puma 2.2.0 → 8.0.2

data/ext/puma_http11/org/jruby/puma/MiniSSL.java

@@ -1,32 +1,53 @@
 package org.jruby.puma;
 
 import org.jruby.Ruby;
+import org.jruby.RubyArray;
 import org.jruby.RubyClass;
-import org.jruby.RubyHash;
 import org.jruby.RubyModule;
-import org.jruby.RubyNumeric;
 import org.jruby.RubyObject;
 import org.jruby.RubyString;
-
 import org.jruby.anno.JRubyMethod;
-
+import org.jruby.exceptions.RaiseException;
+import org.jruby.javasupport.JavaEmbedUtils;
 import org.jruby.runtime.Block;
 import org.jruby.runtime.ObjectAllocator;
 import org.jruby.runtime.ThreadContext;
 import org.jruby.runtime.builtin.IRubyObject;
-
-import org.jruby.exceptions.RaiseException;
-
 import org.jruby.util.ByteList;
 
-
-import javax.net.ssl.*;
-import javax.net.ssl.SSLEngineResult.*;
-import java.io.*;
-import java.security.*;
-import java.nio.*;
-
-public class MiniSSL extends RubyObject {
+import javax.net.ssl.KeyManagerFactory;
+import javax.net.ssl.TrustManager;
+import javax.net.ssl.TrustManagerFactory;
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.SSLEngine;
+import javax.net.ssl.SSLEngineResult;
+import javax.net.ssl.SSLException;
+import javax.net.ssl.SSLPeerUnverifiedException;
+import javax.net.ssl.SSLSession;
+import javax.net.ssl.X509TrustManager;
+import java.io.FileInputStream;
+import java.io.InputStream;
+import java.io.IOException;
+import java.nio.Buffer;
+import java.nio.ByteBuffer;
+import java.security.KeyManagementException;
+import java.security.KeyStore;
+import java.security.KeyStoreException;
+import java.security.NoSuchAlgorithmException;
+import java.security.UnrecoverableKeyException;
+import java.security.cert.Certificate;
+import java.security.cert.CertificateEncodingException;
+import java.security.cert.CertificateException;
+import java.security.cert.X509Certificate;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.Map;
+import java.util.function.Supplier;
+
+import static javax.net.ssl.SSLEngineResult.Status;
+import static javax.net.ssl.SSLEngineResult.HandshakeStatus;
+
+public class MiniSSL extends RubyObject { // MiniSSL::Engine
+  private static final long serialVersionUID = -6903439483039141234L;
   private static ObjectAllocator ALLOCATOR = new ObjectAllocator() {
     public IRubyObject allocate(Ruby runtime, RubyClass klass) {
       return new MiniSSL(runtime, klass);
@@ -35,255 +56,454 @@ public class MiniSSL extends RubyObject {
 
   public static void createMiniSSL(Ruby runtime) {
     RubyModule mPuma = runtime.defineModule("Puma");
-    RubyModule ssl =   mPuma.defineModuleUnder("MiniSSL");
+    RubyModule ssl = mPuma.defineModuleUnder("MiniSSL");
 
-    mPuma.defineClassUnder("SSLError",
-                           runtime.getClass("IOError"),
-                           runtime.getClass("IOError").getAllocator());
+    // Puma::MiniSSL::SSLError
+    ssl.defineClassUnder("SSLError", runtime.getStandardError(), runtime.getStandardError().getAllocator());
 
-    RubyClass eng = ssl.defineClassUnder("Engine",runtime.getObject(),ALLOCATOR);
+    RubyClass eng = ssl.defineClassUnder("Engine", runtime.getObject(), ALLOCATOR);
     eng.defineAnnotatedMethods(MiniSSL.class);
   }
 
-  private Ruby runtime;
-  private SSLContext sslc;
-
-  private SSLEngine  engine;
-
-  private ByteBuffer peerAppData;
-  private ByteBuffer peerNetData;
-  private ByteBuffer netData;
-  private ByteBuffer dummy;
-  
-  public MiniSSL(Ruby runtime, RubyClass klass) {
-    super(runtime, klass);
+  /**
+   * Fairly transparent wrapper around {@link java.nio.ByteBuffer} which adds the enhancements we need
+   */
+  private static class MiniSSLBuffer {
+    ByteBuffer buffer;
 
-    this.runtime = runtime;
-  }
+    private MiniSSLBuffer(int capacity) { buffer = ByteBuffer.allocate(capacity); }
+    private MiniSSLBuffer(byte[] initialContents) { buffer = ByteBuffer.wrap(initialContents); }
 
-  @JRubyMethod(meta = true)
-  public static IRubyObject server(ThreadContext context, IRubyObject recv, IRubyObject key, IRubyObject cert) {
-      RubyClass klass = (RubyClass) recv;
-      IRubyObject newInstance = klass.newInstance(context,
-          new IRubyObject[] { key, cert },
-          Block.NULL_BLOCK);
+    public void clear() { buffer.clear(); }
+    public void compact() { buffer.compact(); }
+    public void flip() { ((Buffer) buffer).flip(); }
+    public boolean hasRemaining() { return buffer.hasRemaining(); }
+    public int position() { return buffer.position(); }
 
-      return newInstance;
-  }
+    public ByteBuffer getRawBuffer() {
+      return buffer;
+    }
 
-  @JRubyMethod
-  public IRubyObject initialize(IRubyObject key, IRubyObject cert) 
-      throws java.security.KeyStoreException,
-             java.io.FileNotFoundException,
-             java.io.IOException,
-             java.io.FileNotFoundException,
-             java.security.NoSuchAlgorithmException,
-             java.security.KeyManagementException,
-             java.security.cert.CertificateException,
-             java.security.UnrecoverableKeyException
-  {
-    KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
-    KeyStore ts = KeyStore.getInstance(KeyStore.getDefaultType());
-
-    char[] pass = "blahblah".toCharArray();
-
-    ks.load(new FileInputStream(key.convertToString().asJavaString()),
-                                pass);
-    ts.load(new FileInputStream(cert.convertToString().asJavaString()),
-            pass);
+    /**
+     * Writes bytes to the buffer after ensuring there's room
+     */
+    private void put(byte[] bytes, final int offset, final int length) {
+      if (buffer.remaining() < length) {
+        resize(buffer.limit() + length);
+      }
+      buffer.put(bytes, offset, length);
+    }
 
-    KeyManagerFactory kmf = KeyManagerFactory.getInstance("SunX509");
-    kmf.init(ks, pass);
+    /**
+     * Ensures that newCapacity bytes can be written to this buffer, only re-allocating if necessary
+     */
+    public void resize(int newCapacity) {
+      if (newCapacity > buffer.capacity()) {
+        ByteBuffer dstTmp = ByteBuffer.allocate(newCapacity);
+        flip();
+        dstTmp.put(buffer);
+        buffer = dstTmp;
+      } else {
+        buffer.limit(newCapacity);
+      }
+    }
 
-    TrustManagerFactory tmf = TrustManagerFactory.getInstance("SunX509");
-    tmf.init(ts);
+    /**
+     * Drains the buffer to a ByteList, or returns null for an empty buffer
+     */
+    public ByteList asByteList() {
+      flip();
+      if (!buffer.hasRemaining()) {
+        buffer.clear();
+        return null;
+      }
 
-    SSLContext sslCtx = SSLContext.getInstance("TLS");
+      byte[] bss = new byte[buffer.limit()];
 
-    sslCtx.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);
+      buffer.get(bss);
+      buffer.clear();
+      return new ByteList(bss, false);
+    }
 
-    sslc = sslCtx;
+    @Override
+    public String toString() { return buffer.toString(); }
+  }
 
-    engine = sslc.createSSLEngine();
-    engine.setUseClientMode(false);
-    // engine.setNeedClientAuth(true);
+  private SSLEngine engine;
+  private boolean closed;
+  private boolean handshake;
+  private MiniSSLBuffer inboundNetData;
+  private MiniSSLBuffer outboundAppData;
+  private MiniSSLBuffer outboundNetData;
 
-    SSLSession session = engine.getSession();
-    peerNetData = ByteBuffer.allocate(session.getPacketBufferSize());
-    peerAppData = ByteBuffer.allocate(session.getApplicationBufferSize());		
-    netData = ByteBuffer.allocate(session.getPacketBufferSize());
-    peerNetData.limit(0);
-    peerAppData.limit(0);
-    netData.limit(0);
-
-    peerNetData.clear();
-    peerAppData.clear();
-    netData.clear();
-
-    dummy = ByteBuffer.allocate(0);
-    
-    return this;
+  public MiniSSL(Ruby runtime, RubyClass klass) {
+    super(runtime, klass);
   }
 
-  @JRubyMethod
-  public IRubyObject inject(IRubyObject arg) {
-    byte[] bytes = arg.convertToString().getBytes();
+  private static Map<String, KeyManagerFactory> keyManagerFactoryMap = new ConcurrentHashMap<String, KeyManagerFactory>();
+  private static Map<String, TrustManagerFactory> trustManagerFactoryMap = new ConcurrentHashMap<String, TrustManagerFactory>();
+
+  @JRubyMethod(meta = true) // Engine.server
+  public static synchronized IRubyObject server(ThreadContext context, IRubyObject recv, IRubyObject miniSSLContext)
+      throws KeyStoreException, IOException, CertificateException, NoSuchAlgorithmException, UnrecoverableKeyException {
+    // Create the KeyManagerFactory and TrustManagerFactory for this server
+    String keystoreFile = asStringValue(miniSSLContext.callMethod(context, "keystore"), null);
+    char[] keystorePass = asStringValue(miniSSLContext.callMethod(context, "keystore_pass"), null).toCharArray();
+    String keystoreType = asStringValue(miniSSLContext.callMethod(context, "keystore_type"), KeyStore::getDefaultType);
+
+    String truststoreFile;
+    char[] truststorePass;
+    String truststoreType;
+    IRubyObject truststore = miniSSLContext.callMethod(context, "truststore");
+    if (truststore.isNil()) {
+      truststoreFile = keystoreFile;
+      truststorePass = keystorePass;
+      truststoreType = keystoreType;
+    } else if (!isDefaultSymbol(context, truststore)) {
+      truststoreFile = truststore.convertToString().asJavaString();
+      IRubyObject pass = miniSSLContext.callMethod(context, "truststore_pass");
+      if (pass.isNil()) {
+        truststorePass = null;
+      } else {
+        truststorePass = asStringValue(pass, null).toCharArray();
+      }
+      truststoreType = asStringValue(miniSSLContext.callMethod(context, "truststore_type"), KeyStore::getDefaultType);
+    } else { // self.truststore = :default
+      truststoreFile = null;
+      truststorePass = null;
+      truststoreType = null;
+    }
 
-    peerNetData.limit(peerNetData.limit() + bytes.length);
+    KeyStore ks = KeyStore.getInstance(keystoreType);
+    InputStream is = new FileInputStream(keystoreFile);
+    try {
+      ks.load(is, keystorePass);
+    } finally {
+      is.close();
+    }
+    KeyManagerFactory kmf = KeyManagerFactory.getInstance("SunX509");
+    kmf.init(ks, keystorePass);
+    keyManagerFactoryMap.put(keystoreFile, kmf);
+
+    if (truststoreFile != null) {
+      KeyStore ts = KeyStore.getInstance(truststoreType);
+      is = new FileInputStream(truststoreFile);
+      try {
+        ts.load(is, truststorePass);
+      } finally {
+        is.close();
+      }
+      TrustManagerFactory tmf = TrustManagerFactory.getInstance("SunX509");
+      tmf.init(ts);
+      trustManagerFactoryMap.put(truststoreFile, tmf);
+    }
 
-    log("capacity: " + peerNetData.capacity() + " limit: " + peerNetData.limit());
+    RubyClass klass = (RubyClass) recv;
+    return klass.newInstance(context, miniSSLContext, Block.NULL_BLOCK);
+  }
 
-    peerNetData.put(bytes);
+  private static String asStringValue(IRubyObject value, Supplier<String> defaultValue) {
+    if (defaultValue != null && value.isNil()) return defaultValue.get();
+    return value.convertToString().asJavaString();
+  }
 
-    log("netData: " + peerNetData.position() + "/" + peerAppData.limit());
-    return this;
+  private static boolean isDefaultSymbol(ThreadContext context, IRubyObject truststore) {
+    return context.runtime.newSymbol("default").equals(truststore);
   }
 
   @JRubyMethod
-  public IRubyObject read() throws javax.net.ssl.SSLException, Exception {
-    peerAppData.clear();
-    peerNetData.flip();
-    SSLEngineResult res;
-
-    log("available read: " + peerNetData.position() + "/ " + peerNetData.limit());
-
-    if(!peerNetData.hasRemaining()) {
-      return getRuntime().getNil();
+  public IRubyObject initialize(ThreadContext context, IRubyObject miniSSLContext)
+      throws KeyStoreException, NoSuchAlgorithmException, KeyManagementException {
+
+    String keystoreFile = miniSSLContext.callMethod(context, "keystore").convertToString().asJavaString();
+    KeyManagerFactory kmf = keyManagerFactoryMap.get(keystoreFile);
+    IRubyObject truststore = miniSSLContext.callMethod(context, "truststore");
+    String truststoreFile = isDefaultSymbol(context, truststore) ? "" : asStringValue(truststore, () -> keystoreFile);
+    TrustManagerFactory tmf = trustManagerFactoryMap.get(truststoreFile); // null if self.truststore = :default
+    if (kmf == null) {
+      throw new KeyStoreException("Could not find KeyManagerFactory for keystore: " + keystoreFile + " truststore: " + truststoreFile);
     }
 
-    do {
-      res = engine.unwrap(peerNetData, peerAppData);
-    } while(res.getStatus() == SSLEngineResult.Status.OK &&
-        res.getHandshakeStatus() == SSLEngineResult.HandshakeStatus.NEED_UNWRAP &&
-        res.bytesProduced() == 0);
+    SSLContext sslCtx = SSLContext.getInstance("TLS");
 
-    log("read: ", res);
+    sslCtx.init(kmf.getKeyManagers(), getTrustManagers(tmf), null);
+    closed = false;
+    handshake = false;
+    engine = sslCtx.createSSLEngine();
+
+    String[] enabledProtocols;
+    IRubyObject protocols = miniSSLContext.callMethod(context, "protocols");
+    if (protocols.isNil()) {
+      if (miniSSLContext.callMethod(context, "no_tlsv1").isTrue()) {
+        enabledProtocols = new String[] { "TLSv1.1", "TLSv1.2", "TLSv1.3" };
+      } else {
+        enabledProtocols = new String[] { "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" };
+      }
 
-    if(peerNetData.hasRemaining()) {
-      log("STILL HAD peerNetData!");
+      if (miniSSLContext.callMethod(context, "no_tlsv1_1").isTrue()) {
+        enabledProtocols = new String[] { "TLSv1.2", "TLSv1.3" };
+      }
+    } else if (protocols instanceof RubyArray) {
+      enabledProtocols = (String[]) ((RubyArray) protocols).toArray(new String[0]);
+    } else {
+      throw context.runtime.newTypeError(protocols, context.runtime.getArray());
     }
+    engine.setEnabledProtocols(enabledProtocols);
 
-    peerNetData.position(0);
-    peerNetData.limit(0);
+    engine.setUseClientMode(false);
 
-    HandshakeStatus hsStatus = runDelegatedTasks(res, engine);
+    long verify_mode = miniSSLContext.callMethod(context, "verify_mode").convertToInteger("to_i").getLongValue();
+    if ((verify_mode & 0x1) != 0) { // 'peer'
+        engine.setWantClientAuth(true);
+    }
+    if ((verify_mode & 0x2) != 0) { // 'force_peer'
+        engine.setNeedClientAuth(true);
+    }
 
-    if(res.getStatus() == SSLEngineResult.Status.BUFFER_UNDERFLOW) {
-      return getRuntime().getNil();
+    IRubyObject cipher_suites = miniSSLContext.callMethod(context, "cipher_suites");
+    if (cipher_suites instanceof RubyArray) {
+      engine.setEnabledCipherSuites((String[]) ((RubyArray) cipher_suites).toArray(new String[0]));
+    } else if (!cipher_suites.isNil()) {
+      throw context.runtime.newTypeError(cipher_suites, context.runtime.getArray());
     }
 
-    if(hsStatus == HandshakeStatus.NEED_WRAP) {
-      netData.clear();
-      log("netData: " + netData.limit());
-      engine.wrap(dummy, netData);
-      return getRuntime().getNil();
+    SSLSession session = engine.getSession();
+    inboundNetData = new MiniSSLBuffer(session.getPacketBufferSize());
+    outboundAppData = new MiniSSLBuffer(session.getApplicationBufferSize());
+    outboundAppData.flip();
+    outboundNetData = new MiniSSLBuffer(session.getPacketBufferSize());
+
+    return this;
+  }
+
+  private TrustManager[] getTrustManagers(TrustManagerFactory factory) {
+    if (factory == null) return null; // use JDK trust defaults
+    final TrustManager[] tms = factory.getTrustManagers();
+    if (tms != null) {
+      for (int i=0; i<tms.length; i++) {
+        final TrustManager tm = tms[i];
+        if (tm instanceof X509TrustManager) {
+          tms[i] = new TrustManagerWrapper((X509TrustManager) tm);
+        }
+      }
     }
+    return tms;
+  }
 
-    if(hsStatus == HandshakeStatus.NEED_UNWRAP) {
-      return getRuntime().getNil();
+  private volatile transient X509Certificate lastCheckedCert0;
 
-      // log("peerNet: " + peerNetData.position() + "/" + peerNetData.limit());
-      // log("peerApp: " + peerAppData.position() + "/" + peerAppData.limit());
+  private class TrustManagerWrapper implements X509TrustManager {
 
-      // peerNetData.compact();
+    private final X509TrustManager delegate;
 
-      // log("peerNet: " + peerNetData.position() + "/" + peerNetData.limit());
-        // do {
-          // res = engine.unwrap(peerNetData, peerAppData);
-        // } while(res.getStatus() == SSLEngineResult.Status.OK &&
-            // res.getHandshakeStatus() == SSLEngineResult.HandshakeStatus.NEED_UNWRAP &&
-            // res.bytesProduced() == 0);
-      // return getRuntime().getNil();
+    TrustManagerWrapper(X509TrustManager delegate) {
+      this.delegate = delegate;
     }
 
-    // if(peerAppData.position() == 0 && 
-        // res.getStatus() == SSLEngineResult.Status.OK &&
-        // peerNetData.hasRemaining()) {
-      // res = engine.unwrap(peerNetData, peerAppData);
-    // }
+    @Override
+    public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {
+      lastCheckedCert0 = chain.length > 0 ? chain[0] : null;
+      delegate.checkClientTrusted(chain, authType);
+    }
 
-    byte[] bss = new byte[peerAppData.limit()];
+    @Override
+    public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {
+      delegate.checkServerTrusted(chain, authType);
+    }
 
-    peerAppData.get(bss);
+    @Override
+    public X509Certificate[] getAcceptedIssuers() {
+      return delegate.getAcceptedIssuers();
+    }
 
-    RubyString str = getRuntime().newString("");
-    str.setValue(new ByteList(bss));
+  }
 
-    return str;
+  @JRubyMethod
+  public IRubyObject inject(IRubyObject arg) {
+    ByteList bytes = arg.convertToString().getByteList();
+    inboundNetData.put(bytes.unsafeBytes(), bytes.getBegin(), bytes.getRealSize());
+    return this;
   }
 
-  private static HandshakeStatus runDelegatedTasks(SSLEngineResult result,
-      SSLEngine engine) throws Exception {
+  private enum SSLOperation {
+    WRAP,
+    UNWRAP
+  }
 
-    HandshakeStatus hsStatus = result.getHandshakeStatus();
+  private SSLEngineResult doOp(SSLOperation sslOp, MiniSSLBuffer src, MiniSSLBuffer dst) throws SSLException {
+    SSLEngineResult res = null;
+    boolean retryOp = true;
+    while (retryOp) {
+      switch (sslOp) {
+        case WRAP:
+          res = engine.wrap(src.getRawBuffer(), dst.getRawBuffer());
+          break;
+        case UNWRAP:
+          res = engine.unwrap(src.getRawBuffer(), dst.getRawBuffer());
+          break;
+        default:
+          throw new AssertionError("Unknown SSLOperation: " + sslOp);
+      }
 
-    if(hsStatus == HandshakeStatus.NEED_TASK) {
-      Runnable runnable;
-      while ((runnable = engine.getDelegatedTask()) != null) {
-        log("\trunning delegated task...");
-        runnable.run();
+      switch (res.getStatus()) {
+        case BUFFER_OVERFLOW:
+          // increase the buffer size to accommodate the overflowing data
+          int newSize = Math.max(engine.getSession().getPacketBufferSize(), engine.getSession().getApplicationBufferSize());
+          dst.resize(newSize + dst.position());
+          // retry the operation
+          retryOp = true;
+          break;
+        case BUFFER_UNDERFLOW:
+          // need to wait for more data to come in before we retry
+          retryOp = false;
+          break;
+        case CLOSED:
+          closed = true;
+          retryOp = false;
+          break;
+        default:
+          // other case is OK.  We're done here.
+          retryOp = false;
       }
-      hsStatus = engine.getHandshakeStatus();
-      if (hsStatus == HandshakeStatus.NEED_TASK) {
-        throw new Exception(
-            "handshake shouldn't need additional tasks");
+      if (res.getHandshakeStatus() == HandshakeStatus.FINISHED) {
+        handshake = true;
       }
-      log("\tnew HandshakeStatus: " + hsStatus);
     }
 
-    return hsStatus;
+    return res;
   }
-  
-
-  private static void log(String str, SSLEngineResult result) {
-    System.out.println("The format of the SSLEngineResult is: \n" +
-        "\t\"getStatus() / getHandshakeStatus()\" +\n" +
-        "\t\"bytesConsumed() / bytesProduced()\"\n");
-
-    HandshakeStatus hsStatus = result.getHandshakeStatus();
-    log(str +
-        result.getStatus() + "/" + hsStatus + ", " +
-        result.bytesConsumed() + "/" + result.bytesProduced() +
-        " bytes");
-    if (hsStatus == HandshakeStatus.FINISHED) {
-      log("\t...ready for application data");
+
+  @JRubyMethod
+  public IRubyObject read() {
+    try {
+      inboundNetData.flip();
+
+      if(!inboundNetData.hasRemaining()) {
+        return getRuntime().getNil();
+      }
+
+      MiniSSLBuffer inboundAppData = new MiniSSLBuffer(engine.getSession().getApplicationBufferSize());
+      doOp(SSLOperation.UNWRAP, inboundNetData, inboundAppData);
+
+      HandshakeStatus handshakeStatus = engine.getHandshakeStatus();
+      boolean done = false;
+      while (!done) {
+        SSLEngineResult res;
+        switch (handshakeStatus) {
+          case NEED_WRAP:
+            res = doOp(SSLOperation.WRAP, inboundAppData, outboundNetData);
+            handshakeStatus = res.getHandshakeStatus();
+            break;
+          case NEED_UNWRAP:
+            res = doOp(SSLOperation.UNWRAP, inboundNetData, inboundAppData);
+            if (res.getStatus() == Status.BUFFER_UNDERFLOW) {
+              // need more data before we can shake more hands
+              done = true;
+            }
+            handshakeStatus = res.getHandshakeStatus();
+            break;
+          case NEED_TASK:
+            Runnable runnable;
+            while ((runnable = engine.getDelegatedTask()) != null) {
+              runnable.run();
+            }
+            handshakeStatus = engine.getHandshakeStatus();
+            break;
+          default:
+            done = true;
+        }
+      }
+
+      if (inboundNetData.hasRemaining()) {
+        inboundNetData.compact();
+      } else {
+        inboundNetData.clear();
+      }
+
+      ByteList appDataByteList = inboundAppData.asByteList();
+      if (appDataByteList == null) {
+        return getRuntime().getNil();
+      }
+
+      return RubyString.newString(getRuntime(), appDataByteList);
+    } catch (SSLException e) {
+      throw newSSLError(getRuntime(), e);
     }
   }
 
-  private static void log(String str) {
-    System.out.println(str);
+  @JRubyMethod
+  public IRubyObject write(IRubyObject arg) {
+    byte[] bls = arg.convertToString().getBytes();
+    outboundAppData = new MiniSSLBuffer(bls);
+
+    return getRuntime().newFixnum(bls.length);
   }
-  
-  
 
   @JRubyMethod
-  public IRubyObject write(IRubyObject arg) throws javax.net.ssl.SSLException {
-    log("write from: " + netData.position());
+  public IRubyObject extract(ThreadContext context) {
+    try {
+      ByteList dataByteList = outboundNetData.asByteList();
+      if (dataByteList != null) {
+        return RubyString.newString(context.runtime, dataByteList);
+      }
 
-    byte[] bls = arg.convertToString().getBytes();
-    ByteBuffer src = ByteBuffer.wrap(bls);
+      if (!outboundAppData.hasRemaining()) {
+        return context.nil;
+      }
 
-    SSLEngineResult res = engine.wrap(src, netData);
+      outboundNetData.clear();
+      doOp(SSLOperation.WRAP, outboundAppData, outboundNetData);
+      dataByteList = outboundNetData.asByteList();
+      if (dataByteList == null) {
+        return context.nil;
+      }
 
-    return getRuntime().newFixnum(res.bytesConsumed());
+      return RubyString.newString(context.runtime, dataByteList);
+    } catch (SSLException e) {
+      throw newSSLError(getRuntime(), e);
+    }
   }
 
   @JRubyMethod
-  public IRubyObject extract() {
-    netData.flip();
-
-    if(!netData.hasRemaining()) {
-      return getRuntime().getNil();
+  public IRubyObject peercert(ThreadContext context) throws CertificateEncodingException {
+    Certificate peerCert;
+    try {
+      peerCert = engine.getSession().getPeerCertificates()[0];
+    } catch (SSLPeerUnverifiedException e) {
+      peerCert = lastCheckedCert0; // null if trust check did not happen
     }
+    return peerCert == null ? context.nil : JavaEmbedUtils.javaToRuby(context.runtime, peerCert.getEncoded());
+  }
 
-    byte[] bss = new byte[netData.limit()];
+  @JRubyMethod(name = "init?")
+  public IRubyObject isInit(ThreadContext context) {
+    return handshake ? getRuntime().getFalse() : getRuntime().getTrue();
+  }
 
-    netData.get(bss);
-    netData.clear();
+  @JRubyMethod
+  public IRubyObject shutdown() {
+    if (closed || engine.isInboundDone() && engine.isOutboundDone()) {
+      if (engine.isOutboundDone()) {
+        engine.closeOutbound();
+      }
+      return getRuntime().getTrue();
+    } else {
+      return getRuntime().getFalse();
+    }
+  }
 
-    RubyString str = getRuntime().newString("");
-    str.setValue(new ByteList(bss));
+  private static RubyClass getSSLError(Ruby runtime) {
+    return (RubyClass) ((RubyModule) runtime.getModule("Puma").getConstantAt("MiniSSL")).getConstantAt("SSLError");
+  }
 
-    return str;
+  private static RaiseException newSSLError(Ruby runtime, SSLException cause) {
+    return newError(runtime, getSSLError(runtime), cause.toString(), cause);
   }
+
+  private static RaiseException newError(Ruby runtime, RubyClass errorClass, String message, Throwable cause) {
+    RaiseException ex = RaiseException.from(runtime, errorClass, message);
+    ex.initCause(cause);
+    return ex;
+  }
+
 }