Re: mailfront on IPv6

On 06/22/2011 07:58 PM, John R. Levine wrote:
> I've been using it for a month or so, and it seems to work fine.
>
> There's a buglet in plugin-add-received.  The SMTP spec says that you
> put IPV6: in front of the IP address, e.g.
>
>  Received: from foo (bar [IPV6:2001:2002::123])
>      by zip (zap [IPV6:201a::345]) ; date
>
> The code to add to the routine str_catfromby() is obvious, I haven't
> done it since I use a different plugin that does mysql logging at the
> same time.
>
> Unrelated question: has anyone done STARTTLS?  There's patches for
> ofmipd or qmail-smtpd that show what you have to do, but it looks to
> me like the current plugin setup isn't adequate to stick the necessary
> shims to do the TLS on the way in and out.  I suppose you could do it
> by making a separate process and pipes, but ugh.
>
> Regards,
> John Levine, [email protected], Primary Perpetrator of "The Internet for
> Dummies",
> Please consider the environment before reading this e-mail. http://jl.ly
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [email protected]
> For additional commands, e-mail: [email protected]
>

I have STARTTLS working on mailfront 1.12 by doing the following:
* I have modified ucspi-ssl in order for it to work correctly by adding
another flag to the sslserver executable. I use sslserver to handle the
SSL stuff and pass the information via environment variables to mailfront.
* I have modified the protocol-smtp.c in order to add the STARTTLS verb
to the protocol as well as other responses necessary to allow users to
know the extension is allowed. As well as modify the protocol string as
appropiate in order to generate the correct received headers.
* I have modified plugin-add-received.c in order to show the SSL
information (SSL_PROTOCOL/SSL_CIPHER_USEKEYSIZE/SSL_CIPHER)  on the
received header as shown here:

Received: from jvaldes.corporate.intercom (jvaldes.corporate.intercom [172.16.2.252]) 
	by sun21a.intercom.com.sv ([168.243.235.221]) 
	with ESMTPA via SSL (TLSv1:256 bits [AES256-SHA]); 23 Jun 2011 17:23:00 -0000

With regards to its funcionality, I have had no user complaints and it
works great. Tested it with Outlook/Outlook Express/Thunderbird as well
as other mail clients. The only issue I still have is that sometimes the
sslserver session gets stuck @ 100% cpu usage and the process must be
killed manually, and have not been able to reproduce on a staging
server, so I need to clear these "stuck" processes. My server gets ~100K
connections/day and get between 1 and 3 stuck processes per day, so I
have not done much debugging, since I really do keep an eye on the
server throughout the day...

--
Jorge Valdes