iodine 0.7.31 → 0.7.32

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4333832730c27a0b0f866df2eded6d5afc707d747cec5b4e56f5303252b27b42
-  data.tar.gz: 6eb945b021821b45fb2db140f268c7c4e6910d6ce1ad18b14425eaec491ea677
+  metadata.gz: 1176ef5b01b31595fe7cccdf6cad949354b5f733ae870a1b56be511d21b0a860
+  data.tar.gz: 15d65ddf131dbb20b40d4aceb6709abff2634b9a68c00e2a2f54480cbca1f9da
 SHA512:
-  metadata.gz: 24e5b2c190e6ee10777dcc1d7acaba00913c978bdb35a7a43b743ff62a7b344837797cb131ed3c88ac464919e80779fb16058e32b3fac6c95e11fdb9c6a50e4d
-  data.tar.gz: 2045b0b5002585b6805cafee4acd08df08ce36c4e119a742288662c64624dd8938003ee3d216cd4fd01f1d38a501f297660ca6e6cbb125bfcd39e79ebdefe028
+  metadata.gz: 12e5c3799f8f85ec60f1e5a2c596e88d5fc4f8dd1704a82a9159c4d3a6894ac48d5adcf7f36c8ab346ad764573f361090790dc96938cf4804cd4369cb2879ce6
+  data.tar.gz: 8fedb5972019f22d202d5bad886c01645caadbe864d9b959d2a11f99c70ca038d4d8042b78751c05151da2a516c02f8aeccb05fb8a283d45e533726166cafd88

data/CHANGELOG.md

@@ -6,6 +6,10 @@ Please notice that this change log contains changes for upcoming releases as wel
 
 ## Changes:
 
+#### Change log v.0.7.32
+
+**Fix**: (`http1`) fixes a race-condition between the `on_ready` and `on_data` events, that could result in the `on_data` event being called twice instead of once (only possible with some clients). On multi-threaded workers, this could result in the CPU spinning while the task lock remains busy. Credit to Néstor Coppi (@Shelvak) for exposing the issue and providing an example application with detailed reports. Issue #75.
+
 #### Change log v.0.7.31
 
 **Security**: a heap-overflow vulnerability was fixed in the WebSocket parser. This attack could have been triggered remotely by a maliciously crafted message-header. Credit to Dane (4cad@silvertoque) for exposing this issue and providing a Python script demonstrating the attack. 

data/ext/iodine/http1.c

@@ -554,7 +554,7 @@ static int http1_on_request(http1_parser_s *parser) {
   if (p->request.method && !p->stop)
     http_finish(&p->request);
   h1_reset(p);
-  return fio_is_closed(p->p.uuid);
+  return !p->close && fio_is_closed(p->p.uuid);
 }
 /** called when a response was received. */
 static int http1_on_response(http1_parser_s *parser) {
@@ -563,7 +563,7 @@ static int http1_on_response(http1_parser_s *parser) {
   if (p->request.status_str && !p->stop)
     http_finish(&p->request);
   h1_reset(p);
-  return fio_is_closed(p->p.uuid);
+  return !p->close && fio_is_closed(p->p.uuid);
 }
 /** called when a request method is parsed. */
 static int http1_on_method(http1_parser_s *parser, char *method,
@@ -666,7 +666,9 @@ static int http1_on_body_chunk(http1_parser_s *parser, char *data,
 
 /** called when a protocol error occurred. */
 static int http1_on_error(http1_parser_s *parser) {
-  FIO_LOG_DEBUG("HTTP parser error.");
+  FIO_LOG_DEBUG("HTTP parser error at HTTP/1.1 buffer position %zu/%zu",
+                parser->state.next - parser2http(parser)->buf,
+                parser2http(parser)->buf_len);
   fio_close(parser2http(parser)->p.uuid);
   return -1;
 }
@@ -722,6 +724,7 @@ static inline void http1_consume_data(intptr_t uuid, http1pr_s *p) {
 throttle:
   /* throttle busy clients (slowloris) */
   fio_suspend(uuid);
+  p->stop |= 4;
   FIO_LOG_DEBUG("(HTTP/1,1) throttling client at %.*s",
                 (int)fio_peer_addr(uuid).len, fio_peer_addr(uuid).data);
 }
@@ -752,7 +755,11 @@ static void http1_on_close(intptr_t uuid, fio_protocol_s *protocol) {
 /** called when the connection was closed, but will not run concurrently */
 static void http1_on_ready(intptr_t uuid, fio_protocol_s *protocol) {
   /* resume slow clients from suspension */
-  fio_force_event(uuid, FIO_EVENT_ON_DATA);
+  http1pr_s *p = (http1pr_s *)protocol;
+  if ((p->stop & 4)) {
+    p->stop ^= 4;
+    fio_force_event(uuid, FIO_EVENT_ON_DATA);
+  }
   (void)protocol;
 }
 
@@ -769,6 +776,7 @@ static void http1_on_data_first_time(intptr_t uuid, fio_protocol_s *protocol) {
 
   /* ensure future reads skip this first time HTTP/2.0 test */
   p->p.protocol.on_data = http1_on_data;
+  /* Test fot HTTP/2.0 pre-knowledge */
   if (i >= 24 && !memcmp(p->buf, "PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n", 24)) {
     FIO_LOG_WARNING("client claimed unsupported HTTP/2 prior knowledge.");
     fio_close(uuid);

data/lib/iodine/version.rb

@@ -1,3 +1,3 @@
 module Iodine
-  VERSION = '0.7.31'.freeze
+  VERSION = '0.7.32'.freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: iodine
 version: !ruby/object:Gem::Version
-  version: 0.7.31
+  version: 0.7.32
 platform: ruby
 authors:
 - Boaz Segev
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2019-05-17 00:00:00.000000000 Z
+date: 2019-06-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -202,7 +202,7 @@ licenses:
 - MIT
 metadata:
   allowed_push_host: https://rubygems.org
-post_install_message: 'Thank you for installing Iodine 0.7.31.
+post_install_message: 'Thank you for installing Iodine 0.7.32.
 
 '
 rdoc_options: []