#! /bin/bash
#
# xapi          Start/Stop the XAPI SSL proxy
#
# chkconfig: 2345 91 01
# description: XenServer server SSL
# processname: stunnel
# config: /etc/xensource/stunnel.conf
# pidfile: /var/run/xapi.ssl.pid

# Source function library.
. /etc/init.d/functions

PEMFILE="/etc/xensource/xapi-ssl.pem"
SSLPIDFILE="/var/run/xapissl.pid"
SSLCONFFILE="/var/xapi/xapi-ssl.conf"

mgmt_ip() {
    . /etc/xensource-inventory
    if [ -n "${MANAGEMENT_INTERFACE}" ] && [ "${MANAGEMENT_INTERFACE}" != "lo" ]; then
	/sbin/ifconfig ${MANAGEMENT_INTERFACE} | sed -ne 's/.*inet addr:\([^ ]*\).*/\1/p'
    fi
}

# Write out the stunnel config file. This requires the management interface,
# so it's done here rather than written statically.
writeconffile () {
    # Initial boilerplate which is valid whether the management interface
    # is enabled or disabled.
cat > $SSLCONFFILE <<EOF
; Autogenerated by init.d/xapissl
pid = ${SSLPIDFILE}
socket = r:TCP_NODELAY=1
socket = a:TCP_NODELAY=1
socket = l:TCP_NODELAY=1
compression = zlib

[localhost-xapi]
accept = 127.0.0.1:443
connect = 80
cert = ${PEMFILE}
ciphers = !SSLv2:RSA+AES256-SHA:RSA+AES128-SHA:RSA+RC4-SHA:RSA+RC4-MD5:RSA+DES-CBC3-SHA
EOF

    . /etc/xensource-inventory
    # Only if the management interface is set ask stunnel to bind to it
    if [ -n "${MANAGEMENT_INTERFACE}" ] && [ "${MANAGEMENT_INTERFACE}" != "lo" ]; then
    	MGMT_IP=`ifconfig ${MANAGEMENT_INTERFACE} | grep "inet addr" | cut -d: -f2 | awk '{print $1}'`
	cat >> $SSLCONFFILE <<EOF

[xapi]
accept = ${MGMT_IP}:443
connect = 80
cert = ${PEMFILE}
ciphers = !SSLv2:RSA+AES256-SHA:RSA+AES128-SHA:RSA+RC4-SHA:RSA+RC4-MD5:RSA+DES-CBC3-SHA
TIMEOUTclose = 5
EOF
    fi
    
    return
}

start() {
	echo -n $"Starting xapi SSL: "
        if [ -e /var/lock/subsys/xapissl ]; then
		if [ -e ${SSLPIDFILE} ] && [ -e /proc/`cat ${SSLPIDFILE}` ]; then
			echo -n $"cannot start xapi SSL: xapi SSL is already running.";
			failure $"cannot start xapi SSL: xapi SSL already running.";
			echo
			return 1
		fi
	fi
	if [ ! -f ${PEMFILE} ]; then
		# generating a pem file
		CN=`hostname`

		case "${CN}" in
		    localhost*)
			CN=`mgmt_ip`;;
		    *.*)
			:;;
		    *)
			CN=`mgmt_ip`;; 
		esac
		/opt/xensource/libexec/generate_ssl_cert ${PEMFILE} ${CN}
	fi
	NEWSTUNNEL="`grep -e '^ *stunnelng *= *true *' /etc/xensource/xapi.conf`"
	if test -z "$NEWSTUNNEL"
	then
		writeconffile
		daemon nice -n -3 /usr/sbin/stunnel ${SSLCONFFILE}
	else
		daemon nice -n -3 /usr/sbin/stunnelng -m server -p ${SSLPIDFILE} -c ${PEMFILE} -s :443 -d 127.0.0.1:80
	fi
	RETVAL=$?

	echo
	[ $RETVAL -eq 0 ] && touch /var/lock/subsys/xapissl;
	return $RETVAL
}

stop() {
	echo -n $"Stopping xapi SSL: "
        if [ ! -e /var/lock/subsys/xapissl ]; then
	    echo -n $"cannot stop xapi SSL: xapi SSL is not running."
	    failure $"cannot stop xapi: xapi SSL is not running."
	    echo
	    return 1;
	fi
	SSLPID=$(cat ${SSLPIDFILE})
	kill ${SSLPID}
	if [ $? -ne 0 ]; then
	    echo -n $"stunnel already dead"
	    failure $"stunnel already dead"
	    return 1
        fi
	# Wait until the stunnel pid disappears
        RETRIES=180
        while [ ${RETRIES} -ne 0 ]; do
	    RETRIES=$(( ${RETRIES} - 1 ))
	    kill -0 $SSLPID 2> /dev/null
            if [ $? -eq 0 ]; then
		echo -n .
		sleep 1
	    else
		echo
		rm -f /var/lock/subsys/xapissl
		return 0
            fi
        done
	echo -n $"stunnel failed to terminate"
	failure $"stunnel failed to terminate"
	return 1
}

rhstatus() {
	status xapissl
}

restart() {
	stop
	start
}

case "$1" in
  start)
	start
	;;
  stop)
	stop
	;;
  restart)
	restart
	;;
  status)
	rhstatus
	;;
  condrestart)
	[ -f /var/lock/subsys/xapissl ] && restart || :
	;;
  *)
	echo $"Usage: $0 {start|stop|status|restart|condrestart}"
	exit 1
esac
