http3 0.0.3 → 0.0.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7342e51b5150f53092806631b85d5d1053d16f7f757c26730227fd0a9d27619d
-  data.tar.gz: 7c7cee88475696117fcfe14e42333fc1267ffc0942c40360f6b6d0fcc9b487cf
+  metadata.gz: 327825057f3faad23ce063df236945bb927803d537b9a9df853352ad30515fb4
+  data.tar.gz: 19051a40291f678fce8a6a44fce125d40706e6ad3cf4b9b800875910dfd5a11b
 SHA512:
-  metadata.gz: 802c51e3f9040ac9d51ff0f6afee6e1541f7f479f94336283d49c346c127bf6740fca313ce4badb5627ba03e4793be9cd1536bafbfec24a180a3658a2a0c3cd7
-  data.tar.gz: fe45066ac7c54c622ff9c5fdab9d1fbc474867ce2076db6fd28f1c78ca4f65db8c5fbf1059b2dead1234e414902f8d43aa53c9912a08602fd0849425a5bfc480
+  metadata.gz: 6003280f0c3dbcd4d62d4a63f7c70a79b31230c93dcc2ad7d95bfd83b3ae98a9814fa7e076e1ccb6c8e476b8b8822a94a7daefffbab7d0db19752752c5b3a929
+  data.tar.gz: b10b118decf20b8326cabd055890d35a7c0b8e17aa1853e61e726761f679b98a35c0cc178a1250fd43e1311a616e1b32b47cbf58e3ff239bd87f55cc1d0ac24a

data/CHANGELOG.md

@@ -1,3 +1,49 @@
+## [0.0.4] - 2026-10-27
+
+### Added
+- quic-interop-runner's http3 test case runs against http3-ruby with `test/interop/run_interop_runner.sh`. The runner's ns-3 network simulator passes no packets under rootless podman, so the script runs the runner on `test/interop/quic-interop-runner.yml`, its compose with a stand-in (`test/interop/sim/`) that forwards with plain Linux routing; it makes the networks afresh before and after each run. CI runs it against the clients of ngtcp2, quic-go, quiche, neqo, aioquic, picoquic, lsquic, s2n-quic and quinn. ([#10](https://github.com/unasuke/http3-ruby/pull/10))
+- `HTTP3::Server` takes `max_connection_request_buffer` (4 MiB) and `max_total_request_buffer` (64 MiB): the bytes that requests not yet passed to the application may hold on one connection and over all connections, header fields counted as RFC 9114 §4.2.2 counts them. A request that would pass either is answered with 503, with neither headers nor body. `HTTP3::Session.attach` takes the same limits as `max_connection_request_buffer:` and `shared_buffer:`, made with `HTTP3::Session.shared_buffer(limit)`. ([#12](https://github.com/unasuke/http3-ruby/pull/12))
+- `test/interop/hold_requests.rb`, a check run by hand that requests held open cannot exhaust the server's memory: 20 connections of 100 requests, none of them ever finished, then a GET on a new connection. ([#12](https://github.com/unasuke/http3-ruby/pull/12))
+- `HTTP3::Server` takes `max_connection_send_buffer` (1 MiB) and `max_total_send_buffer` (64 MiB): the bytes of array and `each` response bodies that may be queued but unsent on one connection and over all connections. A body waits for room, and while the total is used up, the bodies on every connection wait. `HTTP3::Session#fill_bodies` and `#wants_fill?` take the room left as `connection_limit:` and `room:`, and `#unsent_total` tells what a Session has unsent. ([#17](https://github.com/unasuke/http3-ruby/pull/17))
+- `HTTP3::Server` takes `request_timeout` (30 seconds): the time a request may take to come in full, counted from the start of its headers. One that takes longer is answered with 408, with neither headers nor body, and the rest of it is not read. `nil` sets no limit; anything else but a positive number makes `HTTP3::Server.new` raise `ArgumentError`. `HTTP3::Session.attach` takes it as `request_timeout:`, `HTTP3::Session#expire_requests(now)` refuses the requests past their time, and `#next_request_deadline` tells when the next one runs out. 30 seconds fit the default `max_request_body` of 1 MiB at about 280 kbps; an application that raises `max_request_body` should lengthen `request_timeout` to match or set it to `nil`, or large uploads over slow links get 408 (100 MiB in 30 seconds takes about 28 Mbps). ([#18](https://github.com/unasuke/http3-ruby/pull/18))
+- `HTTP3::Server` logs how many requests it answered without the application (400, 408, 413, 431, 501 and 503), which are not logged one by one: `refusal_log_interval` seconds (60) after the first of them, and when `#run` ends, a warn line per status such as `requests_refused status=503 count=1234 seconds=60`, with the seconds since the first. `HTTP3::Server.new` raises `ArgumentError` for a `refusal_log_interval` that is not a positive number. `HTTP3::RackAdapter#take_refusals` returns the 400s and 501s it answered since the last call, as `{status => count}`. ([#19](https://github.com/unasuke/http3-ruby/pull/19))
+
+### Changed
+- The interop checks in CI, curl and quic-interop-runner, run on every push to main as well as weekly. ([#10](https://github.com/unasuke/http3-ruby/pull/10))
+- http3 depends on quic `~> 0.0.5`. A client on that quic keeps its connection when the server stops reading a request it is still sending, and closes the qlog file of a connection once the connection ends. ([#11](https://github.com/unasuke/http3-ruby/pull/11))
+- 413 and 431 are answered as soon as the request passes the limit, before the rest of it arrives. The server does not read the rest: `HTTP3::Session#stop_reading` sends STOP_SENDING with H3_NO_ERROR, as RFC 9114 §4.1 allows. ([#12](https://github.com/unasuke/http3-ruby/pull/12))
+- `HTTP3::Session#take_requests` hands out a request it refuses (413, 431 or 503) as soon as it is refused, with neither headers nor body. ([#12](https://github.com/unasuke/http3-ruby/pull/12))
+- `HTTP3::Session#respond` raises `HTTP3::Nghttp3::InvalidStateError` for a request already answered, instead of sending a second response. ([#12](https://github.com/unasuke/http3-ruby/pull/12))
+- The request that `HTTP3::Session#fill_bodies` passes to its block has only the pseudo-header fields, and no body: a response being sent no longer keeps the body of its request. ([#12](https://github.com/unasuke/http3-ruby/pull/12))
+- `HTTP3::Server.new` raises `ArgumentError` for request limits that are not Integers in range, and for a `max_connection_request_buffer` smaller than `max_request_body + max_field_section_size` or a `max_total_request_buffer` smaller than `max_connection_request_buffer`, which would answer a request within both limits with 503 on an idle server. ([#12](https://github.com/unasuke/http3-ruby/pull/12))
+- `HTTP3::Server.new` raises `ArgumentError` unless `send_buffer_size`, `max_connection_send_buffer` and `max_total_send_buffer` are positive Integers, each at least the one before. ([#17](https://github.com/unasuke/http3-ruby/pull/17))
+- `HTTP3::Nghttp3::NV_FLAG_NO_COPY_NAME` and `NV_FLAG_NO_COPY_VALUE` are ignored: nghttp3 always copies the names and values, and lowercases the names it copies. `HTTP3::Nghttp3::NV.new` raises `ArgumentError` for flags that are not an Integer of 0..255. ([#13](https://github.com/unasuke/http3-ruby/pull/13))
+- A callback may call back into its `HTTP3::Nghttp3::Connection` only as far as nghttp3 allows: inside the callbacks of `#read_stream`, the `#submit_*` methods, `#resume_stream`, `#block_stream`, `#unblock_stream`, `#shutdown_stream_read`, `#shutdown_stream_write`, `#submit_shutdown_notice`, `#shutdown`, `#set_max_client_streams_bidi` and `#stream_writable?`; inside any other callback, nothing that calls into nghttp3. The rest, `#close` among them, raise `InvalidStateError`, as do `HTTP3::Session`'s methods called from inside its callbacks. Once nghttp3 reports a connection error, only `#close` is allowed. ([#13](https://github.com/unasuke/http3-ruby/pull/13))
+- What nghttp3 asserts of its callers raises instead. `ArgumentError`: a stream id out of 0..2**62-1 or of the wrong kind for the call, a smaller `#set_max_client_streams_bidi` than before, and a header that is not an `HTTP3::Nghttp3::NV` with String name and value, whose `to_str` is no longer called. `InvalidStateError`: `#submit_info` or `#set_max_client_streams_bidi` on a client, a `#submit_*` before `#bind_qpack_streams`, and a GOAWAY before `#bind_control_stream` or after `#shutdown`. ([#13](https://github.com/unasuke/http3-ruby/pull/13))
+- `HTTP3::RackAdapter` answers 400, without calling the application or logging, a request whose scheme is not http or https, whose path has a fragment, whose authority is not `host` or `host:port`, or whose `:authority` and `host` field differ (RFC 9114 §4.3.1). It answers CONNECT with 501, since the server opens no tunnels. ([#14](https://github.com/unasuke/http3-ruby/pull/14))
+- A response gets 500 for a status outside 200..599, a `content-length` given more than once or not a number, or one that a file or array body does not have. A body read with `each` is counted as it is sent, and its stream is aborted once it passes `content-length` or ends short of it. ([#14](https://github.com/unasuke/http3-ruby/pull/14))
+- The `content-length` of a 204 response is dropped, as RFC 9110 §8.6 forbids one. ([#14](https://github.com/unasuke/http3-ruby/pull/14))
+
+### Fixed
+- The browser steps of `test/interop/README.md` work as written. Chrome opens 127.0.0.1, since it looks localhost up as ::1 first. Firefox gets Alt-Svc over TCP from `openssl s_server` on the same port, since `network.http.http3.alt-svc-mapping-for-testing` alone still left it connecting over TCP, where nothing listened. ([#9](https://github.com/unasuke/http3-ruby/pull/9))
+- A client that never finished its requests could make the server hold `max_request_body` on every stream of every connection: about 100 MiB per connection, and 100 GiB in all, with the defaults. The new buffer limits bound it. ([#12](https://github.com/unasuke/http3-ruby/pull/12))
+- A request the client resets before sending it in full gets the server's side of its stream reset with H3_REQUEST_INCOMPLETE (RFC 9114 §4.1), so that the stream closes. Before, it stayed open, holding what had come of the request, until the connection ended. ([#12](https://github.com/unasuke/http3-ruby/pull/12))
+- A client that allows fewer than three unidirectional streams no longer aborts the server process on nghttp3's assertions: its connection is closed with H3_GENERAL_PROTOCOL_ERROR. ([#12](https://github.com/unasuke/http3-ruby/pull/12))
+- Once nghttp3 reports an error on a connection, `HTTP3::Session` deletes the nghttp3 connection and the QUIC connection closes. Before, calls made later in the same turn still went into the failed nghttp3 connection. ([#12](https://github.com/unasuke/http3-ruby/pull/12))
+- An exception from `HTTP3::Session.attach` no longer stops `HTTP3::Server#run`. It is logged as `session_error` and closes that connection only. ([#12](https://github.com/unasuke/http3-ruby/pull/12))
+- Two use-after-frees in `HTTP3::Nghttp3`: a header submitted with the no-copy flags went out as freed memory once its NV was dropped, and `Connection#close` inside a callback freed the nghttp3 connection nghttp3 was still running on. ([#13](https://github.com/unasuke/http3-ruby/pull/13))
+- `Connection#submit_*` and `QPACK::Encoder#encode` put the header list on the heap. On the machine stack, a long list overflowed a thread's stack. ([#13](https://github.com/unasuke/http3-ruby/pull/13))
+- `Connection#submit_*`, `QPACK::Encoder#encode` and `HTTP3::Session#submit_response` take the pointers into the header Strings only once no Ruby code can run before nghttp3 copies them. A GC that compacted the heap inside a later field's `to_str` made them send the bytes left behind, and the body's `to_str` could close the connection before nghttp3 was called with it. `Session#push_chunk` and `#attach_file` likewise convert their arguments before they look up the stream. ([#13](https://github.com/unasuke/http3-ruby/pull/13))
+- A stream id, role or order of calls that nghttp3 asserts against no longer aborts the process. ([#13](https://github.com/unasuke/http3-ruby/pull/13))
+- After nghttp3 reports a connection error, `HTTP3::Nghttp3::Connection` no longer lets calls go into the failed nghttp3 connection. ([#13](https://github.com/unasuke/http3-ruby/pull/13))
+- `HTTP3::Nghttp3::QPACK::Decoder` decodes at most `MAX_STREAMS` (2000) streams at once, and raises `InvalidStateError` for one more. Before, a peer that began field sections and never finished them made it hold any number of stream contexts. ([#13](https://github.com/unasuke/http3-ruby/pull/13))
+- Calling `QPACK::Encoder#initialize` or `QPACK::Decoder#initialize` again frees the old encoder or decoder, which leaked, and a decoder's stream contexts, from which it went on decoding a stream in the old state. ([#13](https://github.com/unasuke/http3-ruby/pull/13))
+- The Rack env no longer carries what the client sent unchecked: the scheme goes in lowercase, and an empty port is the scheme's default. Before, a scheme such as file or ftp became `rack.url_scheme`, a fragment stayed in `PATH_INFO`, an authority such as `example.com:abc` was split into `SERVER_NAME` and `SERVER_PORT` however it fell apart, and `:authority` won over a `host` field that said otherwise. ([#14](https://github.com/unasuke/http3-ruby/pull/14))
+- An array body with a chunk that is not a String is answered with 500 before anything is sent. Before, its headers went out and then its stream was aborted. ([#14](https://github.com/unasuke/http3-ruby/pull/14))
+- A client that never finished its requests could keep what they held of the request buffers for as long as it kept them open: with the defaults, 16 such connections filled `max_total_request_buffer` and left every other request with 503. Such a request now gets 408 once `request_timeout` has passed. ([#18](https://github.com/unasuke/http3-ruby/pull/18))
+- `HTTP3::Nghttp3::Connection#read_stream` takes frozen data, such as a String literal under `frozen_string_literal`. Before, it raised `FrozenError`. ([#16](https://github.com/unasuke/http3-ruby/pull/16))
+- A client that stops reading its responses could make the server hold `send_buffer_size` on every stream of every connection: about 6.4 GiB with the defaults. The new send buffer limits bound it. ([#17](https://github.com/unasuke/http3-ruby/pull/17))
+
 ## [0.0.3] - 2026-10-13
 
 ### Added

data/README.md

@@ -1,17 +1,23 @@
 # http3-ruby
 
-> [!CAUTION]
-> This gem is for experimental purposes only. Do not use it in production environments.
-
-> [!WARNING]
-> The code in this repository is almost entirely generated by Claude Code and reviewed by a human.
-
 `http3` serves Rack 3 applications over HTTP/3. It runs QUIC through the
 [quic gem](https://github.com/unasuke/quic-ruby) and HTTP/3 through
 [nghttp3](https://github.com/ngtcp2/nghttp3), which it builds from source and
 links in statically. The nghttp3 bindings are also there to use directly, as
 `HTTP3::Nghttp3`.
 
+It is not suited for production yet:
+
+- The application is called on the thread that drives every connection, one
+  request at a time, so a slow request holds up all the others.
+- A request body is read in full, up to `max_request_body:` (1 MiB), before
+  the application is called, and streaming response bodies are not
+  supported.
+- CI runs it on Ruby 4.0 alone, not on 3.3, the oldest it installs on. It is
+  checked against curl and the clients of quic-interop-runner, over links
+  with no loss or delay, and has not been run under load or over lossy
+  networks.
+
 ## Installation
 
 Linux only, Ruby 3.3 or later. Like the quic gem, installing builds C code, so
@@ -58,17 +64,44 @@ Other options, with their defaults:
 | `max_connections:` | `1024` | Connections at once; more are refused with CONNECTION_REFUSED |
 | `max_request_body:` | `1_048_576` | Bytes of request body; more gets 413 |
 | `max_field_section_size:` | `65_536` | Bytes of request headers (RFC 9114 §4.2.2); more gets 431 |
+| `max_connection_request_buffer:` | `4_194_304` | Bytes a connection's requests may hold before they reach the application (headers counted as RFC 9114 §4.2.2 does, and bodies); more gets 503 |
+| `max_total_request_buffer:` | `67_108_864` | The same over all connections; more gets 503 |
 | `send_buffer_size:` | `65_536` | Bytes of a response body queued but unsent per stream |
+| `max_connection_send_buffer:` | `1_048_576` | Bytes of array and `each` response bodies a connection may have queued but unsent; more waits |
+| `max_total_send_buffer:` | `67_108_864` | The same over all connections |
+| `request_timeout:` | `30` | Seconds a request may take to come in full, counted from its headers; later gets 408. `nil` for no limit |
+| `refusal_log_interval:` | `60` | Seconds between the `requests_refused` log lines, which count the requests answered without the application (400, 408, 413, 431, 501, 503) |
 | `shutdown_timeout:` | `30` | Seconds a graceful stop waits for the requests under way |
 | `qlog_dir:` | `nil` | Directory for one qlog file per connection |
 | `transport_params:` | `QUIC::TransportParams.default` | QUIC transport parameters |
 | `settings:` | `QUIC::Settings.default` | QUIC settings (the ALPN is always `h3`) |
 | `logger:` | `Logger.new($stderr)` | Where failures are logged |
 
+`max_connection_request_buffer:` has to be at least `max_request_body:` plus
+`max_field_section_size:`, and `max_total_request_buffer:` at least
+`max_connection_request_buffer:`, so that a request within the limits never
+gets 503 from an idle server; otherwise `HTTP3::Server.new` raises
+`ArgumentError`.
+
+A request gets 413, 431 or 503 as soon as it passes a limit, without waiting
+for the rest of it, and the server reads no more of it (STOP_SENDING with
+H3_NO_ERROR). The 503 has neither headers nor body.
+
+A request gets 400, without the application seeing it, when its scheme is
+not `http` or `https`, its path has a fragment, its authority is not `host`
+or `host:port`, or its `:authority` and `host` field differ. `CONNECT` gets
+501: the server opens no tunnels.
+
 Response bodies may be files (`to_path`, sent 16 KiB at a time as the
-connection takes them), arrays or anything with `each`. Streaming bodies
-(`call`) are not supported and get 500, as do response headers whose names
-are not lowercase tokens or whose values contain NUL, CR or LF.
+connection takes them), arrays or anything with `each`. These get 500:
+streaming bodies (`call`), which are not supported; a status outside
+200..599; response headers whose names are not lowercase tokens or whose
+values contain NUL, CR or LF; a `content-length` given more than once, not a
+number, or not the length of a file or array body; and an array body with a
+chunk that is not a String. A body read with `each` is counted as it is
+sent, and its stream is aborted (H3_INTERNAL_ERROR) once it goes past
+`content-length` or ends short of it. The `content-length` of a 204 is
+dropped.
 
 ### Signals
 
@@ -105,6 +138,30 @@ alt-svc: h3=":443"
 
 That is configured in that server (nginx, Puma, ...), not in this gem.
 
+### HTTP3::Nghttp3
+
+The bindings keep nghttp3's rules for its callers, so that a wrong call
+raises instead of crashing the process or reaching freed memory:
+
+- A callback (a `Callbacks` block or a body block) runs while nghttp3 is in
+  the middle of a call. Inside the callbacks of `read_stream`, it may call
+  `submit_*`, `resume_stream`, `block_stream`, `unblock_stream`,
+  `shutdown_stream_read`, `shutdown_stream_write`, `submit_shutdown_notice`,
+  `shutdown`, `set_max_client_streams_bidi` and `stream_writable?` on the
+  same connection. `close`, `read_stream`, `writev_stream` and the rest
+  raise `InvalidStateError` there, and inside any other callback every call
+  into nghttp3 does.
+- Once nghttp3 reports a connection error, only `#close` can be called; the
+  rest raise `InvalidStateError`.
+- `NV_FLAG_NO_COPY_NAME` and `NV_FLAG_NO_COPY_VALUE` are ignored: names and
+  values are always copied.
+- Stream ids are checked for their range and kind, and calls for the role
+  and state of the connection, raising `ArgumentError` and
+  `InvalidStateError` instead of tripping nghttp3's assertions.
+- A `QPACK::Decoder` decodes at most `MAX_STREAMS` (2000) streams at once.
+
+The signatures in `sig/` describe each method.
+
 ## Development
 
 After checking out the repo, run `bin/setup` to install dependencies. Then,

data/ext/http3/nghttp3.c

@@ -136,6 +136,25 @@ void nghttp3_rb_raise(int error_code, const char *fmt, ...) {
   }
 }
 
+/* The largest stream id, the largest value of a QUIC variable-length
+ * integer. */
+#define NGHTTP3_RB_MAX_STREAM_ID ((1ULL << 62) - 1)
+
+int64_t nghttp3_rb_stream_id(VALUE rb_id) {
+  VALUE id = rb_to_int(rb_id);
+  uint64_t value;
+  /* 0 for zero, 1 for a positive value that fits, -1 or -2 for a negative
+   * one and 2 for one too large. */
+  int sign = rb_integer_pack(id, &value, 1, sizeof(value), 0,
+                             INTEGER_PACK_MSWORD_FIRST |
+                                 INTEGER_PACK_NATIVE_BYTE_ORDER);
+  if ((sign == 0 || sign == 1) && value <= NGHTTP3_RB_MAX_STREAM_ID) {
+    return (int64_t)value;
+  }
+  rb_raise(rb_eArgError, "stream_id must be 0..2**62-1 (got %" PRIsVALUE ")",
+           rb_id);
+}
+
 /*
  * call-seq:
  *   Nghttp3.err_is_fatal?(error_code) -> true or false
@@ -174,7 +193,7 @@ static const quic_ext_api *http3_load_quic_api(uint32_t major) {
     VALUE version = rb_const_get(quic, rb_intern("VERSION"));
     rb_raise(rb_eLoadError,
              "http3 needs the quic gem's C function table for quic/ext.h "
-             "ABI major version %u (quic ~> 0.0.3), which quic %" PRIsVALUE
+             "ABI major version %u (quic ~> 0.0.5), which quic %" PRIsVALUE
              " does not provide",
              (unsigned int)major, version);
   }

data/ext/http3/nghttp3.h

@@ -46,6 +46,13 @@ extern const rb_data_type_t settings_data_type;
 /* TypedData type for Callbacks */
 extern const rb_data_type_t callbacks_data_type;
 
+/* Which call into nghttp3 a connection is in, for ConnectionObj.entered.
+ * nghttp3 runs callbacks only inside such a call, and lets a callback call
+ * back into the connection only as far as that call allows: from inside
+ * read_stream, ngtcp2's examples submit a response, but nghttp3 is in no
+ * state to read, write or be deleted. */
+enum { CONN_IDLE, CONN_IN_READ, CONN_IN_OTHER };
+
 /* The C side of an Nghttp3::Connection. nghttp3 gets a pointer to this
  * struct as conn_user_data, never the Ruby object: GC.compact may move the
  * object, and dcompact keeps self pointing at it. */
@@ -66,6 +73,19 @@ typedef struct {
   VALUE pending_exc;
   int is_closed;
   int is_server;
+  int entered; /* CONN_IDLE, or the call into nghttp3 under way */
+  /* nghttp3 returned an error after which it allows nothing but
+   * nghttp3_conn_del: any from read_stream or writev_stream, or a fatal one
+   * from another call. */
+  int failed;
+  /* What has been done to the connection, for the calls nghttp3 asserts
+   * come after it or not after it. goaway is 0 before any GOAWAY, 1 after
+   * submit_shutdown_notice and 2 after shutdown. max_client_streams is the
+   * last value given to set_max_client_streams_bidi. */
+  int ctrl_bound;
+  int qpack_bound;
+  int goaway;
+  uint64_t max_client_streams;
 } ConnectionObj;
 
 /* Run body(arg) under rb_protect on behalf of a callback of obj. An
@@ -84,11 +104,24 @@ void nghttp3_rb_conn_stream_closed(ConnectionObj *obj, int64_t stream_id);
 VALUE nghttp3_rb_error_class_for_code(int error_code);
 void nghttp3_rb_raise(int error_code, const char *fmt, ...);
 
+/* rb_id (to_int is called) as a stream id for nghttp3, which asserts the
+ * range of the ids it is given: ArgumentError unless it is 0..2**62-1. */
+int64_t nghttp3_rb_stream_id(VALUE rb_id);
+
 /* Settings helper */
 nghttp3_settings *nghttp3_rb_get_settings(VALUE rb_settings);
 
-/* NV helper */
-nghttp3_nv nghttp3_rb_nv_to_c(VALUE rb_nv);
+/* NV helpers. nghttp3_rb_nva_fill fills nva with the first nvlen elements
+ * of headers, an Array of NVs, pointing into their Strings. It never raises,
+ * allocates nothing and runs no Ruby code, so that from the moment it takes
+ * those pointers until nghttp3 has copied the Strings, nothing can change,
+ * free or move them; so call it after anything that allocates or may run
+ * Ruby code, and call nghttp3 right after it. It returns the index of the
+ * first element that is not an NV with String name and value and flags of
+ * 0..255, or -1 if there is none. nghttp3_rb_raise_bad_nv raises
+ * ArgumentError for that index. */
+long nghttp3_rb_nva_fill(VALUE headers, nghttp3_nv *nva, long nvlen);
+NORETURN(void nghttp3_rb_raise_bad_nv(long index));
 
 /* Callbacks helper: install the C callbacks, which do their own
  * bookkeeping and then call the Ruby blocks of conn's Callbacks, if any. */