about summary refs log tree commit homepage
path: root/lib/yahns/openssl_client.rb
DateCommit message (Collapse)
2018-08-05use IO#pread if available in Ruby 2.5
In the future, this will allow sharing open files across different clients when serving static files. For now, it saves us one syscall.
2018-08-05openssl_client: do not attempt writes after SystemCallError
Whenever @ssl.write_nonblock fails due to ECONNRESET/EPIPE in Rack::Deflater#each; Rack::Deflater#each will still attempt to write again in the "ensure" statement via Zlib::GzipWriter#close. This causes SSL_write to complain of "bad length" or "bad write retry" errors. Now, re-raise any SystemCallError we caught from previous write_nonblock calls to prevent calls to SSL_write which would trigger such an exception.
2016-08-06openssl_client: avoid undefined SSL_write behavior
Sometimes apps may trigger zero-byte chunks in the response body for whatever reason. We should maintain consistent behavior with the rest of kgio; and Ruby OpenSSL::SSL::SSLSocket should maintain consistent behavior with the core IO class: https://bugs.ruby-lang.org/issues/12660
2016-07-12wbuf_lite: use StringIO instead of TmpIO
This allows us to work transparently with our OpenSSL workaround[*] while allowing us to reuse our non-sendfile compatibility code. Unfortunately, this means we duplicate a lot of code from the normal wbuf code for now; but that should be fairly stable at this point. [*] https://bugs.ruby-lang.org/issues/12085
2016-07-04openssl_client: wrap shutdown for graceful termination
When we call shutdown on bad upstream responses, FD limits, or server termination, we need to ensure the TLS connection is terminated properly by calling SSL_shutdown and avoiding confusion on the client side (or violating TLS specs!).
2016-02-20fix output buffering with SSL_write
The underlying SSL_write called by the OpenSSL socket when we use write_nonblock must get the same arguments after a call returns SSL_ERROR_WANT_READ or SSL_ERROR_WANT_WRITE. Ensure that by always passing a copy of the user-supplied buffer to OpenSSL::SSL::SSLSocket#write_nonblock and retaining our copy of the string internally as @ssl_blocked if we hit EAGAIN on the socket. String#dup is inexpensive in modern Ruby, as copying a non-embedded string is implemented using copy-on-write. We also prefer to use write_nonblock directly instead of using our kgio-dependent sendfile emulation layer to avoid allocating a new string on partial writes. ref: https://bugs.ruby-lang.org/issues/12085 http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-core/73882 http://mid.gmane.org/redmine.issue-12085.20160219020243.4b790a77f1cdd593@ruby-lang.org
2016-01-02copyright updates for 2016
Using the 'update-copyright' script from gnulib[1]: git ls-files | UPDATE_COPYRIGHT_HOLDER='all contributors' \ UPDATE_COPYRIGHT_USE_INTERVALS=2 \ xargs /path/to/gnulib/build-aux/update-copyright We're also switching to 'GPL-3.0+' as recommended by SPDX to be consistent with our gemspec and other metadata (as opposed to the longer but equivalent "GPLv3 or later"). [1] git://git.savannah.gnu.org/gnulib.git
2016-01-02enable frozen_string_literal for Ruby 2.3+
There are likely yet-to-be-discovered bugs in here. Also, keeping explicit #freeze calls for 2.2 users, since most users have not migrated to 2.3, yet.
2015-12-13openssl_client: use `exception: false' for accept_nonblock
Ruby 2.3 will support this feature to reduce allocations for common errors.
2015-05-09ssl: ensure rack.hijack users get "normal" IO methods
We do not want rack.hijack users relying on kgio_* methods since kgio is trying to make itself obsolete (as Ruby itself adopts kgio features). This is a bit wonky since our common case tries to minimize object allocation by only using the Kgio::Socket derived class.
2015-05-09openssl_client: remove shutdown call
OpenSSL::SSL::SSLSocket does not actually respond to a shutdown method, and it would not be safe to call anyways. Merely shutdown at the OS level and let any handling thread clean it up.
2014-12-21openssl_client: ignore SSL_accept errors during negotiotion
Otherwise, we may encounter too much log spam from ordinary shutdown or malicious (or dumb) clients which send us invalid data to an SSL port.
2014-12-02initial cut at OpenSSL support
The current CA model and code quality of OpenSSL have long put me off from supporting TLS; however but efforts such as "Let's Encrypt" and the fallout from Heartbleed give me hope for the future. This implements, as much as possible, a "hands-off" approach to TLS support via OpenSSL. This implementation allows us to shift responsibility away from us to users and upstreams (the Ruby 'openssl' extension maintainers, software packagers, and OpenSSL project itself). This is also perhaps the easiest way for now for us, while being most powerful for users. It requires users to configure their own OpenSSL context object which we'll use as-is. This context object is used as the :ssl_ctx parameter to the "listen" directive in the yahns configuration file: require 'openssl' # we will not do this for the user, even ctx = OpenSSL::SSL::SSLContext.new # user must configure ctx here... listen 443, ssl_ctx: ctx This way, in case we support GnuTLS or other TLS libraries, there'll be less confusion as to what a user is actually using. Note: this feature requires Ruby 2.1 and later for non-kgio {read,write}_nonblock(.. exception: false) support.