Re: mailfront on IPv6

--20cf3071ce3edf430504a6d35401
Content-Type: text/plain; charset=ISO-8859-1

On Tue, Jun 28, 2011 at 11:35 PM, Bruce Guenter <[email protected]>wrote:

> On Tue, Jun 28, 2011 at 09:59:16PM -0400, Scott Gifford wrote:
>
[ ... ]

>  > I guess it could be done with a separate SSL server and
> > file-descriptor passing,
>
> That's an interesting idea, though setting up an extra server could be a
> nuisance.  It could run as a parent of tcpserver (or equivalent), which
> wouldn't then require an extra server.
>
> > but I'm not sure that could be easily shoehorned into sslserver.
>
> No, it wouldn't need to be sslserver, since the requirements don't
> require accepting connections and setting up the environment, just
> handling the SSL protocol.
>

True, but it would require somebody to write such a server, which is
definitely a nontrivial undertaking.


>  > Because sslserver implements the functionality of tcpserver plus SSL, it
> > doesn't really carry around an extra process, it just carries around a
> copy
> > of tcpserver that has some extra libraries loaded to provide SSL.
>
> But it is still another PID, right?  So it has its own address space and
> all.  Granted, most will be mapped from the parent process if I
> understand right.
>

You are right.  I thought that tcpserver stuck around, and so this required
no more work than that, but on further investigation I see that tcpserver
exits after setting up the connection.

So support for STARTTLS requires that the parent process hangs around in
case TLS is activated later.  It doesn't do anything unless STARTTLS is
activated, and on my system it consumes 216KB of data+stack; another 3.36MB
is consumed by the executable and libraries, but that should be shared.  The
footprint is pretty small by modern standards, but certainly nonzero.

-----Scott.

--20cf3071ce3edf430504a6d35401
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

On Tue, Jun 28, 2011 at 11:35 PM, Bruce Guenter <span dir=3D"ltr">&lt;<a hr=
ef=3D"mailto:[email protected]">[email protected]</a>&gt;</span> wrot=
e:<br><div class=3D"gmail_quote"><blockquote class=3D"gmail_quote" style=3D=
"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">

<div class=3D"im">On Tue, Jun 28, 2011 at 09:59:16PM -0400, Scott Gifford w=
rote:<br></div></blockquote><div>[ ... ]=A0</div><blockquote class=3D"gmail=
_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:=
1ex;">

<div class=3D"im">
&gt; I guess it could be done with a separate SSL server and<br>
&gt; file-descriptor passing,<br>
<br>
</div>That&#39;s an interesting idea, though setting up an extra server cou=
ld be a<br>
nuisance. =A0It could run as a parent of tcpserver (or equivalent), which<b=
r>
wouldn&#39;t then require an extra server.<br>
<div class=3D"im"><br>
&gt; but I&#39;m not sure that could be easily shoehorned into sslserver.<b=
r>
<br>
</div>No, it wouldn&#39;t need to be sslserver, since the requirements don&=
#39;t<br>
require accepting connections and setting up the environment, just<br>
handling the SSL protocol.<br></blockquote><div><br></div><div>True, but it=
 would require somebody to write such a server, which is definitely a nontr=
ivial undertaking.</div><div>=A0</div><blockquote class=3D"gmail_quote" sty=
le=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">

<div class=3D"im">
&gt; Because sslserver implements the functionality of tcpserver plus SSL, =
it<br>
&gt; doesn&#39;t really carry around an extra process, it just carries arou=
nd a copy<br>
&gt; of tcpserver that has some extra libraries loaded to provide SSL.<br>
<br>
</div>But it is still another PID, right? =A0So it has its own address spac=
e and<br>
all. =A0Granted, most will be mapped from the parent process if I<br>
understand right.<br></blockquote><div><br></div><div>You are right. =A0I t=
hought that tcpserver stuck around, and so this required no more work than =
that, but on further investigation I see that tcpserver exits after setting=
 up the connection.</div>

<div><br></div><div>So support for STARTTLS requires that the parent proces=
s hangs around in case TLS is activated later. =A0It doesn&#39;t do anythin=
g unless STARTTLS is activated, and on my system it consumes 216KB of data+=
stack; another 3.36MB is consumed by the executable and libraries, but that=
 should be shared. =A0The footprint is pretty small by modern standards, bu=
t certainly nonzero.</div>

<div><br></div><div>-----Scott.</div><div><br></div></div>

--20cf3071ce3edf430504a6d35401--