2 #***************************************************************************
4 # Project ___| | | | _ \| |
6 # | (__| |_| | _ <| |___
7 # \___|\___/|_| \_\_____|
9 # Copyright (C) 1998 - 2014, Daniel Stenberg, <daniel@haxx.se>, et al.
11 # This software is licensed as described in the file COPYING, which
12 # you should have received as part of this distribution. The terms
13 # are also available at http://curl.haxx.se/docs/copyright.html.
15 # You may opt to use, copy, modify, merge, publish, distribute and/or sell
16 # copies of the Software, and permit persons to whom the Software is
17 # furnished to do so, under the terms of the COPYING file.
19 # This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
20 # KIND, either express or implied.
22 #***************************************************************************
24 # This is the HTTPS, FTPS, POP3S, IMAPS, SMTPS, server used for curl test
25 # harness. Actually just a layer that runs stunnel properly using the
26 # non-secure test harness servers.
29 push(@INC, $ENV{'srcdir'}) if(defined $ENV{'srcdir'});
42 my $stunnel = "stunnel";
44 my $verbose=0; # set to 1 for debugging
46 my $accept_port = 8991; # just our default, weird enough
47 my $target_port = 8999; # default test http-server port
58 my $pidfile; # stunnel pid file
59 my $logfile; # stunnel log file
60 my $loglevel = 5; # stunnel log level
61 my $ipvnum = 4; # default IP version of stunneled server
62 my $idnum = 1; # dafault stunneled server instance number
63 my $proto = 'https'; # default secure server protocol
64 my $conffile; # stunnel configuration file
65 my $certfile; # certificate chain PEM file
67 #***************************************************************************
68 # stunnel requires full path specification for several files.
72 my $logdir = $path .'/log';
74 #***************************************************************************
75 # Signal handler to remove our stunnel 4.00 and newer configuration file.
77 sub exit_signal_handler {
79 local $!; # preserve errno
80 local $?; # preserve exit status
81 unlink($conffile) if($conffile && (-f $conffile));
85 #***************************************************************************
86 # Process command line options
89 if($ARGV[0] eq '--verbose') {
92 elsif($ARGV[0] eq '--proto') {
98 elsif($ARGV[0] eq '--accept') {
100 if($ARGV[1] =~ /^(\d+)$/) {
106 elsif($ARGV[0] eq '--connect') {
108 if($ARGV[1] =~ /^(\d+)$/) {
114 elsif($ARGV[0] eq '--stunnel') {
116 if($ARGV[1] =~ /^([\w\/]+)$/) {
120 $stunnel = "\"". $ARGV[1] ."\"";
125 elsif($ARGV[0] eq '--srcdir') {
131 elsif($ARGV[0] eq '--certfile') {
133 $stuncert = $ARGV[1];
137 elsif($ARGV[0] eq '--id') {
139 if($ARGV[1] =~ /^(\d+)$/) {
140 $idnum = $1 if($1 > 0);
145 elsif($ARGV[0] eq '--ipv4') {
148 elsif($ARGV[0] eq '--ipv6') {
151 elsif($ARGV[0] eq '--pidfile') {
153 $pidfile = "$path/". $ARGV[1];
157 elsif($ARGV[0] eq '--logfile') {
159 $logfile = "$path/". $ARGV[1];
164 print STDERR "\nWarning: secureserver.pl unknown parameter: $ARGV[0]\n";
169 #***************************************************************************
170 # Initialize command line option dependant variables
173 $pidfile = "$path/". server_pidfilename($proto, $ipvnum, $idnum);
176 $logfile = server_logfilename($logdir, $proto, $ipvnum, $idnum);
179 $conffile = "$path/stunnel.conf";
181 $certfile = "$srcdir/". ($stuncert?"certs/$stuncert":"stunnel.pem");
183 my $ssltext = uc($proto) ." SSL/TLS:";
185 #***************************************************************************
186 # Find out version info for the given stunnel binary
188 foreach my $veropt (('-version', '-V')) {
189 foreach my $verstr (qx($stunnel $veropt 2>&1)) {
190 if($verstr =~ /^stunnel (\d+)\.(\d+) on /) {
194 elsif($verstr =~ /^sslVersion.*fips *= *yes/) {
195 # the fips option causes an error if stunnel doesn't support it
202 if((!$ver_major) || (!$ver_minor)) {
203 if(-x "$stunnel" && ! -d "$stunnel") {
204 print "$ssltext Unknown stunnel version\n";
207 print "$ssltext No stunnel\n";
211 $stunnel_version = (100*$ver_major) + $ver_minor;
213 #***************************************************************************
214 # Verify minimum stunnel required version
216 if($stunnel_version < 310) {
217 print "$ssltext Unsupported stunnel version $ver_major.$ver_minor\n";
221 #***************************************************************************
222 # Build command to execute for stunnel 3.X versions
224 if($stunnel_version < 400) {
225 if($stunnel_version >= 319) {
226 $socketopt = "-O a:SO_REUSEADDR=1";
228 $cmd = "$stunnel -p $certfile -P $pidfile ";
229 $cmd .= "-d $accept_port -r $target_port -f -D $loglevel ";
230 $cmd .= ($socketopt) ? "$socketopt " : "";
231 $cmd .= ">$logfile 2>&1";
233 print uc($proto) ." server (stunnel $ver_major.$ver_minor)\n";
235 print "pem cert file: $certfile\n";
236 print "pid file: $pidfile\n";
237 print "log file: $logfile\n";
238 print "log level: $loglevel\n";
239 print "listen on port: $accept_port\n";
240 print "connect to port: $target_port\n";
244 #***************************************************************************
245 # Build command to execute for stunnel 4.00 and newer
247 if($stunnel_version >= 400) {
248 $socketopt = "a:SO_REUSEADDR=1";
249 $cmd = "$stunnel $conffile ";
250 $cmd .= ">$logfile 2>&1";
251 # setup signal handler
252 $SIG{INT} = \&exit_signal_handler;
253 $SIG{TERM} = \&exit_signal_handler;
254 # stunnel configuration file
255 if(open(STUNCONF, ">$conffile")) {
260 socket = $socketopt";
262 # disable fips in case OpenSSL doesn't support it
266 if($stunnel !~ /tstunnel(\.exe)?"?$/) {
274 accept = $accept_port
275 connect = $target_port";
276 if(!close(STUNCONF)) {
277 print "$ssltext Error closing file $conffile\n";
282 print "$ssltext Error writing file $conffile\n";
286 print uc($proto) ." server (stunnel $ver_major.$ver_minor)\n";
288 print "CApath = $path\n";
289 print "cert = $certfile\n";
290 print "pid = $pidfile\n";
291 print "debug = $loglevel\n";
292 print "socket = $socketopt\n";
293 print "output = $logfile\n";
294 print "foreground = yes\n";
296 print "[curltest]\n";
297 print "accept = $accept_port\n";
298 print "connect = $target_port\n";
302 #***************************************************************************
303 # Set file permissions on certificate pem file.
305 chmod(0600, $certfile) if(-f $certfile);
307 #***************************************************************************
308 # Run tstunnel on Windows.
310 if($stunnel =~ /tstunnel(\.exe)?"?$/) {
311 # Fake pidfile for tstunnel on Windows.
312 if(open(OUT, ">$pidfile")) {
317 # Put an "exec" in front of the command so that the child process
318 # keeps this child's process ID.
319 exec("exec $cmd") || die "Can't exec() $cmd: $!";
321 # exec() should never return back here to this process. We protect
322 # ourselves by calling die() just in case something goes really bad.
323 die "error: exec() has returned";
326 #***************************************************************************
329 my $rc = system($cmd);
333 unlink($conffile) if($conffile && -f $conffile);