@amritk/nish-x86_64-linux 0.18.0 → 0.21.0

package/std/net/http1-server.ts

@@ -22,7 +22,7 @@
  *     }
  *     wants = server.flush(slot);
  *     if ((wants & H1_DONE) !== 0) { server.close(slot); }
- *     else { pollModify(loop, server.fd(slot), wants & 3, slot); }
+ *     else if (server.rearm(slot, wants)) { pollModify(loop, server.fd(slot), wants & 3, slot); }
  *
  * **Events.** `next()` answers `H1_REQUEST` (a request's head: the parser's
  * spans and `...Is` methods read it), `H1_BODY` (some of its body, de-chunked,
@@ -65,6 +65,13 @@
  * §15.4.5). A 1xx before the final response (100 Continue) is allowed; 101 is
  * `acceptWebSocket`'s.
  *
+ * **The Date.** Every final response, an error included, carries a `Date`
+ * field (RFC 9110 §6.6.1) from `HttpDate`, which formats the IMF-fixdate at
+ * most once a second; a 1xx carries none. The pool's slots share one, so a
+ * busy server formats a second once, not once a slot. A program that sets its
+ * own `date` field sends that one instead, so a response has one `Date`.
+ * `date.pin(unixMs)` fixes it, for a test that compares bytes.
+ *
  * **Refusals.** Every refusal of `nish/net/http1`'s parser — the smuggling
  * shapes, a `Content-Length` with a `Transfer-Encoding`, two that disagree,
  * a malformed chunk size — is answered with its status (400, 413, 414, 431,
@@ -81,11 +88,23 @@
  *
  * **Caps are start-up numbers**, all in `Http1Config`: the request target,
  * the header section and its field count, a request body, the chunk handed
- * over, the output buffer, a WebSocket message and the idle timeout; the
- * slots are the pool's size. Every buffer is allocated by the constructor or
- * grown to its cap on first use and kept, so a warmed slot serves request
- * after request with `Arena.used()` flat. Accepting a WebSocket allocates
- * (the accept key), once a connection.
+ * over, the output buffer, a WebSocket message, the idle timeout and the
+ * deadline for a whole request head (`headTimeout`, against slowloris); the
+ * slots are the pool's size. `Http1Server` builds a slot's connection on the
+ * first accept into it and keeps it, so a pool sized for its peak costs at
+ * start-up only what does not depend on the size, and holds at most `size`
+ * connections once the peak has come; `Http1TlsServer` does the same for a
+ * slot's connection and, through `TlsTcpServer`, its TLS state. Every buffer
+ * is allocated with its slot or grown to its cap on first use and kept, so a
+ * warmed slot serves request after request with `Arena.used()` flat.
+ * Accepting a WebSocket allocates (the accept key), once a connection.
+ *
+ * **Output is borrowed.** The pools' slots share an `Http1OutputPool`: a
+ * connection takes an `outputSize` buffer when it first needs room to write
+ * and gives it back once its carrier has sent everything, so the output
+ * memory a pool holds follows the connections the socket is holding back,
+ * not its size. A pool that ever had `n` connections writing at once keeps
+ * `n` buffers and allocates no more.
  *
  * Private helpers share the importing program's flat symbol namespace
  * (`docs/wp26-stdlib.md` §3e), which is why each one carries the module's name.
@@ -128,6 +147,7 @@ import {
   websocketWriteFrame,
 } from "nish/net/websocket"
 import { TlsServerConfig } from "nish/net/tls"
+import { HTTP_DATE_LAST_SECOND, HTTP_DATE_SIZE, httpDateWrite } from "nish/net/http-fields"
 import { TLS_RECORD_DONE, TLS_RECORD_STATE_OPEN, TLS_RECORD_WANT_WRITE } from "nish/net/tls/record-server"
 import { TlsTcpServer } from "nish/net/tls-tcp"
 
@@ -228,6 +248,82 @@ const http1ServerCopy = (out: u8[], at: i32, src: u8[], off: i32, n: i32): i32 =
   return at + n
 }
 
+/**
+ * The `Date` field an origin server with a clock sends on every final
+ * response (RFC 9110 §6.6.1): the IMF-fixdate of now, in 29 bytes the object
+ * owns and rewrites in place, at most once a second.
+ *
+ * It reads the wall clock, `Date.now()`, which a wasm32 build has no host for,
+ * so it lives here, in a module that is native already, while the formatting
+ * it calls, `httpDateWrite`, stays in `nish/net/http-fields`, which compiles
+ * for wasm32 (the split `nish/crypto/x509` and `x509-random` make). `pin`
+ * replaces the clock with one instant, which is how a test asserts a response
+ * byte for byte.
+ */
+export class HttpDate {
+  /** The IMF-fixdate of `second`: what `current` answers, made once. */
+  bytes: u8[]
+  /** The second `bytes` holds, since 1970; -1 before the first `current`. */
+  second: i64 = -1
+  /** The instant `pin` fixed, in milliseconds since 1970, while `pinned`. */
+  pinnedMs: i64 = 0
+  /** How many times `bytes` has been rewritten. */
+  rewrites: i64 = 0
+  pinned: boolean = false
+
+  /** A date on the wall clock, with nothing formatted yet. */
+  constructor() {
+    this.bytes = new Array<u8>(HTTP_DATE_SIZE)
+  }
+
+  /**
+   * The 29 bytes for now, which are rewritten only when the second differs
+   * from the one they hold — earlier as well as later, since a corrected clock
+   * steps back. It allocates nothing, and the array is the same one each time,
+   * so a caller copies it out rather than keeping it. A wall clock before 1970
+   * or past 9999 answers the nearer of the two ends.
+   */
+  current(): u8[] {
+    const ms: i64 = this.pinned ? this.pinnedMs : toI64(Date.now())
+    let second: i64 = ms / 1000
+    if (ms < 0) {
+      second = 0
+    } else if (second > HTTP_DATE_LAST_SECOND) {
+      second = HTTP_DATE_LAST_SECOND
+    }
+    if (second !== this.second) {
+      httpDateWrite(this.bytes, 0, second)
+      this.second = second
+      this.rewrites += 1
+    }
+    return this.bytes
+  }
+
+  /**
+   * Makes `current` answer `unixMs`, milliseconds since 1970, until `unpin`.
+   * False, and nothing changed, for an instant before 1970-01-01T00:00:00Z or
+   * after 9999-12-31T23:59:59.999Z, which an IMF-fixdate cannot name.
+   */
+  pin(unixMs: i64): boolean {
+    if (unixMs < 0 || unixMs / 1000 > HTTP_DATE_LAST_SECOND) {
+      return false
+    }
+    this.pinnedMs = unixMs
+    this.pinned = true
+    return true
+  }
+
+  /** Puts `current` back on the wall clock. */
+  unpin(): void {
+    this.pinned = false
+  }
+
+  /** How many times the bytes have been rewritten: one per second that `current` was asked for, at most. */
+  formats(): i64 {
+    return this.rewrites
+  }
+}
+
 /**
  * The caps of every connection made from it, fixed when the connection is
  * made. Each is a number the program sets once, at start-up.
@@ -249,6 +345,13 @@ export class Http1Config {
   maxMessage: i32 = 1048576
   /** Milliseconds without a byte read or written after which `expire` closes a slot. */
   idleTimeout: i32 = 60000
+  /**
+   * Milliseconds a request head may take, from its first byte to its blank
+   * line, before `expire` closes the slot however steadily its bytes come. The
+   * idle timeout alone restarts on every byte, so a client that sends one byte
+   * of its head each `idleTimeout` would hold its slot for good (slowloris).
+   */
+  headTimeout: i32 = 30000
 }
 
 /** The reason phrase a status is sent with; RFC 9112 §4 lets a client ignore it. */
@@ -311,6 +414,44 @@ const http1ServerReserved = (name: u8[]): boolean =>
   http1BytesAre(name, "transfer-encoding") ||
   http1BytesAre(name, "content-length")
 
+/**
+ * Output buffers shared by the connections of one pool, each `size` bytes. A
+ * connection borrows one when it has something to write and gives it back
+ * once its carrier has sent everything, so a pool's output memory follows the
+ * connections the socket is holding back, not the slots: Go's `net/http`
+ * pools its writers the same way, and uWebSockets shares one per loop. A
+ * buffer is made only when none is free, so the pool grows to the most
+ * connections ever writing at once and then allocates nothing.
+ */
+export class Http1OutputPool {
+  // Widest first, so the layout packs without padding.
+  free: u8[][]
+  size: i32 = 0
+  /** How many buffers the pool has made. */
+  made: i32 = 0
+
+  constructor(size: i32) {
+    this.size = size
+    this.free = []
+  }
+
+  /** A buffer of `size` bytes: the one given back last, or a new one. */
+  take(): u8[] {
+    if (this.free.length > 0) {
+      const buf: u8[] = this.free[this.free.length - 1]
+      this.free.pop()
+      return buf
+    }
+    this.made = this.made + 1
+    return new Array<u8>(this.size)
+  }
+
+  /** Takes back a buffer `take` gave. */
+  give(buf: u8[]): void {
+    this.free.push(buf)
+  }
+}
+
 /**
  * One connection's HTTP/1.1 server, sans-IO: bytes in through `feed`, events
  * out of `next`, and the response the program writes in
@@ -320,12 +461,27 @@ export class Http1Connection {
   // References, then 64-bit fields, then 32-bit ones, then flags: the order
   // the layout packs without padding.
   config: Http1Config
+  /**
+   * The `Date` every final response carries. The connection makes its own;
+   * `Http1Server` and `Http1TlsServer` put theirs here, so that every slot of a
+   * pool shares one and the pool formats at most once a second. A program may
+   * put another, to share it or to pin its clock.
+   */
+  date: HttpDate
   /** The request parser: its head (`methodIs`, `targetIs`, `header`, spans) is the last `H1_REQUEST`'s. */
   parser: Http1Parser
   /** The frame decoder, once the slot has switched to WebSocket. */
   ws: WsDecoder
-  /** Bytes to send are `output[outputStart .. outputEnd)`. */
+  /**
+   * Bytes to send are `output[outputStart .. outputEnd)`. Empty until the
+   * connection first needs room to write: then its own buffer, made once, or
+   * one borrowed from `pool` and given back by `release` once sent.
+   */
   output: u8[]
+  /** The empty array `output` is while the connection holds no buffer. */
+  noOutput: u8[]
+  /** Where `output` is borrowed from, for a connection of a pool; null for one that keeps its own. */
+  pool: Http1OutputPool | null
   /** `H1_BODY`'s and `H1_WS_MESSAGE`'s bytes. */
   data: u8[]
   /** A ping's payload, kept until its pong fits. */
@@ -334,6 +490,8 @@ export class Http1Connection {
   noFields: u8[][]
   /** When the carrier last moved a byte for the connection, in `monotonicNanos`. */
   lastActive: i64 = 0
+  /** When the head being read began to arrive, in `monotonicNanos`; meaningful while `headTimed`. */
+  headSince: i64 = 0
   outputStart: i32 = 0
   outputEnd: i32 = 0
   dataStart: i32 = 0
@@ -369,6 +527,8 @@ export class Http1Connection {
   pongPending: boolean = false
   /** The peer's byte stream has ended. */
   inputEnded: boolean = false
+  /** A head has begun to arrive and is not read whole yet: `headSince` is its deadline's start. */
+  headTimed: boolean = false
 
   /** A connection under `config`. A cap outside what the connection can work with panics. */
   constructor(config: Http1Config) {
@@ -384,6 +544,7 @@ export class Http1Connection {
     http1ServerCheckCap("outputSize", config.outputSize, output, big)
     http1ServerCheckCap("maxMessage", config.maxMessage, H1_ZERO, big - H1_FRAME_HEADER)
     http1ServerCheckCap("idleTimeout", config.idleTimeout, one, big)
+    http1ServerCheckCap("headTimeout", config.headTimeout, one, big)
     // The buffers the peer's bytes fill grow by doubling and stop at 2^30
     // (`Http1Parser`'s input and head, `WsDecoder`'s input), so a cap whose
     // buffer could need more is refused here rather than reached by a peer:
@@ -396,12 +557,15 @@ export class Http1Connection {
       big - H1_LINE_OVERHEAD
     )
     this.config = config
+    this.date = new HttpDate()
     this.parser = new Http1Parser(config.maxTarget, config.maxHeaderBytes, config.maxHeaders, config.maxBody)
     this.parser.keepText = false
     this.parser.maxChunk = config.chunkSize
     this.ws = new WsDecoder(true, config.maxMessage)
-    this.output = new Array<u8>(config.outputSize)
-    this.data = this.output
+    this.noOutput = []
+    this.output = this.noOutput
+    this.pool = null
+    this.data = this.noOutput
     this.pong = new Array<u8>(WS_MAX_CONTROL)
     this.noFields = []
     // A line must fit whole before the parser can read it, so the buffer
@@ -423,7 +587,7 @@ export class Http1Connection {
     this.ws.reset()
     this.outputStart = 0
     this.outputEnd = 0
-    this.data = this.output
+    this.data = this.noOutput
     this.dataStart = 0
     this.dataLength = 0
     this.opcode = 0
@@ -441,6 +605,9 @@ export class Http1Connection {
     this.writeHeld = false
     this.pongPending = false
     this.inputEnded = false
+    this.headTimed = false
+    this.headSince = 0
+    this.release()
   }
 
   // ---- Bytes in and out ---------------------------------------------------------
@@ -492,6 +659,44 @@ export class Http1Connection {
     this.outputEnd = 0
     this.pongPending = false
     this.writeHeld = false
+    this.release()
+  }
+
+  /**
+   * Borrows `output` from the pool between connections of one, for a
+   * connection that keeps its own makes it the first time: before anything
+   * is written into it, which is why `room` calls it. It allocates only when
+   * the pool has no free buffer, or for a connection's own, once.
+   */
+  acquire(): void {
+    if (toI32(this.output.length) > 0) {
+      return
+    }
+    const pool: Http1OutputPool | null = this.pool
+    this.output = pool !== null ? pool.take() : new Array<u8>(this.config.outputSize)
+    this.outputStart = 0
+    this.outputEnd = 0
+  }
+
+  /**
+   * Gives `output` back to the pool once nothing in it is waiting: no bytes
+   * to send, no write held back for room. The carrier calls it after each
+   * send; a connection that keeps its own buffer keeps it.
+   */
+  release(): void {
+    const pool: Http1OutputPool | null = this.pool
+    if (
+      pool === null ||
+      toI32(this.output.length) === 0 ||
+      this.outputEnd > this.outputStart ||
+      this.writeHeld
+    ) {
+      return
+    }
+    pool.give(this.output)
+    this.output = this.noOutput
+    this.outputStart = 0
+    this.outputEnd = 0
   }
 
   /** Marks the first `n` bytes of the output sent. */
@@ -518,6 +723,7 @@ export class Http1Connection {
 
   /** The room at the end of the output, once what was sent is moved out of the way. */
   room(): i32 {
+    this.acquire()
     const output: u8[] = this.output
     const live: i32 = this.outputEnd - this.outputStart
     if (this.outputStart > 0) {
@@ -550,7 +756,7 @@ export class Http1Connection {
     if (this.writeHeld) {
       // Half the output free before the program is asked to write again, so
       // that a slow reader is not answered one small write at a time.
-      if (this.bodyRoom() * 2 < toI32(this.output.length) - H1_CONTROL_RESERVE) {
+      if (this.bodyRoom() * 2 < this.config.outputSize - H1_CONTROL_RESERVE) {
         return H1_NEED_MORE
       }
       this.writeHeld = false
@@ -587,9 +793,16 @@ export class Http1Connection {
           this.state = H1_S_CLOSING
           return H1_NEED_MORE
         }
+        // A pipelined head that waited behind the exchange starts its clock
+        // now that it is the one being read. The carrier stamped `lastActive`
+        // when it last moved a byte, which is no earlier than these bytes came.
+        this.headArrived(this.lastActive)
       }
       const event: i32 = this.parser.next()
       if (event === HTTP1_HEAD) {
+        // The head is whole, so its deadline is met; the next head's starts
+        // when its first byte is fed (`headArrived`).
+        this.headTimed = false
         this.requestOpen = true
         this.response = H1_R_NONE
         this.closeAfter = !this.parser.keepAlive
@@ -642,7 +855,8 @@ export class Http1Connection {
         this.noFields,
         this.noFields,
         H1_ZERO,
-        "close"
+        "close",
+        this.date.current()
       )
       if (end >= 0) {
         this.outputEnd = end
@@ -794,14 +1008,15 @@ export class Http1Connection {
       names,
       values,
       framing,
-      connection
+      connection,
+      this.date.current()
     )
     if (end === HTTP1_REFUSED) {
       return H1_INVALID
     }
     if (end < 0 || end - this.outputEnd > room) {
       // The head was not written, or ate into the reserve: take it back.
-      if (end - this.outputEnd > toI32(this.output.length) - H1_CONTROL_RESERVE) {
+      if (end - this.outputEnd > this.config.outputSize - H1_CONTROL_RESERVE) {
         return H1_INVALID
       }
       if (this.outputEnd === 0) {
@@ -950,7 +1165,7 @@ export class Http1Connection {
     if (this.state !== H1_S_WEBSOCKET) {
       return H1_CLOSED
     }
-    if (opcode === WS_OP_CLOSE || len > toI32(this.output.length) - H1_CONTROL_RESERVE - 14) {
+    if (opcode === WS_OP_CLOSE || len > this.config.outputSize - H1_CONTROL_RESERVE - 14) {
       return H1_INVALID
     }
     if (websocketFrameSize(len, false) > this.bodyRoom()) {
@@ -992,6 +1207,44 @@ export class Http1Connection {
   idle(now: i64): boolean {
     return now - this.lastActive > toI64(this.config.idleTimeout) * toI64(1000000)
   }
+
+  /**
+   * Starts the head deadline at `now` (`monotonicNanos`) when bytes of a
+   * request head wait to be read and its clock has not started. The carriers
+   * call it after each `feed`; a program that feeds a connection itself calls
+   * it the same way. Bytes that wait while the previous exchange is still
+   * open start no clock: they count from when it is over (`nextRequest`).
+   */
+  headArrived(now: i64): void {
+    if (this.parser.buffered() > 0) {
+      this.headAwaited(now)
+    }
+  }
+
+  /**
+   * Starts the head deadline at `now` (`monotonicNanos`) when the connection
+   * waits for a head and its clock has not started, whether or not a byte of
+   * it has been read. `Http1TlsServer` calls it when ciphertext arrives after
+   * the handshake: a record trickled a byte at a time hands no plaintext to
+   * `headArrived` until it is whole, so its bytes would otherwise only keep
+   * the slot from going idle.
+   */
+  headAwaited(now: i64): void {
+    if (!this.headTimed && this.state === H1_S_HTTP && !this.requestOpen) {
+      this.headTimed = true
+      this.headSince = now
+    }
+  }
+
+  /** Whether a head has been arriving for longer than `headTimeout` at `now` (`monotonicNanos`). */
+  headLate(now: i64): boolean {
+    return this.headTimed && now - this.headSince > toI64(this.config.headTimeout) * toI64(1000000)
+  }
+
+  /** Whether `expire` closes the slot at `now`: idle, or a head past its deadline. */
+  expired(now: i64): boolean {
+    return this.idle(now) || this.headLate(now)
+  }
 }
 
 // ---- Carriers -------------------------------------------------------------------
@@ -1003,34 +1256,72 @@ export class Http1Connection {
  */
 export class Http1Server {
   config: Http1Config
+  /**
+   * The connections built so far, slot `k`'s at `k`: one per slot ever
+   * accepted into, and slot 0's once `connection` has asked for it.
+   */
   connections: Http1Connection[]
-  /** Each slot's descriptor, or -1 while it is free. */
+  /** The `Date` every slot's responses carry, formatted once a second for all of them. `date.pin` fixes its clock. */
+  date: HttpDate
+  /**
+   * Each slot's descriptor, or -1 while it is free, for the slots accepted
+   * into so far: its length is the high-water mark, and a slot past it has
+   * never been used.
+   */
   fds: i32[]
+  /** Each used slot's interest as the loop last armed it, for `rearm`. */
+  armed: i32[]
+  /** The output buffers the slots borrow while they write. */
+  outputs: Http1OutputPool
+  /**
+   * The slots closed since they were used, a stack whose top `accept` takes
+   * before it builds a slot past the high-water mark: finding one costs the
+   * same with every slot free as with all but one busy, where a scan of
+   * `fds` walked the busy ones.
+   */
+  free: i32[]
   /** Where the socket is read into before the connection takes the bytes. */
   scratch: u8[]
   /** The last accepted peer's address, in `nish:net`'s 18-byte form. */
   peer: u8[]
+  /** How many slots the pool may hold, which `size` answers. */
+  slots: i32 = 1
   /** The listening socket, which the program made with `tcpListen` and still owns. */
   listener: i32 = -1
 
-  /** A pool of `size` slots, at least one, serving `config` on `listener`. Every slot's buffers are allocated here. */
+  /**
+   * A pool of `size` slots, at least one, serving `config` on `listener`.
+   * No slot is built here: a slot's connection and its buffers are
+   * allocated by the first `accept` into it and kept, so a pool sized for a
+   * peak costs at start-up only the read scratch, the shared `Date` and the
+   * output pool, and at most `size` connections once the peak has come.
+   */
   constructor(config: Http1Config, listener: i32, size: i32) {
     this.config = config
     this.listener = listener
     this.connections = []
     this.fds = []
-    const slots: i32 = size < 1 ? 1 : size
-    for (let k: i32 = 0; k < slots; k++) {
-      this.connections.push(new Http1Connection(config))
-      this.fds.push(H1_FREE)
-    }
+    this.armed = []
+    this.free = []
+    this.slots = size < 1 ? 1 : size
+    this.outputs = new Http1OutputPool(config.outputSize)
+    this.date = new HttpDate()
     this.scratch = new Array<u8>(config.chunkSize)
     this.peer = new Array<u8>(H1_ADDRESS_SIZE)
   }
 
-  /** How many slots the pool has. */
+  /** A new connection on this pool's outputs and `Date`, for the next slot built. */
+  build(): Http1Connection {
+    const conn: Http1Connection = new Http1Connection(this.config)
+    conn.pool = this.outputs
+    conn.date = this.date
+    this.connections.push(conn)
+    return conn
+  }
+
+  /** How many slots the pool has, built or not. */
   size(): i32 {
-    return toI32(this.fds.length)
+    return this.slots
   }
 
   /** How many slots hold a connection. */
@@ -1054,36 +1345,57 @@ export class Http1Server {
     return this.holds(slot) ? this.fds[slot] : -1
   }
 
-  /** The connection of `slot`; a slot out of range names the first. */
+  /**
+   * The connection of `slot`. A slot never accepted into, or out of range,
+   * names slot 0's connection, which this builds when no slot has been yet
+   * (the first `accept` then takes it, restarted).
+   */
   connection(slot: i32): Http1Connection {
-    const at: i32 = slot >= 0 && slot < toI32(this.connections.length) ? slot : H1_ZERO
-    return this.connections[at]
+    if (slot >= 0 && slot < toI32(this.connections.length)) {
+      return this.connections[slot]
+    }
+    return this.connections.length > 0 ? this.connections[0] : this.build()
   }
 
   /**
    * Accepts the next waiting connection into a free slot and answers the
-   * slot; -11 when none is waiting, `H1_POOL_FULL` when every slot is busy
-   * (the connection is closed), or `tcpAccept`'s own failure.
+   * slot, which the program adds to its loop with `H1_WANT_READ`; -11 when
+   * none is waiting, `H1_POOL_FULL` when every slot is busy (the connection
+   * is closed), or `tcpAccept`'s own failure.
    */
   accept(): i32 {
     const fd: i32 = tcpAccept(this.listener, this.peer)
     if (fd < 0) {
       return fd
     }
-    for (let k: i32 = 0; k < toI32(this.fds.length) && k < toI32(this.connections.length); k++) {
-      if (this.fds[k] < 0) {
-        this.fds[k] = fd
-        const conn: Http1Connection = this.connections[k]
-        conn.restart()
-        conn.lastActive = monotonicNanos()
-        return k
-      }
-    }
-    netClose(fd)
-    return H1_POOL_FULL
+    // A slot closed before is taken first, then the next never used, so the
+    // first accepts take slots 0, 1, 2 ... and a pool that never fills never
+    // builds its last slots.
+    let k: i32 = H1_POOL_FULL
+    if (this.free.length > 0) {
+      k = this.free[this.free.length - 1]
+      this.free.pop()
+    } else if (toI32(this.fds.length) < this.slots) {
+      k = toI32(this.fds.length)
+      this.fds.push(H1_FREE)
+      this.armed.push(H1_WANT_READ)
+    }
+    if (k < 0 || k >= toI32(this.fds.length) || k >= toI32(this.armed.length)) {
+      netClose(fd)
+      return H1_POOL_FULL
+    }
+    const conn: Http1Connection = k < toI32(this.connections.length) ? this.connections[k] : this.build()
+    this.fds[k] = fd
+    this.armed[k] = H1_WANT_READ
+    conn.restart()
+    conn.lastActive = monotonicNanos()
+    return k
   }
 
-  /** The socket of `slot` is readable: reads it while the connection has room, then sends. Answers the interest. */
+  /**
+   * The socket of `slot` is readable: reads it while the connection has room
+   * and the socket has more, then sends. Answers the interest.
+   */
   readable(slot: i32): i32 {
     if (!this.holds(slot)) {
       return H1_DONE
@@ -1108,9 +1420,18 @@ export class Http1Server {
       }
       moved = true
       conn.feed(this.scratch, H1_ZERO, n)
+      // A short read emptied the socket. The loop's readiness is
+      // level-triggered, so more input, or the peer's close, wakes it again;
+      // reading once more here would only answer -11, at the price of a
+      // system call on every request.
+      if (n < want) {
+        break
+      }
     }
     if (moved) {
-      conn.lastActive = monotonicNanos()
+      const now: i64 = monotonicNanos()
+      conn.lastActive = now
+      conn.headArrived(now)
     }
     return this.flush(slot)
   }
@@ -1180,6 +1501,23 @@ export class Http1Server {
     if (conn.outputEnd - conn.outputStart < pending) {
       conn.lastActive = monotonicNanos()
     }
+    conn.release()
+  }
+
+  /**
+   * Whether the program must `pollModify` `slot`'s descriptor to `wants`, the
+   * interest `readable`, `writable` or `flush` answered, and records it as
+   * armed when it must. A keep-alive connection answers the same interest
+   * request after request, and each `pollModify` is a system call
+   * (`epoll_ctl`) that changes nothing.
+   */
+  rearm(slot: i32, wants: i32): boolean {
+    const interest: i32 = wants & (H1_WANT_READ | H1_WANT_WRITE)
+    if (!this.holds(slot) || slot >= toI32(this.armed.length) || this.armed[slot] === interest) {
+      return false
+    }
+    this.armed[slot] = interest
+    return true
   }
 
   /** Closes `slot`'s socket, whatever is left unsent, and frees the slot. */
@@ -1189,13 +1527,20 @@ export class Http1Server {
     }
     netClose(this.fds[slot])
     this.fds[slot] = H1_FREE
+    this.free.push(slot)
+    if (slot < toI32(this.connections.length)) {
+      this.connections[slot].abort()
+    }
   }
 
-  /** Closes every slot that has been idle past `idleTimeout` at `now` (`monotonicNanos`); answers how many. */
+  /**
+   * Closes every slot that has been idle past `idleTimeout`, or reading one
+   * head for longer than `headTimeout`, at `now` (`monotonicNanos`); answers how many.
+   */
   expire(now: i64): i32 {
     let n: i32 = 0
     for (let k: i32 = 0; k < toI32(this.fds.length) && k < toI32(this.connections.length); k++) {
-      if (this.fds[k] >= 0 && this.connections[k].idle(now)) {
+      if (this.fds[k] >= 0 && this.connections[k].expired(now)) {
         this.close(k)
         n = n + 1
       }
@@ -1209,25 +1554,69 @@ export class Http1Server {
  * `Http1Connection` beside each slot of a `TlsTcpServer`, run the way
  * `nish/net/http2-tls` runs HTTP/2. A handshake that chose ALPN `http/1.1`,
  * or none (a client that does not send ALPN speaks HTTP/1.1), reaches its
- * connection; any other protocol is shut down with `close_notify`.
+ * connection; any other protocol is shut down with `close_notify`. A slot's
+ * connection is built on the first accept into it and kept, as
+ * `Http1Server`'s is.
  */
 export class Http1TlsServer {
+  config: Http1Config
   tls: TlsTcpServer
+  /**
+   * The connections built so far, slot `k`'s at `k`: one per slot ever
+   * accepted into. `connection` never adds to it; a slot never built reads
+   * `vacant` instead.
+   */
   connections: Http1Connection[]
+  /**
+   * What `connection` answers for every slot never built: one connection no
+   * slot holds and every such slot shares, so the slot never reads as
+   * another slot's live request. Its first read allocates it, once per
+   * server, and a caller must not change it.
+   */
+  vacant: Http1Connection | null = null
+  /** The `Date` every slot's responses carry, as `Http1Server.date` is. */
+  date: HttpDate
   /** Where TLS decrypts into before the connection takes the bytes. */
   scratch: u8[]
+  /** The output buffers the slots borrow while they write. */
+  outputs: Http1OutputPool
 
-  /** A pool of `size` slots, at least one, serving `config` over TLS under `tlsConfig` on `listener`. */
+  /**
+   * A pool of `size` slots, at least one, serving `config` over TLS under
+   * `tlsConfig` on `listener`. No slot is built here: the first `accept` into
+   * a slot builds its connection and, in `tls`, its handshake state, and
+   * keeps them, so a pool sized for a peak costs at start-up only the read
+   * scratches, the shared `Date` and the empty pools.
+   */
   constructor(tlsConfig: TlsServerConfig, config: Http1Config, listener: i32, size: i32) {
+    this.config = config
     this.tls = new TlsTcpServer(tlsConfig, listener, size)
     this.connections = []
-    for (let k: i32 = 0; k < this.tls.size(); k++) {
-      this.connections.push(new Http1Connection(config))
-    }
+    this.outputs = new Http1OutputPool(config.outputSize)
+    this.date = new HttpDate()
     this.scratch = new Array<u8>(config.chunkSize)
   }
 
-  /** How many slots the pool has. */
+  /**
+   * A new connection on this pool's outputs and `Date`, for the next slot
+   * built. Called by `accept` alone, as `tls` builds slots: slot `k`'s
+   * connection must sit at index `k` of `connections`.
+   */
+  build(): Http1Connection {
+    const conn: Http1Connection = this.make()
+    this.connections.push(conn)
+    return conn
+  }
+
+  /** A connection on this pool's outputs and `Date` that no slot holds yet. */
+  make(): Http1Connection {
+    const conn: Http1Connection = new Http1Connection(this.config)
+    conn.pool = this.outputs
+    conn.date = this.date
+    return conn
+  }
+
+  /** How many slots the pool has, built or not. */
   size(): i32 {
     return this.tls.size()
   }
@@ -1247,10 +1636,32 @@ export class Http1TlsServer {
     return this.tls.fd(slot)
   }
 
-  /** The HTTP/1.1 connection of `slot`; a slot out of range names the first. */
+  /**
+   * Whether `slot` holds a connection and has its HTTP/1.1 connection built,
+   * as `Http2TlsServer.live` asks: a slot accepted on `tls` directly holds a
+   * TLS session and no `Http1Connection`, and reads as free here.
+   */
+  live(slot: i32): boolean {
+    return this.tls.holds(slot) && slot < toI32(this.connections.length)
+  }
+
+  /**
+   * The HTTP/1.1 connection of `slot`. A slot never accepted into answers
+   * `vacant`, as a free slot answers a connection that holds nothing, and
+   * builds no slot; a slot out of range names slot 0's.
+   */
   connection(slot: i32): Http1Connection {
-    const at: i32 = slot >= 0 && slot < toI32(this.connections.length) ? slot : H1_ZERO
-    return this.connections[at]
+    const index: i32 = slot >= 0 && slot < this.tls.size() ? slot : 0
+    if (index >= 0 && index < toI32(this.connections.length)) {
+      return this.connections[index]
+    }
+    const vacant: Http1Connection | null = this.vacant
+    if (vacant !== null) {
+      return vacant
+    }
+    const made: Http1Connection = this.make()
+    this.vacant = made
+    return made
   }
 
   /** The ALPN protocol `slot`'s handshake chose, or empty. */
@@ -1267,11 +1678,17 @@ export class Http1TlsServer {
   /**
    * Accepts the next waiting connection as `TlsTcpServer.accept` does, with
    * the caller's 32-byte server random and x25519 key, and gives it a fresh
-   * connection. Answers the slot, or what `TlsTcpServer.accept` answers.
+   * connection, building the slot's on its first accept. Answers the slot, or
+   * what `TlsTcpServer.accept` answers.
    */
   accept(serverRandom: u8[], ephemeralPrivate: u8[]): i32 {
     const slot: i32 = this.tls.accept(serverRandom, ephemeralPrivate)
-    if (slot >= 0 && slot < toI32(this.connections.length)) {
+    if (slot >= 0) {
+      // `tls` builds a slot past its high-water mark one at a time, so this
+      // builds at most the one connection, keeping slot `k`'s at `k`.
+      while (toI32(this.connections.length) <= slot) {
+        this.build()
+      }
       const conn: Http1Connection = this.connections[slot]
       conn.restart()
       conn.lastActive = monotonicNanos()
@@ -1281,10 +1698,19 @@ export class Http1TlsServer {
 
   /** The socket of `slot` is readable: TLS reads it, and what the connection has to send goes after. Answers the interest. */
   readable(slot: i32): i32 {
-    if (this.holds(slot)) {
-      this.connections[slot].lastActive = monotonicNanos()
+    const live: boolean = this.live(slot)
+    const now: i64 = monotonicNanos()
+    if (live) {
+      this.connections[slot].lastActive = now
     }
     this.tls.readable(slot)
+    // Ciphertext after the handshake is the start of a head, or of a record
+    // that will hold one, so the head's clock starts here; a record trickled
+    // a byte at a time would hand `next` no plaintext until it is whole. The
+    // handshake itself is bounded by `idleTimeout` alone (TLS-4).
+    if (live && this.tls.connection(slot).state === TLS_RECORD_STATE_OPEN) {
+      this.connections[slot].headAwaited(now)
+    }
     return this.flush(slot)
   }
 
@@ -1306,7 +1732,7 @@ export class Http1TlsServer {
    * slot, or one whose ALPN was another protocol, answers `H1_ERROR`.
    */
   next(slot: i32): i32 {
-    if (!this.holds(slot) || this.refused(slot)) {
+    if (!this.live(slot) || this.refused(slot)) {
       return H1_ERROR
     }
     const conn: Http1Connection = this.connections[slot]
@@ -1339,7 +1765,7 @@ export class Http1TlsServer {
    * connection still holds bytes.
    */
   flush(slot: i32): i32 {
-    if (!this.holds(slot)) {
+    if (!this.live(slot)) {
       return TLS_RECORD_DONE
     }
     if (this.refused(slot)) {
@@ -1354,8 +1780,14 @@ export class Http1TlsServer {
     return conn.wantsWrite() && (wants & TLS_RECORD_DONE) === 0 ? wants | TLS_RECORD_WANT_WRITE : wants
   }
 
-  /** Writes what `slot`'s connection holds into TLS, as far as TLS takes it. */
+  /**
+   * Writes what `slot`'s connection holds into TLS, as far as TLS takes it;
+   * a slot never built has nothing to write.
+   */
   send(slot: i32): void {
+    if (slot < 0 || slot >= toI32(this.connections.length)) {
+      return
+    }
     const conn: Http1Connection = this.connections[slot]
     const pending: i32 = conn.outputEnd - conn.outputStart
     while (conn.wantsWrite()) {
@@ -1368,18 +1800,25 @@ export class Http1TlsServer {
     if (conn.outputEnd - conn.outputStart < pending) {
       conn.lastActive = monotonicNanos()
     }
+    conn.release()
   }
 
   /** Ends `slot`'s connection and frees the slot at once, as `TlsTcpServer.close` does. */
   close(slot: i32): void {
     this.tls.close(slot)
+    if (slot >= 0 && slot < toI32(this.connections.length)) {
+      this.connections[slot].abort()
+    }
   }
 
-  /** Closes every slot that has been idle past `idleTimeout` at `now` (`monotonicNanos`); answers how many. */
+  /**
+   * Closes every slot that has been idle past `idleTimeout`, or reading one
+   * head for longer than `headTimeout`, at `now` (`monotonicNanos`); answers how many.
+   */
   expire(now: i64): i32 {
     let n: i32 = 0
     for (let k: i32 = 0; k < this.tls.size() && k < toI32(this.connections.length); k++) {
-      if (this.tls.holds(k) && this.connections[k].idle(now)) {
+      if (this.tls.holds(k) && this.connections[k].expired(now)) {
         this.tls.close(k)
         n = n + 1
       }