Re: ipsvd-0.9.3, sslio minimum checks?

* Clemens Fischer:

> what i tried was this:
>
>  tcpserver -vv localhost 55000 strace -f sslio -u ino -C /mail/root/certs/tmppub.pem -K /mail/root/certs/tmpsec.pem -vvv /usr/bin/env
> ...
> fork(sslio[664]: fatal: unable to read certfile or keyfile: no error
> )                                  = 665
>
> what do you think of this "error" message?

whatever it means, it doesn't mean a thing.

on the openssl.org site i found a script called newcert-ca.sh which
automates certificate generation.  it makes openssl configurations on the
fly and therefor you can mess up your own as much as you like, it will
simply work.

> what i do know is that sslclient is picky about what's presented in the
> server certificate, which is why i also tried giving it the exact same
> certificate the server uses.  unfortunately, that cert doesn't contain my
> hosts name, which is why i think sslclient rejects it:

with correct certificates presented to sslclient, sslio with matrixssl now
works on freebsd-4-STABLE.  it was sslclient giving me fits with the
testing, sslio worked all along.

,----
| tcpserver -vv -l $host $host 55000 sslio -u http -C $cert -K $key -vvv env
`----
 
,----
| sslclient -vvv -RHl0 -a $cacert $host 55000 multitee 6:1
| sslclient: connected to 217.231.126.213 port 55000
| sslclient: ssl connect
| ...
`----

is the test that demonstrates this.

next question:  is there any portable or at least "clean" way to find both
processor and its internal clock frequency?  freebsd has a MIB to query
intel i386 CPUs with a TSC component, which propably only holds for
pentiums(?).  for some reason such a mechanism is defined in matrixssl.
the linux abstraction uses /proc/cpu/* and parses the cpu identification,
which looks a bit awkward to me.

and finally:  sslio uses the GPL'ed matrixssl, but in theory it's possible
to let sslio run some proprietary application.  would this be "legal"?

  clemens