<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Hello,<br>
To my mind, admin tasks such as conf file customization, should be
performed by admin scripts, not app running in admin mode.<br>
<br>
With <b>GnuWin32 </b>sed AND echo commands, things are really
simple :<br>
<br>
<b>stunnel.conf :</b><b><br>
</b>
<pre>cert = %USERPROFILE%\.config\my.pem (windows)</pre>
<pre>output = %APPDATA%\stunnel.log (windows)</pre>
<br>
<b>script "envsed.bat" on Windows :</b><b><br>
</b><br>
<pre>cat stunnel.conf | ^</pre>
<pre>sed -r -e "s/^(.*)$/C\:\\Progra~2\\GnuWin32\\bin\\echo.EXE \1/e" </pre>
<br>
every envvar "à la windows" is expanded ....<br>
Will work the same in Linux.<br>
<br>
If we really modify stunnel to do that job, I recommend to (try to)
use stubs for WCE trying to keep one main code, and keeping an
acceptable behavior in WCE,<br>
instead of playing with #if WCE #else etc ...<br>
<br>
Another way to proceed is that stunnel recognizes a very small set
of "pseudo-envvars", like eg we can find in samba conf files,<br>
such as, eg, %u for current user home folder, and that it expands
(or "translate") internally with its own logic (of course using
system calls if needed),<br>
but in any case, stunnel has to do some work for tokenization,
something that I think dangerous :<br>
it would not be good that stunnel expands ANY envvar, known or
UNKNOWN, without being able to predict the effects on its execution.<br>
Moreover, envars can be modified on the fly in an unpredictable way:
what if stunnel reloads the conf after an envvar change ?<br>
if it even does NOT detect the change, there may be issues ...and if
it detects the change and reloads, there may be other issues...<br>
<br>
Anyway, for the purpose of having multiple stunnel processes,
running in user space, started from USER command line, it does not
appear clear to me why an admin should create the USER conf
files...the USER should be aware of what is he/she doing with
stunnel?<br>
and it is not clear why and HOW multiple users, logged-on on the
?same? machine, each working in USER SPACE, should run stunnel
simultaneously ...<br>
<br>
Question is also : if stunnel is running as a service, how will it
deal with conf file containing ENVVARS, and what interest for this
as system-wide stunnel just need one unique conf file.<br>
<br>
Yours sincerely,<br>
Pierre<br>
<br>
<br>
<div class="moz-cite-prefix">Le 31/05/2016 18:59, Dmitry Bakshaev a
écrit :<br>
</div>
<blockquote
cite="mid:CAK9DdiHV6fLTpq5cTtPaDBv9TkdLbnRQaHFW1nM59kdf9CeX8w@mail.gmail.com"
type="cite">
<div dir="ltr"><br>
<div class="gmail_extra"><br>
<div class="gmail_quote">2016-05-31 17:07 GMT+04:00 Pierre
Delaage <span dir="ltr"><<a moz-do-not-send="true"
href="mailto:delaage.pierre@free.fr" target="_blank">delaage.pierre@free.fr</a>></span>:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid
rgb(204,204,204);padding-left:1ex">
<div text="#000000" bgcolor="#FFFFFF"> Hi,<br>
The difference is that, on WCE, for stunnel code, it is
straigthforward to access the "unique profile"
stunnel.conf, WITHOUT in fact dealing with envvars, <br>
rather than 1/ decode %VARNAME% tokens in conf file and
then ask env for replacement...<br>
well...ok..we can create stubs as well for getenv etc...
but is is much more complicated.<br>
</div>
</blockquote>
<div><br>
"environment expanded config" feature is designed for the
platform that support it - on WCE is not avialable -
config is static text file,<br>
and use static values in config files on other platform
not prohibited : ADMIN chooses which<br>
parameters USER can expand to USER own values or none.<br>
<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid
rgb(204,204,204);padding-left:1ex">
<div text="#000000" bgcolor="#FFFFFF"> <br>
For W32 platforms, communicating with a server with env
vars can open issues.<br>
</div>
</blockquote>
<div>example, please. every account that start stunnel has
his own environment, cert, key, etc.<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid
rgb(204,204,204);padding-left:1ex">
<div text="#000000" bgcolor="#FFFFFF"> BUT working in
"local user sandbox", folders etc...is more secure than
modifying system files by everyone through envvars.<br>
</div>
</blockquote>
files not modified globally, only for current USER by USER
values in runtime, only for specified parameters<br>
<br>
</div>
<div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid
rgb(204,204,204);padding-left:1ex">
<div text="#000000" bgcolor="#FFFFFF"> More generally, I
agree that a per user conf can be useful ONLY IF each
user is able, and "directed to" start HIS/HER STUNNEL by
HAND, in a user space process.<br>
</div>
</blockquote>
<div>yes. one of our scenarios. <br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid
rgb(204,204,204);padding-left:1ex">
<div text="#000000" bgcolor="#FFFFFF"> <br>
But to achieve this....stunnel is ALREADY ready to go by
using the command line like this "stunnel
myownconfig.conf", of course having "my" own copy of
stunnel executable.<br>
<br>
So there is no real need to have an embeddef feature in
stunnel for conf file customization per user.<br>
<br>
And, once again, as conf file are just "text files", it
is quite easy to create a bunch of such from a template,
by text editiong tools : sed on win32 is really
powerful, or win32 perl engine, or whatever scripting
language you prefer</div>
</blockquote>
<div><br>
</div>
this feature makes it unnecessary to copy config to every
user and edit files manually or using sed/perl.<br>
not need ADMIN intervention after adding new USER.<br>
adding/replace service/port not need regenerate all users
config - one centralized config.<br>
this is the primary purpose - ADMIN make one config as
template for all users.<br>
<br>
</div>
<div class="gmail_quote">for example server scenario: we has
multiple stunnel instanses on gentoo linux<br>
</div>
and i can configure on template:<br>
output = /var/log/stunnel/stunnel_${SVCNAME}.log<br>
each instance has its own log. (SVCNAME variable contains
instance name from init.d startup scripts)<br>
</div>
</div>
</blockquote>
<br>
</body>
</html>