feat(parser,conn): chunked request bodies (v0.3 chunk 2)

parser: Transfer-Encoding: chunked no longer 411s — it sets
ParsedHead.chunked and the conn actor decodes. Two hard rejections at
parse time, both Malformed/400: chunked together with Content-Length
(the request-smuggling ambiguity; RFC 7230 §3.3.3 permits rejection)
and chunked on HTTP/1.0 (TE is a 1.1 mechanism). ParseError::Unsupported
is now unconstructed; kept for future framings.

conn_actor: read_chunked_body decodes incrementally from buf[head_len..],
reading on the SAME request deadline the head came in under (a stalled
chunked body dies at request_timeout exactly like a stalled CL body).
Chunk extensions are ignored; trailers are consumed and discarded.
Bounds: decoded size capped at max_body_bytes -> 413 the moment the cap
would be crossed (the CL pre-check can't see a chunked body's size up
front); size lines capped at 128 bytes and the trailer section at 8 KiB
-> 400, so framing spam can't grow the read buffer unboundedly.

Returns (decoded, raw_consumed_past_head): the keep-alive drain at the
loop bottom now drops head_len + RAW framing length (not decoded length),
so pipelined requests behind a chunked body land exactly — covered by
the trailers+pipelining test.

Tests: 3 parser unit (flagging, CL+TE reject, 1.0 reject; the old
chunked-is-Unsupported test replaced) + 6 integration (decode with
extensions, trailers + pipelined next request, 413 over decoded cap,
400 malformed size line, 400 CL+TE on the wire, stalled chunked body
killed at request_timeout with silent close).

src/conn_actor.rs

@@ -133,6 +133,8 @@ pub fn run_connection(
         let _ = registry.cast(Cast::ConnBusy(me));
 
         // ----- 2. Read body. -----
+        // Content-Length pre-check only applies to fixed bodies; a chunked
+        // body is bounded incrementally by the decoder.
         let body_len = parsed.content_length.unwrap_or(0);
         if body_len > limits.max_body_bytes {
             let _ = write_all(
@@ -152,11 +154,41 @@ pub fn run_connection(
             }
         }
 
-        let body = match read_body(raw, &mut buf, parsed.head_len, body_len, request_deadline) {
-            Ok(b) => b,
-            // Timeout mid-body (and any other body io error) -> just close;
-            // there's no point talking HTTP to a client this far gone.
-            Err(_) => return,
+        // `consumed_past_head`: how many RAW bytes of `buf` past the head
+        // this request's body occupied — for chunked bodies that is framing
+        // included, NOT the decoded length. The keep-alive drain at the
+        // bottom of the loop must drop exactly this much to land on the
+        // next pipelined request.
+        let (body, consumed_past_head) = if parsed.chunked {
+            match read_chunked_body(raw, &mut buf, parsed.head_len, &limits, request_deadline) {
+                Ok(ok) => ok,
+                Err(ChunkedBodyErr::TooLarge) => {
+                    let _ = write_all(
+                        raw,
+                        b"HTTP/1.1 413 Payload Too Large\r\ncontent-length: 0\r\nconnection: close\r\n\r\n",
+                        Instant::now() + limits.write_timeout,
+                    );
+                    return;
+                }
+                Err(ChunkedBodyErr::Malformed) => {
+                    let _ = write_all(
+                        raw,
+                        b"HTTP/1.1 400 Bad Request\r\ncontent-length: 0\r\nconnection: close\r\n\r\n",
+                        Instant::now() + limits.write_timeout,
+                    );
+                    return;
+                }
+                // Timeout mid-body (and any other io error) -> just close.
+                Err(ChunkedBodyErr::Io(_)) => return,
+            }
+        } else {
+            match read_body(raw, &mut buf, parsed.head_len, body_len, request_deadline) {
+                Ok(b) => (b, body_len),
+                // Timeout mid-body (and any other body io error) -> just
+                // close; there's no point talking HTTP to a client this far
+                // gone.
+                Err(_) => return,
+            }
         };
 
         let keep_alive = parsed.keep_alive;
@@ -236,9 +268,9 @@ pub fn run_connection(
         // catch us, which is acceptable: drain means no new work.)
         let _ = registry.cast(Cast::ConnIdle(me));
 
-        // Drop the request bytes (head + body) from `buf`; anything past
-        // them is the start of the next pipelined request.
-        let consumed = head_len + body_len;
+        // Drop the request bytes (head + raw body framing) from `buf`;
+        // anything past them is the start of the next pipelined request.
+        let consumed = head_len + consumed_past_head;
         buf.drain(..consumed);
     }
 }
@@ -364,6 +396,135 @@ fn read_body(
     Ok(buf[head_len..head_len + body_len].to_vec())
 }
 
+// ---------------------------------------------------------------------------
+// read_chunked_body — incremental chunked transfer-decoding (request side).
+// ---------------------------------------------------------------------------
+//
+// Decodes `Transfer-Encoding: chunked` from `buf[head_len..]`, reading more
+// from the socket as needed on the SAME request deadline the head was read
+// under. Returns (decoded_body, raw_bytes_consumed_past_head) — the raw
+// count includes all framing and the trailer section, so the caller's
+// keep-alive drain lands exactly on the next pipelined request.
+//
+// Bounds: the DECODED size is capped at max_body_bytes (-> TooLarge/413);
+// a single size line (incl. chunk extensions, which are ignored) is capped
+// at MAX_SIZE_LINE and the trailer section at MAX_TRAILER_BYTES (-> 
+// Malformed/400) so framing spam can't grow `buf` unboundedly. Trailers
+// are consumed and discarded — nothing in the pipeline wants them yet.
+
+const MAX_SIZE_LINE:     usize = 128;
+const MAX_TRAILER_BYTES: usize = 8 * 1024;
+
+#[allow(dead_code)] // io::Error is captured for future logging
+enum ChunkedBodyErr {
+    Io(io::Error),
+    Malformed,
+    TooLarge,
+}
+
+fn read_chunked_body(
+    fd: RawFd,
+    buf: &mut Vec<u8>,
+    head_len: usize,
+    limits: &ConnLimits,
+    deadline: Instant,
+) -> Result<(Vec<u8>, usize), ChunkedBodyErr> {
+    // Ensure `buf` holds at least `until` bytes, reading on the request
+    // deadline. Io(TimedOut) on expiry, UnexpectedEof on early close.
+    fn fill_to(
+        fd: RawFd,
+        buf: &mut Vec<u8>,
+        until: usize,
+        deadline: Instant,
+    ) -> Result<(), ChunkedBodyErr> {
+        while buf.len() < until {
+            match read_some(fd, buf, 8 * 1024, deadline) {
+                Ok(0) => {
+                    return Err(ChunkedBodyErr::Io(io::Error::new(
+                        ErrorKind::UnexpectedEof,
+                        "client closed during chunked body",
+                    )))
+                }
+                Ok(_) => {}
+                Err(e) => return Err(ChunkedBodyErr::Io(e)),
+            }
+        }
+        Ok(())
+    }
+
+    // Find "\r\n" in buf[from..], reading more as needed; the line may be
+    // at most `max_line` bytes (terminator excluded). Returns the index of
+    // the '\r'.
+    fn find_crlf(
+        fd: RawFd,
+        buf: &mut Vec<u8>,
+        from: usize,
+        max_line: usize,
+        deadline: Instant,
+    ) -> Result<usize, ChunkedBodyErr> {
+        let mut scan = from;
+        loop {
+            while scan + 1 < buf.len() {
+                if buf[scan] == b'\r' && buf[scan + 1] == b'\n' {
+                    return Ok(scan);
+                }
+                scan += 1;
+                if scan - from > max_line {
+                    return Err(ChunkedBodyErr::Malformed);
+                }
+            }
+            fill_to(fd, buf, buf.len() + 1, deadline)?;
+        }
+    }
+
+    let mut pos = head_len;
+    let mut decoded: Vec<u8> = Vec::new();
+
+    loop {
+        // ----- size line: HEX[;extensions]\r\n -----
+        let line_end = find_crlf(fd, buf, pos, MAX_SIZE_LINE, deadline)?;
+        let line = &buf[pos..line_end];
+        let size_str = match line.iter().position(|&b| b == b';') {
+            Some(i) => &line[..i], // chunk extensions: ignored
+            None    => line,
+        };
+        let size_str = std::str::from_utf8(size_str)
+            .map_err(|_| ChunkedBodyErr::Malformed)?
+            .trim();
+        let size = usize::from_str_radix(size_str, 16)
+            .map_err(|_| ChunkedBodyErr::Malformed)?;
+        pos = line_end + 2;
+
+        if size == 0 {
+            // ----- trailer section: zero or more header lines, then CRLF -----
+            let trailer_start = pos;
+            loop {
+                let t_end = find_crlf(fd, buf, pos, MAX_SIZE_LINE.max(1024), deadline)?;
+                let empty = t_end == pos;
+                pos = t_end + 2;
+                if empty {
+                    return Ok((decoded, pos - head_len));
+                }
+                if pos - trailer_start > MAX_TRAILER_BYTES {
+                    return Err(ChunkedBodyErr::Malformed);
+                }
+            }
+        }
+
+        if decoded.len() + size > limits.max_body_bytes {
+            return Err(ChunkedBodyErr::TooLarge);
+        }
+
+        // ----- chunk payload + trailing CRLF -----
+        fill_to(fd, buf, pos + size + 2, deadline)?;
+        decoded.extend_from_slice(&buf[pos..pos + size]);
+        if &buf[pos + size..pos + size + 2] != b"\r\n" {
+            return Err(ChunkedBodyErr::Malformed);
+        }
+        pos += size + 2;
+    }
+}
+
 // ---------------------------------------------------------------------------
 // read_some — single epoll-park + read loop, bounded by a deadline.
 // ---------------------------------------------------------------------------

src/parser.rs

@@ -4,14 +4,13 @@
 //! copy, battle-tested). Body framing, keep-alive logic and response writing
 //! are ours.
 //!
-//! v1 body framing:
+//! Body framing:
 //!   - `Content-Length: N` — read exactly N bytes.
 //!   - No body header — empty body.
-//!   - `Transfer-Encoding: chunked` — deferred. Returns ParseError::Unsupported
-//!     and the connection actor responds 411 Length Required + close.
-//!
-//! Keep it stupid simple. Chunked decoding lands when something actually
-//! requests it.
+//!   - `Transfer-Encoding: chunked` (HTTP/1.1) — flagged in `ParsedHead`;
+//!     the connection actor decodes incrementally (`read_chunked_body`).
+//!     Chunked + Content-Length together, or chunked on HTTP/1.0, is
+//!     Malformed (request-smuggling ambiguity; RFC 7230 §3.3.3).
 
 use crate::conn::{Body, Conn, HeaderMap, HttpVersion, Method, RespBody};
 
@@ -30,8 +29,9 @@ pub enum ParseError {
     TooManyHeaders,
     /// `Content-Length` header could not be parsed as an integer.
     BadContentLength,
-    /// A wire feature we haven't implemented yet (e.g. chunked encoding).
-    /// Connection actor responds 411 + close.
+    /// A wire feature we haven't implemented. Currently unconstructed
+    /// (chunked decoding landed in v0.3); kept for future unsupported
+    /// framings. Connection actor responds 411 + close.
     Unsupported,
 }
 
@@ -50,6 +50,10 @@ pub struct ParsedHead {
     pub version:        HttpVersion,
     pub headers:        HeaderMap,
     pub content_length: Option<usize>,
+    /// `Transfer-Encoding: chunked` — the body is chunked-framed and the
+    /// connection actor decodes it (`read_chunked_body`). Mutually
+    /// exclusive with `content_length` (rejected as Malformed).
+    pub chunked:        bool,
     pub keep_alive:     bool,
     pub expect_100:     bool,
 }
@@ -130,7 +134,13 @@ pub fn parse_head(buf: &[u8], max_headers: usize) -> Result<ParsedHead, ParseErr
     }
 
     if chunked {
-        return Err(ParseError::Unsupported);
+        // Transfer-Encoding is an HTTP/1.1 mechanism; a 1.0 request
+        // carrying it is malformed. And a request carrying BOTH a
+        // Content-Length and TE: chunked is the classic request-smuggling
+        // ambiguity — RFC 7230 §3.3.3 lets a server reject it, and we do.
+        if version == HttpVersion::Http10 || content_length.is_some() {
+            return Err(ParseError::Malformed);
+        }
     }
 
     // Keep-alive logic, RFC 7230 §6.3:
@@ -149,6 +159,7 @@ pub fn parse_head(buf: &[u8], max_headers: usize) -> Result<ParsedHead, ParseErr
         version,
         headers,
         content_length,
+        chunked,
         keep_alive,
         expect_100,
     })
@@ -357,11 +368,28 @@ mod tests {
     }
 
     #[test]
-    fn parse_chunked_unsupported() {
+    fn parse_chunked_is_flagged() {
         let req = b"POST /a HTTP/1.1\r\nHost: x\r\nTransfer-Encoding: chunked\r\n\r\n";
+        let head = parse_head(req, 64).unwrap();
+        assert!(head.chunked);
+        assert_eq!(head.content_length, None);
+    }
+
+    #[test]
+    fn parse_chunked_plus_content_length_is_malformed() {
+        let req = b"POST /a HTTP/1.1\r\nHost: x\r\nContent-Length: 5\r\nTransfer-Encoding: chunked\r\n\r\n";
         match parse_head(req, 64) {
-            Err(ParseError::Unsupported) => {}
-            _ => panic!("expected Unsupported for chunked"),
+            Err(ParseError::Malformed) => {}
+            _ => panic!("expected Malformed for CL + chunked"),
+        }
+    }
+
+    #[test]
+    fn parse_chunked_on_http10_is_malformed() {
+        let req = b"POST /a HTTP/1.0\r\nHost: x\r\nTransfer-Encoding: chunked\r\n\r\n";
+        match parse_head(req, 64) {
+            Err(ParseError::Malformed) => {}
+            _ => panic!("expected Malformed for chunked on 1.0"),
         }
     }