itsi 0.2.26 → 0.2.27

data/gems/server/test/helpers/local_acme.rb

@@ -0,0 +1,218 @@
+# frozen_string_literal: true
+
+require "fileutils"
+require "json"
+require "net/http"
+require "openssl"
+require "rbconfig"
+require "shellwords"
+require "timeout"
+require "tmpdir"
+
+class LocalAcmeAuthority
+  PEBBLE_VERSION = "v2.10.1"
+
+  attr_reader :directory_url, :cache_dir, :http_port, :tls_port
+
+  def self.available?
+    system("go version > /dev/null 2>&1")
+  end
+
+  def initialize
+    @workspace = Dir.mktmpdir("itsi-local-acme-")
+    @bin_dir = File.join(@workspace, "bin")
+    @cache_dir = File.join(@workspace, "cache")
+    FileUtils.mkdir_p(@bin_dir)
+    FileUtils.mkdir_p(@cache_dir)
+    @pids = []
+  end
+
+  def start
+    install_binaries
+    resolve_module_paths
+
+    @acme_port = free_port
+    @management_port = free_port
+    @dns_port = free_port
+    @dns_management_port = free_port
+    @http_port = free_port
+    @tls_port = free_port
+
+    write_pebble_config
+    start_challtestsrv
+    start_pebble
+
+    @directory_url = "https://localhost:#{@acme_port}/dir"
+    wait_for_https(@directory_url, @pebble_api_ca_path)
+  end
+
+  def stop
+    @pids.reverse_each do |pid|
+      begin
+        Process.kill("TERM", pid)
+      rescue Errno::ESRCH
+        next
+      end
+
+      begin
+        Timeout.timeout(5) { Process.wait(pid) }
+      rescue Timeout::Error
+        begin
+          Process.kill("KILL", pid)
+        rescue Errno::ESRCH
+          nil
+        end
+        begin
+          Process.wait(pid)
+        rescue Errno::ECHILD
+          nil
+        end
+      rescue Errno::ECHILD
+        nil
+      end
+    end
+    FileUtils.remove_entry(@workspace) if File.exist?(@workspace)
+  end
+
+  def env
+    {
+      "ITSI_ACME_DIRECTORY_URL" => @directory_url,
+      "ITSI_ACME_CA_PEM_PATH" => @pebble_api_ca_path,
+      "ITSI_ACME_CACHE_DIR" => @cache_dir
+    }
+  end
+
+  private
+
+  def install_binaries
+    install_go_binary("github.com/letsencrypt/pebble/v2/cmd/pebble", "pebble")
+    install_go_binary("github.com/letsencrypt/pebble/v2/cmd/pebble-challtestsrv", "pebble-challtestsrv")
+  end
+
+  def install_go_binary(package_name, binary_name)
+    destination = File.join(@bin_dir, binary_name)
+    return if File.exist?(destination)
+
+    system(
+      {
+        "GOBIN" => @bin_dir
+      },
+      "go", "install", "#{package_name}@#{PEBBLE_VERSION}",
+      exception: true
+    )
+  end
+
+  def resolve_module_paths
+    module_json = JSON.parse(`go mod download -json github.com/letsencrypt/pebble/v2@#{PEBBLE_VERSION}`)
+    @pebble_module_dir = module_json.fetch("Dir")
+    @pebble_api_ca_path = File.join(@pebble_module_dir, "test/certs/pebble.minica.pem")
+    @pebble_tls_cert_path = File.join(@pebble_module_dir, "test/certs/localhost/cert.pem")
+    @pebble_tls_key_path = File.join(@pebble_module_dir, "test/certs/localhost/key.pem")
+  end
+
+  def write_pebble_config
+    @pebble_config_path = File.join(@workspace, "pebble-config.json")
+    File.write(
+      @pebble_config_path,
+      JSON.pretty_generate(
+        {
+          pebble: {
+            listenAddress: "0.0.0.0:#{@acme_port}",
+            managementListenAddress: "0.0.0.0:#{@management_port}",
+            certificate: @pebble_tls_cert_path,
+            privateKey: @pebble_tls_key_path,
+            httpPort: @http_port,
+            tlsPort: @tls_port,
+            ocspResponderURL: "",
+            externalAccountBindingRequired: false,
+            domainBlocklist: [],
+            retryAfter: {
+              authz: 1,
+              order: 1
+            },
+            keyAlgorithm: "ecdsa"
+          }
+        }
+      )
+    )
+  end
+
+  def start_challtestsrv
+    spawn_process(
+      [
+        File.join(@bin_dir, "pebble-challtestsrv"),
+        "-dnsserver", "127.0.0.1:#{@dns_port}",
+        "-management", "127.0.0.1:#{@dns_management_port}",
+        "-http01", "",
+        "-https01", "",
+        "-tlsalpn01", "",
+        "-defaultIPv4", "127.0.0.1",
+        "-defaultIPv6", ""
+      ],
+      "challtestsrv"
+    )
+  end
+
+  def start_pebble
+    spawn_process(
+      [
+        File.join(@bin_dir, "pebble"),
+        "-config", @pebble_config_path,
+        "-dnsserver", "127.0.0.1:#{@dns_port}",
+        "-strict=false"
+      ],
+      "pebble",
+      {
+        "PEBBLE_VA_NOSLEEP" => "1",
+        "PEBBLE_WFE_NONCEREJECT" => "0",
+        "PEBBLE_AUTHZREUSE" => "0"
+      }
+    )
+  end
+
+  def spawn_process(command, name, env = {})
+    log_path = File.join(@workspace, "#{name}.log")
+    log = File.open(log_path, "w")
+    pid = Process.spawn(
+      env,
+      *command,
+      out: log,
+      err: log
+    )
+    @pids << pid
+  end
+
+  def free_port
+    server = TCPServer.new("127.0.0.1", 0)
+    port = server.addr[1]
+    server.close
+    port
+  end
+
+  def wait_for_https(url, ca_file)
+    uri = URI(url)
+    store = OpenSSL::X509::Store.new
+    store.add_file(ca_file)
+
+    Timeout.timeout(20) do
+      loop do
+        begin
+          Net::HTTP.start(
+            uri.host,
+            uri.port,
+            use_ssl: true,
+            cert_store: store,
+            verify_mode: OpenSSL::SSL::VERIFY_PEER,
+            open_timeout: 1,
+            read_timeout: 1
+          ) do |http|
+            response = http.get(uri.request_uri)
+            return if response.code.to_i < 500
+          end
+        rescue StandardError
+          sleep 0.1
+        end
+      end
+    end
+  end
+end

data/gems/server/test/helpers/test_helper.rb

@@ -2,6 +2,8 @@
 
 ENV["ITSI_LOG"] = "off"
 
+Warning[:experimental] = false if Warning.respond_to?(:[]=)
+
 require "minitest/reporters"
 require "rackup"
 require "itsi/server"
@@ -26,12 +28,12 @@ def free_bind(protocol = "http", unix_socket: false)
 end
 
 def server(
-  app: nil, app_with_lint: nil, protocol: "http", bind: free_bind(protocol), itsi_rb: nil, cleanup: true,
+  app: nil, app_with_lint: nil, protocol: "http", bind: free_bind(protocol), binds: nil, itsi_rb: nil, cleanup: true,
            &blk)
   app ||= Rack::Lint.new(app_with_lint) if app_with_lint
 
   cli_params = {}
-  cli_params[:binds] = [bind] if bind
+  cli_params[:binds] = binds || [bind] if binds || bind
 
   sync = Queue.new
   cli_params[:hooks] ||= {}
@@ -40,10 +42,10 @@ def server(
   end
 
   Itsi::Server.start_in_background_thread(cli_params) do
-    bind bind
+    bind bind if bind && binds.nil?
     workers 1
     threads 1
-    log_level :warn
+    log_level :error
     run app if app
     instance_exec(&itsi_rb) if itsi_rb
   end
@@ -51,11 +53,6 @@ def server(
   sync.pop
   uri = URI(bind)
   RequestContext.new(uri, self).instance_exec(uri, &blk)
-rescue StandardError => e
-  puts e
-  # puts e.message
-  # puts e.backtrace.join("\n")
-  raise
 ensure
   Itsi::Server.stop_background_threads if cleanup
 end
@@ -157,6 +154,7 @@ class RequestContext
         @uri.host,
         @uri.port,
         use_ssl: @uri.scheme == "https",
+        verify_mode: (@uri.scheme == "https" ? OpenSSL::SSL::VERIFY_NONE : nil),
         **opts
       )
     end

data/gems/server/test/middleware/endpoint.rb

@@ -118,14 +118,17 @@ class TestEndpoint < Minitest::Test
 
   # 8. Exceptions inside handler produce 500
   def test_internal_error_returns_500
-    server(itsi_rb: lambda do
-      endpoint "/boom" do |_req|
-        raise "test crash"
+    response = nil
+    capture_subprocess_io do
+      server(itsi_rb: lambda do
+        endpoint "/boom" do |_req|
+          raise "test crash"
+        end
+      end) do
+        response = get_resp("/boom")
       end
-    end) do
-      res = get_resp("/boom")
-      assert_equal "500", res.code
     end
+    assert_equal "500", response.code
   end
 
   # 9. Controller method dispatch via symbol

data/gems/server/test/rack/test_rack_server.rb

@@ -1,4 +1,7 @@
 require_relative "../helpers/test_helper"
+require "async/websocket/adapters/rack"
+require "protocol/websocket/connection"
+require "base64"
 
 class TestRackServer < Minitest::Test
   def test_that_it_has_a_version_number
@@ -66,6 +69,115 @@ class TestRackServer < Minitest::Test
     end
   end
 
+  def test_partial_hijack_yields_writable_stream
+    stream_class = nil
+    stream_closed = nil
+    required_methods_ok = nil
+
+    server(app_with_lint: lambda do |_env|
+      [200, { "content-type" => "text/plain", "rack.hijack" => lambda { |stream|
+        stream_class = stream.class
+        refute stream.closed?
+        required_methods_ok = %i[read write << flush close close_read close_write closed?]
+          .all? { |method_name| stream.respond_to?(method_name) }
+        stream.write("Hello")
+        stream.write(", World!")
+        stream.close
+        stream_closed = stream.closed?
+      } }, []]
+    end) do
+      assert_equal "Hello, World!", get("/")
+    end
+
+    assert_equal Rack::Lint::Wrapper::StreamWrapper, stream_class
+    assert_equal true, required_methods_ok
+    assert_equal true, stream_closed
+  end
+
+  def test_partial_hijack_upgrade_supports_bidirectional_io
+    callback_error = Queue.new
+    stream_details = Queue.new
+
+    server(app: lambda do |_env|
+      [101, {
+        "connection" => "Upgrade",
+        "upgrade" => "test",
+        "rack.hijack" => lambda { |stream|
+          stream_details << [stream.class, stream.is_a?(IO), stream.method(:read).arity]
+          Thread.new do
+            begin
+              payload = stream.read(2)
+              stream.write("echo:#{payload}")
+            rescue => e
+              callback_error << e
+            ensure
+              stream.close rescue nil
+            end
+          end
+        }
+      }, []]
+    end) do |uri|
+      socket = TCPSocket.new(uri.host, uri.port)
+      socket.write(
+        "GET / HTTP/1.1\r\n" \
+        "Host: #{uri.host}:#{uri.port}\r\n" \
+        "Connection: Upgrade\r\n" \
+        "Upgrade: test\r\n" \
+        "\r\n"
+      )
+      socket.flush
+
+      response = +""
+      until response.include?("\r\n\r\n")
+        response << socket.readpartial(1024)
+      end
+
+      assert_includes response, "101"
+      socket.write("hi")
+      socket.flush
+      echoed = socket.readpartial(7)
+      assert_equal "echo:hi", echoed
+    ensure
+      socket&.close
+    end
+
+    raise callback_error.pop unless callback_error.empty?
+    stream_class, stream_is_io, read_arity = stream_details.pop
+    assert_equal UNIXSocket, stream_class
+    assert_equal true, stream_is_io
+    assert_operator read_arity, :!=, 0
+  end
+
+  def test_async_websocket_rack_adapter_can_upgrade_and_echo_messages
+    callback_error = Queue.new
+
+    server(app_with_lint: lambda do |env|
+      Async::WebSocket::Adapters::Rack.open(env) do |connection|
+        begin
+          message = connection.read
+          connection.write(message)
+          connection.flush
+        rescue => e
+          callback_error << e
+        end
+      end || [200, { "content-type" => "text/plain" }, ["ok"]]
+    end) do |uri|
+      socket = websocket_upgrade_socket(uri)
+      connection = websocket_client_connection(socket)
+
+      connection.write("hello")
+      connection.flush
+
+      message = connection.read
+      assert_equal "hello", message.to_str
+    ensure
+      connection&.close rescue nil
+      socket&.close
+    end
+
+    raise callback_error.pop unless callback_error.empty?
+  end
+
   def test_enumerable_body
     server(app_with_lint: lambda do |env|
       [200, { "content-type" => "application/json" },
@@ -424,4 +536,36 @@ class TestRackServer < Minitest::Test
       assert_equal %w[a=b c=d], resp.get_fields("set-cookie")
     end
   end
+
+  private
+
+  def websocket_upgrade_socket(uri)
+    socket = TCPSocket.new(uri.host, uri.port)
+    socket.write(
+      "GET / HTTP/1.1\r\n" \
+      "Host: #{uri.host}:#{uri.port}\r\n" \
+      "Connection: Upgrade\r\n" \
+      "Upgrade: websocket\r\n" \
+      "Sec-WebSocket-Version: 13\r\n" \
+      "Sec-WebSocket-Key: #{Base64.strict_encode64(SecureRandom.random_bytes(16))}\r\n" \
+      "\r\n"
+    )
+    socket.flush
+
+    response = +""
+    until response.include?("\r\n\r\n")
+      chunk = socket.read(1)
+      raise EOFError, "Unexpected EOF during websocket handshake" unless chunk
+
+      response << chunk
+    end
+
+    assert_includes response, "101"
+    socket
+  end
+
+  def websocket_client_connection(socket)
+    framer = Protocol::WebSocket::Framer.new(socket)
+    Protocol::WebSocket::Connection.new(framer, mask: "\x01\x02\x03\x04")
+  end
 end

data/lib/itsi/version.rb

@@ -1,3 +1,3 @@
 module Itsi
-  VERSION = "0.2.26"
+  VERSION = "0.2.27"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: itsi
 version: !ruby/object:Gem::Version
-  version: 0.2.26
+  version: 0.2.27
 platform: ruby
 authors:
 - Wouter Coppieters
@@ -15,28 +15,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.2.26
+        version: 0.2.27
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.2.26
+        version: 0.2.27
 - !ruby/object:Gem::Dependency
   name: itsi-server
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.2.26
+        version: 0.2.27
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.2.26
+        version: 0.2.27
 description: Wrapper Gem for both the Itsi server and the Itsi Fiber scheduler
 email:
 - wc@pico.net.nz
@@ -74,6 +74,7 @@ files:
 - crates/itsi_acme/src/caches/no.rs
 - crates/itsi_acme/src/caches/test.rs
 - crates/itsi_acme/src/config.rs
+- crates/itsi_acme/src/http_challenge.rs
 - crates/itsi_acme/src/https_helper.rs
 - crates/itsi_acme/src/incoming.rs
 - crates/itsi_acme/src/jose.rs
@@ -768,6 +769,7 @@ files:
 - gems/scheduler/Cargo.lock
 - gems/scheduler/Cargo.toml
 - gems/scheduler/Gemfile
+- gems/scheduler/Gemfile.lock
 - gems/scheduler/Rakefile
 - gems/scheduler/bin/console
 - gems/scheduler/bin/setup
@@ -787,11 +789,13 @@ files:
 - gems/scheduler/test/test_nested_fibers.rb
 - gems/scheduler/test/test_network_io.rb
 - gems/scheduler/test/test_process_wait.rb
+- gems/scheduler/test/test_timeout_after.rb
 - gems/server/.gitignore
 - gems/server/.rubocop.yml
 - gems/server/Cargo.lock
 - gems/server/Cargo.toml
 - gems/server/Gemfile
+- gems/server/Gemfile.lock
 - gems/server/Rakefile
 - gems/server/bin/console
 - gems/server/bin/setup
@@ -1084,6 +1088,8 @@ files:
 - gems/server/lib/itsi/standard_headers.rb
 - gems/server/lib/ruby_lsp/itsi/addon.rb
 - gems/server/lib/shell_completions/completions.rb
+- gems/server/test/acme/local_acme_challenges.rb
+- gems/server/test/helpers/local_acme.rb
 - gems/server/test/helpers/test_helper.rb
 - gems/server/test/middleware/allow_list.rb
 - gems/server/test/middleware/auth_api_key.rb
@@ -1155,7 +1161,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '3.2'
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 3.6.9
 specification_version: 4
 summary: Wrapper Gem for both the Itsi server and the Itsi Fiber scheduler
 test_files: []