mt-ruby-tls 2.4.0

data/lib/mt-ruby-tls/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module MTRubyTls
+    VERSION = '2.4.0'
+end

data/lib/mt-ruby-tls.rb

@@ -0,0 +1,6 @@
+# frozen_string_literal: true
+
+require 'mt-ruby-tls/ssl'    # Loads OpenSSL using FFI
+
+module MTRubyTls
+end

data/mt-ruby-tls.gemspec

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+# -*- encoding: utf-8 -*-
+
+$:.push File.expand_path("../lib", __FILE__)
+require "mt-ruby-tls/version"
+
+Gem::Specification.new do |s|
+    s.name        = "mt-ruby-tls"
+    s.version     = MTRubyTls::VERSION
+    s.authors     = ["Giallombardo Nathan"]
+    s.email       = ["nathan.giallombardo@mapotempo.com"]
+    s.licenses    = ["MIT"]
+    s.homepage    = "https://github.com/Mapotempo/mt-ruby-tls"
+    s.summary     = "Abstract TLS for Ruby"
+    s.description = <<-EOF
+        Allows transport layers outside Ruby TCP to be secured.
+    EOF
+
+    s.add_dependency 'ffi-compiler',    '>= 1.0', '< 2.0'
+    s.add_dependency 'concurrent-ruby', '~> 1.0'
+
+    s.add_development_dependency 'rspec', '~> 3.5'
+    s.add_development_dependency 'yard',  '~> 0.9'
+
+
+    s.files = Dir["{lib}/**/*"] + %w(mt-ruby-tls.gemspec README.md)
+    s.test_files = Dir["spec/**/*"]
+    s.extra_rdoc_files = ["README.md"]
+
+    s.require_paths = ["lib"]
+end

data/spec/alpn_spec.rb

@@ -0,0 +1,415 @@
+require 'mt-ruby-tls'
+
+if MTRubyTls::SSL::ALPN_SUPPORTED
+
+    describe MTRubyTls do
+
+        describe MTRubyTls::SSL::Box do
+
+            it "should be able to negotiate a protocol" do
+                @server_data = []
+                @client_data = []
+                @interleaved = []
+
+
+                class Client3
+                    def initialize(client_data, interleaved)
+                        @client_data = client_data
+                        @interleaved = interleaved
+                        @ssl = MTRubyTls::SSL::Box.new(false, self, {
+                            protocols: ["http/1.1", :h2]
+                        })
+                    end
+
+                    attr_reader :ssl
+                    attr_accessor :stop
+                    attr_accessor :server
+
+                    def close_cb
+                        @client_data << 'client stopped'
+                        @interleaved << 'client stopped'
+                        @stop = true
+                    end
+
+                    def dispatch_cb(data)
+                        @client_data << data
+                        @interleaved << data
+                    end
+
+                    def transmit_cb(data)
+                        if not @server.started
+                            @server.started = true
+                            @server.ssl.start
+                        end
+                        @server.ssl.decrypt(data) unless @stop
+                    end
+
+                    def handshake_cb(protocol)
+                        @client_data << protocol
+                        @interleaved << 'client ready'
+
+                        sending = 'client request'
+                        @ssl.encrypt(sending) unless @stop
+                    end
+                end
+
+
+                class Server3
+                    def initialize(client, server_data, interleaved)
+                        @client = client
+                        @server_data = server_data
+                        @interleaved = interleaved
+                        @ssl = MTRubyTls::SSL::Box.new(true, self, {
+                            protocols: [:h2, "http/1.1"]
+                        })
+                    end
+
+                    attr_reader :ssl
+                    attr_accessor :started
+                    attr_accessor :stop
+
+                    def close_cb
+                        @server_data << 'server stop'
+                        @interleaved << 'server stop'
+                        @stop = true
+                    end
+
+                    def dispatch_cb(data)
+                        @server_data << data
+                        @interleaved << data
+
+                        sending = 'server response'
+                        @ssl.encrypt(sending) unless @stop
+                    end
+
+                    def transmit_cb(data)
+                        @client.ssl.decrypt(data) unless @stop
+                    end
+
+                    def handshake_cb(protocol)
+                        @server_data << protocol
+                        @interleaved << 'server ready'
+                    end
+                end
+
+
+                @client = Client3.new(@client_data, @interleaved)
+                @server = Server3.new(@client, @server_data, @interleaved)
+                @client.server = @server
+
+
+                @client.ssl.start
+                @client.ssl.cleanup
+                @server.ssl.cleanup
+
+                expect(@server_data).to eq([:h2, 'client request'])
+                expect(@client_data).to eq([:h2, 'server response'])
+                expect(@interleaved).to eq(['server ready', 'client ready', 'client request', 'server response'])
+            end
+
+
+            it "should stop the server when a protocol cannot be negotiated" do
+                @server_data = []
+                @client_data = []
+                @interleaved = []
+
+
+                class Client4
+                    def initialize(client_data, interleaved)
+                        @client_data = client_data
+                        @interleaved = interleaved
+                        @ssl = MTRubyTls::SSL::Box.new(false, self, {
+                            protocols: ["h2c"]
+                        })
+                    end
+
+                    attr_reader :ssl
+                    attr_accessor :stop
+                    attr_accessor :server
+
+                    def close_cb
+                        @client_data << 'client stopped'
+                        @interleaved << 'client stopped'
+                        @stop = true
+                    end
+
+                    def dispatch_cb(data)
+                        @client_data << data
+                        @interleaved << data
+                    end
+
+                    def transmit_cb(data)
+                        if not @server.started
+                            @server.started = true
+                            @server.ssl.start
+                        end
+                        @server.ssl.decrypt(data) unless @stop
+                    end
+
+                    def handshake_cb(protocol)
+                        @client_data << 'ready'
+                        @interleaved << 'client ready'
+
+                        sending = 'client request'
+                        @ssl.encrypt(sending) unless @stop
+                    end
+                end
+
+
+                class Server4
+                    def initialize(client, server_data, interleaved)
+                        @client = client
+                        @server_data = server_data
+                        @interleaved = interleaved
+                        @ssl = MTRubyTls::SSL::Box.new(true, self, {
+                            protocols: ["http/1.1", "h2"]
+                        })
+                    end
+
+                    attr_reader :ssl
+                    attr_accessor :started
+                    attr_accessor :stop
+
+                    def close_cb
+                        @server_data << 'server stop'
+                        @interleaved << 'server stop'
+                        @stop = true
+                    end
+
+                    def dispatch_cb(data)
+                        @server_data << data
+                        @interleaved << data
+
+                        sending = 'server response'
+                        @ssl.encrypt(sending) unless @stop
+                    end
+
+                    def transmit_cb(data)
+                        @client.ssl.decrypt(data) unless @stop
+                    end
+
+                    def handshake_cb(protocol)
+                        @server_data << 'ready'
+                        @interleaved << 'server ready'
+                    end
+                end
+
+
+                @client = Client4.new(@client_data, @interleaved)
+                @server = Server4.new(@client, @server_data, @interleaved)
+                @client.server = @server
+
+
+                @client.ssl.start
+                @client.ssl.cleanup
+                @server.ssl.cleanup
+
+                expect(@server_data).to eq(['server stop'])
+                expect(@client_data).to eq([])
+                expect(@interleaved).to eq(['server stop'])
+            end
+
+
+            it "should not stop the client if the server doesn't support ALPN" do
+                @server_data = []
+                @client_data = []
+                @interleaved = []
+
+
+                class Client5
+                    def initialize(client_data, interleaved)
+                        @client_data = client_data
+                        @interleaved = interleaved
+                        @ssl = MTRubyTls::SSL::Box.new(false, self, {
+                            protocols: ["h2c"]
+                        })
+                    end
+
+                    attr_reader :ssl
+                    attr_accessor :stop
+                    attr_accessor :server
+
+                    def close_cb
+                        @client_data << 'client stopped'
+                        @interleaved << 'client stopped'
+                        @stop = true
+                    end
+
+                    def dispatch_cb(data)
+                        @client_data << data
+                        @interleaved << data
+                    end
+
+                    def transmit_cb(data)
+                        if not @server.started
+                            @server.started = true
+                            @server.ssl.start
+                        end
+                        @server.ssl.decrypt(data) unless @stop
+                    end
+
+                    def handshake_cb(protocol)
+                        @client_data << protocol
+                        @interleaved << 'client ready'
+
+                        sending = 'client request'
+                        @ssl.encrypt(sending) unless @stop
+                    end
+                end
+
+
+                class Server5
+                    def initialize(client, server_data, interleaved)
+                        @client = client
+                        @server_data = server_data
+                        @interleaved = interleaved
+                        @ssl = MTRubyTls::SSL::Box.new(true, self)
+                    end
+
+                    attr_reader :ssl
+                    attr_accessor :started
+                    attr_accessor :stop
+
+                    def close_cb
+                        @server_data << 'server stop'
+                        @interleaved << 'server stop'
+                        @stop = true
+                    end
+
+                    def dispatch_cb(data)
+                        @server_data << data
+                        @interleaved << data
+
+                        sending = 'server response'
+                        @ssl.encrypt(sending) unless @stop
+                    end
+
+                    def transmit_cb(data)
+                        @client.ssl.decrypt(data) unless @stop
+                    end
+
+                    def handshake_cb(protocol)
+                        @server_data << protocol
+                        @interleaved << 'server ready'
+                    end
+                end
+
+
+                @client = Client5.new(@client_data, @interleaved)
+                @server = Server5.new(@client, @server_data, @interleaved)
+                @client.server = @server
+
+
+                @client.ssl.start
+                @client.ssl.cleanup
+                @server.ssl.cleanup
+
+                expect(@client_data).to eq([:failed, 'server response'])
+                expect(@server_data).to eq([nil, 'client request'])
+                expect(@interleaved).to eq(['server ready', 'client ready', 'client request', 'server response'])
+            end
+
+
+            it "should not stop the server if the client doesn't support ALPN" do
+                @server_data = []
+                @client_data = []
+                @interleaved = []
+
+
+                class Client6
+                    def initialize(client_data, interleaved)
+                        @client_data = client_data
+                        @interleaved = interleaved
+                        @ssl = MTRubyTls::SSL::Box.new(false, self)
+                    end
+
+                    attr_reader :ssl
+                    attr_accessor :stop
+                    attr_accessor :server
+
+                    def close_cb
+                        @client_data << 'client stopped'
+                        @interleaved << 'client stopped'
+                        @stop = true
+                    end
+
+                    def dispatch_cb(data)
+                        @client_data << data
+                        @interleaved << data
+                    end
+
+                    def transmit_cb(data)
+                        if not @server.started
+                            @server.started = true
+                            @server.ssl.start
+                        end
+                        @server.ssl.decrypt(data) unless @stop
+                    end
+
+                    def handshake_cb(protocol)
+                        @client_data << protocol
+                        @interleaved << 'client ready'
+
+                        sending = 'client request'
+                        @ssl.encrypt(sending) unless @stop
+                    end
+                end
+
+
+                class Server6
+                    def initialize(client, server_data, interleaved)
+                        @client = client
+                        @server_data = server_data
+                        @interleaved = interleaved
+                        @ssl = MTRubyTls::SSL::Box.new(true, self, {
+                            protocols: ["h2", "http/1.1"],
+                            fallback: "http/1.1"
+                        })
+                    end
+
+                    attr_reader :ssl
+                    attr_accessor :started
+                    attr_accessor :stop
+
+                    def close_cb
+                        @server_data << 'server stop'
+                        @interleaved << 'server stop'
+                        @stop = true
+                    end
+
+                    def dispatch_cb(data)
+                        @server_data << data
+                        @interleaved << data
+
+                        sending = 'server response'
+                        @ssl.encrypt(sending) unless @stop
+                    end
+
+                    def transmit_cb(data)
+                        @client.ssl.decrypt(data) unless @stop
+                    end
+
+                    def handshake_cb(protocol)
+                        @server_data << protocol
+                        @interleaved << 'server ready'
+                    end
+                end
+
+
+                @client = Client6.new(@client_data, @interleaved)
+                @server = Server6.new(@client, @server_data, @interleaved)
+                @client.server = @server
+
+
+                @client.ssl.start
+                @client.ssl.cleanup
+                @server.ssl.cleanup
+
+
+                expect(@server_data).to eq([:"http/1.1", 'client request'])
+                expect(@client_data).to eq([nil, 'server response'])
+                expect(@interleaved).to eq(['server ready', 'client ready', 'client request', 'server response'])
+            end
+        end
+    end
+end

data/spec/client.crt

@@ -0,0 +1,31 @@
+-----BEGIN CERTIFICATE-----
+MIIFRDCCAywCAQEwDQYJKoZIhvcNAQEFBQAwaDELMAkGA1UEBhMCRU0xFTATBgNV
+BAgTDEV2ZW50TWFjaGluZTEVMBMGA1UEChMMRXZlbnRNYWNoaW5lMRQwEgYDVQQL
+EwtEZXZlbG9wbWVudDEVMBMGA1UEAxMMRXZlbnRNYWNoaW5lMB4XDTA5MDMyOTAy
+MzE0NloXDTEwMDMyOTAyMzE0NlowaDELMAkGA1UEBhMCRU0xFTATBgNVBAgTDEV2
+ZW50TWFjaGluZTEVMBMGA1UEChMMRXZlbnRNYWNoaW5lMRQwEgYDVQQLEwtEZXZl
+bG9wbWVudDEVMBMGA1UEAxMMRXZlbnRNYWNoaW5lMIICIjANBgkqhkiG9w0BAQEF
+AAOCAg8AMIICCgKCAgEAv1FSOIX1z7CQtVBFlrB0A3/V29T+22STKKmiRWYkKL5b
++hkrp9IZ5J4phZHgUVM2VDPOO2Oc2PU6dlGGZISg+UPERunTogxQKezCV0vcE9cK
+OwzxCFDRvv5rK8aKMscfBLbNKocAXywuRRQmdxPiVRzbyPrl+qCr/EDLXAX3D77l
+S8n2AwDg19VyI+IgFUE+Dy5e1eLoY6nV+Mq+vNXdn3ttF3t+ngac5pj5Q9h+pD5p
+67baDHSnf/7cy2fa/LKrLolVHQR9G2K6cEfeM99NtcsMbkoPs4iI3FA05OVTQHXg
+C8C8cRxrb9APl95I/ep65OIaCJgcdYxJ3QD3qOtQo6/NQsGnjbyiUxaEpjfqyT1N
+uzWD81Q8uXGNS8yD6dDynt/lseBjyp2nfC3uQ5fY18VdIcu0MJ9pezBUKrNuhlsy
+XXEZ2DXj4sY8QOvIcBqSB/zmS1nGEK55xrtkaiaNrY8fe8wRVpcPLxy+P225NFw+
+B69FJRA0Lj6Jt9BM4hV/3MSIEWwTVhuw4E02ywDYTzz1wq3ITf0tsbIPn0hXQMxD
+ohhAoKioM6u+yHtqsxD0eYaAWmHTVn5oDvOSGpvCpBfWHyA7FP5UQak0fKABEAgK
+iQYEnb294AXwXymJttfGTIV/Ne4tLN5dIpNma8UO8rlThlcr6xnTQDbR3gkTDRsC
+AwEAATANBgkqhkiG9w0BAQUFAAOCAgEAj7J8fy1LUWoVWnrXDAC9jwJ1nI/YjoSU
+6ywke3o04+nZC5S+dPnuVy+HAwsU940CoNvP6RStI/bH6JL+NIqEFmwM3M8xIEWV
+MYVPkfvQUxxGvDnaY7vv93u+6Q77HV3qlhAQBHChyuXyO7TG3+WzsiT9AnBNtAP0
+4jClt5kCAQXLO/p0SFEZQ8Ru9SM8d1i73Z0VDVzs8jYWlBhiherSgbw1xK4wBOpJ
+43XmjZsBSrDpiAXd07Ak3UL2GjfT7eStgebL3UIe39ThE/s/+l43bh0M6WbOBvyQ
+i/rZ50kd1GvN0xnZhtv07hIJWO85FGWi7Oet8AzdUZJ17v1Md/f2vdhPVTFN9q+w
+mQ6LxjackqCvaJaQfBEbqsn2Tklxk4tZuDioiQbOElT2e6vljQVJWIfNx38Ny2LM
+aiXQPQu+4CI7meAh5gXM5nyJGbZvRPsxj89CqYzyHCYs5HBP3AsviBvn26ziOF+c
+544VmHd9HkIv8UTC29hh+R64RlgMQQQdaXFaUrFPTs/do0k8n/c2bPc0iTdfi5Q2
+gq6Vi8q6Ay5wGgTtRRbn/mWKuCFjEh94z6pF9Xr06NX0PuEOdf+Ls9vI5vz6G0w6
+0Li7devEN7EKBY+7Mcjg918yq9i5tEiMkUgT68788t3fTC+4iUQ5fDtdrHsaOlIR
+8bs/XQVNE/s=
+-----END CERTIFICATE-----

data/spec/client.key

@@ -0,0 +1,51 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIJKAIBAAKCAgEAv1FSOIX1z7CQtVBFlrB0A3/V29T+22STKKmiRWYkKL5b+hkr
+p9IZ5J4phZHgUVM2VDPOO2Oc2PU6dlGGZISg+UPERunTogxQKezCV0vcE9cKOwzx
+CFDRvv5rK8aKMscfBLbNKocAXywuRRQmdxPiVRzbyPrl+qCr/EDLXAX3D77lS8n2
+AwDg19VyI+IgFUE+Dy5e1eLoY6nV+Mq+vNXdn3ttF3t+ngac5pj5Q9h+pD5p67ba
+DHSnf/7cy2fa/LKrLolVHQR9G2K6cEfeM99NtcsMbkoPs4iI3FA05OVTQHXgC8C8
+cRxrb9APl95I/ep65OIaCJgcdYxJ3QD3qOtQo6/NQsGnjbyiUxaEpjfqyT1NuzWD
+81Q8uXGNS8yD6dDynt/lseBjyp2nfC3uQ5fY18VdIcu0MJ9pezBUKrNuhlsyXXEZ
+2DXj4sY8QOvIcBqSB/zmS1nGEK55xrtkaiaNrY8fe8wRVpcPLxy+P225NFw+B69F
+JRA0Lj6Jt9BM4hV/3MSIEWwTVhuw4E02ywDYTzz1wq3ITf0tsbIPn0hXQMxDohhA
+oKioM6u+yHtqsxD0eYaAWmHTVn5oDvOSGpvCpBfWHyA7FP5UQak0fKABEAgKiQYE
+nb294AXwXymJttfGTIV/Ne4tLN5dIpNma8UO8rlThlcr6xnTQDbR3gkTDRsCAwEA
+AQKCAgB495RDRQB9x6hX3F+DviI8rDGug+h5FAiwJ0IBG2o1kNdbNVsTC5dvpEmg
+uPHaugCaEP+PMZbU34mNklKlb+7QbPbH18UGqz5so9TlmYOXz9oaKD6nAWL9nqRo
+02pCXQDR3DuxbhbgFnFTIECJ/jqXkl2toGaVp83W+6kZkHP8srkMyLASihWgosc+
+xRWAGvaAZtNz7br+eT5fxuH/SEKPOl1qAZ23kXrXm1XQfizk8MnMTptkUMYv+hfl
+TM98BASUsiTs6g+opy43HFn09naOQcqkWZO/8s6Gbvhi2lVfZqi5Ba6g3lVYJ3gU
+kGoako4N9qB7WqJz+LYjVR9C4TbkkJ9OD6ArwGAx5IIzC3XKSxCyY/pUn4YumPhY
+fjvY/km54TBtx/isS1TAgjSgDUxbzrfbkh7afOXSOniy9bWJMgNqHF61dqxWxmUg
+F5Tch9zH3qFFVkXpYzDU/R8ZV+CRouCvhn0eZYDh8IqIAwjH0VjkxjPyQtrdrMd3
+gDKMVKoY31EOMLZzv8a0prjpr15A+uw30tT336qb3fofks4pZKUJw8ru9jJVir2p
++RML6iUHCmIeceF7/N1meooSMLPJe0xgKeMb9M4Wtd/et2UNVtP8nCDG622rf2a0
+F/EudXuFgc3FB8nXRw9TCkw9xKQff38edG5xPFUEgqObbVl5YQKCAQEA5DDKGOmp
+EO5Zuf/kZfG6/AMMYwAuv1HrYTV2w/HnI3tyQ34Xkeqo+I/OqmRk68Ztxw4Kx1So
+SRavkotrlWhhDpl2+Yn1BjkHktSoOdf9gJ9z9llkLmbOkBjmupig1NUB7fq/4y2k
+MdqJXDy3uVKHJ97gxdIheMTyHiKuMJPnuT5lZtlT210Ig82P7sLQb/sgCfKVFTr0
+Z3haQ5/tBNKjq+igT4nMBWupOTD1q2GeZLIZACnmnUIhvu+3/bm0l+wiCB0DqF0T
+Wy9tlL3fqQSCqzevL7/k5Lg6tJTaP/XYePB73TsOtAXgIaoltXgRBsBUeE1eaODx
+kMT6E1PPtn7EqQKCAQEA1qImmTWGqhKICrwje40awPufFtZ/qXKVCN/V+zYsrJV1
+EnZpUDM+zfitlQCugnrQVHSpgfekI6mmVkmogO3fkNjUFTq+neg7IHOUHnqotx+3
+NMqIsyFInGstu9mfPd26fzZjUtx5wKF38LDTIJJAEJ83U3UpPBfpwKmiOGDXOa54
+2i4em/bb/hrQR6JySruZYLi0fXnGI5ZOfpkHgC/KOFkKNKAg2oh4B9qo7ACyiSNk
+yojb2mmn6g1OLPxi7wGUSrkS1HQq4an6RZ+eUO0HXVWag0QStdQ91M9IrIHgSBBG
+0e86Ar6jtD579gqsbz4ySpI/FqEI9obTC+E1/b0aIwKCAQAGz334qGCnZLXA22ZR
+tJlEFEM2YTcD9snzqMjWqE2hvXl3kjfZ3wsUABbG9yAb+VwlaMHhmSE8rTSoRwj6
++JaM/P+UCw4JFYKoWzh6IXwrbpbjb1+SEvdvTY71WsDSGVlpZOZ9PUt9QWyAGD/T
+hCcMhZZn0RG2rQoc5CQWxxNPcBFOtIXQMkKizGvTUHUwImqeYWMZsxzASdNH2WoV
+jsPbyaGfPhmcv83ZKyDp8IvtrXMZkiaT4vlm3Xi8VeKR9jY9z7/gMob1XcEDg3c9
+cCkGOy87WZrXSLhX02mAJzJCycqom66gqNw7pPxjIiY/8VWUEZsTvkL3cymTkhjM
+9ZOhAoIBAGUaNqJe01NTrV+ZJgGyAxM6s8LXQYV5IvjuL2bJKxwUvvP2cT9FFGWD
+qYiRrKJr5ayS07IUC+58oIzu33/0DSa27JgfduD9HrT3nKMK1mSEfRFSAjiXChQc
+bIubRGapBoub/AdxMazqoovvT1R9b84kobQfcVAMV6DYh0CVZWyXYfgsV2DSVOiK
+iufjfoDzg5lLCEI+1XW3/LunrB/W4yPN1X/amf8234ublYyt+2ucD4NUGnP05xLa
+N6P7M0MwdEEKkvMe0YBBSFH5kWK/dIOjqkgBDes20fVnuuz/tL1dZW7IiIP4dzaV
+ZGEOwBEatCfqYetv6b/u3IUxDfS7Wg8CggEBALoOwkn5LGdQg+bpdZAKJspGnJWL
+Kyr9Al2tvgc69rxfpZqS5eDLkYYCzWPpspSt0Axm1O7xOUDQDt42luaLNGJzHZ2Q
+Hn0ZNMhyHpe8d8mIQngRjD+nuLI/uFUglPzabDOCOln2aycjg1mA6ecXP1XMEVbu
+0RB/0IE36XTMfZ+u9+TRjkBLpmUaX1FdIQQWfwUou/LfaXotoQlhSGAcprLrncuJ
+T44UATYEgO/q9pMM33bdE3eBYZHoT9mSvqoLCN4s0LuwOYItIxLKUj0GulL0VQOI
+SZi+0A1c8cVDXgApkBrWPDQIR9JS4de0gW4hnDoUvHtUc2TYPRnz6N9MtFY=
+-----END RSA PRIVATE KEY-----

data/spec/comms_spec.rb

@@ -0,0 +1,120 @@
+require 'mt-ruby-tls'
+
+describe MTRubyTls do
+
+    describe MTRubyTls::SSL::Box do
+
+        it "fails when passed an unsupported TLS version" do
+            expect {
+                MTRubyTls::SSL::Box.new(false, nil, version: :TLS1_4)
+            }.to raise_error(/is unsupported/)
+        end
+
+        it "succeeds when passed a supported TLS version" do
+            MTRubyTls::SSL::Box.new(false, nil, version: :TLS1_2) if MTRubyTls::SSL::VERSION_SUPPORTED
+        end
+
+        it "should be able to send and receive encrypted comms" do
+            @server_data = []
+            @client_data = []
+            @interleaved = []
+
+
+            class Client1
+                def initialize(client_data, interleaved)
+                    @client_data = client_data
+                    @interleaved = interleaved
+                    @ssl = MTRubyTls::SSL::Box.new(false, self)
+                end
+
+                attr_reader :ssl
+                attr_accessor :stop
+                attr_accessor :server
+
+                def close_cb
+                    @client_data << 'client stopped'
+                    @interleaved << 'client stopped'
+                    @stop = true
+                end
+
+                def dispatch_cb(data)
+                    @client_data << data
+                    @interleaved << data
+                end
+
+                def transmit_cb(data)
+                    if not @server.started
+                        @server.started = true
+                        @server.ssl.start
+                    end
+                    @server.ssl.decrypt(data) unless @stop
+                end
+
+                def handshake_cb(protocol)
+                    @client_data << 'ready'
+                    @interleaved << 'client ready'
+
+                    sending = 'client request'
+                    @ssl.encrypt(sending) unless @stop
+                end
+            end
+
+
+            class Server1
+                def initialize(client, server_data, interleaved)
+                    @client = client
+                    @server_data = server_data
+                    @interleaved = interleaved
+                    @ssl = MTRubyTls::SSL::Box.new(true, self)
+                end
+
+                attr_reader :ssl
+                attr_accessor :started
+                attr_accessor :stop
+
+                def close_cb
+                    @server_data << 'server stop'
+                    @interleaved << 'server stop'
+                    @stop = true
+                end
+
+                def dispatch_cb(data)
+                    @server_data << data
+                    @interleaved << data
+
+                    sending = 'server response'
+                    @ssl.encrypt(sending) unless @stop
+                end
+
+                def transmit_cb(data)
+                    @client.ssl.decrypt(data) unless @stop
+                end
+
+                def handshake_cb(protocol)
+                    @server_data << 'ready'
+                    @interleaved << 'server ready'
+                end
+            end
+
+
+            @client = Client1.new(@client_data, @interleaved)
+            @server = Server1.new(@client, @server_data, @interleaved)
+            @client.server = @server
+
+
+            @client.ssl.start
+            @client.ssl.cleanup
+            @server.ssl.cleanup
+
+
+            # Calls to encrypt should not cause crashes after cleanup
+            @server.ssl.encrypt('server response')
+            @client.ssl.encrypt('client request')
+
+            expect(@server_data).to eq(['ready', 'client request'])
+            expect(@client_data).to eq(['ready', 'server response'])
+            expect(@interleaved).to eq(['server ready', 'client ready', 'client request', 'server response'])
+        end
+    end
+end
+