v1.15 release

Corrected OpenVPN probe to support pre-shared secret
	mode (OpenVPN port-sharing code is... wrong). Thanks
	to Kai Ellinger for help in investigating and
	testing.

	Added an actual TLS/SSL probe.

	Added configurable --on-timeout protocol
	specification.

	Added a --anyprot protocol probe (equivalent to what
	--ssl was).

	Makefile respects the user's compiler and CFLAG
	choices (falling back to the current values if
	undefined), as well as LDFLAGS.
	(Michael Palimaka)

	Added "After" and "KillMode" to systemd.sslh.service
	(Thomas Weißschuh).

	Added LSB tags to etc.init.d.sslh
	(Thomas Varis).

ChangeLog

@@ -1,3 +1,69 @@
+v1.15:	27JUL2013
+	Added --transparent option for transparent proxying.
+	See README for iptables magic and capability
+	management.
+
+	Fixed bug in sslh-select: if number of opened file
+	descriptor became bigger than FD_SETSIZE, bad things
+	would happen.
+
+	Fixed bug in sslh-select: if socket dropped while
+	defered_data was present, sslh-select would crash.
+
+	Increased FD_SETSIZE for Cygwin, as the default 64
+	is too low for even moderate load.
+
+v1.14: 21DEC2012
+	Corrected OpenVPN probe to support pre-shared secret
+	mode (OpenVPN port-sharing code is... wrong). Thanks
+	to Kai Ellinger for help in investigating and
+	testing.
+
+	Added an actual TLS/SSL probe.
+
+	Added configurable --on-timeout protocol
+	specification.
+
+	Added a --anyprot protocol probe (equivalent to what
+	--ssl was).
+
+	Makefile respects the user's compiler and CFLAG
+	choices (falling back to the current values if
+	undefined), as well as LDFLAGS. 
+	(Michael Palimaka)
+
+	Added "After" and "KillMode" to systemd.sslh.service
+	(Thomas Weißschuh).
+
+	Added LSB tags to etc.init.d.sslh
+	(Thomas Varis).
+
+v1.13: 18MAY2012
+	Write PID file before dropping privileges.
+
+	Added --background, which overrides 'foreground'
+	configuration file setting.
+
+	Added example systemd service file from Archlinux in
+	scripts/
+	https://projects.archlinux.org/svntogit/community.git/tree/trunk/sslh.service?h=packages/sslh
+	(Sébastien Luttringer)
+
+v1.12: 08MAY2012
+	Added support for configuration file.
+
+	New protocol probes can be defined using regular
+	expressions that match the first packet sent by the
+	client.
+
+	sslh now connects timed out connections to the first
+	configured protocol instead of 'ssh' (just make sure
+	ssh is the first defined protocol).
+
+	sslh now tries protocols in the order in which they
+	are defined (just make sure sslh is the last defined
+	protocol).
+
 v1.11: 21APR2012
 	WARNING: defaults have been removed for --user and
 	--pidfile options, update your start-up scripts!

Makefile

@@ -1,6 +1,7 @@
 # Configuration
 
-VERSION="v1.11"
+VERSION="1.15"
+USELIBCONFIG=1	# Use libconfig? (necessary to use configuration files)
 USELIBWRAP=	# Use libwrap?
 COV_TEST= 	# Perform test coverage?
 PREFIX=/usr/local
@@ -14,18 +15,22 @@ ifneq ($(strip $(COV_TEST)),)
     CFLAGS_COV=-fprofile-arcs -ftest-coverage
 endif
 
-CC = gcc
-CFLAGS=-Wall -g $(CFLAGS_COV)
+CC ?= gcc
+CFLAGS ?=-Wall -g $(CFLAGS_COV)
 
-#LIBS=-lnet
-LIBS=
-OBJS=common.o sslh-main.o
+LIBS=$(LDFLAGS)
+OBJS=common.o sslh-main.o probe.o
 
 ifneq ($(strip $(USELIBWRAP)),)
 	LIBS:=$(LIBS) -lwrap
 	CFLAGS:=$(CFLAGS) -DLIBWRAP
 endif
 
+ifneq ($(strip $(USELIBCONFIG)),)
+	LIBS:=$(LIBS) -lconfig
+	CFLAGS:=$(CFLAGS) -DLIBCONFIG
+endif
+
 all: sslh $(MAN) echosrv
 
 .c.o: *.h
@@ -43,11 +48,16 @@ sslh-select: $(OBJS) sslh-select.o Makefile common.h
 	#strip sslh-select
 
 echosrv: $(OBJS) echosrv.o
-	$(CC) $(CFLAGS) -o echosrv echosrv.o common.o $(LIBS)
+	$(CC) $(CFLAGS) -o echosrv echosrv.o probe.o common.o $(LIBS)
 
 $(MAN): sslh.pod Makefile
 	pod2man --section=8 --release=$(VERSION) --center=" " sslh.pod | gzip -9 - > $(MAN)
 
+# Create release: export clean tree and tag current
+# configuration
+release:
+	git archive master --prefix="sslh-$(VERSION)/" | gzip > /tmp/sslh-$(VERSION).tar.gz
+
 # generic install: install binary and man page
 install: sslh $(MAN)
 	install -D sslh-fork $(PREFIX)/sbin/sslh
@@ -68,7 +78,7 @@ clean:
 	rm -f sslh-fork sslh-select echosrv $(MAN) *.o *.gcov *.gcno *.gcda *.png *.html *.css *.info 
 
 tags:
-	ctags -T *.[ch]
+	ctags --globals -T *.[ch]
 
 test:
 	./t

README

@@ -1,17 +1,55 @@
 ===== sslh -- A ssl/ssh multiplexer. =====
 
-sslh accepts HTTP, HTTPS, SSH, OpenVPN, tinc and XMPP
-connections on the same port. This makes it possible to
-connect to any of these servers on port 443 (e.g. from
-inside a corporate firewall, which almost never block port
-443) while still serving HTTPS on that port. 
+Sslh accepts connections on specified ports, and forwards
+them further based on tests performed on the first data
+packet sent by the remote client.
+
+Probes for HTTP, SSL, SSH, OpenVPN, tinc, XMPP are
+implemented, and any other protocol that can be tested using
+a regular expression, can be recognised. A typical use case
+is to allow serving several services on port 443 (e.g. to
+connect to ssh from inside a corporate firewall, which
+almost never block port 443) while still serving HTTPS on
+that port. 
+
+Hence sslh acts as a protocol demultiplexer, or a
+switchboard. Its name comes from its original function to
+serve SSH and HTTPS on the same port.
 
 ==== Compile and install ====
 
-If you're lucky, the Makefile will work for you:
+sslh uses libconfig (http://www.hyperrealm.com/libconfig/)
+and libwrap.
+
+For Debian, these are contained in packages libwrap0-dev and
+libconfig8-dev.  
+
+For OpenSUSE, these are contained in packages libconfig9 and
+libconfig-dev in repository
+http://download.opensuse.org/repositories/multimedia:/libs/openSUSE_12.1/
+
+For Fedora, this package should work:
+https://admin.fedoraproject.org/pkgdb/acls/name/libconfig
+(feedback from Fedorans appreciated).
+
+If you can't find libconfig, or just don't want a
+configuration file, set 'USELIBCONFIG=' in the Makefile.
+
+After this, the Makefile should work:
 
 make install
 
+There are a couple of configuration options at the beginning
+of the Makefile: 
+
+    USELIBWRAP compiles support for host access control (see
+    hosts_access(3)), you will need libwrap headers and
+    library to compile (libwrap0-dev in Debian).
+
+    USELIBCONFIG compiles support for the configuration
+    file. You will need libconfig headers to compile
+    (libconfig8-dev in Debian).
+
 The Makefile produces two different executables: sslh-fork
 and sslh-select. 
 
@@ -27,7 +65,7 @@ If you are going to use sslh for a "small" setup (less than
 a dozen ssh connections and a low-traffic https server) then
 sslh-fork is probably more suited for you. If you are going
 to use sslh on a "medium" setup (a few thousand ssh
-connections, and another few thousand sslh connections),
+connections, and another few thousand ssl connections),
 sslh-select will be better. If you have a very large site
 (tens of thousands of connections), you'll need a vapourware
 version that would use libevent or something like that.
@@ -109,43 +147,75 @@ Web browser --------http/ssl------> stunnel ---http---> sslh --> http:80
 Configuration goes like this:
 
 On the server side, using stunnel3:
-stunnel -f -p mycert.pem  -d thelonious:443 -l /usr/local/sbin/sslh -- sslh -i  --ssl localhost:80 --ssh localhost:22
+stunnel -f -p mycert.pem  -d thelonious:443 -l /usr/local/sbin/sslh -- sslh -i  --http localhost:80 --ssh localhost:22
 
 stunnel options: -f for foreground/debugging, -p specifies
 the key + certificate, -d specifies which interface and port
 we're listening to for incoming connexions, -l summons sslh
 in inetd mode.
 
-sslh options: -i for inetd mode, --ssl to forward SSL
-connexions (in fact normal HTTP at that stage) to port 80,
-and SSH connexions to port 22. This works because sslh
-considers that any protocol it doesn't recognise is SSL.
+sslh options: -i for inetd mode, --http to forward http
+connexions to port 80, and SSH connexions to port 22.
 
-==== IP_TPROXY support ====
+==== capapbilities support ====
 
-There is a netfilter patch that adds an option to the Linux
-TCP/IP stack to allow a program to set the source address
-of an IP packet that it sends. This could let sslh set the
-address of packets to that of the actual client, so that
-sshd would see and log the IP address of the client, making
-sslh transparent.
+On Linux (only?), you can use POSIX capabilities to reduce a
+server's capabilities to the minimum it needs (see
+capabilities(8).  For sslh, this is CAP_NET_ADMIN (to
+perform transparent proxy-ing) and CAP_NET_BIND_SERVICE (to
+bind to port 443 without being root).
 
-This is not, and won't be, implemented in sslh for the
-following reasons (in increasing order of importance):
+The simplest way to use capabilities is to give them to the
+executable as root:
 
-  * It's not vital: the real connecting IP address can be
-    found in logs. Little gain.
-  * It's Linux only: it means increased complexity for no
-    gain to some users.
-  * It's a patch: it means it'd only be useful to Linux
-    users who compile their own kernel.
-  * Only root can use the feature: that's a definite no-no.
-    Sslh should not, must not, will never run as root.
+# setcap cap_net_bind_service,cap_net_admin+pe sslh-select
 
-This isn't to mean that it won't eventually get implemented,
-when/if the feature finds its way into the main kernel and
-it becomes usuable by non-root processes.
+Then you can run sslh-select as an unpriviledged user, e.g.:
 
+$ sslh-select -p myname:443 --ssh localhost:22 --ssl localhost:443
+
+This has 2 advantages over starting as root with -u:
+- You no longer start as root (duh)
+- This enables transparent proxying.
+
+Caveat: CAP_NET_ADMIN does give sslh too many rights, e.g.
+configuring the interface. If you're not going to use
+transparent proxying, just don't use it.
+
+==== Transparent proxy support ====
+
+On Linux (only?) you can use the --transparent option to
+request transparent proying. This means services behind sslh
+(Apache, sshd and so on) will see the external IP and ports
+as if the external world connected directly to them. This
+simplifies IP-based access control (or makes it possible at
+all).
+
+sslh needs extended rights to perform this: you'll need to
+give it cap_net_admin capabilities (see appropriate chapter)
+or run it as root (but don't do that).
+
+The firewalling tables also need to be adjusted as follow
+(example to connect to https on 4443 -- adapt to your needs
+(I don't think it is possible to have httpd listen to 443 in
+this scheme -- let me know if you manage that))):
+
+# iptables -t mangle -N SSLH
+# iptables -t mangle -A  OUTPUT --protocol tcp --out-interface eth0 --sport 22 --jump SSLH
+# iptables -t mangle -A OUTPUT --protocol tcp --out-interface eth0 --sport 4443 --jump SSLH
+# iptables -t mangle -A SSLH --jump MARK --set-mark 0x1
+# iptables -t mangle -A SSLH --jump ACCEPT
+# ip rule add fwmark 0x1 lookup 100
+# ip route add local 0.0.0.0/0 dev lo table 100
+
+This will only work if sslh does not use any loopback
+addresses (no 127.0.0.1 or localhost), you'll need to use
+explicit IP addresses (or names):
+
+sslh --listen 192.168.0.1:443 --ssh 192.168.0.1:22 --ssl 192.168.0.1:4443
+
+This will not work:
+sslh --listen 192.168.0.1:443 --ssh 127.0.0.1:22 --ssl 127.0.0.1:4443
 
 ==== Comments? Questions? ====
 

basic.cfg

@@ -0,0 +1,28 @@
+# This is a basic configuration file that should provide
+# sensible values for "standard" setup.
+
+verbose: false;
+foreground: false;
+inetd: false;
+numeric: false;
+timeout: 2;
+user: "nobody";
+pidfile: "/var/run/sslh.pid";
+
+
+# Change hostname with your external address name.
+listen:
+(
+    { host: "thelonious"; port: "443"; }
+);
+
+protocols:
+(
+     { name: "ssh"; service: "ssh"; host: "localhost"; port: "22"; probe: "builtin"; },
+     { name: "openvpn"; host: "localhost"; port: "1194"; probe: "builtin"; },
+     { name: "xmpp"; host: "localhost"; port: "5222"; probe: "builtin"; },
+     { name: "http"; host: "localhost"; port: "80"; probe: "builtin"; },
+     { name: "ssl"; host: "localhost"; port: "443"; probe: "builtin"; },
+     { name: "anyprot"; host: "localhost"; port: "443"; probe: "builtin"; }
+);
+

common.c

@@ -5,23 +5,7 @@
  **/
 
 #define _GNU_SOURCE
-#include <sys/types.h>
-#include <fcntl.h>
-#include <string.h>
-#include <unistd.h>
-#include <stdlib.h>
 #include <stdarg.h>
-#include <stdio.h>
-#include <signal.h>
-#include <sys/socket.h>
-#include <sys/wait.h>
-#include <netinet/in.h>
-#include <arpa/inet.h>
-#include <netdb.h>
-#include <pwd.h>
-#include <syslog.h>
-#include <libgen.h>
-#include <getopt.h>
 
 #include "common.h"
 
@@ -31,34 +15,6 @@
 #define SA_NOCLDWAIT 0
 #endif
 
-int is_ssh_protocol(const char *p, int len);
-int is_openvpn_protocol(const char *p, int len);
-int is_tinc_protocol(const char *p, int len);
-int is_xmpp_protocol(const char *p, int len);
-int is_http_protocol(const char *p, int len);
-int is_true(const char *p, int len) { return 1; }
-
-/* Table of all the protocols we know how to connect to.
- *
- * The first protocol in the table is where we connect in case of timeout
- * (client didn't speak: typically this is SSH.)
- *
- * The last protocol in the table is where we connect if client spoke but we
- * couldn't probe what it's saying.
- */
-struct proto protocols[] = {
-    /* affected  description   service  saddr   probe  */
-    { 0,         "ssh",        "sshd",  {0},   is_ssh_protocol },
-    { 0,         "openvpn",     NULL,   {0},   is_openvpn_protocol },
-    { 0,         "tinc",        NULL,   {0},   is_tinc_protocol },
-    { 0,         "xmpp",        NULL,   {0},   is_xmpp_protocol },
-    { 0,         "http",        NULL,   {0},   is_http_protocol },
-    /* probe for SSL always successes: it's the default, and must be tried last
-     **/
-    { 0,        "ssl",          NULL,   {0},   is_true }
-};
-int num_known_protocols = ARRAY_SIZE(protocols);
-
 /* 
  * Settings that depend on the command line.  They're set in main(), but also
  * used in other places in common.c, and it'd be heavy-handed to pass it all as
@@ -68,8 +24,10 @@ int verbose = 0;
 int probing_timeout = 2;
 int inetd = 0;
 int foreground = 0;
+int background = 0;
+int transparent = 0;
 int numeric = 0;
-char *user_name, *pid_file;
+const char *user_name, *pid_file;
 
 struct addrinfo *addr_listen = NULL; /* what addresses do we listen to? */
 
@@ -139,9 +97,35 @@ int start_listen_sockets(int *sockfd[], struct addrinfo *addr_list)
    return num_addr;
 }
 
+/* Transparent proxying: bind the peer address of fd to the peer address of
+ * fd_from */
+#define IP_TRANSPARENT 19
+int bind_peer(int fd, int fd_from)
+{
+    struct addrinfo from;
+    struct sockaddr_storage ss;
+    int res, trans = 1;
+
+    memset(&from, 0, sizeof(from));
+    from.ai_addr = (struct sockaddr*)&ss;
+    from.ai_addrlen = sizeof(ss);
+
+    res = getpeername(fd_from, from.ai_addr, &from.ai_addrlen);
+    CHECK_RES_DIE(res, "getpeername");
+    res = setsockopt(fd, IPPROTO_IP, IP_TRANSPARENT, &trans, sizeof(trans));
+    CHECK_RES_DIE(res, "setsockopt");
+    res = bind(fd, from.ai_addr, from.ai_addrlen);
+    CHECK_RES_RETURN(res, "bind");
+
+    return 0;
+}
+
 /* Connect to first address that works and returns a file descriptor, or -1 if
- * none work. cnx_name points to the name of the service (for logging) */
-int connect_addr(struct addrinfo *addr, char* cnx_name)
+ * none work. 
+ * If transparent proxying is on, use fd_from peer address on external address
+ * of new file descriptor.
+ * cnx_name points to the name of the service (for logging) */
+int connect_addr(struct addrinfo *addr, int fd_from, const char* cnx_name)
 {
     struct addrinfo *a;
     char buf[NI_MAXHOST];
@@ -156,6 +140,8 @@ int connect_addr(struct addrinfo *addr, char* cnx_name)
         if (fd == -1) {
             log_message(LOG_ERR, "forward to %s failed:socket: %s\n", cnx_name, strerror(errno));
         } else {
+            if (transparent)
+                bind_peer(fd, fd_from);
             res = connect(fd, a->ai_addr, a->ai_addrlen);
             if (res == -1) {
                 log_message(LOG_ERR, "forward to %s failed:connect: %s\n", 
@@ -208,7 +194,6 @@ int flush_defered(struct queue *q)
         q->defered_data_size -= n;
     }
 
-
     return n;
 }
 
@@ -236,8 +221,6 @@ void dump_connection(struct connection *cnx)
  * returns FD_NODATA if no data was available
  * returns FD_STALLED if data was read, could not be written, and has been
  * stored in temporary buffer.
- *
- * slot for debug only and may go away at some point
  */
 int fd2fd(struct queue *target_q, struct queue *from_q)
 {
@@ -291,123 +274,6 @@ int fd2fd(struct queue *target_q, struct queue *from_q)
    return size_w;
 }
 
-/* If the client wrote something first, read it and check if it's a SSH banner.
- * Data is left in appropriate defered write buffer.
- */
-int is_ssh_protocol(const char *p, int len)
-{
-    if (!strncmp(p, "SSH-", 4)) {
-        return 1;
-    }
-    return 0;
-}
-
-/* Is the buffer the beginning of an OpenVPN connection?
- * (code lifted from OpenVPN port-share option)
- */
-int is_openvpn_protocol (const char*p,int len)
-{
-#define P_OPCODE_SHIFT                 3
-#define P_CONTROL_HARD_RESET_CLIENT_V2 7
-    if (len >= 3)
-    {
-        return p[0] == 0
-            && p[1] >= 14
-            && p[2] == (P_CONTROL_HARD_RESET_CLIENT_V2<<P_OPCODE_SHIFT);
-    }
-    else if (len >= 2)
-    {
-        return p[0] == 0 && p[1] >= 14;
-    }
-    else
-        return 0;
-}
-
-/* Is the buffer the beginning of a tinc connections?
- * (protocol is undocumented, but starts with "0 " in 1.0.15)
- * */
-int is_tinc_protocol( const char *p, int len)
-{
-    return !strncmp(p, "0 ", 2);
-}
-
-/* Is the buffer the beginning of a jabber (XMPP) connections?
- * (Protocol is documented (http://tools.ietf.org/html/rfc6120) but for lazy
- * clients, just checking first frame containing "jabber" in xml entity)
- * */
-int is_xmpp_protocol( const char *p, int len)
-{
-    return strstr(p, "jabber") ? 1 : 0;
-}
-
-int probe_http_method(const char *p, const char *opt)
-{
-    return !strncmp(p, opt, strlen(opt)-1);
-}
-
-/* Is the buffer the beginnin of an HTTP connection?  */
-int is_http_protocol(const char *p, int len)
-{
-    /* If it's got HTTP in the request (HTTP/1.1) then it's HTTP */
-    if (strstr(p, "HTTP"))
-        return 1;
-
-    /* Otherwise it could be HTTP/1.0 without version: check if it's got an
-     * HTTP method (RFC2616 5.1.1) */
-    probe_http_method(p, "OPTIONS");
-    probe_http_method(p, "GET");
-    probe_http_method(p, "HEAD");
-    probe_http_method(p, "POST");
-    probe_http_method(p, "PUT");
-    probe_http_method(p, "DELETE");
-    probe_http_method(p, "TRACE");
-    probe_http_method(p, "CONNECT");
-
-    return 0;
-}
-
-
-/* 
- * Read the beginning of data coming from the client connection and check if
- * it's a known protocol. Then leave the data on the defered
- * write buffer of the connection and returns the protocol index in the
- * protocols[] array *
- */
-T_PROTO_ID probe_client_protocol(struct connection *cnx)
-{
-    char buffer[BUFSIZ];
-    int n, i;
-
-    n = read(cnx->q[0].fd, buffer, sizeof(buffer));
-    /* It's possible that read() returns an error, e.g. if the client
-     * disconnected between the previous call to select() and now. If that
-     * happens, we just connect to the default protocol so the caller of this
-     * function does not have to deal with a specific  failure condition (the
-     * connection will just fail later normally). */
-    if (n > 0) {
-        defer_write(&cnx->q[1], buffer, n);
-
-        for (i = 0; i < ARRAY_SIZE(protocols); i++) {
-            if (protocols[i].affected) {
-                if (protocols[i].probe(buffer, n)) {
-                    return i;
-                }
-            }
-        }
-    }
-
-    /* If none worked, return the first one affected (that's completely
-     * arbitrary) */
-    for (i = 0; i < ARRAY_SIZE(protocols); i++)
-        if (protocols[i].affected)
-            return i;
-
-    /* At this stage... nothing is affected. This shouldn't happen as we check
-     * at least one target exists when we parse the commnand line */
-    fprintf(stderr, "FATAL: No protocol affected. This should not happen.\n");
-    exit(1);
-}
-
 /* returns a string that prints the IP and port of the sockaddr */
 char* sprintaddr(char* buf, size_t size, struct addrinfo *a)
 {
@@ -439,13 +305,30 @@ char* sprintaddr(char* buf, size_t size, struct addrinfo *a)
    return buf;
 }
 
+/* Turns a hostname and port (or service) into a list of struct addrinfo 
+ * returns 0 on success, -1 otherwise and logs error
+ **/
+int resolve_split_name(struct addrinfo **out, const char* host, const char* serv)
+{
+   struct addrinfo hint;
+   int res;
+
+   memset(&hint, 0, sizeof(hint));
+   hint.ai_family = PF_UNSPEC;
+   hint.ai_socktype = SOCK_STREAM;
+
+   res = getaddrinfo(host, serv, &hint, out);
+   if (res)
+      log_message(LOG_ERR, "%s `%s:%s'\n", gai_strerror(res), host, serv);
+   return res;
+}
+
 /* turns a "hostname:port" string into a list of struct addrinfo;
 out: list of newly allocated addrinfo (see getaddrinfo(3)); freeaddrinfo(3) when done
 fullname: input string -- it gets clobbered
 */
 void resolve_name(struct addrinfo **out, char* fullname)
 {
-   struct addrinfo hint;
    char *serv, *host;
    int res;
 
@@ -453,7 +336,7 @@ void resolve_name(struct addrinfo **out, char* fullname)
 
    if (!sep) /* No separator: parameter is just a port */
    {
-      fprintf(stderr, "names must be fully specified as hostname:port\n");
+      fprintf(stderr, "%s: names must be fully specified as hostname:port\n", fullname);
       exit(1);
    }
 
@@ -461,11 +344,7 @@ void resolve_name(struct addrinfo **out, char* fullname)
    serv = sep+1;
    *sep = 0;
 
-   memset(&hint, 0, sizeof(hint));
-   hint.ai_family = PF_UNSPEC;
-   hint.ai_socktype = SOCK_STREAM;
-
-   res = getaddrinfo(host, serv, &hint, out);
+   res = resolve_split_name(out, host, serv);
    if (res) {
       fprintf(stderr, "%s `%s'\n", gai_strerror(res), fullname);
       if (res == EAI_SERVICE)
@@ -533,7 +412,7 @@ void log_connection(struct connection *cnx)
  *
  * Returns -1 if access is denied, 0 otherwise
  */
-int check_access_rights(int in_socket, char* service)
+int check_access_rights(int in_socket, const char* service)
 {
 #ifdef LIBWRAP
     struct sockaddr peeraddr;
@@ -572,7 +451,6 @@ int check_access_rights(int in_socket, char* service)
     return 0;
 }
 
-
 void setup_signals(void)
 {
     int res;
@@ -586,18 +464,23 @@ void setup_signals(void)
     res = sigaction(SIGCHLD, &action, NULL);
     CHECK_RES_DIE(res, "sigaction");
 
-
     /* Set SIGTERM to exit. For some reason if it's not set explicitely,
      * coverage information is lost when killing the process */
     memset(&action, 0, sizeof(action));
     action.sa_handler = exit;
     res = sigaction(SIGTERM, &action, NULL);
     CHECK_RES_DIE(res, "sigaction");
+
+    /* Ignore SIGPIPE . */
+    action.sa_handler = SIG_IGN;
+    res = sigaction(SIGPIPE, &action, NULL);
+    CHECK_RES_DIE(res, "sigaction");
+
 }
 
 /* Open syslog connection with appropriate banner; 
  * banner is made up of basename(bin_name)+"[pid]" */
-void setup_syslog(char* bin_name) {
+void setup_syslog(const char* bin_name) {
     char *name1, *name2;
 
     name1 = strdup(bin_name);
@@ -610,7 +493,7 @@ void setup_syslog(char* bin_name) {
 }
 
 /* We don't want to run as root -- drop priviledges if required */
-void drop_privileges(char* user_name)
+void drop_privileges(const char* user_name)
 {
     int res;
     struct passwd *pw = getpwnam(user_name);
@@ -628,7 +511,7 @@ void drop_privileges(char* user_name)
 }
 
 /* Writes my PID */
-void write_pid_file(char* pidfile)
+void write_pid_file(const char* pidfile)
 {
     FILE *f;
 
@@ -642,45 +525,3 @@ void write_pid_file(char* pidfile)
     fclose(f);
 }
 
-void printsettings(void)
-{
-    char buf[NI_MAXHOST];
-    struct addrinfo *a;
-    int i;
-    
-    for (i = 0; i < ARRAY_SIZE(protocols); i++) {
-        if (protocols[i].affected)
-            fprintf(stderr,
-                    "%s addr: %s. libwrap service: %s family %d %d\n", 
-                    protocols[i].description, 
-                    sprintaddr(buf, sizeof(buf), &protocols[i].saddr), 
-                    protocols[i].service,
-                    protocols[i].saddr.ai_family,
-                    protocols[i].saddr.ai_addr->sa_family);
-    }
-    fprintf(stderr, "listening on:\n");
-    for (a = addr_listen; a; a = a->ai_next) {
-        fprintf(stderr, "\t%s\n", sprintaddr(buf, sizeof(buf), a));
-    }
-    fprintf(stderr, "timeout to ssh: %d\n", probing_timeout);
-}
-
-/* Adds protocols to the list of options, so command-line parsing uses the
- * protocol definition array 
- * options: array of options to add to; must be big enough
- * n_opts: number of options in *options before calling (i.e. where to append)
- * prot: array of protocols
- * n_prots: number of protocols in *prot
- * */
-void append_protocols(struct option *options, int n_opts, struct proto *prot, int n_prots)
-{
-    int o, p;
-
-    for (o = n_opts, p = 0; p < n_prots; o++, p++) {
-        options[o].name = prot[p].description;
-        options[o].has_arg = required_argument;
-        options[o].flag = 0;
-        options[o].val = p + PROT_SHIFT;
-    }
-}
-

common.h

@@ -1,3 +1,13 @@
+#ifndef __COMMON_H_
+#define __COMMON_H_
+
+/* FD_SETSIZE is 64 on Cygwin, which is really low. Just redefining it is
+ * enough for the macros to adapt (http://support.microsoft.com/kb/111855)
+ */
+#ifdef __CYGWIN__
+#define FD_SETSIZE 4096
+#endif
+
 #define _GNU_SOURCE
 #include <sys/types.h>
 #include <fcntl.h>
@@ -30,7 +40,7 @@
 
 #define CHECK_RES_RETURN(res, str) \
     if (res == -1) {                                    \
-        log_message(LOG_CRIT, "%s: %d\n", str, errno);  \
+        log_message(LOG_CRIT, "%s:%d:%s\n", str, errno, strerror(errno));  \
         return res;                                     \
     } 
 
@@ -47,21 +57,6 @@ enum connection_state {
     ST_SHOVELING   /* Connexion is established */
 };
 
-typedef int T_PROTO_ID; /* Index into protocols[] array */
-
-/* For each protocol we need: */
-struct proto {
-    int affected;       /* are we actually using it? */
-    char* description;  /* a string that says what it is (for logging and command-line parsing) */
-    char* service;      /* service name to do libwrap checks */
-    struct addrinfo saddr; /* where to switch that protocol */
-    int (*probe)(const char*, int); /* function to probe that protocol */
-};
-
-/* A table in common.c contains all the known protocols */
-extern struct proto protocols[];
-extern int num_known_protocols;
-
 /* this is used to pass protocols through the command-line parameter parsing */
 #define PROT_SHIFT 1000  /* protocol options will be 1000, 1001, etc */
 
@@ -91,36 +86,37 @@ struct connection {
 
 /* common.c */
 void init_cnx(struct connection *cnx);
-int connect_addr(struct addrinfo *addr, char* cnx_name);
+int connect_addr(struct addrinfo *addr, int fd_from, const char* cnx_name);
 int fd2fd(struct queue *target, struct queue *from);
 char* sprintaddr(char* buf, size_t size, struct addrinfo *a);
 void resolve_name(struct addrinfo **out, char* fullname);
-T_PROTO_ID probe_client_protocol(struct connection *cnx);
+struct proto* probe_client_protocol(struct connection *cnx);
 void log_connection(struct connection *cnx);
-int check_access_rights(int in_socket, char* service);
+int check_access_rights(int in_socket, const char* service);
 void setup_signals(void);
-void setup_syslog(char* bin_name);
-void drop_privileges(char* user_name);
-void write_pid_file(char* pidfile);
-void printsettings(void);
-void parse_cmdline(int argc, char* argv[]);
+void setup_syslog(const char* bin_name);
+void drop_privileges(const char* user_name);
+void write_pid_file(const char* pidfile);
 void log_message(int type, char* msg, ...);
 void dump_connection(struct connection *cnx);
+int resolve_split_name(struct addrinfo **out, const char* hostname, const char* port);
 
-void append_protocols(struct option *options, int n_opts, struct proto *prot, int n_prots);
 int start_listen_sockets(int *sockfd[], struct addrinfo *addr_list);
 
 int defer_write(struct queue *q, void* data, int data_size);
 int flush_defered(struct queue *q);
 
-extern int probing_timeout, verbose, inetd, foreground, numeric;
+extern int probing_timeout, verbose, inetd, foreground, 
+       background, transparent, numeric;
 extern struct sockaddr_storage addr_ssl, addr_ssh, addr_openvpn;
 extern struct addrinfo *addr_listen;
 extern const char* USAGE_STRING;
-extern char* user_name, *pid_file;
+extern const char* user_name, *pid_file;
 extern const char* server_type;
 
 /* sslh-fork.c */
 void start_shoveler(int);
 
 void main_loop(int *listen_sockets, int num_addr_listen);
+
+#endif

echosrv.c

@@ -94,32 +94,26 @@ void parse_cmdline(int argc, char* argv[])
 
 void start_echo(int fd)
 {
-    fd_set fds;
     int res;
     char buffer[1 << 20];
-    char* ret;
-    FILE *socket;
+    int ret, prefix_len;
 
-    FD_ZERO(&fds);
+    prefix_len = strlen(prefix);
 
-    socket = fdopen(fd, "r+");
-    if (!socket) {
-        CHECK_RES_DIE(-1, "fdopen");
-    }
+    memset(buffer, 0, sizeof(buffer));
+    strcpy(buffer, prefix);
 
     while (1) {
-        ret = fgets(buffer, sizeof(buffer), socket);
-        if (!ret) {
-            fprintf(stderr, "%s", strerror(ferror(socket)));
+        ret = read(fd, buffer + prefix_len, sizeof(buffer));
+        if (ret == -1) {
+            fprintf(stderr, "%s", strerror(errno));
             return;
         }
-        res = fprintf(socket, "%s%s", prefix, buffer);
+        res = write(fd, buffer, ret + prefix_len);
         if (res < 0) {
-            fprintf(stderr, "%s", strerror(ferror(socket)));
+            fprintf(stderr, "%s", strerror(errno));
             return;
         }
-
-        fflush(socket);
     }
 }
 

example.cfg

@@ -0,0 +1,52 @@
+# This file is provided as documentation to show what is
+# possible. It should not be used as-is, and probably should
+# not be used as a starting point for a working
+# configuration. Instead use basic.cfg.
+
+verbose: true;
+foreground: true;
+inetd: false;
+numeric: false;
+timeout: 2;
+user: "nobody";
+pidfile: "/var/run/sslh.pid";
+
+
+# List of interfaces on which we should listen
+listen:
+(
+    { host: "thelonious"; port: "443"; },
+    { host: "thelonious"; port: "8080"; }
+);
+
+# List of protocols
+#
+# Each protocol entry consists of:
+#   name: name of the protocol
+#   service: (optional) libwrap service name (see hosts_access(5))
+#   host: host name to connect that protocol
+#   port: port number to connect that protocol
+#   probe: "builtin" or a list of regular expressions
+#          (can be left out, e.g. to use with on-timeout)
+#   
+# sslh will try each probe in order they are declared, and
+# connect to the first that matches.
+
+protocols:
+(
+     { name: "ssh"; service: "ssh"; host: "localhost"; port: "22"; probe: "builtin"; },
+     { name: "openvpn"; host: "localhost"; port: "1194"; probe: [ "^\x00[\x0D-\xFF]$", "^\x00[\x0D-\xFF]\x38" ]; },
+     { name: "xmpp"; host: "localhost"; port: "5222"; probe: [ "jabber" ]; },
+     { name: "http"; host: "localhost"; port: "80"; probe: "builtin"; },
+     { name: "ssl"; host: "localhost"; port: "443"; probe: [ "" ]; },
+     { name: "timeout"; service: "daytime"; host: "localhost"; port: "daytime"; }
+);
+
+# Optionally, specify to which protocol to connect in case
+# of timeout (defaults to "ssh").
+# You can timeout to any arbitrary address by setting a
+# protocol with no probe, as is the case with this example.
+# This enables you to set a tcpd service name for this
+# protocol too.
+on-timeout: "timeout";
+

probe.c

@@ -0,0 +1,288 @@
+/*
+# probe.c: Code for probing protocols
+#
+# Copyright (C) 2007-2012  Yves Rutschle
+# 
+# This program is free software; you can redistribute it
+# and/or modify it under the terms of the GNU General Public
+# License as published by the Free Software Foundation; either
+# version 2 of the License, or (at your option) any later
+# version.
+# 
+# This program is distributed in the hope that it will be
+# useful, but WITHOUT ANY WARRANTY; without even the implied
+# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+# PURPOSE.  See the GNU General Public License for more
+# details.
+# 
+# The full text for the General Public License is here:
+# http://www.gnu.org/licenses/gpl.html
+*/
+
+#define _GNU_SOURCE
+#include <stdio.h>
+#include <regex.h>
+#include <ctype.h>
+#include "probe.h"
+
+
+
+static int is_ssh_protocol(const char *p, int len, struct proto*);
+static int is_openvpn_protocol(const char *p, int len, struct proto*);
+static int is_tinc_protocol(const char *p, int len, struct proto*);
+static int is_xmpp_protocol(const char *p, int len, struct proto*);
+static int is_http_protocol(const char *p, int len, struct proto*);
+static int is_tls_protocol(const char *p, int len, struct proto*);
+static int is_true(const char *p, int len, struct proto* proto) { return 1; }
+
+/* Table of protocols that have a built-in probe
+ */
+static struct proto builtins[] = {
+    /* description   service  saddr   probe  */
+    { "ssh",         "sshd",   NULL,   is_ssh_protocol},
+    { "openvpn",     NULL,     NULL,   is_openvpn_protocol },
+    { "tinc",        NULL,     NULL,   is_tinc_protocol },
+    { "xmpp",        NULL,     NULL,   is_xmpp_protocol },
+    { "http",        NULL,     NULL,   is_http_protocol },
+    { "ssl",         NULL,     NULL,   is_tls_protocol },
+    { "tls",         NULL,     NULL,   is_tls_protocol },
+    { "anyprot",     NULL,     NULL,   is_true }
+};
+
+static struct proto *protocols;
+static char* on_timeout = "ssh";
+
+struct proto*  get_builtins(void) {
+    return builtins;
+}
+
+int get_num_builtins(void) {
+    return ARRAY_SIZE(builtins);
+}
+
+/* Sets the protocol name to connect to in case of timeout */
+void set_ontimeout(const char* name)
+{
+    asprintf(&on_timeout, "%s", name);
+}
+
+/* Returns the protocol to connect to in case of timeout; 
+ * if not found, return the first protocol specified 
+ */
+struct proto* timeout_protocol(void) 
+{
+    struct proto* p = get_first_protocol();
+    for (; p && strcmp(p->description, on_timeout); p = p->next);
+    if (p) return p;
+    return get_first_protocol();
+}
+
+/* returns the first protocol (caller can then follow the *next pointers) */
+struct proto* get_first_protocol(void)
+{
+    return protocols;
+}
+
+void set_protocol_list(struct proto* prots)
+{
+    protocols = prots;
+}
+
+/* From http://grapsus.net/blog/post/Hexadecimal-dump-in-C */
+#define HEXDUMP_COLS 16
+void hexdump(const char *mem, unsigned int len)
+{
+    unsigned int i, j;
+
+    for(i = 0; i < len + ((len % HEXDUMP_COLS) ? (HEXDUMP_COLS - len % HEXDUMP_COLS) : 0); i++)
+    {
+        /* print offset */
+        if(i % HEXDUMP_COLS == 0)
+            printf("0x%06x: ", i);
+
+        /* print hex data */
+        if(i < len)
+            printf("%02x ", 0xFF & mem[i]);
+        else /* end of block, just aligning for ASCII dump */
+            printf("   ");
+
+        /* print ASCII dump */
+        if(i % HEXDUMP_COLS == (HEXDUMP_COLS - 1)) {
+            for(j = i - (HEXDUMP_COLS - 1); j <= i; j++) {
+                if(j >= len) /* end of block, not really printing */
+                    putchar(' ');
+                else if(isprint(mem[j])) /* printable char */
+                    putchar(0xFF & mem[j]);        
+                else /* other char */
+                    putchar('.');
+            }
+            putchar('\n');
+        }
+    }
+}
+
+/* Is the buffer the beginning of an SSH connection? */
+static int is_ssh_protocol(const char *p, int len, struct proto *proto)
+{
+    if (!strncmp(p, "SSH-", 4)) {
+        return 1;
+    }
+    return 0;
+}
+
+/* Is the buffer the beginning of an OpenVPN connection?
+ *
+ * Code inspired from OpenVPN port-share option; however, OpenVPN code is
+ * wrong: users using pre-shared secrets have non-initialised key_id fields so
+ * p[3] & 7 should not be looked at, and also the key_method can be specified
+ * to 1 which changes the opcode to P_CONTROL_HARD_RESET_CLIENT_V1.
+ * See:
+ * http://www.fengnet.com/book/vpns%20illustrated%20tunnels%20%20vpnsand%20ipsec/ch08lev1sec5.html
+ * and OpenVPN ssl.c, ssl.h and options.c
+ */
+static int is_openvpn_protocol (const char*p,int len, struct proto *proto)
+{
+    int packet_len = ntohs(*(uint16_t*)p);
+
+    return packet_len == len - 2;
+}
+
+/* Is the buffer the beginning of a tinc connections?
+ * (protocol is undocumented, but starts with "0 " in 1.0.15)
+ * */
+static int is_tinc_protocol( const char *p, int len, struct proto *proto)
+{
+    return !strncmp(p, "0 ", 2);
+}
+
+/* Is the buffer the beginning of a jabber (XMPP) connections?
+ * (Protocol is documented (http://tools.ietf.org/html/rfc6120) but for lazy
+ * clients, just checking first frame containing "jabber" in xml entity)
+ * */
+static int is_xmpp_protocol( const char *p, int len, struct proto *proto)
+{
+    return strstr(p, "jabber") ? 1 : 0;
+}
+
+static int probe_http_method(const char *p, const char *opt)
+{
+    return !strcmp(p, opt);
+}
+
+/* Is the buffer the beginning of an HTTP connection?  */
+static int is_http_protocol(const char *p, int len, struct proto *proto)
+{
+    /* If it's got HTTP in the request (HTTP/1.1) then it's HTTP */
+    if (strstr(p, "HTTP"))
+        return 1;
+
+    /* Otherwise it could be HTTP/1.0 without version: check if it's got an
+     * HTTP method (RFC2616 5.1.1) */
+    probe_http_method(p, "OPTIONS");
+    probe_http_method(p, "GET");
+    probe_http_method(p, "HEAD");
+    probe_http_method(p, "POST");
+    probe_http_method(p, "PUT");
+    probe_http_method(p, "DELETE");
+    probe_http_method(p, "TRACE");
+    probe_http_method(p, "CONNECT");
+
+    return 0;
+}
+
+static int is_tls_protocol(const char *p, int len, struct proto *proto)
+{
+    /* TLS packet starts with a record "Hello" (0x16), followed by version
+     * (0x03 0x00-0x03) (RFC6101 A.1)
+     * This means we reject SSLv2 and lower, which is actually a good thing (RFC6176)
+     */
+    return p[0] == 0x16 && p[1] == 0x03 && ( p[2] >= 0 && p[2] <= 0x03);
+}
+
+static int regex_probe(const char *p, int len, struct proto *proto)
+{
+    regex_t** probe_list = (regex_t**)(proto->data);
+    int i=0;
+
+    while (probe_list[i]) {
+        if (!regexec(probe_list[i], p, 0, NULL, 0)) {
+            return 1;
+        }
+        i++;
+    }
+    return 0;
+}
+
+/* 
+ * Read the beginning of data coming from the client connection and check if
+ * it's a known protocol. Then leave the data on the defered
+ * write buffer of the connection and returns a pointer to the protocol
+ * structure
+ */
+struct proto* probe_client_protocol(struct connection *cnx)
+{
+    char buffer[BUFSIZ];
+    struct proto *p;
+    int n;
+
+    n = read(cnx->q[0].fd, buffer, sizeof(buffer));
+    /* It's possible that read() returns an error, e.g. if the client
+     * disconnected between the previous call to select() and now. If that
+     * happens, we just connect to the default protocol so the caller of this
+     * function does not have to deal with a specific  failure condition (the
+     * connection will just fail later normally). */
+    if (n > 0) {
+        defer_write(&cnx->q[1], buffer, n);
+
+        for (p = protocols; p; p = p->next) {
+            if (! p->probe) continue;
+            if (verbose) fprintf(stderr, "probing for %s\n", p->description);
+            if (p->probe(buffer, n, p)) {
+                if (verbose) fprintf(stderr, "probe %s successful\n", p->description);
+                return p;
+            }
+        }
+    }
+
+    if (verbose) 
+        fprintf(stderr, 
+                "all probes failed, connecting to first protocol: %s\n", 
+                protocols->description);
+
+    /* If none worked, return the first one affected (that's completely
+     * arbitrary) */
+    return protocols;
+}
+
+/* Returns the structure for specified protocol or NULL if not found */
+static struct proto* get_protocol(const char* description)
+{
+    int i;
+
+    for (i = 0; i < ARRAY_SIZE(builtins); i++) {
+        if (!strcmp(builtins[i].description, description)) {
+            return &builtins[i];
+        }
+    }
+    return NULL;
+}
+
+/* Returns the probe for specified protocol:
+ * parameter is the description in builtins[], or "regex" 
+ * */
+T_PROBE* get_probe(const char* description) {
+    struct proto* p = get_protocol(description);
+
+    if (p)
+        return p->probe;
+
+    /* Special case of "regex" probe (we don't want to set it in builtins
+     * because builtins is also used to build the command-line options and
+     * regexp is not legal on the command line)*/
+    if (!strcmp(description, "regex"))
+        return regex_probe;
+
+    return NULL;
+}
+
+

probe.h

@@ -0,0 +1,59 @@
+/* API for probe.c */
+
+#ifndef __PROBE_H_
+#define __PROBE_H_
+
+#include "common.h"
+
+struct proto;
+typedef int T_PROBE(const char*, int, struct proto*);
+
+/* For each protocol we need: */
+struct proto {
+    const char* description;  /* a string that says what it is (for logging and command-line parsing) */
+    const char* service;      /* service name to do libwrap checks */
+    struct addrinfo *saddr; /* list of addresses to try and switch that protocol */
+
+    /* function to probe that protocol; parameters are buffer and length
+     * containing the data to probe, and a pointer to the protocol structure */
+    T_PROBE* probe;
+    void* data;     /* opaque pointer ; used to pass list of regex to regex probe */
+    struct proto *next; /* pointer to next protocol in list, NULL if last */
+};
+
+/* Returns a pointer to the array of builtin protocols */
+struct proto * get_builtins(void);
+
+/* Returns the number of builtin protocols */
+int get_num_builtins(void);
+
+/* Returns the probe for specified protocol */
+T_PROBE* get_probe(const char* description);
+
+/* Returns the head of the configured protocols */
+struct proto* get_first_protocol(void);
+
+/* Set the list of configured protocols */
+void set_protocol_list(struct proto*);
+
+/* probe_client_protocol
+ *
+ * Read the beginning of data coming from the client connection and check if
+ * it's a known protocol. Then leave the data on the defered
+ * write buffer of the connection and returns a pointer to the protocol
+ * structure
+ */
+struct proto* probe_client_protocol(struct connection *cnx);
+
+/* set the protocol to connect to in case of timeout */
+void set_ontimeout(const char* name);
+
+/* timeout_protocol
+ *
+ * Returns the protocol to connect to in case of timeout
+ */
+struct proto* timeout_protocol(void);
+
+void hexdump(const char*, unsigned int);
+
+#endif

scripts/etc.init.d.sslh

@@ -2,6 +2,8 @@
 
 ### BEGIN INIT INFO
 # Provides:		sslh
+# Required-Start:    $remote_fs $syslog
+# Required-Stop:     $remote_fs $syslog
 # Default-Start:	2 3 4 5
 # Default-Stop:		1
 # Short-Description:	sslh proxy ssl & ssh connections

scripts/systemd.sslh.service

@@ -0,0 +1,11 @@
+[Unit]
+Description=SSL/SSH multiplexer
+After=network.target
+
+[Service]
+EnvironmentFile=/etc/conf.d/sslh
+ExecStart=/usr/bin/sslh --foreground $DAEMON_OPTS
+KillMode=process
+
+[Install]
+WantedBy=multi-user.target

sslh-fork.c

@@ -1,7 +1,7 @@
 /*
-   Reimplementation of sslh in C
+   sslh-fork: forking server
 
-# Copyright (C) 2007-2011  Yves Rutschle
+# Copyright (C) 2007-2012  Yves Rutschle
 # 
 # This program is free software; you can redistribute it
 # and/or modify it under the terms of the GNU General Public
@@ -21,6 +21,7 @@
 */
 
 #include "common.h"
+#include "probe.h"
 
 const char* server_type = "sslh-fork";
 
@@ -72,7 +73,7 @@ void start_shoveler(int in_socket)
    int res;
    int out_socket;
    struct connection cnx;
-   T_PROTO_ID prot;
+   struct proto *prot;
 
    init_cnx(&cnx);
 
@@ -91,17 +92,17 @@ void start_shoveler(int in_socket)
        prot = probe_client_protocol(&cnx);
    } else {
        /* Timed out: it's necessarily SSH */
-       prot = 0;
+       prot = timeout_protocol();
    }
 
-   saddr = &protocols[prot].saddr;
-   if (protocols[prot].service && 
-       check_access_rights(in_socket, protocols[prot].service)) {
+   saddr = prot->saddr;
+   if (prot->service && 
+       check_access_rights(in_socket, prot->service)) {
        exit(0);
    }
 
    /* Connect the target socket */
-   out_socket = connect_addr(saddr, protocols[prot].description);
+   out_socket = connect_addr(saddr, in_socket, prot->description);
    CHECK_RES_DIE(out_socket, "connect");
 
    cnx.q[1].fd = out_socket;

sslh-main.c

@@ -1,7 +1,8 @@
 /*
-# main: processing of command line options and start the main loop.
+# main: processing of config file, command line options and start the main
+# loop.
 #
-# Copyright (C) 2007-2011  Yves Rutschle
+# Copyright (C) 2007-2012  Yves Rutschle
 # 
 # This program is free software; you can redistribute it
 # and/or modify it under the terms of the GNU General Public
@@ -21,89 +22,391 @@
 */
 
 #define _GNU_SOURCE
-#include <sys/types.h>
-#include <fcntl.h>
-#include <string.h>
-#include <unistd.h>
-#include <stdlib.h>
-#include <stdarg.h>
-#include <stdio.h>
-#include <signal.h>
-#include <sys/socket.h>
-#include <sys/wait.h>
-#include <netinet/in.h>
-#include <arpa/inet.h>
-#include <netdb.h>
-#include <pwd.h>
-#include <syslog.h>
-#include <libgen.h>
-#include <getopt.h>
+#ifdef LIBCONFIG
+#include <libconfig.h>
+#endif
+#include <regex.h>
 
 #include "common.h"
+#include "probe.h"
 
 const char* USAGE_STRING =
 "sslh " VERSION "\n" \
 "usage:\n" \
-"\tsslh  [-v] [-i] [-V] [-f] [-n]\n"
+"\tsslh  [-v] [-i] [-V] [-f] [-n] [-F <file>]\n"
 "\t[-t <timeout>] [-P <pidfile>] -u <username> -p <add> [-p <addr> ...] \n" \
-"%s\n\n" \
+"%s\n\n" /* Dynamically built list of builtin protocols */  \
+"\t[--on-timeout <addr>]\n" \
 "-v: verbose\n" \
 "-V: version\n" \
 "-f: foreground\n" \
 "-n: numeric output\n" \
-"-t: timeout before connecting to SSH.\n" \
+"-F: use configuration file\n" \
+"--on-timeout: connect to specified address upon timeout (default: ssh address)\n" \
+"-t: seconds to wait before connecting to --on-timeout address.\n" \
 "-p: address and port to listen on.\n    Can be used several times to bind to several addresses.\n" \
 "--[ssh,ssl,...]: where to connect connections from corresponding protocol.\n" \
-"-P: PID file. Default: /var/run/sslh.pid.\n" \
+"-F: specify a configuration file\n" \
+"-P: PID file.\n" \
 "-i: Run as a inetd service.\n" \
 "";
 
-void print_usage(void)
+/* Constants for options that have no one-character shorthand */
+#define OPT_ONTIMEOUT   257
+
+static struct option const_options[] = {
+    { "inetd",      no_argument,            &inetd,         1 },
+    { "foreground", no_argument,            &foreground,    1 },
+    { "background", no_argument,            &background,    1 },
+    { "transparent", no_argument,           &transparent,   1 },
+    { "numeric",    no_argument,            &numeric,       1 },
+    { "verbose",    no_argument,            &verbose,       1 },
+    { "user",       required_argument,      0,              'u' },
+    { "config",     required_argument,      0,              'F' },
+    { "pidfile",    required_argument,      0,              'P' },
+    { "timeout",    required_argument,      0,              't' },
+    { "on-timeout", required_argument,      0,              OPT_ONTIMEOUT },
+    { "listen",     required_argument,      0,              'p' },
+    {}
+};
+static struct option* all_options;
+static struct proto* builtins;
+static const char *optstr = "vt:T:p:VP:F:";
+
+
+
+static void print_usage(void)
 {
+    struct proto *p;
     int i;
     char *prots = "";
 
-    for (i = 0; i < num_known_protocols; i++)
-        asprintf(&prots, "%s\t[--%s <addr>]\n", prots, protocols[i].description);
+    p = get_builtins();
+    for (i = 0; i < get_num_builtins(); i++)
+        asprintf(&prots, "%s\t[--%s <addr>]\n", prots, p[i].description);
 
     fprintf(stderr, USAGE_STRING, prots);
 }
 
-void parse_cmdline(int argc, char* argv[])
+static void printsettings(void)
 {
-    int c, affected = 0;
-    struct option const_options[] = {
-        { "inetd",      no_argument,            &inetd,         1 },
-        { "foreground", no_argument,            &foreground,    1 },
-        { "verbose",    no_argument,            &verbose,       1 },
-        { "numeric",    no_argument,            &numeric,       1 },
-        { "user",       required_argument,      0,              'u' },
-        { "pidfile",   required_argument,       0,              'P' },
-        { "timeout",    required_argument,      0,              't' },
-        { "listen",     required_argument,      0,              'p' },
-    };
-    struct option all_options[ARRAY_SIZE(const_options) + num_known_protocols + 1];
-    struct addrinfo *addr, **a;
+    char buf[NI_MAXHOST];
+    struct addrinfo *a;
+    struct proto *p;
+    
+    for (p = get_first_protocol(); p; p = p->next) {
+        fprintf(stderr,
+                "%s addr: %s. libwrap service: %s family %d %d\n", 
+                p->description, 
+                sprintaddr(buf, sizeof(buf), p->saddr), 
+                p->service,
+                p->saddr->ai_family,
+                p->saddr->ai_addr->sa_family);
+    }
+    fprintf(stderr, "listening on:\n");
+    for (a = addr_listen; a; a = a->ai_next) {
+        fprintf(stderr, "\t%s\n", sprintaddr(buf, sizeof(buf), a));
+    }
+    fprintf(stderr, "timeout: %d\non-timeout: %s\n", probing_timeout,
+            timeout_protocol()->description);
+}
 
-    memset(all_options, 0, sizeof(all_options));
+
+/* Extract configuration on addresses and ports on which to listen.
+ * out: newly allocated list of addrinfo to listen to
+ */
+#ifdef LIBCONFIG
+static int config_listen(config_t *config, struct addrinfo **listen) 
+{
+    config_setting_t *setting, *addr;
+    int len, i;
+    const char *hostname, *port;
+
+    setting = config_lookup(config, "listen");
+    if (setting) {
+        len = config_setting_length(setting);
+        for (i = 0; i < len; i++) {
+            addr = config_setting_get_elem(setting, i);
+            if (! (config_setting_lookup_string(addr, "host", &hostname) &&
+                   config_setting_lookup_string(addr, "port", &port))) {
+                fprintf(stderr,
+                            "line %d:Incomplete specification (hostname and port required)\n",
+                            config_setting_source_line(addr));
+                return -1;
+            }
+
+            resolve_split_name(listen, hostname, port);
+
+            /* getaddrinfo returned a list of addresses corresponding to the
+             * specification; move the pointer to the end of that list before
+             * processing the next specification */
+            for (; *listen; listen = &((*listen)->ai_next));
+        }
+    }
+
+    return 0;
+}
+#endif
+
+
+
+#ifdef LIBCONFIG
+static void setup_regex_probe(struct proto *p, config_setting_t* probes)
+{
+    int num_probes, errsize, i, res;
+    char *err;
+    const char * expr;
+    regex_t** probe_list;
+
+    num_probes = config_setting_length(probes);
+    if (!num_probes) {
+        fprintf(stderr, "%s: no probes specified\n", p->description);
+        exit(1);
+    }
+
+    p->probe = get_probe("regex");
+    probe_list = calloc(num_probes + 1, sizeof(*probe_list));
+    p->data = (void*)probe_list;
+
+    for (i = 0; i < num_probes; i++) {
+        probe_list[i] = malloc(sizeof(*(probe_list[i])));
+        expr = config_setting_get_string_elem(probes, i);
+        res = regcomp(probe_list[i], expr, 0);
+        if (res) {
+            err = malloc(errsize = regerror(res, probe_list[i], NULL, 0));
+            regerror(res, probe_list[i], err, errsize);
+            fprintf(stderr, "%s:%s\n", expr, err);
+            free(err);
+            exit(1);
+        }
+    }
+}
+#endif
+
+/* Extract configuration for protocols to connect to.
+ * out: newly-allocated list of protocols
+ */
+#ifdef LIBCONFIG
+static int config_protocols(config_t *config, struct proto **prots)
+{
+    config_setting_t *setting, *prot, *probes;
+    const char *hostname, *port, *name;
+    int i, num_prots;
+    struct proto *p, *prev = NULL;
+
+    setting = config_lookup(config, "protocols");
+    if (setting) {
+        num_prots = config_setting_length(setting);
+        for (i = 0; i < num_prots; i++) {
+            p = calloc(1, sizeof(*p));
+            if (i == 0) *prots = p;
+            if (prev) prev->next = p;
+            prev = p;
+
+            prot = config_setting_get_elem(setting, i);
+            if ((config_setting_lookup_string(prot, "name", &name) &&
+                 config_setting_lookup_string(prot, "host", &hostname) &&
+                 config_setting_lookup_string(prot, "port", &port)
+                )) {
+                p->description = name;
+                config_setting_lookup_string(prot, "service", &(p->service));
+
+                resolve_split_name(&(p->saddr), hostname, port);
+
+
+                probes = config_setting_get_member(prot, "probe");
+                if (probes) {
+                    if (config_setting_is_array(probes)) {
+                        /* If 'probe' is an array, setup a regex probe using the
+                         * array of strings as pattern */
+
+                        setup_regex_probe(p, probes);
+
+                    } else {
+                        /* if 'probe' is 'builtin', set the probe to the
+                         * appropriate builtin protocol */
+                        if (!strcmp(config_setting_get_string(probes), "builtin")) {
+                            p->probe = get_probe(name);
+                            if (!p->probe) {
+                                fprintf(stderr, "%s: no builtin probe for this protocol\n", name);
+                                exit(1);
+                            }
+                        } else {
+                            fprintf(stderr, "%s: illegal probe name\n", name);
+                            exit(1);
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    return 0;
+}
+#endif
+
+/* Parses a config file
+ * in: *filename
+ * out: *listen, a newly-allocated linked list of listen addrinfo
+ *      *prots, a newly-allocated linked list of protocols
+ */
+#ifdef LIBCONFIG
+static int config_parse(char *filename, struct addrinfo **listen, struct proto **prots)
+{
+    config_t config;
+    long int timeout;
+    const char* str;
+
+    config_init(&config);
+    if (config_read_file(&config, filename) == CONFIG_FALSE) {
+        fprintf(stderr, "%s:%d:%s\n", 
+                    filename,
+                    config_error_line(&config),
+                    config_error_text(&config));
+        exit(1);
+    }
+
+    config_lookup_bool(&config, "verbose", &verbose);
+    config_lookup_bool(&config, "inetd", &inetd);
+    config_lookup_bool(&config, "foreground", &foreground);
+    config_lookup_bool(&config, "numeric", &numeric);
+
+    if (config_lookup_int(&config, "timeout", &timeout) == CONFIG_TRUE) {
+        probing_timeout = timeout;
+    }
+
+    if (config_lookup_string(&config, "on-timeout", &str)) {
+        set_ontimeout(str);
+    }
+
+    config_lookup_string(&config, "user", &user_name);
+    config_lookup_string(&config, "pidfile", &pid_file);
+
+    config_listen(&config, listen);
+    config_protocols(&config, prots);
+
+    return 0;
+}
+#endif
+
+/* Adds protocols to the list of options, so command-line parsing uses the
+ * protocol definition array 
+ * options: array of options to add to; must be big enough
+ * n_opts: number of options in *options before calling (i.e. where to append)
+ * prot: array of protocols
+ * n_prots: number of protocols in *prot
+ * */
+static void append_protocols(struct option *options, int n_opts, struct proto *prot , int n_prots)
+{
+    int o, p;
+
+    for (o = n_opts, p = 0; p < n_prots; o++, p++) {
+        options[o].name = prot[p].description;
+        options[o].has_arg = required_argument;
+        options[o].flag = 0;
+        options[o].val = p + PROT_SHIFT;
+    }
+}
+
+static void make_alloptions(void)
+{
+    builtins = get_builtins();
+
+    /* Create all_options, composed of const_options followed by one option per
+     * known protocol */
+    all_options = calloc(ARRAY_SIZE(const_options) + get_num_builtins(), sizeof(struct option));
     memcpy(all_options, const_options, sizeof(const_options));
-    append_protocols(all_options, ARRAY_SIZE(const_options), protocols, num_known_protocols);
+    append_protocols(all_options, ARRAY_SIZE(const_options) - 1, builtins, get_num_builtins());
+}
 
-    while ((c = getopt_long_only(argc, argv, "t:T:p:VP:", all_options, NULL)) != -1) {
+/* Performs a first scan of command line options to see if a configuration file
+ * is specified. If there is one, parse it now before all other options (so
+ * configuration file settings can be overridden from the command line).
+ *
+ * prots: newly-allocated list of configured protocols, if any.
+ */
+static void cmdline_config(int argc, char* argv[], struct proto** prots)
+{
+#ifdef LIBCONFIG
+    int c, res;
+    char *config_filename;
+#endif
+
+    make_alloptions();
+
+#ifdef LIBCONFIG
+    optind = 1;
+    opterr = 0; /* we're missing protocol options at this stage so don't output errors */
+    while ((c = getopt_long_only(argc, argv, optstr, all_options, NULL)) != -1) {
+        if (c == 'F') {
+            config_filename = optarg;
+            /* find the end of the listen list */
+            res = config_parse(config_filename, &addr_listen, prots);
+            if (res)
+                exit(4);
+            break;
+        }
+    }
+#endif
+}
+
+
+/* Parse command-line options. prots points to a list of configured protocols,
+ * potentially non-allocated */
+static void parse_cmdline(int argc, char* argv[], struct proto* prots)
+{
+    int c;
+    struct addrinfo **a;
+    struct proto *p;
+
+    optind = 1;
+    opterr = 1;
+next_arg:
+    while ((c = getopt_long_only(argc, argv, optstr, all_options, NULL)) != -1) {
         if (c == 0) continue;
 
         if (c >= PROT_SHIFT) {
-            affected++;
-            protocols[c - PROT_SHIFT].affected = 1;
-            resolve_name(&addr, optarg);
-            protocols[c - PROT_SHIFT].saddr= *addr;
+            if (prots)
+                for (p = prots; p && p->next; p = p->next) {
+                    /* override if protocol was already defined by config file 
+                     * (note it only overrides address and use builtin probe) */
+                    if (!strcmp(p->description, builtins[c-PROT_SHIFT].description)) {
+                        resolve_name(&(p->saddr), optarg);
+                        p->probe = builtins[c-PROT_SHIFT].probe;
+                        goto next_arg;
+                    }
+                }
+            /* At this stage, it's a new protocol: add it to the end of the
+             * list */
+            if (!prots) {
+                /* No protocols yet -- create the list */
+                p = prots = calloc(1, sizeof(*p));
+            } else {
+                p->next = calloc(1, sizeof(*p));
+                p = p->next;
+            }
+            memcpy(p, &builtins[c-PROT_SHIFT], sizeof(*p));
+            resolve_name(&(p->saddr), optarg);
             continue;
         }
 
         switch (c) {
 
+        case 'F':
+            /* Legal option, but do nothing, it was already processed in
+             * cmdline_config() */
+#ifndef LIBCONFIG
+            fprintf(stderr, "Built without libconfig support: configuration file not available.\n");
+            exit(1);
+#endif
+            break;
+
         case 't':
-            probing_timeout = atoi(optarg);
+             probing_timeout = atoi(optarg);
+            break;
+
+        case OPT_ONTIMEOUT:
+            set_ontimeout(optarg);
             break;
 
         case 'p':
@@ -126,22 +429,32 @@ void parse_cmdline(int argc, char* argv[])
             pid_file = optarg;
             break;
 
+        case 'v':
+            verbose++;
+            break;
+
         default:
             print_usage();
             exit(2);
         }
     }
 
-    if (!affected) {
+    if (!prots) {
         fprintf(stderr, "At least one target protocol must be specified.\n");
         exit(2);
     }
 
+    set_protocol_list(prots);
+
     if (!addr_listen) {
         fprintf(stderr, "No listening address specified; use at least one -p option\n");
         exit(1);
     }
 
+    /* Did command-line override foreground setting? */
+    if (background)
+        foreground = 0;
+
 }
 
 int main(int argc, char *argv[])
@@ -150,15 +463,16 @@ int main(int argc, char *argv[])
    extern char *optarg;
    extern int optind;
    int res, num_addr_listen;
+   struct proto* protocols = NULL;
 
    int *listen_sockets;
 
    /* Init defaults */
    pid_file = NULL;
    user_name = NULL;
-   foreground = 0;
 
-   parse_cmdline(argc, argv);
+   cmdline_config(argc, argv, &protocols);
+   parse_cmdline(argc, argv, protocols);
 
    if (inetd)
    {
@@ -184,12 +498,12 @@ int main(int argc, char *argv[])
 
    setup_signals();
 
-   if (user_name)
-       drop_privileges(user_name);
-
    if (pid_file)
        write_pid_file(pid_file);
 
+   if (user_name)
+       drop_privileges(user_name);
+
    /* Open syslog connection */
    setup_syslog(argv[0]);
 

sslh-select.c

@@ -1,5 +1,5 @@
 /*
-   sslh: a SSL/SSH multiplexer
+   sslh-select: mono-processus server
 
 # Copyright (C) 2007-2010  Yves Rutschle
 # 
@@ -23,6 +23,7 @@
 #define __LINUX__
 
 #include "common.h"
+#include "probe.h"
 
 const char* server_type = "sslh-select";
 
@@ -71,6 +72,16 @@ int tidy_connection(struct connection *cnx, fd_set *fds, fd_set *fds2)
     return 0;
 }
 
+/* if fd becomes higher than FD_SETSIZE, things won't work so well with FD_SET
+ * and FD_CLR. Need to drop connections if we go above that limit */
+int fd_is_in_range(int fd) {
+    if (fd >= FD_SETSIZE) {
+        log_message(LOG_ERR, "too many open file descriptor to monitor them all -- dropping connection\n");
+        return 0;
+    }
+    return 1;
+}
+
 /* Accepts a connection from the main socket and assigns it to an empty slot.
  * If no slots are available, allocate another few. If that fails, drop the
  * connexion */
@@ -82,6 +93,9 @@ int accept_new_connection(int listen_socket, struct connection *cnx[], int* cnx_
     in_socket = accept(listen_socket, 0, 0);
     CHECK_RES_RETURN(in_socket, "accept");
 
+    if (!fd_is_in_range(in_socket))
+        return -1;
+
     res = set_nonblock(in_socket);
     if (res == -1) return -1;
 
@@ -116,13 +130,13 @@ int accept_new_connection(int listen_socket, struct connection *cnx[], int* cnx_
 
 /* Connect queue 1 of connection to SSL; returns new file descriptor */
 int connect_queue(struct connection *cnx, struct addrinfo *addr, 
-                  char* cnx_name,
+                  const char* cnx_name,
                   fd_set *fds_r, fd_set *fds_w)
 {
     struct queue *q = &cnx->q[1];
 
-    q->fd = connect_addr(addr, cnx_name);
-    if (q->fd != -1) {
+    q->fd = connect_addr(addr, cnx->q[0].fd, cnx_name);
+    if ((q->fd != -1) && fd_is_in_range(q->fd)) {
         log_connection(cnx);
         set_nonblock(q->fd);
         flush_defered(q);
@@ -196,7 +210,7 @@ void main_loop(int listen_sockets[], int num_addr_listen)
     struct timeval tv;
     int max_fd, in_socket, i, j, res;
     struct connection *cnx;
-    T_PROTO_ID prot;
+    struct proto *prot;
     int num_cnx;  /* Number of connections in *cnx */
     int num_probing = 0; /* Number of connections currently probing 
                           * We use this to know if we need to time out of
@@ -237,7 +251,8 @@ void main_loop(int listen_sockets[], int num_addr_listen)
         for (i = 0; i < num_addr_listen; i++) {
             if (FD_ISSET(listen_sockets[i], &readfds)) {
                 in_socket = accept_new_connection(listen_sockets[i], &cnx, &num_cnx);
-                num_probing++;
+                if (in_socket != -1)
+                    num_probing++;
 
                 if (in_socket > 0) {
                     FD_SET(in_socket, &fds_r);
@@ -259,12 +274,13 @@ void main_loop(int listen_sockets[], int num_addr_listen)
                             tidy_connection(&cnx[i], &fds_r, &fds_w);
                             if (verbose)
                                 fprintf(stderr, "closed slot %d\n", i);
-                        }
-                        /* If no defered data is left, stop monitoring the fd 
-                         * for write, and restart monitoring the other one for reads*/
-                        if (!cnx[i].q[j].defered_data_size) {
-                            FD_CLR(cnx[i].q[j].fd, &fds_w);
-                            FD_SET(cnx[i].q[1-j].fd, &fds_r);
+                        } else {
+                            /* If no defered data is left, stop monitoring the fd 
+                             * for write, and restart monitoring the other one for reads*/
+                            if (!cnx[i].q[j].defered_data_size) {
+                                FD_CLR(cnx[i].q[j].fd, &fds_w);
+                                FD_SET(cnx[i].q[1-j].fd, &fds_r);
+                            }
                         }
                     }
                 }
@@ -293,20 +309,20 @@ void main_loop(int listen_sockets[], int num_addr_listen)
                         /* If timed out it's SSH, otherwise the client sent
                          * data so probe the protocol */
                         if ((cnx[i].probe_timeout < time(NULL))) {
-                            prot = 0;
+                            prot = timeout_protocol();
                         } else {
                             prot = probe_client_protocol(&cnx[i]);
                         }
 
                         /* libwrap check if required for this protocol */
-                        if (protocols[prot].service && 
-                            check_access_rights(in_socket, protocols[prot].service)) {
+                        if (prot->service && 
+                            check_access_rights(in_socket, prot->service)) {
                             tidy_connection(&cnx[i], &fds_r, &fds_w);
                             res = -1;
                         } else {
                             res = connect_queue(&cnx[i], 
-                                                &protocols[prot].saddr, 
-                                                protocols[prot].description, 
+                                                prot->saddr, 
+                                                prot->description, 
                                                 &fds_r, &fds_w);
                         }
 

sslh.pod

@@ -2,59 +2,75 @@
 
 =head1 NAME
 
- sslh - ssl/ssh multiplexer
+ sslh - protocol demultiplexer
 
 =head1 SYNOPSIS
 
-sslh [ B<-t> I<num> ] [B<-p> I<listening address> [B<-p> I<listening address> ...] [B<--ssl> I<target address for SSL>] [B<--ssh> I<target address for SSH>] [B<--openvpn> I<target address for OpenVPN>] [B<--http> I<target address for HTTP>] [B<-u> I<username>] [B<-P> I<pidfile>] [-v] [-i] [-V] [-f] [-n]
+sslh [B<-F> I<config file>] [ B<-t> I<num> ] [B<-p> I<listening address> [B<-p> I<listening address> ...] [B<--ssl> I<target address for SSL>] [B<--ssh> I<target address for SSH>] [B<--openvpn> I<target address for OpenVPN>] [B<--http> I<target address for HTTP>] [B<--anyprot> I<default target address>] [B<--on-timeout> I<protocol name>] [B<-u> I<username>] [B<-P> I<pidfile>] [-v] [-i] [-V] [-f] [-n]
 
 =head1 DESCRIPTION
 
-B<sslh> accepts HTTP, HTTPS, SSH, OpenVPN, tinc and XMPP
-connections on the same port. This makes it possible to
-connect to any of these servers on port 443 (e.g. from
-inside a corporate firewall, which almost never block port
-443) while still serving HTTPS on that port. 
+B<sslh> accepts connections on specified ports, and forwards
+them further based on tests performed on the first data
+packet sent by the remote client.
 
+Probes for HTTP, SSL, SSH, OpenVPN, tinc, XMPP are
+implemented, and any other protocol that can be tested using
+a regular expression, can be recognised. A typical use case
+is to allow serving several services on port 443 (e.g. to
+connect to ssh from inside a corporate firewall, which
+almost never block port 443) while still serving HTTPS on
+that port. 
 
-The idea is to have B<sslh> listen to the external 443 port,
-accept the incoming connections, work out what type of
-connection it is, and then fordward to the appropriate
-server.
-
-=head2 Protocol detection
-
-The protocol detection is made based on the first bytes sent
-by the client: SSH connections start by identifying each
-other's versions using clear text "SSH-2.0" strings (or
-equivalent version strings). This is defined in RFC4253,
-4.2. Meanwhile, OpenVPN clients start with 0x00 0x0D 0x38,
-tinc clients start with "0 ", and XMPP client start with a
-packet containing "jabber".
-
-Additionally, two kind of SSH clients exist: the client
-waits for the server to send its version string ("Shy"
-client, which is the case of OpenSSH and Putty), or the
-client sends its version first ("Bold" client, which is the
-case of Bitvise Tunnelier and ConnectBot). 
-
-B<sslh> waits for some time for the incoming connection to
-send data. If it stays quiet after the timeout period, it is
-assumed to be a shy SSH client, and is connected to the SSH
-server. Otherwise, B<sslh> reads the first packet the client
-provides, and connects it to the SSH server if it starts
-with "SSH-", or connects it to the SSL server otherwise.
+Hence B<sslh> acts as a protocol demultiplexer, or a
+switchboard. Its name comes from its original function to
+serve SSH and HTTPS on the same port.
 
 =head2 Libwrap support
 
-One drawback of B<sslh> is that the B<ssh> and B<httpd>
-servers do not see the original IP address of the client
-anymore, as the connection is forwarded through B<sslh>.
-B<sslh> provides enough logging to circumvent that problem.
-However it is common to limit access to B<ssh> using
-B<libwrap> or B<tcpd>. For this reason, B<sslh> can be
-compiled to check SSH accesses against SSH access lists as
-defined in F</etc/hosts.allow> and F</etc/hosts.deny>.
+One drawback of B<sslh> is that the servers do not see the
+original IP address of the client anymore, as the connection
+is forwarded through B<sslh>.
+
+For this reason, B<sslh> can be compiled with B<libwrap> to
+check accesses defined in F</etc/hosts.allow> and
+F</etc/hosts.deny>.  Libwrap services can be defined using
+the configuration file.
+
+=head2 Configuration file
+
+A configuration file can be supplied to B<sslh>. Command
+line arguments override file settings. B<sslh> uses
+B<libconfig> to parse the configuration file, so the general
+file format is indicated in
+L<http://www.hyperrealm.com/libconfig/libconfig_manual.html>.
+Please refer to the example configuration file provided with
+B<sslh> for the specific format (Options have the same names
+as on the command line, except for the list of listen ports
+and the list of protocols).
+
+The configuration file makes it possible to specify
+protocols using regular expressions: a list of regular
+expressions is given as the I<probe> parameter, and if the
+first packet received from the client matches any of these
+expressions, B<sslh> connects to that protocol.
+
+Alternatively, the I<probe> parameter can be set to
+"builtin", to use the compiled probes which are much faster
+than regular expressions.
+
+=head2 Probing protocols
+
+When receiving an incoming connection, B<sslh> will read the
+first bytes sent be the connecting client. It will then
+probe for the protocol in the order specified on the command
+line (or the configuration file). Therefore B<--anyprot>
+should alway be used last, as it always succeeds and further
+protocols will never be tried.
+
+If no data is sent by the client, B<sslh> will eventually
+time out and connect to the protocol specified with
+B<--on-timeout>, or I<ssh> if none is specified.
 
 =head1 OPTIONS
 
@@ -62,8 +78,13 @@ defined in F</etc/hosts.allow> and F</etc/hosts.deny>.
 
 =item B<-t> I<num>, B<--timeout> I<num>
 
-Timeout before a connection is considered to be SSH. Default
-is 2s.
+Timeout before forwarding the connection to the timeout
+protocol (which should usually be SSH). Default is 2s.
+
+=item B<--on-timeout> I<protocol name>
+
+Name of the protocol to connect to after the timeout period
+is over. Default is 'ssh'.
 
 =item B<-p> I<listening address>, B<--listen> I<listening address>
 
@@ -75,6 +96,7 @@ This can be specified several times to bind B<sslh> to
 several addresses.
 
 =item B<--ssl> I<target address>
+=item B<--tls> I<target address>
 
 Interface and port on which to forward SSL connection,
 typically I<localhost:443>.
@@ -83,6 +105,11 @@ Note that you can set B<sslh> to listen on I<ext_ip:443> and
 B<httpd> to listen on I<localhost:443>: this allows clients
 inside your network to just connect directly to B<httpd>.
 
+Also, B<sslh> probes for SSLv3 (or TLSv1) handshake and will
+reject connections from clients requesting SSLv2. This is
+compliant to RFC6176 which prohibits the usage of SSLv2. If
+you wish to accept SSLv2, use B<--default> instead.
+
 =item B<--ssh> I<target address>
 
 Interface and port on which to forward SSH connections,
@@ -98,6 +125,11 @@ typically I<localhost:1194>.
 Interface and port on which to forward XMPP connections,
 typically I<localhost:5222>.
 
+=item B<--http> I<target address>
+
+Interface and port on which to forward HTTP connections,
+typically I<localhost:80>.
+
 =item B<--tinc> I<target address>
 
 Interface and port on which to forward tinc connections,
@@ -106,6 +138,14 @@ typically I<localhost:655>.
 This is experimental. If you use this feature, please report
 the results (even if it works!)
 
+=item B<--anyprot> I<target address>
+
+Interface and port on which to forward if no other protocol
+has been found. Because B<sslh> tries protocols in the order
+specified on the command line, this should be specified
+last. If no default is specified, B<sslh> will forward
+unknown protocols to the first protocol specified.
+
 =item B<-v>, B<--verbose>
 
 Increase verboseness.
@@ -125,7 +165,7 @@ Prints B<sslh> version.
 
 Requires to run under the specified username. 
 
-=item B<-P> I<pidfile>, B<--pid-file> I<pidfile>
+=item B<-P> I<pidfile>, B<--pidfile> I<pidfile>
 
 Specifies a file in which to write the PID of the main
 server.
@@ -141,6 +181,13 @@ Runs in foreground. The server will not fork and will remain connected
 to the terminal. Messages normally sent to B<syslog> will also be sent
 to I<stderr>.
 
+=item B<--background>
+
+Runs in background. This overrides B<foreground> if set in
+the configuration file (or on the command line, but there is
+no point setting both on the command line unless you have a
+personality disorder).
+
 =back
 
 =head1 FILES
@@ -165,7 +212,7 @@ detailed explanation of the variables used by B<sslh>.
 
 Last version available from
 L<http://www.rutschle.net/tech/sslh>, and can be tracked
-from L<http://freshmeat.net/projects/sslh/>.
+from L<http://freecode.com/projects/sslh>.
 
 =head1 AUTHOR
 

t

@@ -20,8 +20,8 @@ my $SSH_SHY_CNX =       1;
 my $SSH_BOLD_CNX =      1;
 my $SSL_MIX_SSH =       1;
 my $SSH_MIX_SSL =       1;
-my $BIG_MSG =           1;
-my $STALL_CNX =         1;
+my $BIG_MSG =           0; # This test is unreliable
+my $STALL_CNX =         0; # This test needs fixing
 
 # Robustness tests. These are mostly to achieve full test
 # coverage, but do not necessarily result in an actual test
@@ -55,8 +55,10 @@ for my $binary (@binaries) {
     my $sslh_pid;
     if (!($sslh_pid = fork)) {
         my $user = (getpwuid $<)[0]; # Run under current username
-        exec "./$binary -v -f -u $user --listen localhost:$sslh_port --ssh $ssh_address --ssl $ssl_address -P $pidfile";
-        #exec "valgrind --leak-check=full ./sslh-select -v -f -u $user --listen localhost:$sslh_port --ssh $ssh_address -ssl $ssl_address -P $pidfile";
+        my $cmd = "./$binary -v -f -u $user --listen localhost:$sslh_port --ssh $ssh_address --ssl $ssl_address -P $pidfile";
+        warn "$cmd\n";
+        #exec $cmd;
+        exec "valgrind --leak-check=full ./sslh-select -v -f -u $user --listen localhost:$sslh_port --ssh $ssh_address -ssl $ssl_address -P $pidfile";
         exit 0;
     }
     warn "spawned $sslh_pid\n";
@@ -64,6 +66,8 @@ for my $binary (@binaries) {
 
 
     my $test_data = "hello world\n";
+#    my $ssl_test_data = (pack 'n', ((length $test_data) + 2)) .  $test_data;
+    my $ssl_test_data = "\x16\x03\x03$test_data\n";
 
 # Test: SSL connection
     if ($SSL_CNX) {
@@ -71,9 +75,10 @@ for my $binary (@binaries) {
         my $cnx_l = new IO::Socket::INET(PeerHost => "localhost:$sslh_port");
         warn "$!\n" unless $cnx_l;
         if (defined $cnx_l) {
-            print $cnx_l $test_data;
-            my $data = <$cnx_l>;
-            is($data, "ssl: $test_data", "SSL connection");
+            print $cnx_l $ssl_test_data;
+            my $data;
+            my $n = sysread $cnx_l, $data, 1024;
+            is($data, "ssl: $ssl_test_data", "SSL connection");
         }
     }
 
@@ -109,7 +114,7 @@ for my $binary (@binaries) {
         my $cnx_l = new IO::Socket::INET(PeerHost => "localhost:$sslh_port");
         warn "$!\n" unless $cnx_l;
         if (defined $cnx_l) {
-            print $cnx_l $test_data;
+            print $cnx_l $ssl_test_data;
             my $cnx_h= new IO::Socket::INET(PeerHost => "localhost:$sslh_port");
             warn "$!\n" unless $cnx_h;
             if (defined $cnx_h) {
@@ -118,8 +123,9 @@ for my $binary (@binaries) {
                 my $data_h = <$cnx_h>;
                 is($data_h, "ssh: $test_data", "SSH during SSL being established");
             }
-            my $data = <$cnx_l>;
-            is($data, "ssl: $test_data", "SSL connection interrupted by SSH");
+            my $data;
+            my $n = sysread $cnx_l, $data, 1024;
+            is($data, "ssl: $ssl_test_data", "SSL connection interrupted by SSH");
         }
     }
 
@@ -133,9 +139,10 @@ for my $binary (@binaries) {
             my $cnx_l = new IO::Socket::INET(PeerHost => "localhost:$sslh_port");
             warn "$!\n" unless $cnx_l;
             if (defined $cnx_l) {
-                print $cnx_l $test_data;
-                my $data = <$cnx_l>;
-                is($data, "ssl: $test_data", "SSL during SSH being established");
+                print $cnx_l $ssl_test_data;
+                my $data;
+                my $n = sysread $cnx_l, $data, 1024;
+                is($data, "ssl: $ssl_test_data", "SSL during SSH being established");
             }
             print $cnx_h $test_data;
             my $data = <$cnx_h>;
@@ -149,19 +156,24 @@ for my $binary (@binaries) {
         print "***Test: big message\n";
         my $cnx_l = new IO::Socket::INET(PeerHost => "localhost:$sslh_port");
         warn "$!\n" unless $cnx_l;
-        my $test_data2 = "helloworld";
-        my $rept = 10000;
+        my $rept = 1000;
+        my $test_data2 = $ssl_test_data . ("helloworld"x$rept);
         if (defined $cnx_l) {
-            print $cnx_l ($test_data2 x $rept);
-            print $cnx_l "\n";
-            my $data = <$cnx_l>;
-            is($data, "ssl: ". ($test_data2 x $rept) . "\n", "Big message");
+            my $n = syswrite $cnx_l, $test_data2;
+            my ($data);
+            $n = sysread $cnx_l, $data, 1 << 20;
+            is($data, "ssl: ". $test_data2, "Big message");
         }
     }
 
 # Test: Stalled connection
 # Create two connections, stall one, check the other one
 # works, unstall first and check it works fine
+# This test needs fixing.
+# Now that echosrv no longer works on "lines" (finishing
+# with '\n'), it may cut blocks randomly with prefixes.
+# The whole thing needs to be re-thought as it'll only
+# work by chance.
     if ($STALL_CNX) {
         print "***Test: Stalled connection\n";
         my $cnx_1 = new IO::Socket::INET(PeerHost => "localhost:$sslh_port");
@@ -169,20 +181,21 @@ for my $binary (@binaries) {
         my $cnx_2 = new IO::Socket::INET(PeerHost => "localhost:$sslh_port");
         warn "$!\n" unless defined $cnx_2;
         my $test_data2 = "helloworld";
-        my $rept = 10000;
+        sleep 4;
+        my $rept = 1000;
         if (defined $cnx_1 and defined $cnx_2) {
             print $cnx_1 ($test_data2 x $rept);
             print $cnx_1 "\n";
             print $cnx_2 ($test_data2 x $rept);
             print $cnx_2 "\n";
             my $data = <$cnx_2>;
-            is($data, "ssl: " . ($test_data2 x $rept) . "\n", "Stalled connection (1)");
+            is($data, "ssh: " . ($test_data2 x $rept) . "\n", "Stalled connection (1)");
             print $cnx_2 ($test_data2 x $rept);
             print $cnx_2 "\n";
             $data = <$cnx_2>;
-            is($data, "ssl: " . ($test_data2 x $rept) . "\n", "Stalled connection (2)");
+            is($data, "ssh: " . ($test_data2 x $rept) . "\n", "Stalled connection (2)");
             $data = <$cnx_1>;
-            is($data, "ssl: " . ($test_data2 x $rept) . "\n", "Stalled connection (3)");
+            is($data, "ssh: " . ($test_data2 x $rept) . "\n", "Stalled connection (3)");
 
         }
     }

t_load

@@ -27,7 +27,7 @@ my $NUM_CNX = 30;
 # you start 200 processes in under a second, things go wrong
 # and it's not sslh's fault (typically the echosrv won't be
 # forking fast enough).
-my $start_time_delay = 0.5;
+my $start_time_delay = 1;
 
 # If you test 4 protocols, you'll start $NUM_CNX * 4 clients
 # (e.g. 40), starting one every $start_time_delay seconds.