curb 1.3.7 → 1.4.1

data/ext/curb_multi.h

@@ -17,16 +17,24 @@ typedef struct {
   int running;
   char closed;
   char perform_active;
+  VALUE perform_thread; /* Owner while a drive loop may release the GVL. */
   char callback_active;
   char allow_close_during_perform;
   CURLM *handle;
   struct st_table *attached;
+  /* Bumped on every add and stamped onto the easy (multi_attachment_generation),
+   * so "attached after point X" is a comparison instead of a table snapshot.
+   * Monotonic for the object's lifetime; never reset. */
+  unsigned long attachment_sequence;
 } ruby_curl_multi;
 
 extern VALUE cCurlMulti;
 extern const rb_data_type_t ruby_curl_multi_data_type;
 
 void init_curb_multi();
+int rb_curl_multi_easy_performing(void *rbce_ptr);
+void rb_curl_multi_check_easy_thread(void *rbce_ptr);
+void rb_curl_multi_remove_request_reference(VALUE self, VALUE easy);
 void rb_curl_multi_forget_easy(ruby_curl_multi *rbcm, void *rbce_ptr);
 CURLMcode rb_curl_multi_detach_easy(ruby_curl_multi *rbcm, void *rbce_ptr);
 

data/ext/curb_postfield.c

@@ -20,128 +20,117 @@ VALUE cCurlPostField;
 
 /* ================= APPEND FORM FUNC ================ */
 
-/* This gets called by the post method on Curl::Easy for each postfield
- * supplied in the arguments. It's job is to add the supplied field to
- * the list that's being built for a perform.
- * 
- * THIS FUNC MODIFIES ITS ARGUMENTS. See curl_formadd(3) for details.
- */
-void append_to_form(VALUE self, 
-                    struct curl_httppost **first, 
-                    struct curl_httppost **last) {                               
+/* Snapshot before invoking further Ruby coercions. Native storage is private
+ * to this request and cannot move under GC or require VM-global GC roots. */
+static ruby_curl_form_string *form_string_snapshot(VALUE value, ruby_curl_form_string **strings) {
+  ruby_curl_form_string *entry;
+  long length;
+  StringValue(value);
+  length = RSTRING_LEN(value);
+  /* One allocation for the list entry, payload and terminating NUL. */
+  entry = ruby_xmalloc(sizeof(*entry) + (size_t)length + 1);
+  entry->data = (char *)(entry + 1);
+  entry->length = length;
+  memcpy(entry->data, RSTRING_PTR(value), (size_t)length);
+  entry->data[length] = '\0';
+  entry->next = *strings;
+  *strings = entry;
+  RB_GC_GUARD(value);
+  return entry;
+}
+
+static void free_form_strings_until(ruby_curl_form_string **strings,
+                                    ruby_curl_form_string *stop) {
+  while (*strings != stop) {
+    ruby_curl_form_string *next = (*strings)->next;
+    xfree(*strings);
+    *strings = next;
+  }
+}
+
+void free_form_strings(ruby_curl_form_string *strings) {
+  free_form_strings_until(&strings, NULL);
+}
+
+void append_to_form(VALUE self,
+                    struct curl_httppost **first,
+                    struct curl_httppost **last,
+                    ruby_curl_form_string **strings) {
   ruby_curl_postfield *rbcpf;
   CURLFORMcode result = -1;
-  
+  ruby_curl_form_string *name, *content = NULL, *remote = NULL, *local = NULL, *type = NULL;
+  ruby_curl_form_string *previous_strings = *strings;
+  int is_file;
+  struct curl_forms form[8];
+  int n = 0;
+
   TypedData_Get_Struct(self, ruby_curl_postfield, &ruby_curl_postfield_data_type, rbcpf);
-  
-  if (rbcpf->name == Qnil) {
+  if (NIL_P(rbcpf->name)) {
     rb_raise(eCurlErrInvalidPostField, "Cannot post unnamed field");
-  } else {
-    if ((rbcpf->local_file != Qnil) || (rbcpf->remote_file != Qnil)) {
-      // is a file upload field
-      if (rbcpf->content_proc != Qnil) {
-        // with content proc
-        rbcpf->buffer_str = rb_funcall(rbcpf->content_proc, idCall, 1, self);
-        
-        if (rbcpf->remote_file == Qnil) {
-          rb_raise(eCurlErrInvalidPostField, "Cannot post file upload field with no filename");
-        } else {
-          if (rbcpf->content_type == Qnil) {
-            result = curl_formadd(first, last, CURLFORM_PTRNAME, StringValuePtr(rbcpf->name), 
-                                               CURLFORM_BUFFER, StringValuePtr(rbcpf->remote_file),
-                                               CURLFORM_BUFFERPTR, StringValuePtr(rbcpf->buffer_str),
-                                               CURLFORM_BUFFERLENGTH, RSTRING_LEN(rbcpf->buffer_str),
-                                               CURLFORM_END);
-          } else {
-            result = curl_formadd(first, last, CURLFORM_PTRNAME, StringValuePtr(rbcpf->name), 
-                                               CURLFORM_BUFFER, StringValuePtr(rbcpf->remote_file),
-                                               CURLFORM_BUFFERPTR, StringValuePtr(rbcpf->buffer_str),
-                                               CURLFORM_BUFFERLENGTH, RSTRING_LEN(rbcpf->buffer_str),
-                                               CURLFORM_CONTENTTYPE, StringValuePtr(rbcpf->content_type),
-                                               CURLFORM_END);
-          }
-        }
-      } else if (rbcpf->content != Qnil) {
-        // with content
-        if (rbcpf->remote_file == Qnil) {
-          rb_raise(eCurlErrInvalidPostField, "Cannot post file upload field with no filename");
-        } else {
-          if (rbcpf->content_type == Qnil) {
-            result = curl_formadd(first, last, CURLFORM_PTRNAME, StringValuePtr(rbcpf->name), 
-                                               CURLFORM_BUFFER, StringValuePtr(rbcpf->remote_file),
-                                               CURLFORM_BUFFERPTR, StringValuePtr(rbcpf->content),
-                                               CURLFORM_BUFFERLENGTH, RSTRING_LEN(rbcpf->content),
-                                               CURLFORM_END);
-          } else {
-            result = curl_formadd(first, last, CURLFORM_PTRNAME, StringValuePtr(rbcpf->name), 
-                                               CURLFORM_BUFFER, StringValuePtr(rbcpf->remote_file),
-                                               CURLFORM_BUFFERPTR, StringValuePtr(rbcpf->content),
-                                               CURLFORM_BUFFERLENGTH, RSTRING_LEN(rbcpf->content),
-                                               CURLFORM_CONTENTTYPE, StringValuePtr(rbcpf->content_type),
-                                               CURLFORM_END);
-          }
-        }
-      } else if (rbcpf->local_file != Qnil) {
-        // with local filename
-        if (rbcpf->local_file == Qnil) {
-          rb_raise(eCurlErrInvalidPostField, "Cannot post file upload field no filename");
-        } else {
-          if (rbcpf->remote_file == Qnil) {
-            rbcpf->remote_file = rbcpf->local_file;
-          }
-          
-          if (rbcpf->content_type == Qnil) {
-            result = curl_formadd(first, last, CURLFORM_PTRNAME, StringValuePtr(rbcpf->name), 
-                                               CURLFORM_FILE, StringValuePtr(rbcpf->local_file),
-                                               CURLFORM_FILENAME, StringValuePtr(rbcpf->remote_file),
-                                               CURLFORM_END);
-          } else {
-            result = curl_formadd(first, last, CURLFORM_PTRNAME, StringValuePtr(rbcpf->name), 
-                                               CURLFORM_FILE, StringValuePtr(rbcpf->local_file),
-                                               CURLFORM_FILENAME, StringValuePtr(rbcpf->remote_file),
-                                               CURLFORM_CONTENTTYPE, StringValuePtr(rbcpf->content_type),
-                                               CURLFORM_END);
-          }            
-        }
-      } else {
-        rb_raise(eCurlErrInvalidPostField, "Cannot post file upload field with no data");
+  }
+  is_file = !NIL_P(rbcpf->local_file) || !NIL_P(rbcpf->remote_file);
+  if (!NIL_P(rbcpf->content_proc)) {
+    rbcpf->buffer_str = rb_funcall(rbcpf->content_proc, idCall, 1, self);
+    StringValue(rbcpf->buffer_str);
+    content = form_string_snapshot(rbcpf->buffer_str, strings);
+  } else if (!NIL_P(rbcpf->content)) {
+    StringValue(rbcpf->content);
+    content = form_string_snapshot(rbcpf->content, strings);
+  }
+
+  name = form_string_snapshot(rbcpf->name, strings);
+  if (is_file) {
+    if (content != NULL) {
+      if (NIL_P(rbcpf->remote_file)) {
+        rb_raise(eCurlErrInvalidPostField, "Cannot post file upload field with no filename");
       }
+    } else if (!NIL_P(rbcpf->local_file)) {
+      local = form_string_snapshot(rbcpf->local_file, strings);
+      if (NIL_P(rbcpf->remote_file)) rbcpf->remote_file = rbcpf->local_file;
     } else {
-      // is a content field
-      if (rbcpf->content_proc != Qnil) {
-        rbcpf->buffer_str = rb_funcall(rbcpf->content_proc, idCall, 1, self);
-        
-        if (rbcpf->content_type == Qnil) {
-          result = curl_formadd(first, last, CURLFORM_PTRNAME, StringValuePtr(rbcpf->name), 
-                                             CURLFORM_PTRCONTENTS, StringValuePtr(rbcpf->buffer_str),
-                                             CURLFORM_CONTENTSLENGTH, RSTRING_LEN(rbcpf->buffer_str),
-                                             CURLFORM_END);
-        } else {
-          result = curl_formadd(first, last, CURLFORM_PTRNAME, StringValuePtr(rbcpf->name), 
-                                             CURLFORM_PTRCONTENTS, StringValuePtr(rbcpf->buffer_str),
-                                             CURLFORM_CONTENTSLENGTH, RSTRING_LEN(rbcpf->buffer_str),
-                                             CURLFORM_CONTENTTYPE, StringValuePtr(rbcpf->content_type),
-                                             CURLFORM_END);
-        }
-      } else if (rbcpf->content != Qnil) {
-        if (rbcpf->content_type == Qnil) {
-          result = curl_formadd(first, last, CURLFORM_PTRNAME, StringValuePtr(rbcpf->name), 
-                                             CURLFORM_PTRCONTENTS, StringValuePtr(rbcpf->content),
-                                             CURLFORM_CONTENTSLENGTH, RSTRING_LEN(rbcpf->content),
-                                             CURLFORM_END);
-        } else {
-          result = curl_formadd(first, last, CURLFORM_PTRNAME, StringValuePtr(rbcpf->name), 
-                                             CURLFORM_PTRCONTENTS, StringValuePtr(rbcpf->content),
-                                             CURLFORM_CONTENTSLENGTH, RSTRING_LEN(rbcpf->content),
-                                             CURLFORM_CONTENTTYPE, StringValuePtr(rbcpf->content_type),
-                                             CURLFORM_END);
-        }
-      } else {
-        rb_raise(eCurlErrInvalidPostField, "Cannot post content field with no data");
-      }
+      rb_raise(eCurlErrInvalidPostField, "Cannot post file upload field with no data");
     }
+    remote = form_string_snapshot(rbcpf->remote_file, strings);
+  } else if (content == NULL) {
+    rb_raise(eCurlErrInvalidPostField, "Cannot post content field with no data");
   }
-  
+  if (!NIL_P(rbcpf->content_type)) {
+    type = form_string_snapshot(rbcpf->content_type, strings);
+  }
+
+  /* libcurl copies metadata but borrows the private payload for the request.
+   * This avoids a second form-owned copy of ordinary field contents. */
+  form[n].option = CURLFORM_COPYNAME;
+  form[n++].value = name->data;
+  if (is_file) {
+    form[n].option = content == NULL ? CURLFORM_FILE : CURLFORM_BUFFER;
+    form[n++].value = (content == NULL ? local : remote)->data;
+    if (content == NULL) {
+      form[n].option = CURLFORM_FILENAME;
+      form[n++].value = remote->data;
+    }
+  }
+  if (type != NULL) {
+    form[n].option = CURLFORM_CONTENTTYPE;
+    form[n++].value = type->data;
+  }
+  form[n].option = CURLFORM_END;
+  form[n].value = NULL;
+
+  if (content == NULL) {
+    result = curl_formadd(first, last, CURLFORM_ARRAY, form, CURLFORM_END);
+  } else {
+    result = curl_formadd(first, last, CURLFORM_ARRAY, form,
+                         is_file ? CURLFORM_BUFFERPTR : CURLFORM_PTRCONTENTS,
+                         content->data,
+                         is_file ? CURLFORM_BUFFERLENGTH : CURLFORM_CONTENTSLENGTH,
+                         content->length, CURLFORM_END);
+  }
+
+  /* Metadata was copied by curl_formadd. Retain only the payload, if any,
+   * which was the first snapshot allocated for this field. */
+  free_form_strings_until(strings, content ? content : previous_strings);
+
   if (result != 0) {
     const char *reason = NULL;
     
@@ -468,7 +457,10 @@ static VALUE ruby_curl_postfield_to_str(VALUE self) {
     name = rbcpf->name;
     if (TYPE(name) != T_STRING) {
       if (rb_respond_to(name, rb_intern("to_s")))
-        name = rb_funcall(name, rb_intern("to_s"), 0);
+        /* rb_obj_as_string always yields a String, even if #to_s misbehaves
+         * and returns a non-String; a raw rb_funcall result could later be
+         * handed to RSTRING_PTR/RSTRING_LEN and crash. */
+        name = rb_obj_as_string(name);
       else
         name = Qnil;
     }
@@ -481,6 +473,33 @@ static VALUE ruby_curl_postfield_to_str(VALUE self) {
   /* Force field name to UTF-8 before escaping */
   VALUE name_utf8 = rb_str_export_to_enc(name, rb_utf8_encoding());
 
+  /* Resolve and coerce the content before creating the curl handle: the
+   * content proc, #to_s and the UTF-8 export can all raise, which would
+   * otherwise leak the handle. */
+  VALUE tmpcontent = Qnil;
+  if (rbcpf->content_proc != Qnil) {
+    tmpcontent = rb_funcall(rbcpf->content_proc, idCall, 1, self);
+  } else if (rbcpf->content != Qnil) {
+    tmpcontent = rbcpf->content;
+  } else if (rbcpf->local_file != Qnil) {
+    tmpcontent = rbcpf->local_file;
+  } else if (rbcpf->remote_file != Qnil) {
+    tmpcontent = rbcpf->remote_file;
+  } else {
+    tmpcontent = rb_str_new2("");
+  }
+  if (TYPE(tmpcontent) != T_STRING) {
+    if (rb_respond_to(tmpcontent, rb_intern("to_s")))
+      /* rb_obj_as_string always yields a String, even if #to_s misbehaves */
+      tmpcontent = rb_obj_as_string(tmpcontent);
+    else
+      rb_raise(rb_eRuntimeError,
+               "postfield(%"PRIsVALUE") is not a string and does not respond_to to_s",
+               name);
+  }
+  /* Force content to UTF-8 before escaping */
+  VALUE content_utf8 = rb_str_export_to_enc(tmpcontent, rb_utf8_encoding());
+
 #ifdef HAVE_CURL_EASY_ESCAPE
   curl_handle = curl_easy_init();
   if (!curl_handle) {
@@ -499,38 +518,8 @@ static VALUE ruby_curl_postfield_to_str(VALUE self) {
 #endif
 
   VALUE escd_name = rb_str_new2(tmpchrs);
-#ifdef HAVE_CURL_EASY_ESCAPE
-  curl_free(tmpchrs);
-#else
   curl_free(tmpchrs);
-#endif
 
-  VALUE tmpcontent = Qnil;
-  if (rbcpf->content_proc != Qnil) {
-    tmpcontent = rb_funcall(rbcpf->content_proc, idCall, 1, self);
-  } else if (rbcpf->content != Qnil) {
-    tmpcontent = rbcpf->content;
-  } else if (rbcpf->local_file != Qnil) {
-    tmpcontent = rbcpf->local_file;
-  } else if (rbcpf->remote_file != Qnil) {
-    tmpcontent = rbcpf->remote_file;
-  } else {
-    tmpcontent = rb_str_new2("");
-  }
-  if (TYPE(tmpcontent) != T_STRING) {
-    if (rb_respond_to(tmpcontent, rb_intern("to_s")))
-      tmpcontent = rb_funcall(tmpcontent, rb_intern("to_s"), 0);
-    else {
-#ifdef HAVE_CURL_EASY_ESCAPE
-      curl_easy_cleanup(curl_handle);
-#endif
-      rb_raise(rb_eRuntimeError,
-               "postfield(%s) is not a string and does not respond_to to_s",
-               RSTRING_PTR(escd_name));
-    }
-  }
-  /* Force content to UTF-8 before escaping */
-  VALUE content_utf8 = rb_str_export_to_enc(tmpcontent, rb_utf8_encoding());
 #ifdef HAVE_CURL_EASY_ESCAPE
   tmpchrs = curl_easy_escape(curl_handle, StringValuePtr(content_utf8), (int)RSTRING_LEN(content_utf8));
   if (!tmpchrs) {

data/ext/curb_postfield.h

@@ -32,9 +32,18 @@ typedef struct {
 extern VALUE cCurlPostField;
 extern const rb_data_type_t ruby_curl_postfield_data_type;
 
+typedef struct ruby_curl_form_string {
+  struct ruby_curl_form_string *next;
+  long length;
+  char *data;
+} ruby_curl_form_string;
+
+void free_form_strings(ruby_curl_form_string *strings);
+
 void append_to_form(VALUE self, 
                     struct curl_httppost **first, 
-                    struct curl_httppost **last);
+                    struct curl_httppost **last,
+                    ruby_curl_form_string **strings);
 
 void init_curb_postfield();
 

data/ext/extconf.rb

@@ -260,6 +260,7 @@ have_constant "curl_version_idn"
 have_constant "curl_version_sspi"
 have_constant "curl_version_conv"
 have_constant "curl_version_http2"
+have_constant "curl_version_threadsafe"
 have_constant "curlproxy_http"
 have_constant "curlproxy_socks4"
 have_constant "curlproxy_socks4a"
@@ -704,6 +705,7 @@ have_func('rb_fiber_scheduler_current', 'ruby/fiber/scheduler.h')
 have_func('rb_fiber_scheduler_io_wait', 'ruby/fiber/scheduler.h')
 have_func('rb_fiber_scheduler_io_select', 'ruby/fiber/scheduler.h')
 have_func('rb_fiber_scheduler_kernel_sleep', 'ruby/fiber/scheduler.h')
+have_func('rb_ext_ractor_safe')
 have_func('rb_io_stdio_file')
 have_func('curl_multi_wait')
 have_func('curl_multi_socket_action')
@@ -714,6 +716,10 @@ have_func('curl_multi_socket')
 have_func('curl_multi_timer_callback')
 have_constant 'curlmopt_socketfunction'
 have_constant 'curlmopt_timerfunction'
+# Kernel event queues let the socket-action loop wait on one descriptor for
+# every libcurl socket under a fiber scheduler.
+have_header('sys/epoll.h') && have_func('epoll_create1', 'sys/epoll.h')
+have_header('sys/event.h') && have_func('kqueue', ['sys/types.h', 'sys/event.h'])
 have_func('curl_easy_duphandle')
 
 # Optional: enable verbose socket-action debug logging.

data/lib/curl/easy.rb

@@ -3,13 +3,20 @@ require 'curl/download'
 module Curl
   class Easy
     class << self
+      def deferred_multi_close_state
+        Curl.__send__(:ractor_local_state)
+      end
+      private :deferred_multi_close_state
+
       def deferred_multi_close_mutex
-        @deferred_multi_close_mutex ||= Mutex.new
+        state = deferred_multi_close_state
+        state[:deferred_multi_close_mutex] ||= Mutex.new
       end
 
       def deferred_multi_closes
+        state = deferred_multi_close_state
         deferred_multi_close_mutex.synchronize do
-          (@deferred_multi_closes ||= []).dup
+          (state[:deferred_multi_closes] ||= []).dup
         end
       end
 
@@ -34,27 +41,29 @@ module Curl
       end
 
       def defer_multi_close(multi, easy, owner: Thread.current)
+        state = deferred_multi_close_state
         deferred_multi_close_mutex.synchronize do
-          @deferred_multi_closes ||= []
-          return if @deferred_multi_closes.any? { |entry| entry[:multi].equal?(multi) }
+          state[:deferred_multi_closes] ||= []
+          return if state[:deferred_multi_closes].any? { |entry| entry[:multi].equal?(multi) }
 
           multi.instance_variable_set(:@deferred_close, true)
-          @deferred_multi_closes << { multi: multi, easy: easy, owner: owner }
+          state[:deferred_multi_closes] << { multi: multi, easy: easy, owner: owner }
         end
       end
 
       def flush_deferred_multi_closes(all_threads: false)
+        state = deferred_multi_close_state
         pending = deferred_multi_close_mutex.synchronize do
-          @deferred_multi_closes ||= []
+          deferred_closes = (state[:deferred_multi_closes] ||= [])
 
           if all_threads
-            @deferred_multi_closes.shift(@deferred_multi_closes.length)
+            deferred_closes.shift(deferred_closes.length)
           else
             owner = Thread.current
             remaining = []
             current = []
 
-            @deferred_multi_closes.each do |entry|
+            deferred_closes.each do |entry|
               if entry[:owner].equal?(owner)
                 current << entry
               else
@@ -62,7 +71,7 @@ module Curl
               end
             end
 
-            @deferred_multi_closes = remaining
+            state[:deferred_multi_closes] = remaining
             current
           end
         end
@@ -175,10 +184,16 @@ module Curl
       set_protocol_allowlist('CURLOPT_REDIR_PROTOCOLS_STR', 'CURLOPT_REDIR_PROTOCOLS', protocols)
     end
 
-    def safe_http!
+    def safe_http!(options = {})
+      options = Curl.__send__(:safe_http_options, options)
+      config = Curl.__send__(:ractor_local_state)[:safety_config] || Curl::SafetyConfig.new
+      limit = Curl::SafetyConfig.new
+      limit.max_body_bytes = options.fetch(:max_body_bytes, config.max_body_bytes)
       __curb_set_safety_override!(
         :protocols => [:http, :https],
-        :redirect_protocols => [:http, :https]
+        :redirect_protocols => [:http, :https],
+        :network_policy => :public,
+        :max_body_bytes => limit.max_body_bytes
       )
     end
 
@@ -188,7 +203,8 @@ module Curl
       @__curb_safety_override = (defined?(@__curb_safety_override) && @__curb_safety_override) ? @__curb_safety_override.dup : {}
       @__curb_safety_override[:protocols] = Array(options[:protocols]).map { |protocol| protocol.to_s.downcase.to_sym } if options.key?(:protocols)
       @__curb_safety_override[:redirect_protocols] = Array(options[:redirect_protocols]).map { |protocol| protocol.to_s.downcase.to_sym } if options.key?(:redirect_protocols)
-      @__curb_safety_override[:max_body_bytes] = options[:max_body_bytes] if options.key?(:max_body_bytes) && options[:max_body_bytes]
+      @__curb_safety_override[:max_body_bytes] = options[:max_body_bytes] if options.key?(:max_body_bytes)
+      @__curb_safety_override[:network_policy] = options[:network_policy] if options.key?(:network_policy)
       @__curb_safety_override_generation = __curb_safety_override_generation + 1
       Curl.__send__(:apply_safety!, self) if Curl.respond_to?(:apply_safety!, true)
       self

data/lib/curl/multi.rb

@@ -454,9 +454,9 @@ module Curl
 
     def remove(easy)
       return self if !requests[easy.object_id]
+      _remove(easy)
       requests.delete(easy.object_id)
       __curb_native_safety_signatures.delete(easy.object_id)
-      _remove(easy)
       self
     end
 

data/lib/curl.rb

@@ -8,8 +8,22 @@ require 'uri'
 
 # expose shortcut methods
 module Curl
+  # Module/class instance variables cannot be read or written by non-main
+  # Ractors, even when the value itself would otherwise be safe. Keep curb's
+  # mutable Ruby-side configuration in storage owned by the current Ractor.
+  # Older Rubies retain the historical process-wide state.
+  def self.ractor_local_state
+    if defined?(Ractor) && Ractor.respond_to?(:current) &&
+       Ractor.current.respond_to?(:[]) && Ractor.current.respond_to?(:[]=)
+      Ractor.current[:__curb_ractor_local_state] ||= {}
+    else
+      @legacy_local_state ||= {}
+    end
+  end
+
   class SafetyConfig
     DEFAULT_PROTOCOLS = [:http, :https].freeze
+    DEFAULT_MAX_BODY_BYTES = 10 * 1024 * 1024
 
     attr_reader :max_body_bytes, :network_policy
     attr_accessor :allow_proxies, :allow_resolve, :allow_connect_to, :allow_doh, :allow_unix_socket
@@ -17,8 +31,8 @@ module Curl
     def initialize
       @protocols = DEFAULT_PROTOCOLS
       @redirect_protocols = nil
-      @max_body_bytes = nil
-      @network_policy = nil
+      @max_body_bytes = DEFAULT_MAX_BODY_BYTES
+      @network_policy = :public
       @allowed_hosts = nil
       @allowed_proxy_hosts = nil
       @allowed_cidrs = nil
@@ -176,12 +190,12 @@ module Curl
   def self.safe!
     config = SafetyConfig.new
     yield config if block_given?
-    @safety_config = config
+    ractor_local_state[:safety_config] = config
     bump_safety_generation!
   end
 
   def self.apply_safety!(easy)
-    config = @safety_config
+    config = ractor_local_state[:safety_config]
     override = safety_override_for(easy)
     return easy unless config || override
 
@@ -204,9 +218,11 @@ module Curl
     apply_allowed_hosts!(easy, config.allowed_hosts) if config&.allowed_hosts
     apply_allowed_cidrs!(easy, config) if config&.allowed_cidrs
 
-    if config&.network_policy
-      easy.network_policy = config.network_policy
-      apply_public_network_policy_controls!(easy, config) if config.network_policy == :public
+    network_policy = config&.network_policy
+    network_policy = :public if override && override[:network_policy] == :public
+    if network_policy
+      easy.network_policy = network_policy
+      apply_public_network_policy_controls!(easy, config || SafetyConfig.new) if network_policy == :public
     end
 
     apply_max_body_bytes!(easy, config.max_body_bytes) if config&.max_body_bytes
@@ -215,12 +231,12 @@ module Curl
   end
 
   def self.clear_safe!
-    @safety_config = nil
+    ractor_local_state[:safety_config] = nil
     bump_safety_generation!
   end
 
   def self.safety_active_for?(easy)
-    !!(@safety_config || safety_override_for(easy))
+    !!(ractor_local_state[:safety_config] || safety_override_for(easy))
   end
 
   def self.safety_signature_for(easy)
@@ -240,11 +256,11 @@ module Curl
   end
 
   def self.safety_generation
-    @safety_generation ||= 0
+    ractor_local_state[:safety_generation] ||= 0
   end
 
   def self.bump_safety_generation!
-    @safety_generation = safety_generation + 1
+    ractor_local_state[:safety_generation] = safety_generation + 1
   end
 
   def self.safety_protocol_intersection(base_protocols, override_protocols)
@@ -395,7 +411,8 @@ module Curl
     easy.set(Curl::CURLOPT_NOPROXY, "*") if Curl.const_defined?(:CURLOPT_NOPROXY)
   end
 
-  private_class_method :apply_safety!, :clear_safe!, :safety_active_for?,
+  private_class_method :ractor_local_state,
+                       :apply_safety!, :clear_safe!, :safety_active_for?,
                        :safety_signature_for, :safety_override_for,
                        :safety_generation, :bump_safety_generation!,
                        :safety_protocol_intersection,
@@ -480,23 +497,44 @@ module Curl
     end
   end
 
+  # Wakes the waiters whose transfers finished since the last call. Completions
+  # are queued by the on_complete wrapper in perform_with_scheduler, so each
+  # drive-loop pass costs O(new completions) rather than O(all waiters).
   def self.release_scheduler_waiters(state)
-    source_id = deferred_exception_source_id(state)
+    completed = state[:completed]
+    return if completed.empty?
 
-    state[:waiters].each do |easy_id, waiter|
-      next if source_id == easy_id
+    source_id = deferred_exception_source_id(state)
+    retained = nil
+
+    until completed.empty?
+      easy_id, waiter = completed.shift
+      # A waiter whose perform already returned (it raised) is no longer
+      # blocked on this completion; waking its fiber would be spurious.
+      next unless state[:waiters][easy_id].equal?(waiter)
+
+      if source_id == easy_id
+        # The transfer that raised the deferred exception gets that error via
+        # release_scheduler_error. Keep it queued in case the source changes.
+        (retained ||= []) << [easy_id, waiter]
+        next
+      end
 
-      complete_scheduler_waiter(waiter) if waiter[:completed]
+      complete_scheduler_waiter(waiter)
     end
+
+    completed.concat(retained) if retained
   end
 
   def self.perform_with_scheduler(easy)
     state = scheduler_state
+    easy_id = easy.object_id
     waiter = {completed: false, done: false, error: nil, fiber: nil, scheduler: Fiber.scheduler}
-    state[:waiters][easy.object_id] = waiter
+    state[:waiters][easy_id] = waiter
     previous_complete = easy.on_complete do |completed_easy|
       previous_complete.call(completed_easy) if previous_complete
       waiter[:completed] = true
+      state[:completed] << [easy_id, waiter]
     end
 
     state[:pending] << easy
@@ -533,6 +571,8 @@ module Curl
         driver_running: false,
         error: nil,
         waiters: {},
+        # [easy object_id, waiter] pairs completed but not yet woken
+        completed: [],
       }
       Thread.current.thread_variable_set(:curb_scheduler_state, state)
       state
@@ -616,8 +656,7 @@ module Curl
 
     http(verb, url, post_body, put_data) do |handle|
       yield handle if block
-      handle.safe_http!
-      handle.max_body_bytes = options[:max_body_bytes] if options.key?(:max_body_bytes)
+      handle.safe_http!(options)
     end
   end