<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta name="Generator" content="Microsoft Word 15 (filtered medium)"> <style></style> </head> <body lang="EN-GB" link="blue" vlink="purple"> <div class="WordSection1"> Thanks for the response.<o:p></o:p> <o:p> </o:p> Yes the server program need not bind and listen because systemd socket will do that.<o:p></o:p> <o:p> </o:p> On “Accept=True” parameter, here the requirement is that systemd should accept the connection and handover it to server. <o:p></o:p> <o:p> </o:p> My query was on post the connection accept by systemd. <o:p></o:p> Once the regular connection is accepted, client does SSL_connect over same fd to establish SSL connection.<o:p></o:p> Will this SSL connect request also be handled by systemd ? <o:p></o:p> <o:p> </o:p> Regards,<o:p></o:p> Hari.<o:p></o:p> <o:p> </o:p> <o:p> </o:p> From: Mantas Mikulėnas [mailto:grawity@gmail.com] Sent: Tuesday, January 28, 2020 8:02 PM To: Tiwari, Hari Sahaya <hari-sahaya.tiwari@hpe.com> Cc: systemd-devel@lists.freedesktop.org Subject: Re: [systemd-devel] SSL_connect fails on systemd socket<o:p></o:p> <o:p> </o:p> <div> <div> On Tue, Jan 28, 2020 at 4:23 PM Tiwari, Hari Sahaya <<a href="mailto:hari-sahaya.tiwari@hpe.com">hari-sahaya.tiwari@hpe.com</a>> wrote:<o:p></o:p> </div> <div> <blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in"> <div> <div> Hi,<o:p></o:p> <o:p></o:p> I am trying to implement a client server program over SSL through systemd.<o:p></o:p> Here I have a TCP systemd socket (listening on a predefined port) and its associated service.<o:p></o:p> <o:p></o:p> systemd socket file:-<o:p></o:p> # cat /usr/lib/systemd/system/test_ssl.socket<o:p></o:p> [Unit]<o:p></o:p> Description=Test socket<o:p></o:p> <o:p></o:p> [Socket]<o:p></o:p> ListenStream=2000<o:p></o:p> Accept=true<o:p></o:p> MaxConnections=900<o:p></o:p> <o:p></o:p> [Install]<o:p></o:p> WantedBy=sockets.target<o:p></o:p> <o:p></o:p> systemd service file:-<o:p></o:p> # cat <a href="mailto:/usr/lib/systemd/system/test_ssl@.service">/usr/lib/systemd/system/test_ssl@.service</a><o:p></o:p> [Unit]<o:p></o:p> Description= Test Service<o:p></o:p> Requires=test_ssl.socket<o:p></o:p> <o:p></o:p> [Service]<o:p></o:p> ExecStart=/home/SSL/server <o:p></o:p> StandardInput=socket<o:p></o:p> KillMode=process<o:p></o:p> <o:p></o:p> [Install]<o:p></o:p> WantedBy=multi-user.target<o:p></o:p> <o:p></o:p> The service file invoke the binary /home/SSL/server.<o:p></o:p> <o:p></o:p> Here is it a very simple client server program, where<o:p></o:p> 1. Server binds and listens on a port number.<o:p></o:p> </div> </div> </blockquote> <div> You need to remove this part if you want to use socket activation. The whole point of .socket units here is that systemd binds to the socket and passes the fd over to your service. If your service ignores the received fd and tries to create its own socket, it will never be able to receive the connections.<o:p></o:p> </div> <div> <o:p> </o:p> </div> <div> By default, the service would receive the sockets as fd#3 and ahove (see <a href="https://www.freedesktop.org/software/systemd/man/sd_listen_fds.html">https://www.freedesktop.org/software/systemd/man/sd_listen_fds.html</a> for documentation), but because you use StandardInput=socket, it will receive the socket as fd#1.<o:p></o:p> </div> <blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in"> <div> <div> 2. Client first connects to server with normal connect (server will do accept)<o:p></o:p> </div> </div> </blockquote> <div> Your .socket specifies Accept=true, so you should remove this part as well: the option means that systemd itself will accept the connection and only hand your server the accepted socket.<o:p></o:p> </div> <div> <o:p></o:p> </div> </div> <o:p></o:p> <div> <o:p> </o:p> </div> -- <o:p></o:p> <div> <div> Mantas Mikulėnas<o:p></o:p> </div> </div> </div> </div> </body> </html>