patron 0.13.4 → 0.14.0

data/lib/patron/error.rb

@@ -36,6 +36,10 @@ module Patron
   # Gets raised if the progress callback, or an interrupt, aborts the Curl perform() call
   class Aborted                < Error; end
 
+  # Gets raised when the client certificate or its private key could not be used,
+  # for example when the key password is wrong or the certificate file is missing.
+  class ClientCertificateError < Error; end
+
   # Gets raised when the server specifies an encoding that could not be found, or has an invalid name,
   # or when the server "lies" about the encoding of the response body (such as can be the case
   # when the server specifies an encoding in `Content-Type`) which the HTML generator then overrides

data/lib/patron/request.rb

@@ -25,13 +25,13 @@ module Patron
       :ignore_content_length, :multipart, :action, :timeout, :connect_timeout, :dns_cache_timeout,
       :max_redirects, :headers, :auth_type, :upload_data, :buffer_size, :cacert,
       :ssl_version, :http_version, :automatic_content_encoding, :force_ipv4, :download_byte_limit,
-      :low_speed_time, :low_speed_limit, :progress_callback
+      :low_speed_time, :low_speed_limit, :progress_callback, :ssl_cert, :ssl_cert_type, :ssl_key, :ssl_key_password
     ]
 
     WRITER_VARS = [
       :url, :username, :password, :file_name, :proxy, :proxy_type, :insecure, :dns_cache_timeout,
       :ignore_content_length, :multipart, :cacert, :ssl_version, :http_version, :automatic_content_encoding, :force_ipv4, :download_byte_limit,
-      :low_speed_time, :low_speed_limit, :progress_callback
+      :low_speed_time, :low_speed_limit, :progress_callback, :ssl_cert, :ssl_cert_type, :ssl_key, :ssl_key_password
     ]
 
     attr_reader(*READER_VARS)
@@ -181,7 +181,8 @@ module Patron
     def marshal_dump
       [ @url, @username, @password, @file_name, @proxy, @proxy_type, @insecure,
         @ignore_content_length, @multipart, @action, @timeout, @connect_timeout,
-        @max_redirects, @headers, @auth_type, @upload_data, @buffer_size, @cacert ]
+        @max_redirects, @headers, @auth_type, @upload_data, @buffer_size, @cacert,
+        @ssl_cert, @ssl_cert_type, @ssl_key, @ssl_key_password ]
     end
 
     # Reinstates instance variables from a marshaled representation
@@ -190,7 +191,8 @@ module Patron
     def marshal_load(data)
       @url, @username, @password, @file_name, @proxy, @proxy_type, @insecure,
       @ignore_content_length, @multipart, @action, @timeout, @connect_timeout,
-      @max_redirects, @headers, @auth_type, @upload_data, @buffer_size, @cacert = data
+      @max_redirects, @headers, @auth_type, @upload_data, @buffer_size, @cacert,
+      @ssl_cert, @ssl_cert_type, @ssl_key, @ssl_key_password = data
     end
 
   end

data/lib/patron/response.rb

@@ -28,6 +28,11 @@ module Patron
     #    to be a valid charset name, just stored. To check the charset for validity, use #body_decodable?
     attr_reader :charset
 
+    # @return [Hash{Symbol => Float}, nil] curl's cumulative transfer marks in seconds since the request
+    #   started: `:namelookup`, `:connect`, `:appconnect`, `:pretransfer`, `:starttransfer`, `:redirect`
+    #   and `:total`. `nil` when the response was not built from a curl transfer (e.g. a stub).
+    attr_reader :timings
+
     # Overridden so that the output is shorter and there is no response body printed
     def inspect
       # Avoid spamming the console with the header and body data

data/lib/patron/session.rb

@@ -67,6 +67,19 @@ module Patron
     # @return [String] path to the CA file used for certificate verification, or `nil` if CURL default is used
     attr_accessor :cacert
 
+    # @return [String] path to the client SSL certificate file, or `nil` if no client certificate is used
+    attr_accessor :ssl_cert
+
+    # @return [String] the client SSL certificate file type: "PEM" (the libcurl default), "DER" or "P12" (PKCS#12)
+    attr_accessor :ssl_cert_type
+
+    # @return [String] path to the PEM private key for the client SSL certificate, if it is not bundled with
+    #   the certificate itself (as it is with PKCS#12)
+    attr_accessor :ssl_key
+
+    # @return [String] the password for the client SSL certificate private key
+    attr_accessor :ssl_key_password
+
     # @return [Boolean] whether Content-Range and Content-Length headers should be ignored
     attr_accessor :ignore_content_length
 
@@ -376,6 +389,10 @@ module Patron
         req.ssl_version            = options.fetch :ssl_version,           self.ssl_version
         req.http_version           = options.fetch :http_version,          self.http_version
         req.cacert                 = options.fetch :cacert,                self.cacert
+        req.ssl_cert               = options.fetch :ssl_cert,              self.ssl_cert
+        req.ssl_cert_type          = options.fetch :ssl_cert_type,         self.ssl_cert_type
+        req.ssl_key                = options.fetch :ssl_key,               self.ssl_key
+        req.ssl_key_password       = options.fetch :ssl_key_password,      self.ssl_key_password
         req.ignore_content_length  = options.fetch :ignore_content_length, self.ignore_content_length
         req.buffer_size            = options.fetch :buffer_size,           self.buffer_size
         req.download_byte_limit    = options.fetch :download_byte_limit,   self.download_byte_limit

data/lib/patron/version.rb

@@ -1,3 +1,3 @@
 module Patron
-  VERSION = "0.13.4"
+  VERSION = "0.14.0"
 end

data/patron.gemspec

@@ -22,7 +22,8 @@ Gem::Specification.new do |spec|
     raise "RubyGems 2.0 or newer is required to protect against public gem pushes."
   end
 
-  spec.required_rubygems_version = ">= 1.2.0"
+  spec.required_rubygems_version = ">= 2.5.0"
+  spec.required_ruby_version = ">= 2.3"
 
   spec.files         = `git ls-files -z`.split("\x0")
   spec.bindir        = "exe"

data/script/generate_client_certs

@@ -0,0 +1,65 @@
+#!/usr/bin/env ruby
+# Regenerates the client certificate fixtures used by the mutual TLS specs
+require 'openssl'
+
+DIR = File.expand_path('../spec/support/certs', __dir__)
+PASSWORD = 'patron'
+NOT_BEFORE = Time.utc(2025, 1, 1)
+NOT_AFTER = Time.utc(2045, 1, 1)
+
+def name(cn)
+  OpenSSL::X509::Name.parse("/C=US/O=Patron Test Certificate/CN=#{cn}")
+end
+
+def make_ca(cn)
+  key = OpenSSL::PKey::RSA.new(2048)
+  cert = OpenSSL::X509::Certificate.new
+  cert.version = 2
+  cert.serial = 1
+  cert.subject = name(cn)
+  cert.issuer = cert.subject
+  cert.public_key = key.public_key
+  cert.not_before = NOT_BEFORE
+  cert.not_after = NOT_AFTER
+  ef = OpenSSL::X509::ExtensionFactory.new(cert, cert)
+  cert.add_extension(ef.create_extension('basicConstraints', 'CA:TRUE', true))
+  cert.add_extension(ef.create_extension('keyUsage', 'keyCertSign,cRLSign', true))
+  cert.add_extension(ef.create_extension('subjectKeyIdentifier', 'hash'))
+  cert.sign(key, OpenSSL::Digest::SHA256.new)
+  [cert, key]
+end
+
+def make_client(ca, ca_key)
+  key = OpenSSL::PKey::RSA.new(2048)
+  cert = OpenSSL::X509::Certificate.new
+  cert.version = 2
+  cert.serial = 2
+  cert.subject = name('patron-test-client')
+  cert.issuer = ca.subject
+  cert.public_key = key.public_key
+  cert.not_before = NOT_BEFORE
+  cert.not_after = NOT_AFTER
+  ef = OpenSSL::X509::ExtensionFactory.new(ca, cert)
+  cert.add_extension(ef.create_extension('basicConstraints', 'CA:FALSE', true))
+  cert.add_extension(ef.create_extension('keyUsage', 'digitalSignature,keyEncipherment', true))
+  cert.add_extension(ef.create_extension('extendedKeyUsage', 'clientAuth'))
+  cert.sign(ca_key, OpenSSL::Digest::SHA256.new)
+  [cert, key]
+end
+
+def write_p12(filename, cert, key)
+  p12 = OpenSSL::PKCS12.create(PASSWORD, 'patron-test-client', key, cert, nil, 'PBE-SHA1-3DES', 'PBE-SHA1-3DES')
+  File.binwrite(File.join(DIR, filename), p12.to_der)
+end
+
+ca, ca_key = make_ca('Patron Test Client CA')
+client, client_key = make_client(ca, ca_key)
+File.write(File.join(DIR, 'client_ca.pem'), ca.to_pem)
+File.write(File.join(DIR, 'client_cert.pem'), client.to_pem)
+File.write(File.join(DIR, 'client_key.pem'), client_key.export(OpenSSL::Cipher.new('aes-256-cbc'), PASSWORD))
+write_p12('client.p12', client, client_key)
+
+# Same subject as the real client certificate, but signed by a CA the test server does not trust
+rogue_ca, rogue_ca_key = make_ca('Patron Rogue CA')
+rogue, rogue_key = make_client(rogue_ca, rogue_ca_key)
+write_p12('rogue_client.p12', rogue, rogue_key)

data/spec/request_spec.rb

@@ -74,4 +74,16 @@ describe Patron::Request do
   it "should be able to serialize and deserialize itself" do
     expect(Marshal.load(Marshal.dump(@request))).to eql(@request)
   end
+
+  it "should preserve the client certificate settings when serialized" do
+    @request.ssl_cert = "client.pem"
+    @request.ssl_cert_type = "PEM"
+    @request.ssl_key = "client_key.pem"
+    @request.ssl_key_password = "secret"
+    restored = Marshal.load(Marshal.dump(@request))
+    expect(restored.ssl_cert).to eq("client.pem")
+    expect(restored.ssl_cert_type).to eq("PEM")
+    expect(restored.ssl_key).to eq("client_key.pem")
+    expect(restored.ssl_key_password).to eq("secret")
+  end
 end

data/spec/session_spec.rb

@@ -4,6 +4,7 @@ require 'yaml'
 require 'base64'
 require 'fileutils'
 require 'securerandom'
+require 'timeout'
 
 describe Patron::Session do
 
@@ -67,6 +68,16 @@ describe Patron::Session do
       unescaped = @session.unescape(escaped)
       expect(unescaped).to be == string
     end
+
+    it "unescapes a %00 to a NUL byte instead of cutting the string there" do
+      expect(@session.unescape("a%00b").b).to be == "a\0b".b
+      expect(@session.escape("a\0b")).to be == "a%00b"
+    end
+
+    it "rejects a file path with an embedded NUL byte" do
+      expect { @session.enable_debug("/tmp/x\0y") }.to raise_error(ArgumentError)
+      expect { @session.handle_cookies("/tmp/x\0y") }.to raise_error(ArgumentError)
+    end
   end
   
   it "should raise an error when passed an invalid action" do
@@ -84,6 +95,19 @@ describe Patron::Session do
     expect(body.request_method).to be == "GET"
   end
 
+  it "should expose curl's cumulative transfer timings" do
+    timings = @session.get("/test").timings
+
+    expect(timings.keys).to contain_exactly(
+      :namelookup, :connect, :appconnect, :pretransfer, :starttransfer, :redirect, :total
+    )
+    expect(timings.values).to all(be_a(Float).and(be >= 0))
+    expect(timings[:namelookup]).to be <= timings[:connect]
+    expect(timings[:connect]).to be <= timings[:starttransfer]
+    expect(timings[:starttransfer]).to be <= timings[:total]
+    expect(timings[:total]).to be > 0
+  end
+
   it "should use full base url" do
     @session.base_url = "http://localhost:9001/api/v1"
     response = @session.get("/test")
@@ -170,6 +194,14 @@ describe Patron::Session do
     # on 1.9 it will be Patron::PartialFileError
   end
 
+  it "accepts a download body limit above 2 GiB and timeouts given as Floats" do
+    @session.download_byte_limit = 5 * 1024 * 1024 * 1024
+    @session.dns_cache_timeout = 2.5
+    @session.low_speed_time = 2.5
+    @session.low_speed_limit = 1.5
+    expect(@session.get("/test").status).to be == 200
+  end
+
   it "should not send the user-agent if it has been deleted from headers" do
     @session.headers.delete 'User-Agent'
     response = @session.get("/test")
@@ -219,7 +251,7 @@ describe Patron::Session do
     expect {@session.get("/timeout?millis=400")}.to raise_error(Patron::TimeoutError)
   end
 
-  it "should raise an exception on timeout when reading from a slow resource and low speed limit is set" do
+  it "should raise an exception on timeout when reading from a slow resource and low speed limit is set", :timing do
     @session.timeout = 10 # Greater than the low_speed_time
     @session.low_speed_time = 2
     @session.low_speed_limit = 10
@@ -233,7 +265,7 @@ describe Patron::Session do
     expect(delta_s).to be_within(0.1).of(2).or be_within(0.1).of(3)
   end
 
-  it "is able to terminate the thread that is running a slow request using Thread#kill (uses the custom unblock)" do
+  it "is able to terminate the thread that is running a slow request using Thread#kill (uses the custom unblock)", :timing do
     t = Thread.new do
       session = Patron::Session.new
       session.timeout = 10 # Greater than the sleep duration
@@ -253,7 +285,7 @@ describe Patron::Session do
     expect(delta_s).to be_within(0.1).of(2).or be_within(0.1).of(3)
   end
 
-  it "is able to terminate the process that is running a slow request with SIGINT" do
+  it "is able to terminate the process that is running a slow request with SIGINT", :timing do
     pid = Process.fork do
       trap('SIGINT') do
         exit # exit the process
@@ -292,6 +324,64 @@ describe Patron::Session do
     expect(callback_args).not_to be_empty
   end
 
+  it "propagates an exception raised in the progress callback and keeps the session usable" do
+    session = Patron::Session.new
+    session.timeout = 10
+    session.base_url = "http://localhost:9001"
+    boom = Class.new(StandardError)
+    session.progress_callback = Proc.new { raise boom, "from the callback" }
+
+    expect { session.get("/slow") }.to raise_error(boom, "from the callback")
+
+    session.progress_callback = nil
+    expect(session.get("/test").status).to be == 200
+  end
+
+  it "lets a throw from the progress callback unwind to the catch around the request" do
+    # Timeout.timeout on Rubies before 3.1 unwinds with throw rather than raise
+    session = Patron::Session.new
+    session.timeout = 10
+    session.base_url = "http://localhost:9001"
+    session.progress_callback = Proc.new { throw :stop_right_there, :thrown }
+
+    expect(catch(:stop_right_there) { session.get("/slow") }).to be == :thrown
+
+    session.progress_callback = nil
+    expect(session.get("/test").status).to be == 200
+  end
+
+  it "can be interrupted with Timeout.timeout while a progress callback is set", :timing do
+    session = Patron::Session.new
+    session.timeout = 10
+    session.base_url = "http://localhost:9001"
+    session.progress_callback = Proc.new { |*| }
+
+    started = Time.now.to_f
+    expect { Timeout.timeout(1) { session.get("/slow") } }.to raise_error(Timeout::Error)
+    expect(Time.now.to_f - started).to be < 3
+
+    session.progress_callback = nil
+    expect(session.get("/test").status).to be == 200
+  end
+
+  it "raises the right exception class after the heap has been compacted" do
+    # The exception classes are looked up from C once at load time; if they
+    # were not registered with the GC, compaction would move them away
+    skip "no compaction on this Ruby" unless GC.respond_to?(:verify_compaction_references)
+    begin
+      begin
+        GC.verify_compaction_references(expand_heap: true, toward: :empty)
+      rescue ArgumentError # expand_heap: is double_heap: on Rubies before 3.2
+        GC.verify_compaction_references(double_heap: true, toward: :empty)
+      end
+    rescue NotImplementedError
+      skip "compaction is not supported on this platform"
+    end
+
+    session = Patron::Session.new
+    expect { session.get("http://localhost:1/") }.to raise_error(Patron::ConnectionFailed)
+  end
+
   it "should follow redirects by default" do
     @session.max_redirects = 1
     response = @session.get("/redirect")
@@ -405,6 +495,26 @@ describe Patron::Session do
     expect(body.header['content-length']).to be == [data.size.to_s]
   end
 
+  it "keeps a request body built by #to_s alive for the duration of the transfer" do
+    # The body only exists as the return value of #to_s, and libcurl reads it
+    # while the GVL is released - GC.stress makes that window reliable
+    payload = Random.new.bytes(64 * 1024)
+    body_object = Object.new
+    body_object.define_singleton_method(:to_s) { payload + '' }
+
+    begin
+      GC.stress = true
+      [:post, :put, :delete].each do |verb|
+        response = @session.request(verb, "/test", {}, :data => body_object)
+        body = yaml_load(response.body)
+        expect(body.request_method).to be == verb.to_s.upcase
+        expect(body.body.b).to be == payload
+      end
+    ensure
+      GC.stress = false
+    end
+  end
+
   it "should raise when no data is provided to :put" do
     expect { @session.put("/test", nil) }.to raise_error(ArgumentError)
   end
@@ -419,10 +529,20 @@ describe Patron::Session do
     expect { @session.put_file("/test", nil) }.to raise_error(ArgumentError)
   end
 
-  it "should use chunked encoding when uploading a file with :put" do
-    response = @session.put_file("/test", "LICENSE")
-    body = yaml_load(response.body)
-    expect(body.header['transfer-encoding'].first).to be == "chunked"
+  it "should upload a file with :put using chunked transfer-encoding" do
+    # Transfer-Encoding is a hop-by-hop header (RFC 7230 3.3.1): a conformant server
+    # decodes the chunked framing and never exposes the header to the application, so
+    # we capture the raw request to assert how Patron actually frames the upload.
+    captured = capture_request do |url|
+      session = Patron::Session.new
+      session.base_url = url
+      session.timeout = 5
+      session.put_file("/test", "LICENSE")
+    end
+    expect(captured.request_line).to start_with("PUT ")
+    expect(captured.headers["transfer-encoding"]).to be == "chunked"
+    expect(captured.headers).to_not have_key("content-length")
+    expect(captured.body.bytesize).to be == File.size("LICENSE")
   end
   
   it "should call to_s on the data being uploaded via POST if it is not already a String" do
@@ -465,14 +585,36 @@ describe Patron::Session do
     expect(body.request_method).to be == "POST"
   end
 
+  it "sends multipart field names and binary values intact" do
+    # A Symbol key gets stringified into a temporary libcurl must copy,
+    # and a value with NUL bytes must survive past the first one
+    value = "before\0middle\0after".b
+    response = @session.post_multipart("/test", { :sym_key => value }, { :test_file => "LICENSE" })
+    body = yaml_load(response.body)
+    raw = body.body.b
+    expect(raw).to include('name="sym_key"')
+    expect(raw).to include(value)
+    expect(raw).to include('name="test_file"; filename="LICENSE"')
+    expect(raw).to include(File.read("LICENSE").b)
+  end
+
   it "should raise when no file is provided to :post" do
     expect { @session.post_file("/test", nil) }.to raise_error(ArgumentError)
   end
 
-  it "should use chunked encoding when uploading a file with :post" do
-    response = @session.post_file("/test", "LICENSE")
-    body = yaml_load(response.body)
-    expect(body.header['transfer-encoding'].first).to be == "chunked"
+  it "should upload a file with :post using chunked transfer-encoding" do
+    # See the :put counterpart above: Transfer-Encoding is hop-by-hop and invisible
+    # to the application, so we capture the raw request to assert the framing.
+    captured = capture_request do |url|
+      session = Patron::Session.new
+      session.base_url = url
+      session.timeout = 5
+      session.post_file("/test", "LICENSE")
+    end
+    expect(captured.request_line).to start_with("POST ")
+    expect(captured.headers["transfer-encoding"]).to be == "chunked"
+    expect(captured.headers).to_not have_key("content-length")
+    expect(captured.body.bytesize).to be == File.size("LICENSE")
   end
 
   it "should pass credentials as http basic auth" do
@@ -526,6 +668,31 @@ describe Patron::Session do
     expect { @session.handle_cookies("/trash/clash/foo") }.to raise_error(ArgumentError)
   end
 
+  it "refuses to run two requests on one Session from two threads at the same time" do
+    session = Patron::Session.new
+    session.timeout = 10
+    session.base_url = "http://localhost:9001"
+
+    outcomes = Array.new(2) do
+      Thread.new do
+        begin
+          session.get("/slow")
+          :completed
+        rescue Patron::Error => e
+          e
+        end
+      end
+    end.map(&:value)
+
+    refused = outcomes.grep(Patron::Error)
+    expect(refused.size).to be == 1
+    expect(refused.first.message).to include("another thread")
+    expect(outcomes - refused).to be == [:completed]
+
+    # ...and is free again once the in-flight request is done
+    expect(session.get("/test").status).to be == 200
+  end
+
   it "should work with multiple threads" do
     threads = []
     3.times do

data/spec/session_ssl_spec.rb

@@ -18,6 +18,8 @@ describe Patron::Session do
     @session = Patron::Session.new
     @session.base_url = "https://localhost:9043"
     @session.insecure = true
+    # The first TLS handshake takes a few seconds when both ends run under valgrind
+    @session.connect_timeout = 10
   end
 
   it "should retrieve a url with :get" do
@@ -161,10 +163,21 @@ describe Patron::Session do
     expect { @session.put_file("/test", nil) }.to raise_error(ArgumentError)
   end
 
-  it "should use chunked encoding when uploading a file with :put" do
-    response = @session.put_file("/test", "LICENSE")
-    body = yaml_load(response.body)
-    expect(body.header['transfer-encoding'].first).to be == "chunked"
+  it "should upload a file with :put using chunked transfer-encoding" do
+    # Transfer-Encoding is a hop-by-hop header (RFC 7230 3.3.1): a conformant server
+    # decodes the chunked framing and never exposes the header to the application, so
+    # we capture the raw request to assert how Patron actually frames the upload.
+    captured = capture_request(ssl: true) do |url|
+      session = Patron::Session.new
+      session.base_url = url
+      session.insecure = true
+      session.timeout = 5
+      session.put_file("/test", "LICENSE")
+    end
+    expect(captured.request_line).to start_with("PUT ")
+    expect(captured.headers["transfer-encoding"]).to be == "chunked"
+    expect(captured.headers).to_not have_key("content-length")
+    expect(captured.body.bytesize).to be == File.size("LICENSE")
   end
 
   it "should upload data with :post" do
@@ -204,10 +217,20 @@ describe Patron::Session do
     expect { @session.post_file("/test", nil) }.to raise_error(ArgumentError)
   end
 
-  it "should use chunked encoding when uploading a file with :post" do
-    response = @session.post_file("/test", "LICENSE")
-    body = yaml_load(response.body)
-    expect(body.header['transfer-encoding'].first).to be == "chunked"
+  it "should upload a file with :post using chunked transfer-encoding" do
+    # See the :put counterpart above: Transfer-Encoding is hop-by-hop and invisible
+    # to the application, so we capture the raw request to assert the framing.
+    captured = capture_request(ssl: true) do |url|
+      session = Patron::Session.new
+      session.base_url = url
+      session.insecure = true
+      session.timeout = 5
+      session.post_file("/test", "LICENSE")
+    end
+    expect(captured.request_line).to start_with("POST ")
+    expect(captured.headers["transfer-encoding"]).to be == "chunked"
+    expect(captured.headers).to_not have_key("content-length")
+    expect(captured.body.bytesize).to be == File.size("LICENSE")
   end
 
   it "should handle cookies if set" do
@@ -310,4 +333,99 @@ describe Patron::Session do
     end
   end
 
+  describe 'with a server that requires a client certificate' do
+    let(:certs) { File.join(__dir__, 'support', 'certs') }
+
+    # libcurl's GnuTLS backend reports any client certificate it can't load as CURLE_SSL_CONNECT_ERROR
+    let(:gnutls) { Patron.libcurl_version.include?('GnuTLS') }
+
+    def refused_by_server
+      raise_error { |e|
+        expect(e).to be_kind_of(Patron::Error)
+        expect(e).not_to be_kind_of(Patron::ClientCertificateError)
+        expect(e).not_to be_kind_of(Patron::TimeoutError)
+      }
+    end
+
+    before(:each) do
+      @session.base_url = "https://localhost:9044"
+      @session.insecure = false
+      @session.cacert = File.join(certs, 'cacert.pem')
+    end
+
+    it "presents a PKCS#12 client certificate" do
+      @session.ssl_cert = File.join(certs, 'client.p12')
+      @session.ssl_cert_type = 'P12'
+      @session.ssl_key_password = 'patron'
+      response = @session.get("/peercert")
+      expect(response.status).to be == 200
+      expect(response.body).to include('CN=patron-test-client')
+    end
+
+    it "presents a PEM client certificate with a separate encrypted key" do
+      @session.ssl_cert = File.join(certs, 'client_cert.pem')
+      @session.ssl_cert_type = 'PEM'
+      @session.ssl_key = File.join(certs, 'client_key.pem')
+      @session.ssl_key_password = 'patron'
+      response = @session.get("/peercert")
+      expect(response.status).to be == 200
+      expect(response.body).to include('CN=patron-test-client')
+    end
+
+    it "accepts the client certificate as a per-request option" do
+      response = @session.request(:get, "/peercert", {},
+        ssl_cert: File.join(certs, 'client.p12'), ssl_cert_type: 'P12', ssl_key_password: 'patron')
+      expect(response.body).to include('CN=patron-test-client')
+    end
+
+    it "accepts Pathnames for the certificate and key and a Symbol for the type" do
+      @session.cacert = Pathname(certs).join('cacert.pem')
+      @session.ssl_cert = Pathname(certs).join('client_cert.pem')
+      @session.ssl_cert_type = :PEM
+      @session.ssl_key = Pathname(certs).join('client_key.pem')
+      @session.ssl_key_password = 'patron'
+      response = @session.get("/peercert")
+      expect(response.body).to include('CN=patron-test-client')
+    end
+
+    it "does not leak a failed request's options into the next one" do
+      @session.ssl_cert = File.join(certs, 'client.p12')
+      @session.ssl_cert_type = 'P12'
+      @session.ssl_key_password = 'patron'
+      expect {
+        @session.request(:get, "/test", {'X-Leaked' => 'yes'}, ssl_key_password: 1234)
+      }.to raise_error(TypeError)
+
+      body = yaml_load(@session.get("/test").body)
+      expect(body.header).not_to have_key('x-leaked')
+    end
+
+    it "raises ClientCertificateError when the key password is wrong" do
+      skip "GnuTLS does not tell this apart from a handshake failure" if gnutls
+      @session.ssl_cert = File.join(certs, 'client.p12')
+      @session.ssl_cert_type = 'P12'
+      @session.ssl_key_password = 'wrong'
+      expect { @session.get("/peercert") }.to raise_error(Patron::ClientCertificateError)
+    end
+
+    it "raises ClientCertificateError when the certificate file does not exist" do
+      skip "GnuTLS does not tell this apart from a handshake failure" if gnutls
+      @session.ssl_cert = File.join(certs, 'nonexistent.p12')
+      @session.ssl_cert_type = 'P12'
+      @session.ssl_key_password = 'patron'
+      expect { @session.get("/peercert") }.to raise_error(Patron::ClientCertificateError)
+    end
+
+    it "fails when the server does not trust the client certificate" do
+      @session.ssl_cert = File.join(certs, 'rogue_client.p12')
+      @session.ssl_cert_type = 'P12'
+      @session.ssl_key_password = 'patron'
+      expect { @session.get("/peercert") }.to refused_by_server
+    end
+
+    it "fails when no client certificate is presented" do
+      # Depending on the TLS version the server rejects us either during or right after the handshake
+      expect { @session.get("/peercert") }.to refused_by_server
+    end
+  end
 end

data/spec/spec_helper.rb

@@ -24,11 +24,17 @@ sleep 0.1 # Don't interfere the start up output of two processes.
 
 https_server = Fork.new { PatronTestServer.start(true, 9043) }
 
+mtls_server = Fork.new do
+  PatronTestServer.start(true, 9044, client_ca: File.join(__dir__, 'support', 'certs', 'client_ca.pem'))
+end
+
 RSpec.configure do |c|
   c.after(:suite) do
     http_server.kill("TERM")
     https_server.kill("TERM")
+    mtls_server.kill("TERM")
     http_server.wait
     https_server.wait
+    mtls_server.wait
   end
 end

data/spec/support/certs/client_ca.pem

@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDWzCCAkOgAwIBAgIBATANBgkqhkiG9w0BAQsFADBPMQswCQYDVQQGEwJVUzEg
+MB4GA1UECgwXUGF0cm9uIFRlc3QgQ2VydGlmaWNhdGUxHjAcBgNVBAMMFVBhdHJv
+biBUZXN0IENsaWVudCBDQTAeFw0yNTAxMDEwMDAwMDBaFw00NTAxMDEwMDAwMDBa
+ME8xCzAJBgNVBAYTAlVTMSAwHgYDVQQKDBdQYXRyb24gVGVzdCBDZXJ0aWZpY2F0
+ZTEeMBwGA1UEAwwVUGF0cm9uIFRlc3QgQ2xpZW50IENBMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEA1iqOoIm5gW9MP0onsmSuOdlAdFZkP5r7rRSn+100
+5ceHDpRdaR+k8ZIoi7noesryrf7ibZL+9VzZEBGlCcUGEIjQjL/BHsHa5vLfAJnT
+0zbeQFk5MjGZOUPXC33CgidsxF3DsRFDNmOqGBiCf3A/ae/VOMDEyv6aFdKc6JQC
+OoudnCGzVNJuLIa+/yGx9HhIjobbYGuZ7gwLjJk3HW9WixTupUKJME9f7cTIPW+k
+ahw7ZQGzIUHejqy8cDnmBRYNpZ8NU5oTuhr5NFDWhOSGfM70NYFlGDifI2kMPhdc
+s4nEUajG1b3NLBfKMM1HioqG2ivMQv6WNRWGJCn3sdJEXQIDAQABo0IwQDAPBgNV
+HRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUd1Pmdua66Xyn
+qKIbXkVUC389WA8wDQYJKoZIhvcNAQELBQADggEBAD+6HGi8mdkHDnegma3AvQ0K
+4EoTtKljui93zVhsaXpycr/UtOe7p6jBApBdh93up6Fx9cYu2OtTLh0t9rnLXBWD
+GZQt1jajEwvdRg2ncFfoWkxeftUttd5uTVMN6Apv3nGw3VXZnNmVaRyZnGG5j1JO
+lnN94DfE37MyePhuFCDd5RZXegIsel62AMPJNV/RtwPf5b7T59f/Ol1oTMkaWEtM
+wYU/2cFTqGjtqeTv7IewTERbqBxJcvIU3pNVHthq/jyiiuaLeAybbx1AZoI3fkY8
+FO1LAtZx1/xZwjqtSuTZn8CbryLoMetpvVqsUlI72FxStQf5JAFjO+H4kWEEORU=
+-----END CERTIFICATE-----