http3 0.0.3 → 0.0.5

data/lib/http3/session.rb

@@ -1,5 +1,9 @@
 # frozen_string_literal: true
 
+require "stringio"
+require "tempfile"
+require "tmpdir"
+
 module HTTP3
   # HTTP/3 on one QUIC connection. The C part (ext/http3/session.c) runs
   # nghttp3 inside the connection's packet I/O and calls the on_* methods
@@ -10,89 +14,356 @@ module HTTP3
   # requests, answers them, keeps the bodies flowing and lets go of what
   # the streams no longer need.
   class Session
-    # A request still coming in. reject is the status to answer with
-    # instead of calling the application (413, 431), or nil.
-    Incoming = Struct.new(:pseudo, :fields, :body, :reject)
+    # A request still coming in; started is when its headers began
+    # (CLOCK_MONOTONIC). body is a StringIO, or a File once the body has
+    # gone past request_body_buffer_size (#spool); received is how many
+    # bytes of body have come.
+    Incoming = Struct.new(:pseudo, :fields, :body, :started, :received)
 
     # A response whose body is being sent.
     Outgoing = Struct.new(:request, :body, :done)
 
+    # What a field counts for besides its name and value, as RFC 9114
+    # section 4.2.2 counts it, and as the C part does for 431.
+    FIELD_OVERHEAD = 32
+
+    # What #next_chunk returns at the end of a body.
+    END_OF_BODY = Object.new.freeze
+    private_constant :END_OF_BODY
+
+    # Bytes the requests coming in may hold: a connection's, and through
+    # parent the server's. Only the server's I/O loop, one thread, calls
+    # it, so it takes no lock.
+    class Budget
+      attr_reader :limit, :used
+
+      def initialize(limit, parent: nil)
+        @limit = limit
+        @used = 0
+        @parent = parent
+      end
+
+      # Count n bytes and return true if they fit both here and in the
+      # parent; count nothing and return false if not.
+      def reserve(n)
+        return false if @used + n > @limit
+        return false if @parent && !@parent.reserve(n)
+
+        @used += n
+        true
+      end
+
+      def release(n)
+        @used -= n
+        @parent&.release(n)
+      end
+    end
+    private_constant :Budget
+
+    # The limits on what the requests of a connection, and through their
+    # parents the server's, hold in temporary files: bytes, and files open
+    # at once.
+    Spool = Struct.new(:bytes, :files)
+    private_constant :Spool
+
     # Take over quic_conn's streams. A request body over max_request_body
     # bytes is answered with 413, a header section over
-    # max_field_section_size bytes (RFC 9114 section 4.2.2) with 431.
-    def self.attach(quic_conn, max_request_body:, max_field_section_size:)
+    # max_field_section_size bytes (RFC 9114 section 4.2.2) with 431, as
+    # soon as the request passes the limit; the rest of it is not read.
+    #
+    # A request body is kept in memory up to request_body_buffer_size
+    # bytes; past that, all of it goes to a temporary file
+    # (Session.spool_file).
+    #
+    # The requests may hold max_connection_request_buffer bytes of memory in
+    # all, header fields counted as for 431 and bodies by their bytes, and
+    # those of every Session given the same shared_buffer
+    # (Session.shared_buffer) its limit. Their temporary files may hold
+    # max_connection_request_spool bytes, and be
+    # max_connection_request_spool_files many, and those of every Session
+    # given the same shared_spool (Session.shared_spool) its limits. A
+    # request counts until its stream closes, or, once handed out
+    # (#next_request), until #finish, though its stream or connection has
+    # gone. A request that would pass any of
+    # these limits, or whose file cannot be made or written, is answered
+    # with 503.
+    #
+    # A request not received in full within request_timeout seconds of the
+    # start of its headers is answered with 408, and one not handed out
+    # within request_timeout seconds of its end with 503
+    # (#expire_requests); nil is no limit.
+    #
+    # A response whose body has waited on its client for response_timeout
+    # seconds (#response_stalled_since) is aborted (#expire_responses): a
+    # limit on a stall, not on the whole response. nil is no limit. Whoever
+    # drives the Session calls #expire_requests and #expire_responses every
+    # turn, and waits no longer than #next_request_deadline and
+    # #next_response_deadline.
+    def self.attach(quic_conn, max_request_body:, max_field_section_size:,
+      max_connection_request_buffer: 4_194_304, shared_buffer: nil, request_timeout: nil,
+      request_body_buffer_size: 65_536, max_connection_request_spool: 16_777_216,
+      max_connection_request_spool_files: 16, shared_spool: nil, response_timeout: nil)
       session = _attach(quic_conn, max_field_section_size)
-      session.send(:setup, max_request_body)
+      spool = Spool.new(Budget.new(max_connection_request_spool, parent: shared_spool&.bytes),
+        Budget.new(max_connection_request_spool_files, parent: shared_spool&.files))
+      session.send(:setup, max_request_body, Budget.new(max_connection_request_buffer, parent: shared_buffer),
+        request_timeout, request_body_buffer_size, spool, response_timeout)
       session
     end
 
-    # The requests received in full since the last call, each as
-    # [request, status]: status is nil for the application to answer the
-    # request, or the status to answer it with directly.
-    def take_requests
-      done = @done
-      @done = []
-      done
+    # A limit of limit bytes for the requests coming in on every Session
+    # given it as attach's shared_buffer.
+    def self.shared_buffer(limit)
+      Budget.new(limit)
+    end
+
+    # Limits of limit bytes in temporary files, and of files open at once,
+    # for the requests on every Session given it as attach's shared_spool.
+    def self.shared_spool(limit, files:)
+      Spool.new(Budget.new(limit), Budget.new(files))
+    end
+
+    # A temporary file in Dir.tmpdir for a request body, without a name and
+    # in binary mode. O_TMPFILE makes it without one; where the file system
+    # does not take that (overlayfs, NFS), a file made with a random name is
+    # unlinked at once. Raises SystemCallError when no file can be had.
+    def self.spool_file
+      dir = Dir.tmpdir
+      file = begin
+        File.open(dir, File::RDWR | File::TMPFILE, 0o600)
+      rescue Errno::EOPNOTSUPP, Errno::EISDIR, Errno::EINVAL
+        named = Tempfile.create(["http3-body-", ""], dir)
+        begin
+          File.unlink(named.path)
+        rescue SystemCallError
+          named.close
+          raise
+        end
+        named
+      end
+      # File::BINARY is 0 on Linux: only binmode makes the file ASCII-8BIT.
+      file.binmode
+      file
+    end
+
+    # The requests refused since the last call, each as [request, status]:
+    # the status (408, 413, 431, 503) to answer it with directly. A request
+    # comes out as soon as it is refused, before the rest of it has arrived,
+    # with neither headers nor body.
+    def take_refusals
+      refused = @refused
+      @refused = []
+      refused
+    end
+
+    # The next request received in full, for the application to answer, or
+    # nil. The Session no longer closes its input: the caller closes it once
+    # done with the request, its response body included, and then calls
+    # #finish. What the request holds, in memory and in its temporary file,
+    # counts for the limits until then, even after its stream has closed.
+    def next_request
+      request, = @ready.shift
+      return nil if request.nil?
+
+      @handed[request.stream_id] = true
+      request
+    end
+
+    # The caller is done with the request on stream_id that #next_request
+    # handed out: what it held no longer counts for the limits. Its stream
+    # and its connection may have gone already. Calling it again does
+    # nothing.
+    def finish(stream_id)
+      @handed.delete(stream_id) or return
+      release_budget(stream_id)
+    end
+
+    # True while the request on stream_id can still be answered: its stream
+    # is open, the client has neither reset it nor asked for no more of it
+    # (STOP_SENDING), it has not been refused, and it has not been answered.
+    def answerable?(stream_id)
+      @open.key?(stream_id) && !@reset[stream_id] && !@stopped[stream_id] && !@rejected[stream_id] &&
+        !@answered[stream_id]
+    end
+
+    # The first exception a temporary file raised since the last call, or
+    # nil. The request it was for has been answered with 503.
+    def take_spool_error
+      error = @spool_error
+      @spool_error = nil
+      error
+    end
+
+    # Refuse with 408 the requests still coming in whose request_timeout
+    # has passed at now (CLOCK_MONOTONIC), and with 503 those received in
+    # full that have waited that long for #next_request; #take_refusals
+    # hands them out.
+    def expire_requests(now)
+      return if @request_timeout.nil?
+
+      @incoming.each do |id, request|
+        next if @rejected[id] || request.started + @request_timeout > now
+
+        reject(id, request, 408)
+      end
+      # In the order they ended, so the first are the oldest.
+      while (ended = @ready.first&.last) && ended + @request_timeout <= now
+        request, = @ready.shift
+        refuse_waiting(request, 503)
+      end
+    end
+
+    # When the next request still coming in, or waiting for #next_request,
+    # runs out of time (CLOCK_MONOTONIC), or nil.
+    def next_request_deadline
+      return nil if @request_timeout.nil?
+
+      started = @incoming.filter_map { |id, request| request.started unless @rejected[id] }.min
+      [started, @ready.first&.last].compact.min&.+(@request_timeout)
+    end
+
+    # Abort, with H3_REQUEST_CANCELLED, the responses whose body has waited
+    # on its client (#response_stalled_since) response_timeout seconds or
+    # more at now (CLOCK_MONOTONIC): RFC 9114 section 4.1.1 has a server that
+    # abandons a response use that code. A Body::Pipe is cancelled, so that
+    # its writer's write, finish or flush raises StreamClosed; one busy
+    # elsewhere gets it from its next. The Rack body is closed as ever, once
+    # the stream closes (#release_closed). Returns how many were aborted.
+    def expire_responses(now)
+      return 0 if @response_timeout.nil?
+
+      expired = @outgoing.select do |id, _out|
+        since = response_stalled_since(id)
+        since && since + @response_timeout <= now
+      end
+      expired.each do |id, out|
+        abort_stream(id, Nghttp3::H3_REQUEST_CANCELLED)
+        out.done = true
+        out.body.cancel if out.body.is_a?(Body::Pipe)
+      end
+      expired.size
+    end
+
+    # When the next response to wait on its client runs out of time
+    # (CLOCK_MONOTONIC), or nil.
+    def next_response_deadline
+      return nil if @response_timeout.nil?
+
+      @outgoing.each_key.filter_map { |id| response_stalled_since(id) }.min&.+(@response_timeout)
     end
 
     # Send response to request. Its body, if any, is kept until the stream
     # closes, but the IO of a Body::File is closed at once: the C part reads
     # the file through a descriptor of its own. When that descriptor cannot
     # be had (EMFILE, say), the stream is aborted with H3_INTERNAL_ERROR and
-    # the block gets the exception.
+    # the block gets the exception. A request is answered once: nghttp3
+    # would send a second response after the first, so it raises
+    # Nghttp3::InvalidStateError.
     def respond(request, response)
+      id = request.stream_id
+      raise Nghttp3::InvalidStateError, "stream #{id} has been answered" if @answered[id]
+
+      # Refused while it was still coming in (#reject keeps its Incoming).
+      stop_reading(id) if @rejected[id] && @incoming.key?(id)
       headers = [[":status", response.status.to_s], *response.headers]
       body = response.body
-      submit_response(request.stream_id, headers, !body.nil?)
+      submit_response(id, headers, !body.nil?)
+      @answered[id] = true
       return if body.nil?
 
-      @outgoing[request.stream_id] = Outgoing.new(request, body, false)
+      # Only the pseudo-headers stay, for the log, while the body is sent:
+      # the request body would otherwise be held all along, uncounted.
+      pseudo = request.headers.select { |name, _| name.start_with?(":") }
+      @outgoing[id] = Outgoing.new(Request.new(stream_id: id, headers: pseudo, input: empty_input), body, false)
       return unless body.is_a?(Body::File)
 
       begin
-        attach_file(request.stream_id, body.io, body.offset, body.length)
+        attach_file(id, body.io, body.offset, body.length)
       rescue SystemCallError => e
-        abort_stream(request.stream_id, Nghttp3::H3_INTERNAL_ERROR)
+        abort_stream(id, Nghttp3::H3_INTERNAL_ERROR)
         yield e if block_given?
       ensure
         body.io.close
       end
     end
 
-    # Queue more of each Body::Chunks body until limit bytes wait unsent on
-    # its stream. A body whose enum raises is the application failing after
-    # its headers went out: the stream is aborted with H3_INTERNAL_ERROR and
-    # the block gets (request, exception).
-    def fill_bodies(limit)
+    # Queue more of each Body::Chunks and Body::Pipe body until limit bytes
+    # wait unsent on its stream, connection_limit on the whole connection
+    # (#unsent_total), and room more bytes have been queued; nil is no
+    # limit. A chunk may take any of them past its limit, by less than its
+    # size. Returns the bytes queued.
+    #
+    # A body whose enum raises, or whose Pipe failed, is the application
+    # failing after its headers went out: the stream is aborted with
+    # H3_INTERNAL_ERROR and the block gets (request, exception). That
+    # request has only the pseudo-headers, and no body.
+    def fill_bodies(limit, connection_limit: nil, room: nil)
+      left = [room, connection_limit && connection_limit - unsent_total].compact.min
+      queued = 0
       @outgoing.each_value do |out|
-        next if out.done || !out.body.is_a?(Body::Chunks)
+        next if out.done || !generated?(out.body)
+        break if left && queued >= left
 
-        fill_body(out, limit) { |error| yield out.request, error if block_given? }
+        queued += fill_body(out, limit, left && left - queued) { |error| yield out.request, error if block_given? }
       end
+      queued
     end
 
-    # True when a Body::Chunks body could take more right now.
-    def wants_fill?(limit)
+    # True when a Body::Chunks body, or a Body::Pipe with something to take,
+    # could take more right now, with the limits of #fill_bodies.
+    def wants_fill?(limit, connection_limit: nil, room: nil)
+      return false if room && room <= 0
+      return false if connection_limit && unsent_total >= connection_limit
+
       @outgoing.any? do |id, out|
-        !out.done && out.body.is_a?(Body::Chunks) && unsent_bytes(id) < limit
+        next false if out.done || !generated?(out.body)
+        next false if out.body.is_a?(Body::Pipe) && !out.body.ready?
+
+        unsent_bytes(id) < limit
       end
     end
 
-    # True while a request stream is open: received in part, waiting for
-    # its answer, or with a response still being sent.
+    # Bytes of the Body::Chunks and Body::Pipe bodies queued but not taken
+    # by nghttp3 yet, on every stream; a body that has ended may still have
+    # some.
+    def unsent_total
+      @outgoing.sum { |id, out| generated?(out.body) ? unsent_bytes(id) : 0 }
+    end
+
+    # True while a request stream is open: received in part, waiting to be
+    # handed out or answered, or with a response still being sent.
     def busy?
-      !@open.empty?
+      !@open.empty? || !@ready.empty?
     end
 
-    # Let go of the streams nghttp3 closed: their requests are dropped and
-    # their bodies closed. The block gets (stream_id, exception) for a body
-    # whose close raised.
+    # Let go of the streams nghttp3 closed: their requests are dropped, the
+    # inputs of those not handed out closed, and their bodies closed (a
+    # Body::Pipe cancelled). What a request handed out holds still counts,
+    # until #finish. The block gets (stream_id, exception) for a body whose
+    # close raised. First, the requests the client reset before their end
+    # (#on_reset) get our side of their streams reset too, with
+    # H3_REQUEST_INCOMPLETE as RFC 9114 section 4.1 says, so that the
+    # streams close; those it reset once they had come in full, waiting to
+    # be handed out or handed out and not answered, with
+    # H3_REQUEST_CANCELLED.
     def release_closed(&block)
+      @incomplete.each { |id| abort_stream(id, Nghttp3::H3_REQUEST_INCOMPLETE) }
+      @incomplete.clear
+      @cancelled.each { |id| abort_stream(id, Nghttp3::H3_REQUEST_CANCELLED) }
+      @cancelled.clear
       take_closed.each { |id| release(id, &block) }
     end
 
-    # The connection is gone: close every body still held.
+    # The connection is gone: close every body still held. First the C part
+    # lets go of the nghttp3 connection and, of each body, of what nghttp3
+    # has not taken, a file body's descriptor included, rather than when the
+    # Session is garbage collected. From then on #submit_response and
+    # #stop_reading raise Nghttp3::InvalidStateError, as on a failed
+    # connection, and #push_chunk, #push_eof and #attach_file as on an
+    # aborted stream. What the requests handed out hold still counts, until
+    # #finish, since the caller still has them.
     def release_all(&block)
+      release_connection
       (@open.keys | @outgoing.keys).each { |id| release(id, &block) }
     end
 
@@ -100,17 +371,22 @@ module HTTP3
 
     def on_begin_headers(id)
       @open[id] = true
-      @incoming[id] = Incoming.new([], [], "".b, nil)
+      @incoming[id] = Incoming.new([], [], empty_input, Process.clock_gettime(Process::CLOCK_MONOTONIC), 0)
     end
 
     def on_header(id, name, value)
       request = @incoming[id] or return
+      return if @rejected[id]
+      return reject(id, request, 503) unless hold(id, name.bytesize + value.bytesize + FIELD_OVERHEAD)
+
       (name.start_with?(":") ? request.pseudo : request.fields) << [name, value]
     end
 
     def on_fields_too_large(id)
       request = @incoming[id] or return
-      request.reject = 431
+      return if @rejected[id]
+
+      reject(id, request, 431)
     end
 
     def on_end_headers(id)
@@ -118,65 +394,331 @@ module HTTP3
 
     def on_data(id, bytes)
       request = @incoming[id] or return
-      return if request.reject
+      return if @rejected[id]
 
-      if request.body.bytesize + bytes.bytesize > @max_request_body
-        request.reject = 413
-        request.body = "".b
+      if request.received + bytes.bytesize > @max_request_body
+        reject(id, request, 413)
+      elsif @spool_files.key?(id) || request.received + bytes.bytesize > @request_body_buffer_size
+        spool(id, request, bytes)
+      elsif !hold(id, bytes.bytesize)
+        reject(id, request, 503)
       else
-        request.body << bytes
+        request.body.write(bytes)
+        request.received += bytes.bytesize
       end
     end
 
     def on_end_stream(id)
-      request = @incoming.delete(id) or return
+      return if @rejected[id]
+
+      request = @incoming[id] or return
+      input = request.body
+      begin
+        input.flush
+        input.rewind
+      rescue => e
+        @spool_error ||= e
+        return reject(id, request, 503)
+      end
+      @incoming.delete(id)
       headers = request.pseudo + request.fields
-      @done << [Request.new(stream_id: id, headers: headers, body: request.body), request.reject]
+      @ready << [Request.new(stream_id: id, headers: headers, input: input),
+        Process.clock_gettime(Process::CLOCK_MONOTONIC)]
+    end
+
+    # The client reset its side of the stream, and the request is no longer
+    # #answerable?. A request it had not finished is dropped with what it
+    # held, and #release_closed resets our side with H3_REQUEST_INCOMPLETE;
+    # one waiting to be handed out likewise, with H3_REQUEST_CANCELLED, so
+    # that nobody answers what nobody reads. One handed out and not
+    # answered yet has our side reset with H3_REQUEST_CANCELLED too, so that
+    # its stream closes without waiting for the application, whose response
+    # is dropped. One answered goes on: the client may still read the
+    # response. One refused is answered as it would have been. Inside a
+    # callback, so it calls no C.
+    def on_reset(id)
+      @reset[id] = true if @open.key?(id)
+      if (waiting = take_waiting(id))
+        close_input(waiting.input)
+        release_budget(id)
+        @cancelled << id
+        return
+      end
+      if @handed.key?(id) && !@answered[id]
+        @cancelled << id
+        return
+      end
+      return unless @incoming.key?(id) && !@rejected[id]
+
+      request = @incoming.delete(id)
+      close_input(request.body)
+      release_budget(id)
+      @incomplete << id
+    end
+
+    # The client asked for no more of the response (STOP_SENDING). The C
+    # part has stopped sending it and reading the rest of the request, and
+    # the request is no longer #answerable?: one waiting to be handed out, or
+    # still coming in, is dropped with what it held, and one refused is not
+    # answered. A response being sent stops: a Body::Pipe is cancelled, so
+    # that its writer gets StreamClosed. Inside a callback, so it calls no C.
+    def on_stop_sending(id)
+      return unless @open.key?(id)
+
+      @stopped[id] = true
+      @refused.reject! { |request, _| request.stream_id == id }
+      if (out = @outgoing[id])
+        out.done = true
+        out.body.cancel if out.body.is_a?(Body::Pipe)
+      end
+      if (waiting = take_waiting(id))
+        close_input(waiting.input)
+        release_budget(id)
+      elsif (request = @incoming[id]) && !@rejected[id]
+        @incoming.delete(id)
+        close_input(request.body)
+        release_budget(id)
+      end
     end
 
     private
 
-    def setup(max_request_body)
+    def setup(max_request_body, budget, request_timeout, request_body_buffer_size, spool, response_timeout)
       @max_request_body = max_request_body
+      @budget = budget
+      @request_timeout = request_timeout
+      @response_timeout = response_timeout
+      @request_body_buffer_size = request_body_buffer_size
+      @spool = spool
+      @held = {}
+      # stream_id => bytes of the request's body counted in @spool.bytes,
+      # until its file is closed
+      @spooled = {}
+      # stream_id => true for a request whose file counts in @spool.files
+      @spool_files = {}
+      @spool_error = nil
       @incoming = {}
-      @done = []
+      # [request, status] of the requests refused, until #take_refusals
+      @refused = []
+      # [request, when it ended (CLOCK_MONOTONIC)] of the requests received
+      # in full, until #next_request
+      @ready = []
+      # stream_id => true for a request handed out, until #finish
+      @handed = {}
       @outgoing = {}
       @open = {}
+      # stream_id => true for a stream the client has reset
+      @reset = {}
+      # stream_id => true for a stream the client asked for no more of
+      # (STOP_SENDING)
+      @stopped = {}
+      @rejected = {}
+      @answered = {}
+      @incomplete = []
+      # The requests the client reset once they had come in full, while they
+      # waited to be handed out or before they were answered
+      @cancelled = []
     end
 
-    def fill_body(out, limit)
-      id = out.request.stream_id
-      while unsent_bytes(id) < limit
+    # Count n more bytes for the request on id, if the budget has room.
+    def hold(id, n)
+      return false unless @budget.reserve(n)
+
+      @held[id] = @held.fetch(id, 0) + n
+      true
+    end
+
+    # The request on id holds nothing any more. Calling it again does
+    # nothing.
+    def release_held(id)
+      n = @held.delete(id) or return
+      @budget.release(n)
+    end
+
+    # Write bytes to the temporary file of the request on id, making it
+    # first if it has none: what the request has in memory goes to the
+    # file, and from the memory budget to the spool's. The request is
+    # answered with 503 if the spool limits have no room for it, or if its
+    # file cannot be made or written; the exception then waits for
+    # #take_spool_error. Inside a callback, so it lets nothing out.
+    def spool(id, request, bytes)
+      unless @spool_files.key?(id)
+        return reject(id, request, 503) unless @spool.files.reserve(1)
+
+        @spool_files[id] = true
+        in_memory = request.received
+        return reject(id, request, 503) unless reserve_spooled(id, in_memory)
+
+        file = open_spool
         begin
-          chunk = out.body.enum.next
-        rescue StopIteration
-          out.done = true
-          push_eof(id)
-          return
-        rescue => e
-          out.done = true
-          abort_stream(id, Nghttp3::H3_INTERNAL_ERROR)
-          yield e
-          return
+          file.write(request.body.string)
+        rescue
+          close_input(file)
+          raise
         end
+        request.body = file
+        @held[id] = @held.fetch(id, 0) - in_memory
+        @budget.release(in_memory)
+      end
+      return reject(id, request, 503) unless reserve_spooled(id, bytes.bytesize)
+
+      request.body.write(bytes)
+      request.received += bytes.bytesize
+    rescue => e
+      @spool_error ||= e
+      reject(id, request, 503)
+    end
+
+    # The temporary file for a request body; tests replace it.
+    def open_spool
+      Session.spool_file
+    end
+
+    # Count n more bytes of the request on id in the spool, if it has room.
+    def reserve_spooled(id, n)
+      return false unless @spool.bytes.reserve(n)
+
+      @spooled[id] = @spooled.fetch(id, 0) + n
+      true
+    end
+
+    # The request on id holds no bytes in the spool any more. Calling it
+    # again does nothing.
+    def release_spooled(id)
+      n = @spooled.delete(id) or return
+      @spool.bytes.release(n)
+    end
+
+    # The temporary file of the request on id is closed: it no longer
+    # counts as open. Calling it again does nothing.
+    def release_spool_file(id)
+      @spool_files.delete(id) or return
+      @spool.files.release(1)
+    end
+
+    # Nothing the request on id holds counts any more: bytes in memory, in
+    # its temporary file, and the file. Calling it again does nothing.
+    def release_budget(id)
+      release_held(id)
+      release_spooled(id)
+      release_spool_file(id)
+    end
+
+    # Take the request on id out of those waiting to be handed out; nil if
+    # it is not one of them.
+    def take_waiting(id)
+      index = @ready.index { |request, _| request.stream_id == id } or return nil
+      @ready.delete_at(index).first
+    end
+
+    # Answer a request received in full, but not handed out, with status at
+    # once, as #reject does one still coming in.
+    def refuse_waiting(request, status)
+      id = request.stream_id
+      close_input(request.input)
+      release_budget(id)
+      @rejected[id] = true
+      @refused << [Request.new(stream_id: id, headers: [], input: empty_input), status]
+    end
+
+    # Close input unless the application has; a file that cannot be flushed
+    # is given up on all the same.
+    def close_input(input)
+      input.close unless input.closed?
+    rescue IOError, SystemCallError
+      nil
+    end
+
+    # Answer the request on id with status, at once, instead of passing it
+    # on: what has come of it is dropped, with the bytes it held, and
+    # #respond stops reading the rest. Its Incoming stays in @incoming,
+    # emptied, until the stream closes, and the callbacks still to come for
+    # it are ignored. 431 may come before all of the pseudo-headers, so the
+    # request goes out without any headers. A refusal is not logged: only
+    # failures are, and a flood of refusals would flood the log.
+    def reject(id, request, status)
+      request.pseudo.clear
+      request.fields.clear
+      close_input(request.body)
+      request.body = empty_input
+      request.received = 0
+      release_budget(id)
+      @rejected[id] = true
+      @refused << [Request.new(stream_id: id, headers: [], input: empty_input), status]
+    end
+
+    # Queue chunks of out's body while its stream has less than limit bytes
+    # unsent and less than room (nil for no limit) has been queued. Returns
+    # the bytes queued.
+    def fill_body(out, limit, room)
+      queued = 0
+      id = out.request.stream_id
+      while unsent_bytes(id) < limit && (room.nil? || queued < room)
+        chunk = next_chunk(out.body)
+        break if chunk.nil?
+
         unless chunk.is_a?(String)
           out.done = true
-          abort_stream(id, Nghttp3::H3_INTERNAL_ERROR)
-          yield TypeError.new("body chunk must be a String (got #{chunk.class})")
-          return
+          if chunk.equal?(END_OF_BODY)
+            push_eof(id)
+          else
+            abort_stream(id, Nghttp3::H3_INTERNAL_ERROR)
+            yield chunk
+          end
+          break
         end
         push_chunk(id, chunk)
+        queued += chunk.bytesize
       end
+      queued
     rescue Nghttp3::Error
       # The stream went away under the body (the peer reset it); it is
       # released when its close comes through.
       out.done = true
+      queued
+    end
+
+    # The next chunk of body, a String; END_OF_BODY at its end; the
+    # exception that ends it otherwise; or nil while a Body::Pipe has
+    # nothing yet.
+    def next_chunk(body)
+      if body.is_a?(Body::Pipe)
+        chunk = body.take
+        return chunk.equal?(:eof) ? END_OF_BODY : chunk
+      end
+      chunk = body.enum.next
+      chunk.is_a?(String) ? chunk : TypeError.new("body chunk must be a String (got #{chunk.class})")
+    rescue StopIteration
+      END_OF_BODY
+    rescue => e
+      e
+    end
+
+    # The bodies the Session sends as they are generated, rather than read
+    # by the C part (Body::File).
+    def generated?(body)
+      body.is_a?(Body::Chunks) || body.is_a?(Body::Pipe)
     end
 
+    # An input with no body, for the requests that keep none.
+    def empty_input
+      StringIO.new("".b)
+    end
+
+    # The input of a request handed out is the caller's to close, and what
+    # it holds counts until #finish.
     def release(id)
       @open.delete(id)
-      @incoming.delete(id)
-      @done.reject! { |request, _| request.stream_id == id }
+      incoming = @incoming.delete(id)
+      close_input(incoming.body) if incoming
+      waiting = take_waiting(id)
+      close_input(waiting.input) if waiting
+      release_budget(id) unless @handed.key?(id)
+      @reset.delete(id)
+      @stopped.delete(id)
+      @rejected.delete(id)
+      @answered.delete(id)
+      @refused.reject! { |request, _| request.stream_id == id }
       out = @outgoing.delete(id) or return
 
       close_body(out.body)
@@ -184,10 +726,16 @@ module HTTP3
       yield id, e if block_given?
     end
 
+    # A Body::Pipe is cancelled, so that its writer stops; a Body::File's
+    # own IO is closed; a rack_body other than nil is closed.
     def close_body(body)
-      body.io.close if body.is_a?(Body::File) && !body.io.closed?
+      case body
+      when Body::Pipe then body.cancel
+      when Body::File then body.io.close unless body.io.closed?
+      end
     ensure
-      body.rack_body.close if body.rack_body.respond_to?(:close)
+      rack_body = body.rack_body if body.respond_to?(:rack_body)
+      rack_body.close if rack_body.respond_to?(:close)
     end
   end
 end