shopify-cli 1.4.1 → 1.8.0

data/vendor/deps/webrick/lib/webrick/ssl.rb

@@ -0,0 +1,215 @@
+# frozen_string_literal: true
+#
+# ssl.rb -- SSL/TLS enhancement for GenericServer
+#
+# Copyright (c) 2003 GOTOU Yuuzou All rights reserved.
+#
+# $Id$
+
+require 'webrick'
+require 'openssl'
+
+module WEBrick
+  module Config
+    svrsoft = General[:ServerSoftware]
+    osslv = ::OpenSSL::OPENSSL_VERSION.split[1]
+
+    ##
+    # Default SSL server configuration.
+    #
+    # WEBrick can automatically create a self-signed certificate if
+    # <code>:SSLCertName</code> is set.  For more information on the various
+    # SSL options see OpenSSL::SSL::SSLContext.
+    #
+    # :ServerSoftware       ::
+    #   The server software name used in the Server: header.
+    # :SSLEnable            :: false,
+    #   Enable SSL for this server.  Defaults to false.
+    # :SSLCertificate       ::
+    #   The SSL certificate for the server.
+    # :SSLPrivateKey        ::
+    #   The SSL private key for the server certificate.
+    # :SSLClientCA          :: nil,
+    #   Array of certificates that will be sent to the client.
+    # :SSLExtraChainCert    :: nil,
+    #   Array of certificates that will be added to the certificate chain
+    # :SSLCACertificateFile :: nil,
+    #   Path to a CA certificate file
+    # :SSLCACertificatePath :: nil,
+    #   Path to a directory containing CA certificates
+    # :SSLCertificateStore  :: nil,
+    #   OpenSSL::X509::Store used for certificate validation of the client
+    # :SSLTmpDhCallback     :: nil,
+    #   Callback invoked when DH parameters are required.
+    # :SSLVerifyClient      ::
+    #   Sets whether the client is verified.  This defaults to VERIFY_NONE
+    #   which is typical for an HTTPS server.
+    # :SSLVerifyDepth       ::
+    #   Number of CA certificates to walk when verifying a certificate chain
+    # :SSLVerifyCallback    ::
+    #   Custom certificate verification callback
+    # :SSLServerNameCallback::
+    #   Custom servername indication callback
+    # :SSLTimeout           ::
+    #   Maximum session lifetime
+    # :SSLOptions           ::
+    #   Various SSL options
+    # :SSLCiphers           ::
+    #   Ciphers to be used
+    # :SSLStartImmediately  ::
+    #   Immediately start SSL upon connection?  Defaults to true
+    # :SSLCertName          ::
+    #   SSL certificate name.  Must be set to enable automatic certificate
+    #   creation.
+    # :SSLCertComment       ::
+    #   Comment used during automatic certificate creation.
+
+    SSL = {
+      :ServerSoftware       => "#{svrsoft} OpenSSL/#{osslv}",
+      :SSLEnable            => false,
+      :SSLCertificate       => nil,
+      :SSLPrivateKey        => nil,
+      :SSLClientCA          => nil,
+      :SSLExtraChainCert    => nil,
+      :SSLCACertificateFile => nil,
+      :SSLCACertificatePath => nil,
+      :SSLCertificateStore  => nil,
+      :SSLTmpDhCallback     => nil,
+      :SSLVerifyClient      => ::OpenSSL::SSL::VERIFY_NONE,
+      :SSLVerifyDepth       => nil,
+      :SSLVerifyCallback    => nil,   # custom verification
+      :SSLTimeout           => nil,
+      :SSLOptions           => nil,
+      :SSLCiphers           => nil,
+      :SSLStartImmediately  => true,
+      # Must specify if you use auto generated certificate.
+      :SSLCertName          => nil,
+      :SSLCertComment       => "Generated by Ruby/OpenSSL"
+    }
+    General.update(SSL)
+  end
+
+  module Utils
+    ##
+    # Creates a self-signed certificate with the given number of +bits+,
+    # the issuer +cn+ and a +comment+ to be stored in the certificate.
+
+    def create_self_signed_cert(bits, cn, comment)
+      rsa = OpenSSL::PKey::RSA.new(bits){|p, n|
+        case p
+        when 0; $stderr.putc "."  # BN_generate_prime
+        when 1; $stderr.putc "+"  # BN_generate_prime
+        when 2; $stderr.putc "*"  # searching good prime,
+                                  # n = #of try,
+                                  # but also data from BN_generate_prime
+        when 3; $stderr.putc "\n" # found good prime, n==0 - p, n==1 - q,
+                                  # but also data from BN_generate_prime
+        else;   $stderr.putc "*"  # BN_generate_prime
+        end
+      }
+      cert = OpenSSL::X509::Certificate.new
+      cert.version = 2
+      cert.serial = 1
+      name = (cn.kind_of? String) ? OpenSSL::X509::Name.parse(cn)
+                                  : OpenSSL::X509::Name.new(cn)
+      cert.subject = name
+      cert.issuer = name
+      cert.not_before = Time.now
+      cert.not_after = Time.now + (365*24*60*60)
+      cert.public_key = rsa.public_key
+
+      ef = OpenSSL::X509::ExtensionFactory.new(nil,cert)
+      ef.issuer_certificate = cert
+      cert.extensions = [
+        ef.create_extension("basicConstraints","CA:FALSE"),
+        ef.create_extension("keyUsage", "keyEncipherment, digitalSignature, keyAgreement, dataEncipherment"),
+        ef.create_extension("subjectKeyIdentifier", "hash"),
+        ef.create_extension("extendedKeyUsage", "serverAuth"),
+        ef.create_extension("nsComment", comment),
+      ]
+      aki = ef.create_extension("authorityKeyIdentifier",
+                                "keyid:always,issuer:always")
+      cert.add_extension(aki)
+      cert.sign(rsa, "SHA256")
+
+      return [ cert, rsa ]
+    end
+    module_function :create_self_signed_cert
+  end
+
+  ##
+  #--
+  # Updates WEBrick::GenericServer with SSL functionality
+
+  class GenericServer
+
+    ##
+    # SSL context for the server when run in SSL mode
+
+    def ssl_context # :nodoc:
+      @ssl_context ||= begin
+        if @config[:SSLEnable]
+          ssl_context = setup_ssl_context(@config)
+          @logger.info("\n" + @config[:SSLCertificate].to_text)
+          ssl_context
+        end
+      end
+    end
+
+    undef listen
+
+    ##
+    # Updates +listen+ to enable SSL when the SSL configuration is active.
+
+    def listen(address, port) # :nodoc:
+      listeners = Utils::create_listeners(address, port)
+      if @config[:SSLEnable]
+        listeners.collect!{|svr|
+          ssvr = ::OpenSSL::SSL::SSLServer.new(svr, ssl_context)
+          ssvr.start_immediately = @config[:SSLStartImmediately]
+          ssvr
+        }
+      end
+      @listeners += listeners
+      setup_shutdown_pipe
+    end
+
+    ##
+    # Sets up an SSL context for +config+
+
+    def setup_ssl_context(config) # :nodoc:
+      unless config[:SSLCertificate]
+        cn = config[:SSLCertName]
+        comment = config[:SSLCertComment]
+        cert, key = Utils::create_self_signed_cert(2048, cn, comment)
+        config[:SSLCertificate] = cert
+        config[:SSLPrivateKey] = key
+      end
+      ctx = OpenSSL::SSL::SSLContext.new
+      ctx.key = config[:SSLPrivateKey]
+      ctx.cert = config[:SSLCertificate]
+      ctx.client_ca = config[:SSLClientCA]
+      ctx.extra_chain_cert = config[:SSLExtraChainCert]
+      ctx.ca_file = config[:SSLCACertificateFile]
+      ctx.ca_path = config[:SSLCACertificatePath]
+      ctx.cert_store = config[:SSLCertificateStore]
+      ctx.tmp_dh_callback = config[:SSLTmpDhCallback]
+      ctx.verify_mode = config[:SSLVerifyClient]
+      ctx.verify_depth = config[:SSLVerifyDepth]
+      ctx.verify_callback = config[:SSLVerifyCallback]
+      ctx.servername_cb = config[:SSLServerNameCallback] || proc { |args| ssl_servername_callback(*args) }
+      ctx.timeout = config[:SSLTimeout]
+      ctx.options = config[:SSLOptions]
+      ctx.ciphers = config[:SSLCiphers]
+      ctx
+    end
+
+    ##
+    # ServerNameIndication callback
+
+    def ssl_servername_callback(sslsocket, hostname = nil)
+      # default
+    end
+
+  end
+end

data/vendor/deps/webrick/lib/webrick/utils.rb

@@ -0,0 +1,265 @@
+# frozen_string_literal: true
+#
+# utils.rb -- Miscellaneous utilities
+#
+# Author: IPR -- Internet Programming with Ruby -- writers
+# Copyright (c) 2001 TAKAHASHI Masayoshi, GOTOU Yuuzou
+# Copyright (c) 2002 Internet Programming with Ruby writers. All rights
+# reserved.
+#
+# $IPR: utils.rb,v 1.10 2003/02/16 22:22:54 gotoyuzo Exp $
+
+require 'socket'
+require 'io/nonblock'
+require 'etc'
+
+module WEBrick
+  module Utils
+    ##
+    # Sets IO operations on +io+ to be non-blocking
+    def set_non_blocking(io)
+      io.nonblock = true if io.respond_to?(:nonblock=)
+    end
+    module_function :set_non_blocking
+
+    ##
+    # Sets the close on exec flag for +io+
+    def set_close_on_exec(io)
+      io.close_on_exec = true if io.respond_to?(:close_on_exec=)
+    end
+    module_function :set_close_on_exec
+
+    ##
+    # Changes the process's uid and gid to the ones of +user+
+    def su(user)
+      if pw = Etc.getpwnam(user)
+        Process::initgroups(user, pw.gid)
+        Process::Sys::setgid(pw.gid)
+        Process::Sys::setuid(pw.uid)
+      else
+        warn("WEBrick::Utils::su doesn't work on this platform", uplevel: 1)
+      end
+    end
+    module_function :su
+
+    ##
+    # The server hostname
+    def getservername
+      Socket::gethostname
+    end
+    module_function :getservername
+
+    ##
+    # Creates TCP server sockets bound to +address+:+port+ and returns them.
+    #
+    # It will create IPV4 and IPV6 sockets on all interfaces.
+    def create_listeners(address, port)
+      unless port
+        raise ArgumentError, "must specify port"
+      end
+      sockets = Socket.tcp_server_sockets(address, port)
+      sockets = sockets.map {|s|
+        s.autoclose = false
+        ts = TCPServer.for_fd(s.fileno)
+        s.close
+        ts
+      }
+      return sockets
+    end
+    module_function :create_listeners
+
+    ##
+    # Characters used to generate random strings
+    RAND_CHARS = "ABCDEFGHIJKLMNOPQRSTUVWXYZ" +
+                 "0123456789" +
+                 "abcdefghijklmnopqrstuvwxyz"
+
+    ##
+    # Generates a random string of length +len+
+    def random_string(len)
+      rand_max = RAND_CHARS.bytesize
+      ret = +""
+      len.times{ ret << RAND_CHARS[rand(rand_max)] }
+      ret
+    end
+    module_function :random_string
+
+    ###########
+
+    require "timeout"
+    require "singleton"
+
+    ##
+    # Class used to manage timeout handlers across multiple threads.
+    #
+    # Timeout handlers should be managed by using the class methods which are
+    # synchronized.
+    #
+    #   id = TimeoutHandler.register(10, Timeout::Error)
+    #   begin
+    #     sleep 20
+    #     puts 'foo'
+    #   ensure
+    #     TimeoutHandler.cancel(id)
+    #   end
+    #
+    # will raise Timeout::Error
+    #
+    #   id = TimeoutHandler.register(10, Timeout::Error)
+    #   begin
+    #     sleep 5
+    #     puts 'foo'
+    #   ensure
+    #     TimeoutHandler.cancel(id)
+    #   end
+    #
+    # will print 'foo'
+    #
+    class TimeoutHandler
+      include Singleton
+
+      ##
+      # Mutex used to synchronize access across threads
+      TimeoutMutex = Thread::Mutex.new # :nodoc:
+
+      ##
+      # Registers a new timeout handler
+      #
+      # +time+:: Timeout in seconds
+      # +exception+:: Exception to raise when timeout elapsed
+      def TimeoutHandler.register(seconds, exception)
+        at = Process.clock_gettime(Process::CLOCK_MONOTONIC) + seconds
+        instance.register(Thread.current, at, exception)
+      end
+
+      ##
+      # Cancels the timeout handler +id+
+      def TimeoutHandler.cancel(id)
+        instance.cancel(Thread.current, id)
+      end
+
+      def self.terminate
+        instance.terminate
+      end
+
+      ##
+      # Creates a new TimeoutHandler.  You should use ::register and ::cancel
+      # instead of creating the timeout handler directly.
+      def initialize
+        TimeoutMutex.synchronize{
+          @timeout_info = Hash.new
+        }
+        @queue = Thread::Queue.new
+        @watcher = nil
+      end
+
+      # :nodoc:
+      private \
+        def watch
+          to_interrupt = []
+          while true
+            now = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+            wakeup = nil
+            to_interrupt.clear
+            TimeoutMutex.synchronize{
+              @timeout_info.each {|thread, ary|
+                next unless ary
+                ary.each{|info|
+                  time, exception = *info
+                  if time < now
+                    to_interrupt.push [thread, info.object_id, exception]
+                  elsif !wakeup || time < wakeup
+                    wakeup = time
+                  end
+                }
+              }
+            }
+            to_interrupt.each {|arg| interrupt(*arg)}
+            if !wakeup
+              @queue.pop
+            elsif (wakeup -= now) > 0
+              begin
+                (th = Thread.start {@queue.pop}).join(wakeup)
+              ensure
+                th&.kill&.join
+              end
+            end
+            @queue.clear
+          end
+        end
+
+      # :nodoc:
+      private \
+        def watcher
+          (w = @watcher)&.alive? and return w # usual case
+          TimeoutMutex.synchronize{
+            (w = @watcher)&.alive? and next w # pathological check
+            @watcher = Thread.start(&method(:watch))
+          }
+        end
+
+      ##
+      # Interrupts the timeout handler +id+ and raises +exception+
+      def interrupt(thread, id, exception)
+        if cancel(thread, id) && thread.alive?
+          thread.raise(exception, "execution timeout")
+        end
+      end
+
+      ##
+      # Registers a new timeout handler
+      #
+      # +time+:: Timeout in seconds
+      # +exception+:: Exception to raise when timeout elapsed
+      def register(thread, time, exception)
+        info = nil
+        TimeoutMutex.synchronize{
+          (@timeout_info[thread] ||= []) << (info = [time, exception])
+        }
+        @queue.push nil
+        watcher
+        return info.object_id
+      end
+
+      ##
+      # Cancels the timeout handler +id+
+      def cancel(thread, id)
+        TimeoutMutex.synchronize{
+          if ary = @timeout_info[thread]
+            ary.delete_if{|info| info.object_id == id }
+            if ary.empty?
+              @timeout_info.delete(thread)
+            end
+            return true
+          end
+          return false
+        }
+      end
+
+      ##
+      def terminate
+        TimeoutMutex.synchronize{
+          @timeout_info.clear
+          @watcher&.kill&.join
+        }
+      end
+    end
+
+    ##
+    # Executes the passed block and raises +exception+ if execution takes more
+    # than +seconds+.
+    #
+    # If +seconds+ is zero or nil, simply executes the block
+    def timeout(seconds, exception=Timeout::Error)
+      return yield if seconds.nil? or seconds.zero?
+      # raise ThreadError, "timeout within critical session" if Thread.critical
+      id = TimeoutHandler.register(seconds, exception)
+      begin
+        yield(seconds)
+      ensure
+        TimeoutHandler.cancel(id)
+      end
+    end
+    module_function :timeout
+  end
+end