Re: ipsvd-0.9.3, sslio minimum checks?
"Clemens Fischer" <[email protected]>
| Newsgroups | gmane.comp.misc.pape.general |
|---|---|
| Message-ID | <[email protected]> |
* Gerrit Pape:
> On Thu, Jun 03, 2004 at 02:14:11PM +0200, Clemens Fischer wrote:
>> he! i had just finished patching matrixssl-1.0.2, and behold: right
>> after
> Good!
ah, that was simple. but getting it into your build procedure required
about the same amount of work.
> I not yet have a selftest for the sslio program in the package. To test
> matrixssl, you can use the http* programs in the examples/ directory. To
> test sslio I use fnord and bincimap services as described in the examples
> page, and sslclient from ucspi-ssl.
yeah, that's what i tried myself, but without success. provided the user
has sslclient installed, could you devise a simple test with tcpsvd + sslio
on the server side and sslclient + (sh | multitee) on the clients? you
would only have to include a usable certificate and the tests, and this
would make things a lot easier, at least for people on non-linux platforms.
what i tried was this:
tcpserver -vv localhost 55000 strace -f sslio -u ino -C /mail/root/certs/tmppub.pem -K /mail/root/certs/tmpsec.pem -vvv /usr/bin/env
...
fork(sslio[664]: fatal: unable to read certfile or keyfile: no error
) = 665
what do you think of this "error" message?
here's the client:
sslclient -vvv -RHl0 localhost 55000 multitee 6:1 0:7
sslclient: connected to 127.0.0.1 port 55000
sslclient: fatal: unable to SSL connect: error:00000005:lib(0):func(0):DH lib
sslclient: fatal: unable to SSL connect: error:00000005:lib(0):func(0):DH lib
btw, i also tried tcpclient + sslio because i thought this should have
worked as well. am i right? what i do know is that sslclient is picky
about what's presented in the server certificate, which is why i also
tried giving it the exact same certificate the server uses.
unfortunately, that cert doesn't contain my hosts name, which is why i
think sslclient rejects it:
sslclient -vvv -k /mail/root/certs/tmpsec.pem -c /mail/root/certs/tmppub.pem -A /etc/ssl/servercerts localhost 55000 multitee 6:1 0:7
sslclient: connected to 127.0.0.1 port 55000
sslclient: fatal: unable to load key pair
soooo. i'm in desparate need for a little *and precise* tutorial about
how to make a server key, together with the openssl.cnf used to make it.
i have searched the web and found numerous remarks, but none did explain
the matter the way *i* could understand it.
the only thing left for me to do at the moment is inserting sslio in front
of a https:// server and try with w3m.
oh, and ucspi-ssl is at version 0.68 here.
g'night,
clemens
here's the complete server side trace:
0 p1 # tcpserver -vv localhost 55000 strace -f sslio -u ino -C /mail/root/certs/tmppub.pem -K /mail/root/certs/tmpsec.pem -vvv /usr/bin/env
tcpserver: status: 0/40
tcpserver: status: 1/40
tcpserver: pid 661 from 127.0.0.1
tcpserver: ok 661 localhost:127.0.0.1:55000 localhost:127.0.0.1:ino:1112
execve("/usr/local/bin/sslio", ["sslio", "-u", "ino", "-C", "/mail/root/certs/tmppub.pem", "-K", "/mail/root/certs/tmpsec.pem", "-vvv", "/usr/bin/env"], [/* 115 vars */]) = 0
mmap(0, 2048, PROT_READ|PROT_WRITE, MAP_ANON, -1, 0) = 0x2806f000
munmap(0x2806f000, 2048) = 0
__sysctl([hw.pagesize], 2, "\0\20\0\0", [4], NULL, 0) = 0
mmap(0, 32768, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANON, -1, 0) = 0x2806f000
geteuid(0xbfbfea54) = 0
getuid() = 0 (euid 0)
getegid(0xbfbfea54) = 0
getgid() = 0 (egid 0)
open("/etc/libmap.conf", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/var/run/ld-elf.so.hints", O_RDONLY) = 3
read(3, "Ehnt\1\0\0\0\200\0\0\0J\0\0\0\0\0\0\0I\0\0\0\0\0\0\0\0"..., 128) = 128
lseek(3, 128, SEEK_SET) = 128
read(3, "/usr/lib:/usr/lib/compat:/usr/X1"..., 74) = 74
close(3) = 0
access("/usr/lib/libc.so.4", F_OK) = 0
open("/usr/lib/libc.so.4", O_RDONLY) = 3
fstat(3, {st_mode=S_IFREG|0444, st_size=580604, ...}) = 0
read(3, "\177ELF\1\1\1\t\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\264(\1"..., 4096) = 4096
mmap(0, 626688, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_NOCORE, 3, 0) = 0x28077000
mprotect(0x280f8000, 4096, PROT_READ|PROT_WRITE|PROT_EXEC) = 0
mprotect(0x280f8000, 4096, PROT_READ|PROT_EXEC) = 0
mmap(0x280f9000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 3, 0x81000) = 0x280f9000
mmap(0x280fe000, 73728, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANON, -1, 0) = 0x280fe000
close(3) = 0
mmap(0, 456, PROT_READ|PROT_WRITE, MAP_ANON, -1, 0) = 0x28110000
munmap(0x28110000, 456) = 0
mmap(0, 13360, PROT_READ|PROT_WRITE, MAP_ANON, -1, 0) = 0x28110000
munmap(0x28110000, 13360) = 0
sigaction(SIGILL, {0x2805e864, [], 0}, {SIG_DFL}) = 0
sigprocmask(SIG_BLOCK, NULL, []) = 0
sigaction(SIGILL, {SIG_DFL}, NULL) = 0
sigprocmask(SIG_BLOCK, ~[ILL TRAP ABRT EMT FPE BUS SEGV SYS], []) = 0
sigprocmask(SIG_SETMASK, [], NULL) = 0
getpid() = 664 (ppid 661)
getuid() = 0 (euid 0)
geteuid(0x280fc7cc) = 0
readlink("/etc/malloc.conf", 0xbfbfe7b0, 63) = -1 ENOENT (No such file or directory)
mmap(0, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANON, -1, 0) = 0x28110000
break(0x805d000) = 0
break(0x805e000) = 0
stat("/etc/spwd.db", {st_mode=S_IFREG|0600, st_size=40960, ...}) = 0
open("/etc/spwd.db", O_RDONLY) = 3
fcntl(3, F_SETFD, FD_CLOEXEC) = 0
read(3, "\0\6\25a\0\0\0\2\0\0\4\322\0\0\20\0\0\0\0\f\0\0\1\0\0\0"..., 260) = 260
break(0x805f000) = 0
break(0x8060000) = 0
break(0x8061000) = 0
lseek(3, 32768, SEEK_SET) = 32768
read(3, "(\0\373\17\260\17\253\17k\17b\17\f\17\7\17\261\16\254\16"..., 4096) = 4096
break(0x8062000) = 0
close(3) = 0
pipe([3, 4]) = 3
pipe([5, 6]) = 5
fork(sslio[664]: fatal: unable to read certfile or keyfile: no error
) = 665
[pid 664] close(3) = 0
[pid 665] exit(111) = ?
[pid 664] close(6 <unfinished ...>
--- SIGCHLD (Child exited) ---
<... close resumed> ) = 0
fcntl(5, F_GETFL) = 0x2 (flags O_RDWR)
close(0) = 0
fcntl(5, F_DUPFD, 0) = 0
close(5) = 0
fcntl(4, F_GETFL) = 0x2 (flags O_RDWR)
close(1) = 0
fcntl(4, F_DUPFD, 1) = 1
close(4) = 0
execve("/usr/bin/env", ["/usr/bin/env"], [/* 115 vars */]) = 0
mmap(0, 2048, PROT_READ|PROT_WRITE, MAP_ANON, -1, 0) = 0x2805f000
munmap(0x2805f000, 2048) = 0
__sysctl([hw.pagesize], 2, "\0\20\0\0", [4], NULL, 0) = 0
mmap(0, 32768, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANON, -1, 0) = 0x2805f000
geteuid(0xbfbfeac4) = 0
getuid() = 0 (euid 0)
getegid(0xbfbfeac4) = 0
getgid() = 0 (egid 0)
open("/etc/libmap.conf", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/var/run/ld-elf.so.hints", O_RDONLY) = 3
read(3, "Ehnt\1\0\0\0\200\0\0\0J\0\0\0\0\0\0\0I\0\0\0\0\0\0\0\0"..., 128) = 128
lseek(3, 128, SEEK_SET) = 128
read(3, "/usr/lib:/usr/lib/compat:/usr/X1"..., 74) = 74
close(3) = 0
access("/usr/lib/libc.so.4", F_OK) = 0
open("/usr/lib/libc.so.4", O_RDONLY) = 3
fstat(3, {st_mode=S_IFREG|0444, st_size=580604, ...}) = 0
read(3, "\177ELF\1\1\1\t\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\264(\1"..., 4096) = 4096
mmap(0, 626688, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_NOCORE, 3, 0) = 0x28067000
mprotect(0x280e8000, 4096, PROT_READ|PROT_WRITE|PROT_EXEC) = 0
mprotect(0x280e8000, 4096, PROT_READ|PROT_EXEC) = 0
mmap(0x280e9000, 20480, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 3, 0x81000) = 0x280e9000
mmap(0x280ee000, 73728, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANON, -1, 0) = 0x280ee000
close(3) = 0
mmap(0, 200, PROT_READ|PROT_WRITE, MAP_ANON, -1, 0) = 0x28100000
munmap(0x28100000, 200) = 0
mmap(0, 13360, PROT_READ|PROT_WRITE, MAP_ANON, -1, 0) = 0x28100000
munmap(0x28100000, 13360) = 0
sigaction(SIGILL, {0x2804e864, [], 0}, {SIG_DFL}) = 0
sigprocmask(SIG_BLOCK, NULL, []) = 0
sigaction(SIGILL, {SIG_DFL}, NULL) = 0
sigprocmask(SIG_BLOCK, ~[ILL TRAP ABRT EMT FPE BUS SEGV SYS], []) = 0
sigprocmask(SIG_SETMASK, [], NULL) = 0
fstat(1, {st_mode=S_IFIFO, st_size=0, ...}) = 0
readlink("/etc/malloc.conf", 0xbfbfe6c0, 63) = -1 ENOENT (No such file or directory)
mmap(0, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANON, -1, 0) = 0x28100000
break(0x804b000) = 0
break(0x804f000) = 0
write(1, "NAPNICK=rabataf\nNNTPSERVER=127.0"..., 4473 <unfinished ...>
--- SIGPIPE (Broken pipe) ---
--- SIGPIPE (Broken pipe) ---
tcpserver: end 661 status 0
tcpserver: status: 0/40