Re: Benchmarked tcpserver dlopen() -> qmail_smtpd() VS tcpserver --> fork() --> exec qmail-smtpd

On 5 April 2017 at 02:50, Charles Cazabon
<[email protected]> wrote:
> Manvendra Bhangui <[email protected]> wrote:
>>
>> No. I don't use a 25 Mib badmail file. That example was to make
>> apparent the penalty imposed in the current architecture where every
>> invocation of qmail-smtpd reads this file.
>
> So to summarize: you manufactured a circumstance where qmail's control-file
> architecture was a spectacularly bad fit for the artifical circumstance.  And
> then you used that to justify your development of your feature?
>
> That's fine; inventing and solving weird problems can be fun.  It's basically
> intellecutal masturbation at that point.
>

Yes Charles, you are right about that. It is fun. You may not
remember, but I got into understanding qmail more than 17 years ago. I
knew nothing about qmail and it was your timely help and explanation
about how qmail works, got me into this. I was trying to migrate from
my company's ISOCOR messaging platform. You even gave me a script to
convert from mailbox to Maildir. When I went live, the stock qmail was
just not able to handle the deluge of emails. We had around 3 million
customers. The first thing I did was to put multiple queues (instead
of just one /var/qmail/queue). There is a lot I learned from Russ
Nelson too, but looks like he has disappeared. And I cannot forget
Dave Sills handbook.

> But...
>
>> My dlopen() architecture was completed months ago but I did not
>> succeed in making the tcpserver symbols private to just the tcpserver
>> executable. If the symbols can be private how can that be less secure
>> then using exec() ?
>
> <SFX: KLAXON SOUNDS>
>
> Making the symbols private affects how the linker (static and dynamic) loads
> and resolves names/symbols in the object code.
>
> It does *not* make the code or data private.  Anyone who can trigger a heap
> overflow, stack overflow, use-after-free, or other bug in your code can still
> modify data and modify/execute code behind those non-public symbols.  You
> could easily turn yourself into an open relay, or open your private control
> information up to attackers on the net, or leak private information from your
> db server to an attacker, etc.
>
> i.e. you appear to have not understood when I said that the fork & exec design
> of tcpserver was a security feature.
>
> I *strongly* recommend you not expose this code of yours to the 'net at large
> until you have had a competent security review done on it, as you seem not to
> understand the security implications of your changes.

That has been the original intention of my first email in this thread.
I update the source code using git and it is public. Anyday more heads
are better than one.

https://sourceforge.net/p/indimail/code/ci/master/tree/ucspi-tcp-0.88/

The relevant files are tcpserver.c, tcpserver_plugin.c, load_shared.c,
dlnamespace.c, rblsmtpd.c. This entire feature can be turned off by
removing conf-dlopen

This was the whole point of my original post and I am again puting it.
Worries
======
1.  Maybe I have done something stupid here
     eventhough it works for me

2.  I don't have the full knowledge of how
     the ld loader works and half baked
    knowledge is not good.