Add JRuby CI coverage and handle SSL read timeouts

.github/workflows/test.yml

@@ -63,3 +63,25 @@ jobs:
         cache-version: 2
     - name: Run tests
       run: bundle exec rake --trace RUBYOPT="${{ matrix.ruby-opt }}"
+
+  jruby:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+    - name: Set up Java
+      uses: actions/setup-java@v6
+      with:
+        distribution: temurin
+        java-version: '21'
+    - name: Set up JRuby
+      uses: ruby/setup-ruby@v1
+      with:
+        ruby-version: jruby-10.1.2.0
+        bundler-cache: true
+        cache-version: 2
+    - name: Run tests
+      run: bundle exec rake --trace RUBYOPT="-rbundler/setup"
+    - name: Run JRuby-specific tests
+      run: bundle exec ruby -Ilib test/jruby_ssl_socket/test_pemutils.rb
+    - name: Run JRuby socket timeout tests
+      run: bundle exec ruby -Ilib test/jruby_ssl_socket/test_socket_timeout.rb

lib/httpclient/jruby_ssl_socket.rb

@@ -125,9 +125,11 @@
       begin
         size = @instr.read(@buf)
         if size > 0
           @bufstr << String.from_java_bytes(@buf, Encoding::BINARY)[0, size]
         end
         size
+      rescue java.net.SocketTimeoutException => e
+        raise HTTPClient::ReceiveTimeoutError.new(e.getMessage)
       rescue java.io.IOException => e
         raise OpenSSL::SSL::SSLError.new("#{e.class}: #{e.getMessage}")
       end
@@ -356,7 +358,7 @@
               # keep parsing in case where multiple certificates in a file
             else
               if pem
                 pem << line
               end
             end
           end

test/helper.rb

@@ -6,9 +6,41 @@
 require 'webrick/httpproxy.rb'
 require 'logger'
 require 'stringio'
 require 'cgi'
 require 'webrick/httputils'
 
+if RUBY_ENGINE == 'jruby'
+  require 'delegate'
+
+  module JRubyWEBrickSSLReadBuffer
+    class ReadableIO < SimpleDelegator
+      def initialize(socket)
+        @ssl_socket = socket
+        super(socket.to_io)
+      end
+
+      def wait_readable(timeout = nil)
+        # JRuby may buffer request bytes while completing the TLS handshake.
+        @ssl_socket.pending > 0 || super
+      end
+    end
+
+    module HTTPServerPatch
+      def run(sock)
+        if sock.respond_to?(:pending)
+          readable_io = ReadableIO.new(sock)
+          sock.define_singleton_method(:to_io) { readable_io }
+        end
+        super
+      ensure
+        sock.singleton_class.remove_method(:to_io) if readable_io
+      end
+    end
+  end
+
+  WEBrick::HTTPServer.prepend(JRubyWEBrickSSLReadBuffer::HTTPServerPatch)
+end
+
 
 module Helper
   Port = 17171

test/jruby_ssl_socket/test_socket_timeout.rb

@@ -0,0 +1,18 @@
+require File.expand_path('../helper', File.dirname(__FILE__))
+
+
+class JRubySocketTimeoutTest < Test::Unit::TestCase
+  def test_read_timeout_is_reported_as_receive_timeout
+    socket = HTTPClient::JavaSocketWrap.allocate
+    input = Object.new
+    input.define_singleton_method(:read) do |_buffer|
+      raise Java::JavaNet::SocketTimeoutException.new('Read timed out')
+    end
+    socket.instance_variable_set(:@instr, input)
+    socket.instance_variable_set(:@buf, Java::byte[HTTPClient::JavaSocketWrap::BUF_SIZE].new)
+
+    assert_raise(HTTPClient::ReceiveTimeoutError) do
+      socket.send(:fill)
+    end
+  end
+end

test/test_ssl.rb

@@ -332,7 +332,10 @@ def test_ciphers
       assert_match(/No appropriate protocol/, ssle.message)
     end
     #
-    cfg.ciphers = %w(TLS_RSA_WITH_AES_128_CBC_SHA)
+    # CI's Temurin 21 disables static-RSA suites such as
+    # TLS_RSA_WITH_AES_128_CBC_SHA in jdk.tls.disabledAlgorithms. Use an enabled
+    # ECDHE suite to verify explicitly configured ciphers can be negotiated.
+    cfg.ciphers = %w(TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256)
     assert_equal("hello", @client.get_content(@url))
     #
     cfg.ciphers = HTTPClient::SSLConfig::CIPHERS_DEFAULT
@@ -386,7 +389,15 @@ def test_no_sslv3
     end
   end
 
-  if OPENSSL_VERSION < 3
+  if RUBY_ENGINE == 'jruby'
+    def test_disallow_tlsv1
+      @client.ssl_config.ssl_version = :TLSv1
+      @client.ssl_config.verify_mode = nil
+      assert_raise(OpenSSL::SSL::SSLError) do
+        @client.get(@url)
+      end
+    end
+  elsif OPENSSL_VERSION < 3
     def test_allow_tlsv1
       teardown_server
       setup_server_with_ssl_version(:TLSv1)
@@ -408,7 +419,7 @@ def test_disallow_tlsv1
   end
 
   def test_use_higher_TLS
-    omit('TODO: it does not pass with Java 7 or old openssl')
+    omit('TODO: it does not pass with Java 7 or old openssl') unless RUBY_ENGINE == 'jruby'
     teardown_server
     setup_server_with_ssl_version('TLSv1_2')
     assert_nothing_raised do