dalli-elasticache 2.0.2 → 2.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c0afff12dcbecd681d00446e7a792cb82f356f28e02bfaac78a1962180e7973e
-  data.tar.gz: 2918dfeefec59bf0c663c15ecc2d981a1b16a51d8b653d2df710290f379945f8
+  metadata.gz: ef06b82cfedd6c5a6faad37af6dff3bc6a5dba7205f9b074ab15dd5f53c89582
+  data.tar.gz: f0fd06b34b0c051658f34f6ad2c5d9ec7e377981493779be98cc17c3eca8a244
 SHA512:
-  metadata.gz: 0acf68cd09b9bf0bda5e1e77a4c8aff7925edf1e1a51e26adf8773e7a86df0e69fdf9d285d6ee965b24648d0feeb6406cb9bfca6a1187f7ffb652ab117b275fc
-  data.tar.gz: 05702c86d429beea0759bde3682068986b7b0da1f54c55155e3b9ce2f228e95d9b979c8c8ffdf8a35e1a2b752a3e3523624aa8940454f073fd2c6cb79311f1b5
+  metadata.gz: 7c0fcc7900d628300a7fc406d3a586559d68fc29780e04bea3f9b69437d8e51682a08f181d5e7a102a7fb636b3a6359c5577c125d275be6383fa274e16027dce
+  data.tar.gz: 1a9244ff561d6e85479c61a4c17422c4d0a82df8e651f866a38f6c17ba6c20e21c33d1d520eb95055c36805ebb2f99352cf9c02dd5b83e219f180c9ae7cdd69c

data/CHANGELOG.md

@@ -0,0 +1,138 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [2.1.0]
+
+### Changed
+
+- `Endpoint` and the command classes now default to a 5 second timeout, matching `Dalli::ElastiCache`. Previously they had no timeout unless one was passed. Pass `timeout: nil` to disable it. [@petergoldstein](https://github.com/petergoldstein)
+
+### Fixed
+
+- Bracketed IPv6 configuration endpoints (e.g. `[::1]:11211`) were parsed but could never connect, because the brackets were passed through to address resolution. The brackets are now stripped before connecting, and SNI is no longer set when the host is an IP literal. [@petergoldstein](https://github.com/petergoldstein)
+- An `ERROR`, `CLIENT_ERROR`, or `SERVER_ERROR` reply from the endpoint was not recognized, so discovery blocked until the read timeout (or indefinitely with `timeout: nil`). These replies now raise `Dalli::Elasticache::AutoDiscovery::ResponseError` immediately. The response terminator is now matched exactly instead of any line containing `END`. [@petergoldstein](https://github.com/petergoldstein)
+- The TLS handshake with the configuration endpoint had no timeout, so an endpoint that accepted the TCP connection but never completed the handshake blocked discovery indefinitely, regardless of `timeout:`. The handshake is now bounded by `timeout:` and raises `Timeout::Error`. [@petergoldstein](https://github.com/petergoldstein)
+- Node lists from IPv6 clusters, nodes reported without an IP address, and hostnames containing underscores were silently parsed as an empty list, producing a Dalli client with no servers that only failed on first use with `Dalli::RingError`. These nodes now parse correctly, and `#servers` (and therefore `#client`) raises `Dalli::Elasticache::AutoDiscovery::ResponseError` if a response contains no nodes. [@petergoldstein](https://github.com/petergoldstein)
+- The configuration endpoint address was validated with line anchors, so a string containing a newline (e.g. `"junk\nhost:11211"`) parsed using one of its lines. Ports outside 1–65535 were also accepted. Both now raise `ArgumentError`. [@petergoldstein](https://github.com/petergoldstein)
+- `Node#==` raised `NoMethodError` when compared with an object that is not a `Node`. It now returns `false`. [@petergoldstein](https://github.com/petergoldstein)
+- Concurrent first calls to `Endpoint#config` or `Endpoint#stats` each ran their own network call. They now share one. [@petergoldstein](https://github.com/petergoldstein)
+- `timeout:` now also bounds DNS resolution of the configuration endpoint (`resolv_timeout:`), not just the TCP connect. [@petergoldstein](https://github.com/petergoldstein)
+- The README's "Refreshing the Node List" examples didn't work. `#refresh` doesn't update a `Dalli::Client` you already have, so the "on failure" example retried the same stale client indefinitely and the "on a schedule" example had no effect. The examples now build and switch to a new client, and the retry is limited. [@petergoldstein](https://github.com/petergoldstein)
+- The published gem didn't include the `LICENSE` file (or `CHANGELOG.md`). Both are now packaged, and the gem metadata links to the source and changelog over https. [@petergoldstein](https://github.com/petergoldstein)
+- `ResponseError` messages quoted the server's error line in full. Quoted text is now truncated to 200 characters. [@petergoldstein](https://github.com/petergoldstein)
+
+### Security
+
+- With `ssl_context:` set to `VERIFY_PEER`, the endpoint certificate was checked against the trusted CAs but not against the endpoint hostname, because `SSLContext.new` leaves `verify_hostname` false. Any certificate from a trusted CA was accepted for any host. The hostname (or IP address) is now verified whenever `verify_mode` includes `VERIFY_PEER`, even if `verify_hostname` is false, since an explicit `false` can't be distinguished from the default. Connections that relied on a certificate not matching the endpoint host will now fail. [@petergoldstein](https://github.com/petergoldstein)
+- Discovery responses are now limited to 1 MB. Previously a misbehaving endpoint could send an unbounded response (or a single line with no terminator) and the client buffered all of it until the read timeout, or indefinitely with `timeout: nil`. Larger responses raise `Dalli::Elasticache::AutoDiscovery::ResponseError`. [@petergoldstein](https://github.com/petergoldstein)
+
+## [2.0.2]
+
+### Fixed
+
+- Read timeout over TLS (`ssl_context:`) could block for the full timeout on every line after the first. `wait_readable` polled the raw TCP fd for readiness, which can't see data already buffered above it by OpenSSL, so it waited out the full timeout instead of returning immediately. Read timeouts are now enforced as a single deadline around the whole response rather than gating each line's readiness. [@petergoldstein](https://github.com/petergoldstein)
+
+## [2.0.1]
+
+### Fixed
+
+- TLS support via `ssl_context:` keyword argument was advertised in v2.0.0 but was not included in the published gem due to a tagging error. [@petergoldstein](https://github.com/petergoldstein)
+
+## [2.0.0]
+
+### Added
+
+- TCP connect and read timeout (default 5s) for auto-discovery calls. [@petergoldstein](https://github.com/petergoldstein)
+- IPv6 endpoint support (bracketed addresses like `[::1]:11211`). [@petergoldstein](https://github.com/petergoldstein)
+- TLS support for auto-discovery endpoint via `ssl_context:` keyword argument. [@petergoldstein](https://github.com/petergoldstein)
+
+### Removed
+
+- Legacy config command path for engines < 1.4.14. [@petergoldstein](https://github.com/petergoldstein)
+- Support for Ruby < 3.3. [@petergoldstein](https://github.com/petergoldstein)
+
+### Changed
+
+- Fix `Dalli::Socket` shadowing `::Socket` in `BaseCommand`. [@petergoldstein](https://github.com/petergoldstein)
+- Version requirements: Ruby v3.3+, and Dalli v5.0+. [@petergoldstein](https://github.com/petergoldstein)
+
+## [1.0.1]
+
+### Fixed
+
+- Loading error because of incorrect path in a require_relative.  [@petervandoros](https://github.com/petervandoros)
+
+## [1.0.0]
+
+### Added
+
+- Rubocop linting. [@petergoldstein](https://github.com/petergoldstein)
+- Specs for reading data off the socket, to ensure that code functions as expected. [@petergoldstein](https://github.com/petergoldstein)
+- This CHANGELOG.md. [@petergoldstein](https://github.com/petergoldstein)
+- Support for Google Cloud MemoryStore. [@petergoldstein](https://github.com/petergoldstein)
+
+### Fixed
+
+- Parsing error when retrieving the version.  Version string is now parsed correctly. [@petergoldstein](https://github.com/petergoldstein)
+- Library would error when the engine version was non-numeric or included additional data.  Now treats such situations as a "modern" engine version. [@petergoldstein](https://github.com/petergoldstein)
+
+### Changed
+
+- BREAKING: engine_version is now returned as a string rather than a Gem::Version to support potentially non-numeric versions. [@petergoldstein](https://github.com/petergoldstein)
+- Updated README to reflect deprecation of DalliStore and preferred use of MemCacheStore. [@xiaoronglv](https://github.com/xiaoronglv)
+- Switched to GitHub Actions from Travis for CI. Added Ruby 2.6, 2.7, 3.0, 3.1, ruby-head, jruby-9.3, jruby-head. [@petergoldstein](https://github.com/petergoldstein)
+- Dalli::Elasticache now raises an ArgumentError if it cannot parse the config endpoint argument. [@petergoldstein](https://github.com/petergoldstein)
+- Now use default port of 11211 for configuration endpoint when not explicitly specified. [@petergoldstein](https://github.com/petergoldstein)
+- Refactored internal classes to better enable testing, shrink individual class responsibilities. [@petergoldstein](https://github.com/petergoldstein)
+- Allow underscores in hostnames.
+
+### Removed
+
+- Support for all Rubies before 2.6 was dropped. [@petergoldstein](https://github.com/petergoldstein)
+
+
+## [0.2.0] - 2016-02-24
+
+### Changed
+
+- Node connections now use hostnames as opposed to IPs (which may change over time). [@BanjoInc](https://github.com/BanjoInc)
+- Ruby 2.2 and 2.3 was added to CI. [@ktheory](https://github.com/ktheory)
+
+### Removed
+
+- Support for Ruby 1.9.2 and 1.9.3 was dropped. [@ktheory](https://github.com/ktheory)
+
+## [0.1.2] - 2014-07-08
+
+### Changed
+
+- Added Ruby 2.0 and 2.1 to CI. [@petergoldstein](https://github.com/petergoldstein)
+
+### Fixed
+
+- Addressed NameError on refresh. [@ryo0301](https://github.com/ryo0301)
+
+## [0.1.1] - 2014-05-03
+
+### Added
+
+- Ability to retrieve configuration version (indication of how many times the node set has changed) from endpoint. [@zmillman](https://github.com/zmillman)
+- Specs for existing functionality. [@zmillman](https://github.com/zmillman)
+- Continuous Integration using Travis CI. [@zmillman](https://github.com/zmillman)
+- Refresh capability for the node set. [@zmillman](https://github.com/zmillman)
+
+### Changed
+
+- Refactoring and repackaging of the endpoint classes. [@zmillman](https://github.com/zmillman)
+
+
+## [0.1.0] - 2013-01-27
+
+### Added
+
+- Initial implementation for fetching node addresses from an Amazon ElastiCache endpoint. [@ktheory](https://github.com/ktheory)
+

data/LICENSE

@@ -0,0 +1,20 @@
+Copyright (2017-2022) Aaron Suggs, Peter M. Goldstein
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.md

@@ -16,7 +16,7 @@ gem 'dalli-elasticache'
 Using Dalli Elasticache in Rails
 ---------------------------------
 
-Note that the list of memcached servers used by Rails will be refreshed each time an app server process starts.  If the list of nodes in your cluster changes, this configuration will not be reflected in the Rails configuraiton without such a server process restart.
+Note that the list of memcached servers used by Rails will be refreshed each time an app server process starts.  If the list of nodes in your cluster changes, this configuration will not be reflected in the Rails configuration without such a server process restart.
 
 ### Configuring a Cache Store
 
@@ -95,7 +95,7 @@ Pass an `OpenSSL::SSL::SSLContext` via `ssl_context:` to enable TLS for the auto
 
 ```ruby
 ssl_context = OpenSSL::SSL::SSLContext.new
-ssl_context.verify_mode = OpenSSL::SSL::VERIFY_PEER
+ssl_context.set_params(verify_mode: OpenSSL::SSL::VERIFY_PEER)
 
 elasticache = Dalli::ElastiCache.new(
   "my-cluster.abc123.cfg.use1.cache.amazonaws.com:11211",
@@ -104,6 +104,8 @@ elasticache = Dalli::ElastiCache.new(
 )
 ```
 
+When the context's `verify_mode` includes `VERIFY_PEER`, the endpoint's certificate is also checked against the endpoint hostname (or IP address), even if `verify_hostname` was left at its `SSLContext.new` default of `false`. `set_params` additionally loads the system CA store.
+
 Note that `ssl_context:` controls TLS for the auto-discovery endpoint only. To also encrypt traffic to the cache nodes themselves, pass `ssl_context:` in the Dalli options as well:
 
 ```ruby
@@ -112,32 +114,47 @@ elasticache = Dalli::ElastiCache.new(endpoint, { ssl_context: ssl_context }, ssl
 
 ### Refreshing the Node List
 
-The node list is fetched once and cached. Call `#refresh` to re-query the endpoint, which creates a new `Dalli::Client` with the current node list.
+The node list is fetched once and cached. `#refresh` discards the cached list so the next call re-queries the endpoint. It does **not** update a `Dalli::Client` you already have: each call to `#client` builds a new client from the node list at that moment. After refreshing, call `#client` again and switch to the new client. You can then `close` the old one; Dalli reconnects a closed client automatically if anything still uses it.
 
 Two common patterns for keeping the node list up to date:
 
-**On failure** — rescue `Dalli::RingError` (raised when no nodes are reachable) and refresh before retrying:
+**On failure:** rescue `Dalli::RingError` (raised when no nodes are reachable), build a new client from a refreshed node list, and retry once:
 
 ```ruby
+retried = false
 begin
   cache.get("key")
 rescue Dalli::RingError
-  elasticache.refresh
+  raise if retried
+
+  retried = true
+  old_cache = cache
+  cache = elasticache.refresh.client
+  old_cache.close
   retry
 end
 ```
 
-**On a schedule** — refresh periodically in a background thread or job. AWS does not publish exact timing for node replacement, but the process typically takes a few minutes, so refreshing every 60 seconds is a reasonable default:
+Limit the retries. If the cluster is still unreachable after a refresh, retrying without a limit loops forever.
+
+**On a schedule:** refresh periodically in a background thread or job and swap in the new client. AWS does not publish exact timing for node replacement, but the process typically takes a few minutes, so refreshing every 60 seconds is a reasonable default:
 
 ```ruby
 Thread.new do
   loop do
     sleep 60
-    elasticache.refresh
+    new_cache = elasticache.refresh.client
+    old_cache = cache
+    cache = new_cache
+    old_cache.close
+  rescue StandardError => e
+    warn "ElastiCache refresh failed, keeping the current client: #{e.message}"
   end
 end
 ```
 
+If discovery fails, for example because the endpoint times out or lists no nodes, `#client` raises and the existing client stays in use.
+
 A combination of both approaches is reasonable for production use.
 
 License

data/lib/dalli/elasticache/auto_discovery/base_command.rb

@@ -1,11 +1,19 @@
 # frozen_string_literal: true
 
+require 'ipaddr'
 require 'openssl'
 require 'timeout'
 
 module Dalli
   module Elasticache
     module AutoDiscovery
+      ##
+      # Raised when the configuration endpoint's response can't be used: it replied
+      # with ERROR, CLIENT_ERROR, or SERVER_ERROR, the response exceeded
+      # MAX_RESPONSE_BYTES, or (from Dalli::ElastiCache#servers) it listed no nodes.
+      ##
+      class ResponseError < StandardError; end
+
       ##
       # Base command class for configuration endpoint
       # command.  Contains the network logic.
@@ -13,7 +21,18 @@ module Dalli
       class BaseCommand
         attr_reader :host, :port, :timeout, :ssl_context
 
-        def initialize(host, port, timeout = nil, ssl_context: nil)
+        DEFAULT_TIMEOUT = 5
+
+        # Upper bound on a response. Even a large cluster's node list is a few tens of KB.
+        MAX_RESPONSE_BYTES = 1024 * 1024
+
+        # Server-supplied text quoted in an exception message is cut to this length
+        MAX_ERROR_TEXT_LENGTH = 200
+
+        END_LINE = "END\r\n"
+        ERROR_LINE_REGEX = /\A(?:ERROR|CLIENT_ERROR|SERVER_ERROR)\b/
+
+        def initialize(host, port, timeout = DEFAULT_TIMEOUT, ssl_context: nil)
           @host = host
           @port = port
           @timeout = timeout
@@ -24,7 +43,7 @@ module Dalli
         #
         # Returns the raw response as a String
         def send_command
-          tcp_socket = ::Socket.tcp(@host, @port, connect_timeout: timeout)
+          tcp_socket = ::Socket.tcp(socket_host, @port, connect_timeout: timeout, resolv_timeout: timeout)
           begin
             socket = ssl_context ? wrap_with_ssl(tcp_socket) : tcp_socket
             socket.puts command
@@ -35,38 +54,83 @@ module Dalli
         end
 
         # `timeout` bounds the entire multi-line read as a single wall-clock deadline,
-        # not each individual `readline`. A per-line readiness check (e.g. `wait_readable`)
+        # not each individual line read. A per-line readiness check (e.g. `wait_readable`)
         # can't tell buffered-but-unread bytes apart from an empty socket once a buffering
         # layer (Ruby's IO buffer, or OpenSSL::Buffering for TLS) sits between the fd and
-        # `readline`, so it can't be used to gate individual lines reliably.
+        # the line read, so it can't be used to gate individual lines reliably.
         def response_from_socket(socket)
-          return read_lines(socket) unless timeout
-
-          Timeout.timeout(timeout, Timeout::Error, "Auto discovery read timed out after #{timeout}s") do
-            read_lines(socket)
-          end
+          with_timeout('read') { read_lines(socket) }
         end
 
         private
 
+        def with_timeout(phase, &)
+          return yield unless timeout
+
+          Timeout.timeout(timeout, Timeout::Error, "Auto discovery #{phase} timed out after #{timeout}s", &)
+        end
+
+        # The host without the brackets used to delimit an IPv6 address from its port
+        def socket_host
+          @host.delete_prefix('[').delete_suffix(']')
+        end
+
+        def ip_address?(host)
+          IPAddr.new(host)
+          true
+        rescue IPAddr::InvalidAddressError
+          false
+        end
+
         def read_lines(socket)
           data = +''
           loop do
-            line = socket.readline
-            break if line.include?('END')
+            line = next_line(socket, data.bytesize)
+            break if line == END_LINE
+            raise ResponseError, "Auto discovery command failed: #{error_text(line)}" if ERROR_LINE_REGEX.match?(line)
 
             data << line
           end
           data
         end
 
+        def error_text(line)
+          text = line.strip
+          text.length > MAX_ERROR_TEXT_LENGTH ? "#{text[0, MAX_ERROR_TEXT_LENGTH]}..." : text
+        end
+
+        # Reads one line, or as much of one as fits in the remaining response budget.
+        # The limit is one byte over the budget so an oversized response is detectable.
+        # `gets` is used because OpenSSL's `readline` doesn't accept a limit.
+        def next_line(socket, bytes_read)
+          line = socket.gets("\n", MAX_RESPONSE_BYTES - bytes_read + 1)
+          raise EOFError, 'Auto discovery connection closed before END' unless line
+          if bytes_read + line.bytesize > MAX_RESPONSE_BYTES
+            raise ResponseError, "Auto discovery response exceeded #{MAX_RESPONSE_BYTES} bytes"
+          end
+
+          line
+        end
+
         def wrap_with_ssl(tcp_socket)
           ssl_socket = OpenSSL::SSL::SSLSocket.new(tcp_socket, ssl_context)
-          ssl_socket.hostname = @host
+          # SNI must be a DNS name (RFC 6066), never an IP literal
+          ssl_socket.hostname = socket_host unless ip_address?(socket_host)
           ssl_socket.sync_close = true
-          ssl_socket.connect
+          # connect_timeout only covers the TCP connect, so bound the handshake separately
+          with_timeout('TLS handshake') { ssl_socket.connect }
+          verify_hostname(ssl_socket)
           ssl_socket
         end
+
+        # SSLContext.new leaves verify_hostname false, so VERIFY_PEER alone only checks
+        # that the certificate chains to a trusted CA, not that it was issued for this
+        # host. Check the hostname explicitly whenever the peer is being verified.
+        def verify_hostname(ssl_socket)
+          return if ssl_context.verify_mode.to_i.nobits?(OpenSSL::SSL::VERIFY_PEER)
+
+          ssl_socket.post_connection_check(socket_host)
+        end
       end
     end
   end

data/lib/dalli/elasticache/auto_discovery/config_response.rb

@@ -14,8 +14,9 @@ module Dalli
         # Matches the version line of the response
         VERSION_REGEX = /^(\d+)\r?\n/
 
-        # Matches strings like "my-cluster.001.cache.aws.com|10.154.182.29|11211"
-        NODE_REGEX = /(([-.a-zA-Z0-9]+)\|(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b)\|(\d+))/
+        # Matches strings like "my-cluster.001.cache.aws.com|10.154.182.29|11211".
+        # The IP may be IPv4, IPv6, or empty; only the host and port are used to connect.
+        NODE_REGEX = /(([-.\w]+)\|([^|\s]*)\|(\d+))/
         NODE_LIST_REGEX = /^(#{NODE_REGEX}\s*)+$/
 
         def initialize(response_text)
@@ -34,7 +35,7 @@ module Dalli
 
         # Node hosts, ip addresses, and ports
         #
-        # Returns an Array of Hashes with values for :host, :ip and :port
+        # Returns an Array of Node
         def nodes
           NODE_LIST_REGEX.match(@text).to_s.scan(NODE_REGEX).map do |match|
             Node.new(match[1], match[2], match[3].to_i)

data/lib/dalli/elasticache/auto_discovery/endpoint.rb

@@ -13,12 +13,13 @@ module Dalli
         attr_reader :host, :port
 
         # Matches DNS/IPv4 like "my-host.cache.aws.com:11211" or bracketed IPv6 like "[::1]:11211"
-        ENDPOINT_REGEX = /^([-_.a-zA-Z0-9]+|\[[a-fA-F0-9:]+\])(?::(\d+))?$/
+        ENDPOINT_REGEX = /\A([-_.a-zA-Z0-9]+|\[[a-fA-F0-9:]+\])(?::(\d+))?\z/
 
-        def initialize(addr, timeout: nil, ssl_context: nil)
+        def initialize(addr, timeout: BaseCommand::DEFAULT_TIMEOUT, ssl_context: nil)
           @host, @port = parse_endpoint_address(addr)
           @timeout = timeout
           @ssl_context = ssl_context
+          @mutex = Mutex.new
         end
 
         DEFAULT_PORT = 11_211
@@ -26,17 +27,27 @@ module Dalli
           m = ENDPOINT_REGEX.match(addr)
           raise ArgumentError, "Unable to parse configuration endpoint address - #{addr}" unless m
 
-          [m[1], (m[2] || DEFAULT_PORT).to_i]
+          port = (m[2] || DEFAULT_PORT).to_i
+          unless (1..65_535).cover?(port)
+            raise ArgumentError, "Invalid configuration endpoint address - #{addr}: port must be between 1 and 65535"
+          end
+
+          [m[1], port]
         end
 
-        # A cached ElastiCache::StatsResponse
+        # A cached ElastiCache::StatsResponse. The mutex ensures concurrent first
+        # callers share one network call instead of each running their own.
         def stats
-          @stats ||= StatsCommand.new(@host, @port, @timeout, ssl_context: @ssl_context).response
+          @stats || @mutex.synchronize do
+            @stats ||= StatsCommand.new(@host, @port, @timeout, ssl_context: @ssl_context).response
+          end
         end
 
         # A cached ElastiCache::ConfigResponse
         def config
-          @config ||= ConfigCommand.new(@host, @port, @timeout, ssl_context: @ssl_context).response
+          @config || @mutex.synchronize do
+            @config ||= ConfigCommand.new(@host, @port, @timeout, ssl_context: @ssl_context).response
+          end
         end
 
         # The memcached engine version

data/lib/dalli/elasticache/auto_discovery/node.rb

@@ -17,7 +17,8 @@ module Dalli
         end
 
         def ==(other)
-          host == other.host &&
+          other.is_a?(Node) &&
+            host == other.host &&
             ip == other.ip &&
             port == other.port
         end

data/lib/dalli/elasticache/version.rb

@@ -2,6 +2,6 @@
 
 module Dalli
   class ElastiCache
-    VERSION = '2.0.2'
+    VERSION = '2.1.0'
   end
 end

data/lib/dalli/elasticache.rb

@@ -22,7 +22,7 @@ module Dalli
   # distributes cached items consistently over the nodes.
   ##
   class ElastiCache
-    DEFAULT_TIMEOUT = 5
+    DEFAULT_TIMEOUT = Dalli::Elasticache::AutoDiscovery::BaseCommand::DEFAULT_TIMEOUT
 
     attr_reader :endpoint, :options
 
@@ -35,8 +35,10 @@ module Dalli
     # a bracketed IPv6 address.
     # dalli_options - a set of options passed to the Dalli::Client that is returned
     # by the client method.  Otherwise unused.
-    # timeout: - connect and read timeout in seconds for auto-discovery TCP calls.
-    # Defaults to 5 seconds.
+    # timeout: - timeout in seconds applied separately to each step of an auto-discovery
+    # call: DNS resolution, TCP connect, TLS handshake, and reading the response.
+    # Defaults to 5 seconds. Pass nil to disable.
+    # ssl_context: - an OpenSSL::SSL::SSLContext to use TLS for the auto-discovery calls.
     ##
     def initialize(config_endpoint, dalli_options = {}, timeout: DEFAULT_TIMEOUT, ssl_context: nil)
       @timeout = timeout
@@ -66,11 +68,24 @@ module Dalli
 
     # List of cluster server nodes with ip addresses and ports
     # Always use host name instead of private elasticache IPs as internal IPs can change after a node is rebooted
+    #
+    # Raises Dalli::Elasticache::AutoDiscovery::ResponseError if the response contains
+    # no nodes, rather than handing Dalli an empty server list that only fails on first use
     def servers
-      endpoint.config.nodes.map(&:to_s)
+      nodes = endpoint.config.nodes
+      if nodes.empty?
+        raise Dalli::Elasticache::AutoDiscovery::ResponseError,
+              "No cache nodes found in auto discovery response from #{endpoint.host}:#{endpoint.port}"
+      end
+
+      nodes.map(&:to_s)
     end
 
-    # Clear all cached data from the cluster endpoint
+    # Discards the cached discovery results so the next call re-queries the
+    # configuration endpoint. Returns self.
+    #
+    # This does not change Dalli::Client instances already returned by #client;
+    # call #client again to get one that uses the current node list.
     def refresh
       config_endpoint = "#{endpoint.host}:#{endpoint.port}"
       @endpoint = Dalli::Elasticache::AutoDiscovery::Endpoint.new(config_endpoint, timeout: @timeout,

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dalli-elasticache
 version: !ruby/object:Gem::Version
-  version: 2.0.2
+  version: 2.1.0
 platform: ruby
 authors:
 - Aaron Suggs
@@ -37,6 +37,8 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- CHANGELOG.md
+- LICENSE
 - README.md
 - Rakefile
 - lib/dalli-elasticache.rb
@@ -49,11 +51,13 @@ files:
 - lib/dalli/elasticache/auto_discovery/stats_command.rb
 - lib/dalli/elasticache/auto_discovery/stats_response.rb
 - lib/dalli/elasticache/version.rb
-homepage: http://github.com/ktheory/dalli-elasticache
+homepage: https://github.com/ktheory/dalli-elasticache
 licenses:
 - MIT
 metadata:
   rubygems_mfa_required: 'true'
+  source_code_uri: https://github.com/ktheory/dalli-elasticache
+  changelog_uri: https://github.com/ktheory/dalli-elasticache/blob/master/CHANGELOG.md
 rdoc_options:
 - "--charset=UTF-8"
 require_paths:
@@ -69,7 +73,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 1.3.5
 requirements: []
-rubygems_version: 4.0.18
+rubygems_version: 4.0.23
 specification_version: 4
 summary: Configure Dalli clients with ElastiCache's AutoDiscovery
 test_files: []