puma 5.6.9 → 6.0.0

data/ext/puma_http11/http11_parser.c

@@ -297,7 +297,7 @@ case 13:
 tr18:
 #line 65 "ext/puma_http11/http11_parser.rl"
 	{
-    parser->http_version(parser, PTR_TO(mark), LEN(mark, p));
+    parser->server_protocol(parser, PTR_TO(mark), LEN(mark, p));
   }
 	goto st14;
 tr26:

data/ext/puma_http11/http11_parser.h

@@ -46,7 +46,7 @@ typedef struct puma_parser {
   element_cb fragment;
   element_cb request_path;
   element_cb query_string;
-  element_cb http_version;
+  element_cb server_protocol;
   element_cb header_done;
 
   char buf[BUFFER_LEN];

data/ext/puma_http11/http11_parser.java.rl

@@ -39,8 +39,8 @@ public class Http11Parser {
     Http11.query_string(runtime, parser.data, parser.buffer, parser.query_start, fpc-parser.query_start);
   }
 
-  action http_version {
-    Http11.http_version(runtime, parser.data, parser.buffer, parser.mark, fpc-parser.mark);
+  action server_protocol {
+    Http11.server_protocol(runtime, parser.data, parser.buffer, parser.mark, fpc-parser.mark);
   }
 
   action request_path {

data/ext/puma_http11/http11_parser.rl

@@ -62,8 +62,8 @@ static void snake_upcase_char(char *c)
     parser->query_string(parser, PTR_TO(query_start), LEN(query_start, fpc));
   }
 
-  action http_version {
-    parser->http_version(parser, PTR_TO(mark), LEN(mark, fpc));
+  action server_protocol {
+    parser->server_protocol(parser, PTR_TO(mark), LEN(mark, fpc));
   }
 
   action request_path {

data/ext/puma_http11/http11_parser_common.rl

@@ -38,8 +38,8 @@
   Method = ( upper | digit | safe ){1,20} >mark %request_method;
 
   http_number = ( digit+ "." digit+ ) ;
-  HTTP_Version = ( "HTTP/" http_number ) >mark %http_version ;
-  Request_Line = ( Method " " Request_URI ("#" Fragment){0,1} " " HTTP_Version CRLF ) ;
+  Server_Protocol = ( "HTTP/" http_number ) >mark %server_protocol ;
+  Request_Line = ( Method " " Request_URI ("#" Fragment){0,1} " " Server_Protocol CRLF ) ;
 
   field_name = ( token -- ":" )+ >start_field $snake_upcase_field %write_field;
 

data/ext/puma_http11/mini_ssl.c

@@ -210,25 +210,28 @@ sslctx_alloc(VALUE klass) {
 VALUE
 sslctx_initialize(VALUE self, VALUE mini_ssl_ctx) {
   SSL_CTX* ctx;
-
-#ifdef HAVE_SSL_CTX_SET_MIN_PROTO_VERSION
-  int min;
-#endif
   int ssl_options;
   VALUE key, cert, ca, verify_mode, ssl_cipher_filter, no_tlsv1, no_tlsv1_1,
     verification_flags, session_id_bytes, cert_pem, key_pem;
-#ifndef HAVE_SSL_CTX_SET_DH_AUTO
-  DH *dh;
-#endif
   BIO *bio;
   X509 *x509;
   EVP_PKEY *pkey;
-
+#ifdef HAVE_SSL_CTX_SET_MIN_PROTO_VERSION
+  int min;
+#endif
+#ifndef HAVE_SSL_CTX_SET_DH_AUTO
+  DH *dh;
+#endif
 #if OPENSSL_VERSION_NUMBER < 0x10002000L
   EC_KEY *ecdh;
 #endif
+#ifdef HAVE_SSL_CTX_SET_SESSION_CACHE_MODE
+  VALUE reuse, reuse_cache_size, reuse_timeout;
 
-  TypedData_Get_Struct(self, SSL_CTX, &sslctx_type, ctx);
+  reuse = rb_funcall(mini_ssl_ctx, rb_intern_const("reuse"), 0);
+  reuse_cache_size = rb_funcall(mini_ssl_ctx, rb_intern_const("reuse_cache_size"), 0);
+  reuse_timeout = rb_funcall(mini_ssl_ctx, rb_intern_const("reuse_timeout"), 0);
+#endif
 
   key = rb_funcall(mini_ssl_ctx, rb_intern_const("key"), 0);
 
@@ -248,6 +251,8 @@ sslctx_initialize(VALUE self, VALUE mini_ssl_ctx) {
 
   no_tlsv1_1 = rb_funcall(mini_ssl_ctx, rb_intern_const("no_tlsv1_1"), 0);
 
+  TypedData_Get_Struct(self, SSL_CTX, &sslctx_type, ctx);
+
   if (!NIL_P(cert)) {
     StringValue(cert);
 
@@ -270,8 +275,11 @@ sslctx_initialize(VALUE self, VALUE mini_ssl_ctx) {
     x509 = PEM_read_bio_X509(bio, NULL, NULL, NULL);
 
     if (SSL_CTX_use_certificate(ctx, x509) != 1) {
+      BIO_free(bio);
       raise_file_error("SSL_CTX_use_certificate", RSTRING_PTR(cert_pem));
     }
+    X509_free(x509);
+    BIO_free(bio);
   }
 
   if (!NIL_P(key_pem)) {
@@ -280,8 +288,11 @@ sslctx_initialize(VALUE self, VALUE mini_ssl_ctx) {
     pkey = PEM_read_bio_PrivateKey(bio, NULL, NULL, NULL);
 
     if (SSL_CTX_use_PrivateKey(ctx, pkey) != 1) {
+      BIO_free(bio);
       raise_file_error("SSL_CTX_use_PrivateKey", RSTRING_PTR(key_pem));
     }
+    EVP_PKEY_free(pkey);
+    BIO_free(bio);
   }
 
   verification_flags = rb_funcall(mini_ssl_ctx, rb_intern_const("verification_flags"), 0);
@@ -314,8 +325,6 @@ sslctx_initialize(VALUE self, VALUE mini_ssl_ctx) {
 
   SSL_CTX_set_min_proto_version(ctx, min);
 
-  SSL_CTX_set_options(ctx, ssl_options);
-
 #else
   /* As of 1.0.2f, SSL_OP_SINGLE_DH_USE key use is always on */
   ssl_options |= SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | SSL_OP_SINGLE_DH_USE;
@@ -326,10 +335,23 @@ sslctx_initialize(VALUE self, VALUE mini_ssl_ctx) {
   if(RTEST(no_tlsv1_1)) {
     ssl_options |= SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1;
   }
-  SSL_CTX_set_options(ctx, ssl_options);
 #endif
 
-  SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_OFF);
+#ifdef HAVE_SSL_CTX_SET_SESSION_CACHE_MODE
+  if (!NIL_P(reuse)) {
+    SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_SERVER);
+    if (!NIL_P(reuse_cache_size)) {
+      SSL_CTX_sess_set_cache_size(ctx, NUM2INT(reuse_cache_size));
+    }
+    if (!NIL_P(reuse_timeout)) {
+      SSL_CTX_set_timeout(ctx, NUM2INT(reuse_timeout));
+    }
+  } else {
+    SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_OFF);
+  }
+#endif
+
+  SSL_CTX_set_options(ctx, ssl_options);
 
   if (!NIL_P(ssl_cipher_filter)) {
     StringValue(ssl_cipher_filter);
@@ -340,8 +362,7 @@ sslctx_initialize(VALUE self, VALUE mini_ssl_ctx) {
   }
 
 #if OPENSSL_VERSION_NUMBER < 0x10002000L
-  // Remove this case if OpenSSL 1.0.1 (now EOL) support is no
-  // longer needed.
+  // Remove this case if OpenSSL 1.0.1 (now EOL) support is no longer needed.
   ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
   if (ecdh) {
     SSL_CTX_set_tmp_ecdh(ctx, ecdh);

data/ext/puma_http11/org/jruby/puma/Http11.java

@@ -46,7 +46,7 @@ public class Http11 extends RubyObject {
     public static final ByteList FRAGMENT_BYTELIST = new ByteList(ByteList.plain("FRAGMENT"));
     public static final ByteList REQUEST_PATH_BYTELIST = new ByteList(ByteList.plain("REQUEST_PATH"));
     public static final ByteList QUERY_STRING_BYTELIST = new ByteList(ByteList.plain("QUERY_STRING"));
-    public static final ByteList HTTP_VERSION_BYTELIST = new ByteList(ByteList.plain("HTTP_VERSION"));
+    public static final ByteList SERVER_PROTOCOL_BYTELIST = new ByteList(ByteList.plain("SERVER_PROTOCOL"));
 
     private static ObjectAllocator ALLOCATOR = new ObjectAllocator() {
         public IRubyObject allocate(Ruby runtime, RubyClass klass) {
@@ -99,8 +99,6 @@ public class Http11 extends RubyObject {
             int bite = b.get(i) & 0xFF;
             if(bite == '-') {
                 b.set(i, (byte)'_');
-            } else if(bite == '_') {
-                b.set(i, (byte)',');
             } else {
                 b.set(i, (byte)Character.toUpperCase(bite));
             }
@@ -155,9 +153,9 @@ public class Http11 extends RubyObject {
         req.fastASet(RubyString.newStringShared(runtime, QUERY_STRING_BYTELIST),val);
     }
 
-    public static void http_version(Ruby runtime, RubyHash req, ByteList buffer, int at, int length) {
+    public static void server_protocol(Ruby runtime, RubyHash req, ByteList buffer, int at, int length) {
         RubyString val = RubyString.newString(runtime,new ByteList(buffer,at,length));
-        req.fastASet(RubyString.newStringShared(runtime, HTTP_VERSION_BYTELIST),val);
+        req.fastASet(RubyString.newStringShared(runtime, SERVER_PROTOCOL_BYTELIST),val);
     }
 
     public void header_done(Ruby runtime, RubyHash req, ByteList buffer, int at, int length) {

data/ext/puma_http11/org/jruby/puma/Http11Parser.java

@@ -383,7 +383,7 @@ case 1:
 	case 11:
 // line 42 "ext/puma_http11/http11_parser.java.rl"
 	{
-    Http11.http_version(runtime, parser.data, parser.buffer, parser.mark, p-parser.mark);
+    Http11.server_protocol(runtime, parser.data, parser.buffer, parser.mark, p-parser.mark);
   }
 	break;
 	case 12:

data/ext/puma_http11/org/jruby/puma/MiniSSL.java

@@ -1,6 +1,7 @@
 package org.jruby.puma;
 
 import org.jruby.Ruby;
+import org.jruby.RubyArray;
 import org.jruby.RubyClass;
 import org.jruby.RubyModule;
 import org.jruby.RubyObject;
@@ -15,6 +16,7 @@ import org.jruby.runtime.builtin.IRubyObject;
 import org.jruby.util.ByteList;
 
 import javax.net.ssl.KeyManagerFactory;
+import javax.net.ssl.TrustManager;
 import javax.net.ssl.TrustManagerFactory;
 import javax.net.ssl.SSLContext;
 import javax.net.ssl.SSLEngine;
@@ -22,6 +24,7 @@ import javax.net.ssl.SSLEngineResult;
 import javax.net.ssl.SSLException;
 import javax.net.ssl.SSLPeerUnverifiedException;
 import javax.net.ssl.SSLSession;
+import javax.net.ssl.X509TrustManager;
 import java.io.FileInputStream;
 import java.io.InputStream;
 import java.io.IOException;
@@ -32,15 +35,18 @@ import java.security.KeyStore;
 import java.security.KeyStoreException;
 import java.security.NoSuchAlgorithmException;
 import java.security.UnrecoverableKeyException;
+import java.security.cert.Certificate;
 import java.security.cert.CertificateEncodingException;
 import java.security.cert.CertificateException;
+import java.security.cert.X509Certificate;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.Map;
+import java.util.function.Supplier;
 
 import static javax.net.ssl.SSLEngineResult.Status;
 import static javax.net.ssl.SSLEngineResult.HandshakeStatus;
 
-public class MiniSSL extends RubyObject {
+public class MiniSSL extends RubyObject { // MiniSSL::Engine
   private static ObjectAllocator ALLOCATOR = new ObjectAllocator() {
     public IRubyObject allocate(Ruby runtime, RubyClass klass) {
       return new MiniSSL(runtime, klass);
@@ -51,11 +57,10 @@ public class MiniSSL extends RubyObject {
     RubyModule mPuma = runtime.defineModule("Puma");
     RubyModule ssl = mPuma.defineModuleUnder("MiniSSL");
 
-    mPuma.defineClassUnder("SSLError",
-                           runtime.getClass("IOError"),
-                           runtime.getClass("IOError").getAllocator());
+    // Puma::MiniSSL::SSLError
+    ssl.defineClassUnder("SSLError", runtime.getStandardError(), runtime.getStandardError().getAllocator());
 
-    RubyClass eng = ssl.defineClassUnder("Engine",runtime.getObject(),ALLOCATOR);
+    RubyClass eng = ssl.defineClassUnder("Engine", runtime.getObject(), ALLOCATOR);
     eng.defineAnnotatedMethods(MiniSSL.class);
   }
 
@@ -137,74 +142,116 @@ public class MiniSSL extends RubyObject {
   private static Map<String, KeyManagerFactory> keyManagerFactoryMap = new ConcurrentHashMap<String, KeyManagerFactory>();
   private static Map<String, TrustManagerFactory> trustManagerFactoryMap = new ConcurrentHashMap<String, TrustManagerFactory>();
 
-  @JRubyMethod(meta = true)
+  @JRubyMethod(meta = true) // Engine.server
   public static synchronized IRubyObject server(ThreadContext context, IRubyObject recv, IRubyObject miniSSLContext)
       throws KeyStoreException, IOException, CertificateException, NoSuchAlgorithmException, UnrecoverableKeyException {
     // Create the KeyManagerFactory and TrustManagerFactory for this server
-    String keystoreFile = miniSSLContext.callMethod(context, "keystore").convertToString().asJavaString();
-    char[] password = miniSSLContext.callMethod(context, "keystore_pass").convertToString().asJavaString().toCharArray();
+    String keystoreFile = asStringValue(miniSSLContext.callMethod(context, "keystore"), null);
+    char[] keystorePass = asStringValue(miniSSLContext.callMethod(context, "keystore_pass"), null).toCharArray();
+    String keystoreType = asStringValue(miniSSLContext.callMethod(context, "keystore_type"), KeyStore::getDefaultType);
+
+    String truststoreFile;
+    char[] truststorePass;
+    String truststoreType;
+    IRubyObject truststore = miniSSLContext.callMethod(context, "truststore");
+    if (truststore.isNil()) {
+      truststoreFile = keystoreFile;
+      truststorePass = keystorePass;
+      truststoreType = keystoreType;
+    } else if (!isDefaultSymbol(context, truststore)) {
+      truststoreFile = truststore.convertToString().asJavaString();
+      IRubyObject pass = miniSSLContext.callMethod(context, "truststore_pass");
+      if (pass.isNil()) {
+        truststorePass = null;
+      } else {
+        truststorePass = asStringValue(pass, null).toCharArray();
+      }
+      truststoreType = asStringValue(miniSSLContext.callMethod(context, "truststore_type"), KeyStore::getDefaultType);
+    } else { // self.truststore = :default
+      truststoreFile = null;
+      truststorePass = null;
+      truststoreType = null;
+    }
 
-    KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
+    KeyStore ks = KeyStore.getInstance(keystoreType);
     InputStream is = new FileInputStream(keystoreFile);
     try {
-      ks.load(is, password);
+      ks.load(is, keystorePass);
     } finally {
       is.close();
     }
     KeyManagerFactory kmf = KeyManagerFactory.getInstance("SunX509");
-    kmf.init(ks, password);
+    kmf.init(ks, keystorePass);
     keyManagerFactoryMap.put(keystoreFile, kmf);
 
-    KeyStore ts = KeyStore.getInstance(KeyStore.getDefaultType());
-    is = new FileInputStream(keystoreFile);
-    try {
-      ts.load(is, password);
-    } finally {
-      is.close();
+    if (truststoreFile != null) {
+      KeyStore ts = KeyStore.getInstance(truststoreType);
+      is = new FileInputStream(truststoreFile);
+      try {
+        ts.load(is, truststorePass);
+      } finally {
+        is.close();
+      }
+      TrustManagerFactory tmf = TrustManagerFactory.getInstance("SunX509");
+      tmf.init(ts);
+      trustManagerFactoryMap.put(truststoreFile, tmf);
     }
-    TrustManagerFactory tmf = TrustManagerFactory.getInstance("SunX509");
-    tmf.init(ts);
-    trustManagerFactoryMap.put(keystoreFile, tmf);
 
     RubyClass klass = (RubyClass) recv;
-    return klass.newInstance(context,
-        new IRubyObject[] { miniSSLContext },
-        Block.NULL_BLOCK);
+    return klass.newInstance(context, miniSSLContext, Block.NULL_BLOCK);
+  }
+
+  private static String asStringValue(IRubyObject value, Supplier<String> defaultValue) {
+    if (defaultValue != null && value.isNil()) return defaultValue.get();
+    return value.convertToString().asJavaString();
+  }
+
+  private static boolean isDefaultSymbol(ThreadContext context, IRubyObject truststore) {
+    return context.runtime.newSymbol("default").equals(truststore);
   }
 
   @JRubyMethod
-  public IRubyObject initialize(ThreadContext threadContext, IRubyObject miniSSLContext)
+  public IRubyObject initialize(ThreadContext context, IRubyObject miniSSLContext)
       throws KeyStoreException, NoSuchAlgorithmException, KeyManagementException {
 
-    String keystoreFile = miniSSLContext.callMethod(threadContext, "keystore").convertToString().asJavaString();
+    String keystoreFile = miniSSLContext.callMethod(context, "keystore").convertToString().asJavaString();
     KeyManagerFactory kmf = keyManagerFactoryMap.get(keystoreFile);
-    TrustManagerFactory tmf = trustManagerFactoryMap.get(keystoreFile);
-    if(kmf == null || tmf == null) {
-      throw new KeyStoreException("Could not find KeyManagerFactory/TrustManagerFactory for keystore: " + keystoreFile);
+    IRubyObject truststore = miniSSLContext.callMethod(context, "truststore");
+    String truststoreFile = isDefaultSymbol(context, truststore) ? "" : asStringValue(truststore, () -> keystoreFile);
+    TrustManagerFactory tmf = trustManagerFactoryMap.get(truststoreFile); // null if self.truststore = :default
+    if (kmf == null) {
+      throw new KeyStoreException("Could not find KeyManagerFactory for keystore: " + keystoreFile + " truststore: " + truststoreFile);
     }
 
     SSLContext sslCtx = SSLContext.getInstance("TLS");
 
-    sslCtx.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);
+    sslCtx.init(kmf.getKeyManagers(), getTrustManagers(tmf), null);
     closed = false;
     handshake = false;
     engine = sslCtx.createSSLEngine();
 
-    String[] protocols;
-    if(miniSSLContext.callMethod(threadContext, "no_tlsv1").isTrue()) {
-        protocols = new String[] { "TLSv1.1", "TLSv1.2" };
-    } else {
-        protocols = new String[] { "TLSv1", "TLSv1.1", "TLSv1.2" };
-    }
+    String[] enabledProtocols;
+    IRubyObject protocols = miniSSLContext.callMethod(context, "protocols");
+    if (protocols.isNil()) {
+      if (miniSSLContext.callMethod(context, "no_tlsv1").isTrue()) {
+        enabledProtocols = new String[] { "TLSv1.1", "TLSv1.2", "TLSv1.3" };
+      } else {
+        enabledProtocols = new String[] { "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" };
+      }
 
-    if(miniSSLContext.callMethod(threadContext, "no_tlsv1_1").isTrue()) {
-        protocols = new String[] { "TLSv1.2" };
+      if (miniSSLContext.callMethod(context, "no_tlsv1_1").isTrue()) {
+        enabledProtocols = new String[] { "TLSv1.2", "TLSv1.3" };
+      }
+    } else if (protocols instanceof RubyArray) {
+      enabledProtocols = (String[]) ((RubyArray) protocols).toArray(new String[0]);
+    } else {
+      throw context.runtime.newTypeError(protocols, context.runtime.getArray());
     }
+    engine.setEnabledProtocols(enabledProtocols);
 
-    engine.setEnabledProtocols(protocols);
     engine.setUseClientMode(false);
 
-    long verify_mode = miniSSLContext.callMethod(threadContext, "verify_mode").convertToInteger("to_i").getLongValue();
+    long verify_mode = miniSSLContext.callMethod(context, "verify_mode").convertToInteger("to_i").getLongValue();
     if ((verify_mode & 0x1) != 0) { // 'peer'
         engine.setWantClientAuth(true);
     }
@@ -212,10 +259,11 @@ public class MiniSSL extends RubyObject {
         engine.setNeedClientAuth(true);
     }
 
-    IRubyObject sslCipherListObject = miniSSLContext.callMethod(threadContext, "ssl_cipher_list");
-    if (!sslCipherListObject.isNil()) {
-      String[] sslCipherList = sslCipherListObject.convertToString().asJavaString().split(",");
-      engine.setEnabledCipherSuites(sslCipherList);
+    IRubyObject cipher_suites = miniSSLContext.callMethod(context, "cipher_suites");
+    if (cipher_suites instanceof RubyArray) {
+      engine.setEnabledCipherSuites((String[]) ((RubyArray) cipher_suites).toArray(new String[0]));
+    } else if (!cipher_suites.isNil()) {
+      throw context.runtime.newTypeError(cipher_suites, context.runtime.getArray());
     }
 
     SSLSession session = engine.getSession();
@@ -227,6 +275,48 @@ public class MiniSSL extends RubyObject {
     return this;
   }
 
+  private TrustManager[] getTrustManagers(TrustManagerFactory factory) {
+    if (factory == null) return null; // use JDK trust defaults
+    final TrustManager[] tms = factory.getTrustManagers();
+    if (tms != null) {
+      for (int i=0; i<tms.length; i++) {
+        final TrustManager tm = tms[i];
+        if (tm instanceof X509TrustManager) {
+          tms[i] = new TrustManagerWrapper((X509TrustManager) tm);
+        }
+      }
+    }
+    return tms;
+  }
+
+  private volatile transient X509Certificate lastCheckedCert0;
+
+  private class TrustManagerWrapper implements X509TrustManager {
+
+    private final X509TrustManager delegate;
+
+    TrustManagerWrapper(X509TrustManager delegate) {
+      this.delegate = delegate;
+    }
+
+    @Override
+    public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {
+      lastCheckedCert0 = chain.length > 0 ? chain[0] : null;
+      delegate.checkClientTrusted(chain, authType);
+    }
+
+    @Override
+    public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {
+      delegate.checkServerTrusted(chain, authType);
+    }
+
+    @Override
+    public X509Certificate[] getAcceptedIssuers() {
+      return delegate.getAcceptedIssuers();
+    }
+
+  }
+
   @JRubyMethod
   public IRubyObject inject(IRubyObject arg) {
     ByteList bytes = arg.convertToString().getByteList();
@@ -251,7 +341,7 @@ public class MiniSSL extends RubyObject {
           res = engine.unwrap(src.getRawBuffer(), dst.getRawBuffer());
           break;
         default:
-          throw new IllegalStateException("Unknown SSLOperation: " + sslOp);
+          throw new AssertionError("Unknown SSLOperation: " + sslOp);
       }
 
       switch (res.getStatus()) {
@@ -336,9 +426,7 @@ public class MiniSSL extends RubyObject {
 
       return RubyString.newString(getRuntime(), appDataByteList);
     } catch (SSLException e) {
-      RaiseException re = getRuntime().newEOFError(e.getMessage());
-      re.initCause(e);
-      throw re;
+      throw newSSLError(getRuntime(), e);
     }
   }
 
@@ -371,19 +459,19 @@ public class MiniSSL extends RubyObject {
 
       return RubyString.newString(context.runtime, dataByteList);
     } catch (SSLException e) {
-      RaiseException ex = context.runtime.newRuntimeError(e.toString());
-      ex.initCause(e);
-      throw ex;
+      throw newSSLError(getRuntime(), e);
     }
   }
 
   @JRubyMethod
-  public IRubyObject peercert() throws CertificateEncodingException {
+  public IRubyObject peercert(ThreadContext context) throws CertificateEncodingException {
+    Certificate peerCert;
     try {
-      return JavaEmbedUtils.javaToRuby(getRuntime(), engine.getSession().getPeerCertificates()[0].getEncoded());
+      peerCert = engine.getSession().getPeerCertificates()[0];
     } catch (SSLPeerUnverifiedException e) {
-      return getRuntime().getNil();
+      peerCert = lastCheckedCert0; // null if trust check did not happen
     }
+    return peerCert == null ? context.nil : JavaEmbedUtils.javaToRuby(context.runtime, peerCert.getEncoded());
   }
 
   @JRubyMethod(name = "init?")
@@ -402,4 +490,19 @@ public class MiniSSL extends RubyObject {
       return getRuntime().getFalse();
     }
   }
+
+  private static RubyClass getSSLError(Ruby runtime) {
+    return (RubyClass) ((RubyModule) runtime.getModule("Puma").getConstantAt("MiniSSL")).getConstantAt("SSLError");
+  }
+
+  private static RaiseException newSSLError(Ruby runtime, SSLException cause) {
+    return newError(runtime, getSSLError(runtime), cause.toString(), cause);
+  }
+
+  private static RaiseException newError(Ruby runtime, RubyClass errorClass, String message, Throwable cause) {
+    RaiseException ex = new RaiseException(runtime, errorClass, message, true);
+    ex.initCause(cause);
+    return ex;
+  }
+
 }

data/ext/puma_http11/puma_http11.c

@@ -36,13 +36,13 @@ static VALUE global_request_method;
 static VALUE global_request_uri;
 static VALUE global_fragment;
 static VALUE global_query_string;
-static VALUE global_http_version;
+static VALUE global_server_protocol;
 static VALUE global_request_path;
 
 /** Defines common length and error messages for input length validation. */
 #define QUOTE(s) #s
-#define EXPLAIN_MAX_LENGTH_VALUE(s) QUOTE(s)
-#define DEF_MAX_LENGTH(N,length) const size_t MAX_##N##_LENGTH = length; const char *MAX_##N##_LENGTH_ERR = "HTTP element " # N  " is longer than the " EXPLAIN_MAX_LENGTH_VALUE(length) " allowed length (was %d)"
+#define EXPAND_MAX_LENGTH_VALUE(s) QUOTE(s)
+#define DEF_MAX_LENGTH(N,length) const size_t MAX_##N##_LENGTH = length; const char *MAX_##N##_LENGTH_ERR = "HTTP element " # N  " is longer than the " EXPAND_MAX_LENGTH_VALUE(length) " allowed length (was %d)"
 
 /** Validates the max length of given input and throws an HttpParserError exception if over. */
 #define VALIDATE_MAX_LENGTH(len, N) if(len > MAX_##N##_LENGTH) { rb_raise(eHttpParserError, MAX_##N##_LENGTH_ERR, len); }
@@ -52,15 +52,23 @@ static VALUE global_request_path;
 
 
 /* Defines the maximum allowed lengths for various input elements.*/
+#ifndef PUMA_REQUEST_URI_MAX_LENGTH
+#define PUMA_REQUEST_URI_MAX_LENGTH (1024 * 12)
+#endif
+
+#ifndef PUMA_REQUEST_PATH_MAX_LENGTH
+#define PUMA_REQUEST_PATH_MAX_LENGTH (8192)
+#endif
+
 #ifndef PUMA_QUERY_STRING_MAX_LENGTH
 #define PUMA_QUERY_STRING_MAX_LENGTH (1024 * 10)
 #endif
 
 DEF_MAX_LENGTH(FIELD_NAME, 256);
 DEF_MAX_LENGTH(FIELD_VALUE, 80 * 1024);
-DEF_MAX_LENGTH(REQUEST_URI, 1024 * 12);
+DEF_MAX_LENGTH(REQUEST_URI, PUMA_REQUEST_URI_MAX_LENGTH);
 DEF_MAX_LENGTH(FRAGMENT, 1024); /* Don't know if this length is specified somewhere or not */
-DEF_MAX_LENGTH(REQUEST_PATH, 8192);
+DEF_MAX_LENGTH(REQUEST_PATH, PUMA_REQUEST_PATH_MAX_LENGTH);
 DEF_MAX_LENGTH(QUERY_STRING, PUMA_QUERY_STRING_MAX_LENGTH);
 DEF_MAX_LENGTH(HEADER, (1024 * (80 + 32)));
 
@@ -236,10 +244,10 @@ void query_string(puma_parser* hp, const char *at, size_t length)
   rb_hash_aset(hp->request, global_query_string, val);
 }
 
-void http_version(puma_parser* hp, const char *at, size_t length)
+void server_protocol(puma_parser* hp, const char *at, size_t length)
 {
   VALUE val = rb_str_new(at, length);
-  rb_hash_aset(hp->request, global_http_version, val);
+  rb_hash_aset(hp->request, global_server_protocol, val);
 }
 
 /** Finalizes the request header to have a bunch of stuff that's
@@ -281,7 +289,7 @@ VALUE HttpParser_alloc(VALUE klass)
   hp->fragment = fragment;
   hp->request_path = request_path;
   hp->query_string = query_string;
-  hp->http_version = http_version;
+  hp->server_protocol = server_protocol;
   hp->header_done = header_done;
   hp->request = Qnil;
 
@@ -461,7 +469,7 @@ void Init_puma_http11(void)
   DEF_GLOBAL(request_uri, "REQUEST_URI");
   DEF_GLOBAL(fragment, "FRAGMENT");
   DEF_GLOBAL(query_string, "QUERY_STRING");
-  DEF_GLOBAL(http_version, "HTTP_VERSION");
+  DEF_GLOBAL(server_protocol, "SERVER_PROTOCOL");
   DEF_GLOBAL(request_path, "REQUEST_PATH");
 
   eHttpParserError = rb_define_class_under(mPuma, "HttpParserError", rb_eIOError);

data/lib/puma/app/status.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-require 'puma/json_serialization'
+require_relative '../json_serialization'
 
 module Puma
   module App
@@ -85,8 +85,8 @@ module Puma
 
       def rack_response(status, body, content_type='application/json')
         headers = {
-          'Content-Type' => content_type,
-          'Content-Length' => body.bytesize.to_s
+          'content-type' => content_type,
+          'content-length' => body.bytesize.to_s
         }
 
         [status, headers, [body]]