NGHTTP2: Update to 1.8.0

Change-Id: Ic818b7df95c9812076303f613b0641b9e702b62e
Reviewed-on: https://code.wireshark.org/review/14562
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>

5 files changed, 596 insertions, 37 deletions

diff --git a/epan/nghttp2/nghttp2.h b/epan/nghttp2/nghttp2.h
index 5a6a53a480..87472fa9ad 100644
--- a/epan/nghttp2/nghttp2.h
+++ b/epan/nghttp2/nghttp2.h
@@ -395,6 +395,10 @@ typedef enum {
    */
   NGHTTP2_ERR_INTERNAL = -534,
   /**
+   * Indicates that a processing was canceled.
+   */
+  NGHTTP2_ERR_CANCEL = -535,
+  /**
    * The errors < :enum:`NGHTTP2_ERR_FATAL` mean that the library is
    * under unexpected condition and processing was terminated (e.g.,
    * out of memory).  If application receives this error code, it must
@@ -760,7 +764,7 @@ typedef enum {
   /**
    * Indicates that END_STREAM flag must not be set even if
    * NGHTTP2_DATA_FLAG_EOF is set.  Usually this flag is used to send
-   * trailer header fields with `nghttp2_submit_request()` or
+   * trailer fields with `nghttp2_submit_request()` or
    * `nghttp2_submit_response()`.
    */
   NGHTTP2_DATA_FLAG_NO_END_STREAM = 0x02,
@@ -796,13 +800,13 @@ typedef enum {
  * :enum:`NGHTTP2_FLAG_END_STREAM` set, and
  * :enum:`NGHTTP2_DATA_FLAG_EOF` flag is set to |*data_flags|, DATA
  * frame will have END_STREAM flag set.  Usually, this is expected
- * behaviour and all are fine.  One exception is send trailer header
- * fields.  You cannot send trailers after sending frame with
- * END_STREAM set.  To avoid this problem, one can set
+ * behaviour and all are fine.  One exception is send trailer fields.
+ * You cannot send trailer fields after sending frame with END_STREAM
+ * set.  To avoid this problem, one can set
  * :enum:`NGHTTP2_DATA_FLAG_NO_END_STREAM` along with
  * :enum:`NGHTTP2_DATA_FLAG_EOF` to signal the library not to set
  * END_STREAM in DATA frame.  Then application can use
- * `nghttp2_submit_trailer()` to send trailers.
+ * `nghttp2_submit_trailer()` to send trailer fields.
  * `nghttp2_submit_trailer()` can be called inside this callback.
  *
  * If the application wants to postpone DATA frames (e.g.,
@@ -861,9 +865,9 @@ typedef struct {
  *
  * The category of HEADERS, which indicates the role of the frame.  In
  * HTTP/2 spec, request, response, push response and other arbitrary
- * headers (e.g., trailers) are all called just HEADERS.  To give the
- * application the role of incoming HEADERS frame, we define several
- * categories.
+ * headers (e.g., trailer fields) are all called just HEADERS.  To
+ * give the application the role of incoming HEADERS frame, we define
+ * several categories.
  */
 typedef enum {
   /**
@@ -1511,7 +1515,7 @@ typedef int (*nghttp2_on_stream_close_callback)(nghttp2_session *session,
  * NGHTTP2_HCAT_REQUEST``.  If |session| is configured as server side,
  * ``frame->headers.cat`` is either ``NGHTTP2_HCAT_REQUEST``
  * containing request headers or ``NGHTTP2_HCAT_HEADERS`` containing
- * trailer headers and never get PUSH_PROMISE in this callback.
+ * trailer fields and never get PUSH_PROMISE in this callback.
  *
  * For the client applications, ``frame->hd.type`` is either
  * ``NGHTTP2_HEADERS`` or ``NGHTTP2_PUSH_PROMISE``.  In case of
@@ -1523,7 +1527,7 @@ typedef int (*nghttp2_on_stream_close_callback)(nghttp2_session *session,
  * non-final response code and finally client gets exactly one HEADERS
  * frame with ``frame->headers.cat == NGHTTP2_HCAT_HEADERS``
  * containing final response headers (non-1xx status code).  The
- * trailer headers also has ``frame->headers.cat ==
+ * trailer fields also has ``frame->headers.cat ==
  * NGHTTP2_HCAT_HEADERS`` which does not contain any status code.
  *
  * Returning :enum:`NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE` will close
@@ -1620,6 +1624,14 @@ typedef int (*nghttp2_on_begin_headers_callback)(nghttp2_session *session,
  *
  * To set this callback to :type:`nghttp2_session_callbacks`, use
  * `nghttp2_session_callbacks_set_on_header_callback()`.
+ *
+ * .. warning::
+ *
+ *   Application should properly limit the total buffer size to store
+ *   incoming header fields.  Without it, peer may send large number
+ *   of header fields or large header fields to cause out of memory in
+ *   local endpoint.  Due to how HPACK works, peer can do this
+ *   effectively without using much memory on their own.
  */
 typedef int (*nghttp2_on_header_callback)(nghttp2_session *session,
                                           const nghttp2_frame *frame,
@@ -1704,6 +1716,99 @@ typedef int (*nghttp2_on_begin_frame_callback)(nghttp2_session *session,
                                                const nghttp2_frame_hd *hd,
                                                void *user_data);
 
+/**
+ * @functypedef
+ *
+ * Callback function invoked when chunk of extension frame payload is
+ * received.  The |hd| points to frame header.  The received
+ * chunk is |data| of length |len|.
+ *
+ * The implementation of this function must return 0 if it succeeds.
+ *
+ * To abort processing this extension frame, return
+ * :enum:`NGHTTP2_ERR_CANCEL`.
+ *
+ * If fatal error occurred, application should return
+ * :enum:`NGHTTP2_ERR_CALLBACK_FAILURE`.  In this case,
+ * `nghttp2_session_recv()` and `nghttp2_session_mem_recv()` functions
+ * immediately return :enum:`NGHTTP2_ERR_CALLBACK_FAILURE`.  If the
+ * other values are returned, currently they are treated as
+ * :enum:`NGHTTP2_ERR_CALLBACK_FAILURE`.
+ */
+typedef int (*nghttp2_on_extension_chunk_recv_callback)(
+    nghttp2_session *session, const nghttp2_frame_hd *hd, const uint8_t *data,
+    size_t len, void *user_data);
+
+/**
+ * @functypedef
+ *
+ * Callback function invoked when library asks the application to
+ * unpack extension payload from its wire format.  The extension
+ * payload has been passed to the application using
+ * :type:`nghttp2_on_extension_chunk_recv_callback`.  The frame header
+ * is already unpacked by the library and provided as |hd|.
+ *
+ * To receive extension frames, the application must tell desired
+ * extension frame type to the library using
+ * `nghttp2_option_set_user_recv_extension_type()`.
+ *
+ * The implementation of this function may store the pointer to the
+ * created object as a result of unpacking in |*payload|, and returns
+ * 0.  The pointer stored in |*payload| is opaque to the library, and
+ * the library does not own its pointer.  |*payload| is initialized as
+ * ``NULL``.  The |*payload| is available as ``frame->ext.payload`` in
+ * :type:`nghttp2_on_frame_recv_callback`.  Therefore if application
+ * can free that memory inside :type:`nghttp2_on_frame_recv_callback`
+ * callback.  Of course, application has a liberty not ot use
+ * |*payload|, and do its own mechanism to process extension frames.
+ *
+ * To abort processing this extension frame, return
+ * :enum:`NGHTTP2_ERR_CANCEL`.
+ *
+ * If fatal error occurred, application should return
+ * :enum:`NGHTTP2_ERR_CALLBACK_FAILURE`.  In this case,
+ * `nghttp2_session_recv()` and `nghttp2_session_mem_recv()` functions
+ * immediately return :enum:`NGHTTP2_ERR_CALLBACK_FAILURE`.  If the
+ * other values are returned, currently they are treated as
+ * :enum:`NGHTTP2_ERR_CALLBACK_FAILURE`.
+ */
+typedef int (*nghttp2_unpack_extension_callback)(nghttp2_session *session,
+                                                 void **payload,
+                                                 const nghttp2_frame_hd *hd,
+                                                 void *user_data);
+
+/**
+ * @functypedef
+ *
+ * Callback function invoked when library asks the application to pack
+ * extension payload in its wire format.  The frame header will be
+ * packed by library.  Application must pack payload only.
+ * ``frame->ext.payload`` is the object passed to
+ * `nghttp2_submit_extension()` as payload parameter.  Application
+ * must pack extension payload to the |buf| of its capacity |len|
+ * bytes.  The |len| is at least 16KiB.
+ *
+ * The implementation of this function should return the number of
+ * bytes written into |buf| when it succeeds.
+ *
+ * To abort processing this extension frame, return
+ * :enum:`NGHTTP2_ERR_CANCEL`, and
+ * :type:`nghttp2_on_frame_not_send_callback` will be invoked.
+ *
+ * If fatal error occurred, application should return
+ * :enum:`NGHTTP2_ERR_CALLBACK_FAILURE`.  In this case,
+ * `nghttp2_session_send()` and `nghttp2_session_mem_send()` functions
+ * immediately return :enum:`NGHTTP2_ERR_CALLBACK_FAILURE`.  If the
+ * other values are returned, currently they are treated as
+ * :enum:`NGHTTP2_ERR_CALLBACK_FAILURE`.  If the return value is
+ * strictly larger than |len|, it is treated as
+ * :enum:`NGHTTP2_ERR_CALLBACK_FAILURE`.
+ */
+typedef ssize_t (*nghttp2_pack_extension_callback)(nghttp2_session *session,
+                                                   uint8_t *buf, size_t len,
+                                                   const nghttp2_frame *frame,
+                                                   void *user_data);
+
 struct nghttp2_session_callbacks;
 
 /**
@@ -1897,6 +2002,37 @@ NGHTTP2_EXTERN void nghttp2_session_callbacks_set_send_data_callback(
     nghttp2_send_data_callback send_data_callback);
 
 /**
+ * @function
+ *
+ * Sets callback function invoked when the library asks the
+ * application to pack extension frame payload in wire format.
+ */
+NGHTTP2_EXTERN void nghttp2_session_callbacks_set_pack_extension_callback(
+    nghttp2_session_callbacks *cbs,
+    nghttp2_pack_extension_callback pack_extension_callback);
+
+/**
+ * @function
+ *
+ * Sets callback function invoked when the library asks the
+ * application to unpack extension frame payload from wire format.
+ */
+NGHTTP2_EXTERN void nghttp2_session_callbacks_set_unpack_extension_callback(
+    nghttp2_session_callbacks *cbs,
+    nghttp2_unpack_extension_callback unpack_extension_callback);
+
+/**
+ * @function
+ *
+ * Sets callback function invoked when chunk of extension frame
+ * payload is received.
+ */
+NGHTTP2_EXTERN void
+nghttp2_session_callbacks_set_on_extension_chunk_recv_callback(
+    nghttp2_session_callbacks *cbs,
+    nghttp2_on_extension_chunk_recv_callback on_extension_chunk_recv_callback);
+
+/**
  * @functypedef
  *
  * Custom memory allocator to replace malloc().  The |mem_user_data|
@@ -2113,6 +2249,23 @@ nghttp2_option_set_max_reserved_remote_streams(nghttp2_option *option,
 /**
  * @function
  *
+ * Sets extension frame type the application is willing to handle with
+ * user defined callbacks (see
+ * :type:`nghttp2_on_extension_chunk_recv_callback` and
+ * :type:`nghttp2_unpack_extension_callback`).  The |type| is
+ * extension frame type, and must be strictly greater than 0x9.
+ * Otherwise, this function does nothing.  The application can call
+ * this function multiple times to set more than one frame type to
+ * receive.  The application does not have to call this function if it
+ * just sends extension frames.
+ */
+NGHTTP2_EXTERN void
+nghttp2_option_set_user_recv_extension_type(nghttp2_option *option,
+                                            uint8_t type);
+
+/**
+ * @function
+ *
  * Initializes |*session_ptr| for client use.  The all members of
  * |callbacks| are copied to |*session_ptr|.  Therefore |*session_ptr|
  * does not store |callbacks|.  The |user_data| is an arbitrary user
@@ -3173,6 +3326,11 @@ nghttp2_priority_spec_check_default(const nghttp2_priority_spec *pri_spec);
  * :enum:`NGHTTP2_ERR_STREAM_ID_NOT_AVAILABLE`
  *     No stream ID is available because maximum stream ID was
  *     reached.
+ * :enum:`NGHTTP2_ERR_INVALID_ARGUMENT`
+ *     Trying to depend on itself (new stream ID equals
+ *     ``pri_spec->stream_id``).
+ * :enum:`NGHTTP2_ERR_PROTO`
+ *     The |session| is server session.
  *
  * .. warning::
  *
@@ -3245,6 +3403,8 @@ nghttp2_submit_request(nghttp2_session *session,
  *     processed yet.  Normally, this does not happen, but when
  *     application wrongly calls `nghttp2_submit_response()` twice,
  *     this may happen.
+ * :enum:`NGHTTP2_ERR_PROTO`
+ *     The |session| is client session.
  *
  * .. warning::
  *
@@ -3260,7 +3420,7 @@ nghttp2_submit_response(nghttp2_session *session, int32_t stream_id,
 /**
  * @function
  *
- * Submits trailer HEADERS against the stream |stream_id|.
+ * Submits trailer fields HEADERS against the stream |stream_id|.
  *
  * The |nva| is an array of name/value pair :type:`nghttp2_nv` with
  * |nvlen| elements.  The application is responsible not to include
@@ -3279,26 +3439,26 @@ nghttp2_submit_response(nghttp2_session *session, int32_t stream_id,
  * :type:`nghttp2_on_frame_send_callback` or
  * :type:`nghttp2_on_frame_not_send_callback` is called.
  *
- * For server, trailer must be followed by response HEADERS or
- * response DATA.  The library does not check that response HEADERS
- * has already sent and if `nghttp2_submit_trailer()` is called before
- * any response HEADERS submission (usually by
- * `nghttp2_submit_response()`), the content of |nva| will be sent as
- * reponse headers, which will result in error.
+ * For server, trailer fields must follow response HEADERS or response
+ * DATA with END_STREAM flag set.  The library does not enforce this
+ * requirement, and applications should do this for themselves.  If
+ * `nghttp2_submit_trailer()` is called before any response HEADERS
+ * submission (usually by `nghttp2_submit_response()`), the content of
+ * |nva| will be sent as response headers, which will result in error.
  *
  * This function has the same effect with `nghttp2_submit_headers()`,
  * with flags = :enum:`NGHTTP2_FLAG_END_HEADERS` and both pri_spec and
  * stream_user_data to NULL.
  *
- * To submit trailer after `nghttp2_submit_response()` is called, the
- * application has to specify :type:`nghttp2_data_provider` to
- * `nghttp2_submit_response()`.  In side
- * :type:`nghttp2_data_source_read_callback`, when setting
+ * To submit trailer fields after `nghttp2_submit_response()` is
+ * called, the application has to specify
+ * :type:`nghttp2_data_provider` to `nghttp2_submit_response()`.  In
+ * side :type:`nghttp2_data_source_read_callback`, when setting
  * :enum:`NGHTTP2_DATA_FLAG_EOF`, also set
  * :enum:`NGHTTP2_DATA_FLAG_NO_END_STREAM`.  After that, the
- * application can send trailer using `nghttp2_submit_trailer()`.
- * `nghttp2_submit_trailer()` can be used inside
- * :type:`nghttp2_data_source_read_callback`.
+ * application can send trailer fields using
+ * `nghttp2_submit_trailer()`.  `nghttp2_submit_trailer()` can be used
+ * inside :type:`nghttp2_data_source_read_callback`.
  *
  * This function returns 0 if it succeeds and |stream_id| is -1.
  * Otherwise, this function returns 0 if it succeeds, or one of the
@@ -3383,11 +3543,14 @@ NGHTTP2_EXTERN int nghttp2_submit_trailer(nghttp2_session *session,
  *     No stream ID is available because maximum stream ID was
  *     reached.
  * :enum:`NGHTTP2_ERR_INVALID_ARGUMENT`
- *     The |stream_id| is 0.
+ *     The |stream_id| is 0; or trying to depend on itself (stream ID
+ *     equals ``pri_spec->stream_id``).
  * :enum:`NGHTTP2_ERR_DATA_EXIST`
  *     DATA or HEADERS has been already submitted and not fully
  *     processed yet.  This happens if stream denoted by |stream_id|
  *     is in reserved state.
+ * :enum:`NGHTTP2_ERR_PROTO`
+ *     The |stream_id| is -1, and |session| is server session.
  *
  * .. warning::
  *
@@ -3426,7 +3589,7 @@ nghttp2_submit_headers(nghttp2_session *session, uint8_t flags,
  * :enum:`NGHTTP2_ERR_INVALID_ARGUMENT`
  *     The |stream_id| is 0.
  * :enum:`NGHTTP2_ERR_STREAM_CLOSED`
- *     The stream was alreay closed; or the |stream_id| is invalid.
+ *     The stream was already closed; or the |stream_id| is invalid.
  *
  * .. note::
  *
@@ -3595,7 +3758,7 @@ NGHTTP2_EXTERN int nghttp2_submit_settings(nghttp2_session *session,
  *     The |stream_id| is 0; The |stream_id| does not designate stream
  *     that peer initiated.
  * :enum:`NGHTTP2_ERR_STREAM_CLOSED`
- *     The stream was alreay closed; or the |stream_id| is invalid.
+ *     The stream was already closed; or the |stream_id| is invalid.
  *
  * .. warning::
  *
@@ -3773,6 +3936,48 @@ NGHTTP2_EXTERN int nghttp2_submit_window_update(nghttp2_session *session,
 /**
  * @function
  *
+ * Submits extension frame.
+ *
+ * Application can pass arbitrary frame flags and stream ID in |flags|
+ * and |stream_id| respectively.  The |payload| is opaque pointer, and
+ * it can be accessible though ``frame->ext.payload`` in
+ * :type:`nghttp2_pack_extension_callback`.  The library will not own
+ * passed |payload| pointer.
+ *
+ * The application must set :type:`nghttp2_pack_extension_callback`
+ * using `nghttp2_session_callbacks_set_pack_extension_callback()`.
+ *
+ * The application should retain the memory pointed by |payload| until
+ * the transmission of extension frame is done (which is indicated by
+ * :type:`nghttp2_on_frame_send_callback`), or transmission fails
+ * (which is indicated by :type:`nghttp2_on_frame_not_send_callback`).
+ * If application does not touch this memory region after packing it
+ * into a wire format, application can free it inside
+ * :type:`nghttp2_pack_extension_callback`.
+ *
+ * The standard HTTP/2 frame cannot be sent with this function, so
+ * |type| must be strictly grater than 0x9.  Otherwise, this function
+ * will fail with error code :enum:`NGHTTP2_ERR_INVALID_ARGUMENT`.
+ *
+ * This function returns 0 if it succeeds, or one of the following
+ * negative error codes:
+ *
+ * :enum:`NGHTTP2_ERR_INVALID_STATE`
+ *     If :type:`nghttp2_pack_extension_callback` is not set.
+ * :enum:`NGHTTP2_ERR_INVALID_ARGUMENT`
+ *     If  |type| specifies  standard  HTTP/2 frame  type.  The  frame
+ *     types  in the  rage [0x0,  0x9], both  inclusive, are  standard
+ *     HTTP/2 frame type, and cannot be sent using this function.
+ * :enum:`NGHTTP2_ERR_NOMEM`
+ *     Out of memory
+ */
+NGHTTP2_EXTERN int nghttp2_submit_extension(nghttp2_session *session,
+                                            uint8_t type, uint8_t flags,
+                                            int32_t stream_id, void *payload);
+
+/**
+ * @function
+ *
  * Compares ``lhs->name`` of length ``lhs->namelen`` bytes and
  * ``rhs->name`` of length ``rhs->namelen`` bytes.  Returns negative
  * integer if ``lhs->name`` is found to be less than ``rhs->name``; or
@@ -4182,7 +4387,7 @@ typedef enum {
  * :enum:`NGHTTP2_ERR_HEADER_COMP`
  *     Inflation process has failed.
  * :enum:`NGHTTP2_ERR_BUFFER_ERROR`
- *     The heder field name or value is too large.
+ *     The header field name or value is too large.
  *
  * Example follows::
  *
diff --git a/epan/nghttp2/nghttp2_hd.c b/epan/nghttp2/nghttp2_hd.c
index 15faa8f328..28598554bc 100644
--- a/epan/nghttp2/nghttp2_hd.c
+++ b/epan/nghttp2/nghttp2_hd.c
@@ -137,6 +137,26 @@ static int lookup_token(const uint8_t *name, size_t namelen) {
         return NGHTTP2_TOKEN_AGE;
       }
       break;
+    case 'n':
+      if (lstreq("tc", name, 2)) {
+        return NGHTTP2_TOKEN_TCN;
+      }
+      break;
+    case 'p':
+      if (lstreq("p3", name, 2)) {
+        return NGHTTP2_TOKEN_P3P;
+      }
+      break;
+    case 't':
+      if (lstreq("dn", name, 2)) {
+        return NGHTTP2_TOKEN_DNT;
+      }
+      break;
+    case 'v':
+      if (lstreq("ts", name, 2)) {
+        return NGHTTP2_TOKEN_TSV;
+      }
+      break;
     }
     break;
   case 4:
@@ -197,16 +217,31 @@ static int lookup_token(const uint8_t *name, size_t namelen) {
     break;
   case 6:
     switch (name[5]) {
+    case 'a':
+      if (lstreq("pragm", name, 5)) {
+        return NGHTTP2_TOKEN_PRAGMA;
+      }
+      break;
     case 'e':
       if (lstreq("cooki", name, 5)) {
         return NGHTTP2_TOKEN_COOKIE;
       }
       break;
+    case 'n':
+      if (lstreq("origi", name, 5)) {
+        return NGHTTP2_TOKEN_ORIGIN;
+      }
+      break;
     case 'r':
       if (lstreq("serve", name, 5)) {
         return NGHTTP2_TOKEN_SERVER;
       }
       break;
+    case 's':
+      if (lstreq("statu", name, 5)) {
+        return NGHTTP2_TOKEN_STATUS;
+      }
+      break;
     case 't':
       if (lstreq("accep", name, 5)) {
         return NGHTTP2_TOKEN_ACCEPT;
@@ -219,6 +254,11 @@ static int lookup_token(const uint8_t *name, size_t namelen) {
     break;
   case 7:
     switch (name[6]) {
+    case 'c':
+      if (lstreq("alt-sv", name, 6)) {
+        return NGHTTP2_TOKEN_ALT_SVC;
+      }
+      break;
     case 'd':
       if (lstreq(":metho", name, 6)) {
         return NGHTTP2_TOKEN__METHOD;
@@ -237,6 +277,14 @@ static int lookup_token(const uint8_t *name, size_t namelen) {
       if (lstreq("upgrad", name, 6)) {
         return NGHTTP2_TOKEN_UPGRADE;
       }
+      if (lstreq("x-cach", name, 6)) {
+        return NGHTTP2_TOKEN_X_CACHE;
+      }
+      break;
+    case 'g':
+      if (lstreq("warnin", name, 6)) {
+        return NGHTTP2_TOKEN_WARNING;
+      }
       break;
     case 'h':
       if (lstreq("refres", name, 6)) {
@@ -247,6 +295,9 @@ static int lookup_token(const uint8_t *name, size_t namelen) {
       if (lstreq("refere", name, 6)) {
         return NGHTTP2_TOKEN_REFERER;
       }
+      if (lstreq("traile", name, 6)) {
+        return NGHTTP2_TOKEN_TRAILER;
+      }
       break;
     case 's':
       if (lstreq(":statu", name, 6)) {
@@ -295,6 +346,25 @@ static int lookup_token(const uint8_t *name, size_t namelen) {
       break;
     }
     break;
+  case 9:
+    switch (name[8]) {
+    case 'd':
+      if (lstreq("forwarde", name, 8)) {
+        return NGHTTP2_TOKEN_FORWARDED;
+      }
+      break;
+    case 'e':
+      if (lstreq("negotiat", name, 8)) {
+        return NGHTTP2_TOKEN_NEGOTIATE;
+      }
+      break;
+    case 'h':
+      if (lstreq("accept-c", name, 8)) {
+        return NGHTTP2_TOKEN_ACCEPT_CH;
+      }
+      break;
+    }
+    break;
   case 10:
     switch (name[9]) {
     case 'e':
@@ -310,6 +380,11 @@ static int lookup_token(const uint8_t *name, size_t namelen) {
         return NGHTTP2_TOKEN_CONNECTION;
       }
       break;
+    case 's':
+      if (lstreq("alternate", name, 9)) {
+        return NGHTTP2_TOKEN_ALTERNATES;
+      }
+      break;
     case 't':
       if (lstreq("user-agen", name, 9)) {
         return NGHTTP2_TOKEN_USER_AGENT;
@@ -324,6 +399,16 @@ static int lookup_token(const uint8_t *name, size_t namelen) {
     break;
   case 11:
     switch (name[10]) {
+    case '2':
+      if (lstreq("set-cookie", name, 10)) {
+        return NGHTTP2_TOKEN_SET_COOKIE2;
+      }
+      break;
+    case '5':
+      if (lstreq("content-md", name, 10)) {
+        return NGHTTP2_TOKEN_CONTENT_MD5;
+      }
+      break;
     case 'r':
       if (lstreq("retry-afte", name, 10)) {
         return NGHTTP2_TOKEN_RETRY_AFTER;
@@ -338,16 +423,37 @@ static int lookup_token(const uint8_t *name, size_t namelen) {
         return NGHTTP2_TOKEN_CONTENT_TYPE;
       }
       break;
+    case 'h':
+      if (lstreq("accept-patc", name, 11)) {
+        return NGHTTP2_TOKEN_ACCEPT_PATCH;
+      }
+      break;
+    case 'p':
+      if (lstreq("x-webkit-cs", name, 11)) {
+        return NGHTTP2_TOKEN_X_WEBKIT_CSP;
+      }
+      break;
     case 's':
       if (lstreq("max-forward", name, 11)) {
         return NGHTTP2_TOKEN_MAX_FORWARDS;
       }
       break;
+    case 'y':
+      if (lstreq("variant-var", name, 11)) {
+        return NGHTTP2_TOKEN_VARIANT_VARY;
+      }
+      if (lstreq("x-powered-b", name, 11)) {
+        return NGHTTP2_TOKEN_X_POWERED_BY;
+      }
+      break;
     }
     break;
   case 13:
     switch (name[12]) {
     case 'd':
+      if (lstreq("last-event-i", name, 12)) {
+        return NGHTTP2_TOKEN_LAST_EVENT_ID;
+      }
       if (lstreq("last-modifie", name, 12)) {
         return NGHTTP2_TOKEN_LAST_MODIFIED;
       }
@@ -356,6 +462,9 @@ static int lookup_token(const uint8_t *name, size_t namelen) {
       if (lstreq("content-rang", name, 12)) {
         return NGHTTP2_TOKEN_CONTENT_RANGE;
       }
+      if (lstreq("x-wap-profil", name, 12)) {
+        return NGHTTP2_TOKEN_X_WAP_PROFILE;
+      }
       break;
     case 'h':
       if (lstreq("if-none-matc", name, 12)) {
@@ -371,6 +480,9 @@ static int lookup_token(const uint8_t *name, size_t namelen) {
       if (lstreq("authorizatio", name, 12)) {
         return NGHTTP2_TOKEN_AUTHORIZATION;
       }
+      if (lstreq("x-api-versio", name, 12)) {
+        return NGHTTP2_TOKEN_X_API_VERSION;
+      }
       break;
     case 's':
       if (lstreq("accept-range", name, 12)) {
@@ -381,11 +493,21 @@ static int lookup_token(const uint8_t *name, size_t namelen) {
     break;
   case 14:
     switch (name[13]) {
+    case 'd':
+      if (lstreq("x-att-devicei", name, 13)) {
+        return NGHTTP2_TOKEN_X_ATT_DEVICEID;
+      }
+      break;
     case 'h':
       if (lstreq("content-lengt", name, 13)) {
         return NGHTTP2_TOKEN_CONTENT_LENGTH;
       }
       break;
+    case 'p':
+      if (lstreq("x-cache-looku", name, 13)) {
+        return NGHTTP2_TOKEN_X_CACHE_LOOKUP;
+      }
+      break;
     case 't':
       if (lstreq("accept-charse", name, 13)) {
         return NGHTTP2_TOKEN_ACCEPT_CHARSET;
@@ -396,15 +518,40 @@ static int lookup_token(const uint8_t *name, size_t namelen) {
   case 15:
     switch (name[14]) {
     case 'e':
+      if (lstreq("accept-datetim", name, 14)) {
+        return NGHTTP2_TOKEN_ACCEPT_DATETIME;
+      }
       if (lstreq("accept-languag", name, 14)) {
         return NGHTTP2_TOKEN_ACCEPT_LANGUAGE;
       }
+      if (lstreq("x-ua-compatibl", name, 14)) {
+        return NGHTTP2_TOKEN_X_UA_COMPATIBLE;
+      }
       break;
     case 'g':
       if (lstreq("accept-encodin", name, 14)) {
         return NGHTTP2_TOKEN_ACCEPT_ENCODING;
       }
       break;
+    case 'r':
+      if (lstreq("x-forwarded-fo", name, 14)) {
+        return NGHTTP2_TOKEN_X_FORWARDED_FOR;
+      }
+      break;
+    case 's':
+      if (lstreq("accept-feature", name, 14)) {
+        return NGHTTP2_TOKEN_ACCEPT_FEATURES;
+      }
+      if (lstreq("front-end-http", name, 14)) {
+        return NGHTTP2_TOKEN_FRONT_END_HTTPS;
+      }
+      if (lstreq("public-key-pin", name, 14)) {
+        return NGHTTP2_TOKEN_PUBLIC_KEY_PINS;
+      }
+      if (lstreq("x-frame-option", name, 14)) {
+        return NGHTTP2_TOKEN_X_FRAME_OPTIONS;
+      }
+      break;
     }
     break;
   case 16:
@@ -422,6 +569,11 @@ static int lookup_token(const uint8_t *name, size_t namelen) {
         return NGHTTP2_TOKEN_CONTENT_ENCODING;
       }
       break;
+    case 'h':
+      if (lstreq("x-requested-wit", name, 15)) {
+        return NGHTTP2_TOKEN_X_REQUESTED_WITH;
+      }
+      break;
     case 'n':
       if (lstreq("content-locatio", name, 15)) {
         return NGHTTP2_TOKEN_CONTENT_LOCATION;
@@ -429,6 +581,14 @@ static int lookup_token(const uint8_t *name, size_t namelen) {
       if (lstreq("proxy-connectio", name, 15)) {
         return NGHTTP2_TOKEN_PROXY_CONNECTION;
       }
+      if (lstreq("x-xss-protectio", name, 15)) {
+        return NGHTTP2_TOKEN_X_XSS_PROTECTION;
+      }
+      break;
+    case 't':
+      if (lstreq("x-forwarded-hos", name, 15)) {
+        return NGHTTP2_TOKEN_X_FORWARDED_HOST;
+      }
       break;
     }
     break;
@@ -444,6 +604,16 @@ static int lookup_token(const uint8_t *name, size_t namelen) {
         return NGHTTP2_TOKEN_TRANSFER_ENCODING;
       }
       break;
+    case 'o':
+      if (lstreq("x-forwarded-prot", name, 16)) {
+        return NGHTTP2_TOKEN_X_FORWARDED_PROTO;
+      }
+      break;
+    case 'y':
+      if (lstreq("sec-websocket-ke", name, 16)) {
+        return NGHTTP2_TOKEN_SEC_WEBSOCKET_KEY;
+      }
+      break;
     }
     break;
   case 18:
@@ -453,6 +623,11 @@ static int lookup_token(const uint8_t *name, size_t namelen) {
         return NGHTTP2_TOKEN_PROXY_AUTHENTICATE;
       }
       break;
+    case 'n':
+      if (lstreq("x-content-duratio", name, 17)) {
+        return NGHTTP2_TOKEN_X_CONTENT_DURATION;
+      }
+      break;
     }
     break;
   case 19:
@@ -472,12 +647,80 @@ static int lookup_token(const uint8_t *name, size_t namelen) {
       break;
     }
     break;
+  case 20:
+    switch (name[19]) {
+    case 'n':
+      if (lstreq("sec-websocket-origi", name, 19)) {
+        return NGHTTP2_TOKEN_SEC_WEBSOCKET_ORIGIN;
+      }
+      break;
+    }
+    break;
+  case 21:
+    switch (name[20]) {
+    case 'l':
+      if (lstreq("x-dnsprefetch-contro", name, 20)) {
+        return NGHTTP2_TOKEN_X_DNSPREFETCH_CONTROL;
+      }
+      break;
+    case 'n':
+      if (lstreq("sec-websocket-versio", name, 20)) {
+        return NGHTTP2_TOKEN_SEC_WEBSOCKET_VERSION;
+      }
+      break;
+    }
+    break;
+  case 22:
+    switch (name[21]) {
+    case 'e':
+      if (lstreq("access-control-max-ag", name, 21)) {
+        return NGHTTP2_TOKEN_ACCESS_CONTROL_MAX_AGE;
+      }
+      break;
+    case 'l':
+      if (lstreq("sec-websocket-protoco", name, 21)) {
+        return NGHTTP2_TOKEN_SEC_WEBSOCKET_PROTOCOL;
+      }
+      break;
+    case 's':
+      if (lstreq("x-content-type-option", name, 21)) {
+        return NGHTTP2_TOKEN_X_CONTENT_TYPE_OPTIONS;
+      }
+      break;
+    }
+    break;
+  case 23:
+    switch (name[22]) {
+    case 'y':
+      if (lstreq("content-security-polic", name, 22)) {
+        return NGHTTP2_TOKEN_CONTENT_SECURITY_POLICY;
+      }
+      break;
+    }
+    break;
+  case 24:
+    switch (name[23]) {
+    case 's':
+      if (lstreq("sec-websocket-extension", name, 23)) {
+        return NGHTTP2_TOKEN_SEC_WEBSOCKET_EXTENSIONS;
+      }
+      break;
+    }
+    break;
   case 25:
     switch (name[24]) {
+    case 's':
+      if (lstreq("upgrade-insecure-request", name, 24)) {
+        return NGHTTP2_TOKEN_UPGRADE_INSECURE_REQUESTS;
+      }
+      break;
     case 'y':
       if (lstreq("strict-transport-securit", name, 24)) {
         return NGHTTP2_TOKEN_STRICT_TRANSPORT_SECURITY;
       }
+      if (lstreq("x-content-security-polic", name, 24)) {
+        return NGHTTP2_TOKEN_X_CONTENT_SECURITY_POLICY;
+      }
       break;
     }
     break;
@@ -490,6 +733,59 @@ static int lookup_token(const uint8_t *name, size_t namelen) {
       break;
     }
     break;
+  case 28:
+    switch (name[27]) {
+    case 's':
+      if (lstreq("access-control-allow-header", name, 27)) {
+        return NGHTTP2_TOKEN_ACCESS_CONTROL_ALLOW_HEADERS;
+      }
+      if (lstreq("access-control-allow-method", name, 27)) {
+        return NGHTTP2_TOKEN_ACCESS_CONTROL_ALLOW_METHODS;
+      }
+      break;
+    }
+    break;
+  case 29:
+    switch (name[28]) {
+    case 'd':
+      if (lstreq("access-control-request-metho", name, 28)) {
+        return NGHTTP2_TOKEN_ACCESS_CONTROL_REQUEST_METHOD;
+      }
+      break;
+    case 's':
+      if (lstreq("access-control-expose-header", name, 28)) {
+        return NGHTTP2_TOKEN_ACCESS_CONTROL_EXPOSE_HEADERS;
+      }
+      break;
+    }
+    break;
+  case 30:
+    switch (name[29]) {
+    case 's':
+      if (lstreq("access-control-request-header", name, 29)) {
+        return NGHTTP2_TOKEN_ACCESS_CONTROL_REQUEST_HEADERS;
+      }
+      break;
+    }
+    break;
+  case 32:
+    switch (name[31]) {
+    case 's':
+      if (lstreq("access-control-allow-credential", name, 31)) {
+        return NGHTTP2_TOKEN_ACCESS_CONTROL_ALLOW_CREDENTIALS;
+      }
+      break;
+    }
+    break;
+  case 35:
+    switch (name[34]) {
+    case 'y':
+      if (lstreq("content-security-policy-report-onl", name, 34)) {
+        return NGHTTP2_TOKEN_CONTENT_SECURITY_POLICY_REPORT_ONLY;
+      }
+      break;
+    }
+    break;
   }
   return -1;
 }
@@ -617,8 +913,8 @@ static nghttp2_hd_entry *hd_map_find(nghttp2_hd_map *map, int *exact_match,
   *exact_match = 0;
 
   for (p = map->table[hash & (HD_MAP_SIZE - 1)]; p; p = p->next) {
-    if (hash != p->hash || token != p->token ||
-        (token == -1 && !name_eq(&p->nv, nv))) {
+    if (token != p->token ||
+        (token == -1 && (hash != p->hash || !name_eq(&p->nv, nv)))) {
       continue;
     }
     if (!res) {
@@ -1444,7 +1740,7 @@ static int deflate_nv(nghttp2_hd_deflater *deflater, nghttp2_bufs *bufs,
   int indexing_mode;
   int token;
   nghttp2_mem *mem;
-  uint32_t hash;
+  uint32_t hash = 0;
 
   DEBUGF(fprintf(stderr, "deflatehd: deflating %.*s: %.*s\n", (int)nv->namelen,
                  nv->name, (int)nv->valuelen, nv->value));
@@ -1452,9 +1748,9 @@ static int deflate_nv(nghttp2_hd_deflater *deflater, nghttp2_bufs *bufs,
   mem = deflater->ctx.mem;
 
   token = lookup_token(nv->name, nv->namelen);
-  if (token == -1 || token > NGHTTP2_TOKEN_WWW_AUTHENTICATE) {
+  if (token == -1) {
     hash = name_hash(nv);
-  } else {
+  } else if (token <= NGHTTP2_TOKEN_WWW_AUTHENTICATE) {
     hash = static_table[token].hash;
   }
 
diff --git a/epan/nghttp2/nghttp2_hd.h b/epan/nghttp2/nghttp2_hd.h
index f28c341a18..b942d93c23 100644
--- a/epan/nghttp2/nghttp2_hd.h
+++ b/epan/nghttp2/nghttp2_hd.h
@@ -105,11 +105,67 @@ typedef enum {
   NGHTTP2_TOKEN_VARY = 58,
   NGHTTP2_TOKEN_VIA = 59,
   NGHTTP2_TOKEN_WWW_AUTHENTICATE = 60,
-  NGHTTP2_TOKEN_TE,
+  NGHTTP2_TOKEN_ACCEPT_CH,
+  NGHTTP2_TOKEN_ACCEPT_DATETIME,
+  NGHTTP2_TOKEN_ACCEPT_FEATURES,
+  NGHTTP2_TOKEN_ACCEPT_PATCH,
+  NGHTTP2_TOKEN_ACCESS_CONTROL_ALLOW_CREDENTIALS,
+  NGHTTP2_TOKEN_ACCESS_CONTROL_ALLOW_HEADERS,
+  NGHTTP2_TOKEN_ACCESS_CONTROL_ALLOW_METHODS,
+  NGHTTP2_TOKEN_ACCESS_CONTROL_EXPOSE_HEADERS,
+  NGHTTP2_TOKEN_ACCESS_CONTROL_MAX_AGE,
+  NGHTTP2_TOKEN_ACCESS_CONTROL_REQUEST_HEADERS,
+  NGHTTP2_TOKEN_ACCESS_CONTROL_REQUEST_METHOD,
+  NGHTTP2_TOKEN_ALT_SVC,
+  NGHTTP2_TOKEN_ALTERNATES,
   NGHTTP2_TOKEN_CONNECTION,
+  NGHTTP2_TOKEN_CONTENT_MD5,
+  NGHTTP2_TOKEN_CONTENT_SECURITY_POLICY,
+  NGHTTP2_TOKEN_CONTENT_SECURITY_POLICY_REPORT_ONLY,
+  NGHTTP2_TOKEN_DNT,
+  NGHTTP2_TOKEN_FORWARDED,
+  NGHTTP2_TOKEN_FRONT_END_HTTPS,
   NGHTTP2_TOKEN_KEEP_ALIVE,
+  NGHTTP2_TOKEN_LAST_EVENT_ID,
+  NGHTTP2_TOKEN_NEGOTIATE,
+  NGHTTP2_TOKEN_ORIGIN,
+  NGHTTP2_TOKEN_P3P,
+  NGHTTP2_TOKEN_PRAGMA,
   NGHTTP2_TOKEN_PROXY_CONNECTION,
-  NGHTTP2_TOKEN_UPGRADE
+  NGHTTP2_TOKEN_PUBLIC_KEY_PINS,
+  NGHTTP2_TOKEN_SEC_WEBSOCKET_EXTENSIONS,
+  NGHTTP2_TOKEN_SEC_WEBSOCKET_KEY,
+  NGHTTP2_TOKEN_SEC_WEBSOCKET_ORIGIN,
+  NGHTTP2_TOKEN_SEC_WEBSOCKET_PROTOCOL,
+  NGHTTP2_TOKEN_SEC_WEBSOCKET_VERSION,
+  NGHTTP2_TOKEN_SET_COOKIE2,
+  NGHTTP2_TOKEN_STATUS,
+  NGHTTP2_TOKEN_TCN,
+  NGHTTP2_TOKEN_TE,
+  NGHTTP2_TOKEN_TRAILER,
+  NGHTTP2_TOKEN_TSV,
+  NGHTTP2_TOKEN_UPGRADE,
+  NGHTTP2_TOKEN_UPGRADE_INSECURE_REQUESTS,
+  NGHTTP2_TOKEN_VARIANT_VARY,
+  NGHTTP2_TOKEN_WARNING,
+  NGHTTP2_TOKEN_X_API_VERSION,
+  NGHTTP2_TOKEN_X_ATT_DEVICEID,
+  NGHTTP2_TOKEN_X_CACHE,
+  NGHTTP2_TOKEN_X_CACHE_LOOKUP,
+  NGHTTP2_TOKEN_X_CONTENT_DURATION,
+  NGHTTP2_TOKEN_X_CONTENT_SECURITY_POLICY,
+  NGHTTP2_TOKEN_X_CONTENT_TYPE_OPTIONS,
+  NGHTTP2_TOKEN_X_DNSPREFETCH_CONTROL,
+  NGHTTP2_TOKEN_X_FORWARDED_FOR,
+  NGHTTP2_TOKEN_X_FORWARDED_HOST,
+  NGHTTP2_TOKEN_X_FORWARDED_PROTO,
+  NGHTTP2_TOKEN_X_FRAME_OPTIONS,
+  NGHTTP2_TOKEN_X_POWERED_BY,
+  NGHTTP2_TOKEN_X_REQUESTED_WITH,
+  NGHTTP2_TOKEN_X_UA_COMPATIBLE,
+  NGHTTP2_TOKEN_X_WAP_PROFILE,
+  NGHTTP2_TOKEN_X_WEBKIT_CSP,
+  NGHTTP2_TOKEN_X_XSS_PROTECTION,
 } nghttp2_token;
 
 typedef enum {
diff --git a/epan/nghttp2/nghttp2_helper.c b/epan/nghttp2/nghttp2_helper.c
index feec30d0aa..4f839e49fe 100644
--- a/epan/nghttp2/nghttp2_helper.c
+++ b/epan/nghttp2/nghttp2_helper.c
@@ -288,6 +288,8 @@ const char *nghttp2_strerror(int error_code) {
     return "Stream was refused";
   case NGHTTP2_ERR_INTERNAL:
     return "Internal error";
+  case NGHTTP2_ERR_CANCEL:
+    return "Cancel";
   case NGHTTP2_ERR_NOMEM:
     return "Out of memory";
   case NGHTTP2_ERR_CALLBACK_FAILURE:
diff --git a/epan/nghttp2/nghttp2ver.h b/epan/nghttp2/nghttp2ver.h
index bdd342da14..58472c3276 100644
--- a/epan/nghttp2/nghttp2ver.h
+++ b/epan/nghttp2/nghttp2ver.h
@@ -29,7 +29,7 @@
  * @macro
  * Version number of the nghttp2 library release
  */
-#define NGHTTP2_VERSION "1.6.0"
+#define NGHTTP2_VERSION "1.8.0"
 
 /**
  * @macro
@@ -37,6 +37,6 @@
  * release. This is a 24 bit number with 8 bits for major number, 8 bits
  * for minor and 8 bits for patch. Version 1.2.3 becomes 0x010203.
  */
-#define NGHTTP2_VERSION_NUM 0x010600
+#define NGHTTP2_VERSION_NUM 0x010800
 
 #endif /* NGHTTP2VER_H */