added parameter to configure incoming connections backlog size

.gitea/workflows/build.yaml

@@ -9,11 +9,6 @@ jobs:
     steps:
       - name: Checkout sources
         uses: actions/checkout@v4
-      - name: Setup Java
-        uses: actions/setup-java@v4
-        with:
-          distribution: graalvm
-          java-version: 21
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@v3
       - name: Execute Gradle build

Dockerfile

@@ -1,2 +0,0 @@
-FROM gitea.woggioni.net/woggioni/gbcs:memcached
-COPY --chown=luser:luser conf/gbcs-memcached.xml /home/luser/.config/gbcs/gbcs.xml

conf/gbcs-memcached.xml

@@ -1,13 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
-<gbcs:server useVirtualThreads="true" xmlns:xs="http://www.w3.org/2001/XMLSchema-instance"
-             xmlns:gbcs="urn:net.woggioni.gbcs"
-             xmlns:gbcs-memcached="urn:net.woggioni.gbcs-memcached"
-             xs:schemaLocation="urn:net.woggioni.gbcs-memcached jpms://net.woggioni.gbcs.memcached/net/woggioni/gbcs/memcached/schema/gbcs-memcached.xsd urn:net.woggioni.gbcs jpms://net.woggioni.gbcs/net/woggioni/gbcs/schema/gbcs.xsd">
-    <bind host="0.0.0.0" port="13080" />
-    <cache xs:type="gbcs-memcached:memcachedCacheType" max-age="P7D" max-size="16777216" compression-mode="zip">
-        <server host="memcached" port="11211"/>
-    </cache>
-    <authentication>
-        <none/>
-    </authentication>
-</gbcs:server>

conf/logback.xml

@@ -1,21 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" ?>
-<!DOCTYPE configuration>
-
-<configuration>
-    <import class="ch.qos.logback.classic.encoder.PatternLayoutEncoder"/>
-    <import class="ch.qos.logback.core.ConsoleAppender"/>
-
-    <appender name="console" class="ConsoleAppender">
-        <target>System.err</target>
-        <encoder class="PatternLayoutEncoder">
-            <pattern>%d [%highlight(%-5level)] \(%thread\) %logger{36} -%kvp- %msg %n</pattern>
-        </encoder>
-    </appender>
-
-    <root level="info">
-        <appender-ref ref="console"/>
-    </root>
-    <logger name="io.netty" level="debug"/>
-    <logger name="com.google.code.yanf4j" level="warn"/>
-    <logger name="net.rubyeye.xmemcached" level="warn"/>
-</configuration>

docker-compose.yml

@@ -1,36 +0,0 @@
-networks:
-  default:
-    external: false
-    ipam:
-      driver: default
-      config:
-        - subnet: 172.118.0.0/16
-          ip_range: 172.118.0.0/16
-          gateway: 172.118.0.254
-services:
-  gbcs:
-    build:
-      context: .
-    container_name: gbcs
-    restart: unless-stopped
-    ports:
-      - "127.0.0.1:8080:13080"
-      - "[::1]:8080:13080"
-    depends_on:
-      memcached:
-        condition: service_started
-    deploy:
-      resources:
-        limits:
-          cpus: "2.00"
-          memory: 256M
-  memcached:
-    image: memcached
-    container_name: memcached
-    restart: unless-stopped
-    command: -I 64m -m 900m
-    deploy:
-      resources:
-        limits:
-          cpus: "1.00"
-          memory: 1G

docker/Dockerfile

@@ -1,6 +1,4 @@
-FROM alpine:latest AS base-release
+FROM eclipse-temurin:21-jre-alpine AS base-release
-RUN --mount=type=cache,target=/var/cache/apk apk update
-RUN --mount=type=cache,target=/var/cache/apk apk add openjdk21-jre
 RUN adduser -D luser
 USER luser
 WORKDIR /home/luser

gbcs-api/src/main/java/net/woggioni/gbcs/api/Configuration.java

@@ -21,6 +21,8 @@ public class Configuration {
     Authentication authentication;
     Tls tls;
     boolean useVirtualThread;
+    int maxRequestSize;
+    int incomingConnectionsBacklogSize;
 
     @Value
     public static class Group {
@@ -107,7 +109,9 @@ public class Configuration {
             Cache cache,
             Authentication authentication,
             Tls tls,
-            boolean useVirtualThread
+            boolean useVirtualThread,
+            int maxRequestSize,
+            int incomingConnectionsBacklogSize
     ) {
         return new Configuration(
                 host,
@@ -118,7 +122,9 @@ public class Configuration {
                 cache,
                 authentication,
                 tls,
-                useVirtualThread
+                useVirtualThread,
+                maxRequestSize,
+                incomingConnectionsBacklogSize
         );
     }
 }

gbcs-server/src/main/kotlin/net/woggioni/gbcs/server/GradleBuildCacheServer.kt

@@ -7,6 +7,7 @@ import io.netty.channel.Channel
 import io.netty.channel.ChannelDuplexHandler
 import io.netty.channel.ChannelFuture
 import io.netty.channel.ChannelFutureListener
+import io.netty.channel.ChannelHandler.Sharable
 import io.netty.channel.ChannelHandlerContext
 import io.netty.channel.ChannelInitializer
 import io.netty.channel.ChannelOption
@@ -36,6 +37,7 @@ import io.netty.handler.codec.http.LastHttpContent
 import io.netty.handler.ssl.ClientAuth
 import io.netty.handler.ssl.SslContext
 import io.netty.handler.ssl.SslContextBuilder
+import io.netty.handler.ssl.SslHandler
 import io.netty.handler.stream.ChunkedNioFile
 import io.netty.handler.stream.ChunkedNioStream
 import io.netty.handler.stream.ChunkedWriteHandler
@@ -44,17 +46,18 @@ import io.netty.util.concurrent.EventExecutorGroup
 import net.woggioni.gbcs.api.Cache
 import net.woggioni.gbcs.api.Configuration
 import net.woggioni.gbcs.api.Role
+import net.woggioni.gbcs.api.exception.ConfigurationException
 import net.woggioni.gbcs.api.exception.ContentTooLargeException
-import net.woggioni.gbcs.server.auth.AbstractNettyHttpAuthenticator
-import net.woggioni.gbcs.server.auth.Authorizer
-import net.woggioni.gbcs.server.auth.ClientCertificateValidator
-import net.woggioni.gbcs.server.auth.RoleAuthorizer
 import net.woggioni.gbcs.common.GBCS.toUrl
 import net.woggioni.gbcs.common.PasswordSecurity.decodePasswordHash
 import net.woggioni.gbcs.common.PasswordSecurity.hashPassword
 import net.woggioni.gbcs.common.Xml
 import net.woggioni.gbcs.common.contextLogger
 import net.woggioni.gbcs.common.info
+import net.woggioni.gbcs.server.auth.AbstractNettyHttpAuthenticator
+import net.woggioni.gbcs.server.auth.Authorizer
+import net.woggioni.gbcs.server.auth.ClientCertificateValidator
+import net.woggioni.gbcs.server.auth.RoleAuthorizer
 import net.woggioni.gbcs.server.configuration.Parser
 import net.woggioni.gbcs.server.configuration.Serializer
 import net.woggioni.jwo.JWO
@@ -72,11 +75,28 @@ import java.util.Base64
 import java.util.regex.Matcher
 import java.util.regex.Pattern
 import javax.naming.ldap.LdapName
-import javax.net.ssl.SSLEngine
 import javax.net.ssl.SSLPeerUnverifiedException
 
 
 class GradleBuildCacheServer(private val cfg: Configuration) {
+    private val log = contextLogger()
+
+    companion object {
+
+        val DEFAULT_CONFIGURATION_URL by lazy { "classpath:net/woggioni/gbcs/gbcs-default.xml".toUrl() }
+        private const val SSL_HANDLER_NAME = "sslHandler"
+
+        fun loadConfiguration(configurationFile: Path): Configuration {
+            val doc = Files.newInputStream(configurationFile).use {
+                Xml.parseXml(configurationFile.toUri().toURL(), it)
+            }
+            return Parser.parse(doc)
+        }
+
+        fun dumpConfiguration(conf: Configuration, outputStream: OutputStream) {
+            Xml.write(Serializer.serialize(conf), outputStream)
+        }
+    }
 
     private class HttpChunkContentCompressor(
         threshold: Int,
@@ -99,20 +119,19 @@ class GradleBuildCacheServer(private val cfg: Configuration) {
         }
     }
 
+    @Sharable
     private class ClientCertificateAuthenticator(
         authorizer: Authorizer,
-        private val sslEngine: SSLEngine,
         private val anonymousUserRoles: Set<Role>?,
         private val userExtractor: Configuration.UserExtractor?,
         private val groupExtractor: Configuration.GroupExtractor?,
     ) : AbstractNettyHttpAuthenticator(authorizer) {
 
-        companion object {
-            private val log = contextLogger()
-        }
-
         override fun authenticate(ctx: ChannelHandlerContext, req: HttpRequest): Set<Role>? {
             return try {
+                val sslHandler = (ctx.pipeline().get(SSL_HANDLER_NAME) as? SslHandler)
+                    ?: throw ConfigurationException("Client certificate authentication cannot be used when TLS is disabled")
+                val sslEngine = sslHandler.engine()
                 sslEngine.session.peerCertificates.takeIf {
                     it.isNotEmpty()
                 }?.let { peerCertificates ->
@@ -127,13 +146,11 @@ class GradleBuildCacheServer(private val cfg: Configuration) {
         }
     }
 
+    @Sharable
     private class NettyHttpBasicAuthenticator(
         private val users: Map<String, Configuration.User>, authorizer: Authorizer
     ) : AbstractNettyHttpAuthenticator(authorizer) {
-
+        private val log = contextLogger()
-        companion object {
-            private val log = contextLogger()
-        }
 
         override fun authenticate(ctx: ChannelHandlerContext, req: HttpRequest): Set<Role>? {
             val authorizationHeader = req.headers()[HttpHeaderNames.AUTHORIZATION] ?: let {
@@ -183,6 +200,28 @@ class GradleBuildCacheServer(private val cfg: Configuration) {
         private val eventExecutorGroup: EventExecutorGroup
     ) : ChannelInitializer<Channel>() {
 
+        private val serverHandler = let {
+            val cacheImplementation = cfg.cache.materialize()
+            val prefix = Path.of("/").resolve(Path.of(cfg.serverPath ?: "/"))
+            ServerHandler(cacheImplementation, prefix)
+        }
+
+        private val exceptionHandler = ExceptionHandler()
+
+        private val authenticator = when (val auth = cfg.authentication) {
+            is Configuration.BasicAuthentication -> NettyHttpBasicAuthenticator(cfg.users, RoleAuthorizer())
+            is Configuration.ClientCertificateAuthentication -> {
+                ClientCertificateAuthenticator(
+                    RoleAuthorizer(),
+                    cfg.users[""]?.roles,
+                    userExtractor(auth),
+                    groupExtractor(auth)
+                )
+            }
+
+            else -> null
+        }
+
         companion object {
             private fun createSslCtx(tls: Configuration.Tls): SslContext {
                 val keyStore = tls.keyStore
@@ -265,39 +304,22 @@ class GradleBuildCacheServer(private val cfg: Configuration) {
 
         override fun initChannel(ch: Channel) {
             val pipeline = ch.pipeline()
-            val auth = cfg.authentication
+            sslContext?.newHandler(ch.alloc())?.also {
-            var authenticator: AbstractNettyHttpAuthenticator? = null
+                pipeline.addLast(SSL_HANDLER_NAME, it)
-            if (auth is Configuration.BasicAuthentication) {
-                authenticator = (NettyHttpBasicAuthenticator(cfg.users, RoleAuthorizer()))
-            }
-            if (sslContext != null) {
-                val sslHandler = sslContext.newHandler(ch.alloc())
-                pipeline.addLast(sslHandler)
-
-                if (auth is Configuration.ClientCertificateAuthentication) {
-                    authenticator = ClientCertificateAuthenticator(
-                        RoleAuthorizer(),
-                        sslHandler.engine(),
-                        cfg.users[""]?.roles,
-                        userExtractor(auth),
-                        groupExtractor(auth)
-                    )
-                }
             }
             pipeline.addLast(HttpServerCodec())
             pipeline.addLast(HttpChunkContentCompressor(1024))
             pipeline.addLast(ChunkedWriteHandler())
-            pipeline.addLast(HttpObjectAggregator(Int.MAX_VALUE))
+            pipeline.addLast(HttpObjectAggregator(cfg.maxRequestSize))
             authenticator?.let {
                 pipeline.addLast(it)
             }
-            val cacheImplementation = cfg.cache.materialize()
+            pipeline.addLast(eventExecutorGroup, serverHandler)
-            val prefix = Path.of("/").resolve(Path.of(cfg.serverPath ?: "/"))
+            pipeline.addLast(exceptionHandler)
-            pipeline.addLast(eventExecutorGroup, ServerHandler(cacheImplementation, prefix))
-            pipeline.addLast(ExceptionHandler())
         }
     }
 
+    @Sharable
     private class ExceptionHandler : ChannelDuplexHandler() {
         private val log = contextLogger()
 
@@ -338,12 +360,11 @@ class GradleBuildCacheServer(private val cfg: Configuration) {
         }
     }
 
+    @Sharable
     private class ServerHandler(private val cache: Cache, private val serverPrefix: Path) :
         SimpleChannelInboundHandler<FullHttpRequest>() {
 
-        companion object {
+        private val log = contextLogger()
-            private val log = contextLogger()
-        }
 
         override fun channelRead0(ctx: ChannelHandlerContext, msg: FullHttpRequest) {
             val keepAlive: Boolean = HttpUtil.isKeepAlive(msg)
@@ -448,8 +469,8 @@ class GradleBuildCacheServer(private val cfg: Configuration) {
         private val executorGroups: Iterable<EventExecutorGroup>
     ) : AutoCloseable {
         private val httpChannel: Channel = httpChannelFuture.channel()
-
         private val closeFuture: ChannelFuture = httpChannel.closeFuture()
+        private val log = contextLogger()
 
         fun shutdown(): ChannelFuture {
             return httpChannel.close()
@@ -488,7 +509,7 @@ class GradleBuildCacheServer(private val cfg: Configuration) {
             group(bossGroup, workerGroup)
             channel(serverSocketChannel)
             childHandler(ServerInitializer(cfg, eventExecutorGroup))
-            option(ChannelOption.SO_BACKLOG, 128)
+            option(ChannelOption.SO_BACKLOG, cfg.incomingConnectionsBacklogSize)
             childOption(ChannelOption.SO_KEEPALIVE, true)
         }
 
@@ -501,22 +522,4 @@ class GradleBuildCacheServer(private val cfg: Configuration) {
         }
         return ServerHandle(httpChannel, setOf(bossGroup, workerGroup, eventExecutorGroup))
     }
-
-    companion object {
-
-        val DEFAULT_CONFIGURATION_URL by lazy { "classpath:net/woggioni/gbcs/gbcs-default.xml".toUrl() }
-
-        fun loadConfiguration(configurationFile: Path): Configuration {
-            val doc = Files.newInputStream(configurationFile).use {
-                Xml.parseXml(configurationFile.toUri().toURL(), it)
-            }
-            return Parser.parse(doc)
-        }
-
-        fun dumpConfiguration(conf: Configuration, outputStream: OutputStream) {
-            Xml.write(Serializer.serialize(conf), outputStream)
-        }
-
-        private val log = contextLogger()
-    }
 }

gbcs-server/src/main/kotlin/net/woggioni/gbcs/server/configuration/Parser.kt

@@ -31,8 +31,12 @@ object Parser {
         var groups = emptyMap<String, Group>()
         var tls: Tls? = null
         val serverPath = root.renderAttribute("path")
-        val useVirtualThread = root.renderAttribute("useVirtualThreads")
+        val useVirtualThread = root.renderAttribute("use-virtual-threads")
             ?.let(String::toBoolean) ?: true
+        val maxRequestSize = root.renderAttribute("max-request-size")
+            ?.let(String::toInt) ?: 67108864
+        val incomingConnectionsBacklogSize = root.renderAttribute("incoming-connections-backlog-size")
+            ?.let(String::toInt) ?: 1024
         var authentication: Authentication? = null
         for (child in root.asIterable()) {
             val tagName = child.localName
@@ -136,7 +140,19 @@ object Parser {
                 }
             }
         }
-        return Configuration(host, port, serverPath, users, groups, cache!!, authentication, tls, useVirtualThread)
+        return Configuration(
+            host,
+            port,
+            serverPath,
+            users,
+            groups,
+            cache!!,
+            authentication,
+            tls,
+            useVirtualThread,
+            maxRequestSize,
+            incomingConnectionsBacklogSize
+        )
     }
 
     private fun parseRoles(root: Element) = root.asIterable().asSequence().map {

gbcs-server/src/main/kotlin/net/woggioni/gbcs/server/configuration/Serializer.kt

@@ -14,7 +14,10 @@ object Serializer {
             it.xmlNamespace to it.xmlSchemaLocation
         }.toMap()
         return Xml.of(GBCS.GBCS_NAMESPACE_URI, GBCS.GBCS_PREFIX + ":server") {
-            attr("useVirtualThreads", conf.isUseVirtualThread.toString())
+            attr("use-virtual-threads", conf.isUseVirtualThread.toString())
+            attr("max-request-size", conf.maxRequestSize.toString())
+            attr("incoming-connections-backlog-size", conf.incomingConnectionsBacklogSize.toString())
+
 //            attr("xmlns:xs", GradleBuildCacheServer.XML_SCHEMA_NAMESPACE_URI)
             val value = schemaLocations.asSequence().map { (k, v) -> "$k $v" }.joinToString(" ")
             attr("xs:schemaLocation", value , namespaceURI = GBCS.XML_SCHEMA_NAMESPACE_URI)

gbcs-server/src/main/resources/net/woggioni/gbcs/server/gbcs-default.xml

@@ -1,5 +1,8 @@
 <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
-<gbcs:server useVirtualThreads="false" xmlns:xs="http://www.w3.org/2001/XMLSchema-instance"
+<gbcs:server use-virtual-threads="false"
+             max-request-size="67108864"
+             incoming-connections-backlog-size="1024"
+             xmlns:xs="http://www.w3.org/2001/XMLSchema-instance"
              xmlns:gbcs="urn:net.woggioni.gbcs.server"
              xs:schemaLocation="urn:net.woggioni.gbcs.server jpms://net.woggioni.gbcs.server/net/woggioni/gbcs/server/schema/gbcs.xsd">
     <bind host="127.0.0.1" port="8080"/>

gbcs-server/src/main/resources/net/woggioni/gbcs/server/schema/gbcs.xsd

@@ -23,7 +23,9 @@
             <xs:element name="tls" type="gbcs:tlsType" minOccurs="0" maxOccurs="1"/>
         </xs:sequence>
         <xs:attribute name="path" type="xs:string" use="optional"/>
-        <xs:attribute name="useVirtualThreads" type="xs:boolean" use="optional" default="true"/>
+        <xs:attribute name="use-virtual-threads" type="xs:boolean" use="optional" default="true"/>
+        <xs:attribute name="max-request-size" type="xs:unsignedInt" use="optional" default="67108864"/>
+        <xs:attribute name="incoming-connections-backlog-size" type="xs:unsignedInt" use="optional" default="1024"/>
     </xs:complexType>
 
     <xs:complexType name="bindType">

gbcs-server/src/test/kotlin/net/woggioni/gbcs/server/test/AbstractBasicAuthServerTest.kt

@@ -45,6 +45,8 @@ abstract class AbstractBasicAuthServerTest : AbstractServerTest() {
             Configuration.BasicAuthentication(),
             null,
             true,
+            0x10000,
+            100
         )
         Xml.write(Serializer.serialize(cfg), System.out)
     }

gbcs-server/src/test/kotlin/net/woggioni/gbcs/server/test/AbstractTlsServerTest.kt

@@ -157,6 +157,8 @@ abstract class AbstractTlsServerTest : AbstractServerTest() {
                 true
             ),
             false,
+            0x10000,
+            100
         )
         Xml.write(Serializer.serialize(cfg), System.out)
     }

gbcs-server/src/test/kotlin/net/woggioni/gbcs/server/test/NoAuthServerTest.kt

@@ -46,6 +46,8 @@ class NoAuthServerTest : AbstractServerTest() {
             null,
             null,
             true,
+            0x10000,
+            100
         )
         Xml.write(Serializer.serialize(cfg), System.out)
     }

gbcs-server/src/test/resources/net/woggioni/gbcs/server/test/gbcs-default.xml

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
-<gbcs:server useVirtualThreads="false" xmlns:xs="http://www.w3.org/2001/XMLSchema-instance"
+<gbcs:server use-virtual-threads="false" xmlns:xs="http://www.w3.org/2001/XMLSchema-instance"
              xmlns:gbcs="urn:net.woggioni.gbcs.server"
              xs:schemaLocation="urn:net.woggioni.gbcs.server jpms://net.woggioni.gbcs.server/net/woggioni/gbcs/server/schema/gbcs.xsd">
     <bind host="127.0.0.1" port="11443"/>

gbcs-server/src/test/resources/net/woggioni/gbcs/server/test/gbcs-memcached.xml

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
-<gbcs:server useVirtualThreads="false" xmlns:xs="http://www.w3.org/2001/XMLSchema-instance"
+<gbcs:server use-virtual-threads="false" xmlns:xs="http://www.w3.org/2001/XMLSchema-instance"
              xmlns:gbcs="urn:net.woggioni.gbcs.server"
              xmlns:gbcs-memcached="urn:net.woggioni.gbcs.server.memcached"
              xs:schemaLocation="urn:net.woggioni.gbcs.server.memcached jpms://net.woggioni.gbcs.server.memcached/net/woggioni/gbcs/server/memcached/schema/gbcs-memcached.xsd urn:net.woggioni.gbcs.server jpms://net.woggioni.gbcs.server/net/woggioni/gbcs/server/schema/gbcs.xsd">

gbcs-server/src/test/resources/net/woggioni/gbcs/server/test/gbcs-tls.xml

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
-<gbcs:server useVirtualThreads="false" xmlns:xs="http://www.w3.org/2001/XMLSchema-instance"
+<gbcs:server use-virtual-threads="false" max-request-size="4096" xmlns:xs="http://www.w3.org/2001/XMLSchema-instance"
              xmlns:gbcs="urn:net.woggioni.gbcs.server"
              xs:schemaLocation="urn:net.woggioni.gbcs.server jpms://net.woggioni.gbcs.server/net/woggioni/gbcs/server/schema/gbcs.xsd">
     <bind host="127.0.0.1" port="11443"/>