puma 5.2.2 → 6.3.0

data/ext/puma_http11/org/jruby/puma/Http11Parser.java

@@ -34,9 +34,9 @@ private static short[] init__puma_parser_key_offsets_0()
 {
 	return new short [] {
 	    0,    0,    8,   17,   27,   29,   30,   31,   32,   33,   34,   36,
-	   39,   41,   44,   45,   61,   62,   78,   80,   81,   89,   97,  107,
-	  115,  124,  132,  140,  149,  158,  167,  176,  185,  194,  203,  212,
-	  221,  230,  239,  248,  257,  266,  275,  284,  293,  302,  303
+	   39,   41,   44,   45,   61,   62,   78,   85,   91,   99,  107,  117,
+	  125,  134,  142,  150,  159,  168,  177,  186,  195,  204,  213,  222,
+	  231,  240,  249,  258,  267,  276,  285,  294,  303,  312,  313
 	};
 }
 
@@ -52,26 +52,27 @@ private static char[] init__puma_parser_trans_keys_0()
 	   46,   48,   57,   48,   57,   13,   48,   57,   10,   13,   33,  124,
 	  126,   35,   39,   42,   43,   45,   46,   48,   57,   65,   90,   94,
 	  122,   10,   33,   58,  124,  126,   35,   39,   42,   43,   45,   46,
-	   48,   57,   65,   90,   94,  122,   13,   32,   13,   32,   60,   62,
-	  127,    0,   31,   34,   35,   32,   60,   62,  127,    0,   31,   34,
-	   35,   43,   58,   45,   46,   48,   57,   65,   90,   97,  122,   32,
-	   34,   35,   60,   62,  127,    0,   31,   32,   34,   35,   60,   62,
-	   63,  127,    0,   31,   32,   34,   35,   60,   62,  127,    0,   31,
-	   32,   34,   35,   60,   62,  127,    0,   31,   32,   36,   95,   45,
-	   46,   48,   57,   65,   90,   32,   36,   95,   45,   46,   48,   57,
-	   65,   90,   32,   36,   95,   45,   46,   48,   57,   65,   90,   32,
-	   36,   95,   45,   46,   48,   57,   65,   90,   32,   36,   95,   45,
-	   46,   48,   57,   65,   90,   32,   36,   95,   45,   46,   48,   57,
-	   65,   90,   32,   36,   95,   45,   46,   48,   57,   65,   90,   32,
-	   36,   95,   45,   46,   48,   57,   65,   90,   32,   36,   95,   45,
-	   46,   48,   57,   65,   90,   32,   36,   95,   45,   46,   48,   57,
-	   65,   90,   32,   36,   95,   45,   46,   48,   57,   65,   90,   32,
-	   36,   95,   45,   46,   48,   57,   65,   90,   32,   36,   95,   45,
-	   46,   48,   57,   65,   90,   32,   36,   95,   45,   46,   48,   57,
-	   65,   90,   32,   36,   95,   45,   46,   48,   57,   65,   90,   32,
-	   36,   95,   45,   46,   48,   57,   65,   90,   32,   36,   95,   45,
-	   46,   48,   57,   65,   90,   32,   36,   95,   45,   46,   48,   57,
-	   65,   90,   32,    0
+	   48,   57,   65,   90,   94,  122,   13,   32,  127,    0,    8,   10,
+	   31,   13,  127,    0,    8,   10,   31,   32,   60,   62,  127,    0,
+	   31,   34,   35,   32,   60,   62,  127,    0,   31,   34,   35,   43,
+	   58,   45,   46,   48,   57,   65,   90,   97,  122,   32,   34,   35,
+	   60,   62,  127,    0,   31,   32,   34,   35,   60,   62,   63,  127,
+	    0,   31,   32,   34,   35,   60,   62,  127,    0,   31,   32,   34,
+	   35,   60,   62,  127,    0,   31,   32,   36,   95,   45,   46,   48,
+	   57,   65,   90,   32,   36,   95,   45,   46,   48,   57,   65,   90,
+	   32,   36,   95,   45,   46,   48,   57,   65,   90,   32,   36,   95,
+	   45,   46,   48,   57,   65,   90,   32,   36,   95,   45,   46,   48,
+	   57,   65,   90,   32,   36,   95,   45,   46,   48,   57,   65,   90,
+	   32,   36,   95,   45,   46,   48,   57,   65,   90,   32,   36,   95,
+	   45,   46,   48,   57,   65,   90,   32,   36,   95,   45,   46,   48,
+	   57,   65,   90,   32,   36,   95,   45,   46,   48,   57,   65,   90,
+	   32,   36,   95,   45,   46,   48,   57,   65,   90,   32,   36,   95,
+	   45,   46,   48,   57,   65,   90,   32,   36,   95,   45,   46,   48,
+	   57,   65,   90,   32,   36,   95,   45,   46,   48,   57,   65,   90,
+	   32,   36,   95,   45,   46,   48,   57,   65,   90,   32,   36,   95,
+	   45,   46,   48,   57,   65,   90,   32,   36,   95,   45,   46,   48,
+	   57,   65,   90,   32,   36,   95,   45,   46,   48,   57,   65,   90,
+	   32,    0
 	};
 }
 
@@ -82,7 +83,7 @@ private static byte[] init__puma_parser_single_lengths_0()
 {
 	return new byte [] {
 	    0,    2,    3,    4,    2,    1,    1,    1,    1,    1,    0,    1,
-	    0,    1,    1,    4,    1,    4,    2,    1,    4,    4,    2,    6,
+	    0,    1,    1,    4,    1,    4,    3,    2,    4,    4,    2,    6,
 	    7,    6,    6,    3,    3,    3,    3,    3,    3,    3,    3,    3,
 	    3,    3,    3,    3,    3,    3,    3,    3,    3,    1,    0
 	};
@@ -95,7 +96,7 @@ private static byte[] init__puma_parser_range_lengths_0()
 {
 	return new byte [] {
 	    0,    3,    3,    3,    0,    0,    0,    0,    0,    0,    1,    1,
-	    1,    1,    0,    6,    0,    6,    0,    0,    2,    2,    4,    1,
+	    1,    1,    0,    6,    0,    6,    2,    2,    2,    2,    4,    1,
 	    1,    1,    1,    3,    3,    3,    3,    3,    3,    3,    3,    3,
 	    3,    3,    3,    3,    3,    3,    3,    3,    3,    0,    0
 	};
@@ -108,9 +109,9 @@ private static short[] init__puma_parser_index_offsets_0()
 {
 	return new short [] {
 	    0,    0,    6,   13,   21,   24,   26,   28,   30,   32,   34,   36,
-	   39,   41,   44,   46,   57,   59,   70,   73,   75,   82,   89,   96,
-	  104,  113,  121,  129,  136,  143,  150,  157,  164,  171,  178,  185,
-	  192,  199,  206,  213,  220,  227,  234,  241,  248,  255,  257
+	   39,   41,   44,   46,   57,   59,   70,   76,   81,   88,   95,  102,
+	  110,  119,  127,  135,  142,  149,  156,  163,  170,  177,  184,  191,
+	  198,  205,  212,  219,  226,  233,  240,  247,  254,  261,  263
 	};
 }
 
@@ -126,22 +127,23 @@ private static byte[] init__puma_parser_indicies_0()
 	   16,   15,    1,   17,    1,   18,   17,    1,   19,    1,   20,   21,
 	   21,   21,   21,   21,   21,   21,   21,   21,    1,   22,    1,   23,
 	   24,   23,   23,   23,   23,   23,   23,   23,   23,    1,   26,   27,
-	   25,   29,   28,   30,    1,    1,    1,    1,    1,   31,   32,    1,
-	    1,    1,    1,    1,   33,   34,   35,   34,   34,   34,   34,    1,
-	    8,    1,    9,    1,    1,    1,    1,   35,   36,    1,   38,    1,
-	    1,   39,    1,    1,   37,   40,    1,   42,    1,    1,    1,    1,
-	   41,   43,    1,   45,    1,    1,    1,    1,   44,    2,   46,   46,
-	   46,   46,   46,    1,    2,   47,   47,   47,   47,   47,    1,    2,
-	   48,   48,   48,   48,   48,    1,    2,   49,   49,   49,   49,   49,
-	    1,    2,   50,   50,   50,   50,   50,    1,    2,   51,   51,   51,
-	   51,   51,    1,    2,   52,   52,   52,   52,   52,    1,    2,   53,
-	   53,   53,   53,   53,    1,    2,   54,   54,   54,   54,   54,    1,
-	    2,   55,   55,   55,   55,   55,    1,    2,   56,   56,   56,   56,
-	   56,    1,    2,   57,   57,   57,   57,   57,    1,    2,   58,   58,
-	   58,   58,   58,    1,    2,   59,   59,   59,   59,   59,    1,    2,
-	   60,   60,   60,   60,   60,    1,    2,   61,   61,   61,   61,   61,
-	    1,    2,   62,   62,   62,   62,   62,    1,    2,   63,   63,   63,
-	   63,   63,    1,    2,    1,    1,    0
+	    1,    1,    1,   25,   29,    1,    1,    1,   28,   30,    1,    1,
+	    1,    1,    1,   31,   32,    1,    1,    1,    1,    1,   33,   34,
+	   35,   34,   34,   34,   34,    1,    8,    1,    9,    1,    1,    1,
+	    1,   35,   36,    1,   38,    1,    1,   39,    1,    1,   37,   40,
+	    1,   42,    1,    1,    1,    1,   41,   43,    1,   45,    1,    1,
+	    1,    1,   44,    2,   46,   46,   46,   46,   46,    1,    2,   47,
+	   47,   47,   47,   47,    1,    2,   48,   48,   48,   48,   48,    1,
+	    2,   49,   49,   49,   49,   49,    1,    2,   50,   50,   50,   50,
+	   50,    1,    2,   51,   51,   51,   51,   51,    1,    2,   52,   52,
+	   52,   52,   52,    1,    2,   53,   53,   53,   53,   53,    1,    2,
+	   54,   54,   54,   54,   54,    1,    2,   55,   55,   55,   55,   55,
+	    1,    2,   56,   56,   56,   56,   56,    1,    2,   57,   57,   57,
+	   57,   57,    1,    2,   58,   58,   58,   58,   58,    1,    2,   59,
+	   59,   59,   59,   59,    1,    2,   60,   60,   60,   60,   60,    1,
+	    2,   61,   61,   61,   61,   61,    1,    2,   62,   62,   62,   62,
+	   62,    1,    2,   63,   63,   63,   63,   63,    1,    2,    1,    1,
+	    0
 	};
 }
 
@@ -210,7 +212,7 @@ static final int puma_parser_error = 0;
           cs = 0;
 
           
-// line 214 "ext/puma_http11/org/jruby/puma/Http11Parser.java"
+// line 216 "ext/puma_http11/org/jruby/puma/Http11Parser.java"
 	{
 	cs = puma_parser_start;
 	}
@@ -242,7 +244,7 @@ static final int puma_parser_error = 0;
      parser.buffer = buffer;
 
      
-// line 246 "ext/puma_http11/org/jruby/puma/Http11Parser.java"
+// line 248 "ext/puma_http11/org/jruby/puma/Http11Parser.java"
 	{
 	int _klen;
 	int _trans = 0;
@@ -381,7 +383,7 @@ case 1:
 	case 11:
 // line 42 "ext/puma_http11/http11_parser.java.rl"
 	{
-    Http11.http_version(runtime, parser.data, parser.buffer, parser.mark, p-parser.mark);
+    Http11.server_protocol(runtime, parser.data, parser.buffer, parser.mark, p-parser.mark);
   }
 	break;
 	case 12:
@@ -398,7 +400,7 @@ case 1:
     { p += 1; _goto_targ = 5; if (true)  continue _goto;}
   }
 	break;
-// line 402 "ext/puma_http11/org/jruby/puma/Http11Parser.java"
+// line 404 "ext/puma_http11/org/jruby/puma/Http11Parser.java"
 			}
 		}
 	}

data/ext/puma_http11/org/jruby/puma/MiniSSL.java

@@ -1,11 +1,13 @@
 package org.jruby.puma;
 
 import org.jruby.Ruby;
+import org.jruby.RubyArray;
 import org.jruby.RubyClass;
 import org.jruby.RubyModule;
 import org.jruby.RubyObject;
 import org.jruby.RubyString;
 import org.jruby.anno.JRubyMethod;
+import org.jruby.exceptions.RaiseException;
 import org.jruby.javasupport.JavaEmbedUtils;
 import org.jruby.runtime.Block;
 import org.jruby.runtime.ObjectAllocator;
@@ -14,6 +16,7 @@ import org.jruby.runtime.builtin.IRubyObject;
 import org.jruby.util.ByteList;
 
 import javax.net.ssl.KeyManagerFactory;
+import javax.net.ssl.TrustManager;
 import javax.net.ssl.TrustManagerFactory;
 import javax.net.ssl.SSLContext;
 import javax.net.ssl.SSLEngine;
@@ -21,6 +24,7 @@ import javax.net.ssl.SSLEngineResult;
 import javax.net.ssl.SSLException;
 import javax.net.ssl.SSLPeerUnverifiedException;
 import javax.net.ssl.SSLSession;
+import javax.net.ssl.X509TrustManager;
 import java.io.FileInputStream;
 import java.io.InputStream;
 import java.io.IOException;
@@ -31,15 +35,18 @@ import java.security.KeyStore;
 import java.security.KeyStoreException;
 import java.security.NoSuchAlgorithmException;
 import java.security.UnrecoverableKeyException;
+import java.security.cert.Certificate;
 import java.security.cert.CertificateEncodingException;
 import java.security.cert.CertificateException;
+import java.security.cert.X509Certificate;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.Map;
+import java.util.function.Supplier;
 
 import static javax.net.ssl.SSLEngineResult.Status;
 import static javax.net.ssl.SSLEngineResult.HandshakeStatus;
 
-public class MiniSSL extends RubyObject {
+public class MiniSSL extends RubyObject { // MiniSSL::Engine
   private static ObjectAllocator ALLOCATOR = new ObjectAllocator() {
     public IRubyObject allocate(Ruby runtime, RubyClass klass) {
       return new MiniSSL(runtime, klass);
@@ -50,11 +57,10 @@ public class MiniSSL extends RubyObject {
     RubyModule mPuma = runtime.defineModule("Puma");
     RubyModule ssl = mPuma.defineModuleUnder("MiniSSL");
 
-    mPuma.defineClassUnder("SSLError",
-                           runtime.getClass("IOError"),
-                           runtime.getClass("IOError").getAllocator());
+    // Puma::MiniSSL::SSLError
+    ssl.defineClassUnder("SSLError", runtime.getStandardError(), runtime.getStandardError().getAllocator());
 
-    RubyClass eng = ssl.defineClassUnder("Engine",runtime.getObject(),ALLOCATOR);
+    RubyClass eng = ssl.defineClassUnder("Engine", runtime.getObject(), ALLOCATOR);
     eng.defineAnnotatedMethods(MiniSSL.class);
   }
 
@@ -80,11 +86,11 @@ public class MiniSSL extends RubyObject {
     /**
      * Writes bytes to the buffer after ensuring there's room
      */
-    public void put(byte[] bytes) {
-      if (buffer.remaining() < bytes.length) {
-        resize(buffer.limit() + bytes.length);
+    private void put(byte[] bytes, final int offset, final int length) {
+      if (buffer.remaining() < length) {
+        resize(buffer.limit() + length);
       }
-      buffer.put(bytes);
+      buffer.put(bytes, offset, length);
     }
 
     /**
@@ -115,7 +121,7 @@ public class MiniSSL extends RubyObject {
 
       buffer.get(bss);
       buffer.clear();
-      return new ByteList(bss);
+      return new ByteList(bss, false);
     }
 
     @Override
@@ -136,76 +142,116 @@ public class MiniSSL extends RubyObject {
   private static Map<String, KeyManagerFactory> keyManagerFactoryMap = new ConcurrentHashMap<String, KeyManagerFactory>();
   private static Map<String, TrustManagerFactory> trustManagerFactoryMap = new ConcurrentHashMap<String, TrustManagerFactory>();
 
-  @JRubyMethod(meta = true)
+  @JRubyMethod(meta = true) // Engine.server
   public static synchronized IRubyObject server(ThreadContext context, IRubyObject recv, IRubyObject miniSSLContext)
       throws KeyStoreException, IOException, CertificateException, NoSuchAlgorithmException, UnrecoverableKeyException {
     // Create the KeyManagerFactory and TrustManagerFactory for this server
-    String keystoreFile = miniSSLContext.callMethod(context, "keystore").convertToString().asJavaString();
-    char[] password = miniSSLContext.callMethod(context, "keystore_pass").convertToString().asJavaString().toCharArray();
+    String keystoreFile = asStringValue(miniSSLContext.callMethod(context, "keystore"), null);
+    char[] keystorePass = asStringValue(miniSSLContext.callMethod(context, "keystore_pass"), null).toCharArray();
+    String keystoreType = asStringValue(miniSSLContext.callMethod(context, "keystore_type"), KeyStore::getDefaultType);
+
+    String truststoreFile;
+    char[] truststorePass;
+    String truststoreType;
+    IRubyObject truststore = miniSSLContext.callMethod(context, "truststore");
+    if (truststore.isNil()) {
+      truststoreFile = keystoreFile;
+      truststorePass = keystorePass;
+      truststoreType = keystoreType;
+    } else if (!isDefaultSymbol(context, truststore)) {
+      truststoreFile = truststore.convertToString().asJavaString();
+      IRubyObject pass = miniSSLContext.callMethod(context, "truststore_pass");
+      if (pass.isNil()) {
+        truststorePass = null;
+      } else {
+        truststorePass = asStringValue(pass, null).toCharArray();
+      }
+      truststoreType = asStringValue(miniSSLContext.callMethod(context, "truststore_type"), KeyStore::getDefaultType);
+    } else { // self.truststore = :default
+      truststoreFile = null;
+      truststorePass = null;
+      truststoreType = null;
+    }
 
-    KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
+    KeyStore ks = KeyStore.getInstance(keystoreType);
     InputStream is = new FileInputStream(keystoreFile);
     try {
-      ks.load(is, password);
+      ks.load(is, keystorePass);
     } finally {
       is.close();
     }
     KeyManagerFactory kmf = KeyManagerFactory.getInstance("SunX509");
-    kmf.init(ks, password);
+    kmf.init(ks, keystorePass);
     keyManagerFactoryMap.put(keystoreFile, kmf);
 
-    KeyStore ts = KeyStore.getInstance(KeyStore.getDefaultType());
-    is = new FileInputStream(keystoreFile);
-    try {
-      ts.load(is, password);
-    } finally {
-      is.close();
+    if (truststoreFile != null) {
+      KeyStore ts = KeyStore.getInstance(truststoreType);
+      is = new FileInputStream(truststoreFile);
+      try {
+        ts.load(is, truststorePass);
+      } finally {
+        is.close();
+      }
+      TrustManagerFactory tmf = TrustManagerFactory.getInstance("SunX509");
+      tmf.init(ts);
+      trustManagerFactoryMap.put(truststoreFile, tmf);
     }
-    TrustManagerFactory tmf = TrustManagerFactory.getInstance("SunX509");
-    tmf.init(ts);
-    trustManagerFactoryMap.put(keystoreFile, tmf);
 
     RubyClass klass = (RubyClass) recv;
-    return klass.newInstance(context,
-        new IRubyObject[] { miniSSLContext },
-        Block.NULL_BLOCK);
+    return klass.newInstance(context, miniSSLContext, Block.NULL_BLOCK);
+  }
+
+  private static String asStringValue(IRubyObject value, Supplier<String> defaultValue) {
+    if (defaultValue != null && value.isNil()) return defaultValue.get();
+    return value.convertToString().asJavaString();
+  }
+
+  private static boolean isDefaultSymbol(ThreadContext context, IRubyObject truststore) {
+    return context.runtime.newSymbol("default").equals(truststore);
   }
 
   @JRubyMethod
-  public IRubyObject initialize(ThreadContext threadContext, IRubyObject miniSSLContext)
+  public IRubyObject initialize(ThreadContext context, IRubyObject miniSSLContext)
       throws KeyStoreException, NoSuchAlgorithmException, KeyManagementException {
-    KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
-    KeyStore ts = KeyStore.getInstance(KeyStore.getDefaultType());
 
-    String keystoreFile = miniSSLContext.callMethod(threadContext, "keystore").convertToString().asJavaString();
+    String keystoreFile = miniSSLContext.callMethod(context, "keystore").convertToString().asJavaString();
     KeyManagerFactory kmf = keyManagerFactoryMap.get(keystoreFile);
-    TrustManagerFactory tmf = trustManagerFactoryMap.get(keystoreFile);
-    if(kmf == null || tmf == null) {
-      throw new KeyStoreException("Could not find KeyManagerFactory/TrustManagerFactory for keystore: " + keystoreFile);
+    IRubyObject truststore = miniSSLContext.callMethod(context, "truststore");
+    String truststoreFile = isDefaultSymbol(context, truststore) ? "" : asStringValue(truststore, () -> keystoreFile);
+    TrustManagerFactory tmf = trustManagerFactoryMap.get(truststoreFile); // null if self.truststore = :default
+    if (kmf == null) {
+      throw new KeyStoreException("Could not find KeyManagerFactory for keystore: " + keystoreFile + " truststore: " + truststoreFile);
     }
 
     SSLContext sslCtx = SSLContext.getInstance("TLS");
 
-    sslCtx.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);
+    sslCtx.init(kmf.getKeyManagers(), getTrustManagers(tmf), null);
     closed = false;
     handshake = false;
     engine = sslCtx.createSSLEngine();
 
-    String[] protocols;
-    if(miniSSLContext.callMethod(threadContext, "no_tlsv1").isTrue()) {
-        protocols = new String[] { "TLSv1.1", "TLSv1.2" };
-    } else {
-        protocols = new String[] { "TLSv1", "TLSv1.1", "TLSv1.2" };
-    }
+    String[] enabledProtocols;
+    IRubyObject protocols = miniSSLContext.callMethod(context, "protocols");
+    if (protocols.isNil()) {
+      if (miniSSLContext.callMethod(context, "no_tlsv1").isTrue()) {
+        enabledProtocols = new String[] { "TLSv1.1", "TLSv1.2", "TLSv1.3" };
+      } else {
+        enabledProtocols = new String[] { "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" };
+      }
 
-    if(miniSSLContext.callMethod(threadContext, "no_tlsv1_1").isTrue()) {
-        protocols = new String[] { "TLSv1.2" };
+      if (miniSSLContext.callMethod(context, "no_tlsv1_1").isTrue()) {
+        enabledProtocols = new String[] { "TLSv1.2", "TLSv1.3" };
+      }
+    } else if (protocols instanceof RubyArray) {
+      enabledProtocols = (String[]) ((RubyArray) protocols).toArray(new String[0]);
+    } else {
+      throw context.runtime.newTypeError(protocols, context.runtime.getArray());
     }
+    engine.setEnabledProtocols(enabledProtocols);
 
-    engine.setEnabledProtocols(protocols);
     engine.setUseClientMode(false);
 
-    long verify_mode = miniSSLContext.callMethod(threadContext, "verify_mode").convertToInteger("to_i").getLongValue();
+    long verify_mode = miniSSLContext.callMethod(context, "verify_mode").convertToInteger("to_i").getLongValue();
     if ((verify_mode & 0x1) != 0) { // 'peer'
         engine.setWantClientAuth(true);
     }
@@ -213,10 +259,11 @@ public class MiniSSL extends RubyObject {
         engine.setNeedClientAuth(true);
     }
 
-    IRubyObject sslCipherListObject = miniSSLContext.callMethod(threadContext, "ssl_cipher_list");
-    if (!sslCipherListObject.isNil()) {
-      String[] sslCipherList = sslCipherListObject.convertToString().asJavaString().split(",");
-      engine.setEnabledCipherSuites(sslCipherList);
+    IRubyObject cipher_suites = miniSSLContext.callMethod(context, "cipher_suites");
+    if (cipher_suites instanceof RubyArray) {
+      engine.setEnabledCipherSuites((String[]) ((RubyArray) cipher_suites).toArray(new String[0]));
+    } else if (!cipher_suites.isNil()) {
+      throw context.runtime.newTypeError(cipher_suites, context.runtime.getArray());
     }
 
     SSLSession session = engine.getSession();
@@ -228,16 +275,53 @@ public class MiniSSL extends RubyObject {
     return this;
   }
 
+  private TrustManager[] getTrustManagers(TrustManagerFactory factory) {
+    if (factory == null) return null; // use JDK trust defaults
+    final TrustManager[] tms = factory.getTrustManagers();
+    if (tms != null) {
+      for (int i=0; i<tms.length; i++) {
+        final TrustManager tm = tms[i];
+        if (tm instanceof X509TrustManager) {
+          tms[i] = new TrustManagerWrapper((X509TrustManager) tm);
+        }
+      }
+    }
+    return tms;
+  }
+
+  private volatile transient X509Certificate lastCheckedCert0;
+
+  private class TrustManagerWrapper implements X509TrustManager {
+
+    private final X509TrustManager delegate;
+
+    TrustManagerWrapper(X509TrustManager delegate) {
+      this.delegate = delegate;
+    }
+
+    @Override
+    public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {
+      lastCheckedCert0 = chain.length > 0 ? chain[0] : null;
+      delegate.checkClientTrusted(chain, authType);
+    }
+
+    @Override
+    public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {
+      delegate.checkServerTrusted(chain, authType);
+    }
+
+    @Override
+    public X509Certificate[] getAcceptedIssuers() {
+      return delegate.getAcceptedIssuers();
+    }
+
+  }
+
   @JRubyMethod
   public IRubyObject inject(IRubyObject arg) {
-    try {
-      byte[] bytes = arg.convertToString().getBytes();
-      inboundNetData.put(bytes);
-      return this;
-    } catch (Exception e) {
-      e.printStackTrace();
-      throw new RuntimeException(e);
-    }
+    ByteList bytes = arg.convertToString().getByteList();
+    inboundNetData.put(bytes.unsafeBytes(), bytes.getBegin(), bytes.getRealSize());
+    return this;
   }
 
   private enum SSLOperation {
@@ -257,7 +341,7 @@ public class MiniSSL extends RubyObject {
           res = engine.unwrap(src.getRawBuffer(), dst.getRawBuffer());
           break;
         default:
-          throw new IllegalStateException("Unknown SSLOperation: " + sslOp);
+          throw new AssertionError("Unknown SSLOperation: " + sslOp);
       }
 
       switch (res.getStatus()) {
@@ -285,19 +369,11 @@ public class MiniSSL extends RubyObject {
       }
     }
 
-    // after each op, run any delegated tasks if needed
-    if(res.getHandshakeStatus() == HandshakeStatus.NEED_TASK) {
-      Runnable runnable;
-      while ((runnable = engine.getDelegatedTask()) != null) {
-        runnable.run();
-      }
-    }
-
     return res;
   }
 
   @JRubyMethod
-  public IRubyObject read() throws Exception {
+  public IRubyObject read() {
     try {
       inboundNetData.flip();
 
@@ -310,11 +386,12 @@ public class MiniSSL extends RubyObject {
 
       HandshakeStatus handshakeStatus = engine.getHandshakeStatus();
       boolean done = false;
-      SSLEngineResult res = null;
       while (!done) {
+        SSLEngineResult res;
         switch (handshakeStatus) {
           case NEED_WRAP:
             res = doOp(SSLOperation.WRAP, inboundAppData, outboundNetData);
+            handshakeStatus = res.getHandshakeStatus();
             break;
           case NEED_UNWRAP:
             res = doOp(SSLOperation.UNWRAP, inboundNetData, inboundAppData);
@@ -322,13 +399,18 @@ public class MiniSSL extends RubyObject {
               // need more data before we can shake more hands
               done = true;
             }
+            handshakeStatus = res.getHandshakeStatus();
+            break;
+          case NEED_TASK:
+            Runnable runnable;
+            while ((runnable = engine.getDelegatedTask()) != null) {
+              runnable.run();
+            }
+            handshakeStatus = engine.getHandshakeStatus();
             break;
           default:
             done = true;
         }
-        if (!done) {
-          handshakeStatus = res.getHandshakeStatus();
-        }
       }
 
       if (inboundNetData.hasRemaining()) {
@@ -342,65 +424,54 @@ public class MiniSSL extends RubyObject {
         return getRuntime().getNil();
       }
 
-      RubyString str = getRuntime().newString("");
-      str.setValue(appDataByteList);
-      return str;
-    } catch (Exception e) {
-      throw getRuntime().newEOFError(e.getMessage());
+      return RubyString.newString(getRuntime(), appDataByteList);
+    } catch (SSLException e) {
+      throw newSSLError(getRuntime(), e);
     }
   }
 
   @JRubyMethod
   public IRubyObject write(IRubyObject arg) {
-    try {
-      byte[] bls = arg.convertToString().getBytes();
-      outboundAppData = new MiniSSLBuffer(bls);
+    byte[] bls = arg.convertToString().getBytes();
+    outboundAppData = new MiniSSLBuffer(bls);
 
-      return getRuntime().newFixnum(bls.length);
-    } catch (Exception e) {
-      e.printStackTrace();
-      throw new RuntimeException(e);
-    }
+    return getRuntime().newFixnum(bls.length);
   }
 
   @JRubyMethod
-  public IRubyObject extract() throws SSLException {
+  public IRubyObject extract(ThreadContext context) {
     try {
       ByteList dataByteList = outboundNetData.asByteList();
       if (dataByteList != null) {
-        RubyString str = getRuntime().newString("");
-        str.setValue(dataByteList);
-        return str;
+        return RubyString.newString(context.runtime, dataByteList);
       }
 
       if (!outboundAppData.hasRemaining()) {
-        return getRuntime().getNil();
+        return context.nil;
       }
 
       outboundNetData.clear();
       doOp(SSLOperation.WRAP, outboundAppData, outboundNetData);
       dataByteList = outboundNetData.asByteList();
       if (dataByteList == null) {
-        return getRuntime().getNil();
+        return context.nil;
       }
 
-      RubyString str = getRuntime().newString("");
-      str.setValue(dataByteList);
-
-      return str;
-    } catch (Exception e) {
-      e.printStackTrace();
-      throw new RuntimeException(e);
+      return RubyString.newString(context.runtime, dataByteList);
+    } catch (SSLException e) {
+      throw newSSLError(getRuntime(), e);
     }
   }
 
   @JRubyMethod
-  public IRubyObject peercert() throws CertificateEncodingException {
+  public IRubyObject peercert(ThreadContext context) throws CertificateEncodingException {
+    Certificate peerCert;
     try {
-      return JavaEmbedUtils.javaToRuby(getRuntime(), engine.getSession().getPeerCertificates()[0].getEncoded());
-    } catch (SSLPeerUnverifiedException ex) {
-      return getRuntime().getNil();
+      peerCert = engine.getSession().getPeerCertificates()[0];
+    } catch (SSLPeerUnverifiedException e) {
+      peerCert = lastCheckedCert0; // null if trust check did not happen
     }
+    return peerCert == null ? context.nil : JavaEmbedUtils.javaToRuby(context.runtime, peerCert.getEncoded());
   }
 
   @JRubyMethod(name = "init?")
@@ -419,4 +490,19 @@ public class MiniSSL extends RubyObject {
       return getRuntime().getFalse();
     }
   }
+
+  private static RubyClass getSSLError(Ruby runtime) {
+    return (RubyClass) ((RubyModule) runtime.getModule("Puma").getConstantAt("MiniSSL")).getConstantAt("SSLError");
+  }
+
+  private static RaiseException newSSLError(Ruby runtime, SSLException cause) {
+    return newError(runtime, getSSLError(runtime), cause.toString(), cause);
+  }
+
+  private static RaiseException newError(Ruby runtime, RubyClass errorClass, String message, Throwable cause) {
+    RaiseException ex = new RaiseException(runtime, errorClass, message, true);
+    ex.initCause(cause);
+    return ex;
+  }
+
 }