ruby-utcp 1.1.5 → 1.1.6

data/lib/utcp/protocols/webrtc.rb

@@ -2,27 +2,45 @@
 
 module UTCP
   class WebRTCPeer
-    def initialize(template)
-      gem "webrtc-ruby", ">= 1.0.0"
-      require "webrtc"
-      WebRTC.init
+    def initialize(template, connection: nil)
       @template = template
       @mutex = Mutex.new
       @condition = ConditionVariable.new
-      @responses = {}
+      @pending = {}
+      @io_mutex = Mutex.new
+      @closed = false
       @candidates = []
-      configuration = { disable_auto_negotiation: true }
+      configuration = { disable_auto_negotiation: true, max_message_size: template.max_response_bytes }
       configuration[:ice_servers] = template.ice_servers unless template.ice_servers.empty?
-      @connection = WebRTC::RTCPeerConnection.new(configuration)
+      unless connection
+        gem "webrtc-ruby", ">= 1.0.0"
+        require "webrtc"
+        require_relative "webrtc_native_cleanup"
+        WebRTC.init
+        @native_cleanup = WebRTCNativeCleanup.new
+        connection = WebRTC::RTCPeerConnection.new(configuration)
+      end
+      @connection = connection
       install_candidate_handler
       @channel = @connection.create_data_channel(template.data_channel_name)
       install_channel_handlers
     rescue LoadError => error
+      close
       raise MissingDependencyError,
             "WebRTC requires the optional 'webrtc-ruby' gem and libdatachannel: #{error.message}"
+    rescue StandardError
+      close
+      raise
     end
 
     def connect
+      @io_mutex.synchronize do
+        @mutex.synchronize { assert_open! }
+        connect_peer
+      end
+    end
+
+    def connect_peer
       offer = @connection.create_offer.await
       # webrtc-ruby creates and installs the local offer in one native operation.
       wait_for_ice_gathering
@@ -34,38 +52,82 @@ module UTCP
       rescue StandardError
         nil
       end
-      @candidates.each { |candidate| post_candidate(candidate) }
+      @mutex.synchronize { @candidates.dup }.each { |candidate| post_candidate(candidate) }
       wait_for_channel
       response
     end
 
     def request(payload, timeout: @template.timeout)
       identifier = payload.fetch("id")
-      @channel.send_text(JSON.generate(payload))
       deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + timeout
+      state = { deadline: deadline }
       @mutex.synchronize do
-        until @responses.key?(identifier)
+        assert_open!
+        raise ValidationError, "Duplicate WebRTC request id" if @pending.key?(identifier)
+        if @pending.length >= @template.max_pending_requests
+          raise ToolCallError, "WebRTC exceeds max_pending_requests"
+        end
+        @pending[identifier] = state
+      end
+      @io_mutex.synchronize do
+        @mutex.synchronize { assert_open! }
+        @channel.send_text(JSON.generate(payload))
+      end
+      @mutex.synchronize do
+        loop do
+          assert_open!
+          return state[:response] if state.key?(:response)
           remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
           raise TimeoutError, "WebRTC response timed out" unless remaining.positive?
           @condition.wait(@mutex, remaining)
         end
-        @responses.delete(identifier)
       end
+    ensure
+      @mutex.synchronize { @pending.delete(identifier) if @pending[identifier].equal?(state) }
     end
 
     def close
-      @channel.close if @channel
-      @channel.destroy if @channel&.respond_to?(:destroy)
-      @connection.close if @connection
-    rescue StandardError
+      @mutex.synchronize do
+        return nil if @closed
+        @closed = true
+        @pending.clear
+        @candidates.clear
+        @condition.broadcast
+      end
+      @io_mutex.synchronize do
+        if @native_cleanup
+          @native_cleanup.close(@channel, @connection)
+        else
+          begin
+            @channel.close if @channel
+            @channel.destroy if @channel&.respond_to?(:destroy)
+          ensure
+            @connection.close if @connection
+          end
+        end
+      end
       nil
     end
 
     private
 
+    private :connect_peer
+
+    def assert_open!
+      raise ToolCallError, "WebRTC peer closed" if @closed
+      raise ToolCallError, @failure if @failure
+    end
+
+    def fail_peer(message)
+      @mutex.synchronize do
+        @failure ||= message unless @closed
+        @condition.broadcast
+      end
+    end
+
     def install_candidate_handler
       @connection.on_ice_candidate do |candidate|
-        @mutex.synchronize { @candidates << candidate } if candidate
+        @mutex.synchronize { @candidates << candidate unless @closed } if candidate
       end
     end
 
@@ -73,15 +135,24 @@ module UTCP
       @channel_open = false
       @channel.on_open do
         @mutex.synchronize do
-          @channel_open = true
+          @channel_open = true unless @closed
           @condition.broadcast
         end
       end
+      @channel.on_close { fail_peer("WebRTC channel closed") } if @channel.respond_to?(:on_close)
       @channel.on_message do |message|
+        if message.data.bytesize > @template.max_response_bytes
+          fail_peer("WebRTC response exceeds max_response_bytes")
+          next
+        end
         envelope = JSON.parse(message.data)
+        next unless envelope.is_a?(Hash)
         identifier = envelope["id"]
         @mutex.synchronize do
-          @responses[identifier] = envelope.key?("result") ? envelope["result"] : envelope
+          state = @pending[identifier]
+          next unless state && !@closed && !state.key?(:response)
+          next if Process.clock_gettime(Process::CLOCK_MONOTONIC) >= state[:deadline]
+          state[:response] = envelope.key?("result") ? envelope["result"] : envelope
           @condition.broadcast
         end
       rescue JSON::ParserError
@@ -93,9 +164,9 @@ module UTCP
       return unless @connection.respond_to?(:on_ice_gathering_state_change)
 
       complete = @connection.ice_gathering_state == :complete
-      @connection.on_ice_gathering_state_change do
+      @connection.on_ice_gathering_state_change do |state|
         @mutex.synchronize do
-          complete = @connection.ice_gathering_state == :complete
+          complete = state == :complete
           @condition.broadcast if complete
         end
       end
@@ -112,7 +183,9 @@ module UTCP
     def wait_for_flag(timeout)
       deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + timeout
       @mutex.synchronize do
-        until yield
+        loop do
+          assert_open!
+          return if yield
           remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
           raise TimeoutError, "WebRTC connection timed out" unless remaining.positive?
           @condition.wait(@mutex, remaining)
@@ -138,7 +211,14 @@ module UTCP
       http.verify_mode = OpenSSL::SSL::VERIFY_PEER if http.use_ssl?
       http.open_timeout = [@template.timeout, 10].min
       http.read_timeout = @template.timeout
-      response = http.start { |connection| connection.request(request) }
+      http.write_timeout = @template.timeout if http.respond_to?(:write_timeout=)
+      response = Timeout.timeout(@template.timeout, TimeoutError, "WebRTC signaling timed out") do
+        http.start do |connection|
+          connection.request(request) do |incoming|
+            incoming.body = LimitedHTTPResponse.new(incoming, @template.max_response_bytes).body
+          end
+        end
+      end
       unless response.code.to_i.between?(200, 299)
         raise ToolCallError.new("WebRTC signaling failed with status #{response.code}",
                                 status: response.code.to_i, response_body: response.body)
@@ -159,6 +239,7 @@ module UTCP
     def register_manual(client, template)
       assert_webrtc_template!(template)
       response = peer_for(client, template).connect
+      ResponseByteBudget.new(template.max_response_bytes, "WebRTC discovery").consume_value(response)
       payload = if response.is_a?(Hash) && response.key?("tools") && !response.key?("utcp_version")
                   {
                     "utcp_version" => VERSION,
@@ -187,7 +268,7 @@ module UTCP
     def call_tool(client, tool_name, tool_args, template)
       assert_webrtc_template!(template)
       identifier = SecureRandom.uuid
-      peer_for(client, template).request(
+      response = peer_for(client, template).request(
         {
           "id" => identifier,
           "tool" => tool_name.to_s.split(".").last,
@@ -195,6 +276,7 @@ module UTCP
         },
         timeout: template.timeout
       )
+      ResponseByteBudget.new(template.max_response_bytes, "WebRTC").consume_value(response)
     rescue Error
       raise
     rescue StandardError => error
@@ -214,7 +296,8 @@ module UTCP
     end
 
     def peer_key(client, template)
-      [client, template.name, template.signaling_server, template.peer_id, template.data_channel_name]
+      [client, template.name, template.signaling_server, template.peer_id, template.data_channel_name,
+       template.max_response_bytes, template.max_pending_requests]
     end
   end
   WebrtcCommunicationProtocol = WebRTCProtocol

data/lib/utcp/protocols/webrtc_native_cleanup.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+module UTCP
+  # Stock webrtc-ruby 1.0 binds these waiting destructors without releasing the
+  # GVL. Keep the compatibility binding local to UTCP-owned objects: callbacks
+  # must be able to finish while native destruction waits for them.
+  class WebRTCNativeCleanup
+    MUTEX = Mutex.new
+
+    def self.bindings
+      MUTEX.synchronize do
+        @bindings ||= Module.new do
+          extend ::FFI::Library
+          ffi_lib WebRTC::FFI::LIB_PATH
+          attach_function :destroy_channel, :webrtc_data_channel_destroy, [:pointer], :void, blocking: true
+          attach_function :destroy_peer, :webrtc_peer_connection_destroy, [:pointer], :void, blocking: true
+        end
+      end
+    end
+
+    def initialize
+      @bindings = self.class.bindings
+    end
+
+    def close(channel, connection)
+      # WebRTCPeer serializes this transfer with all native I/O and elects one
+      # closer. Detach handles before callbacks can observe or reuse them.
+      channel_pointer = channel.instance_variable_get(:@ptr) if channel
+      peer_pointer = connection.ptr if connection
+      channel.instance_variable_set(:@ptr, nil) if channel
+      connection.instance_variable_set(:@ptr, nil) if connection
+      begin
+        @bindings.destroy_channel(channel_pointer) if channel_pointer && !channel_pointer.null?
+      ensure
+        @bindings.destroy_peer(peer_pointer) if peer_pointer && !peer_pointer.null?
+      end
+    end
+  end
+end

data/lib/utcp/protocols/websocket.rb

@@ -28,10 +28,12 @@ module UTCP
     GUID = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11"
     MAX_HEADER_SIZE = 65_536
     MAX_MESSAGE_SIZE = 16 * 1024 * 1024
+    attr_accessor :max_response_bytes
 
     def initialize(url, headers = {}, protocol = nil, timeout = 30)
       @uri = WebSocketURLSecurity.validate!(url)
       @timeout = Float(timeout)
+      @max_response_bytes = MAX_MESSAGE_SIZE
       @read_buffer = +"".b
       @closed = false
       open_socket
@@ -57,7 +59,7 @@ module UTCP
       message = +"".b
       message_opcode = nil
       loop do
-        fin, opcode, payload = read_frame
+        fin, opcode, payload = read_frame(@max_response_bytes - message.bytesize)
         case opcode
         when 0x0
           raise ToolCallError, "unexpected WebSocket continuation frame" unless message_opcode
@@ -78,9 +80,12 @@ module UTCP
         else
           raise ToolCallError, "unsupported WebSocket opcode #{opcode}"
         end
-        raise ToolCallError, "WebSocket message exceeds #{MAX_MESSAGE_SIZE} bytes" if message.bytesize > MAX_MESSAGE_SIZE
+        raise ToolCallError, "WebSocket message exceeds max_response_bytes" if message.bytesize > @max_response_bytes
         return [message_opcode, message] if fin
       end
+    rescue Error
+      close
+      raise
     end
 
     def close
@@ -198,7 +203,7 @@ module UTCP
       @socket.write(header + mask + masked)
     end
 
-    def read_frame
+    def read_frame(remaining = @max_response_bytes)
       head = read_exact(2)
       first, second = head.unpack("CC")
       fin = (first & 0x80) != 0
@@ -207,7 +212,8 @@ module UTCP
       length = second & 0x7F
       length = read_exact(2).unpack1("n") if length == 126
       length = read_exact(8).unpack1("Q>") if length == 127
-      raise ToolCallError, "WebSocket frame exceeds #{MAX_MESSAGE_SIZE} bytes" if length > MAX_MESSAGE_SIZE
+      maximum = opcode >= 8 ? 125 : remaining
+      raise ToolCallError, "WebSocket frame exceeds max_response_bytes" if length > maximum
 
       mask = masked ? read_exact(4) : nil
       payload = read_exact(length)
@@ -220,7 +226,7 @@ module UTCP
     def read_exact(length)
       while @read_buffer.bytesize < length
         wait_readable
-        @read_buffer << @socket.readpartial([4096, length - @read_buffer.bytesize].max)
+        @read_buffer << @socket.readpartial([4096, length - @read_buffer.bytesize].min)
       end
       @read_buffer.slice!(0, length)
     rescue EOFError
@@ -255,8 +261,10 @@ module UTCP
       assert_websocket_template!(template)
       entry, transient = connection_for(client, template, {})
       payload = entry.mutex.synchronize do
+        configure_response_limit(entry.connection, template)
         entry.connection.send_text(JSON.generate("type" => "utcp"))
         _opcode, bytes = entry.connection.read_message
+        ResponseByteBudget.new(template.max_response_bytes, "WebSocket").consume(bytes)
         bytes
       end
       success(template, manual_from_payload(template, payload, source: "WebSocket discovery response"))
@@ -283,11 +291,13 @@ module UTCP
       args = Utils.stringify_keys(tool_args || {})
       entry, transient, message_args = connection_for(client, template, args, include_arguments: true)
       result = entry.mutex.synchronize do
+        configure_response_limit(entry.connection, template)
         message = format_message(template, message_args)
         entry.connection.send_text(message)
         frame = entry.connection.read_message
         raise ToolCallError, "WebSocket closed without a response" unless frame
 
+        ResponseByteBudget.new(template.max_response_bytes, "WebSocket").consume(frame[1])
         decode_message(frame[1], template.response_format, frame[0])
       end
       result
@@ -301,6 +311,10 @@ module UTCP
 
     private
 
+    def configure_response_limit(connection, template)
+      connection.max_response_bytes = template.max_response_bytes if connection.respond_to?(:max_response_bytes=)
+    end
+
     def assert_websocket_template!(template)
       return if template.is_a?(WebSocketCallTemplate)
 

data/lib/utcp/response_limits.rb

@@ -0,0 +1,114 @@
+# frozen_string_literal: true
+
+require "timeout"
+
+module UTCP
+  # Ruby extension for network transports; CLI, file and text are excluded.
+  module ResponseLimits
+    DEFAULT_MAX_RESPONSE_BYTES = 100 * 1024 * 1024
+    DEFAULT_MAX_EVENT_BYTES = 1024 * 1024
+    DEFAULT_MAX_RESPONSE_ITEMS = 10_000
+
+    attr_accessor :max_response_bytes
+
+    def initialize(max_response_bytes: DEFAULT_MAX_RESPONSE_BYTES, **options)
+      super(**options)
+      @max_response_bytes = positive_limit(max_response_bytes, "max_response_bytes")
+    end
+
+    def to_h
+      super.merge("max_response_bytes" => max_response_bytes)
+    end
+
+    private
+
+    def positive_limit(value, name)
+      result = Integer(value)
+      raise ValidationError.new("must be greater than zero", path: name) unless result.positive?
+      result
+    end
+  end
+
+  module HTTPResponseLimits
+    include ResponseLimits
+    attr_accessor :max_event_bytes, :max_response_items, :total_timeout
+
+    def initialize(max_event_bytes: DEFAULT_MAX_EVENT_BYTES,
+                   max_response_items: DEFAULT_MAX_RESPONSE_ITEMS, total_timeout: nil, **options)
+      super(**options)
+      @max_event_bytes = positive_limit(max_event_bytes, "max_event_bytes")
+      @max_response_items = positive_limit(max_response_items, "max_response_items")
+      @total_timeout = total_timeout.nil? ? nil : Float(total_timeout)
+      if @total_timeout && (!@total_timeout.finite? || !@total_timeout.positive?)
+        raise ValidationError.new("must be finite and greater than zero", path: "total_timeout")
+      end
+    end
+
+    def to_h
+      super.merge("max_event_bytes" => max_event_bytes,
+                  "max_response_items" => max_response_items).tap do |value|
+        value["total_timeout"] = total_timeout if total_timeout
+      end
+    end
+
+  end
+
+  class ResponseByteBudget
+    attr_reader :remaining
+
+    def initialize(maximum, context = "Transport")
+      @remaining = maximum
+      @context = context
+    end
+
+    def consume(bytes)
+      @remaining -= bytes.to_s.bytesize
+      raise ToolCallError, "#{@context} response exceeds max_response_bytes" if @remaining.negative?
+      bytes
+    end
+
+    def consume_value(value)
+      consume(value.is_a?(String) ? value : JSON.generate(value))
+      value
+    end
+  end
+
+  # Count decoded bytes before a parser or an accumulating caller receives them.
+  class LimitedHTTPResponse
+    def initialize(response, maximum)
+      @response = response
+      @maximum = maximum
+      @bytes = 0
+    end
+
+    def code
+      @response.code
+    end
+
+    def [](name)
+      @response[name]
+    end
+
+    def read_body
+      consume = lambda do |chunk|
+        @bytes += chunk.to_s.bytesize
+        raise ToolCallError, "HTTP response exceeds max_response_bytes (#{@maximum})" if @bytes > @maximum
+        yield chunk
+      end
+      if @response.respond_to?(:read_body)
+        @response.read_body { |chunk| consume.call(chunk) }
+      else
+        consume.call(@response.body) unless @response.body.nil?
+      end
+    end
+
+    def body
+      result = nil
+      read_body do |chunk|
+        result ||= +"".b
+        result << chunk.to_s.b
+      end
+      result
+    end
+  end
+end

data/lib/utcp/version.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
 module UTCP
-  VERSION = "1.1.5"
+  VERSION = "1.1.6"
 end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ruby-utcp
 version: !ruby/object:Gem::Version
-  version: 1.1.5
+  version: 1.1.6
 platform: ruby
 authors:
 - ruby-utcp contributors
@@ -183,9 +183,11 @@ files:
 - lib/utcp/protocols/text.rb
 - lib/utcp/protocols/udp.rb
 - lib/utcp/protocols/webrtc.rb
+- lib/utcp/protocols/webrtc_native_cleanup.rb
 - lib/utcp/protocols/websocket.rb
 - lib/utcp/registry.rb
 - lib/utcp/repository.rb
+- lib/utcp/response_limits.rb
 - lib/utcp/serializer.rb
 - lib/utcp/utils.rb
 - lib/utcp/variables.rb