jruby-openssl 0.16.2-java → 0.19.0-java

data/Rakefile

@@ -1,57 +1,108 @@
-#-*- mode: ruby -*-
+require 'rake/testtask'
+
+mvnw = File.expand_path('./mvnw', File.dirname(__FILE__))
+
+# reproducible build: SOURCE_DATE_EPOCH shared by jopenssl.jar and gem
+# read from env by RubyGems; pass via -D so dev builds don't churn pom.xml
+def source_date_epoch!
+  ENV['SOURCE_DATE_EPOCH'] ||= `git log -1 --pretty=%ct`.strip
+end
+
+def _build_output_timestamp
+  "-Dproject.build.outputTimestamp=#{ENV['SOURCE_DATE_EPOCH']}" if ENV['SOURCE_DATE_EPOCH']
+end
 
-#Rake::Task[:jar].clear rescue nil
 desc "Package jopenssl.jar with the compiled classes"
 task :jar do
-  sh( './mvnw prepare-package -Dmaven.test.skip=true' )
+  sh("#{mvnw} prepare-package -Dmaven.test.skip=true")
 end
-namespace :jar do
-  desc "Package jopenssl.jar file (and dependendent jars)"
-  task :all do
-    sh( './mvnw package -Dmaven.test.skip=true' )
-  end
-end
-task :test_prepare do
-  sh( './mvnw prepare-package -Dmaven.test.skip=true' )
-  sh( './mvnw test-compile' ) # separate step due -Dmaven.test.skip=true
+
+task :test_prepare => :jar do
+  sh("#{mvnw} test-compile") # separate due -Dmaven.test.skip=true
 end
 
 task :clean do
-  sh( './mvnw clean' )
+  sh("#{mvnw} clean")
 end
 
 task :build do
-  sh( './mvnw clean package -Dmaven.test.skip=true' )
+  source_date_epoch!
+  sh("#{mvnw} -Prelease -DupdateReleaseInfo=true #{_build_output_timestamp} clean package")
+end
+
+desc "Sanity-check the tree/version, then build a reproducible release gem"
+task :release => :release_check do
+  source_date_epoch! # pin to the release commit so the gem + jar use the same
+  puts "SOURCE_DATE_EPOCH=#{ENV['SOURCE_DATE_EPOCH']} (#{Time.at(ENV['SOURCE_DATE_EPOCH'].to_i).utc})"
+  Rake::Task[:build].invoke
+  gem = Dir['target/*.gem', 'pkg/*.gem'].max_by { |f| File.mtime(f) }
+  abort "release aborted - no .gem produced" unless gem
+  puts "built #{gem}"
+  # gem push #{gem}  (or: #{File.basename(mvnw)} deploy -Pjar-release for the jar artifact)"
+end
+
+task :release_check do
+  dirty = `git status --porcelain`.strip
+  abort "release aborted - working tree is not clean:\n#{dirty}" unless dirty.empty?
+
+  load File.expand_path('lib/jopenssl/version.rb', File.dirname(__FILE__))
+  version = JOpenSSL::VERSION
+
+  if Gem::Version.new(version).prerelease? && ENV['PRERELEASE'] != 'true'
+    abort "release aborted - #{version} is a prerelease"
+  end
+
+  branch = `git rev-parse --abbrev-ref HEAD`.strip
+  warn "WARNING: releasing from '#{branch}' (not 'master')" unless branch == 'master'
+
+  tag = `git tag --points-at HEAD`.split("\n").find { |t| t =~ /#{Regexp.escape(version)}/ }
+  warn "WARNING: no git tag matching #{version} points at HEAD" unless tag
+
+  puts "release checks passed for #{version}"
+end
+
+desc "Build the self-contained jar-release artifacts (-Pjar-release)"
+task :jar_release => :release_check do
+  source_date_epoch!
+  puts "SOURCE_DATE_EPOCH=#{ENV['SOURCE_DATE_EPOCH']} (#{Time.at(ENV['SOURCE_DATE_EPOCH'].to_i).utc})"
+  sh("#{mvnw} package -Pjar-release -Dmaven.test.skip=true #{_build_output_timestamp}")
+  # deploy (gpg-sign + push): #{File.basename(mvnw)} deploy -Prelease,jar-release -D...
 end
 
 task :default => :build
 
-file('lib/jopenssl.jar') { Rake::Task['jar'].invoke }
+file('lib/jopenssl.jar') { Rake::Task[:jar].invoke }
+
+file('pkg/test-classes/org/jruby/ext/openssl/SecurityHelperTest.class') do
+  Rake::Task[:test_prepare].invoke
+end
 
-require 'rake/testtask'
 Rake::TestTask.new do |task|
-  task.libs << File.expand_path('src/test/ruby', File.dirname(__FILE__))
-  test_files = FileList['src/test/ruby/**/test*.rb'].to_a
-  task.test_files = test_files.map { |path| path.sub('src/test/ruby/', '') }
+  task.libs << File.expand_path('test', File.dirname(__FILE__))
+  test_files = FileList['test/**/test*.rb'].to_a
+  task.test_files = test_files.map { |path| path.sub('test/', '') }
   task.verbose = false # using -v directly instead due issues with rake
   task.loader = :direct
-  task.ruby_opts = [ '-v', '-C', 'src/test/ruby', '-rbundler/setup' ]
+  task.ruby_opts = [ '-v', '-rbundler/setup' ]
 end
-task :test => 'lib/jopenssl.jar'
+task :test => ['lib/jopenssl.jar', 'pkg/test-classes/org/jruby/ext/openssl/SecurityHelperTest.class']
+
+require_relative 'tasks/vendor_tests'
+define_vendor_test_tasks # root + jopenssl_lib default to this tree
 
 namespace :integration do
-  it_path = File.expand_path('../src/test/integration', __FILE__)
+  it_path = File.expand_path('integration', File.dirname(__FILE__))
   task :install do
     ruby "-C #{it_path} -S bundle install"
   end
-  # desc "Run IT tests"
+  desc "Run tests via invoker (bc-compat)"
   task :test => 'lib/jopenssl.jar' do
     unless File.exist?(File.join(it_path, 'Gemfile.lock'))
-      raise "bundle not installed, run `rake integration:install'"
+      fail "bundle not installed, run `rake integration:install'"
     end
     loader = "ARGV.each { |file| require(file) }"
     lib = [ File.expand_path('../lib', __FILE__), it_path ]
-    test_files = FileList['src/test/integration/*_test.rb'].map { |path| path.sub('src/test/integration/', '') }
-    ruby "-I#{lib.join(':')} -C src/test/integration -e \"#{loader}\" #{test_files.map { |f| "\"#{f}\"" }.join(' ')}"
+    test_files = FileList['integration/*_test.rb'].map { |path| path.sub('integration/', '') }
+    ruby "-I#{lib.join(':')} -C integration -e \"#{loader}\" #{test_files.map { |f| "\"#{f}\"" }.join(' ')}"
   end
 end

data/lib/jopenssl/load.rb

@@ -1,71 +1,27 @@
-require 'jopenssl/version'
+require_relative 'version'
 
-# NOTE: assuming user does pull in BC .jars from somewhere else on the CP
-unless ENV_JAVA['jruby.openssl.load.jars'].eql?('false')
+# NOTE: assuming user does pull in BC .jars from somewhere else on the class-path
+if ENV_JAVA['jruby.openssl.load.jars'] != 'false' &&
+   java.security.Security.getProvider('BC').nil?
   version = JOpenSSL::BOUNCY_CASTLE_VERSION
-  begin
-    require 'jar-dependencies'
-    # if we have jar-dependencies we let it track the jars
+  bc_jars = begin
+    require 'jar_dependencies' unless respond_to?(:require_jar, true)
     require_jar 'org.bouncycastle', 'bcprov-jdk18on', version
     require_jar 'org.bouncycastle', 'bcpkix-jdk18on', version
     require_jar 'org.bouncycastle', 'bcutil-jdk18on', version
     require_jar 'org.bouncycastle', 'bctls-jdk18on',  version
-    bc_jars = true
+    true
   rescue LoadError, RuntimeError
-    bc_jars = false
+    false
   end
   unless bc_jars
-    load "org/bouncycastle/bcprov-jdk18on/#{version}/bcprov-jdk18on-#{version}.jar"
-    load "org/bouncycastle/bcpkix-jdk18on/#{version}/bcpkix-jdk18on-#{version}.jar"
-    load "org/bouncycastle/bcutil-jdk18on/#{version}/bcutil-jdk18on-#{version}.jar"
-    load "org/bouncycastle/bctls-jdk18on/#{version}/bctls-jdk18on-#{version}.jar"
+    vendor = File.expand_path('../../vendor', __dir__)
+    load "#{vendor}/org/bouncycastle/bcprov-jdk18on/#{version}/bcprov-jdk18on-#{version}.jar"
+    load "#{vendor}/org/bouncycastle/bcpkix-jdk18on/#{version}/bcpkix-jdk18on-#{version}.jar"
+    load "#{vendor}/org/bouncycastle/bcutil-jdk18on/#{version}/bcutil-jdk18on-#{version}.jar"
+    load "#{vendor}/org/bouncycastle/bctls-jdk18on/#{version}/bctls-jdk18on-#{version}.jar"
   end
 end
 
 require 'jopenssl.jar'
 JRuby::Util.load_ext('org.jruby.ext.openssl.OpenSSL')
-
-# NOTE: content bellow should live in *lib/openssl.rb* but due RubyGems/Bundler
-# `autoload :OpenSSL` this will cause issues if an older version (0.11) is the
-# default gem under JRuby 9.2 (which on auto-load does not trigger a dynamic
-# require - this is only fixed in JRuby 9.3)
-
-module OpenSSL
-  autoload :Config, 'openssl/config' unless const_defined?(:Config, false)
-  autoload :ConfigError, 'openssl/config' unless const_defined?(:ConfigError, false)
-  autoload :PKCS12, 'openssl/pkcs12'
-end
-
-=begin
-= Info
-  'OpenSSL for Ruby 2' project
-  Copyright (C) 2002  Michal Rokos <m.rokos@sh.cvut.cz>
-  All rights reserved.
-
-= Licence
-  This program is licensed under the same licence as Ruby.
-  (See the file 'LICENCE'.)
-=end
-
-require 'openssl/bn'
-require 'openssl/pkey'
-require 'openssl/cipher'
-require 'openssl/digest'
-require 'openssl/hmac'
-require 'openssl/x509'
-require 'openssl/ssl'
-require 'openssl/pkcs5'
-
-module OpenSSL
-  # call-seq:
-  #   OpenSSL.secure_compare(string, string) -> boolean
-  #
-  # Constant time memory comparison. Inputs are hashed using SHA-256 to mask
-  # the length of the secret. Returns +true+ if the strings are identical,
-  # +false+ otherwise.
-  def self.secure_compare(a, b)
-    hashed_a = OpenSSL::Digest.digest('SHA256', a)
-    hashed_b = OpenSSL::Digest.digest('SHA256', b)
-    OpenSSL.fixed_length_secure_compare(hashed_a, hashed_b) && a == b
-  end
-end

data/lib/jopenssl/version.rb

@@ -1,10 +1,5 @@
+# frozen_string_literal: true
 module JOpenSSL
-  VERSION = '0.16.2'
+  VERSION = '0.19.0'
   BOUNCY_CASTLE_VERSION = '1.85'
 end
-
-Object.class_eval do
-  Jopenssl = JOpenSSL
-  private_constant :Jopenssl if respond_to?(:private_constant)
-  deprecate_constant :Jopenssl if respond_to?(:deprecate_constant)
-end

data/lib/openssl/config.rb

@@ -80,7 +80,9 @@ module OpenSSL
         section = 'default'
         data = {section => {}}
         io_stack = [io]
-        while definition = get_definition(io_stack)
+        # absolute paths of the currently-open .include chain, to break include cycles
+        included = [nil]
+        while definition = get_definition(io_stack, included)
           definition = clear_comments(definition)
           next if definition.empty?
           case definition
@@ -100,11 +102,16 @@ module OpenSSL
             end
 
             files.each do |filename|
+              real = File.expand_path(filename)
+              if included.include?(real)
+                raise ConfigError, "include cycle detected: '%s'" % filename
+              end
               begin
                 io_stack << StringIO.new(File.read(filename))
               rescue
                 raise ConfigError, "could not include file '%s'" % filename
               end
+              included << real
             end
           when /\A([^:\s]*)(?:::([^:\s]*))?\s*=(.*)\z/
             if $2
@@ -229,10 +236,10 @@ module OpenSSL
         scanned.join
       end
 
-      def get_definition(io_stack)
-        if line = get_line(io_stack)
+      def get_definition(io_stack, included = nil)
+        if line = get_line(io_stack, included)
           while /[^\\]\\\z/ =~ line
-            if extra = get_line(io_stack)
+            if extra = get_line(io_stack, included)
               line += extra
             else
               break
@@ -242,12 +249,13 @@ module OpenSSL
         end
       end
 
-      def get_line(io_stack)
+      def get_line(io_stack, included = nil)
         while io = io_stack.last
           if line = io.gets
             return line.gsub(/[\r\n]*/, '')
           end
           io_stack.pop
+          included.pop if included
         end
       end
     end

data/lib/openssl/ssl.rb

@@ -12,6 +12,7 @@
 
 require "openssl/buffering"
 require "io/nonblock"
+require "ipaddr"
 require "socket"
 
 module OpenSSL
@@ -84,7 +85,6 @@ YoaOffgTf5qxiwkjnlVZQc3whgnEt9FpVMvQ9eknyeGB5KHfayAc3+hUAvI3/Cr3
 
       DEFAULT_CERT_STORE = OpenSSL::X509::Store.new # :nodoc:
       DEFAULT_CERT_STORE.set_default_paths
-      DEFAULT_CERT_STORE.flags = OpenSSL::X509::V_FLAG_CRL_CHECK_ALL
 
       # A callback invoked when DH parameters are required for ephemeral DH key
       # exchange.
@@ -137,7 +137,7 @@ YoaOffgTf5qxiwkjnlVZQc3whgnEt9FpVMvQ9eknyeGB5KHfayAc3+hUAvI3/Cr3
       # used.
       def set_params(params={})
         params = DEFAULT_PARAMS.merge(params)
-        self.options = params.delete(:options) # set before min_version/max_version
+        self.options |= params.delete(:options) # set before min_version/max_version
         params.each{ |name, value| self.__send__("#{name}=", value) }
         if self.verify_mode != OpenSSL::SSL::VERIFY_NONE
           unless self.ca_file or self.ca_path or self.cert_store
@@ -319,15 +319,10 @@ YoaOffgTf5qxiwkjnlVZQc3whgnEt9FpVMvQ9eknyeGB5KHfayAc3+hUAvI3/Cr3
           #when 7 # iPAddress in GeneralName (RFC5280)
           elsif /\AIP(?: Address)?:(.*)/ =~ general_name
             should_verify_common_name = false
-            return true if $1 == hostname
-            # NOTE: bellow logic makes little sense JRuby reads exts differently
-            # follows GENERAL_NAME_print() in x509v3/v3_alt.c
-            # if san.value.size == 4 || san.value.size == 16
-            #    begin
-            #      return true if $1 == IPAddr.new(hostname).to_s
-            #    rescue IPAddr::InvalidAddressError
-            #    end
-            # end
+            begin
+              return true if IPAddr.new($1) == IPAddr.new(hostname)
+            rescue IPAddr::InvalidAddressError
+            end
           end
         }
       }
@@ -431,6 +426,13 @@ YoaOffgTf5qxiwkjnlVZQc3whgnEt9FpVMvQ9eknyeGB5KHfayAc3+hUAvI3/Cr3
       # This method MUST be called after calling #connect to ensure that the
       # hostname of a remote peer has been verified.
       def post_connection_check(hostname)
+        # if connect already verified this hostname (via verify_hostname), skip;
+        # avoids double-verification in libraries that call post_connection_check
+        if defined?(@verified_hostname) && @verified_hostname == hostname
+          @verified_hostname = nil
+          return true
+        end
+
         if peer_cert.nil?
           msg = "Peer verification enabled, but no certificate received."
           if using_anon_cipher?
@@ -446,6 +448,14 @@ YoaOffgTf5qxiwkjnlVZQc3whgnEt9FpVMvQ9eknyeGB5KHfayAc3+hUAvI3/Cr3
         return true
       end
 
+      # @private JRuby due having to call this outside of post_connection_check
+      def verify_certificate_identity_internal(hostname)
+        peer_cert = self.peer_cert
+        return nil if peer_cert.nil?
+        OpenSSL::SSL.verify_certificate_identity(peer_cert, hostname)
+      end
+      private :verify_certificate_identity_internal
+
       # call-seq:
       #   ssl.session -> aSession
       #

data/lib/openssl.rb

@@ -1,3 +1,46 @@
 # frozen_string_literal: true
 
 require 'jopenssl/load'
+
+module OpenSSL
+  autoload :Config, 'openssl/config' unless const_defined?(:Config, false)
+  autoload :ConfigError, 'openssl/config' unless const_defined?(:ConfigError, false)
+end
+
+=begin
+= Info
+  'OpenSSL for Ruby 2' project
+  Copyright (C) 2002  Michal Rokos <m.rokos@sh.cvut.cz>
+  All rights reserved.
+
+= Licence
+  This program is licensed under the same licence as Ruby.
+  (See the file 'COPYING'.)
+=end
+
+require 'openssl/bn'
+require 'openssl/cipher'
+require 'openssl/digest'
+require 'openssl/hmac'
+require 'openssl/pkcs5'
+require 'openssl/pkey'
+require 'openssl/ssl'
+require 'openssl/x509'
+
+module OpenSSL
+  # :call-seq:
+  #    OpenSSL.secure_compare(string, string) -> true or false
+  #
+  # Constant time memory comparison. Inputs are hashed using SHA-256 to mask
+  # the length of the secret. Returns +true+ if the strings are identical,
+  # +false+ otherwise.
+  #
+  # This method is expensive due to the SHA-256 hashing. In most cases, where
+  # the input lengths are known to be equal or are not sensitive,
+  # OpenSSL.fixed_length_secure_compare should be used instead.
+  def self.secure_compare(a, b)
+    hashed_a = OpenSSL::Digest.digest('SHA256', a)
+    hashed_b = OpenSSL::Digest.digest('SHA256', b)
+    OpenSSL.fixed_length_secure_compare(hashed_a, hashed_b) && a == b
+  end
+end