http3 0.0.3 → 0.0.4

data/lib/http3/server.rb

@@ -19,7 +19,11 @@ module HTTP3
   #
   # Only failures are logged, one line each: the event, then key=value
   # pairs. Requests are not logged; use Rack::CommonLogger for that. Query
-  # strings and header values never appear in the log.
+  # strings and header values never appear in the log. Those answered
+  # without the application (400, 408, 413, 431, 501, 503) are counted
+  # instead: refusal_log_interval seconds after the first of them, and when
+  # #run ends, a warn line per status tells how many there were since,
+  # such as "requests_refused status=503 count=1234 seconds=60".
   class Server
     ALPN = ["h3"].freeze
 
@@ -42,11 +46,29 @@ module HTTP3
     # certificate_path is a PEM chain, leaf first; private_key_path a PEM key
     # without passphrase. qlog_dir writes one qlog file per connection.
     # max_request_body and max_field_section_size (bytes) bound a request's
-    # body (413 beyond) and header section (431 beyond); send_buffer_size
-    # bounds the bytes of a response body queued but unsent per stream.
+    # body (413 beyond) and header section (431 beyond).
+    # max_connection_request_buffer bounds the bytes the requests of a
+    # connection hold before they reach the application, and
+    # max_total_request_buffer those of every connection; a request that
+    # would pass either gets 503. They have to leave room for a request at
+    # the other two limits, or ArgumentError is raised. send_buffer_size
+    # bounds the bytes of a response body queued but unsent per stream,
+    # max_connection_send_buffer those of the array and each bodies of a
+    # connection, and max_total_send_buffer those of every connection; a
+    # body waits for room. Each has to be at least the one before. A request
+    # not received in full within request_timeout seconds of the start of
+    # its headers gets 408; nil is no limit. refusal_log_interval is the
+    # seconds between the requests_refused lines (see above).
     def initialize(app:, bind:, certificate_path:, private_key_path:, transport_params: nil, settings: nil,
       qlog_dir: nil, max_connections: 1024, max_request_body: 1_048_576, max_field_section_size: 65_536,
-      send_buffer_size: 65_536, shutdown_timeout: 30, logger: Logger.new($stderr))
+      max_connection_request_buffer: 4_194_304, max_total_request_buffer: 67_108_864,
+      send_buffer_size: 65_536, max_connection_send_buffer: 1_048_576, max_total_send_buffer: 67_108_864,
+      request_timeout: 30, refusal_log_interval: 60, shutdown_timeout: 30, logger: Logger.new($stderr))
+      check_request_limits(max_request_body, max_field_section_size, max_connection_request_buffer,
+        max_total_request_buffer)
+      check_send_limits(send_buffer_size, max_connection_send_buffer, max_total_send_buffer)
+      check_request_timeout(request_timeout)
+      check_refusal_log_interval(refusal_log_interval)
       @adapter = RackAdapter.new(app)
       @bind_address = parse_bind(bind)
       @certificate_path = certificate_path
@@ -60,7 +82,13 @@ module HTTP3
       @max_connections = max_connections
       @max_request_body = max_request_body
       @max_field_section_size = max_field_section_size
+      @max_connection_request_buffer = max_connection_request_buffer
+      @max_total_request_buffer = max_total_request_buffer
       @send_buffer_size = send_buffer_size
+      @max_connection_send_buffer = max_connection_send_buffer
+      @max_total_send_buffer = max_total_send_buffer
+      @request_timeout = request_timeout
+      @refusal_log_interval = refusal_log_interval
       @shutdown_timeout = shutdown_timeout
       @logger = logger
     end
@@ -77,13 +105,19 @@ module HTTP3
       )
       @sessions = {}
       @remotes = {}
+      @request_buffer = Session.shared_buffer(@max_total_request_buffer)
       @blocked_send = nil
       @phase = :serving
       @drain_deadline = nil
+      # {status => count} of the requests answered without the
+      # application, since @refusals_since.
+      @refusals = Hash.new(0)
+      @refusals_since = nil
       old_traps = install_traps(sig_w)
 
       turn(sig_r) until finished?
       close_connections
+      log_refusals
       nil
     ensure
       restore_traps(old_traps) if old_traps
@@ -93,15 +127,21 @@ module HTTP3
 
     private
 
-    # One turn of the loop.
+    # One turn of the loop. The room left in max_total_send_buffer is
+    # counted once, at the start. Only fill_bodies queues more, so until
+    # then the room can only have grown (nghttp3 taking what flush sends),
+    # and filling by the room counted queues no more than the limit allows.
     def turn(sig_r)
+      room = send_room
       writers = @blocked_send ? [@sock] : nil
-      readable, writable, = IO.select([@sock, sig_r], writers, nil, select_timeout)
+      readable, writable, = IO.select([@sock, sig_r], writers, nil, select_timeout(room))
       handle_signals(sig_r) if readable&.include?(sig_r)
       flush if writable&.include?(@sock)
       receive if readable&.include?(@sock)
+      expire_requests
       serve_requests
-      fill_bodies
+      log_refusals if refusals_due?
+      fill_bodies(room)
       @endpoint.handle_expiry if due?(@endpoint.expiry)
       flush
       reap
@@ -115,14 +155,21 @@ module HTTP3
       end
     end
 
-    # Until the next timer or the end of the drain, but no wait at all while
-    # a body could take more.
-    def select_timeout
-      return 0 if @sessions.each_value.any? { |session| session.wants_fill?(@send_buffer_size) }
+    # Until the next timer, the next request to run out of time, the next
+    # requests_refused lines or the end of the drain, but no wait at all
+    # while a body could take more within the send buffers.
+    def select_timeout(room)
+      wants_fill = @sessions.each_value.any? { |session|
+        session.wants_fill?(@send_buffer_size, connection_limit: @max_connection_send_buffer, room: room)
+      }
+      return 0 if wants_fill
 
       timeouts = []
       expiry = @endpoint.expiry
       timeouts << [(expiry - now_ns) / 1e9, 0.0].max if expiry
+      deadline = @sessions.each_value.filter_map(&:next_request_deadline).min
+      timeouts << [deadline - now, 0.0].max if deadline
+      timeouts << [refusal_log_at - now, 0.0].max if refusal_log_at
       timeouts << [@drain_deadline - now, 0.0].max if @drain_deadline
       timeouts.min
     end
@@ -142,16 +189,39 @@ module HTTP3
         conn = @endpoint.read_pkt(data, remote: sender.to_sockaddr)
         next if conn.nil? || @sessions.key?(conn)
 
-        @sessions[conn] = Session.attach(
-          conn, max_request_body: @max_request_body, max_field_section_size: @max_field_section_size
-        )
-        @remotes[conn] = sender
+        attach_session(conn, sender)
       end
     end
 
+    # Serve a new connection. One whose Session cannot be set up is logged
+    # and closed, and the loop goes on with the others.
+    def attach_session(conn, sender)
+      @sessions[conn] = Session.attach(
+        conn, max_request_body: @max_request_body, max_field_section_size: @max_field_section_size,
+        max_connection_request_buffer: @max_connection_request_buffer, shared_buffer: @request_buffer,
+        request_timeout: @request_timeout
+      )
+      @remotes[conn] = sender
+    rescue => e
+      log(:error, "session_error", remote: format_remote(sender), **error_fields(e))
+      begin
+        conn.close(error_code: Nghttp3::H3_INTERNAL_ERROR)
+      rescue QUIC::Error
+        nil
+      end
+    end
+
+    # Refuse with 408 the requests that ran out of time; serve_requests
+    # answers them.
+    def expire_requests
+      at = now
+      @sessions.each_value { |session| session.expire_requests(at) }
+    end
+
     def serve_requests
       @sessions.each do |conn, session|
         session.take_requests.each do |request, status|
+          count_refusal(status) if status
           response = status ? Response.new(status: status, headers: [], body: nil) : call_app(conn, request)
           begin
             session.respond(request, response) { |error| log_body_error(conn, request, error) }
@@ -161,6 +231,7 @@ module HTTP3
           end
         end
       end
+      @adapter.take_refusals.each { |status, count| count_refusal(status, count) }
     end
 
     def call_app(conn, request)
@@ -170,12 +241,49 @@ module HTTP3
       Response.new(status: 500, headers: [], body: nil)
     end
 
-    def fill_bodies
+    def count_refusal(status, count = 1)
+      @refusals_since ||= now
+      @refusals[status] += count
+    end
+
+    # When the refusals counted are due to be logged; nil while there are
+    # none.
+    def refusal_log_at
+      @refusals_since && @refusals_since + @refusal_log_interval
+    end
+
+    def refusals_due?
+      at = refusal_log_at
+      !at.nil? && at <= now
+    end
+
+    # One line per status, in ascending order, with the seconds since the
+    # first of them; the count starts over.
+    def log_refusals
+      return if @refusals_since.nil?
+
+      seconds = (now - @refusals_since).round
+      @refusals.sort.each do |status, count|
+        log(:warn, "requests_refused", status: status, count: count, seconds: seconds)
+      end
+      @refusals.clear
+      @refusals_since = nil
+    end
+
+    # The connections are filled in the order they came, so that while the
+    # total is short the older ones get its room first.
+    def fill_bodies(room)
       @sessions.each do |conn, session|
-        session.fill_bodies(@send_buffer_size) { |request, error| log_app_error(conn, request, error) }
+        room -= session.fill_bodies(@send_buffer_size, connection_limit: @max_connection_send_buffer,
+          room: room) { |request, error| log_app_error(conn, request, error) }
       end
     end
 
+    # What max_total_send_buffer has left for array and each bodies.
+    def send_room
+      @max_total_send_buffer - @sessions.each_value.sum(&:unsent_total)
+    end
+
     # Send what the Endpoint has, until the socket would block.
     def flush
       loop do
@@ -282,6 +390,64 @@ module HTTP3
       previous.each { |name, handler| Signal.trap(name, handler || "DEFAULT") }
     end
 
+    # Raise ArgumentError for the first request limit found wrong: each has
+    # to be an Integer in range, and the buffers have to let a request at
+    # max_request_body and max_field_section_size through on a server with
+    # nothing else under way.
+    def check_request_limits(max_request_body, max_field_section_size, max_connection_request_buffer,
+      max_total_request_buffer)
+      unless max_request_body.is_a?(Integer) && max_request_body >= 0
+        raise ArgumentError, "max_request_body must be an Integer of 0 or more (got #{max_request_body.inspect})"
+      end
+      # The range Session._attach takes, which would otherwise raise only
+      # on the first connection.
+      unless max_field_section_size.is_a?(Integer) && (1...2**62).cover?(max_field_section_size)
+        raise ArgumentError, "max_field_section_size must be 1..2**62-1 (got #{max_field_section_size.inspect})"
+      end
+      {max_connection_request_buffer:, max_total_request_buffer:}.each do |name, value|
+        raise ArgumentError, "#{name} must be a positive Integer (got #{value.inspect})" unless value.is_a?(Integer) && value.positive?
+      end
+      request = max_request_body + max_field_section_size
+      if max_connection_request_buffer < request
+        raise ArgumentError, "max_connection_request_buffer (#{max_connection_request_buffer}) must be at least " \
+          "max_request_body + max_field_section_size (#{request})"
+      end
+      if max_total_request_buffer < max_connection_request_buffer
+        raise ArgumentError, "max_total_request_buffer (#{max_total_request_buffer}) must be at least " \
+          "max_connection_request_buffer (#{max_connection_request_buffer})"
+      end
+    end
+
+    # Raise ArgumentError for the first send limit found wrong: each has to
+    # be a positive Integer, at least the one before.
+    def check_send_limits(send_buffer_size, max_connection_send_buffer, max_total_send_buffer)
+      {send_buffer_size:, max_connection_send_buffer:, max_total_send_buffer:}.each do |name, value|
+        raise ArgumentError, "#{name} must be a positive Integer (got #{value.inspect})" unless value.is_a?(Integer) && value.positive?
+      end
+      if max_connection_send_buffer < send_buffer_size
+        raise ArgumentError, "max_connection_send_buffer (#{max_connection_send_buffer}) must be at least " \
+          "send_buffer_size (#{send_buffer_size})"
+      end
+      if max_total_send_buffer < max_connection_send_buffer
+        raise ArgumentError, "max_total_send_buffer (#{max_total_send_buffer}) must be at least " \
+          "max_connection_send_buffer (#{max_connection_send_buffer})"
+      end
+    end
+
+    def check_request_timeout(request_timeout)
+      return if request_timeout.nil?
+      return if (request_timeout.is_a?(Integer) || request_timeout.is_a?(Float)) && request_timeout.positive?
+
+      raise ArgumentError, "request_timeout must be nil or a positive number of seconds (got #{request_timeout.inspect})"
+    end
+
+    def check_refusal_log_interval(refusal_log_interval)
+      return if (refusal_log_interval.is_a?(Integer) || refusal_log_interval.is_a?(Float)) && refusal_log_interval.positive?
+
+      raise ArgumentError,
+        "refusal_log_interval must be a positive number of seconds (got #{refusal_log_interval.inspect})"
+    end
+
     def parse_bind(bind)
       match = bind.match(/\A\[(?<host>[^\]]+)\]:(?<port>\d+)\z/) || bind.match(/\A(?<host>[^:\[\]]+):(?<port>\d+)\z/)
       raise ArgumentError, "bind must be \"host:port\" or \"[ipv6]:port\" (got #{bind.inspect})" unless match
@@ -338,6 +504,10 @@ module HTTP3
 
     def remote_of(conn)
       address = @remotes[conn] or return "-"
+      format_remote(address)
+    end
+
+    def format_remote(address)
       host = address.ipv6? ? "[#{address.ip_address}]" : address.ip_address
       "#{host}:#{address.ip_port}"
     end

data/lib/http3/session.rb

@@ -10,49 +10,136 @@ module HTTP3
   # requests, answers them, keeps the bodies flowing and lets go of what
   # the streams no longer need.
   class Session
-    # A request still coming in. reject is the status to answer with
-    # instead of calling the application (413, 431), or nil.
-    Incoming = Struct.new(:pseudo, :fields, :body, :reject)
+    # A request still coming in; started is when its headers began
+    # (CLOCK_MONOTONIC).
+    Incoming = Struct.new(:pseudo, :fields, :body, :started)
 
     # A response whose body is being sent.
     Outgoing = Struct.new(:request, :body, :done)
 
+    # What a field counts for besides its name and value, as RFC 9114
+    # section 4.2.2 counts it, and as the C part does for 431.
+    FIELD_OVERHEAD = 32
+
+    # Bytes the requests coming in may hold: a connection's, and through
+    # parent the server's. Only the server's I/O loop, one thread, calls
+    # it, so it takes no lock.
+    class Budget
+      attr_reader :limit, :used
+
+      def initialize(limit, parent: nil)
+        @limit = limit
+        @used = 0
+        @parent = parent
+      end
+
+      # Count n bytes and return true if they fit both here and in the
+      # parent; count nothing and return false if not.
+      def reserve(n)
+        return false if @used + n > @limit
+        return false if @parent && !@parent.reserve(n)
+
+        @used += n
+        true
+      end
+
+      def release(n)
+        @used -= n
+        @parent&.release(n)
+      end
+    end
+    private_constant :Budget
+
     # Take over quic_conn's streams. A request body over max_request_body
     # bytes is answered with 413, a header section over
-    # max_field_section_size bytes (RFC 9114 section 4.2.2) with 431.
-    def self.attach(quic_conn, max_request_body:, max_field_section_size:)
+    # max_field_section_size bytes (RFC 9114 section 4.2.2) with 431, as
+    # soon as the request passes the limit; the rest of it is not read.
+    #
+    # The requests not yet handed out (#take_requests) may hold
+    # max_connection_request_buffer bytes in all, header fields counted as
+    # for 431 and bodies by their bytes, and those of every Session given
+    # the same shared_buffer (Session.shared_buffer) its limit; a request
+    # that would pass either is answered with 503.
+    #
+    # A request not received in full within request_timeout seconds of the
+    # start of its headers is answered with 408 (#expire_requests); nil is
+    # no limit.
+    def self.attach(quic_conn, max_request_body:, max_field_section_size:,
+      max_connection_request_buffer: 4_194_304, shared_buffer: nil, request_timeout: nil)
       session = _attach(quic_conn, max_field_section_size)
-      session.send(:setup, max_request_body)
+      session.send(:setup, max_request_body, Budget.new(max_connection_request_buffer, parent: shared_buffer),
+        request_timeout)
       session
     end
 
+    # A limit of limit bytes for the requests coming in on every Session
+    # given it as attach's shared_buffer.
+    def self.shared_buffer(limit)
+      Budget.new(limit)
+    end
+
     # The requests received in full since the last call, each as
     # [request, status]: status is nil for the application to answer the
-    # request, or the status to answer it with directly.
+    # request, or the status to answer it with directly. A request answered
+    # directly comes out as soon as it is refused, before the rest of it
+    # has arrived, with neither headers nor body. The bytes they held no
+    # longer count for the limits.
     def take_requests
       done = @done
       @done = []
+      done.each { |request, _| release_held(request.stream_id) }
       done
     end
 
+    # Refuse with 408 the requests still coming in whose request_timeout
+    # has passed at now (CLOCK_MONOTONIC); #take_requests hands them out.
+    def expire_requests(now)
+      return if @request_timeout.nil?
+
+      @incoming.each do |id, request|
+        next if @rejected[id] || request.started + @request_timeout > now
+
+        reject(id, request, 408)
+      end
+    end
+
+    # When the next request still coming in runs out of time
+    # (CLOCK_MONOTONIC), or nil.
+    def next_request_deadline
+      return nil if @request_timeout.nil?
+
+      started = @incoming.filter_map { |id, request| request.started unless @rejected[id] }.min
+      started && started + @request_timeout
+    end
+
     # Send response to request. Its body, if any, is kept until the stream
     # closes, but the IO of a Body::File is closed at once: the C part reads
     # the file through a descriptor of its own. When that descriptor cannot
     # be had (EMFILE, say), the stream is aborted with H3_INTERNAL_ERROR and
-    # the block gets the exception.
+    # the block gets the exception. A request is answered once: nghttp3
+    # would send a second response after the first, so it raises
+    # Nghttp3::InvalidStateError.
     def respond(request, response)
+      id = request.stream_id
+      raise Nghttp3::InvalidStateError, "stream #{id} has been answered" if @answered[id]
+
+      stop_reading(id) if @rejected[id]
       headers = [[":status", response.status.to_s], *response.headers]
       body = response.body
-      submit_response(request.stream_id, headers, !body.nil?)
+      submit_response(id, headers, !body.nil?)
+      @answered[id] = true
       return if body.nil?
 
-      @outgoing[request.stream_id] = Outgoing.new(request, body, false)
+      # Only the pseudo-headers stay, for the log, while the body is sent:
+      # the request body would otherwise be held all along, uncounted.
+      pseudo = request.headers.select { |name, _| name.start_with?(":") }
+      @outgoing[id] = Outgoing.new(Request.new(stream_id: id, headers: pseudo, body: "".b), body, false)
       return unless body.is_a?(Body::File)
 
       begin
-        attach_file(request.stream_id, body.io, body.offset, body.length)
+        attach_file(id, body.io, body.offset, body.length)
       rescue SystemCallError => e
-        abort_stream(request.stream_id, Nghttp3::H3_INTERNAL_ERROR)
+        abort_stream(id, Nghttp3::H3_INTERNAL_ERROR)
         yield e if block_given?
       ensure
         body.io.close
@@ -60,24 +147,44 @@ module HTTP3
     end
 
     # Queue more of each Body::Chunks body until limit bytes wait unsent on
-    # its stream. A body whose enum raises is the application failing after
-    # its headers went out: the stream is aborted with H3_INTERNAL_ERROR and
-    # the block gets (request, exception).
-    def fill_bodies(limit)
+    # its stream, connection_limit on the whole connection (#unsent_total),
+    # and room more bytes have been queued; nil is no limit. A chunk may
+    # take any of them past its limit, by less than its size. Returns the
+    # bytes queued.
+    #
+    # A body whose enum raises is the application failing after its headers
+    # went out: the stream is aborted with H3_INTERNAL_ERROR and the block
+    # gets (request, exception). That request has only the pseudo-headers,
+    # and no body.
+    def fill_bodies(limit, connection_limit: nil, room: nil)
+      left = [room, connection_limit && connection_limit - unsent_total].compact.min
+      queued = 0
       @outgoing.each_value do |out|
         next if out.done || !out.body.is_a?(Body::Chunks)
+        break if left && queued >= left
 
-        fill_body(out, limit) { |error| yield out.request, error if block_given? }
+        queued += fill_body(out, limit, left && left - queued) { |error| yield out.request, error if block_given? }
       end
+      queued
     end
 
-    # True when a Body::Chunks body could take more right now.
-    def wants_fill?(limit)
+    # True when a Body::Chunks body could take more right now, with the
+    # limits of #fill_bodies.
+    def wants_fill?(limit, connection_limit: nil, room: nil)
+      return false if room && room <= 0
+      return false if connection_limit && unsent_total >= connection_limit
+
       @outgoing.any? do |id, out|
         !out.done && out.body.is_a?(Body::Chunks) && unsent_bytes(id) < limit
       end
     end
 
+    # Bytes of the Body::Chunks bodies queued but not taken by nghttp3 yet,
+    # on every stream; a body that has ended may still have some.
+    def unsent_total
+      @outgoing.sum { |id, out| out.body.is_a?(Body::Chunks) ? unsent_bytes(id) : 0 }
+    end
+
     # True while a request stream is open: received in part, waiting for
     # its answer, or with a response still being sent.
     def busy?
@@ -86,8 +193,13 @@ module HTTP3
 
     # Let go of the streams nghttp3 closed: their requests are dropped and
     # their bodies closed. The block gets (stream_id, exception) for a body
-    # whose close raised.
+    # whose close raised. First, the requests the client reset before their
+    # end (#on_reset) get our side of their streams reset too, with
+    # H3_REQUEST_INCOMPLETE as RFC 9114 section 4.1 says, so that the
+    # streams close.
     def release_closed(&block)
+      @incomplete.each { |id| abort_stream(id, Nghttp3::H3_REQUEST_INCOMPLETE) }
+      @incomplete.clear
       take_closed.each { |id| release(id, &block) }
     end
 
@@ -100,17 +212,22 @@ module HTTP3
 
     def on_begin_headers(id)
       @open[id] = true
-      @incoming[id] = Incoming.new([], [], "".b, nil)
+      @incoming[id] = Incoming.new([], [], "".b, Process.clock_gettime(Process::CLOCK_MONOTONIC))
     end
 
     def on_header(id, name, value)
       request = @incoming[id] or return
+      return if @rejected[id]
+      return reject(id, request, 503) unless hold(id, name.bytesize + value.bytesize + FIELD_OVERHEAD)
+
       (name.start_with?(":") ? request.pseudo : request.fields) << [name, value]
     end
 
     def on_fields_too_large(id)
       request = @incoming[id] or return
-      request.reject = 431
+      return if @rejected[id]
+
+      reject(id, request, 431)
     end
 
     def on_end_headers(id)
@@ -118,64 +235,126 @@ module HTTP3
 
     def on_data(id, bytes)
       request = @incoming[id] or return
-      return if request.reject
+      return if @rejected[id]
 
       if request.body.bytesize + bytes.bytesize > @max_request_body
-        request.reject = 413
-        request.body = "".b
+        reject(id, request, 413)
+      elsif !hold(id, bytes.bytesize)
+        reject(id, request, 503)
       else
         request.body << bytes
       end
     end
 
     def on_end_stream(id)
+      return if @rejected[id]
+
       request = @incoming.delete(id) or return
       headers = request.pseudo + request.fields
-      @done << [Request.new(stream_id: id, headers: headers, body: request.body), request.reject]
+      @done << [Request.new(stream_id: id, headers: headers, body: request.body), nil]
+    end
+
+    # The client reset its side of the stream. A request it had not
+    # finished is dropped with the bytes it held, and #release_closed
+    # resets our side; one received in full, or refused, is answered as it
+    # would have been. Inside a callback, so it calls no C.
+    def on_reset(id)
+      return unless @incoming.key?(id) && !@rejected[id]
+
+      @incoming.delete(id)
+      release_held(id)
+      @incomplete << id
     end
 
     private
 
-    def setup(max_request_body)
+    def setup(max_request_body, budget, request_timeout)
       @max_request_body = max_request_body
+      @budget = budget
+      @request_timeout = request_timeout
+      @held = {}
       @incoming = {}
       @done = []
       @outgoing = {}
       @open = {}
+      @rejected = {}
+      @answered = {}
+      @incomplete = []
+    end
+
+    # Count n more bytes for the request on id, if the budget has room.
+    def hold(id, n)
+      return false unless @budget.reserve(n)
+
+      @held[id] = @held.fetch(id, 0) + n
+      true
+    end
+
+    # The request on id holds nothing any more. Calling it again does
+    # nothing.
+    def release_held(id)
+      n = @held.delete(id) or return
+      @budget.release(n)
+    end
+
+    # Answer the request on id with status, at once, instead of passing it
+    # on: what has come of it is dropped, with the bytes it held, and
+    # #respond stops reading the rest. Its Incoming stays in @incoming,
+    # emptied, until the stream closes, and the callbacks still to come for
+    # it are ignored. 431 may come before all of the pseudo-headers, so the
+    # request goes out without any headers. A refusal is not logged: only
+    # failures are, and a flood of refusals would flood the log.
+    def reject(id, request, status)
+      request.pseudo.clear
+      request.fields.clear
+      request.body = "".b
+      release_held(id)
+      @rejected[id] = true
+      @done << [Request.new(stream_id: id, headers: [], body: "".b), status]
     end
 
-    def fill_body(out, limit)
+    # Queue chunks of out's body while its stream has less than limit bytes
+    # unsent and less than room (nil for no limit) has been queued. Returns
+    # the bytes queued.
+    def fill_body(out, limit, room)
+      queued = 0
       id = out.request.stream_id
-      while unsent_bytes(id) < limit
+      while unsent_bytes(id) < limit && (room.nil? || queued < room)
         begin
           chunk = out.body.enum.next
         rescue StopIteration
           out.done = true
           push_eof(id)
-          return
+          return queued
         rescue => e
           out.done = true
           abort_stream(id, Nghttp3::H3_INTERNAL_ERROR)
           yield e
-          return
+          return queued
         end
         unless chunk.is_a?(String)
           out.done = true
           abort_stream(id, Nghttp3::H3_INTERNAL_ERROR)
           yield TypeError.new("body chunk must be a String (got #{chunk.class})")
-          return
+          return queued
         end
         push_chunk(id, chunk)
+        queued += chunk.bytesize
       end
+      queued
     rescue Nghttp3::Error
       # The stream went away under the body (the peer reset it); it is
       # released when its close comes through.
       out.done = true
+      queued
     end
 
     def release(id)
       @open.delete(id)
       @incoming.delete(id)
+      release_held(id)
+      @rejected.delete(id)
+      @answered.delete(id)
       @done.reject! { |request, _| request.stream_id == id }
       out = @outgoing.delete(id) or return