|
Hi all,
I am in the process of securing an existing
application, and am weighing the feasibility of different approaches. I have
already asked a few questions on the list in this regard and got pretty good
response, that helped me understand OpenSSL implementation better. I thank you
all for that.
Here I am again asking a few question to judge
the feasibility of an approach, that would help me provide security with minimal
architectural changes to the existing application.
The main behavior I am trying to understand
better is "would it be okay to create a copy of the SSL object and use this copy
between two processes (say through shared mem)"? Following is the context that
leads to this question.
The application has a server parent process that
establishes a TCP session with the client. Thereafter, depending on the
client request, the server parent fork() -> exec() a new process (say server
child). These server child now communicates with the client (in the mean time,
server parent is busy doing something else). After the server child is done
talking to the client (or if it encounters an error, or gets killed), the server
parent resumes its communication with the client. This scenario works fine with
normal TCP/IP sockets.
When it comes to providing security with SSL, it
is desired that the same SSL session established between the server parent and
client should be used by server child and client. (we preferably do not want to
instantiate a new SSL session between the server child and the client). But the
problems I could see here are:
a. SSL objects are in memory objects, and are
lost on exec().
b. SSL objects have function pointer which would
point to the addresses in the server parent process space.
Now would the following scenario
work?
a. Instead of fork() -> exec(), the server
parent will just fork() (NO exec()).
b. The code of server child is now part of server
parent process itself. So now after fork(), instead of exec(), it is just a
function call.
c. Before fork()'ing the server parent process
will make a copy of its SSL object in shared memory.
d. The server child will use this copy in the
shared memory to communicate with the client
e. The server parent and child will use mutexes
to take care of synchronization.
So,
a. Would this be a good solution?
b. Will this work with current implementation of
OpenSSL?
c. Is it possible to clone SSL
object?
d. If yes, do I need to take any special
precautions, handle any specific scenarios like cleanup etc.?
I would really appreciate if you could help me
out.
Thank you,
~ Urjit
|
