fix: bound HTTP intake and response lifetimes

2026-09-30 09:23:12 +09:00
parent f5034c0e4b
commit 780150d7ae
6 changed files with 364 additions and 106 deletions
@@ -57,9 +57,11 @@ pub struct ResourceLimits {
    pub max_tree_nodes: u32,
    /// Maximum simultaneously pinned projected filesystem handles.
    pub max_open_handles: usize,
+    /// Maximum bytes accepted for one HTTP request head, including its terminator.
+    pub max_http_header_bytes: usize,
    /// Maximum requests executing concurrently.
    pub max_concurrent_requests: usize,
-    /// Deadline applied to request dispatch and cooperative filesystem work.
+    /// End-to-end deadline for HTTP intake, dispatch, and response transmission.
    pub request_timeout: Duration,
 }

@@ -73,6 +75,7 @@ impl Default for ResourceLimits {
            max_tree_depth: 32,
            max_tree_nodes: 1024,
            max_open_handles: 2048,
+            max_http_header_bytes: 16 * 1024,
            max_concurrent_requests: 32,
            request_timeout: Duration::from_secs(30),
        }
@@ -124,6 +127,7 @@ impl ServerConfig {
            || self.limits.max_file_write_bytes == 0
            || self.limits.max_tree_nodes == 0
            || self.limits.max_open_handles == 0
+            || self.limits.max_http_header_bytes == 0
            || self.limits.max_concurrent_requests == 0
            || self.limits.request_timeout.is_zero()
        {
@@ -1,5 +1,5 @@
-use std::io::Read;
-use std::net::SocketAddr;
+use std::io::{Read, Write};
+use std::net::{SocketAddr, TcpListener, TcpStream};
 use std::sync::Arc;
 use std::sync::atomic::{AtomicBool, Ordering};
 use std::thread;
@@ -62,6 +62,14 @@ impl WipFsServer {
    /// Listener integrations must enforce the same body limit while collecting bytes.
    #[must_use]
    pub fn handle_http(&self, request: Request<Vec<u8>>) -> Response<Vec<u8>> {
+        self.handle_http_with_deadline(request, Instant::now() + self.config.limits.request_timeout)
+    }
+
+    fn handle_http_with_deadline(
+        &self,
+        request: Request<Vec<u8>>,
+        deadline: Instant,
+    ) -> Response<Vec<u8>> {
        let Some(route) = self.route(request.uri().path()) else {
            return empty_response(StatusCode::NOT_FOUND);
        };
@@ -69,7 +77,7 @@ impl WipFsServer {
            return self.metadata_error(route, error);
        }
        let context = ExecutionContext::new()
-            .with_deadline(Instant::now() + self.config.limits.request_timeout)
+            .with_deadline(deadline)
            .with_resource_budget(u64::from(self.config.limits.max_tree_nodes));
        match route {
            Route::Fetch => self.fetch(request.body(), &context),
@@ -85,16 +93,18 @@ impl WipFsServer {
    /// The listener is cleartext by design. Configuration must explicitly state
    /// whether TLS is terminated by a reverse proxy or development HTTP is in use.
    pub fn bind(self) -> Result<BoundServer, ServerBuildError> {
-        let server = tiny_http::Server::http(self.config.listen)
+        let listener = TcpListener::bind(self.config.listen)
+            .map_err(|error| ServerBuildError::Listener(error.to_string()))?;
+        listener
+            .set_nonblocking(true)
+            .map_err(|error| ServerBuildError::Listener(error.to_string()))?;
+        let local_addr = listener
+            .local_addr()
            .map_err(|error| ServerBuildError::Listener(error.to_string()))?;
-        let local_addr = server
-            .server_addr()
-            .to_ip()
-            .ok_or_else(|| ServerBuildError::Listener("expected an IP listener".into()))?;
        Ok(BoundServer {
            local_addr,
            service: Arc::new(self),
-            listener: Arc::new(server),
+            listener: Arc::new(listener),
        })
    }

@@ -356,7 +366,7 @@ impl WipFsServer {
 pub struct BoundServer {
    local_addr: SocketAddr,
    service: Arc<WipFsServer>,
-    listener: Arc<tiny_http::Server>,
+    listener: Arc<TcpListener>,
 }

 impl BoundServer {
@@ -367,6 +377,11 @@ impl BoundServer {
    }

    /// Serves requests with a fixed worker count until `shutdown` becomes true.
+    ///
+    /// Workers accept connections directly, so at most
+    /// `max_concurrent_requests` sockets are active in userspace. Each connection
+    /// is closed after one request and shares one absolute deadline across HTTP
+    /// intake, dispatch, and response transmission.
    pub fn serve_until(&self, shutdown: Arc<AtomicBool>) -> Result<(), std::io::Error> {
        let mut workers = Vec::with_capacity(self.service.config.limits.max_concurrent_requests);
        for _ in 0..self.service.config.limits.max_concurrent_requests {
@@ -375,9 +390,12 @@ impl BoundServer {
            let shutdown = Arc::clone(&shutdown);
            workers.push(thread::spawn(move || {
                while !shutdown.load(Ordering::Acquire) {
-                    match listener.recv_timeout(Duration::from_millis(25)) {
-                        Ok(Some(request)) => serve_request(&service, request),
-                        Ok(None) => {}
+                    match listener.accept() {
+                        Ok((stream, _)) => serve_connection(&service, stream),
+                        Err(error) if error.kind() == std::io::ErrorKind::WouldBlock => {
+                            thread::sleep(Duration::from_millis(5));
+                        }
+                        Err(error) if error.kind() == std::io::ErrorKind::Interrupted => {}
                        Err(error) => return Err(error),
                    }
                }
@@ -398,60 +416,260 @@ impl BoundServer {
    }
 }

-fn serve_request(service: &WipFsServer, mut request: tiny_http::Request) {
-    let maximum = service.config.limits.wire.max_request_bytes();
-    let mut body = Vec::new();
-    let read_result = request
-        .as_reader()
-        .take(maximum.saturating_add(1) as u64)
-        .read_to_end(&mut body);
-    let route = service.route(request.url().split('?').next().unwrap_or_default());
-    let response = if read_result.is_err() {
-        empty_response(StatusCode::BAD_REQUEST)
-    } else if body.len() > maximum {
-        route.map_or_else(
-            || empty_response(StatusCode::PAYLOAD_TOO_LARGE),
-            |route| {
-                if route == Route::Batch {
-                    service.batch_top_error(
-                        &resource_error(),
-                        Some(ResourceLimitKind::RepresentationBytes),
-                    )
-                } else {
-                    service.protocol_error(
-                        interaction(route),
-                        &resource_error(),
-                        Some(ResourceLimitKind::RepresentationBytes),
-                    )
-                }
-            },
-        )
-    } else {
-        let mut builder = Request::builder()
-            .method(request.method().as_str())
-            .uri(request.url());
-        for header in request.headers() {
-            if let (Ok(name), Ok(value)) = (
-                http::header::HeaderName::from_bytes(header.field.as_str().as_bytes()),
-                http::HeaderValue::from_bytes(header.value.as_bytes()),
-            ) {
-                builder = builder.header(name, value);
-            }
+#[derive(Debug)]
+struct ParsedRequestHead {
+    method: http::Method,
+    target: String,
+    headers: Vec<(http::header::HeaderName, http::HeaderValue)>,
+    content_length: usize,
+}
+
+#[derive(Debug)]
+enum IntakeError {
+    Timeout,
+    HeaderTooLarge,
+    PayloadTooLarge { target: String },
+    BadRequest,
+    Socket,
+}
+
+fn serve_connection(service: &WipFsServer, mut stream: TcpStream) {
+    let _ = stream.set_nonblocking(false);
+    let started = Instant::now();
+    let deadline = started
+        .checked_add(service.config.limits.request_timeout)
+        .unwrap_or(started);
+    let response = match read_http_request(
+        &mut stream,
+        service.config.limits.max_http_header_bytes,
+        service.config.limits.wire.max_request_bytes(),
+        deadline,
+    ) {
+        Ok(request) => Some(service.handle_http_with_deadline(request, deadline)),
+        Err(IntakeError::HeaderTooLarge) => {
+            Some(empty_response(StatusCode::REQUEST_HEADER_FIELDS_TOO_LARGE))
        }
-        match builder.body(body) {
-            Ok(request) => service.handle_http(request),
-            Err(_) => empty_response(StatusCode::BAD_REQUEST),
+        Err(IntakeError::PayloadTooLarge { target }) => {
+            Some(payload_too_large_response(service, &target))
        }
+        Err(IntakeError::BadRequest) => Some(empty_response(StatusCode::BAD_REQUEST)),
+        Err(IntakeError::Timeout | IntakeError::Socket) => None,
    };
-    let status = tiny_http::StatusCode(response.status().as_u16());
-    let mut outgoing =
-        tiny_http::Response::from_data(response.body().clone()).with_status_code(status);
+    if let Some(response) = response {
+        let _ = write_http_response(&mut stream, &response, deadline);
+    }
+    let _ = stream.shutdown(std::net::Shutdown::Both);
+}
+
+fn read_http_request(
+    stream: &mut TcpStream,
+    maximum_header: usize,
+    maximum_body: usize,
+    deadline: Instant,
+) -> Result<Request<Vec<u8>>, IntakeError> {
+    let mut received = Vec::with_capacity(maximum_header.min(8 * 1024));
+    let header_end = loop {
+        if let Some(position) = received.windows(4).position(|window| window == b"\r\n\r\n") {
+            let end = position + 4;
+            if end > maximum_header {
+                return Err(IntakeError::HeaderTooLarge);
+            }
+            break end;
+        }
+        if received.len() >= maximum_header {
+            return Err(IntakeError::HeaderTooLarge);
+        }
+        let mut chunk = [0_u8; 4 * 1024];
+        let available = (maximum_header - received.len()).min(chunk.len());
+        let count = read_with_deadline(stream, &mut chunk[..available], deadline)?;
+        if count == 0 {
+            return Err(IntakeError::BadRequest);
+        }
+        received.extend_from_slice(&chunk[..count]);
+    };
+
+    let parsed = parse_request_head(&received[..header_end])?;
+    if parsed.content_length > maximum_body {
+        return Err(IntakeError::PayloadTooLarge {
+            target: parsed.target,
+        });
+    }
+    let mut body = Vec::with_capacity(parsed.content_length);
+    let buffered = &received[header_end..];
+    body.extend_from_slice(&buffered[..buffered.len().min(parsed.content_length)]);
+    while body.len() < parsed.content_length {
+        let mut chunk = [0_u8; 8 * 1024];
+        let wanted = (parsed.content_length - body.len()).min(chunk.len());
+        let count = read_with_deadline(stream, &mut chunk[..wanted], deadline)?;
+        if count == 0 {
+            return Err(IntakeError::BadRequest);
+        }
+        body.extend_from_slice(&chunk[..count]);
+    }
+
+    let mut builder = Request::builder().method(parsed.method).uri(parsed.target);
+    for (name, value) in parsed.headers {
+        builder = builder.header(name, value);
+    }
+    builder.body(body).map_err(|_| IntakeError::BadRequest)
+}
+
+fn parse_request_head(bytes: &[u8]) -> Result<ParsedRequestHead, IntakeError> {
+    let text = std::str::from_utf8(bytes).map_err(|_| IntakeError::BadRequest)?;
+    let mut lines = text
+        .strip_suffix("\r\n\r\n")
+        .ok_or(IntakeError::BadRequest)?
+        .split("\r\n");
+    let mut request_line = lines
+        .next()
+        .ok_or(IntakeError::BadRequest)?
+        .split_ascii_whitespace();
+    let method = request_line.next().ok_or(IntakeError::BadRequest)?;
+    let target = request_line.next().ok_or(IntakeError::BadRequest)?;
+    let version = request_line.next().ok_or(IntakeError::BadRequest)?;
+    if request_line.next().is_some()
+        || !matches!(version, "HTTP/1.0" | "HTTP/1.1")
+        || !target.starts_with('/')
+    {
+        return Err(IntakeError::BadRequest);
+    }
+    let method =
+        http::Method::from_bytes(method.as_bytes()).map_err(|_| IntakeError::BadRequest)?;
+    let _: http::Uri = target.parse().map_err(|_| IntakeError::BadRequest)?;
+
+    let mut headers = Vec::new();
+    let mut content_length = None;
+    for line in lines {
+        if line.is_empty() || line.starts_with([' ', '\t']) {
+            return Err(IntakeError::BadRequest);
+        }
+        let (name, value) = line.split_once(':').ok_or(IntakeError::BadRequest)?;
+        let name = http::header::HeaderName::from_bytes(name.as_bytes())
+            .map_err(|_| IntakeError::BadRequest)?;
+        let value =
+            http::HeaderValue::from_str(value.trim()).map_err(|_| IntakeError::BadRequest)?;
+        if name == http::header::CONTENT_LENGTH {
+            if content_length.is_some() {
+                return Err(IntakeError::BadRequest);
+            }
+            content_length = Some(
+                value
+                    .to_str()
+                    .ok()
+                    .and_then(|value| value.parse::<usize>().ok())
+                    .ok_or(IntakeError::BadRequest)?,
+            );
+        }
+        if name == http::header::TRANSFER_ENCODING {
+            return Err(IntakeError::BadRequest);
+        }
+        headers.push((name, value));
+    }
+
+    Ok(ParsedRequestHead {
+        method,
+        target: target.to_owned(),
+        headers,
+        content_length: content_length.unwrap_or(0),
+    })
+}
+
+fn read_with_deadline(
+    stream: &mut TcpStream,
+    buffer: &mut [u8],
+    deadline: Instant,
+) -> Result<usize, IntakeError> {
+    let remaining = deadline
+        .checked_duration_since(Instant::now())
+        .ok_or(IntakeError::Timeout)?;
+    stream
+        .set_read_timeout(Some(remaining.max(Duration::from_millis(1))))
+        .map_err(|_| IntakeError::Socket)?;
+    stream.read(buffer).map_err(|error| match error.kind() {
+        std::io::ErrorKind::TimedOut | std::io::ErrorKind::WouldBlock => IntakeError::Timeout,
+        _ => IntakeError::Socket,
+    })
+}
+
+fn payload_too_large_response(service: &WipFsServer, target: &str) -> Response<Vec<u8>> {
+    let route = service.route(target.split('?').next().unwrap_or_default());
+    route.map_or_else(
+        || empty_response(StatusCode::PAYLOAD_TOO_LARGE),
+        |route| {
+            if route == Route::Batch {
+                service.batch_top_error(
+                    &resource_error(),
+                    Some(ResourceLimitKind::RepresentationBytes),
+                )
+            } else {
+                service.protocol_error(
+                    interaction(route),
+                    &resource_error(),
+                    Some(ResourceLimitKind::RepresentationBytes),
+                )
+            }
+        },
+    )
+}
+
+fn write_http_response(
+    stream: &mut TcpStream,
+    response: &Response<Vec<u8>>,
+    deadline: Instant,
+) -> Result<(), std::io::Error> {
+    let mut encoded = Vec::new();
+    write!(
+        encoded,
+        "HTTP/1.1 {} {}\r\n",
+        response.status().as_u16(),
+        response.status().canonical_reason().unwrap_or("")
+    )?;
    for (name, value) in response.headers() {
-        if let Ok(header) = tiny_http::Header::from_bytes(name.as_str(), value.as_bytes()) {
-            outgoing.add_header(header);
+        if name == http::header::CONTENT_LENGTH
+            || name == http::header::CONNECTION
+            || name == http::header::TRANSFER_ENCODING
+        {
+            continue;
+        }
+        encoded.extend_from_slice(name.as_str().as_bytes());
+        encoded.extend_from_slice(b": ");
+        encoded.extend_from_slice(value.as_bytes());
+        encoded.extend_from_slice(b"\r\n");
+    }
+    write!(
+        encoded,
+        "Content-Length: {}\r\nConnection: close\r\n\r\n",
+        response.body().len()
+    )?;
+    encoded.extend_from_slice(response.body());
+    write_all_with_deadline(stream, &encoded, deadline)
+}
+
+fn write_all_with_deadline(
+    stream: &mut TcpStream,
+    mut bytes: &[u8],
+    deadline: Instant,
+) -> Result<(), std::io::Error> {
+    while !bytes.is_empty() {
+        let remaining = deadline
+            .checked_duration_since(Instant::now())
+            .ok_or_else(|| {
+                std::io::Error::new(std::io::ErrorKind::TimedOut, "request timed out")
+            })?;
+        stream.set_write_timeout(Some(remaining.max(Duration::from_millis(1))))?;
+        match stream.write(bytes) {
+            Ok(0) => {
+                return Err(std::io::Error::new(
+                    std::io::ErrorKind::WriteZero,
+                    "socket closed",
+                ));
+            }
+            Ok(count) => bytes = &bytes[count..],
+            Err(error) if error.kind() == std::io::ErrorKind::Interrupted => {}
+            Err(error) => return Err(error),
        }
    }
-    let _ = request.respond(outgoing);
+    stream.flush()
 }

 fn interaction(route: Route) -> ProtocolInteraction {