patron 0.13.3 → 0.14.0

data/spec/session_ssl_spec.rb

@@ -6,15 +6,25 @@ require 'fileutils'
 
 describe Patron::Session do
 
+  def yaml_load(str)
+    if RUBY_VERSION >= '3.1.0'
+      YAML::safe_load(str, permitted_classes: [OpenStruct])
+    else
+      YAML::load(str)
+    end
+  end
+
   before(:each) do
     @session = Patron::Session.new
     @session.base_url = "https://localhost:9043"
     @session.insecure = true
+    # The first TLS handshake takes a few seconds when both ends run under valgrind
+    @session.connect_timeout = 10
   end
 
   it "should retrieve a url with :get" do
     response = @session.get("/test")
-    body = YAML::load(response.body)
+    body = yaml_load(response.body)
     expect(body.request_method).to be == "GET"
   end
 
@@ -22,7 +32,7 @@ describe Patron::Session do
     tmpfile = "/tmp/patron_test.yaml"
     response = @session.get_file "/test", tmpfile
     expect(response.body).to be_nil
-    body = YAML::load_file(tmpfile)
+    body = yaml_load(File.open(tmpfile).read)
     expect(body.request_method).to be == "GET"
     FileUtils.rm tmpfile
   end
@@ -39,7 +49,7 @@ describe Patron::Session do
     pid = fork do
       response = @session.get_file "/test", tmpfile
       expect(response.body).to be_nil
-      body = YAML::load_file(tmpfile)
+      body = yaml_load(File.open(tmpfile).read)
       expect(body.request_method).to be == "GET"
       FileUtils.rm tmpfile
     end
@@ -58,14 +68,14 @@ describe Patron::Session do
 
   it "should include custom headers in a request" do
     response = @session.get("/test", {"User-Agent" => "PatronTest"})
-    body = YAML::load(response.body)
+    body = yaml_load(response.body)
     expect(body.header["user-agent"]).to be == ["PatronTest"]
   end
 
   it "should merge custom headers with session headers" do
     @session.headers["X-Test"] = "Testing"
     response = @session.get("/test", {"User-Agent" => "PatronTest"})
-    body = YAML::load(response.body)
+    body = yaml_load(response.body)
     expect(body.header["user-agent"]).to be == ["PatronTest"]
     expect(body.header["x-test"]).to be == ["Testing"]
   end
@@ -80,7 +90,7 @@ describe Patron::Session do
   it "should follow redirects by default" do
     @session.max_redirects = 1
     response = @session.get("/redirect")
-    body = YAML::load(response.body)
+    body = yaml_load(response.body)
     expect(response.status).to be == 200
     expect(body.path).to be == "/test"
   end
@@ -107,26 +117,26 @@ describe Patron::Session do
 
   it "should send a delete request with :delete" do
     response = @session.delete("/test")
-    body = YAML::load(response.body)
+    body = yaml_load(response.body)
     expect(body.request_method).to be == "DELETE"
   end
 
   it "should send a COPY request with :copy" do
     response = @session.copy("/test", "/test2")
-    body = YAML::load(response.body)
+    body = yaml_load(response.body)
     expect(body.request_method).to be == "COPY"
   end
 
   it "should include a Destination header in COPY requests" do
     response = @session.copy("/test", "/test2")
-    body = YAML::load(response.body)
+    body = yaml_load(response.body)
     expect(body.header['destination'].first).to be == "/test2"
   end
 
   it "should upload data with :get" do
     data = "upload data"
     response = @session.request(:get, "/test", {}, :data => data)
-    body = YAML::load(response.body)
+    body = yaml_load(response.body)
     expect(body.request_method).to be == "GET"
     expect(body.header['content-length']).to be == [data.size.to_s]
   end
@@ -134,7 +144,7 @@ describe Patron::Session do
   it "should upload data with :put" do
     data = "upload data"
     response = @session.put("/test", data)
-    body = YAML::load(response.body)
+    body = yaml_load(response.body)
     expect(body.request_method).to be == "PUT"
     expect(body.header['content-length']).to be == [data.size.to_s]
   end
@@ -145,7 +155,7 @@ describe Patron::Session do
 
   it "should upload a file with :put" do
     response = @session.put_file("/test", "LICENSE")
-    body = YAML::load(response.body)
+    body = yaml_load(response.body)
     expect(body.request_method).to be == "PUT"
   end
 
@@ -153,16 +163,27 @@ describe Patron::Session do
     expect { @session.put_file("/test", nil) }.to raise_error(ArgumentError)
   end
 
-  it "should use chunked encoding when uploading a file with :put" do
-    response = @session.put_file("/test", "LICENSE")
-    body = YAML::load(response.body)
-    expect(body.header['transfer-encoding'].first).to be == "chunked"
+  it "should upload a file with :put using chunked transfer-encoding" do
+    # Transfer-Encoding is a hop-by-hop header (RFC 7230 3.3.1): a conformant server
+    # decodes the chunked framing and never exposes the header to the application, so
+    # we capture the raw request to assert how Patron actually frames the upload.
+    captured = capture_request(ssl: true) do |url|
+      session = Patron::Session.new
+      session.base_url = url
+      session.insecure = true
+      session.timeout = 5
+      session.put_file("/test", "LICENSE")
+    end
+    expect(captured.request_line).to start_with("PUT ")
+    expect(captured.headers["transfer-encoding"]).to be == "chunked"
+    expect(captured.headers).to_not have_key("content-length")
+    expect(captured.body.bytesize).to be == File.size("LICENSE")
   end
 
   it "should upload data with :post" do
     data = "upload data"
     response = @session.post("/test", data)
-    body = YAML::load(response.body)
+    body = yaml_load(response.body)
     expect(body.request_method).to be == "POST"
     expect(body.header['content-length']).to be == [data.size.to_s]
   end
@@ -170,7 +191,7 @@ describe Patron::Session do
   it "should post a hash of arguments as a urlencoded form" do
     data = {:foo => 123, 'baz' => '++hello world++'}
     response = @session.post("/testpost", data)
-    body = YAML::load(response.body)
+    body = yaml_load(response.body)
     expect(body['content_type']).to be == "application/x-www-form-urlencoded"
     expect(body['body']).to match(/baz=%2B%2Bhello%20world%2B%2B/)
     expect(body['body']).to match(/foo=123/)
@@ -182,13 +203,13 @@ describe Patron::Session do
 
   it "should upload a file with :post" do
     response = @session.post_file("/test", "LICENSE")
-    body = YAML::load(response.body)
+    body = yaml_load(response.body)
     expect(body.request_method).to be == "POST"
   end
 
   it "should upload a multipart with :post" do
     response = @session.post_multipart("/test", { :test_data => "123" }, { :test_file => "LICENSE" } )
-    body = YAML::load(response.body)
+    body = yaml_load(response.body)
     expect(body.request_method).to be == "POST"
   end
 
@@ -196,21 +217,31 @@ describe Patron::Session do
     expect { @session.post_file("/test", nil) }.to raise_error(ArgumentError)
   end
 
-  it "should use chunked encoding when uploading a file with :post" do
-    response = @session.post_file("/test", "LICENSE")
-    body = YAML::load(response.body)
-    expect(body.header['transfer-encoding'].first).to be == "chunked"
+  it "should upload a file with :post using chunked transfer-encoding" do
+    # See the :put counterpart above: Transfer-Encoding is hop-by-hop and invisible
+    # to the application, so we capture the raw request to assert the framing.
+    captured = capture_request(ssl: true) do |url|
+      session = Patron::Session.new
+      session.base_url = url
+      session.insecure = true
+      session.timeout = 5
+      session.post_file("/test", "LICENSE")
+    end
+    expect(captured.request_line).to start_with("POST ")
+    expect(captured.headers["transfer-encoding"]).to be == "chunked"
+    expect(captured.headers).to_not have_key("content-length")
+    expect(captured.body.bytesize).to be == File.size("LICENSE")
   end
 
   it "should handle cookies if set" do
     @session.handle_cookies
     response = @session.get("/setcookie").body
-    expect(YAML::load(response).header['cookie'].first).to be == "session_id=foo123"
+    expect(yaml_load(response).header['cookie'].first).to be == "session_id=foo123"
   end
 
   it "should not handle cookies by default" do
     response = @session.get("/setcookie").body
-    expect(YAML::load(response).header).to_not include('cookie')
+    expect(yaml_load(response).header).to_not include('cookie')
   end
 
   it "should raise exception if cookie store is not writable or readable" do
@@ -241,10 +272,20 @@ describe Patron::Session do
     @session.insecure = nil
     @session.cacert = File.join(__dir__, 'support', 'certs', 'cacert.pem')
     response = @session.get("/test")
-    body = YAML::load(response.body)
+    body = yaml_load(response.body)
     expect(body.request_method).to be == "GET"
   end
 
+  it "should allow to specify insecure mode per-request" do
+    @session.insecure = false
+    expect {
+      @session.request(:get, "/test", {}, insecure: true)
+    }.not_to raise_error
+    expect {
+      @session.request(:get, "/test", {})
+    }.to raise_error(Patron::Error)
+  end
+
   it "should work with different SSL versions" do
     ['TLSv1_0','TLSv1_1'].each do |version|
       @session.ssl_version = version
@@ -292,4 +333,99 @@ describe Patron::Session do
     end
   end
 
+  describe 'with a server that requires a client certificate' do
+    let(:certs) { File.join(__dir__, 'support', 'certs') }
+
+    # libcurl's GnuTLS backend reports any client certificate it can't load as CURLE_SSL_CONNECT_ERROR
+    let(:gnutls) { Patron.libcurl_version.include?('GnuTLS') }
+
+    def refused_by_server
+      raise_error { |e|
+        expect(e).to be_kind_of(Patron::Error)
+        expect(e).not_to be_kind_of(Patron::ClientCertificateError)
+        expect(e).not_to be_kind_of(Patron::TimeoutError)
+      }
+    end
+
+    before(:each) do
+      @session.base_url = "https://localhost:9044"
+      @session.insecure = false
+      @session.cacert = File.join(certs, 'cacert.pem')
+    end
+
+    it "presents a PKCS#12 client certificate" do
+      @session.ssl_cert = File.join(certs, 'client.p12')
+      @session.ssl_cert_type = 'P12'
+      @session.ssl_key_password = 'patron'
+      response = @session.get("/peercert")
+      expect(response.status).to be == 200
+      expect(response.body).to include('CN=patron-test-client')
+    end
+
+    it "presents a PEM client certificate with a separate encrypted key" do
+      @session.ssl_cert = File.join(certs, 'client_cert.pem')
+      @session.ssl_cert_type = 'PEM'
+      @session.ssl_key = File.join(certs, 'client_key.pem')
+      @session.ssl_key_password = 'patron'
+      response = @session.get("/peercert")
+      expect(response.status).to be == 200
+      expect(response.body).to include('CN=patron-test-client')
+    end
+
+    it "accepts the client certificate as a per-request option" do
+      response = @session.request(:get, "/peercert", {},
+        ssl_cert: File.join(certs, 'client.p12'), ssl_cert_type: 'P12', ssl_key_password: 'patron')
+      expect(response.body).to include('CN=patron-test-client')
+    end
+
+    it "accepts Pathnames for the certificate and key and a Symbol for the type" do
+      @session.cacert = Pathname(certs).join('cacert.pem')
+      @session.ssl_cert = Pathname(certs).join('client_cert.pem')
+      @session.ssl_cert_type = :PEM
+      @session.ssl_key = Pathname(certs).join('client_key.pem')
+      @session.ssl_key_password = 'patron'
+      response = @session.get("/peercert")
+      expect(response.body).to include('CN=patron-test-client')
+    end
+
+    it "does not leak a failed request's options into the next one" do
+      @session.ssl_cert = File.join(certs, 'client.p12')
+      @session.ssl_cert_type = 'P12'
+      @session.ssl_key_password = 'patron'
+      expect {
+        @session.request(:get, "/test", {'X-Leaked' => 'yes'}, ssl_key_password: 1234)
+      }.to raise_error(TypeError)
+
+      body = yaml_load(@session.get("/test").body)
+      expect(body.header).not_to have_key('x-leaked')
+    end
+
+    it "raises ClientCertificateError when the key password is wrong" do
+      skip "GnuTLS does not tell this apart from a handshake failure" if gnutls
+      @session.ssl_cert = File.join(certs, 'client.p12')
+      @session.ssl_cert_type = 'P12'
+      @session.ssl_key_password = 'wrong'
+      expect { @session.get("/peercert") }.to raise_error(Patron::ClientCertificateError)
+    end
+
+    it "raises ClientCertificateError when the certificate file does not exist" do
+      skip "GnuTLS does not tell this apart from a handshake failure" if gnutls
+      @session.ssl_cert = File.join(certs, 'nonexistent.p12')
+      @session.ssl_cert_type = 'P12'
+      @session.ssl_key_password = 'patron'
+      expect { @session.get("/peercert") }.to raise_error(Patron::ClientCertificateError)
+    end
+
+    it "fails when the server does not trust the client certificate" do
+      @session.ssl_cert = File.join(certs, 'rogue_client.p12')
+      @session.ssl_cert_type = 'P12'
+      @session.ssl_key_password = 'patron'
+      expect { @session.get("/peercert") }.to refused_by_server
+    end
+
+    it "fails when no client certificate is presented" do
+      # Depending on the TLS version the server rejects us either during or right after the handshake
+      expect { @session.get("/peercert") }.to refused_by_server
+    end
+  end
 end

data/spec/spec_helper.rb

@@ -18,14 +18,23 @@ $stderr.puts "Build against #{Patron.libcurl_version}"
 
 Dir['./spec/support/**/*.rb'].each { |fn| require fn }
 
-http_server_pid = Process.fork { PatronTestServer.start(false, 9001) }
-https_server_pid = Process.fork { PatronTestServer.start(true, 9043) }
+http_server = Fork.new { PatronTestServer.start(false, 9001) }
+
+sleep 0.1 # Don't interfere the start up output of two processes.
+
+https_server = Fork.new { PatronTestServer.start(true, 9043) }
+
+mtls_server = Fork.new do
+  PatronTestServer.start(true, 9044, client_ca: File.join(__dir__, 'support', 'certs', 'client_ca.pem'))
+end
 
 RSpec.configure do |c|
   c.after(:suite) do
-    Process.kill("INT", http_server_pid)
-    Process.kill("INT", https_server_pid)
-    Process.wait(http_server_pid)
-    Process.wait(https_server_pid)
+    http_server.kill("TERM")
+    https_server.kill("TERM")
+    mtls_server.kill("TERM")
+    http_server.wait
+    https_server.wait
+    mtls_server.wait
   end
-end
+end

data/spec/support/certs/client_ca.pem

@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDWzCCAkOgAwIBAgIBATANBgkqhkiG9w0BAQsFADBPMQswCQYDVQQGEwJVUzEg
+MB4GA1UECgwXUGF0cm9uIFRlc3QgQ2VydGlmaWNhdGUxHjAcBgNVBAMMFVBhdHJv
+biBUZXN0IENsaWVudCBDQTAeFw0yNTAxMDEwMDAwMDBaFw00NTAxMDEwMDAwMDBa
+ME8xCzAJBgNVBAYTAlVTMSAwHgYDVQQKDBdQYXRyb24gVGVzdCBDZXJ0aWZpY2F0
+ZTEeMBwGA1UEAwwVUGF0cm9uIFRlc3QgQ2xpZW50IENBMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEA1iqOoIm5gW9MP0onsmSuOdlAdFZkP5r7rRSn+100
+5ceHDpRdaR+k8ZIoi7noesryrf7ibZL+9VzZEBGlCcUGEIjQjL/BHsHa5vLfAJnT
+0zbeQFk5MjGZOUPXC33CgidsxF3DsRFDNmOqGBiCf3A/ae/VOMDEyv6aFdKc6JQC
+OoudnCGzVNJuLIa+/yGx9HhIjobbYGuZ7gwLjJk3HW9WixTupUKJME9f7cTIPW+k
+ahw7ZQGzIUHejqy8cDnmBRYNpZ8NU5oTuhr5NFDWhOSGfM70NYFlGDifI2kMPhdc
+s4nEUajG1b3NLBfKMM1HioqG2ivMQv6WNRWGJCn3sdJEXQIDAQABo0IwQDAPBgNV
+HRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUd1Pmdua66Xyn
+qKIbXkVUC389WA8wDQYJKoZIhvcNAQELBQADggEBAD+6HGi8mdkHDnegma3AvQ0K
+4EoTtKljui93zVhsaXpycr/UtOe7p6jBApBdh93up6Fx9cYu2OtTLh0t9rnLXBWD
+GZQt1jajEwvdRg2ncFfoWkxeftUttd5uTVMN6Apv3nGw3VXZnNmVaRyZnGG5j1JO
+lnN94DfE37MyePhuFCDd5RZXegIsel62AMPJNV/RtwPf5b7T59f/Ol1oTMkaWEtM
+wYU/2cFTqGjtqeTv7IewTERbqBxJcvIU3pNVHthq/jyiiuaLeAybbx1AZoI3fkY8
+FO1LAtZx1/xZwjqtSuTZn8CbryLoMetpvVqsUlI72FxStQf5JAFjO+H4kWEEORU=
+-----END CERTIFICATE-----

data/spec/support/certs/client_cert.pem

@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDSzCCAjOgAwIBAgIBAjANBgkqhkiG9w0BAQsFADBPMQswCQYDVQQGEwJVUzEg
+MB4GA1UECgwXUGF0cm9uIFRlc3QgQ2VydGlmaWNhdGUxHjAcBgNVBAMMFVBhdHJv
+biBUZXN0IENsaWVudCBDQTAeFw0yNTAxMDEwMDAwMDBaFw00NTAxMDEwMDAwMDBa
+MEwxCzAJBgNVBAYTAlVTMSAwHgYDVQQKDBdQYXRyb24gVGVzdCBDZXJ0aWZpY2F0
+ZTEbMBkGA1UEAwwScGF0cm9uLXRlc3QtY2xpZW50MIIBIjANBgkqhkiG9w0BAQEF
+AAOCAQ8AMIIBCgKCAQEAnp7kL8f5Yk/T6B+IRoLWvCTHeORa4ilp7ixTE4EJOwTB
+atAfnoue4U+xMBAX91oIiGT8u5yKcC+EbvmvcOuOYQPCVXvx3bHBzeTzjBkH37k1
+rBeXVxfhEnkXAANJOccTpPJRH2m+1X/FcXuUNKZOnSrc4G/Gpraj2Opygz8ntxbW
+JR94mz1nkkAILlkCie4VFfSdnxE5ghQSnt8B7W9SdqSKD22NKpBmOff2x5136IEo
+YNK7zYintgJfX6Pa7TR8peEVtAkl3/EjSEoSmfFQVZz2OB7IK3xFT2RyqoC9MjO6
+2mItbD0LgZzTD3f91g00a7z6EjSW8g8QYc5pXSdC1wIDAQABozUwMzAMBgNVHRMB
+Af8EAjAAMA4GA1UdDwEB/wQEAwIFoDATBgNVHSUEDDAKBggrBgEFBQcDAjANBgkq
+hkiG9w0BAQsFAAOCAQEAU/u+MOKWMXQqkPSQx2RjrOale3KKdkHX6LlGfZYjqMhn
+IQjYbEfGtIKyD2MChXrhKMLwuwvMUaCMQWq0r9vZb2cz+AGDS/OzHui/YXgoUU/D
+JOqmT17ClM1JIBZjfbLaogGGY//l4NA48MjhTDHw9MGOnnjzVYUy7CC6qiFu0onC
+Ko+ZE0Ebb3KyjUeJLSCXEhTVW0myGc+/jNRJP0YW/TvxKRZ5EAhaJrLXvKm7tjil
+SZpXBETiXq6eZZsD+XNfQvytBIFO4eBhv3sipQ8Ga30L3SqkMlsb4ptWpa5+z1Vk
+BlkuYdKpPhD/nmx/OfRdfTItDVstm8Q13+MGS5Rokw==
+-----END CERTIFICATE-----

data/spec/support/certs/client_key.pem

@@ -0,0 +1,30 @@
+-----BEGIN RSA PRIVATE KEY-----
+Proc-Type: 4,ENCRYPTED
+DEK-Info: AES-256-CBC,73A5C7F43CBFB22BDECED16E3F6D4014
+
+s2DHo+hKzlo9ZFcql4V84w5c8OADkBHNYp3DJJSII+LSufiNLJ1JVcACEZdr/JsF
+vLKTlCIjExGY1b85GPZ25PArB5jrZvWCcOFfs5PGzr3/ykRTfTMHSXo+WfFwkZ2x
+2k/Zt8yVJ7f69G7EevTtVbkmx/wLMnlTSjMKfzWfs/f57GP+dWM5rHOiMBKK2KhC
+OlD6yhKV4frmF9YTQlslrg5Nmd+3UQsSubT6s4qLByYrLm7pJHB9mx2LNLLQnoxv
+IBIL+FcQRQvLtGGbzV42BHEqr6Kq7aqDf9RT6JohOMdGMYMtABZP9/iOqCUMT2QB
+2/cio1jjgijHqpVBsPg9D493t0fm+1FXLK21wfvQgP6/v0wDB3YKlGlHzWWiVc2f
+4EF/VAyPR8bJwpnZvQpsQ16HEftyyHTbishVbiqzvTNi4HnmSX6WQI2pwFHlF22j
+UWJzSfLqp8NW340zo/EYDAm/dPaqVGR+pVtUEta+oGSI7OQWB3hGt7znSpdgFrah
+i1IOkcu3fie15FzSlBtFhByigtz6iedrTCvYZhfswU4XxJfPJtlVnDubQ9xKDXp6
+3xuy8R4ekMysSOGHq2NdOaYvOoMK8LAJ++KZwEe6UJfBDvEkC23V3mkoCKiUANDY
+GuJ5SOqw6DF6cO/i+StvOuB+2mxMOhR4x893N/ntQrITYldvRh+QHNFoyKc5NUu4
+035ezDVRDR4kzJzzTFfO9yshGFrqb7oyfUegzZMGah1sNn7AWG7AtBSbxSzmRk5s
+0uBrBX7ASfMUGkpUV7BFsvDPi819k5iWLYLFPiFB/CJ5Wq0HHU4j9XDIa/dEuSe+
+0HvQpYf/2IiYocxKxnZOXfdO06cigip1OjxbIXgx1uqrCyzB7c7XMLEUXETpdj1p
+XPCvZ/9BaRNjWvvTrNNB2nMSarFdtjY6pB8bZtP4xObiQ59L3mLoL9/MD87Cnhzn
+Gr8Yr3V5TJk8o60rWNNpaXeCbIlJONFN128uAP8vgjaYviHNb15ViDW1a57fO/OW
+4XOt5jqVDC/NfQXADku7bcs1SPUOKbDgVeYiiq0na3t5yePNRZVcA6FEHuc9hDLi
+T+Fp7bqxXa7pZMn9FOCJ0cRhtoD6LaIqNbtzCIU9u6HBbJkg36Nz7ysh3riYPKBI
+ShLhSb+unI2owdWBi6QwDRus2FtcvPwPNrqtnZ1V5/YyFY6k7ScLR6R67A4ESKNJ
+qIWQ0iCN9nCjbCGpO62e5BzwoVGXiTQK7QK1WPT95+E3Qlv8q6hGi32d5gMUNR1h
+r8OmL+HXMZE2azKJB1mKldYznOYiSIJDjvSp/Jm4A+6zYB6wwiQWwZUUrmW7zbg0
+o7PHImDvRj8hkJlpNRCqLKkyKF+/PaqkFx2dJxJT3xmVJ+H7wqmwhii1Y0RE9YHu
+yzrL7vZpC2a2cjyJnlDG7sX4ZLPNg1vOEXcnKO/6+HHDLkmPQj85+mqHInrTvuca
+GqC/JZeD8FMnpsWQC51ZwThbwlzq91kvFPhSxOqEequ0HP/1K3DdNhxQNKwQseV2
+0jK0rCgibSroD8bE7kghtUPK/fts6XGRqgXmPmx9i3VJGbJw14GvKGp3oyosVEna
+-----END RSA PRIVATE KEY-----

data/spec/support/config.ru

@@ -67,7 +67,7 @@ TimeoutServlet = Proc.new {|env|
 SlowServlet = Proc.new {|env|
   body = Enumerator.new do |y|
     y.yield 'x'
-    sleep 20
+    sleep 5
     y.yield 'rest of body'
   end
   [200, {'Content-Type' => 'text/plain'}, body]
@@ -102,7 +102,13 @@ RepetitiveHeaderServlet = Proc.new {|env|
 }
 
 PictureServlet = Proc.new {|env|
-  [200, {'Content-Type' => 'image/png'}, [File.read('./pic.png')]]
+  # Rack::File allows us to test Range support as well
+  env_with_adjusted_path = env.merge('PATH_INFO' => Rack::Utils.escape('/pic.png'))
+  Rack::File.new('./').call(env_with_adjusted_path)
+}
+
+RedirectToPictureServlet = Proc.new {|env|
+  [307, {'Location' => '/picture'}, []]
 }
 
 WrongContentLengthServlet = Proc.new {|env|
@@ -111,15 +117,22 @@ WrongContentLengthServlet = Proc.new {|env|
 
 # Serves a substantial amount of data
 LargeServlet = Proc.new {|env|
+  rng = Random.new
   len = 15 * 1024 * 1024
   body = Enumerator.new do |y|
     15.times do
-      y.yield(Random.new.bytes(1024 * 1024))
+      y.yield(rng.bytes(1024 * 1024))
     end
   end
   [200, {'Content-Type' => 'binary/octet-stream', 'Content-Length' => len.to_s}, body]
 }
 
+# Echoes the subject of the client certificate Puma verified, if any
+PeerCertServlet = Proc.new {|env|
+  subject = env['puma.peercert'] ? env['puma.peercert'].subject.to_s : 'none'
+  [200, {'Content-Type' => 'text/plain', 'Content-Length' => subject.bytesize.to_s}, [subject]]
+}
+
 run Rack::URLMap.new({
   "/" => Proc.new {|env| [200, {'Content-Length' => '2'}, ['Welcome']]},
   "/test" => Readback,
@@ -130,9 +143,11 @@ run Rack::URLMap.new({
   "/redirect" => RedirectServlet,
   "/evil-redirect" => EvilRedirectServlet,
   "/picture" => PictureServlet,
+  "/redirect-to-picture" => RedirectToPictureServlet,
   "/very-large" => LargeServlet,
   "/setcookie" => SetCookieServlet,
   "/repetitiveheader" => RepetitiveHeaderServlet,
   "/wrongcontentlength" => WrongContentLengthServlet,
   "/gzip-compressed" => GzipServlet,  
+  "/peercert" => PeerCertServlet,
 })

data/spec/support/fork.rb

@@ -0,0 +1,70 @@
+require 'thread'
+
+class Fork
+  def initialize(&block)
+    @mu = Mutex.new
+    @cond = ConditionVariable.new
+    @pstate = nil
+    @pid = Process.fork(&block)
+    @killed = false
+
+    # Start monitoring the PID.
+    Thread.new { monitor }
+
+    # Kill the process anyway when the program exits.
+    ppid = Process.pid
+    at_exit do
+      if ppid == Process.pid # Make sure we are not inside another fork spawned by rspec example.
+        do_kill("KILL")
+      end
+    end
+  end
+
+  # Wait for process to exit.
+  def wait(timeout = nil)
+    @mu.synchronize do
+      next @pstate unless @pstate.nil?
+
+      @cond.wait(@mu, timeout)
+      @pstate
+    end
+  end
+
+  # Signal the process.
+  def kill(sig)
+    already_killed = @mu.synchronize do
+      old = @killed
+      @killed = true
+      old
+    end
+    signaled = do_kill(sig)
+    Thread.new { reaper } if signaled && !already_killed
+    signaled
+  end
+
+  private
+
+  # Signal the process.
+  def do_kill(sig)
+    Process.kill(sig, @pid)
+    true
+  rescue Errno::ESRCH # No such process
+    false
+  end
+
+  # Monitor the process state.
+  def monitor
+    _, pstate = Process.wait2(@pid)
+
+    @mu.synchronize do
+      @pstate = pstate
+      @cond.broadcast
+    end
+  end
+
+  # Wait 500 milliseconds and force terminate.
+  def reaper
+    pstate = wait(0.5)
+    do_kill("KILL") unless pstate
+  end
+end

data/spec/support/raw_request_capture.rb

@@ -0,0 +1,93 @@
+require 'socket'
+require 'openssl'
+require 'stringio'
+
+# Captures the raw HTTP request a client puts on the wire, independent of any
+# Rack/HTTP server. This lets us assert on hop-by-hop details such as
+# Transfer-Encoding which a conformant server (webrick, puma, ...) decodes and
+# never exposes to the application.
+module RawRequestCapture
+  CapturedRequest = Struct.new(:request_line, :headers, :body)
+
+  CERT_DIR = File.join(__dir__, 'certs')
+
+  # Boots a one-shot capture server on an ephemeral port, yields its base URL to
+  # the block (which must perform a single request against it) and returns the
+  # CapturedRequest. Pass ssl: true to terminate TLS using the test certificates.
+  def capture_request(ssl: false)
+    tcp = TCPServer.new('127.0.0.1', 0)
+    port = tcp.addr[1]
+    server = ssl ? wrap_tls(tcp) : tcp
+    captured = nil
+    acceptor = Thread.new do
+      conn = server.accept
+      captured = read_request(conn)
+      conn.write("HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\nok")
+      conn.close
+    end
+    yield "#{ssl ? 'https' : 'http'}://127.0.0.1:#{port}"
+    acceptor.join(5)
+    captured
+  ensure
+    tcp.close if tcp
+  end
+
+  private
+
+  def wrap_tls(tcp)
+    ctx = OpenSSL::SSL::SSLContext.new
+    ctx.cert = OpenSSL::X509::Certificate.new(File.read(File.join(CERT_DIR, 'cacert.pem')))
+    ctx.key = OpenSSL::PKey.read(File.read(File.join(CERT_DIR, 'privkey.pem')))
+    OpenSSL::SSL::SSLServer.new(tcp, ctx)
+  end
+
+  def read_request(conn)
+    buf = +''
+    buf << conn.readpartial(4096) until buf.include?("\r\n\r\n")
+    head, rest = buf.split("\r\n\r\n", 2)
+    request_line, *header_lines = head.split("\r\n")
+    headers = header_lines.each_with_object({}) do |line, acc|
+      name, value = line.split(': ', 2)
+      acc[name.downcase] = value
+    end
+    # Honour Expect: 100-continue so the client proceeds to send the body.
+    conn.write("HTTP/1.1 100 Continue\r\n\r\n") if headers['expect'].to_s =~ /100-continue/i
+    CapturedRequest.new(request_line, headers, read_body(conn, headers, rest))
+  end
+
+  def read_body(conn, headers, rest)
+    if headers['transfer-encoding'] == 'chunked'
+      dechunk(drain_chunked(conn, rest))
+    elsif (len = headers['content-length'])
+      read_exactly(conn, len.to_i, rest)
+    else
+      rest
+    end
+  end
+
+  def drain_chunked(conn, rest)
+    buf = rest.dup
+    buf << conn.readpartial(4096) until buf.include?("0\r\n\r\n")
+    buf
+  end
+
+  def read_exactly(conn, n, rest)
+    buf = rest.dup
+    buf << conn.readpartial(4096) while buf.bytesize < n
+    buf.byteslice(0, n)
+  end
+
+  def dechunk(buf)
+    io = StringIO.new(buf)
+    out = +''
+    while (size_line = io.gets("\r\n"))
+      size = size_line.strip.split(';', 2).first.to_i(16)
+      break if size.zero?
+      out << io.read(size).to_s
+      io.read(2) # trailing CRLF
+    end
+    out
+  end
+end
+
+RSpec.configure { |c| c.include RawRequestCapture }