From darrenm@sac.sfbay.sun.com Tue Jun 10 04:18:54 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5ABIrsc017320 for ; Tue, 10 Jun 2008 04:18:53 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m5ABIpTv013402; Tue, 10 Jun 2008 12:18:52 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K2800501VFF4S00@nwk-avmta-1.sfbay.Sun.COM>; Tue, 10 Jun 2008 04:18:51 -0700 (PDT) Received: from dm-sfbay-02.sfbay.sun.com ([129.146.11.31]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K280050OVFE4B00@nwk-avmta-1.sfbay.Sun.COM>; Tue, 10 Jun 2008 04:18:51 -0700 (PDT) Received: from sac.sfbay.sun.com (new-sac.SFBay.Sun.COM [129.146.175.65]) by dm-sfbay-02.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m5ABIno9008830; Tue, 10 Jun 2008 04:18:49 -0700 (PDT) Received: from sac.sfbay.sun.com (localhost [127.0.0.1]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5ABIl0W017315; Tue, 10 Jun 2008 04:18:47 -0700 (PDT) Received: (from darrenm@localhost) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8/Submit) id m5ABIlhD017311; Tue, 10 Jun 2008 04:18:47 -0700 (PDT) Date: Tue, 10 Jun 2008 04:18:47 -0700 (PDT) From: Darren J Moffat Subject: Stunnel [PSARC/2008/369 FastTrack timeout 06/13/2008] To: PSARC-ext@sun.com Cc: Mark.Fenwick@sun.com Message-id: <200806101118.m5ABIlhD017311@sac.sfbay.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 3175 Template Version: @(#)sac_nextcase 1.66 04/17/08 SMI This information is Copyright 2008 Sun Microsystems 1. Introduction 1.1. Project/Component Working Name: Stunnel 1.2. Name of Document Author/Supplier: Author: Mark Fenwick 1.3 Date of This Document: 10 June, 2008 4. Technical Description This case adds the open source stunnel (http://www.stunnel.org) command to the Solaris WOS. Stability levels are Uncommitted, release binding is Patch/Micro. Overview: The stunnel command allows the arbitrary encryption of TCP connections with SSL, the encryption mechanisms are provided by the OpenSSL library, which is already part of Solaris. Stunnel allows non-SSL aware daemons and protocol (such as POP, IMAP, HTTP) to use SSL encryption. For example, an unprivileged user can start stunnel from the command line so that it listens on a ephemeral port number. The configuration file provided by the user will define what stunnel should do with TCP connections to the localhost on this port number. This could be used by a non-SSL aware mail client to communicate securely with a SSL protected mail server. Another usage would be to provide SSL protection for a network service listening on a well known port, the decrypted traffic is proxied to the unmodified network daemon. This configuration can be used to provide HTTPS support for a web server that does not support SSL. When stunnel is used to provide a SSL protected system service on a well known port, the stunnel command needs to be started by a privileged user. It should be started when the system boots, for this reason a Solaris specific smf(5) manifest is provided to enable a stunnel service. The svc:/network/stunnel:default service is disabled by default because it requires configuration before use. A sample configuration file is also provided. The following CR is used to track this case: 6712365 Intergration of stunnel into Solaris Packaging: SUNWstunnelr - stunnel root components SUNWstunnelu - stunnel user components Exported Interfaces: +-------------------------------------+-----------------+---------------------+ |Interfaces: | Classification: | Comments: | +-------------------------------------+-----------------+---------------------+ /var/svc/manifest/network/stunnel.xml Uncommitted stunnel manifest svc:/network/stunnel:default Uncommitted stunnel FMRI /usr/bin/stunnel Uncommitted stunnel executable /etc/stunnel Uncommitted stunnel configuration /etc/stunnel/stunnel.sample Uncommitted stunnel sample config /usr/share/man/man1/stunnel.1 Uncommitted stunnel man page Imported Interfaces: +-------------------------------------+-----------------+---------------------+ |Interfaces: | Classification: | Comments: | +-------------------------------------+-----------------+---------------------+ OpenSSL External/Uncommitted References: The stunnel website: http://www.stunnel.org/ 6. Resources and Schedule 6.4. Steering Committee requested information 6.4.1. Consolidation C-team Name: SFW 6.5. ARC review type: FastTrack 6.6. ARC Exposure: open From Darren.Moffat@Sun.COM Tue Jun 10 04:33:10 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5ABX9IC017402 for ; Tue, 10 Jun 2008 04:33:10 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m5ABX6kB015394; Tue, 10 Jun 2008 19:33:06 +0800 (SGT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K2800L01W35SP00@brm-avmta-1.central.sun.com>; Tue, 10 Jun 2008 05:33:05 -0600 (MDT) Received: from gmp-eb-inf-1.sun.com ([192.18.6.21]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K2800FXPW348L30@brm-avmta-1.central.sun.com>; Tue, 10 Jun 2008 05:33:05 -0600 (MDT) Received: from fe-emea-09.sun.com (gmp-eb-lb-2-fe2.eu.sun.com [192.18.6.11]) by gmp-eb-inf-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m5ABX4mt014047; Tue, 10 Jun 2008 11:33:04 +0000 (GMT) Received: from conversion-daemon.fe-emea-09.sun.com by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K2800201VEJA600@fe-emea-09.sun.com> (original mail from Darren.Moffat@Sun.COM); Tue, 10 Jun 2008 12:33:04 +0100 (BST) Received: from [129.156.173.21] by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K2800DF6W2EXM00@fe-emea-09.sun.com>; Tue, 10 Jun 2008 12:32:38 +0100 (BST) Date: Tue, 10 Jun 2008 12:32:38 +0100 From: Darren J Moffat Subject: OpenSSL contract for Stunnel [PSARC/2008/369] In-reply-to: <200806101118.m5ABIlhD017311@sac.sfbay.sun.com> Sender: Darren.Moffat@Sun.COM To: Anup.Sekar@Sun.COM, Steven.Detar@Sun.COM, contract-2003-500@Sun.COM Cc: PSARC-ext@Sun.COM, Mark.Fenwick@Sun.COM Message-id: <484E6656.2050401@Sun.COM> MIME-version: 1.0 Content-type: multipart/mixed; boundary="Boundary_(ID_CFCxULrx0TSn11hyrPGuww)" X-PMX-Version: 5.4.1.325704 References: <200806101118.m5ABIlhD017311@sac.sfbay.sun.com> User-Agent: Thunderbird 2.0.0.14 (X11/20080507) Status: RO Content-Length: 8343 This is a multi-part message in MIME format. --Boundary_(ID_CFCxULrx0TSn11hyrPGuww) Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT This case requires an ARC contract against PSARC/2003/500 for the import of OpenSSL. I've created contract-23 in the case dir of 2003/500 - a copy is also attached to this email. Anup please reply to this email with your approval as supplier. Steve please reply to this email with your approval as consumer. -- Darren J Moffat --Boundary_(ID_CFCxULrx0TSn11hyrPGuww) Content-type: text/plain; name=contract-23 Content-transfer-encoding: 7BIT Content-disposition: inline; filename=contract-23 @(#)contract 1.6 @(#) /shared/sac/arcARC-Templates/contract [1.6 02/03/27] #ident "@(#)contract.txt 1.3 03/11/04 SMI" CONTRACT ALLOWING/REQUIRING SPECIAL ARRANGEMENTS FOR INTERFACES 0. Number: PSARC/2003/500-NN 1. This contract is between a SUPPLIER of INTERFACES and a CONSUMER of those INTERFACES, both of whom are entities within Sun Microsystems, Incorporated. 2. The SUPPLIER (definer and/or implementor) is identified by the following: Product or Bundle: Solaris WOS Consolidation: ON Department or Group: Solaris Security Technology Group (SSTG) Bugtraq Category/SubCategory: solaris/solaris-crypto/openssl Responsible Manager: Anup Sekhar Contact: contract-2003-500@sun.com 3. The CONSUMER is identified by the following: Product or Bundle: Solaris WOS Consolidation: SFW Department or Group: Solaris Security Technology Group (SSTG) Bugtraq Category/SubCategory: Responsible Manager: Steven De Tar Packages: SUNWstunnelu Contact: sdetar-staff@sun.com 4. The INTERFACES are: The interfaces covered by this contract are limited to a subset of the C programming APIs that the OpenSSL communittee has choosen to document in man pages. It is the subset that the SUPPLIER beleives to be reasonably stable. That subset covers the following major subsystems: ASN1, BN, CRYPTO, EVP, HMAC, OpenSSL, PEM, PKCS7, PKCS12, RAND, SMIME, SSL, BIO, X509 In particular it does NOT cover "direct use" of encryption algorithm APIs outside of the EVP_ interfaces, eg do not call DES or AES except via EVP_Encrypt*() This contract does NOT cover the use of the openssl(1) command as an interface to be consumed. This contract does NOT cover any API or implementation artifact that does not have an OpenSSL delivered man page. OpenSSL Package names SUNWopenssl-include Unstable SUNWopenssl-libraries Unstable OpenSSL Library Location /usr/sfw/lib/libcrypto.so Unstable /usr/sfw/lib/libssl.so Unstable OpenSSL Headers Location /usr/sfw/include/openssl/*.h UnStable BN_ External BIO_ External CRYPTO_ External EVP_ External HMAC External OpenSSL_ External OBJ_ External PEM_ External PKCS7 External PKCS12_ External RAND_ External SMIME_ External SSL_ External X509_ External 5. The ARC controlling these INTERFACES is: PSARC 6. The CASE describing these INTERFACES is: PSARC/2003/500 Note: this contract is not about a specific version of OpenSSL. It covers version 0.9.7d from PSARC/2003/500 and all subsequent versions. If a change in the OpenSSL interfaces requires an update of the contract then OpenSSL iteam will contact the consumer. 7. The following SPECIAL ARRANGEMENTS are made which modify the rules imposed by the stability levels listed in section 4 above: _N_ 7a. Although the stability level doesn't normally restrict it, SUPPLIER promises to only modify INTERFACES in an incompatible way as follows: The SUPPLIER will modify the interfaces as needed by the evolution of OpenSSL releases shipped by on the www.openssl.org site. _N_ 7b. Although the stability level doesn't normally allow it, CONSUMER will expose INTERFACES to a PARTNER, which is external to Sun, namely: Name of Company: Name of Department or Group within Company: Responsible Manager: _Y_ 7c. Although the stability level doesn't normally allow it, CONSUMER will import INTERFACES from a separate consolidation. This contract is only avaliable for CONSUMERS who deliver directly to the Solaris WOS. If a contract for a CONSUMER who is not part of the Solaris WOS is requested it will be dealt with by ARC and the SUPPLIER as a new contract. _Y_ 7d. If SUPPLIER decides to change (including replace or remove) any portion of the INTERFACES, SUPPLIER will notify CONSUMER of the proposed new version, no later than the application for ARC approval of the new version. If SUPPLIER and CONSUMER are contained in the same consolidation, they will have simultaneous conversion to the new interfaces. The SUPPLIER will make a best effort to do most of the work, but the CONSUMER must be willing to supply resources to assist with modification/testing of their consuming code if necessary. Only a single version of the INTERFACES will be available at any one time. 8. If CONSUMER requires changes in INTERFACES, they must work with the OpenSSL communittee. The SUPPLIER is willing to assist with this process on a best effort to accommodate such changes. In general INTERFACE changes will not be made unless they come from the OpenSSL communittee. 9. N/A 10. SUPPLIER and CONSUMER agree that evolution of INTERFACES shall be handled as follows: The SUPPLIER will update the OpenSSL code base in the ON consolidation on an as needed basis. The trigger for these events is based on the externally defined schedule of the OpenSSL communittee. The SUPPLIER will inform the CONSUMER(S) of this change via the contract alias before filing the RTI for integration into ON. Note that it may be necessary to update INTERFACES (or more likely the implementations of them) with less than 5 working days notice. 11. SUPPLIER and CONSUMER agree that INTERFACES will be supported as follows: The SUPPLIER will NOT provide any assistance for use of the interfaces they are Externally defined and the SUPPLIER is not necessarily an expert in their use. 12. SUPPLIER and CONSUMER agree that INTERFACES will be documented as follows: The only documentation will be that provided by the OpenSSL communittee, it will be shipped in the SUNWopenssl-man package in the form of Solaris nroff man pages. 13. SUPPLIER and CONSUMER agree that changes to the INTERFACES will be tested as follows: Before each intergration the OpenSSL test suites will be run. The standard for "PASS" is that the version in the ON gate should produce the same functionality as binaries built using the OpenSSL makefiles for the same processor architecture. 14. SUPPLIER and CONSUMER agree that this contract can be terminated as follows: The CONSUMER may choose to terminate this contract at any time by sending email to the contract-2003-500@sun.com alias. The SUPPLIER may terminate this contract only after giving suffient notice to the CONSUMER. Sufficient notice in the case of CONSUMERS that are external to the ON consolidation must take into account the Solaris WOS build schedule and its restrictions for change. The SUPPLIER will terminate this contract if the interfaces are ever reclassified to something other than External. 15. This contract is not valid until "signed" via agreement from the SUPPLIER and CONSUMER, and approved by the ARC CASE referenced by this contract. E-mail agreement to the contract should be archived in the mail archive of CASE; verbal agreement to the contract should be noted in the meeting minutes. This contract remains valid until superseded or invalidated. For SUPPLIER: Anup.Sekar@Sun.COM Date: For CONSUMER: Steven.DeTar@Sun.COM Date: For ARC: Darren.MoffaT@Sun.COM Date: A copy of this contract shall be deposited in the CASE directory as "contract-23" or in a "contracts" subdirectory. 16. (Not to be filled in until superseded or invalidated.) This contract was superseded or invalidated by CASE: For ARC: Date: --Boundary_(ID_CFCxULrx0TSn11hyrPGuww)-- From carlsonj@phorcys.east.sun.com Tue Jun 10 05:27:18 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5ACRItF019382 for ; Tue, 10 Jun 2008 05:27:18 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m5ACR6AK011166; Tue, 10 Jun 2008 13:27:16 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K280060JYLFRI00@nwk-avmta-2.sfbay.sun.com>; Tue, 10 Jun 2008 05:27:15 -0700 (PDT) Received: from phorcys.east.sun.com ([129.148.174.143]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K28000OUYLEHPB0@nwk-avmta-2.sfbay.sun.com>; Tue, 10 Jun 2008 05:27:14 -0700 (PDT) Received: from phorcys.east.sun.com (localhost [127.0.0.1]) by phorcys.east.sun.com (8.14.3+Sun/8.14.3) with ESMTP id m5ACRDwp006425; Tue, 10 Jun 2008 08:27:13 -0400 (EDT) Received: (from carlsonj@localhost) by phorcys.east.sun.com (8.14.3+Sun/8.14.3/Submit) id m5ACRCvG006422; Tue, 10 Jun 2008 08:27:12 -0400 (EDT) Date: Tue, 10 Jun 2008 08:27:12 -0400 From: James Carlson Subject: Re: Stunnel [PSARC/2008/369 FastTrack timeout 06/13/2008] In-reply-to: <200806101118.m5ABIlhD017311@sac.sfbay.sun.com> To: Darren J Moffat Cc: PSARC-ext@sun.com, Mark.Fenwick@sun.com Message-id: <18510.29472.700807.622010@gargle.gargle.HOWL> MIME-version: 1.0 X-Mailer: VM 7.01 under Emacs 21.3.1 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200806101118.m5ABIlhD017311@sac.sfbay.sun.com> Status: RO Content-Length: 965 Darren J Moffat writes: > For example, an unprivileged user can start stunnel from the command > line so that it listens on a ephemeral port number. The configuration > file provided by the user will define what stunnel should do with TCP > connections to the localhost on this port number. This could be used by > a non-SSL aware mail client to communicate securely with a SSL > protected mail server. I assume that "INETD MODE" (in the man page) is supported ... it might be good to update the man page to explain how to use stunnel with the Solaris inetd. (Using that mode allows each individual mapping to be managed as a service by SMF, rather than having all of the maps dumped into one file, with a single SMF service for stunnel.) -- James Carlson, Solaris Networking Sun Microsystems / 35 Network Drive 71.232W Vox +1 781 442 2084 MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677 From steven.detar@Sun.COM Tue Jun 10 07:55:05 2008 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5AEt5Pc022672 for ; Tue, 10 Jun 2008 07:55:05 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m5AEt2cp003903; Tue, 10 Jun 2008 07:55:03 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K2900C0N5FR4T00@nwk-avmta-2.sfbay.sun.com>; Tue, 10 Jun 2008 07:55:03 -0700 (PDT) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.63]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K29008HS5FQDE90@nwk-avmta-2.sfbay.sun.com>; Tue, 10 Jun 2008 07:55:02 -0700 (PDT) Received: from steven-detars-computer.local (punchin-client-10-7-251-73.SFBay.Sun.COM [10.7.251.73]) by jurassic-x4600.sfbay.sun.com (8.14.3+Sun/8.14.3) with ESMTP id m5AEt2Yh547838; Tue, 10 Jun 2008 07:55:02 -0700 (PDT) Date: Tue, 10 Jun 2008 07:55:01 -0700 From: Steven DeTar Subject: Re: OpenSSL contract for Stunnel [PSARC/2008/369] In-reply-to: <484E6656.2050401@Sun.COM> To: Darren J Moffat Cc: Anup.Sekar@Sun.COM, contract-2003-500@Sun.COM, PSARC-ext@Sun.COM, Mark.Fenwick@Sun.COM Message-id: <484E95C5.5060508@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200806101118.m5ABIlhD017311@sac.sfbay.sun.com> <484E6656.2050401@Sun.COM> User-Agent: Thunderbird 2.0.0.14 (Macintosh/20080421) Status: RO Content-Length: 531 I approve this contract as the consumer. - Steve Darren J Moffat wrote: > This case requires an ARC contract against PSARC/2003/500 for the import > of OpenSSL. I've created contract-23 in the case dir of 2003/500 - a > copy is also attached to this email. > > Anup please reply to this email with your approval as supplier. > > Steve please reply to this email with your approval as consumer. > > -- > Darren J Moffat > -- ------------------------------------- Steven De Tar Sr Manager, Solaris Security Technologies From anup.sekhar@sun.com Tue Jun 10 09:15:37 2008 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5AGFbOl026104 for ; Tue, 10 Jun 2008 09:15:37 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m5AGFZ86007271; Tue, 10 Jun 2008 09:15:35 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K2900C0L95YAB00@nwk-avmta-1.sfbay.Sun.COM>; Tue, 10 Jun 2008 09:15:34 -0700 (PDT) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.59]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K2900MUW95XYAB0@nwk-avmta-1.sfbay.Sun.COM>; Tue, 10 Jun 2008 09:15:33 -0700 (PDT) Received: from [10.7.250.97] (punchin-client-10-7-250-97.SFBay.Sun.COM [10.7.250.97]) by jurassic-x4600.sfbay.sun.com (8.14.3+Sun/8.14.3) with ESMTP id m5AGF0mC565223; Tue, 10 Jun 2008 09:15:33 -0700 (PDT) Date: Tue, 10 Jun 2008 09:15:32 -0700 From: Anup Sekhar Subject: Re: OpenSSL contract for Stunnel [PSARC/2008/369] In-reply-to: <484E6656.2050401@Sun.COM> To: Darren J Moffat Cc: Anup.Sekar@sun.com, Steven.Detar@sun.com, contract-2003-500@sun.com, PSARC-ext@sun.com, Mark.Fenwick@sun.com Message-id: <477CFE65-9AC2-4F0C-B500-90B2D458145B@sun.com> MIME-version: 1.0 X-Mailer: Apple Mail (2.753) Content-type: text/plain; charset=US-ASCII; delsp=yes; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200806101118.m5ABIlhD017311@sac.sfbay.sun.com> <484E6656.2050401@Sun.COM> Status: RO Content-Length: 8506 On Jun 10, 2008, at 4:32 AM, Darren J Moffat wrote: > This case requires an ARC contract against PSARC/2003/500 for the > import of OpenSSL. I've created contract-23 in the case dir of > 2003/500 - a copy is also attached to this email. > > Anup please reply to this email with your approval as supplier. I approve this contract. Anup > > Steve please reply to this email with your approval as consumer. > > -- > Darren J Moffat > @(#)contract 1.6 @(#) /shared/sac/arcARC-Templates/contract [1.6 > 02/03/27] > #ident "@(#)contract.txt 1.3 03/11/04 SMI" > > CONTRACT ALLOWING/REQUIRING SPECIAL ARRANGEMENTS FOR INTERFACES > > 0. Number: PSARC/2003/500-NN > > 1. This contract is between > a SUPPLIER of INTERFACES and > a CONSUMER of those INTERFACES, > both of whom are entities within Sun Microsystems, Incorporated. > > 2. The SUPPLIER (definer and/or implementor) is identified by the > following: > Product or Bundle: Solaris WOS > Consolidation: ON > Department or Group: Solaris Security Technology Group (SSTG) > Bugtraq Category/SubCategory: solaris/solaris-crypto/openssl > Responsible Manager: Anup Sekhar > Contact: contract-2003-500@sun.com > > 3. The CONSUMER is identified by the following: > Product or Bundle: Solaris WOS > Consolidation: SFW > Department or Group: Solaris Security Technology Group (SSTG) > Bugtraq Category/SubCategory: > Responsible Manager: Steven De Tar > Packages: SUNWstunnelu > Contact: sdetar-staff@sun.com > > > 4. The INTERFACES are: > > The interfaces covered by this contract are limited to a subset > of the C programming APIs that the OpenSSL communittee has > choosen to document in man pages. It is the subset that the > SUPPLIER beleives to be reasonably stable. > > That subset covers the following major subsystems: > > ASN1, BN, CRYPTO, EVP, HMAC, OpenSSL, PEM, PKCS7, PKCS12, RAND, > SMIME, SSL, BIO, X509 > > In particular it does NOT cover "direct use" of encryption algorithm > APIs outside of the EVP_ interfaces, eg do not call DES or AES > except via EVP_Encrypt*() > > This contract does NOT cover the use of the openssl(1) command > as an interface to be consumed. > > This contract does NOT cover any API or implementation artifact > that does not have an OpenSSL delivered man page. > > OpenSSL Package names > > SUNWopenssl-include Unstable > SUNWopenssl-libraries Unstable > > OpenSSL Library Location > > /usr/sfw/lib/libcrypto.so Unstable > /usr/sfw/lib/libssl.so Unstable > > OpenSSL Headers Location > > /usr/sfw/include/openssl/*.h UnStable > > BN_ External > BIO_ External > CRYPTO_ External > EVP_ External > HMAC External > OpenSSL_ External > OBJ_ External > PEM_ External > PKCS7 External > PKCS12_ External > RAND_ External > SMIME_ External > SSL_ External > X509_ External > > > > 5. The ARC controlling these INTERFACES is: PSARC > > 6. The CASE describing these INTERFACES is: PSARC/2003/500 > > Note: this contract is not about a specific version of OpenSSL. > It covers > version 0.9.7d from PSARC/2003/500 and all subsequent versions. > If a > change in the OpenSSL interfaces requires an update of the > contract then > OpenSSL iteam will contact the consumer. > > 7. The following SPECIAL ARRANGEMENTS are made which modify the rules > imposed by the stability levels listed in section 4 above: > > _N_ 7a. Although the stability level doesn't normally restrict it, > SUPPLIER promises to only modify INTERFACES in an incompatible > way as follows: > > The SUPPLIER will modify the interfaces as needed by the > evolution > of OpenSSL releases shipped by on the www.openssl.org site. > > _N_ 7b. Although the stability level doesn't normally allow it, > CONSUMER will > expose INTERFACES to a PARTNER, which is external to Sun, > namely: > Name of Company: > Name of Department or Group within Company: > Responsible Manager: > > _Y_ 7c. Although the stability level doesn't normally allow it, > CONSUMER will > import INTERFACES from a separate consolidation. > > This contract is only avaliable for CONSUMERS who deliver > directly > to the Solaris WOS. > > If a contract for a CONSUMER who is not part of the Solaris > WOS is > requested it will be dealt with by ARC and the SUPPLIER as > a new > contract. > > _Y_ 7d. If SUPPLIER decides to change (including replace or remove) > any > portion of the INTERFACES, SUPPLIER will notify CONSUMER of the > proposed new version, no later than the application for ARC > approval of the new version. > If SUPPLIER and CONSUMER are contained in the same > consolidation, they will have simultaneous conversion to the > new interfaces. > The SUPPLIER will make a best effort to do most of the work, but > the CONSUMER must be willing to supply resources to assist with > modification/testing of their consuming code if necessary. > > Only a single version of the INTERFACES will be available at any > one time. > > 8. If CONSUMER requires changes in INTERFACES, they must work with the > OpenSSL communittee. The SUPPLIER is willing to assist with this > process on a best effort to accommodate such changes. > In general INTERFACE changes will not be made unless they come from > the OpenSSL communittee. > > 9. N/A > > 10. SUPPLIER and CONSUMER agree that evolution of INTERFACES shall be > handled as follows: > > The SUPPLIER will update the OpenSSL code base in the ON > consolidation > on an as needed basis. The trigger for these events is based > on the > externally defined schedule of the OpenSSL communittee. > > The SUPPLIER will inform the CONSUMER(S) of this change via the > contract alias before filing the RTI for integration into ON. > > Note that it may be necessary to update INTERFACES (or more likely > the implementations of them) with less than 5 working days notice. > > 11. SUPPLIER and CONSUMER agree that INTERFACES will be supported as > follows: > > The SUPPLIER will NOT provide any assistance for use of the > interfaces > they are Externally defined and the SUPPLIER is not necessarily an > expert in their use. > > 12. SUPPLIER and CONSUMER agree that INTERFACES will be documented as > follows: > > The only documentation will be that provided by the OpenSSL > communittee, it will be shipped in the SUNWopenssl-man package > in the form of Solaris nroff man pages. > > 13. SUPPLIER and CONSUMER agree that changes to the INTERFACES will be > tested as follows: > > Before each intergration the OpenSSL test suites will be run. The > standard for "PASS" is that the version in the ON gate should > produce > the same functionality as binaries built using the OpenSSL > makefiles > for the same processor architecture. > > 14. SUPPLIER and CONSUMER agree that this contract can be > terminated as > follows: > > The CONSUMER may choose to terminate this contract at any time by > sending email to the contract-2003-500@sun.com alias. > > The SUPPLIER may terminate this contract only after giving > suffient > notice to the CONSUMER. Sufficient notice in the case of > CONSUMERS > that are external to the ON consolidation must take into > account the > Solaris WOS build schedule and its restrictions for change. > > The SUPPLIER will terminate this contract if the interfaces > are ever reclassified to something other than External. > > 15. This contract is not valid until "signed" via agreement from the > SUPPLIER and CONSUMER, and approved by the ARC CASE referenced by > this contract. E-mail agreement to the contract should be > archived > in the mail archive of CASE; verbal agreement to the contract > should be noted in the meeting minutes. This contract remains > valid until superseded or invalidated. > > For SUPPLIER: Anup.Sekar@Sun.COM Date: > For CONSUMER: Steven.DeTar@Sun.COM Date: > For ARC: Darren.MoffaT@Sun.COM Date: > > A copy of this contract shall be deposited in the CASE > directory as > "contract-23" or in a "contracts" subdirectory. > > 16. (Not to be filled in until superseded or invalidated.) > This contract was superseded or invalidated by CASE: > For ARC: Date: > From bhargava.yenduri@sun.com Tue Jun 10 13:14:16 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5AKEFZ2008997 for ; Tue, 10 Jun 2008 13:14:16 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m5AKDud9013047; Tue, 10 Jun 2008 21:14:14 +0100 (BST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K2900C03K7PVS00@brm-avmta-1.central.sun.com>; Tue, 10 Jun 2008 14:14:13 -0600 (MDT) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.63]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K29008GXK7OB340@brm-avmta-1.central.sun.com>; Tue, 10 Jun 2008 14:14:12 -0600 (MDT) Received: from [129.146.108.66] (bluesky.SFBay.Sun.COM [129.146.108.66]) by jurassic-x4600.sfbay.sun.com (8.14.3+Sun/8.14.3) with ESMTP id m5AKEC1I612955; Tue, 10 Jun 2008 13:14:12 -0700 (PDT) Date: Tue, 10 Jun 2008 13:14:02 -0700 From: Krishna Yenduri Subject: Re: Stunnel [PSARC/2008/369 FastTrack timeout 06/13/2008] In-reply-to: <200806101118.m5ABIlhD017311@sac.sfbay.sun.com> To: Darren J Moffat Cc: PSARC-ext@sun.com, Mark.Fenwick@sun.com Message-id: <484EE08A.9090102@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200806101118.m5ABIlhD017311@sac.sfbay.sun.com> User-Agent: Thunderbird 2.0.0.12 (X11/20080310) Status: RO Content-Length: 796 Darren J Moffat wrote: > When stunnel is used to provide a SSL protected system service on a > well known port, the stunnel command needs to be started by a > privileged user. It should be started when the system boots, for this > reason a Solaris specific smf(5) manifest is provided to enable a > stunnel service. > > The svc:/network/stunnel:default service is disabled by default because > it requires configuration before use. A sample configuration file is > also provided. > I would recommend changing the FMRI to svc:/network/ssl/stunnel:default since kernel SSL (KSSL) added network/ssl. BTW, stunnel is a nice complement to kernel SSL because it can do client side SSL. kernel SSL gives better performance on the server side where performance is more important. -Krishna From Darren.Moffat@sun.com Wed Jun 11 02:07:39 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5B97cwv003755 for ; Wed, 11 Jun 2008 02:07:39 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m5B97Pog018431; Wed, 11 Jun 2008 10:07:37 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K2A00A0BK0N4V00@nwk-avmta-1.sfbay.Sun.COM>; Wed, 11 Jun 2008 02:07:35 -0700 (PDT) Received: from gmp-eb-inf-2.sun.com ([192.18.6.24]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K2A008K8K0LEO00@nwk-avmta-1.sfbay.Sun.COM>; Wed, 11 Jun 2008 02:07:34 -0700 (PDT) Received: from fe-emea-09.sun.com (gmp-eb-lb-2-fe1.eu.sun.com [192.18.6.10]) by gmp-eb-inf-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m5B97WQL021684; Wed, 11 Jun 2008 09:07:32 +0000 (GMT) Received: from conversion-daemon.fe-emea-09.sun.com by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K2A00C01J43K500@fe-emea-09.sun.com> (original mail from Darren.Moffat@Sun.COM); Wed, 11 Jun 2008 10:07:32 +0100 (BST) Received: from [129.156.173.21] by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K2A00MDFK07BC10@fe-emea-09.sun.com>; Wed, 11 Jun 2008 10:07:20 +0100 (BST) Date: Wed, 11 Jun 2008 10:07:19 +0100 From: Darren J Moffat Subject: Re: Stunnel [PSARC/2008/369 FastTrack timeout 06/13/2008] In-reply-to: <484EE08A.9090102@sun.com> Sender: Darren.Moffat@sun.com To: Krishna Yenduri Cc: Darren J Moffat , PSARC-EXT@sun.com, Mark.Fenwick@sun.com Message-id: <484F95C7.1010408@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200806101118.m5ABIlhD017311@sac.sfbay.sun.com> <484EE08A.9090102@sun.com> User-Agent: Thunderbird 2.0.0.14 (X11/20080507) Status: RO Content-Length: 1033 Krishna Yenduri wrote: > Darren J Moffat wrote: >> When stunnel is used to provide a SSL protected system service on a >> well known port, the stunnel command needs to be started by a >> privileged user. It should be started when the system boots, for this >> reason a Solaris specific smf(5) manifest is provided to enable a >> stunnel service. >> >> The svc:/network/stunnel:default service is disabled by default because >> it requires configuration before use. A sample configuration file is >> also provided. >> > > I would recommend changing the FMRI to > svc:/network/ssl/stunnel:default > since kernel SSL (KSSL) added network/ssl. > > BTW, stunnel is a nice complement to kernel SSL because it can do client > side SSL. kernel SSL gives better performance on the server side > where performance is more important. I agree with Krishna's suggestion on the FMRI, I did go looking for it but forgot that there are no kssl instances by default so it didn't show up in "svcs -a | grep ssl". -- Darren J Moffat From Darren.Moffat@Sun.COM Wed Jun 11 11:17:41 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5BIHeoY020335 for ; Wed, 11 Jun 2008 11:17:40 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m5BIHWhm012120; Thu, 12 Jun 2008 02:17:37 +0800 (SGT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K2B00N059HB0T00@brm-avmta-1.central.sun.com>; Wed, 11 Jun 2008 12:17:35 -0600 (MDT) Received: from gmp-eb-inf-2.sun.com ([192.18.6.24]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K2B0050Y9HAHCE0@brm-avmta-1.central.sun.com>; Wed, 11 Jun 2008 12:17:35 -0600 (MDT) Received: from fe-emea-09.sun.com (gmp-eb-lb-2-fe1.eu.sun.com [192.18.6.10]) by gmp-eb-inf-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m5BIHY6X008891; Wed, 11 Jun 2008 18:17:34 +0000 (GMT) Received: from conversion-daemon.fe-emea-09.sun.com by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K2B00L019C1SA00@fe-emea-09.sun.com> (original mail from Darren.Moffat@Sun.COM); Wed, 11 Jun 2008 19:17:34 +0100 (BST) Received: from [129.156.173.21] by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K2B00DOJ9H9I800@fe-emea-09.sun.com>; Wed, 11 Jun 2008 19:17:34 +0100 (BST) Date: Wed, 11 Jun 2008 19:17:33 +0100 From: Darren J Moffat Subject: PSARC/2008/369 stunnel [ closed-approved ] Sender: Darren.Moffat@Sun.COM To: PSARC-EXT@Sun.COM Cc: mark.fenwick@Sun.COM Message-id: <485016BD.8080009@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 User-Agent: Thunderbird 2.0.0.14 (X11/20080507) Status: RO Content-Length: 60 This case was approved in PSARC today. -- Darren J Moffat From Mark.Fenwick@sun.com Fri Jun 13 14:31:44 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5DLVhGE008019 for ; Fri, 13 Jun 2008 14:31:44 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m5DLVdbu010783; Fri, 13 Jun 2008 22:31:41 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K2F00A0J7SQPG00@nwk-avmta-2.sfbay.sun.com>; Fri, 13 Jun 2008 14:31:38 -0700 (PDT) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.59]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K2F006DH7SP6Z40@nwk-avmta-2.sfbay.sun.com>; Fri, 13 Jun 2008 14:31:37 -0700 (PDT) Received: from ushers (ushers.SFBay.Sun.COM [129.146.108.235]) by jurassic-x4600.sfbay.sun.com (8.14.3+Sun/8.14.3) with SMTP id m5DLVbdv692662; Fri, 13 Jun 2008 14:31:37 -0700 (PDT) Date: Fri, 13 Jun 2008 14:28:51 -0700 (PDT) From: Mark Fenwick Subject: Re: Stunnel [PSARC/2008/369 FastTrack timeout 06/13/2008] In-reply-to: Your message with ID <18510.29472.700807.622010@gargle.gargle.HOWL> To: James Carlson Cc: Darren J Moffat , PSARC-ext@sun.com, Mark.Fenwick@sun.com Reply-to: Mark Fenwick Message-id: MIME-version: 1.0 Content-type: TEXT/PLAIN; CHARSET=US-ASCII Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 1312 > Darren J Moffat writes: > > For example, an unprivileged user can start stunnel from the command > > line so that it listens on a ephemeral port number. The configuration > > file provided by the user will define what stunnel should do with TCP > > connections to the localhost on this port number. This could be used by > > a non-SSL aware mail client to communicate securely with a SSL > > protected mail server. > > I assume that "INETD MODE" (in the man page) is supported ... it might > be good to update the man page to explain how to use stunnel with the > Solaris inetd. (Using that mode allows each individual mapping to be > managed as a service by SMF, rather than having all of the maps dumped > into one file, with a single SMF service for stunnel.) I have added a section to the man page to describe how to add a new service to inetd, although IMHO this should be explained in inetd(1M) and inetd.conf(4). Mark ---------------------------------------------------------------------------- Mark Fenwick, Solaris Security Technologies. TEL: +1 (650) 786 2733 (X82733) __o Sun Microsystems Inc, Menlo Park, California. `\<,_ (*)/ (*) ---------------------------------------------------------------------------- From Mark.Fenwick@Sun.COM Fri Jun 13 14:34:03 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5DLY2Hq008359 for ; Fri, 13 Jun 2008 14:34:02 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m5DLXxre011571; Fri, 13 Jun 2008 22:34:00 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K2F00A057WNSQ00@nwk-avmta-2.sfbay.sun.com>; Fri, 13 Jun 2008 14:33:59 -0700 (PDT) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.63]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K2F006JB7WM6Z40@nwk-avmta-2.sfbay.sun.com>; Fri, 13 Jun 2008 14:33:59 -0700 (PDT) Received: from ushers (ushers.SFBay.Sun.COM [129.146.108.235]) by jurassic-x4600.sfbay.sun.com (8.14.3+Sun/8.14.3) with SMTP id m5DLXwLQ693059; Fri, 13 Jun 2008 14:33:58 -0700 (PDT) Date: Fri, 13 Jun 2008 14:31:12 -0700 (PDT) From: Mark Fenwick Subject: Re: Stunnel [PSARC/2008/369 FastTrack timeout 06/13/2008] In-reply-to: Your message with ID <484EE08A.9090102@sun.com> To: Krishna Yenduri Cc: Darren J Moffat , PSARC-ext@Sun.COM, Mark.Fenwick@Sun.COM Reply-to: Mark Fenwick Message-id: MIME-version: 1.0 Content-type: TEXT/PLAIN; CHARSET=US-ASCII Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 1103 > Darren J Moffat wrote: > > When stunnel is used to provide a SSL protected system service on a > > well known port, the stunnel command needs to be started by a > > privileged user. It should be started when the system boots, for this > > reason a Solaris specific smf(5) manifest is provided to enable a > > stunnel service. > > > > The svc:/network/stunnel:default service is disabled by default because > > it requires configuration before use. A sample configuration file is > > also provided. > > > > I would recommend changing the FMRI to > svc:/network/ssl/stunnel:default > since kernel SSL (KSSL) added network/ssl. OK, changed this, how do I update the original case to reflect this change ? Mark ---------------------------------------------------------------------------- Mark Fenwick, Solaris Security Technologies. TEL: +1 (650) 786 2733 (X82733) __o Sun Microsystems Inc, Menlo Park, California. `\<,_ (*)/ (*) ---------------------------------------------------------------------------- From Darren.Moffat@sun.com Mon Jun 16 02:34:57 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m5G9Yu1L015268 for ; Mon, 16 Jun 2008 02:34:57 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m5G9Yfhg004494; Mon, 16 Jun 2008 10:34:55 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K2J00G0BUM4C100@nwk-avmta-2.sfbay.sun.com>; Mon, 16 Jun 2008 02:34:52 -0700 (PDT) Received: from gmp-eb-inf-1.sun.com ([192.18.6.21]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K2J00C2OUM3GW40@nwk-avmta-2.sfbay.sun.com>; Mon, 16 Jun 2008 02:34:52 -0700 (PDT) Received: from fe-emea-10.sun.com (gmp-eb-lb-2-fe3.eu.sun.com [192.18.6.12]) by gmp-eb-inf-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m5G9YpHD007813; Mon, 16 Jun 2008 09:34:51 +0000 (GMT) Received: from conversion-daemon.fe-emea-10.sun.com by fe-emea-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K2J00301TR6ID00@fe-emea-10.sun.com> (original mail from Darren.Moffat@Sun.COM); Mon, 16 Jun 2008 10:34:51 +0100 (BST) Received: from [129.156.173.21] by fe-emea-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K2J00EY0ULUIBC0@fe-emea-10.sun.com>; Mon, 16 Jun 2008 10:34:43 +0100 (BST) Date: Mon, 16 Jun 2008 10:34:42 +0100 From: Darren J Moffat Subject: Re: Stunnel [PSARC/2008/369 FastTrack timeout 06/13/2008] In-reply-to: Sender: Darren.Moffat@sun.com To: Mark Fenwick Cc: Krishna Yenduri , PSARC-ext@sun.com, Darren J Moffat Message-id: <485633B2.4060407@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: User-Agent: Thunderbird 2.0.0.14 (X11/20080507) Status: RO Content-Length: 839 Mark Fenwick wrote: >> Darren J Moffat wrote: >>> When stunnel is used to provide a SSL protected system service on a >>> well known port, the stunnel command needs to be started by a >>> privileged user. It should be started when the system boots, for this >>> reason a Solaris specific smf(5) manifest is provided to enable a >>> stunnel service. >>> >>> The svc:/network/stunnel:default service is disabled by default because >>> it requires configuration before use. A sample configuration file is >>> also provided. >>> >> I would recommend changing the FMRI to >> svc:/network/ssl/stunnel:default >> since kernel SSL (KSSL) added network/ssl. > > > OK, changed this, how do I update the original case to reflect this change ? The updated and final specification is in the case directory as spec.txt. -- Darren J Moffat