PMDF System Manager's Guide
PMDF-REF-6.0

Previous | Contents

24.2.2 Examples on OpenVMS

The following subsections provide examples of using BSMTP channels on OpenVMS.

24.2.2.1 Configuring the BSMTP channels to compress their payloads on OpenVMS

Using PMDF's general purpose, on-the-fly conversion facilities, BSMTP parcels can be compressed on the sending system and then uncompressed on the receiving system. This allows for faster transmission of the parcels through the network.

In the CHARSET-CONVERSION mapping table on each PMDF system, a simple entry enabling conversions for the BSMTP channels must be made: 

CHARSET-CONVERSION 
 
  in-chan=bsout_*;out-chan=*;convert      yes 
  in-chan=*;out-chan=bsin_*;convert       yes

In the PMDF conversions file on each system, conversion entries are added which call out to the site-supplied command procedure, PMDF_COM:compress.com: 

in-chan=bsout_*; part-number=1; in-type=*; in-subtype=*; 
  service-command="@PMDF_COM:COMPRESS.COM COMPRESS 'INPUT_FILE' 'OUTPUT_FILE'" 
 
out-chan=bsin_*; part-number=1; in-type=application; 
  in-subtype=compressed-bsmtp; 
  service-command="@PMDF_COM:COMPRESS.COM DECOMPRESS 'INPUT_FILE' 'OUTPUT_FILE'"
The PMDF_COM:compress.com: command procedure is shown in Figure 24-1 .

Figure 24-1 compress.com:Compress and decompress BSMTP payloads 

$ ! 
$ ! Compress/decompress a MIME message using GZIP & GUNZIP 
$ ! P1 == "COMPRESS" | "DECOMPRESS" 
$ ! P2 == File to compress or decompress 
$ ! P3 == File containing the compressed or decompressed result 
$ ! 
$ ! Ensure that we have three command line arguments 
$ IF P1 .EQS. "" THEN EXIT 229448  ! DCL-W-INSFPRM 
$ IF P2 .EQS. "" THEN EXIT 229448 
$ IF P3 .EQS. "" THEN EXIT 229448 
$ ! 
$ ! Used for temporary files 
$ OUTFILE = F$ELEMENT(0,";",P3) 
$ ! 
$ ! Dispatch to the correct part of this command file 
$ IF "DECOMPRESS" .EQS. F$EDIT(P1,"TRIM,UPCASE) THEN GOTO DECOMPRESS 
$ IF "COMPRESS" .NES. F$EDIT(P1,"TRIM,UPCASE) THEN EXIT 229472  ! DCL-W-IVKEYW 
$ ! 
$ COMPRESS: 
$   GZIP = "$PMDF_EXE:GZIP.EXE" 
$   DEFINE/USER SYS$OUTPUT 'OUTFILE'-TMP 
$   GZIP -C 'P2' 
$   PMDF ENCODE/HEADER/TYPE=APPLICATION/SUBTYPE=COMPRESSED-BSMTP - 
      'OUTFILE'-TMP 'P3' 
$   DELETE/NOLOG 'OUTFILE'-TMP;* 
$   EXIT 1 
$ ! 
$ DECOMPRESS: 
$   GUNZIP = "$PMDF_EXE:GUNZIP.EXE" 
$   PMDF DECODE/HEADER 'P2' 'OUTFILE'-TMP 
$   DEFINE/USER SYS$OUTPUT 'P3' 
$   GUNZIP -C 'OUTFILE-TMP' 
$   DELETE/NOLOG 'OUTFILE'-TMP;* 
$   EXIT 1

24.2.2.2 Configuring the BSMTP channels to provide authentication services on OpenVMS

Using PMDF's general purpose, on-the-fly conversion facilities, authentication and integrity services may be tied in to the BSMTP channels. This is done through the CHARSET-CONVERSION mapping table, the PMDF conversions file, and a site-supplied command procedure to digitally sign payloads and verify the signature and integrity of the data upon receipt.

In the CHARSET-CONVERSION mapping table on each PMDF system, a simple entry enabling conversions for the BSMTP channels must be made: 

CHARSET-CONVERSION 
 
  in-chan=bsout_*;out-chan=*;convert      yes 
  in-chan=*;out-chan=bsin_*;convert       yes

In the PMDF conversions file on each system, there must be conversion entries to invoke the site-supplied command procedures: 

in-chan=bsout_*; part-number=1; in-type=*; in-subtype=*; 
  service-command="@PMDF_COM:PGP_SIGN.COM 'INPUT_FILE' 'OUTPUT_FILE'" 
 
out-chan=bsin_*; part-number=1; in-type=multipart; in-subtype=signed; 
  service-command="@PMDF_COM:PGP_VERIFY.COM 'INPUT_FILE' 'OUTPUT_FILE'"
These two command procedures are shown in Figures 24-2 and 24-3 . They assume that the PGP utility is the image D1:[pgp]pgp.exe. Note that the pgp_sign.com procedure requires the pass phrase for the PMDF MTA's private PGP key in order to generate signatures. Edit the procedure to reflect the correct pass phrase and be sure to protect the file from other users: 
$ SET FILE/OWNER=[PMDF] PMDF_COM:PGP_SIGN.COM
$ SET PROTECTION=(S:RWED,O:RWED,G,W) PMDF_COM:PGP_SIGN.COM

Figure 24-2 pgp_sign.com:Digitally sign BSMTP payloads 

$ !   P1 == Input file specification; message to sign 
$ !   P2 == Output file specification; multipart/signed message 
$ !   P3 == File specification for the file of envelope recipient addresses 
$ ! 
$ ! Check that we have at least two command line parameters 
$ IF P1 .EQS. "" THEN EXIT 229448  ! DCL-W_INSFPRM 
$ IF P2 .EQS. "" THEN EXIT 229448 
$ ! 
$ ! Basic definitions 
$ PGP     = "$D1:[PGP]PGP.EXE" 
$ PGPUSER = "PMDF MTA key" 
$ PGPPATH = "PMDF_ROOT:[TABLE.PGP]" 
$ PGPPASS = "Percy eats pealed banannas" 
$ FILENAM = F$ELEMENT(0,";",P2) 
$ ! 
$ ! Error handling 
$ ON ERROR THEN GOTO ERROR 
$ ON SEVERE_ERROR THEN GOTO ERROR 
$ ! 
$ ! Generate the digital signature 
$ PGP "-sab" "-u" "''PGPUSER'" "-z" "''PGPPASS'" 'P1' "-o" 'FILENAM'-SIGN - 
      "+batchmode" 
$ ! 
$ ! Get a unique string to use in a MIME boundary marker 
$ RUN PMDF_EXE:UNIQUE_ID.EXE 
$ BOUNDARY = "''unique_id'" 
$ ! 
$ ! Start the multipart message and the first message part 
$ OPEN/WRITE/ERROR=ERROR OUTFILE 'P2' 
$ WRT = "WRITE/ERROR=ERROR OUTFILE" 
$ WRT "Content-type: multipart/signed; boundary=''BOUNDARY';" 
$ WRT " micalg=pgp-md5; protocol=application/pgp-signature" 
$ WRT "" 
$ WRT "--''BOUNDARY'" 
$ CLOSE/ERROR=ERROR OUTFILE 
$ ! 
$ ! Start the second message part 
$ OPEN/WRITE/ERROR=ERROR OUTFILE 'FILENAM'-MID 
$ WRT "--''BOUNDARY'" 
$ WRT "Content-type: application/pgp-signature" 
$ WRT "" 
$ CLOSE/ERROR=ERROR OUTFILE 
$ ! 
$ ! And the end of the message 
$ OPEN/WRITE/ERROR=ERROR OUTFILE 'FILENAM'-BOT 
$ WRT "--''BOUNDARY'--" 
$ CLOSE/ERROR=ERROR OUTFILE 
$ ! 
$ ! Now glue all of the pieces together 
$ CONVERT/APPEND 'P1' 'P2' 
$ CONVERT/APPEND 'FILENAM'-MID 'P2' 
$ CONVERT/APPEND 'FILENAM'-SIGN 'P2' 
$ CONVERT/APPEND 'FILENAM'-BOT 'P2' 
$ ! 
$ ! Delete the temporary files 
$ DELETE/NOLOG 'FILENAM'-MID;*,'FILENAM'-SIGN;*,'FILENAM'-BOT;* 
$ EXIT 1 
$ ! 
$ ! We fall through to here when we have an error 
$ ERROR: 
$ SET NOON 
$ IF F$TRNLNM("OUTFILE") .NES. "" THEN CLOSE OUTFILE 
$ DELETE/NOLOG 'FILENAM'-*.*,'P2' 
$ SET ON 
$ EXIT 2

Figure 24-3 pgp_verify.com:Verify the integrity of a digitally signed BSMTP payload 

$ !   P1 == Input file specification; multipart/signed message 
$ !   P2 == Output file specification; message which was signed; 
$ !   P3 == File specification for the file of envelope recipient addresses 
$ ! 
$ ! Check that we have at least two command line parameters 
$ IF P1 .EQS. "" THEN EXIT 229448  ! DCL-W-INSFPRM 
$ IF P2 .EQS. "" THEN EXIT 229448 
$ ! 
$ ! Basic definitions 
$ PGP     = "$D1:[PGP]PGP.EXE" 
$ PGPPATH = "PMDF_ROOT:[TABLE.PGP]" 
$ FILENAM = F$ELEMENT(0,";",P2) 
$ ! 
$ ! Error handling 
$ ON ERROR THEN GOTO ERROR 
$ ON SEVERE_ERROR THEN GOTO ERROR 
$ ! 
$ ! Reformat the input file to look like a PGP signature file 
$ OPEN/READ/ERROR=ERROR INFILE 'P1' 
$ OPEN/WRITE/ERROR=ERROR OUTFILE 'FILENAM'-SIGN 
$ WRT = "WRITE/ERROR=ERROR OUTFILE" 
$ STATE = 1 
$ LOOP: 
$   READ/ERROR=ERROR/END_OF_FILE=END_LOOP INFILE LINE 
$   IF STATE .EQ. 1 
$   THEN 
$     IF F$EXTRACT(0,2,LINE) .EQS. "--" 
$     THEN 
$       STATE = 2 
$       BOUNDARY = LINE 
$       WRT "-----BEGIN PGP SIGNED MESSAGE-----" 
$       WRT "" 
$     ENDIF 
$   ELSE 
$     IF STATE .EQ. 2 
$     THEN 
$       IF BOUNDARY .NES. LINE 
$       THEN 
$         WRT LINE 
$       ELSE 
$         STATE = 3 
$       ENDIF 
$     ELSE 
$       IF STATE .EQ. 3 
$       THEN 
$         IF LINE .EQS. "" 
$         THEN 
$           STATE = 4 
$           WRT "" 
$         ENDIF 
$       ELSE 
$         WRT LINE 
$       ENDIF 
$     ENDIF 
$   ENDIF 
$   GOTO LOOP 
$ ! 
$ END_LOOP: 
$ CLOSE/ERROR=ERROR INFILE 
$ CLOSE/ERROR=ERROR OUTFILE 
$ ! 
$ ! Now check the signature 
$ DEFINE/USER SYS$OUTPUT 'FILENAM'-CHECK 
$ PGP "-o" 'FILENAM'-OUT 'FILENAM'-SIGN "+batchmode" 
$ ! 
$ ! See what the results of the check were; build the X-Content-MIC-check: line 
$ SEARCH/OUTPUT='FILENAM'-MIC/EXACT 'FILENAM'-CHECK " signature from user " 
$ IF $STATUS .EQ. 1 
$ THEN 
$   OPEN/READ/ERROR=ERROR INFILE 'FILENAM'-MIC 
$   READ/ERROR=ERROR INFILE LINE 
$   CLOSE/ERROR=ERROR INFILE 
$   MIC_CHECK = "X-Content-MIC-check: "+LINE   
$ ELSE 
$   MIC_CHECK = "X-Content-MIC-check: Bad signature" 
$ ENDIF 
$ OPEN/WRITE/ERROR=ERROR OUTFILE 'P2' 
$ WRITE/ERROR=ERROR OUTFILE MIC_CHECK 
$ CLOSE/ERROR=ERROR OUTFILE 
$ ! 
$ ! Now assemble the result: the MIC check + signed data 
$ CONVERT/APPEND 'FILENAM'-OUT 'P2' 
$ DELETE/NOLOG 'FILENAM'-*.* 
$ EXIT 1 
$ ! 
$ ! We fall through to here when there is an error 
$ ERROR: 
$ SET NOON 
$ IF F$TRNLNM("INFILE") .NES. "" THEN CLOSE INFILE 
$ IF F$TRNLNM("OUTFILE") .NES. "" THEN CLOSE OUTFILE 
$ DELETE/NOLOG 'FILENAM'-*.*,'P2' 
$ SET ON 
$ EXIT 2

24.2.2.2.1 Using PGP with PMDF on OpenVMS

Note:

Use of PGP for commercial purposes requires a license from Pretty Good Privacy, Inc. Please contact Pretty Good Privacy, Inc. for details and assistance in licensing PGP.

Use of PGP requires installation of PGP as well as generation and exchange of PGP public keys between the PMDF BSMTP systems which will be using PGP for authentication. This section documents step-by-step how to generate and exchange PGP keys. No attempt is here made to document PGP. Please refer to the documentation supplied with PGP for information on those subjects.