puma · rodzyn · Sep 23, 2021 · Oct 1, 2021 · Oct 4, 2021 · Oct 4, 2021
diff --git a/lib/puma/binder.rb b/lib/puma/binder.rb
@@ -57,7 +57,6 @@ def initialize(events, conf = Configuration.new)
 
       @envs = {}
       @ios = []
-      localhost_authority
     end
 
     attr_reader :ios
@@ -229,11 +228,6 @@ def parse(binds, logger, log_msg = 'Listening')
 
           params = Util.parse_query uri.query
 
-          # If key and certs are not defined and localhost gem is required.
-          # localhost gem will be used for self signed
-          # Load localhost authority if not loaded.
-          ctx = localhost_authority && localhost_authority_context if params.empty?
-
           ctx ||= MiniSSL::ContextBuilder.new(params, @events).context
 
           if fd = @inherited_fds.delete(str)
@@ -246,9 +240,11 @@ def parse(binds, logger, log_msg = 'Listening')
             ios_len = @ios.length
             io = add_ssl_listener uri.host, uri.port, ctx
 
+            uri_query = params.map { |k, v| "#{k}=#{v}" }.join('&')
+
             @ios[ios_len..-1].each do |i|
               addr = loc_addr_str i
-              logger.log "* #{log_msg} on ssl://#{addr}?#{uri.query}"
+              logger.log "* #{log_msg} on ssl://#{addr}?#{uri_query}"
 "ssl://#{host}:#{port}?cert=#{opts[:cert]}&key=#{opts[:key]}" \ 
   "#{ssl_cipher_filter}&verify_mode=#{verify}#{tls_str}#{ca_additions}#{v_flags}" 
 params = Util.parse_query uri.query 
 "ssl://#{host}:#{port}?cert=#{opts[:cert]}&key=#{opts[:key]}" \ 
   "#{ssl_cipher_filter}&verify_mode=#{verify}#{tls_str}#{ca_additions}#{v_flags}" 
 params = Util.parse_query uri.query 
             end
           end
 
@@ -292,22 +288,6 @@ def parse(binds, logger, log_msg = 'Listening')
       end
     end
 
-    def localhost_authority
-      @localhost_authority ||= Localhost::Authority.fetch if defined?(Localhost::Authority) && !Puma::IS_JRUBY
-    end
-
-    def localhost_authority_context
-      return unless localhost_authority
-
-      key_path, crt_path = if [:key_path, :certificate_path].all? { |m| localhost_authority.respond_to?(m) }
-        [localhost_authority.key_path, localhost_authority.certificate_path]
-      else
-        local_certificates_path = File.expand_path("~/.localhost")
-        [File.join(local_certificates_path, "localhost.key"), File.join(local_certificates_path, "localhost.crt")]
-      end
-      MiniSSL::ContextBuilder.new({ "key" => key_path, "cert" => crt_path }, @events).context
-    end
-
     # Tell the server to listen on host +host+, port +port+.
     # If +optimize_for_latency+ is true (the default) then clients connecting
     # will be optimized for latency over throughput.
@@ -348,7 +328,7 @@ def add_ssl_listener(host, port, ctx,
 
       raise "Puma compiled without SSL support" unless HAS_SSL
       # Puma will try to use local authority context if context is supplied nil
-      ctx ||= localhost_authority_context
+      ctx ||= MiniSSL::ContextBuilder.new({}, @events).context
 
       if host == "localhost"
         loopback_addresses.each do |addr|
@@ -377,7 +357,7 @@ def add_ssl_listener(host, port, ctx,
     def inherit_ssl_listener(fd, ctx)
       raise "Puma compiled without SSL support" unless HAS_SSL
       # Puma will try to use local authority context if context is supplied nil
-      ctx ||= localhost_authority_context
+      ctx ||= MiniSSL::ContextBuilder.new({}, @events).context
 
       s = fd.kind_of?(::TCPServer) ? fd : ::TCPServer.for_fd(fd)
 

diff --git a/lib/puma/dsl.rb b/lib/puma/dsl.rb
@@ -439,6 +439,12 @@ def threads(min, max)
     # Instead of `bind 'ssl://127.0.0.1:9292?key=key_path&cert=cert_path'` you
     # can also use the this method.
     #
+    # When binding on localhost you don't need to specify cert and key - it will assume you are
+    # using localhost gem and will try to load appropriate files for you
+    #
+    # @example
+    #   ssl_bind '127.0.0.1', '9292'
+    #
     # @example
     #   ssl_bind '127.0.0.1', '9292', {
     #     cert: path_to_cert,
@@ -454,7 +460,8 @@ def threads(min, max)
     #     ssl_cipher_list: cipher_list,     # optional
     #     verify_mode: verify_mode          # default 'none'
     #   }
-    def ssl_bind(host, port, opts)
+    #
+    def ssl_bind(host, port, opts = {})
       bind self.class.ssl_bind_str(host, port, opts)
     end
 

diff --git a/lib/puma/minissl/context_builder.rb b/lib/puma/minissl/context_builder.rb
@@ -6,6 +6,21 @@ def initialize(params, events)
         @events = events
       end
 
+      def localhost_authority
+        @localhost_authority ||= Localhost::Authority.fetch if defined?(Localhost::Authority) && !Puma::IS_JRUBY
+      end
+
+      def localhost_authority_context
+        return unless localhost_authority
+
+        key_path, crt_path = if [:key_path, :certificate_path].all? { |m| localhost_authority.respond_to?(m) }
+          [localhost_authority.key_path, localhost_authority.certificate_path]
+        else
+          local_certificates_path = File.expand_path("~/.localhost")
+          [File.join(local_certificates_path, "localhost.key"), File.join(local_certificates_path, "localhost.crt")]
+        end
+      end
+
       def context
         ctx = MiniSSL::Context.new
 
@@ -23,14 +38,22 @@ def context
           ctx.keystore_pass = params['keystore-pass']
           ctx.ssl_cipher_list = params['ssl_cipher_list'] if params['ssl_cipher_list']
         else
-          unless params['key']
-            events.error "Please specify the SSL key via 'key='"
+          if params['key'].nil? || params['key'] == ""
+            if localhost_authority
+              params['key'] = localhost_authority_context[0]
+            else
+              events.error "Please specify the SSL key via 'key='"
+            end
           end
 
           ctx.key = params['key']
 
-          unless params['cert']
-            events.error "Please specify the SSL cert via 'cert='"
+          if params['cert'].nil? || params['cert'] == ""
+            if localhost_authority
+              params['cert'] = localhost_authority_context[1]
+            else
+              events.error "Please specify the SSL cert via 'cert='"
+            end
           end
 
           ctx.cert = params['cert']

diff --git a/test/test_integration_ssl.rb b/test/test_integration_ssl.rb
@@ -15,18 +15,10 @@ class TestIntegrationSSL < TestIntegration
   require "net/http"
   require "openssl"
 
-  def teardown
-    @server.close unless @server.closed?
-    @server = nil
-    super
-  end
-
-  def generate_config(opts = nil)
+  def setup
     @bind_port = UniquePort.call
     @control_tcp_port = UniquePort.call
-
-    config = <<RUBY
-#{opts}
+    @default_config = <<RUBY
 if ::Puma.jruby?
   keystore =  '#{File.expand_path '../examples/puma/keystore.jks', __dir__}'
   keystore_pass = 'jruby_puma'
@@ -54,14 +46,35 @@ def generate_config(opts = nil)
 end
 RUBY
 
+    @localhost_config = <<RUBY
+require 'localhost/authority'
+
+ssl_bind '#{HOST}', '#{@bind_port}'
+
+activate_control_app 'tcp://#{HOST}:#{@control_tcp_port}', { auth_token: '#{TOKEN}' }
+
+app do |env|
+  [200, {}, [env['rack.url_scheme']]]
+end
+RUBY
+
+    super
+  end
+
+  def teardown
+    @server.close unless @server.closed?
+    @server = nil
+    super
+  end
+
+  def generate_config(config)
     config_file = Tempfile.new %w(config .rb)
-    config_file.write config
+    config_file.write(config)
     config_file.close
     config_file.path
   end
 
-  def start_server(opts = nil)
-    cmd = "#{BASE} bin/puma -C #{generate_config opts}"
+  def start_server(cmd)
     @server = IO.popen cmd, 'r'
     wait_for_server_to_boot
     @pid = @server.pid
@@ -81,12 +94,23 @@ def stop_server
 
   def test_ssl_run
     body = nil
-    start_server
+    start_server("#{BASE} bin/puma -C #{generate_config(@default_config)}")
     @http.start do
       req = Net::HTTP::Get.new '/', {}
       @http.request(req) { |resp| body = resp.body }
     end
     assert_equal 'https', body
     stop_server
   end
+
+  def test_ssl_run_with_localhost_authority
+    body = nil
+    start_server("#{BASE} bin/puma -C #{generate_config(@localhost_config)}")
+    @http.start do
+      req = Net::HTTP::Get.new '/', {}
+      @http.request(req) { |resp| body = resp.body }
+    end
+    assert_equal 'https', body
+    stop_server
+  end unless ::Puma::IS_JRUBY
 end if ::Puma::HAS_SSL