rack-proxy 0.7.7 → 1.0.1

data/lib/rack/http_streaming_response.rb

@@ -1,19 +1,63 @@
-require "net_http_hacked"
+# frozen_string_literal: true
+
+require "net/https"
 require "stringio"
 
 module Rack
-  # Wraps the hacked net/http in a Rack way.
+  # A lazy Rack body that streams a backend Net::HTTP response without
+  # buffering it.
+  #
+  # The request runs inside a Fiber, using only the public block form of
+  # Net::HTTP#request: the Fiber pauses (`Fiber.yield res`) the moment the
+  # status and headers are available, and #each resumes it to pull body chunks
+  # as the server consumes them. This replaced the 2010-era monkey-patch of
+  # private net/http internals (`net_http_hacked.rb`, deleted in 1.0) and
+  # inherits upstream's handling of 1xx interim responses, keep-alive
+  # negotiation, and transport errors.
+  #
+  # A Fiber can only be resumed from the thread that created it. The request
+  # Fiber is created lazily on first use (#code/#headers/#each), so the normal
+  # Rack flow — one thread calls the app and then iterates the body — is fine.
+  # If #close is called from a different thread (some servers do this on client
+  # abort), the Fiber unwind is skipped and the connection is hard-closed
+  # instead, which releases the socket either way.
   class HttpStreamingResponse
+    # Raised while streaming when the backend body exceeds max_response_length.
+    # The status/headers are already sent, so the transfer is aborted mid-stream.
+    class ResponseTooLarge < StandardError; end
+
+    # Raised INTO the request Fiber to unwind it on early termination (client
+    # abort, HEAD, 204/304, oversize response). Deliberately a direct
+    # StandardError subclass — it must never match the network-error classes
+    # Net::HTTP#request retries on, or aborting a stream could replay the
+    # request against the backend.
+    class StreamAborted < StandardError; end
+
     STATUSES_WITH_NO_ENTITY_BODY = {
       204 => true,
       205 => true,
       304 => true
     }.freeze
 
-    attr_accessor :use_ssl, :verify_mode, :read_timeout, :ssl_version, :cert, :key
-
-    def initialize(request, host, port = nil)
-      @request, @host, @port = request, host, port
+    attr_accessor :use_ssl, :verify_mode, :read_timeout, :ssl_version, :cert, :key, :logger
+    attr_accessor :max_response_length
+
+    # An optional block receives the Net::HTTP instance for configuration before
+    # it connects — this is the single source of truth used by Rack::Proxy (see
+    # Rack::Proxy#configure_backend_connection). When no block is given, the
+    # public accessors above are applied instead (backward-compatible path for
+    # direct users of this class).
+    def initialize(request, host, port = nil, &configure)
+      @request, @host, @port, @configure = request, host, port, configure
+
+      # Forward the backend body verbatim. Without this, Net::HTTP inflates
+      # gzip/deflate bodies for requests that opted in (the default for e.g.
+      # Net::HTTP::Get), leaving the already-forwarded Content-Length and
+      # Content-Encoding describing bytes the client never receives. The old
+      # patched read path never decoded; keep that contract.
+      if request.instance_variable_defined?(:@decode_content)
+        request.instance_variable_set(:@decode_content, false)
+      end
     end
 
     def body
@@ -36,7 +80,28 @@ module Rack
     def each(&block)
       return if connection_closed
 
-      response.read_body(&block)
+      response # make sure the request has started and the headers are in
+
+      bytes = 0
+      while @fiber.alive?
+        chunk = @fiber.resume
+        # The last resume returns the Fiber's terminal value, not a body chunk.
+        next unless chunk.is_a?(String)
+
+        if max_response_length
+          bytes += chunk.bytesize
+          if bytes > max_response_length
+            raise ResponseTooLarge, "backend response exceeded max_response_length=#{max_response_length}"
+          end
+        end
+        block.call(chunk)
+      end
+    rescue => e
+      # The status/headers are already on the wire, so we can't turn a mid-stream
+      # backend failure into a 502. Log it and re-raise so the server aborts the
+      # transfer (the client sees a truncated response, not a false "complete").
+      logger << "rack-proxy: streaming backend read failed: #{e.class}: #{e.message}\n" if logger.respond_to?(:<<)
+      raise
     ensure
       close_connection
     end
@@ -45,22 +110,58 @@ module Rack
       @to_s ||= StringIO.new.tap { |io| each { |line| io << line } }.string
     end
 
+    # Rack calls #close on the response body when it is done with it, including
+    # when it bails out early (HEAD, 304, a client disconnect). Without this, a
+    # body that is never iterated leaks the backend TCP/TLS connection until GC.
+    def close
+      close_connection
+    end
+
     protected
 
-    # Net::HTTPResponse
+    # Net::HTTPResponse. Fetching it lazily dials the backend, sends the request
+    # and reads the response head; the body stays unread on the socket until
+    # #each resumes the Fiber.
     def response
-      @response ||= session.begin_request_hacked(request)
+      return @response if @response
+
+      # Starting a request on a closed body would dial a connection that
+      # nothing can ever release (close_connection has already latched). Check
+      # AFTER the memo: #headers is legitimately read after #code auto-closed a
+      # 204/304, which must keep working.
+      raise IOError, "rack-proxy: backend response was closed before it was read" if connection_closed
+
+      @response = begin
+        @fiber = Fiber.new do
+          session.request(request) do |res|
+            Fiber.yield res
+            res.read_body { |chunk| Fiber.yield chunk }
+          end
+          :done
+        end
+        @fiber.resume
+      end
     end
 
     # Net::HTTP
     def session
       @session ||= Net::HTTP.new(host, port).tap do |http|
-        http.use_ssl = use_ssl
-        http.verify_mode = verify_mode
-        http.read_timeout = read_timeout
-        http.ssl_version = ssl_version if ssl_version
-        http.cert = cert if cert
-        http.key = key if key
+        if @configure
+          @configure.call(http)
+        else
+          http.use_ssl = use_ssl
+          http.verify_mode = verify_mode
+          http.read_timeout = read_timeout
+          http.ssl_version = ssl_version if ssl_version
+          http.cert = cert if cert
+          http.key = key if key
+          http.set_debug_output(logger) if logger
+        end
+        # Net::HTTP retries idempotent requests once on transport errors — but a
+        # retry after the response was yielded would silently replay the request
+        # and restart the body mid-stream. The old patched path never retried;
+        # streaming must not either. (Set after the configure block on purpose.)
+        http.max_retries = 0
         http.start
       end
     end
@@ -71,12 +172,32 @@ module Rack
 
     attr_accessor :connection_closed
 
+    # Idempotent, best-effort teardown. Uses @session/@fiber directly (never the
+    # lazy accessors) so closing a response that was never read does not dial
+    # the backend just to tear it down. A still-suspended request Fiber is
+    # unwound first (running net/http's own ensure blocks), then the connection
+    # is closed for real. Swallows teardown errors: a half-read or already-reset
+    # backend must not crash the app or mask the original error.
     def close_connection
       return if connection_closed
 
-      session.end_request_hacked
-      session.finish
       self.connection_closed = true
+
+      if @fiber&.alive?
+        begin
+          @fiber.raise(StreamAborted, "backend stream closed before the response was fully read")
+        rescue
+          # Expected: StreamAborted itself (or whatever the unwind trips over)
+          # propagates back out of Fiber#raise; FiberError if another thread
+          # owns the Fiber. Either way we fall through to closing the socket.
+        end
+      end
+
+      begin
+        @session.finish if @session&.started?
+      rescue
+        # best-effort: the connection may already be gone
+      end
     end
   end
 end

data/lib/rack/proxy/version.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module Rack
+  class Proxy
+    VERSION = "1.0.1"
+  end
+end

data/lib/rack/proxy.rb

@@ -1,45 +1,77 @@
-require "net_http_hacked"
+# frozen_string_literal: true
+
+require "rack"
+require "net/https"
 require "rack/http_streaming_response"
+require "rack/proxy/version"
 
 module Rack
-
   # Subclass and bring your own #rewrite_request and #rewrite_response
   class Proxy
-    VERSION = "0.7.7".freeze
-
     HOP_BY_HOP_HEADERS = {
-      'connection' => true,
-      'keep-alive' => true,
-      'proxy-authenticate' => true,
-      'proxy-authorization' => true,
-      'te' => true,
-      'trailer' => true,
-      'transfer-encoding' => true,
-      'upgrade' => true
+      "connection" => true,
+      "keep-alive" => true,
+      "proxy-authenticate" => true,
+      "proxy-authorization" => true,
+      "te" => true,
+      "trailer" => true,
+      "transfer-encoding" => true,
+      "upgrade" => true
     }.freeze
 
+    # Backend/network failures that must surface as 502 Bad Gateway rather than
+    # crashing the proxy with a raw 500. Construction- and policy-time failures
+    # are mapped separately (400/501/502) in #perform_request.
+    BACKEND_ERRORS = [
+      Errno::ECONNREFUSED, Errno::ECONNRESET, Errno::ECONNABORTED,
+      Errno::EHOSTUNREACH, Errno::ENETUNREACH, Errno::ETIMEDOUT, Errno::EPIPE,
+      SocketError,
+      Timeout::Error,               # includes Net::OpenTimeout
+      Net::ReadTimeout, Net::WriteTimeout,
+      IOError,                      # includes EOFError
+      OpenSSL::SSL::SSLError,
+      Net::ProtocolError,
+      # A malformed status line / header block raises these; they subclass
+      # StandardError directly, NOT Net::ProtocolError, so list them explicitly
+      # or a hostile backend crashes the proxy with a raw 500 instead of a 502.
+      Net::HTTPBadResponse, Net::HTTPHeaderSyntaxError
+    ].freeze
+
     class << self
       def extract_http_request_headers(env)
         headers = env.reject do |k, v|
-          !(/^HTTP_[A-Z0-9_\.]+$/ === k) || v.nil?
+          !(/^HTTP_[A-Z0-9_.]+$/ === k) || v.nil?
         end.map do |k, v|
           [reconstruct_header_name(k), v]
         end.then { |pairs| build_header_hash(pairs) }
 
-        x_forwarded_for = (headers['X-Forwarded-For'].to_s.split(/, +/) << env['REMOTE_ADDR']).join(', ')
+        # Strip hop-by-hop headers before forwarding. Relaying the client's
+        # Connection / TE / Transfer-Encoding (etc.) enables request smuggling
+        # and confuses the backend — these are connection-scoped, not end-to-end.
+        # Per RFC 7230 §6.1 any field named in the inbound Connection header is
+        # itself hop-by-hop for this hop. Use #delete (not #reject!) so the
+        # returned HeaderHash's case-insensitive index stays consistent on Rack 2.
+        connection_named = headers["Connection"].to_s.downcase.split(/,\s*/).map(&:strip)
+        headers.keys.each do |key|
+          headers.delete(key) if HOP_BY_HOP_HEADERS[key.downcase] || connection_named.include?(key.downcase)
+        end
+
+        x_forwarded_for = (headers["X-Forwarded-For"].to_s.split(/, +/) << env["REMOTE_ADDR"]).join(", ")
 
-        headers.merge!('X-Forwarded-For' => x_forwarded_for)
+        headers.merge!("X-Forwarded-For" => x_forwarded_for)
       end
 
       def normalize_headers(headers)
         mapped = headers.map do |k, v|
-          [titleize(k), if v.is_a? Array then v.join("\n") else v end]
+          [titleize(k), v.is_a?(Array) ? v.join("\n") : v]
         end
-        build_header_hash Hash[mapped]
+        build_header_hash mapped.to_h
       end
 
       def build_header_hash(pairs)
-        if Rack.const_defined?(:Headers)
+        # Pass inherit: false so we only check Rack's own constants — otherwise
+        # a top-level ::Headers defined by the host app would falsely match.
+        if Rack.const_defined?(:Headers, false)
           # Rack::Headers is only available from Rack 3 onward
           Headers.new.tap { |headers| pairs.each { |k, v| headers[k] = v } }
         else
@@ -51,7 +83,7 @@ module Rack
       protected
 
       def reconstruct_header_name(name)
-        titleize(name.sub(/^HTTP_/, "").gsub("_", "-"))
+        titleize(name.sub(/^HTTP_/, "").tr("_", "-"))
       end
 
       def titleize(str)
@@ -60,7 +92,7 @@ module Rack
     end
 
     # @option opts [String, URI::HTTP] :backend Backend host to proxy requests to
-    def initialize(app = nil, opts= {})
+    def initialize(app = nil, opts = {})
       if app.is_a?(Hash)
         opts = app
         @app = nil
@@ -69,17 +101,55 @@ module Rack
       end
 
       @streaming = opts.fetch(:streaming, true)
-      @ssl_verify_none = opts.fetch(:ssl_verify_none, false)
       @backend = opts[:backend] ? URI(opts[:backend]) : nil
+      # With no :backend (and no env["rack.backend"]), the destination is
+      # derived from the client-controlled Host header. Since 1.0 that dynamic
+      # mode is refused (502) unless explicitly opted into, because a bare
+      # proxy would otherwise be an open proxy / SSRF pivot (cloud metadata
+      # endpoints, loopback, RFC1918). Combine the opt-in with a
+      # #backend_allowed? allowlist — see the README "Security considerations".
+      @allow_dynamic_backend = opts.fetch(:allow_dynamic_backend, false)
       @read_timeout = opts.fetch(:read_timeout, 60)
+      # Connect and per-write deadlines. Without these a slow/hostile backend can
+      # stall a thread for Net::HTTP's 60s defaults even with a small read_timeout.
+      @open_timeout = opts[:open_timeout]
+      @write_timeout = opts[:write_timeout]
+      # Optional cap (in bytes) on the backend response size, to bound memory
+      # against a hostile/huge backend. Enforced incrementally while streaming and
+      # via the declared Content-Length / buffered size otherwise. Default: no cap.
+      @max_response_length = opts[:max_response_length]
+      # :ssl_version pins an exact protocol and is deprecated (it forbids TLS 1.3);
+      # prefer :min_version / :max_version, which map to Net::HTTP#min_version=/#max_version=.
       @ssl_version = opts[:ssl_version]
+      @min_version = opts[:min_version]
+      @max_version = opts[:max_version]
       @cert = opts[:cert]
       @key = opts[:key]
+      # Trust anchors for VERIFY_PEER: :ca_file is a PEM bundle path, :cert_store
+      # an OpenSSL::X509::Store. Use these for private-CA backends instead of
+      # disabling verification with ssl_verify_none.
+      @ca_file = opts[:ca_file]
+      @cert_store = opts[:cert_store]
+      # SSL verification: defaults to VERIFY_PEER (Ruby's Net::HTTP default).
+      # Pass ssl_verify_none: true to explicitly disable cert verification, or
+      # pass verify_mode: <OpenSSL::SSL::VERIFY_*> for full control.
       @verify_mode = opts[:verify_mode]
+      @verify_mode ||= OpenSSL::SSL::VERIFY_NONE if opts[:ssl_verify_none]
 
       @username = opts[:username]
       @password = opts[:password]
 
+      # Opt-in request hardening (see README "Security considerations"):
+      # :strip_credentials drops Cookie/Authorization from the forwarded
+      # request; :replace_x_forwarded_for discards the client-supplied
+      # X-Forwarded-For chain and forwards only this hop's REMOTE_ADDR.
+      @strip_credentials = opts[:strip_credentials]
+      @replace_x_forwarded_for = opts[:replace_x_forwarded_for]
+
+      # Optional logger for Net::HTTP debug output. Accepts anything with a #<< method
+      # (e.g. $stdout, a StringIO, or a Ruby Logger instance).
+      @logger = opts[:logger]
+
       @opts = opts
     end
 
@@ -97,72 +167,196 @@ module Rack
       triplet
     end
 
+    # SSRF guardrail, consulted for EVERY request with the resolved backend
+    # (`backend` responds to #host, #port and #scheme). Return false to refuse,
+    # which makes the proxy respond 502. The default allows the backend, because
+    # by the time this hook runs the destination is either app-configured
+    # (:backend / env["rack.backend"]) or the deployment has explicitly passed
+    # allow_dynamic_backend: true — override it to pin an allowlist on top:
+    #
+    #   def backend_allowed?(backend)
+    #     %w[api.internal.example.com].include?(backend.host)
+    #   end
+    def backend_allowed?(backend)
+      true
+    end
+
     protected
 
     def perform_request(env)
       source_request = Rack::Request.new(env)
 
-      # Initialize request
-      if source_request.fullpath == ""
-        full_path = URI.parse(env['REQUEST_URI']).request_uri
-      else
-        full_path = source_request.fullpath
-      end
+      # Everything that can fail on a hostile/unreachable request or backend is
+      # mapped to a status code here so the proxy never surfaces a raw 500:
+      #   400 malformed request URI, 501 unknown method, 502 backend failure.
+      begin
+        # Initialize request
+        full_path = if source_request.fullpath == ""
+          URI.parse(env["REQUEST_URI"]).request_uri
+        else
+          source_request.fullpath
+        end
 
-      target_request = Net::HTTP.const_get(source_request.request_method.capitalize, false).new(full_path)
+        request_class = net_http_request_class(source_request.request_method)
+        return [501, {}, []] if request_class.nil?
 
-      # Setup headers
-      target_request.initialize_http_header(self.class.extract_http_request_headers(source_request.env))
+        target_request = request_class.new(full_path)
 
-      # Setup body
-      if target_request.request_body_permitted? && source_request.body
-        target_request.body_stream    = source_request.body
-        target_request.content_length = source_request.content_length.to_i
-        target_request.content_type   = source_request.content_type if source_request.content_type
-        target_request.body_stream.rewind
-      end
+        # Setup headers
+        request_headers = self.class.extract_http_request_headers(source_request.env)
+        if @strip_credentials
+          request_headers.delete("Cookie")
+          request_headers.delete("Authorization")
+        end
+        if @replace_x_forwarded_for
+          if (remote_addr = env["REMOTE_ADDR"])
+            request_headers["X-Forwarded-For"] = remote_addr
+          else
+            request_headers.delete("X-Forwarded-For")
+          end
+        end
+        target_request.initialize_http_header(request_headers)
 
-      # Use basic auth if we have to
-      target_request.basic_auth(@username, @password) if @username && @password
-
-      backend = env.delete('rack.backend') || @backend || source_request
-      use_ssl = backend.scheme == "https" || @cert
-      read_timeout = env.delete('http.read_timeout') || @read_timeout
-
-      # Create the response
-      if @streaming
-        # streaming response (the actual network communication is deferred, a.k.a. streamed)
-        target_response = HttpStreamingResponse.new(target_request, backend.host, backend.port)
-        target_response.use_ssl = use_ssl
-        target_response.read_timeout = read_timeout
-        target_response.ssl_version = @ssl_version if @ssl_version
-        target_response.verify_mode = (@verify_mode || OpenSSL::SSL::VERIFY_NONE) if use_ssl
-        target_response.cert = @cert if @cert
-        target_response.key = @key if @key
-      else
-        http = Net::HTTP.new(backend.host, backend.port)
-        http.use_ssl = use_ssl if use_ssl
-        http.read_timeout = read_timeout
-        http.ssl_version = @ssl_version if @ssl_version
-        http.verify_mode = (@verify_mode || OpenSSL::SSL::VERIFY_NONE if use_ssl) if use_ssl
-        http.cert = @cert if @cert
-        http.key = @key if @key
-
-        target_response = http.start do
-          http.request(target_request)
+        # Forward the backend response verbatim: don't let Net::HTTP transparently
+        # gzip-decode it, which would leave the forwarded Content-Length describing
+        # the compressed size (a body/Content-Length desync). The client decodes
+        # its own content-encoding.
+        target_request.instance_variable_set(:@decode_content, false) if target_request.instance_variable_defined?(:@decode_content)
+
+        # Setup body
+        if target_request.request_body_permitted? && source_request.body
+          target_request.body_stream = source_request.body
+          target_request.content_length = source_request.content_length.to_i
+          target_request.content_type = source_request.content_type if source_request.content_type
+          target_request.body_stream.rewind if target_request.body_stream.respond_to?(:rewind)
+        end
+
+        # Use basic auth if we have to
+        target_request.basic_auth(@username, @password) if @username && @password
+
+        backend = env.delete("rack.backend") || @backend
+        # env["rack.backend"] is documented as a URI, but accept a URI-parseable
+        # string too (symmetric with the :backend option) rather than crash on
+        # #scheme later; a malformed string surfaces as 400 via the rescue.
+        backend = URI(backend) if backend.is_a?(String)
+        if backend.nil?
+          # Dynamic mode: the destination would come from the client-controlled
+          # Host header. Refused unless the deployment opted in (SSRF guard).
+          unless @allow_dynamic_backend
+            if @logger.respond_to?(:<<)
+              @logger << "rack-proxy: refusing Host-derived backend #{source_request.host.inspect} " \
+                         "(no :backend configured; pass allow_dynamic_backend: true to opt in)\n"
+            end
+            return [502, {}, []]
+          end
+          backend = source_request
+        end
+        unless backend_allowed?(backend)
+          if @logger.respond_to?(:<<)
+            @logger << "rack-proxy: backend #{backend.host.inspect} refused by backend_allowed?\n"
+          end
+          return [502, {}, []]
         end
+
+        use_ssl = backend.scheme == "https" || @cert
+        read_timeout = env.delete("http.read_timeout") || @read_timeout
+
+        if @streaming
+          # streaming response (the actual network communication is deferred, a.k.a. streamed)
+          target_response = HttpStreamingResponse.new(target_request, backend.host, backend.port) do |http|
+            configure_backend_connection(http, use_ssl: use_ssl, read_timeout: read_timeout)
+          end
+          target_response.logger = @logger if @logger
+        else
+          http = Net::HTTP.new(backend.host, backend.port)
+          configure_backend_connection(http, use_ssl: use_ssl, read_timeout: read_timeout)
+
+          target_response = http.start do
+            http.request(target_request)
+          end
+        end
+
+        code = target_response.code
+        headers = self.class.normalize_headers(target_response.respond_to?(:headers) ? target_response.headers : target_response.to_hash)
+        body = target_response.body || []
+        body = [body] unless body.respond_to?(:each)
+      rescue URI::InvalidURIError
+        return [400, {}, []]
+      rescue *BACKEND_ERRORS => e
+        @logger << "rack-proxy: backend request failed: #{e.class}: #{e.message}\n" if @logger.respond_to?(:<<)
+        return [502, {}, []]
       end
 
-      code    = target_response.code
-      headers = self.class.normalize_headers(target_response.respond_to?(:headers) ? target_response.headers : target_response.to_hash)
-      body    = target_response.body || [""]
-      body    = [body] unless body.respond_to?(:each)
+      # No entity body for status codes that don't allow one (1xx, 204, 304)
+      body = [] if Rack::Utils::STATUS_WITH_NO_ENTITY_BODY[code.to_i]
 
-      # According to https://tools.ietf.org/html/draft-ietf-httpbis-p1-messaging-14#section-7.1.3.1Acc
-      # should remove hop-by-hop header fields
-      headers.reject! { |k| HOP_BY_HOP_HEADERS[k.downcase] }
+      # Remove hop-by-hop header fields from the response. Use #delete (not
+      # #reject!) so the returned HeaderHash's case-insensitive index stays
+      # consistent on Rack 2 for any downstream middleware.
+      headers.keys.each { |k| headers.delete(k) if HOP_BY_HOP_HEADERS[k.downcase] }
+
+      return [502, {}, []] if response_too_large?(target_response, headers, body)
 
       [code, headers, body]
     end
+
+    private
+
+    # Enforce :max_response_length. Returns true (→ 502) when the response is
+    # already known to be too large. For streaming, a declared oversize is
+    # rejected up-front (the connection is closed) and the incremental limit is
+    # armed on the body for chunked/unknown-length responses; for non-streaming,
+    # the body is already buffered so we check its actual size. Returns false
+    # (allow) when no cap is set.
+    def response_too_large?(target_response, headers, body)
+      return false unless @max_response_length
+
+      declared = headers["Content-Length"]
+      declared_oversize = declared && declared.to_i > @max_response_length
+
+      if target_response.respond_to?(:max_response_length=)
+        if declared_oversize
+          target_response.close
+          return true
+        end
+        target_response.max_response_length = @max_response_length
+        false
+      else
+        buffered = body.sum { |part| part.to_s.bytesize }
+        declared_oversize || buffered > @max_response_length
+      end
+    end
+
+    # Resolve the Net::HTTP request class for an HTTP method, or nil if there is
+    # no matching Net::HTTP::<Verb> (unknown/unsupported method -> 501).
+    def net_http_request_class(method)
+      Net::HTTP.const_get(method.capitalize, false)
+    rescue NameError
+      nil
+    end
+
+    # Single source of truth for TLS/timeout setup, applied to the (real
+    # Net::HTTP) connection on both the streaming and non-streaming paths so a
+    # TLS option — notably the VERIFY_PEER default — can never land on only one.
+    def configure_backend_connection(conn, use_ssl:, read_timeout:)
+      conn.use_ssl = use_ssl
+      conn.read_timeout = read_timeout
+      conn.open_timeout = @open_timeout if @open_timeout
+      conn.write_timeout = @write_timeout if @write_timeout
+
+      if use_ssl
+        conn.verify_mode = @verify_mode || OpenSSL::SSL::VERIFY_PEER
+        conn.ca_file = @ca_file if @ca_file
+        conn.cert_store = @cert_store if @cert_store
+        conn.min_version = @min_version if @min_version
+        conn.max_version = @max_version if @max_version
+        conn.ssl_version = @ssl_version if @ssl_version # deprecated; prefer min/max_version
+        conn.cert = @cert if @cert
+        conn.key = @key if @key
+      end
+
+      conn.set_debug_output(@logger) if @logger
+      conn
+    end
   end
 end

data/lib/rack-proxy.rb

@@ -1 +1,3 @@
-require "rack/proxy"
+# frozen_string_literal: true
+
+require "rack/proxy"