Update netutils and network components for improved TLS handling and configuration

- Bump server version from 1.6 to 1.7 in netutils.ecs.
- Introduce default HTTP thread and worker counts in netutils.ecs for better configurability.
- Enhance TLS connection handling in network.cpp with timeout management during safe shutdown.
- Add tests for TLS handshake failures and timeouts in test_http_client.csc.
- Validate default worker and thread counts in test_http_server.csc, ensuring correct behavior under concurrent connections.

Author: mikecovlee

CMakeLists.txt

@@ -23,7 +23,7 @@ set(NETWORK_MAX_PORT 65535 CACHE STRING
 set(NETWORK_MAX_IO_BUFFER_SIZE 67108864 CACHE STRING
     "Maximum bytes accepted by a single read/receive/get_buffer request")
 set(NETWORK_SAFE_SHUTDOWN_TIMEOUT_MS 200 CACHE STRING
-    "UDP safe_close drain-loop timeout in milliseconds (TCP safe_shutdown waits indefinitely for async jobs)")
+    "Drain-loop deadline in milliseconds for both UDP safe_close and TCP safe_shutdown exclusive-operation and queued-I/O drain")
 set(NETWORK_TLS_SHUTDOWN_TIMEOUT_MS 5000 CACHE STRING
     "TCP safe_shutdown TLS close-notify timeout in milliseconds")
 set(NETWORK_THREAD_WORKER_POLL_MS 1 CACHE STRING

NETUTILS.md

@@ -1,6 +1,6 @@
 # CovScript NetUtils 协议文档
 
-版本：1.6
+版本：1.7
 
 作者：Covariant Script OSC
 
@@ -27,7 +27,7 @@
 ## 2. 基本常量与工具函数
 
 * `server_name = "CovScript-NetUtils"`
-* `server_version = "1.6"`
+* `server_version = "1.7"`
 
 与协议/实现相关的重要工具函数：
 
@@ -156,7 +156,8 @@ Master 分配 `rank`：先尝试使用 `deprecated_rank`（回收的编号），
 
 | 配置项                        |                                   含义 |   默认值  |
 | -------------------------- | -----------------------------------: | :----: |
-| `worker_count`             |                      每进程启动的 worker 数 |   `4`  |
+| `thread_count`             |                  底层 Asio I/O 线程数（不等于 handler 并发数） |   `4`  |
+| `worker_count`             |    单进程 HTTP 连接处理 fiber 数（控制可同时服务的活动/keep-alive 连接数） |  `64`  |
 | `max_keep_alive`           |                          每连接允许的最大请求数 |  `100` |
 | `keep_alive_timeout`       |                      保持连接的最大空闲时间（ms） | `5000` |
 | `max_connections`          |                    Master 接入的最大并发连接数 |  `100` |
@@ -336,7 +337,7 @@ slave.set_slave("127.0.0.1", 9000)
 
 * **性能调优建议**
 
-  * `worker_count` 不建议调得过高，单核能力有限，会增加调度开销。
+  * `worker_count` 控制可同时服务的活动/keep-alive 连接数量，默认为 64。高并发部署仍应根据内存、keep-alive 时间和后端延迟调整。不建议无限制调高——每个 worker fiber 持有 accept 操作的异步状态。
   * Master 模式下可以单独调整 `master_worker_count` 以改善 Master 对高并发连接的处理能力。同时，`max_connections` 也需要相应更改，防止大量连接排队的情况。
   * 由于 NetUtils 依赖 Master 节点进行分发，过多的 Slave 节点也会增加系统资源和调度的开销，一般可以取 2~8。
   * 调整 `max_keep_alive`、`keep_alive_timeout` 平衡连接复用与资源占用。

README.md

@@ -8,8 +8,8 @@ A high-performance network extension for the [Covariant Script](http://covscript
 
 | Package | Type | Version | Description |
 |---|---|---|---|
-| `network` | C++ Extension | `1.38.0_v6.2` | TCP/UDP sockets, TLS/SSL, async I/O, event loop |
-| `netutils` | CovScript | `1.6` | HTTP server framework with single-process and distributed master/slave modes |
+| `network` | C++ Extension | `1.38.0_v6.3` | TCP/UDP sockets, TLS/SSL, async I/O, event loop |
+| `netutils` | CovScript | `1.7` | HTTP server framework with single-process and distributed master/slave modes |
 | `argparse` | CovScript | `1.1` | Lightweight command-line argument parser |
 
 > **Note:** `netutils` and `argparse` are provided as both source (`.ecs`), compiled package (`.csp`), and bytecode module (`.csym`) — place them in your project's `imports/` directory.
@@ -76,7 +76,7 @@ All options can be overridden with `-D<option>=<value>`:
 | `NETWORK_FIXED_HEX_SIZE` | `16` | Hex string length for framing protocol helpers |
 | `NETWORK_MAX_PORT` | `65535` | Maximum valid TCP/UDP port number |
 | `NETWORK_MAX_IO_BUFFER_SIZE` | `67108864` | Max bytes per single read/receive call (64 MiB) |
-| `NETWORK_SAFE_SHUTDOWN_TIMEOUT_MS` | `200` | UDP `safe_close` drain timeout |
+| `NETWORK_SAFE_SHUTDOWN_TIMEOUT_MS` | `200` | Drain-loop deadline for UDP `safe_close` and TCP `safe_shutdown` |
 | `NETWORK_TLS_SHUTDOWN_TIMEOUT_MS` | `5000` | TLS close-notify timeout |
 | `NETWORK_THREAD_WORKER_POLL_MS` | `1` | Thread executor polling interval |
 

csbuild/netutils.json

@@ -3,7 +3,7 @@
     "Name": "netutils",
     "Info": "Network Utilities",
     "Author": "CovScript Organization",
-    "Version": "1.6",
+    "Version": "1.7",
     "Source": "netutils.ecs",
     "Target": "netutils.csp",
     "Dependencies": [

csbuild/network.json

@@ -3,7 +3,7 @@
     "Name": "network",
     "Info": "Socket Extension",
     "Author": "CovScript Organization",
-    "Version": "1.38.0_v6.2",
+    "Version": "1.38.0_v6.3",
     "Target": "build/imports/network.cse",
     "Dependencies": []
 }

netutils.csp

@@ -1,6 +1,6 @@
 # Generated by Extended CovScript Compiler
 # DO NOT MODIFY
-# Date: Tue Jul 14 16:30:44 2026
+# Date: Tue Jul 14 18:56:51 2026
 @charset: utf8
 import ecs as netutils_ecs
 struct __netutils_ecs_lambda_impl_1__
@@ -122,14 +122,16 @@ import network; using network
 import regex
 import codec.json as json
 constant server_name = "CovScript-NetUtils"
-constant server_version = "1.6"
+constant server_version = "1.7"
 constant http_client_read_chunk = 8192
 constant http_max_header_line_size = 8192
 constant http_max_header_size = 65536
 constant http_max_body_size = 67108864
 constant framing_hex_size = 16
 constant default_http_port = 80
 constant default_https_port = 443
+constant default_http_thread_count = 4
+constant default_http_worker_count = 64
 var request_line_reg = regex.build_optimize("^([A-Z]+) ([^ ?]+)(?:\\?([^ ]*))? HTTP/([0-9.]+)$")
 var request_header_reg = regex.build_optimize("^([^:]*): ?(.*)$")
 namespace state_codes
@@ -1257,7 +1259,12 @@ class http_client
 				return false
 			end
 			if target["scheme"] == "https"
-				sock.connect_ssl(host, tls_options)
+				var tls_state = async.connect_ssl(sock, host, tls_options)
+				if !_await(tls_state)
+					log("TLS handshake failed: " + tls_state.get_error())
+					sock.safe_shutdown()
+					return false
+				end
 			end
 			sock.set_opt_no_delay(true)
 			return true
@@ -1733,9 +1740,9 @@ class http_server
 	var wwwroot_path = null
 	var url_map = new hash_map
 	var thread_pool = null
-	var thread_count = 4
+	var thread_count = default_http_thread_count
 	var worker_list = null
-	var worker_count = 4
+	var worker_count = default_http_worker_count
 	var max_keep_alive = 100
 	var keep_alive_timeout = 5000
 	var mtime_map = new hash_map

netutils.csym

@@ -5,7 +5,7 @@ import network.*, regex
 import codec.json
 
 constant server_name = "CovScript-NetUtils"
-constant server_version = "1.6"
+constant server_version = "1.7"
 
 # ============================================================================
 # Configuration constants — override before use to adjust behavior
@@ -24,6 +24,10 @@ constant framing_hex_size = 16                   # length of fixed-hex size head
 constant default_http_port = 80
 constant default_https_port = 443
 
+# Server defaults — tuning knobs exposed for documentation and test assertions
+constant default_http_thread_count = 4               # Asio I/O threads
+constant default_http_worker_count = 64              # per-process HTTP handler fibers
+
 # Internal Functions
 
 var request_line_reg = regex.build_optimize("^([A-Z]+) ([^ ?]+)(?:\\?([^ ]*))? HTTP/([0-9.]+)$")
@@ -1236,7 +1240,12 @@ class http_client
                 return false
             end
             if target["scheme"] == "https"
-                sock.connect_ssl(host, tls_options)
+                var tls_state = async.connect_ssl(sock, host, tls_options)
+                if !_await(tls_state)
+                    log("TLS handshake failed: " + tls_state.get_error())
+                    sock.safe_shutdown()
+                    return false
+                end
             end
             sock.set_opt_no_delay(true)
             return true
@@ -1716,9 +1725,9 @@ class http_server
     var wwwroot_path = null
     var url_map = new hash_map
     var thread_pool = null
-    var thread_count = 4
+    var thread_count = default_http_thread_count
     var worker_list = null
-    var worker_count = 4
+    var worker_count = default_http_worker_count
     var max_keep_alive = 100
     var keep_alive_timeout = 5000
     var mtime_map = new hash_map

netutils.ecs

@@ -1246,13 +1246,32 @@ bool network_cs_ext::tcp::socket::safe_shutdown(socket_t &sock)
 	if (!sock->get_raw().is_open())
 		return true;
 	// Block new I/O atomically, then wait for existing jobs to drain.
-	// No timeout — safe_shutdown blocks until all pending I/O completes
-	// or the peer closes the connection.
+	// Uses NETWORK_SAFE_SHUTDOWN_TIMEOUT_MS as a deadline for both
+	// the exclusive-lock retry path (TLS handshake collision) and the
+	// drain-queued-I/O path.
 	try {
 		sock->begin_draining_exclusive();
 	}
 	catch (const std::exception &) {
-		return false;
+		// Another exclusive operation (e.g. TLS handshake) is in flight.
+		// Cancel the raw socket to force its completion handler to fire,
+		// then retry the lock.
+		asio::error_code ignored;
+		sock->get_raw().cancel(ignored);
+		network_cs_ext::async::restart();
+		auto deadline = std::chrono::steady_clock::now() + std::chrono::milliseconds(NETWORK_SAFE_SHUTDOWN_TIMEOUT_MS);
+		while (sock->async_jobs.load(std::memory_order_acquire) > 0) {
+			if (std::chrono::steady_clock::now() >= deadline)
+				break;
+			network_cs_ext::async::get_global_settings().poll();
+			cs_runtime_yield();
+		}
+		try {
+			sock->begin_draining_exclusive();
+		}
+		catch (const std::exception &) {
+			return false;
+		}
 	}
 	// RAII: release exclusive reservation on any exit path.
 	struct exclusive_guard {
@@ -1263,18 +1282,25 @@ bool network_cs_ext::tcp::socket::safe_shutdown(socket_t &sock)
 			s->end_draining_exclusive();
 		}
 	} guard(sock);
+	bool success = true;
 	network_cs_ext::async::restart();
 	// Cancel pending operations so timed-out reads/writes
 	// do not keep async_jobs > 0 permanently.
 	{
 		asio::error_code ignored;
 		sock->get_raw().cancel(ignored);
 	}
+	auto drain_dl = std::chrono::steady_clock::now() + std::chrono::milliseconds(NETWORK_SAFE_SHUTDOWN_TIMEOUT_MS);
 	while (sock->async_jobs.load(std::memory_order_acquire) > 0) {
+		if (std::chrono::steady_clock::now() >= drain_dl) {
+			success = false;
+			break;
+		}
 		network_cs_ext::async::get_global_settings().poll();
 		cs_runtime_yield();
 	}
-	bool success = true;
+	if (!success)
+		return false;
 	// TLS: async_shutdown avoids blocking the OS thread.
 	// A strand-bound timer closes the raw socket on timeout so the
 	// shutdown operation completes before TLS state is destroyed.

network.cpp

@@ -51,9 +51,13 @@ function skip(label, reason)
     system.out.println("[SKIP] " + _section + " | " + label + " -- " + reason)
 end
 
+var _httpclient_port = 15300
+
 function find_free_port()
-    var port = 15000
-    while port < 15100
+    var port = _httpclient_port
+    _httpclient_port += 1
+    var max_port = port + 100
+    while port < max_port
         try
             var acpt = tcp.acceptor(tcp.endpoint_v4(port))
             acpt = null
@@ -370,6 +374,121 @@ client14.close()
 srv_sock8.close()
 acpt8 = null
 
+# ============================================================
+# C09 -- TLS handshake failure against plain TCP server
+# ============================================================
+section("C09: TLS handshake failure")
+
+var port9 = find_free_port()
+if port9 == 0
+    skip("C09-all", "no free port")
+else
+    var acpt9 = tcp.acceptor(tcp.endpoint_v4(port9))
+    var srv9 = new tcp.socket
+    var ast9 = async.accept(srv9, acpt9)
+
+    var client15 = new netutils.http_client
+    client15.set_timeout_ms(2000)
+    var target9 = client15.parse_url("https://127.0.0.1:" + to_string(port9) + "/")
+    check_not_null("C09-01: https target parsed", target9)
+
+    # TLS handshake against a plain TCP server must fail
+    var result9 = client15.connect_target(target9)
+    check_false("C09-02: TLS to plain TCP returns false", result9)
+
+    if ast9.wait_for(1000)
+        srv9.close()
+    end
+    acpt9 = null
+end
+
+# ============================================================
+# C10 -- TLS handshake timeout (server accepts but never responds)
+# ============================================================
+section("C10: TLS handshake timeout")
+
+var port10 = find_free_port()
+if port10 == 0
+    skip("C10-all", "no free port")
+else
+    var acpt10 = tcp.acceptor(tcp.endpoint_v4(port10))
+    var srv10 = new tcp.socket
+    var ast10 = async.accept(srv10, acpt10)
+
+    var client16 = new netutils.http_client
+    client16.set_timeout_ms(500)
+    var target10 = client16.parse_url("https://127.0.0.1:" + to_string(port10) + "/")
+    check_not_null("C10-01: https target parsed", target10)
+
+    var start10 = runtime.time()
+    var result10 = client16.connect_target(target10)
+    var elapsed10 = runtime.time() - start10
+    check_false("C10-02: TLS timeout returns false", result10)
+    check("C10-03: timeout respected (elapsed < 3000ms)", elapsed10 < 3000)
+
+    if ast10.wait_for(1000)
+        srv10.close()
+    end
+    acpt10 = null
+end
+
+# ============================================================
+# C11 -- TLS handshake: other fiber runs while this fiber waits
+# ============================================================
+section("C11: other fiber runs during TLS wait")
+
+var c11_port = find_free_port()
+if c11_port == 0
+    skip("C11-all", "no free port")
+else
+    var c11_tls_done = false
+    var c11_tls_error = false
+
+    function c11_tls_fiber_func(sock)
+        var state = async.connect_ssl(sock, "127.0.0.1", null)
+        state.wait_for(2000)
+        c11_tls_error = !state.has_done() || state.get_error() != null
+        c11_tls_done = true
+    end
+
+    var c11_acpt = tcp.acceptor(tcp.endpoint_v4(c11_port))
+    var c11_srv = new tcp.socket
+    var c11_ast = async.accept(c11_srv, c11_acpt)
+
+    # Pre-establish TCP connection outside the fiber
+    var c11_sock = new tcp.socket
+    c11_sock.connect(tcp.endpoint("127.0.0.1", c11_port))
+
+    # Fiber only does TLS handshake (not TCP connect)
+    var c11_fiber = fiber.create(c11_tls_fiber_func, c11_sock)
+
+    # Resume once — TLS handshake should yield
+    c11_fiber.resume()
+    check("C11-01: TLS not complete after first resume", !c11_tls_done)
+
+    # Drive TLS fiber to completion
+    var c11_start = runtime.time()
+    loop
+        c11_fiber.resume()
+        async.poll_once()
+        runtime.delay(5)
+        if runtime.time() - c11_start >= 4000
+            break
+        end
+    until c11_tls_done
+
+    check("C11-02: TLS fiber completed", c11_tls_done)
+    check("C11-03: TLS reported error (plain TCP server)", c11_tls_error)
+
+    # Cancel pending handshake cleanly — safe_shutdown, not close()
+    c11_sock.safe_shutdown()
+
+    if c11_ast.has_done()
+        c11_srv.close()
+    end
+    c11_acpt = null
+end
+
 # ============================================================
 # Cleanup and results
 # ============================================================