http3 0.0.3 → 0.0.4

data/ext/http3/session.c

@@ -28,7 +28,7 @@
 VALUE rb_cHTTP3Session;
 
 static ID id_on_begin_headers, id_on_header, id_on_end_headers, id_on_data,
-    id_on_end_stream, id_on_fields_too_large;
+    id_on_end_stream, id_on_fields_too_large, id_on_reset;
 
 /* What h3_session.field_sizes holds for a request whose header section has
  * gone over max_field_section_size. */
@@ -77,7 +77,9 @@ typedef struct {
   VALUE self;      /* the object wrapping this struct; dcompact follows it */
   VALUE quic_conn; /* the QUIC::Connection::Server */
   quic_ext_conn *qc;
-  nghttp3_conn *h3;  /* made on handshake_completed */
+  nghttp3_conn *h3;  /* made on handshake_completed, deleted by h3_fail */
+  bool failed;       /* h3_fail has been called: h3 is gone for good */
+  int in_callback;   /* how deep the Ruby part is in h3_protect */
   st_table *streams; /* stream_id => h3_stream * */
   VALUE pending_exc; /* an exception the Ruby part raised in a callback */
   VALUE closed_ids;  /* ids of the streams nghttp3 closed, for #take_closed */
@@ -163,7 +165,9 @@ static void h3_stream_acked(h3_stream *st, uint64_t n) {
 
 static int h3_protect(h3_session *s, VALUE (*body)(VALUE), VALUE arg) {
   int state = 0;
+  s->in_callback++;
   rb_protect(body, arg, &state);
+  s->in_callback--;
   if (state == 0) {
     return 0;
   }
@@ -437,10 +441,43 @@ static const nghttp3_data_reader h3_data_reader = {.read_data =
 
 /* Stream handler (quic -> glue). ud is the h3_session. */
 
+/* The HTTP/3 connection has failed: the QUIC connection is to close with
+ * app_error_code, and the nghttp3 connection goes, since nghttp3 allows
+ * nothing but nghttp3_conn_del once it has returned an error. From then on
+ * the handler fails every read and write, so that the QUIC connection
+ * closes even when the failure came from a call the Ruby part made. Never
+ * called while nghttp3 is running. */
+static int h3_fail_with(h3_session *s, uint64_t app_error_code) {
+  http3_quic_api->set_application_error(s->qc, app_error_code);
+  if (s->h3 != NULL) {
+    nghttp3_conn_del(s->h3);
+    s->h3 = NULL;
+  }
+  s->failed = true;
+  return -1;
+}
+
+/* A failure inside nghttp3, with the HTTP/3 error code it stands for. */
+static int h3_fail(h3_session *s, int64_t rv) {
+  return h3_fail_with(s, nghttp3_err_infer_quic_app_error_code((int)rv));
+}
+
+/* Raise for rv, which a call the Ruby part made into nghttp3 returned. A
+ * fatal error fails the connection first. */
+static void h3_raise(h3_session *s, int rv, const char *message) {
+  if (nghttp3_err_is_fatal(rv) || rv == NGHTTP3_ERR_QPACK_FATAL) {
+    h3_fail(s, rv);
+  }
+  nghttp3_rb_raise(rv, message);
+}
+
 /* Make the nghttp3 connection and its three unidirectional streams, as
  * ngtcp2's examples/server.cc does once the handshake is done. */
 static int h3_handshake_completed(void *ud) {
   h3_session *s = ud;
+  if (s->failed) {
+    return -1;
+  }
   if (s->h3 != NULL) {
     return 0;
   }
@@ -466,34 +503,39 @@ static int h3_handshake_completed(void *ud) {
 
   if (nghttp3_conn_server_new(&s->h3, &callbacks, &settings, NULL, s) != 0) {
     s->h3 = NULL;
-    return -1;
+    return h3_fail_with(s, NGHTTP3_H3_INTERNAL_ERROR);
   }
-  nghttp3_conn_set_max_client_streams_bidi(
-      s->h3, http3_quic_api->local_max_streams_bidi(s->qc));
+  uint64_t max_streams = http3_quic_api->local_max_streams_bidi(s->qc);
+  nghttp3_conn_set_max_client_streams_bidi(s->h3, max_streams);
+  /* Every request #stop_reading gives up on leaves a Stream Cancellation on
+   * the QPACK decoder stream, and nghttp3 fails the connection once that
+   * stream holds more than max(this, 100) * 20 bytes. */
+  nghttp3_conn_set_max_concurrent_streams(s->h3, (size_t)max_streams);
 
   int64_t ctrl, enc, dec;
-  if (http3_quic_api->open_uni_stream(s->qc, &ctrl) != 0 ||
-      http3_quic_api->open_uni_stream(s->qc, &enc) != 0 ||
-      http3_quic_api->open_uni_stream(s->qc, &dec) != 0 ||
+  int rv = 0;
+  if ((rv = http3_quic_api->open_uni_stream(s->qc, &ctrl)) != 0 ||
+      (rv = http3_quic_api->open_uni_stream(s->qc, &enc)) != 0 ||
+      (rv = http3_quic_api->open_uni_stream(s->qc, &dec)) != 0 ||
       nghttp3_conn_bind_control_stream(s->h3, ctrl) != 0 ||
       nghttp3_conn_bind_qpack_streams(s->h3, enc, dec) != 0) {
-    return -1;
+    /* nghttp3 asserts the streams are bound before most calls, so the half
+     * made connection must go. A client has to let the server open three
+     * unidirectional streams (RFC 9114 section 6.2). */
+    return h3_fail_with(s, rv == QUIC_EXT_ERR_STREAM_ID_BLOCKED
+                               ? NGHTTP3_H3_GENERAL_PROTOCOL_ERROR
+                               : NGHTTP3_H3_INTERNAL_ERROR);
   }
   return 0;
 }
 
-/* A failure inside nghttp3 closes the QUIC connection with the HTTP/3 error
- * code it stands for. */
-static int h3_fail(h3_session *s, int64_t rv) {
-  http3_quic_api->set_application_error(
-      s->qc, nghttp3_err_infer_quic_app_error_code((int)rv));
-  return -1;
-}
-
 static int h3_recv_stream_data(void *ud, int64_t id, const uint8_t *data,
                                size_t len, int fin, uint64_t ts,
                                size_t *consumed) {
   h3_session *s = ud;
+  if (s->failed) {
+    return -1;
+  }
   if (s->h3 == NULL) {
     /* Nothing can arrive on a stream before the handshake; drop it. */
     *consumed = len;
@@ -513,6 +555,9 @@ static int h3_next_stream_data(void *ud, int64_t *id, int *fin,
   *id = -1;
   *fin = 0;
   *nvecs = 0;
+  if (s->failed) {
+    return -1;
+  }
   if (s->h3 == NULL) {
     return 0;
   }
@@ -589,9 +634,16 @@ static int h3_stream_stop_sending(void *ud, int64_t id,
   return h3_shutdown_stream_read(ud, id);
 }
 
+/* The client reset its side of the stream. The Ruby part answers a request
+ * cut short by it (#on_reset). */
 static int h3_stream_reset(void *ud, int64_t id, uint64_t final_size,
                            uint64_t app_error_code) {
-  return h3_shutdown_stream_read(ud, id);
+  h3_session *s = ud;
+  int rv = h3_shutdown_stream_read(s, id);
+  if (rv != 0 || s->h3 == NULL) {
+    return rv;
+  }
+  return h3_call_ruby(s, id_on_reset, id, 0, NULL);
 }
 
 static int h3_stream_close(void *ud, int64_t id, int has_code,
@@ -697,8 +749,27 @@ static h3_session *h3_session_get(VALUE self) {
   return s;
 }
 
-static h3_session *h3_session_get_open(VALUE self) {
+/* The session, for a method that may call into nghttp3 or the QUIC
+ * connection, or fail the connection. The Ruby part's callbacks run inside
+ * nghttp3 or inside the QUIC connection's packet handling, where none of
+ * that may happen, so such a method raises InvalidStateError there. */
+static h3_session *h3_session_enter(VALUE self) {
   h3_session *s = h3_session_get(self);
+  if (s->in_callback > 0) {
+    rb_raise(rb_eNghttp3InvalidStateError,
+             "#%" PRIsVALUE
+             " cannot be called from inside a callback of this session",
+             rb_id2str(rb_frame_this_func()));
+  }
+  return s;
+}
+
+/* h3_session_enter, for a method that needs the nghttp3 connection. */
+static h3_session *h3_session_get_open(VALUE self) {
+  h3_session *s = h3_session_enter(self);
+  if (s->failed) {
+    rb_raise(rb_eNghttp3InvalidStateError, "the HTTP/3 connection has failed");
+  }
   if (s->h3 == NULL) {
     rb_raise(rb_eNghttp3InvalidStateError,
              "the HTTP/3 connection is not set up yet (handshake pending)");
@@ -706,12 +777,20 @@ static h3_session *h3_session_get_open(VALUE self) {
   return s;
 }
 
+NORETURN(static void h3_raise_no_body(VALUE rb_id));
+static void h3_raise_no_body(VALUE rb_id) {
+  rb_raise(rb_eNghttp3StreamNotFoundError,
+           "no response body is open on stream %" PRIsVALUE, rb_id);
+}
+
+/* The body of stream rb_id. Ruby code that runs once it is found may make
+ * the connection go on and close the stream, so convert everything else
+ * first. */
 static h3_stream *h3_session_stream(VALUE self, VALUE rb_id) {
   h3_session *s = h3_session_get(self);
   h3_stream *st = h3_stream_find(s, NUM2LL(rb_id));
   if (st == NULL) {
-    rb_raise(rb_eNghttp3StreamNotFoundError,
-             "no response body is open on stream %" PRIsVALUE, rb_id);
+    h3_raise_no_body(rb_id);
   }
   return st;
 }
@@ -724,7 +803,7 @@ static void h3_stream_wake(h3_session *s, h3_stream *st) {
   st->blocked = false;
   int rv = nghttp3_conn_resume_stream(s->h3, st->id);
   if (rv != 0) {
-    nghttp3_rb_raise(rv, "Failed to resume stream");
+    h3_raise(s, rv, "Failed to resume stream");
   }
 }
 
@@ -783,15 +862,19 @@ static VALUE rb_http3_session_s_attach(VALUE klass, VALUE quic_conn,
  */
 static VALUE rb_http3_session_submit_response(VALUE self, VALUE rb_id,
                                               VALUE headers, VALUE has_body) {
-  h3_session *s = h3_session_get_open(self);
   int64_t id = NUM2LL(rb_id);
   Check_Type(headers, T_ARRAY);
 
-  long nvlen = RARRAY_LEN(headers);
-  VALUE tmp;
-  nghttp3_nv *nva = ALLOCV_N(nghttp3_nv, tmp, nvlen);
+  /* Every field is converted before a pointer into any is taken: to_ary and
+   * to_str may run Ruby code, which could change or drop the Strings taken
+   * so far, or start a GC that moves them. It goes over a copy of headers,
+   * which that code cannot shrink under it, and keeps the Strings in
+   * strings, two per field. */
+  VALUE fields = rb_ary_dup(headers);
+  long nvlen = RARRAY_LEN(fields);
+  VALUE strings = rb_ary_new_capa(nvlen * 2);
   for (long i = 0; i < nvlen; i++) {
-    VALUE pair = rb_check_array_type(RARRAY_AREF(headers, i));
+    VALUE pair = rb_check_array_type(RARRAY_AREF(fields, i));
     if (NIL_P(pair) || RARRAY_LEN(pair) != 2) {
       rb_raise(rb_eArgError, "headers must be [name, value] pairs");
     }
@@ -799,13 +882,16 @@ static VALUE rb_http3_session_submit_response(VALUE self, VALUE rb_id,
     VALUE value = RARRAY_AREF(pair, 1);
     StringValue(name);
     StringValue(value);
-    nva[i] = (nghttp3_nv){.name = (const uint8_t *)RSTRING_PTR(name),
-                          .value = (const uint8_t *)RSTRING_PTR(value),
-                          .namelen = (size_t)RSTRING_LEN(name),
-                          .valuelen = (size_t)RSTRING_LEN(value),
-                          .flags = NGHTTP3_NV_FLAG_NONE};
+    rb_ary_push(strings, name);
+    rb_ary_push(strings, value);
   }
 
+  /* Then the connection, which that code may have failed, and every
+   * allocation; then the pointers, and nghttp3 copies the names and values
+   * before anything else can run. */
+  h3_session *s = h3_session_get_open(self);
+  VALUE tmp;
+  nghttp3_nv *nva = ALLOCV_N(nghttp3_nv, tmp, nvlen);
   h3_stream *st = NULL;
   if (RTEST(has_body) && h3_stream_find(s, id) == NULL) {
     st = ZALLOC(h3_stream);
@@ -813,23 +899,76 @@ static VALUE rb_http3_session_submit_response(VALUE self, VALUE rb_id,
     st->fd = -1;
     st_insert(s->streams, (st_data_t)id, (st_data_t)st);
   }
+  for (long i = 0; i < nvlen; i++) {
+    VALUE name = RARRAY_AREF(strings, 2 * i);
+    VALUE value = RARRAY_AREF(strings, 2 * i + 1);
+    nva[i] = (nghttp3_nv){.name = (const uint8_t *)RSTRING_PTR(name),
+                          .value = (const uint8_t *)RSTRING_PTR(value),
+                          .namelen = (size_t)RSTRING_LEN(name),
+                          .valuelen = (size_t)RSTRING_LEN(value),
+                          .flags = NGHTTP3_NV_FLAG_NONE};
+  }
 
-  /* nghttp3 copies the header names and values. */
   int rv = nghttp3_conn_submit_response(
       s->h3, id, nva, (size_t)nvlen, RTEST(has_body) ? &h3_data_reader : NULL);
   ALLOCV_END(tmp);
-  RB_GC_GUARD(headers);
+  RB_GC_GUARD(strings);
   if (rv != 0) {
     if (st != NULL) {
       st_data_t key = (st_data_t)id;
       st_delete(s->streams, &key, NULL);
       h3_stream_free(st);
     }
-    nghttp3_rb_raise(rv, "Failed to submit response");
+    h3_raise(s, rv, "Failed to submit response");
   }
   return self;
 }
 
+/* rb_id as the id of a request stream: 0..2**62-1 and client-initiated
+ * bidirectional. nghttp3 asserts the range. */
+static int64_t h3_request_stream_id(VALUE rb_id) {
+  int64_t id = NUM2LL(rb_id);
+  if (id < 0 || (uint64_t)id > H3_VARINT_MAX) {
+    rb_raise(rb_eArgError, "stream_id must be 0..2**62-1 (got %" PRIsVALUE ")",
+             rb_id);
+  }
+  if ((id & 3) != 0) {
+    rb_raise(rb_eArgError,
+             "stream_id %" PRIsVALUE
+             " is not a client-initiated bidirectional stream",
+             rb_id);
+  }
+  return id;
+}
+
+/*
+ * call-seq:
+ *   session.stop_reading(stream_id) -> self
+ *
+ * Read no more of the request on stream_id, which is being answered
+ * before all of it has arrived: nghttp3 drops what still comes, and the
+ * client gets STOP_SENDING with H3_NO_ERROR. RFC 9114 section 4.1 lets a
+ * server send a complete response before the request is complete and
+ * then ask the client to stop sending it, with H3_NO_ERROR.
+ */
+static VALUE rb_http3_session_stop_reading(VALUE self, VALUE rb_id) {
+  int64_t id = h3_request_stream_id(rb_id);
+  h3_session *s = h3_session_get_open(self);
+  int rv = nghttp3_conn_shutdown_stream_read(s->h3, id);
+  if (rv != 0) {
+    h3_raise(s, rv, "Failed to stop reading the stream");
+  }
+  if (http3_quic_api->shutdown_stream_read(s->qc, id, NGHTTP3_H3_NO_ERROR) !=
+      0) {
+    rb_raise(rb_eNghttp3Error, "cannot send STOP_SENDING on stream %" PRIsVALUE,
+             rb_id);
+  }
+  /* No end_headers will come to drop the count of a section cut short. */
+  st_data_t key = (st_data_t)id;
+  st_delete(s->field_sizes, &key, NULL);
+  return self;
+}
+
 /*
  * call-seq:
  *   session.push_chunk(stream_id, str) -> self
@@ -837,16 +976,16 @@ static VALUE rb_http3_session_submit_response(VALUE self, VALUE rb_id,
  * Queue a frozen copy of str as the next piece of the response body.
  */
 static VALUE rb_http3_session_push_chunk(VALUE self, VALUE rb_id, VALUE str) {
-  h3_session *s = h3_session_get(self);
-  h3_stream *st = h3_session_stream(self, rb_id);
+  h3_session *s = h3_session_enter(self);
   StringValue(str);
+  VALUE copy = rb_str_new_frozen(str);
+  h3_stream *st = h3_session_stream(self, rb_id);
   if (st->eof) {
     rb_raise(rb_eNghttp3InvalidStateError, "the body has ended");
   }
-  if (RSTRING_LEN(str) == 0) {
+  if (RSTRING_LEN(copy) == 0) {
     return self;
   }
-  VALUE copy = rb_str_new_frozen(str);
   if (h3_stream_push(st, (const uint8_t *)RSTRING_PTR(copy),
                      (size_t)RSTRING_LEN(copy), copy) != 0) {
     rb_raise(rb_eNoMemError, "failed to queue a body chunk");
@@ -863,7 +1002,7 @@ static VALUE rb_http3_session_push_chunk(VALUE self, VALUE rb_id, VALUE str) {
  * Mark the end of the response body.
  */
 static VALUE rb_http3_session_push_eof(VALUE self, VALUE rb_id) {
-  h3_session *s = h3_session_get(self);
+  h3_session *s = h3_session_enter(self);
   h3_stream *st = h3_session_stream(self, rb_id);
   st->eof = true;
   h3_stream_wake(s, st);
@@ -882,11 +1021,9 @@ static VALUE rb_http3_session_push_eof(VALUE self, VALUE rb_id) {
  */
 static VALUE rb_http3_session_attach_file(VALUE self, VALUE rb_id, VALUE io,
                                           VALUE offset, VALUE length) {
-  h3_session *s = h3_session_get(self);
-  h3_stream *st = h3_session_stream(self, rb_id);
-  if (st->fd >= 0 || st->eof || st->nchunks > 0) {
-    rb_raise(rb_eNghttp3InvalidStateError, "the body is already given");
-  }
+  h3_session *s = h3_session_enter(self);
+  /* The arguments first, as #push_chunk does: io.fileno is Ruby code. */
+  int64_t id = NUM2LL(rb_id);
   off_t off = NUM2OFFT(offset);
   off_t len = NUM2OFFT(length);
   if (off < 0 || len < 0) {
@@ -897,6 +1034,15 @@ static VALUE rb_http3_session_attach_file(VALUE self, VALUE rb_id, VALUE io,
     rb_sys_fail("dup");
   }
   rb_update_max_fd(fd);
+  h3_stream *st = h3_stream_find(s, id);
+  if (st == NULL) {
+    close(fd);
+    h3_raise_no_body(rb_id);
+  }
+  if (st->fd >= 0 || st->eof || st->nchunks > 0) {
+    close(fd);
+    rb_raise(rb_eNghttp3InvalidStateError, "the body is already given");
+  }
   st->fd = fd;
   st->file_off = off;
   st->file_end = off + len;
@@ -954,13 +1100,13 @@ static VALUE rb_http3_session_take_error(VALUE self) {
  * served.
  */
 static VALUE rb_http3_session_shutdown_notice(VALUE self) {
-  h3_session *s = h3_session_get(self);
+  h3_session *s = h3_session_enter(self);
   if (s->h3 == NULL) {
     return self;
   }
   int rv = nghttp3_conn_submit_shutdown_notice(s->h3);
   if (rv != 0) {
-    nghttp3_rb_raise(rv, "Failed to submit shutdown notice");
+    h3_raise(s, rv, "Failed to submit shutdown notice");
   }
   return self;
 }
@@ -974,7 +1120,7 @@ static VALUE rb_http3_session_shutdown_notice(VALUE self) {
  */
 static VALUE rb_http3_session_abort_stream(VALUE self, VALUE rb_id,
                                            VALUE rb_code) {
-  h3_session *s = h3_session_get(self);
+  h3_session *s = h3_session_enter(self);
   int64_t id = NUM2LL(rb_id);
   uint64_t code = NUM2ULL(rb_code);
   if (s->h3 != NULL) {
@@ -992,6 +1138,7 @@ void Init_http3_session(VALUE rb_mHTTP3) {
   id_on_data = rb_intern("on_data");
   id_on_end_stream = rb_intern("on_end_stream");
   id_on_fields_too_large = rb_intern("on_fields_too_large");
+  id_on_reset = rb_intern("on_reset");
 
   rb_cHTTP3Session = rb_define_class_under(rb_mHTTP3, "Session", rb_cObject);
   rb_undef_alloc_func(rb_cHTTP3Session);
@@ -999,6 +1146,8 @@ void Init_http3_session(VALUE rb_mHTTP3) {
                              rb_http3_session_s_attach, 2);
   rb_define_method(rb_cHTTP3Session, "submit_response",
                    rb_http3_session_submit_response, 3);
+  rb_define_method(rb_cHTTP3Session, "stop_reading",
+                   rb_http3_session_stop_reading, 1);
   rb_define_method(rb_cHTTP3Session, "push_chunk", rb_http3_session_push_chunk,
                    2);
   rb_define_method(rb_cHTTP3Session, "push_eof", rb_http3_session_push_eof, 1);

data/lib/http3/rack_adapter.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "stringio"
+require "uri"
 
 module HTTP3
   # Calls a Rack 3 application for an HTTP3::Request and turns what it
@@ -10,6 +11,18 @@ module HTTP3
     # server answers 500 instead.
     class InvalidResponse < StandardError; end
 
+    # The request cannot be put in a Rack env; it is answered with 400.
+    class BadRequest < StandardError; end
+    private_constant :BadRequest
+
+    # The schemes a Rack env may carry (Rack also allows ws and wss, which
+    # HTTP/3 has no use for).
+    SCHEMES = %w[http https].freeze
+
+    # An authority, "host" or "host:port" (RFC 3986 section 3.2), as Rack
+    # Lint checks HTTP_HOST: the port is digits, of any number, or none.
+    AUTHORITY = /\A(?<host>#{URI::RFC3986_Parser::HOST})(?::(?<port>\d*))?\z/
+
     # Connection-specific fields, which HTTP/3 forbids (RFC 9114 section
     # 4.2).
     CONNECTION_FIELDS = %w[connection keep-alive transfer-encoding upgrade proxy-connection].freeze
@@ -23,18 +36,53 @@ module HTTP3
 
     def initialize(app)
       @app = app
+      @refusals = Hash.new(0)
     end
 
-    # remote is the client's address, an Addrinfo. Raises whatever the
+    # remote is the client's address, an Addrinfo. CONNECT is answered with
+    # 501, and a request the Rack env cannot carry with 400, without calling
+    # the application; #take_refusals counts them. Raises whatever the
     # application raises, and InvalidResponse for a response that cannot be
     # sent; the Rack body is closed in both cases.
     def call(request, remote:)
-      status, headers, body = @app.call(env_for(request, remote))
+      # The server cannot open a tunnel (RFC 9114 section 4.4), and a
+      # CONNECT request has neither :scheme nor :path, so the env would be
+      # made up. The Session leaves nghttp3's enable_connect_protocol off,
+      # so nghttp3 refuses the :protocol of an extended CONNECT (RFC 9220).
+      return refuse(501) if request.headers.assoc(":method")&.last == "CONNECT"
+
+      env = env_for(request, remote)
+    rescue BadRequest
+      # Not logged: the client sent it, the server did not fail.
+      refuse(400)
+    else
+      status, headers, body = @app.call(env)
       response_for(request, status, headers, body)
     end
 
+    # The requests answered without the application since the last call,
+    # as {status => count}; the count starts over.
+    def take_refusals
+      refusals = @refusals
+      @refusals = Hash.new(0)
+      refusals
+    end
+
     private
 
+    def refuse(status)
+      @refusals[status] += 1
+      Response.new(status: status, headers: [], body: nil)
+    end
+
+    # Raises BadRequest for what Rack does not allow, or allows in a form
+    # the application might read differently from the client, in this
+    # order: a scheme other than http and https, a fragment in the path, an
+    # authority that is not one (RFC 3986 section 3.2), and an :authority
+    # and a host field that disagree (RFC 9114 section 4.3.1). nghttp3 has
+    # already refused a request without :scheme, :path, or both :authority
+    # and host (but CONNECT); the defaults are for calling the adapter
+    # directly.
     def env_for(request, remote)
       pseudo = {}
       fields = {}
@@ -46,18 +94,33 @@ module HTTP3
         end
       end
 
-      path, query = pseudo.fetch(":path", "/").split("?", 2)
-      scheme = pseudo.fetch(":scheme", "https")
-      authority = pseudo[":authority"] || fields["host"]&.first || "localhost"
-      server_name, server_port = split_authority(authority, scheme)
+      # nghttp3 takes either case of http and https; Rack wants them in
+      # lowercase.
+      scheme = pseudo.fetch(":scheme", "https").downcase
+      raise BadRequest, "scheme #{scheme} is not http or https" unless SCHEMES.include?(scheme)
+
+      # nghttp3 lets a fragment through; Rack forbids one.
+      target = pseudo.fetch(":path", "/")
+      raise BadRequest, "the path has a fragment" if target.include?("#")
+
+      path, query = target.split("?", 2)
+      host = fields["host"]&.first
+      authority = pseudo[":authority"] || host || "localhost"
+      match = AUTHORITY.match(authority) or raise BadRequest, "the authority is malformed"
+      if pseudo[":authority"] && host && host != pseudo[":authority"]
+        raise BadRequest, ":authority and host differ"
+      end
+
+      port = match[:port]
+      port = (scheme == "http") ? "80" : "443" if port.nil? || port.empty?
 
       env = {
         "REQUEST_METHOD" => pseudo.fetch(":method", "GET"),
         "SCRIPT_NAME" => "",
         "PATH_INFO" => path,
         "QUERY_STRING" => query || "",
-        "SERVER_NAME" => server_name,
-        "SERVER_PORT" => server_port,
+        "SERVER_NAME" => match[:host],
+        "SERVER_PORT" => port,
         "SERVER_PROTOCOL" => "HTTP/3",
         "REMOTE_ADDR" => remote.ip_address,
         "HTTP_HOST" => authority,
@@ -88,35 +151,45 @@ module HTTP3
       end
     end
 
-    # "host", "host:port", "[v6]" or "[v6]:port"; the port defaults to the
-    # scheme's.
-    def split_authority(authority, scheme)
-      default_port = (scheme == "http") ? "80" : "443"
-      if (match = authority.match(/\A(\[[^\]]*\])(?::(\d+))?\z/))
-        [match[1], match[2] || default_port]
-      else
-        host, port = authority.split(":", 2)
-        [host, port || default_port]
-      end
-    end
-
-    # The Rack body is closed here unless it goes on in the Response.
+    # The Rack body is closed here unless it goes on in the Response, or
+    # to_ary has closed it (body_for yields then).
     def response_for(request, status, headers, body)
       response = nil
       status = Integer(status)
+      # A 1xx is no final response, which is all HTTP/3 can send here (Rack
+      # Lint only asks for 100 or more).
+      unless (200..599).cover?(status)
+        raise InvalidResponse, "status #{status} is not a final status (200..599)"
+      end
       headers = header_pairs(headers)
+      # A 204 must not have one (RFC 9110 section 8.6); it is dropped as the
+      # connection-specific fields are.
+      headers = headers.reject { |pair| pair.first == "content-length" } if status == 204
+      length = content_length(headers)
 
       method = request.headers.assoc(":method")&.last
-      response = if method == "HEAD" || status < 200 || status == 204 || status == 304
+      response = if method == "HEAD" || status == 204 || status == 304
+        # No body is sent, so content-length is not held against one.
         close_rack_body(body)
         Response.new(status: status, headers: headers, body: nil)
       else
-        Response.new(status: status, headers: headers, body: body_for(body))
+        Response.new(status: status, headers: headers, body: body_for(body, length) { body = nil })
       end
     ensure
       close_rack_body(body) if response.nil?
     end
 
+    # The content-length among headers, as an Integer, or nil if there is
+    # none. The message leaves the value out, as header_pairs's do.
+    def content_length(headers)
+      values = headers.filter_map { |name, value| value if name == "content-length" }
+      return nil if values.empty?
+      raise InvalidResponse, "content-length is given more than once" if values.size > 1
+      raise InvalidResponse, "content-length is not a number" unless values.first.match?(/\A\d+\z/)
+
+      Integer(values.first, 10)
+    end
+
     # Rack 3 headers: lowercase names, each value a String or an Array of
     # them, one field per element. nghttp3 sends names and values as they
     # are, so a name that is not a token (":status", say) or a value with
@@ -141,20 +214,62 @@ module HTTP3
       pairs
     end
 
-    def body_for(body)
+    # The body to send. One whose length is known before it is sent, a file
+    # or an Array, is held against length, the content-length, now; one
+    # read with each, as it is read (#counted).
+    def body_for(body, length)
       if body.respond_to?(:to_path)
         io = ::File.open(body.to_path, "rb")
+        if length && io.size != length
+          size = io.size
+          io.close
+          raise length_mismatch(size)
+        end
         Body::File.new(io: io, offset: 0, length: io.size, rack_body: body)
       elsif body.respond_to?(:to_ary)
         # Rack 3 has to_ary close the body itself.
-        Body::Chunks.new(enum: body.to_ary.each, rack_body: nil)
+        chunks = body.to_ary
+        yield
+        # Checked before anything is sent, which Session#fill_bodies would
+        # only find out once the headers have gone.
+        chunks.each do |chunk|
+          raise InvalidResponse, "body chunk must be a String (got #{chunk.class})" unless chunk.is_a?(String)
+        end
+        size = chunks.sum(&:bytesize)
+        raise length_mismatch(size) if length && size != length
+
+        Body::Chunks.new(enum: chunks.each, rack_body: nil)
       elsif body.respond_to?(:each)
-        Body::Chunks.new(enum: body.to_enum(:each), rack_body: body)
+        enum = length ? counted(body, length) : body.to_enum(:each)
+        Body::Chunks.new(enum: enum, rack_body: body)
       else
         raise InvalidResponse, "streaming bodies (#{body.class}) are not supported"
       end
     end
 
+    # The chunks of body's each, raising InvalidResponse from next once they
+    # pass length bytes, or end short of it. Session#fill_bodies aborts the
+    # stream then, since the headers have gone. A chunk that is not a String
+    # goes on to fill_bodies, which refuses it.
+    def counted(body, length)
+      Enumerator.new do |y|
+        size = 0
+        body.each do |chunk|
+          size += chunk.bytesize if chunk.is_a?(String)
+          if size > length
+            raise InvalidResponse, "the body is at least #{size} bytes but content-length says otherwise"
+          end
+
+          y << chunk
+        end
+        raise length_mismatch(size) if size < length
+      end
+    end
+
+    def length_mismatch(size)
+      InvalidResponse.new("the body is #{size} bytes but content-length says otherwise")
+    end
+
     def close_rack_body(body)
       body.close if body.respond_to?(:close)
     end