Re: sslio as a STARTTLS wrapper (was Re: sslio error description incomplete/wrong)

On Fri, 7 Jan 2005, Gerrit Pape wrote:

> On Wed, Jan 05, 2005 at 05:45:54PM -0500, Charlie Brady wrote:
>
> > When started in this mode, sslio could create a pipe to share with its
> > mail daemon peer. It could then block on a one byte read from the pipe.  
> 
> I think you can use a communication channel that's already there.  Give
> sslio a new command line option for starttls.  With this option, it
> leaves filedescriptors 0 and 1 untouched for the service program (here
> smtpfront-qmail), and provides filedescriptors 6 an 7 for ssl encrypted
> data.  It sleeps until it sees fd 7 readable.
> 
> smtpfront-qmail talks to the client through stdin and stdout in plain
> text.  If tls is requested, it switches stdout to fd 7 and wakes up
> sslio.

By writing a byte, correct?

>  stdin is switched to fd 6, and smtpfront-qmail now talks to the
> client through ssl.  If smtpfront-qmail knows that tls no longer can be
> requested in this session, it closes fd 6 and 7, and sslio exits.
> 
> Can this work?

I don't see where you are getting the fd 6 and 7 from. I see how they are 
defined for use by UCSPI clients, but we don't have one of those here.

Here's the relevant code from sslio.c:

...
  if (close(encpipe[0]) == -1) fatal("unable to close encoding pipe input");
  if (close(decpipe[1]) == -1) fatal("unable to close decoding pipe output");
  if (fd_move(fdstdin, decpipe[0]) == -1)
    fatal("unable to setup filedescriptor for decoding");
  if (fd_move(fdstdou, encpipe[1]) == -1)
    fatal("unable to setup filedescriptor for encoding");
  if (svuser) {
    if (prot_gid(svugid.gid) == -1) fatal("unable to set gid for prog");
    if (prot_uid(svugid.uid) == -1) fatal("unable to set uid for prog");
  }
  pathexec(argv);
...

I think you are suggesting doing something like:

  if (close(decpipe[1]) == -1) fatal("unable to close decoding pipe output");
  if (!waitforstarttls)
  {
    if (close(encpipe[0]) == -1) fatal("unable to close encoding pipe input");
    if (fd_move(fdstdin, decpipe[0]) == -1)
      fatal("unable to setup filedescriptor for decoding");
    if (fd_move(fdstdou, encpipe[1]) == -1)
      fatal("unable to setup filedescriptor for encoding");
  }

and in the child wait until decpipe[1] is readable.

At any rate, if you'd like to send me any ipsvd patches I should be able 
to do the other side and try to test it out. Bear in mind though that this 
will still be a very limited solution until someone adds TLSv1 support to 
matrixssl.

---
Charlie