---------- Forwarded message ---------- Date: Mon, 17 Jun 2002 21:47:49 -0700 From: Russ Cox <rsc@plan9.bell-labs.com> Reply-To: 9fans@cse.psu.edu To: 9fans@cse.psu.edu Subject: [9fans] tls tunnelling I was intrigued by the prospect of running a TLS-tunneled VNC over the internet (since right now I run plaintext VNCs over the internet), so I looked up stunnel. The interface seemed more reasonable than what I posted earlier today, so I built an equivalent one for Plan 9. Sources now has the following new (and documented) programs: aux/listen1 - simple network listener like inferno's listen(1) tlsclient - what i posted earlier, but no cmd tlssrvtunnel - server side tunneler tlssrvclient - client side tunneler I figured out how to generate new certificates with OpenSSL and documented that too. Enjoy. Russ TLSSRV(8) TLSSRV(8) NAME tlssrv, tlsclient, tlssrvtunnel, tlsclienttunnel - TLS server and client SYNOPSIS tlssrv [ -c cert.pem ] [ -l logfile ] [ -r remotesys ] cmd [ args ... ] tlsclient [ -t trustedkeys ] [ -x excludedkeys ] address tlssrvtunnel plain-addr crypt-addr cert.pem tlsclienttunnel crypt-addr plain-addr trustedkeys DESCRIPTION Tlssrv is a helper program, typically exec'd in a /bin/service file to establish an SSL or TLS connection before launching cmd args; a typical command might start the IMAP or HTTP server. Cert.pem is the server certificate; factotum(4) should hold the corresponding private key. The specified logfile is by convention the same as for the tar- get server. Remotesys is mainly used for logging. Tlsclient is the reverse of tlssrv: it dials address, starts TLS, and then relays between the network connection and standard input and output. If the -t flag (and, optionally, the -x flag) is given, the remote server must present a key whose SHA1 hash is listed in the file trustedkeys but not in the file excludedkeys. See thumbprint(6) for more informa- tion. Tlssrvtunnel and tlsclienttunnel use these tools and listen1 (see listen(8)) to provide TLS network tunnels, allowing legacy application to take advantage of TLS encryption. EXAMPLES Listen for TLS-encrypted IMAP by creating a server certifi- cate /sys/lib/tls/imap.pem and a listener script /bin/service.auth/tcp993 containing: #!/bin/rc exec tlssrv -c/sys/lib/tls/imap.pem -limap4d -r`{cat $3/remote} \ /bin/ip/imap4d -p -dyourdomain -r`{cat $3/remote} \ >[2]/sys/log/imap4d Interact with the server, putting the appropriate hash into /sys/lib/tls/mail and running: tlsclient -t /sys/lib/tls/mail tcp!server!imaps Create a TLS-encrypted VNC connection from a client on kremvax to a server on moscvax: mosc% vncs -d :3 mosc% tlssrvtunnel tcp!moscvax!5903 tcp!*!12345 \ /usr/you/lib/cert.pem krem% tlsclienttunnel tcp!moscvax!12345 tcp!*!5905 \ /usr/you/lib/cert.thumb krem% vncv kremvax:5 (The port numbers passed to the VNC tools are offset by 5900 from the actual TCP port numbers.) FILES /sys/lib/tls SOURCE /sys/src/cmd/tlssrv.c /sys/src/cmd/tlsclient.c /rc/bin/tlssrvtunnel /rc/bin/tlsclienttunnel SEE ALSO factotum(4), listen(8) Unix's stunnel BUGS There is not yet a Plan 9 tool to generate X.509 certifi- cates and public keys. Instead, use the Unix openssl toolkit: openssl req -x509 -nodes -newkey rsa:1024 -keyout key.pem -out cert.pem