Source file src/net/http/transport.go

     1  // Copyright 2011 The Go Authors. All rights reserved.
     2  // Use of this source code is governed by a BSD-style
     3  // license that can be found in the LICENSE file.
     4  
     5  // HTTP client implementation. See RFC 7230 through 7235.
     6  //
     7  // This is the low-level Transport implementation of RoundTripper.
     8  // The high-level interface is in client.go.
     9  
    10  package http
    11  
    12  import (
    13  	"bufio"
    14  	"context"
    15  	"crypto/tls"
    16  	"errors"
    17  	"fmt"
    18  	"internal/godebug"
    19  	"io"
    20  	"log"
    21  	"maps"
    22  	"math/rand/v2"
    23  	"net"
    24  	"net/http/httptrace"
    25  	"net/http/internal"
    26  	"net/http/internal/ascii"
    27  	"net/http/internal/httpcommon"
    28  	"net/textproto"
    29  	"net/url"
    30  	"reflect"
    31  	"strings"
    32  	"sync"
    33  	"sync/atomic"
    34  	"time"
    35  	_ "unsafe"
    36  
    37  	"golang.org/x/net/http/httpguts"
    38  	"golang.org/x/net/http/httpproxy"
    39  )
    40  
    41  // DefaultTransport is the default implementation of [Transport] and is
    42  // used by [DefaultClient]. It establishes network connections as needed
    43  // and caches them for reuse by subsequent calls. It uses HTTP proxies
    44  // as directed by the environment variables HTTP_PROXY, HTTPS_PROXY
    45  // and NO_PROXY (or the lowercase versions thereof, which take
    46  // precedence over the uppercase versions).
    47  var DefaultTransport RoundTripper = &Transport{
    48  	Proxy: ProxyFromEnvironment,
    49  	DialContext: defaultTransportDialContext(&net.Dialer{
    50  		Timeout:   30 * time.Second,
    51  		KeepAlive: 30 * time.Second,
    52  	}),
    53  	ForceAttemptHTTP2:     true,
    54  	MaxIdleConns:          100,
    55  	IdleConnTimeout:       90 * time.Second,
    56  	TLSHandshakeTimeout:   10 * time.Second,
    57  	ExpectContinueTimeout: 1 * time.Second,
    58  }
    59  
    60  // DefaultMaxIdleConnsPerHost is the default value of [Transport]'s
    61  // MaxIdleConnsPerHost.
    62  const DefaultMaxIdleConnsPerHost = 2
    63  
    64  // Transport is an implementation of [RoundTripper] that supports HTTP,
    65  // HTTPS, and HTTP proxies (for either HTTP or HTTPS with CONNECT).
    66  //
    67  // By default, Transport caches connections for future re-use.
    68  // This may leave many open connections when accessing many hosts.
    69  // This behavior can be managed using [Transport.CloseIdleConnections] method
    70  // and the [Transport.MaxIdleConnsPerHost] and [Transport.DisableKeepAlives] fields.
    71  //
    72  // Transports should be reused instead of created as needed.
    73  // Transports are safe for concurrent use by multiple goroutines.
    74  //
    75  // A Transport is a low-level primitive for making HTTP and HTTPS requests.
    76  // For high-level functionality, such as cookies and redirects, see [Client].
    77  //
    78  // Transport uses HTTP/1.1 for HTTP URLs and either HTTP/1.1 or HTTP/2
    79  // for HTTPS URLs, depending on whether the server supports HTTP/2,
    80  // and how the Transport is configured. The [DefaultTransport] supports HTTP/2.
    81  // To explicitly enable HTTP/2 on a transport, set [Transport.Protocols].
    82  //
    83  // Responses with status codes in the 1xx range are either handled
    84  // automatically (100 expect-continue) or ignored. The one
    85  // exception is HTTP status code 101 (Switching Protocols), which is
    86  // considered a terminal status and returned by [Transport.RoundTrip]. To see the
    87  // ignored 1xx responses, use the httptrace trace package's
    88  // ClientTrace.Got1xxResponse.
    89  //
    90  // Transport only retries a request upon encountering a network error
    91  // if the connection has already been used successfully and if the
    92  // request is idempotent and either has no body or has its [Request.GetBody]
    93  // defined. HTTP requests are considered idempotent if they have HTTP methods
    94  // GET, HEAD, OPTIONS, TRACE, or QUERY; or if their [Header] map contains an
    95  // "Idempotency-Key" or "X-Idempotency-Key" entry. If the idempotency key
    96  // value is a zero-length slice, the request is treated as idempotent but the
    97  // header is not sent on the wire.
    98  type Transport struct {
    99  	pool clientConnPool
   100  
   101  	altMu    sync.Mutex   // guards changing altProto only
   102  	altProto atomic.Value // of nil or map[string]RoundTripper, key is URI scheme
   103  
   104  	// Proxy specifies a function to return a proxy for a given
   105  	// Request. If the function returns a non-nil error, the
   106  	// request is aborted with the provided error.
   107  	//
   108  	// The proxy type is determined by the URL scheme. "http",
   109  	// "https", "socks5", and "socks5h" are supported. If the scheme is empty,
   110  	// "http" is assumed.
   111  	// "socks5" is treated the same as "socks5h".
   112  	//
   113  	// If the proxy URL contains a userinfo subcomponent,
   114  	// the proxy request will pass the username and password
   115  	// in a Proxy-Authorization header.
   116  	//
   117  	// If Proxy is nil or returns a nil *URL, no proxy is used.
   118  	Proxy func(*Request) (*url.URL, error)
   119  
   120  	// OnProxyConnectResponse is called when the Transport gets an HTTP response from
   121  	// a proxy for a CONNECT request. It's called before the check for a 200 OK response.
   122  	// If it returns an error, the request fails with that error.
   123  	OnProxyConnectResponse func(ctx context.Context, proxyURL *url.URL, connectReq *Request, connectRes *Response) error
   124  
   125  	// DialContext specifies the dial function for creating unencrypted TCP connections.
   126  	// If DialContext is nil (and the deprecated Dial below is also nil),
   127  	// then the transport dials using package net.
   128  	//
   129  	// DialContext runs concurrently with calls to RoundTrip.
   130  	// A RoundTrip call that initiates a dial may end up using
   131  	// a connection dialed previously when the earlier connection
   132  	// becomes idle before the later DialContext completes.
   133  	DialContext func(ctx context.Context, network, addr string) (net.Conn, error)
   134  
   135  	// Dial specifies the dial function for creating unencrypted TCP connections.
   136  	//
   137  	// Dial runs concurrently with calls to RoundTrip.
   138  	// A RoundTrip call that initiates a dial may end up using
   139  	// a connection dialed previously when the earlier connection
   140  	// becomes idle before the later Dial completes.
   141  	//
   142  	// Deprecated: Use DialContext instead, which allows the transport
   143  	// to cancel dials as soon as they are no longer needed.
   144  	// If both are set, DialContext takes priority.
   145  	Dial func(network, addr string) (net.Conn, error)
   146  
   147  	// DialTLSContext specifies an optional dial function for creating
   148  	// TLS connections for non-proxied HTTPS requests.
   149  	//
   150  	// If DialTLSContext is nil (and the deprecated DialTLS below is also nil),
   151  	// DialContext and TLSClientConfig are used.
   152  	//
   153  	// If DialTLSContext is set, the Dial and DialContext hooks are not used for HTTPS
   154  	// requests and the TLSClientConfig and TLSHandshakeTimeout
   155  	// are ignored. The returned net.Conn is assumed to already be
   156  	// past the TLS handshake.
   157  	//
   158  	// To support ALPN protocol negotiation, the returned net.Conn should be
   159  	// a *tls.Conn or implement the same ConnectionState method as *tls.Conn.
   160  	DialTLSContext func(ctx context.Context, network, addr string) (net.Conn, error)
   161  
   162  	// DialTLS specifies an optional dial function for creating
   163  	// TLS connections for non-proxied HTTPS requests.
   164  	//
   165  	// Deprecated: Use DialTLSContext instead, which allows the transport
   166  	// to cancel dials as soon as they are no longer needed.
   167  	// If both are set, DialTLSContext takes priority.
   168  	DialTLS func(network, addr string) (net.Conn, error)
   169  
   170  	// TLSClientConfig specifies the TLS configuration to use with
   171  	// tls.Client.
   172  	// If nil, the default configuration is used.
   173  	// If non-nil, HTTP/2 support may not be enabled by default.
   174  	TLSClientConfig *tls.Config
   175  
   176  	// TLSHandshakeTimeout specifies the maximum amount of time to
   177  	// wait for a TLS handshake. Zero means no timeout.
   178  	TLSHandshakeTimeout time.Duration
   179  
   180  	// DisableKeepAlives, if true, disables HTTP keep-alives and
   181  	// will only use the connection to the server for a single
   182  	// HTTP request.
   183  	//
   184  	// This is unrelated to the similarly named TCP keep-alives.
   185  	DisableKeepAlives bool
   186  
   187  	// DisableCompression, if true, prevents the Transport from
   188  	// requesting compression with an "Accept-Encoding: gzip"
   189  	// request header when the Request contains no existing
   190  	// Accept-Encoding value. If the Transport requests gzip on
   191  	// its own and gets a gzipped response, it's transparently
   192  	// decoded in the Response.Body. However, if the user
   193  	// explicitly requested gzip it is not automatically
   194  	// uncompressed.
   195  	DisableCompression bool
   196  
   197  	// MaxIdleConns controls the maximum number of idle (keep-alive)
   198  	// connections across all hosts. Zero means no limit.
   199  	MaxIdleConns int
   200  
   201  	// MaxIdleConnsPerHost, if non-zero, controls the maximum idle
   202  	// (keep-alive) connections to keep per-host. If zero,
   203  	// DefaultMaxIdleConnsPerHost is used.
   204  	MaxIdleConnsPerHost int
   205  
   206  	// MaxConnsPerHost optionally limits the total number of
   207  	// connections per host, including connections in the dialing,
   208  	// active, and idle states. On limit violation, dials will block.
   209  	//
   210  	// Zero means no limit.
   211  	MaxConnsPerHost int
   212  
   213  	// IdleConnTimeout is the maximum amount of time an idle
   214  	// (keep-alive) connection will remain idle before closing
   215  	// itself.
   216  	// Zero means no limit.
   217  	IdleConnTimeout time.Duration
   218  
   219  	// ResponseHeaderTimeout, if non-zero, specifies the amount of
   220  	// time to wait for a server's response headers after fully
   221  	// writing the request (including its body, if any). This
   222  	// time does not include the time to read the response body.
   223  	ResponseHeaderTimeout time.Duration
   224  
   225  	// ExpectContinueTimeout, if non-zero, specifies the amount of
   226  	// time to wait for a server's first response headers after fully
   227  	// writing the request headers if the request has an
   228  	// "Expect: 100-continue" header. Zero means no timeout and
   229  	// causes the body to be sent immediately, without
   230  	// waiting for the server to approve.
   231  	// This time does not include the time to send the request header.
   232  	ExpectContinueTimeout time.Duration
   233  
   234  	// TLSNextProto specifies how the Transport switches to an
   235  	// alternate protocol (such as HTTP/2) after a TLS ALPN
   236  	// protocol negotiation. If Transport dials a TLS connection
   237  	// with a non-empty protocol name and TLSNextProto contains a
   238  	// map entry for that key (such as "h2"), then the func is
   239  	// called with the request's authority (such as "example.com"
   240  	// or "example.com:1234") and the TLS connection. The function
   241  	// must return a RoundTripper that then handles the request.
   242  	// If TLSNextProto is not nil, HTTP/2 support is not enabled
   243  	// automatically.
   244  	//
   245  	// Historically, TLSNextProto was used to disable HTTP/2 support.
   246  	// The Transport.Protocols field now provides a simpler way to do this.
   247  	TLSNextProto map[string]func(authority string, c *tls.Conn) RoundTripper
   248  
   249  	// ProxyConnectHeader optionally specifies headers to send to
   250  	// proxies during CONNECT requests.
   251  	// To set the header dynamically, see GetProxyConnectHeader.
   252  	ProxyConnectHeader Header
   253  
   254  	// GetProxyConnectHeader optionally specifies a func to return
   255  	// headers to send to proxyURL during a CONNECT request to the
   256  	// ip:port target.
   257  	// If it returns an error, the Transport's RoundTrip fails with
   258  	// that error. It can return (nil, nil) to not add headers.
   259  	// If GetProxyConnectHeader is non-nil, ProxyConnectHeader is
   260  	// ignored.
   261  	GetProxyConnectHeader func(ctx context.Context, proxyURL *url.URL, target string) (Header, error)
   262  
   263  	// MaxResponseHeaderBytes specifies a limit on how many
   264  	// response bytes are allowed in the server's response
   265  	// header.
   266  	//
   267  	// Zero means to use a default limit.
   268  	MaxResponseHeaderBytes int64
   269  
   270  	// WriteBufferSize specifies the size of the write buffer used
   271  	// when writing to the transport.
   272  	// If zero, a default (currently 4KB) is used.
   273  	WriteBufferSize int
   274  
   275  	// ReadBufferSize specifies the size of the read buffer used
   276  	// when reading from the transport.
   277  	// If zero, a default (currently 4KB) is used.
   278  	ReadBufferSize int
   279  
   280  	// nextProtoOnce guards initialization of TLSNextProto and
   281  	// h2Transport (via onceSetNextProtoDefaults)
   282  	nextProtoOnce      sync.Once
   283  	closeIdleFunc      closeIdleConnectionser // non-nil if http2 wired up
   284  	h2Transport        *http2Transport
   285  	h2Config           http2ExternalTransportConfig
   286  	h3Transport        http3Transport // non-nil if http3 wired up
   287  	tlsNextProtoWasNil bool           // whether TLSNextProto was nil when the Once fired
   288  
   289  	// ForceAttemptHTTP2 controls whether HTTP/2 is enabled when a non-zero
   290  	// Dial, DialTLS, or DialContext func or TLSClientConfig is provided.
   291  	// By default, use of any those fields conservatively disables HTTP/2.
   292  	// To use a custom dialer or TLS config and still attempt HTTP/2
   293  	// upgrades, set this to true.
   294  	ForceAttemptHTTP2 bool
   295  
   296  	// HTTP2 configures HTTP/2 connections.
   297  	HTTP2 *HTTP2Config
   298  
   299  	// Protocols is the set of protocols supported by the transport.
   300  	//
   301  	// If Protocols includes UnencryptedHTTP2 and does not include HTTP1,
   302  	// the transport will use unencrypted HTTP/2 for requests for http:// URLs.
   303  	//
   304  	// If Protocols is nil, the default is usually HTTP/1 only.
   305  	// If ForceAttemptHTTP2 is true, or if TLSNextProto contains an "h2" entry,
   306  	// the default is HTTP/1 and HTTP/2.
   307  	Protocols *Protocols
   308  }
   309  
   310  func (t *Transport) writeBufferSize() int {
   311  	if t.WriteBufferSize > 0 {
   312  		return t.WriteBufferSize
   313  	}
   314  	return 4 << 10
   315  }
   316  
   317  func (t *Transport) readBufferSize() int {
   318  	if t.ReadBufferSize > 0 {
   319  		return t.ReadBufferSize
   320  	}
   321  	return 4 << 10
   322  }
   323  
   324  func (t *Transport) maxHeaderResponseSize() int64 {
   325  	if t.MaxResponseHeaderBytes > 0 {
   326  		return t.MaxResponseHeaderBytes
   327  	}
   328  	return 10 << 20 // conservative default; same as http2
   329  }
   330  
   331  // Clone returns a deep copy of t's exported fields.
   332  func (t *Transport) Clone() *Transport {
   333  	t.nextProtoOnce.Do(t.onceSetNextProtoDefaults)
   334  	t2 := &Transport{
   335  		Proxy:                  t.Proxy,
   336  		OnProxyConnectResponse: t.OnProxyConnectResponse,
   337  		DialContext:            t.DialContext,
   338  		Dial:                   t.Dial,
   339  		DialTLS:                t.DialTLS,
   340  		DialTLSContext:         t.DialTLSContext,
   341  		TLSHandshakeTimeout:    t.TLSHandshakeTimeout,
   342  		DisableKeepAlives:      t.DisableKeepAlives,
   343  		DisableCompression:     t.DisableCompression,
   344  		MaxIdleConns:           t.MaxIdleConns,
   345  		MaxIdleConnsPerHost:    t.MaxIdleConnsPerHost,
   346  		MaxConnsPerHost:        t.MaxConnsPerHost,
   347  		IdleConnTimeout:        t.IdleConnTimeout,
   348  		ResponseHeaderTimeout:  t.ResponseHeaderTimeout,
   349  		ExpectContinueTimeout:  t.ExpectContinueTimeout,
   350  		ProxyConnectHeader:     t.ProxyConnectHeader.Clone(),
   351  		GetProxyConnectHeader:  t.GetProxyConnectHeader,
   352  		MaxResponseHeaderBytes: t.MaxResponseHeaderBytes,
   353  		ForceAttemptHTTP2:      t.ForceAttemptHTTP2,
   354  		WriteBufferSize:        t.WriteBufferSize,
   355  		ReadBufferSize:         t.ReadBufferSize,
   356  	}
   357  	if t.TLSClientConfig != nil {
   358  		t2.TLSClientConfig = t.TLSClientConfig.Clone()
   359  	}
   360  	if t.HTTP2 != nil {
   361  		t2.HTTP2 = &HTTP2Config{}
   362  		*t2.HTTP2 = *t.HTTP2
   363  	}
   364  	if t.Protocols != nil {
   365  		t2.Protocols = &Protocols{}
   366  		*t2.Protocols = *t.Protocols
   367  	}
   368  	if !t.tlsNextProtoWasNil {
   369  		npm := maps.Clone(t.TLSNextProto)
   370  		if npm == nil {
   371  			npm = make(map[string]func(authority string, c *tls.Conn) RoundTripper)
   372  		}
   373  		t2.TLSNextProto = npm
   374  	}
   375  	return t2
   376  }
   377  
   378  type closeIdleConnectionser interface {
   379  	// CloseIdleConnections is called by Transport.CloseIdleConnections.
   380  	//
   381  	// We expect to use this on transports supplied by x/net/http2 or
   382  	// internal/http3.
   383  	//
   384  	// The transport will close idle connections created with DialClientConn
   385  	// before calling this method. The HTTP/3 transport should not attempt to
   386  	// close idle connections, but may clean up shared resources such as UDP
   387  	// sockets if no connections remain.
   388  	CloseIdleConnections()
   389  }
   390  
   391  func (t *Transport) hasCustomTLSDialer() bool {
   392  	return t.DialTLS != nil || t.DialTLSContext != nil
   393  }
   394  
   395  var http2client = godebug.New("http2client")
   396  
   397  // onceSetNextProtoDefaults initializes TLSNextProto.
   398  // It must be called via t.nextProtoOnce.Do.
   399  func (t *Transport) onceSetNextProtoDefaults() {
   400  	t.tlsNextProtoWasNil = (t.TLSNextProto == nil)
   401  	if http2client.Value() == "0" {
   402  		http2client.IncNonDefault()
   403  		return
   404  	}
   405  
   406  	// If they've already configured http2 with
   407  	// golang.org/x/net/http2 instead of the bundled copy, try to
   408  	// get at its http2.Transport value (via the "https"
   409  	// altproto map) so we can call CloseIdleConnections on it if
   410  	// requested. (Issue 22891)
   411  	altProto, _ := t.altProto.Load().(map[string]RoundTripper)
   412  	if rv := reflect.ValueOf(altProto["https"]); rv.IsValid() && rv.Type().Kind() == reflect.Struct && rv.Type().NumField() == 1 {
   413  		if v := rv.Field(0); v.CanInterface() {
   414  			if h2i, ok := v.Interface().(closeIdleConnectionser); ok {
   415  				t.closeIdleFunc = h2i
   416  				return
   417  			}
   418  		}
   419  	}
   420  
   421  	if _, ok := t.TLSNextProto["h2"]; ok {
   422  		// There's an existing HTTP/2 implementation installed.
   423  		return
   424  	}
   425  	protocols := t.protocols()
   426  	if !protocols.HTTP2() && !protocols.UnencryptedHTTP2() {
   427  		return
   428  	}
   429  	if omitHTTP2Client {
   430  		return
   431  	}
   432  
   433  	t.configureHTTP2(protocols)
   434  }
   435  
   436  func (t *Transport) protocols() Protocols {
   437  	if t.Protocols != nil {
   438  		return *t.Protocols // user-configured set
   439  	}
   440  	var p Protocols
   441  	p.SetHTTP1(true) // default always includes HTTP/1
   442  	switch {
   443  	case t.TLSNextProto != nil:
   444  		// Setting TLSNextProto to an empty map is a documented way
   445  		// to disable HTTP/2 on a Transport.
   446  		if t.TLSNextProto["h2"] != nil {
   447  			p.SetHTTP2(true)
   448  		}
   449  	case !t.ForceAttemptHTTP2 && (t.TLSClientConfig != nil || t.Dial != nil || t.DialContext != nil || t.hasCustomTLSDialer()):
   450  		// Be conservative and don't automatically enable
   451  		// http2 if they've specified a custom TLS config or
   452  		// custom dialers. Let them opt-in themselves via
   453  		// Transport.Protocols.SetHTTP2(true) so we don't surprise them
   454  		// by modifying their tls.Config. Issue 14275.
   455  		// However, if ForceAttemptHTTP2 is true, it overrides the above checks.
   456  	case http2client.Value() == "0":
   457  	default:
   458  		p.SetHTTP2(true)
   459  	}
   460  	return p
   461  }
   462  
   463  // ProxyFromEnvironment returns the URL of the proxy to use for a
   464  // given request, as indicated by the environment variables
   465  // HTTP_PROXY, HTTPS_PROXY and NO_PROXY (or the lowercase versions
   466  // thereof, which take precedence over the uppercase versions).
   467  // Requests use the proxy from the environment variable
   468  // matching their scheme, unless excluded by NO_PROXY.
   469  //
   470  // The environment values may be either a complete URL or a
   471  // "host[:port]", in which case the "http" scheme is assumed.
   472  // An error is returned if the value is a different form.
   473  //
   474  // A nil URL and nil error are returned if no proxy is defined in the
   475  // environment, or a proxy should not be used for the given request,
   476  // as defined by NO_PROXY.
   477  //
   478  // As a special case, if req.URL.Host is "localhost" (with or without
   479  // a port number), then a nil URL and nil error will be returned.
   480  func ProxyFromEnvironment(req *Request) (*url.URL, error) {
   481  	return envProxyFunc()(req.URL)
   482  }
   483  
   484  // ProxyURL returns a proxy function (for use in a [Transport])
   485  // that always returns the same URL.
   486  func ProxyURL(fixedURL *url.URL) func(*Request) (*url.URL, error) {
   487  	return func(*Request) (*url.URL, error) {
   488  		return fixedURL, nil
   489  	}
   490  }
   491  
   492  // transportRequest is a wrapper around a *Request that adds
   493  // optional extra headers to write and stores any error to return
   494  // from roundTrip.
   495  type transportRequest struct {
   496  	*Request                        // original request, not to be mutated
   497  	extra    Header                 // extra headers to write, or nil
   498  	trace    *httptrace.ClientTrace // optional
   499  
   500  	ctx    context.Context // canceled when we are done with the request
   501  	cancel context.CancelCauseFunc
   502  
   503  	mu  sync.Mutex // guards err
   504  	err error      // first setError value for mapRoundTripError to consider
   505  }
   506  
   507  func (tr *transportRequest) extraHeaders() Header {
   508  	if tr.extra == nil {
   509  		tr.extra = make(Header)
   510  	}
   511  	return tr.extra
   512  }
   513  
   514  func (tr *transportRequest) setError(err error) {
   515  	tr.mu.Lock()
   516  	if tr.err == nil {
   517  		tr.err = err
   518  	}
   519  	tr.mu.Unlock()
   520  }
   521  
   522  // useRegisteredProtocol reports whether an alternate protocol (as registered
   523  // with Transport.RegisterProtocol) should be respected for this request.
   524  func (t *Transport) useRegisteredProtocol(req *Request) bool {
   525  	if req.URL.Scheme == "https" && req.requiresHTTP1() {
   526  		// If this request requires HTTP/1, don't use the
   527  		// "https" alternate protocol, which is used by the
   528  		// HTTP/2 code to take over requests if there's an
   529  		// existing cached HTTP/2 connection.
   530  		return false
   531  	}
   532  	return true
   533  }
   534  
   535  // alternateRoundTripper returns the alternate RoundTripper to use
   536  // for this request if the Request's URL scheme requires one,
   537  // or nil for the normal case of using the Transport.
   538  func (t *Transport) alternateRoundTripper(req *Request) RoundTripper {
   539  	if !t.useRegisteredProtocol(req) {
   540  		return nil
   541  	}
   542  	if req.URL.Scheme == "https" && t.h2Config != nil && t.h2Config.ExternalRoundTrip() {
   543  		// This Transport has been configured to use an x/net/http2 Transport
   544  		// with a user-provided ClientConnPool. We're going to pass off the
   545  		// RoundTrip to x/net/http2 so it can use that pool.
   546  		//
   547  		// The ClientConnPool API is deprecated, but we're doing our best here
   548  		// to continue supporting any users who are using it.
   549  		return t.h2Config
   550  	}
   551  	altProto, _ := t.altProto.Load().(map[string]RoundTripper)
   552  	return altProto[req.URL.Scheme]
   553  }
   554  
   555  func validateHeaders(hdrs Header) string {
   556  	for k, vv := range hdrs {
   557  		if !httpguts.ValidHeaderFieldName(k) {
   558  			return fmt.Sprintf("field name %q", k)
   559  		}
   560  		for _, v := range vv {
   561  			if !httpguts.ValidHeaderFieldValue(v) {
   562  				// Don't include the value in the error,
   563  				// because it may be sensitive.
   564  				return fmt.Sprintf("field value for %q", k)
   565  			}
   566  		}
   567  	}
   568  	return ""
   569  }
   570  
   571  // roundTrip implements a RoundTripper over HTTP.
   572  func (t *Transport) roundTrip(req *Request) (_ *Response, err error) {
   573  	t.nextProtoOnce.Do(t.onceSetNextProtoDefaults)
   574  	ctx := req.Context()
   575  
   576  	if req.URL == nil {
   577  		req.closeBody()
   578  		return nil, errors.New("http: nil Request.URL")
   579  	}
   580  	if req.Header == nil {
   581  		req.closeBody()
   582  		return nil, errors.New("http: nil Request.Header")
   583  	}
   584  	scheme := req.URL.Scheme
   585  	isHTTP := scheme == "http" || scheme == "https"
   586  	if isHTTP {
   587  		// Validate the outgoing headers.
   588  		if err := validateHeaders(req.Header); err != "" {
   589  			req.closeBody()
   590  			return nil, fmt.Errorf("net/http: invalid header %s", err)
   591  		}
   592  
   593  		// Validate the outgoing trailers too.
   594  		if err := validateHeaders(req.Trailer); err != "" {
   595  			req.closeBody()
   596  			return nil, fmt.Errorf("net/http: invalid trailer %s", err)
   597  		}
   598  	}
   599  
   600  	origReq := req
   601  	req = setupRewindBody(req)
   602  
   603  	retry := 0
   604  	if altRT := t.alternateRoundTripper(req); altRT != nil {
   605  		_, isInternalH2 := altRT.(http2RoundTripper)
   606  		resp, err := altRT.RoundTrip(req)
   607  		switch {
   608  		case err == nil:
   609  			// Success.
   610  			return resp, err
   611  		case err == ErrSkipAltProtocol:
   612  			// Dial a connection and try again.
   613  		case isInternalH2:
   614  			if _, ok := errors.AsType[internal.RetryableError](err); ok {
   615  				// Retryable failure (usually a GOAWAY from the server).
   616  				// (Backoff doesn't matter, we don't backoff on the first retry.)
   617  				retry++
   618  				testHookRoundTripRetried()
   619  			} else {
   620  				return resp, err
   621  			}
   622  		default:
   623  			// Hard failure.
   624  			return resp, err
   625  		}
   626  		req, err = rewindBody(req)
   627  		if err != nil {
   628  			return nil, err
   629  		}
   630  	}
   631  	if !isHTTP {
   632  		req.closeBody()
   633  		return nil, badStringError("unsupported protocol scheme", scheme)
   634  	}
   635  	if req.Method != "" && !validMethod(req.Method) {
   636  		req.closeBody()
   637  		return nil, fmt.Errorf("net/http: invalid method %q", req.Method)
   638  	}
   639  	if req.URL.Host == "" {
   640  		req.closeBody()
   641  		return nil, errors.New("http: no Host in request URL")
   642  	}
   643  
   644  	// Transport request context.
   645  	//
   646  	// RoundTrip cancels this context before returning.
   647  	// On the HTTP/1 path, persistConn.RoundTrip creates its own context
   648  	// that persistConn.readLoop cancels after reading the response body.
   649  	ctx, cancel := context.WithCancelCause(req.Context())
   650  
   651  	// Convert Request.Cancel into context cancellation.
   652  	if origReq.Cancel != nil {
   653  		go awaitLegacyCancel(ctx, cancel, origReq)
   654  	}
   655  
   656  	defer func() {
   657  		if err != nil {
   658  			cancel(err)
   659  		} else {
   660  			cancel(errRequestDone)
   661  		}
   662  	}()
   663  
   664  	for {
   665  		select {
   666  		case <-ctx.Done():
   667  			req.closeBody()
   668  			return nil, context.Cause(ctx)
   669  		default:
   670  		}
   671  
   672  		cm, err := t.connectMethodForRequest(req)
   673  		if err != nil {
   674  			req.closeBody()
   675  			return nil, err
   676  		}
   677  
   678  		// Get the cached or newly-created connection to either the
   679  		// host (for http or https), the http proxy, or the http proxy
   680  		// pre-CONNECTed to https server. In any case, we'll be ready
   681  		// to send it requests.
   682  		pconn, err := t.getConn(ctx, cm)
   683  		if err != nil {
   684  			req.closeBody()
   685  			return nil, err
   686  		}
   687  
   688  		resp, err := pconn.cc.RoundTrip(req)
   689  		if err == nil {
   690  			resp.Request = origReq
   691  			return resp, nil
   692  		}
   693  
   694  		// Failed. Clean up and determine whether to retry.
   695  		var shouldRetry, backoff bool
   696  		if http2isNoCachedConnError(err) {
   697  			// Don't do backoff, because the request was never sent.
   698  			shouldRetry = true
   699  			backoff = false
   700  			t.poolRemoveConn(pconn)
   701  		} else {
   702  			shouldRetry, backoff = shouldRetryRequest(retry, pconn, req, err)
   703  		}
   704  		if !shouldRetry {
   705  			// Issue 16465: return underlying net.Conn.Read error from peek,
   706  			// as we've historically done.
   707  			if e, ok := err.(nothingWrittenError); ok {
   708  				err = e.error
   709  			}
   710  			if e, ok := err.(transportReadFromServerError); ok {
   711  				err = e.err
   712  			}
   713  			if b, ok := req.Body.(*readTrackingBody); ok && !b.didClose.Load() {
   714  				// Issue 49621: Close the request body if pconn.roundTrip
   715  				// didn't do so already. This can happen if the pconn
   716  				// write loop exits without reading the write request.
   717  				req.closeBody()
   718  			}
   719  			return nil, err
   720  		}
   721  		testHookRoundTripRetried()
   722  
   723  		// Rewind the body if we're able to.
   724  		req, err = rewindBody(req)
   725  		if err != nil {
   726  			return nil, err
   727  		}
   728  
   729  		if !backoff {
   730  			continue
   731  		}
   732  		if pconn.cc.Proto() == 2 && retry > 0 {
   733  			// After the first retry, do exponential backoff with 10% jitter.
   734  			backoff := float64(uint(1) << (uint(retry) - 1))
   735  			backoff += backoff * (0.1 * rand.Float64())
   736  			d := time.Duration(float64(time.Second) * backoff)
   737  			select {
   738  			case <-time.After(d):
   739  			case <-ctx.Done():
   740  				req.closeBody()
   741  				return nil, context.Cause(ctx)
   742  			}
   743  		}
   744  		retry++
   745  	}
   746  }
   747  
   748  func http2isNoCachedConnError(err error) bool {
   749  	_, ok := err.(interface{ IsHTTP2NoCachedConnError() })
   750  	return ok
   751  }
   752  
   753  func awaitLegacyCancel(ctx context.Context, cancel context.CancelCauseFunc, req *Request) {
   754  	select {
   755  	case <-req.Cancel:
   756  		cancel(errRequestCanceled)
   757  	case <-ctx.Done():
   758  	}
   759  }
   760  
   761  var errCannotRewind = errors.New("net/http: cannot rewind body after connection loss")
   762  
   763  type readTrackingBody struct {
   764  	io.ReadCloser
   765  	didRead  bool // not atomic.Bool because only one goroutine (the user's) should be accessing
   766  	didClose atomic.Bool
   767  }
   768  
   769  func (r *readTrackingBody) Read(data []byte) (int, error) {
   770  	r.didRead = true
   771  	return r.ReadCloser.Read(data)
   772  }
   773  
   774  func (r *readTrackingBody) Close() error {
   775  	if !r.didClose.CompareAndSwap(false, true) {
   776  		return nil
   777  	}
   778  	return r.ReadCloser.Close()
   779  }
   780  
   781  // setupRewindBody returns a new request with a custom body wrapper
   782  // that can report whether the body needs rewinding.
   783  // This lets rewindBody avoid an error result when the request
   784  // does not have GetBody but the body hasn't been read at all yet.
   785  func setupRewindBody(req *Request) *Request {
   786  	if req.Body == nil || req.Body == NoBody {
   787  		return req
   788  	}
   789  	newReq := *req
   790  	newReq.Body = &readTrackingBody{ReadCloser: req.Body}
   791  	return &newReq
   792  }
   793  
   794  // rewindBody returns a new request with the body rewound.
   795  // It returns req unmodified if the body does not need rewinding.
   796  // rewindBody takes care of closing req.Body when appropriate
   797  // (in all cases except when rewindBody returns req unmodified).
   798  func rewindBody(req *Request) (rewound *Request, err error) {
   799  	if req.Body == nil || req.Body == NoBody || (!req.Body.(*readTrackingBody).didRead && !req.Body.(*readTrackingBody).didClose.Load()) {
   800  		return req, nil // nothing to rewind
   801  	}
   802  	if !req.Body.(*readTrackingBody).didClose.Load() {
   803  		req.closeBody()
   804  	}
   805  	if req.GetBody == nil {
   806  		return nil, errCannotRewind
   807  	}
   808  	body, err := req.GetBody()
   809  	if err != nil {
   810  		return nil, err
   811  	}
   812  	newReq := *req
   813  	newReq.Body = &readTrackingBody{ReadCloser: body}
   814  	return &newReq, nil
   815  }
   816  
   817  // shouldRetryRequest reports whether we should retry sending a failed
   818  // HTTP request on a new connection. The non-nil input error is the
   819  // error from roundTrip.
   820  func shouldRetryRequest(retry int, pconn *poolConn, req *Request, err error) (shouldRetry, backoff bool) {
   821  	if retry > 6 {
   822  		return false, false
   823  	}
   824  	if http2isNoCachedConnError(err) {
   825  		// Issue 16582: if the user started a bunch of
   826  		// requests at once, they can all pick the same conn
   827  		// and violate the server's max concurrent streams.
   828  		// Instead, match the HTTP/1 behavior for now and dial
   829  		// again to get a new TCP connection, rather than failing
   830  		// this request.
   831  		return true, false
   832  	}
   833  	if err == errMissingHost {
   834  		// User error.
   835  		return false, false
   836  	}
   837  	if e, ok := errors.AsType[internal.RetryableError](err); ok {
   838  		// This request was never processed by a server, and may be retried.
   839  		// This comes before the fresh-connection check, because this includes
   840  		// cases such as an HTTP/2 server sending a GOAWAY for the first batch
   841  		// of requests sent to it (perhaps because it started shutting down just
   842  		// as we contacted it, or because we sent requests in excess of its concurrency
   843  		// limit before processing its initial SETTINGS frame).
   844  		return true, e.Backoff
   845  	}
   846  	if !pconn.cc.IsReused() {
   847  		// This was a fresh connection. There's no reason the server
   848  		// should've hung up on us.
   849  		//
   850  		// Also, if we retried now, we could loop forever
   851  		// creating new connections and retrying if the server
   852  		// is just hanging up on us because it doesn't like
   853  		// our request (as opposed to sending an error).
   854  		return false, false
   855  	}
   856  	if _, ok := err.(nothingWrittenError); ok {
   857  		// We never wrote anything, so it's safe to retry, if there's no body or we
   858  		// can "rewind" the body with GetBody.
   859  		return req.outgoingLength() == 0 || req.GetBody != nil, false
   860  	}
   861  	if !req.isReplayable() {
   862  		// Don't retry non-idempotent requests.
   863  		return false, false
   864  	}
   865  	if _, ok := err.(transportReadFromServerError); ok {
   866  		// We got some non-EOF net.Conn.Read failure reading
   867  		// the 1st response byte from the server.
   868  		return true, false
   869  	}
   870  	if err == errServerClosedIdle {
   871  		// The server replied with io.EOF while we were trying to
   872  		// read the response. Probably an unfortunately keep-alive
   873  		// timeout, just as the client was writing a request.
   874  		return true, false
   875  	}
   876  	return false, false // conservatively
   877  }
   878  
   879  // ErrSkipAltProtocol is a sentinel error value defined by Transport.RegisterProtocol.
   880  var ErrSkipAltProtocol = internal.ErrSkipAltProtocol
   881  
   882  // RegisterProtocol registers a new protocol with scheme.
   883  // The [Transport] will pass requests using the given scheme to rt.
   884  // It is rt's responsibility to simulate HTTP request semantics.
   885  //
   886  // RegisterProtocol can be used by other packages to provide
   887  // implementations of protocol schemes like "ftp" or "file".
   888  //
   889  // If rt.RoundTrip returns [ErrSkipAltProtocol], the Transport will
   890  // handle the [Transport.RoundTrip] itself for that one request, as if the
   891  // protocol were not registered.
   892  func (t *Transport) RegisterProtocol(scheme string, rt RoundTripper) {
   893  	if err := t.registerProtocol(scheme, rt); err != nil {
   894  		panic(err)
   895  	}
   896  }
   897  
   898  func (t *Transport) registerProtocol(scheme string, rt RoundTripper) error {
   899  	t.altMu.Lock()
   900  	defer t.altMu.Unlock()
   901  
   902  	if scheme == "http/2" {
   903  		if t.h2Config != nil {
   904  			panic("http: HTTP/2 Transport already registered")
   905  		}
   906  		var ok bool
   907  		if t.h2Config, ok = rt.(http2ExternalTransportConfig); !ok {
   908  			panic("http: HTTP/2 configuration does not implement ExternalTransportConfig")
   909  		}
   910  		t.h2Config.Registered(t)
   911  	}
   912  
   913  	if scheme == "http/3" {
   914  		if t.h3Transport != nil {
   915  			panic("http: HTTP/3 Transport already registered")
   916  		}
   917  		var ok bool
   918  		if t.h3Transport, ok = rt.(http3Transport); !ok {
   919  			panic("http: HTTP/3 RoundTripper does not implement DialClientConn")
   920  		}
   921  		// Notify the HTTP/3 transport of successful registration.
   922  		// (Since RegisterProtocol doesn't return anything, we call a method here.)
   923  		if r, ok := rt.(interface {
   924  			Registered(*Transport)
   925  		}); ok {
   926  			r.Registered(t)
   927  		}
   928  		return nil
   929  	}
   930  
   931  	oldMap, _ := t.altProto.Load().(map[string]RoundTripper)
   932  	if _, exists := oldMap[scheme]; exists {
   933  		return errors.New("protocol " + scheme + " already registered")
   934  	}
   935  	newMap := maps.Clone(oldMap)
   936  	if newMap == nil {
   937  		newMap = make(map[string]RoundTripper)
   938  	}
   939  	newMap[scheme] = rt
   940  	t.altProto.Store(newMap)
   941  	return nil
   942  }
   943  
   944  // CloseIdleConnections closes any connections which were previously
   945  // connected from previous requests but are now sitting idle in
   946  // a "keep-alive" state. It does not interrupt any connections currently
   947  // in use.
   948  func (t *Transport) CloseIdleConnections() {
   949  	t.nextProtoOnce.Do(t.onceSetNextProtoDefaults)
   950  
   951  	t.poolCloseIdleConnections()
   952  
   953  	// Tell various associated transports to close their connections.
   954  
   955  	// net/http/internal/http2 transport. This is the common case for HTTP/2 users.
   956  	if tr2 := t.h2Transport; tr2 != nil {
   957  		tr2.CloseIdleConnections()
   958  	}
   959  	// Probably an older x/net/http2 transport registered via Transport.RegisterProtocol.
   960  	// This is a legacy path; modern users just use internal/http2.
   961  	// (Note that we don't use this path when x/net/http2 wraps the net/http transport;
   962  	// this is supporting pre-wrapping x/net/http2.)
   963  	if t2 := t.closeIdleFunc; t2 != nil {
   964  		t2.CloseIdleConnections()
   965  	}
   966  	// HTTP/3 transport, probably from internal/http3.
   967  	if cc, ok := t.h3Transport.(closeIdleConnectionser); ok {
   968  		cc.CloseIdleConnections()
   969  	}
   970  }
   971  
   972  // CancelRequest is obsolete and does nothing.
   973  //
   974  // Deprecated: Use [NewRequestWithContext] to create a request with a
   975  // cancelable context instead.
   976  func (t *Transport) CancelRequest(req *Request) {
   977  }
   978  
   979  //
   980  // Private implementation past this point.
   981  //
   982  
   983  var (
   984  	envProxyOnce      sync.Once
   985  	envProxyFuncValue func(*url.URL) (*url.URL, error)
   986  )
   987  
   988  // envProxyFunc returns a function that reads the
   989  // environment variable to determine the proxy address.
   990  func envProxyFunc() func(*url.URL) (*url.URL, error) {
   991  	envProxyOnce.Do(func() {
   992  		envProxyFuncValue = httpproxy.FromEnvironment().ProxyFunc()
   993  	})
   994  	return envProxyFuncValue
   995  }
   996  
   997  // resetProxyConfig is used by tests.
   998  func resetProxyConfig() {
   999  	envProxyOnce = sync.Once{}
  1000  	envProxyFuncValue = nil
  1001  }
  1002  
  1003  func (t *Transport) connectMethodForRequest(req *Request) (cm connectMethod, err error) {
  1004  	cm.targetScheme = req.URL.Scheme
  1005  	cm.targetAddr = canonicalAddr(req.URL)
  1006  	if t.Proxy != nil {
  1007  		cm.proxyURL, err = t.Proxy(req)
  1008  	}
  1009  	cm.onlyH1 = req.requiresHTTP1()
  1010  	return cm, err
  1011  }
  1012  
  1013  // proxyAuth returns the Proxy-Authorization header to set
  1014  // on requests, if applicable.
  1015  func (cm *connectMethod) proxyAuth() string {
  1016  	if cm.proxyURL == nil {
  1017  		return ""
  1018  	}
  1019  	if u := cm.proxyURL.User; u != nil {
  1020  		username := u.Username()
  1021  		password, _ := u.Password()
  1022  		return "Basic " + basicAuth(username, password)
  1023  	}
  1024  	return ""
  1025  }
  1026  
  1027  // error values for debugging and testing, not seen by users.
  1028  var (
  1029  	errKeepAlivesDisabled = errors.New("http: putIdleConn: keep alives disabled")
  1030  	errConnBroken         = errors.New("http: putIdleConn: connection is in bad state")
  1031  	errCloseIdle          = errors.New("http: putIdleConn: CloseIdleConnections was called")
  1032  	errTooManyIdle        = errors.New("http: putIdleConn: too many idle connections")
  1033  	errTooManyIdleHost    = errors.New("http: putIdleConn: too many idle connections for host")
  1034  	errCloseIdleConns     = errors.New("http: CloseIdleConnections called")
  1035  	errReadLoopExiting    = errors.New("http: persistConn.readLoop exiting")
  1036  	errIdleConnTimeout    = errors.New("http: idle connection timeout")
  1037  
  1038  	// errServerClosedIdle is not seen by users for idempotent requests, but may be
  1039  	// seen by a user if the server shuts down an idle connection and sends its FIN
  1040  	// in flight with already-written POST body bytes from the client.
  1041  	// See https://github.com/golang/go/issues/19943#issuecomment-355607646
  1042  	errServerClosedIdle = errors.New("http: server closed idle connection")
  1043  )
  1044  
  1045  // transportReadFromServerError is used by Transport.readLoop when the
  1046  // 1 byte peek read fails and we're actually anticipating a response.
  1047  // Usually this is just due to the inherent keep-alive shut down race,
  1048  // where the server closed the connection at the same time the client
  1049  // wrote. The underlying err field is usually io.EOF or some
  1050  // ECONNRESET sort of thing which varies by platform. But it might be
  1051  // the user's custom net.Conn.Read error too, so we carry it along for
  1052  // them to return from Transport.RoundTrip.
  1053  type transportReadFromServerError struct {
  1054  	err error
  1055  }
  1056  
  1057  func (e transportReadFromServerError) Unwrap() error { return e.err }
  1058  
  1059  func (e transportReadFromServerError) Error() string {
  1060  	return fmt.Sprintf("net/http: Transport failed to read from server: %v", e.err)
  1061  }
  1062  
  1063  func (t *Transport) maxIdleConnsPerHost() int {
  1064  	if v := t.MaxIdleConnsPerHost; v != 0 {
  1065  		return v
  1066  	}
  1067  	return DefaultMaxIdleConnsPerHost
  1068  }
  1069  
  1070  func (t *Transport) keepAlivesDisabled() bool {
  1071  	return t.DisableKeepAlives || t.MaxIdleConnsPerHost < 0 || t.MaxIdleConns < 0
  1072  }
  1073  
  1074  // roundTripDone records that an in-flight request has completed.
  1075  // It returns an error if the connection should now be closed.
  1076  func (pc *persistConn) roundTripDone() error {
  1077  	if pc.t.keepAlivesDisabled() {
  1078  		return errKeepAlivesDisabled
  1079  	}
  1080  	if err := func() error {
  1081  		pc.mu.Lock()
  1082  		defer pc.mu.Unlock()
  1083  		if pc.closed != nil {
  1084  			return errConnBroken
  1085  		}
  1086  		pc.reused = true
  1087  		if !pc.inFlight {
  1088  			panic("pconn is not in flight")
  1089  		}
  1090  		pc.inFlight = false
  1091  		select {
  1092  		case pc.availch <- struct{}{}:
  1093  		default:
  1094  			panic("unable to make pconn available")
  1095  		}
  1096  		return nil
  1097  	}(); err != nil {
  1098  		return err
  1099  	}
  1100  	if pc.internalStateHook != nil {
  1101  		pc.internalStateHook()
  1102  	}
  1103  	// The state hook could have closed the conn.
  1104  	// If it did, return an error so readLoop can exit quickly.
  1105  	pc.mu.Lock()
  1106  	defer pc.mu.Unlock()
  1107  	return pc.closed
  1108  }
  1109  
  1110  var zeroDialer net.Dialer
  1111  
  1112  func (t *Transport) dial(ctx context.Context, network, addr string) (net.Conn, error) {
  1113  	if t.DialContext != nil {
  1114  		c, err := t.DialContext(ctx, network, addr)
  1115  		if c == nil && err == nil {
  1116  			err = errors.New("net/http: Transport.DialContext hook returned (nil, nil)")
  1117  		}
  1118  		return c, err
  1119  	}
  1120  	if t.Dial != nil {
  1121  		c, err := t.Dial(network, addr)
  1122  		if c == nil && err == nil {
  1123  			err = errors.New("net/http: Transport.Dial hook returned (nil, nil)")
  1124  		}
  1125  		return c, err
  1126  	}
  1127  	return zeroDialer.DialContext(ctx, network, addr)
  1128  }
  1129  
  1130  func (t *Transport) customDialTLS(ctx context.Context, network, addr string) (conn net.Conn, err error) {
  1131  	if t.DialTLSContext != nil {
  1132  		conn, err = t.DialTLSContext(ctx, network, addr)
  1133  	} else {
  1134  		conn, err = t.DialTLS(network, addr)
  1135  	}
  1136  	if conn == nil && err == nil {
  1137  		err = errors.New("net/http: Transport.DialTLS or DialTLSContext returned (nil, nil)")
  1138  	}
  1139  	return
  1140  }
  1141  
  1142  // getConn dials and creates a new connection to the target as
  1143  // specified in the connectMethod. This includes doing a proxy CONNECT
  1144  // and/or setting up TLS. If this doesn't return an error, the connection
  1145  // is ready to write requests to.
  1146  func (t *Transport) getConn(ctx context.Context, cm connectMethod) (_ *poolConn, err error) {
  1147  	trace := httptrace.ContextClientTrace(ctx)
  1148  	if trace != nil && trace.GetConn != nil {
  1149  		trace.GetConn(cm.addr())
  1150  	}
  1151  
  1152  	pconn, err := t.poolGetConn(ctx, cm)
  1153  	if err != nil {
  1154  		return nil, err
  1155  	}
  1156  	if !pconn.cc.IsAlt() && trace != nil {
  1157  		if _, ok := pconn.cc.(*persistConn); ok {
  1158  			// Arrange to call PutIdleConn for HTTP/1 connections.
  1159  			// Our documented behavior is to not call PutIdleConn for HTTP/2
  1160  			// (and eventually HTTP/3) connections.
  1161  			//
  1162  			// Setting putIdleHook here is race-free: The conn can only become
  1163  			// idle after RoundTrip sends a request on it, and putIdleHook
  1164  			// is only checked for idle conns.
  1165  			pconn.putIdleHook = trace.PutIdleConn
  1166  		}
  1167  		if trace.GotConn != nil {
  1168  			info := httptrace.GotConnInfo{
  1169  				Conn:   pconn.cc.NetConn(),
  1170  				Reused: pconn.cc.IsReused(),
  1171  			}
  1172  			if !pconn.idleAt.IsZero() {
  1173  				info.WasIdle = true
  1174  				info.IdleTime = time.Since(pconn.idleAt)
  1175  			}
  1176  			trace.GotConn(info)
  1177  		}
  1178  	}
  1179  	return pconn, nil
  1180  }
  1181  
  1182  func (t *Transport) tlsConfigForDial(host string) (*tls.Config, error) {
  1183  	firstTLSHost, _, err := net.SplitHostPort(host)
  1184  	if err != nil {
  1185  		return nil, err
  1186  	}
  1187  	cfg := cloneTLSConfig(t.TLSClientConfig)
  1188  	if cfg.ServerName == "" {
  1189  		cfg.ServerName = firstTLSHost
  1190  	}
  1191  	return cfg, nil
  1192  }
  1193  
  1194  // Add TLS to a persistent connection, i.e. negotiate a TLS session. If pconn is already a TLS
  1195  // tunnel, this function establishes a nested TLS session inside the encrypted channel.
  1196  // The remote endpoint's name may be overridden by TLSClientConfig.ServerName.
  1197  func (pconn *persistConn) addTLS(ctx context.Context, addr string, trace *httptrace.ClientTrace) error {
  1198  	cfg, err := pconn.t.tlsConfigForDial(addr)
  1199  	if err != nil {
  1200  		pconn.conn.Close()
  1201  		return err
  1202  	}
  1203  	if pconn.cacheKey.onlyH1 {
  1204  		cfg.NextProtos = nil
  1205  	}
  1206  	plainConn := pconn.conn
  1207  	tlsConn := tls.Client(plainConn, cfg)
  1208  	errc := make(chan error, 2)
  1209  	var timer *time.Timer // for canceling TLS handshake
  1210  	if d := pconn.t.TLSHandshakeTimeout; d != 0 {
  1211  		timer = time.AfterFunc(d, func() {
  1212  			errc <- tlsHandshakeTimeoutError{}
  1213  		})
  1214  	}
  1215  	go func() {
  1216  		if trace != nil && trace.TLSHandshakeStart != nil {
  1217  			trace.TLSHandshakeStart()
  1218  		}
  1219  		err := tlsConn.HandshakeContext(ctx)
  1220  		if timer != nil {
  1221  			timer.Stop()
  1222  		}
  1223  		errc <- err
  1224  	}()
  1225  	if err := <-errc; err != nil {
  1226  		plainConn.Close()
  1227  		if err == (tlsHandshakeTimeoutError{}) {
  1228  			// Now that we have closed the connection,
  1229  			// wait for the call to HandshakeContext to return.
  1230  			<-errc
  1231  		}
  1232  		if trace != nil && trace.TLSHandshakeDone != nil {
  1233  			trace.TLSHandshakeDone(tls.ConnectionState{}, err)
  1234  		}
  1235  		return err
  1236  	}
  1237  	cs := tlsConn.ConnectionState()
  1238  	if trace != nil && trace.TLSHandshakeDone != nil {
  1239  		trace.TLSHandshakeDone(cs, nil)
  1240  	}
  1241  	pconn.tlsState = &cs
  1242  	pconn.conn = tlsConn
  1243  	return nil
  1244  }
  1245  
  1246  type erringRoundTripper interface {
  1247  	RoundTripErr() error
  1248  }
  1249  
  1250  var testHookProxyConnectTimeout = context.WithTimeout
  1251  
  1252  func (t *Transport) dialConn(ctx context.Context, cm connectMethod, isClientConn bool, internalStateHook func()) (_ genericClientConn, err error) {
  1253  	// TODO: actually support HTTP/3. Among other things:
  1254  	// - make HTTP/3 play well with proxy.
  1255  	// - implement happy eyeball between HTTP/3 and HTTP/1 & HTTP/2.
  1256  	// - clean up the connection pooling logic.
  1257  	if p := t.protocols(); p.http3() {
  1258  		if p.HTTP1() || p.HTTP2() || p.UnencryptedHTTP2() {
  1259  			return nil, errors.New("http: when using HTTP3, Transport.Protocols must contain only HTTP3")
  1260  		}
  1261  		if t.h3Transport == nil {
  1262  			return nil, errors.New("http: Transport.Protocols contains HTTP3, but Transport does not support HTTP/3")
  1263  		}
  1264  		tlsConfig, err := t.tlsConfigForDial(cm.addr())
  1265  		if err != nil {
  1266  			return nil, err
  1267  		}
  1268  		tlsConfig.NextProtos = []string{"h3"}
  1269  		rt, err := t.h3Transport.DialClientConn(ctx, cm.addr(), cm.proxyURL, tlsConfig, internalStateHook)
  1270  		if err != nil {
  1271  			return nil, err
  1272  		}
  1273  		return rt.(genericClientConn), nil
  1274  	}
  1275  
  1276  	// TODO: Don't allocate persistConn until we know that we're using HTTP/1.
  1277  	pconn := &persistConn{
  1278  		t:                 t,
  1279  		cacheKey:          cm.key(),
  1280  		reqch:             make(chan requestAndChan, 1),
  1281  		writech:           make(chan writeRequest, 1),
  1282  		closech:           make(chan struct{}),
  1283  		writeErrCh:        make(chan error, 1),
  1284  		writeLoopDone:     make(chan struct{}),
  1285  		internalStateHook: internalStateHook,
  1286  	}
  1287  	trace := httptrace.ContextClientTrace(ctx)
  1288  	wrapErr := func(err error) error {
  1289  		if cm.proxyURL != nil {
  1290  			// Return a typed error, per Issue 16997
  1291  			return &net.OpError{Op: "proxyconnect", Net: "tcp", Err: err}
  1292  		}
  1293  		return err
  1294  	}
  1295  
  1296  	if cc, err := t.http2ExternalDial(ctx, cm); err != errors.ErrUnsupported {
  1297  		if err != nil {
  1298  			return nil, err
  1299  		}
  1300  		return cc, nil
  1301  	}
  1302  
  1303  	if cm.scheme() == "https" && t.hasCustomTLSDialer() {
  1304  		var err error
  1305  		pconn.conn, err = t.customDialTLS(ctx, "tcp", cm.addr())
  1306  		if err != nil {
  1307  			return nil, wrapErr(err)
  1308  		}
  1309  		type connectionStater interface {
  1310  			ConnectionState() tls.ConnectionState
  1311  		}
  1312  		type handshaker interface {
  1313  			HandshakeContext(context.Context) error
  1314  		}
  1315  		if cstater, ok := pconn.conn.(connectionStater); ok {
  1316  			if trace != nil && trace.TLSHandshakeStart != nil {
  1317  				trace.TLSHandshakeStart()
  1318  			}
  1319  			if handshaker, ok := cstater.(handshaker); ok {
  1320  				// Handshake here, in case DialTLS didn't. TLSNextProto below
  1321  				// depends on it for knowing the connection state.
  1322  				if err := handshaker.HandshakeContext(ctx); err != nil {
  1323  					go pconn.conn.Close()
  1324  					if trace != nil && trace.TLSHandshakeDone != nil {
  1325  						trace.TLSHandshakeDone(tls.ConnectionState{}, err)
  1326  					}
  1327  					return nil, err
  1328  				}
  1329  			}
  1330  			cs := cstater.ConnectionState()
  1331  			if trace != nil && trace.TLSHandshakeDone != nil {
  1332  				trace.TLSHandshakeDone(cs, nil)
  1333  			}
  1334  			pconn.tlsState = &cs
  1335  		}
  1336  	} else {
  1337  		conn, err := t.dial(ctx, "tcp", cm.addr())
  1338  		if err != nil {
  1339  			return nil, wrapErr(err)
  1340  		}
  1341  		pconn.conn = conn
  1342  		if cm.scheme() == "https" {
  1343  			if err = pconn.addTLS(ctx, cm.addr(), trace); err != nil {
  1344  				return nil, wrapErr(err)
  1345  			}
  1346  		}
  1347  	}
  1348  
  1349  	// Proxy setup.
  1350  	switch {
  1351  	case cm.proxyURL == nil:
  1352  		// Do nothing. Not using a proxy.
  1353  	case cm.proxyURL.Scheme == "socks5" || cm.proxyURL.Scheme == "socks5h":
  1354  		conn := pconn.conn
  1355  		d := socksNewDialer("tcp", conn.RemoteAddr().String())
  1356  		if u := cm.proxyURL.User; u != nil {
  1357  			auth := &socksUsernamePassword{
  1358  				Username: u.Username(),
  1359  			}
  1360  			auth.Password, _ = u.Password()
  1361  			d.AuthMethods = []socksAuthMethod{
  1362  				socksAuthMethodNotRequired,
  1363  				socksAuthMethodUsernamePassword,
  1364  			}
  1365  			d.Authenticate = auth.Authenticate
  1366  		}
  1367  		if _, err := d.DialWithConn(ctx, conn, "tcp", cm.targetAddr); err != nil {
  1368  			conn.Close()
  1369  			return nil, err
  1370  		}
  1371  	case cm.targetScheme == "http":
  1372  		pconn.isProxy = true
  1373  		if pa := cm.proxyAuth(); pa != "" {
  1374  			pconn.mutateHeaderFunc = func(h Header) {
  1375  				h.Set("Proxy-Authorization", pa)
  1376  			}
  1377  		}
  1378  	case cm.targetScheme == "https":
  1379  		conn := pconn.conn
  1380  		var hdr Header
  1381  		if t.GetProxyConnectHeader != nil {
  1382  			var err error
  1383  			hdr, err = t.GetProxyConnectHeader(ctx, cm.proxyURL, cm.targetAddr)
  1384  			if err != nil {
  1385  				conn.Close()
  1386  				return nil, err
  1387  			}
  1388  		} else {
  1389  			hdr = t.ProxyConnectHeader
  1390  		}
  1391  		if hdr == nil {
  1392  			hdr = make(Header)
  1393  		}
  1394  		if pa := cm.proxyAuth(); pa != "" {
  1395  			hdr = hdr.Clone()
  1396  			hdr.Set("Proxy-Authorization", pa)
  1397  		}
  1398  		connectReq := &Request{
  1399  			Method: "CONNECT",
  1400  			URL:    &url.URL{Opaque: cm.targetAddr},
  1401  			Host:   cm.targetAddr,
  1402  			Header: hdr,
  1403  		}
  1404  
  1405  		// Set a (long) timeout here to make sure we don't block forever
  1406  		// and leak a goroutine if the connection stops replying after
  1407  		// the TCP connect.
  1408  		connectCtx, cancel := testHookProxyConnectTimeout(ctx, 1*time.Minute)
  1409  		defer cancel()
  1410  
  1411  		didReadResponse := make(chan struct{}) // closed after CONNECT write+read is done or fails
  1412  		var (
  1413  			resp *Response
  1414  			err  error // write or read error
  1415  		)
  1416  		// Write the CONNECT request & read the response.
  1417  		go func() {
  1418  			defer close(didReadResponse)
  1419  			err = connectReq.Write(conn)
  1420  			if err != nil {
  1421  				return
  1422  			}
  1423  			// Okay to use and discard buffered reader here, because
  1424  			// TLS server will not speak until spoken to.
  1425  			br := bufio.NewReader(&io.LimitedReader{R: conn, N: t.maxHeaderResponseSize()})
  1426  			resp, err = ReadResponse(br, connectReq)
  1427  		}()
  1428  		select {
  1429  		case <-connectCtx.Done():
  1430  			conn.Close()
  1431  			<-didReadResponse
  1432  			return nil, connectCtx.Err()
  1433  		case <-didReadResponse:
  1434  			// resp or err now set
  1435  		}
  1436  		if err != nil {
  1437  			conn.Close()
  1438  			return nil, err
  1439  		}
  1440  
  1441  		if t.OnProxyConnectResponse != nil {
  1442  			err = t.OnProxyConnectResponse(ctx, cm.proxyURL, connectReq, resp)
  1443  			if err != nil {
  1444  				conn.Close()
  1445  				return nil, err
  1446  			}
  1447  		}
  1448  
  1449  		if resp.StatusCode != 200 {
  1450  			_, text, ok := strings.Cut(resp.Status, " ")
  1451  			conn.Close()
  1452  			if !ok {
  1453  				return nil, errors.New("unknown status code")
  1454  			}
  1455  			return nil, errors.New(text)
  1456  		}
  1457  	}
  1458  
  1459  	if cm.proxyURL != nil && cm.targetScheme == "https" {
  1460  		if err := pconn.addTLS(ctx, cm.targetAddr, trace); err != nil {
  1461  			return nil, err
  1462  		}
  1463  	}
  1464  
  1465  	// Possible unencrypted HTTP/2 with prior knowledge.
  1466  	unencryptedHTTP2 := pconn.tlsState == nil &&
  1467  		t.Protocols != nil &&
  1468  		t.Protocols.UnencryptedHTTP2() &&
  1469  		!t.Protocols.HTTP1()
  1470  
  1471  	http2 := unencryptedHTTP2 ||
  1472  		(pconn.tlsState != nil && pconn.tlsState.NegotiatedProtocol == "h2")
  1473  
  1474  	if http2 && t.h2Transport != nil {
  1475  		// HTTP/2, backed by internal/http2.
  1476  		if isClientConn {
  1477  			// NewClientConn, creating a connection.
  1478  			cc, err := t.http2NewClientConn(pconn.conn, internalStateHook)
  1479  			if err == nil {
  1480  				return cc, nil
  1481  			}
  1482  			if err != errors.ErrUnsupported {
  1483  				return nil, err
  1484  			}
  1485  		} else {
  1486  			// RoundTrip, adding a net.Conn to internal/http2.Transport's pool.
  1487  			// The "connection" returned by http2AddConn is just a reference
  1488  			// to the http2.Transport.
  1489  			cc, err := t.http2AddConn(cm.targetScheme, cm.targetAddr, pconn.conn)
  1490  			if err == nil {
  1491  				return cc, nil
  1492  			}
  1493  			if err != errors.ErrUnsupported {
  1494  				return nil, err
  1495  			}
  1496  		}
  1497  	}
  1498  
  1499  	if isClientConn && (unencryptedHTTP2 || (pconn.tlsState != nil && pconn.tlsState.NegotiatedProtocol == "h2")) {
  1500  		// NewClientConn, using an HTTP/2 implementation installed via the legacy
  1501  		// RegisterProtocol path. This shouldn't really be used by anything any more.
  1502  		altProto, _ := t.altProto.Load().(map[string]RoundTripper)
  1503  		h2, ok := altProto["https"].(newClientConner)
  1504  		if !ok {
  1505  			return nil, errors.New("http: HTTP/2 implementation does not support NewClientConn (update golang.org/x/net?)")
  1506  		}
  1507  		rt, err := h2.NewClientConn(pconn.conn, internalStateHook)
  1508  		if err != nil {
  1509  			pconn.conn.Close()
  1510  			return nil, err
  1511  		}
  1512  		cc, ok := rt.(externalClientConn)
  1513  		if !ok {
  1514  			return nil, errors.New("http: NewClientConn returned something that is not a ClientConn")
  1515  		}
  1516  		return externalHTTP2Conn{cc}, nil
  1517  	}
  1518  
  1519  	wrapTLSNextProtoRoundTripper := func(rt RoundTripper) (genericClientConn, error) {
  1520  		if e, ok := rt.(erringRoundTripper); ok {
  1521  			// pconn.conn was closed by next (http2configureTransports.upgradeFn).
  1522  			return nil, e.RoundTripErr()
  1523  		}
  1524  		return &altClientConn{rt: rt}, nil
  1525  	}
  1526  	if unencryptedHTTP2 {
  1527  		// Unencrypted HTTP/2 using the legacy TLSNextProto.
  1528  		next, ok := t.TLSNextProto[nextProtoUnencryptedHTTP2]
  1529  		if !ok {
  1530  			return nil, errors.New("http: Transport does not support unencrypted HTTP/2")
  1531  		}
  1532  		alt := next(cm.targetAddr, unencryptedTLSConn(pconn.conn))
  1533  		return wrapTLSNextProtoRoundTripper(alt)
  1534  	}
  1535  
  1536  	if s := pconn.tlsState; s != nil && s.NegotiatedProtocolIsMutual && s.NegotiatedProtocol != "" {
  1537  		// Encrypted HTTP/2 using the legacy TLSNextProto.
  1538  		tlsConn, tlsConnOK := pconn.conn.(*tls.Conn)
  1539  		if next, ok := t.TLSNextProto[s.NegotiatedProtocol]; tlsConnOK && ok {
  1540  			alt := next(cm.targetAddr, tlsConn)
  1541  			return wrapTLSNextProtoRoundTripper(alt)
  1542  		}
  1543  	}
  1544  
  1545  	// All HTTP/1 connections.
  1546  	pconn.availch = make(chan struct{}, 1)
  1547  	pconn.availch <- struct{}{}
  1548  	pconn.br = bufio.NewReaderSize(pconn, t.readBufferSize())
  1549  	pconn.bw = bufio.NewWriterSize(persistConnWriter{pconn}, t.writeBufferSize())
  1550  
  1551  	go pconn.readLoop()
  1552  	go pconn.writeLoop()
  1553  	return pconn, nil
  1554  }
  1555  
  1556  // persistConnWriter is the io.Writer written to by pc.bw.
  1557  // It accumulates the number of bytes written to the underlying conn,
  1558  // so the retry logic can determine whether any bytes made it across
  1559  // the wire.
  1560  // This is exactly 1 pointer field wide so it can go into an interface
  1561  // without allocation.
  1562  type persistConnWriter struct {
  1563  	pc *persistConn
  1564  }
  1565  
  1566  func (w persistConnWriter) Write(p []byte) (n int, err error) {
  1567  	n, err = w.pc.conn.Write(p)
  1568  	w.pc.nwrite += int64(n)
  1569  	return
  1570  }
  1571  
  1572  // ReadFrom exposes persistConnWriter's underlying Conn to io.Copy and if
  1573  // the Conn implements io.ReaderFrom, it can take advantage of optimizations
  1574  // such as sendfile.
  1575  func (w persistConnWriter) ReadFrom(r io.Reader) (n int64, err error) {
  1576  	n, err = io.Copy(w.pc.conn, r)
  1577  	w.pc.nwrite += n
  1578  	return
  1579  }
  1580  
  1581  var _ io.ReaderFrom = (*persistConnWriter)(nil)
  1582  
  1583  // connectMethod is the map key (in its String form) for keeping persistent
  1584  // TCP connections alive for subsequent HTTP requests.
  1585  //
  1586  // A connect method may be of the following types:
  1587  //
  1588  //	connectMethod.key().String()      Description
  1589  //	------------------------------    -------------------------
  1590  //	|http|foo.com                     http directly to server, no proxy
  1591  //	|https|foo.com                    https directly to server, no proxy
  1592  //	|https,h1|foo.com                 https directly to server w/o HTTP/2, no proxy
  1593  //	http://proxy.com|https|foo.com    http to proxy, then CONNECT to foo.com
  1594  //	http://proxy.com|http             http to proxy, http to anywhere after that
  1595  //	socks5://proxy.com|http|foo.com   socks5 to proxy, then http to foo.com
  1596  //	socks5://proxy.com|https|foo.com  socks5 to proxy, then https to foo.com
  1597  //	https://proxy.com|https|foo.com   https to proxy, then CONNECT to foo.com
  1598  //	https://proxy.com|http            https to proxy, http to anywhere after that
  1599  type connectMethod struct {
  1600  	_            incomparable
  1601  	proxyURL     *url.URL // nil for no proxy, else full proxy URL
  1602  	targetScheme string   // "http" or "https"
  1603  	// If proxyURL specifies an http or https proxy, and targetScheme is http (not https),
  1604  	// then targetAddr is not included in the connect method key, because the socket can
  1605  	// be reused for different targetAddr values.
  1606  	targetAddr string
  1607  	onlyH1     bool // whether to disable HTTP/2 and force HTTP/1
  1608  }
  1609  
  1610  func (cm *connectMethod) key() connectMethodKey {
  1611  	proxyStr := ""
  1612  	targetAddr := cm.targetAddr
  1613  	if cm.proxyURL != nil {
  1614  		proxyStr = cm.proxyURL.String()
  1615  		if (cm.proxyURL.Scheme == "http" || cm.proxyURL.Scheme == "https") && cm.targetScheme == "http" {
  1616  			targetAddr = ""
  1617  		}
  1618  	}
  1619  	return connectMethodKey{
  1620  		proxy:  proxyStr,
  1621  		scheme: cm.targetScheme,
  1622  		addr:   targetAddr,
  1623  		onlyH1: cm.onlyH1,
  1624  	}
  1625  }
  1626  
  1627  // scheme returns the first hop scheme: http, https, or socks5
  1628  func (cm *connectMethod) scheme() string {
  1629  	if cm.proxyURL != nil {
  1630  		return cm.proxyURL.Scheme
  1631  	}
  1632  	return cm.targetScheme
  1633  }
  1634  
  1635  // addr returns the first hop "host:port" to which we need to TCP connect.
  1636  func (cm *connectMethod) addr() string {
  1637  	if cm.proxyURL != nil {
  1638  		return canonicalAddr(cm.proxyURL)
  1639  	}
  1640  	return cm.targetAddr
  1641  }
  1642  
  1643  // connectMethodKey is the map key version of connectMethod, with a
  1644  // stringified proxy URL (or the empty string) instead of a pointer to
  1645  // a URL.
  1646  type connectMethodKey struct {
  1647  	proxy, scheme, addr string
  1648  	onlyH1              bool
  1649  }
  1650  
  1651  func (k connectMethodKey) String() string {
  1652  	// Only used by tests.
  1653  	var h1 string
  1654  	if k.onlyH1 {
  1655  		h1 = ",h1"
  1656  	}
  1657  	return fmt.Sprintf("%s|%s%s|%s", k.proxy, k.scheme, h1, k.addr)
  1658  }
  1659  
  1660  // persistConn wraps an HTTP/1 client connection, usually a persistent one
  1661  // (but may be used for non-keep-alive requests as well).
  1662  type persistConn struct {
  1663  	t         *Transport
  1664  	cacheKey  connectMethodKey
  1665  	conn      net.Conn
  1666  	tlsState  *tls.ConnectionState
  1667  	br        *bufio.Reader       // from conn
  1668  	bw        *bufio.Writer       // to conn
  1669  	nwrite    int64               // bytes written
  1670  	reqch     chan requestAndChan // written by roundTrip; read by readLoop
  1671  	writech   chan writeRequest   // written by roundTrip; read by writeLoop
  1672  	closech   chan struct{}       // closed when conn closed
  1673  	availch   chan struct{}       // contains a value when conn is usable
  1674  	isProxy   bool
  1675  	sawEOF    bool  // whether we've seen EOF from conn; owned by readLoop
  1676  	readLimit int64 // bytes allowed to be read; owned by readLoop
  1677  	// writeErrCh passes the request write error (usually nil)
  1678  	// from the writeLoop goroutine to the readLoop which passes
  1679  	// it off to the res.Body reader, which then uses it to decide
  1680  	// whether or not a connection can be reused. Issue 7569.
  1681  	writeErrCh chan error
  1682  
  1683  	writeLoopDone chan struct{} // closed when write loop ends
  1684  
  1685  	mu                   sync.Mutex // guards following fields
  1686  	numExpectedResponses int
  1687  	closed               error  // set non-nil when conn is closed, before closech is closed
  1688  	canceledErr          error  // set non-nil if conn is canceled
  1689  	reused               bool   // whether conn has had successful request/response and is being reused.
  1690  	reserved             bool   // concurrency slot reserved
  1691  	inFlight             bool   // request is in flight
  1692  	internalStateHook    func() // called when connection state changes
  1693  
  1694  	// mutateHeaderFunc is an optional func to modify extra
  1695  	// headers on each outbound request before it's written. (the
  1696  	// original Request given to RoundTrip is not modified)
  1697  	mutateHeaderFunc func(Header)
  1698  }
  1699  
  1700  func (pc *persistConn) maxHeaderResponseSize() int64 {
  1701  	return pc.t.maxHeaderResponseSize()
  1702  }
  1703  
  1704  func (pc *persistConn) Read(p []byte) (n int, err error) {
  1705  	if pc.readLimit <= 0 {
  1706  		return 0, fmt.Errorf("read limit of %d bytes exhausted", pc.maxHeaderResponseSize())
  1707  	}
  1708  	if int64(len(p)) > pc.readLimit {
  1709  		p = p[:pc.readLimit]
  1710  	}
  1711  	n, err = pc.conn.Read(p)
  1712  	if err == io.EOF {
  1713  		pc.sawEOF = true
  1714  	}
  1715  	pc.readLimit -= int64(n)
  1716  	return
  1717  }
  1718  
  1719  // isBroken reports whether this connection is in a known broken state.
  1720  func (pc *persistConn) isBroken() bool {
  1721  	pc.mu.Lock()
  1722  	b := pc.closed != nil
  1723  	pc.mu.Unlock()
  1724  	return b
  1725  }
  1726  
  1727  // canceled returns non-nil if the connection was closed due to context cancellation.
  1728  func (pc *persistConn) canceled() error {
  1729  	pc.mu.Lock()
  1730  	defer pc.mu.Unlock()
  1731  	return pc.canceledErr
  1732  }
  1733  
  1734  // IsReused reports whether this connection has been used before.
  1735  func (pc *persistConn) IsReused() bool {
  1736  	pc.mu.Lock()
  1737  	r := pc.reused
  1738  	pc.mu.Unlock()
  1739  	return r
  1740  }
  1741  
  1742  func (pc *persistConn) cancelRequest(err error) {
  1743  	pc.mu.Lock()
  1744  	defer pc.mu.Unlock()
  1745  	pc.canceledErr = err
  1746  	pc.closeLocked(errRequestCanceled)
  1747  }
  1748  
  1749  // mapRoundTripError returns the appropriate error value for
  1750  // persistConn.roundTrip.
  1751  //
  1752  // The provided err is the first error that (*persistConn).roundTrip
  1753  // happened to receive from its select statement.
  1754  //
  1755  // The startBytesWritten value should be the value of pc.nwrite before the roundTrip
  1756  // started writing the request.
  1757  func (pc *persistConn) mapRoundTripError(req *transportRequest, startBytesWritten int64, err error) error {
  1758  	if err == nil {
  1759  		return nil
  1760  	}
  1761  
  1762  	// Wait for the writeLoop goroutine to terminate to avoid data
  1763  	// races on callers who mutate the request on failure.
  1764  	//
  1765  	// When resc in pc.roundTrip and hence rc.ch receives a responseAndError
  1766  	// with a non-nil error it implies that the persistConn is either closed
  1767  	// or closing. Waiting on pc.writeLoopDone is hence safe as all callers
  1768  	// close closech which in turn ensures writeLoop returns.
  1769  	<-pc.writeLoopDone
  1770  
  1771  	// If the request was canceled, that's better than network
  1772  	// failures that were likely the result of tearing down the
  1773  	// connection.
  1774  	if cerr := pc.canceled(); cerr != nil {
  1775  		return cerr
  1776  	}
  1777  
  1778  	// See if an error was set explicitly.
  1779  	req.mu.Lock()
  1780  	reqErr := req.err
  1781  	req.mu.Unlock()
  1782  	if reqErr != nil {
  1783  		return reqErr
  1784  	}
  1785  
  1786  	if err == errServerClosedIdle {
  1787  		// Don't decorate
  1788  		return err
  1789  	}
  1790  
  1791  	if _, ok := err.(transportReadFromServerError); ok {
  1792  		if pc.nwrite == startBytesWritten {
  1793  			return nothingWrittenError{err}
  1794  		}
  1795  		// Don't decorate
  1796  		return err
  1797  	}
  1798  	if pc.isBroken() {
  1799  		if pc.nwrite == startBytesWritten {
  1800  			return nothingWrittenError{err}
  1801  		}
  1802  		return fmt.Errorf("net/http: HTTP/1.x transport connection broken: %w", err)
  1803  	}
  1804  	return err
  1805  }
  1806  
  1807  // errCallerOwnsConn is an internal sentinel error used when we hand
  1808  // off a writable response.Body to the caller. We use this to prevent
  1809  // closing a net.Conn that is now owned by the caller.
  1810  var errCallerOwnsConn = errors.New("read loop ending; caller owns writable underlying conn")
  1811  
  1812  // maxPostCloseReadBytes is the max number of bytes that a client is willing to
  1813  // read when draining the response body of any unread bytes after it has been
  1814  // closed. This number is chosen for consistency with maxPostHandlerReadBytes.
  1815  const maxPostCloseReadBytes = 256 << 10
  1816  
  1817  // maxPostCloseReadTime defines the maximum amount of time that a client is
  1818  // willing to spend on draining a response body of any unread bytes after it
  1819  // has been closed.
  1820  const maxPostCloseReadTime = 50 * time.Millisecond
  1821  
  1822  func maybeDrainBody(r io.Reader) bool {
  1823  	drainedCh := make(chan bool, 1)
  1824  	go func() {
  1825  		// When we drain the body and (hopefully) reach EOF, we might
  1826  		// potentially need to deal with trailers. Make sure they are discarded
  1827  		// so the connection can actually be reused.
  1828  		if b, ok := r.(*body); ok {
  1829  			b.discardTrailer()
  1830  		}
  1831  		if _, err := io.CopyN(io.Discard, r, maxPostCloseReadBytes+1); err == io.EOF {
  1832  			drainedCh <- true
  1833  		} else {
  1834  			drainedCh <- false
  1835  		}
  1836  	}()
  1837  	select {
  1838  	case drained := <-drainedCh:
  1839  		return drained
  1840  	case <-time.After(maxPostCloseReadTime):
  1841  		return false
  1842  	}
  1843  }
  1844  
  1845  type bodyReadStatus uint8
  1846  
  1847  const (
  1848  	bodyReadEOF bodyReadStatus = iota
  1849  	bodyReadClosedEarly
  1850  	bodyReadError
  1851  )
  1852  
  1853  func (pc *persistConn) readLoop() {
  1854  	closeErr := errReadLoopExiting // default value, if not changed below
  1855  	defer func() {
  1856  		pc.CloseWithError(closeErr)
  1857  		if pc.internalStateHook != nil {
  1858  			pc.internalStateHook()
  1859  		}
  1860  	}()
  1861  
  1862  	tryPutIdleConn := func() bool {
  1863  		if err := pc.roundTripDone(); err != nil {
  1864  			closeErr = err
  1865  			return false
  1866  		}
  1867  		return true
  1868  	}
  1869  
  1870  	// eofc is used to block caller goroutines reading from Response.Body
  1871  	// at EOF until this goroutines has (potentially) added the connection
  1872  	// back to the idle pool.
  1873  	//
  1874  	// (We also use this channel to coordinate bodyless responses with RoundTrip,
  1875  	// see waitc below.)
  1876  	eofc := make(chan struct{})
  1877  	defer close(eofc) // unblock reader on errors
  1878  
  1879  	// Read this once, before loop starts. (to avoid races in tests)
  1880  	testHookMu.Lock()
  1881  	testHookReadLoopBeforeNextRead := testHookReadLoopBeforeNextRead
  1882  	testHookMu.Unlock()
  1883  
  1884  	alive := true
  1885  	for alive {
  1886  		pc.readLimit = pc.maxHeaderResponseSize()
  1887  		_, err := pc.br.Peek(1)
  1888  
  1889  		pc.mu.Lock()
  1890  		if pc.numExpectedResponses == 0 {
  1891  			pc.readLoopPeekFailLocked(err)
  1892  			pc.mu.Unlock()
  1893  			return
  1894  		}
  1895  		pc.mu.Unlock()
  1896  
  1897  		rc := <-pc.reqch
  1898  		trace := rc.treq.trace
  1899  
  1900  		var resp *Response
  1901  		if err == nil {
  1902  			resp, err = pc.readResponse(rc, trace)
  1903  		} else {
  1904  			err = transportReadFromServerError{err}
  1905  			closeErr = err
  1906  		}
  1907  
  1908  		if err != nil {
  1909  			if pc.readLimit <= 0 {
  1910  				err = fmt.Errorf("net/http: server response headers exceeded %d bytes; aborted", pc.maxHeaderResponseSize())
  1911  			}
  1912  
  1913  			select {
  1914  			case rc.ch <- responseAndError{err: err}:
  1915  			case <-rc.callerGone:
  1916  				return
  1917  			}
  1918  			return
  1919  		}
  1920  		pc.readLimit = maxInt64 // effectively no limit for response bodies
  1921  
  1922  		pc.mu.Lock()
  1923  		pc.numExpectedResponses--
  1924  		pc.mu.Unlock()
  1925  
  1926  		bodyWritable := resp.bodyIsWritable()
  1927  		isConnect := rc.treq.Request.Method == "CONNECT"
  1928  		hasBody := rc.treq.Request.Method != "HEAD" && resp.ContentLength != 0
  1929  
  1930  		if resp.Close || rc.treq.Request.Close || resp.StatusCode <= 199 || bodyWritable || isConnect {
  1931  			// Don't do keep-alive on error if either party requested a close
  1932  			// or we get an unexpected informational (1xx) response.
  1933  			// StatusCode 100 is already handled above.
  1934  			//
  1935  			// Don't do keep-alive after sending a CONNECT request.
  1936  			// Only a 2xx response converts the connection into a tunnel,
  1937  			// but for safety we'll drop the connection even after getting a non-2xx.
  1938  			alive = false
  1939  		}
  1940  
  1941  		if !hasBody || bodyWritable {
  1942  			// Three things need to happen, in order:
  1943  			//
  1944  			// 1. Notify roundTrip that we have a response.
  1945  			// 2. Put the now-idle conn back into the pool.
  1946  			//    This must happen after notifying roundTrip, because returning
  1947  			//    the connection to the pool could close the connection,
  1948  			//    causing roundTrip to return an error.
  1949  			// 3. roundTrip returns.
  1950  			//    This must happen after putting the conn back into the pool,
  1951  			//    so if the caller starts a new request they can reuse this conn.
  1952  			//
  1953  			// We send roundTrip a channel to wait on, which we will signal
  1954  			// once the conn is back in the pool (or possibly closed).
  1955  			waitc := eofc // no body, never going to use eofc
  1956  			select {
  1957  			case rc.ch <- responseAndError{res: resp, waitc: waitc}:
  1958  			case <-rc.callerGone:
  1959  				return
  1960  			}
  1961  
  1962  			// Put the idle conn back into the pool before roundTrip returns the
  1963  			// response to its caller.
  1964  			alive = alive &&
  1965  				!pc.sawEOF &&
  1966  				pc.wroteRequest() &&
  1967  				tryPutIdleConn()
  1968  			if bodyWritable {
  1969  				closeErr = errCallerOwnsConn
  1970  			}
  1971  			rc.treq.cancel(errRequestDone)
  1972  
  1973  			// Tell roundTrip that we've put the conn back into the pool.
  1974  			waitc <- struct{}{}
  1975  
  1976  			// Now that they've read from the unbuffered channel, they're safely
  1977  			// out of the select that also waits on this goroutine to die, so
  1978  			// we're allowed to exit now if needed (if alive is false)
  1979  			testHookReadLoopBeforeNextRead()
  1980  			continue
  1981  		}
  1982  
  1983  		waitForBodyRead := make(chan bodyReadStatus, 1)
  1984  		body := &bodyEOFSignal{
  1985  			body: resp.Body,
  1986  			earlyCloseFn: func() error {
  1987  				waitForBodyRead <- bodyReadClosedEarly
  1988  				<-eofc // will be closed by deferred call at the end of the function
  1989  				return nil
  1990  			},
  1991  			fn: func(err error) error {
  1992  				if err == io.EOF {
  1993  					waitForBodyRead <- bodyReadEOF
  1994  					<-eofc // see comment above eofc declaration
  1995  				} else {
  1996  					waitForBodyRead <- bodyReadError
  1997  					if err != nil {
  1998  						if cerr := pc.canceled(); cerr != nil {
  1999  							return cerr
  2000  						}
  2001  					}
  2002  				}
  2003  				return err
  2004  			},
  2005  		}
  2006  
  2007  		resp.Body = body
  2008  		if rc.addedGzip && ascii.EqualFold(resp.Header.Get("Content-Encoding"), "gzip") {
  2009  			resp.Body = &httpcommon.GzipReader{Body: body}
  2010  			resp.Header.Del("Content-Encoding")
  2011  			resp.Header.Del("Content-Length")
  2012  			resp.ContentLength = -1
  2013  			resp.Uncompressed = true
  2014  		}
  2015  
  2016  		select {
  2017  		case rc.ch <- responseAndError{res: resp}:
  2018  		case <-rc.callerGone:
  2019  			return
  2020  		}
  2021  
  2022  		// Before looping back to the top of this function and peeking on
  2023  		// the bufio.Reader, wait for the caller goroutine to finish
  2024  		// reading the response body. (or for cancellation or death)
  2025  		select {
  2026  		case status := <-waitForBodyRead:
  2027  			tryPutIdle := func() {
  2028  				alive = alive &&
  2029  					!pc.sawEOF &&
  2030  					pc.wroteRequest() &&
  2031  					tryPutIdleConn()
  2032  			}
  2033  			switch status {
  2034  			case bodyReadEOF:
  2035  				tryPutIdle()
  2036  				eofc <- struct{}{}
  2037  			case bodyReadClosedEarly:
  2038  				// Read resp before signaling eofc: the send lets the caller's
  2039  				// Close return, and resp belongs to the caller after that.
  2040  				tryDrain := alive && !pc.t.keepAlivesDisabled() && resp.ContentLength <= maxPostCloseReadBytes
  2041  				eofc <- struct{}{}
  2042  				if tryDrain && maybeDrainBody(body.body) {
  2043  					tryPutIdle()
  2044  				} else {
  2045  					alive = false
  2046  				}
  2047  			case bodyReadError:
  2048  				alive = false
  2049  			}
  2050  		case <-rc.treq.ctx.Done():
  2051  			alive = false
  2052  			pc.cancelRequest(context.Cause(rc.treq.ctx))
  2053  		case <-pc.closech:
  2054  			alive = false
  2055  		}
  2056  
  2057  		rc.treq.cancel(errRequestDone)
  2058  		testHookReadLoopBeforeNextRead()
  2059  	}
  2060  }
  2061  
  2062  func (pc *persistConn) readLoopPeekFailLocked(peekErr error) {
  2063  	if pc.closed != nil {
  2064  		return
  2065  	}
  2066  	if n := pc.br.Buffered(); n > 0 {
  2067  		buf, _ := pc.br.Peek(n)
  2068  		if is408Message(buf) {
  2069  			pc.closeLocked(errServerClosedIdle)
  2070  			return
  2071  		} else {
  2072  			log.Printf("Unsolicited response received on idle HTTP channel starting with %q; err=%v", buf, peekErr)
  2073  		}
  2074  	}
  2075  	if peekErr == io.EOF {
  2076  		// common case.
  2077  		pc.closeLocked(errServerClosedIdle)
  2078  	} else {
  2079  		pc.closeLocked(fmt.Errorf("readLoopPeekFailLocked: %w", peekErr))
  2080  	}
  2081  }
  2082  
  2083  // is408Message reports whether buf has the prefix of an
  2084  // HTTP 408 Request Timeout response.
  2085  // See golang.org/issue/32310.
  2086  func is408Message(buf []byte) bool {
  2087  	if len(buf) < len("HTTP/1.x 408") {
  2088  		return false
  2089  	}
  2090  	if string(buf[:7]) != "HTTP/1." {
  2091  		return false
  2092  	}
  2093  	return string(buf[8:12]) == " 408"
  2094  }
  2095  
  2096  // readResponse reads an HTTP response (or two, in the case of "Expect:
  2097  // 100-continue") from the server. It returns the final non-100 one.
  2098  // trace is optional.
  2099  func (pc *persistConn) readResponse(rc requestAndChan, trace *httptrace.ClientTrace) (resp *Response, err error) {
  2100  	if trace != nil && trace.GotFirstResponseByte != nil {
  2101  		if peek, err := pc.br.Peek(1); err == nil && len(peek) == 1 {
  2102  			trace.GotFirstResponseByte()
  2103  		}
  2104  	}
  2105  
  2106  	continueCh := rc.continueCh
  2107  	for {
  2108  		resp, err = ReadResponse(pc.br, rc.treq.Request)
  2109  		if err != nil {
  2110  			return
  2111  		}
  2112  		resCode := resp.StatusCode
  2113  		if continueCh != nil && resCode == StatusContinue {
  2114  			if trace != nil && trace.Got100Continue != nil {
  2115  				trace.Got100Continue()
  2116  			}
  2117  			continueCh <- struct{}{}
  2118  			continueCh = nil
  2119  		}
  2120  		is1xx := 100 <= resCode && resCode <= 199
  2121  		// treat 101 as a terminal status, see issue 26161
  2122  		is1xxNonTerminal := is1xx && resCode != StatusSwitchingProtocols
  2123  		if is1xxNonTerminal {
  2124  			if trace != nil && trace.Got1xxResponse != nil {
  2125  				if err := trace.Got1xxResponse(resCode, textproto.MIMEHeader(resp.Header)); err != nil {
  2126  					return nil, err
  2127  				}
  2128  				// If the 1xx response was delivered to the user,
  2129  				// then they're responsible for limiting the number of
  2130  				// responses. Reset the header limit.
  2131  				//
  2132  				// If the user didn't examine the 1xx response, then we
  2133  				// limit the size of all headers (including both 1xx
  2134  				// and the final response) to maxHeaderResponseSize.
  2135  				pc.readLimit = pc.maxHeaderResponseSize() // reset the limit
  2136  			}
  2137  			continue
  2138  		}
  2139  		break
  2140  	}
  2141  	if resp.isProtocolSwitch() && isProtocolSwitchHeader(rc.treq.Request.Header) {
  2142  		resp.Body = newReadWriteCloserBody(pc.br, pc.conn)
  2143  	}
  2144  	if continueCh != nil {
  2145  		// We send an "Expect: 100-continue" header, but the server
  2146  		// responded with a terminal status and no 100 Continue.
  2147  		//
  2148  		// If we're going to keep using the connection, we need to send the request body.
  2149  		// Tell writeLoop to skip sending the body if we're going to close the connection,
  2150  		// or to send it otherwise.
  2151  		//
  2152  		// The case where we receive a 101 Switching Protocols response is a bit
  2153  		// ambiguous, since we don't know what protocol we're switching to.
  2154  		// Conceivably, it's one that doesn't need us to send the body.
  2155  		// Given that we'll send the body if ExpectContinueTimeout expires,
  2156  		// be consistent and always send it if we aren't closing the connection.
  2157  		if resp.Close || rc.treq.Request.Close {
  2158  			close(continueCh) // don't send the body; the connection will close
  2159  		} else {
  2160  			continueCh <- struct{}{} // send the body
  2161  		}
  2162  	}
  2163  
  2164  	resp.TLS = pc.tlsState
  2165  	return
  2166  }
  2167  
  2168  // waitForContinue returns the function to block until
  2169  // any response, timeout or connection close. After any of them,
  2170  // the function returns a bool which indicates if the body should be sent.
  2171  func (pc *persistConn) waitForContinue(continueCh <-chan struct{}) func() bool {
  2172  	if continueCh == nil {
  2173  		return nil
  2174  	}
  2175  	return func() bool {
  2176  		timer := time.NewTimer(pc.t.ExpectContinueTimeout)
  2177  		defer timer.Stop()
  2178  
  2179  		select {
  2180  		case _, ok := <-continueCh:
  2181  			return ok
  2182  		case <-timer.C:
  2183  			return true
  2184  		case <-pc.closech:
  2185  			return false
  2186  		}
  2187  	}
  2188  }
  2189  
  2190  func newReadWriteCloserBody(br *bufio.Reader, rwc io.ReadWriteCloser) io.ReadWriteCloser {
  2191  	body := &readWriteCloserBody{ReadWriteCloser: rwc}
  2192  	if br.Buffered() != 0 {
  2193  		body.br = br
  2194  	}
  2195  	return body
  2196  }
  2197  
  2198  // readWriteCloserBody is the Response.Body type used when we want to
  2199  // give users write access to the Body through the underlying
  2200  // connection (TCP, unless using custom dialers). This is then
  2201  // the concrete type for a Response.Body on the 101 Switching
  2202  // Protocols response, as used by WebSockets, h2c, etc.
  2203  type readWriteCloserBody struct {
  2204  	_  incomparable
  2205  	br *bufio.Reader // used until empty
  2206  	io.ReadWriteCloser
  2207  }
  2208  
  2209  func (b *readWriteCloserBody) Read(p []byte) (n int, err error) {
  2210  	if b.br != nil {
  2211  		if n := b.br.Buffered(); len(p) > n {
  2212  			p = p[:n]
  2213  		}
  2214  		n, err = b.br.Read(p)
  2215  		if b.br.Buffered() == 0 {
  2216  			b.br = nil
  2217  		}
  2218  		return n, err
  2219  	}
  2220  	return b.ReadWriteCloser.Read(p)
  2221  }
  2222  
  2223  func (b *readWriteCloserBody) CloseWrite() error {
  2224  	if cw, ok := b.ReadWriteCloser.(interface{ CloseWrite() error }); ok {
  2225  		return cw.CloseWrite()
  2226  	}
  2227  	return fmt.Errorf("CloseWrite: %w", ErrNotSupported)
  2228  }
  2229  
  2230  // nothingWrittenError wraps a write errors which ended up writing zero bytes.
  2231  type nothingWrittenError struct {
  2232  	error
  2233  }
  2234  
  2235  func (nwe nothingWrittenError) Unwrap() error {
  2236  	return nwe.error
  2237  }
  2238  
  2239  func (pc *persistConn) writeLoop() {
  2240  	defer close(pc.writeLoopDone)
  2241  	for {
  2242  		select {
  2243  		case wr := <-pc.writech:
  2244  			startBytesWritten := pc.nwrite
  2245  			err := wr.req.Request.write(pc.bw, pc.isProxy, wr.req.extra, pc.waitForContinue(wr.continueCh))
  2246  			if bre, ok := err.(requestBodyReadError); ok {
  2247  				err = bre.error
  2248  				// Errors reading from the user's
  2249  				// Request.Body are high priority.
  2250  				// Set it here before sending on the
  2251  				// channels below or calling
  2252  				// pc.close() which tears down
  2253  				// connections and causes other
  2254  				// errors.
  2255  				wr.req.setError(err)
  2256  			}
  2257  			if err == nil {
  2258  				err = pc.bw.Flush()
  2259  			}
  2260  			if err != nil {
  2261  				if pc.nwrite == startBytesWritten {
  2262  					err = nothingWrittenError{err}
  2263  				}
  2264  			}
  2265  			pc.writeErrCh <- err // to the body reader, which might recycle us
  2266  			wr.ch <- err         // to the roundTrip function
  2267  			if err != nil {
  2268  				// The conn will be closed by either roundTrip or readLoop.
  2269  				return
  2270  			}
  2271  		case <-pc.closech:
  2272  			return
  2273  		}
  2274  	}
  2275  }
  2276  
  2277  // maxWriteWaitBeforeConnReuse is how long the a Transport RoundTrip
  2278  // will wait to see the Request's Body.Write result after getting a
  2279  // response from the server. See comments in (*persistConn).wroteRequest.
  2280  //
  2281  // In tests, we set this to a large value to avoid flakiness from inconsistent
  2282  // recycling of connections.
  2283  var maxWriteWaitBeforeConnReuse = 50 * time.Millisecond
  2284  
  2285  // wroteRequest is a check before recycling a connection that the previous write
  2286  // (from writeLoop above) happened and was successful.
  2287  func (pc *persistConn) wroteRequest() bool {
  2288  	select {
  2289  	case err := <-pc.writeErrCh:
  2290  		// Common case: the write happened well before the response, so
  2291  		// avoid creating a timer.
  2292  		return err == nil
  2293  	default:
  2294  		// Rare case: the request was written in writeLoop above but
  2295  		// before it could send to pc.writeErrCh, the reader read it
  2296  		// all, processed it, and called us here. In this case, give the
  2297  		// write goroutine a bit of time to finish its send.
  2298  		//
  2299  		// Less rare case: We also get here in the legitimate case of
  2300  		// Issue 7569, where the writer is still writing (or stalled),
  2301  		// but the server has already replied. In this case, we don't
  2302  		// want to wait too long, and we want to return false so this
  2303  		// connection isn't re-used.
  2304  		t := time.NewTimer(maxWriteWaitBeforeConnReuse)
  2305  		defer t.Stop()
  2306  		select {
  2307  		case err := <-pc.writeErrCh:
  2308  			return err == nil
  2309  		case <-t.C:
  2310  			return false
  2311  		}
  2312  	}
  2313  }
  2314  
  2315  // responseAndError is how the goroutine reading from an HTTP/1 server
  2316  // communicates with the goroutine doing the RoundTrip.
  2317  type responseAndError struct {
  2318  	_     incomparable
  2319  	res   *Response       // else use this response (see res method)
  2320  	waitc <-chan struct{} // read from this before returning from RoundTrip (see readLoop)
  2321  	err   error
  2322  }
  2323  
  2324  type requestAndChan struct {
  2325  	_    incomparable
  2326  	treq *transportRequest
  2327  	ch   chan responseAndError // unbuffered; always send in select on callerGone
  2328  
  2329  	// whether the Transport (as opposed to the user client code)
  2330  	// added the Accept-Encoding gzip header. If the Transport
  2331  	// set it, only then do we transparently decode the gzip.
  2332  	addedGzip bool
  2333  
  2334  	// Optional blocking chan for Expect: 100-continue (for send).
  2335  	// If the request has an "Expect: 100-continue" header and
  2336  	// the server responds 100 Continue, readLoop send a value
  2337  	// to writeLoop via this chan.
  2338  	continueCh chan<- struct{}
  2339  
  2340  	callerGone <-chan struct{} // closed when roundTrip caller has returned
  2341  }
  2342  
  2343  // A writeRequest is sent by the caller's goroutine to the
  2344  // writeLoop's goroutine to write a request while the read loop
  2345  // concurrently waits on both the write response and the server's
  2346  // reply.
  2347  type writeRequest struct {
  2348  	req *transportRequest
  2349  	ch  chan<- error
  2350  
  2351  	// Optional blocking chan for Expect: 100-continue (for receive).
  2352  	// If not nil, writeLoop blocks sending request body until
  2353  	// it receives from this chan.
  2354  	continueCh <-chan struct{}
  2355  }
  2356  
  2357  // httpTimeoutError represents a timeout.
  2358  // It implements net.Error and wraps context.DeadlineExceeded.
  2359  type timeoutError struct {
  2360  	err string
  2361  }
  2362  
  2363  func (e *timeoutError) Error() string     { return e.err }
  2364  func (e *timeoutError) Timeout() bool     { return true }
  2365  func (e *timeoutError) Temporary() bool   { return true }
  2366  func (e *timeoutError) Is(err error) bool { return err == context.DeadlineExceeded }
  2367  
  2368  var errTimeout error = &timeoutError{"net/http: timeout awaiting response headers"}
  2369  
  2370  // errRequestCanceled is set to be identical to the one from h2 to facilitate
  2371  // testing.
  2372  var errRequestCanceled = internal.ErrRequestCanceled
  2373  var errRequestCanceledConn = errors.New("net/http: request canceled while waiting for connection") // TODO: unify?
  2374  
  2375  // errRequestDone is used to cancel the round trip Context after a request is successfully done.
  2376  // It should not be seen by the user.
  2377  var errRequestDone = errors.New("net/http: request completed")
  2378  
  2379  func nop() {}
  2380  
  2381  // testHooks. Always non-nil.
  2382  var (
  2383  	testHookEnterRoundTrip   = nop
  2384  	testHookWaitResLoop      = nop
  2385  	testHookRoundTripRetried = nop
  2386  
  2387  	testHookMu                     sync.Locker = fakeLocker{} // guards following
  2388  	testHookReadLoopBeforeNextRead             = nop
  2389  )
  2390  
  2391  var (
  2392  	testHookPrePendingDial  func()
  2393  	testHookPostPendingDial func()
  2394  )
  2395  
  2396  func (pc *persistConn) waitForAvailability(ctx context.Context) error {
  2397  	select {
  2398  	case <-pc.availch:
  2399  		return nil
  2400  	case <-pc.closech:
  2401  		return pc.closed
  2402  	case <-ctx.Done():
  2403  		return ctx.Err()
  2404  	}
  2405  }
  2406  
  2407  const postRequestWriteErrorWaitTime = 50 * time.Millisecond
  2408  
  2409  func (pc *persistConn) roundTrip(req *transportRequest) (resp *Response, err error) {
  2410  	testHookEnterRoundTrip()
  2411  
  2412  	pc.mu.Lock()
  2413  	if !pc.reserved {
  2414  		select {
  2415  		case <-pc.availch:
  2416  		default:
  2417  			pc.mu.Unlock()
  2418  			if err := pc.waitForAvailability(req.ctx); err != nil {
  2419  				return nil, err
  2420  			}
  2421  			pc.mu.Lock()
  2422  		}
  2423  	}
  2424  	pc.reserved = false
  2425  	pc.inFlight = true
  2426  	pc.numExpectedResponses++
  2427  	headerFn := pc.mutateHeaderFunc
  2428  	pc.mu.Unlock()
  2429  
  2430  	if headerFn != nil {
  2431  		headerFn(req.extraHeaders())
  2432  	}
  2433  
  2434  	// Ask for a compressed version if the caller didn't set their
  2435  	// own value for Accept-Encoding. We only attempt to
  2436  	// uncompress the gzip stream if we were the layer that
  2437  	// requested it.
  2438  	requestedGzip := false
  2439  	if !pc.t.DisableCompression &&
  2440  		req.Header.Get("Accept-Encoding") == "" &&
  2441  		req.Header.Get("Range") == "" &&
  2442  		req.Method != "HEAD" {
  2443  		// Request gzip only, not deflate. Deflate is ambiguous and
  2444  		// not as universally supported anyway.
  2445  		// See: https://zlib.net/zlib_faq.html#faq39
  2446  		//
  2447  		// Note that we don't request this for HEAD requests,
  2448  		// due to a bug in nginx:
  2449  		//   https://trac.nginx.org/nginx/ticket/358
  2450  		//   https://golang.org/issue/5522
  2451  		//
  2452  		// We don't request gzip if the request is for a range, since
  2453  		// auto-decoding a portion of a gzipped document will just fail
  2454  		// anyway. See https://golang.org/issue/8923
  2455  		requestedGzip = true
  2456  		req.extraHeaders().Set("Accept-Encoding", "gzip")
  2457  	}
  2458  
  2459  	var continueCh chan struct{}
  2460  	if req.ProtoAtLeast(1, 1) && req.Body != nil && req.expectsContinue() {
  2461  		continueCh = make(chan struct{}, 1)
  2462  	}
  2463  
  2464  	if pc.t.DisableKeepAlives &&
  2465  		!req.wantsClose() &&
  2466  		!isProtocolSwitchHeader(req.Header) {
  2467  		req.extraHeaders().Set("Connection", "close")
  2468  	}
  2469  
  2470  	gone := make(chan struct{})
  2471  	defer close(gone)
  2472  
  2473  	const debugRoundTrip = false
  2474  
  2475  	// Write the request concurrently with waiting for a response,
  2476  	// in case the server decides to reply before reading our full
  2477  	// request body.
  2478  	startBytesWritten := pc.nwrite
  2479  	writeErrCh := make(chan error, 1)
  2480  	pc.writech <- writeRequest{req, writeErrCh, continueCh}
  2481  
  2482  	resc := make(chan responseAndError)
  2483  	pc.reqch <- requestAndChan{
  2484  		treq:       req,
  2485  		ch:         resc,
  2486  		addedGzip:  requestedGzip,
  2487  		continueCh: continueCh,
  2488  		callerGone: gone,
  2489  	}
  2490  
  2491  	handleResponse := func(re responseAndError) (*Response, error) {
  2492  		if (re.res == nil) == (re.err == nil) {
  2493  			panic(fmt.Sprintf("internal error: exactly one of res or err should be set; nil=%v", re.res == nil))
  2494  		}
  2495  		if debugRoundTrip {
  2496  			req.logf("resc recv: %p, %T/%#v", re.res, re.err, re.err)
  2497  		}
  2498  		if re.waitc != nil {
  2499  			<-re.waitc
  2500  		}
  2501  		if re.err != nil {
  2502  			return nil, pc.mapRoundTripError(req, startBytesWritten, re.err)
  2503  		}
  2504  		return re.res, nil
  2505  	}
  2506  
  2507  	var writeErr error
  2508  	var respHeaderTimer <-chan time.Time
  2509  	ctxDoneChan := req.ctx.Done()
  2510  	pcClosed := pc.closech
  2511  	for {
  2512  		testHookWaitResLoop()
  2513  		select {
  2514  		case err := <-writeErrCh:
  2515  			if debugRoundTrip {
  2516  				req.logf("writeErrCh recv: %T/%#v", err, err)
  2517  			}
  2518  			timeout := pc.t.ResponseHeaderTimeout
  2519  			if err != nil {
  2520  				// If this is something other than a network write error
  2521  				// (presumably an error reading from the user-provided body),
  2522  				// then return immediately.
  2523  				//
  2524  				// Otherwise, it's possible that the server sent a response
  2525  				// and immediately closed the connection. Wait for a short
  2526  				// time to see if a response shows up.
  2527  				//
  2528  				// See #11745.
  2529  				if _, ok := errors.AsType[*net.OpError](err); !ok {
  2530  					pc.CloseWithError(fmt.Errorf("write error: %w", err))
  2531  					return nil, pc.mapRoundTripError(req, startBytesWritten, err)
  2532  				}
  2533  				writeErr = err
  2534  				if timeout == 0 {
  2535  					timeout = postRequestWriteErrorWaitTime
  2536  				} else {
  2537  					timeout = min(timeout, postRequestWriteErrorWaitTime)
  2538  				}
  2539  			}
  2540  			if timeout > 0 {
  2541  				if debugRoundTrip {
  2542  					req.logf("starting timer for %v", timeout)
  2543  				}
  2544  				timer := time.NewTimer(timeout)
  2545  				respHeaderTimer = timer.C
  2546  			}
  2547  		case <-pcClosed:
  2548  			select {
  2549  			case re := <-resc:
  2550  				// The pconn closing raced with the response to the request,
  2551  				// probably after the server wrote a response and immediately
  2552  				// closed the connection. Use the response.
  2553  				return handleResponse(re)
  2554  			default:
  2555  			}
  2556  			if debugRoundTrip {
  2557  				req.logf("closech recv: %T %#v", pc.closed, pc.closed)
  2558  			}
  2559  			return nil, pc.mapRoundTripError(req, startBytesWritten, pc.closed)
  2560  		case <-respHeaderTimer:
  2561  			if debugRoundTrip {
  2562  				req.logf("timeout waiting for response headers.")
  2563  			}
  2564  			if writeErr != nil {
  2565  				// Error writing request body, and we haven't read response
  2566  				// headers within postRequestWriteErrorWaitTime.
  2567  				pc.CloseWithError(fmt.Errorf("write error: %w", writeErr))
  2568  				return nil, pc.mapRoundTripError(req, startBytesWritten, writeErr)
  2569  			}
  2570  			pc.CloseWithError(errTimeout)
  2571  			return nil, errTimeout
  2572  		case re := <-resc:
  2573  			return handleResponse(re)
  2574  		case <-ctxDoneChan:
  2575  			select {
  2576  			case re := <-resc:
  2577  				// readLoop is responsible for canceling req.ctx after
  2578  				// it reads the response body. Check for a response racing
  2579  				// the context close, and use the response if available.
  2580  				return handleResponse(re)
  2581  			default:
  2582  			}
  2583  			pc.cancelRequest(context.Cause(req.ctx))
  2584  		}
  2585  	}
  2586  }
  2587  
  2588  // tLogKey is a context WithValue key for test debugging contexts containing
  2589  // a t.Logf func. See export_test.go's Request.WithT method.
  2590  type tLogKey struct{}
  2591  
  2592  func (tr *transportRequest) logf(format string, args ...any) {
  2593  	if logf, ok := tr.Request.Context().Value(tLogKey{}).(func(string, ...any)); ok {
  2594  		logf(time.Now().Format(time.RFC3339Nano)+": "+format, args...)
  2595  	}
  2596  }
  2597  
  2598  // CloseWithError closes the underlying TCP connection and closes
  2599  // the pc.closech channel.
  2600  //
  2601  // The provided err is only for testing and debugging; in normal
  2602  // circumstances it should never be seen by users.
  2603  func (pc *persistConn) CloseWithError(err error) {
  2604  	pc.mu.Lock()
  2605  	defer pc.mu.Unlock()
  2606  	pc.closeLocked(err)
  2607  }
  2608  
  2609  func (pc *persistConn) closeLocked(err error) {
  2610  	if err == nil {
  2611  		panic("nil error")
  2612  	}
  2613  	if pc.closed == nil {
  2614  		pc.closed = err
  2615  		if err != errCallerOwnsConn {
  2616  			pc.conn.Close()
  2617  		}
  2618  		close(pc.closech)
  2619  	}
  2620  	pc.mutateHeaderFunc = nil
  2621  }
  2622  
  2623  func schemePort(scheme string) string {
  2624  	switch scheme {
  2625  	case "http":
  2626  		return "80"
  2627  	case "https":
  2628  		return "443"
  2629  	case "socks5", "socks5h":
  2630  		return "1080"
  2631  	default:
  2632  		return ""
  2633  	}
  2634  }
  2635  
  2636  func idnaASCIIFromURL(url *url.URL) string {
  2637  	addr := url.Hostname()
  2638  	if v, err := idnaASCII(addr); err == nil && v != "" {
  2639  		addr = v
  2640  	}
  2641  	return addr
  2642  }
  2643  
  2644  // canonicalAddr returns url.Host but always with a ":port" suffix.
  2645  func canonicalAddr(url *url.URL) string {
  2646  	port := url.Port()
  2647  	if port == "" {
  2648  		port = schemePort(url.Scheme)
  2649  	}
  2650  	return net.JoinHostPort(idnaASCIIFromURL(url), port)
  2651  }
  2652  
  2653  // bodyEOFSignal is used by the HTTP/1 transport when reading response
  2654  // bodies to make sure we see the end of a response body before
  2655  // proceeding and reading on the connection again.
  2656  //
  2657  // It wraps a ReadCloser but runs fn (if non-nil) at most
  2658  // once, right before its final (error-producing) Read or Close call
  2659  // returns. fn should return the new error to return from Read or Close.
  2660  //
  2661  // If earlyCloseFn is non-nil and Close is called before any final error from
  2662  // Read is seen, earlyCloseFn is called instead of fn, and its return value is
  2663  // the return value from Close.
  2664  type bodyEOFSignal struct {
  2665  	body         io.ReadCloser
  2666  	mu           sync.Mutex        // guards following 4 fields
  2667  	closed       bool              // whether Close has been called
  2668  	rerr         error             // sticky Read error
  2669  	fn           func(error) error // called on final body.Read non-nil error (or body.Close if earlyCloseFn is not run)
  2670  	earlyCloseFn func() error      // called if body.Close is called before body.Read ever returns a non-nil error
  2671  }
  2672  
  2673  var errReadOnClosedResBody = errors.New("http: read on closed response body")
  2674  
  2675  func (es *bodyEOFSignal) Read(p []byte) (n int, err error) {
  2676  	es.mu.Lock()
  2677  	closed, rerr := es.closed, es.rerr
  2678  	es.mu.Unlock()
  2679  	if closed {
  2680  		return 0, errReadOnClosedResBody
  2681  	}
  2682  	if rerr != nil {
  2683  		return 0, rerr
  2684  	}
  2685  
  2686  	n, err = es.body.Read(p)
  2687  	if err != nil {
  2688  		es.mu.Lock()
  2689  		defer es.mu.Unlock()
  2690  		if es.rerr == nil {
  2691  			es.rerr = err
  2692  		}
  2693  		err = es.condfn(err)
  2694  	}
  2695  	return
  2696  }
  2697  
  2698  func (es *bodyEOFSignal) Close() error {
  2699  	es.mu.Lock()
  2700  	defer es.mu.Unlock()
  2701  	if es.closed {
  2702  		return nil
  2703  	}
  2704  	es.closed = true
  2705  	if es.earlyCloseFn != nil && es.rerr == nil {
  2706  		earlyCloseFn := es.earlyCloseFn
  2707  		es.earlyCloseFn = nil
  2708  		es.fn = nil
  2709  		return earlyCloseFn()
  2710  	}
  2711  	if es.rerr != nil && es.rerr != io.EOF {
  2712  		// Read already returned this error and readLoop gave up the
  2713  		// connection. Draining would only read the same error again.
  2714  		return nil
  2715  	}
  2716  	err := es.body.Close()
  2717  	return es.condfn(err)
  2718  }
  2719  
  2720  // caller must hold es.mu.
  2721  func (es *bodyEOFSignal) condfn(err error) error {
  2722  	if es.fn == nil {
  2723  		return err
  2724  	}
  2725  	fn := es.fn
  2726  	es.fn = nil
  2727  	es.earlyCloseFn = nil
  2728  	return fn(err)
  2729  }
  2730  
  2731  type tlsHandshakeTimeoutError struct{}
  2732  
  2733  func (tlsHandshakeTimeoutError) Timeout() bool   { return true }
  2734  func (tlsHandshakeTimeoutError) Temporary() bool { return true }
  2735  func (tlsHandshakeTimeoutError) Error() string   { return "net/http: TLS handshake timeout" }
  2736  
  2737  // fakeLocker is a sync.Locker which does nothing. It's used to guard
  2738  // test-only fields when not under test, to avoid runtime atomic
  2739  // overhead.
  2740  type fakeLocker struct{}
  2741  
  2742  func (fakeLocker) Lock()   {}
  2743  func (fakeLocker) Unlock() {}
  2744  
  2745  // cloneTLSConfig returns a shallow clone of cfg, or a new zero tls.Config if
  2746  // cfg is nil. This is safe to call even if cfg is in active use by a TLS
  2747  // client or server.
  2748  //
  2749  // cloneTLSConfig should be an internal detail,
  2750  // but widely used packages access it using linkname.
  2751  // Notable members of the hall of shame include:
  2752  //   - github.com/searKing/golang
  2753  //
  2754  // Do not remove or change the type signature.
  2755  // See go.dev/issue/67401.
  2756  //
  2757  //go:linkname cloneTLSConfig
  2758  func cloneTLSConfig(cfg *tls.Config) *tls.Config {
  2759  	if cfg == nil {
  2760  		return &tls.Config{}
  2761  	}
  2762  	return cfg.Clone()
  2763  }
  2764  

View as plain text