Setup:
Create a pair of memory BIOs, using BIO_s_mem(3ssl).
Set them to not return EOF when they're empty, using
SSL_set_mem_eof_return(BIO, 1). *
Associate them with an SSL object, using SSL_set_bio(3ssl).
Then:
When you receive the encrypted data from the connection:
call BIO_write into the from-network-side BIO
and then call SSL_read(3ssl).
When you have cleartext data that you wish to push out to the connection:
call SSL_write(3ssl) as normal
call BIO_ctrl_pending(3ssl) to find out how big your buffer must be
allocate your buffer of that size
BIO_read() from the to-network-side BIO into that buffer
transmit the contents of buffer as-is across your connection.
*: This is important, because otherwise the BIO operates with standard
file semantics and it'll cause your programs to appear to succeed at
first, and fail after about 3 packets.
You *MUST NOT ACCESS THE BIOs FROM ANY OTHER THREAD THAN THE ONE THAT
CREATED THEM*, as there is no locking done inside the BIO structures
(see BIO_s_bio(3ssl) for more information).
Also, from BIO_s_bio(3ssl):
One typical use of BIO pairs is to place TLS/SSL I/O under application
control, this can be used when the application wishes to use a non
standard transport for TLS/SSL or the normal socket routines are
inappropriate.
You *must* write out any data that you read from the to-network BIO to
the connection, as this "flushes" the BIO's buffer.
-Kyle H
On Mon, Jan 18, 2010 at 8:27 AM, Lutz Jaenicke <[email protected]> wrote:
> Forwarded to [email protected] for public discussion.
>
> Best regards,
> Lutz
>
> ----- Forwarded message from [email protected] -----
>
> From: [email protected]
> To: [email protected]
> Date: Mon, 18 Jan 2010 22:25:57 +0800
> Reply-To: [email protected]
> Subject: enhancement request:tls without sockets
>
> Hi, I have a quirky app that while connection based is not tcp based.
> I am looking for some way to usel tls for authentication of both ends of the
> connection.
>
> Is there an example of how to use OpenSSL without it managing the socket?
>
> Thanks
>
>
> ----- End forwarded message -----
> --
> Lutz Jaenicke [email protected]
> OpenSSL Project http://www.openssl.org/~jaenicke/
> ______________________________________________________________________
> OpenSSL Project http://www.openssl.org
> User Support Mailing List [email protected]
> Automated List Manager [email protected]
>
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [email protected]
Automated List Manager [email protected]
