yugui	2010-12-23 21:45:59 +0900 (Thu, 23 Dec 2010)

  New Revision: 30323

  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=30323

  Log:
    merges r30294 from trunk into ruby_1_9_2.
    --
    * lib/net/smtp.rb: Net::SMTP should close the SSL connection if the
      connection verification fails.

  Added directories:
    branches/ruby_1_9_2/test/net/smtp/
  Added files:
    branches/ruby_1_9_2/test/net/smtp/test_ssl_socket.rb
  Modified files:
    branches/ruby_1_9_2/ChangeLog
    branches/ruby_1_9_2/lib/net/smtp.rb
    branches/ruby_1_9_2/version.h

Index: ruby_1_9_2/ChangeLog
===================================================================
--- ruby_1_9_2/ChangeLog	(revision 30322)
+++ ruby_1_9_2/ChangeLog	(revision 30323)
@@ -1,3 +1,8 @@
+Thu Dec 23 06:35:41 2010  Aaron Patterson <aaron@t...>
+
+	* lib/net/smtp.rb: Net::SMTP should close the SSL connection if the
+	  connection verification fails.
+
 Tue Dec 21 06:25:43 2010  Nobuyoshi Nakada  <nobu@r...>
 
 	* test/rexml/test_contrib.rb (ContribTester#test_pos): should not
Index: ruby_1_9_2/lib/net/smtp.rb
===================================================================
--- ruby_1_9_2/lib/net/smtp.rb	(revision 30322)
+++ ruby_1_9_2/lib/net/smtp.rb	(revision 30323)
@@ -542,13 +542,17 @@
 
     private
 
+    def tcp_socket(address, port)
+      TCPSocket.open address, port
+    end
+
     def do_start(helo_domain, user, secret, authtype)
       raise IOError, 'SMTP session already started' if @started
       if user or secret
         check_auth_method(authtype || DEFAULT_AUTH_TYPE)
         check_auth_args user, secret
       end
-      s = timeout(@open_timeout) { TCPSocket.open(@address, @port) }
+      s = timeout(@open_timeout) { tcp_socket(@address, @port) }
       logging "Connection opened: #{@address}:#{@port}"
       @socket = new_internet_message_io(tls? ? tlsconnect(s) : s)
       check_response critical { recv_response() }
@@ -573,15 +577,23 @@
       end
     end
 
+    def ssl_socket(socket, context)
+      OpenSSL::SSL::SSLSocket.new socket, context
+    end
+
     def tlsconnect(s)
-      s = OpenSSL::SSL::SSLSocket.new(s, @ssl_context)
+      verified = false
+      s = ssl_socket(s, @ssl_context)
       logging "TLS connection started"
       s.sync_close = true
       s.connect
       if @ssl_context.verify_mode != OpenSSL::SSL::VERIFY_NONE
         s.post_connection_check(@address)
       end
+      verified = true
       s
+    ensure
+      s.close unless verified
     end
 
     def new_internet_message_io(s)
Index: ruby_1_9_2/version.h
===================================================================
--- ruby_1_9_2/version.h	(revision 30322)
+++ ruby_1_9_2/version.h	(revision 30323)
@@ -1,5 +1,5 @@
 #define RUBY_VERSION "1.9.2"
-#define RUBY_PATCHLEVEL 128
+#define RUBY_PATCHLEVEL 129
 #define RUBY_VERSION_MAJOR 1
 #define RUBY_VERSION_MINOR 9
 #define RUBY_VERSION_TEENY 1
Index: ruby_1_9_2/test/net/smtp/test_ssl_socket.rb
===================================================================
--- ruby_1_9_2/test/net/smtp/test_ssl_socket.rb	(revision 0)
+++ ruby_1_9_2/test/net/smtp/test_ssl_socket.rb	(revision 30323)
@@ -0,0 +1,90 @@
+require 'net/smtp'
+require 'minitest/autorun'
+
+module Net
+  class TestSSLSocket < MiniTest::Unit::TestCase
+    class MySMTP < SMTP
+      attr_accessor :fake_tcp, :fake_ssl
+
+      def tcp_socket address, port
+        fake_tcp
+      end
+
+      def ssl_socket socket, context
+        fake_ssl
+      end
+    end
+
+    class SSLSocket < StringIO
+      attr_accessor :sync_close, :connected, :closed
+
+      def initialize(*args)
+        @connected = false
+        @closed    = true
+        super
+      end
+
+      def connect
+        self.connected = true
+        self.closed = false
+      end
+
+      def close
+        self.closed = true
+      end
+
+      def post_connection_check omg
+      end
+    end
+
+    def test_ssl_socket_close_on_post_connection_check_fail
+      tcp_socket = StringIO.new success_response
+
+      ssl_socket = SSLSocket.new.extend Module.new {
+        def post_connection_check omg
+          raise OpenSSL::SSL::SSLError, 'hostname was not match with the server certificate'
+        end
+      }
+
+      connection = MySMTP.new('localhost', 25)
+      connection.enable_starttls_auto
+      connection.fake_tcp = tcp_socket
+      connection.fake_ssl = ssl_socket
+
+      assert_raises(OpenSSL::SSL::SSLError) do
+        connection.start
+      end
+      assert_equal true, ssl_socket.closed
+    end
+
+    def test_ssl_socket_open_on_post_connection_check_success
+      tcp_socket = StringIO.new success_response
+
+      ssl_socket = SSLSocket.new success_response
+
+      connection = MySMTP.new('localhost', 25)
+      connection.enable_starttls_auto
+      connection.fake_tcp = tcp_socket
+      connection.fake_ssl = ssl_socket
+
+      connection.start
+      assert_equal false, ssl_socket.closed
+    end
+
+    def success_response
+      [
+        '220 smtp.example.com ESMTP Postfix',
+        "250-ubuntu-desktop",
+        "250-PIPELINING",
+        "250-SIZE 10240000",
+        "250-VRFY",
+        "250-ETRN",
+        "250-STARTTLS",
+        "250-ENHANCEDSTATUSCODES",
+        "250-8BITMIME",
+        "250 DSN",
+        "220 2.0.0 Ready to start TLS",
+      ].join("\r\n") + "\r\n"
+    end
+  end
+end

--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/