puma 8.0.2-java → 8.0.3-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ccf5cdd3f952f6ea55feda29b8899a36cc64ce8ecb5c79bb981f0450b7a74962
-  data.tar.gz: c0094d7ac6edb28c93ad7354b719fbd337278ff743f7b7ea7a4268736e12e70d
+  metadata.gz: 9bb993a39d400591f128b4808ca9d7f735618d614f6e490f850838ac7121391c
+  data.tar.gz: aae15617fcd8cd7147701e1f594625554bc6178c991c5ee98e00ca5bc0d1346d
 SHA512:
-  metadata.gz: 6e371849168d7a0f5ba1d88c12083a7aec0c8530e518251da1d077bc90af3cccdd1fbf43c7166881a8e8a87e5b5ffdef9782cf863907bf9c2dae5ba4c6010d52
-  data.tar.gz: e85bb20d08fbdf474558b0abb8cead8de3e4a26373134c19872eb9eb8850ee92fd42c09987777c535cf6bcd50f1f2f7622282277ef36aaab6cce7d792a354e71
+  metadata.gz: 2a47f4ca7106a37810eff02f38a0a7410904fa78bf3e9022176cc2d09eea261bb622f18b5d2a8f9e3330404850a2f5a2cd5178e5b65d2f78aab222c7faf1a467
+  data.tar.gz: db545b9e393c0236856a6db02e8b1953cd6eb19a41573aab67ff766f67fa65ba90e4e8d4984b9653481cfb834dc29d585aa94cc657adab31ce05d6a5d6ae5614

data/History.md

@@ -1,3 +1,21 @@
+## 8.0.3 / 2026-11-13
+
+* Security
+  * Close connections whose reactor timeout passed even when another client keeps sending data. ([GHSA-m5xw-3hrw-qcmf](https://github.com/puma/puma/security/advisories/GHSA-m5xw-3hrw-qcmf))
+  * Don't block the reactor writing a `100 Continue` or `408` to a client that stops reading. ([GHSA-xw3h-pgr9-3vg7](https://github.com/puma/puma/security/advisories/GHSA-xw3h-pgr9-3vg7))
+  * Apply the write timeout to TLS responses and to file responses larger than 64 KB, and don't let a TLS client that stops reading keep its connection alive by sending TLS records with no request data. ([GHSA-x646-wp7c-h9mg](https://github.com/puma/puma/security/advisories/GHSA-x646-wp7c-h9mg))
+  * Bound how long a graceful shutdown or restart keeps reading an incomplete request, with the new `shutdown_body_timeout` option (default 25 seconds). ([GHSA-jm4r-w4xx-qxw7](https://github.com/puma/puma/security/advisories/GHSA-jm4r-w4xx-qxw7))
+  * Keep `+` literal in bind URL query values, and raise on an invalid `ssl_cipher_filter`. ([GHSA-r885-m39c-939g](https://github.com/puma/puma/security/advisories/GHSA-r885-m39c-939g))
+  * Verify the TLS certificate and hostname of `ssl://` control servers in `pumactl`, with the new `--control-ca-file` option for private CAs. ([GHSA-86xc-wrr9-xmmq](https://github.com/puma/puma/security/advisories/GHSA-86xc-wrr9-xmmq))
+  * Back off and rate-limit logging when `accept` runs out of file descriptors. ([GHSA-rf6g-xhmp-gm7v](https://github.com/puma/puma/security/advisories/GHSA-rf6g-xhmp-gm7v))
+
+  CVE IDs have been requested for these advisories and will be added here once assigned.
+
+* Bugfixes
+  * Send the idle notification from a clustered worker only once per idle period, so the master no longer stops an active cluster or delays an idle shutdown ([#4101])
+  * Fix build errors on Windows arm64 with Ruby head ([#4071])
+  * Send TLS `close_notify` when closing an SSL connection on JRuby ([#4029])
+
 ## 8.0.2 / 2026-05-27
 
 * Bugfixes
@@ -2341,6 +2359,9 @@ be added back in a future date when a java Puma::MiniSSL is added.
 * Bugfixes
   * Your bugfix goes here <Most recent on the top, like GitHub> (#Github Number)
 
+[#4101]:https://github.com/puma/puma/pull/4101     "PR by Nate Berkopec, merged 2026-11-13"
+[#4071]:https://github.com/puma/puma/pull/4071     "PR by Nate Berkopec, merged 2026-11-09"
+[#4029]:https://github.com/puma/puma/pull/4029     "PR by Islam Elsayed, merged 2026-09-28"
 [#3944]:https://github.com/puma/puma/pull/3944     "PR by Nate Berkopec, merged 2026-05-26"
 [#3929]:https://github.com/puma/puma/pull/3929     "PR by Joshua Young, merged 2026-04-26"
 [#3928]:https://github.com/puma/puma/pull/3928     "PR by Nate Berkopec, merged 2026-04-16"

data/ext/puma_http11/mini_ssl.c

@@ -440,7 +440,14 @@ sslctx_initialize(VALUE self, VALUE mini_ssl_ctx) {
 
   if (!NIL_P(ssl_cipher_filter)) {
     StringValue(ssl_cipher_filter);
-    SSL_CTX_set_cipher_list(ctx, RSTRING_PTR(ssl_cipher_filter));
+    ERR_clear_error();
+    if (SSL_CTX_set_cipher_list(ctx, RSTRING_PTR(ssl_cipher_filter)) != 1) {
+      if (ERR_GET_REASON(ERR_peek_last_error()) == SSL_R_NO_CIPHER_MATCH) {
+        ERR_clear_error();
+      } else {
+        raise_param_error("SSL_CTX_set_cipher_list", "ssl_cipher_filter");
+      }
+    }
   }
   else {
     SSL_CTX_set_cipher_list(ctx, "HIGH:!aNULL@STRENGTH");

data/ext/puma_http11/org/jruby/puma/MiniSSL.java

@@ -383,36 +383,41 @@ public class MiniSSL extends RubyObject { // MiniSSL::Engine
       }
 
       MiniSSLBuffer inboundAppData = new MiniSSLBuffer(engine.getSession().getApplicationBufferSize());
-      doOp(SSLOperation.UNWRAP, inboundNetData, inboundAppData);
-
-      HandshakeStatus handshakeStatus = engine.getHandshakeStatus();
-      boolean done = false;
-      while (!done) {
-        SSLEngineResult res;
-        switch (handshakeStatus) {
-          case NEED_WRAP:
-            res = doOp(SSLOperation.WRAP, inboundAppData, outboundNetData);
-            handshakeStatus = res.getHandshakeStatus();
-            break;
-          case NEED_UNWRAP:
-            res = doOp(SSLOperation.UNWRAP, inboundNetData, inboundAppData);
-            if (res.getStatus() == Status.BUFFER_UNDERFLOW) {
-              // need more data before we can shake more hands
+      int consumedTo;
+      do {
+        consumedTo = inboundNetData.position();
+        doOp(SSLOperation.UNWRAP, inboundNetData, inboundAppData);
+
+        HandshakeStatus handshakeStatus = engine.getHandshakeStatus();
+        boolean done = false;
+        while (!done) {
+          SSLEngineResult res;
+          switch (handshakeStatus) {
+            case NEED_WRAP:
+              res = doOp(SSLOperation.WRAP, inboundAppData, outboundNetData);
+              handshakeStatus = res.getHandshakeStatus();
+              break;
+            case NEED_UNWRAP:
+              res = doOp(SSLOperation.UNWRAP, inboundNetData, inboundAppData);
+              if (res.getStatus() == Status.BUFFER_UNDERFLOW) {
+                // need more data before we can shake more hands
+                done = true;
+              }
+              handshakeStatus = res.getHandshakeStatus();
+              break;
+            case NEED_TASK:
+              Runnable runnable;
+              while ((runnable = engine.getDelegatedTask()) != null) {
+                runnable.run();
+              }
+              handshakeStatus = engine.getHandshakeStatus();
+              break;
+            default:
               done = true;
-            }
-            handshakeStatus = res.getHandshakeStatus();
-            break;
-          case NEED_TASK:
-            Runnable runnable;
-            while ((runnable = engine.getDelegatedTask()) != null) {
-              runnable.run();
-            }
-            handshakeStatus = engine.getHandshakeStatus();
-            break;
-          default:
-            done = true;
+          }
         }
-      }
+      } while (inboundAppData.position() == 0 && !closed &&
+               inboundNetData.hasRemaining() && inboundNetData.position() > consumedTo);
 
       if (inboundNetData.hasRemaining()) {
         inboundNetData.compact();
@@ -482,14 +487,19 @@ public class MiniSSL extends RubyObject { // MiniSSL::Engine
 
   @JRubyMethod
   public IRubyObject shutdown() {
-    if (closed || engine.isInboundDone() && engine.isOutboundDone()) {
-      if (engine.isOutboundDone()) {
-        engine.closeOutbound();
-      }
+    // The peer may be speaking plain HTTP if the handshake did not finish.
+    if (closed || !handshake || engine.isInboundDone() && engine.isOutboundDone()) {
+      return getRuntime().getTrue();
+    }
+
+    // Generate close_notify for MiniSSL::Socket#close to send.
+    engine.closeOutbound();
+    try {
+      doOp(SSLOperation.WRAP, outboundAppData, outboundNetData);
+    } catch (SSLException e) {
       return getRuntime().getTrue();
-    } else {
-      return getRuntime().getFalse();
     }
+    return getRuntime().getFalse();
   }
 
   private static RubyClass getSSLError(Ruby runtime) {

data/ext/puma_http11/puma_http11.c

@@ -385,7 +385,8 @@ static VALUE HttpParser_execute(VALUE self, VALUE req_hash, VALUE data, VALUE st
   long dlen = 0;
 
   from = FIX2INT(start);
-  RSTRING_GETMEM(data, dptr, dlen);
+  dptr = RSTRING_PTR(data);
+  dlen = (long)RSTRING_LEN(data);
 
   if(from >= dlen) {
     rb_raise(eHttpParserError, "%s", "Requested start is after data buffer end.");
@@ -398,7 +399,7 @@ static VALUE HttpParser_execute(VALUE self, VALUE req_hash, VALUE data, VALUE st
     if(puma_parser_has_error(http)) {
       rb_raise(eHttpParserError, "%s", "Invalid HTTP format, parsing fails. Are you trying to open an SSL connection to a non-SSL Puma?");
     } else {
-      return INT2FIX(puma_parser_nread(http));
+      return SIZET2NUM(puma_parser_nread(http));
     }
   }
 }
@@ -444,7 +445,7 @@ static VALUE HttpParser_nread(VALUE self)
 {
   puma_parser *http = HttpParser_unwrap(self);
 
-  return INT2FIX(http->nread);
+  return SIZET2NUM(http->nread);
 }
 
 /**

data/lib/puma/client.rb

@@ -54,6 +54,8 @@ module Puma
     # chunk header.
     MAX_CHUNK_HEADER_SIZE = 4096
 
+    SHUTDOWN_READ_GRACE = 1
+
     # The maximum amount of excess data the client sends
     # using chunk size extensions before we abort the connection.
     MAX_CHUNK_EXCESS = 16 * 1024
@@ -74,11 +76,12 @@ module Puma
 
     attr_reader :env, :to_io, :body, :io, :timeout_at, :ready, :hijacked,
                 :tempfile, :io_buffer, :http_content_length_limit_exceeded,
-                :requests_served, :error_status_code
+                :requests_served, :error_status_code, :bytes_read
 
     attr_writer :peerip, :http_content_length_limit, :supported_http_methods
 
-    attr_accessor :remote_addr_header, :listener, :env_set_http_version
+    attr_accessor :remote_addr_header, :listener, :env_set_http_version,
+                  :reactor_error
 
     def initialize(io, env=nil)
       @io = io
@@ -106,6 +109,7 @@ module Puma
       @http_content_length_limit = nil
       @http_content_length_limit_exceeded = nil
       @error_status_code = nil
+      @reactor_error = nil
 
       @peerip = nil
       @peer_family = nil
@@ -114,6 +118,8 @@ module Puma
       @expect_proxy_proto = false
 
       @body_remain = 0
+      @bytes_read = 0
+      @pending_write = nil
 
       @in_last_chunk = false
 
@@ -248,8 +254,9 @@ module Puma
       true
     end
 
-    def try_to_finish
-      return read_body if in_data_phase
+    def try_to_finish(&deadline)
+      return false unless flush_pending_write
+      return read_body(&deadline) if in_data_phase
 
       data = nil
       begin
@@ -269,6 +276,7 @@ module Puma
         raise EOFError
       end
 
+      @bytes_read += data.bytesize
       if @buffer
         @buffer << data
       else
@@ -282,19 +290,55 @@ module Puma
       @parser.finished? ? process_env_body : false
     end
 
-    def eagerly_finish
+    def eagerly_finish(&deadline)
       return true if @ready
-      while @to_io.wait_readable(0) # rubocop: disable Style/WhileUntilModifier
-        return true if try_to_finish
+      while !write_pending? && @to_io.wait_readable(0)
+        read = @bytes_read
+        return true if try_to_finish(&deadline)
+        check_deadline(&deadline) if deadline
+        return false if @bytes_read == read
       end
       false
     end
 
-    def finish(timeout)
+    def finish(timeout, &deadline)
       return if @ready
-      @to_io.wait_readable(timeout) || timeout! until try_to_finish
+      set_timeout timeout
+      read = @bytes_read
+      until try_to_finish(&deadline)
+        if @bytes_read > read
+          set_timeout timeout
+          read = @bytes_read
+        elsif self.timeout == 0
+          timeout!
+        end
+        if deadline
+          check_deadline(&deadline)
+          limit = yield
+          wait = [self.timeout, limit ? limit - Process.clock_gettime(Process::CLOCK_MONOTONIC) : 0.1].min
+          wait_io(wait) if wait > 0
+        else
+          wait_io(self.timeout) || timeout!
+        end
+      end
+    end
+
+    def write_pending?
+      !@pending_write.nil? || (@io.respond_to?(:write_pending?) && @io.write_pending?)
     end
 
+    def take_pending_write
+      str = @pending_write
+      @pending_write = nil
+      str
+    end
+
+    def wait_io(timeout)
+      return @to_io.wait_readable(timeout) unless write_pending?
+      @to_io.wait_writable(timeout)
+    end
+    private :wait_io
+
     # Wraps `@parser.execute` and adds meaningful error messages
     # @return [Integer] bytes of buffer read by parser
     #
@@ -354,11 +398,41 @@ module Puma
 
     def write_error(status_code)
       begin
-        @io << ERROR_RESPONSE[status_code]
+        write_interim ERROR_RESPONSE[status_code]
       rescue StandardError
       end
     end
 
+    def write_interim(str)
+      if @pending_write
+        @pending_write << str
+        return flush_pending_write
+      end
+
+      n = @io.write_nonblock(str, exception: false)
+      if n == :wait_writable
+        @pending_write = +str unless @io.respond_to?(:write_pending?) && @io.write_pending?
+      elsif n < str.bytesize
+        @pending_write = str.byteslice(n..-1)
+      end
+    rescue SystemCallError, IOError
+      raise ConnectionError, "Connection error detected during write"
+    end
+    private :write_interim
+
+    def flush_pending_write
+      return true unless @pending_write
+
+      n = @io.write_nonblock(@pending_write, exception: false)
+      return false if n == :wait_writable
+
+      @pending_write = n == @pending_write.bytesize ? nil : @pending_write.byteslice(n..-1)
+      @pending_write.nil?
+    rescue SystemCallError, IOError
+      raise ConnectionError, "Connection error detected during write"
+    end
+    private :flush_pending_write
+
     def peerip
       return @peerip if @peerip
 
@@ -426,8 +500,7 @@ module Puma
 
       if @env[HTTP_EXPECT] == CONTINUE
         # TODO allow a hook here to check the headers before going forward
-        @io << HTTP_11_100
-        @io.flush
+        write_interim HTTP_11_100
       end
 
       @read_header = false
@@ -522,9 +595,9 @@ module Puma
       false
     end
 
-    def read_body
+    def read_body(&deadline)
       if @chunked_body
-        return read_chunked_body
+        return read_chunked_body(&deadline)
       end
 
       # Read an odd sized chunk so we can read even sized ones
@@ -549,6 +622,7 @@ module Puma
           raise EOFError
         end
 
+        @bytes_read += chunk.bytesize
         remain -= @body.write(chunk)
       end
 
@@ -563,7 +637,7 @@ module Puma
       end
     end
 
-    def read_chunked_body
+    def read_chunked_body(&deadline)
       while true
         begin
           chunk = @io.read_nonblock(CHUNK_SIZE, @read_buffer)
@@ -581,13 +655,27 @@ module Puma
           raise EOFError
         end
 
+        @bytes_read += chunk.bytesize
         if decode_chunk(chunk)
           @env[CONTENT_LENGTH] = @chunked_content_length.to_s
           return true
         end
+
+        check_deadline(&deadline) if deadline
       end
     end
 
+    def check_deadline
+      limit = yield
+      return unless limit
+
+      now = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+      return if now < limit
+      return if now < limit + SHUTDOWN_READ_GRACE && @to_io.wait_readable(0)
+
+      timeout!
+    end
+
     def setup_chunked_body(body)
       @chunked_body = true
       @partial_part_left = 0

data/lib/puma/configuration.rb

@@ -144,6 +144,7 @@ module Puma
       first_data_timeout: 30,
       force_shutdown_after: -1,
       http_content_length_limit: nil,
+      shutdown_body_timeout: 25,
       # Number of seconds to wait until the next request before shutting down.
       idle_timeout: nil,
       io_selector_backend: :auto,

data/lib/puma/const.rb

@@ -100,7 +100,7 @@ module Puma
   # too taxing on performance.
   module Const
 
-    PUMA_VERSION = VERSION = "8.0.2"
+    PUMA_VERSION = VERSION = "8.0.3"
     CODE_NAME = "Into the Arena"
 
     PUMA_SERVER_STRING = ["puma", PUMA_VERSION, CODE_NAME].join(" ").freeze
@@ -109,6 +109,9 @@ module Puma
     # sending data back
     WRITE_TIMEOUT = 10
 
+    # How long the accept loop waits after running out of file descriptors
+    ACCEPT_ERROR_DELAY = 0.1
+
     # The original URI requested by the client.
     REQUEST_URI= "REQUEST_URI"
     REQUEST_PATH = "REQUEST_PATH"

data/lib/puma/control_cli.rb

@@ -44,6 +44,7 @@ module Puma
       @pid = nil
       @control_url = nil
       @control_auth_token = nil
+      @control_ca_file = nil
       @config_file = nil
       @command = nil
       @environment = env['APP_ENV'] || env['RACK_ENV'] || env['RAILS_ENV']
@@ -80,6 +81,10 @@ module Puma
           @control_auth_token = arg
         end
 
+        o.on "--control-ca-file PATH", "CA certificate bundle for the TLS control server" do |arg|
+          @control_ca_file = arg
+        end
+
         o.on "-F", "--config-file PATH", "Puma config script" do |arg|
           @config_file = arg
         end
@@ -179,11 +184,16 @@ module Puma
         when 'ssl'
           require 'openssl'
           host = host[1..-2] if host&.start_with? '['
-          OpenSSL::SSL::SSLSocket.new(
+          ctx = OpenSSL::SSL::SSLContext.new
+          ctx.ca_file = @control_ca_file if @control_ca_file
+          ctx.set_params
+          ssl = OpenSSL::SSL::SSLSocket.new(
             TCPSocket.new(host, uri.port),
-            OpenSSL::SSL::SSLContext.new)
-            .tap { |ssl| ssl.sync_close = true }  # default is false
+            ctx)
+          ssl.tap { |socket| socket.sync_close = true }
+            .tap { |socket| socket.hostname = host }
             .tap(&:connect)
+            .tap { |socket| socket.post_connection_check host }
         when 'tcp'
           host = host[1..-2] if host&.start_with? '['
           TCPSocket.new host, uri.port
@@ -230,6 +240,7 @@ module Puma
         message response.last if PRINTABLE_COMMANDS.include?(@command)
       end
     ensure
+      server ||= ssl
       if server
         if uri.scheme == 'ssl'
           server.sysclose

data/lib/puma/dsl.rb

@@ -399,7 +399,20 @@ module Puma
       @options[:drain_on_shutdown] = which
     end
 
-    # Set the environment in which the rack's app will run. The value must be
+    # Define how long an incomplete request may continue to be read during shutdown.
+    #
+    # The default is 25 seconds.
+    #
+    # @example
+    #   shutdown_body_timeout 10
+    #
+    # @see Puma::Server#graceful_shutdown
+    #
+    def shutdown_body_timeout(seconds)
+      @options[:shutdown_body_timeout] = Float(seconds)
+    end
+
+    # Set the environment in which the Rack app will run. The value must be
     # a string.
     #
     # The default is "development".

data/lib/puma/minissl.rb

@@ -25,6 +25,9 @@ module Puma
         @engine = engine
         @peercert = nil
         @reuse = nil
+        @write_buffer = +''
+        @write_owed = 0
+        @write_owed_data = nil
       end
 
       # @!attribute [r] to_io
@@ -68,9 +71,8 @@ module Puma
 
           return output if output
 
-          while neg_data = @engine.extract
-            @socket.write neg_data
-          end
+          queue_ciphertext
+          flush_write_buffer
         end
       end
 
@@ -85,52 +87,60 @@ module Puma
       def read_nonblock(size, *_)
         # *_ is to deal with keyword args that were added
         # at some point (and being used in the wild)
-        while true
-          output = engine_read_all
-          return output if output
-
-          data = @socket.read_nonblock(size, exception: false)
-          if data == :wait_readable || data == :wait_writable
-            # It would make more sense to let @socket.read_nonblock raise
-            # EAGAIN if necessary but it seems like it'll misbehave on Windows.
-            # I don't have a Windows machine to debug this so I can't explain
-            # exactly whats happening in that OS. Please let me know if you
-            # find out!
-            #
-            # In the meantime, we can emulate the correct behavior by
-            # capturing :wait_readable & :wait_writable and raising EAGAIN
-            # ourselves.
-            raise IO::EAGAINWaitReadable
-          elsif data.nil?
-            raise SSLError.exception "HTTP connection?" if bad_tlsv1_3?
-            return nil
-          end
+        output = engine_read_all
+        return output if output
+
+        raise IO::EAGAINWaitReadable unless flush_write_buffer_nonblock
+
+        data = @socket.read_nonblock(size, exception: false)
+        if data == :wait_readable || data == :wait_writable
+          # It would make more sense to let @socket.read_nonblock raise
+          # EAGAIN if necessary but it seems like it'll misbehave on Windows.
+          # I don't have a Windows machine to debug this so I can't explain
+          # exactly whats happening in that OS. Please let me know if you
+          # find out!
+          #
+          # In the meantime, we can emulate the correct behavior by
+          # capturing :wait_readable & :wait_writable and raising EAGAIN
+          # ourselves.
+          raise IO::EAGAINWaitReadable
+        elsif data.nil?
+          raise SSLError.exception "HTTP connection?" if bad_tlsv1_3?
+          return nil
+        end
 
-          @engine.inject(data)
-          output = engine_read_all
+        @engine.inject(data)
+        output = engine_read_all
+        return output if output
 
-          return output if output
+        queue_ciphertext
+        flush_write_buffer_nonblock
+        raise IO::EAGAINWaitReadable
+      end
 
-          while neg_data = @engine.extract
-            @socket.write neg_data
-          end
-        end
+      def write_pending?
+        !@write_buffer.empty?
       end
 
       def write(data)
         return 0 if data.empty?
 
         data_size = data.bytesize
-        need = data_size
+
+        flush_write_buffer
+        if @write_owed_data && data.byteslice(0, @write_owed_data.bytesize).b == @write_owed_data
+          data = data.byteslice(@write_owed..-1)
+          @write_owed = 0
+          @write_owed_data = nil
+          return data_size if data.empty?
+        end
+
+        need = data.bytesize
 
         while true
           wrote = @engine.write data
-
-          enc_wr = +''
-          while (enc = @engine.extract)
-            enc_wr << enc
-          end
-          @socket.write enc_wr unless enc_wr.empty?
+          queue_ciphertext
+          flush_write_buffer
 
           need -= wrote
 
@@ -143,34 +153,43 @@ module Puma
       alias_method :syswrite, :write
       alias_method :<<, :write
 
-      # This is a temporary fix to deal with websockets code using
-      # write_nonblock.
+      # As with SSL_write, retry with the same data after IO::EAGAINWaitWritable
+      def write_nonblock(data, exception: true)
+        return 0 if data.empty?
 
-      # The problem with implementing it properly
-      # is that it means we'd have to have the ability to rewind
-      # an engine because after we write+extract, the socket
-      # write_nonblock call might raise an exception and later
-      # code would pass the same data in, but the engine would think
-      # it had already written the data in.
-      #
-      # So for the time being (and since write blocking is quite rare),
-      # go ahead and actually block in write_nonblock.
-      #
-      def write_nonblock(data, *_)
-        write data
+        @write_owed = 0 if @write_owed_data && data.byteslice(0, @write_owed_data.bytesize).b != @write_owed_data
+
+        if @write_owed == 0
+          @write_owed = @engine.write data
+          @write_owed_data = nil
+          queue_ciphertext
+        end
+
+        unless flush_write_buffer_nonblock
+          @write_owed_data ||= data.byteslice(0, @write_owed).b
+          raise IO::EAGAINWaitWritable if exception
+          return :wait_writable
+        end
+
+        wrote = @write_owed
+        @write_owed = 0
+        @write_owed_data = nil
+        wrote
+      end
+
+      def wait_writable(timeout = nil)
+        @socket.wait_writable timeout
       end
 
       def flush
+        flush_write_buffer
         @socket.flush
       end
 
       def close
         begin
-          unless @engine.shutdown
-            while alert_data = @engine.extract
-              @socket.write alert_data
-            end
-          end
+          queue_ciphertext unless @engine.shutdown
+          flush_write_buffer_nonblock
         rescue IOError, SystemCallError
           # nothing
         ensure
@@ -178,6 +197,32 @@ module Puma
         end
       end
 
+      def queue_ciphertext
+        while (enc = @engine.extract)
+          @write_buffer << enc
+        end
+      end
+      private :queue_ciphertext
+
+      def flush_write_buffer
+        return if @write_buffer.empty?
+
+        @socket.write @write_buffer
+        @write_buffer = +''
+      end
+      private :flush_write_buffer
+
+      def flush_write_buffer_nonblock
+        until @write_buffer.empty?
+          n = @socket.write_nonblock @write_buffer, exception: false
+          return false if n == :wait_writable
+
+          @write_buffer = @write_buffer.byteslice(n..-1)
+        end
+        true
+      end
+      private :flush_write_buffer_nonblock
+
       # @!attribute [r] peeraddr
       def peeraddr
         @socket.peeraddr

data/lib/puma/reactor.rb

@@ -34,6 +34,7 @@ module Puma
       @selector = ::NIO::Selector.new(NIO::Selector.backends.delete(backend))
       @input = Queue.new
       @timeouts = []
+      @timeout_keys = {}.compare_by_identity
       @block = block
       @reactor_size = 0
       @reactor_max = 0
@@ -77,11 +78,13 @@ module Puma
     def select_loop
       begin
         until @input.closed? && @input.empty?
+          requeue_moved_timeouts
+
           # Wakeup any registered object that receives incoming data.
           # Block until the earliest timeout or Selector#wakeup is called.
           timeout = (earliest = @timeouts.first) && earliest.timeout
           @selector.select(timeout) do |monitor|
-            wakeup!(monitor.value)
+            monitor.interests = interests(monitor.value) unless wakeup!(monitor.value)
           end
 
           # Wakeup all objects that timed out.
@@ -93,7 +96,7 @@ module Puma
               client = @input.pop
               register(client) if client.io_ok?
             end
-            @timeouts.sort_by!(&:timeout_at)
+            @timeouts.sort_by! { |client| @timeout_keys[client] }
           end
         end
       rescue StandardError => e
@@ -110,14 +113,19 @@ module Puma
 
     # Start monitoring the object.
     def register(client)
-      @selector.register(client.to_io, :r).value = client
+      @selector.register(client.to_io, interests(client)).value = client
       @reactor_size += 1
       @reactor_max = @reactor_size if @reactor_max < @reactor_size
       @timeouts << client
+      @timeout_keys[client] = client.timeout_at
     rescue ArgumentError
       # unreadable clients raise error when processed by NIO
     end
 
+    def interests(client)
+      client.write_pending? ? :w : :r
+    end
+
     # 'Wake up' a monitored object by calling the provided block.
     # Stop monitoring the object if the block returns `true`.
     def wakeup!(client)
@@ -125,7 +133,31 @@ module Puma
         @selector.deregister client.to_io
         @reactor_size -= 1
         @timeouts.delete client
+        @timeout_keys.delete client
+        true
+      else
+        if client.timeout_at < @timeout_keys[client]
+          @timeouts.delete client
+          requeue client
+        end
+        false
       end
     end
+
+    # `@timeouts` is sorted by the timeout each client had when it was queued.
+    # Timeouts that moved earlier are requeued in `wakeup!`. Timeouts that moved
+    # later are requeued here, once the client reaches the front.
+    def requeue_moved_timeouts
+      while (client = @timeouts.first) && @timeout_keys[client] < client.timeout_at
+        @timeouts.shift
+        requeue client
+      end
+    end
+
+    def requeue(client)
+      key = @timeout_keys[client] = client.timeout_at
+      index = @timeouts.bsearch_index { |c| @timeout_keys[c] > key } || @timeouts.size
+      @timeouts.insert index, client
+    end
   end
 end

data/lib/puma/response.rb

@@ -59,6 +59,8 @@ module Puma
 
       return :close if closed_socket?(socket)
 
+      write_pending_interim socket, client
+
       if @early_hints
         env[EARLY_HINTS] = lambda { |headers|
           begin
@@ -148,6 +150,8 @@ module Puma
 
       return :close if closed_socket?(socket)
 
+      write_pending_interim socket, client
+
       # Close the connection after a reasonable number of inline requests
       force_keep_alive = @enable_keep_alives && client.requests_served < @max_keep_alive
 
@@ -248,6 +252,12 @@ module Puma
       !shutting_down? && keep_alive ? :keep_alive : :close
     end
 
+    def write_pending_interim(socket, client)
+      pending = client.take_pending_write
+      fast_write_str socket, pending if pending
+    end
+    private :write_pending_interim
+
     # Used to write 'early hints', 'no body' responses, 'hijacked' responses,
     # and body segments (called by `fast_write_response`).
     # Writes a string to a socket (normally `Client#io`) using `write_nonblock`.
@@ -297,7 +307,11 @@ module Puma
             fast_write_str socket, io_buffer.read_and_reset
           else
             fast_write_str socket, io_buffer.read_and_reset
-            IO.copy_stream body, socket
+            remaining = content_length
+            while remaining > 0 && (chunk = body.read([remaining, BODY_LEN_MAX].min))
+              fast_write_str socket, chunk
+              remaining -= chunk.bytesize
+            end
           end
         end
       elsif body.is_a?(::Array) && body.length == 1

data/lib/puma/server.rb

@@ -51,7 +51,7 @@ module Puma
     # @todo the following may be deprecated in the future
     attr_reader :auto_trim_time, :early_hints, :first_data_timeout,
       :leak_stack_on_error,
-      :persistent_timeout, :reaping_time
+      :persistent_timeout, :reaping_time, :shutdown_body_timeout
 
     attr_accessor :app
     attr_accessor :binder
@@ -98,6 +98,8 @@ module Puma
       @early_hints               = @options[:early_hints]
       @first_data_timeout        = @options[:first_data_timeout]
       @persistent_timeout        = @options[:persistent_timeout]
+      @shutdown_body_timeout     = @options[:shutdown_body_timeout]
+      @shutdown_body_deadline    = nil
       @idle_timeout              = @options[:idle_timeout]
       @min_threads               = @options[:min_threads]
       @max_threads               = @options[:max_threads]
@@ -258,6 +260,7 @@ module Puma
       @events.fire :state, :booting
 
       @status = :run
+      @shutdown_body_deadline = nil
 
       @thread_pool = ThreadPool.new(thread_name, options, server: self) do |processor, client|
         process_client(processor, client)
@@ -312,6 +315,9 @@ module Puma
     # If a client object times out, a 408 response is written, its connection is closed,
     # and the object is removed from the reactor (return `true`).
     #
+    # If the request cannot be read, the Client is passed to the ThreadPool with its
+    # `reactor_error` set, so that a processor thread writes the error response.
+    #
     # If the Reactor is shutting down, all Clients are either timed out or passed to the
     # ThreadPool, depending on their current state (#can_close?).
     #
@@ -320,18 +326,33 @@ module Puma
     # will wake up and again be checked to see if it's ready to be passed to the thread pool.
     def reactor_wakeup(client)
       shutdown = !@queue_requests
-      if client.try_to_finish || (shutdown && !client.can_close?)
-        @thread_pool << client
+      read = client.bytes_read
+      if client.try_to_finish { shutdown_body_limit } || (shutdown && !client.can_close?)
+        hand_to_thread_pool client
       elsif shutdown || client.timeout == 0
         client.timeout!
       else
-        client.set_timeout(@first_data_timeout)
+        client.set_timeout(@first_data_timeout) if client.bytes_read > read
         false
       end
-    rescue StandardError => e
-      client_error(e, client)
+    rescue ConnectionError, EOFError
       close_client_safely(client)
       true
+    rescue StandardError => e
+      # Writing the error response may block on a client that is not reading,
+      # so leave it to a thread pool thread.
+      client.reactor_error = e
+      hand_to_thread_pool client
+    end
+
+    def hand_to_thread_pool(client)
+      @thread_pool << client
+      true
+    rescue ThreadError
+      true
+    rescue StandardError
+      close_client_safely client
+      true
     end
 
     def handle_servers
@@ -361,13 +382,16 @@ module Puma
             ios = IO.select sockets, nil, nil, (shutting_down? ? 0 : @idle_timeout)
             unless ios
               unless shutting_down?
-                @idle_timeout_reached = true
-
                 if @clustered
-                  @worker_write << "#{PipeRequest::PIPE_IDLE}#{Process.pid}\n" rescue nil
+                  unless @idle_timeout_reached
+                    @idle_timeout_reached = true
+                    @worker_write << "#{PipeRequest::PIPE_IDLE}#{Process.pid}\n" rescue nil
+                  end
                   next
                 else
+                  @idle_timeout_reached = true
                   @log_writer.log "- Idle timeout reached"
+                  shutdown_body_deadline
                   @status = :stop
                 end
               end
@@ -401,6 +425,9 @@ module Puma
                   sock.accept_nonblock
                 rescue IO::WaitReadable
                   next
+                rescue Errno::EMFILE, Errno::ENFILE, Errno::ENOBUFS, Errno::ENOMEM => e
+                  accept_resource_error e
+                  next
                 end
                 drain += 1 if shutting_down?
 
@@ -413,11 +440,17 @@ module Puma
             # In the case that any of the sockets are unexpectedly close.
             raise
           rescue StandardError => e
-            @log_writer.unknown_error e, nil, "Listen loop"
+            begin
+              @log_writer.unknown_error e, nil, "Listen loop"
+            rescue StandardError
+            end
           end
         end
 
-        @log_writer.debug { "Drained #{drain} additional connections." } if drain
+        begin
+          @log_writer.debug { "Drained #{drain} additional connections." } if drain
+        rescue StandardError
+        end
         @events.fire :state, @status
 
         if queue_requests
@@ -427,7 +460,10 @@ module Puma
 
         graceful_shutdown if @status == :stop || @status == :restart
       rescue Exception => e
-        @log_writer.unknown_error e, nil, "Exception handling servers"
+        begin
+          @log_writer.unknown_error e, nil, "Exception handling servers"
+        rescue StandardError
+        end
       ensure
         # Errno::EBADF is infrequently raised
         [@check, @notify].each do |io|
@@ -459,12 +495,14 @@ module Puma
 
       case cmd
       when STOP_COMMAND
+        shutdown_body_deadline
         @status = :stop
         return true
       when HALT_COMMAND
         @status = :halt
         return true
       when RESTART_COMMAND
+        shutdown_body_deadline
         @status = :restart
         return true
       end
@@ -488,7 +526,9 @@ module Puma
       requests = 0
 
       begin
-        if @queue_requests && !client.eagerly_finish
+        raise client.reactor_error if client.reactor_error
+
+        if @queue_requests && !client.eagerly_finish { shutdown_body_limit }
 
           client.set_timeout(@first_data_timeout)
           if @reactor.add client
@@ -498,7 +538,7 @@ module Puma
         end
 
         with_force_shutdown(client) do
-          client.finish(@first_data_timeout)
+          client.finish(@first_data_timeout) { shutdown_body_limit }
         end
 
         can_loop = true
@@ -519,7 +559,7 @@ module Puma
             next_request_ready = if client.has_back_to_back_requests?
               with_force_shutdown(client) { client.process_back_to_back_requests }
             else
-              with_force_shutdown(client) { client.eagerly_finish }
+              with_force_shutdown(client) { client.eagerly_finish { shutdown_body_limit } }
             end
 
             if next_request_ready
@@ -551,6 +591,25 @@ module Puma
       end
     end
 
+    # Accepting fails while the process is out of file descriptors or memory.
+    # The connection stays in the backlog, so retrying at once would spin and
+    # log at full speed. Wait briefly and log at most once per second.
+    def accept_resource_error(error)
+      now = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+      if @accept_error_logged_at.nil? || now - @accept_error_logged_at >= 1
+        suffix = @accept_errors_suppressed.to_i > 0 ? " (#{@accept_errors_suppressed} more suppressed)" : ""
+        @accept_error_logged_at = now
+        @accept_errors_suppressed = 0
+        begin
+          @log_writer.unknown_error error, nil, "Listen loop#{suffix}"
+        rescue StandardError
+        end
+      else
+        @accept_errors_suppressed += 1
+      end
+      sleep ACCEPT_ERROR_DELAY
+    end
+
     # :nodoc:
     def close_client_safely(client)
       client.close
@@ -628,9 +687,19 @@ module Puma
     end
     private :response_to_error
 
+    def shutdown_body_deadline
+      @shutdown_body_deadline ||= Process.clock_gettime(Process::CLOCK_MONOTONIC) + @shutdown_body_timeout
+    end
+
+    def shutdown_body_limit
+      @shutdown_body_deadline
+    end
+
     # Wait for all outstanding requests to finish.
     #
     def graceful_shutdown
+      shutdown_body_deadline
+
       if @status != :restart
         @binder.close
       end
@@ -656,6 +725,7 @@ module Puma
     # off the request queue before finally exiting.
 
     def stop(sync=false)
+      shutdown_body_deadline
       notify_safely(STOP_COMMAND)
       @thread.join if @thread && sync
     end
@@ -666,6 +736,7 @@ module Puma
     end
 
     def begin_restart(sync=false)
+      shutdown_body_deadline
       notify_safely(RESTART_COMMAND)
       @thread.join if @thread && sync
     end

data/lib/puma/util.rb

@@ -13,21 +13,25 @@ module Puma
     # Escapes and unescapes a URI escaped string with
     # +encoding+. +encoding+ will be the target encoding of the string
     # returned, and it defaults to UTF-8
+    #
+    # Unlike form encoding, escape writes a space as '%20' and unescape
+    # keeps a literal '+', so values such as OpenSSL cipher strings
+    # ("AES+SHA") survive.
     if defined?(::Encoding)
       def escape(s, encoding = Encoding::UTF_8)
-        URI.encode_www_form_component(s, encoding)
+        URI.encode_www_form_component(s, encoding).gsub('+', '%20')
       end
 
       def unescape(s, encoding = Encoding::UTF_8)
-        URI.decode_www_form_component(s, encoding)
+        URI.decode_www_form_component(s.gsub('+', '%2B'), encoding)
       end
     else
       def escape(s, encoding = nil)
-        URI.encode_www_form_component(s, encoding)
+        URI.encode_www_form_component(s, encoding).gsub('+', '%20')
       end
 
       def unescape(s, encoding = nil)
-        URI.decode_www_form_component(s, encoding)
+        URI.decode_www_form_component(s.gsub('+', '%2B'), encoding)
       end
     end
     module_function :unescape, :escape

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: puma
 version: !ruby/object:Gem::Version
-  version: 8.0.2
+  version: 8.0.3
 platform: java
 authors:
 - Evan Phoenix
@@ -157,7 +157,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 4.0.23
 specification_version: 4
 summary: A Ruby/Rack web server built for parallelism.
 test_files: []