iodine 0.1.16 → 0.1.17

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: b4d5413250301e7bf147d2768d9989815d00ea67
-  data.tar.gz: a4225e75c91425af46c034a37db12fdfca468a3c
+  metadata.gz: 2f3c4befa23f4edb3a43a751b7b9b9a0834411b1
+  data.tar.gz: 59be563a5d91a4dbdc72b06dd282d8acf9f96ad2
 SHA512:
-  metadata.gz: 8e41378d248d5607120b26d96c2b94ad85de20ced37e9ac2091afe4dd8c618e04ffe427a319cd70febae126bfcb79a3a33e7979d5ca291141fac1263a2b7399e
-  data.tar.gz: a6b209fc737a540af696e11c85a981fae392e83e46325e2b3b10dd6fcea9bbc111043313a3ae4af3c3ab7480092458b381074693aa293adfa69d2047b328ab57
+  metadata.gz: ebb7e22141e7c3f96ff23c8a7923026193e14409bd00746c84acde2258951eb6ef272ad713db79d93e40541d98a07680fe5a5deab52eea2a067922d550504bd2
+  data.tar.gz: 94e92158a092f1799b74500b9500c5a22b205d21ef13cc36f8cc589e6eaac618ca13f592b6dde45cbda16a698c0d1e23e197ec9702d8e96e085b59dca4cb4991

data/CHANGELOG.md

@@ -8,6 +8,20 @@ Please notice that this change log contains changes for upcoming releases as wel
 
 ***
 
+Change log v.0.1.17
+
+**Credit**: thanks you @frozenfoxx for going through the readme and fixing my broken grammer.
+
+**Fix**: fixed an issue where multiple Pings might get sent when pinging takes time. Now pings are exclusive (run within their own Mutex).
+
+**Fix**: Http/2 is back... sorry about breaking it in the 0.1.16 version. When I updated the write buffer I forgot to write the status of the response, causing a protocol error related with the headers. It's now working again.
+
+**Update**: by default and for security reasons, session id's created through a secure connection (SSL) will NOT be available on a non secure connection (SSL/TLS). However, while upgrading to the encrypted connection, the non_encrypted session storage is now available for review using the `Response#session_old` method.
+
+* Remember that sessions are never really safe, no matter how much we guard them. Session hijacking is far too easy. This is why Iodine stores the session data locally and not within the session cookie. This is also why you should review any authentication before performing sensitive tasks based on session stored authentication data.
+
+***
+
 Change log v.0.1.16
 
 **Performance**: Http/1 and Http/2 connections now share and recycle their write buffer when while reading the response body and writing it to the IO. This (hopefuly) prevents excess `malloc` calls by the interperter.

data/README.md

@@ -56,15 +56,15 @@ Iodine.threads = 5
 exit
 ```
 
-In this mode, Iodine will continue running until all the tasks have completed and than it will quite. Timer based tasks will be ignored.
+In this mode, Iodine will continue running until all the tasks have completed and then it will quit. Timer-based tasks will be ignored.
 
 ## Simple Usage: Task polling
 
-This mode of operation is effective if want Iodine to periodically initiates new tasks, for instance if you cannot use `cron`.
+This mode of operation is effective if you want Iodine to periodically initiate new tasks such as when you are not able to use `cron`.
 
 To initiate this mode, simply set: `Iodine.protocol = :timers` OR create a TimedEvent.
 
-In example:
+In example form:
 
 
 ```ruby

data/bin/hello_world

@@ -59,6 +59,7 @@ Process.fork do
       res.stream_async { sleep 2; res << "I was sleeping..."}
       next
     end
+    res << "Old session visits: #{res.session_old[:count]}\n\n" if res.session_old
 		res.session[:count] ||= 0
 		res.session[:count] += 1
     res['content-type'] = 'text/plain'

data/lib/iodine/http/http2.rb

@@ -82,9 +82,7 @@ module Iodine
 				send_headers response, request
 				return body && body.close if request.head?
 				if body
-					until body.eof?
-						response.bytes_written += emit_payload(body.read(@settings[SETTINGS_MAX_FRAME_SIZE], Thread.current[:write_buffer]), request[:sid], 0, ((finish && body.eof?) ? 1 : 0))
-					end
+					response.bytes_written += emit_payload body, request[:sid], 0,(finish ? 1 : 0)
 					body.close
 				elsif finish
 					emit_payload(''.freeze, request[:sid], 0, 1)
@@ -93,7 +91,7 @@ module Iodine
 			end
 
 			def ping
-				@frame_locker.synchronize { emit_frame "pniodine", 0, 6 }
+				@frame_locker.synchronize { emit_frame "pniodine".freeze, 0, 6 }
 			end
 
 			def push request
@@ -102,7 +100,7 @@ module Iodine
 				# emit push promise
 				emit_payload @hpack.encode(path: request[:path], method: request[:method], scheme: request[:scheme], authority: request[:authority]), (request[:sid] = (@last_push += 2)), 5, 4
 				# queue for app dispatch
-				Iodine.run request, &::Iodine::Http::Http2.dispatch
+				Iodine.run( request, &::Iodine::Http::Http2.dispatch)
 			end
 
 			def go_away error_code
@@ -119,8 +117,8 @@ module Iodine
 
 			# clear text handshake
 			def self.handshake request, io, data
-				return false unless request['upgrade'] =~ /h2c/ && request['http2-settings']
-				io.write "HTTP/1.1 101 Switching Protocols\r\nConnection: Upgrade\r\nUpgrade: h2c\r\n\r\n"
+				return false unless request['upgrade'.freeze] =~ /h2c/.freeze && request['http2-settings'.freeze]
+				io.write "HTTP/1.1 101 Switching Protocols\r\nConnection: Upgrade\r\nUpgrade: h2c\r\n\r\n".freeze
 				http_2 = self.new(io, request)
 				unless data.eof?
 					http_2.on_message data.read
@@ -150,12 +148,12 @@ module Iodine
 				return false if response.headers.frozen?
 				headers = response.headers
 				# headers[:status] = response.status.to_s
-				headers['set-cookie'] = response.extract_cookies
+				headers['set-cookie'.freeze] = response.extract_cookies
 				headers.freeze
-				(out = (Thread.current[:headers_buffer] ||= String.new)).clear
-				out <<  @hpack.encode(headers)
-				emit_payload (out), request[:sid], 1, (request.head? ? 1 : 0)
-				out.clear
+				(Thread.current[:headers_buffer] ||= String.new).clear
+				Thread.current[:headers_buffer] <<  @hpack.encode(status: response.status)
+				Thread.current[:headers_buffer] <<  @hpack.encode(headers)
+				emit_payload Thread.current[:headers_buffer], request[:sid], 1, (request.head? ? 1 : 0)
 				return true
 			end
 
@@ -175,17 +173,17 @@ module Iodine
 				max_frame_size = 131_072 if max_frame_size > 131_072
 				return @frame_locker.synchronize { emit_frame(payload, sid, type, ( (type == 0x1 || type == 0x5) ? (flags | 0x4) : flags ) ) } if payload.bytesize <= max_frame_size
 				sent = 0
-				payload = StringIO.new payload
+				payload = StringIO.new payload unless payload.respond_to? :read
 				if type == 0x1 || type == 0x5
 					@frame_locker.synchronize do
-						sent += emit_frame(payload.read(max_frame_size), sid, 0x1, flags & 254)
-						sent += emit_frame(payload.read(max_frame_size), sid, 0x9, 0) while payload.size - payload.pos > max_frame_size
-						sent += emit_frame(payload.read(max_frame_size), sid, 0x9, (0x4 | (flags & 0x1)) )
+						sent += emit_frame(payload.read(max_frame_size, Thread.current[:write_buffer]), sid, 0x1, flags & 254)
+						sent += emit_frame(payload.read(max_frame_size, Thread.current[:write_buffer]), sid, 0x9, 0) while payload.size - payload.pos > max_frame_size
+						sent += emit_frame(payload.read(max_frame_size, Thread.current[:write_buffer]), sid, 0x9, (0x4 | (flags & 0x1)) )
 					end
 					return sent
 				end
-				sent += @frame_locker.synchronize { emit_frame(payload.read(max_frame_size), sid, type, (flags & 254)) } while payload.size - payload.pos > max_frame_size
-				sent += @frame_locker.synchronize { emit_frame(payload.read(max_frame_size), sid, type, flags) }
+				sent += @frame_locker.synchronize { emit_frame(payload.read(max_frame_size, Thread.current[:write_buffer]), sid, type, (flags & 254)) } while payload.size - payload.pos > max_frame_size
+				sent += @frame_locker.synchronize { emit_frame(payload.read(max_frame_size, Thread.current[:write_buffer]), sid, type, flags) }
 			end
 
 			def parse_preface data

data/lib/iodine/http/response.rb

@@ -158,6 +158,16 @@ module Iodine
 				@request[:session] = @session = ::Iodine::Http::SessionManager.get(id)
 			end
 
+			# Returns the OLD session storage object when the connection was upgraded to SSL.
+			#
+			# By default and for security reasons, session id's created on a secure connection will NOT be available on a non secure connection (SSL/TLS).
+			# However, while upgrading to the encrypted connection, the non_encrypted session storage is still available for review.
+			#
+			# @return [nil, "Hash like storage"] returns the non-encypeted  connection's session storage object, if it exists. This method will NOT create a new sesssion if it didn't exist.
+			def session_old
+				::Iodine::Http::SessionManager.get(@request.cookies[::Iodine::Http.session_token.to_sym]) if @request.cookies[::Iodine::Http.session_token.to_sym]
+			end
+
 			# Returns a writable combined hash of the request's cookies and the response cookie values.
 			#
 			# Any cookies writen to this hash (`response.cookies[:name] = value` will be set using default values).

data/lib/iodine/protocol.rb

@@ -166,6 +166,7 @@ module Iodine
 		def initialize io, options = nil
 			@timeout ||= nil
 			@send_locker = Mutex.new
+			@ping_locker = Mutex.new
 			@locker = Mutex.new
 			@io = io
 			@options = options
@@ -193,11 +194,16 @@ module Iodine
 		end
 
 
-		# This method is used by Iodine to ask whether a timeout has occured.
+		# This method is used by Iodine invoke a timeout review.
 		#
 		# Normally you won't need to override this method. See {#ping}
 		def timeout? time
-			ping if @timeout && !@send_locker.locked? && ( (time - @last_active) > @timeout )
+			return unless @ping_locker.try_lock
+			begin
+				touch && ping if @timeout && !@send_locker.locked? && ( (time - @last_active) > @timeout )
+			ensure
+				@ping_locker.unlock	
+			end
 		end
 
 		protected

data/lib/iodine/version.rb

@@ -1,3 +1,3 @@
 module Iodine
-  VERSION = "0.1.16"
+  VERSION = "0.1.17"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: iodine
 version: !ruby/object:Gem::Version
-  version: 0.1.16
+  version: 0.1.17
 platform: ruby
 authors:
 - Boaz Segev
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2015-11-15 00:00:00.000000000 Z
+date: 2015-11-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler