puma 5.4.0 → 5.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8615fe84e162e127ef524e304e0cdc330d4f66b57fcd3339c9c32883fef73011
-  data.tar.gz: 505bf893eb69b1e910320dcb4769fe259cfa880e764900c8d1091b6f9baa7533
+  metadata.gz: cf7876f05ec5908081837654da902bb4e92b7594a36dd37f6a71995c7d84626f
+  data.tar.gz: ba1aa508c1c05e514ae29037f3fb3407e253ce2145552104a982579e7eb75835
 SHA512:
-  metadata.gz: 1c347073ca1dc41fb975cd0cfd19fecfa72780e11f08151caed06993b1045a0c2204911d77cbee967b332c68adc4940ad0c0f1f1b26cc105f1d3c923f3fee4f8
-  data.tar.gz: a67f6b4a6959b3f47deb0966e7c2a35697cc1021f77cc7598bdad080c60ef6705be39c0352da76c20bab5fd3165d1e207db8df0bad9ec4633dd5bbefdee3b39e
+  metadata.gz: 5e7057acca8dc5d1289329ab354fc973120c6bd9a3d95da2ab81456f95cacda3d4c8066064461dabd0e90fc8a92789c316e434ca4804be481b7aa36d39304425
+  data.tar.gz: 2708065b37d07c3b6b1a3ba9fa184b36b55647ce5d91cd3fbc7f7df8d561c8bec42e9b97191cd5247b2fcad68877b2c577f11d3ac4934fcf25b31a0d8ce2cfb2

data/History.md

@@ -1,3 +1,18 @@
+## 5.5.0 / 2021-09-19
+
+* Features
+  * Automatic SSL certificate provisioning for localhost, via localhost gem ([#2610], [#2257])
+  * add support for the PROXY protocol (v1 only) ([#2654], [#2651])
+  * Add a semantic CLI option for no config file ([#2689])
+
+* Bugfixes
+  * More elaborate exception handling - lets some dead pumas die. ([#2700], [#2699])
+  * allow multiple after_worker_fork hooks ([#2690])
+  * Preserve BUNDLE_APP_CONFIG on worker fork ([#2688], [#2687])
+
+* Performance
+  * Fix performance of server-side SSL connection close. ([#2675])
+
 ## 5.4.0 / 2021-07-28
 
 * Features
@@ -9,6 +24,7 @@
   * `Binder#parse` - allow for symlinked unix path, add create_activated_fds debug ENV ([#2643], [#2638])
   * Fix deprecation warning: minissl.c - Use Random.bytes if available ([#2642])
   * Client certificates: set session id context while creating SSLContext ([#2633])
+  * Fix deadlock issue in thread pool ([#2656])
 
 * Refactor
   * Replace `IO.select` with `IO#wait_*` when checking a single IO ([#2666])
@@ -1768,6 +1784,17 @@ be added back in a future date when a java Puma::MiniSSL is added.
 * Bugfixes
   * Your bugfix goes here <Most recent on the top, like GitHub> (#Github Number)
 
+[#2610]:https://github.com/puma/puma/pull/2610     "PR by @ye-lin-aung, merged 2021-08-18"
+[#2257]:https://github.com/puma/puma/issues/2257   "Issue by @nateberkopec, closed 2021-08-18"
+[#2654]:https://github.com/puma/puma/pull/2654     "PR by @Roguelazer, merged 2021-09-07"
+[#2651]:https://github.com/puma/puma/issues/2651   "Issue by @Roguelazer, closed 2021-09-07"
+[#2689]:https://github.com/puma/puma/pull/2689     "PR by @jacobherrington, merged 2021-09-05"
+[#2700]:https://github.com/puma/puma/pull/2700     "PR by @ioquatix, merged 2021-09-16"
+[#2699]:https://github.com/puma/puma/issues/2699   "Issue by @ioquatix, closed 2021-09-16"
+[#2690]:https://github.com/puma/puma/pull/2690     "PR by @doits, merged 2021-09-06"
+[#2688]:https://github.com/puma/puma/pull/2688     "PR by @jdelStrother, merged 2021-09-03"
+[#2687]:https://github.com/puma/puma/issues/2687   "Issue by @jdelStrother, closed 2021-09-03"
+[#2675]:https://github.com/puma/puma/pull/2675     "PR by @devwout, merged 2021-09-08"
 [#2657]:https://github.com/puma/puma/pull/2657     "PR by @olivierbellone, merged 2021-07-13"
 [#2648]:https://github.com/puma/puma/pull/2648     "PR by @MSP-Greg, merged 2021-06-27"
 [#1412]:https://github.com/puma/puma/issues/1412   "Issue by @x-yuri, closed 2021-06-27"
@@ -1777,6 +1804,7 @@ be added back in a future date when a java Puma::MiniSSL is added.
 [#2638]:https://github.com/puma/puma/issues/2638   "Issue by @gingerlime, closed 2021-06-27"
 [#2642]:https://github.com/puma/puma/pull/2642     "PR by @MSP-Greg, merged 2021-06-16"
 [#2633]:https://github.com/puma/puma/pull/2633     "PR by @onlined, merged 2021-06-04"
+[#2656]:https://github.com/puma/puma/pull/2656     "PR by @olivierbellone, merged 2021-07-07"
 [#2666]:https://github.com/puma/puma/pull/2666     "PR by @MSP-Greg, merged 2021-07-25"
 [#2630]:https://github.com/puma/puma/pull/2630     "PR by @seangoedecke, merged 2021-05-20"
 [#2626]:https://github.com/puma/puma/issues/2626   "Issue by @rorymckinley, closed 2021-05-20"
@@ -1800,8 +1828,8 @@ be added back in a future date when a java Puma::MiniSSL is added.
 [#2552]:https://github.com/puma/puma/issues/2552   "Issue by @feliperaul, closed 2021-05-24"
 [#2606]:https://github.com/puma/puma/pull/2606     "PR by @wjordan, merged 2021-04-20"
 [#2574]:https://github.com/puma/puma/issues/2574   "Issue by @darkhelmet, closed 2021-04-20"
-[#2567]:https://github.com/puma/puma/pull/2567     "PR by @kddeisz, merged 2021-04-19"
-[#2566]:https://github.com/puma/puma/issues/2566   "Issue by @kddeisz, closed 2021-04-19"
+[#2567]:https://github.com/puma/puma/pull/2567     "PR by @kddnewton, merged 2021-04-19"
+[#2566]:https://github.com/puma/puma/issues/2566   "Issue by @kddnewton, closed 2021-04-19"
 [#2596]:https://github.com/puma/puma/pull/2596     "PR by @MSP-Greg, merged 2021-04-18"
 [#2588]:https://github.com/puma/puma/pull/2588     "PR by @dentarg, merged 2021-04-02"
 [#2556]:https://github.com/puma/puma/issues/2556   "Issue by @gamecreature, closed 2021-04-02"

data/README.md

@@ -2,7 +2,7 @@
   <img src="https://puma.io/images/logos/puma-logo-large.png">
 </p>
 
-# Puma: A Ruby Web Server Built For Concurrency
+# Puma: A Ruby Web Server Built For Parallelism
 
 [![Actions MRI](https://github.com/puma/puma/workflows/MRI/badge.svg?branch=master)](https://github.com/puma/puma/actions?query=workflow%3AMRI)
 [![Actions non MRI](https://github.com/puma/puma/workflows/non_MRI/badge.svg?branch=master)](https://github.com/puma/puma/actions?query=workflow%3Anon_MRI)
@@ -10,11 +10,11 @@
 [![SemVer](https://api.dependabot.com/badges/compatibility_score?dependency-name=puma&package-manager=bundler&version-scheme=semver)](https://dependabot.com/compatibility-score.html?dependency-name=puma&package-manager=bundler&version-scheme=semver)
 [![StackOverflow](https://img.shields.io/badge/stackoverflow-Puma-blue.svg)]( https://stackoverflow.com/questions/tagged/puma )
 
-Puma is a **simple, fast, multi-threaded, and highly concurrent HTTP 1.1 server for Ruby/Rack applications**.
+Puma is a **simple, fast, multi-threaded, and highly parallel HTTP 1.1 server for Ruby/Rack applications**.
 
-## Built For Speed &amp; Concurrency
+## Built For Speed &amp; Parallelism
 
-Puma processes requests using a C-optimized Ragel extension (inherited from Mongrel) that provides fast, accurate HTTP 1.1 protocol parsing in a portable way. Puma then serves the request using a thread pool. Each request is served in a separate thread, so truly concurrent Ruby implementations (JRuby, Rubinius) will use all available CPU cores.
+Puma processes requests using a C-optimized Ragel extension (inherited from Mongrel) that provides fast, accurate HTTP 1.1 protocol parsing in a portable way. Puma then serves the request using a thread pool. Each request is served in a separate thread, so truly parallel Ruby implementations (JRuby, Rubinius) will use all available CPU cores.
 
 Originally designed as a server for [Rubinius](https://github.com/rubinius/rubinius), Puma also works well with Ruby (MRI) and JRuby.
 
@@ -187,6 +187,21 @@ Need a bit of security? Use SSL sockets:
 ```
 $ puma -b 'ssl://127.0.0.1:9292?key=path_to_key&cert=path_to_cert'
 ```
+#### Self-signed SSL certificates (via _localhost_ gem, for development use): 
+
+Puma supports [localhost](https://github.com/socketry/localhost) gem for self-signed certificates. This is particularly useful if you want to use Puma with SSL locally, and self-signed certificates will work for your use-case. Currently, `localhost-authority` can be used only in MRI. To use [localhost](https://github.com/socketry/localhost), you have to `require "localhost/authority"`: 
+
+```ruby
+# config.ru
+require './app'
+require 'localhost/authority'
+run Sinatra::Application
+
+...
+
+$ puma -b 'ssl://localhost:9292' config.ru
+```
+
 
 #### Controlling SSL Cipher Suites
 
@@ -257,9 +272,13 @@ $ puma -C /path/to/config
 
 If no configuration file is specified, Puma will look for a configuration file at `config/puma.rb`. If an environment is specified, either via the `-e` and `--environment` flags, or through the `RACK_ENV` or the `RAILS_ENV` environment variables, Puma first looks for configuration at `config/puma/<environment_name>.rb`, and then falls back to `config/puma.rb`.
 
-If you want to prevent Puma from looking for a configuration file in those locations, provide a dash as the argument to the `-C` (or `--config`) flag:
+If you want to prevent Puma from looking for a configuration file in those locations, include the `--no-config` flag:
 
 ```
+$ puma --no-config
+
+# or
+
 $ puma -C "-"
 ```
 

data/docs/systemd.md

@@ -248,3 +248,4 @@ cap $stage puma:stop  --dry-run
 
 [Restart]: https://www.freedesktop.org/software/systemd/man/systemd.service.html#Restart=
 [#1367]: https://github.com/puma/puma/issues/1367
+[#1499]: https://github.com/puma/puma/issues/1499

data/lib/puma/binder.rb

@@ -57,6 +57,7 @@ module Puma
 
       @envs = {}
       @ios = []
+      localhost_authority
     end
 
     attr_reader :ios
@@ -227,7 +228,13 @@ module Puma
           raise "Puma compiled without SSL support" unless HAS_SSL
 
           params = Util.parse_query uri.query
-          ctx = MiniSSL::ContextBuilder.new(params, @events).context
+
+          # If key and certs are not defined and localhost gem is required.
+          # localhost gem will be used for self signed
+          # Load localhost authority if not loaded.
+          ctx = localhost_authority && localhost_authority_context if params.empty?
+
+          ctx ||= MiniSSL::ContextBuilder.new(params, @events).context
 
           if fd = @inherited_fds.delete(str)
             logger.log "* Inherited #{str}"
@@ -285,6 +292,22 @@ module Puma
       end
     end
 
+    def localhost_authority
+      @localhost_authority ||= Localhost::Authority.fetch if defined?(Localhost::Authority) && !Puma::IS_JRUBY
+    end
+
+    def localhost_authority_context
+      return unless localhost_authority
+
+      key_path, crt_path = if [:key_path, :certificate_path].all? { |m| localhost_authority.respond_to?(m) }
+        [localhost_authority.key_path, localhost_authority.certificate_path]
+      else
+        local_certificates_path = File.expand_path("~/.localhost")
+        [File.join(local_certificates_path, "localhost.key"), File.join(local_certificates_path, "localhost.crt")]
+      end
+      MiniSSL::ContextBuilder.new({ "key" => key_path, "cert" => crt_path }, @events).context
+    end
+
     # Tell the server to listen on host +host+, port +port+.
     # If +optimize_for_latency+ is true (the default) then clients connecting
     # will be optimized for latency over throughput.
@@ -302,6 +325,7 @@ module Puma
 
       host = host[1..-2] if host and host[0..0] == '['
       tcp_server = TCPServer.new(host, port)
+
       if optimize_for_latency
         tcp_server.setsockopt(Socket::IPPROTO_TCP, Socket::TCP_NODELAY, 1)
       end
@@ -323,6 +347,8 @@ module Puma
                          optimize_for_latency=true, backlog=1024)
 
       raise "Puma compiled without SSL support" unless HAS_SSL
+      # Puma will try to use local authority context if context is supplied nil
+      ctx ||= localhost_authority_context
 
       if host == "localhost"
         loopback_addresses.each do |addr|
@@ -350,6 +376,8 @@ module Puma
 
     def inherit_ssl_listener(fd, ctx)
       raise "Puma compiled without SSL support" unless HAS_SSL
+      # Puma will try to use local authority context if context is supplied nil
+      ctx ||= localhost_authority_context
 
       s = fd.kind_of?(::TCPServer) ? fd : ::TCPServer.for_fd(fd)
 

data/lib/puma/cli.rb

@@ -112,6 +112,11 @@ module Puma
             file_config.load arg
           end
 
+          # Identical to supplying --config "-", but more semantic
+          o.on "--no-config", "Prevent Puma from searching for a config file" do |arg|
+            file_config.load "-"
+          end
+
           o.on "--control-url URL", "The bind url to use for the control server. Use 'auto' to use temp unix server" do |arg|
             configure_control_url(arg)
           end

data/lib/puma/client.rb

@@ -56,6 +56,7 @@ module Puma
       @parser = HttpParser.new
       @parsed_bytes = 0
       @read_header = true
+      @read_proxy = false
       @ready = false
 
       @body = nil
@@ -71,6 +72,7 @@ module Puma
       @peerip = nil
       @listener = nil
       @remote_addr_header = nil
+      @expect_proxy_proto = false
 
       @body_remain = 0
 
@@ -106,7 +108,7 @@ module Puma
 
     # @!attribute [r] in_data_phase
     def in_data_phase
-      !@read_header
+      !(@read_header || @read_proxy)
     end
 
     def set_timeout(val)
@@ -121,6 +123,7 @@ module Puma
     def reset(fast_check=true)
       @parser.reset
       @read_header = true
+      @read_proxy = !!@expect_proxy_proto
       @env = @proto_env.dup
       @body = nil
       @tempfile = nil
@@ -131,6 +134,8 @@ module Puma
       @in_last_chunk = false
 
       if @buffer
+        return false unless try_to_parse_proxy_protocol
+
         @parsed_bytes = @parser.execute(@env, @buffer, @parsed_bytes)
 
         if @parser.finished?
@@ -161,8 +166,32 @@ module Puma
       end
     end
 
+    # If necessary, read the PROXY protocol from the buffer. Returns
+    # false if more data is needed.
+    def try_to_parse_proxy_protocol
+      if @read_proxy
+        if @expect_proxy_proto == :v1
+          if @buffer.include? "\r\n"
+            if md = PROXY_PROTOCOL_V1_REGEX.match(@buffer)
+              if md[1]
+                @peerip = md[1].split(" ")[0]
+              end
+              @buffer = md.post_match
+            end
+            # if the buffer has a \r\n but doesn't have a PROXY protocol
+            # request, this is just HTTP from a non-PROXY client; move on
+            @read_proxy = false
+            return @buffer.size > 0
+          else
+            return false
+          end
+        end
+      end
+      true
+    end
+
     def try_to_finish
-      return read_body unless @read_header
+      return read_body if in_data_phase
 
       begin
         data = @io.read_nonblock(CHUNK_SIZE)
@@ -187,6 +216,8 @@ module Puma
         @buffer = data
       end
 
+      return false unless try_to_parse_proxy_protocol
+
       @parsed_bytes = @parser.execute(@env, @buffer, @parsed_bytes)
 
       if @parser.finished?
@@ -243,6 +274,17 @@ module Puma
       @parsed_bytes == 0
     end
 
+    def expect_proxy_proto=(val)
+      if val
+        if @read_header
+          @read_proxy = true
+        end
+      else
+        @read_proxy = false
+      end
+      @expect_proxy_proto = val
+    end
+
     private
 
     def setup_body

data/lib/puma/const.rb

@@ -100,8 +100,8 @@ module Puma
   # too taxing on performance.
   module Const
 
-    PUMA_VERSION = VERSION = "5.4.0".freeze
-    CODE_NAME = "Super Flight".freeze
+    PUMA_VERSION = VERSION = "5.5.0".freeze
+    CODE_NAME = "Zawgyi".freeze
 
     PUMA_SERVER_STRING = ['puma', PUMA_VERSION, CODE_NAME].join(' ').freeze
 
@@ -247,5 +247,7 @@ module Puma
 
     # Banned keys of response header
     BANNED_HEADER_KEY = /\A(rack\.|status\z)/.freeze
+
+    PROXY_PROTOCOL_V1_REGEX = /^PROXY (?:TCP4|TCP6|UNKNOWN) ([^\r]+)\r\n/.freeze
   end
 end

data/lib/puma/dsl.rb

@@ -585,7 +585,7 @@ module Puma
     #   end
     def after_worker_fork(&block)
       @options[:after_worker_fork] ||= []
-      @options[:after_worker_fork] = block
+      @options[:after_worker_fork] << block
     end
 
     alias_method :after_worker_boot, :after_worker_fork
@@ -818,7 +818,7 @@ module Puma
     # a kernel syscall is required which for very fast rack handlers
     # slows down the handling significantly.
     #
-    # There are 4 possible values:
+    # There are 5 possible values:
     #
     # 1. **:socket** (the default) - read the peername from the socket using the
     #    syscall. This is the normal behavior.
@@ -828,7 +828,10 @@ module Puma
     #    `set_remote_address header: "X-Real-IP"`.
     #    Only the first word (as separated by spaces or comma) is used, allowing
     #    headers such as X-Forwarded-For to be used as well.
-    # 4. **\<Any string\>** - this allows you to hardcode remote address to any value
+    # 4. **proxy_protocol: :v1**- set the remote address to the value read from the
+    #    HAproxy PROXY protocol, version 1. If the request does not have the PROXY
+    #    protocol attached to it, will fall back to :socket
+    # 5. **\<Any string\>** - this allows you to hardcode remote address to any value
     #    you wish. Because Puma never uses this field anyway, it's format is
     #    entirely in your hands.
     #
@@ -846,6 +849,13 @@ module Puma
         if hdr = val[:header]
           @options[:remote_address] = :header
           @options[:remote_address_header] = "HTTP_" + hdr.upcase.tr("-", "_")
+        elsif protocol_version = val[:proxy_protocol]
+          @options[:remote_address] = :proxy_protocol
+          protocol_version = protocol_version.downcase.to_sym
+          unless [:v1].include?(protocol_version)
+            raise "Invalid value for proxy_protocol - #{protocol_version.inspect}"
+          end
+          @options[:remote_address_proxy_protocol] = protocol_version
         else
           raise "Invalid value for set_remote_address - #{val.inspect}"
         end

data/lib/puma/launcher.rb

@@ -319,10 +319,12 @@ module Puma
       log '* Pruning Bundler environment'
       home = ENV['GEM_HOME']
       bundle_gemfile = Bundler.original_env['BUNDLE_GEMFILE']
+      bundle_app_config = Bundler.original_env['BUNDLE_APP_CONFIG']
       with_unbundled_env do
         ENV['GEM_HOME'] = home
         ENV['BUNDLE_GEMFILE'] = bundle_gemfile
         ENV['PUMA_BUNDLER_PRUNED'] = '1'
+        ENV["BUNDLE_APP_CONFIG"] = bundle_app_config
         args = [Gem.ruby, puma_wild_location, '-I', dirs.join(':')] + @original_argv
         # Ruby 2.0+ defaults to true which breaks socket activation
         args += [{:close_others => false}]

data/lib/puma/minissl.rb

@@ -161,28 +161,13 @@ module Puma
         @socket.flush
       end
 
-      def read_and_drop(timeout = 1)
-        return :timeout unless @socket.wait_readable(timeout)
-        case @socket.read_nonblock(1024, exception: false)
-        when nil
-          :eof
-        when :wait_readable
-          :eagain
-        else
-          :drop
-        end
-      end
-
-      def should_drop_bytes?
-        @engine.init? || !@engine.shutdown
-      end
-
       def close
         begin
-          # Read any drop any partially initialized sockets and any received bytes during shutdown.
-          # Don't let this socket hold this loop forever.
-          # If it can't send more packets within 1s, then give up.
-          return if [:timeout, :eof].include?(read_and_drop(1)) while should_drop_bytes?
+          unless @engine.shutdown
+            while alert_data = @engine.extract
+              @socket.write alert_data
+            end
+          end
         rescue IOError, SystemCallError
           Thread.current.purge_interrupt_queue if Thread.current.respond_to? :purge_interrupt_queue
           # nothing

data/lib/puma/server.rb

@@ -323,6 +323,8 @@ module Puma
           remote_addr_value = @options[:remote_address_value]
         when :header
           remote_addr_header = @options[:remote_address_header]
+        when :proxy_protocol
+          remote_addr_proxy_protocol = @options[:remote_address_proxy_protocol]
         end
 
         while @status == :run || (drain && shutting_down?)
@@ -348,11 +350,16 @@ module Puma
                   client.peerip = remote_addr_value
                 elsif remote_addr_header
                   client.remote_addr_header = remote_addr_header
+                elsif remote_addr_proxy_protocol
+                  client.expect_proxy_proto = remote_addr_proxy_protocol
                 end
                 pool << client
               end
             end
-          rescue Object => e
+          rescue IOError, Errno::EBADF
+            # In the case that any of the sockets are unexpectedly close.
+            raise
+          rescue StandardError => e
             @events.unknown_error e, nil, "Listen loop"
           end
         end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: puma
 version: !ruby/object:Gem::Version
-  version: 5.4.0
+  version: 5.5.0
 platform: ruby
 authors:
 - Evan Phoenix
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-07-29 00:00:00.000000000 Z
+date: 2021-09-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: nio4r
@@ -24,9 +24,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '2.0'
-description: Puma is a simple, fast, threaded, and highly concurrent HTTP 1.1 server
+description: Puma is a simple, fast, threaded, and highly parallel HTTP 1.1 server
   for Ruby/Rack applications. Puma is intended for use in both development and production
-  environments. It's great for highly concurrent Ruby implementations such as Rubinius
+  environments. It's great for highly parallel Ruby implementations such as Rubinius
   and JRuby as well as as providing process worker support to support CRuby well.
 email:
 - evan@phx.io
@@ -143,6 +143,6 @@ requirements: []
 rubygems_version: 3.2.3
 signing_key:
 specification_version: 4
-summary: Puma is a simple, fast, threaded, and highly concurrent HTTP 1.1 server for
+summary: Puma is a simple, fast, threaded, and highly parallel HTTP 1.1 server for
   Ruby/Rack applications
 test_files: []