Re: relayd load certificates via fd

2017-11-27 Thread Claudio Jeker
On Mon, Nov 27, 2017 at 11:46:54PM +0100, Claudio Jeker wrote: > On Mon, Nov 27, 2017 at 11:34:49PM +0100, Alexander Bluhm wrote: > > On Mon, Nov 27, 2017 at 11:26:06PM +0100, Claudio Jeker wrote: > > > Guess we should make the 3 fatalx() in that code different so that it > > > becomes more clear o

Re: relayd load certificates via fd

2017-11-27 Thread Claudio Jeker
On Mon, Nov 27, 2017 at 11:34:49PM +0100, Alexander Bluhm wrote: > On Mon, Nov 27, 2017 at 11:26:06PM +0100, Claudio Jeker wrote: > > Guess we should make the 3 fatalx() in that code different so that it > > becomes more clear on which call it fails. > > As in the diff below? > > > Wonder what ki

Re: relayd load certificates via fd

2017-11-27 Thread Alexander Bluhm
On Mon, Nov 27, 2017 at 11:26:06PM +0100, Claudio Jeker wrote: > Guess we should make the 3 fatalx() in that code different so that it > becomes more clear on which call it fails. As in the diff below? > Wonder what kind of startup race we lose... I can reproduce one of the errors on my laptop:

Re: relayd load certificates via fd

2017-11-27 Thread Claudio Jeker
On Mon, Nov 27, 2017 at 11:11:59PM +0100, Alexander Bluhm wrote: > On Mon, Nov 27, 2017 at 11:04:49PM +0100, Alexander Bluhm wrote: > > And I am waiting for my loop to fail ... > > Now I have got a different error: > > execute: ssh ot2 perl -I /usr/src/regress/usr.sbin/relayd > /usr/src/regress/

Re: relayd load certificates via fd

2017-11-27 Thread Claudio Jeker
On Mon, Nov 27, 2017 at 11:04:49PM +0100, Alexander Bluhm wrote: > On Mon, Nov 27, 2017 at 10:40:33PM +0100, Claudio Jeker wrote: > > Does not happen here. Running > > while make run-regress-args-https-inspect.pl ; do echo -n; done > > for a few minutes now and no failure. > > It takes a while

Re: relayd load certificates via fd

2017-11-27 Thread Alexander Bluhm
On Mon, Nov 27, 2017 at 11:04:49PM +0100, Alexander Bluhm wrote: > And I am waiting for my loop to fail ... Now I have got a different error: execute: ssh ot2 perl -I /usr/src/regress/usr.sbin/relayd /usr/src/regress/usr.sbin/relayd/remote.pl copy 10.188.81.22 10.188.81.21 37198 /usr/src/regres

Re: relayd load certificates via fd

2017-11-27 Thread Alexander Bluhm
On Mon, Nov 27, 2017 at 10:40:33PM +0100, Claudio Jeker wrote: > Does not happen here. Running > while make run-regress-args-https-inspect.pl ; do echo -n; done > for a few minutes now and no failure. It takes a while. I am running it on - very old and slow i386 machine, different timing -

Re: relayd load certificates via fd

2017-11-27 Thread Claudio Jeker
On Mon, Nov 27, 2017 at 10:27:50PM +0100, Alexander Bluhm wrote: > On Mon, Nov 27, 2017 at 08:23:29PM +0100, Claudio Jeker wrote: > > Instead of using imsg to pass certificates, pass the fd to the cert to the > > relay processes. This allows for large certificates and esp. ca file to > > work. OCSP

Re: relayd load certificates via fd

2017-11-27 Thread Alexander Bluhm
On Mon, Nov 27, 2017 at 08:23:29PM +0100, Claudio Jeker wrote: > Instead of using imsg to pass certificates, pass the fd to the cert to the > relay processes. This allows for large certificates and esp. ca file to > work. OCSP stapling will also be added through this. relayd regression tests pass

relayd load certificates via fd

2017-11-27 Thread Claudio Jeker
Instead of using imsg to pass certificates, pass the fd to the cert to the relay processes. This allows for large certificates and esp. ca file to work. OCSP stapling will also be added through this. OK? -- :wq Claudio Index: ca.c =