Safe to link against gem extension?
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 276
- Forks
- 200
- Avg merge
- 1d 19h
- Merged PRs (30d)
- 7
Description
Is there any way for one C extension to safely link against another?
Looking at the external symbols in openssl.so, I see the following:
$ nm tmp/x86_64-linux/openssl/3.0.2/openssl.so |
ruby -nae 'g=ARGF.grep(/ T /).map{_1.split[2]}.group_by{_1[/(\A(o|I)|_to)/]}.values.sort_by{-_1.size};
g[0].size.times{|i|puts ("%28s"*4)%g.map{_1[i]}}'
ossl_asn1_get_asn1type Init_openssl DupPKeyPtr asn1integer_to_num
ossl_bin2hex Init_ossl_asn1 DupX509CertPtr asn1str_to_str
ossl_bn_ctx_free Init_ossl_bn DupX509RevokedPtr asn1time_to_time
ossl_bn_ctx_get Init_ossl_cipher GetConfig num_to_asn1integer
ossl_bn_new Init_ossl_config GetPKeyPtr
ossl_bn_value_ptr Init_ossl_dh GetPrivPKeyPtr
ossl_buf2str Init_ossl_digest GetX509AttrPtr
ossl_cipher_new Init_ossl_dsa GetX509CertPtr
ossl_clear_error Init_ossl_ec GetX509CRLPtr
ossl_digest_new Init_ossl_engine GetX509ExtPtr
ossl_digest_update Init_ossl_hmac GetX509NamePtr
ossl_evp_get_cipherbyname Init_ossl_kdf GetX509ReqPtr
ossl_evp_get_digestbyname Init_ossl_ns_spki GetX509StorePtr
ossl_get_errors Init_ossl_ocsp
ossl_make_error Init_ossl_pkcs12
ossl_membio2str Init_ossl_pkcs7
ossl_obj2bio Init_ossl_pkey
ossl_pem_passwd_cb Init_ossl_rand
ossl_pem_passwd_value Init_ossl_rsa
ossl_pkey_check_public_key Init_ossl_ssl
ossl_pkey_export_spki Init_ossl_ssl_session
ossl_pkey_export_traditional Init_ossl_ts
ossl_pkey_new Init_ossl_x509
ossl_pkey_read_generic Init_ossl_x509attr
ossl_protect_x509_ary2sk Init_ossl_x509cert
ossl_raise Init_ossl_x509crl
ossl_str_new Init_ossl_x509ext
ossl_time_split Init_ossl_x509name
ossl_to_der Init_ossl_x509req
ossl_to_der_if_possible Init_ossl_x509revoked
ossl_verify_cb_call Init_ossl_x509store
ossl_x509_ary2sk
ossl_x509_ary2sk0
ossl_x509attr_new
ossl_x509crl_new
ossl_x509crl_sk2ary
ossl_x509ext_new
ossl_x509name_new
ossl_x509name_sk2ary
ossl_x509_new
ossl_x509revoked_new
ossl_x509_sk2ary
ossl_x509_time_adjust
If there's a safe way to do so, I'd like to use a couple of those... and maybe submit a PR with a few more.
I know of at least two gems with their own extensions linking against openssl (puma and eventmachine). It seems to me they would be able to use this gem's implementation with only a few additions to the API, if they could link against the C extension API. In particular, if there were a simple wrapper around the BIO struct, BIO_* functions, and SSL_set_bio, then those gems could be rewritten to use that.
For ease of maintenance and maximum eyeballs on such critical security infrastructure, I'd rather not have a new implementation in every gem with a C extension that needs access to openssl. (n.b. there has been at least three CVEs for gems which depend on eventmachine, all of which probably would've been avoided if eventmachine could've simply used stdlib's openssl)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the exported symbols from openssl.so and the proposed BIO, BIO_* and SSL_set_bio wrapper API. Compare the C-extension integration used by puma and eventmachine, then determine whether a supported cross-gem API can be defined; done means the safe linking approach and any required API additions are established.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, ruby
- Domain
- cryptography, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100