puma 3.12.1 → 5.3.2

data/ext/puma_http11/http11_parser.h

@@ -29,8 +29,8 @@ typedef void (*field_cb)(struct puma_parser* hp,
 
 typedef struct puma_parser {
   int cs;
-  size_t body_start;
   int content_len;
+  size_t body_start;
   size_t nread;
   size_t mark;
   size_t field_start;

data/ext/puma_http11/http11_parser.java.rl

@@ -1,5 +1,7 @@
 package org.jruby.puma;
 
+import org.jruby.Ruby;
+import org.jruby.RubyHash;
 import org.jruby.util.ByteList;
 
 public class Http11Parser {
@@ -19,44 +21,35 @@ public class Http11Parser {
   }
 
   action start_value { parser.mark = fpc; }
-  action write_value { 
-    if(parser.http_field != null) {
-      parser.http_field.call(parser.data, parser.field_start, parser.field_len, parser.mark, fpc-parser.mark);
-    }
+  action write_value {
+    Http11.http_field(runtime, parser.data, parser.buffer, parser.field_start, parser.field_len, parser.mark, fpc-parser.mark);
   }
-  action request_method { 
-    if(parser.request_method != null) 
-      parser.request_method.call(parser.data, parser.mark, fpc-parser.mark);
+  action request_method {
+    Http11.request_method(runtime, parser.data, parser.buffer, parser.mark, fpc-parser.mark);
   }
-  action request_uri { 
-    if(parser.request_uri != null)
-      parser.request_uri.call(parser.data, parser.mark, fpc-parser.mark);
+  action request_uri {
+    Http11.request_uri(runtime, parser.data, parser.buffer, parser.mark, fpc-parser.mark);
   }
-  action fragment { 
-    if(parser.fragment != null)
-      parser.fragment.call(parser.data, parser.mark, fpc-parser.mark);
+  action fragment {
+    Http11.fragment(runtime, parser.data, parser.buffer, parser.mark, fpc-parser.mark);
   }
   
   action start_query {parser.query_start = fpc; }
-  action query_string { 
-    if(parser.query_string != null)
-      parser.query_string.call(parser.data, parser.query_start, fpc-parser.query_start);
+  action query_string {
+    Http11.query_string(runtime, parser.data, parser.buffer, parser.query_start, fpc-parser.query_start);
   }
 
-  action http_version {	
-    if(parser.http_version != null)
-      parser.http_version.call(parser.data, parser.mark, fpc-parser.mark);
+  action http_version {
+    Http11.http_version(runtime, parser.data, parser.buffer, parser.mark, fpc-parser.mark);
   }
 
   action request_path {
-    if(parser.request_path != null)
-      parser.request_path.call(parser.data, parser.mark, fpc-parser.mark);
+    Http11.request_path(runtime, parser.data, parser.buffer, parser.mark, fpc-parser.mark);
   }
 
   action done { 
-    parser.body_start = fpc + 1; 
-    if(parser.header_done != null)
-      parser.header_done.call(parser.data, fpc + 1, pe - fpc - 1);
+    parser.body_start = fpc + 1;
+    http.header_done(runtime, parser.data, parser.buffer, fpc + 1, pe - fpc - 1);
     fbreak;
   }
 
@@ -65,14 +58,14 @@ public class Http11Parser {
 }%%
 
 /** Data **/
-%% write data;
+%% write data noentry;
 
    public static interface ElementCB {
-     public void call(Object data, int at, int length);
+     public void call(Ruby runtime, RubyHash data, ByteList buffer, int at, int length);
    }
 
    public static interface FieldCB {
-     public void call(Object data, int field, int flen, int value, int vlen);
+     public void call(Ruby runtime, RubyHash data, ByteList buffer, int field, int flen, int value, int vlen);
    }
 
    public static class HttpParser {
@@ -85,18 +78,9 @@ public class Http11Parser {
       int field_len;
       int query_start;
 
-      Object data;
+      RubyHash data;
       ByteList buffer;
 
-      public FieldCB http_field;
-      public ElementCB request_method;
-      public ElementCB request_uri;
-      public ElementCB fragment;
-      public ElementCB request_path;
-      public ElementCB query_string;
-      public ElementCB http_version;
-      public ElementCB header_done;
-
       public void init() {
           cs = 0;
 
@@ -113,7 +97,7 @@ public class Http11Parser {
 
    public final HttpParser parser = new HttpParser();
 
-   public int execute(ByteList buffer, int off) {
+   public int execute(Ruby runtime, Http11 http, ByteList buffer, int off) {
      int p, pe;
      int cs = parser.cs;
      int len = buffer.length();

data/ext/puma_http11/http11_parser.rl

@@ -12,12 +12,14 @@
 
 /*
  * capitalizes all lower-case ASCII characters,
- * converts dashes to underscores.
+ * converts dashes to underscores, and underscores to commas.
  */
 static void snake_upcase_char(char *c)
 {
     if (*c >= 'a' && *c <= 'z')
       *c &= ~0x20;
+    else if (*c == '_')
+      *c = ',';
     else if (*c == '-')
       *c = '_';
 }
@@ -79,7 +81,7 @@ static void snake_upcase_char(char *c)
 }%%
 
 /** Data **/
-%% write data;
+%% write data noentry;
 
 int puma_parser_init(puma_parser *parser)  {
   int cs = 0;

data/ext/puma_http11/http11_parser_common.rl

@@ -1,5 +1,5 @@
 %%{
-  
+
   machine puma_parser_common;
 
 #### HTTP PROTOCOL GRAMMAR
@@ -16,7 +16,7 @@
   unreserved = (alpha | digit | safe | extra | national);
   escape = ("%" xdigit xdigit);
   uchar = (unreserved | escape | "%");
-  pchar = (uchar | ":" | "@" | "&" | "=" | "+");
+  pchar = (uchar | ":" | "@" | "&" | "=" | "+" | ";");
   tspecials = ("(" | ")" | "<" | ">" | "@" | "," | ";" | ":" | "\\" | "\"" | "/" | "[" | "]" | "?" | "=" | "{" | "}" | " " | "\t");
 
 # elements
@@ -30,7 +30,7 @@
   query = ( uchar | reserved )* %query_string ;
   param = ( pchar | "/" )* ;
   params = ( param ( ";" param )* ) ;
-  rel_path = ( path? %request_path (";" params)? ) ("?" %start_query query)?;
+  rel_path = ( path? %request_path ) ("?" %start_query query)?;
   absolute_path = ( "/"+ rel_path );
 
   Request_URI = ( "*" | absolute_uri | absolute_path ) >mark %request_uri;

data/ext/puma_http11/mini_ssl.c

@@ -2,12 +2,7 @@
 
 #include <ruby.h>
 #include <ruby/version.h>
-
-#if RUBY_API_VERSION_MAJOR == 1
-#include <rubyio.h>
-#else
 #include <ruby/io.h>
-#endif
 
 #ifdef HAVE_OPENSSL_BIO_H
 
@@ -33,7 +28,10 @@ typedef struct {
   int bytes;
 } ms_cert_buf;
 
-void engine_free(ms_conn* conn) {
+VALUE eError;
+
+void engine_free(void *ptr) {
+  ms_conn *conn = ptr;
   ms_cert_buf* cert_buf = (ms_cert_buf*)SSL_get_app_data(conn->ssl);
   if(cert_buf) {
     OPENSSL_free(cert_buf->buf);
@@ -45,61 +43,71 @@ void engine_free(ms_conn* conn) {
   free(conn);
 }
 
-ms_conn* engine_alloc(VALUE klass, VALUE* obj) {
-  ms_conn* conn;
-
-  *obj = Data_Make_Struct(klass, ms_conn, 0, engine_free, conn);
-
-  conn->read = BIO_new(BIO_s_mem());
-  BIO_set_nbio(conn->read, 1);
-
-  conn->write = BIO_new(BIO_s_mem());
-  BIO_set_nbio(conn->write, 1);
-
-  conn->ssl = 0;
-  conn->ctx = 0;
+const rb_data_type_t engine_data_type = {
+    "MiniSSL/ENGINE",
+    { 0, engine_free, 0 },
+    0, 0, RUBY_TYPED_FREE_IMMEDIATELY,
+};
 
-  return conn;
-}
-
-DH *get_dh1024() {
-  /* `openssl dhparam 1024 -C`
+DH *get_dh2048() {
+  /* `openssl dhparam -C 2048`
    * -----BEGIN DH PARAMETERS-----
-   * MIGHAoGBALPwcEv0OstmQCZdfHw0N5r+07lmXMxkpQacy1blwj0LUqC+Divp6pBk
-   * usTJ9W2/dOYr1X7zi6yXNLp4oLzc/31PUL3D9q8CpGS7vPz5gijKSw9BwCTT5z9+
-   * KF9v46qw8XqT5HHV87sWFlGQcVFq+pEkA2kPikkKZ/X/CCcpCAV7AgEC
+   * MIIBCAKCAQEAjmh1uQHdTfxOyxEbKAV30fUfzqMDF/ChPzjfyzl2jcrqQMhrk76o
+   * 2NPNXqxHwsddMZ1RzvU8/jl+uhRuPWjXCFZbhET4N1vrviZM3VJhV8PPHuiVOACO
+   * y32jFd+Szx4bo2cXSK83hJ6jRd+0asP1awWjz9/06dFkrILCXMIfQLo0D8rqmppn
+   * EfDDAwuudCpM9kcDmBRAm9JsKbQ6gzZWjkc5+QWSaQofojIHbjvj3xzguaCJn+oQ
+   * vHWM+hsAnaOgEwCyeZ3xqs+/5lwSbkE/tqJW98cEZGygBUVo9jxZRZx6KOfjpdrb
+   * yenO9LJr/qtyrZB31WJbqxI0m0AKTAO8UwIBAg==
    * -----END DH PARAMETERS-----
    */
-  static unsigned char dh1024_p[] = {
-    0xB3,0xF0,0x70,0x4B,0xF4,0x3A,0xCB,0x66,0x40,0x26,0x5D,0x7C,
-    0x7C,0x34,0x37,0x9A,0xFE,0xD3,0xB9,0x66,0x5C,0xCC,0x64,0xA5,
-    0x06,0x9C,0xCB,0x56,0xE5,0xC2,0x3D,0x0B,0x52,0xA0,0xBE,0x0E,
-    0x2B,0xE9,0xEA,0x90,0x64,0xBA,0xC4,0xC9,0xF5,0x6D,0xBF,0x74,
-    0xE6,0x2B,0xD5,0x7E,0xF3,0x8B,0xAC,0x97,0x34,0xBA,0x78,0xA0,
-    0xBC,0xDC,0xFF,0x7D,0x4F,0x50,0xBD,0xC3,0xF6,0xAF,0x02,0xA4,
-    0x64,0xBB,0xBC,0xFC,0xF9,0x82,0x28,0xCA,0x4B,0x0F,0x41,0xC0,
-    0x24,0xD3,0xE7,0x3F,0x7E,0x28,0x5F,0x6F,0xE3,0xAA,0xB0,0xF1,
-    0x7A,0x93,0xE4,0x71,0xD5,0xF3,0xBB,0x16,0x16,0x51,0x90,0x71,
-    0x51,0x6A,0xFA,0x91,0x24,0x03,0x69,0x0F,0x8A,0x49,0x0A,0x67,
-    0xF5,0xFF,0x08,0x27,0x29,0x08,0x05,0x7B
+  static unsigned char dh2048_p[] = {
+    0x8E, 0x68, 0x75, 0xB9, 0x01, 0xDD, 0x4D, 0xFC, 0x4E, 0xCB,
+    0x11, 0x1B, 0x28, 0x05, 0x77, 0xD1, 0xF5, 0x1F, 0xCE, 0xA3,
+    0x03, 0x17, 0xF0, 0xA1, 0x3F, 0x38, 0xDF, 0xCB, 0x39, 0x76,
+    0x8D, 0xCA, 0xEA, 0x40, 0xC8, 0x6B, 0x93, 0xBE, 0xA8, 0xD8,
+    0xD3, 0xCD, 0x5E, 0xAC, 0x47, 0xC2, 0xC7, 0x5D, 0x31, 0x9D,
+    0x51, 0xCE, 0xF5, 0x3C, 0xFE, 0x39, 0x7E, 0xBA, 0x14, 0x6E,
+    0x3D, 0x68, 0xD7, 0x08, 0x56, 0x5B, 0x84, 0x44, 0xF8, 0x37,
+    0x5B, 0xEB, 0xBE, 0x26, 0x4C, 0xDD, 0x52, 0x61, 0x57, 0xC3,
+    0xCF, 0x1E, 0xE8, 0x95, 0x38, 0x00, 0x8E, 0xCB, 0x7D, 0xA3,
+    0x15, 0xDF, 0x92, 0xCF, 0x1E, 0x1B, 0xA3, 0x67, 0x17, 0x48,
+    0xAF, 0x37, 0x84, 0x9E, 0xA3, 0x45, 0xDF, 0xB4, 0x6A, 0xC3,
+    0xF5, 0x6B, 0x05, 0xA3, 0xCF, 0xDF, 0xF4, 0xE9, 0xD1, 0x64,
+    0xAC, 0x82, 0xC2, 0x5C, 0xC2, 0x1F, 0x40, 0xBA, 0x34, 0x0F,
+    0xCA, 0xEA, 0x9A, 0x9A, 0x67, 0x11, 0xF0, 0xC3, 0x03, 0x0B,
+    0xAE, 0x74, 0x2A, 0x4C, 0xF6, 0x47, 0x03, 0x98, 0x14, 0x40,
+    0x9B, 0xD2, 0x6C, 0x29, 0xB4, 0x3A, 0x83, 0x36, 0x56, 0x8E,
+    0x47, 0x39, 0xF9, 0x05, 0x92, 0x69, 0x0A, 0x1F, 0xA2, 0x32,
+    0x07, 0x6E, 0x3B, 0xE3, 0xDF, 0x1C, 0xE0, 0xB9, 0xA0, 0x89,
+    0x9F, 0xEA, 0x10, 0xBC, 0x75, 0x8C, 0xFA, 0x1B, 0x00, 0x9D,
+    0xA3, 0xA0, 0x13, 0x00, 0xB2, 0x79, 0x9D, 0xF1, 0xAA, 0xCF,
+    0xBF, 0xE6, 0x5C, 0x12, 0x6E, 0x41, 0x3F, 0xB6, 0xA2, 0x56,
+    0xF7, 0xC7, 0x04, 0x64, 0x6C, 0xA0, 0x05, 0x45, 0x68, 0xF6,
+    0x3C, 0x59, 0x45, 0x9C, 0x7A, 0x28, 0xE7, 0xE3, 0xA5, 0xDA,
+    0xDB, 0xC9, 0xE9, 0xCE, 0xF4, 0xB2, 0x6B, 0xFE, 0xAB, 0x72,
+    0xAD, 0x90, 0x77, 0xD5, 0x62, 0x5B, 0xAB, 0x12, 0x34, 0x9B,
+    0x40, 0x0A, 0x4C, 0x03, 0xBC, 0x53
   };
-  static unsigned char dh1024_g[] = { 0x02 };
+  static unsigned char dh2048_g[] = { 0x02 };
 
   DH *dh;
+#if !(OPENSSL_VERSION_NUMBER < 0x10100005L || defined(LIBRESSL_VERSION_NUMBER))
+  BIGNUM *p, *g;
+#endif
+
   dh = DH_new();
 
 #if OPENSSL_VERSION_NUMBER < 0x10100005L || defined(LIBRESSL_VERSION_NUMBER)
-  dh->p = BN_bin2bn(dh1024_p, sizeof(dh1024_p), NULL);
-  dh->g = BN_bin2bn(dh1024_g, sizeof(dh1024_g), NULL);
+  dh->p = BN_bin2bn(dh2048_p, sizeof(dh2048_p), NULL);
+  dh->g = BN_bin2bn(dh2048_g, sizeof(dh2048_g), NULL);
 
   if ((dh->p == NULL) || (dh->g == NULL)) {
     DH_free(dh);
     return NULL;
   }
 #else
-  BIGNUM *p, *g;
-  p = BN_bin2bn(dh1024_p, sizeof(dh1024_p), NULL);
-  g = BN_bin2bn(dh1024_g, sizeof(dh1024_g), NULL);
+  p = BN_bin2bn(dh2048_p, sizeof(dh2048_p), NULL);
+  g = BN_bin2bn(dh2048_g, sizeof(dh2048_g), NULL);
 
   if (p == NULL || g == NULL || !DH_set0_pqg(dh, p, NULL, g)) {
     DH_free(dh);
@@ -112,6 +120,37 @@ DH *get_dh1024() {
   return dh;
 }
 
+static void
+sslctx_free(void *ptr) {
+  SSL_CTX *ctx = ptr;
+  SSL_CTX_free(ctx);
+}
+
+static const rb_data_type_t sslctx_type = {
+  "MiniSSL/SSLContext",
+  {
+    0, sslctx_free,
+  },
+  0, 0, RUBY_TYPED_FREE_IMMEDIATELY,
+};
+
+ms_conn* engine_alloc(VALUE klass, VALUE* obj) {
+  ms_conn* conn;
+
+  *obj = TypedData_Make_Struct(klass, ms_conn, &engine_data_type, conn);
+
+  conn->read = BIO_new(BIO_s_mem());
+  BIO_set_nbio(conn->read, 1);
+
+  conn->write = BIO_new(BIO_s_mem());
+  BIO_set_nbio(conn->write, 1);
+
+  conn->ssl = 0;
+  conn->ctx = 0;
+
+  return conn;
+}
+
 static int engine_verify_callback(int preverify_ok, X509_STORE_CTX* ctx) {
   X509* err_cert;
   SSL* ssl;
@@ -138,44 +177,108 @@ static int engine_verify_callback(int preverify_ok, X509_STORE_CTX* ctx) {
   return preverify_ok;
 }
 
-VALUE engine_init_server(VALUE self, VALUE mini_ssl_ctx) {
-  VALUE obj;
+static VALUE
+sslctx_alloc(VALUE klass) {
+  SSL_CTX *ctx;
+  long mode = 0 |
+    SSL_MODE_ENABLE_PARTIAL_WRITE |
+    SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER |
+    SSL_MODE_RELEASE_BUFFERS;
+
+#ifdef HAVE_TLS_SERVER_METHOD
+  ctx = SSL_CTX_new(TLS_method());
+  // printf("\nctx using TLS_method security_level %d\n", SSL_CTX_get_security_level(ctx));
+#else
+  ctx = SSL_CTX_new(SSLv23_method());
+#endif
+  if (!ctx) {
+    rb_raise(eError, "SSL_CTX_new");
+  }
+  SSL_CTX_set_mode(ctx, mode);
+
+  return TypedData_Wrap_Struct(klass, &sslctx_type, ctx);
+}
+
+VALUE
+sslctx_initialize(VALUE self, VALUE mini_ssl_ctx) {
   SSL_CTX* ctx;
-  SSL* ssl;
 
-  ms_conn* conn = engine_alloc(self, &obj);
+#ifdef HAVE_SSL_CTX_SET_MIN_PROTO_VERSION
+  int min;
+#endif
+  int ssl_options;
+  VALUE key, cert, ca, verify_mode, ssl_cipher_filter, no_tlsv1, no_tlsv1_1,
+    verification_flags;
+  DH *dh;
+
+#if OPENSSL_VERSION_NUMBER < 0x10002000L
+  EC_KEY *ecdh;
+#endif
 
-  ID sym_key = rb_intern("key");
-  VALUE key = rb_funcall(mini_ssl_ctx, sym_key, 0);
+  TypedData_Get_Struct(self, SSL_CTX, &sslctx_type, ctx);
 
+  key = rb_funcall(mini_ssl_ctx, rb_intern_const("key"), 0);
   StringValue(key);
 
-  ID sym_cert = rb_intern("cert");
-  VALUE cert = rb_funcall(mini_ssl_ctx, sym_cert, 0);
-
+  cert = rb_funcall(mini_ssl_ctx, rb_intern_const("cert"), 0);
   StringValue(cert);
 
-  ID sym_ca = rb_intern("ca");
-  VALUE ca = rb_funcall(mini_ssl_ctx, sym_ca, 0);
+  ca = rb_funcall(mini_ssl_ctx, rb_intern_const("ca"), 0);
 
-  ID sym_verify_mode = rb_intern("verify_mode");
-  VALUE verify_mode = rb_funcall(mini_ssl_ctx, sym_verify_mode, 0);
+  verify_mode = rb_funcall(mini_ssl_ctx, rb_intern_const("verify_mode"), 0);
 
-  ID sym_ssl_cipher_filter = rb_intern("ssl_cipher_filter");
-  VALUE ssl_cipher_filter = rb_funcall(mini_ssl_ctx, sym_ssl_cipher_filter, 0);
+  ssl_cipher_filter = rb_funcall(mini_ssl_ctx, rb_intern_const("ssl_cipher_filter"), 0);
 
-  ctx = SSL_CTX_new(SSLv23_server_method());
-  conn->ctx = ctx;
+  no_tlsv1 = rb_funcall(mini_ssl_ctx, rb_intern_const("no_tlsv1"), 0);
+
+  no_tlsv1_1 = rb_funcall(mini_ssl_ctx, rb_intern_const("no_tlsv1_1"), 0);
 
   SSL_CTX_use_certificate_chain_file(ctx, RSTRING_PTR(cert));
   SSL_CTX_use_PrivateKey_file(ctx, RSTRING_PTR(key), SSL_FILETYPE_PEM);
 
+  verification_flags = rb_funcall(mini_ssl_ctx, rb_intern_const("verification_flags"), 0);
+
+  if (!NIL_P(verification_flags)) {
+    X509_VERIFY_PARAM *param = SSL_CTX_get0_param(ctx);
+    X509_VERIFY_PARAM_set_flags(param, NUM2INT(verification_flags));
+    SSL_CTX_set1_param(ctx, param);
+  }
+
   if (!NIL_P(ca)) {
     StringValue(ca);
     SSL_CTX_load_verify_locations(ctx, RSTRING_PTR(ca), NULL);
   }
 
-  SSL_CTX_set_options(ctx, SSL_OP_CIPHER_SERVER_PREFERENCE | SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | SSL_OP_SINGLE_DH_USE | SSL_OP_SINGLE_ECDH_USE | SSL_OP_NO_COMPRESSION);
+  ssl_options = SSL_OP_CIPHER_SERVER_PREFERENCE | SSL_OP_SINGLE_ECDH_USE | SSL_OP_NO_COMPRESSION;
+
+#ifdef HAVE_SSL_CTX_SET_MIN_PROTO_VERSION
+  if (RTEST(no_tlsv1_1)) {
+    min = TLS1_2_VERSION;
+  }
+  else if (RTEST(no_tlsv1)) {
+    min = TLS1_1_VERSION;
+  }
+  else {
+    min = TLS1_VERSION;
+  }
+
+  SSL_CTX_set_min_proto_version(ctx, min);
+
+  SSL_CTX_set_options(ctx, ssl_options);
+
+#else
+  /* As of 1.0.2f, SSL_OP_SINGLE_DH_USE key use is always on */
+  ssl_options |= SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | SSL_OP_SINGLE_DH_USE;
+
+  if (RTEST(no_tlsv1)) {
+    ssl_options |= SSL_OP_NO_TLSv1;
+  }
+  if(RTEST(no_tlsv1_1)) {
+    ssl_options |= SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1;
+  }
+  SSL_CTX_set_options(ctx, ssl_options);
+#endif
+
   SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_OFF);
 
   if (!NIL_P(ssl_cipher_filter)) {
@@ -186,29 +289,45 @@ VALUE engine_init_server(VALUE self, VALUE mini_ssl_ctx) {
     SSL_CTX_set_cipher_list(ctx, "HIGH:!aNULL@STRENGTH");
   }
 
-  DH *dh = get_dh1024();
+  dh = get_dh2048();
   SSL_CTX_set_tmp_dh(ctx, dh);
 
-#ifndef OPENSSL_NO_ECDH
-  EC_KEY *ecdh = EC_KEY_new_by_curve_name(NID_secp521r1);
+#if OPENSSL_VERSION_NUMBER < 0x10002000L
+  // Remove this case if OpenSSL 1.0.1 (now EOL) support is no
+  // longer needed.
+  ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
   if (ecdh) {
     SSL_CTX_set_tmp_ecdh(ctx, ecdh);
     EC_KEY_free(ecdh);
   }
+#elif OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
+  SSL_CTX_set_ecdh_auto(ctx, 1);
 #endif
 
-  ssl = SSL_new(ctx);
-  conn->ssl = ssl;
-  SSL_set_app_data(ssl, NULL);
-
   if (NIL_P(verify_mode)) {
-    /* SSL_set_verify(ssl, SSL_VERIFY_NONE, NULL); */
+    /* SSL_CTX_set_verify(ctx, SSL_VERIFY_NONE, NULL); */
   } else {
-    SSL_set_verify(ssl, NUM2INT(verify_mode), engine_verify_callback);
+    SSL_CTX_set_verify(ctx, NUM2INT(verify_mode), engine_verify_callback);
   }
+  // printf("\ninitialize end security_level %d\n", SSL_CTX_get_security_level(ctx));
+  rb_obj_freeze(self);
+  return self;
+}
 
-  SSL_set_bio(ssl, conn->read, conn->write);
+VALUE engine_init_server(VALUE self, VALUE sslctx) {
+  ms_conn* conn;
+  VALUE obj;
+  SSL_CTX* ctx;
+  SSL* ssl;
 
+  conn = engine_alloc(self, &obj);
+
+  TypedData_Get_Struct(sslctx, SSL_CTX, &sslctx_type, ctx);
+
+  ssl = SSL_new(ctx);
+  conn->ssl = ssl;
+  SSL_set_app_data(ssl, NULL);
+  SSL_set_bio(ssl, conn->read, conn->write);
   SSL_set_accept_state(ssl);
   return obj;
 }
@@ -216,8 +335,11 @@ VALUE engine_init_server(VALUE self, VALUE mini_ssl_ctx) {
 VALUE engine_init_client(VALUE klass) {
   VALUE obj;
   ms_conn* conn = engine_alloc(klass, &obj);
-
+#ifdef HAVE_DTLS_METHOD
+  conn->ctx = SSL_CTX_new(DTLS_method());
+#else
   conn->ctx = SSL_CTX_new(DTLSv1_method());
+#endif
   conn->ssl = SSL_new(conn->ctx);
   SSL_set_app_data(conn->ssl, NULL);
   SSL_set_verify(conn->ssl, SSL_VERIFY_NONE, NULL);
@@ -232,7 +354,7 @@ VALUE engine_inject(VALUE self, VALUE str) {
   ms_conn* conn;
   long used;
 
-  Data_Get_Struct(self, ms_conn, conn);
+  TypedData_Get_Struct(self, ms_conn, &engine_data_type, conn);
 
   StringValue(str);
 
@@ -245,13 +367,14 @@ VALUE engine_inject(VALUE self, VALUE str) {
   return INT2FIX(used);
 }
 
-static VALUE eError;
+NORETURN(void raise_error(SSL* ssl, int result));
 
 void raise_error(SSL* ssl, int result) {
   char buf[512];
   char msg[512];
   const char* err_str;
   int err = errno;
+  int mask = 4095;
   int ssl_err = SSL_get_error(ssl, result);
   int verify_err = (int) SSL_get_verify_result(ssl);
 
@@ -268,8 +391,7 @@ void raise_error(SSL* ssl, int result) {
     } else {
       err = (int) ERR_get_error();
       ERR_error_string_n(err, buf, sizeof(buf));
-      snprintf(msg, sizeof(msg), "OpenSSL error: %s - %d", buf, err);
-
+      snprintf(msg, sizeof(msg), "OpenSSL error: %s - %d", buf, err & mask);
     }
   } else {
     snprintf(msg, sizeof(msg), "Unknown OpenSSL error: %d", ssl_err);
@@ -284,7 +406,7 @@ VALUE engine_read(VALUE self) {
   char buf[512];
   int bytes, error;
 
-  Data_Get_Struct(self, ms_conn, conn);
+  TypedData_Get_Struct(self, ms_conn, &engine_data_type, conn);
 
   ERR_clear_error();
 
@@ -311,7 +433,7 @@ VALUE engine_write(VALUE self, VALUE str) {
   ms_conn* conn;
   int bytes;
 
-  Data_Get_Struct(self, ms_conn, conn);
+  TypedData_Get_Struct(self, ms_conn, &engine_data_type, conn);
 
   StringValue(str);
 
@@ -333,9 +455,11 @@ VALUE engine_extract(VALUE self) {
   ms_conn* conn;
   int bytes;
   size_t pending;
-  char buf[512];
+  // https://www.openssl.org/docs/manmaster/man3/BIO_f_buffer.html
+  // crypto/bio/bf_buff.c DEFAULT_BUFFER_SIZE
+  char buf[4096];
 
-  Data_Get_Struct(self, ms_conn, conn);
+  TypedData_Get_Struct(self, ms_conn, &engine_data_type, conn);
 
   pending = BIO_pending(conn->write);
   if(pending > 0) {
@@ -354,7 +478,7 @@ VALUE engine_shutdown(VALUE self) {
   ms_conn* conn;
   int ok;
 
-  Data_Get_Struct(self, ms_conn, conn);
+  TypedData_Get_Struct(self, ms_conn, &engine_data_type, conn);
 
   ERR_clear_error();
 
@@ -369,7 +493,7 @@ VALUE engine_shutdown(VALUE self) {
 VALUE engine_init(VALUE self) {
   ms_conn* conn;
 
-  Data_Get_Struct(self, ms_conn, conn);
+  TypedData_Get_Struct(self, ms_conn, &engine_data_type, conn);
 
   return SSL_in_init(conn->ssl) ? Qtrue : Qfalse;
 }
@@ -382,7 +506,7 @@ VALUE engine_peercert(VALUE self) {
   ms_cert_buf* cert_buf = NULL;
   VALUE rb_cert_buf;
 
-  Data_Get_Struct(self, ms_conn, conn);
+  TypedData_Get_Struct(self, ms_conn, &engine_data_type, conn);
 
   cert = SSL_get_peer_certificate(conn->ssl);
   if(!cert) {
@@ -413,12 +537,22 @@ VALUE engine_peercert(VALUE self) {
   return rb_cert_buf;
 }
 
+/* @see Puma::MiniSSL::Socket#ssl_version_state
+ * @version 5.0.0
+ */
+static VALUE
+engine_ssl_vers_st(VALUE self) {
+  ms_conn* conn;
+  TypedData_Get_Struct(self, ms_conn, &engine_data_type, conn);
+  return rb_ary_new3(2, rb_str_new2(SSL_get_version(conn->ssl)), rb_str_new2(SSL_state_string(conn->ssl)));
+}
+
 VALUE noop(VALUE self) {
   return Qnil;
 }
 
 void Init_mini_ssl(VALUE puma) {
-  VALUE mod, eng;
+  VALUE mod, eng, sslctx;
 
 /* Fake operation for documentation (RDoc, YARD) */
 #if 0 == 1
@@ -432,17 +566,43 @@ void Init_mini_ssl(VALUE puma) {
 
   mod = rb_define_module_under(puma, "MiniSSL");
   eng = rb_define_class_under(mod, "Engine", rb_cObject);
+  sslctx = rb_define_class_under(mod, "SSLContext", rb_cObject);
+  rb_define_alloc_func(sslctx, sslctx_alloc);
+  rb_define_method(sslctx, "initialize", sslctx_initialize, 1);
+  rb_undef_method(sslctx, "initialize_copy");
+
 
   // OpenSSL Build / Runtime/Load versions
 
   /* Version of OpenSSL that Puma was compiled with */
-	rb_define_const(mod, "OPENSSL_VERSION", rb_str_new2(OPENSSL_VERSION_TEXT));
+  rb_define_const(mod, "OPENSSL_VERSION", rb_str_new2(OPENSSL_VERSION_TEXT));
 
 #if !defined(LIBRESSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= 0x10100000
-	/* Version of OpenSSL that Puma loaded with */
-	rb_define_const(mod, "OPENSSL_LIBRARY_VERSION", rb_str_new2(OpenSSL_version(OPENSSL_VERSION)));
+  /* Version of OpenSSL that Puma loaded with */
+  rb_define_const(mod, "OPENSSL_LIBRARY_VERSION", rb_str_new2(OpenSSL_version(OPENSSL_VERSION)));
+#else
+  rb_define_const(mod, "OPENSSL_LIBRARY_VERSION", rb_str_new2(SSLeay_version(SSLEAY_VERSION)));
+#endif
+
+#if defined(OPENSSL_NO_SSL3) || defined(OPENSSL_NO_SSL3_METHOD)
+  /* True if SSL3 is not available */
+  rb_define_const(mod, "OPENSSL_NO_SSL3", Qtrue);
+#else
+  rb_define_const(mod, "OPENSSL_NO_SSL3", Qfalse);
+#endif
+
+#if defined(OPENSSL_NO_TLS1) || defined(OPENSSL_NO_TLS1_METHOD)
+  /* True if TLS1 is not available */
+  rb_define_const(mod, "OPENSSL_NO_TLS1", Qtrue);
 #else
-	rb_define_const(mod, "OPENSSL_LIBRARY_VERSION", rb_str_new2(SSLeay_version(SSLEAY_VERSION)));
+  rb_define_const(mod, "OPENSSL_NO_TLS1", Qfalse);
+#endif
+
+#if defined(OPENSSL_NO_TLS1_1) || defined(OPENSSL_NO_TLS1_1_METHOD)
+  /* True if TLS1_1 is not available */
+  rb_define_const(mod, "OPENSSL_NO_TLS1_1", Qtrue);
+#else
+  rb_define_const(mod, "OPENSSL_NO_TLS1_1", Qfalse);
 #endif
 
   rb_define_singleton_method(mod, "check", noop, 0);
@@ -463,13 +623,16 @@ void Init_mini_ssl(VALUE puma) {
   rb_define_method(eng, "init?", engine_init, 0);
 
   rb_define_method(eng, "peercert", engine_peercert, 0);
+
+  rb_define_method(eng, "ssl_vers_st", engine_ssl_vers_st, 0);
 }
 
 #else
 
+NORETURN(VALUE raise_error(VALUE self));
+
 VALUE raise_error(VALUE self) {
   rb_raise(rb_eStandardError, "SSL not available in this build");
-  return Qnil;
 }
 
 void Init_mini_ssl(VALUE puma) {