jruby-openssl 0.11.0.cr1-java → 0.12.2-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: f3f30690dc2b33cef639d984152204e362ca32fe
-  data.tar.gz: e28ede260833c9223108b43ca15d725224c678b7
+SHA256:
+  metadata.gz: 5e7e293b2549e684866105df2df1b7fdc93b930a9740bf6b5159149dfbc236e0
+  data.tar.gz: 771bace1ef936acd0ec9508f30f4636c3415a3785ebe29883490646b9221eae9
 SHA512:
-  metadata.gz: c061354db76fc82fc1b554e633c4192f3795e109a78e4aba8fe9d3d3a244a2dc5ff29ee8e6389876abf12999c080375c191f7be654d3fe839f01a9882589d8af
-  data.tar.gz: 2cc1932d607582de0f4858c6e11fc32774ca3a1653ce3efc9bea20204e358feffe274e13c1d96c44cff5fa77600678c4703cdaf7d4a0e62f27a9c08982457e29
+  metadata.gz: f746ec0e6551af8004714f6345154a0c52a429283828e8a41765617627d0498083283216b33dcca9fe1dd7206aeb1bc8d9bff0b2e6999395bfe8cdaa32dd295e
+  data.tar.gz: 9261e4930fd87105dfcf2ade1cba0cf8d241623394f83ecd0c86a476d151eb12de34fa480a0838347dcc4950acebae3306746b4e0c69ebeb2c109c38ce7a81ac

data/History.md

@@ -1,3 +1,48 @@
+## 0.12.2
+
+* [fix] work-around JRuby 9.2 autoload behavior (#248)
+  to be able to install jruby-openssl >= 0.12 on JRuby 9.2
+  while the default gem (shipped with JRuby) is < 0.12
+* [feat] support alpn negotiation in ssl context (#247)
+* [feat] support Java cipher names on `SSLContext#ciphers=`
+* [fix] properly handle `require_jar` fallback
+
+## 0.12.1
+
+* improved compatibility with the openssl gem (version 2.2.1)
+* JOSSL now ships with a single set of openssl .rb files
+  - providing compat with `required_ruby_version = '>= 2.3.0'`
+  - flat set of .rb files at *lib/openssl/* (based on openssl gem) 
+* revisited `OpenSSL::SSL::SSLContext::DEFAULT_PARAMS` defaults
+  - implicit `verify_hostname` default .rb callback still a noop
+  - TLS continues to rely on the Java SSL engine for hostname checks
+* working TLS 1.3 support
+* droped Java 1.7 support (at least Java 8 needed to use the gem)
+* fixed `SSLContext#options` matches C OpenSSL (using `OP_ALL`)
+* no longer filter out SSLv2 (for improved OpenSSL compatibility) 
+* implemented naive `SSLContext#ciphers` caching to speed-up TLS
+* `StoreError` raised due a Java exception now retain native cause
+
+## 0.12.0 (yanked)
+
+There were Java 8 and JRuby 9.3 regressions in this release, use 0.12.1 instead.
+
+## 0.11.0
+
+NOTE: This release aims to adapt the certificate verification logic to be aligned 
+with OpenSSL 1.1.1 as a resolution to issues due *DST Root CA X3* expiration, more
+details at: https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/ 
+
+The port is expected to be superior compared to the simple legacy verification,
+however in case of issues the previous algorithm is still around and can be toggled 
+using `JRUBY_OPTS="-J-Djruby.openssl.x509.store.verify=legacy"` system property.
+
+* **OpenSSL 1.1.1 cert verification port** (fixes #236) (#239)
+ - as a side-effect part of the PR to "allow multiple certs with same SubjectDN" 
+   (#198) got reverted, this has been causing verification regressions (since 0.10.5) 
+   for some users (#232) and is expected to be fixed   
+* [fix] replace deprecated getPeerCertificateChain (#231)
+
 ## 0.10.7
 
 * [feat] upgrade BC library to 1.68

data/Mavenfile

@@ -45,15 +45,18 @@ plugin( 'org.codehaus.mojo:build-helper-maven-plugin', '1.9' ) do
   execute_goal 'add-source', :phase => 'process-classes', :sources => [ gen_sources ]
 end
 
-plugin( :compiler, '3.1',
-        :source => '1.8', :target => java_target,
-        :encoding => 'UTF-8', :debug => true,
-        :showWarnings => true, :showDeprecation => true,
-        :excludes => [ 'module-info.java' ],
-        #:jdkToolchain => { :version => '[1.7,11)' },
+compiler_configuration = {
+    :source => '1.8', :target => java_target, :release => '8',
+    :encoding => 'UTF-8', :debug => true,
+    :showWarnings => true, :showDeprecation => true,
+    :excludes => [ 'module-info.java' ],
+    #:jdkToolchain => { :version => '[1.7,11)' },
+    :generatedSourcesDirectory => gen_sources,
+    :annotationProcessors => [ 'org.jruby.anno.AnnotationBinder' ]
+}
+compiler_configuration.delete(:release) if ENV_JAVA['java.specification.version'] == '1.8'
 
-        :generatedSourcesDirectory => gen_sources,
-        :annotationProcessors => [ 'org.jruby.anno.AnnotationBinder' ]) do
+plugin( :compiler, '3.9.0', compiler_configuration) do
 
   #execute_goal :compile, :id => 'annotation-binder', :phase => 'compile',
   #    :generatedSourcesDirectory => gen_sources, #:outputDirectory => gen_sources,
@@ -69,14 +72,6 @@ plugin( :compiler, '3.1',
                :compilerArgs => [ '', '-XDignore.symbol.file=true' ]
 end
 
-profile 'module-info' do
-  activation { jdk '[9,)' }
-  plugin :compiler, '3.8.1',
-         :source => '9', :target => java_target,
-         :release => '9',
-         :includes => [ 'module-info.java' ]
-end
-
 plugin :clean do
   execute_goals( 'clean', :id => 'default-clean', :phase => 'clean',
                  'filesets' => [
@@ -87,18 +82,18 @@ plugin :clean do
                  'failOnError' =>  'false' )
 end
 
-jar 'org.jruby:jruby-core', '1.7.20', :scope => :provided
+jar 'org.jruby:jruby-core', '9.1.11.0', :scope => :provided
+# for invoker generated classes we need to add javax.annotation when on Java > 8
+jar 'javax.annotation:javax.annotation-api', '1.3.1', :scope => :compile
 jar 'junit:junit', '[4.13.1,)', :scope => :test
 
-# 9.1.17.0 is Java 7 compatible (till supporting JRuby 1.7)
 # NOTE: to build on Java 11 - installing gems fails (due old jossl) with:
 #  load error: jopenssl/load -- java.lang.StringIndexOutOfBoundsException
-MVN_JRUBY_VERSION = ENV_JAVA['java.version'].to_i >= 9 ? '9.2.9.0' : '9.1.17.0'
+MVN_JRUBY_VERSION = ENV_JAVA['java.version'].to_i >= 9 ? '9.2.19.0' : '9.1.17.0'
 
 jruby_plugin! :gem do
   # when installing dependent gems we want to use the built in openssl not the one from this lib directory
-  # we compile against jruby-core-1.7.20 and want to keep this out of the plugin execution here
-  execute_goal :id => 'default-initialize', :addProjectClasspath => false, :libDirectory => 'something-which-does-not-exists'
+  execute_goal :id => 'default-package', :addProjectClasspath => false, :libDirectory => 'something-which-does-not-exists'
   execute_goals :id => 'default-push', :skip => true
 end
 
@@ -107,12 +102,12 @@ plugin :deploy, '2.8.1' do
   execute_goals( :deploy, :skip => false )
 end
 
-supported_bc_versions = %w{ 1.58 1.59 1.60 1.61 1.62 1.63 1.64 1.65 }
+supported_bc_versions = %w{ 1.60 1.61 1.62 1.63 1.64 1.65 1.66 1.67 1.68 }
 
 default_bc_version = File.read File.expand_path('lib/jopenssl/version.rb', File.dirname(__FILE__))
 default_bc_version = default_bc_version[/BOUNCY_CASTLE_VERSION\s?=\s?'(.*?)'/, 1]
 
-properties( 'jruby.plugins.version' => '1.1.8',
+properties( 'jruby.plugins.version' => '2.0.1', # 2.0.1
             'jruby.switches' => '-W0', # https://github.com/torquebox/jruby-maven-plugins/issues/94
             'bc.versions' => default_bc_version,
             'invoker.test' => '${bc.versions}',
@@ -151,8 +146,8 @@ invoker_run_options = {
       'runit.dir' => '${runit.dir}' }
 }
 
-jruby_9_K_versions  = %w{ 9.0.5.0 9.1.2.0 9.1.8.0 9.1.12.0 9.1.16.0 9.1.17.0 }
-jruby_9_K_versions += %w{ 9.2.0.0 9.2.5.0 9.2.6.0 9.2.7.0 9.2.8.0 9.2.9.0 }
+jruby_9_K_versions  = %w{ 9.1.2.0 9.1.8.0 9.1.12.0 9.1.16.0 9.1.17.0 }
+jruby_9_K_versions += %w{ 9.2.0.0 9.2.5.0 9.2.10.0 9.2.17.0 9.2.19.0 }
 
 jruby_9_K_versions.each { |version|
 profile :id => "test-#{version}" do

data/README.md

@@ -24,6 +24,9 @@ the JRuby [mailing list][1] or the [bug tracker][2].
 |      ~>0.9.18 |   1.6.8-9.1.x |  Java 6-8  |    1.50-1.55 |
 |        0.10.0 |  1.7.20-9.2.x |  Java 7-10 |    1.55-1.59 |
 |        0.10.3 |  1.7.20-9.2.x |  Java 7-11 |    1.56-1.62 |
+|      ~>0.10.5 |  1.7.20-9.3.x |  Java 7-11 |    1.60-1.68 |
+|      ~>0.11.x |   9.0.x-9.3.x |  Java 7-11 |    1.62-1.68 |
+|      ~>0.12.x |   9.1.x-9.3.x |  Java 8-15 |    1.65-1.68 |
 
 NOTE: backwards JRuby compatibility was not handled for versions <= **0.9.6** 
 

data/Rakefile

@@ -1,40 +1,27 @@
 #-*- mode: ruby -*-
 
-begin
-  require 'ruby-maven'
-rescue LoadError
-  warn "ruby-maven not available - some tasks will not work " <<
-       "either `gem install ruby-maven' or use mvn instead of rake"
-  desc "Package jopenssl.jar with the compiled classes"
-  task :jar do
-    sh "mvn prepare-package -Dmaven.test.skip=true"
-  end
-  namespace :jar do
-    desc "Package jopenssl.jar file (and dependendent jars)"
-    task :all do
-      sh "mvn package -Dmaven.test.skip=true"
-    end
-  end
-else
-  #Rake::Task[:jar].clear rescue nil
-  desc "Package jopenssl.jar with the compiled classes"
-  task :jar do
-    RubyMaven.exec( 'prepare-package -Dmaven.test.skip=true' )
-  end
-  namespace :jar do
-    desc "Package jopenssl.jar file (and dependendent jars)"
-    task :all do
-      RubyMaven.exec( 'package -Dmaven.test.skip=true' )
-    end
-  end
-  task :test_prepare do
-    RubyMaven.exec( 'prepare-package -Dmaven.test.skip=true' )
-    RubyMaven.exec( 'test-compile' ) # separate step due -Dmaven.test.skip=true
+#Rake::Task[:jar].clear rescue nil
+desc "Package jopenssl.jar with the compiled classes"
+task :jar do
+  sh( './mvnw prepare-package -Dmaven.test.skip=true' )
+end
+namespace :jar do
+  desc "Package jopenssl.jar file (and dependendent jars)"
+  task :all do
+    sh( './mvnw package -Dmaven.test.skip=true' )
   end
 end
+task :test_prepare do
+  sh( './mvnw prepare-package -Dmaven.test.skip=true' )
+  sh( './mvnw test-compile' ) # separate step due -Dmaven.test.skip=true
+end
+
+task :clean do
+  sh( './mvnw clean' )
+end
 
 task :build do
-  RubyMaven.exec('package -Dmaven.test.skip')
+  sh( './mvnw clean package -Dmaven.test.skip=true' )
 end
 
 task :default => :build
@@ -55,16 +42,15 @@ task :test => 'lib/jopenssl.jar'
 namespace :integration do
   it_path = File.expand_path('../src/test/integration', __FILE__)
   task :install do
-    Dir.chdir(it_path) do
-      ruby "-S bundle install --gemfile '#{it_path}/Gemfile'"
-    end
+    ruby "-C #{it_path} -S bundle install"
   end
   # desc "Run IT tests"
   task :test => 'lib/jopenssl.jar' do
     unless File.exist?(File.join(it_path, 'Gemfile.lock'))
       raise "bundle not installed, run `rake integration:install'"
     end
-    loader = "ARGV.each { |f| require f }" ; lib = [ 'lib', it_path ]
+    loader = "ARGV.each { |f| require f }"
+    lib = [ File.expand_path('../lib', __FILE__), it_path ]
     test_files = FileList['src/test/integration/*_test.rb'].map { |path| path.sub('src/test/integration/', '') }
     ruby "-I#{lib.join(':')} -C src/test/integration -e \"#{loader}\" #{test_files.map { |f| "\"#{f}\"" }.join(' ')}"
   end

data/lib/jopenssl/load.rb

@@ -2,20 +2,22 @@ warn 'Loading jruby-openssl gem in a non-JRuby interpreter' unless defined? JRUB
 
 require 'jopenssl/version'
 
-warn "JRuby #{JRUBY_VERSION} is not supported by jruby-openssl #{JOpenSSL::VERSION}" if JRUBY_VERSION < '1.7.20'
-
 # NOTE: assuming user does pull in BC .jars from somewhere else on the CP
 unless ENV_JAVA['jruby.openssl.load.jars'].eql?('false')
   version = JOpenSSL::BOUNCY_CASTLE_VERSION
-  bc_jars = nil
   begin
     require 'jar-dependencies'
     # if we have jar-dependencies we let it track the jars
-    require_jar( 'org.bouncycastle', 'bcprov-jdk15on', version )
-    require_jar( 'org.bouncycastle', 'bcpkix-jdk15on', version )
-    require_jar( 'org.bouncycastle', 'bctls-jdk15on',  version )
+    require_jar 'org.bouncycastle', 'bcprov-jdk15on', version
+    require_jar 'org.bouncycastle', 'bcpkix-jdk15on', version
+    require_jar 'org.bouncycastle', 'bctls-jdk15on',  version
+    begin # bcutil got extracted from bcprov in BC 1.69
+      require_jar 'org.bouncycastle', 'bcutil-jdk15to18', version
+    rescue LoadError, RuntimeError
+      # continue without loading the jar - assume we got BC < 1.69
+    end
     bc_jars = true
-  rescue LoadError
+  rescue LoadError, RuntimeError
     bc_jars = false
   end
   unless bc_jars
@@ -34,17 +36,50 @@ else; require 'jruby'
 end
 
 if RUBY_VERSION > '2.3'
-  load 'jopenssl23/openssl.rb'
   load 'jopenssl/_compat23.rb'
-elsif RUBY_VERSION > '2.2'
-  load 'jopenssl22/openssl.rb'
-elsif RUBY_VERSION > '2.1'
-  load 'jopenssl21/openssl.rb'
-else
-  load 'jopenssl19/openssl.rb'
 end
 
+# NOTE: content bellow should live in *lib/openssl.rb* but due RubyGems/Bundler
+# `autoload :OpenSSL` this will cause issues if an older version (0.11) is the
+# default gem under JRuby 9.2 (which on auto-load does not trigger a dynamic
+# require - this is only fixed in JRuby 9.3)
+
 module OpenSSL
   autoload :Config, 'openssl/config' unless const_defined?(:Config, false)
   autoload :PKCS12, 'openssl/pkcs12'
 end
+
+=begin
+= Info
+  'OpenSSL for Ruby 2' project
+  Copyright (C) 2002  Michal Rokos <m.rokos@sh.cvut.cz>
+  All rights reserved.
+
+= Licence
+  This program is licensed under the same licence as Ruby.
+  (See the file 'LICENCE'.)
+=end
+
+require 'openssl/bn'
+require 'openssl/pkey'
+require 'openssl/cipher'
+#require 'openssl/config' if OpenSSL.const_defined?(:Config, false)
+require 'openssl/digest'
+require 'openssl/hmac'
+require 'openssl/x509'
+require 'openssl/ssl'
+require 'openssl/pkcs5'
+
+module OpenSSL
+  # call-seq:
+  #   OpenSSL.secure_compare(string, string) -> boolean
+  #
+  # Constant time memory comparison. Inputs are hashed using SHA-256 to mask
+  # the length of the secret. Returns +true+ if the strings are identical,
+  # +false+ otherwise.
+  def self.secure_compare(a, b)
+    hashed_a = OpenSSL::Digest.digest('SHA256', a)
+    hashed_b = OpenSSL::Digest.digest('SHA256', b)
+    OpenSSL.fixed_length_secure_compare(hashed_a, hashed_b) && a == b
+  end
+end

data/lib/jopenssl/version.rb

@@ -1,9 +1,10 @@
 module JOpenSSL
-  VERSION = '0.11.0.cr1'
+  VERSION = '0.12.2'
   BOUNCY_CASTLE_VERSION = '1.68'
 end
 
 Object.class_eval do
   Jopenssl = JOpenSSL
   private_constant :Jopenssl if respond_to?(:private_constant)
+  deprecate_constant :Jopenssl if respond_to?(:deprecate_constant)
 end

data/lib/openssl/bn.rb

@@ -1,9 +1,40 @@
-if RUBY_VERSION > '2.3'
-  load "jopenssl23/openssl/#{File.basename(__FILE__)}"
-elsif RUBY_VERSION > '2.2'
-  load "jopenssl22/openssl/#{File.basename(__FILE__)}"
-elsif RUBY_VERSION > '2.1'
-  load "jopenssl21/openssl/#{File.basename(__FILE__)}"
-else
-  load "jopenssl19/openssl/#{File.basename(__FILE__)}"
-end
+# frozen_string_literal: true
+#--
+#
+# = Ruby-space definitions that completes C-space funcs for BN
+#
+# = Info
+# 'OpenSSL for Ruby 2' project
+# Copyright (C) 2002  Michal Rokos <m.rokos@sh.cvut.cz>
+# All rights reserved.
+#
+# = Licence
+# This program is licensed under the same licence as Ruby.
+# (See the file 'LICENCE'.)
+#++
+
+module OpenSSL
+  class BN
+    include Comparable
+
+    def pretty_print(q)
+      q.object_group(self) {
+        q.text ' '
+        q.text to_i.to_s
+      }
+    end
+  end # BN
+end # OpenSSL
+
+##
+#--
+# Add double dispatch to Integer
+#++
+class Integer
+  # Casts an Integer as an OpenSSL::BN
+  #
+  # See `man bn` for more info.
+  def to_bn
+    OpenSSL::BN::new(self)
+  end
+end # Integer