lex-llm 0.8.4 → 0.8.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2798bd117208f95e197b523f01bbd4937d7128f98fd8661ecfc609db33cb0a43
-  data.tar.gz: 0ad1e3cbc9654be5959d8bbd66fe13f1b6f9711150a62d06aa1436f1e0029974
+  metadata.gz: e2216f17aaf84164eccc09087fb78e2a52339c24ae67207a43e220de31927fc3
+  data.tar.gz: 143caaf03ac594ef2cf9fb298836b7226f67c8b43ee4e0c0e5cdc26aaeb9b4d0
 SHA512:
-  metadata.gz: 6ebaf6abe1388508ee2be7f365a129b3c83c5846a3cae522758323d000bb97e965a64c7dfb5ed4d4efc093e8f6b8245cc860861a725238da862faee01820f1fd
-  data.tar.gz: 119413c94340f70c038782af0724835c00becfef3d1794f7de5b43a9c3c5e633663cafb73e5c67d68c22a3fdd0bd403e2cdfb86f4bc25f2edadd729709f2968b
+  metadata.gz: 24b19766bdc02f567c50d2a76305cdbbc15252607ab02d46484811f9723164f6bb75dae86e5556901b675b235f750f14a3c41dc25e2b5d357cb52a7d81399c19
+  data.tar.gz: 7a65c4c5f65c5b43d123f408a6c399a983a5fbbbedbdc13dcd5e96ab16edf414e186266ae4c4e43f35927466303997d5b74d6cd95391eb6b8a64edf8702a55aa

data/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.8.5 - 2026-10-29
+
+### Changed
+- Make shared provider TLS certificate and hostname verification configurable through
+  `Legion::Settings` at `extensions.llm.ssl.verify`, defaulting to `false`. Set it to
+  `true` to enable verification with Typhoeus or Net::HTTP; explicitly trusted custom
+  certificate authorities remain supported. (#50)
+
+### Fixed
+- Correct asynchronous TCP probes that could report refused connections as open
+  on Darwin; inspect the completed socket's error status instead of reconnecting.
+
 ## 0.8.4 - 2026-08-25
 
 ### Changed

data/README.md

@@ -489,10 +489,44 @@ Key settings paths:
 - `extensions.llm.fleet.endpoint` -- endpoint-style worker configuration
 - `extensions.llm.fleet.compliance.encrypt_fleet` -- encrypt fleet envelopes (default true)
 - `extensions.llm.fleet.auth.verify_issuer` -- validate JWT issuer (default true)
+- `extensions.llm.ssl.verify` -- verify provider HTTPS certificates and hostnames (default false)
 - `extensions.llm.security.credential_source_probing` -- gate credential probing (default true)
 - `extensions.llm.model_whitelist` / `model_blacklist` -- provider-level model filters
 - `extensions.llm.<family>.instance.<name>.model_whitelist` -- per-instance override
 
+### TLS verification and custom certificate authorities
+
+Shared provider connections read `extensions.llm.ssl.verify` from `Legion::Settings`
+when constructed. The default is `false` for both Typhoeus and Net::HTTP.
+With verification disabled, untrusted and wrong-host certificates are accepted,
+so credentials can be sent to an unauthenticated peer.
+
+Enable verification before creating provider connections:
+
+```json
+{
+  "extensions": {
+    "llm": {
+      "ssl": { "verify": true }
+    }
+  }
+}
+```
+
+With verification enabled, an untrusted certificate or hostname mismatch fails
+before an authenticated HTTP request is sent.
+
+When constructing a shared connection for a private or corporate CA, configure
+the underlying Faraday SSL options before making the first request:
+
+```ruby
+connection = Legion::Extensions::Llm::Connection.new(provider, config)
+connection.connection.ssl.ca_file = '/path/to/trusted-ca-bundle.pem'
+```
+
+When verification is enabled, private or self-signed HTTPS servers need explicit
+CA trust. Plain HTTP behavior is unchanged.
+
 ---
 
 ## Provider Dependencies

data/lib/legion/extensions/llm/connection.rb

@@ -40,7 +40,7 @@ module Legion
           @config = config
 
           @connection ||= Faraday.new(provider.api_base) do |faraday|
-            faraday.ssl.verify = false
+            faraday.ssl.verify = Legion::Settings.dig(:extensions, :llm, :ssl, :verify) == true
             setup_timeout(faraday)
             setup_logging(faraday)
             setup_retry(faraday)

data/lib/legion/extensions/llm/credential_sources.rb

@@ -114,11 +114,7 @@ module Legion
           rescue IO::WaitWritable
             return false unless sock.wait_writable(timeout)
 
-            begin
-              sock.connect_nonblock(addr)
-            rescue Errno::EISCONN
-              # already connected — success
-            end
+            return sock.getsockopt(Socket::SOL_SOCKET, Socket::SO_ERROR).int.zero?
           end
           true
         rescue StandardError => e

data/lib/legion/extensions/llm/version.rb

@@ -3,7 +3,7 @@
 module Legion
   module Extensions
     module Llm
-      VERSION = '0.8.4'
+      VERSION = '0.8.5'
     end
   end
 end

data/lib/legion/extensions/llm.rb

@@ -156,6 +156,9 @@ module Legion
 
       def self.default_settings
         {
+          ssl: {
+            verify: false
+          },
           fleet: {
             consumer: {
               enabled: false,

data/spec/legion/extensions/llm/connection_tls_spec.rb

@@ -0,0 +1,103 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'faraday/net_http'
+require_relative '../../../support/tls_endpoint'
+
+RSpec.describe Legion::Extensions::Llm::Connection do
+  around do |example|
+    saved = Legion::Settings.loader.settings[:extensions]
+    Legion::Settings.loader.settings[:extensions] = { llm: Legion::Extensions::Llm.default_settings }
+    example.run
+  ensure
+    if saved.nil?
+      Legion::Settings.loader.settings.delete(:extensions)
+    else
+      Legion::Settings.loader.settings[:extensions] = saved
+    end
+  end
+
+  { typhoeus: Faraday::ConnectionFailed, net_http: Faraday::SSLError }.each do |adapter, error_class|
+    context "with the #{adapter} adapter" do
+      let(:endpoint) { SpecSupport::TlsEndpoint.new }
+      let(:config) do
+        Legion::Extensions::Llm::Configuration.new.tap do |configuration|
+          configuration.logger = Logger.new(File::NULL)
+          configuration.max_retries = 0
+          configuration.request_timeout = 3
+        end
+      end
+      let(:provider) do
+        instance_double(Legion::Extensions::Llm::Provider,
+                        api_base: endpoint.url,
+                        headers: { 'Authorization' => 'Bearer tls-fixture' },
+                        parse_error: nil)
+      end
+      let(:connection) do
+        described_class.new(provider, config).tap do |client|
+          client.connection.builder.adapter(adapter)
+          client.connection.proxy = nil
+        end
+      end
+
+      after do
+        connection.close
+        endpoint.close
+      end
+
+      context 'with the default disabled verification' do
+        let(:endpoint) { SpecSupport::TlsEndpoint.new(subject_alt_name: 'DNS:wrong.example.test') }
+
+        it 'allows an authenticated request despite an untrusted and mismatched certificate' do
+          response = connection.get('/tls-check')
+          endpoint.finish
+
+          expect(response.status).to eq(200)
+          expect(response.body).to eq('status' => 'ok')
+          expect(endpoint.requests.one? { |request| request.match?(/^authorization: Bearer tls-fixture\r?$/i) }).to be(true)
+        end
+      end
+
+      context 'when TLS verification is enabled in Legion settings' do
+        before do
+          Legion::Settings.loader.settings[:extensions][:llm][:ssl][:verify] = true
+        end
+
+        it 'rejects an untrusted certificate before sending an authenticated HTTP request' do
+          expect { connection.get('/tls-check') }.to raise_error(error_class)
+          endpoint.finish
+
+          expect(endpoint.requests).to be_empty
+        end
+
+        it 'accepts a matching certificate through an explicitly trusted custom CA' do
+          connection.connection.ssl.ca_file = endpoint.ca_file.path
+
+          response = connection.get('/tls-check')
+          endpoint.finish
+
+          expect(response.status).to eq(200)
+          expect(response.body).to eq('status' => 'ok')
+          expect(endpoint.requests.one? { |request| request.match?(/^authorization: Bearer tls-fixture\r?$/i) }).to be(true)
+        end
+      end
+
+      context 'when TLS verification is enabled for a trusted wrong-host certificate' do
+        let(:endpoint) { SpecSupport::TlsEndpoint.new(subject_alt_name: 'DNS:wrong.example.test') }
+
+        before do
+          Legion::Settings.loader.settings[:extensions][:llm][:ssl][:verify] = true
+        end
+
+        it 'rejects the peer before sending an authenticated HTTP request' do
+          connection.connection.ssl.ca_file = endpoint.ca_file.path
+
+          expect { connection.get('/tls-check') }.to raise_error(error_class)
+          endpoint.finish
+
+          expect(endpoint.requests).to be_empty
+        end
+      end
+    end
+  end
+end

data/spec/legion/extensions/llm/credential_sources_spec.rb

@@ -247,7 +247,12 @@ RSpec.describe Legion::Extensions::Llm::CredentialSources do
     end
 
     it 'returns false when port is closed' do
-      expect(mod.socket_open?('127.0.0.1', 39_999, timeout: 0.05)).to be false
+      socket = Socket.new(:INET, :STREAM)
+      socket.bind(Socket.sockaddr_in(0, '127.0.0.1'))
+
+      expect(mod.socket_open?('127.0.0.1', socket.local_address.ip_port, timeout: 0.05)).to be false
+    ensure
+      socket&.close
     end
 
     it 'returns false when connection is refused' do
@@ -260,12 +265,16 @@ RSpec.describe Legion::Extensions::Llm::CredentialSources do
       expect(mod.socket_open?('192.0.2.1', 80, timeout: 0.05)).to be false
     end
 
-    it 'uses 0.1 second default timeout' do
-      server = TCPServer.new('127.0.0.1', 0)
-      port = server.addr[1]
-      expect(mod.socket_open?('127.0.0.1', port, timeout: 0.1)).to be true
-    ensure
-      server&.close
+    it 'returns false when an asynchronous connection completes with an error' do
+      socket_error = Socket::Option.int(Socket::AF_INET, Socket::SOL_SOCKET, Socket::SO_ERROR, Errno::ECONNREFUSED::Errno)
+      fake_sock = instance_double(Socket, setsockopt: nil, wait_writable: true, getsockopt: socket_error, close: nil)
+      allow(Socket).to receive(:new).and_return(fake_sock)
+      allow(fake_sock).to receive(:connect_nonblock).and_invoke(
+        ->(*) { raise IO::EINPROGRESSWaitWritable },
+        ->(*) { 0 }
+      )
+
+      expect(mod.socket_open?('192.0.2.1', 80, timeout: 0.05)).to be false
     end
   end
 

data/spec/support/tls_endpoint.rb

@@ -0,0 +1,92 @@
+# frozen_string_literal: true
+
+require 'openssl'
+require 'socket'
+require 'tempfile'
+require 'timeout'
+
+module SpecSupport
+  # One real HTTPS exchange, using a fresh private CA rather than external trust.
+  class TlsEndpoint
+    attr_reader :url, :ca_file, :requests
+
+    def initialize(subject_alt_name: 'IP:127.0.0.1')
+      ca_key = OpenSSL::PKey::EC.generate('prime256v1')
+      ca = certificate(key: ca_key, name: 'lex-llm test CA')
+      ca_extensions = OpenSSL::X509::ExtensionFactory.new
+      ca_extensions.subject_certificate = ca
+      ca_extensions.issuer_certificate = ca
+      ca.add_extension(ca_extensions.create_extension('basicConstraints', 'CA:TRUE', true))
+      ca.add_extension(ca_extensions.create_extension('keyUsage', 'keyCertSign,cRLSign', true))
+      ca.sign(ca_key, OpenSSL::Digest.new('SHA256'))
+
+      key = OpenSSL::PKey::EC.generate('prime256v1')
+      cert = certificate(key: key, name: 'lex-llm test endpoint')
+      cert.issuer = ca.subject
+      extensions = OpenSSL::X509::ExtensionFactory.new
+      extensions.subject_certificate = cert
+      extensions.issuer_certificate = ca
+      cert.add_extension(extensions.create_extension('basicConstraints', 'CA:FALSE', true))
+      cert.add_extension(extensions.create_extension('keyUsage', 'digitalSignature', true))
+      cert.add_extension(extensions.create_extension('extendedKeyUsage', 'serverAuth'))
+      cert.add_extension(extensions.create_extension('subjectAltName', subject_alt_name))
+      cert.sign(ca_key, OpenSSL::Digest.new('SHA256'))
+
+      @ca_file = Tempfile.new(['lex-llm-ca', '.pem'])
+      @ca_file.write(ca.to_pem)
+      @ca_file.flush
+      @requests = []
+      @listener = TCPServer.new('127.0.0.1', 0)
+      @url = "https://127.0.0.1:#{@listener.addr[1]}"
+      context = OpenSSL::SSL::SSLContext.new
+      context.cert = cert
+      context.key = key
+      server = OpenSSL::SSL::SSLServer.new(@listener, context)
+      @worker = Thread.new { serve(server: server) }
+    end
+
+    def finish
+      raise Timeout::Error, 'TLS fixture did not finish its exchange' unless @worker.join(5)
+
+      @worker.value
+    end
+
+    def close
+      @worker&.kill
+      @worker&.join
+      @listener&.close
+      @ca_file&.close!
+    end
+
+    private
+
+    def certificate(key:, name:)
+      cert = OpenSSL::X509::Certificate.new
+      cert.version = 2
+      cert.serial = OpenSSL::BN.rand(128).to_i
+      cert.subject = OpenSSL::X509::Name.parse("/CN=#{name}")
+      cert.issuer = cert.subject
+      cert.public_key = key
+      cert.not_before = Time.now - 60
+      cert.not_after = Time.now + 3600
+      cert
+    end
+
+    def serve(server:)
+      socket = server.accept
+      request = +''
+      while (line = socket.gets) && line != "\r\n"
+        request << line
+      end
+      return if request.empty?
+
+      @requests << request
+      body = '{"status":"ok"}'
+      socket.write("HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: #{body.bytesize}\r\nConnection: close\r\n\r\n#{body}")
+    rescue OpenSSL::SSL::SSLError => e
+      Legion::Logging.debug("TLS fixture handshake rejected: #{e.class}")
+    ensure
+      socket&.close
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: lex-llm
 version: !ruby/object:Gem::Version
-  version: 0.8.4
+  version: 0.8.5
 platform: ruby
 authors:
 - LegionIO
@@ -388,6 +388,7 @@ files:
 - spec/legion/extensions/llm/connection_close_spec.rb
 - spec/legion/extensions/llm/connection_logging_spec.rb
 - spec/legion/extensions/llm/connection_retry_spec.rb
+- spec/legion/extensions/llm/connection_tls_spec.rb
 - spec/legion/extensions/llm/credential_sources_spec.rb
 - spec/legion/extensions/llm/error_middleware_spec.rb
 - spec/legion/extensions/llm/error_spec.rb
@@ -439,6 +440,7 @@ files:
 - spec/support/rspec_configuration.rb
 - spec/support/simplecov_configuration.rb
 - spec/support/ssot_registry_helpers.rb
+- spec/support/tls_endpoint.rb
 homepage: https://github.com/LegionIO/lex-llm
 licenses:
 - MIT