Re: sslio as a STARTTLS wrapper (was Re: sslio error description incomplete/wrong)

On Thu, Jan 06, 2005 at 01:07:34AM -0500, Scott Gifford wrote:
> One concern that one of stunnel's authors (Brian Hatch?) had was that
> starting up a brand new SSL-handling program wasted processing power,
> since a lot of SSL's work is initialization.  If we used a

I'm not sure that's really a problem, I didn't run into any problems yet
with starting up sslio as a separate program in the process chain for
each connection.  But I think integrating sslio into tcpsvd, and so
creating a sslsvd, can be done quite easily.

For me this looks like the best suggestion:

> tcpserver/tcpsvd replacement that natively understood SSL, it would
> help with that concern.  The operation would essentially be:
> 
>     /* Running as root */
>     initialize_ssl();
>     while(accept())
>       fork()
>         child:
>           fork()
>             parent:
>               chroot("/nothing");
>               setgid("nobody");
>               setuid("nobody");
>               be_ssl_tunnel();
>             child:
>               setgid(g_option);
>               setuid(u_option);
>               exec(rest_of_args);

(sslio actually does it the other way round, it runs as child process of
the service program).  sslsvd would be a tcpsvd that initializes ssl on
startup, and for connections forks and runs the code from sslio,
skipping the ssl initialization.  The sslio code, just as now, forks
again to do ssl en/decryption, and then replaces itself with the service
daemon.

Regards, Gerrit.