@amritk/nish-x86_64-linux 0.20.0 → 0.21.0

package/std/net/http1-server.ts

@@ -88,7 +88,8 @@
  *
  * **Caps are start-up numbers**, all in `Http1Config`: the request target,
  * the header section and its field count, a request body, the chunk handed
- * over, the output buffer, a WebSocket message and the idle timeout; the
+ * over, the output buffer, a WebSocket message, the idle timeout and the
+ * deadline for a whole request head (`headTimeout`, against slowloris); the
  * slots are the pool's size. `Http1Server` builds a slot's connection on the
  * first accept into it and keeps it, so a pool sized for its peak costs at
  * start-up only what does not depend on the size, and holds at most `size`
@@ -344,6 +345,13 @@ export class Http1Config {
   maxMessage: i32 = 1048576
   /** Milliseconds without a byte read or written after which `expire` closes a slot. */
   idleTimeout: i32 = 60000
+  /**
+   * Milliseconds a request head may take, from its first byte to its blank
+   * line, before `expire` closes the slot however steadily its bytes come. The
+   * idle timeout alone restarts on every byte, so a client that sends one byte
+   * of its head each `idleTimeout` would hold its slot for good (slowloris).
+   */
+  headTimeout: i32 = 30000
 }
 
 /** The reason phrase a status is sent with; RFC 9112 §4 lets a client ignore it. */
@@ -482,6 +490,8 @@ export class Http1Connection {
   noFields: u8[][]
   /** When the carrier last moved a byte for the connection, in `monotonicNanos`. */
   lastActive: i64 = 0
+  /** When the head being read began to arrive, in `monotonicNanos`; meaningful while `headTimed`. */
+  headSince: i64 = 0
   outputStart: i32 = 0
   outputEnd: i32 = 0
   dataStart: i32 = 0
@@ -517,6 +527,8 @@ export class Http1Connection {
   pongPending: boolean = false
   /** The peer's byte stream has ended. */
   inputEnded: boolean = false
+  /** A head has begun to arrive and is not read whole yet: `headSince` is its deadline's start. */
+  headTimed: boolean = false
 
   /** A connection under `config`. A cap outside what the connection can work with panics. */
   constructor(config: Http1Config) {
@@ -532,6 +544,7 @@ export class Http1Connection {
     http1ServerCheckCap("outputSize", config.outputSize, output, big)
     http1ServerCheckCap("maxMessage", config.maxMessage, H1_ZERO, big - H1_FRAME_HEADER)
     http1ServerCheckCap("idleTimeout", config.idleTimeout, one, big)
+    http1ServerCheckCap("headTimeout", config.headTimeout, one, big)
     // The buffers the peer's bytes fill grow by doubling and stop at 2^30
     // (`Http1Parser`'s input and head, `WsDecoder`'s input), so a cap whose
     // buffer could need more is refused here rather than reached by a peer:
@@ -592,6 +605,8 @@ export class Http1Connection {
     this.writeHeld = false
     this.pongPending = false
     this.inputEnded = false
+    this.headTimed = false
+    this.headSince = 0
     this.release()
   }
 
@@ -778,9 +793,16 @@ export class Http1Connection {
           this.state = H1_S_CLOSING
           return H1_NEED_MORE
         }
+        // A pipelined head that waited behind the exchange starts its clock
+        // now that it is the one being read. The carrier stamped `lastActive`
+        // when it last moved a byte, which is no earlier than these bytes came.
+        this.headArrived(this.lastActive)
       }
       const event: i32 = this.parser.next()
       if (event === HTTP1_HEAD) {
+        // The head is whole, so its deadline is met; the next head's starts
+        // when its first byte is fed (`headArrived`).
+        this.headTimed = false
         this.requestOpen = true
         this.response = H1_R_NONE
         this.closeAfter = !this.parser.keepAlive
@@ -1185,6 +1207,44 @@ export class Http1Connection {
   idle(now: i64): boolean {
     return now - this.lastActive > toI64(this.config.idleTimeout) * toI64(1000000)
   }
+
+  /**
+   * Starts the head deadline at `now` (`monotonicNanos`) when bytes of a
+   * request head wait to be read and its clock has not started. The carriers
+   * call it after each `feed`; a program that feeds a connection itself calls
+   * it the same way. Bytes that wait while the previous exchange is still
+   * open start no clock: they count from when it is over (`nextRequest`).
+   */
+  headArrived(now: i64): void {
+    if (this.parser.buffered() > 0) {
+      this.headAwaited(now)
+    }
+  }
+
+  /**
+   * Starts the head deadline at `now` (`monotonicNanos`) when the connection
+   * waits for a head and its clock has not started, whether or not a byte of
+   * it has been read. `Http1TlsServer` calls it when ciphertext arrives after
+   * the handshake: a record trickled a byte at a time hands no plaintext to
+   * `headArrived` until it is whole, so its bytes would otherwise only keep
+   * the slot from going idle.
+   */
+  headAwaited(now: i64): void {
+    if (!this.headTimed && this.state === H1_S_HTTP && !this.requestOpen) {
+      this.headTimed = true
+      this.headSince = now
+    }
+  }
+
+  /** Whether a head has been arriving for longer than `headTimeout` at `now` (`monotonicNanos`). */
+  headLate(now: i64): boolean {
+    return this.headTimed && now - this.headSince > toI64(this.config.headTimeout) * toI64(1000000)
+  }
+
+  /** Whether `expire` closes the slot at `now`: idle, or a head past its deadline. */
+  expired(now: i64): boolean {
+    return this.idle(now) || this.headLate(now)
+  }
 }
 
 // ---- Carriers -------------------------------------------------------------------
@@ -1369,7 +1429,9 @@ export class Http1Server {
       }
     }
     if (moved) {
-      conn.lastActive = monotonicNanos()
+      const now: i64 = monotonicNanos()
+      conn.lastActive = now
+      conn.headArrived(now)
     }
     return this.flush(slot)
   }
@@ -1471,11 +1533,14 @@ export class Http1Server {
     }
   }
 
-  /** Closes every slot that has been idle past `idleTimeout` at `now` (`monotonicNanos`); answers how many. */
+  /**
+   * Closes every slot that has been idle past `idleTimeout`, or reading one
+   * head for longer than `headTimeout`, at `now` (`monotonicNanos`); answers how many.
+   */
   expire(now: i64): i32 {
     let n: i32 = 0
     for (let k: i32 = 0; k < toI32(this.fds.length) && k < toI32(this.connections.length); k++) {
-      if (this.fds[k] >= 0 && this.connections[k].idle(now)) {
+      if (this.fds[k] >= 0 && this.connections[k].expired(now)) {
         this.close(k)
         n = n + 1
       }
@@ -1633,10 +1698,19 @@ export class Http1TlsServer {
 
   /** The socket of `slot` is readable: TLS reads it, and what the connection has to send goes after. Answers the interest. */
   readable(slot: i32): i32 {
-    if (this.live(slot)) {
-      this.connections[slot].lastActive = monotonicNanos()
+    const live: boolean = this.live(slot)
+    const now: i64 = monotonicNanos()
+    if (live) {
+      this.connections[slot].lastActive = now
     }
     this.tls.readable(slot)
+    // Ciphertext after the handshake is the start of a head, or of a record
+    // that will hold one, so the head's clock starts here; a record trickled
+    // a byte at a time would hand `next` no plaintext until it is whole. The
+    // handshake itself is bounded by `idleTimeout` alone (TLS-4).
+    if (live && this.tls.connection(slot).state === TLS_RECORD_STATE_OPEN) {
+      this.connections[slot].headAwaited(now)
+    }
     return this.flush(slot)
   }
 
@@ -1737,11 +1811,14 @@ export class Http1TlsServer {
     }
   }
 
-  /** Closes every slot that has been idle past `idleTimeout` at `now` (`monotonicNanos`); answers how many. */
+  /**
+   * Closes every slot that has been idle past `idleTimeout`, or reading one
+   * head for longer than `headTimeout`, at `now` (`monotonicNanos`); answers how many.
+   */
   expire(now: i64): i32 {
     let n: i32 = 0
     for (let k: i32 = 0; k < this.tls.size() && k < toI32(this.connections.length); k++) {
-      if (this.tls.holds(k) && this.connections[k].idle(now)) {
+      if (this.tls.holds(k) && this.connections[k].expired(now)) {
         this.tls.close(k)
         n = n + 1
       }

package/std/net/http3-server.ts

@@ -41,6 +41,14 @@
  * **Sending.** `flush` writes each touched slot's datagrams with
  * `quicListenerTakeFlight`, a paced flight at a time in one `udpSendTo` with
  * GSO where the platform has it and one datagram at a time where it does not.
+ * Each flight goes with the ECN codepoint its connection marked it with
+ * (`QuicFlight.ecn`, RFC 9000 §13.4), so the peer's ACK_ECN counts are
+ * validated and a CE mark shrinks the window. Where the platform sends no
+ * ECN (Darwin, whose `udpSendTo` answers -95 to a marked send), the first
+ * marked send goes again unmarked and no slot marks after it. A -95 is also
+ * what a platform without segmentation offload answers, so a refused GSO
+ * send goes again one datagram at a time, still marked, and only a -95 to
+ * one of those turns marking off.
  * The pacer counts the microseconds `clock` gives it, so on a path whose
  * round trip is under a millisecond it neither waits for the next
  * millisecond to earn credit nor holds a slot back for a whole one; without
@@ -122,8 +130,8 @@ export const H3_SERVER_ANSWER_INTERVAL: i64 = 100
 /** The address form `nish:net` reads and writes. */
 const H3_SERVER_ADDRESS: i32 = 18
 
-/** What `udpSendTo` answers where the platform has no segmentation offload. */
-const H3_SERVER_NO_GSO: i32 = -95
+/** What `udpSendTo` answers where the platform has no segmentation offload, or sends no ECN. */
+const H3_SERVER_UNSUPPORTED: i32 = -95
 
 /** The largest datagram read: a GRO receive of up to 64 KB. */
 const H3_SERVER_RECEIVE_SIZE: i32 = 65536
@@ -484,6 +492,8 @@ export class Http3Server {
   refused: i32 = 0
   limited: i32 = 0
   sendErrors: i32 = 0
+  /** Whether the platform sends ECN marks: true until a marked send answers -95, and every slot's `ecnMarking` with it. */
+  ecn: boolean = true
   /**
    * The stream buffers every slot's connection borrows from, made by the
    * constructor for the stream table `quicConfig` gives every slot: `null`
@@ -578,6 +588,7 @@ export class Http3Server {
   build(): void {
     crypto.getRandomValues(this.entropy)
     const quic = new QuicConnection(this.quicConfig, this.entropy)
+    quic.ecnMarking = this.ecn
     this.quics.push(quic)
     const pools: QuicStreamPools | null = this.streamPools
     if (pools !== null && pools.data.size === quic.streams.bufferSize && quic.streams.slots.length > 0) {
@@ -751,7 +762,7 @@ export class Http3Server {
     if (this.listener.handleWindow(buf, at, len, address, now, answer) !== QUIC_LISTEN_ACCEPT) {
       const reply: i32 = toI32(answer.reply.length)
       if (reply > 0) {
-        this.send(answer.reply, H3_SERVER_ZERO, reply, address, H3_SERVER_ZERO)
+        this.send(answer.reply, H3_SERVER_ZERO, reply, address, H3_SERVER_ZERO, H3_SERVER_ZERO)
       }
       return
     }
@@ -904,21 +915,40 @@ export class Http3Server {
     }
   }
 
-  /** Sends `buf[at .. at + len)` to `to`, cut into `segment`-byte datagrams when it is above 0; answers whether it went. */
-  send(buf: u8[], at: i32, len: i32, to: u8[], segment: i32): boolean {
-    const sent: i32 = udpSendTo(this.fd, buf, at, len, to, segment, H3_SERVER_ZERO)
+  /**
+   * Sends `buf[at .. at + len)` to `to` with the ECN codepoint `ecn`, cut
+   * into `segment`-byte datagrams when it is above 0; answers whether it went.
+   */
+  send(buf: u8[], at: i32, len: i32, to: u8[], segment: i32, ecn: i32): boolean {
+    const sent: i32 = udpSendTo(this.fd, buf, at, len, to, segment, ecn)
     if (sent >= 0) {
       return true
     }
-    if (sent !== H3_SERVER_NO_GSO || segment <= 0) {
+    if (sent !== H3_SERVER_UNSUPPORTED || (segment <= 0 && ecn === 0)) {
       this.sendErrors = h3Count(this.sendErrors)
       return false
     }
-    // No segmentation offload here: one datagram at a time.
+    // -95: no segmentation offload, or no ECN, or both. One datagram at a
+    // time, still marked: a -95 to a datagram with no segment is the mark's.
+    let mark: i32 = ecn
+    if (segment <= 0) {
+      this.unmark()
+      mark = H3_SERVER_ZERO
+    }
+    const step: i32 = segment > 0 ? segment : len
     let p: i32 = at
     while (p < at + len) {
-      const n: i32 = at + len - p < segment ? at + len - p : segment
-      if (udpSendTo(this.fd, buf, p, n, to, H3_SERVER_ZERO, H3_SERVER_ZERO) < 0) {
+      const n: i32 = at + len - p < step ? at + len - p : step
+      let one: i32 = udpSendTo(this.fd, buf, p, n, to, H3_SERVER_ZERO, mark)
+      if (one === H3_SERVER_UNSUPPORTED && mark !== 0) {
+        // No ECN here: this datagram and the rest go unmarked and no slot
+        // marks again. The packets just counted as marked fail their
+        // connection's validation.
+        this.unmark()
+        mark = H3_SERVER_ZERO
+        one = udpSendTo(this.fd, buf, p, n, to, H3_SERVER_ZERO, mark)
+      }
+      if (one < 0) {
         this.sendErrors = h3Count(this.sendErrors)
         return false
       }
@@ -927,6 +957,14 @@ export class Http3Server {
     return true
   }
 
+  /** The platform sends no ECN: no slot's connection marks from now on. */
+  unmark(): void {
+    this.ecn = false
+    for (let slot: i32 = 0; slot < toI32(this.quics.length); slot++) {
+      this.quics[slot].ecnMarking = false
+    }
+  }
+
   /**
    * Sends what every touched slot has, as far as its pacer lets it, closes a
    * slot whose HTTP/3 side is done after GOAWAY, frees a slot whose
@@ -972,7 +1010,7 @@ export class Http3Server {
         break
       }
       const segment: i32 = this.flight.count > 1 ? this.flight.segment : H3_SERVER_ZERO
-      if (!this.send(this.tx, H3_SERVER_ZERO, n, to, segment)) {
+      if (!this.send(this.tx, H3_SERVER_ZERO, n, to, segment, this.flight.ecn)) {
         break
       }
       retried = false
@@ -981,7 +1019,7 @@ export class Http3Server {
       // The CONNECTION_CLOSE goes whatever the pacer says: nothing follows it.
       const n: i32 = quic.takeDatagramInto(this.tx, H3_SERVER_ZERO, now)
       if (n > 0) {
-        this.send(this.tx, H3_SERVER_ZERO, n, to, H3_SERVER_ZERO)
+        this.send(this.tx, H3_SERVER_ZERO, n, to, H3_SERVER_ZERO, quic.datagramEcn)
       }
       this.release(slot)
       return