jruby · Aug 20, 2015 · Aug 20, 2015 · Aug 20, 2015
Showing with 7 additions and 79 deletions.

+1 −1 pom.xml

+1 −1 src/main/java/org/jruby/ext/openssl/OpenSSL.java

+0 −22 src/main/java/org/jruby/ext/openssl/x509store/Lookup.java

+5 −55 src/main/java/org/jruby/ext/openssl/x509store/X509Utils.java
diff --git a/pom.xml b/pom.xml
@@ -4,7 +4,7 @@
   <modelVersion>4.0.0</modelVersion>
   <groupId>rubygems</groupId>
   <artifactId>jruby-openssl</artifactId>
-  <version>0.9.9</version>
+  <version>0.9.10</version>
   <packaging>gem</packaging>
   <name>JRuby OpenSSL</name>
   <description>JRuby-OpenSSL is an add-on gem for JRuby that emulates the Ruby OpenSSL native library.</description>

diff --git a/src/main/java/org/jruby/ext/openssl/OpenSSL.java b/src/main/java/org/jruby/ext/openssl/OpenSSL.java
@@ -205,7 +205,7 @@ static boolean isDebug(final Ruby runtime) {
         return getDebug( OpenSSL ) == runtime.getTrue();
     }
 
-    public static void debugStackTrace(final Ruby runtime, final Throwable e) {
+    static void debugStackTrace(final Ruby runtime, final Throwable e) {
         if ( isDebug(runtime) ) e.printStackTrace(runtime.getOut());
     }
 

diff --git a/src/main/java/org/jruby/ext/openssl/x509store/Lookup.java b/src/main/java/org/jruby/ext/openssl/x509store/Lookup.java
@@ -27,9 +27,6 @@
  ***** END LICENSE BLOCK *****/
 package org.jruby.ext.openssl.x509store;
 
-
-import static org.jruby.ext.openssl.OpenSSL.debugStackTrace;
-
 import org.jruby.ext.openssl.util.Cache;
 import static org.jruby.ext.openssl.x509store.X509Utils.X509_CERT_DIR;
 import static org.jruby.ext.openssl.x509store.X509Utils.X509_FILETYPE_ASN1;
@@ -242,10 +239,6 @@ else if ( type == X509_FILETYPE_ASN1 ) {
                 return 0; // NOTE: really?
             }
         }
-        catch(IOException e) {
-            debugStackTrace(runtime, e);
-            return 0;
-        }
         finally {
             if ( reader != null ) {
                 try { reader.close(); } catch (Exception ignored) {}
@@ -292,10 +285,6 @@ else if ( type == X509_FILETYPE_ASN1 ) {
                 return 0; // NOTE: really?
             }
         }
-        catch(IOException e) {
-            debugStackTrace(runtime, e);
-            return 0;
-        }
         finally {
             if ( reader != null ) {
                 try { reader.close(); } catch (Exception ignored) {}
@@ -356,10 +345,6 @@ else if ( cert instanceof CRL ) {
             }
             return count;
         }
-        catch(IOException e) {
-            debugStackTrace(runtime, e);
-            return 0;
-        }
         finally {
             if ( reader != null ) {
                 try { reader.close(); } catch (Exception ignored) {}
@@ -382,9 +367,6 @@ public int loadDefaultJavaCACertsFile() throws IOException, GeneralSecurityExcep
                 count++;
             }
         }
-        catch(IOException e) {
-            return 0;
-        }
         finally {
             try { fin.close(); } catch (Exception ignored) {}
         }
@@ -540,10 +522,6 @@ public int call(final Lookup ctx, final Integer cmd, final String argp, final Nu
                         ok = ctx.loadCertificateOrCRLFile(file, X509_FILETYPE_PEM) != 0 ? 1 : 0;
                     } else {
                         ok = (ctx.loadDefaultJavaCACertsFile() != 0) ? 1: 0;
-                        // it could be a PEM file
-                        if (ok == 0) {
-                            ok = ctx.loadCertificateOrCRLFile(file, X509_FILETYPE_PEM) != 0 ? 1 : 0;
-                        }
                     }
                     if (ok == 0) {
                         X509Error.addError(X509_R_LOADING_DEFAULTS);

diff --git a/src/main/java/org/jruby/ext/openssl/x509store/X509Utils.java b/src/main/java/org/jruby/ext/openssl/x509store/X509Utils.java
@@ -28,7 +28,6 @@
 package org.jruby.ext.openssl.x509store;
 
 
-import java.io.File;
 import java.io.IOException;
 import java.math.BigInteger;
 import java.util.Arrays;
@@ -293,62 +292,13 @@ else if ( keyUsage != null && ! keyUsage[5] ) { // KU_KEY_CERT_SIGN
     public static final String X509_PRIVATE_DIR;
 
     static {
-        // roughly following the ideas from https://www.happyassassin.net/2015/01/12/a-note-about-ssltls-trusted-certificate-stores-and-platforms/
-        // and falling back to trust store from java to be on the save side
-
+        OPENSSLDIR = "/usr/local/openssl"; // NOTE: blindly follow?!
         // TODO usability in limited environments should be tested/reviewed
         final String JAVA_HOME = SafePropertyAccessor.getProperty("java.home", "");
-
-        // if the default files/dirs exist we use them. with this a switch
-        // from MRI to JRuby produces the same results. otherwise we use the
-        // certs from JAVA_HOME.
-        final String LINUX_CERT_AREA = "/etc/ssl";
-        final String MACOS_CERT_AREA = "/System/Library/OpenSSL";
-
-        String certArea, certDir, privateDir;
-        String maybeCertFile;
-        String maybePkiCertFile = "/etc/pki/tls/certs/ca-bundle.crt";
-        try {
-            if (new File(LINUX_CERT_AREA).exists()) {
-                certArea = LINUX_CERT_AREA;
-                certDir = certArea + "/certs";
-                privateDir = certArea + "/private";
-                maybeCertFile = certDir + "/cert.pem";
-            }
-            else if (new File(MACOS_CERT_AREA).exists()) {
-                certArea = MACOS_CERT_AREA;
-                certDir = certArea + "/certs";
-                privateDir = certArea + "/private";
-                maybeCertFile = certArea + "/cert.pem";
-            }
-            else {
-                certArea = JAVA_HOME + "/lib/security";
-                certDir = certArea;
-                privateDir = certArea;
-                maybeCertFile = maybePkiCertFile;
-            }
-        }
-        catch (SecurityException e) {
-            maybeCertFile = null; maybePkiCertFile = null;
-            privateDir = certDir = certArea = JAVA_HOME + "/lib/security";
-        }
-
-        X509_CERT_AREA = certArea;
-        X509_CERT_DIR = certDir;
-        X509_PRIVATE_DIR = privateDir;
-
-        if (maybePkiCertFile != null && new File(maybePkiCertFile).exists()) {
-            X509_CERT_FILE = maybePkiCertFile;
-        }
-        else if (maybeCertFile != null && new File(maybeCertFile).exists()) {
-            X509_CERT_FILE = maybeCertFile;
-        }
-        else {
-            X509_CERT_FILE = JAVA_HOME + "/lib/security/cacerts";
-        }
-
-        // keep it with some meaninful content as it is a public constant
-        OPENSSLDIR = X509_CERT_AREA;
+        X509_CERT_AREA = JAVA_HOME + "/lib/security";
+        X509_CERT_DIR = X509_CERT_AREA;
+        X509_CERT_FILE = X509_CERT_DIR + "/cacerts";
+        X509_PRIVATE_DIR = "/usr/lib/ssl/private"; // NOTE: blindly follow?!
     }
 
     public static final String X509_CERT_DIR_EVP = "SSL_CERT_DIR";