httpx 0.19.2 → 0.19.5

data/lib/httpx/io/tls/box.rb

@@ -1,365 +0,0 @@
-# frozen_string_literal: true
-
-# Copyright (c) 2004-2013 Cotag Media
-#
-# Permission is hereby granted, free of charge, to any person obtaining a copy
-# of this software and associated documentation files (the "Software"), to deal
-# in the Software without restriction, including without limitation the rights
-# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-# copies of the Software, and to permit persons to whom the Software is furnished
-# to do so, subject to the following conditions:
-#
-# The above copyright notice and this permission notice shall be included in all
-# copies or substantial portions of the Software.
-#
-# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-# THE SOFTWARE.
-#
-
-class HTTPX::TLS
-  class Box
-    InstanceLookup = ::Concurrent::Map.new
-
-    READ_BUFFER = 2048
-    SSL_VERIFY_PEER = 0x01
-    SSL_VERIFY_CLIENT_ONCE = 0x04
-
-    VerifyCB = FFI::Function.new(:int, %i[int pointer]) do |preverify_ok, x509_store|
-      x509 = SSL.X509_STORE_CTX_get_current_cert(x509_store)
-      ssl = SSL.X509_STORE_CTX_get_ex_data(x509_store, SSL.SSL_get_ex_data_X509_STORE_CTX_idx)
-
-      bio_out = SSL.BIO_new(SSL.BIO_s_mem)
-      ret = SSL.PEM_write_bio_X509(bio_out, x509)
-      if ret
-        len = SSL.BIO_pending(bio_out)
-        buffer = FFI::MemoryPointer.new(:char, len, false)
-        size = SSL.BIO_read(bio_out, buffer, len)
-
-        # THis is the callback into the ruby class
-        cert = buffer.read_string(size)
-        SSL.BIO_free(bio_out)
-        # InstanceLookup[ssl.address].verify(cert) || preverify_ok.zero? ? 1 : 0
-        depth = SSL.X509_STORE_CTX_get_error_depth(ssl)
-        box = InstanceLookup[ssl.address]
-        if preverify_ok == 1
-
-          hostname_verify = box.verify(cert)
-          if hostname_verify
-            1
-          else
-            # SSL.X509_STORE_CTX_set_error(x509_store, SSL::X509_V_ERR_HOSTNAME_MISMATCH)
-            0
-          end
-        else
-          1
-        end
-      else
-        SSL.BIO_free(bio_out)
-        SSL.X509_STORE_CTX_set_error(x509_store, SSL::X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT)
-        0
-      end
-    end
-
-    attr_reader :is_server, :context, :handshake_completed, :hosts, :ssl_version, :cipher, :verify_peer
-
-    def initialize(is_server, transport, options = {})
-      @ready = true
-
-      @handshake_completed = false
-      @handshake_signaled = false
-      @alpn_negotiated = false
-      @transport = transport
-
-      @read_buffer = FFI::MemoryPointer.new(:char, READ_BUFFER, false)
-
-      @is_server = is_server
-      @context = Context.new(is_server, options)
-
-      @bioRead = SSL.BIO_new(SSL.BIO_s_mem)
-      @bioWrite = SSL.BIO_new(SSL.BIO_s_mem)
-      @ssl = SSL.SSL_new(@context.ssl_ctx)
-      SSL.SSL_set_bio(@ssl, @bioRead, @bioWrite)
-
-      @write_queue = []
-
-      InstanceLookup[@ssl.address] = self
-
-      @verify_peer = options[:verify_peer]
-      
-      if @verify_peer
-        SSL.SSL_set_verify(@ssl, SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, VerifyCB)
-      end
-
-      # Add Server Name Indication (SNI) for client connections
-      if (hostname = options[:hostname])
-        if is_server
-          @hosts = ::Concurrent::Map.new
-          @hosts[hostname.to_s] = @context
-          @context.add_server_name_indication
-        else
-          SSL.SSL_set_tlsext_host_name(@ssl, hostname)
-        end
-      end
-
-      SSL.SSL_connect(@ssl) unless is_server
-    end
-
-    def add_host(hostname:, **options)
-      raise Error, "Server Name Indication (SNI) not configured for default host" unless @hosts
-      raise Error, "only valid for server mode context" unless @is_server
-
-      context = Context.new(true, options)
-      @hosts[hostname.to_s] = context
-      context.add_server_name_indication
-      nil
-    end
-
-    # Careful with this.
-    # If you remove all the hosts you'll end up with a segfault
-    def remove_host(hostname)
-      raise Error, "Server Name Indication (SNI) not configured for default host" unless @hosts
-      raise Error, "only valid for server mode context" unless @is_server
-
-      context = @hosts[hostname.to_s]
-      if context
-        @hosts.delete(hostname.to_s)
-        context.cleanup
-      end
-      nil
-    end
-
-    def get_peer_cert
-      return "" unless @ready
-
-      SSL.SSL_get_peer_certificate(@ssl)
-    end
-
-    def start
-      return unless @ready
-
-      dispatch_cipher_text
-    end
-
-    def encrypt(data)
-      return unless @ready
-
-      wrote = put_plain_text data
-      if wrote < 0
-        @transport.close_cb
-      else
-        dispatch_cipher_text
-      end
-    end
-
-    SSL_ERROR_WANT_READ = 2
-    SSL_ERROR_SSL = 1
-    def decrypt(data)
-      return unless @ready
-
-      put_cipher_text data
-
-      unless SSL.is_init_finished(@ssl)
-        resp = @is_server ? SSL.SSL_accept(@ssl) : SSL.SSL_connect(@ssl)
-
-        if resp < 0
-          err_code = SSL.SSL_get_error(@ssl, resp)
-          if err_code != SSL_ERROR_WANT_READ
-            if err_code == SSL_ERROR_SSL
-              verify_msg = SSL.X509_verify_cert_error_string(SSL.SSL_get_verify_result(@ssl))
-              @transport.close_cb(verify_msg)
-            end
-            return
-          end
-        end
-
-        @handshake_completed = true
-        @ssl_version = SSL.get_version(@ssl)
-        @cipher = SSL.get_current_cipher(@ssl)
-        signal_handshake unless @handshake_signaled
-      end
-
-      loop do
-        size = get_plain_text(@read_buffer, READ_BUFFER)
-        if size > 0
-          @transport.dispatch_cb @read_buffer.read_string(size)
-        else
-          break
-        end
-      end
-
-      dispatch_cipher_text
-    end
-
-    def signal_handshake
-      @handshake_signaled = true
-
-      # Check protocol support here
-      if @context.alpn_set
-        proto = alpn_negotiated_protocol
-
-        if proto == :failed
-          if @alpn_negotiated
-            # We should shutdown if this is the case
-            # TODO: send back proper error message
-            @transport.close_cb
-            return
-          end
-        end
-        @transport.alpn_protocol_cb(proto)
-      end
-
-      @transport.handshake_cb
-    end
-
-    def alpn_negotiated!
-      @alpn_negotiated = true
-    end
-
-    SSL_RECEIVED_SHUTDOWN = 2
-    def cleanup
-      return unless @ready
-
-      @ready = false
-
-      InstanceLookup.delete @ssl.address
-
-      if (SSL.SSL_get_shutdown(@ssl) & SSL_RECEIVED_SHUTDOWN) != 0
-        SSL.SSL_shutdown @ssl
-      else
-        SSL.SSL_clear @ssl
-      end
-
-      SSL.SSL_free @ssl
-
-      if @hosts
-        @hosts.each_value(&:cleanup)
-        @hosts = nil
-      else
-        @context.cleanup
-      end
-    end
-
-    # Called from class level callback function
-    def verify(cert)
-      @transport.verify_cb(cert)
-    end
-
-    def close(msg)
-      @transport.close_cb(msg)
-    end
-
-    private
-
-    def alpn_negotiated_protocol
-      return nil unless @context.alpn_set
-
-      proto = FFI::MemoryPointer.new(:pointer, 1, true)
-      len = FFI::MemoryPointer.new(:uint, 1, true)
-      SSL.SSL_get0_alpn_selected(@ssl, proto, len)
-
-      resp = proto.get_pointer(0)
-
-      return :failed if resp.address == 0
-
-      length = len.get_uint(0)
-      resp.read_string(length)
-    end
-
-    def get_plain_text(buffer, ready)
-      # Read the buffered clear text
-      size = SSL.SSL_read(@ssl, buffer, ready)
-      if size >= 0
-        size
-      else
-        SSL.SSL_get_error(@ssl, size) == SSL_ERROR_WANT_READ ? 0 : -1
-      end
-    end
-
-    def pending_data(bio)
-      SSL.BIO_pending(bio)
-    end
-
-    def get_cipher_text(buffer, length)
-      SSL.BIO_read(@bioWrite, buffer, length)
-    end
-
-    def put_cipher_text(data)
-      len = data.bytesize
-      wrote = SSL.BIO_write(@bioRead, data, len)
-      wrote == len
-    end
-
-    SSL_ERROR_WANT_WRITE = 3
-    def put_plain_text(data)
-      @write_queue.push(data) if data
-      return 0 unless SSL.is_init_finished(@ssl)
-
-      fatal = false
-      did_work = false
-
-      until @write_queue.empty?
-        data = @write_queue.pop
-        len = data.bytesize
-
-        wrote = SSL.SSL_write(@ssl, data, len)
-
-        if wrote > 0
-          did_work = true
-        else
-          err_code = SSL.SSL_get_error(@ssl, wrote)
-          if (err_code != SSL_ERROR_WANT_READ) && (err_code != SSL_ERROR_WANT_WRITE)
-            fatal = true
-          else
-            # Not fatal - add back to the queue
-            @write_queue.unshift data
-          end
-
-          break
-        end
-      end
-
-      if did_work
-        1
-      elsif fatal
-        -1
-      else
-        0
-      end
-    end
-
-    CIPHER_DISPATCH_FAILED = "Cipher text dispatch failed"
-    def dispatch_cipher_text
-      loop do
-        did_work = false
-
-        # Get all the encrypted data and transmit it
-        pending = pending_data(@bioWrite)
-        if pending > 0
-          buffer = FFI::MemoryPointer.new(:char, pending, false)
-
-          resp = get_cipher_text(buffer, pending)
-          raise Error, CIPHER_DISPATCH_FAILED unless resp > 0
-
-          @transport.transmit_cb(buffer.read_string(resp))
-          did_work = true
-        end
-
-        # Send any queued out going data
-        unless @write_queue.empty?
-          resp = put_plain_text nil
-          if resp > 0
-            did_work = true
-          elsif resp < 0
-            @transport.close_cb
-          end
-        end
-        break unless did_work
-      end
-    end
-  end
-end

data/lib/httpx/io/tls/context.rb

@@ -1,199 +0,0 @@
-# frozen_string_literal: true
-
-# Copyright (c) 2004-2013 Cotag Media
-#
-# Permission is hereby granted, free of charge, to any person obtaining a copy
-# of this software and associated documentation files (the "Software"), to deal
-# in the Software without restriction, including without limitation the rights
-# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-# copies of the Software, and to permit persons to whom the Software is furnished
-# to do so, subject to the following conditions:
-#
-# The above copyright notice and this permission notice shall be included in all
-# copies or substantial portions of the Software.
-#
-# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-# THE SOFTWARE.
-#
-
-class HTTPX::TLS
-  class Context
-
-    # Based on information from https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
-    CIPHERS = "EECDH+AESGCM:EDH+AESGCM:ECDHE-RSA-AES128-GCM-SHA256:AES256+EECDH:DHE-RSA-AES128-GCM-SHA256:AES256+EDH:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4"
-    SESSION = "ruby-tls"
-
-    ALPN_LOOKUP = ::Concurrent::Map.new
-    ALPN_Select_CB = FFI::Function.new(:int, [
-                                         # array of str, unit8 out,uint8 in,        *arg
-                                         :pointer, :pointer, :pointer, :string, :uint, :pointer
-                                       ]) do |ssl_p, out, outlen, inp, inlen, _arg|
-      ssl = Box::InstanceLookup[ssl_p.address]
-      return SSL::SSL_TLSEXT_ERR_ALERT_FATAL unless ssl
-
-      protos = ssl.context.alpn_str
-      status = SSL.SSL_select_next_proto(out, outlen, protos, protos.length, inp, inlen)
-      ssl.alpn_negotiated
-
-      case status
-      when SSL::OPENSSL_NPN_UNSUPPORTED
-        SSL::SSL_TLSEXT_ERR_ALERT_FATAL
-      when SSL::OPENSSL_NPN_NEGOTIATED
-        SSL::SSL_TLSEXT_ERR_OK
-      when SSL::OPENSSL_NPN_NO_OVERLAP
-        SSL::SSL_TLSEXT_ERR_ALERT_WARNING
-      end
-    end
-
-    attr_reader :is_server, :ssl_ctx, :alpn_set, :alpn_str
-
-    def initialize(server, options = {})
-      @is_server = server
-
-      if @is_server
-        @ssl_ctx = SSL.SSL_CTX_new(SSL.TLS_server_method)
-        set_private_key(options[:private_key] || SSL::DEFAULT_PRIVATE)
-        set_certificate(options[:cert_chain]  || SSL::DEFAULT_CERT)
-        set_client_ca(options[:client_ca])
-      else
-        @ssl_ctx = SSL.SSL_CTX_new(SSL.TLS_client_method)
-      end
-
-      SSL.SSL_CTX_set_options(@ssl_ctx, SSL::SSL_OP_ALL)
-      SSL.SSL_CTX_set_mode(@ssl_ctx, SSL::SSL_MODE_RELEASE_BUFFERS)
-
-      SSL.SSL_CTX_set_cipher_list(@ssl_ctx, options[:ciphers] || CIPHERS)
-
-      set_min_version(options[:version])
-
-      if @is_server
-        SSL.SSL_CTX_sess_set_cache_size(@ssl_ctx, 128)
-        SSL.SSL_CTX_set_session_id_context(@ssl_ctx, SESSION, 8)
-      else
-        set_private_key(options[:private_key])
-        set_certificate(options[:cert_chain])
-      end
-      set_alpn_negotiation(options[:protocols])
-    end
-
-    def cleanup
-      return unless @ssl_ctx
-
-      SSL.SSL_CTX_free(@ssl_ctx)
-      @ssl_ctx = nil
-    end
-
-    def add_server_name_indication
-      raise Error, "only valid for server mode context" unless @is_server
-
-      SSL.SSL_CTX_set_tlsext_servername_callback(@ssl_ctx, ServerNameCB)
-    end
-
-    ServerNameCB = FFI::Function.new(:int, %i[pointer pointer pointer]) do |ssl, _, _|
-      ruby_ssl = Box::InstanceLookup[ssl.address]
-      return SSL::SSL_TLSEXT_ERR_NOACK unless ruby_ssl
-
-      ctx = ruby_ssl.hosts[SSL.SSL_get_servername(ssl, SSL::TLSEXT_NAMETYPE_host_name)]
-      if ctx
-        SSL.SSL_set_SSL_CTX(ssl, ctx.ssl_ctx)
-        SSL::SSL_TLSEXT_ERR_OK
-      else
-        SSL::SSL_TLSEXT_ERR_ALERT_FATAL
-      end
-    end
-
-    private
-
-    def self.build_alpn_string(protos)
-      protos.reduce("".b) do |buffer, proto|
-        buffer << proto.bytesize
-        buffer << proto
-      end
-    end
-
-    # Version can be one of:
-    # :SSL3, :TLS1, :TLS1_1, :TLS1_2, :TLS1_3, :TLS_MAX
-    if SSL::VERSION_SUPPORTED
-
-      def set_min_version(version)
-        return unless version
-
-        num = SSL.const_get("#{version}_VERSION")
-        SSL.SSL_CTX_set_min_proto_version(@ssl_ctx, num) == 1
-      rescue NameError
-        raise Error, "#{version} is unsupported"
-      end
-
-    else
-      def set_min_version(_version); end
-    end
-
-    if SSL::ALPN_SUPPORTED
-      def set_alpn_negotiation(protocols)
-        @alpn_set = false
-        return unless protocols
-
-        if @is_server
-          @alpn_str = Context.build_alpn_string(protocols)
-          SSL.SSL_CTX_set_alpn_select_cb(@ssl_ctx, ALPN_Select_CB, nil)
-          @alpn_set = true
-        else
-          protocols = Context.build_alpn_string(protocols)
-          @alpn_set = SSL.SSL_CTX_set_alpn_protos(@ssl_ctx, protocols, protocols.length) == 0
-        end
-      end
-    else
-      def set_alpn_negotiation(_protocols); end
-    end
-
-    def set_private_key(key)
-      err = if key.is_a? FFI::Pointer
-        SSL.SSL_CTX_use_PrivateKey(@ssl_ctx, key)
-      elsif key && File.file?(key)
-        SSL.SSL_CTX_use_PrivateKey_file(@ssl_ctx, key, SSL_FILETYPE_PEM)
-      else
-        1
-      end
-
-      # Check for errors
-      if err <= 0
-        # TODO: : ERR_print_errors_fp or ERR_print_errors
-        # So we can properly log the issue
-        cleanup
-        raise Error, "invalid private key or file not found"
-      end
-    end
-
-    def set_certificate(cert)
-      err = if cert.is_a? FFI::Pointer
-        SSL.SSL_CTX_use_certificate(@ssl_ctx, cert)
-      elsif cert && File.file?(cert)
-        SSL.SSL_CTX_use_certificate_chain_file(@ssl_ctx, cert)
-      else
-        1
-      end
-
-      if err <= 0
-        cleanup
-        raise Error, "invalid certificate or file not found"
-      end
-    end
-
-    def set_client_ca(ca)
-      return unless ca
-
-      if File.file?(ca) && (ca_ptr = SSL.SSL_load_client_CA_file(ca))
-        # there is no error checking provided by SSL_CTX_set_client_CA_list
-        SSL.SSL_CTX_set_client_CA_list(@ssl_ctx, ca_ptr)
-      else
-        cleanup
-        raise Error, "invalid ca certificate or file not found"
-      end
-    end
-  end
-end