itsi 0.2.26 → 0.2.27.rc1

data/crates/itsi_acme/src/state.rs

@@ -20,8 +20,9 @@ use x509_parser::parse_x509_certificate;
 
 use crate::acceptor::AcmeAcceptor;
 use crate::acme::{
-    Account, AcmeError, Auth, AuthStatus, Directory, Identifier, Order, OrderStatus,
+    Account, AcmeError, Auth, AuthStatus, Challenge, Directory, Identifier, Order, OrderStatus,
 };
+use crate::http_challenge::Http01Handler;
 use crate::{AcmeConfig, Incoming, ResolvesServerCertAcme};
 
 type Timer = std::pin::Pin<Box<Sleep>>;
@@ -36,6 +37,9 @@ pub struct AcmeState<EC: Debug = Infallible, EA: Debug = EC> {
     config: Arc<AcmeConfig<EC, EA>>,
     resolver: Arc<ResolvesServerCertAcme>,
     account_key: Option<Vec<u8>>,
+    http01_handler: Arc<Http01Handler>,
+    http01_enabled: bool,
+    managed_domain: Option<String>,
 
     early_action: Option<BoxFuture<Event<EC, EA>>>,
     load_cert: Option<BoxFuture<Result<Option<Vec<u8>>, EC>>>,
@@ -128,12 +132,29 @@ impl<EC: 'static + Debug, EA: 'static + Debug> AcmeState<EC, EA> {
     pub fn resolver(&self) -> Arc<ResolvesServerCertAcme> {
         self.resolver.clone()
     }
+    pub fn http01_handler(&self) -> Arc<Http01Handler> {
+        self.http01_handler.clone()
+    }
+    pub fn set_http01_enabled(&mut self, enabled: bool) {
+        self.http01_enabled = enabled;
+    }
     pub fn new(config: AcmeConfig<EC, EA>) -> Self {
+        Self::new_with_resolver(config, ResolvesServerCertAcme::new(), Arc::new(Http01Handler::new()), None)
+    }
+    pub fn new_with_resolver(
+        config: AcmeConfig<EC, EA>,
+        resolver: Arc<ResolvesServerCertAcme>,
+        http01_handler: Arc<Http01Handler>,
+        managed_domain: Option<String>,
+    ) -> Self {
         let config = Arc::new(config);
         Self {
             config: config.clone(),
-            resolver: ResolvesServerCertAcme::new(),
+            resolver,
             account_key: None,
+            http01_handler,
+            http01_enabled: false,
+            managed_domain,
             early_action: None,
             load_cert: Some(Box::pin({
                 let config = config.clone();
@@ -195,7 +216,11 @@ impl<EC: 'static + Debug, EA: 'static + Debug> AcmeState<EC, EA> {
                 }
             }
         };
-        self.resolver.set_cert(Arc::new(cert));
+        let cert = Arc::new(cert);
+        match self.managed_domain.as_ref() {
+            Some(domain) => self.resolver.set_cert_for_domain(domain.clone(), cert),
+            None => self.resolver.set_cert(cert),
+        }
         let wait_duration = (validity[1] - (validity[1] - validity[0]) / 3 - Utc::now())
             .max(chrono::Duration::zero())
             .to_std()
@@ -220,6 +245,8 @@ impl<EC: 'static + Debug, EA: 'static + Debug> AcmeState<EC, EA> {
     async fn order(
         config: Arc<AcmeConfig<EC, EA>>,
         resolver: Arc<ResolvesServerCertAcme>,
+        http01_handler: Arc<Http01Handler>,
+        http01_enabled: bool,
         key_pair: Vec<u8>,
     ) -> Result<Vec<u8>, OrderError> {
         let directory = Directory::discover(&config.client_config, &config.directory_url).await?;
@@ -242,10 +269,16 @@ impl<EC: 'static + Debug, EA: 'static + Debug> AcmeState<EC, EA> {
         loop {
             match order.status {
                 OrderStatus::Pending => {
-                    let auth_futures = order
-                        .authorizations
-                        .iter()
-                        .map(|url| Self::authorize(&config, &resolver, &account, url));
+                    let auth_futures = order.authorizations.iter().map(|url| {
+                        Self::authorize(
+                            &config,
+                            &resolver,
+                            &http01_handler,
+                            http01_enabled,
+                            &account,
+                            url,
+                        )
+                    });
                     try_join_all(auth_futures).await?;
                     log::info!("completed all authorizations");
                     order = account.order(&config.client_config, &order_url).await?;
@@ -289,40 +322,147 @@ impl<EC: 'static + Debug, EA: 'static + Debug> AcmeState<EC, EA> {
     async fn authorize(
         config: &AcmeConfig<EC, EA>,
         resolver: &ResolvesServerCertAcme,
+        http01_handler: &Http01Handler,
+        http01_enabled: bool,
         account: &Account,
         url: &String,
     ) -> Result<(), OrderError> {
         let auth = account.auth(&config.client_config, url).await?;
-        let (domain, challenge_url) = match auth.status {
+        let (domain, challenges) = match auth.status {
             AuthStatus::Pending => {
                 let Identifier::Dns(domain) = auth.identifier;
-                log::info!("trigger challenge for {}", &domain);
+                (domain, auth.challenges)
+            }
+            AuthStatus::Valid => return Ok(()),
+            _ => return Err(OrderError::BadAuth(auth)),
+        };
+
+        log::info!("trigger challenge for {}", &domain);
+
+        let primary = if http01_enabled {
+            ChallengeKind::Http01
+        } else {
+            ChallengeKind::TlsAlpn01
+        };
+        let secondary = match primary {
+            ChallengeKind::Http01 => ChallengeKind::TlsAlpn01,
+            ChallengeKind::TlsAlpn01 => ChallengeKind::Http01,
+        };
+
+        match Self::attempt_authorization(
+            config,
+            resolver,
+            http01_handler,
+            account,
+            &domain,
+            url,
+            &challenges,
+            primary,
+        )
+        .await?
+        {
+            AttemptOutcome::Validated => return Ok(()),
+            AttemptOutcome::Unavailable | AttemptOutcome::RetryableFailure => {}
+        }
+
+        match Self::attempt_authorization(
+            config,
+            resolver,
+            http01_handler,
+            account,
+            &domain,
+            url,
+            &challenges,
+            secondary,
+        )
+        .await?
+        {
+            AttemptOutcome::Validated => Ok(()),
+            AttemptOutcome::Unavailable | AttemptOutcome::RetryableFailure => {
+                Err(OrderError::TooManyAttemptsAuth(domain))
+            }
+        }
+    }
+
+    async fn attempt_authorization(
+        config: &AcmeConfig<EC, EA>,
+        resolver: &ResolvesServerCertAcme,
+        http01_handler: &Http01Handler,
+        account: &Account,
+        domain: &str,
+        auth_url: &str,
+        challenges: &[Challenge],
+        kind: ChallengeKind,
+    ) -> Result<AttemptOutcome, OrderError> {
+        match kind {
+            ChallengeKind::TlsAlpn01 => {
                 let (challenge, auth_key) =
-                    account.tls_alpn_01(&auth.challenges, domain.clone())?;
-                resolver.set_auth_key(domain.clone(), Arc::new(auth_key));
+                    match account.tls_alpn_01(challenges, domain.to_string()) {
+                        Ok(value) => value,
+                        Err(AcmeError::NoTlsAlpn01Challenge) => {
+                            return Ok(AttemptOutcome::Unavailable);
+                        }
+                        Err(error) => return Err(OrderError::Acme(error)),
+                    };
+
+                resolver.set_auth_key(domain.to_string(), Arc::new(auth_key));
                 account
                     .challenge(&config.client_config, &challenge.url)
                     .await?;
-                (domain, challenge.url.clone())
+                let outcome =
+                    Self::poll_authorization(config, account, domain, auth_url, &challenge.url)
+                        .await?;
+                resolver.remove_auth_key(domain);
+                Ok(outcome)
             }
-            AuthStatus::Valid => return Ok(()),
-            _ => return Err(OrderError::BadAuth(auth)),
-        };
+            ChallengeKind::Http01 => {
+                let (challenge, key_authorization) = match account.http_01(challenges) {
+                    Ok(value) => value,
+                    Err(AcmeError::NoHttp01Challenge) => return Ok(AttemptOutcome::Unavailable),
+                    Err(error) => return Err(OrderError::Acme(error)),
+                };
+                let token = challenge
+                    .token
+                    .clone()
+                    .ok_or(OrderError::Acme(AcmeError::MissingChallengeToken))?;
+
+                http01_handler.add_challenge(token.clone(), key_authorization);
+                account
+                    .challenge(&config.client_config, &challenge.url)
+                    .await?;
+                let outcome =
+                    Self::poll_authorization(config, account, domain, auth_url, &challenge.url)
+                        .await?;
+                http01_handler.remove_challenge(&token);
+                Ok(outcome)
+            }
+        }
+    }
+
+    async fn poll_authorization(
+        config: &AcmeConfig<EC, EA>,
+        account: &Account,
+        domain: &str,
+        auth_url: &str,
+        challenge_url: &str,
+    ) -> Result<AttemptOutcome, OrderError> {
         for i in 0u64..5 {
             after(Duration::from_secs(1u64 << i)).await;
-            let auth = account.auth(&config.client_config, url).await?;
+            let auth = account.auth(&config.client_config, auth_url).await?;
             match auth.status {
                 AuthStatus::Pending => {
-                    log::info!("authorization for {} still pending", &domain);
+                    log::info!("authorization for {} still pending", domain);
                     account
-                        .challenge(&config.client_config, &challenge_url)
-                        .await?
+                        .challenge(&config.client_config, challenge_url)
+                        .await?;
                 }
-                AuthStatus::Valid => return Ok(()),
+                AuthStatus::Valid => return Ok(AttemptOutcome::Validated),
+                AuthStatus::Invalid => return Ok(AttemptOutcome::RetryableFailure),
                 _ => return Err(OrderError::BadAuth(auth)),
             }
         }
-        Err(OrderError::TooManyAttemptsAuth(domain))
+
+        Ok(AttemptOutcome::RetryableFailure)
     }
     fn poll_next_infinite(mut self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Event<EC, EA>> {
         loop {
@@ -408,13 +548,34 @@ impl<EC: 'static + Debug, EA: 'static + Debug> AcmeState<EC, EA> {
             };
             let config = self.config.clone();
             let resolver = self.resolver.clone();
+            let http01_handler = self.http01_handler.clone();
+            let http01_enabled = self.http01_enabled;
             self.order = Some(Box::pin({
-                Self::order(config.clone(), resolver.clone(), account_key)
+                Self::order(
+                    config.clone(),
+                    resolver.clone(),
+                    http01_handler,
+                    http01_enabled,
+                    account_key,
+                )
             }));
         }
     }
 }
 
+#[derive(Clone, Copy, Debug)]
+enum ChallengeKind {
+    Http01,
+    TlsAlpn01,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+enum AttemptOutcome {
+    Validated,
+    RetryableFailure,
+    Unavailable,
+}
+
 impl<EC: 'static + Debug, EA: 'static + Debug> Stream for AcmeState<EC, EA> {
     type Item = Event<EC, EA>;
 

data/crates/itsi_scheduler/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "itsi-scheduler"
-version = "0.2.26"
+version = "0.2.27-rc1"
 edition = "2021"
 authors = ["Wouter Coppieters <wc@pico.net.nz>"]
 license = "MIT"

data/crates/itsi_scheduler/src/itsi_scheduler.rs

@@ -4,22 +4,19 @@ mod timer;
 use io_helpers::{build_interest, poll_readiness, set_nonblocking};
 use io_waiter::IoWaiter;
 use itsi_error::ItsiError;
-use itsi_rb_helpers::{call_without_gvl, create_ruby_thread};
-use magnus::{
-    error::Result as MagnusResult,
-    value::{InnerValue, Lazy, LazyId, Opaque, ReprValue},
-    Module, RClass, Ruby, Value,
-};
+use itsi_rb_helpers::call_without_gvl;
+use magnus::{error::Result as MagnusResult, Ruby};
 use mio::{Events, Poll, Token, Waker};
-use parking_lot::{Mutex, RwLock};
+use parking_lot::Mutex;
 use std::{
     collections::{BinaryHeap, HashMap, VecDeque},
+    ffi::CString,
     os::fd::RawFd,
-    sync::Arc,
+    ptr,
     time::Duration,
 };
 use timer::Timer;
-use tracing::{debug, error, info, warn};
+use tracing::{debug, info, warn};
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash)]
 pub(crate) struct Readiness(i16);
@@ -31,9 +28,6 @@ impl std::fmt::Debug for ItsiScheduler {
 }
 
 const WAKE_TOKEN: Token = Token(0);
-static ID_CURRENT: LazyId = LazyId::new("current");
-static CLASS_FIBER: Lazy<RClass> =
-    Lazy::new(|ruby| ruby.module_kernel().const_get("Fiber").unwrap());
 
 #[magnus::wrap(class = "Itsi::Scheduler", free_immediately, size)]
 pub(crate) struct ItsiScheduler {
@@ -123,6 +117,57 @@ impl ItsiScheduler {
         self.timers.lock().retain(|timer| timer.token.0 != token);
     }
 
+    pub fn cancel_wait(&self, token: usize) -> MagnusResult<()> {
+        let token = Token(token);
+
+        self.timers.lock().retain(|timer| timer.token != token);
+
+        let mut io_waiters = self.io_waiters.lock();
+        let Some(mut waiter) = io_waiters.remove(&token) else {
+            return Ok(());
+        };
+
+        let mut registry = self.registry.lock();
+        let Some(queue) = registry.get_mut(&waiter.fd) else {
+            return Ok(());
+        };
+
+        let Some(position) = queue.iter().position(|entry| entry.token == token) else {
+            return Ok(());
+        };
+
+        if position == 0 {
+            self.poll
+                .lock()
+                .registry()
+                .deregister(&mut waiter)
+                .map_err(|_| {
+                    ItsiError::ArgumentError("Failed to deregister".to_string())
+                })?;
+        }
+
+        queue.remove(position);
+
+        if position == 0 {
+            if let Some(head) = queue.get_mut(0) {
+                let interest = build_interest(head.readiness)?;
+                self.poll
+                    .lock()
+                    .registry()
+                    .register(head, head.token, interest)
+                    .map_err(|_| {
+                        ItsiError::ArgumentError("Failed to register".to_string())
+                    })?;
+            }
+        }
+
+        if queue.is_empty() {
+            registry.remove(&waiter.fd);
+        }
+
+        Ok(())
+    }
+
     pub fn has_pending_io(&self) -> bool {
         !self.timers.lock().is_empty() || !self.io_waiters.lock().is_empty()
     }
@@ -220,63 +265,69 @@ impl ItsiScheduler {
         })
     }
 
-    pub fn run_blocking_in_thread<T, F>(&self, ruby: &Ruby, work: F) -> MagnusResult<Option<T>>
-    where
-        T: Send + Sync + std::fmt::Debug + 'static,
-        F: FnOnce() -> Option<T> + Send + 'static,
-    {
-        let result: Arc<RwLock<Option<T>>> = Arc::new(RwLock::new(None));
-        let result_clone = Arc::clone(&result);
-
-        let class_fiber = ruby.get_inner(&CLASS_FIBER);
-        let current_fiber = ruby
-            .get_inner(&CLASS_FIBER)
-            .funcall::<_, _, Value>(*ID_CURRENT, ());
-
-        if current_fiber.is_err() {
-            error!("Failed to get current fiber");
-            return Err(ItsiError::ArgumentError("Failed to get current fiber".to_string()).into());
-        }
-        let current_fiber = Opaque::from(current_fiber.unwrap());
-        let scheduler = Opaque::from(class_fiber.funcall::<_, _, Value>("scheduler", ()).unwrap());
-
-        create_ruby_thread(move || {
-            call_without_gvl(|| {
-                let outcome = work();
-                *result_clone.write() = outcome;
-            });
-
-            let ruby = Ruby::get().unwrap();
-            scheduler
-                .get_inner_with(&ruby)
-                .funcall::<_, _, Value>("unblock", (None::<String>, current_fiber))
-                .unwrap();
-        });
-
-        scheduler
-            .get_inner_with(ruby)
-            .funcall::<_, _, Value>("block", (None::<Value>, None::<u64>))?;
-
-        let result_opt = Arc::try_unwrap(result).unwrap().write().take();
-        Ok(result_opt)
-    }
-
     pub fn address_resolve(
-        ruby: &Ruby,
-        rself: &Self,
+        _ruby: &Ruby,
+        _rself: &Self,
         hostname: String,
     ) -> MagnusResult<Option<Vec<String>>> {
-        let result: Option<Vec<String>> = rself.run_blocking_in_thread(ruby, move || {
-            use std::net::ToSocketAddrs;
-            let addrs_res = (hostname.as_str(), 0).to_socket_addrs();
-            match addrs_res {
-                Ok(addrs) => {
-                    let ips: Vec<String> = addrs.map(|s| s.ip().to_string()).collect();
-                    Some(ips)
+        let result: Option<Vec<String>> = call_without_gvl(move || {
+            let hostname = CString::new(hostname).ok()?;
+            let hints = nix::libc::addrinfo {
+                ai_flags: 0,
+                ai_family: nix::libc::AF_UNSPEC,
+                ai_socktype: nix::libc::SOCK_STREAM,
+                ai_protocol: 0,
+                ai_addrlen: 0,
+                ai_addr: ptr::null_mut(),
+                ai_canonname: ptr::null_mut(),
+                ai_next: ptr::null_mut(),
+            };
+            let mut res: *mut nix::libc::addrinfo = ptr::null_mut();
+            let rc = unsafe {
+                nix::libc::getaddrinfo(hostname.as_ptr(), ptr::null(), &hints, &mut res)
+            };
+            if rc != 0 || res.is_null() {
+                return None;
+            }
+
+            let mut ips = Vec::new();
+            let mut current = res;
+            while !current.is_null() {
+                let ai = unsafe { &*current };
+                if !ai.ai_addr.is_null() {
+                    match ai.ai_family {
+                        nix::libc::AF_INET => {
+                            let addr = unsafe {
+                                &*(ai.ai_addr as *const nix::libc::sockaddr_in)
+                            };
+                            let ip = std::net::Ipv4Addr::from(u32::from_be(addr.sin_addr.s_addr));
+                            ips.push(ip.to_string());
+                        }
+                        nix::libc::AF_INET6 => {
+                            let addr = unsafe {
+                                &*(ai.ai_addr as *const nix::libc::sockaddr_in6)
+                            };
+                            let ip = std::net::Ipv6Addr::from(addr.sin6_addr.s6_addr);
+                            ips.push(ip.to_string());
+                        }
+                        _ => {}
+                    }
                 }
-                Err(_) => None,
+                current = ai.ai_next;
             }
-        })?;
+
+            unsafe {
+                nix::libc::freeaddrinfo(res);
+            }
+
+            if ips.is_empty() {
+                None
+            } else {
+                ips.sort();
+                ips.dedup();
+                Some(ips)
+            }
+        });
         Ok(result)
     }
 

data/crates/itsi_scheduler/src/lib.rs

@@ -20,8 +20,9 @@ fn init(ruby: &Ruby) -> Result<(), Error> {
     scheduler.define_method("warn", method!(ItsiScheduler::warn, 1))?;
     scheduler.define_method("start_timer", method!(ItsiScheduler::start_timer, 2))?;
     scheduler.define_method("clear_timer", method!(ItsiScheduler::clear_timer, 1))?;
+    scheduler.define_method("cancel_wait", method!(ItsiScheduler::cancel_wait, 1))?;
     scheduler.define_method(
-        "address_resolve",
+        "native_address_resolve",
         method!(ItsiScheduler::address_resolve, 1),
     )?;
     scheduler.define_method("has_pending_io?", method!(ItsiScheduler::has_pending_io, 0))?;

data/crates/itsi_server/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "itsi-server"
-version = "0.2.26"
+version = "0.2.27-rc1"
 edition = "2021"
 authors = ["Wouter Coppieters <wc@pico.net.nz>"]
 license = "MIT"
@@ -70,6 +70,7 @@ redis = { version = "0.29.2", features = [
 ] }
 rustls = "0.23.23"
 rustls-pemfile = "2.2.0"
+webpki-roots = "0.26"
 serde = "1.0.219"
 serde_json = "1.0.140"
 serde_magnus = "0.11.0"

data/crates/itsi_server/src/lib.rs

@@ -41,6 +41,20 @@ fn init(ruby: &Ruby) -> Result<()> {
     server.define_singleton_method("reset_signal_handlers", function!(reset_signal_handlers, 0))?;
     server.define_method("start", method!(ItsiServer::start, 0))?;
     server.define_method("stop", method!(ItsiServer::stop, 0))?;
+    server.define_method("tls_bindings", method!(ItsiServer::tls_bindings, 0))?;
+    server.define_method("tls_domains", method!(ItsiServer::tls_domains, 1))?;
+    server.define_method(
+        "tls_domain_statuses",
+        method!(ItsiServer::tls_domain_statuses, 1),
+    )?;
+    server.define_method(
+        "register_tls_domain",
+        method!(ItsiServer::register_tls_domain, 2),
+    )?;
+    server.define_method(
+        "unregister_tls_domain",
+        method!(ItsiServer::unregister_tls_domain, 2),
+    )?;
 
     let request = ruby.get_inner(&ITSI_REQUEST);
     request.define_method("path", method!(ItsiHttpRequest::path, 0))?;
@@ -94,6 +108,7 @@ fn init(ruby: &Ruby) -> Result<()> {
     response.define_method("<<", method!(ItsiHttpResponse::send_frame, 1))?;
     response.define_method("write", method!(ItsiHttpResponse::send_frame, 1))?;
     response.define_method("read", method!(ItsiHttpResponse::recv_frame, 0))?;
+    response.define_method("partial_hijack", method!(ItsiHttpResponse::partial_hijack, 1))?;
     response.define_method("closed?", method!(ItsiHttpResponse::is_closed, 0))?;
     response.define_method(
         "send_and_close",

data/crates/itsi_server/src/ruby_types/itsi_http_request.rs

@@ -211,6 +211,15 @@ impl ItsiHttpRequest {
                                 }
                             }
                         }
+                        Ok(ResponseFrame::PartialHijackedResponse(response)) => {
+                            match response.process_partial_hijacked_response().await {
+                                Ok(result) => Ok(result),
+                                Err(e) => {
+                                    error!("Error processing partial hijacked response: {}", e);
+                                    Ok(Response::new(HttpBody::empty()))
+                                }
+                            }
+                        }
                         Err(_) => {
                             error!("Failed to receive response from receiver");
                             Ok(INTERNAL_SERVER_ERROR_RESPONSE