Re: ucspi-tls (attn: Scott Gifford)

Josh Trutwin <[email protected]> writes:

[...]

> First off, a general question: is it possible to use the same
> qmail-smtpd run file to enable SSL/TLS connections and straight up
> SMTP connections (which is nice for local connections and webmail)? 
> Right now I have to setup a seperate runfile to bind to port 465.  In
> my previous mailfront/TLS implementation (using a patch posted on this
> mailing list by Charlie Brady a while back) there was a TLSCOMMAND
> variable that was consulted by mailfront which executed
> smtpfront-qmail in a stunnel session if the STARTTLS command was sent.
>  This allowed for SSL and non-SSL connections to work against the same
> run file.  Unless I'm missing something this functionality seems to be
> missing with the UCSPI-TLS patch?  

You can get this effect with shell scripting in your run file.
Something like:

  if [ -n "$STARTTLS" ]; then tlsflags="-w"; else tlsflags=""; fi
  ...
  sslserver $tlsflags ...

> Secondly, I get a problem using the chroot feature:

[...]

> export SSL_CHROOT=1

Set SSL_CHROOT to the directory to chroot to.

[...]

> Third, after disabling the chroot I was stilll unable to get a message
> to go through via TLS:
>
> @40000000429cb2ac31562274 sslserver: status: 1/31
> @40000000429cb2ac31635174 sslserver: pid 2570 from 64.83.223.150
> @40000000429cb2ac31684ae4 sslserver: ok 2570 0:192.168.0.3:465
> :64.83.223.150::13763
> @40000000429cb2c633588224 sslserver: warning: dropping connection,
> unable to accept SSL: error:00000002:lib(0):func(0):system lib
> @40000000429cb2c6335bba5c sslserver: end 2569 status 28416
> @40000000429cb2c6335bcde4 sslserver: status: 0/31
> @40000000429cb2c6335dd954 smtpfront-qmail[2570]: bytes in: 0 bytes
> out: 23
>
> This looks icky.  Anything I can do to debug?

Check permissions on certificates, and make sure they're readable by
the user and group you're running sslserver as.  I find the easiest
way to debug these sorts of bugs is using strace/truss/ktrace.
Another useful tool is using stunnel to connect, and turning its
debuggin flags all the way up.

One more thing to try: see if regular SSL (not STARTTLS) works with
vanilla ucspi-ssl.

Good luck, and let me know how it goes,

----ScottG.

-- 
Scott Gifford
Help us find a cure for cancer!
American Cancer Society Relay for Life - http://www.suspectclass.com/relay4life/