[9fans] TLSServer?

[9fans] TLSServer?

[Sam]

I need to write a Unix application that uses TLS/SSL.  I
looked at using OpenSSL, but lordy mama -- what an interface.
Since I only need to do the server side of the communication,
I thought perhaps the Plan 9 tls stuff could be used.

Comments?  How much work would it be to get the current
code working in a Unix environ?

Cheers,

Sam

Re: [9fans] TLSServer?

[David Presotto]

[-- Attachment #1: Type: text/plain, Size: 256 bytes --]

You'ld have to take our devtls stuff out of the kernel.  You could run it as
a process that you pipe stuff through.  WOuldn't be too hard.  The
security and extended math libraries have been ported before, I
think rsc probably has them ported to a Unix.

[-- Attachment #2: Type: message/rfc822, Size: 2180 bytes --]

From: Sam <sah@softcardsystems.com>
To: <9fans@cse.psu.edu>
Subject: [9fans] TLSServer?
Date: Mon, 10 Nov 2003 09:25:18 -0500 (EST)
Message-ID: <Pine.LNX.4.30.0311100919570.21648-100000@athena>

I need to write a Unix application that uses TLS/SSL.  I
looked at using OpenSSL, but lordy mama -- what an interface.
Since I only need to do the server side of the communication,
I thought perhaps the Plan 9 tls stuff could be used.

Comments?  How much work would it be to get the current
code working in a Unix environ?

Cheers,

Sam

Re: [9fans] TLSServer?

[Russ Cox]

> I need to write a Unix application that uses TLS/SSL.  I
> looked at using OpenSSL, but lordy mama -- what an interface.
> Since I only need to do the server side of the communication,
> I thought perhaps the Plan 9 tls stuff could be used.
>
> Comments?  How much work would it be to get the current
> code working in a Unix environ?

Step 1.  Write a kernel driver to do the TLS record-layer marshalling.
Not so easy.

If you want the Plan 9 interface (just pushtls and use the resulting fd
in normal I/O), the right thing to do seems to be to create a pipe and
then run openssl in a child encrypting between the pipe and your old fd.
Then you can use the pipe as your normal encrypted fd.  There was a
library that did this (either with or without SSL) (by someone in
Australia, perhaps?) but I cannot find it online anymore.  Presumably
it's not _too_ hard to write the appropriate program using OpenSSL
(maybe it's even an example).  The pipe+exec code is trivial.

I think Dong Lin has code that does this somewhere.

Russ

Re: [9fans] TLSServer?

[William Ahern]

On Mon, Nov 10, 2003 at 09:25:18AM -0500, Sam wrote:
> I need to write a Unix application that uses TLS/SSL.  I
> looked at using OpenSSL, but lordy mama -- what an interface.
> Since I only need to do the server side of the communication,
> I thought perhaps the Plan 9 tls stuff could be used.

It takes ~10 calls into OpenSSL in my TLS-able server to load trusted certs,
load the keys, install the descriptor and use it in my IO routines. Much,
much easier than I initially thought when I first dove into the horrible
documentation. And some of the crypto primitives are written in assembly,
which can make a big difference depending on your server's usage pattern.

All-in-all, OpenSSL was much simpler than it looks from 10,000 feet.

Re: [9fans] TLSServer?

[Andrew Simmons]

At 09:25 10/11/2003 -0500, you wrote:
>I need to write a Unix application that uses TLS/SSL.  I
>looked at using OpenSSL, but lordy mama -- what an interface.
>Since I only need to do the server side of the communication,
>I thought perhaps the Plan 9 tls stuff could be used.
>
>Comments?  How much work would it be to get the current
>code working in a Unix environ?
>
>Cheers,
>
>Sam

I use OpenSSL under Windows, and find it very good. The build process is a
bit painful, and the online documentation is dreadful, but if you get a
copy of the O'Reilly book "Network Security with OpenSSL" it all becomes
remarkably simple. They've even provided a sample server application for
you to copy.

Re: [9fans] TLSServer?

[Sam]

> If you want the Plan 9 interface (just pushtls and use the resulting fd
> in normal I/O), the right thing to do seems to be to create a pipe and
> then run openssl in a child encrypting between the pipe and your old fd.
> Then you can use the pipe as your normal encrypted fd.  There was a
> library that did this (either with or without SSL) (by someone in
> Australia, perhaps?) but I cannot find it online anymore.  Presumably
> it's not _too_ hard to write the appropriate program using OpenSSL
> (maybe it's even an example).  The pipe+exec code is trivial.

Sorry for the late response - I just got back to looking at this today.

There's only one problem with the pleasantly trivial solution above.  The
unices still have unidirectional pipes, so I can't read and write the
returned fd.

I'm looking at implementing serveopenssl(int, ...) that takes an already
set up socket fd ready for accept and the tls cert necessities.  I plan
to return a socket descriptor for a unix domain server, and as I get
completed tls connections I'll make a client connect to the udom server
and marshal data back and forth.

Sure seems like a lot of work just to get the security insulated from
the application code.  Suggestions welcomed.

Sam

Re: [9fans] TLSServer?

[Sam]

> You can use socketpair to get a two-way pipe.

Someone else just pointed that out to me.  Thanks
for not letting me "reimplement it, poorly," though.

:)

Re: [9fans] TLSServer?

[Russ Cox]

> There's only one problem with the pleasantly trivial solution above.  The
> unices still have unidirectional pipes, so I can't read and write the
> returned fd.

You can use socketpair to get a two-way pipe.

Russ

Re: [9fans] TLSServer?

[boyd, rounin]

> You can use socketpair to get a two-way pipe.

surely you jest.

8th Ed had bi-directional pipes [cross connected streams].

streams, not sewers, nor sockets.

Re: [9fans] TLSServer?

[William Josephson]

On Sun, Nov 16, 2003 at 05:14:45AM +0100, boyd, rounin wrote:
> > You can use socketpair to get a two-way pipe.
>
> surely you jest.
>
> 8th Ed had bi-directional pipes [cross connected streams].

Most modern Unix variants have bidirectional pipes, too.
Except when they don't.  As ugly as it is, socketpair is
the portable way to make the bidirectional pipe.

Re: [9fans] TLSServer?

[boyd, rounin]

> Most modern Unix variants have bidirectional pipes, too.
> Except when they don't.  As ugly as it is, socketpair is
> the portable way to make the bidirectional pipe.

sockets?  where shall i begin?