spinel-spinner 0.1.0.pre.1

data/lib/spinner/tls.rb

@@ -0,0 +1,116 @@
+require "ffi"
+
+module Spinner
+  module TLSNative
+    extend FFI::Library
+
+    def self.load!
+      return if @loaded
+      # macOS's system libssl can be incompatible with the libcrypto used by
+      # Spinel's bundled OpenSSL package. Allow an explicit, matching library.
+      library = ENV["SPINNER_SSL_LIBRARY"]
+      if library.nil? || library.empty?
+        library = ["/opt/homebrew/opt/openssl@3/lib/libssl.dylib",
+                   "/usr/local/opt/openssl@3/lib/libssl.dylib"].find { |path| File.file?(path) }
+        library ||= "libssl.so.3"
+      end
+      ffi_lib library
+
+      attach_function :TLS_server_method, [], :pointer
+      callback :alpn_select, [:pointer, :pointer, :pointer, :pointer, :uint, :pointer], :int
+      attach_function :SSL_CTX_set_alpn_select_cb, [:pointer, :alpn_select, :pointer], :void
+      attach_function :SSL_CTX_new, [:pointer], :pointer
+      attach_function :SSL_CTX_free, [:pointer], :void
+      attach_function :SSL_CTX_ctrl, [:pointer, :int, :long, :pointer], :long
+      attach_function :SSL_CTX_use_certificate_chain_file, [:pointer, :string], :int
+      attach_function :SSL_CTX_use_PrivateKey_file, [:pointer, :string, :int], :int
+      attach_function :SSL_CTX_check_private_key, [:pointer], :int
+      attach_function :SSL_new, [:pointer], :pointer
+      attach_function :SSL_free, [:pointer], :void
+      attach_function :SSL_set_fd, [:pointer, :int], :int
+      attach_function :SSL_accept, [:pointer], :int
+      attach_function :SSL_get_error, [:pointer, :int], :int
+      attach_function :SSL_read, [:pointer, :pointer, :int], :int
+      attach_function :SSL_write, [:pointer, :pointer, :int], :int
+      attach_function :SSL_pending, [:pointer], :int
+      attach_function :SSL_shutdown, [:pointer], :int
+      attach_function :ERR_get_error, [], :ulong
+      attach_function :ERR_error_string_n, [:ulong, :pointer, :size_t], :void
+
+      @loaded = true
+    end
+
+    def self.error(prefix)
+      code = self.ERR_get_error
+      return prefix if code == 0
+      buffer = FFI::MemoryPointer.new(:char, 256)
+      self.ERR_error_string_n(code, buffer, 256)
+      "#{prefix}: #{buffer.read_string}"
+    end
+  end
+
+  module TLSFileControl
+    extend FFI::Library
+    ffi_lib FFI::Library::LIBC
+    attach_function :fcntl, [:int, :int, :int], :int
+
+    def self.nonblock!(fd)
+      flags = fcntl(fd, 3, 0) # F_GETFL
+      raise IOError, "fcntl(F_GETFL) failed" if flags < 0
+      bit = RUBY_PLATFORM.include?("darwin") ? 4 : 2048
+      raise IOError, "fcntl(F_SETFL) failed" if fcntl(fd, 4, flags | bit) < 0
+    end
+  end
+
+  module TLS
+    class Context
+      attr_reader :pointer
+
+      def initialize(cert_file, key_file)
+        TLSNative.load!
+        @pointer = TLSNative.SSL_CTX_new(TLSNative.TLS_server_method)
+        raise IOError, TLSNative.error("SSL_CTX_new") if @pointer.null?
+        begin
+          # SSL_CTRL_SET_MIN_PROTO_VERSION, TLS1_2_VERSION.
+          raise IOError, "TLS 1.2 minimum unavailable" unless TLSNative.SSL_CTX_ctrl(@pointer, 123, 0x0303, nil) == 1
+          raise IOError, "TLS 1.3 maximum unavailable" unless TLSNative.SSL_CTX_ctrl(@pointer, 124, 0x0304, nil) == 1
+          @alpn_callback = proc do |_ssl, output, output_length, offered, length, _arg|
+            protocols = offered.read_string(length)
+            offset = 0
+            selected = nil
+            while offset < length
+              size = protocols.getbyte(offset)
+              break if size.nil? || size == 0 || offset + size + 1 > length
+              if protocols.byteslice(offset + 1, size) == "http/1.1"
+                selected = offset + 1
+                break
+              end
+              offset += size + 1
+            end
+            if selected.nil?
+              2 # fatal alert: never select HTTP/2
+            else
+              output.write_pointer(offered + selected)
+              output_length.write_uint8(8)
+              0
+            end
+          end
+          TLSNative.SSL_CTX_set_alpn_select_cb(@pointer, @alpn_callback, nil)
+          raise IOError, TLSNative.error("certificate chain") unless TLSNative.SSL_CTX_use_certificate_chain_file(@pointer, cert_file) == 1
+          raise IOError, TLSNative.error("private key") unless TLSNative.SSL_CTX_use_PrivateKey_file(@pointer, key_file, 1) == 1
+          raise IOError, TLSNative.error("certificate/key mismatch") unless TLSNative.SSL_CTX_check_private_key(@pointer) == 1
+        rescue StandardError
+          close
+          raise
+        end
+      end
+
+      def close
+        return if @pointer.nil? || @pointer.null?
+        TLSNative.SSL_CTX_free(@pointer)
+        @pointer = nil
+      end
+    end
+
+  end
+end

data/lib/spinner/transport_socket.rb

@@ -0,0 +1,121 @@
+module Spinner
+  module TLS
+    class Socket
+      def initialize(socket, context)
+        @socket = socket
+        @io_lock = Mutex.new
+        @ssl = nil
+        @handshake_complete = false
+        @pending_write = nil
+        @pending_bytes = nil
+        return if context.nil?
+        TLSFileControl.nonblock!(socket.fileno)
+        @ssl = TLSNative.SSL_new(context.pointer)
+        raise IOError, TLSNative.error("SSL_new") if @ssl.null?
+        unless TLSNative.SSL_set_fd(@ssl, socket.fileno) == 1
+          close
+          raise IOError, TLSNative.error("SSL_set_fd")
+        end
+      end
+
+      def to_io
+        @socket
+      end
+
+      def closed?
+        @socket.closed?
+      end
+
+      def pending
+        @io_lock.synchronize { pending_unlocked }
+      end
+
+      def pending_unlocked
+        @ssl.nil? ? 0 : TLSNative.SSL_pending(@ssl)
+      end
+
+      def accept_nonblock
+        @io_lock.synchronize { accept_nonblock_unlocked }
+      end
+
+      def accept_nonblock_unlocked
+        return self if @ssl.nil?
+        result = TLSNative.SSL_accept(@ssl)
+        if result == 1
+          @handshake_complete = true
+          return self
+        end
+        wait_or_raise(result, "SSL_accept")
+      end
+
+      def read_nonblock(max_bytes)
+        @io_lock.synchronize { read_nonblock_unlocked(max_bytes) }
+      end
+
+      def read_nonblock_unlocked(max_bytes)
+        return @socket.read_nonblock(max_bytes) if @ssl.nil?
+        buffer = FFI::MemoryPointer.new(:char, max_bytes)
+        result = TLSNative.SSL_read(@ssl, buffer, max_bytes)
+        return buffer.read_string(result).b if result > 0
+        wait_or_raise(result, "SSL_read")
+      end
+
+      def write_nonblock(bytes)
+        @io_lock.synchronize { write_nonblock_unlocked(bytes) }
+      end
+
+      # Keep the binary conversion at the native socket call for framed writes.
+      def write_stream_nonblock(bytes)
+        @io_lock.synchronize do
+          if @ssl.nil?
+            @socket.write_nonblock(bytes.b)
+          else
+            write_nonblock_unlocked(bytes)
+          end
+        end
+      end
+
+      def write_nonblock_unlocked(bytes)
+        return @socket.write_nonblock(bytes.b) if @ssl.nil?
+        if @pending_write.nil?
+          @pending_write = FFI::MemoryPointer.new(:char, bytes.bytesize)
+          @pending_write.put_bytes(0, bytes)
+          @pending_bytes = bytes
+        elsif @pending_bytes != bytes
+          raise IOError, "TLS write changed during retry"
+        end
+        result = TLSNative.SSL_write(@ssl, @pending_write, bytes.bytesize)
+        if result > 0
+          @pending_write = nil
+          @pending_bytes = nil
+          return result
+        end
+        wait_or_raise(result, "SSL_write")
+      end
+
+      def close
+        @io_lock.synchronize { close_unlocked }
+      end
+
+      def close_unlocked
+        unless @ssl.nil? || @ssl.null?
+          TLSNative.SSL_shutdown(@ssl) if @handshake_complete && !@socket.closed?
+          TLSNative.SSL_free(@ssl)
+          @ssl = nil
+        end
+        @socket.close unless @socket.closed?
+      end
+
+      private
+
+      def wait_or_raise(result, operation)
+        case TLSNative.SSL_get_error(@ssl, result)
+        when 2 then raise IO::EAGAINWaitReadable
+        when 3 then raise IO::EAGAINWaitWritable
+        when 6 then raise EOFError
+        else raise IOError, TLSNative.error(operation)
+        end
+      end
+    end
+  end
+end

data/lib/spinner/upgrade.rb

@@ -0,0 +1,20 @@
+module Spinner
+  # The callback owns the transport for its lifetime. Returning closes it.
+  class Upgrade
+    def initialize(close_handler = nil, &handler)
+      @handler = handler
+      @close_handler = close_handler
+      @closed = false
+    end
+
+    def call(transport, buffered_bytes)
+      @handler.call(transport, buffered_bytes)
+    end
+
+    def close
+      return if @closed
+      @closed = true
+      @close_handler.call unless @close_handler.nil?
+    end
+  end
+end

data/lib/spinner/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module Spinner
+  VERSION = "0.1.0.pre.1"
+end

data/lib/spinner/websocket.rb

@@ -0,0 +1,179 @@
+require "base64"
+require "digest/sha1"
+require_relative "../spinner"
+
+module Spinner
+  module WebSocket
+    class Adapter
+      def initialize(application, max_message_bytes: 1048576, idle_timeout: 30.0)
+        raise ArgumentError, "invalid WebSocket limits" unless max_message_bytes.is_a?(Integer) && max_message_bytes > 0 && idle_timeout.is_a?(Numeric) && idle_timeout > 0 && idle_timeout.finite?
+        @application = application
+        @maximum = max_message_bytes
+        @timeout = idle_timeout
+      end
+
+      def call(env)
+        upgrades = env["HTTP_UPGRADE"].to_s.downcase.split(",").map(&:strip)
+        return @application.call(env) unless upgrades.include?("websocket")
+        return [400, {}, ["Invalid WebSocket upgrade"]] unless upgrades == ["websocket"]
+        key = env["HTTP_SEC_WEBSOCKET_KEY"].to_s
+        valid_key = key.match?(/\A[A-Za-z0-9+\/]{22}==\z/)
+        valid_key &&= Base64.strict_decode64(key).bytesize == 16
+        valid_key &&= Base64.strict_encode64(Base64.strict_decode64(key)) == key
+        connection = env["HTTP_CONNECTION"].to_s.downcase.split(",").map(&:strip)
+        unless valid_key && connection.include?("upgrade") && env["REQUEST_METHOD"] == "GET" &&
+               env["SERVER_PROTOCOL"] == "HTTP/1.1" && env["HTTP_SEC_WEBSOCKET_VERSION"] == "13" &&
+               env["CONTENT_LENGTH"].to_s.to_i == 0 && env["HTTP_TRANSFER_ENCODING"].nil?
+          return [400, {}, ["Invalid WebSocket request"]]
+        end
+        response = @application.call(env)
+        return response unless response.is_a?(Array) && response.length == 3 && response[0] == 101
+        handler = response[2]
+        raise ArgumentError, "expected WebSocket handler" unless handler.respond_to?(:call)
+        accept = Base64.strict_encode64(Digest::SHA1.digest(key + "258EAFA5-E914-47DA-95CA-C5AB0DC85B11"))
+        headers = response[1].merge("upgrade" => "websocket", "sec-websocket-accept" => accept)
+        upgrade = Upgrade.new(proc { handler.close if handler.respond_to?(:close) }) do |transport, buffered|
+          session = Session.new(transport, buffered, @maximum, @timeout)
+          begin
+            handler.call(session)
+          ensure
+            session.close
+          end
+        end
+        [101, headers, upgrade]
+      rescue ArgumentError
+        [400, {}, ["Invalid WebSocket request"]]
+      end
+    end
+
+    class Session
+      def initialize(transport, buffered, maximum, timeout)
+        @transport = transport
+        @buffer = buffered.b
+        @maximum = maximum
+        @timeout = timeout
+        @closed = false
+        @received_close = false
+      end
+
+      def exact(length, deadline)
+        while @buffer.bytesize < length
+          @buffer << @transport.read_chunk(deadline, [4096, length - @buffer.bytesize].min, "websocket")
+        end
+        @buffer.slice!(0, length).b
+      end
+
+      def read_message
+        data = "".b
+        message_opcode = nil
+        deadline = Transport.now + @timeout
+        loop do
+          head = exact(2, deadline)
+          first = head.getbyte(0)
+          second = head.getbyte(1)
+          fin = (first & 128) != 0
+          opcode = first & 15
+          return protocol_error(1002) if (first & 112) != 0 || (second & 128) == 0
+          length = second & 127
+          if length == 126 || length == 127
+            count = length == 126 ? 2 : 8
+            encoded = exact(count, deadline)
+            length = 0
+            return protocol_error(1002) if count == 8 && (encoded.getbyte(0) & 128) != 0
+            encoded.bytes.each do |byte|
+              return protocol_error(1009) if length > (@maximum >> 8)
+              length = (length << 8) | byte
+            end
+            return protocol_error(1002) if (count == 2 && length < 126) || (count == 8 && length < 65536)
+          end
+          return protocol_error(1009) if opcode < 8 && (length > @maximum || data.bytesize + length > @maximum)
+          return protocol_error(1002) if opcode >= 8 && (!fin || length > 125)
+          mask = exact(4, deadline)
+          payload = exact(length, deadline)
+          decoded = "".b
+          payload.bytes.each_with_index { |byte, index| decoded << (byte ^ mask.getbyte(index % 4)).chr.b }
+          if opcode == 8
+            return protocol_error(1002) if decoded.bytesize == 1
+            if decoded.bytesize >= 2
+              code = (decoded.getbyte(0) << 8) | decoded.getbyte(1)
+              return protocol_error(1002) unless [1000, 1001, 1002, 1003, 1007, 1008, 1009, 1010, 1011, 1012, 1013, 1014].include?(code) || (code >= 3000 && code <= 4999)
+              return protocol_error(1007) unless decoded.byteslice(2, decoded.bytesize - 2).dup.force_encoding("UTF-8").valid_encoding?
+            end
+            write_frame(8, decoded) unless @closed
+            @received_close = true
+            @closed = true
+            return nil
+          elsif opcode == 9
+            write_frame(10, decoded)
+            next
+          elsif opcode == 10
+            next
+          elsif opcode == 1 || opcode == 2
+            return protocol_error(1002) unless message_opcode.nil?
+            message_opcode = opcode
+          elsif opcode == 0
+            return protocol_error(1002) if message_opcode.nil?
+          else
+            return protocol_error(1002)
+          end
+          data << decoded
+          if fin
+            return protocol_error(1007) if message_opcode == 1 && !data.dup.force_encoding("UTF-8").valid_encoding?
+            return [message_opcode, data]
+          end
+        end
+      end
+
+      def write_message(opcode, bytes)
+        raise IOError, "closed WebSocket" if @closed
+        raise ArgumentError, "invalid message" unless [1, 2].include?(opcode) && bytes.is_a?(String) && bytes.bytesize <= @maximum
+        raise ArgumentError, "invalid text message" if opcode == 1 && !bytes.dup.force_encoding("UTF-8").valid_encoding?
+        write_frame(opcode, bytes)
+      end
+
+      def write_frame(opcode, bytes)
+        length = bytes.bytesize
+        header = [128 | opcode]
+        if length < 126
+          header << length
+        else
+          count = length <= 65535 ? 2 : 8
+          header << (count == 2 ? 126 : 127)
+          (count - 1).downto(0) { |index| header << ((length >> (index * 8)) & 255) }
+        end
+        deadline = Transport.now + @timeout
+        write_binary_frame_bytes(header.pack("C*").b, deadline)
+        # Pack dynamic payloads too: Spinel's native socket otherwise stops
+        # a decoded string at an embedded NUL during an echo.
+        write_binary_frame_bytes(bytes.bytes.pack("C*").b, deadline)
+      end
+
+      def write_binary_frame_bytes(bytes, deadline)
+        offset = 0
+        while offset < bytes.bytesize
+          remaining = bytes.byteslice(offset, bytes.bytesize - offset).b
+          count = @transport.write_stream_chunk(remaining, deadline)
+          raise IOError, "invalid WebSocket write progress" if count <= 0 || count > remaining.bytesize
+          offset += count
+        end
+      end
+
+      def protocol_error(code)
+        close(code, false)
+        raise IOError, "invalid WebSocket frame"
+      end
+
+      def close(code = 1000, wait = true)
+        return if @closed
+        @closed = true
+        write_frame(8, (code >> 8).chr.b + (code & 255).chr.b)
+        deadline = Transport.now + @timeout
+        while wait && !@received_close && Transport.now < deadline
+          read_message
+        end
+      rescue IOError, SystemCallError, RequestError
+        nil
+      end
+    end
+  end
+end

data/lib/spinner.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+require_relative "spinner/version"
+require "socket"
+require_relative "spinner/transport_socket"
+require_relative "spinner/input"
+require_relative "spinner/body_storage"
+require_relative "spinner/task_pool"
+require_relative "spinner/proxy_metadata"
+require_relative "spinner/request_parser"
+require_relative "spinner/chunk_decoder"
+require_relative "spinner/host_authority"
+require_relative "spinner/upgrade"
+require_relative "spinner/response_writer"
+require_relative "spinner/reactor"
+require_relative "spinner/server"
+require_relative "spinner/thread_pool"
+
+module Spinner
+  class Error < StandardError; end
+end

data/sig/spinner.rbs

@@ -0,0 +1,4 @@
+module Spinner
+  VERSION: String
+  # See the writing guide of rbs: https://github.com/ruby/rbs#guides
+end

metadata

@@ -0,0 +1,63 @@
+--- !ruby/object:Gem::Specification
+name: spinel-spinner
+version: !ruby/object:Gem::Version
+  version: 0.1.0.pre.1
+platform: ruby
+authors:
+- Dillon Wyatt
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies: []
+description: Spinner compiles with a Spinel application to serve HTTP/1.1 traffic.
+email:
+- dostaglou@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- LICENSE.txt
+- README.md
+- lib/spinner.rb
+- lib/spinner/body_storage.rb
+- lib/spinner/chunk_decoder.rb
+- lib/spinner/host_authority.rb
+- lib/spinner/input.rb
+- lib/spinner/proxy_metadata.rb
+- lib/spinner/reactor.rb
+- lib/spinner/request_parser.rb
+- lib/spinner/response_writer.rb
+- lib/spinner/server.rb
+- lib/spinner/task_pool.rb
+- lib/spinner/thread_pool.rb
+- lib/spinner/tls.rb
+- lib/spinner/transport_socket.rb
+- lib/spinner/upgrade.rb
+- lib/spinner/version.rb
+- lib/spinner/websocket.rb
+- sig/spinner.rbs
+homepage: https://github.com/dostaglou/spinner
+licenses:
+- MIT
+metadata:
+  source_code_uri: https://github.com/dostaglou/spinner
+  changelog_uri: https://github.com/dostaglou/spinner/blob/main/CHANGELOG.md
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 3.0.0
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.6.9
+specification_version: 4
+summary: A Spinel-compatible HTTP application server
+test_files: []