kj-hyper: hyper, rustls and kj's WebSockets behind kj-typed seams

build/deps/rust.MODULE.bazel

@@ -58,6 +58,45 @@ crate.annotation(
     crate = "capnpc",
     gen_binaries = ["capnpc-rust"],
 )
+
+# Header-value leniency patches for the Rust HTTP path (kj-hyper / hyper): KJ, following the
+# browsers' lead, forbids only NUL, CR, and LF in header values, while the `http` crate's
+# HeaderValue constructors and `httparse`'s wire parser additionally reject the other C0
+# control bytes and DEL. workerd must round-trip such values byte-for-byte in both directions
+# (WPT fetch/api headers/header-values*.any.js asserts exactly this), so both validators are
+# relaxed to KJ's rule. CR/LF stay forbidden, so header injection/splitting stays impossible.
+crate.annotation(
+    crate = "http",
+    patch_args = ["-p1"],
+    patches = ["//:patches/rust/crates/http/kj-lenient-header-values.patch"],
+)
+crate.annotation(
+    crate = "httparse",
+    patch_args = ["-p1"],
+    patches = ["//:patches/rust/crates/httparse/kj-lenient-header-values.patch"],
+)
+
+# Header-name case fidelity: kj-http writes header names in exactly the case the application
+# supplied, and workerd's tests (and some peers) assert the raw bytes. hyper's encoder already
+# honors a per-message HeaderCaseMap extension (falling back to title-casing), and its parser
+# records peers' spellings in one, but upstream keeps the type private; this patch makes it
+# public so kj-hyper can fill it for outgoing messages and read it for incoming ones.
+#
+# Graceful shutdown keeps a connection with a partially received request open until that request
+# is answered, as kj's HttpServer::drain() does; upstream closes it as idle. And a client keeps a
+# connection out of the pool until the response body is consumed, as kj's HttpClient does. And the
+# response a server generates for a request it cannot parse (400, 414, 431) explains the error in
+# a text/plain body, as kj's HttpServer does and RFC 9110 section 15.5 asks; upstream sends none.
+crate.annotation(
+    crate = "hyper",
+    patch_args = ["-p1"],
+    patches = [
+        "//:patches/rust/crates/hyper/public-header-case-map.patch",
+        "//:patches/rust/crates/hyper/graceful-shutdown-partial-request.patch",
+        "//:patches/rust/crates/hyper/client-lazy-response-body.patch",
+        "//:patches/rust/crates/hyper/parse-error-explanation.patch",
+    ],
+)
 crate.from_cargo(
     # TODO(cleanup): This name is a bit misleading now that we don't vendor. We can clean it up as a
     # followup.

deps/rust/BUILD.bazel

@@ -11,6 +11,14 @@ cc_library(
     linkopts = select({
         "@platforms//os:windows": [
             "ntdll.lib",
+            # System certificate store APIs behind rustls-platform-verifier.
+            "crypt32.lib",
+        ],
+        "@platforms//os:macos": [
+            "-framework",
+            "Security",
+            "-framework",
+            "CoreFoundation",
         ],
         "//conditions:default": [],
     }),