TLS over TLS for https proxy

Hi all,
I am currently struggling with getting my client application to communicate 
using TLS to my server application via an HTTP CONNECT proxy server 
(squid). The proxy requires an authentication token, which is why I'd like 
to establish a HTTPS connection to the proxy (the outer TLS connection). Is 
there a recommended way of doing this?

Establishing the proxy tunnel works perfectly fine. I can handshake, send 
the HTTP CONNECT and get a 200 - OK response. The server also registers an 
incoming connection.

Next, I want to perform a TLS handshake with the server (the inner TLS). If 
I understand things correctly, that handshake has to be wrapped in the 
proxy connection. So anything written to the target server after the 
handshake needs to be encrypted twice, once for the proxy and once for the 
target server. I have experimented with different ways of doing so:

1) pushing a BIO_new_ssl on the current BIO chain (proxy_bio_connect -> 
proxy_bio_ssl -> server_bio_ssl). This seems to work in principle. However, 
the handshake does take several seconds and the resulting connection seems 
quite unstable. I am stuck in a WANT_READ during SSL_Connect, thus polling 
the socket and that doesn't return for several seconds.
My suspicion is that there is some hickup between the outer and the inner 
ssl layer. Perhaps the outer ssl is consuming packets that the inner one is 
waiting for or sending some packets that the inner one doesn't expect. 
Sometimes I observed an "unexpected message alert". I also observed some 
data being stuck in one of the BIOs when not flushing them.

2) Creating a membio + SSL object and reading/writing to it manually to 
forward data from/ to the proxy BIO. This seems quite complex as forgetting 
to read/write from one of the BIOs easily results in the application 
blocking forever. I think I managed to get a connection working this way as 
well, however I'd like to use non-blocking sockets and am quite scared of 
including any more polling/waiting/read/write stuff into that code. Pretty 
sure the complexity will make it fail at some point given my skill level :-D

Any suggestions and advice on how to do this properly is very welcome (also 
something like "Configure your proxy to open the second TLS connection" or 
similar, if you think that's the most reasonable way).

Thanks!
Thomas

-- 
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/ab2067be-f69c-4b23-b91b-fe50f4be7341n%40openssl.org.