ucspi-tcp

ucspi-tcp is DJB's original implementation of UCSPI, the Unix Client-Server Program Interface, using the TCP protocol.

In english, it's a set of programs which make it easy to write and run service programs which accept connections on TCP sockets, as well as client programs which connect to services on TCP sockets. The programs in the ucspi-tcp package take care of the messy networking details, and allow the programmer or system administrator to concentrate on making their service or client work correctly.

It's mentioned on this web site because the normal method of running an SMTP or POP3 service is to use the "tcpserver" program, which is part of the ucspi-tcp package. It's also possible to use tcpserver to run other TCP-based services, such as IMAP services.

If you're running a qmail server, you should definitely understand how tcpserver works.

Patches

Like qmail, the programs in the ucspi-tcp package are lacking in some features which many people, myself included, need on their servers. Below is a list of the ucspi-tcp patches I use on my own systems:

• ucspi-tcp-0.88.errno.patch The ucspi-tcp package, like all of DJB's other packages, has an issue with the errno variable when compiled using glibc version 2.3 or higher. The solution is the same as for DJB's other packages as well.

  Edit the file error.h in the source code. Find this line, near the top of the file:

  extern int errno;

  Comment this line out, and add the following line below it:

  /* extern int errno; */
  #include <errno.h>

  If you would rather not edit the file by hand, the patch file can be used to make the change as well.

• ucspi-rss.diff is a patch by Alan Curry which makes the rblsmtpd program work with A records. This is necessary because the owners of "rss" (one of the first anti-spam "blacklists") removed the TXT records from their zone files, because the DNS server they were using to serve the zone (BIND, which they also wrote) had trouble with large zone files, a problem which the "rbldns" program (from DJB's djbdns package) does not share.

  I have updated the patch. With the original patch, when rblsmtpd retrieves a TXT record, it scans the value for the string "%IP%" and replaces it with the value of TCPREMOTEIP (i.e. the IP address of the client.) My updated version does the same substitution on the value of the RBLSMTPD environment variable when it starts.

  You can download the original patch from qmail.org, or from my server. You can download the updated patch here:

  File:	ucspi-rss2.patch
  Size:	2,634 bytes
  Date:	2008-12-09 03:58:49 +0000
  MD5:	94272dd7ece27fbde4acfe9e75cffcd4
  SHA-1:	7a99fca1ff9416c74a5171dae38efb48f075d8bd
  RIPEMD-160:	f8337e769328c53295b1bf8dfb0b1bcd4af54287
  PGP Signature:	ucspi-rss2.patch.asc

• The tcpserver limits patch, by Matija Nalis, gives tcpserver the ability to reject connections when the server's load average is above a certain number, when more than a certain number of connections are received from the same IP address, or when more than a certain number of connections are received from machines in the same class-C block (i.e. the "first three numbers" in their IP addresses are the same. "1.2.3.4" and "1.2.3.100" are in the same class-C block.)

  The limits are configured by setting the MAXLOAD, MAXCONNIP, and MAXCONNC environment variables before tcpserver runs. If you want tcpserver to send a message to the client before dropping their connection, you can configure this by setting a DIEMSG environment variable.

  The patch I was using, dated 2006-01-26, does work as advertised, and has saved my own server and several of my clients' servers from being overloaded by over-zealous attackers (i.e. spammers) over the past few months. However, I did notice a few minor cosmetic issues which I thought needed to be fixed, so I updated the patch.

  My updates are:

  • When MAXCONNIP or MAXCONNC cause a connection to be rejected, tcpserver adds "MAXCONNIP:" or "MAXCONNC:" with the limit at the end of the "deny line in the logs. This makes it easy to debug- the error message tells you which environment variable caused the connection to be rejected.

    However, when MAXLOAD causes a connection to be rejected, it adds "LOAD:" and the current load average to the log. This doesn't match the environment variable, which "feels funny" to me. (I told you it was a minor cosmetic issue.)

    For the sake of consistency, I changed the "LOAD:" label to say "MAXLOAD:", so it matches the environment variable name, like the other two messages do.

  • The older patch only has a provision for a single DIEMSG variable, whose value is sent to a client whose connection is being rejected, regardless of which of the three limits the client triggered. I thought it would be nice to be able to set one message which says something like "Server too busy, try again later" and another message which says "Too many connections from your IP address".

    I added three new environment variables: DIEMSG_MAXLOAD, DIEMSG_MAXCONNIP, and DIEMSG_MAXCONNC, whose values are used instead of the generic DIEMSG message. However, to avoid breaking older scripts, if one of these new variables is not set, the DIEMSG value will be used instead.

  The original author's web page has a link where you can download the previous versions of the patch. As of the time I'm writing this (2007-12-22) the most recent version of his patch is dated 2006-01-26, and is what I used as the starting point for my own changes.

  Below is the link to download the patch. I also have the CHANGES.tcpserver-limits-patch and README.tcpserver-limits-patch files available, if you want to read them before downloading the patch.

  File:	tcpserver-limits-2007-12-22.patch
  Size:	17,649 bytes
  Date:	2007-12-22 08:09:42 +0000
  MD5:	c3edb80eada4d290ea6b8dd78612a1df
  SHA-1:	6a47513a837bd0c8d66c2a7a7b035d23109dc5d8
  RIPEMD-160:	3af41e3c323b1ab26bca4aa4a97cf1a1c1848582
  PGP Signature:	tcpserver-limits-2007-12-22.patch.asc

Copyright 1995-2024 John M. Simpson KG4ZOW (email) (PGP key)
Last updated 2008-12-09 04:07:12 +0000