From 4ae0de4f4cc06f09c9c269f42070b7a88beec4dc Mon Sep 17 00:00:00 2001 From: joe miller Date: Sat, 28 Nov 2015 18:17:01 -0800 Subject: [PATCH] support TLS client auth (verify_mode) in jruby Adds support for `verify_mode` to configure client authentication when running under JRuby. Things to note: - Assumes the CA used to verify client certs is in the same java keystore file that is used when setting up the HTTPS TLS listener. We could split this out, but not sure if it's necessary. - Friendly/helpful error messages explaining why the verification failed are not present in the same way they are in the CRuby/OpenSSL code path. I'm not sure how to make them available. - I did not include any code to create the `keystore.jks` file in the `examples/puma/client-certs` directory because I didn't see any existing code to create the `examples/puma/keystore.jks` file. The commands to create this keystore would be: ``` cd examples/puma/client-certs openssl pkcs12 -chain -CAfile ./ca.crt -export -password pass:blahblah -inkey server.key -in server.crt -name server -out server.p12 keytool -importkeystore -srckeystore server.p12 -srcstoretype pkcs12 -srcstorepass blahblah -destkeystore keystore.jks -deststoretype JKS -storepass blahblah keytool -importcert -alias ca -noprompt -trustcacerts -file ca.crt -keystore keystore.jks -storepass blahblah ``` --- examples/puma/client-certs/keystore.jks | Bin 0 -> 3743 bytes examples/puma/client-certs/server.p12 | Bin 0 -> 3274 bytes ext/puma_http11/org/jruby/puma/MiniSSL.java | 20 ++- test/test_puma_server_ssl.rb | 129 +++++++++++--------- 4 files changed, 85 insertions(+), 64 deletions(-) create mode 100644 examples/puma/client-certs/keystore.jks create mode 100644 examples/puma/client-certs/server.p12 diff --git a/examples/puma/client-certs/keystore.jks b/examples/puma/client-certs/keystore.jks new file mode 100644 index 0000000000000000000000000000000000000000..6d734fadce1949b3b47e36b62749ca612fbaddf6 GIT binary patch literal 3743 zcmeH}XHXN^8ivydy@gN&q?brdLRX4{AP9sW0Yi{}K}C8~KtMwYZ9$sS6A)C2F@gw4 zmL^4zqJly|qzD4)D!txpnVsF8x%bYU{kwDK%$fOqob#Rcop-+HVD(@X004k~-yjb+ z003xXg(5-#OpYoVNF4wG3`fR;d64nItx_-u2m%3tNKPoL0>PB9$q589F#(X;C_W@F zl#Mk@E;;*~k|*$p0NCFv1O-RJ{#1kngkE+-u_IZbUrAljYgp~kSL_iZ-u{ccRWz)kBtJE0N{8aH-PaGHc&he2%xKc-@+ehLcozL&+nIq zU=k3!vl82Hb#cQiy=o7}S)%G@u7Q*#GPy>s2ze{c+4$U;T8>Dj61V2z!|T%CY7@84v-aheDCv_=hLXuljd{usk0ec9L?f zxBBz}jWaUwMzwcj7>=wRf}8{gR4|zh>-ZBI8K#!gv|XHqza6a!ls>gnFq1<4?9qlG z--)`d{`p`Q&4)1!-?QiSveNCI11@ys2#i#*oUZ&jkp>a_AprWcbaH5eTRv_!KXjvYK!7S`RtNVvpmuQ>MMQZ@Z{l<$ZA^ z97EV=gf=@LR&iU^1lCIap^Gifr(88fy%L3T#QoF7=lG^-H@b+-AY-UL-V z&d;<9D=csutNf~y+VmiDqm&|ivL;s4MeFtk>ZaDp?9&tV?uvtvYj@!YA@EF@MEAHI zm)Q&5o26f?wYcc%I}ll7L_{e0<9)Y%BH1YTduNe}^h-%hk%W@lU>)#!trQbauQ-2qbI4d4a|bnVv(hbu%!7kT|$ALgt=D z;2t&v&p)CiMy5Ylu5qTnL#b5Lhtd+*I1t1PEiT6tbMZ@>=8_Z@EJMn@vE9ykv8`ry1mY3nu$-{ zd}KzM4X5VZdzGfNEwf51d_MWH>#@PEzqT{9=s?DdHoj|Q?&%yyzjlmYapOr-@tz^y zV(D9K_)g#^h}a}5t*)*rHpuK-+SlaUtUG;F9`>k_A;GwU{YAZ5wAx7D;YCEg>$R6- z%;>lG6B0COy(!PfLiEX(v@kqP!g|)b3bV(EXY!cWLcug6?;5j9$}gjx;|*f1r;UP^ zoA6xbz-t0TX{kFFvYHE+L#U%eF4VLrmpx1~J8raEJU!AiCwQJrLsoM5hstts7G@Y{ zWpn6Ehgg4<4b2E(R-ADSlYqFk1bme`+9jf;Tn_ARt+D%(4{IM5 zEYNywp7ipz@-NqWN;*)Msv06{!(K}9D8tJUol6Ia0^^9;CuQ9E~w8F3?LY-(opN+KCI;d!=K2NiOtT;>a!6=9W&J zq}Zl3r{tZ9Kg}%8-iyO6j1jrRfC;yzuI%ggt9lxr%umTh=gFF>!Gq zKHX2tZ@!(MUzf1q&i>#Rl=vMT*cj*lWlY@9zo7%@FQepdjQ9VI4hH`ZmcWoazhVh1 z3azDrWGob;@BdB^eeV>+(&hbh3ulC(l51lIECv!KyIs{i_A1+iFH=8^+6N9t>a;y7 zbsmJGMS8!bE0rqQ3X);>NCZ~xiovpSf9K4^DWIm9c&=?X%RtE6hFkP`lw&tso8 zK=#)CM{O>o$X^M9q1>N=0aE`Lmwy2U$?pn&L1wpPyfTy|BjzAQJaD^GP*;`BAtYUFkpa$I6zubLTV~Z>5frKC<9cO zfWQE01W6GADc{F)-uHd}{}1`dc$$vnL2%MSK!)mflEQPC<3P1UE(uxPWJNy!RyF|t!qbQ;+rBiohQjv$}J1M zS9O*j!zD=D-`Y20tOHG2R$c~~g_dpSbm=Hg3hMj0=MsquLazXvHM#!p)juYH(Y^I~ zQ)<2&F&|ZHSW83^(40n&8kJCzr^m%=W&c0BI|#11@WcU)zCp>GHz;4LQR?c(`wsrd zPJ(Nd4JQbk#Kx;-onIpI$a3QCmc$m2ciHd$hl95-prT(l7v&p6k{6=)QUc@B{M8IS z*Nj9^>SAG-t|V>c^vj1O{F-9nv-0ParE5HZH{p>N-532CJN%#ZI-SbGTkR6fq-5fC ztW$N#aZ75iVoBaNaS7Fx$K>1(&cU=xT{4`>Dk=`=MJk$*-95{Tro&iBlnDH1D zUM!1~Kmy7+HS~K1Ui{{si{1i_9rf6)LB*UeKcRB4C;u!h?dW`~TQb8b3;9q!R(I8E zxNy6JsdazoSw~b}wt`n7Bt(tLrxy1?9mt}m;y}B+8zE$q0ewNIt2AsnV=2t>%?^i( zf&l8p1K3JQ%kK0^?F|!t%;MdhZDIMNFggYEmK6ebWNA~NeDg)oMvPxBl>ZmUh~ofX z>W^Fe0@5n=74q6i%1sv*hI%}`E4(JM%8EXX)6B%){y4**I&+nLlkMl=C!H+^8K!PncD|^=1zF zmf4V8e?}z_v1zlmQg(W5L83GXURnD4+{7yAz! z;ICb-8XWsYYpy0={yOS?*i;m`bF#Q*+&qjgR}7L*e*tdT?YwhrTh$!T#Y9axZgn!W z9LR|Q>4(w3*?KZiX-uPL-P4I97 zCVnzFbU=H_vmP^kEX`1qp%8eI;M?y3+h)o8QqKJ7eF?r#F=fcuVEd8-%FG!j7=YPW zXzQWShWv0vf6XebM0L2h=fwJWy_jdZGFiAp;90fS=2>w(>a?xc5KB9BzAX{;g>Hdq z=%=iHo+Q~12%d@LVP%lSz=HSVRQH^Ii54Kx1~wG=fx%-!Z` zuN8%Tgr%1e7EofYqdez_GlOZVrh403m7EqAd)KQj{c!|{>wi>|m0YG0J^45261R`|2h0d_73s>Xb{3Pn@PgL{!vqa^v(!9A)B42be22S^+lLMGt0 z8~eCdzFKTnj~%SQa}7%o4%JdZAJ#*Ukd^CRtxpeE&0FYxmW4lNZJyh#;EG{T#@vjY zy3FM(kq@|xITFpt=vMRUrd?EVOLy_^JEV>>{M>lGW@&tj2YUydOZsT9vhihLphbie ztYcnueWQ#6wrohs0BEK>We3Wn&VNfjnd(mZw|D6!ImO$M!4MKU{14`8s0o?pU(M@FcBC` zYVRdB?n3;+nb2D36TSWtSgk5RjdlBq#2jB5$(roci@QB--yfW+?)una>Gi_39qxl3 z;Gsgk5^5z9p0R{|c1?^3M`{{y#q)_K)49>vq?XSq+u#pt$V_WU;IyH|I8U_dXV2!a z`_Rh@+n!Sb&&MgX#W1h>-^Mt7M|wO`LtccYR&HXt3WGk>Zx2y{<48#+C-_%c4J z0gI?gSr=CP^eNAT(e5@oRH0z6(WqMHBG-EUV@01yGpuM<+n9wp#b{YhygVF}nc3ea zssTZIGNQa24^L%J_{QYKBPXCr+;*M|kL9y}I~)l|ja#Snd9g~F*tUP^l@IR^zhX74 z5TD*5hJ%!Rw>eqW)pM*_3RP@|NMZ-8+0^9_Dr?6a&vQ8go4yhGc?f={ZkY>0CtFVC zUGULHv(v@FerjYwm}I@3*YZ7ISP46TV!Adw;b;NS6S#pTccdV=KRqqw>7c>cxSqkL za**hEltF%+D23Fo9z}V=6+Eq}Xd9S=Ua`KvBII>I`!(V7x~{inghU-=#Z@wRLogt( zih|o?tu5B|e^$gSrL@Zr>rN={72Fc!ggvT2 zzcCK&F=)vaCmQeld43*%byMr_zFR8*5+9bllR$^4x@w+!L%n_)vFg8aH@pokC)v|O zTpAw+tqnSvHwtI|`5v#cX7_b3wn-I0@e?HYYb2AP1BeqOhE(~3K2^k7zQ%Z=;Zl%pfF?A>#E?yf|*ZkI-W zcI;&OoYB}$G2GY8_94Bht`i5VU!fKWzO#+7Ji z(RvNVw^9B9V@drQ+M9#%vH8ZJZ!yGkbzq?h{!(!CLzZq)A-GGynwmD)((!6b6c|X9Vp0EmpoQ(4?};iS--@Z(H0y&z zZp8t}U?N@4%=H_n8Yyir*NGU74_98*sA(nL9mqC{k}52*MrexXY-#fqiqRtbyGt%o z-zxjR!@N7kLkoN$g)0G;@{cXeio`5`vHV7~WC7BI%66JKxa?2-x;pBBD#~z}y7kVz z5Z)eF2%4(k0pbIyWAZt2j@d^L#hI1(k1akH96%S0M?Y@)1Rhsjzp!I0w04E4)g*+{ zLh}88J2Jvh=Pp12{(!pxECBa+BSrp&oG30JjOuch0PG2T2;vo>P6?mW)VQR1j6@-Y ykc=RDsdIF+yz~Gdj6S99&;