ruby-tls 1.0.0

data/ext/tls/ssl.h

@@ -0,0 +1,130 @@
+/*****************************************************************************
+
+$Id$
+
+File:     ssl.h
+Date:     30Apr06
+
+Copyright (C) 2006-07 by Francis Cianfrocca. All Rights Reserved.
+Gmail: blackhedd
+
+This program is free software; you can redistribute it and/or modify
+it under the terms of either: 1) the GNU General Public License
+as published by the Free Software Foundation; either version 2 of the
+License, or (at your option) any later version; or 2) Ruby's License.
+
+See the file COPYING for complete licensing information.
+
+*****************************************************************************/
+
+
+#ifndef __SslBox__H_
+#define __SslBox__H_
+
+#include <iostream>
+#include <string>
+
+#include <openssl/ssl.h>
+#include <openssl/err.h>
+
+#include <assert.h>
+
+#include "page.h"
+
+using namespace std;
+
+
+/******************
+class SslContext_t
+******************/
+
+class SslContext_t
+{
+	public:
+		SslContext_t (bool is_server, const string &privkeyfile, const string &certchainfile);
+		virtual ~SslContext_t();
+
+	private:
+		static bool bLibraryInitialized;
+
+	private:
+		bool bIsServer;
+		SSL_CTX *pCtx;
+
+		EVP_PKEY *PrivateKey;
+		X509 *Certificate;
+
+	friend class SslBox_t;
+};
+
+
+
+
+typedef struct tls_state_s tls_state_t;
+
+
+
+/**************
+class SslBox_t
+**************/
+
+class SslBox_t
+{
+	public:
+		SslBox_t (tls_state_t *tls_state, bool is_server, const string &privkeyfile, const string &certchainfile, bool verify_peer);
+		virtual ~SslBox_t();
+
+		int PutPlaintext (const char*, int);
+		int GetPlaintext (char*, int);
+
+		bool PutCiphertext (const char*, int);
+		bool CanGetCiphertext();
+		int GetCiphertext (char*, int);
+		bool IsHandshakeCompleted() { return bHandshakeCompleted; }
+
+		X509 *GetPeerCert();
+
+		void Shutdown();
+
+	protected:
+		SslContext_t *Context;
+
+		bool bIsServer;
+		bool bHandshakeCompleted;
+		bool bVerifyPeer;
+		SSL *pSSL;
+		BIO *pbioRead;
+		BIO *pbioWrite;
+
+		PageList OutboundQ;
+};
+
+
+typedef void (*ssl_close_cb)(const tls_state_t*);
+typedef int (*ssl_verify_cb)(const tls_state_t*, const char *cert);
+typedef void (*ssl_dispatch_cb)(const tls_state_t*, const char *buffer, int size);
+typedef void (*ssl_transmit_cb)(const tls_state_t*, const char *buffer, int size);
+typedef void (*ssl_handshake_cb)(const tls_state_t*);
+
+struct tls_state_s {
+	int handshake_signaled;
+
+	ssl_close_cb close_cb;
+	ssl_verify_cb verify_cb;
+	ssl_dispatch_cb dispatch_cb;
+	ssl_transmit_cb transmit_cb;
+	ssl_handshake_cb handshake_cb;
+
+	SslBox_t* SslBox;
+};
+
+
+extern "C" int ssl_verify_wrapper(int preverify_ok, X509_STORE_CTX *ctx);
+
+extern "C" void start_tls(tls_state_t *tls_state, bool bIsServer, const char *PrivateKeyFilename, const char *CertChainFilename, bool bSslVerifyPeer);
+extern "C" void decrypt_data(tls_state_t *tls_state, const char *buffer, int size);
+extern "C" void encrypt_data(tls_state_t *tls_state, const char *data, int length);
+extern "C" X509 *get_peer_cert(tls_state_t *tls_state);
+
+
+#endif // __SslBox__H_

data/lib/ruby-tls.rb

@@ -0,0 +1,7 @@
+require "ffi"       # Bindings to C libraries
+
+require "ruby-tls/ext"    # Loads the ext using FFI
+require "ruby-tls/connection"    # The ruby abstraction
+
+module RubyTls
+end

data/lib/ruby-tls/connection.rb

@@ -0,0 +1,121 @@
+
+module RubyTls
+    class Connection
+        CALLBACKS = [:close_cb, :verify_cb, :dispatch_cb, :transmit_cb, :handshake_cb]
+
+        #
+        # Initializes the State instance.
+        #
+        def initialize(callback_obj = nil)
+            @state = ::RubyTls::State.new
+            @callbacks = {} # so GC doesn't clean them up on java
+            @started = false
+
+            if not callback_obj.nil?
+                CALLBACKS.each do |callback|
+                    self.__send__(callback, &callback_obj.method(callback)) if callback_obj.respond_to? callback
+                end
+            end
+
+            yield self if block_given?
+        end
+
+        def close_cb(&block)
+            cb = Callback.new(@callbacks, &block)
+            @callbacks[:close_cb] = cb
+            @state[:close_cb] = cb
+        end
+
+        def verify_cb
+            cb = ::FFI::Function.new(:int, [::RubyTls::State.ptr, :string]) do |state, cert|
+                begin
+                    yield(cert) == true ? 1 : 0
+                rescue
+                    # TODO:: Provide some debugging output
+                    0
+                end
+            end
+            @callbacks[:verify_cb] = cb
+            @state[:verify_cb] = cb
+        end
+
+        def dispatch_cb(&block)
+            cb = DataCallback.new(@callbacks, &block)
+            @callbacks[:dispatch_cb] = cb
+            @state[:dispatch_cb] = cb
+        end
+
+        def transmit_cb(&block)
+            cb = DataCallback.new(@callbacks, &block)
+            @callbacks[:transmit_cb] = cb
+            @state[:transmit_cb] = cb
+        end
+
+        def handshake_cb(&block)
+            cb = Callback.new(@callbacks, &block)
+            @callbacks[:handshake_cb] = cb
+            @state[:handshake_cb] = cb
+        end
+
+
+        def start(args = {})
+            return if @started
+
+            server, priv_key, cert_chain, verify_peer = args.values_at(:server, :private_key_file, :cert_chain_file, :verify_peer)
+            [priv_key, cert_chain].each do |file|
+                next if file.nil? or file.empty?
+                raise FileNotFoundException,
+                "Could not find #{file} to start tls" unless File.exists? file
+            end
+
+            @started = true
+            ::RubyTls.start_tls(@state, server || false, priv_key || '', cert_chain || '', verify_peer || !!@callbacks[:verify_cb])
+        end
+
+        def encrypt(data)
+            return unless @started
+            ::RubyTls.encrypt_data(@state, data, data.length)
+        end
+
+        def decrypt(data)
+            return unless @started
+            ::RubyTls.decrypt_data(@state, data, data.length)
+        end
+
+
+        protected
+
+
+        class Callback < ::FFI::Function
+            #
+            # Creates a new Parser callback.
+            #
+            def self.new(callbacks)
+                super(:void, [::RubyTls::State.ptr]) do |state|
+                    begin
+                        yield
+                    rescue => e
+                        # shutdown the connection on error
+                        # TODO:: Provide some debugging output
+                        callbacks[:close_cb].call state
+                    end
+                end
+            end
+        end
+
+        class DataCallback < ::FFI::Function
+            def self.new(callbacks)
+                super(:void, [::RubyTls::State.ptr, :pointer, :int]) do |state, buffer, length|
+                    begin
+                        data = buffer.get_bytes(0, length)
+                        yield(data)
+                    rescue => e
+                        # shutdown the connection on error
+                        # TODO:: Provide some debugging output
+                        callbacks[:close_cb].call state
+                    end
+                end
+            end
+        end
+    end
+end

data/lib/ruby-tls/ext.rb

@@ -0,0 +1,32 @@
+require 'ffi'
+require 'ffi-compiler/loader'
+
+module RubyTls
+    extend FFI::Library
+    ffi_lib FFI::Compiler::Loader.find('ruby-tls-ext')
+
+
+    callback :ssl_close_cb,     [:pointer],                 :void
+    callback :ssl_verify_cb,    [:pointer, :string],        :int
+    callback :ssl_dispatch_cb,  [:pointer, :pointer, :int], :void
+    callback :ssl_transmit_cb,  [:pointer, :pointer, :int], :void
+    callback :ssl_handshake_cb, [:pointer],                 :void
+
+    class State < FFI::Struct
+        layout  :handshake_sig, :int,
+
+                :close_cb,      :ssl_close_cb,
+                :verify_cb,     :ssl_verify_cb,     # Optional
+                :dispatch_cb,   :ssl_dispatch_cb,
+                :transmit_cb,   :ssl_transmit_cb,
+                :handshake_cb,  :ssl_handshake_cb,  # Optional unless first to send data
+
+                :ssl_box,       :pointer
+    end
+
+
+    attach_function :start_tls,     [State.by_ref, :bool, :string, :string, :bool],  :void, :blocking => true
+    attach_function :decrypt_data,  [State.by_ref, :pointer, :int],                  :void, :blocking => true
+    attach_function :encrypt_data,  [State.by_ref, :pointer, :int],                  :void, :blocking => true
+    #attach_function :get_peer_cert, [], :int, :blocking => true
+end

data/lib/ruby-tls/version.rb

@@ -0,0 +1,3 @@
+module RubyTls
+    VERSION = "1.0.0"
+end

data/ruby-tls.gemspec

@@ -0,0 +1,32 @@
+# -*- encoding: utf-8 -*-
+$:.push File.expand_path("../lib", __FILE__)
+require "ruby-tls/version"
+
+Gem::Specification.new do |s|
+    s.name        = "ruby-tls"
+    s.version     = RubyTls::VERSION
+    s.authors     = ["Stephen von Takach"]
+    s.email       = ["steve@cotag.me"]
+    s.license     = 'MIT'
+    s.homepage    = "https://github.com/cotag/ruby-tls"
+    s.summary     = "Abstract TLS for Ruby"
+    s.description = <<-EOF
+        Allows transport layers outside Ruby TCP be secured.
+    EOF
+
+
+    s.add_dependency 'ffi-compiler', '>= 0.0.2'
+    s.add_dependency 'rake'
+
+    s.add_development_dependency 'rspec'
+    s.add_development_dependency 'yard'
+
+
+    s.files = Dir["{lib}/**/*"] + %w(Rakefile ruby-tls.gemspec README.md EM-LICENSE)
+    s.files += ["ext/tls/ssl.cpp", "ext/tls/ssl.h", "ext/tls/page.cpp", "ext/tls/page.h"]
+    s.test_files = Dir["spec/**/*"]
+    s.extra_rdoc_files = ["README.md"]
+
+    s.extensions << "ext/Rakefile"
+    s.require_paths = ["lib"]
+end

data/spec/client.crt

@@ -0,0 +1,31 @@
+-----BEGIN CERTIFICATE-----
+MIIFRDCCAywCAQEwDQYJKoZIhvcNAQEFBQAwaDELMAkGA1UEBhMCRU0xFTATBgNV
+BAgTDEV2ZW50TWFjaGluZTEVMBMGA1UEChMMRXZlbnRNYWNoaW5lMRQwEgYDVQQL
+EwtEZXZlbG9wbWVudDEVMBMGA1UEAxMMRXZlbnRNYWNoaW5lMB4XDTA5MDMyOTAy
+MzE0NloXDTEwMDMyOTAyMzE0NlowaDELMAkGA1UEBhMCRU0xFTATBgNVBAgTDEV2
+ZW50TWFjaGluZTEVMBMGA1UEChMMRXZlbnRNYWNoaW5lMRQwEgYDVQQLEwtEZXZl
+bG9wbWVudDEVMBMGA1UEAxMMRXZlbnRNYWNoaW5lMIICIjANBgkqhkiG9w0BAQEF
+AAOCAg8AMIICCgKCAgEAv1FSOIX1z7CQtVBFlrB0A3/V29T+22STKKmiRWYkKL5b
++hkrp9IZ5J4phZHgUVM2VDPOO2Oc2PU6dlGGZISg+UPERunTogxQKezCV0vcE9cK
+OwzxCFDRvv5rK8aKMscfBLbNKocAXywuRRQmdxPiVRzbyPrl+qCr/EDLXAX3D77l
+S8n2AwDg19VyI+IgFUE+Dy5e1eLoY6nV+Mq+vNXdn3ttF3t+ngac5pj5Q9h+pD5p
+67baDHSnf/7cy2fa/LKrLolVHQR9G2K6cEfeM99NtcsMbkoPs4iI3FA05OVTQHXg
+C8C8cRxrb9APl95I/ep65OIaCJgcdYxJ3QD3qOtQo6/NQsGnjbyiUxaEpjfqyT1N
+uzWD81Q8uXGNS8yD6dDynt/lseBjyp2nfC3uQ5fY18VdIcu0MJ9pezBUKrNuhlsy
+XXEZ2DXj4sY8QOvIcBqSB/zmS1nGEK55xrtkaiaNrY8fe8wRVpcPLxy+P225NFw+
+B69FJRA0Lj6Jt9BM4hV/3MSIEWwTVhuw4E02ywDYTzz1wq3ITf0tsbIPn0hXQMxD
+ohhAoKioM6u+yHtqsxD0eYaAWmHTVn5oDvOSGpvCpBfWHyA7FP5UQak0fKABEAgK
+iQYEnb294AXwXymJttfGTIV/Ne4tLN5dIpNma8UO8rlThlcr6xnTQDbR3gkTDRsC
+AwEAATANBgkqhkiG9w0BAQUFAAOCAgEAj7J8fy1LUWoVWnrXDAC9jwJ1nI/YjoSU
+6ywke3o04+nZC5S+dPnuVy+HAwsU940CoNvP6RStI/bH6JL+NIqEFmwM3M8xIEWV
+MYVPkfvQUxxGvDnaY7vv93u+6Q77HV3qlhAQBHChyuXyO7TG3+WzsiT9AnBNtAP0
+4jClt5kCAQXLO/p0SFEZQ8Ru9SM8d1i73Z0VDVzs8jYWlBhiherSgbw1xK4wBOpJ
+43XmjZsBSrDpiAXd07Ak3UL2GjfT7eStgebL3UIe39ThE/s/+l43bh0M6WbOBvyQ
+i/rZ50kd1GvN0xnZhtv07hIJWO85FGWi7Oet8AzdUZJ17v1Md/f2vdhPVTFN9q+w
+mQ6LxjackqCvaJaQfBEbqsn2Tklxk4tZuDioiQbOElT2e6vljQVJWIfNx38Ny2LM
+aiXQPQu+4CI7meAh5gXM5nyJGbZvRPsxj89CqYzyHCYs5HBP3AsviBvn26ziOF+c
+544VmHd9HkIv8UTC29hh+R64RlgMQQQdaXFaUrFPTs/do0k8n/c2bPc0iTdfi5Q2
+gq6Vi8q6Ay5wGgTtRRbn/mWKuCFjEh94z6pF9Xr06NX0PuEOdf+Ls9vI5vz6G0w6
+0Li7devEN7EKBY+7Mcjg918yq9i5tEiMkUgT68788t3fTC+4iUQ5fDtdrHsaOlIR
+8bs/XQVNE/s=
+-----END CERTIFICATE-----

data/spec/client.key

@@ -0,0 +1,51 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIJKAIBAAKCAgEAv1FSOIX1z7CQtVBFlrB0A3/V29T+22STKKmiRWYkKL5b+hkr
+p9IZ5J4phZHgUVM2VDPOO2Oc2PU6dlGGZISg+UPERunTogxQKezCV0vcE9cKOwzx
+CFDRvv5rK8aKMscfBLbNKocAXywuRRQmdxPiVRzbyPrl+qCr/EDLXAX3D77lS8n2
+AwDg19VyI+IgFUE+Dy5e1eLoY6nV+Mq+vNXdn3ttF3t+ngac5pj5Q9h+pD5p67ba
+DHSnf/7cy2fa/LKrLolVHQR9G2K6cEfeM99NtcsMbkoPs4iI3FA05OVTQHXgC8C8
+cRxrb9APl95I/ep65OIaCJgcdYxJ3QD3qOtQo6/NQsGnjbyiUxaEpjfqyT1NuzWD
+81Q8uXGNS8yD6dDynt/lseBjyp2nfC3uQ5fY18VdIcu0MJ9pezBUKrNuhlsyXXEZ
+2DXj4sY8QOvIcBqSB/zmS1nGEK55xrtkaiaNrY8fe8wRVpcPLxy+P225NFw+B69F
+JRA0Lj6Jt9BM4hV/3MSIEWwTVhuw4E02ywDYTzz1wq3ITf0tsbIPn0hXQMxDohhA
+oKioM6u+yHtqsxD0eYaAWmHTVn5oDvOSGpvCpBfWHyA7FP5UQak0fKABEAgKiQYE
+nb294AXwXymJttfGTIV/Ne4tLN5dIpNma8UO8rlThlcr6xnTQDbR3gkTDRsCAwEA
+AQKCAgB495RDRQB9x6hX3F+DviI8rDGug+h5FAiwJ0IBG2o1kNdbNVsTC5dvpEmg
+uPHaugCaEP+PMZbU34mNklKlb+7QbPbH18UGqz5so9TlmYOXz9oaKD6nAWL9nqRo
+02pCXQDR3DuxbhbgFnFTIECJ/jqXkl2toGaVp83W+6kZkHP8srkMyLASihWgosc+
+xRWAGvaAZtNz7br+eT5fxuH/SEKPOl1qAZ23kXrXm1XQfizk8MnMTptkUMYv+hfl
+TM98BASUsiTs6g+opy43HFn09naOQcqkWZO/8s6Gbvhi2lVfZqi5Ba6g3lVYJ3gU
+kGoako4N9qB7WqJz+LYjVR9C4TbkkJ9OD6ArwGAx5IIzC3XKSxCyY/pUn4YumPhY
+fjvY/km54TBtx/isS1TAgjSgDUxbzrfbkh7afOXSOniy9bWJMgNqHF61dqxWxmUg
+F5Tch9zH3qFFVkXpYzDU/R8ZV+CRouCvhn0eZYDh8IqIAwjH0VjkxjPyQtrdrMd3
+gDKMVKoY31EOMLZzv8a0prjpr15A+uw30tT336qb3fofks4pZKUJw8ru9jJVir2p
++RML6iUHCmIeceF7/N1meooSMLPJe0xgKeMb9M4Wtd/et2UNVtP8nCDG622rf2a0
+F/EudXuFgc3FB8nXRw9TCkw9xKQff38edG5xPFUEgqObbVl5YQKCAQEA5DDKGOmp
+EO5Zuf/kZfG6/AMMYwAuv1HrYTV2w/HnI3tyQ34Xkeqo+I/OqmRk68Ztxw4Kx1So
+SRavkotrlWhhDpl2+Yn1BjkHktSoOdf9gJ9z9llkLmbOkBjmupig1NUB7fq/4y2k
+MdqJXDy3uVKHJ97gxdIheMTyHiKuMJPnuT5lZtlT210Ig82P7sLQb/sgCfKVFTr0
+Z3haQ5/tBNKjq+igT4nMBWupOTD1q2GeZLIZACnmnUIhvu+3/bm0l+wiCB0DqF0T
+Wy9tlL3fqQSCqzevL7/k5Lg6tJTaP/XYePB73TsOtAXgIaoltXgRBsBUeE1eaODx
+kMT6E1PPtn7EqQKCAQEA1qImmTWGqhKICrwje40awPufFtZ/qXKVCN/V+zYsrJV1
+EnZpUDM+zfitlQCugnrQVHSpgfekI6mmVkmogO3fkNjUFTq+neg7IHOUHnqotx+3
+NMqIsyFInGstu9mfPd26fzZjUtx5wKF38LDTIJJAEJ83U3UpPBfpwKmiOGDXOa54
+2i4em/bb/hrQR6JySruZYLi0fXnGI5ZOfpkHgC/KOFkKNKAg2oh4B9qo7ACyiSNk
+yojb2mmn6g1OLPxi7wGUSrkS1HQq4an6RZ+eUO0HXVWag0QStdQ91M9IrIHgSBBG
+0e86Ar6jtD579gqsbz4ySpI/FqEI9obTC+E1/b0aIwKCAQAGz334qGCnZLXA22ZR
+tJlEFEM2YTcD9snzqMjWqE2hvXl3kjfZ3wsUABbG9yAb+VwlaMHhmSE8rTSoRwj6
++JaM/P+UCw4JFYKoWzh6IXwrbpbjb1+SEvdvTY71WsDSGVlpZOZ9PUt9QWyAGD/T
+hCcMhZZn0RG2rQoc5CQWxxNPcBFOtIXQMkKizGvTUHUwImqeYWMZsxzASdNH2WoV
+jsPbyaGfPhmcv83ZKyDp8IvtrXMZkiaT4vlm3Xi8VeKR9jY9z7/gMob1XcEDg3c9
+cCkGOy87WZrXSLhX02mAJzJCycqom66gqNw7pPxjIiY/8VWUEZsTvkL3cymTkhjM
+9ZOhAoIBAGUaNqJe01NTrV+ZJgGyAxM6s8LXQYV5IvjuL2bJKxwUvvP2cT9FFGWD
+qYiRrKJr5ayS07IUC+58oIzu33/0DSa27JgfduD9HrT3nKMK1mSEfRFSAjiXChQc
+bIubRGapBoub/AdxMazqoovvT1R9b84kobQfcVAMV6DYh0CVZWyXYfgsV2DSVOiK
+iufjfoDzg5lLCEI+1XW3/LunrB/W4yPN1X/amf8234ublYyt+2ucD4NUGnP05xLa
+N6P7M0MwdEEKkvMe0YBBSFH5kWK/dIOjqkgBDes20fVnuuz/tL1dZW7IiIP4dzaV
+ZGEOwBEatCfqYetv6b/u3IUxDfS7Wg8CggEBALoOwkn5LGdQg+bpdZAKJspGnJWL
+Kyr9Al2tvgc69rxfpZqS5eDLkYYCzWPpspSt0Axm1O7xOUDQDt42luaLNGJzHZ2Q
+Hn0ZNMhyHpe8d8mIQngRjD+nuLI/uFUglPzabDOCOln2aycjg1mA6ecXP1XMEVbu
+0RB/0IE36XTMfZ+u9+TRjkBLpmUaX1FdIQQWfwUou/LfaXotoQlhSGAcprLrncuJ
+T44UATYEgO/q9pMM33bdE3eBYZHoT9mSvqoLCN4s0LuwOYItIxLKUj0GulL0VQOI
+SZi+0A1c8cVDXgApkBrWPDQIR9JS4de0gW4hnDoUvHtUc2TYPRnz6N9MtFY=
+-----END RSA PRIVATE KEY-----

data/spec/comms_spec.rb

@@ -0,0 +1,147 @@
+require 'ruby-tls'
+
+describe RubyTls do
+
+
+    describe RubyTls::State do
+        before :each do
+            @client = RubyTls::State.new
+            @server = RubyTls::State.new
+
+            @server_started  = false
+            @server_stop = false
+            @client_stop = false
+        end
+
+        
+        it "should be able to send and receive encrypted comms" do
+            @server_data = []
+            @client_data = []
+            @interleaved = []
+
+
+            @client[:close_cb] = proc {
+                @client_data << 'client stopped'
+                @interleaved << 'client stopped'
+                @client_stop = true
+            }
+            @client[:dispatch_cb] = proc { |state, data, len|
+                @client_data << data.read_string(len)
+                @interleaved << data.read_string(len)
+            }
+            @client[:transmit_cb] = proc { |state, data, len|
+                if not @server_started
+                    @server_started = true
+                    RubyTls.start_tls(@server, true, '', '', false)
+                end
+                data = data.get_bytes(0, len)
+                RubyTls.decrypt_data(@server, data, data.length) unless @client_stop
+            }
+            @client[:handshake_cb] = proc { |state|
+                @client_data << 'ready'
+                @interleaved << 'client ready'
+
+                sending = 'client request'
+                RubyTls.encrypt_data(@client, sending, sending.length) unless @client_stop
+            }
+
+
+            @server[:close_cb] = proc {
+                @server_data << 'server stop'
+                @interleaved << 'server stop'
+                @server_stop = true
+            }
+            @server[:dispatch_cb] = proc { |state, data, len|
+                @server_data << data.read_string(len)
+                @interleaved << data.read_string(len)
+
+                sending = 'server response'
+                RubyTls.encrypt_data(@server, sending, sending.length) unless @server_stop
+            }
+            @server[:transmit_cb] = proc { |state, data, len|
+                data = data.get_bytes(0, len)
+                RubyTls.decrypt_data(@client, data, data.length) unless @server_stop
+            }
+            @server[:handshake_cb] = proc { |state|
+                @server_data << 'ready'
+                @interleaved << 'server ready'
+            }
+
+            RubyTls.start_tls(@client, false, '', '', false)
+
+
+            
+            @client_data.should == ['ready', 'server response']
+            @server_data.should == ['ready', 'client request']
+            @interleaved.should == ['server ready', 'client ready', 'client request', 'server response']
+        end
+    end
+
+    describe RubyTls::Connection do
+        before :each do
+            @client = RubyTls::Connection.new
+            @server = RubyTls::Connection.new
+
+            @server_started  = false
+            @server_stop = false
+            @client_stop = false
+        end
+
+        it "should be able to send and receive encrypted comms" do
+            @server_data = []
+            @client_data = []
+            @interleaved = []
+
+
+            @client.close_cb do
+                @client_data << 'client stopped'
+                @interleaved << 'client stopped'
+                @client_stop = true
+            end
+            @client.dispatch_cb do |data|
+                @client_data << data
+                @interleaved << data
+            end
+            @client.transmit_cb do |data|
+                if not @server_started
+                    @server_started = true
+                    @server.start(:server => true)
+                end
+                @server.decrypt(data) unless @client_stop
+            end
+            @client.handshake_cb do
+                @client_data << 'ready'
+                @interleaved << 'client ready'
+
+                @client.encrypt('client request') unless @client_stop
+            end
+
+
+            @server.close_cb do
+                @server_data << 'server stop'
+                @interleaved << 'server stop'
+                @server_stop = true
+            end
+            @server.dispatch_cb do |data|
+                @server_data << data
+                @interleaved << data
+                @server.encrypt('server response') unless @server_stop
+            end
+            @server.transmit_cb do |data|
+                @client.decrypt(data) unless @server_stop
+            end
+            @server.handshake_cb do
+                @server_data << 'ready'
+                @interleaved << 'server ready'
+            end
+
+            @client.start
+
+            
+            @client_data.should == ['ready', 'server response']
+            @server_data.should == ['ready', 'client request']
+            @interleaved.should == ['server ready', 'client ready', 'client request', 'server response']
+        end
+    end
+end
+