puma 5.6.7 → 6.4.0

data/docs/kubernetes.md

@@ -64,3 +64,15 @@ There is a subtle race condition between step 2 and 3: The replication controlle
 The way Kubernetes works this way, rather than handling step 2 synchronously, is due to the CAP theorem: in a distributed system there is no way to guarantee that any message will arrive promptly. In particular, waiting for all Service controllers to report back might get stuck for an indefinite time if one of them has already been terminated or if there has been a net split. A way to work around this is to add a sleep to the pre-stop hook of the same time as the `terminationGracePeriodSeconds` time. This will allow the Puma process to keep serving new requests during the entire grace period, although it will no longer receive new requests after all Service controllers have propagated the removal of the pod from their endpoint lists. Then, after `terminationGracePeriodSeconds`, the pod receives `SIGKILL` and closes down. If your process can't handle SIGKILL properly, for example because it needs to release locks in different services, you can also sleep for a shorter period (and/or increase `terminationGracePeriodSeconds`) as long as the time slept is longer than the time that your Service controllers take to propagate the pod removal. The downside of this workaround is that all pods will take at minimum the amount of time slept to shut down and this will increase the time required for your rolling deploy.
 
 More discussions and links to relevant articles can be found in https://github.com/puma/puma/issues/2343.
+
+## Workers Per Pod, and Other Config Issues
+
+With containerization, you will have to make a decision about how "big" to make each pod. Should you run 2 pods with 50 workers each? 25 pods, each with 4 workers? 100 pods, with each Puma running in single mode? Each scenario represents the same total amount of capacity (100 Puma processes that can respond to requests), but there are tradeoffs to make.
+
+* Worker counts should be somewhere between 4 and 32 in most cases. You want more than 4 in order to minimize time spent in request queueing for a free Puma worker, but probably less than ~32 because otherwise autoscaling is working in too large of an increment or they probably won't fit very well into your nodes.
+* Unless you have a very I/O-heavy application (50%+ time spent waiting on IO), use the default thread count (5 for MRI). Using higher numbers of threads with low I/O wait (<50%) will lead to additional request queueing time (latency!) and additional memory usage.
+* More processes per pod reduces memory usage per process, because of copy-on-write memory and because the cost of the single master process is "amortized" over more child processes.
+* Don't run less than 4 processes per pod if you can. Low numbers of processes per pod will lead to high request queueing, which means you will have to run more pods.
+* If multithreaded, allocate 1 CPU per worker. If single threaded, allocate 0.75 cpus per worker. Most web applications spend about 25% of their time in I/O - but when you're running multi-threaded, your Puma process will have higher CPU usage and should be able to fully saturate a CPU core.
+* Most Puma processes will use about ~512MB-1GB per worker, and about 1GB for the master process. However, you probably shouldn't bother with setting memory limits lower than around 2GB per process, because most places you are deploying will have 2GB of RAM per CPU. A sensible memory limit for a Puma configuration of 4 child workers might be something like 8 GB (1 GB for the master, 7GB for the 4 children).
+

data/docs/nginx.md

@@ -2,7 +2,7 @@
 
 This is a very common setup using an upstream. It was adapted from some Capistrano recipe I found on the Internet a while ago.
 
-```
+```nginx
 upstream myapp {
   server unix:///myapp/tmp/puma.sock;
 }

data/docs/systemd.md

@@ -24,8 +24,7 @@ After=network.target
 
 [Service]
 # Puma supports systemd's `Type=notify` and watchdog service
-# monitoring, if the [sd_notify](https://github.com/agis/ruby-sdnotify) gem is installed,
-# as of Puma 5.1 or later.
+# monitoring, as of Puma 5.1 or later.
 # On earlier versions of Puma or JRuby, change this to `Type=simple` and remove
 # the `WatchdogSec` line.
 Type=notify

data/docs/testing_benchmarks_local_files.md

@@ -0,0 +1,150 @@
+# Testing - benchmark/local files
+
+These files generate data that shows request-per-second (RPS), etc. Typically, files are in 
+pairs, a shell script and a Ruby script. The shell script starts the server, then runs the 
+Ruby file, which starts client request stream(s), then collects and logs metrics.
+
+## response_time_wrk.sh
+
+This uses [wrk] for generating data. One or more wrk runs are performed. Summarizes RPS and 
+wrk latency times. The default for the `-b` argument runs 28 different client request streams, 
+and takes a bit over 5 minutes.  See 'Request Stream Configuration' below for `-b` argument
+description.
+
+<details>
+  <summary>Summary output for<br/><code>benchmarks/local/response_time_wrk.sh -w2 -t5:5 -s tcp6</code>:</summary>
+
+```
+Type   req/sec    50%     75%     90%     99%    100%  Resp Size
+─────────────────────────────────────────────────────────────────    1kB
+array   13710    0.74    2.52    5.23    7.76   37.45      1024
+chunk   13502    0.76    2.55    5.28    7.84   11.23      1042
+string  13794    0.74    2.51    5.20    7.75   14.07      1024
+io       9615    1.16    3.45    7.13   10.57   15.75      1024
+─────────────────────────────────────────────────────────────────   10kB
+array   13458    0.76    2.57    5.31    7.93   13.94     10239
+chunk   13066    0.78    2.64    5.46    8.18   38.48     10320
+string  13500    0.76    2.55    5.29    7.88   11.42     10240
+io       9293    1.18    3.59    7.39   10.94   16.99     10240
+─────────────────────────────────────────────────────────────────  100kB
+array   11315    0.96    3.06    6.33    9.49   17.69    102424
+chunk    9916    1.10    3.48    7.20   10.73   15.14    103075
+string  10948    1.00    3.17    6.57    9.83   17.88    102378
+io       8901    1.21    3.72    7.48   11.27   59.98    102407
+─────────────────────────────────────────────────────────────────  256kB
+array    9217    1.15    3.82    7.88   11.74   17.12    262212
+chunk    7339    1.45    4.76    9.81   14.63   22.70    264007
+string   8574    1.19    3.81    7.73   11.21   15.80    262147
+io       8911    1.19    3.80    7.55   15.25   60.01    262183
+─────────────────────────────────────────────────────────────────  512kB
+array    6951    1.49    5.03   10.28   15.90   25.08    524378
+chunk    5234    2.03    6.56   13.57   20.46   32.15    527862
+string   6438    1.55    5.04   10.12   16.28   72.87    524275
+io       8533    1.15    4.62    8.79   48.15   70.51    524327
+───────────────────────────────────────────────────────────────── 1024kB
+array    4122    1.80   15.59   41.87   67.79  121.00   1048565
+chunk    3158    2.82   15.22   31.00   71.39   99.90   1055654
+string   4710    2.24    6.66   13.65   20.38   70.44   1048575
+io       8355    1.23    3.95    7.94   14.08   68.54   1048498
+───────────────────────────────────────────────────────────────── 2048kB
+array    2454    4.12   14.02   27.70   43.48   88.89   2097415
+chunk    1743    6.26   17.65   36.98   55.78   92.10   2111358
+string   2479    4.38   12.52   25.65   38.44   95.62   2097502
+io       8264    1.25    3.83    7.76   11.73   65.69   2097090
+
+Body    ────────── req/sec ──────────   ─────── req 50% times ───────
+ KB     array   chunk  string      io   array   chunk  string      io
+1       13710   13502   13794    9615   0.745   0.757   0.741   1.160
+10      13458   13066   13500    9293   0.760   0.784   0.759   1.180
+100     11315    9916   10948    8901   0.960   1.100   1.000   1.210
+256      9217    7339    8574    8911   1.150   1.450   1.190   1.190
+512      6951    5234    6438    8533   1.490   2.030   1.550   1.150
+1024     4122    3158    4710    8355   1.800   2.820   2.240   1.230
+2048     2454    1743    2479    8264   4.120   6.260   4.380   1.250
+─────────────────────────────────────────────────────────────────────
+wrk -t8 -c16 -d10s
+benchmarks/local/response_time_wrk.sh -w2 -t5:5 -s tcp6 -Y
+Server cluster mode -w2 -t5:5, bind: tcp6
+Puma repo branch 00-response-refactor
+ruby 3.2.0dev (2022-06-14T01:21:55Z master 048f14221c) +YJIT [x86_64-linux]
+
+[2136] - Gracefully shutting down workers...
+[2136] === puma shutdown: 2022-06-13 21:16:13 -0500 ===
+[2136] - Goodbye!
+
+ 5:15 Total Time
+```
+</details><br/>
+
+## bench_base.sh, bench_base.rb
+
+These two files setup parameters for the Puma server, which is normally started in a shell 
+script. It then starts a Ruby file (a subclass of BenchBase), passing arguments to it. The 
+Ruby file is normally used to generate a client request stream(s).
+
+### Puma Configuration
+
+The following arguments are used for the Puma server:
+
+* **`-C`** - configuration file
+* **`-d`** - app delay
+* **`-r`** - rackup file, often defaults to test/rackup/ci_select.ru
+* **`-s`** - bind socket type, default is tcp/tcp4, also tcp6, ssl/ssl4, ssl6, unix, or aunix
+  (unix & abstract unix are not available with wrk).
+* **`-t`** - threads, expressed as '5:5', same as Puma --thread
+* **`-w`** - workers, same as Puma --worker
+* **`-Y`** - enable Ruby YJIT
+
+### Request Stream Configuration
+
+The following arguments are used for request streams:
+
+* **`-b`** - response body configuration. Body type options are a array, c chunked, s string,
+  and i for File/IO. None or any combination can be specified, they should start the option.
+  Then, any combination of comma separated integers can be used for the response body size
+  in kB. The string 'ac50,100' would create four runs, 50kb array, 50kB chunked, 100kB array,
+  and 100kB chunked. See 'Testing - test/rackup/ci-*.ru files' for more info.
+* **`-c`** - connections per client request stream thread, defaults to 2 for wrk.
+* **`-D`** - duration of client request stream in seconds.
+* **`-T`** - number of threads in the client request stream. For wrk, this defaults to
+  80% of Puma workers * max_threads.
+
+### Notes - Configuration
+
+The above lists script arguments.
+
+`bench_base.sh` contains most server defaults. Many can be set via ENV variables.
+
+`bench_base.rb` contains the client request stream defaults. The default value for
+`-b` is `acsi1,10,100,256,512,1024,2048`, which is a 4 x 7 matrix, and hence, runs
+28 jobs. Also, the i body type (File/IO) generates files, they are placed in the
+`"#{Dir.tmpdir}/.puma_response_body_io"` directory, which is created.
+
+### Notes - wrk
+
+The shell scripts use `-T` for wrk's thread count, since `-t` is used for Puma
+server threads.  Regarding the `-c` argument, wrk has an interesting behavior.
+The total number of connections is set by `(connections/threads).to_i`. The scripts
+here use `-c` as connections per thread.  Hence, using `-T4 -c2` will yield a total
+of eight wrk connections, two per thread. The equivalent wrk arguments would be `-t4 -c8`.
+
+Puma can only process so many requests, and requests will queue in the backlog
+until Puma can respond to them. With wrk, if the number of total connections is
+too high, one will see the upper latency times increase, pushing into the lower
+latency times as the connections are increased. The default values for wrk's
+threads and connections were chosen to minimize requests' time in the backlog.
+
+An example with four wrk runs using `-b s10`.  Notice that `req/sec` varies by
+less than 1%, but the `75%` times increase by an order of magnitude:
+```
+req/sec    50%     75%     90%     99%    100%  Resp Size   wrk cmd line
+─────────────────────────────────────────────────────────────────────────────
+ 13597   0.755   2.550   5.260   7.800  13.310     12040    wrk -t8  -c16 -d10
+ 13549   0.793   4.430   8.140  11.220  16.600     12002    wrk -t10 -c20 -d10
+ 13570   1.040  25.790  40.010  49.070  58.300     11982    wrk -t8  -c64 -d10
+ 13684   1.050  25.820  40.080  49.160  66.190     12033    wrk -t16 -c64 -d10
+```
+Finally, wrk's output may cause rounding errors, so the response body size calculation is
+imprecise.
+
+[wrk]: <https://github.com/ioquatix/wrk>

data/docs/testing_test_rackup_ci_files.md

@@ -0,0 +1,36 @@
+# Testing - test/rackup/ci-*.ru files
+
+## Overview
+
+Puma should efficiently handle a variety of response bodies, varying both by size
+and by the type of object used for the body.
+
+Five rackup files are located in 'test/rackup' that can be used.  All have their
+request body size (in kB) set via `Body-Conf` header or with `ENV['CI_BODY_CONF']`.
+Additionally, the ci_select.ru file can have it's body type set via a starting
+character.
+
+* **ci_array.ru** - body is an `Array` of 1kB strings.  `Content-Length` is not set.
+* **ci_chunked.ru** - body is an `Enumerator` of 1kB strings.  `Content-Length` is not set.
+* **ci_io.ru** - body is a File/IO object.  `Content-Length` is set.
+* **ci_string.ru** - body is a single string.  `Content-Length` is set.
+* **ci_select.ru** - can be any of the above.
+
+All responses have 25 headers, total length approx 1kB.  ci_array.ru and ci_chunked.ru
+contain 1kB items.
+
+All can be delayed by a float value (seconds) specified by the `Dly` header
+
+Note that rhe `Body-Conf` header takes precedence, and `ENV['CI_BODY_CONF']` is
+only read on load.
+
+## ci_select.ru
+
+The ci_select.ru file allows a starting character to specify the body type in the
+`Body-Conf` header or with `ENV['CI_BODY_CONF']`.
+* **a** - array of strings
+* **c** - chunked (enum)
+* **s** - single string
+* **i** - File/IO
+
+A value of `a100` would return a body as an array of 100 1kB strings.

data/ext/puma_http11/extconf.rb

@@ -2,20 +2,22 @@ require 'mkmf'
 
 dir_config("puma_http11")
 
-if $mingw && RUBY_VERSION >= '2.4'
+if $mingw
   append_cflags  '-fstack-protector-strong -D_FORTIFY_SOURCE=2'
   append_ldflags '-fstack-protector-strong -l:libssp.a'
   have_library 'ssp'
 end
 
-unless ENV["DISABLE_SSL"]
+unless ENV["PUMA_DISABLE_SSL"]
   # don't use pkg_config('openssl') if '--with-openssl-dir' is used
   has_openssl_dir = dir_config('openssl').any?
   found_pkg_config = !has_openssl_dir && pkg_config('openssl')
 
-  found_ssl = if (!$mingw || RUBY_VERSION >= '2.4') && found_pkg_config
+  found_ssl = if !$mingw && found_pkg_config
     puts 'using OpenSSL pkgconfig (openssl.pc)'
     true
+  elsif have_library('libcrypto', 'BIO_read') && have_library('libssl', 'SSL_CTX_new')
+    true
   elsif %w'crypto libeay32'.find {|crypto| have_library(crypto, 'BIO_read')} &&
       %w'ssl ssleay32'.find {|ssl| have_library(ssl, 'SSL_CTX_new')}
     true
@@ -28,13 +30,14 @@ unless ENV["DISABLE_SSL"]
     have_header "openssl/bio.h"
 
     # below is  yes for 1.0.2 & later
-    have_func  "DTLS_method"                           , "openssl/ssl.h"
+    have_func "DTLS_method"                            , "openssl/ssl.h"
+    have_func "SSL_CTX_set_session_cache_mode(NULL, 0)", "openssl/ssl.h"
 
     # below are yes for 1.1.0 & later
-    have_func  "TLS_server_method"                     , "openssl/ssl.h"
-    have_func  "SSL_CTX_set_min_proto_version(NULL, 0)", "openssl/ssl.h"
+    have_func "TLS_server_method"                      , "openssl/ssl.h"
+    have_func "SSL_CTX_set_min_proto_version(NULL, 0)" , "openssl/ssl.h"
 
-    have_func  "X509_STORE_up_ref"
+    have_func "X509_STORE_up_ref"
     have_func "SSL_CTX_set_ecdh_auto(NULL, 0)"         , "openssl/ssl.h"
 
     # below exists in 1.1.0 and later, but isn't documented until 3.0.0
@@ -53,7 +56,7 @@ unless ENV["DISABLE_SSL"]
   end
 end
 
-if ENV["MAKE_WARNINGS_INTO_ERRORS"]
+if ENV["PUMA_MAKE_WARNINGS_INTO_ERRORS"]
   # Make all warnings into errors
   # Except `implicit-fallthrough` since most failures comes from ragel state machine generated code
   if respond_to?(:append_cflags, true) # Ruby 2.5 and later

data/ext/puma_http11/http11_parser.c

@@ -297,7 +297,7 @@ case 13:
 tr18:
 #line 65 "ext/puma_http11/http11_parser.rl"
 	{
-    parser->http_version(parser, PTR_TO(mark), LEN(mark, p));
+    parser->server_protocol(parser, PTR_TO(mark), LEN(mark, p));
   }
 	goto st14;
 tr26:

data/ext/puma_http11/http11_parser.h

@@ -46,7 +46,7 @@ typedef struct puma_parser {
   element_cb fragment;
   element_cb request_path;
   element_cb query_string;
-  element_cb http_version;
+  element_cb server_protocol;
   element_cb header_done;
 
   char buf[BUFFER_LEN];

data/ext/puma_http11/http11_parser.java.rl

@@ -39,8 +39,8 @@ public class Http11Parser {
     Http11.query_string(runtime, parser.data, parser.buffer, parser.query_start, fpc-parser.query_start);
   }
 
-  action http_version {
-    Http11.http_version(runtime, parser.data, parser.buffer, parser.mark, fpc-parser.mark);
+  action server_protocol {
+    Http11.server_protocol(runtime, parser.data, parser.buffer, parser.mark, fpc-parser.mark);
   }
 
   action request_path {

data/ext/puma_http11/http11_parser.rl

@@ -62,8 +62,8 @@ static void snake_upcase_char(char *c)
     parser->query_string(parser, PTR_TO(query_start), LEN(query_start, fpc));
   }
 
-  action http_version {
-    parser->http_version(parser, PTR_TO(mark), LEN(mark, fpc));
+  action server_protocol {
+    parser->server_protocol(parser, PTR_TO(mark), LEN(mark, fpc));
   }
 
   action request_path {

data/ext/puma_http11/http11_parser_common.rl

@@ -38,8 +38,8 @@
   Method = ( upper | digit | safe ){1,20} >mark %request_method;
 
   http_number = ( digit+ "." digit+ ) ;
-  HTTP_Version = ( "HTTP/" http_number ) >mark %http_version ;
-  Request_Line = ( Method " " Request_URI ("#" Fragment){0,1} " " HTTP_Version CRLF ) ;
+  Server_Protocol = ( "HTTP/" http_number ) >mark %server_protocol ;
+  Request_Line = ( Method " " Request_URI ("#" Fragment){0,1} " " Server_Protocol CRLF ) ;
 
   field_name = ( token -- ":" )+ >start_field $snake_upcase_field %write_field;
 

data/ext/puma_http11/mini_ssl.c

@@ -36,6 +36,12 @@ void raise_file_error(const char* caller, const char *filename) {
   rb_raise(eError, "%s: error in file '%s': %s", caller, filename, ERR_error_string(ERR_get_error(), NULL));
 }
 
+NORETURN(void raise_param_error(const char* caller, const char *param));
+
+void raise_param_error(const char* caller, const char *param) {
+  rb_raise(eError, "%s: error with parameter '%s': %s", caller, param, ERR_error_string(ERR_get_error(), NULL));
+}
+
 void engine_free(void *ptr) {
   ms_conn *conn = ptr;
   ms_cert_buf* cert_buf = (ms_cert_buf*)SSL_get_app_data(conn->ssl);
@@ -185,6 +191,18 @@ static int engine_verify_callback(int preverify_ok, X509_STORE_CTX* ctx) {
   return preverify_ok;
 }
 
+static int password_callback(char *buf, int size, int rwflag, void *userdata) {
+    const char *password = (const char *) userdata;
+    size_t len = strlen(password);
+
+    if (len > (size_t) size) {
+      return 0;
+    }
+
+    memcpy(buf, password, len);
+    return (int) len;
+}
+
 static VALUE
 sslctx_alloc(VALUE klass) {
   SSL_CTX *ctx;
@@ -210,28 +228,35 @@ sslctx_alloc(VALUE klass) {
 VALUE
 sslctx_initialize(VALUE self, VALUE mini_ssl_ctx) {
   SSL_CTX* ctx;
-
+  int ssl_options;
+  VALUE key, cert, ca, verify_mode, ssl_cipher_filter, no_tlsv1, no_tlsv1_1,
+    verification_flags, session_id_bytes, cert_pem, key_pem, key_password_command, key_password;
+  BIO *bio;
+  X509 *x509 = NULL;
+  EVP_PKEY *pkey;
+  pem_password_cb *password_cb = NULL;
+  const char *password = NULL;
 #ifdef HAVE_SSL_CTX_SET_MIN_PROTO_VERSION
   int min;
 #endif
-  int ssl_options;
-  VALUE key, cert, ca, verify_mode, ssl_cipher_filter, no_tlsv1, no_tlsv1_1,
-    verification_flags, session_id_bytes, cert_pem, key_pem;
 #ifndef HAVE_SSL_CTX_SET_DH_AUTO
   DH *dh;
 #endif
-  BIO *bio;
-  X509 *x509;
-  EVP_PKEY *pkey;
-
 #if OPENSSL_VERSION_NUMBER < 0x10002000L
   EC_KEY *ecdh;
 #endif
+#ifdef HAVE_SSL_CTX_SET_SESSION_CACHE_MODE
+  VALUE reuse, reuse_cache_size, reuse_timeout;
 
-  TypedData_Get_Struct(self, SSL_CTX, &sslctx_type, ctx);
+  reuse = rb_funcall(mini_ssl_ctx, rb_intern_const("reuse"), 0);
+  reuse_cache_size = rb_funcall(mini_ssl_ctx, rb_intern_const("reuse_cache_size"), 0);
+  reuse_timeout = rb_funcall(mini_ssl_ctx, rb_intern_const("reuse_timeout"), 0);
+#endif
 
   key = rb_funcall(mini_ssl_ctx, rb_intern_const("key"), 0);
 
+  key_password_command = rb_funcall(mini_ssl_ctx, rb_intern_const("key_password_command"), 0);
+
   cert = rb_funcall(mini_ssl_ctx, rb_intern_const("cert"), 0);
 
   ca = rb_funcall(mini_ssl_ctx, rb_intern_const("ca"), 0);
@@ -248,6 +273,8 @@ sslctx_initialize(VALUE self, VALUE mini_ssl_ctx) {
 
   no_tlsv1_1 = rb_funcall(mini_ssl_ctx, rb_intern_const("no_tlsv1_1"), 0);
 
+  TypedData_Get_Struct(self, SSL_CTX, &sslctx_type, ctx);
+
   if (!NIL_P(cert)) {
     StringValue(cert);
 
@@ -256,6 +283,18 @@ sslctx_initialize(VALUE self, VALUE mini_ssl_ctx) {
     }
   }
 
+  if (!NIL_P(key_password_command)) {
+      key_password = rb_funcall(mini_ssl_ctx, rb_intern_const("key_password"), 0);
+
+      if (!NIL_P(key_password)) {
+          StringValue(key_password);
+          password_cb = password_callback;
+          password = RSTRING_PTR(key_password);
+          SSL_CTX_set_default_passwd_cb(ctx, password_cb);
+          SSL_CTX_set_default_passwd_cb_userdata(ctx, (void *) password);
+      }
+  }
+
   if (!NIL_P(key)) {
     StringValue(key);
 
@@ -265,23 +304,78 @@ sslctx_initialize(VALUE self, VALUE mini_ssl_ctx) {
   }
 
   if (!NIL_P(cert_pem)) {
+    X509 *ca = NULL;
+    unsigned long err;
+
     bio = BIO_new(BIO_s_mem());
     BIO_puts(bio, RSTRING_PTR(cert_pem));
+
+    /**
+     * Much of this pulled as a simplified version of the `use_certificate_chain_file` method
+     * from openssl's `ssl_rsa.c` file.
+     */
+
+    /* first read the cert as the first item in the pem file */
     x509 = PEM_read_bio_X509(bio, NULL, NULL, NULL);
+    if (NULL == x509) {
+      BIO_free_all(bio);
+      raise_param_error("PEM_read_bio_X509", "cert_pem");
+    }
+
+    /* Add the cert to the context */
+    /* 1 is success - otherwise check the error codes */
+    if (1 != SSL_CTX_use_certificate(ctx, x509)) {
+      BIO_free_all(bio);
+      raise_param_error("SSL_CTX_use_certificate", "cert_pem");
+    }
+
+    X509_free(x509); /* no longer need our reference */
+
+    /* Now lets load up the rest of the certificate chain */
+    /* 1 is success 0 is error */
+    if (0 == SSL_CTX_clear_chain_certs(ctx)) {
+      BIO_free_all(bio);
+      raise_param_error("SSL_CTX_clear_chain_certs","cert_pem");
+    }
+
+    while (1) {
+      ca = PEM_read_bio_X509(bio, NULL, NULL, NULL);
+
+      if (NULL == ca) {
+        break;
+      }
+
+      if (0 == SSL_CTX_add0_chain_cert(ctx, ca)) {
+        BIO_free_all(bio);
+        raise_param_error("SSL_CTX_add0_chain_cert","cert_pem");
+      }
+      /* don't free ca - its now owned by the context */
+    }
+
+    /* ca is NULL - so its either the end of the file or an error */
+    err = ERR_peek_last_error();
 
-    if (SSL_CTX_use_certificate(ctx, x509) != 1) {
-      raise_file_error("SSL_CTX_use_certificate", RSTRING_PTR(cert_pem));
+    /* If its the end of the file - then we are done, in any case free the bio */
+    BIO_free_all(bio);
+
+    if ((ERR_GET_LIB(err) == ERR_LIB_PEM) && (ERR_GET_REASON(err) == PEM_R_NO_START_LINE)) {
+      ERR_clear_error();
+    } else {
+      raise_param_error("PEM_read_bio_X509","cert_pem");
     }
   }
 
   if (!NIL_P(key_pem)) {
     bio = BIO_new(BIO_s_mem());
     BIO_puts(bio, RSTRING_PTR(key_pem));
-    pkey = PEM_read_bio_PrivateKey(bio, NULL, NULL, NULL);
+    pkey = PEM_read_bio_PrivateKey(bio, NULL, password_cb, (void *) password);
 
     if (SSL_CTX_use_PrivateKey(ctx, pkey) != 1) {
+      BIO_free(bio);
       raise_file_error("SSL_CTX_use_PrivateKey", RSTRING_PTR(key_pem));
     }
+    EVP_PKEY_free(pkey);
+    BIO_free(bio);
   }
 
   verification_flags = rb_funcall(mini_ssl_ctx, rb_intern_const("verification_flags"), 0);
@@ -314,8 +408,6 @@ sslctx_initialize(VALUE self, VALUE mini_ssl_ctx) {
 
   SSL_CTX_set_min_proto_version(ctx, min);
 
-  SSL_CTX_set_options(ctx, ssl_options);
-
 #else
   /* As of 1.0.2f, SSL_OP_SINGLE_DH_USE key use is always on */
   ssl_options |= SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | SSL_OP_SINGLE_DH_USE;
@@ -326,10 +418,23 @@ sslctx_initialize(VALUE self, VALUE mini_ssl_ctx) {
   if(RTEST(no_tlsv1_1)) {
     ssl_options |= SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1;
   }
-  SSL_CTX_set_options(ctx, ssl_options);
 #endif
 
-  SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_OFF);
+#ifdef HAVE_SSL_CTX_SET_SESSION_CACHE_MODE
+  if (!NIL_P(reuse)) {
+    SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_SERVER);
+    if (!NIL_P(reuse_cache_size)) {
+      SSL_CTX_sess_set_cache_size(ctx, NUM2INT(reuse_cache_size));
+    }
+    if (!NIL_P(reuse_timeout)) {
+      SSL_CTX_set_timeout(ctx, NUM2INT(reuse_timeout));
+    }
+  } else {
+    SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_OFF);
+  }
+#endif
+
+  SSL_CTX_set_options(ctx, ssl_options);
 
   if (!NIL_P(ssl_cipher_filter)) {
     StringValue(ssl_cipher_filter);
@@ -340,8 +445,7 @@ sslctx_initialize(VALUE self, VALUE mini_ssl_ctx) {
   }
 
 #if OPENSSL_VERSION_NUMBER < 0x10002000L
-  // Remove this case if OpenSSL 1.0.1 (now EOL) support is no
-  // longer needed.
+  // Remove this case if OpenSSL 1.0.1 (now EOL) support is no longer needed.
   ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
   if (ecdh) {
     SSL_CTX_set_tmp_ecdh(ctx, ecdh);

data/ext/puma_http11/org/jruby/puma/Http11.java

@@ -46,7 +46,7 @@ public class Http11 extends RubyObject {
     public static final ByteList FRAGMENT_BYTELIST = new ByteList(ByteList.plain("FRAGMENT"));
     public static final ByteList REQUEST_PATH_BYTELIST = new ByteList(ByteList.plain("REQUEST_PATH"));
     public static final ByteList QUERY_STRING_BYTELIST = new ByteList(ByteList.plain("QUERY_STRING"));
-    public static final ByteList HTTP_VERSION_BYTELIST = new ByteList(ByteList.plain("HTTP_VERSION"));
+    public static final ByteList SERVER_PROTOCOL_BYTELIST = new ByteList(ByteList.plain("SERVER_PROTOCOL"));
 
     private static ObjectAllocator ALLOCATOR = new ObjectAllocator() {
         public IRubyObject allocate(Ruby runtime, RubyClass klass) {
@@ -153,9 +153,9 @@ public class Http11 extends RubyObject {
         req.fastASet(RubyString.newStringShared(runtime, QUERY_STRING_BYTELIST),val);
     }
 
-    public static void http_version(Ruby runtime, RubyHash req, ByteList buffer, int at, int length) {
+    public static void server_protocol(Ruby runtime, RubyHash req, ByteList buffer, int at, int length) {
         RubyString val = RubyString.newString(runtime,new ByteList(buffer,at,length));
-        req.fastASet(RubyString.newStringShared(runtime, HTTP_VERSION_BYTELIST),val);
+        req.fastASet(RubyString.newStringShared(runtime, SERVER_PROTOCOL_BYTELIST),val);
     }
 
     public void header_done(Ruby runtime, RubyHash req, ByteList buffer, int at, int length) {

data/ext/puma_http11/org/jruby/puma/Http11Parser.java

@@ -383,7 +383,7 @@ case 1:
 	case 11:
 // line 42 "ext/puma_http11/http11_parser.java.rl"
 	{
-    Http11.http_version(runtime, parser.data, parser.buffer, parser.mark, p-parser.mark);
+    Http11.server_protocol(runtime, parser.data, parser.buffer, parser.mark, p-parser.mark);
   }
 	break;
 	case 12: