cert file location (was Re: sslio documentation clarification (Re: ipsvd-0.9.0 available))

On Mon, 3 May 2004, Charlie Brady wrote:

> On Sat, 1 May 2004, Gerrit Pape wrote:
> 
> > This version introduces a first beta version of the sslio[0] program
> > (for Linux only), which can be used to encrypt network connections using
> > SSLv3.
> 
> It's not clear from the documentation that the key and cert file paths are 
> relative to the chroot directory (if -/ option is given). IOW, the chroot 
> also occurs before the certificate files are opened.

This strikes me as wrong. What value is there in having the keys inside 
the jail (and readable by the application)? Wouldn't this be better?

--- sslio.c.orig	Tue May  4 10:51:55 2004
+++ sslio.c	Tue May  4 10:52:35 2004
@@ -292,6 +292,9 @@
     if (close(decpipe[0]) == -1)
       fatal("unable to close decoding pipe input");
     matrixSslOpen();
+    if (! key) key =cert;
+    if (matrixSslReadKeys(&keys, cert, key, 0, 0) < 0)
+      fatal("unable to read certfile or keyfile");
     if (root) {
       if (chdir(root) == -1) fatal("unable to change to new root 
directory");
       if (chroot(".") == -1) fatal("unable to chroot");
@@ -301,9 +304,6 @@
       if (prot_gid(ugid.gid) == -1) fatal("unable to set gid");
       if (prot_uid(ugid.uid) == -1) fatal("unable to set uid");
     }
-    if (! key) key =cert;
-    if (matrixSslReadKeys(&keys, cert, key, 0, 0) < 0)
-      fatal("unable to read certfile or keyfile");
     if (matrixSslNewSession(&ssl, keys, 0, SSL_FLAGS_SERVER) < 0)
       fatal("unable to create ssl session");
     doio();

---
Charlie