puma 4.1.1 → 5.0.0

data/lib/puma/minissl.rb

@@ -5,8 +5,18 @@ begin
 rescue LoadError
 end
 
+# need for Puma::MiniSSL::OPENSSL constants used in `HAS_TLS1_3`
+require 'puma/puma_http11'
+
 module Puma
   module MiniSSL
+    # Define constant at runtime, as it's easy to determine at built time,
+    # but Puma could (it shouldn't) be loaded with an older OpenSSL version
+    # @version 5.0.0
+    HAS_TLS1_3 = !IS_JRUBY &&
+      (OPENSSL_VERSION[/ \d+\.\d+\.\d+/].split('.').map(&:to_i) <=> [1,1,1]) != -1 &&
+      (OPENSSL_LIBRARY_VERSION[/ \d+\.\d+\.\d+/].split('.').map(&:to_i) <=> [1,1,1]) !=-1
+
     class Socket
       def initialize(socket, engine)
         @socket = socket
@@ -22,6 +32,26 @@ module Puma
         @socket.closed?
       end
 
+      # Returns a two element array,
+      # first is protocol version (SSL_get_version),
+      # second is 'handshake' state (SSL_state_string)
+      #
+      # Used for dropping tcp connections to ssl.
+      # See OpenSSL ssl/ssl_stat.c SSL_state_string for info
+      # @version 5.0.0
+      #
+      def ssl_version_state
+        IS_JRUBY ? [nil, nil] : @engine.ssl_vers_st
+      end
+
+      # Used to check the handshake status, in particular when a TCP connection
+      # is made with TLSv1.3 as an available protocol
+      # @version 5.0.0
+      def bad_tlsv1_3?
+        HAS_TLS1_3 && @engine.ssl_vers_st == ['TLSv1.3', 'SSLERR']
+      end
+      private :bad_tlsv1_3?
+
       def readpartial(size)
         while true
           output = @engine.read
@@ -41,6 +71,7 @@ module Puma
 
       def engine_read_all
         output = @engine.read
+        raise SSLError.exception "HTTP connection?" if bad_tlsv1_3?
         while output and additional_output = @engine.read
           output << additional_output
         end
@@ -107,14 +138,18 @@ module Puma
       alias_method :<<, :write
 
       # This is a temporary fix to deal with websockets code using
-      # write_nonblock. The problem with implementing it properly
+      # write_nonblock.
+
+      # The problem with implementing it properly
       # is that it means we'd have to have the ability to rewind
       # an engine because after we write+extract, the socket
       # write_nonblock call might raise an exception and later
       # code would pass the same data in, but the engine would think
-      # it had already written the data in. So for the time being
-      # (and since write blocking is quite rare), go ahead and actually
-      # block in write_nonblock.
+      # it had already written the data in.
+      #
+      # So for the time being (and since write blocking is quite rare),
+      # go ahead and actually block in write_nonblock.
+      #
       def write_nonblock(data, *_)
         write data
       end
@@ -125,11 +160,14 @@ module Puma
 
       def read_and_drop(timeout = 1)
         return :timeout unless IO.select([@socket], nil, nil, timeout)
-        return :eof unless read_nonblock(1024)
-        :drop
-      rescue Errno::EAGAIN
-        # do nothing
-        :eagain
+        case @socket.read_nonblock(1024, exception: false)
+        when nil
+          :eof
+        when :wait_readable
+          :eagain
+        else
+          :drop
+        end
       end
 
       def should_drop_bytes?
@@ -141,9 +179,7 @@ module Puma
           # Read any drop any partially initialized sockets and any received bytes during shutdown.
           # Don't let this socket hold this loop forever.
           # If it can't send more packets within 1s, then give up.
-          while should_drop_bytes?
-            return if [:timeout, :eof].include?(read_and_drop(1))
-          end
+          return if [:timeout, :eof].include?(read_and_drop(1)) while should_drop_bytes?
         rescue IOError, SystemCallError
           Thread.current.purge_interrupt_queue if Thread.current.respond_to? :purge_interrupt_queue
           # nothing
@@ -166,12 +202,13 @@ module Puma
       end
     end
 
-    if defined?(JRUBY_VERSION)
+    if IS_JRUBY
+      OPENSSL_NO_SSL3 = false
+      OPENSSL_NO_TLS1 = false
+
       class SSLError < StandardError
         # Define this for jruby even though it isn't used.
       end
-
-      def self.check; end
     end
 
     class Context
@@ -183,7 +220,7 @@ module Puma
         @no_tlsv1_1 = false
       end
 
-      if defined?(JRUBY_VERSION)
+      if IS_JRUBY
         # jruby-specific Context properties: java uses a keystore and password pair rather than a cert/key pair
         attr_reader :keystore
         attr_accessor :keystore_pass
@@ -228,13 +265,13 @@ module Puma
 
       # disables TLSv1
       def no_tlsv1=(tlsv1)
-        raise ArgumentError, "Invalid value of no_tlsv1" unless ['true', 'false', true, false].include?(tlsv1)
+        raise ArgumentError, "Invalid value of no_tlsv1=" unless ['true', 'false', true, false].include?(tlsv1)
         @no_tlsv1 = tlsv1
       end
 
       # disables TLSv1 and TLSv1.1.  Overrides `#no_tlsv1=`
       def no_tlsv1_1=(tlsv1_1)
-        raise ArgumentError, "Invalid value of no_tlsv1" unless ['true', 'false', true, false].include?(tlsv1_1)
+        raise ArgumentError, "Invalid value of no_tlsv1_1=" unless ['true', 'false', true, false].include?(tlsv1_1)
         @no_tlsv1_1 = tlsv1_1
       end
 
@@ -270,6 +307,11 @@ module Puma
         Socket.new io, engine
       end
 
+      # @version 5.0.0
+      def addr
+        @socket.addr
+      end
+
       def close
         @socket.close unless @socket.closed?       # closed? call is for Windows
       end

data/lib/puma/minissl/context_builder.rb

@@ -0,0 +1,73 @@
+module Puma
+  module MiniSSL
+    class ContextBuilder
+      def initialize(params, events)
+        @params = params
+        @events = events
+      end
+
+      def context
+        ctx = MiniSSL::Context.new
+
+        if defined?(JRUBY_VERSION)
+          unless params['keystore']
+            events.error "Please specify the Java keystore via 'keystore='"
+          end
+
+          ctx.keystore = params['keystore']
+
+          unless params['keystore-pass']
+            events.error "Please specify the Java keystore password  via 'keystore-pass='"
+          end
+
+          ctx.keystore_pass = params['keystore-pass']
+          ctx.ssl_cipher_list = params['ssl_cipher_list'] if params['ssl_cipher_list']
+        else
+          unless params['key']
+            events.error "Please specify the SSL key via 'key='"
+          end
+
+          ctx.key = params['key']
+
+          unless params['cert']
+            events.error "Please specify the SSL cert via 'cert='"
+          end
+
+          ctx.cert = params['cert']
+
+          if ['peer', 'force_peer'].include?(params['verify_mode'])
+            unless params['ca']
+              events.error "Please specify the SSL ca via 'ca='"
+            end
+          end
+
+          ctx.ca = params['ca'] if params['ca']
+          ctx.ssl_cipher_filter = params['ssl_cipher_filter'] if params['ssl_cipher_filter']
+        end
+
+        ctx.no_tlsv1 = true if params['no_tlsv1'] == 'true'
+        ctx.no_tlsv1_1 = true if params['no_tlsv1_1'] == 'true'
+
+        if params['verify_mode']
+          ctx.verify_mode = case params['verify_mode']
+                            when "peer"
+                              MiniSSL::VERIFY_PEER
+                            when "force_peer"
+                              MiniSSL::VERIFY_PEER | MiniSSL::VERIFY_FAIL_IF_NO_PEER_CERT
+                            when "none"
+                              MiniSSL::VERIFY_NONE
+                            else
+                              events.error "Please specify a valid verify_mode="
+                              MiniSSL::VERIFY_NONE
+                            end
+        end
+
+        ctx
+      end
+
+      private
+
+      attr_reader :params, :events
+    end
+  end
+end

data/lib/puma/null_io.rb

@@ -15,7 +15,7 @@ module Puma
     # Mimics IO#read with no data.
     #
     def read(count = nil, _buffer = nil)
-      (count && count > 0) ? nil : ""
+      count && count > 0 ? nil : ""
     end
 
     def rewind

data/lib/puma/plugin.rb

@@ -10,7 +10,7 @@ module Puma
 
     def create(name)
       if cls = Plugins.find(name)
-        plugin = cls.new(Plugin)
+        plugin = cls.new
         @instances << plugin
         return plugin
       end
@@ -62,8 +62,11 @@ module Puma
     end
 
     def fire_background
-      @background.each do |b|
-        Thread.new(&b)
+      @background.each_with_index do |b, i|
+        Thread.new do
+          Puma.set_thread_name "plugin background #{i}"
+          b.call
+        end
       end
     end
   end
@@ -101,17 +104,8 @@ module Puma
       Plugins.register name, cls
     end
 
-    def initialize(loader)
-      @loader = loader
-    end
-
     def in_background(&blk)
       Plugins.add_background blk
     end
-
-    def workers_supported?
-      return false if Puma.jruby? || Puma.windows?
-      true
-    end
   end
 end

data/lib/puma/rack/builder.rb

@@ -67,10 +67,6 @@ module Puma::Rack
           options[:environment] = e
         }
 
-        opts.on("-D", "--daemonize", "run daemonized in the background") { |d|
-          options[:daemonize] = d ? true : false
-        }
-
         opts.on("-P", "--pid FILE", "file to store PID") { |f|
           options[:pid] = ::File.expand_path(f)
         }

data/lib/puma/reactor.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 require 'puma/util'
-require 'puma/minissl'
+require 'puma/minissl' if ::Puma::HAS_SSL
 
 require 'nio'
 
@@ -189,7 +189,12 @@ module Puma
                     if submon.value == @ready
                       false
                     else
-                      submon.value.close
+                      if submon.value.can_close?
+                        submon.value.close
+                      else
+                        # Pass remaining open client connections to the thread pool.
+                        @app_pool << submon.value
+                      end
                       begin
                         selector.deregister submon.value
                       rescue IOError
@@ -225,7 +230,7 @@ module Puma
               # will be flooding them with errors when persistent connections
               # are closed.
               rescue ConnectionError
-                c.write_500
+                c.write_error(500)
                 c.close
 
                 clear_monitor mon
@@ -237,7 +242,8 @@ module Puma
                 ssl_socket = c.io
                 begin
                   addr = ssl_socket.peeraddr.last
-                rescue IOError
+                # EINVAL can happen when browser closes socket w/security exception
+                rescue IOError, Errno::EINVAL
                   addr = "<unknown>"
                 end
 
@@ -246,22 +252,22 @@ module Puma
                 c.close
                 clear_monitor mon
 
-                @events.ssl_error @server, addr, cert, e
+                @events.ssl_error e, addr, cert
 
               # The client doesn't know HTTP well
               rescue HttpParserError => e
                 @server.lowlevel_error(e, c.env)
 
-                c.write_400
+                c.write_error(400)
                 c.close
 
                 clear_monitor mon
 
-                @events.parse_error @server, c.env, e
+                @events.parse_error e, c
               rescue StandardError => e
                 @server.lowlevel_error(e, c.env)
 
-                c.write_500
+                c.write_error(500)
                 c.close
 
                 clear_monitor mon
@@ -277,7 +283,7 @@ module Puma
             while @timeouts.first.value.timeout_at < now
               mon = @timeouts.shift
               c = mon.value
-              c.write_408 if c.in_data_phase
+              c.write_error(408) if c.in_data_phase
               c.close
 
               clear_monitor mon
@@ -307,6 +313,7 @@ module Puma
 
     def run_in_thread
       @thread = Thread.new do
+        Puma.set_thread_name "reactor"
         begin
           run_internal
         rescue StandardError => e

data/lib/puma/runner.rb

@@ -17,10 +17,6 @@ module Puma
       @started_at = Time.now
     end
 
-    def daemon?
-      @options[:daemon]
-    end
-
     def development?
       @options[:environment] == "development"
     end
@@ -33,7 +29,8 @@ module Puma
       @events.log str
     end
 
-    def before_restart
+    # @version 5.0.0
+    def stop_control
       @control.stop(true) if @control
     end
 
@@ -51,36 +48,27 @@ module Puma
 
       require 'puma/app/status'
 
-      uri = URI.parse str
-
-      app = Puma::App::Status.new @launcher
-
       if token = @options[:control_auth_token]
-        app.auth_token = token unless token.empty? || token == 'none'
+        token = nil if token.empty? || token == 'none'
       end
 
+      app = Puma::App::Status.new @launcher, token
+
       control = Puma::Server.new app, @launcher.events
       control.min_threads = 0
       control.max_threads = 1
 
-      case uri.scheme
-      when "tcp"
-        log "* Starting control server on #{str}"
-        control.add_tcp_listener uri.host, uri.port
-      when "unix"
-        log "* Starting control server on #{str}"
-        path = "#{uri.host}#{uri.path}"
-        mask = @options[:control_url_umask]
-
-        control.add_unix_listener path, mask
-      else
-        error "Invalid control URI: #{str}"
-      end
+      control.binder.parse [str], self, 'Starting control server'
 
       control.run
       @control = control
     end
 
+    # @version 5.0.0
+    def close_control_listeners
+      @control.binder.close_listeners if @control
+    end
+
     def ruby_engine
       if !defined?(RUBY_ENGINE) || RUBY_ENGINE == "ruby"
         "ruby #{RUBY_VERSION}-p#{RUBY_PATCHLEVEL}"
@@ -101,10 +89,6 @@ module Puma
       log "* Version #{Puma::Const::PUMA_VERSION} (#{ruby_engine}), codename: #{Puma::Const::CODE_NAME}"
       log "* Min threads: #{min_t}, max threads: #{max_t}"
       log "* Environment: #{ENV['RACK_ENV']}"
-
-      if @options[:mode] == :tcp
-        log "* Mode: Lopez Express (tcp)"
-      end
     end
 
     def redirected_io?
@@ -143,7 +127,6 @@ module Puma
         exit 1
       end
 
-      # Load the app before we daemonize.
       begin
         @app = @launcher.config.app
       rescue Exception => e
@@ -167,10 +150,6 @@ module Puma
       server.max_threads = max_t
       server.inherit_binder @launcher.binder
 
-      if @options[:mode] == :tcp
-        server.tcp_mode!
-      end
-
       if @options[:early_hints]
         server.early_hints = true
       end