Rust HTTP backend: kj's HTTP interfaces on hyper, rustls and tungstenite

Under --//:io_backend=rust, workerd's HTTP/1.1 client and server, WebSockets,
CONNECT tunnels and TLS run in Rust on hyper, hyper-util, rustls and
tungstenite's frame codec. workerd is still written against kj's HTTP
interfaces (kj::HttpClient, HttpService, HttpServer, WebSocket,
SecureNetworkWrapper); only their implementations change, by symbol override,
as the I/O layer does. Product code is unchanged, and the default C++ build is
untouched.

Layout:
- kj-hyper (src/rust/cxx/kj-hyper, ~4.3k lines): hyper's pooling and
  single-stream clients, hyper's server fused into one kj event per connection,
  the WebSocket frame loop with permessage-deflate (flate2/zlib-rs), rustls TLS,
  and the kj <-> tokio stream bridges, with a thin C++ seam.
- kj-http-tokio.c++: the kj:: HTTP entry points over kj-hyper.
- tls-network: config::TlsOptions as a kj::SecureNetworkWrapper for both
  engines, so server.c++ has no per-backend #if.
- src/rust/kj: the kj crate links kj-http-types only, and gains header
  iteration and a batch add for kj-hyper.
- capnproto (companion change): kj-http-types holds everything that is not
  kj's wire implementation -- header codec, permessage-deflate negotiation,
  WebSocket pump and pipe, client/service adapters -- so this backend reuses
  kj's own code for those and links without kj-http-impl.

Behavior follows kj's contracts where workerd relies on them:
- Wire fidelity: header spellings (hyper HeaderCaseMap patch), reason phrases,
  kj's Content-Length and Connection: close rules, drain finishing a partially
  received request.
- Errors: HttpServerErrorHandler/WebSocketErrorHandler run as in kj's server;
  kj exceptions survive the trip through hyper.
- WebSocket: text passes through unvalidated, the application owns Close,
  maxSize is checked from the frame header, pongs queue behind a send in
  flight, wire byte counters. The server refuses bad handshakes with 400, or
  426 with Sec-WebSocket-Version for an unsupported version (RFC 6455 4.2.2);
  the client validates Sec-WebSocket-Accept and takes its key from the
  configured EntropySource.
- Disconnects: whenWriteDisconnected() and whenAborted() resolve on peer
  hangup, and a peer that disconnects cancels its connection's service calls.
- Server timeouts: headerTimeout applies to each request head.
- TLS: trustBrowserCas uses the platform verifier, otherwise only
  trustedCertificates are trusted (also directly, as OpenSSL); minVersion
  TLS 1.3 and cipherList's TLS 1.2 suites are honored.

Crate patches: http/httparse lenient header values, hyper's public header case
map, graceful shutdown finishing a partial request, lazily read client response
bodies.

Tests: kj-http-test (48) and tls-network-test (14) check kj's HTTP and TLS
entry points against the wire and the TLS policy, and run unchanged on both
backends. kj-hyper_test covers the deflate codec (RFC 7692 vectors) and the TLS
option mapping. server-test drives its loop with a TokioEventPort,
gains a WebSocket compression case, and TestServer::wait() lets events due at
its final instant settle. bazel test
//src/... passes under the rust backend; the cxx build's server-test,
kj-http-test and tls-network-test pass.

Requires the capnproto kj-http split (kj-http-types).

Co-Authored-By: Claude Code <noreply@anthropic.com>

Author: danlapid

BUILD.bazel

@@ -131,16 +131,18 @@ bool_flag(
 # =============================================================================
 # I/O backend selection: a build/compile/link-time hermeticity guarantee.
 #
-#   --//:io_backend=rust  (default) -- the rust I/O layer: the process event loop is tokio
-#                         (kj-rs-tokio) and every socket/stream is tokio-backed (kj-rs-io); the
-#                         C++ layers above the streams (kj-http, kj-tls, capnp-rpc) are unchanged
-#                         and run over those tokio streams. In this config kj's own OS-I/O
-#                         layer (kj-async-os) must be ABSENT from the link: checked on the
-#                         dependency graph by build/rust_io_graph_check.sh and on the linked
+#   --//:io_backend=rust  (default) -- the rust I/O and HTTP/TLS layer: the process event loop is
+#                         tokio (kj-rs-tokio), every socket/stream is tokio-backed (kj-rs-io),
+#                         and kj's HTTP and TLS interfaces are implemented on hyper and rustls
+#                         (kj-hyper). capnp-rpc remains the unchanged C++ implementation, running
+#                         over tokio-backed streams. In this config kj's own OS-I/O layer
+#                         (kj-async-os), kj's HTTP implementation (kj-http-impl) and kj-tls must
+#                         be ABSENT from the link: checked on the dependency graph by
+#                         build/rust_io_graph_check.sh, and for kj-async-os also on the linked
 #                         binary by //src/workerd/server:rust-io-link-check.
-#   --//:io_backend=cxx   -- workerd's I/O is the concrete C++ stack end to end, including the
-#                         kj OS event loop and sockets. Byte-identical to the pre-migration
-#                         build.
+#   --//:io_backend=cxx   -- workerd's I/O is the concrete C++ stack end to end: kj-http, kj-tls
+#                         and the kj OS event loop and sockets. Byte-identical to the
+#                         pre-migration build.
 #
 # Code that must differ per backend keys off the WORKERD_RUST_IO_BACKEND_RUST define (see
 # //src/workerd/util:setup-async-io) or off the config_settings below in a select().

build/deps/rust.MODULE.bazel

@@ -57,6 +57,42 @@ crate.annotation(
     crate = "capnpc",
     gen_binaries = ["capnpc-rust"],
 )
+
+# Header-value leniency patches for the Rust HTTP path (kj-hyper / hyper): KJ, following the
+# browsers' lead, forbids only NUL, CR, and LF in header values, while the `http` crate's
+# HeaderValue constructors and `httparse`'s wire parser additionally reject the other C0
+# control bytes and DEL. workerd must round-trip such values byte-for-byte in both directions
+# (WPT fetch/api headers/header-values*.any.js asserts exactly this), so both validators are
+# relaxed to KJ's rule. CR/LF stay forbidden, so header injection/splitting stays impossible.
+crate.annotation(
+    crate = "http",
+    patch_args = ["-p1"],
+    patches = ["//:patches/rust/http-kj-lenient-header-values.patch"],
+)
+crate.annotation(
+    crate = "httparse",
+    patch_args = ["-p1"],
+    patches = ["//:patches/rust/httparse-kj-lenient-header-values.patch"],
+)
+
+# Header-name case fidelity: kj-http writes header names in exactly the case the application
+# supplied, and workerd's tests (and some peers) assert the raw bytes. hyper's encoder already
+# honors a per-message HeaderCaseMap extension (falling back to title-casing), but upstream
+# only populates it for forwarded messages; this patch makes the type constructible so the
+# kj<->hyper translation layer can populate it for locally-built requests/responses.
+#
+# Graceful shutdown keeps a connection with a partially received request open until that request
+# is answered, as kj's HttpServer::drain() does; upstream closes it as idle. And a client keeps a
+# connection out of the pool until the response body is consumed, as kj's HttpClient does.
+crate.annotation(
+    crate = "hyper",
+    patch_args = ["-p1"],
+    patches = [
+        "//:patches/rust/hyper-public-header-case-map.patch",
+        "//:patches/rust/hyper-graceful-shutdown-partial-request.patch",
+        "//:patches/rust/hyper-client-lazy-response-body.patch",
+    ],
+)
 crate.from_cargo(
     # TODO(cleanup): This name is a bit misleading now that we don't vendor. We can clean it up as a
     # followup.

build/rust_io_backend.bzl

@@ -2,12 +2,14 @@
 
 The dependency side of the backend switch lives in //src/rust/cxx/kj-rs-io:active-backend (one
 select over the per-backend deps); this file carries the compile-time side: the define read by
-the two translation units that have a per-backend arm.
+the translation units that have a per-backend arm.
 
-Hermeticity of the rust config (kj-async-os, kj's own event loop and sockets, must be ABSENT from
-the workerd link, or its kj::setupAsyncIo() / kj::UnixEventPort definitions collide with the tokio
-shim's and the linker silently keeps whichever archive it meets first) is checked in two places:
-  * build/rust_io_graph_check.sh -- one `bazel cquery somepath(...)` over the dependency graph
+Hermeticity of the rust config is checked in two places. kj-async-os (kj's own event loop and
+sockets) must be ABSENT from the workerd link, or its kj::setupAsyncIo() / kj::UnixEventPort
+definitions collide with the tokio shim's and the linker silently keeps whichever archive it meets
+first; likewise kj-http-impl (kj's HTTP/1.1 implementation, whose kj:: symbols
+//src/workerd/util:kj-http defines over hyper) and kj-tls (replaced by rustls).
+  * build/rust_io_graph_check.sh -- `bazel cquery somepath(...)` over the dependency graph
     (`just check-io-backend-graph`; the lint CI lane runs it);
   * //src/workerd/server:rust-io-link-check -- the linked binary's symbol names.
 """

build/rust_io_graph_check.sh

@@ -1,29 +1,45 @@
 #!/bin/bash
 # Dependency-graph check for the Rust I/O backend: under --//:io_backend=rust, the workerd binary
-# must not reach kj-async-os (kj's own event loop and sockets), directly or through the
-# @capnp-cpp//src/kj:kj-async umbrella. If it does, kj::setupAsyncIo() and kj::UnixEventPort's
-# members are defined twice -- by kj and by the tokio shim (//src/workerd/util:setup-async-io) --
-# and with static archives the linker keeps whichever it meets first, silently.
+# must not reach
+#   * kj-async-os (kj's own event loop and sockets), directly or through the
+#     @capnp-cpp//src/kj:kj-async umbrella: kj::setupAsyncIo() and kj::UnixEventPort's members
+#     would be defined twice -- by kj and by the tokio shim (//src/workerd/util:setup-async-io);
+#   * kj-http-impl (kj's HTTP/1.1 implementation), directly or through the kj-http umbrella: its
+#     kj:: symbols are defined over hyper by //src/workerd/util:kj-http;
+#   * kj-tls (OpenSSL), replaced by rustls.
+# With static archives the linker keeps whichever definition it meets first, silently.
 #
-# One query, empty output means clean; otherwise it prints one offending dependency path. Extra
+# One query per forbidden target; empty output means clean, otherwise it prints one offending
+# dependency path. Extra
 # arguments are passed to bazel (CI passes its --config flags). The linked binary's symbols are
 # checked separately by //src/workerd/server:rust-io-link-check.
 set -euo pipefail
 cd "$(dirname "$0")/.."
 
 TARGET=//src/workerd/server:workerd
-FORBIDDEN=@capnp-cpp//src/kj:kj-async-os
+FORBIDDEN=(
+  "@capnp-cpp//src/kj:kj-async-os|Retarget the offending edge from the @capnp-cpp//src/kj:kj-async umbrella to :kj-async-core / :kj-async-io."
+  "@capnp-cpp//src/kj/compat:kj-http-impl|Depend on //src/workerd/util:kj-http (or :kj-http-types) instead of @capnp-cpp//src/kj/compat:kj-http."
+  "@capnp-cpp//src/kj/compat:kj-tls|Use //src/workerd/server:tls-network instead of kj-tls."
+)
 
 errlog=$(mktemp)
 trap 'rm -f "$errlog"' EXIT
-if ! paths=$(bazel cquery "$@" --//:io_backend=rust "somepath($TARGET, $FORBIDDEN)" 2>"$errlog"); then
-  cat "$errlog" >&2
-  exit 1
-fi
-if [ -n "$paths" ]; then
-  echo "FAIL: $TARGET reaches $FORBIDDEN under --//:io_backend=rust:"
-  echo "$paths"
-  echo "Retarget the offending edge from the @capnp-cpp//src/kj:kj-async umbrella to :kj-async-core / :kj-async-io."
-  exit 1
-fi
-echo "ok: $TARGET does not reach $FORBIDDEN under --//:io_backend=rust"
+status=0
+for entry in "${FORBIDDEN[@]}"; do
+  forbidden=${entry%%|*}
+  hint=${entry#*|}
+  if ! paths=$(bazel cquery "$@" --//:io_backend=rust "somepath($TARGET, $forbidden)" 2>"$errlog"); then
+    cat "$errlog" >&2
+    exit 1
+  fi
+  if [ -n "$paths" ]; then
+    echo "FAIL: $TARGET reaches $forbidden under --//:io_backend=rust:"
+    echo "$paths"
+    echo "$hint"
+    status=1
+  else
+    echo "ok: $TARGET does not reach $forbidden under --//:io_backend=rust"
+  fi
+done
+exit $status

deps/rust/BUILD.bazel

@@ -11,6 +11,14 @@ cc_library(
     linkopts = select({
         "@platforms//os:windows": [
             "ntdll.lib",
+            # System certificate store APIs behind rustls-native-certs/rustls-platform-verifier.
+            "crypt32.lib",
+        ],
+        "@platforms//os:macos": [
+            "-framework",
+            "Security",
+            "-framework",
+            "CoreFoundation",
         ],
         "//conditions:default": [],
     }),