snell 0.1.0

data/lib/snell/record_writer.rb

@@ -0,0 +1,218 @@
+# frozen_string_literal: true
+
+require "securerandom"
+require "async/semaphore"
+require_relative "v6/profile"
+
+module Snell
+  # 一个出站方向，以完整应用写入为单位串行化。
+  # 连接池中的逻辑流共享连续的盐值、nonce 与形态序列；
+  # 部分写入失败后停用写入器，不重放应用数据。
+  class RecordWriter
+    attr_reader :max_payload
+
+    def initialize(transport, psk:, version:, role:, mode: :default)
+      raise ArgumentError, "psk must be a nonempty String" unless psk.is_a?(String) && !psk.empty?
+      raise ArgumentError, "unsupported Snell version" unless [4, 5, 6].include?(version)
+      raise ArgumentError, "unsupported record mode" unless %i[default unshaped raw].include?(mode)
+      raise ArgumentError, "record mode requires version 6" if version != 6 && mode != :default
+      if version == 6 && !psk.bytesize.between?(12, 255)
+        raise ArgumentError, "version 6 psk must contain 12 to 255 bytes"
+      end
+
+      Protocol.validate_role!(role)
+      @transport = transport
+      @psk = psk.b.freeze
+      @version = version
+      @mode = mode
+      @role = role
+      @max_payload = version == 6 ? 65_535 : 16_383
+      @cipher = nil
+      @written_records = 0
+      @failed = false
+      @semaphore = Async::Semaphore.new(1)
+      @profile = V6::Profile.new(psk) if version == 6 && mode == :default
+      @chunk_state = @profile ? @profile.initial_chunk : 1421
+      @written_payload = 0
+      @last_write_at = nil
+      @initial_padding = SecureRandom.random_number(256) + 256 if version != 6
+      @first_payload = true
+    end
+
+    # 报文或头部必须完整落在一条记录中；超限报参数错误，不拆分。
+    # 空应用写入不产生记录，只有 write_eof 显式发送逻辑 EOF。
+    def write_record(bytes)
+      validate_payload!(bytes)
+      raise ArgumentError, "record payload exceeds #{@max_payload} bytes" if bytes.bytesize > @max_payload
+      return 0 if bytes.empty?
+
+      @semaphore.acquire do
+        reset_idle_state
+        emit_record(bytes.b)
+        advance_write
+      end
+      bytes.bytesize
+    end
+
+    # 按当前协议形态拆分流写入，并等待下游写完以维持背压。
+    def write_stream(bytes)
+      validate_payload!(bytes)
+      return 0 if bytes.empty?
+
+      @semaphore.acquire do
+        reset_idle_state
+        offset = 0
+        while offset < bytes.bytesize
+          length = [bytes.bytesize - offset, stream_limit].min
+          emit_record(bytes.byteslice(offset, length).b)
+          offset += length
+          yield_to_reactor if (@written_records % 16).zero?
+        end
+        advance_write
+      end
+      bytes.bytesize
+    end
+
+    # 请求头必须完整放入首条记录；应用数据可跟在请求头之后，
+    # 剩余部分继续以普通流记录发送。
+    def write_request(header, early_data: "")
+      validate_payload!(header)
+      validate_payload!(early_data)
+      raise ArgumentError, "request header must not be empty" if header.empty?
+
+      @semaphore.acquire do
+        reset_idle_state
+        limit = stream_limit
+        raise ArgumentError, "request header exceeds first-record capacity" if header.bytesize > limit
+
+        prefix_length = [early_data.bytesize, limit - header.bytesize].min
+        emit_record(header.b + early_data.byteslice(0, prefix_length).b)
+        offset = prefix_length
+        while offset < early_data.bytesize
+          length = [early_data.bytesize - offset, stream_limit].min
+          emit_record(early_data.byteslice(offset, length).b)
+          offset += length
+          yield_to_reactor if (@written_records % 16).zero?
+        end
+        advance_write
+      end
+      header.bytesize + early_data.bytesize
+    end
+
+    # 零载荷记录关闭逻辑方向，物理 socket 仍可用于反向读取或复用。
+    def write_eof
+      @semaphore.acquire do
+        reset_idle_state
+        emit_record("".b)
+        advance_write
+      end
+      nil
+    end
+
+    def inspect
+      "#<#{self.class} version=#{@version} mode=#{@mode} role=#{@role}>"
+    end
+
+    private
+
+    def validate_payload!(bytes)
+      raise ArgumentError, "payload must be a String" unless bytes.is_a?(String)
+      raise ProtocolError, "record writer is no longer usable" if @failed
+    end
+
+    def stream_limit
+      return @profile.chunk_size(@written_records, @chunk_state) if @profile
+      return @max_payload if @version == 6
+      if @first_payload
+        return 1460 - (@cipher ? 0 : 16) - 23 - 16 - @initial_padding
+      end
+
+      if @role == :server
+        [1421 + ((@written_payload / (192 * 1024)) * 1421), @max_payload].min
+      else
+        [@chunk_state, @max_payload].min
+      end
+    end
+
+    def reset_idle_state
+      now = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+      interval = @profile ? @profile.idle_reset : 31
+      return unless @last_write_at && now - @last_write_at > interval
+
+      @chunk_state = @profile ? @profile.initial_chunk : 1421
+      @written_payload = 0
+    end
+
+    def advance_write
+      @last_write_at = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+      @chunk_state = [@chunk_state + 1421, @max_payload].min unless @profile
+    end
+
+    def emit_record(payload)
+      completed = false
+      raise ProtocolError, "record writer is no longer usable" if @failed
+
+      result = @profile ? emit_shaped_record(payload) : emit_legacy_record(payload)
+      completed = true
+      result
+    ensure
+      @failed = true unless completed
+    end
+
+    def emit_legacy_record(payload)
+      padding_length = @version != 6 && @first_payload && !payload.empty? ? @initial_padding : 0
+      padding = SecureRandom.random_bytes(padding_length)
+      header = [4, 0, padding.bytesize, payload.bytesize].pack("Cnnn")
+      if @mode == :raw
+        wire = header + payload
+      else
+        wire = +"".b
+        unless @cipher
+          salt = SecureRandom.random_bytes(Crypto::SALT_BYTES)
+          @cipher = Crypto::Cipher.new(Crypto.derive_key(@psk, salt))
+          wire << salt
+        end
+        wire << @cipher.encrypt(header)
+        encrypted_payload = payload.empty? ? +"".b : @cipher.encrypt(payload)
+        [padding.bytesize, encrypted_payload.bytesize].min.times do |index|
+          next if index.odd?
+
+          previous = padding.getbyte(index)
+          padding.setbyte(index, encrypted_payload.getbyte(index))
+          encrypted_payload.setbyte(index, previous)
+        end
+        wire << padding << encrypted_payload
+      end
+      @transport.write_all(wire)
+      @written_records += 1
+      @written_payload += payload.bytesize
+      @first_payload = false unless payload.empty?
+      payload.bytesize
+    end
+
+    def emit_shaped_record(payload)
+      sequence = @written_records & 0xffff_ffff
+      wire = +"".b
+      unless @cipher
+        salt = SecureRandom.random_bytes(Crypto::SALT_BYTES)
+        @cipher = Crypto::Cipher.new(Crypto.derive_key(@psk, salt))
+        wire << @profile.salt_block(salt)
+      end
+      prefix = @profile.padding(sequence, @profile.prefix_length(sequence))
+      padding = @profile.padding(sequence, @profile.padding_length(sequence, payload.bytesize))
+      header = [4, 0, padding.bytesize, payload.bytesize].pack("Cnnn")
+      wire << prefix << @cipher.encrypt(header, aad: prefix)
+      encrypted_payload = payload.empty? ? +"".b : @cipher.encrypt(payload, aad: padding)
+      @profile.mix!(padding, encrypted_payload, sequence) unless payload.empty?
+      wire << padding << encrypted_payload
+      @transport.write_all(wire)
+      @written_records += 1
+      @chunk_state = [@chunk_state + @profile.chunk_increment, @profile.maximum_chunk].min
+      payload.bytesize
+    end
+
+    def yield_to_reactor
+      Async::Task.current?&.yield
+    end
+  end
+end

data/lib/snell/replay_cache.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+module Snell
+  # 有界内存缓存，记录首条记录认证成功后的盐值。共享此对象可
+  # 共享重放证据，但不提供持久化或跨进程防护。
+  class ReplayCache
+    def initialize(max_entries: 65_536, ttl: 300, clock: -> { Process.clock_gettime(Process::CLOCK_MONOTONIC) })
+      raise ArgumentError, "max_entries must be positive" unless max_entries.is_a?(Integer) && max_entries.positive?
+      raise ArgumentError, "ttl must be positive" unless ttl.is_a?(Numeric) && ttl.positive? && ttl.finite?
+
+      @max_entries = max_entries
+      @ttl = ttl
+      @clock = clock
+      @entries = {}
+      @mutex = Mutex.new
+    end
+
+    # 显式 raw 模式没有认证盐值；nil 不构成身份认证证据。
+    # 使用单调时钟按插入顺序清除过期项；容量满时拒绝新盐值，
+    # 避免为了接入新连接而删除尚未过期的重放证据。
+    def accept!(salt)
+      return true if salt.nil?
+
+      key = salt.b.dup.freeze
+      @mutex.synchronize do
+        now = @clock.call
+        @entries.shift while !@entries.empty? && @entries.first.last <= now
+        raise AuthenticationError, "Replayed authentication salt" if @entries.key?(key)
+        raise CapacityError, "Replay cache is full" if @entries.size >= @max_entries
+
+        @entries[key] = now + @ttl
+      end
+      nil
+    end
+
+    def size
+      @mutex.synchronize { @entries.size }
+    end
+  end
+end

data/lib/snell/server.rb

@@ -0,0 +1,352 @@
+# frozen_string_literal: true
+
+module Snell
+  # reactor 内的服务入口，负责准入、请求认证与有界转发。
+  # 注入连接器可控制目标访问；一个会话承载顺序 TCP 请求，
+  # 或专用 ping/UDP 交互，不在同一连接上多路复用活跃流。
+  class Server
+    attr_reader :local_address
+
+    def initialize(psk:, version: 5, mode: :default, users: nil, obfs: :none,
+                   obfs_host: nil, obfs_uri: "/", limits: {}, connector: DirectConnector.new,
+                   replay_cache: ReplayCache.new)
+      @owner = Snell.reactor!
+      raise ArgumentError, "psk must be a nonempty String" unless psk.is_a?(String) && !psk.empty?
+
+      @psk = String(psk).dup.freeze
+      @version = version
+      @mode = Snell.mode(mode)
+      @obfs = Snell.obfs(obfs)
+      @obfs_host = obfs_host
+      @obfs_uri = obfs_uri
+      @limits = limits.is_a?(Limits) ? limits : Limits.new(limits)
+      @connector = connector
+      @replay_cache = replay_cache
+      @counters = { accepted: 0, rejected: 0, completed: 0, failed: 0, reused: 0 }
+      @connections = {}
+      @handshakes = 0
+      @udp_count = 0
+      @tokens = @limits[:handshake_burst].to_f
+      @token_time = monotonic
+      @stopping = false
+      update_users(users)
+      validate!
+    end
+
+    def run(listen:)
+      check_owner!
+      raise Error, "Server is already running" if @listener
+      raise ClosedError, "Server has stopped" if @stopping
+
+      @listener = DirectConnector.new.bind(Snell.address(listen))
+      @local_address = @listener.local_address
+      until @stopping
+        accepted = @listener.accept_nonblock(exception: false)
+        if accepted == :wait_readable
+          # 部分调度器不会因另一 Fiber 关闭 IO 而唤醒等待者。
+          @listener.wait_readable(0.1)
+          next
+        end
+        socket, peer = accepted
+        if admit?
+          # 先登记连接再创建任务，Async 子任务会立即启动并可能让出执行权。
+          @connections[socket] = nil
+          Async::Task.current.async { handle_admitted(socket, peer) }
+        else
+          socket.close
+        end
+      end
+    rescue IOError, Errno::EBADF
+      raise unless @stopping
+    ensure
+      @listener&.close unless @listener&.closed?
+      @listener = nil
+    end
+
+    # 嵌入式接入入口；包括拒绝接入时，也负责关闭传入的 socket。
+    def handle(socket, peer: nil)
+      check_owner!
+      unless admit?
+        socket.close
+        raise CapacityError, "Server admission limit reached"
+      end
+      @connections[socket] = nil
+      handle_admitted(socket, peer)
+    end
+
+    # 停止准入，等待正在执行的任务度过宽限期，再关闭连接并取消任务。
+    def stop(grace: @limits[:shutdown_grace])
+      check_owner!
+      raise ArgumentError, "grace must be nonnegative" unless grace.is_a?(Numeric) && grace >= 0 && grace.finite?
+
+      @stopping = true
+      @listener&.close unless @listener&.closed?
+      deadline = monotonic + grace
+      task = Async::Task.current
+      sleep([deadline - monotonic, 0.01].min) while !@connections.empty? && monotonic < deadline
+      @connections.keys.each { |socket| socket.close unless socket.closed? } # rubocop:disable Style/HashEachMethods -- closing can remove entries
+      @connections.values.compact.each { |active| active.stop unless active.equal?(task) }
+      nil
+    end
+
+    # 完整校验替换数据后，才发布冻结的用户快照。
+    # nil 表示仅使用 PSK；已建立的转发保留原接入决定，
+    # 复用连接上的后续请求读取当前快照重新认证。
+    def update_users(users)
+      check_owner!
+      snapshot = if users.nil?
+                   nil
+                 else
+                   raise ArgumentError, "users must be a nonempty Array" unless users.is_a?(Array) && !users.empty?
+
+                   users.each_with_object({}) do |entry, result|
+                     raise ArgumentError, "user must be an object" unless entry.is_a?(Hash)
+                     unless entry.keys.all? { |key| key.is_a?(String) || key.is_a?(Symbol) }
+                       raise ArgumentError, "Invalid user field"
+                     end
+
+                     fields = entry.transform_keys(&:to_sym)
+                     raise ArgumentError, "Duplicate user field" unless fields.size == entry.size
+                     raise ArgumentError, "Unknown user fields" unless (fields.keys - %i[name user_key]).empty?
+
+                     key = fields[:user_key]
+                     name = fields.fetch(:name, "user")
+                     unless key.is_a?(String) && key.bytesize.between?(1, 255) && name.is_a?(String) && !name.empty?
+                       raise ArgumentError, "user requires a name and a 1..255 byte user_key"
+                     end
+                     raise ArgumentError, "Duplicate user key" if result.key?(key.b)
+
+                     result[key.b.dup.freeze] = name.dup.freeze
+                   end.freeze
+                 end
+      @users = snapshot
+      nil
+    end
+
+    # 返回连接处理结果与当前资源计数，不代表目标已确认接收数据。
+    def stats
+      check_owner!
+      @counters.merge(active_connections: @connections.size, handshakes: @handshakes,
+                      udp_associations: @udp_count).freeze
+    end
+
+    def inspect
+      "#<#{self.class} version=#{@version} mode=#{@mode} active_connections=#{@connections.size}>"
+    end
+
+    private
+
+    def handle_admitted(socket, _peer)
+      @connections[socket] = Async::Task.current
+      handshake_pending = true
+      transport = Transport.new(socket, timeout: @limits[:idle_timeout])
+      transport = Obfuscation.wrap(transport, mode: @obfs, role: :server, host: @obfs_host, uri: @obfs_uri)
+      session = Session.new(transport, psk: @psk, version: @version, mode: @mode, role: :server, limits: @limits)
+      request = transport.with_timeout(@limits[:handshake_timeout]) do
+        first = session.read_record
+        @replay_cache.accept!(session.reader.authenticated_salt)
+        Protocol.decode_request(first)
+      end
+      @handshakes -= 1
+      handshake_pending = false
+      loop do
+        session.activate!
+        if request.command.zero?
+          session.write_record(Protocol.encode_reply(kind: 1))
+          break
+        end
+        authenticate!(request)
+        case request.command
+        when 1, 5
+          break unless relay_tcp(session, request)
+        when 6
+          relay_udp(session, request)
+          break
+        end
+        break if @stopping
+
+        session.ready!
+        request = Protocol.decode_request(session.read_record)
+        @counters[:reused] += 1
+      end
+      @counters[:completed] += 1
+    rescue EOFError
+      @counters[:completed] += 1
+    rescue Error, IOError, SystemCallError, SocketError, Async::TimeoutError
+      # 对端失败只影响当前已接入的物理连接。
+      @counters[:failed] += 1
+      nil
+    ensure
+      @handshakes -= 1 if handshake_pending
+      session&.close
+      socket.close unless socket.closed?
+      @connections.delete(socket)
+    end
+
+    def relay_tcp(session, request)
+      begin
+        socket = @connector.connect(request.destination, timeout: @limits[:dial_timeout])
+      rescue SystemCallError, SocketError, TimeoutError
+        send_error(session, 1, "Target connection failed")
+        return false
+      end
+      target = Transport.new(socket, timeout: @limits[:idle_timeout])
+      target.write_all(request.remaining) unless request.remaining.empty?
+      upload_error = nil
+      upload_eof = false
+      # 上传逻辑 EOF 只半关闭目标写方向，下载仍继续进行；
+      # 两个方向都正常结束后，命令 5 才能复用此会话。
+      upload = Async::Task.current.async do
+        loop do
+          bytes = session.read_record
+          if bytes.empty?
+            upload_eof = true
+            break
+          end
+          target.write_all(bytes)
+        end
+      rescue EOFError
+        upload_eof = false
+      rescue Error, IOError, SystemCallError => e
+        upload_error = e
+        target.close
+      ensure
+        target.close_write
+      end
+      replied = false
+      while (bytes = target.read_some([@limits[:buffer_bytes], session.writer.max_payload - 1].min))
+        if replied
+          session.write_stream(bytes)
+        else
+          session.write_stream(Protocol.encode_reply(kind: 0, payload: bytes))
+          replied = true
+        end
+      end
+      return false if upload_error
+
+      unless replied
+        send_error(session, request.command == 5 ? 0x65 : 0xff, request.command == 5 ? "Remote EOF" : "end of file")
+        return false
+      end
+      return false if request.command == 1
+
+      session.write_eof
+      upload.wait
+      upload_eof && upload_error.nil?
+    ensure
+      upload&.stop
+      target&.close
+    end
+
+    # 每个解析出的地址族使用一个 socket，接收子任务由该关联持有；
+    # RecordWriter 将它们对共享下行方向的写入串行化。
+    def relay_udp(session, request)
+      raise ProtocolError, "UDP request contains unexpected data" unless request.remaining.empty?
+      raise CapacityError, "UDP association limit reached" if @udp_count >= @limits[:udp_associations]
+
+      @udp_count += 1
+      counted = true
+      sockets = {}
+      receivers = []
+      session.write_record(Protocol.encode_reply(kind: 0))
+      loop do
+        record = session.read_record
+        break if record.empty?
+
+        datagram = Protocol.decode_packet(record, role: :server)
+        address = Async::Task.current.with_timeout(@limits[:dial_timeout]) { @connector.udp(datagram.address) }
+        socket = sockets[address.afamily] ||= begin
+          udp = Socket.new(address.afamily, Socket::SOCK_DGRAM)
+          begin
+            udp.bind(Addrinfo.udp(address.ipv6? ? "::" : "0.0.0.0", 0))
+            # 先移交给关联的清理集合，再启动可能让出执行权的接收任务。
+            sockets[address.afamily] = udp
+            receivers << Async::Task.current.async { receive_udp(udp, session) }
+            udp
+          ensure
+            # 绑定失败或登记前被取消时，仍由创建者释放 socket。
+            udp.close unless sockets[address.afamily].equal?(udp) || udp.closed?
+          end
+        end
+        loop do
+          sent = socket.sendmsg_nonblock(datagram.payload, 0, address, exception: false)
+          break unless sent == :wait_writable
+
+          raise TimeoutError, "UDP send timed out" unless socket.wait_writable(@limits[:idle_timeout])
+        end
+      end
+    ensure
+      sockets&.each_value { |socket| socket.close unless socket.closed? }
+      receivers&.each(&:stop)
+      @udp_count -= 1 if counted
+    end
+
+    def receive_udp(socket, session)
+      loop do
+        result = socket.recvfrom_nonblock(65_535, exception: false)
+        if result == :wait_readable
+          raise TimeoutError, "UDP receive timed out" unless socket.wait_readable(@limits[:idle_timeout])
+
+          next
+        end
+        payload, source = result
+        address = Address.new(host: source.ip_address, port: source.ip_port)
+        packet = Protocol.encode_packet(payload, address, role: :server)
+        next if packet.bytesize > session.writer.max_payload
+
+        session.write_record(packet)
+      end
+    rescue Error, IOError, SystemCallError
+      session.close
+    end
+
+    def authenticate!(request)
+      snapshot = @users
+      raise AuthenticationError, "Unknown user" if snapshot && !snapshot.key?(request.user_key)
+    end
+
+    def send_error(session, code, message)
+      session.write_record(Protocol.encode_reply(kind: 2, code: code, message: message))
+    end
+
+    def admit?
+      if @stopping || @connections.size >= @limits[:max_connections] || @handshakes >= @limits[:handshake_concurrency]
+        @counters[:rejected] += 1
+        return false
+      end
+
+      now = monotonic
+      @tokens = [@limits[:handshake_burst], @tokens + ((now - @token_time) * @limits[:handshake_rate])].min
+      @token_time = now
+      if @tokens < 1
+        @counters[:rejected] += 1
+        return false
+      end
+
+      @tokens -= 1
+      @handshakes += 1
+      @counters[:accepted] += 1
+      true
+    end
+
+    def check_owner!
+      raise Error, "Server belongs to another reactor" unless Fiber.scheduler.equal?(@owner)
+    end
+
+    def validate!
+      raise ArgumentError, "Server version must be 5 or 6" unless [5, 6].include?(@version)
+      raise ArgumentError, "Invalid mode" unless %i[default unshaped raw].include?(@mode)
+      raise ArgumentError, "Mode requires version 6" unless @version == 6 || @mode == :default
+      raise ArgumentError, "Invalid obfuscation" unless %i[none http tls].include?(@obfs)
+      raise ArgumentError, "Obfuscation is unavailable with version 6" if @version == 6 && @obfs != :none
+      if @version == 6 && !@psk.bytesize.between?(12, 255)
+        raise ArgumentError, "version 6 psk must contain 12 to 255 bytes"
+      end
+      raise ArgumentError, "psk must not be empty" if @psk.empty?
+    end
+
+    def monotonic
+      Process.clock_gettime(Process::CLOCK_MONOTONIC)
+    end
+  end
+end

data/lib/snell/session.rb

@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+module Snell
+  # 拥有物理传输及两个独立的记录方向；连接池状态每次只承载
+  # 一个逻辑流，ready! 不重置加密状态。
+  class Session
+    attr_reader :reader, :writer, :state, :transport, :last_used
+
+    def initialize(transport, psk:, version:, mode:, role:, limits:)
+      @transport = transport
+      @reader = RecordReader.new(transport, psk: psk, version: version, mode: mode, role: role)
+      @writer = RecordWriter.new(transport, psk: psk, version: version, mode: mode, role: role)
+      @limits = limits
+      @state = :ready
+      @last_used = monotonic
+    end
+
+    def activate!
+      raise ClosedError, "Session is not available" unless @state == :ready
+
+      @state = :active
+    end
+
+    def draining!
+      @state = :draining unless closed?
+    end
+
+    def ready!
+      raise ClosedError, "Session is closed" if closed?
+
+      @state = :ready
+      @last_used = monotonic
+    end
+
+    def read_record(timeout: @limits[:idle_timeout])
+      perform(timeout) { @reader.read_record }
+    end
+
+    def write_record(bytes)
+      perform { @writer.write_record(bytes) }
+    end
+
+    def write_stream(bytes)
+      perform { @writer.write_stream(bytes) }
+    end
+
+    def write_request(header, early_data: "")
+      perform { @writer.write_request(header, early_data: early_data) }
+    end
+
+    def write_eof
+      perform { @writer.write_eof }
+    end
+
+    def close
+      @state = :closed
+      @transport.close
+    end
+
+    def closed?
+      @state == :closed || @transport.closed?
+    end
+
+    def inspect
+      "#<#{self.class} state=#{@state}>"
+    end
+
+    private
+
+    # 取消可能绕过 StandardError 捕获；未完成的操作都在 ensure
+    # 中关闭连接，包括处理部分记录时被中断的情况。
+    def perform(timeout = @limits[:idle_timeout], &)
+      result = @transport.with_timeout(timeout, &)
+      completed = true
+      result
+    ensure
+      close unless completed
+    end
+
+    def monotonic
+      Process.clock_gettime(Process::CLOCK_MONOTONIC)
+    end
+  end
+end