ssl: support SSLSocket#connect and #accept with timeout

Add a keyword argument timeout to specify the total time allowed for
the TLS handshake to complete. Inspired by Addrinfo#connect(timeout:)
and TCPSocket.open(connect_timeout:).

Author: rhenium

lib/openssl/ssl.rb

@@ -377,19 +377,39 @@ def sysclose
         end
       end
 
+      private def with_timeout(timeout)
+        # IO#timeout= was added in Ruby 3.2
+        timeout ||= self.timeout if IO.method_defined?(:timeout)
+        if timeout.nil?
+          while true
+            yield
+          end
+        else
+          remaining = timeout
+          start = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+          while remaining >= 0
+            yield remaining
+            now = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+            remaining = timeout - (now - start)
+          end
+        end
+        raise IO_TimeoutError, "user specified timeout for SSL handshake"
+      end
+
       # :call-seq:
-      #    ssl.connect -> self
+      #    ssl.connect(timeout: nil) -> self
       #
       # Initiates an SSL/TLS handshake with a server.
-      def connect
-        while true
+      #
+      # If _timeout_ is specified, and if the handshake does not complete
+      # within _timeout_ seconds, IO::TimeoutError is raised.
+      def connect(timeout: nil)
+        with_timeout(timeout) do |remaining|
           case ret = ssl_connect
           when :wait_readable
-            wait_readable or
-              raise IO_TimeoutError, "Timed out while waiting to become readable!"
+            wait_readable(remaining)
           when :wait_writable
-            wait_writable or
-              raise IO_TimeoutError, "Timed out while waiting to become writable!"
+            wait_writable(remaining)
           else
             return ret
           end
@@ -424,18 +444,19 @@ def connect_nonblock(exception: true)
       end
 
       # :call-seq:
-      #    ssl.accept -> self
+      #    ssl.accept(timeout: nil) -> self
       #
       # Waits for a SSL/TLS client to initiate a handshake.
-      def accept
-        while true
+      #
+      # If _timeout_ is specified, and if the handshake does not complete
+      # within _timeout_ seconds, IO::TimeoutError is raised.
+      def accept(timeout: nil)
+        with_timeout(timeout) do |remaining|
           case ret = ssl_accept
           when :wait_readable
-            wait_readable or
-              raise IO_TimeoutError, "Timed out while waiting to become readable!"
+            wait_readable(remaining)
           when :wait_writable
-            wait_writable or
-              raise IO_TimeoutError, "Timed out while waiting to become writable!"
+            wait_writable(remaining)
           else
             return ret
           end

test/openssl/test_ssl.rb

@@ -186,6 +186,49 @@ def test_connect_accept_nonblock
     end
   end
 
+  def test_connect_timeout
+    timeout_error = defined?(IO::TimeoutError) ? IO::TimeoutError : IOError
+    start = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+    server_proc = proc do |sock|
+      # TLS 1.2 handshake takes 2 RTTs
+      ctx = make_server_context
+      ctx.max_version = OpenSSL::SSL::TLS1_2_VERSION
+      ssl = OpenSSL::SSL::SSLSocket.new(sock, ctx)
+
+      case (sleep 0.1; ssl.accept_nonblock(exception: false))
+      when :wait_readable then ssl.wait_readable
+      when :wait_writable then ssl.wait_writable
+      else break
+      end while true
+      readwrite_loop(ssl)
+    rescue OpenSSL::SSL::SSLError, SystemCallError
+    end
+    start_server_proc(server_proc) do |port|
+      th = []
+      th << Thread.new do
+        sock = TCPSocket.new("127.0.0.1", port)
+        sock.setsockopt(:TCP, :NODELAY, 1)
+        ssl = OpenSSL::SSL::SSLSocket.new(sock)
+        assert_raise(timeout_error) { ssl.connect(timeout: 0.05) }
+        taken = Process.clock_gettime(Process::CLOCK_MONOTONIC) - start
+        assert_operator(taken, :<, 0.2)
+      ensure
+        sock.close
+      end
+      th << Thread.new do
+        sock = TCPSocket.new("127.0.0.1", port)
+        sock.setsockopt(:TCP, :NODELAY, 1)
+        ssl = OpenSSL::SSL::SSLSocket.new(sock)
+        ssl.connect(timeout: 1)
+        taken = Process.clock_gettime(Process::CLOCK_MONOTONIC) - start
+        assert_operator(taken, :>=, 0.2)
+      ensure
+        sock.close
+      end
+      assert_join_threads(th)
+    end
+  end
+
   def test_low_level_socket
     start_server do |port|
       sock = Socket.tcp("127.0.0.1", port)