itsi 0.2.23 → 0.2.24

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6f500a7fdc96a95bb73c92215cef369ad5a208c0ef60f260c36257f74a592448
-  data.tar.gz: 42ccd29b510e972f40b291a0f058b618e4605f2c9379412c853542d7e5e4e8a8
+  metadata.gz: 0450be0cae2f0d3822874ee35e312cc258d6adb33bcbdd9fe659c2ed7c368ea9
+  data.tar.gz: fc08b8ee180b6241e14dd421e68de982cb3f39e7bf04e791a79ea17a77f99ec3
 SHA512:
-  metadata.gz: 3e1e1c6426657562728948fbfab3ca19a727e62ba144ef0c1d0c4ab46d6fa4a7152305ea47d4b23cfdb795a906b60e7bea6e8891c6af704ff9486210a7f05a1e
-  data.tar.gz: 499ba6cd3408cf9e780092e025cb3791af23460cc581dbf774f2774a573b45ddded6c8153358ca3ef6744d6bacc998ac829505c37f329e22dc1e856a7e65891d
+  metadata.gz: 8a4b3ed767538405a7aa311dd3c498ee7182072d6e8013d1a620f21abb55012d20b0d919b86ff03798dd8207b94048d8947acf78a32dd641a548e9e947ce2555
+  data.tar.gz: 9ce0a92e963013836721b5d9b43a05b4e146d6d96ed122a20554a52d9731e0d805480a207687a3d2734e127b0eccf95276354d31e29a38bbb4b16a34481f3eda

data/CHANGELOG.md

@@ -1,3 +1,7 @@
+## [0.2.24] - 2026-04-18
+- Move TLS handshakes out of the listener accept loop so a slow or incomplete TLS client cannot block later HTTPS accepts.
+- Keep malformed proxy-style requests isolated to their connection task instead of disrupting the listener.
+
 ## [0.2.23] - 2026-04-18
 - Return a normal 404 for unmatched proxy-style requests such as CONNECT instead of panicking the HTTP listener.
 

data/Cargo.lock

@@ -1662,7 +1662,7 @@ checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
 
 [[package]]
 name = "itsi-scheduler"
-version = "0.2.23"
+version = "0.2.24"
 dependencies = [
  "bytes",
  "derive_more",
@@ -1680,7 +1680,7 @@ dependencies = [
 
 [[package]]
 name = "itsi-server"
-version = "0.2.23"
+version = "0.2.24"
 dependencies = [
  "argon2",
  "async-channel",

data/Dockerfile

@@ -3,7 +3,7 @@ FROM ruby:3.4
 RUN apt-get update && apt-get install build-essential libclang-dev -y && apt-get clean && rm -rf /var/lib/apt/lists/*
 RUN curl https://sh.rustup.rs -sSf | sh -s -- -y
 
-COPY pkg/itsi-server-0.2.23.gem .
-RUN gem install itsi-server-0.2.23.gem
+COPY pkg/itsi-server-0.2.24.gem .
+RUN gem install itsi-server-0.2.24.gem
 
 CMD ["itsi", "serve"]

data/crates/itsi_scheduler/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "itsi-scheduler"
-version = "0.2.23"
+version = "0.2.24"
 edition = "2021"
 authors = ["Wouter Coppieters <wc@pico.net.nz>"]
 license = "MIT"

data/crates/itsi_server/Cargo.lock

@@ -984,7 +984,7 @@ checksum = "d75a2a4b1b190afb6f5425f10f6a8f959d2ea0b9c2b1d79553551850539e4674"
 
 [[package]]
 name = "itsi-scheduler"
-version = "0.2.23"
+version = "0.2.24"
 dependencies = [
  "bytes",
  "derive_more",
@@ -1002,7 +1002,7 @@ dependencies = [
 
 [[package]]
 name = "itsi-server"
-version = "0.2.23"
+version = "0.2.24"
 dependencies = [
  "async-channel",
  "async-trait",

data/crates/itsi_server/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "itsi-server"
-version = "0.2.23"
+version = "0.2.24"
 edition = "2021"
 authors = ["Wouter Coppieters <wc@pico.net.nz>"]
 license = "MIT"

data/crates/itsi_server/src/server/binds/listener.rs

@@ -14,12 +14,13 @@ use std::fmt::Display;
 use std::net::{IpAddr, SocketAddr, TcpListener};
 use std::os::fd::{AsRawFd, FromRawFd, RawFd};
 use std::sync::Arc;
+use std::time::Duration;
 use std::{os::unix::net::UnixListener, path::PathBuf};
 use tokio::net::TcpListener as TokioTcpListener;
 use tokio::net::UnixListener as TokioUnixListener;
 use tokio::net::{unix, TcpStream, UnixStream};
 use tokio::sync::watch::Receiver;
-use tokio_rustls::TlsAcceptor;
+use tokio::time::timeout;
 use tokio_stream::StreamExt;
 
 pub(crate) enum Listener {
@@ -93,7 +94,7 @@ impl TokioListener {
         }
     }
 
-    pub(crate) async fn accept(&self) -> Result<IoStream> {
+    pub(crate) async fn accept(&self) -> Result<AcceptedStream> {
         match self {
             TokioListener::Tcp(listener) => TokioListener::accept_tcp(listener).await,
             TokioListener::TcpTls(listener, acceptor) => {
@@ -106,9 +107,11 @@ impl TokioListener {
         }
     }
 
-    async fn accept_tcp(listener: &TokioTcpListener) -> Result<IoStream> {
+    async fn accept_tcp(listener: &TokioTcpListener) -> Result<AcceptedStream> {
         let tcp_stream = listener.accept().await?;
-        Self::to_tokio_io(Stream::TcpStream(tcp_stream), None).await
+        Ok(AcceptedStream::Ready(Self::to_plain_io(Stream::TcpStream(
+            tcp_stream,
+        ))))
     }
 
     pub async fn spawn_acme_event_task(&self, mut shutdown_receiver: Receiver<RunningPhase>) {
@@ -137,89 +140,131 @@ impl TokioListener {
     async fn accept_tls(
         listener: &TokioTcpListener,
         acceptor: &ItsiTlsAcceptor,
-    ) -> Result<IoStream> {
-        let tcp_stream = listener.accept().await?;
-        match acceptor {
-            ItsiTlsAcceptor::Manual(tls_acceptor) => {
-                Self::to_tokio_io(Stream::TcpStream(tcp_stream), Some(tls_acceptor)).await
-            }
-            ItsiTlsAcceptor::Automatic(acme_acceptor, _, rustls_config) => {
-                let accept_future = acme_acceptor.accept(tcp_stream.0);
-                match accept_future.await {
-                    Ok(None) => Err(ItsiError::Pass),
-                    Ok(Some(start_handshake)) => {
-                        let tls_stream = start_handshake.into_stream(rustls_config.clone()).await?;
-                        Ok(IoStream::TcpTls {
-                            stream: tls_stream,
-                            addr: SockAddr::Tcp(Arc::new(tcp_stream.1)),
-                        })
-                    }
-                    Err(error) => {
-                        error!(error = format!("{:?}", error));
-                        Err(ItsiError::Pass)
-                    }
-                }
-            }
-        }
+    ) -> Result<AcceptedStream> {
+        let (stream, addr) = listener.accept().await?;
+        Ok(AcceptedStream::TcpTls {
+            stream,
+            addr,
+            acceptor: acceptor.clone(),
+        })
     }
 
-    async fn accept_unix(listener: &TokioUnixListener) -> Result<IoStream> {
+    async fn accept_unix(listener: &TokioUnixListener) -> Result<AcceptedStream> {
         let unix_stream = listener.accept().await?;
-        Self::to_tokio_io(Stream::UnixStream(unix_stream), None).await
+        Ok(AcceptedStream::Ready(Self::to_plain_io(
+            Stream::UnixStream(unix_stream),
+        )))
     }
 
     async fn accept_unix_tls(
         listener: &TokioUnixListener,
         acceptor: &ItsiTlsAcceptor,
-    ) -> Result<IoStream> {
-        let unix_stream = listener.accept().await?;
-        match acceptor {
-            ItsiTlsAcceptor::Manual(tls_acceptor) => {
-                Self::to_tokio_io(Stream::UnixStream(unix_stream), Some(tls_acceptor)).await
-            }
-            ItsiTlsAcceptor::Automatic(_, _, _) => {
-                error!("Automatic TLS not supported on Unix sockets");
-                Err(ItsiError::UnsupportedProtocol(
-                    "Automatic TLS on Unix Sockets".to_owned(),
-                ))
-            }
+    ) -> Result<AcceptedStream> {
+        let (stream, addr) = listener.accept().await?;
+        Ok(AcceptedStream::UnixTls {
+            stream,
+            addr,
+            acceptor: acceptor.clone(),
+        })
+    }
+
+    fn to_plain_io(input_stream: Stream) -> IoStream {
+        match input_stream {
+            Stream::TcpStream((tcp_stream, socket_address)) => IoStream::Tcp {
+                stream: tcp_stream,
+                addr: SockAddr::Tcp(Arc::new(socket_address)),
+            },
+            Stream::UnixStream((unix_stream, socket_address)) => IoStream::Unix {
+                stream: unix_stream,
+                addr: SockAddr::Unix(Arc::new(socket_address)),
+            },
         }
     }
+}
 
-    async fn to_tokio_io(
-        input_stream: Stream,
-        tls_acceptor: Option<&TlsAcceptor>,
-    ) -> Result<IoStream> {
-        match tls_acceptor {
-            Some(acceptor) => match input_stream {
-                Stream::TcpStream((tcp_stream, socket_address)) => {
-                    match acceptor.accept(tcp_stream).await {
-                        Ok(tls_stream) => Ok(IoStream::TcpTls {
+pub(crate) enum AcceptedStream {
+    Ready(IoStream),
+    TcpTls {
+        stream: TcpStream,
+        addr: SocketAddr,
+        acceptor: ItsiTlsAcceptor,
+    },
+    UnixTls {
+        stream: UnixStream,
+        addr: unix::SocketAddr,
+        acceptor: ItsiTlsAcceptor,
+    },
+}
+
+impl AcceptedStream {
+    pub(crate) async fn into_io_stream(self, handshake_timeout: Duration) -> Result<IoStream> {
+        match self {
+            AcceptedStream::Ready(stream) => Ok(stream),
+            AcceptedStream::TcpTls {
+                stream,
+                addr,
+                acceptor,
+            } => match acceptor {
+                ItsiTlsAcceptor::Manual(tls_acceptor) => {
+                    match timeout(handshake_timeout, tls_acceptor.accept(stream)).await {
+                        Ok(Ok(tls_stream)) => Ok(IoStream::TcpTls {
                             stream: tls_stream,
-                            addr: SockAddr::Tcp(Arc::new(socket_address)),
+                            addr: SockAddr::Tcp(Arc::new(addr)),
                         }),
-                        Err(err) => Err(err.into()),
+                        Ok(Err(error)) => Err(error.into()),
+                        Err(_) => Err(ItsiError::Pass),
                     }
                 }
-                Stream::UnixStream((unix_stream, socket_address)) => {
-                    match acceptor.accept(unix_stream).await {
-                        Ok(tls_stream) => Ok(IoStream::UnixTls {
+                ItsiTlsAcceptor::Automatic(acme_acceptor, _, rustls_config) => {
+                    let accept_future = acme_acceptor.accept(stream);
+                    match timeout(handshake_timeout, accept_future).await {
+                        Err(_) => Err(ItsiError::Pass),
+                        Ok(accept_result) => match accept_result {
+                            Ok(None) => Err(ItsiError::Pass),
+                            Ok(Some(start_handshake)) => {
+                                match timeout(
+                                    handshake_timeout,
+                                    start_handshake.into_stream(rustls_config.clone()),
+                                )
+                                .await
+                                {
+                                    Ok(Ok(tls_stream)) => Ok(IoStream::TcpTls {
+                                        stream: tls_stream,
+                                        addr: SockAddr::Tcp(Arc::new(addr)),
+                                    }),
+                                    Ok(Err(error)) => Err(error.into()),
+                                    Err(_) => Err(ItsiError::Pass),
+                                }
+                            }
+                            Err(error) => {
+                                error!(error = format!("{:?}", error));
+                                Err(ItsiError::Pass)
+                            }
+                        },
+                    }
+                }
+            },
+            AcceptedStream::UnixTls {
+                stream,
+                addr,
+                acceptor,
+            } => match acceptor {
+                ItsiTlsAcceptor::Manual(tls_acceptor) => {
+                    match timeout(handshake_timeout, tls_acceptor.accept(stream)).await {
+                        Ok(Ok(tls_stream)) => Ok(IoStream::UnixTls {
                             stream: tls_stream,
-                            addr: SockAddr::Unix(Arc::new(socket_address)),
+                            addr: SockAddr::Unix(Arc::new(addr)),
                         }),
-                        Err(err) => Err(err.into()),
+                        Ok(Err(error)) => Err(error.into()),
+                        Err(_) => Err(ItsiError::Pass),
                     }
                 }
-            },
-            None => match input_stream {
-                Stream::TcpStream((tcp_stream, socket_address)) => Ok(IoStream::Tcp {
-                    stream: tcp_stream,
-                    addr: SockAddr::Tcp(Arc::new(socket_address)),
-                }),
-                Stream::UnixStream((unix_stream, socket_address)) => Ok(IoStream::Unix {
-                    stream: unix_stream,
-                    addr: SockAddr::Unix(Arc::new(socket_address)),
-                }),
+                ItsiTlsAcceptor::Automatic(_, _, _) => {
+                    error!("Automatic TLS not supported on Unix sockets");
+                    Err(ItsiError::UnsupportedProtocol(
+                        "Automatic TLS on Unix Sockets".to_owned(),
+                    ))
+                }
             },
         }
     }

data/crates/itsi_server/src/server/serve_strategy/acceptor.rs

@@ -1,11 +1,15 @@
 use hyper_util::rt::TokioIo;
-use std::{ops::Deref, pin::Pin, sync::Arc, time::Duration};
+use std::{future::Future, ops::Deref, pin::Pin, sync::Arc, time::Duration};
 use tokio::task::JoinSet;
 use tracing::debug;
 
 use crate::{
     ruby_types::itsi_server::itsi_server_config::ServerParams,
-    server::{binds::listener::ListenerInfo, io_stream::IoStream, request_job::RequestJob},
+    server::{
+        binds::listener::{AcceptedStream, ListenerInfo},
+        io_stream::IoStream,
+        request_job::RequestJob,
+    },
     services::itsi_http_service::{ItsiHttpService, ItsiHttpServiceInner},
 };
 
@@ -34,19 +38,39 @@ pub struct AcceptorArgs {
 }
 
 impl Acceptor {
-    pub(crate) async fn serve_connection(&mut self, stream: IoStream) {
-        let addr = stream.addr();
-        let io: TokioIo<Pin<Box<IoStream>>> = TokioIo::new(Box::pin(stream));
+    pub(crate) async fn serve_accepted_connection(
+        &mut self,
+        stream: AcceptedStream,
+        tls_handshake_timeout: Duration,
+    ) {
+        self.spawn_connection(async move { stream.into_io_stream(tls_handshake_timeout).await });
+    }
+
+    fn spawn_connection<F>(&mut self, stream_future: F)
+    where
+        F: Future<Output = itsi_error::Result<IoStream>> + Send + 'static,
+    {
         let mut shutdown_channel = self.shutdown_receiver.clone();
         let acceptor_args = self.acceptor_args.clone();
-        let service = ItsiHttpService {
-            inner: Arc::new(ItsiHttpServiceInner {
-                acceptor_args: acceptor_args.clone(),
-                addr,
-            }),
-        };
 
         self.join_set.spawn(async move {
+            let stream = match stream_future.await {
+                Ok(stream) => stream,
+                Err(error) => {
+                    debug!("Connection setup failed: {:?}", error);
+                    return;
+                }
+            };
+
+            let addr = stream.addr();
+            let io: TokioIo<Pin<Box<IoStream>>> = TokioIo::new(Box::pin(stream));
+            let service = ItsiHttpService {
+                inner: Arc::new(ItsiHttpServiceInner {
+                    acceptor_args: acceptor_args.clone(),
+                    addr,
+                }),
+            };
+
             let executor = &acceptor_args.strategy.executor;
             let svc = hyper::service::service_fn(move |req| {
                 let service = service.clone();

data/crates/itsi_server/src/server/serve_strategy/single_mode.rs

@@ -314,6 +314,7 @@ impl SingleMode {
 
                 let shutdown_rx_for_acme_task = shutdown_receiver.clone();
                 let acme_task_listener_clone = listener.clone();
+                let tls_handshake_timeout = server_params.header_read_timeout;
 
                 let mut after_accept_wait: Option<Duration> = None::<Duration>;
 
@@ -337,7 +338,7 @@ impl SingleMode {
                         tokio::select! {
                             accept_result = listener.accept() => {
                                 match accept_result {
-                                    Ok(accepted) => acceptor.serve_connection(accepted).await,
+                                    Ok(accepted) => acceptor.serve_accepted_connection(accepted, tls_handshake_timeout).await,
                                     Err(e) => debug!("Listener.accept failed: {:?}", e)
                                 }
                                 if cfg!(target_os = "macos") {

data/gems/scheduler/Cargo.lock

@@ -211,7 +211,7 @@ checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
 
 [[package]]
 name = "itsi-scheduler"
-version = "0.2.23"
+version = "0.2.24"
 dependencies = [
  "bytes",
  "derive_more",

data/gems/scheduler/lib/itsi/scheduler/version.rb

@@ -2,6 +2,6 @@
 
 module Itsi
   class Scheduler
-    VERSION = "0.2.23"
+    VERSION = "0.2.24"
   end
 end

data/gems/server/Cargo.lock

@@ -1660,9 +1660,27 @@ version = "1.0.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
 
+[[package]]
+name = "itsi-scheduler"
+version = "0.2.24"
+dependencies = [
+ "bytes",
+ "derive_more",
+ "itsi_error",
+ "itsi_instrument_entry",
+ "itsi_rb_helpers",
+ "itsi_tracing",
+ "magnus",
+ "mio",
+ "nix",
+ "parking_lot",
+ "rb-sys",
+ "tracing",
+]
+
 [[package]]
 name = "itsi-server"
-version = "0.2.23"
+version = "0.2.24"
 dependencies = [
  "argon2",
  "async-channel",
@@ -1772,6 +1790,15 @@ dependencies = [
  "thiserror 2.0.12",
 ]
 
+[[package]]
+name = "itsi_instrument_entry"
+version = "0.1.0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
 [[package]]
 name = "itsi_rb_helpers"
 version = "0.1.0"

data/gems/server/lib/itsi/server/version.rb

@@ -2,6 +2,6 @@
 
 module Itsi
   class Server
-    VERSION = "0.2.23"
+    VERSION = "0.2.24"
   end
 end

data/gems/server/test/helpers/test_helper.rb

@@ -8,6 +8,7 @@ require "itsi/server"
 require "itsi/scheduler"
 require "socket"
 require "net/http"
+require "openssl"
 require "minitest/autorun"
 
 Minitest::Reporters.use! Minitest::Reporters::SpecReporter.new
@@ -157,6 +158,7 @@ class RequestContext
         @uri.host,
         @uri.port,
         use_ssl: @uri.scheme == "https",
+        verify_mode: OpenSSL::SSL::VERIFY_NONE,
         **opts
       )
     end

data/gems/server/test/options/tls_handshake_timeout.rb

@@ -0,0 +1,19 @@
+require_relative "../helpers/test_helper"
+
+class TestTlsHandshakeTimeout < Minitest::Test
+  def test_incomplete_tls_handshake_does_not_block_listener_indefinitely
+    server(
+      protocol: "https",
+      itsi_rb: lambda do
+        header_read_timeout 5.0
+        get("/ok") { |r| r.ok "ok" }
+      end
+    ) do
+      socket = TCPSocket.new("127.0.0.1", @uri.port)
+
+      assert_equal "ok", get("/ok")
+    ensure
+      socket&.close
+    end
+  end
+end

data/lib/itsi/version.rb

@@ -1,3 +1,3 @@
 module Itsi
-  VERSION = "0.2.23"
+  VERSION = "0.2.24"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: itsi
 version: !ruby/object:Gem::Version
-  version: 0.2.23
+  version: 0.2.24
 platform: ruby
 authors:
 - Wouter Coppieters
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.2.23
+        version: 0.2.24
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.2.23
+        version: 0.2.24
 - !ruby/object:Gem::Dependency
   name: itsi-server
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.2.23
+        version: 0.2.24
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.2.23
+        version: 0.2.24
 description: Wrapper Gem for both the Itsi server and the Itsi Fiber scheduler
 email:
 - wc@pico.net.nz
@@ -1139,6 +1139,7 @@ files:
 - gems/server/test/options/test_request_timeout.rb
 - gems/server/test/options/test_threads.rb
 - gems/server/test/options/test_workers.rb
+- gems/server/test/options/tls_handshake_timeout.rb
 - gems/server/test/options/unmatched_request.rb
 - gems/server/test/rack/test_rack_server.rb
 - gems/server/vendor/rb-sys-build/.cargo-ok