puma 4.3.7 → 4.3.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 13b795e06976ed8b1004a190e018db051811b3518acdbe3679d0490fee7ee730
-  data.tar.gz: ebef22a424d8e8bc59dd8647b0f728818b9d1ae788ca9ff64a778830e3030349
+  metadata.gz: 0133cf43153c495af4daa489fd6db234a14fb0d7b72201b71260d4d57dfb1211
+  data.tar.gz: a1a369772eaf8e3e0efa2931c4cdfdc1880314540c260d6c01226f4b0fd2a863
 SHA512:
-  metadata.gz: 98039dfcc8dac9fe7b7ac72cf9970649922c20b5510606a71d3078b83fb20ec8e83febe6be0a9d76bc9d01461937fe7bfd699622f5155e71e86b045fbbcc8dd9
-  data.tar.gz: bb502e59009a55d465b1903cc08f68e9841fbc832bda6f790bd46c7748f2684d5a1e9fc319225e3e49f073478ca2e270f6b5f3a37cc6e562846d84132796e164
+  metadata.gz: 6dfe3a8aa4e40676eb2c70822dac050c75f9bf9ec5270626e2b282a5971f323b2661d5792a4d24982e236f378a13ddf8408080e18bf7f4957cfd5971a7d8d034
+  data.tar.gz: 95706c08d6b746d82af99474001664b282bf760fbbef14860b5e6897dd4eaedc3f4b49a5da2a1809dcfcf0a23fe5f62baabe5da88c631c8228889c615248fe03

data/History.md

@@ -1,3 +1,8 @@
+## 4.3.8 / 2021-05-11
+
+* Security
+  * Close keepalive connections after the maximum number of fast inlined requests (#2625)
+
 ## 4.3.7 / 2020-11-30
 
 * Bugfixes

data/lib/puma/const.rb

@@ -100,7 +100,7 @@ module Puma
   # too taxing on performance.
   module Const
 
-    PUMA_VERSION = VERSION = "4.3.7".freeze
+    PUMA_VERSION = VERSION = "4.3.8".freeze
     CODE_NAME = "Mysterious Traveller".freeze
     PUMA_SERVER_STRING = ['puma', PUMA_VERSION, CODE_NAME].join(' ').freeze
 

data/lib/puma/server.rb

@@ -483,15 +483,20 @@ module Puma
 
             requests += 1
 
-            check_for_more_data = @status == :run
+            # Closing keepalive sockets after they've made a reasonable
+            # number of requests allows Puma to service many connections
+            # fairly, even when the number of concurrent connections exceeds
+            # the size of the threadpool. It also allows cluster mode Pumas
+            # to keep load evenly distributed across workers, because clients
+            # are randomly assigned a new worker when opening a new connection.
+            #
+            # Previously, Puma would kick connections in this conditional back
+            # to the reactor. However, because this causes the todo set to increase
+            # in size, the wait_until_full mutex would never unlock, leaving
+            # any additional connections unserviced.
+            break if requests >= MAX_FAST_INLINE
 
-            if requests >= MAX_FAST_INLINE
-              # This will mean that reset will only try to use the data it already
-              # has buffered and won't try to read more data. What this means is that
-              # every client, independent of their request speed, gets treated like a slow
-              # one once every MAX_FAST_INLINE requests.
-              check_for_more_data = false
-            end
+            check_for_more_data = @status == :run
 
             unless client.reset(check_for_more_data)
               close_socket = false

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: puma
 version: !ruby/object:Gem::Version
-  version: 4.3.7
+  version: 4.3.8
 platform: ruby
 authors:
 - Evan Phoenix
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2020-11-30 00:00:00.000000000 Z
+date: 2021-05-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: nio4r
@@ -136,7 +136,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.4
+rubygems_version: 3.2.3
 signing_key:
 specification_version: 4
 summary: Puma is a simple, fast, threaded, and highly concurrent HTTP 1.1 server for