puma 4.1.1 → 4.3.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e85f11b3b0951de326c5bba3f9f11c77bd1f4b28d6bc82d0f33ba8c6f7ebfd2d
-  data.tar.gz: 481c1977d845730e2fe5f1186861b6e31f6fe5141f9b90b1d5269a4fcb293657
+  metadata.gz: d378ab70a4eac21fe4bf571b95b655d6cbc590b2b91ac323f849986bf8f7ad6c
+  data.tar.gz: 1b288cc39f5d80119dde26e844490e572b5f1043060060a1a1d70180743123c3
 SHA512:
-  metadata.gz: 25f5a271f646bb1d4695279a5fa21a5be43639a01bcd6647adc484f84e84fc2a227097278da57456bf81de4996c749c0f6c80f9fd249e24a79555e44431bb19b
-  data.tar.gz: 2defc82769f5c36810f21aaf3f93aaad52e9073e55cb8f19aa0dbc4cfc2dcab37fd0cf458aef58b2025626ff4a59174aff7fa0faa9ebe5a3333fa7dd69ff5df7
+  metadata.gz: b63ddad40bdeae9c86d62af5bf044238e273cbf8e95ff944d7b0a736dd39532dfe3b562a77c97b14f86d8e3f916b7cb94ccdbf898e75c4088d075d20e83744d5
+  data.tar.gz: abc975210626407c096848540f068a9731ecdc5191327b3ad87355ef4b88b6ac2605ccc7e31ca5398cd787cf9a34efdffc501afe61a2542cc322768af7b26830

data/History.md

@@ -1,10 +1,64 @@
-## Master
+## 4.3.6 / 2020-09-05
+
+* Bugfixes
+  * Explicitly include ctype.h to fix compilation warning and build error on macOS with Xcode 12 (#2304)
+  * Don't require json at boot (#2269)
+
+## 4.3.4/4.3.5 and 3.12.5/3.12.6 / 2020-05-22
+
+Each patchlevel release contains a separate security fix. We recommend simply upgrading to 4.3.5/3.12.6.
+
+## 4.3.3 and 3.12.4 / 2020-02-28
+  * Bugfixes
+    * Fix: Fixes a problem where we weren't splitting headers correctly on newlines (#2132)
+  * Security
+    * Fix: Prevent HTTP Response splitting via CR in early hints.
+
+## 4.3.2 and 3.12.3 / 2020-02-27
+
+* Security
+  * Fix: Prevent HTTP Response splitting via CR/LF in header values. CVE-2020-5247.
+
+## 4.3.1 and 3.12.2 / 2019-12-05
+
+* Security
+  * Fix: a poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. CVE-2019-16770.
+
+## 4.3.0 / 2019-11-07
 
 * Features
-  * Your feature goes here (#Github Number)
+  * Strip whitespace at end of HTTP headers (#2010)
+  * Optimize HTTP parser for JRuby (#2012)
+  * Add SSL support for the control app and cli (#2046, #2052)
 
 * Bugfixes
-  * Your bugfix goes here (#Github Number)
+  * Fix Errno::EINVAL when SSL is enabled and browser rejects cert (#1564)
+  * Fix pumactl defaulting puma to development if an environment was not specified (#2035)
+  * Fix closing file stream when reading pid from pidfile (#2048)
+  * Fix a typo in configuration option `--extra_runtime_dependencies` (#2050)
+
+## 4.2.1 / 2019-10-07
+
+* 3 bugfixes
+  * Fix socket activation of systemd (pre-existing) unix binder files (#1842, #1988)
+  * Deal with multiple calls to bind correctly (#1986, #1994, #2006)
+  * Accepts symbols for `verify_mode` (#1222)
+
+## 4.2.0 / 2019-09-23
+
+* 6 features
+  * Pumactl has a new -e environment option and reads `config/puma/<environment>.rb` config files (#1885)
+  * Semicolons are now allowed in URL paths (MRI only), useful for Angular or Redmine (#1934)
+  * Allow extra dependencies to be defined when using prune_bundler (#1105)
+  * Puma now reports the correct port when binding to port 0, also reports other listeners when binding to localhost (#1786)
+  * Sending SIGINFO to any Puma worker now prints currently active threads and their backtraces (#1320)
+  * Puma threads all now have their name set on Ruby 2.3+ (#1968)
+* 4 bugfixes
+  * Fix some misbehavior with phased restart and externally SIGTERMed workers (#1908, #1952)
+  * Fix socket closing on error (#1941)
+  * Removed unnecessary SIGINT trap for JRuby that caused some race conditions (#1961)
+  * Fix socket files being left around after process stopped (#1970)
+* Absolutely thousands of lines of test improvements and fixes thanks to @MSP-Greg
 
 ## 4.1.1 / 2019-09-05
 
@@ -15,7 +69,7 @@
 
 ## 4.1.0 / 2019-08-08
 
-* 4 features 
+* 4 features
   * Add REQUEST_PATH on parse error message (#1831)
   * You can now easily add custom log formatters with the `log_formatter` config option (#1816)
   * Puma.stats now provides process start times (#1844)
@@ -29,17 +83,17 @@
   * SSL read_nonblock no longer blocks (#1857)
   * Swallow connection errors when sending early hints (#1822)
   * Backtrace no longer dumped when invalid pumactl commands are run (#1863)
-  
-* 5 other 
+
+* 5 other
   * Avoid casting worker_timeout twice (#1838)
   * Removed a call to private that wasn't doing anything (#1882)
   * README, Rakefile, docs and test cleanups (#1848, #1847, #1846, #1853, #1859, #1850, #1866, #1870, #1872, #1833, #1888)
   * Puma.io has proper documentation now (https://puma.io/puma/)
   * Added the Contributor Covenant CoC
-  
-* 1 known issue 
+
+* 1 known issue
   * Some users are still experiencing issues surrounding socket activation and Unix sockets (#1842)
-  
+
 ## 4.0.1 / 2019-07-11
 
 * 2 bugfixes
@@ -61,7 +115,7 @@
   * Reactor now uses nio4r instead of `select` (#1728)
   * Add status to pumactl with pidfile (#1824)
 
-* 9 bugfixes
+* 10 bugfixes
   * Do not accept new requests on shutdown (#1685, #1808)
   * Fix 3 corner cases when request body is chunked (#1508)
   * Change pid existence check's condition branches (#1650)
@@ -71,6 +125,13 @@
   * Fix Java 8 support (#1773)
   * Fix error `uninitialized constant Puma::Cluster` (#1731)
   * Fix `not_token` being able to be set to true (#1803)
+  * Fix "Hang on SIGTERM with ruby 2.6 in clustered mode" ([PR #1741], [#1674], [#1720], [#1730], [#1755])
+
+[PR #1741]: https://github.com/puma/puma/pull/1741
+[#1674]: https://github.com/puma/puma/issues/1674
+[#1720]: https://github.com/puma/puma/issues/1720
+[#1730]: https://github.com/puma/puma/issues/1730
+[#1755]: https://github.com/puma/puma/issues/1755
 
 ## 3.12.1 / 2019-03-19
 

data/README.md

@@ -5,8 +5,9 @@
 # Puma: A Ruby Web Server Built For Concurrency
 
 [![Gitter](https://badges.gitter.im/Join%20Chat.svg)](https://gitter.im/puma/puma?utm\_source=badge&utm\_medium=badge&utm\_campaign=pr-badge)
-[![Travis Build Status](https://secure.travis-ci.org/puma/puma.svg)](https://travis-ci.org/puma/puma)
-[![Appveyor Build Status](https://ci.appveyor.com/api/projects/status/0xnxc7a26u9b2bub/branch/master?svg=true)](https://ci.appveyor.com/project/puma/puma/branch/master)
+[![Actions Build Status](https://github.com/puma/puma/workflows/Puma/badge.svg)](https://github.com/puma/puma/actions)
+[![Travis Build Status](https://travis-ci.org/puma/puma.svg?branch=master)](https://travis-ci.org/puma/puma)
+
 [![Code Climate](https://codeclimate.com/github/puma/puma.svg)](https://codeclimate.com/github/puma/puma)
 [![SemVer](https://api.dependabot.com/badges/compatibility_score?dependency-name=puma&package-manager=bundler&version-scheme=semver)](https://dependabot.com/compatibility-score.html?dependency-name=puma&package-manager=bundler&version-scheme=semver)
 
@@ -16,7 +17,7 @@ Puma is a **simple, fast, multi-threaded, and highly concurrent HTTP 1.1 server
 
 Puma processes requests using a C-optimized Ragel extension (inherited from Mongrel) that provides fast, accurate HTTP 1.1 protocol parsing in a portable way. Puma then serves the request using a thread pool. Each request is served in a separate thread, so truly concurrent Ruby implementations (JRuby, Rubinius) will use all available CPU cores.
 
-Puma was designed to be the go-to server for [Rubinius](https://rubini.us), but also works well with JRuby and MRI.
+Puma was designed to be the go-to server for [Rubinius](https://rubinius.com), but also works well with JRuby and MRI.
 
 On MRI, there is a Global VM Lock (GVL) that ensures only one thread can run Ruby code at a time. But if you're doing a lot of blocking IO (such as HTTP calls to external APIs like Twitter), Puma still improves MRI's throughput by allowing IO waiting to be done in parallel.
 
@@ -118,17 +119,6 @@ This code can be used to setup the process before booting the application, allow
 you to do some Puma-specific things that you don't want to embed in your application.
 For instance, you could fire a log notification that a worker booted or send something to statsd. This can be called multiple times.
 
-If you're preloading your application and using ActiveRecord, it's recommended that you setup your connection pool here:
-
-```ruby
-# config/puma.rb
-on_worker_boot do
-  ActiveSupport.on_load(:active_record) do
-    ActiveRecord::Base.establish_connection
-  end
-end
-```
-
 `before_fork` specifies a block to be run before workers are forked:
 
 ```ruby
@@ -238,6 +228,8 @@ If you want to prevent Puma from looking for a configuration file in those locat
 $ puma -C "-"
 ```
 
+The other side-effects of setting the environment are whether to show stack traces (in `development` or `test`), and setting RACK_ENV may potentially affect middleware looking for this value to change their behavior. The default puma RACK_ENV value is `development`. You can see all config default values [here](https://github.com/puma/puma/blob/12d1706ddc71b89ed2ee26275e31c788e94ff541/lib/puma/configuration.rb#L170).
+
 Check out [dsl.rb](https://github.com/puma/puma/blob/master/lib/puma/dsl.rb) to see all available options.
 
 ## Restart
@@ -290,30 +282,9 @@ reliability in production environments:
 
 ## Contributing
 
-To run the test suite:
-
-```bash
-$ bundle install
-$ bundle exec rake
-```
-
-To run a single test file, use the `TEST` environment variable:
-
-```bash
-$ TEST=test/test_binder.rb bundle exec rake test
-```
-
-Or use [`m`](https://github.com/qrush/m):
+Find details for contributing in the [contribution guide].
 
-```
-$ bundle exec m test/test_binder.rb
-```
-
-Which can also be used to run a single test case:
-
-```
-$ bundle exec m test/test_binder.rb:37
-```
+[contribution guide]: https://github.com/puma/puma/blob/master/CONTRIBUTING.md
 
 ## License
 

data/docs/plugins.md

@@ -1,15 +1,22 @@
 ## Plugins
 
-Puma 3.0 added support for plugins that can augment configuration and service operations.
+Puma 3.0 added support for plugins that can augment configuration and service
+operations.
 
 2 canonical plugins to look to aid in development of further plugins:
 
-* [tmp\_restart](https://github.com/puma/puma/blob/master/lib/puma/plugin/tmp_restart.rb): Restarts the server if the file `tmp/restart.txt` is touched
-* [heroku](https://github.com/puma/puma-heroku/blob/master/lib/puma/plugin/heroku.rb): Packages up the default configuration used by puma on Heroku
+* [tmp\_restart](https://github.com/puma/puma/blob/master/lib/puma/plugin/tmp_restart.rb):
+  Restarts the server if the file `tmp/restart.txt` is touched
+* [heroku](https://github.com/puma/puma-heroku/blob/master/lib/puma/plugin/heroku.rb):
+  Packages up the default configuration used by puma on Heroku
 
-Plugins are activated in a puma configuration file (such as `config/puma.rb'`) by adding `plugin "name"`, such as `plugin "heroku"`.
+Plugins are activated in a puma configuration file (such as `config/puma.rb'`)
+by adding `plugin "name"`, such as `plugin "heroku"`.
 
-Plugins are activated based simply on path requirements so, activating the `heroku` plugin will simply be doing `require "puma/plugin/heroku"`. This allows gems to provide multiple plugins (as well as unrelated gems to provide puma plugins).
+Plugins are activated based simply on path requirements so, activating the
+`heroku` plugin will simply be doing `require "puma/plugin/heroku"`. This
+allows gems to provide multiple plugins (as well as unrelated gems to provide
+puma plugins).
 
 The `tmp_restart` plugin is bundled with puma, so it can always be used.
 
@@ -17,12 +24,15 @@ To use the `heroku` plugin, add `puma-heroku` to your Gemfile or install it.
 
 ### API
 
-At present, there are 2 hooks that plugins can use: `start` and `config`.
+## Server-wide hooks
 
-`start` runs when the server has started and allows the plugin to start other functionality to augment puma.
+Plugins can use a couple of hooks at server level: `start` and `config`.
 
-`config` runs when the server is being configured and is passed a `Puma::DSL` object that can be used to add additional configuration.
+`start` runs when the server has started and allows the plugin to start other
+functionality to augment puma.
 
-Any public methods in `Puma::Plugin` are the public API that any plugin may use.
+`config` runs when the server is being configured and is passed a `Puma::DSL`
+object that can be used to add additional configuration.
 
-In the future, more hooks and APIs will be added.
+Any public methods in `Puma::Plugin` are the public API that any plugin may
+use.

data/docs/tcp_mode.md

@@ -0,0 +1,96 @@
+# TCP mode
+
+Puma also could be used as a TCP server to process incoming TCP
+connections.
+
+
+## Configuration
+
+TCP mode can be enabled with CLI option `--tcp-mode`:
+
+```
+$ puma --tcp-mode
+```
+
+Default ip and port to listen to are `0.0.0.0` and `9292`. You can configure
+them with `--port` and `--bind` options:
+
+```
+$ puma --tcp-mode --bind tcp://127.0.0.1:9293
+$ puma --tcp-mode --port 9293
+```
+
+TCP mode could be set with a configuration file as well with `tcp_mode`
+and `tcp_mode!` methods:
+
+```
+# config/puma.rb
+tcp_mode
+```
+
+When Puma starts in the TCP mode it prints the corresponding message:
+
+```
+puma --tcp-mode
+Puma starting in single mode...
+...
+* Mode: Lopez Express (tcp)
+```
+
+
+## How to declare an application
+
+An application to process TCP connections should be declared as a
+callable object which accepts `env` and `socket` arguments.
+
+`env` argument is a Hash with following structure:
+
+```ruby
+{ "thread" => {}, "REMOTE_ADDR" => "127.0.0.1:51133", "log" => "#<Proc:0x000..." }
+```
+
+It consists of:
+* `thread` - a Hash for each thread in the thread pool that could be
+  used to store information between requests
+* `REMOTE_ADDR` - a client ip address
+* `log` - a proc object to write something down
+
+`log` object could be used this way:
+
+```ruby
+env['log'].call('message to log')
+#> 19/Oct/2019 20:28:53 - 127.0.0.1:51266 - message to log
+```
+
+
+## Example of an application
+
+Let's look at an example of a simple application which just echoes
+incoming string:
+
+```ruby
+# config/puma.rb
+app do |env, socket|
+  s = socket.gets
+  socket.puts "Echo #{s}"
+end
+```
+
+We can easily access the TCP server with `telnet` command and receive an
+echo:
+
+```shell
+telnet 0.0.0.0 9293
+Trying 0.0.0.0...
+Connected to 0.0.0.0.
+Escape character is '^]'.
+sssss
+Echo sssss
+^CConnection closed by foreign host.
+```
+
+
+## Socket management
+
+After the application finishes, Puma closes the socket. In order to
+prevent this, the application should set `env['detach'] = true`.

data/ext/puma_http11/extconf.rb

@@ -1,6 +1,11 @@
 require 'mkmf'
 
 dir_config("puma_http11")
+if RUBY_PLATFORM[/mingw32/]
+  append_cflags '-D_FORTIFY_SOURCE=2'
+  append_ldflags '-fstack-protector'
+  have_library 'ssp'
+end
 
 unless ENV["DISABLE_SSL"]
   dir_config("openssl")

data/ext/puma_http11/http11_parser.c

@@ -14,12 +14,14 @@
 
 /*
  * capitalizes all lower-case ASCII characters,
- * converts dashes to underscores.
+ * converts dashes to underscores, and underscores to commas.
  */
 static void snake_upcase_char(char *c)
 {
     if (*c >= 'a' && *c <= 'z')
       *c &= ~0x20;
+    else if (*c == '_')
+      *c = ',';
     else if (*c == '-')
       *c = '_';
 }
@@ -38,7 +40,7 @@ static void snake_upcase_char(char *c)
 
 #line 40 "ext/puma_http11/http11_parser.c"
 static const int puma_parser_start = 1;
-static const int puma_parser_first_final = 47;
+static const int puma_parser_first_final = 46;
 static const int puma_parser_error = 0;
 
 static const int puma_parser_en_main = 1;
@@ -117,17 +119,17 @@ case 2:
 #line 118 "ext/puma_http11/http11_parser.c"
 	switch( (*p) ) {
 		case 32: goto tr2;
-		case 36: goto st28;
-		case 95: goto st28;
+		case 36: goto st27;
+		case 95: goto st27;
 	}
 	if ( (*p) < 48 ) {
 		if ( 45 <= (*p) && (*p) <= 46 )
-			goto st28;
+			goto st27;
 	} else if ( (*p) > 57 ) {
 		if ( 65 <= (*p) && (*p) <= 90 )
-			goto st28;
+			goto st27;
 	} else
-		goto st28;
+		goto st27;
 	goto st0;
 tr2:
 #line 48 "ext/puma_http11/http11_parser.rl"
@@ -199,7 +201,7 @@ tr37:
     parser->request_uri(parser, PTR_TO(mark), LEN(mark, p));
   }
 	goto st5;
-tr44:
+tr41:
 #line 58 "ext/puma_http11/http11_parser.rl"
 	{ MARK(query_start, p); }
 #line 59 "ext/puma_http11/http11_parser.rl"
@@ -211,7 +213,7 @@ tr44:
     parser->request_uri(parser, PTR_TO(mark), LEN(mark, p));
   }
 	goto st5;
-tr47:
+tr44:
 #line 59 "ext/puma_http11/http11_parser.rl"
 	{
     parser->query_string(parser, PTR_TO(query_start), LEN(query_start, p));
@@ -362,13 +364,13 @@ tr22:
 	{
     parser->body_start = p - buffer + 1;
     parser->header_done(parser, p + 1, pe - p - 1);
-    {p++; cs = 47; goto _out;}
+    {p++; cs = 46; goto _out;}
   }
-	goto st47;
-st47:
+	goto st46;
+st46:
 	if ( ++p == pe )
-		goto _test_eof47;
-case 47:
+		goto _test_eof46;
+case 46:
 #line 373 "ext/puma_http11/http11_parser.c"
 	goto st0;
 tr21:
@@ -458,7 +460,7 @@ tr38:
     parser->request_uri(parser, PTR_TO(mark), LEN(mark, p));
   }
 	goto st20;
-tr45:
+tr42:
 #line 58 "ext/puma_http11/http11_parser.rl"
 	{ MARK(query_start, p); }
 #line 59 "ext/puma_http11/http11_parser.rl"
@@ -470,7 +472,7 @@ tr45:
     parser->request_uri(parser, PTR_TO(mark), LEN(mark, p));
   }
 	goto st20;
-tr48:
+tr45:
 #line 59 "ext/puma_http11/http11_parser.rl"
 	{
     parser->query_string(parser, PTR_TO(query_start), LEN(query_start, p));
@@ -576,10 +578,9 @@ case 24:
 		case 32: goto tr37;
 		case 34: goto st0;
 		case 35: goto tr38;
-		case 59: goto tr39;
 		case 60: goto st0;
 		case 62: goto st0;
-		case 63: goto tr40;
+		case 63: goto tr39;
 		case 127: goto st0;
 	}
 	if ( 0 <= (*p) && (*p) <= 31 )
@@ -595,30 +596,27 @@ st25:
 	if ( ++p == pe )
 		goto _test_eof25;
 case 25:
-#line 599 "ext/puma_http11/http11_parser.c"
+#line 598 "ext/puma_http11/http11_parser.c"
 	switch( (*p) ) {
-		case 32: goto tr8;
+		case 32: goto tr41;
 		case 34: goto st0;
-		case 35: goto tr9;
+		case 35: goto tr42;
 		case 60: goto st0;
 		case 62: goto st0;
-		case 63: goto st26;
 		case 127: goto st0;
 	}
 	if ( 0 <= (*p) && (*p) <= 31 )
 		goto st0;
-	goto st25;
+	goto tr40;
 tr40:
-#line 67 "ext/puma_http11/http11_parser.rl"
-	{
-    parser->request_path(parser, PTR_TO(mark), LEN(mark,p));
-  }
+#line 58 "ext/puma_http11/http11_parser.rl"
+	{ MARK(query_start, p); }
 	goto st26;
 st26:
 	if ( ++p == pe )
 		goto _test_eof26;
 case 26:
-#line 622 "ext/puma_http11/http11_parser.c"
+#line 618 "ext/puma_http11/http11_parser.c"
 	switch( (*p) ) {
 		case 32: goto tr44;
 		case 34: goto st0;
@@ -629,27 +627,25 @@ case 26:
 	}
 	if ( 0 <= (*p) && (*p) <= 31 )
 		goto st0;
-	goto tr43;
-tr43:
-#line 58 "ext/puma_http11/http11_parser.rl"
-	{ MARK(query_start, p); }
-	goto st27;
+	goto st26;
 st27:
 	if ( ++p == pe )
 		goto _test_eof27;
 case 27:
-#line 642 "ext/puma_http11/http11_parser.c"
 	switch( (*p) ) {
-		case 32: goto tr47;
-		case 34: goto st0;
-		case 35: goto tr48;
-		case 60: goto st0;
-		case 62: goto st0;
-		case 127: goto st0;
+		case 32: goto tr2;
+		case 36: goto st28;
+		case 95: goto st28;
 	}
-	if ( 0 <= (*p) && (*p) <= 31 )
-		goto st0;
-	goto st27;
+	if ( (*p) < 48 ) {
+		if ( 45 <= (*p) && (*p) <= 46 )
+			goto st28;
+	} else if ( (*p) > 57 ) {
+		if ( 65 <= (*p) && (*p) <= 90 )
+			goto st28;
+	} else
+		goto st28;
+	goto st0;
 st28:
 	if ( ++p == pe )
 		goto _test_eof28;
@@ -960,24 +956,6 @@ st45:
 	if ( ++p == pe )
 		goto _test_eof45;
 case 45:
-	switch( (*p) ) {
-		case 32: goto tr2;
-		case 36: goto st46;
-		case 95: goto st46;
-	}
-	if ( (*p) < 48 ) {
-		if ( 45 <= (*p) && (*p) <= 46 )
-			goto st46;
-	} else if ( (*p) > 57 ) {
-		if ( 65 <= (*p) && (*p) <= 90 )
-			goto st46;
-	} else
-		goto st46;
-	goto st0;
-st46:
-	if ( ++p == pe )
-		goto _test_eof46;
-case 46:
 	if ( (*p) == 32 )
 		goto tr2;
 	goto st0;
@@ -997,7 +975,7 @@ case 46:
 	_test_eof14: cs = 14; goto _test_eof; 
 	_test_eof15: cs = 15; goto _test_eof; 
 	_test_eof16: cs = 16; goto _test_eof; 
-	_test_eof47: cs = 47; goto _test_eof; 
+	_test_eof46: cs = 46; goto _test_eof; 
 	_test_eof17: cs = 17; goto _test_eof; 
 	_test_eof18: cs = 18; goto _test_eof; 
 	_test_eof19: cs = 19; goto _test_eof; 
@@ -1027,7 +1005,6 @@ case 46:
 	_test_eof43: cs = 43; goto _test_eof; 
 	_test_eof44: cs = 44; goto _test_eof; 
 	_test_eof45: cs = 45; goto _test_eof; 
-	_test_eof46: cs = 46; goto _test_eof; 
 
 	_test_eof: {}
 	_out: {}