castrum 0.7.0

package/rust/headers.rs

@@ -0,0 +1,234 @@
+// rust/headers.rs — HeaderRefs: zero-alloc packed header parser
+// Extracted from ingress.rs for composability
+// Uses u64 word-at-a-time comparison for header name matching
+
+use napi::{Error, Result};
+
+// ── Header presence flags ─────────────────────────────────────────
+const HAS_ORIGIN: u8 = 1 << 0;
+const HAS_COOKIE: u8 = 1 << 1;
+const HAS_XFF: u8 = 1 << 2;
+const HAS_X_REAL_IP: u8 = 1 << 3;
+const HAS_XFP: u8 = 1 << 4;
+const HAS_ACRM: u8 = 1 << 5;
+const HAS_ACRH: u8 = 1 << 6;
+
+/// Zero-alloc reference-based representation of interesting headers.
+#[derive(Clone, Copy)]
+pub struct HeaderRefs<'a> {
+    origin: Option<&'a [u8]>,
+    cookie: Option<&'a [u8]>,
+    xff: Option<&'a [u8]>,
+    x_real_ip: Option<&'a [u8]>,
+    x_forwarded_proto: Option<&'a [u8]>,
+    acrm: Option<&'a [u8]>,
+    acrh: Option<&'a [u8]>,
+    flags: u8,
+}
+
+/// Load a u64 from the first N bytes of a byte slice, zero-padded.
+#[inline(always)]
+fn load_u64_padded(bytes: &[u8]) -> u64 {
+    let mut buf = [0u8; 8];
+    let len = bytes.len().min(8);
+    buf[..len].copy_from_slice(&bytes[..len]);
+    u64::from_le_bytes(buf)
+}
+
+/// Compare two byte slices using u64 word comparison for case-insensitive matching.
+/// Both inputs should be lowercase already (or we compute lowercase u64).
+#[inline(always)]
+fn byte_slice_eq_ignore_case(a: &[u8], b: &[u8]) -> bool {
+    if a.len() != b.len() {
+        return false;
+    }
+    // For short names (up to 8 bytes) use single u64 comparison
+    if a.len() <= 8 {
+        let wa = load_u64_padded(a) | 0x2020_2020_2020_2020;
+        let wb = load_u64_padded(b) | 0x2020_2020_2020_2020;
+        return wa == wb;
+    }
+    // For longer names: compare first 8 bytes, then remaining
+    if a.len() <= 16 {
+        let wa = load_u64_padded(a) | 0x2020_2020_2020_2020;
+        let wb = load_u64_padded(b) | 0x2020_2020_2020_2020;
+        if wa != wb {
+            return false;
+        }
+        let wa2 = load_u64_padded(&a[8..]) | 0x2020_2020_2020_2020;
+        let wb2 = load_u64_padded(&b[8..]) | 0x2020_2020_2020_2020;
+        return wa2 == wb2;
+    }
+    // Fallback
+    a.eq_ignore_ascii_case(b)
+}
+
+impl<'a> HeaderRefs<'a> {
+    #[inline(always)]
+    pub fn empty() -> Self {
+        Self {
+            origin: None,
+            cookie: None,
+            xff: None,
+            x_real_ip: None,
+            x_forwarded_proto: None,
+            acrm: None,
+            acrh: None,
+            flags: 0,
+        }
+    }
+
+    /// Parse packed headers from the input buffer.
+    /// Format: [u16 count] repeated { [u16 name_len] [name] [u32 value_len] [value] }
+    #[inline]
+    pub fn parse(packed: &'a [u8], is_options: bool, max_headers: usize) -> Result<Self> {
+        let mut h = Self::empty();
+
+        if packed.len() < 2 {
+            return Ok(h);
+        }
+
+        let count = u16::from_le_bytes([packed[0], packed[1]]) as usize;
+        if count > max_headers {
+            return Err(Error::from_reason("too many headers"));
+        }
+
+        let mut pos = 2usize;
+
+        for _ in 0..count {
+            if pos + 2 > packed.len() {
+                return Err(Error::from_reason("malformed packed headers"));
+            }
+
+            let name_len = u16::from_le_bytes([packed[pos], packed[pos + 1]]) as usize;
+            pos += 2;
+
+            if pos + name_len > packed.len() {
+                return Err(Error::from_reason("malformed packed header name"));
+            }
+
+            let name = &packed[pos..pos + name_len];
+            pos += name_len;
+
+            if pos + 4 > packed.len() {
+                return Err(Error::from_reason("malformed packed header value length"));
+            }
+
+            let value_len = u32::from_le_bytes([
+                packed[pos],
+                packed[pos + 1],
+                packed[pos + 2],
+                packed[pos + 3],
+            ]) as usize;
+            pos += 4;
+
+            if pos + value_len > packed.len() {
+                return Err(Error::from_reason("malformed packed header value"));
+            }
+
+            let value = &packed[pos..pos + value_len];
+            pos += value_len;
+
+            if name.is_empty() {
+                continue;
+            }
+
+            let first = name[0] | 0x20;
+
+            // Fast path: dispatch based on first character + name length
+            if first == b'o' && name.len() == 6 {
+                if byte_slice_eq_ignore_case(name, b"origin") {
+                    h.flags |= HAS_ORIGIN;
+                    h.origin = Some(value);
+                }
+            } else if first == b'c' && name.len() == 6 {
+                if byte_slice_eq_ignore_case(name, b"cookie") {
+                    h.flags |= HAS_COOKIE;
+                    h.cookie = Some(value);
+                }
+            } else if first == b'x' {
+                let name_len = name.len();
+                if name_len == 15 && byte_slice_eq_ignore_case(name, b"x-forwarded-for") {
+                    h.flags |= HAS_XFF;
+                    h.xff = Some(value);
+                } else if name_len == 9 && byte_slice_eq_ignore_case(name, b"x-real-ip") {
+                    h.flags |= HAS_X_REAL_IP;
+                    h.x_real_ip = Some(value);
+                } else if name_len == 17 && byte_slice_eq_ignore_case(name, b"x-forwarded-proto") {
+                    h.flags |= HAS_XFP;
+                    h.x_forwarded_proto = Some(value);
+                }
+            } else if first == b'a' && is_options {
+                if name.len() == 29 && byte_slice_eq_ignore_case(name, b"access-control-request-method") {
+                    h.flags |= HAS_ACRM;
+                    h.acrm = Some(value);
+                } else if name.len() == 30 && byte_slice_eq_ignore_case(name, b"access-control-request-headers") {
+                    h.flags |= HAS_ACRH;
+                    h.acrh = Some(value);
+                }
+            }
+        }
+
+        Ok(h)
+    }
+
+    #[inline(always)]
+    pub fn origin(&self) -> Option<&[u8]> {
+        self.origin
+    }
+
+    #[inline(always)]
+    pub fn cookie(&self) -> Option<&[u8]> {
+        self.cookie
+    }
+
+    #[inline(always)]
+    pub fn xff(&self) -> Option<&[u8]> {
+        self.xff
+    }
+
+    #[inline(always)]
+    pub fn x_real_ip(&self) -> Option<&[u8]> {
+        self.x_real_ip
+    }
+
+    #[inline(always)]
+    pub fn x_forwarded_proto(&self) -> Option<&[u8]> {
+        self.x_forwarded_proto
+    }
+
+    #[inline(always)]
+    pub fn acrm(&self) -> Option<&[u8]> {
+        self.acrm
+    }
+
+    #[inline(always)]
+    pub fn acrh(&self) -> Option<&[u8]> {
+        self.acrh
+    }
+
+    #[inline(always)]
+    pub fn has_origin(&self) -> bool {
+        (self.flags & HAS_ORIGIN) != 0
+    }
+
+    #[inline(always)]
+    pub fn has_cookie(&self) -> bool {
+        (self.flags & HAS_COOKIE) != 0
+    }
+
+    #[inline(always)]
+    pub fn has_xfp(&self) -> bool {
+        (self.flags & HAS_XFP) != 0
+    }
+
+    #[inline(always)]
+    pub fn has_acrm(&self) -> bool {
+        (self.flags & HAS_ACRM) != 0
+    }
+
+    #[inline(always)]
+    pub fn has_acrh(&self) -> bool {
+        (self.flags & HAS_ACRH) != 0
+    }
+}

package/rust/hmac_sha256.rs

@@ -0,0 +1,113 @@
+use napi::bindgen_prelude::*;
+use napi_derive::napi;
+use aws_lc_rs::hmac;
+use crate::util::{hex_val, trim_ascii_whitespace};
+
+const HEX_LOWER: &[u8; 16] = b"0123456789abcdef";
+
+
+
+#[napi]
+pub fn hmac_sha256(key: Uint8Array, data: Buffer) -> Buffer {
+    let key = hmac::Key::new(hmac::HMAC_SHA256, key.as_ref());
+    let tag = hmac::sign(&key, data.as_ref());
+
+    let mut out = [0u8; 64];
+    hex_encode_32(tag.as_ref(), &mut out);
+
+    Buffer::from(out.to_vec())
+}
+
+#[napi]
+pub fn hmac_sha256_verify(key: Uint8Array, data: Buffer, sig: Buffer) -> bool {
+    let sig = trim_ascii_whitespace(sig.as_ref());
+
+    if sig.len() != 64 {
+        return false;
+    }
+
+    let mut sig_bytes = [0u8; 32];
+
+    let mut i = 0;
+    while i < 32 {
+        let hi = match hex_val(sig[2 * i]) {
+            Some(v) => v,
+            None => return false,
+        };
+
+        let lo = match hex_val(sig[2 * i + 1]) {
+            Some(v) => v,
+            None => return false,
+        };
+
+        sig_bytes[i] = (hi << 4) | lo;
+        i += 1;
+    }
+
+    let key = hmac::Key::new(hmac::HMAC_SHA256, key.as_ref());
+    hmac::verify(&key, data.as_ref(), &sig_bytes).is_ok()
+}
+
+#[napi]
+pub struct HmacSigner {
+    key: hmac::Key,
+}
+
+#[napi]
+impl HmacSigner {
+    #[napi(constructor)]
+    pub fn new(key: Uint8Array) -> Self {
+        Self {
+            key: hmac::Key::new(hmac::HMAC_SHA256, key.as_ref()),
+        }
+    }
+
+    #[napi]
+    pub fn sign(&self, data: Buffer) -> Buffer {
+        let tag = hmac::sign(&self.key, data.as_ref());
+
+        let mut out = [0u8; 64];
+        hex_encode_32(tag.as_ref(), &mut out);
+
+        Buffer::from(out.to_vec())
+    }
+
+    #[napi]
+    pub fn verify(&self, data: Buffer, sig: Buffer) -> bool {
+        let sig = trim_ascii_whitespace(sig.as_ref());
+
+        if sig.len() != 64 {
+            return false;
+        }
+
+        let mut sig_bytes = [0u8; 32];
+
+        let mut i = 0;
+
+        while i < 32 {
+            let hi = match hex_val(sig[2 * i]) {
+                Some(v) => v,
+                None => return false,
+            };
+
+            let lo = match hex_val(sig[2 * i + 1]) {
+                Some(v) => v,
+                None => return false,
+            };
+
+            sig_bytes[i] = (hi << 4) | lo;
+            i += 1;
+        }
+
+        hmac::verify(&self.key, data.as_ref(), &sig_bytes).is_ok()
+    }
+}
+
+fn hex_encode_32(bytes: &[u8], out: &mut [u8; 64]) {
+    debug_assert_eq!(bytes.len(), 32);
+
+    for (i, b) in bytes.iter().enumerate() {
+        out[2 * i] = HEX_LOWER[(b >> 4) as usize];
+        out[2 * i + 1] = HEX_LOWER[(b & 0x0f) as usize];
+    }
+}

package/rust/http_parser.rs

@@ -0,0 +1,132 @@
+// rust/http_parser.rs
+use crate::util::{write_bytes, write_u32_le, VecWriter};
+use napi::bindgen_prelude::*;
+use napi_derive::napi;
+
+pub fn http_parse_request_packed_into_slice(input: &[u8], out: &mut [u8]) -> Result<usize> {
+    let mut headers = [httparse::EMPTY_HEADER; 64];
+    let mut req = httparse::Request::new(&mut headers);
+
+    match req.parse(input) {
+        Ok(httparse::Status::Complete(_)) => {}
+        Ok(_) => return Err(Error::new(Status::InvalidArg, "incomplete HTTP request")),
+        Err(e) => return Err(Error::new(Status::InvalidArg, e.to_string())),
+    }
+
+    let method = req
+        .method
+        .ok_or_else(|| Error::new(Status::InvalidArg, "missing HTTP method"))?
+        .as_bytes();
+
+    let path = req
+        .path
+        .ok_or_else(|| Error::new(Status::InvalidArg, "missing HTTP path"))?
+        .as_bytes();
+
+    let version: &[u8] = match req.version {
+        Some(0) => b"HTTP/1.0",
+        Some(1) => b"HTTP/1.1",
+        _ => b"HTTP/1.1",
+    };
+
+    let mut pos = 0usize;
+
+    write_u32_le(out, &mut pos, method.len() as u32)?;
+    write_bytes(out, &mut pos, method)?;
+
+    write_u32_le(out, &mut pos, path.len() as u32)?;
+    write_bytes(out, &mut pos, path)?;
+
+    write_u32_le(out, &mut pos, version.len() as u32)?;
+    write_bytes(out, &mut pos, version)?;
+
+    write_u32_le(out, &mut pos, req.headers.len() as u32)?;
+
+    for header in req.headers.iter() {
+        let name = header.name.as_bytes();
+        let value = header.value;
+
+        write_u32_le(out, &mut pos, name.len() as u32)?;
+        crate::util::write_bytes_lowercase(out, &mut pos, name)?;
+
+        write_u32_le(out, &mut pos, value.len() as u32)?;
+        crate::util::write_bytes(out, &mut pos, value)?;
+    }
+
+    Ok(pos)
+}
+
+/// Allocating, zero-copy-input, non-zeroing-output parser.
+pub fn http_parse_request_packed_vec(input: &[u8]) -> Result<Vec<u8>> {
+    let mut headers = [httparse::EMPTY_HEADER; 64];
+    let mut req = httparse::Request::new(&mut headers);
+
+    match req.parse(input) {
+        Ok(httparse::Status::Complete(_)) => {}
+        Ok(_) => return Err(Error::new(Status::InvalidArg, "incomplete HTTP request")),
+        Err(e) => return Err(Error::new(Status::InvalidArg, e.to_string())),
+    }
+
+    let method = req
+        .method
+        .ok_or_else(|| Error::new(Status::InvalidArg, "missing HTTP method"))?
+        .as_bytes();
+
+    let path = req
+        .path
+        .ok_or_else(|| Error::new(Status::InvalidArg, "missing HTTP path"))?
+        .as_bytes();
+
+    let version: &[u8] = match req.version {
+        Some(0) => b"HTTP/1.0",
+        Some(1) => b"HTTP/1.1",
+        _ => b"HTTP/1.1",
+    };
+
+    // Max 64 headers.
+    // Metadata overhead:
+    //   4 bytes method len
+    //   4 bytes path len
+    //   4 bytes version len
+    //   4 bytes header count
+    //   8 bytes per header name/value length prefix
+    //
+    // 16 + 64 * 8 = 528
+    let mut w = VecWriter::with_capacity(input.len().saturating_add(528));
+
+    w.write_u32(method.len() as u32);
+    w.write_bytes(method);
+
+    w.write_u32(path.len() as u32);
+    w.write_bytes(path);
+
+    w.write_u32(version.len() as u32);
+    w.write_bytes(version);
+
+    w.write_u32(req.headers.len() as u32);
+
+    for header in req.headers.iter() {
+        let name = header.name.as_bytes();
+        let value = header.value;
+
+        w.write_u32(name.len() as u32);
+        w.write_bytes_ascii_lowercase(name);
+
+        w.write_u32(value.len() as u32);
+        w.write_bytes(value);
+    }
+
+    Ok(w.into_bytes())
+}
+
+#[napi]
+pub fn http_parse_request_packed(input: Uint8Array) -> Result<Buffer> {
+    Ok(Buffer::from(http_parse_request_packed_vec(
+        input.as_ref(),
+    )?))
+}
+
+#[napi]
+pub fn http_parse_request_packed_into(input: Uint8Array, mut output: Uint8Array) -> Result<u32> {
+    crate::util::run_packed_into(&input, &mut output, http_parse_request_packed_into_slice)
+}