passenger 6.0.20 → 6.0.21

data/src/cxx_supportlib/SecurityKit/Crypto.cpp

@@ -73,18 +73,6 @@ CFDictionaryRef Crypto::createQueryDict(const char *label) {
 	return NULL;
 }
 
-OSStatus Crypto::lookupKeychainItem(const char *label, SecIdentityRef *oIdentity) {
-	OSStatus status = errSecItemNotFound;
-
-	CFDictionaryRef queryDict = createQueryDict(label);
-	if (queryDict) {
-		/* Do we have a match? */
-		status = SecItemCopyMatching(queryDict, (CFTypeRef *) oIdentity);
-		CFRelease(queryDict);
-	}
-	return status;
-}
-
 SecAccessRef Crypto::createAccess(const char *cLabel) {
 	SecAccessRef access = NULL;
 	CFStringRef label = CFStringCreateWithCString(NULL, cLabel, kCFStringEncodingUTF8);
@@ -162,85 +150,6 @@ OSStatus Crypto::copyIdentityFromPKCS12File(const char *cPath,
 	return status;
 }
 
-#if PRE_HIGH_SIERRA
-void Crypto::killKey(const char *cLabel) {
-	SecIdentityRef id = NULL;
-	OSStatus status = lookupKeychainItem(cLabel, &id);
-	if (status != errSecItemNotFound) {
-
-		CFArrayRef itemList = CFArrayCreate(NULL, (const void **) &id, 1, NULL);
-		CFTypeRef keys[]   = { kSecClass,  kSecMatchItemList,  kSecMatchLimit };
-		CFTypeRef values[] = { kSecClassCertificate, itemList, kSecMatchLimitOne };
-
-		CFDictionaryRef dict = CFDictionaryCreate(NULL, keys, values, 3L, NULL, NULL);
-		OSStatus oserr = SecItemDelete(dict);
-		if (oserr) {
-			CFStringRef str = SecCopyErrorMessageString(oserr, NULL);
-			logError(string("Removing Passenger Cert from keychain failed: ") + CFStringGetCStringPtr(str, kCFStringEncodingUTF8) +
-					". Please remove the certificate labeled " + cLabel + " in your keychain.");
-			CFRelease(str);
-		}
-		CFRelease(dict);
-		CFRelease(itemList);
-
-		if(id){
-			CFTypeRef keys2[]   = { kSecClass,  kSecAttrSubjectKeyID,  kSecMatchLimit };
-			CFTypeRef values2[] = { kSecClassKey, id, kSecMatchLimitOne };
-			dict = CFDictionaryCreate(NULL, keys2, values2, 3L, NULL, NULL);
-			oserr = SecItemDelete(dict);
-			if (oserr) {
-				CFStringRef str = SecCopyErrorMessageString(oserr, NULL);
-				logError(string("Removing Passenger private key from keychain failed: ") + CFStringGetCStringPtr(str, kCFStringEncodingUTF8) +
-						 ". Please remove the private key from the certificate labeled " + cLabel + " in your keychain.");
-				CFRelease(str);
-			}
-			CFRelease(dict);
-			CFRelease(id);
-			id = NULL;
-		}
-
-	} else {
-		CFStringRef str = SecCopyErrorMessageString(status, NULL);
-		logError(string("Finding Passenger Cert failed: ") + CFStringGetCStringPtr(str, kCFStringEncodingUTF8) );
-		CFRelease(str);
-	}
-}
-
-bool Crypto::preAuthKey(const char *path, const char *passwd, const char *cLabel) {
-	SecIdentityRef id = NULL;
-	if (lookupKeychainItem(cLabel, &id) == errSecItemNotFound) {
-		OSStatus oserr = SecKeychainSetUserInteractionAllowed(false);
-		if (oserr) {
-			CFStringRef str = SecCopyErrorMessageString(oserr, NULL);
-			logError(string("Disabling GUI Keychain interaction failed: ") + CFStringGetCStringPtr(str, kCFStringEncodingUTF8));
-			CFRelease(str);
-		}
-		oserr = copyIdentityFromPKCS12File(path, passwd, cLabel);
-		bool success = (noErr == oserr);
-		if (!success) {
-			CFStringRef str = SecCopyErrorMessageString(oserr, NULL);
-			logError(string("Pre authorizing the Passenger client certificate failed: ") + CFStringGetCStringPtr(str, kCFStringEncodingUTF8));
-			CFRelease(str);
-		}
-		oserr = SecKeychainSetUserInteractionAllowed(true);
-		if (oserr) {
-			//This is really bad, we should probably ask the user to reboot.
-			CFStringRef str = SecCopyErrorMessageString(oserr, NULL);
-			logError(string("Re-enabling GUI Keychain interaction failed with error: ") + CFStringGetCStringPtr(str, kCFStringEncodingUTF8) +
-					" Please reboot as soon as possible, thanks.");
-			CFRelease(str);
-		}
-		return success;
-	} else {
-		logError(string("Passenger client certificate was found in the keychain unexpectedly, skipping security update check. Please remove the private key from the certificate labeled ") + cLabel + " in your keychain.");
-		if (id) {
-			CFRelease(id);
-		}
-		return false;
-	}
-}
-#endif
-
 bool Crypto::generateRandomChars(unsigned char *rndChars, int rndLen) {
 	FILE *fPtr = fopen("/dev/random", "r");
 	if (fPtr == NULL) {
@@ -546,7 +455,7 @@ bool Crypto::verifySignature(string signaturePubKeyPath, char *signatureChars, i
 
 		CFDataRef signatureRef = CFDataCreateWithBytesNoCopy(NULL, (UInt8*) signatureChars, signatureLen, kCFAllocatorNull);
 
-		CFDataRef dataRef = CFDataCreateWithBytesNoCopy(NULL, (UInt8*) data.c_str(), data.length(), kCFAllocatorNull);
+		CFDataRef dataRef = CFDataCreateWithBytesNoCopy(NULL, reinterpret_cast<const UInt8*>(data.c_str()), data.length(), kCFAllocatorNull);
 
 		CFErrorRef error = NULL;
 		verifier = SecVerifyTransformCreate(rsaPubKey, signatureRef, &error);
@@ -609,7 +518,7 @@ PUBKEY_TYPE Crypto::loadPubKey(const char *filename) {
 	CFArrayRef temparray = NULL;
 	do {
 		url = CFURLCreateFromFileSystemRepresentation(kCFAllocatorDefault,
-													  (UInt8*) filename, strlen(filename), false);
+													  reinterpret_cast<const UInt8*>(filename), strlen(filename), false);
 		if (url == NULL) {
 			logError("CFURLCreateFromFileSystemRepresentation failed.");
 			break;
@@ -655,7 +564,7 @@ PUBKEY_TYPE Crypto::loadPubKey(const char *filename) {
 			CFRelease(str);
 			break;
 		}
-		pubKey = (SecKeyRef) CFArrayGetValueAtIndex(temparray, 0);
+		pubKey = reinterpret_cast<SecKeyRef>(const_cast<void*>(CFArrayGetValueAtIndex(temparray, 0)));
 		CFRetain(pubKey); //bump ref count, now we own this and need to release it eventually
 	} while (0);
 

data/src/cxx_supportlib/SecurityKit/Crypto.h

@@ -90,7 +90,6 @@ private:
 	void logFreeErrorExtended(const StaticString &prefix, CFErrorRef &additional);
 	CFDictionaryRef createQueryDict(const char *label);
 	SecAccessRef createAccess(const char *cLabel);
-	OSStatus lookupKeychainItem(const char *label, SecIdentityRef *oIdentity);
 	OSStatus copyIdentityFromPKCS12File(const char *cPath, const char *cPassword, const char *cLabel);
 	CFDataRef genIV(size_t iv_size);
 	bool getKeyBytes(SecKeyRef cryptokey, void **target, size_t &len);
@@ -110,13 +109,6 @@ public:
 	bool generateAndAppendNonce(string &nonce);
 
 #if BOOST_OS_MACOS
-#if PRE_HIGH_SIERRA
-	/**
-	 * sets the permissions on the certificate so that curl doesn't prompt
-	 */
-	bool preAuthKey(const char *path, const char *passwd, const char *cLabel);
-	void killKey(const char *cLabel);
-#endif
 	bool generateRandomChars(unsigned char *rndChars, int rndLen);
 #endif
 

data/src/cxx_supportlib/ServerKit/Context.h

@@ -83,6 +83,12 @@ public:
 		}
 
 		mbuf_pool.mbuf_block_chunk_size = configStore["mbuf_block_chunk_size"].asUInt();
+		if ((mbuf_pool.mbuf_block_chunk_size - sizeof(struct MemoryKit::mbuf_block)) % alignof(struct MemoryKit::mbuf_block) != 0) {
+			throw RuntimeException("mbuf_block_chunk_size(" +
+								   toString(mbuf_pool.mbuf_block_chunk_size) +
+								   ") - " + toString(sizeof(struct MemoryKit::mbuf_block)) +
+								   " must be a multiple of " + toString(alignof(struct MemoryKit::mbuf_block)));
+		}
 		MemoryKit::mbuf_pool_init(&mbuf_pool);
 	}
 

data/src/cxx_supportlib/ServerKit/Errors.h

@@ -27,7 +27,8 @@
 #define _PASSENGER_SERVER_KIT_ERRORS_H_
 
 #include <cstring>
-#include <ServerKit/http_parser.h>
+#include <ServerKit/llhttp.h>
+#include <ServerKit/llerrors.h>
 
 namespace Passenger {
 namespace ServerKit {
@@ -94,7 +95,7 @@ getErrorDesc(int errcode) {
 		return "The client connection is closed before the request is done processing";
 	default:
 		if (errcode <= HTTP_PARSER_ERRNO_BEGIN) {
-			return http_errno_description((enum http_errno)
+			return llhttp_get_error_description((llhttp_errno_t)
 				(-errcode + HTTP_PARSER_ERRNO_BEGIN));
 		} else {
 			return std::strerror(errcode);

data/src/cxx_supportlib/ServerKit/HttpHeaderParser.h

@@ -32,6 +32,7 @@
 #include <cassert>
 #include <cstring>
 #include <MemoryKit/mbuf.h>
+#include <ServerKit/llhttp.h>
 #include <ServerKit/Context.h>
 #include <ServerKit/HttpRequest.h>
 #include <ServerKit/HttpHeaderParserState.h>
@@ -61,7 +62,7 @@ private:
 	Message *message;
 	psg_pool_t *pool;
 	const MemoryKit::mbuf *currentBuffer;
-	http_method	requestMethod;
+	llhttp_method_t	requestMethod;
 
 	bool validateHeader(const HttpParseRequest &tag, const Header *header) {
 		if (!state->secureMode) {
@@ -118,20 +119,37 @@ private:
 		}
 	}
 
-	static size_t http_parser_execute_and_handle_pause(http_parser *parser,
-		const http_parser_settings *settings, const char *data, size_t len,
-		bool &paused)
+	static size_t http_parser_execute_and_handle_pause(llhttp_t *parser,
+		const char *data, size_t len, bool &paused)
 	{
-		size_t ret = http_parser_execute(parser, settings, data, len);
-		paused = len > 0 && ret != len && HTTP_PARSER_ERRNO(parser) == HPE_PAUSED;
-		if (paused) {
-			http_parser_pause(parser, 0);
-			http_parser_execute(parser, settings, data + len - 1, 1);
+		llhttp_errno_t rc = llhttp_get_errno(parser);
+		switch (rc) {
+		case HPE_PAUSED_UPGRADE:
+			llhttp_resume_after_upgrade(parser);
+			goto happy_path;
+		case HPE_PAUSED:
+			llhttp_resume(parser);
+			goto happy_path;
+		case HPE_OK:
+		happy_path:
+			switch (llhttp_execute(parser, data, len)) {
+			case HPE_PAUSED_H2_UPGRADE:
+			case HPE_PAUSED_UPGRADE:
+			case HPE_PAUSED:
+				paused = true;
+				return (llhttp_get_error_pos(parser) - data);
+			case HPE_OK:
+				return len;
+			default:
+				goto error_path;
+			}
+        default:
+		error_path:
+			return (llhttp_get_error_pos(parser) - data);
 		}
-		return ret;
 	}
 
-	static int _onURL(http_parser *parser, const char *data, size_t len) {
+	static int _onURL(llhttp_t *parser, const char *data, size_t len) {
 		HttpHeaderParser *self = static_cast<HttpHeaderParser *>(parser->data);
 		return self->onURL(MessageType(), data, len);
 	}
@@ -149,11 +167,11 @@ private:
 		return 0;
 	}
 
-	static int onStatus(http_parser *parser, const char *data, size_t len) {
+	static int onStatus(llhttp_t *parser, const char *data, size_t len) {
 		HttpHeaderParser *self = static_cast<HttpHeaderParser *>(parser->data);
-		if (parser->status_code == 100) {
+		if (llhttp_get_status_code(parser) == 100) {
 			self->set100ContinueHttpState(MessageType());
-			http_parser_pause(parser, 1);
+			return HPE_PAUSED;// llhttp_pause(parser); is illegal in a callback
 		}
 		return 0;
 	}
@@ -166,7 +184,7 @@ private:
 		message->httpState = Message::ONEHUNDRED_CONTINUE;
 	}
 
-	static int onHeaderField(http_parser *parser, const char *data, size_t len) {
+	static int onHeaderField(llhttp_t *parser, const char *data, size_t len) {
 		HttpHeaderParser *self = static_cast<HttpHeaderParser *>(parser->data);
 
 		if (self->state->state == HttpHeaderParserState::PARSING_NOT_STARTED
@@ -181,7 +199,7 @@ private:
 			{
 				// Validate previous header and insert into table.
 				if (!self->validateHeader(MessageType(), self->state->currentHeader)) {
-					return 1;
+					return HPE_USER;
 				}
 				self->insertCurrentHeader();
 			}
@@ -217,7 +235,7 @@ private:
 		return 0;
 	}
 
-	static int onHeaderValue(http_parser *parser, const char *data, size_t len) {
+	static int onHeaderValue(llhttp_t *parser, const char *data, size_t len) {
 		HttpHeaderParser *self = static_cast<HttpHeaderParser *>(parser->data);
 
 		if (self->state->state == HttpHeaderParserState::PARSING_FIRST_HEADER_FIELD
@@ -240,7 +258,7 @@ private:
 		return 0;
 	}
 
-	static int onHeadersComplete(http_parser *parser) {
+	static int onHeadersComplete(llhttp_t *parser) {
 		HttpHeaderParser *self = static_cast<HttpHeaderParser *>(parser->data);
 
 		if (self->state->state == HttpHeaderParserState::PARSING_HEADER_VALUE
@@ -248,10 +266,7 @@ private:
 		{
 			// Validate previous header and insert into table.
 			if (!self->validateHeader(MessageType(), self->state->currentHeader)) {
-				// There's a bug in http_parser: even if we return 1 here, it doesn't
-				// set the error flag correctly. We fix that here.
-				self->state->parser.http_errno = HPE_CB_headers_complete;
-				return 1;
+				return -1;// Error
 			}
 			self->insertCurrentHeader();
 		}
@@ -259,8 +274,13 @@ private:
 		self->state->currentHeader = NULL;
 		self->message->httpState = Message::PARSED_HEADERS;
 		self->indexQueryString(MessageType());
-		http_parser_pause(parser, 1);
-		return 0;
+		if (parser->upgrade) {
+			return 2;//Assume absence of body and make llhttp_execute() return HPE_PAUSED_UPGRADE.
+		} else {
+			return HPE_PAUSED;//using llhttp_pause(parser); is illegal in a callback
+		}
+ 		//return 1; Assume that request/response has no body, and proceed to parsing the next message.
+		//return 0; Proceed normally.
 	}
 
 	OXT_FORCE_INLINE
@@ -286,12 +306,28 @@ private:
 
 	OXT_FORCE_INLINE
 	void initializeParser(const HttpParseRequest &tag) {
-		http_parser_init(&state->parser, HTTP_REQUEST);
+		llhttp_settings_t &settings = state->parser_settings;
+		llhttp_settings_init(&settings);
+		settings.on_url = _onURL;
+		settings.on_status = onStatus;
+		settings.on_header_field = onHeaderField;
+		settings.on_header_value = onHeaderValue;
+		settings.on_headers_complete = onHeadersComplete;
+
+		llhttp_init(&state->parser, HTTP_REQUEST, &state->parser_settings);
 	}
 
 	OXT_FORCE_INLINE
 	void initializeParser(const HttpParseResponse &tag) {
-		http_parser_init(&state->parser, HTTP_RESPONSE);
+		llhttp_settings_t &settings = state->parser_settings;
+		llhttp_settings_init(&settings);
+		settings.on_url = _onURL;
+		settings.on_status = onStatus;
+		settings.on_header_field = onHeaderField;
+		settings.on_header_value = onHeaderValue;
+		settings.on_headers_complete = onHeadersComplete;
+
+		llhttp_init(&state->parser, HTTP_RESPONSE, &state->parser_settings);
 	}
 
 	OXT_FORCE_INLINE
@@ -318,8 +354,8 @@ private:
 			contentLength = 0;
 		}
 
-		message->method = (http_method) state->parser.method;
-		httpVersion = state->parser.http_major * 1000 + state->parser.http_minor * 10;
+		message->method = static_cast<llhttp_method_t>(llhttp_get_method(&state->parser));
+		httpVersion = llhttp_get_http_major(&state->parser) * 1000 + llhttp_get_http_minor(&state->parser) * 10;
 
 		if (httpVersion > 1010) {
 			// Maximum supported HTTP version is 1.1
@@ -334,7 +370,7 @@ private:
 		} else if (contentLength > 0 || isChunked) {
 			// There is a request body.
 			message->aux.bodyInfo.contentLength = contentLength;
-			if (state->parser.upgrade) {
+			if (llhttp_get_upgrade(&state->parser)) {
 				message->httpState      = Message::ERROR;
 				message->aux.parseError = UPGRADE_NOT_ALLOWED_WHEN_REQUEST_BODY_EXISTS;
 			} else if (isChunked) {
@@ -346,7 +382,7 @@ private:
 			}
 		} else {
 			// There is no request body.
-			if (!state->parser.upgrade) {
+			if (!llhttp_get_upgrade(&state->parser)) {
 				message->httpState = Message::COMPLETE;
 				P_ASSERT_EQ(message->bodyType, Message::RBT_NO_BODY);
 			} else if (message->method != HTTP_HEAD) {
@@ -357,17 +393,18 @@ private:
 				message->httpState      = Message::ERROR;
 				message->aux.parseError = UPGRADE_NOT_ALLOWED_FOR_HEAD_REQUESTS;
 			}
+			llhttp_finish(&state->parser);
 		}
 	}
 
 	void processParseResult(const HttpParseResponse &tag) {
 		TRACE_POINT();
-		const unsigned int status = state->parser.status_code;
+		const unsigned int status = llhttp_get_status_code(&state->parser);
 		const boost::uint64_t contentLength = state->parser.content_length;
 
-		message->statusCode = state->parser.status_code;
+		message->statusCode = status;
 
-		if (state->parser.upgrade) {
+		if (llhttp_get_upgrade(&state->parser)) {
 			message->httpState = Message::UPGRADED;
 			message->bodyType  = Message::RBT_UPGRADE;
 			message->wantKeepAlive = false;
@@ -392,6 +429,7 @@ private:
 			message->headers.erase(HTTP_CONTENT_LENGTH);
 			message->headers.erase(HTTP_TRANSFER_ENCODING);
 			message->wantKeepAlive = false;
+			llhttp_finish(&state->parser);
 		} else if (requestMethod == HTTP_HEAD
 		 || status / 100 == 1  // status 1xx
 		 || status == 204
@@ -399,25 +437,29 @@ private:
 		{
 			if (status != 100) {
 				message->httpState = Message::COMPLETE;
+				llhttp_finish(&state->parser);
 			} else {
 				message->httpState = Message::ONEHUNDRED_CONTINUE;
 			}
 			message->bodyType = Message::RBT_NO_BODY;
 		} else if (state->parser.flags & F_CHUNKED) {
-			if (contentLength == std::numeric_limits<boost::uint64_t>::max()) {
+			if (state->parser.flags & F_CONTENT_LENGTH) {
+				message->httpState      = Message::ERROR;
+				message->aux.parseError = RESPONSE_CONTAINS_CONTENT_LENGTH_AND_TRANSFER_ENCODING;
+			} else {
 				message->httpState = Message::PARSING_CHUNKED_BODY;
 				message->bodyType  = Message::RBT_CHUNKED;
+			}
+		} else if (state->parser.flags & F_CONTENT_LENGTH) {
+			if (contentLength == 0) {
+				message->httpState = Message::COMPLETE;
+				message->bodyType  = Message::RBT_NO_BODY;
+				llhttp_finish(&state->parser);
 			} else {
-				message->httpState      = Message::ERROR;
-				message->aux.parseError = RESPONSE_CONTAINS_CONTENT_LENGTH_AND_TRANSFER_ENCODING;
+				message->httpState = Message::PARSING_BODY_WITH_LENGTH;
+				message->bodyType  = Message::RBT_CONTENT_LENGTH;
+				message->aux.bodyInfo.contentLength = contentLength;
 			}
-		} else if (contentLength == 0) {
-			message->httpState = Message::COMPLETE;
-			message->bodyType  = Message::RBT_NO_BODY;
-		} else if (contentLength != std::numeric_limits<boost::uint64_t>::max()) {
-			message->httpState = Message::PARSING_BODY_WITH_LENGTH;
-			message->bodyType  = Message::RBT_CONTENT_LENGTH;
-			message->aux.bodyInfo.contentLength = contentLength;
 		} else {
 			message->httpState = Message::PARSING_BODY_UNTIL_EOF;
 			message->bodyType  = Message::RBT_UNTIL_EOF;
@@ -428,7 +470,7 @@ private:
 public:
 	HttpHeaderParser(Context *context, HttpHeaderParserState *_state,
 		Message *_message, psg_pool_t *_pool,
-		enum http_method _requestMethod = HTTP_GET)
+		llhttp_method_t _requestMethod = HTTP_GET)
 		: ctx(context),
 		  state(_state),
 		  message(_message),
@@ -447,31 +489,21 @@ public:
 		TRACE_POINT();
 		P_ASSERT_EQ(message->httpState, Message::PARSING_HEADERS);
 
-		http_parser_settings settings;
 		size_t ret;
 		bool paused;
 
-		settings.on_message_begin = NULL;
-		settings.on_url = _onURL;
-		settings.on_status = onStatus;
-		settings.on_header_field = onHeaderField;
-		settings.on_header_value = onHeaderValue;
-		settings.on_headers_complete = onHeadersComplete;
-		settings.on_body = NULL;
-		settings.on_message_complete = NULL;
-
 		state->parser.data = this;
 		currentBuffer = &buffer;
 		ret = http_parser_execute_and_handle_pause(&state->parser,
-			&settings, buffer.start, buffer.size(), paused);
+			buffer.start, buffer.size(), paused);
 		currentBuffer = NULL;
 
-		if (!state->parser.upgrade && ret != buffer.size() && !paused) {
+		if (!llhttp_get_upgrade(&state->parser) && ret != buffer.size() && !paused || !paused && llhttp_get_errno(&state->parser) != HPE_OK) {
 			UPDATE_TRACE_POINT();
 			message->httpState = Message::ERROR;
-			switch (HTTP_PARSER_ERRNO(&state->parser)) {
-			case HPE_CB_header_field:
-			case HPE_CB_headers_complete:
+			switch (llhttp_get_errno(&state->parser)) {
+			case HPE_CB_HEADER_FIELD_COMPLETE://?? does this match was HPE_CB_header_field in old one
+			case HPE_CB_HEADERS_COMPLETE:
 				switch (state->state) {
 				case HttpHeaderParserState::ERROR_SECURITY_PASSWORD_MISMATCH:
 					message->aux.parseError = SECURITY_PASSWORD_MISMATCH;
@@ -489,20 +521,20 @@ public:
 					goto default_error;
 				}
 				break;
+			case HPE_INVALID_TRANSFER_ENCODING:
 			case HPE_UNEXPECTED_CONTENT_LENGTH:
 				message->aux.parseError = REQUEST_CONTAINS_CONTENT_LENGTH_AND_TRANSFER_ENCODING;
 				break;
 			default:
 				default_error:
-				message->aux.parseError = HTTP_PARSER_ERRNO_BEGIN - HTTP_PARSER_ERRNO(&state->parser);
+				message->aux.parseError = HTTP_PARSER_ERRNO_BEGIN - llhttp_get_errno(&state->parser);
 				break;
 			}
 		} else if (messageHttpStateIndicatesCompletion(MessageType())) {
 			UPDATE_TRACE_POINT();
-			ret++;
-			message->httpMajor = state->parser.http_major;
-			message->httpMinor = state->parser.http_minor;
-			message->wantKeepAlive = http_should_keep_alive(&state->parser);
+			message->httpMajor = llhttp_get_http_major(&state->parser);
+			message->httpMinor = llhttp_get_http_minor(&state->parser);
+			message->wantKeepAlive = llhttp_should_keep_alive(&state->parser);
 			processParseResult(MessageType());
 		}
 

data/src/cxx_supportlib/ServerKit/HttpHeaderParserState.h

@@ -28,6 +28,8 @@
 
 #include <DataStructures/LString.h>
 #include <Algorithms/Hasher.h>
+#include <ServerKit/llhttp.h>
+#include <ServerKit/HeaderTable.h>
 
 namespace Passenger {
 namespace ServerKit {
@@ -49,7 +51,8 @@ struct HttpHeaderParserState {
 
 	State state;
 	bool secureMode;
-	http_parser parser;
+	llhttp_t parser;
+	llhttp_settings_t parser_settings;
 	Header *currentHeader;
 	Hasher hasher;
 };

data/src/cxx_supportlib/ServerKit/HttpRequest.h

@@ -29,7 +29,7 @@
 #include <psg_sysqueue.h>
 #include <boost/cstdint.hpp>
 #include <boost/atomic.hpp>
-#include <ServerKit/http_parser.h>
+#include <ServerKit/llhttp.h>
 #include <ServerKit/Hooks.h>
 #include <ServerKit/Client.h>
 #include <ServerKit/HeaderTable.h>
@@ -99,7 +99,7 @@ public:
 	HttpState httpState: 5;
 	BodyType bodyType: 3;
 
-	http_method method: 5;
+	llhttp_method_t method: 6;
 	bool wantKeepAlive: 1;
 	bool responseBegun: 1;
 	bool detectingNextRequestEarlyReadError: 1;

data/src/cxx_supportlib/ServerKit/HttpServer.h

@@ -376,7 +376,8 @@ private:
 			case Request::ERROR:
 				// Change state so that the response body will be written.
 				req->httpState = Request::COMPLETE;
-				if (req->aux.parseError == HTTP_VERSION_NOT_SUPPORTED) {
+				if ((req->aux.parseError == HTTP_VERSION_NOT_SUPPORTED) ||
+					(req->aux.parseError == HTTP_PARSER_ERRNO_BEGIN - HPE_INVALID_VERSION)) {
 					endWithErrorResponse(&client, &req, 505, "HTTP version not supported\n");
 				} else {
 					endAsBadRequest(&client, &req, getErrorDesc(req->aux.parseError));
@@ -1319,7 +1320,7 @@ public:
 			doc["response_begun"] = req->responseBegun;
 			doc["last_data_receive_time"] = evTimeToJson(req->lastDataReceiveTime, evNow, now);
 			doc["last_data_send_time"] = evTimeToJson(req->lastDataSendTime, evNow, now);
-			doc["method"] = http_method_str(req->method);
+			doc["method"] = llhttp_method_name(req->method);
 			if (req->httpState != Request::ERROR) {
 				if (req->bodyType == Request::RBT_CONTENT_LENGTH) {
 					doc["content_length"] = (Json::Value::UInt64)

data/src/cxx_supportlib/ServerKit/llerrors.h

@@ -0,0 +1,84 @@
+#ifndef INCLUDE_LLERRORS_H_
+#define INCLUDE_LLERRORS_H_
+
+#include <ServerKit/llhttp.h>
+
+inline const char *llhttp_get_error_description(llhttp_errno_t error) {
+	switch (error) {
+	case HPE_OK:
+		return "success";
+	case HPE_INTERNAL:
+		return "encountered unexpected internal state";
+	case HPE_STRICT:
+		return "strict mode assertion failed";
+	case HPE_CR_EXPECTED:
+		return "CR character expected";
+	case HPE_LF_EXPECTED:
+		return "LF character expected";
+	case HPE_UNEXPECTED_CONTENT_LENGTH:
+		return "unexpected content-length header";
+	case HPE_UNEXPECTED_SPACE:
+		return "unexpected space character";
+	case HPE_CLOSED_CONNECTION:
+		return "data received after completed connection: close message";
+	case HPE_INVALID_METHOD:
+		return "invalid HTTP method";
+	case HPE_INVALID_URL:
+		return "invalid URL";
+	case HPE_INVALID_CONSTANT:
+		return "invalid constant string";
+	case HPE_INVALID_VERSION:
+		return "invalid HTTP version";
+	case HPE_INVALID_HEADER_TOKEN:
+		return "invalid character in header";
+	case HPE_INVALID_CONTENT_LENGTH:
+		return "invalid character in content-length header";
+	case HPE_INVALID_CHUNK_SIZE:
+		return "invalid character in chunk size header";
+	case HPE_INVALID_STATUS:
+		return "invalid HTTP status code";
+	case HPE_INVALID_EOF_STATE:
+		return "stream ended at an unexpected time";
+	case HPE_INVALID_TRANSFER_ENCODING:
+		return "request has invalid transfer-encoding";
+	case HPE_PAUSED:
+		return "parser is paused";
+	case HPE_PAUSED_UPGRADE:
+		return "Pause on CONNECT/Upgrade";
+	case HPE_PAUSED_H2_UPGRADE:
+		return "Pause on Http2 CONNECT/Upgrade";
+	case HPE_USER:
+		return "User callback error";
+	case HPE_CB_MESSAGE_BEGIN:
+		return "the on_message_begin callback failed";
+	case HPE_CB_HEADERS_COMPLETE:
+		return "the on_headers_complete callback failed";
+	case HPE_CB_MESSAGE_COMPLETE:
+		return "the on_message_complete callback failed";
+	case HPE_CB_URL_COMPLETE:
+		return "the on_url_complete callback failed";
+	case HPE_CB_STATUS_COMPLETE:
+		return "the on_status_complete callback failed";
+	case HPE_CB_METHOD_COMPLETE:
+		return "the on_method_complete callback failed";
+	case HPE_CB_VERSION_COMPLETE:
+		return "the on_version_complete callback failed";
+	case HPE_CB_HEADER_FIELD_COMPLETE:
+		return "the on_header_field_complete callback failed";
+	case HPE_CB_HEADER_VALUE_COMPLETE:
+		return "the on_header_value_complete callback failed";
+	case HPE_CB_CHUNK_EXTENSION_NAME_COMPLETE:
+		return "the on_chunk_extension_name_complete callback failed";
+	case HPE_CB_CHUNK_EXTENSION_VALUE_COMPLETE:
+		return "the on_chunk_extension_value_complete callback failed";
+	case HPE_CB_CHUNK_HEADER:
+		return "the on_chunk_header callback failed";
+	case HPE_CB_CHUNK_COMPLETE:
+		return "the on_chunk_complete callback failed";
+	case HPE_CB_RESET:
+		return "the on_reset callback failed";
+	default:
+		return "unknown error";
+	}
+}
+#endif