Safe to link against gem extension?

まず openssl.so からエクスポートされるシンボルと、BIO、BIO_*、SSL_set_bio に対して提案されているラッパー API を確認します。puma と eventmachine で使用されている C 拡張の統合方法を比較し、サポート対象となる gem 間 API を定義できるかどうかを判断します。安全なリンク方法と、必要な API の追加が確立されれば完了です。

Is there any way for one C extension to safely link against another?
Looking at the external symbols in openssl.so, I see the following:

$ nm tmp/x86_64-linux/openssl/3.0.2/openssl.so |
    ruby -nae 'g=ARGF.grep(/ T /).map{_1.split[2]}.group_by{_1[/(\A(o|I)|_to)/]}.values.sort_by{-_1.size};
      g[0].size.times{|i|puts ("%28s"*4)%g.map{_1[i]}}'

      ossl_asn1_get_asn1type                Init_openssl                  DupPKeyPtr          asn1integer_to_num
                ossl_bin2hex              Init_ossl_asn1              DupX509CertPtr              asn1str_to_str
            ossl_bn_ctx_free                Init_ossl_bn           DupX509RevokedPtr            asn1time_to_time
             ossl_bn_ctx_get            Init_ossl_cipher                   GetConfig          num_to_asn1integer
                 ossl_bn_new            Init_ossl_config                  GetPKeyPtr                            
           ossl_bn_value_ptr                Init_ossl_dh              GetPrivPKeyPtr                            
                ossl_buf2str            Init_ossl_digest              GetX509AttrPtr                            
             ossl_cipher_new               Init_ossl_dsa              GetX509CertPtr                            
            ossl_clear_error                Init_ossl_ec               GetX509CRLPtr                            
             ossl_digest_new            Init_ossl_engine               GetX509ExtPtr                            
          ossl_digest_update              Init_ossl_hmac              GetX509NamePtr                            
   ossl_evp_get_cipherbyname               Init_ossl_kdf               GetX509ReqPtr                            
   ossl_evp_get_digestbyname           Init_ossl_ns_spki             GetX509StorePtr                            
             ossl_get_errors              Init_ossl_ocsp                                                        
             ossl_make_error            Init_ossl_pkcs12                                                        
             ossl_membio2str             Init_ossl_pkcs7                                                        
                ossl_obj2bio              Init_ossl_pkey                                                        
          ossl_pem_passwd_cb              Init_ossl_rand                                                        
       ossl_pem_passwd_value               Init_ossl_rsa                                                        
  ossl_pkey_check_public_key               Init_ossl_ssl                                                        
       ossl_pkey_export_spki       Init_ossl_ssl_session                                                        
ossl_pkey_export_traditional                Init_ossl_ts                                                        
               ossl_pkey_new              Init_ossl_x509                                                        
      ossl_pkey_read_generic          Init_ossl_x509attr                                                        
    ossl_protect_x509_ary2sk          Init_ossl_x509cert                                                        
                  ossl_raise           Init_ossl_x509crl                                                        
                ossl_str_new           Init_ossl_x509ext                                                        
             ossl_time_split          Init_ossl_x509name                                                        
                 ossl_to_der           Init_ossl_x509req                                                        
     ossl_to_der_if_possible       Init_ossl_x509revoked                                                        
         ossl_verify_cb_call         Init_ossl_x509store                                                        
            ossl_x509_ary2sk                                                                                    
           ossl_x509_ary2sk0                                                                                    
           ossl_x509attr_new                                                                                    
            ossl_x509crl_new                                                                                    
         ossl_x509crl_sk2ary                                                                                    
            ossl_x509ext_new                                                                                    
           ossl_x509name_new                                                                                    
        ossl_x509name_sk2ary                                                                                    
               ossl_x509_new                                                                                    
        ossl_x509revoked_new                                                                                    
            ossl_x509_sk2ary                                                                                    
       ossl_x509_time_adjust      

If there's a safe way to do so, I'd like to use a couple of those... and maybe submit a PR with a few more.

I know of at least two gems with their own extensions linking against openssl (puma and eventmachine). It seems to me they would be able to use this gem's implementation with only a few additions to the API, if they could link against the C extension API. In particular, if there were a simple wrapper around the BIO struct, BIO_* functions, and SSL_set_bio, then those gems could be rewritten to use that.

For ease of maintenance and maximum eyeballs on such critical security infrastructure, I'd rather not have a new implementation in every gem with a C extension that needs access to openssl. (n.b. there has been at least three CVEs for gems which depend on eventmachine, all of which probably would've been avoided if eventmachine could've simply used stdlib's openssl)