-
Notifications
You must be signed in to change notification settings - Fork 33
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Extract and mixin cert ops from server module #8
Extract and mixin cert ops from server module #8
Conversation
Generic SSL routines can be in their own module, for import by consumers without having to drag the entire server infrastructure in with it. This pulls the certificate methods into Rex::Socket::Ssl for use by consumers, and includes the module in Rex::Socket::SslTcpServer as the initial consumer.
lib/rex/socket/ssl.rb
Outdated
module Rex::Socket::Ssl | ||
|
||
@@loaded_openssl = false | ||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
do you think we really need to continue pretending openssl is optional? I don't think Ruby even compiles without it anymore. I'd suggest removing this entire @@loaded_openssl path
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Done sir done.
Rex utilizes a class variable in the ThreadFactory which permits passing a thread factory down from consumers so long as it matches the API. The benefit of such an arrangement is that the consumer is responsible for the dependencies of the provider object, which in turn lets Rex keep its deps to a minimum. Following that pattern, Rex::Socket::Ssl gets a @@cert_provider variable which by default uses the existing module methods now attached to a CertProvider namespace in order to create certs and attributes. Msf can now designate its own provider at runtime in order to give users greater control, entropy, etc, without weighing down this gem or obsoleting useful examples of how Rex::Text can be utilized by consumers. Also added minor cleanup of prior commit replacing instance method calls to the module methods referencing SslTcpServer with just the Ssl namespace (which in turn proxies calls to the @@cert_provider). Testing: None, this is part of a larger effort spanning a couple of repos.
MRI is compiled with OpenSSL by default, so the graceful failure to load OpenSSL is basically a dead codepath. Remove the openssl loading and checking blocks, and require it as a normal gem. Note: this might create problems with other interpreters, so we might need to revisit this approach as a way for them to load the runtime-specific ssl gems down the road.
Well, apprently New England and the midwest arent the only places frozen over. Hell's boiler must be broken because these all claim to pass CI. :) Think i'm done here for the time being, wiring up the provider in Msf currently so expect a related PR in that repo shortly. Probably alright to merge now if everyone with eyes on agrees. |
Yeah, that's a good sign Thanks! |
Generic SSL routines can be in their own module, for import by
consumers without having to drag the entire server infrastructure
in with it.
This pulls the certificate methods into Rex::Socket::Ssl for use
by consumers, and includes the module in Rex::Socket::SslTcpServer
as the initial consumer.