patron 0.13.4 → 0.14.0

data/spec/support/certs/client_cert.pem

@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDSzCCAjOgAwIBAgIBAjANBgkqhkiG9w0BAQsFADBPMQswCQYDVQQGEwJVUzEg
+MB4GA1UECgwXUGF0cm9uIFRlc3QgQ2VydGlmaWNhdGUxHjAcBgNVBAMMFVBhdHJv
+biBUZXN0IENsaWVudCBDQTAeFw0yNTAxMDEwMDAwMDBaFw00NTAxMDEwMDAwMDBa
+MEwxCzAJBgNVBAYTAlVTMSAwHgYDVQQKDBdQYXRyb24gVGVzdCBDZXJ0aWZpY2F0
+ZTEbMBkGA1UEAwwScGF0cm9uLXRlc3QtY2xpZW50MIIBIjANBgkqhkiG9w0BAQEF
+AAOCAQ8AMIIBCgKCAQEAnp7kL8f5Yk/T6B+IRoLWvCTHeORa4ilp7ixTE4EJOwTB
+atAfnoue4U+xMBAX91oIiGT8u5yKcC+EbvmvcOuOYQPCVXvx3bHBzeTzjBkH37k1
+rBeXVxfhEnkXAANJOccTpPJRH2m+1X/FcXuUNKZOnSrc4G/Gpraj2Opygz8ntxbW
+JR94mz1nkkAILlkCie4VFfSdnxE5ghQSnt8B7W9SdqSKD22NKpBmOff2x5136IEo
+YNK7zYintgJfX6Pa7TR8peEVtAkl3/EjSEoSmfFQVZz2OB7IK3xFT2RyqoC9MjO6
+2mItbD0LgZzTD3f91g00a7z6EjSW8g8QYc5pXSdC1wIDAQABozUwMzAMBgNVHRMB
+Af8EAjAAMA4GA1UdDwEB/wQEAwIFoDATBgNVHSUEDDAKBggrBgEFBQcDAjANBgkq
+hkiG9w0BAQsFAAOCAQEAU/u+MOKWMXQqkPSQx2RjrOale3KKdkHX6LlGfZYjqMhn
+IQjYbEfGtIKyD2MChXrhKMLwuwvMUaCMQWq0r9vZb2cz+AGDS/OzHui/YXgoUU/D
+JOqmT17ClM1JIBZjfbLaogGGY//l4NA48MjhTDHw9MGOnnjzVYUy7CC6qiFu0onC
+Ko+ZE0Ebb3KyjUeJLSCXEhTVW0myGc+/jNRJP0YW/TvxKRZ5EAhaJrLXvKm7tjil
+SZpXBETiXq6eZZsD+XNfQvytBIFO4eBhv3sipQ8Ga30L3SqkMlsb4ptWpa5+z1Vk
+BlkuYdKpPhD/nmx/OfRdfTItDVstm8Q13+MGS5Rokw==
+-----END CERTIFICATE-----

data/spec/support/certs/client_key.pem

@@ -0,0 +1,30 @@
+-----BEGIN RSA PRIVATE KEY-----
+Proc-Type: 4,ENCRYPTED
+DEK-Info: AES-256-CBC,73A5C7F43CBFB22BDECED16E3F6D4014
+
+s2DHo+hKzlo9ZFcql4V84w5c8OADkBHNYp3DJJSII+LSufiNLJ1JVcACEZdr/JsF
+vLKTlCIjExGY1b85GPZ25PArB5jrZvWCcOFfs5PGzr3/ykRTfTMHSXo+WfFwkZ2x
+2k/Zt8yVJ7f69G7EevTtVbkmx/wLMnlTSjMKfzWfs/f57GP+dWM5rHOiMBKK2KhC
+OlD6yhKV4frmF9YTQlslrg5Nmd+3UQsSubT6s4qLByYrLm7pJHB9mx2LNLLQnoxv
+IBIL+FcQRQvLtGGbzV42BHEqr6Kq7aqDf9RT6JohOMdGMYMtABZP9/iOqCUMT2QB
+2/cio1jjgijHqpVBsPg9D493t0fm+1FXLK21wfvQgP6/v0wDB3YKlGlHzWWiVc2f
+4EF/VAyPR8bJwpnZvQpsQ16HEftyyHTbishVbiqzvTNi4HnmSX6WQI2pwFHlF22j
+UWJzSfLqp8NW340zo/EYDAm/dPaqVGR+pVtUEta+oGSI7OQWB3hGt7znSpdgFrah
+i1IOkcu3fie15FzSlBtFhByigtz6iedrTCvYZhfswU4XxJfPJtlVnDubQ9xKDXp6
+3xuy8R4ekMysSOGHq2NdOaYvOoMK8LAJ++KZwEe6UJfBDvEkC23V3mkoCKiUANDY
+GuJ5SOqw6DF6cO/i+StvOuB+2mxMOhR4x893N/ntQrITYldvRh+QHNFoyKc5NUu4
+035ezDVRDR4kzJzzTFfO9yshGFrqb7oyfUegzZMGah1sNn7AWG7AtBSbxSzmRk5s
+0uBrBX7ASfMUGkpUV7BFsvDPi819k5iWLYLFPiFB/CJ5Wq0HHU4j9XDIa/dEuSe+
+0HvQpYf/2IiYocxKxnZOXfdO06cigip1OjxbIXgx1uqrCyzB7c7XMLEUXETpdj1p
+XPCvZ/9BaRNjWvvTrNNB2nMSarFdtjY6pB8bZtP4xObiQ59L3mLoL9/MD87Cnhzn
+Gr8Yr3V5TJk8o60rWNNpaXeCbIlJONFN128uAP8vgjaYviHNb15ViDW1a57fO/OW
+4XOt5jqVDC/NfQXADku7bcs1SPUOKbDgVeYiiq0na3t5yePNRZVcA6FEHuc9hDLi
+T+Fp7bqxXa7pZMn9FOCJ0cRhtoD6LaIqNbtzCIU9u6HBbJkg36Nz7ysh3riYPKBI
+ShLhSb+unI2owdWBi6QwDRus2FtcvPwPNrqtnZ1V5/YyFY6k7ScLR6R67A4ESKNJ
+qIWQ0iCN9nCjbCGpO62e5BzwoVGXiTQK7QK1WPT95+E3Qlv8q6hGi32d5gMUNR1h
+r8OmL+HXMZE2azKJB1mKldYznOYiSIJDjvSp/Jm4A+6zYB6wwiQWwZUUrmW7zbg0
+o7PHImDvRj8hkJlpNRCqLKkyKF+/PaqkFx2dJxJT3xmVJ+H7wqmwhii1Y0RE9YHu
+yzrL7vZpC2a2cjyJnlDG7sX4ZLPNg1vOEXcnKO/6+HHDLkmPQj85+mqHInrTvuca
+GqC/JZeD8FMnpsWQC51ZwThbwlzq91kvFPhSxOqEequ0HP/1K3DdNhxQNKwQseV2
+0jK0rCgibSroD8bE7kghtUPK/fts6XGRqgXmPmx9i3VJGbJw14GvKGp3oyosVEna
+-----END RSA PRIVATE KEY-----

data/spec/support/config.ru

@@ -127,6 +127,12 @@ LargeServlet = Proc.new {|env|
   [200, {'Content-Type' => 'binary/octet-stream', 'Content-Length' => len.to_s}, body]
 }
 
+# Echoes the subject of the client certificate Puma verified, if any
+PeerCertServlet = Proc.new {|env|
+  subject = env['puma.peercert'] ? env['puma.peercert'].subject.to_s : 'none'
+  [200, {'Content-Type' => 'text/plain', 'Content-Length' => subject.bytesize.to_s}, [subject]]
+}
+
 run Rack::URLMap.new({
   "/" => Proc.new {|env| [200, {'Content-Length' => '2'}, ['Welcome']]},
   "/test" => Readback,
@@ -143,4 +149,5 @@ run Rack::URLMap.new({
   "/repetitiveheader" => RepetitiveHeaderServlet,
   "/wrongcontentlength" => WrongContentLengthServlet,
   "/gzip-compressed" => GzipServlet,  
+  "/peercert" => PeerCertServlet,
 })

data/spec/support/raw_request_capture.rb

@@ -0,0 +1,93 @@
+require 'socket'
+require 'openssl'
+require 'stringio'
+
+# Captures the raw HTTP request a client puts on the wire, independent of any
+# Rack/HTTP server. This lets us assert on hop-by-hop details such as
+# Transfer-Encoding which a conformant server (webrick, puma, ...) decodes and
+# never exposes to the application.
+module RawRequestCapture
+  CapturedRequest = Struct.new(:request_line, :headers, :body)
+
+  CERT_DIR = File.join(__dir__, 'certs')
+
+  # Boots a one-shot capture server on an ephemeral port, yields its base URL to
+  # the block (which must perform a single request against it) and returns the
+  # CapturedRequest. Pass ssl: true to terminate TLS using the test certificates.
+  def capture_request(ssl: false)
+    tcp = TCPServer.new('127.0.0.1', 0)
+    port = tcp.addr[1]
+    server = ssl ? wrap_tls(tcp) : tcp
+    captured = nil
+    acceptor = Thread.new do
+      conn = server.accept
+      captured = read_request(conn)
+      conn.write("HTTP/1.1 200 OK\r\nContent-Length: 2\r\n\r\nok")
+      conn.close
+    end
+    yield "#{ssl ? 'https' : 'http'}://127.0.0.1:#{port}"
+    acceptor.join(5)
+    captured
+  ensure
+    tcp.close if tcp
+  end
+
+  private
+
+  def wrap_tls(tcp)
+    ctx = OpenSSL::SSL::SSLContext.new
+    ctx.cert = OpenSSL::X509::Certificate.new(File.read(File.join(CERT_DIR, 'cacert.pem')))
+    ctx.key = OpenSSL::PKey.read(File.read(File.join(CERT_DIR, 'privkey.pem')))
+    OpenSSL::SSL::SSLServer.new(tcp, ctx)
+  end
+
+  def read_request(conn)
+    buf = +''
+    buf << conn.readpartial(4096) until buf.include?("\r\n\r\n")
+    head, rest = buf.split("\r\n\r\n", 2)
+    request_line, *header_lines = head.split("\r\n")
+    headers = header_lines.each_with_object({}) do |line, acc|
+      name, value = line.split(': ', 2)
+      acc[name.downcase] = value
+    end
+    # Honour Expect: 100-continue so the client proceeds to send the body.
+    conn.write("HTTP/1.1 100 Continue\r\n\r\n") if headers['expect'].to_s =~ /100-continue/i
+    CapturedRequest.new(request_line, headers, read_body(conn, headers, rest))
+  end
+
+  def read_body(conn, headers, rest)
+    if headers['transfer-encoding'] == 'chunked'
+      dechunk(drain_chunked(conn, rest))
+    elsif (len = headers['content-length'])
+      read_exactly(conn, len.to_i, rest)
+    else
+      rest
+    end
+  end
+
+  def drain_chunked(conn, rest)
+    buf = rest.dup
+    buf << conn.readpartial(4096) until buf.include?("0\r\n\r\n")
+    buf
+  end
+
+  def read_exactly(conn, n, rest)
+    buf = rest.dup
+    buf << conn.readpartial(4096) while buf.bytesize < n
+    buf.byteslice(0, n)
+  end
+
+  def dechunk(buf)
+    io = StringIO.new(buf)
+    out = +''
+    while (size_line = io.gets("\r\n"))
+      size = size_line.strip.split(';', 2).first.to_i(16)
+      break if size.zero?
+      out << io.read(size).to_s
+      io.read(2) # trailing CRLF
+    end
+    out
+  end
+end
+
+RSpec.configure { |c| c.include RawRequestCapture }

data/spec/support/test_server.rb

@@ -5,7 +5,7 @@ require 'rack/handler/puma'
 class PatronTestServer
   APP = Rack::Builder.new { eval(File.read(File.join(__dir__, 'config.ru'))) }
 
-  def self.start(ssl = false, port = 9001 )
+  def self.start(ssl = false, port = 9001, client_ca: nil)
     # Reset the RSpec's SIGINT handler that does not really terminate after
     # the first Ctrl+C pressed.
     # Useful to terminate the forked process before Puma is actually started:
@@ -16,11 +16,14 @@ class PatronTestServer
     keypath = File.join(__dir__, 'certs', 'privkey.pem')
     certpath = File.join(__dir__, 'certs', 'cacert.pem')
 
-    host = if ssl
+    host = if ssl && client_ca
+      # force_peer makes Puma drop the handshake when no valid client certificate is presented
+      'ssl://0.0.0.0:%d?key=%s&cert=%s&ca=%s&verify_mode=force_peer' % [port, keypath, certpath, client_ca]
+    elsif ssl
       'ssl://0.0.0.0:%d?key=%s&cert=%s' % [port, keypath, certpath]
     else
       '0.0.0.0'
     end
-    Rack::Handler::Puma.run(APP, {:Port => port.to_i, :Verbose => true, :Host => host})
+    Rack::Handler::Puma.run(APP, :Port => port.to_i, :Verbose => true, :Host => host)
   end
 end

data/spec/support/valgrind.supp

@@ -0,0 +1,2 @@
+# Suppressions for the valgrind CI job. Keep this to things that are demonstrably
+# not Patron's: nothing from session_ext.c or membuffer.c may be suppressed here.

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: patron
 version: !ruby/object:Gem::Version
-  version: 0.13.4
+  version: 0.14.0
 platform: ruby
 authors:
 - Aeryn Riley Dowling-Toland
 bindir: exe
 cert_chain: []
-date: 2025-02-27 00:00:00.000000000 Z
+date: 2026-10-27 00:00:00.000000000 Z
 dependencies: []
 description: Ruby HTTP client library based on libcurl
 email:
@@ -18,6 +18,7 @@ extensions:
 extra_rdoc_files: []
 files:
 - ".autotest"
+- ".github/dependabot.yml"
 - ".github/workflows/ci.yml"
 - ".gitignore"
 - ".rspec"
@@ -47,6 +48,7 @@ files:
 - patron.gemspec
 - pic.png
 - script/console
+- script/generate_client_certs
 - script/test_server
 - spec/header_parser_spec.rb
 - spec/patron_spec.rb
@@ -62,10 +64,17 @@ files:
 - spec/session_ssl_spec.rb
 - spec/spec_helper.rb
 - spec/support/certs/cacert.pem
+- spec/support/certs/client.p12
+- spec/support/certs/client_ca.pem
+- spec/support/certs/client_cert.pem
+- spec/support/certs/client_key.pem
 - spec/support/certs/privkey.pem
+- spec/support/certs/rogue_client.p12
 - spec/support/config.ru
 - spec/support/fork.rb
+- spec/support/raw_request_capture.rb
 - spec/support/test_server.rb
+- spec/support/valgrind.supp
 - spec/util_spec.rb
 homepage: https://github.com/toland/patron
 licenses:
@@ -86,12 +95,12 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: '2.3'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 1.2.0
+      version: 2.5.0
 requirements: []
 rubygems_version: 3.6.2
 specification_version: 4