thrift 0.23.0 → 0.25.0

data/lib/thrift/transport/socket.rb

@@ -1,4 +1,5 @@
 # encoding: ascii-8bit
+# frozen_string_literal: true
 #
 # Licensed to the Apache Software Foundation (ASF) under one
 # or more contributor license agreements. See the NOTICE file
@@ -18,11 +19,11 @@
 # under the License.
 #
 
-require 'socket'
+require "socket"
 
 module Thrift
   class Socket < BaseTransport
-    def initialize(host = 'localhost', port = 9090, timeout = nil)
+    def initialize(host = "localhost", port = 9090, timeout = nil)
       @host = host
       @port = port
       @timeout = timeout
@@ -33,39 +34,21 @@ module Thrift
     attr_accessor :handle, :timeout
 
     def open
-      for addrinfo in ::Socket::getaddrinfo(@host, @port, nil, ::Socket::SOCK_STREAM) do
-        begin
-          socket = ::Socket.new(addrinfo[4], ::Socket::SOCK_STREAM, 0)
-          socket.setsockopt(::Socket::IPPROTO_TCP, ::Socket::TCP_NODELAY, 1)
-          sockaddr = ::Socket.sockaddr_in(addrinfo[1], addrinfo[3])
-          begin
-            socket.connect_nonblock(sockaddr)
-          rescue Errno::EINPROGRESS
-            unless IO.select(nil, [ socket ], nil, @timeout)
-              next
-            end
-            begin
-              socket.connect_nonblock(sockaddr)
-            rescue Errno::EISCONN
-            end
-          end
-          return @handle = socket
-        rescue StandardError => e
-          next
-        end
-      end
-      raise TransportException.new(TransportException::NOT_OPEN, "Could not connect to #{@desc}: #{e}")
+      raise TransportException.new(TransportException::ALREADY_OPEN, "Socket already open") if open?
+
+      deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + @timeout unless @timeout.nil? || @timeout == 0
+      @handle = connect_socket(deadline)
     end
 
     def open?
-      !@handle.nil? and !@handle.closed?
+      !@handle.nil? && !@handle.closed?
     end
 
     def write(str)
       raise TransportException.new(TransportException::NOT_OPEN, "closed stream") unless open?
       str = Bytes.force_binary_encoding(str)
       begin
-        if @timeout.nil? or @timeout == 0
+        if @timeout.nil? || @timeout == 0
           @handle.write(str)
         else
           deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + @timeout
@@ -73,7 +56,7 @@ module Thrift
 
           while len < str.length
             begin
-              len += @handle.write_nonblock(str[len..-1])
+              len += @handle.write_nonblock(str[len..])
             rescue IO::WaitWritable
               wait_for(:write, deadline, str.length)
             rescue IO::WaitReadable
@@ -83,12 +66,11 @@ module Thrift
 
           len
         end
-      rescue TransportException => e
-        # pass this on
-        raise e
+      rescue TransportException
+        close
+        raise
       rescue StandardError => e
-        @handle.close
-        @handle = nil
+        close
         raise TransportException.new(TransportException::NOT_OPEN, e.message)
       end
     end
@@ -97,42 +79,39 @@ module Thrift
       raise TransportException.new(TransportException::NOT_OPEN, "closed stream") unless open?
 
       begin
-        if @timeout.nil? or @timeout == 0
+        if @timeout.nil? || @timeout == 0
           data = @handle.readpartial(sz)
         else
           deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + @timeout
 
           data = loop do
-            begin
-              break @handle.read_nonblock(sz)
-            rescue IO::WaitReadable
-              wait_for(:read, deadline, sz)
-            rescue IO::WaitWritable
-              wait_for(:write, deadline, sz)
-            end
+            break @handle.read_nonblock(sz)
+          rescue IO::WaitReadable
+            wait_for(:read, deadline, sz)
+          rescue IO::WaitWritable
+            wait_for(:write, deadline, sz)
           end
         end
-      rescue TransportException => e
-        # don't let this get caught by the StandardError handler
-        raise e
+      rescue TransportException
+        close
+        raise
       rescue StandardError => e
-        @handle.close unless @handle.closed?
-        @handle = nil
+        close
         raise TransportException.new(TransportException::NOT_OPEN, e.message)
       end
-      if (data.nil? or data.length == 0)
+      if data.nil? || data.length == 0
         raise TransportException.new(TransportException::UNKNOWN, "Socket: Could not read #{sz} bytes from #{@desc}")
       end
       data
     end
 
     def close
-      @handle.close unless @handle.nil? or @handle.closed?
+      close_socket(@handle)
       @handle = nil
     end
 
     def to_io
-      @handle&.to_io || raise(IOError, 'closed stream')
+      @handle&.to_io || raise(IOError, "closed stream")
     end
 
     def to_s
@@ -141,6 +120,64 @@ module Thrift
 
     private
 
+    def connect_socket(deadline)
+      last_error = nil
+      connected_socket = nil
+
+      Addrinfo.foreach(@host, @port, nil, :STREAM) do |addrinfo|
+        socket = nil
+
+        begin
+          socket = if deadline
+            remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+            raise TransportException.new(TransportException::TIMED_OUT, "Socket: Timed out opening connection to #{@desc}") if remaining <= 0
+
+            addrinfo.connect(timeout: remaining)
+          else
+            addrinfo.connect
+          end
+
+          socket.setsockopt(::Socket::IPPROTO_TCP, ::Socket::TCP_NODELAY, 1)
+          connected_socket = socket
+          break
+        rescue Errno::ETIMEDOUT => e
+          close_socket(socket)
+          last_error = e
+        rescue TransportException
+          close_socket(socket)
+          raise
+        rescue StandardError => e
+          close_socket(socket)
+          last_error = e
+        end
+      end
+
+      return connected_socket if connected_socket
+
+      if last_error.is_a?(Errno::ETIMEDOUT)
+        raise TransportException.new(TransportException::TIMED_OUT, "Socket: Timed out opening connection to #{@desc}")
+      end
+
+      if deadline && deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC) <= 0
+        raise TransportException.new(TransportException::TIMED_OUT, "Socket: Timed out opening connection to #{@desc}")
+      end
+
+      raise TransportException.new(TransportException::NOT_OPEN, "Could not connect to #{@desc}"), cause: last_error
+    rescue TransportException
+      raise
+    rescue StandardError
+      raise TransportException.new(TransportException::NOT_OPEN, "Could not connect to #{@desc}")
+    end
+
+    def close_socket(socket)
+      return if socket.nil?
+      return if socket.respond_to?(:closed?) && socket.closed?
+
+      socket.close
+    rescue StandardError
+      nil
+    end
+
     def wait_for(operation, deadline, sz)
       rd_ary, wr_ary = case operation
       when :read

data/lib/thrift/transport/ssl_server_socket.rb

@@ -1,4 +1,5 @@
 # encoding: ascii-8bit
+# frozen_string_literal: true
 #
 # Licensed to the Apache Software Foundation (ASF) under one
 # or more contributor license agreements. See the NOTICE file
@@ -18,24 +19,84 @@
 # under the License.
 #
 
-require 'socket'
+require "io/wait"
+require "socket"
 
 module Thrift
   class SSLServerSocket < ServerSocket
-    def initialize(host_or_port, port = nil, ssl_context = nil)
-      super(host_or_port, port)
+    def initialize(host_or_port, port = nil, ssl_context = nil, client_timeout: DEFAULT_CLIENT_TIMEOUT)
+      super(host_or_port, port, client_timeout: client_timeout)
       @ssl_context = ssl_context
     end
 
     attr_accessor :ssl_context
 
     def listen
-      socket = TCPServer.new(@host, @port)
-      @handle = OpenSSL::SSL::SSLServer.new(socket, @ssl_context)
+      tcp_server = TCPServer.new(@host, @port)
+      @handle = OpenSSL::SSL::SSLServer.new(tcp_server, @ssl_context).tap do |server|
+        server.start_immediately = false
+      end
+    end
+
+    def accept
+      return if @handle.nil?
+
+      transport = nil
+      ssl_socket = @handle.accept
+      deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + @client_timeout unless @client_timeout.nil? || @client_timeout == 0
+      ssl_socket.to_io.setsockopt(::Socket::IPPROTO_TCP, ::Socket::TCP_NODELAY, 1)
+      accept_ssl_socket(ssl_socket, deadline)
+
+      transport = Socket.new.tap do |accepted_transport|
+        accepted_transport.timeout = @client_timeout
+        accepted_transport.handle = ssl_socket
+      end
+    ensure
+      # Thread#kill leaves $! nil, but marks the thread as aborting.
+      close_accepted_socket(ssl_socket) if transport.nil? || $! || Thread.current.status == "aborting"
     end
 
     def to_s
-      "ssl(#{super.to_s})"
+      "ssl(#{super})"
+    end
+
+    private
+
+    def accept_ssl_socket(ssl_socket, deadline)
+      return ssl_socket.accept unless deadline
+
+      loop do
+        case ssl_socket.accept_nonblock(exception: false)
+        when ssl_socket
+          return ssl_socket
+        when :wait_readable
+          wait_for_handshake(ssl_socket, :read, deadline)
+        when :wait_writable
+          wait_for_handshake(ssl_socket, :write, deadline)
+        else
+          raise TransportException.new(TransportException::NOT_OPEN, "SSL server socket: Unexpected TLS handshake result")
+        end
+      end
+    end
+
+    def wait_for_handshake(ssl_socket, direction, deadline)
+      remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+      ready = if remaining > 0
+        if direction == :read
+          ssl_socket.to_io.wait_readable(remaining)
+        else
+          ssl_socket.to_io.wait_writable(remaining)
+        end
+      end
+      return if ready
+
+      raise OpenSSL::SSL::SSLError, "SSL server socket: Timed out accepting TLS connection"
+    end
+
+    def close_accepted_socket(ssl_socket)
+      ssl_socket&.close
+    rescue StandardError
+      nil
     end
   end
 end

data/lib/thrift/transport/ssl_socket.rb

@@ -1,4 +1,5 @@
 # encoding: ascii-8bit
+# frozen_string_literal: true
 #
 # Licensed to the Apache Software Foundation (ASF) under one
 # or more contributor license agreements. See the NOTICE file
@@ -17,35 +18,93 @@
 # specific language governing permissions and limitations
 # under the License.
 
+require "io/wait"
+require "ipaddr"
+
 module Thrift
   class SSLSocket < Socket
-    def initialize(host = 'localhost', port = 9090, timeout = nil, ssl_context = nil)
+    def initialize(host = "localhost", port = 9090, timeout = nil, ssl_context = nil, server_hostname: host)
       super(host, port, timeout)
       @ssl_context = ssl_context
+      @server_hostname = server_hostname
     end
 
     attr_accessor :ssl_context
+    attr_accessor :server_hostname
 
     def open
-      socket = super
-      @handle = OpenSSL::SSL::SSLSocket.new(socket, @ssl_context)
+      deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + @timeout unless @timeout.nil? || @timeout == 0
+      socket = connect_socket(deadline)
+
       begin
-        @handle.connect_nonblock
-        @handle.post_connection_check(@host)
+        ssl_context = configured_ssl_context
+        ssl_socket = OpenSSL::SSL::SSLSocket.new(socket, ssl_context)
+        ssl_socket.hostname = @server_hostname if send_server_hostname?
+        ssl_socket.sync_close = true
+        @handle = ssl_socket
+
+        if deadline
+          loop do
+            result = @handle.connect_nonblock(exception: false)
+
+            case result
+            when @handle
+              break
+            when :wait_readable
+              remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+              if remaining <= 0 || !@handle.to_io.wait_readable(remaining)
+                raise TransportException.new(TransportException::TIMED_OUT, "SSL socket: Timed out establishing session with #{@desc}")
+              end
+            when :wait_writable
+              remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+              if remaining <= 0 || !@handle.to_io.wait_writable(remaining)
+                raise TransportException.new(TransportException::TIMED_OUT, "SSL socket: Timed out establishing session with #{@desc}")
+              end
+            else
+              raise TransportException.new(TransportException::NOT_OPEN, "Could not connect to #{@desc}: unexpected SSL connect result #{result.inspect}")
+            end
+          end
+        else
+          @handle.connect
+        end
+
+        @handle.post_connection_check(server_hostname_for_verification)
         @handle
-      rescue IO::WaitReadable
-        IO.select([ @handle ], nil, nil, @timeout)
-        retry
-      rescue IO::WaitWritable
-        IO.select(nil, [ @handle ], nil, @timeout)
-        retry
-      rescue StandardError => e
-        raise TransportException.new(TransportException::NOT_OPEN, "Could not connect to #{@desc}: #{e}")
+      rescue TransportException
+        close_socket(@handle)
+        @handle = nil
+        raise
+      rescue StandardError
+        close_socket(@handle || socket)
+        @handle = nil
+        raise TransportException.new(TransportException::NOT_OPEN, "Could not connect to #{@desc}")
       end
     end
 
     def to_s
-      "ssl(#{super.to_s})"
+      "ssl(#{super})"
+    end
+
+    private
+
+    def configured_ssl_context
+      @ssl_context ||= OpenSSL::SSL::SSLContext.new.tap do |context|
+        context.verify_mode = OpenSSL::SSL::VERIFY_PEER
+        context.cert_store = OpenSSL::X509::Store.new.tap(&:set_default_paths)
+      end
+    end
+
+    def send_server_hostname?
+      return false if @server_hostname.nil? || @server_hostname.empty?
+
+      IPAddr.new(@server_hostname)
+      false
+    rescue IPAddr::InvalidAddressError
+      true
+    end
+
+    def server_hostname_for_verification
+      @server_hostname.nil? || @server_hostname.empty? ? @host : @server_hostname
     end
   end
 end

data/lib/thrift/transport/unix_server_socket.rb

@@ -1,4 +1,5 @@
 # encoding: ascii-8bit
+# frozen_string_literal: true
 #
 # Licensed to the Apache Software Foundation (ASF) under one
 # or more contributor license agreements. See the NOTICE file
@@ -18,16 +19,18 @@
 # under the License.
 #
 
-require 'socket'
+require "socket"
 
 module Thrift
   class UNIXServerSocket < BaseServerTransport
-    def initialize(path)
+    def initialize(path, client_timeout: DEFAULT_CLIENT_TIMEOUT)
       @path = path
+      @client_timeout = client_timeout
       @handle = nil
     end
 
     attr_accessor :handle
+    attr_reader :client_timeout
 
     def listen
       @handle = ::UNIXServer.new(@path)
@@ -37,6 +40,7 @@ module Thrift
       unless @handle.nil?
         sock = @handle.accept
         trans = UNIXSocket.new(nil)
+        trans.timeout = @client_timeout
         trans.handle = sock
         trans
       end

data/lib/thrift/transport/unix_socket.rb

@@ -1,4 +1,5 @@
 # encoding: ascii-8bit
+# frozen_string_literal: true
 #
 # Licensed to the Apache Software Foundation (ASF) under one
 # or more contributor license agreements. See the NOTICE file
@@ -18,7 +19,7 @@
 # under the License.
 #
 
-require 'socket'
+require "socket"
 
 module Thrift
   class UNIXSocket < Socket
@@ -30,11 +31,9 @@ module Thrift
     end
 
     def open
-      begin
-        @handle = ::UNIXSocket.new(@path)
-      rescue StandardError
-        raise TransportException.new(TransportException::NOT_OPEN, "Could not open UNIX socket at #{@path}")
-      end
+      @handle = ::UNIXSocket.new(@path)
+    rescue StandardError
+      raise TransportException.new(TransportException::NOT_OPEN, "Could not open UNIX socket at #{@path}")
     end
 
     def to_s

data/lib/thrift/types.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 #
 # Licensed to the Apache Software Foundation (ASF) under one
 # or more contributor license agreements. See the NOTICE file
@@ -17,7 +18,7 @@
 # under the License.
 #
 
-require 'set'
+require "set"
 
 module Thrift
   module Types
@@ -47,27 +48,27 @@ module Thrift
   def self.check_type(value, field, name, skip_nil = true)
     return if value.nil? and skip_nil
     klasses = case field[:type]
-              when Types::VOID
-                NilClass
-              when Types::BOOL
-                [TrueClass, FalseClass]
-              when Types::BYTE, Types::I16, Types::I32, Types::I64
-                Integer
-              when Types::DOUBLE
-                Float
-              when Types::STRING
-                String
-              when Types::UUID
-                String
-              when Types::STRUCT
-                [Struct, Union]
-              when Types::MAP
-                Hash
-              when Types::SET
-                Set
-              when Types::LIST
-                Array
-              end
+    when Types::VOID
+      NilClass
+    when Types::BOOL
+      [TrueClass, FalseClass]
+    when Types::BYTE, Types::I16, Types::I32, Types::I64
+      Integer
+    when Types::DOUBLE
+      Float
+    when Types::STRING
+      String
+    when Types::UUID
+      String
+    when Types::STRUCT
+      [Struct, Union]
+    when Types::MAP
+      Hash
+    when Types::SET
+      Set
+    when Types::LIST
+      Array
+    end
     valid = klasses && [*klasses].any? { |klass| klass === value }
     raise TypeError, "Expected #{type_name(field[:type])}, received #{value.class} for field #{name}" unless valid
     # check elements now

data/lib/thrift/union.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 #
 # Licensed to the Apache Software Foundation (ASF) under one
 # or more contributor license agreements. See the NOTICE file
@@ -17,6 +18,8 @@
 # under the License.
 #
 
+require "thrift/struct_union"
+
 module Thrift
   class Union
     def initialize(name = nil, value = nil)
@@ -53,13 +56,17 @@ module Thrift
       end
     end
 
-    def read(iprot)
+    def read(iprot, remaining_depth = DEFAULT_RECURSION_DEPTH)
+      raise ProtocolException.new(ProtocolException::DEPTH_LIMIT, "Maximum recursion depth exceeded") if remaining_depth <= 0
+      @setfield = nil
+      @value = nil
+
       iprot.read_struct_begin
-      fname, ftype, fid = iprot.read_field_begin
-      handle_message(iprot, fid, ftype)
+      _, ftype, fid = iprot.read_field_begin
+      handle_message(iprot, fid, ftype, remaining_depth)
       iprot.read_field_end
 
-      fname, ftype, fid = iprot.read_field_begin
+      _, ftype, _ = iprot.read_field_begin
       unless (ftype == Types::STOP)
         raise ProtocolException.new(ProtocolException::INVALID_DATA, "Too many fields for union")
       end
@@ -68,11 +75,12 @@ module Thrift
       validate
     end
 
-    def write(oprot)
+    def write(oprot, remaining_depth = DEFAULT_RECURSION_DEPTH)
+      raise ProtocolException.new(ProtocolException::DEPTH_LIMIT, "Maximum recursion depth exceeded") if remaining_depth <= 0
       validate
       oprot.write_struct_begin(self.class.name)
 
-      fid = self.name_to_id(@setfield.to_s)
+      fid = name_to_id(@setfield.to_s)
 
       field_info = struct_fields[fid]
       unless field_info
@@ -82,8 +90,10 @@ module Thrift
       type = field_info[:type]
       if is_container? type
         oprot.write_field_begin(@setfield, type, fid)
-        write_container(oprot, @value, field_info)
+        write_container(oprot, @value, field_info, remaining_depth)
         oprot.write_field_end
+      elsif type == Types::STRUCT
+        oprot.write_field(field_info, fid, @value, remaining_depth)
       else
         oprot.write_field(@setfield, type, fid, @value)
       end
@@ -93,7 +103,7 @@ module Thrift
     end
 
     def ==(other)
-      other.equal?(self) || other.instance_of?(self.class) && @setfield == other.get_set_field && @value == other.get_value
+      other.equal?(self) || (other.instance_of?(self.class) && @setfield == other.get_set_field && @value == other.get_value)
     end
     alias_method :eql?, :==
 
@@ -106,7 +116,7 @@ module Thrift
         if field_info[:name].to_sym == @setfield
           @value
         else
-          raise RuntimeError, "#{field_info[:name]} is not union's set field."
+          raise "#{field_info[:name]} is not union's set field."
         end
       end
 
@@ -168,10 +178,10 @@ module Thrift
 
     protected
 
-    def handle_message(iprot, fid, ftype)
+    def handle_message(iprot, fid, ftype, remaining_depth)
       field = struct_fields[fid]
       if field and field[:type] == ftype
-        @value = read_field(iprot, field)
+        @value = read_field(iprot, field, remaining_depth)
         name = field[:name].to_sym
         @setfield = name
       else

data/lib/thrift/uuid.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 #
 # Licensed to the Apache Software Foundation (ASF) under one
 # or more contributor license agreements. See the NOTICE file
@@ -17,32 +18,32 @@
 # under the License.
 #
 
-require 'thrift/protocol/base_protocol'
+require "thrift/protocol/base_protocol"
 
 module Thrift
   module UUID
-    UUID_REGEX = /\A[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\z/.freeze
+    UUID_REGEX = /\A[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\z/
 
     def self.validate_uuid!(uuid)
       unless uuid.is_a?(String)
-        raise ProtocolException.new(ProtocolException::INVALID_DATA, 'UUID must be a string')
+        raise ProtocolException.new(ProtocolException::INVALID_DATA, "UUID must be a string")
       end
 
-      unless uuid =~ UUID_REGEX
-        raise ProtocolException.new(ProtocolException::INVALID_DATA, 'Invalid UUID format')
+      unless UUID_REGEX.match?(uuid)
+        raise ProtocolException.new(ProtocolException::INVALID_DATA, "Invalid UUID format")
       end
     end
 
     def self.uuid_bytes(uuid)
-      [uuid.delete('-')].pack('H*')
+      [uuid.delete("-")].pack("H*")
     end
 
     def self.uuid_from_bytes(bytes)
       unless bytes.bytesize == 16
-        raise ProtocolException.new(ProtocolException::INVALID_DATA, 'Invalid UUID data length')
+        raise ProtocolException.new(ProtocolException::INVALID_DATA, "Invalid UUID data length")
       end
 
-      hex = bytes.unpack('H*').first
+      hex = bytes.unpack1("H*")
       "#{hex[0, 8]}-#{hex[8, 4]}-#{hex[12, 4]}-#{hex[16, 4]}-#{hex[20, 12]}"
     end
   end