http3 0.0.3 → 0.0.5

data/ext/http3/session.c

@@ -6,6 +6,7 @@
 #include <stdlib.h>
 #include <string.h>
 #include <sys/random.h>
+#include <time.h>
 #include <unistd.h>
 
 /*
@@ -28,7 +29,7 @@
 VALUE rb_cHTTP3Session;
 
 static ID id_on_begin_headers, id_on_header, id_on_end_headers, id_on_data,
-    id_on_end_stream, id_on_fields_too_large;
+    id_on_end_stream, id_on_fields_too_large, id_on_reset, id_on_stop_sending;
 
 /* What h3_session.field_sizes holds for a request whose header section has
  * gone over max_field_section_size. */
@@ -65,19 +66,28 @@ typedef struct {
   size_t nchunks, cap;
   size_t handed;    /* how many of chunks read_data has handed to nghttp3 */
   uint64_t unsent;  /* bytes queued but not handed to nghttp3 yet */
+  uint64_t queued;  /* bytes ever queued, the pieces read from a file too */
   uint64_t acked;   /* bytes the peer has acknowledged */
   uint64_t shifted; /* bytes of the chunks already dropped */
   int fd;           /* a file body (#attach_file) not read in full yet, or -1 */
   off_t file_off, file_end;
-  bool eof;     /* nothing follows the queued chunks */
-  bool blocked; /* read_data returned NGHTTP3_ERR_WOULDBLOCK */
+  /* When the body began to wait on the peer, or last moved: the peer
+   * acknowledged some of it, or widened the stream's flow control window
+   * (CLOCK_MONOTONIC seconds; #response_stalled_since) */
+  double since;
+  bool fc_blocked; /* the peer's flow control window holds it back */
+  bool eof;        /* nothing follows the queued chunks */
+  bool blocked;    /* read_data returned NGHTTP3_ERR_WOULDBLOCK */
+  bool aborted;    /* #abort_stream stopped it: no more of the body is sent */
 } h3_stream;
 
 typedef struct {
   VALUE self;      /* the object wrapping this struct; dcompact follows it */
   VALUE quic_conn; /* the QUIC::Connection::Server */
   quic_ext_conn *qc;
-  nghttp3_conn *h3;  /* made on handshake_completed */
+  nghttp3_conn *h3;  /* made on handshake_completed, deleted by h3_fail */
+  bool failed;       /* h3_fail has been called: h3 is gone for good */
+  int in_callback;   /* how deep the Ruby part is in h3_protect */
   st_table *streams; /* stream_id => h3_stream * */
   VALUE pending_exc; /* an exception the Ruby part raised in a callback */
   VALUE closed_ids;  /* ids of the streams nghttp3 closed, for #take_closed */
@@ -87,8 +97,18 @@ typedef struct {
   /* stream_id => size of the header section received so far, while the
    * headers of that request come in */
   st_table *field_sizes;
+  /* When the peer last acknowledged some response body, on any stream
+   * (CLOCK_MONOTONIC seconds) */
+  double acked_at;
 } h3_session;
 
+/* CLOCK_MONOTONIC in seconds, as Process.clock_gettime gives it. */
+static double h3_now(void) {
+  struct timespec ts;
+  clock_gettime(CLOCK_MONOTONIC, &ts);
+  return (double)ts.tv_sec + (double)ts.tv_nsec / 1e9;
+}
+
 /* Streams */
 
 static void h3_chunk_release(h3_chunk *chunk) {
@@ -128,9 +148,20 @@ static int h3_stream_push(h3_stream *st, const uint8_t *base, size_t len,
   }
   st->chunks[st->nchunks++] = (h3_chunk){base, len, str};
   st->unsent += len;
+  st->queued += len;
   return 0;
 }
 
+/* Bytes of the body the peer has not acknowledged: queued, the rest of a
+ * file not read yet, or sent; 0 once the stream has been aborted. */
+static uint64_t h3_stream_unacked(const h3_stream *st) {
+  if (st->aborted) {
+    return 0;
+  }
+  uint64_t rest = st->fd >= 0 ? (uint64_t)(st->file_end - st->file_off) : 0;
+  return st->queued - st->acked + rest;
+}
+
 /* The whole file body has been read: let go of its descriptor now rather
  * than when the stream closes, which waits for the peer to acknowledge
  * every byte. */
@@ -140,6 +171,24 @@ static void h3_stream_end_file(h3_stream *st) {
   st->eof = true;
 }
 
+/* The stream has been aborted, and no more of its body will be sent: let go
+ * at once of what nghttp3 has not taken, and of the file's descriptor,
+ * rather than when the stream closes, which waits for the peer to
+ * acknowledge the reset. The chunks nghttp3 has taken stay until then,
+ * since it still points into them. */
+static void h3_stream_abort(h3_stream *st) {
+  for (size_t i = st->handed; i < st->nchunks; i++) {
+    h3_chunk_release(&st->chunks[i]);
+  }
+  st->nchunks = st->handed;
+  st->unsent = 0;
+  if (st->fd >= 0) {
+    close(st->fd);
+    st->fd = -1;
+  }
+  st->aborted = true;
+}
+
 /* Drop the chunks at the front the peer has acknowledged to their end. A
  * chunk acknowledged only in part stays. */
 static void h3_stream_acked(h3_stream *st, uint64_t n) {
@@ -163,7 +212,9 @@ static void h3_stream_acked(h3_stream *st, uint64_t n) {
 
 static int h3_protect(h3_session *s, VALUE (*body)(VALUE), VALUE arg) {
   int state = 0;
+  s->in_callback++;
   rb_protect(body, arg, &state);
+  s->in_callback--;
   if (state == 0) {
     return 0;
   }
@@ -272,7 +323,14 @@ static VALUE h3_end_headers_body(VALUE arg) {
 static int h3_acked_stream_data_cb(nghttp3_conn *conn, int64_t id,
                                    uint64_t datalen, void *user_data,
                                    void *stream_user_data) {
-  h3_stream *st = h3_stream_find(user_data, id);
+  h3_session *s = user_data;
+  h3_stream *st = h3_stream_find(s, id);
+  if (datalen > 0) {
+    s->acked_at = h3_now();
+    if (st != NULL) {
+      st->since = s->acked_at;
+    }
+  }
   if (st != NULL) {
     h3_stream_acked(st, datalen);
   }
@@ -437,10 +495,43 @@ static const nghttp3_data_reader h3_data_reader = {.read_data =
 
 /* Stream handler (quic -> glue). ud is the h3_session. */
 
+/* The HTTP/3 connection has failed: the QUIC connection is to close with
+ * app_error_code, and the nghttp3 connection goes, since nghttp3 allows
+ * nothing but nghttp3_conn_del once it has returned an error. From then on
+ * the handler fails every read and write, so that the QUIC connection
+ * closes even when the failure came from a call the Ruby part made. Never
+ * called while nghttp3 is running. */
+static int h3_fail_with(h3_session *s, uint64_t app_error_code) {
+  http3_quic_api->set_application_error(s->qc, app_error_code);
+  if (s->h3 != NULL) {
+    nghttp3_conn_del(s->h3);
+    s->h3 = NULL;
+  }
+  s->failed = true;
+  return -1;
+}
+
+/* A failure inside nghttp3, with the HTTP/3 error code it stands for. */
+static int h3_fail(h3_session *s, int64_t rv) {
+  return h3_fail_with(s, nghttp3_err_infer_quic_app_error_code((int)rv));
+}
+
+/* Raise for rv, which a call the Ruby part made into nghttp3 returned. A
+ * fatal error fails the connection first. */
+static void h3_raise(h3_session *s, int rv, const char *message) {
+  if (nghttp3_err_is_fatal(rv) || rv == NGHTTP3_ERR_QPACK_FATAL) {
+    h3_fail(s, rv);
+  }
+  nghttp3_rb_raise(rv, "%s", message);
+}
+
 /* Make the nghttp3 connection and its three unidirectional streams, as
  * ngtcp2's examples/server.cc does once the handshake is done. */
 static int h3_handshake_completed(void *ud) {
   h3_session *s = ud;
+  if (s->failed) {
+    return -1;
+  }
   if (s->h3 != NULL) {
     return 0;
   }
@@ -466,34 +557,39 @@ static int h3_handshake_completed(void *ud) {
 
   if (nghttp3_conn_server_new(&s->h3, &callbacks, &settings, NULL, s) != 0) {
     s->h3 = NULL;
-    return -1;
+    return h3_fail_with(s, NGHTTP3_H3_INTERNAL_ERROR);
   }
-  nghttp3_conn_set_max_client_streams_bidi(
-      s->h3, http3_quic_api->local_max_streams_bidi(s->qc));
+  uint64_t max_streams = http3_quic_api->local_max_streams_bidi(s->qc);
+  nghttp3_conn_set_max_client_streams_bidi(s->h3, max_streams);
+  /* Every request #stop_reading gives up on leaves a Stream Cancellation on
+   * the QPACK decoder stream, and nghttp3 fails the connection once that
+   * stream holds more than max(this, 100) * 20 bytes. */
+  nghttp3_conn_set_max_concurrent_streams(s->h3, (size_t)max_streams);
 
   int64_t ctrl, enc, dec;
-  if (http3_quic_api->open_uni_stream(s->qc, &ctrl) != 0 ||
-      http3_quic_api->open_uni_stream(s->qc, &enc) != 0 ||
-      http3_quic_api->open_uni_stream(s->qc, &dec) != 0 ||
+  int rv = 0;
+  if ((rv = http3_quic_api->open_uni_stream(s->qc, &ctrl)) != 0 ||
+      (rv = http3_quic_api->open_uni_stream(s->qc, &enc)) != 0 ||
+      (rv = http3_quic_api->open_uni_stream(s->qc, &dec)) != 0 ||
       nghttp3_conn_bind_control_stream(s->h3, ctrl) != 0 ||
       nghttp3_conn_bind_qpack_streams(s->h3, enc, dec) != 0) {
-    return -1;
+    /* nghttp3 asserts the streams are bound before most calls, so the half
+     * made connection must go. A client has to let the server open three
+     * unidirectional streams (RFC 9114 section 6.2). */
+    return h3_fail_with(s, rv == QUIC_EXT_ERR_STREAM_ID_BLOCKED
+                               ? NGHTTP3_H3_GENERAL_PROTOCOL_ERROR
+                               : NGHTTP3_H3_INTERNAL_ERROR);
   }
   return 0;
 }
 
-/* A failure inside nghttp3 closes the QUIC connection with the HTTP/3 error
- * code it stands for. */
-static int h3_fail(h3_session *s, int64_t rv) {
-  http3_quic_api->set_application_error(
-      s->qc, nghttp3_err_infer_quic_app_error_code((int)rv));
-  return -1;
-}
-
 static int h3_recv_stream_data(void *ud, int64_t id, const uint8_t *data,
                                size_t len, int fin, uint64_t ts,
                                size_t *consumed) {
   h3_session *s = ud;
+  if (s->failed) {
+    return -1;
+  }
   if (s->h3 == NULL) {
     /* Nothing can arrive on a stream before the handshake; drop it. */
     *consumed = len;
@@ -513,6 +609,9 @@ static int h3_next_stream_data(void *ud, int64_t *id, int *fin,
   *id = -1;
   *fin = 0;
   *nvecs = 0;
+  if (s->failed) {
+    return -1;
+  }
   if (s->h3 == NULL) {
     return 0;
   }
@@ -534,14 +633,22 @@ static int h3_stream_data_written(void *ud, int64_t id, size_t n) {
   return rv == 0 ? 0 : h3_fail(s, rv);
 }
 
+/* The peer's flow control window for the stream is used up. */
 static int h3_stream_blocked(void *ud, int64_t id) {
   h3_session *s = ud;
+  h3_stream *st = h3_stream_find(s, id);
+  if (st != NULL) {
+    st->fc_blocked = true;
+  }
   if (s->h3 != NULL) {
     nghttp3_conn_block_stream(s->h3, id);
   }
   return 0;
 }
 
+/* quic found our side of the stream shut when next_stream_data offered it:
+ * nghttp3 sends no more of it. recv_stop_sending and #abort_stream tell
+ * nghttp3 first, so this is what is left for a stream shut otherwise. */
 static int h3_stream_shut_write(void *ud, int64_t id) {
   h3_session *s = ud;
   if (s->h3 != NULL) {
@@ -559,8 +666,15 @@ static int h3_acked_stream_data(void *ud, int64_t id, uint64_t n) {
   return rv == 0 ? 0 : h3_fail(s, rv);
 }
 
+/* The peer widened the stream's flow control window: it has read some of
+ * the body. */
 static int h3_extend_max_stream_data(void *ud, int64_t id) {
   h3_session *s = ud;
+  h3_stream *st = h3_stream_find(s, id);
+  if (st != NULL) {
+    st->fc_blocked = false;
+    st->since = h3_now();
+  }
   if (s->h3 == NULL) {
     return 0;
   }
@@ -589,9 +703,61 @@ static int h3_stream_stop_sending(void *ud, int64_t id,
   return h3_shutdown_stream_read(ud, id);
 }
 
+/* The client reset its side of the stream. The Ruby part answers a request
+ * cut short by it (#on_reset). */
 static int h3_stream_reset(void *ud, int64_t id, uint64_t final_size,
                            uint64_t app_error_code) {
-  return h3_shutdown_stream_read(ud, id);
+  h3_session *s = ud;
+  int rv = h3_shutdown_stream_read(s, id);
+  if (rv != 0 || s->h3 == NULL) {
+    return rv;
+  }
+  return h3_call_ruby(s, id_on_reset, id, 0, NULL);
+}
+
+/* The client asked for no more of what goes out on the stream
+ * (STOP_SENDING); ngtcp2 resets our side of it once this returns. Of a
+ * response, what nghttp3 has not taken is let go at once, and nghttp3
+ * sends no more. The rest of the request is not read either: RFC 9114
+ * section 4.1.1 has a cancelled request stopped in every direction still
+ * open. That is done here, as #stop_reading does it, rather than left to
+ * the Ruby part, so that nothing more of the request comes in, from the
+ * packets read after this one too, even on a stream the Ruby part has not
+ * heard of yet, since STOP_SENDING may come before the request. quic sends
+ * nothing if all of the request has arrived. The Ruby part then drops the
+ * request (#on_stop_sending).
+ *
+ * Our unidirectional streams are the control and QPACK streams, which the
+ * client must not ask us to close, and whose closing is a connection error
+ * of type H3_CLOSED_CRITICAL_STREAM (RFC 9114 section 6.2.1, RFC 9204
+ * section 4.2): the connection fails at once, rather than when the stream
+ * has closed. The client's own unidirectional streams never get here:
+ * ngtcp2 refuses STOP_SENDING on a stream we only receive on. */
+static int h3_recv_stop_sending(void *ud, int64_t id, uint64_t app_error_code) {
+  h3_session *s = ud;
+  if (s->h3 == NULL) {
+    return 0;
+  }
+  if (id & 0x2) {
+    return h3_fail_with(s, NGHTTP3_H3_CLOSED_CRITICAL_STREAM);
+  }
+  h3_stream *st = h3_stream_find(s, id);
+  if (st != NULL) {
+    h3_stream_abort(st);
+  }
+  nghttp3_conn_shutdown_stream_write(s->h3, id);
+  int rv = h3_shutdown_stream_read(s, id);
+  if (rv != 0) {
+    return rv;
+  }
+  if (http3_quic_api->shutdown_stream_read(s->qc, id,
+                                           NGHTTP3_H3_REQUEST_CANCELLED) != 0) {
+    return h3_fail_with(s, NGHTTP3_H3_INTERNAL_ERROR);
+  }
+  /* No end_headers will come to drop the count of a section cut short. */
+  st_data_t key = (st_data_t)id;
+  st_delete(s->field_sizes, &key, NULL);
+  return h3_call_ruby(s, id_on_stop_sending, id, 0, NULL);
 }
 
 static int h3_stream_close(void *ud, int64_t id, int has_code,
@@ -608,8 +774,16 @@ static int h3_stream_close(void *ud, int64_t id, int has_code,
   return h3_fail(s, rv);
 }
 
+/* The size of a handler filled in up to member m. The size tells quic.so
+ * which members the handler has (quic/ext.h): those it fills in, whatever
+ * quic/ext.h it is built against. */
+#define H3_HANDLER_SIZE_TO(m)                                                  \
+  (offsetof(quic_ext_stream_handler, m) +                                      \
+   sizeof(((quic_ext_stream_handler *)0)->m))
+
+/* An ABI 1.1 handler: recv_stop_sending came with quic 0.0.6. */
 static const quic_ext_stream_handler h3_handler = {
-    .size = sizeof(quic_ext_stream_handler),
+    .size = H3_HANDLER_SIZE_TO(recv_stop_sending),
     .recv_stream_data = h3_recv_stream_data,
     .next_stream_data = h3_next_stream_data,
     .stream_data_written = h3_stream_data_written,
@@ -622,6 +796,7 @@ static const quic_ext_stream_handler h3_handler = {
     .stream_reset = h3_stream_reset,
     .stream_close = h3_stream_close,
     .handshake_completed = h3_handshake_completed,
+    .recv_stop_sending = h3_recv_stop_sending,
 };
 
 /* The Ruby object */
@@ -651,6 +826,11 @@ static int h3_free_stream_i(st_data_t key, st_data_t value, st_data_t arg) {
   return ST_CONTINUE;
 }
 
+static int h3_abort_stream_i(st_data_t key, st_data_t value, st_data_t arg) {
+  h3_stream_abort((h3_stream *)value);
+  return ST_CONTINUE;
+}
+
 /* Never touches qc: the QUIC connection may be gone already. */
 static void h3_session_free(void *ptr) {
   h3_session *s = ptr;
@@ -697,8 +877,27 @@ static h3_session *h3_session_get(VALUE self) {
   return s;
 }
 
-static h3_session *h3_session_get_open(VALUE self) {
+/* The session, for a method that may call into nghttp3 or the QUIC
+ * connection, or fail the connection. The Ruby part's callbacks run inside
+ * nghttp3 or inside the QUIC connection's packet handling, where none of
+ * that may happen, so such a method raises InvalidStateError there. */
+static h3_session *h3_session_enter(VALUE self) {
   h3_session *s = h3_session_get(self);
+  if (s->in_callback > 0) {
+    rb_raise(rb_eNghttp3InvalidStateError,
+             "#%" PRIsVALUE
+             " cannot be called from inside a callback of this session",
+             rb_id2str(rb_frame_this_func()));
+  }
+  return s;
+}
+
+/* h3_session_enter, for a method that needs the nghttp3 connection. */
+static h3_session *h3_session_get_open(VALUE self) {
+  h3_session *s = h3_session_enter(self);
+  if (s->failed) {
+    rb_raise(rb_eNghttp3InvalidStateError, "the HTTP/3 connection has failed");
+  }
   if (s->h3 == NULL) {
     rb_raise(rb_eNghttp3InvalidStateError,
              "the HTTP/3 connection is not set up yet (handshake pending)");
@@ -706,12 +905,26 @@ static h3_session *h3_session_get_open(VALUE self) {
   return s;
 }
 
+NORETURN(static void h3_raise_no_body(VALUE rb_id));
+static void h3_raise_no_body(VALUE rb_id) {
+  rb_raise(rb_eNghttp3StreamNotFoundError,
+           "no response body is open on stream %" PRIsVALUE, rb_id);
+}
+
+NORETURN(static void h3_raise_aborted(VALUE rb_id));
+static void h3_raise_aborted(VALUE rb_id) {
+  rb_raise(rb_eNghttp3InvalidStateError,
+           "stream %" PRIsVALUE " has been aborted", rb_id);
+}
+
+/* The body of stream rb_id. Ruby code that runs once it is found may make
+ * the connection go on and close the stream, so convert everything else
+ * first. */
 static h3_stream *h3_session_stream(VALUE self, VALUE rb_id) {
   h3_session *s = h3_session_get(self);
   h3_stream *st = h3_stream_find(s, NUM2LL(rb_id));
   if (st == NULL) {
-    rb_raise(rb_eNghttp3StreamNotFoundError,
-             "no response body is open on stream %" PRIsVALUE, rb_id);
+    h3_raise_no_body(rb_id);
   }
   return st;
 }
@@ -724,7 +937,7 @@ static void h3_stream_wake(h3_session *s, h3_stream *st) {
   st->blocked = false;
   int rv = nghttp3_conn_resume_stream(s->h3, st->id);
   if (rv != 0) {
-    nghttp3_rb_raise(rv, "Failed to resume stream");
+    h3_raise(s, rv, "Failed to resume stream");
   }
 }
 
@@ -783,15 +996,19 @@ static VALUE rb_http3_session_s_attach(VALUE klass, VALUE quic_conn,
  */
 static VALUE rb_http3_session_submit_response(VALUE self, VALUE rb_id,
                                               VALUE headers, VALUE has_body) {
-  h3_session *s = h3_session_get_open(self);
   int64_t id = NUM2LL(rb_id);
   Check_Type(headers, T_ARRAY);
 
-  long nvlen = RARRAY_LEN(headers);
-  VALUE tmp;
-  nghttp3_nv *nva = ALLOCV_N(nghttp3_nv, tmp, nvlen);
+  /* Every field is converted before a pointer into any is taken: to_ary and
+   * to_str may run Ruby code, which could change or drop the Strings taken
+   * so far, or start a GC that moves them. It goes over a copy of headers,
+   * which that code cannot shrink under it, and keeps the Strings in
+   * strings, two per field. */
+  VALUE fields = rb_ary_dup(headers);
+  long nvlen = RARRAY_LEN(fields);
+  VALUE strings = rb_ary_new_capa(nvlen * 2);
   for (long i = 0; i < nvlen; i++) {
-    VALUE pair = rb_check_array_type(RARRAY_AREF(headers, i));
+    VALUE pair = rb_check_array_type(RARRAY_AREF(fields, i));
     if (NIL_P(pair) || RARRAY_LEN(pair) != 2) {
       rb_raise(rb_eArgError, "headers must be [name, value] pairs");
     }
@@ -799,13 +1016,16 @@ static VALUE rb_http3_session_submit_response(VALUE self, VALUE rb_id,
     VALUE value = RARRAY_AREF(pair, 1);
     StringValue(name);
     StringValue(value);
-    nva[i] = (nghttp3_nv){.name = (const uint8_t *)RSTRING_PTR(name),
-                          .value = (const uint8_t *)RSTRING_PTR(value),
-                          .namelen = (size_t)RSTRING_LEN(name),
-                          .valuelen = (size_t)RSTRING_LEN(value),
-                          .flags = NGHTTP3_NV_FLAG_NONE};
+    rb_ary_push(strings, name);
+    rb_ary_push(strings, value);
   }
 
+  /* Then the connection, which that code may have failed, and every
+   * allocation; then the pointers, and nghttp3 copies the names and values
+   * before anything else can run. */
+  h3_session *s = h3_session_get_open(self);
+  VALUE tmp;
+  nghttp3_nv *nva = ALLOCV_N(nghttp3_nv, tmp, nvlen);
   h3_stream *st = NULL;
   if (RTEST(has_body) && h3_stream_find(s, id) == NULL) {
     st = ZALLOC(h3_stream);
@@ -813,40 +1033,101 @@ static VALUE rb_http3_session_submit_response(VALUE self, VALUE rb_id,
     st->fd = -1;
     st_insert(s->streams, (st_data_t)id, (st_data_t)st);
   }
+  for (long i = 0; i < nvlen; i++) {
+    VALUE name = RARRAY_AREF(strings, 2 * i);
+    VALUE value = RARRAY_AREF(strings, 2 * i + 1);
+    nva[i] = (nghttp3_nv){.name = (const uint8_t *)RSTRING_PTR(name),
+                          .value = (const uint8_t *)RSTRING_PTR(value),
+                          .namelen = (size_t)RSTRING_LEN(name),
+                          .valuelen = (size_t)RSTRING_LEN(value),
+                          .flags = NGHTTP3_NV_FLAG_NONE};
+  }
 
-  /* nghttp3 copies the header names and values. */
   int rv = nghttp3_conn_submit_response(
       s->h3, id, nva, (size_t)nvlen, RTEST(has_body) ? &h3_data_reader : NULL);
   ALLOCV_END(tmp);
-  RB_GC_GUARD(headers);
+  RB_GC_GUARD(strings);
   if (rv != 0) {
     if (st != NULL) {
       st_data_t key = (st_data_t)id;
       st_delete(s->streams, &key, NULL);
       h3_stream_free(st);
     }
-    nghttp3_rb_raise(rv, "Failed to submit response");
+    h3_raise(s, rv, "Failed to submit response");
   }
   return self;
 }
 
+/* rb_id as the id of a request stream: 0..2**62-1 and client-initiated
+ * bidirectional. nghttp3 asserts the range. */
+static int64_t h3_request_stream_id(VALUE rb_id) {
+  int64_t id = NUM2LL(rb_id);
+  if (id < 0 || (uint64_t)id > H3_VARINT_MAX) {
+    rb_raise(rb_eArgError, "stream_id must be 0..2**62-1 (got %" PRIsVALUE ")",
+             rb_id);
+  }
+  if ((id & 3) != 0) {
+    rb_raise(rb_eArgError,
+             "stream_id %" PRIsVALUE
+             " is not a client-initiated bidirectional stream",
+             rb_id);
+  }
+  return id;
+}
+
+/*
+ * call-seq:
+ *   session.stop_reading(stream_id) -> self
+ *
+ * Read no more of the request on stream_id, which is being answered
+ * before all of it has arrived: nghttp3 drops what still comes, and the
+ * client gets STOP_SENDING with H3_NO_ERROR. RFC 9114 section 4.1 lets a
+ * server send a complete response before the request is complete and
+ * then ask the client to stop sending it, with H3_NO_ERROR.
+ */
+static VALUE rb_http3_session_stop_reading(VALUE self, VALUE rb_id) {
+  int64_t id = h3_request_stream_id(rb_id);
+  h3_session *s = h3_session_get_open(self);
+  int rv = nghttp3_conn_shutdown_stream_read(s->h3, id);
+  if (rv != 0) {
+    h3_raise(s, rv, "Failed to stop reading the stream");
+  }
+  if (http3_quic_api->shutdown_stream_read(s->qc, id, NGHTTP3_H3_NO_ERROR) !=
+      0) {
+    rb_raise(rb_eNghttp3Error, "cannot send STOP_SENDING on stream %" PRIsVALUE,
+             rb_id);
+  }
+  /* No end_headers will come to drop the count of a section cut short. */
+  st_data_t key = (st_data_t)id;
+  st_delete(s->field_sizes, &key, NULL);
+  return self;
+}
+
 /*
  * call-seq:
  *   session.push_chunk(stream_id, str) -> self
  *
  * Queue a frozen copy of str as the next piece of the response body.
+ * Raises InvalidStateError once the stream has been aborted.
  */
 static VALUE rb_http3_session_push_chunk(VALUE self, VALUE rb_id, VALUE str) {
-  h3_session *s = h3_session_get(self);
-  h3_stream *st = h3_session_stream(self, rb_id);
+  h3_session *s = h3_session_enter(self);
   StringValue(str);
+  VALUE copy = rb_str_new_frozen(str);
+  h3_stream *st = h3_session_stream(self, rb_id);
+  if (st->aborted) {
+    h3_raise_aborted(rb_id);
+  }
   if (st->eof) {
     rb_raise(rb_eNghttp3InvalidStateError, "the body has ended");
   }
-  if (RSTRING_LEN(str) == 0) {
+  if (RSTRING_LEN(copy) == 0) {
     return self;
   }
-  VALUE copy = rb_str_new_frozen(str);
+  if (h3_stream_unacked(st) == 0) {
+    /* The body waits on the peer from now. */
+    st->since = h3_now();
+  }
   if (h3_stream_push(st, (const uint8_t *)RSTRING_PTR(copy),
                      (size_t)RSTRING_LEN(copy), copy) != 0) {
     rb_raise(rb_eNoMemError, "failed to queue a body chunk");
@@ -860,11 +1141,15 @@ static VALUE rb_http3_session_push_chunk(VALUE self, VALUE rb_id, VALUE str) {
  * call-seq:
  *   session.push_eof(stream_id) -> self
  *
- * Mark the end of the response body.
+ * Mark the end of the response body. Raises InvalidStateError once the
+ * stream has been aborted.
  */
 static VALUE rb_http3_session_push_eof(VALUE self, VALUE rb_id) {
-  h3_session *s = h3_session_get(self);
+  h3_session *s = h3_session_enter(self);
   h3_stream *st = h3_session_stream(self, rb_id);
+  if (st->aborted) {
+    h3_raise_aborted(rb_id);
+  }
   st->eof = true;
   h3_stream_wake(s, st);
   return self;
@@ -878,15 +1163,14 @@ static VALUE rb_http3_session_push_eof(VALUE self, VALUE rb_id) {
  * descriptor is duplicated, so io may be closed afterwards. The duplicate
  * is close-on-exec, as Ruby's own descriptors are, so that a process the
  * application spawns does not inherit it, and is closed as soon as the
- * whole length has been read.
+ * whole length has been read. Raises InvalidStateError once the stream has
+ * been aborted.
  */
 static VALUE rb_http3_session_attach_file(VALUE self, VALUE rb_id, VALUE io,
                                           VALUE offset, VALUE length) {
-  h3_session *s = h3_session_get(self);
-  h3_stream *st = h3_session_stream(self, rb_id);
-  if (st->fd >= 0 || st->eof || st->nchunks > 0) {
-    rb_raise(rb_eNghttp3InvalidStateError, "the body is already given");
-  }
+  h3_session *s = h3_session_enter(self);
+  /* The arguments first, as #push_chunk does: io.fileno is Ruby code. */
+  int64_t id = NUM2LL(rb_id);
   off_t off = NUM2OFFT(offset);
   off_t len = NUM2OFFT(length);
   if (off < 0 || len < 0) {
@@ -897,9 +1181,23 @@ static VALUE rb_http3_session_attach_file(VALUE self, VALUE rb_id, VALUE io,
     rb_sys_fail("dup");
   }
   rb_update_max_fd(fd);
+  h3_stream *st = h3_stream_find(s, id);
+  if (st == NULL) {
+    close(fd);
+    h3_raise_no_body(rb_id);
+  }
+  if (st->aborted) {
+    close(fd);
+    h3_raise_aborted(rb_id);
+  }
+  if (st->fd >= 0 || st->eof || st->nchunks > 0) {
+    close(fd);
+    rb_raise(rb_eNghttp3InvalidStateError, "the body is already given");
+  }
   st->fd = fd;
   st->file_off = off;
   st->file_end = off + len;
+  st->since = h3_now();
   if (len == 0) {
     h3_stream_end_file(st);
   }
@@ -919,6 +1217,36 @@ static VALUE rb_http3_session_unsent_bytes(VALUE self, VALUE rb_id) {
   return ULL2NUM(st == NULL ? 0 : st->unsent);
 }
 
+/*
+ * call-seq:
+ *   session.response_stalled_since(stream_id) -> Float or nil
+ *
+ * Since when (CLOCK_MONOTONIC seconds, as Process.clock_gettime gives it)
+ * the response body on stream_id has waited on the client: some of it has
+ * not been acknowledged, and nothing has moved since. nil while none of it
+ * waits, for a stream without a body, and once the stream has been
+ * aborted.
+ *
+ * Moving is the client acknowledging some of the body, or widening the
+ * stream's flow control window. While that window does not hold the body
+ * back, an acknowledgement of any response body on the connection counts
+ * too: nghttp3 sends the responses of one priority one at a time, so a
+ * response waiting its turn behind another the client is reading gets no
+ * acknowledgements of its own.
+ */
+static VALUE rb_http3_session_response_stalled_since(VALUE self, VALUE rb_id) {
+  h3_session *s = h3_session_get(self);
+  h3_stream *st = h3_stream_find(s, NUM2LL(rb_id));
+  if (st == NULL || h3_stream_unacked(st) == 0) {
+    return Qnil;
+  }
+  double since = st->since;
+  if (!st->fc_blocked && s->acked_at > since) {
+    since = s->acked_at;
+  }
+  return DBL2NUM(since);
+}
+
 /*
  * call-seq:
  *   session.take_closed -> Array
@@ -954,13 +1282,13 @@ static VALUE rb_http3_session_take_error(VALUE self) {
  * served.
  */
 static VALUE rb_http3_session_shutdown_notice(VALUE self) {
-  h3_session *s = h3_session_get(self);
+  h3_session *s = h3_session_enter(self);
   if (s->h3 == NULL) {
     return self;
   }
   int rv = nghttp3_conn_submit_shutdown_notice(s->h3);
   if (rv != 0) {
-    nghttp3_rb_raise(rv, "Failed to submit shutdown notice");
+    h3_raise(s, rv, "Failed to submit shutdown notice");
   }
   return self;
 }
@@ -970,13 +1298,21 @@ static VALUE rb_http3_session_shutdown_notice(VALUE self) {
  *   session.abort_stream(stream_id, app_error_code) -> self
  *
  * Stop the stream in both directions with app_error_code (for instance
- * H3_INTERNAL_ERROR after the response headers went out).
+ * H3_INTERNAL_ERROR after the response headers went out). What of the
+ * response body nghttp3 has not taken is let go at once, so that
+ * #unsent_bytes no longer counts it, and a file body's descriptor is
+ * closed; #push_chunk, #push_eof and #attach_file raise InvalidStateError
+ * from then on.
  */
 static VALUE rb_http3_session_abort_stream(VALUE self, VALUE rb_id,
                                            VALUE rb_code) {
-  h3_session *s = h3_session_get(self);
+  h3_session *s = h3_session_enter(self);
   int64_t id = NUM2LL(rb_id);
   uint64_t code = NUM2ULL(rb_code);
+  h3_stream *st = h3_stream_find(s, id);
+  if (st != NULL) {
+    h3_stream_abort(st);
+  }
   if (s->h3 != NULL) {
     nghttp3_conn_shutdown_stream_write(s->h3, id);
   }
@@ -985,6 +1321,36 @@ static VALUE rb_http3_session_abort_stream(VALUE self, VALUE rb_id,
   return self;
 }
 
+/*
+ * call-seq:
+ *   session.release_connection -> self   (private; #release_all calls it)
+ *
+ * Let go of the HTTP/3 connection now, rather than when the Session is
+ * garbage collected: the nghttp3 connection is deleted, and every response
+ * body aborted as #abort_stream aborts one, though no stream is reset, so
+ * that what nghttp3 had not taken of it is let go of and a file body's
+ * descriptor closed. What nghttp3 had taken stays until the Session is
+ * freed, even once the stream closes, since without nghttp3 nothing tells
+ * of that: ngtcp2 may still point into it, to send it again.
+ *
+ * For a QUIC connection that has gone. One still driven goes on as after a
+ * failure (h3_fail_with), with H3_NO_ERROR; without nghttp3, it sends
+ * nothing more of a body let go of, its FIN included. A connection that
+ * failed keeps the error it failed with. From then on #submit_response and
+ * #stop_reading raise InvalidStateError, as on a failed connection, and
+ * #push_chunk, #push_eof and #attach_file as on an aborted stream. Raises
+ * InvalidStateError inside a callback of the Session, where nghttp3 may be
+ * running. Calling it again does nothing.
+ */
+static VALUE rb_http3_session_release_connection(VALUE self) {
+  h3_session *s = h3_session_enter(self);
+  if (!s->failed) {
+    h3_fail_with(s, NGHTTP3_H3_NO_ERROR);
+  }
+  st_foreach(s->streams, h3_abort_stream_i, 0);
+  return self;
+}
+
 void Init_http3_session(VALUE rb_mHTTP3) {
   id_on_begin_headers = rb_intern("on_begin_headers");
   id_on_header = rb_intern("on_header");
@@ -992,6 +1358,8 @@ void Init_http3_session(VALUE rb_mHTTP3) {
   id_on_data = rb_intern("on_data");
   id_on_end_stream = rb_intern("on_end_stream");
   id_on_fields_too_large = rb_intern("on_fields_too_large");
+  id_on_reset = rb_intern("on_reset");
+  id_on_stop_sending = rb_intern("on_stop_sending");
 
   rb_cHTTP3Session = rb_define_class_under(rb_mHTTP3, "Session", rb_cObject);
   rb_undef_alloc_func(rb_cHTTP3Session);
@@ -999,6 +1367,8 @@ void Init_http3_session(VALUE rb_mHTTP3) {
                              rb_http3_session_s_attach, 2);
   rb_define_method(rb_cHTTP3Session, "submit_response",
                    rb_http3_session_submit_response, 3);
+  rb_define_method(rb_cHTTP3Session, "stop_reading",
+                   rb_http3_session_stop_reading, 1);
   rb_define_method(rb_cHTTP3Session, "push_chunk", rb_http3_session_push_chunk,
                    2);
   rb_define_method(rb_cHTTP3Session, "push_eof", rb_http3_session_push_eof, 1);
@@ -1006,6 +1376,8 @@ void Init_http3_session(VALUE rb_mHTTP3) {
                    rb_http3_session_attach_file, 4);
   rb_define_method(rb_cHTTP3Session, "unsent_bytes",
                    rb_http3_session_unsent_bytes, 1);
+  rb_define_method(rb_cHTTP3Session, "response_stalled_since",
+                   rb_http3_session_response_stalled_since, 1);
   rb_define_method(rb_cHTTP3Session, "take_closed",
                    rb_http3_session_take_closed, 0);
   rb_define_method(rb_cHTTP3Session, "take_error", rb_http3_session_take_error,
@@ -1014,4 +1386,6 @@ void Init_http3_session(VALUE rb_mHTTP3) {
                    rb_http3_session_shutdown_notice, 0);
   rb_define_method(rb_cHTTP3Session, "abort_stream",
                    rb_http3_session_abort_stream, 2);
+  rb_define_private_method(rb_cHTTP3Session, "release_connection",
+                           rb_http3_session_release_connection, 0);
 }