kino 0.5.0 → 0.6.0

data/ext/kino/src/tls.rs

@@ -17,7 +17,13 @@ fn pem_bytes(input: &str) -> Result<Vec<u8>, String> {
     }
 }
 
-pub fn build_acceptor(cert: &str, key: &str) -> Result<TlsAcceptor, String> {
+pub fn build_acceptor(cert: &str, key: &str, http2: bool) -> Result<TlsAcceptor, String> {
+    Ok(TlsAcceptor::from(Arc::new(server_config(
+        cert, key, http2,
+    )?)))
+}
+
+fn server_config(cert: &str, key: &str, http2: bool) -> Result<ServerConfig, String> {
     let cert_pem = pem_bytes(cert)?;
     let key_pem = pem_bytes(key)?;
 
@@ -36,14 +42,19 @@ pub fn build_acceptor(cert: &str, key: &str) -> Result<TlsAcceptor, String> {
         .with_no_client_auth()
         .with_single_cert(certs, key)
         .map_err(|e| format!("TLS config rejected: {e}"))?;
-    config.alpn_protocols = vec![b"http/1.1".to_vec()];
-
-    Ok(TlsAcceptor::from(Arc::new(config)))
+    // Preference order matters: h2 first, so an HTTP/2-capable client
+    // negotiates it; a client offering only http/1.1 still matches.
+    config.alpn_protocols = if http2 {
+        vec![b"h2".to_vec(), b"http/1.1".to_vec()]
+    } else {
+        vec![b"http/1.1".to_vec()]
+    };
+    Ok(config)
 }
 
 #[cfg(test)]
 mod tests {
-    use super::build_acceptor;
+    use super::{build_acceptor, server_config};
 
     const CERT: &str = "-----BEGIN CERTIFICATE-----
 MIIBfjCCASWgAwIBAgIUTs9+cVJSzJjy4TSi9YLEd+i4KiIwCgYIKoZIzj0EAwIw
@@ -65,12 +76,12 @@ WJ2lRijROyX9v7f8aSQlb6kEwKhI8kG8SbeUc+zbKkzGgRXNaZHY/mAa
 
     #[test]
     fn inline_pem_builds_an_acceptor() {
-        assert!(build_acceptor(CERT, KEY).is_ok());
+        assert!(build_acceptor(CERT, KEY, true).is_ok());
     }
 
     #[test]
     fn missing_file_paths_error_without_panicking() {
-        let err = build_acceptor("/nonexistent/cert.pem", "/nonexistent/key.pem")
+        let err = build_acceptor("/nonexistent/cert.pem", "/nonexistent/key.pem", true)
             .err()
             .expect("missing files");
         assert!(err.contains("cannot read"));
@@ -78,13 +89,15 @@ WJ2lRijROyX9v7f8aSQlb6kEwKhI8kG8SbeUc+zbKkzGgRXNaZHY/mAa
 
     #[test]
     fn pem_without_certificates_is_rejected() {
-        let err = build_acceptor(KEY, KEY).err().expect("a key is not a cert");
+        let err = build_acceptor(KEY, KEY, true)
+            .err()
+            .expect("a key is not a cert");
         assert!(err.contains("no certificates found"));
     }
 
     #[test]
     fn pem_without_a_key_is_rejected() {
-        let err = build_acceptor(CERT, CERT)
+        let err = build_acceptor(CERT, CERT, true)
             .err()
             .expect("a cert is not a key");
         assert!(err.contains("no private key found"));
@@ -95,9 +108,106 @@ WJ2lRijROyX9v7f8aSQlb6kEwKhI8kG8SbeUc+zbKkzGgRXNaZHY/mAa
         let err = build_acceptor(
             CERT,
             "-----BEGIN PRIVATE KEY-----\ngarbage\n-----END PRIVATE KEY-----",
+            true,
         )
         .err()
         .expect("garbage key");
         assert!(!err.is_empty());
     }
+
+    #[test]
+    fn alpn_advertises_h2_first_when_http2_is_on() {
+        let config = server_config(CERT, KEY, true).expect("valid PEM");
+        assert_eq!(
+            config.alpn_protocols,
+            vec![b"h2".to_vec(), b"http/1.1".to_vec()]
+        );
+    }
+
+    #[test]
+    fn alpn_advertises_only_http11_when_http2_is_off() {
+        let config = server_config(CERT, KEY, false).expect("valid PEM");
+        assert_eq!(config.alpn_protocols, vec![b"http/1.1".to_vec()]);
+    }
+
+    /// A real rustls handshake over an in-memory pipe: an h2-capable
+    /// client must land on "h2", proving the advertisement is not just a
+    /// config field but what the wire negotiates. The client skips
+    /// certificate verification (the fixture cert is CA-flagged, which
+    /// webpki refuses as an end-entity cert): ALPN is under test here,
+    /// not the trust chain.
+    #[tokio::test]
+    async fn handshake_negotiates_h2_with_a_capable_client() {
+        use std::sync::Arc;
+
+        use tokio_rustls::rustls::client::danger::{
+            HandshakeSignatureValid, ServerCertVerified, ServerCertVerifier,
+        };
+        use tokio_rustls::rustls::crypto::WebPkiSupportedAlgorithms;
+        use tokio_rustls::rustls::pki_types::ServerName;
+        use tokio_rustls::rustls::ClientConfig;
+        use tokio_rustls::{TlsAcceptor, TlsConnector};
+
+        #[derive(Debug)]
+        struct AcceptAny(WebPkiSupportedAlgorithms);
+
+        impl ServerCertVerifier for AcceptAny {
+            fn verify_server_cert(
+                &self,
+                _end_entity: &tokio_rustls::rustls::pki_types::CertificateDer<'_>,
+                _intermediates: &[tokio_rustls::rustls::pki_types::CertificateDer<'_>],
+                _server_name: &ServerName<'_>,
+                _ocsp_response: &[u8],
+                _now: tokio_rustls::rustls::pki_types::UnixTime,
+            ) -> Result<ServerCertVerified, tokio_rustls::rustls::Error> {
+                Ok(ServerCertVerified::assertion())
+            }
+
+            fn verify_tls12_signature(
+                &self,
+                _message: &[u8],
+                _cert: &tokio_rustls::rustls::pki_types::CertificateDer<'_>,
+                _dss: &tokio_rustls::rustls::DigitallySignedStruct,
+            ) -> Result<HandshakeSignatureValid, tokio_rustls::rustls::Error> {
+                Ok(HandshakeSignatureValid::assertion())
+            }
+
+            fn verify_tls13_signature(
+                &self,
+                _message: &[u8],
+                _cert: &tokio_rustls::rustls::pki_types::CertificateDer<'_>,
+                _dss: &tokio_rustls::rustls::DigitallySignedStruct,
+            ) -> Result<HandshakeSignatureValid, tokio_rustls::rustls::Error> {
+                Ok(HandshakeSignatureValid::assertion())
+            }
+
+            fn supported_verify_schemes(&self) -> Vec<tokio_rustls::rustls::SignatureScheme> {
+                self.0.supported_schemes()
+            }
+        }
+
+        let acceptor =
+            TlsAcceptor::from(Arc::new(server_config(CERT, KEY, true).expect("valid PEM")));
+
+        let provider = tokio_rustls::rustls::crypto::ring::default_provider();
+        let verifier = AcceptAny(provider.signature_verification_algorithms);
+        let mut client = ClientConfig::builder()
+            .dangerous()
+            .with_custom_certificate_verifier(Arc::new(verifier))
+            .with_no_client_auth();
+        client.alpn_protocols = vec![b"h2".to_vec(), b"http/1.1".to_vec()];
+        let connector = TlsConnector::from(Arc::new(client));
+
+        let (client_io, server_io) = tokio::io::duplex(16 * 1024);
+        let server = tokio::spawn(async move { acceptor.accept(server_io).await });
+        let domain = ServerName::try_from("localhost").expect("server name");
+        let client_stream = connector
+            .connect(domain, client_io)
+            .await
+            .expect("client handshake");
+        let server_stream = server.await.expect("join").expect("server handshake");
+
+        assert_eq!(client_stream.get_ref().1.alpn_protocol(), Some(&b"h2"[..]));
+        assert_eq!(server_stream.get_ref().1.alpn_protocol(), Some(&b"h2"[..]));
+    }
 }

data/lib/kino/configuration.rb

@@ -30,6 +30,7 @@ module Kino
       io_threads: nil,
       tokio_threads: nil,
       tls: nil,
+      http2: true,
       environment: nil,
       pidfile: nil,
       control_bind: nil,
@@ -245,6 +246,11 @@ module Kino
       # TLS termination; file paths or inline PEM strings.
       def tls(cert:, key:) = @config.set(:tls, {cert: cert, key: key})
 
+      # HTTP/2: negotiated via ALPN on TLS binds, served to
+      # prior-knowledge clients on plaintext. On by default; set false
+      # to serve HTTP/1 only.
+      def http2(enabled = true) = @config.set(:http2, !!enabled)
+
       # Sets RACK_ENV (unless already set) before the CLI loads the app.
       def environment(env) = @config.set(:environment, env.to_s)
 

data/lib/kino/server.rb

@@ -109,6 +109,7 @@ module Kino
       if @tls && unix?
         raise ArgumentError, "TLS is not supported on a unix socket bind; terminate TLS at the proxy in front"
       end
+      @http2 = settings.fetch(:http2, true) ? true : false
       @pidfile = settings[:pidfile]
       @control_bind = settings[:control_bind]&.to_s
       @control_token = settings[:control_token]&.to_s
@@ -155,6 +156,7 @@ module Kino
           io_threads: @io_threads,
           tokio_threads: @tokio_threads,
           tls_cert: @tls&.fetch(:cert), tls_key: @tls&.fetch(:key),
+          http2: @http2,
           lanes: @lanes, log_requests: @log_requests,
           mode: @mode.to_s, workers: @workers, threads: @threads, batch: @batch,
           control_bind: @control_bind, control_token: @control_token

data/lib/kino/templates/kino.rb.tt

@@ -20,6 +20,11 @@
 # PEM strings also work).
 # tls cert: "config/certs/server.pem", key: "config/certs/server.key"
 
+# HTTP/2 is on by default: negotiated via ALPN on TLS binds, and served
+# to prior-knowledge (h2c) clients on plaintext. Everything else keeps
+# getting HTTP/1.1. Set false to serve HTTP/1 only.
+# http2 false
+
 ## Topology
 
 # How many workers to run. Each worker handles requests independently;

data/lib/kino/version.rb

@@ -2,5 +2,5 @@
 
 module Kino
   # The gem version (single source of truth; ext/kino/Cargo.toml syncs).
-  VERSION = "0.5.0"
+  VERSION = "0.6.0"
 end

data/lib/kino/worker.rb

@@ -20,12 +20,16 @@ module Kino
 
     def run(server_id, worker_id, app, batch_size = 1, hooks = nil)
       fire_after_worker_boot(hooks, worker_id)
+      # One resolution of (server, worker) into a native handle; every take
+      # after this skips the registry lookup. nil = server already gone.
+      worker = Native.worker(server_id, worker_id)
+      return unless worker
       if batch_size <= 1
-        env = Native.take_one(server_id, worker_id)
-        env = handle_one(env, server_id, worker_id, app, hooks) while env
+        env = worker.take_one
+        env = handle_one(env, worker, app, hooks) while env
       else
-        batch = Native.take_batch(server_id, worker_id, batch_size)
-        batch = process(batch, server_id, worker_id, app, batch_size, hooks) while batch
+        batch = worker.take_batch(batch_size)
+        batch = process(batch, worker, app, batch_size, hooks) while batch
       end
     end
 
@@ -35,22 +39,21 @@ module Kino
     NOT_FUSED = Object.new.freeze
 
     # Handle one request; returns the next env (fused take) or nil.
-    def handle_one(env, server_id, worker_id, app, hooks)
+    def handle_one(env, worker, app, hooks)
       result = serve(env, app, hooks) do |request, status, headers, chunks|
-        request.respond_and_take_one(server_id, worker_id, status, headers, chunks)
+        request.respond_and_take_one(worker, status, headers, chunks)
       end
-      result.equal?(NOT_FUSED) ? Native.take_one(server_id, worker_id) : result
+      result.equal?(NOT_FUSED) ? worker.take_one : result
     end
 
     # Handle every env in the batch; returns the next batch (the last
     # simple response rides the fused respond_and_take) or nil on shutdown.
-    def process(batch, server_id, worker_id, app, batch_size, hooks)
+    def process(batch, worker, app, batch_size, hooks)
       last = batch.size - 1
       batch.each_with_index do |env, index|
         result = serve(env, app, hooks) do |request, status, headers, chunks|
           if index == last
-            request.respond_and_take(server_id, worker_id, batch_size,
-              status, headers, chunks)
+            request.respond_and_take(worker, batch_size, status, headers, chunks)
           else
             request.send_simple(status, headers, chunks)
             NOT_FUSED
@@ -58,7 +61,7 @@ module Kino
         end
         return result if index == last && !result.equal?(NOT_FUSED)
       end
-      Native.take_batch(server_id, worker_id, batch_size)
+      worker.take_batch(batch_size)
     end
 
     # Run one request through the app. Complete bodies are yielded so the

data/sig/kino.rbs

@@ -130,6 +130,7 @@ module Kino
       def io_threads: (int? count) -> untyped
       def tokio_threads: (int count) -> untyped
       def tls: (cert: String, key: String) -> untyped
+      def http2: (?boolish enabled) -> untyped
       def environment: (String | Symbol env) -> untyped
       def pidfile: (String path) -> untyped
       def control_bind: (String addr) -> String

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kino
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.6.0
 platform: ruby
 authors:
 - Yaroslav Markin
@@ -51,6 +51,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: 0.9.128
+- !ruby/object:Gem::Dependency
+  name: httpx
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.3'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.3'
 - !ruby/object:Gem::Dependency
   name: rackup
   requirement: !ruby/object:Gem::Requirement