Skip to content

Commit 7e872b7

Browse files
kareskares
committed
test: will now pass regardless or actual JCE setup
1 parent 2816b73 commit 7e872b7

2 files changed

Lines changed: 32 additions & 49 deletions

File tree

‎src/test/ruby/ssl/test_context.rb‎

Lines changed: 16 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -102,13 +102,16 @@ def test_context_set_ssl_version
102102

103103
def test_context_ciphers
104104
return skip('on Java 6') if defined?(ENV_JAVA) && ENV_JAVA['java.version'] < '1.7'
105-
105+
106+
self.class.disable_security_restrictions
107+
106108
context = OpenSSL::SSL::SSLContext.new
107109
context.ciphers = "ALL"
108110

109-
all_ciphers = context.ciphers.map{ |cipher_array| cipher_array[0] }
111+
all_ciphers = context.ciphers.map { |cipher_array| cipher_array[0] }
110112

111-
# Java 8 (1.8.0_112-b15) :
113+
# NOTE: assuming JCE installed ()CryptoSecurity.setAllPermissionPolicy)
114+
# ... otherwise on Java 8 (1.8.0_112-b15) :
112115
# Ignoring unavailable cipher suite: TLS_DHE_DSS_WITH_AES_256_GCM_SHA384
113116
# Ignoring unavailable cipher suite: TLS_DH_anon_WITH_AES_256_CBC_SHA
114117
# Ignoring unavailable cipher suite: TLS_DH_anon_WITH_AES_256_CBC_SHA256
@@ -177,15 +180,14 @@ def test_context_ciphers
177180
# Ignoring unavailable cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
178181
# Ignoring unavailable cipher suite: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
179182

180-
java_8 = (ENV_JAVA['java.version'] == '1.8') || nil
181-
182-
expected_ciphers = [java_8 && "ECDHE-ECDSA-AES256-SHA",
183-
java_8 && "ECDHE-RSA-AES256-SHA",
184-
java_8 && "AES256-SHA",
185-
java_8 && "ECDH-ECDSA-AES256-SHA",
186-
java_8 && "ECDH-RSA-AES256-SHA",
187-
java_8 && "DHE-RSA-AES256-SHA",
188-
java_8 && "DHE-DSS-AES256-SHA",
183+
jce_installed = true # || nil
184+
expected_ciphers = [jce_installed && "ECDHE-ECDSA-AES256-SHA",
185+
jce_installed && "ECDHE-RSA-AES256-SHA",
186+
jce_installed && "AES256-SHA",
187+
jce_installed && "ECDH-ECDSA-AES256-SHA",
188+
jce_installed && "ECDH-RSA-AES256-SHA",
189+
jce_installed && "DHE-RSA-AES256-SHA",
190+
jce_installed && "DHE-DSS-AES256-SHA",
189191
"ECDHE-ECDSA-AES128-SHA256",
190192
"ECDHE-RSA-AES128-SHA256",
191193
"ECDH-ECDSA-AES128-SHA256",
@@ -204,8 +206,8 @@ def test_context_ciphers
204206
"ECDH-RSA-DES-CBC3-SHA",
205207
"EDH-RSA-DES-CBC3-SHA",
206208
"EDH-DSS-DES-CBC3-SHA",
207-
java_8 && "AECDH-AES256-SHA",
208-
java_8 && "ADH-AES256-SHA",
209+
jce_installed && "AECDH-AES256-SHA",
210+
jce_installed && "ADH-AES256-SHA",
209211
"AECDH-AES128-SHA",
210212
"ADH-AES128-SHA",
211213
"AECDH-DES-CBC3-SHA",

‎src/test/ruby/test_helper.rb‎

Lines changed: 16 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -99,46 +99,28 @@ def assert_not_same(expected, actual)
9999
end
100100
end
101101

102-
def self.disable_security_restrictions!; end # do nothing on MRI
102+
def self.disable_security_restrictions!; @@security_restrictions = nil end # do nothing on MRI
103103

104-
@@security_restrictions = nil
104+
@@security_restrictions = ''
105105

106106
def self.disable_security_restrictions!
107-
jce_security_class = java.lang.Class.for_name('javax.crypto.JceSecurity')
108-
restricted_field = jce_security_class.getDeclaredField('isRestricted')
109-
restricted_field.accessible = true
110-
@@security_restrictions = restricted_field.getBoolean(nil)
111-
return false unless @@security_restrictions
112-
113-
if java.lang.reflect.Modifier.isFinal restricted_field.modifiers
114-
field_class = java.lang.Class.for_name('java.lang.reflect.Field')
115-
# NOTE: this no longer works since 8u111 as it's using unsafe :
116-
# Can not set static final boolean field javax.crypto.JceSecurity.isRestricted to (boolean)false
117-
# sun.reflect.UnsafeFieldAccessorImpl.throwFinalFieldIllegalAccessException(sun/reflect/UnsafeFieldAccessorImpl.java:76)
118-
# sun.reflect.UnsafeFieldAccessorImpl.throwFinalFieldIllegalAccessException(sun/reflect/UnsafeFieldAccessorImpl.java:84)
119-
# sun.reflect.UnsafeQualifiedStaticBooleanFieldAccessorImpl.setBoolean(sun/reflect/UnsafeQualifiedStaticBooleanFieldAccessorImpl.java:93)
120-
# java.lang.reflect.Field.setBoolean(java/lang/reflect/Field.java:801)
121-
mods_field = field_class.getDeclaredField('modifiers')
122-
mods_field.accessible = true
123-
124-
# restricted_field = jce_security_class.getDeclaredField('isRestricted')
125-
# restricted_field.accessible = true
126-
mods_field.setInt restricted_field, (~java.lang.reflect.Modifier::FINAL & restricted_field.modifiers)
107+
debug = OpenSSL.debug
108+
begin
109+
OpenSSL.debug = true
110+
#org.jruby.ext.openssl.util.CryptoSecurity.unrestrictSecurity
111+
#org.jruby.ext.openssl.util.CryptoSecurity.setAllPermissionPolicy
112+
@@security_restrictions = OpenSSL.send :_disable_security_restrictions!
113+
ensure
114+
OpenSSL.debug = debug
127115
end
128-
restricted_field.setBoolean nil, false; return true
129-
rescue Java::JavaLang::ClassNotFoundException => e
130-
warn "failed to disable JCE security restrictions: #{e.inspect}"; nil
131-
rescue Java::JavaLang::NoSuchFieldException => e # Java 6
132-
warn "failed to disable JCE security restrictions: #{e.inspect}"; nil
133-
rescue Java::JavaLang::IllegalAccessException => e
134-
warn "failed to disable JCE security restrictions: #{e.inspect}"; nil
135-
rescue NameError => e
136-
warn "failed to disable JCE security restrictions: #{e.inspect}"; nil
137116
end if defined? JRUBY_VERSION
138117

118+
def self.disable_security_restrictions
119+
disable_security_restrictions! if @@security_restrictions.eql?('')
120+
end
121+
139122
def self.security_restrictions?
140-
disable_security_restrictions! if @@security_restrictions.nil?
141-
@@security_restrictions
123+
disable_security_restrictions; return @@security_restrictions
142124
end
143125

144126
def self.java6?; java_version.last.to_i == 6 end
@@ -155,8 +137,7 @@ def jruby?; self.class.jruby? end
155137

156138
private
157139

158-
def issue_cert(dn, key, serial, not_before, not_after, extensions,
159-
issuer, issuer_key, digest)
140+
def issue_cert(dn, key, serial, not_before, not_after, extensions, issuer, issuer_key, digest)
160141
cert = OpenSSL::X509::Certificate.new
161142
issuer = cert unless issuer
162143
issuer_key = key unless issuer_key

0 commit comments

Comments
 (0)