123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383 |
- use strict;
- use warnings;
- BEGIN {
- push(@INC, $ENV{'srcdir'}) if(defined $ENV{'srcdir'});
- push(@INC, ".");
- }
- use Cwd;
- use Cwd 'abs_path';
- use File::Basename;
- use serverhelp qw(
- server_pidfilename
- server_logfilename
- );
- use pathhelp;
- my $stunnel = "stunnel";
- my $verbose=0;
- my $accept_port = 8991;
- my $target_port = 8999;
- my $stuncert;
- my $ver_major;
- my $ver_minor;
- my $fips_support;
- my $stunnel_version;
- my $tstunnel_windows;
- my $socketopt;
- my $cmd;
- my $pidfile;
- my $logfile;
- my $loglevel = 5;
- my $ipvnum = 4;
- my $idnum = 1;
- my $proto = 'https';
- my $conffile;
- my $capath;
- my $certfile;
- my $path = getcwd();
- my $srcdir = $path;
- my $logdir = $path .'/log';
- my $piddir;
- sub exit_signal_handler {
- my $signame = shift;
- local $!;
- local $?;
- unlink($conffile) if($conffile && (-f $conffile));
- exit;
- }
- while(@ARGV) {
- if($ARGV[0] eq '--verbose') {
- $verbose = 1;
- }
- elsif($ARGV[0] eq '--proto') {
- if($ARGV[1]) {
- $proto = $ARGV[1];
- shift @ARGV;
- }
- }
- elsif($ARGV[0] eq '--accept') {
- if($ARGV[1]) {
- if($ARGV[1] =~ /^(\d+)$/) {
- $accept_port = $1;
- shift @ARGV;
- }
- }
- }
- elsif($ARGV[0] eq '--connect') {
- if($ARGV[1]) {
- if($ARGV[1] =~ /^(\d+)$/) {
- $target_port = $1;
- shift @ARGV;
- }
- }
- }
- elsif($ARGV[0] eq '--stunnel') {
- if($ARGV[1]) {
- $stunnel = $ARGV[1];
- shift @ARGV;
- }
- }
- elsif($ARGV[0] eq '--srcdir') {
- if($ARGV[1]) {
- $srcdir = $ARGV[1];
- shift @ARGV;
- }
- }
- elsif($ARGV[0] eq '--certfile') {
- if($ARGV[1]) {
- $stuncert = $ARGV[1];
- shift @ARGV;
- }
- }
- elsif($ARGV[0] eq '--id') {
- if($ARGV[1]) {
- if($ARGV[1] =~ /^(\d+)$/) {
- $idnum = $1 if($1 > 0);
- shift @ARGV;
- }
- }
- }
- elsif($ARGV[0] eq '--ipv4') {
- $ipvnum = 4;
- }
- elsif($ARGV[0] eq '--ipv6') {
- $ipvnum = 6;
- }
- elsif($ARGV[0] eq '--pidfile') {
- if($ARGV[1]) {
- $pidfile = "$path/". $ARGV[1];
- shift @ARGV;
- }
- }
- elsif($ARGV[0] eq '--logfile') {
- if($ARGV[1]) {
- $logfile = "$path/". $ARGV[1];
- shift @ARGV;
- }
- }
- elsif($ARGV[0] eq '--logdir') {
- if($ARGV[1]) {
- $logdir = "$path/". $ARGV[1];
- shift @ARGV;
- }
- }
- else {
- print STDERR "\nWarning: secureserver.pl unknown parameter: $ARGV[0]\n";
- }
- shift @ARGV;
- }
- if($pidfile) {
-
- $piddir = dirname($pidfile);
- }
- else {
-
- $piddir = $path;
- $pidfile = server_pidfilename($piddir, $proto, $ipvnum, $idnum);
- }
- if(!$logfile) {
- $logfile = server_logfilename($logdir, $proto, $ipvnum, $idnum);
- }
- $conffile = "$piddir/${proto}_stunnel.conf";
- $capath = abs_path($path);
- $certfile = "$srcdir/". ($stuncert?"certs/$stuncert":"stunnel.pem");
- $certfile = abs_path($certfile);
- my $ssltext = uc($proto) ." SSL/TLS:";
- my $host_ip = ($ipvnum == 6)? '::1' : '127.0.0.1';
- foreach my $veropt (('-version', '-V')) {
- foreach my $verstr (qx("$stunnel" $veropt 2>&1)) {
- if($verstr =~ /^stunnel (\d+)\.(\d+) on /) {
- $ver_major = $1;
- $ver_minor = $2;
- }
- elsif($verstr =~ /^sslVersion.*fips *= *yes/) {
-
- $fips_support = 1;
- last
- }
- }
- last if($ver_major);
- }
- if((!$ver_major) || !defined($ver_minor)) {
- if(-x "$stunnel" && ! -d "$stunnel") {
- print "$ssltext Unknown stunnel version\n";
- }
- else {
- print "$ssltext No stunnel\n";
- }
- exit 1;
- }
- $stunnel_version = (100*$ver_major) + $ver_minor;
- if($stunnel_version < 310) {
- print "$ssltext Unsupported stunnel version $ver_major.$ver_minor\n";
- exit 1;
- }
- if($stunnel =~ /tstunnel(\.exe)?$/) {
- $tstunnel_windows = 1;
-
- $capath = pathhelp::sys_native_abs_path($capath);
- $certfile = pathhelp::sys_native_abs_path($certfile);
- }
- if($stunnel_version < 400) {
- if($stunnel_version >= 319) {
- $socketopt = "-O a:SO_REUSEADDR=1";
- }
-
-
- $cmd = "\"$stunnel\" -p $certfile -P $pidfile ";
- $cmd .= "-d $accept_port -r $target_port -f -D $loglevel ";
- $cmd .= ($socketopt) ? "$socketopt " : "";
- $cmd .= ">$logfile 2>&1";
- if($verbose) {
- print uc($proto) ." server (stunnel $ver_major.$ver_minor)\n";
- print "cmd: $cmd\n";
- print "pem cert file: $certfile\n";
- print "pid file: $pidfile\n";
- print "log file: $logfile\n";
- print "log level: $loglevel\n";
- print "listen on port: $accept_port\n";
- print "connect to port: $target_port\n";
- }
- }
- if($stunnel_version >= 400) {
- $socketopt = "a:SO_REUSEADDR=1";
- if(($stunnel_version >= 534) && $tstunnel_windows) {
-
-
- $socketopt .= "\nsocket = a:SO_EXCLUSIVEADDRUSE=0";
- }
- $cmd = "\"$stunnel\" $conffile ";
- $cmd .= ">$logfile 2>&1";
-
- $SIG{INT} = \&exit_signal_handler;
- $SIG{TERM} = \&exit_signal_handler;
-
- if(open(my $stunconf, ">", "$conffile")) {
- print $stunconf "CApath = $capath\n";
- print $stunconf "cert = $certfile\n";
- print $stunconf "debug = $loglevel\n";
- print $stunconf "socket = $socketopt\n";
- if($fips_support) {
-
- print $stunconf "fips = no\n";
- }
- if(!$tstunnel_windows) {
-
- print $stunconf "output = $logfile\n";
- print $stunconf "pid = $pidfile\n";
- print $stunconf "foreground = yes\n";
- }
- print $stunconf "\n";
- print $stunconf "[curltest]\n";
- print $stunconf "accept = $host_ip:$accept_port\n";
- print $stunconf "connect = $host_ip:$target_port\n";
- if(!close($stunconf)) {
- print "$ssltext Error closing file $conffile\n";
- exit 1;
- }
- }
- else {
- print "$ssltext Error writing file $conffile\n";
- exit 1;
- }
- if($verbose) {
- print uc($proto) ." server (stunnel $ver_major.$ver_minor)\n";
- print "cmd: $cmd\n";
- print "CApath = $capath\n";
- print "cert = $certfile\n";
- print "debug = $loglevel\n";
- print "socket = $socketopt\n";
- if($fips_support) {
- print "fips = no\n";
- }
- if(!$tstunnel_windows) {
- print "pid = $pidfile\n";
- print "output = $logfile\n";
- print "foreground = yes\n";
- }
- print "\n";
- print "[curltest]\n";
- print "accept = $host_ip:$accept_port\n";
- print "connect = $host_ip:$target_port\n";
- }
- }
- chmod(0600, $certfile) if(-f $certfile);
- print STDERR "RUN: $cmd\n" if($verbose);
- if($tstunnel_windows) {
-
- if(open(my $out, ">", "$pidfile")) {
- print $out $$ . "\n";
- close($out);
- }
-
- $| = 1;
-
-
- exec("exec $cmd") || die "Can't exec() $cmd: $!";
-
-
-
-
- die "error: exec() has returned";
- }
- my $rc = system($cmd);
- $rc >>= 8;
- unlink($conffile) if($conffile && -f $conffile);
- exit $rc;
|