fix(cancel): a token belongs to its call; downloads take one; openkal Windows has entropy

The token is set on the socket at the bottom of a connection and nowhere else.
TlsSocket::set_stop forwards to the session beneath it, which is where every
wait happens inside an https:// proxy's tunnel; setting only its own socket left
a reused tunnel on the token of the call that opened it. Once that token was
stopped, which a std::jthread does in its destructor, every wait on the tunnel
failed at once and the stale-connection retry sent a POST that had already
arrived a second time; a later call's own token never reached the tunnel at all.

PooledConnection::keep() takes the token off the connection it returns to the
pool, so nothing in the pool carries one.

download_to_file takes a std::stop_token as its last argument, and
DownloadToFileResult::cancelled is set by it or by isCancelled, as
HttpResponse::cancelled is. proxy_connect, the wrapper nothing here calls, does
not take one.

Where the C library is musl, the TLS random generator is seeded from musl's
getentropy rather than mbedTLS's reading of /dev/urandom, which above openkal on
x86_64-windows-musl does not exist: every handshake there failed with
"CTR_DRBG - The entropy source failed".

Tests: a stop after the call returned does not reach the next call, and the
next call's token does, each directly, through an http:// proxy and through an
https:// proxy; a SOCKS5 proxy that never answers; a download cancelled before
the head, during the body, with a token already stopped, and by isCancelled.
test_cancel imports std before its includes under libc++, whose 20 and 22 fail
to link stop_source::request_stop() the other way round.

examples/openkal follows mcpp-index's openkal pins (runtime 0.15.2) and cancels
a handshake against a local listener, which needs no network; it runs on
x86_64-linux-gnu, x86_64-linux-musl, aarch64-linux-musl and x86_64-windows-musl.

Author: speak-agent

examples/openkal/mcpp.toml

@@ -11,7 +11,7 @@ version = "0.1.0"
 # sources either way. That is the claim this directory exists to check.
 [dependencies]
 tinyhttps            = { path = "../.." }
-openkal-llvm-runtime = "0.9.1"
+openkal-llvm-runtime = "0.15.2"
 
 [targets.smoke]
 kind = "bin"
@@ -22,3 +22,11 @@ main = "src/main.cpp"
 # dependency above.
 [toolchain]
 default = "llvm@22.1.8"
+
+# The programs of the other targets this example is run for, as mcpp-index's
+# openkal measurement runs them (tests/openkal/pins.toml there).
+[target.x86_64-windows-musl]
+runner = ["wine"]
+
+[target.aarch64-linux-musl]
+runner = ["qemu-aarch64"]

examples/openkal/src/main.cpp

@@ -10,11 +10,82 @@
 // is none it says so and exits 0, because a CI job without egress should report
 // "not run" rather than "broken". A certificate the client refused is not an
 // absence of network, and exits 1.
+// The listener below is made with the C library's sockets, which openkal-musl
+// provides on every target this example runs on. C headers only: they declare
+// nothing `import std` also declares.
+#include <arpa/inet.h>
+#include <netinet/in.h>
+#include <sys/socket.h>
+#include <unistd.h>
+
 import mcpplibs.tinyhttps;
 import std;
 
 namespace https = mcpplibs::tinyhttps;
 
+namespace {
+
+// CANCELLATION ABOVE openkal, WITH NO NETWORK.
+//
+// A listener that never accepts: the connection completes in the backlog, the
+// client sends its ClientHello and waits for an answer that is not coming. That
+// wait is a `poll` in slices of 50 ms, and above openkal each slice is a bounded
+// read (`kal_timeout_read`) rather than a readiness query, which is the part of
+// the stack this checks. The read timeout is 30 s, so returning promptly can
+// only be the token's doing.
+bool cancellation_works() {
+    const int listener = ::socket(AF_INET, SOCK_STREAM, 0);
+    if (listener < 0) { std::println("cancellation: no socket"); return false; }
+    sockaddr_in addr {};
+    addr.sin_family = AF_INET;
+    addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
+    addr.sin_port = 0;
+    socklen_t len = sizeof addr;
+    if (::bind(listener, reinterpret_cast<sockaddr*>(&addr), sizeof addr) != 0
+        || ::listen(listener, 4) != 0
+        || ::getsockname(listener, reinterpret_cast<sockaddr*>(&addr), &len) != 0) {
+        std::println("cancellation: no listener");
+        ::close(listener);
+        return false;
+    }
+    const std::string url = "https://127.0.0.1:" + std::to_string(ntohs(addr.sin_port)) + "/";
+
+    https::HttpClientConfig config;
+    config.verifySsl = false;
+    config.connectTimeoutMs = 5000;
+    config.readTimeoutMs = 30000;
+    https::HttpClient client(config);
+    https::HttpRequest request;
+    request.method = https::Method::GET;
+    request.url = url;
+
+    // A token stopped before the call: nothing is sent.
+    std::stop_source early;
+    early.request_stop();
+    auto before = client.send(request, early.get_token());
+
+    // A token stopped while the handshake waits.
+    std::stop_source source;
+    std::jthread stopper([&] {
+        std::this_thread::sleep_for(std::chrono::milliseconds(200));
+        source.request_stop();
+    });
+    const auto start = std::chrono::steady_clock::now();
+    auto during = client.send(request, source.get_token());
+    const auto ms = std::chrono::duration_cast<std::chrono::milliseconds>(
+        std::chrono::steady_clock::now() - start).count();
+    ::close(listener);
+
+    const bool ok = before.cancelled && before.statusCode == 0
+                 && during.cancelled && during.statusCode == 0
+                 && ms >= 150 && ms < 2000;
+    std::println("cancellation: {} (stopped at 200 ms, returned after {} ms)",
+                 ok ? "ok" : "WRONG", ms);
+    return ok;
+}
+
+} // namespace
+
 int main() {
     https::Socket::platform_init();
 
@@ -30,6 +101,8 @@ int main() {
     }
     std::println("framing parsers: ok");
 
+    if (!cancellation_works()) return 1;
+
     https::HttpClientConfig config;
     config.connectTimeoutMs = 15000;
     config.readTimeoutMs = 20000;

src/http.cppm

@@ -149,6 +149,12 @@ export struct DownloadToFileResult {
     // failure downstream of a truncated file otherwise blames the wrong party.
     bool writeFailed { false };
 
+    // True when the caller abandoned the transfer: `isCancelled` returned true
+    // or the stop token was stopped. `error` is then "Cancelled" if no status
+    // line had arrived and "cancelled" if one had, as for `HttpResponse`. A
+    // destination that failed first is reported as that instead.
+    bool cancelled { false };
+
     bool ok() const { return statusCode >= 200 && statusCode < 300 && error.empty(); }
 };
 
@@ -842,7 +848,16 @@ public:
 
     // Call only where the body was read to the end its framing declared and the
     // response did not ask for the connection to close.
-    void keep() noexcept { armed_ = false; }
+    //
+    // A connection in the pool carries no stop token. The call that used it
+    // set its own (`perform_exchange`), and the caller may stop that token
+    // after this call has returned — a `std::jthread` does so in its
+    // destructor — which must not reach whatever takes the connection next.
+    void keep() noexcept {
+        if (!armed_) return;
+        armed_ = false;
+        if (auto it = pool_.find(key_); it != pool_.end()) it->second.set_stop({});
+    }
 
     // Drop now rather than at the end of the scope. Idempotent, and a no-op
     // after `keep()`.
@@ -953,14 +968,16 @@ public:
     // Download URL to file with streaming progress.
     // Follows redirects. Calls onProgress periodically during body read.
     // isCancelled is checked after each block — return true to abort.
+    // `stop` is as for send(), and also ends the wait for the response head.
     DownloadToFileResult download_to_file(
         const std::string& url,
         const std::filesystem::path& destFile,
         DownloadProgressFn onProgress = nullptr,
-        std::function<bool()> isCancelled = nullptr)
+        std::function<bool()> isCancelled = nullptr,
+        std::stop_token stop = {})
     {
         return download_to_file_impl(url, destFile, std::move(onProgress),
-                                     std::move(isCancelled), 0);
+                                     std::move(isCancelled), 0, stop);
     }
 
     HttpClientConfig& config() { return config_; }
@@ -1237,9 +1254,15 @@ private:
         const std::filesystem::path& destFile,
         DownloadProgressFn onProgress,
         std::function<bool()> isCancelled,
-        int redirectCount)
+        int redirectCount,
+        std::stop_token stop)
     {
         DownloadToFileResult result;
+        if (stop.stop_requested()) {
+            result.error = "Cancelled";
+            result.cancelled = true;
+            return result;
+        }
 
         auto parsed = parse_url(url);
         if (parsed.scheme != "https") {
@@ -1256,9 +1279,10 @@ private:
         request.headers = { {"User-Agent", "tinyhttps/1.0"}, {"Accept", "*/*"} };
 
         auto exchange = perform_exchange(parsed, poolKey,
-                                         build_request(request, parsed), guard);
+                                         build_request(request, parsed), guard, stop);
         if (!exchange.error.empty()) {
             result.error = exchange.error;
+            result.cancelled = exchange.cancelled;
             return result;
         }
 
@@ -1283,14 +1307,20 @@ private:
                 } else {
                     guard.drop();
                 }
+                if (stop.stop_requested()) {
+                    result.error = "cancelled";
+                    result.cancelled = true;
+                    return result;
+                }
 
                 if (location.starts_with("/")) {
                     location = parsed.scheme + "://" + parsed.host +
                                (parsed.port != 443 ? ":" + std::to_string(parsed.port) : "") +
                                location;
                 }
                 return download_to_file_impl(location, destFile, std::move(onProgress),
-                                             std::move(isCancelled), redirectCount + 1);
+                                             std::move(isCancelled), redirectCount + 1,
+                                             stop);
             }
         }
 
@@ -1383,7 +1413,10 @@ private:
 
                 written += size;
                 if (onProgress) onProgress(totalBytes, written);
-                if (isCancelled && isCancelled()) { cancelled = true; return false; }
+                if ((isCancelled && isCancelled()) || stop.stop_requested()) {
+                    cancelled = true;
+                    return false;
+                }
                 return true;
             });
 
@@ -1401,16 +1434,20 @@ private:
                 result.error = cancelled ? "cancelled" : "stopped";
                 break;
             case BodyEnd::Truncated:
-                result.error = outcome.error;
+                // A wait that the stop token ended reads as a truncated body.
+                cancelled = stop.stop_requested();
+                result.error = cancelled ? "cancelled" : outcome.error;
                 break;
         }
+        result.cancelled = cancelled;
 
         // The destination's failure outranks whatever the switch recorded: a
         // stop that the file asked for is not a cancellation, and a body that
         // arrived whole into a file that lost it has not succeeded.
         if (writeFailed) {
             result.error = write_failure();
             result.writeFailed = true;
+            result.cancelled = false;
         }
         return result;
     }

src/proxy.cppm

@@ -388,11 +388,11 @@ export ProxyTunnel proxy_tunnel(const ProxyConfig& proxy,
 // say why it failed; `proxy_tunnel` can.
 export Socket proxy_connect(std::string_view proxyHost, int proxyPort,
                             std::string_view targetHost, int targetPort,
-                            int timeoutMs, std::stop_token stop = {}) {
+                            int timeoutMs) {
     ProxyConfig proxy;
     proxy.host = std::string(proxyHost);
     proxy.port = proxyPort;
-    auto tunnel = proxy_tunnel(proxy, targetHost, targetPort, timeoutMs, true, stop);
+    auto tunnel = proxy_tunnel(proxy, targetHost, targetPort, timeoutMs);
     return std::move(tunnel.socket);
 }
 

src/tls.cppm

@@ -15,6 +15,21 @@ module;
 #pragma comment(lib, "bcrypt.lib")
 #endif
 
+// WHERE THE C LIBRARY IS musl, THE ENTROPY IS THE C LIBRARY'S.
+//
+// mbedTLS's own platform source asks the kernel through `getrandom` only where
+// it recognises glibc (`entropy_poll.c`: `__linux__ && __GLIBC__`); with musl it
+// opens `/dev/urandom`. Above openkal that file is not a thing the C library can
+// promise — openkal reaches entropy through its own `openkal.random` interface,
+// and openkal-musl answers `getrandom` with it — so on x86_64-windows-musl every
+// handshake failed before it began, with "CTR_DRBG - The entropy source failed".
+// musl's `getentropy` is `getrandom` underneath on every system it runs on,
+// which is the source mbedTLS would have chosen had it known. The macro comes
+// from mcpp.toml's `cfg(c-abi = "musl")`, because musl defines none of its own.
+#ifdef TINYHTTPS_GETENTROPY
+#include <unistd.h>
+#endif
+
 export module mcpplibs.tinyhttps:tls;
 
 import :socket;
@@ -90,6 +105,19 @@ static int bio_recv(void* ctx, unsigned char* buf, size_t len) {
     return ret;   // 0 means end of stream; mbedtls turns it into SSL_CONN_EOF
 }
 
+#ifdef TINYHTTPS_GETENTROPY
+// `getentropy` gives at most 256 bytes a call.
+static int c_library_entropy(void*, unsigned char* out, size_t len) {
+    while (len > 0) {
+        const size_t n = len < 256 ? len : 256;
+        if (::getentropy(out, n) != 0) return MBEDTLS_ERR_ENTROPY_SOURCE_FAILED;
+        out += n;
+        len -= n;
+    }
+    return 0;
+}
+#endif
+
 static std::string mbedtls_message(int ret) {
     char buf[200];
     mbedtls_strerror(ret, buf, sizeof buf);
@@ -165,7 +193,18 @@ public:
     [[nodiscard]] const std::string& error() const { return error_; }
 
     // Call before connect(); it covers the handshake and every later wait.
-    void set_stop(std::stop_token stop) { socket_.set_stop(std::move(stop)); }
+    //
+    // THE TOKEN BELONGS TO THE SOCKET AT THE BOTTOM, AND ONLY THERE. Every wait
+    // ends in a `Socket` — this session's own, or, inside an https:// proxy's
+    // tunnel, the one beneath `lower_` — so that is where it is set. Setting
+    // only `socket_` left a reused tunnel holding the token of the call that
+    // opened it: a later call could not be cancelled, and once that first
+    // token was stopped every wait failed at once and the stale-connection
+    // retry sent a POST that had already arrived a second time.
+    void set_stop(std::stop_token stop) {
+        if (lower_) lower_->set_stop(stop);
+        socket_.set_stop(std::move(stop));
+    }
 
     // Connect over an already-established Socket (e.g. a proxy tunnel).
     // Takes ownership of the socket and performs TLS handshake on top of it.
@@ -336,7 +375,11 @@ private:
         state_ = std::make_unique<TlsState>();
 
         int ret = mbedtls_ctr_drbg_seed(
+#ifdef TINYHTTPS_GETENTROPY
+            &state_->ctr_drbg, c_library_entropy, nullptr,
+#else
             &state_->ctr_drbg, mbedtls_entropy_func, &state_->entropy,
+#endif
             nullptr, 0);
         if (ret != 0) return fail(mbedtls_message(ret));