v1.20

Fix incorrect strncmp length in HTTP method probing

.gitignore

@@ -0,0 +1,10 @@
+*.swp
+*.swo
+*.o
+cscope.*
+echosrv
+sslh-fork
+sslh-select
+sslh.8.gz
+tags
+version.h

COPYING

@@ -0,0 +1,339 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 2, June 1991
+
+ Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
+ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+License is intended to guarantee your freedom to share and change free
+software--to make sure the software is free for all its users.  This
+General Public License applies to most of the Free Software
+Foundation's software and to any other program whose authors commit to
+using it.  (Some other Free Software Foundation software is covered by
+the GNU Lesser General Public License instead.)  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+this service if you wish), that you receive source code or can get it
+if you want it, that you can change the software or use pieces of it
+in new free programs; and that you know you can do these things.
+
+  To protect your rights, we need to make restrictions that forbid
+anyone to deny you these rights or to ask you to surrender the rights.
+These restrictions translate to certain responsibilities for you if you
+distribute copies of the software, or if you modify it.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must give the recipients all the rights that
+you have.  You must make sure that they, too, receive or can get the
+source code.  And you must show them these terms so they know their
+rights.
+
+  We protect your rights with two steps: (1) copyright the software, and
+(2) offer you this license which gives you legal permission to copy,
+distribute and/or modify the software.
+
+  Also, for each author's protection and ours, we want to make certain
+that everyone understands that there is no warranty for this free
+software.  If the software is modified by someone else and passed on, we
+want its recipients to know that what they have is not the original, so
+that any problems introduced by others will not reflect on the original
+authors' reputations.
+
+  Finally, any free program is threatened constantly by software
+patents.  We wish to avoid the danger that redistributors of a free
+program will individually obtain patent licenses, in effect making the
+program proprietary.  To prevent this, we have made it clear that any
+patent must be licensed for everyone's free use or not licensed at all.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                    GNU GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License applies to any program or other work which contains
+a notice placed by the copyright holder saying it may be distributed
+under the terms of this General Public License.  The "Program", below,
+refers to any such program or work, and a "work based on the Program"
+means either the Program or any derivative work under copyright law:
+that is to say, a work containing the Program or a portion of it,
+either verbatim or with modifications and/or translated into another
+language.  (Hereinafter, translation is included without limitation in
+the term "modification".)  Each licensee is addressed as "you".
+
+Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running the Program is not restricted, and the output from the Program
+is covered only if its contents constitute a work based on the
+Program (independent of having been made by running the Program).
+Whether that is true depends on what the Program does.
+
+  1. You may copy and distribute verbatim copies of the Program's
+source code as you receive it, in any medium, provided that you
+conspicuously and appropriately publish on each copy an appropriate
+copyright notice and disclaimer of warranty; keep intact all the
+notices that refer to this License and to the absence of any warranty;
+and give any other recipients of the Program a copy of this License
+along with the Program.
+
+You may charge a fee for the physical act of transferring a copy, and
+you may at your option offer warranty protection in exchange for a fee.
+
+  2. You may modify your copy or copies of the Program or any portion
+of it, thus forming a work based on the Program, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) You must cause the modified files to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    b) You must cause any work that you distribute or publish, that in
+    whole or in part contains or is derived from the Program or any
+    part thereof, to be licensed as a whole at no charge to all third
+    parties under the terms of this License.
+
+    c) If the modified program normally reads commands interactively
+    when run, you must cause it, when started running for such
+    interactive use in the most ordinary way, to print or display an
+    announcement including an appropriate copyright notice and a
+    notice that there is no warranty (or else, saying that you provide
+    a warranty) and that users may redistribute the program under
+    these conditions, and telling the user how to view a copy of this
+    License.  (Exception: if the Program itself is interactive but
+    does not normally print such an announcement, your work based on
+    the Program is not required to print an announcement.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Program,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Program, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Program.
+
+In addition, mere aggregation of another work not based on the Program
+with the Program (or with a work based on the Program) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may copy and distribute the Program (or a work based on it,
+under Section 2) in object code or executable form under the terms of
+Sections 1 and 2 above provided that you also do one of the following:
+
+    a) Accompany it with the complete corresponding machine-readable
+    source code, which must be distributed under the terms of Sections
+    1 and 2 above on a medium customarily used for software interchange; or,
+
+    b) Accompany it with a written offer, valid for at least three
+    years, to give any third party, for a charge no more than your
+    cost of physically performing source distribution, a complete
+    machine-readable copy of the corresponding source code, to be
+    distributed under the terms of Sections 1 and 2 above on a medium
+    customarily used for software interchange; or,
+
+    c) Accompany it with the information you received as to the offer
+    to distribute corresponding source code.  (This alternative is
+    allowed only for noncommercial distribution and only if you
+    received the program in object code or executable form with such
+    an offer, in accord with Subsection b above.)
+
+The source code for a work means the preferred form of the work for
+making modifications to it.  For an executable work, complete source
+code means all the source code for all modules it contains, plus any
+associated interface definition files, plus the scripts used to
+control compilation and installation of the executable.  However, as a
+special exception, the source code distributed need not include
+anything that is normally distributed (in either source or binary
+form) with the major components (compiler, kernel, and so on) of the
+operating system on which the executable runs, unless that component
+itself accompanies the executable.
+
+If distribution of executable or object code is made by offering
+access to copy from a designated place, then offering equivalent
+access to copy the source code from the same place counts as
+distribution of the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  4. You may not copy, modify, sublicense, or distribute the Program
+except as expressly provided under this License.  Any attempt
+otherwise to copy, modify, sublicense or distribute the Program is
+void, and will automatically terminate your rights under this License.
+However, parties who have received copies, or rights, from you under
+this License will not have their licenses terminated so long as such
+parties remain in full compliance.
+
+  5. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Program or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Program (or any work based on the
+Program), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Program or works based on it.
+
+  6. Each time you redistribute the Program (or any work based on the
+Program), the recipient automatically receives a license from the
+original licensor to copy, distribute or modify the Program subject to
+these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties to
+this License.
+
+  7. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Program at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Program by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Program.
+
+If any portion of this section is held invalid or unenforceable under
+any particular circumstance, the balance of the section is intended to
+apply and the section as a whole is intended to apply in other
+circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system, which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  8. If the distribution and/or use of the Program is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Program under this License
+may add an explicit geographical distribution limitation excluding
+those countries, so that distribution is permitted only in or among
+countries not thus excluded.  In such case, this License incorporates
+the limitation as if written in the body of this License.
+
+  9. The Free Software Foundation may publish revised and/or new versions
+of the General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Program
+specifies a version number of this License which applies to it and "any
+later version", you have the option of following the terms and conditions
+either of that version or of any later version published by the Free
+Software Foundation.  If the Program does not specify a version number of
+this License, you may choose any version ever published by the Free Software
+Foundation.
+
+  10. If you wish to incorporate parts of the Program into other free
+programs whose distribution conditions are different, write to the author
+to ask for permission.  For software which is copyrighted by the Free
+Software Foundation, write to the Free Software Foundation; we sometimes
+make exceptions for this.  Our decision will be guided by the two goals
+of preserving the free status of all derivatives of our free software and
+of promoting the sharing and reuse of software generally.
+
+                            NO WARRANTY
+
+  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
+FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
+OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
+PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
+OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
+TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
+PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
+REPAIR OR CORRECTION.
+
+  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
+REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
+OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
+TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
+YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
+PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License along
+    with this program; if not, write to the Free Software Foundation, Inc.,
+    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+Also add information on how to contact you by electronic and paper mail.
+
+If the program is interactive, make it output a short notice like this
+when it starts in an interactive mode:
+
+    Gnomovision version 69, Copyright (C) year name of author
+    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, the commands you use may
+be called something other than `show w' and `show c'; they could even be
+mouse-clicks or menu items--whatever suits your program.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the program, if
+necessary.  Here is a sample; alter the names:
+
+  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
+  `Gnomovision' (which makes passes at compilers) written by James Hacker.
+
+  <signature of Ty Coon>, 1 April 1989
+  Ty Coon, President of Vice
+
+This General Public License does not permit incorporating your program into
+proprietary programs.  If your program is a subroutine library, you may
+consider it more useful to permit linking proprietary applications with the
+library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.

ChangeLog

@@ -1,3 +1,164 @@
+v1.20: 20NOV2018
+	Added support for socks5 protocol (Eugene Protozanov)
+
+	New probing method:
+	Before, probes were tried in order, repeating on the
+	same probe as long it returned PROBE_AGAIN before
+	moving to the next one. This means a probe which
+	requires a lot of data (i.e. returne PROBE_AGAIN for
+	a long time) could prevent sucessful matches from 
+	subsequent probes. The configuration file needed to
+	take that into account.
+
+	Now, all probes are tried each time new data is
+	found. If any probe matches, use it. If at least one
+	probe requires more data, wait for more. If all
+	probes failed, connect to the last one. So the only
+	thing to know when writing the configuration file is
+	that 'anyprot' needs to be last.
+
+	Test suite heavily refactored; `t` uses `test.cfg`
+	to decide which probes to test and all setup is
+	automatic; probes get tested with 'fast' (entire
+	first message in one packet) and 'slow' (one byte at
+	a time); when SNI/ALPN are defined, all combinations
+	are tested.
+
+	Old 'tls' probe removed, 'sni_alpn' probe renamed as 'tls'.
+	You'll need to change 'sni_alpn' to 'tls' in
+	your configuration file, if ever you used it.
+
+v1.19: 20JAN2018
+	Added 'syslog_facility' configuration option to
+	specify where to log.
+
+	TLS now supports SNI and ALPN (Travis Burtrum),
+	including support for Let's Encrypt challenges
+	(Jonathan McCrohan)
+
+	ADB probe. (Mike Frysinger)
+
+	Added per-protocol 'fork' option. (Oleg Oshmyan)
+
+	Added chroot option. (Mike Frysinger)
+
+	A truckload of bug fixes and documentation
+	improvements (Various contributors)
+
+v1.18:	29MAR2016
+	Added USELIBPCRE to make use of regex engine
+	optional.
+
+	Added support for RFC4366 SNI and RFC7301 ALPN
+	(Travis Burtrum)
+
+	Changed connection log to include the name of the probe that
+	triggered.
+
+	Changed configuration file format: 'probe' field is
+	no longer required, 'name' field can now contain
+	'tls' or 'regex', with corresponding options (see
+	example.cfg)
+	Added 'log_level' option to each protocol, which
+	allows to turn off generation of log at each
+	connection.
+	Added 'keepalive' option.
+
+v1.17: 	09MAR2015
+	Support RFC5952-style IPv6 addresses, e.g. [::]:443.
+
+	Transparant proxy support for FreeBSD.
+	(Ruben van Staveren)
+
+	Using -F with no argument will try
+	/etc/sslh/sslh.cfg and then /etc/sslh.cfg as
+	configuration files. (argument to -F can no longer
+	be separated from the option by a space, e.g. must
+	be -Ffoo.cfg)
+
+	Call setgroups() before setgid() (fixes potential
+	privilege escalation).
+	(Lars Vogdt)
+
+	Use portable way of getting modified time for OSX
+	support.
+	(Aaron Madlon-Kay)
+
+	Example configuration for fail2ban.
+	(Every Mouw)
+
+v1.16:	11FEB2014
+	Probes made more resilient, to incoming data
+	containing NULLs. Also made them behave properly
+	when receiving too short packets to probe on the
+	first incoming packet.
+	(Ondrej Kuzník)
+
+	Libcap support: Keep only CAP_NET_ADMIN if started
+	as root with transparent proxying and dropping
+	priviledges (enable USELIBCAP in Makefile). This
+	avoids having to mess with filesystem capabilities.
+	(Sebastian Schmidt/yath)
+
+	Fixed bugs related to getpeername that would cause
+	sslh to quit erroneously (getpeername can return
+	actual errors if connections are dropped before
+	getting to getpeername).
+
+	Set IP_FREEDBIND if available to bind to addresses
+	that don't yet exist.
+
+v1.15:	27JUL2013
+	Added --transparent option for transparent proxying.
+	See README for iptables magic and capability
+	management.
+
+	Fixed bug in sslh-select: if number of opened file
+	descriptor became bigger than FD_SETSIZE, bad things
+	would happen.
+
+	Fixed bug in sslh-select: if socket dropped while
+	deferred_data was present, sslh-select would crash.
+
+	Increased FD_SETSIZE for Cygwin, as the default 64
+	is too low for even moderate load.
+
+v1.14: 21DEC2012
+	Corrected OpenVPN probe to support pre-shared secret
+	mode (OpenVPN port-sharing code is... wrong). Thanks
+	to Kai Ellinger for help in investigating and
+	testing.
+
+	Added an actual TLS/SSL probe.
+
+	Added configurable --on-timeout protocol
+	specification.
+
+	Added a --anyprot protocol probe (equivalent to what
+	--ssl was).
+
+	Makefile respects the user's compiler and CFLAG
+	choices (falling back to the current values if
+	undefined), as well as LDFLAGS. 
+	(Michael Palimaka)
+
+	Added "After" and "KillMode" to systemd.sslh.service
+	(Thomas Weißschuh).
+
+	Added LSB tags to etc.init.d.sslh
+	(Thomas Varis).
+
+v1.13: 18MAY2012
+	Write PID file before dropping privileges.
+
+	Added --background, which overrides 'foreground'
+	configuration file setting.
+
+	Added example systemd service file from Archlinux in
+	scripts/
+	https://projects.archlinux.org/svntogit/community.git/tree/trunk/sslh.service?h=packages/sslh
+	(Sébastien Luttringer)
+
 v1.12: 08MAY2012
 	Added support for configuration file.
 

Makefile

@@ -1,10 +1,16 @@
 # Configuration
 
-VERSION="v1.12"
+VERSION=$(shell ./genver.sh -r)
+ENABLE_REGEX=1  # Enable regex probes
 USELIBCONFIG=1	# Use libconfig? (necessary to use configuration files)
-USELIBWRAP=	# Use libwrap?
+USELIBPCRE=1	# Use libpcre? (needed for regex on musl)
+USELIBWRAP?=	# Use libwrap?
+USELIBCAP=	# Use libcap?
+USESYSTEMD=     # Make use of systemd socket activation
 COV_TEST= 	# Perform test coverage?
-PREFIX=/usr/local
+PREFIX?=/usr
+BINDIR?=$(PREFIX)/sbin
+MANDIR?=$(PREFIX)/share/man/man8
 
 MAN=sslh.8.gz	# man page name
 
@@ -15,66 +21,108 @@ ifneq ($(strip $(COV_TEST)),)
     CFLAGS_COV=-fprofile-arcs -ftest-coverage
 endif
 
-CC = gcc
+CC ?= gcc
-CFLAGS=-Wall -g $(CFLAGS_COV)
+CFLAGS ?=-Wall -g $(CFLAGS_COV)
 
 LIBS=
-OBJS=common.o sslh-main.o probe.o
+OBJS=common.o sslh-main.o probe.o tls.o
+
+CONDITIONAL_TARGETS=
 
 ifneq ($(strip $(USELIBWRAP)),)
 	LIBS:=$(LIBS) -lwrap
-	CFLAGS:=$(CFLAGS) -DLIBWRAP
+	CPPFLAGS+=-DLIBWRAP
+endif
+
+ifneq ($(strip $(ENABLE_REGEX)),)
+	CPPFLAGS+=-DENABLE_REGEX
+endif
+
+ifneq ($(strip $(USELIBPCRE)),)
+	CPPFLAGS+=-DLIBPCRE
+	LIBS:=$(LIBS) -lpcreposix
 endif
 
 ifneq ($(strip $(USELIBCONFIG)),)
 	LIBS:=$(LIBS) -lconfig
-	CFLAGS:=$(CFLAGS) -DLIBCONFIG
+	CPPFLAGS+=-DLIBCONFIG
 endif
 
-all: sslh $(MAN) echosrv
+ifneq ($(strip $(USELIBCAP)),)
+	LIBS:=$(LIBS) -lcap
+	CPPFLAGS+=-DLIBCAP
+endif
 
-.c.o: *.h
+ifneq ($(strip $(USESYSTEMD)),)
-	$(CC) $(CFLAGS) -D'VERSION=$(VERSION)' -c $<
+        LIBS:=$(LIBS) -lsystemd
+        CPPFLAGS+=-DSYSTEMD
+	CONDITIONAL_TARGETS+=systemd-sslh-generator
+endif
 
 
-sslh: $(OBJS) sslh-fork sslh-select
+all: sslh $(MAN) echosrv $(CONDITIONAL_TARGETS)
 
-sslh-fork: $(OBJS) sslh-fork.o Makefile common.h
+.c.o: *.h version.h
-	$(CC) $(CFLAGS) -D'VERSION=$(VERSION)' -o sslh-fork sslh-fork.o $(OBJS) $(LIBS)
+	$(CC) $(CFLAGS) $(CPPFLAGS) -c $<
+
+version.h:
+	./genver.sh >version.h
+
+sslh: sslh-fork sslh-select
+
+$(OBJS): version.h
+
+sslh-fork: version.h $(OBJS) sslh-fork.o Makefile common.h
+	$(CC) $(CFLAGS) $(LDFLAGS) -o sslh-fork sslh-fork.o $(OBJS) $(LIBS)
 	#strip sslh-fork
 
-sslh-select: $(OBJS) sslh-select.o Makefile common.h 
+sslh-select: version.h $(OBJS) sslh-select.o Makefile common.h
-	$(CC) $(CFLAGS) -D'VERSION=$(VERSION)' -o sslh-select sslh-select.o $(OBJS) $(LIBS)
+	$(CC) $(CFLAGS) $(LDFLAGS) -o sslh-select sslh-select.o $(OBJS) $(LIBS)
 	#strip sslh-select
 
-echosrv: $(OBJS) echosrv.o
+systemd-sslh-generator: systemd-sslh-generator.o
-	$(CC) $(CFLAGS) -o echosrv echosrv.o common.o $(LIBS)
+	$(CC) $(CFLAGS) $(LDFLAGS) -o systemd-sslh-generator systemd-sslh-generator.o -lconfig
+
+echosrv: version.h $(OBJS) echosrv.o
+	$(CC) $(CFLAGS) $(LDFLAGS) -o echosrv echosrv.o probe.o common.o tls.o $(LIBS)
 
 $(MAN): sslh.pod Makefile
 	pod2man --section=8 --release=$(VERSION) --center=" " sslh.pod | gzip -9 - > $(MAN)
 
+# Create release: export clean tree and tag current
+# configuration
+release:
+	git archive master --prefix="sslh-$(VERSION)/" | gzip > /tmp/sslh-$(VERSION).tar.gz
+
 # generic install: install binary and man page
 install: sslh $(MAN)
-	install -D sslh-fork $(PREFIX)/sbin/sslh
+	mkdir -p $(DESTDIR)/$(BINDIR)
-	install -D -m 0644 $(MAN) $(PREFIX)/share/man/man8/$(MAN)
+	mkdir -p $(DESTDIR)/$(MANDIR)
+	install -p sslh-fork $(DESTDIR)/$(BINDIR)/sslh
+	install -p -m 0644 $(MAN) $(DESTDIR)/$(MANDIR)/$(MAN)
 
 # "extended" install for Debian: install startup script
 install-debian: install sslh $(MAN)
 	sed -e "s+^PREFIX=+PREFIX=$(PREFIX)+" scripts/etc.init.d.sslh > /etc/init.d/sslh
 	chmod 755 /etc/init.d/sslh
-	cp scripts/etc.default.sslh /etc/default/sslh
 	update-rc.d sslh defaults
 
 uninstall:
-	rm -f $(PREFIX)/sbin/sslh $(PREFIX)/share/man/man8/$(MAN) /etc/init.d/sslh /etc/default/sslh
+	rm -f $(DESTDIR)$(BINDIR)/sslh $(DESTDIR)$(MANDIR)/$(MAN) $(DESTDIR)/etc/init.d/sslh $(DESTDIR)/etc/default/sslh
 	update-rc.d sslh remove
 
+distclean: clean
+	rm -f tags cscope.*
+
 clean:
-	rm -f sslh-fork sslh-select echosrv $(MAN) *.o *.gcov *.gcno *.gcda *.png *.html *.css *.info 
+	rm -f sslh-fork sslh-select echosrv version.h $(MAN) systemd-sslh-generator *.o *.gcov *.gcno *.gcda *.png *.html *.css *.info
 
 tags:
-	ctags -T *.[ch]
+	ctags --globals -T *.[ch]
+
+cscope:
+	-find . -name "*.[chS]" >cscope.files
+	-cscope -b -R
 
 test:
 	./t
-

README

@@ -1,171 +0,0 @@
-===== sslh -- A ssl/ssh multiplexer. =====
-
-sslh accepts connections in HTTP, HTTPS, SSH, OpenVPN,
-tinc, XMPP, or any other protocol that can be tested using a
-regular expression, on the same port. This makes it possible
-to connect to any of these servers on port 443 (e.g. from
-inside a corporate firewall, which almost never block port
-443) while still serving HTTPS on that port. 
-
-
-==== Compile and install ====
-
-If you're lucky, the Makefile will work for you:
-
-make install
-
-There are a couple of configuration options at the beginning
-of the Makefile: 
-
-    USELIBWRAP compiles support for host access control (see
-    hosts_access(3)), you will need libwrap headers and
-    library to compile (libwrap0-dev in Debian).
-
-    USELIBCONFIG compiles support for the configuration
-    file. You will need libconfig headers to compile
-    (libconfig8-dev in Debian).
-
-The Makefile produces two different executables: sslh-fork
-and sslh-select. 
-
-sslh-fork forks a new process for each incoming connection.
-It is well-tested and very reliable, but incurs the overhead
-of many processes.  sslh-select uses only one thread, which
-monitors all connections at once. It is more recent and less
-tested, but only incurs a 16 byte overhead per connection.
-Also, if it stops, you'll lose all connections, which means
-you can't upgrade it remotely.
-
-If you are going to use sslh for a "small" setup (less than
-a dozen ssh connections and a low-traffic https server) then
-sslh-fork is probably more suited for you. If you are going
-to use sslh on a "medium" setup (a few thousand ssh
-connections, and another few thousand sslh connections),
-sslh-select will be better. If you have a very large site
-(tens of thousands of connections), you'll need a vapourware
-version that would use libevent or something like that.
-
-
-To install:
-
-make
-cp sslh-fork /usr/local/sbin/sslh
-cp scripts/etc.default.sslh /etc/default/sslh
-
-For Debian:
-cp scripts/etc.init.d.sslh /etc/init.d/sslh
-For CentOS:
-cp scripts/etc.rc.d.init.d.sslh /etc/rc.d/init.d/sslh
-
-and probably create links in /etc/rc<x>.d so that the server
-start automatically at boot-up, e.g. under Debian:
-update-rc.d sslh defaults
-
-
-
-==== Configuration ====
-
-You can edit settings in /etc/default/sslh:
-
-LISTEN=ifname:443
-SSH=localhost:22
-SSL=localhost:443
-
-A good scheme is to use the external name of the machine in
-$LISTEN, and bind httpd to localhost:443 (instead of all
-binding to all interfaces): that way, https connections
-coming from inside your network don't need to go through
-sslh, and sslh is only there as a frontal for connections
-coming from the internet.
-
-Note that 'external name' in this context refers to the
-actual IP address of the machine as seen from your network,
-i.e. that that is not 127.0.0.1 in the output of
-ifconfig(8).
-
-==== Libwrap support ====
-
-Sslh can optionnaly perform libwrap checks for the sshd
-service: because the connection to sshd will be coming
-locally from sslh, sshd cannot determine the IP of the
-client.
-
-==== OpenVPN support ====
-
-OpenVPN clients connecting to OpenVPN running with
--port-share reportedly take more than one second between
-the time the TCP connexion is established and the time they
-send the first data packet. This results in sslh with
-default settings timing out and assuming an SSH connexion.
-To support OpenVPN connexions reliably, it is necessary to
-increase sslh's timeout to 5 seconds.
-
-Instead of using OpenVPN's port sharing, it is more reliable
-to use sslh's -o option to get sslh to do the port sharing.
-
-==== Using proxytunnel with sslh ====
-
-If you are connecting through a proxy that checks that the
-outgoing connection really is SSL and rejects SSH, you can
-encapsulate all your traffic in SSL using proxytunnel (this
-should work with corkscrew as well). On the server side you
-receive the traffic with stunnel to decapsulate SSL, then
-pipe through sslh to switch HTTP on one side and SSL on the
-other.
-
-In that case, you end up with something like this:
-
-ssh -> proxytunnel -e --------ssh/ssl------> stunnel ---ssh---> sslh --> sshd
-
-Web browser --------http/ssl------> stunnel ---http---> sslh --> http:80
-
-Configuration goes like this:
-
-On the server side, using stunnel3:
-stunnel -f -p mycert.pem  -d thelonious:443 -l /usr/local/sbin/sslh -- sslh -i  --ssl localhost:80 --ssh localhost:22
-
-stunnel options: -f for foreground/debugging, -p specifies
-the key + certificate, -d specifies which interface and port
-we're listening to for incoming connexions, -l summons sslh
-in inetd mode.
-
-sslh options: -i for inetd mode, --ssl to forward SSL
-connexions (in fact normal HTTP at that stage) to port 80,
-and SSH connexions to port 22. This works because sslh
-considers that any protocol it doesn't recognise is SSL.
-
-==== IP_TPROXY support ====
-
-There is a netfilter patch that adds an option to the Linux
-TCP/IP stack to allow a program to set the source address
-of an IP packet that it sends. This could let sslh set the
-address of packets to that of the actual client, so that
-sshd would see and log the IP address of the client, making
-sslh transparent.
-
-This is not, and won't be, implemented in sslh for the
-following reasons (in increasing order of importance):
-
-  * It's not vital: the real connecting IP address can be
-    found in logs. Little gain.
-  * It's Linux only: it means increased complexity for no
-    gain to some users.
-  * It's a patch: it means it'd only be useful to Linux
-    users who compile their own kernel.
-  * Only root can use the feature: that's a definite no-no.
-    Sslh should not, must not, will never run as root.
-
-This isn't to mean that it won't eventually get implemented,
-when/if the feature finds its way into the main kernel and
-it becomes usuable by non-root processes.
-
-
-==== Comments? Questions? ====
-
-You can subscribe to the sslh mailing list here:
-http://rutschle.net/cgi-bin/mailman/listinfo/sslh
-
-This mailing list should be used for discussion, feature
-requests, and will be the prefered channel for
-announcements.
-

README.md

@@ -0,0 +1,448 @@
+sslh -- A ssl/ssh multiplexer
+=============================
+
+`sslh` accepts connections on specified ports, and forwards
+them further based on tests performed on the first data
+packet sent by the remote client.
+
+Probes for HTTP, SSL, SSH, OpenVPN, tinc, XMPP are
+implemented, and any other protocol that can be tested using
+a regular expression, can be recognised. A typical use case
+is to allow serving several services on port 443 (e.g. to
+connect to SSH from inside a corporate firewall, which
+almost never block port 443) while still serving HTTPS on
+that port. 
+
+Hence `sslh` acts as a protocol demultiplexer, or a
+switchboard. Its name comes from its original function to
+serve SSH and HTTPS on the same port.
+
+Compile and install
+===================
+
+Dependencies
+------------
+
+`sslh` uses [libconfig](http://www.hyperrealm.com/libconfig/)
+and [libwrap](http://packages.debian.org/source/unstable/tcp-wrappers).
+
+For Debian, these are contained in packages `libwrap0-dev` and
+`libconfig8-dev`.
+
+For OpenSUSE, these are contained in packages libconfig9 and
+libconfig-dev in repository
+<http://download.opensuse.org/repositories/multimedia:/libs/openSUSE_12.1/>
+
+For Fedora, you'll need packages `libconfig` and
+`libconfig-devel`:
+
+	yum install libconfig libconfig-devel
+
+If you can't find `libconfig`, or just don't want a
+configuration file, set `USELIBCONFIG=` in the Makefile.
+
+Compilation
+-----------
+
+After this, the Makefile should work:
+
+	make install
+
+There are a couple of configuration options at the beginning
+of the Makefile: 
+
+* `USELIBWRAP` compiles support for host access control (see
+  `hosts_access(3)`), you will need `libwrap` headers and
+  library to compile (`libwrap0-dev` in Debian).
+
+* `USELIBCONFIG` compiles support for the configuration
+  file. You will need `libconfig` headers to compile
+  (`libconfig8-dev` in Debian).
+
+*  `USESYSTEMD` compiles support for using systemd socket activation.
+   You will need `systemd` headers to compile (`systemd-devel` in Fedora).
+
+Binaries
+--------
+
+The Makefile produces two different executables: `sslh-fork`
+and `sslh-select`:
+
+* `sslh-fork` forks a new process for each incoming connection.
+It is well-tested and very reliable, but incurs the overhead
+of many processes.  
+If you are going to use `sslh` for a "small" setup (less than
+a dozen ssh connections and a low-traffic https server) then
+`sslh-fork` is probably more suited for you. 
+
+* `sslh-select` uses only one thread, which monitors all connections
+at once. It is more recent and less tested, but only incurs a 16
+byte overhead per connection. Also, if it stops, you'll lose all
+connections, which means you can't upgrade it remotely.  
+If you are going to use `sslh` on a "medium" setup (a few thousand ssh
+connections, and another few thousand ssl connections),
+`sslh-select` will be better.
+
+If you have a very large site (tens of thousands of connections),
+you'll need a vapourware version that would use libevent or
+something like that.
+
+
+Installation
+------------
+
+* In general:
+
+		make
+		cp sslh-fork /usr/local/sbin/sslh
+		cp basic.cfg /etc/sslh.cfg
+                vi /etc/sslh.cfg
+
+* For Debian:
+
+		cp scripts/etc.init.d.sslh /etc/init.d/sslh
+	
+* For CentOS:
+
+		cp scripts/etc.rc.d.init.d.sslh.centos /etc/rc.d/init.d/sslh
+
+
+You might need to create links in /etc/rc<x>.d so that the server
+start automatically at boot-up, e.g. under Debian:
+
+	update-rc.d sslh defaults
+
+
+Configuration
+=============
+
+If you use the scripts provided, sslh will get its
+configuration from /etc/sslh.cfg. Please refer to
+example.cfg for an overview of all the settings.
+
+A good scheme is to use the external name of the machine in
+`listen`, and bind `httpd` to `localhost:443` (instead of all
+binding to all interfaces): that way, HTTPS connections
+coming from inside your network don't need to go through
+`sslh`, and `sslh` is only there as a frontal for connections
+coming from the internet.
+
+Note that 'external name' in this context refers to the
+actual IP address of the machine as seen from your network,
+i.e. that that is not `127.0.0.1` in the output of
+`ifconfig(8)`.
+
+Libwrap support
+---------------
+
+Sslh can optionally perform `libwrap` checks for the sshd
+service: because the connection to `sshd` will be coming
+locally from `sslh`, `sshd` cannot determine the IP of the
+client.
+
+OpenVPN support
+---------------
+
+OpenVPN clients connecting to OpenVPN running with
+`-port-share` reportedly take more than one second between
+the time the TCP connection is established and the time they
+send the first data packet. This results in `sslh` with
+default settings timing out and assuming an SSH connection.
+To support OpenVPN connections reliably, it is necessary to
+increase `sslh`'s timeout to 5 seconds.
+
+Instead of using OpenVPN's port sharing, it is more reliable
+to use `sslh`'s `--openvpn` option to get `sslh` to do the
+port sharing.
+
+Using proxytunnel with sslh
+---------------------------
+
+If you are connecting through a proxy that checks that the
+outgoing connection really is SSL and rejects SSH, you can
+encapsulate all your traffic in SSL using `proxytunnel` (this
+should work with `corkscrew` as well). On the server side you
+receive the traffic with `stunnel` to decapsulate SSL, then
+pipe through `sslh` to switch HTTP on one side and SSL on the
+other.
+
+In that case, you end up with something like this:
+
+	ssh -> proxytunnel -e ----[ssh/ssl]---> stunnel ---[ssh]---> sslh --> sshd
+	Web browser -------------[http/ssl]---> stunnel ---[http]--> sslh --> httpd
+
+Configuration goes like this on the server side, using `stunnel3`:
+
+	stunnel -f -p mycert.pem  -d thelonious:443 -l /usr/local/sbin/sslh -- \
+		sslh -i  --http localhost:80 --ssh localhost:22
+
+* stunnel options:
+  * `-f` for foreground/debugging
+  * `-p` for specifying the key and certificate
+  * `-d` for specifying which interface and port
+	we're listening to for incoming connexions
+  * `-l` summons `sslh` in inetd mode.
+
+* sslh options:
+  * `-i` for inetd mode
+  * `--http` to forward HTTP connexions to port 80,
+	and SSH connexions to port 22.
+
+Capabilities support
+--------------------
+
+On Linux (only?), you can compile sslh with `USELIBCAP=1` to
+make use of POSIX capabilities; this will save the required
+capabilities needed for transparent proxying for unprivileged
+processes.
+
+Alternatively, you may use filesystem capabilities instead
+of starting sslh as root and asking it to drop privileges.
+You will need `CAP_NET_BIND_SERVICE` for listening on port 443
+and `CAP_NET_ADMIN` for transparent proxying (see
+`capabilities(7)`).
+
+You can use the `setcap(8)` utility to give these capabilities
+to the executable:
+
+	sudo setcap cap_net_bind_service,cap_net_admin+pe sslh-select
+
+Then you can run sslh-select as an unpriviledged user, e.g.:
+
+	sslh-select -p myname:443 --ssh localhost:22 --ssl localhost:443
+
+Caveat: `CAP_NET_ADMIN` does give sslh too many rights, e.g.
+configuring the interface. If you're not going to use
+transparent proxying, just don't use it (or use the libcap method).
+
+Transparent proxy support
+-------------------------
+
+On Linux and FreeBSD you can use the `--transparent` option to
+request transparent proxying. This means services behind `sslh`
+(Apache, `sshd` and so on) will see the external IP and ports
+as if the external world connected directly to them. This
+simplifies IP-based access control (or makes it possible at
+all).
+
+Linux:
+
+`sslh` needs extended rights to perform this: you'll need to
+give it `CAP_NET_ADMIN` capabilities (see appropriate chapter)
+or run it as root (but don't do that).
+
+The firewalling tables also need to be adjusted as follows.
+I don't think it is possible to have `httpd` and `sslh` both listen to 443 in
+this scheme -- let me know if you manage that:
+
+	# Set route_localnet = 1 on all interfaces so that ssl can use "localhost" as destination
+	sysctl -w net.ipv4.conf.default.route_localnet=1
+	sysctl -w net.ipv4.conf.all.route_localnet=1
+
+	# DROP martian packets as they would have been if route_localnet was zero
+	# Note: packets not leaving the server aren't affected by this, thus sslh will still work
+	iptables -t raw -A PREROUTING ! -i lo -d 127.0.0.0/8 -j DROP
+	iptables -t mangle -A POSTROUTING ! -o lo -s 127.0.0.0/8 -j DROP
+
+	# Mark all connections made by ssl for special treatment (here sslh is run as user "sslh")
+	iptables -t nat -A OUTPUT -m owner --uid-owner sslh -p tcp --tcp-flags FIN,SYN,RST,ACK SYN -j CONNMARK --set-xmark 0x01/0x0f
+
+	# Outgoing packets that should go to sslh instead have to be rerouted, so mark them accordingly (copying over the connection mark)
+	iptables -t mangle -A OUTPUT ! -o lo -p tcp -m connmark --mark 0x01/0x0f -j CONNMARK --restore-mark --mask 0x0f
+
+	# Configure routing for those marked packets
+	ip rule add fwmark 0x1 lookup 100
+	ip route add local 0.0.0.0/0 dev lo table 100
+
+Tranparent proxying with IPv6 is similarly set up as follows:
+
+	# Set route_localnet = 1 on all interfaces so that ssl can use "localhost" as destination
+	# Not sure if this is needed for ipv6 though
+	sysctl -w net.ipv4.conf.default.route_localnet=1
+	sysctl -w net.ipv4.conf.all.route_localnet=1
+
+	# DROP martian packets as they would have been if route_localnet was zero
+	# Note: packets not leaving the server aren't affected by this, thus sslh will still work
+	ip6tables -t raw -A PREROUTING ! -i lo -d ::1/128 -j DROP
+	ip6tables -t mangle -A POSTROUTING ! -o lo -s ::1/128 -j DROP
+
+	# Mark all connections made by ssl for special treatment (here sslh is run as user "sslh")
+	ip6tables -t nat -A OUTPUT -m owner --uid-owner sslh -p tcp --tcp-flags FIN,SYN,RST,ACK SYN -j CONNMARK --set-xmark 0x01/0x0f
+
+	# Outgoing packets that should go to sslh instead have to be rerouted, so mark them accordingly (copying over the connection mark)
+	ip6tables -t mangle -A OUTPUT ! -o lo -p tcp -m connmark --mark 0x01/0x0f -j CONNMARK --restore-mark --mask 0x0f
+
+	# Configure routing for those marked packets
+	ip -6 rule add fwmark 0x1 lookup 100
+	ip -6 route add local ::/0 dev lo table 100
+
+Explanation:
+To be able to use `localhost` as destination in your sslh config along with transparent proxying
+you have to allow routing of loopback addresses as done above.
+This is something you usually should not do (see [this stackoverflow post](https://serverfault.com/questions/656279/how-to-force-linux-to-accept-packet-with-loopback-ip/656484#656484))
+The two `DROP` iptables rules emulate the behaviour of `route_localnet` set to off (with one small difference:
+allowing the reroute-check to happen after the fwmark is set on packets destined for sslh).
+See [this diagram](https://upload.wikimedia.org/wikipedia/commons/3/37/Netfilter-packet-flow.svg) for a good visualisation
+showing how packets will traverse the iptables chains.
+
+Note:
+You have to run `sslh` as dedicated user (in this example the user is also named `sslh`), to not mess up with your normal networking.
+These rules will allow you to connect directly to ssh on port
+22 (or to any other service behind sslh) as well as through sslh on port 443.
+
+Also remember that iptables configuration and ip routes and 
+rules won't be necessarily persisted after you reboot. Make 
+sure to save them properly. For example in CentOS7, you would 
+do `iptables-save > /etc/sysconfig/iptables`, and add both 
+`ip` commands to your `/etc/rc.local`.
+
+FreeBSD:
+
+Given you have no firewall defined yet, you can use the following configuration
+to have ipfw properly redirect traffic back to sslh
+
+	/etc/rc.conf
+	firewall_enable="YES"
+	firewall_type="open"
+	firewall_logif="YES"
+	firewall_coscripts="/etc/ipfw/sslh.rules"
+
+
+/etc/ipfw/sslh.rules
+
+	#! /bin/sh
+
+	# ssl
+	ipfw add 20000 fwd 192.0.2.1,443 log tcp from 192.0.2.1 8443 to any out
+	ipfw add 20010 fwd 2001:db8::1,443 log tcp from 2001:db8::1 8443 to any out
+
+	# ssh
+	ipfw add 20100 fwd 192.0.2.1,443 log tcp from 192.0.2.1 8022 to any out
+	ipfw add 20110 fwd 2001:db8::1,443 log tcp from 2001:db8::1 8022 to any out
+
+	# xmpp
+	ipfw add 20200 fwd 192.0.2.1,443 log tcp from 192.0.2.1 5222 to any out
+	ipfw add 20210 fwd 2001:db8::1,443 log tcp from 2001:db8::1 5222 to any out
+
+	# openvpn (running on other internal system)
+	ipfw add 20300 fwd 192.0.2.1,443 log tcp from 198.51.100.7 1194 to any out
+	ipfw add 20310 fwd 2001:db8::1,443 log tcp from 2001:db8:1::7 1194 to any out
+
+General notes:
+
+
+This will only work if `sslh` does not use any loopback
+addresses (no `127.0.0.1` or `localhost`), you'll need to use
+explicit IP addresses (or names):
+
+	sslh --listen 192.168.0.1:443 --ssh 192.168.0.1:22 --ssl 192.168.0.1:4443
+
+This will not work:
+
+	sslh --listen 192.168.0.1:443 --ssh 127.0.0.1:22 --ssl 127.0.0.1:4443
+    
+Transparent proxying means the target server sees the real
+origin address, so it means if the client connects using
+IPv6, the server must also support IPv6. It is easy to
+support both IPv4 and IPv6 by configuring the server
+accordingly, and setting `sslh` to connect to a name that
+resolves to both IPv4 and IPv6, e.g.:
+
+        sslh --transparent --listen <extaddr>:443 --ssh insideaddr:22
+
+        /etc/hosts:
+        192.168.0.1  insideaddr
+        201::::2     insideaddr
+
+Upon incoming IPv6 connection, `sslh` will first try to
+connect to the IPv4 address (which will fail), then connect
+to the IPv6 address.
+
+Systemd Socket Activation
+-------------------------
+If compiled with `USESYSTEMD` then it is possible to activate 
+the service on demand and avoid running any code as root.
+
+In this mode any listen configuration options are ignored and 
+the sockets are passed by systemd to the service.
+
+Example socket unit:
+
+	[Unit]
+	Before=sslh.service
+	
+	[Socket]
+	ListenStream=1.2.3.4:443
+	ListenStream=5.6.7.8:444
+	ListenStream=9.10.11.12:445
+	FreeBind=true
+
+	[Install]
+	WantedBy=sockets.target
+
+Example service unit:
+
+	[Unit]
+	PartOf=sslh.socket
+	
+	[Service]
+	ExecStart=/usr/sbin/sslh -v -f --ssh 127.0.0.1:22 --ssl 127.0.0.1:443
+	KillMode=process
+	CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_NET_ADMIN CAP_SETGID CAP_SETUID
+	PrivateTmp=true
+	PrivateDevices=true
+	ProtectSystem=full
+	ProtectHome=true
+	User=sslh
+
+
+With this setup only the socket needs to be enabled. The sslh service 
+will be started on demand and does not need to run as root to bind the 
+sockets as systemd has already bound and passed them over. If the sslh
+service is started on its own without the sockets being passed by systemd
+then it will look to use those defined on the command line or config
+file as usual. Any number of ListenStreams can be defined in the socket
+file and systemd will pass them all over to sslh to use as usual.
+
+To avoid inconsistency between starting via socket and starting directly
+via the service Requires=sslh.socket can be added to the service unit to
+mandate the use of the socket configuration.
+
+Rather than overwriting the entire socket file drop in values can be placed
+in /etc/systemd/system/sslh.socket.d/<name>.conf with additional ListenStream
+values that will be merged.
+
+In addition to the above with manual .socket file configuration there is an
+optional systemd generator which can be compiled - systemd-sslh-generator 
+
+This parses the /etc/sslh.cfg (or /etc/sslh/sslh.cfg file if that exists 
+instead) configuration file and dynamically generates a socket file to use.
+
+This will also merge with any sslh.socket.d drop in configuration but will be 
+overriden by a /etc/systemd/system/sslh.socket file.
+
+To use the generator place it in /usr/lib/systemd/system-generators and then
+call systemctl daemon-reload after any changes to /etc/sslh.cfg to generate 
+the new dynamic socket unit.
+
+Fail2ban
+--------
+
+If using transparent proxying, just use the standard ssh
+rules. If you can't or don't want to use transparent
+proxying, you can set `fail2ban` rules to block repeated ssh
+connections from an IP address (obviously this depends
+on the site, there might be legitimate reasons you would get
+many connections to ssh from the same IP address...)
+
+See example files in scripts/fail2ban.
+
+Comments? Questions?
+====================
+
+You can subscribe to the `sslh` mailing list here:
+<http://rutschle.net/cgi-bin/mailman/listinfo/sslh>
+
+This mailing list should be used for discussion, feature
+requests, and will be the prefered channel for announcements.
+

TODO

@@ -0,0 +1,25 @@
+Here's a list of features that have been suggested or
+sometimes requested. This list is not a roadmap and
+shouldn't be construed to mean that any of this will happen.
+
+- configurable behaviour depending on services (e.g.
+  select() for ssl but fork() for ssh).
+
+- have certain services available only from specified subnets
+
+- some sort of "service knocking" allowing to activate a
+  service upon some external even, similar to port knocking;
+for example, go to a specific URL to enable sslh forwarding
+to sshd for a set period of time:
+    * sslh listens on 443 and only directs to httpd
+    * user goes somewhere to https://example.org/open_ssh.cgi
+    * open_ssh.cgi tells sslh
+    * sslh starts checking if incoming connections are ssh, and
+    if they are, forward to sshd
+    * 10 minutes later, sslh stops forwarding to ssh
+
+That would make it almost impossible for an observer
+(someone who'd telnet regularly on 443) to ever notice both
+services are available on 443.
+
+

basic.cfg

@@ -0,0 +1,30 @@
+# This is a basic configuration file that should provide
+# sensible values for "standard" setup.
+
+verbose: false;
+foreground: false;
+inetd: false;
+numeric: false;
+transparent: false;
+timeout: 2;
+user: "nobody";
+pidfile: "/var/run/sslh.pid";
+chroot: "/var/empty";
+
+
+# Change hostname with your external address name.
+listen:
+(
+    { host: "thelonious"; port: "443"; }
+);
+
+protocols:
+(
+     { name: "ssh"; service: "ssh"; host: "localhost"; port: "22"; fork: true; },
+     { name: "openvpn"; host: "localhost"; port: "1194"; },
+     { name: "xmpp"; host: "localhost"; port: "5222"; },
+     { name: "http"; host: "localhost"; port: "80"; },
+     { name: "ssl"; host: "localhost"; port: "443"; log_level: 0; },
+     { name: "anyprot"; host: "localhost"; port: "443"; }
+);
+

common.c

@@ -4,18 +4,32 @@
  * No code here should assume whether sockets are blocking or not.
  **/
 
+#define SYSLOG_NAMES
 #define _GNU_SOURCE
+#include <stddef.h>
 #include <stdarg.h>
+#include <grp.h>
+
+#include <sys/types.h>
+#include <ifaddrs.h>
+#include <netinet/in.h>
 
 #include "common.h"
+#include "probe.h"
 
-/* Added to make the code compilable under CYGWIN 
+/* Added to make the code compilable under CYGWIN
  * */
 #ifndef SA_NOCLDWAIT
 #define SA_NOCLDWAIT 0
 #endif
 
-/* 
+/* Make use of systemd socket activation
+ * */
+#ifdef SYSTEMD
+#include <systemd/sd-daemon.h>
+#endif
+
+/*
  * Settings that depend on the command line.  They're set in main(), but also
  * used in other places in common.c, and it'd be heavy-handed to pass it all as
  * parameters
@@ -24,8 +38,10 @@ int verbose = 0;
 int probing_timeout = 2;
 int inetd = 0;
 int foreground = 0;
+int background = 0;
+int transparent = 0;
 int numeric = 0;
-const char *user_name, *pid_file, *rule_filename;
+const char *user_name, *pid_file, *chroot_path, *facility = "auth";
 
 struct addrinfo *addr_listen = NULL; /* what addresses do we listen to? */
 
@@ -34,21 +50,50 @@ struct addrinfo *addr_listen = NULL; /* what addresses do we listen to? */
 int allow_severity =0, deny_severity = 0;
 #endif
 
+typedef enum {
+    CR_DIE,
+    CR_WARN
+} CR_ACTION;
 
 /* check result and die, printing the offending address and error */
-void check_res_dumpdie(int res, struct addrinfo *addr, char* syscall)
+void check_res_dump(CR_ACTION act, int res, struct addrinfo *addr, char* syscall)
 {
     char buf[NI_MAXHOST];
 
     if (res == -1) {
-        fprintf(stderr, "%s:%s: %s\n", 
+        fprintf(stderr, "%s:%s: %s\n",
-                sprintaddr(buf, sizeof(buf), addr), 
+                sprintaddr(buf, sizeof(buf), addr),
-                syscall, 
+                syscall,
                 strerror(errno));
-        exit(1);
+
+        if (act == CR_DIE)
+            exit(1);
     }
 }
 
+int get_fd_sockets(int *sockfd[])
+{
+    int sd = 0;
+
+#ifdef SYSTEMD
+    sd = sd_listen_fds(0);
+    if (sd < 0) {
+      fprintf(stderr, "sd_listen_fds(): %s\n", strerror(-sd));
+      exit(1);
+    }
+    if (sd > 0) {
+      int i;
+      *sockfd = malloc(sd * sizeof(*sockfd[0]));
+      CHECK_ALLOC(*sockfd, "malloc");
+      for (i = 0; i < sd; i++) {
+        (*sockfd)[i] = SD_LISTEN_FDS_START + i;
+      }
+    }
+#endif
+
+    return sd;
+}
+
 /* Starts listening sockets on specified addresses.
  * IN: addr[], num_addr
  * OUT: *sockfd[]  pointer to newly-allocated array of file descriptors
@@ -59,16 +104,29 @@ int start_listen_sockets(int *sockfd[], struct addrinfo *addr_list)
 {
    struct sockaddr_storage *saddr;
    struct addrinfo *addr;
-   int i, res, reuse;
+   int i, res, one;
    int num_addr = 0;
+   int sd_socks = 0;
+
+   sd_socks = get_fd_sockets(sockfd);
+
+   if (sd_socks > 0) {
+       return sd_socks;
+   }
 
    for (addr = addr_list; addr; addr = addr->ai_next)
        num_addr++;
 
+   if (num_addr == 0) {
+       fprintf(stderr, "FATAL: No available addresses.\n");
+       exit(1);
+   }
+
    if (verbose)
        fprintf(stderr, "listening to %d addresses\n", num_addr);
 
    *sockfd = malloc(num_addr * sizeof(*sockfd[0]));
+   CHECK_ALLOC(*sockfd, "malloc");
 
    for (i = 0, addr = addr_list; i < num_addr && addr; i++, addr = addr->ai_next) {
        if (!addr) {
@@ -78,45 +136,170 @@ int start_listen_sockets(int *sockfd[], struct addrinfo *addr_list)
        saddr = (struct sockaddr_storage*)addr->ai_addr;
 
        (*sockfd)[i] = socket(saddr->ss_family, SOCK_STREAM, 0);
-       check_res_dumpdie((*sockfd)[i], addr, "socket");
+       check_res_dump(CR_DIE, (*sockfd)[i], addr, "socket");
 
-       reuse = 1;
+       one = 1;
-       res = setsockopt((*sockfd)[i], SOL_SOCKET, SO_REUSEADDR, (char*)&reuse, sizeof(reuse));
+       res = setsockopt((*sockfd)[i], SOL_SOCKET, SO_REUSEADDR, (char*)&one, sizeof(one));
-       check_res_dumpdie(res, addr, "setsockopt");
+       check_res_dump(CR_DIE, res, addr, "setsockopt(SO_REUSEADDR)");
+
+       if (addr->ai_flags & SO_KEEPALIVE) {
+           res = setsockopt((*sockfd)[i], SOL_SOCKET, SO_KEEPALIVE, (char*)&one, sizeof(one));
+           check_res_dump(CR_DIE, res, addr, "setsockopt(SO_KEEPALIVE)");
+       }
+
+       if (IP_FREEBIND) {
+           res = setsockopt((*sockfd)[i], IPPROTO_IP, IP_FREEBIND, (char*)&one, sizeof(one));
+           check_res_dump(CR_WARN, res, addr, "setsockopt(IP_FREEBIND)");
+           }
+
+       if (addr->ai_addr->sa_family == AF_INET6) {
+           res = setsockopt((*sockfd)[i], IPPROTO_IPV6, IPV6_V6ONLY, (char*)&one, sizeof(one));
+           check_res_dump(CR_WARN, res, addr, "setsockopt(IPV6_V6ONLY)");
+       }
 
        res = bind((*sockfd)[i], addr->ai_addr, addr->ai_addrlen);
-       check_res_dumpdie(res, addr, "bind");
+       check_res_dump(CR_DIE, res, addr, "bind");
 
        res = listen ((*sockfd)[i], 50);
-       check_res_dumpdie(res, addr, "listen");
+       check_res_dump(CR_DIE, res, addr, "listen");
 
    }
 
    return num_addr;
 }
 
-/* Connect to first address that works and returns a file descriptor, or -1 if
- * none work. cnx_name points to the name of the service (for logging) */
-int connect_addr(struct addrinfo *addr, const char* cnx_name)
-{
-    struct addrinfo *a;
-    char buf[NI_MAXHOST];
-    int fd, res;
 
-    for (a = addr; a; a = a->ai_next) {
+/* returns 1 if given address is on the local machine: iterate through all
-        if (verbose) 
+ * network interfaces and check their addresses */
-            fprintf(stderr, "connecting to %s family %d len %d\n", 
+int is_same_machine(struct addrinfo* from)
+{
+    struct ifaddrs *ifaddrs_p = NULL, *ifa;
+    int match = 0;
+
+    getifaddrs(&ifaddrs_p);
+
+    for (ifa = ifaddrs_p; ifa != NULL; ifa = ifa->ifa_next)
+    {
+        if (!ifa->ifa_addr)
+            continue;
+        if (from->ai_addr->sa_family == ifa->ifa_addr->sa_family)
+        {
+            int family = ifa->ifa_addr->sa_family;
+            if (family == AF_INET)
+            {
+                struct sockaddr_in *from_addr = (struct sockaddr_in*)from->ai_addr;
+                struct sockaddr_in *ifa_addr = (struct sockaddr_in*)ifa->ifa_addr;
+                if (from_addr->sin_addr.s_addr == ifa_addr->sin_addr.s_addr) {
+                    match = 1;
+                    break;
+                }
+            }
+            else if (family == AF_INET6)
+            {
+                struct sockaddr_in6 *from_addr = (struct sockaddr_in6*)from->ai_addr;
+                struct sockaddr_in6 *ifa_addr = (struct sockaddr_in6*)ifa->ifa_addr;
+                if (!memcmp(from_addr->sin6_addr.s6_addr, ifa_addr->sin6_addr.s6_addr, 16)) {
+                    match = 1;
+                    break;
+                }
+            }
+        }
+    }
+    freeifaddrs(ifaddrs_p);
+    return match;
+}
+
+
+/* Transparent proxying: bind the peer address of fd to the peer address of
+ * fd_from */
+#define IP_TRANSPARENT 19
+int bind_peer(int fd, int fd_from)
+{
+    struct addrinfo from;
+    struct sockaddr_storage ss;
+    int res, trans = 1;
+
+    memset(&from, 0, sizeof(from));
+    from.ai_addr = (struct sockaddr*)&ss;
+    from.ai_addrlen = sizeof(ss);
+
+    /* getpeername can fail with ENOTCONN if connection was dropped before we
+     * got here */
+    res = getpeername(fd_from, from.ai_addr, &from.ai_addrlen);
+    CHECK_RES_RETURN(res, "getpeername");
+
+    /* if the destination is the same machine, there's no need to do bind */
+    if (is_same_machine(&from))
+        return 0;
+    
+#ifndef IP_BINDANY /* use IP_TRANSPARENT */
+    res = setsockopt(fd, IPPROTO_IP, IP_TRANSPARENT, &trans, sizeof(trans));
+    CHECK_RES_DIE(res, "setsockopt");
+#else
+    if (from.ai_addr->sa_family==AF_INET) { /* IPv4 */
+        res = setsockopt(fd, IPPROTO_IP, IP_BINDANY, &trans, sizeof(trans));
+        CHECK_RES_RETURN(res, "setsockopt IP_BINDANY");
+#ifdef IPV6_BINDANY
+    } else { /* IPv6 */
+        res = setsockopt(fd, IPPROTO_IPV6, IPV6_BINDANY, &trans, sizeof(trans));
+        CHECK_RES_RETURN(res, "setsockopt IPV6_BINDANY");
+#endif /* IPV6_BINDANY */
+    }
+#endif /* IP_TRANSPARENT / IP_BINDANY */
+    res = bind(fd, from.ai_addr, from.ai_addrlen);
+    CHECK_RES_RETURN(res, "bind");
+
+    return 0;
+}
+
+/* Connect to first address that works and returns a file descriptor, or -1 if
+ * none work.
+ * If transparent proxying is on, use fd_from peer address on external address
+ * of new file descriptor. */
+int connect_addr(struct connection *cnx, int fd_from)
+{
+    struct addrinfo *a, from;
+    struct sockaddr_storage ss;
+    char buf[NI_MAXHOST];
+    int fd, res, one;
+
+    memset(&from, 0, sizeof(from));
+    from.ai_addr = (struct sockaddr*)&ss;
+    from.ai_addrlen = sizeof(ss);
+
+    res = getpeername(fd_from, from.ai_addr, &from.ai_addrlen);
+    CHECK_RES_RETURN(res, "getpeername");
+
+    for (a = cnx->proto->saddr; a; a = a->ai_next) {
+        /* When transparent, make sure both connections use the same address family */
+        if (transparent && a->ai_family != from.ai_addr->sa_family)
+            continue;
+        if (verbose)
+            fprintf(stderr, "connecting to %s family %d len %d\n",
                     sprintaddr(buf, sizeof(buf), a),
                     a->ai_addr->sa_family, a->ai_addrlen);
+
+        /* XXX Needs to match ai_family from fd_from when being transparent! */
         fd = socket(a->ai_family, SOCK_STREAM, 0);
         if (fd == -1) {
-            log_message(LOG_ERR, "forward to %s failed:socket: %s\n", cnx_name, strerror(errno));
+            log_message(LOG_ERR, "forward to %s failed:socket: %s\n",
+                        cnx->proto->description, strerror(errno));
         } else {
+            if (transparent) {
+                res = bind_peer(fd, fd_from);
+                CHECK_RES_RETURN(res, "bind_peer");
+            }
             res = connect(fd, a->ai_addr, a->ai_addrlen);
             if (res == -1) {
-                log_message(LOG_ERR, "forward to %s failed:connect: %s\n", 
+                log_message(LOG_ERR, "forward to %s failed:connect: %s\n",
-                            cnx_name, strerror(errno));
+                            cnx->proto->description, strerror(errno));
+                close(fd);
             } else {
+                if (cnx->proto->keepalive) {
+                    one = 1;
+                    res = setsockopt(fd, SOL_SOCKET, SO_KEEPALIVE, (char*)&one, sizeof(one));
+                    CHECK_RES_RETURN(res, "setsockopt(SO_KEEPALIVE)");
+                }
                 return fd;
             }
         }
@@ -125,14 +308,21 @@ int connect_addr(struct addrinfo *addr, const char* cnx_name)
 }
 
 /* Store some data to write to the queue later */
-int defer_write(struct queue *q, void* data, int data_size) 
+int defer_write(struct queue *q, void* data, int data_size)
 {
-    if (verbose) 
+    char *p;
-        fprintf(stderr, "**** writing defered on fd %d\n", q->fd);
+    ptrdiff_t data_offset = q->deferred_data - q->begin_deferred_data;
-    q->defered_data = malloc(data_size);
+    if (verbose)
-    q->begin_defered_data = q->defered_data;
+        fprintf(stderr, "**** writing deferred on fd %d\n", q->fd);
-    q->defered_data_size = data_size;
+
-    memcpy(q->defered_data, data, data_size);
+    p = realloc(q->begin_deferred_data, data_offset + q->deferred_data_size + data_size);
+    CHECK_ALLOC(p, "realloc");
+
+    q->begin_deferred_data = p;
+    q->deferred_data = p + data_offset;
+    p += data_offset + q->deferred_data_size;
+    q->deferred_data_size += data_size;
+    memcpy(p, data, data_size);
 
     return 0;
 }
@@ -141,30 +331,29 @@ int defer_write(struct queue *q, void* data, int data_size)
  * Upon success, the number of bytes written is returned.
  * Upon failure, -1 returned (e.g. connexion closed)
  * */
-int flush_defered(struct queue *q)
+int flush_deferred(struct queue *q)
 {
     int n;
 
     if (verbose)
-        fprintf(stderr, "flushing defered data to fd %d\n", q->fd);
+        fprintf(stderr, "flushing deferred data to fd %d\n", q->fd);
 
-    n = write(q->fd, q->defered_data, q->defered_data_size);
+    n = write(q->fd, q->deferred_data, q->deferred_data_size);
     if (n == -1)
         return n;
 
-    if (n == q->defered_data_size) {
+    if (n == q->deferred_data_size) {
         /* All has been written -- release the memory */
-        free(q->begin_defered_data);
+        free(q->begin_deferred_data);
-        q->begin_defered_data = NULL;
+        q->begin_deferred_data = NULL;
-        q->defered_data = NULL;
+        q->deferred_data = NULL;
-        q->defered_data_size = 0;
+        q->deferred_data_size = 0;
     } else {
         /* There is data left */
-        q->defered_data += n;
+        q->deferred_data += n;
-        q->defered_data_size -= n;
+        q->deferred_data_size -= n;
     }
 
-
     return n;
 }
 
@@ -174,26 +363,25 @@ void init_cnx(struct connection *cnx)
     memset(cnx, 0, sizeof(*cnx));
     cnx->q[0].fd = -1;
     cnx->q[1].fd = -1;
+    cnx->proto = get_first_protocol();
 }
 
 void dump_connection(struct connection *cnx)
 {
     printf("state: %d\n", cnx->state);
-    printf("fd %d, %d defered\n", cnx->q[0].fd, cnx->q[0].defered_data_size);
+    printf("fd %d, %d deferred\n", cnx->q[0].fd, cnx->q[0].deferred_data_size);
-    printf("fd %d, %d defered\n", cnx->q[1].fd, cnx->q[1].defered_data_size);
+    printf("fd %d, %d deferred\n", cnx->q[1].fd, cnx->q[1].deferred_data_size);
 }
 
 
-/* 
+/*
  * moves data from one fd to other
  *
- * retuns number of bytes copied if success
+ * returns number of bytes copied if success
  * returns 0 (FD_CNXCLOSED) if incoming socket closed
  * returns FD_NODATA if no data was available
  * returns FD_STALLED if data was read, could not be written, and has been
  * stored in temporary buffer.
- *
- * slot for debug only and may go away at some point
  */
 int fd2fd(struct queue *target_q, struct queue *from_q)
 {
@@ -224,7 +412,7 @@ int fd2fd(struct queue *target_q, struct queue *from_q)
 
    size_w = write(target, buffer, size_r);
    /* process -1 when we know how to deal with it */
-   if ((size_w == -1)) {
+   if (size_w == -1) {
        switch (errno) {
        case EAGAIN:
            /* write blocked: Defer data */
@@ -254,16 +442,16 @@ char* sprintaddr(char* buf, size_t size, struct addrinfo *a)
    int res;
 
    res = getnameinfo(a->ai_addr, a->ai_addrlen,
-               host, sizeof(host), 
+               host, sizeof(host),
-               serv, sizeof(serv), 
+               serv, sizeof(serv),
                numeric ? NI_NUMERICHOST | NI_NUMERICSERV : 0 );
 
    if (res) {
        log_message(LOG_ERR, "sprintaddr:getnameinfo: %s\n", gai_strerror(res));
        /* Name resolution failed: do it numerically instead */
        res = getnameinfo(a->ai_addr, a->ai_addrlen,
-                         host, sizeof(host), 
+                         host, sizeof(host),
-                         serv, sizeof(serv), 
+                         serv, sizeof(serv),
                          NI_NUMERICHOST | NI_NUMERICSERV);
        /* should not fail but... */
        if (res) {
@@ -278,21 +466,45 @@ char* sprintaddr(char* buf, size_t size, struct addrinfo *a)
    return buf;
 }
 
-/* Turns a hostname and port (or service) into a list of struct addrinfo 
+/* Turns a hostname and port (or service) into a list of struct addrinfo
  * returns 0 on success, -1 otherwise and logs error
- **/
+ */
-int resolve_split_name(struct addrinfo **out, const char* host, const char* serv)
+int resolve_split_name(struct addrinfo **out, const char* ct_host, const char* serv)
 {
    struct addrinfo hint;
+   char *end;
    int res;
+   char* host, *host_base;
 
    memset(&hint, 0, sizeof(hint));
    hint.ai_family = PF_UNSPEC;
    hint.ai_socktype = SOCK_STREAM;
 
+   /* Copy parameter so not to clobber data in libconfig */
+   res = asprintf(&host_base, "%s", ct_host);
+   if (res == -1) {
+       log_message(LOG_ERR, "asprintf: cannot allocate memory");
+       return -1;
+   }
+
+   host = host_base;
+
+   /* If it is a RFC-Compliant IPv6 address ("[1234::12]:443"), remove brackets
+    * around IP address */
+   if (host[0] == '[') {
+       end = strrchr(host, ']');
+       if (!end) {
+           fprintf(stderr, "%s: no closing bracket in IPv6 address?\n", host);
+           return -1;
+       }
+       host++; /* skip first bracket */
+       *end = 0; /* remove last bracket */
+   }
+
    res = getaddrinfo(host, serv, &hint, out);
    if (res)
       log_message(LOG_ERR, "%s `%s:%s'\n", gai_strerror(res), host, serv);
+   free(host_base);
    return res;
 }
 
@@ -305,18 +517,17 @@ void resolve_name(struct addrinfo **out, char* fullname)
    char *serv, *host;
    int res;
 
+   /* Find port */
    char *sep = strrchr(fullname, ':');
-
+   if (!sep) { /* No separator: parameter is just a port */
-   if (!sep) /* No separator: parameter is just a port */
-   {
       fprintf(stderr, "%s: names must be fully specified as hostname:port\n", fullname);
       exit(1);
    }
-
-   host = fullname;
    serv = sep+1;
    *sep = 0;
 
+   host = fullname;
+
    res = resolve_split_name(out, host, serv);
    if (res) {
       fprintf(stderr, "%s `%s'\n", gai_strerror(res), fullname);
@@ -349,11 +560,15 @@ void log_connection(struct connection *cnx)
         local[MAX_NAMELENGTH], target[MAX_NAMELENGTH];
     int res;
 
+    if (cnx->proto->log_level < 1)
+        return;
+
     addr.ai_addr = (struct sockaddr*)&ss;
     addr.ai_addrlen = sizeof(ss);
 
     res = getpeername(cnx->q[0].fd, addr.ai_addr, &addr.ai_addrlen);
-    if (res == -1) return; /* that should never happen, right? */
+    if (res == -1) return; /* Can happen if connection drops before we get here.
+                               In that case, don't log anything (there is no connection) */
     sprintaddr(peer, sizeof(peer), &addr);
 
     addr.ai_addrlen = sizeof(ss);
@@ -371,7 +586,8 @@ void log_connection(struct connection *cnx)
     if (res == -1) return;
     sprintaddr(local, sizeof(local), &addr);
 
-    log_message(LOG_INFO, "connection from %s to %s forwarded from %s to %s\n",
+    log_message(LOG_INFO, "%s:connection from %s to %s forwarded from %s to %s\n",
+                cnx->proto->description,
                 peer,
                 service,
                 local,
@@ -388,16 +604,19 @@ void log_connection(struct connection *cnx)
 int check_access_rights(int in_socket, const char* service)
 {
 #ifdef LIBWRAP
-    struct sockaddr peeraddr;
+    union {
-    socklen_t size = sizeof(peeraddr);
+        struct sockaddr saddr;
+        struct sockaddr_storage ss;
+    } peer;
+    socklen_t size = sizeof(peer);
     char addr_str[NI_MAXHOST], host[NI_MAXHOST];
     int res;
 
-    res = getpeername(in_socket, &peeraddr, &size);
+    res = getpeername(in_socket, &peer.saddr, &size);
-    CHECK_RES_DIE(res, "getpeername");
+    CHECK_RES_RETURN(res, "getpeername");
 
     /* extract peer address */
-    res = getnameinfo(&peeraddr, size, addr_str, sizeof(addr_str), NULL, 0, NI_NUMERICHOST);
+    res = getnameinfo(&peer.saddr, size, addr_str, sizeof(addr_str), NULL, 0, NI_NUMERICHOST);
     if (res) {
         if (verbose)
             fprintf(stderr, "getnameinfo(NI_NUMERICHOST):%s\n", gai_strerror(res));
@@ -406,7 +625,7 @@ int check_access_rights(int in_socket, const char* service)
     /* extract peer name */
     strcpy(host, STRING_UNKNOWN);
     if (!numeric) {
-        res = getnameinfo(&peeraddr, size, host, sizeof(host), NULL, 0, NI_NAMEREQD);
+        res = getnameinfo(&peer.saddr, size, host, sizeof(host), NULL, 0, NI_NAMEREQD);
         if (res) {
             if (verbose)
                 fprintf(stderr, "getnameinfo(NI_NAMEREQD):%s\n", gai_strerror(res));
@@ -437,7 +656,7 @@ void setup_signals(void)
     res = sigaction(SIGCHLD, &action, NULL);
     CHECK_RES_DIE(res, "sigaction");
 
-    /* Set SIGTERM to exit. For some reason if it's not set explicitely,
+    /* Set SIGTERM to exit. For some reason if it's not set explicitly,
      * coverage information is lost when killing the process */
     memset(&action, 0, sizeof(action));
     action.sa_handler = exit;
@@ -451,36 +670,123 @@ void setup_signals(void)
 
 }
 
-/* Open syslog connection with appropriate banner; 
+/* Open syslog connection with appropriate banner;
  * banner is made up of basename(bin_name)+"[pid]" */
 void setup_syslog(const char* bin_name) {
     char *name1, *name2;
+    int res, fn;
 
     name1 = strdup(bin_name);
-    asprintf(&name2, "%s[%d]", basename(name1), getpid());
+    res = asprintf(&name2, "%s[%d]", basename(name1), getpid());
-    openlog(name2, LOG_CONS, LOG_AUTH);
+    CHECK_RES_DIE(res, "asprintf");
-    free(name1); 
+
+    for (fn = 0; facilitynames[fn].c_val != -1; fn++)
+        if (strcmp(facilitynames[fn].c_name, facility) == 0)
+            break;
+    if (facilitynames[fn].c_val == -1) {
+        fprintf(stderr, "Unknown facility %s\n", facility);
+        exit(1);
+    }
+
+    openlog(name2, LOG_CONS, facilitynames[fn].c_val);
+    free(name1);
     /* Don't free name2, as openlog(3) uses it (at least in glibc) */
 
     log_message(LOG_INFO, "%s %s started\n", server_type, VERSION);
 }
 
-/* We don't want to run as root -- drop priviledges if required */
+/* Ask OS to keep capabilities over a setuid(nonzero) */
-void drop_privileges(const char* user_name)
+void set_keepcaps(int val) {
+#ifdef LIBCAP
+    int res;
+    res = prctl(PR_SET_KEEPCAPS, val, 0, 0, 0);
+    if (res) {
+        perror("prctl");
+        exit(1);
+    }
+#endif
+}
+
+/* set needed capabilities for effective and permitted, clear rest */
+void set_capabilities(void) {
+#ifdef LIBCAP
+    int res;
+    cap_t caps;
+    cap_value_t cap_list[10];
+    int ncap = 0;
+
+    if (transparent)
+        cap_list[ncap++] = CAP_NET_ADMIN;
+
+    caps = cap_init();
+
+#define _cap_set_flag(flag) do { \
+        res = cap_clear_flag(caps, flag); \
+        CHECK_RES_DIE(res, "cap_clear_flag(" #flag ")"); \
+        if (ncap > 0) { \
+            res = cap_set_flag(caps, flag, ncap, cap_list, CAP_SET); \
+            CHECK_RES_DIE(res, "cap_set_flag(" #flag ")"); \
+        } \
+    } while(0)
+
+    _cap_set_flag(CAP_EFFECTIVE);
+    _cap_set_flag(CAP_PERMITTED);
+
+#undef _cap_set_flag
+
+    res = cap_set_proc(caps);
+    CHECK_RES_DIE(res, "cap_set_proc");
+
+    res = cap_free(caps);
+    if (res) {
+        perror("cap_free");
+        exit(1);
+    }
+#endif
+}
+
+/* We don't want to run as root -- drop privileges if required */
+void drop_privileges(const char* user_name, const char* chroot_path)
 {
     int res;
-    struct passwd *pw = getpwnam(user_name);
+    struct passwd *pw = NULL;
-    if (!pw) {
-        fprintf(stderr, "%s: not found\n", user_name);
-        exit(2);
-    }
-    if (verbose)
-        fprintf(stderr, "turning into %s\n", user_name);
 
-    res = setgid(pw->pw_gid);
+    if (user_name) {
-    CHECK_RES_DIE(res, "setgid");
+        pw = getpwnam(user_name);
-    setuid(pw->pw_uid);
+        if (!pw) {
-    CHECK_RES_DIE(res, "setuid");
+            fprintf(stderr, "%s: not found\n", user_name);
+            exit(2);
+        }
+        if (verbose)
+            fprintf(stderr, "turning into %s\n", user_name);
+    }
+
+    if (chroot_path) {
+        if (verbose)
+            fprintf(stderr, "chrooting into %s\n", chroot_path);
+
+        res = chroot(chroot_path);
+        CHECK_RES_DIE(res, "chroot");
+    }
+
+    if (user_name) {
+        set_keepcaps(1);
+
+        /* remove extraneous groups in case we belong to several extra groups
+         * that may have unwanted rights. If non-root when calling setgroups(),
+         * it fails, which is fine because... we have no unwanted rights
+         * (see POS36-C for security context)
+         * */
+        setgroups(0, NULL);
+
+        res = setgid(pw->pw_gid);
+        CHECK_RES_DIE(res, "setgid");
+        res = setuid(pw->pw_uid);
+        CHECK_RES_DIE(res, "setuid");
+
+        set_capabilities();
+        set_keepcaps(0);
+    }
 }
 
 /* Writes my PID */

common.h

@@ -1,6 +1,12 @@
-#ifndef __COMMON_H_
+#ifndef COMMON_H
-#define __COMMON_H_
+#define COMMON_H
 
+/* FD_SETSIZE is 64 on Cygwin, which is really low. Just redefining it is
+ * enough for the macros to adapt (http://support.microsoft.com/kb/111855)
+ */
+#ifdef __CYGWIN__
+#define FD_SETSIZE 4096
+#endif
 
 #define _GNU_SOURCE
 #include <sys/types.h>
@@ -22,22 +28,33 @@
 #include <time.h>
 #include <getopt.h>
 
-#ifndef VERSION
+#ifdef LIBCAP
-#define VERSION "v?"
+#include <sys/prctl.h>
+#include <sys/capability.h>
 #endif
 
+#include "version.h"
+
 #define CHECK_RES_DIE(res, str) \
     if (res == -1) {    \
+       fprintf(stderr, "%s:%d:", __FILE__, __LINE__); \
        perror(str);     \
        exit(1);         \
     }
 
 #define CHECK_RES_RETURN(res, str) \
     if (res == -1) {                                    \
-        log_message(LOG_CRIT, "%s: %d\n", str, errno);  \
+        log_message(LOG_CRIT, "%s:%d:%s:%d:%s\n", __FILE__, __LINE__, str, errno, strerror(errno));  \
         return res;                                     \
     } 
 
+#define CHECK_ALLOC(a, str) \
+    if (!a) { \
+        fprintf(stderr, "%s:%d:", __FILE__, __LINE__); \
+        perror(str); \
+        exit(1); \
+    }
+
 #define ARRAY_SIZE(a) (sizeof(a) / sizeof(a[0]))
 
 #if 1
@@ -46,6 +63,10 @@
 #define TRACE
 #endif
 
+#ifndef IP_FREEBIND
+#define IP_FREEBIND 0
+#endif
+
 enum connection_state {
     ST_PROBING=1,    /* Waiting for timeout to find where to forward */
     ST_SHOVELING   /* Connexion is established */
@@ -55,17 +76,18 @@ enum connection_state {
 #define PROT_SHIFT 1000  /* protocol options will be 1000, 1001, etc */
 
 /* A 'queue' is composed of a file descriptor (which can be read from or
- * written to), and a queue for defered write data */
+ * written to), and a queue for deferred write data */
 struct queue {
     int fd;
-    void *begin_defered_data;
+    void *begin_deferred_data;
-    void *defered_data;
+    void *deferred_data;
-    int defered_data_size;
+    int deferred_data_size;
 };
 
 struct connection {
     enum connection_state state;
     time_t probe_timeout;
+    struct proto *proto;
 
     /* q[0]: queue for external connection (client);
      * q[1]: queue for internal connection (httpd or sshd);
@@ -80,16 +102,15 @@ struct connection {
 
 /* common.c */
 void init_cnx(struct connection *cnx);
-int connect_addr(struct addrinfo *addr, const char* cnx_name);
+int connect_addr(struct connection *cnx, int fd_from);
 int fd2fd(struct queue *target, struct queue *from);
 char* sprintaddr(char* buf, size_t size, struct addrinfo *a);
 void resolve_name(struct addrinfo **out, char* fullname);
-struct proto* probe_client_protocol(struct connection *cnx);
 void log_connection(struct connection *cnx);
 int check_access_rights(int in_socket, const char* service);
 void setup_signals(void);
 void setup_syslog(const char* bin_name);
-void drop_privileges(const char* user_name);
+void drop_privileges(const char* user_name, const char* chroot_path);
 void write_pid_file(const char* pidfile);
 void log_message(int type, char* msg, ...);
 void dump_connection(struct connection *cnx);
@@ -98,13 +119,14 @@ int resolve_split_name(struct addrinfo **out, const char* hostname, const char*
 int start_listen_sockets(int *sockfd[], struct addrinfo *addr_list);
 
 int defer_write(struct queue *q, void* data, int data_size);
-int flush_defered(struct queue *q);
+int flush_deferred(struct queue *q);
 
-extern int probing_timeout, verbose, inetd, foreground, numeric;
+extern int probing_timeout, verbose, inetd, foreground, 
+       background, transparent, numeric;
 extern struct sockaddr_storage addr_ssl, addr_ssh, addr_openvpn;
 extern struct addrinfo *addr_listen;
 extern const char* USAGE_STRING;
-extern const char* user_name, *pid_file, *rule_filename;
+extern const char* user_name, *pid_file, *chroot_path, *facility;
 extern const char* server_type;
 
 /* sslh-fork.c */

echosrv.c

@@ -94,32 +94,26 @@ void parse_cmdline(int argc, char* argv[])
 
 void start_echo(int fd)
 {
-    fd_set fds;
     int res;
     char buffer[1 << 20];
-    char* ret;
+    int ret, prefix_len;
-    FILE *socket;
 
-    FD_ZERO(&fds);
+    prefix_len = strlen(prefix);
 
-    socket = fdopen(fd, "r+");
+    memset(buffer, 0, sizeof(buffer));
-    if (!socket) {
+    strcpy(buffer, prefix);
-        CHECK_RES_DIE(-1, "fdopen");
-    }
 
     while (1) {
-        ret = fgets(buffer, sizeof(buffer), socket);
+        ret = read(fd, buffer + prefix_len, sizeof(buffer));
-        if (!ret) {
+        if (ret == -1) {
-            fprintf(stderr, "%s", strerror(ferror(socket)));
+            fprintf(stderr, "%s", strerror(errno));
             return;
         }
-        res = fprintf(socket, "%s%s", prefix, buffer);
+        res = write(fd, buffer, ret + prefix_len);
         if (res < 0) {
-            fprintf(stderr, "%s", strerror(ferror(socket)));
+            fprintf(stderr, "%s", strerror(errno));
             return;
         }
-
-        fflush(socket);
     }
 }
 

example.cfg

@@ -1,40 +1,109 @@
-verbose: false;
+# This file is provided as documentation to show what is
+# possible. It should not be used as-is, and probably should
+# not be used as a starting point for a working
+# configuration. Instead use basic.cfg.
+
+verbose: true;
 foreground: true;
 inetd: false;
 numeric: false;
+transparent: false;
 timeout: 2;
 user: "nobody";
 pidfile: "/var/run/sslh.pid";
+chroot: "/var/empty";
 
+# Specify which syslog facility to use (names for your
+# system are usually defined in /usr/include/*/sys/syslog.h
+# or equivalent)
+# Default is "auth"
+syslog_facility: "auth"; 
 
 # List of interfaces on which we should listen
+# Options:
 listen:
 (
-    { host: "thelonious"; port: "443"; }
+    { host: "thelonious"; port: "443"; },
-#    , { host: "thelonious"; port: "8080"; }
+    { host: "thelonious"; port: "8080"; keepalive: true; }
 );
 
 # List of protocols
 #
 # Each protocol entry consists of:
-#   name: name of the protocol
+#   name: name of the probe. These are listed on the command
-#   service: (optional) libwrap service name (see hosts_access(5))
+#   line (ssh -?), plus 'regex' and 'timeout'.
-#   host: host name to connect that protocol
-#   port: port number to connect that protocol
-#   probe: "builtin" or a list of regular expressions
-#   
-# In case of timeout sslh will connect to the first
-# protocol: this should be SSH.
-# SSL should have a "always true" probe, and come last.
-# sslh will try each probe in order they are declared, and
-# connect to the first that matches.
 
+#   service: (optional) libwrap service name (see hosts_access(5))
+#   host, port: where to connect when this probe succeeds
+#   log_level:  0 to turn off logging
+#               1 to log each incoming connection
+#   keepalive:  Should TCP keepalive be on or off for that
+#               connection (default is off)
+#   fork: Should a new process be forked for this protocol?
+#         (only useful for sslh-select)
+#
+#  Probe-specific options:
+# (sslh will try each probe in order they are declared, and
+# connect to the first that matches.)
+#
+#       tls:
+#               sni_hostnames:  list of FQDN for that target
+#               alpn_protocols: list of ALPN protocols for that target, see:
+#               https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#alpn-protocol-ids
+#
+#               if both sni_hostnames AND alpn_protocols are specified, both must match
+#
+#               if neither are set, it is just checked whether this is the TLS protocol or not
+#
+#               Obviously set the most specific probes
+#               first, and if you use TLS with no ALPN/SNI
+#               set it as the last TLS probe
+#       regex:
+#               regex_patterns: list of patterns to match for
+#               that target.
+#   
+# You can specify several of 'regex' and 'tls'.
+ 
 protocols:
 (
-     { name: "ssh"; service: "ssh"; host: "localhost"; port: "22"; probe: "builtin"; },
+     { name: "ssh"; service: "ssh"; host: "localhost"; port: "22"; keepalive: true; fork: true; },
-     { name: "openvpn"; host: "localhost"; port: "1194"; probe: [ "^\x00[\x0D-\xFF]$", "^\x00[\x0D-\xFF]\x38" ]; },
+     { name: "http"; host: "localhost"; port: "80"; },
-     { name: "xmpp"; host: "localhost"; port: "5222"; probe: [ "jabber" ]; },
+
-     { name: "http"; host: "localhost"; port: "80"; probe: "builtin"; },
+# match BOTH ALPN/SNI
-     { name: "ssl"; host: "localhost"; port: "443"; probe: [ "" ]; }
+     { name: "tls"; host: "localhost"; port: "5223"; alpn_protocols: [ "xmpp-client" ]; sni_hostnames: [ "im.somethingelse.net" ]; log_level: 0;},
+
+# just match ALPN
+     { name: "tls"; host: "localhost"; port: "443"; alpn_protocols: [ "h2", "http/1.1", "spdy/1", "spdy/2", "spdy/3" ]; log_level: 0; },
+     { name: "tls"; host: "localhost"; port: "xmpp-client"; alpn_protocols: [ "xmpp-client" ];  log_level: 0;},
+
+# just match SNI
+     { name: "tls"; host: "localhost"; port: "993"; sni_hostnames: [ "mail.rutschle.net", "mail.englishintoulouse.com" ]; log_level: 0; },
+     { name: "tls"; host: "localhost"; port: "xmpp-client"; sni_hostnames: [ "im.rutschle.net", "im.englishintoulouse.com" ];  log_level: 0;},
+
+# Let's Encrypt (tls-sni-* challenges)
+     { name: "tls"; host: "localhost"; port: "letsencrypt-client"; sni_hostnames: [ "*.*.acme.invalid" ];  log_level: 0;},
+
+# catch anything else TLS
+     { name: "tls"; host: "localhost"; port: "443"; },
+
+# Regex examples -- better use the built-in probes for real-world use!
+# OpenVPN
+     { name: "regex"; host: "localhost"; port: "1194"; regex_patterns: [ "^\x00[\x0D-\xFF]$", "^\x00[\x0D-\xFF]\x38" ]; },
+# Jabber
+     { name: "regex"; host: "localhost"; port: "5222"; regex_patterns: [ "jabber" ]; },
+    
+# Catch-all
+     { name: "regex"; host: "localhost"; port: "443"; regex_patterns: [ "" ]; },
+
+# Where to connect in case of timeout (defaults to ssh)
+     { name: "timeout"; service: "daytime"; host: "localhost"; port: "daytime"; }
 );
 
+# Optionally, specify to which protocol to connect in case
+# of timeout (defaults to "ssh").
+# You can timeout to any arbitrary address by setting an
+# entry in 'protocols' named "timeout".
+# This enables you to set a tcpd service name for this
+# protocol too.
+on-timeout: "timeout";
+

genver.sh

@@ -0,0 +1,49 @@
+#! /bin/sh
+
+if [ ${#} -eq 1 ] && [ "x$1" = "x-r" ]; then
+	# release text only
+	QUIET=1
+else
+	QUIET=0
+fi
+
+if ! `(git status | grep -q "On branch") 2> /dev/null`; then
+        # If we don't have git, we can't work out what
+        # version this is. It must have been downloaded as a
+        # zip file. 
+        
+        # If downloaded from the release page, the directory
+        # has the version number.
+        release=`pwd | sed s/.*sslh-// | grep "[[:digit:]]"`
+        
+        if [ "x$release" = "x" ]; then
+            # If downloaded from the head, Github creates the
+            # zip file with all files dated from the last
+            # change: use the Makefile's modification time as a
+            # release number
+            release=head-`perl -MPOSIX -e 'print strftime "%Y-%m-%d",localtime((stat "Makefile")[9])'`
+        fi
+fi
+
+if head=`git rev-parse --verify HEAD 2>/dev/null`; then
+	# generate the version info based on the tag
+	release=`(git describe --tags || git --describe || git describe --all --long) \
+		2>/dev/null | tr -d '\n'`
+
+	# Are there uncommitted changes?
+	git update-index --refresh --unmerged > /dev/null
+	if git diff-index --name-only HEAD | grep -v "^scripts/package" \
+	    | read dummy; then
+		release="$release-dirty"
+	fi
+fi
+
+
+if [ $QUIET -ne 1 ]; then
+	printf "#ifndef VERSION_H \n"
+	printf "#define VERSION_H \n\n"
+	printf "#define VERSION \"$release\"\n"
+	printf "#endif\n"
+else
+	printf "$release\n"
+fi

probe.c

@@ -1,7 +1,7 @@
 /*
 # probe.c: Code for probing protocols
 #
-# Copyright (C) 2007-2012  Yves Rutschle
+# Copyright (C) 2007-2015  Yves Rutschle
 # 
 # This program is free software; you can redistribute it
 # and/or modify it under the terms of the GNU General Public
@@ -19,7 +19,16 @@
 # http://www.gnu.org/licenses/gpl.html
 */
 
+#define _GNU_SOURCE
+#include <stdio.h>
+#ifdef ENABLE_REGEX
+#ifdef LIBPCRE
+#include <pcreposix.h>
+#else
 #include <regex.h>
+#endif
+#endif
+#include <ctype.h>
 #include "probe.h"
 
 
@@ -29,21 +38,28 @@ static int is_openvpn_protocol(const char *p, int len, struct proto*);
 static int is_tinc_protocol(const char *p, int len, struct proto*);
 static int is_xmpp_protocol(const char *p, int len, struct proto*);
 static int is_http_protocol(const char *p, int len, struct proto*);
+static int is_tls_protocol(const char *p, int len, struct proto*);
+static int is_adb_protocol(const char *p, int len, struct proto*);
+static int is_socks5_protocol(const char *p, int len, struct proto*);
 static int is_true(const char *p, int len, struct proto* proto) { return 1; }
 
 /* Table of protocols that have a built-in probe
  */
 static struct proto builtins[] = {
-    /* description   service  saddr   probe  */
+    /* description   service  saddr  log_level  keepalive  fork  probe  */
-    { "ssh",         "sshd",   NULL,   is_ssh_protocol},
+    { "ssh",         "sshd",   NULL,  1,        0,         1,    is_ssh_protocol},
-    { "openvpn",     NULL,     NULL,   is_openvpn_protocol },
+    { "openvpn",     NULL,     NULL,  1,        0,         1,    is_openvpn_protocol },
-    { "tinc",        NULL,     NULL,   is_tinc_protocol },
+    { "tinc",        NULL,     NULL,  1,        0,         1,    is_tinc_protocol },
-    { "xmpp",        NULL,     NULL,   is_xmpp_protocol },
+    { "xmpp",        NULL,     NULL,  1,        0,         0,    is_xmpp_protocol },
-    { "http",        NULL,     NULL,   is_http_protocol },
+    { "http",        NULL,     NULL,  1,        0,         0,    is_http_protocol },
-    { "ssl",          NULL,     NULL,  is_true }
+    { "tls",         NULL,     NULL,  1,        0,         0,    is_tls_protocol },
+    { "adb",         NULL,     NULL,  1,        0,         0,    is_adb_protocol },
+    { "socks5",      NULL,     NULL,  1,        0,         0,    is_socks5_protocol },
+    { "anyprot",     NULL,     NULL,  1,        0,         0,    is_true }
 };
 
 static struct proto *protocols;
+static char* on_timeout = "ssh";
 
 struct proto*  get_builtins(void) {
     return builtins;
@@ -53,12 +69,22 @@ int get_num_builtins(void) {
     return ARRAY_SIZE(builtins);
 }
 
-/* Returns the protocol to connect to in case of timeout; conventionaly this is
+/* Sets the protocol name to connect to in case of timeout */
- * the first protocol specified (but maybe we'll make it more explicit some
+void set_ontimeout(const char* name)
- * day)
+{
+    int res = asprintf(&on_timeout, "%s", name);
+    CHECK_RES_DIE(res, "asprintf");
+}
+
+/* Returns the protocol to connect to in case of timeout; 
+ * if not found, return the first protocol specified 
  */
-struct proto* timeout_protocol(void) {
+struct proto* timeout_protocol(void) 
-    return protocols;
+{
+    struct proto* p = get_first_protocol();
+    for (; p && strcmp(p->description, on_timeout); p = p->next);
+    if (p) return p;
+    return get_first_protocol();
 }
 
 /* returns the first protocol (caller can then follow the *next pointers) */
@@ -72,41 +98,78 @@ void set_protocol_list(struct proto* prots)
     protocols = prots;
 }
 
+/* From http://grapsus.net/blog/post/Hexadecimal-dump-in-C */
+#define HEXDUMP_COLS 16
+void hexdump(const char *mem, unsigned int len)
+{
+    unsigned int i, j;
+
+    for(i = 0; i < len + ((len % HEXDUMP_COLS) ? (HEXDUMP_COLS - len % HEXDUMP_COLS) : 0); i++)
+    {
+        /* print offset */
+        if(i % HEXDUMP_COLS == 0)
+            fprintf(stderr, "0x%06x: ", i);
+
+        /* print hex data */
+        if(i < len)
+            fprintf(stderr, "%02x ", 0xFF & mem[i]);
+        else /* end of block, just aligning for ASCII dump */
+            fprintf(stderr, "   ");
+
+        /* print ASCII dump */
+        if(i % HEXDUMP_COLS == (HEXDUMP_COLS - 1)) {
+            for(j = i - (HEXDUMP_COLS - 1); j <= i; j++) {
+                if(j >= len) /* end of block, not really printing */
+                    fputc(' ', stderr);
+                else if(isprint(mem[j])) /* printable char */
+                    fputc(0xFF & mem[j], stderr);
+                else /* other char */
+                    fputc('.', stderr);
+            }
+            fputc('\n', stderr);
+        }
+    }
+}
+
 /* Is the buffer the beginning of an SSH connection? */
 static int is_ssh_protocol(const char *p, int len, struct proto *proto)
 {
-    if (!strncmp(p, "SSH-", 4)) {
+    if (len < 4)
-        return 1;
+        return PROBE_AGAIN;
-    }
+
-    return 0;
+    return !strncmp(p, "SSH-", 4);
 }
 
 /* Is the buffer the beginning of an OpenVPN connection?
- * (code lifted from OpenVPN port-share option)
+ *
+ * Code inspired from OpenVPN port-share option; however, OpenVPN code is
+ * wrong: users using pre-shared secrets have non-initialised key_id fields so
+ * p[3] & 7 should not be looked at, and also the key_method can be specified
+ * to 1 which changes the opcode to P_CONTROL_HARD_RESET_CLIENT_V1.
+ * See:
+ * http://www.fengnet.com/book/vpns%20illustrated%20tunnels%20%20vpnsand%20ipsec/ch08lev1sec5.html
+ * and OpenVPN ssl.c, ssl.h and options.c
  */
 static int is_openvpn_protocol (const char*p,int len, struct proto *proto)
 {
-#define P_OPCODE_SHIFT                 3
+    int packet_len;
-#define P_CONTROL_HARD_RESET_CLIENT_V2 7
+
-    if (len >= 3)
+    if (len < 2)
-    {
+        return PROBE_AGAIN;
-        return p[0] == 0
+
-            && p[1] >= 14
+    packet_len = ntohs(*(uint16_t*)p);
-            && p[2] == (P_CONTROL_HARD_RESET_CLIENT_V2<<P_OPCODE_SHIFT);
+    return packet_len == len - 2;
-    }
-    else if (len >= 2)
-    {
-        return p[0] == 0 && p[1] >= 14;
-    }
-    else
-        return 0;
 }
 
 /* Is the buffer the beginning of a tinc connections?
- * (protocol is undocumented, but starts with "0 " in 1.0.15)
+ * Protocol is documented here: http://www.tinc-vpn.org/documentation/tinc.pdf
+ * First connection starts with "0 " in 1.0.15)
  * */
 static int is_tinc_protocol( const char *p, int len, struct proto *proto)
 {
+    if (len < 2)
+        return PROBE_AGAIN;
+
     return !strncmp(p, "0 ", 2);
 }
 
@@ -116,61 +179,173 @@ static int is_tinc_protocol( const char *p, int len, struct proto *proto)
  * */
 static int is_xmpp_protocol( const char *p, int len, struct proto *proto)
 {
-    return strstr(p, "jabber") ? 1 : 0;
+    if (memmem(p, len, "jabber", 6))
+        return PROBE_MATCH;
+
+    /* sometimes the word 'jabber' shows up late in the initial string,
+       sometimes after a newline. this makes sure we snarf the entire preamble
+       and detect it. (fixed for adium/pidgin) */
+    if (len < 50)
+        return PROBE_AGAIN;
+
+    return PROBE_NEXT;
 }
 
-static int probe_http_method(const char *p, const char *opt)
+static int probe_http_method(const char *p, int len, const char *opt)
 {
-    return !strcmp(p, opt);
+    if (len < strlen(opt))
+        return PROBE_AGAIN;
+
+    return !strncmp(p, opt, strlen(opt));
 }
 
 /* Is the buffer the beginning of an HTTP connection?  */
 static int is_http_protocol(const char *p, int len, struct proto *proto)
 {
+    int res;
     /* If it's got HTTP in the request (HTTP/1.1) then it's HTTP */
-    if (strstr(p, "HTTP"))
+    if (memmem(p, len, "HTTP", 4))
-        return 1;
+        return PROBE_MATCH;
+
+#define PROBE_HTTP_METHOD(opt) if ((res = probe_http_method(p, len, opt)) != PROBE_NEXT) return res
 
     /* Otherwise it could be HTTP/1.0 without version: check if it's got an
      * HTTP method (RFC2616 5.1.1) */
-    probe_http_method(p, "OPTIONS");
+    PROBE_HTTP_METHOD("OPTIONS");
-    probe_http_method(p, "GET");
+    PROBE_HTTP_METHOD("GET");
-    probe_http_method(p, "HEAD");
+    PROBE_HTTP_METHOD("HEAD");
-    probe_http_method(p, "POST");
+    PROBE_HTTP_METHOD("POST");
-    probe_http_method(p, "PUT");
+    PROBE_HTTP_METHOD("PUT");
-    probe_http_method(p, "DELETE");
+    PROBE_HTTP_METHOD("DELETE");
-    probe_http_method(p, "TRACE");
+    PROBE_HTTP_METHOD("TRACE");
-    probe_http_method(p, "CONNECT");
+    PROBE_HTTP_METHOD("CONNECT");
 
-    return 0;
+#undef PROBE_HTTP_METHOD
+
+    return PROBE_NEXT;
 }
 
+/* Says if it's TLS, optionally with SNI and ALPN lists in proto->data */
+static int is_tls_protocol(const char *p, int len, struct proto *proto)
+{
+    switch (parse_tls_header(proto->data, p, len)) {
+    case TLS_MATCH: return PROBE_MATCH;
+    case TLS_NOMATCH: return PROBE_NEXT;
+    case TLS_ELENGTH: return PROBE_AGAIN;
+    default: return PROBE_NEXT;
+    }
+}
+
+static int probe_adb_cnxn_message(const char *p)
+{
+    /* The initial ADB host->device packet has a command type of CNXN, and a
+     * data payload starting with "host:".  Note that current versions of the
+     * client hardcode "host::" (with empty serialno and banner fields) but
+     * other clients may populate those fields.
+     */
+    return !memcmp(&p[0], "CNXN", 4) && !memcmp(&p[24], "host:", 5);
+}
+
+static int is_adb_protocol(const char *p, int len, struct proto *proto)
+{
+    /* amessage.data_length is not being checked, under the assumption that
+     * a packet >= 30 bytes will have "something" in the payload field.
+     *
+     * 24 bytes for the message header and 5 bytes for the "host:" tag.
+     *
+     * ADB protocol:
+     * https://android.googlesource.com/platform/system/adb/+/master/protocol.txt
+     */
+    static const unsigned int min_data_packet_size = 30;
+
+    if (len < min_data_packet_size)
+        return PROBE_AGAIN;
+
+    if (probe_adb_cnxn_message(&p[0]) == PROBE_MATCH)
+        return PROBE_MATCH;
+
+    /* In ADB v26.0.0 rc1-4321094, the initial host->device packet sends an
+     * empty message before sending the CNXN command type. This was an
+     * unintended side effect introduced in
+     * https://android-review.googlesource.com/c/342653, and will be reverted for
+     * a future release.
+     */
+    static const unsigned char empty_message[] = {
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff
+    };
+
+    if (len < min_data_packet_size + sizeof(empty_message))
+        return PROBE_AGAIN;
+
+    if (memcmp(&p[0], empty_message, sizeof(empty_message)))
+        return PROBE_NEXT;
+
+    return probe_adb_cnxn_message(&p[sizeof(empty_message)]);
+}
+
+static int is_socks5_protocol(const char *p_in, int len, struct proto *proto)
+{
+    unsigned char* p = (unsigned char*)p_in;
+    int i;
+
+    if (len < 2)
+        return PROBE_AGAIN;
+
+    /* First byte should be socks protocol version */
+    if (p[0] != 5)
+        return PROBE_NEXT;
+
+    /* Second byte should be number of supported 
+     * authentication methods, assuming maximum of 10,
+     * as defined in https://www.iana.org/assignments/socks-methods/socks-methods.xhtml
+     */
+    char m_count = p[1];
+    if (m_count < 1 || m_count > 10)
+        return PROBE_NEXT;
+
+    if (len < 2 + m_count)
+        return PROBE_AGAIN;
+
+    /* Each authentication method number should be in range 0..9 
+     * (https://www.iana.org/assignments/socks-methods/socks-methods.xhtml)
+     */
+    for (i = 0; i < m_count; i++) {
+        if (p[2 + i] > 9)
+            return PROBE_NEXT;
+    }
+    return PROBE_MATCH;
+}
 
 static int regex_probe(const char *p, int len, struct proto *proto)
 {
-    regex_t** probe_list = (regex_t**)(proto->data);
+#ifdef ENABLE_REGEX
-    int i=0;
+    regex_t **probe = proto->data;
+    regmatch_t pos = { 0, len };
 
-    while (probe_list[i]) {
+    for (; *probe && regexec(*probe, p, 0, &pos, REG_STARTEND); probe++)
-        if (!regexec(probe_list[i], p, 0, NULL, 0)) {
+        /* try them all */;
-            return 1;
+
-        }
+    return (*probe != NULL);
-        i++;
+#else
-    }
+    /* Should never happen as we check when loading config file */
-    return 0;
+    fprintf(stderr, "FATAL: regex probe called but not built in\n");
+    exit(5);
+#endif
 }
 
 /* 
  * Read the beginning of data coming from the client connection and check if
- * it's a known protocol. Then leave the data on the defered
+ * it's a known protocol. 
- * write buffer of the connection and returns a pointer to the protocol
+ * Return PROBE_AGAIN if not enough data, or PROBE_MATCH if it succeeded in
- * structure
+ * which case cnx->proto is set to the appropriate protocol.
  */
-struct proto* probe_client_protocol(struct connection *cnx)
+int probe_client_protocol(struct connection *cnx)
 {
     char buffer[BUFSIZ];
-    struct proto *p;
+    struct proto *p, *last_p = cnx->proto;
-    int n;
+    int n, res, again = 0;
 
     n = read(cnx->q[0].fd, buffer, sizeof(buffer));
     /* It's possible that read() returns an error, e.g. if the client
@@ -178,38 +353,77 @@ struct proto* probe_client_protocol(struct connection *cnx)
      * happens, we just connect to the default protocol so the caller of this
      * function does not have to deal with a specific  failure condition (the
      * connection will just fail later normally). */
-    if (n > 0) {
-        defer_write(&cnx->q[1], buffer, n);
 
-        for (p = protocols; p; p = p->next) {
+    if (n > 0) {
-            if (p->probe(buffer, n, p)) {
+        if (verbose > 1) {
-                return p;
+            fprintf(stderr, "hexdump of incoming packet:\n");
-            }
+            hexdump(buffer, n);
         }
+        defer_write(&cnx->q[1], buffer, n);
     }
 
-    /* If none worked, return the first one affected (that's completely
+    for (p = cnx->proto; p; p = p->next) {
-     * arbitrary) */
+        char* probe_str[3] = {"PROBE_NEXT", "PROBE_MATCH", "PROBE_AGAIN"};
-    return protocols;
+        if (! p->probe) continue;
+
+        /* Don't probe last protocol if it is anyprot (and store last protocol) */
+        if (! p->next) {
+            last_p = p;
+            if (!strcmp(p->description, "anyprot"))
+                break;
+        }
+
+        res = p->probe(cnx->q[1].begin_deferred_data, cnx->q[1].deferred_data_size, p);
+        if (verbose) fprintf(stderr, "probing for %s: %s\n", p->description, probe_str[res]);
+
+        if (res == PROBE_MATCH) {
+            cnx->proto = p;
+            return PROBE_MATCH;
+        }
+        if (res == PROBE_AGAIN)
+            again++;
+    }
+    if ((again && (n > 0)) || ((n == -1) && (errno == EAGAIN)))
+        return PROBE_AGAIN;
+
+    /* Everything failed: match the last one */
+    cnx->proto = last_p;
+    return PROBE_MATCH;
+}
+
+/* Returns the structure for specified protocol or NULL if not found */
+static struct proto* get_protocol(const char* description)
+{
+    int i;
+
+    for (i = 0; i < ARRAY_SIZE(builtins); i++) {
+        if (!strcmp(builtins[i].description, description)) {
+            return &builtins[i];
+        }
+    }
+    return NULL;
 }
 
 /* Returns the probe for specified protocol:
  * parameter is the description in builtins[], or "regex" 
  * */
 T_PROBE* get_probe(const char* description) {
-    int i;
+    struct proto* p = get_protocol(description);
+
+    if (p)
+        return p->probe;
 
-    for (i = 0; i < ARRAY_SIZE(builtins); i++) {
-        if (!strcmp(builtins[i].description, description)) {
-            return builtins[i].probe;
-        }
-    }
     /* Special case of "regex" probe (we don't want to set it in builtins
      * because builtins is also used to build the command-line options and
      * regexp is not legal on the command line)*/
     if (!strcmp(description, "regex"))
         return regex_probe;
 
+    /* Special case of "timeout" is allowed as a probe name in the
+     * configuration file even though it's not really a probe */
+    if (!strcmp(description, "timeout"))
+        return is_true;
+
     return NULL;
 }
 

probe.h

@@ -1,9 +1,16 @@
 /* API for probe.c */
 
-#ifndef __PROBE_H_
+#ifndef PROBE_H
-#define __PROBE_H_
+#define PROBE_H
 
 #include "common.h"
+#include "tls.h"
+
+typedef enum {
+    PROBE_NEXT,  /* Enough data, probe failed -- it's some other protocol */
+    PROBE_MATCH, /* Enough data, probe successful -- it's the current protocol */
+    PROBE_AGAIN, /* Not enough data for this probe, try again with more data */
+} probe_result;
 
 struct proto;
 typedef int T_PROBE(const char*, int, struct proto*);
@@ -13,11 +20,17 @@ struct proto {
     const char* description;  /* a string that says what it is (for logging and command-line parsing) */
     const char* service;      /* service name to do libwrap checks */
     struct addrinfo *saddr; /* list of addresses to try and switch that protocol */
+    int log_level;  /* 0: No logging of connection
+                     * 1: Log incoming connection
+                     */
+    int keepalive; /* 0: No keepalive ; 1: Set Keepalive for this connection */
+    int fork; /* 0: Connection can run within shared process ; 1: Separate process required for this connection */
 
     /* function to probe that protocol; parameters are buffer and length
      * containing the data to probe, and a pointer to the protocol structure */
     T_PROBE* probe;
-    void* data;     /* opaque pointer ; used to pass list of regex to regex probe */
+    /* opaque pointer ; used to pass list of regex to regex probe, or TLSProtocol struct to sni/alpn probe */
+    void* data;
     struct proto *next; /* pointer to next protocol in list, NULL if last */
 };
 
@@ -39,11 +52,14 @@ void set_protocol_list(struct proto*);
 /* probe_client_protocol
  *
  * Read the beginning of data coming from the client connection and check if
- * it's a known protocol. Then leave the data on the defered
+ * it's a known protocol. Then leave the data on the deferred
  * write buffer of the connection and returns a pointer to the protocol
  * structure
  */
-struct proto* probe_client_protocol(struct connection *cnx);
+int probe_client_protocol(struct connection *cnx);
+
+/* set the protocol to connect to in case of timeout */
+void set_ontimeout(const char* name);
 
 /* timeout_protocol
  *
@@ -51,4 +67,6 @@ struct proto* probe_client_protocol(struct connection *cnx);
  */
 struct proto* timeout_protocol(void);
 
+void hexdump(const char*, unsigned int);
+
 #endif

scripts/etc.default.sslh

@@ -1,5 +0,0 @@
-LISTEN=ifname:443
-SSH=localhost:22
-SSL=localhost:443
-USER=nobody
-PID=/var/run/sslh.pid

scripts/etc.init.d.sslh

@@ -2,6 +2,8 @@
 
 ### BEGIN INIT INFO
 # Provides:		sslh
+# Required-Start:    $remote_fs $syslog
+# Required-Stop:     $remote_fs $syslog
 # Default-Start:	2 3 4 5
 # Default-Stop:		1
 # Short-Description:	sslh proxy ssl & ssh connections
@@ -25,7 +27,7 @@ DAEMON=$PREFIX/sbin/sslh
 start()
 {
         echo "Start services: sslh"
-        $DAEMON --user ${USER} --pidfile ${PID} --listen ${LISTEN} --ssh ${SSH} --ssl ${SSL}
+        $DAEMON -F/etc/sslh.cfg
         logger -t ${tag} -p ${facility} -i 'Started sslh'
 }
 

scripts/etc.rc.d.init.d.sslh.centos

@@ -1,56 +1,56 @@
 #!/bin/bash
 #
-#       /etc/rc.d/init.d/sslh
+# sslh         Startup script for the SSL/SSH multiplexer
-# sslh          This shell script takes care of starting and stopping
-#               sslh - a daemon switching incoming connection between SSH and SSL/HTTPS servers
 #
-# Author: Andre Krajnik akrajnik@gmail.com
+# chkconfig: - 13 87
-# 2010-03-20
+# description: Sslh accepts connections on specified ports, and forwards
+#              them further based on tests performed on the first data
+#              packet sent by the remote client.
+# processname: sslh
+# config: /etc/sslh.cfg
+# config: /etc/sysconfig/sslh
+# pidfile: /var/run/sslh/sslh.pid
 #
-#
+# Authors:
-# chkconfig: 2345 13 87
+# Andre Krajnik akrajnik@gmail.com - 2010-03-20
-#
+# Julien Thomas julthomas@free.fr - 2013-08-25
-# description: sslh - a daemon switching incoming connection between SSH and SSL/HTTPS servers
 
 # Source function library.
 . /etc/init.d/functions
 
-# ./sslh -p  0.0.0.0:8443 -l 127.0.0.1:443 -s 127.0.0.1:22
-
-SSLH="/usr/local/sbin/sslh"
-PIDFILE="/var/run/sslh"
-
-OPTIONS="--user nobody --pidfile $PIDFILE -p  0.0.0.0:8443 --ssl 127.0.0.1:443 --ssh 127.0.0.1:22"
-
 if [ -f /etc/sysconfig/sslh ]; then
         . /etc/sysconfig/sslh
 fi
 
-start() {
+PROGNAME=sslh
-        echo -n "Starting SSL-SSH-Switch: "
+SSLH=${SSLH:-/usr/sbin/sslh-select}
-        if [ -f $PIDFILE ]; then
+SSLH_LANG=${SSLH_LANG:-C}
-                PID=`cat $PIDFILE`
+CONFIG=${CONFIG:-/etc/sslh.cfg}
-                echo sslh already running: $PID
+PIDFILE=${PIDFILE:-/var/run/sslh/sslh.pid}
-                exit 2;
+LOCKFILE=${LOCKFILE:-/var/lock/subsys/sslh}
-        else
+STOP_TIMEOUT=${STOP_TIMEOUT:-10}
-                daemon  $SSLH $OPTIONS
+RETVAL=0
-                RETVAL=$?
-                echo
-                [ $RETVAL -eq 0 ] && touch $PIDFILE
-                return $RETVAL
-        fi
 
+start() {
+    echo -n "Starting $PROGNAME: "
+    LANG=$SSLH_LANG daemon --pidfile="$PIDFILE" \
+                           ${SSLH_USER:+--user="${SSLH_USER}"} \
+                           "$SSLH" ${CONFIG:+-F "$CONFIG"} "$OPTIONS"
+    RETVAL=$?
+    echo
+    [ $RETVAL = 0 ] && touch "$LOCKFILE"
+    return $RETVAL
 }
 
 stop() {
-        echo -n "Shutting down SSL-SSH-Switch: "
+    echo -n "Stopping $PROGNAME: "
-        echo
+    killproc -p "$PIDFILE" -d "$STOP_TIMEOUT" "$SSLH"
-        killproc sslh
+    RETVAL=$?
-        echo
+    echo
-        rm -f $PIDFILE
+    [ $RETVAL = 0 ] && rm -f "$LOCKFILE" "$PIDFILE"
-        return 0
 }
 
+# See how we were called.
 case "$1" in
     start)
         start
@@ -59,18 +59,17 @@ case "$1" in
         stop
         ;;
     status)
-        status sslh
+        status -p "$PIDFILE" "$SSLH"
+        RETVAL=$?
         ;;
     restart)
         stop
         start
         ;;
     *)
-        echo "Usage:  {start|stop|status|restart}"
+        echo "Usage: $PROGNAME {start|stop|status|restart}"
-        exit 1
+        RETVAL=2
         ;;
 esac
-exit $?
-
-
 
+exit $RETVAL

scripts/etc.sysconfig.sslh

@@ -0,0 +1,36 @@
+#
+# The default processing model uses select
+# A fork model is also available
+#
+#SSLH=/usr/sbin/sslh-select
+
+#
+# If transparent mode is enabled, the following
+# is needed in order to run as sslh user
+#
+#SSLH_USER=sslh
+#setcap cap_net_bind_service,cap_net_admin=+ep $SSLH
+
+#
+# Configuration file for sslh
+# Set empty to disable configuration file support
+#
+#CONFIG=/etc/sslh.cfg
+
+#
+# Extra option to pass on comand line
+# Those can supersede configuration file settings
+# 
+#OPTIONS=
+
+#
+# The sslh process is started by default with the C
+# locale, it can be changed here
+#
+#SSLH_LANG=C
+
+#
+# If an alternate location is specified in configuration
+# file, it needs to be reported here
+#
+#PIDFILE=/var/run/sslh/sslh.pid

scripts/fail2ban/jail.conf

@@ -0,0 +1,9 @@
+# Add the following to your fail2ban jail.conf
+# In Debian you'd append it to /etc/fail2ban/jail.local
+
+[sslh-ssh]
+enabled = true
+filter = sslh-ssh
+action = iptables-multiport[name=sslh,port="443"]
+logpath = /var/log/messages
+maxretry = 5

scripts/fail2ban/sslh-ssh.conf

@@ -0,0 +1,25 @@
+# Add the following to you fail2ban configuration file
+# In Debian it'd go in /etc/fail2ban/filter.d/sslh-ssh.conf
+
+
+# Fail2Ban filter for sslh demultiplexed ssh
+#
+# Doesn't (and cannot) detect auth errors,
+# but many connection attempts from the same
+# origin is reason enough to block.
+#
+# Verion: 2014-03-28
+
+[INCLUDES]
+
+# no includes
+
+[Definition]
+
+failregex = ^.+ sslh\[.+\]: connection from <HOST>:.+ to .+ forwarded
+from .+ to .+:ssh\s*$
+
+ignoreregex =
+
+# Author: Evert Mouw <post@evert.net>
+

scripts/systemd.sslh.service

@@ -0,0 +1,27 @@
+[Unit]
+Description=SSL/SSH multiplexer
+After=network.target
+
+[Service]
+EnvironmentFile=/etc/conf.d/sslh
+ExecStart=/usr/sbin/sslh --foreground $DAEMON_OPTS
+KillMode=process
+#Hardening
+PrivateTmp=true
+CapabilityBoundingSet=CAP_SETGID CAP_SETUID CAP_NET_BIND_SERVICE
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+SecureBits=noroot-locked
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+ProtectControlGroups=true
+MountFlags=private
+NoNewPrivileges=true
+PrivateDevices=true
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+MemoryDenyWriteExecute=true
+DynamicUser=true
+
+[Install]
+WantedBy=multi-user.target

sslh-fork.c

@@ -69,47 +69,51 @@ void start_shoveler(int in_socket)
 {
    fd_set fds;
    struct timeval tv;
-   struct addrinfo *saddr;
+   int res = PROBE_AGAIN;
-   int res;
    int out_socket;
    struct connection cnx;
-   struct proto *prot;
 
    init_cnx(&cnx);
+   cnx.q[0].fd = in_socket;
 
    FD_ZERO(&fds);
    FD_SET(in_socket, &fds);
    memset(&tv, 0, sizeof(tv));
    tv.tv_sec = probing_timeout;
-   res = select(in_socket + 1, &fds, NULL, NULL, &tv);
-   if (res == -1)
-      perror("select");
 
-   cnx.q[0].fd = in_socket;
+   while (res == PROBE_AGAIN) {
+       /* POSIX does not guarantee that tv will be updated, but the client can
+        * only postpone the inevitable for so long */
+       res = select(in_socket + 1, &fds, NULL, NULL, &tv);
+       if (res == -1)
+           perror("select");
 
-   if (FD_ISSET(in_socket, &fds)) {
+       if (FD_ISSET(in_socket, &fds)) {
-       /* Received data: figure out what protocol it is */
+           /* Received data: figure out what protocol it is */
-       prot = probe_client_protocol(&cnx);
+           res = probe_client_protocol(&cnx);
-   } else {
+       } else {
-       /* Timed out: it's necessarily SSH */
+           /* Timed out: it's necessarily SSH */
-       prot = timeout_protocol();
+           cnx.proto = timeout_protocol();
+           if (verbose) 
+               log_message(LOG_INFO, "timed out, connect to %s\n", cnx.proto->description);
+           break;
+       }
    }
 
-   saddr = prot->saddr;
+   if (cnx.proto->service &&
-   if (prot->service && 
+       check_access_rights(in_socket, cnx.proto->service)) {
-       check_access_rights(in_socket, prot->service)) {
        exit(0);
    }
 
    /* Connect the target socket */
-   out_socket = connect_addr(saddr, prot->description);
+   out_socket = connect_addr(&cnx, in_socket);
    CHECK_RES_DIE(out_socket, "connect");
 
    cnx.q[1].fd = out_socket;
 
    log_connection(&cnx);
 
-   flush_defered(&cnx.q[1]);
+   flush_deferred(&cnx.q[1]);
 
    shovel(&cnx);
 
@@ -141,11 +145,17 @@ void main_loop(int listen_sockets[], int num_addr_listen)
 
     listener_pid_number = num_addr_listen;
     listener_pid = malloc(listener_pid_number * sizeof(listener_pid[0]));
+    CHECK_ALLOC(listener_pid, "malloc");
 
     /* Start one process for each listening address */
     for (i = 0; i < num_addr_listen; i++) {
-        if (!(listener_pid[i] = fork())) {
+        listener_pid[i] = fork();
-
+        switch(listener_pid[i]) {
+        // Log if fork() fails for some reason
+        case -1: log_message(LOG_ERR, "fork failed: err %d: %s\n", errno, strerror(errno));
+                 break;
+        // We're in the child, we have work to do 
+        case 0:
             /* Listening process just accepts a connection, forks, and goes
              * back to listening */
             while (1)
@@ -153,14 +163,26 @@ void main_loop(int listen_sockets[], int num_addr_listen)
                 in_socket = accept(listen_sockets[i], 0, 0);
                 if (verbose) fprintf(stderr, "accepted fd %d\n", in_socket);
 
-                if (!fork())
+                switch(fork()) {
-                {
+                case -1: log_message(LOG_ERR, "fork failed: err %d: %s\n", errno, strerror(errno));
-                    close(listen_sockets[i]);
+                         break;
+
+                /* In child process */
+                case 0:
+                    for (i = 0; i < num_addr_listen; ++i)
+                        close(listen_sockets[i]);
                     start_shoveler(in_socket);
                     exit(0);
+
+                /* In parent process */
+                default: break;
                 }
                 close(in_socket);
             }
+	    break;
+	// We're in the parent, we don't need to do anything
+	default:
+	    break;
         }
     }
 

sslh-main.c

@@ -1,7 +1,8 @@
 /*
-# main: processing of config file, command line options and start the main loop.
+# main: processing of config file, command line options and start the main
+# loop.
 #
-# Copyright (C) 2007-2012  Yves Rutschle
+# Copyright (C) 2007-2016  Yves Rutschle
 # 
 # This program is free software; you can redistribute it
 # and/or modify it under the terms of the GNU General Public
@@ -24,7 +25,13 @@
 #ifdef LIBCONFIG
 #include <libconfig.h>
 #endif
+#ifdef ENABLE_REGEX
+#ifdef LIBPCRE
+#include <pcreposix.h>
+#else
 #include <regex.h>
+#endif
+#endif
 
 #include "common.h"
 #include "probe.h"
@@ -32,51 +39,84 @@
 const char* USAGE_STRING =
 "sslh " VERSION "\n" \
 "usage:\n" \
-"\tsslh  [-v] [-i] [-V] [-f] [-n] [-F <file>]\n"
+"\tsslh  [-v] [-i] [-V] [-f] [-n] [--transparent] [-F<file>]\n"
-"\t[-t <timeout>] [-P <pidfile>] -u <username> -p <add> [-p <addr> ...] \n" \
+"\t[-t <timeout>] [-P <pidfile>] [-u <username>] [-C <chroot>] -p <addr> [-p <addr> ...] \n" \
 "%s\n\n" /* Dynamically built list of builtin protocols */  \
+"\t[--on-timeout <addr>]\n" \
 "-v: verbose\n" \
 "-V: version\n" \
 "-f: foreground\n" \
 "-n: numeric output\n" \
-"-F: use configuration file\n" \
+"-u: specify under which user to run\n" \
-"-t: timeout before connecting to SSH.\n" \
+"-C: specify under which chroot path to run\n" \
+"--transparent: behave as a transparent proxy\n" \
+"-F: use configuration file (warning: no space between -F and file name!)\n" \
+"--on-timeout: connect to specified address upon timeout (default: ssh address)\n" \
+"-t: seconds to wait before connecting to --on-timeout address.\n" \
 "-p: address and port to listen on.\n    Can be used several times to bind to several addresses.\n" \
 "--[ssh,ssl,...]: where to connect connections from corresponding protocol.\n" \
-"-F: specify a configuration file\n" \
 "-P: PID file.\n" \
 "-i: Run as a inetd service.\n" \
 "";
 
+/* Constants for options that have no one-character shorthand */
+#define OPT_ONTIMEOUT   257
+
 static struct option const_options[] = {
     { "inetd",      no_argument,            &inetd,         1 },
     { "foreground", no_argument,            &foreground,    1 },
+    { "background", no_argument,            &background,    1 },
+    { "transparent", no_argument,           &transparent,   1 },
     { "numeric",    no_argument,            &numeric,       1 },
     { "verbose",    no_argument,            &verbose,       1 },
     { "user",       required_argument,      0,              'u' },
-    { "config",     required_argument,      0,              'F' },
+    { "config",     optional_argument,      0,              'F' },
     { "pidfile",    required_argument,      0,              'P' },
+    { "chroot",     required_argument,      0,              'C' },
     { "timeout",    required_argument,      0,              't' },
+    { "on-timeout", required_argument,      0,              OPT_ONTIMEOUT },
     { "listen",     required_argument,      0,              'p' },
     {}
 };
 static struct option* all_options;
 static struct proto* builtins;
-static const char *optstr = "vt:T:p:VP:F:";
+static const char *optstr = "vt:T:p:VP:C:F::";
 
 
 
 static void print_usage(void)
 {
     struct proto *p;
+    int i;
+    int res;
     char *prots = "";
 
-    for (p = get_first_protocol(); p; p = p->next)
+    p = get_builtins();
-        asprintf(&prots, "%s\t[--%s <addr>]\n", prots, p->description);
+    for (i = 0; i < get_num_builtins(); i++) {
+        res = asprintf(&prots, "%s\t[--%s <addr>]\n", prots, p[i].description);
+        CHECK_RES_DIE(res, "asprintf");
+    }
 
     fprintf(stderr, USAGE_STRING, prots);
 }
 
+static void printcaps(void) {
+#ifdef LIBCAP
+    cap_t caps;
+    char* desc;
+    ssize_t len;
+
+    caps = cap_get_proc();
+
+    desc = cap_to_text(caps, &len);
+
+    fprintf(stderr, "capabilities: %s\n", desc);
+
+    cap_free(caps);
+    cap_free(desc);
+#endif
+}
+
 static void printsettings(void)
 {
     char buf[NI_MAXHOST];
@@ -85,18 +125,51 @@ static void printsettings(void)
     
     for (p = get_first_protocol(); p; p = p->next) {
         fprintf(stderr,
-                "%s addr: %s. libwrap service: %s family %d %d\n", 
+                "%s addr: %s. libwrap service: %s log_level: %d family %d %d [%s] [%s]\n",
                 p->description, 
                 sprintaddr(buf, sizeof(buf), p->saddr), 
                 p->service,
+                p->log_level,
                 p->saddr->ai_family,
-                p->saddr->ai_addr->sa_family);
+                p->saddr->ai_addr->sa_family,
+                p->keepalive ? "keepalive" : "",
+                p->fork ? "fork" : "");
     }
     fprintf(stderr, "listening on:\n");
     for (a = addr_listen; a; a = a->ai_next) {
-        fprintf(stderr, "\t%s\n", sprintaddr(buf, sizeof(buf), a));
+        fprintf(stderr, 
+                "\t%s\t[%s]\n", 
+                sprintaddr(buf, sizeof(buf), a), 
+                a->ai_flags & SO_KEEPALIVE ? "keepalive" : "");
+    }
+    fprintf(stderr, "timeout: %d\non-timeout: %s\n", probing_timeout,
+            timeout_protocol()->description);
+}
+
+
+/* To removed in v1.21 */
+const char* ssl_err_msg = "Usage of 'ssl' setting is deprecated and will be removed in v1.21. Please use 'tls' instead\n";
+void ssl_to_tls(char* setting)
+{
+    if (!strcmp(setting, "ssl")) {
+        strcpy(setting, "tls"); /* legacy configuration */
+        log_message(LOG_INFO, ssl_err_msg);
+    }
+}
+
+
+/* Turn 'ssl' command line option to 'tls'. To removed in v1.21 */
+void cmd_ssl_to_tls(int argc, char* argv[])
+{
+    int i;
+    for (i = 0; i < argc; i++) {
+        if (!strcmp(argv[i], "--ssl")) {
+            strcpy(argv[i], "--tls");
+            /* foreground option not parsed yet, syslog not open, just print on
+             * stderr and hope for the best */
+            fprintf(stderr, ssl_err_msg);
+        }
     }
-    fprintf(stderr, "timeout to ssh: %d\n", probing_timeout);
 }
 
 
@@ -107,7 +180,7 @@ static void printsettings(void)
 static int config_listen(config_t *config, struct addrinfo **listen) 
 {
     config_setting_t *setting, *addr;
-    int len, i;
+    int len, i, keepalive;
     const char *hostname, *port;
 
     setting = config_lookup(config, "listen");
@@ -123,12 +196,20 @@ static int config_listen(config_t *config, struct addrinfo **listen)
                 return -1;
             }
 
+            keepalive = 0;
+            config_setting_lookup_bool(addr, "keepalive", &keepalive);
+
             resolve_split_name(listen, hostname, port);
 
             /* getaddrinfo returned a list of addresses corresponding to the
              * specification; move the pointer to the end of that list before
-             * processing the next specification */
+             * processing the next specification, while setting flags for
-            for (; *listen; listen = &((*listen)->ai_next));
+             * start_listen_sockets() through ai_flags (which is not meant for
+             * that, but is only used as hint in getaddrinfo, so it's OK) */
+            for (; *listen; listen = &((*listen)->ai_next)) {
+                if (keepalive)
+                    (*listen)->ai_flags = SO_KEEPALIVE;
+            }
         }
     }
 
@@ -141,6 +222,7 @@ static int config_listen(config_t *config, struct addrinfo **listen)
 #ifdef LIBCONFIG
 static void setup_regex_probe(struct proto *p, config_setting_t* probes)
 {
+#ifdef ENABLE_REGEX
     int num_probes, errsize, i, res;
     char *err;
     const char * expr;
@@ -154,20 +236,91 @@ static void setup_regex_probe(struct proto *p, config_setting_t* probes)
 
     p->probe = get_probe("regex");
     probe_list = calloc(num_probes + 1, sizeof(*probe_list));
+    CHECK_ALLOC(probe_list, "calloc");
     p->data = (void*)probe_list;
 
     for (i = 0; i < num_probes; i++) {
         probe_list[i] = malloc(sizeof(*(probe_list[i])));
+        CHECK_ALLOC(probe_list[i], "malloc");
         expr = config_setting_get_string_elem(probes, i);
-        res = regcomp(probe_list[i], expr, 0);
+        if (expr == NULL) {
+            fprintf(stderr, "%s: invalid probe specified\n", p->description);
+            exit(1);
+        }
+        res = regcomp(probe_list[i], expr, REG_EXTENDED);
         if (res) {
             err = malloc(errsize = regerror(res, probe_list[i], NULL, 0));
+            CHECK_ALLOC(err, "malloc");
             regerror(res, probe_list[i], err, errsize);
             fprintf(stderr, "%s:%s\n", expr, err);
             free(err);
             exit(1);
         }
     }
+#else
+    fprintf(stderr, "line %d: regex probe specified but not compiled in\n", config_setting_source_line(probes));
+    exit(5);
+#endif
+}
+#endif
+
+#ifdef LIBCONFIG
+static void setup_sni_alpn_list(struct proto *p, config_setting_t* config_items, const char* name, int alpn)
+{
+    int num_probes, i, max_server_name_len, server_name_len;
+    const char * config_item, *server_name;
+    char** sni_hostname_list;
+
+    num_probes = config_setting_length(config_items);
+    if (!num_probes) {
+        fprintf(stderr, "%s: no %s specified\n", p->description, name);
+        return;
+    }
+
+    max_server_name_len = 0;
+    for (i = 0; i < num_probes; i++) {
+        server_name = config_setting_get_string_elem(config_items, i);
+        if (server_name == NULL) {
+            fprintf(stderr, "%s: invalid %s specified\n", p->description, name);
+            exit(1);
+        }
+        server_name_len = strlen(server_name);
+        if(server_name_len > max_server_name_len)
+            max_server_name_len = server_name_len;
+    }
+
+    sni_hostname_list = calloc(num_probes + 1, ++max_server_name_len);
+    CHECK_ALLOC(sni_hostname_list, "calloc");
+
+    for (i = 0; i < num_probes; i++) {
+        config_item = config_setting_get_string_elem(config_items, i);
+        if (config_item == NULL) {
+            fprintf(stderr, "%s: invalid %s specified\n", p->description, name);
+            exit(1);
+        }
+        sni_hostname_list[i] = malloc(max_server_name_len);
+        CHECK_ALLOC(sni_hostname_list[i], "malloc");
+        strcpy (sni_hostname_list[i], config_item);
+        if(verbose) fprintf(stderr, "%s: %s[%d]: %s\n", p->description, name, i, sni_hostname_list[i]);
+    }
+
+    p->data = (void*)tls_data_set_list(p->data, alpn, sni_hostname_list);
+}
+
+static void setup_sni_alpn(struct proto *p, config_setting_t* prot)
+{
+    config_setting_t *sni_hostnames, *alpn_protocols;
+
+    p->data = (void*)new_tls_data();
+    sni_hostnames = config_setting_get_member(prot, "sni_hostnames");
+    alpn_protocols = config_setting_get_member(prot, "alpn_protocols");
+
+    if(sni_hostnames && config_setting_is_array(sni_hostnames)) {
+        setup_sni_alpn_list(p, sni_hostnames, "sni_hostnames", 0);
+    }
+    if(alpn_protocols && config_setting_is_array(alpn_protocols)) {
+        setup_sni_alpn_list(p, alpn_protocols, "alpn_protocols", 1);
+    }
 }
 #endif
 
@@ -177,8 +330,9 @@ static void setup_regex_probe(struct proto *p, config_setting_t* probes)
 #ifdef LIBCONFIG
 static int config_protocols(config_t *config, struct proto **prots)
 {
-    config_setting_t *setting, *prot, *probes;
+    config_setting_t *setting, *prot, *patterns;
-    const char *hostname, *port, *name;
+    const char *hostname, *port, *cfg_name;
+    char* name;
     int i, num_prots;
     struct proto *p, *prev = NULL;
 
@@ -187,42 +341,56 @@ static int config_protocols(config_t *config, struct proto **prots)
         num_prots = config_setting_length(setting);
         for (i = 0; i < num_prots; i++) {
             p = calloc(1, sizeof(*p));
+            CHECK_ALLOC(p, "calloc");
             if (i == 0) *prots = p;
             if (prev) prev->next = p;
             prev = p;
 
             prot = config_setting_get_elem(setting, i);
-            if ((config_setting_lookup_string(prot, "name", &name) &&
+            if ((config_setting_lookup_string(prot, "name", &cfg_name) &&
-                  config_setting_lookup_string(prot, "host", &hostname) &&
+                 config_setting_lookup_string(prot, "host", &hostname) &&
-                  config_setting_lookup_string(prot, "port", &port)
+                 config_setting_lookup_string(prot, "port", &port)
                 )) {
+                /* To removed in v1.21 */
+                name = strdup(cfg_name);
+                ssl_to_tls(name);
+                /* /remove */
                 p->description = name;
                 config_setting_lookup_string(prot, "service", &(p->service));
+                config_setting_lookup_bool(prot, "keepalive", &p->keepalive);
+                config_setting_lookup_bool(prot, "fork", &p->fork);
 
-                resolve_split_name(&(p->saddr), hostname, port);
+                if (config_setting_lookup_int(prot, "log_level", &p->log_level) == CONFIG_FALSE) {
+                    p->log_level = 1;
+                }
 
+                if (resolve_split_name(&(p->saddr), hostname, port)) {
+                    fprintf(stderr, "line %d: cannot resolve %s:%s\n", config_setting_source_line(prot), hostname, port);
+                    exit(1);
+                }
 
-                probes = config_setting_get_member(prot, "probe");
+                p->probe = get_probe(name);
-                if (config_setting_is_array(probes)) {
+                if (!p->probe) {
-                    /* If 'probe' is an array, setup a regex probe using the
+                    fprintf(stderr, "line %d: %s: probe unknown\n", config_setting_source_line(prot), name);
-                     * array of strings as pattern */
+                    exit(1);
+                }
 
-                    setup_regex_probe(p, probes);
+                /* Probe-specific options: regex patterns */
-
+                if (!strcmp(name, "regex")) {
-                } else {
+                    patterns = config_setting_get_member(prot, "regex_patterns");
-                    /* if 'probe' is 'builtin', set the probe to the
+                    if (patterns && config_setting_is_array(patterns)) {
-                     * appropriate builtin protocol */
+                        setup_regex_probe(p, patterns);
-                    if (!strcmp(config_setting_get_string(probes), "builtin")) {
-                        p->probe = get_probe(name);
-                        if (!p->probe) {
-                            fprintf(stderr, "%s: no builtin probe for this protocol\n", name);
-                            exit(1);
-                        }
-                    } else {
-                        fprintf(stderr, "%s: illegal probe name\n", name);
-                        exit(1);
                     }
                 }
+
+                /* Probe-specific options: SNI/ALPN */
+                if (!strcmp(name, "tls")) {
+                    setup_sni_alpn(p, prot);
+                }
+
+            } else {
+                fprintf(stderr, "line %d: Illegal protocol description (missing name, host or port)\n", config_setting_source_line(prot));
+                exit(1);
             }
         }
     }
@@ -235,33 +403,55 @@ static int config_protocols(config_t *config, struct proto **prots)
  * in: *filename
  * out: *listen, a newly-allocated linked list of listen addrinfo
  *      *prots, a newly-allocated linked list of protocols
+ *      1 on error, 0 on success
  */
 #ifdef LIBCONFIG
 static int config_parse(char *filename, struct addrinfo **listen, struct proto **prots)
 {
     config_t config;
-    long int timeout;
+    int timeout;
+    const char* str;
 
     config_init(&config);
     if (config_read_file(&config, filename) == CONFIG_FALSE) {
-        fprintf(stderr, "%s:%d:%s\n", 
+        /* If it's a parse error then there will be a line number for the failure
+         * an I/O error (such as non-existent file) will have the error line as 0
+         */
+        if (config_error_line(&config) != 0) {
+            fprintf(stderr, "%s:%d:%s\n", 
                     filename,
                     config_error_line(&config),
                     config_error_text(&config));
-        exit(1);
+            exit(1);
+        }
+        fprintf(stderr, "%s:%s\n", 
+                filename,
+                config_error_text(&config));
+        return 1;
+    }
+
+    if(config_lookup_bool(&config, "verbose", &verbose) == CONFIG_FALSE) {
+	config_lookup_int(&config, "verbose", &verbose);
     }
 
-    config_lookup_bool(&config, "verbose", &verbose);
     config_lookup_bool(&config, "inetd", &inetd);
     config_lookup_bool(&config, "foreground", &foreground);
     config_lookup_bool(&config, "numeric", &numeric);
+    config_lookup_bool(&config, "transparent", &transparent);
 
-    if (config_lookup_int(&config, "timeout", &timeout) == CONFIG_TRUE) {
+    if (config_lookup_int(&config, "timeout", (int *)&timeout) == CONFIG_TRUE) {
         probing_timeout = timeout;
     }
 
+    if (config_lookup_string(&config, "on-timeout", &str)) {
+        set_ontimeout(str);
+    }
+
     config_lookup_string(&config, "user", &user_name);
     config_lookup_string(&config, "pidfile", &pid_file);
+    config_lookup_string(&config, "chroot", &chroot_path);
+
+    config_lookup_string(&config, "syslog_facility", &facility);
 
     config_listen(&config, listen);
     config_protocols(&config, prots);
@@ -296,6 +486,7 @@ static void make_alloptions(void)
     /* Create all_options, composed of const_options followed by one option per
      * known protocol */
     all_options = calloc(ARRAY_SIZE(const_options) + get_num_builtins(), sizeof(struct option));
+    CHECK_ALLOC(all_options, "calloc");
     memcpy(all_options, const_options, sizeof(const_options));
     append_protocols(all_options, ARRAY_SIZE(const_options) - 1, builtins, get_num_builtins());
 }
@@ -313,16 +504,30 @@ static void cmdline_config(int argc, char* argv[], struct proto** prots)
     char *config_filename;
 #endif
 
+    cmd_ssl_to_tls(argc, argv); /* To remove in v1.21 */
+
     make_alloptions();
 
 #ifdef LIBCONFIG
     optind = 1;
     opterr = 0; /* we're missing protocol options at this stage so don't output errors */
     while ((c = getopt_long_only(argc, argv, optstr, all_options, NULL)) != -1) {
+        if (c == 'v') {
+            verbose++;
+        }
         if (c == 'F') {
             config_filename = optarg;
-            /* find the end of the listen list */
+            if (config_filename) {
-            res = config_parse(config_filename, &addr_listen, prots);
+                res = config_parse(config_filename, &addr_listen, prots);
+            } else {
+                /* No configuration file specified -- try default file locations */
+                res = config_parse("/etc/sslh/sslh.cfg", &addr_listen, prots);
+                if (!res && verbose) fprintf(stderr, "Using /etc/sslh/sslh.cfg\n");
+                if (res) {
+                    res = config_parse("/etc/sslh.cfg", &addr_listen, prots);
+                    if (!res && verbose) fprintf(stderr, "Using /etc/sslh.cfg\n");
+                }
+            }
             if (res)
                 exit(4);
             break;
@@ -362,8 +567,10 @@ next_arg:
             if (!prots) {
                 /* No protocols yet -- create the list */
                 p = prots = calloc(1, sizeof(*p));
+                CHECK_ALLOC(p, "calloc");
             } else {
                 p->next = calloc(1, sizeof(*p));
+                CHECK_ALLOC(p->next, "calloc");
                 p = p->next;
             }
             memcpy(p, &builtins[c-PROT_SHIFT], sizeof(*p));
@@ -386,6 +593,10 @@ next_arg:
              probing_timeout = atoi(optarg);
             break;
 
+        case OPT_ONTIMEOUT:
+            set_ontimeout(optarg);
+            break;
+
         case 'p':
             /* find the end of the listen list */
             for (a = &addr_listen; *a; a = &((*a)->ai_next));
@@ -406,6 +617,10 @@ next_arg:
             pid_file = optarg;
             break;
 
+        case 'C':
+            chroot_path = optarg;
+            break;
+
         case 'v':
             verbose++;
             break;
@@ -423,10 +638,17 @@ next_arg:
 
     set_protocol_list(prots);
 
-    if (!addr_listen) {
+/* If compiling with systemd socket support no need to require listen address */
+#ifndef SYSTEMD
+    if (!addr_listen && !inetd) {
         fprintf(stderr, "No listening address specified; use at least one -p option\n");
         exit(1);
     }
+#endif
+
+    /* Did command-line override foreground setting? */
+    if (background)
+        foreground = 0;
 
 }
 
@@ -443,6 +665,7 @@ int main(int argc, char *argv[])
    /* Init defaults */
    pid_file = NULL;
    user_name = NULL;
+   chroot_path = NULL;
 
    cmdline_config(argc, argv, &protocols);
    parse_cmdline(argc, argv, protocols);
@@ -459,6 +682,13 @@ int main(int argc, char *argv[])
 
    num_addr_listen = start_listen_sockets(&listen_sockets, addr_listen);
 
+#ifdef SYSTEMD
+   if (num_addr_listen < 1) {
+     fprintf(stderr, "No listening sockets found, restart sockets or specify addresses in config\n");
+     exit(1);
+    }
+#endif
+
    if (!foreground) {
        if (fork() > 0) exit(0); /* Detach */
 
@@ -471,15 +701,18 @@ int main(int argc, char *argv[])
 
    setup_signals();
 
-   if (user_name)
-       drop_privileges(user_name);
-
    if (pid_file)
        write_pid_file(pid_file);
 
-   /* Open syslog connection */
+   /* Open syslog connection before we drop privs/chroot */
    setup_syslog(argv[0]);
 
+   if (user_name || chroot_path)
+       drop_privileges(user_name, chroot_path);
+
+   if (verbose)
+       printcaps();
+
    main_loop(listen_sockets, num_addr_listen);
 
    return 0;

sslh-select.c

@@ -27,6 +27,8 @@
 
 const char* server_type = "sslh-select";
 
+#define MAX(a, b) (((a) > (b)) ? (a) : (b))
+
 /* cnx_num_alloc is the number of connection to allocate at once (at start-up,
  * and then every time we get too many simultaneous connections: e.g. start
  * with 100 slots, then if we get more than 100 connections allocate another
@@ -61,17 +63,27 @@ int tidy_connection(struct connection *cnx, fd_set *fds, fd_set *fds2)
             if (verbose)
                 fprintf(stderr, "closing fd %d\n", cnx->q[i].fd);
 
-            close(cnx->q[i].fd);
             FD_CLR(cnx->q[i].fd, fds);
             FD_CLR(cnx->q[i].fd, fds2);
-            if (cnx->q[i].defered_data)
+            close(cnx->q[i].fd);
-                free(cnx->q[i].defered_data);
+            if (cnx->q[i].deferred_data)
+                free(cnx->q[i].deferred_data);
         }
     }
     init_cnx(cnx);
     return 0;
 }
 
+/* if fd becomes higher than FD_SETSIZE, things won't work so well with FD_SET
+ * and FD_CLR. Need to drop connections if we go above that limit */
+int fd_is_in_range(int fd) {
+    if (fd >= FD_SETSIZE) {
+        log_message(LOG_ERR, "too many open file descriptor to monitor them all -- dropping connection\n");
+        return 0;
+    }
+    return 1;
+}
+
 /* Accepts a connection from the main socket and assigns it to an empty slot.
  * If no slots are available, allocate another few. If that fails, drop the
  * connexion */
@@ -83,8 +95,16 @@ int accept_new_connection(int listen_socket, struct connection *cnx[], int* cnx_
     in_socket = accept(listen_socket, 0, 0);
     CHECK_RES_RETURN(in_socket, "accept");
 
+    if (!fd_is_in_range(in_socket)) {
+        close(in_socket);
+        return -1;
+    }
+
     res = set_nonblock(in_socket);
-    if (res == -1) return -1;
+    if (res == -1) {
+        close(in_socket);
+        return -1;
+    }
 
     /* Find an empty slot */
     for (free = 0; (free < *cnx_size) && ((*cnx)[free].q[0].fd != -1); free++) {
@@ -96,6 +116,7 @@ int accept_new_connection(int listen_socket, struct connection *cnx[], int* cnx_
         new = realloc(*cnx, (*cnx_size + cnx_num_alloc) * sizeof((*cnx)[0]));
         if (!new) {
             log_message(LOG_ERR, "unable to realloc -- dropping connection\n");
+            close(in_socket);
             return -1;
         }
         *cnx = new;
@@ -116,22 +137,20 @@ int accept_new_connection(int listen_socket, struct connection *cnx[], int* cnx_
 
 
 /* Connect queue 1 of connection to SSL; returns new file descriptor */
-int connect_queue(struct connection *cnx, struct addrinfo *addr, 
+int connect_queue(struct connection *cnx, fd_set *fds_r, fd_set *fds_w)
-                  const char* cnx_name,
-                  fd_set *fds_r, fd_set *fds_w)
 {
     struct queue *q = &cnx->q[1];
 
-    q->fd = connect_addr(addr, cnx_name);
+    q->fd = connect_addr(cnx, cnx->q[0].fd);
-    if (q->fd != -1) {
+    if ((q->fd != -1) && fd_is_in_range(q->fd)) {
         log_connection(cnx);
         set_nonblock(q->fd);
-        flush_defered(q);
+        flush_deferred(q);
-        if (q->defered_data) {
+        if (q->deferred_data) {
             FD_SET(q->fd, fds_w);
-        } else {
+            FD_CLR(cnx->q[0].fd, fds_r);
-            FD_SET(q->fd, fds_r);
         }
+        FD_SET(q->fd, fds_r);
         return q->fd;
     } else {
         tidy_connection(cnx, fds_r, fds_w);
@@ -169,6 +188,93 @@ void shovel(struct connection *cnx, int active_fd,
     }
 }
 
+/* shovels data from one fd to the other and vice-versa
+   returns after one socket closed
+ */
+void shovel_single(struct connection *cnx)
+{
+   fd_set fds_r, fds_w;
+   int res, i;
+   int max_fd = MAX(cnx->q[0].fd, cnx->q[1].fd) + 1;
+
+   FD_ZERO(&fds_r);
+   FD_ZERO(&fds_w);
+   while (1) {
+      for (i = 0; i < 2; i++) {
+         if (cnx->q[i].deferred_data_size) {
+            FD_SET(cnx->q[i].fd, &fds_w);
+            FD_CLR(cnx->q[1-i].fd, &fds_r);
+         } else {
+            FD_CLR(cnx->q[i].fd, &fds_w);
+            FD_SET(cnx->q[1-i].fd, &fds_r);
+         }
+      }
+
+      res = select(
+                   max_fd,
+                   &fds_r,
+                   &fds_w,
+                   NULL,
+                   NULL
+                  );
+      CHECK_RES_DIE(res, "select");
+
+      for (i = 0; i < 2; i++) {
+          if (FD_ISSET(cnx->q[i].fd, &fds_w)) {
+              res = flush_deferred(&cnx->q[i]);
+              if ((res == -1) && ((errno == EPIPE) || (errno == ECONNRESET))) {
+                  if (verbose)
+                      fprintf(stderr, "%s socket closed\n", i ? "server" : "client");
+                  return;
+              }
+          }
+          if (FD_ISSET(cnx->q[i].fd, &fds_r)) {
+              res = fd2fd(&cnx->q[1-i], &cnx->q[i]);
+              if (!res) {
+                  if (verbose)
+                      fprintf(stderr, "socket closed\n");
+                  return;
+              }
+          }
+      }
+   }
+}
+
+/* Child process that makes internal connection and proxies
+ */
+void connect_proxy(struct connection *cnx)
+{
+    int in_socket;
+    int out_socket;
+
+    /* Minimize the file descriptor value to help select() */
+    in_socket = dup(cnx->q[0].fd);
+    if (in_socket == -1) {
+        in_socket = cnx->q[0].fd;
+    } else {
+        close(cnx->q[0].fd);
+        cnx->q[0].fd = in_socket;
+    }
+
+    /* Connect the target socket */
+    out_socket = connect_addr(cnx, in_socket);
+    CHECK_RES_DIE(out_socket, "connect");
+
+    cnx->q[1].fd = out_socket;
+
+    log_connection(cnx);
+
+    shovel_single(cnx);
+
+    close(in_socket);
+    close(out_socket);
+
+    if (verbose)
+        fprintf(stderr, "connection closed down\n");
+
+    exit(0);
+}
+
 /* returns true if specified fd is initialised and present in fd_set */
 int is_fd_active(int fd, fd_set* set)
 {
@@ -177,13 +283,13 @@ int is_fd_active(int fd, fd_set* set)
 }
 
 /* Main loop: the idea is as follow:
- * - fds_r and fds_w contain the file descritors to monitor in read and write
+ * - fds_r and fds_w contain the file descriptors to monitor in read and write
  * - When a file descriptor goes off, process it: read from it, write the data
  * to its corresponding pair.
  * - When a file descriptor blocks when writing, remove the read fd from fds_r,
- * move the data to a defered buffer, and add the write fd to fds_w. Defered
+ * move the data to a deferred buffer, and add the write fd to fds_w. Defered
  * buffer is allocated dynamically.
- * - When we can write to a file descriptor that has defered data, we try to
+ * - When we can write to a file descriptor that has deferred data, we try to
  * write as much as we can. Once all data is written, remove the fd from fds_w
  * and add its corresponding pair to fds_r, free the buffer.
  *
@@ -195,9 +301,9 @@ void main_loop(int listen_sockets[], int num_addr_listen)
     fd_set fds_r, fds_w;  /* reference fd sets (used to init the next 2) */
     fd_set readfds, writefds; /* working read and write fd sets */
     struct timeval tv;
-    int max_fd, in_socket, i, j, res;
+    int max_fd, i, j, res;
+    int in_socket = 0;
     struct connection *cnx;
-    struct proto *prot;
     int num_cnx;  /* Number of connections in *cnx */
     int num_probing = 0; /* Number of connections currently probing 
                           * We use this to know if we need to time out of
@@ -216,6 +322,7 @@ void main_loop(int listen_sockets[], int num_addr_listen)
 
     num_cnx = cnx_num_alloc; /* Start with a set pool of slots */
     cnx = malloc(num_cnx * sizeof(struct connection));
+    CHECK_ALLOC(cnx, "malloc");
     for (i = 0; i < num_cnx; i++)
         init_cnx(&cnx[i]);
 
@@ -238,15 +345,12 @@ void main_loop(int listen_sockets[], int num_addr_listen)
         for (i = 0; i < num_addr_listen; i++) {
             if (FD_ISSET(listen_sockets[i], &readfds)) {
                 in_socket = accept_new_connection(listen_sockets[i], &cnx, &num_cnx);
-                if (in_socket != -1)
-                    num_probing++;
-
                 if (in_socket > 0) {
+                    num_probing++;
                     FD_SET(in_socket, &fds_r);
                     if (in_socket >= max_fd)
                         max_fd = in_socket + 1;;
                 }
-                FD_CLR(listen_sockets[i], &readfds);
             }
         }
 
@@ -255,18 +359,19 @@ void main_loop(int listen_sockets[], int num_addr_listen)
             if (cnx[i].q[0].fd != -1) {
                 for (j = 0; j < 2; j++) {
                     if (is_fd_active(cnx[i].q[j].fd, &writefds)) {
-                        res = flush_defered(&cnx[i].q[j]);
+                        res = flush_deferred(&cnx[i].q[j]);
                         if ((res == -1) && ((errno == EPIPE) || (errno == ECONNRESET))) {
                             if (cnx[i].state == ST_PROBING) num_probing--;
                             tidy_connection(&cnx[i], &fds_r, &fds_w);
                             if (verbose)
                                 fprintf(stderr, "closed slot %d\n", i);
-                        }
+                        } else {
-                        /* If no defered data is left, stop monitoring the fd 
+                            /* If no deferred data is left, stop monitoring the fd 
-                         * for write, and restart monitoring the other one for reads*/
+                             * for write, and restart monitoring the other one for reads*/
-                        if (!cnx[i].q[j].defered_data_size) {
+                            if (!cnx[i].q[j].deferred_data_size) {
-                            FD_CLR(cnx[i].q[j].fd, &fds_w);
+                                FD_CLR(cnx[i].q[j].fd, &fds_w);
-                            FD_SET(cnx[i].q[1-j].fd, &fds_r);
+                                FD_SET(cnx[i].q[1-j].fd, &fds_r);
+                            }
                         }
                     }
                 }
@@ -289,28 +394,54 @@ void main_loop(int listen_sockets[], int num_addr_listen)
                             dump_connection(&cnx[i]);
                             exit(1);
                         }
-                        num_probing--;
-                        cnx[i].state = ST_SHOVELING;
 
                         /* If timed out it's SSH, otherwise the client sent
                          * data so probe the protocol */
                         if ((cnx[i].probe_timeout < time(NULL))) {
-                            prot = timeout_protocol();
+                            cnx[i].proto = timeout_protocol();
+                            if (verbose) 
+                                log_message(LOG_INFO, 
+                                            "timed out, connect to %s\n", 
+                                            cnx[i].proto->description);
                         } else {
-                            prot = probe_client_protocol(&cnx[i]);
+                            res = probe_client_protocol(&cnx[i]);
+                            if (res == PROBE_AGAIN)
+                                continue;
                         }
 
-                        /* libwrap check if required for this protocol */
+                        num_probing--;
-                        if (prot->service && 
+                        cnx[i].state = ST_SHOVELING;
-                            check_access_rights(in_socket, prot->service)) {
+
-                            tidy_connection(&cnx[i], &fds_r, &fds_w);
+			/* libwrap check if required for this protocol */
-                            res = -1;
+			if (cnx[i].proto->service &&
-                        } else {
+			    check_access_rights(in_socket, cnx[i].proto->service)) {
-                            res = connect_queue(&cnx[i], 
+			    tidy_connection(&cnx[i], &fds_r, &fds_w);
-                                                prot->saddr, 
+			    res = -1;
-                                                prot->description, 
+			} else if (cnx[i].proto->fork) {
-                                                &fds_r, &fds_w);
+			    struct connection *pcnx_i = &cnx[i];
-                        }
+			    struct connection cnx_i = *pcnx_i;
+			    switch (fork()) {
+			    case 0:  /* child */
+				for (i = 0; i < num_addr_listen; i++)
+				    close(listen_sockets[i]);
+				for (i = 0; i < num_cnx; i++)
+				    if (&cnx[i] != pcnx_i)
+					for (j = 0; j < 2; j++)
+					    if (cnx[i].q[j].fd != -1)
+						close(cnx[i].q[j].fd);
+				free(cnx);
+				connect_proxy(&cnx_i);
+				exit(0);
+			    case -1: log_message(LOG_ERR, "fork failed: err %d: %s\n", errno, strerror(errno));
+				     break;
+			    default: /* parent */
+				     break;
+			    }
+			    tidy_connection(&cnx[i], &fds_r, &fds_w);
+			    res = -1;
+			} else {
+			    res = connect_queue(&cnx[i], &fds_r, &fds_w);
+			}
 
                         if (res >= max_fd)
                             max_fd = res + 1;;

sslh.pod

@@ -2,59 +2,40 @@
 
 =head1 NAME
 
- sslh - ssl/ssh multiplexer
+ sslh - protocol demultiplexer
 
 =head1 SYNOPSIS
 
-sslh [B<-F> I<config file>] [ B<-t> I<num> ] [B<-p> I<listening address> [B<-p> I<listening address> ...] [B<--ssl> I<target address for SSL>] [B<--ssh> I<target address for SSH>] [B<--openvpn> I<target address for OpenVPN>] [B<--http> I<target address for HTTP>] [B<-u> I<username>] [B<-P> I<pidfile>] [-v] [-i] [-V] [-f] [-n]
+sslh [B<-F>I<config file>] [B<-t> I<num>] [B<--transparent>] [B<-p> I<listening address> [B<-p> I<listening address> ...] [B<--ssl> I<target address for SSL>] [B<--tls> I<target address for TLS>] [B<--ssh> I<target address for SSH>] [B<--openvpn> I<target address for OpenVPN>] [B<--http> I<target address for HTTP>] [B<--xmpp> I<target address for XMPP>] [B<--tinc> I<target address for TINC>] [B<--anyprot> I<default target address>] [B<--on-timeout> I<protocol name>] [B<-u> I<username>] [B<-C> I<chroot>] [B<-P> I<pidfile>] [-v] [-i] [-V] [-f] [-n]
 
 =head1 DESCRIPTION
 
-B<sslh> accepts connections in HTTP, HTTPS, SSH, OpenVPN,
+B<sslh> accepts connections on specified ports, and forwards
-tinc, XMPP, or any other protocol that can be tested using a
+them further based on tests performed on the first data
-regular expression, on the same port. This makes it possible
+packet sent by the remote client.
-to connect to any of these servers on port 443 (e.g. from
-inside a corporate firewall, which almost never block port
-443) while still serving HTTPS on that port. 
 
+Probes for HTTP, SSL, SSH, OpenVPN, tinc, XMPP are
+implemented, and any other protocol that can be tested using
+a regular expression, can be recognised. A typical use case
+is to allow serving several services on port 443 (e.g. to
+connect to ssh from inside a corporate firewall, which
+almost never block port 443) while still serving HTTPS on
+that port. 
 
-The idea is to have B<sslh> listen to the external 443 port,
+Hence B<sslh> acts as a protocol demultiplexer, or a
-accept the incoming connections, work out what type of
+switchboard. Its name comes from its original function to
-connection it is, and then fordward to the appropriate
+serve SSH and HTTPS on the same port.
-server.
-
-=head2 Protocol detection
-
-The protocol detection is made based on the first bytes sent
-by the client: SSH connections start by identifying each
-other's versions using clear text "SSH-2.0" strings (or
-equivalent version strings). This is defined in RFC4253,
-4.2. Meanwhile, OpenVPN clients start with 0x00 0x0D 0x38,
-tinc clients start with "0 ", and XMPP client start with a
-packet containing "jabber".
-
-Additionally, two kind of SSH clients exist: the client
-waits for the server to send its version string ("Shy"
-client, which is the case of OpenSSH and Putty), or the
-client sends its version first ("Bold" client, which is the
-case of Bitvise Tunnelier and ConnectBot). 
-
-If the client stays quiet after the timeout period, B<sslh>
-will connect to the first protocol defined (in the
-configuration file, or on the command line), so SSH should
-be defined first in B<sslh> configuration to accomodate for
-shy SSH clients.
 
 =head2 Libwrap support
 
-One drawback of B<sslh> is that the B<ssh> and B<httpd>
+One drawback of B<sslh> is that the servers do not see the
-servers do not see the original IP address of the client
+original IP address of the client anymore, as the connection
-anymore, as the connection is forwarded through B<sslh>.
+is forwarded through B<sslh>.
-B<sslh> provides enough logging to circumvent that problem.
+
-However it is common to limit access to B<ssh> using
+For this reason, B<sslh> can be compiled with B<libwrap> to
-B<libwrap> or B<tcpd>. For this reason, B<sslh> can be
+check accesses defined in F</etc/hosts.allow> and
-compiled to check SSH accesses against SSH access lists as
+F</etc/hosts.deny>.  Libwrap services can be defined using
-defined in F</etc/hosts.allow> and F</etc/hosts.deny>.
+the configuration file.
 
 =head2 Configuration file
 
@@ -70,24 +51,62 @@ and the list of protocols).
 
 The configuration file makes it possible to specify
 protocols using regular expressions: a list of regular
-expressions is given as the I<probe> parameter, and if the
+expressions is given as the I<regex_patterns> parameter, and if the
 first packet received from the client matches any of these
 expressions, B<sslh> connects to that protocol.
 
-Alternatively, the I<probe> parameter can be set to
+=head2 Probing protocols
-"builtin", to use the compiled probes which are much faster
-than regular expressions.
 
+When receiving an incoming connection, B<sslh> will read the
+first bytes sent by the connecting client. It will then
+probe for the protocol in the order specified on the command
+line (or the configuration file). Therefore B<--anyprot>
+should alway be used last, as it always succeeds and further
+protocols will never be tried.
+
+If no data is sent by the client, B<sslh> will eventually
+time out and connect to the protocol specified with
+B<--on-timeout>, or I<ssh> if none is specified.
+
+=head2 Logging
+
+As a security/authorization program, B<sslh> logs to the
+LOG_AUTH facility, with priority LOG_INFO for normal
+connections and LOG_ERR for failures.
 
 =head1 OPTIONS
 
 =over 4
 
+=item B<-F>I<filename>, B<--config> I<filename>
+
+Uses I<filename> as configuration file. If other
+command-line options are specified, they will override the
+configuration file's settings.
+
+When using the shorthand version, make sure there should be
+no space between B<-F> and the I<filename>.
+
 =item B<-t> I<num>, B<--timeout> I<num>
 
-Timeout before forwarding the connection to the first
+Timeout before forwarding the connection to the timeout
-configured protocol (which should usually be SSH). Default
+protocol (which should usually be SSH). Default is 2s.
-is 2s.
+
+=item B<--on-timeout> I<protocol name>
+
+Name of the protocol to connect to after the timeout period
+is over. Default is to forward to the first specified
+protocol. It usually makes sense to specify 'ssh' as the
+timeout protocol, as the SSH specification does not tell
+who is supposed to speak first and a large number of SSH
+clients wait for the server to send its banner.
+
+=item B<--transparent>
+
+Makes B<sslh> behave as a transparent proxy, i.e. the
+receiving service sees the original client's IP address.
+This works on Linux only and involves B<iptables> settings.
+Refer to the README for more information.
 
 =item B<-p> I<listening address>, B<--listen> I<listening address>
 
@@ -100,6 +119,8 @@ several addresses.
 
 =item B<--ssl> I<target address>
 
+=item B<--tls> I<target address>
+
 Interface and port on which to forward SSL connection,
 typically I<localhost:443>.
 
@@ -107,6 +128,11 @@ Note that you can set B<sslh> to listen on I<ext_ip:443> and
 B<httpd> to listen on I<localhost:443>: this allows clients
 inside your network to just connect directly to B<httpd>.
 
+Also, B<sslh> probes for SSLv3 (or TLSv1) handshake and will
+reject connections from clients requesting SSLv2. This is
+compliant with RFC6176 which prohibits the usage of SSLv2. If
+you wish to accept SSLv2, use B<--default> instead.
+
 =item B<--ssh> I<target address>
 
 Interface and port on which to forward SSH connections,
@@ -122,6 +148,11 @@ typically I<localhost:1194>.
 Interface and port on which to forward XMPP connections,
 typically I<localhost:5222>.
 
+=item B<--http> I<target address>
+
+Interface and port on which to forward HTTP connections,
+typically I<localhost:80>.
+
 =item B<--tinc> I<target address>
 
 Interface and port on which to forward tinc connections,
@@ -130,6 +161,14 @@ typically I<localhost:655>.
 This is experimental. If you use this feature, please report
 the results (even if it works!)
 
+=item B<--anyprot> I<target address>
+
+Interface and port on which to forward if no other protocol
+has been found. Because B<sslh> tries protocols in the order
+specified on the command line, this should be specified
+last. If no default is specified, B<sslh> will forward
+unknown protocols to the first protocol specified.
+
 =item B<-v>, B<--verbose>
 
 Increase verboseness.
@@ -149,6 +188,10 @@ Prints B<sslh> version.
 
 Requires to run under the specified username. 
 
+=item B<-C> I<chroot>, B<--chroot> I<chroot>
+
+Requires to run under the specified chroot.
+
 =item B<-P> I<pidfile>, B<--pidfile> I<pidfile>
 
 Specifies a file in which to write the PID of the main
@@ -165,6 +208,13 @@ Runs in foreground. The server will not fork and will remain connected
 to the terminal. Messages normally sent to B<syslog> will also be sent
 to I<stderr>.
 
+=item B<--background>
+
+Runs in background. This overrides B<foreground> if set in
+the configuration file (or on the command line, but there is
+no point setting both on the command line unless you have a
+personality disorder).
+
 =back
 
 =head1 FILES
@@ -187,10 +237,10 @@ detailed explanation of the variables used by B<sslh>.
 
 =head1 SEE ALSO
 
-Last version available from
+The latest version is available from
 L<http://www.rutschle.net/tech/sslh>, and can be tracked
 from L<http://freecode.com/projects/sslh>.
 
 =head1 AUTHOR
 
-Written by Yves Rutschle
+Written by Yves Rutschle.

systemd-sslh-generator.c

@@ -0,0 +1,153 @@
+#include <libconfig.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include "common.h"
+
+
+static char* resolve_listen(const char *hostname, const char *port) {
+    /* Need room in the strcat for \0 and :
+     * the format in the socket unit file is hostname:port */
+    char *conn = malloc(strlen(hostname)+strlen(port)+2);
+    CHECK_ALLOC(conn, "malloc");
+    strcpy(conn, hostname);
+    strcat(conn, ":");
+    strcat(conn, port);
+
+    return conn;
+
+}
+
+
+static int get_listen_from_conf(const char *filename, char **listen[]) {
+    config_t config;
+    config_setting_t *setting, *addr;
+    const char *hostname, *port;
+    int len = 0;
+
+    /* look up the listen stanzas in the config file so these
+     * can be used in the socket file generated */
+    config_init(&config);
+    if (config_read_file(&config, filename) == CONFIG_FALSE) {
+        /* we don't care if file is missing, skip it */
+        if (config_error_line(&config) != 0) {
+            fprintf(stderr, "%s:%d:%s\n",
+                    filename,
+                    config_error_line(&config),
+                    config_error_text(&config));
+            return -1;
+        }
+    } else {
+        setting = config_lookup(&config, "listen");
+        if (setting) {
+	    int i;
+            len = config_setting_length(setting);
+            *listen = malloc(len * sizeof(**listen));
+            CHECK_ALLOC(*listen, "malloc");
+            for (i = 0; i < len; i++) {
+                addr = config_setting_get_elem(setting, i);
+                if (! (config_setting_lookup_string(addr, "host", &hostname) &&
+                       config_setting_lookup_string(addr, "port", &port))) {
+                    fprintf(stderr,
+                            "line %d:Incomplete specification (hostname and port required)\n",
+                            config_setting_source_line(addr));
+                    return -1;
+                } else {
+                    (*listen)[i] = malloc(strlen(resolve_listen(hostname, port)));
+                    CHECK_ALLOC((*listen)[i], "malloc");
+                    strcpy((*listen)[i], resolve_listen(hostname, port));
+                }
+            }
+        }
+    }
+
+    return len;
+
+}
+
+static int write_socket_unit(FILE *socket, char *listen[], int num_addr, const char *source) {
+    int i;
+
+    fprintf(socket,
+            "# Automatically generated by systemd-sslh-generator\n\n"
+            "[Unit]\n"
+            "Before=sslh.service\n"
+            "SourcePath=%s\n"
+            "Documentation=man:sslh(8) man:systemd-sslh-generator(8)\n\n"
+            "[Socket]\n"
+            "FreeBind=true\n",
+            source);
+
+    for (i = 0; i < num_addr; i++) {
+        fprintf(socket, "ListenStream=%s\n", listen[i]);
+    }
+
+    return 0;
+}
+
+static int gen_sslh_config(char *runtime_unit_dir) {
+    char *sslh_conf;
+    int num_addr;
+    FILE *config;
+    char **listen;
+    FILE *runtime_conf_fd = stdout;
+    const char *unit_file;
+
+    /* There are two default locations so check both with first given preference */
+    sslh_conf = "/etc/sslh.cfg";
+
+    config = fopen(sslh_conf, "r");
+    if (config  == NULL) {
+        sslh_conf="/etc/sslh/sslh.cfg";
+        config = fopen(sslh_conf, "r");
+        if (config == NULL) {
+            return -1;
+        }
+    }
+
+    fclose(config);
+
+    num_addr = get_listen_from_conf(sslh_conf, &listen);
+    if (num_addr < 0)
+        return -1;
+
+    /* If this is run by systemd directly write to the location told to
+     * otherwise write to standard out so that it's trivial to check what
+     * will be written */
+    if (runtime_unit_dir && *runtime_unit_dir) {
+        unit_file = "/sslh.socket";
+        size_t uf_len = strlen(unit_file);
+        size_t runtime_len = strlen(runtime_unit_dir) + uf_len + 1;
+        char *runtime_conf = malloc(runtime_len);
+        CHECK_ALLOC(runtime_conf, "malloc");
+        strcpy(runtime_conf, runtime_unit_dir);
+        strcat(runtime_conf, unit_file);
+        runtime_conf_fd = fopen(runtime_conf, "w");
+    }
+
+
+    return write_socket_unit(runtime_conf_fd, listen, num_addr, sslh_conf);
+}
+
+
+int main(int argc, char *argv[]){
+    int r = 0;
+    int k;
+    char *runtime_unit_dest = "";
+
+    if (argc > 1 && (argc != 4) ) {
+        printf("This program takes three or no arguments.\n");
+        return -1;
+    }
+
+    if (argc  > 1)
+        runtime_unit_dest = argv[1];
+
+    k = gen_sslh_config(runtime_unit_dest);
+    if (k < 0)
+        r = k;
+
+    return r < 0 ? -1 : 0;
+}
+
+

t

@@ -2,26 +2,30 @@
 
 # Test script for sslh
 
+# Uses Conf::Libconfig to read sslh config file: install
+# with:
+# cpan Conf::Libconfig
+
 use strict;
 use IO::Socket::INET6;
 use Test::More qw/no_plan/;
+use Conf::Libconfig;
 
-# We use ports 9000, 9001 and 9002 -- hope that won't clash
+my $conf = new Conf::Libconfig;
-# with anything...
+$conf->read_file("test.cfg");
-my $ssh_address = "ip6-localhost:9000";
+
-my $ssl_address = "ip6-localhost:9001";
+
-my $sslh_port = 9002;
+my $no_listen = 8083;  # Port on which no-one listens
-my $no_listen = 9003;  # Port on which no-one listens
+my $pidfile = $conf->lookup_value("pidfile");
-my $pidfile = "/tmp/sslh_test.pid";
+my $sslh_port = $conf->fetch_array("listen")->[0]->{port};
+my $user = (getpwuid $<)[0]; # Run under current username
 
 # Which tests do we run
-my $SSL_CNX =           1;
 my $SSH_SHY_CNX =       1;
-my $SSH_BOLD_CNX =      1;
+my $PROBES_NOFRAG =     1;
+my $PROBES_AGAIN =      1;
 my $SSL_MIX_SSH =       1;
 my $SSH_MIX_SSL =       1;
-my $BIG_MSG =           1;
-my $STALL_CNX =         1;
 
 # Robustness tests. These are mostly to achieve full test
 # coverage, but do not necessarily result in an actual test
@@ -31,22 +35,158 @@ my $RB_CNX_NOSERVER =           1;
 my $RB_PARAM_NOHOST =           1;
 my $RB_WRONG_USERNAME =         1;
 my $RB_OPEN_PID_FILE =          1;
-my $RB_BIND_ADDRESS =           1;
 my $RB_RESOLVE_ADDRESS =        1;
 
 `lcov --directory . --zerocounters`;
 
+sub verbose_exec
+{
+    my ($cmd) = @_;
 
-my ($ssh_pid, $ssl_pid);
+    warn "$cmd\n";
-
+    if (!fork) {
-if (!($ssh_pid = fork)) {
+        exec $cmd;
-    exec "./echosrv --listen $ssh_address --prefix 'ssh: '";
+    }
 }
 
-if (!($ssl_pid = fork)) {
+
-    exec "./echosrv --listen $ssl_address --prefix 'ssl: '";
+
+# For SNI/ALPN, build a protocol name as such:
+# tls:sni1,sni2,...;alpn1,alpn2,...
+# input: a protocol entry from Libconfig
+sub make_sni_alpn_name {
+    my ($prot) = @_;
+
+   return "tls:" . (join ",", @{$prot->{sni_hostnames} // []})
+           . ";" . (join ",", @{$prot->{alpn_protocols} // [] });
 }
 
+
+# Tests one probe: given input data, connect, verify we get
+# the expected server, verify shoveling works
+# Named options:
+# data: what to write
+# expected: expected protocol prefix
+# no_frag: don't print byte-per-byte
+sub test_probe {
+    my (%opts) = @_;
+
+    my $cnx = new IO::Socket::INET(PeerHost => "localhost:$sslh_port");
+    warn "$!\n" unless $cnx;
+    return unless $cnx;
+
+    my $pattern = $opts{data};
+    if ($opts{no_frag}) {
+        syswrite $cnx, $pattern;
+    } else {
+        while (length $pattern) {
+            syswrite $cnx, (substr $pattern, 0, 1, '');
+            select undef, undef, undef, .01;
+        }
+    }
+
+    my $data;
+    my $n = sysread $cnx, $data, 1024;
+    $data =~ /^(.*?): /;
+    my $prefix = $1;
+    $data =~ s/$prefix: //g;
+    print "Received: protocol $prefix data [$data]\n";
+    close $cnx;
+
+    $opts{expected} =~ s/^ssl/tls/; # to remove in 1.21
+    is($prefix, $opts{expected}, "probe $opts{expected} connected correctly");
+    is($data, $opts{data}, "data shoveled correctly");
+}
+
+# Test all probes, with or without fragmentation
+# options:
+#     no_frag: write test patterns all at once (also
+#     available per-protocol as some probes don't support
+#     fragmentation)
+sub test_probes {
+    my (%opts) = @_;
+
+    my @probes = @{$conf->fetch_array("protocols")};
+    foreach my $p (@probes) {
+        my %protocols = (
+            'ssh' => { data => "SSH-2.0 tester" },
+            'socks5' => { data => "\x05\x04\x01\x02\x03\x04" },
+            'http' => { 
+                data => "GET index.html HTTP/1.1",
+                no_frag => 1 },
+            'ssl' => {
+                data => "\x16\x03\x01\x00\xab\x01\x00\x00\xa7\x03\x03\x89\x22\x33\x95\x43\x7a\xc3\x89\x45\x51\x12\x3c\x28\x24\x1b\x6a\x78\xbf\xbe\x95\xd8\x90\x58\xd7\x65\xf7\xbb\x2d\xb2\x8d\xa0\x75\x00\x00\x38\xc0\x2c\xc0\x30\x00\x9f\xcc\xa9\xcc\xa8\xcc\xaa\xc0\x2b\xc0\x2f\x00\x9e\xc0\x24\xc0\x28\x00\x6b\xc0\x23\xc0\x27\x00\x67\xc0\x0a\xc0\x14\x00\x39\xc0\x09\xc0\x13\x00\x33\x00\x9d\x00\x9c\x00\x3d\x00\x3c\x00\x35\x00\x2f\x00\xff\x01\x00\x00\x46\x00\x0b\x00\x04\x03\x00\x01\x02\x00\x0a\x00\x0a\x00\x08\x00\x1d\x00\x17\x00\x19\x00\x18\x00\x23\x00\x00\x00\x0d\x00\x20\x00\x1e\x06\x01\x06\x02\x06\x03\x05\x01\x05\x02\x05\x03\x04\x01\x04\x02\x04\x03\x03\x01\x03\x02\x03\x03\x02\x01\x02\x02\x02\x03\x00\x16\x00\x00\x00\x17\x00\x00hello ssl alone"
+            },
+            'tls' => { 
+                # Packet with SNI and ALPN (`openssl s_client -connect localhost:443 -alpn alpn1 -servername sni1`)
+                data_sni_alpn => "\x16\x03\x01\x00\xc4\x01\x00\x00\xc0\x03\x03\x03\x19\x01\x00\x40\x14\x13\xcc\x1b\x94\xad\x20\x5d\x13\x1a\x8d\xd2\x65\x23\x70\xde\xd1\x3c\x5d\x05\x19\xcb\x27\x0d\x7c\x2c\x89\x00\x00\x38\xc0\x2c\xc0\x30\x00\x9f\xcc\xa9\xcc\xa8\xcc\xaa\xc0\x2b\xc0\x2f\x00\x9e\xc0\x24\xc0\x28\x00\x6b\xc0\x23\xc0\x27\x00\x67\xc0\x0a\xc0\x14\x00\x39\xc0\x09\xc0\x13\x00\x33\x00\x9d\x00\x9c\x00\x3d\x00\x3c\x00\x35\x00\x2f\x00\xff\x01\x00\x00\x5f\x00\x00\x00\x09\x00\x07\x00\x00\x04\$sni\x00\x0b\x00\x04\x03\x00\x01\x02\x00\x0a\x00\x0a\x00\x08\x00\x1d\x00\x17\x00\x19\x00\x18\x00\x23\x00\x00\x00\x0d\x00\x20\x00\x1e\x06\x01\x06\x02\x06\x03\x05\x01\x05\x02\x05\x03\x04\x01\x04\x02\x04\x03\x03\x01\x03\x02\x03\x03\x02\x01\x02\x02\x02\x03\x00\x10\x00\x08\x00\x06\x05\$alpn\x00\x16\x00\x00\x00\x17\x00\x00hello sni/alpn",
+                # Packet with SNI alone
+                data_sni => "\x16\x03\x01\x00\xb8\x01\x00\x00\xb4\x03\x03\x97\xe4\xe9\xad\x86\xe1\x21\xfd\xc4\x5b\x27\x0e\xad\x4b\x55\xc2\x50\xe4\x1c\x86\x2f\x37\x25\xde\xe8\x9c\x59\xfc\x1b\xa9\x37\x32\x00\x00\x38\xc0\x2c\xc0\x30\x00\x9f\xcc\xa9\xcc\xa8\xcc\xaa\xc0\x2b\xc0\x2f\x00\x9e\xc0\x24\xc0\x28\x00\x6b\xc0\x23\xc0\x27\x00\x67\xc0\x0a\xc0\x14\x00\x39\xc0\x09\xc0\x13\x00\x33\x00\x9d\x00\x9c\x00\x3d\x00\x3c\x00\x35\x00\x2f\x00\xff\x01\x00\x00\x53\x00\x00\x00\x09\x00\x07\x00\x00\x04\$sni\x00\x0b\x00\x04\x03\x00\x01\x02\x00\x0a\x00\x0a\x00\x08\x00\x1d\x00\x17\x00\x19\x00\x18\x00\x23\x00\x00\x00\x0d\x00\x20\x00\x1e\x06\x01\x06\x02\x06\x03\x05\x01\x05\x02\x05\x03\x04\x01\x04\x02\x04\x03\x03\x01\x03\x02\x03\x03\x02\x01\x02\x02\x02\x03\x00\x16\x00\x00\x00\x17\x00\x00hello sni",
+                # packet with ALPN alone
+                data_alpn => "\x16\x03\x01\x00\xb7\x01\x00\x00\xb3\x03\x03\xe2\x90\xa2\x29\x03\x31\xad\x98\x44\x51\x54\x90\x5b\xd9\x51\x0e\x66\xb5\x3f\xe8\x8b\x09\xc9\xe4\x2b\x97\x24\xef\xad\x56\x06\xc9\x00\x00\x38\xc0\x2c\xc0\x30\x00\x9f\xcc\xa9\xcc\xa8\xcc\xaa\xc0\x2b\xc0\x2f\x00\x9e\xc0\x24\xc0\x28\x00\x6b\xc0\x23\xc0\x27\x00\x67\xc0\x0a\xc0\x14\x00\x39\xc0\x09\xc0\x13\x00\x33\x00\x9d\x00\x9c\x00\x3d\x00\x3c\x00\x35\x00\x2f\x00\xff\x01\x00\x00\x52\x00\x0b\x00\x04\x03\x00\x01\x02\x00\x0a\x00\x0a\x00\x08\x00\x1d\x00\x17\x00\x19\x00\x18\x00\x23\x00\x00\x00\x0d\x00\x20\x00\x1e\x06\x01\x06\x02\x06\x03\x05\x01\x05\x02\x05\x03\x04\x01\x04\x02\x04\x03\x03\x01\x03\x02\x03\x03\x02\x01\x02\x02\x02\x03\x00\x10\x00\x08\x00\x06\x05\$alpn\x00\x16\x00\x00\x00\x17\x00\x00hello alpn",
+                # packet with no SNI, no ALPN
+                data => "\x16\x03\x01\x00\xab\x01\x00\x00\xa7\x03\x03\x89\x22\x33\x95\x43\x7a\xc3\x89\x45\x51\x12\x3c\x28\x24\x1b\x6a\x78\xbf\xbe\x95\xd8\x90\x58\xd7\x65\xf7\xbb\x2d\xb2\x8d\xa0\x75\x00\x00\x38\xc0\x2c\xc0\x30\x00\x9f\xcc\xa9\xcc\xa8\xcc\xaa\xc0\x2b\xc0\x2f\x00\x9e\xc0\x24\xc0\x28\x00\x6b\xc0\x23\xc0\x27\x00\x67\xc0\x0a\xc0\x14\x00\x39\xc0\x09\xc0\x13\x00\x33\x00\x9d\x00\x9c\x00\x3d\x00\x3c\x00\x35\x00\x2f\x00\xff\x01\x00\x00\x46\x00\x0b\x00\x04\x03\x00\x01\x02\x00\x0a\x00\x0a\x00\x08\x00\x1d\x00\x17\x00\x19\x00\x18\x00\x23\x00\x00\x00\x0d\x00\x20\x00\x1e\x06\x01\x06\x02\x06\x03\x05\x01\x05\x02\x05\x03\x04\x01\x04\x02\x04\x03\x03\x01\x03\x02\x03\x03\x02\x01\x02\x02\x02\x03\x00\x16\x00\x00\x00\x17\x00\x00hello tls alone"
+            },
+            'openvpn' => { data => "\x00\x00" },
+            'tinc' => { data => "0 hello" },
+            'xmpp' => {data => "I should get a real jabber connection initialisation here" },
+            'adb' => { data => "CNXN....................host:..." },
+            'anyprot' => {data => "hello anyprot this needs to be longer than xmpp and adb which expect about 50 characters, which I all have to write before the timeout!" },
+        );
+
+        my $pattern = $protocols{$p->{name}}->{data};
+
+        $opts{no_frag} = 1 if $protocols{$p->{name}}->{no_frag};
+
+        if ($p->{sni_hostnames} or $p->{alpn_protocols}) {
+            my $pname = make_sni_alpn_name($p);
+
+            my @sni = @{$p->{sni_hostnames} // [""] };
+            my @alpn = @{$p->{alpn_protocols} // [""] };
+
+            foreach my $sni ( @sni ) {
+                foreach my $alpn ( @alpn ) {
+                    print "sni: $sni\nalpn: $alpn\n";
+                    $pattern = $protocols{tls}->{
+                        "data". ($sni ?  "_sni" : "") . 
+                                ($alpn ?  "_alpn": "")
+                    };
+                    $pattern =~ s/(\$\w+)/$1/eeg;
+
+                    test_probe(
+                        data => $pattern,
+                        expected => $pname,
+                        %opts
+                    );
+                }
+            }
+        } else {
+            test_probe(
+                data => $pattern,
+                expected => $p->{name},
+                %opts
+            );
+
+        }
+    }
+}
+
+
+
+# Start an echoserver for each service
+foreach my $s (@{$conf->fetch_array("protocols")}) {
+    my $prefix = $s->{name};
+
+    $prefix =~ s/^ssl/tls/; # To remove in 1.21
+
+    if ($s->{sni_hostnames} or $s->{alpn_protocols}) {
+        $prefix = make_sni_alpn_name($s);
+    }
+
+    verbose_exec "./echosrv --listen $s->{host}:$s->{port} --prefix '$prefix: '";
+}
+
+
 my @binaries = ('sslh-select', 'sslh-fork');
 for my $binary (@binaries) {
     warn "Testing $binary\n";
@@ -55,29 +195,18 @@ for my $binary (@binaries) {
     my $sslh_pid;
     if (!($sslh_pid = fork)) {
         my $user = (getpwuid $<)[0]; # Run under current username
-        my $cmd = "./$binary -v -f -u $user --listen localhost:$sslh_port --ssh $ssh_address --ssl $ssl_address -P $pidfile";
+        #my $cmd = "./$binary -v -f -u $user --listen localhost:$sslh_port --ssh $ssh_address --ssl $ssl_address -P $pidfile";
-        warn "$cmd\n";
+        my $cmd = "./$binary -v -f -u $user -Ftest.cfg";
-        exec $cmd;
+        verbose_exec $cmd;
-        #exec "valgrind --leak-check=full ./sslh-select -v -f -u $user --listen localhost:$sslh_port --ssh $ssh_address -ssl $ssl_address -P $pidfile";
+        #exec "valgrind --leak-check=full ./$binary -v -f -u $user --listen localhost:$sslh_port --ssh $ssh_address -ssl $ssl_address -P $pidfile";
         exit 0;
     }
     warn "spawned $sslh_pid\n";
-    sleep 1;  # valgrind can be heavy -- wait 5 seconds
+    sleep 5;  # valgrind can be heavy -- wait 5 seconds
 
 
     my $test_data = "hello world\n";
-
+    my $ssl_test_data =  "\x16\x03\x01\x00\xab\x01\x00\x00\xa7\x03\x03\x89\x22\x33\x95\x43\x7a\xc3\x89\x45\x51\x12\x3c\x28\x24\x1b\x6a\x78\xbf\xbe\x95\xd8\x90\x58\xd7\x65\xf7\xbb\x2d\xb2\x8d\xa0\x75\x00\x00\x38\xc0\x2c\xc0\x30\x00\x9f\xcc\xa9\xcc\xa8\xcc\xaa\xc0\x2b\xc0\x2f\x00\x9e\xc0\x24\xc0\x28\x00\x6b\xc0\x23\xc0\x27\x00\x67\xc0\x0a\xc0\x14\x00\x39\xc0\x09\xc0\x13\x00\x33\x00\x9d\x00\x9c\x00\x3d\x00\x3c\x00\x35\x00\x2f\x00\xff\x01\x00\x00\x46\x00\x0b\x00\x04\x03\x00\x01\x02\x00\x0a\x00\x0a\x00\x08\x00\x1d\x00\x17\x00\x19\x00\x18\x00\x23\x00\x00\x00\x0d\x00\x20\x00\x1e\x06\x01\x06\x02\x06\x03\x05\x01\x05\x02\x05\x03\x04\x01\x04\x02\x04\x03\x03\x01\x03\x02\x03\x03\x02\x01\x02\x02\x02\x03\x00\x16\x00\x00\x00\x17\x00\x00hello tls alone";
-# Test: SSL connection
-    if ($SSL_CNX) {
-        print "***Test: SSL connection\n";
-        my $cnx_l = new IO::Socket::INET(PeerHost => "localhost:$sslh_port");
-        warn "$!\n" unless $cnx_l;
-        if (defined $cnx_l) {
-            print $cnx_l $test_data;
-            my $data = <$cnx_l>;
-            is($data, "ssl: $test_data", "SSL connection");
-        }
-    }
 
 # Test: Shy SSH connection
     if ($SSH_SHY_CNX) {
@@ -92,26 +221,13 @@ for my $binary (@binaries) {
         }
     }
 
-# Test: Bold SSH connection
-    if ($SSH_BOLD_CNX) {
-        print "***Test: Bold SSH connection\n";
-        my $cnx_h = new IO::Socket::INET(PeerHost => "localhost:$sslh_port");
-        warn "$!\n" unless $cnx_h;
-        if (defined $cnx_h) {
-            my $td = "SSH-2.0 testsuite\t$test_data";
-            print $cnx_h $td;
-            my $data = <$cnx_h>;
-            is($data, "ssh: $td", "Bold SSH connection");
-        }
-    }
-
 # Test: One SSL half-started then one SSH
     if ($SSL_MIX_SSH) {
         print "***Test: One SSL half-started then one SSH\n";
         my $cnx_l = new IO::Socket::INET(PeerHost => "localhost:$sslh_port");
         warn "$!\n" unless $cnx_l;
         if (defined $cnx_l) {
-            print $cnx_l $test_data;
+            print $cnx_l $ssl_test_data;
             my $cnx_h= new IO::Socket::INET(PeerHost => "localhost:$sslh_port");
             warn "$!\n" unless $cnx_h;
             if (defined $cnx_h) {
@@ -120,8 +236,9 @@ for my $binary (@binaries) {
                 my $data_h = <$cnx_h>;
                 is($data_h, "ssh: $test_data", "SSH during SSL being established");
             }
-            my $data = <$cnx_l>;
+            my $data;
-            is($data, "ssl: $test_data", "SSL connection interrupted by SSH");
+            my $n = sysread $cnx_l, $data, 1024;
+            is($data, "tls: $ssl_test_data", "SSL connection interrupted by SSH");
         }
     }
 
@@ -135,9 +252,10 @@ for my $binary (@binaries) {
             my $cnx_l = new IO::Socket::INET(PeerHost => "localhost:$sslh_port");
             warn "$!\n" unless $cnx_l;
             if (defined $cnx_l) {
-                print $cnx_l $test_data;
+                print $cnx_l $ssl_test_data;
-                my $data = <$cnx_l>;
+                my $data;
-                is($data, "ssl: $test_data", "SSL during SSH being established");
+                my $n = sysread $cnx_l, $data, 1024;
+                is($data, "tls: $ssl_test_data", "SSL during SSH being established");
             }
             print $cnx_h $test_data;
             my $data = <$cnx_h>;
@@ -146,47 +264,12 @@ for my $binary (@binaries) {
     }
 
 
-# Test: Big messages (careful: don't go over echosrv's buffer limit (1M))
+    if ($PROBES_NOFRAG) {
-    if ($BIG_MSG) {
+        test_probes(no_frag => 1);
-        print "***Test: big message\n";
-        my $cnx_l = new IO::Socket::INET(PeerHost => "localhost:$sslh_port");
-        warn "$!\n" unless $cnx_l;
-        my $test_data2 = "helloworld";
-        my $rept = 10000;
-        if (defined $cnx_l) {
-            print $cnx_l ($test_data2 x $rept);
-            print $cnx_l "\n";
-            my $data = <$cnx_l>;
-            is($data, "ssl: ". ($test_data2 x $rept) . "\n", "Big message");
-        }
     }
 
-# Test: Stalled connection
+    if ($PROBES_AGAIN) {
-# Create two connections, stall one, check the other one
+        test_probes;
-# works, unstall first and check it works fine
-    if ($STALL_CNX) {
-        print "***Test: Stalled connection\n";
-        my $cnx_1 = new IO::Socket::INET(PeerHost => "localhost:$sslh_port");
-        warn "$!\n" unless defined $cnx_1;
-        my $cnx_2 = new IO::Socket::INET(PeerHost => "localhost:$sslh_port");
-        warn "$!\n" unless defined $cnx_2;
-        my $test_data2 = "helloworld";
-        my $rept = 10000;
-        if (defined $cnx_1 and defined $cnx_2) {
-            print $cnx_1 ($test_data2 x $rept);
-            print $cnx_1 "\n";
-            print $cnx_2 ($test_data2 x $rept);
-            print $cnx_2 "\n";
-            my $data = <$cnx_2>;
-            is($data, "ssl: " . ($test_data2 x $rept) . "\n", "Stalled connection (1)");
-            print $cnx_2 ($test_data2 x $rept);
-            print $cnx_2 "\n";
-            $data = <$cnx_2>;
-            is($data, "ssl: " . ($test_data2 x $rept) . "\n", "Stalled connection (2)");
-            $data = <$cnx_1>;
-            is($data, "ssl: " . ($test_data2 x $rept) . "\n", "Stalled connection (3)");
-
-        }
     }
 
     my $pid = `cat $pidfile`;
@@ -200,7 +283,6 @@ if ($RB_CNX_NOSERVER) {
     print "***Test: Connecting to non-existant server\n";
     my $sslh_pid;
     if (!($sslh_pid = fork)) {
-        my $user = (getpwuid $<)[0]; # Run under current username
         exec "./sslh-select -v -f -u $user --listen localhost:$sslh_port --ssh localhost:$no_listen --ssl localhost:$no_listen -P $pidfile";
     }
     warn "spawned $sslh_pid\n";
@@ -221,12 +303,19 @@ if ($RB_CNX_NOSERVER) {
 }
 
 
+my $ssh_conf = (grep { $_->{name} eq "ssh" } @{$conf->fetch_array("protocols")})[0];
+my $ssh_address = $ssh_conf->{host} . ":" .  $ssh_conf->{port};
+
+# Use the last TLS echoserv (no SNI/ALPN)
+my $ssl_conf = (grep { $_->{name} eq "tls" } @{$conf->fetch_array("protocols")})[-1];
+my $ssl_address = $ssl_conf->{host} . ":" .  $ssl_conf->{port};
+
+
 # Robustness: No hostname in address
 if ($RB_PARAM_NOHOST) {
     print "***Test: No hostname in address\n";
     my $sslh_pid;
     if (!($sslh_pid = fork)) {
-        my $user = (getpwuid $<)[0]; # Run under current username
         exec "./sslh-select -v -f -u $user --listen $sslh_port --ssh $ssh_address --ssl $ssl_address -P $pidfile";
     }
     warn "spawned $sslh_pid\n";
@@ -241,7 +330,6 @@ if ($RB_WRONG_USERNAME) {
     print "***Test: Changing to non-existant username\n";
     my $sslh_pid;
     if (!($sslh_pid = fork)) {
-        my $user = (getpwuid $<)[0]; # Run under current username
         exec "./sslh-select -v -f -u ${user}_doesnt_exist --listen localhost:$sslh_port --ssh $ssh_address --ssl $ssl_address -P $pidfile";
     }
     warn "spawned $sslh_pid\n";
@@ -256,7 +344,6 @@ if ($RB_OPEN_PID_FILE) {
     print "***Test: Can't open PID file\n";
     my $sslh_pid;
     if (!($sslh_pid = fork)) {
-        my $user = (getpwuid $<)[0]; # Run under current username
         exec "./sslh-select -v -f -u $user --listen localhost:$sslh_port --ssh $ssh_address --ssl $ssl_address -P /dont_exist/$pidfile";
         # You don't have a /dont_exist/ directory, do you?!
     }
@@ -267,21 +354,6 @@ if ($RB_OPEN_PID_FILE) {
     is($code, 3, "Exit status if can't open PID file");
 }
 
-# Robustness: Can't bind address
-if ($RB_BIND_ADDRESS) {
-    print "***Test: Can't bind address\n";
-    my $sslh_pid;
-    if (!($sslh_pid = fork)) {
-        my $user = (getpwuid $<)[0]; # Run under current username
-        exec "./sslh-select -v -f -u $user --listen 74.125.39.106:9000 --ssh $ssh_address --ssl $ssl_address -P $pidfile";
-    }
-    warn "spawned $sslh_pid\n";
-    waitpid $sslh_pid, 0;
-    my $code = $? >> 8;
-    warn "exited with $code\n";
-    is($code, 1, "Exit status if can't bind address");
-}
-
 # Robustness: Can't resolve address
 if ($RB_RESOLVE_ADDRESS) {
     print "***Test: Can't resolve address\n";

test.cfg

@@ -0,0 +1,42 @@
+# Configuration file for testing (use both by sslh under
+# test and the test script `t`)
+
+verbose: 2;
+foreground: true;
+inetd: false;
+numeric: false;
+transparent: false;
+timeout: 10;   # Probe test writes slowly
+pidfile: "/tmp/sslh_test.pid";
+
+syslog_facility: "auth"; 
+
+
+# List of interfaces on which we should listen
+# Options:
+listen:
+(
+    { host: "localhost"; port: "8080"; keepalive: true; },
+    { host: "localhost"; port: "8081"; keepalive: true; }
+);
+
+ 
+protocols:
+(
+     { name: "ssh";  host: "localhost"; port: "9000"; fork: true; },
+     { name: "socks5";  host: "localhost"; port: "9001";  },
+     { name: "http";  host: "localhost"; port: "9002";  },
+     { name: "tinc";  host: "localhost"; port: "9003"; },
+     { name: "openvpn";  host: "localhost"; port: "9004"; },
+     { name: "xmpp";  host: "localhost"; port: "9009"; },
+     { name: "adb";  host: "localhost"; port: "9010"; },
+     { name: "tls"; host: "localhost"; port: "9021"; alpn_protocols: [ "alpn1", "alpn2" ]; sni_hostnames: [ "sni1" ]; },
+     { name: "ssl"; host: "localhost"; port: "9022"; alpn_protocols: [ "alpn1", "alpn2" ]; sni_hostnames: [ "sni2", "sni3" ]; },
+     { name: "tls"; host: "localhost"; port: "9023"; alpn_protocols: [ "alpn3" ]; },
+     { name: "tls"; host: "localhost"; port: "9024"; sni_hostnames: [ "sni3" ]; },
+     { name: "ssl"; host: "localhost"; port: "9025"; },
+     { name: "anyprot";  host: "localhost"; port: "9099";  }
+);
+
+on-timeout: "ssh";
+

tls.c

@@ -0,0 +1,305 @@
+/*
+ * Copyright (c) 2011 and 2012, Dustin Lundquist <dustin@null-ptr.net>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+/*
+ * This is a minimal TLS implementation intended only to parse the server name
+ * extension.  This was created based primarily on Wireshark dissection of a
+ * TLS handshake and RFC4366.
+ */
+#include <stdio.h>
+#include <stdlib.h> /* malloc() */
+#include <fnmatch.h> /* fnmatch() */
+#include "tls.h"
+
+#define TLS_HEADER_LEN 5
+#define TLS_HANDSHAKE_CONTENT_TYPE 0x16
+#define TLS_HANDSHAKE_TYPE_CLIENT_HELLO 0x01
+
+#ifndef MIN
+#define MIN(X, Y) ((X) < (Y) ? (X) : (Y))
+#endif
+
+typedef struct {
+    int tls_match_sni : 1;
+    int tls_match_alpn : 1;
+} TLS_MATCHMODE;
+
+struct TLSProtocol {
+    TLS_MATCHMODE match_mode;
+    char** sni_hostname_list;
+    char** alpn_protocol_list;
+};
+
+static int parse_extensions(const struct TLSProtocol *, const char *, size_t);
+static int parse_server_name_extension(const struct TLSProtocol *, const char *, size_t);
+static int parse_alpn_extension(const struct TLSProtocol *, const char *, size_t);
+static int has_match(char**, const char*, size_t);
+
+/* Parse a TLS packet for the Server Name Indication and ALPN extension in the client
+ * hello handshake, returning a status code
+ *
+ * Returns:
+ * 0: no match
+ * 1: match
+ *  < 0:  error code (see tls.h)
+ */
+int
+parse_tls_header(const struct TLSProtocol *tls_data, const char *data, size_t data_len) {
+    char tls_content_type;
+    char tls_version_major;
+    char tls_version_minor;
+    size_t pos = TLS_HEADER_LEN;
+    size_t len;
+
+    /* Check that our TCP payload is at least large enough for a TLS header */
+    if (data_len < TLS_HEADER_LEN)
+        return TLS_ELENGTH;
+
+    tls_content_type = data[0];
+    if (tls_content_type != TLS_HANDSHAKE_CONTENT_TYPE) {
+        if (verbose) fprintf(stderr, "Request did not begin with TLS handshake.\n");
+        return TLS_EPROTOCOL;
+    }
+
+    tls_version_major = data[1];
+    tls_version_minor = data[2];
+    if (tls_version_major < 3) {
+        if (verbose) fprintf(stderr, "Received SSL %d.%d handshake which cannot be parsed.\n",
+              tls_version_major, tls_version_minor);
+
+        return TLS_EVERSION;
+    }
+
+    /* TLS record length */
+    len = ((unsigned char)data[3] << 8) +
+          (unsigned char)data[4] + TLS_HEADER_LEN;
+    data_len = MIN(data_len, len);
+
+    /* Check we received entire TLS record length */
+    if (data_len < len)
+        return TLS_ELENGTH;
+
+    /*
+     * Handshake
+     */
+    if (pos + 1 > data_len) {
+        return TLS_EPROTOCOL;
+    }
+    if (data[pos] != TLS_HANDSHAKE_TYPE_CLIENT_HELLO) {
+        if (verbose) fprintf(stderr, "Not a client hello\n");
+
+        return TLS_EPROTOCOL;
+    }
+
+    /* Skip past fixed length records:
+       1	Handshake Type
+       3	Length
+       2	Version (again)
+       32	Random
+       to	Session ID Length
+     */
+    pos += 38;
+
+    /* Session ID */
+    if (pos + 1 > data_len)
+        return TLS_EPROTOCOL;
+    len = (unsigned char)data[pos];
+    pos += 1 + len;
+
+    /* Cipher Suites */
+    if (pos + 2 > data_len)
+        return TLS_EPROTOCOL;
+    len = ((unsigned char)data[pos] << 8) + (unsigned char)data[pos + 1];
+    pos += 2 + len;
+
+    /* Compression Methods */
+    if (pos + 1 > data_len)
+        return TLS_EPROTOCOL;
+    len = (unsigned char)data[pos];
+    pos += 1 + len;
+
+    if (pos == data_len && tls_version_major == 3 && tls_version_minor == 0) {
+        if (verbose) fprintf(stderr, "Received SSL 3.0 handshake without extensions\n");
+        return TLS_EVERSION;
+    }
+
+    /* Extensions */
+    if (pos + 2 > data_len)
+        return TLS_EPROTOCOL;
+    len = ((unsigned char)data[pos] << 8) + (unsigned char)data[pos + 1];
+    pos += 2;
+
+    if (pos + len > data_len)
+        return TLS_EPROTOCOL;
+
+    /* By now we know it's TLS. if SNI or ALPN is set, parse extensions to see if
+     * they match. Otherwise, it's a match already */
+    if (tls_data && 
+        (tls_data->match_mode.tls_match_alpn || tls_data->match_mode.tls_match_sni)) {
+        return parse_extensions(tls_data, data + pos, len);
+    } else {
+        return TLS_MATCH;
+    }
+}
+
+static int
+parse_extensions(const struct TLSProtocol *tls_data, const char *data, size_t data_len) {
+    size_t pos = 0;
+    size_t len;
+    int sni_match = 0, alpn_match = 0;
+
+    if (tls_data == NULL)
+        return TLS_EINVAL;
+
+    /* Parse each 4 bytes for the extension header */
+    while (pos + 4 <= data_len) {
+        /* Extension Length */
+        len = ((unsigned char) data[pos + 2] << 8) +
+              (unsigned char) data[pos + 3];
+
+        if (pos + 4 + len > data_len)
+            return TLS_EPROTOCOL;
+
+        size_t extension_type = ((unsigned char) data[pos] << 8) +
+                                (unsigned char) data[pos + 1];
+
+        if (extension_type == 0x00 && tls_data->match_mode.tls_match_sni) { /* Server Name */
+            sni_match = parse_server_name_extension(tls_data, data + pos + 4, len);
+            if (sni_match < 0) return sni_match;
+        } else if (extension_type == 0x10 && tls_data->match_mode.tls_match_alpn) { /* ALPN */
+            alpn_match = parse_alpn_extension(tls_data, data + pos + 4, len);
+            if (alpn_match < 0) return alpn_match;
+        }
+
+        pos += 4 + len; /* Advance to the next extension header */
+    }
+
+    /* Check we ended where we expected to */
+    if (pos != data_len)
+        return TLS_EPROTOCOL;
+
+    return (sni_match && alpn_match) 
+        || (!tls_data->match_mode.tls_match_sni && alpn_match)
+        || (!tls_data->match_mode.tls_match_alpn && sni_match);
+}
+
+static int
+parse_server_name_extension(const struct TLSProtocol *tls_data, const char *data, size_t data_len) {
+    size_t pos = 2; /* skip server name list length */
+    size_t len;
+
+    while (pos + 3 < data_len) {
+        len = ((unsigned char)data[pos + 1] << 8) +
+              (unsigned char)data[pos + 2];
+
+        if (pos + 3 + len > data_len)
+            return TLS_EPROTOCOL;
+
+        switch (data[pos]) { /* name type */
+            case 0x00: /* host_name */
+                if(has_match(tls_data->sni_hostname_list, data + pos + 3, len)) {
+                    return len;
+                } else {
+                    return TLS_ENOEXT;
+                }
+            default:
+                if (verbose) fprintf(stderr, "Unknown server name extension name type: %d\n",
+                      data[pos]);
+        }
+        pos += 3 + len;
+    }
+    /* Check we ended where we expected to */
+    if (pos != data_len)
+        return TLS_EPROTOCOL;
+
+    return TLS_ENOEXT;
+}
+
+static int
+parse_alpn_extension(const struct TLSProtocol *tls_data, const char *data, size_t data_len) {
+    size_t pos = 2;
+    size_t len;
+
+    while (pos + 1 < data_len) {
+        len = (unsigned char)data[pos];
+
+        if (pos + 1 + len > data_len)
+            return TLS_EPROTOCOL;
+
+        if (len > 0 && has_match(tls_data->alpn_protocol_list, data + pos + 1, len)) {
+            return len;
+        } else if (len > 0) {
+            if (verbose) fprintf(stderr, "Unknown ALPN name: %.*s\n", (int)len, data + pos + 1);
+        }
+        pos += 1 + len;
+    }
+    /* Check we ended where we expected to */
+    if (pos != data_len)
+        return TLS_EPROTOCOL;
+
+    return TLS_ENOEXT;
+}
+
+static int
+has_match(char** list, const char* name, size_t name_len) {
+    char **item;
+    char *name_nullterminated = malloc(name_len+1);
+    CHECK_ALLOC(name_nullterminated, "malloc");
+    memcpy(name_nullterminated, name, name_len);
+    name_nullterminated[name_len]='\0';
+
+    for (item = list; *item; item++) {
+        if (verbose) fprintf(stderr, "matching [%.*s] with [%s]\n", (int)name_len, name, *item);
+        if(!fnmatch(*item, name_nullterminated, 0)) {
+            free(name_nullterminated);
+            return 1;
+        }
+    }
+    free(name_nullterminated);
+    return 0;
+}
+
+struct TLSProtocol *
+new_tls_data() {
+    struct TLSProtocol *tls_data = malloc(sizeof(struct TLSProtocol));
+    CHECK_ALLOC(tls_data, "malloc");
+
+    memset(tls_data, 0, sizeof(*tls_data));
+
+    return tls_data;
+}
+
+struct TLSProtocol *
+tls_data_set_list(struct TLSProtocol *tls_data, int alpn, char** list) {
+    if (alpn) {
+        tls_data->alpn_protocol_list = list;
+        tls_data->match_mode.tls_match_alpn = 1;
+    } else {
+        tls_data->sni_hostname_list = list;
+        tls_data->match_mode.tls_match_sni = 1;
+    }
+
+    return tls_data;
+}

tls.h

@@ -0,0 +1,48 @@
+/*
+ * Copyright (c) 2011 and 2012, Dustin Lundquist <dustin@null-ptr.net>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef TLS_H
+#define TLS_H
+
+#include "common.h"
+
+struct TLSProtocol;
+
+int parse_tls_header(const struct TLSProtocol *tls_data, const char *data, size_t data_len);
+
+struct TLSProtocol *new_tls_data();
+struct TLSProtocol *tls_data_set_list(struct TLSProtocol *, int, char**);
+
+#define TLS_MATCH       1
+#define TLS_NOMATCH     0
+
+#define TLS_EINVAL      -1 /* Invalid parameter (NULL data pointer) */
+#define TLS_ELENGTH     -2 /* Incomplete request */
+#define TLS_EVERSION    -3 /* TLS version that cannot be parsed */
+#define TLS_ENOEXT      -4 /* No ALPN or SNI extension found */
+#define TLS_EPROTOCOL   -5 /* Protocol error */
+
+
+#endif