FIX Protocol

A FIX message is a sequence of tag=value fields, each terminated by SOH (byte 0x01), shown below as |:

8=FIX.4.4|9=127|35=D|49=CLIENT|56=EXCH|34=3|52=20261004-13:30:00.001|
11=ORD-1|55=ACME|54=1|60=20261004-13:30:00.001|38=100|40=2|44=101.25|59=0|10=212|

• Standard header. The first three fields are fixed: 8 BeginString (protocol version), 9 BodyLength, 35 MsgType (D = NewOrderSingle). Then come 49 SenderCompID, 56 TargetCompID, 34 MsgSeqNum and 52 SendingTime (UTC), in any order.
• Body. 11 ClOrdID (the client's id for this order), 55 Symbol, 54 Side (1 buy, 2 sell), 60 TransactTime, 38 OrderQty, 40 OrdType (1 market, 2 limit), 44 Price, 59 TimeInForce (0 day, 1 GTC, 3 IOC, 4 FOK).
• Trailer. 10 CheckSum is always the last field: exactly three digits.

From FIX 5.0 on, the session layer was split into its own spec, FIXT.1.1. Those messages carry 8=FIXT.1.1 and declare the application version separately. FIX 4.4 has both layers in one document, and it's still very widely deployed, which is why the capstone targets it.

The two framing fields have exact definitions, and off-by-one bugs here are the classic first FIX bug:

• BodyLength (9) counts bytes starting after the SOH that ends the 9= field, up to and including the SOH just before 10=. In the message above that's from 35=D| through 59=0|: 127 bytes.
• CheckSum (10) is the sum of every byte before 10= (header and body, including all their SOH bytes) modulo 256, written as exactly three digits with leading zeros (10=015, never 10=15).

Validation order matters for error messages. Check the header shape first, then the trailer shape, then BodyLength, then CheckSum. Building a message has a chicken-and-egg problem: the length goes before the body. Build the body first, then prepend the header (Day 6 shows how to do that without copying).

pub const SOH: u8 = 0x01;

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum FixError {
    /// Does not start with "8=<non-empty><SOH>9=<1+ digits><SOH>".
    BadHeader,
    /// Does not end with "<SOH>10=" + exactly 3 digits (000..=255) + SOH.
    BadTrailer,
    BadBodyLength { declared: usize, actual: usize },
    BadChecksum { declared: u8, actual: u8 },
}

/// Sum of all bytes, modulo 256.
pub fn checksum(bytes: &[u8]) -> u8 {
    todo!()
}

/// Validate one complete message. Check, in this order:
/// header shape, trailer shape, BodyLength, CheckSum.
pub fn validate(msg: &[u8]) -> Result<(), FixError> {
    todo!()
}

/// Build "8=<begin><SOH>9=<len><SOH>" + body + "10=<ccc><SOH>".
/// `body` starts with "35=" and ends with SOH.
pub fn frame(begin_string: &str, body: &[u8]) -> Vec<u8> {
    todo!()
}

The slow way to parse FIX is to split on SOH into a Vec<String>, split each field on =, and insert into a HashMap<u32, String>. That's dozens of allocations and a hash per field, and it's also wrong (see the check below). The fast way is the week 11 approach adapted to delimiters:

• Iterate fields as (u32, &[u8]): parse the tag digits into an integer while scanning to =, then find the next SOH. Values stay borrowed from the receive buffer. Finding delimiters is the main cost. The memchr crate's SIMD search, or the auto-vectorized loop you get from position, scans many bytes per instruction.
• Dispatch on the tag with match. Store the slices you need in locals and ignore the rest. The compiler turns a dense match into a jump table or a short series of compares.
• Check required fields after the loop, with Options or a bitmask of seen tags.
• Convert prices to fixed-point integers, never f64. "101.25" becomes 1_012_500 at 4 implied decimals. Reject values that would lose precision, and use checked arithmetic, because a 25-digit price is an attack, not an order.

pub const SOH: u8 = 0x01;

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum ParseError {
    /// Tag empty, non-digit, no '=', or > u32::MAX. `at` = offset of the field start.
    BadTag { at: usize },
    EmptyValue { tag: u32 },
    /// Value runs to the end of input with no SOH.
    Unterminated { tag: u32 },
    MissingField { tag: u32 },
    BadValue { tag: u32 },
}

pub struct Fields<'a> {
    buf: &'a [u8],
    pos: usize,
    done: bool,
}

pub fn fields(buf: &[u8]) -> Fields<'_> {
    Fields { buf, pos: 0, done: false }
}

impl<'a> Iterator for Fields<'a> {
    type Item = Result<(u32, &'a [u8]), ParseError>;
    /// One "tag=value<SOH>" per call. After an error: that error once, then None.
    fn next(&mut self) -> Option<Self::Item> {
        todo!()
    }
}

/// Fixed point, 4 implied decimals: b"101.25" -> 1_012_500.
/// Grammar: optional '-', 1+ digits, optionally '.' and 1+ digits. Digits past
/// the 4th decimal are allowed only if they are all '0'. None on anything
/// else, including overflow.
pub fn parse_price(v: &[u8]) -> Option<i64> {
    todo!()
}

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum Side {
    Buy,
    Sell,
}

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub struct NewOrder<'a> {
    pub cl_ord_id: &'a [u8], // 11
    pub symbol: &'a [u8],    // 55
    pub side: Side,          // 54: '1' Buy, '2' Sell
    pub qty: u64,            // 38: positive integer
    pub price: Option<i64>,  // 44: required when 40=2 (limit); None when 40=1 (market)
}

/// Parse a whole NewOrderSingle (header and trailer included; framing was
/// validated already, so ignore 8/9/10 and any tag you don't need).
/// Iterator errors first; then 35 (must be "D"), 11, 55, 54, 38, 40, and
/// 44 for limits: MissingField if absent, BadValue if invalid. Must not allocate.
pub fn parse_new_order(msg: &[u8]) -> Result<NewOrder<'_>, ParseError> {
    todo!()
}

The session-level message types (MsgType in brackets):

• Logon (A) starts the session: 98 EncryptMethod (0 = none), 108 HeartBtInt in seconds, optionally 141 ResetSeqNumFlag. The acceptor replies with its own Logon.
• Heartbeat (0) is sent when nothing else has been sent for HeartBtInt seconds. TestRequest (1) with a 112 TestReqID is sent when nothing has been received for HeartBtInt plus a grace period, and the peer must answer with a Heartbeat echoing that id. No answer means the connection is dead.
• ResendRequest (2) asks for a range: 7 BeginSeqNo and 16 EndSeqNo (0 means "everything after BeginSeqNo").
• SequenceReset (4) with 123 GapFillFlag=Y and 36 NewSeqNo says "skip ahead to NewSeqNo". It's used during resends in place of administrative messages that shouldn't be replayed.
• Reject (3) is a session-level rejection of a malformed message. Business-level problems use BusinessMessageReject (j) or application rejects.
• Logout (5) ends the session gracefully. Both sides send it.

Sequence numbers (34 MsgSeqNum) are per direction, start at 1, and persist across reconnects within a session's lifetime (typically a trading day). Each side stores its next expected inbound number and its next outbound number. Every outbound message is stored so it can be resent. When a message arrives:

• Equal to expected: process it, then increment.
• Higher than expected: messages were lost. Send a ResendRequest for the gap and queue or process according to your engine's policy.
• Lower than expected without 43 PossDupFlag=Y: a serious error. The spec says to log out and disconnect.
• Lower than expected with PossDupFlag=Y: a retransmission of something already processed, so ignore it. Retransmissions carry 122 OrigSendingTime.

FIX orders carry the client's identifiers, and your engine has its own:

• 11 ClOrdID is chosen by the client and must be unique per session for the life of the order. A cancel or replace gets a new ClOrdID and points at the order through 41 OrigClOrdID, so one order accumulates a chain of ClOrdIDs over its life.
• 37 OrderID is assigned by the exchange and never changes. The gateway owns the mapping from (session, ClOrdID) to OrderID and must reject a duplicate ClOrdID.

Every state change goes back as an ExecutionReport (8) with two status fields that are easy to confuse:

• 150 ExecType says what just happened: 0 New, F Trade (FIX 4.4 replaced the older partial-fill and fill values with F), 4 Canceled, 5 Replaced, 8 Rejected.
• 39 OrdStatus says the order's state now: 0 New, 1 Partially filled, 2 Filled, 4 Canceled, 8 Rejected.

Fills also carry 32 LastQty and 31 LastPx (this fill), 14 CumQty and 151 LeavesQty (running totals, where CumQty + LeavesQty = OrderQty while the order is open), and 6 AvgPx. A rejected cancel is an OrderCancelReject (9), not an ExecutionReport.

The outbound path matters as much as parsing: every fill produces an ExecutionReport for at least one session. Techniques that keep it allocation-free:

• Body first, header back-filled. Reserve 32 bytes at the front of a reusable buffer. Write the body after it, then write 8=FIX.4.4|9=<len>| backwards so it ends exactly where the body starts, and send from the header's first byte. No copy, no second pass.
• Per-session constant prefix. 35=8|49=EXCH|56=CLIENT| never changes for a session. Precompute it once at logon and copy_from_slice it.
• Integers without formatting machinery. Write digits into a small stack buffer from the end (or use the itoa crate). format! allocates and goes through the formatting traits.
• Cached timestamps. SendingTime only changes in its last digits within a millisecond. Cache the formatted prefix (YYYYMMDD-HH:MM:SS.) and rewrite it only when the second changes.
• Running checksum. Sum bytes as you write them, or sum the finished buffer once. A byte sum over 200 bytes vectorizes to a handful of instructions.