non-blocking openssl BIO type

[Mike Mangelsdorf]

I am using openssl to implement a tls server with libuv. There is a lot of dated information on the web on how to do non-blocking openssl, but a reasonable approach seems to be:

http://h71000.www7.hp.com/doc/83final/ba554_90007/ch04s03.html

This document recommends creating a non-blocking socket BIO like so: sbio = BIO_new_socket( socket, BIO_NOCLOSE); and then use asynchronous SSL_read and SSL_write. Is this the right BIO type to use though, as it would presumably involve a private socket fd from libuv?

[Fedor Indutny]

Mike,

You could try using my TLS terminator as a base of your server:
http://github.com/indutny/bud . It is written on the top of the libuv,
though, not using asynchronous BIOs (in fact it is using my custom
BIO).

Cheers,
Fedor.

> --
> You received this message because you are subscribed to the Google Groups
> "libuv" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to libuv+un...@googlegroups.com.
> To post to this group, send email to li...@googlegroups.com.
> Visit this group at http://groups.google.com/group/libuv.
> For more options, visit https://groups.google.com/groups/opt_out.

[Mike Mangelsdorf]

Thank you Fedor,

I had looked at bud before and it's been helpful already!

For anyone trying to get to grips with non-blocking use of openssl, I also found this post/thread helpful, it cleared up basic misconceptions I had:

http://openssl.6102.n7.nabble.com/SSL-Communication-using-BIO-td9842.html#a9843

Probably a topic of ongoing interest, so feel free to reply with interesting links here...

Kind Regards,

Michael

[Mike Mangelsdorf]

Reading up on this some more, rather than socket BIO with SSL_read/write, I will prototype a "BIO pair" approach, so that libuv doesn't have to share the socket. The application shares encode/decode data with openssl across an asynchronous "BIO pair" (buffer).

[Mike Mangelsdorf]

Hopefully this is helpful for people coming across this thread, as some information on the web explicitly states that openssl doesn't have notification callbacks, which may have put you on a wrong track.




From http://www.openssl.org/docs/ssl/SSL_CTX_set_info_callback.html:




SSL_CTX_set_info_callback() sets the callback function, that can be used to obtain state information for SSL objects created from ctx during connection setup and use.

The where argument specifies information about where (in which context) the callback function was called. 

(Can be SSL_CB_READ/WRITE, which sounds promising.)