@amritk/nish-x86_64-linux 0.20.0 → 0.22.1

package/std/net/http1-server.ts

@@ -88,7 +88,8 @@
  *
  * **Caps are start-up numbers**, all in `Http1Config`: the request target,
  * the header section and its field count, a request body, the chunk handed
- * over, the output buffer, a WebSocket message and the idle timeout; the
+ * over, the output buffer, a WebSocket message, the idle timeout and the
+ * deadline for a whole request head (`headTimeout`, against slowloris); the
  * slots are the pool's size. `Http1Server` builds a slot's connection on the
  * first accept into it and keeps it, so a pool sized for its peak costs at
  * start-up only what does not depend on the size, and holds at most `size`
@@ -112,6 +113,7 @@
  * implementation.
  */
 import { Secret } from "nish:secret"
+import { copyBytes } from "nish/bytes"
 import { netClose, netRead, netWrite, tcpAccept } from "nish:net"
 import {
   HTTP1_BODY,
@@ -119,6 +121,8 @@ import {
   HTTP1_CLOSED,
   HTTP1_END,
   HTTP1_ERROR,
+  HTTP1_FIRST_HEAD,
+  HTTP1_FIRST_INPUT,
   HTTP1_HEAD,
   HTTP1_NO_BODY,
   HTTP1_REFUSED,
@@ -239,6 +243,11 @@ const http1ServerCheckWindow = (what: string, buf: u8[], off: i32, len: i32): vo
 
 /** Copies `src[off .. off + n)` to `out` at `at`, which the caller has made sure holds it, and answers where it ends. */
 const http1ServerCopy = (out: u8[], at: i32, src: u8[], off: i32, n: i32): i32 => {
+  if (n > 0 && at >= 0 && off >= 0 && at <= toI32(out.length) - n && off <= toI32(src.length) - n) {
+    // Both windows fit, as they do for every caller: one move, not a byte loop.
+    copyBytes(out, at, src, off, n)
+    return at + n
+  }
   for (let k: i32 = 0; k < n && at + k < toI32(out.length) && off + k < toI32(src.length); k++) {
     if (at + k >= 0 && off + k >= 0) {
       out[at + k] = src[off + k]
@@ -344,6 +353,22 @@ export class Http1Config {
   maxMessage: i32 = 1048576
   /** Milliseconds without a byte read or written after which `expire` closes a slot. */
   idleTimeout: i32 = 60000
+  /**
+   * Milliseconds a request head may take, from its first byte to its blank
+   * line, before `expire` closes the slot however steadily its bytes come. The
+   * idle timeout alone restarts on every byte, so a client that sends one byte
+   * of its head each `idleTimeout` would hold its slot for good (slowloris).
+   */
+  headTimeout: i32 = 30000
+  /**
+   * Lend a slot's input and head buffers back to the server between
+   * exchanges: once a response is sent and no byte of the next request has
+   * come, the slot gives both to pools the server's slots share, and takes
+   * them again with the next byte. The memory they hold then follows the
+   * connections mid-request rather than every keep-alive connection open,
+   * for two pool operations a request. Off by default.
+   */
+  idleInput: boolean = false
 }
 
 /** The reason phrase a status is sent with; RFC 9112 §4 lets a client ignore it. */
@@ -462,8 +487,12 @@ export class Http1Connection {
   date: HttpDate
   /** The request parser: its head (`methodIs`, `targetIs`, `header`, spans) is the last `H1_REQUEST`'s. */
   parser: Http1Parser
-  /** The frame decoder, once the slot has switched to WebSocket. */
-  ws: WsDecoder
+  /**
+   * The frame decoder: made when the slot first switches to WebSocket, so a
+   * slot that only ever speaks HTTP never holds its buffers, then kept for
+   * the slot's later peers.
+   */
+  ws: WsDecoder | null
   /**
    * Bytes to send are `output[outputStart .. outputEnd)`. Empty until the
    * connection first needs room to write: then its own buffer, made once, or
@@ -474,14 +503,19 @@ export class Http1Connection {
   noOutput: u8[]
   /** Where `output` is borrowed from, for a connection of a pool; null for one that keeps its own. */
   pool: Http1OutputPool | null
+  /** Where the parser's input and head buffers go while the slot rests, with `Http1Config.idleInput`; null otherwise. */
+  inputs: Http1OutputPool | null
+  heads: Http1OutputPool | null
   /** `H1_BODY`'s and `H1_WS_MESSAGE`'s bytes. */
   data: u8[]
-  /** A ping's payload, kept until its pong fits. */
+  /** A ping's payload, kept until its pong fits: empty until the first ping. */
   pong: u8[]
   /** No fields, for the responses the connection writes itself: made once. */
   noFields: u8[][]
   /** When the carrier last moved a byte for the connection, in `monotonicNanos`. */
   lastActive: i64 = 0
+  /** When the head being read began to arrive, in `monotonicNanos`; meaningful while `headTimed`. */
+  headSince: i64 = 0
   outputStart: i32 = 0
   outputEnd: i32 = 0
   dataStart: i32 = 0
@@ -517,6 +551,8 @@ export class Http1Connection {
   pongPending: boolean = false
   /** The peer's byte stream has ended. */
   inputEnded: boolean = false
+  /** A head has begun to arrive and is not read whole yet: `headSince` is its deadline's start. */
+  headTimed: boolean = false
 
   /** A connection under `config`. A cap outside what the connection can work with panics. */
   constructor(config: Http1Config) {
@@ -532,6 +568,7 @@ export class Http1Connection {
     http1ServerCheckCap("outputSize", config.outputSize, output, big)
     http1ServerCheckCap("maxMessage", config.maxMessage, H1_ZERO, big - H1_FRAME_HEADER)
     http1ServerCheckCap("idleTimeout", config.idleTimeout, one, big)
+    http1ServerCheckCap("headTimeout", config.headTimeout, one, big)
     // The buffers the peer's bytes fill grow by doubling and stop at 2^30
     // (`Http1Parser`'s input and head, `WsDecoder`'s input), so a cap whose
     // buffer could need more is refused here rather than reached by a peer:
@@ -548,12 +585,14 @@ export class Http1Connection {
     this.parser = new Http1Parser(config.maxTarget, config.maxHeaderBytes, config.maxHeaders, config.maxBody)
     this.parser.keepText = false
     this.parser.maxChunk = config.chunkSize
-    this.ws = new WsDecoder(true, config.maxMessage)
+    this.ws = null
     this.noOutput = []
     this.output = this.noOutput
     this.pool = null
+    this.inputs = null
+    this.heads = null
     this.data = this.noOutput
-    this.pong = new Array<u8>(WS_MAX_CONTROL)
+    this.pong = this.noOutput
     this.noFields = []
     // A line must fit whole before the parser can read it, so the buffer
     // holds the longest request line or field line however small a chunk is.
@@ -571,7 +610,10 @@ export class Http1Connection {
   /** Puts the connection back as the constructor left it, for the next peer. It allocates nothing. */
   restart(): void {
     this.parser.restart()
-    this.ws.reset()
+    const ws: WsDecoder | null = this.ws
+    if (ws !== null) {
+      ws.reset()
+    }
     this.outputStart = 0
     this.outputEnd = 0
     this.data = this.noOutput
@@ -592,7 +634,52 @@ export class Http1Connection {
     this.writeHeld = false
     this.pongPending = false
     this.inputEnded = false
+    this.headTimed = false
+    this.headSince = 0
     this.release()
+    this.park()
+  }
+
+  /**
+   * Gives the parser's input and head buffers to `inputs` and `heads` while
+   * the connection rests between exchanges: speaking HTTP, no request open,
+   * nothing fed and unread. Does nothing without the pools or otherwise.
+   */
+  park(): void {
+    const inputs: Http1OutputPool | null = this.inputs
+    const heads: Http1OutputPool | null = this.heads
+    const p: Http1Parser = this.parser
+    if (inputs === null || heads === null || this.state !== H1_S_HTTP || this.requestOpen || !p.resting()) {
+      return
+    }
+    if (toI32(p.buf.length) > 0) {
+      inputs.give(p.buf)
+      p.buf = this.noOutput
+      p.body = this.noOutput
+      p.start = 0
+      p.end = 0
+      p.scan = 0
+      p.lineStart = 0
+      p.lineEnd = 0
+    }
+    if (toI32(p.head.length) > 0) {
+      heads.give(p.head)
+      p.head = this.noOutput
+    }
+  }
+
+  /** Takes back the buffers `park` gave away, before bytes are fed. */
+  unpark(): void {
+    const inputs: Http1OutputPool | null = this.inputs
+    const heads: Http1OutputPool | null = this.heads
+    const p: Http1Parser = this.parser
+    if (inputs !== null && toI32(p.buf.length) === 0) {
+      p.buf = inputs.take()
+      p.body = p.buf
+    }
+    if (heads !== null && toI32(p.head.length) === 0) {
+      p.head = heads.take()
+    }
   }
 
   // ---- Bytes in and out ---------------------------------------------------------
@@ -607,7 +694,9 @@ export class Http1Connection {
     if (this.writeHeld || this.inputEnded || this.state === H1_S_CLOSING || this.state === H1_S_FAILED) {
       return 0
     }
-    const held: i32 = this.state === H1_S_WEBSOCKET ? this.ws.end - this.ws.start : this.parser.buffered()
+    const ws: WsDecoder | null = this.ws
+    const held: i32 =
+      this.state === H1_S_WEBSOCKET && ws !== null ? ws.end - ws.start : this.parser.buffered()
     const room: i32 = this.inputLimit() - held
     return room > 0 ? room : 0
   }
@@ -625,8 +714,9 @@ export class Http1Connection {
       return 0
     }
     if (this.state === H1_S_WEBSOCKET) {
-      this.ws.feed(buf, off, n)
+      this.decoder().feed(buf, off, n)
     } else {
+      this.unpark()
       this.parser.feed(buf, off, n)
     }
     return n
@@ -712,12 +802,8 @@ export class Http1Connection {
     const output: u8[] = this.output
     const live: i32 = this.outputEnd - this.outputStart
     if (this.outputStart > 0) {
-      for (
-        let k: i32 = 0;
-        k < live && k < toI32(output.length) && this.outputStart + k < toI32(output.length);
-        k++
-      ) {
-        output[k] = output[this.outputStart + k]
+      if (live > 0 && this.outputStart <= toI32(output.length) - live) {
+        copyBytes(output, 0, output, this.outputStart, live)
       }
       this.outputStart = 0
       this.outputEnd = live
@@ -769,8 +855,9 @@ export class Http1Connection {
         this.response = H1_R_NONE
         if (this.upgraded) {
           const p: Http1Parser = this.parser
-          this.ws.reset()
-          this.ws.feed(p.buf, p.start, p.buffered())
+          const ws: WsDecoder = this.decoder()
+          ws.reset()
+          ws.feed(p.buf, p.start, p.buffered())
           this.state = H1_S_WEBSOCKET
           return this.nextFrame()
         }
@@ -778,9 +865,16 @@ export class Http1Connection {
           this.state = H1_S_CLOSING
           return H1_NEED_MORE
         }
+        // A pipelined head that waited behind the exchange starts its clock
+        // now that it is the one being read. The carrier stamped `lastActive`
+        // when it last moved a byte, which is no earlier than these bytes came.
+        this.headArrived(this.lastActive)
       }
       const event: i32 = this.parser.next()
       if (event === HTTP1_HEAD) {
+        // The head is whole, so its deadline is met; the next head's starts
+        // when its first byte is fed (`headArrived`).
+        this.headTimed = false
         this.requestOpen = true
         this.response = H1_R_NONE
         this.closeAfter = !this.parser.keepAlive
@@ -845,35 +939,50 @@ export class Http1Connection {
     return H1_ERROR
   }
 
+  /** The frame decoder, made on the slot's first switch to WebSocket. */
+  decoder(): WsDecoder {
+    const ws: WsDecoder | null = this.ws
+    if (ws !== null) {
+      return ws
+    }
+    const made: WsDecoder = new WsDecoder(true, this.config.maxMessage)
+    this.ws = made
+    return made
+  }
+
   /** `next` once the slot has switched to WebSocket. */
   nextFrame(): i32 {
     while (true) {
       if (this.pongPending && !this.sendPong()) {
         return H1_NEED_MORE
       }
-      const event: i32 = this.ws.next()
+      const ws: WsDecoder = this.decoder()
+      const event: i32 = ws.next()
       if (event === WS_MESSAGE) {
-        this.opcode = this.ws.opcode
-        this.data = this.ws.data
+        this.opcode = ws.opcode
+        this.data = ws.data
         this.dataStart = 0
-        this.dataLength = this.ws.dataLen
+        this.dataLength = ws.dataLen
         return H1_WS_MESSAGE
       }
       if (event === WS_PING) {
-        const n: i32 = this.ws.dataLen
-        for (let k: i32 = 0; k < n && k < toI32(this.pong.length) && k < toI32(this.ws.data.length); k++) {
-          this.pong[k] = this.ws.data[k]
+        const n: i32 = ws.dataLen
+        if (this.pong.length === 0) {
+          this.pong = new Array<u8>(WS_MAX_CONTROL)
+        }
+        for (let k: i32 = 0; k < n && k < toI32(this.pong.length) && k < toI32(ws.data.length); k++) {
+          this.pong[k] = ws.data[k]
         }
         this.pongLength = n
         this.pongPending = true
       } else if (event === WS_CLOSE) {
-        this.status = this.ws.closeCode
-        this.sendClose(this.ws.closeCode)
+        this.status = ws.closeCode
+        this.sendClose(ws.closeCode)
         this.state = H1_S_CLOSING
         return H1_WS_CLOSE
       } else if (event === WS_ERROR) {
-        this.status = this.ws.closeCode
-        this.sendClose(this.ws.closeCode)
+        this.status = ws.closeCode
+        this.sendClose(ws.closeCode)
         this.state = H1_S_FAILED
         return H1_ERROR
       } else if (event === WS_NEED_MORE) {
@@ -913,7 +1022,7 @@ export class Http1Connection {
     const payload: u8[] | null = websocketClosePayload(code, "")
     // A code that may not be sent (1005, for a close that had none) is
     // answered with an empty close.
-    const body: u8[] = payload === null ? this.pong : payload
+    const body: u8[] = payload === null ? this.noOutput : payload
     const n: i32 = payload === null ? H1_ZERO : toI32(body.length)
     const end: i32 = websocketWriteFrame(
       this.output,
@@ -1185,6 +1294,68 @@ export class Http1Connection {
   idle(now: i64): boolean {
     return now - this.lastActive > toI64(this.config.idleTimeout) * toI64(1000000)
   }
+
+  /**
+   * Starts the head deadline at `now` (`monotonicNanos`) when bytes of a
+   * request head wait to be read and its clock has not started. The carriers
+   * call it after each `feed`; a program that feeds a connection itself calls
+   * it the same way. Bytes that wait while the previous exchange is still
+   * open start no clock: they count from when it is over (`nextRequest`).
+   */
+  headArrived(now: i64): void {
+    if (this.parser.buffered() > 0) {
+      this.headAwaited(now)
+    }
+  }
+
+  /**
+   * Starts the head deadline at `now` (`monotonicNanos`) when the connection
+   * waits for a head and its clock has not started, whether or not a byte of
+   * it has been read. `Http1TlsServer` calls it when ciphertext arrives after
+   * the handshake: a record trickled a byte at a time hands no plaintext to
+   * `headArrived` until it is whole, so its bytes would otherwise only keep
+   * the slot from going idle.
+   */
+  headAwaited(now: i64): void {
+    if (!this.headTimed && this.state === H1_S_HTTP && !this.requestOpen) {
+      this.headTimed = true
+      this.headSince = now
+    }
+  }
+
+  /** Whether a head has been arriving for longer than `headTimeout` at `now` (`monotonicNanos`). */
+  headLate(now: i64): boolean {
+    return this.headTimed && now - this.headSince > toI64(this.config.headTimeout) * toI64(1000000)
+  }
+
+  /** Whether `expire` closes the slot at `now`: idle, or a head past its deadline. */
+  expired(now: i64): boolean {
+    return this.idle(now) || this.headLate(now)
+  }
+
+  /**
+   * The soonest `expired` can turn true, however the connection moves from
+   * here: `lastActive` only grows, and a head clock not yet started starts
+   * no earlier than it.
+   */
+  expiresNoSooner(): i64 {
+    const idle: i64 = toI64(this.config.idleTimeout) * toI64(1000000)
+    const head: i64 = toI64(this.config.headTimeout) * toI64(1000000)
+    const soonest: i64 = this.lastActive + (head < idle ? head : idle)
+    if (this.headTimed && this.headSince + head < soonest) {
+      return this.headSince + head
+    }
+    return soonest
+  }
+}
+
+/**
+ * The soonest any slot accepted after now can expire: no sooner than the
+ * shorter of `idleTimeout` and `headTimeout` from now.
+ */
+const http1ExpireFloor = (config: Http1Config): i64 => {
+  const shorter: i32 = config.headTimeout < config.idleTimeout ? config.headTimeout : config.idleTimeout
+  return monotonicNanos() + toI64(shorter) * toI64(1000000)
 }
 
 // ---- Carriers -------------------------------------------------------------------
@@ -1213,6 +1384,9 @@ export class Http1Server {
   armed: i32[]
   /** The output buffers the slots borrow while they write. */
   outputs: Http1OutputPool
+  /** The input and head buffers resting slots lend, with `Http1Config.idleInput`. */
+  inputs: Http1OutputPool
+  heads: Http1OutputPool
   /**
    * The slots closed since they were used, a stack whose top `accept` takes
    * before it builds a slot past the high-water mark: finding one costs the
@@ -1228,6 +1402,14 @@ export class Http1Server {
   slots: i32 = 1
   /** The listening socket, which the program made with `tcpListen` and still owns. */
   listener: i32 = -1
+  /**
+   * No slot can expire before this (`monotonicNanos`), so `expire` called
+   * sooner walks none: it walks every slot only about once per the shorter
+   * timeout, however many there are.
+   */
+  expireAfter: i64 = 0
+  /** How many calls of `expire` walked every slot, for a program measuring its cost. */
+  expireScans: i32 = 0
 
   /**
    * A pool of `size` slots, at least one, serving `config` on `listener`.
@@ -1245,6 +1427,8 @@ export class Http1Server {
     this.free = []
     this.slots = size < 1 ? 1 : size
     this.outputs = new Http1OutputPool(config.outputSize)
+    this.inputs = new Http1OutputPool(HTTP1_FIRST_INPUT)
+    this.heads = new Http1OutputPool(HTTP1_FIRST_HEAD)
     this.date = new HttpDate()
     this.scratch = new Array<u8>(config.chunkSize)
     this.peer = new Array<u8>(H1_ADDRESS_SIZE)
@@ -1255,6 +1439,10 @@ export class Http1Server {
     const conn: Http1Connection = new Http1Connection(this.config)
     conn.pool = this.outputs
     conn.date = this.date
+    if (this.config.idleInput) {
+      conn.inputs = this.inputs
+      conn.heads = this.heads
+    }
     this.connections.push(conn)
     return conn
   }
@@ -1369,7 +1557,9 @@ export class Http1Server {
       }
     }
     if (moved) {
-      conn.lastActive = monotonicNanos()
+      const now: i64 = monotonicNanos()
+      conn.lastActive = now
+      conn.headArrived(now)
     }
     return this.flush(slot)
   }
@@ -1411,6 +1601,7 @@ export class Http1Server {
     if (conn.isDone()) {
       return H1_DONE
     }
+    conn.park()
     let wants: i32 = 0
     if (conn.inputRoom() > 0) {
       wants = wants | H1_WANT_READ
@@ -1471,15 +1662,29 @@ export class Http1Server {
     }
   }
 
-  /** Closes every slot that has been idle past `idleTimeout` at `now` (`monotonicNanos`); answers how many. */
+  /**
+   * Closes every slot that has been idle past `idleTimeout`, or reading one
+   * head for longer than `headTimeout`, at `now` (`monotonicNanos`); answers how many.
+   */
   expire(now: i64): i32 {
+    if (now < this.expireAfter) {
+      return 0
+    }
+    this.expireScans = this.expireScans + 1
+    let soonest: i64 = http1ExpireFloor(this.config)
     let n: i32 = 0
     for (let k: i32 = 0; k < toI32(this.fds.length) && k < toI32(this.connections.length); k++) {
-      if (this.fds[k] >= 0 && this.connections[k].idle(now)) {
-        this.close(k)
-        n = n + 1
+      if (this.fds[k] >= 0) {
+        const conn = this.connections[k]
+        if (conn.expired(now)) {
+          this.close(k)
+          n = n + 1
+        } else if (conn.expiresNoSooner() < soonest) {
+          soonest = conn.expiresNoSooner()
+        }
       }
     }
+    this.expireAfter = soonest
     return n
   }
 }
@@ -1515,6 +1720,13 @@ export class Http1TlsServer {
   scratch: u8[]
   /** The output buffers the slots borrow while they write. */
   outputs: Http1OutputPool
+  /** The input and head buffers resting slots lend, with `Http1Config.idleInput`. */
+  inputs: Http1OutputPool
+  heads: Http1OutputPool
+  /** No slot can expire before this (`monotonicNanos`): `Http1Server.expireAfter`. */
+  expireAfter: i64 = 0
+  /** How many calls of `expire` walked every slot. */
+  expireScans: i32 = 0
 
   /**
    * A pool of `size` slots, at least one, serving `config` over TLS under
@@ -1528,6 +1740,8 @@ export class Http1TlsServer {
     this.tls = new TlsTcpServer(tlsConfig, listener, size)
     this.connections = []
     this.outputs = new Http1OutputPool(config.outputSize)
+    this.inputs = new Http1OutputPool(HTTP1_FIRST_INPUT)
+    this.heads = new Http1OutputPool(HTTP1_FIRST_HEAD)
     this.date = new HttpDate()
     this.scratch = new Array<u8>(config.chunkSize)
   }
@@ -1548,6 +1762,10 @@ export class Http1TlsServer {
     const conn: Http1Connection = new Http1Connection(this.config)
     conn.pool = this.outputs
     conn.date = this.date
+    if (this.config.idleInput) {
+      conn.inputs = this.inputs
+      conn.heads = this.heads
+    }
     return conn
   }
 
@@ -1633,10 +1851,19 @@ export class Http1TlsServer {
 
   /** The socket of `slot` is readable: TLS reads it, and what the connection has to send goes after. Answers the interest. */
   readable(slot: i32): i32 {
-    if (this.live(slot)) {
-      this.connections[slot].lastActive = monotonicNanos()
+    const live: boolean = this.live(slot)
+    const now: i64 = monotonicNanos()
+    if (live) {
+      this.connections[slot].lastActive = now
     }
     this.tls.readable(slot)
+    // Ciphertext after the handshake is the start of a head, or of a record
+    // that will hold one, so the head's clock starts here; a record trickled
+    // a byte at a time would hand `next` no plaintext until it is whole. The
+    // handshake itself is bounded by `idleTimeout` alone (TLS-4).
+    if (live && this.tls.connection(slot).state === TLS_RECORD_STATE_OPEN) {
+      this.connections[slot].headAwaited(now)
+    }
     return this.flush(slot)
   }
 
@@ -1702,6 +1929,7 @@ export class Http1TlsServer {
     if (conn.isDone()) {
       return this.tls.shutdown(slot)
     }
+    conn.park()
     const wants: i32 = this.tls.interest(slot)
     return conn.wantsWrite() && (wants & TLS_RECORD_DONE) === 0 ? wants | TLS_RECORD_WANT_WRITE : wants
   }
@@ -1737,15 +1965,29 @@ export class Http1TlsServer {
     }
   }
 
-  /** Closes every slot that has been idle past `idleTimeout` at `now` (`monotonicNanos`); answers how many. */
+  /**
+   * Closes every slot that has been idle past `idleTimeout`, or reading one
+   * head for longer than `headTimeout`, at `now` (`monotonicNanos`); answers how many.
+   */
   expire(now: i64): i32 {
+    if (now < this.expireAfter) {
+      return 0
+    }
+    this.expireScans = this.expireScans + 1
+    let soonest: i64 = http1ExpireFloor(this.config)
     let n: i32 = 0
     for (let k: i32 = 0; k < this.tls.size() && k < toI32(this.connections.length); k++) {
-      if (this.tls.holds(k) && this.connections[k].idle(now)) {
-        this.tls.close(k)
-        n = n + 1
+      if (this.tls.holds(k)) {
+        const conn = this.connections[k]
+        if (conn.expired(now)) {
+          this.tls.close(k)
+          n = n + 1
+        } else if (conn.expiresNoSooner() < soonest) {
+          soonest = conn.expiresNoSooner()
+        }
       }
     }
+    this.expireAfter = soonest
     return n
   }
 }