[9fans] tls tunnelling (fwd)

[Jim Choate]

---------- Forwarded message ----------
Date: Mon, 17 Jun 2002 21:47:49 -0700
From: Russ Cox <rsc at plan9.bell-labs.com>
Reply-To: 9fans at cse.psu.edu
To: 9fans at cse.psu.edu
Subject: [9fans] tls tunnelling

I was intrigued by the prospect of running a
TLS-tunneled VNC over the internet (since right
now I run plaintext VNCs over the internet),
so I looked up stunnel.  The interface seemed
more reasonable than what I posted earlier today,
so I built an equivalent one for Plan 9.

Sources now has the following new (and documented) programs:

	aux/listen1 - simple network listener like inferno's listen(1)
	tlsclient - what i posted earlier, but no cmd
	tlssrvtunnel - server side tunneler
	tlssrvclient - client side tunneler

I figured out how to generate new certificates with
OpenSSL and documented that too.

Enjoy.
Russ

     TLSSRV(8)                                               TLSSRV(8)

     NAME
          tlssrv, tlsclient, tlssrvtunnel, tlsclienttunnel - TLS
          server and client

     SYNOPSIS
          tlssrv [ -c cert.pem ] [ -l logfile ] [ -r remotesys ] cmd [
          args ... ]

          tlsclient [ -t trustedkeys ] [ -x excludedkeys ] address

          tlssrvtunnel plain-addr crypt-addr cert.pem

          tlsclienttunnel crypt-addr plain-addr trustedkeys

     DESCRIPTION
          Tlssrv is a helper program, typically exec'd in a
          /bin/service file to establish an SSL or TLS connection
          before launching cmd args; a typical command might start the
          IMAP or HTTP server.  Cert.pem is the server certificate;
          factotum(4) should hold the corresponding private key.  The
          specified logfile is by convention the same as for the tar-
          get server.  Remotesys is mainly used for logging.

          Tlsclient is the reverse of tlssrv: it dials address, starts
          TLS, and then relays between the network connection and
          standard input and output.  If the -t flag (and, optionally,
          the -x flag) is given, the remote server must present a key
          whose SHA1 hash is listed in the file trustedkeys but not in
          the file excludedkeys. See thumbprint(6) for more informa-
          tion.

          Tlssrvtunnel and tlsclienttunnel use these tools and listen1
          (see listen(8)) to provide TLS network tunnels, allowing
          legacy application to take advantage of TLS encryption.

     EXAMPLES
          Listen for TLS-encrypted IMAP by creating a server certifi-
          cate /sys/lib/tls/imap.pem and a listener script
          /bin/service.auth/tcp993 containing:

               #!/bin/rc
               exec tlssrv -c/sys/lib/tls/imap.pem -limap4d -r`{cat $3/remote} \
                   /bin/ip/imap4d -p -dyourdomain -r`{cat $3/remote} \
                   >[2]/sys/log/imap4d

          Interact with the server, putting the appropriate hash into
          /sys/lib/tls/mail and running:

               tlsclient -t /sys/lib/tls/mail tcp!server!imaps

          Create a TLS-encrypted VNC connection from a client on
          kremvax to a server on moscvax:

               mosc% vncs -d :3
               mosc% tlssrvtunnel tcp!moscvax!5903 tcp!*!12345 \
                       /usr/you/lib/cert.pem
               krem% tlsclienttunnel tcp!moscvax!12345 tcp!*!5905 \
                       /usr/you/lib/cert.thumb
               krem% vncv kremvax:5

          (The port numbers passed to the VNC tools are offset by 5900
          from the actual TCP port numbers.)

     FILES
          /sys/lib/tls

     SOURCE
          /sys/src/cmd/tlssrv.c
          /sys/src/cmd/tlsclient.c
          /rc/bin/tlssrvtunnel
          /rc/bin/tlsclienttunnel

     SEE ALSO
          factotum(4), listen(8)
          Unix's stunnel

     BUGS
          There is not yet a Plan 9 tool to generate X.509 certifi-
          cates and public keys.  Instead, use the Unix openssl
          toolkit:

               openssl req -x509 -nodes -newkey rsa:1024 -keyout key.pem -out cert.pem