Re: sslio as a STARTTLS wrapper (was Re: sslio error description incomplete/wrong)

On Wed, Jan 05, 2005 at 05:45:54PM -0500, Charlie Brady wrote:
> On Mon, 3 Jan 2005, Charlie Brady wrote:
> > I'd like to do something very similar on the smtp port, with 
> > smtpfront-qmail talking plain text smtp, until it sees a STARTTLS request.
> > This should be possible with just a little co-operation between sslio and 
> > smtpfront-qmail. If sslio leaves smtpfront-qmail with stdin and stdout 
> > connected to the network socket, and doesn't itself read from or write to 
> > the network, smtpfront-qmail should be able to talk plain text SMTP to the 
> > network, right?
Okay.

> > Now, if smtpfront-qmail sees a STARTTLS request, it can respond to the
> > connecting client that it is ready for TLS, and can switch its I/O to the
> > pipe connections it has with sslio (closing the file descriptors it no 
> > longer needs). It'll send some sort of message to its
> > sslio peer, which will then commence SSL negotation, and start proxying
> > the SSL traffic as it normally does.
> > 
> > If smtpfront-qmail sees any command other than STARTTLS, it'll know it 
> > doesn't need an SSL proxy, and can let sslio know that it can quit.
> > 
> > The main detail to flesh out is what form of IPC to use. Any suggestions? 
> 
> When started in this mode, sslio could create a pipe to share with its
> mail daemon peer. It could then block on a one byte read from the pipe.  

I think you can use a communication channel that's already there.  Give
sslio a new command line option for starttls.  With this option, it
leaves filedescriptors 0 and 1 untouched for the service program (here
smtpfront-qmail), and provides filedescriptors 6 an 7 for ssl encrypted
data.  It sleeps until it sees fd 7 readable.

smtpfront-qmail talks to the client through stdin and stdout in plain
text.  If tls is requested, it switches stdout to fd 7 and wakes up
sslio.  stdin is switched to fd 6, and smtpfront-qmail now talks to the
client through ssl.  If smtpfront-qmail knows that tls no longer can be
requested in this session, it closes fd 6 and 7, and sslio exits.

Can this work?, Gerrit.