ruby-proxy-headers 0.2.2 → 0.3.0

data/lib/ruby_proxy_headers/net_http.rb

@@ -1,16 +1,20 @@
 # frozen_string_literal: true
 
 require 'net/http'
-require 'net/protocol'
 require 'openssl'
-require 'resolv'
-require 'timeout'
+
+# Loaded for header validation. Requiring this file first is safe: the parent
+# requires it back and Ruby drops the cycle.
+require_relative '../ruby_proxy_headers'
 
 module RubyProxyHeaders
-  # Patches Net::HTTP#connect for HTTPS-over-proxy so extra headers can be sent on
-  # the CONNECT request and response headers can be read (e.g. ProxyMesh
-  # X-ProxyMesh-IP). Based on the same tunnel flow as Python's http.client / urllib3
-  # extensions in python-proxy-headers.
+  # Patches Net::HTTP so an HTTPS request through a proxy can send extra CONNECT
+  # headers and keep the proxy's CONNECT response.
+  #
+  # The patch does not copy +Net::HTTP#connect+. The installed net-http still
+  # owns the socket, +timeouted_connect+, and HTTPS-to-proxy (+proxy_use_ssl+).
+  # A prepend validates the target, then rewrites the CONNECT bytes that
+  # upstream writes and records the CONNECT response.
   #
   # @example
   #   require 'ruby_proxy_headers/net_http'
@@ -20,148 +24,89 @@ module RubyProxyHeaders
   #   http.use_ssl = true
   #   http.proxy_connect_request_headers = { 'X-ProxyMesh-IP' => '203.0.113.1' }
   #   res = http.request(Net::HTTP::Get.new(uri))
-  #   p http.last_proxy_connect_response_headers
+  #   p http.last_proxy_connect_response_headers['X-ProxyMesh-IP']
   module NetHTTP
-    unless const_defined?(:ORIGINAL_CONNECT, false)
-      ORIGINAL_CONNECT = ::Net::HTTP.instance_method(:connect)
-    end
-
-    module Extension
-      attr_accessor :proxy_connect_request_headers
-      attr_reader :last_proxy_connect_response_headers
+    # Inserts +headers+ before the blank line that ends a CONNECT request.
+    def self.inject_connect_headers(buf, headers)
+      return buf if headers.nil? || headers.empty?
 
-      def connect
-        if use_ssl? && proxy?
-          connect_with_proxy_tunnel
-        else
-          RubyProxyHeaders::NetHTTP::ORIGINAL_CONNECT.bind_call(self)
-        end
+      extra = String.new(encoding: buf.encoding)
+      headers.each do |key, value|
+        extra << "#{key}: #{value}\r\n".encode(buf.encoding)
       end
+      "#{buf.sub(/\r\n\r\n\z/, "\r\n")}#{extra}\r\n"
+    end
 
-      private
-
-      # Duplicates Net::HTTP#connect (MRI 3.2) for the HTTPS + proxy branch, with
-      # optional extra CONNECT headers and capture of the CONNECT response headers.
-      def connect_with_proxy_tunnel
-        s = nil
-        if use_ssl?
-          @ssl_context = OpenSSL::SSL::SSLContext.new
-        end
-
-        if proxy?
-          conn_addr = proxy_address
-          conn_port = proxy_port
-        else
-          conn_addr = conn_address
-          conn_port = port
+    # Rewrites a CONNECT write while a patched connection is opening.
+    module ConnectRequestWrite
+      def write(*strs)
+        http = Thread.current[:ruby_proxy_headers_active_http]
+        if http && strs.first.start_with?('CONNECT ')
+          strs = [
+            RubyProxyHeaders::NetHTTP.inject_connect_headers(
+              strs.join,
+              http.proxy_connect_request_headers
+            )
+          ]
         end
+        super(*strs)
+      end
+    end
 
-        debug "opening connection to #{conn_addr}:#{conn_port}..."
-        s = Timeout.timeout(@open_timeout, Net::OpenTimeout) do
-          begin
-            TCPSocket.open(conn_addr, conn_port, @local_host, @local_port)
-          rescue StandardError => e
-            raise e, "Failed to open TCP connection to " \
-              "#{conn_addr}:#{conn_port} (#{e.message})"
-          end
+    # Records CONNECT response headers. Active only while #connect is running,
+    # so the later origin response is left alone.
+    module ConnectResponseRead
+      def read_new(sock)
+        response = super
+        http = Thread.current[:ruby_proxy_headers_active_http]
+        if http
+          headers = HeaderMap.new
+          response.each_header { |key, value| headers[key] = value }
+          http.last_proxy_connect_response_headers = headers
+          Thread.current[:ruby_proxy_headers_connect_headers] = headers.dup
         end
-        s.setsockopt(Socket::IPPROTO_TCP, Socket::TCP_NODELAY, 1)
-        debug 'opened'
-
-        if use_ssl?
-          if proxy?
-            plain_sock = Net::BufferedIO.new(s, read_timeout: @read_timeout,
-                                            write_timeout: @write_timeout,
-                                            continue_timeout: @continue_timeout,
-                                            debug_output: @debug_output)
-            buf = +"CONNECT #{conn_address}:#{@port} HTTP/#{::Net::HTTP::HTTPVersion}\r\n" \
-              "Host: #{@address}:#{@port}\r\n"
-            if proxy_user
-              credential = ["#{proxy_user}:#{proxy_pass}"].pack('m0')
-              buf << "Proxy-Authorization: Basic #{credential}\r\n"
-            end
-            if proxy_connect_request_headers&.any?
-              proxy_connect_request_headers.each do |k, v|
-                RubyProxyHeaders.validate_header!(k, v)
-                buf << "#{k}: #{v}\r\n"
-              end
-            end
-            buf << "\r\n"
-            plain_sock.write(buf)
-
-            proxy_res = ::Net::HTTPResponse.read_new(plain_sock)
-            @last_proxy_connect_response_headers = {}
-            proxy_res.each_header do |k, v|
-              @last_proxy_connect_response_headers[k] = v
-            end
-            Thread.current[:ruby_proxy_headers_connect_headers] = @last_proxy_connect_response_headers.dup
-            proxy_res.value
-          end
-
-          ssl_parameters = {}
-          iv_list = instance_variables
-          Net::HTTP::SSL_IVNAMES.each_with_index do |ivname, i|
-            if iv_list.include?(ivname)
-              value = instance_variable_get(ivname)
-              unless value.nil?
-                ssl_parameters[Net::HTTP::SSL_ATTRIBUTES[i]] = value
-              end
-            end
-          end
-          @ssl_context.set_params(ssl_parameters)
-          unless @ssl_context.session_cache_mode.nil?
-            @ssl_context.session_cache_mode =
-              OpenSSL::SSL::SSLContext::SESSION_CACHE_CLIENT |
-              OpenSSL::SSL::SSLContext::SESSION_CACHE_NO_INTERNAL_STORE
-          end
-          if @ssl_context.respond_to?(:session_new_cb)
-            @ssl_context.session_new_cb = proc { |sock, sess| @ssl_session = sess }
-          end
+        response
+      end
+    end
 
-          verify_hostname = @ssl_context.verify_hostname
+    # Instance methods prepended onto Net::HTTP.
+    module Extension
+      attr_accessor :proxy_connect_request_headers, :last_proxy_connect_response_headers
 
-          case @address
-          when Resolv::IPv4::Regex, Resolv::IPv6::Regex
-            @ssl_context.verify_hostname = false
-          else
-            ssl_host_address = @address
-          end
+      def connect
+        return super unless use_ssl? && proxy?
 
-          debug "starting SSL for #{conn_addr}:#{conn_port}..."
-          s = OpenSSL::SSL::SSLSocket.new(s, @ssl_context)
-          s.sync_close = true
-          s.hostname = ssl_host_address if s.respond_to?(:hostname=) && ssl_host_address
+        # Reject smuggled targets and header values before any socket I/O.
+        RubyProxyHeaders.validate_connect_target!(conn_address, @port)
+        RubyProxyHeaders.validate_connect_target!(@address, @port)
+        proxy_connect_request_headers&.each do |key, value|
+          RubyProxyHeaders.validate_header!(key, value)
+        end
 
-          if @ssl_session &&
-             Process.clock_gettime(Process::CLOCK_REALTIME) < @ssl_session.time.to_f + @ssl_session.timeout
-            s.session = @ssl_session
+        @last_proxy_connect_response_headers = nil
+        previous_http = Thread.current[:ruby_proxy_headers_active_http]
+        previous_headers = Thread.current[:ruby_proxy_headers_connect_headers]
+        begin
+          Thread.current[:ruby_proxy_headers_active_http] = self
+          Thread.current[:ruby_proxy_headers_connect_headers] = nil
+          super
+        ensure
+          Thread.current[:ruby_proxy_headers_active_http] = previous_http
+          if Thread.current[:ruby_proxy_headers_connect_headers].nil?
+            Thread.current[:ruby_proxy_headers_connect_headers] = previous_headers
           end
-          ssl_socket_connect(s, @open_timeout)
-          if (@ssl_context.verify_mode != OpenSSL::SSL::VERIFY_NONE) && verify_hostname
-            s.post_connection_check(@address)
-          end
-          debug "SSL established, protocol: #{s.ssl_version}, cipher: #{s.cipher[0]}"
-        end
-        @socket = Net::BufferedIO.new(s, read_timeout: @read_timeout,
-                                     write_timeout: @write_timeout,
-                                     continue_timeout: @continue_timeout,
-                                     debug_output: @debug_output)
-        @last_communicated = nil
-        on_connect
-      rescue StandardError => e
-        if s
-          debug "Conn close because of connect error #{e}"
-          s.close
         end
-        raise
       end
     end
 
     class << self
       def patch!
-        return if @patched
-
-        ::Net::HTTP.prepend(Extension)
+        ::Net::HTTP.prepend(Extension) unless ::Net::HTTP.ancestors.include?(Extension)
+        io_hooked = ::Net::BufferedIO.ancestors.include?(ConnectRequestWrite)
+        ::Net::BufferedIO.prepend(ConnectRequestWrite) unless io_hooked
+        response_class = ::Net::HTTPResponse.singleton_class
+        response_hooked = response_class.ancestors.include?(ConnectResponseRead)
+        response_class.prepend(ConnectResponseRead) unless response_hooked
         @patched = true
       end
 

data/lib/ruby_proxy_headers/rest_client.rb

@@ -1,89 +1,105 @@
 # frozen_string_literal: true
 
+require 'delegate'
+require 'openssl'
+require 'uri'
+require_relative '../ruby_proxy_headers'
+
+begin
+  require 'rest-client'
+rescue LoadError => e
+  raise LoadError, "rest-client is required for ruby_proxy_headers/rest_client (#{e.message})"
+end
+
 module RubyProxyHeaders
-  # RestClient integration for proxy headers support.
+  # RestClient uses Net::HTTP. HTTPS requests go through that client so
+  # redirects and payloads stay RestClient's. The Net::HTTP patch attaches
+  # CONNECT headers and records +X-ProxyMesh-IP+.
   #
   # @example
   #   response = RubyProxyHeaders::RestClient.get(
   #     'https://example.com',
-  #     proxy: 'http://user:pass@proxy:8080',
+  #     proxy: 'http://user:pass@proxy.example.com:31280',
   #     proxy_headers: { 'X-ProxyMesh-Country' => 'US' }
   #   )
-  #   puts response.proxy_response_headers
-  #
+  #   puts response.proxy_response_headers['X-ProxyMesh-IP']
   module RestClient
-    # Make a GET request with proxy headers.
-    def self.get(url, proxy:, proxy_headers: {}, **options)
-      request(:get, url, proxy: proxy, proxy_headers: proxy_headers, **options)
-    end
-
-    # Make a POST request with proxy headers.
-    def self.post(url, proxy:, proxy_headers: {}, payload: nil, **options)
-      request(:post, url, proxy: proxy, proxy_headers: proxy_headers, body: payload, **options)
-    end
-
-    # Make a PUT request with proxy headers.
-    def self.put(url, proxy:, proxy_headers: {}, payload: nil, **options)
-      request(:put, url, proxy: proxy, proxy_headers: proxy_headers, body: payload, **options)
-    end
-
-    # Make a DELETE request with proxy headers.
-    def self.delete(url, proxy:, proxy_headers: {}, **options)
-      request(:delete, url, proxy: proxy, proxy_headers: proxy_headers, **options)
+    # Sets CONNECT headers on the Net::HTTP object RestClient is about to use.
+    module NetHttpHook
+      def net_http_object(hostname, port)
+        http = super
+        headers = Thread.current[:ruby_proxy_headers_rest_client_headers]
+        http.proxy_connect_request_headers = headers if headers&.any?
+        http
+      end
     end
 
-    # Make a request with proxy headers.
-    def self.request(method, url, proxy:, proxy_headers: {}, **options)
-      require 'rest-client'
+    class << self
+      def get(url, proxy:, proxy_headers: {}, **options)
+        request(:get, url, proxy: proxy, proxy_headers: proxy_headers, **options)
+      end
 
-      uri = URI.parse(url)
+      def post(url, proxy:, proxy_headers: {}, payload: nil, **options)
+        request(:post, url, proxy: proxy, proxy_headers: proxy_headers, payload: payload, **options)
+      end
 
-      # For HTTPS with proxy headers, use our core connection
-      if uri.scheme == 'https' && !proxy_headers.empty?
-        response = RubyProxyHeaders::NetHTTP.request(
-          method,
-          url,
-          proxy: proxy,
-          proxy_headers: proxy_headers,
-          headers: options[:headers],
-          body: options[:body]
-        )
-        return response
+      def put(url, proxy:, proxy_headers: {}, payload: nil, **options)
+        request(:put, url, proxy: proxy, proxy_headers: proxy_headers, payload: payload, **options)
       end
 
-      # For HTTP or no proxy headers, use standard RestClient
-      ::RestClient.proxy = proxy
-      response = ::RestClient.send(method, url, options)
-      ProxyResponse.new(response, {})
-    end
+      def delete(url, proxy:, proxy_headers: {}, **options)
+        request(:delete, url, proxy: proxy, proxy_headers: proxy_headers, **options)
+      end
 
-    # Response wrapper with proxy headers accessor
-    class ProxyResponse
-      attr_reader :proxy_response_headers
+      def request(method, url, proxy:, proxy_headers: {}, **options)
+        install!
+        headers = proxy_headers || {}
+        https = URI.parse(url).scheme == 'https'
+        headers.each { |key, value| RubyProxyHeaders.validate_header!(key, value) } if https
 
-      def initialize(response, proxy_headers)
-        @response = response
-        @proxy_response_headers = proxy_headers
+        previous = Thread.current[:ruby_proxy_headers_rest_client_headers]
+        Thread.current[:ruby_proxy_headers_rest_client_headers] = https ? headers : nil
+        response = ::RestClient::Request.execute(execute_options(method, url, proxy, options))
+        captured = RubyProxyHeaders.proxy_connect_response_headers
+        ProxyResponse.new(response, captured ? captured.dup : HeaderMap.new)
+      ensure
+        Thread.current[:ruby_proxy_headers_rest_client_headers] = previous
       end
 
-      def code
-        @response.code
-      end
+      def install!
+        RubyProxyHeaders::NetHTTP.patch!
+        return if ::RestClient::Request.ancestors.include?(NetHttpHook)
 
-      def body
-        @response.body
+        ::RestClient::Request.prepend(NetHttpHook)
       end
 
-      def headers
-        @response.headers
-      end
+      private
 
-      def method_missing(method, *args, &block)
-        @response.send(method, *args, &block)
+      def execute_options(method, url, proxy, options)
+        payload = options.key?(:payload) ? options[:payload] : options[:body]
+        verify_ssl = options[:verify_ssl]
+        verify_ssl = OpenSSL::SSL::VERIFY_PEER if verify_ssl == true
+        verify_ssl = OpenSSL::SSL::VERIFY_NONE if verify_ssl == false
+        {
+          method: method,
+          url: url,
+          proxy: proxy,
+          headers: options[:headers],
+          payload: payload,
+          open_timeout: options[:open_timeout],
+          read_timeout: options[:read_timeout],
+          verify_ssl: verify_ssl
+        }.compact
       end
+    end
 
-      def respond_to_missing?(method, include_private = false)
-        @response.respond_to?(method, include_private) || super
+    # RestClient response plus CONNECT response headers.
+    class ProxyResponse < SimpleDelegator
+      attr_reader :proxy_response_headers
+
+      def initialize(response, proxy_headers)
+        super(response)
+        @proxy_response_headers = proxy_headers
       end
     end
   end

data/lib/ruby_proxy_headers/typhoeus.rb

@@ -1,101 +1,108 @@
 # frozen_string_literal: true
 
+require 'delegate'
+require 'uri'
+require_relative '../ruby_proxy_headers'
+
+begin
+  require 'typhoeus'
+rescue LoadError => e
+  raise LoadError, "typhoeus ~> 1.7 is required for ruby_proxy_headers/typhoeus (#{e.message})"
+end
+
 module RubyProxyHeaders
-  # Typhoeus/Ethon integration for proxy headers support.
-  # Typhoeus wraps libcurl, which has native support for CURLOPT_PROXYHEADER.
+  # Typhoeus adapter using libcurl's proxy-header list.
+  #
+  # Typhoeus 1.7 / Ethon 0.19 expose +:proxyheader+ (`CURLOPT_PROXYHEADER`) and
+  # +:headeropt+ (`CURLOPT_HEADEROPT`). With +headeropt: :separate+, those
+  # headers are sent only to the proxy. On HTTPS that is the CONNECT request.
+  # +:headers+ stay on the tunneled origin request.
+  #
+  # libcurl records the CONNECT response as the first header block of
+  # +response_headers+ and the origin response after it. Typhoeus's
+  # +response.headers+ is only the last block. On HTTPS through a proxy,
+  # +proxy_response_headers+ is that first block when its status is 2xx.
   #
   # @example
   #   response = RubyProxyHeaders::Typhoeus.get(
-  #     'https://example.com',
-  #     proxy: 'http://user:pass@proxy:8080',
+  #     'https://api.ipify.org?format=json',
+  #     proxy: 'http://user:pass@proxy.example.com:31280',
   #     proxy_headers: { 'X-ProxyMesh-Country' => 'US' }
   #   )
-  #   puts response.proxy_response_headers
-  #
+  #   puts response.proxy_response_headers['X-ProxyMesh-IP']
   module Typhoeus
-    # Make a GET request with proxy headers.
-    # @param url [String] Target URL
-    # @param proxy [String] Proxy URL
-    # @param proxy_headers [Hash] Custom headers to send to proxy
-    # @param options [Hash] Additional Typhoeus options
-    # @return [ProxyResponse]
-    def self.get(url, proxy:, proxy_headers: {}, **options)
-      request(:get, url, proxy: proxy, proxy_headers: proxy_headers, **options)
-    end
+    HTTP_STATUS = %r{\AHTTP/\d+(?:\.\d+)?\s+(\d{3})\b}i
 
-    # Make a POST request with proxy headers.
-    def self.post(url, proxy:, proxy_headers: {}, body: nil, **options)
-      request(:post, url, proxy: proxy, proxy_headers: proxy_headers, body: body, **options)
-    end
+    class << self
+      def get(url, proxy:, proxy_headers: {}, **options)
+        request(:get, url, proxy: proxy, proxy_headers: proxy_headers, **options)
+      end
 
-    # Make a request with proxy headers.
-    # @param method [Symbol] HTTP method
-    # @param url [String] Target URL
-    # @param proxy [String] Proxy URL
-    # @param proxy_headers [Hash] Custom headers to send to proxy
-    # @param options [Hash] Additional Typhoeus options
-    # @return [ProxyResponse]
-    def self.request(method, url, proxy:, proxy_headers: {}, **options)
-      require 'typhoeus'
-
-      uri = URI.parse(url)
-
-      # For HTTPS, we need custom handling since Typhoeus doesn't expose CURLOPT_PROXYHEADER
-      if uri.scheme == 'https' && !proxy_headers.empty?
-        # Use our core connection for now
-        # TODO: Extend Ethon to expose CURLOPT_PROXYHEADER for native support
-        response = RubyProxyHeaders::NetHTTP.request(
-          method,
-          url,
-          proxy: proxy,
-          proxy_headers: proxy_headers,
-          headers: options[:headers],
-          body: options[:body]
-        )
-        return response
+      def post(url, proxy:, proxy_headers: {}, body: nil, **options)
+        request(:post, url, proxy: proxy, proxy_headers: proxy_headers, body: body, **options)
       end
 
-      # For HTTP or no proxy headers, use standard Typhoeus
-      typhoeus_options = options.merge(
-        proxy: proxy,
-        method: method
-      )
+      def request(method, url, proxy:, proxy_headers: {}, **options)
+        typhoeus_options = options.merge(proxy: proxy, method: method)
+        unless proxy_headers.empty?
+          lines = proxy_headers.map do |name, value|
+            RubyProxyHeaders.validate_header!(name, value)
+            "#{name}: #{value}"
+          end
+          # The Slist has to stay in the options Typhoeus keeps. libcurl does not
+          # copy CURLOPT_PROXYHEADER, and Ethon clears its own reference on reset.
+          typhoeus_options[:proxyheader] = ::Ethon::Curl::Slist.new(::Ethon::Curl::Slist.build(lines))
+          typhoeus_options[:headeropt] = :separate
+        end
 
-      response = ::Typhoeus::Request.new(url, typhoeus_options).run
-      ProxyResponse.new(response, {})
-    end
+        response = ::Typhoeus::Request.new(url, typhoeus_options).run
+        ProxyResponse.new(response, connect_headers(response, url, proxy))
+      end
 
-    # Response wrapper with proxy headers accessor
-    class ProxyResponse
-      attr_reader :proxy_response_headers
+      private
 
-      def initialize(response, proxy_headers)
-        @response = response
-        @proxy_response_headers = proxy_headers
-      end
+      def connect_headers(response, url, proxy)
+        blocks = response.response_headers.to_s.split(/\r?\n\r?\n/).map(&:strip).select do |part|
+          part.start_with?('HTTP/')
+        end
+        block = blocks.first
+        return HeaderMap.new unless proxy_connect_block?(block, blocks.size, url, proxy)
 
-      def code
-        @response.code
-      end
+        headers = HeaderMap.new
+        block.each_line do |line|
+          stripped = line.strip
+          next if stripped.empty? || stripped.start_with?('HTTP/')
 
-      def body
-        @response.body
-      end
+          name, value = stripped.split(':', 2)
+          next if name.nil? || value.nil?
 
-      def headers
-        @response.headers
+          name = name.strip
+          value = value.strip
+          headers[name] = headers.key?(name) ? "#{headers[name]}, #{value}" : value
+        end
+        headers
       end
 
-      def success?
-        @response.success?
-      end
+      # Some proxies send "200 OK" rather than "200 Connection established".
+      # The CONNECT block is the first of at least two when the origin responded.
+      def proxy_connect_block?(block, block_count, url, proxy)
+        return false if block.nil? || proxy.nil? || block_count < 2
+        return false unless URI.parse(url.to_s).scheme == 'https'
 
-      def method_missing(method, *args, &block)
-        @response.send(method, *args, &block)
+        code = block.lines.first.to_s[HTTP_STATUS, 1]
+        code.to_i.between?(200, 299)
+      rescue URI::InvalidURIError
+        false
       end
+    end
+
+    # Typhoeus response plus the CONNECT response headers.
+    class ProxyResponse < SimpleDelegator
+      attr_reader :proxy_response_headers
 
-      def respond_to_missing?(method, include_private = false)
-        @response.respond_to?(method, include_private) || super
+      def initialize(response, proxy_headers)
+        super(response)
+        @proxy_response_headers = proxy_headers
       end
     end
   end

data/lib/ruby_proxy_headers/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RubyProxyHeaders
-  VERSION = '0.2.2'
+  VERSION = '0.3.0'
 end

data/lib/ruby_proxy_headers.rb

@@ -7,6 +7,38 @@ module RubyProxyHeaders
   INVALID_HEADER_NAME_RE = /[\r\n\0]/
   INVALID_HEADER_VALUE_RE = /[\r\n\0]/
 
+  # HTTP header map with case-insensitive lookup. Names are stored downcased,
+  # which is how Net::HTTP yields them. +X-ProxyMesh-IP+ and +x-proxymesh-ip+
+  # read the same value. +[]+, +[]=+, +fetch+, +delete+, and +key?+ normalize
+  # names. Other Hash methods still use the stored downcased key.
+  class HeaderMap < Hash
+    def [](key)
+      super(normalize(key))
+    end
+
+    def []=(key, value)
+      super(normalize(key), value)
+    end
+
+    def fetch(key, *args, &block)
+      super(normalize(key), *args, &block)
+    end
+
+    def delete(key)
+      super(normalize(key))
+    end
+
+    def key?(key)
+      super(normalize(key))
+    end
+
+    private
+
+    def normalize(key)
+      key.to_s.downcase
+    end
+  end
+
   # CONNECT response headers from the last Net::HTTP-based proxied HTTPS request on this thread.
   def self.proxy_connect_response_headers
     Thread.current[:ruby_proxy_headers_connect_headers]
@@ -22,4 +54,17 @@ module RubyProxyHeaders
       raise ArgumentError, "proxy CONNECT header value contains invalid characters (CR, LF, or NUL): #{value.inspect}"
     end
   end
+
+  # Raises ArgumentError if +host+ or +port+ contain CR, LF, or NUL bytes that
+  # would allow HTTP request smuggling when interpolated into a CONNECT line.
+  def self.validate_connect_target!(host, port)
+    if INVALID_HEADER_VALUE_RE.match?(host.to_s)
+      raise ArgumentError,
+            "CONNECT target host contains invalid characters (CR, LF, or NUL): #{host.inspect}"
+    end
+    if INVALID_HEADER_VALUE_RE.match?(port.to_s)
+      raise ArgumentError,
+            "CONNECT target port contains invalid characters (CR, LF, or NUL): #{port.inspect}"
+    end
+  end
 end