From: John Downey <jdowney@...>
Date: 2011-12-03T00:01:46+09:00
Subject: Re: Using OpenSSL for making a network TLS server

--0016367b62dc3efb0c04b31d3f14
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Ruby's OpenSSL library has an SSLServer class that will do exactly what
you're asking. Here is just some quick example code (most of the code is
just building a self-signed cert, you could just as easily load this from a
file):

require 'openssl'
require 'socket'

tcp_server =3D TCPServer.new 8080

ctx =3D OpenSSL::SSL::SSLContext.new
ctx.key =3D OpenSSL::PKey::RSA.new 2048
ctx.cert =3D OpenSSL::X509::Certificate.new
ctx.cert.subject =3D OpenSSL::X509::Name.new [['CN', 'localhost']]
ctx.cert.issuer =3D ctx.cert.subject
ctx.cert.public_key =3D ctx.key
ctx.cert.not_before =3D Time.now
ctx.cert.not_after =3D Time.now + 60 * 60 * 24
ctx.cert.sign ctx.key, OpenSSL::Digest::SHA1.new

server =3D OpenSSL::SSL::SSLServer.new tcp_server, ctx
socket =3D server.accept
puts socket.gets

With anything having to do with crypto I would highly recommend not trying
to create the solution yourself (it is far to easy to screw up). Instead
you should take time to review existing solutions that have been "battle
hardened."

On Fri, Dec 2, 2011 at 4:22 AM, I=F1aki Baz Castillo <ibc@aliax.net> wrote:

> Hi, Ruby EventMachine has some issues in its TLS implementation (coded
> in C++ using OpenSSL) as noted in
> https://github.com/eventmachine/eventmachine/issues/266.
>
> I've been suggested by the author of the project to make a TLS stack
> on pure Ruby (by using OpenSSL) and I want to start with it. I'd like
> to ask some very basic questions so I can investigate how to achieve
> it:
>
> - Imagine that a Ruby server receives a TLS connection from a client.
> I assume that my server must implement the TLS handshake protocol at
> pure Ruby level, this is, OpenSSL will not help me with this, am I
> right?
>
> - Once such TLS handshake is started, I could receive a certificate
> from the client, such certificate must be parsed "manually" at Ruby
> level in the server (OpenSSL will not help me with this),am I right?
>
> - I must also send my certificate(s) to the peer (again at Ruby level).
>
> - After previous steps, I expect that TLS connection is done so I will
> receive data from the client. And I should process/decrypt such data
> by using some OpenSSL::XXXXXXX instance and method, am I right?
>
> - And in case I reply data to the client, I must first encrypt the
> data using some OpenSSL::XXXXXXXX instance and method, and then send
> the generated data to the client, am I right?
>
> Thanks a lot for any input that helps me starting with this stuff.
>
> --
> I=F1aki Baz Castillo
> <ibc@aliax.net>
>
>


--=20
John Downey

--0016367b62dc3efb0c04b31d3f14--