puma 5.6.9-java → 6.6.0-java

data/docs/testing_benchmarks_local_files.md

@@ -0,0 +1,150 @@
+# Testing - benchmark/local files
+
+These files generate data that shows request-per-second (RPS), etc. Typically, files are in 
+pairs, a shell script and a Ruby script. The shell script starts the server, then runs the 
+Ruby file, which starts client request stream(s), then collects and logs metrics.
+
+## response_time_wrk.sh
+
+This uses [wrk] for generating data. One or more wrk runs are performed. Summarizes RPS and 
+wrk latency times. The default for the `-b` argument runs 28 different client request streams, 
+and takes a bit over 5 minutes.  See 'Request Stream Configuration' below for `-b` argument
+description.
+
+<details>
+  <summary>Summary output for<br/><code>benchmarks/local/response_time_wrk.sh -w2 -t5:5 -s tcp6</code>:</summary>
+
+```
+Type   req/sec    50%     75%     90%     99%    100%  Resp Size
+─────────────────────────────────────────────────────────────────    1kB
+array   13710    0.74    2.52    5.23    7.76   37.45      1024
+chunk   13502    0.76    2.55    5.28    7.84   11.23      1042
+string  13794    0.74    2.51    5.20    7.75   14.07      1024
+io       9615    1.16    3.45    7.13   10.57   15.75      1024
+─────────────────────────────────────────────────────────────────   10kB
+array   13458    0.76    2.57    5.31    7.93   13.94     10239
+chunk   13066    0.78    2.64    5.46    8.18   38.48     10320
+string  13500    0.76    2.55    5.29    7.88   11.42     10240
+io       9293    1.18    3.59    7.39   10.94   16.99     10240
+─────────────────────────────────────────────────────────────────  100kB
+array   11315    0.96    3.06    6.33    9.49   17.69    102424
+chunk    9916    1.10    3.48    7.20   10.73   15.14    103075
+string  10948    1.00    3.17    6.57    9.83   17.88    102378
+io       8901    1.21    3.72    7.48   11.27   59.98    102407
+─────────────────────────────────────────────────────────────────  256kB
+array    9217    1.15    3.82    7.88   11.74   17.12    262212
+chunk    7339    1.45    4.76    9.81   14.63   22.70    264007
+string   8574    1.19    3.81    7.73   11.21   15.80    262147
+io       8911    1.19    3.80    7.55   15.25   60.01    262183
+─────────────────────────────────────────────────────────────────  512kB
+array    6951    1.49    5.03   10.28   15.90   25.08    524378
+chunk    5234    2.03    6.56   13.57   20.46   32.15    527862
+string   6438    1.55    5.04   10.12   16.28   72.87    524275
+io       8533    1.15    4.62    8.79   48.15   70.51    524327
+───────────────────────────────────────────────────────────────── 1024kB
+array    4122    1.80   15.59   41.87   67.79  121.00   1048565
+chunk    3158    2.82   15.22   31.00   71.39   99.90   1055654
+string   4710    2.24    6.66   13.65   20.38   70.44   1048575
+io       8355    1.23    3.95    7.94   14.08   68.54   1048498
+───────────────────────────────────────────────────────────────── 2048kB
+array    2454    4.12   14.02   27.70   43.48   88.89   2097415
+chunk    1743    6.26   17.65   36.98   55.78   92.10   2111358
+string   2479    4.38   12.52   25.65   38.44   95.62   2097502
+io       8264    1.25    3.83    7.76   11.73   65.69   2097090
+
+Body    ────────── req/sec ──────────   ─────── req 50% times ───────
+ KB     array   chunk  string      io   array   chunk  string      io
+1       13710   13502   13794    9615   0.745   0.757   0.741   1.160
+10      13458   13066   13500    9293   0.760   0.784   0.759   1.180
+100     11315    9916   10948    8901   0.960   1.100   1.000   1.210
+256      9217    7339    8574    8911   1.150   1.450   1.190   1.190
+512      6951    5234    6438    8533   1.490   2.030   1.550   1.150
+1024     4122    3158    4710    8355   1.800   2.820   2.240   1.230
+2048     2454    1743    2479    8264   4.120   6.260   4.380   1.250
+─────────────────────────────────────────────────────────────────────
+wrk -t8 -c16 -d10s
+benchmarks/local/response_time_wrk.sh -w2 -t5:5 -s tcp6 -Y
+Server cluster mode -w2 -t5:5, bind: tcp6
+Puma repo branch 00-response-refactor
+ruby 3.2.0dev (2022-06-14T01:21:55Z master 048f14221c) +YJIT [x86_64-linux]
+
+[2136] - Gracefully shutting down workers...
+[2136] === puma shutdown: 2022-06-13 21:16:13 -0500 ===
+[2136] - Goodbye!
+
+ 5:15 Total Time
+```
+</details><br/>
+
+## bench_base.sh, bench_base.rb
+
+These two files setup parameters for the Puma server, which is normally started in a shell 
+script. It then starts a Ruby file (a subclass of BenchBase), passing arguments to it. The 
+Ruby file is normally used to generate a client request stream(s).
+
+### Puma Configuration
+
+The following arguments are used for the Puma server:
+
+* **`-C`** - configuration file
+* **`-d`** - app delay
+* **`-r`** - rackup file, often defaults to test/rackup/ci_select.ru
+* **`-s`** - bind socket type, default is tcp/tcp4, also tcp6, ssl/ssl4, ssl6, unix, or aunix
+  (unix & abstract unix are not available with wrk).
+* **`-t`** - threads, expressed as '5:5', same as Puma --thread
+* **`-w`** - workers, same as Puma --worker
+* **`-Y`** - enable Ruby YJIT
+
+### Request Stream Configuration
+
+The following arguments are used for request streams:
+
+* **`-b`** - response body configuration. Body type options are a array, c chunked, s string,
+  and i for File/IO. None or any combination can be specified, they should start the option.
+  Then, any combination of comma separated integers can be used for the response body size
+  in kB. The string 'ac50,100' would create four runs, 50kb array, 50kB chunked, 100kB array,
+  and 100kB chunked. See 'Testing - test/rackup/ci-*.ru files' for more info.
+* **`-c`** - connections per client request stream thread, defaults to 2 for wrk.
+* **`-D`** - duration of client request stream in seconds.
+* **`-T`** - number of threads in the client request stream. For wrk, this defaults to
+  80% of Puma workers * max_threads.
+
+### Notes - Configuration
+
+The above lists script arguments.
+
+`bench_base.sh` contains most server defaults. Many can be set via ENV variables.
+
+`bench_base.rb` contains the client request stream defaults. The default value for
+`-b` is `acsi1,10,100,256,512,1024,2048`, which is a 4 x 7 matrix, and hence, runs
+28 jobs. Also, the i body type (File/IO) generates files, they are placed in the
+`"#{Dir.tmpdir}/.puma_response_body_io"` directory, which is created.
+
+### Notes - wrk
+
+The shell scripts use `-T` for wrk's thread count, since `-t` is used for Puma
+server threads.  Regarding the `-c` argument, wrk has an interesting behavior.
+The total number of connections is set by `(connections/threads).to_i`. The scripts
+here use `-c` as connections per thread.  Hence, using `-T4 -c2` will yield a total
+of eight wrk connections, two per thread. The equivalent wrk arguments would be `-t4 -c8`.
+
+Puma can only process so many requests, and requests will queue in the backlog
+until Puma can respond to them. With wrk, if the number of total connections is
+too high, one will see the upper latency times increase, pushing into the lower
+latency times as the connections are increased. The default values for wrk's
+threads and connections were chosen to minimize requests' time in the backlog.
+
+An example with four wrk runs using `-b s10`.  Notice that `req/sec` varies by
+less than 1%, but the `75%` times increase by an order of magnitude:
+```
+req/sec    50%     75%     90%     99%    100%  Resp Size   wrk cmd line
+─────────────────────────────────────────────────────────────────────────────
+ 13597   0.755   2.550   5.260   7.800  13.310     12040    wrk -t8  -c16 -d10
+ 13549   0.793   4.430   8.140  11.220  16.600     12002    wrk -t10 -c20 -d10
+ 13570   1.040  25.790  40.010  49.070  58.300     11982    wrk -t8  -c64 -d10
+ 13684   1.050  25.820  40.080  49.160  66.190     12033    wrk -t16 -c64 -d10
+```
+Finally, wrk's output may cause rounding errors, so the response body size calculation is
+imprecise.
+
+[wrk]: <https://github.com/ioquatix/wrk>

data/docs/testing_test_rackup_ci_files.md

@@ -0,0 +1,36 @@
+# Testing - test/rackup/ci-*.ru files
+
+## Overview
+
+Puma should efficiently handle a variety of response bodies, varying both by size
+and by the type of object used for the body.
+
+Five rackup files are located in 'test/rackup' that can be used.  All have their
+request body size (in kB) set via `Body-Conf` header or with `ENV['CI_BODY_CONF']`.
+Additionally, the ci_select.ru file can have it's body type set via a starting
+character.
+
+* **ci_array.ru** - body is an `Array` of 1kB strings.  `Content-Length` is not set.
+* **ci_chunked.ru** - body is an `Enumerator` of 1kB strings.  `Content-Length` is not set.
+* **ci_io.ru** - body is a File/IO object.  `Content-Length` is set.
+* **ci_string.ru** - body is a single string.  `Content-Length` is set.
+* **ci_select.ru** - can be any of the above.
+
+All responses have 25 headers, total length approx 1kB.  ci_array.ru and ci_chunked.ru
+contain 1kB items.
+
+All can be delayed by a float value (seconds) specified by the `Dly` header
+
+Note that rhe `Body-Conf` header takes precedence, and `ENV['CI_BODY_CONF']` is
+only read on load.
+
+## ci_select.ru
+
+The ci_select.ru file allows a starting character to specify the body type in the
+`Body-Conf` header or with `ENV['CI_BODY_CONF']`.
+* **a** - array of strings
+* **c** - chunked (enum)
+* **s** - single string
+* **i** - File/IO
+
+A value of `a100` would return a body as an array of 100 1kB strings.

data/ext/puma_http11/extconf.rb

@@ -2,19 +2,23 @@ require 'mkmf'
 
 dir_config("puma_http11")
 
-if $mingw && RUBY_VERSION >= '2.4'
+if $mingw
   append_cflags  '-fstack-protector-strong -D_FORTIFY_SOURCE=2'
   append_ldflags '-fstack-protector-strong -l:libssp.a'
   have_library 'ssp'
 end
 
-unless ENV["DISABLE_SSL"]
+unless ENV["PUMA_DISABLE_SSL"]
   # don't use pkg_config('openssl') if '--with-openssl-dir' is used
-  has_openssl_dir = dir_config('openssl').any?
+  has_openssl_dir = dir_config('openssl').any? ||
+    RbConfig::CONFIG['configure_args']&.include?('openssl')
+
   found_pkg_config = !has_openssl_dir && pkg_config('openssl')
 
-  found_ssl = if (!$mingw || RUBY_VERSION >= '2.4') && found_pkg_config
-    puts 'using OpenSSL pkgconfig (openssl.pc)'
+  found_ssl = if !$mingw && found_pkg_config
+    puts '──── Using OpenSSL pkgconfig (openssl.pc) ────'
+    true
+  elsif have_library('libcrypto', 'BIO_read') && have_library('libssl', 'SSL_CTX_new')
     true
   elsif %w'crypto libeay32'.find {|crypto| have_library(crypto, 'BIO_read')} &&
       %w'ssl ssleay32'.find {|ssl| have_library(ssl, 'SSL_CTX_new')}
@@ -27,21 +31,27 @@ unless ENV["DISABLE_SSL"]
   if found_ssl
     have_header "openssl/bio.h"
 
-    # below is  yes for 1.0.2 & later
-    have_func  "DTLS_method"                           , "openssl/ssl.h"
+    ssl_h = "openssl/ssl.h".freeze
+
+    puts "\n──── Below are yes for 1.0.2 & later ────"
+    have_func "DTLS_method"                            , ssl_h
+    have_func "SSL_CTX_set_session_cache_mode(NULL, 0)", ssl_h
+
+    puts "\n──── Below are yes for 1.1.0 & later ────"
+    have_func "TLS_server_method"                      , ssl_h
+    have_func "SSL_CTX_set_min_proto_version(NULL, 0)" , ssl_h
 
-    # below are yes for 1.1.0 & later
-    have_func  "TLS_server_method"                     , "openssl/ssl.h"
-    have_func  "SSL_CTX_set_min_proto_version(NULL, 0)", "openssl/ssl.h"
+    puts "\n──── Below is yes for 1.1.0 and later, but isn't documented until 3.0.0 ────"
+    # https://github.com/openssl/openssl/blob/OpenSSL_1_1_0/include/openssl/ssl.h#L1159
+    have_func "SSL_CTX_set_dh_auto(NULL, 0)"           , ssl_h
 
-    have_func  "X509_STORE_up_ref"
-    have_func "SSL_CTX_set_ecdh_auto(NULL, 0)"         , "openssl/ssl.h"
+    puts "\n──── Below is yes for 1.1.1 & later ────"
+    have_func "SSL_CTX_set_ciphersuites(NULL, \"\")"   , ssl_h
 
-    # below exists in 1.1.0 and later, but isn't documented until 3.0.0
-    have_func "SSL_CTX_set_dh_auto(NULL, 0)"           , "openssl/ssl.h"
+    puts "\n──── Below is yes for 3.0.0 & later ────"
+    have_func "SSL_get1_peer_certificate"              , ssl_h
 
-    # below is yes for 3.0.0 & later
-    have_func "SSL_get1_peer_certificate"              , "openssl/ssl.h"
+    puts ''
 
     # Random.bytes available in Ruby 2.5 and later, Random::DEFAULT deprecated in 3.0
     if Random.respond_to?(:bytes)
@@ -53,7 +63,7 @@ unless ENV["DISABLE_SSL"]
   end
 end
 
-if ENV["MAKE_WARNINGS_INTO_ERRORS"]
+if ENV["PUMA_MAKE_WARNINGS_INTO_ERRORS"]
   # Make all warnings into errors
   # Except `implicit-fallthrough` since most failures comes from ragel state machine generated code
   if respond_to?(:append_cflags, true) # Ruby 2.5 and later

data/ext/puma_http11/http11_parser.c

@@ -297,7 +297,7 @@ case 13:
 tr18:
 #line 65 "ext/puma_http11/http11_parser.rl"
 	{
-    parser->http_version(parser, PTR_TO(mark), LEN(mark, p));
+    parser->server_protocol(parser, PTR_TO(mark), LEN(mark, p));
   }
 	goto st14;
 tr26:

data/ext/puma_http11/http11_parser.h

@@ -46,7 +46,7 @@ typedef struct puma_parser {
   element_cb fragment;
   element_cb request_path;
   element_cb query_string;
-  element_cb http_version;
+  element_cb server_protocol;
   element_cb header_done;
 
   char buf[BUFFER_LEN];

data/ext/puma_http11/http11_parser.java.rl

@@ -39,8 +39,8 @@ public class Http11Parser {
     Http11.query_string(runtime, parser.data, parser.buffer, parser.query_start, fpc-parser.query_start);
   }
 
-  action http_version {
-    Http11.http_version(runtime, parser.data, parser.buffer, parser.mark, fpc-parser.mark);
+  action server_protocol {
+    Http11.server_protocol(runtime, parser.data, parser.buffer, parser.mark, fpc-parser.mark);
   }
 
   action request_path {

data/ext/puma_http11/http11_parser.rl

@@ -62,8 +62,8 @@ static void snake_upcase_char(char *c)
     parser->query_string(parser, PTR_TO(query_start), LEN(query_start, fpc));
   }
 
-  action http_version {
-    parser->http_version(parser, PTR_TO(mark), LEN(mark, fpc));
+  action server_protocol {
+    parser->server_protocol(parser, PTR_TO(mark), LEN(mark, fpc));
   }
 
   action request_path {

data/ext/puma_http11/http11_parser_common.rl

@@ -38,8 +38,8 @@
   Method = ( upper | digit | safe ){1,20} >mark %request_method;
 
   http_number = ( digit+ "." digit+ ) ;
-  HTTP_Version = ( "HTTP/" http_number ) >mark %http_version ;
-  Request_Line = ( Method " " Request_URI ("#" Fragment){0,1} " " HTTP_Version CRLF ) ;
+  Server_Protocol = ( "HTTP/" http_number ) >mark %server_protocol ;
+  Request_Line = ( Method " " Request_URI ("#" Fragment){0,1} " " Server_Protocol CRLF ) ;
 
   field_name = ( token -- ":" )+ >start_field $snake_upcase_field %write_field;
 

data/ext/puma_http11/mini_ssl.c

@@ -36,6 +36,12 @@ void raise_file_error(const char* caller, const char *filename) {
   rb_raise(eError, "%s: error in file '%s': %s", caller, filename, ERR_error_string(ERR_get_error(), NULL));
 }
 
+NORETURN(void raise_param_error(const char* caller, const char *param));
+
+void raise_param_error(const char* caller, const char *param) {
+  rb_raise(eError, "%s: error with parameter '%s': %s", caller, param, ERR_error_string(ERR_get_error(), NULL));
+}
+
 void engine_free(void *ptr) {
   ms_conn *conn = ptr;
   ms_cert_buf* cert_buf = (ms_cert_buf*)SSL_get_app_data(conn->ssl);
@@ -185,6 +191,18 @@ static int engine_verify_callback(int preverify_ok, X509_STORE_CTX* ctx) {
   return preverify_ok;
 }
 
+static int password_callback(char *buf, int size, int rwflag, void *userdata) {
+    const char *password = (const char *) userdata;
+    size_t len = strlen(password);
+
+    if (len > (size_t) size) {
+      return 0;
+    }
+
+    memcpy(buf, password, len);
+    return (int) len;
+}
+
 static VALUE
 sslctx_alloc(VALUE klass) {
   SSL_CTX *ctx;
@@ -210,28 +228,35 @@ sslctx_alloc(VALUE klass) {
 VALUE
 sslctx_initialize(VALUE self, VALUE mini_ssl_ctx) {
   SSL_CTX* ctx;
-
+  int ssl_options;
+  VALUE key, cert, ca, verify_mode, ssl_cipher_filter, ssl_ciphersuites, no_tlsv1, no_tlsv1_1,
+    verification_flags, session_id_bytes, cert_pem, key_pem, key_password_command, key_password;
+  BIO *bio;
+  X509 *x509 = NULL;
+  EVP_PKEY *pkey;
+  pem_password_cb *password_cb = NULL;
+  const char *password = NULL;
 #ifdef HAVE_SSL_CTX_SET_MIN_PROTO_VERSION
   int min;
 #endif
-  int ssl_options;
-  VALUE key, cert, ca, verify_mode, ssl_cipher_filter, no_tlsv1, no_tlsv1_1,
-    verification_flags, session_id_bytes, cert_pem, key_pem;
 #ifndef HAVE_SSL_CTX_SET_DH_AUTO
   DH *dh;
 #endif
-  BIO *bio;
-  X509 *x509;
-  EVP_PKEY *pkey;
-
 #if OPENSSL_VERSION_NUMBER < 0x10002000L
   EC_KEY *ecdh;
 #endif
+#ifdef HAVE_SSL_CTX_SET_SESSION_CACHE_MODE
+  VALUE reuse, reuse_cache_size, reuse_timeout;
 
-  TypedData_Get_Struct(self, SSL_CTX, &sslctx_type, ctx);
+  reuse = rb_funcall(mini_ssl_ctx, rb_intern_const("reuse"), 0);
+  reuse_cache_size = rb_funcall(mini_ssl_ctx, rb_intern_const("reuse_cache_size"), 0);
+  reuse_timeout = rb_funcall(mini_ssl_ctx, rb_intern_const("reuse_timeout"), 0);
+#endif
 
   key = rb_funcall(mini_ssl_ctx, rb_intern_const("key"), 0);
 
+  key_password_command = rb_funcall(mini_ssl_ctx, rb_intern_const("key_password_command"), 0);
+
   cert = rb_funcall(mini_ssl_ctx, rb_intern_const("cert"), 0);
 
   ca = rb_funcall(mini_ssl_ctx, rb_intern_const("ca"), 0);
@@ -244,10 +269,14 @@ sslctx_initialize(VALUE self, VALUE mini_ssl_ctx) {
 
   ssl_cipher_filter = rb_funcall(mini_ssl_ctx, rb_intern_const("ssl_cipher_filter"), 0);
 
+  ssl_ciphersuites = rb_funcall(mini_ssl_ctx, rb_intern_const("ssl_ciphersuites"), 0);
+
   no_tlsv1 = rb_funcall(mini_ssl_ctx, rb_intern_const("no_tlsv1"), 0);
 
   no_tlsv1_1 = rb_funcall(mini_ssl_ctx, rb_intern_const("no_tlsv1_1"), 0);
 
+  TypedData_Get_Struct(self, SSL_CTX, &sslctx_type, ctx);
+
   if (!NIL_P(cert)) {
     StringValue(cert);
 
@@ -256,6 +285,18 @@ sslctx_initialize(VALUE self, VALUE mini_ssl_ctx) {
     }
   }
 
+  if (!NIL_P(key_password_command)) {
+      key_password = rb_funcall(mini_ssl_ctx, rb_intern_const("key_password"), 0);
+
+      if (!NIL_P(key_password)) {
+          StringValue(key_password);
+          password_cb = password_callback;
+          password = RSTRING_PTR(key_password);
+          SSL_CTX_set_default_passwd_cb(ctx, password_cb);
+          SSL_CTX_set_default_passwd_cb_userdata(ctx, (void *) password);
+      }
+  }
+
   if (!NIL_P(key)) {
     StringValue(key);
 
@@ -265,23 +306,78 @@ sslctx_initialize(VALUE self, VALUE mini_ssl_ctx) {
   }
 
   if (!NIL_P(cert_pem)) {
+    X509 *ca = NULL;
+    unsigned long err;
+
     bio = BIO_new(BIO_s_mem());
     BIO_puts(bio, RSTRING_PTR(cert_pem));
+
+    /**
+     * Much of this pulled as a simplified version of the `use_certificate_chain_file` method
+     * from openssl's `ssl_rsa.c` file.
+     */
+
+    /* first read the cert as the first item in the pem file */
     x509 = PEM_read_bio_X509(bio, NULL, NULL, NULL);
+    if (NULL == x509) {
+      BIO_free_all(bio);
+      raise_param_error("PEM_read_bio_X509", "cert_pem");
+    }
+
+    /* Add the cert to the context */
+    /* 1 is success - otherwise check the error codes */
+    if (1 != SSL_CTX_use_certificate(ctx, x509)) {
+      BIO_free_all(bio);
+      raise_param_error("SSL_CTX_use_certificate", "cert_pem");
+    }
+
+    X509_free(x509); /* no longer need our reference */
 
-    if (SSL_CTX_use_certificate(ctx, x509) != 1) {
-      raise_file_error("SSL_CTX_use_certificate", RSTRING_PTR(cert_pem));
+    /* Now lets load up the rest of the certificate chain */
+    /* 1 is success 0 is error */
+    if (0 == SSL_CTX_clear_chain_certs(ctx)) {
+      BIO_free_all(bio);
+      raise_param_error("SSL_CTX_clear_chain_certs","cert_pem");
+    }
+
+    while (1) {
+      ca = PEM_read_bio_X509(bio, NULL, NULL, NULL);
+
+      if (NULL == ca) {
+        break;
+      }
+
+      if (0 == SSL_CTX_add0_chain_cert(ctx, ca)) {
+        BIO_free_all(bio);
+        raise_param_error("SSL_CTX_add0_chain_cert","cert_pem");
+      }
+      /* don't free ca - its now owned by the context */
+    }
+
+    /* ca is NULL - so its either the end of the file or an error */
+    err = ERR_peek_last_error();
+
+    /* If its the end of the file - then we are done, in any case free the bio */
+    BIO_free_all(bio);
+
+    if ((ERR_GET_LIB(err) == ERR_LIB_PEM) && (ERR_GET_REASON(err) == PEM_R_NO_START_LINE)) {
+      ERR_clear_error();
+    } else {
+      raise_param_error("PEM_read_bio_X509","cert_pem");
     }
   }
 
   if (!NIL_P(key_pem)) {
     bio = BIO_new(BIO_s_mem());
     BIO_puts(bio, RSTRING_PTR(key_pem));
-    pkey = PEM_read_bio_PrivateKey(bio, NULL, NULL, NULL);
+    pkey = PEM_read_bio_PrivateKey(bio, NULL, password_cb, (void *) password);
 
     if (SSL_CTX_use_PrivateKey(ctx, pkey) != 1) {
+      BIO_free(bio);
       raise_file_error("SSL_CTX_use_PrivateKey", RSTRING_PTR(key_pem));
     }
+    EVP_PKEY_free(pkey);
+    BIO_free(bio);
   }
 
   verification_flags = rb_funcall(mini_ssl_ctx, rb_intern_const("verification_flags"), 0);
@@ -314,8 +410,6 @@ sslctx_initialize(VALUE self, VALUE mini_ssl_ctx) {
 
   SSL_CTX_set_min_proto_version(ctx, min);
 
-  SSL_CTX_set_options(ctx, ssl_options);
-
 #else
   /* As of 1.0.2f, SSL_OP_SINGLE_DH_USE key use is always on */
   ssl_options |= SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | SSL_OP_SINGLE_DH_USE;
@@ -326,10 +420,23 @@ sslctx_initialize(VALUE self, VALUE mini_ssl_ctx) {
   if(RTEST(no_tlsv1_1)) {
     ssl_options |= SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1;
   }
-  SSL_CTX_set_options(ctx, ssl_options);
 #endif
 
-  SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_OFF);
+#ifdef HAVE_SSL_CTX_SET_SESSION_CACHE_MODE
+  if (!NIL_P(reuse)) {
+    SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_SERVER);
+    if (!NIL_P(reuse_cache_size)) {
+      SSL_CTX_sess_set_cache_size(ctx, NUM2INT(reuse_cache_size));
+    }
+    if (!NIL_P(reuse_timeout)) {
+      SSL_CTX_set_timeout(ctx, NUM2INT(reuse_timeout));
+    }
+  } else {
+    SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_OFF);
+  }
+#endif
+
+  SSL_CTX_set_options(ctx, ssl_options);
 
   if (!NIL_P(ssl_cipher_filter)) {
     StringValue(ssl_cipher_filter);
@@ -339,9 +446,16 @@ sslctx_initialize(VALUE self, VALUE mini_ssl_ctx) {
     SSL_CTX_set_cipher_list(ctx, "HIGH:!aNULL@STRENGTH");
   }
 
+#if HAVE_SSL_CTX_SET_CIPHERSUITES
+  // Only override OpenSSL default ciphersuites if config option is supplied.
+  if (!NIL_P(ssl_ciphersuites)) {
+    StringValue(ssl_ciphersuites);
+    SSL_CTX_set_ciphersuites(ctx, RSTRING_PTR(ssl_ciphersuites));
+  }
+#endif
+
 #if OPENSSL_VERSION_NUMBER < 0x10002000L
-  // Remove this case if OpenSSL 1.0.1 (now EOL) support is no
-  // longer needed.
+  // Remove this case if OpenSSL 1.0.1 (now EOL) support is no longer needed.
   ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
   if (ecdh) {
     SSL_CTX_set_tmp_ecdh(ctx, ecdh);
@@ -442,7 +556,7 @@ NORETURN(void raise_error(SSL* ssl, int result));
 
 void raise_error(SSL* ssl, int result) {
   char buf[512];
-  char msg[512];
+  char msg[768];
   const char* err_str;
   int err = errno;
   int mask = 4095;
@@ -700,6 +814,10 @@ void Init_mini_ssl(VALUE puma) {
 
   rb_define_method(eng, "init?", engine_init, 0);
 
+  /* @!attribute [r] peercert
+   * Returns `nil` when `MiniSSL::Context#verify_mode` is set to `VERIFY_NONE`.
+   * @return [String, nil] DER encoded cert
+   */
   rb_define_method(eng, "peercert", engine_peercert, 0);
 
   rb_define_method(eng, "ssl_vers_st", engine_ssl_vers_st, 0);

data/ext/puma_http11/org/jruby/puma/Http11.java

@@ -26,14 +26,14 @@ public class Http11 extends RubyObject {
     public final static String MAX_FIELD_NAME_LENGTH_ERR = "HTTP element FIELD_NAME is longer than the 256 allowed length.";
     public final static int MAX_FIELD_VALUE_LENGTH = 80 * 1024;
     public final static String MAX_FIELD_VALUE_LENGTH_ERR = "HTTP element FIELD_VALUE is longer than the 81920 allowed length.";
-    public final static int MAX_REQUEST_URI_LENGTH = 1024 * 12;
-    public final static String MAX_REQUEST_URI_LENGTH_ERR = "HTTP element REQUEST_URI is longer than the 12288 allowed length.";
+    public final static int MAX_REQUEST_URI_LENGTH = getConstLength("PUMA_REQUEST_URI_MAX_LENGTH", 1024 * 12);
+    public final static String MAX_REQUEST_URI_LENGTH_ERR = "HTTP element REQUEST_URI is longer than the " + MAX_REQUEST_URI_LENGTH + " allowed length.";
     public final static int MAX_FRAGMENT_LENGTH = 1024;
     public final static String MAX_FRAGMENT_LENGTH_ERR = "HTTP element REQUEST_PATH is longer than the 1024 allowed length.";
-    public final static int MAX_REQUEST_PATH_LENGTH = 8192;
-    public final static String MAX_REQUEST_PATH_LENGTH_ERR = "HTTP element REQUEST_PATH is longer than the 8192 allowed length.";
-    public final static int MAX_QUERY_STRING_LENGTH = 1024 * 10;
-    public final static String MAX_QUERY_STRING_LENGTH_ERR = "HTTP element QUERY_STRING is longer than the 10240 allowed length.";
+    public final static int MAX_REQUEST_PATH_LENGTH = getConstLength("PUMA_REQUEST_PATH_MAX_LENGTH", 8192);
+    public final static String MAX_REQUEST_PATH_LENGTH_ERR = "HTTP element REQUEST_PATH is longer than the " + MAX_REQUEST_PATH_LENGTH + " allowed length.";
+    public final static int MAX_QUERY_STRING_LENGTH = getConstLength("PUMA_QUERY_STRING_MAX_LENGTH", 10 * 1024);
+    public final static String MAX_QUERY_STRING_LENGTH_ERR = "HTTP element QUERY_STRING is longer than the " + MAX_QUERY_STRING_LENGTH +" allowed length.";
     public final static int MAX_HEADER_LENGTH = 1024 * (80 + 32);
     public final static String MAX_HEADER_LENGTH_ERR = "HTTP element HEADER is longer than the 114688 allowed length.";
 
@@ -46,7 +46,28 @@ public class Http11 extends RubyObject {
     public static final ByteList FRAGMENT_BYTELIST = new ByteList(ByteList.plain("FRAGMENT"));
     public static final ByteList REQUEST_PATH_BYTELIST = new ByteList(ByteList.plain("REQUEST_PATH"));
     public static final ByteList QUERY_STRING_BYTELIST = new ByteList(ByteList.plain("QUERY_STRING"));
-    public static final ByteList HTTP_VERSION_BYTELIST = new ByteList(ByteList.plain("HTTP_VERSION"));
+    public static final ByteList SERVER_PROTOCOL_BYTELIST = new ByteList(ByteList.plain("SERVER_PROTOCOL"));
+
+    public static String getEnvOrProperty(String name) {
+        String envValue = System.getenv(name);
+        return (envValue != null) ? envValue : System.getProperty(name);
+    }
+
+    public static int getConstLength(String name, Integer defaultValue) {
+        String stringValue = getEnvOrProperty(name);
+        if (stringValue == null || stringValue.isEmpty()) return defaultValue;
+
+        try {
+            int value = Integer.parseUnsignedInt(stringValue);
+            if (value <= 0) {
+                throw new NumberFormatException("The number is not positive.");
+            }
+            return value;
+        } catch (NumberFormatException e) {
+            System.err.println(String.format("The value %s for %s is invalid. Using default value %d instead.", stringValue, name, defaultValue));
+            return defaultValue;
+        }
+    }
 
     private static ObjectAllocator ALLOCATOR = new ObjectAllocator() {
         public IRubyObject allocate(Ruby runtime, RubyClass klass) {
@@ -56,7 +77,7 @@ public class Http11 extends RubyObject {
 
     public static void createHttp11(Ruby runtime) {
         RubyModule mPuma = runtime.defineModule("Puma");
-        mPuma.defineClassUnder("HttpParserError",runtime.getClass("IOError"),runtime.getClass("IOError").getAllocator());
+        mPuma.defineClassUnder("HttpParserError",runtime.getClass("StandardError"),runtime.getClass("StandardError").getAllocator());
 
         RubyClass cHttpParser = mPuma.defineClassUnder("HttpParser",runtime.getObject(),ALLOCATOR);
         cHttpParser.defineAnnotatedMethods(Http11.class);
@@ -155,9 +176,9 @@ public class Http11 extends RubyObject {
         req.fastASet(RubyString.newStringShared(runtime, QUERY_STRING_BYTELIST),val);
     }
 
-    public static void http_version(Ruby runtime, RubyHash req, ByteList buffer, int at, int length) {
+    public static void server_protocol(Ruby runtime, RubyHash req, ByteList buffer, int at, int length) {
         RubyString val = RubyString.newString(runtime,new ByteList(buffer,at,length));
-        req.fastASet(RubyString.newStringShared(runtime, HTTP_VERSION_BYTELIST),val);
+        req.fastASet(RubyString.newStringShared(runtime, SERVER_PROTOCOL_BYTELIST),val);
     }
 
     public void header_done(Ruby runtime, RubyHash req, ByteList buffer, int at, int length) {

data/ext/puma_http11/org/jruby/puma/Http11Parser.java

@@ -383,7 +383,7 @@ case 1:
 	case 11:
 // line 42 "ext/puma_http11/http11_parser.java.rl"
 	{
-    Http11.http_version(runtime, parser.data, parser.buffer, parser.mark, p-parser.mark);
+    Http11.server_protocol(runtime, parser.data, parser.buffer, parser.mark, p-parser.mark);
   }
 	break;
 	case 12: