jruby-openssl 0.16.1-java → 0.19.0-java

data/README.md

@@ -1,35 +1,34 @@
 # JRuby-OpenSSL
 
-[JRuby-OpenSSL](https://github.com/jruby/jruby-openssl) is an add-on gem for
-[JRuby](https://www.jruby.org/) that emulates the Ruby OpenSSL native library.
+[JRuby-OpenSSL](https://github.com/jruby/jruby-openssl) is an extension gem for
+[JRuby](https://www.jruby.org/) that emulates the Ruby `OpenSSL` native library.
 
 Under the hood it uses the [Bouncy Castle Crypto APIs](https://www.bouncycastle.org/java.html).
 
-Each jruby-openssl gem release includes the Bouncy Castle library (BC Provider and
-PKIX/CMS/EAC/PKCS/OCSP/TSP/OPENSSL jars), usually the latest available version.
+All jruby-openssl gem releases include the Bouncy Castle library (BC Provider, BC JSSE 
+and PKIX/CMS/EAC/PKCS/OCSP/TSP/OPENSSL jars), usually the latest available version.
 
 Please report bugs and incompatibilities (preferably with test-cases) to either
 the JRuby [mailing list][1] or the [bug tracker][2].
 
 ## Compatibility
 
+Check latest jruby-openssl gem spec's `jar` *requirements* for compatibility.
+
+```ruby
+require 'openssl'
+JOpenSSL::VERSION
+```
+
+For older versions of the gem compatibility wasn't reported:
+
 | JRuby-OpenSSL | JRuby compat | JVM compat | supported BC |
 |---------------|:------------:|-----------:|-------------:|
-| 0.9.6         | 1.6.8-9.0.2  |   Java 6-8 |    1.47-1.50 |
-| 0.9.12        | 1.6.8-9.0.5  |   Java 6-8 |    1.47-1.52 |
-| 0.9.13        | 1.6.8-9.1.2  |   Java 6-8 |    1.49-1.52 |
-| 0.9.14        | 1.6.8-9.1.5  |   Java 6-8 |    1.49-1.54 |
-| 0.9.17        | 1.6.8-9.1.5  |   Java 6-8 |    1.50-1.54 |
-| ~>0.9.18      | 1.6.8-9.1.x  |   Java 6-8 |    1.50-1.55 |
-| 0.10.0        | 1.7.20-9.2.x |  Java 7-10 |    1.55-1.59 |
-| 0.10.3        | 1.7.20-9.2.x |  Java 7-11 |    1.56-1.62 |
-| ~>0.10.5      | 1.7.20-9.3.x |  Java 7-11 |    1.60-1.68 |
-| ~>0.11.x      | 9.0.x-9.3.x  |  Java 7-11 |    1.62-1.68 |
 | ~>0.12.x      | 9.1.x-9.3.x  |  Java 8-15 |    1.65-1.68 |
 | ~>0.13.x      | 9.1.x-9.4.x  |  Java 8-17 |    1.68-1.69 |
 | ~>0.14.x      | 9.1.x-9.4.x  |  Java 8-21 |    1.71-1.74 |
 | ~>0.15.x      | 9.2.x-10.0.x |  Java 8-25 |    1.78-1.83 |
-| ~>0.16.x      | 9.3.x-10.0.x |  Java 8-25 |    1.83-1.84 |
+| ~>0.16.x      | 9.3.x-10.0.x |  Java 8-25 |    1.83-1.85 |
 
 ## Security
 
@@ -39,30 +38,103 @@ JRuby-OpenSSL is an essential part of [JRuby](https://www.jruby.org/), please re
 Please note that most OpenSSL vulnerabilities do not affect JRuby since it's not using
 any of OpenSSL's C code, only Ruby parts (*.rb) are the same as in MRI's OpenSSL library.
 
-## Testing
+## Supported configuration
+
+Most runtime knobs are Java system properties. 
+Under JRuby you pass them as `-J-D...` flags, e.g. `JRUBY_OPTS='-J-Djruby.openssl.debug=true'`.
+
+### Runtime / JVM properties
+
+| Property | Default | Effect                                                                                                                                                               |
+|----------|---------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `jruby.openssl.load.jars` | `true` | If set to `false`, `lib/jopenssl/load.rb` skips auto-loading the bundled BouncyCastle jars - handy when the BC jars are on the JVM classpath.                        |
+| `jruby.openssl.debug` | `false` | Turns on internal debug logging and stack traces from the Java extension, has the same effect as setting `OpenSSL.debug = true` at runtime.                          |
+| `jruby.openssl.warn` | follows JRuby's warning mode (`runtime.warningsEnabled()`) | Enables or disables warnings from the extension, set `false` to stay quiet regardless of `-w`.                                               |
+| `jruby.openssl.log.logger` | default stdout/stderr logger | Selects the internal logger implementation, set to `JUL` to route logs through `java.util.logging`.                                                                  |
+| `jruby.openssl.log.silence` | `true` | Silences a few noisy BC / BC-JSSE loggers by default, set `false` to leave their levels untouched.                                                                   |
+| `jruby.openssl.provider.ssl` | `BCJSSE` | Selects the SSL provider. `BCJSSE`, `BC`, or `true` all mean BC-JSSE, an empty string or `false` falls back to the platform JSSE provider.                           |
+| `jruby.openssl.ssl.error_wait_nonblock.backtrace` | falls back to `jruby.errno.backtrace` (which defaults to `false`) | Whether `SSLErrorWaitReadable` / `SSLErrorWaitWritable` carry backtraces.                                |
+| `jruby.openssl.x509.lookup.cache` | disabled | Caching for X.509 lookup results. `true` turns on a soft cache; an integer such as `8` gives a bounded strong/soft cache of that size, unset or `false` disables it. |
+
+### Environment variables
+
+| Variable | Default | Effect                                                                                                                                                                       |
+|----------|---------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `SSL_CERT_FILE` | platform / packaged default CA file | Overrides the default certificate bundle used for X.509 default-path loading, `.crt`, `.cer`, or `.pem` are read as a PEM bundle, otherwise treated as a Java CA store path. |
+| `SSL_CERT_DIR` | platform / packaged default CA directory | Overrides the default certificate directory list for X.509 default-path loading, separate multiple directories with the platform path separator.                         |
+| `OPENSSL_ALLOW_PROXY_CERTS` | unset / disabled | When set to anything other than `false`, proxy certificates are allowed during certificate chain validation.                                                                 |
+
+### Other supported customizations
+
+- `OpenSSL.debug = true` gives you the same internal debug logging as `-Djruby.openssl.debug=true`
+- when `jruby.openssl.warn` is unset, JRuby's own warning mode (`ruby -w`) decides whether warnings show
+- `OpenSSL::Config` can look up variables from the process environment through the `ENV` section, matching the upstream Ruby OpenSSL config parser
+
+
+## Differences from OpenSSL
+
+JRuby-OpenSSL aims to be a source-compatible drop-in for MRI's `openssl` - same Ruby API and
+same `require 'openssl'`. But there are limitations on the JVM (with JCE and JSSE) as well as 
+Bouncy Castle libraries, so some entry points are unavailable, behave differently, or are no-ops.
+
+**Engine**
+- `OpenSSL::Engine` is not implemented - there is no hardware/engine layer, `OpenSSL::Engine.*`
+  raises `NameError` (uninitialized constant)
+
+**SSL / TLS** (backed by JSSE)
+- `SSLSocket#state` and NPN (`#npn_protocol`) are unimplemented and return `nil` - use ALPN instead
+- Forced session resumption (`SSLSocket#session=`) is best-effort and only fully works with the
+  BouncyCastle JSSE provider; `session_reused?` may return `nil` ("can't decide")
+- `SSL::Session#id=` / `#time=` are no-ops; `SSL::Session.new` on a non-socket raises `NotImplementedError`
+- Hostname / `subjectAltName` matching runs over Java's certificate parsing and can differ from
+  MRI's `GeneralName` handling in edge cases
+
+**Cipher** (JCE / Bouncy Castle)
+- The available cipher set is provider-dependent (what JCE/BC offer on your JVM), not the fixed
+  libcrypto list (some OpenSSL ciphers may be missing or vary by JDK)
+- CFB1 mode (`*-cfb1`) is excluded (doesn't match OpenSSL under BC)
+- AEAD is limited to what JCE exposes; `iv_len=` on a non-AEAD cipher raises
 
-    rake jar:all # creates pom.xml and generates jopenssl.jar under lib
-    mvn test
+**PKey** (EC / DH / EdDSA)
+- EC is limited to prime curves (`:GFp`); binary-field curves (`:GF2m`) fail
+- `EC::Point#mul` with array arguments, `:hybrid` point compression, and encrypted EC private-key
+  export are not implemented
+- `DH#set_pqg` accepts but silently ignores the `q` parameter
+- EdDSA (`Ed25519` / `Ed448`) rejects digest arguments
 
-This will run (JUnit as well as Ruby) tests against the default JRuby version.
-To pick a different JRuby version:
+**X509**
+- multi-valued RDNs (the `+` separator in a DN string) are not supported and raise `X509::NameError`.
+- few `authorityKeyIdentifier` extension configurations are unsupported
 
-    mvn test -Djruby.versions=9.4.14.0
+**Random**
+- randomness comes from the JVM's `SecureRandom`; the EGD and seed-file APIs (`Random.egd`,
+  `egd_bytes`, `load_random_file`, `write_random_file`) are no-ops
 
-For running integration tests the gem will be installed first and the same
-tests run for each supported Bouncy Castle version (see [listing][3]):
+**Other**
+- `OpenSSL.fips_mode = true` raises `NotImplementedError` unless the separate [FIPS variant](#fips)
+  gem is installed
+- some rarely-used entry points are no-ops (`OpenSSL.check_func`, `deprecated_warning_flag`) and
+  `OPENSSL_NO_SOCK` is `nil` rather than a boolean
+- a few PKCS7 content types can't be reconstructed purely from ASN.1 (may surface when parsing
+  some S/MIME structures)
 
-    mvn verify -P test-9.4.14.0,test-9.2.21.0
+Hitting something not listed here that MRI's OpenSSL supports? 
+Please report it on the [bug tracker][2], ideally with a test case.
 
-Or pick a specific Bouncy Castle version:
+## FIPS
 
-    mvn verify -P test-9.4.14.0 -Dbc.versions=1.78
+A FIPS 140-3 build of jruby-openssl is available as a separate gem.
+It's the very same library but uses the NIST-validated BC FIPS module (BC-FJA) instead of 
+regular Bouncy Castle, for deployments that need a validated cryptographic module.
+Ships separately under GPL 3.0, with commercial licensing available - see the 
+[FIPS variant][6] wiki page for details.
 
-NOTE: you can pick any JRuby version which is on [Maven Central][4] or on [ci.jruby][5]
+NOTE: unlike C OpenSSL, `OpenSSL.fips_mode` cannot be changed at runtime, the flag reports 
+which gem variant is activated (`true` under the FIPS gem, `false` otherwise).
 
 ## License
 
-(c) 2009-2026 JRuby distributed under EPL 1.0/GPL 2.0/LGPL 2.1
+(c) 2009-2026 JRuby distributed under EPL 1.0 / GPL 2.0 / LGPL 2.1
 
 [0]: https://github.com/jruby/jruby-openssl/security
 [1]: https://github.com/jruby/jruby/wiki/MailingLists
@@ -70,3 +142,4 @@ NOTE: you can pick any JRuby version which is on [Maven Central][4] or on [ci.jr
 [3]: https://github.com/jruby/jruby-openssl/tree/master/integration
 [4]: https://repo1.maven.org/maven2/org/jruby/
 [5]: https://www.jruby.org/nightly
+[6]: https://github.com/jruby/jruby-openssl/wiki/FIPS

data/Rakefile

@@ -1,57 +1,108 @@
-#-*- mode: ruby -*-
+require 'rake/testtask'
+
+mvnw = File.expand_path('./mvnw', File.dirname(__FILE__))
+
+# reproducible build: SOURCE_DATE_EPOCH shared by jopenssl.jar and gem
+# read from env by RubyGems; pass via -D so dev builds don't churn pom.xml
+def source_date_epoch!
+  ENV['SOURCE_DATE_EPOCH'] ||= `git log -1 --pretty=%ct`.strip
+end
+
+def _build_output_timestamp
+  "-Dproject.build.outputTimestamp=#{ENV['SOURCE_DATE_EPOCH']}" if ENV['SOURCE_DATE_EPOCH']
+end
 
-#Rake::Task[:jar].clear rescue nil
 desc "Package jopenssl.jar with the compiled classes"
 task :jar do
-  sh( './mvnw prepare-package -Dmaven.test.skip=true' )
+  sh("#{mvnw} prepare-package -Dmaven.test.skip=true")
 end
-namespace :jar do
-  desc "Package jopenssl.jar file (and dependendent jars)"
-  task :all do
-    sh( './mvnw package -Dmaven.test.skip=true' )
-  end
-end
-task :test_prepare do
-  sh( './mvnw prepare-package -Dmaven.test.skip=true' )
-  sh( './mvnw test-compile' ) # separate step due -Dmaven.test.skip=true
+
+task :test_prepare => :jar do
+  sh("#{mvnw} test-compile") # separate due -Dmaven.test.skip=true
 end
 
 task :clean do
-  sh( './mvnw clean' )
+  sh("#{mvnw} clean")
 end
 
 task :build do
-  sh( './mvnw clean package -Dmaven.test.skip=true' )
+  source_date_epoch!
+  sh("#{mvnw} -Prelease -DupdateReleaseInfo=true #{_build_output_timestamp} clean package")
+end
+
+desc "Sanity-check the tree/version, then build a reproducible release gem"
+task :release => :release_check do
+  source_date_epoch! # pin to the release commit so the gem + jar use the same
+  puts "SOURCE_DATE_EPOCH=#{ENV['SOURCE_DATE_EPOCH']} (#{Time.at(ENV['SOURCE_DATE_EPOCH'].to_i).utc})"
+  Rake::Task[:build].invoke
+  gem = Dir['target/*.gem', 'pkg/*.gem'].max_by { |f| File.mtime(f) }
+  abort "release aborted - no .gem produced" unless gem
+  puts "built #{gem}"
+  # gem push #{gem}  (or: #{File.basename(mvnw)} deploy -Pjar-release for the jar artifact)"
+end
+
+task :release_check do
+  dirty = `git status --porcelain`.strip
+  abort "release aborted - working tree is not clean:\n#{dirty}" unless dirty.empty?
+
+  load File.expand_path('lib/jopenssl/version.rb', File.dirname(__FILE__))
+  version = JOpenSSL::VERSION
+
+  if Gem::Version.new(version).prerelease? && ENV['PRERELEASE'] != 'true'
+    abort "release aborted - #{version} is a prerelease"
+  end
+
+  branch = `git rev-parse --abbrev-ref HEAD`.strip
+  warn "WARNING: releasing from '#{branch}' (not 'master')" unless branch == 'master'
+
+  tag = `git tag --points-at HEAD`.split("\n").find { |t| t =~ /#{Regexp.escape(version)}/ }
+  warn "WARNING: no git tag matching #{version} points at HEAD" unless tag
+
+  puts "release checks passed for #{version}"
+end
+
+desc "Build the self-contained jar-release artifacts (-Pjar-release)"
+task :jar_release => :release_check do
+  source_date_epoch!
+  puts "SOURCE_DATE_EPOCH=#{ENV['SOURCE_DATE_EPOCH']} (#{Time.at(ENV['SOURCE_DATE_EPOCH'].to_i).utc})"
+  sh("#{mvnw} package -Pjar-release -Dmaven.test.skip=true #{_build_output_timestamp}")
+  # deploy (gpg-sign + push): #{File.basename(mvnw)} deploy -Prelease,jar-release -D...
 end
 
 task :default => :build
 
-file('lib/jopenssl.jar') { Rake::Task['jar'].invoke }
+file('lib/jopenssl.jar') { Rake::Task[:jar].invoke }
+
+file('pkg/test-classes/org/jruby/ext/openssl/SecurityHelperTest.class') do
+  Rake::Task[:test_prepare].invoke
+end
 
-require 'rake/testtask'
 Rake::TestTask.new do |task|
-  task.libs << File.expand_path('src/test/ruby', File.dirname(__FILE__))
-  test_files = FileList['src/test/ruby/**/test*.rb'].to_a
-  task.test_files = test_files.map { |path| path.sub('src/test/ruby/', '') }
+  task.libs << File.expand_path('test', File.dirname(__FILE__))
+  test_files = FileList['test/**/test*.rb'].to_a
+  task.test_files = test_files.map { |path| path.sub('test/', '') }
   task.verbose = false # using -v directly instead due issues with rake
   task.loader = :direct
-  task.ruby_opts = [ '-v', '-C', 'src/test/ruby', '-rbundler/setup' ]
+  task.ruby_opts = [ '-v', '-rbundler/setup' ]
 end
-task :test => 'lib/jopenssl.jar'
+task :test => ['lib/jopenssl.jar', 'pkg/test-classes/org/jruby/ext/openssl/SecurityHelperTest.class']
+
+require_relative 'tasks/vendor_tests'
+define_vendor_test_tasks # root + jopenssl_lib default to this tree
 
 namespace :integration do
-  it_path = File.expand_path('../src/test/integration', __FILE__)
+  it_path = File.expand_path('integration', File.dirname(__FILE__))
   task :install do
     ruby "-C #{it_path} -S bundle install"
   end
-  # desc "Run IT tests"
+  desc "Run tests via invoker (bc-compat)"
   task :test => 'lib/jopenssl.jar' do
     unless File.exist?(File.join(it_path, 'Gemfile.lock'))
-      raise "bundle not installed, run `rake integration:install'"
+      fail "bundle not installed, run `rake integration:install'"
     end
     loader = "ARGV.each { |file| require(file) }"
     lib = [ File.expand_path('../lib', __FILE__), it_path ]
-    test_files = FileList['src/test/integration/*_test.rb'].map { |path| path.sub('src/test/integration/', '') }
-    ruby "-I#{lib.join(':')} -C src/test/integration -e \"#{loader}\" #{test_files.map { |f| "\"#{f}\"" }.join(' ')}"
+    test_files = FileList['integration/*_test.rb'].map { |path| path.sub('integration/', '') }
+    ruby "-I#{lib.join(':')} -C integration -e \"#{loader}\" #{test_files.map { |f| "\"#{f}\"" }.join(' ')}"
   end
 end

data/lib/jopenssl/load.rb

@@ -1,71 +1,27 @@
-require 'jopenssl/version'
+require_relative 'version'
 
-# NOTE: assuming user does pull in BC .jars from somewhere else on the CP
-unless ENV_JAVA['jruby.openssl.load.jars'].eql?('false')
+# NOTE: assuming user does pull in BC .jars from somewhere else on the class-path
+if ENV_JAVA['jruby.openssl.load.jars'] != 'false' &&
+   java.security.Security.getProvider('BC').nil?
   version = JOpenSSL::BOUNCY_CASTLE_VERSION
-  begin
-    require 'jar-dependencies'
-    # if we have jar-dependencies we let it track the jars
+  bc_jars = begin
+    require 'jar_dependencies' unless respond_to?(:require_jar, true)
     require_jar 'org.bouncycastle', 'bcprov-jdk18on', version
     require_jar 'org.bouncycastle', 'bcpkix-jdk18on', version
     require_jar 'org.bouncycastle', 'bcutil-jdk18on', version
     require_jar 'org.bouncycastle', 'bctls-jdk18on',  version
-    bc_jars = true
+    true
   rescue LoadError, RuntimeError
-    bc_jars = false
+    false
   end
   unless bc_jars
-    load "org/bouncycastle/bcprov-jdk18on/#{version}/bcprov-jdk18on-#{version}.jar"
-    load "org/bouncycastle/bcpkix-jdk18on/#{version}/bcpkix-jdk18on-#{version}.jar"
-    load "org/bouncycastle/bcutil-jdk18on/#{version}/bcutil-jdk18on-#{version}.jar"
-    load "org/bouncycastle/bctls-jdk18on/#{version}/bctls-jdk18on-#{version}.jar"
+    vendor = File.expand_path('../../vendor', __dir__)
+    load "#{vendor}/org/bouncycastle/bcprov-jdk18on/#{version}/bcprov-jdk18on-#{version}.jar"
+    load "#{vendor}/org/bouncycastle/bcpkix-jdk18on/#{version}/bcpkix-jdk18on-#{version}.jar"
+    load "#{vendor}/org/bouncycastle/bcutil-jdk18on/#{version}/bcutil-jdk18on-#{version}.jar"
+    load "#{vendor}/org/bouncycastle/bctls-jdk18on/#{version}/bctls-jdk18on-#{version}.jar"
   end
 end
 
 require 'jopenssl.jar'
 JRuby::Util.load_ext('org.jruby.ext.openssl.OpenSSL')
-
-# NOTE: content bellow should live in *lib/openssl.rb* but due RubyGems/Bundler
-# `autoload :OpenSSL` this will cause issues if an older version (0.11) is the
-# default gem under JRuby 9.2 (which on auto-load does not trigger a dynamic
-# require - this is only fixed in JRuby 9.3)
-
-module OpenSSL
-  autoload :Config, 'openssl/config' unless const_defined?(:Config, false)
-  autoload :ConfigError, 'openssl/config' unless const_defined?(:ConfigError, false)
-  autoload :PKCS12, 'openssl/pkcs12'
-end
-
-=begin
-= Info
-  'OpenSSL for Ruby 2' project
-  Copyright (C) 2002  Michal Rokos <m.rokos@sh.cvut.cz>
-  All rights reserved.
-
-= Licence
-  This program is licensed under the same licence as Ruby.
-  (See the file 'LICENCE'.)
-=end
-
-require 'openssl/bn'
-require 'openssl/pkey'
-require 'openssl/cipher'
-require 'openssl/digest'
-require 'openssl/hmac'
-require 'openssl/x509'
-require 'openssl/ssl'
-require 'openssl/pkcs5'
-
-module OpenSSL
-  # call-seq:
-  #   OpenSSL.secure_compare(string, string) -> boolean
-  #
-  # Constant time memory comparison. Inputs are hashed using SHA-256 to mask
-  # the length of the secret. Returns +true+ if the strings are identical,
-  # +false+ otherwise.
-  def self.secure_compare(a, b)
-    hashed_a = OpenSSL::Digest.digest('SHA256', a)
-    hashed_b = OpenSSL::Digest.digest('SHA256', b)
-    OpenSSL.fixed_length_secure_compare(hashed_a, hashed_b) && a == b
-  end
-end

data/lib/jopenssl/version.rb

@@ -1,10 +1,5 @@
+# frozen_string_literal: true
 module JOpenSSL
-  VERSION = '0.16.1'
-  BOUNCY_CASTLE_VERSION = '1.84'
-end
-
-Object.class_eval do
-  Jopenssl = JOpenSSL
-  private_constant :Jopenssl if respond_to?(:private_constant)
-  deprecate_constant :Jopenssl if respond_to?(:deprecate_constant)
+  VERSION = '0.19.0'
+  BOUNCY_CASTLE_VERSION = '1.85'
 end

data/lib/openssl/config.rb

@@ -80,7 +80,9 @@ module OpenSSL
         section = 'default'
         data = {section => {}}
         io_stack = [io]
-        while definition = get_definition(io_stack)
+        # absolute paths of the currently-open .include chain, to break include cycles
+        included = [nil]
+        while definition = get_definition(io_stack, included)
           definition = clear_comments(definition)
           next if definition.empty?
           case definition
@@ -100,11 +102,16 @@ module OpenSSL
             end
 
             files.each do |filename|
+              real = File.expand_path(filename)
+              if included.include?(real)
+                raise ConfigError, "include cycle detected: '%s'" % filename
+              end
               begin
                 io_stack << StringIO.new(File.read(filename))
               rescue
                 raise ConfigError, "could not include file '%s'" % filename
               end
+              included << real
             end
           when /\A([^:\s]*)(?:::([^:\s]*))?\s*=(.*)\z/
             if $2
@@ -229,10 +236,10 @@ module OpenSSL
         scanned.join
       end
 
-      def get_definition(io_stack)
-        if line = get_line(io_stack)
+      def get_definition(io_stack, included = nil)
+        if line = get_line(io_stack, included)
           while /[^\\]\\\z/ =~ line
-            if extra = get_line(io_stack)
+            if extra = get_line(io_stack, included)
               line += extra
             else
               break
@@ -242,12 +249,13 @@ module OpenSSL
         end
       end
 
-      def get_line(io_stack)
+      def get_line(io_stack, included = nil)
         while io = io_stack.last
           if line = io.gets
             return line.gsub(/[\r\n]*/, '')
           end
           io_stack.pop
+          included.pop if included
         end
       end
     end

data/lib/openssl/ssl.rb

@@ -12,6 +12,7 @@
 
 require "openssl/buffering"
 require "io/nonblock"
+require "ipaddr"
 require "socket"
 
 module OpenSSL
@@ -84,7 +85,6 @@ YoaOffgTf5qxiwkjnlVZQc3whgnEt9FpVMvQ9eknyeGB5KHfayAc3+hUAvI3/Cr3
 
       DEFAULT_CERT_STORE = OpenSSL::X509::Store.new # :nodoc:
       DEFAULT_CERT_STORE.set_default_paths
-      DEFAULT_CERT_STORE.flags = OpenSSL::X509::V_FLAG_CRL_CHECK_ALL
 
       # A callback invoked when DH parameters are required for ephemeral DH key
       # exchange.
@@ -137,7 +137,7 @@ YoaOffgTf5qxiwkjnlVZQc3whgnEt9FpVMvQ9eknyeGB5KHfayAc3+hUAvI3/Cr3
       # used.
       def set_params(params={})
         params = DEFAULT_PARAMS.merge(params)
-        self.options = params.delete(:options) # set before min_version/max_version
+        self.options |= params.delete(:options) # set before min_version/max_version
         params.each{ |name, value| self.__send__("#{name}=", value) }
         if self.verify_mode != OpenSSL::SSL::VERIFY_NONE
           unless self.ca_file or self.ca_path or self.cert_store
@@ -319,15 +319,10 @@ YoaOffgTf5qxiwkjnlVZQc3whgnEt9FpVMvQ9eknyeGB5KHfayAc3+hUAvI3/Cr3
           #when 7 # iPAddress in GeneralName (RFC5280)
           elsif /\AIP(?: Address)?:(.*)/ =~ general_name
             should_verify_common_name = false
-            return true if $1 == hostname
-            # NOTE: bellow logic makes little sense JRuby reads exts differently
-            # follows GENERAL_NAME_print() in x509v3/v3_alt.c
-            # if san.value.size == 4 || san.value.size == 16
-            #    begin
-            #      return true if $1 == IPAddr.new(hostname).to_s
-            #    rescue IPAddr::InvalidAddressError
-            #    end
-            # end
+            begin
+              return true if IPAddr.new($1) == IPAddr.new(hostname)
+            rescue IPAddr::InvalidAddressError
+            end
           end
         }
       }
@@ -431,6 +426,13 @@ YoaOffgTf5qxiwkjnlVZQc3whgnEt9FpVMvQ9eknyeGB5KHfayAc3+hUAvI3/Cr3
       # This method MUST be called after calling #connect to ensure that the
       # hostname of a remote peer has been verified.
       def post_connection_check(hostname)
+        # if connect already verified this hostname (via verify_hostname), skip;
+        # avoids double-verification in libraries that call post_connection_check
+        if defined?(@verified_hostname) && @verified_hostname == hostname
+          @verified_hostname = nil
+          return true
+        end
+
         if peer_cert.nil?
           msg = "Peer verification enabled, but no certificate received."
           if using_anon_cipher?
@@ -446,6 +448,14 @@ YoaOffgTf5qxiwkjnlVZQc3whgnEt9FpVMvQ9eknyeGB5KHfayAc3+hUAvI3/Cr3
         return true
       end
 
+      # @private JRuby due having to call this outside of post_connection_check
+      def verify_certificate_identity_internal(hostname)
+        peer_cert = self.peer_cert
+        return nil if peer_cert.nil?
+        OpenSSL::SSL.verify_certificate_identity(peer_cert, hostname)
+      end
+      private :verify_certificate_identity_internal
+
       # call-seq:
       #   ssl.session -> aSession
       #

data/lib/openssl.rb

@@ -1,3 +1,46 @@
 # frozen_string_literal: true
 
 require 'jopenssl/load'
+
+module OpenSSL
+  autoload :Config, 'openssl/config' unless const_defined?(:Config, false)
+  autoload :ConfigError, 'openssl/config' unless const_defined?(:ConfigError, false)
+end
+
+=begin
+= Info
+  'OpenSSL for Ruby 2' project
+  Copyright (C) 2002  Michal Rokos <m.rokos@sh.cvut.cz>
+  All rights reserved.
+
+= Licence
+  This program is licensed under the same licence as Ruby.
+  (See the file 'COPYING'.)
+=end
+
+require 'openssl/bn'
+require 'openssl/cipher'
+require 'openssl/digest'
+require 'openssl/hmac'
+require 'openssl/pkcs5'
+require 'openssl/pkey'
+require 'openssl/ssl'
+require 'openssl/x509'
+
+module OpenSSL
+  # :call-seq:
+  #    OpenSSL.secure_compare(string, string) -> true or false
+  #
+  # Constant time memory comparison. Inputs are hashed using SHA-256 to mask
+  # the length of the secret. Returns +true+ if the strings are identical,
+  # +false+ otherwise.
+  #
+  # This method is expensive due to the SHA-256 hashing. In most cases, where
+  # the input lengths are known to be equal or are not sensitive,
+  # OpenSSL.fixed_length_secure_compare should be used instead.
+  def self.secure_compare(a, b)
+    hashed_a = OpenSSL::Digest.digest('SHA256', a)
+    hashed_b = OpenSSL::Digest.digest('SHA256', b)
+    OpenSSL.fixed_length_secure_compare(hashed_a, hashed_b) && a == b
+  end
+end