spinel-spinner 0.1.0.pre.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 192df4472958ec515d42c017b8aae2423e10a3ada0e2fc81a665d8a517b47246
+  data.tar.gz: 471ef455c84ff680da6f725d2ac78664fc22b147f65259e32cd1924b4aefd8dc
+SHA512:
+  metadata.gz: c1abf1727775dec5fde5f46b967b895e0d1d246d62a746bd6d628b96962ad84ce06dd414df21471b1cc618e8eb6957c7d3a9813a74054af87fecb3dff63bbcf0
+  data.tar.gz: 225b0564014e7a341506c71db3d66c8f753fee28558fccb01dd19af4c54890b1becd6946e08a0aae0ffca177bd4d83931e477eb32f98c77ae0f3e50ada11afd3

data/CHANGELOG.md

@@ -0,0 +1,14 @@
+## [Unreleased]
+
+- Rename the distribution to `spinel-spinner` while retaining `require "spinner"`
+  and the `Spinner` namespace.
+
+## [0.1.0.pre.1] - 2026-10-28
+
+- Prepare the first public preview of the packaged Spinel HTTP server.
+- Parse bracketed Forwarded IPv6 addresses without storing a MatchData value,
+  avoiding a Spinel C type mismatch when compiled with Hamster.
+
+## [0.1.0] - 2026-10-18
+
+- Initial release

data/LICENSE.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2026 Dillon Wyatt
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/README.md

@@ -0,0 +1,164 @@
+# Spinner
+
+Spinner is a native Spinel HTTP/1.1 server. An application implements `call(env)`
+and returns `[status, headers, body]`. Compile the application with the packaged
+library, then run the resulting executable:
+
+```ruby
+require "spinner"
+
+class Application
+  def call(env)
+    [200, {"content-type" => "text/plain"}, ["Hello"]]
+  end
+end
+
+Spinner::Server.new(Application.new, host: "127.0.0.1", port: 4000).run
+```
+
+```sh
+spinel app.rb --require-gate -I lib -o app
+./app
+```
+
+The environment includes request method, path, query, protocol, validated Host,
+content headers, normalized `HTTP_*` headers, `REMOTE_ADDR`, `rack.url_scheme`,
+and binary `rack.input`. Input supports `read(length = nil, buffer = nil)`,
+`gets`, `each`, `rewind`, and `close`. Dispatch waits for the complete request
+body. Input and temporary storage belong to the request and are closed when its
+response finishes. Calling `read` without a length explicitly allocates the
+remaining body; consume with sized reads to keep application memory bounded.
+
+Headers use lowercase names and string or string-array values. Arrays emit
+separate fields, including `set-cookie`. Response framing belongs to Spinner.
+An array body produces a Content-Length response; an enumerable body streams
+with HTTP/1.1 chunking (HTTP/1.0 streams close the connection). HEAD closes the
+body without enumerating streams. Finite HTTP/1.1 streams preserve keep-alive
+and pipelining. Body `close` runs after completion, errors, or disconnection.
+
+| Option | Default | Behavior |
+| --- | --- | --- |
+| `max_body_bytes` | 1 MiB | Decoded body limit for both framing modes; overflow returns 413 |
+| `body_memory_bytes` | 64 KiB | Spill threshold, between zero and body limit |
+| `spool_directory` | `TMPDIR` or `/tmp` | Exclusive binary files, mode 0600 |
+| `spool_budget_bytes` | 128 MiB | Aggregate server disk budget; divided evenly across worker processes |
+| `storage_workers` | 2 | Disk workers per process; socket reads pause during pending writes |
+| `max_header_bytes` | 32 KiB | Request header limit |
+| `header_timeout`, `body_timeout`, `write_timeout` | 5 seconds each | Ordinary network deadlines |
+| `stream_idle_timeout` | 30 seconds | Stream/upgrade transport idle deadline, refreshed on progress |
+| `max_streams`, `max_upgrades` | 32 each | Separate execution/admission limits per process; excess returns 503 before headers |
+| `trusted_proxies` | `[]` | IPv4/IPv6 CIDRs allowed to supply standardized Forwarded metadata |
+| `threads`, `queue_capacity`, `max_connections` | 4, 64, 128 | Application workers, queued work, accepted connections per process |
+| `queue_timeout`, `keepalive_timeout` | 5 seconds each | Admission wait and idle connection deadlines |
+| `max_requests_per_connection` | 100 | Keep-alive request ceiling |
+| `drain_timeout` | 10 seconds | Shutdown deadline |
+| `worker_processes` | 1 | Supervised TCP workers; HUP rolls them one at a time |
+| `reactor_heartbeat` | `false` | Emit the once-per-second `SPINNER_METRIC event=reactor` snapshot |
+| `request_metrics` | `false` | Emit routine `queued`, `start`, and `finish` request metrics |
+| `unix_path`, `listener` | `nil` | Unix socket or supplied listener, mutually exclusive |
+| `tls_cert`, `tls_key` | `nil` | PEM chain/key pair for TCP TLS |
+
+Spool exhaustion and filesystem failures return 503 and release storage.
+Transport, application, stream, storage, admission, worker, TLS, and shutdown
+metrics go to stderr as `SPINNER_METRIC event=...` records. Unix sockets have
+an empty remote address. Forwarded fields are ignored for untrusted immediate
+peers. Trusted chains are validated in full, then walked from the nearest peer
+until the first untrusted address. Malformed chains do not change identity or
+scheme; X-Forwarded-* fields never change them.
+
+The periodic reactor heartbeat and routine request metrics are disabled by
+default. Enable them in Ruby with `reactor_heartbeat: true` and
+`request_metrics: true`, or with `SPINNER_REACTOR_HEARTBEAT=1` and
+`SPINNER_REQUEST_METRICS=1`. Request metrics include queue admission and
+worker/stream lifecycle events; failure, rejection, worker, and shutdown
+metrics remain enabled.
+
+TLS loads libssl when requested, checks chain/key loading and key matching,
+permits TLS 1.2/1.3, and selects only `http/1.1` via ALPN. Clients can omit ALPN.
+Set `SPINNER_SSL_LIBRARY` to a matching OpenSSL shared library if needed.
+
+TERM/INT stop admission, close idle and partial clients, and allow active work
+to finish within the drain deadline. HUP in multiprocess mode rolls workers.
+Unexpected worker exits trigger replacement; more than five unexpected exits
+in ten seconds stop the supervisor. Workers detect parent death. Network
+timeouts do not safely interrupt arbitrary application or enumerator code.
+A timed-out enumerator retains its bounded execution slot until it returns or
+the worker exits. Recover stuck application code by replacing the process.
+Abruptly killing an unsupervised process can leave a named spool file; a
+supervisor removes its dead workers' spool files.
+
+Optional WebSockets use the bundled adapter:
+
+```ruby
+require "spinner/websocket"
+
+class Echo
+  def call(session)
+    message = session.read_message # [opcode, binary bytes], or nil after close
+    session.write_message(message[0], message[1]) unless message.nil?
+    session.close
+  end
+end
+
+class Application
+  def call(env)
+    [101, {"upgrade" => "websocket"}, Echo.new]
+  end
+end
+
+application = Spinner::WebSocket::Adapter.new(Application.new,
+  max_message_bytes: 1048576, idle_timeout: 30.0)
+Spinner::Server.new(application).run
+```
+
+The adapter validates handshakes before application dispatch, bounds messages,
+validates masking and UTF-8 text, reassembles fragmentation, handles ping/pong,
+and exchanges close frames. It does not negotiate extensions or subprotocols.
+The core upgrade API accepts `[101, headers, Spinner::Upgrade.new { |transport,
+buffered_bytes| ... }]`. The callback owns the transport until it returns;
+Spinner keeps the connection counted and closes it on return or shutdown.
+
+Supported methods are GET, HEAD, POST, PUT, PATCH, DELETE, and OPTIONS, including
+`OPTIONS *`. Absolute targets must match Host and transport scheme. TRACE and
+CONNECT are disabled. Duplicate Host/framing/singleton fields, normalization
+collisions, trailers, and ambiguous framing are rejected. Ordinary repeated
+fields combine with commas; Cookie uses semicolons. Routing, multipart/form
+parsing, authentication, and middleware belong to the application. Full Rack
+compatibility, HTTP/2, mTLS, SNI certificate selection, early hints, sendfile,
+and Puma CLI parity remain outside this contract.
+
+The reference dependency is **Puma 8.0.2**. Tests build and unpack the gem,
+compile basic startup and native component probes separately from the expanded
+application fixture, and exercise native executables over sockets:
+
+For a package-level preview, build and install the gem, then compile with the
+installed library path. Spinel is a separate compiler prerequisite:
+
+```sh
+gem build spinel-spinner.gemspec
+gem install --local spinel-spinner-0.1.0.pre.1.gem
+spinel app.rb --require-gate -I "$(ruby -e 'puts Gem::Specification.find_by_name("spinel-spinner").full_gem_path')/lib" -o app
+```
+
+The gem is named `spinel-spinner`; application code uses `require "spinner"`
+and the `Spinner` namespace. In a Gemfile, use
+`gem "spinel-spinner", require: "spinner"` when using Bundler's automatic requires.
+
+The installed gem provides Ruby source to the compiler; it does not provide a
+precompiled server executable. Applications still require a Spinel compilation
+step for their own entrypoint.
+
+```sh
+bundle install
+bundle exec rake test
+bundle exec rake soak
+```
+
+The GitHub Actions workflow is manual-only for now. It uses a GitHub-hosted
+Ubuntu runner, installs the native test tools, and builds a pinned Spinel
+revision. Select **Run workflow** in the Actions tab; enable the `soak` input to
+run the longer resource and restart checks. Locally, provide Spinel, a C
+compiler, OpenSSL, and Nginx on `PATH`. `KEEP_SPINNER_TEST_ARTIFACTS=1` retains
+build and process artifacts; failed startup/process logs are retained
+automatically. See
+[test/COVERAGE.md](test/COVERAGE.md) for evidence and remaining release gates.

data/lib/spinner/body_storage.rb

@@ -0,0 +1,106 @@
+module Spinner
+  # One budget per worker process. Reservations include every byte in a spool.
+  class StorageBudget
+    def initialize(limit)
+      @limit = limit
+      @used = 0
+      @lock = Mutex.new
+    end
+
+    def reserve(bytes)
+      @lock.synchronize do
+        if @used + bytes > @limit
+          warn "SPINNER_METRIC event=spool_exhausted bytes=#{@used} limit=#{@limit}"
+          raise RequestError.new(503, "spool budget exhausted")
+        end
+        @used += bytes
+      end
+    end
+
+    def release(bytes)
+      @lock.synchronize { @used -= bytes }
+    end
+  end
+
+  class BodyStorage
+    attr_reader :size
+
+    def initialize(maximum, threshold, directory, budget)
+      @maximum = maximum
+      @threshold = threshold
+      @directory = directory
+      @budget = budget
+      @bytes = "".b
+      @file = nil
+      @path = nil
+      @reserved = 0
+      @size = 0
+      @closed = false
+    end
+
+    def append(bytes)
+      raise IOError, "closed body" if @closed
+      raise RequestError.new(413, "request body too large") if @size + bytes.bytesize > @maximum
+      if @file.nil? && @size + bytes.bytesize > @threshold
+        # Exclusive creation and mode 0600 prevent following an existing path.
+        20.times do
+          @path = File.join(@directory, "spinner-#{Process.pid}-#{rand(1_000_000_000)}.body")
+          begin
+            @file = File.open(@path, File::RDWR | File::CREAT | File::EXCL, 0600)
+            @file.binmode
+            break
+          rescue Errno::EEXIST
+            @path = nil
+          end
+        end
+        raise IOError, "cannot create spool" if @file.nil?
+        reserve(@bytes.bytesize)
+        @file.write(@bytes)
+        @bytes = "".b
+        warn "SPINNER_METRIC event=body_spill pid=#{Process.pid}"
+      end
+      if @file.nil?
+        @bytes << bytes
+      else
+        reserve(bytes.bytesize)
+        @file.write(bytes)
+      end
+      @size += bytes.bytesize
+    rescue SystemCallError, IOError => error
+      close
+      raise RequestError.new(503, "body storage unavailable: #{error.message}")
+    end
+
+    def reserve(bytes)
+      @budget.reserve(bytes)
+      @reserved += bytes
+    end
+
+    def input
+      if @file.nil?
+        Input.new(@bytes)
+      else
+        @file.flush
+        @file.rewind
+        Input.new("".b, @file)
+      end
+    end
+
+    def close
+      return if @closed
+      @closed = true
+      warn "SPINNER_METRIC event=body_cleanup bytes=#{@size} disk_bytes=#{@reserved}" if @reserved > 0
+      begin
+        @file.close unless @file.nil? || @file.closed?
+      ensure
+        File.unlink(@path) if !@path.nil? && File.exist?(@path)
+      end
+    ensure
+      if @reserved > 0
+        @budget.release(@reserved)
+        @reserved = 0
+      end
+      @bytes = "".b
+    end
+  end
+end

data/lib/spinner/chunk_decoder.rb

@@ -0,0 +1,72 @@
+module Spinner
+  # Incremental HTTP/1.1 chunk framing. Only decoded bytes count toward the
+  # body limit; trailer fields are deliberately rejected until modeled safely.
+  class ChunkDecoder
+    attr_reader :remainder
+
+    def initialize(storage, maximum = RequestParser::MAX_BODY_BYTES)
+      @storage = storage
+      @maximum = maximum
+      @buffer = "".b
+      @size = 0
+      @remaining = 0
+      @state = :size
+      @remainder = "".b
+    end
+
+    def complete?
+      @state == :done
+    end
+
+    def body
+      @storage.input
+    end
+
+    def feed(bytes)
+      raise RequestError.new(400, "chunk body already complete") if complete?
+      @buffer << bytes
+      loop do
+        case @state
+        when :size
+          boundary = @buffer.index("\r\n")
+          raise RequestError.new(400, "chunk size line too long") if boundary.nil? && @buffer.bytesize > 1024
+          break if boundary.nil?
+          raise RequestError.new(400, "chunk size line too long") if boundary > 1024
+          line = @buffer.slice!(0, boundary + 2).byteslice(0, boundary)
+          token = line.split(";", 2).first
+          raise RequestError.new(400, "invalid chunk size") unless token.match?(/\A[0-9a-fA-F]+\z/)
+          raise RequestError.new(400, "invalid chunk extension") if line.match?(/[\x00-\x1f\x7f]/)
+          digits = token.downcase.sub(/\A0+/, "")
+          digits = "0" if digits.empty?
+          limit = (@maximum - @size).to_s(16)
+          if digits.length > limit.length || (digits.length == limit.length && digits > limit)
+            raise RequestError.new(413, "request body exceeds configured limit")
+          end
+          @remaining = digits.to_i(16)
+          @state = @remaining == 0 ? :trailers : :data
+        when :data
+          break if @buffer.empty?
+          count = [@remaining, @buffer.bytesize].min
+          part = @buffer.slice!(0, count).b
+          @storage.append(part)
+          @size += count
+          @remaining -= count
+          @state = :terminator if @remaining == 0
+        when :terminator
+          break if @buffer.bytesize < 2
+          raise RequestError.new(400, "invalid chunk terminator") unless @buffer.start_with?("\r\n")
+          @buffer.slice!(0, 2)
+          @state = :size
+        when :trailers
+          break if @buffer.bytesize < 2
+          raise RequestError.new(400, "chunk trailers unsupported") unless @buffer.start_with?("\r\n")
+          @remainder = @buffer.byteslice(2, @buffer.bytesize - 2).to_s.b
+          @buffer = "".b
+          @state = :done
+          break
+        end
+      end
+      complete?
+    end
+  end
+end

data/lib/spinner/host_authority.rb

@@ -0,0 +1,86 @@
+module Spinner
+  # Host is mandatory in this HTTP/1.1 subset. Validate without DNS lookup.
+  class HostAuthority
+    attr_reader :name
+
+    def initialize(authority)
+      @name = ""
+      if authority.start_with?("[")
+        closing = authority.index("]")
+        raise RequestError.new(400, "invalid Host literal") if closing.nil?
+        literal = authority.byteslice(1, closing - 1)
+        unless ipv6?(literal)
+          raise RequestError.new(400, "invalid Host IPv6 address")
+        end
+        @name = authority.byteslice(0, closing + 1)
+        suffix = authority.byteslice(closing + 1, authority.bytesize - closing - 1)
+        unless suffix.empty?
+          raise RequestError.new(400, "invalid Host authority") unless suffix.start_with?(":")
+          validate_port(suffix.delete_prefix(":"))
+        end
+      else
+        parts = authority.split(":", 2)
+        @name = parts[0].to_s
+        hostname = @name.delete_suffix(".")
+        if hostname.empty? || hostname.bytesize > 253 || hostname.end_with?(".")
+          raise RequestError.new(400, "missing or invalid Host")
+        end
+        hostname.split(".").each do |label|
+          unless label.match?(/\A[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\z/)
+            raise RequestError.new(400, "invalid Host name")
+          end
+        end
+        if hostname.match?(/\A[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+\z/)
+          raise RequestError.new(400, "invalid Host IPv4 address") unless ipv4?(hostname)
+        end
+        validate_port(parts[1]) if parts.length == 2
+      end
+    end
+
+    def validate_port(port)
+      unless port.match?(/\A[0-9]{1,5}\z/) && port.to_i >= 1 && port.to_i <= 65535
+        raise RequestError.new(400, "invalid Host port")
+      end
+    end
+
+    def ipv4?(address)
+      parts = address.split(".", -1)
+      return false unless parts.length == 4
+      parts.each do |part|
+        return false unless part.match?(/\A(?:0|[1-9][0-9]{0,2})\z/) && part.to_i <= 255
+      end
+      true
+    end
+
+    # Validate groups without constructing a 128-bit integer: the bundled
+    # IPAddr overflows on addresses such as 2001:db8::1 in this Spinel revision.
+    def ipv6?(address)
+      text = address
+      if text.include?(".")
+        colon = text.rindex(":")
+        return false if colon.nil?
+        tail = text.byteslice(colon + 1, text.bytesize - colon - 1)
+        return false unless ipv4?(tail)
+        # An IPv4 tail occupies two hexadecimal groups.
+        text = text.byteslice(0, colon + 1) + "0:0"
+      end
+      halves = text.split("::", -1)
+      return false if halves.length > 2
+      groups = []
+      halves.each do |half|
+        next if half.empty?
+        return false if half.start_with?(":") || half.end_with?(":")
+        groups += half.split(":")
+      end
+      if halves.length == 2
+        return false unless groups.length < 8
+      else
+        return false unless groups.length == 8
+      end
+      groups.each do |group|
+        return false unless group.match?(/\A[0-9A-Fa-f]{1,4}\z/)
+      end
+      true
+    end
+  end
+end

data/lib/spinner/input.rb

@@ -0,0 +1,58 @@
+require "stringio"
+
+module Spinner
+  # Both backends expose binary IO semantics without copying a spool into RAM.
+  class Input
+    def initialize(bytes, file = nil)
+      @file = file
+      @memory = file.nil? ? StringIO.new(bytes.b, "rb") : nil
+      @closed = false
+    end
+
+    def read(length = nil, buffer = nil)
+      raise IOError, "closed input" if @closed
+      result = if @file.nil?
+                 length.nil? ? @memory.read : @memory.read(length)
+               else
+                 length.nil? ? @file.read : @file.read(length)
+               end
+      buffer.replace(result.to_s.b) unless buffer.nil?
+      result.nil? ? nil : (buffer.nil? ? result.b : buffer)
+    end
+
+    def gets(separator = "\n", limit = nil)
+      raise IOError, "closed input" if @closed
+      result = if @file.nil?
+        limit.nil? ? @memory.gets(separator) : @memory.gets(separator, limit)
+      else
+        limit.nil? ? @file.gets(separator) : @file.gets(separator, limit)
+      end
+      result.nil? ? nil : result.b
+    end
+
+    def each
+      return enum_for(:each) unless block_given?
+      while (line = gets)
+        yield line
+      end
+      self
+    end
+
+    def rewind
+      raise IOError, "closed input" if @closed
+      @file.nil? ? @memory.rewind : @file.rewind
+      0
+    end
+
+    def close
+      return if @closed
+      @closed = true
+      if @file.nil?
+        @memory.close
+      else
+        @file.close unless @file.closed?
+      end
+      nil
+    end
+  end
+end

data/lib/spinner/proxy_metadata.rb

@@ -0,0 +1,93 @@
+module Spinner
+  class ProxyMetadata
+    def initialize(proxies)
+      raise ArgumentError, "trusted_proxies must be an array of CIDRs" unless proxies.is_a?(Array) && proxies.all? { |proxy| proxy.is_a?(String) }
+      @networks = proxies.map do |proxy|
+        address, prefix = proxy.split("/", 2)
+        bytes = address_bytes(address)
+        raise ArgumentError, "invalid trusted proxy" if bytes.nil?
+        bits = prefix.nil? ? bytes.length * 8 : prefix.to_i
+        if (!prefix.nil? && !prefix.match?(/\A[0-9]+\z/)) || bits < 0 || bits > bytes.length * 8
+          raise ArgumentError, "invalid proxy prefix"
+        end
+        [bytes, bits]
+      end
+    end
+
+    def address_bytes(address)
+      validator = HostAuthority.allocate
+      if validator.ipv4?(address)
+        return address.split(".").map(&:to_i)
+      end
+      return nil unless validator.ipv6?(address)
+      text = address
+      if text.include?(".")
+        index = text.rindex(":")
+        tail = text.byteslice(index + 1, text.bytesize).split(".").map(&:to_i)
+        text = text.byteslice(0, index + 1) + ((tail[0] << 8) | tail[1]).to_s(16) + ":" + ((tail[2] << 8) | tail[3]).to_s(16)
+      end
+      halves = text.split("::", -1)
+      left = halves[0].empty? ? [] : halves[0].split(":")
+      right = halves.length == 2 && !halves[1].empty? ? halves[1].split(":") : []
+      groups = halves.length == 2 ? left + Array.new(8 - left.length - right.length, "0") + right : left
+      bytes = []
+      groups.each { |group| value = group.to_i(16); bytes << (value >> 8); bytes << (value & 255) }
+      bytes
+    end
+
+    def trusted?(address)
+      bytes = address_bytes(address)
+      return false if bytes.nil?
+      @networks.any? do |network, bits|
+        next false unless bytes.length == network.length
+        whole = bits / 8
+        rest = bits % 8
+        bytes.take(whole) == network.take(whole) && (rest == 0 || (bytes[whole] >> (8 - rest)) == (network[whole] >> (8 - rest)))
+      end
+    end
+
+    def apply(env, peer)
+      env["REMOTE_ADDR"] = peer
+      return env unless trusted?(peer) && env.key?("HTTP_FORWARDED")
+      chain = []
+      env["HTTP_FORWARDED"].split(",").each do |element|
+        fields = {}
+        element.split(";").each do |part|
+          key, value = part.strip.split("=", 2)
+          return env if value.nil? || fields.key?(key.downcase)
+          if value.start_with?('"') && value.end_with?('"')
+            value = value.byteslice(1, value.bytesize - 2)
+          end
+          return env if value.include?('"') || value.include?("\\")
+          fields[key.downcase] = value
+        end
+        address = fields["for"]
+        return env if address.nil?
+        if address.start_with?("[")
+          return env unless address.match?(/\A\[([^\]]+)\](?::[0-9]{1,5})?\z/)
+          closing = address.index("]")
+          address = address.byteslice(1, closing - 1)
+        elsif address.include?(":")
+          return env unless address.match?(/\A[0-9.]+:[0-9]{1,5}\z/)
+          address = address.split(":")[0]
+        end
+        return env if address_bytes(address).nil?
+        proto = fields["proto"]
+        return env if !proto.nil? && !["http", "https"].include?(proto)
+        chain << [address, proto]
+      end
+      current = peer
+      selected = nil
+      chain.reverse_each do |entry|
+        break unless trusted?(current)
+        selected = entry
+        current = entry[0]
+      end
+      unless selected.nil?
+        env["REMOTE_ADDR"] = selected[0]
+        env["rack.url_scheme"] = selected[1] unless selected[1].nil?
+      end
+      env
+    end
+  end
+end