ruby SSL proxy (MITM) - ruby

Question

I want to proxy SSL data, HTTPS in this case.
Here is my Code:
begin
server = TCPServer.open(on_demand_port)
rescue Exception => e
sleep 5
retry
end
sslContext = OpenSSL::SSL::SSLContext.new
sslContext.verify_mode = OpenSSL::SSL::VERIFY_NONE
begin
sslContext.cert = OpenSSL::X509::Certificate.new(File.open("#{Dir.pwd}/Cert/cert.pem"))
sslContext.key = OpenSSL::PKey::RSA.new(File.open("#{Dir.pwd}/Cert/key.pem"), "1234")
rescue Exception => e
sleep 5
retry
end
begin
sslServer = OpenSSL::SSL::SSLServer.new(server, sslContext)
rescue Exception => e
sleep 5
retry
end
while true
begin
threads << Thread.new(sslServer.accept) do |client| # Putting new connections into the thread pool
tcp_proxy(client, db_name, db_user, db_password, remote_host, remote_port, patterns)
end
rescue Exception => e
end
threads = threads.select { |t| t.alive? ? true : (t.join; false) }
while threads.size >= on_demand_max_threads
sleep 1
threads = threads.select { |t| t.alive? ? true : (t.join; false) }
end
end
And this is the "tcp_proxy" which is the actual SSL Proxy
begin
begin
ssl_context = OpenSSL::SSL::SSLContext.new
ssl_context.verify_mode = OpenSSL::SSL::VERIFY_NONE
cert_store = OpenSSL::X509::Store.new
cert_store.set_default_paths
ssl_context.cert_store = cert_store
tcp_socket = TCPSocket.new(remote_host, remote_port)
server_socket = OpenSSL::SSL::SSLSocket.new tcp_socket, ssl_context
server_socket.sync_close = true
server_socket.connect
rescue Exception => e
client.close
end
while true
# Wait for data to be available on either socket.
(ready_sockets, dummy, dummy) = IO.select([client, server_socket])
begin
ready_sockets.each do |socket|
data = socket.readpartial(4096)
if socket == client
# Read from client, write to server.
server_socket.write data
server_socket.flush
else
# Read from server, write to client.
client.write data
client.flush
end
end
rescue Exception => e
end
end
rescue StandardError => e
end
begin
client.close
server_socket.close
rescue Exception => e
end
Now, this is working great in normal TCP and HTTP, but, when I use it in SSL\HTTPS when upgrading the socket it starts getting really really slow and sometimes will just timeout.
Any idea why ?

Answer 1

You have to be careful with read and select, because read is done at the SSL level while select is at the TCP level.
SSL puts the data into frames, where each frame can contain at most 16384 bytes. It needs to read the full frame from the underlying TCP socket before the read on the SSL socket can return any data from the frame. This means if you have a frame with 4097 bytes payload it will need to read the full frame from the TCP socket before you can read anything from the SSL socket. If you then only read 4096 bytes from the SSL socket it will return the first 4096 bytes and leave the rest (1 byte) in the SSL buffer. If you then check with select for new data at the TCP level it might block, because there are no unread data at the TCP level, even if there is still the single byte inside the SSL buffer.
There are two ways to work around this problem:
Check with pending if there are still data in the SSL buffer. If there are, read them instead of doing the select.
Or try to read at least 16384 bytes with each read, that is the maximum size of a SSL frame. I'm not sure about the implementation in ruby, but in Perl this read will just call the underlying SSL_read and this only reads the data from a single frame. Thus with a read size of 16384 bytes there can be no pending data and you can just call select like you do now.