itsi-server 0.1.1 → 0.2.2

data/ext/itsi_server/src/server/itsi_server.rs

@@ -1,182 +0,0 @@
-use super::{
-    bind::Bind,
-    listener::{Listener, SockAddr},
-};
-use crate::{request::itsi_request::ItsiRequest, ITSI_SERVER};
-use bytes::Bytes;
-use derive_more::Debug;
-use http_body_util::{combinators::BoxBody, Empty};
-use hyper::{
-    body::Incoming, header::HeaderName, service::service_fn, HeaderMap, Request, Response,
-    StatusCode,
-};
-use hyper_util::{rt::TokioExecutor, server::conn::auto::Builder};
-use itsi_tracing::{error, info};
-use magnus::{
-    error::Result,
-    scan_args::{get_kwargs, scan_args, Args, KwArgs},
-    value::{Opaque, ReprValue},
-    RHash, Ruby, Value,
-};
-use parking_lot::Mutex;
-use std::{collections::HashMap, convert::Infallible, sync::Arc};
-use tokio::runtime::Builder as RuntimeBuilder;
-use tokio::task::JoinSet;
-
-#[magnus::wrap(class = "Itsi::Server", free_immediately, size)]
-#[derive(Debug)]
-pub struct Server {
-    #[debug(skip)]
-    app: Opaque<Value>,
-    #[allow(unused)]
-    workers: u16,
-    #[allow(unused)]
-    threads: u16,
-    #[allow(unused)]
-    shutdown_timeout: f64,
-    script_name: String,
-    pub(crate) binds: Mutex<Vec<Bind>>,
-}
-
-impl Server {
-    pub fn new(args: &[Value]) -> Result<Self> {
-        type OptionalArgs = (
-            Option<u16>,
-            Option<u16>,
-            Option<f64>,
-            Option<String>,
-            Option<Vec<String>>,
-        );
-
-        let scan_args: Args<(), (), (), (), RHash, ()> = scan_args(args)?;
-        let args: KwArgs<(Value,), OptionalArgs, ()> = get_kwargs(
-            scan_args.keywords,
-            &["app"],
-            &[
-                "workers",
-                "threads",
-                "shutdown_timeout",
-                "script_name",
-                "binds",
-            ],
-        )?;
-        let server = Server {
-            app: Opaque::from(args.required.0),
-            workers: args.optional.0.unwrap_or(1),
-            threads: args.optional.1.unwrap_or(1),
-            shutdown_timeout: args.optional.2.unwrap_or(5.0),
-            script_name: args.optional.3.unwrap_or("".to_string()),
-            binds: Mutex::new(
-                args.optional
-                    .4
-                    .unwrap_or_else(|| vec!["localhost:3000".to_string()])
-                    .into_iter()
-                    .map(|s| s.parse().unwrap_or_else(|_| Bind::default()))
-                    .collect(),
-            ),
-        };
-        Ok(server)
-    }
-
-    pub(crate) async fn process_request(
-        hyper_request: Request<Incoming>,
-        app: Opaque<Value>,
-        script_name: String,
-        listener: Arc<Listener>,
-        addr: SockAddr,
-    ) -> itsi_error::Result<Response<BoxBody<Bytes, Infallible>>> {
-        let request = ItsiRequest::build_from(hyper_request, addr, script_name, listener).await;
-        let ruby = Ruby::get().unwrap();
-        let server = ruby.get_inner(&ITSI_SERVER);
-        let response: Result<(u16, HashMap<String, String>, Value)> =
-            server.funcall("call", (app, request));
-        if let Ok((status, headers_raw, body)) = response {
-            let mut body_buf = vec![];
-            for body_chunk in body.enumeratorize("each", ()) {
-                body_buf.push(body_chunk.unwrap().to_string())
-            }
-            body.check_funcall::<_, _, Value>("close", ());
-            let boxed_body = BoxBody::new(body_buf.join(""));
-            let mut response = Response::new(boxed_body);
-            let mut headers = HeaderMap::new();
-            headers_raw.into_iter().for_each(|(key, value)| {
-                let header_name: HeaderName = key.parse().unwrap();
-                headers.insert(header_name, value.parse().unwrap());
-            });
-            *response.headers_mut() = headers;
-            *response.status_mut() = StatusCode::from_u16(status).unwrap();
-            Ok(response)
-        } else {
-            let mut response = Response::new(BoxBody::new(Empty::new()));
-            *response.status_mut() = StatusCode::BAD_REQUEST;
-            Ok(response)
-        }
-    }
-
-    pub fn start(&self) {
-        let mut builder: RuntimeBuilder = RuntimeBuilder::new_current_thread();
-        let runtime = builder
-            .thread_name("itsi-server-accept-loop")
-            .thread_stack_size(3 * 1024 * 1024)
-            .enable_io()
-            .enable_time()
-            .build()
-            .expect("Failed to build Tokio runtime");
-
-        runtime.block_on(async {
-            let server = Arc::new(Builder::new(TokioExecutor::new()));
-            let listeners: Vec<Listener> = self
-                .binds
-                .lock()
-                .iter()
-                .cloned()
-                .map(Listener::from)
-                .collect::<Vec<_>>();
-
-            let mut set = JoinSet::new();
-
-            for listener in listeners {
-                let app = self.app;
-                let server_clone = server.clone();
-                let listener_clone = Arc::new(listener);
-                let script_name = self.script_name.clone();
-
-                set.spawn(async move {
-                    loop {
-                        let server = server_clone.clone();
-                        let listener = listener_clone.clone();
-                        let script_name = script_name.clone();
-                        let (stream, addr) = match listener.accept().await {
-                            Ok(stream) => stream,
-                            Err(e) => {
-                                error!("Failed to accept connection: {:?}", e);
-                                continue;
-                            }
-                        };
-
-                        tokio::spawn(async move {
-                            if let Err(e) = server
-                                .serve_connection_with_upgrades(
-                                    stream,
-                                    service_fn(move |hyper_request: Request<Incoming>| {
-                                        Server::process_request(
-                                            hyper_request,
-                                            app,
-                                            script_name.clone(),
-                                            listener.clone(),
-                                            addr.clone(),
-                                        )
-                                    }),
-                                )
-                                .await
-                            {
-                                info!("Closed connection due to: {:?}", e);
-                            }
-                        });
-                    }
-                });
-            }
-            while let Some(_res) = set.join_next().await {}
-        })
-    }
-}

data/ext/itsi_server/src/server/listener.rs

@@ -1,218 +0,0 @@
-use super::bind::{Bind, BindAddress};
-use super::transfer_protocol::TransferProtocol;
-use hyper_util::rt::TokioIo;
-use itsi_error::Result;
-use itsi_tracing::info;
-use socket2::{Domain, Protocol, Socket, Type};
-use std::net::{IpAddr, SocketAddr, TcpListener as StdTcpListener};
-use std::pin::Pin;
-use std::sync::Arc;
-use std::{os::unix::net::UnixListener as StdUnixListener, path::PathBuf};
-use tokio::net::{unix, TcpListener, TcpStream, UnixListener, UnixStream};
-use tokio_rustls::TlsAcceptor;
-
-pub(crate) trait IoStream:
-    tokio::io::AsyncRead + tokio::io::AsyncWrite + Send + Unpin
-{
-}
-impl<T: tokio::io::AsyncRead + tokio::io::AsyncWrite + Send + Unpin> IoStream for T {}
-
-pub(crate) enum Listener {
-    Tcp(TcpListener),
-    TcpTls((TcpListener, TlsAcceptor)),
-    Unix(UnixListener),
-    UnixTls((UnixListener, TlsAcceptor)),
-}
-
-enum Stream {
-    TcpStream((TcpStream, SocketAddr)),
-    UnixStream((UnixStream, unix::SocketAddr)),
-}
-
-#[derive(Clone, Debug)]
-pub enum SockAddr {
-    Tcp(Arc<SocketAddr>),
-    Unix(Arc<unix::SocketAddr>),
-}
-impl std::fmt::Display for SockAddr {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            SockAddr::Tcp(socket_addr) => write!(f, "{}", socket_addr.ip().to_canonical()),
-            SockAddr::Unix(socket_addr) => match socket_addr.as_pathname() {
-                Some(path) => write!(f, "{:?}", path),
-                None => write!(f, ""),
-            },
-        }
-    }
-}
-
-impl Listener {
-    pub(crate) async fn accept(&self) -> Result<(TokioIo<Pin<Box<dyn IoStream>>>, SockAddr)> {
-        match self {
-            Listener::Tcp(listener) => Listener::accept_tcp(listener).await,
-            Listener::TcpTls((listener, acceptor)) => {
-                Listener::accept_tls(listener, acceptor).await
-            }
-            Listener::Unix(stream) => Listener::accept_unix(stream).await,
-            Listener::UnixTls((listener, acceptor)) => {
-                Listener::accept_unix_tls(listener, acceptor).await
-            }
-        }
-    }
-
-    async fn to_tokio_io(
-        input_stream: Stream,
-        tls_acceptor: Option<&TlsAcceptor>,
-    ) -> Result<(TokioIo<Pin<Box<dyn IoStream>>>, SockAddr)> {
-        match tls_acceptor {
-            Some(acceptor) => match input_stream {
-                Stream::TcpStream((tcp_stream, socket_address)) => {
-                    match acceptor.accept(tcp_stream).await {
-                        Ok(tls_stream) => Ok((
-                            TokioIo::new(Box::pin(tls_stream) as Pin<Box<dyn IoStream>>),
-                            SockAddr::Tcp(Arc::new(socket_address)),
-                        )),
-                        Err(err) => Err(err.into()),
-                    }
-                }
-                Stream::UnixStream((unix_stream, socket_address)) => {
-                    match acceptor.accept(unix_stream).await {
-                        Ok(tls_stream) => Ok((
-                            TokioIo::new(Box::pin(tls_stream) as Pin<Box<dyn IoStream>>),
-                            SockAddr::Unix(Arc::new(socket_address)),
-                        )),
-                        Err(err) => Err(err.into()),
-                    }
-                }
-            },
-            None => match input_stream {
-                Stream::TcpStream((tcp_stream, socket_address)) => Ok((
-                    TokioIo::new(Box::pin(tcp_stream) as Pin<Box<dyn IoStream>>),
-                    SockAddr::Tcp(Arc::new(socket_address)),
-                )),
-                Stream::UnixStream((unix_stream, socket_address)) => Ok((
-                    TokioIo::new(Box::pin(unix_stream) as Pin<Box<dyn IoStream>>),
-                    SockAddr::Unix(Arc::new(socket_address)),
-                )),
-            },
-        }
-    }
-
-    async fn accept_tcp(
-        listener: &TcpListener,
-    ) -> Result<(TokioIo<Pin<Box<dyn IoStream>>>, SockAddr)> {
-        let tcp_stream = listener.accept().await?;
-        Self::to_tokio_io(Stream::TcpStream(tcp_stream), None).await
-    }
-
-    async fn accept_tls(
-        listener: &TcpListener,
-        acceptor: &TlsAcceptor,
-    ) -> Result<(TokioIo<Pin<Box<dyn IoStream>>>, SockAddr)> {
-        let tcp_stream = listener.accept().await?;
-        Self::to_tokio_io(Stream::TcpStream(tcp_stream), Some(acceptor)).await
-    }
-
-    async fn accept_unix(
-        listener: &UnixListener,
-    ) -> Result<(TokioIo<Pin<Box<dyn IoStream>>>, SockAddr)> {
-        let unix_stream = listener.accept().await?;
-        Self::to_tokio_io(Stream::UnixStream(unix_stream), None).await
-    }
-
-    async fn accept_unix_tls(
-        listener: &UnixListener,
-        acceptor: &TlsAcceptor,
-    ) -> Result<(TokioIo<Pin<Box<dyn IoStream>>>, SockAddr)> {
-        let unix_stream = listener.accept().await?;
-        Self::to_tokio_io(Stream::UnixStream(unix_stream), Some(acceptor)).await
-    }
-
-    pub(crate) fn scheme(&self) -> String {
-        match self {
-            Listener::Tcp(_) => "http".to_string(),
-            Listener::TcpTls(_) => "https".to_string(),
-            Listener::Unix(_) => "http".to_string(),
-            Listener::UnixTls(_) => "https".to_string(),
-        }
-    }
-
-    pub(crate) fn port(&self) -> u16 {
-        match self {
-            Listener::Tcp(listener) => listener.local_addr().unwrap().port(),
-            Listener::TcpTls((listener, _)) => listener.local_addr().unwrap().port(),
-            Listener::Unix(_) => 0,
-            Listener::UnixTls(_) => 0,
-        }
-    }
-
-    pub(crate) fn host(&self) -> String {
-        match self {
-            Listener::Tcp(listener) => listener.local_addr().unwrap().ip().to_string(),
-            Listener::TcpTls((listener, _)) => listener.local_addr().unwrap().ip().to_string(),
-            Listener::Unix(_) => "unix".to_string(),
-            Listener::UnixTls(_) => "unix".to_string(),
-        }
-    }
-}
-
-impl From<Bind> for Listener {
-    fn from(bind: Bind) -> Self {
-        match bind.address {
-            BindAddress::Ip(addr) => match bind.protocol {
-                TransferProtocol::Http => Listener::Tcp(
-                    TcpListener::from_std(connect_tcp_socket(addr, bind.port.unwrap())).unwrap(),
-                ),
-                TransferProtocol::Https => {
-                    let tcp_listener =
-                        TcpListener::from_std(connect_tcp_socket(addr, bind.port.unwrap()))
-                            .unwrap();
-                    let tls_acceptor = TlsAcceptor::from(Arc::new(bind.tls_config.unwrap()));
-                    Listener::TcpTls((tcp_listener, tls_acceptor))
-                }
-                _ => unreachable!(),
-            },
-            BindAddress::UnixSocket(path) => match bind.tls_config {
-                Some(tls_config) => {
-                    let tls_acceptor = TlsAcceptor::from(Arc::new(tls_config));
-                    Listener::UnixTls((
-                        UnixListener::from_std(connect_unix_socket(&path)).unwrap(),
-                        tls_acceptor,
-                    ))
-                }
-                None => Listener::Unix(UnixListener::from_std(connect_unix_socket(&path)).unwrap()),
-            },
-        }
-    }
-}
-
-fn connect_tcp_socket(addr: IpAddr, port: u16) -> StdTcpListener {
-    let domain = match addr {
-        IpAddr::V4(_) => Domain::IPV4,
-        IpAddr::V6(_) => Domain::IPV6,
-    };
-    let socket = Socket::new(domain, Type::STREAM, Some(Protocol::TCP)).unwrap();
-    let socket_address: SocketAddr = SocketAddr::new(addr, port);
-    socket.set_reuse_address(true).ok();
-    socket.set_reuse_port(true).ok();
-    socket.set_nonblocking(true).ok();
-    socket.set_nodelay(true).ok();
-    socket.set_recv_buffer_size(1_048_576).ok();
-    info!("Binding to {}", socket_address);
-    socket.bind(&socket_address.into()).unwrap();
-    socket.listen(1024).unwrap();
-    socket.into()
-}
-
-fn connect_unix_socket(path: &PathBuf) -> StdUnixListener {
-    let _ = std::fs::remove_file(path);
-    let socket = Socket::new(Domain::UNIX, Type::STREAM, None).unwrap();
-    socket.set_nonblocking(true).ok();
-    let socket_address = socket2::SockAddr::unix(path).unwrap();
-
-    info!("Binding to {:?}", path);
-    socket.bind(&socket_address).unwrap();
-    socket.listen(1024).unwrap();
-
-    socket.into()
-}

data/ext/itsi_server/src/server/tls.rs

@@ -1,138 +0,0 @@
-use base64::{engine::general_purpose, Engine as _};
-use itsi_error::Result;
-use itsi_tracing::{info, warn};
-use rcgen::{CertificateParams, DnType, KeyPair, SanType};
-use rustls_pemfile::{certs, pkcs8_private_keys};
-use std::{collections::HashMap, fs, io::BufReader};
-use tokio_rustls::rustls::{Certificate, PrivateKey, ServerConfig};
-
-const ITS_CA_CERT: &str = include_str!("./itsi_ca/itsi_ca.crt");
-const ITS_CA_KEY: &str = include_str!("./itsi_ca/itsi_ca.key");
-
-// Generates a TLS configuration based on either :
-// * Input "cert" and "key" options (either paths or Base64-encoded strings) or
-// * Performs automatic certificate generation/retrieval. Generated certs use an internal self-signed Isti CA.
-// If a non-local host or optional domain parameter is provided,
-// an automated certificate will attempt to be fetched using let's encrypt.
-pub fn configure_tls(host: &str, query_params: &HashMap<String, String>) -> Result<ServerConfig> {
-    let (certs, key) = if let (Some(cert_path), Some(key_path)) =
-        (query_params.get("cert"), query_params.get("key"))
-    {
-        // Load from file or Base64
-        let certs = load_certs(cert_path);
-        let key = load_private_key(key_path);
-        (certs, key)
-    } else if query_params
-        .get("cert")
-        .map(|v| v == "auto")
-        .unwrap_or(false)
-    {
-        let domain_param = query_params.get("domain");
-        let host_string = host.to_string();
-        let domain = domain_param.or_else(|| {
-            if host_string != "localhost" {
-                Some(&host_string)
-            } else {
-                None
-            }
-        });
-
-        if let Some(domain) = domain {
-            retrieve_acme_cert(domain)?
-        } else {
-            generate_ca_signed_cert(host)?
-        }
-    } else {
-        generate_ca_signed_cert(host)?
-    };
-
-    let mut config = ServerConfig::builder()
-        .with_safe_defaults()
-        .with_no_client_auth()
-        .with_single_cert(certs, key)
-        .expect("Failed to build TLS config");
-
-    config.alpn_protocols = vec![b"h2".to_vec(), b"http/1.1".to_vec()];
-    Ok(config)
-}
-
-pub fn load_certs(path: &str) -> Vec<Certificate> {
-    let data = if let Some(stripped) = path.strip_prefix("base64:") {
-        general_purpose::STANDARD
-            .decode(stripped)
-            .expect("Invalid base64 certificate")
-    } else {
-        fs::read(path).expect("Failed to read certificate file")
-    };
-
-    if data.starts_with(b"-----BEGIN ") {
-        let mut reader = BufReader::new(&data[..]);
-        let certs_der: Vec<Vec<u8>> = certs(&mut reader)
-            .map(|r| {
-                r.map(|der| der.as_ref().to_vec())
-                    .map_err(itsi_error::ItsiError::from)
-            })
-            .collect::<Result<_>>()
-            .expect("Failed to parse certificate file");
-        certs_der.into_iter().map(Certificate).collect()
-    } else {
-        vec![Certificate(data)]
-    }
-}
-
-/// Loads a private key from a file or Base64.
-pub fn load_private_key(path: &str) -> PrivateKey {
-    let key_data = if let Some(stripped) = path.strip_prefix("base64:") {
-        general_purpose::STANDARD
-            .decode(stripped)
-            .expect("Invalid base64 private key")
-    } else {
-        fs::read(path).expect("Failed to read private key file")
-    };
-
-    if key_data.starts_with(b"-----BEGIN ") {
-        let mut reader = BufReader::new(&key_data[..]);
-        let keys: Vec<Vec<u8>> = pkcs8_private_keys(&mut reader)
-            .map(|r| {
-                r.map(|key| key.secret_pkcs8_der().to_vec())
-                    .map_err(itsi_error::ItsiError::from)
-            })
-            .collect::<Result<_>>()
-            .expect("Failed to parse private key");
-        if !keys.is_empty() {
-            return PrivateKey(keys[0].clone());
-        }
-    }
-    PrivateKey(key_data)
-}
-
-pub fn generate_ca_signed_cert(domain: &str) -> Result<(Vec<Certificate>, PrivateKey)> {
-    info!("Generating New Itsi CA - Self signed Certificate. Use `itsi ca export` to export the CA certificate for import into your local trust store.");
-
-    let ca_kp = KeyPair::from_pem(ITS_CA_KEY).unwrap();
-    let params = CertificateParams::from_ca_cert_pem(ITS_CA_CERT).unwrap();
-
-    let ca_cert = params.self_signed(&ca_kp).unwrap();
-    let ee_key = KeyPair::generate().unwrap();
-    let mut ee_params = CertificateParams::default();
-
-    // Set the domain in the subject alternative names (SAN)
-    ee_params.subject_alt_names = vec![SanType::DnsName(domain.try_into()?)];
-    // Optionally, set the Common Name (CN) in the distinguished name:
-    ee_params
-        .distinguished_name
-        .push(DnType::CommonName, domain);
-
-    ee_params.use_authority_key_identifier_extension = true;
-
-    let ee_cert = ee_params.signed_by(&ee_key, &ca_cert, &ee_key).unwrap();
-    let ee_cert_der = ee_cert.der().to_vec();
-    let ee_cert = Certificate(ee_cert_der);
-    Ok((vec![ee_cert], PrivateKey(ee_key.serialize_der())))
-}
-
-/// Retrieves an ACME certificate for a given domain.
-pub fn retrieve_acme_cert(domain: &str) -> Result<(Vec<Certificate>, PrivateKey)> {
-    warn!("Retrieving ACME cert for {}", domain);
-    generate_ca_signed_cert(domain)
-}

data/ext/itsi_server/src/server/transfer_protocol.rs

@@ -1,23 +0,0 @@
-use itsi_error::ItsiError;
-use std::str::FromStr;
-
-#[derive(Debug, Default, Clone)]
-pub enum TransferProtocol {
-    #[default]
-    Https,
-    Http,
-    Unix,
-}
-
-impl FromStr for TransferProtocol {
-    type Err = ItsiError;
-
-    fn from_str(s: &str) -> Result<Self, Self::Err> {
-        match s {
-            "http" => Ok(TransferProtocol::Http),
-            "https" => Ok(TransferProtocol::Https),
-            "unix" => Ok(TransferProtocol::Unix),
-            _ => Err(ItsiError::UnsupportedProtocol(s.to_string())),
-        }
-    }
-}

data/ext/itsi_server/src/stream_writer/mod.rs

@@ -1,21 +0,0 @@
-use bytes::Bytes;
-use magnus::{error::Result as MagnusResult, exception::io_error, Error};
-use tokio::sync::mpsc::Sender;
-
-#[magnus::wrap(class = "Itsi::StreamWriter", free_immediately, size)]
-pub struct StreamWriter {
-    sender: Sender<Bytes>,
-}
-
-impl StreamWriter {
-    pub fn new(sender: Sender<Bytes>) -> Self {
-        StreamWriter { sender }
-    }
-
-    pub fn write(&self, bytes: Bytes) -> MagnusResult<()> {
-        self.sender
-            .blocking_send(bytes)
-            .map_err(|e| Error::new(io_error(), format!("{:?}", e)))?;
-        Ok(())
-    }
-}

data/lib/itsi/request.rb

@@ -1,39 +0,0 @@
-# frozen_string_literal: true
-
-require "stringio"
-
-module Itsi
-  class Request
-    def to_env
-      {
-        "SERVER_SOFTWARE" => "Itsi",
-        "SCRIPT_NAME" => script_name,
-        "REQUEST_METHOD" => method,
-        "PATH_INFO" => path,
-        "REQUEST_PATH" => path,
-        "QUERY_STRING" => query_string,
-        "REMOTE_ADDR" => remote_addr,
-        "SERVER_NAME" => host,
-        "SERVER_PORT" => port.to_s,
-        "SERVER_PROTOCOL" => version,
-        "HTTP_VERSION" => version,
-        "HTTP_HOST" => host,
-        "rack.input" => StringIO.new(body),
-        "rack.errors" => $stderr,
-        "rack.version" => version,
-        "rack.multithread" => true,
-        "rack.multiprocess" => true,
-        "rack.run_once" => false,
-        "rack.multipart.buffer_size" => 16_384
-      }.merge(
-        headers.transform_keys do |k|
-          case k
-          when "content-length" then "CONTENT_LENGTH"
-          when "content-type" then "CONTENT_TYPE"
-          else "HTTP_#{k.upcase.tr("-", "_")}"
-          end
-        end
-      )
-    end
-  end
-end