Stefan Meinecke
7cc9dc90be
probes: fix msrdp length truncation, teamspeak match, unaligned reads
...
- is_msrdp_protocol() stored the 16-bit TPKT length in a char, so a
packet claiming length 263 (0x0107) but carrying only 7 bytes
compared 7 == 7 and matched - any sufficiently short packet whose
declared length low byte equals its size is accepted as RDP.
Keep the declared length in a uint16_t. Verified with a harness:
{0x03 0x00 0x01 0x07 ...} no longer matches.
- is_teamspeak_protocol() used strncmp(p, "TS3INIT1", len): for the
first datagram of a real TS3 client (len > 8) this compares the
string literal's terminating NUL against packet byte 8, which is a
version field, so it could never match real traffic (and reads
past the literal for len > 9). Use a fixed 8-byte memcmp prefix.
- is_openvpn_protocol() and is_wireguard_protocol() dereferenced the
packet buffer through uint16_t*/uint32_t* casts; the buffer is not
aligned, which is UB and traps on strict-alignment targets (ARM).
Use memcpy() instead, as already done elsewhere in this file.
2026-10-18 11:44:36 +02:00
Yves Rutschle
ca5e7fe6f3
check socket() return value
2026-10-07 15:20:21 +02:00
Yves Rutschle
bebc109b94
print_message() restores errno ( fix #538 )
2026-10-04 11:07:55 +02:00
Iain
1c98792a55
fix transparent proxy link and timeout default in man page
2026-09-30 18:32:13 +02:00
Yves Rutschle
1e1cde863b
Merge branch 'TigerP-improve-configure-ac'
2026-09-19 18:25:18 +02:00
Yves Rutschle
224efd36c3
Merge branch 'improve-configure-ac' of github.com:TigerP/sslh into TigerP-improve-configure-ac
2026-09-19 18:24:16 +02:00
Aniket
1df05999b7
Remove compose version
2026-09-19 18:20:34 +02:00
Kai Bolay
0d696eb007
fix typo
2026-09-19 18:19:35 +02:00
Yves Rutschle
03067e9ab7
respect hosts_ctl() prototype
2026-08-02 09:03:51 +02:00
Yves Rutschle
eb976475be
declare pp_log_connection() as inline (avoids warning with proxyprotocol not present)
2026-07-12 18:10:34 +02:00
Yves Rutschle
7eabafc6e2
added updated QUIC example
2026-05-31 09:58:57 +02:00
Yves Rutschle
5f9ff68f1c
mention Wireguard probe in documentation ( fix #535 )
2026-05-31 09:51:06 +02:00
Yves Rutschle
4752c8647d
Merge branch 'master' of github.com:yrutschle/sslh
2026-05-08 22:52:40 +02:00
Yves Rutschle
a8352c137c
udp_c2s_forward: silently ignor EAGAIN/EWOULDBLOCK on recvfrom ( fix #534 )
2026-05-08 22:52:26 +02:00
keanehatescoding
6c0dc269c7
fix: close err_log after writing success message in main()
...
err_log was fclose()'d before the "Successfully generated all targets"
fprintf(), resulting in a write-after-close that corrupted glibc's
internal stdio buffers and triggered an abort() via SIGABRT on every
systemd-invoked run regardless of whether /etc/sslh/ exists.
Fix by moving the success fprintf() above the fclose() call.
2026-05-08 22:42:13 +02:00
Tiger!P
0bc0fb62b7
Improve configure.ac to work with newer autoconf versions
2026-04-18 22:25:53 +02:00
Yves Rutschle
dc70cc0d3b
verbose_packet now dumps UDP packets as well ( fix #527 )
2026-03-15 22:12:00 +01:00
Yves Rutschle
d39388d1ed
prepare v2.3.1
2026-03-05 19:14:57 +01:00
Yves Rutschle
70a776fb9a
-V now outputs compile-time configuration ( fix #519 )
2026-03-04 22:35:56 +01:00
Yves Rutschle
9fadd60eed
sanity check that libwrap is present when using service option
2026-03-03 22:42:52 +01:00
Yves Rutschle
83c9465c37
sanity check that proxyprotocol is compiled in when used by listening endpoints
2026-03-03 22:34:36 +01:00
Yves Rutschle
1137779b9c
sanity check that libproxyprocol is compiled in when option is used
2026-03-03 22:29:01 +01:00
Yves Rutschle
4d3aa6c6e0
sanity checks that regex options are only used with the right probe and with libpcre2 support compiled in
2026-03-03 22:05:01 +01:00
Yves Rutschle
579baae363
fix syntax error in documentation example
2026-02-28 21:42:01 +01:00
Yves Rutschle
e2d01a7440
close file descriptors upon forking a connection shoveler ( fix #521 )
2026-02-15 11:17:36 +01:00
Yves Rutschle
ecc76071c1
downgrade SNI matching logs from error to info to reduce log verboseness ( Fix #520 )
2026-02-08 09:50:45 +01:00
Yves Rutschle
e5d7cd0575
revert some useless changes to really fix #515
2026-02-06 22:08:59 +01:00
Yves Rutschle
d288125ff3
test combinations of ipv4 <-> ipv6 over proxyprotocol
2026-02-06 22:05:27 +01:00
Yves Rutschle
2cc1e1f1d9
add CAP_NET_RAW in systemd configuration to support transparent proxying
2026-02-03 21:00:40 +01:00
yrutschle
77dc76a0f2
Change IPv4 to IPv6 addresses when using proxyprotocol and protocols are different ( Fix #515 )
2026-02-01 18:02:03 +01:00
4O4-Not-F0und
86188cdd28
build sslh with libproxyprotocol
2025-12-20 17:23:10 +01:00
Yves Rutschle
c29081f71d
Merge branch 'master' of github.com:yrutschle/sslh
2025-11-14 14:54:17 +01:00
Yves Rutschle
8d58164fdd
Libwrap requires access to some more files when using landlock ( fix #450 again)
2025-11-14 14:53:56 +01:00
yrutschle
894eacfb42
Fix sslh-fork segmentation fault ( Fix #508 )
2025-10-30 08:22:48 +01:00
benok
6310e6fc9c
Add missing trailing "\n" to log output
2025-10-29 12:28:01 +01:00
Yves Rutschle
0dd580f45b
move symbol definition for Cygwin ( fix #506 )
2025-09-24 14:48:16 +02:00
Yves Rutschle
63e15bb55c
Prepare for 2.3.0
2025-09-10 15:50:52 +02:00
Yves Rutschle
6f3dcfb365
Merge branch 'proxyprotocol'
2025-09-10 15:31:43 +02:00
Yves Rutschle
f8e031ecb9
Merge branch 'master' of github.com:yrutschle/sslh
2025-09-10 15:29:59 +02:00
Yves Rutschle
fcfc348aee
added proxyprotocol documentation
2025-09-10 15:29:04 +02:00
Yves Rutschle
6905498d60
proxyprotocol on client-side can be removed on server side, and its info is then logged
2025-09-10 12:14:41 +02:00
Yves Rűtschlé
eea50a97fc
support for proxy_protocol on incoming (client-side) link
2025-09-10 09:28:54 +02:00
Yves Rutschle
387ef13f52
fix memory leak when server-side is not yet attached, and potential memory leak when forking hash is full ( fix #504 )
2025-09-04 23:50:17 +02:00
Yves Rűtschlé
dcb2cc928a
import main branch for endpoint tracking
2025-08-29 20:44:15 +02:00
Yves Rűtschlé
2106bd6527
added test for client-side proxyprotocol
2025-08-29 20:39:42 +02:00
Yves Rűtschlé
12f748fe8e
include test for server-side proxyprotocol
2025-08-29 12:22:30 +02:00
yrutschle
b6c8e116af
verify there is space in pid followup table before forking ( fix #502 )
2025-08-27 22:57:04 +02:00
yrutschle
4427a9570f
remove noisy logging from harmless interrupted system calls
2025-08-27 22:21:51 +02:00
yrutschle
3c237b3c9a
have some minimum hash size if no protocols have a max_connections setting
2025-08-26 23:22:17 +02:00
yrutschle
2914fe7b5c
fix embarassingly wrong error check
2025-08-26 22:23:30 +02:00
Stefan Meinecke
Yves Rutschle
Iain
Aniket
Kai Bolay
keanehatescoding
Tiger!P
4O4-Not-F0und
benok