Re: TLS over TLS for https proxy

Hi Viktor, Hi Alex,
thank you for all the explanations and ideas. That really helped a lot!
I finally succeeded by removing some of the complexity using libcurl for 
the proxy connection part and putting a SSL with read and write MemBIOs on 
top of it.
That way I only have to forward data between curl_easy_recv/curl_easy_send 
and the BIOs, as well as poll the socket when curls requires me to.
Pretty sure I can dig into debugging the initial solution with this part 
now working (even though I am pretty happy with this solution already).

Thanks again!
Thomas

Viktor Dukhovni schrieb am Montag, 2. Dezember 2024 um 16:44:50 UTC+1:

> On Mon, Dec 02, 2024 at 02:22:48AM -0800, Thomas K wrote:
>
> > I am still in the process of understanding how the
> > network_biopair_interop() works exactly, but I think I got the general
> > idea and how to transfer it.
>
> When you configure such a biopair on the network (ciphertext) side of an
> SSL handle, the SSL handle is not directly connected to any network
> socket. 
>
> Once the is enough data in the write buffer, the biopair is full, and
> needs to be drained (read and sent to the peer somehow) by the
> application. Writes to the clear side of the SSL handle then report
> SSL_ERROR_WANT_WRITE.
>
> Similarly, when the SSL handle runs of already decrypted data, or
> buffered data in the biopair, reads will report SSL_ERROR_WANT_READ.
>
> It is up to you how to move bytes from the biopair to the peer and back.
> But of course you need to do so in a timely manner. In particular on
>
> - SSL_ERROR_WANT_READ: make sure to send anything already
> available on the write side, the peer may be waiting for that
> before it can respond. If there's any you can read from the
> peer, do so and push it into the biopair.
>
> - SSL_ERROR_WANT_WRITE: send already encrypted data to the peer.
>
> The details depend a lot on the application protocol, if it is
> half-duplex like SMTP, things may be much easier than in general.
> Otherwise, you need non-blocking SSL handles, and ways to know that more
> data may be ready, which means also tracking I/O activity on the network
> side of the outer SSL tunnel, which could be another biopair, this time
> reading/writing to a socket, with epoll() or poll() letting you know
> when you may be able to try to push more data into the outer SSL or
> to pull more data out. This takes some care to get right. :-(
>
> -- 
> Viktor.
>

-- 
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/800eb283-af60-4145-8438-fddca8e43cbdn%40openssl.org.