thrift 0.24.0 → 0.25.0

data/lib/thrift/transport/ssl_server_socket.rb

@@ -19,7 +19,8 @@
 # under the License.
 #
 
-require 'socket'
+require "io/wait"
+require "socket"
 
 module Thrift
   class SSLServerSocket < ServerSocket
@@ -31,12 +32,71 @@ module Thrift
     attr_accessor :ssl_context
 
     def listen
-      socket = TCPServer.new(@host, @port)
-      @handle = OpenSSL::SSL::SSLServer.new(socket, @ssl_context)
+      tcp_server = TCPServer.new(@host, @port)
+      @handle = OpenSSL::SSL::SSLServer.new(tcp_server, @ssl_context).tap do |server|
+        server.start_immediately = false
+      end
+    end
+
+    def accept
+      return if @handle.nil?
+
+      transport = nil
+      ssl_socket = @handle.accept
+      deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + @client_timeout unless @client_timeout.nil? || @client_timeout == 0
+      ssl_socket.to_io.setsockopt(::Socket::IPPROTO_TCP, ::Socket::TCP_NODELAY, 1)
+      accept_ssl_socket(ssl_socket, deadline)
+
+      transport = Socket.new.tap do |accepted_transport|
+        accepted_transport.timeout = @client_timeout
+        accepted_transport.handle = ssl_socket
+      end
+    ensure
+      # Thread#kill leaves $! nil, but marks the thread as aborting.
+      close_accepted_socket(ssl_socket) if transport.nil? || $! || Thread.current.status == "aborting"
     end
 
     def to_s
-      "ssl(#{super.to_s})"
+      "ssl(#{super})"
+    end
+
+    private
+
+    def accept_ssl_socket(ssl_socket, deadline)
+      return ssl_socket.accept unless deadline
+
+      loop do
+        case ssl_socket.accept_nonblock(exception: false)
+        when ssl_socket
+          return ssl_socket
+        when :wait_readable
+          wait_for_handshake(ssl_socket, :read, deadline)
+        when :wait_writable
+          wait_for_handshake(ssl_socket, :write, deadline)
+        else
+          raise TransportException.new(TransportException::NOT_OPEN, "SSL server socket: Unexpected TLS handshake result")
+        end
+      end
+    end
+
+    def wait_for_handshake(ssl_socket, direction, deadline)
+      remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+      ready = if remaining > 0
+        if direction == :read
+          ssl_socket.to_io.wait_readable(remaining)
+        else
+          ssl_socket.to_io.wait_writable(remaining)
+        end
+      end
+      return if ready
+
+      raise OpenSSL::SSL::SSLError, "SSL server socket: Timed out accepting TLS connection"
+    end
+
+    def close_accepted_socket(ssl_socket)
+      ssl_socket&.close
+    rescue StandardError
+      nil
     end
   end
 end

data/lib/thrift/transport/ssl_socket.rb

@@ -18,23 +18,28 @@
 # specific language governing permissions and limitations
 # under the License.
 
-require 'io/wait'
+require "io/wait"
+require "ipaddr"
 
 module Thrift
   class SSLSocket < Socket
-    def initialize(host = 'localhost', port = 9090, timeout = nil, ssl_context = nil)
+    def initialize(host = "localhost", port = 9090, timeout = nil, ssl_context = nil, server_hostname: host)
       super(host, port, timeout)
       @ssl_context = ssl_context
+      @server_hostname = server_hostname
     end
 
     attr_accessor :ssl_context
+    attr_accessor :server_hostname
 
     def open
       deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + @timeout unless @timeout.nil? || @timeout == 0
       socket = connect_socket(deadline)
 
       begin
-        ssl_socket = OpenSSL::SSL::SSLSocket.new(socket, @ssl_context)
+        ssl_context = configured_ssl_context
+        ssl_socket = OpenSSL::SSL::SSLSocket.new(socket, ssl_context)
+        ssl_socket.hostname = @server_hostname if send_server_hostname?
         ssl_socket.sync_close = true
         @handle = ssl_socket
 
@@ -63,7 +68,7 @@ module Thrift
           @handle.connect
         end
 
-        @handle.post_connection_check(@host)
+        @handle.post_connection_check(server_hostname_for_verification)
         @handle
       rescue TransportException
         close_socket(@handle)
@@ -77,7 +82,29 @@ module Thrift
     end
 
     def to_s
-      "ssl(#{super.to_s})"
+      "ssl(#{super})"
+    end
+
+    private
+
+    def configured_ssl_context
+      @ssl_context ||= OpenSSL::SSL::SSLContext.new.tap do |context|
+        context.verify_mode = OpenSSL::SSL::VERIFY_PEER
+        context.cert_store = OpenSSL::X509::Store.new.tap(&:set_default_paths)
+      end
+    end
+
+    def send_server_hostname?
+      return false if @server_hostname.nil? || @server_hostname.empty?
+
+      IPAddr.new(@server_hostname)
+      false
+    rescue IPAddr::InvalidAddressError
+      true
+    end
+
+    def server_hostname_for_verification
+      @server_hostname.nil? || @server_hostname.empty? ? @host : @server_hostname
     end
   end
 end

data/lib/thrift/transport/unix_server_socket.rb

@@ -19,7 +19,7 @@
 # under the License.
 #
 
-require 'socket'
+require "socket"
 
 module Thrift
   class UNIXServerSocket < BaseServerTransport

data/lib/thrift/transport/unix_socket.rb

@@ -19,7 +19,7 @@
 # under the License.
 #
 
-require 'socket'
+require "socket"
 
 module Thrift
   class UNIXSocket < Socket
@@ -31,11 +31,9 @@ module Thrift
     end
 
     def open
-      begin
-        @handle = ::UNIXSocket.new(@path)
-      rescue StandardError
-        raise TransportException.new(TransportException::NOT_OPEN, "Could not open UNIX socket at #{@path}")
-      end
+      @handle = ::UNIXSocket.new(@path)
+    rescue StandardError
+      raise TransportException.new(TransportException::NOT_OPEN, "Could not open UNIX socket at #{@path}")
     end
 
     def to_s

data/lib/thrift/types.rb

@@ -18,7 +18,7 @@
 # under the License.
 #
 
-require 'set'
+require "set"
 
 module Thrift
   module Types
@@ -48,27 +48,27 @@ module Thrift
   def self.check_type(value, field, name, skip_nil = true)
     return if value.nil? and skip_nil
     klasses = case field[:type]
-              when Types::VOID
-                NilClass
-              when Types::BOOL
-                [TrueClass, FalseClass]
-              when Types::BYTE, Types::I16, Types::I32, Types::I64
-                Integer
-              when Types::DOUBLE
-                Float
-              when Types::STRING
-                String
-              when Types::UUID
-                String
-              when Types::STRUCT
-                [Struct, Union]
-              when Types::MAP
-                Hash
-              when Types::SET
-                Set
-              when Types::LIST
-                Array
-              end
+    when Types::VOID
+      NilClass
+    when Types::BOOL
+      [TrueClass, FalseClass]
+    when Types::BYTE, Types::I16, Types::I32, Types::I64
+      Integer
+    when Types::DOUBLE
+      Float
+    when Types::STRING
+      String
+    when Types::UUID
+      String
+    when Types::STRUCT
+      [Struct, Union]
+    when Types::MAP
+      Hash
+    when Types::SET
+      Set
+    when Types::LIST
+      Array
+    end
     valid = klasses && [*klasses].any? { |klass| klass === value }
     raise TypeError, "Expected #{type_name(field[:type])}, received #{value.class} for field #{name}" unless valid
     # check elements now

data/lib/thrift/union.rb

@@ -18,6 +18,8 @@
 # under the License.
 #
 
+require "thrift/struct_union"
+
 module Thrift
   class Union
     def initialize(name = nil, value = nil)
@@ -54,13 +56,17 @@ module Thrift
       end
     end
 
-    def read(iprot)
+    def read(iprot, remaining_depth = DEFAULT_RECURSION_DEPTH)
+      raise ProtocolException.new(ProtocolException::DEPTH_LIMIT, "Maximum recursion depth exceeded") if remaining_depth <= 0
+      @setfield = nil
+      @value = nil
+
       iprot.read_struct_begin
-      fname, ftype, fid = iprot.read_field_begin
-      handle_message(iprot, fid, ftype)
+      _, ftype, fid = iprot.read_field_begin
+      handle_message(iprot, fid, ftype, remaining_depth)
       iprot.read_field_end
 
-      fname, ftype, fid = iprot.read_field_begin
+      _, ftype, _ = iprot.read_field_begin
       unless (ftype == Types::STOP)
         raise ProtocolException.new(ProtocolException::INVALID_DATA, "Too many fields for union")
       end
@@ -69,11 +75,12 @@ module Thrift
       validate
     end
 
-    def write(oprot)
+    def write(oprot, remaining_depth = DEFAULT_RECURSION_DEPTH)
+      raise ProtocolException.new(ProtocolException::DEPTH_LIMIT, "Maximum recursion depth exceeded") if remaining_depth <= 0
       validate
       oprot.write_struct_begin(self.class.name)
 
-      fid = self.name_to_id(@setfield.to_s)
+      fid = name_to_id(@setfield.to_s)
 
       field_info = struct_fields[fid]
       unless field_info
@@ -83,8 +90,10 @@ module Thrift
       type = field_info[:type]
       if is_container? type
         oprot.write_field_begin(@setfield, type, fid)
-        write_container(oprot, @value, field_info)
+        write_container(oprot, @value, field_info, remaining_depth)
         oprot.write_field_end
+      elsif type == Types::STRUCT
+        oprot.write_field(field_info, fid, @value, remaining_depth)
       else
         oprot.write_field(@setfield, type, fid, @value)
       end
@@ -94,7 +103,7 @@ module Thrift
     end
 
     def ==(other)
-      other.equal?(self) || other.instance_of?(self.class) && @setfield == other.get_set_field && @value == other.get_value
+      other.equal?(self) || (other.instance_of?(self.class) && @setfield == other.get_set_field && @value == other.get_value)
     end
     alias_method :eql?, :==
 
@@ -107,7 +116,7 @@ module Thrift
         if field_info[:name].to_sym == @setfield
           @value
         else
-          raise RuntimeError, "#{field_info[:name]} is not union's set field."
+          raise "#{field_info[:name]} is not union's set field."
         end
       end
 
@@ -169,10 +178,10 @@ module Thrift
 
     protected
 
-    def handle_message(iprot, fid, ftype)
+    def handle_message(iprot, fid, ftype, remaining_depth)
       field = struct_fields[fid]
       if field and field[:type] == ftype
-        @value = read_field(iprot, field)
+        @value = read_field(iprot, field, remaining_depth)
         name = field[:name].to_sym
         @setfield = name
       else

data/lib/thrift/uuid.rb

@@ -18,32 +18,32 @@
 # under the License.
 #
 
-require 'thrift/protocol/base_protocol'
+require "thrift/protocol/base_protocol"
 
 module Thrift
   module UUID
-    UUID_REGEX = /\A[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\z/.freeze
+    UUID_REGEX = /\A[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\z/
 
     def self.validate_uuid!(uuid)
       unless uuid.is_a?(String)
-        raise ProtocolException.new(ProtocolException::INVALID_DATA, 'UUID must be a string')
+        raise ProtocolException.new(ProtocolException::INVALID_DATA, "UUID must be a string")
       end
 
-      unless uuid =~ UUID_REGEX
-        raise ProtocolException.new(ProtocolException::INVALID_DATA, 'Invalid UUID format')
+      unless UUID_REGEX.match?(uuid)
+        raise ProtocolException.new(ProtocolException::INVALID_DATA, "Invalid UUID format")
       end
     end
 
     def self.uuid_bytes(uuid)
-      [uuid.delete('-')].pack('H*')
+      [uuid.delete("-")].pack("H*")
     end
 
     def self.uuid_from_bytes(bytes)
       unless bytes.bytesize == 16
-        raise ProtocolException.new(ProtocolException::INVALID_DATA, 'Invalid UUID data length')
+        raise ProtocolException.new(ProtocolException::INVALID_DATA, "Invalid UUID data length")
       end
 
-      hex = bytes.unpack('H*').first
+      hex = bytes.unpack1("H*")
       "#{hex[0, 8]}-#{hex[8, 4]}-#{hex[12, 4]}-#{hex[16, 4]}-#{hex[20, 12]}"
     end
   end

data/lib/thrift.rb

@@ -23,51 +23,51 @@
 
 $:.unshift File.dirname(__FILE__)
 
-require 'thrift/bytes'
-require 'thrift/exceptions'
-require 'thrift/types'
-require 'thrift/processor'
-require 'thrift/multiplexed_processor'
-require 'thrift/client'
-require 'thrift/struct'
-require 'thrift/union'
-require 'thrift/struct_union'
-require 'thrift/uuid'
+require "thrift/bytes"
+require "thrift/exceptions"
+require "thrift/types"
+require "thrift/processor"
+require "thrift/multiplexed_processor"
+require "thrift/client"
+require "thrift/struct"
+require "thrift/union"
+require "thrift/struct_union"
+require "thrift/uuid"
 
 # serializer
-require 'thrift/serializer/serializer'
-require 'thrift/serializer/deserializer'
+require "thrift/serializer/serializer"
+require "thrift/serializer/deserializer"
 
 # protocol
-require 'thrift/protocol/base_protocol'
-require 'thrift/protocol/binary_protocol'
-require 'thrift/protocol/binary_protocol_accelerated'
-require 'thrift/protocol/compact_protocol'
-require 'thrift/protocol/json_protocol'
-require 'thrift/protocol/multiplexed_protocol'
-require 'thrift/protocol/header_protocol'
+require "thrift/protocol/base_protocol"
+require "thrift/protocol/binary_protocol"
+require "thrift/protocol/binary_protocol_accelerated"
+require "thrift/protocol/compact_protocol"
+require "thrift/protocol/json_protocol"
+require "thrift/protocol/multiplexed_protocol"
+require "thrift/protocol/header_protocol"
 
 # transport
-require 'thrift/transport/base_transport'
-require 'thrift/transport/base_server_transport'
-require 'thrift/transport/socket'
-require 'thrift/transport/ssl_socket'
-require 'thrift/transport/server_socket'
-require 'thrift/transport/ssl_server_socket'
-require 'thrift/transport/unix_socket'
-require 'thrift/transport/unix_server_socket'
-require 'thrift/transport/buffered_transport'
-require 'thrift/transport/framed_transport'
-require 'thrift/transport/header_transport'
-require 'thrift/transport/http_client_transport'
-require 'thrift/transport/io_stream_transport'
-require 'thrift/transport/memory_buffer_transport'
+require "thrift/transport/base_transport"
+require "thrift/transport/base_server_transport"
+require "thrift/transport/socket"
+require "thrift/transport/ssl_socket"
+require "thrift/transport/server_socket"
+require "thrift/transport/ssl_server_socket"
+require "thrift/transport/unix_socket"
+require "thrift/transport/unix_server_socket"
+require "thrift/transport/buffered_transport"
+require "thrift/transport/framed_transport"
+require "thrift/transport/header_transport"
+require "thrift/transport/http_client_transport"
+require "thrift/transport/io_stream_transport"
+require "thrift/transport/memory_buffer_transport"
 
 # server
-require 'thrift/server/base_server'
-require 'thrift/server/nonblocking_server'
-require 'thrift/server/simple_server'
-require 'thrift/server/threaded_server'
-require 'thrift/server/thread_pool_server'
+require "thrift/server/base_server"
+require "thrift/server/nonblocking_server"
+require "thrift/server/simple_server"
+require "thrift/server/threaded_server"
+require "thrift/server/thread_pool_server"
 
-require 'thrift/thrift_native'
+require "thrift/thrift_native"