ssl: support SSLSocket#connect and #accept with timeout - #1098
Open
rhenium wants to merge 9 commits into
Open
Conversation
r8081 originally intended test_pair.rb for testing methods that behave
like IO.
Move tests for #{get,read}byte, #sys{read,write}, #close_write, and
IO.copy_stream from test_ssl.rb to test_pair.rb.
Similarly, move tests for methods that are specific to SSLSocket and
not for IO compatibility to test_ssl.rb.
OpenSSL::SSL::SSLSocket only depends on T_FILE and a small number of methods defined on IO, so the difference between TCPSocket and Socket is not significant for these tests. Test only one of them to reduce the test run time by half. Add a simple client using Socket to test_ssl.rb to keep basic coverage. Also simplify ut_eof.rb to test only one direction, since the direction does not matter after the handshake.
Break it into multiple pieces and simplify:
- Let callers pass a complete SSLContext object instead of a
callback proc ctx_proc to mutate it.
- Add a variant start_server_proc for tests that need finer control,
and remove two callbacks server_proc and accept_proc.
- Remove rescue for IOError, Errno::EBADF, Errno::EINVAL, and
Errno::ENOTSOCK which as far as I can tell should not be possible.
Some tests expect server-side SSLSocket#accept to fail for various reasons. On some systems, closing the underlying socket immediately with IO#close causes the TCP connection to be terminated with RST. Do not close it immediately so that the client can reliably receive the TLS alert. This allows writing more meaningful assertions. Also add a dedicated test case for the rb_sys_fail() path in SSLSocket#connect.
Update more tests to use start_server_proc instead of UNIXSocket.pair. It runs threads with timeout and prevents "rake test" from hanging indefinitely. It also produces better error messages when a test fails.
The blocking methods #connect, #accept, #sysread, and #syswrite can be implemented on top of their *_nonblock counterpart, with hopefully negligible amount of overhead. Also, handle the exception keyword argument of the *_nonblock methods in Ruby as well. This further simplifies the extension code and also avoids a Hash object allocation. This is a preparatory change for the upcoming patch to improve timeout support in SSLSocket. This patch does not intend to introduce any visible behavior change.
Add a keyword argument timeout to specify the total time allowed for the TLS handshake to complete. Inspired by Addrinfo#connect(timeout:) and TCPSocket.open(connect_timeout:).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add a keyword argument
timeoutto specify the total time allowed for the TLS handshake to complete. Inspired byAddrinfo#connect(timeout:)andTCPSocket.open(connect_timeout:).