patron 0.13.3 → 0.14.0

data/lib/patron/error.rb

@@ -36,6 +36,10 @@ module Patron
   # Gets raised if the progress callback, or an interrupt, aborts the Curl perform() call
   class Aborted                < Error; end
 
+  # Gets raised when the client certificate or its private key could not be used,
+  # for example when the key password is wrong or the certificate file is missing.
+  class ClientCertificateError < Error; end
+
   # Gets raised when the server specifies an encoding that could not be found, or has an invalid name,
   # or when the server "lies" about the encoding of the response body (such as can be the case
   # when the server specifies an encoding in `Content-Type`) which the HTML generator then overrides

data/lib/patron/request.rb

@@ -25,17 +25,17 @@ module Patron
       :ignore_content_length, :multipart, :action, :timeout, :connect_timeout, :dns_cache_timeout,
       :max_redirects, :headers, :auth_type, :upload_data, :buffer_size, :cacert,
       :ssl_version, :http_version, :automatic_content_encoding, :force_ipv4, :download_byte_limit,
-      :low_speed_time, :low_speed_limit, :progress_callback
+      :low_speed_time, :low_speed_limit, :progress_callback, :ssl_cert, :ssl_cert_type, :ssl_key, :ssl_key_password
     ]
 
     WRITER_VARS = [
       :url, :username, :password, :file_name, :proxy, :proxy_type, :insecure, :dns_cache_timeout,
       :ignore_content_length, :multipart, :cacert, :ssl_version, :http_version, :automatic_content_encoding, :force_ipv4, :download_byte_limit,
-      :low_speed_time, :low_speed_limit, :progress_callback
+      :low_speed_time, :low_speed_limit, :progress_callback, :ssl_cert, :ssl_cert_type, :ssl_key, :ssl_key_password
     ]
 
-    attr_reader *READER_VARS
-    attr_writer *WRITER_VARS
+    attr_reader(*READER_VARS)
+    attr_writer(*WRITER_VARS)
 
     # Set the type of authentication to use for this request.
     #
@@ -181,7 +181,8 @@ module Patron
     def marshal_dump
       [ @url, @username, @password, @file_name, @proxy, @proxy_type, @insecure,
         @ignore_content_length, @multipart, @action, @timeout, @connect_timeout,
-        @max_redirects, @headers, @auth_type, @upload_data, @buffer_size, @cacert ]
+        @max_redirects, @headers, @auth_type, @upload_data, @buffer_size, @cacert,
+        @ssl_cert, @ssl_cert_type, @ssl_key, @ssl_key_password ]
     end
 
     # Reinstates instance variables from a marshaled representation
@@ -190,7 +191,8 @@ module Patron
     def marshal_load(data)
       @url, @username, @password, @file_name, @proxy, @proxy_type, @insecure,
       @ignore_content_length, @multipart, @action, @timeout, @connect_timeout,
-      @max_redirects, @headers, @auth_type, @upload_data, @buffer_size, @cacert = data
+      @max_redirects, @headers, @auth_type, @upload_data, @buffer_size, @cacert,
+      @ssl_cert, @ssl_cert_type, @ssl_key, @ssl_key_password = data
     end
 
   end

data/lib/patron/response.rb

@@ -28,6 +28,11 @@ module Patron
     #    to be a valid charset name, just stored. To check the charset for validity, use #body_decodable?
     attr_reader :charset
 
+    # @return [Hash{Symbol => Float}, nil] curl's cumulative transfer marks in seconds since the request
+    #   started: `:namelookup`, `:connect`, `:appconnect`, `:pretransfer`, `:starttransfer`, `:redirect`
+    #   and `:total`. `nil` when the response was not built from a curl transfer (e.g. a stub).
+    attr_reader :timings
+
     # Overridden so that the output is shorter and there is no response body printed
     def inspect
       # Avoid spamming the console with the header and body data

data/lib/patron/session.rb

@@ -67,6 +67,19 @@ module Patron
     # @return [String] path to the CA file used for certificate verification, or `nil` if CURL default is used
     attr_accessor :cacert
 
+    # @return [String] path to the client SSL certificate file, or `nil` if no client certificate is used
+    attr_accessor :ssl_cert
+
+    # @return [String] the client SSL certificate file type: "PEM" (the libcurl default), "DER" or "P12" (PKCS#12)
+    attr_accessor :ssl_cert_type
+
+    # @return [String] path to the PEM private key for the client SSL certificate, if it is not bundled with
+    #   the certificate itself (as it is with PKCS#12)
+    attr_accessor :ssl_key
+
+    # @return [String] the password for the client SSL certificate private key
+    attr_accessor :ssl_key_password
+
     # @return [Boolean] whether Content-Range and Content-Length headers should be ignored
     attr_accessor :ignore_content_length
 
@@ -103,8 +116,6 @@ module Patron
     # @see low_speed_time
     attr_accessor :low_speed_limit
 
-    private :handle_request, :add_cookie_file, :set_debug_file
-
     # @return [#call, nil] callable object that will be called with 4 arguments
     #    during request/response execution - `dltotal`, `dlnow`, `ultotal`, `ulnow`.
     #    All these arguments are in bytes.
@@ -146,9 +157,9 @@ module Patron
       if file_path
         path = Pathname(file_path).expand_path
         
-        if !File.exists?(file_path) && !File.writable?(path.dirname)
+        if !File.exist?(file_path) && !File.writable?(path.dirname)
           raise ArgumentError, "Can't create file #{path} (permission error)"
-        elsif File.exists?(file_path) && !File.writable?(file_path)
+        elsif File.exist?(file_path) && !File.writable?(file_path)
           raise ArgumentError, "Can't read or write file #{path} (permission error)"
         end
       else
@@ -378,6 +389,10 @@ module Patron
         req.ssl_version            = options.fetch :ssl_version,           self.ssl_version
         req.http_version           = options.fetch :http_version,          self.http_version
         req.cacert                 = options.fetch :cacert,                self.cacert
+        req.ssl_cert               = options.fetch :ssl_cert,              self.ssl_cert
+        req.ssl_cert_type          = options.fetch :ssl_cert_type,         self.ssl_cert_type
+        req.ssl_key                = options.fetch :ssl_key,               self.ssl_key
+        req.ssl_key_password       = options.fetch :ssl_key_password,      self.ssl_key_password
         req.ignore_content_length  = options.fetch :ignore_content_length, self.ignore_content_length
         req.buffer_size            = options.fetch :buffer_size,           self.buffer_size
         req.download_byte_limit    = options.fetch :download_byte_limit,   self.download_byte_limit

data/lib/patron/version.rb

@@ -1,3 +1,3 @@
 module Patron
-  VERSION = "0.13.3"
+  VERSION = "0.14.0"
 end

data/patron.gemspec

@@ -6,23 +6,24 @@ require 'patron/version'
 Gem::Specification.new do |spec|
   spec.name        = "patron"
   spec.version     = Patron::VERSION
+  spec.licenses    = ["MIT"]
   spec.platform    = Gem::Platform::RUBY
-  spec.authors     = ["Phillip Toland"]
-  spec.email       = ["phil.toland@gmail.com"]
+  spec.authors     = ["Aeryn Riley Dowling-Toland"]
+  spec.email       = ["aeryn.toland@gmail.com"]
   spec.homepage    = "https://github.com/toland/patron"
   spec.summary     = "Patron HTTP Client"
   spec.description = "Ruby HTTP client library based on libcurl"
 
-  # Prevent pushing this gem to RubyGemspec.org. To allow pushes either set the 'allowed_push_host'
+  # Prevent pushing this gem to RubyGems.org. To allow pushes either set the 'allowed_push_host'
   # to allow pushing to a single host or delete this section to allow pushing to any host.
   if spec.respond_to?(:metadata)
     spec.metadata['allowed_push_host'] = "https://rubygems.org"
   else
-    raise "RubyGems 2.0 or newer is required to protect against public gem pushespec."
+    raise "RubyGems 2.0 or newer is required to protect against public gem pushes."
   end
 
-  spec.required_rubygems_version = ">= 1.2.0"
-  spec.rubyforge_project = "patron"
+  spec.required_rubygems_version = ">= 2.5.0"
+  spec.required_ruby_version = ">= 2.3"
 
   spec.files         = `git ls-files -z`.split("\x0")
   spec.bindir        = "exe"
@@ -31,16 +32,8 @@ Gem::Specification.new do |spec|
   spec.extensions   = ["ext/patron/extconf.rb"]
   spec.post_install_message = %q{
 Thank you for installing Patron. On OSX, make sure you are using libCURL with OpenSSL.
-SecureTransport-based builds might cause crashes in forking environment.
+SecureTransport-based builds might cause crashes in forking environments.
 
 For more info see https://github.com/curl/curl/issues/788
 }
-  spec.add_development_dependency "rake", "~> 10"
-  spec.add_development_dependency "bundler"
-  spec.add_development_dependency "rspec", ">= 2.3.0"
-  spec.add_development_dependency "simplecov", "~> 0.10"
-  spec.add_development_dependency "yard", "~> 0.9.11"
-  spec.add_development_dependency "rack", "~> 1"
-  spec.add_development_dependency "puma", '~> 3.11'
-  spec.add_development_dependency "rake-compiler"
 end

data/script/generate_client_certs

@@ -0,0 +1,65 @@
+#!/usr/bin/env ruby
+# Regenerates the client certificate fixtures used by the mutual TLS specs
+require 'openssl'
+
+DIR = File.expand_path('../spec/support/certs', __dir__)
+PASSWORD = 'patron'
+NOT_BEFORE = Time.utc(2025, 1, 1)
+NOT_AFTER = Time.utc(2045, 1, 1)
+
+def name(cn)
+  OpenSSL::X509::Name.parse("/C=US/O=Patron Test Certificate/CN=#{cn}")
+end
+
+def make_ca(cn)
+  key = OpenSSL::PKey::RSA.new(2048)
+  cert = OpenSSL::X509::Certificate.new
+  cert.version = 2
+  cert.serial = 1
+  cert.subject = name(cn)
+  cert.issuer = cert.subject
+  cert.public_key = key.public_key
+  cert.not_before = NOT_BEFORE
+  cert.not_after = NOT_AFTER
+  ef = OpenSSL::X509::ExtensionFactory.new(cert, cert)
+  cert.add_extension(ef.create_extension('basicConstraints', 'CA:TRUE', true))
+  cert.add_extension(ef.create_extension('keyUsage', 'keyCertSign,cRLSign', true))
+  cert.add_extension(ef.create_extension('subjectKeyIdentifier', 'hash'))
+  cert.sign(key, OpenSSL::Digest::SHA256.new)
+  [cert, key]
+end
+
+def make_client(ca, ca_key)
+  key = OpenSSL::PKey::RSA.new(2048)
+  cert = OpenSSL::X509::Certificate.new
+  cert.version = 2
+  cert.serial = 2
+  cert.subject = name('patron-test-client')
+  cert.issuer = ca.subject
+  cert.public_key = key.public_key
+  cert.not_before = NOT_BEFORE
+  cert.not_after = NOT_AFTER
+  ef = OpenSSL::X509::ExtensionFactory.new(ca, cert)
+  cert.add_extension(ef.create_extension('basicConstraints', 'CA:FALSE', true))
+  cert.add_extension(ef.create_extension('keyUsage', 'digitalSignature,keyEncipherment', true))
+  cert.add_extension(ef.create_extension('extendedKeyUsage', 'clientAuth'))
+  cert.sign(ca_key, OpenSSL::Digest::SHA256.new)
+  [cert, key]
+end
+
+def write_p12(filename, cert, key)
+  p12 = OpenSSL::PKCS12.create(PASSWORD, 'patron-test-client', key, cert, nil, 'PBE-SHA1-3DES', 'PBE-SHA1-3DES')
+  File.binwrite(File.join(DIR, filename), p12.to_der)
+end
+
+ca, ca_key = make_ca('Patron Test Client CA')
+client, client_key = make_client(ca, ca_key)
+File.write(File.join(DIR, 'client_ca.pem'), ca.to_pem)
+File.write(File.join(DIR, 'client_cert.pem'), client.to_pem)
+File.write(File.join(DIR, 'client_key.pem'), client_key.export(OpenSSL::Cipher.new('aes-256-cbc'), PASSWORD))
+write_p12('client.p12', client, client_key)
+
+# Same subject as the real client certificate, but signed by a CA the test server does not trust
+rogue_ca, rogue_ca_key = make_ca('Patron Rogue CA')
+rogue, rogue_key = make_client(rogue_ca, rogue_ca_key)
+write_p12('rogue_client.p12', rogue, rogue_key)

data/spec/request_spec.rb

@@ -74,4 +74,16 @@ describe Patron::Request do
   it "should be able to serialize and deserialize itself" do
     expect(Marshal.load(Marshal.dump(@request))).to eql(@request)
   end
+
+  it "should preserve the client certificate settings when serialized" do
+    @request.ssl_cert = "client.pem"
+    @request.ssl_cert_type = "PEM"
+    @request.ssl_key = "client_key.pem"
+    @request.ssl_key_password = "secret"
+    restored = Marshal.load(Marshal.dump(@request))
+    expect(restored.ssl_cert).to eq("client.pem")
+    expect(restored.ssl_cert_type).to eq("PEM")
+    expect(restored.ssl_key).to eq("client_key.pem")
+    expect(restored.ssl_key_password).to eq("secret")
+  end
 end