Changelog prepared for v1.16

sslh-fork: close all listening sockets in shoveler

.gitignore

@@ -0,0 +1,10 @@
+*.swp
+*.swo
+*.o
+cscope.*
+echosrv
+sslh-fork
+sslh-select
+sslh.8.gz
+tags
+version.h

ChangeLog

@@ -1,3 +1,39 @@
+v1.16:	11FEB2014
+	Probes made more resilient, to incoming data
+	containing NULLs. Also made them behave properly
+	when receiving too short packets to probe on the
+	first incoming packet.
+	(Ondrej Kuzník)
+
+	Libcap support: Keep only CAP_NET_ADMIN if started
+	as root with transparent proxying and dropping
+	priviledges (enable USELIBCAP in Makefile). This
+	avoids having to mess with filesystem capabilities.
+	(Sebastian Schmidt/yath)
+
+	Fixed bugs related to getpeername that would cause
+	sslh to quit erroneously (getpeername can return
+	actual errors if connections are dropped before
+	getting to getpeername).
+
+	Set IP_FREEDBIND if available to bind to addresses
+	that don't yet exist.
+
+v1.15:	27JUL2013
+	Added --transparent option for transparent proxying.
+	See README for iptables magic and capability
+	management.
+
+	Fixed bug in sslh-select: if number of opened file
+	descriptor became bigger than FD_SETSIZE, bad things
+	would happen.
+
+	Fixed bug in sslh-select: if socket dropped while
+	deferred_data was present, sslh-select would crash.
+
+	Increased FD_SETSIZE for Cygwin, as the default 64
+	is too low for even moderate load.
+
 v1.14: 21DEC2012
 	Corrected OpenVPN probe to support pre-shared secret
 	mode (OpenVPN port-sharing code is... wrong). Thanks

Makefile

@@ -1,8 +1,9 @@
 # Configuration
 
-VERSION="1.14"
+VERSION=$(shell ./genver.sh -r)
 USELIBCONFIG=1	# Use libconfig? (necessary to use configuration files)
 USELIBWRAP=	# Use libwrap?
+USELIBCAP=	# Use libcap?
 COV_TEST= 	# Perform test coverage?
 PREFIX=/usr/local
 
@@ -18,37 +19,44 @@ endif
 CC ?= gcc
 CFLAGS ?=-Wall -g $(CFLAGS_COV)
 
-LIBS=$(LDFLAGS)
+LIBS=
 OBJS=common.o sslh-main.o probe.o
 
 ifneq ($(strip $(USELIBWRAP)),)
 	LIBS:=$(LIBS) -lwrap
-	CFLAGS:=$(CFLAGS) -DLIBWRAP
+	CPPFLAGS+=-DLIBWRAP
 endif
 
 ifneq ($(strip $(USELIBCONFIG)),)
 	LIBS:=$(LIBS) -lconfig
-	CFLAGS:=$(CFLAGS) -DLIBCONFIG
+	CPPFLAGS+=-DLIBCONFIG
+endif
+
+ifneq ($(strip $(USELIBCAP)),)
+	LIBS:=$(LIBS) -lcap
+	CPPFLAGS+=-DLIBCAP
 endif
 
 all: sslh $(MAN) echosrv
 
 .c.o: *.h
-	$(CC) $(CFLAGS) -D'VERSION=$(VERSION)' -c $<
+	$(CC) $(CFLAGS) $(CPPFLAGS) -c $<
 
+version.h:
+	./genver.sh >version.h
 
-sslh: $(OBJS) sslh-fork sslh-select
+sslh: sslh-fork sslh-select
 
-sslh-fork: $(OBJS) sslh-fork.o Makefile common.h
-	$(CC) $(CFLAGS) -D'VERSION=$(VERSION)' -o sslh-fork sslh-fork.o $(OBJS) $(LIBS)
+sslh-fork: version.h $(OBJS) sslh-fork.o Makefile common.h
+	$(CC) $(CFLAGS) $(LDFLAGS) -o sslh-fork sslh-fork.o $(OBJS) $(LIBS)
 	#strip sslh-fork
 
-sslh-select: $(OBJS) sslh-select.o Makefile common.h 
-	$(CC) $(CFLAGS) -D'VERSION=$(VERSION)' -o sslh-select sslh-select.o $(OBJS) $(LIBS)
+sslh-select: version.h $(OBJS) sslh-select.o Makefile common.h
+	$(CC) $(CFLAGS) $(LDFLAGS) -o sslh-select sslh-select.o $(OBJS) $(LIBS)
 	#strip sslh-select
 
 echosrv: $(OBJS) echosrv.o
-	$(CC) $(CFLAGS) -o echosrv echosrv.o probe.o common.o $(LIBS)
+	$(CC) $(CFLAGS) $(LDFLAGS) -o echosrv echosrv.o probe.o common.o $(LIBS)
 
 $(MAN): sslh.pod Makefile
 	pod2man --section=8 --release=$(VERSION) --center=" " sslh.pod | gzip -9 - > $(MAN)
@@ -56,14 +64,12 @@ $(MAN): sslh.pod Makefile
 # Create release: export clean tree and tag current
 # configuration
 release:
-	svn export . /tmp/sslh-$(VERSION)
-	( cd /tmp; tar zcvf /tmp/sslh-$(VERSION).tar.gz sslh-$(VERSION) )
-	( cd .. ; svn copy trunk tags/sslh-$(VERSION) ; cd tags/sslh-$(VERSION) ; make clean )
+	git archive master --prefix="sslh-$(VERSION)/" | gzip > /tmp/sslh-$(VERSION).tar.gz
 
 # generic install: install binary and man page
 install: sslh $(MAN)
-	install -D sslh-fork $(PREFIX)/sbin/sslh
-	install -D -m 0644 $(MAN) $(PREFIX)/share/man/man8/$(MAN)
+	install -pD sslh-fork $(DESTDIR)$(PREFIX)/sbin/sslh
+	install -pD -m 0644 $(MAN) $(DESTDIR)$(PREFIX)/share/man/man8/$(MAN)
 
 # "extended" install for Debian: install startup script
 install-debian: install sslh $(MAN)
@@ -73,15 +79,22 @@ install-debian: install sslh $(MAN)
 	update-rc.d sslh defaults
 
 uninstall:
-	rm -f $(PREFIX)/sbin/sslh $(PREFIX)/share/man/man8/$(MAN) /etc/init.d/sslh /etc/default/sslh
+	rm -f $(DESTDIR)$(PREFIX)/sbin/sslh $(DESTDIR)$(PREFIX)/share/man/man8/$(MAN) $(DESTDIR)/etc/init.d/sslh $(DESTDIR)/etc/default/sslh
 	update-rc.d sslh remove
 
+distclean: clean
+	rm -f tags cscope.*
+
 clean:
-	rm -f sslh-fork sslh-select echosrv $(MAN) *.o *.gcov *.gcno *.gcda *.png *.html *.css *.info 
+	rm -f sslh-fork sslh-select echosrv version.h $(MAN) *.o *.gcov *.gcno *.gcda *.png *.html *.css *.info
 
 tags:
 	ctags --globals -T *.[ch]
 
+cscope:
+	-find . -name "*.[chS]" >cscope.files
+	-cscope -b -R
+
 test:
 	./t
 

README

@@ -1,194 +0,0 @@
-===== sslh -- A ssl/ssh multiplexer. =====
-
-Sslh accepts connections on specified ports, and forwards
-them further based on tests performed on the first data
-packet sent by the remote client.
-
-Probes for HTTP, SSL, SSH, OpenVPN, tinc, XMPP are
-implemented, and any other protocol that can be tested using
-a regular expression, can be recognised. A typical use case
-is to allow serving several services on port 443 (e.g. to
-connect to ssh from inside a corporate firewall, which
-almost never block port 443) while still serving HTTPS on
-that port. 
-
-Hence sslh acts as a protocol demultiplexer, or a
-switchboard. Its name comes from its original function to
-serve SSH and HTTPS on the same port.
-
-==== Compile and install ====
-
-sslh uses libconfig (http://www.hyperrealm.com/libconfig/)
-and libwrap.
-
-For Debian, these are contained in packages libwrap0-dev and
-libconfig8-dev.  
-
-For OpenSUSE, these are contained in packages libconfig9 and
-libconfig-dev in repository
-http://download.opensuse.org/repositories/multimedia:/libs/openSUSE_12.1/
-
-For Fedora, this package should work:
-https://admin.fedoraproject.org/pkgdb/acls/name/libconfig
-(feedback from Fedorans appreciated).
-
-If you can't find libconfig, or just don't want a
-configuration file, set 'USELIBCONFIG=' in the Makefile.
-
-After this, the Makefile should work:
-
-make install
-
-There are a couple of configuration options at the beginning
-of the Makefile: 
-
-    USELIBWRAP compiles support for host access control (see
-    hosts_access(3)), you will need libwrap headers and
-    library to compile (libwrap0-dev in Debian).
-
-    USELIBCONFIG compiles support for the configuration
-    file. You will need libconfig headers to compile
-    (libconfig8-dev in Debian).
-
-The Makefile produces two different executables: sslh-fork
-and sslh-select. 
-
-sslh-fork forks a new process for each incoming connection.
-It is well-tested and very reliable, but incurs the overhead
-of many processes.  sslh-select uses only one thread, which
-monitors all connections at once. It is more recent and less
-tested, but only incurs a 16 byte overhead per connection.
-Also, if it stops, you'll lose all connections, which means
-you can't upgrade it remotely.
-
-If you are going to use sslh for a "small" setup (less than
-a dozen ssh connections and a low-traffic https server) then
-sslh-fork is probably more suited for you. If you are going
-to use sslh on a "medium" setup (a few thousand ssh
-connections, and another few thousand ssl connections),
-sslh-select will be better. If you have a very large site
-(tens of thousands of connections), you'll need a vapourware
-version that would use libevent or something like that.
-
-
-To install:
-
-make
-cp sslh-fork /usr/local/sbin/sslh
-cp scripts/etc.default.sslh /etc/default/sslh
-
-For Debian:
-cp scripts/etc.init.d.sslh /etc/init.d/sslh
-For CentOS:
-cp scripts/etc.rc.d.init.d.sslh /etc/rc.d/init.d/sslh
-
-and probably create links in /etc/rc<x>.d so that the server
-start automatically at boot-up, e.g. under Debian:
-update-rc.d sslh defaults
-
-
-
-==== Configuration ====
-
-You can edit settings in /etc/default/sslh:
-
-LISTEN=ifname:443
-SSH=localhost:22
-SSL=localhost:443
-
-A good scheme is to use the external name of the machine in
-$LISTEN, and bind httpd to localhost:443 (instead of all
-binding to all interfaces): that way, https connections
-coming from inside your network don't need to go through
-sslh, and sslh is only there as a frontal for connections
-coming from the internet.
-
-Note that 'external name' in this context refers to the
-actual IP address of the machine as seen from your network,
-i.e. that that is not 127.0.0.1 in the output of
-ifconfig(8).
-
-==== Libwrap support ====
-
-Sslh can optionnaly perform libwrap checks for the sshd
-service: because the connection to sshd will be coming
-locally from sslh, sshd cannot determine the IP of the
-client.
-
-==== OpenVPN support ====
-
-OpenVPN clients connecting to OpenVPN running with
--port-share reportedly take more than one second between
-the time the TCP connexion is established and the time they
-send the first data packet. This results in sslh with
-default settings timing out and assuming an SSH connexion.
-To support OpenVPN connexions reliably, it is necessary to
-increase sslh's timeout to 5 seconds.
-
-Instead of using OpenVPN's port sharing, it is more reliable
-to use sslh's -o option to get sslh to do the port sharing.
-
-==== Using proxytunnel with sslh ====
-
-If you are connecting through a proxy that checks that the
-outgoing connection really is SSL and rejects SSH, you can
-encapsulate all your traffic in SSL using proxytunnel (this
-should work with corkscrew as well). On the server side you
-receive the traffic with stunnel to decapsulate SSL, then
-pipe through sslh to switch HTTP on one side and SSL on the
-other.
-
-In that case, you end up with something like this:
-
-ssh -> proxytunnel -e --------ssh/ssl------> stunnel ---ssh---> sslh --> sshd
-
-Web browser --------http/ssl------> stunnel ---http---> sslh --> http:80
-
-Configuration goes like this:
-
-On the server side, using stunnel3:
-stunnel -f -p mycert.pem  -d thelonious:443 -l /usr/local/sbin/sslh -- sslh -i  --http localhost:80 --ssh localhost:22
-
-stunnel options: -f for foreground/debugging, -p specifies
-the key + certificate, -d specifies which interface and port
-we're listening to for incoming connexions, -l summons sslh
-in inetd mode.
-
-sslh options: -i for inetd mode, --http to forward http
-connexions to port 80, and SSH connexions to port 22.
-
-==== IP_TPROXY support ====
-
-There is a netfilter patch that adds an option to the Linux
-TCP/IP stack to allow a program to set the source address
-of an IP packet that it sends. This could let sslh set the
-address of packets to that of the actual client, so that
-sshd would see and log the IP address of the client, making
-sslh transparent.
-
-This is not, and won't be, implemented in sslh for the
-following reasons (in increasing order of importance):
-
-  * It's not vital: the real connecting IP address can be
-    found in logs. Little gain.
-  * It's Linux only: it means increased complexity for no
-    gain to some users.
-  * It's a patch: it means it'd only be useful to Linux
-    users who compile their own kernel.
-  * Only root can use the feature: that's a definite no-no.
-    Sslh should not, must not, will never run as root.
-
-This isn't to mean that it won't eventually get implemented,
-when/if the feature finds its way into the main kernel and
-it becomes usuable by non-root processes.
-
-
-==== Comments? Questions? ====
-
-You can subscribe to the sslh mailing list here:
-http://rutschle.net/cgi-bin/mailman/listinfo/sslh
-
-This mailing list should be used for discussion, feature
-requests, and will be the prefered channel for
-announcements.
-

README.md

@@ -0,0 +1,261 @@
+sslh -- A ssl/ssh multiplexer
+=============================
+
+`sslh` accepts connections on specified ports, and forwards
+them further based on tests performed on the first data
+packet sent by the remote client.
+
+Probes for HTTP, SSL, SSH, OpenVPN, tinc, XMPP are
+implemented, and any other protocol that can be tested using
+a regular expression, can be recognised. A typical use case
+is to allow serving several services on port 443 (e.g. to
+connect to SSH from inside a corporate firewall, which
+almost never block port 443) while still serving HTTPS on
+that port. 
+
+Hence `sslh` acts as a protocol demultiplexer, or a
+switchboard. Its name comes from its original function to
+serve SSH and HTTPS on the same port.
+
+Compile and install
+===================
+
+Dependencies
+------------
+
+`sslh` uses [libconfig](http://www.hyperrealm.com/libconfig/)
+and [libwrap](http://packages.debian.org/source/unstable/tcp-wrappers).
+
+For Debian, these are contained in packages `libwrap0-dev` and
+`libconfig8-dev`.
+
+For OpenSUSE, these are contained in packages libconfig9 and
+libconfig-dev in repository
+<http://download.opensuse.org/repositories/multimedia:/libs/openSUSE_12.1/>
+
+For Fedora, you'll need packages `libconfig` and
+`libconfig-devel`:
+
+	yum install libconfig libconfig-devel
+
+If you can't find `libconfig`, or just don't want a
+configuration file, set `USELIBCONFIG=` in the Makefile.
+
+Compilation
+-----------
+
+After this, the Makefile should work:
+
+	make install
+
+There are a couple of configuration options at the beginning
+of the Makefile: 
+
+* `USELIBWRAP` compiles support for host access control (see
+  `hosts_access(3)`), you will need `libwrap` headers and
+  library to compile (`libwrap0-dev` in Debian).
+
+* `USELIBCONFIG` compiles support for the configuration
+  file. You will need `libconfig` headers to compile
+  (`libconfig8-dev` in Debian).
+
+
+Binaries
+--------
+
+The Makefile produces two different executables: `sslh-fork`
+and `sslh-select`:
+
+* `sslh-fork` forks a new process for each incoming connection.
+It is well-tested and very reliable, but incurs the overhead
+of many processes.  
+If you are going to use `sslh` for a "small" setup (less than
+a dozen ssh connections and a low-traffic https server) then
+`sslh-fork` is probably more suited for you. 
+
+* `sslh-select` uses only one thread, which monitors all connections
+at once. It is more recent and less tested, but only incurs a 16
+byte overhead per connection. Also, if it stops, you'll lose all
+connections, which means you can't upgrade it remotely.  
+If you are going to use `sslh` on a "medium" setup (a few thousand ssh
+connections, and another few thousand ssl connections),
+`sslh-select` will be better.
+
+If you have a very large site (tens of thousands of connections),
+you'll need a vapourware version that would use libevent or
+something like that.
+
+
+Installation
+------------
+
+* In general:
+
+		make
+		cp sslh-fork /usr/local/sbin/sslh
+		cp scripts/etc.default.sslh /etc/default/sslh
+
+* For Debian:
+
+		cp scripts/etc.init.d.sslh /etc/init.d/sslh
+	
+* For CentOS:
+
+		cp scripts/etc.rc.d.init.d.sslh /etc/rc.d/init.d/sslh
+
+
+You might need to create links in /etc/rc<x>.d so that the server
+start automatically at boot-up, e.g. under Debian:
+
+	update-rc.d sslh defaults
+
+
+Configuration
+=============
+
+You can edit settings in /etc/default/sslh:
+
+	LISTEN=ifname:443
+	SSH=localhost:22
+	SSL=localhost:443
+
+A good scheme is to use the external name of the machine in
+`$LISTEN`, and bind `httpd` to `localhost:443` (instead of all
+binding to all interfaces): that way, HTTPS connections
+coming from inside your network don't need to go through
+`sslh`, and `sslh` is only there as a frontal for connections
+coming from the internet.
+
+Note that 'external name' in this context refers to the
+actual IP address of the machine as seen from your network,
+i.e. that that is not `127.0.0.1` in the output of
+`ifconfig(8)`.
+
+Libwrap support
+---------------
+
+Sslh can optionnaly perform `libwrap` checks for the sshd
+service: because the connection to `sshd` will be coming
+locally from `sslh`, `sshd` cannot determine the IP of the
+client.
+
+OpenVPN support
+---------------
+
+OpenVPN clients connecting to OpenVPN running with
+`-port-share` reportedly take more than one second between
+the time the TCP connexion is established and the time they
+send the first data packet. This results in `sslh` with
+default settings timing out and assuming an SSH connexion.
+To support OpenVPN connexions reliably, it is necessary to
+increase `sslh`'s timeout to 5 seconds.
+
+Instead of using OpenVPN's port sharing, it is more reliable
+to use `sslh`'s `-o` option to get `sslh` to do the port sharing.
+
+Using proxytunnel with sslh
+---------------------------
+
+If you are connecting through a proxy that checks that the
+outgoing connection really is SSL and rejects SSH, you can
+encapsulate all your traffic in SSL using `proxytunnel` (this
+should work with `corkscrew` as well). On the server side you
+receive the traffic with `stunnel` to decapsulate SSL, then
+pipe through `sslh` to switch HTTP on one side and SSL on the
+other.
+
+In that case, you end up with something like this:
+
+	ssh -> proxytunnel -e ----[ssh/ssl]---> stunnel ---[ssh]---> sslh --> sshd
+	Web browser -------------[http/ssl]---> stunnel ---[http]--> sslh --> httpd
+
+Configuration goes like this on the server side, using `stunnel3`:
+
+	stunnel -f -p mycert.pem  -d thelonious:443 -l /usr/local/sbin/sslh -- \
+		sslh -i  --http localhost:80 --ssh localhost:22
+
+* stunnel options:
+  * `-f` for foreground/debugging
+  * `-p` for specifying the key and certificate
+  * `-d` for specifying which interface and port
+	we're listening to for incoming connexions
+  * `-l` summons `sslh` in inetd mode.
+
+* sslh options:
+  * `-i` for inetd mode
+  * `--http` to forward HTTP connexions to port 80,
+	and SSH connexions to port 22.
+
+Capabilities support
+--------------------
+
+On Linux (only?), you can compile sslh with `USELIBCAP=1` to
+make use of POSIX capabilities; this will save the required
+capabilities needed for transparent proxying for unprivileged
+processes.
+
+Alternatively, you may use filesystem capabilities instead
+of starting sslh as root and asking it to drop privileges.
+You will need `CAP_NET_BIND_SERVICE` for listening on port 443
+and `CAP_NET_ADMIN` for transparent proxying (see
+`capabilities(7)`).
+
+You can use the `setcap(8)` utility to give these capabilities
+to the executable:
+
+	# setcap cap_net_bind_service,cap_net_admin+pe sslh-select
+
+Then you can run sslh-select as an unpriviledged user, e.g.:
+
+	$ sslh-select -p myname:443 --ssh localhost:22 --ssl localhost:443
+
+Caveat: `CAP_NET_ADMIN` does give sslh too many rights, e.g.
+configuring the interface. If you're not going to use
+transparent proxying, just don't use it (or use the libcap method).
+
+Transparent proxy support
+-------------------------
+
+On Linux (only?) you can use the `--transparent` option to
+request transparent proying. This means services behind `sslh`
+(Apache, `sshd` and so on) will see the external IP and ports
+as if the external world connected directly to them. This
+simplifies IP-based access control (or makes it possible at
+all).
+
+`sslh` needs extended rights to perform this: you'll need to
+give it `CAP_NET_ADMIN` capabilities (see appropriate chapter)
+or run it as root (but don't do that).
+
+The firewalling tables also need to be adjusted as follow.
+The example connects to HTTPS on 4443 -- adapt to your needs ;
+I don't think it is possible to have `httpd` listen to 443 in
+this scheme -- let me know if you manage that:
+
+	# iptables -t mangle -N SSLH
+	# iptables -t mangle -A  OUTPUT --protocol tcp --out-interface eth0 --sport 22 --jump SSLH
+	# iptables -t mangle -A OUTPUT --protocol tcp --out-interface eth0 --sport 4443 --jump SSLH
+	# iptables -t mangle -A SSLH --jump MARK --set-mark 0x1
+	# iptables -t mangle -A SSLH --jump ACCEPT
+	# ip rule add fwmark 0x1 lookup 100
+	# ip route add local 0.0.0.0/0 dev lo table 100
+
+This will only work if `sslh` does not use any loopback
+addresses (no `127.0.0.1` or `localhost`), you'll need to use
+explicit IP addresses (or names):
+
+	sslh --listen 192.168.0.1:443 --ssh 192.168.0.1:22 --ssl 192.168.0.1:4443
+
+This will not work:
+
+	sslh --listen 192.168.0.1:443 --ssh 127.0.0.1:22 --ssl 127.0.0.1:4443
+
+Comments? Questions?
+====================
+
+You can subscribe to the `sslh` mailing list here:
+<http://rutschle.net/cgi-bin/mailman/listinfo/sslh>
+
+This mailing list should be used for discussion, feature
+requests, and will be the prefered channel for announcements.
+

TODO

@@ -0,0 +1,25 @@
+Here's a list of features that have been suggested or
+sometimes requested. This list is not a roadmap and
+shouldn't be construed to mean that any of this will happen.
+
+- configurable behaviour depending on services (e.g.
+  select() for ssl but fork() for ssh).
+
+- have certain services available only from specified subnets
+
+- some sort of "service knocking" allowing to activate a
+  service upon some external even, similar to port knocking;
+for example, go to a specific URL to enable sslh forwarding
+to sshd for a set period of time:
+    * sslh listens on 443 and only directs to httpd
+    * user goes somewhere to https://example.org/open_ssh.cgi
+    * open_ssh.cgi tells sslh
+    * sslh starts checking if incoming connections are ssh, and
+    if they are, forward to sshd
+    * 10 minutes later, sslh stops forwarding to ssh
+
+That would make it almost impossible for an observer
+(someone who'd telnet regularly on 443) to ever notice both
+services are available on 443.
+
+

basic.cfg

@@ -5,6 +5,7 @@ verbose: false;
 foreground: false;
 inetd: false;
 numeric: false;
+transparent: false;
 timeout: 2;
 user: "nobody";
 pidfile: "/var/run/sslh.pid";

common.c

@@ -8,6 +8,7 @@
 #include <stdarg.h>
 
 #include "common.h"
+#include "probe.h"
 
 /* Added to make the code compilable under CYGWIN 
  * */
@@ -25,6 +26,7 @@ int probing_timeout = 2;
 int inetd = 0;
 int foreground = 0;
 int background = 0;
+int transparent = 0;
 int numeric = 0;
 const char *user_name, *pid_file;
 
@@ -35,7 +37,6 @@ struct addrinfo *addr_listen = NULL; /* what addresses do we listen to? */
 int allow_severity =0, deny_severity = 0;
 #endif
 
-
 /* check result and die, printing the offending address and error */
 void check_res_dumpdie(int res, struct addrinfo *addr, char* syscall)
 {
@@ -60,7 +61,7 @@ int start_listen_sockets(int *sockfd[], struct addrinfo *addr_list)
 {
    struct sockaddr_storage *saddr;
    struct addrinfo *addr;
-   int i, res, reuse;
+   int i, res, one;
    int num_addr = 0;
 
    for (addr = addr_list; addr; addr = addr->ai_next)
@@ -81,9 +82,14 @@ int start_listen_sockets(int *sockfd[], struct addrinfo *addr_list)
        (*sockfd)[i] = socket(saddr->ss_family, SOCK_STREAM, 0);
        check_res_dumpdie((*sockfd)[i], addr, "socket");
 
-       reuse = 1;
-       res = setsockopt((*sockfd)[i], SOL_SOCKET, SO_REUSEADDR, (char*)&reuse, sizeof(reuse));
-       check_res_dumpdie(res, addr, "setsockopt");
+       one = 1;
+       res = setsockopt((*sockfd)[i], SOL_SOCKET, SO_REUSEADDR, (char*)&one, sizeof(one));
+       check_res_dumpdie(res, addr, "setsockopt(SO_REUSEADDR)");
+
+       if (IP_FREEBIND) {
+           res = setsockopt((*sockfd)[i], IPPROTO_IP, IP_FREEBIND, (char*)&one, sizeof(one));
+           check_res_dumpdie(res, addr, "setsockopt(IP_FREEBIND)");
+       }
 
        res = bind((*sockfd)[i], addr->ai_addr, addr->ai_addrlen);
        check_res_dumpdie(res, addr, "bind");
@@ -96,27 +102,59 @@ int start_listen_sockets(int *sockfd[], struct addrinfo *addr_list)
    return num_addr;
 }
 
+/* Transparent proxying: bind the peer address of fd to the peer address of
+ * fd_from */
+#define IP_TRANSPARENT 19
+int bind_peer(int fd, int fd_from)
+{
+    struct addrinfo from;
+    struct sockaddr_storage ss;
+    int res, trans = 1;
+
+    memset(&from, 0, sizeof(from));
+    from.ai_addr = (struct sockaddr*)&ss;
+    from.ai_addrlen = sizeof(ss);
+
+    /* getpeername can fail with ENOTCONN if connection was dropped before we
+     * got here */
+    res = getpeername(fd_from, from.ai_addr, &from.ai_addrlen);
+    CHECK_RES_RETURN(res, "getpeername");
+    res = setsockopt(fd, IPPROTO_IP, IP_TRANSPARENT, &trans, sizeof(trans));
+    CHECK_RES_DIE(res, "setsockopt");
+    res = bind(fd, from.ai_addr, from.ai_addrlen);
+    CHECK_RES_RETURN(res, "bind");
+
+    return 0;
+}
+
 /* Connect to first address that works and returns a file descriptor, or -1 if
- * none work. cnx_name points to the name of the service (for logging) */
-int connect_addr(struct addrinfo *addr, const char* cnx_name)
+ * none work. 
+ * If transparent proxying is on, use fd_from peer address on external address
+ * of new file descriptor. */
+int connect_addr(struct connection *cnx, int fd_from)
 {
     struct addrinfo *a;
     char buf[NI_MAXHOST];
     int fd, res;
 
-    for (a = addr; a; a = a->ai_next) {
+    for (a = cnx->proto->saddr; a; a = a->ai_next) {
         if (verbose) 
             fprintf(stderr, "connecting to %s family %d len %d\n", 
                     sprintaddr(buf, sizeof(buf), a),
                     a->ai_addr->sa_family, a->ai_addrlen);
         fd = socket(a->ai_family, SOCK_STREAM, 0);
         if (fd == -1) {
-            log_message(LOG_ERR, "forward to %s failed:socket: %s\n", cnx_name, strerror(errno));
+            log_message(LOG_ERR, "forward to %s failed:socket: %s\n",
+                        cnx->proto->description, strerror(errno));
         } else {
+            if (transparent) {
+                res = bind_peer(fd, fd_from);
+                CHECK_RES_RETURN(res, "bind_peer");
+            }
             res = connect(fd, a->ai_addr, a->ai_addrlen);
             if (res == -1) {
                 log_message(LOG_ERR, "forward to %s failed:connect: %s\n", 
-                            cnx_name, strerror(errno));
+                            cnx->proto->description, strerror(errno));
             } else {
                 return fd;
             }
@@ -128,12 +166,20 @@ int connect_addr(struct addrinfo *addr, const char* cnx_name)
 /* Store some data to write to the queue later */
 int defer_write(struct queue *q, void* data, int data_size) 
 {
+    char *p;
     if (verbose) 
-        fprintf(stderr, "**** writing defered on fd %d\n", q->fd);
-    q->defered_data = malloc(data_size);
-    q->begin_defered_data = q->defered_data;
-    q->defered_data_size = data_size;
-    memcpy(q->defered_data, data, data_size);
+        fprintf(stderr, "**** writing deferred on fd %d\n", q->fd);
+
+    p = realloc(q->begin_deferred_data, q->deferred_data_size + data_size);
+    if (!p) {
+        perror("realloc");
+        exit(1);
+    }
+
+    q->deferred_data = q->begin_deferred_data = p;
+    p += q->deferred_data_size;
+    q->deferred_data_size += data_size;
+    memcpy(p, data, data_size);
 
     return 0;
 }
@@ -142,27 +188,27 @@ int defer_write(struct queue *q, void* data, int data_size)
  * Upon success, the number of bytes written is returned.
  * Upon failure, -1 returned (e.g. connexion closed)
  * */
-int flush_defered(struct queue *q)
+int flush_deferred(struct queue *q)
 {
     int n;
 
     if (verbose)
-        fprintf(stderr, "flushing defered data to fd %d\n", q->fd);
+        fprintf(stderr, "flushing deferred data to fd %d\n", q->fd);
 
-    n = write(q->fd, q->defered_data, q->defered_data_size);
+    n = write(q->fd, q->deferred_data, q->deferred_data_size);
     if (n == -1)
         return n;
 
-    if (n == q->defered_data_size) {
+    if (n == q->deferred_data_size) {
         /* All has been written -- release the memory */
-        free(q->begin_defered_data);
-        q->begin_defered_data = NULL;
-        q->defered_data = NULL;
-        q->defered_data_size = 0;
+        free(q->begin_deferred_data);
+        q->begin_deferred_data = NULL;
+        q->deferred_data = NULL;
+        q->deferred_data_size = 0;
     } else {
         /* There is data left */
-        q->defered_data += n;
-        q->defered_data_size -= n;
+        q->deferred_data += n;
+        q->deferred_data_size -= n;
     }
 
     return n;
@@ -174,20 +220,21 @@ void init_cnx(struct connection *cnx)
     memset(cnx, 0, sizeof(*cnx));
     cnx->q[0].fd = -1;
     cnx->q[1].fd = -1;
+    cnx->proto = get_first_protocol();
 }
 
 void dump_connection(struct connection *cnx)
 {
     printf("state: %d\n", cnx->state);
-    printf("fd %d, %d defered\n", cnx->q[0].fd, cnx->q[0].defered_data_size);
-    printf("fd %d, %d defered\n", cnx->q[1].fd, cnx->q[1].defered_data_size);
+    printf("fd %d, %d deferred\n", cnx->q[0].fd, cnx->q[0].deferred_data_size);
+    printf("fd %d, %d deferred\n", cnx->q[1].fd, cnx->q[1].deferred_data_size);
 }
 
 
 /* 
  * moves data from one fd to other
  *
- * retuns number of bytes copied if success
+ * returns number of bytes copied if success
  * returns 0 (FD_CNXCLOSED) if incoming socket closed
  * returns FD_NODATA if no data was available
  * returns FD_STALLED if data was read, could not be written, and has been
@@ -222,7 +269,7 @@ int fd2fd(struct queue *target_q, struct queue *from_q)
 
    size_w = write(target, buffer, size_r);
    /* process -1 when we know how to deal with it */
-   if ((size_w == -1)) {
+   if (size_w == -1) {
        switch (errno) {
        case EAGAIN:
            /* write blocked: Defer data */
@@ -351,7 +398,8 @@ void log_connection(struct connection *cnx)
     addr.ai_addrlen = sizeof(ss);
 
     res = getpeername(cnx->q[0].fd, addr.ai_addr, &addr.ai_addrlen);
-    if (res == -1) return; /* that should never happen, right? */
+    if (res == -1) return; /* Can happen if connection drops before we get here. 
+                               In that case, don't log anything (there is no connection) */
     sprintaddr(peer, sizeof(peer), &addr);
 
     addr.ai_addrlen = sizeof(ss);
@@ -392,7 +440,7 @@ int check_access_rights(int in_socket, const char* service)
     int res;
 
     res = getpeername(in_socket, &peeraddr, &size);
-    CHECK_RES_DIE(res, "getpeername");
+    CHECK_RES_RETURN(res, "getpeername");
 
     /* extract peer address */
     res = getnameinfo(&peeraddr, size, addr_str, sizeof(addr_str), NULL, 0, NI_NUMERICHOST);
@@ -435,7 +483,7 @@ void setup_signals(void)
     res = sigaction(SIGCHLD, &action, NULL);
     CHECK_RES_DIE(res, "sigaction");
 
-    /* Set SIGTERM to exit. For some reason if it's not set explicitely,
+    /* Set SIGTERM to exit. For some reason if it's not set explicitly,
      * coverage information is lost when killing the process */
     memset(&action, 0, sizeof(action));
     action.sa_handler = exit;
@@ -453,9 +501,11 @@ void setup_signals(void)
  * banner is made up of basename(bin_name)+"[pid]" */
 void setup_syslog(const char* bin_name) {
     char *name1, *name2;
+    int res;
 
     name1 = strdup(bin_name);
-    asprintf(&name2, "%s[%d]", basename(name1), getpid());
+    res = asprintf(&name2, "%s[%d]", basename(name1), getpid());
+    CHECK_RES_DIE(res, "asprintf");
     openlog(name2, LOG_CONS, LOG_AUTH);
     free(name1); 
     /* Don't free name2, as openlog(3) uses it (at least in glibc) */
@@ -463,7 +513,57 @@ void setup_syslog(const char* bin_name) {
     log_message(LOG_INFO, "%s %s started\n", server_type, VERSION);
 }
 
-/* We don't want to run as root -- drop priviledges if required */
+/* Ask OS to keep capabilities over a setuid(nonzero) */
+void set_keepcaps(int val) {
+#ifdef LIBCAP
+    int res;
+    res = prctl(PR_SET_KEEPCAPS, val, 0, 0, 0);
+    if (res) {
+        perror("prctl");
+        exit(1);
+    }
+#endif
+}
+
+/* set needed capabilities for effective and permitted, clear rest */
+void set_capabilities(void) {
+#ifdef LIBCAP
+    int res;
+    cap_t caps;
+    cap_value_t cap_list[10];
+    int ncap = 0;
+
+    if (transparent)
+        cap_list[ncap++] = CAP_NET_ADMIN;
+
+    caps = cap_init();
+
+#define _cap_set_flag(flag) do { \
+        res = cap_clear_flag(caps, flag); \
+        CHECK_RES_DIE(res, "cap_clear_flag(" #flag ")"); \
+        if (ncap > 0) { \
+            res = cap_set_flag(caps, flag, ncap, cap_list, CAP_SET); \
+            CHECK_RES_DIE(res, "cap_set_flag(" #flag ")"); \
+        } \
+    } while(0)
+
+    _cap_set_flag(CAP_EFFECTIVE);
+    _cap_set_flag(CAP_PERMITTED);
+
+#undef _cap_set_flag
+
+    res = cap_set_proc(caps);
+    CHECK_RES_DIE(res, "cap_set_proc");
+
+    res = cap_free(caps);
+    if (res) {
+        perror("cap_free");
+        exit(1);
+    }
+#endif
+}
+
+/* We don't want to run as root -- drop privileges if required */
 void drop_privileges(const char* user_name)
 {
     int res;
@@ -475,10 +575,15 @@ void drop_privileges(const char* user_name)
     if (verbose)
         fprintf(stderr, "turning into %s\n", user_name);
 
+    set_keepcaps(1);
+
     res = setgid(pw->pw_gid);
     CHECK_RES_DIE(res, "setgid");
-    setuid(pw->pw_uid);
+    res = setuid(pw->pw_uid);
     CHECK_RES_DIE(res, "setuid");
+
+    set_capabilities();
+    set_keepcaps(0);
 }
 
 /* Writes my PID */

common.h

@@ -1,6 +1,12 @@
 #ifndef __COMMON_H_
 #define __COMMON_H_
 
+/* FD_SETSIZE is 64 on Cygwin, which is really low. Just redefining it is
+ * enough for the macros to adapt (http://support.microsoft.com/kb/111855)
+ */
+#ifdef __CYGWIN__
+#define FD_SETSIZE 4096
+#endif
 
 #define _GNU_SOURCE
 #include <sys/types.h>
@@ -22,10 +28,13 @@
 #include <time.h>
 #include <getopt.h>
 
-#ifndef VERSION
-#define VERSION "v?"
+#ifdef LIBCAP
+#include <sys/prctl.h>
+#include <sys/capability.h>
 #endif
 
+#include "version.h"
+
 #define CHECK_RES_DIE(res, str) \
     if (res == -1) {    \
        perror(str);     \
@@ -34,7 +43,7 @@
 
 #define CHECK_RES_RETURN(res, str) \
     if (res == -1) {                                    \
-        log_message(LOG_CRIT, "%s: %d\n", str, errno);  \
+        log_message(LOG_CRIT, "%s:%d:%s\n", str, errno, strerror(errno));  \
         return res;                                     \
     } 
 
@@ -46,6 +55,10 @@
 #define TRACE
 #endif
 
+#ifndef IP_FREEBIND
+#define IP_FREEBIND 0
+#endif
+
 enum connection_state {
     ST_PROBING=1,    /* Waiting for timeout to find where to forward */
     ST_SHOVELING   /* Connexion is established */
@@ -55,17 +68,18 @@ enum connection_state {
 #define PROT_SHIFT 1000  /* protocol options will be 1000, 1001, etc */
 
 /* A 'queue' is composed of a file descriptor (which can be read from or
- * written to), and a queue for defered write data */
+ * written to), and a queue for deferred write data */
 struct queue {
     int fd;
-    void *begin_defered_data;
-    void *defered_data;
-    int defered_data_size;
+    void *begin_deferred_data;
+    void *deferred_data;
+    int deferred_data_size;
 };
 
 struct connection {
     enum connection_state state;
     time_t probe_timeout;
+    struct proto *proto;
 
     /* q[0]: queue for external connection (client);
      * q[1]: queue for internal connection (httpd or sshd);
@@ -80,11 +94,10 @@ struct connection {
 
 /* common.c */
 void init_cnx(struct connection *cnx);
-int connect_addr(struct addrinfo *addr, const char* cnx_name);
+int connect_addr(struct connection *cnx, int fd_from);
 int fd2fd(struct queue *target, struct queue *from);
 char* sprintaddr(char* buf, size_t size, struct addrinfo *a);
 void resolve_name(struct addrinfo **out, char* fullname);
-struct proto* probe_client_protocol(struct connection *cnx);
 void log_connection(struct connection *cnx);
 int check_access_rights(int in_socket, const char* service);
 void setup_signals(void);
@@ -98,9 +111,10 @@ int resolve_split_name(struct addrinfo **out, const char* hostname, const char*
 int start_listen_sockets(int *sockfd[], struct addrinfo *addr_list);
 
 int defer_write(struct queue *q, void* data, int data_size);
-int flush_defered(struct queue *q);
+int flush_deferred(struct queue *q);
 
-extern int probing_timeout, verbose, inetd, foreground, background, numeric;
+extern int probing_timeout, verbose, inetd, foreground, 
+       background, transparent, numeric;
 extern struct sockaddr_storage addr_ssl, addr_ssh, addr_openvpn;
 extern struct addrinfo *addr_listen;
 extern const char* USAGE_STRING;

example.cfg

@@ -7,6 +7,7 @@ verbose: true;
 foreground: true;
 inetd: false;
 numeric: false;
+transparent: false;
 timeout: 2;
 user: "nobody";
 pidfile: "/var/run/sslh.pid";

genver.sh

@@ -0,0 +1,40 @@
+#! /bin/bash
+
+if [ ${#} -eq 1 ] && [ "x$1" = "x-r" ]; then
+	# release text only
+	QUIET=1
+else
+	QUIET=0
+fi
+
+if ! `(git status | grep -q "On branch") 2> /dev/null`; then
+        # If we don't have git, we can't work out what
+        # version this is. It must have been downloaded as a
+        # zip file. Github creates the zip file with all
+        # files dated from the last change: use the
+        # Makefile's modification time as a release number
+	release=zip-`stat -c "%y" Makefile | sed 's/ .*//'`
+fi
+
+if head=`git rev-parse --verify HEAD 2>/dev/null`; then
+	# generate the version info based on the tag
+	release=`(git describe --tags || git --describe || git describe --all --long) \
+		2>/dev/null | tr -d '\n'`
+
+	# Are there uncommitted changes?
+	git update-index --refresh --unmerged > /dev/null
+	if git diff-index --name-only HEAD | grep -v "^scripts/package" \
+	    | read dummy; then
+		release="$release-dirty"
+	fi
+fi
+
+
+if [ $QUIET -ne 1 ]; then
+	printf "#ifndef _VERSION_H_ \n"
+	printf "#define _VERSION_H_ \n\n"
+	printf "#define VERSION \"$release\"\n"
+	printf "#endif\n"
+else
+	printf "$release\n"
+fi

probe.c

@@ -63,7 +63,8 @@ int get_num_builtins(void) {
 /* Sets the protocol name to connect to in case of timeout */
 void set_ontimeout(const char* name)
 {
-    asprintf(&on_timeout, "%s", name);
+    int res = asprintf(&on_timeout, "%s", name);
+    CHECK_RES_DIE(res, "asprintf");
 }
 
 /* Returns the protocol to connect to in case of timeout; 
@@ -124,10 +125,10 @@ void hexdump(const char *mem, unsigned int len)
 /* Is the buffer the beginning of an SSH connection? */
 static int is_ssh_protocol(const char *p, int len, struct proto *proto)
 {
-    if (!strncmp(p, "SSH-", 4)) {
-        return 1;
-    }
-    return 0;
+    if (len < 4)
+        return PROBE_AGAIN;
+
+    return !strncmp(p, "SSH-", 4);
 }
 
 /* Is the buffer the beginning of an OpenVPN connection?
@@ -142,8 +143,12 @@ static int is_ssh_protocol(const char *p, int len, struct proto *proto)
  */
 static int is_openvpn_protocol (const char*p,int len, struct proto *proto)
 {
-    int packet_len = ntohs(*(uint16_t*)p);
+    int packet_len;
 
+    if (len < 2)
+        return PROBE_AGAIN;
+
+    packet_len = ntohs(*(uint16_t*)p);
     return packet_len == len - 2;
 }
 
@@ -152,6 +157,9 @@ static int is_openvpn_protocol (const char*p,int len, struct proto *proto)
  * */
 static int is_tinc_protocol( const char *p, int len, struct proto *proto)
 {
+    if (len < 2)
+        return PROBE_AGAIN;
+
     return !strncmp(p, "0 ", 2);
 }
 
@@ -161,37 +169,51 @@ static int is_tinc_protocol( const char *p, int len, struct proto *proto)
  * */
 static int is_xmpp_protocol( const char *p, int len, struct proto *proto)
 {
-    return strstr(p, "jabber") ? 1 : 0;
+    if (len < 6)
+        return PROBE_AGAIN;
+
+    return memmem(p, len, "jabber", 6) ? 1 : 0;
 }
 
-static int probe_http_method(const char *p, const char *opt)
+static int probe_http_method(const char *p, int len, const char *opt)
 {
-    return !strcmp(p, opt);
+    if (len < strlen(opt))
+        return PROBE_AGAIN;
+
+    return !strncmp(p, opt, len);
 }
 
 /* Is the buffer the beginning of an HTTP connection?  */
 static int is_http_protocol(const char *p, int len, struct proto *proto)
 {
+    int res;
     /* If it's got HTTP in the request (HTTP/1.1) then it's HTTP */
-    if (strstr(p, "HTTP"))
-        return 1;
+    if (memmem(p, len, "HTTP", 4))
+        return PROBE_MATCH;
+
+#define PROBE_HTTP_METHOD(opt) if ((res = probe_http_method(p, len, opt)) != PROBE_NEXT) return res
 
     /* Otherwise it could be HTTP/1.0 without version: check if it's got an
      * HTTP method (RFC2616 5.1.1) */
-    probe_http_method(p, "OPTIONS");
-    probe_http_method(p, "GET");
-    probe_http_method(p, "HEAD");
-    probe_http_method(p, "POST");
-    probe_http_method(p, "PUT");
-    probe_http_method(p, "DELETE");
-    probe_http_method(p, "TRACE");
-    probe_http_method(p, "CONNECT");
+    PROBE_HTTP_METHOD("OPTIONS");
+    PROBE_HTTP_METHOD("GET");
+    PROBE_HTTP_METHOD("HEAD");
+    PROBE_HTTP_METHOD("POST");
+    PROBE_HTTP_METHOD("PUT");
+    PROBE_HTTP_METHOD("DELETE");
+    PROBE_HTTP_METHOD("TRACE");
+    PROBE_HTTP_METHOD("CONNECT");
 
-    return 0;
+#undef PROBE_HTTP_METHOD
+
+    return PROBE_NEXT;
 }
 
 static int is_tls_protocol(const char *p, int len, struct proto *proto)
 {
+    if (len < 3)
+        return PROBE_AGAIN;
+
     /* TLS packet starts with a record "Hello" (0x16), followed by version
      * (0x03 0x00-0x03) (RFC6101 A.1)
      * This means we reject SSLv2 and lower, which is actually a good thing (RFC6176)
@@ -201,25 +223,22 @@ static int is_tls_protocol(const char *p, int len, struct proto *proto)
 
 static int regex_probe(const char *p, int len, struct proto *proto)
 {
-    regex_t** probe_list = (regex_t**)(proto->data);
-    int i=0;
+    regex_t **probe = proto->data;
+    regmatch_t pos = { 0, len };
 
-    while (probe_list[i]) {
-        if (!regexec(probe_list[i], p, 0, NULL, 0)) {
-            return 1;
-        }
-        i++;
-    }
-    return 0;
+    for (; *probe && regexec(*probe, p, 0, &pos, REG_STARTEND); probe++)
+        /* try them all */;
+
+    return (probe != NULL);
 }
 
 /* 
  * Read the beginning of data coming from the client connection and check if
- * it's a known protocol. Then leave the data on the defered
- * write buffer of the connection and returns a pointer to the protocol
- * structure
+ * it's a known protocol. 
+ * Return PROBE_AGAIN if not enough data, or PROBE_MATCH if it succeeded in
+ * which case cnx->proto is set to the appropriate protocol.
  */
-struct proto* probe_client_protocol(struct connection *cnx)
+int probe_client_protocol(struct connection *cnx)
 {
     char buffer[BUFSIZ];
     struct proto *p;
@@ -232,16 +251,19 @@ struct proto* probe_client_protocol(struct connection *cnx)
      * function does not have to deal with a specific  failure condition (the
      * connection will just fail later normally). */
     if (n > 0) {
+        int res = PROBE_NEXT;
+
         defer_write(&cnx->q[1], buffer, n);
 
-        for (p = protocols; p; p = p->next) {
+        for (p = cnx->proto; p && res == PROBE_NEXT; p = p->next) {
             if (! p->probe) continue;
             if (verbose) fprintf(stderr, "probing for %s\n", p->description);
-            if (p->probe(buffer, n, p)) {
-                if (verbose) fprintf(stderr, "probe %s successful\n", p->description);
-                return p;
-            }
+
+            cnx->proto = p;
+            res = p->probe(cnx->q[1].begin_deferred_data, cnx->q[1].deferred_data_size, p);
         }
+        if (res != PROBE_NEXT)
+            return res;
     }
 
     if (verbose) 
@@ -251,7 +273,8 @@ struct proto* probe_client_protocol(struct connection *cnx)
 
     /* If none worked, return the first one affected (that's completely
      * arbitrary) */
-    return protocols;
+    cnx->proto = protocols;
+    return PROBE_MATCH;
 }
 
 /* Returns the structure for specified protocol or NULL if not found */

probe.h

@@ -5,6 +5,12 @@
 
 #include "common.h"
 
+typedef enum {
+    PROBE_NEXT,  /* Enough data, probe failed -- it's some other protocol */
+    PROBE_MATCH, /* Enough data, probe successful -- it's the current protocol */
+    PROBE_AGAIN, /* Not enough data for this probe, try again with more data */
+} probe_result;
+
 struct proto;
 typedef int T_PROBE(const char*, int, struct proto*);
 
@@ -39,11 +45,11 @@ void set_protocol_list(struct proto*);
 /* probe_client_protocol
  *
  * Read the beginning of data coming from the client connection and check if
- * it's a known protocol. Then leave the data on the defered
+ * it's a known protocol. Then leave the data on the deferred
  * write buffer of the connection and returns a pointer to the protocol
  * structure
  */
-struct proto* probe_client_protocol(struct connection *cnx);
+int probe_client_protocol(struct connection *cnx);
 
 /* set the protocol to connect to in case of timeout */
 void set_ontimeout(const char* name);

scripts/etc.rc.d.init.d.sslh.centos

@@ -1,56 +1,56 @@
 #!/bin/bash
 #
-#       /etc/rc.d/init.d/sslh
-# sslh          This shell script takes care of starting and stopping
-#               sslh - a daemon switching incoming connection between SSH and SSL/HTTPS servers
+# sslh         Startup script for the SSL/SSH multiplexer
 #
-# Author: Andre Krajnik akrajnik@gmail.com
-# 2010-03-20
+# chkconfig: - 13 87
+# description: Sslh accepts connections on specified ports, and forwards
+#              them further based on tests performed on the first data
+#              packet sent by the remote client.
+# processname: sslh
+# config: /etc/sslh.cfg
+# config: /etc/sysconfig/sslh
+# pidfile: /var/run/sslh/sslh.pid
 #
-#
-# chkconfig: 2345 13 87
-#
-# description: sslh - a daemon switching incoming connection between SSH and SSL/HTTPS servers
+# Authors:
+# Andre Krajnik akrajnik@gmail.com - 2010-03-20
+# Julien Thomas julthomas@free.fr - 2013-08-25
 
 # Source function library.
 . /etc/init.d/functions
 
-# ./sslh -p  0.0.0.0:8443 -l 127.0.0.1:443 -s 127.0.0.1:22
-
-SSLH="/usr/local/sbin/sslh"
-PIDFILE="/var/run/sslh"
-
-OPTIONS="--user nobody --pidfile $PIDFILE -p  0.0.0.0:8443 --ssl 127.0.0.1:443 --ssh 127.0.0.1:22"
-
 if [ -f /etc/sysconfig/sslh ]; then
         . /etc/sysconfig/sslh
 fi
 
-start() {
-        echo -n "Starting SSL-SSH-Switch: "
-        if [ -f $PIDFILE ]; then
-                PID=`cat $PIDFILE`
-                echo sslh already running: $PID
-                exit 2;
-        else
-                daemon  $SSLH $OPTIONS
-                RETVAL=$?
-                echo
-                [ $RETVAL -eq 0 ] && touch $PIDFILE
-                return $RETVAL
-        fi
+PROGNAME=sslh
+SSLH=${SSLH:-/usr/sbin/sslh-select}
+SSLH_LANG=${SSLH_LANG:-C}
+CONFIG=${CONFIG:-/etc/sslh.cfg}
+PIDFILE=${PIDFILE:-/var/run/sslh/sslh.pid}
+LOCKFILE=${LOCKFILE:-/var/lock/subsys/sslh}
+STOP_TIMEOUT=${STOP_TIMEOUT:-10}
+RETVAL=0
 
+start() {
+    echo -n "Starting $PROGNAME: "
+    LANG=$SSLH_LANG daemon --pidfile="$PIDFILE" \
+                           ${SSLH_USER:+--user="${SSLH_USER}"} \
+                           "$SSLH" ${CONFIG:+-F "$CONFIG"} "$OPTIONS"
+    RETVAL=$?
+    echo
+    [ $RETVAL = 0 ] && touch "$LOCKFILE"
+    return $RETVAL
 }
 
 stop() {
-        echo -n "Shutting down SSL-SSH-Switch: "
-        echo
-        killproc sslh
-        echo
-        rm -f $PIDFILE
-        return 0
+    echo -n "Stopping $PROGNAME: "
+    killproc -p "$PIDFILE" -d "$STOP_TIMEOUT" "$SSLH"
+    RETVAL=$?
+    echo
+    [ $RETVAL = 0 ] && rm -f "$LOCKFILE" "$PIDFILE"
 }
 
+# See how we were called.
 case "$1" in
     start)
         start
@@ -59,18 +59,17 @@ case "$1" in
         stop
         ;;
     status)
-        status sslh
+        status -p "$PIDFILE" "$SSLH"
+        RETVAL=$?
         ;;
     restart)
         stop
         start
         ;;
     *)
-        echo "Usage:  {start|stop|status|restart}"
-        exit 1
+        echo "Usage: $PROGNAME {start|stop|status|restart}"
+        RETVAL=2
         ;;
 esac
-exit $?
-
-
 
+exit $RETVAL

scripts/etc.sysconfig.sslh

@@ -0,0 +1,36 @@
+#
+# The default processing model uses select
+# A fork model is also available
+#
+#SSLH=/usr/sbin/sslh-select
+
+#
+# If transparent mode is enabled, the following
+# is needed in order to run as sslh user
+#
+#SSLH_USER=sslh
+#setcap cap_net_bind_service,cap_net_admin=+ep $SSLH
+
+#
+# Configuration file for sslh
+# Set empty to disable configuration file support
+#
+#CONFIG=/etc/sslh.cfg
+
+#
+# Extra option to pass on comand line
+# Those can supersede configuration file settings
+# 
+#OPTIONS=
+
+#
+# The sslh process is started by default with the C
+# locale, it can be changed here
+#
+#SSLH_LANG=C
+
+#
+# If an alternate location is specified in configuration
+# file, it needs to be reported here
+#
+#PIDFILE=/var/run/sslh/sslh.pid

sslh-fork.c

@@ -69,47 +69,49 @@ void start_shoveler(int in_socket)
 {
    fd_set fds;
    struct timeval tv;
-   struct addrinfo *saddr;
-   int res;
+   int res = PROBE_AGAIN;
    int out_socket;
    struct connection cnx;
-   struct proto *prot;
 
    init_cnx(&cnx);
+   cnx.q[0].fd = in_socket;
 
    FD_ZERO(&fds);
    FD_SET(in_socket, &fds);
    memset(&tv, 0, sizeof(tv));
    tv.tv_sec = probing_timeout;
-   res = select(in_socket + 1, &fds, NULL, NULL, &tv);
-   if (res == -1)
-      perror("select");
 
-   cnx.q[0].fd = in_socket;
+   while (res == PROBE_AGAIN) {
+       /* POSIX does not guarantee that tv will be updated, but the client can
+        * only postpone the inevitable for so long */
+       res = select(in_socket + 1, &fds, NULL, NULL, &tv);
+       if (res == -1)
+           perror("select");
 
-   if (FD_ISSET(in_socket, &fds)) {
-       /* Received data: figure out what protocol it is */
-       prot = probe_client_protocol(&cnx);
-   } else {
-       /* Timed out: it's necessarily SSH */
-       prot = timeout_protocol();
+       if (FD_ISSET(in_socket, &fds)) {
+           /* Received data: figure out what protocol it is */
+           res = probe_client_protocol(&cnx);
+       } else {
+           /* Timed out: it's necessarily SSH */
+           cnx.proto = timeout_protocol();
+           break;
+       }
    }
 
-   saddr = prot->saddr;
-   if (prot->service && 
-       check_access_rights(in_socket, prot->service)) {
+   if (cnx.proto->service &&
+       check_access_rights(in_socket, cnx.proto->service)) {
        exit(0);
    }
 
    /* Connect the target socket */
-   out_socket = connect_addr(saddr, prot->description);
+   out_socket = connect_addr(&cnx, in_socket);
    CHECK_RES_DIE(out_socket, "connect");
 
    cnx.q[1].fd = out_socket;
 
    log_connection(&cnx);
 
-   flush_defered(&cnx.q[1]);
+   flush_deferred(&cnx.q[1]);
 
    shovel(&cnx);
 
@@ -155,7 +157,8 @@ void main_loop(int listen_sockets[], int num_addr_listen)
 
                 if (!fork())
                 {
-                    close(listen_sockets[i]);
+                    for (i = 0; i < num_addr_listen; ++i)
+                        close(listen_sockets[i]);
                     start_shoveler(in_socket);
                     exit(0);
                 }

sslh-main.c

@@ -58,6 +58,7 @@ static struct option const_options[] = {
     { "inetd",      no_argument,            &inetd,         1 },
     { "foreground", no_argument,            &foreground,    1 },
     { "background", no_argument,            &background,    1 },
+    { "transparent", no_argument,           &transparent,   1 },
     { "numeric",    no_argument,            &numeric,       1 },
     { "verbose",    no_argument,            &verbose,       1 },
     { "user",       required_argument,      0,              'u' },
@@ -78,15 +79,35 @@ static void print_usage(void)
 {
     struct proto *p;
     int i;
+    int res;
     char *prots = "";
 
     p = get_builtins();
-    for (i = 0; i < get_num_builtins(); i++)
-        asprintf(&prots, "%s\t[--%s <addr>]\n", prots, p[i].description);
+    for (i = 0; i < get_num_builtins(); i++) {
+        res = asprintf(&prots, "%s\t[--%s <addr>]\n", prots, p[i].description);
+        CHECK_RES_DIE(res, "asprintf");
+    }
 
     fprintf(stderr, USAGE_STRING, prots);
 }
 
+static void printcaps(void) {
+#ifdef LIBCAP
+    cap_t caps;
+    char* desc;
+    ssize_t len;
+
+    caps = cap_get_proc();
+
+    desc = cap_to_text(caps, &len);
+
+    fprintf(stderr, "capabilities: %s\n", desc);
+
+    cap_free(caps);
+    cap_free(desc);
+#endif
+}
+
 static void printsettings(void)
 {
     char buf[NI_MAXHOST];
@@ -253,7 +274,7 @@ static int config_protocols(config_t *config, struct proto **prots)
 static int config_parse(char *filename, struct addrinfo **listen, struct proto **prots)
 {
     config_t config;
-    long int timeout;
+    int timeout;
     const char* str;
 
     config_init(&config);
@@ -269,8 +290,9 @@ static int config_parse(char *filename, struct addrinfo **listen, struct proto *
     config_lookup_bool(&config, "inetd", &inetd);
     config_lookup_bool(&config, "foreground", &foreground);
     config_lookup_bool(&config, "numeric", &numeric);
+    config_lookup_bool(&config, "transparent", &transparent);
 
-    if (config_lookup_int(&config, "timeout", &timeout) == CONFIG_TRUE) {
+    if (config_lookup_int(&config, "timeout", (int *)&timeout) == CONFIG_TRUE) {
         probing_timeout = timeout;
     }
 
@@ -445,7 +467,7 @@ next_arg:
 
     set_protocol_list(prots);
 
-    if (!addr_listen) {
+    if (!addr_listen && !inetd) {
         fprintf(stderr, "No listening address specified; use at least one -p option\n");
         exit(1);
     }
@@ -503,9 +525,13 @@ int main(int argc, char *argv[])
    if (user_name)
        drop_privileges(user_name);
 
+
    /* Open syslog connection */
    setup_syslog(argv[0]);
 
+   if (verbose)
+       printcaps();
+
    main_loop(listen_sockets, num_addr_listen);
 
    return 0;

sslh-select.c

@@ -64,14 +64,24 @@ int tidy_connection(struct connection *cnx, fd_set *fds, fd_set *fds2)
             close(cnx->q[i].fd);
             FD_CLR(cnx->q[i].fd, fds);
             FD_CLR(cnx->q[i].fd, fds2);
-            if (cnx->q[i].defered_data)
-                free(cnx->q[i].defered_data);
+            if (cnx->q[i].deferred_data)
+                free(cnx->q[i].deferred_data);
         }
     }
     init_cnx(cnx);
     return 0;
 }
 
+/* if fd becomes higher than FD_SETSIZE, things won't work so well with FD_SET
+ * and FD_CLR. Need to drop connections if we go above that limit */
+int fd_is_in_range(int fd) {
+    if (fd >= FD_SETSIZE) {
+        log_message(LOG_ERR, "too many open file descriptor to monitor them all -- dropping connection\n");
+        return 0;
+    }
+    return 1;
+}
+
 /* Accepts a connection from the main socket and assigns it to an empty slot.
  * If no slots are available, allocate another few. If that fails, drop the
  * connexion */
@@ -83,6 +93,9 @@ int accept_new_connection(int listen_socket, struct connection *cnx[], int* cnx_
     in_socket = accept(listen_socket, 0, 0);
     CHECK_RES_RETURN(in_socket, "accept");
 
+    if (!fd_is_in_range(in_socket))
+        return -1;
+
     res = set_nonblock(in_socket);
     if (res == -1) return -1;
 
@@ -116,18 +129,16 @@ int accept_new_connection(int listen_socket, struct connection *cnx[], int* cnx_
 
 
 /* Connect queue 1 of connection to SSL; returns new file descriptor */
-int connect_queue(struct connection *cnx, struct addrinfo *addr, 
-                  const char* cnx_name,
-                  fd_set *fds_r, fd_set *fds_w)
+int connect_queue(struct connection *cnx, fd_set *fds_r, fd_set *fds_w)
 {
     struct queue *q = &cnx->q[1];
 
-    q->fd = connect_addr(addr, cnx_name);
-    if (q->fd != -1) {
+    q->fd = connect_addr(cnx, cnx->q[0].fd);
+    if ((q->fd != -1) && fd_is_in_range(q->fd)) {
         log_connection(cnx);
         set_nonblock(q->fd);
-        flush_defered(q);
-        if (q->defered_data) {
+        flush_deferred(q);
+        if (q->deferred_data) {
             FD_SET(q->fd, fds_w);
         } else {
             FD_SET(q->fd, fds_r);
@@ -177,13 +188,13 @@ int is_fd_active(int fd, fd_set* set)
 }
 
 /* Main loop: the idea is as follow:
- * - fds_r and fds_w contain the file descritors to monitor in read and write
+ * - fds_r and fds_w contain the file descriptors to monitor in read and write
  * - When a file descriptor goes off, process it: read from it, write the data
  * to its corresponding pair.
  * - When a file descriptor blocks when writing, remove the read fd from fds_r,
- * move the data to a defered buffer, and add the write fd to fds_w. Defered
+ * move the data to a deferred buffer, and add the write fd to fds_w. Defered
  * buffer is allocated dynamically.
- * - When we can write to a file descriptor that has defered data, we try to
+ * - When we can write to a file descriptor that has deferred data, we try to
  * write as much as we can. Once all data is written, remove the fd from fds_w
  * and add its corresponding pair to fds_r, free the buffer.
  *
@@ -197,7 +208,6 @@ void main_loop(int listen_sockets[], int num_addr_listen)
     struct timeval tv;
     int max_fd, in_socket, i, j, res;
     struct connection *cnx;
-    struct proto *prot;
     int num_cnx;  /* Number of connections in *cnx */
     int num_probing = 0; /* Number of connections currently probing 
                           * We use this to know if we need to time out of
@@ -255,18 +265,19 @@ void main_loop(int listen_sockets[], int num_addr_listen)
             if (cnx[i].q[0].fd != -1) {
                 for (j = 0; j < 2; j++) {
                     if (is_fd_active(cnx[i].q[j].fd, &writefds)) {
-                        res = flush_defered(&cnx[i].q[j]);
+                        res = flush_deferred(&cnx[i].q[j]);
                         if ((res == -1) && ((errno == EPIPE) || (errno == ECONNRESET))) {
                             if (cnx[i].state == ST_PROBING) num_probing--;
                             tidy_connection(&cnx[i], &fds_r, &fds_w);
                             if (verbose)
                                 fprintf(stderr, "closed slot %d\n", i);
-                        }
-                        /* If no defered data is left, stop monitoring the fd 
-                         * for write, and restart monitoring the other one for reads*/
-                        if (!cnx[i].q[j].defered_data_size) {
-                            FD_CLR(cnx[i].q[j].fd, &fds_w);
-                            FD_SET(cnx[i].q[1-j].fd, &fds_r);
+                        } else {
+                            /* If no deferred data is left, stop monitoring the fd 
+                             * for write, and restart monitoring the other one for reads*/
+                            if (!cnx[i].q[j].deferred_data_size) {
+                                FD_CLR(cnx[i].q[j].fd, &fds_w);
+                                FD_SET(cnx[i].q[1-j].fd, &fds_r);
+                            }
                         }
                     }
                 }
@@ -289,27 +300,27 @@ void main_loop(int listen_sockets[], int num_addr_listen)
                             dump_connection(&cnx[i]);
                             exit(1);
                         }
-                        num_probing--;
-                        cnx[i].state = ST_SHOVELING;
 
                         /* If timed out it's SSH, otherwise the client sent
                          * data so probe the protocol */
                         if ((cnx[i].probe_timeout < time(NULL))) {
-                            prot = timeout_protocol();
+                            cnx[i].proto = timeout_protocol();
                         } else {
-                            prot = probe_client_protocol(&cnx[i]);
+                            res = probe_client_protocol(&cnx[i]);
+                            if (res == PROBE_AGAIN)
+                                continue;
                         }
 
+                        num_probing--;
+                        cnx[i].state = ST_SHOVELING;
+
                         /* libwrap check if required for this protocol */
-                        if (prot->service && 
-                            check_access_rights(in_socket, prot->service)) {
+                        if (cnx[i].proto->service &&
+                            check_access_rights(in_socket, cnx[i].proto->service)) {
                             tidy_connection(&cnx[i], &fds_r, &fds_w);
                             res = -1;
                         } else {
-                            res = connect_queue(&cnx[i], 
-                                                prot->saddr, 
-                                                prot->description, 
-                                                &fds_r, &fds_w);
+                            res = connect_queue(&cnx[i], &fds_r, &fds_w);
                         }
 
                         if (res >= max_fd)

sslh.pod

@@ -96,6 +96,7 @@ This can be specified several times to bind B<sslh> to
 several addresses.
 
 =item B<--ssl> I<target address>
+
 =item B<--tls> I<target address>
 
 Interface and port on which to forward SSL connection,

t

@@ -18,6 +18,7 @@ my $pidfile = "/tmp/sslh_test.pid";
 my $SSL_CNX =           1;
 my $SSH_SHY_CNX =       1;
 my $SSH_BOLD_CNX =      1;
+my $SSH_PROBE_AGAIN =   1;
 my $SSL_MIX_SSH =       1;
 my $SSH_MIX_SSL =       1;
 my $BIG_MSG =           0; # This test is unreliable
@@ -58,11 +59,11 @@ for my $binary (@binaries) {
         my $cmd = "./$binary -v -f -u $user --listen localhost:$sslh_port --ssh $ssh_address --ssl $ssl_address -P $pidfile";
         warn "$cmd\n";
         #exec $cmd;
-        exec "valgrind --leak-check=full ./sslh-select -v -f -u $user --listen localhost:$sslh_port --ssh $ssh_address -ssl $ssl_address -P $pidfile";
+        exec "valgrind --leak-check=full ./$binary -v -f -u $user --listen localhost:$sslh_port --ssh $ssh_address -ssl $ssl_address -P $pidfile";
         exit 0;
     }
     warn "spawned $sslh_pid\n";
-    sleep 1;  # valgrind can be heavy -- wait 5 seconds
+    sleep 5;  # valgrind can be heavy -- wait 5 seconds
 
 
     my $test_data = "hello world\n";
@@ -108,6 +109,22 @@ for my $binary (@binaries) {
         }
     }
 
+# Test: PROBE_AGAIN, incomplete first frame
+    if ($SSH_PROBE_AGAIN) {
+        print "***Test: incomplete SSH first frame\n";
+        my $cnx_h = new IO::Socket::INET(PeerHost => "localhost:$sslh_port");
+        warn "$!\n" unless $cnx_h;
+        if (defined $cnx_h) {
+            my $td = "SSH-2.0 testsuite\t$test_data";
+            print $cnx_h substr $td, 0, 2;
+            sleep 1;
+            print $cnx_h substr $td, 2;
+            my $data = <$cnx_h>;
+            is($data, "ssh: $td", "Incomplete first SSH frame");
+        }
+    }
+
+
 # Test: One SSL half-started then one SSH
     if ($SSL_MIX_SSH) {
         print "***Test: One SSL half-started then one SSH\n";