From dbf450bdd203020451c02f8f746242a72b1af843 Mon Sep 17 00:00:00 2001
From: Karol Bucek <kares@users.noreply.github.com>
Date: Sat, 27 Aug 2022 22:18:24 +0200
Subject: [PATCH] [jruby] allow truststore without password (#2904)

---
 examples/puma/client-certs/ca_store.jks     | Bin 0 -> 848 bytes
 ext/puma_http11/org/jruby/puma/MiniSSL.java |   7 ++++++-
 test/test_puma_server_ssl.rb                |  19 +++++++++++++++++++
 3 files changed, 25 insertions(+), 1 deletion(-)
 create mode 100644 examples/puma/client-certs/ca_store.jks

diff --git a/examples/puma/client-certs/ca_store.jks b/examples/puma/client-certs/ca_store.jks
new file mode 100644
index 0000000000000000000000000000000000000000..afe3497c7387ad3549883156ec75a51e293ddf1e
GIT binary patch
literal 848
zcmezO_TO6u1_mY|W(3o$xs}<el|WwO32xy<46G4)rUsS_49r3XP0V}-O^n|bFf%bS
zF)=b5@Un4gwRyCC=VfH%W@Rw2FcdZrWaHwTq}Dn4lTHewq!@EvYKftUfe?xyOF?OF
zq9L~dCmVAp3o{Rsv!j8WIIod`frWvg0T@I9xh6<l3QTTdR6=$pBP#=Q6C*zZ&>LJ#
zO^l2TC*-A$7V36R6p@bEn6Yv1w_T+vVQ<(yzN~#=m3qrmK<5AL!Uu+b?-yj0$$#1z
z%@M${@b*le=hiVwA)Pm5q$kJg%$cyvQ_RwzNiy-D(##45f2o}fb58#iej}olDX`;8
z@v}7(w{qy2tXnSecxQ-pMwIgF$4|{%Wo|g+imhEMo5UY|uj}jr*4f#{<`qg&`2vOO
zUvb3GRX4kAwxe2d)-tR59Sj_nRdJ&A0&*`K^6u;?y}w9q(qev7?Uww2?AhNwX>8LD
zkjXuB#d%|~*WCS5EkQl;(~?*0d2v7T%K7RW9~DkJu|13HlzZ!c`Pbdc9=?}k`3_ru
z51$!puq|r&{*@si!c5GJ42+AF4HOOdfzcr=%*gnkh1Gx=NEz^f1o%M$EWik7Lk>n@
zYy*Rlk-=OttLWi2Zi}KLCMH){pR0;5XD;oSwd=yKX7N%FqcagN90KA#9cKCS<^gBf
zUXP!-!9o8VU2?asxw+NpSiJ6*wIvHoXU%Bw|DT?4@7dM1b^0?r?koKGYPin&{+pu*
zEzext&0p#ma%<mmm2cO-yw~9{<hcE~FYoqgn-0rUg28HqA2XclPhRm~&f+EdN{COO
z(;-Nw_s=#JjkNN0;RY9{7DQb5wSql9^~MU@lNRnhU#_<ExiGRcYZf%^UE`1&W0msh
z?40LbFRWh)&OOFGb!kS4?2J8W=FRiN7qD!bq1BLPyZg}AQz5VKxcok{X?LDD!@}7L
p4X%;vgXE822vb~h(VVj&Xi5Epl|}Cyew{2`F1kT4vpMv0H2_1JK=c3r

literal 0
HcmV?d00001

diff --git a/ext/puma_http11/org/jruby/puma/MiniSSL.java b/ext/puma_http11/org/jruby/puma/MiniSSL.java
index dd42f7af..1b9ab433 100644
--- a/ext/puma_http11/org/jruby/puma/MiniSSL.java
+++ b/ext/puma_http11/org/jruby/puma/MiniSSL.java
@@ -160,7 +160,12 @@ public class MiniSSL extends RubyObject { // MiniSSL::Engine
       truststoreType = keystoreType;
     } else if (!isDefaultSymbol(context, truststore)) {
       truststoreFile = truststore.convertToString().asJavaString();
-      truststorePass = asStringValue(miniSSLContext.callMethod(context, "truststore_pass"), null).toCharArray();
+      IRubyObject pass = miniSSLContext.callMethod(context, "truststore_pass");
+      if (pass.isNil()) {
+        truststorePass = null;
+      } else {
+        truststorePass = asStringValue(pass, null).toCharArray();
+      }
       truststoreType = asStringValue(miniSSLContext.callMethod(context, "truststore_type"), KeyStore::getDefaultType);
     } else { // self.truststore = :default
       truststoreFile = null;
diff --git a/test/test_puma_server_ssl.rb b/test/test_puma_server_ssl.rb
index 6808e589..ef36775d 100644
--- a/test/test_puma_server_ssl.rb
+++ b/test/test_puma_server_ssl.rb
@@ -489,6 +489,25 @@ class TestPumaServerSSLClient < Minitest::Test
     end
   end if Puma.jruby?
 
+  def test_verify_client_cert_with_truststore_without_pass
+    ctx = Puma::MiniSSL::Context.new
+    ctx.keystore = "#{CERT_PATH}/server.p12"
+    ctx.keystore_type = 'pkcs12'
+    ctx.keystore_pass = 'jruby_puma'
+    ctx.truststore =  "#{CERT_PATH}/ca_store.jks" # cert entry can be read without password
+    ctx.truststore_type = 'jks'
+    ctx.verify_mode = Puma::MiniSSL::VERIFY_PEER
+
+    assert_ssl_client_error_match(false, context: ctx) do |http|
+      key = "#{CERT_PATH}/client.key"
+      crt = "#{CERT_PATH}/client.crt"
+      http.key = OpenSSL::PKey::RSA.new File.read(key)
+      http.cert = OpenSSL::X509::Certificate.new File.read(crt)
+      http.ca_file = "#{CERT_PATH}/ca.crt"
+      http.verify_mode = OpenSSL::SSL::VERIFY_PEER
+    end
+  end if Puma.jruby?
+
 end if ::Puma::HAS_SSL
 
 class TestPumaServerSSLWithCertPemAndKeyPem < Minitest::Test