use top level method signature for iterators

README.md

@@ -16,7 +16,6 @@ Userspace networking primitives.
     - Zero scheduling required. No goroutines/channels use in Lneto. Can be run in event loop.
 - Heapless packet processing
     - [`httpraw`](https://github.com/soypat/lneto/tree/main/http/httpraw) is likely the most performant HTTP/1.1 processing package in the Go ecosystem. Based on [`fasthttp`](https://github.com/valyala/fasthttp) but simpler and more thoughtful memory use.
-    - [`httφ`](https://github.com/soypat/lneto/tree/main/http/httphi) - Heapless HTTP router and zero-copy response writing with Go's standard library API.
 - Lean memory footprint
     - HTTP header struct is 80 bytes with no runtime usage nor heap usage other than buffer
     - Entire Ethernet+IPv4+UDP+DHCP+DNS+NTP stack in ~2kB RAM.

arp/stringers.go

@@ -17,9 +17,9 @@ const _Operation_name = "requestreply"
 var _Operation_index = [...]uint8{0, 7, 12}
 
 func (i Operation) String() string {
-	idx := int(i) - 1
-	if i < 1 || idx >= len(_Operation_index)-1 {
-		return "Operation(" + strconv.FormatInt(int64(i), 10) + ")"
+	i -= 1
+	if i >= Operation(len(_Operation_index)-1) {
+		return "Operation(" + strconv.FormatInt(int64(i+1), 10) + ")"
 	}
-	return _Operation_name[_Operation_index[idx]:_Operation_index[idx+1]]
+	return _Operation_name[_Operation_index[i]:_Operation_index[i+1]]
 }

dhcp/dhcpv4/frame.go

@@ -44,9 +44,6 @@ type Frame struct {
 	buf []byte
 }
 
-// RawData returns the underlying frame buffer.
-func (frm Frame) RawData() []byte { return frm.buf }
-
 // OptionsPayload returns the options portion of the DHCP frame. May be zero lengthed.
 func (frm Frame) OptionsPayload() []byte {
 	return frm.buf[OptionsOffset:]

dhcp/dhcpv4/stringers.go

@@ -106,11 +106,10 @@ const _Op_name = "undefinedrequestreply"
 var _Op_index = [...]uint8{0, 9, 16, 21}
 
 func (i Op) String() string {
-	idx := int(i) - 0
-	if i < 0 || idx >= len(_Op_index)-1 {
+	if i >= Op(len(_Op_index)-1) {
 		return "Op(" + strconv.FormatInt(int64(i), 10) + ")"
 	}
-	return _Op_name[_Op_index[idx]:_Op_index[idx+1]]
+	return _Op_name[_Op_index[i]:_Op_index[i+1]]
 }
 func _() {
 	// An "invalid array index" compiler error signifies that the constant values have changed.
@@ -132,11 +131,10 @@ const _MessageType_name = "undefineddiscoverofferrequestdeclineacknakreleaseinfo
 var _MessageType_index = [...]uint8{0, 9, 17, 22, 29, 36, 39, 42, 49, 55}
 
 func (i MessageType) String() string {
-	idx := int(i) - 0
-	if i < 0 || idx >= len(_MessageType_index)-1 {
+	if i >= MessageType(len(_MessageType_index)-1) {
 		return "MessageType(" + strconv.FormatInt(int64(i), 10) + ")"
 	}
-	return _MessageType_name[_MessageType_index[idx]:_MessageType_index[idx+1]]
+	return _MessageType_name[_MessageType_index[i]:_MessageType_index[i+1]]
 }
 func _() {
 	// An "invalid array index" compiler error signifies that the constant values have changed.
@@ -157,9 +155,9 @@ const _ClientState_name = "initselectingrequestingboundrenewingrebindinginit-reb
 var _ClientState_index = [...]uint8{0, 4, 13, 23, 28, 36, 45, 56, 65}
 
 func (i ClientState) String() string {
-	idx := int(i) - 1
-	if i < 1 || idx >= len(_ClientState_index)-1 {
-		return "ClientState(" + strconv.FormatInt(int64(i), 10) + ")"
+	i -= 1
+	if i >= ClientState(len(_ClientState_index)-1) {
+		return "ClientState(" + strconv.FormatInt(int64(i+1), 10) + ")"
 	}
-	return _ClientState_name[_ClientState_index[idx]:_ClientState_index[idx+1]]
+	return _ClientState_name[_ClientState_index[i]:_ClientState_index[i+1]]
 }

dhcp/dhcpv6/stringers.go

@@ -28,11 +28,11 @@ const _MsgType_name = "solicitadvertiserequestconfirmrenewrebindreplyreleasedecl
 var _MsgType_index = [...]uint8{0, 7, 16, 23, 30, 35, 41, 46, 53, 60, 71, 85, 95, 105}
 
 func (i MsgType) String() string {
-	idx := int(i) - 1
-	if i < 1 || idx >= len(_MsgType_index)-1 {
-		return "MsgType(" + strconv.FormatInt(int64(i), 10) + ")"
+	i -= 1
+	if i >= MsgType(len(_MsgType_index)-1) {
+		return "MsgType(" + strconv.FormatInt(int64(i+1), 10) + ")"
 	}
-	return _MsgType_name[_MsgType_index[idx]:_MsgType_index[idx+1]]
+	return _MsgType_name[_MsgType_index[i]:_MsgType_index[i+1]]
 }
 func _() {
 	// An "invalid array index" compiler error signifies that the constant values have changed.
@@ -51,11 +51,11 @@ const _ClientState_name = "initsolicitingrequestingboundrenewingrebinding"
 var _ClientState_index = [...]uint8{0, 4, 14, 24, 29, 37, 46}
 
 func (i ClientState) String() string {
-	idx := int(i) - 1
-	if i < 1 || idx >= len(_ClientState_index)-1 {
-		return "ClientState(" + strconv.FormatInt(int64(i), 10) + ")"
+	i -= 1
+	if i >= ClientState(len(_ClientState_index)-1) {
+		return "ClientState(" + strconv.FormatInt(int64(i+1), 10) + ")"
 	}
-	return _ClientState_name[_ClientState_index[idx]:_ClientState_index[idx+1]]
+	return _ClientState_name[_ClientState_index[i]:_ClientState_index[i+1]]
 }
 func _() {
 	// An "invalid array index" compiler error signifies that the constant values have changed.
@@ -134,11 +134,10 @@ const _StatusCode_name = "successunspec-failno-addrs-availno-bindingnot-on-linku
 var _StatusCode_index = [...]uint8{0, 7, 18, 32, 42, 53, 66}
 
 func (i StatusCode) String() string {
-	idx := int(i) - 0
-	if i < 0 || idx >= len(_StatusCode_index)-1 {
+	if i >= StatusCode(len(_StatusCode_index)-1) {
 		return "StatusCode(" + strconv.FormatInt(int64(i), 10) + ")"
 	}
-	return _StatusCode_name[_StatusCode_index[idx]:_StatusCode_index[idx+1]]
+	return _StatusCode_name[_StatusCode_index[i]:_StatusCode_index[i+1]]
 }
 func _() {
 	// An "invalid array index" compiler error signifies that the constant values have changed.
@@ -154,9 +153,9 @@ const _DUIDType_name = "duid-lltduid-enduid-ll"
 var _DUIDType_index = [...]uint8{0, 8, 15, 22}
 
 func (i DUIDType) String() string {
-	idx := int(i) - 1
-	if i < 1 || idx >= len(_DUIDType_index)-1 {
-		return "DUIDType(" + strconv.FormatInt(int64(i), 10) + ")"
+	i -= 1
+	if i >= DUIDType(len(_DUIDType_index)-1) {
+		return "DUIDType(" + strconv.FormatInt(int64(i+1), 10) + ")"
 	}
-	return _DUIDType_name[_DUIDType_index[idx]:_DUIDType_index[idx+1]]
+	return _DUIDType_name[_DUIDType_index[i]:_DUIDType_index[i+1]]
 }

dns/stringers.go

@@ -119,11 +119,10 @@ const _RCode_name = "successformat errorserver failurename errornot implementedr
 var _RCode_index = [...]uint8{0, 7, 19, 33, 43, 58, 65}
 
 func (i RCode) String() string {
-	idx := int(i) - 0
-	if i < 0 || idx >= len(_RCode_index)-1 {
+	if i >= RCode(len(_RCode_index)-1) {
 		return "RCode(" + strconv.FormatInt(int64(i), 10) + ")"
 	}
-	return _RCode_name[_RCode_index[idx]:_RCode_index[idx+1]]
+	return _RCode_name[_RCode_index[i]:_RCode_index[i+1]]
 }
 func _() {
 	// An "invalid array index" compiler error signifies that the constant values have changed.
@@ -139,9 +138,8 @@ const _OpCode_name = "Standard queryInverse queryServer status request"
 var _OpCode_index = [...]uint8{0, 14, 27, 48}
 
 func (i OpCode) String() string {
-	idx := int(i) - 0
-	if i < 0 || idx >= len(_OpCode_index)-1 {
+	if i >= OpCode(len(_OpCode_index)-1) {
 		return "OpCode(" + strconv.FormatInt(int64(i), 10) + ")"
 	}
-	return _OpCode_name[_OpCode_index[idx]:_OpCode_index[idx+1]]
+	return _OpCode_name[_OpCode_index[i]:_OpCode_index[i+1]]
 }

ethernet/definitions.go

@@ -25,15 +25,6 @@ const (
 	MinimumMTU = MinimumFrameLength - sizeHeaderNoVLAN
 )
 
-// String returns the colon-separated hexadecimal text representation of a hardware address.
-func String(hwAddr [6]byte) string {
-	// See net/netip's (Addr).string4 pattern.
-	var buf [maxAddrStringLen]byte
-	return string(AppendAddr(buf[:0], hwAddr))
-}
-
-const maxAddrStringLen = len("ff:ff:ff:ff:ff:ff")
-
 // AppendAddr appends the text representation of the hardware address to the destination buffer.
 func AppendAddr(dst []byte, hwAddr [6]byte) []byte {
 	for i, b := range hwAddr {

ethernet/definitions_test.go

@@ -1,42 +0,0 @@
-package ethernet
-
-import (
-	"net"
-	"testing"
-)
-
-func TestString(t *testing.T) {
-	for _, tc := range []struct {
-		addr [6]byte
-		want string
-	}{
-		{addr: [6]byte{}, want: "00:00:00:00:00:00"},
-		{addr: [6]byte{0xff, 0xff, 0xff, 0xff, 0xff, 0xff}, want: "ff:ff:ff:ff:ff:ff"},
-		{addr: [6]byte{0xde, 0xad, 0xbe, 0xef, 0x00, 0x01}, want: "de:ad:be:ef:00:01"},
-		{addr: [6]byte{0x01, 0x00, 0x5e, 0x7f, 0x00, 0x0f}, want: "01:00:5e:7f:00:0f"},
-	} {
-		got := String(tc.addr)
-		if got != tc.want {
-			t.Errorf("String(%v): got %q, want %q", tc.addr, got, tc.want)
-		}
-		if want := net.HardwareAddr(tc.addr[:]).String(); got != want {
-			t.Errorf("String(%v) disagrees with net: got %q, want %q", tc.addr, got, want)
-		}
-		if got := string(AppendAddr(nil, tc.addr)); got != tc.want {
-			t.Errorf("AppendAddr(%v): got %q, want %q", tc.addr, got, tc.want)
-		}
-	}
-}
-
-func TestString_singleAlloc(t *testing.T) {
-	addr := [6]byte{0xde, 0xad, 0xbe, 0xef, 0x00, 0x01}
-	var sink string
-	allocs := testing.AllocsPerRun(100, func() {
-		sink = String(addr)
-	})
-	_ = sink
-	// Only the returned string allocates; the scratch buffer must stay on the stack.
-	if allocs != 1 {
-		t.Errorf("expected 1 alloc, got %v", allocs)
-	}
-}

examples/berkeley-listener/berkeley_server.go

@@ -274,7 +274,7 @@ func handleConnNet(conn net.Conn) error {
 	defer conn.Close()
 	conn.SetDeadline(time.Now().Add(10 * time.Second))
 
-	var hdr httpraw.HeaderV1
+	var hdr httpraw.Header
 	needMore := true
 	for needMore {
 		_, err := hdr.ReadFromLimited(conn, 1024)
@@ -288,10 +288,10 @@ func handleConnNet(conn net.Conn) error {
 		}
 	}
 	method := string(hdr.Method())
-	uri := string(hdr.RequestTarget())
+	uri := string(hdr.RequestURI())
 	fmt.Printf("< %s %s\n", method, uri)
 
-	var resp httpraw.HeaderV1
+	var resp httpraw.Header
 	resp.SetProtocol("HTTP/1.1")
 	resp.SetStatus("200", "OK")
 	resp.Set("Content-Type", "text/html")
@@ -368,9 +368,9 @@ func mockClient(stack *xnet.StackAsync, port uint16, subnet netip.Prefix) {
 		panic("mock client deadline exceeded to establish")
 	}
 
-	var hdr httpraw.HeaderV1
+	var hdr httpraw.Header
 	hdr.SetMethod("GET")
-	hdr.SetRequestTarget("/")
+	hdr.SetRequestURI("/")
 	hdr.SetProtocol("HTTP/1.1")
 	hdr.Set("Host", string(ipv4.AppendFormatAddr(nil, stack.Addr4())))
 	hdr.Set("User-Agent", "lneto-mock")

examples/http-linux/conn-linux.go

@@ -0,0 +1,96 @@
+//go:build !tinygo && linux
+
+package main
+
+import (
+	"net/netip"
+	"syscall"
+)
+
+// Conn wraps an accepted TCP connection from a raw Linux socket file descriptor.
+// It implements io.Reader/io.Writer/io.Closer over syscall.Read/Write/Close.
+type Conn struct {
+	fd     int
+	remote netip.AddrPort
+}
+
+// Read reads bytes from the connection into b.
+func (c *Conn) Read(b []byte) (int, error) {
+	if len(b) == 0 {
+		return 0, nil
+	}
+	n, err := syscall.Read(c.fd, b)
+	if err != nil {
+		return 0, err
+	}
+	if n == 0 {
+		return 0, syscall.ECONNRESET // Peer closed.
+	}
+	return n, nil
+}
+
+// Write writes b to the connection, looping until all bytes are sent.
+func (c *Conn) Write(b []byte) (int, error) {
+	total := 0
+	for total < len(b) {
+		n, err := syscall.Write(c.fd, b[total:])
+		if err != nil {
+			return total, err
+		}
+		total += n
+	}
+	return total, nil
+}
+
+// Close closes the underlying file descriptor.
+func (c *Conn) Close() error {
+	return syscall.Close(c.fd)
+}
+
+// RemoteAddr returns the peer address of the connection.
+func (c *Conn) RemoteAddr() netip.AddrPort { return c.remote }
+
+// Listener wraps a listening TCP socket bound to a local port.
+type Listener struct {
+	fd int
+}
+
+// Listen creates a listening TCP socket bound to port on all interfaces.
+func Listen(port uint16) (*Listener, error) {
+	fd, err := syscall.Socket(syscall.AF_INET, syscall.SOCK_STREAM, syscall.IPPROTO_TCP)
+	if err != nil {
+		return nil, err
+	}
+	// Allow quick rebind after restart.
+	if err = syscall.SetsockoptInt(fd, syscall.SOL_SOCKET, syscall.SO_REUSEADDR, 1); err != nil {
+		syscall.Close(fd)
+		return nil, err
+	}
+	addr := &syscall.SockaddrInet4{Port: int(port)}
+	if err = syscall.Bind(fd, addr); err != nil {
+		syscall.Close(fd)
+		return nil, err
+	}
+	if err = syscall.Listen(fd, syscall.SOMAXCONN); err != nil {
+		syscall.Close(fd)
+		return nil, err
+	}
+	return &Listener{fd: fd}, nil
+}
+
+// Accept blocks until an incoming connection arrives and returns it as a Conn.
+func (l *Listener) Accept(conn *Conn) error {
+	nfd, sa, err := syscall.Accept(l.fd)
+	if err != nil {
+		return err
+	}
+
+	conn.fd = nfd
+	if sa4, ok := sa.(*syscall.SockaddrInet4); ok {
+		conn.remote = netip.AddrPortFrom(netip.AddrFrom4(sa4.Addr), uint16(sa4.Port))
+	}
+	return nil
+}
+
+// Close closes the listening socket.
+func (l *Listener) Close() error { return syscall.Close(l.fd) }

examples/http-linux/main-httplinux.go

@@ -0,0 +1,107 @@
+//go:build !tinygo && linux
+
+package main
+
+import (
+	"os"
+	"strconv"
+	"sync/atomic"
+	"time"
+
+	"github.com/soypat/lneto/http/httpraw"
+)
+
+const listenPort = 8080
+
+func main() {
+	if err := run(); err != nil {
+		println("Error: ", err)
+		os.Exit(1)
+	}
+	println("DONE")
+}
+
+func run() error {
+	ln, err := Listen(listenPort)
+	if err != nil {
+		return err
+	}
+	defer ln.Close()
+	println("listening on port", listenPort)
+	conn := new(Conn)
+	for {
+		err := ln.Accept(conn)
+		if err != nil {
+			return err
+		}
+		visits.Add(1)
+		if err := handle(conn); err != nil {
+			println("handle:", conn.RemoteAddr().String(), err.Error())
+		}
+		conn.Close()
+	}
+}
+
+const (
+	htmlHead = `<html><body bgcolor="#000080" text="#00FF00"><center>` +
+		`<marquee><font face="Comic Sans MS" size="5" color="#FFFF00">` +
+		`*** WELCOME TO MY HOMEPAGE ***</font></marquee>` +
+		`<h1><blink>YOU ARE VISITOR #`
+	htmlTail = `!</blink></h1>` +
+		`<font color="#FF00FF">Sign my guestbook!</font>` +
+		`<br><hr>Best viewed in Netscape Navigator</center></body></html>`
+)
+
+const maxHTTPHeader = 1024
+
+var (
+	hdr     httpraw.Header
+	httpbuf [maxHTTPHeader]byte
+	htmlbuf [512]byte
+	visits  atomic.Uint64
+)
+
+func handle(conn *Conn) error {
+	hdr.Reset(httpbuf[:0])
+	hdr.EnableBufferGrowth(false)    // Limit memory to buffer capacity.
+	const incomingIsResponse = false // We get HTTP requests from clients.
+	deadline := time.Now().Add(50 * time.Millisecond)
+	for time.Until(deadline) > 0 {
+		if _, err := hdr.ReadFromLimited(conn, maxHTTPHeader); err != nil {
+			return err
+		}
+		needmoredata, err := hdr.TryParse(incomingIsResponse)
+		if err != nil {
+			return err
+		}
+		if needmoredata {
+			continue
+		}
+		break
+	}
+	println("\n\n================\n\n", hdr.String())
+	if time.Since(deadline) > 0 {
+		print("DEADLINE EXCEED: ", hdr.BufferParsed(), "/", hdr.BufferReceived(), " bytes parsed/read\n")
+		return nil
+	}
+	// Prepare tacky HTML response.
+	n := copy(htmlbuf[:], htmlHead)
+	n += len(strconv.AppendUint(htmlbuf[n:n], visits.Load(), 10))
+	n += copy(htmlbuf[n:], htmlTail)
+	contentLen := n
+	hdr.Reset(httpbuf[:0])
+	hdr.SetProtocol("HTTP/1.1")
+	hdr.SetStatus("200", "OK")
+	hdr.Set("Content-Type", "text/html")
+	hdr.SetInt("Content-Length", int64(contentLen), 10)
+	// Here we do some buffer juggling. We use remaining space
+	// of HTTP Header buffer to write the response that will be written over the wire.
+	respbuf := httpbuf[hdr.BufferUsed():]
+	header, err := hdr.AppendResponse(respbuf[:0])
+	if err != nil {
+		return err
+	}
+	conn.Write(header)
+	_, err = conn.Write(htmlbuf[:contentLen])
+	return err
+}

examples/httpclient/main.go

@@ -25,9 +25,9 @@ func run() error {
 	flag.IntVar(&port, "lport", 13337, "Local port over which to hit server")
 	flag.Parse()
 	// Prepare GET request.
-	var hdr httpraw.HeaderV1
+	var hdr httpraw.Header
 	hdr.SetMethod("GET")
-	hdr.SetRequestTarget("/")
+	hdr.SetRequestURI("/")
 	hdr.SetProtocol("HTTP/1.1")
 	req, err := hdr.AppendRequest(nil)
 	if err != nil {
@@ -50,7 +50,7 @@ func run() error {
 	}()
 	fmt.Println(time.Now().Format("15:04:05.000"), "writing...")
 	conn.Write(req)
-	hdr.Reset(nil, 0) // No preallocation. Both key/value and raw buffer will grow and allocate.
+	hdr.Reset(nil)
 	var needMore bool = true
 	for needMore {
 		_, err = hdr.ReadFromLimited(conn, 1024)

examples/httphi-fuzz/fuzz.sh

@@ -1,259 +0,0 @@
-#!/usr/bin/env bash
-# fuzz.sh points ffuf at an already running main-httplinux server. Start it
-# yourself first, in another terminal, so its log and any crash stay visible:
-#
-#	go run ./examples/http-linux -port 8080
-#	./examples/http-linux/fuzz.sh                  # all cases
-#	./examples/http-linux/fuzz.sh paths cookie     # named cases only
-#	URL=http://localhost:9000 ./examples/http-linux/fuzz.sh
-#
-# Install ffuf with:  go install github.com/ffuf/ffuf/v2@latest
-#
-# Every case ends by reporting the server is still up: a case that "finds
-# nothing" because the process died is the failure this is looking for.
-set -u
-
-URL="${URL:-http://localhost:8080}"
-# Matched to the server's FixedNumGoroutines: in worker mode the router owns one
-# exchange per goroutine and refuses a connection outright when none is free, so
-# that count is what bounds concurrency. Going above it is correct backpressure,
-# but it reaches ffuf as a connection error and hides the response a case was
-# looking for. Raise it to exercise the drop path.
-THREADS="${THREADS:-4}"
-
-WORDDIR="$(mktemp -d)"
-trap 'rm -rf "$WORDDIR"' EXIT
-
-# ---------------------------------------------------------------------------
-# Wordlists. Kept here rather than pulled from SecLists so a run is repeatable
-# and every entry is aimed at the parser: percent escapes, separators the
-# grammar gives meaning to, and lengths that cross the server's fixed buffers.
-# ---------------------------------------------------------------------------
-cat >"$WORDDIR/paths.txt" <<'EOF'
-admin
-login
-search
-health
-echo
-upload
-users
-files
-users/alice
-users/bob
-users/carol
-users/mallory
-users/al%69ce
-users/%zz
-users/%2e%2e%2f
-users/alice/extra
-files/
-files/readme.txt
-files/logo.png
-files/notes.md
-files/a/b/c
-files/%2e%2e/%2e%2e/etc/passwd
-EOF
-
-cat >"$WORDDIR/queries.txt" <<'EOF'
-go
-go+lang
-go%20lang
-%21%40%23
-%zz
-%
-%2
-a=b
-a&b
-a;b
-""
-EOF
-
-cat >"$WORDDIR/passwords.txt" <<'EOF'
-hunter2
-password
-admin
-letmein
-hunter2%00
-hunter2+
-hun%74er2
-EOF
-
-cat >"$WORDDIR/tokens.txt" <<'EOF'
-s3cr3t-session-token
-admin
-""
-"s3cr3t-session-token"
-s3cr3t-session-token; debug
-s3cr3t-session-token;debug
-=====
-;;;;;
-EOF
-
-cat >"$WORDDIR/headers.txt" <<'EOF'
-plain
-with spaces
-%00%01%02
-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
-EOF
-
-cat >"$WORDDIR/names.txt" <<'EOF'
-a.bin
-report.pdf
-../escape.txt
-%2e%2e%2fescape.txt
-EOF
-
-# grow prints a line of n 'A's, for the cases that walk a value past a buffer.
-grow() { printf 'A%.0s' $(seq "$1"); printf '\n'; }
-{ for n in 8 64 512 1024 2048 4096 8192; do grow "$n"; done; } >"$WORDDIR/long.txt"
-
-alive() {
-	if curl -s -o /dev/null --max-time 5 "$URL/health"; then
-		printf '  server alive\n\n'
-	else
-		printf '  *** SERVER DOWN after this case ***\n\n'
-		exit 1
-	fi
-}
-
-case_header() { printf '=== %s: %s\n' "$1" "$2"; }
-
-# ---------------------------------------------------------------------------
-# Cases. Each one drives a different part of the request through the parser.
-# ---------------------------------------------------------------------------
-
-# paths walks the mux: literal patterns, the "{id}" single-segment wildcard and
-# the "{path...}" wildcard that swallows slashes. -mc all because a 404 from an
-# unregistered path is a correct answer worth seeing next to the 200s.
-fuzz_paths() {
-	case_header paths "mux patterns, wildcards and percent escapes in the path"
-	ffuf -u "$URL/FUZZ" -w "$WORDDIR/paths.txt" -t "$THREADS" -s -timeout 5 -mc all -fc 404
-	alive
-}
-
-# recursion follows the "{path...}" wildcard down, which is the pattern a
-# directory scanner exercises hardest.
-fuzz_recursion() {
-	case_header recursion "\"{path...}\" wildcard walked recursively"
-	ffuf -u "$URL/files/FUZZ" -w "$WORDDIR/paths.txt" -t "$THREADS" -s -timeout 5 \
-		-recursion -recursion-depth 2 -recursion-strategy greedy -mc all -fc 404
-	alive
-}
-
-# longpath pushes the request-target past RequestHeaderBufferSize. The server
-# should answer 431 or drop the connection, never serve a mangled path.
-fuzz_longpath() {
-	case_header longpath "request-target grown past the request header buffer"
-	ffuf -u "$URL/FUZZ" -w "$WORDDIR/long.txt" -t 4 -s -timeout 5 -mc all
-	alive
-}
-
-# query drives RequestQueryValue and the percent decoder, including escapes that
-# do not decode, which must come back 400 and not half decoded.
-fuzz_query() {
-	case_header query "query string values, valid and malformed escapes"
-	ffuf -u "$URL/search?q=FUZZ" -w "$WORDDIR/queries.txt" -t "$THREADS" -s -timeout 5 -mc all
-	ffuf -u "$URL/search?q=go&limit=FUZZ" -w "$WORDDIR/queries.txt" -t "$THREADS" -s -timeout 5 -mc all
-	case_header query "query value grown past the request header buffer"
-	ffuf -u "$URL/search?q=FUZZ" -w "$WORDDIR/long.txt" -t 4 -s -timeout 5 -mc all
-	alive
-}
-
-# form posts "application/x-www-form-urlencoded" bodies, the case the credential
-# check answers 200 for and everything else 401.
-fuzz_form() {
-	case_header form "urlencoded body pairs; 200 is the credential that works"
-	ffuf -u "$URL/login" -X POST -w "$WORDDIR/passwords.txt" \
-		-H 'Content-Type: application/x-www-form-urlencoded' \
-		-d 'user=admin&pass=FUZZ' -t "$THREADS" -s -timeout 5 -mc all -fc 401
-	case_header form "body grown past the form buffer, which may not grow"
-	ffuf -u "$URL/login" -X POST -w "$WORDDIR/long.txt" \
-		-H 'Content-Type: application/x-www-form-urlencoded' \
-		-d 'user=admin&pass=FUZZ' -t 4 -s -timeout 5 -mc all
-	case_header form "pair count driven past the form's fixed pair table"
-	ffuf -u "$URL/login?a=1&b=2&c=3&d=4&e=5&f=6&g=7&h=8&i=9&j=10&k=11&l=12&m=13&n=14&o=15&p=16&q=17" \
-		-X POST -w "$WORDDIR/passwords.txt" \
-		-H 'Content-Type: application/x-www-form-urlencoded' \
-		-d 'user=admin&pass=FUZZ' -t "$THREADS" -s -timeout 5 -mc all
-	alive
-}
-
-# cookie drives the Cookie header parser: quoting, valueless attributes and the
-# separators the grammar splits on.
-fuzz_cookie() {
-	case_header cookie "Cookie header values; 200 is the session that works"
-	ffuf -u "$URL/admin" -w "$WORDDIR/tokens.txt" -b 'session=FUZZ' \
-		-t "$THREADS" -s -timeout 5 -mc all -fc 403
-	case_header cookie "cookie grown past the cookie buffer"
-	ffuf -u "$URL/admin" -w "$WORDDIR/long.txt" -b 'session=FUZZ' -t 4 -s -timeout 5 -mc all
-	alive
-}
-
-# headers fuzzes a header field value and the field count, /echo handing back
-# the header block as the parser stored it.
-fuzz_headers() {
-	case_header headers "header field values echoed back through the parser"
-	ffuf -u "$URL/echo" -w "$WORDDIR/headers.txt" -H 'X-Fuzz: FUZZ' \
-		-t "$THREADS" -s -timeout 5 -mc all
-	case_header headers "header value grown past the request header buffer"
-	ffuf -u "$URL/echo" -w "$WORDDIR/long.txt" -H 'X-Fuzz: FUZZ' -t 4 -s -timeout 5 -mc all
-	alive
-}
-
-# multipart fuzzes the part header block: the filename parameter picks whether a
-# part is streamed to a sink or discarded.
-fuzz_multipart() {
-	case_header multipart "multipart part headers and filenames"
-	ffuf -u "$URL/upload" -X POST -w "$WORDDIR/names.txt" \
-		-H 'Content-Type: multipart/form-data; boundary=X' \
-		-d $'--X\r\nContent-Disposition: form-data; name="f"; filename="FUZZ"\r\n\r\ndata\r\n--X--\r\n' \
-		-t "$THREADS" -s -timeout 5 -mc all
-	case_header multipart "part header grown past the multipart buffer, expect 413"
-	ffuf -u "$URL/upload" -X POST -w "$WORDDIR/long.txt" \
-		-H 'Content-Type: multipart/form-data; boundary=X' \
-		-d $'--X\r\nContent-Disposition: form-data; name="f"; filename="FUZZ"\r\n\r\ndata\r\n--X--\r\n' \
-		-t 4 -s -timeout 5 -mc all
-	alive
-}
-
-# methods sends a method per registration and a few the server never names.
-# "/echo" is registered without one, so any method reaches it; "/login" is
-# POST only and everything else must 404 there.
-fuzz_methods() {
-	case_header methods "registered, unregistered and extension methods"
-	printf 'GET\nPOST\nPUT\nDELETE\nPATCH\nHEAD\nOPTIONS\nTRACE\nPROPFIND\nBREW\n' >"$WORDDIR/methods.txt"
-	ffuf -u "$URL/echo" -w "$WORDDIR/methods.txt" -X FUZZ -t "$THREADS" -s -timeout 5 -mc all
-	ffuf -u "$URL/login" -w "$WORDDIR/methods.txt" -X FUZZ -t "$THREADS" -s -timeout 5 -mc all -fc 404
-	alive
-}
-
-# clusterbomb crosses a path wordlist with a query wordlist, so the two parsers
-# are driven by unrelated inputs in the same request.
-fuzz_clusterbomb() {
-	case_header clusterbomb "path and query fuzzed together, every combination"
-	ffuf -u "$URL/PATH?q=QUERY" -mode clusterbomb \
-		-w "$WORDDIR/paths.txt:PATH" -w "$WORDDIR/queries.txt:QUERY" \
-		-t "$THREADS" -s -timeout 5 -mc all -fc 404
-	alive
-}
-
-ALL=(paths recursion longpath query form cookie headers multipart methods clusterbomb)
-
-main() {
-	command -v ffuf >/dev/null || {
-		echo "ffuf not found: go install github.com/ffuf/ffuf/v2@latest" >&2
-		exit 1
-	}
-	curl -s -o /dev/null --max-time 5 "$URL/health" || {
-		echo "no server at $URL: start it with 'go run ./examples/http-linux'" >&2
-		exit 1
-	}
-	local cases=("$@")
-	[ ${#cases[@]} -eq 0 ] && cases=("${ALL[@]}")
-	for c in "${cases[@]}"; do
-		"fuzz_$c" || { echo "unknown case: $c" >&2; exit 1; }
-	done
-	echo "all cases done, server still up"
-}
-
-main "$@"

examples/httphi-fuzz/main-httplinux.go

@@ -1,465 +0,0 @@
-//go:build !tinygo && linux
-
-package main
-
-import (
-	"flag"
-	"io"
-	"log/slog"
-	"net"
-	"os"
-	"strconv"
-	"sync/atomic"
-	"time"
-
-	"github.com/soypat/lneto"
-	"github.com/soypat/lneto/http/httphi"
-	"github.com/soypat/lneto/http/httpraw"
-)
-
-const (
-	kB            = 1 << 10
-	listenPort    = 8080
-	memoryPerConn = 4 * kB
-	readTimeout   = 2 * time.Second
-)
-
-// Credentials the endpoints check. They are in the source on purpose: this is a
-// target to point a fuzzer at, and a scan is only interesting when something is
-// there to be found.
-const (
-	adminUser    = "admin"
-	adminPass    = "hunter2"
-	sessionToken = "s3cr3t-session-token"
-)
-
-// Fixed corpora the handlers answer from, so a path scan separates hits from
-// misses instead of finding one status code everywhere.
-var (
-	users = [...]string{"alice", "bob", "carol"}
-	files = [...]string{"readme.txt", "logo.png", "notes.md"}
-)
-
-var (
-	flagPort    = flag.Int("port", listenPort, "TCP port to listen on")
-	flagVerbose = flag.Bool("v", false, "log every request to stderr; a fuzzer at full rate makes this expensive")
-	flagThreads = flag.Int("threads", 8, "Number of goroutines to spawn.")
-)
-
-func main() {
-	flag.Parse()
-	if err := run(); err != nil {
-		println("Error:", err.Error())
-		os.Exit(1)
-	}
-	println("DONE")
-}
-
-func run() error {
-	ln, err := net.Listen("tcp", ":"+strconv.Itoa(*flagPort))
-	if err != nil {
-		return err
-	}
-	defer ln.Close()
-	print("listening on http://localhost:", *flagPort, "\n")
-
-	var server Server
-	// One scratch per router goroutine: the router serves that many requests at
-	// once, so a handler always finds one waiting for it.
-	server.initScratch(*flagThreads)
-	// "{$}" matches the empty path and nothing else, so an unregistered path
-	// gets a 404 instead of the homepage. A bare "/" is a catch-all.
-	server.Handle("GET /{$}", server.homepage)
-	server.Handle("GET /health", server.health)
-	server.Handle("GET /search", server.search)
-	server.Handle("POST /login", server.login)
-	server.Handle("GET /admin", server.admin)
-	server.Handle("GET /users/{id}", server.user)
-	server.Handle("GET /files/{path...}", server.file)
-	server.Handle("POST /upload", server.upload)
-	server.Handle("/echo", server.echo) // No method: any method matches.
-
-	var router httphi.Router
-	cfg := httphi.DefaultRouterConfig(*flagThreads, memoryPerConn, server.mux.MaxPathValues())
-	err = router.Configure(&server.mux, cfg)
-	if err != nil {
-		return err
-	}
-	defer router.Shutdown()
-
-	for {
-		conn, err := ln.Accept()
-		if err != nil {
-			return err
-		}
-		// The connection owns the idle policy: a peer that opens a socket and
-		// then stalls fails its read instead of holding a router goroutine.
-		conn.SetReadDeadline(time.Now().Add(readTimeout))
-		err = router.Handle(conn)
-		if err != nil {
-			// Every goroutine is busy and the queue is full. Dropping the
-			// connection is the backpressure: memory stays bounded.
-			slog.Warn("dropped connection", slog.String("remote", conn.RemoteAddr().String()), slog.String("err", err.Error()))
-			conn.Close()
-		}
-	}
-}
-
-const (
-	htmlHead = `<html><body bgcolor="#000080" text="#00FF00"><center>` +
-		`<marquee><font face="Comic Sans MS" size="5" color="#FFFF00">` +
-		`*** WELCOME TO MY HOMEPAGE ***</font></marquee>` +
-		`<h1><blink>YOU ARE VISITOR #`
-	htmlTail = `!</blink></h1>` +
-		`<font color="#FF00FF">Sign my guestbook!</font><br><hr>` +
-		`<a href="/search?q=go">/search</a> | ` +
-		`<a href="/users/alice">/users/{id}</a> | ` +
-		`<a href="/files/">/files/</a> | ` +
-		`<a href="/admin">/admin</a> | ` +
-		`<a href="/echo">/echo</a> | ` +
-		`<a href="/health">/health</a>` +
-		`<br><hr>Best viewed in Netscape Navigator</center></body></html>`
-	// maxPage bounds the rendered page: both halves plus the visitor number.
-	maxPage = len(htmlHead) + 20 + len(htmlTail)
-)
-
-// Compile-time check that a scratch's render buffer holds the largest page a
-// handler builds. A page outgrowing it would grow the buffer on the heap,
-// which is the one thing this server is written not to do.
-const _ = uint(outBufferSize - maxPage)
-
-type Server struct {
-	// Visits counts served requests.
-	Visits atomic.Uint64
-	mux    httphi.MuxSlice
-	// scratch is a fixed pool of per-request working memory, see [scratch].
-	scratch chan *scratch
-}
-
-// Sizes of a [scratch]. Every one of these is memory spent once per pooled
-// scratch, so the pool's size times the sum below is what the handlers cost.
-const (
-	formBufferSize      = kB
-	formNumPairs        = 16
-	cookieBufferSize    = 512
-	cookieNumPairs      = 8
-	multipartBufferSize = kB
-	maxMultipartParts   = 8
-	outBufferSize       = 2 * kB
-	tmpBufferSize       = 256
-)
-
-// scratch is the memory a handler works in for the length of one request: the
-// [Exchange] buffer holds the request header and the response header, and
-// everything a handler parses or renders on top of that lives here.
-//
-// Parsers are handed their buffer once and forbidden to grow, so a request that
-// sends more than the buffer holds is answered an error rather than served from
-// memory the server never budgeted for.
-type scratch struct {
-	form   httpraw.Form
-	cookie httpraw.Cookie
-	// parts is reused across requests: its [httpraw.MultipartHeader] values keep
-	// the buffers their Name and Filename were copied into.
-	parts   []httphi.MultipartSink
-	uploads countingSink
-
-	formBuf   [formBufferSize]byte
-	cookieBuf [cookieBufferSize]byte
-	mpBuf     [multipartBufferSize]byte
-	// out renders the response body, tmp holds a decoded value being read out of
-	// the request. They are separate because a decode reads into one while the
-	// body is being built in the other.
-	out [outBufferSize]byte
-	tmp [tmpBufferSize]byte
-}
-
-// initScratch fills the pool with n scratches and fixes each parser to its
-// buffer. Sizing n to the router's goroutine count bounds handler memory the
-// same way the router bounds its own.
-func (sv *Server) initScratch(n int) {
-	sv.scratch = make(chan *scratch, n)
-	for range n {
-		s := new(scratch)
-		s.form.Reset(s.formBuf[:0], formNumPairs)
-		s.form.EnableBufferGrowth(false)
-		s.cookie.Reset(s.cookieBuf[:0], cookieNumPairs)
-		s.cookie.EnableBufferGrowth(false)
-		s.parts = make([]httphi.MultipartSink, 0, maxMultipartParts)
-		sv.scratch <- s
-	}
-}
-
-// acquireScratch takes a scratch out of the pool, blocking while none is free.
-// With the pool sized to the router's fixed goroutine count it never blocks:
-// a handler running is a goroutine that has not returned its scratch yet.
-func (sv *Server) acquireScratch() *scratch { return <-sv.scratch }
-
-func (sv *Server) releaseScratch(s *scratch) { sv.scratch <- s }
-
-// Handle registers a handler and wraps it in the middleware every request runs
-// through: the visit counter and, when asked for, the request log.
-func (sv *Server) Handle(pattern string, handler httphi.HandlerFunc) {
-	sv.mux.Handle(pattern, func(exch *httphi.Exchange) {
-		sv.Visits.Add(1)
-		if *flagVerbose {
-			println(exch.RequestMethod().String(), exch.MuxPattern())
-		}
-		handler(exch)
-	})
-}
-
-func (sv *Server) homepage(exch *httphi.Exchange) {
-	s := sv.acquireScratch()
-	defer sv.releaseScratch(s)
-	page := append(s.out[:0], htmlHead...)
-	page = strconv.AppendUint(page, sv.Visits.Load(), 10)
-	page = append(page, htmlTail...)
-	exch.Respond(httphi.StatusOK, "text/html", page)
-}
-
-func (sv *Server) health(exch *httphi.Exchange) {
-	exch.RespondString(httphi.StatusOK, "text/plain", "ok\n")
-}
-
-// search reads the query string, i.e: "/search?q=go+lang&limit=2". Values are
-// percent and '+' encoded on the wire, so this is the decoder's surface: a
-// malformed escape is answered 400 and never half decoded into the response.
-func (sv *Server) search(exch *httphi.Exchange) {
-	s := sv.acquireScratch()
-	defer sv.releaseScratch(s)
-	const decode = true
-	query, present := exch.RequestQueryAppend(s.tmp[:0], "q", decode)
-	if !present {
-		exch.RespondString(httphi.StatusBadRequest, "text/plain", "missing or malformed q parameter\n")
-		return
-	}
-	limit := len(users)
-	if raw, present := exch.RequestQueryValue("limit"); present {
-		n, ok := atoiBounded(raw, len(users))
-		if !ok {
-			exch.RespondString(httphi.StatusBadRequest, "text/plain", "limit must be a non-negative integer\n")
-			return
-		}
-		limit = n
-	}
-	body := append(s.out[:0], "query: "...)
-	body = append(body, query...)
-	body = append(body, '\n')
-	for _, user := range users[:limit] {
-		body = append(body, user...)
-		body = append(body, '\n')
-	}
-	exch.Respond(httphi.StatusOK, "text/plain", body)
-}
-
-// login reads "application/x-www-form-urlencoded" pairs out of the request body
-// and the query string alike, the body winning a key both carry. It is where a
-// credential scan lands:
-//
-//	ffuf -X POST -u http://localhost:8080/login -d 'user=admin&pass=FUZZ' \
-//	     -H 'Content-Type: application/x-www-form-urlencoded' -w passwords.txt -fc 401
-func (sv *Server) login(exch *httphi.Exchange) {
-	s := sv.acquireScratch()
-	defer sv.releaseScratch(s)
-	// Checked ahead of the parse so a body in some other encoding is told what
-	// is wrong with it, the parser reporting only that it would not parse.
-	contentType := exch.RequestContentType()
-	if contentType != nil && !httpraw.MediaTypeIs(contentType, "application/x-www-form-urlencoded") {
-		exch.RespondString(httphi.StatusUnsupportedMediaType, "text/plain", "expected application/x-www-form-urlencoded\n")
-		return
-	}
-	const parseQuery, queryWins = true, false
-	err := exch.RequestParseForm(&s.form, parseQuery, queryWins)
-	if err != nil {
-		// A body larger than formBufferSize or more pairs than formNumPairs land
-		// here too: the form was told not to grow, so it refuses instead.
-		exch.RespondString(httphi.StatusBadRequest, "text/plain", "malformed or oversized form\n")
-		return
-	}
-	if err = s.form.Decode(); err != nil {
-		exch.RespondString(httphi.StatusBadRequest, "text/plain", "malformed percent escape in form\n")
-		return
-	}
-	user, pass := s.form.Get("user"), s.form.Get("pass")
-	if string(user) != adminUser || string(pass) != adminPass {
-		exch.RespondString(httphi.StatusUnauthorized, "text/plain", "bad credentials\n")
-		return
-	}
-	exch.StageHeader("Set-Cookie", "session="+sessionToken+"; Path=/; HttpOnly")
-	exch.RespondString(httphi.StatusOK, "text/plain", "welcome "+adminUser+"\n")
-}
-
-// admin is gated on the cookie [Server.login] hands out, so a scan of it fuzzes
-// the cookie parser:
-//
-//	ffuf -u http://localhost:8080/admin -b 'session=FUZZ' -w tokens.txt -fc 403
-func (sv *Server) admin(exch *httphi.Exchange) {
-	s := sv.acquireScratch()
-	defer sv.releaseScratch(s)
-	err := exch.RequestParseCookie(&s.cookie, "Cookie")
-	if err != nil {
-		exch.RespondString(httphi.StatusUnauthorized, "text/plain", "no cookie\n")
-		return
-	}
-	if string(s.cookie.Get("session")) != sessionToken {
-		exch.RespondString(httphi.StatusForbidden, "text/plain", "forbidden\n")
-		return
-	}
-	body := append(s.out[:0], "admin panel\n"...)
-	// A valueless attribute, i.e: "session=...; debug", is stored with an empty
-	// key, so a plain Get would never find it.
-	if s.cookie.HasKeyOrSingleValue("debug") {
-		body = append(body, "requests served: "...)
-		body = strconv.AppendUint(body, sv.Visits.Load(), 10)
-		body = append(body, '\n')
-	}
-	exch.Respond(httphi.StatusOK, "text/plain", body)
-}
-
-// user serves the "{id}" wildcard, a single path segment. Segments are bound
-// raw, so the value is decoded here and "/users/al%69ce" reaches alice.
-func (sv *Server) user(exch *httphi.Exchange) {
-	s := sv.acquireScratch()
-	defer sv.releaseScratch(s)
-	const decode = true
-	id, err := exch.PathValueAppend(s.tmp[:0], "id", decode)
-	if err != nil {
-		exch.RespondString(httphi.StatusBadRequest, "text/plain", "malformed percent escape in path\n")
-		return
-	}
-	for _, user := range users {
-		if string(id) == user {
-			body := append(s.out[:0], `{"user":"`...)
-			body = append(body, id...)
-			body = append(body, "\"}\n"...)
-			exch.Respond(httphi.StatusOK, "application/json", body)
-			return
-		}
-	}
-	exch.RespondString(httphi.StatusNotFound, "text/plain", "no such user\n")
-}
-
-// file serves the "{path...}" wildcard, which takes the rest of the path
-// including its slashes, so "/files/" and "/files/a/b" both reach here. That
-// makes it what a recursive scan walks: ffuf -u http://localhost:8080/files/FUZZ -recursion.
-func (sv *Server) file(exch *httphi.Exchange) {
-	s := sv.acquireScratch()
-	defer sv.releaseScratch(s)
-	path := exch.PathValue("path")
-	if len(path) == 0 {
-		body := append(s.out[:0], "index of /files/\n"...)
-		for _, file := range files {
-			body = append(body, file...)
-			body = append(body, '\n')
-		}
-		exch.Respond(httphi.StatusOK, "text/plain", body)
-		return
-	}
-	for _, file := range files {
-		if string(path) == file {
-			body := append(s.out[:0], "contents of "...)
-			body = append(body, path...)
-			body = append(body, '\n')
-			exch.Respond(httphi.StatusOK, "text/plain", body)
-			return
-		}
-	}
-	exch.RespondString(httphi.StatusNotFound, "text/plain", "no such file\n")
-}
-
-// upload streams a "multipart/form-data" body, counting each file part instead
-// of storing it. Parts declare no length, so the body is read a bufferful at a
-// time and the header of a part that outgrows the buffer is refused 413.
-//
-//	ffuf -X POST -u http://localhost:8080/upload -w names.txt \
-//	     -H 'Content-Type: multipart/form-data; boundary=X' \
-//	     -d $'--X\r\nContent-Disposition: form-data; name="f"; filename="FUZZ"\r\n\r\ndata\r\n--X--\r\n'
-func (sv *Server) upload(exch *httphi.Exchange) {
-	s := sv.acquireScratch()
-	defer sv.releaseScratch(s)
-	if !httpraw.MediaTypeIs(exch.RequestContentType(), "multipart/form-data") {
-		exch.RespondString(httphi.StatusUnsupportedMediaType, "text/plain", "expected multipart/form-data\n")
-		return
-	}
-	s.uploads.n = 0
-	// The sink is a field of the scratch, so handing it over as an io.WriteCloser
-	// boxes a pointer that is already on the heap and allocates nothing.
-	parts, err := exch.ReadMultiparts(s.parts[:0], s.mpBuf[:], func(hdr *httpraw.MultipartHeader) io.WriteCloser {
-		if len(hdr.Filename) == 0 {
-			return nil // A plain field, not a file: keep the header, drop the content.
-		}
-		return &s.uploads
-	})
-	// Kept even on failure: the headers parsed so far own buffers worth reusing.
-	// The slice grows with the number of parts, which only the connection's read
-	// deadline bounds, so a real server would cap it.
-	s.parts = parts
-	if err != nil {
-		if err == lneto.ErrShortBuffer {
-			exch.RespondString(httphi.StatusRequestEntityTooLarge, "text/plain", "part header too large\n")
-		} else {
-			exch.RespondString(httphi.StatusBadRequest, "text/plain", "malformed multipart body\n")
-		}
-		return
-	}
-	body := append(s.out[:0], "parts: "...)
-	body = strconv.AppendInt(body, int64(len(parts)), 10)
-	body = append(body, '\n')
-	for i := range parts {
-		body = append(body, parts[i].Header.Name...)
-		if len(parts[i].Header.Filename) > 0 {
-			body = append(body, " -> "...)
-			body = append(body, parts[i].Header.Filename...)
-		}
-		body = append(body, '\n')
-	}
-	body = append(body, "bytes stored: "...)
-	body = strconv.AppendInt(body, s.uploads.n, 10)
-	body = append(body, '\n')
-	exch.Respond(httphi.StatusOK, "text/plain", body)
-}
-
-// echo hands back the request line and the header block as the parser stored
-// it, which is what tells a header fuzzer what its input turned into.
-func (sv *Server) echo(exch *httphi.Exchange) {
-	s := sv.acquireScratch()
-	defer sv.releaseScratch(s)
-	body := append(s.out[:0], exch.RequestMethodBytes()...)
-	body = append(body, ' ')
-	body = append(body, exch.RequestTarget()...)
-	body = append(body, '\n')
-	if value := exch.RequestHeader("X-Fuzz"); value != nil {
-		body = append(body, "x-fuzz: "...)
-		body = append(body, value...)
-		body = append(body, '\n')
-	}
-	body = append(body, "-- parsed header --\n"...)
-	body = exch.RequestHeaderV1Raw().AppendHeaders(body)
-	exch.Respond(httphi.StatusOK, "text/plain", body)
-}
-
-// countingSink discards a multipart part and counts what it discarded, standing
-// in for the file a real upload would write.
-type countingSink struct{ n int64 }
-
-func (c *countingSink) Write(b []byte) (int, error) { c.n += int64(len(b)); return len(b), nil }
-func (c *countingSink) Close() error                { return nil }
-
-// atoiBounded parses a decimal number and clamps it to max, reporting false for
-// anything that is not one. It works off the bytes rather than converting to a
-// string, which would allocate on a path every request takes.
-func atoiBounded(b []byte, max int) (int, bool) {
-	const maxDigits = 9 // Bounded so the accumulator below cannot overflow.
-	if len(b) == 0 || len(b) > maxDigits {
-		return 0, false
-	}
-	n := 0
-	for _, c := range b {
-		if c < '0' || c > '9' {
-			return 0, false
-		}
-		n = n*10 + int(c-'0')
-	}
-	return min(n, max), true
-}

examples/httphi-server/main-httplinux.go

@@ -1,105 +0,0 @@
-//go:build !tinygo && linux
-
-package main
-
-import (
-	"log/slog"
-	"net"
-	"os"
-	"strconv"
-	"sync/atomic"
-	"time"
-
-	"github.com/soypat/lneto/http/httphi"
-)
-
-const (
-	kB            = 1 << 10
-	listenPort    = 8080
-	connMemoryUse = 4 * kB
-	numGoroutines = 4
-	readTimeout   = 2 * time.Second
-)
-
-func main() {
-	if err := run(); err != nil {
-		println("Error:", err.Error())
-		os.Exit(1)
-	}
-	println("DONE")
-}
-
-func run() error {
-	ln, err := net.Listen("tcp", ":"+strconv.Itoa(listenPort))
-	if err != nil {
-		return err
-	}
-	defer ln.Close()
-	print("listening on http://localhost:", listenPort, "\n")
-
-	var server Server
-	server.Handle("GET /", server.homepage)
-
-	var router httphi.Router
-	cfg := httphi.DefaultRouterConfig(numGoroutines, connMemoryUse, server.mux.MaxPathValues())
-	err = router.Configure(&server.mux, cfg)
-	if err != nil {
-		return err
-	}
-	defer router.Shutdown()
-
-	for {
-		conn, err := ln.Accept()
-		if err != nil {
-			return err
-		}
-		// The connection owns the idle policy: a peer that opens a socket and
-		// then stalls fails its read instead of holding a router goroutine.
-		conn.SetReadDeadline(time.Now().Add(readTimeout))
-		err = router.Handle(conn)
-		if err != nil {
-			// Every goroutine is busy and the queue is full. Dropping the
-			// connection is the backpressure: memory stays bounded.
-			slog.Warn("dropped connection", slog.String("remote", conn.RemoteAddr().String()), slog.String("err", err.Error()))
-			conn.Close()
-		}
-	}
-}
-
-const (
-	htmlHead = `<html><body bgcolor="#000080" text="#00FF00"><center>` +
-		`<marquee><font face="Comic Sans MS" size="5" color="#FFFF00">` +
-		`*** WELCOME TO MY HOMEPAGE ***</font></marquee>` +
-		`<h1><blink>YOU ARE VISITOR #`
-	htmlTail = `!</blink></h1>` +
-		`<font color="#FF00FF">Sign my guestbook!</font>` +
-		`<br><hr>Best viewed in Netscape Navigator</center></body></html>`
-	// maxPage bounds the rendered page: both halves plus the visitor number.
-	maxPage = len(htmlHead) + 20 + len(htmlTail)
-)
-
-type Server struct {
-	// visits counts served requests.
-	Visits atomic.Uint64
-	mux    httphi.MuxSlice
-}
-
-func (sv *Server) Handle(pattern string, handler httphi.HandlerFunc) {
-	// Middleware for all incoming requests declared here.
-	sv.mux.Handle(pattern, func(exch *httphi.Exchange) {
-		println(exch.RequestMethod().String(), exch.MuxPattern())
-		handler(exch)
-	})
-}
-
-func (sv *Server) homepage(exch *httphi.Exchange) {
-	var page [maxPage]byte
-	n := copy(page[:], htmlHead)
-	n += len(strconv.AppendUint(page[n:n], sv.Visits.Add(1), 10))
-	n += copy(page[n:], htmlTail)
-	exch.Respond(200, "text/html", page[:n])
-}
-
-func (sv *Server) form(exch *httphi.Exchange) {
-
-}

examples/httpserver/main.go

@@ -18,12 +18,11 @@ import (
 	"runtime"
 	"strconv"
 	"strings"
-	"sync/atomic"
 	"time"
 
 	"github.com/soypat/lneto"
 	"github.com/soypat/lneto/ethernet"
-	"github.com/soypat/lneto/http/httphi"
+	"github.com/soypat/lneto/http/httpraw"
 	"github.com/soypat/lneto/internal"
 	"github.com/soypat/lneto/internal/ltesto"
 	"github.com/soypat/lneto/internet/pcap"
@@ -35,18 +34,6 @@ import (
 //go:embed index.html
 var indexhtml string
 
-// Router memory. The router allocates all of it on Configure and never again,
-// so these are the whole cost of serving HTTP over the stack.
-const (
-	httpConnMemoryUse = 4 * 1024
-	// One exchange is allocated per worker, and a worker holds its exchange for
-	// the whole request, so this is what bounds requests served at once.
-	numWorkers = 2
-	// requestTimeout drops a peer that opens a connection and then stalls,
-	// rather than letting it hold one of the workers.
-	requestTimeout = 10 * time.Second
-)
-
 var softRand = time.Now().Unix()
 
 func main() {
@@ -238,23 +225,6 @@ func run() (err error) {
 	svPort := uint16(flagPort)
 	fmt.Printf("Listening on %s:%d\n", ipv4.AppendFormatAddr(nil, stack.Addr4()), svPort)
 
-	// Routes are registered before Configure: the router reads the mux to size
-	// the exchanges it allocates, and refuses a mux with nothing registered.
-	server := httpServer{start: time.Now()}
-	// "{$}" matches the empty path and nothing else, so anything unregistered
-	// gets a 404 rather than the index page.
-	server.handle("GET /{$}", server.index)
-	server.handle("GET /stats", server.stats)
-
-	var router httphi.Router
-	cfg := httphi.DefaultRouterConfig(numWorkers, httpConnMemoryUse, server.mux.MaxPathValues())
-	cfg.Logger = slog.Default()
-	err = router.Configure(&server.mux, cfg)
-	if err != nil {
-		return fmt.Errorf("configuring HTTP router: %w", err)
-	}
-	defer router.Shutdown()
-
 	// Serve connections in a loop.
 	for {
 		var conn tcp.Conn
@@ -284,56 +254,65 @@ func run() (err error) {
 			continue
 		}
 		fmt.Println("connection established from", net.IP(conn.RemoteAddr()).String())
-		// The connection owns the idle policy: a peer that stalls fails its read
-		// instead of holding a worker. conn is declared inside the loop, so the
-		// worker keeps serving this one while the next iteration listens anew.
-		conn.SetDeadline(time.Now().Add(requestTimeout))
-		err = router.Handle(&conn)
-		if err != nil {
-			// Every worker is busy. Dropping is the backpressure that keeps the
-			// stack's memory bounded, see numWorkers.
-			slog.Warn("dropped connection", slog.String("err", err.Error()))
-			conn.Abort()
-		}
+		go func() {
+			err = handleConnection(&conn)
+			if err != nil {
+				fmt.Println("handle error:", err)
+			}
+		}()
 	}
 }
 
-// httpServer holds what the handlers answer with. Routes are registered on its
-// mux before [httphi.Router.Configure] runs, which reads the mux to size the
-// path values every exchange must hold.
-type httpServer struct {
-	mux    httphi.MuxSlice
-	served atomic.Uint64
-	start  time.Time
-}
+func handleConnection(conn *tcp.Conn) error {
+	conn.SetDeadline(time.Now().Add(10 * time.Second))
 
-// handle registers handler and wraps it in the logging and counting every
-// request goes through, i.e: the "< GET /" line this example has always printed.
-func (sv *httpServer) handle(pattern string, handler httphi.HandlerFunc) {
-	sv.mux.Handle(pattern, func(exch *httphi.Exchange) {
-		sv.served.Add(1)
-		fmt.Printf("< %s %s\n", exch.RequestMethodBytes(), exch.RequestTarget())
-		handler(exch)
-	})
-}
+	// Read HTTP request.
+	var hdr httpraw.Header
+	var needMore bool = true
+	for needMore {
+		_, err := hdr.ReadFromLimited(conn, 1024)
+		if err != nil {
+			return fmt.Errorf("reading request: %w", err)
+		}
+		const asResponse = false
+		needMore, err = hdr.TryParse(asResponse)
+		if err != nil && !needMore {
+			return fmt.Errorf("parsing request: %w", err)
+		}
+	}
 
-// index serves the embedded page. The body goes straight to the connection, so
-// only its header ever sits in the exchange's buffer and the page's size does
-// not enter into how the router is configured.
-func (sv *httpServer) index(exch *httphi.Exchange) {
-	exch.RespondString(httphi.StatusOK, "text/html", indexhtml)
-}
+	method := string(hdr.Method())
+	uri := string(hdr.RequestURI())
+	fmt.Printf("< %s %s\n", method, uri)
 
-// stats reports what the stack has served, which is the quickest way to tell a
-// working link from a page that came out of a browser cache.
-func (sv *httpServer) stats(exch *httphi.Exchange) {
-	var buf [128]byte
-	body := append(buf[:0], "requests served: "...)
-	body = strconv.AppendUint(body, sv.served.Load(), 10)
-	body = append(body, "\nuptime: "...)
-	body = append(body, prettyDuration(time.Since(sv.start))...)
-	body = append(body, '\n')
-	exch.Respond(httphi.StatusOK, "text/plain", body)
+	// Build response body.
+
+	// Build HTTP response.
+	var resp httpraw.Header
+	resp.SetProtocol("HTTP/1.1")
+	resp.SetStatus("200", "OK")
+	resp.Set("Content-Type", "text/html")
+	resp.Set("Content-Length", strconv.Itoa(len(indexhtml)))
+	resp.Set("Connection", "close")
+	response, err := resp.AppendResponse(nil)
+	if err != nil {
+		return fmt.Errorf("building response: %w", err)
+	}
+	response = append(response, indexhtml...)
+
+	// Send response.
+	_, err = conn.Write(response)
+	if err != nil {
+		return fmt.Errorf("writing response: %w", err)
+	}
+	err = conn.Flush()
+	if err != nil {
+		return fmt.Errorf("flushing response: %w", err)
+	}
+	fmt.Printf("> %d bytes sent\n", len(response))
+
+	conn.Close()
+	return nil
 }
 
 func clear(buf []byte) {

examples/httptap/dhcp.go

@@ -168,7 +168,7 @@ func (d *dhcpInterceptor) buildDHCPResponse(buf []byte) (int, error) {
 	// DHCP responses must be broadcast since the client doesn't have
 	// an IP configured yet and the stack would drop unicast packets.
 	*efrm.DestinationHardwareAddr() = ethernet.BroadcastAddr()
-	*ifrm.DestinationAddr() = ipv4.BroadcastAddr()
+	*ifrm.DestinationAddr() = [4]byte{255, 255, 255, 255}
 	ifrm.SetTotalLength(totalIPLen)
 	ufrm.SetLength(udpLen)
 	// Source and destination IPs already set by dhcpv4.Server.Encapsulate.

examples/xcurl/main.go

@@ -305,9 +305,9 @@ func run() (err error) {
 	})
 
 	timeHTTPCreate := timer("create HTTP GET request")
-	var hdr httpraw.HeaderV1
+	var hdr httpraw.Header
 	hdr.SetMethod("GET")
-	hdr.SetRequestTarget("/")
+	hdr.SetRequestURI("/")
 	hdr.SetProtocol("HTTP/1.1")
 	hdr.Set("Host", flagHostToResolve)
 	hdr.Set("User-Agent", "lneto")

http/httphi/README.md

@@ -1,49 +0,0 @@
-# httφ
-
-Heapless HTTP/1.1 router with `net/http`-shaped handlers. Benchmarked against `net/http` and friends at [**soypat/httpbench**](https://github.com/soypat/httpbench).
-
-## Why
-
-`net/http` allocates per request: `Request`, header map, response buffer, goroutine. Fine on a
-server, fatal on a microcontroller. httφ pays that cost once, at `Router.Configure`:
-
-- Exchanges and goroutines are fixed there. Serving allocates nothing; memory does not grow with load.
-- No free exchange means `Handle` refuses the connection unclosed, rather than allocating one more of everything.
-- `Handle` takes an `io.ReadWriteCloser`, so the router runs over a raw socket, an [`lneto`](https://github.com/soypat/lneto) TCP stack or a test pipe. No listener, no OS, no clock.
-
-Parsing is [`httpraw`](../httpraw).
-
-## Example
-
-```go
-var mux httphi.MuxSlice
-mux.Handle("GET /", func(ex *httphi.Exchange) {
-	ex.WriteBody([]byte("hello world"))
-})
-
-var router httphi.Router
-cfg := httphi.DefaultRouterConfig(numWorkers, memoryPerConn, mux.MaxPathValues())
-err := router.Configure(&mux, cfg)
-if err != nil {
-	log.Fatal(err)
-}
-for {
-	conn, err := listener.Accept() // Accepting is the caller's job.
-	if err != nil {
-		log.Fatal(err)
-	}
-	if err = router.Handle(conn); err != nil {
-		conn.Close() // Refused: never blocks, never queues unboundedly.
-	}
-}
-```
-
-`FixedNumGoroutines: -1` gives the unbounded flavor, a goroutine and an exchange per connection.
-
-Runnable server over raw Linux sockets, plus query, form and multipart handlers:
-[`example_test.go`](./example_test.go).
-
-
-## Naming
-
-Gonna be honest with y'all. I initially wanted it to be named `httplo` until I saw I could write `httphi.MethHead` with a small change.

http/httphi/bench_test.go

@@ -1,137 +0,0 @@
-package httphi
-
-import (
-	"io"
-	"testing"
-
-	"github.com/soypat/lneto/http/httpraw"
-	"github.com/soypat/lneto/internal"
-)
-
-// benchConn replays a fixed request and discards the response. It allocates
-// nothing itself so benchmark alloc counts belong to the package under test.
-type benchConn struct {
-	request string
-	read    int
-	written int
-}
-
-func (c *benchConn) rewind() { c.read, c.written = 0, 0 }
-
-func (c *benchConn) Read(b []byte) (int, error) {
-	if c.read >= len(c.request) {
-		return 0, io.EOF
-	}
-	n := copy(b, c.request[c.read:])
-	c.read += n
-	return n, nil
-}
-
-func (c *benchConn) Write(b []byte) (int, error) {
-	c.written += len(b)
-	return len(b), nil
-}
-
-func (c *benchConn) Close() error { return nil }
-
-// benchBody is package level: converting a string literal to []byte inside the
-// handler would allocate on every request and hide the router's own cost.
-var benchBody = []byte("hello world")
-
-func benchExchange(b *testing.B, conn conn) *Exchange {
-	b.Helper()
-	const bufferSize = 1024
-	const numHeaderCap = 2
-	exch := new(Exchange)
-	exch.Configure(ExchangeConfig{
-		RawBuf:           make([]byte, 2*bufferSize),
-		RequestBufferLim: bufferSize,
-		NumHeaderKVCap:   numHeaderCap,
-	})
-	if !exch.Acquire(conn) {
-		b.Fatal("fresh exchange failed to acquire connection")
-	}
-	return exch
-}
-
-// BenchmarkHandle measures a whole exchange: read, parse, mux and respond.
-func BenchmarkHandle(b *testing.B) {
-	expect := []byte("123")
-	buf := make([]byte, 64)
-	for _, bb := range []struct {
-		name    string
-		request string
-		handler HandlerFunc
-	}{
-		{
-			name:    "GETWithHeadersAndQuery",
-			request: "GET /?abc=123 HTTP/1.1\r\nHost: tinygo.org\r\nUser-Agent: bench\r\nAccept: */*\r\nConnection: close\r\n\r\n",
-			handler: func(ex *Exchange) {
-				ex.StageHeader("Content-Type", "text/plain")
-				ex.StageHeaderIntBase("Content-Length", int64(len(benchBody)), 10)
-				data, present := ex.RequestQueryAppend(buf[:0], "abc", true)
-				if !present || !internal.BytesEqual(data, expect) {
-					panic("invalid result")
-				}
-				ex.WriteBody(benchBody)
-			},
-		},
-		{
-			name:    "NotFound",
-			request: "GET /nowhere HTTP/1.1\r\nHost: tinygo.org\r\n\r\n",
-			handler: nil, // Unregistered: exercises the 404 path.
-		},
-	} {
-		b.Run(bb.name, func(b *testing.B) {
-			var mux MuxSlice
-			if bb.handler != nil {
-				mux.Handle("GET /", bb.handler)
-			}
-			conn := &benchConn{request: bb.request}
-			exch := benchExchange(b, conn)
-			b.ReportAllocs()
-			b.SetBytes(int64(len(bb.request)))
-			b.ResetTimer()
-			for i := 0; i < b.N; i++ {
-				conn.rewind()
-				exch.Release()
-				exch.Acquire(conn)
-				Handle(exch, &mux, nopBackoff)
-			}
-		})
-	}
-}
-
-// benchForm is package level so the Form's pair slice is reused across requests,
-// as a real handler holding one per goroutine would.
-var benchForm httpraw.Form
-
-// BenchmarkRequestParseForm measures reading and parsing a urlencoded body into
-// a buffer the caller owns. Nothing on the path may allocate.
-func BenchmarkRequestParseForm(b *testing.B) {
-	const request = "POST /f HTTP/1.1\r\nHost: tinygo.org\r\n" +
-		"Content-Type: application/x-www-form-urlencoded\r\nContent-Length: 27\r\n\r\n" +
-		"user=gopher&msg=hello+world"
-	// The form owns its memory now, so pre-size it and forbid growth: an
-	// allocation on this path is the failure the benchmark is watching for.
-	benchForm.Reset(make([]byte, 0, 64), 2)
-	benchForm.EnableBufferGrowth(false)
-	var mux MuxSlice
-	mux.Handle("POST /f", func(ex *Exchange) {
-		err := ex.RequestParseForm(&benchForm, false, false)
-		if err != nil || benchForm.Len() != 2 {
-			panic("invalid result")
-		}
-	})
-	conn := &benchConn{request: request}
-	exch := benchExchange(b, conn)
-	b.ReportAllocs()
-	b.SetBytes(int64(len(request)))
-	b.ResetTimer()
-	for b.Loop() {
-		conn.rewind()
-		exch.Release()
-		exch.Acquire(conn)
-		Handle(exch, &mux, nopBackoff)
-	}
-}

http/httphi/example_test.go

@@ -1,103 +0,0 @@
-package httphi_test
-
-import (
-	"fmt"
-	"io"
-	"log"
-	"net"
-	"os"
-
-	"github.com/soypat/lneto/http/httphi"
-	"github.com/soypat/lneto/http/httpraw"
-)
-
-// ExampleRouter_linux goes over how to setup a linux server using raw linux connections.
-// See [ExampleMuxSlice_query_forms_multipart] on how to define handlers for common HTTP processing.
-func ExampleRouter() {
-	const numWorkers = 8
-	const memoryPerConn = 2048
-	var mux httphi.MuxSlice
-	mux.Handle("GET /", func(ex *httphi.Exchange) {
-		ex.WriteBody([]byte("hello world"))
-	})
-	var router httphi.Router
-	cfg := httphi.DefaultRouterConfig(numWorkers, memoryPerConn, mux.MaxPathValues())
-	err := router.Configure(&mux, cfg)
-	if err != nil {
-		log.Fatal(err)
-	}
-	const port = ":8080"
-	listener, err := net.Listen("tcp", port)
-	if err != nil {
-		log.Fatal(err)
-	}
-	log.Printf("server up at http://localhost%s", port)
-	for {
-		conn, err := listener.Accept()
-		if err != nil {
-			log.Fatal(err)
-		}
-		err = router.Handle(conn)
-		if err != nil {
-			log.Println("httphi.Router failed to handle connection:", err)
-		}
-	}
-}
-
-// ExampleMuxSlice_query_forms_multipart goes over how to define Handlers (HandleFunc).
-// See [ExampleRouter_linux] for how to setup the server.
-func ExampleMuxSlice_query_forms_multipart() {
-
-	var mux httphi.MuxSlice
-
-	mux.Handle("/users/{id}", func(ex *httphi.Exchange) {
-		userID := ex.PathValue("id")
-		fmt.Printf("someone requested data for user %s\n", userID)
-	})
-
-	mux.Handle("/query", func(ex *httphi.Exchange) {
-		// query parameter in URL.
-		const decodeQuery = true
-		const queryKey = "search"
-		valueRaw, present := ex.RequestQueryValue(queryKey)
-		if !present {
-			return
-		}
-		valueDecoded, present := ex.RequestQueryAppend(nil, queryKey, decodeQuery)
-		fmt.Printf("got query=%v %s=%s (raw:%s)\n", present, queryKey, valueDecoded, valueRaw)
-	})
-
-	mux.Handle("GET /form", func(ex *httphi.Exchange) {
-		// Request Body Form. The form owns the memory: hand it a buffer and
-		// forbid growth to bound what a request may spend.
-		var form httpraw.Form
-		form.Reset(make([]byte, 0, 1024), 8) // Room for 8 pairs.
-		form.EnableBufferGrowth(false)
-		err := ex.RequestParseForm(&form, false, false)
-		if err != nil {
-			ex.WriteHeader(httphi.StatusInternalServerError)
-			return
-		}
-		for i := range form.Len() {
-			k, v := form.Pair(i)
-			fmt.Printf("received form value %d: %s=%s\n", i, k, v)
-		}
-	})
-
-	mux.Handle("GET /file-upload", func(ex *httphi.Exchange) {
-		// File upload directly onto server using multipart.
-		formbuf := make([]byte, 1024)
-		_, err := ex.ReadMultiparts(nil, formbuf, func(hdr *httpraw.MultipartHeader) io.WriteCloser {
-			fp, err := os.Create(string(hdr.Filename))
-			if err != nil {
-				return nil
-			}
-			return fp // Will write full file contents to fp.
-		})
-		if err != nil {
-			ex.WriteHeader(httphi.StatusInternalServerError)
-			return
-		}
-	})
-
-}

http/httphi/exchange.go

@@ -1,830 +0,0 @@
-package httphi
-
-import (
-	"io"
-	"net"
-	"slices"
-	"strconv"
-	"sync/atomic"
-	"unsafe"
-
-	"github.com/soypat/lneto"
-	"github.com/soypat/lneto/http/httpraw"
-	"github.com/soypat/lneto/internal"
-)
-
-// maxStatusLine bounds the response status line: "HTTP/1.1 " + 3 digit code +
-// " " + longest [StatusText] + CRLF.
-const maxStatusLine = len("HTTP/1.1 ") + 3 + 1 + len("Network Authentication Required") + 2
-
-// Exchange is a single request-response cycle over a connection, playing the
-// part of both http.Request and http.ResponseWriter: Request* methods read the
-// request, [Exchange.StageHeader] and [Exchange.WriteBody] produce the response.
-// A [Router] owns a fixed pool of them, which is what bounds its memory.
-//
-// Request and response share one buffer, the response header being written over
-// the bytes that follow the parsed request header. Read the request body with
-// [Exchange.ReadBody] before setting response headers.
-type Exchange struct {
-	acquired       atomic.Bool
-	gen            atomic.Uint32
-	respTopBuf     [maxStatusLine]byte
-	respTopWritten uint8
-
-	rawbuf        []byte
-	respHeaderOff uint16
-	respHeaderLen uint16
-	reqHdr        httpraw.HeaderV1
-	pathValues    []PathValue
-	// bodyRW is the reader handed to [httpraw.Form.ReadLimited], kept here so
-	// boxing it into an io.Reader allocates nothing per request.
-	bodyRW ExchangeRW
-
-	hijacked bool
-	rw       conn
-
-	matchedPattern string
-
-	respRemains   int
-	respErr       error // Sticky: response is unrecoverable once a write fails.
-	headerWritten bool
-	normalizeKeys bool
-	nextFree      *Exchange
-	readErr       error
-}
-
-// ExchangeConfig is the memory an [Exchange] is fixed to for the rest of its
-// life by [Exchange.Configure]. A [Router] derives one per exchange from its
-// [RouterConfig], which is what bounds the router's memory.
-//
-// Fields open with Required, Conditional or Optional and the constraint in
-// brackets, as in [RouterConfig].
-type ExchangeConfig struct {
-	// Required [non-empty] single buffer holding the request header, the response
-	// header and any surplus body. See [Exchange.UnsafeRawBuffer].
-	RawBuf []byte
-	// Required [<=len(RawBuf)] bytes of RawBuf reserved for the request header,
-	// the rest being the response. Configure panics if it exceeds RawBuf.
-	RequestBufferLim int
-	// Required [>0] request header fields that may be parsed. A request carrying
-	// more is answered 431, see [httpraw.ErrHeaderTooMany].
-	NumHeaderKVCap int
-	// Optional [any] normalization of staged response header keys as they are
-	// written, i.e: "content-type" becomes "Content-Type".
-	NormalizeOutgoingKeys bool
-	// Optional [any] cap holding the request header to RequestBufferLim rather than
-	// growing it. A header outgrowing it is answered 431, see [httpraw.ErrBufferExhausted].
-	NoRequestBufferGrowth bool
-	// Conditional [len >=[Mux.MaxPathValues]] written to during [Mux.LookupHandler] in [Handle].
-	PathValuesBuf []PathValue
-}
-
-// HijackRaw is a low-level implementation of http.Hijacker interface.
-// A Hijack method is not exposed due to heap allocation implications and correctness concerns.
-// Below is what an actual implementation may look like:
-//
-//	func (exch *Exchange) Hijack() (net.Conn, *bufio.ReadWriter, error) {
-//		conn, ok := exch.rw.(net.Conn)
-//		if !ok {
-//			return nil, nil, errors.New("net.Conn not implemented")
-//		}
-//		_, data, err := exch.HijackRaw(nil)
-//		if err != nil {
-//			return nil, nil, err
-//		}
-//		var rd *bufio.ReadWriter
-//		if len(data) > 0 {
-//			rd = &bufio.ReadWriter{Reader: bufio.NewReader(bytes.NewReader(data))}
-//		}
-//		return conn, rd, nil
-//	}
-func (exch *Exchange) HijackRaw(dstBody []byte) (conn, []byte, error) {
-	data, err := exch.remainingSurplusBody()
-	if err != nil {
-		return nil, nil, err
-	}
-	exch.hijacked = true
-	dstBody = append(dstBody, data...)
-	return exch.rw, dstBody, nil
-}
-
-// Configure sets the memory the exchange works with for the rest of its life:
-// rawbuf holds the request header, the response header and any surplus body,
-// of which the first requestLim bytes are reserved for the request header.
-// Panics if requestLim exceeds the buffer. Set normalizeKeys to normalize
-// outgoing header keys, i.e: "content-type" to "Content-Type".
-func (exch *Exchange) Configure(cfg ExchangeConfig) {
-	respSize := len(cfg.RawBuf) - cfg.RequestBufferLim
-	if respSize < 0 {
-		panic("request lim larger than buffer")
-	}
-	exch.rawbuf = cfg.RawBuf
-	exch.reqHdr.Reset(cfg.RawBuf[:0:cfg.RequestBufferLim], cfg.NumHeaderKVCap)
-	exch.reqHdr.ConfigBufferGrowth(!cfg.NoRequestBufferGrowth)
-	exch.normalizeKeys = cfg.NormalizeOutgoingKeys
-	exch.pathValues = cfg.PathValuesBuf
-}
-
-// Acquire claims the exchange for conn and resets it to serve a new request,
-// reusing the buffer set by [Exchange.Configure]. Returns false if the exchange
-// is already serving, in which case conn is untouched.
-func (exch *Exchange) Acquire(conn conn) bool {
-	if !exch.acquired.CompareAndSwap(false, true) {
-		return false
-	}
-	exch.matchedPattern = ""
-	exch.gen.Add(1)
-	exch.readErr = nil
-	exch.respErr = nil
-	exch.hijacked = false
-	exch.respTopWritten = 0
-	exch.respHeaderOff = 0
-	exch.respHeaderLen = 0
-	exch.respRemains = 0
-	exch.rw = conn
-	exch.headerWritten = false
-	exch.nextFree = nil
-	clear(exch.pathValues)
-	exch.reqHdr.Reset(nil, 0)
-	return true
-}
-
-// Release closes the exchange's connection and frees the exchange for a future
-// [Exchange.Acquire]. The connection is left open if the handler took ownership
-// of it with [Exchange.HijackRaw].
-func (exch *Exchange) Release() {
-	if !exch.hijacked {
-		exch.rw.Close()
-	}
-	exch.rw = nil
-	exch.gen.Add(1)
-	exch.acquired.Store(false)
-}
-
-// UnsafeRawBuffer returns the contiguous buffer owned by [Exchange] being used for the request and response.
-//
-// Writing to it will mangle the entire request header+body and/or any staged response headers.
-// Does not return the buffer used for the response first line so can be safely
-// written to and used without modifying the staged response first line.
-//
-// To access only the request header buffer portion use [httpraw.HeaderV1.BufferRaw] limited
-// to [httpraw.HeaderV1.BufferParsed] as returned by [Exchange.requestHeaderRaw].
-// Writing to this aforementioned section will not change the contents read by [Exchange.ReadBody].
-//
-// In [Router] context, the size of this buffer is influenced directly by [RouterConfig] HeaderBufferSize fields.
-func (exch *Exchange) UnsafeRawBuffer() []byte { return exch.rawbuf }
-
-// RequestHeaderV1Raw returns the internal [Exchange] data structure used for HTTP/1.x requests.
-func (exch *Exchange) RequestHeaderV1Raw() *httpraw.HeaderV1 { return &exch.reqHdr }
-
-// StageHeader stages a response header field, written on the first
-// [Exchange.FlushHeader], [Exchange.WriteHeader] or [Exchange.WriteBody].
-// Returns false and drops the field if the response buffer cannot fit it.
-func (exch *Exchange) StageHeader(key, value string) (enoughMemory bool) {
-	off := int(exch.respHeaderOff) + int(exch.respHeaderLen)
-	free := len(exch.rawbuf) - off
-	// Field costs key+':'+value+CRLF, plus the CRLF [Exchange.FlushHeader]
-	// appends past the last field to close the header block.
-	if len(key)+len(value)+len(":\r\n")+len("\r\n") > free {
-		exch.respErr = lneto.ErrBufferFull // Omit writing header back to prevent incomplete response.
-		return false
-	}
-	n := copy(exch.rawbuf[off:], key)
-	if exch.normalizeKeys {
-		httpraw.NormalizeHeaderKey(exch.rawbuf[off : off+n])
-	}
-	exch.rawbuf[off+n] = ':'
-	n++
-	n += copy(exch.rawbuf[off+n:], value)
-	exch.rawbuf[off+n] = '\r'
-	exch.rawbuf[off+n+1] = '\n'
-	n += 2
-	exch.respHeaderLen += uint16(n)
-	return true
-}
-
-// StageHeaderBytes is [Exchange.StageHeader] with a byte slice value, i.e: a
-// field copied out of the request. The value is not retained.
-func (exch *Exchange) StageHeaderBytes(key string, value []byte) (enoughMemory bool) {
-	return exch.StageHeader(key, b2s(value))
-}
-
-// StageHeaderInt is [Exchange.StageHeaderIntBase] in base 10, which is the base
-// every HTTP field value carrying a number uses, i.e: Content-Length.
-func (exch *Exchange) StageHeaderInt(key string, value int64) (enoughMemory bool) {
-	return exch.StageHeaderIntBase(key, value, 10)
-}
-
-// StageHeaderIntBase is [Exchange.StageHeader] with an integer value, i.e: Content-Length.
-// It formats the value directly into the response buffer without allocating.
-// base must be in the range 10..36; lower bases are dropped, no HTTP header
-// field value is written below base 10.
-func (exch *Exchange) StageHeaderIntBase(key string, value int64, base int) (enoughMemory bool) {
-	if base < 10 || base > 36 {
-		return false
-	}
-	off := int(exch.respHeaderOff) + int(exch.respHeaderLen)
-	free := len(exch.rawbuf) - off
-	if len(key)+internal.IntLen(value, base)+len(":\r\n")+len("\r\n") > free {
-		exch.respErr = lneto.ErrBufferFull // Omit writing header back to prevent incomplete response.
-		return false
-	}
-	n := copy(exch.rawbuf[off:], key)
-	if exch.normalizeKeys {
-		httpraw.NormalizeHeaderKey(exch.rawbuf[off : off+n])
-	}
-	exch.rawbuf[off+n] = ':'
-	n++
-	n += len(strconv.AppendInt(exch.rawbuf[off+n:off+n], value, base))
-	exch.rawbuf[off+n] = '\r'
-	exch.rawbuf[off+n+1] = '\n'
-	n += 2
-	exch.respHeaderLen += uint16(n)
-	return true
-}
-
-// StageStatus prepares the status line for the given code without writing
-// it, i.e: "HTTP/1.1 404 Not Found". Codes with no [StatusText] get an empty
-// reason phrase.
-func (exch *Exchange) StageStatus(code int) {
-	if code >= 1000 {
-		return
-	} else if code == 200 {
-		// Common case.
-		exch.respTopWritten = uint8(copy(exch.respTopBuf[:], "HTTP/1.1 200 OK\r\n"))
-		return
-	}
-	n := copy(exch.respTopBuf[:], "HTTP/1.1 ")
-	n += len(strconv.AppendInt(exch.respTopBuf[n:n], int64(code), 10))
-	text := StatusText(code)
-	exch.respTopBuf[n] = ' '
-	n++
-	n += copy(exch.respTopBuf[n:], text)
-	exch.respTopBuf[n] = '\r'
-	exch.respTopBuf[n+1] = '\n'
-	exch.respTopWritten = uint8(n + 2)
-}
-
-// WriteHeader sends the status line for code along with the staged header
-// fields. Only the first call reaches the wire, as in http.ResponseWriter.
-func (exch *Exchange) WriteHeader(code int) (n int, err error) {
-	exch.StageStatus(code)
-	return exch.FlushHeader()
-}
-
-// Respond writes a complete response in one call: Content-Type, a Content-Length
-// taken from len(body), the status line and the body. An empty contentType
-// stages no Content-Type field, for a code that carries no entity.
-//
-// It also stages "Connection: close", the router serving one exchange per
-// connection, so a peer never waits on a response that is not coming.
-//
-// Returns [Exchange.ResponseError]: staged fields that did not fit and failed
-// writes are both reported there, so a truncated response cannot pass silently.
-func (exch *Exchange) Respond(code int, contentType string, body []byte) error {
-	exch.stageResponse(code, contentType, len(body))
-	exch.WriteBody(body) // Reports through respErr, checked below.
-	return exch.respErr
-}
-
-// RespondString is [Exchange.Respond] with a string body, saving the conversion.
-func (exch *Exchange) RespondString(code int, contentType, body string) error {
-	exch.stageResponse(code, contentType, len(body))
-	exch.WriteBodyString(body) // Reports through respErr, checked below.
-	return exch.respErr
-}
-
-// stageResponse stages the fields and status line a complete response needs.
-// Drops are recorded on respErr by the Stage* calls, so [Exchange.WriteBody]
-// declines to write a partial header afterwards.
-func (exch *Exchange) stageResponse(code int, contentType string, bodyLen int) {
-	if contentType != "" {
-		exch.StageHeader("Content-Type", contentType)
-	}
-	exch.StageHeaderInt("Content-Length", int64(bodyLen))
-	// One exchange per connection today, so the peer is told not to wait for a
-	// second response on it. Revisit once the router loops exchanges.
-	exch.StageHeader("Connection", "close")
-	exch.StageStatus(code)
-}
-
-// ResponseError returns any error encountered during staging of headers or during writing of response.
-// Provides an ergonomic way of checking if one ran out of buffer space after staging all headers with [Exchange.StageHeader].
-func (exch *Exchange) ResponseError() error {
-	return exch.respErr
-}
-
-// FlushHeader writes the status line and staged header fields to the connection
-// and returns the bytes written, defaulting to a 200 status if none was staged.
-// Does nothing if the header was already written.
-func (exch *Exchange) FlushHeader() (int, error) {
-	if exch.respErr != nil {
-		return 0, exch.respErr
-	} else if exch.headerWritten {
-		return 0, nil
-	}
-	if exch.respTopWritten == 0 {
-		exch.StageStatus(200)
-	}
-	exch.headerWritten = true
-	ng, err := exch.rw.Write(exch.respTopBuf[:exch.respTopWritten])
-	if err != nil {
-		exch.respErr = err
-		return ng, err
-	}
-	off := int(exch.respHeaderOff)
-	headers := exch.rawbuf[off : off+int(exch.respHeaderLen)+2]
-	headers[len(headers)-1] = '\n'
-	headers[len(headers)-2] = '\r'
-	ng2, err := exch.rw.Write(headers)
-	exch.respErr = err
-	return ng + ng2, err
-}
-
-// ExchangeRW is an [io.ReadWriteCloser] view of an [Exchange] wrapping
-// [Exchange.ReadBody] and [Exchange.WriteBody] methods.
-//
-// Exchanges are pooled and reused, so a handle records the exchange generation
-// it was taken at and refuses to touch the connection once that exchange moves
-// on to another request. Obtain one with [Exchange.ReadWriter].
-type ExchangeRW struct {
-	gen  uint32
-	exch *Exchange
-}
-
-// IsValid returns true while the handle still refers to the request it was
-// taken from, i.e: false once the exchange was released.
-func (rw *ExchangeRW) IsValid() bool {
-	return rw.gen == rw.exch.gen.Load() && rw.exch.acquired.Load()
-}
-
-func (rw *ExchangeRW) validate() error {
-	if !rw.IsValid() {
-		return net.ErrClosed
-	}
-	return nil
-}
-
-// Write writes response body bytes. See [Exchange.WriteBody].
-// Fails with [net.ErrClosed] once the handle is no longer valid.
-func (rw *ExchangeRW) Write(buf []byte) (int, error) {
-	if err := rw.validate(); err != nil {
-		return 0, err
-	}
-	return rw.exch.WriteBody(buf)
-}
-
-// WriteString wraps [Exchange.WriteBodyString]. Fails if handle no longer valid.
-func (rw *ExchangeRW) WriteString(s string) (int, error) {
-	if err := rw.validate(); err != nil {
-		return 0, err
-	}
-	return rw.exch.WriteBodyString(s)
-}
-
-// Read reads request body bytes. See [Exchange.ReadBody].
-// Fails with [net.ErrClosed] once the handle is no longer valid.
-func (rw *ExchangeRW) Read(buf []byte) (int, error) {
-	if err := rw.validate(); err != nil {
-		return 0, err
-	}
-	return rw.exch.ReadBody(buf)
-}
-
-// Close invalidates this handle so later reads and writes fail. It does not
-// close the connection nor end the exchange, both of which the [Router] owns.
-func (rw *ExchangeRW) Close() error {
-	if err := rw.validate(); err != nil {
-		return err
-	}
-	rw.gen--
-	return nil
-}
-
-// ReadWriter fills dst with a stream view of the exchange, valid until the
-// exchange is released. The caller owns dst, so a handler may keep one and
-// refill it every request without allocating.
-func (exch *Exchange) ReadWriter(dst *ExchangeRW) {
-	dst.gen = exch.gen.Load()
-	dst.exch = exch
-}
-
-// WriteBodyString implements [io.StringWriter] by unsafe conversion.
-// Most underlying [io.Writer] implementations are TCP transport and not modify/own the underlying buffer.
-func (exch *Exchange) WriteBodyString(buf string) (int, error) {
-	return exch.WriteBody(unsafe.Slice(unsafe.StringData(buf), len(buf)))
-}
-
-// WriteBody writes response body bytes, flushing the header first if the handler
-// has not written it yet. Once a write to the connection fails the response is
-// unrecoverable and every later write returns that same error, so a body never
-// reaches the wire without its header.
-func (exch *Exchange) WriteBody(buf []byte) (int, error) {
-	if exch.respErr != nil {
-		return 0, exch.respErr
-	} else if !exch.headerWritten {
-		_, err := exch.FlushHeader()
-		if err != nil {
-			return 0, err // Body must not reach the wire without its header.
-		}
-	}
-	if len(buf) == 0 {
-		return 0, nil
-	}
-	n, err := exch.rw.Write(buf)
-	exch.respErr = err
-	return n, err
-}
-
-// ReadBody reads the request body into dst, starting with the bytes that
-// arrived in the same read as the header and continuing from the connection.
-// The exchange does not know the body's length: use Content-Length or the
-// transfer encoding to know when to stop reading.
-func (exch *Exchange) ReadBody(dst []byte) (n int, _ error) {
-	if exch.respRemains > 0 {
-		toRead, err := exch.remainingSurplusBody()
-		if err != nil {
-			return 0, err
-		}
-		n = copy(dst, toRead)
-		exch.respRemains -= n
-		// hand over what already arrived since conn might have
-		// exhausted data and could block indefinetely.
-		return n, nil
-	}
-	return exch.rw.Read(dst)
-}
-
-func (exch *Exchange) remainingSurplusBody() ([]byte, error) {
-	_, err := exch.reqHdr.Body()
-	if err != nil {
-		return nil, err // Returns mangled buffer error if request header has been misused.
-	}
-	surplus := exch.rawbuf[exch.reqHdr.BufferParsed():exch.reqHdr.BufferReceived()]
-	toRead := surplus[len(surplus)-exch.respRemains:]
-	return toRead, nil
-}
-
-// MuxPattern returns the pattern [Mux] matched to the request.
-func (exch *Exchange) MuxPattern() string {
-	return exch.matchedPattern
-}
-
-// RequestParseCookie parses the request's key header field into dst, i.e:
-// "Cookie". The caller owns dst and its buffer, so it may be reused between
-// requests.
-func (exch *Exchange) RequestParseCookie(dst *httpraw.Cookie, key string) error {
-	value := exch.RequestHeader(key)
-	return dst.ParseBytes(value)
-}
-
-// RequestContentType returns the request's Content-Type field value as it
-// appears on the wire, parameters included, nil if absent. Test it with
-// [httpraw.MediaTypeIs] and pick parameters out with [httpraw.ContentParam].
-func (exch *Exchange) RequestContentType() []byte {
-	// Folded: field names are case insensitive and HTTP/2 mandates lowercase, so
-	// a proxy translating h2 to h1 sends "content-type", RFC 9110 5.1.
-	return exch.RequestHeader("Content-Type")
-}
-
-// RequestContentLength returns the body length declared by the request's
-// Content-Length field. An absent field is signalled with present=false and no error.
-// See [httpraw.HeaderV1.ContentLength].
-func (exch *Exchange) RequestContentLength() (_ int64, present bool, _ error) {
-	return exch.RequestHeaderV1Raw().ContentLength()
-}
-
-// RequestParseForm parses "application/x-www-form-urlencoded" pairs into dst
-// from the request body and, when parseURL is set, from the query string as
-// well. Pairs are stored as they arrived, call [httpraw.Form.Decode] to decode
-// them in place.
-//
-// dst owns the memory: both sources are read into its buffer and parsed together
-// once. Hand it a preallocated buffer with [httpraw.Form.Reset] and turn growth
-// off with [httpraw.Form.EnableBufferGrowth] to bound it, which then reports
-// [httpraw.ErrBufferExhausted] instead of allocating. It grows by default.
-//
-// prioritizeURL reads the query ahead of the body, so a key carried by both
-// resolves to the query's value: [httpraw.Form.Get] answers with the first pair
-// holding a key. Both stay readable in wire order through [httpraw.Form.Pair].
-// The body is consumed, so call this before [Exchange.ReadBody].
-//
-// A request with no Content-Length has no body, RFC 9112 6.3, and one with no
-// Content-Type declares no encoding to parse, RFC 9110 8.3. Neither is an error,
-// a bodiless POST being legal, and the query is still parsed when asked for. A
-// Content-Type that is present and not form encoded is [errNotFormEncoded].
-func (exch *Exchange) RequestParseForm(dst *httpraw.Form, parseURL, prioritizeURL bool) error {
-	dst.Reset(nil, 0) // Reuse whatever buffer dst holds, discarding old pairs.
-	if parseURL && prioritizeURL {
-		if err := exch.readQueryForm(dst); err != nil {
-			return err
-		}
-	}
-	if err := exch.readBodyForm(dst); err != nil {
-		return err
-	}
-	if parseURL && !prioritizeURL {
-		if err := exch.readQueryForm(dst); err != nil {
-			return err
-		}
-	}
-	return dst.Parse()
-}
-
-// formSeparator joins two sources inside one form buffer. Shared so appending it
-// converts no literal per call.
-var formSeparator = []byte{'&'}
-
-// readQueryForm appends the request's query string to dst's buffer.
-func (exch *Exchange) readQueryForm(dst *httpraw.Form) error {
-	query := exch.RequestQuery()
-	if len(query) == 0 {
-		return nil
-	} else if err := separateForm(dst); err != nil {
-		return err
-	}
-	return dst.ReadFromBytes(query)
-}
-
-// readBodyForm appends the request body to dst's buffer, reading until
-// Content-Length bytes have arrived.
-func (exch *Exchange) readBodyForm(dst *httpraw.Form) error {
-	contentType := exch.RequestContentType()
-	if contentType == nil {
-		return nil // No declared encoding is no form, RFC 9110 8.3.
-	} else if !httpraw.MediaTypeIs(contentType, "application/x-www-form-urlencoded") {
-		return errNotFormEncoded
-	} else if exch.RequestHeaderV1Raw().GetFold("Transfer-Encoding") != nil {
-		// Chunked bodies are framed, so reading Content-Length bytes off the
-		// wire would parse chunk sizes as form data. httpraw does not decode them.
-		return errUnsupportedTransferCoding
-	}
-	length, present, err := exch.RequestContentLength()
-	if err != nil {
-		return err
-	} else if !present || length == 0 {
-		return nil // No length is no body, RFC 9112 6.3.
-	}
-	if err = separateForm(dst); err != nil {
-		return err
-	}
-	// Reuse the exchange's own handle: a local would escape when boxed into the
-	// io.Reader [httpraw.Form.ReadLimited] takes, costing an allocation a request.
-	exch.ReadWriter(&exch.bodyRW)
-	// A single read may fall short of the limit, the body arriving a TCP segment
-	// at a time, so read until the declared length is in hand.
-	for read := 0; read < int(length); {
-		n, err := dst.ReadLimited(&exch.bodyRW, int(length)-read)
-		read += n
-		if n == 0 {
-			if err == nil {
-				err = io.ErrNoProgress
-			} else if err == io.EOF {
-				break // Peer sent less than it declared.
-			}
-			return err
-		} else if err != nil && err != io.EOF {
-			return err
-		}
-	}
-	return nil
-}
-
-// separateForm appends the '&' keeping two sources from merging into one pair,
-// doing nothing while dst holds no bytes yet.
-func separateForm(dst *httpraw.Form) error {
-	if dst.BufferUsed() == 0 {
-		return nil
-	}
-	return dst.ReadFromBytes(formSeparator)
-}
-
-// RequestMultipart returns a parser prepared from the boundary parameter of the
-// request's Content-Type field. It reads no body: multipart parts declare no
-// length, so the caller drives the loop with a buffer it owns and decides per
-// part what to keep and when a part has grown too large. See
-// [Exchange.ReadMultiparts] for that loop already written.
-func (exch *Exchange) RequestMultipart() (mp httpraw.Multipart, err error) {
-	contentType := exch.RequestContentType()
-	if !httpraw.MediaTypeIs(contentType, "multipart/form-data") {
-		return mp, errNotMultipart
-	}
-	return mp, mp.SetContentType(contentType)
-}
-
-// MultipartSink is a part of a multipart body together with the writer its
-// content was streamed to, as appended by [Exchange.ReadMultiparts].
-type MultipartSink struct {
-	// Header identifies the part. Name and Filename are copies, so they
-	// outlive the read buffer; PartView does not, see [httpraw.MultipartHeader].
-	Header httpraw.MultipartHeader
-	// Sink received the part's content and was closed when the part ended,
-	// nil for a part newSink chose to discard.
-	Sink io.WriteCloser
-}
-
-// ReadMultiparts streams the request's "multipart/form-data" body, writing each
-// part to a sink newSink returns for it and appending the pair to dst. buf is the
-// only storage used and content is never held whole, so a part of any length
-// streams through a buffer the caller sized. dst is appended to and returned, so
-// a handler may hand back the slice of a previous request to reuse its parts.
-//
-// newSink is called once per part, before any of its content is read, and picks
-// what to do with it from hdr.Name and hdr.Filename: return a writer to keep the
-// part, or nil to discard its content and keep only the header. Each sink is
-// closed as soon as its part ends, so Close reports the part arrived whole; on
-// error the sink of the part being read is left open for the caller to deal with.
-//
-// A part header that does not fit buf is refused with [lneto.ErrShortBuffer],
-// since reading more can never complete it, leaving the caller free to answer
-// 413. The body is consumed, so call this before [Exchange.ReadBody].
-func (exch *Exchange) ReadMultiparts(dst []MultipartSink, buf []byte, newSink func(hdr *httpraw.MultipartHeader) io.WriteCloser) (_ []MultipartSink, _ error) {
-	mp, err := exch.RequestMultipart()
-	if err != nil {
-		return dst, err
-	} else if newSink == nil || len(buf) <= len("\r\n--")+len(mp.Boundary) {
-		// A buffer that cannot outgrow a delimiter never makes progress.
-		return dst, lneto.ErrInvalidConfig
-	}
-	buflen := 0
-	for {
-		// Slot for the next part, given back when the body turns out to be
-		// over, so its Name and Filename buffers stay available for reuse.
-		part := internal.SliceReclaim(&dst)
-		var parsed int
-		for {
-			parsed, err = mp.NextHeader(&part.Header, buf[:buflen])
-			if err != nil {
-				dst = dst[:len(dst)-1]
-				if err == io.EOF {
-					err = nil // Closing delimiter, body done.
-				}
-				return dst, err
-			} else if parsed > 0 {
-				break // Delimiter and header block complete.
-			} else if buflen == len(buf) {
-				dst = dst[:len(dst)-1]
-				return dst, lneto.ErrShortBuffer // Header longer than buf.
-			}
-			// A read that both delivers and fails, as the last of the body
-			// followed by a hangup does, may still hold what the parser is
-			// waiting for: take the data and let the error surface on the
-			// next read.
-			n, readErr := exch.ReadBody(buf[buflen:])
-			buflen += n
-			if n == 0 && readErr != nil {
-				dst = dst[:len(dst)-1]
-				return dst, readErr
-			}
-		}
-		part.Sink = newSink(&part.Header)
-		buflen = copy(buf, buf[parsed:buflen])
-		for {
-			bodyLen, restOff, done := mp.NextBody(buf[:buflen])
-			if bodyLen > 0 && part.Sink != nil {
-				_, err = part.Sink.Write(buf[:bodyLen])
-				if err != nil {
-					return dst, err
-				}
-			}
-			buflen = copy(buf, buf[restOff:buflen])
-			if done {
-				break // Buffer now starts at the next part's delimiter.
-			}
-			n, readErr := exch.ReadBody(buf[buflen:])
-			buflen += n
-			if n == 0 && readErr != nil {
-				return dst, readErr // Body ended mid part.
-			}
-		}
-		if part.Sink != nil {
-			if err = part.Sink.Close(); err != nil {
-				return dst, err
-			}
-		}
-	}
-}
-
-// RequestHeader returns the value of the first request header field matching
-// key, or nil if absent. Matching is not case sensitive.
-func (exch *Exchange) RequestHeader(key string) []byte {
-	header := exch.RequestHeaderV1Raw()
-	return header.GetFold(key)
-}
-
-// RequestTarget returns the request-target (URI) of the request line, i.e:
-// "/search?q=go". See [httpraw.HeaderV1.RequestTarget].
-func (exch *Exchange) RequestTarget() []byte {
-	return exch.RequestHeaderV1Raw().RequestTarget()
-}
-
-// RequestPath returns the request-target (URI) up to the query string. This is
-// what the [Mux] matches on, i.e: "/search" for a request to "/search?q=go".
-func (exch *Exchange) RequestPath() []byte {
-	return exch.RequestHeaderV1Raw().RequestPath()
-}
-
-// RequestQuery returns the request's query string as it appears on the wire.
-// Iterate it with [httpraw.NextQueryPair].
-func (exch *Exchange) RequestQuery() []byte {
-	return exch.RequestHeaderV1Raw().RequestQuery()
-}
-
-// RequestQueryValue returns an undecoded view of the first query parameter
-// matching key and reports whether it was present. Keys are matched decoded, so
-// key "a b" finds "a%20b" and "a+b"; a parameter whose key is a malformed
-// escape is skipped. A parameter with no value ("?debug") and one with an empty
-// value ("?debug=") are both present with a zero length view.
-//
-// The view aliases the request buffer, so copy it to outlive the handler or use
-// [Exchange.RequestQueryAppend] to decode it out.
-func (exch *Exchange) RequestQueryValue(key string) (rawValue []byte, present bool) {
-	const plusAsSpace = true // Query strings are form encoded, unlike paths.
-	rawkey, rawval, rest := httpraw.NextQueryPair(exch.RequestQuery())
-	for ; rawkey != nil; rawkey, rawval, rest = httpraw.NextQueryPair(rest) {
-		// Compare raw first: a key needing no decoding is the common case, and
-		// the decoding compare walks the key an escape at a time.
-		if b2s(rawkey) == key || httpraw.EqualDecodedPercentURL(rawkey, key, plusAsSpace) {
-			return rawval, true
-		}
-	}
-	return nil, false
-}
-
-// RequestQueryAppend appends the value of the first query parameter matching key to
-// dst and reports whether the parameter was present, matching keys as
-// [Exchange.RequestQueryValue] does. A parameter with no value ("?debug") and
-// one with an empty value ("?debug=") are both present with nothing appended.
-//
-// Values are appended raw unless decoded is set, in which case percent escapes
-// and '+' are decoded. A parameter whose value fails to decode is reported
-// absent, dst being left as it was rather than holding half a decode.
-func (exch *Exchange) RequestQueryAppend(dst []byte, key string, decoded bool) (valueAppended []byte, present bool) {
-	const plusAsSpace = true // Query strings are form encoded, unlike paths.
-	rawval, present := exch.RequestQueryValue(key)
-	if !present || len(rawval) == 0 {
-		return dst, present
-	}
-	if !decoded {
-		return append(dst, rawval...), true
-	}
-	base := len(dst)
-	dst = slices.Grow(dst, len(rawval))
-	n, err := httpraw.CopyDecodedPercentURL(dst[base:base+len(rawval)], rawval, plusAsSpace)
-	if err != nil {
-		return dst[:base], false // Do not hand back half a decode.
-	}
-	return dst[:base+n], true
-}
-
-// PathValue returns the segment the request path bound to the wildcard named
-// key, or nil if the matched pattern has no such wildcard. It plays the part of
-// http.Request.PathValue. See [SetPathValues] for the pattern syntax and for
-// which segments a wildcard binds.
-//
-//	sm.Handle("GET /users/{id}", func(exch *httphi.Exchange) {
-//		id := exch.PathValue("id") // "42" on a GET /users/42.
-//	})
-func (exch *Exchange) PathValue(key string) []byte {
-	for i := range exch.pathValues {
-		if exch.pathValues[i].Key == key {
-			return exch.pathValues[i].Value
-		} else if exch.pathValues[i].Key == "" {
-			break // No more keys set.
-		}
-	}
-	return nil
-}
-
-// PathValueAppend acceses the result of [Exchange.PathValue] and appends it to dst.
-// If decoded is set to true the result will be URL-percent decoded. An error is returned if URL-percent decoding fails.
-func (exch *Exchange) PathValueAppend(dst []byte, key string, decoded bool) ([]byte, error) {
-	const plusAsSpace = true
-	rawValue := exch.PathValue(key)
-	if !decoded || len(rawValue) == 0 {
-		return append(dst, rawValue...), nil
-	}
-	base := len(dst)
-	dst = slices.Grow(dst, len(rawValue))
-	n, err := httpraw.CopyDecodedPercentURL(dst[base:base+len(rawValue)], rawValue, plusAsSpace)
-	if err != nil {
-		return dst[:base], err // Do not hand back half a decode.
-	}
-	return dst[:base+n], nil
-}
-
-// RequestMethod returns the request's [Method] enum.
-func (exch *Exchange) RequestMethod() Method {
-	return MethodFromBytes(exch.RequestMethodBytes())
-}
-
-// RequestMethodBytes returns the request line's method as a []byte view, i.e: "GET".
-func (exch *Exchange) RequestMethodBytes() []byte {
-	return exch.RequestHeaderV1Raw().Method()
-}
-
-// RequestConnectionClose returns true if the client asked for the connection to
-// be closed after this exchange with a "Connection: close" header field.
-func (exch *Exchange) RequestConnectionClose() bool {
-	return exch.RequestHeaderV1Raw().ConnectionClose()
-}

http/httphi/httphi_fuzz_test.go

@@ -1,419 +0,0 @@
-package httphi
-
-import (
-	"bytes"
-	"io"
-	"strings"
-	"testing"
-
-	"github.com/soypat/lneto/http/httpraw"
-)
-
-// Fuzz targets in this file are written so that a stored corpus keeps its
-// meaning as the tests grow. Go's corpus files are positional and typed, so an
-// input is only reproducible while the code that decodes it stays fixed. Five
-// rules keep that true, and edits to this file must obey them:
-//
-//  1. A target's signature is frozen: func(t *testing.T, ctrl uint64, data []byte).
-//     Adding, removing or reordering a parameter invalidates every stored entry.
-//  2. Control decisions come from ctrl only, wire bytes from data only. Never
-//     branch on data, never put payload in ctrl: the two axes mutate apart.
-//  3. ctrl is a bit field read through absolute shifts and masks named below.
-//     New knobs claim unused high bits and are only ever appended, never
-//     renumbered, and the zero value of a knob must decode to the behaviour that
-//     existed before it was added, so old entries keep replaying as they did.
-//  4. No PRNG, no cursor. No rand, no internal.Prand64, and no helper that
-//     "reads the next N bits" while advancing a position: inserting one draw
-//     ahead of another shifts every later decision, which is the same corpus
-//     invalidation a PRNG causes.
-//  5. Nothing ambient: no wall clock, no goroutines, no map iteration order.
-//     Targets drive [Handle] on the calling goroutine; [Router] is not fuzzed
-//     here precisely because it serves on goroutines of its own.
-const (
-	// Bits 0..3 index segSizes: how the request is split across reads.
-	ctlSegShift, ctlSegMask = 0, 0xf
-	// Bits 4..7 and 8..11 size the request and response halves of the buffer.
-	ctlReqBufShift, ctlRespBufShift, ctlBufMask = 4, 8, 0xf
-	// Bits 12..13 size the request header field table.
-	ctlKVCapShift, ctlKVCapMask = 12, 0x3
-	// Bit 14 normalizes outgoing header keys.
-	ctlNormalizeShift, ctlNormalizeMask = 14, 0x1
-	// Bits 15..16 make that many leading writes to the connection fail.
-	ctlFailWriteShift, ctlFailWriteMask = 15, 0x3
-	// Bits 17..20 select what the handler does, see the op constants.
-	ctlHandlerOpsShift, ctlHandlerOpsMask = 17, 0xf
-	// Bits 21..23 count the header fields the handler stages.
-	ctlStageCountShift, ctlStageCountMask = 21, 0x7
-	// Bit 24 asks AppendQuery for decoded values.
-	ctlDecodeShift, ctlDecodeMask = 24, 0x1
-	// Bits 25..28 size the scratch buffer handed to form and multipart parsing.
-	ctlScratchShift, ctlScratchMask = 25, 0xf
-	// Bit 29 makes the multipart sink discard part content.
-	ctlDiscardShift, ctlDiscardMask = 29, 0x1
-	// Next knob starts at bit 30.
-)
-
-// Handler operations, selected by the ctlHandlerOps field. Values are frozen:
-// a new operation takes the next free bit within the field.
-const (
-	opStageHeaders = 1 << iota
-	opReadBody
-	opWriteBody
-	opHijack
-)
-
-// segSizes are the chunk sizes a request may be delivered in, index 0 meaning
-// "all at once". Splitting a request mid-CRLF or before a colon is what drives
-// [httpraw.HeaderV1.TryParse]'s resumption path. Entries may be appended, never
-// changed: an existing index must keep splitting exactly as it does today.
-var segSizes = [16]int{0, 1, 2, 3, 5, 7, 11, 16, 23, 37, 64, 101, 173, 256, 509, 1024}
-
-// ctlField reads a knob out of ctrl. Absolute shift, no cursor, so knobs are
-// independent of one another and of the order they are read in.
-func ctlField(ctrl uint64, shift, mask uint64) uint64 {
-	return (ctrl >> shift) & mask
-}
-
-// maxFuzzInput bounds the wire data a target accepts. The filter depends only
-// on the input, so it classifies an entry the same way on every run.
-const maxFuzzInput = 16 << 10
-
-// fuzzExchange returns an exchange acquired on a connection preloaded with data,
-// both sized and segmented by ctrl.
-func fuzzExchange(t *testing.T, ctrl uint64, data []byte) (*Exchange, *rwconn) {
-	t.Helper()
-	reqBuf := minRequestHeaderBuffer + int(ctlField(ctrl, ctlReqBufShift, ctlBufMask))*8
-	respBuf := minResponseHeaderBuffer + int(ctlField(ctrl, ctlRespBufShift, ctlBufMask))*8
-	kvCap := 1 + int(ctlField(ctrl, ctlKVCapShift, ctlKVCapMask))*8
-
-	conn := newConn("")
-	seg := segSizes[ctlField(ctrl, ctlSegShift, ctlSegMask)]
-	if seg <= 0 || seg >= len(data) {
-		conn.AddReadable(data)
-	} else {
-		for off := 0; off < len(data); off += seg {
-			conn.AddSegment(string(data[off:min(off+seg, len(data))]))
-		}
-	}
-	// Always hang up: a drained connection that never reports EOF reads (0,nil)
-	// forever and [Handle] would back off in an unbounded loop.
-	conn.Hangup()
-	if n := ctlField(ctrl, ctlFailWriteShift, ctlFailWriteMask); n > 0 {
-		conn.FailWrites(int(n))
-	}
-	exch := newExchange(t, conn, ExchangeConfig{
-		RawBuf:                make([]byte, reqBuf+respBuf),
-		RequestBufferLim:      reqBuf,
-		NumHeaderKVCap:        kvCap,
-		NormalizeOutgoingKeys: ctlField(ctrl, ctlNormalizeShift, ctlNormalizeMask) != 0,
-		NoRequestBufferGrowth: true,
-	})
-	return exch, conn
-}
-
-// checkRequestView asserts the request-target views agree with one another.
-func checkRequestView(t *testing.T, exch *Exchange) {
-	t.Helper()
-	target, path, query := exch.RequestTarget(), exch.RequestPath(), exch.RequestQuery()
-	if !bytes.HasPrefix(target, path) {
-		t.Fatalf("path %q is not a prefix of target %q", path, target)
-	}
-	if len(query) > 0 && !bytes.HasSuffix(target, query) {
-		t.Fatalf("query %q is not a suffix of target %q", query, target)
-	}
-	if len(path)+len(query) > len(target) {
-		t.Fatalf("path %q and query %q exceed target %q", path, query, target)
-	}
-}
-
-// checkResponse asserts that whatever reached the wire is a response a peer
-// could parse: a status line this package produced, followed by a header block
-// that terminates, and that [httpraw] reads back what it wrote.
-func checkResponse(t *testing.T, written string) {
-	t.Helper()
-	if written == "" {
-		return // Hijacked, or a request refused before anything was staged.
-	}
-	const proto = "HTTP/1.1 "
-	if !strings.HasPrefix(written, proto) {
-		t.Fatalf("response does not open with a status line: %q", written)
-	}
-	if len(written) < len(proto)+4 {
-		t.Fatalf("status line truncated: %q", written)
-	}
-	for _, c := range []byte(written[len(proto) : len(proto)+3]) {
-		if c < '0' || c > '9' {
-			t.Fatalf("status code is not three digits: %q", written)
-		}
-	}
-	if written[len(proto)+3] != ' ' {
-		t.Fatalf("status code not followed by a space: %q", written)
-	}
-	if !strings.Contains(written, "\r\n\r\n") {
-		t.Fatalf("header block never terminated: %q", written)
-	}
-	var resp httpraw.HeaderV1
-	const asResponse = true
-	if err := resp.ParseBytes(asResponse, []byte(written)); err != nil {
-		t.Fatalf("response does not parse back: %s in %q", err, written)
-	}
-}
-
-// handler2Path is a second registration so lookup does not always match on the
-// first entry of the mux.
-const handler2Path = "/fuzz"
-
-// fuzzMux returns a mux serving handler on the paths the seed corpus requests.
-func fuzzMux(handler HandlerFunc) *MuxSlice {
-	var mux MuxSlice
-	mux.Handle("/", handler)
-	mux.Handle(handler2Path, handler)
-	return &mux
-}
-
-// FuzzHandleRequest drives a whole exchange: a request off the wire through
-// [Handle], a handler staging and writing a response, and back out to the peer.
-func FuzzHandleRequest(f *testing.F) {
-	addSeeds(f)
-	f.Fuzz(func(t *testing.T, ctrl uint64, data []byte) {
-		if len(data) > maxFuzzInput {
-			return
-		}
-		exch, conn := fuzzExchange(t, ctrl, data)
-		ops := ctlField(ctrl, ctlHandlerOpsShift, ctlHandlerOpsMask)
-		stage := ctlField(ctrl, ctlStageCountShift, ctlStageCountMask)
-
-		Handle(exch, fuzzMux(func(exch *Exchange) {
-			checkRequestView(t, exch)
-			if ops&opStageHeaders != 0 {
-				// Literal fields: staging request bytes would test the caller's
-				// escaping, not this package's framing.
-				for i := range stage {
-					exch.StageHeader("X-Fuzz", "value")
-					exch.StageHeaderIntBase("X-Fuzz-Int", int64(i), 10)
-				}
-			}
-			if ops&opReadBody != 0 {
-				var body [64]byte
-				for range 64 {
-					n, err := exch.ReadBody(body[:])
-					if n == 0 && err != nil {
-						break
-					}
-				}
-			}
-			if ops&opWriteBody != 0 {
-				exch.WriteBody([]byte("fuzz body"))
-			}
-			if ops&opHijack != 0 {
-				exch.HijackRaw(nil)
-			}
-		}), nopBackoff)
-
-		if ctlField(ctrl, ctlFailWriteShift, ctlFailWriteMask) == 0 {
-			// A refused write leaves a partial response on purpose, so the
-			// wire is only well formed when every write got through.
-			checkResponse(t, conn.ViewWritten())
-		}
-	})
-}
-
-// FuzzQueryAndForm drives the request-target query and the form-encoded body,
-// both of which decode percent escapes in place over caller memory.
-func FuzzQueryAndForm(f *testing.F) {
-	addSeeds(f)
-	f.Fuzz(func(t *testing.T, ctrl uint64, data []byte) {
-		if len(data) > maxFuzzInput {
-			return
-		}
-		exch, _ := fuzzExchange(t, ctrl, data)
-		decoded := ctlField(ctrl, ctlDecodeShift, ctlDecodeMask) != 0
-		scratchLen := 8 + int(ctlField(ctrl, ctlScratchShift, ctlScratchMask))*16
-
-		Handle(exch, fuzzMux(func(exch *Exchange) {
-			// Every pair the iterator yields must be reachable by name, or the
-			// two views of the query string disagree.
-			const maxPairs = 64
-			key, _, rest := httpraw.NextQueryPair(exch.RequestQuery())
-			for pairs := 0; key != nil && pairs < maxPairs; pairs++ {
-				dec := make([]byte, len(key))
-				n, err := httpraw.CopyDecodedPercentURL(dec, key, true)
-				if err == nil {
-					if n > len(key) {
-						t.Fatalf("decoding key %q grew it to %d bytes", key, n)
-					}
-					if _, present := exch.RequestQueryAppend(nil, string(dec[:n]), decoded); !present {
-						t.Fatalf("query pair %q absent from AppendQuery", key)
-					}
-				}
-				key, _, rest = httpraw.NextQueryPair(rest)
-			}
-
-			var form httpraw.Form
-			buf := make([]byte, scratchLen)
-			if err := exch.RequestParseForm(&form, false, false); err != nil {
-				return
-			}
-			total := 0
-			lens := make([]int, form.Len())
-			for i := range form.Len() {
-				k, v := form.Pair(i)
-				lens[i] = len(k) + len(v)
-				total += lens[i]
-			}
-			if total > len(buf) {
-				t.Fatalf("form pairs span %d bytes of a %d byte buffer", total, len(buf))
-			}
-			if err := form.Decode(); err != nil {
-				return
-			}
-			// Decoding replaces escapes in place, so no pair may grow.
-			for i := range form.Len() {
-				k, v := form.Pair(i)
-				if len(k)+len(v) > lens[i] {
-					t.Fatalf("pair %d grew from %d to %d bytes on decode", i, lens[i], len(k)+len(v))
-				}
-			}
-		}), nopBackoff)
-	})
-}
-
-// countSink counts what a multipart part streamed into it and whether the part
-// was closed off.
-type countSink struct {
-	written int
-	closed  bool
-}
-
-func (c *countSink) Write(b []byte) (int, error) {
-	c.written += len(b)
-	return len(b), nil
-}
-
-func (c *countSink) Close() error {
-	c.closed = true
-	return nil
-}
-
-// FuzzMultipart drives [Exchange.ReadMultiparts], which streams a body of
-// unknown length through a buffer the caller sized.
-func FuzzMultipart(f *testing.F) {
-	addSeeds(f)
-	f.Fuzz(func(t *testing.T, ctrl uint64, data []byte) {
-		if len(data) > maxFuzzInput {
-			return
-		}
-		exch, _ := fuzzExchange(t, ctrl, data)
-		discard := ctlField(ctrl, ctlDiscardShift, ctlDiscardMask) != 0
-		bufLen := 16 + int(ctlField(ctrl, ctlScratchShift, ctlScratchMask))*16
-
-		Handle(exch, fuzzMux(func(exch *Exchange) {
-			var sinks []*countSink
-			_, err := exch.ReadMultiparts(nil, make([]byte, bufLen), func(hdr *httpraw.MultipartHeader) io.WriteCloser {
-				if discard {
-					return nil
-				}
-				sink := new(countSink)
-				sinks = append(sinks, sink)
-				return sink
-			})
-			if err != nil {
-				return // Sinks are left for the caller to deal with on error.
-			}
-			total := 0
-			for _, sink := range sinks {
-				if !sink.closed {
-					t.Fatal("ReadMultiparts returned with a part left open")
-				}
-				total += sink.written
-			}
-			if total > len(data) {
-				t.Fatalf("parts streamed %d bytes out of a %d byte request", total, len(data))
-			}
-		}), nopBackoff)
-	})
-}
-
-// addSeeds adds the shared seed corpus. Every seed pins ctrl to zero so its
-// meaning never moves: knobs added later decode their zero value to the
-// behaviour the seed was recorded under.
-func addSeeds(f *testing.F) {
-	f.Helper()
-	const (
-		formType = "Content-Type: application/x-www-form-urlencoded\r\n"
-		mpType   = "Content-Type: multipart/form-data; boundary=b0undary\r\n"
-	)
-	seeds := []string{
-		// Well formed traffic, so the fuzzer has somewhere to mutate from.
-		"GET / HTTP/1.1\r\nHost: h\r\n\r\n",
-		"GET /fuzz?q=go&n=1 HTTP/1.1\r\nHost: h\r\n\r\n",
-		"POST /fuzz HTTP/1.1\r\nHost: h\r\n" + formType + "Content-Length: 11\r\n\r\na=1&b=2&c=3",
-		"POST /fuzz HTTP/1.1\r\nHost: h\r\n" + mpType + "Content-Length: 76\r\n\r\n--b0undary\r\nContent-Disposition: form-data; name=\"f\"\r\n\r\nbody\r\n--b0undary--\r\n",
-
-		// Framing the RFC leaves room to disagree over, which is where request
-		// smuggling lives: two lengths, a length plus a coding, and a coding
-		// this package does not decode.
-		"POST / HTTP/1.1\r\nHost: h\r\nContent-Length: 3\r\nContent-Length: 4\r\n\r\nabcd",
-		"POST / HTTP/1.1\r\nHost: h\r\nContent-Length: 3\r\nTransfer-Encoding: chunked\r\n\r\n1\r\na\r\n0\r\n\r\n",
-		"POST / HTTP/1.1\r\nHost: h\r\nTransfer-Encoding: chunked\r\n\r\n4\r\nbody\r\n0\r\n\r\n",
-
-		// Field names are case insensitive, RFC 9110 5.1, so a lookup that
-		// misses one of these reads the request differently than the peer wrote it.
-		"POST / HTTP/1.1\r\nHost: h\r\ncontent-length: 4\r\n\r\nbody",
-		"POST / HTTP/1.1\r\nHost: h\r\nCONTENT-LENGTH: 4\r\n\r\nbody",
-		"POST /fuzz HTTP/1.1\r\nHost: h\r\ncontent-type: application/x-www-form-urlencoded\r\ncontent-length: 3\r\n\r\na=1",
-
-		// Content-Length values that are not a bare digit string, RFC 9112 6.2.
-		"POST / HTTP/1.1\r\nHost: h\r\nContent-Length: +5\r\n\r\nbody!",
-		"POST / HTTP/1.1\r\nHost: h\r\nContent-Length: -1\r\n\r\nbody",
-		"POST / HTTP/1.1\r\nHost: h\r\nContent-Length: 1 2\r\n\r\nbody",
-		"POST / HTTP/1.1\r\nHost: h\r\nContent-Length:\r\n\r\nbody",
-		"POST / HTTP/1.1\r\nHost: h\r\nContent-Length: 9223372036854775808\r\n\r\nbody",
-
-		// Line ending and field syntax edges.
-		"GET / HTTP/1.1\nHost: h\n\n",
-		"GET / HTTP/1.1\r\nHost: h\rX: y\r\n\r\n",
-		"GET / HTTP/1.1\r\nHost: h\r\n Continued: fold\r\n\r\n",
-		"GET / HTTP/1.1\r\nHost: h\r\nX: va\x00lue\r\n\r\n",
-		"GET / HTTP/1.1\r\nHost: h\r\nNoColon\r\n\r\n",
-		"GET / HTTP/1.1\r\nHost: h\r\n: novalue\r\n\r\n",
-		"GET / HTTP/1.1\r\nHost: h\r\nX:\r\n\r\n",
-		"GET / HTTP/1.1\r\nHost: h\r\n\r\n\r\n",
-
-		// Request lines this package tolerates or must refuse.
-		"GET http://h/abs HTTP/1.1\r\nHost: h\r\n\r\n",
-		"GET /\r\n\r\n", // HTTP/0.9 simple request, no version.
-		" GET / HTTP/1.1\r\nHost: h\r\n\r\n",
-		"GET  / HTTP/1.1\r\nHost: h\r\n\r\n",
-		"/ HTTP/1.1\r\nHost: h\r\n\r\n",
-		"GET / HTTP/9.9\r\nHost: h\r\n\r\n",
-
-		// Percent escapes, including the truncated and the malformed.
-		"GET /a%20b?a%20b=c%20d HTTP/1.1\r\nHost: h\r\n\r\n",
-		"GET /?q=%2 HTTP/1.1\r\nHost: h\r\n\r\n",
-		"GET /?q=%zz HTTP/1.1\r\nHost: h\r\n\r\n",
-		"GET /%00?a=%00 HTTP/1.1\r\nHost: h\r\n\r\n",
-		"GET /?a=b=c&&=v&debug HTTP/1.1\r\nHost: h\r\n\r\n",
-		"GET /?a%3db=1&a+b=2 HTTP/1.1\r\nHost: h\r\n\r\n",
-
-		// Multipart bodies that end early or never open a part.
-		"POST /fuzz HTTP/1.1\r\nHost: h\r\n" + mpType + "Content-Length: 12\r\n\r\n--b0undary\r\n",
-		"POST /fuzz HTTP/1.1\r\nHost: h\r\n" + mpType + "Content-Length: 14\r\n\r\n--b0undary--\r\n",
-		"POST /fuzz HTTP/1.1\r\nHost: h\r\nContent-Type: multipart/form-data\r\nContent-Length: 4\r\n\r\nbody",
-
-		// Sizes that crowd the buffers: a long target, many fields, and a body
-		// arriving in the same read as the header it follows.
-		"GET /" + strings.Repeat("a", 512) + " HTTP/1.1\r\nHost: h\r\n\r\n",
-		"GET / HTTP/1.1\r\n" + strings.Repeat("X: y\r\n", 200) + "\r\n",
-		"GET / HTTP/1.1\r\n" + strings.Repeat("k", 512) + ": v\r\n\r\n",
-		"POST / HTTP/1.1\r\nHost: h\r\nContent-Length: 4\r\n\r\nbodyTRAILING",
-
-		// Nothing, and nothing that resembles a request at all.
-		"",
-		"\r\n\r\n",
-		"\x00\x00\x00\x00",
-	}
-	for _, seed := range seeds {
-		f.Add(uint64(0), []byte(seed))
-	}
-}

http/httphi/mux.go

@@ -1,489 +0,0 @@
-package httphi
-
-import (
-	"bytes"
-	"io"
-	"strings"
-	"unsafe"
-
-	"github.com/soypat/lneto"
-	"github.com/soypat/lneto/http/httpraw"
-	"github.com/soypat/lneto/internal"
-)
-
-// Handle is a extremely low-level HTTP handling method used internally in [Router].
-// Requires exchange to be acquired and configured. Will panic if any argument is nil.
-// Handle does not close the connection on any outcome: the caller owns it.
-// backoff can be set for dealing with non-blocking connections. If backoff set to nil
-// then a zero-length-read will result in Handle returning [io.ErrNoProgress].
-func Handle(exch *Exchange, mux Mux, backoff lneto.BackoffStrategy) error {
-	if !exch.acquired.Load() {
-		return lneto.ErrBadState
-	}
-	reqhdr := &exch.reqHdr
-	reqhdr.Reset(nil, 0) // Assume exchange has been configured and reuse memory.
-	var consecutiveBackoffs uint
-	for {
-		n, err := reqhdr.ReadFromLimited(exch.rw, reqhdr.BufferFree())
-		if err != nil {
-			exch.readErr = err
-			exch.handleError(err)
-			return err
-		} else if n == 0 {
-			if backoff == nil {
-				return io.ErrNoProgress
-			}
-			backoff.Do(consecutiveBackoffs)
-			consecutiveBackoffs++
-			continue
-		}
-		consecutiveBackoffs = 0
-		const asRequest = false
-		needMore, err := reqhdr.TryParse(asRequest)
-		if needMore {
-			continue // Request header split across reads, accumulate the rest.
-		} else if err != nil {
-			exch.handleError(err)
-			return err
-		}
-		break // Done!
-	}
-	// Setup Exchange fields necessary for correct functioning.
-	parsed := reqhdr.BufferParsed()
-	exch.respRemains = reqhdr.BufferReceived() - parsed
-	exch.respHeaderOff = uint16(parsed)
-	exch.respHeaderLen = 0
-	proto := b2s(reqhdr.Protocol())
-	if len(proto) == 0 {
-		// HTTP/0.9 not tolerated RFC 9112 3.
-		exch.WriteHeader(int(StatusBadRequest))
-		return errNoRequestProto
-	} else if proto != "HTTP/1.1" && proto != "HTTP/1.0" {
-		// RFC 9112 2.6.
-		exch.WriteHeader(int(StatusHTTPVersionNotSupported))
-		return errBadRequestProto
-	}
-	// Mux on the request path: the query string is the handler's business.
-	path := reqhdr.RequestPath()
-	meth := reqhdr.Method()
-	clear(exch.pathValues)
-	matchedPattern, handler := mux.LookupHandler(MethodFromBytes(meth), path, exch.pathValues)
-	if handler != nil {
-		exch.matchedPattern = matchedPattern
-		handler(exch)
-		if !exch.hijacked {
-			exch.FlushHeader()
-		}
-	} else {
-		exch.WriteHeader(404)
-	}
-	return nil
-}
-
-func (exch *Exchange) handleError(err error) {
-	if err == lneto.ErrUnsupported {
-		// httpraw refused a first line naming a version it does not speak, before
-		// spending the field loop on it. An empty protocol is a HTTP/0.9
-		// simple-request, RFC 9112 3: a malformed 1.x request-line rather than a
-		// version there is any point naming back.
-		if len(exch.reqHdr.Protocol()) == 0 {
-			exch.WriteHeader(int(StatusBadRequest))
-		} else {
-			exch.WriteHeader(int(StatusHTTPVersionNotSupported))
-		}
-		return
-	}
-	if err == httpraw.ErrHeaderTooMany || err == httpraw.ErrBufferExhausted || exch.reqHdr.BufferFree() == 0 {
-		// The peer is owed an answer: no larger buffer is coming, so
-		// say so instead of dropping the connection, RFC 6585 5.
-		exch.StageHeader("Content-Length", "0")
-		exch.WriteHeader(int(StatusRequestHeaderFieldsTooLarge))
-	}
-}
-
-// HandlerFunc serves a single request, playing the part of http.Handler.
-// The exchange is only valid for the duration of the call: it is released to
-// the router's pool on return, so a handler must not retain it nor any slice it
-// handed out.
-type HandlerFunc func(ex *Exchange)
-
-// Mux resolves a request to the handler that serves it. [Handle] calls
-// LookupHandler with the request-target's path, not the whole target, and
-// replies 404 when it returns nil.
-type Mux interface {
-	// LookupHandler matches the requestPath and method to a handler and returns it and the
-	// pattern it matched. dstPathVals are set to non-zero values by Mux and can later be accessed by [Exchange.PathValue]
-	// requestPath is a buffer owned by the [Exchange] usually and should not be held after LookupHandler returns.
-	LookupHandler(get Method, requestPath []byte, dstPathVals []PathValue) (matchedPattern string, handler HandlerFunc)
-	// MaxPathValues specifies the required size of dstPathVals in a call to [Mux.LookupHandler].
-	// MaxPathValues should return -1 if no paths have been configured to catch situation
-	// where the Mux has been passed to a [Router.Configuration] before registering paths.
-	MaxPathValues() int
-}
-
-// PathValue used to implement [Mux] interface. Stores http.Request.PathValue-like values.
-type PathValue struct {
-	Key   string // owned by mux.
-	Value []byte // points to raw exchange buffer.
-}
-
-// pathSeparator is shared so [SetPathValues] never converts a literal per call.
-var pathSeparator = []byte{'/'}
-
-// SetPathValues matches requestPath against pattern and binds its wildcards
-// into dstPathVals, read back with [Exchange.PathValue]. Wildcards are whole
-// segments as per http.ServeMux: "{name}" takes one non-empty segment,
-// "{name...}" the rest including slashes, "{$}" only the path's end, and a
-// trailing slash is an anonymous "{...}". i.e: "/b/{bucket}/o/{obj...}".
-//
-// Unlike ServeMux, segments are compared and bound raw, so "/users/{id}" binds
-// "x%2Fy" and not "x/y". Which paths match is unaffected. Bound values alias
-// requestPath rather than copy it.
-//
-// Values are bound while walking, before the match is known, so on failure
-// SetPathValues clears what it bound. A [Mux] may then try patterns in turn
-// without a matching one inheriting values from one that failed.
-func SetPathValues(dstPathVals []PathValue, pattern string, requestPath []byte) (matched, pathValSliceTooShort bool) {
-	n, matched, pathValSliceTooShort := setPathValues(dstPathVals, pattern, requestPath)
-	if !matched {
-		clear(dstPathVals[:n])
-	}
-	return matched, pathValSliceTooShort
-}
-
-// setPathValues is [SetPathValues] reporting how many values it bound, so its
-// caller can discard them when the pattern turns out not to match.
-func setPathValues(dstPathVals []PathValue, pattern string, requestPath []byte) (n int, matched, pathValSliceTooShort bool) {
-	if len(pattern) == 0 || pattern[0] != '/' || len(requestPath) == 0 || requestPath[0] != '/' {
-		return n, false, false
-	}
-	pattern, requestPath = pattern[1:], requestPath[1:]
-	for {
-		if len(pattern) == 0 {
-			// Nothing left after a slash: an anonymous "..." taking the rest,
-			// which is why "/files/" matches "/files/a/b" and "/" matches all.
-			return n, true, false
-		}
-		patSeg, patRest, patMore := strings.Cut(pattern, "/")
-		reqSeg, reqRest, reqMore := bytes.Cut(requestPath, pathSeparator)
-		name, isMulti, isWildcard := pathWildcard(patSeg)
-		switch {
-		case isWildcard && name == "$":
-			// Matches the end of the path and nothing else, so it must be the
-			// last segment of the pattern and leave no path behind.
-			return n, !patMore && len(requestPath) == 0, false
-
-		case isWildcard && isMulti:
-			// Takes the remainder including slashes, possibly empty.
-			if name != "" {
-				if n >= len(dstPathVals) {
-					return n, false, true
-				}
-				dstPathVals[n] = PathValue{Key: name, Value: requestPath}
-				n++
-			}
-			return n, true, false
-
-		case isWildcard:
-			if len(reqSeg) == 0 {
-				return n, false, false // One segment means a non-empty one.
-			}
-			if n >= len(dstPathVals) {
-				return n, false, true
-			}
-			dstPathVals[n] = PathValue{Key: name, Value: reqSeg}
-			n++
-
-		default:
-			if b2s(reqSeg) != patSeg {
-				return n, false, false
-			}
-		}
-		if patMore != reqMore {
-			// One side has a further segment and the other does not, so
-			// "/health" misses "/health/" and "/files/" misses "/files".
-			return n, false, false
-		} else if !patMore {
-			return n, true, false // Both spent on the same segment.
-		}
-		pattern, requestPath = patRest, reqRest
-	}
-}
-
-// pathWildcard picks apart a "{name}" or "{name...}" pattern segment. It
-// reports ok false for a literal segment, so "/b_{bucket}" is literal text and
-// not a wildcard, matching ServeMux's rule that wildcards be whole segments.
-func pathWildcard(segment string) (name string, isMulti, ok bool) {
-	if len(segment) < 2 || segment[0] != '{' || segment[len(segment)-1] != '}' {
-		return "", false, false
-	}
-	name = segment[1 : len(segment)-1]
-	if rest, found := strings.CutSuffix(name, "..."); found {
-		return rest, true, true
-	}
-	return name, false, true
-}
-
-// MuxSlice is a [Mux] implementation backed by a slice of registered endpoints, matched by
-// exact path. Lookup is linear in the number of registrations.
-type MuxSlice struct {
-	// TODO: binary search worth it?
-	_handlers []struct {
-		method   Method
-		path     string
-		handler  HandlerFunc
-		pathVals int
-		spec     int
-	}
-}
-
-// Reset discards all registered handlers, reusing the backing array and growing
-// it to fit capacity registrations.
-func (sm *MuxSlice) Reset(capacity int) {
-	internal.SliceReuse(&sm._handlers, capacity)
-}
-
-// LookupHandler returns the handler registered for request path, or nil if none
-// matches. The most specific matching registration wins, not the first, so the
-// catch-all "/" may be registered alongside the endpoints it backs without
-// shadowing them, as in http.ServeMux, see [patternSpecificity]. Registrations
-// of equal specificity are resolved in registration order.
-//
-// Every method this package does not name is [MethUnknown], so a request with an
-// extension method matches a bare-path registration and any registration naming
-// an extension method, whichever it names. Tell PROPFIND from MKCOL inside the
-// handler with [Exchange.RequestMethodBytes].
-func (sm *MuxSlice) LookupHandler(method Method, path []byte, dstPathVals []PathValue) (matched string, _ HandlerFunc) {
-	best := -1
-	bestSpec := 0
-	for i, endpoint := range sm._handlers {
-		if endpoint.method != MethUndefined && endpoint.method != method {
-			continue
-		} else if best >= 0 && endpoint.spec <= bestSpec {
-			continue // Cannot beat the incumbent, so do not pay to match it.
-		}
-		// Method matches. A pattern ending in '/' is a wildcard despite binding no
-		// values: the trailing slash is an anonymous "{...}", so it must go
-		// through the matcher and not a literal compare, see [SetPathValues].
-		var ok bool
-		if isWildcardPattern(endpoint.path) {
-			// dstPathVals is scratch during the scan: a candidate that matches and
-			// is then beaten, or one that is beaten and clears on failure, would
-			// leave the winner's values wrong, so the winner is bound below.
-			ok, _ = SetPathValues(dstPathVals, endpoint.path, path)
-		} else {
-			ok = b2s(path) == endpoint.path
-		}
-		if ok {
-			best, bestSpec = i, endpoint.spec
-		}
-	}
-	if best < 0 {
-		return "", nil
-	}
-	winner := sm._handlers[best]
-	if isWildcardPattern(winner.path) {
-		clear(dstPathVals) // The scan may have bound more values than the winner does.
-		SetPathValues(dstPathVals, winner.path, path)
-	}
-	return winner.path, winner.handler
-}
-
-// MaxPathValues returns the maximum number of path values any endpoint could have.
-func (sm *MuxSlice) MaxPathValues() (maxPathValues int) {
-	if len(sm._handlers) == 0 {
-		return -1 // Signal no handlers registered.
-	}
-	for _, endpoint := range sm._handlers {
-		maxPathValues = max(maxPathValues, endpoint.pathVals)
-	}
-	return maxPathValues
-}
-
-// Handle registers handler for reg, either a bare path matching any method or a
-// method and path separated by a space, i.e: "/health" or "GET /health".
-//
-// Handle panics on a registration that could never serve a request: a method
-// token carrying lowercase (methods are case sensitive and uppercase, RFC 9110
-// 9.1, so "Get" matches no GET request), a path not rooted at '/', or an exact
-// duplicate of an earlier registration, which the first one always shadows.
-// Registration is program startup, so a fault belongs there and not in a
-// permanent silent 404.
-func (sm *MuxSlice) Handle(optMethodAndPath string, handler HandlerFunc) {
-	method := MethUndefined
-	methodOrURL, url, methodFound := strings.Cut(optMethodAndPath, " ")
-	if methodFound {
-		if hasLowerASCII(methodOrURL) {
-			panic("httphi: method must be uppercase in registration " + optMethodAndPath)
-		}
-		method = MethodFrom(methodOrURL)
-	} else {
-		url = methodOrURL
-	}
-	if len(url) == 0 || url[0] != '/' {
-		panic("httphi: path must begin with '/' in registration " + optMethodAndPath)
-	}
-	for _, endpoint := range sm._handlers {
-		if endpoint.method == method && endpoint.path == url {
-			if method == MethUnknown {
-				// Two extension methods are both MethUnknown, so the second is
-				// unreachable. Register one and branch in the handler, see
-				// [MuxSlice.LookupHandler].
-				panic("httphi: extension method already registered on path in " + optMethodAndPath)
-			}
-			panic("httphi: duplicate registration " + optMethodAndPath)
-		}
-	}
-	v := internal.SliceReclaim(&sm._handlers)
-	v.pathVals = countPathValues(url)
-	v.spec = patternSpecificity(url)
-	v.method = method
-	v.path = url
-	v.handler = handler
-}
-
-// patternSpecificity scores how tightly pattern pins a path, letting
-// [MuxSlice.LookupHandler] prefer the most specific match over the first one
-// registered. A literal segment pins harder than a wildcard segment, and a
-// pattern left open at the end ("/", "/files/", "/{p...}") pins less than one
-// spent on the whole path, so "/cnt" outscores "/" and "/users/me" outscores
-// "/users/{id}". Scoring at registration keeps lookup to an integer compare.
-//
-// The score is a total order over patterns, which the subset relation is not:
-// neither of "/a/{x}/c" and "/a/b/{y}" is more specific than the other, and they
-// tie here where http.ServeMux rejects the pair as conflicting. A tie is settled
-// by registration order rather than by a panic.
-func patternSpecificity(pattern string) (spec int) {
-	if len(pattern) == 0 || pattern[0] != '/' {
-		return 0
-	}
-	pattern = pattern[1:]
-	for {
-		if len(pattern) == 0 {
-			return spec // Nothing after a slash: an anonymous "{...}" taking the rest.
-		}
-		segment, rest, more := strings.Cut(pattern, "/")
-		name, isMulti, isWildcard := pathWildcard(segment)
-		switch {
-		case isWildcard && name == "$":
-			return spec + 1 // Ends the path, so nothing is left open.
-		case isWildcard && isMulti:
-			return spec // Takes the remainder, pinning nothing more.
-		case isWildcard:
-			spec++
-		default:
-			spec += 2
-		}
-		if !more {
-			return spec + 1 // Spent on the last segment: the pattern is exact.
-		}
-		pattern = rest
-	}
-}
-
-// countPathValues is how many values pattern can bind, which is what sizes the
-// slice [SetPathValues] writes into. Only a named wildcard segment binds: "{$}"
-// marks the path's end, an anonymous "{...}" has no name to bind under, and a
-// brace inside a literal segment is not a wildcard at all.
-func countPathValues(pattern string) (n int) {
-	if len(pattern) == 0 || pattern[0] != '/' {
-		return 0
-	}
-	pattern = pattern[1:]
-	for len(pattern) > 0 {
-		segment, rest, more := strings.Cut(pattern, "/")
-		if name, _, ok := pathWildcard(segment); ok && name != "" && name != "$" {
-			n++
-		}
-		if !more {
-			break
-		}
-		pattern = rest
-	}
-	return n
-}
-
-// isWildcardPattern reports whether pattern must go through [SetPathValues]
-// rather than a literal comparison. Distinct from the value count: "{$}" and a
-// trailing slash match by walking segments while binding nothing.
-func isWildcardPattern(pattern string) bool {
-	return strings.IndexByte(pattern, '{') >= 0 || strings.HasSuffix(pattern, "/")
-}
-
-// hasLowerASCII reports whether s carries an ASCII lowercase letter, which a
-// method token registered by mistake ("Get") does and a legal extension method
-// ("PROPFIND") does not.
-func hasLowerASCII(s string) bool {
-	for i := 0; i < len(s); i++ {
-		if s[i] >= 'a' && s[i] <= 'z' {
-			return true
-		}
-	}
-	return false
-}
-
-// Method is a HTTP request method, parsed by [MethodFrom].
-// Method can only take standardized values and is set to [MethUnknown] for non-standard methods.
-type Method uint8
-
-const (
-	// MethUndefined returned by [MethodFrom] on an empty/missing method.
-	// Used by [MuxSlice] to denote an unset method kind for a request pattern.
-	MethUndefined Method = iota // undefined
-	MethGet                     // GET
-	// lol.
-	MethHead // HEAD
-	MethPost // POST
-	MethPut  // PUT
-	// RFC 5789
-	MethPatch   // PATCH
-	MethDelete  // DELETE
-	MethConnect // CONNECT
-	MethOptions // OPTIONS
-	MethTrace   // TRACE
-	// MethUnknown returned by [MethodFrom] on an non-standard method kind i.e: "get" and "FROBNICATE".
-	MethUnknown // unknown
-)
-
-// MethodFrom returns the [Method] matching meth, [MethUndefined] if meth is
-// empty and [MethUnknown] if it names a method this package does not know.
-// Comparison is case sensitive: methods are uppercase, RFC 9110 9.1.
-func MethodFrom(meth string) (res Method) {
-	if len(meth) == 0 {
-		return MethUndefined
-	}
-	switch meth {
-	case "GET":
-		res = MethGet
-	case "HEAD":
-		res = MethHead
-	case "POST":
-		res = MethPost
-	case "PUT":
-		res = MethPut
-	case "PATCH":
-		res = MethPatch
-	case "DELETE":
-		res = MethDelete
-	case "CONNECT":
-		res = MethConnect
-	case "OPTIONS":
-		res = MethOptions
-	case "TRACE":
-		res = MethTrace
-	default:
-		res = MethUnknown
-	}
-	return res
-}
-
-// MethodFromBytes is a [MethodFrom] wrapper with bytes argument instead of string.
-func MethodFromBytes(meth []byte) (res Method) {
-	return MethodFrom(b2s(meth))
-}
-
-// b2s converts byte slice to a string without memory allocation.
-// See https://groups.google.com/forum/#!msg/Golang-Nuts/ENgbUzYvCuU/90yGx7GUAgAJ .
-func b2s(b []byte) string {
-	return unsafe.String(unsafe.SliceData(b), len(b))
-}

http/httphi/mux_test.go

@@ -1,515 +0,0 @@
-package httphi
-
-import (
-	"strings"
-	"testing"
-)
-
-// SetPathValues must agree with net/http.ServeMux on which patterns match which
-// paths and what each wildcard binds to. Every case below was taken from a run
-// against a real ServeMux, so this table is an oracle, not a guess.
-//
-// The one documented deviation is percent-decoding: ServeMux unescapes segments
-// before matching and binding, this does not. See TestSetPathValuesEscaping.
-func TestSetPathValues(t *testing.T) {
-	for _, test := range []struct {
-		pattern string
-		path    string
-		match   bool
-		want    string // "name=value" pairs joined by "|", in bind order.
-	}{
-		// Single segment wildcard binds exactly one non-empty segment.
-		{pattern: "/users/{id}", path: "/users/42", match: true, want: "id=42"},
-		{pattern: "/users/{id}", path: "/users/42/x", match: false},
-		{pattern: "/users/{id}", path: "/users/", match: false},
-		{pattern: "/users/{id}", path: "/users", match: false},
-		{pattern: "/users/{id}/edit", path: "/users/42/edit", match: true, want: "id=42"},
-		{pattern: "/{a}/{b}", path: "/x/y", match: true, want: "a=x|b=y"},
-
-		// "..." swallows the remainder, slashes included, and may bind empty.
-		{pattern: "/b/{bucket}/o/{obj...}", path: "/b/bk/o/a/b/c", match: true, want: "bucket=bk|obj=a/b/c"},
-		{pattern: "/b/{bucket}/o/{obj...}", path: "/b/bk/o/", match: true, want: "bucket=bk|obj="},
-		{pattern: "/b/{bucket}/o/{obj...}", path: "/b/bk/o", match: false},
-		{pattern: "/files/{p...}", path: "/files/", match: true, want: "p="},
-		{pattern: "/files/{p...}", path: "/files", match: false},
-
-		// {$} matches only the end of the path.
-		{pattern: "/{$}", path: "/", match: true},
-		{pattern: "/{$}", path: "/x", match: false},
-		{pattern: "/a/{$}", path: "/a/", match: true},
-		{pattern: "/a/{$}", path: "/a", match: false},
-		{pattern: "/a/{$}", path: "/a/b", match: false},
-
-		// A trailing slash is an anonymous "..." wildcard, binding nothing.
-		{pattern: "/files/", path: "/files/a/b", match: true},
-		{pattern: "/files/", path: "/files/", match: true},
-		{pattern: "/files/", path: "/files", match: false},
-		{pattern: "/", path: "/anything/at/all", match: true},
-
-		// Literal patterns match exactly, trailing slash included.
-		{pattern: "/health", path: "/health", match: true},
-		{pattern: "/health", path: "/health/", match: false},
-
-		// An empty segment never satisfies a single wildcard.
-		{pattern: "/a/{x}/b", path: "/a//b", match: false},
-	} {
-		t.Run(test.pattern+"__"+test.path, func(t *testing.T) {
-			vals := make([]PathValue, 8)
-			match, tooShort := SetPathValues(vals, test.pattern, []byte(test.path))
-			if tooShort {
-				t.Fatal("8 slots must be enough for these patterns")
-			}
-			if match != test.match {
-				t.Fatalf("want match=%v, got %v", test.match, match)
-			}
-			if !match {
-				return
-			}
-			if got := renderPathValues(vals); got != test.want {
-				t.Errorf("want %q, got %q", test.want, got)
-			}
-		})
-	}
-}
-
-// Bound values must alias the request path buffer rather than copy it: the
-// exchange owns that memory and a copy would allocate per request.
-func TestSetPathValuesAliasesRequestBuffer(t *testing.T) {
-	path := []byte("/users/42/edit")
-	vals := make([]PathValue, 4)
-	match, _ := SetPathValues(vals, "/users/{id}/edit", path)
-	if !match {
-		t.Fatal("want match")
-	}
-	if string(vals[0].Value) != "42" {
-		t.Fatalf("want id=42, got %q", vals[0].Value)
-	}
-	// Mutating the request buffer must show through the bound value.
-	path[7] = '9'
-	if string(vals[0].Value) != "92" {
-		t.Errorf("value must alias the request buffer, got %q", vals[0].Value)
-	}
-}
-
-// A destination too small to hold every wildcard must say so rather than bind a
-// partial set or write out of range.
-func TestSetPathValuesSliceTooShort(t *testing.T) {
-	match, tooShort := SetPathValues(make([]PathValue, 1), "/{a}/{b}", []byte("/x/y"))
-	if !tooShort {
-		t.Error("want pathValSliceTooShort for 2 wildcards in 1 slot")
-	}
-	if match {
-		t.Error("want match=false when values could not be bound")
-	}
-	// A pattern that binds nothing needs no slots at all.
-	match, tooShort = SetPathValues(nil, "/health", []byte("/health"))
-	if !match || tooShort {
-		t.Errorf("want match with no slots needed, got match=%v tooShort=%v", match, tooShort)
-	}
-}
-
-// Percent escapes are compared and bound raw. ServeMux unescapes segment by
-// segment, so "/users/x%2Fy" binds id="x/y" there and id="x%2Fy" here. Matching
-// agrees either way; only the bound bytes differ.
-func TestSetPathValuesEscaping(t *testing.T) {
-	vals := make([]PathValue, 4)
-	if match, _ := SetPathValues(vals, "/a%2Fb/{x}", []byte("/a%2Fb/v")); !match {
-		t.Error("want literal escape in pattern to match the same bytes in path")
-	}
-	vals = make([]PathValue, 4)
-	match, _ := SetPathValues(vals, "/users/{id}", []byte("/users/x%2Fy"))
-	if !match {
-		t.Fatal("want match")
-	}
-	if got := string(vals[0].Value); got != "x%2Fy" {
-		t.Errorf("want raw %q, got %q", "x%2Fy", got)
-	}
-}
-
-// renderPathValues joins the bound pairs for comparison, stopping at the first
-// unused slot.
-func renderPathValues(vals []PathValue) string {
-	var sb strings.Builder
-	for _, v := range vals {
-		if v.Key == "" {
-			break
-		}
-		if sb.Len() > 0 {
-			sb.WriteByte('|')
-		}
-		sb.WriteString(v.Key)
-		sb.WriteByte('=')
-		sb.Write(v.Value)
-	}
-	return sb.String()
-}
-
-// Matching a request must not allocate: keys alias the mux's pattern and values
-// alias the request buffer, so nothing is copied per request.
-func TestSetPathValuesNoAlloc(t *testing.T) {
-	vals := make([]PathValue, 8)
-	path := []byte("/b/bk/o/a/b/c")
-	allocs := testing.AllocsPerRun(100, func() {
-		SetPathValues(vals, "/b/{bucket}/o/{obj...}", path)
-	})
-	if allocs != 0 {
-		t.Fatalf("SetPathValues allocated %v times, want 0", allocs)
-	}
-}
-
-// pathValueMux binds one wildcard pattern, standing in for a [Mux] that
-// supports them until MuxSlice sets setPathVal.
-type pathValueMux struct {
-	pattern string
-	handler HandlerFunc
-}
-
-func (m *pathValueMux) MaxPathValues() int {
-	return -1
-}
-
-func (m *pathValueMux) LookupHandler(method Method, path []byte, dst []PathValue) (string, HandlerFunc) {
-	if ok, _ := SetPathValues(dst, m.pattern, path); ok {
-		return m.pattern, m.handler
-	}
-	return "", nil
-}
-
-// A wildcard bound by one request must not be readable by the next request the
-// same pooled exchange serves. A literal pattern binds nothing, so it never
-// overwrites the previous request's slots, and the values it would leak alias a
-// buffer the new request has already overwritten.
-func TestExchangePathValueClearedBetweenRequests(t *testing.T) {
-	exch := new(Exchange)
-	exch.Configure(ExchangeConfig{
-		RawBuf: make([]byte, 2048), RequestBufferLim: 1024,
-		NumHeaderKVCap: defaultNumHeaderKVCap, PathValuesBuf: make([]PathValue, 4),
-	})
-
-	// First request binds id=42 off a wildcard pattern.
-	var gotFirst string
-	wildcard := &pathValueMux{pattern: "/users/{id}", handler: func(e *Exchange) {
-		gotFirst = string(e.PathValue("id"))
-		e.WriteHeader(200)
-	}}
-	conn := newConn("GET /users/42 HTTP/1.1\r\nHost: h\r\n\r\n")
-	conn.Hangup()
-	if !exch.Acquire(conn) {
-		t.Fatal("fresh exchange failed to acquire")
-	}
-	if err := Handle(exch, wildcard, nopBackoff); err != nil {
-		t.Fatalf("first request: %s", err)
-	}
-	exch.Release()
-	if gotFirst != "42" {
-		t.Fatalf("want id=42 bound on the first request, got %q", gotFirst)
-	}
-
-	// Second request matches a literal pattern, which binds nothing at all.
-	var leaked []byte
-	var sm MuxSlice
-	sm.Handle("/health", func(e *Exchange) {
-		leaked = e.PathValue("id")
-		e.WriteHeader(200)
-	})
-	conn2 := newConn("GET /health HTTP/1.1\r\nHost: h\r\n\r\n")
-	conn2.Hangup()
-	if !exch.Acquire(conn2) {
-		t.Fatal("released exchange failed to re-acquire")
-	}
-	if err := Handle(exch, &sm, nopBackoff); err != nil {
-		t.Fatalf("second request: %s", err)
-	}
-	if leaked != nil {
-		t.Errorf("want no path value on a literal route, got id=%q from the previous request", leaked)
-	}
-}
-
-// A lookup tries each endpoint in turn and [SetPathValues] binds as it walks, so
-// a pattern that binds values and then fails must not leave them behind for the
-// pattern that does match: a handler would read a wildcard no matched pattern has.
-func TestMuxSliceNoStaleBindingsAcrossCandidates(t *testing.T) {
-	var sm MuxSlice
-	sm.Reset(2)
-	sm.Handle("/a/{x}/{y}/z", func(ex *Exchange) { t.Error("non-matching handler ran") })
-	var gotP, gotX, gotY string
-	sm.Handle("/a/{p}/b", func(ex *Exchange) {
-		gotP = string(ex.PathValue("p"))
-		gotX = string(ex.PathValue("x"))
-		gotY = string(ex.PathValue("y"))
-		ex.WriteHeader(200)
-	})
-
-	exch := new(Exchange)
-	exch.Configure(ExchangeConfig{
-		RawBuf: make([]byte, 2048), RequestBufferLim: 1024,
-		NumHeaderKVCap: defaultNumHeaderKVCap, PathValuesBuf: make([]PathValue, sm.MaxPathValues()),
-	})
-	conn := newConn("GET /a/1/b HTTP/1.1\r\nHost: h\r\n\r\n")
-	conn.Hangup()
-	if !exch.Acquire(conn) {
-		t.Fatal("fresh exchange failed to acquire")
-	}
-	if err := Handle(exch, &sm, nopBackoff); err != nil {
-		t.Fatal(err)
-	}
-	if gotP != "1" {
-		t.Errorf("want p=1 from the matched pattern, got %q", gotP)
-	}
-	if gotX != "" || gotY != "" {
-		t.Errorf("want no x/y from the failed candidate, got x=%q y=%q", gotX, gotY)
-	}
-}
-
-// A pattern ending in '/' carries no brace but is still a wildcard: the trailing
-// slash is an anonymous "{...}", see [SetPathValues]. MuxSlice must route it
-// through the same matcher rather than comparing the path literally.
-func TestMuxSliceTrailingSlashPattern(t *testing.T) {
-	for _, test := range []struct {
-		pattern string
-		path    string
-		want    bool
-	}{
-		{pattern: "/files/", path: "/files/a/b", want: true},
-		{pattern: "/files/", path: "/files/", want: true},
-		{pattern: "/files/", path: "/files", want: false},
-		{pattern: "/files/", path: "/other/a", want: false},
-		{pattern: "/", path: "/anything/at/all", want: true},
-		{pattern: "/", path: "/", want: true},
-		// Without the trailing slash a pattern stays literal.
-		{pattern: "/files", path: "/files/a", want: false},
-		{pattern: "/files", path: "/files", want: true},
-	} {
-		t.Run(test.pattern+"__"+test.path, func(t *testing.T) {
-			var sm MuxSlice
-			sm.Reset(1)
-			var served bool
-			sm.Handle(test.pattern, func(ex *Exchange) { served = true; ex.WriteHeader(200) })
-			// MuxSlice must agree with the matcher it delegates to.
-			if ok, _ := SetPathValues(nil, test.pattern, []byte(test.path)); ok != test.want {
-				t.Fatalf("SetPathValues disagrees with the table: got %v", ok)
-			}
-			exch := new(Exchange)
-			exch.Configure(ExchangeConfig{
-				RawBuf: make([]byte, 2048), RequestBufferLim: 1024,
-				NumHeaderKVCap: defaultNumHeaderKVCap, PathValuesBuf: make([]PathValue, sm.MaxPathValues()),
-			})
-			conn := newConn("GET " + test.path + " HTTP/1.1\r\nHost: h\r\n\r\n")
-			conn.Hangup()
-			if !exch.Acquire(conn) {
-				t.Fatal("fresh exchange failed to acquire")
-			}
-			if err := Handle(exch, &sm, nopBackoff); err != nil {
-				t.Fatal(err)
-			}
-			if served != test.want {
-				t.Errorf("want served=%v, got %v", test.want, served)
-			}
-		})
-	}
-}
-
-// A malformed registration is a programming error, and one that otherwise costs
-// a permanent silent 404 at runtime: "Get /x" parses to MethUnknown, which no
-// GET request ever matches but every extension-method request does. Fail at
-// registration, where the stack points at the offending line.
-func TestMuxSliceHandlePanicsOnBadRegistration(t *testing.T) {
-	for _, test := range []struct {
-		name string
-		reg  string
-	}{
-		{name: "lowercase method", reg: "Get /x"},
-		{name: "all lower method", reg: "get /x"},
-		{name: "mixed case method", reg: "pOsT /x"},
-		{name: "no leading slash", reg: "GET x"},
-		{name: "bare path no slash", reg: "x"},
-		{name: "empty path after method", reg: "GET "},
-	} {
-		t.Run(test.name, func(t *testing.T) {
-			var sm MuxSlice
-			sm.Reset(1)
-			defer func() {
-				if recover() == nil {
-					t.Errorf("want panic registering %q", test.reg)
-				}
-			}()
-			sm.Handle(test.reg, func(ex *Exchange) {})
-		})
-	}
-}
-
-// An exact duplicate is unreachable code: the first registration always wins.
-func TestMuxSliceHandlePanicsOnDuplicate(t *testing.T) {
-	var sm MuxSlice
-	sm.Reset(2)
-	sm.Handle("GET /x", func(ex *Exchange) {})
-	defer func() {
-		if recover() == nil {
-			t.Error("want panic registering the same method and path twice")
-		}
-	}()
-	sm.Handle("GET /x", func(ex *Exchange) {})
-}
-
-// Extension methods are legal and uppercase, so they must still register: only
-// the case-mangled forms are rejected.
-func TestMuxSliceHandleAllowsExtensionMethod(t *testing.T) {
-	var sm MuxSlice
-	sm.Reset(2)
-	sm.Handle("PROPFIND /dav", func(ex *Exchange) {})
-	sm.Handle("/any-method", func(ex *Exchange) {}) // Bare path matches any method.
-	if sm.MaxPathValues() != 0 {
-		t.Errorf("want 0 path values, got %d", sm.MaxPathValues())
-	}
-}
-
-// A catch-all registered before the endpoints it sits above must not swallow
-// them. "/" is a wildcard pattern: its trailing slash is an anonymous "{...}",
-// so a purely first-match-wins scan hands every request to it and the specific
-// registrations below become dead code, answered with the root page instead of
-// their own body. Registering the site root first is the ordinary way to write
-// a mux, so the more specific pattern has to win regardless of order, as in
-// http.ServeMux.
-func TestMuxSliceSpecificPatternBeatsEarlierCatchAll(t *testing.T) {
-	for _, test := range []struct {
-		name     string
-		register []string
-		path     string
-		want     string
-	}{
-		{
-			name:     "root registered first",
-			register: []string{"/", "/hello", "/cnt", "/6"},
-			path:     "/cnt",
-			want:     "/cnt",
-		}, {
-			name:     "root registered last",
-			register: []string{"/hello", "/cnt", "/6", "/"},
-			path:     "/cnt",
-			want:     "/cnt",
-		}, {
-			name:     "root still serves the root path",
-			register: []string{"/", "/cnt"},
-			path:     "/",
-			want:     "/",
-		}, {
-			name:     "root still catches the unregistered",
-			register: []string{"/", "/cnt"},
-			path:     "/nowhere",
-			want:     "/",
-		}, {
-			name:     "subtree wildcard loses to its own literal",
-			register: []string{"/files/", "/files/index"},
-			path:     "/files/index",
-			want:     "/files/index",
-		}, {
-			name:     "subtree wildcard keeps the rest",
-			register: []string{"/files/", "/files/index"},
-			path:     "/files/a/b",
-			want:     "/files/",
-		}, {
-			name:     "longer literal prefix wins over shorter subtree",
-			register: []string{"/", "/files/", "/files/a/b"},
-			path:     "/files/a/b",
-			want:     "/files/a/b",
-		}, {
-			name:     "named wildcard loses to the literal it covers",
-			register: []string{"/users/{id}", "/users/me"},
-			path:     "/users/me",
-			want:     "/users/me",
-		}, {
-			name:     "named wildcard keeps everything else",
-			register: []string{"/users/{id}", "/users/me"},
-			path:     "/users/42",
-			want:     "/users/{id}",
-		},
-	} {
-		t.Run(test.name, func(t *testing.T) {
-			var sm MuxSlice
-			sm.Reset(len(test.register))
-			for _, pattern := range test.register {
-				sm.Handle(pattern, func(ex *Exchange) { ex.WriteHeader(200) })
-			}
-			pathVals := make([]PathValue, max(sm.MaxPathValues(), 0))
-			got, handler := sm.LookupHandler(MethGet, []byte(test.path), pathVals)
-			if handler == nil {
-				t.Fatalf("%s matched no handler, want %q", test.path, test.want)
-			}
-			if got != test.want {
-				t.Errorf("%s matched pattern %q, want %q", test.path, got, test.want)
-			}
-		})
-	}
-}
-
-// pathVals sizes the slice SetPathValues writes into, so it must count exactly
-// the wildcards that bind. Counting braces over-reports: "{$}" marks the path's
-// end, an anonymous "{...}" has no name, and a brace inside a literal segment is
-// not a wildcard at all. Each of those binds nothing.
-func TestMuxSliceMaxPathValuesCountsOnlyBindingWildcards(t *testing.T) {
-	for _, test := range []struct {
-		pattern string
-		want    int
-	}{
-		{pattern: "/health", want: 0},
-		{pattern: "/", want: 0},
-		{pattern: "/files/", want: 0},       // Anonymous trailing wildcard.
-		{pattern: "/{$}", want: 0},          // End-of-path marker.
-		{pattern: "/a/{$}", want: 0},        //
-		{pattern: "/b_{bucket}", want: 0},   // Literal: brace not a whole segment.
-		{pattern: "/{...}", want: 0},        // Multi wildcard with no name.
-		{pattern: "/users/{id}", want: 1},   //
-		{pattern: "/files/{p...}", want: 1}, //
-		{pattern: "/{a}/{b}", want: 2},      //
-		{pattern: "/b/{bucket}/o/{obj...}", want: 2},
-	} {
-		t.Run(test.pattern, func(t *testing.T) {
-			var sm MuxSlice
-			sm.Reset(1)
-			sm.Handle(test.pattern, func(ex *Exchange) {})
-			if got := sm.MaxPathValues(); got != test.want {
-				t.Errorf("want %d path values, got %d", test.want, got)
-			}
-		})
-	}
-}
-
-// Sizing and routing are different questions: "{$}" binds no values yet still
-// needs the matcher, so an exact pathVals count must not send it to the literal
-// comparison instead.
-func TestMuxSliceZeroValueWildcardStillMatches(t *testing.T) {
-	for _, test := range []struct {
-		pattern string
-		path    string
-		want    bool
-	}{
-		{pattern: "/{$}", path: "/", want: true},
-		{pattern: "/{$}", path: "/x", want: false},
-		{pattern: "/a/{$}", path: "/a/", want: true},
-		{pattern: "/a/{$}", path: "/a/b", want: false},
-		{pattern: "/{...}", path: "/any/thing", want: true},
-	} {
-		t.Run(test.pattern+"__"+test.path, func(t *testing.T) {
-			var sm MuxSlice
-			sm.Reset(1)
-			var served bool
-			sm.Handle(test.pattern, func(ex *Exchange) { served = true; ex.WriteHeader(200) })
-			exch := new(Exchange)
-			exch.Configure(ExchangeConfig{
-				RawBuf: make([]byte, 2048), RequestBufferLim: 1024,
-				NumHeaderKVCap: defaultNumHeaderKVCap, PathValuesBuf: make([]PathValue, sm.MaxPathValues()),
-			})
-			conn := newConn("GET " + test.path + " HTTP/1.1\r\nHost: h\r\n\r\n")
-			conn.Hangup()
-			if !exch.Acquire(conn) {
-				t.Fatal("acquire")
-			}
-			if err := Handle(exch, &sm, nopBackoff); err != nil {
-				t.Fatal(err)
-			}
-			if served != test.want {
-				t.Errorf("want served=%v, got %v", test.want, served)
-			}
-		})
-	}
-}

http/httphi/router.go

@@ -1,388 +0,0 @@
-package httphi
-
-import (
-	"errors"
-	"io"
-	"log/slog"
-	"math"
-	"sync"
-	"sync/atomic"
-	"time"
-
-	"github.com/soypat/lneto"
-	"github.com/soypat/lneto/internal"
-)
-
-//go:generate stringer -type Method -linecomment -output stringers.go
-
-// reconfigureWait bounds how long [Router.Configure] waits for the previous
-// generation to stop serving before reusing its exchange buffers.
-const reconfigureWait = 10 * time.Millisecond
-
-var (
-	errNoRequestProto  = errors.New("httphi: request line with no HTTP version")
-	errBadRequestProto = errors.New("httphi: unsupported HTTP version in request line")
-	errBusyExchanges   = errors.New("httphi: exchanges still serving, cannot reuse their buffers")
-	errRouterTornDown  = errors.New("httphi: router torn down, configure it before serving")
-
-	errNotFormEncoded            = errors.New("httphi: request body is not application/x-www-form-urlencoded")
-	errNotMultipart              = errors.New("httphi: request body is not multipart/form-data")
-	errUnsupportedTransferCoding = errors.New("httphi: transfer coding not decoded, read the body directly")
-)
-
-type conn = io.ReadWriteCloser
-
-// Router serves HTTP connections handed to it with [Router.Handle], routing
-// each request to a handler found through its [Mux]. It plays the part of
-// http.Server minus the listening: accepting connections is the caller's job,
-// which is what lets the same router run over a TCP stack, a socket or a test
-// pipe.
-//
-// A Router owns the exchanges and goroutines that serve connections and sizes
-// both at [Router.Configure] time, so serving load costs no allocation and
-// bounded memory. Connections arriving with nothing left to serve them are
-// refused rather than queued, see [Router.Handle].
-//
-// Methods are safe for concurrent use. The zero value is not usable: configure
-// it first.
-type Router struct {
-	mu              sync.Mutex
-	gen             atomic.Uint32
-	numGoro         int
-	reqBuf          int
-	respBuf         int
-	reqNumHeaderCap int
-	maxPathValues   int
-	normalizeKeys   bool
-	pendingConns    chan job
-	mux             Mux
-
-	globbuf  []byte
-	globpath []PathValue
-	exchs    []Exchange
-	freeList *Exchange
-
-	log *slog.Logger
-}
-
-// job is a connection waiting on an exchange for a worker goroutine to serve it.
-type job struct {
-	exch *Exchange
-}
-
-// RouterConfig configures a [Router]. See [Router.Configure].
-//
-// Each field below opens with Required, Conditional or Optional followed by the
-// constraint in brackets, that being what [RouterConfig.Validate] rejects on.
-type RouterConfig struct {
-	// Required [-1 or >0] number of goroutines to spawn on [Router.Configure],
-	// -1 meaning allocate them freely per connection instead.
-	FixedNumGoroutines int
-	// Required [>=32, sum with ResponseHeaderMinBufferSize <=65535] buffer for the
-	// request header: request-target (URI), protocol and key/value pairs.
-	RequestHeaderBufferSize int
-	// Required [>=2, <=65535] buffer for response headers. Reuses unused request
-	// memory so it is not a strict limit, and the status line does not count
-	// towards it. Once consumed [Exchange.StageHeader] appends no more fields.
-	ResponseHeaderMinBufferSize int
-	// Required [>0] request header key/value pairs to parse before failing with
-	// [StatusRequestHeaderFieldsTooLarge].
-	RequestNumHeaderKVCap int
-	// Optional [any] normalization of response header field keys as they are
-	// staged, i.e: "content-type" becomes "Content-Type".
-	NormalizeOutgoingKeys bool
-	// Optional [nil disables] sink for failed exchanges.
-	Logger *slog.Logger
-}
-
-// Validate returns a non-nil error if the configuration cannot be used to
-// configure a [Router].
-func (cfg RouterConfig) Validate() error {
-	workerMode := cfg.workerMode()
-	switch {
-	case !workerMode && cfg.FixedNumGoroutines != -1,
-		cfg.RequestNumHeaderKVCap <= 0,
-		cfg.RequestHeaderBufferSize < minRequestHeaderBuffer,
-		cfg.ResponseHeaderMinBufferSize < minResponseHeaderBuffer,
-		cfg.ResponseHeaderMinBufferSize > maxExchangeBuffer,
-		cfg.RequestHeaderBufferSize > maxExchangeBuffer-cfg.ResponseHeaderMinBufferSize:
-		return lneto.ErrInvalidConfig
-	}
-	if workerMode {
-		// Buffer sizes are bounded by maxExchangeBuffer above so the sum cannot
-		// overflow; the products below allocate and can.
-		exchBuf := cfg.RequestHeaderBufferSize + cfg.ResponseHeaderMinBufferSize
-		if cfg.FixedNumGoroutines > math.MaxInt/exchBuf ||
-			cfg.FixedNumGoroutines > math.MaxInt/cfg.RequestNumHeaderKVCap {
-			return lneto.ErrInvalidConfig
-		}
-	}
-	return nil
-}
-
-func (cfg RouterConfig) workerMode() bool {
-	return cfg.FixedNumGoroutines > 0
-}
-
-// Shutdown stops the router once in-flight exchanges finish; until
-// [Router.Configure] is called again, connections are refused with a
-// non-nil error. Configure calls it before installing a new generation.
-func (r *Router) Shutdown() {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	r.shutdownLocked()
-}
-
-// shutdownLocked is [Router.Shutdown] but without locking requirement.
-func (r *Router) shutdownLocked() {
-	r.gen.Add(1)
-	if r.pendingConns != nil {
-		close(r.pendingConns)
-		r.pendingConns = nil
-	}
-}
-
-// Configure prepares the router to serve connections, tearing down the previous
-// generation of goroutines and exchanges first. In worker mode it spawns
-// [RouterConfig.FixedNumGoroutines] goroutines and allocates their exchange
-// buffers up front, so the router's memory use does not grow with load.
-//
-// Configure may be called on a serving router, but since the exchange buffers
-// are reused it waits for connections in flight to finish and fails with a
-// non-nil error rather than reconfigure buffers still being served from.
-func (r *Router) Configure(mux Mux, cfg RouterConfig) error {
-	if err := cfg.Validate(); err != nil {
-		return err
-	}
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	r.shutdownLocked()
-	gen := r.gen.Load()
-	numgoro := cfg.FixedNumGoroutines
-	workerMode := cfg.workerMode()
-
-	r.reqNumHeaderCap = cfg.RequestNumHeaderKVCap
-	r.reqBuf = cfg.RequestHeaderBufferSize
-	r.respBuf = cfg.ResponseHeaderMinBufferSize
-	r.mux = mux
-	r.log = cfg.Logger
-	maxPathValues := mux.MaxPathValues()
-	if maxPathValues < 0 {
-		return errors.New("Mux paths must be registered before configuring Router")
-	}
-	r.maxPathValues = maxPathValues
-	r.normalizeKeys = cfg.NormalizeOutgoingKeys
-	// Freelist entries were sized by the outgoing configuration: recycling one
-	// would serve a request with buffer limits cfg never asked for.
-	r.freeList = nil
-	if !workerMode {
-		r.numGoro = 0
-		r.pendingConns = nil
-		return nil
-	}
-	if workerMode {
-		jobqueue := make(chan job, cfg.FixedNumGoroutines)
-		if gen > 1 {
-			// Exchange buffers below are reused: the previous generation must be
-			// done serving before they may be handed to the new one.
-			err := r.awaitIdleExchangesLocked(reconfigureWait)
-			if err != nil {
-				return err
-			}
-		}
-		internal.SliceReuse(&r.exchs, numgoro)
-		r.exchs = r.exchs[:numgoro]
-		rawBuflen := cfg.RequestHeaderBufferSize + cfg.ResponseHeaderMinBufferSize
-		internal.SliceReuse(&r.globbuf, numgoro*rawBuflen)
-		internal.SliceReuse(&r.globpath, numgoro*maxPathValues)
-
-		for i := range numgoro {
-			goff := i * rawBuflen
-			poff := i * maxPathValues
-			r.exchs[i].Configure(ExchangeConfig{
-				RawBuf:                r.globbuf[goff : goff+rawBuflen],
-				RequestBufferLim:      cfg.RequestHeaderBufferSize,
-				NumHeaderKVCap:        cfg.RequestNumHeaderKVCap,
-				NormalizeOutgoingKeys: cfg.NormalizeOutgoingKeys,
-				NoRequestBufferGrowth: true, // Hard memory limit.
-				PathValuesBuf:         r.globpath[poff : poff+maxPathValues],
-			})
-			go r.goroWorker(gen, jobqueue, mux)
-		}
-		r.pendingConns = jobqueue
-		r.numGoro = numgoro
-	}
-	return nil
-}
-
-// awaitIdleExchangesLocked waits up to maxWait for exchanges of the previous
-// generation to finish serving so their buffers may be reused. Requires r.mu
-// held; the lock is released while waiting since [Router.freeExch] needs it to
-// free the exchanges being waited on.
-func (r *Router) awaitIdleExchangesLocked(maxWait time.Duration) error {
-	const pollInterval = time.Millisecond
-	for waited := time.Duration(0); ; waited += pollInterval {
-		busy := false
-		for i := range r.exchs {
-			if r.exchs[i].acquired.Load() {
-				busy = true
-				break
-			}
-		}
-		if !busy {
-			return nil
-		} else if waited >= maxWait {
-			return errBusyExchanges
-		}
-		r.mu.Unlock()
-		time.Sleep(pollInterval)
-		r.mu.Lock()
-	}
-}
-
-// Handle takes ownership of conn and serves one exchange on it, closing it when
-// done. It does not block on the exchange: the connection is handed to a
-// goroutine and Handle returns immediately.
-//
-// Handle returns [lneto.ErrExhausted] when no exchange is free,
-// [lneto.ErrPacketDrop] when the queue of connections awaiting a goroutine is
-// full, and an error when the router's goroutines have been torn down. On every
-// one of them conn is left untouched and unclosed for the caller to dispose of:
-// refusing connections is how a router with fixed memory applies backpressure.
-func (r *Router) Handle(conn io.ReadWriteCloser) error {
-	// Exchange acquisition and the configuration it is served with must be read
-	// under the same lock: [Router.Configure] may run concurrently.
-	r.mu.Lock()
-	numGoro, mux := r.numGoro, r.mux
-	gen := r.gen.Load() // Generation whose buffers the exchange below is sized by.
-	if numGoro > 0 && r.pendingConns == nil {
-		// Goroutines torn down: refuse before claiming an exchange.
-		r.mu.Unlock()
-		return errRouterTornDown
-	}
-	exch := r.getExchLocked(conn)
-	if exch == nil {
-		r.mu.Unlock()
-		return lneto.ErrExhausted
-	} else if numGoro == 0 {
-		r.mu.Unlock()
-		go r.goroHandle(gen, exch, mux)
-		return nil
-	}
-	// Enqueue under the lock: [Router.Configure] closes pendingConns while
-	// holding it, so an unlocked send could land on a closed channel. The send
-	// never blocks, so holding the lock cannot stall a worker.
-	var enqueued bool
-	select {
-	case r.pendingConns <- job{exch: exch}:
-		enqueued = true
-	default:
-		// pendingConns cannot store another Conn, we drop and return error.
-		exch.acquired.Store(false) // release.
-	}
-	r.mu.Unlock()
-	if enqueued {
-		return nil
-	}
-	return lneto.ErrPacketDrop
-}
-
-func (r *Router) goroWorker(gen uint32, queue chan job, mux Mux) {
-	for job := range queue {
-		exch := job.exch
-		if exch == nil {
-			panic("httphi: unreachable nil job")
-		} else if gen != r.gen.Load() {
-			// Not released with freeExch since generation torn down,
-			// new buffer may have been allocated for Exchanges.
-			exch.Release()
-			continue
-		}
-		r.goroHandle(gen, exch, mux)
-	}
-}
-
-func (r *Router) goroHandle(gen uint32, exch *Exchange, mux Mux) {
-	defer r.freeExch(gen, exch)
-	err := Handle(exch, mux, nil)
-	if err != nil {
-		if exch.readErr != nil {
-			r.error("goroHandle:ReadFromLimited", slog.String("err", err.Error()))
-		} else {
-			r.error("goroHandle:TryParse?", slog.String("err", err.Error()))
-		}
-	}
-}
-
-// freeExch releases exch and offers it to the freelist for reuse. gen is the
-// generation exch was acquired under: an exchange outliving its generation is
-// dropped, its buffers being sized by a configuration the router no longer
-// serves and possibly carved out of a globbuf it no longer owns.
-func (r *Router) freeExch(gen uint32, exch *Exchange) {
-	const freelistMaxDepth = 5
-	r.mu.Lock()
-	if gen != r.gen.Load() {
-		exch.Release()
-		r.mu.Unlock()
-		return
-	}
-	depth := 0
-	for node := r.freeList; node != nil && depth < freelistMaxDepth; node = node.nextFree {
-		depth++
-	}
-	if depth < freelistMaxDepth {
-		// Push at head: appending at the tail would drop every node past the
-		// depth limit instead of dropping the exchange we cannot store.
-		exch.nextFree = r.freeList
-		r.freeList = exch
-	} else {
-		exch.nextFree = nil // Freelist full, exchange is dropped.
-	}
-	exch.Release()
-	r.mu.Unlock()
-}
-
-// getExchLocked returns an exchange acquired on conn. Requires r.mu held.
-func (r *Router) getExchLocked(conn conn) (exch *Exchange) {
-	if r.freeList != nil {
-		// Successor must be read before Acquire: Acquire clears nextFree, so
-		// popping afterwards would truncate the freelist to the popped node.
-		next := r.freeList.nextFree
-		if r.freeList.Acquire(conn) {
-			exch = r.freeList
-			r.freeList = next
-			return exch
-		}
-	}
-	// Unbounded mode is stored as zero, see [Router.Configure].
-	workerMode := r.numGoro > 0
-	if workerMode {
-		for i := range r.exchs {
-			if r.exchs[i].Acquire(conn) {
-				return &r.exchs[i]
-			}
-		}
-	} else {
-		// Unbounded growth mode when r.numGoro==0.
-		exch := new(Exchange)
-		exch.Configure(ExchangeConfig{
-			RawBuf:                make([]byte, r.respBuf+r.reqBuf),
-			RequestBufferLim:      r.reqBuf,
-			NumHeaderKVCap:        r.reqNumHeaderCap,
-			NormalizeOutgoingKeys: r.normalizeKeys,
-			NoRequestBufferGrowth: true,
-			PathValuesBuf:         make([]PathValue, r.maxPathValues),
-		})
-		exch.Acquire(conn) // Fresh exchange, CAS cannot fail.
-		return exch
-	}
-	return nil
-}
-
-func (r *Router) error(msg string, attrs ...slog.Attr) {
-	internal.LogAttrs(r.log, slog.LevelError, msg, attrs...)
-}
-
-func (r *Router) info(msg string, attrs ...slog.Attr) {
-	internal.LogAttrs(r.log, slog.LevelInfo, msg, attrs...)
-}

http/httphi/router_test.go

@@ -1,501 +0,0 @@
-package httphi
-
-import (
-	"bytes"
-	"context"
-	"io"
-	"net"
-	"strings"
-	"sync"
-	"testing"
-	"time"
-)
-
-// rwconn is a in-memory conn. The router handles connections on another
-// goroutine so every field is guarded; onClose lets tests await the handler.
-//
-// A drained rwconn reads (0,nil) as a live socket with no data pending would,
-// so a partial request can be completed with AddReadable mid-handling. Tests
-// that need the peer to hang up call Hangup.
-type rwconn struct {
-	mu       sync.Mutex
-	readable bytes.Buffer
-	segments []string
-	written  bytes.Buffer
-	closed   bool
-	hangup   bool
-	failWr   int
-	onClose  chan struct{}
-	deadline time.Time
-}
-
-// newConn returns a conn preloaded with request and whose Close is observable
-// with [rwconn.AwaitClose].
-func newConn(request string) *rwconn {
-	r := &rwconn{onClose: make(chan struct{})}
-	r.AddReadable([]byte(request))
-	return r
-}
-
-// AddSegment queues data delivered on a later read, once everything already
-// pending has been read. Models a request split over several TCP segments
-// without depending on goroutine scheduling.
-func (r *rwconn) AddSegment(b string) {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	r.segments = append(r.segments, b)
-}
-
-// FailWrites makes the next n writes fail, as a conn refusing further data
-// would. Later writes succeed.
-func (r *rwconn) FailWrites(n int) {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	r.failWr = n
-}
-
-// Hangup makes reads past the pending data return [io.EOF], as a peer that
-// closed its side of the connection would.
-func (r *rwconn) Hangup() {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	r.hangup = true
-}
-
-func (r *rwconn) Close() error {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	if !r.closed {
-		r.closed = true
-		if r.onClose != nil {
-			close(r.onClose)
-		}
-	}
-	return nil
-}
-
-// AwaitClose blocks until the connection is closed by its handler or timeout elapses.
-func (r *rwconn) AwaitClose(t *testing.T, timeout time.Duration) {
-	t.Helper()
-	select {
-	case <-r.onClose:
-	case <-time.After(timeout):
-		t.Fatal("timed out awaiting connection close by handler")
-	}
-}
-
-func (r *rwconn) Read(b []byte) (int, error) {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	if r.closed {
-		return 0, net.ErrClosed
-	} else if r.deadlineExceeded() {
-		return 0, context.DeadlineExceeded
-	} else if r.readable.Len() == 0 {
-		if len(r.segments) > 0 {
-			r.readable.WriteString(r.segments[0])
-			r.segments = r.segments[1:]
-			return r.readable.Read(b)
-		}
-		if r.hangup {
-			return 0, io.EOF
-		}
-		return 0, nil // No data pending, handler backs off and retries.
-	}
-	return r.readable.Read(b)
-}
-func (r *rwconn) Write(b []byte) (int, error) {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	if r.closed {
-		return 0, net.ErrClosed
-	} else if r.deadlineExceeded() {
-		return 0, context.DeadlineExceeded
-	} else if r.failWr > 0 {
-		r.failWr--
-		return 0, io.ErrShortWrite
-	}
-	return r.written.Write(b)
-}
-func (r *rwconn) deadlineExceeded() bool {
-	return !r.deadline.IsZero() && time.Since(r.deadline) > 0
-}
-func (r *rwconn) AddReadable(b []byte) {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	r.readable.Write(b)
-}
-
-// SetDeadline makes reads and writes past t fail, as a conn with a read
-// deadline set would.
-func (r *rwconn) SetDeadline(t time.Time) {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	r.deadline = t
-}
-
-// IsClosed reports whether the connection was closed by its handler.
-func (r *rwconn) IsClosed() bool {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	return r.closed
-}
-
-func (r *rwconn) ViewWritten() string {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	return r.written.String()
-}
-
-var _ Mux = (*MuxSlice)(nil)
-
-func configSynchronousRouter(t *testing.T, router *Router, bufferSize int, mux Mux) {
-	err := router.Configure(mux, RouterConfig{
-		FixedNumGoroutines:          -1,
-		RequestHeaderBufferSize:     bufferSize,
-		RequestNumHeaderKVCap:       16,
-		ResponseHeaderMinBufferSize: bufferSize,
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-}
-
-func TestRouterGet(t *testing.T) {
-	const bufferSize = 1024
-	const expectResponse = "its time"
-	var (
-		sm     MuxSlice
-		router Router
-	)
-	sm.Handle("GET /", staticPage(t, expectResponse))
-	configSynchronousRouter(t, &router, bufferSize, &sm)
-
-	conn := newConn("GET / HTTP/1.1\r\nHost: tinygo.org\r\n\r\n")
-	err := router.Handle(conn)
-	if err != nil {
-		t.Fatal(err)
-	}
-	conn.AwaitClose(t, time.Second)
-
-	got := conn.ViewWritten()
-	if !strings.HasPrefix(got, "HTTP/1.1 200 OK\r\n") {
-		t.Errorf("want 200 status line, got %q", got)
-	}
-	if !strings.HasSuffix(got, expectResponse) {
-		t.Errorf("want body %q at end of response, got %q", expectResponse, got)
-	}
-}
-
-// The handler observes the request line and header fields the router parsed.
-func TestRouterRequestVisibleToHandler(t *testing.T) {
-	const bufferSize = 1024
-	var (
-		sm     MuxSlice
-		router Router
-	)
-	var gotMethod, gotURI, gotHost string
-	var gotMethodEnum Method
-	sm.Handle("GET /index.html", func(ex *Exchange) {
-		gotMethod = string(ex.RequestMethodBytes())
-		gotMethodEnum = ex.RequestMethod()
-		gotURI = string(ex.RequestTarget())
-		gotHost = string(ex.RequestHeader("Host"))
-		ex.WriteHeader(200)
-	})
-	configSynchronousRouter(t, &router, bufferSize, &sm)
-
-	conn := newConn("GET /index.html HTTP/1.1\r\nHost: tinygo.org\r\n\r\n")
-	if err := router.Handle(conn); err != nil {
-		t.Fatal(err)
-	}
-	conn.AwaitClose(t, time.Second)
-
-	if gotMethod != "GET" {
-		t.Errorf("want method %q, got %q", "GET", gotMethod)
-	}
-	if gotMethodEnum != MethGet {
-		t.Errorf("want method enum %q, got %q", MethGet, gotMethodEnum)
-	}
-	if gotURI != "/index.html" {
-		t.Errorf("want URI %q, got %q", "/index.html", gotURI)
-	}
-	if gotHost != "tinygo.org" {
-		t.Errorf("want Host %q, got %q", "tinygo.org", gotHost)
-	}
-}
-
-// Router must route on method and URI, and must not invoke a handler for
-// requests it has no registration for.
-func TestRouterMux(t *testing.T) {
-	const bufferSize = 1024
-	for _, test := range []struct {
-		name          string
-		request       string
-		want          string // Response body the matched handler must have written.
-		wantNoHandler bool   // No registration matches: the router must answer 404 itself.
-	}{
-		{name: "get root", request: "GET / HTTP/1.1\r\nHost: h\r\n\r\n", want: "root"},
-		{name: "get page", request: "GET /page HTTP/1.1\r\nHost: h\r\n\r\n", want: "page"},
-		{name: "any method", request: "DELETE /any HTTP/1.1\r\nHost: h\r\n\r\n", want: "any"},
-		{name: "method mismatch", request: "POST / HTTP/1.1\r\nHost: h\r\n\r\n", wantNoHandler: true},
-		{name: "unknown uri", request: "GET /nowhere HTTP/1.1\r\nHost: h\r\n\r\n", wantNoHandler: true},
-	} {
-		t.Run(test.name, func(t *testing.T) {
-			var (
-				sm     MuxSlice
-				router Router
-			)
-			// "/{$}" is the root alone: a bare "/" is a catch-all and would serve
-			// "root" for /page and /nowhere as well, see [SetPathValues].
-			sm.Handle("GET /{$}", staticPage(t, "root"))
-			sm.Handle("GET /page", staticPage(t, "page"))
-			sm.Handle("/any", staticPage(t, "any")) // No method: matches any.
-			configSynchronousRouter(t, &router, bufferSize, &sm)
-
-			conn := newConn(test.request)
-			if err := router.Handle(conn); err != nil {
-				t.Fatal(err)
-			}
-			conn.AwaitClose(t, time.Second)
-
-			got := conn.ViewWritten()
-			_, body, found := strings.Cut(got, "\r\n\r\n")
-			if !found {
-				t.Fatalf("header block never terminated: %q", got)
-			}
-			if test.wantNoHandler {
-				if !strings.HasPrefix(got, "HTTP/1.1 404 ") {
-					t.Errorf("want a 404 answer, got %q", got)
-				}
-				if body != "" {
-					t.Errorf("no handler must run, got body %q", body)
-				}
-				return
-			}
-			if !strings.HasPrefix(got, "HTTP/1.1 200 OK\r\n") {
-				t.Errorf("want a 200 answer, got %q", got)
-			}
-			if body != test.want {
-				t.Errorf("want body %q, got %q", test.want, body)
-			}
-		})
-	}
-}
-
-// A request arriving in pieces (TCP segmentation) must still be handled.
-func TestRouterSplitRequest(t *testing.T) {
-	const bufferSize = 1024
-	const expectResponse = "split ok"
-	var (
-		sm     MuxSlice
-		router Router
-	)
-	sm.Handle("GET /", staticPage(t, expectResponse))
-	configSynchronousRouter(t, &router, bufferSize, &sm)
-
-	conn := newConn("GET / HTTP/1.1\r\nHo")
-	conn.AddSegment("st: tinygo.org\r\n\r")
-	conn.AddSegment("\n") // Final CRLF lands in its own segment.
-	if err := router.Handle(conn); err != nil {
-		t.Fatal(err)
-	}
-	conn.AwaitClose(t, time.Second)
-
-	if got := conn.ViewWritten(); !strings.HasSuffix(got, expectResponse) {
-		t.Errorf("want body %q, got response %q", expectResponse, got)
-	}
-}
-
-func staticPage(t *testing.T, page string) HandlerFunc {
-	return func(ex *Exchange) {
-		var rw ExchangeRW // Streaming APIs take the ReadWriter view.
-		ex.ReadWriter(&rw)
-		n, err := io.WriteString(&rw, page)
-		// Handler runs on the router goroutine: Error, never Fatal.
-		if err != nil {
-			t.Error(err)
-		} else if n != len(page) {
-			t.Error("expected written ", len(page), "got", n)
-		}
-	}
-}
-
-// An exchange freed by the outgoing generation carries that generation's
-// buffers. Recycling it under a new configuration serves the request with
-// buffer limits the new [RouterConfig] never asked for.
-func TestRouterReconfigureDropsStaleExchanges(t *testing.T) {
-	const smallBuf, largeBuf = 256, 1024
-	var (
-		sm     MuxSlice
-		router Router
-	)
-	bufsize := make(chan int, 2)
-	sm.Handle("GET /", func(ex *Exchange) { bufsize <- len(ex.UnsafeRawBuffer()) })
-	serve := func(want int) {
-		t.Helper()
-		conn := newConn("GET / HTTP/1.1\r\nHost: h\r\n\r\n")
-		conn.Hangup()
-		if err := router.Handle(conn); err != nil {
-			t.Fatal(err)
-		}
-		if got := <-bufsize; got != want {
-			t.Errorf("want exchange buffer %d, got %d", want, got)
-		}
-		conn.AwaitClose(t, time.Second) // Exchange hits the freelist on close.
-	}
-
-	configSynchronousRouter(t, &router, smallBuf, &sm)
-	serve(2 * smallBuf)
-	configSynchronousRouter(t, &router, largeBuf, &sm)
-	serve(2 * largeBuf)
-}
-
-// Configure writes the fields Handle reads; concurrent use must not race.
-func TestRouterConfigureHandleRace(t *testing.T) {
-	const bufferSize = 1024
-	var (
-		sm     MuxSlice
-		router Router
-	)
-	sm.Handle("GET /", staticPage(t, "ok"))
-	configSynchronousRouter(t, &router, bufferSize, &sm)
-
-	var wg sync.WaitGroup
-	wg.Add(2)
-	go func() {
-		defer wg.Done()
-		configSynchronousRouter(t, &router, bufferSize, &sm)
-	}()
-	go func() {
-		defer wg.Done()
-		conn := newConn("GET / HTTP/1.1\r\nHost: h\r\n\r\n")
-		if err := router.Handle(conn); err != nil {
-			t.Error(err)
-		}
-	}()
-	wg.Wait()
-}
-
-// Reconfiguring a running router tears down the job queue that Handle may be
-// sending a connection on. Connections may be dropped, but never panic.
-// A torn down router has nothing left to serve with: it must say so instead of
-// dropping the connection as if it were merely busy.
-func TestRouterHandleAfterTeardown(t *testing.T) {
-	var (
-		sm     MuxSlice
-		router Router
-	)
-	sm.Handle("GET /", staticPage(t, "ok"))
-	err := router.Configure(&sm, RouterConfig{
-		FixedNumGoroutines:          2,
-		RequestHeaderBufferSize:     512,
-		RequestNumHeaderKVCap:       16,
-		ResponseHeaderMinBufferSize: 512,
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	router.Shutdown()
-
-	conn := newConn("GET / HTTP/1.1\r\nHost: h\r\n\r\n")
-	if err = router.Handle(conn); err != errRouterTornDown {
-		t.Errorf("want errRouterTornDown, got %v", err)
-	}
-	if conn.IsClosed() {
-		t.Error("refused connection must be left for the caller to dispose of")
-	}
-}
-
-// Tearing down a generation abandons the connections queued for it. They were
-// taken ownership of by Handle, so they must be closed and their exchanges
-// released: an exchange left claimed by a torn down generation is a buffer the
-// router can never reconfigure again.
-func TestRouterTeardownReleasesQueuedConns(t *testing.T) {
-	var (
-		sm     MuxSlice
-		router Router
-	)
-	const numGoro = 2
-	sm.Handle("GET /", staticPage(t, "ok"))
-	cfg := RouterConfig{
-		FixedNumGoroutines:          numGoro,
-		RequestHeaderBufferSize:     512,
-		RequestNumHeaderKVCap:       16,
-		ResponseHeaderMinBufferSize: 512,
-	}
-	// Handing connections over and tearing down immediately leaves them queued
-	// for workers that will never serve them. Rounds bound the scheduling luck
-	// needed; a single leaked exchange also fails every later Configure.
-	var conns [numGoro]*rwconn
-	for range 30 {
-		// errBusyExchanges is legitimate backpressure while the previous
-		// generation drops its connections, but it must not outlive it.
-		var err error
-		for range 100 {
-			if err = router.Configure(&sm, cfg); err == nil {
-				break
-			}
-			time.Sleep(time.Millisecond)
-		}
-		if err != nil {
-			t.Fatal("reconfigure after teardown:", err)
-		}
-		for i := range conns {
-			conns[i] = newConn("GET / HTTP/1.1\r\nHost: h\r\n\r\n")
-			conns[i].Hangup()
-			if err := router.Handle(conns[i]); err != nil {
-				t.Fatal(err)
-			}
-		}
-		router.Shutdown()
-		for i := range conns {
-			// Handle took ownership of the connection: served or dropped, the
-			// router closes it.
-			conns[i].AwaitClose(t, time.Second)
-		}
-	}
-}
-
-func TestRouterConfigureDuringWorkerHandle(t *testing.T) {
-	var (
-		sm     MuxSlice
-		router Router
-	)
-	sm.Handle("GET /", staticPage(t, "ok"))
-	cfg := RouterConfig{
-		FixedNumGoroutines:          2,
-		RequestHeaderBufferSize:     512,
-		RequestNumHeaderKVCap:       16,
-		ResponseHeaderMinBufferSize: 512,
-	}
-	if err := router.Configure(&sm, cfg); err != nil {
-		t.Fatal(err)
-	}
-	defer router.Shutdown()
-
-	var wg sync.WaitGroup
-	wg.Add(2)
-	go func() {
-		defer wg.Done()
-		for range 300 {
-			conn := newConn("GET / HTTP/1.1\r\nHost: h\r\n\r\n")
-			conn.Hangup()
-			router.Handle(conn) // Drops are fine, panics are not.
-		}
-	}()
-	go func() {
-		defer wg.Done()
-		// Each Configure sleeps 5ms tearing down the previous generation, keep
-		// the count low and let the Handle loop supply the concurrency.
-		for range 20 {
-			// errBusyExchanges is legitimate backpressure: the previous
-			// generation was still serving when the buffers were needed.
-			if err := router.Configure(&sm, cfg); err != nil && err != errBusyExchanges {
-				t.Error(err)
-				return
-			}
-		}
-	}()
-	wg.Wait()
-}

http/httphi/routermem.go

@@ -1,122 +0,0 @@
-package httphi
-
-import (
-	"math"
-	"unsafe"
-
-	"github.com/soypat/lneto/http/httpraw"
-)
-
-const (
-	// minRequestHeaderBuffer is the smallest request buffer [httpraw.Header]
-	// accepts with buffer growth disabled, which is how exchanges are configured.
-	minRequestHeaderBuffer = 32
-	// minResponseHeaderBuffer is the room [Exchange.FlushHeader] needs for the
-	// CRLF closing the header block, written even when no field was staged.
-	minResponseHeaderBuffer = len("\r\n")
-	// maxExchangeBuffer bounds an exchange's whole buffer: [Exchange] indexes it
-	// with uint16 offsets, so a larger one would be addressed truncated.
-	maxExchangeBuffer = math.MaxUint16
-
-	// sizeofExchange is the fixed cost of an exchange, which a Router pays per
-	// connection it can serve concurrently on top of the buffers it hands it.
-	// It dwarfs a small request buffer, so budgets must account for it.
-	sizeofExchange = int(unsafe.Sizeof(Exchange{}))
-	// sizeofPathValue is the per-wildcard cost of the path value table.
-	sizeofPathValue = int(unsafe.Sizeof(PathValue{}))
-	// sizeofJob is an exchange's slot in the queue connections wait on for a
-	// worker goroutine, sized to the goroutine count in worker mode.
-	sizeofJob = int(unsafe.Sizeof(job{}))
-
-	// bytesPerHeaderField is the request buffer [DefaultRouterConfig] budgets per
-	// parseable header field. Real fields run a little longer than this
-	// ("Accept-Encoding: gzip, deflate, br\r\n" is 35 bytes), so a request fills
-	// the buffer before it exhausts the field table, which is the cheaper of the
-	// two limits to hit: growing the table costs [httpraw.SizeKV] per field on top
-	// of the bytes the field already occupies.
-	bytesPerHeaderField = 32
-	// defaultResponseHeaderBuffer is the response header room
-	// [DefaultRouterConfig] reserves when the budget can afford it: enough for a
-	// Content-Type, a Content-Length and a Connection field with room to spare.
-	// It does not scale with the request buffer because what a response header
-	// costs depends on the fields a handler stages, not on the request's size.
-	defaultResponseHeaderBuffer = 128
-)
-
-// MemoryUsagePerConnection returns the heap bytes a [Router] configured with cfg
-// reserves for each connection it can serve concurrently, maxPathValues being
-// the [Mux.MaxPathValues] of the mux it is configured with. Goroutine stacks are
-// not counted: those are the runtime's to size, not the router's.
-//
-// In worker mode this is exact and fixed, so a router's whole heap footprint is
-// this times FixedNumGoroutines, plus the runtime's own header for the job
-// queue. With FixedNumGoroutines -1 the router allocates one of these per
-// connection in flight instead, so the total grows with peak concurrency.
-//
-// It is the inverse of [DefaultRouterConfig] and useful to check a hand written
-// configuration against a memory budget.
-func (cfg RouterConfig) MemoryUsagePerConnection(maxPathValues int) int {
-	if maxPathValues < 0 {
-		maxPathValues = 0 // Mux with no routes registered yet, see [Mux.MaxPathValues].
-	}
-	n := sizeofExchange + // Exchange itself, an element of the router's exchange store.
-		cfg.RequestHeaderBufferSize + cfg.ResponseHeaderMinBufferSize + // Its window into the raw buffer.
-		cfg.RequestNumHeaderKVCap*httpraw.SizeKV + // The request header's field table.
-		maxPathValues*sizeofPathValue // Its window into the path value store.
-	if cfg.workerMode() {
-		n += sizeofJob // Slot in the queue connections wait on for a worker.
-	}
-	return n
-}
-
-// DefaultRouterConfig is a general purpose configuration creator
-// for small, medium, large, performant or embedded projects.
-//
-// Generalness is achieved with parameters that let the Configuration
-// determine allocation buffer sizes based on typical usage for that
-// number of goroutines and heap allocation on a per-connection basis.
-func DefaultRouterConfig(numGoroutines, memoryPerConnectionBytes, maxPathValues int) RouterConfig {
-	// The budget is spent on the request header buffer first, since that is what
-	// decides which requests are answered at all, then on a field table sized to
-	// match it and a small response header reserve. A budget too small to fund the
-	// minimum viable exchange yields the minimum instead, so the returned config is
-	// always one [Router.Configure] accepts but may exceed a budget under roughly
-	// sizeofExchange + 200 bytes. Check it with MemoryUsagePerConnection when the
-	// bound has to hold.
-	if numGoroutines <= 0 {
-		numGoroutines = -1 // Unbounded mode, the only non-positive value Validate accepts.
-	}
-	// Everything the exchange costs before any buffer is sized: subtract it first
-	// so the buffers below divide up what is actually left to spend.
-	fixed := sizeofExchange + maxPathValues*sizeofPathValue
-	if numGoroutines > 0 {
-		fixed += sizeofJob
-	}
-	// A budget past what the buffers may grow to is only spendable up to the cap
-	// below, so clamp before the products: on a 32 bit target an unclamped
-	// multiply would overflow and wrap a generous budget into a tiny buffer.
-	const maxSpendable = (maxExchangeBuffer + defaultResponseHeaderBuffer) *
-		(bytesPerHeaderField + httpraw.SizeKV) / bytesPerHeaderField
-	avail := min(memoryPerConnectionBytes-fixed, maxSpendable)
-
-	// The response reserve is a floor rather than a share of the budget, but a
-	// budget this small cannot afford the full one without starving the request.
-	respBuf := min(defaultResponseHeaderBuffer, avail/4)
-
-	// Solve avail-respBuf = reqBuf + reqBuf/bytesPerHeaderField*httpraw.SizeKV for
-	// reqBuf, the field table growing with the buffer it parses.
-	reqBuf := (avail - respBuf) * bytesPerHeaderField / (bytesPerHeaderField + httpraw.SizeKV)
-
-	// Clamp to what [RouterConfig.Validate] accepts. Truncating division above
-	// keeps the result under budget; these floors are what can push it over.
-	respBuf = max(respBuf, minResponseHeaderBuffer)
-	reqBuf = max(reqBuf, minRequestHeaderBuffer)
-	reqBuf = min(reqBuf, maxExchangeBuffer-respBuf)
-	return RouterConfig{
-		FixedNumGoroutines:          numGoroutines,
-		RequestHeaderBufferSize:     reqBuf,
-		ResponseHeaderMinBufferSize: respBuf,
-		RequestNumHeaderKVCap:       max(reqBuf/bytesPerHeaderField, 1),
-		NormalizeOutgoingKeys:       false,
-	}
-}

http/httphi/routermem_test.go

@@ -1,231 +0,0 @@
-package httphi
-
-import (
-	"testing"
-
-	"github.com/soypat/lneto/http/httpraw"
-)
-
-// budgetMux exposes a settable path value count so budget tests can sweep it
-// without registering patterns that bind that many wildcards.
-type budgetMux struct {
-	MuxSlice
-	maxPathValues int
-}
-
-func (m *budgetMux) MaxPathValues() int { return m.maxPathValues }
-
-func newBudgetMux(maxPathValues int) *budgetMux {
-	mux := &budgetMux{maxPathValues: maxPathValues}
-	mux.Handle("GET /", func(*Exchange) {})
-	return mux
-}
-
-// TestDefaultRouterConfigHonorsBudget sweeps budgets and path value counts and
-// checks the returned configuration both fits its budget and configures a
-// router. The floor is documented: below it the minimum viable exchange comes
-// back instead, which is the only case allowed to exceed the budget.
-func TestDefaultRouterConfigHonorsBudget(t *testing.T) {
-	minCfg := RouterConfig{
-		FixedNumGoroutines:          1,
-		RequestHeaderBufferSize:     minRequestHeaderBuffer,
-		ResponseHeaderMinBufferSize: minResponseHeaderBuffer,
-		RequestNumHeaderKVCap:       1,
-	}
-	for _, numGoro := range []int{-1, 1, 4} {
-		for _, maxPathValues := range []int{0, 1, 4, 32} {
-			floor := minCfg.MemoryUsagePerConnection(maxPathValues)
-			mux := newBudgetMux(maxPathValues)
-			for _, budget := range []int{0, 1, 64, 256, 512, 1024, 4096, 65536, 1 << 20} {
-				cfg := DefaultRouterConfig(numGoro, budget, maxPathValues)
-				if err := cfg.Validate(); err != nil {
-					t.Fatalf("goro=%d pathvals=%d budget=%d: %s", numGoro, maxPathValues, budget, err)
-				}
-				got := cfg.MemoryUsagePerConnection(maxPathValues)
-				if got > budget && budget >= floor {
-					t.Errorf("goro=%d pathvals=%d budget=%d: uses %d bytes, over budget",
-						numGoro, maxPathValues, budget, got)
-				}
-				var router Router
-				if err := router.Configure(mux, cfg); err != nil {
-					t.Fatalf("goro=%d pathvals=%d budget=%d: %s", numGoro, maxPathValues, budget, err)
-				}
-				router.Shutdown()
-			}
-		}
-	}
-}
-
-// TestDefaultRouterConfigSpendsBudget guards the other direction: a config that
-// fits but leaves most of the budget unspent is as wrong as one that overruns,
-// since the memory is reserved either way.
-func TestDefaultRouterConfigSpendsBudget(t *testing.T) {
-	const maxPathValues = 2
-	for _, budget := range []int{1024, 2048, 4096, 16384} {
-		cfg := DefaultRouterConfig(4, budget, maxPathValues)
-		used := cfg.MemoryUsagePerConnection(maxPathValues)
-		if pct := used * 100 / budget; pct < 95 {
-			t.Errorf("budget=%d: spends only %d bytes (%d%%)", budget, used, pct)
-		}
-	}
-}
-
-// TestExchangeMemoryTerms pins each term of MemoryUsagePerConnection to the
-// allocation it stands for, so a layout change downstream fails here rather than
-// silently letting a router overrun its budget.
-func TestExchangeMemoryTerms(t *testing.T) {
-	const maxPathValues = 4
-	cfg := RouterConfig{
-		FixedNumGoroutines:          2,
-		RequestHeaderBufferSize:     512,
-		ResponseHeaderMinBufferSize: 128,
-		RequestNumHeaderKVCap:       16,
-	}
-	want := sizeofExchange + 512 + 128 + 16*httpraw.SizeKV + maxPathValues*sizeofPathValue + sizeofJob
-	if got := cfg.MemoryUsagePerConnection(maxPathValues); got != want {
-		t.Errorf("worker mode: got %d want %d", got, want)
-	}
-	// Unbounded mode has no job queue to reserve a slot in.
-	cfg.FixedNumGoroutines = -1
-	if got := cfg.MemoryUsagePerConnection(maxPathValues); got != want-sizeofJob {
-		t.Errorf("unbounded mode: got %d want %d", got, want-sizeofJob)
-	}
-	// A mux with no routes registered reports -1, which must not subtract memory.
-	if got := cfg.MemoryUsagePerConnection(-1); got != cfg.MemoryUsagePerConnection(0) {
-		t.Errorf("unregistered mux: got %d want %d", got, cfg.MemoryUsagePerConnection(0))
-	}
-}
-
-// TestRouterSharesExchangeStores checks the invariant the memory accounting
-// rests on: every exchange's buffer and path values are windows into the two
-// stores the router allocates, non-overlapping and exactly the configured size.
-// Measuring allocations would only observe this indirectly.
-func TestRouterSharesExchangeStores(t *testing.T) {
-	const numGoro = 8
-	const maxPathValues = 3
-	mux := newBudgetMux(maxPathValues)
-	cfg := DefaultRouterConfig(numGoro, 1024, maxPathValues)
-	var router Router
-	if err := router.Configure(mux, cfg); err != nil {
-		t.Fatal(err)
-	}
-	defer router.Shutdown()
-
-	wantRaw := cfg.RequestHeaderBufferSize + cfg.ResponseHeaderMinBufferSize
-	if len(router.exchs) != numGoro {
-		t.Fatalf("got %d exchanges, want %d", len(router.exchs), numGoro)
-	}
-	if cap(router.globbuf) < numGoro*wantRaw {
-		t.Errorf("raw store holds %d bytes, want %d", cap(router.globbuf), numGoro*wantRaw)
-	}
-	if cap(router.globpath) < numGoro*maxPathValues {
-		t.Errorf("path store holds %d values, want %d", cap(router.globpath), numGoro*maxPathValues)
-	}
-	rawSeen := make(map[*byte]int, numGoro*wantRaw)
-	pathSeen := make(map[*PathValue]int, numGoro*maxPathValues)
-	for i := range router.exchs {
-		exch := &router.exchs[i]
-		if len(exch.rawbuf) != wantRaw {
-			t.Errorf("exchange %d: raw buffer is %d bytes, want %d", i, len(exch.rawbuf), wantRaw)
-		}
-		if len(exch.pathValues) != maxPathValues {
-			t.Errorf("exchange %d: %d path values, want %d", i, len(exch.pathValues), maxPathValues)
-		}
-		// Every byte must come from the shared store and belong to this exchange
-		// alone: an exchange allocating its own, or two sharing a window, would
-		// make the per-connection accounting a fiction.
-		for j := range exch.rawbuf {
-			p := &exch.rawbuf[j]
-			if owner, dup := rawSeen[p]; dup {
-				t.Fatalf("exchanges %d and %d share raw buffer byte %d", owner, i, j)
-			}
-			rawSeen[p] = i
-		}
-		for j := range exch.pathValues {
-			p := &exch.pathValues[j]
-			if owner, dup := pathSeen[p]; dup {
-				t.Fatalf("exchanges %d and %d share path value %d", owner, i, j)
-			}
-			pathSeen[p] = i
-		}
-	}
-	if len(rawSeen) != numGoro*wantRaw {
-		t.Errorf("exchanges cover %d raw bytes, want %d", len(rawSeen), numGoro*wantRaw)
-	}
-}
-
-// TestExchangeConfigureIsAllocationFree checks an exchange handed all of its
-// memory allocates none of its own, which is what lets a router carve every
-// exchange out of its two stores.
-func TestExchangeConfigureIsAllocationFree(t *testing.T) {
-	cfg := ExchangeConfig{
-		RawBuf:                make([]byte, 640),
-		RequestBufferLim:      512,
-		NumHeaderKVCap:        16,
-		NoRequestBufferGrowth: true,
-		PathValuesBuf:         make([]PathValue, 4),
-	}
-	var exch Exchange
-	exch.Configure(cfg) // Field table allocates once, then settles.
-	allocs := testing.AllocsPerRun(100, func() {
-		exch.Configure(cfg)
-	})
-	if allocs != 0 {
-		t.Errorf("Exchange.Configure allocates %v times, want 0", allocs)
-	}
-}
-
-// TestMemoryUsagePerConnectionMatchesHeap checks the accounting against the heap
-// a router actually takes, which is what makes the number worth budgeting
-// against.
-//
-// It measures two budgets and compares the difference rather than either
-// absolute figure. A router's heap carries costs the accounting does not claim
-// and should not: size class rounding, the job queue's runtime header and the
-// runtime's per-goroutine bookkeeping. Those are identical at both budgets, so
-// subtracting cancels them and leaves only the buffers, whose growth is exactly
-// what MemoryUsagePerConnection predicts. Goroutine stacks never enter into it,
-// the runtime accounting them separately from the heap measured here.
-func TestMemoryUsagePerConnectionMatchesHeap(t *testing.T) {
-	if testing.Short() {
-		t.Skip("measures heap over many Configure iterations")
-	}
-	const numGoro = 64
-	const maxPathValues = 3
-	mux := newBudgetMux(maxPathValues)
-	measure := func(budget int) (accounted, heap int) {
-		cfg := DefaultRouterConfig(numGoro, budget, maxPathValues)
-		res := testing.Benchmark(func(b *testing.B) {
-			b.ReportAllocs()
-			for range b.N {
-				var router Router
-				if err := router.Configure(mux, cfg); err != nil {
-					b.Fatal(err)
-				}
-				router.Shutdown()
-			}
-		})
-		return numGoro * cfg.MemoryUsagePerConnection(maxPathValues), int(res.AllocedBytesPerOp())
-	}
-	lowAcct, lowHeap := measure(2048)
-	highAcct, highHeap := measure(16384)
-	wantGrowth := highAcct - lowAcct
-	gotGrowth := highHeap - lowHeap
-	t.Logf("accounted %d->%d (+%d), heap %d->%d (+%d)",
-		lowAcct, highAcct, wantGrowth, lowHeap, highHeap, gotGrowth)
-
-	// What remains after cancelling is buffer growth, which the accounting covers
-	// term for term. Only size class rounding on the grown buffers is left over.
-	const tolerancePercent = 2
-	if diff := abs(gotGrowth - wantGrowth); diff*100 > wantGrowth*tolerancePercent {
-		t.Errorf("budget growth accounted %d bytes, heap grew %d (%+d)",
-			wantGrowth, gotGrowth, gotGrowth-wantGrowth)
-	}
-}
-
-func abs(x int) int {
-	if x < 0 {
-		return -x
-	}
-	return x
-}

http/httphi/status.go

@@ -1,269 +0,0 @@
-package httphi
-
-// StatusText returns a text for the HTTP status code. It returns the empty
-// string if the code is unknown.
-func StatusText(code int) string {
-	switch code {
-	case StatusContinue:
-		return "Continue"
-	case StatusSwitchingProtocols:
-		return "Switching Protocols"
-	case StatusProcessing:
-		return "Processing"
-	case StatusEarlyHints:
-		return "Early Hints"
-	case StatusOK:
-		return "OK"
-	case StatusCreated:
-		return "Created"
-	case StatusAccepted:
-		return "Accepted"
-	case StatusNonAuthoritativeInfo:
-		return "Non-Authoritative Information"
-	case StatusNoContent:
-		return "No Content"
-	case StatusResetContent:
-		return "Reset Content"
-	case StatusPartialContent:
-		return "Partial Content"
-	case StatusMultiStatus:
-		return "Multi-Status"
-	case StatusAlreadyReported:
-		return "Already Reported"
-	case StatusIMUsed:
-		return "IM Used"
-	case StatusMultipleChoices:
-		return "Multiple Choices"
-	case StatusMovedPermanently:
-		return "Moved Permanently"
-	case StatusFound:
-		return "Found"
-	case StatusSeeOther:
-		return "See Other"
-	case StatusNotModified:
-		return "Not Modified"
-	case StatusUseProxy:
-		return "Use Proxy"
-	case StatusTemporaryRedirect:
-		return "Temporary Redirect"
-	case StatusPermanentRedirect:
-		return "Permanent Redirect"
-	case StatusBadRequest:
-		return "Bad Request"
-	case StatusUnauthorized:
-		return "Unauthorized"
-	case StatusPaymentRequired:
-		return "Payment Required"
-	case StatusForbidden:
-		return "Forbidden"
-	case StatusNotFound:
-		return "Not Found"
-	case StatusMethodNotAllowed:
-		return "Method Not Allowed"
-	case StatusNotAcceptable:
-		return "Not Acceptable"
-	case StatusProxyAuthRequired:
-		return "Proxy Authentication Required"
-	case StatusRequestTimeout:
-		return "Request Timeout"
-	case StatusConflict:
-		return "Conflict"
-	case StatusGone:
-		return "Gone"
-	case StatusLengthRequired:
-		return "Length Required"
-	case StatusPreconditionFailed:
-		return "Precondition Failed"
-	case StatusRequestEntityTooLarge:
-		return "Request Entity Too Large"
-	case StatusRequestURITooLong:
-		return "Request URI Too Long"
-	case StatusUnsupportedMediaType:
-		return "Unsupported Media Type"
-	case StatusRequestedRangeNotSatisfiable:
-		return "Requested Range Not Satisfiable"
-	case StatusExpectationFailed:
-		return "Expectation Failed"
-	case StatusTeapot:
-		return "I'm a teapot"
-	case StatusMisdirectedRequest:
-		return "Misdirected Request"
-	case StatusUnprocessableEntity:
-		return "Unprocessable Entity"
-	case StatusLocked:
-		return "Locked"
-	case StatusFailedDependency:
-		return "Failed Dependency"
-	case StatusTooEarly:
-		return "Too Early"
-	case StatusUpgradeRequired:
-		return "Upgrade Required"
-	case StatusPreconditionRequired:
-		return "Precondition Required"
-	case StatusTooManyRequests:
-		return "Too Many Requests"
-	case StatusRequestHeaderFieldsTooLarge:
-		return "Request Header Fields Too Large"
-	case StatusUnavailableForLegalReasons:
-		return "Unavailable For Legal Reasons"
-	case StatusInternalServerError:
-		return "Internal Server Error"
-	case StatusNotImplemented:
-		return "Not Implemented"
-	case StatusBadGateway:
-		return "Bad Gateway"
-	case StatusServiceUnavailable:
-		return "Service Unavailable"
-	case StatusGatewayTimeout:
-		return "Gateway Timeout"
-	case StatusHTTPVersionNotSupported:
-		return "HTTP Version Not Supported"
-	case StatusVariantAlsoNegotiates:
-		return "Variant Also Negotiates"
-	case StatusInsufficientStorage:
-		return "Insufficient Storage"
-	case StatusLoopDetected:
-		return "Loop Detected"
-	case StatusNotExtended:
-		return "Not Extended"
-	case StatusNetworkAuthenticationRequired:
-		return "Network Authentication Required"
-	default:
-		return ""
-	}
-}
-
-// HTTP status codes as registered with IANA.
-// See: https://www.iana.org/assignments/http-status-codes/http-status-codes.xhtml
-const (
-	// RFC 9110, 15.2.1
-	StatusContinue = 100 // Continue
-	// RFC 9110, 15.2.2
-	StatusSwitchingProtocols = 101 // Switching Protocols
-	// RFC 2518, 10.1
-	StatusProcessing = 102 // Processing
-	// RFC 8297
-	StatusEarlyHints = 103 // Early Hints
-
-	// RFC 9110, 15.3.1
-	StatusOK = 200 // OK
-	// RFC 9110, 15.3.2
-	StatusCreated = 201 // Created
-	// RFC 9110, 15.3.3
-	StatusAccepted = 202 // Accepted
-	// RFC 9110, 15.3.4
-	StatusNonAuthoritativeInfo = 203 // Non-Authoritative Information
-	// RFC 9110, 15.3.5
-	StatusNoContent = 204 // No Content
-	// RFC 9110, 15.3.6
-	StatusResetContent = 205 // Reset Content
-	// RFC 9110, 15.3.7
-	StatusPartialContent = 206 // Partial Content
-	// RFC 4918, 11.1
-	StatusMultiStatus = 207 // Multi-Status
-	// RFC 5842, 7.1
-	StatusAlreadyReported = 208 // Already Reported
-	// RFC 3229, 10.4.1
-	StatusIMUsed = 226 // IM Used
-
-	// RFC 9110, 15.4.1
-	StatusMultipleChoices = 300 // Multiple Choices
-	// RFC 9110, 15.4.2
-	StatusMovedPermanently = 301 // Moved Permanently
-	// RFC 9110, 15.4.3
-	StatusFound = 302 // Found
-	// RFC 9110, 15.4.4
-	StatusSeeOther = 303 // See Other
-	// RFC 9110, 15.4.5
-	StatusNotModified = 304 // Not Modified
-	// RFC 9110, 15.4.6
-	StatusUseProxy = 305 // Use Proxy
-	// RFC 9110, 15.4.7 (Unused)
-	_ = 306
-	// RFC 9110, 15.4.8
-	StatusTemporaryRedirect = 307 // Temporary Redirect
-	// RFC 9110, 15.4.9
-	StatusPermanentRedirect = 308 // Permanent Redirect
-
-	// RFC 9110, 15.5.1
-	StatusBadRequest = 400 // Bad Request
-	// RFC 9110, 15.5.2
-	StatusUnauthorized = 401 // Unauthorized
-	// RFC 9110, 15.5.3
-	StatusPaymentRequired = 402 // Payment Required
-	// RFC 9110, 15.5.4
-	StatusForbidden = 403 // Forbidden
-	// RFC 9110, 15.5.5
-	StatusNotFound = 404 // Not Found
-	// RFC 9110, 15.5.6
-	StatusMethodNotAllowed = 405 // Method Not Allowed
-	// RFC 9110, 15.5.7
-	StatusNotAcceptable = 406 // Not Acceptable
-	// RFC 9110, 15.5.8
-	StatusProxyAuthRequired = 407 // Proxy Authentication Required
-	// RFC 9110, 15.5.9
-	StatusRequestTimeout = 408 // Request Timeout
-	// RFC 9110, 15.5.10
-	StatusConflict = 409 // Conflict
-	// RFC 9110, 15.5.11
-	StatusGone = 410 // Gone
-	// RFC 9110, 15.5.12
-	StatusLengthRequired = 411 // Length Required
-	// RFC 9110, 15.5.13
-	StatusPreconditionFailed = 412 // Precondition Failed
-	// RFC 9110, 15.5.14
-	StatusRequestEntityTooLarge = 413 // Request Entity Too Large
-	// RFC 9110, 15.5.15
-	StatusRequestURITooLong = 414 // Request URI Too Long
-	// RFC 9110, 15.5.16
-	StatusUnsupportedMediaType = 415 // Unsupported Media Type
-	// RFC 9110, 15.5.17
-	StatusRequestedRangeNotSatisfiable = 416 // Requested Range Not Satisfiable
-	// RFC 9110, 15.5.18
-	StatusExpectationFailed = 417 // Expectation Failed
-	// RFC 9110, 15.5.19 (Unused)
-	StatusTeapot = 418 // I'm a teapot
-	// RFC 9110, 15.5.20
-	StatusMisdirectedRequest = 421 // Misdirected Request
-	// RFC 9110, 15.5.21
-	StatusUnprocessableEntity = 422 // Unprocessable Entity
-	// RFC 4918, 11.3
-	StatusLocked = 423 // Locked
-	// RFC 4918, 11.4
-	StatusFailedDependency = 424 // Failed Dependency
-	// RFC 8470, 5.2.
-	StatusTooEarly = 425 // Too Early
-	// RFC 9110, 15.5.22
-	StatusUpgradeRequired = 426 // Upgrade Required
-	// RFC 6585, 3
-	StatusPreconditionRequired = 428 // Precondition Required
-	// RFC 6585, 4
-	StatusTooManyRequests = 429 // Too Many Requests
-	// RFC 6585, 5
-	StatusRequestHeaderFieldsTooLarge = 431 // Request Header Fields Too Large
-	// RFC 7725, 3
-	StatusUnavailableForLegalReasons = 451 // Unavailable For Legal Reasons
-
-	// RFC 9110, 15.6.1
-	StatusInternalServerError = 500 // Internal Server Error
-	// RFC 9110, 15.6.2
-	StatusNotImplemented = 501 // Not Implemented
-	// RFC 9110, 15.6.3
-	StatusBadGateway = 502 // Bad Gateway
-	// RFC 9110, 15.6.4
-	StatusServiceUnavailable = 503 // Service Unavailable
-	// RFC 9110, 15.6.5
-	StatusGatewayTimeout = 504 // Gateway Timeout
-	// RFC 9110, 15.6.6
-	StatusHTTPVersionNotSupported = 505 // HTTP Version Not Supported
-	// RFC 2295, 8.1
-	StatusVariantAlsoNegotiates = 506 // Variant Also Negotiates
-	// RFC 4918, 11.5
-	StatusInsufficientStorage = 507 // Insufficient Storage
-	// RFC 5842, 7.2
-	StatusLoopDetected = 508 // Loop Detected
-	// RFC 2774, 7
-	StatusNotExtended = 510 // Not Extended
-	// RFC 6585, 6
-	StatusNetworkAuthenticationRequired = 511 // Network Authentication Required
-)

http/httphi/stringers.go

@@ -1,34 +0,0 @@
-// Code generated by "stringer -type Method -linecomment -output stringers.go"; DO NOT EDIT.
-
-package httphi
-
-import "strconv"
-
-func _() {
-	// An "invalid array index" compiler error signifies that the constant values have changed.
-	// Re-run the stringer command to generate them again.
-	var x [1]struct{}
-	_ = x[MethUndefined-0]
-	_ = x[MethGet-1]
-	_ = x[MethHead-2]
-	_ = x[MethPost-3]
-	_ = x[MethPut-4]
-	_ = x[MethPatch-5]
-	_ = x[MethDelete-6]
-	_ = x[MethConnect-7]
-	_ = x[MethOptions-8]
-	_ = x[MethTrace-9]
-	_ = x[MethUnknown-10]
-}
-
-const _Method_name = "undefinedGETHEADPOSTPUTPATCHDELETECONNECTOPTIONSTRACEunknown"
-
-var _Method_index = [...]uint8{0, 9, 12, 16, 20, 23, 28, 34, 41, 48, 53, 60}
-
-func (i Method) String() string {
-	idx := int(i) - 0
-	if i < 0 || idx >= len(_Method_index)-1 {
-		return "Method(" + strconv.FormatInt(int64(i), 10) + ")"
-	}
-	return _Method_name[_Method_index[idx]:_Method_index[idx+1]]
-}

http/httpraw/cookie.go

@@ -4,92 +4,108 @@ import (
 	"bytes"
 )
 
-// Cookie implements cookie key-value parsing. Methods function similarly to eponymous [HeaderV1] methods.
+// Cookie implements cookie key-value parsing. Methods function similarly to eponymous [Header] methods.
 // Cookie represents a single-line Cookie header value in a HTTP header, much like the standard library Cookie.
 type Cookie struct {
-	kv kvBuffer
+	buf []byte
+	kvs []argsKV // first key-value pair is the data Key/Value pair.
 }
 
-// EnableBufferGrowth allows the cookie's buffer to grow past what [Cookie.Reset] was
-// handed. See [kvBuffer.EnableBufferGrowth].
-func (c *Cookie) EnableBufferGrowth(enableBufferGrowth bool) {
-	c.kv.EnableBufferGrowth(enableBufferGrowth)
-}
-
-// Reset functions very similarly to [HeaderV1.Reset]. Can be used for in-place cookie parsing.
-func (c *Cookie) Reset(buf []byte, capKV int) { c.kv.Reset(buf, capKV) }
-
-func (c *Cookie) valid() bool {
-	return len(c.kv.kvs) > 0 && c.kv.kvs[0].key.len > 0
+// Reset functions very similarly to [Header.Reset]. Can be used for in-place cookie parsing.
+func (c *Cookie) Reset(buf []byte) {
+	if buf == nil {
+		buf = c.buf[:0]
+	}
+	*c = Cookie{
+		buf: buf,
+		kvs: c.kvs[:0],
+	}
 }
 
 // Name returns the first cookie key which is commonly referred to as the cookie's name. Returns nil if not found.
 func (c *Cookie) Name() []byte {
-	if !c.valid() {
+	if len(c.kvs) == 0 || c.kvs[0].key.len == 0 {
 		return nil
 	}
-	return c.kv.AtKey(0)
+	return tok2bytes(c.buf, c.kvs[0].key)
 }
 
 // Value returns the first cookie value associated with the name. Returns nil if not found.
 func (c *Cookie) Value() []byte {
-	if !c.valid() {
+	if len(c.kvs) == 0 || c.kvs[0].value.len == 0 {
 		return nil
 	}
-	return c.kv.AtValue(0)
+	return tok2bytes(c.buf, c.kvs[0].value)
 }
 
 // ParseBytes copies the argument bytes to the Cookie's underlying buffer and parses the cookie.
 func (c *Cookie) ParseBytes(cookie []byte) error {
-	c.Reset(nil, 0)
-	c.kv.buf = append(c.kv.buf[:0], cookie...)
+	c.Reset(nil)
+	c.buf = append(c.buf[:0], cookie...)
 	return c.Parse()
 }
 
 // CopyFrom makes a copy of the argument cookie to the receiver dst argument. No memory is shared between cookies.
-func (dst *Cookie) CopyFrom(c Cookie) { dst.kv.CopyFrom(&c.kv) }
+func (dst *Cookie) CopyFrom(c Cookie) {
+	dst.buf = append(dst.buf[:0], c.buf...)
+	dst.kvs = append(dst.kvs[:0], c.kvs...)
+}
 
 // Parse parses the cookie's buffer in place.
 func (c *Cookie) Parse() error {
-	if c.kv.Len() > 0 {
+	if len(c.kvs) > 0 {
 		return errCookiesParsed
 	}
 	off := 0
 	for {
-		k, v, n := parseCookie(c.kv.buf[off:])
+		k, v, n := parseCookie(c.buf[off:])
 		if n == 0 {
 			break
 		}
-		if !c.kv.setInternal(k, v) {
-			return ErrBufferExhausted
-		}
-
+		c.kvs = append(c.kvs, argsKV{
+			key:   bytes2tok(c.buf, k),
+			value: bytes2tok(c.buf, v),
+		})
 		off += n
 	}
-	if c.kv.Len() == 0 {
+	if len(c.kvs) == 0 {
 		return errNoCookies
 	}
 	return nil
 }
 
-// ForEach iterates over the cookie's key-value pairs, stopping on the first
-// error returned by cb and returning it.
-func (c *Cookie) ForEach(cb func(key, value []byte) bool) {
-	c.kv.ForEach(cb)
+func (c *Cookie) ForEach(cb func(key, value []byte) error) error {
+	nc := len(c.kvs)
+	for i := range nc {
+		kv := c.kvs[i]
+		key := tok2bytes(c.buf, kv.key)
+		value := tok2bytes(c.buf, kv.value)
+		err := cb(key, value)
+		if err != nil {
+			return err
+		}
+	}
+	return nil
 }
 
 // Get gets a cookie's value from its key. Use HasValueOrKey to check if a key or single-valued cookie is present in the cookie.
-func (c *Cookie) Get(key string) []byte { return c.kv.Get(key) }
+func (c *Cookie) Get(key string) []byte {
+	nc := len(c.kvs)
+	for i := range nc {
+		kv := c.kvs[i]
+		if b2s(tok2bytes(c.buf, kv.key)) == key {
+			return tok2bytes(c.buf, kv.value)
+		}
+	}
+	return nil
+}
 
-// HasKeyOrSingleValue returns true if the cookie contains a pair with the given
-// key or a valueless attribute with the given text, i.e: "Secure" or "HttpOnly".
-// It cannot defer to [KVBuffer.Present]: parseCookie stores a valueless
-// attribute with an empty key and the text as the value, so a key-only lookup
-// would never match one.
 func (c *Cookie) HasKeyOrSingleValue(keyOrSingleValue string) bool {
-	for i, nc := 0, c.kv.Len(); i < nc; i++ {
-		k, v := c.kv.At(i)
-		if (len(k) == 0 && b2s(v) == keyOrSingleValue) || b2s(k) == keyOrSingleValue {
+	nc := len(c.kvs)
+	for i := range nc {
+		kv := c.kvs[i]
+		if kv.key.len == 0 && b2s(tok2bytes(c.buf, kv.value)) == keyOrSingleValue ||
+			b2s(tok2bytes(c.buf, kv.key)) == keyOrSingleValue {
 			return true
 		}
 	}
@@ -142,14 +158,16 @@ func (c *Cookie) String() string {
 
 // AppendKeyValues appends the HTTP header value of the cookie expected after the "Cookie:" string. Does not include trailing \r\n's.
 func (c *Cookie) AppendKeyValues(dst []byte) []byte {
-	nc := c.kv.Len()
+	nc := len(c.kvs)
 	for i := range nc {
-		k, v := c.kv.At(i)
-		if len(k) != 0 {
-			dst = append(dst, k...)
+		kv := c.kvs[i]
+		key := tok2bytes(c.buf, kv.key)
+		value := tok2bytes(c.buf, kv.value)
+		if len(key) != 0 {
+			dst = append(dst, key...)
 			dst = append(dst, '=')
 		}
-		dst = append(dst, v...)
+		dst = append(dst, value...)
 		if i+1 < nc {
 			dst = append(dst, ';', ' ')
 		}

http/httpraw/form.go

@@ -1,162 +0,0 @@
-package httpraw
-
-import (
-	"bytes"
-	"io"
-)
-
-// Form holds "application/x-www-form-urlencoded" key-value pairs, the encoding
-// HTML forms use for POST bodies and query strings alike. Methods function
-// similarly to eponymous [Cookie] methods.
-//
-// Pairs are stored as they appear on the wire, percent-encoded and with '+'
-// undecoded, until [Form.Decode] rewrites them in place. The caller bounds the
-// data: Form parses the buffer it is handed and reads nothing more.
-type Form struct {
-	kv kvBuffer
-}
-
-// EnableBufferGrowth allows the form's buffer to grow past what [Form.Reset] was
-// handed. See [kvBuffer.EnableBufferGrowth].
-func (f *Form) EnableBufferGrowth(enableGrowth bool) { f.kv.EnableBufferGrowth(enableGrowth) }
-
-// Reset discards parsed pairs and sets the buffer to parse in place.
-// If buf is nil the current buffer is reused.
-//
-// capKV sizes the pair table. With growth disabled it is a hard limit, so a
-// capKV of 0 leaves no room for a single pair and [Form.Parse] answers
-// [ErrBufferExhausted]; size it to the pairs expected.
-func (f *Form) Reset(buf []byte, capKV int) {
-	f.kv.Reset(buf, capKV)
-}
-
-// ReadFromBytes appends buf to the underlying buffer, accumulating data to parse. Returns ErrBufferExhausted when buf does not fit and growth is disabled.
-func (f *Form) ReadFromBytes(b []byte) error { return f.kv.ReadFromBytes(b) }
-
-// BufferUsed returns bytes accumulated by the Read* methods and awaiting a
-// [Form.Parse]. See [kvBuffer.BufferUsed].
-func (f *Form) BufferUsed() int { return f.kv.BufferUsed() }
-
-// ReadLimited appends at most limit bytes read from r to the underlying buffer. A read returning data alongside io.EOF reports a nil error, later ones io.EOF.
-func (f *Form) ReadLimited(r io.Reader, limit int) (int, error) { return f.kv.ReadLimited(r, limit) }
-
-// ParseBytes copies the argument bytes to the Form's underlying buffer and parses them.
-func (f *Form) ParseBytes(b []byte) error {
-	f.Reset(nil, 0)
-	if len(b) == 0 {
-		return nil // An empty body is an empty form, not a failure to read one.
-	}
-	err := f.kv.ReadFromBytes(b)
-	if err != nil {
-		return err
-	}
-	return f.Parse()
-}
-
-// Parse parses the form's buffer in place.
-func (f *Form) Parse() error {
-	f.kv.discardKVs()
-	key, value, rest := NextQueryPair(f.kv.buf)
-	for key != nil {
-		if !f.kv.setInternal(key, value) {
-			return ErrBufferExhausted
-		}
-		key, value, rest = NextQueryPair(rest)
-	}
-	return nil
-}
-
-// Decode rewrites every key and value in place, replacing percent escapes and
-// '+' with the bytes they encode. Decoding only shrinks, so no memory is added.
-func (f *Form) Decode() error {
-	const plusAsSpace = true // Form encoded data, unlike a path.
-	nkvs := f.kv.Len()
-	for i := range nkvs {
-		k, v := f.kv.At(i)
-		nk, err := CopyDecodedPercentURL(k, k, plusAsSpace)
-		if err != nil {
-			return err
-		} else if len(v) == 0 {
-			if nk != len(k) {
-				f.kv.setAt(i, k[:nk], v) // k[:nk]: the decoded key is shorter.
-			}
-			continue
-		}
-		nv, err := CopyDecodedPercentURL(v, v, plusAsSpace)
-		if err != nil {
-			return err
-		}
-		if nk != len(k) || nv != len(v) {
-			f.kv.setAt(i, k[:nk], v[:nv])
-		}
-	}
-	return nil
-}
-
-// Len returns the amount of key-value pairs parsed.
-func (f *Form) Len() int { return f.kv.Len() }
-
-// Pair returns the i'th key-value pair in wire order. The value is nil for a
-// pair with no '=', i.e: "ok" in "ok&q=go", which distinguishes it from "ok="
-// where the value is present and empty.
-func (f *Form) Pair(i int) (key, value []byte) {
-	return f.kv.At(i)
-}
-
-// Get returns the value of the first pair matching key, nil if absent or if the
-// pair has no value. Bytes are compared as stored, so call [Form.Decode] first
-// when keys may be encoded.
-func (f *Form) Get(key string) []byte { return f.kv.Get(key) }
-
-// Has returns true if key is present, with or without a value.
-func (f *Form) Has(key string) bool { return f.kv.Present(key) }
-
-// AppendKeyValues appends the form's wire representation to dst and returns it.
-func (f *Form) AppendKeyValues(dst []byte) []byte {
-	nkv := f.kv.Len()
-	for i := range nkv {
-		key, value := f.Pair(i)
-		if i > 0 {
-			dst = append(dst, '&')
-		}
-		dst = append(dst, key...)
-		if value != nil {
-			dst = append(dst, '=')
-			dst = append(dst, value...)
-		}
-	}
-	return dst
-}
-
-// NextQueryPair splits the leading key-value pair off a query string and returns
-// what remains of it. Loop until rawkey is nil:
-//
-//	rawkey, rawval, rest := httpraw.NextQueryPair(h.RequestQuery())
-//	for rawkey != nil {
-//		// use rawkey, rawval.
-//		rawkey, rawval, rest = httpraw.NextQueryPair(rest)
-//	}
-//
-// A pair with no '=' yields a nil rawval, i.e: "debug" in "?debug&q=go", which
-// distinguishes it from "?debug=" where the value is present and empty. Empty
-// sequences are skipped, so "?&&q=go&" yields a single pair. Only '&' separates
-// pairs and only the first '=' splits a pair.
-func NextQueryPair(query []byte) (rawkey, rawval, rest []byte) {
-	for len(query) > 0 {
-		pair := query
-		amp := bytes.IndexByte(query, '&')
-		if amp >= 0 {
-			pair, query = query[:amp], query[amp+1:]
-		} else {
-			query = nil
-		}
-		if len(pair) == 0 {
-			continue // Empty sequence, see WHATWG URL urlencoded parsing.
-		}
-		if before, after, ok := bytes.Cut(pair, []byte{'='}); ok {
-			return before, after, query
-		}
-		return pair, nil, query
-	}
-	return nil, nil, nil
-}

http/httpraw/form_test.go

@@ -1,198 +0,0 @@
-package httpraw
-
-import (
-	"strings"
-	"testing"
-)
-
-// render joins a form's pairs as "key=value", a valueless key as "key".
-func render(f *Form) string {
-	var sb strings.Builder
-	for i := range f.Len() {
-		key, value := f.Pair(i)
-		if i > 0 {
-			sb.WriteByte('|')
-		}
-		sb.Write(key)
-		if value != nil {
-			sb.WriteByte('=')
-			sb.Write(value)
-		}
-	}
-	return sb.String()
-}
-
-func TestFormParse(t *testing.T) {
-	for _, test := range []struct {
-		body string
-		want string
-	}{
-		{body: "", want: ""},
-		{body: "q=go", want: "q=go"},
-		{body: "name=Jos%C3%A9+P%C3%A9rez&msg=hi+there&ok=on", want: "name=Jos%C3%A9+P%C3%A9rez|msg=hi+there|ok=on"},
-		{body: "ok", want: "ok"},                   // Flag: no '=' at all.
-		{body: "ok=", want: "ok="},                 // Present but empty.
-		{body: "&&q=go&", want: "q=go"},            // Empty sequences skipped.
-		{body: "tag=a&tag=b", want: "tag=a|tag=b"}, // Duplicates kept in order.
-		{body: "=v", want: "=v"},                   // Empty name kept.
-		{body: "a=b=c", want: "a=b=c"},             // Only the first '=' splits.
-	} {
-		var f Form
-		if err := f.ParseBytes([]byte(test.body)); err != nil {
-			t.Fatalf("%q: %s", test.body, err)
-		}
-		if got := render(&f); got != test.want {
-			t.Errorf("%q: want %q, got %q", test.body, test.want, got)
-		}
-	}
-}
-
-// Decode rewrites keys and values in place: percent escapes and '+' as space.
-func TestFormDecode(t *testing.T) {
-	var f Form
-	const body = "name=Jos%C3%A9+P%C3%A9rez&a%20b=c%2Bd&ok"
-	if err := f.ParseBytes([]byte(body)); err != nil {
-		t.Fatal(err)
-	}
-	if err := f.Decode(); err != nil {
-		t.Fatal(err)
-	}
-	const want = "name=José Pérez|a b=c+d|ok"
-	if got := render(&f); got != want {
-		t.Errorf("want %q, got %q", want, got)
-	}
-	if got := string(f.Get("a b")); got != "c+d" {
-		t.Errorf("want decoded key lookup %q, got %q", "c+d", got)
-	}
-}
-
-// Decoding a valueless key that shrinks must rewrite the key without inventing
-// a value: the pair has no '=' before Decode and must have none after.
-func TestFormDecodeValuelessKeyShrinks(t *testing.T) {
-	var f Form
-	const body = "a=1&o%6Bay"
-	if err := f.ParseBytes([]byte(body)); err != nil {
-		t.Fatal(err)
-	}
-	if err := f.Decode(); err != nil {
-		t.Fatal(err)
-	}
-	const want = "a=1|okay"
-	if got := render(&f); got != want {
-		t.Errorf("want %q, got %q", want, got)
-	}
-	if _, value := f.Pair(1); value != nil {
-		t.Errorf("want valueless pair to stay valueless, got value %q", value)
-	}
-	if !f.Has("okay") {
-		t.Error("want decoded valueless key present")
-	}
-}
-
-// A malformed escape must be reported, never silently passed through.
-func TestFormDecodeMalformed(t *testing.T) {
-	for _, body := range []string{"q=%zz", "%zz=v", "q=%4"} {
-		var f Form
-		if err := f.ParseBytes([]byte(body)); err != nil {
-			t.Fatal(err)
-		}
-		if err := f.Decode(); err == nil {
-			t.Errorf("%q: want decode error, got nil", body)
-		}
-	}
-}
-
-func TestFormGetHas(t *testing.T) {
-	var f Form
-	if err := f.ParseBytes([]byte("tag=a&tag=b&ok&empty=")); err != nil {
-		t.Fatal(err)
-	}
-	if got := string(f.Get("tag")); got != "a" {
-		t.Errorf("want first value %q, got %q", "a", got)
-	}
-	if got := f.Get("ok"); got != nil {
-		t.Errorf("want nil value for valueless key, got %q", got)
-	}
-	if got := f.Get("nope"); got != nil {
-		t.Errorf("want nil for absent key, got %q", got)
-	}
-	if v := f.Get("empty"); v == nil || len(v) != 0 {
-		t.Errorf("want present empty value, got %v", v)
-	}
-	for _, key := range []string{"tag", "ok", "empty"} {
-		if !f.Has(key) {
-			t.Errorf("want Has(%q) true", key)
-		}
-	}
-	if f.Has("nope") {
-		t.Error("want Has(nope) false")
-	}
-}
-
-func TestFormAppendKeyValues(t *testing.T) {
-	const body = "name=go&ok&empty=&tag=a&tag=b"
-	var f Form
-	if err := f.ParseBytes([]byte(body)); err != nil {
-		t.Fatal(err)
-	}
-	if got := string(f.AppendKeyValues(nil)); got != body {
-		t.Errorf("want round trip %q, got %q", body, got)
-	}
-}
-
-// Parsing into a reused Form must not allocate: the pair storage is reused.
-func TestFormParseReuseNoAlloc(t *testing.T) {
-	body := []byte("name=go&tag=a&tag=b&ok")
-	var f Form
-	if err := f.ParseBytes(body); err != nil { // Warm up the pair storage.
-		t.Fatal(err)
-	}
-	allocs := testing.AllocsPerRun(100, func() {
-		f.Reset(body, 0) // 0 preserves the pair storage warmed up above, the reuse under test.
-		f.Parse()
-	})
-	if allocs != 0 {
-		t.Errorf("reused Form allocated %v times, want 0", allocs)
-	}
-}
-
-// BufferUsed reports buffered bytes, not parsed pairs, so a caller appending
-// from several sources can tell whether a separator is needed before the next
-// one. Form.Len is zero until Parse runs and cannot answer that.
-func TestFormBufferUsed(t *testing.T) {
-	var f Form
-	f.Reset(nil, defaultKVCap)
-	if got := f.BufferUsed(); got != 0 {
-		t.Errorf("want 0 on a fresh form, got %d", got)
-	}
-	if err := f.ReadFromBytes([]byte("a=1")); err != nil {
-		t.Fatal(err)
-	}
-	if got := f.BufferUsed(); got != 3 {
-		t.Errorf("want 3 buffered, got %d", got)
-	}
-	if got := f.Len(); got != 0 {
-		t.Errorf("Len must stay 0 until Parse, got %d", got)
-	}
-	// A second source appended behind a separator.
-	if err := f.ReadFromBytes([]byte("&b=2")); err != nil {
-		t.Fatal(err)
-	}
-	if got := f.BufferUsed(); got != 7 {
-		t.Errorf("want 7 buffered, got %d", got)
-	}
-	if err := f.Parse(); err != nil {
-		t.Fatal(err)
-	}
-	if got := render(&f); got != "a=1|b=2" {
-		t.Errorf("want a=1|b=2, got %q", got)
-	}
-	if got := f.BufferUsed(); got != 7 {
-		t.Errorf("BufferUsed must not change on Parse, got %d", got)
-	}
-	// Reset discards the pairs and the buffered bytes with them.
-	f.Reset(nil, defaultKVCap)
-	if got := f.BufferUsed(); got != 0 {
-		t.Errorf("want 0 after Reset, got %d", got)
-	}
-}

http/httpraw/header.go

@@ -0,0 +1,542 @@
+package httpraw
+
+import (
+	"bytes"
+	"io"
+	"slices"
+)
+
+const (
+	methodGet        = "GET"
+	strHTTP11        = "HTTP/1.1"
+	strCRLF          = "\r\n"
+	headerCookie     = "Cookie"
+	headerConnection = "Connection"
+	strClose         = "close"
+)
+
+type flags uint16
+
+const (
+	flagNoBufferGrow flags = 1 << iota
+	flagDoneParsingHeader
+	flagOOMReached
+	flagConnClose
+	flagNoHTTP11
+	flagMangledBuffer // set when header fields appended to buffer via Add,Set calls
+	flagReaderEOF
+)
+
+func (f flags) hasAny(checkThese flags) bool {
+	return f&checkThese != 0
+}
+
+// Header implements "raw" HTTP header key-value parsing, validation and marshalling.
+//
+// It does NOT implement:
+//   - Normalization.
+//   - Cookies (see [Cookie]).
+//   - Special header optimizations.
+//   - Content-Length validation and other special header field value validation.
+type Header struct {
+	hbuf headerBuf
+
+	// Request fields.
+	method     headerSlice
+	requestURI headerSlice
+	proto      headerSlice
+
+	// Response fields.
+	statusCode headerSlice
+	statusText headerSlice
+
+	flags flags
+	_     noCopy
+}
+
+// EnableBufferGrowth disables buffer growth during parsing if b is false. Is enabled by default.
+// Disabling buffer growth prevents allocations but methods may throw errors on insufficient memory.
+func (h *Header) EnableBufferGrowth(b bool) {
+	if !b {
+		h.flags |= flagNoBufferGrow
+	} else {
+		h.flags &^= flagNoBufferGrow
+	}
+}
+
+// ParseBytes copies the bytes into buffer and parses the HTTP header. It fails if HTTP header data is incomplete.
+func (h *Header) ParseBytes(asResponse bool, b []byte) error {
+	h.Reset(nil)
+	h.hbuf.readFromBytes(b)
+	return h.parse(asResponse)
+}
+
+// Parse parses accumulated data in-place with no copying. One can set HTTP header data buffer with [Header.Reset].
+// It fails if HTTP data is incomplete.
+func (h *Header) Parse(asResponse bool) error {
+	debuglog("http:parse:reset")
+	h.Reset(h.hbuf.buf)
+	debuglog("http:parse:start")
+	return h.parse(asResponse)
+}
+
+// TryParse begins parsing or resumes parsing from a failed previous attempt from any of the Parse* methods.
+// As long as needMoreData returns true future calls to TryParse may succeed and the header is not done parsing.
+// Users may call [Header.ForEach] in-between TryParse calls so as to validate values before header is completely parsed.
+//
+//	needMoreData := true
+//	var err error
+//	for needMoreData {
+//		_, err = h.ReadFrom(r, 1024)
+//		if err != nil {
+//			break
+//		}
+//		needMoreData, err = h.TryParse(asResponse)
+//	}
+//	if err != nil {
+//		return err
+//	}
+func (h *Header) TryParse(asResponse bool) (needMoreData bool, err error) {
+	if h.flags.hasAny(flagDoneParsingHeader) {
+		return false, errAlreadyParsed
+	} else if h.flags.hasAny(flagMangledBuffer) {
+		return false, errMangledBuffer
+	}
+	if asResponse && h.statusCode.len == 0 || !asResponse && h.requestURI.start == 0 {
+		err = h.parseFirstLine(asResponse)
+		if err != nil {
+			return err == errNeedMore, err
+		}
+	}
+	err = h.parseNextHeaders()
+	return err == errNeedMore, err
+}
+
+// ParsingSuccess returns true if TryParse was successful, that is to say it returned needMoreData==false and err==nil.
+func (h *Header) ParsingSuccess() bool {
+	return h.flags.hasAny(flagDoneParsingHeader)
+}
+
+// ReadFromLimited reads at most maxBytesToRead from reader and appends them to underlying buffer.
+// Used to accumulate HTTP header for later parsing with [Header.TryParse].
+// If read is successful (read length>0) and reader returns [io.EOF] then ReadFromLimited will return a nil error.
+func (h *Header) ReadFromLimited(r io.Reader, maxBytesToRead int) (int, error) {
+	if maxBytesToRead <= 0 {
+		return 0, errSmallBuffer
+	} else if h.flags.hasAny(flagMangledBuffer) {
+		return 0, errMangledBuffer
+	}
+	free := h.BufferFree()
+	if free < maxBytesToRead {
+		if h.flags.hasAny(flagNoBufferGrow) {
+			return 0, errSmallBuffer
+		}
+		h.hbuf.buf = slices.Grow(h.hbuf.buf, maxBytesToRead)
+	}
+	blen := len(h.hbuf.buf)
+	b := h.hbuf.buf[blen:min(blen+maxBytesToRead, cap(h.hbuf.buf))]
+	n, err := r.Read(b)
+	if err != nil && err == io.EOF {
+		h.flags |= flagReaderEOF
+		if n > 0 {
+			err = nil // Nil-out error if read was succesful so as to not spook readers.
+		}
+	}
+	h.hbuf.buf = h.hbuf.buf[:blen+n]
+	return n, err
+}
+
+// ReadFromBytes appends argument buffer to underlying buffer.
+// Used to accumulate HTTP header for later parsing with [Header.TryParse].
+func (h *Header) ReadFromBytes(b []byte) (int, error) {
+	if len(b) == 0 {
+		return 0, errSmallBuffer
+	}
+	free := h.BufferFree()
+	if free < len(b) {
+		if h.flags.hasAny(flagNoBufferGrow) {
+			return 0, errSmallBuffer
+		}
+		h.hbuf.buf = slices.Grow(h.hbuf.buf, len(b))
+	}
+	h.hbuf.readFromBytes(b)
+	return len(b), nil
+}
+
+// BufferReceived returns the amoung of bytes read during calls to Read* methods.
+// Returns 0 if buffer is invalid/mangled.
+func (h *Header) BufferReceived() int {
+	if h.flags.hasAny(flagMangledBuffer | flagOOMReached) {
+		return 0
+	}
+	return len(h.hbuf.buf)
+}
+
+// BufferParsed returns the amount of bytes parsed during a call to Parse* methods.
+// If the Parse* method completed without error then BufferParsed returns the header's length including the final "\r\n\r\n" text.
+// BufferParsed returns 0 if the buffer is invalid/mangled or if no header data has been parsed succesfully.
+func (h *Header) BufferParsed() int {
+	if h.flags.hasAny(flagMangledBuffer | flagOOMReached) {
+		return 0
+	}
+	return h.hbuf.off
+}
+
+// BufferUsed returns the raw memory used.
+//
+//	BufferUsed + BufferFree == BufferCapacity
+func (h *Header) BufferUsed() int {
+	return len(h.hbuf.buf)
+}
+
+// BufferFree returns amount of bytes free in underlying buffer.
+//
+//	BufferUsed + BufferFree == BufferCapacity
+func (h *Header) BufferFree() int {
+	return h.hbuf.free()
+}
+
+// BufferCapacity returns the total capacity of the underlying buffer.
+//
+//	BufferUsed + BufferFree == BufferCapacity
+func (h *Header) BufferCapacity() int {
+	return cap(h.hbuf.buf)
+}
+
+// ForEach iterates over header key-value field tuples.
+func (h *Header) ForEach(cb func(key, value []byte) error) error {
+	return h.hbuf.forEach(cb)
+}
+
+func (hb *headerBuf) forEach(cb func(key, value []byte) error) error {
+	nh := len(hb.headers)
+	for i := range nh {
+		kv := hb.headers[i]
+		if !kv.isValid() {
+			continue
+		}
+		key := hb.musttoken(kv.key)
+		value := hb.musttoken(kv.value)
+		err := cb(key, value)
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// Reset discards all parsed data and sets the buffer data to buf. This method
+// can be used to avoid copying and growing buffers. Call [Header.Parse] after setting buffer
+// data with Reset to parse data in-place.
+// If buf is nil then the current buffer is reused. There are 3 ways to use Reset:
+//
+//	h.Reset(prealloc[:0]); h.ParseBytes(httpHeader) // Tell header to use a pre-allocated buffer capacity.
+//	h.Reset(httpHeader); h.Parse() // Parse bytes in place with no copying.
+//	h.Reset(nil) // Reuse buffer previously set in a call to Reset.
+func (h *Header) Reset(buf []byte) {
+	if h.flags.hasAny(flagNoBufferGrow) && cap(buf) < 32 {
+		panic("small buffer and flagNoBufferGrow set")
+	}
+	const persistentFlags = flagNoBufferGrow
+	debuglog("http:reset:hbuf")
+	h.hbuf.reset(buf)
+	*h = Header{
+		hbuf:  h.hbuf,
+		flags: h.flags & persistentFlags,
+	}
+	debuglog("http:reset:done")
+}
+
+// Body returns the surplus data following headers. It is only valid as long as Parse* or Reset methods are not called.
+func (h *Header) Body() ([]byte, error) {
+	debuglog("http:body")
+	if h.flags.hasAny(flagMangledBuffer) {
+		return nil, errMangledBuffer
+	} else if h.flags.hasAny(flagDoneParsingHeader) {
+		return h.hbuf.buf[h.hbuf.off:], nil
+	}
+	return nil, errUnparsed
+}
+
+// SetBytes is equivalent to [Header.Set] but with a []byte value. Does not keep reference to value slice.
+// Calling SetBytes Mangles the buffer.
+func (h *Header) SetBytes(key string, value []byte) {
+	h.Set(key, b2s(value))
+}
+
+// SetInt is equivalent to [Header.Set] but with an integer value i.e: Content-Length header key.
+// base must be in the range 2..36 (as accepted by [strconv.AppendInt]); other bases are dropped.
+// SetInt formats the value directly into the header buffer without heap allocation.
+func (h *Header) SetInt(key string, value int64, base int) {
+	if base < 2 || base > 36 {
+		return // strconv.AppendInt only supports base 2..36.
+	}
+	useKv := h.takeReusableSlot(key)
+	if useKv == nil {
+		h.appendHeaderInt(key, value, base)
+	} else {
+		useKv.value = h.reuseOrAppendInt(useKv.value, value, base)
+	}
+}
+
+// Set sets a key-value pair in the HTTP header.
+// Calling Set mangles the buffer.
+func (h *Header) Set(key, value string) {
+	useKv := h.takeReusableSlot(key)
+	if useKv == nil {
+		h.appendHeader(key, value)
+	} else {
+		useKv.value = h.reuseOrAppend(useKv.value, value)
+	}
+}
+
+// takeReusableSlot returns the valid key-value entry for key with the largest
+// value buffer (best candidate for in-place reuse) and invalidates any other
+// entries sharing the key. Returns nil if the key is not present.
+func (h *Header) takeReusableSlot(key string) *argsKV {
+	hb := &h.hbuf
+	var useKv *argsKV
+	for i := 0; i < len(hb.headers); i++ {
+		// Search for key-value with largest buffer for value to store value reusing buffer.
+		gotkv := &hb.headers[i]
+		if gotkv.isValid() && b2s(hb.musttoken(gotkv.key)) == key {
+			if useKv == nil {
+				useKv = gotkv
+			} else if gotkv.value.len > useKv.value.len {
+				useKv.invalidate()
+				useKv = gotkv
+			} else {
+				gotkv.invalidate()
+			}
+		}
+	}
+	return useKv
+}
+
+// Get gets the first value of a key found in the headers. Use [Header.ForEach] to find multiple values corresponding to same key.
+func (h *Header) Get(key string) []byte {
+	debuglog("http:get:start")
+	kv := h.peekHeader(key)
+	if kv.isValid() {
+		debuglog("http:get:found")
+		return h.hbuf.musttoken(kv.value)
+	}
+	debuglog("http:get:notfound")
+	return nil
+}
+
+// Add adds a new key-value pair to the HTTP header. Calling Add mangles the buffer.
+func (h *Header) Add(key, value string) {
+	h.appendHeader(key, value)
+}
+
+// Method returns HTTP request method.
+func (h *Header) Method() []byte {
+	return h.getNonEmptyValue(h.method)
+}
+
+// SetMethod sets the request header's method.
+func (h *Header) SetMethod(method string) {
+	h.method = h.reuseOrAppend(h.method, method)
+}
+
+// SetRequestURI sets RequestURI for the first HTTP request line.
+func (h *Header) SetRequestURI(requestURI string) {
+	h.requestURI = h.reuseOrAppend(h.requestURI, requestURI)
+}
+
+// RequestURI returns RequestURI from the first HTTP request line.
+func (h *Header) RequestURI() []byte {
+	return h.getNonEmptyValue(h.requestURI)
+}
+
+// Protocol returns the request header's HTTP protocol. Usually "HTTP/1.1".
+func (h *Header) Protocol() []byte {
+	return h.getNonEmptyValue(h.proto)
+}
+
+// SetProtocol sets the request header's protocol. Usually "HTTP/1.1".
+func (h *Header) SetProtocol(protocol string) {
+	h.proto = h.reuseOrAppend(h.proto, protocol)
+}
+
+// Status returns the response header's status code and status text. i.e: "200" "OK".
+func (h *Header) Status() (code, statusText []byte) {
+	if h.statusCode.len == 0 {
+		return nil, nil
+	}
+	return h.hbuf.musttoken(h.statusCode), h.hbuf.musttoken(h.statusText)
+}
+
+// Status sets the response header's status code and status text. i.e: "200" "OK".
+func (h *Header) SetStatus(code, statusText string) {
+	h.statusCode = h.reuseOrAppend(h.statusCode, code)
+	h.statusText = h.reuseOrAppend(h.statusText, statusText)
+}
+
+func (h *Header) getNonEmptyValue(s headerSlice) []byte {
+	if s.len == 0 {
+		return nil // If empty then value is invalid, return nil.
+	}
+	return h.hbuf.musttoken(s)
+}
+
+// AppendRequest appends the request header representation to the buffer and returns the result.
+func (h *Header) AppendRequest(dst []byte) ([]byte, error) {
+	proto := h.Protocol()
+	if h.flags.hasAny(flagOOMReached) {
+		return dst, errOOM
+	} else if h.requestURI.len == 0 || h.method.len == 0 {
+		return dst, errNeedMethodURI
+	} else if len(proto) == 0 {
+		return dst, errNoProto
+	}
+
+	method := h.Method()
+	if len(method) == 0 {
+		dst = append(dst, methodGet...)
+	} else {
+		dst = append(dst, method...)
+	}
+	uri := h.RequestURI()
+
+	dst = append(dst, ' ')
+	dst = append(dst, uri...)
+	dst = append(dst, ' ')
+	dst = append(dst, proto...)
+	dst = append(dst, strCRLF...)
+
+	dst = h.AppendHeaders(dst)
+
+	return append(dst, strCRLF...), nil
+}
+
+// AppendResponse appends the response header representation to the buffer and returns the result.
+func (h *Header) AppendResponse(dst []byte) ([]byte, error) {
+	proto := h.Protocol()
+	if h.flags.hasAny(flagOOMReached) {
+		return dst, errOOM
+	} else if h.statusCode.len == 0 || h.statusText.len == 0 {
+		return dst, errBadStatusCodeTxt
+	} else if len(proto) == 0 {
+		return dst, errNoProto
+	}
+	code, text := h.Status()
+
+	dst = append(dst, proto...)
+	dst = append(dst, ' ')
+	dst = append(dst, code...)
+	dst = append(dst, ' ')
+	dst = append(dst, text...)
+	dst = append(dst, strCRLF...)
+
+	dst = h.AppendHeaders(dst)
+
+	return append(dst, strCRLF...), nil
+}
+
+// AppendHeaders appends headers to buffer. Use AppendRequest and AppendResponse over this.
+// Does not append extra \r\n to end. Appends nothing if contains no headers.
+func (h *Header) AppendHeaders(dst []byte) []byte {
+	for i, n := 0, len(h.hbuf.headers); i < n; i++ {
+		kv := &h.hbuf.headers[i]
+		if kv.isValid() {
+			key := h.hbuf.musttoken(kv.key)
+			value := h.hbuf.musttoken(kv.value)
+			dst = appendHeaderLine(dst, b2s(key), b2s(value))
+		}
+	}
+	return dst
+}
+
+func (h *Header) String() string {
+	buf, err := h.AppendRequest(nil)
+	if err != nil {
+		buf, err = h.AppendResponse(nil)
+		if err != nil {
+			return err.Error()
+		}
+	}
+	return b2s(buf)
+}
+
+func appendHeaderLine(dst []byte, key, value string) []byte {
+	dst = append(dst, key...)
+	dst = append(dst, ':', ' ')
+	dst = append(dst, value...)
+	return append(dst, strCRLF...)
+}
+
+// Embed this type into a struct, which mustn't be copied,
+// so `go vet` gives a warning if this struct is copied.
+//
+// See https://github.com/golang/go/issues/8005#issuecomment-190753527 for details.
+// and also: https://stackoverflow.com/questions/52494458/nocopy-minimal-example
+type noCopy struct{}
+
+func (*noCopy) Lock()   {}
+func (*noCopy) Unlock() {}
+
+// NormalizeKey normalizes a HTTP header key in-place. Returns true if buffer modified.
+// Examples of normalization:
+//   - CONTENT -> Content
+//   - content-length -> Content-Length
+//   - cOnTeNt-LenGtH -> Content-Length
+func NormalizeHeaderKey(b []byte) (modified bool) {
+	if len(b) == 0 {
+		return false
+	}
+	const asciiCapDiff = 'a' - 'A'
+	for i := -1; i < len(b); i++ {
+		nextToUpper := i == -1 || (b[i] == '-' && i < len(b)-1)
+		if nextToUpper {
+			i++
+			isLower := b[i] >= 'a' && b[i] <= 'z'
+			if isLower {
+				modified = true
+				b[i] -= asciiCapDiff
+			}
+		} else {
+			isUpper := b[i] >= 'A' && b[i] <= 'Z'
+			if isUpper {
+				modified = true
+				b[i] += asciiCapDiff
+			}
+		}
+	}
+	return modified
+}
+
+// CopyNormalizedHeaderValue copies the header value in the value buffer to dst.
+// The result may be shrunk. The target and source buffers can only alias if the
+// destination buffer 0 address is equal to value's 0 address.
+// Header value normalization implies the replacement of \r\n\t with a single space.
+func CopyNormalizedHeaderValue(dst []byte, value []byte) (n int, modified bool) {
+	if len(dst) < len(value) {
+		panic("httpraw.CopyNormalizedHeaderValue: dst buffer shorter than length")
+	}
+	write := 0
+	read := 0
+	for {
+		rmStart := bytes.IndexByte(value[read:], '\n')
+		if rmStart < 0 {
+			write += copy(dst[write:], value[read:])
+			break
+		}
+		omit := 1
+		rmStart += read
+		if rmStart+1 < len(value) && value[rmStart+1] == '\t' {
+			omit++
+		}
+		if rmStart > 0 && value[rmStart-1] == '\r' {
+			rmStart--
+			omit++
+		}
+		modified = true
+		n := copy(dst[write:], value[read:rmStart])
+		dst[write+n] = ' '
+		read += omit + n
+		write += n + 1
+	}
+	return write, modified
+}

http/httpraw/header_test.go

@@ -0,0 +1,425 @@
+package httpraw
+
+import (
+	"bytes"
+	"fmt"
+	"net/http"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestHeaderParseRequest(t *testing.T) {
+	const (
+		wantMethod  = "GET"
+		wantURI     = "/data/set"
+		wantMessage = "hello world!"
+		asRequest   = false
+		asResponse  = true
+	)
+	req, err := http.NewRequest(wantMethod, wantURI, strings.NewReader(wantMessage))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var wantCookie http.Cookie
+	wantCookie.SameSite = http.SameSiteLaxMode
+	wantCookie.MaxAge = 360000
+	wantCookie.Name = "key"
+	wantCookie.Value = "value"
+	wantCookie.Expires = time.Now().Add(time.Hour)
+	wantCookie.Domain = "DOM"
+	wantCookie.HttpOnly = true
+	wantCookie.Secure = true
+	wantCookie.Path = "/abc"
+	req.Header.Set("Cookie", wantCookie.String())
+	t.Log("valid cookie:", wantCookie.Valid() == nil, wantCookie.String())
+
+	var buf bytes.Buffer
+	req.Write(&buf)
+	var hdr Header
+	msg := buf.Bytes()
+
+	start := time.Now()
+	err = hdr.ParseBytes(asRequest, msg)
+	elapsed := time.Since(start)
+	if err != nil {
+		t.Fatal(err)
+	}
+	fmt.Printf("%s\nparsed in %s\n\n", msg, elapsed.String())
+	if string(hdr.Method()) != wantMethod {
+		t.Errorf("want method %s, got %q", wantMethod, hdr.Method())
+	}
+	if !bytes.Equal(hdr.RequestURI(), []byte(wantURI)) {
+		t.Errorf("want request URI %q, got %q", wantURI, hdr.RequestURI())
+	}
+	contentLength, _ := strconv.Atoi(string(hdr.Get("Content-Length")))
+	if contentLength != len(wantMessage) {
+		t.Errorf("want Content-Length %d, got %d", len(wantMessage), contentLength)
+	}
+	var c Cookie
+	cookie := hdr.Get("Cookie")
+	c.Reset(cookie)
+	err = c.Parse()
+	if err != nil {
+		t.Error(err)
+	}
+	key := string(c.Name())
+	if key != wantCookie.Name {
+		t.Errorf("want cookie key %q, got %q", wantCookie.Name, key)
+	}
+	value := string(c.Value())
+	if value != wantCookie.Value {
+		t.Errorf("want cookie key %q, got %q", wantCookie.Value, value)
+	}
+	domain := string(c.Get("Domain"))
+	if domain != wantCookie.Domain {
+		t.Errorf("want domain %q, got %q", wantCookie.Domain, domain)
+	}
+	httpOnly := c.HasKeyOrSingleValue("HttpOnly")
+	if httpOnly != wantCookie.HttpOnly {
+		t.Errorf("want cookie HttpOnly %v, got %v", wantCookie.HttpOnly, httpOnly)
+	}
+	secure := c.HasKeyOrSingleValue("Secure")
+	if secure != wantCookie.Secure {
+		t.Errorf("want cookie HttpOnly %v, got %v", wantCookie.Secure, secure)
+	}
+	samesite := string(c.Get("SameSite"))
+	if samesite != strSameSite(wantCookie.SameSite) {
+		t.Errorf("want cookie SameSite %v, got %v", strSameSite(wantCookie.SameSite), samesite)
+	}
+	body, err := hdr.Body()
+	if err != nil {
+		t.Error(err)
+	}
+	if string(body) != wantMessage {
+		t.Errorf("want body message %q, got %q", wantMessage, body)
+	}
+	cookieStr := string(c.AppendKeyValues(nil))
+	if wantCookie.String() != cookieStr {
+		t.Errorf("want full cookie representation\n%qgot:\n%q", wantCookie.String(), cookieStr)
+	}
+	data, _ := hdr.AppendRequest(nil)
+	fmt.Printf("%s", data)
+}
+
+func BenchmarkParseBytes(b *testing.B) {
+	b.StopTimer()
+	const (
+		wantMethod  = "GET"
+		wantURI     = "/data/set"
+		wantMessage = "hello world!"
+		asRequest   = false
+	)
+	req, _ := http.NewRequest(wantMethod, wantURI, strings.NewReader(wantMessage))
+	var rawBuf bytes.Buffer
+	req.Write(&rawBuf)
+	data := rawBuf.Bytes()
+
+	// hdr is declared outside the loop so that ParseBytes can reuse the
+	// backing arrays on Reset (headers slice and data buffer) without
+	// allocating on every iteration. Declaring it inside the loop causes
+	// two allocs per iteration: one for the headers slice (make in reset)
+	// and one for the data buffer (append in readFromBytes).
+	var hdr Header
+	b.StartTimer()
+
+	for b.Loop() {
+		err := hdr.ParseBytes(asRequest, data)
+		if err != nil {
+			b.Fatal(err)
+		}
+		_, err = hdr.Body()
+		if err != nil {
+			b.Fatal(err)
+		}
+	}
+}
+
+func strSameSite(mode http.SameSite) string {
+	switch mode {
+	case http.SameSiteLaxMode:
+		return "Lax"
+	case http.SameSiteDefaultMode:
+		return ""
+	case http.SameSiteStrictMode:
+		return "Strict"
+	case http.SameSiteNoneMode:
+		return "None"
+	default:
+		panic("invalid same site")
+	}
+}
+
+func TestHeaderNormalizeKey(t *testing.T) {
+	var tests = []struct {
+		key      string
+		wantnorm string
+	}{
+		{key: "", wantnorm: ""},
+		{key: "a-a-a", wantnorm: "A-A-A"},
+		{key: "a-a-a-", wantnorm: "A-A-A-"},
+		{key: "-", wantnorm: "-"},
+		{key: "CONTENT", wantnorm: "Content"},
+		{key: "cONTENT", wantnorm: "Content"},
+		{key: "Content-Length", wantnorm: "Content-Length"},
+		{key: "Content-length", wantnorm: "Content-Length"},
+		{key: "content-length", wantnorm: "Content-Length"},
+		{key: "conTent-lENgth", wantnorm: "Content-Length"},
+		{key: "conTent-lENgth-", wantnorm: "Content-Length-"},
+	}
+	for _, test := range tests {
+		gotKey := []byte(test.key)
+		modified := NormalizeHeaderKey(gotKey)
+		if string(gotKey) != test.wantnorm {
+			t.Errorf("mismatch want %q got %q", test.wantnorm, gotKey)
+		}
+		wantMod := string(gotKey) != test.key
+		if wantMod != modified {
+			t.Errorf("mismatch want mod=%v, got mod=%v", wantMod, modified)
+		}
+	}
+}
+
+func TestCopyNormalizedHeaderValue(t *testing.T) {
+	var tests = []struct {
+		value    string
+		wantnorm string
+	}{
+		{value: "abc\r\n\tdef\r\n\tghi", wantnorm: "abc def ghi"},
+		{value: "abc\r\n\tabc", wantnorm: "abc abc"},
+		{value: "abc\n\tdef\n\tghi", wantnorm: "abc def ghi"},
+		{value: "abc\n\tdef\n\tghi\n\t", wantnorm: "abc def ghi "},
+		{value: "abc\n\tdef\n\tghi\r\n\t", wantnorm: "abc def ghi "},
+		{value: "", wantnorm: ""},
+		{value: "abc", wantnorm: "abc"},
+	}
+	dst := make([]byte, 256)
+	for _, test := range tests {
+		value := []byte(test.value)
+		n, modified := CopyNormalizedHeaderValue(dst[:len(value)], value)
+		got := dst[:n]
+		if string(got) != test.wantnorm {
+			t.Errorf("mismatch want %q got %q", test.wantnorm, got)
+		}
+		wantMod := string(got) != test.value
+		if wantMod != modified {
+			t.Errorf("mismatch want mod=%v, got mod=%v", wantMod, modified)
+		}
+	}
+}
+
+func TestHeaderSetOverwrite(t *testing.T) {
+	var h Header
+	h.Reset(nil)
+	h.SetMethod("GET")
+	h.SetRequestURI("/")
+	h.SetProtocol("HTTP/1.1")
+
+	h.Set("Host", "first.example.com")
+	h.Set("Host", "second.example.com")
+
+	got := string(h.Get("Host"))
+	if got != "second.example.com" {
+		t.Errorf("want Host %q, got %q", "second.example.com", got)
+	}
+	req, err := h.AppendRequest(nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if n := strings.Count(string(req), "Host:"); n != 1 {
+		t.Errorf("want 1 Host field in request, got %d:\n%s", n, req)
+	}
+}
+
+func TestHeaderSetBytesEmptyValue(t *testing.T) {
+	var h Header
+	h.Reset(nil)
+	h.SetBytes("X-Empty", nil)
+	if got := h.Get("X-Empty"); len(got) != 0 {
+		t.Errorf("want empty value, got %q", got)
+	}
+}
+
+// buffer/offset past uint16 range silently corrupts or panics.
+// A header block > 64KiB pushes a field's offset past 65535. tokint truncation
+// makes Get return the wrong window (silent corruption) or panic on slice bounds.
+func TestHeader_LargeBufferOverflow(t *testing.T) {
+	const wantVal = "the-canary-value"
+	// Pad with a big header so the canary field lands past offset 65535.
+	pad := strings.Repeat("x", 70000)
+	raw := "GET / HTTP/1.1\r\n" +
+		"X-Pad: " + pad + "\r\n" +
+		"X-Canary: " + wantVal + "\r\n" +
+		"\r\n"
+
+	var h Header
+	err := h.ParseBytes(false, []byte(raw))
+	if err != nil {
+		// Clean rejection of the oversized header is the intended behavior:
+		// no panic, no silent corruption.
+		return
+	}
+	// If it did parse, the value must be correct (never a truncated-offset window).
+	got := string(h.Get("X-Canary"))
+	if got != wantVal {
+		t.Fatalf("overflow corruption: want X-Canary %q, got %q", wantVal, got)
+	}
+}
+
+// a complete but malformed header line with no colon must be a hard error,
+// not errNeedMore (which makes a streaming parser wait forever).
+func TestHeader_ColonlessLineIsHardError(t *testing.T) {
+	raw := "GET / HTTP/1.1\r\nBadHeaderNoColon\r\n\r\n"
+	var h Header
+	err := h.ParseBytes(false, []byte(raw))
+	if err == nil {
+		t.Fatal("want error on colonless header line, got nil")
+	}
+	if err == errNeedMore {
+		t.Fatalf("colonless line reported as errNeedMore (parser would hang); want a hard error like errInvalidName")
+	}
+}
+
+// Regression for a TCP split landing BEFORE the colon (no newline yet) must
+// stay "need more data" and parse once the rest arrives. This is the case the
+// Colonless fix must NOT turn into a hard error.
+func TestHeader_SplitBeforeColonStillParses(t *testing.T) {
+	const part1 = "GET / HTTP/1.1\r\nHost" // split mid-key, before colon+newline
+	const part2 = ": example.com\r\n\r\n"
+
+	var h Header
+	h.Reset(nil)
+	if _, err := h.ReadFromBytes([]byte(part1)); err != nil {
+		t.Fatal(err)
+	}
+	needMore, err := h.TryParse(false)
+	if err != nil && err != errNeedMore {
+		t.Fatalf("split before colon: want errNeedMore/nil, got %v", err)
+	}
+	if !needMore {
+		t.Fatal("want needMoreData=true after partial input")
+	}
+
+	if _, err := h.ReadFromBytes([]byte(part2)); err != nil {
+		t.Fatal(err)
+	}
+	needMore, err = h.TryParse(false)
+	if err != nil {
+		t.Fatalf("after full input: %v", err)
+	}
+	if needMore {
+		t.Fatal("want needMoreData=false after full input")
+	}
+	if got := string(h.Get("Host")); got != "example.com" {
+		t.Fatalf("want Host %q, got %q", "example.com", got)
+	}
+}
+
+// appendHeader must reserve the +1 byte that mustAppendSlice consumes on an
+// empty buffer. Force cap == len(key)+len(value) to defeat allocator rounding.
+func TestHeader_AppendHeaderExactCapNoPanic(t *testing.T) {
+	const key, value = "K", "V"
+	buf := make([]byte, 0, len(key)+len(value)) // exact cap, no slack.
+	var h Header
+	h.Reset(buf)
+	defer func() {
+		if r := recover(); r != nil {
+			t.Fatalf("appendHeader panicked on exact-cap buffer: %v", r)
+		}
+	}()
+	h.Add(key, value)
+	if got := string(h.Get(key)); got != value {
+		t.Fatalf("want %q, got %q", value, got)
+	}
+}
+
+// Add/Set on a full buffer with growth disabled must drop gracefully (flag OOM),
+// never panic. Panicking is unacceptable for this package.
+func TestHeader_AddFullBufferNoPanic(t *testing.T) {
+	buf := make([]byte, 0, 40) // Small cap; enough for Reset (len 0) but not the field below.
+	var h Header
+	h.Reset(buf)
+	h.EnableBufferGrowth(false)
+	h.SetMethod("GET")
+	h.SetRequestURI("/")
+	h.SetProtocol("HTTP/1.1")
+
+	defer func() {
+		if r := recover(); r != nil {
+			t.Fatalf("Add on full no-grow buffer panicked: %v", r)
+		}
+	}()
+	h.Add("X-Very-Long-Header-Key", "a-value-that-cannot-possibly-fit-in-the-buffer")
+
+	// Graceful drop: request marshalling reports OOM instead of emitting bad data.
+	if _, err := h.AppendRequest(nil); err == nil {
+		t.Fatal("want OOM error after dropped Add, got nil")
+	}
+}
+
+func TestHeader_SetInt(t *testing.T) {
+	for _, tc := range []struct {
+		name  string
+		value int64
+		base  int
+		want  string
+	}{
+		{"decimal", 1234, 10, "1234"},
+		{"zero", 0, 10, "0"},
+		{"negative", -42, 10, "-42"},
+		{"maxint64", 9223372036854775807, 10, "9223372036854775807"},
+		{"minint64", -9223372036854775808, 10, "-9223372036854775808"},
+		{"hex", 255, 16, "ff"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			var h Header
+			h.Reset(nil)
+			h.SetInt("Content-Length", tc.value, tc.base)
+			if got := string(h.Get("Content-Length")); got != tc.want {
+				t.Fatalf("want %q, got %q", tc.want, got)
+			}
+		})
+	}
+}
+
+// SetInt on an existing key must reuse the slot in place (single field, latest value).
+func TestHeader_SetIntOverwrite(t *testing.T) {
+	var h Header
+	h.Reset(nil)
+	h.SetMethod("GET")
+	h.SetRequestURI("/")
+	h.SetProtocol("HTTP/1.1")
+
+	h.SetInt("Content-Length", 100, 10)
+	h.SetInt("Content-Length", 5, 10) // shorter, must fit in old slot.
+
+	if got := string(h.Get("Content-Length")); got != "5" {
+		t.Fatalf("want Content-Length %q, got %q", "5", got)
+	}
+	req, err := h.AppendRequest(nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if n := strings.Count(string(req), "Content-Length:"); n != 1 {
+		t.Errorf("want 1 Content-Length field, got %d:\n%s", n, req)
+	}
+}
+
+// SetInt must not heap-allocate: it must format directly into the header buffer.
+func TestHeader_SetIntNoAlloc(t *testing.T) {
+	buf := make([]byte, 0, 256)
+	var h Header
+	h.Reset(buf)
+	h.EnableBufferGrowth(false)
+	h.Add("Content-Length", "0000000000000000000000") // pre-size a reusable slot.
+	allocs := testing.AllocsPerRun(100, func() {
+		h.SetInt("Content-Length", 1234567890, 10)
+	})
+	if allocs != 0 {
+		t.Fatalf("SetInt allocated %v times, want 0", allocs)
+	}
+	if got := string(h.Get("Content-Length")); got != "1234567890" {
+		t.Fatalf("want %q, got %q", "1234567890", got)
+	}
+}

http/httpraw/headerv1.go

@@ -1,636 +0,0 @@
-package httpraw
-
-import (
-	"bytes"
-	"io"
-	"strconv"
-)
-
-const (
-	methodGet           = "GET"
-	strHTTP1            = "HTTP/1."
-	strHTTP11           = strHTTP1 + "1"
-	strCRLF             = "\r\n"
-	headerCookie        = "Cookie"
-	headerConnection    = "Connection"
-	headerContentLength = "Content-Length"
-	strClose            = "close"
-	strKeepAlive        = "keep-alive"
-)
-
-// Flags is a bitset of signals gathered while parsing or building a header,
-// such as a status code having been set or the peer requesting connection
-// close. See [HeaderV1.Flags].
-type Flags uint16
-
-const (
-	flagNoBufferGrow Flags = 1 << iota
-	flagDoneParsingHeader
-	flagOOMReached
-	flagConnClose
-	flagNoHTTP11
-	flagMangledBuffer // set when header fields appended to buffer via Add,Set calls
-	flagKVAppended    // set after KV appended to buffer outside Read methods.
-	flagReaderEOF
-	// set if [Header.SetStatus] or [Header.SetStatusInt] has been called.
-	FlagStatusSet
-)
-
-// HasAny returns true if any of the argument flags are set.
-func (f Flags) HasAny(checkThese Flags) bool {
-	return f&checkThese != 0
-}
-
-// HeaderV1 implements "raw" HTTP header key-value parsing, validation and marshalling.
-//
-// It does NOT implement:
-//   - Normalization.
-//   - Cookies (see [Cookie]).
-//   - Special header optimizations.
-//   - Content-Length validation and other special header field value validation.
-type HeaderV1 struct {
-	hbuf headerv1Buf
-
-	// Request fields.
-	method        view
-	requestTarget view
-	proto         view
-
-	// Response fields.
-	statusCode view
-	statusText view
-	_          noCopy
-}
-
-// Flags returns [Flags] to signal status code has been set, Connection:Close or other useful signals provided by flags.
-func (h *HeaderV1) Flags() Flags { return h.hbuf.kv.flags }
-
-// ConfigBufferGrowth configures the memory the header may use. Setting
-// outlives [HeaderV1.Reset]. Call before parsing/reading.
-//
-// enableBufferGrowth enables growing both the header buffer and the header key/value pair slice.
-func (h *HeaderV1) ConfigBufferGrowth(enableBufferGrowth bool) {
-	h.hbuf.kv.EnableBufferGrowth(enableBufferGrowth)
-}
-
-// ParseBytes copies the bytes into buffer and parses the HTTP header. It fails if HTTP header data is incomplete.
-func (h *HeaderV1) ParseBytes(asResponse bool, b []byte) error {
-	h.Reset(nil, 0)
-	err := h.hbuf.kv.ReadFromBytes(b)
-	if err != nil {
-		return err
-	}
-	return h.parse(asResponse)
-}
-
-// Parse parses accumulated data in-place with no copying. One can set HTTP header data buffer with [HeaderV1.Reset].
-// It fails if HTTP data is incomplete.
-func (h *HeaderV1) Parse(asResponse bool) error {
-	debuglog("http:parse:reset")
-	h.Reset(h.hbuf.kv.buf, 0)
-	debuglog("http:parse:start")
-	return h.parse(asResponse)
-}
-
-// TryParse begins parsing or resumes parsing from a failed previous attempt from any of the Parse* methods.
-// As long as needMoreData returns true future calls to TryParse may succeed and the header is not done parsing.
-// Users may call [HeaderV1.ForEach] in-between TryParse calls so as to validate values before header is completely parsed.
-//
-//	needMoreData := true
-//	var err error
-//	for needMoreData {
-//		_, err = h.ReadFrom(r, 1024)
-//		if err != nil {
-//			break
-//		}
-//		needMoreData, err = h.TryParse(asResponse)
-//	}
-//	if err != nil {
-//		return err
-//	}
-func (h *HeaderV1) TryParse(asResponse bool) (needMoreData bool, err error) {
-	flags := h.Flags()
-	if flags.HasAny(flagDoneParsingHeader) {
-		return false, errAlreadyParsed
-	} else if flags.HasAny(flagMangledBuffer) {
-		return false, errMangledBuffer
-	}
-	if asResponse && h.statusCode.len == 0 || !asResponse && h.requestTarget.start == 0 {
-		err = h.parseFirstLine(asResponse)
-		if err != nil {
-			return err == ErrNeedMoreData, err
-		}
-	}
-	err = h.parseNextHeaders(flags)
-	return err == ErrNeedMoreData, err
-}
-
-// ParsingSuccess returns true if TryParse was successful, that is to say it returned needMoreData==false and err==nil.
-func (h *HeaderV1) ParsingSuccess() bool {
-	return h.Flags().HasAny(flagDoneParsingHeader)
-}
-
-// ReadFromLimited reads at most maxBytesToRead from reader and appends them to underlying buffer.
-// Used to accumulate HTTP header for later parsing with [HeaderV1.TryParse].
-// If read is successful (read length>0) and reader returns [io.EOF] then ReadFromLimited will return a nil error.
-func (h *HeaderV1) ReadFromLimited(r io.Reader, maxBytesToRead int) (int, error) {
-	return h.hbuf.kv.ReadLimited(r, maxBytesToRead)
-}
-
-// ReadFromBytes appends argument buffer to underlying buffer.
-// Used to accumulate HTTP header for later parsing with [HeaderV1.TryParse].
-func (h *HeaderV1) ReadFromBytes(b []byte) error {
-	return h.hbuf.kv.ReadFromBytes(b)
-}
-
-// BufferReceived returns the amoung of bytes read during calls to Read* methods.
-// Returns 0 if buffer is invalid/mangled.
-func (h *HeaderV1) BufferReceived() int {
-	if h.Flags().HasAny(flagMangledBuffer | flagOOMReached) {
-		return 0
-	}
-	return len(h.hbuf.kv.BufferRaw())
-}
-
-// BufferParsed returns the amount of bytes parsed during a call to Parse* methods.
-// If the Parse* method completed without error then BufferParsed returns the header's length including the final "\r\n\r\n" text.
-// BufferParsed returns 0 if the buffer is invalid/mangled or if no header data has been parsed succesfully.
-func (h *HeaderV1) BufferParsed() int {
-	if h.Flags().HasAny(flagMangledBuffer | flagOOMReached) {
-		return 0
-	}
-	return h.hbuf.off
-}
-
-// BufferRaw returns the undeerlying buffer as stored currently in memory.
-// The length of the returned buffer is the used portion. Capacity of returned slice is [HeaderV1.BufferCapacity].
-func (h *HeaderV1) BufferRaw() []byte { return h.hbuf.kv.BufferRaw() }
-
-// BufferUsed returns the raw memory used.
-//
-//	BufferUsed + BufferFree == BufferCapacity
-func (h *HeaderV1) BufferUsed() int {
-	return len(h.hbuf.kv.BufferRaw())
-}
-
-// BufferFree returns amount of bytes free in underlying buffer.
-//
-//	BufferUsed + BufferFree == BufferCapacity
-func (h *HeaderV1) BufferFree() int {
-	return h.hbuf.free()
-}
-
-// BufferCapacity returns the total capacity of the underlying buffer.
-//
-//	BufferUsed + BufferFree == BufferCapacity
-func (h *HeaderV1) BufferCapacity() int {
-	return cap(h.hbuf.kv.BufferRaw())
-}
-
-// ForEach iterates over header key-value field tuples.
-func (h *HeaderV1) ForEach(cb func(key, value []byte) bool) {
-	h.hbuf.kv.ForEach(cb)
-}
-
-// Reset discards all parsed data and sets the buffer data to buf. This method
-// can be used to avoid copying and growing buffers. Call [HeaderV1.Parse] after setting buffer
-// data with Reset to parse data in-place.
-// If buf is nil then the current buffer is reused. There are 3 ways to use Reset:
-//
-//	h.Reset(prealloc[:0], 16); h.ParseBytes(httpHeader) // Tell header to use a pre-allocated buffer capacity.
-//	h.Reset(httpHeader, 16); h.Parse() // Parse bytes in place with no copying.
-//	h.Reset(nil) // Reuse buffer previously set in a call to Reset.
-func (h *HeaderV1) Reset(buf []byte, numHeaderCapacity int) {
-	const persistentFlags = flagNoBufferGrow
-	debuglog("http:reset:hbuf")
-	h.hbuf.reset(buf, numHeaderCapacity)
-	if h.Flags().HasAny(flagNoBufferGrow) && h.BufferCapacity() < 32 {
-		panic("small buffer and flagNoBufferGrow set")
-	}
-	*h = HeaderV1{hbuf: h.hbuf}
-	debuglog("http:reset:done")
-}
-
-// Body returns the surplus data following headers. It is only valid as long as Parse* or Reset methods are not called.
-func (h *HeaderV1) Body() ([]byte, error) {
-	debuglog("http:body")
-	flags := h.Flags()
-	if flags.HasAny(flagMangledBuffer) {
-		return nil, errMangledBuffer
-	} else if flags.HasAny(flagDoneParsingHeader) {
-		return h.BufferRaw()[h.hbuf.off:], nil
-	}
-	return nil, errUnparsed
-}
-
-// SetBytes is equivalent to [HeaderV1.Set] but with a []byte value. Does not keep reference to value slice.
-// Calling SetBytes Mangles the buffer.
-func (h *HeaderV1) SetBytes(key string, value []byte) {
-	h.Set(key, b2s(value))
-}
-
-// SetInt is equivalent to [HeaderV1.Set] but with an integer value i.e: Content-Length header key.
-// base must be in the range 2..36 (as accepted by [strconv.AppendInt]); other bases are dropped.
-// SetInt formats the value directly into the header buffer without heap allocation.
-func (h *HeaderV1) SetInt(key string, value int64, base int) {
-	if base < 2 || base > 36 {
-		return // strconv.AppendInt only supports base 2..36.
-	}
-	h.hbuf.kv.SetInt(key, value, base)
-}
-
-// Set sets a key-value pair in the HTTP header.
-// Calling Set mangles the buffer.
-func (h *HeaderV1) Set(key, value string) (enoughSpace bool) {
-	return h.hbuf.kv.Set(key, value)
-}
-
-// Get gets the first exact-match value of a key found in the headers. Use [HeaderV1.ForEach] to find multiple values corresponding to same key.
-func (h *HeaderV1) Get(key string) []byte {
-	return h.hbuf.kv.Get(key)
-}
-
-// GetFold gets the first value whose key matches key under ASCII case-insensitive
-// comparison, i.e: "content-length" matches "Content-Length".
-// Use [HeaderV1.Get] for exact match and [HeaderV1.ForEach] to find multiple values
-// corresponding to same key.
-func (h *HeaderV1) GetFold(key string) []byte {
-	return h.hbuf.kv.GetFold(key)
-}
-
-// NormalizeKeys normalizes all header keys. i.e: CONTENT-type -> Content-Type
-func (h *HeaderV1) NormalizeKeys() {
-	for i, kv := range h.hbuf.kv.kvs {
-		if kv.isValidHeader() {
-			NormalizeHeaderKey(h.hbuf.kv.AtKey(i))
-		}
-	}
-}
-
-// ContentLength returns the body length declared by the Content-Length field.
-// If the field is not present then the returned bool is false. Will return error for invalid or non-integer value.
-func (h *HeaderV1) ContentLength() (_ int64, present bool, _ error) {
-	value := h.GetFold(headerContentLength)
-	if value == nil {
-		return 0, false, nil
-	}
-	value = trimOWS(value)
-	// Unsigned parse of 63 bits rejects a sign and anything past int64's range.
-	n, err := strconv.ParseInt(b2s(value), 10, 64)
-	if err != nil || n < 0 {
-		return n, true, errBadContentLength // strconv's error allocates and is not comparable.
-	}
-	return n, true, nil
-}
-
-// Add adds a new key-value pair to the HTTP header. Calling Add mangles the buffer.
-func (h *HeaderV1) Add(key, value string) {
-	h.hbuf.kv.appendPair(key, value)
-}
-
-// Method returns HTTP request method.
-func (h *HeaderV1) Method() []byte {
-	return h.getNonEmptyValue(h.method)
-}
-
-// SetMethod sets the request header's method.
-func (h *HeaderV1) SetMethod(method string) {
-	h.method = h.hbuf.kv.reuseOrAppend(h.method, method)
-}
-
-// SetRequestTarget sets request-target (URI) for the first HTTP request line.
-func (h *HeaderV1) SetRequestTarget(requestTarget string) {
-	h.requestTarget = h.hbuf.kv.reuseOrAppend(h.requestTarget, requestTarget)
-}
-
-// RequestTarget returns a view of the request-target (URI) of the first HTTP request line.
-// Called Request-URI in the obsolete RFC 2616, renamed request-target by RFC 9112.
-func (h *HeaderV1) RequestTarget() []byte {
-	return h.getNonEmptyValue(h.requestTarget)
-}
-
-// RequestPath returns the request-target (URI) up to the query string, i.e: "/search"
-// for "/search?q=go". Returns the whole target if it contains no query string.
-func (h *HeaderV1) RequestPath() []byte {
-	target := h.RequestTarget()
-	before, _, ok := bytes.Cut(target, []byte{'?'})
-	if !ok {
-		return target
-	}
-	return before
-}
-
-// RequestQuery returns the request-target (URI) query string as it appears on the
-// wire, percent-encoded and with '+' undecoded, i.e: "q=go" for "/search?q=go".
-// Returns nil if the target has no query string. Iterate it with [NextQueryPair].
-func (h *HeaderV1) RequestQuery() []byte {
-	target := h.RequestTarget()
-	_, after, ok := bytes.Cut(target, []byte{'?'})
-	if !ok {
-		return nil
-	}
-	return after
-}
-
-// Protocol returns the request header's HTTP protocol. Usually "HTTP/1.1".
-func (h *HeaderV1) Protocol() []byte {
-	return h.getNonEmptyValue(h.proto)
-}
-
-// SetProtocol sets the request header's protocol. Usually "HTTP/1.1".
-func (h *HeaderV1) SetProtocol(protocol string) {
-	h.proto = h.hbuf.kv.reuseOrAppend(h.proto, protocol)
-}
-
-// Status returns the response header's status code and status text. i.e: "200" "OK".
-func (h *HeaderV1) Status() (code, statusText []byte) {
-	if h.statusCode.len == 0 {
-		return nil, nil
-	}
-	return h.hbuf.kv.musttoken(h.statusCode), h.hbuf.kv.musttoken(h.statusText)
-}
-
-// SetStatus sets the response header's status code and status text. i.e: "200" "OK".
-func (h *HeaderV1) SetStatus(code, statusText string) {
-	h.hbuf.kv.flags |= FlagStatusSet
-	h.statusCode = h.hbuf.kv.reuseOrAppend(h.statusCode, code)
-	h.statusText = h.hbuf.kv.reuseOrAppend(h.statusText, statusText)
-}
-
-// SetStatusInt is identical to [HeaderV1.SetStatus] but performs integer to text conversion for status code.
-func (h *HeaderV1) SetStatusInt(code int64, statusText string) {
-	h.hbuf.kv.flags |= FlagStatusSet
-	h.statusCode = h.hbuf.kv.reuseOrAppendInt(h.statusCode, code, 10)
-	h.statusText = h.hbuf.kv.reuseOrAppend(h.statusText, statusText)
-}
-
-func (h *HeaderV1) getNonEmptyValue(s view) []byte {
-	if s.len == 0 {
-		return nil // If empty then value is invalid, return nil.
-	}
-	return h.hbuf.kv.musttoken(s)
-}
-
-// AppendRequest appends the request header representation to the buffer and returns the result.
-func (h *HeaderV1) AppendRequest(dst []byte) ([]byte, error) {
-	proto := h.Protocol()
-	if h.hbuf.kv.flags.HasAny(flagOOMReached) {
-		return dst, ErrBufferExhausted
-	} else if h.requestTarget.len == 0 || h.method.len == 0 {
-		return dst, errNeedMethodURI
-	} else if len(proto) == 0 {
-		return dst, errNoProto
-	}
-
-	method := h.Method()
-	if len(method) == 0 {
-		dst = append(dst, methodGet...)
-	} else {
-		dst = append(dst, method...)
-	}
-	uri := h.RequestTarget()
-
-	dst = append(dst, ' ')
-	dst = append(dst, uri...)
-	dst = append(dst, ' ')
-	dst = append(dst, proto...)
-	dst = append(dst, strCRLF...)
-
-	dst = h.AppendHeaders(dst)
-
-	return append(dst, strCRLF...), nil
-}
-
-// AppendResponse appends the response header representation to the buffer and returns the result.
-func (h *HeaderV1) AppendResponse(dst []byte) ([]byte, error) {
-	dst, err := h.AppendResponseNoHeaders(dst)
-	if err != nil {
-		return dst, err
-	}
-	dst = h.AppendHeaders(dst)
-	return append(dst, strCRLF...), nil
-}
-
-// AppendResponseNoHeaders appends the first line of the response containing protocol and status code/text: i.e: "HTTP/1.1 200 OK\r\n"
-func (h *HeaderV1) AppendResponseNoHeaders(dst []byte) ([]byte, error) {
-	proto := h.Protocol()
-	if h.hbuf.kv.flags.HasAny(flagOOMReached) {
-		return dst, ErrBufferExhausted
-	} else if h.statusCode.len == 0 || h.statusText.len == 0 {
-		return dst, errBadStatusCodeTxt
-	} else if len(proto) == 0 {
-		return dst, errNoProto
-	}
-	code, text := h.Status()
-
-	dst = append(dst, proto...)
-	dst = append(dst, ' ')
-	dst = append(dst, code...)
-	dst = append(dst, ' ')
-	dst = append(dst, text...)
-	dst = append(dst, strCRLF...)
-	return dst, nil
-}
-
-// AppendHeaders appends headers to buffer. Use AppendRequest and AppendResponse over this.
-// Does not append extra \r\n to end. Appends nothing if contains no headers.
-func (h *HeaderV1) AppendHeaders(dst []byte) []byte {
-	for i, kv := range h.hbuf.kv.kvs {
-		if kv.isValidHeader() {
-			k, v := h.hbuf.kv.At(i)
-			dst = appendHeaderLine(dst, b2s(k), b2s(v))
-		}
-	}
-	return dst
-}
-
-// String returns the header's wire representation, as a request if it has a
-// request line and as a response otherwise. Returns the error text if neither
-// can be built. Allocates, so it is meant for debugging and logging only.
-func (h *HeaderV1) String() string {
-	buf, err := h.AppendRequest(nil)
-	if err != nil {
-		buf, err = h.AppendResponse(nil)
-		if err != nil {
-			return err.Error()
-		}
-	}
-	return b2s(buf)
-}
-
-func appendHeaderLine(dst []byte, key, value string) []byte {
-	dst = append(dst, key...)
-	dst = append(dst, ':', ' ')
-	dst = append(dst, value...)
-	return append(dst, strCRLF...)
-}
-
-// Embed this type into a struct, which mustn't be copied,
-// so `go vet` gives a warning if this struct is copied.
-//
-// See https://github.com/golang/go/issues/8005#issuecomment-190753527 for details.
-// and also: https://stackoverflow.com/questions/52494458/nocopy-minimal-example
-type noCopy struct{}
-
-func (*noCopy) Lock()   {}
-func (*noCopy) Unlock() {}
-
-// NormalizeKey normalizes a HTTP header key in-place. Returns true if buffer modified.
-// Examples of normalization:
-//   - CONTENT -> Content
-//   - content-length -> Content-Length
-//   - cOnTeNt-LenGtH -> Content-Length
-func NormalizeHeaderKey(b []byte) (modified bool) {
-	if len(b) == 0 {
-		return false
-	}
-	const asciiCapDiff = 'a' - 'A'
-	for i := -1; i < len(b); i++ {
-		nextToUpper := i == -1 || (b[i] == '-' && i < len(b)-1)
-		if nextToUpper {
-			i++
-			isLower := b[i] >= 'a' && b[i] <= 'z'
-			if isLower {
-				modified = true
-				b[i] -= asciiCapDiff
-			}
-		} else {
-			isUpper := b[i] >= 'A' && b[i] <= 'Z'
-			if isUpper {
-				modified = true
-				b[i] += asciiCapDiff
-			}
-		}
-	}
-	return modified
-}
-
-// CopyNormalizedHeaderValue copies the header value in the value buffer to dst.
-// The result may be shrunk. The target and source buffers can only alias if the
-// destination buffer 0 address is equal to value's 0 address.
-// Header value normalization implies the replacement of \r\n\t with a single space.
-func CopyNormalizedHeaderValue(dst []byte, value []byte) (n int, modified bool) {
-	if len(dst) < len(value) {
-		panic("httpraw.CopyNormalizedHeaderValue: dst buffer shorter than length")
-	}
-	write := 0
-	read := 0
-	for {
-		rmStart := bytes.IndexByte(value[read:], '\n')
-		if rmStart < 0 {
-			write += copy(dst[write:], value[read:])
-			break
-		}
-		omit := 1
-		rmStart += read
-		if rmStart+1 < len(value) && value[rmStart+1] == '\t' {
-			omit++
-		}
-		if rmStart > 0 && value[rmStart-1] == '\r' {
-			rmStart--
-			omit++
-		}
-		modified = true
-		n := copy(dst[write:], value[read:rmStart])
-		dst[write+n] = ' '
-		read += omit + n
-		write += n + 1
-	}
-	return write, modified
-}
-
-// CopyDecodedPercentURL decodes percent-escapes in value into dst and returns bytes written.
-// n < len(value) implies percent-escapes were decoded; the converse does not hold since
-// '+' substitution preserves length. If plusAsSpace is set '+' decodes to ' ',
-// which is correct for query and form-encoded data but NOT for path segments.
-// On malformed escape returns n bytes written before the fault and a non-nil error.
-// dst and value may only alias if &dst[0] == &value[0].
-func CopyDecodedPercentURL(dst, value []byte, plusAsSpace bool) (n int, err error) {
-	if len(dst) < len(value) {
-		panic("httpraw.CopyDecodedPercentURL: dst buffer shorter than value")
-	}
-	read := 0
-	for {
-		escape := bytes.IndexByte(value[read:], '%')
-		if escape < 0 {
-			n += copyPlusDecoded(dst[n:], value[read:], plusAsSpace)
-			return n, nil
-		}
-		escape += read
-		n += copyPlusDecoded(dst[n:], value[read:escape], plusAsSpace)
-		if escape+2 >= len(value) {
-			return n, errBadPercentEncode // Truncated escape at end of value.
-		}
-		hi, okhi := unhexdigit(value[escape+1])
-		lo, oklo := unhexdigit(value[escape+2])
-		if !okhi || !oklo {
-			return n, errBadPercentEncode
-		}
-		// Write index n is always <= escape since decoding shrinks 3 bytes to 1,
-		// so writing here never clobbers an unread byte when dst aliases value.
-		dst[n] = hi<<4 | lo
-		n++
-		read = escape + 3
-	}
-}
-
-// EqualDecodedPercentURL reports whether value, once decoded, equals want. It
-// decodes as it compares so it needs no scratch buffer, and reports false on a
-// malformed escape just as [CopyDecodedPercentURL] errors on one.
-// plusAsSpace decodes '+' to ' ', correct for query and form-encoded data but
-// NOT for path segments.
-func EqualDecodedPercentURL(value []byte, want string, plusAsSpace bool) bool {
-	w := 0
-	for i := 0; i < len(value); {
-		var c byte
-		switch {
-		case value[i] == '%':
-			if i+2 >= len(value) {
-				return false // Truncated escape at end of value.
-			}
-			hi, okhi := unhexdigit(value[i+1])
-			lo, oklo := unhexdigit(value[i+2])
-			if !okhi || !oklo {
-				return false
-			}
-			c = hi<<4 | lo
-			i += 3
-		case plusAsSpace && value[i] == '+':
-			c = ' '
-			i++
-		default:
-			c = value[i]
-			i++
-		}
-		if w >= len(want) || want[w] != c {
-			return false
-		}
-		w++
-	}
-	return w == len(want)
-}
-
-// copyPlusDecoded copies src to dst replacing '+' with ' ' if plusAsSpace set.
-func copyPlusDecoded(dst, src []byte, plusAsSpace bool) int {
-	n := copy(dst, src)
-	if plusAsSpace {
-		for i := range n {
-			if dst[i] == '+' {
-				dst[i] = ' '
-			}
-		}
-	}
-	return n
-}
-
-func unhexdigit(c byte) (byte, bool) {
-	switch {
-	case c >= '0' && c <= '9':
-		return c - '0', true
-	case c >= 'a' && c <= 'f':
-		return c - 'a' + 10, true
-	case c >= 'A' && c <= 'F':
-		return c - 'A' + 10, true
-	}
-	return 0, false
-}

http/httpraw/headerv1_test.go

@@ -1,707 +0,0 @@
-package httpraw
-
-import (
-	"bytes"
-	"errors"
-	"fmt"
-	"net/http"
-	"strconv"
-	"strings"
-	"testing"
-	"time"
-)
-
-// defaultKVCap is the key/value table size tests hand to Reset. A Reset with 0
-// preserves whatever capacity the value already had, which is what production
-// code wants on reuse but leaves a fresh value unable to hold a single pair when
-// growth is disabled, see [Form.Reset].
-const defaultKVCap = 16
-
-func TestHeaderParseRequest(t *testing.T) {
-	const (
-		wantMethod  = "GET"
-		wantURI     = "/data/set"
-		wantMessage = "hello world!"
-		asRequest   = false
-		asResponse  = true
-	)
-	req, err := http.NewRequest(wantMethod, wantURI, strings.NewReader(wantMessage))
-	if err != nil {
-		t.Fatal(err)
-	}
-	var wantCookie http.Cookie
-	wantCookie.SameSite = http.SameSiteLaxMode
-	wantCookie.MaxAge = 360000
-	wantCookie.Name = "key"
-	wantCookie.Value = "value"
-	wantCookie.Expires = time.Now().Add(time.Hour)
-	wantCookie.Domain = "DOM"
-	wantCookie.HttpOnly = true
-	wantCookie.Secure = true
-	wantCookie.Path = "/abc"
-	req.Header.Set("Cookie", wantCookie.String())
-	t.Log("valid cookie:", wantCookie.Valid() == nil, wantCookie.String())
-
-	var buf bytes.Buffer
-	req.Write(&buf)
-	var hdr HeaderV1
-	msg := buf.Bytes()
-
-	start := time.Now()
-	err = hdr.ParseBytes(asRequest, msg)
-	elapsed := time.Since(start)
-	if err != nil {
-		t.Fatal(err)
-	}
-	fmt.Printf("%s\nparsed in %s\n\n", msg, elapsed.String())
-	if string(hdr.Method()) != wantMethod {
-		t.Errorf("want method %s, got %q", wantMethod, hdr.Method())
-	}
-	if !bytes.Equal(hdr.RequestTarget(), []byte(wantURI)) {
-		t.Errorf("want request URI %q, got %q", wantURI, hdr.RequestTarget())
-	}
-	contentLength, _ := strconv.Atoi(string(hdr.Get("Content-Length")))
-	if contentLength != len(wantMessage) {
-		t.Errorf("want Content-Length %d, got %d", len(wantMessage), contentLength)
-	}
-	var c Cookie
-	cookie := hdr.Get("Cookie")
-	c.Reset(cookie, defaultKVCap)
-	err = c.Parse()
-	if err != nil {
-		t.Error(err)
-	}
-	key := string(c.Name())
-	if key != wantCookie.Name {
-		t.Errorf("want cookie key %q, got %q", wantCookie.Name, key)
-	}
-	value := string(c.Value())
-	if value != wantCookie.Value {
-		t.Errorf("want cookie key %q, got %q", wantCookie.Value, value)
-	}
-	domain := string(c.Get("Domain"))
-	if domain != wantCookie.Domain {
-		t.Errorf("want domain %q, got %q", wantCookie.Domain, domain)
-	}
-	httpOnly := c.HasKeyOrSingleValue("HttpOnly")
-	if httpOnly != wantCookie.HttpOnly {
-		t.Errorf("want cookie HttpOnly %v, got %v", wantCookie.HttpOnly, httpOnly)
-	}
-	secure := c.HasKeyOrSingleValue("Secure")
-	if secure != wantCookie.Secure {
-		t.Errorf("want cookie HttpOnly %v, got %v", wantCookie.Secure, secure)
-	}
-	samesite := string(c.Get("SameSite"))
-	if samesite != strSameSite(wantCookie.SameSite) {
-		t.Errorf("want cookie SameSite %v, got %v", strSameSite(wantCookie.SameSite), samesite)
-	}
-	body, err := hdr.Body()
-	if err != nil {
-		t.Error(err)
-	}
-	if string(body) != wantMessage {
-		t.Errorf("want body message %q, got %q", wantMessage, body)
-	}
-	cookieStr := string(c.AppendKeyValues(nil))
-	if wantCookie.String() != cookieStr {
-		t.Errorf("want full cookie representation\n%qgot:\n%q", wantCookie.String(), cookieStr)
-	}
-	data, _ := hdr.AppendRequest(nil)
-	fmt.Printf("%s", data)
-}
-
-func BenchmarkParseBytes(b *testing.B) {
-	b.StopTimer()
-	const (
-		wantMethod  = "GET"
-		wantURI     = "/data/set"
-		wantMessage = "hello world!"
-		asRequest   = false
-	)
-	req, _ := http.NewRequest(wantMethod, wantURI, strings.NewReader(wantMessage))
-	var rawBuf bytes.Buffer
-	req.Write(&rawBuf)
-	data := rawBuf.Bytes()
-
-	// hdr is declared outside the loop so that ParseBytes can reuse the
-	// backing arrays on Reset (headers slice and data buffer) without
-	// allocating on every iteration. Declaring it inside the loop causes
-	// two allocs per iteration: one for the headers slice (make in reset)
-	// and one for the data buffer (append in readFromBytes).
-	var hdr HeaderV1
-	b.StartTimer()
-
-	for b.Loop() {
-		err := hdr.ParseBytes(asRequest, data)
-		if err != nil {
-			b.Fatal(err)
-		}
-		_, err = hdr.Body()
-		if err != nil {
-			b.Fatal(err)
-		}
-	}
-}
-
-func strSameSite(mode http.SameSite) string {
-	switch mode {
-	case http.SameSiteLaxMode:
-		return "Lax"
-	case http.SameSiteDefaultMode:
-		return ""
-	case http.SameSiteStrictMode:
-		return "Strict"
-	case http.SameSiteNoneMode:
-		return "None"
-	default:
-		panic("invalid same site")
-	}
-}
-
-func TestHeaderRequestPath(t *testing.T) {
-	for _, test := range []struct {
-		uri  string
-		want string
-	}{
-		{uri: "/", want: "/"},
-		{uri: "/search?q=go", want: "/search"},
-		{uri: "/search?", want: "/search"},
-		{uri: "/a/b/c?x=1&y=2", want: "/a/b/c"},
-		{uri: "/?q=go", want: "/"},
-	} {
-		var h HeaderV1
-		err := h.ParseBytes(false, []byte("GET "+test.uri+" HTTP/1.1\r\nHost: h\r\n\r\n"))
-		if err != nil {
-			t.Fatal(err)
-		}
-		if got := string(h.RequestPath()); got != test.want {
-			t.Errorf("uri %q: want path %q, got %q", test.uri, test.want, got)
-		}
-	}
-}
-
-func TestHeaderContentLength(t *testing.T) {
-	for _, test := range []struct {
-		field   string // Extra header lines, empty for an absent field.
-		want    int64
-		wantErr error
-	}{
-		{field: "Content-Length: 0", want: 0},
-		{field: "Content-Length: 12", want: 12},
-		{field: "Content-Length:  12 ", want: 12}, // OWS around the value, RFC 9110 5.6.3.
-		{field: "Content-Length: 9223372036854775807", want: 9223372036854775807},
-		{field: ""}, // Absent field is no body and no error, RFC 9112 6.3.
-		{field: "Content-Length:", wantErr: errBadContentLength},     // Present but empty.
-		{field: "Content-Length: -1", wantErr: errBadContentLength},  // Digits only, RFC 9112 6.2.
-		{field: "Content-Length: 1 2", wantErr: errBadContentLength}, // Not a list.
-		{field: "Content-Length: 9223372036854775808", wantErr: errBadContentLength},
-	} {
-		var h HeaderV1
-		raw := "POST / HTTP/1.1\r\nHost: h\r\n"
-		if test.field != "" {
-			raw += test.field + "\r\n"
-		}
-		if err := h.ParseBytes(false, []byte(raw+"\r\n")); err != nil {
-			t.Fatal(err)
-		}
-		got, present, err := h.ContentLength()
-		if err != test.wantErr {
-			t.Errorf("%q: want error %v, got %v", test.field, test.wantErr, err)
-		} else if err == nil && got != test.want {
-			t.Errorf("%q: want %d, got %d", test.field, test.want, got)
-		}
-		key, _, _ := strings.Cut(test.field, ":")
-		if strings.EqualFold(key, headerContentLength) != present {
-			t.Error("unexpected 'present'", test.field)
-		}
-	}
-}
-
-func TestNextQueryPair(t *testing.T) {
-	for _, test := range []struct {
-		uri  string
-		want string // "key=value" pairs joined by '|'; nil value shown as "key".
-	}{
-		{uri: "/", want: ""},
-		{uri: "/x?", want: ""},
-		{uri: "/x?q=go", want: "q=go"},
-		{uri: "/x?q=go&n=1", want: "q=go|n=1"},
-		{uri: "/x?debug&q=go", want: "debug|q=go"},   // No '=' yields a nil value.
-		{uri: "/x?q=", want: "q="},                   // Empty but present value.
-		{uri: "/x?&&q=go&", want: "q=go"},            // Empty sequences skipped.
-		{uri: "/x?=v", want: "=v"},                   // Empty name is kept.
-		{uri: "/x?a=1&a=2", want: "a=1|a=2"},         // Duplicates all yielded.
-		{uri: "/x?a%20b=c%20d", want: "a%20b=c%20d"}, // Raw, undecoded.
-		{uri: "/x?a=b=c", want: "a=b=c"},             // Only first '=' splits.
-	} {
-		var h HeaderV1
-		err := h.ParseBytes(false, []byte("GET "+test.uri+" HTTP/1.1\r\nHost: h\r\n\r\n"))
-		if err != nil {
-			t.Fatal(err)
-		}
-		var got []byte
-		rawkey, rawval, rest := NextQueryPair(h.RequestQuery())
-		for rawkey != nil {
-			if len(got) > 0 {
-				got = append(got, '|')
-			}
-			got = append(got, rawkey...)
-			if rawval != nil {
-				got = append(got, '=')
-				got = append(got, rawval...)
-			}
-			rawkey, rawval, rest = NextQueryPair(rest)
-		}
-		if string(got) != test.want {
-			t.Errorf("uri %q: want %q, got %q", test.uri, test.want, got)
-		}
-	}
-}
-
-// A nil key ends iteration, and stopping early is just not looping again.
-func TestNextQueryPairEnd(t *testing.T) {
-	rawkey, rawval, rest := NextQueryPair([]byte("a=1&b=2"))
-	if string(rawkey) != "a" || string(rawval) != "1" || string(rest) != "b=2" {
-		t.Fatalf("want a=1 with rest b=2, got %q=%q rest %q", rawkey, rawval, rest)
-	}
-	rawkey, _, rest = NextQueryPair(rest)
-	if string(rawkey) != "b" || len(rest) != 0 {
-		t.Fatalf("want b with empty rest, got %q rest %q", rawkey, rest)
-	}
-	if rawkey, _, _ = NextQueryPair(rest); rawkey != nil {
-		t.Fatalf("want nil key at end of query, got %q", rawkey)
-	}
-	// Trailing separators yield no pair rather than an empty one.
-	if rawkey, _, _ = NextQueryPair([]byte("&&")); rawkey != nil {
-		t.Fatalf("want nil key for empty sequences, got %q", rawkey)
-	}
-}
-
-func TestHeaderNormalizeKey(t *testing.T) {
-	var tests = []struct {
-		key      string
-		wantnorm string
-	}{
-		{key: "", wantnorm: ""},
-		{key: "a-a-a", wantnorm: "A-A-A"},
-		{key: "a-a-a-", wantnorm: "A-A-A-"},
-		{key: "-", wantnorm: "-"},
-		{key: "CONTENT", wantnorm: "Content"},
-		{key: "cONTENT", wantnorm: "Content"},
-		{key: "Content-Length", wantnorm: "Content-Length"},
-		{key: "Content-length", wantnorm: "Content-Length"},
-		{key: "content-length", wantnorm: "Content-Length"},
-		{key: "conTent-lENgth", wantnorm: "Content-Length"},
-		{key: "conTent-lENgth-", wantnorm: "Content-Length-"},
-	}
-	for _, test := range tests {
-		gotKey := []byte(test.key)
-		modified := NormalizeHeaderKey(gotKey)
-		if string(gotKey) != test.wantnorm {
-			t.Errorf("mismatch want %q got %q", test.wantnorm, gotKey)
-		}
-		wantMod := string(gotKey) != test.key
-		if wantMod != modified {
-			t.Errorf("mismatch want mod=%v, got mod=%v", wantMod, modified)
-		}
-	}
-}
-
-func TestCopyNormalizedHeaderValue(t *testing.T) {
-	var tests = []struct {
-		value    string
-		wantnorm string
-	}{
-		{value: "abc\r\n\tdef\r\n\tghi", wantnorm: "abc def ghi"},
-		{value: "abc\r\n\tabc", wantnorm: "abc abc"},
-		{value: "abc\n\tdef\n\tghi", wantnorm: "abc def ghi"},
-		{value: "abc\n\tdef\n\tghi\n\t", wantnorm: "abc def ghi "},
-		{value: "abc\n\tdef\n\tghi\r\n\t", wantnorm: "abc def ghi "},
-		{value: "", wantnorm: ""},
-		{value: "abc", wantnorm: "abc"},
-	}
-	dst := make([]byte, 256)
-	for _, test := range tests {
-		value := []byte(test.value)
-		n, modified := CopyNormalizedHeaderValue(dst[:len(value)], value)
-		got := dst[:n]
-		if string(got) != test.wantnorm {
-			t.Errorf("mismatch want %q got %q", test.wantnorm, got)
-		}
-		wantMod := string(got) != test.value
-		if wantMod != modified {
-			t.Errorf("mismatch want mod=%v, got mod=%v", wantMod, modified)
-		}
-	}
-}
-
-func TestCopyDecodedPercentURL(t *testing.T) {
-	var tests = []struct {
-		value       string
-		plusAsSpace bool
-		want        string
-		wantErr     bool
-	}{
-		{value: "", want: ""},
-		{value: "/plain/path", want: "/plain/path"},
-		{value: "/a%20b", want: "/a b"},
-		{value: "%41%42%43", want: "ABC"},
-		{value: "%2f%2F", want: "//"}, // lower and upper case hex digits.
-		{value: "%25", want: "%"},     // escaped percent must not re-trigger decoding.
-		{value: "%2525", want: "%25"}, // decoded output is not re-scanned.
-		{value: "a+b", want: "a+b"},   // plus is literal in path segments.
-		{value: "a+b", plusAsSpace: true, want: "a b"},
-		{value: "%20+%20", plusAsSpace: true, want: "   "},
-		{value: "/x?q=%E2%82%AC", want: "/x?q=\xe2\x82\xac"}, // multi-byte UTF-8 sequence.
-		// Malformed escapes must error, never pass through silently.
-		{value: "%zz", want: "", wantErr: true},
-		{value: "ok%4", want: "ok", wantErr: true}, // truncated escape at end.
-		{value: "ok%", want: "ok", wantErr: true},  // bare percent at end.
-		{value: "a%2gb", want: "a", wantErr: true}, // second digit not hex.
-		{value: "a%g2b", want: "a", wantErr: true}, // first digit not hex.
-	}
-	dst := make([]byte, 256)
-	for _, test := range tests {
-		value := []byte(test.value)
-		n, err := CopyDecodedPercentURL(dst[:len(value)], value, test.plusAsSpace)
-		if test.wantErr && err == nil {
-			t.Errorf("%q: want error, got nil", test.value)
-		} else if !test.wantErr && err != nil {
-			t.Errorf("%q: unexpected error %s", test.value, err)
-		}
-		if got := string(dst[:n]); got != test.want {
-			t.Errorf("%q: want %q got %q", test.value, test.want, got)
-		}
-		// n<len(value) implies percent-escapes were decoded. The converse does not
-		// hold: '+'->' ' substitution preserves length.
-		if !test.wantErr && n < len(test.value) && test.want == test.value {
-			t.Errorf("%q: n=%d signals decoding but value unchanged", test.value, n)
-		}
-		if !test.wantErr && !test.plusAsSpace && test.want != test.value && n >= len(test.value) {
-			t.Errorf("%q: n=%d does not signal decoding of %q", test.value, n, test.want)
-		}
-	}
-}
-
-// In-place decoding (dst aliasing value at offset 0) must yield the same result.
-func TestCopyDecodedPercentURLInPlace(t *testing.T) {
-	const value, want = "/a%20b%2Fc%25", "/a b/c%"
-	buf := []byte(value)
-	n, err := CopyDecodedPercentURL(buf, buf, false)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got := string(buf[:n]); got != want {
-		t.Fatalf("want %q got %q", want, got)
-	}
-}
-
-func TestHeaderSetOverwrite(t *testing.T) {
-	var h HeaderV1
-	h.Reset(nil, defaultKVCap)
-	h.SetMethod("GET")
-	h.SetRequestTarget("/")
-	h.SetProtocol("HTTP/1.1")
-
-	h.Set("Host", "first.example.com")
-	h.Set("Host", "second.example.com")
-
-	got := string(h.Get("Host"))
-	if got != "second.example.com" {
-		t.Errorf("want Host %q, got %q", "second.example.com", got)
-	}
-	req, err := h.AppendRequest(nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if n := strings.Count(string(req), "Host:"); n != 1 {
-		t.Errorf("want 1 Host field in request, got %d:\n%s", n, req)
-	}
-}
-
-func TestHeaderSetBytesEmptyValue(t *testing.T) {
-	var h HeaderV1
-	h.Reset(nil, defaultKVCap)
-	h.SetBytes("X-Empty", nil)
-	if got := h.Get("X-Empty"); len(got) != 0 {
-		t.Errorf("want empty value, got %q", got)
-	}
-}
-
-// buffer/offset past uint16 range silently corrupts or panics.
-// A header block > 64KiB pushes a field's offset past 65535. tokint truncation
-// makes Get return the wrong window (silent corruption) or panic on slice bounds.
-func TestHeader_LargeBufferOverflow(t *testing.T) {
-	const wantVal = "the-canary-value"
-	// Pad with a big header so the canary field lands past offset 65535.
-	pad := strings.Repeat("x", 70000)
-	raw := "GET / HTTP/1.1\r\n" +
-		"X-Pad: " + pad + "\r\n" +
-		"X-Canary: " + wantVal + "\r\n" +
-		"\r\n"
-
-	var h HeaderV1
-	err := h.ParseBytes(false, []byte(raw))
-	if err != nil {
-		// Clean rejection of the oversized header is the intended behavior:
-		// no panic, no silent corruption.
-		return
-	}
-	// If it did parse, the value must be correct (never a truncated-offset window).
-	got := string(h.Get("X-Canary"))
-	if got != wantVal {
-		t.Fatalf("overflow corruption: want X-Canary %q, got %q", wantVal, got)
-	}
-}
-
-// a complete but malformed header line with no colon must be a hard error,
-// not ErrNeedMoreData (which makes a streaming parser wait forever).
-func TestHeader_ColonlessLineIsHardError(t *testing.T) {
-	raw := "GET / HTTP/1.1\r\nBadHeaderNoColon\r\n\r\n"
-	var h HeaderV1
-	err := h.ParseBytes(false, []byte(raw))
-	if err == nil {
-		t.Fatal("want error on colonless header line, got nil")
-	}
-	if err == ErrNeedMoreData {
-		t.Fatalf("colonless line reported as ErrNeedMoreData (parser would hang); want a hard error like errInvalidName")
-	}
-}
-
-// Regression for a TCP split landing BEFORE the colon (no newline yet) must
-// stay "need more data" and parse once the rest arrives. This is the case the
-// Colonless fix must NOT turn into a hard error.
-func TestHeader_SplitBeforeColonStillParses(t *testing.T) {
-	const part1 = "GET / HTTP/1.1\r\nHost" // split mid-key, before colon+newline
-	const part2 = ": example.com\r\n\r\n"
-
-	var h HeaderV1
-	h.Reset(nil, defaultKVCap)
-	if err := h.ReadFromBytes([]byte(part1)); err != nil {
-		t.Fatal(err)
-	}
-	needMore, err := h.TryParse(false)
-	if err != nil && err != ErrNeedMoreData {
-		t.Fatalf("split before colon: want ErrNeedMoreData/nil, got %v", err)
-	}
-	if !needMore {
-		t.Fatal("want needMoreData=true after partial input")
-	}
-
-	if err := h.ReadFromBytes([]byte(part2)); err != nil {
-		t.Fatal(err)
-	}
-	needMore, err = h.TryParse(false)
-	if err != nil {
-		t.Fatalf("after full input: %v", err)
-	}
-	if needMore {
-		t.Fatal("want needMoreData=false after full input")
-	}
-	if got := string(h.Get("Host")); got != "example.com" {
-		t.Fatalf("want Host %q, got %q", "example.com", got)
-	}
-}
-
-// appendHeader must reserve the +1 byte that mustAppendSlice consumes on an
-// empty buffer. Force cap == len(key)+len(value) to defeat allocator rounding.
-func TestHeader_AppendHeaderExactCapNoPanic(t *testing.T) {
-	const key, value = "K", "V"
-	buf := make([]byte, 0, len(key)+len(value)) // exact cap, no slack.
-	var h HeaderV1
-	h.Reset(buf, defaultKVCap)
-	defer func() {
-		if r := recover(); r != nil {
-			t.Fatalf("appendHeader panicked on exact-cap buffer: %v", r)
-		}
-	}()
-	h.Add(key, value)
-	if got := string(h.Get(key)); got != value {
-		t.Fatalf("want %q, got %q", value, got)
-	}
-}
-
-// Add/Set on a full buffer with growth disabled must drop gracefully (flag OOM),
-// never panic. Panicking is unacceptable for this package.
-func TestHeader_AddFullBufferNoPanic(t *testing.T) {
-	buf := make([]byte, 0, 40) // Small cap; enough for Reset (len 0) but not the field below.
-	var h HeaderV1
-	h.Reset(buf, defaultKVCap)
-	h.ConfigBufferGrowth(false)
-	h.SetMethod("GET")
-	h.SetRequestTarget("/")
-	h.SetProtocol("HTTP/1.1")
-
-	defer func() {
-		if r := recover(); r != nil {
-			t.Fatalf("Add on full no-grow buffer panicked: %v", r)
-		}
-	}()
-	h.Add("X-Very-Long-Header-Key", "a-value-that-cannot-possibly-fit-in-the-buffer")
-
-	// Graceful drop: request marshalling reports OOM instead of emitting bad data.
-	if _, err := h.AppendRequest(nil); err == nil {
-		t.Fatal("want OOM error after dropped Add, got nil")
-	}
-}
-
-func TestHeader_SetInt(t *testing.T) {
-	for _, tc := range []struct {
-		name  string
-		value int64
-		base  int
-		want  string
-	}{
-		{"decimal", 1234, 10, "1234"},
-		{"zero", 0, 10, "0"},
-		{"negative", -42, 10, "-42"},
-		{"maxint64", 9223372036854775807, 10, "9223372036854775807"},
-		{"minint64", -9223372036854775808, 10, "-9223372036854775808"},
-		{"hex", 255, 16, "ff"},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			var h HeaderV1
-			h.Reset(nil, defaultKVCap)
-			h.SetInt("Content-Length", tc.value, tc.base)
-			if got := string(h.Get("Content-Length")); got != tc.want {
-				t.Fatalf("want %q, got %q", tc.want, got)
-			}
-		})
-	}
-}
-
-// SetInt on an existing key must reuse the slot in place (single field, latest value).
-func TestHeader_SetIntOverwrite(t *testing.T) {
-	var h HeaderV1
-	h.Reset(nil, defaultKVCap)
-	h.SetMethod("GET")
-	h.SetRequestTarget("/")
-	h.SetProtocol("HTTP/1.1")
-
-	h.SetInt("Content-Length", 100, 10)
-	h.SetInt("Content-Length", 5, 10) // shorter, must fit in old slot.
-
-	if got := string(h.Get("Content-Length")); got != "5" {
-		t.Fatalf("want Content-Length %q, got %q", "5", got)
-	}
-	req, err := h.AppendRequest(nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if n := strings.Count(string(req), "Content-Length:"); n != 1 {
-		t.Errorf("want 1 Content-Length field, got %d:\n%s", n, req)
-	}
-}
-
-// SetInt must not heap-allocate: it must format directly into the header buffer.
-func TestHeader_SetIntNoAlloc(t *testing.T) {
-	buf := make([]byte, 0, 256)
-	var h HeaderV1
-	h.Reset(buf, defaultKVCap)
-	h.ConfigBufferGrowth(false)
-	h.Add("Content-Length", "0000000000000000000000") // pre-size a reusable slot.
-	allocs := testing.AllocsPerRun(100, func() {
-		h.SetInt("Content-Length", 1234567890, 10)
-	})
-	if allocs != 0 {
-		t.Fatalf("SetInt allocated %v times, want 0", allocs)
-	}
-	if got := string(h.Get("Content-Length")); got != "1234567890" {
-		t.Fatalf("want %q, got %q", "1234567890", got)
-	}
-}
-
-// A browser sends upwards of twenty header fields and an API client with a few
-// custom fields is not far behind. The field table must be sized from the
-// buffer the caller handed over, not fixed at a count that a real request
-// exceeds.
-func TestHeader_FieldTableSizedFromBuffer(t *testing.T) {
-	const wantVal = "the-canary-value"
-	var raw strings.Builder
-	raw.WriteString("GET / HTTP/1.1\r\nHost: lneto.test\r\n")
-	for i := range 40 {
-		raw.WriteString("X-Field-")
-		raw.WriteString(strconv.Itoa(i))
-		raw.WriteString(": value-of-a-realistic-length-here\r\n")
-	}
-	raw.WriteString("X-Canary: " + wantVal + "\r\n\r\n")
-
-	var h HeaderV1
-	h.Reset(make([]byte, 0, 8192), defaultKVCap) // Room for the block with plenty to spare.
-	err := h.ParseBytes(false, []byte(raw.String()))
-	if err != nil {
-		t.Fatalf("parsing a 42 field request into an 8kB buffer: %s", err)
-	}
-	if got := string(h.Get("X-Canary")); got != wantVal {
-		t.Fatalf("want X-Canary %q, got %q", wantVal, got)
-	}
-}
-
-// A buffer too small for the fields it is handed must be refused with an error
-// the caller can act on, so a server answers 431 instead of dropping the peer.
-func TestHeader_FieldTableFullIsReported(t *testing.T) {
-	var raw strings.Builder
-	raw.WriteString("GET / HTTP/1.1\r\n")
-	for i := range 64 {
-		// As short as a field gets.
-		raw.WriteString("H")
-		raw.WriteString(strconv.Itoa(i))
-		raw.WriteString(":v\r\n")
-	}
-	raw.WriteString("\r\n")
-	var h HeaderV1
-	h.Reset(make([]byte, 0, 512), defaultKVCap)
-	h.ConfigBufferGrowth(false)
-	err := h.ParseBytes(false, []byte(raw.String()))
-	if !errors.Is(err, ErrHeaderTooMany) {
-		t.Fatalf("want ErrHeaderFieldsTooLarge, got %v", err)
-	}
-}
-
-// EqualDecodedPercentURL must agree with CopyDecodedPercentURL on every input:
-// same decoded bytes, and false wherever the copying decoder reports an error.
-func TestEqualDecodedPercentURL(t *testing.T) {
-	for _, value := range []string{
-		"", "plain", "a+b", "a%20b", "%41%42", "100%25", "a%2Fb", "+", "%2b",
-		"trailing%", "trailing%4", "%zz", "a%2", "%%", "a+b%20c", "%00",
-	} {
-		for _, plusAsSpace := range []bool{false, true} {
-			dst := make([]byte, len(value))
-			n, err := CopyDecodedPercentURL(dst, []byte(value), plusAsSpace)
-			// The copying decoder is the reference: whatever it produces is what
-			// an equal comparison must accept, and only that.
-			want := ""
-			if err == nil {
-				want = string(dst[:n])
-			}
-			got := EqualDecodedPercentURL([]byte(value), want, plusAsSpace)
-			if err != nil {
-				if got {
-					t.Errorf("%q plus=%v: malformed escape must not compare equal", value, plusAsSpace)
-				}
-				continue
-			}
-			if !got {
-				t.Errorf("%q plus=%v: want equal to its own decoding %q", value, plusAsSpace, want)
-			}
-			if EqualDecodedPercentURL([]byte(value), want+"x", plusAsSpace) {
-				t.Errorf("%q plus=%v: must not equal a longer want", value, plusAsSpace)
-			}
-			if want != "" && EqualDecodedPercentURL([]byte(value), want[:len(want)-1], plusAsSpace) {
-				t.Errorf("%q plus=%v: must not equal a shorter want", value, plusAsSpace)
-			}
-		}
-	}
-}
-
-// The comparison must not allocate: it is the reason a query lookup can return
-// a view without scratch space.
-func TestEqualDecodedPercentURLNoAlloc(t *testing.T) {
-	value := []byte("a%20long%2Dish+key")
-	allocs := testing.AllocsPerRun(100, func() {
-		EqualDecodedPercentURL(value, "a long-ish key", true)
-	})
-	if allocs != 0 {
-		t.Fatalf("EqualDecodedPercentURL allocated %v times, want 0", allocs)
-	}
-}

http/httpraw/kvbuffer.go

@@ -1,510 +0,0 @@
-package httpraw
-
-import (
-	"io"
-	"slices"
-	"strconv"
-	"unsafe"
-
-	"github.com/soypat/lneto/internal"
-)
-
-// kvBuffer is a common key-value store engine for Cookie, Form, Header and other HTTP abstractions that need
-// a key-value store with underlying buffer memory.
-type kvBuffer struct {
-	buf   []byte
-	kvs   []pairKV
-	flags Flags
-}
-
-func (kvb *kvBuffer) free() int { return cap(kvb.buf) - len(kvb.buf) }
-
-// BufferRaw returns the underlying buffer, its length being the portion in use.
-// Stored pairs alias it, so writing to it mangles them.
-func (kvb *kvBuffer) BufferRaw() []byte { return kvb.buf }
-
-// BufferUsed returns the raw memory used, which is what a caller appending from
-// several sources checks to know whether a separator is needed. Counts buffered
-// bytes and not parsed pairs, so it is set before a Parse and unchanged by one.
-func (kvb *kvBuffer) BufferUsed() int { return len(kvb.buf) }
-
-// EnableBufferGrowth allows the buffer to grow past the memory [kvBuffer.Reset]
-// was handed. The setting outlives Reset; with growth off callers get [ErrBufferExhausted].
-func (kvb *kvBuffer) EnableBufferGrowth(enableGrowth bool) {
-	if enableGrowth {
-		kvb.flags &^= flagNoBufferGrow
-	} else {
-		kvb.flags |= flagNoBufferGrow
-	}
-}
-
-func (kvb *kvBuffer) discardKVs() { kvb.kvs = kvb.kvs[:0] }
-
-// BufferGrowthEnabled reports whether the buffer may grow, see [kvBuffer.EnableBufferGrowth].
-func (kvb *kvBuffer) BufferGrowthEnabled() bool { return !kvb.flags.HasAny(flagNoBufferGrow) }
-
-// ReadFromBytes appends buf to the underlying buffer, accumulating data to parse.
-// Returns [ErrBufferExhausted] when buf does not fit and growth is disabled.
-func (kvb *kvBuffer) ReadFromBytes(buf []byte) error {
-	if len(buf) == 0 {
-		return io.ErrNoProgress // Nothing handed over, not a buffer problem.
-	} else if kvb.flags.HasAny(flagMangledBuffer) {
-		return errMangledBuffer
-	} else if len(buf)+cap(kvb.buf) > maxBufLen {
-		return ErrBufferExhausted
-	}
-	free := kvb.free()
-	if len(buf) > free && !kvb.BufferGrowthEnabled() {
-		return ErrBufferExhausted
-	}
-	kvb.buf = append(kvb.buf, buf...)
-	return nil
-}
-
-// ReadLimited appends at most limit bytes read from r to the underlying buffer.
-// A read returning data alongside [io.EOF] reports a nil error, later ones io.EOF.
-func (kvb *kvBuffer) ReadLimited(r io.Reader, limit int) (int, error) {
-	free := kvb.free()
-	growthEnabled := kvb.BufferGrowthEnabled()
-	if !growthEnabled && (free == 0 || free < limit) || len(kvb.buf) >= maxBufLen {
-		return 0, ErrBufferExhausted
-	} else if kvb.flags.HasAny(flagMangledBuffer) {
-		return 0, errMangledBuffer
-	} else if kvb.flags.HasAny(flagReaderEOF) {
-		return 0, io.EOF
-	} else if limit <= 0 {
-		return 0, io.ErrNoProgress
-	}
-	kvb.buf = slices.Grow(kvb.buf, limit)
-	n, err := r.Read(kvb.buf[len(kvb.buf):min(len(kvb.buf)+limit, maxBufLen)])
-	kvb.buf = kvb.buf[:len(kvb.buf)+n]
-	if err != nil {
-		if n > 0 && err == io.EOF {
-			kvb.flags |= flagReaderEOF
-			err = nil // Nil out EOF to not scare off readers.
-		}
-	}
-	return n, err
-}
-
-// Reset discards all pairs and takes buf as the buffer to parse in place, nil
-// reusing the current one. kvCap sizes the pair table. Only the growth setting survives.
-func (kvb *kvBuffer) Reset(buf []byte, kvCap int) {
-	if buf == nil {
-		kvb.buf = kvb.buf[:0]
-	} else {
-		kvb.buf = buf
-	}
-	internal.SliceReuse(&kvb.kvs, kvCap)
-	kvb.flags = kvb.flags & flagNoBufferGrow // Only flag persisted is buffer grow config.
-}
-
-// CopyFrom replaces the receiver's contents with a copy of src, sharing no
-// memory with it afterwards.
-func (kvb *kvBuffer) CopyFrom(src *kvBuffer) {
-	kvb.buf = append(kvb.buf[:0], src.buf...)
-	kvb.kvs = append(kvb.kvs[:0], src.kvs...)
-}
-
-// Get returns the value of the first pair matching key.
-// Bytes are compared as stored, so if using a Form call [Form.Decode] first when keys may be encoded.
-// Returns nil for an absent key and for a valueless pair alike, so use
-// [kvBuffer.Present] to tell the two apart.
-func (kvb *kvBuffer) Get(key string) []byte {
-	i := kvb.getIdx(key)
-	if i < 0 {
-		return nil
-	}
-	return kvb.AtValue(i)
-}
-
-// GetFold returns the value of the first key that matches ascii-case-insensitive.
-func (kvb *kvBuffer) GetFold(key string) []byte {
-	i := kvb.getFoldIdx(key)
-	if i < 0 {
-		return nil
-	}
-	return kvb.AtValue(i)
-}
-
-// ForEach iterates over the cookie's key-value pairs as stored until cb returns false.
-func (kvb *kvBuffer) ForEach(cb func(key, value []byte) bool) {
-	nc := len(kvb.kvs)
-	for i := range nc {
-		if !kvb.kvs[i].isValid() {
-			continue
-		} else if !cb(kvb.At(i)) {
-			break
-		}
-	}
-}
-
-// Has returns true if key is present, with or without a value.
-func (kvb *kvBuffer) Present(key string) bool { // TODO: rename to Has.
-	return kvb.getIdx(key) >= 0
-}
-
-// Has returns true if key is present, with or without a value.
-func (kvb *kvBuffer) HasKeyValue(key, value string) bool {
-	idx := kvb.getIdx(key)
-	if idx >= 0 {
-		return b2s(kvb.musttoken(kvb.kvs[idx].value)) == value
-	}
-	return false
-}
-
-// Add appends a pair, keeping any already sharing the key: use [kvBuffer.Set]
-// to replace instead. Reports false if the buffer could not hold it.
-func (kvb *kvBuffer) Add(key, value string) (enoughSpace bool) {
-	kvb.appendPair(key, value)
-	return kvb.getIdx(key) >= 0
-}
-
-// Set replaces key's value and invalidates every other pair sharing the key, so
-// a following [kvBuffer.Get] sees exactly one value.
-//
-// It rewrites in place when it can: of the pairs it would invalidate it keeps
-// the smallest whose key and value regions both still hold the new pair,
-// leaving the roomier regions for a later Set. When none fits the pair is
-// appended with [kvBuffer.Add] and the invalidated regions are stranded, since
-// nothing here compacts the buffer.
-func (kvb *kvBuffer) Set(key, value string) (enoughSpace bool) {
-	reuse := kvb.takeReusableSlot(key, len(key), len(value))
-	if reuse < 0 {
-		return kvb.Add(key, value)
-	}
-	kvb.overwriteAt(reuse, key, value)
-	return true
-}
-
-// SetInt is [kvBuffer.Set]'s integer counterpart. It formats value straight into
-// the slot it reuses, so overwriting a pair never allocates.
-func (kvb *kvBuffer) SetInt(key string, value int64, base int) (enoughSpace bool) {
-	reuse := kvb.takeReusableSlot(key, len(key), internal.IntLen(value, base))
-	if reuse < 0 {
-		return kvb.appendPairInt(key, value, base)
-	}
-	kvb.flags |= flagMangledBuffer
-	kv := &kvb.kvs[reuse]
-	copy(kvb.buf[kv.key.start:], key)
-	kv.key.len = tokint(len(key))
-	// The slot was picked to hold keyLen/valueLen, so AppendInt writes inside
-	// buf and never grows a new backing array.
-	v := strconv.AppendInt(kvb.buf[kv.value.start:kv.value.start], value, base)
-	kv.value.len = tokint(len(v))
-	return true
-}
-
-// takeReusableSlot invalidates every pair matching key except the smallest one
-// whose key and value regions hold keyLen and valueLen bytes, whose index it
-// returns. It returns -1 when no surviving slot fits, meaning the caller must
-// append instead.
-func (kvb *kvBuffer) takeReusableSlot(key string, keyLen, valueLen int) int {
-	reuse := -1
-	for i := range kvb.kvs {
-		kv := &kvb.kvs[i]
-		if !kv.isValid() || b2s(kvb.musttoken(kv.key)) != key {
-			continue
-		}
-		// A valueless pair holds no value region, so reusing one would write the
-		// value over byte 0. Let it fall through to the caller's append, which
-		// gives the pair a real region and keeps "ok" distinct from "ok=".
-		fits := kv.HasValue() && int(kv.key.len) >= keyLen && int(kv.value.len) >= valueLen
-		if fits && (reuse < 0 || kv.size() < kvb.kvs[reuse].size()) {
-			if reuse >= 0 {
-				kvb.kvs[reuse].invalidate() // Superseded by a tighter fit.
-			}
-			reuse = i
-			continue
-		}
-		kv.invalidate()
-	}
-	return reuse
-}
-
-// overwriteAt writes key and value over the regions pair i already owns. The
-// caller must have checked both fit; the bytes freed by a shorter pair are
-// stranded, not reclaimed.
-func (kvb *kvBuffer) overwriteAt(i int, key, value string) {
-	kvb.flags |= flagMangledBuffer
-	kv := &kvb.kvs[i]
-	copy(kvb.buf[kv.key.start:], key)
-	kv.key.len = tokint(len(key))
-	copy(kvb.buf[kv.value.start:], value)
-	kv.value.len = tokint(len(value))
-}
-
-func (kvb *kvBuffer) setInternal(key, value []byte) (enoughSpace bool) {
-	if !kvb.canAddOneKV() {
-		return false
-	}
-	kvb.flags |= flagKVAppended
-	kvb.kvs = append(kvb.kvs, pairKV{
-		key:   kvb.view(key),
-		value: kvb.view(value),
-	})
-	return true
-}
-
-// Len returns the number of slots stored, counting those [kvBuffer.Set] invalidated.
-func (kvb *kvBuffer) Len() int { return len(kvb.kvs) }
-
-// At returns the i'th pair in wire order. value is nil for a pair holding none,
-// which is what tells a form's "ok" from "ok=".
-func (kvb *kvBuffer) At(i int) (key, value []byte) {
-	kv := kvb.kvs[i]
-	if !kv.HasValue() {
-		return kvb.musttoken(kv.key), nil
-	}
-	return kvb.musttoken(kv.key), kvb.musttoken(kv.value)
-}
-func (kvb *kvBuffer) setAt(i int, k, v []byte) {
-	kvb.flags |= flagMangledBuffer
-	// Route through slice, not bytes2tok: a nil v is a pair with no '=' and must
-	// stay absent rather than trip the alias check on a nil pointer.
-	kvb.kvs[i] = pairKV{
-		key:   kvb.view(k),
-		value: kvb.view(v),
-	}
-}
-
-// AtKey is [kvBuffer.At] limited to the i'th key.
-func (kvb *kvBuffer) AtKey(i int) (key []byte) { return kvb.musttoken(kvb.kvs[i].key) }
-
-// AtValue is [kvBuffer.At] limited to the i'th value, nil when the pair holds none.
-func (kvb *kvBuffer) AtValue(i int) (key []byte) {
-	if !kvb.kvs[i].HasValue() {
-		return nil
-	}
-	return kvb.musttoken(kvb.kvs[i].value)
-}
-
-func (kvb *kvBuffer) getIdx(key string) int {
-	for i, pair := range kvb.kvs {
-		if pair.isValid() && b2s(kvb.musttoken(pair.key)) == key {
-			return i
-		}
-	}
-	return -1
-}
-
-func (kvb *kvBuffer) getFoldIdx(key string) int {
-	for i, pair := range kvb.kvs {
-		if pair.isValid() && EqualFoldASCII(key, b2s(kvb.AtKey(i))) {
-			return i
-		}
-	}
-	return -1
-}
-
-// EqualFoldASCII reports whether a and b are equal under ASCII case folding.
-// Unlike strings.EqualFold it does not fold non-ASCII runes, so no multi-byte
-// rune such as U+212A KELVIN SIGN can alias a header key.
-func EqualFoldASCII(a, b string) bool {
-	if len(a) != len(b) {
-		return false
-	}
-	const asciiCapDiff = 'a' - 'A'
-	for i := 0; i < len(a); i++ {
-		ca, cb := a[i], b[i]
-		if ca >= 'A' && ca <= 'Z' {
-			ca += asciiCapDiff
-		}
-		if cb >= 'A' && cb <= 'Z' {
-			cb += asciiCapDiff
-		}
-		if ca != cb {
-			return false
-		}
-	}
-	return true
-}
-
-// reserve ensures need free bytes are available in the buffer, growing it when
-// permitted. It accounts for the byte-0 reservation on an empty buffer (see
-// mustAppendSlice). It returns false and sets flagOOMReached when the space
-// cannot be guaranteed: a tokint offset overflow, or a full buffer with
-// flagNoBufferGrow set.
-func (kvb *kvBuffer) reserve(need int) (enoughSpace bool) {
-	if len(kvb.buf) == 0 {
-		need++ // mustAppend* reserves byte 0 on an empty buffer.
-	}
-	if len(kvb.buf)+need > maxBufLen {
-		kvb.flags |= flagOOMReached // Offsets would overflow uint16 tokint.
-		return false
-	}
-	if need > kvb.free() {
-		if kvb.flags.HasAny(flagNoBufferGrow) {
-			kvb.flags |= flagOOMReached
-			return false
-		}
-		kvb.buf = slices.Grow(kvb.buf, need)
-	}
-	return true
-}
-
-func (kvb *kvBuffer) appendPair(key, value string) bool {
-	if !kvb.canAddOneKV() || !kvb.reserve(len(key)+len(value)) {
-		return false
-	}
-	kvb.flags |= flagKVAppended
-	kvb.kvs = append(kvb.kvs, pairKV{
-		key:   kvb.mustAppendSlice(key),
-		value: kvb.mustAppendSlice(value),
-	})
-	return true
-}
-
-func (kvb *kvBuffer) appendPairInt(key string, value int64, base int) bool {
-	vlen := internal.IntLen(value, base)
-	if !kvb.canAddOneKV() || !kvb.reserve(len(key)+vlen) {
-		return false
-	}
-	kvb.flags |= flagKVAppended
-	kvb.kvs = append(kvb.kvs, pairKV{
-		key:   kvb.mustAppendSlice(key),
-		value: kvb.mustAppendInt(value, base),
-	})
-	return true
-}
-
-func (kvb *kvBuffer) canAddOneKV() (enoughSpace bool) {
-	return len(kvb.kvs) < cap(kvb.kvs) || kvb.flags&flagNoBufferGrow == 0
-}
-
-func (kvb *kvBuffer) mustAppendSlice(value string) view {
-	L := len(kvb.buf)
-	if L == 0 {
-		L++ // Valid key-values start after 0.
-	}
-	copy(kvb.buf[L:L+len(value)], value)
-	kvb.buf = kvb.buf[:L+len(value)]
-	return kvb.view(kvb.buf[L : L+len(value)])
-}
-
-func (kvb *kvBuffer) mustAppendInt(value int64, base int) view {
-	L := len(kvb.buf)
-	if L == 0 {
-		L++ // Valid key-values start after byte 0.
-	}
-	v := strconv.AppendInt(kvb.buf[L:L], value, base)
-	kvb.buf = kvb.buf[:L+len(v)]
-	return kvb.view(kvb.buf[L : L+len(v)])
-}
-
-// reuseOrAppend writes value over tok's slot when it fits there, avoiding any
-// buffer growth; otherwise it appends a fresh slot.
-func (kvb *kvBuffer) reuseOrAppend(tok view, value string) view {
-	if tok.len > tokint(len(value)) {
-		copy(kvb.musttoken(tok), value)
-		tok.len = tokint(len(value))
-		return tok
-	}
-	return kvb.appendSlice(value)
-}
-
-// appendSlice reserves space (growing or flagging OOM) and appends value as a
-// new slot.
-func (kvb *kvBuffer) appendSlice(value string) view {
-	debuglog("http:appendslice:start")
-	if !kvb.reserve(len(value)) {
-		return view{} // Drop and flag OOM; never panic.
-	}
-	kvb.flags |= flagMangledBuffer
-	return kvb.mustAppendSlice(value)
-}
-
-// reuseOrAppendInt is [kvBuffer.reuseOrAppend]'s integer counterpart.
-func (kvb *kvBuffer) reuseOrAppendInt(tok view, value int64, base int) view {
-	n := internal.IntLen(value, base)
-	if int(tok.len) >= n {
-		// Reuse: format directly over the existing slot. No free space needed
-		// since n <= tok.len and the slot already lives inside buf.
-		v := strconv.AppendInt(kvb.buf[tok.start:tok.start], value, base)
-		tok.len = tokint(len(v))
-		kvb.flags |= flagMangledBuffer
-		return tok
-	}
-	return kvb.appendInt(value, base, n)
-}
-
-// appendInt reserves space (growing or flagging OOM) and appends value as a new slot.
-func (kvb *kvBuffer) appendInt(value int64, base, n int) view {
-	if !kvb.reserve(n) {
-		return view{} // Drop and flag OOM; never panic.
-	}
-	kvb.flags |= flagMangledBuffer
-	return kvb.mustAppendInt(value, base)
-}
-
-func (kvb *kvBuffer) view(value []byte) view {
-	if value == nil {
-		return view{}
-	}
-	return bytes2tok(kvb.buf, value)
-}
-
-func (kvb kvBuffer) musttoken(slice view) []byte {
-	return tok2bytes(kvb.buf, slice)
-}
-func (kvb *kvBuffer) noKV() pairKV { return pairKV{} }
-
-type tokint = uint16
-
-// view is a smaller `string`-like representation of a section in [kvBuffer]'s buffer.
-type view struct {
-	start tokint
-	len   tokint
-}
-
-type pairKV struct {
-	key   view
-	value view // value start >0 means value is present.
-}
-
-// SizeKV is the heap cost of a single key/value field slot, as reserved by the
-// numHeaderCapacity argument to [HeaderV1.Reset] and by [Form.Reset]. Callers
-// budgeting a fixed memory pool up front, such as a Router sizing its
-// exchanges, multiply it by the pair capacity to account the field table.
-const SizeKV = int(unsafe.Sizeof(pairKV{}))
-
-// isValid is for stores parsed in place, where offset 0 is the first key so
-// only length can signal presence. Empty keys are valid: see valueless cookies.
-func (pair pairKV) isValid() bool {
-	return pair.key.len > 0 || pair.value.len > 0
-}
-
-// isValidHeader is for the append-built [HeaderV1] store, where mustAppendSlice
-// burns byte 0 so a zero offset means absent. Drops offset-0 pairs otherwise.
-func (pair pairKV) isValidHeader() bool { return pair.key.start > 0 }
-
-func (pair *pairKV) invalidate() {
-	*pair = pairKV{}
-}
-
-// size is the buffer a pair occupies, used to pick the tightest slot to reuse.
-func (pair pairKV) size() int { return int(pair.key.len) + int(pair.value.len) }
-
-func (pair pairKV) HasValue() bool { return pair.value.start > 0 }
-
-// b2s converts byte slice to a string without memory allocation.
-// See https://groups.google.com/forum/#!msg/Golang-Nuts/ENgbUzYvCuU/90yGx7GUAgAJ .
-func b2s(b []byte) string {
-	return unsafe.String(unsafe.SliceData(b), len(b))
-}
-
-func tok2bytes(buf []byte, slice view) []byte {
-	return buf[slice.start : slice.start+slice.len]
-}
-
-func bytes2tok(buf, value []byte) view {
-	base := uintptr(unsafe.Pointer(unsafe.SliceData(buf)))
-	off := uintptr(unsafe.Pointer(unsafe.SliceData(value)))
-	if off < base || off > base+uintptr(len(buf)) {
-		panic("httpx: argument buffer does not alias header buffer")
-	}
-	return view{
-		start: tokint(off - base),
-		len:   tokint(len(value)),
-	}
-}

http/httpraw/multipart.go

@@ -1,272 +0,0 @@
-package httpraw
-
-import (
-	"bytes"
-	"io"
-)
-
-// Multipart splits a "multipart/form-data" body into its parts. Such bodies
-// frame their fields with a delimiter instead of escaping them, so a part's
-// value has no length: it ends where the next delimiter begins.
-//
-// Multipart stores none of the body, leaving the caller to decide what to keep,
-// what to skip and when a part has grown too large. Both methods report how much
-// of buf they consumed, which the caller compacts away before reading more in:
-//
-//	var m httpraw.Multipart
-//	m.SetContentType(contentType)
-//	var hdr httpraw.MultipartHeader
-//	for {
-//		parsed, err := m.NextHeader(&hdr, buf[:buflen])
-//		if err != nil {
-//			break // io.EOF at the closing delimiter, body done.
-//		} else if parsed == 0 {
-//			// Header block incomplete: read more into buf[buflen:] and retry.
-//			continue
-//		}
-//		buflen = copy(buf, buf[parsed:buflen])
-//		for {
-//			bodyLen, restOff, done := m.NextBody(buf[:buflen])
-//			// Consume buf[:bodyLen] for hdr.Name, then compact and read more.
-//			buflen = copy(buf, buf[restOff:buflen])
-//			if done {
-//				break
-//			}
-//		}
-//	}
-type Multipart struct {
-	// Boundary is the delimiter parameter of the body's Content-Type field,
-	// without the leading "--" the delimiter carries on the wire.
-	Boundary []byte
-}
-
-// MultipartHeader is a part's header block and the Content-Disposition
-// parameters that identify it.
-type MultipartHeader struct {
-	// PartView is the part's raw header block, ending in its final CRLF. It
-	// aliases the buffer it was parsed from, so it is only valid until that
-	// buffer is compacted or read into again.
-	PartView []byte
-	// Name is the name parameter of a part's Content-Disposition field,
-	// i.e: "photo" for `form-data; name="photo"; filename="beach.png"`.
-	// Copied out of the buffer, so it outlives it, and reused between parts.
-	Name []byte
-	// Filename is the filename parameter of a part's Content-Disposition
-	// field, empty when the part is not a file upload. Copied like Name.
-	Filename []byte
-}
-
-// Reset clears the header for the next part, keeping the buffers Name and
-// Filename were copied into so a reused header stops allocating.
-func (hdr *MultipartHeader) Reset() {
-	hdr.PartView = nil
-	hdr.Name = hdr.Name[:0]
-	hdr.Filename = hdr.Filename[:0]
-}
-
-// SetContentType sets [Multipart.Boundary] from the boundary parameter of a
-// Content-Type field value, i.e: "abc123" for
-// "multipart/form-data; boundary=abc123". The leading "--" the delimiter carries
-// on the wire is not included. Fails when the parameter is absent or is not
-// 1 to 70 characters long, RFC 2046 5.1.1; a zero length boundary would match
-// every "--" in the body.
-func (m *Multipart) SetContentType(contentType []byte) error {
-	m.Boundary = ContentParam(contentType, "boundary")
-	if len(m.Boundary) == 0 || len(m.Boundary) > 70 {
-		return errNoBoundary // RFC 2046 5.1.1: 1..70 characters, required.
-	}
-	return nil
-}
-
-// NextHeader parses the leading part's header block off a multipart body into
-// dst, returning how many bytes of data it consumed: the part's content begins
-// at data[parsedLen]. A zero parsedLen and no error means data holds no complete
-// delimiter and header block yet, so the caller reads more in and retries.
-// Returns [io.EOF] once the closing delimiter is reached. dst is reset on error.
-func (m *Multipart) NextHeader(dst *MultipartHeader, data []byte) (parsedLen int, err error) {
-	dst.Reset()
-	if len(m.Boundary) == 0 {
-		return 0, errNoBoundary
-	}
-	idx := m.indexDelimiter(data)
-	if idx < 0 {
-		return 0, nil
-	}
-	after := idx + len("--") + len(m.Boundary)
-	if after+2 > len(data) {
-		return 0, nil // Cannot tell a closing delimiter yet.
-	} else if data[after] == '-' && data[after+1] == '-' {
-		return 0, io.EOF
-	}
-	// Delimiter is followed by CRLF, then the part's header block.
-	if data[after] == '\r' {
-		after++
-	}
-	if after >= len(data) {
-		return 0, nil
-	} else if data[after] != '\n' {
-		return 0, errBadDelimiter
-	}
-	after++
-	end := bytes.Index(data[after:], []byte("\r\n\r\n"))
-	if end < 0 {
-		return 0, nil
-	}
-	dst.PartView = data[after : after+end+2]
-	disposition := partField(dst.PartView)
-	dst.Name = append(dst.Name[:0], ContentParam(disposition, "name")...)
-	dst.Filename = append(dst.Filename[:0], ContentParam(disposition, "filename")...)
-	return after + end + 4, nil
-}
-
-// NextBody reports how much of data is part content, data[:bodyLen], and where
-// what is left begins, data[restOff:], which the caller compacts to the front of
-// its buffer before reading more in. done reports the part ended, in which case
-// data[restOff:] begins the next part's delimiter; otherwise the bytes past
-// bodyLen are a tail held back because it could still turn into a delimiter.
-func (m *Multipart) NextBody(data []byte) (bodyLen, restOff int, done bool) {
-	idx := m.indexPartEnd(data)
-	if idx >= 0 {
-		return idx, idx + len("\r\n"), true
-	}
-	// Longest prefix of "\r\n--"+boundary that could still be completed.
-	hold := min(len("\r\n--")+len(m.Boundary)-1, len(data))
-	return len(data) - hold, len(data) - hold, false
-}
-
-// indexDelimiter returns the offset of the leading "--"+Boundary in data.
-func (m *Multipart) indexDelimiter(data []byte) int {
-	for i := 0; i+len("--")+len(m.Boundary) <= len(data); i++ {
-		dash := bytes.IndexByte(data[i:], '-')
-		if dash < 0 {
-			return -1
-		}
-		i += dash
-		if i+len("--")+len(m.Boundary) > len(data) {
-			return -1
-		}
-		if data[i+1] == '-' && b2s(data[i+2:i+2+len(m.Boundary)]) == b2s(m.Boundary) {
-			return i
-		}
-	}
-	return -1
-}
-
-// indexPartEnd returns the offset of the CRLF that closes a part, that is the
-// CRLF preceding the next delimiter.
-func (m *Multipart) indexPartEnd(data []byte) int {
-	for i := 0; i+len("\r\n--")+len(m.Boundary) <= len(data); i++ {
-		cr := bytes.IndexByte(data[i:], '\r')
-		if cr < 0 {
-			return -1
-		}
-		i += cr
-		if i+len("\r\n--")+len(m.Boundary) > len(data) {
-			return -1
-		}
-		if data[i+1] == '\n' && data[i+2] == '-' && data[i+3] == '-' &&
-			b2s(data[i+4:i+4+len(m.Boundary)]) == b2s(m.Boundary) {
-			return i
-		}
-	}
-	return -1
-}
-
-// MediaTypeIs reports whether a Content-Type field value carries the given
-// media type, ignoring case and any parameters that follow it, i.e: true for
-// "text/plain; charset=utf-8" and media type "text/plain". mediaType must be
-// ASCII lowercase. RFC 9110 8.3.1.
-func MediaTypeIs(value []byte, mediaType string) bool {
-	if semi := bytes.IndexByte(value, ';'); semi >= 0 {
-		value = value[:semi]
-	}
-	return equalFold(trimOWS(value), mediaType)
-}
-
-// ContentParam returns the value of a parameter of a header field value, i.e:
-// "utf-8" for key "charset" of "text/plain; charset=utf-8". Quoted values are
-// returned without their quotes and with escapes left as they appear on the
-// wire. Key matching is case insensitive, RFC 9110 5.6.6.
-func ContentParam(value []byte, key string) []byte {
-	for len(value) > 0 {
-		semi := bytes.IndexByte(value, ';')
-		if semi < 0 {
-			return nil // No parameters left.
-		}
-		value = trimOWS(value[semi+1:])
-		eq := bytes.IndexByte(value, '=')
-		if eq < 0 {
-			return nil
-		}
-		gotKey := trimOWS(value[:eq])
-		value = value[eq+1:]
-		param := value
-		if len(param) > 0 && param[0] == '"' {
-			end := bytes.IndexByte(param[1:], '"')
-			if end < 0 {
-				return nil // Unterminated quoted string.
-			}
-			param, value = param[1:end+1], param[end+2:]
-		} else {
-			end := bytes.IndexByte(param, ';')
-			if end >= 0 {
-				param, value = param[:end], param[end:]
-			} else {
-				value = nil
-			}
-			param = trimOWS(param)
-		}
-		if equalFold(gotKey, key) {
-			return param
-		}
-	}
-	return nil
-}
-
-// partField returns the Content-Disposition field value of a part header block.
-func partField(partHdr []byte) []byte {
-	const key = "content-disposition"
-	for len(partHdr) > 0 {
-		eol := bytes.IndexByte(partHdr, '\n')
-		line := partHdr
-		if eol >= 0 {
-			line, partHdr = partHdr[:eol], partHdr[eol+1:]
-		} else {
-			partHdr = nil
-		}
-		colon := bytes.IndexByte(line, ':')
-		if colon > 0 && equalFold(line[:colon], key) {
-			return line[colon+1:]
-		}
-	}
-	return nil
-}
-
-// trimOWS trims optional whitespace off both ends of b, RFC 9110 5.6.3.
-func trimOWS(b []byte) []byte {
-	for len(b) > 0 && (b[0] == ' ' || b[0] == '\t') {
-		b = b[1:]
-	}
-	for len(b) > 0 && (b[len(b)-1] == ' ' || b[len(b)-1] == '\t') {
-		b = b[:len(b)-1]
-	}
-	return b
-}
-
-// equalFold compares b to the ASCII lowercase key, case insensitively.
-func equalFold(b []byte, key string) bool {
-	if len(b) != len(key) {
-		return false
-	}
-	const asciiCapDiff = 'a' - 'A'
-	for i := range b {
-		c := b[i]
-		if c >= 'A' && c <= 'Z' {
-			c += asciiCapDiff
-		}
-		if c != key[i] {
-			return false
-		}
-	}
-	return true
-}

http/httpraw/multipart_test.go

@@ -1,334 +0,0 @@
-package httpraw
-
-import (
-	"io"
-	"strconv"
-	"strings"
-	"testing"
-)
-
-// A two part body: a text field and a PNG upload whose bytes contain CRLFs and
-// even the boundary text, which must not desync the parser.
-const (
-	multiBoundary = "----abc123"
-	multiBody     = "------abc123\r\n" +
-		"Content-Disposition: form-data; name=\"caption\"\r\n" +
-		"\r\n" +
-		"hi there\r\n" +
-		"------abc123\r\n" +
-		"Content-Disposition: form-data; name=\"photo\"; filename=\"beach.png\"\r\n" +
-		"Content-Type: image/png\r\n" +
-		"\r\n" +
-		"\x89PNG\r\n--not-the-boundary\r\n\x00\xff\r\n" +
-		"------abc123--\r\n"
-)
-
-func TestMultipartBoundary(t *testing.T) {
-	var mp Multipart
-	for _, test := range []struct {
-		contentType string
-		want        string
-		wantErr     bool
-	}{
-		{contentType: "multipart/form-data; boundary=abc123", want: "abc123"},
-		{contentType: "multipart/form-data; boundary=\"a b\"", want: "a b"},
-		{contentType: "multipart/form-data; charset=utf-8; boundary=xyz", want: "xyz"},
-		{contentType: "multipart/form-data; BOUNDARY=xyz", want: "xyz"},   // Keys are case insensitive.
-		{contentType: "multipart/form-data", wantErr: true},               // Absent, RFC 2046 5.1.1 requires it.
-		{contentType: "application/x-www-form-urlencoded", wantErr: true}, // Not multipart at all.
-		{contentType: "multipart/form-data; boundary=", wantErr: true},    // Empty matches every "--".
-	} {
-		err := mp.SetContentType([]byte(test.contentType))
-		if test.wantErr {
-			if err == nil {
-				t.Errorf("%q: want error, got boundary %q", test.contentType, mp.Boundary)
-			}
-			continue
-		} else if err != nil {
-			t.Errorf("%q: %s", test.contentType, err)
-			continue
-		}
-		got := string(mp.Boundary)
-		if got != test.want {
-			t.Errorf("%q: want %q, got %q", test.contentType, test.want, got)
-		}
-	}
-}
-
-func TestMediaTypeIs(t *testing.T) {
-	for _, test := range []struct {
-		value string
-		media string
-		want  bool
-	}{
-		{value: "text/plain", media: "text/plain", want: true},
-		{value: "text/plain; charset=utf-8", media: "text/plain", want: true},
-		{value: "text/plain;charset=utf-8", media: "text/plain", want: true},
-		{value: "Text/Plain", media: "text/plain", want: true}, // Case insensitive, RFC 9110 8.3.1.
-		{value: " text/plain ; x=1", media: "text/plain", want: true},
-		{value: "text/plain", media: "text/html"},
-		{value: "text/plainish", media: "text/plain"}, // Prefix must not match.
-		{value: "", media: "text/plain"},
-		{value: "multipart/form-data; boundary=abc", media: "multipart/form-data", want: true},
-	} {
-		if got := MediaTypeIs([]byte(test.value), test.media); got != test.want {
-			t.Errorf("%q is %q: want %v, got %v", test.value, test.media, test.want, got)
-		}
-	}
-}
-
-func TestContentParam(t *testing.T) {
-	for _, test := range []struct {
-		value string
-		key   string
-		want  string
-	}{
-		{value: "text/plain; charset=utf-8", key: "charset", want: "utf-8"},
-		{value: "text/plain;charset=utf-8", key: "charset", want: "utf-8"}, // No space.
-		{value: "text/plain; charset=\"utf-8\"", key: "charset", want: "utf-8"},
-		{value: "form-data; name=\"photo\"; filename=\"a;b.png\"", key: "filename", want: "a;b.png"},
-		{value: "form-data; name=\"photo\"", key: "nope", want: ""},
-		{value: "form-data; names=x; name=y", key: "name", want: "y"}, // Prefix must not match.
-		{value: "text/plain", key: "charset", want: ""},
-	} {
-		got := ContentParam([]byte(test.value), test.key)
-		if string(got) != test.want {
-			t.Errorf("%q key %q: want %q, got %q", test.value, test.key, test.want, got)
-		}
-	}
-}
-
-func TestNextPartHeader(t *testing.T) {
-	m := Multipart{Boundary: []byte(multiBoundary)}
-	var hdr MultipartHeader
-	parsed, err := m.NextHeader(&hdr, []byte(multiBody))
-	if err != nil {
-		t.Fatal(err)
-	}
-	const wantHdr = "Content-Disposition: form-data; name=\"caption\"\r\n"
-	if string(hdr.PartView) != wantHdr {
-		t.Errorf("want header %q, got %q", wantHdr, hdr.PartView)
-	}
-	if string(hdr.Name) != "caption" {
-		t.Errorf("want name %q, got %q", "caption", hdr.Name)
-	}
-	if len(hdr.Filename) != 0 {
-		t.Errorf("want no filename for a non file part, got %q", hdr.Filename)
-	}
-	if !strings.HasPrefix(multiBody[parsed:], "hi there\r\n") {
-		t.Errorf("want rest at part body, got %q", multiBody[parsed:])
-	}
-}
-
-// Names and filenames must outlive the buffer they were parsed from, so a
-// caller may compact it and read more without losing the part it is reading.
-func TestNextPartHeaderOutlivesBuffer(t *testing.T) {
-	m := Multipart{Boundary: []byte(multiBoundary)}
-	data := []byte(multiBody)
-	var hdr MultipartHeader
-	if _, err := m.NextHeader(&hdr, data); err != nil {
-		t.Fatal(err)
-	}
-	for i := range data {
-		data[i] = 'x' // Buffer reused for the next read.
-	}
-	if string(hdr.Name) != "caption" {
-		t.Errorf("want name %q to survive the buffer, got %q", "caption", hdr.Name)
-	}
-}
-
-// Incomplete data must ask for more, never guess.
-func TestNextPartHeaderNeedMore(t *testing.T) {
-	m := Multipart{Boundary: []byte(multiBoundary)}
-	for _, data := range []string{
-		"",
-		"------abc",        // Delimiter cut short.
-		"------abc123\r\n", // No header block yet.
-		"------abc123\r\nContent-Disposition: form-", // Header block unterminated.
-	} {
-		var hdr MultipartHeader
-		parsed, err := m.NextHeader(&hdr, []byte(data))
-		if parsed != 0 || err != nil {
-			t.Errorf("%q: want (0, nil) asking for more data, got (%d, %v)", data, parsed, err)
-		}
-	}
-}
-
-// Junk between the delimiter and the part header is a multipart framing error,
-// not a header field name error.
-func TestNextPartHeaderJunk(t *testing.T) {
-	m := Multipart{Boundary: []byte("abc")}
-	var hdr MultipartHeader
-	if _, err := m.NextHeader(&hdr, []byte("--abcX\r\nA: b\r\n\r\n")); err != errBadDelimiter {
-		t.Errorf("want errBadDelimiter, got %v", err)
-	}
-}
-
-// The closing delimiter ends iteration.
-func TestNextPartHeaderEnd(t *testing.T) {
-	m := Multipart{Boundary: []byte(multiBoundary)}
-	var hdr MultipartHeader
-	if _, err := m.NextHeader(&hdr, []byte("------abc123--\r\n")); err != io.EOF {
-		t.Errorf("want io.EOF, got %v", err)
-	}
-}
-
-func TestNextPartBody(t *testing.T) {
-	m := Multipart{Boundary: []byte(multiBoundary)}
-	var hdr MultipartHeader
-	parsed, err := m.NextHeader(&hdr, []byte(multiBody))
-	if err != nil {
-		t.Fatal(err)
-	}
-	rest := multiBody[parsed:]
-	bodyLen, restOff, done := m.NextBody([]byte(rest))
-	if !done {
-		t.Fatal("want the part to end within the buffer")
-	}
-	if rest[:bodyLen] != "hi there" {
-		t.Errorf("want body %q, got %q", "hi there", rest[:bodyLen])
-	}
-	if !strings.HasPrefix(rest[restOff:], "------abc123\r\n") {
-		t.Errorf("want rest at next delimiter, got %q", rest[restOff:])
-	}
-}
-
-// A part whose bytes contain CRLFs and boundary-like text must survive intact.
-func TestNextPartBodyBinary(t *testing.T) {
-	m := Multipart{Boundary: []byte(multiBoundary)}
-	rest := []byte(multiBody)
-	var hdr MultipartHeader
-	parsed, err := m.NextHeader(&hdr, rest) // caption part.
-	if err != nil {
-		t.Fatal(err)
-	}
-	_, restOff, _ := m.NextBody(rest[parsed:])
-	rest = rest[parsed+restOff:]
-	parsed, err = m.NextHeader(&hdr, rest) // photo part.
-	if err != nil {
-		t.Fatal(err)
-	}
-	rest = rest[parsed:]
-	bodyLen, restOff, done := m.NextBody(rest)
-	if !done {
-		t.Fatal("want the part to end within the buffer")
-	}
-	const want = "\x89PNG\r\n--not-the-boundary\r\n\x00\xff"
-	if string(rest[:bodyLen]) != want {
-		t.Errorf("want body %q, got %q", want, rest[:bodyLen])
-	}
-	if _, err = m.NextHeader(&hdr, rest[restOff:]); err != io.EOF {
-		t.Errorf("want io.EOF after last part, got %v", err)
-	}
-}
-
-// A delimiter split across two reads must not be mistaken for part data: the
-// tail is held back until proven not to be a delimiter.
-func TestNextPartBodySplitDelimiter(t *testing.T) {
-	m := Multipart{Boundary: []byte(multiBoundary)}
-	const part = "hi there"
-	full := part + "\r\n------abc123\r\n"
-	for split := 1; split < len(full); split++ {
-		data := full[:split]
-		bodyLen, restOff, done := m.NextBody([]byte(data))
-		if done {
-			continue // Whole delimiter already present, nothing to prove.
-		}
-		if bodyLen > len(part) {
-			t.Fatalf("split %d: emitted %q, past the end of the part", split, data[:bodyLen])
-		}
-		if data[:bodyLen]+data[restOff:] != data {
-			t.Fatalf("split %d: body+rest %q%q does not reconstruct input", split, data[:bodyLen], data[restOff:])
-		}
-	}
-}
-
-// A file part carries both parameters, and the raw block stays available.
-func TestNextHeaderFilePart(t *testing.T) {
-	m := Multipart{Boundary: []byte(multiBoundary)}
-	var hdr MultipartHeader
-	parsed, err := m.NextHeader(&hdr, []byte(multiBody)) // caption part.
-	if err != nil {
-		t.Fatal(err)
-	}
-	rest := []byte(multiBody[parsed:])
-	_, restOff, _ := m.NextBody(rest)
-	if _, err = m.NextHeader(&hdr, rest[restOff:]); err != nil { // photo part.
-		t.Fatal(err)
-	}
-	if got := string(hdr.Name); got != "photo" {
-		t.Errorf("want name %q, got %q", "photo", got)
-	}
-	if got := string(hdr.Filename); got != "beach.png" {
-		t.Errorf("want filename %q, got %q", "beach.png", got)
-	}
-	if !strings.Contains(string(hdr.PartView), "Content-Type: image/png") {
-		t.Errorf("want the raw block to hold every field, got %q", hdr.PartView)
-	}
-}
-
-// A failed call must not leave the previous part's fields behind.
-func TestNextHeaderResetsOnError(t *testing.T) {
-	m := Multipart{Boundary: []byte(multiBoundary)}
-	var hdr MultipartHeader
-	if _, err := m.NextHeader(&hdr, []byte(multiBody)); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := m.NextHeader(&hdr, []byte("------abc123--\r\n")); err != io.EOF {
-		t.Fatalf("want io.EOF, got %v", err)
-	}
-	if hdr.PartView != nil || len(hdr.Name) != 0 || len(hdr.Filename) != 0 {
-		t.Errorf("want cleared header on error, got %+v", hdr)
-	}
-}
-
-// A header reused across parts must stop allocating once its name and filename
-// buffers are big enough.
-func TestNextHeaderReuseNoAlloc(t *testing.T) {
-	m := Multipart{Boundary: []byte(multiBoundary)}
-	data := []byte(multiBody)
-	var hdr MultipartHeader
-	allocs := testing.AllocsPerRun(10, func() {
-		if _, err := m.NextHeader(&hdr, data); err != nil {
-			t.Fatal(err)
-		}
-	})
-	if allocs != 0 {
-		t.Errorf("want a reused header to allocate 0 times, got %v", allocs)
-	}
-}
-
-// The whole loop, as a caller writes it over a buffer it compacts.
-func TestMultipartLoop(t *testing.T) {
-	m := Multipart{Boundary: []byte(multiBoundary)}
-	rest := []byte(multiBody)
-	var got []string
-	var hdr MultipartHeader
-	for {
-		parsed, err := m.NextHeader(&hdr, rest)
-		if err == io.EOF {
-			break
-		} else if err != nil {
-			t.Fatal(err)
-		} else if parsed == 0 {
-			t.Fatal("header must complete within the buffer")
-		}
-		name := string(hdr.Name)
-		total := 0
-		rest = rest[parsed:]
-		for {
-			bodyLen, restOff, done := m.NextBody(rest)
-			total += bodyLen
-			rest = rest[restOff:]
-			if done {
-				break
-			}
-			t.Fatal("part must complete within the buffer")
-		}
-		got = append(got, name+":"+strconv.Itoa(total))
-	}
-	want := "caption:8|photo:28"
-	if strings.Join(got, "|") != want {
-		t.Errorf("want %q, got %q", want, strings.Join(got, "|"))
-	}
-}

http/httpraw/parse.go

@@ -0,0 +1,559 @@
+package httpraw
+
+import (
+	"bytes"
+	"errors"
+	"slices"
+	"strconv"
+	"unsafe"
+
+	"github.com/soypat/lneto/internal"
+)
+
+var (
+	errNoProto     = errors.New("missing protocol, HTTP/0.9 unsupported")
+	errNeedMore    = errors.New("need more data: cannot find trailing lf")
+	errUnparsed    = errors.New("need to finish parsing")
+	errInvalidName = errors.New("invalid header name")
+	errSmallBuffer = errors.New("small read buffer. Increase ReadBufferSize")
+	errOOM         = errors.New("httpraw: buffer out of memory")
+	// Header.Set and Header.Add mangles the buffer.
+	// Call them after retrieving the Body. Do not call them before parsing the header (why would you even do that?).
+	errMangledBuffer    = errors.New("httpraw: mangled buffer")
+	errNoCookies        = errors.New("no cookie found")
+	errEmptyURI         = errors.New("empty URI")
+	errLongStatusCode   = errors.New("long status code")
+	errBadStatusCode    = errors.New("invalid status code")
+	errAlreadyParsed    = errors.New("TryParse called after header parsed")
+	errNeedMethodURI    = errors.New("need method/request URI to create request header")
+	errBadStatusCodeTxt = errors.New("invalid status code or text")
+	errCookiesParsed    = errors.New("cookies already parsed, reset before parsing again")
+	errBufferTooLarge   = errors.New("httpraw: buffer exceeds max size (offsets are uint16)")
+)
+
+// maxBufLen bounds the header buffer. Offsets/lengths are stored as uint16
+// (tokint); a buffer past this would truncate/overflow those, silently
+// returning the wrong bytes or panicking on a wrapped slice bound.
+const maxBufLen = 0xffff
+
+type headerBuf struct {
+	// buf[:len] holds entire HTTP header data, which may be normalized by [flags]. buf[off:len] holds data not yet processed during parsing.
+	buf []byte
+	// offset into buf for parsing.
+	off int
+	// args contains key-value store.
+	headers []argsKV
+}
+
+// reset sets the buffer data and discards all parsed data.
+func (h *headerBuf) reset(buf []byte) {
+	if buf == nil {
+		buf = h.buf[:0] // Reuse buffer but discard raw data on nil input.
+	}
+	if cap(h.headers) == 0 {
+		h.headers = make([]argsKV, 16)
+	}
+	*h = headerBuf{
+		buf:     buf,
+		headers: h.headers[:0],
+	}
+}
+
+type tokint = uint16
+
+type headerSlice struct {
+	start tokint
+	len   tokint
+}
+
+type argsKV struct {
+	key   headerSlice
+	value headerSlice // value start >0 means value is present.
+}
+
+type scannerState struct {
+	err error
+
+	// by checking whether the next line contains a colon or not to tell
+	// it's a header entry or a multi line value of current header entry.
+	// the side effect of this operation is that we know the index of the
+	// next colon and new line, so this can be used during next iteration,
+	// instead of find them again.
+	nextColon   int
+	nextNewLine int
+
+	initialized bool
+}
+
+func (h *Header) parse(asResponse bool) (err error) {
+	debuglog("http:firstline:start")
+	err = h.parseFirstLine(asResponse)
+	if err != nil {
+		debuglog("http:firstline:err")
+		return err
+	}
+	debuglog("http:firstline:done")
+	err = h.parseNextHeaders()
+	debuglog("http:headers:done")
+	return err
+}
+
+func (h *Header) parseFirstLine(asResponse bool) (err error) {
+	if len(h.hbuf.buf) > maxBufLen {
+		return errBufferTooLarge // Offsets would overflow uint16 tokint.
+	}
+	if asResponse {
+		h.statusCode, h.statusText, h.flags, err = h.hbuf.parseFirstLineResponse(h.flags)
+	} else {
+		h.method, h.requestURI, h.proto, h.flags, err = h.hbuf.parseFirstLineRequest(h.flags)
+	}
+	return err
+}
+
+func (h *Header) parseNextHeaders() error {
+	var ss scannerState
+	h.hbuf.parseNextHeaders(&ss)
+	if ss.err != nil {
+		h.flags |= flagConnClose
+		return ss.err
+	}
+	h.flags |= flagDoneParsingHeader
+	return nil
+}
+
+func (hb *headerBuf) readFromBytes(b []byte) {
+	hb.buf = append(hb.buf, b...)
+}
+
+func (hb *headerBuf) free() int { return cap(hb.buf) - len(hb.buf) }
+
+func (hb *headerBuf) parseNextHeaders(ss *scannerState) {
+	debuglog("http:nexthdr:loop")
+	for kv := hb.next(ss); kv.isValid(); kv = hb.next(ss) {
+		if len(hb.headers) == cap(hb.headers) {
+			// Refuse to grow the headers slice: caller must pre-allocate
+			// sufficient capacity via reset or use a larger initial size.
+			ss.err = errOOM
+			return
+		}
+		hb.headers = append(hb.headers, kv)
+	}
+	debuglog("http:nexthdr:done")
+}
+
+func (hb *headerBuf) offBuf() []byte {
+	return hb.buf[hb.off:]
+}
+
+func (hb *headerBuf) skipLeadingCRLF() {
+	for hb.off < len(hb.buf) && (hb.buf[hb.off] == '\n' || hb.buf[hb.off] == '\r') {
+		hb.off++
+	}
+}
+
+func (hb *headerBuf) scanLine() []byte {
+	buf := hb.scanUntilByte('\n')
+	if len(buf) > 0 && buf[len(buf)-1] == '\r' {
+		buf = buf[:len(buf)-1] // exclude carriage return.
+	}
+	if hb.off < len(hb.buf) {
+		hb.off++ // consume newline.
+	}
+	return buf
+}
+
+func (hb *headerBuf) scanUntilByte(c byte) []byte {
+	buf := hb.offBuf()
+	idx := bytes.IndexByte(buf, c)
+	if idx >= 0 {
+		buf = buf[:idx]
+	}
+	hb.off += len(buf)
+	return buf
+}
+
+func (hb *headerBuf) parseFirstLineRequest(initFlags flags) (method, uri, proto headerSlice, flags flags, err error) {
+	debuglog("http:req:scan")
+	hb.off = 0 // Parsing first line resets offset.
+	hb.skipLeadingCRLF()
+	flags = initFlags
+	if bytes.IndexByte(hb.offBuf(), '\n') < 0 {
+		return method, uri, proto, flags, errNeedMore // Incomplete line.
+	}
+	b := hb.scanLine()
+	if len(b) < 5 {
+		return method, uri, proto, flags, errNeedMore
+	}
+	debuglog("http:req:parse")
+
+	methodEnd := max(0, bytes.IndexByte(b, ' '))
+	reqURIEnd := bytes.IndexByte(b[methodEnd+1:], ' ')
+	if reqURIEnd > 0 {
+		reqURIEnd += methodEnd + 1
+		uri = hb.slice(b[methodEnd+1 : reqURIEnd])
+		proto = hb.slice(b[reqURIEnd+1:]) // Skip space before protocol.
+		if b2s(b[reqURIEnd+1:]) != strHTTP11 {
+			flags |= flagNoHTTP11
+		}
+	} else if reqURIEnd == 0 {
+		return method, uri, proto, flags, errEmptyURI
+	} else {
+		// No version provided.
+		flags |= flagNoHTTP11
+		uri = hb.slice(b[methodEnd+1:])
+	}
+	method = hb.slice(b[:methodEnd])
+	return method, uri, proto, flags, nil
+}
+
+func (hb *headerBuf) parseFirstLineResponse(initFlags flags) (statusCode, statusText headerSlice, flags flags, err error) {
+	debuglog("http:resp:scan")
+	hb.off = 0 // Parsing first line resets offset.
+	hb.skipLeadingCRLF()
+	flags = initFlags
+	if bytes.IndexByte(hb.offBuf(), '\n') < 0 {
+		return statusCode, statusText, flags, errNeedMore // Incomplete line.
+	}
+	b := hb.scanLine()
+	if len(b) < 5 {
+		return statusCode, statusText, flags, errNeedMore
+	}
+	debuglog("http:resp:parse")
+
+	// Parse protocol (e.g. "HTTP/1.1"), then status code, then status text.
+	protoEnd := bytes.IndexByte(b, ' ')
+	if protoEnd < 0 {
+		return statusCode, statusText, flags, errNeedMore
+	}
+	if b2s(b[:protoEnd]) != strHTTP11 {
+		flags |= flagNoHTTP11
+	}
+	b = b[protoEnd+1:] // Advance past protocol and space.
+
+	codeEnd := bytes.IndexByte(b, ' ')
+	if codeEnd < 0 {
+		codeEnd = len(b) // Status text is optional.
+	}
+	code := b[:codeEnd]
+	if len(code) > 3 {
+		return statusCode, statusText, flags, errLongStatusCode
+	}
+	for i := range code {
+		if code[i] > '9' || code[i] < '0' {
+			debuglog("http:resp:invalid-code")
+			return statusCode, statusText, flags, errBadStatusCode
+		}
+	}
+	statusCode = hb.slice(code)
+	if codeEnd < len(b) {
+		statusText = hb.slice(b[codeEnd+1:]) // Skip space before text.
+	}
+	debuglog("http:resp:done")
+	return statusCode, statusText, flags, nil
+}
+
+func (kv argsKV) isValid() bool {
+	return kv.key.start > 0
+}
+
+func (kv *argsKV) invalidate() {
+	*kv = argsKV{}
+}
+
+func (tb headerBuf) musttoken(slice headerSlice) []byte {
+	return tok2bytes(tb.buf, slice)
+
+}
+
+func (tb headerBuf) slice(b []byte) headerSlice {
+	return bytes2tok(tb.buf, b)
+}
+
+func (kv argsKV) HasValue() bool { return kv.value.start > 0 }
+
+func (h *Header) hasHeaderValue(key, value string) bool {
+	kv := h.peekHeader(key)
+	return kv.isValid() && b2s(h.hbuf.musttoken(kv.value)) == value
+}
+
+// peekHeader returns header key-value for the given key.
+//
+// The returned value is valid until the request is released,
+// either though ReleaseRequest or your request handler returning.
+// Do not store references to returned value. Make copies instead.
+func (h *Header) peekHeader(key string) argsKV {
+	hb := &h.hbuf
+	for i := 0; i < len(h.hbuf.headers); i++ {
+		if b2s(hb.musttoken(h.hbuf.headers[i].key)) == key {
+			return h.hbuf.headers[i]
+		}
+	}
+	return hb.noKV()
+}
+
+func (hb *headerBuf) mustAppendSlice(value string) headerSlice {
+	L := len(hb.buf)
+	if L == 0 {
+		L++ // Valid key-values start after 0.
+	}
+	copy(hb.buf[L:L+len(value)], value)
+	hb.buf = hb.buf[:L+len(value)]
+	return hb.slice(hb.buf[L : L+len(value)])
+}
+
+func (h *Header) reuseOrAppend(tok headerSlice, value string) headerSlice {
+	if tok.len > tokint(len(value)) {
+		copy(h.hbuf.musttoken(tok), value)
+		tok.len = tokint(len(value))
+		return tok
+	}
+	return h.appendSlice(value)
+}
+
+func (h *Header) appendSlice(value string) headerSlice {
+	debuglog("http:appendslice:start")
+	if !h.reserve(len(value)) {
+		return headerSlice{}
+	}
+	h.flags |= flagMangledBuffer
+	return h.hbuf.mustAppendSlice(value)
+}
+
+func (h *Header) appendHeader(key, value string) {
+	// reserve accounts for the byte-0 reservation mustAppendSlice makes on an
+	// empty buffer, and drops (flagging OOM) rather than panicking when growth
+	// is disabled and space runs out.
+	if !h.reserve(len(key) + len(value)) {
+		return
+	}
+	h.flags |= flagMangledBuffer
+	hb := &h.hbuf
+	k := hb.mustAppendSlice(key)
+	v := hb.mustAppendSlice(value)
+	debuglog("http:appendhdr:grow-hdrs")
+	hb.headers = append(hb.headers, argsKV{
+		key:   k,
+		value: v,
+	})
+}
+
+// appendHeaderInt is appendHeader's integer counterpart: it appends key and the
+// formatted integer value as a new header field.
+func (h *Header) appendHeaderInt(key string, value int64, base int) {
+	n := intLen(value, base)
+	if !h.reserve(len(key) + n) {
+		return // Drop and flag OOM; never panic.
+	}
+	h.flags |= flagMangledBuffer
+	hb := &h.hbuf
+	k := hb.mustAppendSlice(key)
+	v := hb.mustAppendInt(value, base)
+	hb.headers = append(hb.headers, argsKV{
+		key:   k,
+		value: v,
+	})
+}
+
+// reserve ensures need free bytes are available in the buffer, growing it when
+// permitted. It accounts for the byte-0 reservation on an empty buffer (see
+// mustAppendSlice). It returns false and sets flagOOMReached when the space
+// cannot be guaranteed: a tokint offset overflow, or a full buffer with
+// flagNoBufferGrow set.
+func (h *Header) reserve(need int) bool {
+	hb := &h.hbuf
+	if len(hb.buf) == 0 {
+		need++ // mustAppend* reserves byte 0 on an empty buffer.
+	}
+	if len(hb.buf)+need > maxBufLen {
+		h.flags |= flagOOMReached // Offsets would overflow uint16 tokint.
+		return false
+	}
+	if need > hb.free() {
+		if h.flags.hasAny(flagNoBufferGrow) {
+			h.flags |= flagOOMReached
+			return false
+		}
+		hb.buf = slices.Grow(hb.buf, need)
+	}
+	return true
+}
+
+// reuseOrAppendInt writes value into tok's slot in place when it fits, avoiding
+// any buffer growth; otherwise it appends a fresh slot.
+func (h *Header) reuseOrAppendInt(tok headerSlice, value int64, base int) headerSlice {
+	n := intLen(value, base)
+	if int(tok.len) >= n {
+		// Reuse: format directly over the existing slot. No free space needed
+		// since n <= tok.len and the slot already lives inside buf.
+		v := strconv.AppendInt(h.hbuf.buf[tok.start:tok.start], value, base)
+		tok.len = tokint(len(v))
+		h.flags |= flagMangledBuffer
+		return tok
+	}
+	return h.appendInt(value, base, n)
+}
+
+// appendInt reserves space (growing or flagging OOM) and appends value as a new slot.
+func (h *Header) appendInt(value int64, base, n int) headerSlice {
+	if !h.reserve(n) {
+		return headerSlice{} // Drop and flag OOM; never panic.
+	}
+	h.flags |= flagMangledBuffer
+	return h.hbuf.mustAppendInt(value, base)
+}
+
+// mustAppendInt formats value into the buffer's free region and commits it.
+// The caller must have reserved at least intLen(value, base) free bytes.
+func (hb *headerBuf) mustAppendInt(value int64, base int) headerSlice {
+	L := len(hb.buf)
+	if L == 0 {
+		L++ // Valid key-values start after byte 0.
+	}
+	v := strconv.AppendInt(hb.buf[L:L], value, base)
+	hb.buf = hb.buf[:L+len(v)]
+	return hb.slice(hb.buf[L : L+len(v)])
+}
+
+// intLen returns the number of bytes strconv.AppendInt would emit for value in
+// the given base (including a leading minus sign for negatives). Used to size
+// the buffer and to test whether a value fits an existing slot without writing.
+func intLen(value int64, base int) int {
+	n := 1
+	u := uint64(value)
+	if value < 0 {
+		n++    // Leading minus sign.
+		u = -u // Two's-complement magnitude; correct even for math.MinInt64.
+	}
+	for u >= uint64(base) {
+		u /= uint64(base)
+		n++
+	}
+	return n
+}
+
+func (hb *headerBuf) noKV() argsKV { return argsKV{} }
+
+func (hb *headerBuf) next(ss *scannerState) argsKV {
+	if !ss.initialized {
+		ss.nextColon = -1
+		ss.nextNewLine = -1
+	}
+	buf := hb.buf[hb.off:]
+	blen := len(buf)
+	if blen >= 2 && buf[0] == '\r' && buf[1] == '\n' {
+		hb.off += 2
+		return hb.noKV() // \r\n\r\n Ends header.
+	} else if blen >= 1 && buf[0] == '\n' {
+		hb.off += 1
+		return hb.noKV() // \n\n Ends header.
+	}
+
+	// n is parsing offset. Will start by storing colon index.
+	n := 0
+	if ss.nextColon >= 0 {
+		// Retake from last colon found.
+		n = ss.nextColon
+		ss.nextColon = -1
+	} else {
+		n = bytes.IndexByte(buf, ':')
+		x := bytes.IndexByte(buf, '\n')
+		if x < 0 {
+			// A header name should always at some point be followed by a \n
+			// even if it's the one that terminates the header block.
+			ss.err = errNeedMore
+			return hb.noKV()
+		} else if x < n {
+			// There was a \n before the colon! This is invalid.
+			ss.err = errInvalidName
+			return hb.noKV()
+		} else if n < 0 {
+			// A newline is present (x>=0 reached here) but the line has no
+			// colon: malformed, not incomplete. A split arriving before the
+			// colon has no newline yet and is caught by the x<0 branch above,
+			// so it still returns errNeedMore.
+			ss.err = errInvalidName
+			return hb.noKV()
+		}
+	}
+	// n stores colon position by now.
+	if bytes.IndexByte(buf[:n], ' ') >= 0 || bytes.IndexByte(buf[:n], '\t') >= 0 {
+		// Spaces between the header key and colon are not allowed.
+		// See RFC 7230, Section 3.2.4.
+		ss.err = errInvalidName
+		return hb.noKV()
+	}
+
+	// Ready to store key..
+	var resultKV argsKV
+	resultKV.key = hb.slice(buf[:n])
+	n++ // consume colon.
+	for len(buf) > n && buf[n] == ' ' {
+		n++ // Trim leading spaces.
+	}
+	// n now points to start of value.
+	valueStart := n
+
+	// Find end of value. Values may be multiline, in which case we must treat newlines followed by whitespace as part of the value.
+	for {
+		nl := bytes.IndexByte(buf[n:], '\n')
+		if nl < 0 || nl+n+1 == len(buf) {
+			// No newline or newline is last character and can't know if is multiline.
+			ss.err = errNeedMore
+			return hb.noKV()
+		}
+		n += nl + 1 // Index of the newly found newline.
+		nextChar := buf[n]
+		if nextChar != ' ' && nextChar != '\t' {
+			break // End of value found.
+		}
+	}
+
+	valueEnd := n - 1 // Trim newline.
+	if valueEnd > valueStart && buf[valueEnd-1] == '\r' {
+		valueEnd-- // Trim \r character if present before value.
+	}
+	resultKV.value = hb.slice(buf[valueStart:valueEnd])
+	hb.off += n
+	return resultKV
+}
+
+// ConnectionClose returns true if 'Connection: close' header is set or if a invalid header was found.
+func (h *Header) ConnectionClose() bool {
+	closed := h.flags.hasAny(flagConnClose) ||
+		h.hasHeaderValue(headerConnection, strClose) ||
+		(h.flags.hasAny(flagNoHTTP11) && !h.hasHeaderValue(headerConnection, "keep-alive"))
+	if closed {
+		h.flags |= flagConnClose
+	}
+	return closed
+}
+
+// b2s converts byte slice to a string without memory allocation.
+// See https://groups.google.com/forum/#!msg/Golang-Nuts/ENgbUzYvCuU/90yGx7GUAgAJ .
+func b2s(b []byte) string {
+	return unsafe.String(unsafe.SliceData(b), len(b))
+}
+
+func tok2bytes(buf []byte, slice headerSlice) []byte {
+	return buf[slice.start : slice.start+slice.len]
+}
+
+func bytes2tok(buf, value []byte) headerSlice {
+	base := uintptr(unsafe.Pointer(unsafe.SliceData(buf)))
+	off := uintptr(unsafe.Pointer(unsafe.SliceData(value)))
+	if off < base || off > base+uintptr(len(buf)) {
+		panic("httpx: argument buffer does not alias header buffer")
+	}
+	return headerSlice{
+		start: tokint(off - base),
+		len:   tokint(len(value)),
+	}
+}
+
+const enableDebug = internal.HeapAllocDebugging
+
+func debuglog(msg string) {
+	if enableDebug {
+		internal.LogAllocs(msg)
+	}
+}

http/httpraw/parse_test.go

@@ -2,28 +2,28 @@ package httpraw
 
 import (
 	"bytes"
-	"errors"
 	"strings"
 	"testing"
-
-	"github.com/soypat/lneto"
 )
 
 func TestTryParse_IncrementalRequest(t *testing.T) {
 	// Full HTTP request split across multiple ReadFromBytes calls.
 	full := "GET /index.html HTTP/1.1\r\nHost: example.com\r\nContent-Type: text/html\r\n\r\nbody here"
-	var hdr HeaderV1
-	hdr.Reset(make([]byte, 0, 256), defaultKVCap)
+	var hdr Header
+	hdr.Reset(make([]byte, 0, 256))
 
 	// Feed data in small chunks to exercise incremental parsing.
 	chunks := splitInto(full, 10)
 	var done bool
 	var doneIdx int
 	for i, chunk := range chunks {
-		err := hdr.ReadFromBytes([]byte(chunk))
+		n, err := hdr.ReadFromBytes([]byte(chunk))
 		if err != nil {
 			t.Fatalf("ReadFromBytes: %v", err)
 		}
+		if n != len(chunk) {
+			t.Fatalf("expected %d bytes read, got %d", len(chunk), n)
+		}
 
 		var needMore bool
 		needMore, err = hdr.TryParse(false)
@@ -52,16 +52,19 @@ func TestTryParse_IncrementalRequest(t *testing.T) {
 	if string(hdr.Method()) != "GET" {
 		t.Errorf("method = %q; want GET", hdr.Method())
 	}
-	if string(hdr.RequestTarget()) != "/index.html" {
-		t.Errorf("URI = %q; want /index.html", hdr.RequestTarget())
+	if string(hdr.RequestURI()) != "/index.html" {
+		t.Errorf("URI = %q; want /index.html", hdr.RequestURI())
 	}
 
 	// Verify headers via ForEach.
 	headers := make(map[string]string)
-	hdr.ForEach(func(key, value []byte) bool {
+	err := hdr.ForEach(func(key, value []byte) error {
 		headers[string(key)] = string(value)
-		return true
+		return nil
 	})
+	if err != nil {
+		t.Fatal(err)
+	}
 	if headers["Host"] != "example.com" {
 		t.Errorf("Host = %q; want example.com", headers["Host"])
 	}
@@ -81,8 +84,8 @@ func TestTryParse_IncrementalRequest(t *testing.T) {
 
 func TestTryParse_IncrementalResponse(t *testing.T) {
 	full := "HTTP/1.1 200 OK\r\nContent-Length: 5\r\nServer: lneto\r\n\r\nhello"
-	var hdr HeaderV1
-	hdr.Reset(make([]byte, 0, 256), defaultKVCap)
+	var hdr Header
+	hdr.Reset(make([]byte, 0, 256))
 
 	chunks := splitInto(full, 8)
 	var done bool
@@ -133,8 +136,8 @@ func TestReadFromLimited(t *testing.T) {
 	data := "GET / HTTP/1.1\r\nHost: test\r\n\r\n"
 	r := strings.NewReader(data)
 
-	var hdr HeaderV1
-	hdr.Reset(make([]byte, 0, 256), defaultKVCap)
+	var hdr Header
+	hdr.Reset(make([]byte, 0, 256))
 
 	// Read in one shot.
 	n, err := hdr.ReadFromLimited(r, 256)
@@ -159,8 +162,8 @@ func TestReadFromLimited(t *testing.T) {
 }
 
 func TestReadFromLimited_MaxBytes(t *testing.T) {
-	var hdr HeaderV1
-	hdr.Reset(make([]byte, 0, 256), defaultKVCap)
+	var hdr Header
+	hdr.Reset(make([]byte, 0, 256))
 
 	// Zero maxBytesToRead should error.
 	_, err := hdr.ReadFromLimited(strings.NewReader("data"), 0)
@@ -170,18 +173,18 @@ func TestReadFromLimited_MaxBytes(t *testing.T) {
 }
 
 func TestReadFromBytes_Empty(t *testing.T) {
-	var hdr HeaderV1
-	hdr.Reset(make([]byte, 0, 256), defaultKVCap)
+	var hdr Header
+	hdr.Reset(make([]byte, 0, 256))
 
-	err := hdr.ReadFromBytes(nil)
+	_, err := hdr.ReadFromBytes(nil)
 	if err == nil {
 		t.Fatal("expected error for empty bytes")
 	}
 }
 
 func TestBufferFreeAndCapacity(t *testing.T) {
-	var hdr HeaderV1
-	hdr.Reset(make([]byte, 0, 100), defaultKVCap)
+	var hdr Header
+	hdr.Reset(make([]byte, 0, 100))
 
 	if hdr.BufferCapacity() != 100 {
 		t.Errorf("capacity = %d; want 100", hdr.BufferCapacity())
@@ -197,16 +200,17 @@ func TestBufferFreeAndCapacity(t *testing.T) {
 }
 
 func TestEnableBufferGrowth(t *testing.T) {
-	var hdr HeaderV1
+	var hdr Header
 	buf := make([]byte, 0, 64)
-	hdr.Reset(buf, defaultKVCap)
-	hdr.ConfigBufferGrowth(false)
+	hdr.Reset(buf)
+	hdr.EnableBufferGrowth(false)
+
 	// With growth disabled, reading more than capacity should fail.
 	big := make([]byte, 128)
 	for i := range big {
 		big[i] = 'A'
 	}
-	err := hdr.ReadFromBytes(big)
+	_, err := hdr.ReadFromBytes(big)
 	if err == nil {
 		t.Fatal("expected error when buffer growth disabled and data exceeds capacity")
 	}
@@ -214,7 +218,7 @@ func TestEnableBufferGrowth(t *testing.T) {
 
 func TestHeader_Add(t *testing.T) {
 	full := "GET / HTTP/1.1\r\nHost: test\r\n\r\n"
-	var hdr HeaderV1
+	var hdr Header
 	err := hdr.ParseBytes(false, []byte(full))
 	if err != nil {
 		t.Fatal(err)
@@ -225,11 +229,11 @@ func TestHeader_Add(t *testing.T) {
 
 	// ForEach should find both.
 	var values []string
-	hdr.ForEach(func(key, value []byte) bool {
+	hdr.ForEach(func(key, value []byte) error {
 		if string(key) == "X-Custom" {
 			values = append(values, string(value))
 		}
-		return true
+		return nil
 	})
 	if len(values) != 2 {
 		t.Fatalf("expected 2 X-Custom headers, got %d", len(values))
@@ -241,7 +245,7 @@ func TestHeader_Add(t *testing.T) {
 
 func TestHeader_SetBytes(t *testing.T) {
 	full := "GET / HTTP/1.1\r\nHost: test\r\n\r\n"
-	var hdr HeaderV1
+	var hdr Header
 	err := hdr.ParseBytes(false, []byte(full))
 	if err != nil {
 		t.Fatal(err)
@@ -257,7 +261,7 @@ func TestHeader_SetBytes(t *testing.T) {
 func TestConnectionClose(t *testing.T) {
 	t.Run("HTTP11_NoConnectionHeader", func(t *testing.T) {
 		full := "GET / HTTP/1.1\r\nHost: test\r\n\r\n"
-		var hdr HeaderV1
+		var hdr Header
 		hdr.ParseBytes(false, []byte(full))
 		if hdr.ConnectionClose() {
 			t.Error("HTTP/1.1 without Connection:close should not close")
@@ -266,7 +270,7 @@ func TestConnectionClose(t *testing.T) {
 
 	t.Run("ExplicitClose", func(t *testing.T) {
 		full := "GET / HTTP/1.1\r\nConnection: close\r\nHost: test\r\n\r\n"
-		var hdr HeaderV1
+		var hdr Header
 		hdr.ParseBytes(false, []byte(full))
 		if !hdr.ConnectionClose() {
 			t.Error("Connection:close header should trigger close")
@@ -275,7 +279,7 @@ func TestConnectionClose(t *testing.T) {
 
 	t.Run("HTTP10_NoKeepAlive", func(t *testing.T) {
 		full := "GET / HTTP/1.0\r\nHost: test\r\n\r\n"
-		var hdr HeaderV1
+		var hdr Header
 		hdr.ParseBytes(false, []byte(full))
 		if !hdr.ConnectionClose() {
 			t.Error("HTTP/1.0 without keep-alive should close")
@@ -284,7 +288,7 @@ func TestConnectionClose(t *testing.T) {
 
 	t.Run("HTTP10_KeepAlive", func(t *testing.T) {
 		full := "GET / HTTP/1.0\r\nConnection: keep-alive\r\nHost: test\r\n\r\n"
-		var hdr HeaderV1
+		var hdr Header
 		hdr.ParseBytes(false, []byte(full))
 		if hdr.ConnectionClose() {
 			t.Error("HTTP/1.0 with keep-alive should not close")
@@ -294,7 +298,7 @@ func TestConnectionClose(t *testing.T) {
 
 func TestTryParse_AlreadyParsed(t *testing.T) {
 	full := "GET / HTTP/1.1\r\nHost: test\r\n\r\n"
-	var hdr HeaderV1
+	var hdr Header
 	hdr.ParseBytes(false, []byte(full))
 
 	// Calling TryParse again should return error.
@@ -306,7 +310,7 @@ func TestTryParse_AlreadyParsed(t *testing.T) {
 
 func TestParseResponse_BadStatusCode(t *testing.T) {
 	full := "HTTP/1.1 abc Bad\r\n\r\n"
-	var hdr HeaderV1
+	var hdr Header
 	err := hdr.ParseBytes(true, []byte(full))
 	if err == nil {
 		t.Fatal("expected error for non-numeric status code")
@@ -328,14 +332,6 @@ func TestCookie_ParseBytes(t *testing.T) {
 	if string(c.Get("Path")) != "/" {
 		t.Errorf("Path = %q; want /", c.Get("Path"))
 	}
-	// The first pair sits at buffer offset 0, which a presence check keyed on
-	// the offset rather than the length reads as absent.
-	if string(c.Get("session")) != "abc123" {
-		t.Errorf("Get(session) = %q; want abc123", c.Get("session"))
-	}
-	if !c.HasKeyOrSingleValue("session") {
-		t.Error("expected first pair to be present by key")
-	}
 	if !c.HasKeyOrSingleValue("Secure") {
 		t.Error("expected Secure flag")
 	}
@@ -361,10 +357,13 @@ func TestCookie_ForEach(t *testing.T) {
 	c.ParseBytes([]byte("a=1; b=2; c=3"))
 
 	var keys []string
-	c.ForEach(func(key, value []byte) bool {
+	err := c.ForEach(func(key, value []byte) error {
 		keys = append(keys, string(key))
-		return true
+		return nil
 	})
+	if err != nil {
+		t.Fatal(err)
+	}
 	if len(keys) != 3 {
 		t.Fatalf("expected 3 cookie entries, got %d", len(keys))
 	}
@@ -373,7 +372,7 @@ func TestCookie_ForEach(t *testing.T) {
 func TestHeader_MultilineValue(t *testing.T) {
 	// RFC 7230: obsolete line folding with \r\n followed by space/tab.
 	full := "GET / HTTP/1.1\r\nX-Multi: line1\r\n\tline2\r\nHost: test\r\n\r\n"
-	var hdr HeaderV1
+	var hdr Header
 	err := hdr.ParseBytes(false, []byte(full))
 	if err != nil {
 		t.Fatal(err)
@@ -389,8 +388,8 @@ func TestHeader_MultilineValue(t *testing.T) {
 }
 
 func TestHeader_ResponseRoundTrip(t *testing.T) {
-	var hdr HeaderV1
-	hdr.Reset(make([]byte, 0, 256), defaultKVCap)
+	var hdr Header
+	hdr.Reset(make([]byte, 0, 256))
 	hdr.SetProtocol("HTTP/1.1")
 	hdr.SetStatus("404", "Not Found")
 	hdr.Add("Content-Type", "text/plain")
@@ -414,7 +413,7 @@ func TestHeader_ResponseRoundTrip(t *testing.T) {
 	}
 
 	// Parse back the generated response.
-	var hdr2 HeaderV1
+	var hdr2 Header
 	err = hdr2.ParseBytes(true, buf)
 	if err != nil {
 		t.Fatalf("re-parse response: %v", err)
@@ -429,11 +428,11 @@ func TestHeader_ResponseRoundTrip(t *testing.T) {
 }
 
 func TestHeader_RequestRoundTrip(t *testing.T) {
-	var hdr HeaderV1
-	hdr.Reset(make([]byte, 0, 256), defaultKVCap)
+	var hdr Header
+	hdr.Reset(make([]byte, 0, 256))
 	hdr.SetProtocol("HTTP/1.1")
 	hdr.SetMethod("POST")
-	hdr.SetRequestTarget("/api/data")
+	hdr.SetRequestURI("/api/data")
 	hdr.Add("Host", "example.com")
 	hdr.Add("Content-Type", "application/json")
 
@@ -447,7 +446,7 @@ func TestHeader_RequestRoundTrip(t *testing.T) {
 	}
 
 	// Parse back the generated request.
-	var hdr2 HeaderV1
+	var hdr2 Header
 	err = hdr2.ParseBytes(false, buf)
 	if err != nil {
 		t.Fatalf("re-parse request: %v", err)
@@ -455,8 +454,8 @@ func TestHeader_RequestRoundTrip(t *testing.T) {
 	if string(hdr2.Method()) != "POST" {
 		t.Errorf("re-parsed method = %q; want POST", hdr2.Method())
 	}
-	if string(hdr2.RequestTarget()) != "/api/data" {
-		t.Errorf("re-parsed URI = %q; want /api/data", hdr2.RequestTarget())
+	if string(hdr2.RequestURI()) != "/api/data" {
+		t.Errorf("re-parsed URI = %q; want /api/data", hdr2.RequestURI())
 	}
 	if string(hdr2.Get("Host")) != "example.com" {
 		t.Errorf("re-parsed Host = %q; want example.com", hdr2.Get("Host"))
@@ -466,7 +465,7 @@ func TestHeader_RequestRoundTrip(t *testing.T) {
 func TestParseResponse_StatusCodeOnly(t *testing.T) {
 	// Response with status code but no status text.
 	full := "HTTP/1.1 204\r\n\r\n"
-	var hdr HeaderV1
+	var hdr Header
 	err := hdr.ParseBytes(true, []byte(full))
 	if err != nil {
 		t.Fatal(err)
@@ -480,7 +479,7 @@ func TestParseResponse_StatusCodeOnly(t *testing.T) {
 
 func TestParseResponse_HTTP10(t *testing.T) {
 	full := "HTTP/1.0 200 OK\r\nServer: old\r\n\r\n"
-	var hdr HeaderV1
+	var hdr Header
 	err := hdr.ParseBytes(true, []byte(full))
 	if err != nil {
 		t.Fatal(err)
@@ -495,23 +494,19 @@ func TestParseResponse_HTTP10(t *testing.T) {
 }
 
 func TestParseRequest_NoProtocol(t *testing.T) {
-	// HTTP/0.9 style: just method and URI, no version. Refused, but the
-	// request-line it did read stays readable so a caller can answer 400 and say
-	// what it saw.
+	// HTTP/0.9 style: just method and URI, no version.
 	full := "GET /simple\r\nHost: test\r\n\r\n"
-	var hdr HeaderV1
+	var hdr Header
 	err := hdr.ParseBytes(false, []byte(full))
-	if !errors.Is(err, lneto.ErrUnsupported) {
-		t.Fatalf("want lneto.ErrUnsupported for a version-less request, got %v", err)
+	if err != nil {
+		t.Fatal(err)
 	}
 	if string(hdr.Method()) != "GET" {
 		t.Errorf("method = %q; want GET", hdr.Method())
 	}
-	if string(hdr.RequestTarget()) != "/simple" {
-		t.Errorf("URI = %q; want /simple", hdr.RequestTarget())
+	if string(hdr.RequestURI()) != "/simple" {
+		t.Errorf("URI = %q; want /simple", hdr.RequestURI())
 	}
-	// An empty protocol is what tells HTTP/0.9 apart from a named version, which
-	// is how [httphi] picks 400 over 505.
 	if hdr.Protocol() != nil {
 		t.Errorf("protocol should be nil for version-less request, got %q", hdr.Protocol())
 	}
@@ -528,7 +523,7 @@ func TestCookie_QuotedValue(t *testing.T) {
 func TestParseRequest_InvalidHeaderSpaceBeforeColon(t *testing.T) {
 	// RFC 7230 §3.2.4: No whitespace allowed between header name and colon.
 	full := "GET / HTTP/1.1\r\nBad Header : value\r\n\r\n"
-	var hdr HeaderV1
+	var hdr Header
 	err := hdr.ParseBytes(false, []byte(full))
 	if err == nil {
 		t.Fatal("expected error for space before colon in header name")
@@ -544,104 +539,3 @@ func splitInto(s string, n int) []string {
 	}
 	return chunks
 }
-
-// Connection is a case-insensitive list of case-insensitive tokens, RFC 9110
-// 7.6.1, and its field name folds like any other, RFC 9110 5.1. Missing a close
-// token keeps serving a peer that asked to hang up; missing keep-alive hangs up
-// on an HTTP/1.0 peer that asked to stay.
-func TestConnectionCloseFolded(t *testing.T) {
-	for _, test := range []struct {
-		proto     string
-		field     string
-		wantClose bool
-	}{
-		{proto: "HTTP/1.1", field: "Connection: close", wantClose: true},
-		{proto: "HTTP/1.1", field: "connection: close", wantClose: true},
-		{proto: "HTTP/1.1", field: "CONNECTION: close", wantClose: true},
-		{proto: "HTTP/1.1", field: "Connection: Close", wantClose: true},
-		{proto: "HTTP/1.1", field: "Connection: CLOSE", wantClose: true},
-		{proto: "HTTP/1.1", field: "Connection: keep-alive, close", wantClose: true},
-		{proto: "HTTP/1.1", field: "Connection: close, keep-alive", wantClose: true},
-		{proto: "HTTP/1.1", field: "Connection: TE, Close", wantClose: true},
-		// A token that merely contains "close" is not the close token.
-		{proto: "HTTP/1.1", field: "Connection: closed", wantClose: false},
-		{proto: "HTTP/1.1", field: "Connection: keep-alive", wantClose: false},
-		// HTTP/1.0 closes unless the peer asks to keep the connection.
-		{proto: "HTTP/1.0", field: "Connection: keep-alive", wantClose: false},
-		{proto: "HTTP/1.0", field: "connection: keep-alive", wantClose: false},
-		{proto: "HTTP/1.0", field: "Connection: Keep-Alive", wantClose: false},
-		{proto: "HTTP/1.0", field: "Connection: TE, keep-alive", wantClose: false},
-		{proto: "HTTP/1.0", field: "Host: h", wantClose: true},
-	} {
-		t.Run(test.proto+" "+test.field, func(t *testing.T) {
-			var hdr HeaderV1
-			full := "GET / " + test.proto + "\r\nHost: h\r\n" + test.field + "\r\n\r\n"
-			if err := hdr.ParseBytes(false, []byte(full)); err != nil {
-				t.Fatal(err)
-			}
-			if got := hdr.ConnectionClose(); got != test.wantClose {
-				t.Errorf("want ConnectionClose=%v, got %v", test.wantClose, got)
-			}
-		})
-	}
-}
-
-// HeaderV1 speaks HTTP/1.x and nothing else, so a request or response naming
-// another version is refused on the first line. That skips the field loop, which
-// is where nearly all the parse cost is, and refuses the h2c preface a modern
-// client opens with before it is mistaken for a request.
-func TestHeaderV1RejectsUnsupportedVersion(t *testing.T) {
-	for _, test := range []struct {
-		name       string
-		raw        string
-		asResponse bool
-	}{
-		{name: "request http2", raw: "GET / HTTP/2.0\r\nHost: h\r\n\r\n"},
-		{name: "request http3", raw: "GET / HTTP/3.0\r\nHost: h\r\n\r\n"},
-		{name: "h2c preface", raw: "PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n"},
-		{name: "request http09 no version", raw: "GET /index.html\r\nHost: h\r\n\r\n"},
-		{name: "request bogus proto", raw: "GET / BANANA\r\nHost: h\r\n\r\n"},
-		{name: "response http2", raw: "HTTP/2.0 200 OK\r\nServer: s\r\n\r\n", asResponse: true},
-		{name: "response http09", raw: "HTTP/0.9 200 OK\r\nServer: s\r\n\r\n", asResponse: true},
-	} {
-		t.Run(test.name, func(t *testing.T) {
-			var h HeaderV1
-			err := h.ParseBytes(test.asResponse, []byte(test.raw))
-			if !errors.Is(err, lneto.ErrUnsupported) {
-				t.Fatalf("want lneto.ErrUnsupported, got %v", err)
-			}
-			// The field loop must not have run: refusing early is the point.
-			fields := 0
-			h.ForEach(func(key, value []byte) bool { fields++; return true })
-			if fields != 0 {
-				t.Errorf("want no fields parsed, got %d", fields)
-			}
-			if h.ParsingSuccess() {
-				t.Error("a refused header must not report a successful parse")
-			}
-		})
-	}
-}
-
-// Both HTTP/1 versions stay supported: only non-1.x is refused.
-func TestHeaderV1AcceptsV1Versions(t *testing.T) {
-	for _, test := range []struct {
-		raw        string
-		asResponse bool
-	}{
-		{raw: "GET / HTTP/1.1\r\nHost: h\r\n\r\n"},
-		{raw: "GET / HTTP/1.0\r\nHost: h\r\n\r\n"},
-		{raw: "HTTP/1.1 200 OK\r\nServer: s\r\n\r\n", asResponse: true},
-		{raw: "HTTP/1.0 200 OK\r\nServer: s\r\n\r\n", asResponse: true},
-	} {
-		t.Run(test.raw[:12], func(t *testing.T) {
-			var h HeaderV1
-			if err := h.ParseBytes(test.asResponse, []byte(test.raw)); err != nil {
-				t.Fatalf("want parsed, got %v", err)
-			}
-			if !h.ParsingSuccess() {
-				t.Error("want a successful parse")
-			}
-		})
-	}
-}

http/httpraw/parsev1.go

@@ -1,385 +0,0 @@
-package httpraw
-
-import (
-	"bytes"
-	"errors"
-
-	"github.com/soypat/lneto"
-	"github.com/soypat/lneto/internal"
-)
-
-var (
-	errNoProto = errors.New("missing protocol, HTTP/0.9 unsupported")
-	// ErrNeedMoreData signals a parser was handed an incomplete buffer: append
-	// more data to it and call again.
-	ErrNeedMoreData = errors.New("need more data: cannot find trailing lf/delimiter")
-	errNoBoundary   = errors.New("httpraw: multipart boundary not set")
-	errUnparsed     = errors.New("need to finish parsing")
-	errInvalidName  = errors.New("invalid header name")
-	// ErrBufferExhausted signals a buffer with no room left for the data being
-	// written and no permission to grow, see [KVBuffer.EnableBufferGrowth].
-	// Enlarging the buffer handed to Reset is the only fix; a server answers it
-	// on a request header with 431, RFC 6585 5.
-	ErrBufferExhausted = errors.New("httpraw: buffer exhausted, increase size")
-	// ErrHeaderTooMany signals a header block carrying more fields than
-	// the buffer it is parsed into has room for, see [Header.Reset]. A server
-	// answers it with 431, RFC 6585 5: no larger buffer is coming, so reading
-	// the rest of the block would only spend memory on a request already lost.
-	ErrHeaderTooMany = errors.New("httpraw: more header fields than buffer holds")
-	// Header.Set and Header.Add mangles the buffer.
-	// Call them after retrieving the Body. Do not call them before parsing the header (why would you even do that?).
-	errMangledBuffer    = errors.New("httpraw: mangled buffer")
-	errNoCookies        = errors.New("no cookie found")
-	errEmptyURI         = errors.New("empty URI")
-	errLongStatusCode   = errors.New("long status code")
-	errBadStatusCode    = errors.New("invalid status code")
-	errAlreadyParsed    = errors.New("TryParse called after header parsed")
-	errNeedMethodURI    = errors.New("need method/request URI to create request header")
-	errBadStatusCodeTxt = errors.New("invalid status code or text")
-	errCookiesParsed    = errors.New("cookies already parsed, reset before parsing again")
-	errBufferTooLarge   = errors.New("httpraw: buffer exceeds max size (offsets are uint16)")
-	errBadPercentEncode = errors.New("httpraw: invalid percent-encoding in URL")
-	errBadDelimiter     = errors.New("httpraw: junk between multipart delimiter and part")
-	errNoContentLength  = errors.New("httpraw: no Content-Length field")
-	errBadContentLength = errors.New("httpraw: invalid Content-Length value")
-)
-
-// maxBufLen bounds the header buffer. Offsets/lengths are stored as uint16
-// (tokint); a buffer past this would truncate/overflow those, silently
-// returning the wrong bytes or panicking on a wrapped slice bound.
-const maxBufLen = 0xffff
-
-func protoIsV1(s string) bool {
-	return s[:min(len(strHTTP1), len(s))] == strHTTP1
-}
-
-type headerv1Buf struct {
-	kv kvBuffer
-	// buf[:len] holds entire HTTP header data, which may be normalized by [flags]. buf[off:len] holds data not yet processed during parsing.
-	// buf []byte
-	// offset into buf for parsing.
-	off int
-	// args contains key-value store.
-	// headers []argsKV
-}
-
-// reset sets the buffer data and discards all parsed data. The field table is
-// grown to match the new buffer's capacity and never shrinks, so a header
-// reused across requests settles on its largest buffer and stops allocating.
-func (h *headerv1Buf) reset(buf []byte, numHeaderCapacity int) {
-	h.kv.Reset(buf, numHeaderCapacity)
-	h.off = 0
-}
-
-type scannerState struct {
-	err error
-
-	// by checking whether the next line contains a colon or not to tell
-	// it's a header entry or a multi line value of current header entry.
-	// the side effect of this operation is that we know the index of the
-	// next colon and new line, so this can be used during next iteration,
-	// instead of find them again.
-	nextColon   int
-	nextNewLine int
-
-	initialized bool
-}
-
-func (h *HeaderV1) parse(asResponse bool) (err error) {
-	debuglog("http:firstline:start")
-	err = h.parseFirstLine(asResponse)
-	if err != nil {
-		debuglog("http:firstline:err")
-		return err
-	}
-	debuglog("http:firstline:done")
-	err = h.parseNextHeaders(h.Flags())
-	debuglog("http:headers:done")
-	return err
-}
-
-func (h *HeaderV1) parseFirstLine(asResponse bool) (err error) {
-	if len(h.hbuf.kv.buf) > maxBufLen {
-		return errBufferTooLarge // Offsets would overflow uint16 tokint.
-	}
-	flags := h.Flags()
-	if asResponse {
-		h.statusCode, h.statusText, flags, err = h.hbuf.parseFirstLineResponse(flags)
-	} else {
-		h.method, h.requestTarget, h.proto, flags, err = h.hbuf.parseFirstLineRequest(flags)
-	}
-	h.hbuf.kv.flags = flags
-	return err
-}
-
-func (h *HeaderV1) parseNextHeaders(flags Flags) error {
-	var ss scannerState
-	h.hbuf.parseNextHeaders(&ss, flags)
-	if ss.err != nil {
-		h.hbuf.kv.flags |= flagConnClose
-		return ss.err
-	}
-	h.hbuf.kv.flags |= flagDoneParsingHeader
-	return nil
-}
-
-func (hb *headerv1Buf) free() int { return hb.kv.free() }
-
-func (hb *headerv1Buf) parseNextHeaders(ss *scannerState, flags Flags) {
-	debuglog("http:nexthdr:loop")
-	for kv := hb.next(ss); kv.isValidHeader(); kv = hb.next(ss) {
-		if !hb.kv.canAddOneKV() {
-			ss.err = ErrHeaderTooMany
-			return
-		}
-		hb.kv.kvs = append(hb.kv.kvs, kv)
-	}
-	debuglog("http:nexthdr:done")
-}
-
-func (hb *headerv1Buf) offBuf() []byte {
-	return hb.kv.buf[hb.off:]
-}
-
-func (hb *headerv1Buf) skipLeadingCRLF() {
-	for hb.off < len(hb.kv.buf) && (hb.kv.buf[hb.off] == '\n' || hb.kv.buf[hb.off] == '\r') {
-		hb.off++
-	}
-}
-
-func (hb *headerv1Buf) scanLine() []byte {
-	buf := hb.scanUntilByte('\n')
-	if len(buf) > 0 && buf[len(buf)-1] == '\r' {
-		buf = buf[:len(buf)-1] // exclude carriage return.
-	}
-	if hb.off < len(hb.kv.buf) {
-		hb.off++ // consume newline.
-	}
-	return buf
-}
-
-func (hb *headerv1Buf) scanUntilByte(c byte) []byte {
-	buf := hb.offBuf()
-	idx := bytes.IndexByte(buf, c)
-	if idx >= 0 {
-		buf = buf[:idx]
-	}
-	hb.off += len(buf)
-	return buf
-}
-
-func (hb *headerv1Buf) parseFirstLineRequest(initFlags Flags) (method, uri, proto view, flags Flags, err error) {
-	debuglog("http:req:scan")
-	hb.off = 0 // Parsing first line resets offset.
-	hb.skipLeadingCRLF()
-	flags = initFlags
-	if bytes.IndexByte(hb.offBuf(), '\n') < 0 {
-		return method, uri, proto, flags, ErrNeedMoreData // Incomplete line.
-	}
-	b := hb.scanLine()
-	if len(b) < 5 {
-		return method, uri, proto, flags, ErrNeedMoreData
-	}
-	debuglog("http:req:parse")
-
-	methodEnd := max(0, bytes.IndexByte(b, ' '))
-	reqURIEnd := bytes.IndexByte(b[methodEnd+1:], ' ')
-	if reqURIEnd > 0 {
-		reqURIEnd += methodEnd + 1
-		uri = hb.kv.view(b[methodEnd+1 : reqURIEnd])
-		proto = hb.kv.view(b[reqURIEnd+1:]) // Skip space before protocol.
-		protoText := b2s(b[reqURIEnd+1:])
-		if !protoIsV1(protoText) {
-			// Refused here rather than after the fields: the field loop is nearly
-			// all of the parse cost and none of it serves a version this type
-			// does not speak. proto is set so the caller can name it, i.e: 505.
-			method = hb.kv.view(b[:methodEnd])
-			return method, uri, proto, flags | flagNoHTTP11, lneto.ErrUnsupported
-		} else if protoText != strHTTP11 {
-			flags |= flagNoHTTP11 // HTTP/1.0, which defaults to closing the connection.
-		}
-	} else if reqURIEnd == 0 {
-		return method, uri, proto, flags, errEmptyURI
-	} else {
-		// No version at all is a HTTP/0.9 simple-request, not a 1.x request-line,
-		// RFC 9112 3. proto stays empty, telling it apart from a named version.
-		uri = hb.kv.view(b[methodEnd+1:])
-		method = hb.kv.view(b[:methodEnd])
-		return method, uri, proto, flags | flagNoHTTP11, lneto.ErrUnsupported
-	}
-	method = hb.kv.view(b[:methodEnd])
-	return method, uri, proto, flags, nil
-}
-
-func (hb *headerv1Buf) parseFirstLineResponse(initFlags Flags) (statusCode, statusText view, flags Flags, err error) {
-	debuglog("http:resp:scan")
-	hb.off = 0 // Parsing first line resets offset.
-	hb.skipLeadingCRLF()
-	flags = initFlags
-	if bytes.IndexByte(hb.offBuf(), '\n') < 0 {
-		return statusCode, statusText, flags, ErrNeedMoreData // Incomplete line.
-	}
-	b := hb.scanLine()
-	if len(b) < 5 {
-		return statusCode, statusText, flags, ErrNeedMoreData
-	}
-	debuglog("http:resp:parse")
-
-	// Parse protocol (e.g. "HTTP/1.1"), then status code, then status text.
-	protoEnd := bytes.IndexByte(b, ' ')
-	if protoEnd < 0 {
-		return statusCode, statusText, flags, ErrNeedMoreData
-	}
-	if !protoIsV1(b2s(b[:protoEnd])) {
-		// Refused before the fields, as on the request side: a response naming
-		// another version is not one this type can read.
-		return statusCode, statusText, flags | flagNoHTTP11, lneto.ErrUnsupported
-	} else if b2s(b[:protoEnd]) != strHTTP11 {
-		flags |= flagNoHTTP11
-	}
-	b = b[protoEnd+1:] // Advance past protocol and space.
-
-	codeEnd := bytes.IndexByte(b, ' ')
-	if codeEnd < 0 {
-		codeEnd = len(b) // Status text is optional.
-	}
-	code := b[:codeEnd]
-	if len(code) > 3 {
-		return statusCode, statusText, flags, errLongStatusCode
-	}
-	for i := range code {
-		if code[i] > '9' || code[i] < '0' {
-			debuglog("http:resp:invalid-code")
-			return statusCode, statusText, flags, errBadStatusCode
-		}
-	}
-	statusCode = hb.kv.view(code)
-	if codeEnd < len(b) {
-		statusText = hb.kv.view(b[codeEnd+1:]) // Skip space before text.
-	}
-	debuglog("http:resp:done")
-	return statusCode, statusText, flags, nil
-}
-
-func (hb *headerv1Buf) next(ss *scannerState) pairKV {
-	if !ss.initialized {
-		ss.nextColon = -1
-		ss.nextNewLine = -1
-	}
-	buf := hb.kv.buf[hb.off:]
-	blen := len(buf)
-	if blen >= 2 && buf[0] == '\r' && buf[1] == '\n' {
-		hb.off += 2
-		return hb.kv.noKV() // \r\n\r\n Ends header.
-	} else if blen >= 1 && buf[0] == '\n' {
-		hb.off += 1
-		return hb.kv.noKV() // \n\n Ends header.
-	}
-
-	// n is parsing offset. Will start by storing colon index.
-	n := 0
-	if ss.nextColon >= 0 {
-		// Retake from last colon found.
-		n = ss.nextColon
-		ss.nextColon = -1
-	} else {
-		n = bytes.IndexByte(buf, ':')
-		x := bytes.IndexByte(buf, '\n')
-		if x < 0 {
-			// A header name should always at some point be followed by a \n
-			// even if it's the one that terminates the header block.
-			ss.err = ErrNeedMoreData
-			return hb.kv.noKV()
-		} else if x < n {
-			// There was a \n before the colon! This is invalid.
-			ss.err = errInvalidName
-			return hb.kv.noKV()
-		} else if n < 0 {
-			// A newline is present (x>=0 reached here) but the line has no
-			// colon: malformed, not incomplete. A split arriving before the
-			// colon has no newline yet and is caught by the x<0 branch above,
-			// so it still returns ErrNeedMoreData.
-			ss.err = errInvalidName
-			return hb.kv.noKV()
-		}
-	}
-	// n stores colon position by now.
-	if bytes.IndexByte(buf[:n], ' ') >= 0 || bytes.IndexByte(buf[:n], '\t') >= 0 {
-		// Spaces between the header key and colon are not allowed.
-		// See RFC 7230, Section 3.2.4.
-		ss.err = errInvalidName
-		return hb.kv.noKV()
-	}
-
-	// Ready to store key..
-	var resultKV pairKV
-	resultKV.key = hb.kv.view(buf[:n])
-	n++ // consume colon.
-	for len(buf) > n && buf[n] == ' ' {
-		n++ // Trim leading spaces.
-	}
-	// n now points to start of value.
-	valueStart := n
-
-	// Find end of value. Values may be multiline, in which case we must treat newlines followed by whitespace as part of the value.
-	for {
-		nl := bytes.IndexByte(buf[n:], '\n')
-		if nl < 0 || nl+n+1 == len(buf) {
-			// No newline or newline is last character and can't know if is multiline.
-			ss.err = ErrNeedMoreData
-			return hb.kv.noKV()
-		}
-		n += nl + 1 // Index of the newly found newline.
-		nextChar := buf[n]
-		if nextChar != ' ' && nextChar != '\t' {
-			break // End of value found.
-		}
-	}
-
-	valueEnd := n - 1 // Trim newline.
-	if valueEnd > valueStart && buf[valueEnd-1] == '\r' {
-		valueEnd-- // Trim \r character if present before value.
-	}
-	resultKV.value = hb.kv.view(buf[valueStart:valueEnd])
-	hb.off += n
-	return resultKV
-}
-
-// ConnectionClose returns true if 'Connection: close' header is set or if a invalid header was found.
-func (h *HeaderV1) ConnectionClose() bool {
-	flags := h.Flags()
-	closed := flags.HasAny(flagConnClose) ||
-		h.hasConnectionToken(strClose) ||
-		(flags.HasAny(flagNoHTTP11) && !h.hasConnectionToken(strKeepAlive))
-	if closed {
-		h.hbuf.kv.flags |= flagConnClose
-	}
-	return closed
-}
-
-// hasConnectionToken reports whether the Connection field lists token, which
-// must be lowercase. The field name, its comma list and each token all compare
-// case insensitively, RFC 9110 5.1 and 7.6.1.
-func (h *HeaderV1) hasConnectionToken(token string) bool {
-	value := h.GetFold(headerConnection)
-	for len(value) > 0 {
-		item := value
-		if comma := bytes.IndexByte(value, ','); comma >= 0 {
-			item, value = value[:comma], value[comma+1:]
-		} else {
-			value = nil
-		}
-		if equalFold(trimOWS(item), token) {
-			return true
-		}
-	}
-	return false
-}
-
-const enableDebug = internal.HeapAllocDebugging
-
-func debuglog(msg string) {
-	if enableDebug {
-		internal.LogAllocs(msg)
-	}
-}

internal/strconv.go

@@ -1,19 +0,0 @@
-package internal
-
-// IntLen returns the number of bytes [strconv.AppendInt] emits for value in the
-// given base, including a leading minus sign for negatives. Lets callers size a
-// buffer, or test whether a value fits an existing slot, before writing a byte.
-// base must be in the range 2..36, as accepted by [strconv.AppendInt].
-func IntLen(value int64, base int) int {
-	n := 1
-	u := uint64(value)
-	if value < 0 {
-		n++    // Leading minus sign.
-		u = -u // Two's-complement magnitude; correct even for math.MinInt64.
-	}
-	for u >= uint64(base) {
-		u /= uint64(base)
-		n++
-	}
-	return n
-}

internet/pcap/capture.go

@@ -35,7 +35,7 @@ var (
 )
 
 type PacketBreakdown struct {
-	hdr  httpraw.HeaderV1
+	hdr  httpraw.Header
 	dmsg dns.Message
 	vld  lneto.Validator
 	// SubfieldLimit will limit the number of captured subfields to the value it has.
@@ -52,11 +52,12 @@ type PacketBreakdown struct {
 //	0: Ethernet (3 base + VLAN tag = 4)
 //	1: L3 max(IPv4=12, ARP=9, IPv6=8) = 12
 //	2: L4 max(TCP=10, ICMP=8, UDP=4) = 10
-//	3: App max(DHCP=15, NTP=13, HTTP=2, DNS=1) = 16
-//	4-5: overflow/remaining = 2
+//	3: App max(DHCP=15, NTP=13, HTTP=2, DNS=1, TLS record=4) = 16
+//	4: TLS handshake message (ClientHello=8) = 8
+//	5-7: extra TLS records/overflow/remaining = 4,2,2
 func (pc *PacketBreakdown) initFrames() []Frame {
-	const nframes = 6
-	var fieldCaps = [nframes]int{4, 12, 10, 16, 2, 2}
+	const nframes = 8
+	var fieldCaps = [nframes]int{4, 12, 10, 16, 8, 4, 2, 2}
 	frames := make([]Frame, nframes)
 	for i := range frames {
 		frames[i].Fields = make([]FrameField, 0, fieldCaps[i])
@@ -328,9 +329,18 @@ func (pc *PacketBreakdown) CaptureTCP(dst []Frame, pkt []byte, bitOffset int) ([
 	}
 	payload := tfrm.Payload()
 	if len(payload) > 0 {
-		debuglog("pcap:tcp:http-start")
-		dst, err = pc.CaptureHTTP(dst, pkt, end)
-		debuglog("pcap:tcp:http-done")
+		// Application protocol is picked by inspecting the payload rather than
+		// by port, so that TLS on a port other than 443 and HTTP on a port
+		// other than 80 are both broken down correctly.
+		if payloadIsTLS(payload) {
+			debuglog("pcap:tcp:tls-start")
+			dst, err = pc.CaptureTLS(dst, pkt, end)
+			debuglog("pcap:tcp:tls-done")
+		} else {
+			debuglog("pcap:tcp:http-start")
+			dst, err = pc.CaptureHTTP(dst, pkt, end)
+			debuglog("pcap:tcp:http-done")
+		}
 		if err != nil {
 			reclaimRemainingFrame(&dst, unknownPayloadProto, FieldClassPayload, end, octet*len(pkt))
 		}
@@ -768,11 +778,6 @@ func httpBodyClass(contentType, body []byte) FieldClass {
 	return FieldClassText
 }
 
-// maxCapturedHeaderFields bounds the field table a captured HTTP header is
-// parsed into. Captures are read once and discarded, so the table is sized for
-// a realistic request rather than for whatever the capture happens to hold.
-const maxCapturedHeaderFields = 64
-
 func (pc *PacketBreakdown) CaptureHTTP(dst []Frame, pkt []byte, bitOffset int) ([]Frame, error) {
 	debuglog("pcap:http:start")
 	const httpProtocol = "HTTP"
@@ -782,10 +787,10 @@ func (pc *PacketBreakdown) CaptureHTTP(dst []Frame, pkt []byte, bitOffset int) (
 	const asResponse = true
 	const asRequest = false
 	httpData := pkt[bitOffset/8:]
-	pc.hdr.Reset(httpData, maxCapturedHeaderFields)
+	pc.hdr.Reset(httpData)
 	err := pc.hdr.Parse(asResponse)
 	if err != nil {
-		pc.hdr.Reset(httpData, 0)     // Field table already sized, reuse it.
+		pc.hdr.Reset(httpData)
 		err = pc.hdr.Parse(asRequest) // try as request.
 	}
 	if err != nil {
@@ -840,10 +845,13 @@ const (
 	// FlagContainer is used for [FrameField]s whose SubFields represent
 	// the entirety of the FrameField's data. i.e: DNS Questions/Answers.
 	FlagContainer
+	// FlagEncrypted marks fields whose bytes are ciphertext. i.e: TLS application_data fragment.
+	FlagEncrypted
 )
 
 func (ff Flags) IsLegacy() bool       { return ff&FlagLegacy != 0 }
 func (ff Flags) IsRightAligned() bool { return ff&FlagRightAligned != 0 }
+func (ff Flags) IsEncrypted() bool    { return ff&FlagEncrypted != 0 }
 
 type Frame struct {
 	PacketBitOffset int
@@ -1014,6 +1022,9 @@ func (frm Frame) LenBits() (totalBitlen int) {
 
 func (ff FrameField) String() string {
 	if ff.Class == FieldClassPayload {
+		if ff.Flags.IsEncrypted() {
+			return "Encrypted len=" + strconv.Itoa(ff.BitLength/8)
+		}
 		return "Payload len=" + strconv.Itoa(ff.BitLength/8)
 	}
 	if ff.Name != "" {

internet/pcap/capture_bench_test.go

@@ -9,6 +9,7 @@ import (
 	"github.com/soypat/lneto/dns"
 	"github.com/soypat/lneto/ethernet"
 	"github.com/soypat/lneto/ipv4"
+	"github.com/soypat/lneto/tcp"
 	"github.com/soypat/lneto/udp"
 )
 
@@ -106,6 +107,39 @@ func buildDNSPacket(b testing.TB) []byte {
 	return pkt
 }
 
+// buildTLSPacket builds an Ethernet+IPv4+TCP packet carrying a real
+// ClientHello record, exercising the string-heavy TLS path: cipher suite and
+// extension subfields, SNI and ALPN text.
+func buildTLSPacket(b testing.TB) []byte {
+	const (
+		ethSize  = 14
+		ipv4Size = 20
+		tcpSize  = 20
+	)
+	hello := captureClientHelloRecord(b, "example.com", []string{"h2", "http/1.1"})
+	pkt := make([]byte, ethSize+ipv4Size+tcpSize+len(hello))
+
+	efrm, _ := ethernet.NewFrame(pkt)
+	*efrm.DestinationHardwareAddr() = [6]byte{0xde, 0xad, 0xbe, 0xef, 0xca, 0xfe}
+	*efrm.SourceHardwareAddr() = [6]byte{0xff, 0xff, 0xff, 0xff, 0xff, 0xff}
+	efrm.SetEtherType(ethernet.TypeIPv4)
+
+	ifrm, _ := ipv4.NewFrame(pkt[ethSize:])
+	ifrm.SetVersionAndIHL(4, 5)
+	ifrm.SetID(0x1234)
+	ifrm.SetTTL(64)
+	ifrm.SetProtocol(lneto.IPProtoTCP)
+	ifrm.SetTotalLength(uint16(ipv4Size + tcpSize + len(hello)))
+
+	tfrm, _ := tcp.NewFrame(pkt[ethSize+ipv4Size:])
+	tfrm.SetSourcePort(51000)
+	tfrm.SetDestinationPort(443)
+	tfrm.SetOffsetAndFlags(5, tcp.FlagPSH|tcp.FlagACK)
+
+	copy(pkt[ethSize+ipv4Size+tcpSize:], hello)
+	return pkt
+}
+
 func configureBenchFormatter(f *Formatter) {
 	f.SubfieldLimit = benchSubfieldLimit
 	f.FrameSep = "\n"
@@ -123,6 +157,7 @@ func BenchmarkPcap(b *testing.B) {
 	}{
 		{"DHCP", buildDHCPPacket(b)},
 		{"DNS", buildDNSPacket(b)},
+		{"TLS", buildTLSPacket(b)},
 	}
 	for _, tc := range cases {
 		b.Run(tc.name, func(b *testing.B) {
@@ -182,6 +217,7 @@ func BenchmarkPcapPhases(b *testing.B) {
 	}{
 		{"DHCP", buildDHCPPacket(b)},
 		{"DNS", buildDNSPacket(b)},
+		{"TLS", buildTLSPacket(b)},
 	}
 	for _, tc := range cases {
 		b.Run(tc.name, func(b *testing.B) {

internet/pcap/capture_test.go

@@ -23,7 +23,7 @@ import (
 const httpProtocol = "HTTP/1.1"
 
 func makeHttpPayload(body string) ([]byte, error) {
-	var hdr httpraw.HeaderV1
+	var hdr httpraw.Header
 	hdr.SetProtocol(httpProtocol)
 	hdr.SetStatus("200", "OK")
 	hdr.Set("Cookie", "ABC=123")

internet/pcap/capture_tls.go

@@ -0,0 +1,461 @@
+package pcap
+
+import (
+	"encoding/binary"
+
+	"github.com/soypat/lneto"
+	"github.com/soypat/lneto/internal"
+	"github.com/soypat/lneto/x/tls"
+)
+
+// maxTLSRecordsPerPacket bounds how many record frames a single packet may
+// produce. A TCP segment commonly coalesces several small records, but without
+// a bound a segment full of 5-byte empty records would produce thousands of
+// frames.
+const maxTLSRecordsPerPacket = 8
+
+// payloadIsTLS reports whether payload begins with what could be a TLS record
+// header. TLS has no magic number, so this is a heuristic: the content type
+// must be one of the four TLS 1.3 defines, the legacy record version must be
+// 0x03xx and the declared fragment length must be legal.
+//
+// It is what lets TLS be captured on any port instead of only on 443, and it
+// does not collide with HTTP, whose first byte is a method or version letter
+// and never a valid content type.
+func payloadIsTLS(payload []byte) bool {
+	if len(payload) < tls.SizeHeaderRecord {
+		return false
+	}
+	switch tls.ContentType(payload[0]) {
+	case tls.ContentTypeChangeCipherSpec, tls.ContentTypeAlert,
+		tls.ContentTypeHandshake, tls.ContentTypeApplicationData:
+	default:
+		return false
+	}
+	if payload[1] != 0x03 || payload[2] > 0x04 {
+		// Every record version in use is 3.x: TLS 1.0 through 1.3 inclusive.
+		return false
+	}
+	n := int(binary.BigEndian.Uint16(payload[3:5]))
+	return n > 0 && n <= tls.MaxCiphertext
+}
+
+// CaptureTLS breaks down the TLS records starting at bitOffset. A single entry
+// point handles every kind of TLS traffic: a record names its own content type,
+// so the caller does not need to know whether it is looking at a handshake, an
+// alert or application data, which is what makes capturing a whole port 443
+// conversation possible without tracking connection state.
+//
+// One [Frame] is produced per record, plus one more per cleartext handshake
+// message carried inside a handshake record. Everything after the ServerHello
+// is encrypted and appears on the wire as application_data; its fragment is
+// reported as an opaque payload, since decrypting it needs keys a capture does
+// not have.
+//
+// TLS is a byte stream: a record may span TCP segments and a handshake message
+// may span records. Whatever arrived is reported and the affected frame carries
+// [tls.ErrNeedMore]; reassembly is out of scope for a stateless breakdown.
+func (pc *PacketBreakdown) CaptureTLS(dst []Frame, pkt []byte, bitOffset int) ([]Frame, error) {
+	debuglog("pcap:tls:start")
+	if bitOffset%8 != 0 {
+		return dst, errNotByteAligned
+	}
+	off := bitOffset / 8
+	for nrec := 0; off < len(pkt); nrec++ {
+		if nrec == maxTLSRecordsPerPacket {
+			reclaimRemainingFrame(&dst, "TLS records?", FieldClassPayload, off*octet, octet*len(pkt))
+			break
+		}
+		newdst, consumed, err := pc.captureTLSRecord(dst, pkt, off*octet)
+		dst = newdst
+		if err != nil {
+			if nrec == 0 {
+				// Not TLS after all; let the caller frame the payload.
+				return dst, err
+			}
+			// Bytes trailing the last complete record that are too few or too
+			// malformed to be a record header of their own.
+			reclaimRemainingFrame(&dst, unknownPayloadProto, FieldClassPayload, off*octet, octet*len(pkt))
+			break
+		}
+		off += consumed
+	}
+	debuglog("pcap:tls:done")
+	return dst, nil
+}
+
+// captureTLSRecord appends the frames of the single record at bitOffset and
+// returns how many bytes of pkt the record occupied.
+func (pc *PacketBreakdown) captureTLSRecord(dst []Frame, pkt []byte, bitOffset int) ([]Frame, int, error) {
+	rec := pkt[bitOffset/8:]
+	rfrm, err := tls.NewRecordFrame(rec)
+	if err != nil {
+		return dst, 0, err
+	}
+	rfrm.ValidateSize(pc.validator())
+	if pc.validator().HasError() {
+		return dst, 0, pc.validator().ErrPop()
+	}
+	debuglog("pcap:tls:validated")
+	const fragOff = tls.SizeHeaderRecord * octet
+	ctype := rfrm.ContentType()
+	finfo := reclaimFrame(&dst, "TLS", bitOffset, baseTLSRecordFields[:])
+	finfo.Fields[0].Name = ctype.StringConst()
+	frag := rfrm.Payload()
+	if frag == nil {
+		// Fragment continues in a later segment. Report what arrived.
+		avail := len(rec) - tls.SizeHeaderRecord
+		finfo.Errors = append(finfo.Errors, tls.ErrNeedMore)
+		if avail > 0 {
+			var flags Flags
+			if ctype == tls.ContentTypeApplicationData {
+				flags = FlagEncrypted
+			}
+			finfo.Fields = append(finfo.Fields, FrameField{
+				Class:          FieldClassPayload,
+				FrameBitOffset: fragOff,
+				BitLength:      avail * octet,
+				Flags:          flags,
+			})
+		}
+		return dst, len(rec), nil
+	}
+
+	switch ctype {
+	case tls.ContentTypeHandshake:
+		// Handshake messages get frames of their own. finfo must not be touched
+		// past this point: appending to dst may move the Frame it points at.
+		dst = pc.captureTLSHandshake(dst, pkt, bitOffset+fragOff, len(frag))
+
+	case tls.ContentTypeAlert:
+		if len(frag) < 2 {
+			finfo.Errors = append(finfo.Errors, lneto.ErrTruncatedFrame)
+			break
+		}
+		// The level byte is advisory only: in TLS 1.3 every alert except
+		// close_notify and user_canceled is fatal whatever it says.
+		finfo.Fields = append(finfo.Fields, FrameField{
+			Name:           tls.AlertLevel(frag[0]).StringConst(),
+			Class:          FieldClassType,
+			FrameBitOffset: fragOff,
+			BitLength:      octet,
+			Flags:          FlagLegacy,
+		}, FrameField{
+			Name:           tls.AlertDescription(frag[1]).StringConst(),
+			Class:          FieldClassType,
+			FrameBitOffset: fragOff + octet,
+			BitLength:      octet,
+		})
+
+	case tls.ContentTypeApplicationData:
+		// Either genuine application data or a protected handshake or alert
+		// record; which of the three is only knowable after decryption.
+		finfo.Fields = append(finfo.Fields, FrameField{
+			Class:          FieldClassPayload,
+			FrameBitOffset: fragOff,
+			BitLength:      len(frag) * octet,
+			Flags:          FlagEncrypted,
+		})
+
+	default: // change_cipher_spec and unrecognized content types.
+		finfo.Fields = append(finfo.Fields, FrameField{
+			Class:          FieldClassPayload,
+			FrameBitOffset: fragOff,
+			BitLength:      len(frag) * octet,
+		})
+	}
+	return dst, rfrm.RecordLength(), nil
+}
+
+// captureTLSHandshake appends one frame per handshake message found in the
+// fragLen bytes of handshake record fragment starting at bitOffset.
+func (pc *PacketBreakdown) captureTLSHandshake(dst []Frame, pkt []byte, bitOffset, fragLen int) []Frame {
+	debuglog("pcap:tls:hs-start")
+	const hdr = tls.SizeHeaderHandshake
+	frag := pkt[bitOffset/8:][:fragLen]
+	fragEnd := bitOffset + fragLen*octet
+	for off := 0; off < fragLen; {
+		msgBitOff := bitOffset + off*octet
+		hfrm, err := tls.NewHandshakeFrame(frag[off:])
+		if err != nil {
+			// Fewer than 4 bytes left: a message header split across records.
+			reclaimRemainingFrame(&dst, "TLS Handshake?", FieldClassPayload, msgBitOff, fragEnd)
+			return dst
+		}
+		mtype := hfrm.MsgType()
+		finfo := reclaimFrame(&dst, tlsHandshakeProto(mtype), msgBitOff, baseTLSHandshakeFields[:])
+		finfo.Fields[0].Name = mtype.StringConst()
+		body := hfrm.Body()
+		if body == nil {
+			// Message body continues in the next record.
+			finfo.Errors = append(finfo.Errors, tls.ErrNeedMore)
+			if avail := fragLen - off - hdr; avail > 0 {
+				finfo.Fields = append(finfo.Fields, FrameField{
+					Class:          FieldClassPayload,
+					FrameBitOffset: hdr * octet,
+					BitLength:      avail * octet,
+				})
+			}
+			return dst
+		}
+		switch mtype {
+		case tls.HandshakeTypeClientHello:
+			pc.captureTLSClientHello(finfo, body)
+		case tls.HandshakeTypeServerHello:
+			pc.captureTLSServerHello(finfo, body)
+		default:
+			if len(body) > 0 {
+				finfo.Fields = append(finfo.Fields, FrameField{
+					Class:          FieldClassPayload,
+					FrameBitOffset: hdr * octet,
+					BitLength:      len(body) * octet,
+				})
+			}
+		}
+		off += hfrm.MessageLength()
+	}
+	debuglog("pcap:tls:hs-done")
+	return dst
+}
+
+// captureTLSClientHello appends the fields of a ClientHello body to finfo.
+// Field positions come from the parsed message, so the only arithmetic here is
+// shifting past the handshake header.
+func (pc *PacketBreakdown) captureTLSClientHello(finfo *Frame, body []byte) {
+	msg, err := tls.ParseClientHello(body)
+	if err != nil {
+		appendTLSHelloError(finfo, body, err)
+		return
+	}
+	sp := msg.Spans()
+	appendTLSHelloHead(finfo, sp)
+	pc.appendTLSCipherSuites(finfo, msg, sp.CipherSuites)
+	finfo.Fields = append(finfo.Fields, FrameField{
+		Name:           "compression methods",
+		Class:          FieldClassOptions,
+		FrameBitOffset: helloBitOffset(sp.Compression.Off),
+		BitLength:      sp.Compression.Len * octet,
+		Flags:          FlagLegacy,
+	})
+	pc.appendTLSExtensions(finfo, msg.ExtensionList(), sp.Extensions)
+}
+
+// captureTLSServerHello appends the fields of a ServerHello body to finfo. It
+// differs from the client's in naming one suite and one compression method
+// where the client offers a list of each.
+func (pc *PacketBreakdown) captureTLSServerHello(finfo *Frame, body []byte) {
+	msg, err := tls.ParseServerHello(body)
+	if err != nil {
+		appendTLSHelloError(finfo, body, err)
+		return
+	}
+	sp := msg.Spans()
+	appendTLSHelloHead(finfo, sp)
+	finfo.Fields = append(finfo.Fields, FrameField{
+		Name:           msg.CipherSuite().StringConst(),
+		Class:          FieldClassType,
+		FrameBitOffset: helloBitOffset(sp.CipherSuites.Off),
+		BitLength:      sp.CipherSuites.Len * octet,
+	}, FrameField{
+		Name:           "compression method",
+		Class:          FieldClassOptions,
+		FrameBitOffset: helloBitOffset(sp.Compression.Off),
+		BitLength:      sp.Compression.Len * octet,
+		Flags:          FlagLegacy,
+	})
+	pc.appendTLSExtensions(finfo, msg.ExtensionList(), sp.Extensions)
+}
+
+// helloBitOffset converts an offset within a hello body to one within the
+// handshake message frame.
+func helloBitOffset(bodyOff int) int {
+	return (tls.SizeHeaderHandshake + bodyOff) * octet
+}
+
+// appendTLSHelloHead appends the fields both hellos begin with.
+func appendTLSHelloHead(finfo *Frame, sp tls.HelloSpans) {
+	finfo.Fields = append(finfo.Fields, FrameField{
+		// legacy_version. TLS 1.3 pins it to 0x0303 and carries the real version
+		// in supported_versions.
+		Class:          FieldClassVersion,
+		FrameBitOffset: helloBitOffset(0),
+		BitLength:      2 * octet,
+		Flags:          FlagLegacy,
+	}, FrameField{
+		Name:           "Random",
+		Class:          FieldClassID,
+		FrameBitOffset: helloBitOffset(sp.Random.Off),
+		BitLength:      sp.Random.Len * octet,
+	})
+	if sp.SessionID.Len > 0 {
+		// TLS 1.3 has no resumption by session ID; a non-empty value means
+		// middlebox compatibility mode, echoed verbatim by the server.
+		finfo.Fields = append(finfo.Fields, FrameField{
+			Name:           "Session ID",
+			Class:          FieldClassID,
+			FrameBitOffset: helloBitOffset(sp.SessionID.Off),
+			BitLength:      sp.SessionID.Len * octet,
+		})
+	}
+}
+
+// appendTLSHelloError reports a hello that did not parse. The parsers reject a
+// whole message on any inconsistent length, which is what makes their iterators
+// error-free, so there are no field offsets to show: the error and the raw bytes
+// are all a capture can say.
+func appendTLSHelloError(finfo *Frame, body []byte, err error) {
+	finfo.Errors = append(finfo.Errors, err)
+	finfo.Fields = append(finfo.Fields, FrameField{
+		Class:          FieldClassPayload,
+		FrameBitOffset: helloBitOffset(0),
+		BitLength:      len(body) * octet,
+	})
+}
+
+// appendTLSCipherSuites appends a cipher_suites container field whose subfields
+// name each offered suite. GREASE values show up as such, which is what a
+// capture should display: they carry no meaning and are not an error.
+func (pc *PacketBreakdown) appendTLSCipherSuites(finfo *Frame, msg tls.ClientHelloMsg, sp tls.Span) {
+	// Reclaim from the Fields backing array to reuse its SubFields backing array.
+	sfield := internal.SliceReclaim(&finfo.Fields)
+	*sfield = FrameField{
+		Name:           "cipher suites",
+		Class:          FieldClassOptions,
+		SubFields:      sfield.SubFields[:0],
+		FrameBitOffset: helloBitOffset(sp.Off),
+		BitLength:      sp.Len * octet,
+	}
+	if pc.SubfieldLimit <= 0 {
+		return
+	}
+	for off, suite := range msg.CipherSuites {
+		if len(sfield.SubFields) >= pc.SubfieldLimit {
+			finfo.Errors = append(finfo.Errors, ErrLimitExceeded)
+			return
+		}
+		sfield.SubFields = append(sfield.SubFields, FrameField{
+			Name:           suite.StringConst(),
+			Class:          FieldClassType,
+			FrameBitOffset: helloBitOffset(off),
+			BitLength:      2 * octet,
+		})
+	}
+}
+
+// appendTLSExtensions appends an extensions container field whose subfields are
+// the individual extensions.
+func (pc *PacketBreakdown) appendTLSExtensions(finfo *Frame, exts tls.ExtensionList, sp tls.Span) {
+	extfield := internal.SliceReclaim(&finfo.Fields)
+	*extfield = FrameField{
+		Name:           "extensions",
+		Class:          FieldClassOptions,
+		SubFields:      extfield.SubFields[:0],
+		FrameBitOffset: helloBitOffset(sp.Off),
+		BitLength:      sp.Len * octet,
+	}
+	if pc.SubfieldLimit <= 0 {
+		return
+	}
+	for off, ext := range exts.All {
+		if len(extfield.SubFields) >= pc.SubfieldLimit {
+			finfo.Errors = append(finfo.Errors, ErrLimitExceeded)
+			return
+		}
+		extfield.SubFields = append(extfield.SubFields, tlsExtensionField(ext, off))
+	}
+}
+
+// tlsExtensionField describes a single hello extension. Extensions carrying a
+// human readable value point at that value, located by the extension's own
+// iterators, and the bulky opaque ones are classed as payload so that a
+// [Formatter.FilterClasses] can drop them without losing the rest of the hello.
+func tlsExtensionField(ext tls.ExtensionFrame, dataOff int) FrameField {
+	field := FrameField{
+		Name:           ext.Type().StringConst(),
+		Class:          FieldClassOptions,
+		FrameBitOffset: helloBitOffset(dataOff),
+		BitLength:      len(ext.Data()) * octet,
+	}
+	switch ext.Type() {
+	case tls.ExtServerName:
+		for off, name := range ext.ServerNames {
+			if name.Type != 0 {
+				continue // Only host_name is defined.
+			}
+			field.Class = FieldClassText
+			field.FrameBitOffset = helloBitOffset(off)
+			field.BitLength = len(name.Name) * octet
+			break
+		}
+
+	case tls.ExtALPN:
+		// Span the first name through the last so every offered protocol stays
+		// visible; the length bytes between them show up as escapes.
+		first, end := -1, 0
+		for off, proto := range ext.ALPNProtos {
+			if first < 0 {
+				first = off
+			}
+			end = off + len(proto)
+		}
+		if first >= 0 {
+			field.Class = FieldClassText
+			field.FrameBitOffset = helloBitOffset(first)
+			field.BitLength = (end - first) * octet
+		}
+
+	case tls.ExtKeyShare, tls.ExtPreSharedKey, tls.ExtPadding, tls.ExtSessionTicket,
+		tls.ExtCookie, tls.ExtEncryptedClientHello, tls.ExtSignedCertificateTimestamp:
+		// Opaque and large: a post-quantum key share alone runs past 1kB.
+		field.Class = FieldClassPayload
+	}
+	return field
+}
+
+// tlsHandshakeProto names the frame of a handshake message. Only the messages a
+// capture can see in cleartext get a name of their own; the rest travel inside
+// a protected record and never reach here undecrypted.
+func tlsHandshakeProto(t tls.HandshakeType) string {
+	switch t {
+	case tls.HandshakeTypeClientHello:
+		return "TLS ClientHello"
+	case tls.HandshakeTypeServerHello:
+		return "TLS ServerHello"
+	}
+	return "TLS Handshake"
+}
+
+var baseTLSRecordFields = [...]FrameField{
+	{
+		// Name is filled in with the content type's name by captureTLSRecord.
+		Class:          FieldClassType,
+		FrameBitOffset: 0,
+		BitLength:      1 * octet,
+	},
+	{
+		// legacy_record_version, which TLS 1.3 receivers ignore entirely.
+		Class:          FieldClassVersion,
+		FrameBitOffset: 1 * octet,
+		BitLength:      2 * octet,
+		Flags:          FlagLegacy,
+	},
+	{
+		Class:          FieldClassSize,
+		FrameBitOffset: 3 * octet,
+		BitLength:      2 * octet,
+	},
+}
+
+var baseTLSHandshakeFields = [...]FrameField{
+	{
+		// Name is filled in with the message type's name by captureTLSHandshake.
+		Class:          FieldClassType,
+		FrameBitOffset: 0,
+		BitLength:      1 * octet,
+	},
+	{
+		Class:          FieldClassSize,
+		FrameBitOffset: 1 * octet,
+		BitLength:      3 * octet,
+	},
+}

internet/pcap/capture_tls_test.go

@@ -0,0 +1,414 @@
+package pcap
+
+import (
+	stdtls "crypto/tls"
+	"math/rand"
+	"net"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/soypat/lneto/ethernet"
+	"github.com/soypat/lneto/internal/ltesto"
+	"github.com/soypat/lneto/tcp"
+	"github.com/soypat/lneto/x/tls"
+)
+
+// captureClientHelloRecord drives a standard library TLS client far enough to
+// emit its first flight and returns the complete handshake record, header
+// included. A real client gives realistic extension ordering, a 32-byte
+// middlebox compatibility session ID and a post-quantum key share.
+func captureClientHelloRecord(t testing.TB, serverName string, protos []string) []byte {
+	t.Helper()
+	client, server := net.Pipe()
+	defer client.Close()
+	defer server.Close()
+	go func() {
+		c := stdtls.Client(client, &stdtls.Config{
+			ServerName: serverName,
+			MinVersion: stdtls.VersionTLS13,
+			MaxVersion: stdtls.VersionTLS13,
+			NextProtos: protos,
+		})
+		_ = c.Handshake() // Will fail; only the first flight is needed.
+	}()
+	server.SetReadDeadline(time.Now().Add(10 * time.Second))
+	var buf [4096]byte
+	n, err := server.Read(buf[:])
+	if err != nil {
+		t.Fatalf("reading ClientHello: %v", err)
+	}
+	rec, err := tls.NewRecordFrame(buf[:n])
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !rec.Complete() {
+		t.Fatalf("ClientHello record split across reads: have %d want %d", n, rec.RecordLength())
+	}
+	return append([]byte{}, rec.RawData()...)
+}
+
+// TestCaptureTLSClientHello runs a real ClientHello through the full
+// Ethernet/IPv4/TCP path to check that TLS is detected by payload content
+// rather than by port, and that the SNI hostname is recovered.
+func TestCaptureTLSClientHello(t *testing.T) {
+	const mtu = ethernet.MaxMTU
+	const serverName = "example.com"
+	payload := captureClientHelloRecord(t, serverName, []string{"h2", "http/1.1"})
+
+	var buf [mtu]byte
+	var gen ltesto.PacketGen
+	rng := rand.New(rand.NewSource(1))
+	gen.RandomizeAddrs(rng)
+	pkt := gen.AppendRandomIPv4TCPPacket(buf[:0], rng, tcp.Segment{
+		SEQ:     100,
+		ACK:     200,
+		DATALEN: tcp.Size(len(payload)),
+		WND:     1024,
+		Flags:   tcp.FlagPSH | tcp.FlagACK,
+	})
+	copy(pkt[len(pkt)-len(payload):], payload)
+
+	var pbreak PacketBreakdown
+	pbreak.SubfieldLimit = 32
+	frames, err := pbreak.CaptureEthernet(nil, pkt, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	// Ethernet+IPv4+TCP+TLS record+TLS ClientHello = 5 frames.
+	if len(frames) != 5 {
+		for i := range frames {
+			t.Logf("frame[%d]=%s", i, frames[i].String())
+		}
+		t.Fatalf("want 5 frames, got %d", len(frames))
+	}
+	if frames[3].Protocol != "TLS" {
+		t.Errorf("frame 3 protocol=%q want TLS", frames[3].Protocol)
+	}
+	if frames[4].Protocol != "TLS ClientHello" {
+		t.Errorf("frame 4 protocol=%q want TLS ClientHello", frames[4].Protocol)
+	}
+	if len(frames[3].Errors) > 0 || len(frames[4].Errors) > 0 {
+		t.Errorf("unexpected errors: %v %v", frames[3].Errors, frames[4].Errors)
+	}
+	// A handshake record frame describes the record header only; its fragment is
+	// broken down by the handshake frame that follows, so that no bytes are
+	// claimed by two frames at once.
+	if got := frames[3].LenBits() / 8; got != tls.SizeHeaderRecord {
+		t.Errorf("TLS record frame len=%d want %d", got, tls.SizeHeaderRecord)
+	}
+	if got := frames[4].LenBits() / 8; got != len(payload)-tls.SizeHeaderRecord {
+		t.Errorf("handshake frame len=%d want %d", got, len(payload)-tls.SizeHeaderRecord)
+	}
+
+	ctype := fieldByName(frames[3], "handshake")
+	if ctype == nil {
+		t.Fatal("no handshake content type field")
+	}
+	if v, _ := frames[3].FieldAsUint(indexOfField(frames[3], "handshake"), pkt); v != uint64(tls.ContentTypeHandshake) {
+		t.Errorf("content type=%d want %d", v, tls.ContentTypeHandshake)
+	}
+
+	// SNI and ALPN live as subfields of the extensions container.
+	exts := fieldByName(frames[4], "extensions")
+	if exts == nil {
+		t.Fatal("no extensions field in ClientHello")
+	}
+	var sni, alpn *FrameField
+	for i := range exts.SubFields {
+		switch exts.SubFields[i].Name {
+		case tls.ExtServerName.String():
+			sni = &exts.SubFields[i]
+		case tls.ExtALPN.String():
+			alpn = &exts.SubFields[i]
+		}
+	}
+	if sni == nil {
+		t.Fatal("no server_name extension field")
+	}
+	got := string(pkt[(frames[4].PacketBitOffset+sni.FrameBitOffset)/8:][:sni.BitLength/8])
+	if got != serverName {
+		t.Errorf("server_name=%q want %q", got, serverName)
+	}
+	if alpn == nil {
+		t.Error("no application_layer_protocol_negotiation extension field")
+	}
+
+	// Formatted output is the point of the exercise: the hostname and the
+	// negotiated suites must be readable in one line.
+	var f Formatter
+	f.SubfieldLimit = 32
+	out, err := f.FormatFrames(nil, frames, pkt)
+	if err != nil {
+		t.Fatal(err)
+	}
+	str := string(out)
+	for _, want := range []string{"TLS", "handshake=", "client_hello=", serverName,
+		"TLS_AES_128_GCM_SHA256", "http/1.1"} {
+		if !strings.Contains(str, want) {
+			t.Errorf("formatted output missing %q:\n%s", want, str)
+		}
+	}
+}
+
+// TestCaptureTLSRecordSequence checks the multi-record path: a server flight
+// coalesces ServerHello, the compatibility ChangeCipherSpec and the first
+// protected record into a single segment.
+func TestCaptureTLSRecordSequence(t *testing.T) {
+	var b tls.Builder
+	var buf [512]byte
+	b.Reset(buf[:])
+
+	// ServerHello record.
+	b.AddU8(uint8(tls.ContentTypeHandshake))
+	b.AddU16(tls.VersionTLS12)
+	b.OpenU16()
+	b.AddU8(uint8(tls.HandshakeTypeServerHello))
+	b.OpenU24()
+	b.AddU16(tls.VersionTLS12) // legacy_version
+	for range tls.SizeRandom {
+		b.AddU8(0xab) // server_random
+	}
+	b.OpenU8() // legacy_session_id echo
+	for range 32 {
+		b.AddU8(0xcd)
+	}
+	b.Close()
+	b.AddU16(uint16(tls.SuiteAES128GCMSHA256))
+	b.AddU8(0)  // legacy_compression_method
+	b.OpenU16() // extensions
+	b.AddU16(uint16(tls.ExtSupportedVersions))
+	b.OpenU16()
+	b.AddU16(tls.VersionTLS13)
+	b.Close()
+	b.AddU16(uint16(tls.ExtKeyShare))
+	b.OpenU16()
+	b.AddU16(uint16(tls.GroupX25519))
+	b.OpenU16()
+	for range 32 {
+		b.AddU8(0xee)
+	}
+	b.Close()
+	b.Close()
+	b.Close() // extensions
+	b.Close() // handshake body
+	b.Close() // record fragment
+
+	// change_cipher_spec record.
+	b.AddU8(uint8(tls.ContentTypeChangeCipherSpec))
+	b.AddU16(tls.VersionTLS12)
+	b.OpenU16()
+	b.AddU8(1)
+	b.Close()
+
+	// First protected record: outwardly application_data.
+	b.AddU8(uint8(tls.ContentTypeApplicationData))
+	b.AddU16(tls.VersionTLS12)
+	b.OpenU16()
+	for range 24 {
+		b.AddU8(0x5a)
+	}
+	b.Close()
+
+	pkt, err := b.Bytes()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !payloadIsTLS(pkt) {
+		t.Fatal("payloadIsTLS did not recognize a ServerHello record")
+	}
+
+	var pbreak PacketBreakdown
+	pbreak.SubfieldLimit = 8
+	frames, err := pbreak.CaptureTLS(nil, pkt, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := []string{"TLS", "TLS ServerHello", "TLS", "TLS"}
+	if len(frames) != len(want) {
+		for i := range frames {
+			t.Logf("frame[%d]=%s", i, frames[i].String())
+		}
+		t.Fatalf("got %d frames want %d", len(frames), len(want))
+	}
+	for i, wantProto := range want {
+		if frames[i].Protocol != wantProto {
+			t.Errorf("frame[%d] protocol=%q want %q", i, frames[i].Protocol, wantProto)
+		}
+		if len(frames[i].Errors) > 0 {
+			t.Errorf("frame[%d] errors=%v", i, frames[i].Errors)
+		}
+	}
+	if fieldByName(frames[1], tls.SuiteAES128GCMSHA256.String()) == nil {
+		t.Error("ServerHello cipher suite field not named after the selected suite")
+	}
+	i, err := frames[3].FieldByClass(FieldClassPayload)
+	if err != nil {
+		t.Error("no payload field in application_data record:", err)
+	} else if !frames[3].Fields[i].Flags.IsEncrypted() {
+		t.Error("application_data fragment not flagged as encrypted")
+	}
+	// Record frames must start exactly where the previous record ended, and the
+	// last one must end at the packet end: no record skipped, none double read.
+	off := 0
+	for i := range frames {
+		if frames[i].Protocol != "TLS" {
+			continue
+		}
+		if frames[i].PacketBitOffset != off*octet {
+			t.Errorf("frame[%d] starts at bit %d want %d", i, frames[i].PacketBitOffset, off*octet)
+		}
+		rec, err := tls.NewRecordFrame(pkt[off:])
+		if err != nil {
+			t.Fatal(err)
+		}
+		off += rec.RecordLength()
+	}
+	if off != len(pkt) {
+		t.Errorf("records cover %d bytes of %d", off, len(pkt))
+	}
+}
+
+// TestCaptureTLSIncomplete checks the stream cases a stateless breakdown cannot
+// reassemble: a record whose fragment continues in the next TCP segment, and a
+// handshake message whose body continues in the next record.
+func TestCaptureTLSIncomplete(t *testing.T) {
+	t.Run("record", func(t *testing.T) {
+		pkt := []byte{byte(tls.ContentTypeApplicationData), 0x03, 0x03, 0x04, 0x00, 1, 2, 3}
+		var pbreak PacketBreakdown
+		frames, err := pbreak.CaptureTLS(nil, pkt, 0)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if len(frames) != 1 {
+			t.Fatalf("got %d frames want 1", len(frames))
+		}
+		if len(frames[0].Errors) != 1 || frames[0].Errors[0] != tls.ErrNeedMore {
+			t.Errorf("errors=%v want %v", frames[0].Errors, tls.ErrNeedMore)
+		}
+		if got := frames[0].LenBits() / 8; got != len(pkt) {
+			t.Errorf("frame covers %d bytes want %d", got, len(pkt))
+		}
+	})
+	t.Run("handshake", func(t *testing.T) {
+		// A 5-byte record carrying a Certificate message header that declares a
+		// 1000-byte body: the rest arrives in later records.
+		pkt := []byte{
+			byte(tls.ContentTypeHandshake), 0x03, 0x03, 0x00, 0x06,
+			byte(tls.HandshakeTypeCertificate), 0x00, 0x03, 0xe8, 0xaa, 0xbb,
+		}
+		var pbreak PacketBreakdown
+		frames, err := pbreak.CaptureTLS(nil, pkt, 0)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if len(frames) != 2 {
+			t.Fatalf("got %d frames want 2", len(frames))
+		}
+		if frames[1].Protocol != "TLS Handshake" {
+			t.Errorf("protocol=%q want TLS Handshake", frames[1].Protocol)
+		}
+		if len(frames[1].Errors) != 1 || frames[1].Errors[0] != tls.ErrNeedMore {
+			t.Errorf("errors=%v want %v", frames[1].Errors, tls.ErrNeedMore)
+		}
+		if got := frames[1].LenBits() / 8; got != 6 {
+			t.Errorf("handshake frame covers %d bytes want 6", got)
+		}
+	})
+}
+
+// TestCaptureTLSAlert checks the cleartext alert path, which is the only way a
+// TLS 1.3 handshake failure is visible to a capture.
+func TestCaptureTLSAlert(t *testing.T) {
+	pkt := []byte{
+		byte(tls.ContentTypeAlert), 0x03, 0x03, 0x00, 0x02,
+		byte(tls.AlertLevelFatal), byte(tls.AlertHandshakeFailure),
+	}
+	var pbreak PacketBreakdown
+	frames, err := pbreak.CaptureTLS(nil, pkt, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(frames) != 1 {
+		t.Fatalf("got %d frames want 1", len(frames))
+	}
+	if fieldByName(frames[0], tls.AlertHandshakeFailure.String()) == nil {
+		t.Errorf("no field named %q in %s", tls.AlertHandshakeFailure.String(), frames[0].String())
+	}
+	var f Formatter
+	f.DisableLegacyFilter = true
+	out, err := f.FormatFrame(nil, frames[0], pkt)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(string(out), "handshake_failure") {
+		t.Errorf("formatted alert missing description: %s", out)
+	}
+}
+
+// TestPayloadIsTLS guards the heuristic that routes a TCP payload to CaptureTLS
+// against the HTTP traffic it shares the datapath with.
+func TestPayloadIsTLS(t *testing.T) {
+	for _, tc := range []struct {
+		name    string
+		payload []byte
+		want    bool
+	}{
+		{"client hello", []byte{22, 3, 1, 0, 10}, true},
+		{"app data", []byte{23, 3, 3, 0x40, 0x00}, true},
+		{"alert", []byte{21, 3, 3, 0, 2}, true},
+		{"http request", []byte("GET / HTTP/1.1\r\n"), false},
+		{"http response", []byte("HTTP/1.1 200 OK\r\n"), false},
+		{"bad content type", []byte{25, 3, 3, 0, 10}, false},
+		{"bad version", []byte{22, 2, 1, 0, 10}, false},
+		{"future version", []byte{22, 3, 5, 0, 10}, false},
+		{"zero length", []byte{22, 3, 3, 0, 0}, false},
+		{"oversize length", []byte{23, 3, 3, 0xff, 0xff}, false},
+		{"short", []byte{22, 3, 3}, false},
+	} {
+		if got := payloadIsTLS(tc.payload); got != tc.want {
+			t.Errorf("%s: payloadIsTLS=%v want %v", tc.name, got, tc.want)
+		}
+	}
+}
+
+// TestCaptureTLSRecordLimit checks that a segment packed with tiny records
+// cannot make a single packet produce unbounded frames.
+func TestCaptureTLSRecordLimit(t *testing.T) {
+	var pkt []byte
+	for range maxTLSRecordsPerPacket + 3 {
+		pkt = append(pkt, byte(tls.ContentTypeApplicationData), 3, 3, 0, 1, 0x99)
+	}
+	var pbreak PacketBreakdown
+	frames, err := pbreak.CaptureTLS(nil, pkt, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(frames) != maxTLSRecordsPerPacket+1 {
+		t.Fatalf("got %d frames want %d", len(frames), maxTLSRecordsPerPacket+1)
+	}
+	last := frames[len(frames)-1]
+	if last.Protocol != "TLS records?" {
+		t.Errorf("last frame protocol=%q want TLS records?", last.Protocol)
+	}
+	if end := (last.PacketBitOffset + last.LenBits()) / 8; end != len(pkt) {
+		t.Errorf("remaining frame ends at %d want %d", end, len(pkt))
+	}
+}
+
+func fieldByName(frm Frame, name string) *FrameField {
+	i := indexOfField(frm, name)
+	if i < 0 {
+		return nil
+	}
+	return &frm.Fields[i]
+}
+
+func indexOfField(frm Frame, name string) int {
+	for i := range frm.Fields {
+		if frm.Fields[i].Name == name {
+			return i
+		}
+	}
+	return -1
+}

internet/pcap/format.go

@@ -136,6 +136,9 @@ func (f *Formatter) formatField(dst []byte, pktStartOff int, field FrameField, p
 	name := field.Name
 	if name == "" {
 		name = field.Class.String()
+		if field.Flags.IsEncrypted() {
+			name = "encrypted"
+		}
 	}
 	hasSpaces := strings.IndexByte(name, ' ') >= 0
 	if hasSpaces {
@@ -191,8 +194,10 @@ func (f *Formatter) formatField(dst []byte, pktStartOff int, field FrameField, p
 		nameOff := field.FrameBitOffset / 8
 		dst = dnsAppendDottedName(dst, dnsMsg, nameOff)
 	case FieldClassDst, FieldClassSrc, FieldClassSize, FieldClassAddress, FieldClassOperation:
-		// IP, MAC addresses and ports.
-		if field.BitLength <= 16 {
+		// IP, MAC addresses and ports. Sizes are always numbers, never
+		// addresses, so a wide one such as the TLS 24-bit handshake length is
+		// still printed in decimal.
+		if field.BitLength <= 16 || field.Class == FieldClassSize && field.BitLength <= 64 {
 			v, err := f.fieldAsUint(pkt, fieldBitStart, field.BitLength, field.Flags.IsRightAligned())
 			if err != nil {
 				return dst, err

internet/pcap/stringers.go

@@ -33,9 +33,8 @@ const _FieldClass_name = "undefinedsourcedestinationprotocolversiontypesizeflags
 var _FieldClass_index = [...]uint8{0, 9, 15, 26, 34, 41, 45, 49, 54, 68, 76, 83, 90, 94, 101, 112, 114, 123, 131}
 
 func (i FieldClass) String() string {
-	idx := int(i) - 0
-	if i < 0 || idx >= len(_FieldClass_index)-1 {
+	if i >= FieldClass(len(_FieldClass_index)-1) {
 		return "FieldClass(" + strconv.FormatInt(int64(i), 10) + ")"
 	}
-	return _FieldClass_name[_FieldClass_index[idx]:_FieldClass_index[idx+1]]
+	return _FieldClass_name[_FieldClass_index[i]:_FieldClass_index[i+1]]
 }

ipv4/definitions.go

@@ -18,12 +18,6 @@ func IsMulticast(addr [4]byte) bool {
 	return addr[0]&0xf0 == 0xe0
 }
 
-// UnspecifiedAddr returns the unspecified address: 0.0.0.0
-func UnspecifiedAddr() [4]byte { return [4]byte{0, 0, 0, 0} }
-
-// BroadcastAddr returns the broadcast address: 255.255.255.255
-func BroadcastAddr() [4]byte { return [4]byte{255, 255, 255, 255} }
-
 // IsBroadcast reports whether addr is the limited broadcast address
 // 255.255.255.255 used to address all hosts on the local network segment
 // as defined in [RFC919]. It does not detect directed (subnet) broadcast
@@ -32,7 +26,7 @@ func BroadcastAddr() [4]byte { return [4]byte{255, 255, 255, 255} }
 //
 // [RFC919]: https://datatracker.ietf.org/doc/html/rfc919
 func IsBroadcast(addr [4]byte) bool {
-	return addr == BroadcastAddr()
+	return addr == [4]byte{255, 255, 255, 255}
 }
 
 // IsLinkLocal reports whether addr is within the IPv4 link-local prefix
@@ -119,12 +113,3 @@ func AppendFormatAddr(dst []byte, addr [4]byte) []byte {
 	}
 	return dst
 }
-
-// String returns the dotted-decimal text representation of an IPv4 address.
-func String(addr [4]byte) string {
-	// See net/netip's (Addr).string4 pattern.
-	var buf [maxAddrStringLen]byte
-	return string(AppendFormatAddr(buf[:0], addr))
-}
-
-const maxAddrStringLen = len("255.255.255.255")

ipv4/definitions_test.go

@@ -10,10 +10,10 @@ func TestAppendFormatAddr(t *testing.T) {
 		addr [4]byte
 		want string
 	}{
-		{addr: UnspecifiedAddr(), want: "0.0.0.0"},
-		{addr: BroadcastAddr(), want: "255.255.255.255"},
+		{addr: [4]byte{0, 0, 0, 0}, want: "0.0.0.0"},
 		{addr: [4]byte{127, 0, 0, 1}, want: "127.0.0.1"},
 		{addr: [4]byte{192, 168, 1, 1}, want: "192.168.1.1"},
+		{addr: [4]byte{255, 255, 255, 255}, want: "255.255.255.255"},
 		{addr: [4]byte{10, 0, 0, 1}, want: "10.0.0.1"},
 		{addr: [4]byte{1, 2, 3, 4}, want: "1.2.3.4"},
 		{addr: [4]byte{100, 99, 9, 0}, want: "100.99.9.0"},

ipv4/icmpv4/stringers.go

@@ -66,11 +66,10 @@ const _CodeDestinationUnreachable_name = "net unreachablehost unreachableprotoco
 var _CodeDestinationUnreachable_index = [...]uint8{0, 15, 31, 51, 67, 98, 117}
 
 func (i CodeDestinationUnreachable) String() string {
-	idx := int(i) - 0
-	if i < 0 || idx >= len(_CodeDestinationUnreachable_index)-1 {
+	if i >= CodeDestinationUnreachable(len(_CodeDestinationUnreachable_index)-1) {
 		return "CodeDestinationUnreachable(" + strconv.FormatInt(int64(i), 10) + ")"
 	}
-	return _CodeDestinationUnreachable_name[_CodeDestinationUnreachable_index[idx]:_CodeDestinationUnreachable_index[idx+1]]
+	return _CodeDestinationUnreachable_name[_CodeDestinationUnreachable_index[i]:_CodeDestinationUnreachable_index[i+1]]
 }
 func _() {
 	// An "invalid array index" compiler error signifies that the constant values have changed.
@@ -87,9 +86,8 @@ const _CodeRedirect_name = "redirect for networkredirect for hostredirect for To
 var _CodeRedirect_index = [...]uint8{0, 20, 37, 61, 82}
 
 func (i CodeRedirect) String() string {
-	idx := int(i) - 0
-	if i < 0 || idx >= len(_CodeRedirect_index)-1 {
+	if i >= CodeRedirect(len(_CodeRedirect_index)-1) {
 		return "CodeRedirect(" + strconv.FormatInt(int64(i), 10) + ")"
 	}
-	return _CodeRedirect_name[_CodeRedirect_index[idx]:_CodeRedirect_index[idx+1]]
+	return _CodeRedirect_name[_CodeRedirect_index[i]:_CodeRedirect_index[i+1]]
 }

ipv6/icmpv6/stringers.go

@@ -66,11 +66,10 @@ const _CodeDestinationUnreachable_name = "no route to destinationcommunication a
 var _CodeDestinationUnreachable_index = [...]uint8{0, 23, 64, 94, 113, 129, 172, 199}
 
 func (i CodeDestinationUnreachable) String() string {
-	idx := int(i) - 0
-	if i < 0 || idx >= len(_CodeDestinationUnreachable_index)-1 {
+	if i >= CodeDestinationUnreachable(len(_CodeDestinationUnreachable_index)-1) {
 		return "CodeDestinationUnreachable(" + strconv.FormatInt(int64(i), 10) + ")"
 	}
-	return _CodeDestinationUnreachable_name[_CodeDestinationUnreachable_index[idx]:_CodeDestinationUnreachable_index[idx+1]]
+	return _CodeDestinationUnreachable_name[_CodeDestinationUnreachable_index[i]:_CodeDestinationUnreachable_index[i+1]]
 }
 func _() {
 	// An "invalid array index" compiler error signifies that the constant values have changed.
@@ -86,9 +85,8 @@ const _CodeParameterProblem_name = "erroneous header field encounteredunrecogniz
 var _CodeParameterProblem_index = [...]uint8{0, 34, 75, 111}
 
 func (i CodeParameterProblem) String() string {
-	idx := int(i) - 0
-	if i < 0 || idx >= len(_CodeParameterProblem_index)-1 {
+	if i >= CodeParameterProblem(len(_CodeParameterProblem_index)-1) {
 		return "CodeParameterProblem(" + strconv.FormatInt(int64(i), 10) + ")"
 	}
-	return _CodeParameterProblem_name[_CodeParameterProblem_index[idx]:_CodeParameterProblem_index[idx+1]]
+	return _CodeParameterProblem_name[_CodeParameterProblem_index[i]:_CodeParameterProblem_index[i+1]]
 }

phy/phy_stringers.go

@@ -29,9 +29,8 @@ const _LinkMode_name = "down10M-H10M-F100M-H100M-F100M-T41000M-H1000M-F2.5G-F5G-
 var _LinkMode_index = [...]uint8{0, 4, 9, 14, 20, 26, 33, 40, 47, 53, 57, 62, 67, 72, 78}
 
 func (i LinkMode) String() string {
-	idx := int(i) - 0
-	if i < 0 || idx >= len(_LinkMode_index)-1 {
+	if i >= LinkMode(len(_LinkMode_index)-1) {
 		return "LinkMode(" + strconv.FormatInt(int64(i), 10) + ")"
 	}
-	return _LinkMode_name[_LinkMode_index[idx]:_LinkMode_index[idx+1]]
+	return _LinkMode_name[_LinkMode_index[i]:_LinkMode_index[i+1]]
 }

stringers.go

@@ -212,17 +212,16 @@ func _() {
 	_ = x[ErrAlreadyRegistered-17]
 	_ = x[ErrTruncatedFrame-18]
 	_ = x[ErrMissingHALConfig-19]
-	_ = x[ErrBadState-20]
 }
 
 const (
 	_errGeneric_name_0 = "lneto-bug(use build tag \"debugheaplog\")packet droppedincorrect checksumzero source(port/addr)zero destination(port/addr)short bufferbuffer fullinvalid addressunsupportedmismatchmismatched lengthinvalid configuration"
-	_errGeneric_name_1 = "invalid fieldinvalid length fieldresource exhaustedprotocol already registeredtruncated framemissing HAL configurationoperation invalid in current state"
+	_errGeneric_name_1 = "invalid fieldinvalid length fieldresource exhaustedprotocol already registeredtruncated framemissing HAL configuration"
 )
 
 var (
 	_errGeneric_index_0 = [...]uint8{0, 39, 53, 71, 93, 120, 132, 143, 158, 169, 177, 194, 215}
-	_errGeneric_index_1 = [...]uint8{0, 13, 33, 51, 78, 93, 118, 152}
+	_errGeneric_index_1 = [...]uint8{0, 13, 33, 51, 78, 93, 118}
 )
 
 func (i errGeneric) String() string {
@@ -230,7 +229,7 @@ func (i errGeneric) String() string {
 	case 1 <= i && i <= 12:
 		i -= 1
 		return _errGeneric_name_0[_errGeneric_index_0[i]:_errGeneric_index_0[i+1]]
-	case 14 <= i && i <= 20:
+	case 14 <= i && i <= 19:
 		i -= 14
 		return _errGeneric_name_1[_errGeneric_index_1[i]:_errGeneric_index_1[i+1]]
 	default:

tcp/stringers.go

@@ -26,11 +26,10 @@ const _State_name = "CLOSEDLISTENSYN-RECEIVEDSYN-SENTESTABLISHEDFIN-WAIT-1FIN-WA
 var _State_index = [...]uint8{0, 6, 12, 24, 32, 43, 53, 63, 70, 79, 89, 97}
 
 func (i State) String() string {
-	idx := int(i) - 0
-	if i < 0 || idx >= len(_State_index)-1 {
+	if i >= State(len(_State_index)-1) {
 		return "State(" + strconv.FormatInt(int64(i), 10) + ")"
 	}
-	return _State_name[_State_index[idx]:_State_index[idx+1]]
+	return _State_name[_State_index[i]:_State_index[i+1]]
 }
 func _() {
 	// An "invalid array index" compiler error signifies that the constant values have changed.

x/rawsock/doc.go

@@ -1,11 +0,0 @@
-// Package rawsock listens and reads over Linux sockets through syscalls
-// directly, without the net package. It exists so a server can be measured
-// without net.TCPConn, its netFD and its poller on the path.
-//
-// [Conn] and [Listener] implement [net.Conn] and [net.Listener] the way
-// TinyGo's net package does: a connection is its file descriptor plus its
-// addresses, deadlines live on the struct and are handed to the socket, and
-// nothing sits between a Read and the syscall. A server written against these
-// interfaces runs unchanged over the net package, over this package and over
-// TinyGo's netdev.
-package rawsock

x/rawsock/rawsock_darwin.go

@@ -1,7 +0,0 @@
-//go:build !tinygo && darwin
-
-package rawsock
-
-import "syscall"
-
-const sysaccept = syscall.SYS_ACCEPT

x/rawsock/rawsock_linux.go

@@ -1,7 +0,0 @@
-//go:build !tinygo && linux
-
-package rawsock
-
-import "syscall"
-
-const sysaccept = syscall.SYS_ACCEPT4

x/rawsock/rawsock_other.go

@@ -1,49 +0,0 @@
-//go:build tinygo || (!linux && !darwin)
-
-package rawsock
-
-import (
-	"errors"
-	"net"
-	"net/netip"
-	"time"
-)
-
-var (
-	_ net.Conn     = (*Conn)(nil)
-	_ net.Listener = (*Listener)(nil)
-)
-
-// Addr is a socket address implementing [net.Addr].
-type Addr netip.AddrPort
-
-func (a Addr) Network() string          { return "tcp" }
-func (a Addr) String() string           { return netip.AddrPort(a).String() }
-func (a Addr) AddrPort() netip.AddrPort { return netip.AddrPort(a) }
-
-// Conn is an accepted connection. Unsupported on this platform.
-type Conn struct{}
-
-func (c *Conn) Read(b []byte) (int, error)  { return 0, errors.ErrUnsupported }
-func (c *Conn) Write(b []byte) (int, error) { return 0, errors.ErrUnsupported }
-func (c *Conn) Close() error                { return errors.ErrUnsupported }
-func (c *Conn) LocalAddr() net.Addr         { return Addr{} }
-func (c *Conn) RemoteAddr() net.Addr        { return Addr{} }
-
-func (c *Conn) SetDeadline(t time.Time) error               { return errors.ErrUnsupported }
-func (c *Conn) SetReadDeadline(t time.Time) error           { return errors.ErrUnsupported }
-func (c *Conn) SetWriteDeadline(t time.Time) error          { return errors.ErrUnsupported }
-func (c *Conn) SetReadTimeout(timeout time.Duration) error  { return errors.ErrUnsupported }
-func (c *Conn) SetWriteTimeout(timeout time.Duration) error { return errors.ErrUnsupported }
-
-// Listener is a listening socket. Unsupported on this platform.
-type Listener struct{}
-
-// Listen is unsupported on this platform.
-func (l *Listener) Listen(port uint16) error { return errors.ErrUnsupported }
-
-func (l *Listener) Accept() (net.Conn, error)   { return nil, errors.ErrUnsupported }
-func (l *Listener) AcceptConn(conn *Conn) error { return errors.ErrUnsupported }
-func (l *Listener) Addr() net.Addr              { return Addr{} }
-func (l *Listener) Port() uint16                { return 0 }
-func (l *Listener) Close() error                { return errors.ErrUnsupported }

x/rawsock/rawsock_unix.go

@@ -1,244 +0,0 @@
-//go:build !tinygo && (linux || darwin)
-
-package rawsock
-
-import (
-	"net"
-	"net/netip"
-	"syscall"
-	"time"
-	"unsafe"
-)
-
-// The interfaces this package exists to satisfy: an http.Server and a heapless
-// router must both accept what Listen hands back.
-var (
-	_ net.Conn     = (*Conn)(nil)
-	_ net.Listener = (*Listener)(nil)
-)
-
-// Addr is a socket address. It implements [net.Addr] over a
-// [netip.AddrPort], which costs no allocation to carry around, unlike
-// [net.TCPAddr] and its IP slice.
-type Addr netip.AddrPort
-
-// Network returns "tcp".
-func (a Addr) Network() string { return "tcp" }
-
-// String returns the address in host:port form.
-func (a Addr) String() string { return netip.AddrPort(a).String() }
-
-// AddrPort returns the address as a [netip.AddrPort].
-func (a Addr) AddrPort() netip.AddrPort { return netip.AddrPort(a) }
-
-// Conn is an accepted TCP connection over a raw socket file descriptor. It
-// implements [net.Conn], so both an [net/http.Server] and a heapless router can
-// be handed the same connection.
-//
-// Deadlines are enforced by the socket itself through SO_RCVTIMEO and
-// SO_SNDTIMEO: a read that runs out of time fails with a [net.Error] that
-// reports Timeout, as callers of net.Conn expect.
-type Conn struct {
-	fd            int
-	local, remote Addr
-	readDeadline  time.Time
-	writeDeadline time.Time
-}
-
-// Read reads bytes from the connection into b.
-func (c *Conn) Read(b []byte) (int, error) {
-	if len(b) == 0 {
-		return 0, nil
-	}
-	n, err := syscall.Read(c.fd, b)
-	if err != nil {
-		return 0, c.opError("read", err)
-	}
-	if n == 0 {
-		return 0, syscall.ECONNRESET // Peer closed.
-	}
-	return n, nil
-}
-
-// Write writes b to the connection, looping until all bytes are sent.
-func (c *Conn) Write(b []byte) (int, error) {
-	total := 0
-	for total < len(b) {
-		n, err := syscall.Write(c.fd, b[total:])
-		if err != nil {
-			return total, c.opError("write", err)
-		}
-		total += n
-	}
-	return total, nil
-}
-
-// Close closes the underlying file descriptor.
-func (c *Conn) Close() error {
-	return syscall.Close(c.fd)
-}
-
-// LocalAddr returns the address the connection was accepted on.
-func (c *Conn) LocalAddr() net.Addr { return c.local }
-
-// RemoteAddr returns the peer address of the connection.
-func (c *Conn) RemoteAddr() net.Addr { return c.remote }
-
-// SetDeadline sets both the read and write deadline. A zero time removes them.
-func (c *Conn) SetDeadline(t time.Time) error {
-	err := c.SetReadDeadline(t)
-	if err != nil {
-		return err
-	}
-	return c.SetWriteDeadline(t)
-}
-
-// SetReadDeadline makes reads after t fail with a timeout error. A zero time
-// lets reads block indefinitely.
-func (c *Conn) SetReadDeadline(t time.Time) error {
-	c.readDeadline = t
-	return c.SetReadTimeout(untilDeadline(t))
-}
-
-// SetWriteDeadline makes writes after t fail with a timeout error. A zero time
-// lets writes block indefinitely.
-func (c *Conn) SetWriteDeadline(t time.Time) error {
-	c.writeDeadline = t
-	return c.SetWriteTimeout(untilDeadline(t))
-}
-
-// SetReadTimeout limits how long a single Read waits for data before failing
-// with a timeout error. Zero blocks indefinitely. This is what stops a peer
-// that opens a connection and then stalls from holding a server worker: the
-// connection, not the HTTP handler, owns the idle policy.
-func (c *Conn) SetReadTimeout(timeout time.Duration) error {
-	return setSockTimeout(c.fd, syscall.SO_RCVTIMEO, timeout)
-}
-
-// SetWriteTimeout limits how long a single Write waits for the send buffer to
-// drain before failing with a timeout error. Zero blocks indefinitely.
-func (c *Conn) SetWriteTimeout(timeout time.Duration) error {
-	return setSockTimeout(c.fd, syscall.SO_SNDTIMEO, timeout)
-}
-
-// opError wraps a socket error the way the net package does, so that callers
-// which test for a timeout with [net.Error] see one. A deadline that has passed
-// surfaces from the kernel as EAGAIN, which on a blocking socket only ever
-// means the timeout fired.
-func (c *Conn) opError(op string, err error) error {
-	if err == syscall.EAGAIN || err == syscall.EWOULDBLOCK {
-		err = errTimeout{}
-	}
-	return &net.OpError{Op: op, Net: "tcp", Source: c.local, Addr: c.remote, Err: err}
-}
-
-// errTimeout is the error a read or write past its deadline fails with.
-type errTimeout struct{}
-
-func (errTimeout) Error() string   { return "i/o timeout" }
-func (errTimeout) Timeout() bool   { return true }
-func (errTimeout) Temporary() bool { return true }
-
-func untilDeadline(t time.Time) time.Duration {
-	if t.IsZero() {
-		return 0 // No deadline: block indefinitely.
-	}
-	remaining := time.Until(t)
-	if remaining <= 0 {
-		return time.Nanosecond // Already past: fail the next call, do not block.
-	}
-	return remaining
-}
-
-func setSockTimeout(fd, option int, timeout time.Duration) error {
-	tv := syscall.NsecToTimeval(int64(timeout))
-	return syscall.SetsockoptTimeval(fd, syscall.SOL_SOCKET, option, &tv)
-}
-
-// Listener is a listening TCP socket bound to a local port. It implements
-// [net.Listener].
-type Listener struct {
-	fd    int
-	local Addr
-}
-
-// Listen creates a listening TCP socket bound to port on all interfaces. A
-// zero port lets the kernel choose one, see [Listener.Addr].
-func (l *Listener) Listen(port uint16) error {
-	fd, err := syscall.Socket(syscall.AF_INET, syscall.SOCK_STREAM, syscall.IPPROTO_TCP)
-	if err != nil {
-		return err
-	}
-	// Allow quick rebind after restart.
-	if err = syscall.SetsockoptInt(fd, syscall.SOL_SOCKET, syscall.SO_REUSEADDR, 1); err != nil {
-		syscall.Close(fd)
-		return err
-	}
-	addr := &syscall.SockaddrInet4{Port: int(port)}
-	if err = syscall.Bind(fd, addr); err != nil {
-		syscall.Close(fd)
-		return err
-	}
-	if err = syscall.Listen(fd, syscall.SOMAXCONN); err != nil {
-		syscall.Close(fd)
-		return err
-	}
-	l.fd = fd
-	l.local = Addr{}
-	bound, err := syscall.Getsockname(fd)
-	if err != nil {
-		syscall.Close(fd)
-		return err
-	}
-	if sa4, ok := bound.(*syscall.SockaddrInet4); ok {
-		l.local = Addr(netip.AddrPortFrom(netip.AddrFrom4(sa4.Addr), uint16(sa4.Port)))
-	}
-	return nil
-}
-
-// Accept blocks until an incoming connection arrives and returns it. It
-// allocates the connection, as [net.Listener] requires. A server that keeps its
-// own connection storage should call [Listener.AcceptConn] instead.
-func (l *Listener) Accept() (net.Conn, error) {
-	conn := new(Conn)
-	err := l.AcceptConn(conn)
-	if err != nil {
-		return nil, err
-	}
-	return conn, nil
-}
-
-// AcceptConn blocks until an incoming connection arrives and stores it in conn,
-// reusing whatever conn already held. Nothing is allocated.
-//
-// The syscall is made by hand because [syscall.Accept] allocates the
-// [syscall.Sockaddr] it returns, one per accepted connection: the kernel is
-// given address storage this call owns instead, and the address is read out of
-// it into conn.
-func (l *Listener) AcceptConn(conn *Conn) error {
-	var rsa syscall.RawSockaddrAny
-	salen := uint32(unsafe.Sizeof(rsa))
-	nfd, _, errno := syscall.Syscall6(sysaccept, uintptr(l.fd),
-		uintptr(unsafe.Pointer(&rsa)), uintptr(unsafe.Pointer(&salen)), 0, 0, 0)
-	if errno != 0 {
-		return errno
-	}
-	*conn = Conn{fd: int(nfd), local: l.local}
-	if rsa.Addr.Family == syscall.AF_INET {
-		sa4 := (*syscall.RawSockaddrInet4)(unsafe.Pointer(&rsa))
-		// Port is in network byte order in the sockaddr the kernel filled.
-		port := uint16(sa4.Port<<8) | uint16(sa4.Port>>8)
-		conn.remote = Addr(netip.AddrPortFrom(netip.AddrFrom4(sa4.Addr), port))
-	}
-	return nil
-}
-
-// Addr returns the address the socket is bound to, which carries the port the
-// kernel picked when the listener was created with port zero.
-func (l *Listener) Addr() net.Addr { return l.local }
-
-// Port returns the port the socket is bound to.
-func (l *Listener) Port() uint16 { return l.local.AddrPort().Port() }
-
-// Close closes the listening socket.
-func (l *Listener) Close() error { return syscall.Close(l.fd) }

x/tls/builder.go

@@ -0,0 +1,214 @@
+package tls
+
+import (
+	"encoding/binary"
+	"unsafe"
+)
+
+// maxBuilderNest is the deepest length-prefix nesting the [Builder] supports.
+// The deepest real TLS 1.3 structure is the ClientHello key_share extension:
+// handshake body, extensions block, extension, client_shares list,
+// key_exchange. Eight leaves generous headroom.
+const maxBuilderNest = 8
+
+// Builder writes TLS wire structures into a caller-supplied buffer that never
+// grows. It exists because TLS nests length-prefixed vectors several levels
+// deep and the length of each is only known after its contents are written;
+// the standard answer, golang.org/x/crypto/cryptobyte, allocates.
+//
+// Open a length prefix, write the contents, then Close to backpatch the real
+// length:
+//
+//	var b tls.Builder
+//	b.Reset(buf)
+//	b.AddU16(uint16(tls.ExtSupportedVersions))
+//	b.OpenU16()             // extension_data length
+//	b.AddU16(tls.VersionTLS13)
+//	b.Close()
+//	out, err := b.Bytes()
+//
+// Errors are sticky: once the destination buffer overflows or the nesting is
+// misused, every later call is a no-op and [Builder.Err] reports the first
+// failure. Callers therefore need to check only once, at the end.
+//
+// The zero Builder is not usable; call [Builder.Reset] first.
+type Builder struct {
+	buf   []byte
+	stack [maxBuilderNest]int32 // offset of each open length field
+	width [maxBuilderNest]int8  // 1, 2 or 3 byte length prefix
+	n     int8                  // open prefix count
+	err   error
+}
+
+// Reset prepares the Builder to write into dst, discarding any previous state
+// and error. The Builder writes into dst[:0] and never reallocates, so dst's
+// capacity is a hard ceiling on the structure being built.
+func (b *Builder) Reset(dst []byte) {
+	b.buf = dst[:0]
+	b.n = 0
+	b.err = nil
+}
+
+// Err returns the first error encountered since [Builder.Reset], if any.
+func (b *Builder) Err() error { return b.err }
+
+// Len returns the number of bytes written so far, including the placeholder
+// bytes of any currently open length prefix.
+func (b *Builder) Len() int { return len(b.buf) }
+
+// Bytes returns the built structure. It reports an error if the Builder failed
+// at any point, or if a length prefix was opened and never closed, since the
+// resulting bytes would contain an unpatched placeholder.
+func (b *Builder) Bytes() ([]byte, error) {
+	if b.err != nil {
+		return nil, b.err
+	}
+	if b.n != 0 {
+		return nil, errBuilderUnbal
+	}
+	return b.buf, nil
+}
+
+// fail records err if no error has been recorded yet.
+func (b *Builder) fail(err error) {
+	if b.err == nil {
+		b.err = err
+	}
+}
+
+// grow extends the buffer by n bytes and returns the new region, or nil if the
+// buffer is full or the Builder has already failed.
+func (b *Builder) grow(n int) []byte {
+	if b.err != nil {
+		return nil
+	}
+	if n > cap(b.buf)-len(b.buf) {
+		b.fail(errShortBuffer)
+		return nil
+	}
+	start := len(b.buf)
+	b.buf = b.buf[:start+n]
+	return b.buf[start:]
+}
+
+// AddU8 appends a single byte.
+func (b *Builder) AddU8(v uint8) {
+	if p := b.grow(1); p != nil {
+		p[0] = v
+	}
+}
+
+// AddU16 appends a big-endian uint16.
+func (b *Builder) AddU16(v uint16) {
+	if p := b.grow(2); p != nil {
+		binary.BigEndian.PutUint16(p, v)
+	}
+}
+
+// AddU24 appends a big-endian 24-bit value, the length encoding used by
+// handshake message headers and certificate entries.
+func (b *Builder) AddU24(v uint32) {
+	if p := b.grow(3); p != nil {
+		p[0] = byte(v >> 16)
+		p[1] = byte(v >> 8)
+		p[2] = byte(v)
+	}
+}
+
+// AddU32 appends a big-endian uint32.
+func (b *Builder) AddU32(v uint32) {
+	if p := b.grow(4); p != nil {
+		binary.BigEndian.PutUint32(p, v)
+	}
+}
+
+// AddBytes appends raw bytes.
+func (b *Builder) AddBytes(v []byte) {
+	if p := b.grow(len(v)); p != nil {
+		copy(p, v)
+	}
+}
+
+// AddString appends the bytes of s without allocating. TLS labels and ALPN
+// protocol names are naturally string constants, and converting them with
+// []byte(s) would copy to the heap on every call.
+func (b *Builder) AddString(s string) {
+	if len(s) == 0 {
+		return
+	}
+	// unsafe.Slice over the string's backing array; the bytes are only read,
+	// and only for the duration of the copy inside AddBytes.
+	b.AddBytes(unsafe.Slice(unsafe.StringData(s), len(s)))
+}
+
+// openN reserves width bytes for a length prefix whose value is filled in by
+// the matching [Builder.Close].
+func (b *Builder) openN(width int8) {
+	if b.err != nil {
+		return
+	}
+	if int(b.n) >= maxBuilderNest {
+		b.fail(errBuilderNest)
+		return
+	}
+	start := len(b.buf)
+	if b.grow(int(width)) == nil {
+		return
+	}
+	b.stack[b.n] = int32(start)
+	b.width[b.n] = width
+	b.n++
+}
+
+// OpenU8 begins a vector with a one-byte length prefix.
+func (b *Builder) OpenU8() { b.openN(1) }
+
+// OpenU16 begins a vector with a two-byte length prefix.
+func (b *Builder) OpenU16() { b.openN(2) }
+
+// OpenU24 begins a vector with a three-byte length prefix, as used by the
+// handshake message header.
+func (b *Builder) OpenU24() { b.openN(3) }
+
+// Close ends the innermost open vector and backpatches its length prefix with
+// the number of bytes written since the matching Open.
+//
+// A length that does not fit the reserved prefix width is a failure rather
+// than a silent truncation: writing a value modulo 2^16 into a two-byte prefix
+// would produce a structurally valid but semantically wrong record.
+func (b *Builder) Close() {
+	if b.err != nil {
+		return
+	}
+	if b.n == 0 {
+		b.fail(errBuilderUnbal)
+		return
+	}
+	b.n--
+	start := int(b.stack[b.n])
+	width := int(b.width[b.n])
+	n := len(b.buf) - start - width
+	p := b.buf[start:]
+	switch width {
+	case 1:
+		if n > 0xff {
+			b.fail(errBadLength)
+			return
+		}
+		p[0] = byte(n)
+	case 2:
+		if n > 0xffff {
+			b.fail(errBadLength)
+			return
+		}
+		binary.BigEndian.PutUint16(p, uint16(n))
+	case 3:
+		if n > 0xffffff {
+			b.fail(errBadLength)
+			return
+		}
+		p[0] = byte(n >> 16)
+		p[1] = byte(n >> 8)
+		p[2] = byte(n)
+	}
+}

x/tls/builder_test.go

@@ -0,0 +1,240 @@
+package tls_test
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/soypat/lneto"
+	"github.com/soypat/lneto/x/tls"
+)
+
+// buildSupportedVersions writes the extension a TLS 1.3 ServerHello carries,
+// exercising one level of nesting.
+func buildSupportedVersions(b *tls.Builder) {
+	b.AddU16(uint16(tls.ExtSupportedVersions))
+	b.OpenU16()
+	b.AddU16(tls.VersionTLS13)
+	b.Close()
+}
+
+func TestBuilderRoundTripThroughParser(t *testing.T) {
+	// Build a ServerHello extensions block, then walk it back with the parser.
+	// Agreement between the two is the property that matters.
+	var b tls.Builder
+	buf := make([]byte, 64)
+	b.Reset(buf)
+	b.OpenU16() // extensions block length
+	buildSupportedVersions(&b)
+	b.AddU16(uint16(tls.ExtKeyShare))
+	b.OpenU16()
+	b.AddU16(uint16(tls.GroupX25519)) // server form: one entry, no list prefix
+	b.OpenU16()
+	b.AddBytes(make([]byte, 8))
+	b.Close()
+	b.Close()
+	b.Close()
+
+	out, err := b.Bytes()
+	if err != nil {
+		t.Fatal(err)
+	}
+	// Strip the outer block length the way ServerHelloMsg.ExtensionBytes does.
+	if len(out) < 2 {
+		t.Fatal("output too short")
+	}
+	exts := out[2:]
+	if int(out[0])<<8|int(out[1]) != len(exts) {
+		t.Fatalf("outer length %d != %d", int(out[0])<<8|int(out[1]), len(exts))
+	}
+
+	list, err := tls.ParseServerExtensions(exts, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var seen []tls.ExtensionType
+	for _, ext := range list.All {
+		seen = append(seen, ext.Type())
+		if ext.Type() != tls.ExtKeyShare {
+			continue
+		}
+		for _, ks := range ext.KeyShares {
+			if ks.Group != tls.GroupX25519 || len(ks.Key) != 8 {
+				t.Errorf("key share got %v len %d", ks.Group, len(ks.Key))
+			}
+		}
+	}
+	if len(seen) != 2 || seen[0] != tls.ExtSupportedVersions || seen[1] != tls.ExtKeyShare {
+		t.Errorf("walked %v", seen)
+	}
+}
+
+func TestBuilderStickyShortBuffer(t *testing.T) {
+	var b tls.Builder
+	b.Reset(make([]byte, 4))
+	b.AddU32(0x01020304) // exactly fills
+	if b.Err() != nil {
+		t.Fatalf("unexpected error filling buffer: %v", b.Err())
+	}
+	b.AddU8(0xff) // overflows
+	if !errors.Is(b.Err(), lneto.ErrShortBuffer) {
+		t.Fatalf("got %v want ErrShortBuffer", b.Err())
+	}
+	// Once failed, later writes must not panic, must not write, and must not
+	// replace the original error.
+	b.AddBytes(make([]byte, 100))
+	b.OpenU16()
+	b.Close()
+	if !errors.Is(b.Err(), lneto.ErrShortBuffer) {
+		t.Fatalf("error changed to %v", b.Err())
+	}
+	if _, err := b.Bytes(); !errors.Is(err, lneto.ErrShortBuffer) {
+		t.Fatalf("Bytes returned %v", err)
+	}
+}
+
+func TestBuilderUnclosedPrefixIsAnError(t *testing.T) {
+	// Returning bytes with an unpatched placeholder would emit a structurally
+	// wrong record that looks valid.
+	var b tls.Builder
+	b.Reset(make([]byte, 16))
+	b.OpenU16()
+	b.AddU8(1)
+	if _, err := b.Bytes(); err == nil {
+		t.Error("Bytes accepted an unclosed length prefix")
+	}
+}
+
+func TestBuilderUnbalancedClose(t *testing.T) {
+	var b tls.Builder
+	b.Reset(make([]byte, 16))
+	b.Close()
+	if b.Err() == nil {
+		t.Error("Close without Open accepted")
+	}
+}
+
+func TestBuilderNestingLimit(t *testing.T) {
+	var b tls.Builder
+	b.Reset(make([]byte, 64))
+	for range 8 {
+		b.OpenU8()
+	}
+	if b.Err() != nil {
+		t.Fatalf("8 levels rejected: %v", b.Err())
+	}
+	b.OpenU8()
+	if b.Err() == nil {
+		t.Error("9th nesting level accepted")
+	}
+}
+
+func TestBuilderLengthOverflowRejected(t *testing.T) {
+	// 300 bytes cannot be described by a one-byte prefix. Truncating modulo 256
+	// would produce a valid-looking but wrong structure, so this must fail.
+	var b tls.Builder
+	b.Reset(make([]byte, 512))
+	b.OpenU8()
+	b.AddBytes(make([]byte, 300))
+	b.Close()
+	if !errors.Is(b.Err(), lneto.ErrInvalidLengthField) {
+		t.Errorf("got %v want ErrInvalidLengthField", b.Err())
+	}
+}
+
+func TestBuilderU24RoundTrip(t *testing.T) {
+	var b tls.Builder
+	b.Reset(make([]byte, 8))
+	b.AddU8(byte(tls.HandshakeTypeServerHello))
+	b.OpenU24()
+	b.AddBytes([]byte{1, 2, 3})
+	b.Close()
+	out, err := b.Bytes()
+	if err != nil {
+		t.Fatal(err)
+	}
+	hf, err := tls.NewHandshakeFrame(out)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if hf.MsgType() != tls.HandshakeTypeServerHello {
+		t.Errorf("type got %v", hf.MsgType())
+	}
+	if hf.Length() != 3 {
+		t.Errorf("length got %d want 3", hf.Length())
+	}
+	if !hf.Complete() || len(hf.Body()) != 3 {
+		t.Errorf("body got % x", hf.Body())
+	}
+}
+
+func TestBuilderAddStringMatchesAddBytes(t *testing.T) {
+	const label = "tls13 derived"
+	var b1, b2 tls.Builder
+	buf1, buf2 := make([]byte, 32), make([]byte, 32)
+	b1.Reset(buf1)
+	b1.AddString(label)
+	b2.Reset(buf2)
+	b2.AddBytes([]byte(label))
+	out1, err1 := b1.Bytes()
+	out2, err2 := b2.Bytes()
+	if err1 != nil || err2 != nil {
+		t.Fatalf("%v %v", err1, err2)
+	}
+	if string(out1) != string(out2) {
+		t.Errorf("AddString %q != AddBytes %q", out1, out2)
+	}
+}
+
+func TestBuilderZeroAlloc(t *testing.T) {
+	// The whole point of not using cryptobyte. A regression here means the
+	// outbound handshake path started allocating per connection.
+	buf := make([]byte, 256)
+	var b tls.Builder
+	n := testing.AllocsPerRun(100, func() {
+		b.Reset(buf)
+		b.AddU8(byte(tls.HandshakeTypeServerHello))
+		b.OpenU24()
+		b.AddU16(tls.VersionTLS12)
+		b.AddBytes(make([]byte, 0, 0)) // no-op, must not allocate
+		b.OpenU16()
+		buildSupportedVersions(&b)
+		b.Close()
+		b.AddString("x")
+		b.Close()
+		_, _ = b.Bytes()
+	})
+	if n != 0 {
+		t.Errorf("Builder allocated %v times per run, want 0", n)
+	}
+}
+
+func FuzzBuilderNeverEscapesBuffer(f *testing.F) {
+	f.Add([]byte{1, 2, 3}, uint8(16))
+	f.Fuzz(func(t *testing.T, payload []byte, size uint8) {
+		buf := make([]byte, size)
+		canary := make([]byte, len(buf))
+		var b tls.Builder
+		b.Reset(buf)
+		b.OpenU16()
+		b.AddBytes(payload)
+		b.OpenU8()
+		b.AddBytes(payload)
+		b.Close()
+		b.Close()
+		out, err := b.Bytes()
+		if err != nil {
+			return
+		}
+		if len(out) > len(buf) {
+			t.Fatalf("wrote %d bytes into a %d byte buffer", len(out), len(buf))
+		}
+		// Whatever was produced must parse back as a well-formed vector.
+		if len(out) < 2 {
+			t.Fatalf("output %d bytes is too short to hold its own prefix", len(out))
+		}
+		if declared := int(out[0])<<8 | int(out[1]); declared != len(out)-2 {
+			t.Fatalf("declared %d != actual %d", declared, len(out)-2)
+		}
+		_ = canary
+	})
+}

x/tls/definitions.go

@@ -0,0 +1,276 @@
+// Package tls implements a heapless, preallocated TLS 1.3 server (RFC 8446).
+//
+// All buffers are supplied by the caller and never grow. There is no
+// allocation in the steady-state record datapath, no goroutines, and no
+// dependency on an operating system. A [Conn] wraps any [io.ReadWriter], so it
+// works over a lneto tcp.Conn, over net.Pipe, or over a bytes.Buffer in tests.
+//
+// # Scope
+//
+// TLS 1.3 only. There is deliberately no TLS 1.2 fallback, no renegotiation,
+// no 0-RTT/early data, and no client certificate support. Each omission
+// removes a whole class of attack surface.
+//
+// # Cryptographic primitives
+//
+// This package implements the record layer, the key schedule and the handshake
+// state machine, but ships no cryptographic primitives of its own. Concrete
+// hashes, AEADs, key agreements and signers cross the [Hasher], [AEADSuite],
+// [KeyAgreement] and [Signer] interfaces. Standard library implementations
+// live in the tlsstd subpackage; a hardware AEAD or a secure-element signer
+// slots in at the same seam without protocol code changing.
+//
+// Note that on embedded targets the Signer is expected to be supplied by the
+// integrator: Go's crypto/ecdsa carries an 88kB precomputed P-256 basepoint
+// table that lands in RAM, which is a third of an RP2040's SRAM.
+//
+// # Randomness
+//
+// Config.Rand is required and has no default. Embedded targets frequently have
+// a weak or stubbed entropy source, and a biased ECDSA nonce recovers the
+// signing key from two signatures, so the choice is made explicit rather than
+// silently defaulted. Never seed anything here from internal.Prand32/64; those
+// are for TCP initial sequence numbers and DNS IDs, not for key material.
+package tls
+
+import (
+	"errors"
+
+	"github.com/soypat/lneto"
+)
+
+// Sizes of fixed length headers and the record size limits of RFC 8446 5.2.
+const (
+	// SizeHeaderRecord is the size of a TLSPlaintext/TLSCiphertext header:
+	// content type(1) + legacy record version(2) + length(2).
+	SizeHeaderRecord = 5
+	// SizeHeaderHandshake is the size of a Handshake header:
+	// message type(1) + 24-bit length(3).
+	SizeHeaderHandshake = 4
+
+	// MaxPlaintext is the largest legal TLSPlaintext.fragment.
+	MaxPlaintext = 1 << 14 // 16384
+	// MaxCiphertext is the largest legal TLSCiphertext.encrypted_record.
+	// The extra 256 bytes cover the content type byte, padding and the AEAD tag.
+	MaxCiphertext = 1<<14 + 256 // 16640
+	// MaxRecord is the largest legal record as it appears on the wire.
+	MaxRecord = SizeHeaderRecord + MaxCiphertext // 16645
+
+	// MinRecordSizeLimit is the smallest value a peer may advertise in the
+	// record_size_limit extension of RFC 8449 4.
+	MinRecordSizeLimit = 64
+)
+
+//go:generate stringer -type=ContentType,HandshakeType,ExtensionType,AlertDescription,AlertLevel,NamedGroup,SignatureScheme,CipherSuite -linecomment -output stringers.go .
+
+// ContentType is the outermost record demultiplexing tag of RFC 8446 5.1.
+type ContentType uint8
+
+// Record content types. Values below are the only ones TLS 1.3 defines;
+// everything else must be rejected with an unexpected_message alert.
+const (
+	ContentTypeInvalid          ContentType = 0  // invalid
+	ContentTypeChangeCipherSpec ContentType = 20 // change_cipher_spec
+	ContentTypeAlert            ContentType = 21 // alert
+	ContentTypeHandshake        ContentType = 22 // handshake
+	ContentTypeApplicationData  ContentType = 23 // application_data
+)
+
+// HandshakeType identifies a handshake message, RFC 8446 4.
+type HandshakeType uint8
+
+// Handshake message types. Types this server never sends or accepts are still
+// listed so that a peer sending one can be logged and rejected precisely.
+const (
+	HandshakeTypeClientHello         HandshakeType = 1   // client_hello
+	HandshakeTypeServerHello         HandshakeType = 2   // server_hello
+	HandshakeTypeNewSessionTicket    HandshakeType = 4   // new_session_ticket
+	HandshakeTypeEndOfEarlyData      HandshakeType = 5   // end_of_early_data
+	HandshakeTypeEncryptedExtensions HandshakeType = 8   // encrypted_extensions
+	HandshakeTypeCertificate         HandshakeType = 11  // certificate
+	HandshakeTypeCertificateRequest  HandshakeType = 13  // certificate_request
+	HandshakeTypeCertificateVerify   HandshakeType = 15  // certificate_verify
+	HandshakeTypeFinished            HandshakeType = 20  // finished
+	HandshakeTypeKeyUpdate           HandshakeType = 24  // key_update
+	HandshakeTypeMessageHash         HandshakeType = 254 // message_hash
+)
+
+// ExtensionType identifies a hello extension, RFC 8446 4.2.
+type ExtensionType uint16
+
+// Extension types. Those marked "ignored" are ones a browser sends and this
+// server parses past without erroring; being strict about unknown extensions
+// breaks real clients.
+const (
+	ExtServerName                 ExtensionType = 0     // server_name
+	ExtMaxFragmentLength          ExtensionType = 1     // max_fragment_length
+	ExtStatusRequest              ExtensionType = 5     // status_request
+	ExtSupportedGroups            ExtensionType = 10    // supported_groups
+	ExtECPointFormats             ExtensionType = 11    // ec_point_formats
+	ExtSignatureAlgorithms        ExtensionType = 13    // signature_algorithms
+	ExtALPN                       ExtensionType = 16    // application_layer_protocol_negotiation
+	ExtSignedCertificateTimestamp ExtensionType = 18    // signed_certificate_timestamp
+	ExtPadding                    ExtensionType = 21    // padding
+	ExtExtendedMasterSecret       ExtensionType = 23    // extended_master_secret
+	ExtCompressCertificate        ExtensionType = 27    // compress_certificate
+	ExtRecordSizeLimit            ExtensionType = 28    // record_size_limit
+	ExtSessionTicket              ExtensionType = 35    // session_ticket
+	ExtPreSharedKey               ExtensionType = 41    // pre_shared_key
+	ExtEarlyData                  ExtensionType = 42    // early_data
+	ExtSupportedVersions          ExtensionType = 43    // supported_versions
+	ExtCookie                     ExtensionType = 44    // cookie
+	ExtPSKKeyExchangeModes        ExtensionType = 45    // psk_key_exchange_modes
+	ExtCertificateAuthorities     ExtensionType = 47    // certificate_authorities
+	ExtSignatureAlgorithmsCert    ExtensionType = 50    // signature_algorithms_cert
+	ExtKeyShare                   ExtensionType = 51    // key_share
+	ExtApplicationSettings        ExtensionType = 17513 // application_settings
+	ExtEncryptedClientHello       ExtensionType = 65037 // encrypted_client_hello
+	ExtRenegotiationInfo          ExtensionType = 65281 // renegotiation_info
+)
+
+// AlertLevel is the legacy severity byte of an alert. In TLS 1.3 every alert
+// except close_notify and user_canceled is fatal regardless of this field
+// (RFC 8446 6.1), so it is carried for wire compatibility only and must never
+// be used to decide whether to continue.
+type AlertLevel uint8
+
+// Alert levels.
+const (
+	AlertLevelWarning AlertLevel = 1 // warning
+	AlertLevelFatal   AlertLevel = 2 // fatal
+)
+
+// AlertDescription is the alert code of RFC 8446 6.
+type AlertDescription uint8
+
+// Alert descriptions. Only the subset a TLS 1.3 server can legitimately send
+// or receive is listed.
+const (
+	AlertCloseNotify                  AlertDescription = 0   // close_notify
+	AlertUnexpectedMessage            AlertDescription = 10  // unexpected_message
+	AlertBadRecordMAC                 AlertDescription = 20  // bad_record_mac
+	AlertRecordOverflow               AlertDescription = 22  // record_overflow
+	AlertHandshakeFailure             AlertDescription = 40  // handshake_failure
+	AlertBadCertificate               AlertDescription = 42  // bad_certificate
+	AlertUnsupportedCertificate       AlertDescription = 43  // unsupported_certificate
+	AlertCertificateRevoked           AlertDescription = 44  // certificate_revoked
+	AlertCertificateExpired           AlertDescription = 45  // certificate_expired
+	AlertCertificateUnknown           AlertDescription = 46  // certificate_unknown
+	AlertIllegalParameter             AlertDescription = 47  // illegal_parameter
+	AlertUnknownCA                    AlertDescription = 48  // unknown_ca
+	AlertAccessDenied                 AlertDescription = 49  // access_denied
+	AlertDecodeError                  AlertDescription = 50  // decode_error
+	AlertDecryptError                 AlertDescription = 51  // decrypt_error
+	AlertProtocolVersion              AlertDescription = 70  // protocol_version
+	AlertInsufficientSecurity         AlertDescription = 71  // insufficient_security
+	AlertInternalError                AlertDescription = 80  // internal_error
+	AlertInappropriateFallback        AlertDescription = 86  // inappropriate_fallback
+	AlertUserCanceled                 AlertDescription = 90  // user_canceled
+	AlertMissingExtension             AlertDescription = 109 // missing_extension
+	AlertUnsupportedExtension         AlertDescription = 110 // unsupported_extension
+	AlertUnrecognizedName             AlertDescription = 112 // unrecognized_name
+	AlertBadCertificateStatusResponse AlertDescription = 113 // bad_certificate_status_response
+	AlertUnknownPSKIdentity           AlertDescription = 115 // unknown_psk_identity
+	AlertCertificateRequired          AlertDescription = 116 // certificate_required
+	AlertNoApplicationProtocol        AlertDescription = 120 // no_application_protocol
+)
+
+// Protocol versions as they appear on the wire.
+const (
+	// VersionTLS12 is the value TLS 1.3 requires in ClientHello.legacy_version
+	// and in ServerHello.legacy_version for middlebox compatibility.
+	VersionTLS12 uint16 = 0x0303
+	// VersionTLS13 is the real negotiated version, carried only in the
+	// supported_versions extension.
+	VersionTLS13 uint16 = 0x0304
+	// VersionTLS10 appears in the legacy_record_version of an initial
+	// ClientHello record. The field is ignored entirely on receipt.
+	VersionTLS10 uint16 = 0x0301
+)
+
+// NamedGroup identifies a key exchange group, RFC 8446 4.2.7.
+type NamedGroup uint16
+
+// Named groups. Only X25519 is implemented; the rest are recognized so that
+// group selection and HelloRetryRequest can report precisely what was offered.
+const (
+	GroupSECP256R1      NamedGroup = 0x0017 // secp256r1
+	GroupSECP384R1      NamedGroup = 0x0018 // secp384r1
+	GroupSECP521R1      NamedGroup = 0x0019 // secp521r1
+	GroupX25519         NamedGroup = 0x001d // x25519
+	GroupX448           NamedGroup = 0x001e // x448
+	GroupX25519MLKEM768 NamedGroup = 0x11ec // x25519mlkem768
+)
+
+// SignatureScheme identifies a signature algorithm, RFC 8446 4.2.3.
+type SignatureScheme uint16
+
+// Signature schemes. Browsers do not accept Ed25519 certificates, so
+// [SigECDSAP256SHA256] is the practical minimum for a public-facing server.
+const (
+	SigRSAPKCS1SHA256   SignatureScheme = 0x0401 // rsa_pkcs1_sha256
+	SigRSAPKCS1SHA384   SignatureScheme = 0x0501 // rsa_pkcs1_sha384
+	SigRSAPKCS1SHA512   SignatureScheme = 0x0601 // rsa_pkcs1_sha512
+	SigECDSAP256SHA256  SignatureScheme = 0x0403 // ecdsa_secp256r1_sha256
+	SigECDSAP384SHA384  SignatureScheme = 0x0503 // ecdsa_secp384r1_sha384
+	SigECDSAP521SHA512  SignatureScheme = 0x0603 // ecdsa_secp521r1_sha512
+	SigRSAPSSRSAESHA256 SignatureScheme = 0x0804 // rsa_pss_rsae_sha256
+	SigRSAPSSRSAESHA384 SignatureScheme = 0x0805 // rsa_pss_rsae_sha384
+	SigRSAPSSRSAESHA512 SignatureScheme = 0x0806 // rsa_pss_rsae_sha512
+	SigEd25519          SignatureScheme = 0x0807 // ed25519
+	SigRSAPSSPSSSHA256  SignatureScheme = 0x0809 // rsa_pss_pss_sha256
+)
+
+// CipherSuite identifies an AEAD plus hash pair, RFC 8446 B.4.
+type CipherSuite uint16
+
+// TLS 1.3 cipher suites. Only [SuiteAES128GCMSHA256] is implemented; it is the
+// one suite RFC 8446 9.1 makes mandatory to implement.
+const (
+	SuiteAES128GCMSHA256        CipherSuite = 0x1301 // TLS_AES_128_GCM_SHA256
+	SuiteAES256GCMSHA384        CipherSuite = 0x1302 // TLS_AES_256_GCM_SHA384
+	SuiteChaCha20Poly1305SHA256 CipherSuite = 0x1303 // TLS_CHACHA20_POLY1305_SHA256
+	SuiteAES128CCMSHA256        CipherSuite = 0x1304 // TLS_AES_128_CCM_SHA256
+	SuiteAES128CCM8SHA256       CipherSuite = 0x1305 // TLS_AES_128_CCM_8_SHA256
+)
+
+// IsGREASE reports whether v is one of the 16 reserved GREASE values of
+// RFC 8701. Chrome injects GREASE values into its offered cipher suites,
+// supported groups, extensions, ALPN protocol list and key shares. They carry
+// no meaning and must be skipped wherever they appear; rejecting them breaks
+// Chrome outright.
+//
+// GREASE values have both bytes equal and of the form 0x?a.
+func IsGREASE(v uint16) bool {
+	return v&0x0f0f == 0x0a0a && v>>8 == v&0xff
+}
+
+// ErrNeedMore is returned by incremental parsers and by the record layer when
+// the input available so far is a valid prefix but not yet a complete unit. It
+// is not a failure: the caller should retry once more data has arrived.
+//
+// It is deliberately distinct from [lneto.ErrTruncatedFrame], which means the
+// data is complete but malformed.
+var ErrNeedMore = errors.New("tls: need more data")
+
+// ErrUnexpectedClose is returned by Conn.Read when the underlying transport
+// reached EOF before a close_notify alert was received. Returning io.EOF here
+// instead would let an attacker who can inject a TCP FIN or RST silently
+// truncate a response or a request body. Callers must treat this as a failure
+// unless the application layer has independently confirmed the message was
+// complete, for example by satisfying a Content-Length.
+var ErrUnexpectedClose = errors.New("tls: connection closed without close_notify")
+
+// Errors reported by frame constructors and walkers. These reuse the generic
+// lneto error set so that callers can compare against a single vocabulary.
+var (
+	errTruncated        error = lneto.ErrTruncatedFrame
+	errShortBuffer      error = lneto.ErrShortBuffer
+	errBadLength        error = lneto.ErrInvalidLengthField
+	errBadField         error = lneto.ErrInvalidField
+	errUnsupported      error = lneto.ErrUnsupported
+	errTrailingBytes          = errors.New("tls: trailing bytes after structure")
+	errBuilderNest            = errors.New("tls: builder nesting depth exceeded")
+	errBuilderUnbal           = errors.New("tls: builder length prefix unbalanced")
+	errAllZeroPlaintext       = errors.New("tls: inner plaintext is all padding")
+)

x/tls/extension.go

@@ -0,0 +1,458 @@
+package tls
+
+import (
+	"encoding/binary"
+
+	"github.com/soypat/lneto"
+)
+
+// Iterators in this package have the signature of an [iter.Seq2] instead of
+// returning one, so they are ranged over as a method value without a call:
+//
+//	for off, ext := range list.All {
+//		for off, ks := range ext.KeyShares {
+//		}
+//	}
+//
+// A method value bound to a receiver stays on the caller's stack, while a
+// closure returned from a method escapes to the heap. The int key is always the
+// item's offset within the enclosing message body, and nested iterators inherit
+// that base, so a decoder never has to add up prefix widths.
+//
+// Every length prefix was checked when the message was parsed, so no iterator
+// can fail and none returns an error.
+
+// ExtensionFrame provides access to a single hello extension (RFC 8446 4.2):
+//
+//	struct {
+//	    ExtensionType extension_type; // 2 bytes
+//	    opaque extension_data<0..2^16-1>;
+//	} Extension;
+//
+// The lists nested inside an extension are reached with the iterators below,
+// each of which walks only its own extension type.
+type ExtensionFrame struct {
+	buf []byte
+	// base is where buf starts within the enclosing message body.
+	base int
+	// server records that this came from a server hello. The server forms of
+	// key_share and supported_versions carry a single value, not a list.
+	server bool
+}
+
+// NewExtensionFrame wraps buf as an [ExtensionFrame]. It checks the extension's
+// own framing but not the structure nested inside extension_data; prefer
+// [ParseClientExtensions] or [ParseServerExtensions], which check both.
+func NewExtensionFrame(buf []byte) (ExtensionFrame, error) {
+	return newExtensionFrame(buf, 0, false)
+}
+
+func newExtensionFrame(buf []byte, base int, server bool) (ExtensionFrame, error) {
+	if len(buf) < 4 {
+		return ExtensionFrame{}, lneto.ErrTruncatedFrame
+	}
+	n := int(binary.BigEndian.Uint16(buf[2:4]))
+	if 4+n > len(buf) {
+		return ExtensionFrame{}, lneto.ErrTruncatedFrame
+	}
+	return ExtensionFrame{buf: buf[:4+n], base: base, server: server}, nil
+}
+
+// Type returns the extension type.
+func (ef ExtensionFrame) Type() ExtensionType {
+	return ExtensionType(binary.BigEndian.Uint16(ef.buf[0:2]))
+}
+
+// Length returns the declared extension_data length.
+func (ef ExtensionFrame) Length() uint16 {
+	return binary.BigEndian.Uint16(ef.buf[2:4])
+}
+
+// Data returns the extension_data bytes.
+func (ef ExtensionFrame) Data() []byte { return ef.buf[4:] }
+
+// RawData returns the extension bytes, type and length included.
+func (ef ExtensionFrame) RawData() []byte { return ef.buf }
+
+// DataOffset is where Data starts within the enclosing message body.
+func (ef ExtensionFrame) DataOffset() int { return ef.base + 4 }
+
+// ExtensionList is an extensions block whose framing has been checked, down to
+// the lists inside the extensions this package recognizes.
+type ExtensionList struct {
+	buf    []byte
+	base   int
+	server bool
+}
+
+// ParseClientExtensions validates a ClientHello extensions block. exts is the
+// block contents with the outer two-byte length already stripped, and base is
+// where exts starts within the enclosing message body.
+//
+// Unknown extension types, GREASE among them, are accepted and left unchecked.
+// A repeated known type is rejected with [lneto.ErrInvalidField]: RFC 8446 4.2
+// forbids duplicates, and tolerating them lets this parser and a middlebox act
+// on different copies.
+func ParseClientExtensions(exts []byte, base int) (ExtensionList, error) {
+	return parseExtensions(exts, base, false)
+}
+
+// ParseServerExtensions validates a ServerHello extensions block. It differs
+// from [ParseClientExtensions] in the key_share and supported_versions forms.
+func ParseServerExtensions(exts []byte, base int) (ExtensionList, error) {
+	return parseExtensions(exts, base, true)
+}
+
+func parseExtensions(exts []byte, base int, server bool) (ExtensionList, error) {
+	var seen extSeen
+	for off := 0; off < len(exts); {
+		ef, err := newExtensionFrame(exts[off:], base+off, server)
+		if err != nil {
+			return ExtensionList{}, err
+		}
+		if seen.mark(ef.Type()) {
+			return ExtensionList{}, lneto.ErrInvalidField
+		}
+		err = ef.validate()
+		if err != nil {
+			return ExtensionList{}, err
+		}
+		off += len(ef.RawData())
+	}
+	return ExtensionList{buf: exts, base: base, server: server}, nil
+}
+
+// All iterates the extensions in wire order, keyed by the offset of each
+// extension's data within the enclosing message body.
+func (l ExtensionList) All(yield func(off int, ext ExtensionFrame) bool) {
+	for off := 0; off < len(l.buf); {
+		ef, err := newExtensionFrame(l.buf[off:], l.base+off, l.server)
+		if err != nil {
+			return // Framing was checked at parse.
+		}
+		if !yield(ef.DataOffset(), ef) {
+			return
+		}
+		off += len(ef.RawData())
+	}
+}
+
+// Bytes returns the block contents.
+func (l ExtensionList) Bytes() []byte { return l.buf }
+
+// validate checks the structure nested inside extension_data for the types this
+// package walks. The switch mirrors the iterators below: an extension with no
+// iterator has no shape to check here.
+func (ef ExtensionFrame) validate() error {
+	data := ef.Data()
+	switch ef.Type() {
+	case ExtServerName:
+		return validateServerNames(data)
+	case ExtALPN:
+		return validateALPN(data)
+	case ExtSupportedGroups, ExtSignatureAlgorithms, ExtSignatureAlgorithmsCert:
+		body, err := vectorU16(data)
+		if err != nil {
+			return err
+		}
+		return validateU16List(body)
+	case ExtSupportedVersions:
+		if ef.server {
+			return validateU16List(data) // Bare uint16.
+		}
+		body, err := vectorU8(data)
+		if err != nil {
+			return err
+		}
+		return validateU16List(body)
+	case ExtKeyShare:
+		return ef.validateKeyShare()
+	}
+	return nil
+}
+
+func validateU16List(b []byte) error {
+	if len(b)%2 != 0 {
+		return lneto.ErrInvalidLengthField
+	}
+	return nil
+}
+
+func validateServerNames(data []byte) error {
+	body, err := vectorU16(data)
+	if err != nil {
+		return err
+	}
+	for off := 0; off < len(body); {
+		if len(body)-off < 3 {
+			return lneto.ErrTruncatedFrame
+		}
+		n := int(binary.BigEndian.Uint16(body[off+1 : off+3]))
+		off += 3
+		if n > len(body)-off {
+			return lneto.ErrTruncatedFrame
+		}
+		off += n
+	}
+	return nil
+}
+
+func validateALPN(data []byte) error {
+	body, err := vectorU16(data)
+	if err != nil {
+		return err
+	}
+	for off := 0; off < len(body); {
+		n := int(body[off])
+		off++
+		if n == 0 {
+			// A zero-length name would make a walk unable to advance.
+			return lneto.ErrInvalidLengthField
+		} else if n > len(body)-off {
+			return lneto.ErrTruncatedFrame
+		}
+		off += n
+	}
+	return nil
+}
+
+func (ef ExtensionFrame) validateKeyShare() error {
+	data := ef.Data()
+	if ef.server {
+		// A ServerHello names one group and its key; a HelloRetryRequest names
+		// only the group.
+		if len(data) == 2 {
+			return nil
+		}
+		return validateKeyShareEntries(data)
+	}
+	body, err := vectorU16(data)
+	if err != nil {
+		return err
+	}
+	return validateKeyShareEntries(body)
+}
+
+func validateKeyShareEntries(b []byte) error {
+	for off := 0; off < len(b); {
+		if len(b)-off < 4 {
+			return lneto.ErrTruncatedFrame
+		}
+		n := int(binary.BigEndian.Uint16(b[off+2 : off+4]))
+		off += 4
+		if n > len(b)-off {
+			return lneto.ErrTruncatedFrame
+		}
+		off += n
+	}
+	return nil
+}
+
+// KeyShare is one KeyShareEntry of a key_share extension:
+//
+//	struct {
+//	    NamedGroup group;
+//	    opaque key_exchange<1..2^16-1>;
+//	} KeyShareEntry;
+//
+// A HelloRetryRequest names a group with no key, so Key may be empty. GREASE
+// key shares carry a deliberately absurd key, commonly one byte, so no length
+// constraint is placed on Key beyond fitting inside the extension.
+type KeyShare struct {
+	Group NamedGroup
+	Key   []byte
+}
+
+// ServerName is one entry of an SNI server_name_list. Type 0 is host_name, the
+// only type ever defined.
+type ServerName struct {
+	Type uint8
+	Name []byte
+}
+
+// KeyShares iterates the key shares of a key_share extension, in the client or
+// server form as the enclosing hello requires, keyed by the offset of the
+// key_exchange bytes. Yields nothing for any other extension type.
+func (ef ExtensionFrame) KeyShares(yield func(off int, ks KeyShare) bool) {
+	if ef.Type() != ExtKeyShare {
+		return
+	}
+	body, base := ef.Data(), ef.DataOffset()
+	if ef.server {
+		if len(body) == 2 { // HelloRetryRequest: selected_group only.
+			yield(base, KeyShare{Group: NamedGroup(binary.BigEndian.Uint16(body))})
+			return
+		}
+	} else {
+		b, err := vectorU16(body)
+		if err != nil {
+			return
+		}
+		body, base = b, base+2
+	}
+	for off := 0; off+4 <= len(body); {
+		group := NamedGroup(binary.BigEndian.Uint16(body[off : off+2]))
+		n := int(binary.BigEndian.Uint16(body[off+2 : off+4]))
+		off += 4
+		if n > len(body)-off {
+			return
+		}
+		if !yield(base+off, KeyShare{Group: group, Key: body[off : off+n]}) {
+			return
+		}
+		off += n
+	}
+}
+
+// ServerNames iterates the server_name_list of an SNI extension, keyed by the
+// offset of the name. Yields nothing for any other extension type.
+func (ef ExtensionFrame) ServerNames(yield func(off int, name ServerName) bool) {
+	if ef.Type() != ExtServerName {
+		return
+	}
+	body, err := vectorU16(ef.Data())
+	if err != nil {
+		return
+	}
+	base := ef.DataOffset() + 2
+	for off := 0; off+3 <= len(body); {
+		nameType := body[off]
+		n := int(binary.BigEndian.Uint16(body[off+1 : off+3]))
+		off += 3
+		if n > len(body)-off {
+			return
+		}
+		if !yield(base+off, ServerName{Type: nameType, Name: body[off : off+n]}) {
+			return
+		}
+		off += n
+	}
+}
+
+// ALPNProtos iterates the protocol names of an ALPN extension, keyed by the
+// offset of the name. Chrome includes a GREASE entry here, so callers must match
+// against their own offer list rather than assuming the first name is
+// meaningful. Yields nothing for any other extension type.
+func (ef ExtensionFrame) ALPNProtos(yield func(off int, proto []byte) bool) {
+	if ef.Type() != ExtALPN {
+		return
+	}
+	body, err := vectorU16(ef.Data())
+	if err != nil {
+		return
+	}
+	base := ef.DataOffset() + 2
+	for off := 0; off < len(body); {
+		n := int(body[off])
+		off++
+		if n == 0 || n > len(body)-off {
+			return
+		}
+		if !yield(base+off, body[off:off+n]) {
+			return
+		}
+		off += n
+	}
+}
+
+// SupportedVersions iterates a supported_versions extension. The ClientHello
+// form is a list behind a one-byte prefix, unlike every other hello list; the
+// ServerHello form is a bare uint16, which yields a single value. Yields nothing
+// for any other extension type.
+func (ef ExtensionFrame) SupportedVersions(yield func(off int, version uint16) bool) {
+	if ef.Type() != ExtSupportedVersions {
+		return
+	}
+	body, base := ef.Data(), ef.DataOffset()
+	if !ef.server {
+		b, err := vectorU8(body)
+		if err != nil {
+			return
+		}
+		body, base = b, base+1
+	}
+	for off := 0; off+2 <= len(body); off += 2 {
+		if !yield(base+off, binary.BigEndian.Uint16(body[off:off+2])) {
+			return
+		}
+	}
+}
+
+// SupportedGroups iterates a supported_groups extension, keyed by the group's
+// offset. Yields nothing for any other extension type.
+func (ef ExtensionFrame) SupportedGroups(yield func(off int, group NamedGroup) bool) {
+	body, base, ok := ef.u16Vector(ExtSupportedGroups)
+	if !ok {
+		return
+	}
+	for off := 0; off+2 <= len(body); off += 2 {
+		if !yield(base+off, NamedGroup(binary.BigEndian.Uint16(body[off:off+2]))) {
+			return
+		}
+	}
+}
+
+// SignatureSchemes iterates a signature_algorithms or signature_algorithms_cert
+// extension, keyed by the scheme's offset. Yields nothing for any other type.
+func (ef ExtensionFrame) SignatureSchemes(yield func(off int, scheme SignatureScheme) bool) {
+	want := ef.Type()
+	if want != ExtSignatureAlgorithms && want != ExtSignatureAlgorithmsCert {
+		return
+	}
+	body, base, ok := ef.u16Vector(want)
+	if !ok {
+		return
+	}
+	for off := 0; off+2 <= len(body); off += 2 {
+		if !yield(base+off, SignatureScheme(binary.BigEndian.Uint16(body[off:off+2]))) {
+			return
+		}
+	}
+}
+
+// u16Vector returns the contents of a two-byte-prefixed vector and where it
+// starts within the message body, or ok false for another extension type.
+func (ef ExtensionFrame) u16Vector(want ExtensionType) (body []byte, base int, ok bool) {
+	if ef.Type() != want {
+		return nil, 0, false
+	}
+	body, err := vectorU16(ef.Data())
+	if err != nil {
+		return nil, 0, false
+	}
+	return body, ef.DataOffset() + 2, true
+}
+
+// vectorU16 strips a two-byte length prefix and returns the vector contents.
+// It requires the prefix to describe the buffer exactly: trailing bytes mean
+// the sender and this parser disagree on the structure, which is precisely the
+// ambiguity parser-differential attacks exploit.
+func vectorU16(b []byte) ([]byte, error) {
+	if len(b) < 2 {
+		return nil, lneto.ErrTruncatedFrame
+	}
+	n := int(binary.BigEndian.Uint16(b[0:2]))
+	if n != len(b)-2 {
+		if n > len(b)-2 {
+			return nil, lneto.ErrTruncatedFrame
+		}
+		return nil, errTrailingBytes
+	}
+	return b[2:], nil
+}
+
+// vectorU8 strips a one-byte length prefix. See [vectorU16] for why trailing
+// bytes are rejected.
+func vectorU8(b []byte) ([]byte, error) {
+	if len(b) < 1 {
+		return nil, lneto.ErrTruncatedFrame
+	}
+	n := int(b[0])
+	if n != len(b)-1 {
+		if n > len(b)-1 {
+			return nil, lneto.ErrTruncatedFrame
+		}
+		return nil, errTrailingBytes
+	}
+	return b[1:], nil
+}

x/tls/extension_test.go

@@ -0,0 +1,283 @@
+package tls_test
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/soypat/lneto"
+	"github.com/soypat/lneto/x/tls"
+)
+
+func TestExtensionListWalksAndToleratesGREASE(t *testing.T) {
+	// Two extensions: a GREASE type with empty data, then supported_versions.
+	exts := []byte{
+		0x0a, 0x0a, 0x00, 0x00, // GREASE, len 0
+		0x00, 0x2b, 0x00, 0x03, 0x02, 0x03, 0x04, // supported_versions
+	}
+	list, err := tls.ParseClientExtensions(exts, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var types []tls.ExtensionType
+	for off, ext := range list.All {
+		if want := 4*len(types) + 4; off != want {
+			t.Errorf("%v at offset %d want %d", ext.Type(), off, want)
+		}
+		types = append(types, ext.Type())
+	}
+	if len(types) != 2 || types[1] != tls.ExtSupportedVersions {
+		t.Fatalf("got %v", types)
+	}
+	if !tls.IsGREASE(uint16(types[0])) {
+		t.Errorf("first extension %#x not recognized as GREASE", types[0])
+	}
+}
+
+func TestParseExtensionsTruncated(t *testing.T) {
+	for _, tc := range [][]byte{
+		{0x00},                               // partial type
+		{0x00, 0x2b, 0x00},                   // partial length
+		{0x00, 0x2b, 0x00, 0x05, 0x02, 0x03}, // length overruns
+	} {
+		_, err := tls.ParseClientExtensions(tc, 0)
+		if !errors.Is(err, lneto.ErrTruncatedFrame) {
+			t.Errorf("% x: got %v want ErrTruncatedFrame", tc, err)
+		}
+	}
+}
+
+func TestParseExtensionsRejectsMalformedInnerList(t *testing.T) {
+	// Framing inside a recognized extension is checked at parse, which is what
+	// lets the iterators be error-free.
+	for _, tc := range [][]byte{
+		{0x00, 0x0a, 0x00, 0x03, 0x00, 0x01, 0x1d},             // supported_groups, odd list
+		{0x00, 0x2b, 0x00, 0x03, 0x04, 0x03, 0x04},             // supported_versions, prefix overruns
+		{0x00, 0x10, 0x00, 0x04, 0x00, 0x02, 0x00, 0x00},       // alpn, zero-length name
+		{0x00, 0x00, 0x00, 0x05, 0x00, 0x03, 0x00, 0x00, 0x09}, // server_name, name overruns
+	} {
+		if _, err := tls.ParseClientExtensions(tc, 0); err == nil {
+			t.Errorf("% x accepted", tc)
+		}
+	}
+}
+
+func TestExtensionIterationStopsOnBreak(t *testing.T) {
+	// Two extensions with no inner structure of their own.
+	exts := []byte{0x00, 0x15, 0x00, 0x00, 0x00, 0x17, 0x00, 0x00}
+	list, err := tls.ParseClientExtensions(exts, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	n := 0
+	for range list.All {
+		n++
+		break
+	}
+	if n != 1 {
+		t.Errorf("walk continued after break: %d iterations", n)
+	}
+}
+
+func TestKeySharesAcceptGREASEEntry(t *testing.T) {
+	// Chrome sends a GREASE key share whose key_exchange is a single byte.
+	// Rejecting it as malformed breaks Chrome outright.
+	exts := []byte{
+		0x00, 0x33, 0x00, 0x0d, // key_share, 13 bytes
+		0x00, 0x0b, // client_shares length 11
+		0x1a, 0x1a, 0x00, 0x01, 0x00, // GREASE group, 1 byte body
+		0x00, 0x1d, 0x00, 0x02, 0xab, 0xcd, // x25519, 2 byte body
+	}
+	list, err := tls.ParseClientExtensions(exts, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	type share struct {
+		g tls.NamedGroup
+		n int
+	}
+	var got []share
+	for _, ext := range list.All {
+		for _, ks := range ext.KeyShares {
+			got = append(got, share{ks.Group, len(ks.Key)})
+		}
+	}
+	if len(got) != 2 {
+		t.Fatalf("got %d shares want 2", len(got))
+	}
+	if !tls.IsGREASE(uint16(got[0].g)) || got[0].n != 1 {
+		t.Errorf("GREASE share mishandled: %+v", got[0])
+	}
+	if got[1].g != tls.GroupX25519 || got[1].n != 2 {
+		t.Errorf("x25519 share mishandled: %+v", got[1])
+	}
+}
+
+func TestServerKeyShareHelloRetryRequestForm(t *testing.T) {
+	// A HelloRetryRequest names a group with no key.
+	exts := []byte{0x00, 0x33, 0x00, 0x02, 0x00, 0x1d}
+	list, err := tls.ParseServerExtensions(exts, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	n := 0
+	for _, ext := range list.All {
+		for _, ks := range ext.KeyShares {
+			n++
+			if ks.Group != tls.GroupX25519 || len(ks.Key) != 0 {
+				t.Errorf("got %v with %d key bytes", ks.Group, len(ks.Key))
+			}
+		}
+	}
+	if n != 1 {
+		t.Errorf("walked %d shares want 1", n)
+	}
+}
+
+func TestALPNProtos(t *testing.T) {
+	exts := []byte{
+		0x00, 0x10, 0x00, 0x0e,
+		0x00, 0x0c,
+		0x02, 'h', '2',
+		0x08, 'h', 't', 't', 'p', '/', '1', '.', '1',
+	}
+	list, err := tls.ParseClientExtensions(exts, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var names []string
+	for _, ext := range list.All {
+		for _, p := range ext.ALPNProtos {
+			names = append(names, string(p))
+		}
+	}
+	if len(names) != 2 || names[0] != "h2" || names[1] != "http/1.1" {
+		t.Errorf("got %q", names)
+	}
+}
+
+func TestSupportedVersionsClientAndServerForms(t *testing.T) {
+	// The ClientHello form is a list behind a one-byte prefix; the ServerHello
+	// form is a bare uint16.
+	client := []byte{0x00, 0x2b, 0x00, 0x05, 0x04, 0x1a, 0x1a, 0x03, 0x04}
+	list, err := tls.ParseClientExtensions(client, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var vers []uint16
+	for _, ext := range list.All {
+		for _, v := range ext.SupportedVersions {
+			vers = append(vers, v)
+		}
+	}
+	if len(vers) != 2 || vers[1] != tls.VersionTLS13 {
+		t.Errorf("client form got %#x", vers)
+	}
+
+	server := []byte{0x00, 0x2b, 0x00, 0x02, 0x03, 0x04}
+	list, err = tls.ParseServerExtensions(server, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	vers = vers[:0]
+	for _, ext := range list.All {
+		for _, v := range ext.SupportedVersions {
+			vers = append(vers, v)
+		}
+	}
+	if len(vers) != 1 || vers[0] != tls.VersionTLS13 {
+		t.Errorf("server form got %#x", vers)
+	}
+}
+
+func TestVectorRejectsTrailingBytes(t *testing.T) {
+	// A prefix that under-describes its buffer leaves bytes whose meaning this
+	// parser and a middlebox could disagree about.
+	exts := []byte{0x00, 0x0a, 0x00, 0x05, 0x00, 0x02, 0x00, 0x1d, 0xff}
+	if _, err := tls.ParseClientExtensions(exts, 0); err == nil {
+		t.Error("trailing bytes after vector accepted")
+	}
+}
+
+func TestSubIteratorOffsetsAreBodyRelative(t *testing.T) {
+	// base threads through every nesting level so a decoder adds no arithmetic.
+	const base = 100
+	exts := []byte{
+		0x00, 0x00, 0x00, 0x0b, // server_name, 11 bytes
+		0x00, 0x09, // list length
+		0x00, 0x00, 0x06, // host_name, 6 bytes
+		'a', '.', 'c', 'o', 'm', '!',
+	}
+	list, err := tls.ParseClientExtensions(exts, base)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for off, ext := range list.All {
+		if off != base+4 {
+			t.Errorf("extension data at %d want %d", off, base+4)
+		}
+		for noff, name := range ext.ServerNames {
+			// 4 extension header + 2 list length + 3 entry header
+			if want := base + 9; noff != want {
+				t.Errorf("name at %d want %d", noff, want)
+			}
+			if string(name.Name) != "a.com!" {
+				t.Errorf("name %q", name.Name)
+			}
+		}
+	}
+}
+
+func FuzzParseClientExtensions(f *testing.F) {
+	f.Add([]byte{0x00, 0x2b, 0x00, 0x03, 0x02, 0x03, 0x04})
+	f.Add([]byte{0x0a, 0x0a, 0x00, 0x00})
+	f.Fuzz(func(t *testing.T, b []byte) {
+		list, err := tls.ParseClientExtensions(b, 0)
+		if err != nil {
+			return
+		}
+		total := 0
+		for off, ext := range list.All {
+			total += 4 + len(ext.Data())
+			if total > len(b) {
+				t.Fatalf("walked %d bytes past input length %d", total, len(b))
+			}
+			if off+len(ext.Data()) > len(b) {
+				t.Fatalf("extension data at %d overruns %d byte input", off, len(b))
+			}
+			// No sub-iterator may escape its slice, whatever the type says.
+			for o, ks := range ext.KeyShares {
+				if o+len(ks.Key) > len(b) {
+					t.Fatalf("key share at %d overruns input", o)
+				}
+			}
+			for o, name := range ext.ServerNames {
+				if o+len(name.Name) > len(b) {
+					t.Fatalf("server name at %d overruns input", o)
+				}
+			}
+			for o, p := range ext.ALPNProtos {
+				if o+len(p) > len(b) {
+					t.Fatalf("alpn name at %d overruns input", o)
+				}
+			}
+			for o := range ext.SupportedVersions {
+				if o+2 > len(b) {
+					t.Fatalf("version at %d overruns input", o)
+				}
+			}
+			for o := range ext.SupportedGroups {
+				if o+2 > len(b) {
+					t.Fatalf("group at %d overruns input", o)
+				}
+			}
+			for o := range ext.SignatureSchemes {
+				if o+2 > len(b) {
+					t.Fatalf("scheme at %d overruns input", o)
+				}
+			}
+		}
+		if total != len(b) {
+			t.Fatalf("clean walk consumed %d of %d bytes", total, len(b))
+		}
+	})
+}

x/tls/frame.go

@@ -0,0 +1,244 @@
+package tls
+
+import (
+	"encoding/binary"
+
+	"github.com/soypat/lneto"
+)
+
+// RecordFrame provides zero-copy access to a TLS record (RFC 8446 5.1).
+//
+//	struct {
+//	    ContentType type;                   // 1 byte
+//	    ProtocolVersion legacy_record_version; // 2 bytes
+//	    uint16 length;                      // 2 bytes
+//	    opaque fragment[length];
+//	} TLSPlaintext;
+//
+// A RecordFrame may be constructed over a buffer holding only the header, so
+// that [RecordFrame.Length] can be consulted to decide how many more bytes to
+// read. Accessors that reach into the fragment return nil until the whole
+// record is present; call [RecordFrame.Complete] to test for that explicitly.
+type RecordFrame struct {
+	buf []byte
+}
+
+// NewRecordFrame wraps buf as a [RecordFrame]. It validates only that the
+// 5-byte header is present, since the fragment commonly arrives later.
+func NewRecordFrame(buf []byte) (RecordFrame, error) {
+	if len(buf) < SizeHeaderRecord {
+		return RecordFrame{}, lneto.ErrTruncatedFrame
+	}
+	return RecordFrame{buf: buf}, nil
+}
+
+// ContentType returns the record's outer content type. For a protected record
+// this is always [ContentTypeApplicationData]; the real type lives in the
+// encrypted [InnerPlaintext].
+func (rf RecordFrame) ContentType() ContentType { return ContentType(rf.buf[0]) }
+
+// SetContentType sets the outer content type.
+func (rf RecordFrame) SetContentType(ct ContentType) { rf.buf[0] = byte(ct) }
+
+// LegacyVersion returns the legacy_record_version field. TLS 1.3 requires
+// receivers to ignore this field entirely; it is exposed for logging only.
+func (rf RecordFrame) LegacyVersion() uint16 {
+	return binary.BigEndian.Uint16(rf.buf[1:3])
+}
+
+// SetLegacyVersion sets the legacy_record_version field.
+func (rf RecordFrame) SetLegacyVersion(v uint16) {
+	binary.BigEndian.PutUint16(rf.buf[1:3], v)
+}
+
+// Length returns the declared fragment length. It is attacker controlled and
+// must be checked against [MaxCiphertext] before being used to size a read;
+// [RecordFrame.ValidateSize] does this.
+func (rf RecordFrame) Length() uint16 {
+	return binary.BigEndian.Uint16(rf.buf[3:5])
+}
+
+// SetLength sets the declared fragment length.
+func (rf RecordFrame) SetLength(n uint16) {
+	binary.BigEndian.PutUint16(rf.buf[3:5], n)
+}
+
+// RecordLength returns the total wire size of this record, header included.
+func (rf RecordFrame) RecordLength() int {
+	return SizeHeaderRecord + int(rf.Length())
+}
+
+// Complete reports whether the whole record, header and fragment, is present
+// in the underlying buffer.
+func (rf RecordFrame) Complete() bool {
+	return len(rf.buf) >= rf.RecordLength()
+}
+
+// Payload returns the record fragment, or nil if the whole record has not
+// arrived yet. The result aliases the underlying buffer.
+func (rf RecordFrame) Payload() []byte {
+	if !rf.Complete() {
+		return nil
+	}
+	return rf.buf[SizeHeaderRecord:rf.RecordLength()]
+}
+
+// RawData returns the record bytes, header included, truncated to the declared
+// length when the full record is present.
+func (rf RecordFrame) RawData() []byte {
+	if !rf.Complete() {
+		return rf.buf
+	}
+	return rf.buf[:rf.RecordLength()]
+}
+
+// ValidateSize adds an error to v if the record is structurally invalid.
+// It does not require the fragment to have arrived; it only rejects a declared
+// length that could never be legal.
+func (rf RecordFrame) ValidateSize(v *lneto.Validator) {
+	if len(rf.buf) < SizeHeaderRecord {
+		v.AddError(lneto.ErrTruncatedFrame)
+		return
+	}
+	if rf.Length() > MaxCiphertext {
+		// Checked before the length is ever used to size a read.
+		v.AddError(lneto.ErrInvalidLengthField)
+	}
+}
+
+// InnerPlaintext provides access to a decrypted TLSInnerPlaintext
+// (RFC 8446 5.2):
+//
+//	struct {
+//	    opaque content[length];
+//	    ContentType type;
+//	    uint8 zeros[length_of_padding];
+//	} TLSInnerPlaintext;
+//
+// The real content type is the last non-zero byte, and everything after the
+// content is padding that must be stripped before use.
+type InnerPlaintext struct {
+	buf     []byte // content only, padding and type byte already stripped
+	ctype   ContentType
+	padding int
+}
+
+// NewInnerPlaintext scans decrypted for its trailing content type byte,
+// stripping any zero padding that follows it.
+//
+// A record whose plaintext is entirely zeros carries no content type and is a
+// protocol violation; it is reported so the caller can send an
+// unexpected_message alert rather than silently treating it as empty.
+func NewInnerPlaintext(decrypted []byte) (InnerPlaintext, error) {
+	i := len(decrypted) - 1
+	for i >= 0 && decrypted[i] == 0 {
+		i--
+	}
+	if i < 0 {
+		return InnerPlaintext{}, errAllZeroPlaintext
+	}
+	return InnerPlaintext{
+		buf:     decrypted[:i],
+		ctype:   ContentType(decrypted[i]),
+		padding: len(decrypted) - i - 1,
+	}, nil
+}
+
+// ContentType returns the true content type recovered from the inner plaintext.
+func (ip InnerPlaintext) ContentType() ContentType { return ip.ctype }
+
+// Content returns the plaintext with the content type byte and padding removed.
+// The result aliases the buffer passed to [NewInnerPlaintext].
+func (ip InnerPlaintext) Content() []byte { return ip.buf }
+
+// PaddingLen returns how many padding bytes followed the content type byte.
+func (ip InnerPlaintext) PaddingLen() int { return ip.padding }
+
+// HandshakeFrame provides zero-copy access to a handshake message
+// (RFC 8446 4):
+//
+//	struct {
+//	    HandshakeType msg_type;  // 1 byte
+//	    uint24 length;           // 3 bytes
+//	    opaque body[length];
+//	} Handshake;
+//
+// As with [RecordFrame], a HandshakeFrame may be constructed over a buffer
+// holding only the 4-byte header so that the body length can be consulted
+// before the rest has arrived.
+type HandshakeFrame struct {
+	buf []byte
+}
+
+// NewHandshakeFrame wraps buf as a [HandshakeFrame], validating that the
+// 4-byte header is present.
+func NewHandshakeFrame(buf []byte) (HandshakeFrame, error) {
+	if len(buf) < SizeHeaderHandshake {
+		return HandshakeFrame{}, lneto.ErrTruncatedFrame
+	}
+	return HandshakeFrame{buf: buf}, nil
+}
+
+// MsgType returns the handshake message type.
+func (hf HandshakeFrame) MsgType() HandshakeType { return HandshakeType(hf.buf[0]) }
+
+// SetMsgType sets the handshake message type.
+func (hf HandshakeFrame) SetMsgType(t HandshakeType) { hf.buf[0] = byte(t) }
+
+// Length returns the declared 24-bit body length. It is attacker controlled;
+// the value is returned as an int32 rather than an int so that behaviour is
+// identical on 32- and 64-bit targets.
+func (hf HandshakeFrame) Length() int32 {
+	return int32(hf.buf[1])<<16 | int32(hf.buf[2])<<8 | int32(hf.buf[3])
+}
+
+// SetLength sets the declared 24-bit body length. Values outside the 24-bit
+// range are silently masked; callers building messages should ensure the body
+// fits first.
+func (hf HandshakeFrame) SetLength(n int32) {
+	hf.buf[1] = byte(n >> 16)
+	hf.buf[2] = byte(n >> 8)
+	hf.buf[3] = byte(n)
+}
+
+// MessageLength returns the total size of this handshake message, header
+// included.
+func (hf HandshakeFrame) MessageLength() int {
+	return SizeHeaderHandshake + int(hf.Length())
+}
+
+// Complete reports whether the entire handshake message is present.
+func (hf HandshakeFrame) Complete() bool {
+	return len(hf.buf) >= hf.MessageLength()
+}
+
+// Body returns the handshake message body, or nil if the whole message has not
+// arrived. The result aliases the underlying buffer.
+func (hf HandshakeFrame) Body() []byte {
+	if !hf.Complete() {
+		return nil
+	}
+	return hf.buf[SizeHeaderHandshake:hf.MessageLength()]
+}
+
+// RawData returns the handshake message bytes, header included. This is what
+// must be fed to the transcript hash: the header is hashed along with the body,
+// exactly once per message, even when the message spanned several records.
+func (hf HandshakeFrame) RawData() []byte {
+	if !hf.Complete() {
+		return hf.buf
+	}
+	return hf.buf[:hf.MessageLength()]
+}
+
+// ValidateSize adds an error to v if the handshake header is malformed.
+func (hf HandshakeFrame) ValidateSize(v *lneto.Validator) {
+	if len(hf.buf) < SizeHeaderHandshake {
+		v.AddError(lneto.ErrTruncatedFrame)
+		return
+	}
+	if hf.Length() > MaxPlaintext {
+		// No handshake message this server accepts approaches 2^14 bytes.
+		v.AddError(lneto.ErrInvalidLengthField)
+	}
+}

x/tls/frame_test.go

@@ -0,0 +1,252 @@
+package tls_test
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/soypat/lneto"
+	"github.com/soypat/lneto/x/tls"
+)
+
+func TestRecordFrameHeaderBeforeBody(t *testing.T) {
+	// A record layer sees the 5 byte header first and must be able to consult
+	// the length to know how much more to read.
+	hdr := []byte{22, 0x03, 0x01, 0x00, 0x10}
+	rf, err := tls.NewRecordFrame(hdr)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if rf.ContentType() != tls.ContentTypeHandshake {
+		t.Errorf("content type got %v want handshake", rf.ContentType())
+	}
+	if rf.Length() != 16 {
+		t.Errorf("length got %d want 16", rf.Length())
+	}
+	if rf.RecordLength() != 21 {
+		t.Errorf("record length got %d want 21", rf.RecordLength())
+	}
+	if rf.Complete() {
+		t.Error("record with header only reported complete")
+	}
+	if rf.Payload() != nil {
+		t.Error("payload of incomplete record must be nil, not a short slice")
+	}
+
+	full := append(hdr, make([]byte, 16)...)
+	rf, err = tls.NewRecordFrame(full)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !rf.Complete() {
+		t.Fatal("full record reported incomplete")
+	}
+	if len(rf.Payload()) != 16 {
+		t.Errorf("payload len got %d want 16", len(rf.Payload()))
+	}
+}
+
+func TestRecordFrameShortHeader(t *testing.T) {
+	for n := range tls.SizeHeaderRecord {
+		_, err := tls.NewRecordFrame(make([]byte, n))
+		if !errors.Is(err, lneto.ErrTruncatedFrame) {
+			t.Errorf("len=%d got %v want ErrTruncatedFrame", n, err)
+		}
+	}
+}
+
+func TestRecordFrameRejectsOversizeLength(t *testing.T) {
+	// The length field is attacker controlled and must be refused before it is
+	// ever used to size a read.
+	hdr := []byte{23, 0x03, 0x03, 0xff, 0xff} // 65535 > MaxCiphertext
+	rf, err := tls.NewRecordFrame(hdr)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var v lneto.Validator
+	rf.ValidateSize(&v)
+	if err := v.ErrPop(); !errors.Is(err, lneto.ErrInvalidLengthField) {
+		t.Errorf("got %v want ErrInvalidLengthField", err)
+	}
+
+	// Exactly at the limit is legal.
+	maxCT := uint16(tls.MaxCiphertext)
+	hdr[3], hdr[4] = byte(maxCT>>8), byte(maxCT)
+	rf, _ = tls.NewRecordFrame(hdr)
+	rf.ValidateSize(&v)
+	if err := v.ErrPop(); err != nil {
+		t.Errorf("MaxCiphertext rejected: %v", err)
+	}
+}
+
+func TestInnerPlaintextStripsPadding(t *testing.T) {
+	for _, tc := range []struct {
+		name    string
+		in      []byte
+		content string
+		ctype   tls.ContentType
+		padding int
+	}{
+		{"no padding", []byte{'h', 'i', 23}, "hi", tls.ContentTypeApplicationData, 0},
+		{"padded", []byte{'h', 'i', 23, 0, 0, 0}, "hi", tls.ContentTypeApplicationData, 3},
+		{"empty content", []byte{22}, "", tls.ContentTypeHandshake, 0},
+		{"content ends in zero", []byte{'a', 0, 'b', 21, 0}, "a\x00b", tls.ContentTypeAlert, 1},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			ip, err := tls.NewInnerPlaintext(tc.in)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if string(ip.Content()) != tc.content {
+				t.Errorf("content got %q want %q", ip.Content(), tc.content)
+			}
+			if ip.ContentType() != tc.ctype {
+				t.Errorf("type got %v want %v", ip.ContentType(), tc.ctype)
+			}
+			if ip.PaddingLen() != tc.padding {
+				t.Errorf("padding got %d want %d", ip.PaddingLen(), tc.padding)
+			}
+		})
+	}
+}
+
+func TestInnerPlaintextAllZeroRejected(t *testing.T) {
+	// An all-zero inner plaintext carries no content type. Silently treating it
+	// as empty would let a peer inject records the state machine cannot
+	// classify; RFC 8446 5.4 requires unexpected_message.
+	for _, n := range []int{0, 1, 8} {
+		_, err := tls.NewInnerPlaintext(make([]byte, n))
+		if err == nil {
+			t.Errorf("len=%d: all-zero plaintext accepted", n)
+		}
+	}
+}
+
+func TestHandshakeFrame24BitLength(t *testing.T) {
+	hdr := []byte{1, 0x01, 0x02, 0x03} // ClientHello, length 0x010203
+	hf, err := tls.NewHandshakeFrame(hdr)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if hf.MsgType() != tls.HandshakeTypeClientHello {
+		t.Errorf("type got %v", hf.MsgType())
+	}
+	if hf.Length() != 0x010203 {
+		t.Errorf("length got %#x want 0x010203", hf.Length())
+	}
+	if hf.Complete() {
+		t.Error("header-only message reported complete")
+	}
+	if hf.Body() != nil {
+		t.Error("body of incomplete message must be nil")
+	}
+}
+
+func TestHandshakeFrameRoundTripLength(t *testing.T) {
+	buf := make([]byte, tls.SizeHeaderHandshake)
+	hf, err := tls.NewHandshakeFrame(buf)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, n := range []int32{0, 1, 255, 256, 65535, 65536, 0xffffff} {
+		hf.SetLength(n)
+		if got := hf.Length(); got != n {
+			t.Errorf("SetLength(%d) round-tripped to %d", n, got)
+		}
+	}
+}
+
+func TestHandshakeFrameRawDataIncludesHeader(t *testing.T) {
+	// The transcript hash covers the header plus body, exactly once per
+	// message. Getting this wrong breaks Finished verification.
+	msg := []byte{20, 0, 0, 2, 0xaa, 0xbb}
+	hf, err := tls.NewHandshakeFrame(msg)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := hf.RawData(); len(got) != 6 {
+		t.Errorf("RawData len got %d want 6", len(got))
+	}
+	if got := hf.Body(); len(got) != 2 || got[0] != 0xaa {
+		t.Errorf("Body got % x", got)
+	}
+}
+
+func TestIsGREASE(t *testing.T) {
+	// The 16 reserved values of RFC 8701.
+	for i := range 16 {
+		v := uint16(i)<<12 | 0x0a00 | uint16(i)<<4 | 0x0a
+		if !tls.IsGREASE(v) {
+			t.Errorf("%#04x not detected as GREASE", v)
+		}
+	}
+	for _, v := range []uint16{
+		0x0000, 0x1301, 0x001d, 0x0403, 0x0a0b, 0x0b0a, 0x1a2a, 0xffff,
+	} {
+		if tls.IsGREASE(v) {
+			t.Errorf("%#04x falsely detected as GREASE", v)
+		}
+	}
+}
+
+func FuzzNewRecordFrame(f *testing.F) {
+	f.Add([]byte{22, 3, 1, 0, 5, 1, 2, 3, 4, 5})
+	f.Add([]byte{23, 3, 3, 0xff, 0xff})
+	f.Fuzz(func(t *testing.T, b []byte) {
+		rf, err := tls.NewRecordFrame(b)
+		if err != nil {
+			return
+		}
+		var v lneto.Validator
+		rf.ValidateSize(&v)
+		// Accessors must stay in bounds regardless of validation outcome.
+		_ = rf.ContentType()
+		_ = rf.LegacyVersion()
+		_ = rf.Length()
+		if p := rf.Payload(); p != nil && len(p) != int(rf.Length()) {
+			t.Fatalf("payload len %d != declared %d", len(p), rf.Length())
+		}
+		if raw := rf.RawData(); len(raw) > len(b) {
+			t.Fatalf("RawData %d longer than input %d", len(raw), len(b))
+		}
+	})
+}
+
+func FuzzNewHandshakeFrame(f *testing.F) {
+	f.Add([]byte{1, 0, 0, 2, 3, 4})
+	f.Add([]byte{20, 0xff, 0xff, 0xff})
+	f.Fuzz(func(t *testing.T, b []byte) {
+		hf, err := tls.NewHandshakeFrame(b)
+		if err != nil {
+			return
+		}
+		var v lneto.Validator
+		hf.ValidateSize(&v)
+		if hf.Length() < 0 {
+			t.Fatalf("negative 24-bit length %d", hf.Length())
+		}
+		if body := hf.Body(); body != nil && len(body) != int(hf.Length()) {
+			t.Fatalf("body len %d != declared %d", len(body), hf.Length())
+		}
+		if raw := hf.RawData(); len(raw) > len(b) {
+			t.Fatalf("RawData %d longer than input %d", len(raw), len(b))
+		}
+	})
+}
+
+func FuzzNewInnerPlaintext(f *testing.F) {
+	f.Add([]byte{1, 2, 23, 0, 0})
+	f.Add([]byte{0, 0, 0})
+	f.Fuzz(func(t *testing.T, b []byte) {
+		ip, err := tls.NewInnerPlaintext(b)
+		if err != nil {
+			return
+		}
+		if ip.ContentType() == 0 {
+			t.Fatal("accepted a zero content type")
+		}
+		if len(ip.Content())+ip.PaddingLen()+1 != len(b) {
+			t.Fatalf("content %d + padding %d + 1 != input %d",
+				len(ip.Content()), ip.PaddingLen(), len(b))
+		}
+	})
+}

x/tls/hello.go

@@ -0,0 +1,432 @@
+package tls
+
+import (
+	"encoding/binary"
+
+	"github.com/soypat/lneto"
+)
+
+// SizeRandom is the length of the client_random and server_random fields.
+const SizeRandom = 32
+
+// MaxSessionIDLen is the largest legal legacy_session_id. TLS 1.3 does not use
+// session IDs, but a client sends a 32-byte one to trigger middlebox
+// compatibility mode and the server must echo it verbatim.
+const MaxSessionIDLen = 32
+
+// Span is the position and length of a field within a message body.
+type Span struct {
+	Off int
+	Len int
+}
+
+// HelloSpans locates the fields of a ClientHello or ServerHello body. Packet
+// decoders need a field's wire position, which the slice returning accessors
+// cannot give.
+type HelloSpans struct {
+	Random       Span
+	SessionID    Span
+	CipherSuites Span // ServerHello: the single selected suite.
+	Compression  Span
+	Extensions   Span
+}
+
+// ClientHelloMsg provides zero-copy access to a ClientHello body
+// (RFC 8446 4.1.2), wrapping the handshake message body returned by
+// [HandshakeFrame.Body], not the handshake header.
+//
+//	struct {
+//	    ProtocolVersion legacy_version = 0x0303;
+//	    Random random;                              // 32 bytes
+//	    opaque legacy_session_id<0..32>;
+//	    CipherSuite cipher_suites<2..2^16-2>;
+//	    opaque legacy_compression_methods<1..2^8-1>;
+//	    Extension extensions<8..2^16-1>;
+//	} ClientHello;
+//
+// Unlike a [RecordFrame] or [HandshakeFrame], whose fields sit at fixed offsets,
+// a hello's fields are length-prefixed and its extensions may arrive in any
+// order. [ParseClientHello] resolves every offset once so accessors and
+// iterators need no bounds checks and cannot fail.
+type ClientHelloMsg struct {
+	buf  []byte
+	exts ExtensionList
+	// Offsets of each variable-length field's contents, resolved at parse time.
+	sessionIDOff, sessionIDLen int
+	suitesOff, suitesLen       int
+	compOff, compLen           int
+}
+
+// ParseClientHello parses a ClientHello body, validating that every length
+// prefix is consistent with the buffer, down to the lists inside the extensions
+// this package recognizes. It performs no policy checks: version negotiation,
+// cipher suite selection and extension validation are the handshake state
+// machine's job.
+//
+// Trailing bytes after the extensions block are rejected. A sender and parser
+// that disagree about where a structure ends is the ambiguity that
+// parser-differential attacks are built on.
+func ParseClientHello(body []byte) (ClientHelloMsg, error) {
+	var ch ClientHelloMsg
+	// legacy_version(2) + random(32) + session_id length(1)
+	const fixed = 2 + SizeRandom + 1
+	if len(body) < fixed {
+		return ch, lneto.ErrTruncatedFrame
+	}
+	off := 2 + SizeRandom
+
+	sidLen := int(body[off])
+	off++
+	if sidLen > MaxSessionIDLen {
+		// Bounds-checked before it can reach a fixed [32]byte echo buffer.
+		return ch, lneto.ErrInvalidLengthField
+	} else if sidLen > len(body)-off {
+		return ch, lneto.ErrTruncatedFrame
+	}
+	ch.sessionIDOff, ch.sessionIDLen = off, sidLen
+	off += sidLen
+
+	if len(body)-off < 2 {
+		return ch, lneto.ErrTruncatedFrame
+	}
+	suitesLen := int(binary.BigEndian.Uint16(body[off : off+2]))
+	off += 2
+	if suitesLen > len(body)-off {
+		return ch, lneto.ErrTruncatedFrame
+	} else if suitesLen%2 != 0 || suitesLen == 0 {
+		return ch, lneto.ErrInvalidLengthField
+	}
+	ch.suitesOff, ch.suitesLen = off, suitesLen
+	off += suitesLen
+
+	if len(body)-off < 1 {
+		return ch, lneto.ErrTruncatedFrame
+	}
+	compLen := int(body[off])
+	off++
+	if compLen > len(body)-off {
+		return ch, lneto.ErrTruncatedFrame
+	}
+	ch.compOff, ch.compLen = off, compLen
+	off += compLen
+
+	// TLS 1.3 requires extensions; a ClientHello without them cannot possibly
+	// carry supported_versions and so cannot be a 1.3 hello.
+	if len(body)-off < 2 {
+		return ch, lneto.ErrTruncatedFrame
+	}
+	extsLen := int(binary.BigEndian.Uint16(body[off : off+2]))
+	off += 2
+	if extsLen > len(body)-off {
+		return ch, lneto.ErrTruncatedFrame
+	} else if extsLen != len(body)-off {
+		return ch, errTrailingBytes
+	}
+	exts, err := ParseClientExtensions(body[off:off+extsLen], off)
+	if err != nil {
+		return ClientHelloMsg{}, err
+	}
+	ch.exts = exts
+	ch.buf = body
+	return ch, nil
+}
+
+// LegacyVersion returns the legacy_version field, which TLS 1.3 pins to
+// 0x0303 regardless of the version actually negotiated.
+func (ch ClientHelloMsg) LegacyVersion() uint16 {
+	return binary.BigEndian.Uint16(ch.buf[0:2])
+}
+
+// Random returns the 32-byte client_random.
+func (ch ClientHelloMsg) Random() *[SizeRandom]byte {
+	return (*[SizeRandom]byte)(ch.buf[2 : 2+SizeRandom])
+}
+
+// LegacySessionID returns the legacy_session_id, at most 32 bytes. A TLS 1.3
+// server must echo this verbatim in its ServerHello; a non-empty value means
+// the client is using middlebox compatibility mode and expects a dummy
+// ChangeCipherSpec record.
+func (ch ClientHelloMsg) LegacySessionID() []byte {
+	return ch.buf[ch.sessionIDOff : ch.sessionIDOff+ch.sessionIDLen]
+}
+
+// CipherSuites iterates the offered suites in wire order, keyed by each suite's
+// offset within the body. The list includes GREASE values.
+func (ch ClientHelloMsg) CipherSuites(yield func(off int, suite CipherSuite) bool) {
+	suites := ch.CipherSuiteBytes()
+	for off := 0; off+2 <= len(suites); off += 2 {
+		if !yield(ch.suitesOff+off, CipherSuite(binary.BigEndian.Uint16(suites[off:off+2]))) {
+			return
+		}
+	}
+}
+
+// CipherSuiteBytes returns the cipher_suites vector with its length prefix
+// stripped.
+func (ch ClientHelloMsg) CipherSuiteBytes() []byte {
+	return ch.buf[ch.suitesOff : ch.suitesOff+ch.suitesLen]
+}
+
+// LegacyCompressionMethods returns the legacy_compression_methods vector
+// contents. For a TLS 1.3 hello this must be exactly one zero byte; see
+// [ClientHelloMsg.ValidateCompression].
+func (ch ClientHelloMsg) LegacyCompressionMethods() []byte {
+	return ch.buf[ch.compOff : ch.compOff+ch.compLen]
+}
+
+// Extensions iterates this hello's extensions in wire order, keyed by the
+// offset of each extension's data within the body. Duplicates were rejected at
+// parse time, so the walk needs no bookkeeping.
+func (ch ClientHelloMsg) Extensions(yield func(off int, ext ExtensionFrame) bool) {
+	ch.exts.All(yield)
+}
+
+// ExtensionList returns the validated extensions block, for passing the block
+// itself around rather than ranging over it here.
+func (ch ClientHelloMsg) ExtensionList() ExtensionList { return ch.exts }
+
+// ExtensionBytes returns the extensions block contents with the outer length
+// prefix stripped.
+func (ch ClientHelloMsg) ExtensionBytes() []byte { return ch.exts.Bytes() }
+
+// RawData returns the whole ClientHello body.
+func (ch ClientHelloMsg) RawData() []byte { return ch.buf }
+
+// Spans locates this hello's fields inside [ClientHelloMsg.RawData].
+func (ch ClientHelloMsg) Spans() HelloSpans {
+	return HelloSpans{
+		Random:       Span{Off: 2, Len: SizeRandom},
+		SessionID:    Span{Off: ch.sessionIDOff, Len: ch.sessionIDLen},
+		CipherSuites: Span{Off: ch.suitesOff, Len: ch.suitesLen},
+		Compression:  Span{Off: ch.compOff, Len: ch.compLen},
+		Extensions:   Span{Off: ch.exts.base, Len: len(ch.exts.buf)},
+	}
+}
+
+// ValidateSize adds an error to v if the ClientHello is structurally invalid.
+// Since [ParseClientHello] already rejects every inconsistent length, this only
+// re-checks that the message was successfully parsed.
+func (ch ClientHelloMsg) ValidateSize(v *lneto.Validator) {
+	if ch.buf == nil {
+		v.AddError(lneto.ErrTruncatedFrame)
+	}
+}
+
+// ValidateCompression reports whether legacy_compression_methods is exactly
+// the single null method TLS 1.3 mandates (RFC 8446 4.1.2). Anything else must
+// be rejected with an illegal_parameter alert: a client offering real
+// compression methods is either pre-1.3 or attempting a downgrade.
+func (ch ClientHelloMsg) ValidateCompression() bool {
+	return ch.compLen == 1 && ch.buf[ch.compOff] == 0
+}
+
+// ServerHelloMsg provides zero-copy access to a ServerHello body
+// (RFC 8446 4.1.3). Like [ClientHelloMsg] it wraps the handshake message body.
+//
+//	struct {
+//	    ProtocolVersion legacy_version = 0x0303;
+//	    Random random;                              // 32 bytes
+//	    opaque legacy_session_id_echo<0..32>;
+//	    CipherSuite cipher_suite;                   // 2 bytes
+//	    uint8 legacy_compression_method = 0;
+//	    Extension extensions<6..2^16-1>;
+//	} ServerHello;
+//
+// A HelloRetryRequest has this same structure; it is told apart by its random
+// being the special value of RFC 8446 4.1.3, which is policy, not framing.
+type ServerHelloMsg struct {
+	buf                        []byte
+	exts                       ExtensionList
+	sessionIDOff, sessionIDLen int
+	suiteOff                   int
+}
+
+// ParseServerHello parses a ServerHello body. Like [ParseClientHello] it
+// validates framing only, rejects trailing bytes, and validates the lists
+// inside recognized extensions, in their server forms.
+func ParseServerHello(body []byte) (ServerHelloMsg, error) {
+	var sh ServerHelloMsg
+	const fixed = 2 + SizeRandom + 1
+	if len(body) < fixed {
+		return sh, lneto.ErrTruncatedFrame
+	}
+	off := 2 + SizeRandom
+
+	sidLen := int(body[off])
+	off++
+	if sidLen > MaxSessionIDLen {
+		return sh, lneto.ErrInvalidLengthField
+	} else if sidLen > len(body)-off {
+		return sh, lneto.ErrTruncatedFrame
+	}
+	sh.sessionIDOff, sh.sessionIDLen = off, sidLen
+	off += sidLen
+
+	// cipher_suite(2) + legacy_compression_method(1)
+	if len(body)-off < 3 {
+		return sh, lneto.ErrTruncatedFrame
+	}
+	sh.suiteOff = off
+	off += 3
+
+	if len(body)-off < 2 {
+		return sh, lneto.ErrTruncatedFrame
+	}
+	extsLen := int(binary.BigEndian.Uint16(body[off : off+2]))
+	off += 2
+	if extsLen > len(body)-off {
+		return sh, lneto.ErrTruncatedFrame
+	} else if extsLen != len(body)-off {
+		return sh, errTrailingBytes
+	}
+	exts, err := ParseServerExtensions(body[off:off+extsLen], off)
+	if err != nil {
+		return ServerHelloMsg{}, err
+	}
+	sh.exts = exts
+	sh.buf = body
+	return sh, nil
+}
+
+// LegacyVersion returns the legacy_version field, pinned to 0x0303 by TLS 1.3.
+func (sh ServerHelloMsg) LegacyVersion() uint16 {
+	return binary.BigEndian.Uint16(sh.buf[0:2])
+}
+
+// Random returns the 32-byte server_random.
+func (sh ServerHelloMsg) Random() *[SizeRandom]byte {
+	return (*[SizeRandom]byte)(sh.buf[2 : 2+SizeRandom])
+}
+
+// LegacySessionIDEcho returns the client's legacy_session_id as echoed back. A
+// client in middlebox compatibility mode requires it to match what it sent.
+func (sh ServerHelloMsg) LegacySessionIDEcho() []byte {
+	return sh.buf[sh.sessionIDOff : sh.sessionIDOff+sh.sessionIDLen]
+}
+
+// CipherSuite returns the selected cipher suite.
+func (sh ServerHelloMsg) CipherSuite() CipherSuite {
+	return CipherSuite(binary.BigEndian.Uint16(sh.buf[sh.suiteOff : sh.suiteOff+2]))
+}
+
+// LegacyCompressionMethod returns the legacy_compression_method, which TLS 1.3
+// requires to be zero.
+func (sh ServerHelloMsg) LegacyCompressionMethod() uint8 {
+	return sh.buf[sh.suiteOff+2]
+}
+
+// Extensions iterates this hello's extensions in wire order, keyed by the
+// offset of each extension's data within the body.
+func (sh ServerHelloMsg) Extensions(yield func(off int, ext ExtensionFrame) bool) {
+	sh.exts.All(yield)
+}
+
+// ExtensionList returns the validated extensions block.
+func (sh ServerHelloMsg) ExtensionList() ExtensionList { return sh.exts }
+
+// ExtensionBytes returns the extensions block contents with the outer length
+// prefix stripped.
+func (sh ServerHelloMsg) ExtensionBytes() []byte { return sh.exts.Bytes() }
+
+// RawData returns the whole ServerHello body.
+func (sh ServerHelloMsg) RawData() []byte { return sh.buf }
+
+// Spans locates this hello's fields inside [ServerHelloMsg.RawData].
+func (sh ServerHelloMsg) Spans() HelloSpans {
+	return HelloSpans{
+		Random:       Span{Off: 2, Len: SizeRandom},
+		SessionID:    Span{Off: sh.sessionIDOff, Len: sh.sessionIDLen},
+		CipherSuites: Span{Off: sh.suiteOff, Len: 2},
+		Compression:  Span{Off: sh.suiteOff + 2, Len: 1},
+		Extensions:   Span{Off: sh.exts.base, Len: len(sh.exts.buf)},
+	}
+}
+
+// ValidateSize adds an error to v if the ServerHello was not parsed.
+func (sh ServerHelloMsg) ValidateSize(v *lneto.Validator) {
+	if sh.buf == nil {
+		v.AddError(lneto.ErrTruncatedFrame)
+	}
+}
+
+// extSeen tracks which known extension types have already been encountered in
+// a single hello. RFC 8446 4.2 forbids a duplicate extension type, and
+// tolerating duplicates invites parser-differential attacks where this parser
+// and a middlebox act on different copies.
+//
+// Only known types are tracked; unknown and GREASE types are exempt because
+// they are skipped without being acted upon.
+type extSeen uint64
+
+// mark records ext and reports whether it had already been seen. Extension
+// types with no assigned bit are never reported as duplicates.
+func (s *extSeen) mark(ext ExtensionType) (duplicate bool) {
+	bit, ok := extBit(ext)
+	if !ok {
+		return false
+	}
+	if *s&bit != 0 {
+		return true
+	}
+	*s |= bit
+	return false
+}
+
+// extBit maps an extension type to its bit in [extSeen]. The mapping covers
+// every extension this server reads or must reject a duplicate of.
+func extBit(ext ExtensionType) (extSeen, bool) {
+	var i uint
+	switch ext {
+	case ExtServerName:
+		i = 0
+	case ExtMaxFragmentLength:
+		i = 1
+	case ExtStatusRequest:
+		i = 2
+	case ExtSupportedGroups:
+		i = 3
+	case ExtSignatureAlgorithms:
+		i = 4
+	case ExtALPN:
+		i = 5
+	case ExtSignedCertificateTimestamp:
+		i = 6
+	case ExtPadding:
+		i = 7
+	case ExtExtendedMasterSecret:
+		i = 8
+	case ExtCompressCertificate:
+		i = 9
+	case ExtRecordSizeLimit:
+		i = 10
+	case ExtSessionTicket:
+		i = 11
+	case ExtPreSharedKey:
+		i = 12
+	case ExtEarlyData:
+		i = 13
+	case ExtSupportedVersions:
+		i = 14
+	case ExtCookie:
+		i = 15
+	case ExtPSKKeyExchangeModes:
+		i = 16
+	case ExtCertificateAuthorities:
+		i = 17
+	case ExtSignatureAlgorithmsCert:
+		i = 18
+	case ExtKeyShare:
+		i = 19
+	case ExtApplicationSettings:
+		i = 20
+	case ExtEncryptedClientHello:
+		i = 21
+	case ExtRenegotiationInfo:
+		i = 22
+	case ExtECPointFormats:
+		i = 23
+	default:
+		return 0, false
+	}
+	return 1 << i, true
+}

x/tls/hello_test.go

@@ -0,0 +1,255 @@
+package tls_test
+
+import (
+	"crypto/tls"
+	"errors"
+	"net"
+	"testing"
+	"time"
+
+	"github.com/soypat/lneto"
+	ltls "github.com/soypat/lneto/x/tls"
+)
+
+// captureClientHello drives a standard library TLS client far enough to emit
+// its first flight and returns the ClientHello handshake message body.
+//
+// Using a real client rather than a hand-written fixture means the parser is
+// exercised against genuine extension ordering, a 32-byte compatibility
+// session ID and GREASE-free but otherwise realistic content. Browser captures
+// arrive at Stage 6; this covers the structure in the meantime.
+func captureClientHello(t *testing.T) ltls.ClientHelloMsg {
+	t.Helper()
+	client, server := net.Pipe()
+	defer client.Close()
+	defer server.Close()
+
+	go func() {
+		c := tls.Client(client, &tls.Config{
+			ServerName: "example.com",
+			MinVersion: tls.VersionTLS13,
+			MaxVersion: tls.VersionTLS13,
+			NextProtos: []string{"h2", "http/1.1"},
+		})
+		_ = c.Handshake() // will fail; we only need the first flight
+	}()
+
+	server.SetReadDeadline(time.Now().Add(10 * time.Second))
+	var buf [4096]byte
+	n, err := server.Read(buf[:])
+	if err != nil {
+		t.Fatalf("reading ClientHello: %v", err)
+	}
+	rec, err := ltls.NewRecordFrame(buf[:n])
+	if err != nil {
+		t.Fatalf("record: %v", err)
+	}
+	if rec.ContentType() != ltls.ContentTypeHandshake {
+		t.Fatalf("first record is %v, want handshake", rec.ContentType())
+	}
+	if !rec.Complete() {
+		t.Fatalf("ClientHello record split across reads: have %d want %d",
+			n, rec.RecordLength())
+	}
+	hs, err := ltls.NewHandshakeFrame(rec.Payload())
+	if err != nil {
+		t.Fatalf("handshake: %v", err)
+	}
+	if hs.MsgType() != ltls.HandshakeTypeClientHello {
+		t.Fatalf("first message is %v, want client_hello", hs.MsgType())
+	}
+	if !hs.Complete() {
+		t.Fatal("ClientHello spans multiple records")
+	}
+	ch, err := ltls.ParseClientHello(hs.Body())
+	if err != nil {
+		t.Fatalf("client hello: %v", err)
+	}
+	return ch
+}
+
+func TestClientHelloParseRealHello(t *testing.T) {
+	ch := captureClientHello(t)
+
+	if ch.LegacyVersion() != ltls.VersionTLS12 {
+		t.Errorf("legacy_version %#04x want 0x0303", ch.LegacyVersion())
+	}
+	if !ch.ValidateCompression() {
+		t.Errorf("legacy_compression_methods % x, want exactly {0}",
+			ch.LegacyCompressionMethods())
+	}
+	if n := len(ch.LegacySessionID()); n != 32 {
+		// A TLS 1.3 client sends a fake 32-byte session ID to trigger
+		// middlebox compatibility mode. The server must echo it.
+		t.Errorf("session id len %d, want 32 for middlebox compat", n)
+	}
+
+	var sawTLS13, sawX25519, sawSNI, sawALPN bool
+	for _, ext := range ch.Extensions {
+		switch ext.Type() {
+		case ltls.ExtSupportedVersions:
+			for _, v := range ext.SupportedVersions {
+				sawTLS13 = sawTLS13 || v == ltls.VersionTLS13
+			}
+		case ltls.ExtKeyShare:
+			for _, ks := range ext.KeyShares {
+				sawX25519 = sawX25519 || ks.Group == ltls.GroupX25519 && len(ks.Key) == 32
+			}
+		case ltls.ExtServerName:
+			for _, name := range ext.ServerNames {
+				sawSNI = sawSNI || name.Type == 0 && string(name.Name) == "example.com"
+			}
+		case ltls.ExtALPN:
+			for _, p := range ext.ALPNProtos {
+				sawALPN = sawALPN || string(p) == "http/1.1"
+			}
+		}
+	}
+	var suites []ltls.CipherSuite
+	for _, s := range ch.CipherSuites {
+		suites = append(suites, s)
+	}
+
+	if !sawTLS13 {
+		t.Error("supported_versions did not offer TLS 1.3")
+	}
+	if !sawX25519 {
+		t.Error("no 32-byte x25519 key share found")
+	}
+	if !sawSNI {
+		t.Error("SNI host not recovered")
+	}
+	if !sawALPN {
+		t.Error("ALPN http/1.1 not recovered")
+	}
+	var mandatory bool
+	for _, s := range suites {
+		if s == ltls.SuiteAES128GCMSHA256 {
+			mandatory = true
+		}
+	}
+	if !mandatory {
+		t.Errorf("TLS_AES_128_GCM_SHA256 not offered; got %v", suites)
+	}
+}
+
+// rebuildHelloWithExtensions re-encodes ch with a replacement extensions block,
+// exercising Builder against a structure produced by a real client.
+func rebuildHelloWithExtensions(t *testing.T, ch ltls.ClientHelloMsg, exts []byte) []byte {
+	t.Helper()
+	var b ltls.Builder
+	b.Reset(make([]byte, 0, len(ch.RawData())+len(exts)+64))
+	b.AddU16(ch.LegacyVersion())
+	b.AddBytes(ch.Random()[:])
+	b.OpenU8()
+	b.AddBytes(ch.LegacySessionID())
+	b.Close()
+	b.OpenU16()
+	b.AddBytes(ch.CipherSuiteBytes())
+	b.Close()
+	b.OpenU8()
+	b.AddBytes(ch.LegacyCompressionMethods())
+	b.Close()
+	b.OpenU16()
+	b.AddBytes(exts)
+	b.Close()
+	out, err := b.Bytes()
+	if err != nil {
+		t.Fatalf("rebuilding hello: %v", err)
+	}
+	return out
+}
+
+func TestClientHelloRejectsOversizeSessionID(t *testing.T) {
+	// legacy_session_id feeds a fixed [32]byte echo buffer in the server, so
+	// the bound must be enforced at parse time.
+	body := make([]byte, 0, 128)
+	body = append(body, 0x03, 0x03)
+	body = append(body, make([]byte, ltls.SizeRandom)...)
+	body = append(body, 33)                     // session id length, one over
+	body = append(body, make([]byte, 33)...)    //
+	body = append(body, 0x00, 0x02, 0x13, 0x01) // cipher suites
+	body = append(body, 0x01, 0x00)             // compression
+	body = append(body, 0x00, 0x00)             // extensions, empty
+	_, err := ltls.ParseClientHello(body)
+	if !errors.Is(err, lneto.ErrInvalidLengthField) {
+		t.Errorf("got %v want ErrInvalidLengthField", err)
+	}
+}
+
+func TestClientHelloRejectsTrailingBytes(t *testing.T) {
+	ch := captureClientHello(t)
+	body := append(append([]byte{}, ch.RawData()...), 0xff)
+	if _, err := ltls.ParseClientHello(body); err == nil {
+		t.Error("trailing byte after extensions block accepted")
+	}
+}
+
+func TestClientHelloTruncatedAtEveryOffset(t *testing.T) {
+	// Truncating a valid hello anywhere must produce an error, never a panic
+	// and never a frame whose accessors read out of bounds.
+	ch := captureClientHello(t)
+	full := ch.RawData()
+	for n := range len(full) {
+		msg, err := ltls.ParseClientHello(full[:n])
+		if err == nil {
+			// A shorter prefix must never parse as a complete hello.
+			t.Errorf("truncation to %d/%d bytes parsed clean", n, len(full))
+			_ = msg.ExtensionBytes()
+		}
+	}
+}
+
+func FuzzNewClientHelloFrame(f *testing.F) {
+	f.Add([]byte{
+		0x03, 0x03,
+		0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+		0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+		0x00,                   // no session id
+		0x00, 0x02, 0x13, 0x01, // one cipher suite
+		0x01, 0x00, // null compression
+		0x00, 0x00, // no extensions
+	})
+	f.Fuzz(func(t *testing.T, b []byte) {
+		ch, err := ltls.ParseClientHello(b)
+		if err != nil {
+			return
+		}
+		// Every accessor must stay inside the input.
+		if len(ch.LegacySessionID()) > ltls.MaxSessionIDLen {
+			t.Fatalf("session id %d bytes exceeds max", len(ch.LegacySessionID()))
+		}
+		if len(ch.CipherSuiteBytes())%2 != 0 {
+			t.Fatal("cipher suites vector has odd length")
+		}
+		total := 2 + ltls.SizeRandom + 1 + len(ch.LegacySessionID()) +
+			2 + len(ch.CipherSuiteBytes()) +
+			1 + len(ch.LegacyCompressionMethods()) +
+			2 + len(ch.ExtensionBytes())
+		if total != len(b) {
+			t.Fatalf("fields sum to %d but input is %d bytes", total, len(b))
+		}
+		_ = ch.ValidateCompression()
+		// Every nested iterator must stay inside the input too.
+		for _, ext := range ch.Extensions {
+			for _, ks := range ext.KeyShares {
+				_ = ks
+			}
+			for _, name := range ext.ServerNames {
+				_ = name
+			}
+			for _, p := range ext.ALPNProtos {
+				_ = p
+			}
+			for _, v := range ext.SupportedVersions {
+				_ = v
+			}
+			for _, g := range ext.SupportedGroups {
+				_ = g
+			}
+			for _, s := range ext.SignatureSchemes {
+				_ = s
+			}
+		}
+	})
+}

x/tls/msg_test.go

@@ -0,0 +1,314 @@
+package tls_test
+
+import (
+	"bytes"
+	"errors"
+	"testing"
+
+	"github.com/soypat/lneto"
+	ltls "github.com/soypat/lneto/x/tls"
+)
+
+// locates reports whether span points at want inside body.
+func locates(body []byte, off int, want []byte) bool {
+	return off >= 0 && off+len(want) <= len(body) && bytes.Equal(body[off:off+len(want)], want)
+}
+
+// Spans must locate every hello field, so decoders can map a field onto its wire
+// position without re-walking the structure.
+func TestClientHelloMsgSpans(t *testing.T) {
+	msg := captureClientHello(t)
+	body := msg.RawData()
+	sp := msg.Spans()
+	for _, tc := range []struct {
+		name string
+		span ltls.Span
+		want []byte
+	}{
+		{"random", sp.Random, msg.Random()[:]},
+		{"session id", sp.SessionID, msg.LegacySessionID()},
+		{"compression", sp.Compression, msg.LegacyCompressionMethods()},
+		{"extensions", sp.Extensions, msg.ExtensionBytes()},
+	} {
+		if tc.span.Len != len(tc.want) {
+			t.Errorf("%s span len %d want %d", tc.name, tc.span.Len, len(tc.want))
+		} else if !locates(body, tc.span.Off, tc.want) {
+			t.Errorf("%s span %+v does not locate its field", tc.name, tc.span)
+		}
+	}
+}
+
+// Iterator keys are offsets into the hello body, at every nesting level, so a
+// decoder can point at a cipher suite or an SNI hostname without arithmetic.
+func TestClientHelloMsgIterators(t *testing.T) {
+	msg := captureClientHello(t)
+	body := msg.RawData()
+
+	nsuites := 0
+	for off, suite := range msg.CipherSuites {
+		want := []byte{byte(suite >> 8), byte(suite)}
+		if !locates(body, off, want) {
+			t.Errorf("suite %v at offset %d does not match the wire", suite, off)
+		}
+		nsuites++
+	}
+	if nsuites == 0 {
+		t.Fatal("no cipher suites walked")
+	}
+
+	var sawSNI, sawALPN, sawTLS13, sawX25519 bool
+	for off, ext := range msg.Extensions {
+		if !locates(body, off, ext.Data()) {
+			t.Errorf("%v data at offset %d does not match the wire", ext.Type(), off)
+		}
+		switch ext.Type() {
+		case ltls.ExtServerName:
+			for noff, name := range ext.ServerNames {
+				sawSNI = true
+				if name.Type != 0 || string(name.Name) != "example.com" {
+					t.Errorf("server name %d %q", name.Type, name.Name)
+				}
+				if !locates(body, noff, name.Name) {
+					t.Errorf("server name at offset %d does not match the wire", noff)
+				}
+			}
+		case ltls.ExtALPN:
+			for poff, proto := range ext.ALPNProtos {
+				sawALPN = true
+				if !locates(body, poff, proto) {
+					t.Errorf("alpn %q at offset %d does not match the wire", proto, poff)
+				}
+			}
+		case ltls.ExtSupportedVersions:
+			for _, v := range ext.SupportedVersions {
+				sawTLS13 = sawTLS13 || v == ltls.VersionTLS13
+			}
+		case ltls.ExtKeyShare:
+			for koff, ks := range ext.KeyShares {
+				if ks.Group == ltls.GroupX25519 {
+					sawX25519 = true
+				}
+				if !locates(body, koff, ks.Key) {
+					t.Errorf("key share %v at offset %d does not match the wire", ks.Group, koff)
+				}
+			}
+		case ltls.ExtSupportedGroups:
+			for goff, g := range ext.SupportedGroups {
+				if !locates(body, goff, []byte{byte(g >> 8), byte(g)}) {
+					t.Errorf("group %v at offset %d does not match the wire", g, goff)
+				}
+			}
+		case ltls.ExtSignatureAlgorithms:
+			for soff, s := range ext.SignatureSchemes {
+				if !locates(body, soff, []byte{byte(s >> 8), byte(s)}) {
+					t.Errorf("scheme %v at offset %d does not match the wire", s, soff)
+				}
+			}
+		}
+	}
+	if !sawSNI || !sawALPN || !sawTLS13 || !sawX25519 {
+		t.Errorf("sni=%v alpn=%v tls13=%v x25519=%v", sawSNI, sawALPN, sawTLS13, sawX25519)
+	}
+}
+
+// A sub-iterator reached from the wrong extension yields nothing rather than
+// reinterpreting unrelated bytes.
+func TestExtensionSubIteratorTypeMismatch(t *testing.T) {
+	msg := captureClientHello(t)
+	for _, ext := range msg.Extensions {
+		if ext.Type() != ltls.ExtServerName {
+			continue
+		}
+		for range ext.KeyShares {
+			t.Error("KeyShares walked a server_name extension")
+		}
+		for range ext.SupportedVersions {
+			t.Error("SupportedVersions walked a server_name extension")
+		}
+	}
+}
+
+// Walking a hello must not allocate: every iterator is a value type over the
+// caller's buffer.
+func TestClientHelloMsgZeroAlloc(t *testing.T) {
+	msg := captureClientHello(t)
+	body := msg.RawData()
+	n := testing.AllocsPerRun(10, func() {
+		m, err := ltls.ParseClientHello(body)
+		if err != nil {
+			t.Fatal(err)
+		}
+		for _, suite := range m.CipherSuites {
+			_ = suite
+		}
+		for _, ext := range m.Extensions {
+			for _, name := range ext.ServerNames {
+				_ = name
+			}
+			for _, ks := range ext.KeyShares {
+				_ = ks
+			}
+			for _, p := range ext.ALPNProtos {
+				_ = p
+			}
+			for _, v := range ext.SupportedVersions {
+				_ = v
+			}
+		}
+	})
+	if n != 0 {
+		t.Errorf("parse and walk allocated %v times, want 0", n)
+	}
+}
+
+// A known extension whose inner framing is broken must fail the parse, since
+// every iterator past construction is error-free.
+func TestParseClientHelloRejectsMalformedKnownExtension(t *testing.T) {
+	msg := captureClientHello(t)
+	// server_name with a host name length one past the extension data.
+	bad := []byte{
+		0x00, 0x00, 0x00, 0x0b, // server_name, 11 bytes
+		0x00, 0x09, // server_name_list length
+		0x00,       // host_name
+		0x00, 0x0a, // name length 10, but only 6 bytes follow
+		'e', 'x', 'a', 'm', 'p', 'l',
+	}
+	body := rebuildHelloWithExtensions(t, msg, bad)
+	if _, err := ltls.ParseClientHello(body); err == nil {
+		t.Error("malformed server_name accepted")
+	}
+}
+
+func TestParseClientHelloRejectsDuplicateExtension(t *testing.T) {
+	// Duplicating an extension lets this parser and a middlebox act on
+	// different copies, so it is rejected at parse time.
+	msg := captureClientHello(t)
+	exts := msg.ExtensionBytes()
+	var first int
+	for off, ext := range msg.Extensions {
+		first = off + len(ext.Data())
+		break
+	}
+	dup := make([]byte, 0, len(exts)+first)
+	dup = append(dup, exts...)
+	dup = append(dup, exts[:first-msg.Spans().Extensions.Off]...)
+
+	body := rebuildHelloWithExtensions(t, msg, dup)
+	_, err := ltls.ParseClientHello(body)
+	if !errors.Is(err, lneto.ErrInvalidField) {
+		t.Errorf("duplicate extension got %v want ErrInvalidField", err)
+	}
+}
+
+// buildServerHello encodes a ServerHello body with supported_versions and a
+// key_share, which in the server form is a single entry with no list prefix.
+func buildServerHello(t *testing.T, sid []byte) []byte {
+	t.Helper()
+	var b ltls.Builder
+	b.Reset(make([]byte, 0, 256))
+	b.AddU16(ltls.VersionTLS12)
+	for range ltls.SizeRandom {
+		b.AddU8(0xab)
+	}
+	b.OpenU8()
+	b.AddBytes(sid)
+	b.Close()
+	b.AddU16(uint16(ltls.SuiteAES128GCMSHA256))
+	b.AddU8(0) // legacy_compression_method
+	b.OpenU16()
+	b.AddU16(uint16(ltls.ExtSupportedVersions))
+	b.OpenU16()
+	b.AddU16(ltls.VersionTLS13)
+	b.Close()
+	b.AddU16(uint16(ltls.ExtKeyShare))
+	b.OpenU16()
+	b.AddU16(uint16(ltls.GroupX25519))
+	b.OpenU16()
+	for range 32 {
+		b.AddU8(0xee)
+	}
+	b.Close()
+	b.Close()
+	b.Close()
+	body, err := b.Bytes()
+	if err != nil {
+		t.Fatal(err)
+	}
+	return body
+}
+
+func TestServerHelloMsg(t *testing.T) {
+	sid := bytes.Repeat([]byte{0xcd}, 32)
+	body := buildServerHello(t, sid)
+	msg, err := ltls.ParseServerHello(body)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if msg.LegacyVersion() != ltls.VersionTLS12 {
+		t.Errorf("legacy_version %#04x want 0x0303", msg.LegacyVersion())
+	}
+	if !bytes.Equal(msg.LegacySessionIDEcho(), sid) {
+		t.Errorf("session id echo % x want % x", msg.LegacySessionIDEcho(), sid)
+	}
+	if msg.CipherSuite() != ltls.SuiteAES128GCMSHA256 {
+		t.Errorf("cipher suite %v want TLS_AES_128_GCM_SHA256", msg.CipherSuite())
+	}
+	if msg.LegacyCompressionMethod() != 0 {
+		t.Errorf("compression method %d want 0", msg.LegacyCompressionMethod())
+	}
+
+	var version uint16
+	shares := 0
+	for _, ext := range msg.Extensions {
+		switch ext.Type() {
+		case ltls.ExtSupportedVersions:
+			// The ServerHello form is a bare uint16, not a list.
+			if len(ext.Data()) != 2 {
+				t.Fatalf("supported_versions %d bytes want 2", len(ext.Data()))
+			}
+			version = uint16(ext.Data()[0])<<8 | uint16(ext.Data()[1])
+		case ltls.ExtKeyShare:
+			for koff, ks := range ext.KeyShares {
+				shares++
+				if ks.Group != ltls.GroupX25519 || len(ks.Key) != 32 {
+					t.Errorf("key share %v %d bytes", ks.Group, len(ks.Key))
+				}
+				if !locates(body, koff, ks.Key) {
+					t.Errorf("key share at offset %d does not match the wire", koff)
+				}
+			}
+		}
+	}
+	if version != ltls.VersionTLS13 {
+		t.Errorf("negotiated version %#04x want 0x0304", version)
+	}
+	if shares != 1 {
+		t.Errorf("walked %d key shares want 1, the server sends a single entry", shares)
+	}
+
+	sp := msg.Spans()
+	if sp.CipherSuites.Len != 2 || !locates(body, sp.CipherSuites.Off, body[sp.CipherSuites.Off:sp.CipherSuites.Off+2]) {
+		t.Errorf("cipher suite span %+v", sp.CipherSuites)
+	}
+	if sp.Compression.Len != 1 {
+		t.Errorf("compression span len %d want 1", sp.Compression.Len)
+	}
+	if !locates(body, sp.Extensions.Off, msg.ExtensionBytes()) {
+		t.Errorf("extensions span %+v does not locate the block", sp.Extensions)
+	}
+}
+
+func TestParseServerHelloRejectsMalformed(t *testing.T) {
+	body := buildServerHello(t, bytes.Repeat([]byte{0xcd}, 32))
+	if _, err := ltls.ParseServerHello(append(append([]byte{}, body...), 0xff)); err == nil {
+		t.Error("trailing byte after extensions block accepted")
+	}
+	// No truncation may parse clean, panic, or leave an accessor out of range.
+	for n := range len(body) {
+		msg, err := ltls.ParseServerHello(body[:n])
+		if err == nil {
+			t.Errorf("truncation to %d/%d bytes parsed clean", n, len(body))
+			_ = msg.ExtensionBytes()
+		}
+	}
+}

x/tls/stringers.go

@@ -0,0 +1,366 @@
+// Code generated by "stringer -type=ContentType,HandshakeType,ExtensionType,AlertDescription,AlertLevel,NamedGroup,SignatureScheme,CipherSuite -linecomment -output stringers.go ."; DO NOT EDIT.
+
+package tls
+
+import "strconv"
+
+func _() {
+	// An "invalid array index" compiler error signifies that the constant values have changed.
+	// Re-run the stringer command to generate them again.
+	var x [1]struct{}
+	_ = x[ContentTypeInvalid-0]
+	_ = x[ContentTypeChangeCipherSpec-20]
+	_ = x[ContentTypeAlert-21]
+	_ = x[ContentTypeHandshake-22]
+	_ = x[ContentTypeApplicationData-23]
+}
+
+const (
+	_ContentType_name_0 = "invalid"
+	_ContentType_name_1 = "change_cipher_specalerthandshakeapplication_data"
+)
+
+var (
+	_ContentType_index_1 = [...]uint8{0, 18, 23, 32, 48}
+)
+
+func (i ContentType) String() string {
+	switch {
+	case i == 0:
+		return _ContentType_name_0
+	case 20 <= i && i <= 23:
+		i -= 20
+		return _ContentType_name_1[_ContentType_index_1[i]:_ContentType_index_1[i+1]]
+	default:
+		return "ContentType(" + strconv.FormatInt(int64(i), 10) + ")"
+	}
+}
+func _() {
+	// An "invalid array index" compiler error signifies that the constant values have changed.
+	// Re-run the stringer command to generate them again.
+	var x [1]struct{}
+	_ = x[HandshakeTypeClientHello-1]
+	_ = x[HandshakeTypeServerHello-2]
+	_ = x[HandshakeTypeNewSessionTicket-4]
+	_ = x[HandshakeTypeEndOfEarlyData-5]
+	_ = x[HandshakeTypeEncryptedExtensions-8]
+	_ = x[HandshakeTypeCertificate-11]
+	_ = x[HandshakeTypeCertificateRequest-13]
+	_ = x[HandshakeTypeCertificateVerify-15]
+	_ = x[HandshakeTypeFinished-20]
+	_ = x[HandshakeTypeKeyUpdate-24]
+	_ = x[HandshakeTypeMessageHash-254]
+}
+
+const (
+	_HandshakeType_name_0 = "client_helloserver_hello"
+	_HandshakeType_name_1 = "new_session_ticketend_of_early_data"
+	_HandshakeType_name_2 = "encrypted_extensions"
+	_HandshakeType_name_3 = "certificate"
+	_HandshakeType_name_4 = "certificate_request"
+	_HandshakeType_name_5 = "certificate_verify"
+	_HandshakeType_name_6 = "finished"
+	_HandshakeType_name_7 = "key_update"
+	_HandshakeType_name_8 = "message_hash"
+)
+
+var (
+	_HandshakeType_index_0 = [...]uint8{0, 12, 24}
+	_HandshakeType_index_1 = [...]uint8{0, 18, 35}
+)
+
+func (i HandshakeType) String() string {
+	switch {
+	case 1 <= i && i <= 2:
+		i -= 1
+		return _HandshakeType_name_0[_HandshakeType_index_0[i]:_HandshakeType_index_0[i+1]]
+	case 4 <= i && i <= 5:
+		i -= 4
+		return _HandshakeType_name_1[_HandshakeType_index_1[i]:_HandshakeType_index_1[i+1]]
+	case i == 8:
+		return _HandshakeType_name_2
+	case i == 11:
+		return _HandshakeType_name_3
+	case i == 13:
+		return _HandshakeType_name_4
+	case i == 15:
+		return _HandshakeType_name_5
+	case i == 20:
+		return _HandshakeType_name_6
+	case i == 24:
+		return _HandshakeType_name_7
+	case i == 254:
+		return _HandshakeType_name_8
+	default:
+		return "HandshakeType(" + strconv.FormatInt(int64(i), 10) + ")"
+	}
+}
+func _() {
+	// An "invalid array index" compiler error signifies that the constant values have changed.
+	// Re-run the stringer command to generate them again.
+	var x [1]struct{}
+	_ = x[ExtServerName-0]
+	_ = x[ExtMaxFragmentLength-1]
+	_ = x[ExtStatusRequest-5]
+	_ = x[ExtSupportedGroups-10]
+	_ = x[ExtECPointFormats-11]
+	_ = x[ExtSignatureAlgorithms-13]
+	_ = x[ExtALPN-16]
+	_ = x[ExtSignedCertificateTimestamp-18]
+	_ = x[ExtPadding-21]
+	_ = x[ExtExtendedMasterSecret-23]
+	_ = x[ExtCompressCertificate-27]
+	_ = x[ExtRecordSizeLimit-28]
+	_ = x[ExtSessionTicket-35]
+	_ = x[ExtPreSharedKey-41]
+	_ = x[ExtEarlyData-42]
+	_ = x[ExtSupportedVersions-43]
+	_ = x[ExtCookie-44]
+	_ = x[ExtPSKKeyExchangeModes-45]
+	_ = x[ExtCertificateAuthorities-47]
+	_ = x[ExtSignatureAlgorithmsCert-50]
+	_ = x[ExtKeyShare-51]
+	_ = x[ExtApplicationSettings-17513]
+	_ = x[ExtEncryptedClientHello-65037]
+	_ = x[ExtRenegotiationInfo-65281]
+}
+
+const _ExtensionType_name = "server_namemax_fragment_lengthstatus_requestsupported_groupsec_point_formatssignature_algorithmsapplication_layer_protocol_negotiationsigned_certificate_timestamppaddingextended_master_secretcompress_certificaterecord_size_limitsession_ticketpre_shared_keyearly_datasupported_versionscookiepsk_key_exchange_modescertificate_authoritiessignature_algorithms_certkey_shareapplication_settingsencrypted_client_hellorenegotiation_info"
+
+var _ExtensionType_map = map[ExtensionType]string{
+	0:     _ExtensionType_name[0:11],
+	1:     _ExtensionType_name[11:30],
+	5:     _ExtensionType_name[30:44],
+	10:    _ExtensionType_name[44:60],
+	11:    _ExtensionType_name[60:76],
+	13:    _ExtensionType_name[76:96],
+	16:    _ExtensionType_name[96:134],
+	18:    _ExtensionType_name[134:162],
+	21:    _ExtensionType_name[162:169],
+	23:    _ExtensionType_name[169:191],
+	27:    _ExtensionType_name[191:211],
+	28:    _ExtensionType_name[211:228],
+	35:    _ExtensionType_name[228:242],
+	41:    _ExtensionType_name[242:256],
+	42:    _ExtensionType_name[256:266],
+	43:    _ExtensionType_name[266:284],
+	44:    _ExtensionType_name[284:290],
+	45:    _ExtensionType_name[290:312],
+	47:    _ExtensionType_name[312:335],
+	50:    _ExtensionType_name[335:360],
+	51:    _ExtensionType_name[360:369],
+	17513: _ExtensionType_name[369:389],
+	65037: _ExtensionType_name[389:411],
+	65281: _ExtensionType_name[411:429],
+}
+
+func (i ExtensionType) String() string {
+	if str, ok := _ExtensionType_map[i]; ok {
+		return str
+	}
+	return "ExtensionType(" + strconv.FormatInt(int64(i), 10) + ")"
+}
+func _() {
+	// An "invalid array index" compiler error signifies that the constant values have changed.
+	// Re-run the stringer command to generate them again.
+	var x [1]struct{}
+	_ = x[AlertCloseNotify-0]
+	_ = x[AlertUnexpectedMessage-10]
+	_ = x[AlertBadRecordMAC-20]
+	_ = x[AlertRecordOverflow-22]
+	_ = x[AlertHandshakeFailure-40]
+	_ = x[AlertBadCertificate-42]
+	_ = x[AlertUnsupportedCertificate-43]
+	_ = x[AlertCertificateRevoked-44]
+	_ = x[AlertCertificateExpired-45]
+	_ = x[AlertCertificateUnknown-46]
+	_ = x[AlertIllegalParameter-47]
+	_ = x[AlertUnknownCA-48]
+	_ = x[AlertAccessDenied-49]
+	_ = x[AlertDecodeError-50]
+	_ = x[AlertDecryptError-51]
+	_ = x[AlertProtocolVersion-70]
+	_ = x[AlertInsufficientSecurity-71]
+	_ = x[AlertInternalError-80]
+	_ = x[AlertInappropriateFallback-86]
+	_ = x[AlertUserCanceled-90]
+	_ = x[AlertMissingExtension-109]
+	_ = x[AlertUnsupportedExtension-110]
+	_ = x[AlertUnrecognizedName-112]
+	_ = x[AlertBadCertificateStatusResponse-113]
+	_ = x[AlertUnknownPSKIdentity-115]
+	_ = x[AlertCertificateRequired-116]
+	_ = x[AlertNoApplicationProtocol-120]
+}
+
+const _AlertDescription_name = "close_notifyunexpected_messagebad_record_macrecord_overflowhandshake_failurebad_certificateunsupported_certificatecertificate_revokedcertificate_expiredcertificate_unknownillegal_parameterunknown_caaccess_denieddecode_errordecrypt_errorprotocol_versioninsufficient_securityinternal_errorinappropriate_fallbackuser_canceledmissing_extensionunsupported_extensionunrecognized_namebad_certificate_status_responseunknown_psk_identitycertificate_requiredno_application_protocol"
+
+var _AlertDescription_map = map[AlertDescription]string{
+	0:   _AlertDescription_name[0:12],
+	10:  _AlertDescription_name[12:30],
+	20:  _AlertDescription_name[30:44],
+	22:  _AlertDescription_name[44:59],
+	40:  _AlertDescription_name[59:76],
+	42:  _AlertDescription_name[76:91],
+	43:  _AlertDescription_name[91:114],
+	44:  _AlertDescription_name[114:133],
+	45:  _AlertDescription_name[133:152],
+	46:  _AlertDescription_name[152:171],
+	47:  _AlertDescription_name[171:188],
+	48:  _AlertDescription_name[188:198],
+	49:  _AlertDescription_name[198:211],
+	50:  _AlertDescription_name[211:223],
+	51:  _AlertDescription_name[223:236],
+	70:  _AlertDescription_name[236:252],
+	71:  _AlertDescription_name[252:273],
+	80:  _AlertDescription_name[273:287],
+	86:  _AlertDescription_name[287:309],
+	90:  _AlertDescription_name[309:322],
+	109: _AlertDescription_name[322:339],
+	110: _AlertDescription_name[339:360],
+	112: _AlertDescription_name[360:377],
+	113: _AlertDescription_name[377:408],
+	115: _AlertDescription_name[408:428],
+	116: _AlertDescription_name[428:448],
+	120: _AlertDescription_name[448:471],
+}
+
+func (i AlertDescription) String() string {
+	if str, ok := _AlertDescription_map[i]; ok {
+		return str
+	}
+	return "AlertDescription(" + strconv.FormatInt(int64(i), 10) + ")"
+}
+func _() {
+	// An "invalid array index" compiler error signifies that the constant values have changed.
+	// Re-run the stringer command to generate them again.
+	var x [1]struct{}
+	_ = x[AlertLevelWarning-1]
+	_ = x[AlertLevelFatal-2]
+}
+
+const _AlertLevel_name = "warningfatal"
+
+var _AlertLevel_index = [...]uint8{0, 7, 12}
+
+func (i AlertLevel) String() string {
+	i -= 1
+	if i >= AlertLevel(len(_AlertLevel_index)-1) {
+		return "AlertLevel(" + strconv.FormatInt(int64(i+1), 10) + ")"
+	}
+	return _AlertLevel_name[_AlertLevel_index[i]:_AlertLevel_index[i+1]]
+}
+func _() {
+	// An "invalid array index" compiler error signifies that the constant values have changed.
+	// Re-run the stringer command to generate them again.
+	var x [1]struct{}
+	_ = x[GroupSECP256R1-23]
+	_ = x[GroupSECP384R1-24]
+	_ = x[GroupSECP521R1-25]
+	_ = x[GroupX25519-29]
+	_ = x[GroupX448-30]
+	_ = x[GroupX25519MLKEM768-4588]
+}
+
+const (
+	_NamedGroup_name_0 = "secp256r1secp384r1secp521r1"
+	_NamedGroup_name_1 = "x25519x448"
+	_NamedGroup_name_2 = "x25519mlkem768"
+)
+
+var (
+	_NamedGroup_index_0 = [...]uint8{0, 9, 18, 27}
+	_NamedGroup_index_1 = [...]uint8{0, 6, 10}
+)
+
+func (i NamedGroup) String() string {
+	switch {
+	case 23 <= i && i <= 25:
+		i -= 23
+		return _NamedGroup_name_0[_NamedGroup_index_0[i]:_NamedGroup_index_0[i+1]]
+	case 29 <= i && i <= 30:
+		i -= 29
+		return _NamedGroup_name_1[_NamedGroup_index_1[i]:_NamedGroup_index_1[i+1]]
+	case i == 4588:
+		return _NamedGroup_name_2
+	default:
+		return "NamedGroup(" + strconv.FormatInt(int64(i), 10) + ")"
+	}
+}
+func _() {
+	// An "invalid array index" compiler error signifies that the constant values have changed.
+	// Re-run the stringer command to generate them again.
+	var x [1]struct{}
+	_ = x[SigRSAPKCS1SHA256-1025]
+	_ = x[SigRSAPKCS1SHA384-1281]
+	_ = x[SigRSAPKCS1SHA512-1537]
+	_ = x[SigECDSAP256SHA256-1027]
+	_ = x[SigECDSAP384SHA384-1283]
+	_ = x[SigECDSAP521SHA512-1539]
+	_ = x[SigRSAPSSRSAESHA256-2052]
+	_ = x[SigRSAPSSRSAESHA384-2053]
+	_ = x[SigRSAPSSRSAESHA512-2054]
+	_ = x[SigEd25519-2055]
+	_ = x[SigRSAPSSPSSSHA256-2057]
+}
+
+const (
+	_SignatureScheme_name_0 = "rsa_pkcs1_sha256"
+	_SignatureScheme_name_1 = "ecdsa_secp256r1_sha256"
+	_SignatureScheme_name_2 = "rsa_pkcs1_sha384"
+	_SignatureScheme_name_3 = "ecdsa_secp384r1_sha384"
+	_SignatureScheme_name_4 = "rsa_pkcs1_sha512"
+	_SignatureScheme_name_5 = "ecdsa_secp521r1_sha512"
+	_SignatureScheme_name_6 = "rsa_pss_rsae_sha256rsa_pss_rsae_sha384rsa_pss_rsae_sha512ed25519"
+	_SignatureScheme_name_7 = "rsa_pss_pss_sha256"
+)
+
+var (
+	_SignatureScheme_index_6 = [...]uint8{0, 19, 38, 57, 64}
+)
+
+func (i SignatureScheme) String() string {
+	switch {
+	case i == 1025:
+		return _SignatureScheme_name_0
+	case i == 1027:
+		return _SignatureScheme_name_1
+	case i == 1281:
+		return _SignatureScheme_name_2
+	case i == 1283:
+		return _SignatureScheme_name_3
+	case i == 1537:
+		return _SignatureScheme_name_4
+	case i == 1539:
+		return _SignatureScheme_name_5
+	case 2052 <= i && i <= 2055:
+		i -= 2052
+		return _SignatureScheme_name_6[_SignatureScheme_index_6[i]:_SignatureScheme_index_6[i+1]]
+	case i == 2057:
+		return _SignatureScheme_name_7
+	default:
+		return "SignatureScheme(" + strconv.FormatInt(int64(i), 10) + ")"
+	}
+}
+func _() {
+	// An "invalid array index" compiler error signifies that the constant values have changed.
+	// Re-run the stringer command to generate them again.
+	var x [1]struct{}
+	_ = x[SuiteAES128GCMSHA256-4865]
+	_ = x[SuiteAES256GCMSHA384-4866]
+	_ = x[SuiteChaCha20Poly1305SHA256-4867]
+	_ = x[SuiteAES128CCMSHA256-4868]
+	_ = x[SuiteAES128CCM8SHA256-4869]
+}
+
+const _CipherSuite_name = "TLS_AES_128_GCM_SHA256TLS_AES_256_GCM_SHA384TLS_CHACHA20_POLY1305_SHA256TLS_AES_128_CCM_SHA256TLS_AES_128_CCM_8_SHA256"
+
+var _CipherSuite_index = [...]uint8{0, 22, 44, 72, 94, 118}
+
+func (i CipherSuite) String() string {
+	i -= 4865
+	if i >= CipherSuite(len(_CipherSuite_index)-1) {
+		return "CipherSuite(" + strconv.FormatInt(int64(i+4865), 10) + ")"
+	}
+	return _CipherSuite_name[_CipherSuite_index[i]:_CipherSuite_index[i+1]]
+}

x/tls/stringers_const.go

@@ -0,0 +1,122 @@
+package tls
+
+// StringConst methods name values as String does but always return a
+// compile-time constant, unlike String which formats an unrecognized value with
+// strconv. Wire values are attacker controlled, so decoders and logs on
+// embedded targets use StringConst and print the number alongside it.
+
+const (
+	// nameGREASE names the reserved values of RFC 8701, which carry no meaning.
+	nameGREASE = "GREASE"
+	// nameUnknown names a value this package does not recognize. Other RFCs may
+	// well define it: this is TLS 1.3 only.
+	nameUnknown = "unknown"
+)
+
+// StringConst returns the content type's name, or "unknown".
+func (v ContentType) StringConst() string {
+	switch v {
+	case ContentTypeInvalid, ContentTypeChangeCipherSpec, ContentTypeAlert,
+		ContentTypeHandshake, ContentTypeApplicationData:
+		return v.String()
+	}
+	return nameUnknown
+}
+
+// StringConst returns the handshake message type's name, or "unknown".
+func (v HandshakeType) StringConst() string {
+	switch v {
+	case HandshakeTypeClientHello, HandshakeTypeServerHello, HandshakeTypeNewSessionTicket,
+		HandshakeTypeEndOfEarlyData, HandshakeTypeEncryptedExtensions, HandshakeTypeCertificate,
+		HandshakeTypeCertificateRequest, HandshakeTypeCertificateVerify, HandshakeTypeFinished,
+		HandshakeTypeKeyUpdate, HandshakeTypeMessageHash:
+		return v.String()
+	}
+	return nameUnknown
+}
+
+// StringConst returns the extension type's name, "GREASE" or "unknown".
+func (v ExtensionType) StringConst() string {
+	switch v {
+	case ExtServerName, ExtMaxFragmentLength, ExtStatusRequest, ExtSupportedGroups,
+		ExtECPointFormats, ExtSignatureAlgorithms, ExtALPN, ExtSignedCertificateTimestamp,
+		ExtPadding, ExtExtendedMasterSecret, ExtCompressCertificate, ExtRecordSizeLimit,
+		ExtSessionTicket, ExtPreSharedKey, ExtEarlyData, ExtSupportedVersions, ExtCookie,
+		ExtPSKKeyExchangeModes, ExtCertificateAuthorities, ExtSignatureAlgorithmsCert,
+		ExtKeyShare, ExtApplicationSettings, ExtEncryptedClientHello, ExtRenegotiationInfo:
+		return v.String()
+	}
+	if IsGREASE(uint16(v)) {
+		return nameGREASE
+	}
+	return nameUnknown
+}
+
+// StringConst returns the alert level's name, or "unknown".
+func (v AlertLevel) StringConst() string {
+	switch v {
+	case AlertLevelWarning, AlertLevelFatal:
+		return v.String()
+	}
+	return nameUnknown
+}
+
+// StringConst returns the alert description's name, or "unknown".
+func (v AlertDescription) StringConst() string {
+	switch v {
+	case AlertCloseNotify, AlertUnexpectedMessage, AlertBadRecordMAC, AlertRecordOverflow,
+		AlertHandshakeFailure, AlertBadCertificate, AlertUnsupportedCertificate,
+		AlertCertificateRevoked, AlertCertificateExpired, AlertCertificateUnknown,
+		AlertIllegalParameter, AlertUnknownCA, AlertAccessDenied, AlertDecodeError,
+		AlertDecryptError, AlertProtocolVersion, AlertInsufficientSecurity,
+		AlertInternalError, AlertInappropriateFallback, AlertUserCanceled,
+		AlertMissingExtension, AlertUnsupportedExtension, AlertUnrecognizedName,
+		AlertBadCertificateStatusResponse, AlertUnknownPSKIdentity,
+		AlertCertificateRequired, AlertNoApplicationProtocol:
+		return v.String()
+	}
+	return nameUnknown
+}
+
+// StringConst returns the named group's name, "GREASE" or "unknown".
+func (v NamedGroup) StringConst() string {
+	switch v {
+	case GroupSECP256R1, GroupSECP384R1, GroupSECP521R1,
+		GroupX25519, GroupX448, GroupX25519MLKEM768:
+		return v.String()
+	}
+	if IsGREASE(uint16(v)) {
+		return nameGREASE
+	}
+	return nameUnknown
+}
+
+// StringConst returns the signature scheme's name, "GREASE" or "unknown".
+func (v SignatureScheme) StringConst() string {
+	switch v {
+	case SigRSAPKCS1SHA256, SigRSAPKCS1SHA384, SigRSAPKCS1SHA512,
+		SigECDSAP256SHA256, SigECDSAP384SHA384, SigECDSAP521SHA512,
+		SigRSAPSSRSAESHA256, SigRSAPSSRSAESHA384, SigRSAPSSRSAESHA512,
+		SigEd25519, SigRSAPSSPSSSHA256:
+		return v.String()
+	}
+	if IsGREASE(uint16(v)) {
+		return nameGREASE
+	}
+	return nameUnknown
+}
+
+// StringConst returns the cipher suite's name, "GREASE" or "unknown".
+// Every TLS 1.2 suite a browser still offers is undefined here: this package
+// implements TLS 1.3 only.
+func (v CipherSuite) StringConst() string {
+	switch v {
+	case SuiteAES128GCMSHA256, SuiteAES256GCMSHA384, SuiteChaCha20Poly1305SHA256,
+		SuiteAES128CCMSHA256, SuiteAES128CCM8SHA256:
+		return v.String()
+	}
+	if IsGREASE(uint16(v)) {
+		return nameGREASE
+	}
+	return nameUnknown
+}

x/tls/stringers_const_test.go

@@ -0,0 +1,73 @@
+package tls_test
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/soypat/lneto/x/tls"
+)
+
+// StringConst must name defined values as String does, GREASE values "GREASE"
+// and everything else "unknown", over the whole range and without allocating.
+// A constant added without extending a StringConst switch fails here.
+func TestStringConst(t *testing.T) {
+	for _, tc := range []struct {
+		name   string
+		n      int
+		grease bool // type carries GREASE values
+		str    func(int) string
+		cst    func(int) string
+	}{
+		{"ContentType", 1 << 8, false,
+			func(i int) string { return tls.ContentType(i).String() },
+			func(i int) string { return tls.ContentType(i).StringConst() }},
+		{"HandshakeType", 1 << 8, false,
+			func(i int) string { return tls.HandshakeType(i).String() },
+			func(i int) string { return tls.HandshakeType(i).StringConst() }},
+		{"AlertLevel", 1 << 8, false,
+			func(i int) string { return tls.AlertLevel(i).String() },
+			func(i int) string { return tls.AlertLevel(i).StringConst() }},
+		{"AlertDescription", 1 << 8, false,
+			func(i int) string { return tls.AlertDescription(i).String() },
+			func(i int) string { return tls.AlertDescription(i).StringConst() }},
+		{"ExtensionType", 1 << 16, true,
+			func(i int) string { return tls.ExtensionType(i).String() },
+			func(i int) string { return tls.ExtensionType(i).StringConst() }},
+		{"NamedGroup", 1 << 16, true,
+			func(i int) string { return tls.NamedGroup(i).String() },
+			func(i int) string { return tls.NamedGroup(i).StringConst() }},
+		{"SignatureScheme", 1 << 16, true,
+			func(i int) string { return tls.SignatureScheme(i).String() },
+			func(i int) string { return tls.SignatureScheme(i).StringConst() }},
+		{"CipherSuite", 1 << 16, true,
+			func(i int) string { return tls.CipherSuite(i).String() },
+			func(i int) string { return tls.CipherSuite(i).StringConst() }},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			for i := range tc.n {
+				str, cst := tc.str(i), tc.cst(i)
+				if !strings.ContainsRune(str, '(') { // stringer names undefined values "Type(9)".
+					if cst != str {
+						t.Fatalf("%s(%d)=%q want %q", tc.name, i, cst, str)
+					}
+					continue
+				}
+				want := "unknown"
+				if tc.grease && tls.IsGREASE(uint16(i)) {
+					want = "GREASE"
+				}
+				if cst != want {
+					t.Fatalf("%s(%d)=%q want %q", tc.name, i, cst, want)
+				}
+			}
+			allocs := testing.AllocsPerRun(1, func() {
+				for i := range tc.n {
+					_ = tc.cst(i)
+				}
+			})
+			if allocs != 0 {
+				t.Errorf("%s allocated %v times", tc.name, allocs)
+			}
+		})
+	}
+}

x/xnet/stack-async.go

@@ -69,8 +69,6 @@ type StackAsync struct {
 
 	ipv6enabled bool
 	stack6      Stack6
-
-	log *slog.Logger
 }
 
 type StackConfig struct {
@@ -107,9 +105,6 @@ type StackConfig struct {
 	AcceptMulticast bool
 	// Accept broadcast IPv4 packets. Needed for managing access points and DHCPv4 servers.
 	AcceptIPv4Broadcast bool
-	// Logger receives the stack's Debug and DebugErr output. A nil Logger silences
-	// them; the heap allocation probe still runs so allocation bisection keeps working.
-	Logger *slog.Logger
 }
 
 func (cfg *StackConfig) id() uint16 {
@@ -207,7 +202,6 @@ func (s *StackAsync) Reset(cfg StackConfig) (err error) {
 	defer s.mu.Unlock()
 	s.prng = uint32(cfg.RandSeed)
 	s.hostname = cfg.Hostname
-	s.log = cfg.Logger
 	// Treat last character of hostname as number.
 	id := cfg.id()
 	linkNodes := 2 // ARP and IPv4 nodes
@@ -849,39 +843,20 @@ func addr4(addr [4]byte, ok bool) netip.Addr {
 }
 
 // Debug prints debugging and heap information.
-//
-// The heap allocation probe runs unconditionally; only the log line is gated on
-// the configured Logger's level. Building the slog.Attr list allocates, so the
-// gate must come first or the allocation happens even when nothing is logged.
 func (s *StackAsync) Debug(msg string) {
-	internal.LogAllocs(msg)
-	if !internal.LogEnabled(s.log, slog.LevelDebug) {
-		return
-	}
-	internal.LogAttrsAndAllocs(msg, s.log, slog.LevelDebug, "stackasync",
+	internal.LogAttrsAndAllocs(msg, slog.Default(), slog.LevelDebug, "stackasync",
 		slog.String("umsg", msg),
 		slog.Uint64("sent", s.stats.TotalSent),
 		slog.Uint64("recv", s.stats.TotalReceived),
 	)
 }
 
-// DebugErr prints debugging and heap information with [slog.LevelError] level. See [StackAsync.Debug] on gating.
+// DebugErr prints debugging and heap information.
 func (s *StackAsync) DebugErr(msg, err string) {
-	internal.LogAllocs(msg)
-	if !internal.LogEnabled(s.log, slog.LevelError) {
-		return
-	}
-	internal.LogAttrsAndAllocs(msg, s.log, slog.LevelError, "stackasync",
+	internal.LogAttrsAndAllocs(msg, slog.Default(), slog.LevelError, "stackasync",
 		slog.String("umsg", msg),
 		slog.String("err", err),
 		slog.Uint64("sent", s.stats.TotalSent),
 		slog.Uint64("recv", s.stats.TotalReceived),
 	)
 }
-
-// LogAllocs is an lneto-tracked allocation logger. If there was an allocation between this call and a previous call
-// to LogAllocs it will be printed. This is called globally by StackAsync.Debug methods and by all logging calls in lneto
-// when build tag debugheaplog is set.
-func LogAllocs(msg string) {
-	internal.LogAllocs(msg)
-}

x/xnet/stack-go.go

@@ -162,9 +162,11 @@ func (s StackGo) SocketNetip(ctx context.Context, network string, family, sotype
 			return nil, err
 		}
 		uc := udpconn{
-			Conn:      &conn,
-			localAddr: net.UDPAddrFromAddrPort(laddr),
-			raddr:     net.UDPAddrFromAddrPort(raddr),
+			Conn: &conn,
+			// TODO: use udpaddr until UDPAddrFromAddrPort added to tinygo.
+			// https://github.com/tinygo-org/net/issues/45
+			localAddr: udpaddr(laddr),
+			raddr:     udpaddr(raddr),
 		}
 		return uc, nil
 	case "tcp", "tcp4", "tcp6":
@@ -382,6 +384,13 @@ func (c udpconn) ReadFrom(b []byte) (int, net.Addr, error) {
 func (c udpconn) WriteTo(b []byte, _ net.Addr) (int, error) {
 	return c.Conn.Write(b) // connected UDP: always writes to dialed remote
 }
+func udpaddr(addr netip.AddrPort) net.Addr {
+	return &net.UDPAddr{
+		IP:   addr.Addr().AsSlice(),
+		Zone: addr.Addr().Zone(),
+		Port: int(addr.Port()),
+	}
+}
 
 // parseNetAddr converts a [net.Addr] to a [netip.AddrPort]. A nil or empty IP
 // (e.g. ":22" from a listen address with no host) is treated as 0.0.0.0 so

x/xnet/xnet_arp_test.go

@@ -6,7 +6,6 @@ import (
 	"testing"
 
 	"github.com/soypat/lneto/ethernet"
-	"github.com/soypat/lneto/ipv4"
 )
 
 func TestARPLocal(t *testing.T) {
@@ -21,7 +20,7 @@ func TestARPLocal(t *testing.T) {
 	addr2 := netip.AddrPortFrom(netip.AddrFrom4(s2.Addr4()), 80)   // listener, server.
 	err := s1.AssimilateDHCPResults(&DHCPResults{
 		Router:        netip.AddrFrom4([4]byte{10, 0, 0, 255}),
-		BroadcastAddr: netip.AddrFrom4(ipv4.BroadcastAddr()),
+		BroadcastAddr: netip.AddrFrom4([4]byte{255, 255, 255, 255}),
 		AssignedAddr4: s1.Addr4(),
 		Subnet:        netip.PrefixFrom(netip.AddrFrom4(s2.Addr4()), 24), // Subnet containing s2 will force an ARP on s1.
 		TRenewal:      1000,

x/xnet/xnet_fuzz_test.go

@@ -21,7 +21,7 @@ func FuzzStackPacketHTTP(f *testing.F) {
 	const seed = 1
 	var buf [ethernet.MaxFrameLength]byte
 	s1, s2, c1, c2 := newTCPStacks(f, seed, MTU)
-	var hdr httpraw.HeaderV1
+	var hdr httpraw.Header
 	err := s1.ListenTCP4(c1, 80)
 	if err != nil {
 		f.Fatal(err)
@@ -32,7 +32,7 @@ func FuzzStackPacketHTTP(f *testing.F) {
 	}
 	hdr.SetMethod("GET")
 	hdr.SetProtocol("HTTP/1.1")
-	hdr.SetRequestTarget("/")
+	hdr.SetRequestURI("/")
 	data := hdr.AppendHeaders(nil)
 
 	pktnum := 0
@@ -129,7 +129,7 @@ func FuzzStackPacketHTTP(f *testing.F) {
 			if n1 == 0 && n2 == 0 {
 				if !closed {
 					if c1.BufferedInput() > 0 {
-						var hdr httpraw.HeaderV1
+						var hdr httpraw.Header
 						n, _ := c1.Read(buf[:])
 						hdr.ReadFromBytes(buf[:n])
 						hdr.TryParse(false)