puma 6.4.2-java → 6.5.0-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1736c6dd01c94d6cf6a109965156ec60ec8a9deb17b42bdabc198f79d1b72c1a
-  data.tar.gz: 58e70495466aa055fc76038a23cf394167ca393959ab7bfa8a55306a7506f1ac
+  metadata.gz: 98e214e6e7ef41283c44c5b17cce34c008171416e72f13dc94b3c948f69adb32
+  data.tar.gz: a2c9b766ace09e6875e3e44f40c30eebaf6ff8d1d2db108a2b4215a7efa8d8da
 SHA512:
-  metadata.gz: 5ee67bed8910a53a217a6d9f799cf7a64f145d5a80a0cbea224949e3ae2fe76ae31dc5e5991a7983f71cbe34836ef568cab41a6d0ae5ca7d21cf0f87b8fac09e
-  data.tar.gz: '0085fa5bd8492707be9c52b3618c0663a06a2aad62e5fe60b66521d51572f8159d22f5f14b265314c1a094bec0d506dabef74c514fb8813d9a31d9f5395bfd3d'
+  metadata.gz: 6bd3492005053361459468ed003c15b5e7d9d61fe2ae05eac2fd28fcac514b2a6619e72e90dbba6aab9a70818af86d44c478b29ab18337425f066641e3dcaa72
+  data.tar.gz: bb16c4a3ac2b95af52c24575c1affe75c8b6cc4b893e98e3bd0309fd90cd6fa26afaded01c2e306c2d4606bd78ec96615f13100d6ddeaeba8b7ae416523adf52

data/History.md

@@ -1,3 +1,57 @@
+## 6.5.0 / 2024-11-23
+
+* Features
+  * Print RUBY_DESCRIPTION when Puma starts ([#3407])
+  * Set the worker process count automatically when using WEB_CONCURRENCY=auto ([#3439], [#3437])
+  * Mark as ractor-safe ([#3486], [#3422])
+  * Add option `enable_keep_alive`. `true` mimics existing behavior, but now can use `false` to disable keepalive to reduce queue tail latency ([#3496])
+  * Add parameters to Puma methods to allow CI to change ENV in isolation ([#3485])
+  * Add `ssl_ciphersuites` option for TLSv1.3 ciphers ([#3359], [#3343])
+  * You can now use `--threads 5` or `threads 5` to config max/min threads with a single number (used to need to say `5:5`) ([#3309])
+  * Option to turn off systemd plugin ([#3425], [#3424])
+  * Add `on_stopped` hook ([#3411], [#3380])
+
+* Bugfixes
+  * Handle blank environment variables when loading config ([#3539])
+  * lib/rack/handler/puma.rb - fix for rackup v1.0.1, adjust Gemfile ([#3532], [#3531])
+  * null_io.rb - add `external_encoding`, `set_encoding`, `binmode`, `binmode?` ([#3214])
+  * Implement NullIO#seek and #pos to mimic IO ([#3468])
+  * add support in rack handler & fix regression in binder for linux abstract namespace sockets ([#3508])
+  * Use actual thread local for `Puma::Server.current`. ([#3360])
+  * client.rb - fix request chunked body handling ([#3338], [#3337])
+  * Properly handle two requests seen in the initial buffer ([#3332])
+  * Fix response repeated status line when request is invalid or errors are raised ([#3308], [#3307])
+  * Fix child processes not being reaped when `Process.detach` used ([#3314], [#3313])
+
+* JRuby
+  * Make HTTP length constants configurable ([#3518])
+  * Fixup jruby_restart.rb & launcher.rb to work with ARM64 macOS JRuby ([#3467])
+
+* Performance
+  * Avoid checking if all workers reached timeout unless idle timeout is configured ([#3341])
+  * Request body - increase read size to 64 kB ([#3548])
+  * single mode skip wait_for_less_busy_worker ([#3325])
+
+* Refactor
+  * A ton of CI/test improvements by @MSP-Greg, as usual.
+  * Add ThreadPool#stats and adjust Server#stats to use it ([#3527])
+  * normalize whitespace in worker stats string ([#3513])
+  * rack/handler/puma.rb - ssl - use `start_with?`, add test ([#3510])
+  * extconf.rb - add logging for OpenSSL versions ([#3370])
+  * Lazily require `Puma::Rack::Builder` ([#3340])
+  * Refactor: Constantize worker pipe request types ([#3318])
+
+* Docs
+  * stats.md improvements ([#3514])
+  * control_cli.rb: Harmonize help message with bin/puma ([#3434])
+  * dsl.rb: Clarify a callback's argument ([#3435])
+  * lib/rack/handler/puma.rb - relocate and fixup module comment ([#3495])
+
+## 6.4.3 / 2024-09-19
+
+* Security
+  * Discards any headers using underscores if the non-underscore version also exists. Without this, an attacker could overwrite values set by intermediate proxies (e.g. X-Forwarded-For). ([CVE-2024-45614](https://github.com/puma/puma/security/advisories/GHSA-9hf4-67fc-4vf4)/GHSA-9hf4-67fc-4vf4)
+
 ## 6.4.2 / 2024-01-08
 
 * Security
@@ -173,6 +227,14 @@
   * Ruby 3.2 will have native IO#wait_* methods, don't require io/wait ([#2903])
   * Various internal API refactorings ([#2942], [#2921], [#2922], [#2955])
 
+## 5.6.9 / 2024-09-19
+
+* Security
+  * Discards any headers using underscores if the non-underscore version also exists. Without this, an attacker could overwrite values set by intermediate proxies (e.g. X-Forwarded-For). ([CVE-2024-45614](https://github.com/puma/puma/security/advisories/GHSA-9hf4-67fc-4vf4)/GHSA-9hf4-67fc-4vf4)
+* JRuby
+  * Must use at least Java >= 9 to compile. You can no longer build from source on Java 8.
+
+
 ## 5.6.8 / 2024-01-08
 
 * Security
@@ -2063,6 +2125,49 @@ be added back in a future date when a java Puma::MiniSSL is added.
 * Bugfixes
   * Your bugfix goes here <Most recent on the top, like GitHub> (#Github Number)
 
+[#3407]:https://github.com/puma/puma/pull/3407     "PR by @JacobEvelyn, merged 2024-11-05"
+[#3439]:https://github.com/puma/puma/pull/3439     "PR by @codergeek121, merged 2024-11-04"
+[#3437]:https://github.com/puma/puma/issues/3437   "Issue by @rafaelfranca, closed 2024-11-04"
+[#3486]:https://github.com/puma/puma/pull/3486     "PR by @mohamedhafez, merged 2024-09-26"
+[#3422]:https://github.com/puma/puma/issues/3422   "Issue by @mohamedhafez, closed 2024-09-26"
+[#3496]:https://github.com/puma/puma/pull/3496     "PR by @slizco, merged 2024-09-26"
+[#3485]:https://github.com/puma/puma/pull/3485     "PR by @MSP-Greg, merged 2024-09-21"
+[#3359]:https://github.com/puma/puma/pull/3359     "PR by @willayton, merged 2024-04-11"
+[#3343]:https://github.com/puma/puma/issues/3343   "Issue by @willayton, closed 2024-04-11"
+[#3309]:https://github.com/puma/puma/pull/3309     "PR by @byroot, merged 2024-01-09"
+[#3425]:https://github.com/puma/puma/pull/3425     "PR by @mohamedhafez, merged 2024-07-14"
+[#3424]:https://github.com/puma/puma/issues/3424   "Issue by @mohamedhafez, closed 2024-07-14"
+[#3411]:https://github.com/puma/puma/pull/3411     "PR by @OuYangJinTing, merged 2024-06-15"
+[#3380]:https://github.com/puma/puma/pull/3380     "PR by @emilyst, closed 2024-06-15"
+[#3539]:https://github.com/puma/puma/pull/3539     "PR by @caius, merged 2024-11-20"
+[#3532]:https://github.com/puma/puma/pull/3532     "PR by @MSP-Greg, merged 2024-10-24"
+[#3531]:https://github.com/puma/puma/issues/3531   "Issue by @tagliala, closed 2024-10-24"
+[#3214]:https://github.com/puma/puma/pull/3214     "PR by @MSP-Greg, merged 2024-10-15"
+[#3468]:https://github.com/puma/puma/pull/3468     "PR by @foca, merged 2024-10-04"
+[#3508]:https://github.com/puma/puma/pull/3508     "PR by @MayCXC, merged 2024-10-02"
+[#3360]:https://github.com/puma/puma/pull/3360     "PR by @ioquatix, merged 2024-04-24"
+[#3338]:https://github.com/puma/puma/pull/3338     "PR by @MSP-Greg, merged 2024-04-11"
+[#3337]:https://github.com/puma/puma/issues/3337   "Issue by @skliew, closed 2024-04-11"
+[#3332]:https://github.com/puma/puma/pull/3332     "PR by @evanphx, merged 2024-02-18"
+[#3308]:https://github.com/puma/puma/pull/3308     "PR by @MSP-Greg, merged 2024-01-31"
+[#3307]:https://github.com/puma/puma/issues/3307   "Issue by @nateberkopec, closed 2024-01-31"
+[#3314]:https://github.com/puma/puma/pull/3314     "PR by @stanhu, merged 2024-01-26"
+[#3313]:https://github.com/puma/puma/issues/3313   "Issue by @stanhu, closed 2024-01-26"
+[#3518]:https://github.com/puma/puma/pull/3518     "PR by @roque86, merged 2024-11-15"
+[#3467]:https://github.com/puma/puma/pull/3467     "PR by @MSP-Greg, merged 2024-09-21"
+[#3341]:https://github.com/puma/puma/pull/3341     "PR by @joshuay03, merged 2024-03-11"
+[#3548]:https://github.com/puma/puma/pull/3548     "PR by @MSP-Greg, merged 2024-11-21"
+[#3325]:https://github.com/puma/puma/pull/3325     "PR by @OuYangJinTing, merged 2024-10-22"
+[#3527]:https://github.com/puma/puma/pull/3527     "PR by @MSP-Greg, merged 2024-10-26"
+[#3513]:https://github.com/puma/puma/pull/3513     "PR by @jjb, merged 2024-10-11"
+[#3510]:https://github.com/puma/puma/pull/3510     "PR by @MSP-Greg, merged 2024-10-03"
+[#3370]:https://github.com/puma/puma/pull/3370     "PR by @MSP-Greg, merged 2024-04-15"
+[#3340]:https://github.com/puma/puma/pull/3340     "PR by @joshuay03, merged 2024-03-10"
+[#3318]:https://github.com/puma/puma/pull/3318     "PR by @joshuay03, merged 2024-01-15"
+[#3514]:https://github.com/puma/puma/pull/3514     "PR by @jjb, merged 2024-10-11"
+[#3434]:https://github.com/puma/puma/pull/3434     "PR by @olleolleolle, merged 2024-09-19"
+[#3435]:https://github.com/puma/puma/pull/3435     "PR by @olleolleolle, merged 2024-09-19"
+[#3495]:https://github.com/puma/puma/pull/3495     "PR by @MSP-Greg, merged 2024-09-19"
 [#3256]:https://github.com/puma/puma/pull/3256     "PR by @MSP-Greg, merged 2023-10-16"
 [#3235]:https://github.com/puma/puma/pull/3235     "PR by @joshuay03, merged 2023-10-03"
 [#3228]:https://github.com/puma/puma/issues/3228   "Issue by @davidalejandroaguilar, closed 2023-10-03"
@@ -2672,7 +2777,7 @@ be added back in a future date when a java Puma::MiniSSL is added.
 [#845]:https://github.com/puma/puma/pull/845       "PR by @deepj, merged 2016-01-28"
 [#846]:https://github.com/puma/puma/pull/846       "PR by @sriedel, merged 2016-01-15"
 [#850]:https://github.com/puma/puma/pull/850       "PR by @deepj, merged 2016-01-15"
-[#853]:https://github.com/puma/puma/pull/853       "PR by @Jeffrey6052, merged 2016-01-28"
+[#853]:https://github.com/puma/puma/pull/853       "PR by @xuqiyong666, merged 2016-01-28"
 [#857]:https://github.com/puma/puma/pull/857       "PR by @osheroff, merged 2016-01-15"
 [#858]:https://github.com/puma/puma/pull/858       "PR by @mlarraz, merged 2016-01-28"
 [#860]:https://github.com/puma/puma/pull/860       "PR by @osheroff, merged 2016-01-15"

data/README.md

@@ -12,7 +12,7 @@ Puma is a **simple, fast, multi-threaded, and highly parallel HTTP 1.1 server fo
 
 ## Built For Speed & Parallelism
 
-Puma is a server for [Rack](https://github.com/rack/rack)-powered HTTP applications written in Ruby.  It is: 
+Puma is a server for [Rack](https://github.com/rack/rack)-powered HTTP applications written in Ruby.  It is:
 * **Multi-threaded**. Each request is served in a separate thread. This helps you serve more requests per second with less memory use.
 * **Multi-process**. "Pre-forks" in cluster mode, using less memory per-process thanks to copy-on-write memory.
 * **Standalone**. With SSL support, zero-downtime rolling restarts and a built-in request bufferer, you can deploy Puma without any reverse proxy.
@@ -118,6 +118,8 @@ $ WEB_CONCURRENCY=3 puma -t 8:32
 
 Note that threads are still used in clustered mode, and the `-t` thread flag setting is per worker, so `-w 2 -t 16:16` will spawn 32 threads in total, with 16 in each worker process.
 
+If the `WEB_CONCURRENCY` environment variable is set to `"auto"` and the `concurrent-ruby` gem is available in your application, Puma will set the worker process count to the result of [available processors](https://ruby-concurrency.github.io/concurrent-ruby/master/Concurrent.html#available_processor_count-class_method).
+
 For an in-depth discussion of the tradeoffs of thread and process count settings, [see our docs](https://github.com/puma/puma/blob/9282a8efa5a0c48e39c60d22ca70051a25df9f55/docs/kubernetes.md#workers-per-pod-and-other-config-issues).
 
 In clustered mode, Puma can "preload" your application. This loads all the application code *prior* to forking. Preloading reduces total memory usage of your application via an operating system feature called [copy-on-write](https://en.wikipedia.org/wiki/Copy-on-write).
@@ -138,51 +140,93 @@ preload_app!
 
 Preloading can’t be used with phased restart, since phased restart kills and restarts workers one-by-one, and preloading copies the code of master into the workers.
 
-When using clustered mode, you can specify a block in your configuration file that will be run on boot of each worker:
+#### Clustered mode hooks
+
+When using clustered mode, Puma's configuration DSL provides `before_fork` and `on_worker_boot`
+hooks to run code when the master process forks and child workers are booted respectively.
+
+It is recommended to use these hooks with `preload_app!`, otherwise constants loaded by your
+application (such as `Rails`) will not be available inside the hooks.
 
 ```ruby
 # config/puma.rb
+before_fork do
+  # Add code to run inside the Puma master process before it forks a worker child.
+end
+
 on_worker_boot do
-  # configuration here
+  # Add code to run inside the Puma worker process after forking.
 end
 ```
 
-This code can be used to setup the process before booting the application, allowing
-you to do some Puma-specific things that you don't want to embed in your application.
-For instance, you could fire a log notification that a worker booted or send something to statsd. This can be called multiple times.
-
-Constants loaded by your application (such as `Rails`) will not be available in `on_worker_boot`
-unless preloading is enabled.
-
-You can also specify a block to be run before workers are forked, using `before_fork`:
+In addition, there is an `on_refork` hook which is used only in [`fork_worker` mode](docs/fork_worker.md),
+when the worker 0 child process forks a grandchild worker:
 
 ```ruby
-# config/puma.rb
-before_fork do
-  # configuration here
+on_refork do
+  # Used only when fork_worker mode is enabled. Add code to run inside the Puma worker 0
+  # child process before it forks a grandchild worker.
 end
 ```
 
-You can also specify a block to be run after puma is booted using `on_booted`:
+Importantly, note the following considerations when Ruby forks a child process: 
+
+1. File descriptors such as network sockets **are** copied from the parent to the forked
+   child process. Dual-use of the same sockets by parent and child will result in I/O conflicts
+   such as `SocketError`, `Errno::EPIPE`, and `EOFError`.
+2. Background Ruby threads, including threads used by various third-party gems for connection
+   monitoring, etc., are **not** copied to the child process. Often this does not cause
+   immediate problems until a third-party connection goes down, at which point there will
+   be no supervisor to reconnect it.
+
+Therefore, we recommend the following:
+
+1. If possible, do not establish any socket connections (HTTP, database connections, etc.)
+   inside Puma's master process when booting.
+2. If (1) is not possible, use `before_fork` and `on_refork` to disconnect the parent's socket
+   connections when forking, so that they are not accidentally copied to the child process.
+3. Use `on_worker_boot` to restart any background threads on the forked child.
+
+#### Master process lifecycle hooks
+
+Puma's configuration DSL provides master process lifecycle hooks `on_booted`, `on_restart`, and `on_stopped`
+which may be used to specify code blocks to run on each event:
 
 ```ruby
 # config/puma.rb
 on_booted do
-  # configuration here
+  # Add code to run in the Puma master process after it boots,
+  # and also after a phased restart completes.
+end
+
+on_restart do
+  # Add code to run in the Puma master process when it receives
+  # a restart command but before it restarts.
+end
+
+on_stopped do
+  # Add code to run in the Puma master process when it receives
+  # a stop command but before it shuts down.
 end
 ```
 
 ### Error handling
 
-If puma encounters an error outside of the context of your application, it will respond with a 500 and a simple
+If Puma encounters an error outside of the context of your application, it will respond with a 400/500 and a simple
 textual error message (see `Puma::Server#lowlevel_error` or [server.rb](https://github.com/puma/puma/blob/master/lib/puma/server.rb)).
 You can specify custom behavior for this scenario. For example, you can report the error to your third-party
 error-tracking service (in this example, [rollbar](https://rollbar.com)):
 
 ```ruby
-lowlevel_error_handler do |e|
-  Rollbar.critical(e)
-  [500, {}, ["An error has occurred, and engineers have been informed. Please reload the page. If you continue to have problems, contact support@example.com\n"]]
+lowlevel_error_handler do |e, env, status|
+  if status == 400
+    message = "The server could not process the request due to an error, such as an incorrectly typed URL, malformed syntax, or a URL that contains illegal characters.\n"
+  else
+    message = "An error has occurred, and engineers have been informed. Please reload the page. If you continue to have problems, contact support@example.com\n"
+    Rollbar.critical(e)
+  end
+
+  [status, {}, [message]]
 end
 ```
 
@@ -249,7 +293,7 @@ $ puma -b ssl://localhost:9292 -b tcp://localhost:9393 -C config/use_local_host.
 
 #### Controlling SSL Cipher Suites
 
-To use or avoid specific SSL cipher suites, use `ssl_cipher_filter` or `ssl_cipher_list` options.
+To use or avoid specific SSL ciphers for TLSv1.2 and below, use `ssl_cipher_filter` or `ssl_cipher_list` options.
 
 ##### Ruby:
 
@@ -263,6 +307,14 @@ $ puma -b 'ssl://127.0.0.1:9292?key=path_to_key&cert=path_to_cert&ssl_cipher_fil
 $ puma -b 'ssl://127.0.0.1:9292?keystore=path_to_keystore&keystore-pass=keystore_password&ssl_cipher_list=TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA'
 ```
 
+To configure the available TLSv1.3 ciphersuites, use `ssl_ciphersuites` option (not available for JRuby).
+
+##### Ruby:
+
+```
+$ puma -b 'ssl://127.0.0.1:9292?key=path_to_key&cert=path_to_cert&ssl_ciphersuites=TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256'
+```
+
 See https://www.openssl.org/docs/man1.1.1/man1/ciphers.html for cipher filter format and full list of cipher suites.
 
 Disable TLS v1 with the `no_tlsv1` option:
@@ -279,7 +331,7 @@ To enable verification flags offered by OpenSSL, use `verification_flags` (not a
 $ puma -b 'ssl://127.0.0.1:9292?key=path_to_key&cert=path_to_cert&verification_flags=PARTIAL_CHAIN'
 ```
 
-You can also set multiple verification flags (by separating them with coma):
+You can also set multiple verification flags (by separating them with a comma):
 
 ```
 $ puma -b 'ssl://127.0.0.1:9292?key=path_to_key&cert=path_to_cert&verification_flags=PARTIAL_CHAIN,CRL_CHECK'

data/docs/fork_worker.md

@@ -22,10 +22,14 @@ The `fork_worker` option allows your application to be initialized only once for
 
    You can trigger a refork by sending the cluster the `SIGURG` signal or running the `pumactl refork` command at any time. A refork will also automatically trigger once, after a certain number of requests have been processed by worker 0 (default 1000). To configure the number of requests before the auto-refork, pass a positive integer argument to `fork_worker` (e.g., `fork_worker 1000`), or `0` to disable.
 
+### Usage Considerations
+
+- `fork_worker` introduces a new `on_refork` configuration hook. If you were using the `before_fork` hook previously, we generally recommend to copy its logic to `on_refork`. Note that `fork_worker` triggers the `before_fork` configuration hook *only* when initially forking the master process to worker 0, and triggers the `on_refork` hook on all subsequent forks from worker 0 to additional workers.
+
 ### Limitations
 
 - This mode is still very experimental so there may be bugs or edge-cases, particularly around expected behavior of existing hooks. Please open a [bug report](https://github.com/puma/puma/issues/new?template=bug_report.md) if you encounter any issues.
 
 - In order to fork new workers cleanly, worker 0 shuts down its server and stops serving requests so there are no open file descriptors or other kinds of shared global state between processes, and to maximize copy-on-write efficiency across the newly-forked workers. This may temporarily reduce total capacity of the cluster during a phased restart / refork.
 
-  In a cluster with `n` workers, a normal phased restart stops and restarts workers one by one while the application is loaded in each process, so `n-1` workers are available serving requests during the restart. In a phased restart in fork-worker mode, the application is first loaded in worker 0 while `n-1` workers are available, then worker 0 remains stopped while the rest of the workers are reloaded one by one, leaving only `n-2` workers to be available for a brief period of time. Reloading the rest of the workers should be quick because the application is preloaded at that point, but there may be situations where it can take longer (slow clients, long-running application code, slow worker-fork hooks, etc).
+- In a cluster with `n` workers, a normal phased restart stops and restarts workers one by one while the application is loaded in each process, so `n-1` workers are available serving requests during the restart. In a phased restart in fork-worker mode, the application is first loaded in worker 0 while `n-1` workers are available, then worker 0 remains stopped while the rest of the workers are reloaded one by one, leaving only `n-2` workers to be available for a brief period of time. Reloading the rest of the workers should be quick because the application is preloaded at that point, but there may be situations where it can take longer (slow clients, long-running application code, slow worker-fork hooks, etc).

data/docs/java_options.md

@@ -0,0 +1,48 @@
+# Java Options
+
+`System Properties` or `Environment Variables` can be used to change Puma's
+default configuration for its Java extension. The provided values are evaluated
+during initialization, and changes while running the app have no effect.
+Moreover, default values may be used in case of invalid inputs.
+
+## Supported Options
+
+| ENV Name                     | Default Value |        Validation        |
+|------------------------------|:-------------:|:------------------------:|
+| PUMA_QUERY_STRING_MAX_LENGTH |   1024 * 10   | Positive natural number  |
+| PUMA_REQUEST_PATH_MAX_LENGTH |     8192      | Positive natural number  |
+| PUMA_REQUEST_URI_MAX_LENGTH  |   1024 * 12   | Positive natural number  |
+
+## Examples
+
+### Invalid inputs
+
+An empty string will be handled as missing, and the default value will be used instead.
+Puma will print an error message for other invalid values.
+
+```
+foo@bar:~/puma$ PUMA_QUERY_STRING_MAX_LENGTH=abc PUMA_REQUEST_PATH_MAX_LENGTH='' PUMA_REQUEST_URI_MAX_LENGTH=0 bundle exec bin/puma test/rackup/hello.ru
+
+The value 0 for PUMA_REQUEST_URI_MAX_LENGTH is invalid. Using default value 12288 instead.
+The value abc for PUMA_QUERY_STRING_MAX_LENGTH is invalid. Using default value 10240 instead.
+Puma starting in single mode...
+```
+
+### Valid inputs
+
+```
+foo@bar:~/puma$ PUMA_REQUEST_PATH_MAX_LENGTH=9 bundle exec bin/puma test/rackup/hello.ru
+
+Puma starting in single mode...
+```
+```
+foo@bar:~ export path=/123456789 # 10 chars
+foo@bar:~ curl "http://localhost:9292${path}"
+
+Puma caught this error: HTTP element REQUEST_PATH is longer than the 9 allowed length. (Puma::HttpParserError)
+
+foo@bar:~ export path=/12345678 # 9 chars
+foo@bar:~ curl "http://localhost:9292${path}"
+Hello World
+```
+

data/docs/signals.md

@@ -17,13 +17,13 @@ $ ps aux | grep tail
 schneems        87152   0.0  0.0  2432772    492 s032  S+   12:46PM   0:00.00 tail -f my.log
 ```
 
-You can send a signal in Ruby using the [Process module](https://www.ruby-doc.org/core-2.1.1/Process.html#kill-method):
+You can send a signal in Ruby using the [Process module](https://ruby-doc.org/3.2.2/Process.html#method-c-kill):
 
 ```
 $ irb
 > puts pid
 => 87152
-Process.detach(pid) # https://ruby-doc.org/core-2.1.1/Process.html#method-c-detach
+Process.detach(pid) # https://ruby-doc.org/3.2.2/Process.html#method-c-detach
 Process.kill("TERM", pid)
 ```
 

data/docs/stats.md

@@ -56,7 +56,8 @@ end
 When Puma runs in single mode, these stats are available at the top level. When Puma runs in cluster mode, these stats are available within the `worker_status` array in a hash labeled `last_status`, in an array of hashes where one hash represents each worker.
 
 * backlog: requests that are waiting for an available thread to be available. if this is above 0, you need more capacity [always true?]
-* running: how many threads are running
+* running: how many threads are spawned. A spawned thread may be busy processing a request or waiting for a new request. If `min_threads` and `max_threads` are set to the same number,
+  this will be a never-changing number (other than rare cases when a thread dies, etc).
 * pool_capacity: the number of requests that the server is capable of taking right now. For example, if the number is 5, then it means there are 5 threads sitting idle ready to take a request. If one request comes in, then the value would be 4 until it finishes processing. If the minimum threads allowed is zero, this number will still have a maximum value of the maximum threads allowed.
 * max_threads: the maximum number of threads Puma is configured to spool per worker
 * requests_count: the number of requests this worker has served since starting

data/docs/systemd.md

@@ -99,9 +99,11 @@ ListenStream=0.0.0.0:9293
 # ListenStream=/run/puma.sock
 
 # Socket options matching Puma defaults
-NoDelay=true
 ReusePort=true
 Backlog=1024
+# Enable this if you're using Puma with the "low_latency" option, read more in Puma DSL docs and systemd docs:
+# https://www.freedesktop.org/software/systemd/man/latest/systemd.socket.html#NoDelay=
+# NoDelay=true
 
 [Install]
 WantedBy=sockets.target
@@ -239,6 +241,13 @@ cap $stage puma:start --dry-run
 cap $stage puma:stop  --dry-run
 ~~~~
 
+### Disabling Puma Systemd Integration
+
+If you would like to disable Puma's systemd integration, for example if you handle it elsewhere
+in your code yourself, simply set the the environment variable `PUMA_SKIP_SYSTEMD` to any value.
+
+
+
 [Restart]: https://www.freedesktop.org/software/systemd/man/systemd.service.html#Restart=
 [#1367]: https://github.com/puma/puma/issues/1367
 [#1499]: https://github.com/puma/puma/issues/1499

data/ext/puma_http11/extconf.rb

@@ -10,15 +10,13 @@ end
 
 unless ENV["PUMA_DISABLE_SSL"]
   # don't use pkg_config('openssl') if '--with-openssl-dir' is used
-  # also looks within the Ruby build for directory info
   has_openssl_dir = dir_config('openssl').any? ||
-    RbConfig::CONFIG['configure_args']&.include?('openssl') ||
-    Dir.exist?("#{RbConfig::TOPDIR}/src/main/c/openssl") # TruffleRuby
+    RbConfig::CONFIG['configure_args']&.include?('openssl')
 
   found_pkg_config = !has_openssl_dir && pkg_config('openssl')
 
   found_ssl = if !$mingw && found_pkg_config
-    puts 'using OpenSSL pkgconfig (openssl.pc)'
+    puts '──── Using OpenSSL pkgconfig (openssl.pc) ────'
     true
   elsif have_library('libcrypto', 'BIO_read') && have_library('libssl', 'SSL_CTX_new')
     true
@@ -33,22 +31,27 @@ unless ENV["PUMA_DISABLE_SSL"]
   if found_ssl
     have_header "openssl/bio.h"
 
-    # below is  yes for 1.0.2 & later
-    have_func "DTLS_method"                            , "openssl/ssl.h"
-    have_func "SSL_CTX_set_session_cache_mode(NULL, 0)", "openssl/ssl.h"
+    ssl_h = "openssl/ssl.h".freeze
 
-    # below are yes for 1.1.0 & later
-    have_func "TLS_server_method"                      , "openssl/ssl.h"
-    have_func "SSL_CTX_set_min_proto_version(NULL, 0)" , "openssl/ssl.h"
+    puts "\n──── Below are yes for 1.0.2 & later ────"
+    have_func "DTLS_method"                            , ssl_h
+    have_func "SSL_CTX_set_session_cache_mode(NULL, 0)", ssl_h
 
-    have_func "X509_STORE_up_ref"
-    have_func "SSL_CTX_set_ecdh_auto(NULL, 0)"         , "openssl/ssl.h"
+    puts "\n──── Below are yes for 1.1.0 & later ────"
+    have_func "TLS_server_method"                      , ssl_h
+    have_func "SSL_CTX_set_min_proto_version(NULL, 0)" , ssl_h
 
-    # below exists in 1.1.0 and later, but isn't documented until 3.0.0
-    have_func "SSL_CTX_set_dh_auto(NULL, 0)"           , "openssl/ssl.h"
+    puts "\n──── Below is yes for 1.1.0 and later, but isn't documented until 3.0.0 ────"
+    # https://github.com/openssl/openssl/blob/OpenSSL_1_1_0/include/openssl/ssl.h#L1159
+    have_func "SSL_CTX_set_dh_auto(NULL, 0)"           , ssl_h
 
-    # below is yes for 3.0.0 & later
-    have_func "SSL_get1_peer_certificate"              , "openssl/ssl.h"
+    puts "\n──── Below is yes for 1.1.1 & later ────"
+    have_func "SSL_CTX_set_ciphersuites(NULL, \"\")"   , ssl_h
+
+    puts "\n──── Below is yes for 3.0.0 & later ────"
+    have_func "SSL_get1_peer_certificate"              , ssl_h
+
+    puts ''
 
     # Random.bytes available in Ruby 2.5 and later, Random::DEFAULT deprecated in 3.0
     if Random.respond_to?(:bytes)

data/ext/puma_http11/mini_ssl.c

@@ -229,7 +229,7 @@ VALUE
 sslctx_initialize(VALUE self, VALUE mini_ssl_ctx) {
   SSL_CTX* ctx;
   int ssl_options;
-  VALUE key, cert, ca, verify_mode, ssl_cipher_filter, no_tlsv1, no_tlsv1_1,
+  VALUE key, cert, ca, verify_mode, ssl_cipher_filter, ssl_ciphersuites, no_tlsv1, no_tlsv1_1,
     verification_flags, session_id_bytes, cert_pem, key_pem, key_password_command, key_password;
   BIO *bio;
   X509 *x509 = NULL;
@@ -269,6 +269,8 @@ sslctx_initialize(VALUE self, VALUE mini_ssl_ctx) {
 
   ssl_cipher_filter = rb_funcall(mini_ssl_ctx, rb_intern_const("ssl_cipher_filter"), 0);
 
+  ssl_ciphersuites = rb_funcall(mini_ssl_ctx, rb_intern_const("ssl_ciphersuites"), 0);
+
   no_tlsv1 = rb_funcall(mini_ssl_ctx, rb_intern_const("no_tlsv1"), 0);
 
   no_tlsv1_1 = rb_funcall(mini_ssl_ctx, rb_intern_const("no_tlsv1_1"), 0);
@@ -444,6 +446,14 @@ sslctx_initialize(VALUE self, VALUE mini_ssl_ctx) {
     SSL_CTX_set_cipher_list(ctx, "HIGH:!aNULL@STRENGTH");
   }
 
+#if HAVE_SSL_CTX_SET_CIPHERSUITES
+  // Only override OpenSSL default ciphersuites if config option is supplied.
+  if (!NIL_P(ssl_ciphersuites)) {
+    StringValue(ssl_ciphersuites);
+    SSL_CTX_set_ciphersuites(ctx, RSTRING_PTR(ssl_ciphersuites));
+  }
+#endif
+
 #if OPENSSL_VERSION_NUMBER < 0x10002000L
   // Remove this case if OpenSSL 1.0.1 (now EOL) support is no longer needed.
   ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);

data/ext/puma_http11/org/jruby/puma/Http11.java

@@ -26,14 +26,14 @@ public class Http11 extends RubyObject {
     public final static String MAX_FIELD_NAME_LENGTH_ERR = "HTTP element FIELD_NAME is longer than the 256 allowed length.";
     public final static int MAX_FIELD_VALUE_LENGTH = 80 * 1024;
     public final static String MAX_FIELD_VALUE_LENGTH_ERR = "HTTP element FIELD_VALUE is longer than the 81920 allowed length.";
-    public final static int MAX_REQUEST_URI_LENGTH = 1024 * 12;
-    public final static String MAX_REQUEST_URI_LENGTH_ERR = "HTTP element REQUEST_URI is longer than the 12288 allowed length.";
+    public final static int MAX_REQUEST_URI_LENGTH = getConstLength("PUMA_REQUEST_URI_MAX_LENGTH", 1024 * 12);
+    public final static String MAX_REQUEST_URI_LENGTH_ERR = "HTTP element REQUEST_URI is longer than the " + MAX_REQUEST_URI_LENGTH + " allowed length.";
     public final static int MAX_FRAGMENT_LENGTH = 1024;
     public final static String MAX_FRAGMENT_LENGTH_ERR = "HTTP element REQUEST_PATH is longer than the 1024 allowed length.";
-    public final static int MAX_REQUEST_PATH_LENGTH = 8192;
-    public final static String MAX_REQUEST_PATH_LENGTH_ERR = "HTTP element REQUEST_PATH is longer than the 8192 allowed length.";
-    public final static int MAX_QUERY_STRING_LENGTH = 1024 * 10;
-    public final static String MAX_QUERY_STRING_LENGTH_ERR = "HTTP element QUERY_STRING is longer than the 10240 allowed length.";
+    public final static int MAX_REQUEST_PATH_LENGTH = getConstLength("PUMA_REQUEST_PATH_MAX_LENGTH", 8192);
+    public final static String MAX_REQUEST_PATH_LENGTH_ERR = "HTTP element REQUEST_PATH is longer than the " + MAX_REQUEST_PATH_LENGTH + " allowed length.";
+    public final static int MAX_QUERY_STRING_LENGTH = getConstLength("PUMA_QUERY_STRING_MAX_LENGTH", 10 * 1024);
+    public final static String MAX_QUERY_STRING_LENGTH_ERR = "HTTP element QUERY_STRING is longer than the " + MAX_QUERY_STRING_LENGTH +" allowed length.";
     public final static int MAX_HEADER_LENGTH = 1024 * (80 + 32);
     public final static String MAX_HEADER_LENGTH_ERR = "HTTP element HEADER is longer than the 114688 allowed length.";
 
@@ -48,6 +48,27 @@ public class Http11 extends RubyObject {
     public static final ByteList QUERY_STRING_BYTELIST = new ByteList(ByteList.plain("QUERY_STRING"));
     public static final ByteList SERVER_PROTOCOL_BYTELIST = new ByteList(ByteList.plain("SERVER_PROTOCOL"));
 
+    public static String getEnvOrProperty(String name) {
+        String envValue = System.getenv(name);
+        return (envValue != null) ? envValue : System.getProperty(name);
+    }
+
+    public static int getConstLength(String name, Integer defaultValue) {
+        String stringValue = getEnvOrProperty(name);
+        if (stringValue == null || stringValue.isEmpty()) return defaultValue;
+
+        try {
+            int value = Integer.parseUnsignedInt(stringValue);
+            if (value <= 0) {
+                throw new NumberFormatException("The number is not positive.");
+            }
+            return value;
+        } catch (NumberFormatException e) {
+            System.err.println(String.format("The value %s for %s is invalid. Using default value %d instead.", stringValue, name, defaultValue));
+            return defaultValue;
+        }
+    }
+
     private static ObjectAllocator ALLOCATOR = new ObjectAllocator() {
         public IRubyObject allocate(Ruby runtime, RubyClass klass) {
             return new Http11(runtime, klass);
@@ -99,6 +120,8 @@ public class Http11 extends RubyObject {
             int bite = b.get(i) & 0xFF;
             if(bite == '-') {
                 b.set(i, (byte)'_');
+            } else if(bite == '_') {
+                b.set(i, (byte)',');
             } else {
                 b.set(i, (byte)Character.toUpperCase(bite));
             }

data/ext/puma_http11/puma_http11.c

@@ -461,6 +461,9 @@ void Init_mini_ssl(VALUE mod);
 
 void Init_puma_http11(void)
 {
+#ifdef HAVE_RB_EXT_RACTOR_SAFE
+  rb_ext_ractor_safe(true);
+#endif
 
   VALUE mPuma = rb_define_module("Puma");
   VALUE cHttpParser = rb_define_class_under(mPuma, "HttpParser", rb_cObject);

data/lib/puma/binder.rb

@@ -19,13 +19,14 @@ module Puma
 
     RACK_VERSION = [1,6].freeze
 
-    def initialize(log_writer, conf = Configuration.new)
+    def initialize(log_writer, conf = Configuration.new, env: ENV)
       @log_writer = log_writer
       @conf = conf
       @listeners = []
       @inherited_fds = {}
       @activated_sockets = {}
       @unix_paths = []
+      @env = env
 
       @proto_env = {
         "rack.version".freeze => RACK_VERSION,
@@ -34,7 +35,7 @@ module Puma
         "rack.multiprocess".freeze => conf.options[:workers] >= 1,
         "rack.run_once".freeze => false,
         RACK_URL_SCHEME => conf.options[:rack_url_scheme],
-        "SCRIPT_NAME".freeze => ENV['SCRIPT_NAME'] || "",
+        "SCRIPT_NAME".freeze => env['SCRIPT_NAME'] || "",
 
         # I'd like to set a default CONTENT_TYPE here but some things
         # depend on their not being a default set and inferring
@@ -87,7 +88,7 @@ module Puma
     # @version 5.0.0
     #
     def create_activated_fds(env_hash)
-      @log_writer.debug "ENV['LISTEN_FDS'] #{ENV['LISTEN_FDS'].inspect}  env_hash['LISTEN_PID'] #{env_hash['LISTEN_PID'].inspect}"
+      @log_writer.debug "ENV['LISTEN_FDS'] #{@env['LISTEN_FDS'].inspect}  env_hash['LISTEN_PID'] #{env_hash['LISTEN_PID'].inspect}"
       return [] unless env_hash['LISTEN_FDS'] && env_hash['LISTEN_PID'].to_i == $$
       env_hash['LISTEN_FDS'].to_i.times do |index|
         sock = TCPServer.for_fd(socket_activation_fd(index))
@@ -183,7 +184,7 @@ module Puma
             io = inherit_unix_listener path, fd
             log_writer.log "* Inherited #{str}"
           elsif sock = @activated_sockets.delete([ :unix, path ]) ||
-              @activated_sockets.delete([ :unix, File.realdirpath(path) ])
+              !abstract && @activated_sockets.delete([ :unix, File.realdirpath(path) ])
             @unix_paths << path unless abstract || File.exist?(path)
             io = inherit_unix_listener path, sock
             log_writer.log "* Activated #{str}"