itsi 0.2.26 → 0.2.27.rc1

data/crates/itsi_server/src/ruby_types/itsi_http_response.rs

@@ -23,10 +23,12 @@ use parking_lot::RwLock;
 use std::{
     collections::HashMap,
     io,
+    io::Read,
     ops::Deref,
     os::{fd::FromRawFd, unix::net::UnixStream},
     str::FromStr,
     sync::Arc,
+    thread,
     time::Duration,
 };
 use tokio::{
@@ -56,6 +58,7 @@ pub struct ResponseInner {
     pub frame_writer: RwLock<Option<Sender<Bytes>>>,
     pub response: RwLock<Option<HttpResponse>>,
     pub hijacked_socket: RwLock<Option<UnixStream>>,
+    pub partial_hijacked_socket: RwLock<Option<UnixStream>>,
     pub response_sender: RwLock<Option<OneshotSender<ResponseFrame>>>,
     pub shutdown_rx: watch::Receiver<RunningPhase>,
     pub parts: Arc<Parts>,
@@ -65,6 +68,7 @@ pub struct ResponseInner {
 pub enum ResponseFrame {
     HttpResponse(Box<HttpResponse>),
     HijackedResponse(ItsiHttpResponse),
+    PartialHijackedResponse(ItsiHttpResponse),
 }
 
 impl ItsiHttpResponse {
@@ -81,6 +85,7 @@ impl ItsiHttpResponse {
                 frame_writer: RwLock::new(None),
                 response: RwLock::new(Some(Response::new(HttpBody::empty()))),
                 hijacked_socket: RwLock::new(None),
+                partial_hijacked_socket: RwLock::new(None),
             }),
         }
     }
@@ -219,6 +224,42 @@ impl ItsiHttpResponse {
         Ok(response)
     }
 
+    pub async fn process_partial_hijacked_response(&self) -> Result<HttpResponse> {
+        let stream =
+            self.partial_hijacked_socket
+                .write()
+                .take()
+                .ok_or(itsi_error::ItsiError::InvalidInput(
+                    "Couldn't partial hijack stream".to_owned(),
+                ))?;
+        let stream = TokioUnixStream::from_std(stream).map_err(|err| {
+            itsi_error::ItsiError::InvalidInput(format!(
+                "Couldn't prepare partial hijack stream: {:?}",
+                err
+            ))
+        })?;
+
+        let mut response = self.response.write().take().ok_or(
+            itsi_error::ItsiError::InvalidInput("Missing partial hijack response".to_owned()),
+        )?;
+        let parts = self.parts.clone();
+
+        tokio::spawn(async move {
+            let mut req = Request::from_parts((*parts).clone(), Empty::<Bytes>::new());
+            match hyper::upgrade::on(&mut req).await {
+                Ok(upgraded) => {
+                    if let Err(err) = Self::two_way_bridge(upgraded, stream).await {
+                        warn!("partial hijack bridge error: {:?}", err);
+                    }
+                }
+                Err(err) => warn!("partial hijack upgrade error: {:?}", err),
+            }
+        });
+
+        *response.body_mut() = HttpBody::empty();
+        Ok(response)
+    }
+
     pub fn internal_server_error(&self, message: String) {
         error!(message);
         self.close_write().ok();
@@ -304,6 +345,60 @@ impl ItsiHttpResponse {
         // not implemented
     }
 
+    pub fn partial_hijack(&self, fd: i32) -> MagnusResult<()> {
+        let mut stream = unsafe { UnixStream::from_raw_fd(fd) };
+        let status = self
+            .response
+            .read()
+            .as_ref()
+            .map(|response| response.status())
+            .unwrap_or(StatusCode::OK);
+
+        if status == StatusCode::SWITCHING_PROTOCOLS {
+            *self.partial_hijacked_socket.write() = Some(stream);
+            if let Some(sender) = self.response_sender.write().take() {
+                sender
+                    .send(ResponseFrame::PartialHijackedResponse(self.clone()))
+                    .ok();
+            }
+        } else if let Some(mut response) = self.response.write().take() {
+            let (writer, reader) = tokio::sync::mpsc::channel::<Bytes>(256);
+            let shutdown_rx = self.shutdown_rx.clone();
+            let frame_stream = FrameStream::new(reader, shutdown_rx);
+            let buffered =
+                BufferedStream::new(frame_stream, 32 * 1024, Duration::from_millis(10));
+            *response.body_mut() = HttpBody::stream(buffered);
+            self.frame_writer.write().replace(writer.clone());
+
+            thread::spawn(move || {
+                let mut buf = [0u8; 16 * 1024];
+                loop {
+                    match stream.read(&mut buf) {
+                        Ok(0) => break,
+                        Ok(n) => {
+                            if writer
+                                .blocking_send(Bytes::copy_from_slice(&buf[..n]))
+                                .is_err()
+                            {
+                                break;
+                            }
+                        }
+                        Err(err) if err.kind() == io::ErrorKind::Interrupted => continue,
+                        Err(_) => break,
+                    }
+                }
+            });
+
+            if let Some(sender) = self.response_sender.write().take() {
+                sender
+                    .send(ResponseFrame::HttpResponse(Box::new(response)))
+                    .ok();
+            }
+        }
+
+        Ok(())
+    }
+
     pub fn is_closed(&self) -> bool {
         self.response.read().is_none() && self.frame_writer.read().is_none()
     }

data/crates/itsi_server/src/ruby_types/itsi_server/itsi_server_config.rs

@@ -2,7 +2,7 @@ use super::file_watcher::{self, WatcherCommand};
 use crate::{
     ruby_types::ITSI_SERVER_CONFIG,
     server::{
-        binds::{bind::Bind, listener::Listener},
+        binds::{bind::Bind, listener::Listener, tls::DynamicAcmeManager},
         middleware_stack::MiddlewareSet,
     },
 };
@@ -81,6 +81,8 @@ pub struct ServerParams {
     pub binds: Vec<Bind>,
     #[debug(skip)]
     pub(crate) listeners: Mutex<Vec<Listener>>,
+    #[debug(skip)]
+    pub acme_managers: RwLock<Vec<(String, DynamicAcmeManager)>>,
     listener_info: Mutex<HashMap<String, i32>>,
     pub itsi_server_token_preference: ItsiServerTokenPreference,
     pub preloaded: AtomicBool,
@@ -348,6 +350,7 @@ impl ServerParams {
             preexisting_listeners,
             listener_info: Mutex::new(HashMap::new()),
             listeners: Mutex::new(Vec::new()),
+            acme_managers: RwLock::new(Vec::new()),
             middleware_loader: middleware_loader.into(),
             middleware: OnceLock::new(),
             preloaded: AtomicBool::new(false),
@@ -401,8 +404,26 @@ impl ServerParams {
             })
             .collect::<Result<HashMap<String, i32>>>()?;
 
+        let has_http_listener = listeners
+            .iter()
+            .any(|listener| matches!(listener, Listener::Tcp(_)));
+        let mut acme_managers = Vec::new();
+        for listener in &listeners {
+            match listener {
+                Listener::TcpTls((_, acceptor)) | Listener::UnixTls((_, acceptor)) => {
+                    acceptor.set_http01_enabled(has_http_listener);
+                    acceptor.initialize_domains();
+                    if let Some(manager) = acceptor.manager() {
+                        acme_managers.push((listener.handover()?.0, manager));
+                    }
+                }
+                Listener::Tcp(_) | Listener::Unix(_) => {}
+            }
+        }
+
         *self.listener_info.lock() = listener_info;
         *self.listeners.lock() = listeners;
+        *self.acme_managers.write() = acme_managers;
         Ok(())
     }
 }

data/crates/itsi_server/src/ruby_types/itsi_server.rs

@@ -8,6 +8,7 @@ use itsi_server_config::ItsiServerConfig;
 use itsi_tracing::{error, run_silently};
 use magnus::{block::Proc, error::Result, RHash, Ruby};
 use parking_lot::Mutex;
+use std::collections::HashMap;
 use std::{path::PathBuf, sync::Arc};
 use tracing::{info, instrument};
 mod file_watcher;
@@ -46,6 +47,105 @@ impl ItsiServer {
         Ok(())
     }
 
+    fn selected_acme_manager(
+        &self,
+        listener_id: Option<String>,
+    ) -> Result<crate::server::binds::tls::DynamicAcmeManager> {
+        let config = self.config()?;
+        let server_params = config.server_params.read();
+        if server_params.workers > 1 {
+            return Err(magnus::Error::new(
+                magnus::Ruby::get().unwrap().exception_runtime_error(),
+                "Dynamic TLS domain management currently only supports single-worker mode",
+            ));
+        }
+
+        let managers = server_params.acme_managers.read();
+        if managers.is_empty() {
+            return Err(magnus::Error::new(
+                magnus::Ruby::get().unwrap().exception_runtime_error(),
+                "No ACME-managed TLS bindings are configured",
+            ));
+        }
+
+        if let Some(listener_id) = listener_id {
+            managers
+                .iter()
+                .find(|(id, _)| id == &listener_id)
+                .map(|(_, manager)| manager.clone())
+                .ok_or_else(|| {
+                    magnus::Error::new(
+                        magnus::Ruby::get().unwrap().exception_runtime_error(),
+                        format!("Unknown ACME TLS binding: {}", listener_id),
+                    )
+                })
+        } else if managers.len() == 1 {
+            Ok(managers[0].1.clone())
+        } else {
+            Err(magnus::Error::new(
+                magnus::Ruby::get().unwrap().exception_runtime_error(),
+                "Multiple ACME TLS bindings are configured; specify a listener_id",
+            ))
+        }
+    }
+
+    pub fn tls_bindings(&self) -> Result<Vec<String>> {
+        let config = self.config()?;
+        let server_params = config.server_params.read();
+        let bindings = server_params
+            .acme_managers
+            .read()
+            .iter()
+            .map(|(listener_id, _)| listener_id.clone())
+            .collect();
+        Ok(bindings)
+    }
+
+    pub fn tls_domains(&self, listener_id: Option<String>) -> Result<Vec<String>> {
+        let manager = self.selected_acme_manager(listener_id)?;
+        Ok(manager
+            .statuses()
+            .into_iter()
+            .map(|status| status.domain)
+            .collect())
+    }
+
+    pub fn tls_domain_statuses(
+        &self,
+        listener_id: Option<String>,
+    ) -> Result<Vec<HashMap<String, String>>> {
+        let manager = self.selected_acme_manager(listener_id)?;
+        Ok(manager
+            .statuses()
+            .into_iter()
+            .map(|status| {
+                let mut out = HashMap::new();
+                out.insert("domain".to_string(), status.domain);
+                out.insert("status".to_string(), status.status);
+                if let Some(last_error) = status.last_error {
+                    out.insert("last_error".to_string(), last_error);
+                }
+                out
+            })
+            .collect())
+    }
+
+    pub fn register_tls_domain(&self, domain: String, listener_id: Option<String>) -> Result<()> {
+        let manager = self.selected_acme_manager(listener_id)?;
+        manager.register_domain(domain);
+        Ok(())
+    }
+
+    pub fn unregister_tls_domain(
+        &self,
+        domain: String,
+        listener_id: Option<String>,
+    ) -> Result<()> {
+        let manager = self.selected_acme_manager(listener_id)?;
+        manager.unregister_domain(&domain);
+        Ok(())
+    }
+
     fn config(&self) -> Result<Arc<ItsiServerConfig>> {
         self.config.lock().as_ref().cloned().ok_or_else(|| {
             magnus::Error::new(

data/crates/itsi_server/src/server/binds/listener.rs

@@ -8,7 +8,6 @@ use super::bind_protocol::BindProtocol;
 
 use super::tls::ItsiTlsAcceptor;
 use itsi_error::{ItsiError, Result};
-use itsi_tracing::info;
 use socket2::{Domain, Protocol, SockRef, Socket, Type};
 use std::fmt::Display;
 use std::net::{IpAddr, SocketAddr, TcpListener};
@@ -21,7 +20,6 @@ use tokio::net::UnixListener as TokioUnixListener;
 use tokio::net::{unix, TcpStream, UnixStream};
 use tokio::sync::watch::Receiver;
 use tokio::time::timeout;
-use tokio_stream::StreamExt;
 
 pub(crate) enum Listener {
     Tcp(TcpListener),
@@ -115,25 +113,8 @@ impl TokioListener {
     }
 
     pub async fn spawn_acme_event_task(&self, mut shutdown_receiver: Receiver<RunningPhase>) {
-        if let TokioListener::TcpTls(
-            _,
-            ItsiTlsAcceptor::Automatic(_acme_acceptor, state, _server_config),
-        ) = self
-        {
-            let mut state = state.lock().await;
-            loop {
-                tokio::select! {
-                  stream_event = StreamExt::next(&mut *state) => {
-                      match stream_event {
-                        Some(event) => info!("ACME Event: {:?}", event),
-                        None => error!("Received no acme event"),
-                      }
-                  },
-                  _ = shutdown_receiver.changed() => {
-                      break;
-                  }
-                }
-            }
+        if let TokioListener::TcpTls(_, ItsiTlsAcceptor::Automatic { .. }) = self {
+            let _ = shutdown_receiver.changed().await;
         }
     }
 
@@ -215,7 +196,11 @@ impl AcceptedStream {
                         Err(_) => Err(ItsiError::Pass),
                     }
                 }
-                ItsiTlsAcceptor::Automatic(acme_acceptor, _, rustls_config) => {
+                ItsiTlsAcceptor::Automatic {
+                    acme_acceptor,
+                    server_config,
+                    ..
+                } => {
                     let accept_future = acme_acceptor.accept(stream);
                     match timeout(handshake_timeout, accept_future).await {
                         Err(_) => Err(ItsiError::Pass),
@@ -224,7 +209,7 @@ impl AcceptedStream {
                             Ok(Some(start_handshake)) => {
                                 match timeout(
                                     handshake_timeout,
-                                    start_handshake.into_stream(rustls_config.clone()),
+                                    start_handshake.into_stream(server_config.clone()),
                                 )
                                 .await
                                 {
@@ -259,7 +244,7 @@ impl AcceptedStream {
                         Err(_) => Err(ItsiError::Pass),
                     }
                 }
-                ItsiTlsAcceptor::Automatic(_, _, _) => {
+                ItsiTlsAcceptor::Automatic { .. } => {
                     error!("Automatic TLS not supported on Unix sockets");
                     Err(ItsiError::UnsupportedProtocol(
                         "Automatic TLS on Unix Sockets".to_owned(),