http3 0.0.3 → 0.0.5

data/lib/http3/body_pipe.rb

@@ -0,0 +1,160 @@
+# frozen_string_literal: true
+
+module HTTP3
+  # The stream a response was being sent on is gone: the client reset it or
+  # asked for no more of it (STOP_SENDING), the connection ended, the server
+  # stopped, or the response was aborted after waiting on its client for
+  # response_timeout. Body::Pipe's write, finish and flush raise it. It is
+  # an IOError, as a write to a closed socket raises one.
+  class StreamClosed < IOError
+  end
+
+  module Body
+    # A response body written by the thread that runs the application and
+    # taken by the server's I/O loop, which sends it. On the writer's side,
+    # #write waits while capacity bytes or more are queued, and #finish ends
+    # the body, #fail ends it with an exception, each waiting until all of
+    # it has been taken. On the I/O loop's side, #take never waits, and
+    # #cancel gives up on the body: from then on the writer's write, finish
+    # and flush raise StreamClosed, those waiting included, and fail
+    # returns false. Since a writer waits for the
+    # end of its body to be taken, the pipes holding chunks are no more than
+    # the writers.
+    #
+    # wake is called, with no lock held, each time the body goes from
+    # having nothing to take to having something: a chunk, its end, or the
+    # exception that ended it.
+    class Pipe
+      def initialize(capacity:, wake:)
+        @capacity = capacity
+        @wake = wake
+        @lock = Thread::Mutex.new
+        @changed = Thread::ConditionVariable.new
+        @chunks = []
+        @bytes = 0
+        @finished = false
+        @end_taken = false
+        @error = nil
+        @cancelled = false
+      end
+
+      # Queue chunk, a String, first waiting while capacity bytes or more are
+      # queued. A String that can still change is copied. Returns its size.
+      def write(chunk)
+        raise TypeError, "chunk must be a String (got #{chunk.class})" unless chunk.is_a?(String)
+
+        chunk = chunk.dup.freeze unless chunk.frozen?
+        woke = @lock.synchronize do
+          @changed.wait(@lock) while @bytes >= @capacity && !@cancelled
+          check_writable
+          next false if chunk.empty?
+
+          was_empty = @chunks.empty?
+          @chunks << chunk
+          @bytes += chunk.bytesize
+          was_empty
+        end
+        @wake.call if woke
+        chunk.bytesize
+      end
+
+      # End the body, and wait until the I/O loop has taken all of it, its
+      # end included.
+      def finish
+        woke = @lock.synchronize do
+          check_writable
+          @finished = true
+          @chunks.empty?
+        end
+        @wake.call if woke
+        @lock.synchronize do
+          wait_for_the_end
+          raise StreamClosed, "stream closed" unless @end_taken
+        end
+        nil
+      end
+
+      # End the body with error, for the I/O loop to abort the stream once
+      # it has taken what is queued, and wait until it has. Returns true
+      # once the I/O loop has taken error, and false when it never will:
+      # the body had ended or been given up on, and fail did nothing, or it
+      # was given up on while fail waited.
+      def fail(error)
+        woke = @lock.synchronize do
+          next nil if @cancelled || @finished || @error
+
+          @error = error
+          @chunks.empty?
+        end
+        return false if woke.nil?
+
+        @wake.call if woke
+        @lock.synchronize do
+          wait_for_the_end
+          @end_taken
+        end
+      end
+
+      # Wait until the I/O loop has taken every chunk queued.
+      def flush
+        @lock.synchronize do
+          @changed.wait(@lock) until @chunks.empty? || @cancelled
+          raise StreamClosed, "stream closed" if @cancelled
+        end
+        self
+      end
+
+      # The next of what the writer queued, without waiting: a chunk; once
+      # they have all been taken, :eof for a body that ended, or the
+      # exception given to #fail; nil while there is nothing yet, and after
+      # #cancel.
+      def take
+        @lock.synchronize do
+          return nil if @cancelled
+
+          if (chunk = @chunks.shift)
+            @bytes -= chunk.bytesize
+            @changed.broadcast
+            return chunk
+          end
+          return nil unless @finished || @error
+
+          @end_taken = true
+          @changed.broadcast
+          @error || :eof
+        end
+      end
+
+      # True when #take has something new to return: a chunk, or the end.
+      def ready?
+        @lock.synchronize do
+          !@cancelled && (!@chunks.empty? || ((@finished || !@error.nil?) && !@end_taken))
+        end
+      end
+
+      # Give up on the body: what is queued is dropped, and the writer's
+      # calls, those waiting included, raise StreamClosed.
+      def cancel
+        @lock.synchronize do
+          @cancelled = true
+          @chunks.clear
+          @bytes = 0
+          @changed.broadcast
+        end
+        nil
+      end
+
+      private
+
+      # With the lock held.
+      def wait_for_the_end
+        @changed.wait(@lock) until @end_taken || @cancelled
+      end
+
+      def check_writable
+        raise StreamClosed, "stream closed" if @cancelled
+        raise IOError, "body already ended" if @finished || @error
+      end
+    end
+  end
+end

data/lib/http3/body_stream.rb

@@ -0,0 +1,120 @@
+# frozen_string_literal: true
+
+module HTTP3
+  module Body
+    # The stream a streaming body (Rack 3's call(stream)) is called with.
+    # What it writes goes to a Body::Pipe, and what it reads comes from the
+    # request body, which has arrived in full. Its methods behave as IO's
+    # do, as Rack 3 asks: write takes any objects and returns the bytes
+    # written, a write or flush after close_write raises IOError, as a read
+    # after close_read does, and the closes may be called again.
+    #
+    # Once the stream has gone away (the client reset it or sent
+    # STOP_SENDING, or it was aborted after response_timeout), write and
+    # flush raise StreamClosed, and so do close_write and close, once.
+    # Writing past length, the content-length, fails the pipe, so that the
+    # stream is aborted, and raises StreamClosed, so that the body stops
+    # there; ending short of it fails the pipe too.
+    class Stream
+      def initialize(pipe:, input:, length:)
+        @pipe = pipe
+        @input = input
+        @length = length
+        @size = 0
+        @failed = false
+        @read_closed = false
+        @write_closed = false
+        @lock = Thread::Mutex.new
+      end
+
+      # Read from the request body, as IO#read does.
+      def read(...)
+        raise IOError, "not opened for reading" if @read_closed
+
+        @input.read(...)
+      end
+
+      # Write each of objects, as a String (to_s), first waiting while the
+      # pipe is full. Returns the bytes written.
+      def write(*objects)
+        @lock.synchronize do
+          objects.sum do |object|
+            chunk = object.to_s
+            check_writable
+            count(chunk.bytesize)
+            @pipe.write(chunk)
+          end
+        end
+      end
+
+      def <<(object)
+        write(object)
+        self
+      end
+
+      # Wait until what has been written has been taken to be sent.
+      def flush
+        @lock.synchronize { check_writable }
+        @pipe.flush
+        self
+      end
+
+      # Stop reading: close the request body, unless it is closed already.
+      def close_read
+        @read_closed = true
+        @input.close unless @input.closed?
+        nil
+      end
+
+      # End the body, and wait until all of it has been taken to be sent;
+      # fail the pipe instead if it is short of length.
+      def close_write
+        @lock.synchronize do
+          next if @write_closed
+
+          @write_closed = true
+          next if @failed
+
+          if @length && @size != @length
+            @pipe.fail(length_mismatch("the body is #{@size} bytes"))
+          else
+            @pipe.finish
+          end
+        end
+        nil
+      end
+
+      def close
+        close_read
+        close_write
+      end
+
+      def closed?
+        @read_closed && @write_closed
+      end
+
+      private
+
+      # With the lock held.
+      def check_writable
+        raise IOError, "not opened for writing" if @write_closed
+        raise StreamClosed, "stream closed" if @failed
+      end
+
+      # With the lock held. Past length, the pipe fails and StreamClosed is
+      # raised.
+      def count(bytes)
+        @size += bytes
+        return unless @length && @size > @length
+
+        @failed = true
+        @pipe.fail(length_mismatch("the body is at least #{@size} bytes"))
+        raise StreamClosed, "stream closed"
+      end
+
+      def length_mismatch(what)
+        RackAdapter::InvalidResponse.new("#{what} but content-length says otherwise")
+      end
+    end
+  end
+end

data/lib/http3/rack_adapter.rb

@@ -1,15 +1,29 @@
 # frozen_string_literal: true
 
 require "stringio"
+require "uri"
 
 module HTTP3
   # Calls a Rack 3 application for an HTTP3::Request and turns what it
-  # returns into an HTTP3::Response.
+  # returns into an HTTP3::Response. Several threads may call it at once,
+  # each for a request of its own.
   class RackAdapter
     # The application's response breaks the Rack 3 specification; the
     # server answers 500 instead.
     class InvalidResponse < StandardError; end
 
+    # The request cannot be put in a Rack env; it is answered with 400.
+    class BadRequest < StandardError; end
+    private_constant :BadRequest
+
+    # The schemes a Rack env may carry (Rack also allows ws and wss, which
+    # HTTP/3 has no use for).
+    SCHEMES = %w[http https].freeze
+
+    # An authority, "host" or "host:port" (RFC 3986 section 3.2), as Rack
+    # Lint checks HTTP_HOST: the port is digits, of any number, or none.
+    AUTHORITY = /\A(?<host>#{URI::RFC3986_Parser::HOST})(?::(?<port>\d*))?\z/
+
     # Connection-specific fields, which HTTP/3 forbids (RFC 9114 section
     # 4.2).
     CONNECTION_FIELDS = %w[connection keep-alive transfer-encoding upgrade proxy-connection].freeze
@@ -21,20 +35,71 @@ module HTTP3
     # specification).
     FORBIDDEN_IN_VALUE = /[\0\r\n]/
 
-    def initialize(app)
+    # A body read with each, and a streaming body, go through a Body::Pipe
+    # of pipe_capacity bytes, whose wake is wake.
+    def initialize(app, pipe_capacity:, wake:)
       @app = app
+      @pipe_capacity = pipe_capacity
+      @wake = wake
+      @refusals = Hash.new(0)
+      @refusals_lock = Thread::Mutex.new
     end
 
-    # remote is the client's address, an Addrinfo. Raises whatever the
-    # application raises, and InvalidResponse for a response that cannot be
-    # sent; the Rack body is closed in both cases.
+    # Returns [response, fill]. remote is the client's address, an
+    # Addrinfo. CONNECT is answered with 501, and a request the Rack env
+    # cannot carry with 400, without calling the application;
+    # #take_refusals counts them. Raises whatever the application raises,
+    # and InvalidResponse for a response that cannot be sent; the Rack body
+    # is closed in both cases.
+    #
+    # fill is nil, the Rack body closed already, unless the response sends
+    # a body that is read with each or is a streaming body (call): its
+    # response has a Body::Pipe, and fill, called once the response has
+    # been handed over, writes the body to it and closes the Rack body.
+    # fill returns nil, or an exception the body raised that did not abort
+    # its stream, the body having ended or the server having given up on
+    # it, for the caller to log.
     def call(request, remote:)
-      status, headers, body = @app.call(env_for(request, remote))
+      # The server cannot open a tunnel (RFC 9114 section 4.4), and a
+      # CONNECT request has neither :scheme nor :path, so the env would be
+      # made up. The Session leaves nghttp3's enable_connect_protocol off,
+      # so nghttp3 refuses the :protocol of an extended CONNECT (RFC 9220).
+      return [refuse(501), nil] if request.headers.assoc(":method")&.last == "CONNECT"
+
+      env = env_for(request, remote)
+    rescue BadRequest
+      # Not logged: the client sent it, the server did not fail.
+      [refuse(400), nil]
+    else
+      status, headers, body = @app.call(env)
       response_for(request, status, headers, body)
     end
 
+    # The requests answered without the application since the last call,
+    # as {status => count}; the count starts over.
+    def take_refusals
+      @refusals_lock.synchronize do
+        refusals = @refusals
+        @refusals = Hash.new(0)
+        refusals
+      end
+    end
+
     private
 
+    def refuse(status)
+      @refusals_lock.synchronize { @refusals[status] += 1 }
+      Response.new(status: status, headers: [], body: nil)
+    end
+
+    # Raises BadRequest for what Rack does not allow, or allows in a form
+    # the application might read differently from the client, in this
+    # order: a scheme other than http and https, a fragment in the path, an
+    # authority that is not one (RFC 3986 section 3.2), and an :authority
+    # and a host field that disagree (RFC 9114 section 4.3.1). nghttp3 has
+    # already refused a request without :scheme, :path, or both :authority
+    # and host (but CONNECT); the defaults are for calling the adapter
+    # directly.
     def env_for(request, remote)
       pseudo = {}
       fields = {}
@@ -46,23 +111,38 @@ module HTTP3
         end
       end
 
-      path, query = pseudo.fetch(":path", "/").split("?", 2)
-      scheme = pseudo.fetch(":scheme", "https")
-      authority = pseudo[":authority"] || fields["host"]&.first || "localhost"
-      server_name, server_port = split_authority(authority, scheme)
+      # nghttp3 takes either case of http and https; Rack wants them in
+      # lowercase.
+      scheme = pseudo.fetch(":scheme", "https").downcase
+      raise BadRequest, "scheme #{scheme} is not http or https" unless SCHEMES.include?(scheme)
+
+      # nghttp3 lets a fragment through; Rack forbids one.
+      target = pseudo.fetch(":path", "/")
+      raise BadRequest, "the path has a fragment" if target.include?("#")
+
+      path, query = target.split("?", 2)
+      host = fields["host"]&.first
+      authority = pseudo[":authority"] || host || "localhost"
+      match = AUTHORITY.match(authority) or raise BadRequest, "the authority is malformed"
+      if pseudo[":authority"] && host && host != pseudo[":authority"]
+        raise BadRequest, ":authority and host differ"
+      end
+
+      port = match[:port]
+      port = (scheme == "http") ? "80" : "443" if port.nil? || port.empty?
 
       env = {
         "REQUEST_METHOD" => pseudo.fetch(":method", "GET"),
         "SCRIPT_NAME" => "",
         "PATH_INFO" => path,
         "QUERY_STRING" => query || "",
-        "SERVER_NAME" => server_name,
-        "SERVER_PORT" => server_port,
+        "SERVER_NAME" => match[:host],
+        "SERVER_PORT" => port,
         "SERVER_PROTOCOL" => "HTTP/3",
         "REMOTE_ADDR" => remote.ip_address,
         "HTTP_HOST" => authority,
         "rack.url_scheme" => scheme,
-        "rack.input" => StringIO.new(request.body.b),
+        "rack.input" => request.input,
         "rack.errors" => $stderr
       }
       fields.each do |name, values|
@@ -88,33 +168,51 @@ module HTTP3
       end
     end
 
-    # "host", "host:port", "[v6]" or "[v6]:port"; the port defaults to the
-    # scheme's.
-    def split_authority(authority, scheme)
-      default_port = (scheme == "http") ? "80" : "443"
-      if (match = authority.match(/\A(\[[^\]]*\])(?::(\d+))?\z/))
-        [match[1], match[2] || default_port]
-      else
-        host, port = authority.split(":", 2)
-        [host, port || default_port]
-      end
-    end
-
-    # The Rack body is closed here unless it goes on in the Response.
+    # [response, fill]. The Rack body is closed here, before anything is
+    # sent, unless fill goes on with it, or to_ary has closed it (body_for
+    # yields then). Rack 3 only says it is closed "typically after" the
+    # body has been sent, and the Body::File reads the file through a
+    # descriptor of its own.
     def response_for(request, status, headers, body)
-      response = nil
       status = Integer(status)
+      # A 1xx is no final response, which is all HTTP/3 can send here (Rack
+      # Lint only asks for 100 or more).
+      unless (200..599).cover?(status)
+        raise InvalidResponse, "status #{status} is not a final status (200..599)"
+      end
       headers = header_pairs(headers)
+      # A 204 must not have one (RFC 9110 section 8.6); it is dropped as the
+      # connection-specific fields are.
+      headers = headers.reject { |pair| pair.first == "content-length" } if status == 204
+      length = content_length(headers)
 
       method = request.headers.assoc(":method")&.last
-      response = if method == "HEAD" || status < 200 || status == 204 || status == 304
-        close_rack_body(body)
-        Response.new(status: status, headers: headers, body: nil)
-      else
-        Response.new(status: status, headers: headers, body: body_for(body))
+      if method == "HEAD" || status == 204 || status == 304
+        # No body is sent, so content-length is not held against one.
+        return [Response.new(status: status, headers: headers, body: nil), nil]
       end
+
+      sent, fill = body_for(body, length, request.input) { body = nil }
+      [Response.new(status: status, headers: headers, body: sent), fill]
     ensure
-      close_rack_body(body) if response.nil?
+      begin
+        close_rack_body(body)
+      rescue
+        # The response goes nowhere: a 500 replaces it.
+        sent.io.close if sent.is_a?(Body::File)
+        raise
+      end
+    end
+
+    # The content-length among headers, as an Integer, or nil if there is
+    # none. The message leaves the value out, as header_pairs's do.
+    def content_length(headers)
+      values = headers.filter_map { |name, value| value if name == "content-length" }
+      return nil if values.empty?
+      raise InvalidResponse, "content-length is given more than once" if values.size > 1
+      raise InvalidResponse, "content-length is not a number" unless values.first.match?(/\A\d+\z/)
+
+      Integer(values.first, 10)
     end
 
     # Rack 3 headers: lowercase names, each value a String or an Array of
@@ -141,20 +239,104 @@ module HTTP3
       pairs
     end
 
-    def body_for(body)
+    # [the body to send, fill]. One whose length is known before it is
+    # sent, a file or an Array, is held against length, the content-length,
+    # now; one read with each, and a streaming body, as fill writes it. A
+    # streaming body reads input, the request body. body_for yields when
+    # the Rack body is no longer for response_for to close.
+    def body_for(body, length, input)
       if body.respond_to?(:to_path)
         io = ::File.open(body.to_path, "rb")
-        Body::File.new(io: io, offset: 0, length: io.size, rack_body: body)
+        if length && io.size != length
+          size = io.size
+          io.close
+          raise length_mismatch(size)
+        end
+        [Body::File.new(io: io, offset: 0, length: io.size, rack_body: nil), nil]
       elsif body.respond_to?(:to_ary)
         # Rack 3 has to_ary close the body itself.
-        Body::Chunks.new(enum: body.to_ary.each, rack_body: nil)
+        chunks = body.to_ary
+        yield
+        # Checked before anything is sent, which Session#fill_bodies would
+        # only find out once the headers have gone.
+        chunks.each do |chunk|
+          raise InvalidResponse, "body chunk must be a String (got #{chunk.class})" unless chunk.is_a?(String)
+        end
+        size = chunks.sum(&:bytesize)
+        raise length_mismatch(size) if length && size != length
+
+        [Body::Chunks.new(enum: chunks.each, rack_body: nil), nil]
       elsif body.respond_to?(:each)
-        Body::Chunks.new(enum: body.to_enum(:each), rack_body: body)
+        # Rack 3: a body with both each and call is read with each.
+        pipe = Body::Pipe.new(capacity: @pipe_capacity, wake: @wake)
+        yield
+        [pipe, -> { fill_each(body, pipe, length) }]
+      elsif body.respond_to?(:call)
+        pipe = Body::Pipe.new(capacity: @pipe_capacity, wake: @wake)
+        yield
+        [pipe, -> { fill_call(body, pipe, length, input) }]
       else
-        raise InvalidResponse, "streaming bodies (#{body.class}) are not supported"
+        raise InvalidResponse, "the body (#{body.class}) responds to neither each nor call"
       end
     end
 
+    # Write the chunks of body's each to pipe, and end it. A chunk that is
+    # not a String, one that takes the body past length bytes, an end short
+    # of it, and an exception from each fail the pipe, and the stream is
+    # aborted then, since the headers have gone. A pipe the server has given
+    # up on (the client reset the stream, say) makes write raise
+    # StreamClosed, and the body stops there, without failing. Returns an
+    # exception the pipe did not take, or nil. The Rack body is closed in
+    # every case; an exception from its close is raised.
+    def fill_each(body, pipe, length)
+      size = 0
+      body.each do |chunk|
+        raise InvalidResponse, "body chunk must be a String (got #{chunk.class})" unless chunk.is_a?(String)
+
+        size += chunk.bytesize
+        if length && size > length
+          raise InvalidResponse, "the body is at least #{size} bytes but content-length says otherwise"
+        end
+
+        pipe.write(chunk)
+      end
+      raise length_mismatch(size) if length && size < length
+
+      pipe.finish
+    rescue StreamClosed
+      nil
+    rescue Exception => e # rubocop:disable Lint/RescueException
+      # Even exit, on a worker, ends only the body.
+      e unless pipe.fail(e)
+    ensure
+      close_rack_body(body)
+    end
+
+    # Call the streaming body with a Body::Stream that writes to pipe and
+    # reads input, and end the body once call returns, unless it has ended
+    # already: a write after that, from another thread, raises IOError. As
+    # with fill_each, the stream is aborted once the body goes past length
+    # bytes or ends short of it, or call raises, and it stops without
+    # failing once the server has given up on the pipe. Returns an
+    # exception the pipe did not take, such as one call raised after it
+    # closed the stream, or nil. The Rack body is closed in every case; an
+    # exception from its close is raised.
+    def fill_call(body, pipe, length, input)
+      stream = Body::Stream.new(pipe: pipe, input: input, length: length)
+      body.call(stream)
+      stream.close_write
+    rescue StreamClosed
+      nil
+    rescue Exception => e # rubocop:disable Lint/RescueException
+      e unless pipe.fail(e)
+    ensure
+      close_rack_body(body)
+    end
+
+    def length_mismatch(size)
+      InvalidResponse.new("the body is #{size} bytes but content-length says otherwise")
+    end
+
     def close_rack_body(body)
       body.close if body.respond_to?(:close)
     end

data/lib/http3/request.rb

@@ -4,6 +4,8 @@ module HTTP3
   # A request as a Session put it together. headers is an Array of
   # [name, value] binary Strings with lowercase names, the pseudo-headers
   # (:method, :scheme, :authority, :path) first; a repeated name keeps one
-  # pair per field. body is the request body, a binary String.
-  Request = Data.define(:stream_id, :headers, :body)
+  # pair per field. input is the request body, a binary IO at its start,
+  # which becomes rack.input: a StringIO, or a temporary File once the body
+  # is past the Session's request_body_buffer_size.
+  Request = Data.define(:stream_id, :headers, :input)
 end