puma-plus-core 0.1.0

data/go/internal/frontend/bodypump.go

@@ -0,0 +1,81 @@
+package frontend
+
+import (
+	"io"
+
+	"github.com/evanphx/puma-plus/internal/queue"
+	"github.com/evanphx/puma-plus/internal/wire"
+)
+
+// bodyPump streams a request body to a worker as BODY_CHUNK frames, terminated
+// by BODY_END.
+//
+// It runs concurrently with the worker executing the Rack app, because the
+// worker blocks on rack.input while we are still sending. The protocol requires
+// the worker to drain any unread body before RESP_END, which is what guarantees
+// this goroutine always finishes rather than wedging against a worker that
+// stopped reading -- see docs/PROTOCOL.md.
+type bodyPump struct {
+	done chan struct{}
+	err  error
+}
+
+// startBodyPump sends the already-buffered prefix, then the rest of src.
+func (h *Handler) startBodyPump(conn *queue.Conn, src io.Reader, prefix []byte) *bodyPump {
+	p := &bodyPump{done: make(chan struct{})}
+
+	go func() {
+		defer close(p.done)
+
+		// The prefix is what readBody already consumed while deciding whether
+		// the body fit in the buffer. It has to go out first, in wire order.
+		for off := 0; off < len(prefix); off += wire.ChunkTarget {
+			end := min(off+wire.ChunkTarget, len(prefix))
+			if err := conn.W.WriteFrame(wire.TypeBodyChunk, prefix[off:end]); err != nil {
+				p.err = err
+				return
+			}
+		}
+
+		if src != nil {
+			buf := make([]byte, wire.ChunkTarget)
+			for {
+				n, readErr := src.Read(buf)
+				if n > 0 {
+					if err := conn.W.WriteFrame(wire.TypeBodyChunk, buf[:n]); err != nil {
+						p.err = err
+						return
+					}
+				}
+				if readErr == io.EOF {
+					break
+				}
+				if readErr != nil {
+					// The client died mid-upload. Still send BODY_END so the
+					// worker's rack.input sees a clean EOF and the connection
+					// stays in protocol sync; the app sees a short body, which
+					// is the same thing any server would show it.
+					p.err = readErr
+					break
+				}
+			}
+		}
+
+		// BODY_END carries request trailers. Nothing generates them yet, so the
+		// kv blob is empty -- but the frame is mandatory: it is what tells
+		// rack.input it has reached EOF.
+		if err := conn.W.WriteFrame(wire.TypeBodyEnd, wire.AppendKV(nil, nil)); err != nil && p.err == nil {
+			p.err = err
+		}
+	}()
+
+	return p
+}
+
+// wait blocks until the pump finishes and reports whether it completed cleanly.
+// A pump that failed to write means the connection is no longer in a known
+// protocol state and must not be reused.
+func (p *bodyPump) wait() error {
+	<-p.done
+	return p.err
+}

data/go/internal/frontend/env.go

@@ -0,0 +1,224 @@
+package frontend
+
+import (
+	"net"
+	"net/http"
+	"strconv"
+	"strings"
+
+	"github.com/evanphx/puma-plus/internal/wire"
+)
+
+// BuildEnv converts an *http.Request into a complete, final Rack env as a kv
+// blob. All CGI-ification happens here, in Go: Ruby performs zero string
+// transformation and merely dups a frozen prototype env and merges byteslices.
+//
+// The layering this replaces is puma's five-stage construction -- Binder's
+// proto_env, the Ragel C parser, normalize_env, req_env_post_parse, and
+// handle_request -- collapsed into one pass over already-parsed headers.
+func BuildEnv(r *http.Request, scheme, defaultPort string, dst []wire.Pair) []wire.Pair {
+	path := r.URL.EscapedPath()
+	if path == "" {
+		path = "/"
+	}
+
+	host, port := splitHostPort(r.Host, defaultPort)
+
+	dst = append(dst,
+		wire.Pair{Key: kREQUEST_METHOD, Value: []byte(r.Method)},
+		wire.Pair{Key: kPATH_INFO, Value: []byte(path)},
+		wire.Pair{Key: kSCRIPT_NAME, Value: nil},
+		wire.Pair{Key: kQUERY_STRING, Value: []byte(r.URL.RawQuery)},
+		wire.Pair{Key: kSERVER_PROTOCOL, Value: []byte(r.Proto)},
+		wire.Pair{Key: kSERVER_NAME, Value: []byte(host)},
+		wire.Pair{Key: kSERVER_PORT, Value: []byte(port)},
+		wire.Pair{Key: kREMOTE_ADDR, Value: []byte(remoteAddr(r))},
+		wire.Pair{Key: kRACK_URL_SCHEME, Value: []byte(scheme)},
+		wire.Pair{Key: kSERVER_SOFTWARE, Value: serverSoftware},
+	)
+
+	// HTTP_HOST, set from r.Host rather than from the header loop below.
+	//
+	// net/http promotes the Host header into Request.Host and DELETES it from
+	// Header, so a loop over r.Header can never produce HTTP_HOST -- it simply
+	// went missing, silently. Rack apps that only read SERVER_NAME never
+	// noticed; Rails reads the host for ActionDispatch::HostAuthorization, saw
+	// an empty string, and blocked every request with 403 "Blocked hosts".
+	//
+	// Puma treats this header as mandatory on HTTP/1.1, answering 400 when it is
+	// absent (puma/lib/puma/client_env.rb:18), and derives SERVER_NAME and
+	// SERVER_PORT from it. We keep the value verbatim and derive the same two,
+	// but tolerate its absence -- HTTP/1.0 permits no Host, and h2/h3 carry
+	// :authority which Go has already put in r.Host.
+	if r.Host != "" {
+		dst = append(dst, wire.Pair{Key: kHTTP_HOST, Value: []byte(r.Host)})
+	}
+
+	// Content-Length and Content-Type are CGI variables without the HTTP_
+	// prefix, per the Rack spec.
+	if r.ContentLength > 0 {
+		dst = append(dst, wire.Pair{
+			Key:   kCONTENT_LENGTH,
+			Value: []byte(strconv.FormatInt(r.ContentLength, 10)),
+		})
+	}
+	if ct := r.Header.Get("Content-Type"); ct != "" {
+		dst = append(dst, wire.Pair{Key: kCONTENT_TYPE, Value: []byte(ct)})
+	}
+
+	for name, values := range r.Header {
+		// Host is set above from r.Host. Skipped here so that a Host surviving in
+		// Header -- which net/http does not currently do, but which is not ours
+		// to depend on -- cannot produce the key twice.
+		if name == "Content-Length" || name == "Content-Type" || name == "Host" {
+			continue
+		}
+		key := cgiKey(name)
+		if key == nil {
+			continue
+		}
+		// Repeated headers join with ", ", matching puma
+		// (ext/puma_http11/puma_http11.c:192-194) and RFC 9110 field-order
+		// semantics. Go has already split them into a slice.
+		var value string
+		if len(values) == 1 {
+			value = values[0]
+		} else {
+			value = strings.Join(values, ", ")
+		}
+		dst = append(dst, wire.Pair{Key: key, Value: []byte(value)})
+	}
+
+	return dst
+}
+
+// cgiKey converts an HTTP header name to its HTTP_* CGI form, or returns nil if
+// the header must be dropped.
+//
+// Where we deliberately differ from puma: puma's Ragel parser maps '-' to '_'
+// and '_' to ',' (ext/puma_http11/http11_parser.rl:17-25), then un-mangles later
+// depending on allow_underscore_headers, because by that point the two cases are
+// ambiguous. Go sees pristine header names, so it does not need the trick -- a
+// header name containing an underscore is simply dropped. After CGI-ification it
+// would be indistinguishable from its dashed sibling, and that ambiguity is a
+// request-smuggling vector.
+func cgiKey(name string) []byte {
+	if k, ok := commonHeaderKeys[name]; ok {
+		return k
+	}
+	if strings.IndexByte(name, '_') >= 0 {
+		return nil
+	}
+	b := make([]byte, 0, len(name)+5)
+	b = append(b, "HTTP_"...)
+	for i := 0; i < len(name); i++ {
+		c := name[i]
+		switch {
+		case c == '-':
+			b = append(b, '_')
+		case c >= 'a' && c <= 'z':
+			b = append(b, c-('a'-'A'))
+		default:
+			b = append(b, c)
+		}
+	}
+	return b
+}
+
+// splitHostPort splits a Host header into SERVER_NAME and SERVER_PORT, handling
+// bracketed IPv6 literals the way puma's client_env.rb:38-48 does.
+func splitHostPort(hostHeader, defaultPort string) (string, string) {
+	if hostHeader == "" {
+		return "localhost", defaultPort
+	}
+	if hostHeader[0] == '[' {
+		// [::1]:9292 or bare [::1].
+		//
+		// The brackets stay in SERVER_NAME, matching puma
+		// (puma/lib/puma/client_env.rb:39, `host[0, colon+1]` keeps the ']').
+		// Stripping them would leave a SERVER_NAME that cannot be reassembled
+		// into an authority, and would differ from what every other Rack server
+		// reports for the same request.
+		if end := strings.IndexByte(hostHeader, ']'); end >= 0 {
+			host := hostHeader[:end+1]
+			rest := hostHeader[end+1:]
+			if len(rest) > 1 && rest[0] == ':' {
+				return host, rest[1:]
+			}
+			return host, defaultPort
+		}
+		return hostHeader, defaultPort
+	}
+	if i := strings.LastIndexByte(hostHeader, ':'); i >= 0 {
+		// A colon that is not a port separator can only appear in an unbracketed
+		// IPv6 literal, which is malformed in a Host header; treat the whole
+		// thing as the name.
+		if strings.IndexByte(hostHeader, ':') == i {
+			return hostHeader[:i], hostHeader[i+1:]
+		}
+		return hostHeader, defaultPort
+	}
+	return hostHeader, defaultPort
+}
+
+// remoteAddr extracts the peer IP, unmapping IPv4-in-IPv6 the way puma does at
+// client.rb:419. X-Forwarded-For is deliberately not honored: trusting it
+// without a configured proxy allowlist is a spoofing hole, and the spike has no
+// such config yet.
+func remoteAddr(r *http.Request) string {
+	host, _, err := net.SplitHostPort(r.RemoteAddr)
+	if err != nil {
+		return r.RemoteAddr
+	}
+	if ip := net.ParseIP(host); ip != nil {
+		if v4 := ip.To4(); v4 != nil {
+			return v4.String()
+		}
+	}
+	return host
+}
+
+var serverSoftware = []byte("puma-plus")
+
+// Pre-allocated CGI keys. Building these once rather than per request is the
+// same optimization puma makes by interning 35 common header names in
+// ext/puma_http11/puma_http11.c:78-118.
+var (
+	kREQUEST_METHOD  = []byte("REQUEST_METHOD")
+	kPATH_INFO       = []byte("PATH_INFO")
+	kSCRIPT_NAME     = []byte("SCRIPT_NAME")
+	kQUERY_STRING    = []byte("QUERY_STRING")
+	kSERVER_PROTOCOL = []byte("SERVER_PROTOCOL")
+	kHTTP_HOST       = []byte("HTTP_HOST")
+	kSERVER_NAME     = []byte("SERVER_NAME")
+	kSERVER_PORT     = []byte("SERVER_PORT")
+	kREMOTE_ADDR     = []byte("REMOTE_ADDR")
+	kRACK_URL_SCHEME = []byte("rack.url_scheme")
+	kSERVER_SOFTWARE = []byte("SERVER_SOFTWARE")
+	kCONTENT_LENGTH  = []byte("CONTENT_LENGTH")
+	kCONTENT_TYPE    = []byte("CONTENT_TYPE")
+)
+
+// commonHeaderKeys short-circuits cgiKey for the headers that appear on nearly
+// every request, in Go's canonical MIME form.
+var commonHeaderKeys = map[string][]byte{
+	"Accept":            []byte("HTTP_ACCEPT"),
+	"Accept-Charset":    []byte("HTTP_ACCEPT_CHARSET"),
+	"Accept-Encoding":   []byte("HTTP_ACCEPT_ENCODING"),
+	"Accept-Language":   []byte("HTTP_ACCEPT_LANGUAGE"),
+	"Authorization":     []byte("HTTP_AUTHORIZATION"),
+	"Cache-Control":     []byte("HTTP_CACHE_CONTROL"),
+	"Connection":        []byte("HTTP_CONNECTION"),
+	"Cookie":            []byte("HTTP_COOKIE"),
+	"Host":              []byte("HTTP_HOST"),
+	"If-Modified-Since": []byte("HTTP_IF_MODIFIED_SINCE"),
+	"If-None-Match":     []byte("HTTP_IF_NONE_MATCH"),
+	"Origin":            []byte("HTTP_ORIGIN"),
+	"Pragma":            []byte("HTTP_PRAGMA"),
+	"Referer":           []byte("HTTP_REFERER"),
+	"User-Agent":        []byte("HTTP_USER_AGENT"),
+	"X-Forwarded-For":   []byte("HTTP_X_FORWARDED_FOR"),
+	"X-Forwarded-Proto": []byte("HTTP_X_FORWARDED_PROTO"),
+	"X-Request-Id":      []byte("HTTP_X_REQUEST_ID"),
+	"X-Request-Start":   []byte("HTTP_X_REQUEST_START"),
+}

data/go/internal/frontend/env_test.go

@@ -0,0 +1,64 @@
+package frontend
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+// TestBuildEnvSetsHTTPHost is the regression test for a header that went
+// missing silently.
+//
+// net/http promotes the Host header into Request.Host and deletes it from
+// Header, so building the env by looping over Header can never produce
+// HTTP_HOST. Nothing failed: Rack apps reading SERVER_NAME worked fine, and the
+// gap only surfaced as Rails answering 403 "Blocked hosts: """ to every
+// request, because ActionDispatch::HostAuthorization reads the host and got an
+// empty string. Puma treats the header as mandatory on HTTP/1.1
+// (puma/lib/puma/client_env.rb:18), so its absence was a real divergence.
+func TestBuildEnvSetsHTTPHost(t *testing.T) {
+	cases := []struct {
+		name, host     string
+		wantHost       string
+		wantName       string
+		wantPort       string
+		wantHostAbsent bool
+	}{
+		{name: "host with port", host: "example.test:8080", wantHost: "example.test:8080", wantName: "example.test", wantPort: "8080"},
+		{name: "host without port", host: "example.test", wantHost: "example.test", wantName: "example.test", wantPort: "9292"},
+		{name: "ipv4 loopback", host: "127.0.0.1:9691", wantHost: "127.0.0.1:9691", wantName: "127.0.0.1", wantPort: "9691"},
+		{name: "bracketed ipv6", host: "[::1]:9691", wantHost: "[::1]:9691", wantName: "[::1]", wantPort: "9691"},
+		// HTTP/1.0 permits no Host. Puma leaves the key absent rather than
+		// setting an empty one, and an empty HTTP_HOST is worse than none: it
+		// reads as "the client sent an empty host".
+		{name: "no host", host: "", wantHostAbsent: true, wantName: "localhost", wantPort: "9292"},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			r := httptest.NewRequest(http.MethodGet, "http://placeholder/path", nil)
+			r.Host = tc.host
+
+			env := map[string]string{}
+			for _, p := range BuildEnv(r, "http", "9292", nil) {
+				env[string(p.Key)] = string(p.Value)
+			}
+
+			got, present := env["HTTP_HOST"]
+			if tc.wantHostAbsent {
+				if present {
+					t.Errorf("HTTP_HOST = %q with no Host header; the key should be absent", got)
+				}
+			} else if got != tc.wantHost {
+				t.Errorf("HTTP_HOST = %q, want %q", got, tc.wantHost)
+			}
+
+			if env["SERVER_NAME"] != tc.wantName {
+				t.Errorf("SERVER_NAME = %q, want %q", env["SERVER_NAME"], tc.wantName)
+			}
+			if env["SERVER_PORT"] != tc.wantPort {
+				t.Errorf("SERVER_PORT = %q, want %q", env["SERVER_PORT"], tc.wantPort)
+			}
+		})
+	}
+}