Repository navigation
puma: serve TLS - Puma::MiniSSL::Engine on SslStream - #32
Merged
Merged
Conversation
puma's TLS is its C extension's MiniSSL engine, OpenSSL over memory BIOs: puma reads ciphertext off the socket into Engine#inject, takes plaintext from #read, and sends what #extract answers. Src/Libraries/Puma/MiniSsl.cs provides Puma::MiniSSL::Engine, SSLContext and SSLError the same way: a server SslStream over an in-memory stream that #inject fills and #extract drains, with the handshake and the reads running as SslStream's async operations. #read, #write and #extract first wait until SslStream has used up its input, which is where OpenSSL stands when SSL_read returns, so puma's own MiniSSL::Socket drives it unchanged. Puma.ssl? is now true and ssl:// binds serve TLS in single mode. The context takes cert/key files or cert_pem/key_pem, key_password_command, ca with verify_mode none, peer or force_peer (puma.peercert is set), and no_tlsv1/no_tlsv1_1. ssl_cipher_filter, ssl_ciphersuites, verification_flags and reuse are not used. Puma_Tls1 runs puma on three ssl:// binds: Net::HTTP with ca_file and keep-alive, a large POST, pipelined requests, plain HTTP on the TLS port, and client certificates through .NET's SslStream under force_peer.
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 47 minutes. View limit details
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
MiniSSL module and TLS context Src/Libraries/Puma/MiniSsl.cs, Src/Libraries/Puma/PumaHttp11.cs |
Adds the MiniSSL module and SSLContext certificate loading, verification settings, and TLS protocol selection. Makes PumaModule partial. |
TLS engine and buffered I/O Src/Libraries/Puma/MiniSsl.cs |
Adds the server-side SslStream handshake, plaintext and ciphertext operations, shutdown and status queries, and memory BIO queues. |
TLS integration coverage and support description Src/IronRuby.Tests/Runtime/PumaTlsTests.cs, Src/IronRuby.Tests/RubyTests.cs, Docs/net-http-over-tls.md, Src/StdLib/ironruby/puma/puma_http11.rb, Src/StdLib/ruby/gems/4.0.0/specifications/default/puma-8.0.2.gemspec, Util/gen-default-gemspecs.rb |
Adds Puma_Tls1 coverage for TLS binds, HTTP requests, and client certificates. Updates documentation and gem metadata to describe TLS support and its stated limitations. |
Priority:
Estimated code review effort: 4 (Complex) | ~60 minutes
Change: Feature
Sequence Diagram(s)
sequenceDiagram
participant Puma
participant Engine as MiniSSL.Engine
participant MemoryBio
participant SslStream
Puma->>Engine: Inject ciphertext
Engine->>MemoryBio: Queue inbound bytes
SslStream->>MemoryBio: Read inbound bytes
SslStream->>MemoryBio: Queue encrypted output
Puma->>Engine: Extract ciphertext
Possibly related PRs
- Largo/ironruby#28: Adds client-side non-blocking TLS in the same TLS area; this PR adds Puma server-side TLS.
Merge Risk: 
d1e76
-
No actionable TLS issue remains from this review; the change is mergeable after normal checks.
Pre-merge checks: 
-
Check name Status Explanation Resolution Docstring Coverage Docstring coverage is 28.26% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Documentation-only edits and deletions within surv… Write docstrings for the functions missing them to satisfy the coverage threshold. -
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title clearly and concisely identifies the primary change: enabling Puma TLS serving through Puma::MiniSSL::Engine on SslStream. Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage
-
Explanation
Docstring coverage is 28.26% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 46 functions across 7 files. (1 skipped: 1 unsupported.)
Resolution
Write docstrings for the functions missing them to satisfy the coverage threshold.
-
Finishing Touches: 💡 1
-
📝 Generate docstrings: 💡
-
- Commit to this branch
- Create a new PR
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
IronRuby's bundled puma (8.0.2) now serves TLS:
ssl://binds work in single mode. Until nowPuma::MiniSSL::Enginewas undefined, soPuma.ssl?was false and anssl://bind failed with "Puma compiled without SSL support".puma does not use
OpenSSL::SSL::SSLServer. It drives its C extension's MiniSSL engine, which is OpenSSL over memory BIOs: puma reads ciphertext off the socket intoEngine#inject, takes plaintext from#read, encrypts with#writeand sends what#extractreturns.Src/Libraries/Puma/MiniSsl.csprovidesPuma::MiniSSL::Engine,SSLContextandSSLErrorwith the same contract:SslStreamover an in-memory stream.#injectfills its inbound side and#extractdrains its outbound side. The handshake and the reads run as SslStream's async operations, so nothing blocks on the socket, which only puma touches.#read,#writeand#extractfirst wait until SslStream has used up its input and is waiting for more. That is where OpenSSL stands whenSSL_readreturns, so puma's ownMiniSSL::Socketand reactor run unchanged.cert/keyfiles orcert_pem/key_pem,key_password_command, andcawithverify_modenone, peer or force_peer (puma.peercertis set).no_tlsv1andno_tlsv1_1are honoured too.ssl_cipher_filterandssl_ciphersuites(SslStream takes the system's cipher suites),verification_flagsandreuse.Engine.client, which only puma's own tests use, is not implemented.OpenSSL::SSL::SSLServerandSSLSocket#acceptstill raise NotImplementedError. puma does not need them.Also:
Initializers.Generated.csis regenerated (the generator's output, checked identical). Thepuma_http11.rbheader,Docs/net-http-over-tls.mdand puma's default gemspec summary no longer say "no TLS".Tests
Puma_Tls1(Src/IronRuby.Tests/Runtime/PumaTlsTests.cs,[Options(Prism = true)]). It starts puma throughPuma::Launcheron threessl://binds (cert files,cert_pem/key_pemviassl_bind, andforce_peerwith aca) and checks:ca_file:and keep-alive, a 300 KB POST and a 200 KB response;SslStream: the CA-issued one gets in, a self-signed one or none is refused.Verified on Windows / net10.0 / Debug only. The full IronRuby.Tests suite passed there. Linux, macOS, net8.0 and Release were not run locally; CI covers them.
Summary by CodeRabbit