v1.19

changing it. So far it worked, but really that's not
respecting the contract.

ChangeLog

@@ -1,3 +1,20 @@
+v1.19: 20JAN2018
+	Added 'syslog_facility' configuration option to
+	specify where to log.
+
+	TLS now supports SNI and ALPN (Travis Burtrum),
+	including support for Let's Encrypt challenges
+	(Jonathan McCrohan)
+
+	ADB probe. (Mike Frysinger)
+
+	Added per-protocol 'fork' option. (Oleg Oshmyan)
+
+	Added chroot option. (Mike Frysinger)
+
+	A truckload of bug fixes and documentation
+	improvements (Various contributors)
+
 v1.18:	29MAR2016
 	Added USELIBPCRE to make use of regex engine
 	optional.

Makefile

@@ -3,7 +3,7 @@
 VERSION=$(shell ./genver.sh -r)
 ENABLE_REGEX=1  # Enable regex probes
 USELIBCONFIG=1	# Use libconfig? (necessary to use configuration files)
-USELIBPCRE=	# Use libpcre? (needed for regex on musl)
+USELIBPCRE=1	# Use libpcre? (needed for regex on musl)
 USELIBWRAP?=	# Use libwrap?
 USELIBCAP=	# Use libcap?
 USESYSTEMD=     # Make use of systemd socket activation
@@ -27,6 +27,8 @@ CFLAGS ?=-Wall -g $(CFLAGS_COV)
 LIBS=
 OBJS=common.o sslh-main.o probe.o tls.o
 
+CONDITIONAL_TARGETS=
+
 ifneq ($(strip $(USELIBWRAP)),)
 	LIBS:=$(LIBS) -lwrap
 	CPPFLAGS+=-DLIBWRAP
@@ -38,7 +40,7 @@ endif
 
 ifneq ($(strip $(USELIBPCRE)),)
 	CPPFLAGS+=-DLIBPCRE
-	LIBS:=$(LIBS) -lpcre
+	LIBS:=$(LIBS) -lpcreposix
 endif
 
 ifneq ($(strip $(USELIBCONFIG)),)
@@ -54,12 +56,13 @@ endif
 ifneq ($(strip $(USESYSTEMD)),)
         LIBS:=$(LIBS) -lsystemd
         CPPFLAGS+=-DSYSTEMD
+	CONDITIONAL_TARGETS+=systemd-sslh-generator
 endif
 
 
-all: sslh $(MAN) echosrv
+all: sslh $(MAN) echosrv $(CONDITIONAL_TARGETS)
 
-.c.o: *.h
+.c.o: *.h version.h
 	$(CC) $(CFLAGS) $(CPPFLAGS) -c $<
 
 version.h:
@@ -67,6 +70,8 @@ version.h:
 
 sslh: sslh-fork sslh-select
 
+$(OBJS): version.h
+
 sslh-fork: version.h $(OBJS) sslh-fork.o Makefile common.h
 	$(CC) $(CFLAGS) $(LDFLAGS) -o sslh-fork sslh-fork.o $(OBJS) $(LIBS)
 	#strip sslh-fork
@@ -78,7 +83,7 @@ sslh-select: version.h $(OBJS) sslh-select.o Makefile common.h
 systemd-sslh-generator: systemd-sslh-generator.o
 	$(CC) $(CFLAGS) $(LDFLAGS) -o systemd-sslh-generator systemd-sslh-generator.o -lconfig
 
-echosrv: $(OBJS) echosrv.o
+echosrv: version.h $(OBJS) echosrv.o
 	$(CC) $(CFLAGS) $(LDFLAGS) -o echosrv echosrv.o probe.o common.o tls.o $(LIBS)
 
 $(MAN): sslh.pod Makefile

README.md

@@ -135,7 +135,7 @@ i.e. that that is not `127.0.0.1` in the output of
 Libwrap support
 ---------------
 
-Sslh can optionnaly perform `libwrap` checks for the sshd
+Sslh can optionally perform `libwrap` checks for the sshd
 service: because the connection to `sshd` will be coming
 locally from `sslh`, `sshd` cannot determine the IP of the
 client.
@@ -145,10 +145,10 @@ OpenVPN support
 
 OpenVPN clients connecting to OpenVPN running with
 `-port-share` reportedly take more than one second between
-the time the TCP connexion is established and the time they
+the time the TCP connection is established and the time they
 send the first data packet. This results in `sslh` with
-default settings timing out and assuming an SSH connexion.
-To support OpenVPN connexions reliably, it is necessary to
+default settings timing out and assuming an SSH connection.
+To support OpenVPN connections reliably, it is necessary to
 increase `sslh`'s timeout to 5 seconds.
 
 Instead of using OpenVPN's port sharing, it is more reliable
@@ -231,35 +231,70 @@ Linux:
 give it `CAP_NET_ADMIN` capabilities (see appropriate chapter)
 or run it as root (but don't do that).
 
-The firewalling tables also need to be adjusted as follow.
-The example connects to HTTPS on 4443 -- adapt to your needs ;
-I don't think it is possible to have `httpd` listen to 443 in
+The firewalling tables also need to be adjusted as follows.
+I don't think it is possible to have `httpd` and `sslh` both listen to 443 in
 this scheme -- let me know if you manage that:
 
-	# iptables -t mangle -N SSLH
-	# iptables -t mangle -A  OUTPUT --protocol tcp --out-interface eth0 --sport 22 --jump SSLH
-	# iptables -t mangle -A OUTPUT --protocol tcp --out-interface eth0 --sport 4443 --jump SSLH
-	# iptables -t mangle -A SSLH --jump MARK --set-mark 0x1
-	# iptables -t mangle -A SSLH --jump ACCEPT
-	# ip rule add fwmark 0x1 lookup 100
-	# ip route add local 0.0.0.0/0 dev lo table 100
+	$ # Set route_localnet = 1 on all interfaces so that ssl can use "localhost" as destination
+	$ sysctl -w net.ipv4.conf.default.route_localnet=1
+	$ sysctl -w net.ipv4.conf.all.route_localnet=1
+
+	$ # DROP martian packets as they would have been if route_localnet was zero
+	$ # Note: packets not leaving the server aren't affected by this, thus sslh will still work
+	$ iptables -t raw -A PREROUTING ! -i lo -d 127.0.0.0/8 -j DROP
+	$ iptables -t mangle -A POSTROUTING ! -o lo -s 127.0.0.0/8 -j DROP
+
+	$ # Mark all connections made by ssl for special treatment (here sslh is run as user "sslh")
+	$ iptables -t nat -A OUTPUT -m owner --uid-owner sslh -p tcp --tcp-flags FIN,SYN,RST,ACK SYN -j CONNMARK --set-xmark 0x01/0x0f
+
+	$ # Outgoing packets that should go to sslh instead have to be rerouted, so mark them accordingly (copying over the connection mark)
+	$ iptables -t mangle -A OUTPUT ! -o lo -p tcp -m connmark --mark 0x01/0x0f -j CONNMARK --restore-mark --mask 0x0f
+
+	$ # Configure routing for those marked packets
+	$ ip rule add fwmark 0x1 lookup 100
+	$ ip route add local 0.0.0.0/0 dev lo table 100
 
 Tranparent proxying with IPv6 is similarly set up as follows:
 
-        # ip6tables -t mangle -N SSLH
-        # ip6tables -t mangle -A  OUTPUT --protocol tcp --out-interface eth0 --sport 22 --jump SSLH
-        # ip6tables -t mangle -A OUTPUT --protocol tcp --out-interface eth0 --sport 4443 --jump SSLH
-        # ip6tables -t mangle -A SSLH --jump MARK --set-mark 0x1
-        # ip6tables -t mangle -A SSLH --jump ACCEPT
-        # ip -6 rule add fwmark 0x1 lookup 100
-        # ip -6 route add local ::/0 dev lo table 100
+	$ # Set route_localnet = 1 on all interfaces so that ssl can use "localhost" as destination
+	$ # Not sure if this is needed for ipv6 though
+	$ sysctl -w net.ipv4.conf.default.route_localnet=1
+	$ sysctl -w net.ipv4.conf.all.route_localnet=1
 
-Note that these rules will prevent from connecting directly
-to ssh on the port 22, as packets coming out of sshd will be
-tagged. If you need to retain direct access to ssh on port
-22 as well as through sslh, you can make sshd listen to
-22 AND another port (e.g. 2222), and change the above rules
-accordingly.
+	$ # DROP martian packets as they would have been if route_localnet was zero
+	$ # Note: packets not leaving the server aren't affected by this, thus sslh will still work
+	$ ip6tables -t raw -A PREROUTING ! -i lo -d ::1/128 -j DROP
+	$ ip6tables -t mangle -A POSTROUTING ! -o lo -s ::1/128 -j DROP
+
+	$ # Mark all connections made by ssl for special treatment (here sslh is run as user "sslh")
+	$ ip6tables -t nat -A OUTPUT -m owner --uid-owner sslh -p tcp --tcp-flags FIN,SYN,RST,ACK SYN -j CONNMARK --set-xmark 0x01/0x0f
+
+	$ # Outgoing packets that should go to sslh instead have to be rerouted, so mark them accordingly (copying over the connection mark)
+	$ ip6tables -t mangle -A OUTPUT ! -o lo -p tcp -m connmark --mark 0x01/0x0f -j CONNMARK --restore-mark --mask 0x0f
+
+	$ # Configure routing for those marked packets
+	$ ip -6 rule add fwmark 0x1 lookup 100
+	$ ip -6 route add local ::/0 dev lo table 100
+
+Explanation:
+To be able to use `localhost` as destination in your sslh config along with transparent proxying
+you have to allow routing of loopback addresses as done above.
+This is something you usually should not do (see [this stackoverflow post](https://serverfault.com/questions/656279/how-to-force-linux-to-accept-packet-with-loopback-ip/656484#656484))
+The two `DROP` iptables rules emulate the behaviour of `route_localnet` set to off (with one small difference:
+allowing the reroute-check to happen after the fwmark is set on packets destined for sslh).
+See [this diagram](https://upload.wikimedia.org/wikipedia/commons/3/37/Netfilter-packet-flow.svg) for a good visualisation
+showing how packets will traverse the iptables chains.
+
+Note:
+You have to run `sslh` as dedicated user (in this example the user is also named `sslh`), to not mess up with your normal networking.
+These rules will allow you to connect directly to ssh on port
+22 (or to any other service behind sslh) as well as through sslh on port 443.
+
+Also remember that iptables configuration and ip routes and 
+rules won't be necessarily persisted after you reboot. Make 
+sure to save them properly. For example in CentOS7, you would 
+do `iptables-save > /etc/sysconfig/iptables`, and add both 
+`ip` commands to your `/etc/rc.local`.
 
 FreeBSD:
 
@@ -390,32 +425,14 @@ To use the generator place it in /usr/lib/systemd/system-generators and then
 call systemctl daemon-reload after any changes to /etc/sslh.cfg to generate 
 the new dynamic socket unit.
 
-Transparent proxying means the target server sees the real
-origin address, so it means if the client connects using
-IPv6, the server must also support IPv6. It is easy to
-support both IPv4 and IPv6 by configuring the server
-accordingly, and setting `sslh` to connect to a name that
-resolves to both IPv4 and IPv6, e.g.:
-
-        sslh --transparent --listen <extaddr>:443 --ssh insideaddr:22
-
-        /etc/hosts:
-        192.168.0.1  insideaddr
-        201::::2     insideaddr
-
-Upon incoming IPv6 connection, `sslh` will first try to
-connect to the IPv4 address (which will fail), then connect
-to the IPv6 address.
-
-
 Fail2ban
 --------
 
 If using transparent proxying, just use the standard ssh
 rules. If you can't or don't want to use transparent
 proxying, you can set `fail2ban` rules to block repeated ssh
-connections from a same IP address (obviously this depends
-on the site, there might be legimite reasons you would get
+connections from an IP address (obviously this depends
+on the site, there might be legitimate reasons you would get
 many connections to ssh from the same IP address...)
 
 See example files in scripts/fail2ban.

basic.cfg

@@ -9,6 +9,7 @@ transparent: false;
 timeout: 2;
 user: "nobody";
 pidfile: "/var/run/sslh.pid";
+chroot: "/var/empty";
 
 
 # Change hostname with your external address name.
@@ -19,7 +20,7 @@ listen:
 
 protocols:
 (
-     { name: "ssh"; service: "ssh"; host: "localhost"; port: "22"; },
+     { name: "ssh"; service: "ssh"; host: "localhost"; port: "22"; fork: true; },
      { name: "openvpn"; host: "localhost"; port: "1194"; },
      { name: "xmpp"; host: "localhost"; port: "5222"; },
      { name: "http"; host: "localhost"; port: "80"; },

common.c

@@ -4,10 +4,16 @@
  * No code here should assume whether sockets are blocking or not.
  **/
 
+#define SYSLOG_NAMES
 #define _GNU_SOURCE
+#include <stddef.h>
 #include <stdarg.h>
 #include <grp.h>
 
+#include <sys/types.h>
+#include <ifaddrs.h>
+#include <netinet/in.h>
+
 #include "common.h"
 #include "probe.h"
 
@@ -35,7 +41,7 @@ int foreground = 0;
 int background = 0;
 int transparent = 0;
 int numeric = 0;
-const char *user_name, *pid_file;
+const char *user_name, *pid_file, *chroot_path, *facility = "auth";
 
 struct addrinfo *addr_listen = NULL; /* what addresses do we listen to? */
 
@@ -44,8 +50,13 @@ struct addrinfo *addr_listen = NULL; /* what addresses do we listen to? */
 int allow_severity =0, deny_severity = 0;
 #endif
 
+typedef enum {
+    CR_DIE,
+    CR_WARN
+} CR_ACTION;
+
 /* check result and die, printing the offending address and error */
-void check_res_dumpdie(int res, struct addrinfo *addr, char* syscall)
+void check_res_dump(CR_ACTION act, int res, struct addrinfo *addr, char* syscall)
 {
     char buf[NI_MAXHOST];
 
@@ -54,7 +65,9 @@ void check_res_dumpdie(int res, struct addrinfo *addr, char* syscall)
                 sprintaddr(buf, sizeof(buf), addr),
                 syscall,
                 strerror(errno));
-        exit(1);
+
+        if (act == CR_DIE)
+            exit(1);
     }
 }
 
@@ -69,8 +82,9 @@ int get_fd_sockets(int *sockfd[])
       exit(1);
     }
     if (sd > 0) {
+      int i;
       *sockfd = malloc(sd * sizeof(*sockfd[0]));
-      for (int i = 0; i < sd; i++) {
+      for (i = 0; i < sd; i++) {
         (*sockfd)[i] = SD_LISTEN_FDS_START + i;
       }
     }
@@ -115,28 +129,32 @@ int start_listen_sockets(int *sockfd[], struct addrinfo *addr_list)
        saddr = (struct sockaddr_storage*)addr->ai_addr;
 
        (*sockfd)[i] = socket(saddr->ss_family, SOCK_STREAM, 0);
-       check_res_dumpdie((*sockfd)[i], addr, "socket");
+       check_res_dump(CR_DIE, (*sockfd)[i], addr, "socket");
 
        one = 1;
        res = setsockopt((*sockfd)[i], SOL_SOCKET, SO_REUSEADDR, (char*)&one, sizeof(one));
-       check_res_dumpdie(res, addr, "setsockopt(SO_REUSEADDR)");
+       check_res_dump(CR_DIE, res, addr, "setsockopt(SO_REUSEADDR)");
 
        if (addr->ai_flags & SO_KEEPALIVE) {
            res = setsockopt((*sockfd)[i], SOL_SOCKET, SO_KEEPALIVE, (char*)&one, sizeof(one));
-           check_res_dumpdie(res, addr, "setsockopt(SO_KEEPALIVE)");
-           printf("set up keepalive\n");
+           check_res_dump(CR_DIE, res, addr, "setsockopt(SO_KEEPALIVE)");
        }
 
        if (IP_FREEBIND) {
            res = setsockopt((*sockfd)[i], IPPROTO_IP, IP_FREEBIND, (char*)&one, sizeof(one));
-           check_res_dumpdie(res, addr, "setsockopt(IP_FREEBIND)");
+           check_res_dump(CR_WARN, res, addr, "setsockopt(IP_FREEBIND)");
+           }
+
+       if (addr->ai_addr->sa_family == AF_INET6) {
+           res = setsockopt((*sockfd)[i], IPPROTO_IPV6, IPV6_V6ONLY, (char*)&one, sizeof(one));
+           check_res_dump(CR_WARN, res, addr, "setsockopt(IPV6_V6ONLY)");
        }
 
        res = bind((*sockfd)[i], addr->ai_addr, addr->ai_addrlen);
-       check_res_dumpdie(res, addr, "bind");
+       check_res_dump(CR_DIE, res, addr, "bind");
 
        res = listen ((*sockfd)[i], 50);
-       check_res_dumpdie(res, addr, "listen");
+       check_res_dump(CR_DIE, res, addr, "listen");
 
    }
 
@@ -160,6 +178,39 @@ int bind_peer(int fd, int fd_from)
      * got here */
     res = getpeername(fd_from, from.ai_addr, &from.ai_addrlen);
     CHECK_RES_RETURN(res, "getpeername");
+    
+    /* if the destination is the same machine, there's no need to do bind */
+    struct ifaddrs *ifaddrs_p = NULL, *ifa;
+
+    getifaddrs(&ifaddrs_p);
+
+    for (ifa = ifaddrs_p; ifa != NULL; ifa = ifa->ifa_next)
+    {
+        if (!ifa->ifa_addr)
+            continue;
+        int match = 0;
+        if (from.ai_addr->sa_family == ifa->ifa_addr->sa_family)
+        {
+            int family = ifa->ifa_addr->sa_family;
+            if (family == AF_INET)
+            {
+                struct sockaddr_in *from_addr = (struct sockaddr_in*)from.ai_addr;
+                struct sockaddr_in *ifa_addr = (struct sockaddr_in*)ifa->ifa_addr;
+                if (from_addr->sin_addr.s_addr == ifa_addr->sin_addr.s_addr)
+                    match = 1;
+            }
+            else if (family == AF_INET6)
+            {
+                struct sockaddr_in6 *from_addr = (struct sockaddr_in6*)from.ai_addr;
+                struct sockaddr_in6 *ifa_addr = (struct sockaddr_in6*)ifa->ifa_addr;
+                if (!memcmp(from_addr->sin6_addr.s6_addr, ifa_addr->sin6_addr.s6_addr, 16))
+                    match = 1;
+            }
+        }
+        if (match)  /* the destination is the same as the source, should not create a transparent bind */
+            return 0;
+    }
+
 #ifndef IP_BINDANY /* use IP_TRANSPARENT */
     res = setsockopt(fd, IPPROTO_IP, IP_TRANSPARENT, &trans, sizeof(trans));
     CHECK_RES_DIE(res, "setsockopt");
@@ -227,7 +278,6 @@ int connect_addr(struct connection *cnx, int fd_from)
                     one = 1;
                     res = setsockopt(fd, SOL_SOCKET, SO_KEEPALIVE, (char*)&one, sizeof(one));
                     CHECK_RES_RETURN(res, "setsockopt(SO_KEEPALIVE)");
-                    printf("set up keepalive\n");
                 }
                 return fd;
             }
@@ -240,17 +290,19 @@ int connect_addr(struct connection *cnx, int fd_from)
 int defer_write(struct queue *q, void* data, int data_size)
 {
     char *p;
+    ptrdiff_t data_offset = q->deferred_data - q->begin_deferred_data;
     if (verbose)
         fprintf(stderr, "**** writing deferred on fd %d\n", q->fd);
 
-    p = realloc(q->begin_deferred_data, q->deferred_data_size + data_size);
+    p = realloc(q->begin_deferred_data, data_offset + q->deferred_data_size + data_size);
     if (!p) {
         perror("realloc");
         exit(1);
     }
 
-    q->deferred_data = q->begin_deferred_data = p;
-    p += q->deferred_data_size;
+    q->begin_deferred_data = p;
+    q->deferred_data = p + data_offset;
+    p += data_offset + q->deferred_data_size;
     q->deferred_data_size += data_size;
     memcpy(p, data, data_size);
 
@@ -398,19 +450,40 @@ char* sprintaddr(char* buf, size_t size, struct addrinfo *a)
 
 /* Turns a hostname and port (or service) into a list of struct addrinfo
  * returns 0 on success, -1 otherwise and logs error
- **/
-int resolve_split_name(struct addrinfo **out, const char* host, const char* serv)
+ */
+int resolve_split_name(struct addrinfo **out, const char* ct_host, const char* serv)
 {
    struct addrinfo hint;
+   char *end;
    int res;
+   char* host;
 
    memset(&hint, 0, sizeof(hint));
    hint.ai_family = PF_UNSPEC;
    hint.ai_socktype = SOCK_STREAM;
 
+   /* Copy parameter so not to clobber data in libconfig */
+   res = asprintf(&host, "%s", ct_host);
+   if (res == -1) {
+       log_message(LOG_ERR, "asprintf: cannot allocate memory");
+       return -1;
+   }
+
+   /* If it is a RFC-Compliant IPv6 address ("[1234::12]:443"), remove brackets
+    * around IP address */
+   if (host[0] == '[') {
+       end = strrchr(host, ']');
+       if (!end) {
+           fprintf(stderr, "%s: no closing bracket in IPv6 address?\n", host);
+       }
+       host++; /* skip first bracket */
+       *end = 0; /* remove last bracket */
+   }
+
    res = getaddrinfo(host, serv, &hint, out);
    if (res)
       log_message(LOG_ERR, "%s `%s:%s'\n", gai_strerror(res), host, serv);
+   free(host);
    return res;
 }
 
@@ -420,7 +493,7 @@ fullname: input string -- it gets clobbered
 */
 void resolve_name(struct addrinfo **out, char* fullname)
 {
-   char *serv, *host, *end;
+   char *serv, *host;
    int res;
 
    /* Find port */
@@ -434,17 +507,6 @@ void resolve_name(struct addrinfo **out, char* fullname)
 
    host = fullname;
 
-   /* If it is a RFC-Compliant IPv6 address ("[1234::12]:443"), remove brackets
-    * around IP address */
-   if (host[0] == '[') {
-       end = strrchr(host, ']');
-       if (!end) {
-           fprintf(stderr, "%s: no closing bracket in IPv6 address?\n", host);
-       }
-       host++; /* skip first bracket */
-       *end = 0; /* remove last bracket */
-   }
-
    res = resolve_split_name(out, host, serv);
    if (res) {
       fprintf(stderr, "%s `%s'\n", gai_strerror(res), fullname);
@@ -591,12 +653,21 @@ void setup_signals(void)
  * banner is made up of basename(bin_name)+"[pid]" */
 void setup_syslog(const char* bin_name) {
     char *name1, *name2;
-    int res;
+    int res, fn;
 
     name1 = strdup(bin_name);
     res = asprintf(&name2, "%s[%d]", basename(name1), getpid());
     CHECK_RES_DIE(res, "asprintf");
-    openlog(name2, LOG_CONS, LOG_AUTH);
+
+    for (fn = 0; facilitynames[fn].c_val != -1; fn++)
+        if (strcmp(facilitynames[fn].c_name, facility) == 0)
+            break;
+    if (fn == -1) {
+        fprintf(stderr, "Unknown facility %s\n", facility);
+        exit(1);
+    }
+
+    openlog(name2, LOG_CONS, facilitynames[fn].c_val);
     free(name1);
     /* Don't free name2, as openlog(3) uses it (at least in glibc) */
 
@@ -654,33 +725,47 @@ void set_capabilities(void) {
 }
 
 /* We don't want to run as root -- drop privileges if required */
-void drop_privileges(const char* user_name)
+void drop_privileges(const char* user_name, const char* chroot_path)
 {
     int res;
-    struct passwd *pw = getpwnam(user_name);
-    if (!pw) {
-        fprintf(stderr, "%s: not found\n", user_name);
-        exit(2);
+    struct passwd *pw = NULL;
+
+    if (user_name) {
+        pw = getpwnam(user_name);
+        if (!pw) {
+            fprintf(stderr, "%s: not found\n", user_name);
+            exit(2);
+        }
+        if (verbose)
+            fprintf(stderr, "turning into %s\n", user_name);
     }
-    if (verbose)
-        fprintf(stderr, "turning into %s\n", user_name);
 
-    set_keepcaps(1);
+    if (chroot_path) {
+        if (verbose)
+            fprintf(stderr, "chrooting into %s\n", chroot_path);
 
-    /* remove extraneous groups in case we belong to several extra groups that
-     * may have unwanted rights. If non-root when calling setgroups(), it
-     * fails, which is fine because... we have no unwanted rights
-     * (see POS36-C for security context)
-     * */
-    setgroups(0, NULL);
+        res = chroot(chroot_path);
+        CHECK_RES_DIE(res, "chroot");
+    }
 
-    res = setgid(pw->pw_gid);
-    CHECK_RES_DIE(res, "setgid");
-    res = setuid(pw->pw_uid);
-    CHECK_RES_DIE(res, "setuid");
+    if (user_name) {
+        set_keepcaps(1);
 
-    set_capabilities();
-    set_keepcaps(0);
+        /* remove extraneous groups in case we belong to several extra groups
+         * that may have unwanted rights. If non-root when calling setgroups(),
+         * it fails, which is fine because... we have no unwanted rights
+         * (see POS36-C for security context)
+         * */
+        setgroups(0, NULL);
+
+        res = setgid(pw->pw_gid);
+        CHECK_RES_DIE(res, "setgid");
+        res = setuid(pw->pw_uid);
+        CHECK_RES_DIE(res, "setuid");
+
+        set_capabilities();
+        set_keepcaps(0);
+    }
 }
 
 /* Writes my PID */

common.h

@@ -37,13 +37,14 @@
 
 #define CHECK_RES_DIE(res, str) \
     if (res == -1) {    \
+       fprintf(stderr, "%s:%d:", __FILE__, __LINE__); \
        perror(str);     \
        exit(1);         \
     }
 
 #define CHECK_RES_RETURN(res, str) \
     if (res == -1) {                                    \
-        log_message(LOG_CRIT, "%s:%d:%s\n", str, errno, strerror(errno));  \
+        log_message(LOG_CRIT, "%s:%d:%s:%d:%s\n", __FILE__, __LINE__, str, errno, strerror(errno));  \
         return res;                                     \
     } 
 
@@ -102,7 +103,7 @@ void log_connection(struct connection *cnx);
 int check_access_rights(int in_socket, const char* service);
 void setup_signals(void);
 void setup_syslog(const char* bin_name);
-void drop_privileges(const char* user_name);
+void drop_privileges(const char* user_name, const char* chroot_path);
 void write_pid_file(const char* pidfile);
 void log_message(int type, char* msg, ...);
 void dump_connection(struct connection *cnx);
@@ -118,7 +119,7 @@ extern int probing_timeout, verbose, inetd, foreground,
 extern struct sockaddr_storage addr_ssl, addr_ssh, addr_openvpn;
 extern struct addrinfo *addr_listen;
 extern const char* USAGE_STRING;
-extern const char* user_name, *pid_file;
+extern const char* user_name, *pid_file, *chroot_path, *facility;
 extern const char* server_type;
 
 /* sslh-fork.c */

example.cfg

@@ -11,7 +11,13 @@ transparent: false;
 timeout: 2;
 user: "nobody";
 pidfile: "/var/run/sslh.pid";
+chroot: "/var/empty";
 
+# Specify which syslog facility to use (names for your
+# system are usually defined in /usr/include/*/sys/syslog.h
+# or equivalent)
+# Default is "auth"
+syslog_facility: "auth"; 
 
 # List of interfaces on which we should listen
 # Options:
@@ -33,6 +39,8 @@ listen:
 #               1 to log each incoming connection
 #   keepalive:  Should TCP keepalive be on or off for that
 #               connection (default is off)
+#   fork: Should a new process be forked for this protocol?
+#         (only useful for sslh-select)
 #
 #  Probe-specific options:
 #       tls:
@@ -53,7 +61,7 @@ listen:
  
 protocols:
 (
-     { name: "ssh"; service: "ssh"; host: "localhost"; port: "22"; keepalive: true; },
+     { name: "ssh"; service: "ssh"; host: "localhost"; port: "22"; keepalive: true; fork: true; },
      { name: "http"; host: "localhost"; port: "80"; },
 
 # match BOTH ALPN/SNI
@@ -67,14 +75,18 @@ protocols:
      { name: "tls"; host: "localhost"; port: "993"; sni_hostnames: [ "mail.rutschle.net", "mail.englishintoulouse.com" ]; log_level: 0; },
      { name: "tls"; host: "localhost"; port: "xmpp-client"; sni_hostnames: [ "im.rutschle.net", "im.englishintoulouse.com" ];  log_level: 0;},
 
+# Let's Encrypt (tls-sni-* challenges)
+     { name: "tls"; host: "localhost"; port: "letsencrypt-client"; sni_hostnames: [ "*.*.acme.invalid" ];  log_level: 0;},
+
 # catch anything else TLS
      { name: "tls"; host: "localhost"; port: "443"; },
 
+# Regex examples -- better use the built-in probes for real-world use!
 # OpenVPN
      { name: "regex"; host: "localhost"; port: "1194"; regex_patterns: [ "^\x00[\x0D-\xFF]$", "^\x00[\x0D-\xFF]\x38" ]; },
 # Jabber
      { name: "regex"; host: "localhost"; port: "5222"; regex_patterns: [ "jabber" ]; },
-
+    
 # Catch-all
      { name: "regex"; host: "localhost"; port: "443"; regex_patterns: [ "" ]; },
 

probe.c

@@ -45,16 +45,16 @@ static int is_true(const char *p, int len, struct proto* proto) { return 1; }
 /* Table of protocols that have a built-in probe
  */
 static struct proto builtins[] = {
-    /* description   service  saddr  log_level  keepalive  probe  */
-    { "ssh",         "sshd",   NULL,  1,        0,         is_ssh_protocol},
-    { "openvpn",     NULL,     NULL,  1,        0,         is_openvpn_protocol },
-    { "tinc",        NULL,     NULL,  1,        0,         is_tinc_protocol },
-    { "xmpp",        NULL,     NULL,  1,        0,         is_xmpp_protocol },
-    { "http",        NULL,     NULL,  1,        0,         is_http_protocol },
-    { "ssl",         NULL,     NULL,  1,        0,         is_tls_protocol },
-    { "tls",         NULL,     NULL,  1,        0,         is_tls_protocol },
-    { "adb",         NULL,     NULL,  1,        0,         is_adb_protocol },
-    { "anyprot",     NULL,     NULL,  1,        0,         is_true }
+    /* description   service  saddr  log_level  keepalive  fork  probe  */
+    { "ssh",         "sshd",   NULL,  1,        0,         1,    is_ssh_protocol},
+    { "openvpn",     NULL,     NULL,  1,        0,         1,    is_openvpn_protocol },
+    { "tinc",        NULL,     NULL,  1,        0,         1,    is_tinc_protocol },
+    { "xmpp",        NULL,     NULL,  1,        0,         0,    is_xmpp_protocol },
+    { "http",        NULL,     NULL,  1,        0,         0,    is_http_protocol },
+    { "ssl",         NULL,     NULL,  1,        0,         0,    is_tls_protocol },
+    { "tls",         NULL,     NULL,  1,        0,         0,    is_tls_protocol },
+    { "adb",         NULL,     NULL,  1,        0,         0,    is_adb_protocol },
+    { "anyprot",     NULL,     NULL,  1,        0,         0,    is_true }
 };
 
 static struct proto *protocols;
@@ -107,25 +107,25 @@ void hexdump(const char *mem, unsigned int len)
     {
         /* print offset */
         if(i % HEXDUMP_COLS == 0)
-            printf("0x%06x: ", i);
+            fprintf(stderr, "0x%06x: ", i);
 
         /* print hex data */
         if(i < len)
-            printf("%02x ", 0xFF & mem[i]);
+            fprintf(stderr, "%02x ", 0xFF & mem[i]);
         else /* end of block, just aligning for ASCII dump */
-            printf("   ");
+            fprintf(stderr, "   ");
 
         /* print ASCII dump */
         if(i % HEXDUMP_COLS == (HEXDUMP_COLS - 1)) {
             for(j = i - (HEXDUMP_COLS - 1); j <= i; j++) {
                 if(j >= len) /* end of block, not really printing */
-                    putchar(' ');
+                    fputc(' ', stderr);
                 else if(isprint(mem[j])) /* printable char */
-                    putchar(0xFF & mem[j]);        
+                    fputc(0xFF & mem[j], stderr);
                 else /* other char */
-                    putchar('.');
+                    fputc('.', stderr);
             }
-            putchar('\n');
+            fputc('\n', stderr);
         }
     }
 }
@@ -236,32 +236,81 @@ static int is_sni_alpn_protocol(const char *p, int len, struct proto *proto)
 
 static int is_tls_protocol(const char *p, int len, struct proto *proto)
 {
-    if (len < 3)
+    if (len < 6)
         return PROBE_AGAIN;
 
-    /* TLS packet starts with a record "Hello" (0x16), followed by version
-     * (0x03 0x00-0x03) (RFC6101 A.1)
-     * This means we reject SSLv2 and lower, which is actually a good thing (RFC6176)
+    /* TLS packet starts with a record "Hello" (0x16), followed by the number of
+     * the highest version of SSL/TLS supported.
+     *
+     * A SSLv2 record header contains a two or three byte length code. If the
+     * most significant bit is set in the first byte of the record length code
+     * then the record has no padding and the total header length will be 2
+     * bytes,  otherwise the record has padding and the total header length will
+     * be 3 bytes. Next, a 1 char sized client-hello (0x01) is expected,
+     * followed by a 2 char sized version that indicates the highest version of
+     * TLS/SSL supported by the sender. [SSL2] Hickman, Kipp, "The SSL Protocol"
+     *
+     * We're checking the highest version of TLS/SSL supported against
+     * (0x03 0x00-0x03) (RFC6101 A.1). This means we reject the usage of SSLv2
+     * and lower, which is actually a good thing (RFC6176).
      */
-    return p[0] == 0x16 && p[1] == 0x03 && ( p[2] >= 0 && p[2] <= 0x03);
+    if (p[0] == 0x16) // TLS client-hello
+        return p[1] == 0x03 && ( p[2] >= 0 && p[2] <= 0x03);
+    if ((p[0] & 0x80) != 0) // SSLv2 client-hello, no padding
+        return p[2] == 0x01 && p[3] == 0x03 && ( p[4] >= 0 && p[4] <= 0x03);
+    else // SSLv2 client-hello, padded
+        return p[3] == 0x01 && p[4] == 0x03 && ( p[5] >= 0 && p[5] <= 0x03);
 }
 
-static int is_adb_protocol(const char *p, int len, struct proto *proto)
+static int probe_adb_cnxn_message(const char *p)
 {
-    if (len < 30)
-        return PROBE_AGAIN;
-
     /* The initial ADB host->device packet has a command type of CNXN, and a
      * data payload starting with "host:".  Note that current versions of the
      * client hardcode "host::" (with empty serialno and banner fields) but
      * other clients may populate those fields.
-     *
-     * We aren't checking amessage.data_length, under the assumption that
-     * a packet >= 30 bytes long will have "something" in the payload field.
      */
     return !memcmp(&p[0], "CNXN", 4) && !memcmp(&p[24], "host:", 5);
 }
 
+static int is_adb_protocol(const char *p, int len, struct proto *proto)
+{
+    /* amessage.data_length is not being checked, under the assumption that
+     * a packet >= 30 bytes will have "something" in the payload field.
+     *
+     * 24 bytes for the message header and 5 bytes for the "host:" tag.
+     *
+     * ADB protocol:
+     * https://android.googlesource.com/platform/system/adb/+/master/protocol.txt
+     */
+    static const unsigned int min_data_packet_size = 30;
+
+    if (len < min_data_packet_size)
+        return PROBE_AGAIN;
+
+    if (probe_adb_cnxn_message(&p[0]) == PROBE_MATCH)
+        return PROBE_MATCH;
+
+    /* In ADB v26.0.0 rc1-4321094, the initial host->device packet sends an
+     * empty message before sending the CNXN command type. This was an
+     * unintended side effect introduced in
+     * https://android-review.googlesource.com/c/342653, and will be reverted for
+     * a future release.
+     */
+    static const unsigned char empty_message[] = {
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff
+    };
+
+    if (len < min_data_packet_size + sizeof(empty_message))
+        return PROBE_AGAIN;
+
+    if (memcmp(&p[0], empty_message, sizeof(empty_message)))
+        return PROBE_NEXT;
+
+    return probe_adb_cnxn_message(&p[sizeof(empty_message)]);
+}
+
 static int regex_probe(const char *p, int len, struct proto *proto)
 {
 #ifdef ENABLE_REGEX
@@ -297,6 +346,13 @@ int probe_client_protocol(struct connection *cnx)
      * happens, we just connect to the default protocol so the caller of this
      * function does not have to deal with a specific  failure condition (the
      * connection will just fail later normally). */
+
+    /* Dump hex values of the packet */
+    if (verbose>1) {
+        fprintf(stderr, "hexdump of incoming packet:\n");
+        hexdump(buffer, n);
+    }
+
     if (n > 0) {
         int res = PROBE_NEXT;
 

probe.h

@@ -24,6 +24,7 @@ struct proto {
                      * 1: Log incoming connection
                      */
     int keepalive; /* 0: No keepalive ; 1: Set Keepalive for this connection */
+    int fork; /* 0: Connection can run within shared process ; 1: Separate process required for this connection */
 
     /* function to probe that protocol; parameters are buffer and length
      * containing the data to probe, and a pointer to the protocol structure */

scripts/systemd.sslh.service

@@ -6,6 +6,22 @@ After=network.target
 EnvironmentFile=/etc/conf.d/sslh
 ExecStart=/usr/bin/sslh --foreground $DAEMON_OPTS
 KillMode=process
+#Hardening
+PrivateTmp=true
+CapabilityBoundingSet=CAP_SETGID CAP_SETUID CAP_NET_BIND_SERVICE
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+SecureBits=noroot-locked
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+ProtectControlGroups=true
+MountFlags=private
+NoNewPrivileges=true
+PrivateDevices=true
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+MemoryDenyWriteExecute=true
+DynamicUser=true
 
 [Install]
 WantedBy=multi-user.target

sslh-fork.c

@@ -94,6 +94,8 @@ void start_shoveler(int in_socket)
        } else {
            /* Timed out: it's necessarily SSH */
            cnx.proto = timeout_protocol();
+           if (verbose) 
+               log_message(LOG_INFO, "timed out, connect to %s\n", cnx.proto->description);
            break;
        }
    }
@@ -146,8 +148,13 @@ void main_loop(int listen_sockets[], int num_addr_listen)
 
     /* Start one process for each listening address */
     for (i = 0; i < num_addr_listen; i++) {
-        if (!(listener_pid[i] = fork())) {
+        listener_pid[i] = fork();
+        switch(listener_pid[i]) {
+        case 0: break;
+        case -1: log_message(LOG_ERR, "fork failed: err %d: %s\n", errno, strerror(errno));
+                 break;
 
+        default:
             /* Listening process just accepts a connection, forks, and goes
              * back to listening */
             while (1)
@@ -155,12 +162,19 @@ void main_loop(int listen_sockets[], int num_addr_listen)
                 in_socket = accept(listen_sockets[i], 0, 0);
                 if (verbose) fprintf(stderr, "accepted fd %d\n", in_socket);
 
-                if (!fork())
-                {
+                switch(fork()) {
+                case -1: log_message(LOG_ERR, "fork failed: err %d: %s\n", errno, strerror(errno));
+                         break;
+
+                /* In child process */
+                case 0:
                     for (i = 0; i < num_addr_listen; ++i)
                         close(listen_sockets[i]);
                     start_shoveler(in_socket);
                     exit(0);
+
+                /* In parent process */
+                default: break;
                 }
                 close(in_socket);
             }

sslh-main.c

@@ -39,8 +39,8 @@
 const char* USAGE_STRING =
 "sslh " VERSION "\n" \
 "usage:\n" \
-"\tsslh  [-v] [-i] [-V] [-f] [-n] [--transparent] [-F <file>]\n"
-"\t[-t <timeout>] [-P <pidfile>] -u <username> -p <add> [-p <addr> ...] \n" \
+"\tsslh  [-v] [-i] [-V] [-f] [-n] [--transparent] [-F<file>]\n"
+"\t[-t <timeout>] [-P <pidfile>] [-u <username>] [-C <chroot>] -p <add> [-p <addr> ...] \n" \
 "%s\n\n" /* Dynamically built list of builtin protocols */  \
 "\t[--on-timeout <addr>]\n" \
 "-v: verbose\n" \
@@ -48,8 +48,9 @@ const char* USAGE_STRING =
 "-f: foreground\n" \
 "-n: numeric output\n" \
 "-u: specify under which user to run\n" \
+"-C: specify under which chroot path to run\n" \
 "--transparent: behave as a transparent proxy\n" \
-"-F: use configuration file\n" \
+"-F: use configuration file (warning: no space between -F and file name!)\n" \
 "--on-timeout: connect to specified address upon timeout (default: ssh address)\n" \
 "-t: seconds to wait before connecting to --on-timeout address.\n" \
 "-p: address and port to listen on.\n    Can be used several times to bind to several addresses.\n" \
@@ -71,6 +72,7 @@ static struct option const_options[] = {
     { "user",       required_argument,      0,              'u' },
     { "config",     optional_argument,      0,              'F' },
     { "pidfile",    required_argument,      0,              'P' },
+    { "chroot",     required_argument,      0,              'C' },
     { "timeout",    required_argument,      0,              't' },
     { "on-timeout", required_argument,      0,              OPT_ONTIMEOUT },
     { "listen",     required_argument,      0,              'p' },
@@ -78,7 +80,7 @@ static struct option const_options[] = {
 };
 static struct option* all_options;
 static struct proto* builtins;
-static const char *optstr = "vt:T:p:VP:F::";
+static const char *optstr = "vt:T:p:VP:C:F::";
 
 
 
@@ -123,14 +125,15 @@ static void printsettings(void)
     
     for (p = get_first_protocol(); p; p = p->next) {
         fprintf(stderr,
-                "%s addr: %s. libwrap service: %s log_level: %d family %d %d [%s]\n", 
+                "%s addr: %s. libwrap service: %s log_level: %d family %d %d [%s] [%s]\n",
                 p->description, 
                 sprintaddr(buf, sizeof(buf), p->saddr), 
                 p->service,
                 p->log_level,
                 p->saddr->ai_family,
                 p->saddr->ai_addr->sa_family,
-                p->keepalive ? "keepalive" : "");
+                p->keepalive ? "keepalive" : "",
+                p->fork ? "fork" : "");
     }
     fprintf(stderr, "listening on:\n");
     for (a = addr_listen; a; a = a->ai_next) {
@@ -212,7 +215,7 @@ static void setup_regex_probe(struct proto *p, config_setting_t* probes)
     for (i = 0; i < num_probes; i++) {
         probe_list[i] = malloc(sizeof(*(probe_list[i])));
         expr = config_setting_get_string_elem(probes, i);
-        res = regcomp(probe_list[i], expr, 0);
+        res = regcomp(probe_list[i], expr, REG_EXTENDED);
         if (res) {
             err = malloc(errsize = regerror(res, probe_list[i], NULL, 0));
             regerror(res, probe_list[i], err, errsize);
@@ -235,10 +238,6 @@ static void setup_sni_alpn_list(struct proto *p, config_setting_t* config_items,
     const char * config_item;
     char** sni_hostname_list;
 
-    if(!config_items || !config_setting_is_array(config_items)) {
-        fprintf(stderr, "%s: no %s specified\n", p->description, name);
-        return;
-    }
     num_probes = config_setting_length(config_items);
     if (!num_probes) {
         fprintf(stderr, "%s: no %s specified\n", p->description, name);
@@ -264,12 +263,22 @@ static void setup_sni_alpn_list(struct proto *p, config_setting_t* config_items,
     p->data = (void*)tls_data_set_list(p->data, alpn, sni_hostname_list);
 }
 
-static void setup_sni_alpn(struct proto *p, config_setting_t* sni_hostnames, config_setting_t* alpn_protocols)
+static void setup_sni_alpn(struct proto *p, config_setting_t* prot)
 {
+    config_setting_t *sni_hostnames, *alpn_protocols;
+
     p->data = (void*)new_tls_data();
-    p->probe = get_probe("sni_alpn");
-    setup_sni_alpn_list(p, sni_hostnames, "sni_hostnames", 0);
-    setup_sni_alpn_list(p, alpn_protocols, "alpn_protocols", 1);
+    sni_hostnames = config_setting_get_member(prot, "sni_hostnames");
+    alpn_protocols = config_setting_get_member(prot, "alpn_protocols");
+
+    if(sni_hostnames && config_setting_is_array(sni_hostnames)) {
+        p->probe = get_probe("sni_alpn");
+        setup_sni_alpn_list(p, sni_hostnames, "sni_hostnames", 0);
+    }
+    if(alpn_protocols && config_setting_is_array(alpn_protocols)) {
+        p->probe = get_probe("sni_alpn");
+        setup_sni_alpn_list(p, alpn_protocols, "alpn_protocols", 1);
+    }
 }
 #endif
 
@@ -279,7 +288,7 @@ static void setup_sni_alpn(struct proto *p, config_setting_t* sni_hostnames, con
 #ifdef LIBCONFIG
 static int config_protocols(config_t *config, struct proto **prots)
 {
-    config_setting_t *setting, *prot, *patterns, *sni_hostnames, *alpn_protocols;
+    config_setting_t *setting, *prot, *patterns;
     const char *hostname, *port, *name;
     int i, num_prots;
     struct proto *p, *prev = NULL;
@@ -301,12 +310,16 @@ static int config_protocols(config_t *config, struct proto **prots)
                 p->description = name;
                 config_setting_lookup_string(prot, "service", &(p->service));
                 config_setting_lookup_bool(prot, "keepalive", &p->keepalive);
+                config_setting_lookup_bool(prot, "fork", &p->fork);
 
                 if (config_setting_lookup_int(prot, "log_level", &p->log_level) == CONFIG_FALSE) {
                     p->log_level = 1;
                 }
 
-                resolve_split_name(&(p->saddr), hostname, port);
+                if (resolve_split_name(&(p->saddr), hostname, port)) {
+                    fprintf(stderr, "line %d: cannot resolve %s:%s\n", config_setting_source_line(prot), hostname, port);
+                    exit(1);
+                }
 
                 p->probe = get_probe(name);
                 if (!p->probe || !strcmp(name, "sni_alpn")) {
@@ -324,14 +337,12 @@ static int config_protocols(config_t *config, struct proto **prots)
 
                 /* Probe-specific options: SNI/ALPN */
                 if (!strcmp(name, "tls")) {
-                    sni_hostnames = config_setting_get_member(prot, "sni_hostnames");
-                    alpn_protocols = config_setting_get_member(prot, "alpn_protocols");
-
-                    if((sni_hostnames && config_setting_is_array(sni_hostnames)) || (alpn_protocols && config_setting_is_array(alpn_protocols))) {
-                        setup_sni_alpn(p, sni_hostnames, alpn_protocols);
-                    }
+                    setup_sni_alpn(p, prot);
                 }
 
+            } else {
+                fprintf(stderr, "line %d: Illegal protocol description (missing name, host or port)\n", config_setting_source_line(prot));
+                exit(1);
             }
         }
     }
@@ -371,7 +382,10 @@ static int config_parse(char *filename, struct addrinfo **listen, struct proto *
         return 1;
     }
 
-    config_lookup_bool(&config, "verbose", &verbose);
+    if(config_lookup_bool(&config, "verbose", &verbose) == CONFIG_FALSE) {
+	config_lookup_int(&config, "verbose", &verbose);
+    }
+
     config_lookup_bool(&config, "inetd", &inetd);
     config_lookup_bool(&config, "foreground", &foreground);
     config_lookup_bool(&config, "numeric", &numeric);
@@ -387,6 +401,9 @@ static int config_parse(char *filename, struct addrinfo **listen, struct proto *
 
     config_lookup_string(&config, "user", &user_name);
     config_lookup_string(&config, "pidfile", &pid_file);
+    config_lookup_string(&config, "chroot", &chroot_path);
+
+    config_lookup_string(&config, "syslog_facility", &facility);
 
     config_listen(&config, listen);
     config_protocols(&config, prots);
@@ -547,6 +564,10 @@ next_arg:
             pid_file = optarg;
             break;
 
+        case 'C':
+            chroot_path = optarg;
+            break;
+
         case 'v':
             verbose++;
             break;
@@ -591,6 +612,7 @@ int main(int argc, char *argv[])
    /* Init defaults */
    pid_file = NULL;
    user_name = NULL;
+   chroot_path = NULL;
 
    cmdline_config(argc, argv, &protocols);
    parse_cmdline(argc, argv, protocols);
@@ -629,13 +651,12 @@ int main(int argc, char *argv[])
    if (pid_file)
        write_pid_file(pid_file);
 
-   if (user_name)
-       drop_privileges(user_name);
-
-
-   /* Open syslog connection */
+   /* Open syslog connection before we drop privs/chroot */
    setup_syslog(argv[0]);
 
+   if (user_name || chroot_path)
+       drop_privileges(user_name, chroot_path);
+
    if (verbose)
        printcaps();
 

sslh-select.c

@@ -27,6 +27,8 @@
 
 const char* server_type = "sslh-select";
 
+#define MAX(a, b) (((a) > (b)) ? (a) : (b))
+
 /* cnx_num_alloc is the number of connection to allocate at once (at start-up,
  * and then every time we get too many simultaneous connections: e.g. start
  * with 100 slots, then if we get more than 100 connections allocate another
@@ -61,9 +63,9 @@ int tidy_connection(struct connection *cnx, fd_set *fds, fd_set *fds2)
             if (verbose)
                 fprintf(stderr, "closing fd %d\n", cnx->q[i].fd);
 
-            close(cnx->q[i].fd);
             FD_CLR(cnx->q[i].fd, fds);
             FD_CLR(cnx->q[i].fd, fds2);
+            close(cnx->q[i].fd);
             if (cnx->q[i].deferred_data)
                 free(cnx->q[i].deferred_data);
         }
@@ -93,11 +95,16 @@ int accept_new_connection(int listen_socket, struct connection *cnx[], int* cnx_
     in_socket = accept(listen_socket, 0, 0);
     CHECK_RES_RETURN(in_socket, "accept");
 
-    if (!fd_is_in_range(in_socket))
+    if (!fd_is_in_range(in_socket)) {
+        close(in_socket);
         return -1;
+    }
 
     res = set_nonblock(in_socket);
-    if (res == -1) return -1;
+    if (res == -1) {
+        close(in_socket);
+        return -1;
+    }
 
     /* Find an empty slot */
     for (free = 0; (free < *cnx_size) && ((*cnx)[free].q[0].fd != -1); free++) {
@@ -109,6 +116,7 @@ int accept_new_connection(int listen_socket, struct connection *cnx[], int* cnx_
         new = realloc(*cnx, (*cnx_size + cnx_num_alloc) * sizeof((*cnx)[0]));
         if (!new) {
             log_message(LOG_ERR, "unable to realloc -- dropping connection\n");
+            close(in_socket);
             return -1;
         }
         *cnx = new;
@@ -140,9 +148,9 @@ int connect_queue(struct connection *cnx, fd_set *fds_r, fd_set *fds_w)
         flush_deferred(q);
         if (q->deferred_data) {
             FD_SET(q->fd, fds_w);
-        } else {
-            FD_SET(q->fd, fds_r);
+            FD_CLR(cnx->q[0].fd, fds_r);
         }
+        FD_SET(q->fd, fds_r);
         return q->fd;
     } else {
         tidy_connection(cnx, fds_r, fds_w);
@@ -180,6 +188,93 @@ void shovel(struct connection *cnx, int active_fd,
     }
 }
 
+/* shovels data from one fd to the other and vice-versa
+   returns after one socket closed
+ */
+void shovel_single(struct connection *cnx)
+{
+   fd_set fds_r, fds_w;
+   int res, i;
+   int max_fd = MAX(cnx->q[0].fd, cnx->q[1].fd) + 1;
+
+   FD_ZERO(&fds_r);
+   FD_ZERO(&fds_w);
+   while (1) {
+      for (i = 0; i < 2; i++) {
+         if (cnx->q[i].deferred_data_size) {
+            FD_SET(cnx->q[i].fd, &fds_w);
+            FD_CLR(cnx->q[1-i].fd, &fds_r);
+         } else {
+            FD_CLR(cnx->q[i].fd, &fds_w);
+            FD_SET(cnx->q[1-i].fd, &fds_r);
+         }
+      }
+
+      res = select(
+                   max_fd,
+                   &fds_r,
+                   &fds_w,
+                   NULL,
+                   NULL
+                  );
+      CHECK_RES_DIE(res, "select");
+
+      for (i = 0; i < 2; i++) {
+          if (FD_ISSET(cnx->q[i].fd, &fds_w)) {
+              res = flush_deferred(&cnx->q[i]);
+              if ((res == -1) && ((errno == EPIPE) || (errno == ECONNRESET))) {
+                  if (verbose)
+                      fprintf(stderr, "%s socket closed\n", i ? "server" : "client");
+                  return;
+              }
+          }
+          if (FD_ISSET(cnx->q[i].fd, &fds_r)) {
+              res = fd2fd(&cnx->q[1-i], &cnx->q[i]);
+              if (!res) {
+                  if (verbose)
+                      fprintf(stderr, "socket closed\n");
+                  return;
+              }
+          }
+      }
+   }
+}
+
+/* Child process that makes internal connection and proxies
+ */
+void connect_proxy(struct connection *cnx)
+{
+    int in_socket;
+    int out_socket;
+
+    /* Minimize the file descriptor value to help select() */
+    in_socket = dup(cnx->q[0].fd);
+    if (in_socket == -1) {
+        in_socket = cnx->q[0].fd;
+    } else {
+        close(cnx->q[0].fd);
+        cnx->q[0].fd = in_socket;
+    }
+
+    /* Connect the target socket */
+    out_socket = connect_addr(cnx, in_socket);
+    CHECK_RES_DIE(out_socket, "connect");
+
+    cnx->q[1].fd = out_socket;
+
+    log_connection(cnx);
+
+    shovel_single(cnx);
+
+    close(in_socket);
+    close(out_socket);
+
+    if (verbose)
+        fprintf(stderr, "connection closed down\n");
+
+    exit(0);
+}
+
 /* returns true if specified fd is initialised and present in fd_set */
 int is_fd_active(int fd, fd_set* set)
 {
@@ -248,15 +343,12 @@ void main_loop(int listen_sockets[], int num_addr_listen)
         for (i = 0; i < num_addr_listen; i++) {
             if (FD_ISSET(listen_sockets[i], &readfds)) {
                 in_socket = accept_new_connection(listen_sockets[i], &cnx, &num_cnx);
-                if (in_socket != -1)
-                    num_probing++;
-
                 if (in_socket > 0) {
+                    num_probing++;
                     FD_SET(in_socket, &fds_r);
                     if (in_socket >= max_fd)
                         max_fd = in_socket + 1;;
                 }
-                FD_CLR(listen_sockets[i], &readfds);
             }
         }
 
@@ -305,6 +397,10 @@ void main_loop(int listen_sockets[], int num_addr_listen)
                          * data so probe the protocol */
                         if ((cnx[i].probe_timeout < time(NULL))) {
                             cnx[i].proto = timeout_protocol();
+                            if (verbose) 
+                                log_message(LOG_INFO, 
+                                            "timed out, connect to %s\n", 
+                                            cnx[i].proto->description);
                         } else {
                             res = probe_client_protocol(&cnx[i]);
                             if (res == PROBE_AGAIN)
@@ -314,14 +410,36 @@ void main_loop(int listen_sockets[], int num_addr_listen)
                         num_probing--;
                         cnx[i].state = ST_SHOVELING;
 
-                        /* libwrap check if required for this protocol */
-                        if (cnx[i].proto->service &&
-                            check_access_rights(in_socket, cnx[i].proto->service)) {
-                            tidy_connection(&cnx[i], &fds_r, &fds_w);
-                            res = -1;
-                        } else {
-                            res = connect_queue(&cnx[i], &fds_r, &fds_w);
-                        }
+			/* libwrap check if required for this protocol */
+			if (cnx[i].proto->service &&
+			    check_access_rights(in_socket, cnx[i].proto->service)) {
+			    tidy_connection(&cnx[i], &fds_r, &fds_w);
+			    res = -1;
+			} else if (cnx[i].proto->fork) {
+			    struct connection *pcnx_i = &cnx[i];
+			    struct connection cnx_i = *pcnx_i;
+			    switch (fork()) {
+			    case 0:  /* child */
+				for (i = 0; i < num_addr_listen; i++)
+				    close(listen_sockets[i]);
+				for (i = 0; i < num_cnx; i++)
+				    if (&cnx[i] != pcnx_i)
+					for (j = 0; j < 2; j++)
+					    if (cnx[i].q[j].fd != -1)
+						close(cnx[i].q[j].fd);
+				free(cnx);
+				connect_proxy(&cnx_i);
+				exit(0);
+			    case -1: log_message(LOG_ERR, "fork failed: err %d: %s\n", errno, strerror(errno));
+				     break;
+			    default: /* parent */
+				     break;
+			    }
+			    tidy_connection(&cnx[i], &fds_r, &fds_w);
+			    res = -1;
+			} else {
+			    res = connect_queue(&cnx[i], &fds_r, &fds_w);
+			}
 
                         if (res >= max_fd)
                             max_fd = res + 1;;

sslh.pod

@@ -6,7 +6,7 @@
 
 =head1 SYNOPSIS
 
-sslh [B<-F> I<config file>] [ B<-t> I<num> ] [B<--transparent>] [B<-p> I<listening address> [B<-p> I<listening address> ...] [B<--ssl> I<target address for SSL>] [B<--ssh> I<target address for SSH>] [B<--openvpn> I<target address for OpenVPN>] [B<--http> I<target address for HTTP>] [B<--anyprot> I<default target address>] [B<--on-timeout> I<protocol name>] [B<-u> I<username>] [B<-P> I<pidfile>] [-v] [-i] [-V] [-f] [-n]
+sslh [B<-F>I<config file>] [B<-t> I<num>] [B<--transparent>] [B<-p> I<listening address> [B<-p> I<listening address> ...] [B<--ssl> I<target address for SSL>] [B<--tls> I<target address for TLS>] [B<--ssh> I<target address for SSH>] [B<--openvpn> I<target address for OpenVPN>] [B<--http> I<target address for HTTP>] [B<--xmpp> I<target address for XMPP>] [B<--tinc> I<target address for TINC>] [B<--anyprot> I<default target address>] [B<--on-timeout> I<protocol name>] [B<-u> I<username>] [B<-C> I<chroot>] [B<-P> I<pidfile>] [-v] [-i] [-V] [-f] [-n]
 
 =head1 DESCRIPTION
 
@@ -58,7 +58,7 @@ expressions, B<sslh> connects to that protocol.
 =head2 Probing protocols
 
 When receiving an incoming connection, B<sslh> will read the
-first bytes sent be the connecting client. It will then
+first bytes sent by the connecting client. It will then
 probe for the protocol in the order specified on the command
 line (or the configuration file). Therefore B<--anyprot>
 should alway be used last, as it always succeeds and further
@@ -78,12 +78,15 @@ connections and LOG_ERR for failures.
 
 =over 4
 
-=item B<-F> I<filename>, B<--config> I<filename>
+=item B<-F>I<filename>, B<--config> I<filename>
 
-Uses I<filename> has configuration file. If other
+Uses I<filename> as configuration file. If other
 command-line options are specified, they will override the
 configuration file's settings.
 
+When using the shorthand version, make sure there should be
+no space between B<-F> and the I<filename>.
+
 =item B<-t> I<num>, B<--timeout> I<num>
 
 Timeout before forwarding the connection to the timeout
@@ -123,7 +126,7 @@ inside your network to just connect directly to B<httpd>.
 
 Also, B<sslh> probes for SSLv3 (or TLSv1) handshake and will
 reject connections from clients requesting SSLv2. This is
-compliant to RFC6176 which prohibits the usage of SSLv2. If
+compliant with RFC6176 which prohibits the usage of SSLv2. If
 you wish to accept SSLv2, use B<--default> instead.
 
 =item B<--ssh> I<target address>
@@ -181,6 +184,10 @@ Prints B<sslh> version.
 
 Requires to run under the specified username. 
 
+=item B<-C> I<chroot>, B<--chroot> I<chroot>
+
+Requires to run under the specified chroot.
+
 =item B<-P> I<pidfile>, B<--pidfile> I<pidfile>
 
 Specifies a file in which to write the PID of the main
@@ -226,10 +233,10 @@ detailed explanation of the variables used by B<sslh>.
 
 =head1 SEE ALSO
 
-Last version available from
+The latest version is available from
 L<http://www.rutschle.net/tech/sslh>, and can be tracked
 from L<http://freecode.com/projects/sslh>.
 
 =head1 AUTHOR
 
-Written by Yves Rutschle
+Written by Yves Rutschle.

systemd-sslh-generator.c

@@ -5,9 +5,8 @@
 
 
 static char* resolve_listen(const char *hostname, const char *port) {
-
-/* Need room in the strcat for \0 and :
- * the format in the socket unit file is hostname:port */
+    /* Need room in the strcat for \0 and :
+     * the format in the socket unit file is hostname:port */
     char *conn = (char*)malloc(strlen(hostname)+strlen(port)+2);
     strcpy(conn, hostname);
     strcat(conn, ":");
@@ -18,136 +17,132 @@ static char* resolve_listen(const char *hostname, const char *port) {
 }
 
 
-static int get_listen_from_conf(const char *filename, char **listen) {
+static int get_listen_from_conf(const char *filename, char **listen[]) {
+    config_t config;
+    config_setting_t *setting, *addr;
+    const char *hostname, *port;
+    int len = 0;
 
-  config_t config;
-  config_setting_t *setting, *addr;
-  const char *hostname, *port;
-  int len = 0;
-
-/* look up the listen stanzas in the config file so these
- * can be used in the socket file generated */
-
-  config_init(&config);
-  if (config_read_file(&config, filename) == CONFIG_FALSE) {
-  /* we don't care if file is missing, skip it */
-       if (config_error_line(&config) != 0) {
-       fprintf(stderr, "%s:%d:%s\n",
-                filename,
-                config_error_line(&config),
-                config_error_text(&config));
-        return -1;
-        }
-  } else {
-   setting = config_lookup(&config, "listen");
-    if (setting) {
-      len = config_setting_length(setting);
-      for (int i = 0; i < len; i++) {
-        addr = config_setting_get_elem(setting, i);
-        if (! (config_setting_lookup_string(addr, "host", &hostname) &&
-               config_setting_lookup_string(addr, "port", &port))) {
-          fprintf(stderr,
-            "line %d:Incomplete specification (hostname and port required)\n",
-            config_setting_source_line(addr));
+    /* look up the listen stanzas in the config file so these
+     * can be used in the socket file generated */
+    config_init(&config);
+    if (config_read_file(&config, filename) == CONFIG_FALSE) {
+        /* we don't care if file is missing, skip it */
+        if (config_error_line(&config) != 0) {
+            fprintf(stderr, "%s:%d:%s\n",
+                    filename,
+                    config_error_line(&config),
+                    config_error_text(&config));
             return -1;
-         } else {
-
-        listen[i] = malloc(strlen(resolve_listen(hostname, port)));
-        strcpy(listen[i], resolve_listen(hostname, port));
         }
-      }
+    } else {
+        setting = config_lookup(&config, "listen");
+        if (setting) {
+	    int i;
+            len = config_setting_length(setting);
+            *listen = malloc(len * sizeof(**listen));
+            for (i = 0; i < len; i++) {
+                addr = config_setting_get_elem(setting, i);
+                if (! (config_setting_lookup_string(addr, "host", &hostname) &&
+                       config_setting_lookup_string(addr, "port", &port))) {
+                    fprintf(stderr,
+                            "line %d:Incomplete specification (hostname and port required)\n",
+                            config_setting_source_line(addr));
+                    return -1;
+                } else {
+                    (*listen)[i] = malloc(strlen(resolve_listen(hostname, port)));
+                    strcpy((*listen)[i], resolve_listen(hostname, port));
+                }
+            }
+        }
     }
-  }
 
-  return len;
+    return len;
 
 }
 
-static int write_socket_unit(FILE *socket, char **listen, int num_addr, const char *source) {
+static int write_socket_unit(FILE *socket, char *listen[], int num_addr, const char *source) {
+    int i;
 
-   fprintf(socket,
-        "# Automatically generated by systemd-sslh-generator\n\n"
-        "[Unit]\n"
-        "Before=sslh.service\n"
-        "SourcePath=%s\n"
-        "Documentation=man:sslh(8) man:systemd-sslh-generator(8)\n\n"
-        "[Socket]\n"
-        "FreeBind=true\n",
-        source);
+    fprintf(socket,
+            "# Automatically generated by systemd-sslh-generator\n\n"
+            "[Unit]\n"
+            "Before=sslh.service\n"
+            "SourcePath=%s\n"
+            "Documentation=man:sslh(8) man:systemd-sslh-generator(8)\n\n"
+            "[Socket]\n"
+            "FreeBind=true\n",
+            source);
 
-        for (int i = 0; i < num_addr; i++) {
-            fprintf(socket, "ListenStream=%s\n", listen[i]);
-        }
+    for (i = 0; i < num_addr; i++) {
+        fprintf(socket, "ListenStream=%s\n", listen[i]);
+    }
 
-return 0;
+    return 0;
 }
 
 static int gen_sslh_config(char *runtime_unit_dir) {
+    char *sslh_conf;
+    int num_addr;
+    FILE *config;
+    char **listen;
+    FILE *runtime_conf_fd = stdout;
+    const char *unit_file;
 
-  char *sslh_conf;
-  int num_addr;
-  FILE *config;
-  char **listen;
-  FILE *runtime_conf_fd = stdout;
-  const char *unit_file;
+    /* There are two default locations so check both with first given preference */
+    sslh_conf = "/etc/sslh.cfg";
 
-/* There are two default locations so check both with first given preference */
-  sslh_conf = "/etc/sslh.cfg";
-
-  config = fopen(sslh_conf, "r");
-  if (config  == NULL) {
-    sslh_conf="/etc/sslh/sslh.cfg";
-     config = fopen(sslh_conf, "r");
-    if (config == NULL) {
-      return -1;
+    config = fopen(sslh_conf, "r");
+    if (config  == NULL) {
+        sslh_conf="/etc/sslh/sslh.cfg";
+        config = fopen(sslh_conf, "r");
+        if (config == NULL) {
+            return -1;
+        }
     }
-  }
 
-  fclose(config);
+    fclose(config);
+
+    num_addr = get_listen_from_conf(sslh_conf, &listen);
+    if (num_addr < 0)
+        return -1;
+
+    /* If this is run by systemd directly write to the location told to
+     * otherwise write to standard out so that it's trivial to check what
+     * will be written */
+    if (runtime_unit_dir && *runtime_unit_dir) {
+        unit_file = "/sslh.socket";
+        size_t uf_len = strlen(unit_file);
+        size_t runtime_len = strlen(runtime_unit_dir) + uf_len + 1;
+        char *runtime_conf = malloc(runtime_len);
+        strcpy(runtime_conf, runtime_unit_dir);
+        strcat(runtime_conf, unit_file);
+        runtime_conf_fd = fopen(runtime_conf, "w");
+    }
 
 
-  num_addr = get_listen_from_conf(sslh_conf, listen);
-  if (num_addr < 0)
-    return -1;
-
-/* If this is run by systemd directly write to the location told to
- * otherwise write to standard out so that it's trivial to check what
- * will be written */
-   if (runtime_unit_dir != "") {
-   unit_file = "/sslh.socket";
-   size_t uf_len = strlen(unit_file);
-   size_t runtime_len = strlen(runtime_unit_dir) + uf_len + 1;
-   char *runtime_conf = malloc(runtime_len);
-       strcpy(runtime_conf, runtime_unit_dir);
-       strcat(runtime_conf, unit_file);
-       runtime_conf_fd = fopen(runtime_conf, "w");
-   }
-
-
- return write_socket_unit(runtime_conf_fd, listen, num_addr, sslh_conf);
-
+    return write_socket_unit(runtime_conf_fd, listen, num_addr, sslh_conf);
 }
 
+
 int main(int argc, char *argv[]){
+    int r = 0;
+    int k;
+    char *runtime_unit_dest = "";
 
-        int r = 0;
-        int k;
-        char *runtime_unit_dest = "";
+    if (argc > 1 && (argc != 4) ) {
+        printf("This program takes three or no arguments.\n");
+        return -1;
+    }
 
-        if (argc > 1 && (argc != 4) ) {
-                printf("This program takes three or no arguments.\n");
-                return -1;
-        }
+    if (argc  > 1)
+        runtime_unit_dest = argv[1];
 
-        if (argc  > 1)
-            runtime_unit_dest = argv[1];
-
-        k = gen_sslh_config(runtime_unit_dest);
-        if (k < 0)
-          r = k;
-
-       return r < 0 ? -1 : 0;
+    k = gen_sslh_config(runtime_unit_dest);
+    if (k < 0)
+        r = k;
 
+    return r < 0 ? -1 : 0;
 }
 
 

tls.c

@@ -30,6 +30,7 @@
  */
 #include <stdio.h>
 #include <stdlib.h> /* malloc() */
+#include <fnmatch.h> /* fnmatch() */
 #include "tls.h"
 
 #define TLS_HEADER_LEN 5
@@ -192,7 +193,7 @@ parse_extensions(const struct TLSProtocol *tls_data, const char *data, size_t da
                         last_matched = 1;
                     }
                 } else {
-                    // both can't match
+                    /* both can't match */
                     return -2;
                 }
             } else if (extension_type == 0x10) { /* ALPN */
@@ -206,7 +207,7 @@ parse_extensions(const struct TLSProtocol *tls_data, const char *data, size_t da
                         last_matched = 1;
                     }
                 } else {
-                    // both can't match
+                    /* both can't match */
                     return -2;
                 }
             }
@@ -214,6 +215,9 @@ parse_extensions(const struct TLSProtocol *tls_data, const char *data, size_t da
         } else if (extension_type == 0x00 && tls_data->use_alpn == 0) { /* Server Name */
             return parse_server_name_extension(tls_data, data + pos + 4, len);
         } else if (extension_type == 0x10 && tls_data->use_alpn == 1) { /* ALPN */
+            if (parse_alpn_extension(tls_data, data + pos + 4, len) > 0) {
+                return 1;
+            }
             return parse_alpn_extension(tls_data, data + pos + 4, len);
         }
 
@@ -287,13 +291,18 @@ parse_alpn_extension(const struct TLSProtocol *tls_data, const char *data, size_
 static int
 has_match(char** list, const char* name, size_t name_len) {
     char **item;
+    char *name_nullterminated = malloc(name_len+1);
+    memcpy(name_nullterminated, name, name_len);
+    name_nullterminated[name_len]='\0';
 
     for (item = list; *item; item++) {
         if (verbose) fprintf(stderr, "matching [%.*s] with [%s]\n", (int)name_len, name, *item);
-        if(!strncmp(*item, name, name_len)) {
+        if(!fnmatch(*item, name_nullterminated, 0)) {
+            free(name_nullterminated);
             return 1;
         }
     }
+    free(name_nullterminated);
     return 0;
 }