = 0; i < map->tablelen; ++i) {
-    bkt = &map->table[i];
-
-    if (bkt->data == NULL) {
-      continue;
-    }
-
-    func(bkt->data, ptr);
-  }
-}
-
-int nghttp2_map_each(nghttp2_map *map, int (*func)(void *data, void *ptr),
                      void *ptr) {
   int rv;
-  uint32_t i;
+  size_t i;
   nghttp2_map_bucket *bkt;
+  size_t tablelen;
 
   if (map->size == 0) {
     return 0;
   }
 
-  for (i = 0; i < map->tablelen; ++i) {
+  tablelen = 1u << map->hashbits;
+
+  for (i = 0; i < tablelen; ++i) {
     bkt = &map->table[i];
 
     if (bkt->data == NULL) {
@@ -91,82 +78,70 @@ int nghttp2_map_each(nghttp2_map *map, int (*func)(void *data, void *ptr),
   return 0;
 }
 
-static uint32_t hash(nghttp2_map_key_type key) {
+static size_t map_hash(const nghttp2_map *map, nghttp2_map_key_type key) {
-  return (uint32_t)key * 2654435769u;
+  /* hasher from
+     https://github.com/rust-lang/rustc-hash/blob/dc5c33f1283de2da64d8d7a06401d91aded03ad4/src/lib.rs
+     We do not perform finalization here because we use top bits
+     anyway. */
+  uint32_t h = ((uint32_t)key + map->seed) * 0x93d765dd;
+  return (size_t)((h * 2654435769u) >> (32 - map->hashbits));
 }
 
-static size_t h2idx(uint32_t hash, uint32_t bits) {
+static void map_bucket_swap(nghttp2_map_bucket *a, nghttp2_map_bucket *b) {
-  return hash >> (32 - bits);
+  nghttp2_map_bucket c = *a;
-}
 
-static size_t distance(uint32_t tablelen, uint32_t tablelenbits,
+  *a = *b;
-                       nghttp2_map_bucket *bkt, size_t idx) {
+  *b = c;
-  return (idx - h2idx(bkt->hash, tablelenbits)) & (tablelen - 1);
-}
-
-static void map_bucket_swap(nghttp2_map_bucket *bkt, uint32_t *phash,
-                            nghttp2_map_key_type *pkey, void **pdata) {
-  uint32_t h = bkt->hash;
-  nghttp2_map_key_type key = bkt->key;
-  void *data = bkt->data;
-
-  bkt->hash = *phash;
-  bkt->key = *pkey;
-  bkt->data = *pdata;
-
-  *phash = h;
-  *pkey = key;
-  *pdata = data;
-}
-
-static void map_bucket_set_data(nghttp2_map_bucket *bkt, uint32_t hash,
-                                nghttp2_map_key_type key, void *data) {
-  bkt->hash = hash;
-  bkt->key = key;
-  bkt->data = data;
 }
 
 #ifndef WIN32
-void nghttp2_map_print_distance(nghttp2_map *map) {
+void nghttp2_map_print_distance(const nghttp2_map *map) {
-  uint32_t i;
+  size_t i;
   size_t idx;
   nghttp2_map_bucket *bkt;
+  size_t tablelen;
 
-  for (i = 0; i < map->tablelen; ++i) {
+  if (map->size == 0) {
+    return;
+  }
+
+  tablelen = 1u << map->hashbits;
+
+  for (i = 0; i < tablelen; ++i) {
     bkt = &map->table[i];
 
     if (bkt->data == NULL) {
-      fprintf(stderr, "@%u <EMPTY>\n", i);
+      fprintf(stderr, "@%zu <EMPTY>\n", i);
       continue;
     }
 
-    idx = h2idx(bkt->hash, map->tablelenbits);
+    idx = map_hash(map, bkt->key);
-    fprintf(stderr, "@%u hash=%08x key=%d base=%zu distance=%zu\n", i,
+    fprintf(stderr, "@%zu hash=%zu key=%d base=%zu distance=%u\n", i,
-            bkt->hash, bkt->key, idx,
+            map_hash(map, bkt->key), bkt->key, idx, bkt->psl);
-            distance(map->tablelen, map->tablelenbits, bkt, idx));
   }
 }
-#endif /* !WIN32 */
+#endif /* !defined(WIN32) */
 
-static int insert(nghttp2_map_bucket *table, uint32_t tablelen,
+static int map_insert(nghttp2_map *map, nghttp2_map_key_type key, void *data) {
-                  uint32_t tablelenbits, uint32_t hash,
+  size_t idx = map_hash(map, key);
-                  nghttp2_map_key_type key, void *data) {
+  nghttp2_map_bucket b = {
-  size_t idx = h2idx(hash, tablelenbits);
+    .key = key,
-  size_t d = 0, dd;
+    .data = data,
+  };
   nghttp2_map_bucket *bkt;
+  size_t mask = (1u << map->hashbits) - 1;
 
   for (;;) {
-    bkt = &table[idx];
+    bkt = &map->table[idx];
 
     if (bkt->data == NULL) {
-      map_bucket_set_data(bkt, hash, key, data);
+      *bkt = b;
+      ++map->size;
       return 0;
     }
 
-    dd = distance(tablelen, tablelenbits, bkt, idx);
+    if (b.psl > bkt->psl) {
-    if (d > dd) {
+      map_bucket_swap(bkt, &b);
-      map_bucket_swap(bkt, &hash, &key, &data);
-      d = dd;
     } else if (bkt->key == key) {
       /* TODO This check is just a waste after first swap or if this
          function is called from map_resize.  That said, there is no
@@ -175,42 +150,47 @@ static int insert(nghttp2_map_bucket *table, uint32_t tablelen,
       return NGHTTP2_ERR_INVALID_ARGUMENT;
     }
 
-    ++d;
+    ++b.psl;
-    idx = (idx + 1) & (tablelen - 1);
+    idx = (idx + 1) & mask;
   }
 }
 
-/* new_tablelen must be power of 2 and new_tablelen == (1 <<
+static int map_resize(nghttp2_map *map, size_t new_hashbits) {
-   new_tablelenbits) must hold. */
+  size_t i;
-static int map_resize(nghttp2_map *map, uint32_t new_tablelen,
-                      uint32_t new_tablelenbits) {
-  uint32_t i;
-  nghttp2_map_bucket *new_table;
   nghttp2_map_bucket *bkt;
+  size_t tablelen;
   int rv;
+  nghttp2_map new_map = {
+    .table = nghttp2_mem_calloc(map->mem, 1u << new_hashbits,
+                                sizeof(nghttp2_map_bucket)),
+    .mem = map->mem,
+    .seed = map->seed,
+    .hashbits = new_hashbits,
+  };
   (void)rv;
 
-  new_table =
+  if (new_map.table == NULL) {
-      nghttp2_mem_calloc(map->mem, new_tablelen, sizeof(nghttp2_map_bucket));
-  if (new_table == NULL) {
     return NGHTTP2_ERR_NOMEM;
   }
 
-  for (i = 0; i < map->tablelen; ++i) {
+  if (map->size) {
-    bkt = &map->table[i];
+    tablelen = 1u << map->hashbits;
-    if (bkt->data == NULL) {
-      continue;
-    }
-    rv = insert(new_table, new_tablelen, new_tablelenbits, bkt->hash, bkt->key,
-                bkt->data);
 
-    assert(0 == rv);
+    for (i = 0; i < tablelen; ++i) {
+      bkt = &map->table[i];
+      if (bkt->data == NULL) {
+        continue;
+      }
+
+      rv = map_insert(&new_map, bkt->key, bkt->data);
+
+      assert(0 == rv);
+    }
   }
 
   nghttp2_mem_free(map->mem, map->table);
-  map->tablelen = new_tablelen;
+  map->table = new_map.table;
-  map->tablelenbits = new_tablelenbits;
+  map->hashbits = new_hashbits;
-  map->table = new_table;
 
   return 0;
 }
@@ -220,49 +200,48 @@ int nghttp2_map_insert(nghttp2_map *map, nghttp2_map_key_type key, void *data) {
 
   assert(data);
 
-  /* Load factor is 0.75 */
+  /* Load factor is 7/8 */
-  if ((map->size + 1) * 4 > map->tablelen * 3) {
+  /* Under the very initial condition, that is map->size == 0 and
-    if (map->tablelen) {
+     map->hashbits == 0, 8 > 7 still holds nicely. */
-      rv = map_resize(map, map->tablelen * 2, map->tablelenbits + 1);
+  if ((map->size + 1) * 8 > (1u << map->hashbits) * 7) {
+    if (map->hashbits) {
+      rv = map_resize(map, map->hashbits + 1);
       if (rv != 0) {
         return rv;
       }
     } else {
-      rv = map_resize(map, 1 << NGHTTP2_INITIAL_TABLE_LENBITS,
+      rv = map_resize(map, NGHTTP2_INITIAL_HASHBITS);
-                      NGHTTP2_INITIAL_TABLE_LENBITS);
       if (rv != 0) {
         return rv;
       }
     }
   }
 
-  rv = insert(map->table, map->tablelen, map->tablelenbits, hash(key), key,
+  rv = map_insert(map, key, data);
-              data);
   if (rv != 0) {
     return rv;
   }
-  ++map->size;
+
   return 0;
 }
 
-void *nghttp2_map_find(nghttp2_map *map, nghttp2_map_key_type key) {
+void *nghttp2_map_find(const nghttp2_map *map, nghttp2_map_key_type key) {
-  uint32_t h;
   size_t idx;
   nghttp2_map_bucket *bkt;
-  size_t d = 0;
+  size_t psl = 0;
+  size_t mask;
 
   if (map->size == 0) {
     return NULL;
   }
 
-  h = hash(key);
+  idx = map_hash(map, key);
-  idx = h2idx(h, map->tablelenbits);
+  mask = (1u << map->hashbits) - 1;
 
   for (;;) {
     bkt = &map->table[idx];
 
-    if (bkt->data == NULL ||
+    if (bkt->data == NULL || psl > bkt->psl) {
-        d > distance(map->tablelen, map->tablelenbits, bkt, idx)) {
       return NULL;
     }
 
@@ -270,50 +249,47 @@ void *nghttp2_map_find(nghttp2_map *map, nghttp2_map_key_type key) {
       return bkt->data;
     }
 
-    ++d;
+    ++psl;
-    idx = (idx + 1) & (map->tablelen - 1);
+    idx = (idx + 1) & mask;
   }
 }
 
 int nghttp2_map_remove(nghttp2_map *map, nghttp2_map_key_type key) {
-  uint32_t h;
+  size_t idx;
-  size_t idx, didx;
+  nghttp2_map_bucket *b, *bkt;
-  nghttp2_map_bucket *bkt;
+  size_t psl = 0;
-  size_t d = 0;
+  size_t mask;
 
   if (map->size == 0) {
     return NGHTTP2_ERR_INVALID_ARGUMENT;
   }
 
-  h = hash(key);
+  idx = map_hash(map, key);
-  idx = h2idx(h, map->tablelenbits);
+  mask = (1u << map->hashbits) - 1;
 
   for (;;) {
     bkt = &map->table[idx];
 
-    if (bkt->data == NULL ||
+    if (bkt->data == NULL || psl > bkt->psl) {
-        d > distance(map->tablelen, map->tablelenbits, bkt, idx)) {
       return NGHTTP2_ERR_INVALID_ARGUMENT;
     }
 
     if (bkt->key == key) {
-      map_bucket_set_data(bkt, 0, 0, NULL);
+      b = bkt;
-
+      idx = (idx + 1) & mask;
-      didx = idx;
-      idx = (idx + 1) & (map->tablelen - 1);
 
       for (;;) {
         bkt = &map->table[idx];
-        if (bkt->data == NULL ||
+        if (bkt->data == NULL || bkt->psl == 0) {
-            distance(map->tablelen, map->tablelenbits, bkt, idx) == 0) {
+          b->data = NULL;
           break;
         }
 
-        map->table[didx] = *bkt;
+        --bkt->psl;
-        map_bucket_set_data(bkt, 0, 0, NULL);
+        *b = *bkt;
-        didx = idx;
+        b = bkt;
 
-        idx = (idx + 1) & (map->tablelen - 1);
+        idx = (idx + 1) & mask;
       }
 
       --map->size;
@@ -321,18 +297,18 @@ int nghttp2_map_remove(nghttp2_map *map, nghttp2_map_key_type key) {
       return 0;
     }
 
-    ++d;
+    ++psl;
-    idx = (idx + 1) & (map->tablelen - 1);
+    idx = (idx + 1) & mask;
   }
 }
 
 void nghttp2_map_clear(nghttp2_map *map) {
-  if (map->tablelen == 0) {
+  if (map->size == 0) {
     return;
   }
 
-  memset(map->table, 0, sizeof(*map->table) * map->tablelen);
+  memset(map->table, 0, sizeof(*map->table) * (1u << map->hashbits));
   map->size = 0;
 }
 
-size_t nghttp2_map_size(nghttp2_map *map) { return map->size; }
+size_t nghttp2_map_size(const nghttp2_map *map) { return map->size; }

lib/nghttp2_map.h

@@ -28,7 +28,7 @@
 
 #ifdef HAVE_CONFIG_H
 #  include <config.h>
-#endif /* HAVE_CONFIG_H */
+#endif /* defined(HAVE_CONFIG_H) */
 
 #include <nghttp2/nghttp2.h>
 
@@ -39,7 +39,7 @@
 typedef int32_t nghttp2_map_key_type;
 
 typedef struct nghttp2_map_bucket {
-  uint32_t hash;
+  uint32_t psl;
   nghttp2_map_key_type key;
   void *data;
 } nghttp2_map_bucket;
@@ -47,34 +47,26 @@ typedef struct nghttp2_map_bucket {
 typedef struct nghttp2_map {
   nghttp2_map_bucket *table;
   nghttp2_mem *mem;
+  uint32_t seed;
   size_t size;
-  uint32_t tablelen;
+  size_t hashbits;
-  uint32_t tablelenbits;
 } nghttp2_map;
 
 /*
- * Initializes the map |map|.
+ * nghttp2_map_init initializes the map |map|.
  */
-void nghttp2_map_init(nghttp2_map *map, nghttp2_mem *mem);
+void nghttp2_map_init(nghttp2_map *map, uint32_t seed, nghttp2_mem *mem);
 
 /*
- * Deallocates any resources allocated for |map|. The stored entries
+ * nghttp2_map_free deallocates any resources allocated for |map|.
- * are not freed by this function. Use nghttp2_map_each_free() to free
+ * The stored entries are not freed by this function.  Use
- * each entries.
+ * nghttp2_map_each() to free each entry.
  */
 void nghttp2_map_free(nghttp2_map *map);
 
 /*
- * Deallocates each entries using |func| function and any resources
+ * nghttp2_map_insert inserts the new |data| with the |key| to the map
- * allocated for |map|. The |func| function is responsible for freeing
+ * |map|.
- * given the |data| object. The |ptr| will be passed to the |func| as
- * send argument. The return value of the |func| will be ignored.
- */
-void nghttp2_map_each_free(nghttp2_map *map, int (*func)(void *data, void *ptr),
-                           void *ptr);
-
-/*
- * Inserts the new |data| with the |key| to the map |map|.
  *
  * This function returns 0 if it succeeds, or one of the following
  * negative error codes:
@@ -82,57 +74,56 @@ void nghttp2_map_each_free(nghttp2_map *map, int (*func)(void *data, void *ptr),
  * NGHTTP2_ERR_INVALID_ARGUMENT
  *     The item associated by |key| already exists.
  * NGHTTP2_ERR_NOMEM
- *   Out of memory
+ *     Out of memory
  */
 int nghttp2_map_insert(nghttp2_map *map, nghttp2_map_key_type key, void *data);
 
 /*
- * Returns the data associated by the key |key|.  If there is no such
+ * nghttp2_map_find returns the entry associated by the key |key|.  If
- * data, this function returns NULL.
+ * there is no such entry, this function returns NULL.
  */
-void *nghttp2_map_find(nghttp2_map *map, nghttp2_map_key_type key);
+void *nghttp2_map_find(const nghttp2_map *map, nghttp2_map_key_type key);
 
 /*
- * Removes the data associated by the key |key| from the |map|.  The
+ * nghttp2_map_remove removes the entry associated by the key |key|
- * removed data is not freed by this function.
+ * from the |map|.  The removed entry is not freed by this function.
  *
  * This function returns 0 if it succeeds, or one of the following
  * negative error codes:
  *
  * NGHTTP2_ERR_INVALID_ARGUMENT
- *     The data associated by |key| does not exist.
+ *     The entry associated by |key| does not exist.
  */
 int nghttp2_map_remove(nghttp2_map *map, nghttp2_map_key_type key);
 
 /*
- * Removes all entries from |map|.
+ * nghttp2_map_clear removes all entries from |map|.  The removed
+ * entry is not freed by this function.
  */
 void nghttp2_map_clear(nghttp2_map *map);
 
 /*
- * Returns the number of items stored in the map |map|.
+ * nghttp2_map_size returns the number of items stored in the map
+ * |map|.
  */
-size_t nghttp2_map_size(nghttp2_map *map);
+size_t nghttp2_map_size(const nghttp2_map *map);
 
 /*
- * Applies the function |func| to each data in the |map| with the
+ * nghttp2_map_each applies the function |func| to each entry in the
- * optional user supplied pointer |ptr|.
+ * |map| with the optional user supplied pointer |ptr|.
  *
  * If the |func| returns 0, this function calls the |func| with the
- * next data.  If the |func| returns nonzero, it will not call the
+ * next entry.  If the |func| returns nonzero, it will not call the
  * |func| for further entries and return the return value of the
  * |func| immediately.  Thus, this function returns 0 if all the
  * invocations of the |func| return 0, or nonzero value which the last
  * invocation of |func| returns.
- *
- * Don't use this function to free each data. Use
- * nghttp2_map_each_free() instead.
  */
-int nghttp2_map_each(nghttp2_map *map, int (*func)(void *data, void *ptr),
+int nghttp2_map_each(const nghttp2_map *map, int (*func)(void *data, void *ptr),
                      void *ptr);
 
 #ifndef WIN32
-void nghttp2_map_print_distance(nghttp2_map *map);
+void nghttp2_map_print_distance(const nghttp2_map *map);
-#endif /* !WIN32 */
+#endif /* !defined(WIN32) */
 
-#endif /* NGHTTP2_MAP_H */
+#endif /* !defined(NGHTTP2_MAP_H) */

lib/nghttp2_mem.h

@@ -27,7 +27,7 @@
 
 #ifdef HAVE_CONFIG_H
 #  include <config.h>
-#endif /* HAVE_CONFIG_H */
+#endif /* defined(HAVE_CONFIG_H) */
 
 #include <nghttp2/nghttp2.h>
 
@@ -42,4 +42,4 @@ void nghttp2_mem_free2(nghttp2_free free_func, void *ptr, void *mem_user_data);
 void *nghttp2_mem_calloc(nghttp2_mem *mem, size_t nmemb, size_t size);
 void *nghttp2_mem_realloc(nghttp2_mem *mem, void *ptr, size_t size);
 
-#endif /* NGHTTP2_MEM_H */
+#endif /* !defined(NGHTTP2_MEM_H) */

lib/nghttp2_net.h

@@ -27,28 +27,28 @@
 
 #ifdef HAVE_CONFIG_H
 #  include <config.h>
-#endif /* HAVE_CONFIG_H */
+#endif /* defined(HAVE_CONFIG_H) */
 
 #ifdef HAVE_ARPA_INET_H
 #  include <arpa/inet.h>
-#endif /* HAVE_ARPA_INET_H */
+#endif /* defined(HAVE_ARPA_INET_H) */
 
 #ifdef HAVE_NETINET_IN_H
 #  include <netinet/in.h>
-#endif /* HAVE_NETINET_IN_H */
+#endif /* defined(HAVE_NETINET_IN_H) */
 
 #include <nghttp2/nghttp2.h>
 
-#if defined(WIN32)
+#ifdef WIN32
 /* Windows requires ws2_32 library for ntonl family functions.  We
    define inline functions for those function so that we don't have
    dependency on that lib. */
 
 #  ifdef _MSC_VER
 #    define STIN static __inline
-#  else
+#  else /* !defined(_MSC_VER) */
 #    define STIN static inline
-#  endif
+#  endif /* !defined(_MSC_VER) */
 
 STIN uint32_t htonl(uint32_t hostlong) {
   uint32_t res;
@@ -86,6 +86,6 @@ STIN uint16_t ntohs(uint16_t netshort) {
   return res;
 }
 
-#endif /* WIN32 */
+#endif /* defined(WIN32) */
 
-#endif /* NGHTTP2_NET_H */
+#endif /* !defined(NGHTTP2_NET_H) */

lib/nghttp2_option.c

@@ -132,15 +132,15 @@ void nghttp2_option_set_max_settings(nghttp2_option *option, size_t val) {
 }
 
 void nghttp2_option_set_server_fallback_rfc7540_priorities(
-    nghttp2_option *option, int val) {
+  nghttp2_option *option, int val) {
   option->opt_set_mask |= NGHTTP2_OPT_SERVER_FALLBACK_RFC7540_PRIORITIES;
   option->server_fallback_rfc7540_priorities = val;
 }
 
 void nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation(
-    nghttp2_option *option, int val) {
+  nghttp2_option *option, int val) {
   option->opt_set_mask |=
-      NGHTTP2_OPT_NO_RFC9113_LEADING_AND_TRAILING_WS_VALIDATION;
+    NGHTTP2_OPT_NO_RFC9113_LEADING_AND_TRAILING_WS_VALIDATION;
   option->no_rfc9113_leading_and_trailing_ws_validation = val;
 }
 
@@ -155,3 +155,10 @@ void nghttp2_option_set_max_continuations(nghttp2_option *option, size_t val) {
   option->opt_set_mask |= NGHTTP2_OPT_MAX_CONTINUATIONS;
   option->max_continuations = val;
 }
+
+void nghttp2_option_set_glitch_rate_limit(nghttp2_option *option,
+                                          uint64_t burst, uint64_t rate) {
+  option->opt_set_mask |= NGHTTP2_OPT_GLITCH_RATE_LIMIT;
+  option->glitch_burst = burst;
+  option->glitch_rate = rate;
+}

lib/nghttp2_option.h

@@ -27,7 +27,7 @@
 
 #ifdef HAVE_CONFIG_H
 #  include <config.h>
-#endif /* HAVE_CONFIG_H */
+#endif /* defined(HAVE_CONFIG_H) */
 
 #include <nghttp2/nghttp2.h>
 
@@ -72,6 +72,7 @@ typedef enum {
   NGHTTP2_OPT_NO_RFC9113_LEADING_AND_TRAILING_WS_VALIDATION = 1 << 14,
   NGHTTP2_OPT_STREAM_RESET_RATE_LIMIT = 1 << 15,
   NGHTTP2_OPT_MAX_CONTINUATIONS = 1 << 16,
+  NGHTTP2_OPT_GLITCH_RATE_LIMIT = 1 << 17,
 } nghttp2_option_flag;
 
 /**
@@ -83,6 +84,11 @@ struct nghttp2_option {
    */
   uint64_t stream_reset_burst;
   uint64_t stream_reset_rate;
+  /**
+   * NGHTTP2_OPT_GLITCH_RATE_LIMIT
+   */
+  uint64_t glitch_burst;
+  uint64_t glitch_rate;
   /**
    * NGHTTP2_OPT_MAX_SEND_HEADER_BLOCK_LENGTH
    */
@@ -154,4 +160,4 @@ struct nghttp2_option {
   uint8_t user_recv_ext_types[32];
 };
 
-#endif /* NGHTTP2_OPTION_H */
+#endif /* !defined(NGHTTP2_OPTION_H) */

lib/nghttp2_outbound_item.h

@@ -27,7 +27,7 @@
 
 #ifdef HAVE_CONFIG_H
 #  include <config.h>
-#endif /* HAVE_CONFIG_H */
+#endif /* defined(HAVE_CONFIG_H) */
 
 #include <nghttp2/nghttp2.h>
 #include "nghttp2_frame.h"
@@ -186,4 +186,4 @@ void nghttp2_outbound_queue_pop(nghttp2_outbound_queue *q);
 /* Returns the size of the queue */
 #define nghttp2_outbound_queue_size(Q) ((Q)->n)
 
-#endif /* NGHTTP2_OUTBOUND_ITEM_H */
+#endif /* !defined(NGHTTP2_OUTBOUND_ITEM_H) */

lib/nghttp2_pq.h

@@ -27,7 +27,7 @@
 
 #ifdef HAVE_CONFIG_H
 #  include <config.h>
-#endif /* HAVE_CONFIG_H */
+#endif /* defined(HAVE_CONFIG_H) */
 
 #include <nghttp2/nghttp2.h>
 #include "nghttp2_int.h"
@@ -121,4 +121,4 @@ int nghttp2_pq_each(nghttp2_pq *pq, nghttp2_pq_item_cb fun, void *arg);
  */
 void nghttp2_pq_remove(nghttp2_pq *pq, nghttp2_pq_entry *item);
 
-#endif /* NGHTTP2_PQ_H */
+#endif /* !defined(NGHTTP2_PQ_H) */

lib/nghttp2_priority_spec.h

@@ -27,7 +27,7 @@
 
 #ifdef HAVE_CONFIG_H
 #  include <config.h>
-#endif /* HAVE_CONFIG_H */
+#endif /* defined(HAVE_CONFIG_H) */
 
 #include <nghttp2/nghttp2.h>
 
@@ -39,4 +39,4 @@
  */
 void nghttp2_priority_spec_normalize_weight(nghttp2_priority_spec *pri_spec);
 
-#endif /* NGHTTP2_PRIORITY_SPEC_H */
+#endif /* !defined(NGHTTP2_PRIORITY_SPEC_H) */

lib/nghttp2_queue.c

@@ -46,7 +46,7 @@ void nghttp2_queue_free(nghttp2_queue *queue) {
 
 int nghttp2_queue_push(nghttp2_queue *queue, void *data) {
   nghttp2_queue_cell *new_cell =
-      (nghttp2_queue_cell *)malloc(sizeof(nghttp2_queue_cell));
+    (nghttp2_queue_cell *)malloc(sizeof(nghttp2_queue_cell));
   if (!new_cell) {
     return NGHTTP2_ERR_NOMEM;
   }

lib/nghttp2_queue.h

@@ -27,7 +27,7 @@
 
 #ifdef HAVE_CONFIG_H
 #  include "config.h"
-#endif /* HAVE_CONFIG_H */
+#endif /* defined(HAVE_CONFIG_H) */
 
 #include <nghttp2/nghttp2.h>
 
@@ -48,4 +48,4 @@ void *nghttp2_queue_front(nghttp2_queue *queue);
 void *nghttp2_queue_back(nghttp2_queue *queue);
 int nghttp2_queue_empty(nghttp2_queue *queue);
 
-#endif /* NGHTTP2_QUEUE_H */
+#endif /* !defined(NGHTTP2_QUEUE_H) */

lib/nghttp2_ratelim.h

@@ -27,7 +27,7 @@
 
 #ifdef HAVE_CONFIG_H
 #  include <config.h>
-#endif /* HAVE_CONFIG_H */
+#endif /* defined(HAVE_CONFIG_H) */
 
 #include <nghttp2/nghttp2.h>
 
@@ -54,4 +54,4 @@ void nghttp2_ratelim_update(nghttp2_ratelim *rl, uint64_t tstamp);
    succeeds, or -1. */
 int nghttp2_ratelim_drain(nghttp2_ratelim *rl, uint64_t n);
 
-#endif /* NGHTTP2_RATELIM_H */
+#endif /* !defined(NGHTTP2_RATELIM_H) */

lib/nghttp2_rcbuf.h

@@ -27,7 +27,7 @@
 
 #ifdef HAVE_CONFIG_H
 #  include <config.h>
-#endif /* HAVE_CONFIG_H */
+#endif /* defined(HAVE_CONFIG_H) */
 
 #include <nghttp2/nghttp2.h>
 
@@ -77,4 +77,4 @@ int nghttp2_rcbuf_new2(nghttp2_rcbuf **rcbuf_ptr, const uint8_t *src,
  */
 void nghttp2_rcbuf_del(nghttp2_rcbuf *rcbuf);
 
-#endif /* NGHTTP2_RCBUF_H */
+#endif /* !defined(NGHTTP2_RCBUF_H) */

lib/nghttp2_session.h

@@ -27,7 +27,7 @@
 
 #ifdef HAVE_CONFIG_H
 #  include <config.h>
-#endif /* HAVE_CONFIG_H */
+#endif /* defined(HAVE_CONFIG_H) */
 
 #include <nghttp2/nghttp2.h>
 #include "nghttp2_map.h"
@@ -45,6 +45,8 @@
    preface handling. */
 extern int nghttp2_enable_strict_preface;
 
+extern nghttp2_stream nghttp2_stream_root;
+
 /*
  * Option flags.
  */
@@ -53,8 +55,6 @@ typedef enum {
   NGHTTP2_OPTMASK_NO_RECV_CLIENT_MAGIC = 1 << 1,
   NGHTTP2_OPTMASK_NO_HTTP_MESSAGING = 1 << 2,
   NGHTTP2_OPTMASK_NO_AUTO_PING_ACK = 1 << 3,
-  NGHTTP2_OPTMASK_NO_CLOSED_STREAMS = 1 << 4,
-  NGHTTP2_OPTMASK_SERVER_FALLBACK_RFC7540_PRIORITIES = 1 << 5,
   NGHTTP2_OPTMASK_NO_RFC9113_LEADING_AND_TRAILING_WS_VALIDATION = 1 << 6,
 } nghttp2_optmask;
 
@@ -89,10 +89,6 @@ typedef struct {
 /* The default maximum number of incoming reserved streams */
 #define NGHTTP2_MAX_INCOMING_RESERVED_STREAMS 200
 
-/* Even if we have less SETTINGS_MAX_CONCURRENT_STREAMS than this
-   number, we keep NGHTTP2_MIN_IDLE_STREAMS streams in idle state */
-#define NGHTTP2_MIN_IDLE_STREAMS 16
-
 /* The maximum number of items in outbound queue, which is considered
    as flooding caused by peer.  All frames are not considered here.
    We only consider PING + ACK and SETTINGS + ACK.  This is because
@@ -110,6 +106,10 @@ typedef struct {
 #define NGHTTP2_DEFAULT_STREAM_RESET_BURST 1000
 #define NGHTTP2_DEFAULT_STREAM_RESET_RATE 33
 
+/* The default values for glitch rate limiter. */
+#define NGHTTP2_DEFAULT_GLITCH_BURST 1000
+#define NGHTTP2_DEFAULT_GLITCH_RATE 33
+
 /* The default max number of CONTINUATION frames following an incoming
    HEADER frame. */
 #define NGHTTP2_DEFAULT_MAX_CONTINUATIONS 8
@@ -205,8 +205,6 @@ typedef struct nghttp2_inflight_settings nghttp2_inflight_settings;
 
 struct nghttp2_session {
   nghttp2_map /* <nghttp2_stream*> */ streams;
-  /* root of dependency tree*/
-  nghttp2_stream root;
   /* Queue for outbound urgent frames (PING and SETTINGS) */
   nghttp2_outbound_queue ob_urgent;
   /* Queue for non-DATA frames */
@@ -229,26 +227,14 @@ struct nghttp2_session {
   /* Memory allocator */
   nghttp2_mem mem;
   void *user_data;
-  /* Points to the latest incoming closed stream.  NULL if there is no
-     closed stream.  Only used when session is initialized as
-     server. */
-  nghttp2_stream *closed_stream_head;
-  /* Points to the oldest incoming closed stream.  NULL if there is no
-     closed stream.  Only used when session is initialized as
-     server. */
-  nghttp2_stream *closed_stream_tail;
-  /* Points to the latest idle stream.  NULL if there is no idle
-     stream.  Only used when session is initialized as server .*/
-  nghttp2_stream *idle_stream_head;
-  /* Points to the oldest idle stream.  NULL if there is no idle
-     stream.  Only used when session is initialized as erver. */
-  nghttp2_stream *idle_stream_tail;
   /* Queue of In-flight SETTINGS values.  SETTINGS bearing ACK is not
      considered as in-flight. */
   nghttp2_inflight_settings *inflight_settings_head;
   /* Stream reset rate limiter.  If receiving excessive amount of
      stream resets, GOAWAY will be sent. */
   nghttp2_ratelim stream_reset_ratelim;
+  /* Rate limiter for all kinds of glitches. */
+  nghttp2_ratelim glitch_ratelim;
   /* Sequential number across all streams to process streams in
      FIFO. */
   uint64_t stream_seq;
@@ -276,10 +262,9 @@ struct nghttp2_session {
      |closed_stream_head|.  The current implementation only keeps
      incoming streams and session is initialized as server. */
   size_t num_closed_streams;
-  /* The number of idle streams kept in |streams| hash.  The idle
+  /* The number of idle streams kept in |streams| hash.  The current
-     streams can be accessed through doubly linked list
+     implementation only keeps idle streams if session is initialized
-     |idle_stream_head|.  The current implementation only keeps idle
+     as server. */
-     streams if session is initialized as server. */
   size_t num_idle_streams;
   /* The number of bytes allocated for nvbuf */
   size_t nvbuflen;
@@ -362,8 +347,6 @@ struct nghttp2_session {
   /* Unacked local SETTINGS_NO_RFC7540_PRIORITIES value, which is
      effective before it is acknowledged. */
   uint8_t pending_no_rfc7540_priorities;
-  /* Turn on fallback to RFC 7540 priorities; for server use only. */
-  uint8_t fallback_rfc7540_priorities;
   /* Nonzero if the session is server side. */
   uint8_t server;
   /* Flags indicating GOAWAY is sent and/or received. The flags are
@@ -425,6 +408,13 @@ int nghttp2_session_is_my_stream_id(nghttp2_session *session,
 int nghttp2_session_add_item(nghttp2_session *session,
                              nghttp2_outbound_item *item);
 
+/*
+ * This function wraps around nghttp2_session_add_rst_stream_continue
+ * with continue_without_stream = 1.
+ */
+int nghttp2_session_add_rst_stream(nghttp2_session *session, int32_t stream_id,
+                                   uint32_t error_code);
+
 /*
  * Adds RST_STREAM frame for the stream |stream_id| with the error
  * code |error_code|. This is a convenient function built on top of
@@ -432,7 +422,9 @@ int nghttp2_session_add_item(nghttp2_session *session,
  *
  * This function simply returns 0 without adding RST_STREAM frame if
  * given stream is in NGHTTP2_STREAM_CLOSING state, because multiple
- * RST_STREAM for a stream is redundant.
+ * RST_STREAM for a stream is redundant.  It also returns 0 without
+ * adding the frame if |continue_without_stream| is nonzero, and
+ * stream was already gone.
  *
  * This function returns 0 if it succeeds, or one of the following
  * negative error codes:
@@ -440,8 +432,10 @@ int nghttp2_session_add_item(nghttp2_session *session,
  * NGHTTP2_ERR_NOMEM
  *     Out of memory.
  */
-int nghttp2_session_add_rst_stream(nghttp2_session *session, int32_t stream_id,
+int nghttp2_session_add_rst_stream_continue(nghttp2_session *session,
-                                   uint32_t error_code);
+                                            int32_t stream_id,
+                                            uint32_t error_code,
+                                            int continue_without_stream);
 
 /*
  * Adds PING frame. This is a convenient function built on top of
@@ -527,15 +521,9 @@ int nghttp2_session_add_settings(nghttp2_session *session, uint8_t flags,
  *
  * This function returns a pointer to created new stream object, or
  * NULL.
- *
- * This function adjusts neither the number of closed streams or idle
- * streams.  The caller should manually call
- * nghttp2_session_adjust_closed_stream() or
- * nghttp2_session_adjust_idle_stream() respectively.
  */
 nghttp2_stream *nghttp2_session_open_stream(nghttp2_session *session,
                                             int32_t stream_id, uint8_t flags,
-                                            nghttp2_priority_spec *pri_spec,
                                             nghttp2_stream_state initial_state,
                                             void *stream_user_data);
 
@@ -544,11 +532,6 @@ nghttp2_stream *nghttp2_session_open_stream(nghttp2_session *session,
  * is indicated by the |error_code|. When closing the stream,
  * on_stream_close_callback will be called.
  *
- * If the session is initialized as server and |stream| is incoming
- * stream, stream is just marked closed and this function calls
- * nghttp2_session_keep_closed_stream() with |stream|.  Otherwise,
- * |stream| will be deleted from memory.
- *
  * This function returns 0 if it succeeds, or one the following
  * negative error codes:
  *
@@ -565,63 +548,9 @@ int nghttp2_session_close_stream(nghttp2_session *session, int32_t stream_id,
 /*
  * Deletes |stream| from memory.  After this function returns, stream
  * cannot be accessed.
- *
- * This function returns 0 if it succeeds, or one the following
- * negative error codes:
- *
- * NGHTTP2_ERR_NOMEM
- *     Out of memory
  */
-int nghttp2_session_destroy_stream(nghttp2_session *session,
+void nghttp2_session_destroy_stream(nghttp2_session *session,
-                                   nghttp2_stream *stream);
+                                    nghttp2_stream *stream);
-
-/*
- * Tries to keep incoming closed stream |stream|.  Due to the
- * limitation of maximum number of streams in memory, |stream| is not
- * closed and just deleted from memory (see
- * nghttp2_session_destroy_stream).
- */
-void nghttp2_session_keep_closed_stream(nghttp2_session *session,
-                                        nghttp2_stream *stream);
-
-/*
- * Appends |stream| to linked list |session->idle_stream_head|.  We
- * apply fixed limit for list size.  To fit into that limit, one or
- * more oldest streams are removed from list as necessary.
- */
-void nghttp2_session_keep_idle_stream(nghttp2_session *session,
-                                      nghttp2_stream *stream);
-
-/*
- * Detaches |stream| from idle streams linked list.
- */
-void nghttp2_session_detach_idle_stream(nghttp2_session *session,
-                                        nghttp2_stream *stream);
-
-/*
- * Deletes closed stream to ensure that number of incoming streams
- * including active and closed is in the maximum number of allowed
- * stream.
- *
- * This function returns 0 if it succeeds, or one the following
- * negative error codes:
- *
- * NGHTTP2_ERR_NOMEM
- *     Out of memory
- */
-int nghttp2_session_adjust_closed_stream(nghttp2_session *session);
-
-/*
- * Deletes idle stream to ensure that number of idle streams is in
- * certain limit.
- *
- * This function returns 0 if it succeeds, or one the following
- * negative error codes:
- *
- * NGHTTP2_ERR_NOMEM
- *     Out of memory
- */
-int nghttp2_session_adjust_idle_stream(nghttp2_session *session);
 
 /*
  * If further receptions and transmissions over the stream |stream_id|
@@ -915,24 +844,6 @@ int nghttp2_session_update_local_settings(nghttp2_session *session,
                                           nghttp2_settings_entry *iv,
                                           size_t niv);
 
-/*
- * Re-prioritize |stream|. The new priority specification is
- * |pri_spec|.  Caller must ensure that stream->hd.stream_id !=
- * pri_spec->stream_id.
- *
- * This function does not adjust the number of idle streams.  The
- * caller should call nghttp2_session_adjust_idle_stream() later.
- *
- * This function returns 0 if it succeeds, or one of the following
- * negative error codes:
- *
- * NGHTTP2_ERR_NOMEM
- *     Out of memory
- */
-int nghttp2_session_reprioritize_stream(nghttp2_session *session,
-                                        nghttp2_stream *stream,
-                                        const nghttp2_priority_spec *pri_spec);
-
 /*
  * Terminates current |session| with the |error_code|.  The |reason|
  * is NULL-terminated debug string.
@@ -981,4 +892,4 @@ int nghttp2_session_update_recv_stream_window_size(nghttp2_session *session,
                                                    size_t delta_size,
                                                    int send_window_update);
 
-#endif /* NGHTTP2_SESSION_H */
+#endif /* !defined(NGHTTP2_SESSION_H) */

lib/nghttp2_stream.c

@@ -25,45 +25,17 @@
 #include "nghttp2_stream.h"
 
 #include <assert.h>
-#include <stdio.h>
 
 #include "nghttp2_session.h"
 #include "nghttp2_helper.h"
 #include "nghttp2_debug.h"
 #include "nghttp2_frame.h"
 
-/* Maximum distance between any two stream's cycle in the same
-   priority queue.  Imagine stream A's cycle is A, and stream B's
-   cycle is B, and A < B.  The cycle is unsigned 32 bit integer, it
-   may get overflow.  Because of how we calculate the next cycle
-   value, if B - A is less than or equals to
-   NGHTTP2_MAX_CYCLE_DISTANCE, A and B are in the same scale, in other
-   words, B is really greater than or equal to A.  Otherwise, A is a
-   result of overflow, and it is actually A > B if we consider that
-   fact. */
-#define NGHTTP2_MAX_CYCLE_DISTANCE                                             \
-  ((uint64_t)NGHTTP2_MAX_FRAME_SIZE_MAX * 256 + 255)
-
-static int stream_less(const void *lhsx, const void *rhsx) {
-  const nghttp2_stream *lhs, *rhs;
-
-  lhs = nghttp2_struct_of(lhsx, nghttp2_stream, pq_entry);
-  rhs = nghttp2_struct_of(rhsx, nghttp2_stream, pq_entry);
-
-  if (lhs->cycle == rhs->cycle) {
-    return lhs->seq < rhs->seq;
-  }
-
-  return rhs->cycle - lhs->cycle <= NGHTTP2_MAX_CYCLE_DISTANCE;
-}
-
 void nghttp2_stream_init(nghttp2_stream *stream, int32_t stream_id,
                          uint8_t flags, nghttp2_stream_state initial_state,
-                         int32_t weight, int32_t remote_initial_window_size,
+                         int32_t remote_initial_window_size,
                          int32_t local_initial_window_size,
-                         void *stream_user_data, nghttp2_mem *mem) {
+                         void *stream_user_data) {
-  nghttp2_pq_init(&stream->obq, stream_less, mem);
-
   stream->stream_id = stream_id;
   stream->flags = flags;
   stream->state = initial_state;
@@ -77,428 +49,36 @@ void nghttp2_stream_init(nghttp2_stream *stream, int32_t stream_id,
   stream->recv_reduction = 0;
   stream->window_update_queued = 0;
 
-  stream->dep_prev = NULL;
-  stream->dep_next = NULL;
-  stream->sib_prev = NULL;
-  stream->sib_next = NULL;
-
-  stream->closed_prev = NULL;
   stream->closed_next = NULL;
 
-  stream->weight = weight;
-  stream->sum_dep_weight = 0;
-
   stream->http_flags = NGHTTP2_HTTP_FLAG_NONE;
   stream->content_length = -1;
   stream->recv_content_length = 0;
   stream->status_code = -1;
 
   stream->queued = 0;
-  stream->descendant_last_cycle = 0;
   stream->cycle = 0;
   stream->pending_penalty = 0;
-  stream->descendant_next_seq = 0;
   stream->seq = 0;
   stream->last_writelen = 0;
 
   stream->extpri = stream->http_extpri = NGHTTP2_EXTPRI_DEFAULT_URGENCY;
 }
 
-void nghttp2_stream_free(nghttp2_stream *stream) {
+void nghttp2_stream_free(nghttp2_stream *stream) { (void)stream; }
-  nghttp2_pq_free(&stream->obq);
-  /* We don't free stream->item.  If it is assigned to aob, then
-     active_outbound_item_reset() will delete it.  Otherwise,
-     nghttp2_stream_close() or session_del() will delete it. */
-}
 
 void nghttp2_stream_shutdown(nghttp2_stream *stream, nghttp2_shut_flag flag) {
   stream->shut_flags = (uint8_t)(stream->shut_flags | flag);
 }
 
-/*
+void nghttp2_stream_attach_item(nghttp2_stream *stream,
- * Returns nonzero if |stream| is active.  This function does not take
+                                nghttp2_outbound_item *item) {
- * into account its descendants.
- */
-static int stream_active(nghttp2_stream *stream) {
-  return stream->item &&
-         (stream->flags & NGHTTP2_STREAM_FLAG_DEFERRED_ALL) == 0;
-}
-
-/*
- * Returns nonzero if |stream| or one of its descendants is active
- */
-static int stream_subtree_active(nghttp2_stream *stream) {
-  return stream_active(stream) || !nghttp2_pq_empty(&stream->obq);
-}
-
-/*
- * Returns next cycle for |stream|.
- */
-static void stream_next_cycle(nghttp2_stream *stream, uint64_t last_cycle) {
-  uint64_t penalty;
-
-  penalty = (uint64_t)stream->last_writelen * NGHTTP2_MAX_WEIGHT +
-            stream->pending_penalty;
-
-  stream->cycle = last_cycle + penalty / (uint32_t)stream->weight;
-  stream->pending_penalty = (uint32_t)(penalty % (uint32_t)stream->weight);
-}
-
-static int stream_obq_push(nghttp2_stream *dep_stream, nghttp2_stream *stream) {
-  int rv;
-
-  for (; dep_stream && !stream->queued;
-       stream = dep_stream, dep_stream = dep_stream->dep_prev) {
-    stream_next_cycle(stream, dep_stream->descendant_last_cycle);
-    stream->seq = dep_stream->descendant_next_seq++;
-
-    DEBUGF("stream: stream=%d obq push cycle=%lu\n", stream->stream_id,
-           stream->cycle);
-
-    DEBUGF("stream: push stream %d to stream %d\n", stream->stream_id,
-           dep_stream->stream_id);
-
-    rv = nghttp2_pq_push(&dep_stream->obq, &stream->pq_entry);
-    if (rv != 0) {
-      return rv;
-    }
-    stream->queued = 1;
-  }
-
-  return 0;
-}
-
-/*
- * Removes |stream| from parent's obq.  If removal of |stream| makes
- * parent's obq empty, and parent is not active, then parent is also
- * removed.  This process is repeated recursively.
- */
-static void stream_obq_remove(nghttp2_stream *stream) {
-  nghttp2_stream *dep_stream;
-
-  dep_stream = stream->dep_prev;
-
-  if (!stream->queued) {
-    return;
-  }
-
-  for (; dep_stream; stream = dep_stream, dep_stream = dep_stream->dep_prev) {
-    DEBUGF("stream: remove stream %d from stream %d\n", stream->stream_id,
-           dep_stream->stream_id);
-
-    nghttp2_pq_remove(&dep_stream->obq, &stream->pq_entry);
-
-    assert(stream->queued);
-
-    stream->queued = 0;
-    stream->cycle = 0;
-    stream->pending_penalty = 0;
-    stream->descendant_last_cycle = 0;
-    stream->last_writelen = 0;
-
-    if (stream_subtree_active(dep_stream)) {
-      return;
-    }
-  }
-}
-
-/*
- * Moves |stream| from |src|'s obq to |dest|'s obq.  Removal from
- * |src|'s obq is just done calling nghttp2_pq_remove(), so it does
- * not recursively remove |src| and ancestors, like
- * stream_obq_remove().
- */
-static int stream_obq_move(nghttp2_stream *dest, nghttp2_stream *src,
-                           nghttp2_stream *stream) {
-  if (!stream->queued) {
-    return 0;
-  }
-
-  DEBUGF("stream: remove stream %d from stream %d (move)\n", stream->stream_id,
-         src->stream_id);
-
-  nghttp2_pq_remove(&src->obq, &stream->pq_entry);
-  stream->queued = 0;
-
-  return stream_obq_push(dest, stream);
-}
-
-void nghttp2_stream_reschedule(nghttp2_stream *stream) {
-  nghttp2_stream *dep_stream;
-
-  assert(stream->queued);
-
-  dep_stream = stream->dep_prev;
-
-  for (; dep_stream; stream = dep_stream, dep_stream = dep_stream->dep_prev) {
-    nghttp2_pq_remove(&dep_stream->obq, &stream->pq_entry);
-
-    stream_next_cycle(stream, dep_stream->descendant_last_cycle);
-    stream->seq = dep_stream->descendant_next_seq++;
-
-    nghttp2_pq_push(&dep_stream->obq, &stream->pq_entry);
-
-    DEBUGF("stream: stream=%d obq resched cycle=%lu\n", stream->stream_id,
-           stream->cycle);
-
-    dep_stream->last_writelen = stream->last_writelen;
-  }
-}
-
-void nghttp2_stream_change_weight(nghttp2_stream *stream, int32_t weight) {
-  nghttp2_stream *dep_stream;
-  uint64_t last_cycle;
-  int32_t old_weight;
-  uint64_t wlen_penalty;
-
-  if (stream->weight == weight) {
-    return;
-  }
-
-  old_weight = stream->weight;
-  stream->weight = weight;
-
-  dep_stream = stream->dep_prev;
-
-  if (!dep_stream) {
-    return;
-  }
-
-  dep_stream->sum_dep_weight += weight - old_weight;
-
-  if (!stream->queued) {
-    return;
-  }
-
-  nghttp2_pq_remove(&dep_stream->obq, &stream->pq_entry);
-
-  wlen_penalty = (uint64_t)stream->last_writelen * NGHTTP2_MAX_WEIGHT;
-
-  /* Compute old stream->pending_penalty we used to calculate
-     stream->cycle */
-  stream->pending_penalty =
-      (uint32_t)((stream->pending_penalty + (uint32_t)old_weight -
-                  (wlen_penalty % (uint32_t)old_weight)) %
-                 (uint32_t)old_weight);
-
-  last_cycle = stream->cycle -
-               (wlen_penalty + stream->pending_penalty) / (uint32_t)old_weight;
-
-  /* Now we have old stream->pending_penalty and new stream->weight in
-     place */
-  stream_next_cycle(stream, last_cycle);
-
-  if (dep_stream->descendant_last_cycle - stream->cycle <=
-      NGHTTP2_MAX_CYCLE_DISTANCE) {
-    stream->cycle = dep_stream->descendant_last_cycle;
-  }
-
-  /* Continue to use same stream->seq */
-
-  nghttp2_pq_push(&dep_stream->obq, &stream->pq_entry);
-
-  DEBUGF("stream: stream=%d obq resched cycle=%lu\n", stream->stream_id,
-         stream->cycle);
-}
-
-static nghttp2_stream *stream_last_sib(nghttp2_stream *stream) {
-  for (; stream->sib_next; stream = stream->sib_next)
-    ;
-
-  return stream;
-}
-
-int32_t nghttp2_stream_dep_distributed_weight(nghttp2_stream *stream,
-                                              int32_t weight) {
-  weight = stream->weight * weight / stream->sum_dep_weight;
-
-  return nghttp2_max_int32(1, weight);
-}
-
-#ifdef STREAM_DEP_DEBUG
-
-static void ensure_inactive(nghttp2_stream *stream) {
-  nghttp2_stream *si;
-
-  if (stream->queued) {
-    fprintf(stderr, "stream(%p)=%d, stream->queued = 1; want 0\n", stream,
-            stream->stream_id);
-    assert(0);
-  }
-
-  if (stream_active(stream)) {
-    fprintf(stderr, "stream(%p)=%d, stream_active(stream) = 1; want 0\n",
-            stream, stream->stream_id);
-    assert(0);
-  }
-
-  if (!nghttp2_pq_empty(&stream->obq)) {
-    fprintf(stderr, "stream(%p)=%d, nghttp2_pq_size() = %zu; want 0\n", stream,
-            stream->stream_id, nghttp2_pq_size(&stream->obq));
-    assert(0);
-  }
-
-  for (si = stream->dep_next; si; si = si->sib_next) {
-    ensure_inactive(si);
-  }
-}
-
-static void check_queued(nghttp2_stream *stream) {
-  nghttp2_stream *si;
-  int queued;
-
-  if (stream->queued) {
-    if (!stream_subtree_active(stream)) {
-      fprintf(stderr,
-              "stream(%p)=%d, stream->queued == 1, but "
-              "stream_active() == %d and nghttp2_pq_size(&stream->obq) = %zu\n",
-              stream, stream->stream_id, stream_active(stream),
-              nghttp2_pq_size(&stream->obq));
-      assert(0);
-    }
-    if (!stream_active(stream)) {
-      queued = 0;
-      for (si = stream->dep_next; si; si = si->sib_next) {
-        if (si->queued) {
-          ++queued;
-        }
-      }
-      if (queued == 0) {
-        fprintf(stderr,
-                "stream(%p)=%d, stream->queued == 1, and "
-                "!stream_active(), but no descendants is queued\n",
-                stream, stream->stream_id);
-        assert(0);
-      }
-    }
-
-    for (si = stream->dep_next; si; si = si->sib_next) {
-      check_queued(si);
-    }
-  } else {
-    if (stream_active(stream) || !nghttp2_pq_empty(&stream->obq)) {
-      fprintf(stderr,
-              "stream(%p) = %d, stream->queued == 0, but "
-              "stream_active(stream) == %d and "
-              "nghttp2_pq_size(&stream->obq) = %zu\n",
-              stream, stream->stream_id, stream_active(stream),
-              nghttp2_pq_size(&stream->obq));
-      assert(0);
-    }
-    for (si = stream->dep_next; si; si = si->sib_next) {
-      ensure_inactive(si);
-    }
-  }
-}
-
-static void check_sum_dep(nghttp2_stream *stream) {
-  nghttp2_stream *si;
-  int32_t n = 0;
-  for (si = stream->dep_next; si; si = si->sib_next) {
-    n += si->weight;
-  }
-  if (n != stream->sum_dep_weight) {
-    fprintf(stderr, "stream(%p)=%d, sum_dep_weight = %d; want %d\n", stream,
-            stream->stream_id, n, stream->sum_dep_weight);
-    assert(0);
-  }
-  for (si = stream->dep_next; si; si = si->sib_next) {
-    check_sum_dep(si);
-  }
-}
-
-static void check_dep_prev(nghttp2_stream *stream) {
-  nghttp2_stream *si;
-  for (si = stream->dep_next; si; si = si->sib_next) {
-    if (si->dep_prev != stream) {
-      fprintf(stderr, "si->dep_prev = %p; want %p\n", si->dep_prev, stream);
-      assert(0);
-    }
-    check_dep_prev(si);
-  }
-}
-
-#endif /* STREAM_DEP_DEBUG */
-
-#ifdef STREAM_DEP_DEBUG
-static void validate_tree(nghttp2_stream *stream) {
-  nghttp2_stream *si;
-
-  if (!stream) {
-    return;
-  }
-
-  for (; stream->dep_prev; stream = stream->dep_prev)
-    ;
-
-  assert(stream->stream_id == 0);
-  assert(!stream->queued);
-
-  fprintf(stderr, "checking...\n");
-  if (nghttp2_pq_empty(&stream->obq)) {
-    fprintf(stderr, "root obq empty\n");
-    for (si = stream->dep_next; si; si = si->sib_next) {
-      ensure_inactive(si);
-    }
-  } else {
-    for (si = stream->dep_next; si; si = si->sib_next) {
-      check_queued(si);
-    }
-  }
-
-  check_sum_dep(stream);
-  check_dep_prev(stream);
-}
-#else  /* !STREAM_DEP_DEBUG */
-static void validate_tree(nghttp2_stream *stream) { (void)stream; }
-#endif /* !STREAM_DEP_DEBUG*/
-
-static int stream_update_dep_on_attach_item(nghttp2_stream *stream) {
-  int rv;
-
-  rv = stream_obq_push(stream->dep_prev, stream);
-  if (rv != 0) {
-    return rv;
-  }
-
-  validate_tree(stream);
-  return 0;
-}
-
-static void stream_update_dep_on_detach_item(nghttp2_stream *stream) {
-  if (nghttp2_pq_empty(&stream->obq)) {
-    stream_obq_remove(stream);
-  }
-
-  validate_tree(stream);
-}
-
-int nghttp2_stream_attach_item(nghttp2_stream *stream,
-                               nghttp2_outbound_item *item) {
-  int rv;
-
   assert((stream->flags & NGHTTP2_STREAM_FLAG_DEFERRED_ALL) == 0);
   assert(stream->item == NULL);
 
   DEBUGF("stream: stream=%d attach item=%p\n", stream->stream_id, item);
 
   stream->item = item;
-
-  if (stream->flags & NGHTTP2_STREAM_FLAG_NO_RFC7540_PRIORITIES) {
-    return 0;
-  }
-
-  rv = stream_update_dep_on_attach_item(stream);
-  if (rv != 0) {
-    /* This may relave stream->queued == 1, but stream->item == NULL.
-       But only consequence of this error is fatal one, and session
-       destruction.  In that execution path, these inconsistency does
-       not matter. */
-    stream->item = NULL;
-    return rv;
-  }
-
-  return 0;
 }
 
 void nghttp2_stream_detach_item(nghttp2_stream *stream) {
@@ -506,12 +86,6 @@ void nghttp2_stream_detach_item(nghttp2_stream *stream) {
 
   stream->item = NULL;
   stream->flags = (uint8_t)(stream->flags & ~NGHTTP2_STREAM_FLAG_DEFERRED_ALL);
-
-  if (stream->flags & NGHTTP2_STREAM_FLAG_NO_RFC7540_PRIORITIES) {
-    return;
-  }
-
-  stream_update_dep_on_detach_item(stream);
 }
 
 void nghttp2_stream_defer_item(nghttp2_stream *stream, uint8_t flags) {
@@ -521,31 +95,16 @@ void nghttp2_stream_defer_item(nghttp2_stream *stream, uint8_t flags) {
          stream->item, flags);
 
   stream->flags |= flags;
-
-  if (stream->flags & NGHTTP2_STREAM_FLAG_NO_RFC7540_PRIORITIES) {
-    return;
-  }
-
-  stream_update_dep_on_detach_item(stream);
 }
 
-int nghttp2_stream_resume_deferred_item(nghttp2_stream *stream, uint8_t flags) {
+void nghttp2_stream_resume_deferred_item(nghttp2_stream *stream,
+                                         uint8_t flags) {
   assert(stream->item);
 
   DEBUGF("stream: stream=%d resume item=%p flags=%02x\n", stream->stream_id,
          stream->item, flags);
 
   stream->flags = (uint8_t)(stream->flags & ~flags);
-
-  if (stream->flags & NGHTTP2_STREAM_FLAG_DEFERRED_ALL) {
-    return 0;
-  }
-
-  if (stream->flags & NGHTTP2_STREAM_FLAG_NO_RFC7540_PRIORITIES) {
-    return 0;
-  }
-
-  return stream_update_dep_on_attach_item(stream);
 }
 
 int nghttp2_stream_check_deferred_item(nghttp2_stream *stream) {
@@ -571,16 +130,16 @@ static int update_initial_window_size(int32_t *window_size_ptr,
 }
 
 int nghttp2_stream_update_remote_initial_window_size(
-    nghttp2_stream *stream, int32_t new_initial_window_size,
+  nghttp2_stream *stream, int32_t new_initial_window_size,
-    int32_t old_initial_window_size) {
+  int32_t old_initial_window_size) {
   return update_initial_window_size(&stream->remote_window_size,
                                     new_initial_window_size,
                                     old_initial_window_size);
 }
 
 int nghttp2_stream_update_local_initial_window_size(
-    nghttp2_stream *stream, int32_t new_initial_window_size,
+  nghttp2_stream *stream, int32_t new_initial_window_size,
-    int32_t old_initial_window_size) {
+  int32_t old_initial_window_size) {
   return update_initial_window_size(&stream->local_window_size,
                                     new_initial_window_size,
                                     old_initial_window_size);
@@ -591,373 +150,11 @@ void nghttp2_stream_promise_fulfilled(nghttp2_stream *stream) {
   stream->flags = (uint8_t)(stream->flags & ~NGHTTP2_STREAM_FLAG_PUSH);
 }
 
-int nghttp2_stream_dep_find_ancestor(nghttp2_stream *stream,
-                                     nghttp2_stream *target) {
-  for (; stream; stream = stream->dep_prev) {
-    if (stream == target) {
-      return 1;
-    }
-  }
-  return 0;
-}
-
-int nghttp2_stream_dep_insert(nghttp2_stream *dep_stream,
-                              nghttp2_stream *stream) {
-  nghttp2_stream *si;
-  int rv;
-
-  DEBUGF("stream: dep_insert dep_stream(%p)=%d, stream(%p)=%d\n", dep_stream,
-         dep_stream->stream_id, stream, stream->stream_id);
-
-  stream->sum_dep_weight = dep_stream->sum_dep_weight;
-  dep_stream->sum_dep_weight = stream->weight;
-
-  if (dep_stream->dep_next) {
-    for (si = dep_stream->dep_next; si; si = si->sib_next) {
-      si->dep_prev = stream;
-      if (si->queued) {
-        rv = stream_obq_move(stream, dep_stream, si);
-        if (rv != 0) {
-          return rv;
-        }
-      }
-    }
-
-    if (stream_subtree_active(stream)) {
-      rv = stream_obq_push(dep_stream, stream);
-      if (rv != 0) {
-        return rv;
-      }
-    }
-
-    stream->dep_next = dep_stream->dep_next;
-  }
-
-  dep_stream->dep_next = stream;
-  stream->dep_prev = dep_stream;
-
-  validate_tree(stream);
-
-  return 0;
-}
-
-static void set_dep_prev(nghttp2_stream *stream, nghttp2_stream *dep) {
-  for (; stream; stream = stream->sib_next) {
-    stream->dep_prev = dep;
-  }
-}
-
-static void link_dep(nghttp2_stream *dep_stream, nghttp2_stream *stream) {
-  dep_stream->dep_next = stream;
-  if (stream) {
-    stream->dep_prev = dep_stream;
-  }
-}
-
-static void link_sib(nghttp2_stream *a, nghttp2_stream *b) {
-  a->sib_next = b;
-  if (b) {
-    b->sib_prev = a;
-  }
-}
-
-static void insert_link_dep(nghttp2_stream *dep_stream,
-                            nghttp2_stream *stream) {
-  nghttp2_stream *sib_next;
-
-  assert(stream->sib_prev == NULL);
-
-  sib_next = dep_stream->dep_next;
-
-  link_sib(stream, sib_next);
-
-  link_dep(dep_stream, stream);
-}
-
-static void unlink_sib(nghttp2_stream *stream) {
-  nghttp2_stream *prev, *next, *dep_next;
-
-  prev = stream->sib_prev;
-  dep_next = stream->dep_next;
-
-  assert(prev);
-
-  if (dep_next) {
-    /*
-     *  prev--stream(--sib_next--...)
-     *         |
-     *        dep_next
-     */
-
-    link_sib(prev, dep_next);
-
-    set_dep_prev(dep_next, stream->dep_prev);
-
-    if (stream->sib_next) {
-      link_sib(stream_last_sib(dep_next), stream->sib_next);
-    }
-  } else {
-    /*
-     *  prev--stream(--sib_next--...)
-     */
-    next = stream->sib_next;
-
-    prev->sib_next = next;
-
-    if (next) {
-      next->sib_prev = prev;
-    }
-  }
-}
-
-static void unlink_dep(nghttp2_stream *stream) {
-  nghttp2_stream *prev, *next, *dep_next;
-
-  prev = stream->dep_prev;
-  dep_next = stream->dep_next;
-
-  assert(prev);
-
-  if (dep_next) {
-    /*
-     * prev
-     *   |
-     * stream(--sib_next--...)
-     *   |
-     * dep_next
-     */
-    link_dep(prev, dep_next);
-
-    set_dep_prev(dep_next, stream->dep_prev);
-
-    if (stream->sib_next) {
-      link_sib(stream_last_sib(dep_next), stream->sib_next);
-    }
-
-  } else if (stream->sib_next) {
-    /*
-     * prev
-     *   |
-     * stream--sib_next
-     */
-    next = stream->sib_next;
-
-    next->sib_prev = NULL;
-
-    link_dep(prev, next);
-  } else {
-    prev->dep_next = NULL;
-  }
-}
-
-void nghttp2_stream_dep_add(nghttp2_stream *dep_stream,
-                            nghttp2_stream *stream) {
-  DEBUGF("stream: dep_add dep_stream(%p)=%d, stream(%p)=%d\n", dep_stream,
-         dep_stream->stream_id, stream, stream->stream_id);
-
-  dep_stream->sum_dep_weight += stream->weight;
-
-  if (dep_stream->dep_next == NULL) {
-    link_dep(dep_stream, stream);
-  } else {
-    insert_link_dep(dep_stream, stream);
-  }
-
-  validate_tree(stream);
-}
-
-int nghttp2_stream_dep_remove(nghttp2_stream *stream) {
-  nghttp2_stream *dep_prev, *si;
-  int32_t sum_dep_weight_delta;
-  int rv;
-
-  DEBUGF("stream: dep_remove stream(%p)=%d\n", stream, stream->stream_id);
-
-  /* Distribute weight of |stream| to direct descendants */
-  sum_dep_weight_delta = -stream->weight;
-
-  for (si = stream->dep_next; si; si = si->sib_next) {
-    si->weight = nghttp2_stream_dep_distributed_weight(stream, si->weight);
-
-    sum_dep_weight_delta += si->weight;
-
-    if (si->queued) {
-      rv = stream_obq_move(stream->dep_prev, stream, si);
-      if (rv != 0) {
-        return rv;
-      }
-    }
-  }
-
-  assert(stream->dep_prev);
-
-  dep_prev = stream->dep_prev;
-
-  dep_prev->sum_dep_weight += sum_dep_weight_delta;
-
-  if (stream->queued) {
-    stream_obq_remove(stream);
-  }
-
-  if (stream->sib_prev) {
-    unlink_sib(stream);
-  } else {
-    unlink_dep(stream);
-  }
-
-  stream->sum_dep_weight = 0;
-
-  stream->dep_prev = NULL;
-  stream->dep_next = NULL;
-  stream->sib_prev = NULL;
-  stream->sib_next = NULL;
-
-  validate_tree(dep_prev);
-
-  return 0;
-}
-
-int nghttp2_stream_dep_insert_subtree(nghttp2_stream *dep_stream,
-                                      nghttp2_stream *stream) {
-  nghttp2_stream *last_sib;
-  nghttp2_stream *dep_next;
-  nghttp2_stream *si;
-  int rv;
-
-  DEBUGF("stream: dep_insert_subtree dep_stream(%p)=%d stream(%p)=%d\n",
-         dep_stream, dep_stream->stream_id, stream, stream->stream_id);
-
-  stream->sum_dep_weight += dep_stream->sum_dep_weight;
-  dep_stream->sum_dep_weight = stream->weight;
-
-  if (dep_stream->dep_next) {
-    dep_next = dep_stream->dep_next;
-
-    link_dep(dep_stream, stream);
-
-    if (stream->dep_next) {
-      last_sib = stream_last_sib(stream->dep_next);
-
-      link_sib(last_sib, dep_next);
-    } else {
-      link_dep(stream, dep_next);
-    }
-
-    for (si = dep_next; si; si = si->sib_next) {
-      si->dep_prev = stream;
-      if (si->queued) {
-        rv = stream_obq_move(stream, dep_stream, si);
-        if (rv != 0) {
-          return rv;
-        }
-      }
-    }
-  } else {
-    link_dep(dep_stream, stream);
-  }
-
-  if (stream_subtree_active(stream)) {
-    rv = stream_obq_push(dep_stream, stream);
-    if (rv != 0) {
-      return rv;
-    }
-  }
-
-  validate_tree(dep_stream);
-
-  return 0;
-}
-
-int nghttp2_stream_dep_add_subtree(nghttp2_stream *dep_stream,
-                                   nghttp2_stream *stream) {
-  int rv;
-
-  DEBUGF("stream: dep_add_subtree dep_stream(%p)=%d stream(%p)=%d\n",
-         dep_stream, dep_stream->stream_id, stream, stream->stream_id);
-
-  dep_stream->sum_dep_weight += stream->weight;
-
-  if (dep_stream->dep_next) {
-    insert_link_dep(dep_stream, stream);
-  } else {
-    link_dep(dep_stream, stream);
-  }
-
-  if (stream_subtree_active(stream)) {
-    rv = stream_obq_push(dep_stream, stream);
-    if (rv != 0) {
-      return rv;
-    }
-  }
-
-  validate_tree(dep_stream);
-
-  return 0;
-}
-
-void nghttp2_stream_dep_remove_subtree(nghttp2_stream *stream) {
-  nghttp2_stream *next, *dep_prev;
-
-  DEBUGF("stream: dep_remove_subtree stream(%p)=%d\n", stream,
-         stream->stream_id);
-
-  assert(stream->dep_prev);
-
-  dep_prev = stream->dep_prev;
-
-  if (stream->sib_prev) {
-    link_sib(stream->sib_prev, stream->sib_next);
-  } else {
-    next = stream->sib_next;
-
-    link_dep(dep_prev, next);
-
-    if (next) {
-      next->sib_prev = NULL;
-    }
-  }
-
-  dep_prev->sum_dep_weight -= stream->weight;
-
-  if (stream->queued) {
-    stream_obq_remove(stream);
-  }
-
-  validate_tree(dep_prev);
-
-  stream->sib_prev = NULL;
-  stream->sib_next = NULL;
-  stream->dep_prev = NULL;
-}
-
-int nghttp2_stream_in_dep_tree(nghttp2_stream *stream) {
-  return stream->dep_prev || stream->dep_next || stream->sib_prev ||
-         stream->sib_next;
-}
-
-nghttp2_outbound_item *
-nghttp2_stream_next_outbound_item(nghttp2_stream *stream) {
-  nghttp2_pq_entry *ent;
-  nghttp2_stream *si;
-
-  for (;;) {
-    if (stream_active(stream)) {
-      /* Update ascendant's descendant_last_cycle here, so that we can
-         assure that new stream is scheduled based on it. */
-      for (si = stream; si->dep_prev; si = si->dep_prev) {
-        si->dep_prev->descendant_last_cycle = si->cycle;
-      }
-      return stream->item;
-    }
-    ent = nghttp2_pq_top(&stream->obq);
-    if (!ent) {
-      return NULL;
-    }
-    stream = nghttp2_struct_of(ent, nghttp2_stream, pq_entry);
-  }
-}
-
 nghttp2_stream_proto_state nghttp2_stream_get_state(nghttp2_stream *stream) {
+  if (stream == &nghttp2_stream_root) {
+    return NGHTTP2_STREAM_STATE_IDLE;
+  }
+
   if (stream->flags & NGHTTP2_STREAM_FLAG_CLOSED) {
     return NGHTTP2_STREAM_STATE_CLOSED;
   }
@@ -988,27 +185,39 @@ nghttp2_stream_proto_state nghttp2_stream_get_state(nghttp2_stream *stream) {
 }
 
 nghttp2_stream *nghttp2_stream_get_parent(nghttp2_stream *stream) {
-  return stream->dep_prev;
+  (void)stream;
+
+  return NULL;
 }
 
 nghttp2_stream *nghttp2_stream_get_next_sibling(nghttp2_stream *stream) {
-  return stream->sib_next;
+  (void)stream;
+
+  return NULL;
 }
 
 nghttp2_stream *nghttp2_stream_get_previous_sibling(nghttp2_stream *stream) {
-  return stream->sib_prev;
+  (void)stream;
+
+  return NULL;
 }
 
 nghttp2_stream *nghttp2_stream_get_first_child(nghttp2_stream *stream) {
-  return stream->dep_next;
+  (void)stream;
+
+  return NULL;
 }
 
 int32_t nghttp2_stream_get_weight(nghttp2_stream *stream) {
-  return stream->weight;
+  (void)stream;
+
+  return NGHTTP2_DEFAULT_WEIGHT;
 }
 
 int32_t nghttp2_stream_get_sum_dependency_weight(nghttp2_stream *stream) {
-  return stream->sum_dep_weight;
+  (void)stream;
+
+  return 0;
 }
 
 int32_t nghttp2_stream_get_stream_id(nghttp2_stream *stream) {