Access to SSL context in faye-websocket+eventmachine connection

195 views Asked by At

I would like to get a wire dump of a secure websocket connection where I am the client.

I am using the faye-websocket gem in ruby to connect to a secure websocket service. This works well. To understand a specific issue, I need to get a wire dump of the communication. I typically use wireshark for this (running on the same machine as the client). To decrypt the SSL connection, I need to extract the master key to pass it to wireshark. I know how to extract the master key if I have direct access to the socket, but I fail to get access to it when using the faye-websocket gem.

The code to run faye-websocket is pretty standard:

EM.run {
     ws = Faye::WebSocket::Client.new('wss://...')

ws.on :open do |event|
    p [:open]
    ### authentication
end

ws.on :message do |event|
    p [:message, event.data]
    ### message - response loop here
end

ws.on :close do |event|
    p [:close, event.code, event.reason]
    ws = nil
end
}

Inspecting the content of ws, it has a @socket member, but I fail to receive it (get_instance_var returns nil).

For the record, once I have the SSLcontext, I would use the code from https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/how-to-decrypt-ruby-ssl-communications-with-wireshark/ to extract the master key and pass it to wireshark:

ssl_socket.session.to_text.each_line do |line|
  if match = line.match(/Session-ID\s*: (?<session_id>.*)/)
    session_id = match[:session_id]
  end
  if match = line.match(/Master-Key\s*: (?<master_key>.*)/)
    master_key = match[:master_key]
  end
end

Does someone have a solution to get access to the underlying socket and the SSL context?

0

There are 0 answers