Sharing OpenSSL BIO between two different processes

Question

I am currently doing some OpenSSL programming and I need to create an OpenSSL BIO and basically initiate an SSL connection to a remote server then pass that connection on to another process. The way I am currently planning on doing this is to 'package' the BIO into a memory buffer and send that over a socket since I need to dereference a number of pointers contained in the BIO struct and thus can't just 'cast' the BIO to a char * and send it over. Does anyone know if there is an easier way of doing this ? I saw that there are memory BIOs but after doing some research it is still unclear to me whether they're what I need or not...

Thanks

Answer 1

It is much easier to redesign your solution so that instead of passing the newly created SSL socket to another worker process, you open a regular socket pair to that process instead. Your SSL process then acts as a proxy that passes data between the socket to the worker and the SSL socket. To gain some parallelism, you can use multiple threads in the SSL process.

If you really want to go down the path of transferring the SSL socket to another process, you will need to transfer the entire SSL state, so that the encryption and decryption states are properly initialized in the worker process. This means you will need to understand which parts of the SSL context need to be transferred, as well as transfer the SSL_SESSION.