puma 6.4.0-java → 6.4.2-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 725988ce035212443c9cd9c6e250dc80edb5de0d1b843a49d11158e5055699b8
-  data.tar.gz: e5f9f2eb0cf769ff5497ce68bb565f8ead8057ca1293d83a2ff10b89044e58ef
+  metadata.gz: 1736c6dd01c94d6cf6a109965156ec60ec8a9deb17b42bdabc198f79d1b72c1a
+  data.tar.gz: 58e70495466aa055fc76038a23cf394167ca393959ab7bfa8a55306a7506f1ac
 SHA512:
-  metadata.gz: f8a546a676d69611917f30f3839ca01f84f4374e40aa1167882784013b8bddfd95ce03d84aecff86017bf23c9cd7a5efa097fc4c746299da224866737388cdfe
-  data.tar.gz: 7bbf658a44f85eb817101d86e565e03def93a580b31bf4cfd739ecca6c639b070bea75cb3660fe25ab9519396fed9fd31b664b625328430784fdc05cab922f78
+  metadata.gz: 5ee67bed8910a53a217a6d9f799cf7a64f145d5a80a0cbea224949e3ae2fe76ae31dc5e5991a7983f71cbe34836ef568cab41a6d0ae5ca7d21cf0f87b8fac09e
+  data.tar.gz: '0085fa5bd8492707be9c52b3618c0663a06a2aad62e5fe60b66521d51572f8159d22f5f14b265314c1a094bec0d506dabef74c514fb8813d9a31d9f5395bfd3d'

data/History.md

@@ -1,8 +1,37 @@
+## 6.4.2 / 2024-01-08
+
+* Security
+  * Limit the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption. ([GHSA-c2f4-cvqm-65w2](https://github.com/puma/puma/security/advisories/GHSA-c2f4-cvqm-65w2))
+
+## 6.4.1 / 2024-01-03
+
+* Bugfixes
+  * DSL#warn_if_in_single_mode - fixup when workers set via CLI ([#3256])
+  * Fix `idle-timeout` not working in cluster mode ([#3235], [#3228], [#3282], [#3283])
+  * Fix worker 0 timing out during phased restart ([#3225], [#2786])
+  * context_builder.rb - require openssl if verify_mode != 'none' ([#3179])
+  * Make puma cluster process suitable as PID 1 ([#3255])
+  * Improve Puma::NullIO consistency with real IO ([#3276])
+  * extconf.rb - fixup to detect openssl info in Ruby build ([#3271], [#3266])
+  * MiniSSL.java - set serialVersionUID, fix RaiseException deprecation ([#3270])
+  * dsl.rb - fix warn_if_in_single_mode when WEB_CONCURRENCY is set ([#3265], [#3264])
+
+* Maintenance
+  * LOTS of test refactoring to make tests more stable and easier to write - thanks to @MSP-Greg!
+  * Fix bug in tests re: TestPuma::HOST4 ([#3254])
+  * Dockerfile for minimal repros: use Ruby 3.2, expect bundler installed ([#3245])
+  * fix define_method calls, use Symbol parameter instead of String ([#3293])
+
+* Docs
+  * README.md - add the puma-acme plugin ([#3301])
+  * Remove `--keep-file-descriptors` flag from systemd docs ([#3248])
+  * Note symlink mechanism in restart documentation for hot restart ([#3298])
+
 ## 6.4.0 / 2023-09-21
 
 * Features
   * on_thread_exit hook ([#2920])
-  * on_thread_start_hook ([#3195]) 
+  * on_thread_start_hook ([#3195])
   * Shutdown on idle ([#3209], [#2580])
   * New error message when control server port taken ([#3204])
 
@@ -12,13 +41,13 @@
 
 * Bugfixes
   * Bring the cert_pem: parameter into parity with the cert: parameter to ssl_bind. ([#3174])
-  * Fix using control server with IPv6 host ([#3181]) 
+  * Fix using control server with IPv6 host ([#3181])
   * control_cli.rb - add require_relative 'log_writer' ([#3187])
   * Fix cases where fallback Rack response wasn't sent to the client ([#3094])
-  
+
 ## 6.3.1 / 2023-08-18
 
-* Security 
+* Security
   * Address HTTP request smuggling vulnerabilities with zero-length Content Length header and trailer fields ([GHSA-68xg-gqqm-vgj8](https://github.com/puma/puma/security/advisories/GHSA-68xg-gqqm-vgj8))
 
 ## 6.3.0 / 2023-05-31
@@ -92,12 +121,12 @@
   * Refactor const.rb - freeze ([#3016])
 
 ## 6.0.1 / 2022-12-20
- 
+
 * Bugfixes
   * Handle waking up a closed selector in Reactor#add ([#3005])
   * Fixup response processing, enumerable bodies ([#3004], [#3000])
   * Correctly close app body for all code paths ([#3002], [#2999])
-* Refactor 
+* Refactor
   * Add IOBuffer to Client, remove from ThreadPool thread instances ([#3013])
 
 ## 6.0.0 / 2022-10-14
@@ -126,12 +155,12 @@
   * Allow header values to be arrays (Rack 3) ([#2936], [#2931])
   * Export Puma/Ruby versions in /stats ([#2875])
   * Allow configuring request uri max length & request path max length ([#2840])
-  * Add a couple of public accessors ([#2774]) 
+  * Add a couple of public accessors ([#2774])
   * Log entire backtrace when worker start fails ([#2891])
   * [jruby] Enable TLSv1.3 support ([#2886])
   * [jruby] support setting TLS protocols + rename ssl_cipher_list ([#2899])
   * [jruby] Support a truststore option ([#2849], [#2904], [#2884])
-  
+
 * Bugfixes
   * Load the configuration before passing it to the binder ([#2897])
   * Do not raise error raised on HTTP methods we don't recognize or support, like CONNECT ([#2932], [#1441])
@@ -144,9 +173,14 @@
   * Ruby 3.2 will have native IO#wait_* methods, don't require io/wait ([#2903])
   * Various internal API refactorings ([#2942], [#2921], [#2922], [#2955])
 
+## 5.6.8 / 2024-01-08
+
+* Security
+  * Limit the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption. ([GHSA-c2f4-cvqm-65w2](https://github.com/puma/puma/security/advisories/GHSA-c2f4-cvqm-65w2))
+
 ## 5.6.7 / 2023-08-18
 
-* Security 
+* Security
   * Address HTTP request smuggling vulnerabilities with zero-length Content Length header and trailer fields ([GHSA-68xg-gqqm-vgj8](https://github.com/puma/puma/security/advisories/GHSA-68xg-gqqm-vgj8))
 
 ## 5.6.6 / 2023-06-21
@@ -2029,6 +2063,27 @@ be added back in a future date when a java Puma::MiniSSL is added.
 * Bugfixes
   * Your bugfix goes here <Most recent on the top, like GitHub> (#Github Number)
 
+[#3256]:https://github.com/puma/puma/pull/3256     "PR by @MSP-Greg, merged 2023-10-16"
+[#3235]:https://github.com/puma/puma/pull/3235     "PR by @joshuay03, merged 2023-10-03"
+[#3228]:https://github.com/puma/puma/issues/3228   "Issue by @davidalejandroaguilar, closed 2023-10-03"
+[#3282]:https://github.com/puma/puma/issues/3282   "Issue by @bensheldon, closed 2024-01-02"
+[#3283]:https://github.com/puma/puma/pull/3283     "PR by @joshuay03, merged 2024-01-02"
+[#3225]:https://github.com/puma/puma/pull/3225     "PR by @joshuay03, merged 2023-09-27"
+[#2786]:https://github.com/puma/puma/issues/2786   "Issue by @vitiokss, closed 2023-09-27"
+[#3179]:https://github.com/puma/puma/pull/3179     "PR by @MSP-Greg, merged 2023-09-26"
+[#3255]:https://github.com/puma/puma/pull/3255     "PR by @casperisfine, merged 2023-10-19"
+[#3276]:https://github.com/puma/puma/pull/3276     "PR by @casperisfine, merged 2023-11-16"
+[#3271]:https://github.com/puma/puma/pull/3271     "PR by @MSP-Greg, merged 2023-10-30"
+[#3266]:https://github.com/puma/puma/issues/3266   "Issue by @Dragonicity, closed 2023-10-30"
+[#3270]:https://github.com/puma/puma/pull/3270     "PR by @MSP-Greg, merged 2023-10-30"
+[#3265]:https://github.com/puma/puma/pull/3265     "PR by @MSP-Greg, merged 2023-10-25"
+[#3264]:https://github.com/puma/puma/issues/3264   "Issue by @dentarg, closed 2023-10-25"
+[#3254]:https://github.com/puma/puma/pull/3254     "PR by @casperisfine, merged 2023-10-11"
+[#3245]:https://github.com/puma/puma/pull/3245     "PR by @olleolleolle, merged 2023-10-02"
+[#3293]:https://github.com/puma/puma/pull/3293     "PR by @MSP-Greg, merged 2023-12-21"
+[#3301]:https://github.com/puma/puma/pull/3301     "PR by @benburkert, merged 2023-12-29"
+[#3248]:https://github.com/puma/puma/pull/3248     "PR by @dentarg, merged 2023-10-04"
+[#3298]:https://github.com/puma/puma/pull/3298     "PR by @til, merged 2023-12-26"
 [#2920]:https://github.com/puma/puma/pull/2920     "PR by @biinari, merged 2023-07-11"
 [#3195]:https://github.com/puma/puma/pull/3195     "PR by @binarygit, merged 2023-08-15"
 [#3209]:https://github.com/puma/puma/pull/3209     "PR by @joshuay03, merged 2023-09-04"
@@ -2213,7 +2268,7 @@ be added back in a future date when a java Puma::MiniSSL is added.
 [#2563]:https://github.com/puma/puma/pull/2563     "PR by @MSP-Greg, merged 2021-03-06"
 [#2504]:https://github.com/puma/puma/issues/2504   "Issue by @fsateler, closed 2021-03-06"
 [#2591]:https://github.com/puma/puma/pull/2591     "PR by @MSP-Greg, merged 2021-05-05"
-[#2572]:https://github.com/puma/puma/issues/2572   "Issue by @josefbilendo, closed 2021-05-05"
+[#2572]:https://github.com/puma/puma/issues/2572   "Issue by @josef-krabath, closed 2021-05-05"
 [#2613]:https://github.com/puma/puma/pull/2613     "PR by @smcgivern, merged 2021-04-27"
 [#2605]:https://github.com/puma/puma/pull/2605     "PR by @pascalbetz, merged 2021-04-26"
 [#2584]:https://github.com/puma/puma/issues/2584   "Issue by @kaorihinata, closed 2021-04-26"
@@ -2529,7 +2584,7 @@ be added back in a future date when a java Puma::MiniSSL is added.
 [#1110]:https://github.com/puma/puma/pull/1110     "PR by @montdidier, merged 2016-12-12"
 [#1135]:https://github.com/puma/puma/pull/1135     "PR by @jkraemer, merged 2016-11-19"
 [#1081]:https://github.com/puma/puma/pull/1081     "PR by @frodsan, merged 2016-09-08"
-[#1138]:https://github.com/puma/puma/pull/1138     "PR by @steakknife, merged 2016-12-13"
+[#1138]:https://github.com/puma/puma/pull/1138     "PR by @skull-squadron, merged 2016-12-13"
 [#1118]:https://github.com/puma/puma/pull/1118     "PR by @hiroara, merged 2016-11-20"
 [#1075]:https://github.com/puma/puma/issues/1075   "Issue by @pvalena, closed 2016-09-06"
 [#932]:https://github.com/puma/puma/issues/932     "Issue by @everplays, closed 2016-07-24"

data/README.md

@@ -410,6 +410,7 @@ Community guides:
 * [puma-plugin-statsd](https://github.com/yob/puma-plugin-statsd) — send Puma metrics to statsd
 * [puma-plugin-systemd](https://github.com/sj26/puma-plugin-systemd) — deeper integration with systemd for notify, status and watchdog. Puma 5.1.0 integrated notify and watchdog, which probably conflicts with this plugin. Puma 6.1.0 added status support which obsoletes the plugin entirely.
 * [puma-plugin-telemetry](https://github.com/babbel/puma-plugin-telemetry) - telemetry plugin for Puma offering various targets to publish
+* [puma-acme](https://github.com/anchordotdev/puma-acme) - automatic SSL/HTTPS certificate provisioning and setup
 
 ### Monitoring
 

data/docs/kubernetes.md

@@ -69,7 +69,7 @@ More discussions and links to relevant articles can be found in https://github.c
 
 With containerization, you will have to make a decision about how "big" to make each pod. Should you run 2 pods with 50 workers each? 25 pods, each with 4 workers? 100 pods, with each Puma running in single mode? Each scenario represents the same total amount of capacity (100 Puma processes that can respond to requests), but there are tradeoffs to make.
 
-* Worker counts should be somewhere between 4 and 32 in most cases. You want more than 4 in order to minimize time spent in request queueing for a free Puma worker, but probably less than ~32 because otherwise autoscaling is working in too large of an increment or they probably won't fit very well into your nodes.
+* Worker counts should be somewhere between 4 and 32 in most cases. You want more than 4 in order to minimize time spent in request queueing for a free Puma worker, but probably less than ~32 because otherwise autoscaling is working in too large of an increment or they probably won't fit very well into your nodes. In any queueing system, queue time is proportional to 1/n, where n is the number of things pulling from the queue. Each pod will have its own request queue (i.e., the socket backlog). If you have 4 pods with 1 worker each (4 request queues), wait times are, proportionally, about 4 times higher than if you had 1 pod with 4 workers (1 request queue).
 * Unless you have a very I/O-heavy application (50%+ time spent waiting on IO), use the default thread count (5 for MRI). Using higher numbers of threads with low I/O wait (<50%) will lead to additional request queueing time (latency!) and additional memory usage.
 * More processes per pod reduces memory usage per process, because of copy-on-write memory and because the cost of the single master process is "amortized" over more child processes.
 * Don't run less than 4 processes per pod if you can. Low numbers of processes per pod will lead to high request queueing, which means you will have to run more pods.

data/docs/restart.md

@@ -27,6 +27,7 @@ Any of the following will cause a Puma server to perform a hot restart:
 
 ### Additional notes
 
+* The newly started Puma process changes its current working directory to the directory specified by the `directory` option. If `directory` is set to symlink, this is automatically re-evaluated, so this mechanism can be used to upgrade the application.
 * Only one version of the application is running at a time.
 * `on_restart` is invoked just before the server shuts down. This can be used to clean up resources (like long-lived database connections) gracefully. Since Ruby 2.0, it is not typically necessary to explicitly close file descriptors on restart. This is because any file descriptor opened by Ruby will have the `FD_CLOEXEC` flag set, meaning that file descriptors are closed on `exec`. `on_restart` is useful, though, if your application needs to perform any more graceful protocol-specific shutdown procedures before closing connections.
 

data/docs/systemd.md

@@ -51,7 +51,7 @@ ExecStart=/<FULLPATH>/bin/puma -C <YOUR_APP_PATH>/puma.rb
 # Variant: Rails start.
 # ExecStart=/<FULLPATH>/bin/puma -C <YOUR_APP_PATH>/config/puma.rb ../config.ru
 
-# Variant: Use `bundle exec --keep-file-descriptors puma` instead of binstub
+# Variant: Use `bundle exec puma` instead of binstub
 # Variant: Specify directives inline.
 # ExecStart=/<FULLPATH>/puma -b tcp://0.0.0.0:9292 -b ssl://0.0.0.0:9293?key=key.pem&cert=cert.pem
 
@@ -76,9 +76,7 @@ compatible with both clustered mode and application preload.
 
 **Note:** Any wrapper scripts which `exec`, or other indirections in `ExecStart`
 may result in activated socket file descriptors being closed before reaching the
-puma master process. For example, if using `bundle exec`, pass the
-`--keep-file-descriptors` flag. `bundle exec` can be avoided by using a `puma`
-executable generated by `bundle binstubs puma`. This is tracked in [#1499].
+puma master process.
 
 **Note:** Socket activation doesn't currently work on JRuby. This is tracked in
 [#1367].

data/ext/puma_http11/extconf.rb

@@ -10,7 +10,11 @@ end
 
 unless ENV["PUMA_DISABLE_SSL"]
   # don't use pkg_config('openssl') if '--with-openssl-dir' is used
-  has_openssl_dir = dir_config('openssl').any?
+  # also looks within the Ruby build for directory info
+  has_openssl_dir = dir_config('openssl').any? ||
+    RbConfig::CONFIG['configure_args']&.include?('openssl') ||
+    Dir.exist?("#{RbConfig::TOPDIR}/src/main/c/openssl") # TruffleRuby
+
   found_pkg_config = !has_openssl_dir && pkg_config('openssl')
 
   found_ssl = if !$mingw && found_pkg_config

data/ext/puma_http11/mini_ssl.c

@@ -546,7 +546,7 @@ NORETURN(void raise_error(SSL* ssl, int result));
 
 void raise_error(SSL* ssl, int result) {
   char buf[512];
-  char msg[512];
+  char msg[768];
   const char* err_str;
   int err = errno;
   int mask = 4095;
@@ -804,6 +804,10 @@ void Init_mini_ssl(VALUE puma) {
 
   rb_define_method(eng, "init?", engine_init, 0);
 
+  /* @!attribute [r] peercert
+   * Returns `nil` when `MiniSSL::Context#verify_mode` is set to `VERIFY_NONE`.
+   * @return [String, nil] DER encoded cert
+   */
   rb_define_method(eng, "peercert", engine_peercert, 0);
 
   rb_define_method(eng, "ssl_vers_st", engine_ssl_vers_st, 0);

data/ext/puma_http11/org/jruby/puma/MiniSSL.java

@@ -47,6 +47,7 @@ import static javax.net.ssl.SSLEngineResult.Status;
 import static javax.net.ssl.SSLEngineResult.HandshakeStatus;
 
 public class MiniSSL extends RubyObject { // MiniSSL::Engine
+  private static final long serialVersionUID = -6903439483039141234L;
   private static ObjectAllocator ALLOCATOR = new ObjectAllocator() {
     public IRubyObject allocate(Ruby runtime, RubyClass klass) {
       return new MiniSSL(runtime, klass);
@@ -500,7 +501,7 @@ public class MiniSSL extends RubyObject { // MiniSSL::Engine
   }
 
   private static RaiseException newError(Ruby runtime, RubyClass errorClass, String message, Throwable cause) {
-    RaiseException ex = new RaiseException(runtime, errorClass, message, true);
+    RaiseException ex = RaiseException.from(runtime, errorClass, message);
     ex.initCause(cause);
     return ex;
   }

data/lib/puma/client.rb

@@ -51,6 +51,14 @@ module Puma
     CHUNK_VALID_ENDING = Const::LINE_END
     CHUNK_VALID_ENDING_SIZE = CHUNK_VALID_ENDING.bytesize
 
+    # The maximum number of bytes we'll buffer looking for a valid
+    # chunk header.
+    MAX_CHUNK_HEADER_SIZE = 4096
+
+    # The maximum amount of excess data the client sends
+    # using chunk size extensions before we abort the connection.
+    MAX_CHUNK_EXCESS = 16 * 1024
+
     # Content-Length header value validation
     CONTENT_LENGTH_VALUE_INVALID = /[^\d]/.freeze
 
@@ -496,6 +504,7 @@ module Puma
       @chunked_body = true
       @partial_part_left = 0
       @prev_chunk = ""
+      @excess_cr = 0
 
       @body = Tempfile.new(Const::PUMA_TMP_BASE)
       @body.unlink
@@ -577,6 +586,20 @@ module Puma
             end
           end
 
+          # Track the excess as a function of the size of the
+          # header vs the size of the actual data. Excess can
+          # go negative (and is expected to) when the body is
+          # significant.
+          # The additional of chunk_hex.size and 2 compensates
+          # for a client sending 1 byte in a chunked body over
+          # a long period of time, making sure that that client
+          # isn't accidentally eventually punished.
+          @excess_cr += (line.size - len - chunk_hex.size - 2)
+
+          if @excess_cr >= MAX_CHUNK_EXCESS
+            raise HttpParserError, "Maximum chunk excess detected"
+          end
+
           len += 2
 
           part = io.read(len)
@@ -604,6 +627,10 @@ module Puma
             @partial_part_left = len - part.size
           end
         else
+          if @prev_chunk.size + chunk.size >= MAX_CHUNK_HEADER_SIZE
+            raise HttpParserError, "maximum size of chunk header exceeded"
+          end
+
           @prev_chunk = line
           return false
         end

data/lib/puma/cluster.rb

@@ -85,9 +85,7 @@ module Puma
         @workers << WorkerHandle.new(idx, pid, @phase, @options)
       end
 
-      if @options[:fork_worker] &&
-        @workers.all? {|x| x.phase == @phase}
-
+      if @options[:fork_worker] && all_workers_in_phase?
         @fork_writer << "0\n"
       end
     end
@@ -148,10 +146,22 @@ module Puma
       idx
     end
 
+    def worker_at(idx)
+      @workers.find { |w| w.index == idx }
+    end
+
     def all_workers_booted?
       @workers.count { |w| !w.booted? } == 0
     end
 
+    def all_workers_in_phase?
+      @workers.all? { |w| w.phase == @phase }
+    end
+
+    def all_workers_idle_timed_out?
+      (@workers.map(&:pid) - idle_timed_out_worker_pids).empty?
+    end
+
     def check_workers
       return if @next_check >= Time.now
 
@@ -276,7 +286,7 @@ module Puma
 
     # @version 5.0.0
     def fork_worker!
-      if (worker = @workers.find { |w| w.index == 0 })
+      if (worker = worker_at 0)
         worker.phase += 1
       end
       phased_restart(true)
@@ -338,6 +348,8 @@ module Puma
     def run
       @status = :run
 
+      @idle_workers = {}
+
       output_header "cluster"
 
       # This is aligned with the output from Runner, see Runner#output_header
@@ -411,6 +423,8 @@ module Puma
 
       @master_read, @worker_write = read, @wakeup
 
+      @options[:worker_write] = @worker_write
+
       @config.run_hooks(:before_fork, nil, @log_writer)
 
       spawn_workers
@@ -426,6 +440,11 @@ module Puma
 
         while @status == :run
           begin
+            if all_workers_idle_timed_out?
+              log "- All workers reached idle timeout"
+              break
+            end
+
             if @phased_restart
               start_phased_restart
               @phased_restart = false
@@ -446,7 +465,7 @@ module Puma
 
               if req == "b" || req == "f"
                 pid, idx = result.split(':').map(&:to_i)
-                w = @workers.find {|x| x.index == idx}
+                w = worker_at idx
                 w.pid = pid if w.pid.nil?
               end
 
@@ -463,24 +482,37 @@ module Puma
                 when "t"
                   w.term unless w.term?
                 when "p"
-                  w.ping!(result.sub(/^\d+/,'').chomp)
+                  status = result.sub(/^\d+/,'').chomp
+                  w.ping!(status)
                   @events.fire(:ping!, w)
+
+                  if in_phased_restart && workers_not_booted.positive? && w0 = worker_at(0)
+                    w0.ping!(status)
+                    @events.fire(:ping!, w0)
+                  end
+
                   if !booted && @workers.none? {|worker| worker.last_status.empty?}
                     @events.fire_on_booted!
                     debug_loaded_extensions("Loaded Extensions - master:") if @log_writer.debug?
                     booted = true
                   end
+                when "i"
+                  if @idle_workers[pid]
+                    @idle_workers.delete pid
+                  else
+                    @idle_workers[pid] = true
+                  end
                 end
               else
                 log "! Out-of-sync worker list, no #{pid} worker"
               end
             end
+
             if in_phased_restart && workers_not_booted.zero?
               @events.fire_on_booted!
               debug_loaded_extensions("Loaded Extensions - master:") if @log_writer.debug?
               in_phased_restart = false
             end
-
           rescue Interrupt
             @status = :stop
           end
@@ -509,10 +541,28 @@ module Puma
     # loops thru @workers, removing workers that exited, and calling
     # `#term` if needed
     def wait_workers
+      # Reap all children, known workers or otherwise.
+      # If puma has PID 1, as it's common in containerized environments,
+      # then it's responsible for reaping orphaned processes, so we must reap
+      # all our dead children, regardless of whether they are workers we spawned
+      # or some reattached processes.
+      reaped_children = {}
+      loop do
+        begin
+          pid, status = Process.wait2(-1, Process::WNOHANG)
+          break unless pid
+          reaped_children[pid] = status
+        rescue Errno::ECHILD
+          break
+        end
+      end
+
       @workers.reject! do |w|
         next false if w.pid.nil?
         begin
-          if Process.wait(w.pid, Process::WNOHANG)
+          # When `fork_worker` is enabled, some worker may not be direct children, but grand children.
+          # Because of this they won't be reaped by `Process.wait2(-1)`, so we need to check them individually)
+          if reaped_children.delete(w.pid) || (@options[:fork_worker] && Process.wait(w.pid, Process::WNOHANG))
             true
           else
             w.term if w.term?
@@ -529,6 +579,11 @@ module Puma
           end
         end
       end
+
+      # Log unknown children
+      reaped_children.each do |pid, status|
+        log "! reaped unknown child process pid=#{pid} status=#{status}"
+      end
     end
 
     # @version 5.0.0
@@ -536,14 +591,18 @@ module Puma
       @workers.each do |w|
         if !w.term? && w.ping_timeout <= Time.now
           details = if w.booted?
-                      "(worker failed to check in within #{@options[:worker_timeout]} seconds)"
+                      "(Worker #{w.index} failed to check in within #{@options[:worker_timeout]} seconds)"
                     else
-                      "(worker failed to boot within #{@options[:worker_boot_timeout]} seconds)"
+                      "(Worker #{w.index} failed to boot within #{@options[:worker_boot_timeout]} seconds)"
                     end
           log "! Terminating timed out worker #{details}: #{w.pid}"
           w.kill
         end
       end
     end
+
+    def idle_timed_out_worker_pids
+      @idle_workers.keys
+    end
   end
 end

data/lib/puma/configuration.rb

@@ -3,7 +3,7 @@
 require_relative 'rack/builder'
 require_relative 'plugin'
 require_relative 'const'
-# note that dsl is loaded at end of file, requires ConfigDefault constants
+require_relative 'dsl'
 
 module Puma
   # A class used for storing "leveled" configuration options.
@@ -387,5 +387,3 @@ module Puma
     end
   end
 end
-
-require_relative 'dsl'

data/lib/puma/const.rb

@@ -100,7 +100,7 @@ module Puma
   # too taxing on performance.
   module Const
 
-    PUMA_VERSION = VERSION = "6.4.0"
+    PUMA_VERSION = VERSION = "6.4.2"
     CODE_NAME = "The Eagle of Durango"
 
     PUMA_SERVER_STRING = ["puma", PUMA_VERSION, CODE_NAME].join(" ").freeze

data/lib/puma/detect.rb

@@ -12,15 +12,14 @@ module Puma
 
   IS_JRUBY = Object.const_defined? :JRUBY_VERSION
 
-  IS_OSX = RUBY_PLATFORM.include? 'darwin'
+  IS_OSX = RUBY_DESCRIPTION.include? 'darwin'
 
-  IS_WINDOWS = !!(RUBY_PLATFORM =~ /mswin|ming|cygwin/) ||
-    IS_JRUBY && RUBY_DESCRIPTION.include?('mswin')
+  IS_WINDOWS = RUBY_DESCRIPTION.match?(/mswin|ming|cygwin/)
 
   IS_LINUX = !(IS_OSX || IS_WINDOWS)
 
   # @version 5.2.0
-  IS_MRI = (RUBY_ENGINE == 'ruby' || RUBY_ENGINE.nil?)
+  IS_MRI = RUBY_ENGINE == 'ruby'
 
   def self.jruby?
     IS_JRUBY

data/lib/puma/dsl.rb

@@ -729,11 +729,15 @@ module Puma
       process_hook :before_refork, key, block, 'on_refork'
     end
 
-    # Code to run immediately before a thread starts. The worker does not
-    # start new threads until this code finishes.
+    # Provide a block to be executed just before a thread is added to the thread
+    # pool. Be careful: while the block executes, thread creation is delayed, and
+    # probably a request will have to wait too! The new thread will not be added to
+    # the threadpool until the provided block returns.
     #
-    # This hook is useful for doing something when a thread
-    # starts.
+    # Return values are ignored.
+    # Raising an exception will log a warning.
+    #
+    # This hook is useful for doing something when the thread pool grows.
     #
     # This can be called multiple times to add several hooks.
     #
@@ -746,8 +750,15 @@ module Puma
       @options[:before_thread_start] << block
     end
 
-    # Code to run immediately before a thread exits. The worker does not
-    # accept new requests until this code finishes.
+    # Provide a block to be executed after a thread is trimmed from the thread
+    # pool. Be careful: while this block executes, Puma's main loop is
+    # blocked, so no new requests will be picked up.
+    #
+    # This hook only runs when a thread in the threadpool is trimmed by Puma.
+    # It does not run when a thread dies due to exceptions or any other cause.
+    #
+    # Return values are ignored.
+    # Raising an exception will log a warning.
     #
     # This hook is useful for cleaning up thread local resources when a thread
     # is trimmed.
@@ -1179,8 +1190,10 @@ module Puma
 
     def warn_if_in_single_mode(hook_name)
       return if @options[:silence_fork_callback_warning]
-
-      if (@options[:workers] || 0) == 0
+      # user_options (CLI) have precedence over config file
+      workers_val = @config.options.user_options[:workers] || @options[:workers] ||
+        @config.puma_default_options[:workers] || 0
+      if workers_val == 0
         log_string =
           "Warning: You specified code to run in a `#{hook_name}` block, " \
           "but Puma is not configured to run in cluster mode (worker count > 0 ), " \

data/lib/puma/minissl/context_builder.rb

@@ -51,6 +51,8 @@ module Puma
             unless params['ca']
               log_writer.error "Please specify the SSL ca via 'ca='"
             end
+            # needed for Puma::MiniSSL::Socket#peercert, env['puma.peercert']
+            require 'openssl'
           end
 
           ctx.ca = params['ca'] if params['ca']

data/lib/puma/minissl.rb

@@ -184,6 +184,11 @@ module Puma
         @socket.peeraddr
       end
 
+      # OpenSSL is loaded in `MiniSSL::ContextBuilder` when
+      # `MiniSSL::Context#verify_mode` is not `VERIFY_NONE`.
+      # When `VERIFY_NONE`, `MiniSSL::Engine#peercert` is nil, regardless of
+      # whether the client sends a cert.
+      # @return [OpenSSL::X509::Certificate, nil]
       # @!attribute [r] peercert
       def peercert
         return @peercert if @peercert

data/lib/puma/null_io.rb

@@ -18,8 +18,22 @@ module Puma
 
     # Mimics IO#read with no data.
     #
-    def read(count = nil, _buffer = nil)
-      count && count > 0 ? nil : ""
+    def read(length = nil, buffer = nil)
+      if length.to_i < 0
+        raise ArgumentError, "(negative length #{length} given)"
+      end
+
+      buffer = if buffer.nil?
+        "".b
+      else
+        String.try_convert(buffer) or raise TypeError, "no implicit conversion of #{buffer.class} into String"
+      end
+      buffer.clear
+      if length.to_i > 0
+        nil
+      else
+        buffer
+      end
     end
 
     def rewind

data/lib/puma/runner.rb

@@ -70,7 +70,7 @@ module Puma
 
       app = Puma::App::Status.new @launcher, token
 
-      # A Reactor is not created aand nio4r is not loaded when 'queue_requests: false'
+      # A Reactor is not created and nio4r is not loaded when 'queue_requests: false'
       # Use `nil` for events, no hooks in control server
       control = Puma::Server.new app, nil,
         { min_threads: 0, max_threads: 1, queue_requests: false, log_writer: @log_writer }

data/lib/puma/server.rb

@@ -81,6 +81,8 @@ module Puma
         UserFileDefaultOptions.new(options, Configuration::DEFAULTS)
       end
 
+      @clustered                 = (@options.fetch :workers, 0) > 0
+      @worker_write              = @options[:worker_write]
       @log_writer                = @options.fetch :log_writer, LogWriter.stdio
       @early_hints               = @options[:early_hints]
       @first_data_timeout        = @options[:first_data_timeout]
@@ -117,6 +119,8 @@ module Puma
       @precheck_closing = true
 
       @requests_count = 0
+
+      @idle_timeout_reached = false
     end
 
     def inherit_binder(bind)
@@ -328,10 +332,26 @@ module Puma
           begin
             ios = IO.select sockets, nil, nil, (shutting_down? ? 0 : @idle_timeout)
             unless ios
-              @status = :stop unless shutting_down?
+              unless shutting_down?
+                @idle_timeout_reached = true
+
+                if @clustered
+                  @worker_write << "i#{Process.pid}\n" rescue nil
+                  next
+                else
+                  @log_writer.log "- Idle timeout reached"
+                  @status = :stop
+                end
+              end
+
               break
             end
 
+            if @idle_timeout_reached && @clustered
+              @idle_timeout_reached = false
+              @worker_write << "i#{Process.pid}\n" rescue nil
+            end
+
             ios.first.each do |sock|
               if sock == check
                 break if handle_check
@@ -367,6 +387,7 @@ module Puma
           @queue_requests = false
           @reactor.shutdown
         end
+
         graceful_shutdown if @status == :stop || @status == :restart
       rescue Exception => e
         @log_writer.unknown_error e, nil, "Exception handling servers"

data/lib/puma/state_file.rb

@@ -56,11 +56,11 @@ module Puma
     end
 
     ALLOWED_FIELDS.each do |f|
-      define_method f do
+      define_method f.to_sym do
         @options[f]
       end
 
-      define_method "#{f}=" do |v|
+      define_method :"#{f}=" do |v|
         @options[f] = v
       end
     end

data/tools/Dockerfile

@@ -1,6 +1,6 @@
 # Use this Dockerfile to create minimal reproductions of issues
 
-FROM ruby:3.1
+FROM ruby:3.2
 
 # throw errors if Gemfile has been modified since Gemfile.lock
 RUN bundle config --global frozen 1
@@ -8,7 +8,7 @@ RUN bundle config --global frozen 1
 WORKDIR /usr/src/app
 
 COPY . .
-RUN gem install bundler
+
 RUN bundle install
 RUN bundle exec rake compile
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: puma
 version: !ruby/object:Gem::Version
-  version: 6.4.0
+  version: 6.4.2
 platform: java
 authors:
 - Evan Phoenix
 autorequire:
 bindir: bin
 cert_chain: []
-date: 1980-01-01 00:00:00.000000000 Z
+date: 2024-01-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   requirement: !ruby/object:Gem::Requirement