puma 2.0.0.b5 → 5.0.0.beta1

data/lib/puma/minissl.rb

@@ -1,137 +1,283 @@
-module Puma::MiniSSL
-  class Socket
-    def initialize(socket, engine)
-      @socket = socket
-      @engine = engine
-    end
+# frozen_string_literal: true
 
-    def to_io
-      @socket
-    end
+begin
+  require 'io/wait'
+rescue LoadError
+end
 
-    def readpartial(size)
-      while true
-        output = @engine.read
-        return output if output
+module Puma
+  module MiniSSL
+    class Socket
+      def initialize(socket, engine)
+        @socket = socket
+        @engine = engine
+        @peercert = nil
+      end
 
-        data = @socket.readpartial(size)
-        @engine.inject(data)
-        output = @engine.read
+      def to_io
+        @socket
+      end
+
+      def closed?
+        @socket.closed?
+      end
 
-        return output if output
+      def readpartial(size)
+        while true
+          output = @engine.read
+          return output if output
 
-        while neg_data = @engine.extract
-          @socket.write neg_data
+          data = @socket.readpartial(size)
+          @engine.inject(data)
+          output = @engine.read
+
+          return output if output
+
+          while neg_data = @engine.extract
+            @socket.write neg_data
+          end
         end
       end
-    end
 
-    def read_nonblock(size)
-      while true
+      def engine_read_all
         output = @engine.read
-        return output if output
+        while output and additional_output = @engine.read
+          output << additional_output
+        end
+        output
+      end
 
-        data = @socket.read_nonblock(size)
+      def read_nonblock(size, *_)
+        # *_ is to deal with keyword args that were added
+        # at some point (and being used in the wild)
+        while true
+          output = engine_read_all
+          return output if output
+
+          data = @socket.read_nonblock(size, exception: false)
+          if data == :wait_readable || data == :wait_writable
+            # It would make more sense to let @socket.read_nonblock raise
+            # EAGAIN if necessary but it seems like it'll misbehave on Windows.
+            # I don't have a Windows machine to debug this so I can't explain
+            # exactly whats happening in that OS. Please let me know if you
+            # find out!
+            #
+            # In the meantime, we can emulate the correct behavior by
+            # capturing :wait_readable & :wait_writable and raising EAGAIN
+            # ourselves.
+            raise IO::EAGAINWaitReadable
+          elsif data.nil?
+            return nil
+          end
+
+          @engine.inject(data)
+          output = engine_read_all
+
+          return output if output
+
+          while neg_data = @engine.extract
+            @socket.write neg_data
+          end
+        end
+      end
 
-        @engine.inject(data)
-        output = @engine.read
+      def write(data)
+        return 0 if data.empty?
 
-        return output if output
+        need = data.bytesize
 
-        while neg_data = @engine.extract
-          @socket.write neg_data
+        while true
+          wrote = @engine.write data
+          enc = @engine.extract
+
+          while enc
+            @socket.write enc
+            enc = @engine.extract
+          end
+
+          need -= wrote
+
+          return data.bytesize if need == 0
+
+          data = data[wrote..-1]
         end
       end
-    end
 
-    def write(data)
-      need = data.size
+      alias_method :syswrite, :write
+      alias_method :<<, :write
+
+      # This is a temporary fix to deal with websockets code using
+      # write_nonblock. The problem with implementing it properly
+      # is that it means we'd have to have the ability to rewind
+      # an engine because after we write+extract, the socket
+      # write_nonblock call might raise an exception and later
+      # code would pass the same data in, but the engine would think
+      # it had already written the data in. So for the time being
+      # (and since write blocking is quite rare), go ahead and actually
+      # block in write_nonblock.
+      def write_nonblock(data, *_)
+        write data
+      end
 
-      while true
-        wrote = @engine.write data
-        enc = @engine.extract
+      def flush
+        @socket.flush
+      end
 
-        if enc
-          @socket.syswrite enc
+      def read_and_drop(timeout = 1)
+        return :timeout unless IO.select([@socket], nil, nil, timeout)
+        case @socket.read_nonblock(1024, exception: false)
+        when nil
+          :eof
+        when :wait_readable
+          :eagain
+        else
+          :drop
         end
+      end
 
-        need -= wrote
+      def should_drop_bytes?
+        @engine.init? || !@engine.shutdown
+      end
 
-        return data.size if need == 0
+      def close
+        begin
+          # Read any drop any partially initialized sockets and any received bytes during shutdown.
+          # Don't let this socket hold this loop forever.
+          # If it can't send more packets within 1s, then give up.
+          return if [:timeout, :eof].include?(read_and_drop(1)) while should_drop_bytes?
+        rescue IOError, SystemCallError
+          Thread.current.purge_interrupt_queue if Thread.current.respond_to? :purge_interrupt_queue
+          # nothing
+        ensure
+          @socket.close
+        end
+      end
 
-        data = data[need..-1]
+      def peeraddr
+        @socket.peeraddr
       end
-    end
 
-    alias_method :syswrite, :write
+      def peercert
+        return @peercert if @peercert
 
-    def flush
-      @socket.flush
-    end
+        raw = @engine.peercert
+        return nil unless raw
 
-    def close
-      @socket.close
+        @peercert = OpenSSL::X509::Certificate.new raw
+      end
     end
 
-    def peeraddr
-      @socket.peeraddr
+    if defined?(JRUBY_VERSION)
+      class SSLError < StandardError
+        # Define this for jruby even though it isn't used.
+      end
+
+      def self.check; end
     end
-  end
 
-  class Context
-    attr_accessor :verify_mode
+    class Context
+      attr_accessor :verify_mode
+      attr_reader :no_tlsv1, :no_tlsv1_1
 
-    attr_reader :key
-    attr_reader :cert
+      def initialize
+        @no_tlsv1   = false
+        @no_tlsv1_1 = false
+      end
 
-    def key=(key)
-      raise ArgumentError, "No such key file '#{key}'" unless File.exist? key
-      @key = key
-    end
+      if defined?(JRUBY_VERSION)
+        # jruby-specific Context properties: java uses a keystore and password pair rather than a cert/key pair
+        attr_reader :keystore
+        attr_accessor :keystore_pass
+        attr_accessor :ssl_cipher_list
 
-    def cert=(cert)
-      raise ArgumentError, "No such cert file '#{cert}'" unless File.exist? cert
-      @cert = cert
-    end
-  end
+        def keystore=(keystore)
+          raise ArgumentError, "No such keystore file '#{keystore}'" unless File.exist? keystore
+          @keystore = keystore
+        end
 
-  VERIFY_NONE = 0
-  VERIFY_PEER = 1
-
-  #if defined?(JRUBY_VERSION)
-    #class Engine
-      #def self.server(key, cert)
-        #new(key, cert)
-      #end
-    #end
-  #end
-
-  class Server
-    def initialize(socket, ctx)
-      @socket = socket
-      @ctx = ctx
-    end
+        def check
+          raise "Keystore not configured" unless @keystore
+        end
 
-    def to_io
-      @socket
-    end
+      else
+        # non-jruby Context properties
+        attr_reader :key
+        attr_reader :cert
+        attr_reader :ca
+        attr_accessor :ssl_cipher_filter
 
-    def accept
-      io = @socket.accept
-      engine = Engine.server @ctx.key, @ctx.cert
+        def key=(key)
+          raise ArgumentError, "No such key file '#{key}'" unless File.exist? key
+          @key = key
+        end
 
-      Socket.new io, engine
-    end
+        def cert=(cert)
+          raise ArgumentError, "No such cert file '#{cert}'" unless File.exist? cert
+          @cert = cert
+        end
+
+        def ca=(ca)
+          raise ArgumentError, "No such ca file '#{ca}'" unless File.exist? ca
+          @ca = ca
+        end
 
-    def accept_nonblock
-      io = @socket.accept_nonblock
-      engine = Engine.server @ctx.key, @ctx.cert
+        def check
+          raise "Key not configured" unless @key
+          raise "Cert not configured" unless @cert
+        end
+      end
+
+      # disables TLSv1
+      def no_tlsv1=(tlsv1)
+        raise ArgumentError, "Invalid value of no_tlsv1" unless ['true', 'false', true, false].include?(tlsv1)
+        @no_tlsv1 = tlsv1
+      end
+
+      # disables TLSv1 and TLSv1.1.  Overrides `#no_tlsv1=`
+      def no_tlsv1_1=(tlsv1_1)
+        raise ArgumentError, "Invalid value of no_tlsv1" unless ['true', 'false', true, false].include?(tlsv1_1)
+        @no_tlsv1_1 = tlsv1_1
+      end
 
-      Socket.new io, engine
     end
 
-    def close
-      @socket.close
+    VERIFY_NONE = 0
+    VERIFY_PEER = 1
+    VERIFY_FAIL_IF_NO_PEER_CERT = 2
+
+    class Server
+      def initialize(socket, ctx)
+        @socket = socket
+        @ctx = ctx
+      end
+
+      def to_io
+        @socket
+      end
+
+      def accept
+        @ctx.check
+        io = @socket.accept
+        engine = Engine.server @ctx
+
+        Socket.new io, engine
+      end
+
+      def accept_nonblock
+        @ctx.check
+        io = @socket.accept_nonblock
+        engine = Engine.server @ctx
+
+        Socket.new io, engine
+      end
+
+      def addr
+        @socket.addr
+      end
+
+      def close
+        @socket.close unless @socket.closed?       # closed? call is for Windows
+      end
     end
   end
 end

data/lib/puma/minissl/context_builder.rb

@@ -0,0 +1,76 @@
+module Puma
+  module MiniSSL
+    class ContextBuilder
+      def initialize(params, events)
+        require 'puma/minissl'
+        MiniSSL.check
+
+        @params = params
+        @events = events
+      end
+
+      def context
+        ctx = MiniSSL::Context.new
+
+        if defined?(JRUBY_VERSION)
+          unless params['keystore']
+            events.error "Please specify the Java keystore via 'keystore='"
+          end
+
+          ctx.keystore = params['keystore']
+
+          unless params['keystore-pass']
+            events.error "Please specify the Java keystore password  via 'keystore-pass='"
+          end
+
+          ctx.keystore_pass = params['keystore-pass']
+          ctx.ssl_cipher_list = params['ssl_cipher_list'] if params['ssl_cipher_list']
+        else
+          unless params['key']
+            events.error "Please specify the SSL key via 'key='"
+          end
+
+          ctx.key = params['key']
+
+          unless params['cert']
+            events.error "Please specify the SSL cert via 'cert='"
+          end
+
+          ctx.cert = params['cert']
+
+          if ['peer', 'force_peer'].include?(params['verify_mode'])
+            unless params['ca']
+              events.error "Please specify the SSL ca via 'ca='"
+            end
+          end
+
+          ctx.ca = params['ca'] if params['ca']
+          ctx.ssl_cipher_filter = params['ssl_cipher_filter'] if params['ssl_cipher_filter']
+        end
+
+        ctx.no_tlsv1 = true if params['no_tlsv1'] == 'true'
+        ctx.no_tlsv1_1 = true if params['no_tlsv1_1'] == 'true'
+
+        if params['verify_mode']
+          ctx.verify_mode = case params['verify_mode']
+                            when "peer"
+                              MiniSSL::VERIFY_PEER
+                            when "force_peer"
+                              MiniSSL::VERIFY_PEER | MiniSSL::VERIFY_FAIL_IF_NO_PEER_CERT
+                            when "none"
+                              MiniSSL::VERIFY_NONE
+                            else
+                              events.error "Please specify a valid verify_mode="
+                              MiniSSL::VERIFY_NONE
+                            end
+        end
+
+        ctx
+      end
+
+      private
+
+      attr_reader :params, :events
+    end
+  end
+end