From: "Iñaki Baz Castillo" <ibc@...>
Date: 2011-12-06T00:45:19+09:00
Subject: Re: Using OpenSSL for making a network TLS server

2011/12/2 Iñaki Baz Castillo <ibc@aliax.net>:
> 2011/12/2 John Downey <jdowney@gmail.com>:
>> Ruby's OpenSSL library has an SSLServer class that will do exactly what
>> you're asking. Here is just some quick example code (most of the code is
>> just building a self-signed cert, you could just as easily load this from a
>> file):
>>
>> require 'openssl'
>> require 'socket'
>>
>> tcp_server = TCPServer.new 8080
>>
>> ctx = OpenSSL::SSL::SSLContext.new
>> ctx.key = OpenSSL::PKey::RSA.new 2048
>> ctx.cert = OpenSSL::X509::Certificate.new
>> ctx.cert.subject = OpenSSL::X509::Name.new [['CN', 'localhost']]
>> ctx.cert.issuer = ctx.cert.subject
>> ctx.cert.public_key = ctx.key
>> ctx.cert.not_before = Time.now
>> ctx.cert.not_after = Time.now + 60 * 60 * 24
>> ctx.cert.sign ctx.key, OpenSSL::Digest::SHA1.new
>>
>> server = OpenSSL::SSL::SSLServer.new tcp_server, ctx
>> socket = server.accept
>> puts socket.gets
>>
>> With anything having to do with crypto I would highly recommend not trying
>> to create the solution yourself (it is far to easy to screw up). Instead
>> you should take time to review existing solutions that have been "battle
>> hardened."

Hi, unfortunatelly the above solution is not valid for me. What I want
to do is using OpenSSL on top of a EventMachine TCP connection.

EventMachine manages all the sockets and connections internally (at
C++ level), and creates an instance of EM::Connection Ruby class for
each TCP connection (a server connection). Such EM::Connection class
provides some callbacks:

------------------
class MyTcpServer < EM::Connection
  def receive_data data
    puts "data reveiced on this connection: #{data}"
  end
end
------------------

And includes a method "send_data(data)" to send data over the connection.


So I don't have a Ruby Socket instance. Instead I receive the raw TCP
data in that connection. In my case, such TCP data initially contains
the client's SSL handshake, so I need a way to pass such handshake to
a Ruby OpenSSL::XXX instance. I also need a way to encrypt data based
on the SSL handshake and write it into a raw string, so I can call
EM::Connection#send_data(data) over the TLS connection.

Unfortunatelly it seems that Ruby OpenSSL does not provide a mechanism
for that, and it requires passing a real Ruby Socket as argument for
OpenSSL::SSL::SSLSocket and OpenSSL::SSL::SSLServer. Any suggestion
please?

A workaround I'm thinking about is using an intermediary like-socket,
so when I receive TCP data over the EM::Connection#receive_data(data)
method, I send such raw data to the intermediary socket, and
previously I passed such intermediary socket during the initialitation
of the OpenSSL::SSL::SSLSocket instance (so the SSL handshake and
decryption is done by OpenSSL as usual). But I don't know how to
implement this "concept", and I would prefer not to deal with an
"intermediary socket".

Thanks a lot for any suggestion.


-- 
Iñaki Baz Castillo
<ibc@aliax.net>