phpnginxepp

Create an SSL server socket terminator

I need to convert EPP (session based protocol - https://www.rfc-editor.org/rfc/rfc5734) to an HTTP request/response based protocol (JSON). The JSON part has already been coded and is working with a few clients.

I've looked at nginx using websockets but websockets appear too high level for the raw EPP protocol.

I need to solve the following process:

  1. nginx to terminate an SSL TCP connection
  2. read off the EPP request (XML) - preferably in PHP
  3. convert to JSON and send it to an HTTP server
  4. read the result
  5. convert to XML and send it back to the EPP connection

Are there any recommended technologies within nginx to achieve this? I can code the PHP socket server without too much hassle.

Solution

  • So you are building an EPP server? Welcome to the EPP world, from someone being in it since its birth or even before :-)

    EPP is a "simple" protocol using XML over TLS (typically, there are some instances over HTTPS and during drafting period they were other proposals like over SMTP or BXXP).

    So, as a server you need something being able to handle TLS termination, and read XML. This is possible in any language, and is not rocket science. Of course the devil lies in the details. And you do not provide enough details/context to see exactly what constraints you may have or specific problem. So you may be a little off topic here because writing a simple server handling TLS and reading XML would need to be shown here as code if you want people to help you.

    Please make sure to read RFC 5734 multiple times about specific transport considerations. You need of course to remember that it is a stateful protocol so if you "forward" the requests internally over a stateless protocol you will need to carry some sort of authentication.

    You do not need websockets, in fact I do not understand why you speak about them. You just need TLS termination, not HTTPS one.

    Have a look at HAProxy too, it is a popular handler of things like that.

    But again, based on your specific (unknown) constraints (specially number of clients, volume of queries, SLAs needed, etc.), something as simple as stunnel may be enough.

    Note that you have mod_epp for Apache. Maybe not very live anymore but could give you ideas. It allows to use any CGI program under Apache when the server receives in fact EPP frames and not HTTP ones.

    As a side note, besides security (but that should be covered by RFC5734), I would recommend you to be careful about encodings, XML namespaces, and avoid using multiple serialisation mechanisms in the same stream (JSON inside XML is a bad idea as is XML inside JSON, but I do not know exqctly how your "convert" part works).