v1.21

Update SSL example to TLS

ChangeLog

@@ -1,3 +1,56 @@
+v1.21: 11JUL2020
+	Added TCP_FASTOPEN support for client sockets (if
+	tfo_ok is specified in their configuration) and for
+	listenint socket, if all client protocols support it.
+	(Craig Andrews)
+
+	Added 'minlength' option to skip a probe if less
+	than that many bytes have been received (mostly for
+	regex)
+
+	Moved configuration and command-line management to
+	use conf2struct. Hopefully this should be transparent
+	to users.
+
+	Update Let's Encrypt entry in example.cfg for tls-alpn-01
+	challenges; tls-sni-* challenges are now deprecated.
+
+	Log to syslog even if in foreground (for people who
+	use fail2ban)
+
+	Use syslog_facility: "none" to disable syslog
+	output.
+
+v1.20: 20NOV2018
+	Added support for socks5 protocol (Eugene Protozanov)
+
+	New probing method:
+	Before, probes were tried in order, repeating on the
+	same probe as long it returned PROBE_AGAIN before
+	moving to the next one. This means a probe which
+	requires a lot of data (i.e. returne PROBE_AGAIN for
+	a long time) could prevent sucessful matches from 
+	subsequent probes. The configuration file needed to
+	take that into account.
+
+	Now, all probes are tried each time new data is
+	found. If any probe matches, use it. If at least one
+	probe requires more data, wait for more. If all
+	probes failed, connect to the last one. So the only
+	thing to know when writing the configuration file is
+	that 'anyprot' needs to be last.
+
+	Test suite heavily refactored; `t` uses `test.cfg`
+	to decide which probes to test and all setup is
+	automatic; probes get tested with 'fast' (entire
+	first message in one packet) and 'slow' (one byte at
+	a time); when SNI/ALPN are defined, all combinations
+	are tested.
+
+	Old 'tls' probe removed, 'sni_alpn' probe renamed as 'tls'.
+	You'll need to change 'sni_alpn' to 'tls' in
+	your configuration file, if ever you used it.
+
 v1.19: 20JAN2018
 	Added 'syslog_facility' configuration option to
 	specify where to log.

Makefile

@@ -7,6 +7,7 @@ USELIBPCRE=1	# Use libpcre? (needed for regex on musl)
 USELIBWRAP?=	# Use libwrap?
 USELIBCAP=	# Use libcap?
 USESYSTEMD=     # Make use of systemd socket activation
+USELIBBSD?=     # Use libbsd (needed to update process name in `ps`)
 COV_TEST= 	# Perform test coverage?
 PREFIX?=/usr
 BINDIR?=$(PREFIX)/sbin
@@ -25,7 +26,7 @@ CC ?= gcc
 CFLAGS ?=-Wall -g $(CFLAGS_COV)
 
 LIBS=
-OBJS=common.o sslh-main.o probe.o tls.o
+OBJS=sslh-conf.o common.o sslh-main.o probe.o tls.o argtable3.o
 
 CONDITIONAL_TARGETS=
 
@@ -59,6 +60,11 @@ ifneq ($(strip $(USESYSTEMD)),)
 	CONDITIONAL_TARGETS+=systemd-sslh-generator
 endif
 
+ifneq ($(strip $(USELIBBSD)),)
+        LIBS:=$(LIBS) -lbsd
+        CPPFLAGS+=-DLIBBSD
+endif
+
 
 all: sslh $(MAN) echosrv $(CONDITIONAL_TARGETS)
 
@@ -72,6 +78,9 @@ sslh: sslh-fork sslh-select
 
 $(OBJS): version.h
 
+sslh-conf.c: sslhconf.cfg
+	conf2struct sslhconf.cfg
+
 sslh-fork: version.h $(OBJS) sslh-fork.o Makefile common.h
 	$(CC) $(CFLAGS) $(LDFLAGS) -o sslh-fork sslh-fork.o $(OBJS) $(LIBS)
 	#strip sslh-fork
@@ -112,7 +121,7 @@ uninstall:
 	update-rc.d sslh remove
 
 distclean: clean
-	rm -f tags cscope.*
+	rm -f tags sslh-conf.c sslh-conf.h cscope.*
 
 clean:
 	rm -f sslh-fork sslh-select echosrv version.h $(MAN) systemd-sslh-generator *.o *.gcov *.gcno *.gcda *.png *.html *.css *.info

README.md

@@ -5,437 +5,37 @@ sslh -- A ssl/ssh multiplexer
 them further based on tests performed on the first data
 packet sent by the remote client.
 
-Probes for HTTP, SSL, SSH, OpenVPN, tinc, XMPP are
-implemented, and any other protocol that can be tested using
-a regular expression, can be recognised. A typical use case
-is to allow serving several services on port 443 (e.g. to
-connect to SSH from inside a corporate firewall, which
-almost never block port 443) while still serving HTTPS on
-that port. 
+Probes for HTTP, TLS/SSL (including SNI and ALPN), SSH,
+OpenVPN, tinc, XMPP, SOCKS5, are implemented, and any other
+protocol that can be tested using a regular expression, can
+be recognised. A typical use case is to allow serving
+several services on port 443 (e.g. to connect to SSH from
+inside a corporate firewall, which almost never block port
+443) while still serving HTTPS on that port. 
 
 Hence `sslh` acts as a protocol demultiplexer, or a
-switchboard. Its name comes from its original function to
-serve SSH and HTTPS on the same port.
+switchboard. With the SNI and ALPN probe, it makes a good
+front-end to a virtual host farm hosted behind a single IP
+address.
 
-Compile and install
-===================
+`sslh` has the bells and whistles expected from a mature
+daemon: privilege and capabilities dropping, inetd support,
+systemd support, transparent proxying,
+chroot, logging, IPv4 and IPv6, a fork-based and a
+select-based model, and more.
 
-Dependencies
-------------
+Install
+=======
 
-`sslh` uses [libconfig](http://www.hyperrealm.com/libconfig/)
-and [libwrap](http://packages.debian.org/source/unstable/tcp-wrappers).
-
-For Debian, these are contained in packages `libwrap0-dev` and
-`libconfig8-dev`.
-
-For OpenSUSE, these are contained in packages libconfig9 and
-libconfig-dev in repository
-<http://download.opensuse.org/repositories/multimedia:/libs/openSUSE_12.1/>
-
-For Fedora, you'll need packages `libconfig` and
-`libconfig-devel`:
-
-	yum install libconfig libconfig-devel
-
-If you can't find `libconfig`, or just don't want a
-configuration file, set `USELIBCONFIG=` in the Makefile.
-
-Compilation
------------
-
-After this, the Makefile should work:
-
-	make install
-
-There are a couple of configuration options at the beginning
-of the Makefile: 
-
-* `USELIBWRAP` compiles support for host access control (see
-  `hosts_access(3)`), you will need `libwrap` headers and
-  library to compile (`libwrap0-dev` in Debian).
-
-* `USELIBCONFIG` compiles support for the configuration
-  file. You will need `libconfig` headers to compile
-  (`libconfig8-dev` in Debian).
-
-*  `USESYSTEMD` compiles support for using systemd socket activation.
-   You will need `systemd` headers to compile (`systemd-devel` in Fedora).
-
-Binaries
---------
-
-The Makefile produces two different executables: `sslh-fork`
-and `sslh-select`:
-
-* `sslh-fork` forks a new process for each incoming connection.
-It is well-tested and very reliable, but incurs the overhead
-of many processes.  
-If you are going to use `sslh` for a "small" setup (less than
-a dozen ssh connections and a low-traffic https server) then
-`sslh-fork` is probably more suited for you. 
-
-* `sslh-select` uses only one thread, which monitors all connections
-at once. It is more recent and less tested, but only incurs a 16
-byte overhead per connection. Also, if it stops, you'll lose all
-connections, which means you can't upgrade it remotely.  
-If you are going to use `sslh` on a "medium" setup (a few thousand ssh
-connections, and another few thousand ssl connections),
-`sslh-select` will be better.
-
-If you have a very large site (tens of thousands of connections),
-you'll need a vapourware version that would use libevent or
-something like that.
-
-
-Installation
-------------
-
-* In general:
-
-		make
-		cp sslh-fork /usr/local/sbin/sslh
-		cp basic.cfg /etc/sslh.cfg
-                vi /etc/sslh.cfg
-
-* For Debian:
-
-		cp scripts/etc.init.d.sslh /etc/init.d/sslh
-	
-* For CentOS:
-
-		cp scripts/etc.rc.d.init.d.sslh.centos /etc/rc.d/init.d/sslh
-
-
-You might need to create links in /etc/rc<x>.d so that the server
-start automatically at boot-up, e.g. under Debian:
-
-	update-rc.d sslh defaults
+Please refer to the [install guide](doc/INSTALL.md).
 
 
 Configuration
 =============
 
-If you use the scripts provided, sslh will get its
-configuration from /etc/sslh.cfg. Please refer to
-example.cfg for an overview of all the settings.
+Please refer to the [configuration guide](doc/config.md).
 
-A good scheme is to use the external name of the machine in
-`listen`, and bind `httpd` to `localhost:443` (instead of all
-binding to all interfaces): that way, HTTPS connections
-coming from inside your network don't need to go through
-`sslh`, and `sslh` is only there as a frontal for connections
-coming from the internet.
 
-Note that 'external name' in this context refers to the
-actual IP address of the machine as seen from your network,
-i.e. that that is not `127.0.0.1` in the output of
-`ifconfig(8)`.
-
-Libwrap support
----------------
-
-Sslh can optionally perform `libwrap` checks for the sshd
-service: because the connection to `sshd` will be coming
-locally from `sslh`, `sshd` cannot determine the IP of the
-client.
-
-OpenVPN support
----------------
-
-OpenVPN clients connecting to OpenVPN running with
-`-port-share` reportedly take more than one second between
-the time the TCP connection is established and the time they
-send the first data packet. This results in `sslh` with
-default settings timing out and assuming an SSH connection.
-To support OpenVPN connections reliably, it is necessary to
-increase `sslh`'s timeout to 5 seconds.
-
-Instead of using OpenVPN's port sharing, it is more reliable
-to use `sslh`'s `--openvpn` option to get `sslh` to do the
-port sharing.
-
-Using proxytunnel with sslh
----------------------------
-
-If you are connecting through a proxy that checks that the
-outgoing connection really is SSL and rejects SSH, you can
-encapsulate all your traffic in SSL using `proxytunnel` (this
-should work with `corkscrew` as well). On the server side you
-receive the traffic with `stunnel` to decapsulate SSL, then
-pipe through `sslh` to switch HTTP on one side and SSL on the
-other.
-
-In that case, you end up with something like this:
-
-	ssh -> proxytunnel -e ----[ssh/ssl]---> stunnel ---[ssh]---> sslh --> sshd
-	Web browser -------------[http/ssl]---> stunnel ---[http]--> sslh --> httpd
-
-Configuration goes like this on the server side, using `stunnel3`:
-
-	stunnel -f -p mycert.pem  -d thelonious:443 -l /usr/local/sbin/sslh -- \
-		sslh -i  --http localhost:80 --ssh localhost:22
-
-* stunnel options:
-  * `-f` for foreground/debugging
-  * `-p` for specifying the key and certificate
-  * `-d` for specifying which interface and port
-	we're listening to for incoming connexions
-  * `-l` summons `sslh` in inetd mode.
-
-* sslh options:
-  * `-i` for inetd mode
-  * `--http` to forward HTTP connexions to port 80,
-	and SSH connexions to port 22.
-
-Capabilities support
---------------------
-
-On Linux (only?), you can compile sslh with `USELIBCAP=1` to
-make use of POSIX capabilities; this will save the required
-capabilities needed for transparent proxying for unprivileged
-processes.
-
-Alternatively, you may use filesystem capabilities instead
-of starting sslh as root and asking it to drop privileges.
-You will need `CAP_NET_BIND_SERVICE` for listening on port 443
-and `CAP_NET_ADMIN` for transparent proxying (see
-`capabilities(7)`).
-
-You can use the `setcap(8)` utility to give these capabilities
-to the executable:
-
-	# setcap cap_net_bind_service,cap_net_admin+pe sslh-select
-
-Then you can run sslh-select as an unpriviledged user, e.g.:
-
-	$ sslh-select -p myname:443 --ssh localhost:22 --ssl localhost:443
-
-Caveat: `CAP_NET_ADMIN` does give sslh too many rights, e.g.
-configuring the interface. If you're not going to use
-transparent proxying, just don't use it (or use the libcap method).
-
-Transparent proxy support
--------------------------
-
-On Linux and FreeBSD you can use the `--transparent` option to
-request transparent proxying. This means services behind `sslh`
-(Apache, `sshd` and so on) will see the external IP and ports
-as if the external world connected directly to them. This
-simplifies IP-based access control (or makes it possible at
-all).
-
-Linux:
-
-`sslh` needs extended rights to perform this: you'll need to
-give it `CAP_NET_ADMIN` capabilities (see appropriate chapter)
-or run it as root (but don't do that).
-
-The firewalling tables also need to be adjusted as follows.
-I don't think it is possible to have `httpd` and `sslh` both listen to 443 in
-this scheme -- let me know if you manage that:
-
-	$ # Set route_localnet = 1 on all interfaces so that ssl can use "localhost" as destination
-	$ sysctl -w net.ipv4.conf.default.route_localnet=1
-	$ sysctl -w net.ipv4.conf.all.route_localnet=1
-
-	$ # DROP martian packets as they would have been if route_localnet was zero
-	$ # Note: packets not leaving the server aren't affected by this, thus sslh will still work
-	$ iptables -t raw -A PREROUTING ! -i lo -d 127.0.0.0/8 -j DROP
-	$ iptables -t mangle -A POSTROUTING ! -o lo -s 127.0.0.0/8 -j DROP
-
-	$ # Mark all connections made by ssl for special treatment (here sslh is run as user "sslh")
-	$ iptables -t nat -A OUTPUT -m owner --uid-owner sslh -p tcp --tcp-flags FIN,SYN,RST,ACK SYN -j CONNMARK --set-xmark 0x01/0x0f
-
-	$ # Outgoing packets that should go to sslh instead have to be rerouted, so mark them accordingly (copying over the connection mark)
-	$ iptables -t mangle -A OUTPUT ! -o lo -p tcp -m connmark --mark 0x01/0x0f -j CONNMARK --restore-mark --mask 0x0f
-
-	$ # Configure routing for those marked packets
-	$ ip rule add fwmark 0x1 lookup 100
-	$ ip route add local 0.0.0.0/0 dev lo table 100
-
-Tranparent proxying with IPv6 is similarly set up as follows:
-
-	$ # Set route_localnet = 1 on all interfaces so that ssl can use "localhost" as destination
-	$ # Not sure if this is needed for ipv6 though
-	$ sysctl -w net.ipv4.conf.default.route_localnet=1
-	$ sysctl -w net.ipv4.conf.all.route_localnet=1
-
-	$ # DROP martian packets as they would have been if route_localnet was zero
-	$ # Note: packets not leaving the server aren't affected by this, thus sslh will still work
-	$ ip6tables -t raw -A PREROUTING ! -i lo -d ::1/128 -j DROP
-	$ ip6tables -t mangle -A POSTROUTING ! -o lo -s ::1/128 -j DROP
-
-	$ # Mark all connections made by ssl for special treatment (here sslh is run as user "sslh")
-	$ ip6tables -t nat -A OUTPUT -m owner --uid-owner sslh -p tcp --tcp-flags FIN,SYN,RST,ACK SYN -j CONNMARK --set-xmark 0x01/0x0f
-
-	$ # Outgoing packets that should go to sslh instead have to be rerouted, so mark them accordingly (copying over the connection mark)
-	$ ip6tables -t mangle -A OUTPUT ! -o lo -p tcp -m connmark --mark 0x01/0x0f -j CONNMARK --restore-mark --mask 0x0f
-
-	$ # Configure routing for those marked packets
-	$ ip -6 rule add fwmark 0x1 lookup 100
-	$ ip -6 route add local ::/0 dev lo table 100
-
-Explanation:
-To be able to use `localhost` as destination in your sslh config along with transparent proxying
-you have to allow routing of loopback addresses as done above.
-This is something you usually should not do (see [this stackoverflow post](https://serverfault.com/questions/656279/how-to-force-linux-to-accept-packet-with-loopback-ip/656484#656484))
-The two `DROP` iptables rules emulate the behaviour of `route_localnet` set to off (with one small difference:
-allowing the reroute-check to happen after the fwmark is set on packets destined for sslh).
-See [this diagram](https://upload.wikimedia.org/wikipedia/commons/3/37/Netfilter-packet-flow.svg) for a good visualisation
-showing how packets will traverse the iptables chains.
-
-Note:
-You have to run `sslh` as dedicated user (in this example the user is also named `sslh`), to not mess up with your normal networking.
-These rules will allow you to connect directly to ssh on port
-22 (or to any other service behind sslh) as well as through sslh on port 443.
-
-Also remember that iptables configuration and ip routes and 
-rules won't be necessarily persisted after you reboot. Make 
-sure to save them properly. For example in CentOS7, you would 
-do `iptables-save > /etc/sysconfig/iptables`, and add both 
-`ip` commands to your `/etc/rc.local`.
-
-FreeBSD:
-
-Given you have no firewall defined yet, you can use the following configuration
-to have ipfw properly redirect traffic back to sslh
-
-	/etc/rc.conf
-	firewall_enable="YES"
-	firewall_type="open"
-	firewall_logif="YES"
-	firewall_coscripts="/etc/ipfw/sslh.rules"
-
-
-/etc/ipfw/sslh.rules
-
-	#! /bin/sh
-
-	# ssl
-	ipfw add 20000 fwd 192.0.2.1,443 log tcp from 192.0.2.1 8443 to any out
-	ipfw add 20010 fwd 2001:db8::1,443 log tcp from 2001:db8::1 8443 to any out
-
-	# ssh
-	ipfw add 20100 fwd 192.0.2.1,443 log tcp from 192.0.2.1 8022 to any out
-	ipfw add 20110 fwd 2001:db8::1,443 log tcp from 2001:db8::1 8022 to any out
-
-	# xmpp
-	ipfw add 20200 fwd 192.0.2.1,443 log tcp from 192.0.2.1 5222 to any out
-	ipfw add 20210 fwd 2001:db8::1,443 log tcp from 2001:db8::1 5222 to any out
-
-	# openvpn (running on other internal system)
-	ipfw add 20300 fwd 192.0.2.1,443 log tcp from 198.51.100.7 1194 to any out
-	ipfw add 20310 fwd 2001:db8::1,443 log tcp from 2001:db8:1::7 1194 to any out
-
-General notes:
-
-
-This will only work if `sslh` does not use any loopback
-addresses (no `127.0.0.1` or `localhost`), you'll need to use
-explicit IP addresses (or names):
-
-	sslh --listen 192.168.0.1:443 --ssh 192.168.0.1:22 --ssl 192.168.0.1:4443
-
-This will not work:
-
-	sslh --listen 192.168.0.1:443 --ssh 127.0.0.1:22 --ssl 127.0.0.1:4443
-    
-Transparent proxying means the target server sees the real
-origin address, so it means if the client connects using
-IPv6, the server must also support IPv6. It is easy to
-support both IPv4 and IPv6 by configuring the server
-accordingly, and setting `sslh` to connect to a name that
-resolves to both IPv4 and IPv6, e.g.:
-
-        sslh --transparent --listen <extaddr>:443 --ssh insideaddr:22
-
-        /etc/hosts:
-        192.168.0.1  insideaddr
-        201::::2     insideaddr
-
-Upon incoming IPv6 connection, `sslh` will first try to
-connect to the IPv4 address (which will fail), then connect
-to the IPv6 address.
-
-Systemd Socket Activation
--------------------------
-If compiled with `USESYSTEMD` then it is possible to activate 
-the service on demand and avoid running any code as root.
-
-In this mode any listen configuration options are ignored and 
-the sockets are passed by systemd to the service.
-
-Example socket unit:
-
-	[Unit]
-	Before=sslh.service
-	
-	[Socket]
-	ListenStream=1.2.3.4:443
-	ListenStream=5.6.7.8:444
-	ListenStream=9.10.11.12:445
-	FreeBind=true
-
-	[Install]
-	WantedBy=sockets.target
-
-Example service unit:
-
-	[Unit]
-	PartOf=sslh.socket
-	
-	[Service]
-	ExecStart=/usr/sbin/sslh -v -f --ssh 127.0.0.1:22 --ssl 127.0.0.1:443
-	KillMode=process
-	CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_NET_ADMIN CAP_SETGID CAP_SETUID
-	PrivateTmp=true
-	PrivateDevices=true
-	ProtectSystem=full
-	ProtectHome=true
-	User=sslh
-
-
-With this setup only the socket needs to be enabled. The sslh service 
-will be started on demand and does not need to run as root to bind the 
-sockets as systemd has already bound and passed them over. If the sslh
-service is started on its own without the sockets being passed by systemd
-then it will look to use those defined on the command line or config
-file as usual. Any number of ListenStreams can be defined in the socket
-file and systemd will pass them all over to sslh to use as usual.
-
-To avoid inconsistency between starting via socket and starting directly
-via the service Requires=sslh.socket can be added to the service unit to
-mandate the use of the socket configuration.
-
-Rather than overwriting the entire socket file drop in values can be placed
-in /etc/systemd/system/sslh.socket.d/<name>.conf with additional ListenStream
-values that will be merged.
-
-In addition to the above with manual .socket file configuration there is an
-optional systemd generator which can be compiled - systemd-sslh-generator 
-
-This parses the /etc/sslh.cfg (or /etc/sslh/sslh.cfg file if that exists 
-instead) configuration file and dynamically generates a socket file to use.
-
-This will also merge with any sslh.socket.d drop in configuration but will be 
-overriden by a /etc/systemd/system/sslh.socket file.
-
-To use the generator place it in /usr/lib/systemd/system-generators and then
-call systemctl daemon-reload after any changes to /etc/sslh.cfg to generate 
-the new dynamic socket unit.
-
-Fail2ban
---------
-
-If using transparent proxying, just use the standard ssh
-rules. If you can't or don't want to use transparent
-proxying, you can set `fail2ban` rules to block repeated ssh
-connections from an IP address (obviously this depends
-on the site, there might be legitimate reasons you would get
-many connections to ssh from the same IP address...)
-
-See example files in scripts/fail2ban.
 
 Comments? Questions?
 ====================
@@ -444,5 +44,7 @@ You can subscribe to the `sslh` mailing list here:
 <http://rutschle.net/cgi-bin/mailman/listinfo/sslh>
 
 This mailing list should be used for discussion, feature
-requests, and will be the prefered channel for announcements.
+requests, and will be the preferred channel for announcements.
+
+Of course, check the [FAQ](doc/FAQ.md) first!
 

argtable3.h

@@ -0,0 +1,305 @@
+/*******************************************************************************
+ * This file is part of the argtable3 library.
+ *
+ * Copyright (C) 1998-2001,2003-2011,2013 Stewart Heitmann
+ * <sheitmann@users.sourceforge.net>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *     * Neither the name of STEWART HEITMANN nor the  names of its contributors
+ *       may be used to endorse or promote products derived from this software
+ *       without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL STEWART HEITMANN BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ ******************************************************************************/
+
+#ifndef ARGTABLE3
+#define ARGTABLE3
+
+#include <stdio.h>      /* FILE */
+#include <time.h>       /* struct tm */
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define ARG_REX_ICASE 1
+    
+/* bit masks for arg_hdr.flag */
+enum
+{
+    ARG_TERMINATOR=0x1,
+    ARG_HASVALUE=0x2,
+    ARG_HASOPTVALUE=0x4
+};
+
+typedef void (arg_resetfn)(void *parent);
+typedef int  (arg_scanfn)(void *parent, const char *argval);
+typedef int  (arg_checkfn)(void *parent);
+typedef void (arg_errorfn)(void *parent, FILE *fp, int error, const char *argval, const char *progname);
+
+
+/*
+* The arg_hdr struct defines properties that are common to all arg_xxx structs.
+* The argtable library requires each arg_xxx struct to have an arg_hdr
+* struct as its first data member.
+* The argtable library functions then use this data to identify the
+* properties of the command line option, such as its option tags,
+* datatype string, and glossary strings, and so on.
+* Moreover, the arg_hdr struct contains pointers to custom functions that
+* are provided by each arg_xxx struct which perform the tasks of parsing
+* that particular arg_xxx arguments, performing post-parse checks, and
+* reporting errors.
+* These functions are private to the individual arg_xxx source code
+* and are the pointer to them are initiliased by that arg_xxx struct's
+* constructor function. The user could alter them after construction
+* if desired, but the original intention is for them to be set by the
+* constructor and left unaltered.
+*/
+struct arg_hdr
+{
+    char         flag;        /* Modifier flags: ARG_TERMINATOR, ARG_HASVALUE. */
+    const char  *shortopts;   /* String defining the short options */
+    const char  *longopts;    /* String defiing the long options */
+    const char  *datatype;    /* Description of the argument data type */
+    const char  *glossary;    /* Description of the option as shown by arg_print_glossary function */
+    int          mincount;    /* Minimum number of occurences of this option accepted */
+    int          maxcount;    /* Maximum number of occurences if this option accepted */
+    void        *parent;      /* Pointer to parent arg_xxx struct */
+    arg_resetfn *resetfn;     /* Pointer to parent arg_xxx reset function */
+    arg_scanfn  *scanfn;      /* Pointer to parent arg_xxx scan function */
+    arg_checkfn *checkfn;     /* Pointer to parent arg_xxx check function */
+    arg_errorfn *errorfn;     /* Pointer to parent arg_xxx error function */
+    void        *priv;        /* Pointer to private header data for use by arg_xxx functions */
+};
+
+struct arg_rem
+{
+    struct arg_hdr hdr;      /* The mandatory argtable header struct */
+};
+
+struct arg_lit
+{
+    struct arg_hdr hdr;      /* The mandatory argtable header struct */
+    int count;               /* Number of matching command line args */
+};
+
+struct arg_int
+{
+    struct arg_hdr hdr;      /* The mandatory argtable header struct */
+    int count;               /* Number of matching command line args */
+    int *ival;               /* Array of parsed argument values */
+};
+
+struct arg_dbl
+{
+    struct arg_hdr hdr;      /* The mandatory argtable header struct */
+    int count;               /* Number of matching command line args */
+    double *dval;            /* Array of parsed argument values */
+};
+
+struct arg_str
+{
+    struct arg_hdr hdr;      /* The mandatory argtable header struct */
+    int count;               /* Number of matching command line args */
+    const char **sval;       /* Array of parsed argument values */
+};
+
+struct arg_rex
+{
+    struct arg_hdr hdr;      /* The mandatory argtable header struct */
+    int count;               /* Number of matching command line args */
+    const char **sval;       /* Array of parsed argument values */
+};
+
+struct arg_file
+{
+    struct arg_hdr hdr;      /* The mandatory argtable header struct */
+    int count;               /* Number of matching command line args*/
+    const char **filename;   /* Array of parsed filenames  (eg: /home/foo.bar) */
+    const char **basename;   /* Array of parsed basenames  (eg: foo.bar) */
+    const char **extension;  /* Array of parsed extensions (eg: .bar) */
+};
+
+struct arg_date
+{
+    struct arg_hdr hdr;      /* The mandatory argtable header struct */
+    const char *format;      /* strptime format string used to parse the date */
+    int count;               /* Number of matching command line args */
+    struct tm *tmval;        /* Array of parsed time values */
+};
+
+enum {ARG_ELIMIT=1, ARG_EMALLOC, ARG_ENOMATCH, ARG_ELONGOPT, ARG_EMISSARG};
+struct arg_end
+{
+    struct arg_hdr hdr;      /* The mandatory argtable header struct */
+    int count;               /* Number of errors encountered */
+    int *error;              /* Array of error codes */
+    void **parent;           /* Array of pointers to offending arg_xxx struct */
+    const char **argval;     /* Array of pointers to offending argv[] string */
+};
+
+
+/**** arg_xxx constructor functions *********************************/
+
+struct arg_rem* arg_rem(const char* datatype, const char* glossary);
+
+struct arg_lit* arg_lit0(const char* shortopts,
+    const char* longopts,
+    const char* glossary);
+struct arg_lit* arg_lit1(const char* shortopts,
+    const char* longopts,
+    const char *glossary);
+struct arg_lit* arg_litn(const char* shortopts,
+    const char* longopts,
+    int mincount,
+    int maxcount,
+    const char *glossary);
+
+struct arg_key* arg_key0(const char* keyword,
+    int flags,
+    const char* glossary);
+struct arg_key* arg_key1(const char* keyword,
+    int flags,
+    const char* glossary);
+struct arg_key* arg_keyn(const char* keyword,
+    int flags,
+    int mincount,
+    int maxcount,
+    const char* glossary);
+
+struct arg_int* arg_int0(const char* shortopts,
+    const char* longopts,
+    const char* datatype,
+    const char* glossary);
+struct arg_int* arg_int1(const char* shortopts,
+    const char* longopts,
+    const char* datatype,
+    const char *glossary);
+struct arg_int* arg_intn(const char* shortopts,
+    const char* longopts,
+    const char *datatype,
+    int mincount,
+    int maxcount,
+    const char *glossary);
+
+struct arg_dbl* arg_dbl0(const char* shortopts,
+    const char* longopts,
+    const char* datatype,
+    const char* glossary);
+struct arg_dbl* arg_dbl1(const char* shortopts,
+    const char* longopts,
+    const char* datatype,
+    const char *glossary);
+struct arg_dbl* arg_dbln(const char* shortopts,
+    const char* longopts,
+    const char *datatype,
+    int mincount,
+    int maxcount,
+    const char *glossary);
+
+struct arg_str* arg_str0(const char* shortopts,
+    const char* longopts,
+    const char* datatype,
+    const char* glossary);
+struct arg_str* arg_str1(const char* shortopts,
+    const char* longopts,                    
+    const char* datatype,
+    const char *glossary);
+struct arg_str* arg_strn(const char* shortopts,
+    const char* longopts,
+    const char* datatype,
+    int mincount,
+    int maxcount,
+    const char *glossary);
+
+struct arg_rex* arg_rex0(const char* shortopts,
+    const char* longopts,
+    const char* pattern,
+    const char* datatype,
+    int flags,
+    const char* glossary);
+struct arg_rex* arg_rex1(const char* shortopts,
+    const char* longopts,
+    const char* pattern,
+    const char* datatype,
+    int flags,
+    const char *glossary);
+struct arg_rex* arg_rexn(const char* shortopts,
+    const char* longopts,
+    const char* pattern,
+    const char* datatype,
+    int mincount,
+    int maxcount,
+    int flags,
+    const char *glossary);
+
+struct arg_file* arg_file0(const char* shortopts,
+    const char* longopts,
+    const char* datatype,
+    const char* glossary);
+struct arg_file* arg_file1(const char* shortopts,
+    const char* longopts,
+    const char* datatype,
+    const char *glossary);
+struct arg_file* arg_filen(const char* shortopts,
+    const char* longopts,
+    const char* datatype,
+    int mincount,
+    int maxcount,
+    const char *glossary);
+
+struct arg_date* arg_date0(const char* shortopts,
+    const char* longopts,
+    const char* format,
+    const char* datatype,
+    const char* glossary);
+struct arg_date* arg_date1(const char* shortopts,
+    const char* longopts,
+    const char* format,
+    const char* datatype,
+    const char *glossary);
+struct arg_date* arg_daten(const char* shortopts,
+    const char* longopts,
+    const char* format,
+    const char* datatype,
+    int mincount,
+    int maxcount,
+    const char *glossary);
+
+struct arg_end* arg_end(int maxerrors);
+
+
+/**** other functions *******************************************/
+int arg_nullcheck(void **argtable);
+int arg_parse(int argc, char **argv, void **argtable);
+void arg_print_option(FILE *fp, const char *shortopts, const char *longopts, const char *datatype, const char *suffix);
+void arg_print_syntax(FILE *fp, void **argtable, const char *suffix);
+void arg_print_syntaxv(FILE *fp, void **argtable, const char *suffix);
+void arg_print_glossary(FILE *fp, void **argtable, const char *format);
+void arg_print_glossary_gnu(FILE *fp, void **argtable);
+void arg_print_errors(FILE* fp, struct arg_end* end, const char* progname);
+void arg_freetable(void **argtable, size_t n);
+
+/**** deprecated functions, for back-compatibility only ********/
+void arg_free(void **argtable);
+
+#ifdef __cplusplus
+}
+#endif
+#endif

basic.cfg

@@ -1,7 +1,7 @@
 # This is a basic configuration file that should provide
 # sensible values for "standard" setup.
 
-verbose: false;
+verbose: 0;
 foreground: false;
 inetd: false;
 numeric: false;
@@ -24,7 +24,7 @@ protocols:
      { name: "openvpn"; host: "localhost"; port: "1194"; },
      { name: "xmpp"; host: "localhost"; port: "5222"; },
      { name: "http"; host: "localhost"; port: "80"; },
-     { name: "ssl"; host: "localhost"; port: "443"; log_level: 0; },
+     { name: "tls"; host: "localhost"; port: "443"; log_level: 0; },
      { name: "anyprot"; host: "localhost"; port: "443"; }
 );
 

common.c

@@ -16,6 +16,7 @@
 
 #include "common.h"
 #include "probe.h"
+#include "sslh-conf.h"
 
 /* Added to make the code compilable under CYGWIN
  * */
@@ -29,22 +30,20 @@
 #include <systemd/sd-daemon.h>
 #endif
 
+#ifdef LIBBSD
+#include <bsd/unistd.h>
+#endif
+
 /*
- * Settings that depend on the command line.  They're set in main(), but also
- * used in other places in common.c, and it'd be heavy-handed to pass it all as
- * parameters
+ * Settings that depend on the command line or the config file
  */
-int verbose = 0;
-int probing_timeout = 2;
-int inetd = 0;
-int foreground = 0;
-int background = 0;
-int transparent = 0;
-int numeric = 0;
-const char *user_name, *pid_file, *chroot_path, *facility = "auth";
+struct sslhcfg_item cfg;
 
 struct addrinfo *addr_listen = NULL; /* what addresses do we listen to? */
 
+
+static int do_syslog = 1; /* Should we syslog? controled by syslog_facility = "none" */
+
 #ifdef LIBWRAP
 #include <tcpd.h>
 int allow_severity =0, deny_severity = 0;
@@ -84,6 +83,7 @@ int get_fd_sockets(int *sockfd[])
     if (sd > 0) {
       int i;
       *sockfd = malloc(sd * sizeof(*sockfd[0]));
+      CHECK_ALLOC(*sockfd, "malloc");
       for (i = 0; i < sd; i++) {
         (*sockfd)[i] = SD_LISTEN_FDS_START + i;
       }
@@ -93,6 +93,24 @@ int get_fd_sockets(int *sockfd[])
     return sd;
 }
 
+/* Set TCP_FASTOPEN on listening socket if all client protocols support it */
+int make_listen_tfo(int s)
+{
+    int i, qlen = 5;
+
+    /* Don't do it if not supported */
+    if (!TCP_FASTOPEN)
+        return 0;
+
+    /* Don't do it if any protocol does not specify it */
+    for (i = 0; i < cfg.protocols_len; i++) {
+        if (! cfg.protocols[i].tfo_ok)
+            return 0;
+    }
+
+    return setsockopt(s, SOL_SOCKET, TCP_FASTOPEN, (char*)&qlen, sizeof(qlen));
+}
+
 /* Starts listening sockets on specified addresses.
  * IN: addr[], num_addr
  * OUT: *sockfd[]  pointer to newly-allocated array of file descriptors
@@ -116,10 +134,16 @@ int start_listen_sockets(int *sockfd[], struct addrinfo *addr_list)
    for (addr = addr_list; addr; addr = addr->ai_next)
        num_addr++;
 
-   if (verbose)
+   if (num_addr == 0) {
+       fprintf(stderr, "FATAL: No available addresses.\n");
+       exit(1);
+   }
+
+   if (cfg.verbose)
        fprintf(stderr, "listening to %d addresses\n", num_addr);
 
    *sockfd = malloc(num_addr * sizeof(*sockfd[0]));
+   CHECK_ALLOC(*sockfd, "malloc");
 
    for (i = 0, addr = addr_list; i < num_addr && addr; i++, addr = addr->ai_next) {
        if (!addr) {
@@ -135,6 +159,9 @@ int start_listen_sockets(int *sockfd[], struct addrinfo *addr_list)
        res = setsockopt((*sockfd)[i], SOL_SOCKET, SO_REUSEADDR, (char*)&one, sizeof(one));
        check_res_dump(CR_DIE, res, addr, "setsockopt(SO_REUSEADDR)");
 
+       res = make_listen_tfo((*sockfd)[i]);
+       check_res_dump(CR_WARN, res, addr, "setsockopt(TCP_FASTOPEN)");
+
        if (addr->ai_flags & SO_KEEPALIVE) {
            res = setsockopt((*sockfd)[i], SOL_SOCKET, SO_KEEPALIVE, (char*)&one, sizeof(one));
            check_res_dump(CR_DIE, res, addr, "setsockopt(SO_KEEPALIVE)");
@@ -161,6 +188,48 @@ int start_listen_sockets(int *sockfd[], struct addrinfo *addr_list)
    return num_addr;
 }
 
+
+/* returns 1 if given address is on the local machine: iterate through all
+ * network interfaces and check their addresses */
+int is_same_machine(struct addrinfo* from)
+{
+    struct ifaddrs *ifaddrs_p = NULL, *ifa;
+    int match = 0;
+
+    getifaddrs(&ifaddrs_p);
+
+    for (ifa = ifaddrs_p; ifa != NULL; ifa = ifa->ifa_next)
+    {
+        if (!ifa->ifa_addr)
+            continue;
+        if (from->ai_addr->sa_family == ifa->ifa_addr->sa_family)
+        {
+            int family = ifa->ifa_addr->sa_family;
+            if (family == AF_INET)
+            {
+                struct sockaddr_in *from_addr = (struct sockaddr_in*)from->ai_addr;
+                struct sockaddr_in *ifa_addr = (struct sockaddr_in*)ifa->ifa_addr;
+                if (from_addr->sin_addr.s_addr == ifa_addr->sin_addr.s_addr) {
+                    match = 1;
+                    break;
+                }
+            }
+            else if (family == AF_INET6)
+            {
+                struct sockaddr_in6 *from_addr = (struct sockaddr_in6*)from->ai_addr;
+                struct sockaddr_in6 *ifa_addr = (struct sockaddr_in6*)ifa->ifa_addr;
+                if (!memcmp(from_addr->sin6_addr.s6_addr, ifa_addr->sin6_addr.s6_addr, 16)) {
+                    match = 1;
+                    break;
+                }
+            }
+        }
+    }
+    freeifaddrs(ifaddrs_p);
+    return match;
+}
+
+
 /* Transparent proxying: bind the peer address of fd to the peer address of
  * fd_from */
 #define IP_TRANSPARENT 19
@@ -177,56 +246,28 @@ int bind_peer(int fd, int fd_from)
     /* getpeername can fail with ENOTCONN if connection was dropped before we
      * got here */
     res = getpeername(fd_from, from.ai_addr, &from.ai_addrlen);
-    CHECK_RES_RETURN(res, "getpeername");
-    
+    CHECK_RES_RETURN(res, "getpeername", res);
+
     /* if the destination is the same machine, there's no need to do bind */
-    struct ifaddrs *ifaddrs_p = NULL, *ifa;
-
-    getifaddrs(&ifaddrs_p);
-
-    for (ifa = ifaddrs_p; ifa != NULL; ifa = ifa->ifa_next)
-    {
-        if (!ifa->ifa_addr)
-            continue;
-        int match = 0;
-        if (from.ai_addr->sa_family == ifa->ifa_addr->sa_family)
-        {
-            int family = ifa->ifa_addr->sa_family;
-            if (family == AF_INET)
-            {
-                struct sockaddr_in *from_addr = (struct sockaddr_in*)from.ai_addr;
-                struct sockaddr_in *ifa_addr = (struct sockaddr_in*)ifa->ifa_addr;
-                if (from_addr->sin_addr.s_addr == ifa_addr->sin_addr.s_addr)
-                    match = 1;
-            }
-            else if (family == AF_INET6)
-            {
-                struct sockaddr_in6 *from_addr = (struct sockaddr_in6*)from.ai_addr;
-                struct sockaddr_in6 *ifa_addr = (struct sockaddr_in6*)ifa->ifa_addr;
-                if (!memcmp(from_addr->sin6_addr.s6_addr, ifa_addr->sin6_addr.s6_addr, 16))
-                    match = 1;
-            }
-        }
-        if (match)  /* the destination is the same as the source, should not create a transparent bind */
-            return 0;
-    }
-
+    if (is_same_machine(&from))
+        return 0;
+    
 #ifndef IP_BINDANY /* use IP_TRANSPARENT */
     res = setsockopt(fd, IPPROTO_IP, IP_TRANSPARENT, &trans, sizeof(trans));
-    CHECK_RES_DIE(res, "setsockopt");
+    CHECK_RES_DIE(res, "setsockopt IP_TRANSPARENT");
 #else
     if (from.ai_addr->sa_family==AF_INET) { /* IPv4 */
         res = setsockopt(fd, IPPROTO_IP, IP_BINDANY, &trans, sizeof(trans));
-        CHECK_RES_RETURN(res, "setsockopt IP_BINDANY");
+        CHECK_RES_RETURN(res, "setsockopt IP_BINDANY", res);
 #ifdef IPV6_BINDANY
     } else { /* IPv6 */
         res = setsockopt(fd, IPPROTO_IPV6, IPV6_BINDANY, &trans, sizeof(trans));
-        CHECK_RES_RETURN(res, "setsockopt IPV6_BINDANY");
+        CHECK_RES_RETURN(res, "setsockopt IPV6_BINDANY", res);
 #endif /* IPV6_BINDANY */
     }
 #endif /* IP_TRANSPARENT / IP_BINDANY */
     res = bind(fd, from.ai_addr, from.ai_addrlen);
-    CHECK_RES_RETURN(res, "bind");
+    CHECK_RES_RETURN(res, "bind", res);
 
     return 0;
 }
@@ -247,13 +288,13 @@ int connect_addr(struct connection *cnx, int fd_from)
     from.ai_addrlen = sizeof(ss);
 
     res = getpeername(fd_from, from.ai_addr, &from.ai_addrlen);
-    CHECK_RES_RETURN(res, "getpeername");
+    CHECK_RES_RETURN(res, "getpeername", res);
 
     for (a = cnx->proto->saddr; a; a = a->ai_next) {
         /* When transparent, make sure both connections use the same address family */
-        if (transparent && a->ai_family != from.ai_addr->sa_family)
+        if (cfg.transparent && a->ai_family != from.ai_addr->sa_family)
             continue;
-        if (verbose)
+        if (cfg.verbose)
             fprintf(stderr, "connecting to %s family %d len %d\n",
                     sprintaddr(buf, sizeof(buf), a),
                     a->ai_addr->sa_family, a->ai_addrlen);
@@ -262,22 +303,32 @@ int connect_addr(struct connection *cnx, int fd_from)
         fd = socket(a->ai_family, SOCK_STREAM, 0);
         if (fd == -1) {
             log_message(LOG_ERR, "forward to %s failed:socket: %s\n",
-                        cnx->proto->description, strerror(errno));
+                        cnx->proto->name, strerror(errno));
         } else {
-            if (transparent) {
+            one = 1;
+            setsockopt(fd, IPPROTO_TCP, TCP_FASTOPEN_CONNECT, &one, sizeof(one));
+            /* no need to check return value; if it's not supported, that's okay */
+
+            if (cfg.transparent) {
                 res = bind_peer(fd, fd_from);
-                CHECK_RES_RETURN(res, "bind_peer");
+                CHECK_RES_RETURN(res, "bind_peer", res);
             }
             res = connect(fd, a->ai_addr, a->ai_addrlen);
             if (res == -1) {
-                log_message(LOG_ERR, "forward to %s failed:connect: %s\n",
-                            cnx->proto->description, strerror(errno));
-                close(fd);
+                switch (errno) {
+                case EINPROGRESS: 
+                    /* Can't be done yet, or TFO already done */
+                    break;
+
+                default:
+                    log_message(LOG_ERR, "forward to %s failed:connect: %s\n",
+                                cnx->proto->name, strerror(errno));
+                    close(fd);
+                }
             } else {
                 if (cnx->proto->keepalive) {
-                    one = 1;
                     res = setsockopt(fd, SOL_SOCKET, SO_KEEPALIVE, (char*)&one, sizeof(one));
-                    CHECK_RES_RETURN(res, "setsockopt(SO_KEEPALIVE)");
+                    CHECK_RES_RETURN(res, "setsockopt(SO_KEEPALIVE)", res);
                 }
                 return fd;
             }
@@ -291,14 +342,11 @@ int defer_write(struct queue *q, void* data, int data_size)
 {
     char *p;
     ptrdiff_t data_offset = q->deferred_data - q->begin_deferred_data;
-    if (verbose)
+    if (cfg.verbose)
         fprintf(stderr, "**** writing deferred on fd %d\n", q->fd);
 
     p = realloc(q->begin_deferred_data, data_offset + q->deferred_data_size + data_size);
-    if (!p) {
-        perror("realloc");
-        exit(1);
-    }
+    CHECK_ALLOC(p, "realloc");
 
     q->begin_deferred_data = p;
     q->deferred_data = p + data_offset;
@@ -317,7 +365,7 @@ int flush_deferred(struct queue *q)
 {
     int n;
 
-    if (verbose)
+    if (cfg.verbose)
         fprintf(stderr, "flushing deferred data to fd %d\n", q->fd);
 
     n = write(q->fd, q->deferred_data, q->deferred_data_size);
@@ -345,7 +393,7 @@ void init_cnx(struct connection *cnx)
     memset(cnx, 0, sizeof(*cnx));
     cnx->q[0].fd = -1;
     cnx->q[1].fd = -1;
-    cnx->proto = get_first_protocol();
+    cnx->proto = NULL;
 }
 
 void dump_connection(struct connection *cnx)
@@ -377,7 +425,7 @@ int fd2fd(struct queue *target_q, struct queue *from_q)
    if (size_r == -1) {
        switch (errno) {
        case EAGAIN:
-           if (verbose)
+           if (cfg.verbose)
                fprintf(stderr, "reading 0 from %d\n", from);
            return FD_NODATA;
 
@@ -387,7 +435,7 @@ int fd2fd(struct queue *target_q, struct queue *from_q)
        }
    }
 
-   CHECK_RES_RETURN(size_r, "read");
+   CHECK_RES_RETURN(size_r, "read",FD_CNXCLOSED);
 
    if (size_r == 0)
       return FD_CNXCLOSED;
@@ -412,7 +460,7 @@ int fd2fd(struct queue *target_q, struct queue *from_q)
        return FD_STALLED;
    }
 
-   CHECK_RES_RETURN(size_w, "write");
+   CHECK_RES_RETURN(size_w, "write", FD_CNXCLOSED);
 
    return size_w;
 }
@@ -426,7 +474,7 @@ char* sprintaddr(char* buf, size_t size, struct addrinfo *a)
    res = getnameinfo(a->ai_addr, a->ai_addrlen,
                host, sizeof(host),
                serv, sizeof(serv),
-               numeric ? NI_NUMERICHOST | NI_NUMERICSERV : 0 );
+               cfg.numeric ? NI_NUMERICHOST | NI_NUMERICSERV : 0 );
 
    if (res) {
        log_message(LOG_ERR, "sprintaddr:getnameinfo: %s\n", gai_strerror(res));
@@ -451,30 +499,23 @@ char* sprintaddr(char* buf, size_t size, struct addrinfo *a)
 /* Turns a hostname and port (or service) into a list of struct addrinfo
  * returns 0 on success, -1 otherwise and logs error
  */
-int resolve_split_name(struct addrinfo **out, const char* ct_host, const char* serv)
+int resolve_split_name(struct addrinfo **out, char* host, char* serv)
 {
    struct addrinfo hint;
    char *end;
    int res;
-   char* host;
 
    memset(&hint, 0, sizeof(hint));
    hint.ai_family = PF_UNSPEC;
    hint.ai_socktype = SOCK_STREAM;
 
-   /* Copy parameter so not to clobber data in libconfig */
-   res = asprintf(&host, "%s", ct_host);
-   if (res == -1) {
-       log_message(LOG_ERR, "asprintf: cannot allocate memory");
-       return -1;
-   }
-
    /* If it is a RFC-Compliant IPv6 address ("[1234::12]:443"), remove brackets
     * around IP address */
    if (host[0] == '[') {
        end = strrchr(host, ']');
        if (!end) {
            fprintf(stderr, "%s: no closing bracket in IPv6 address?\n", host);
+           return -1;
        }
        host++; /* skip first bracket */
        *end = 0; /* remove last bracket */
@@ -483,7 +524,6 @@ int resolve_split_name(struct addrinfo **out, const char* ct_host, const char* s
    res = getaddrinfo(host, serv, &hint, out);
    if (res)
       log_message(LOG_ERR, "%s `%s:%s'\n", gai_strerror(res), host, serv);
-   free(host);
    return res;
 }
 
@@ -517,60 +557,97 @@ void resolve_name(struct addrinfo **out, char* fullname)
 }
 
 /* Log to syslog or stderr if foreground */
-void log_message(int type, char* msg, ...)
+void log_message(int type, const char* msg, ...)
 {
     va_list ap;
 
     va_start(ap, msg);
-    if (foreground)
+    if (cfg.foreground)
         vfprintf(stderr, msg, ap);
-    else
-        vsyslog(type, msg, ap);
     va_end(ap);
+
+    if (do_syslog) {
+        va_start(ap, msg);
+        vsyslog(type, msg, ap);
+        va_end(ap);
+    }
 }
 
-/* syslogs who connected to where */
-void log_connection(struct connection *cnx)
+
+/* Fills a connection description; returns 0 on failure */
+int get_connection_desc(struct connection_desc* desc, const struct connection *cnx)
 {
+    int res;
     struct addrinfo addr;
     struct sockaddr_storage ss;
-#define MAX_NAMELENGTH (NI_MAXHOST + NI_MAXSERV + 1)
-    char peer[MAX_NAMELENGTH], service[MAX_NAMELENGTH],
-        local[MAX_NAMELENGTH], target[MAX_NAMELENGTH];
-    int res;
-
-    if (cnx->proto->log_level < 1)
-        return;
 
     addr.ai_addr = (struct sockaddr*)&ss;
     addr.ai_addrlen = sizeof(ss);
 
     res = getpeername(cnx->q[0].fd, addr.ai_addr, &addr.ai_addrlen);
-    if (res == -1) return; /* Can happen if connection drops before we get here.
+    if (res == -1) return 0; /* Can happen if connection drops before we get here.
                                In that case, don't log anything (there is no connection) */
-    sprintaddr(peer, sizeof(peer), &addr);
+    sprintaddr(desc->peer, sizeof(desc->peer), &addr);
 
     addr.ai_addrlen = sizeof(ss);
     res = getsockname(cnx->q[0].fd, addr.ai_addr, &addr.ai_addrlen);
-    if (res == -1) return;
-    sprintaddr(service, sizeof(service), &addr);
+    if (res == -1) return 0;
+    sprintaddr(desc->service, sizeof(desc->service), &addr);
 
     addr.ai_addrlen = sizeof(ss);
     res = getpeername(cnx->q[1].fd, addr.ai_addr, &addr.ai_addrlen);
-    if (res == -1) return;
-    sprintaddr(target, sizeof(target), &addr);
+    if (res == -1) return 0;
+    sprintaddr(desc->target, sizeof(desc->target), &addr);
 
     addr.ai_addrlen = sizeof(ss);
     res = getsockname(cnx->q[1].fd, addr.ai_addr, &addr.ai_addrlen);
-    if (res == -1) return;
-    sprintaddr(local, sizeof(local), &addr);
+    if (res == -1) return 0;
+    sprintaddr(desc->local, sizeof(desc->local), &addr);
+
+    return 1;
+}
+
+/* syslogs who connected to where 
+ * desc: string description of the connection. if NULL, log_connection will
+ * manage on its own
+ * cnx: connection descriptor
+ * */
+void log_connection(struct connection_desc* desc, const struct connection *cnx)
+{
+    struct connection_desc d;
+
+    if (cnx->proto->log_level < 1)
+        return;
+
+    if (!desc) {
+        desc = &d;
+        get_connection_desc(desc, cnx);
+    }
 
     log_message(LOG_INFO, "%s:connection from %s to %s forwarded from %s to %s\n",
-                cnx->proto->description,
-                peer,
-                service,
-                local,
-                target);
+                cnx->proto->name,
+                desc->peer,
+                desc->service,
+                desc->local,
+                desc->target);
+}
+
+void set_proctitle_shovel(struct connection_desc* desc, const struct connection *cnx)
+{
+#ifdef LIBBSD
+    struct connection_desc d;
+
+    if (!desc) {
+        desc = &d;
+        get_connection_desc(desc, cnx);
+    }
+    setproctitle("shovel %s %s->%s => %s->%s",
+        cnx->proto->name,
+        desc->peer,
+        desc->service,
+        desc->local,
+        desc->target);
+#endif
 }
 
 
@@ -592,27 +669,27 @@ int check_access_rights(int in_socket, const char* service)
     int res;
 
     res = getpeername(in_socket, &peer.saddr, &size);
-    CHECK_RES_RETURN(res, "getpeername");
+    CHECK_RES_RETURN(res, "getpeername", res);
 
     /* extract peer address */
     res = getnameinfo(&peer.saddr, size, addr_str, sizeof(addr_str), NULL, 0, NI_NUMERICHOST);
     if (res) {
-        if (verbose)
+        if (cfg.verbose)
             fprintf(stderr, "getnameinfo(NI_NUMERICHOST):%s\n", gai_strerror(res));
         strcpy(addr_str, STRING_UNKNOWN);
     }
     /* extract peer name */
     strcpy(host, STRING_UNKNOWN);
-    if (!numeric) {
+    if (!cfg.numeric) {
         res = getnameinfo(&peer.saddr, size, host, sizeof(host), NULL, 0, NI_NAMEREQD);
         if (res) {
-            if (verbose)
+            if (cfg.verbose)
                 fprintf(stderr, "getnameinfo(NI_NAMEREQD):%s\n", gai_strerror(res));
         }
     }
 
     if (!hosts_ctl(service, host, addr_str, STRING_UNKNOWN)) {
-        if (verbose)
+        if (cfg.verbose)
             fprintf(stderr, "access denied\n");
         log_message(LOG_INFO, "connection from %s(%s): access denied", host, addr_str);
         close(in_socket);
@@ -655,15 +732,20 @@ void setup_syslog(const char* bin_name) {
     char *name1, *name2;
     int res, fn;
 
+    if (!strcmp(cfg.syslog_facility, "none")) {
+        do_syslog = 0;
+        return;
+    }
+
     name1 = strdup(bin_name);
     res = asprintf(&name2, "%s[%d]", basename(name1), getpid());
     CHECK_RES_DIE(res, "asprintf");
 
     for (fn = 0; facilitynames[fn].c_val != -1; fn++)
-        if (strcmp(facilitynames[fn].c_name, facility) == 0)
+        if (strcmp(facilitynames[fn].c_name, cfg.syslog_facility) == 0)
             break;
-    if (fn == -1) {
-        fprintf(stderr, "Unknown facility %s\n", facility);
+    if (facilitynames[fn].c_val == -1) {
+        fprintf(stderr, "Unknown facility %s\n", cfg.syslog_facility);
         exit(1);
     }
 
@@ -694,7 +776,7 @@ void set_capabilities(void) {
     cap_value_t cap_list[10];
     int ncap = 0;
 
-    if (transparent)
+    if (cfg.transparent)
         cap_list[ncap++] = CAP_NET_ADMIN;
 
     caps = cap_init();
@@ -736,12 +818,12 @@ void drop_privileges(const char* user_name, const char* chroot_path)
             fprintf(stderr, "%s: not found\n", user_name);
             exit(2);
         }
-        if (verbose)
+        if (cfg.verbose)
             fprintf(stderr, "turning into %s\n", user_name);
     }
 
     if (chroot_path) {
-        if (verbose)
+        if (cfg.verbose)
             fprintf(stderr, "chrooting into %s\n", chroot_path);
 
         res = chroot(chroot_path);

common.h

@@ -42,12 +42,19 @@
        exit(1);         \
     }
 
-#define CHECK_RES_RETURN(res, str) \
+#define CHECK_RES_RETURN(res, str, ret) \
     if (res == -1) {                                    \
         log_message(LOG_CRIT, "%s:%d:%s:%d:%s\n", __FILE__, __LINE__, str, errno, strerror(errno));  \
-        return res;                                     \
+        return ret;                                     \
     } 
 
+#define CHECK_ALLOC(a, str) \
+    if (!a) { \
+        fprintf(stderr, "%s:%d:", __FILE__, __LINE__); \
+        perror(str); \
+        exit(1); \
+    }
+
 #define ARRAY_SIZE(a) (sizeof(a) / sizeof(a[0]))
 
 #if 1
@@ -60,6 +67,14 @@
 #define IP_FREEBIND 0
 #endif
 
+#ifndef TCP_FASTOPEN
+#define TCP_FASTOPEN 0
+#endif
+
+#ifndef TCP_FASTOPEN_CONNECT
+#define TCP_FASTOPEN_CONNECT 30 /* Attempt FastOpen with connect.  */
+#endif
+
 enum connection_state {
     ST_PROBING=1,    /* Waiting for timeout to find where to forward */
     ST_SHOVELING   /* Connexion is established */
@@ -80,7 +95,7 @@ struct queue {
 struct connection {
     enum connection_state state;
     time_t probe_timeout;
-    struct proto *proto;
+    struct sslhcfg_protocols_item* proto;
 
     /* q[0]: queue for external connection (client);
      * q[1]: queue for internal connection (httpd or sshd);
@@ -92,6 +107,13 @@ struct connection {
 #define FD_NODATA       -1
 #define FD_STALLED      -2
 
+/* String description of a connection */
+#define MAX_NAMELENGTH (NI_MAXHOST + NI_MAXSERV + 1)
+struct connection_desc {
+    char peer[MAX_NAMELENGTH], service[MAX_NAMELENGTH],
+        local[MAX_NAMELENGTH], target[MAX_NAMELENGTH];
+};
+
 
 /* common.c */
 void init_cnx(struct connection *cnx);
@@ -99,27 +121,26 @@ int connect_addr(struct connection *cnx, int fd_from);
 int fd2fd(struct queue *target, struct queue *from);
 char* sprintaddr(char* buf, size_t size, struct addrinfo *a);
 void resolve_name(struct addrinfo **out, char* fullname);
-void log_connection(struct connection *cnx);
+int get_connection_desc(struct connection_desc* desc, const struct connection *cnx);
+void log_connection(struct connection_desc* desc, const struct connection *cnx);
+void set_proctitle_shovel(struct connection_desc* desc, const struct connection *cnx);
 int check_access_rights(int in_socket, const char* service);
 void setup_signals(void);
 void setup_syslog(const char* bin_name);
 void drop_privileges(const char* user_name, const char* chroot_path);
 void write_pid_file(const char* pidfile);
-void log_message(int type, char* msg, ...);
+void log_message(int type, const char* msg, ...);
 void dump_connection(struct connection *cnx);
-int resolve_split_name(struct addrinfo **out, const char* hostname, const char* port);
+int resolve_split_name(struct addrinfo **out, char* hostname, char* port);
 
 int start_listen_sockets(int *sockfd[], struct addrinfo *addr_list);
 
 int defer_write(struct queue *q, void* data, int data_size);
 int flush_deferred(struct queue *q);
 
-extern int probing_timeout, verbose, inetd, foreground, 
-       background, transparent, numeric;
-extern struct sockaddr_storage addr_ssl, addr_ssh, addr_openvpn;
+extern struct sslhcfg_item cfg;
 extern struct addrinfo *addr_listen;
 extern const char* USAGE_STRING;
-extern const char* user_name, *pid_file, *chroot_path, *facility;
 extern const char* server_type;
 
 /* sslh-fork.c */

doc/FAQ.md

@@ -0,0 +1,42 @@
+Frequently Asked Questions
+==========================
+
+When something doesn't work, look up here... and if it still
+doesn't work, report how what was suggested here went.
+
+It's also worth reading [how to ask
+questions](http://www.catb.org/~esr/faqs/smart-questions.html)
+before posting on the mailing list or opening an issue in
+Github.
+
+Getting more info
+=================
+
+In general, if something doesn't work, you'll want to run
+`sslh` with lots of logging, and the logging directly in
+the terminal (Otherwise, logs are sent to `syslog`, and
+usually end up in `/var/log/auth.log`). You will achieve
+this by running `sslh` in foreground with verbose:
+
+```
+sslh -v 1 -f -F myconfig.cfg
+```
+
+Higher values of `verbose` produce more information. 1 is
+usually sufficient. 2 will also print incoming packets used
+for probing.
+
+forward to [PROBE] failed:connect: Connection refused
+=====================================================
+
+Usually this means `sslh` is configured to forward a
+protocol somewhere, but no service is listening on the
+target address. Check your `sslh` configuration, check the
+corresponding server really is listening and running.
+Finally, check the server is listening where you expect it
+to:
+
+```
+netstat -lpt
+```
+

doc/INSTALL.md

@@ -0,0 +1,120 @@
+Compile and install
+===================
+
+Dependencies
+------------
+
+`sslh` uses:
+
+* [libconfig](http://www.hyperrealm.com/libconfig/). For
+  Debian this is contained in package `libconfig8-dev`. You
+can compile with or without it using USELIBCONFIG in the
+Makefile.
+
+* [libwrap](http://packages.debian.org/source/unstable/tcp-wrappers).
+    For Debian, this is contained in packages
+`libwrap0-dev`. You
+can compile with or without it using USELIBWRAP in the
+Makefile.
+
+* [libsystemd](http://packages.debian.org/source/unstable/libsystemd-dev), in package `libsystemd-dev`.  You
+can compile with or without it using USESYSTEMD in the
+Makefile.
+
+* [libcap](http://packages.debian.org/source/unstable/libcap-dev), in package `libcap-dev`. You can compile with or without it using USELIBCAP in the Makefile
+
+* libbsd, to enable to change the process name (as shown in
+  `ps`, so each forked process shows what protocol and what
+  connection it is serving),
+which requires `libbsd` at runtime, and `libbsd-dev` at
+compile-time.
+
+
+For OpenSUSE, these are contained in packages libconfig9 and
+libconfig-dev in repository
+<http://download.opensuse.org/repositories/multimedia:/libs/openSUSE_12.1/>
+
+For Fedora, you'll need packages `libconfig` and
+`libconfig-devel`:
+
+	yum install libconfig libconfig-devel
+
+If you want to rebuild `sslh-conf.c` (after a `make
+distclean` for example), you will also need to add
+[conf2struct](https://www.rutschle.net/tech/conf2struct/README.html)
+(v1.1) to your path.
+
+Compilation
+-----------
+
+After this, the Makefile should work:
+
+	make install
+
+There are a couple of configuration options at the beginning
+of the Makefile: 
+
+* `USELIBWRAP` compiles support for host access control (see
+  `hosts_access(3)`), you will need `libwrap` headers and
+  library to compile (`libwrap0-dev` in Debian).
+
+* `USELIBCONFIG` compiles support for the configuration
+  file. You will need `libconfig` headers to compile
+  (`libconfig8-dev` in Debian).
+
+*  `USESYSTEMD` compiles support for using systemd socket activation.
+   You will need `systemd` headers to compile (`systemd-devel` in Fedora).
+
+* `USELIBBSD` compiles support for updating the process name (as shown
+  by `ps`).
+
+Binaries
+--------
+
+The Makefile produces two different executables: `sslh-fork`
+and `sslh-select`:
+
+* `sslh-fork` forks a new process for each incoming connection.
+It is well-tested and very reliable, but incurs the overhead
+of many processes.  
+If you are going to use `sslh` for a "small" setup (less than
+a dozen ssh connections and a low-traffic https server) then
+`sslh-fork` is probably more suited for you. 
+
+* `sslh-select` uses only one thread, which monitors all connections
+at once. It is more recent and less tested, but only incurs a 16
+byte overhead per connection. Also, if it stops, you'll lose all
+connections, which means you can't upgrade it remotely.  
+If you are going to use `sslh` on a "medium" setup (a few thousand ssh
+connections, and another few thousand ssl connections),
+`sslh-select` will be better.
+
+If you have a very large site (tens of thousands of connections),
+you'll need a vapourware version that would use libevent or
+something like that.
+
+
+Installation
+------------
+
+* In general:
+
+		make
+		cp sslh-fork /usr/local/sbin/sslh
+		cp basic.cfg /etc/sslh.cfg
+                vi /etc/sslh.cfg
+
+* For Debian:
+
+		cp scripts/etc.init.d.sslh /etc/init.d/sslh
+	
+* For CentOS:
+
+		cp scripts/etc.rc.d.init.d.sslh.centos /etc/rc.d/init.d/sslh
+
+
+You might need to create links in /etc/rc<x>.d so that the server
+start automatically at boot-up, e.g. under Debian:
+
+	update-rc.d sslh defaults
+

doc/config.md

@@ -0,0 +1,337 @@
+Configuration
+=============
+
+If you use the scripts provided, sslh will get its
+configuration from /etc/sslh.cfg. Please refer to
+example.cfg for an overview of all the settings.
+
+A good scheme is to use the external name of the machine in
+`listen`, and bind `httpd` to `localhost:443` (instead of all
+binding to all interfaces): that way, HTTPS connections
+coming from inside your network don't need to go through
+`sslh`, and `sslh` is only there as a frontal for connections
+coming from the internet.
+
+Note that 'external name' in this context refers to the
+actual IP address of the machine as seen from your network,
+i.e. that that is not `127.0.0.1` in the output of
+`ifconfig(8)`.
+
+Libwrap support
+---------------
+
+Sslh can optionally perform `libwrap` checks for the sshd
+service: because the connection to `sshd` will be coming
+locally from `sslh`, `sshd` cannot determine the IP of the
+client.
+
+OpenVPN support
+---------------
+
+OpenVPN clients connecting to OpenVPN running with
+`-port-share` reportedly take more than one second between
+the time the TCP connection is established and the time they
+send the first data packet. This results in `sslh` with
+default settings timing out and assuming an SSH connection.
+To support OpenVPN connections reliably, it is necessary to
+increase `sslh`'s timeout to 5 seconds.
+
+Instead of using OpenVPN's port sharing, it is more reliable
+to use `sslh`'s `--openvpn` option to get `sslh` to do the
+port sharing.
+
+Using proxytunnel with sslh
+---------------------------
+
+If you are connecting through a proxy that checks that the
+outgoing connection really is SSL and rejects SSH, you can
+encapsulate all your traffic in SSL using `proxytunnel` (this
+should work with `corkscrew` as well). On the server side you
+receive the traffic with `stunnel` to decapsulate SSL, then
+pipe through `sslh` to switch HTTP on one side and SSL on the
+other.
+
+In that case, you end up with something like this:
+
+	ssh -> proxytunnel -e ----[ssh/ssl]---> stunnel ---[ssh]---> sslh --> sshd
+	Web browser -------------[http/ssl]---> stunnel ---[http]--> sslh --> httpd
+
+Configuration goes like this on the server side, using `stunnel3`:
+
+	stunnel -f -p mycert.pem  -d thelonious:443 -l /usr/local/sbin/sslh -- \
+		sslh -i  --http localhost:80 --ssh localhost:22
+
+* stunnel options:
+  * `-f` for foreground/debugging
+  * `-p` for specifying the key and certificate
+  * `-d` for specifying which interface and port
+	we're listening to for incoming connexions
+  * `-l` summons `sslh` in inetd mode.
+
+* sslh options:
+  * `-i` for inetd mode
+  * `--http` to forward HTTP connexions to port 80,
+	and SSH connexions to port 22.
+
+Capabilities support
+--------------------
+
+On Linux (only?), you can compile sslh with `USELIBCAP=1` to
+make use of POSIX capabilities; this will save the required
+capabilities needed for transparent proxying for unprivileged
+processes.
+
+Alternatively, you may use filesystem capabilities instead
+of starting sslh as root and asking it to drop privileges.
+You will need `CAP_NET_BIND_SERVICE` for listening on port 443
+and `CAP_NET_ADMIN` for transparent proxying (see
+`capabilities(7)`).
+
+You can use the `setcap(8)` utility to give these capabilities
+to the executable:
+
+	sudo setcap cap_net_bind_service,cap_net_admin+pe sslh-select
+
+Then you can run sslh-select as an unpriviledged user, e.g.:
+
+	sslh-select -p myname:443 --ssh localhost:22 --ssl localhost:443
+
+Caveat: `CAP_NET_ADMIN` does give sslh too many rights, e.g.
+configuring the interface. If you're not going to use
+transparent proxying, just don't use it (or use the libcap method).
+
+Transparent proxy support
+-------------------------
+
+On Linux and FreeBSD you can use the `--transparent` option to
+request transparent proxying. This means services behind `sslh`
+(Apache, `sshd` and so on) will see the external IP and ports
+as if the external world connected directly to them. This
+simplifies IP-based access control (or makes it possible at
+all).
+
+You can refer to Sean Warn'ѕ [tutorial](tproxy.md) for a
+different set-up which enables transparent proxying between
+two different machines. The following may only work if
+`sslh` and the final servers are on the same machine.
+
+Note that getting this to work is very tricky and
+detail-dependant: depending on whether the target server and
+sslh are on the same machine, different machines, or
+different dockers, and tool versions, all seem to change the
+required network configuration somewhat. If it doesn't work,
+it's almost certain that the problem is not linked to `sslh`
+but to the network setup that surrounds it.
+
+Linux:
+
+`sslh` needs extended rights to perform this: you'll need to
+give it `CAP_NET_ADMIN` capabilities (see appropriate chapter)
+or run it as root (but don't do that).
+
+The firewalling tables also need to be adjusted as follows.
+I don't think it is possible to have `httpd` and `sslh` both listen to 443 in
+this scheme -- let me know if you manage that:
+
+	# Set route_localnet = 1 on all interfaces so that ssl can use "localhost" as destination
+	sysctl -w net.ipv4.conf.default.route_localnet=1
+	sysctl -w net.ipv4.conf.all.route_localnet=1
+
+	# DROP martian packets as they would have been if route_localnet was zero
+	# Note: packets not leaving the server aren't affected by this, thus sslh will still work
+	iptables -t raw -A PREROUTING ! -i lo -d 127.0.0.0/8 -j DROP
+	iptables -t mangle -A POSTROUTING ! -o lo -s 127.0.0.0/8 -j DROP
+
+	# Mark all connections made by ssl for special treatment (here sslh is run as user "sslh")
+	iptables -t nat -A OUTPUT -m owner --uid-owner sslh -p tcp --tcp-flags FIN,SYN,RST,ACK SYN -j CONNMARK --set-xmark 0x01/0x0f
+
+	# Outgoing packets that should go to sslh instead have to be rerouted, so mark them accordingly (copying over the connection mark)
+	iptables -t mangle -A OUTPUT ! -o lo -p tcp -m connmark --mark 0x01/0x0f -j CONNMARK --restore-mark --mask 0x0f
+
+	# Configure routing for those marked packets
+	ip rule add fwmark 0x1 lookup 100
+	ip route add local 0.0.0.0/0 dev lo table 100
+
+Tranparent proxying with IPv6 is similarly set up as follows:
+
+	# Set route_localnet = 1 on all interfaces so that ssl can use "localhost" as destination
+	# Not sure if this is needed for ipv6 though
+	sysctl -w net.ipv4.conf.default.route_localnet=1
+	sysctl -w net.ipv4.conf.all.route_localnet=1
+
+	# DROP martian packets as they would have been if route_localnet was zero
+	# Note: packets not leaving the server aren't affected by this, thus sslh will still work
+	ip6tables -t raw -A PREROUTING ! -i lo -d ::1/128 -j DROP
+	ip6tables -t mangle -A POSTROUTING ! -o lo -s ::1/128 -j DROP
+
+	# Mark all connections made by ssl for special treatment (here sslh is run as user "sslh")
+	ip6tables -t nat -A OUTPUT -m owner --uid-owner sslh -p tcp --tcp-flags FIN,SYN,RST,ACK SYN -j CONNMARK --set-xmark 0x01/0x0f
+
+	# Outgoing packets that should go to sslh instead have to be rerouted, so mark them accordingly (copying over the connection mark)
+	ip6tables -t mangle -A OUTPUT ! -o lo -p tcp -m connmark --mark 0x01/0x0f -j CONNMARK --restore-mark --mask 0x0f
+
+	# Configure routing for those marked packets
+	ip -6 rule add fwmark 0x1 lookup 100
+	ip -6 route add local ::/0 dev lo table 100
+
+Explanation:
+To be able to use `localhost` as destination in your sslh config along with transparent proxying
+you have to allow routing of loopback addresses as done above.
+This is something you usually should not do (see [this stackoverflow post](https://serverfault.com/questions/656279/how-to-force-linux-to-accept-packet-with-loopback-ip/656484#656484))
+The two `DROP` iptables rules emulate the behaviour of `route_localnet` set to off (with one small difference:
+allowing the reroute-check to happen after the fwmark is set on packets destined for sslh).
+See [this diagram](https://upload.wikimedia.org/wikipedia/commons/3/37/Netfilter-packet-flow.svg) for a good visualisation
+showing how packets will traverse the iptables chains.
+
+Note:
+You have to run `sslh` as dedicated user (in this example the user is also named `sslh`), to not mess up with your normal networking.
+These rules will allow you to connect directly to ssh on port
+22 (or to any other service behind sslh) as well as through sslh on port 443.
+
+Also remember that iptables configuration and ip routes and 
+rules won't be necessarily persisted after you reboot. Make 
+sure to save them properly. For example in CentOS7, you would 
+do `iptables-save > /etc/sysconfig/iptables`, and add both 
+`ip` commands to your `/etc/rc.local`.
+
+FreeBSD:
+
+Given you have no firewall defined yet, you can use the following configuration
+to have ipfw properly redirect traffic back to sslh
+
+	/etc/rc.conf
+	firewall_enable="YES"
+	firewall_type="open"
+	firewall_logif="YES"
+	firewall_coscripts="/etc/ipfw/sslh.rules"
+
+
+/etc/ipfw/sslh.rules
+
+	#! /bin/sh
+
+	# ssl
+	ipfw add 20000 fwd 192.0.2.1,443 log tcp from 192.0.2.1 8443 to any out
+	ipfw add 20010 fwd 2001:db8::1,443 log tcp from 2001:db8::1 8443 to any out
+
+	# ssh
+	ipfw add 20100 fwd 192.0.2.1,443 log tcp from 192.0.2.1 8022 to any out
+	ipfw add 20110 fwd 2001:db8::1,443 log tcp from 2001:db8::1 8022 to any out
+
+	# xmpp
+	ipfw add 20200 fwd 192.0.2.1,443 log tcp from 192.0.2.1 5222 to any out
+	ipfw add 20210 fwd 2001:db8::1,443 log tcp from 2001:db8::1 5222 to any out
+
+	# openvpn (running on other internal system)
+	ipfw add 20300 fwd 192.0.2.1,443 log tcp from 198.51.100.7 1194 to any out
+	ipfw add 20310 fwd 2001:db8::1,443 log tcp from 2001:db8:1::7 1194 to any out
+
+General notes:
+
+
+This will only work if `sslh` does not use any loopback
+addresses (no `127.0.0.1` or `localhost`), you'll need to use
+explicit IP addresses (or names):
+
+	sslh --listen 192.168.0.1:443 --ssh 192.168.0.1:22 --ssl 192.168.0.1:4443
+
+This will not work:
+
+	sslh --listen 192.168.0.1:443 --ssh 127.0.0.1:22 --ssl 127.0.0.1:4443
+    
+Transparent proxying means the target server sees the real
+origin address, so it means if the client connects using
+IPv6, the server must also support IPv6. It is easy to
+support both IPv4 and IPv6 by configuring the server
+accordingly, and setting `sslh` to connect to a name that
+resolves to both IPv4 and IPv6, e.g.:
+
+        sslh --transparent --listen <extaddr>:443 --ssh insideaddr:22
+
+        /etc/hosts:
+        192.168.0.1  insideaddr
+        201::::2     insideaddr
+
+Upon incoming IPv6 connection, `sslh` will first try to
+connect to the IPv4 address (which will fail), then connect
+to the IPv6 address.
+
+Systemd Socket Activation
+-------------------------
+If compiled with `USESYSTEMD` then it is possible to activate 
+the service on demand and avoid running any code as root.
+
+In this mode any listen configuration options are ignored and 
+the sockets are passed by systemd to the service.
+
+Example socket unit:
+
+	[Unit]
+	Before=sslh.service
+	
+	[Socket]
+	ListenStream=1.2.3.4:443
+	ListenStream=5.6.7.8:444
+	ListenStream=9.10.11.12:445
+	FreeBind=true
+
+	[Install]
+	WantedBy=sockets.target
+
+Example service unit:
+
+	[Unit]
+	PartOf=sslh.socket
+	
+	[Service]
+	ExecStart=/usr/sbin/sslh -v -f --ssh 127.0.0.1:22 --ssl 127.0.0.1:443
+	KillMode=process
+	CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_NET_ADMIN CAP_SETGID CAP_SETUID
+	PrivateTmp=true
+	PrivateDevices=true
+	ProtectSystem=full
+	ProtectHome=true
+	User=sslh
+
+
+With this setup only the socket needs to be enabled. The sslh service 
+will be started on demand and does not need to run as root to bind the 
+sockets as systemd has already bound and passed them over. If the sslh
+service is started on its own without the sockets being passed by systemd
+then it will look to use those defined on the command line or config
+file as usual. Any number of ListenStreams can be defined in the socket
+file and systemd will pass them all over to sslh to use as usual.
+
+To avoid inconsistency between starting via socket and starting directly
+via the service Requires=sslh.socket can be added to the service unit to
+mandate the use of the socket configuration.
+
+Rather than overwriting the entire socket file drop in values can be placed
+in /etc/systemd/system/sslh.socket.d/<name>.conf with additional ListenStream
+values that will be merged.
+
+In addition to the above with manual .socket file configuration there is an
+optional systemd generator which can be compiled - systemd-sslh-generator 
+
+This parses the /etc/sslh.cfg (or /etc/sslh/sslh.cfg file if that exists 
+instead) configuration file and dynamically generates a socket file to use.
+
+This will also merge with any sslh.socket.d drop in configuration but will be 
+overriden by a /etc/systemd/system/sslh.socket file.
+
+To use the generator place it in /usr/lib/systemd/system-generators and then
+call systemctl daemon-reload after any changes to /etc/sslh.cfg to generate 
+the new dynamic socket unit.
+
+Fail2ban
+--------
+
+If using transparent proxying, just use the standard ssh
+rules. If you can't or don't want to use transparent
+proxying, you can set `fail2ban` rules to block repeated ssh
+connections from an IP address (obviously this depends
+on the site, there might be legitimate reasons you would get
+many connections to ssh from the same IP address...)
+
+See example files in scripts/fail2ban.
+

doc/tproxy.md

@@ -0,0 +1,272 @@
+Transparent Proxy to Two Hosts
+==============================
+
+Tutorial by Sean Warner.  19 June 2019 20:35
+
+Aim
+---
+
+* Show that `sslh` can transparently proxy requests from the internet to services on two separate hosts that are both on the same LAN.
+* The IP address of the client initiating the request is what the destination should see… and not the IP address of the host that `sslh` is running on, which is what happens when `sslh` is not running in transparent mode.
+* The solution here only works for my very specific use-case but hopefully others can adapt it to suits their needs.
+
+Overview of my Network
+----------------------
+
+Two Raspberry Pis on my home LAN:
+* Pi A: 192.168.1.124 – `sslh` (Port 4433), Apache2 web server for https (port 443), `stunnel` (port 4480) to decrypt ssh traffic and forward to SSH server (also on Pi A at Port 1022)
+* Pi B: 192.168.1.123 - HTTP server (port 8000), SSH server (port 1022 on PiB).
+* I send traffic from the internet to my router's external port 443 then use a port forward rule in my router to map that to internal port 4433 where sslh is listening.
+
+![Architecture](tproxy.svg)
+
+`sslh` build
+------------
+ 
+`sslh` Version: sslh v1.19c-2-gf451cc8-dirty.
+
+I compiled sslh from sources giving the binary pretty much all possible options such as Posix capabilities and systemd support.. here are the first few lines of the makefile:
+ 
+```
+# Configuration
+ 
+VERSION=$(shell ./genver.sh -r)
+ENABLE_REGEX=1         # Enable regex probes
+USELIBCONFIG=1         # Use libconfig? (necessary to use configuration files)
+USELIBPCRE=1           # Use libpcre? (needed for regex on musl)
+USELIBWRAP=1           # Use libwrap?
+USELIBCAP=1            # Use libcap?
+USESYSTEMD=1           # Make use of systemd socket activation
+COV_TEST=              # Perform test coverage?
+PREFIX=/usr/local
+BINDIR=$(PREFIX)/sbin
+MANDIR=$(PREFIX)/share/man/man8
+MAN=sslh.8.gz          # man page name
+ 
+# End of configuration -- the rest should take care of
+# itself
+```
+ 
+systemd setup
+-------------
+
+Create an sslh systemd service file...
+```
+# nano /lib/systemd/system/sslh.service
+```
+ 
+Paste in this contents…
+ 
+```
+[Unit]
+Description=SSL/SSH multiplexer
+After=network.target
+Documentation=man:sslh(8)
+ 
+[Service]
+#EnvironmentFile=/etc/default/sslh
+#ExecStart=/usr/local/sbin/sslh $DAEMON_OPTS
+ExecStart=/usr/local/sbin/sslh -F /etc/sslh/sslh.cfg
+KillMode=process
+ 
+[Install]
+WantedBy=multi-user.target
+```
+ 
+Save it and then…
+```
+# systemctl daemon-reload
+```
+ 
+Start it again to test…
+```
+# systemctl start sslh
+```
+ 
+Configure `sslh`
+----------------
+
+First stop `sslh` then open the config file and replace with below, save and start `sslh` again
+```
+# systemctl stop sslh
+# nano /etc/sslh/sslh.cfg
+# systemctl start sslh
+```
+ 
+```
+verbose: true;
+foreground: true;
+inetd: false;
+numeric: true;
+transparent: true;
+timeout: 2;
+user: "sslh";
+pidfile: "/var/run/sslh.pid";
+chroot: "/var/empty";
+ 
+# You must have a port forward rule in the router: external port 443 <-> internal port 4433
+# Local ip address of PiA is: 192.168.1.124, sslh and stunnel4 are running on this Pi
+# Local ip address of PiB is: 192.168.1.123, http server and ssh server on this Pi
+listen:
+(
+{ host: "192.168.1.124"; port: "4433"; }
+);
+ 
+# sslh demultiplexes based on the Protocol and Hostname
+protocols:
+(
+{ name: "tls"; sni_hostnames: [ "www.example.com" ]; host: "192.168.1.124"; port: "443"; log_level: 1; },
+# This probe is for tls encrypted ssh. SSLH forwards it to stunnel on port 4480 which decrypts it and sends it to the ssh server on PiA port 1022
+{ name: "tls"; sni_hostnames: [ "ssh.example.com" ]; host: "192.168.1.124"; port: "4480"; log_level: 1; },
+{ name: "http"; host: "192.168.1.123"; port: "8000"; log_level: 1; },
+{ name: "ssh"; host: "192.168.1.123"; port: "1022"; log_level: 1; }
+);
+```
+ 
+Configure `stunnel`
+-------------------
+
+First stop `stunnel` then open the config file and replace with below, save and start `stunnel` again
+```
+# systemctl stop stunnel4
+# nano /etc/stunnel/stunnel.conf
+# systemctl start stunnel4
+```
+ 
+```
+# Debugging stuff (may be useful for troubleshooting)
+foreground = yes
+#debug = 5 # this is the default
+debug = 7
+output = /var/log/stunnel4/stunnel.log
+pid = /var/run/stunnel4/stunnel.pid
+fips = no
+ 
+cert = /etc/letsencrypt/live/example.com/fullchain.pem
+key = /etc/letsencrypt/live/example.com/privkey.pem
+ 
+[ssh]
+accept = 192.168.1.124:4480
+connect = 192.168.1.124:1022
+TIMEOUTclose  = 0
+```
+ 
+Configure iptables for Pi A
+--------------------------
+
+The `_add.sh` script creates the rules, the `_rm.sh` script removes the rules.
+They will be lost if you reboot but there are ways to make them load again on start-up..
+```
+# nano /usr/local/sbin/piA_tproxy_add.sh
+```
+``` piA_tproxy_add.sh
+iptables -t mangle -N SSLH
+iptables -t mangle -A PREROUTING -p tcp -m socket --transparent -j SSLH
+iptables -t mangle -A OUTPUT --protocol tcp --out-interface eth0 -m multiport --sport 443,4480 --jump SSLH
+iptables -t mangle -A SSLH --jump MARK --set-mark 0x1
+iptables -t mangle -A SSLH --jump ACCEPT
+ip rule add fwmark 0x1 lookup 100
+ip route add local 0.0.0.0/0 dev lo table 100
+```
+ 
+```
+# nano /usr/local/sbin/piA_tproxy_rm.sh
+```
+``` piA_tproxy_rm.sh
+iptables -t mangle -D PREROUTING -p tcp -m socket --transparent -j SSLH
+iptables -t mangle -D OUTPUT --protocol tcp --out-interface eth0 -m multiport --sport 443,4480 --jump SSLH
+iptables -t mangle -D SSLH --jump MARK --set-mark 0x1
+iptables -t mangle -D SSLH --jump ACCEPT
+iptables -t mangle -X SSLH
+ip rule del fwmark 0x1 lookup 100
+ip route del local 0.0.0.0/0 dev lo table 100
+```
+ 
+Make them executable..
+```
+# chmod +rx piA_tproxy_add.sh
+# chmod +rx piA_tproxy_rm.sh
+```
+ 
+Now run the "add" script on Pi A!
+```
+# piA_tproxy_add.sh
+# piA_tproxy_rm.sh
+```
+ 
+Configure iptables for Pi B
+--------------------------
+
+```
+# nano /usr/local/sbin/piB_tproxy_add.sh
+```
+``` piB_tproxy_add.sh
+iptables -t mangle -N SSLHSSL
+iptables -t mangle -A OUTPUT -o eth0 -p tcp -m multiport --sport 1022,8000 -j SSLHSSL
+iptables -t mangle -A SSLHSSL --jump MARK --set-mark 0x1
+iptables -t mangle -A SSLHSSL --jump ACCEPT
+ip rule add fwmark 0x1 lookup 100
+ip route add default via 192.168.1.124 table 100
+ip route flush cache
+```
+ 
+```
+# nano /usr/local/sbin/piB_tproxy_rm.sh
+```
+```
+iptables -t mangle -D OUTPUT -o eth0 -p tcp -m multiport --sport 1022,8000 -j SSLHSSL
+iptables -t mangle -D SSLHSSL --jump MARK --set-mark 0x1
+iptables -t mangle -D SSLHSSL --jump ACCEPT
+iptables -t mangle -X SSLHSSL
+ip rule del fwmark 0x1 lookup 100
+ip route del default via 192.168.1.124 table 100
+ip route flush cache
+```
+ 
+Make them executable..
+```
+# chmod +rx piB_tproxy_add.sh
+# chmod +rx piB_tproxy_rm.sh
+```
+ 
+Now run the "add" script on Pi B!
+```
+# piB_tproxy_add.sh
+# piB_tproxy_rm.sh
+```
+ 
+Testing
+-------
+* Getting to sshd on PiA
+
+I did this test using 4G from my phone (outside the LAN)
+
+To simulate this I use `proxytunnel`. External port 443 is forwarded by my router to 4433. I need to arrive at `sslh` (port 4433) with ssh encrypted as TLS (hence I use the -e switch) and the `sni_hostname` set to ssh.example.com so that `sslh` will demultiplex to `stunnel` (port 4480) which will decrypt and forward to ssh server on PiA… see `sslh.cfg` and `stunnel.conf`.
+
+The first IP:port is just a free HTTPS proxy I found on https://free-proxy-list.net
+I execute this command from a terminal window..
+ 
+```
+# proxytunnel -v -e -C root.pem -p 78.141.192.198:8080 -d ssh.example.com:443
+```
+* Getting to sshd on PiB
+
+I did this test using 4G from my phone (outside the LAN)
+
+My smartphone telecom provider blocks ssh over port 443 so I need to use `proxytunnel` to encrypt.
+
+Use the Proxytunnel `-X` switch to encrypt from local proxy to destination only so by the time we get to the destination it is unencrypted and `sslh` will see the ssh protocol and demultiplex to PiB as per `sslh.cfg`.
+ 
+```
+# proxytunnel -v -X -C root.pem -p 78.141.192.198:8080 -d ssh.example.com:443
+```
+
+Now when you test it all look at the output in daemon.log like this:
+```
+# grep -i 'ssl' /var/log/daemon.log
+```
+You should see that the IP address and port from the “connection from” and “forwarded from” fields are the same.
+
+Special thanks and appreciation to Michael Yelsukov without whom I would never have got this working.
+
+Any feedback or corrections very welcome!

doc/tproxy.svg

@@ -0,0 +1,635 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!-- Created with Inkscape (http://www.inkscape.org/) -->
+
+<svg
+   xmlns:osb="http://www.openswatchbook.org/uri/2009/osb"
+   xmlns:dc="http://purl.org/dc/elements/1.1/"
+   xmlns:cc="http://creativecommons.org/ns#"
+   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+   xmlns:svg="http://www.w3.org/2000/svg"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+   width="297mm"
+   height="210mm"
+   viewBox="0 0 297 210"
+   version="1.1"
+   id="svg288"
+   inkscape:version="0.92.4 (5da689c313, 2019-01-14)"
+   sodipodi:docname="Transparent Proxy to Two Hosts-new.svg">
+  <defs
+     id="defs282">
+    <linearGradient
+       id="linearGradient4840"
+       osb:paint="solid">
+      <stop
+         style="stop-color:#000000;stop-opacity:1;"
+         offset="0"
+         id="stop4838" />
+    </linearGradient>
+    <linearGradient
+       id="linearGradient4802"
+       osb:paint="solid">
+      <stop
+         style="stop-color:#000000;stop-opacity:1;"
+         offset="0"
+         id="stop4800" />
+    </linearGradient>
+  </defs>
+  <sodipodi:namedview
+     id="base"
+     pagecolor="#ffffff"
+     bordercolor="#666666"
+     borderopacity="1.0"
+     inkscape:pageopacity="0.0"
+     inkscape:pageshadow="2"
+     inkscape:zoom="1.01"
+     inkscape:cx="511.12411"
+     inkscape:cy="388.13656"
+     inkscape:document-units="mm"
+     inkscape:current-layer="layer1"
+     showgrid="false"
+     inkscape:snap-page="true"
+     inkscape:window-width="1920"
+     inkscape:window-height="1005"
+     inkscape:window-x="-9"
+     inkscape:window-y="-9"
+     inkscape:window-maximized="1"
+     showguides="false" />
+  <metadata
+     id="metadata285">
+    <rdf:RDF>
+      <cc:Work
+         rdf:about="">
+        <dc:format>image/svg+xml</dc:format>
+        <dc:type
+           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
+        <dc:title />
+      </cc:Work>
+    </rdf:RDF>
+  </metadata>
+  <g
+     inkscape:label="Layer 1"
+     inkscape:groupmode="layer"
+     id="layer1"
+     transform="translate(0,-87)">
+    <rect
+       style="fill:#000000;fill-opacity:0;stroke:#fa9600;stroke-width:0.68479234;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+       id="rect4977-0"
+       width="37.333149"
+       height="17.888765"
+       x="234.24397"
+       y="232.81883" />
+    <ellipse
+       id="path290"
+       cx="38.405174"
+       cy="133.55173"
+       rx="21.853449"
+       ry="28.965515"
+       style="stroke-width:0.26458332;fill-opacity:1;fill:none" />
+    <ellipse
+       style="fill:none;stroke-width:0.26458332"
+       id="path4806"
+       cx="44.482758"
+       cy="135.49138"
+       rx="28.965515"
+       ry="27.025862" />
+    <ellipse
+       style="fill:none;stroke-width:0.26458332"
+       id="path4808"
+       cx="124.26724"
+       cy="151.26724"
+       rx="29.612068"
+       ry="24.698277" />
+    <ellipse
+       style="fill:none;fill-opacity:1;stroke:#000000;stroke-width:0.76499999;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+       id="path4812"
+       ry="30.796005"
+       rx="24.16864"
+       cy="140.54999"
+       cx="43.31974" />
+    <rect
+       style="fill:#000000;fill-opacity:0;stroke:#000000;stroke-width:0.59869254;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+       id="rect4852"
+       width="27.302826"
+       height="13.554869"
+       x="29.797318"
+       y="133.28833" />
+    <text
+       xml:space="preserve"
+       style="font-style:normal;font-weight:normal;font-size:6.6431241px;line-height:1.25;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;fill:#000000;fill-opacity:1;stroke:none;stroke-width:0.31139645"
+       x="38.145908"
+       y="130.0871"
+       id="text138"
+       transform="scale(0.9172844,1.0901744)"><tspan
+         sodipodi:role="line"
+         x="38.145908"
+         y="130.0871"
+         id="tspan136"
+         style="stroke-width:0.31139645"><tspan
+           x="38.145908"
+           y="130.0871"
+           style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:4.93888903px;font-family:'Courier New';-inkscape-font-specification:'Courier New';stroke-width:0.31139645"
+           id="tspan134">Client</tspan></tspan></text>
+    <rect
+       style="fill:#000000;fill-opacity:0;stroke:#000000;stroke-width:0.66499996;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+       id="rect4862"
+       width="20.232847"
+       height="37.612331"
+       x="101.42361"
+       y="121.64869" />
+    <rect
+       style="fill:#000000;fill-opacity:0;stroke:#000000;stroke-width:0.67072004;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+       id="rect4864"
+       width="121.91585"
+       height="91.301468"
+       x="156.41544"
+       y="116.72592" />
+    <rect
+       style="fill:#000000;fill-opacity:0;stroke:#000000;stroke-width:0.66499996;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+       id="rect4866"
+       width="122.95342"
+       height="37.871742"
+       x="155.89668"
+       y="223.04117" />
+    <rect
+       style="fill:#000000;fill-opacity:0;stroke:#f40000;stroke-width:0.701;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+       id="rect4868"
+       width="82.747147"
+       height="23.645355"
+       x="175.0919"
+       y="128.09322" />
+    <rect
+       style="fill:#000000;fill-opacity:0;stroke:#009600;stroke-width:0.66499996;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+       id="rect4870-7"
+       width="26.977121"
+       height="14.785542"
+       x="220.4861"
+       y="185.84906" />
+    <rect
+       style="fill:#000000;fill-opacity:0;stroke:#009600;stroke-width:0.66499996;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+       id="rect4870-7-1"
+       width="26.977123"
+       height="14.785542"
+       x="184.17078"
+       y="185.84906" />
+    <rect
+       style="fill:#000000;fill-opacity:0;stroke:#009600;stroke-width:0.66499996;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"
+       id="rect4919"
+       width="27.495911"
+       height="11.413391"
+       x="219.96732"
+       y="164.44894" />
+    <rect
+       style="fill:none;fill-opacity:0;stroke:#800080;stroke-width:0.85740757;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:0.96517412"
+       id="rect4921"
+       width="139.8217"
+       height="161.06387"
+       x="148.11099"
+       y="108.15634" />
+    <path
+       style="fill:#000000;stroke:#c98f26;stroke-width:0.665;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:0.88627452;stroke-miterlimit:4;stroke-dasharray:none;fill-opacity:0"
+       d="m 57.326389,140.58456 c 43.837821,-0.25939 44.097221,-0.25939 44.097221,-0.25939"
+       id="path4925"
+       inkscape:connector-curvature="0" />
+    <path
+       style="fill:#000000;fill-opacity:0;stroke:#c98f26;stroke-width:0.665;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:0.88627451"
+       d="m 122.01937,140.18462 c 53.1252,-0.25845 53.43955,-0.25845 53.43955,-0.25845"
+       id="path4925-7"
+       inkscape:connector-curvature="0" />
+    <path
+       style="fill:#000000;fill-opacity:0;stroke:#c98f26;stroke-width:0.58399999;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:1.75200005, 0.58400002;stroke-dashoffset:0;stroke-opacity:0.88627451"
+       d="m 101.35344,140.71552 c 19.77892,-0.26191 19.89596,-0.26191 19.89596,-0.26191"
+       id="path4925-4"
+       inkscape:connector-curvature="0" />
+    <path
+       style="fill:none;stroke:#009600;stroke-width:0.665;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;stroke-miterlimit:4;stroke-dasharray:none"
+       d="m 198.1781,185.71937 c -0.25939,-33.9808 -0.25939,-33.9808 -0.25939,-33.9808"
+       id="path4971"
+       inkscape:connector-curvature="0" />
+    <path
+       style="fill:none;stroke:#009600;stroke-width:0.665;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;stroke-miterlimit:4;stroke-dasharray:none"
+       d="m 233.45588,164.18955 c 0,-12.45098 0,-12.45098 0,-12.45098"
+       id="path4973"
+       inkscape:connector-curvature="0" />
+    <path
+       style="fill:none;stroke:#009600;stroke-width:0.665;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;stroke-miterlimit:4;stroke-dasharray:none"
+       d="m 233.19648,185.45997 c 0,-9.59763 0,-9.59763 0,-9.59763"
+       id="path4975"
+       inkscape:connector-curvature="0" />
+    <rect
+       style="fill:none;fill-opacity:0;stroke:#fa9600;stroke-width:0.665;stroke-miterlimit:4;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
+       id="rect4977"
+       width="37.35294"
+       height="16.860703"
+       x="161.2299"
+       y="233.1991" />
+    <path
+       style="fill:none;stroke:#fa9600;stroke-width:0.665;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:0.60784316;stroke-miterlimit:4;stroke-dasharray:none"
+       d="m 178.79609,151.73857 c 0.25941,81.45016 0.25941,81.45016 0.25941,81.45016"
+       id="path4994"
+       inkscape:connector-curvature="0" />
+    <path
+       style="fill:none;stroke:#fa9600;stroke-width:0.66078299;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:0.60784316"
+       d="m 253.45564,151.97084 c 0.25959,80.36694 0.25959,80.36694 0.25959,80.36694"
+       id="path4994-0"
+       inkscape:connector-curvature="0" />
+    <text
+       xml:space="preserve"
+       style="font-style:normal;font-weight:normal;font-size:10.58333302px;line-height:1.25;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;fill:#000000;fill-opacity:1;stroke:none;stroke-width:0.26458332"
+       x="32.424427"
+       y="103.23161"
+       id="text5013"><tspan
+         sodipodi:role="line"
+         id="tspan5011"
+         x="32.424427"
+         y="103.23161"
+         style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:5.29166698px;line-height:0;font-family:'Courier New';-inkscape-font-specification:'Courier New';stroke-width:0.26458332">Internet</tspan></text>
+    <text
+       xml:space="preserve"
+       style="font-style:normal;font-weight:normal;font-size:10.58333302px;line-height:1.25;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;fill:#000000;fill-opacity:1;stroke:none;stroke-width:0.26458332"
+       x="102.3172"
+       y="116.44047"
+       id="text5013-6"><tspan
+         sodipodi:role="line"
+         id="tspan5011-2"
+         x="102.3172"
+         y="116.44047"
+         style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:5.29166698px;line-height:0;font-family:'Courier New';-inkscape-font-specification:'Courier New';stroke-width:0.26458332">Router</tspan></text>
+    <text
+       xml:space="preserve"
+       style="font-style:normal;font-weight:normal;font-size:10.58333302px;line-height:1.25;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;fill:#800080;fill-opacity:0.96470588;stroke:none;stroke-width:0.26458332"
+       x="188.76727"
+       y="105.30679"
+       id="text5053"><tspan
+         sodipodi:role="line"
+         id="tspan5051"
+         x="188.76727"
+         y="105.30679"
+         style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:4.93888903px;font-family:'Courier New';-inkscape-font-specification:'Courier New';fill:#800080;fill-opacity:0.96470588;stroke:none;stroke-width:0.26458332;stroke-opacity:0.96517412">Local Area Network</tspan></text>
+    <text
+       xml:space="preserve"
+       style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:10.58333302px;line-height:1.25;font-family:'Courier New';-inkscape-font-specification:'Courier New';letter-spacing:0px;word-spacing:0px;fill:#c98f26;fill-opacity:0.88627451;stroke:none;stroke-width:0.26458332"
+       x="92.344772"
+       y="138.5094"
+       id="text5057"><tspan
+         sodipodi:role="line"
+         id="tspan5055"
+         x="92.344772"
+         y="138.5094"
+         style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:4.23333311px;font-family:'Courier New';-inkscape-font-specification:'Courier New';fill:#c98f26;fill-opacity:0.88627451;stroke-width:0.26458332">443</tspan></text>
+    <text
+       xml:space="preserve"
+       style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:10.58333302px;line-height:1.25;font-family:'Courier New';-inkscape-font-specification:'Courier New';letter-spacing:0px;word-spacing:0px;fill:#c98f26;fill-opacity:0.88627451;stroke:none;stroke-width:0.26458332"
+       x="92.414749"
+       y="138.5529"
+       id="text5057-0"><tspan
+         sodipodi:role="line"
+         id="tspan5055-6"
+         x="92.414749"
+         y="138.5529"
+         style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:4.23333311px;font-family:'Courier New';-inkscape-font-specification:'Courier New';fill:#c98f26;fill-opacity:0.88627451;stroke-width:0.26458332">443</tspan></text>
+    <text
+       xml:space="preserve"
+       style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:10.58333302px;line-height:1.25;font-family:'Courier New';-inkscape-font-specification:'Courier New';letter-spacing:0px;word-spacing:0px;fill:#c98f26;fill-opacity:0.88627451;stroke:none;stroke-width:0.26458332"
+       x="92.414749"
+       y="138.5529"
+       id="text5057-0-8"><tspan
+         sodipodi:role="line"
+         id="tspan5055-6-2"
+         x="92.414749"
+         y="138.5529"
+         style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:4.23333333px;font-family:'Courier New';-inkscape-font-specification:'Courier New';fill:#c98f26;fill-opacity:0.88627451;stroke-width:0.26458332">443</tspan></text>
+    <text
+       xml:space="preserve"
+       style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:11.3396225px;line-height:1.25;font-family:'Courier New';-inkscape-font-specification:'Courier New';letter-spacing:0px;word-spacing:0px;fill:#c98f26;fill-opacity:0.88627451;stroke:none;stroke-width:0.28349054"
+       x="151.81532"
+       y="147.89809"
+       id="text5057-0-8-6"
+       transform="scale(1.0714604,0.93330561)"><tspan
+         sodipodi:role="line"
+         id="tspan5055-6-2-7"
+         x="151.81532"
+         y="147.89809"
+         style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:4.23333333px;font-family:'Courier New';-inkscape-font-specification:'Courier New';fill:#c98f26;fill-opacity:0.88627451;stroke-width:0.28349054">4433</tspan></text>
+    <text
+       xml:space="preserve"
+       style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:11.33962345px;line-height:1.25;font-family:'Courier New';-inkscape-font-specification:'Courier New';letter-spacing:0px;word-spacing:0px;fill:#c98f26;fill-opacity:0.88627451;stroke:none;stroke-width:0.28349057"
+       x="114.9891"
+       y="148.08023"
+       id="text5057-0-8-6-4"
+       transform="scale(1.0714604,0.93330561)"><tspan
+         sodipodi:role="line"
+         id="tspan5055-6-2-7-3"
+         x="114.9891"
+         y="148.08023"
+         style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:4.23333311px;font-family:'Courier New';-inkscape-font-specification:'Courier New';fill:#c98f26;fill-opacity:0.88627451;stroke-width:0.28349057">4433</tspan></text>
+    <text
+       xml:space="preserve"
+       style="font-style:normal;font-weight:normal;font-size:10.58333302px;line-height:1.25;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;fill:#000000;fill-opacity:1;stroke:none;stroke-width:0.26458332"
+       x="208.55414"
+       y="135.19525"
+       id="text144"><tspan
+         sodipodi:role="line"
+         x="208.55414"
+         y="135.19525"
+         id="tspan142"
+         style="stroke-width:0.26458332"><tspan
+           x="208.55414"
+           y="135.19525"
+           style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:5.64444447px;font-family:'Courier New';-inkscape-font-specification:'Courier New';fill:#f40000;fill-opacity:1;stroke-width:0.26458332"
+           id="tspan140">SSLH</tspan></tspan></text>
+    <text
+       xml:space="preserve"
+       style="font-style:normal;font-weight:normal;font-size:3.52777767px;line-height:1.25;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;fill:#000000;fill-opacity:1;stroke:none;stroke-width:0.26458332"
+       x="158.75"
+       y="121.48432"
+       id="text5159"><tspan
+         sodipodi:role="line"
+         id="tspan5157"
+         x="158.75"
+         y="121.48432"
+         style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-family:'Courier New';-inkscape-font-specification:'Courier New Bold';stroke-width:0.26458332;font-size:3.88055556px">192.168.1.124 (Pi A)</tspan></text>
+    <text
+       xml:space="preserve"
+       style="font-style:normal;font-weight:normal;font-size:3.52777767px;line-height:1.25;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;fill:#000000;fill-opacity:1;stroke:none;stroke-width:0.26458332"
+       x="157.30107"
+       y="258.37653"
+       id="text5159-0"><tspan
+         sodipodi:role="line"
+         id="tspan5157-1"
+         x="157.30107"
+         y="258.37653"
+         style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:3.88055563px;font-family:'Courier New';-inkscape-font-specification:'Courier New Bold';stroke-width:0.26458332">192.168.1.123 (Pi B)</tspan></text>
+    <text
+       xml:space="preserve"
+       style="font-style:normal;font-weight:normal;font-size:3.52777767px;line-height:1.25;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;fill:#fa9600;fill-opacity:1;stroke:none;stroke-width:0.26458332"
+       x="167.25511"
+       y="242.15076"
+       id="text168"><tspan
+         sodipodi:role="line"
+         x="167.25511"
+         y="242.15076"
+         id="tspan166"
+         style="stroke-width:0.26458332"><tspan
+           x="167.25511"
+           y="242.15076"
+           style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:4.23333311px;font-family:'Courier New';-inkscape-font-specification:'Courier New Bold';fill:#fa9600;fill-opacity:1;stroke-width:0.26458332"
+           id="tspan164">Web Server</tspan></tspan></text>
+    <text
+       xml:space="preserve"
+       style="font-style:normal;font-weight:normal;font-size:3.52777767px;line-height:1.25;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;fill:#fa9600;fill-opacity:1;stroke:none;stroke-width:0.26458332"
+       x="239.92085"
+       y="241.98419"
+       id="text174"><tspan
+         sodipodi:role="line"
+         x="239.92085"
+         y="241.98419"
+         id="tspan172"
+         style="stroke-width:0.26458332"><tspan
+           x="239.92085"
+           y="241.98419"
+           style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:4.23333311px;font-family:'Courier New';-inkscape-font-specification:'Courier New Bold';fill:#fa9600;fill-opacity:1;stroke-width:0.26458332"
+           id="tspan170">SSH Server</tspan></tspan></text>
+    <text
+       xml:space="preserve"
+       style="font-style:normal;font-weight:normal;font-size:3.52777767px;line-height:1.25;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;fill:#000000;fill-opacity:1;stroke:none;stroke-width:0.26458332"
+       x="167.9187"
+       y="190.6398"
+       id="text186"><tspan
+         sodipodi:role="line"
+         x="167.9187"
+         y="190.6398"
+         id="tspan184"
+         style="stroke-width:0.26458332"><tspan
+           x="167.9187"
+           y="190.6398"
+           style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:3.88055563px;font-family:'Courier New';-inkscape-font-specification:'Courier New Bold';fill:#fa9600;fill-opacity:1;stroke-width:0.26458332"
+           id="tspan182">http</tspan></tspan></text>
+    <text
+       xml:space="preserve"
+       style="font-style:normal;font-weight:normal;font-size:3.52777767px;line-height:1.25;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;fill:#000000;fill-opacity:1;stroke:none;stroke-width:0.26458332"
+       x="167.48399"
+       y="157.93468"
+       id="text180"><tspan
+         sodipodi:role="line"
+         x="167.48399"
+         y="157.93468"
+         id="tspan178"
+         style="stroke-width:0.26458332"><tspan
+           x="167.48399"
+           y="157.93468"
+           style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:3.88055563px;font-family:'Courier New';-inkscape-font-specification:'Courier New Bold';fill:#fa9600;fill-opacity:1;stroke-width:0.26458332"
+           id="tspan176">8000</tspan></tspan></text>
+    <text
+       xml:space="preserve"
+       style="font-style:normal;font-weight:normal;font-size:3.52777767px;line-height:1.25;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;fill:#000000;fill-opacity:1;stroke:none;stroke-width:0.26458332"
+       x="167.74596"
+       y="229.97469"
+       id="text192"><tspan
+         sodipodi:role="line"
+         x="167.74596"
+         y="229.97469"
+         id="tspan190"
+         style="stroke-width:0.26458332"><tspan
+           x="167.74596"
+           y="229.97469"
+           style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:3.88055563px;font-family:'Courier New';-inkscape-font-specification:'Courier New Bold';fill:#fa9600;fill-opacity:1;stroke-width:0.26458332"
+           id="tspan188">8000</tspan></tspan></text>
+    <text
+       xml:space="preserve"
+       style="font-style:normal;font-weight:normal;font-size:3.52777767px;line-height:1.25;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;fill:#000000;fill-opacity:1;stroke:none;stroke-width:0.26458332"
+       x="255.3237"
+       y="190.91431"
+       id="text246"><tspan
+         sodipodi:role="line"
+         x="255.3237"
+         y="190.91431"
+         id="tspan244"
+         style="stroke-width:0.26458332"><tspan
+           x="255.3237"
+           y="190.91431"
+           style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:3.88055563px;font-family:'Courier New';-inkscape-font-specification:'Courier New Bold';fill:#fa9600;fill-opacity:1;stroke-width:0.26458332"
+           id="tspan242">ssh</tspan></tspan></text>
+    <text
+       xml:space="preserve"
+       style="font-style:normal;font-weight:normal;font-size:3.52777767px;line-height:1.25;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;fill:#000000;fill-opacity:1;stroke:none;stroke-width:0.26458332"
+       x="254.88899"
+       y="158.20918"
+       id="text240"><tspan
+         sodipodi:role="line"
+         x="254.88899"
+         y="158.20918"
+         id="tspan238"
+         style="stroke-width:0.26458332"><tspan
+           x="254.88899"
+           y="158.20918"
+           style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:3.88055563px;font-family:'Courier New';-inkscape-font-specification:'Courier New Bold';fill:#fa9600;fill-opacity:1;stroke-width:0.26458332"
+           id="tspan236">1022</tspan></tspan></text>
+    <text
+       xml:space="preserve"
+       style="font-style:normal;font-weight:normal;font-size:3.52777767px;line-height:1.25;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;fill:#000000;fill-opacity:1;stroke:none;stroke-width:0.26458332"
+       x="255.15096"
+       y="230.24921"
+       id="text252"><tspan
+         sodipodi:role="line"
+         x="255.15096"
+         y="230.24921"
+         id="tspan250"
+         style="stroke-width:0.26458332"><tspan
+           x="255.15096"
+           y="230.24921"
+           style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:3.88055563px;font-family:'Courier New';-inkscape-font-specification:'Courier New Bold';fill:#fa9600;fill-opacity:1;stroke-width:0.26458332"
+           id="tspan248">1022</tspan></tspan></text>
+    <text
+       xml:space="preserve"
+       style="font-style:normal;font-weight:normal;font-size:3.52777767px;line-height:1.25;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;fill:#009600;fill-opacity:1;stroke:none;stroke-width:0.26458332;stroke-opacity:1"
+       x="186.26637"
+       y="193.70544"
+       id="text156"><tspan
+         sodipodi:role="line"
+         x="186.26637"
+         y="193.70544"
+         id="tspan154"
+         style="stroke-width:0.26458332"><tspan
+           x="186.26637"
+           y="193.70544"
+           style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:3.88055563px;font-family:'Courier New';-inkscape-font-specification:'Courier New Bold';fill:#009600;fill-opacity:1;stroke:none;stroke-width:0.26458332;stroke-opacity:1"
+           id="tspan152">Web Server</tspan></tspan></text>
+    <text
+       xml:space="preserve"
+       style="font-style:normal;font-weight:normal;font-size:3.52777767px;line-height:1.25;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;fill:#009600;fill-opacity:1;stroke:none;stroke-width:0.26458332;stroke-opacity:1"
+       x="225.25404"
+       y="170.88316"
+       id="text150"><tspan
+         sodipodi:role="line"
+         x="225.25404"
+         y="170.88316"
+         id="tspan148"
+         style="stroke-width:0.26458332"><tspan
+           x="225.25404"
+           y="170.88316"
+           style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:3.88055563px;font-family:'Courier New';-inkscape-font-specification:'Courier New Bold';fill:#009600;fill-opacity:1;stroke:none;stroke-width:0.26458332;stroke-opacity:1"
+           id="tspan146">STUNNEL</tspan></tspan></text>
+    <text
+       xml:space="preserve"
+       style="font-style:normal;font-weight:normal;font-size:3.52777767px;line-height:1.25;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;fill:#009600;fill-opacity:1;stroke:none;stroke-width:0.26458332;stroke-opacity:1"
+       x="222.6344"
+       y="194.19792"
+       id="text162"><tspan
+         sodipodi:role="line"
+         x="222.6344"
+         y="194.19792"
+         id="tspan160"
+         style="stroke-width:0.26458332"><tspan
+           x="222.6344"
+           y="194.19792"
+           style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:3.88055563px;font-family:'Courier New';-inkscape-font-specification:'Courier New Bold';fill:#009600;fill-opacity:1;stroke:none;stroke-width:0.26458332;stroke-opacity:1"
+           id="tspan158">SSH Server</tspan></tspan></text>
+    <text
+       xml:space="preserve"
+       style="font-style:normal;font-weight:normal;font-size:3.52777767px;line-height:1.25;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;fill:#009600;fill-opacity:1;stroke:none;stroke-width:0.26458332"
+       x="199.15128"
+       y="157.29231"
+       id="text198"><tspan
+         sodipodi:role="line"
+         x="199.15128"
+         y="157.29231"
+         id="tspan196"
+         style="stroke-width:0.26458332"><tspan
+           x="199.15128"
+           y="157.29231"
+           style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:3.88055563px;font-family:'Courier New';-inkscape-font-specification:'Courier New Bold';fill:#009600;fill-opacity:1;stroke-width:0.26458332"
+           id="tspan194">443</tspan></tspan></text>
+    <text
+       xml:space="preserve"
+       style="font-style:normal;font-weight:normal;font-size:3.52777767px;line-height:1.25;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;fill:#009600;fill-opacity:1;stroke:none;stroke-width:0.26458332"
+       x="199.41324"
+       y="182.17886"
+       id="text210"><tspan
+         sodipodi:role="line"
+         x="199.41324"
+         y="182.17886"
+         id="tspan208"
+         style="stroke-width:0.26458332"><tspan
+           x="199.41324"
+           y="182.17886"
+           style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:3.88055563px;font-family:'Courier New';-inkscape-font-specification:'Courier New Bold';fill:#009600;fill-opacity:1;stroke-width:0.26458332"
+           id="tspan206">443</tspan></tspan></text>
+    <text
+       xml:space="preserve"
+       style="font-style:normal;font-weight:normal;font-size:3.52777767px;line-height:1.25;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;fill:#009600;fill-opacity:1;stroke:none;stroke-width:0.26458332"
+       x="199.15128"
+       y="170.65247"
+       id="text204"><tspan
+         sodipodi:role="line"
+         x="199.15128"
+         y="170.65247"
+         id="tspan202"
+         style="stroke-width:0.26458332"><tspan
+           x="199.15128"
+           y="170.65247"
+           style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:3.88055563px;font-family:'Courier New';-inkscape-font-specification:'Courier New Bold';fill:#009600;fill-opacity:1;stroke-width:0.26458332"
+           id="tspan200">tls</tspan></tspan></text>
+    <text
+       xml:space="preserve"
+       style="font-style:normal;font-weight:normal;font-size:3.52777767px;line-height:1.25;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;fill:#009600;fill-opacity:1;stroke:none;stroke-width:0.26458332"
+       x="223.09605"
+       y="158.60213"
+       id="text216"><tspan
+         sodipodi:role="line"
+         x="223.09605"
+         y="158.60213"
+         id="tspan214"
+         style="stroke-width:0.26458332"><tspan
+           x="223.09605"
+           y="158.60213"
+           style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:3.88055563px;font-family:'Courier New';-inkscape-font-specification:'Courier New Bold';fill:#009600;fill-opacity:1;stroke-width:0.26458332"
+           id="tspan212">4480</tspan></tspan></text>
+    <text
+       xml:space="preserve"
+       style="font-style:normal;font-weight:normal;font-size:3.52777767px;line-height:1.25;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;fill:#009600;fill-opacity:1;stroke:none;stroke-width:0.26458332"
+       x="235.14638"
+       y="158.60213"
+       id="text222"><tspan
+         sodipodi:role="line"
+         x="235.14638"
+         y="158.60213"
+         id="tspan220"
+         style="stroke-width:0.26458332"><tspan
+           x="235.14638"
+           y="158.60213"
+           style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:3.88055563px;font-family:'Courier New';-inkscape-font-specification:'Courier New Bold';fill:#009600;fill-opacity:1;stroke-width:0.26458332"
+           id="tspan218">tls</tspan></tspan></text>
+    <text
+       xml:space="preserve"
+       style="font-style:normal;font-weight:normal;font-size:3.52777767px;line-height:1.25;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;fill:#009600;fill-opacity:1;stroke:none;stroke-width:0.26458332"
+       x="222.57213"
+       y="182.44083"
+       id="text228"><tspan
+         sodipodi:role="line"
+         x="222.57213"
+         y="182.44083"
+         id="tspan226"
+         style="stroke-width:0.26458332"><tspan
+           x="222.57213"
+           y="182.44083"
+           style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:3.88055563px;font-family:'Courier New';-inkscape-font-specification:'Courier New Bold';fill:#009600;fill-opacity:1;stroke-width:0.26458332"
+           id="tspan224">1022</tspan></tspan></text>
+    <text
+       xml:space="preserve"
+       style="font-style:normal;font-weight:normal;font-size:3.52777767px;line-height:1.25;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;fill:#009600;fill-opacity:1;stroke:none;stroke-width:0.26458332"
+       x="234.88441"
+       y="182.44083"
+       id="text234"><tspan
+         sodipodi:role="line"
+         x="234.88441"
+         y="182.44083"
+         id="tspan232"
+         style="stroke-width:0.26458332"><tspan
+           x="234.88441"
+           y="182.44083"
+           style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:3.88055563px;font-family:'Courier New';-inkscape-font-specification:'Courier New Bold';fill:#009600;fill-opacity:1;stroke-width:0.26458332"
+           id="tspan230">ssh</tspan></tspan></text>
+  </g>
+</svg>

echosrv.c

@@ -53,6 +53,8 @@ const char* server_type = "echsrv"; /* keep setup_syslog happy */
 char* prefix = "";
 int port;
 
+int verbose, numeric;
+
 void parse_cmdline(int argc, char* argv[])
 {
     int c;
@@ -104,7 +106,7 @@ void start_echo(int fd)
     strcpy(buffer, prefix);
 
     while (1) {
-        ret = read(fd, buffer + prefix_len, sizeof(buffer));
+        ret = read(fd, buffer + prefix_len, sizeof(buffer) - prefix_len);
         if (ret == -1) {
             fprintf(stderr, "%s", strerror(errno));
             return;

example.cfg

@@ -3,7 +3,7 @@
 # not be used as a starting point for a working
 # configuration. Instead use basic.cfg.
 
-verbose: true;
+verbose: 0;
 foreground: true;
 inetd: false;
 numeric: false;
@@ -17,6 +17,7 @@ chroot: "/var/empty";
 # system are usually defined in /usr/include/*/sys/syslog.h
 # or equivalent)
 # Default is "auth"
+# "none" disables use of syslog
 syslog_facility: "auth"; 
 
 # List of interfaces on which we should listen
@@ -41,53 +42,62 @@ listen:
 #               connection (default is off)
 #   fork: Should a new process be forked for this protocol?
 #         (only useful for sslh-select)
+#   tfo_ok: Set to true if the server supports TCP FAST OPEN
 #
 #  Probe-specific options:
+# (sslh will try each probe in order they are declared, and
+# connect to the first that matches.)
+#
 #       tls:
 #               sni_hostnames:  list of FQDN for that target
 #               alpn_protocols: list of ALPN protocols for that target, see:
 #               https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#alpn-protocol-ids
 #
 #               if both sni_hostnames AND alpn_protocols are specified, both must match
+#
 #               if neither are set, it is just checked whether this is the TLS protocol or not
+#
+#               Obviously set the most specific probes
+#               first, and if you use TLS with no ALPN/SNI
+#               set it as the last TLS probe
 #       regex:
 #               regex_patterns: list of patterns to match for
 #               that target.
 #   
-# sslh will try each probe in order they are declared, and
-# connect to the first that matches.
-#
 # You can specify several of 'regex' and 'tls'.
  
 protocols:
 (
-     { name: "ssh"; service: "ssh"; host: "localhost"; port: "22"; keepalive: true; fork: true; },
+     { name: "ssh"; service: "ssh"; host: "localhost"; port: "22"; 
+       keepalive: true; fork: true; tfo_ok: true },
      { name: "http"; host: "localhost"; port: "80"; },
 
 # match BOTH ALPN/SNI
-     { name: "tls"; host: "localhost"; port: "5223"; alpn_protocols: [ "xmpp-client" ]; sni_hostnames: [ "im.somethingelse.net" ]; log_level: 0;},
+     { name: "tls"; host: "localhost"; port: "5223"; alpn_protocols: [ "xmpp-client" ]; sni_hostnames: [ "im.somethingelse.net" ]; log_level: 0; tfo_ok: true },
 
 # just match ALPN
-     { name: "tls"; host: "localhost"; port: "443"; alpn_protocols: [ "h2", "http/1.1", "spdy/1", "spdy/2", "spdy/3" ]; log_level: 0; },
-     { name: "tls"; host: "localhost"; port: "xmpp-client"; alpn_protocols: [ "xmpp-client" ];  log_level: 0;},
+     { name: "tls"; host: "localhost"; port: "443"; alpn_protocols: [ "h2", "http/1.1", "spdy/1", "spdy/2", "spdy/3" ]; log_level: 0;  tfo_ok: true },
+     { name: "tls"; host: "localhost"; port: "xmpp-client"; alpn_protocols: [ "xmpp-client" ];  log_level: 0; tfo_ok: true },
 
 # just match SNI
-     { name: "tls"; host: "localhost"; port: "993"; sni_hostnames: [ "mail.rutschle.net", "mail.englishintoulouse.com" ]; log_level: 0; },
-     { name: "tls"; host: "localhost"; port: "xmpp-client"; sni_hostnames: [ "im.rutschle.net", "im.englishintoulouse.com" ];  log_level: 0;},
+     { name: "tls"; host: "localhost"; port: "993"; sni_hostnames: [ "mail.rutschle.net", "mail.englishintoulouse.com" ]; log_level: 0;  tfo_ok: true },
+     { name: "tls"; host: "localhost"; port: "xmpp-client"; sni_hostnames: [ "im.rutschle.net", "im.englishintoulouse.com" ];  log_level: 0; tfo_ok: true },
 
-# Let's Encrypt (tls-sni-* challenges)
-     { name: "tls"; host: "localhost"; port: "letsencrypt-client"; sni_hostnames: [ "*.*.acme.invalid" ];  log_level: 0;},
+# Let's Encrypt (tls-alpn-* challenges)
+     { name: "tls"; host: "localhost"; port: "letsencrypt-client"; alpn_protocols: [ "acme-tls/1" ]; log_level: 0;},
 
 # catch anything else TLS
-     { name: "tls"; host: "localhost"; port: "443"; },
+     { name: "tls"; host: "localhost"; port: "443";  tfo_ok: true },
 
 # Regex examples -- better use the built-in probes for real-world use!
 # OpenVPN
      { name: "regex"; host: "localhost"; port: "1194"; regex_patterns: [ "^\x00[\x0D-\xFF]$", "^\x00[\x0D-\xFF]\x38" ]; },
 # Jabber
-     { name: "regex"; host: "localhost"; port: "5222"; regex_patterns: [ "jabber" ]; },
+     { name: "regex"; host: "localhost"; port: "5222"; regex_patterns: [ "jabber" ];
+       minlength: 60;  # Won't even try to match the regex if we don't have that many bytes
+     },
     
-# Catch-all
+# Catch-all (but better use 'anyprot')
      { name: "regex"; host: "localhost"; port: "443"; regex_patterns: [ "" ]; },
 
 # Where to connect in case of timeout (defaults to ssh)

genver.sh

@@ -7,7 +7,7 @@ else
 	QUIET=0
 fi
 
-if ! `(git status | grep -q "On branch") 2> /dev/null`; then
+if [ ! -d .git ] || ! `(git status | grep -q "On branch") 2> /dev/null`; then
         # If we don't have git, we can't work out what
         # version this is. It must have been downloaded as a
         # zip file. 
@@ -25,7 +25,7 @@ if ! `(git status | grep -q "On branch") 2> /dev/null`; then
         fi
 fi
 
-if head=`git rev-parse --verify HEAD 2>/dev/null`; then
+if [ -d .git ] && head=`git rev-parse --verify HEAD 2>/dev/null`; then
 	# generate the version info based on the tag
 	release=`(git describe --tags || git --describe || git describe --all --long) \
 		2>/dev/null | tr -d '\n'`

probe.c

@@ -1,7 +1,7 @@
 /*
 # probe.c: Code for probing protocols
 #
-# Copyright (C) 2007-2015  Yves Rutschle
+# Copyright (C) 2007-2019  Yves Rutschle
 # 
 # This program is free software; you can redistribute it
 # and/or modify it under the terms of the GNU General Public
@@ -33,34 +33,34 @@
 
 
 
-static int is_ssh_protocol(const char *p, int len, struct proto*);
-static int is_openvpn_protocol(const char *p, int len, struct proto*);
-static int is_tinc_protocol(const char *p, int len, struct proto*);
-static int is_xmpp_protocol(const char *p, int len, struct proto*);
-static int is_http_protocol(const char *p, int len, struct proto*);
-static int is_tls_protocol(const char *p, int len, struct proto*);
-static int is_adb_protocol(const char *p, int len, struct proto*);
-static int is_true(const char *p, int len, struct proto* proto) { return 1; }
+static int is_ssh_protocol(const char *p, int len, struct sslhcfg_protocols_item*);
+static int is_openvpn_protocol(const char *p, int len, struct sslhcfg_protocols_item*);
+static int is_tinc_protocol(const char *p, int len, struct sslhcfg_protocols_item*);
+static int is_xmpp_protocol(const char *p, int len, struct sslhcfg_protocols_item*);
+static int is_http_protocol(const char *p, int len, struct sslhcfg_protocols_item*);
+static int is_tls_protocol(const char *p, int len, struct sslhcfg_protocols_item*);
+static int is_adb_protocol(const char *p, int len, struct sslhcfg_protocols_item*);
+static int is_socks5_protocol(const char *p, int len, struct sslhcfg_protocols_item*);
+static int is_true(const char *p, int len, struct sslhcfg_protocols_item* proto) { return 1; }
 
 /* Table of protocols that have a built-in probe
  */
-static struct proto builtins[] = {
-    /* description   service  saddr  log_level  keepalive  fork  probe  */
-    { "ssh",         "sshd",   NULL,  1,        0,         1,    is_ssh_protocol},
-    { "openvpn",     NULL,     NULL,  1,        0,         1,    is_openvpn_protocol },
-    { "tinc",        NULL,     NULL,  1,        0,         1,    is_tinc_protocol },
-    { "xmpp",        NULL,     NULL,  1,        0,         0,    is_xmpp_protocol },
-    { "http",        NULL,     NULL,  1,        0,         0,    is_http_protocol },
-    { "ssl",         NULL,     NULL,  1,        0,         0,    is_tls_protocol },
-    { "tls",         NULL,     NULL,  1,        0,         0,    is_tls_protocol },
-    { "adb",         NULL,     NULL,  1,        0,         0,    is_adb_protocol },
-    { "anyprot",     NULL,     NULL,  1,        0,         0,    is_true }
+static struct protocol_probe_desc builtins[] = {
+    /* description  probe  */
+    { "ssh",        is_ssh_protocol},
+    { "openvpn",    is_openvpn_protocol },
+    { "tinc",       is_tinc_protocol },
+    { "xmpp",       is_xmpp_protocol },
+    { "http",       is_http_protocol },
+    { "tls",        is_tls_protocol },
+    { "ssl",        is_tls_protocol },
+    { "adb",        is_adb_protocol },
+    { "socks5",     is_socks5_protocol },
+    { "anyprot",    is_true }
 };
 
-static struct proto *protocols;
-static char* on_timeout = "ssh";
-
-struct proto*  get_builtins(void) {
+/* TODO I think this has to go */
+struct protocol_probe_desc*  get_builtins(void) {
     return builtins;
 }
 
@@ -68,34 +68,18 @@ int get_num_builtins(void) {
     return ARRAY_SIZE(builtins);
 }
 
-/* Sets the protocol name to connect to in case of timeout */
-void set_ontimeout(const char* name)
-{
-    int res = asprintf(&on_timeout, "%s", name);
-    CHECK_RES_DIE(res, "asprintf");
-}
-
 /* Returns the protocol to connect to in case of timeout; 
  * if not found, return the first protocol specified 
  */
-struct proto* timeout_protocol(void) 
+struct sslhcfg_protocols_item* timeout_protocol(void) 
 {
-    struct proto* p = get_first_protocol();
-    for (; p && strcmp(p->description, on_timeout); p = p->next);
-    if (p) return p;
-    return get_first_protocol();
+    int i;
+    for (i = 0; i < cfg.protocols_len; i++) {
+        if (!strcmp(cfg.protocols[i].name, cfg.on_timeout)) return &cfg.protocols[i];
+    }
+    return &cfg.protocols[0];
 }
 
-/* returns the first protocol (caller can then follow the *next pointers) */
-struct proto* get_first_protocol(void)
-{
-    return protocols;
-}
-
-void set_protocol_list(struct proto* prots)
-{
-    protocols = prots;
-}
 
 /* From http://grapsus.net/blog/post/Hexadecimal-dump-in-C */
 #define HEXDUMP_COLS 16
@@ -131,7 +115,7 @@ void hexdump(const char *mem, unsigned int len)
 }
 
 /* Is the buffer the beginning of an SSH connection? */
-static int is_ssh_protocol(const char *p, int len, struct proto *proto)
+static int is_ssh_protocol(const char *p, int len, struct sslhcfg_protocols_item* proto)
 {
     if (len < 4)
         return PROBE_AGAIN;
@@ -149,7 +133,7 @@ static int is_ssh_protocol(const char *p, int len, struct proto *proto)
  * http://www.fengnet.com/book/vpns%20illustrated%20tunnels%20%20vpnsand%20ipsec/ch08lev1sec5.html
  * and OpenVPN ssl.c, ssl.h and options.c
  */
-static int is_openvpn_protocol (const char*p,int len, struct proto *proto)
+static int is_openvpn_protocol (const char*p,int len, struct sslhcfg_protocols_item* proto)
 {
     int packet_len;
 
@@ -164,7 +148,7 @@ static int is_openvpn_protocol (const char*p,int len, struct proto *proto)
  * Protocol is documented here: http://www.tinc-vpn.org/documentation/tinc.pdf
  * First connection starts with "0 " in 1.0.15)
  * */
-static int is_tinc_protocol( const char *p, int len, struct proto *proto)
+static int is_tinc_protocol( const char *p, int len, struct sslhcfg_protocols_item* proto)
 {
     if (len < 2)
         return PROBE_AGAIN;
@@ -176,15 +160,18 @@ static int is_tinc_protocol( const char *p, int len, struct proto *proto)
  * (Protocol is documented (http://tools.ietf.org/html/rfc6120) but for lazy
  * clients, just checking first frame containing "jabber" in xml entity)
  * */
-static int is_xmpp_protocol( const char *p, int len, struct proto *proto)
+static int is_xmpp_protocol( const char *p, int len, struct sslhcfg_protocols_item* proto)
 {
+    if (memmem(p, len, "jabber", 6))
+        return PROBE_MATCH;
+
     /* sometimes the word 'jabber' shows up late in the initial string,
        sometimes after a newline. this makes sure we snarf the entire preamble
        and detect it. (fixed for adium/pidgin) */
     if (len < 50)
         return PROBE_AGAIN;
 
-    return memmem(p, len, "jabber", 6) ? 1 : 0;
+    return PROBE_NEXT;
 }
 
 static int probe_http_method(const char *p, int len, const char *opt)
@@ -192,11 +179,11 @@ static int probe_http_method(const char *p, int len, const char *opt)
     if (len < strlen(opt))
         return PROBE_AGAIN;
 
-    return !strncmp(p, opt, len);
+    return !strncmp(p, opt, strlen(opt));
 }
 
 /* Is the buffer the beginning of an HTTP connection?  */
-static int is_http_protocol(const char *p, int len, struct proto *proto)
+static int is_http_protocol(const char *p, int len, struct sslhcfg_protocols_item* proto)
 {
     int res;
     /* If it's got HTTP in the request (HTTP/1.1) then it's HTTP */
@@ -221,45 +208,15 @@ static int is_http_protocol(const char *p, int len, struct proto *proto)
     return PROBE_NEXT;
 }
 
-static int is_sni_alpn_protocol(const char *p, int len, struct proto *proto)
+/* Says if it's TLS, optionally with SNI and ALPN lists in proto->data */
+static int is_tls_protocol(const char *p, int len, struct sslhcfg_protocols_item* proto)
 {
-    int valid_tls;
-
-    valid_tls = parse_tls_header(proto->data, p, len);
-
-    if(valid_tls < 0)
-        return -1 == valid_tls ? PROBE_AGAIN : PROBE_NEXT;
-
-    /* There *was* a valid match */
-    return PROBE_MATCH;
-}
-
-static int is_tls_protocol(const char *p, int len, struct proto *proto)
-{
-    if (len < 6)
-        return PROBE_AGAIN;
-
-    /* TLS packet starts with a record "Hello" (0x16), followed by the number of
-     * the highest version of SSL/TLS supported.
-     *
-     * A SSLv2 record header contains a two or three byte length code. If the
-     * most significant bit is set in the first byte of the record length code
-     * then the record has no padding and the total header length will be 2
-     * bytes,  otherwise the record has padding and the total header length will
-     * be 3 bytes. Next, a 1 char sized client-hello (0x01) is expected,
-     * followed by a 2 char sized version that indicates the highest version of
-     * TLS/SSL supported by the sender. [SSL2] Hickman, Kipp, "The SSL Protocol"
-     *
-     * We're checking the highest version of TLS/SSL supported against
-     * (0x03 0x00-0x03) (RFC6101 A.1). This means we reject the usage of SSLv2
-     * and lower, which is actually a good thing (RFC6176).
-     */
-    if (p[0] == 0x16) // TLS client-hello
-        return p[1] == 0x03 && ( p[2] >= 0 && p[2] <= 0x03);
-    if ((p[0] & 0x80) != 0) // SSLv2 client-hello, no padding
-        return p[2] == 0x01 && p[3] == 0x03 && ( p[4] >= 0 && p[4] <= 0x03);
-    else // SSLv2 client-hello, padded
-        return p[3] == 0x01 && p[4] == 0x03 && ( p[5] >= 0 && p[5] <= 0x03);
+    switch (parse_tls_header(proto->data, p, len)) {
+    case TLS_MATCH: return PROBE_MATCH;
+    case TLS_NOMATCH: return PROBE_NEXT;
+    case TLS_ELENGTH: return PROBE_AGAIN;
+    default: return PROBE_NEXT;
+    }
 }
 
 static int probe_adb_cnxn_message(const char *p)
@@ -272,7 +229,7 @@ static int probe_adb_cnxn_message(const char *p)
     return !memcmp(&p[0], "CNXN", 4) && !memcmp(&p[24], "host:", 5);
 }
 
-static int is_adb_protocol(const char *p, int len, struct proto *proto)
+static int is_adb_protocol(const char *p, int len, struct sslhcfg_protocols_item* proto)
 {
     /* amessage.data_length is not being checked, under the assumption that
      * a packet >= 30 bytes will have "something" in the payload field.
@@ -311,7 +268,40 @@ static int is_adb_protocol(const char *p, int len, struct proto *proto)
     return probe_adb_cnxn_message(&p[sizeof(empty_message)]);
 }
 
-static int regex_probe(const char *p, int len, struct proto *proto)
+static int is_socks5_protocol(const char *p_in, int len, struct sslhcfg_protocols_item* proto)
+{
+    unsigned char* p = (unsigned char*)p_in;
+    int i;
+
+    if (len < 2)
+        return PROBE_AGAIN;
+
+    /* First byte should be socks protocol version */
+    if (p[0] != 5)
+        return PROBE_NEXT;
+
+    /* Second byte should be number of supported 
+     * authentication methods, assuming maximum of 10,
+     * as defined in https://www.iana.org/assignments/socks-methods/socks-methods.xhtml
+     */
+    char m_count = p[1];
+    if (m_count < 1 || m_count > 10)
+        return PROBE_NEXT;
+
+    if (len < 2 + m_count)
+        return PROBE_AGAIN;
+
+    /* Each authentication method number should be in range 0..9 
+     * (https://www.iana.org/assignments/socks-methods/socks-methods.xhtml)
+     */
+    for (i = 0; i < m_count; i++) {
+        if (p[2 + i] > 9)
+            return PROBE_NEXT;
+    }
+    return PROBE_MATCH;
+}
+
+static int regex_probe(const char *p, int len, struct sslhcfg_protocols_item* proto)
 {
 #ifdef ENABLE_REGEX
     regex_t **probe = proto->data;
@@ -337,8 +327,8 @@ static int regex_probe(const char *p, int len, struct proto *proto)
 int probe_client_protocol(struct connection *cnx)
 {
     char buffer[BUFSIZ];
-    struct proto *p;
-    int n;
+    struct sslhcfg_protocols_item* p;
+    int i, n, res, again = 0;
 
     n = read(cnx->q[0].fd, buffer, sizeof(buffer));
     /* It's possible that read() returns an error, e.g. if the client
@@ -347,60 +337,61 @@ int probe_client_protocol(struct connection *cnx)
      * function does not have to deal with a specific  failure condition (the
      * connection will just fail later normally). */
 
-    /* Dump hex values of the packet */
-    if (verbose>1) {
-        fprintf(stderr, "hexdump of incoming packet:\n");
-        hexdump(buffer, n);
-    }
-
     if (n > 0) {
-        int res = PROBE_NEXT;
-
+        if (cfg.verbose > 1) {
+            fprintf(stderr, "hexdump of incoming packet:\n");
+            hexdump(buffer, n);
+        }
         defer_write(&cnx->q[1], buffer, n);
+    }
 
-        for (p = cnx->proto; p && res == PROBE_NEXT; p = p->next) {
-            if (! p->probe) continue;
-            if (verbose) fprintf(stderr, "probing for %s\n", p->description);
+    for (i = 0; i < cfg.protocols_len; i++) {
+        char* probe_str[3] = {"PROBE_NEXT", "PROBE_MATCH", "PROBE_AGAIN"};
+        p = &cfg.protocols[i];
 
+        if (! p->probe) continue;
+
+        if (cfg.verbose) fprintf(stderr, "probing for %s\n", p->name);
+
+        /* Don't probe last protocol if it is anyprot (and store last protocol) */
+        if ((i == cfg.protocols_len - 1) && (!strcmp(p->name, "anyprot")))
+            break;
+
+        if (p->minlength_is_present && (cnx->q[1].deferred_data_size < p->minlength )) {
+            fprintf(stderr, "input too short, %d bytes but need %d\n", cnx->q[1].deferred_data_size , p->minlength);
+            again++;
+            continue;
+        }
+
+        res = p->probe(cnx->q[1].begin_deferred_data, cnx->q[1].deferred_data_size, p);
+        if (cfg.verbose) fprintf(stderr, "probed for %s: %s\n", p->name, probe_str[res]);
+
+        if (res == PROBE_MATCH) {
             cnx->proto = p;
-            res = p->probe(cnx->q[1].begin_deferred_data, cnx->q[1].deferred_data_size, p);
+            return PROBE_MATCH;
         }
-        if (res != PROBE_NEXT)
-            return res;
+        if (res == PROBE_AGAIN)
+            again++;
     }
+    if ((again && (n > 0)) || ((n == -1) && (errno == EAGAIN)))
+        return PROBE_AGAIN;
 
-    if (verbose) 
-        fprintf(stderr, 
-                "all probes failed, connecting to first protocol: %s\n", 
-                protocols->description);
-
-    /* If none worked, return the first one affected (that's completely
-     * arbitrary) */
-    cnx->proto = protocols;
+    /* Everything failed: match the last one */
+    cnx->proto = &cfg.protocols[cfg.protocols_len-1];
     return PROBE_MATCH;
 }
 
-/* Returns the structure for specified protocol or NULL if not found */
-static struct proto* get_protocol(const char* description)
-{
-    int i;
-
-    for (i = 0; i < ARRAY_SIZE(builtins); i++) {
-        if (!strcmp(builtins[i].description, description)) {
-            return &builtins[i];
-        }
-    }
-    return NULL;
-}
-
 /* Returns the probe for specified protocol:
  * parameter is the description in builtins[], or "regex" 
  * */
 T_PROBE* get_probe(const char* description) {
-    struct proto* p = get_protocol(description);
+    int i;
 
-    if (p)
-        return p->probe;
+    for (i = 0; i < ARRAY_SIZE(builtins); i++) {
+        if (!strcmp(builtins[i].name, description)) {
+            return builtins[i].probe;
+        }
+    }
 
     /* Special case of "regex" probe (we don't want to set it in builtins
      * because builtins is also used to build the command-line options and
@@ -408,10 +399,6 @@ T_PROBE* get_probe(const char* description) {
     if (!strcmp(description, "regex"))
         return regex_probe;
 
-    /* Special case of "sni/alpn" probe for same reason as above*/
-    if (!strcmp(description, "sni_alpn"))
-        return is_sni_alpn_protocol;
-
     /* Special case of "timeout" is allowed as a probe name in the
      * configuration file even though it's not really a probe */
     if (!strcmp(description, "timeout"))

probe.h

@@ -12,30 +12,19 @@ typedef enum {
     PROBE_AGAIN, /* Not enough data for this probe, try again with more data */
 } probe_result;
 
-struct proto;
-typedef int T_PROBE(const char*, int, struct proto*);
+struct sslhcfg_protocols_item;
+typedef int T_PROBE(const char*, int, struct sslhcfg_protocols_item*);
 
-/* For each protocol we need: */
-struct proto {
-    const char* description;  /* a string that says what it is (for logging and command-line parsing) */
-    const char* service;      /* service name to do libwrap checks */
-    struct addrinfo *saddr; /* list of addresses to try and switch that protocol */
-    int log_level;  /* 0: No logging of connection
-                     * 1: Log incoming connection
-                     */
-    int keepalive; /* 0: No keepalive ; 1: Set Keepalive for this connection */
-    int fork; /* 0: Connection can run within shared process ; 1: Separate process required for this connection */
-
-    /* function to probe that protocol; parameters are buffer and length
-     * containing the data to probe, and a pointer to the protocol structure */
+struct protocol_probe_desc {
+    const char* name;
     T_PROBE* probe;
-    /* opaque pointer ; used to pass list of regex to regex probe, or TLSProtocol struct to sni/alpn probe */
-    void* data;
-    struct proto *next; /* pointer to next protocol in list, NULL if last */
 };
 
+
+#include "sslh-conf.h"
+
 /* Returns a pointer to the array of builtin protocols */
-struct proto * get_builtins(void);
+struct protocol_probe_desc* get_builtins(void);
 
 /* Returns the number of builtin protocols */
 int get_num_builtins(void);
@@ -44,10 +33,10 @@ int get_num_builtins(void);
 T_PROBE* get_probe(const char* description);
 
 /* Returns the head of the configured protocols */
-struct proto* get_first_protocol(void);
+struct sslhcfg_protocols_item* get_first_protocol(void);
 
 /* Set the list of configured protocols */
-void set_protocol_list(struct proto*);
+void set_protocol_list(struct sslhcfg_protocols_item*);
 
 /* probe_client_protocol
  *
@@ -65,7 +54,7 @@ void set_ontimeout(const char* name);
  *
  * Returns the protocol to connect to in case of timeout
  */
-struct proto* timeout_protocol(void);
+struct sslhcfg_protocols_item* timeout_protocol(void);
 
 void hexdump(const char*, unsigned int);
 

scripts/systemd.sslh.service

@@ -4,7 +4,7 @@ After=network.target
 
 [Service]
 EnvironmentFile=/etc/conf.d/sslh
-ExecStart=/usr/bin/sslh --foreground $DAEMON_OPTS
+ExecStart=/usr/sbin/sslh --foreground $DAEMON_OPTS
 KillMode=process
 #Hardening
 PrivateTmp=true

sslh-conf.h

@@ -0,0 +1,106 @@
+/* Generated by conf2struct (https://www.rutschle.net/tech/conf2struct/README)
+ * on Fri Jun 19 23:36:04 2020. 
+
+# conf2struct: generate libconf parsers that read to structs
+# Copyright (C) 2018-2019  Yves Rutschle
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+#
+# 1. Redistributions of source code must retain the above copyright notice,
+#    this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+# LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+# POSSIBILITY OF SUCH DAMAGE.
+
+*/
+ 
+#ifndef C2S_SSLHCFG_H
+#define C2S_SSLHCFG_H
+#include <libconfig.h>
+
+
+#include "probe.h"
+#include  <sys/types.h>
+#include  <sys/socket.h>
+#include  <netdb.h>
+
+struct sslhcfg_listen_item {
+	char*	host;
+	char*	port;
+	int	keepalive;
+};
+
+struct sslhcfg_protocols_item {
+	char*	name;
+	char*	host;
+	char*	port;
+	int	service_is_present;
+	char*	service;
+	int	fork;
+	int	tfo_ok;
+	int	log_level;
+	int	keepalive;
+	size_t	sni_hostnames_len;
+	char** sni_hostnames;
+	size_t	alpn_protocols_len;
+	char** alpn_protocols;
+	size_t	regex_patterns_len;
+	char** regex_patterns;
+	int	minlength_is_present;
+	int	minlength;
+	T_PROBE*	probe;
+	struct addrinfo*	saddr;
+	void*	data;
+};
+
+struct sslhcfg_item {
+	int	verbose;
+	int	foreground;
+	int	inetd;
+	int	numeric;
+	int	transparent;
+	int	timeout;
+	int	user_is_present;
+	char*	user;
+	int	pidfile_is_present;
+	char*	pidfile;
+	int	chroot_is_present;
+	char*	chroot;
+	char*	syslog_facility;
+	char*	on_timeout;
+	size_t	listen_len;
+	struct sslhcfg_listen_item* listen;
+	size_t	protocols_len;
+	struct sslhcfg_protocols_item* protocols;
+};
+
+int sslhcfg_parse_file(
+        const char* filename,
+        struct sslhcfg_item* sslhcfg, 
+        const char** errmsg);
+
+void sslhcfg_fprint(
+    FILE* out,
+    struct sslhcfg_item *sslhcfg,
+    int depth);
+
+int sslhcfg_cl_parse(
+    int argc,
+    char* argv[],
+    struct sslhcfg_item *sslhcfg);
+
+#endif

sslh-fork.c

@@ -23,6 +23,10 @@
 #include "common.h"
 #include "probe.h"
 
+#ifdef LIBBSD
+#include <bsd/unistd.h>
+#endif
+
 const char* server_type = "sslh-fork";
 
 #define MAX(a, b)  (((a) > (b)) ? (a) : (b))
@@ -54,7 +58,7 @@ int shovel(struct connection *cnx)
           if (FD_ISSET(cnx->q[i].fd, &fds)) {
               res = fd2fd(&cnx->q[1-i], &cnx->q[i]);
               if (!res) {
-                  if (verbose) 
+                  if (cfg.verbose) 
                       fprintf(stderr, "%s %s", i ? "client" : "server", "socket closed\n");
                   return res;
               }
@@ -72,6 +76,7 @@ void start_shoveler(int in_socket)
    int res = PROBE_AGAIN;
    int out_socket;
    struct connection cnx;
+   struct connection_desc desc;
 
    init_cnx(&cnx);
    cnx.q[0].fd = in_socket;
@@ -79,7 +84,7 @@ void start_shoveler(int in_socket)
    FD_ZERO(&fds);
    FD_SET(in_socket, &fds);
    memset(&tv, 0, sizeof(tv));
-   tv.tv_sec = probing_timeout;
+   tv.tv_sec = cfg.timeout;
 
    while (res == PROBE_AGAIN) {
        /* POSIX does not guarantee that tv will be updated, but the client can
@@ -94,8 +99,8 @@ void start_shoveler(int in_socket)
        } else {
            /* Timed out: it's necessarily SSH */
            cnx.proto = timeout_protocol();
-           if (verbose) 
-               log_message(LOG_INFO, "timed out, connect to %s\n", cnx.proto->description);
+           if (cfg.verbose) 
+               log_message(LOG_INFO, "timed out, connect to %s\n", cnx.proto->name);
            break;
        }
    }
@@ -111,7 +116,9 @@ void start_shoveler(int in_socket)
 
    cnx.q[1].fd = out_socket;
 
-   log_connection(&cnx);
+   get_connection_desc(&desc, &cnx);
+   log_connection(&desc, &cnx);
+   set_proctitle_shovel(&desc, &cnx);
 
    flush_deferred(&cnx.q[1]);
 
@@ -120,7 +127,7 @@ void start_shoveler(int in_socket)
    close(in_socket);
    close(out_socket);
    
-   if (verbose)
+   if (cfg.verbose)
       fprintf(stderr, "connection closed down\n");
 
    exit(0);
@@ -138,6 +145,24 @@ void stop_listeners(int sig)
     }
 }
 
+void set_listen_procname(int listen_socket)
+{
+#ifdef LIBBSD
+    int res;
+    struct addrinfo addr;
+    struct sockaddr_storage ss;
+    char listen_addr[NI_MAXHOST+1+NI_MAXSERV+1];
+
+    addr.ai_addr = (struct sockaddr*)&ss;
+    addr.ai_addrlen = sizeof(ss);
+    res = getsockname(listen_socket, addr.ai_addr, &addr.ai_addrlen);
+    if (res != -1) {
+        sprintaddr(listen_addr, sizeof(listen_addr), &addr);
+        setproctitle("listener %s", listen_addr);
+    }
+#endif
+}
+
 void main_loop(int listen_sockets[], int num_addr_listen)
 {
     int in_socket, i, res;
@@ -145,22 +170,24 @@ void main_loop(int listen_sockets[], int num_addr_listen)
 
     listener_pid_number = num_addr_listen;
     listener_pid = malloc(listener_pid_number * sizeof(listener_pid[0]));
+    CHECK_ALLOC(listener_pid, "malloc");
 
     /* Start one process for each listening address */
     for (i = 0; i < num_addr_listen; i++) {
         listener_pid[i] = fork();
         switch(listener_pid[i]) {
-        case 0: break;
+        // Log if fork() fails for some reason
         case -1: log_message(LOG_ERR, "fork failed: err %d: %s\n", errno, strerror(errno));
                  break;
-
-        default:
+        // We're in the child, we have work to do 
+        case 0:
             /* Listening process just accepts a connection, forks, and goes
              * back to listening */
+            set_listen_procname(listen_sockets[i]);
             while (1)
             {
                 in_socket = accept(listen_sockets[i], 0, 0);
-                if (verbose) fprintf(stderr, "accepted fd %d\n", in_socket);
+                if (cfg.verbose) fprintf(stderr, "accepted fd %d\n", in_socket);
 
                 switch(fork()) {
                 case -1: log_message(LOG_ERR, "fork failed: err %d: %s\n", errno, strerror(errno));
@@ -178,6 +205,10 @@ void main_loop(int listen_sockets[], int num_addr_listen)
                 }
                 close(in_socket);
             }
+	    break;
+	// We're in the parent, we don't need to do anything
+	default:
+	    break;
         }
     }
 

sslh-main.c

@@ -2,7 +2,7 @@
 # main: processing of config file, command line options and start the main
 # loop.
 #
-# Copyright (C) 2007-2016  Yves Rutschle
+# Copyright (C) 2007-2018  Yves Rutschle
 # 
 # This program is free software; you can redistribute it
 # and/or modify it under the terms of the GNU General Public
@@ -33,6 +33,10 @@
 #endif
 #endif
 
+#ifdef LIBBSD
+#include <bsd/unistd.h>
+#endif
+
 #include "common.h"
 #include "probe.h"
 
@@ -40,7 +44,7 @@ const char* USAGE_STRING =
 "sslh " VERSION "\n" \
 "usage:\n" \
 "\tsslh  [-v] [-i] [-V] [-f] [-n] [--transparent] [-F<file>]\n"
-"\t[-t <timeout>] [-P <pidfile>] [-u <username>] [-C <chroot>] -p <add> [-p <addr> ...] \n" \
+"\t[-t <timeout>] [-P <pidfile>] [-u <username>] [-C <chroot>] -p <addr> [-p <addr> ...] \n" \
 "%s\n\n" /* Dynamically built list of builtin protocols */  \
 "\t[--on-timeout <addr>]\n" \
 "-v: verbose\n" \
@@ -62,44 +66,6 @@ const char* USAGE_STRING =
 /* Constants for options that have no one-character shorthand */
 #define OPT_ONTIMEOUT   257
 
-static struct option const_options[] = {
-    { "inetd",      no_argument,            &inetd,         1 },
-    { "foreground", no_argument,            &foreground,    1 },
-    { "background", no_argument,            &background,    1 },
-    { "transparent", no_argument,           &transparent,   1 },
-    { "numeric",    no_argument,            &numeric,       1 },
-    { "verbose",    no_argument,            &verbose,       1 },
-    { "user",       required_argument,      0,              'u' },
-    { "config",     optional_argument,      0,              'F' },
-    { "pidfile",    required_argument,      0,              'P' },
-    { "chroot",     required_argument,      0,              'C' },
-    { "timeout",    required_argument,      0,              't' },
-    { "on-timeout", required_argument,      0,              OPT_ONTIMEOUT },
-    { "listen",     required_argument,      0,              'p' },
-    {}
-};
-static struct option* all_options;
-static struct proto* builtins;
-static const char *optstr = "vt:T:p:VP:C:F::";
-
-
-
-static void print_usage(void)
-{
-    struct proto *p;
-    int i;
-    int res;
-    char *prots = "";
-
-    p = get_builtins();
-    for (i = 0; i < get_num_builtins(); i++) {
-        res = asprintf(&prots, "%s\t[--%s <addr>]\n", prots, p[i].description);
-        CHECK_RES_DIE(res, "asprintf");
-    }
-
-    fprintf(stderr, USAGE_STRING, prots);
-}
-
 static void printcaps(void) {
 #ifdef LIBCAP
     cap_t caps;
@@ -121,12 +87,14 @@ static void printsettings(void)
 {
     char buf[NI_MAXHOST];
     struct addrinfo *a;
-    struct proto *p;
+    int i;
+    struct sslhcfg_protocols_item *p;
     
-    for (p = get_first_protocol(); p; p = p->next) {
+    for (i = 0; i < cfg.protocols_len; i++ ) {
+        p = &cfg.protocols[i];
         fprintf(stderr,
                 "%s addr: %s. libwrap service: %s log_level: %d family %d %d [%s] [%s]\n",
-                p->description, 
+                p->name, 
                 sprintaddr(buf, sizeof(buf), p->saddr), 
                 p->service,
                 p->log_level,
@@ -142,8 +110,34 @@ static void printsettings(void)
                 sprintaddr(buf, sizeof(buf), a), 
                 a->ai_flags & SO_KEEPALIVE ? "keepalive" : "");
     }
-    fprintf(stderr, "timeout: %d\non-timeout: %s\n", probing_timeout,
-            timeout_protocol()->description);
+    fprintf(stderr, "timeout: %d\non-timeout: %s\n", cfg.timeout,
+            timeout_protocol()->name);
+}
+
+
+/* To be removed in v1.21 */
+const char* ssl_err_msg = "Usage of 'ssl' setting is deprecated and will be removed in v1.21. Please use 'tls' instead\n";
+void ssl_to_tls(char* setting)
+{
+    if (!strcmp(setting, "ssl")) {
+        strcpy(setting, "tls"); /* legacy configuration */
+        log_message(LOG_INFO, ssl_err_msg);
+    }
+}
+
+
+/* Turn 'ssl' command line option to 'tls'. To be removed in v1.21 */
+void cmd_ssl_to_tls(int argc, char* argv[])
+{
+    int i;
+    for (i = 0; i < argc; i++) {
+        if (!strcmp(argv[i], "--ssl")) {
+            strcpy(argv[i], "--tls");
+            /* foreground option not parsed yet, syslog not open, just print on
+             * stderr and hope for the best */
+            fprintf(stderr, "%s", ssl_err_msg);
+        }
+    }
 }
 
 
@@ -151,42 +145,23 @@ static void printsettings(void)
  * out: newly allocated list of addrinfo to listen to
  */
 #ifdef LIBCONFIG
-static int config_listen(config_t *config, struct addrinfo **listen) 
+static int config_resolve_listen(struct addrinfo **listen)
 {
-    config_setting_t *setting, *addr;
-    int len, i, keepalive;
-    const char *hostname, *port;
+    int i, res;
+    for (i = 0; i < cfg.listen_len; i++) {
+        res = resolve_split_name(listen, cfg.listen[i].host, cfg.listen[i].port);
+        if (res) return res;
 
-    setting = config_lookup(config, "listen");
-    if (setting) {
-        len = config_setting_length(setting);
-        for (i = 0; i < len; i++) {
-            addr = config_setting_get_elem(setting, i);
-            if (! (config_setting_lookup_string(addr, "host", &hostname) &&
-                   config_setting_lookup_string(addr, "port", &port))) {
-                fprintf(stderr,
-                            "line %d:Incomplete specification (hostname and port required)\n",
-                            config_setting_source_line(addr));
-                return -1;
-            }
-
-            keepalive = 0;
-            config_setting_lookup_bool(addr, "keepalive", &keepalive);
-
-            resolve_split_name(listen, hostname, port);
-
-            /* getaddrinfo returned a list of addresses corresponding to the
-             * specification; move the pointer to the end of that list before
-             * processing the next specification, while setting flags for
-             * start_listen_sockets() through ai_flags (which is not meant for
-             * that, but is only used as hint in getaddrinfo, so it's OK) */
-            for (; *listen; listen = &((*listen)->ai_next)) {
-                if (keepalive)
-                    (*listen)->ai_flags = SO_KEEPALIVE;
-            }
+        /* getaddrinfo returned a list of addresses corresponding to the
+         * specification; move the pointer to the end of that list before
+         * processing the next specification, while setting flags for
+         * start_listen_sockets() through ai_flags (which is not meant for
+         * that, but is only used as hint in getaddrinfo, so it's OK) */
+        for (; *listen; listen = &((*listen)->ai_next)) {
+            if (cfg.listen[i].keepalive)
+                (*listen)->ai_flags = SO_KEEPALIVE;
         }
     }
-
     return 0;
 }
 #endif
@@ -194,437 +169,119 @@ static int config_listen(config_t *config, struct addrinfo **listen)
 
 
 #ifdef LIBCONFIG
-static void setup_regex_probe(struct proto *p, config_setting_t* probes)
+static void setup_regex_probe(struct sslhcfg_protocols_item *p)
 {
-#ifdef ENABLE_REGEX
-    int num_probes, errsize, i, res;
-    char *err;
-    const char * expr;
-    regex_t** probe_list;
+    int num_patterns, i, res;
+    regex_t** pattern_list;
+    size_t errsize;
+    char* err;
 
-    num_probes = config_setting_length(probes);
-    if (!num_probes) {
-        fprintf(stderr, "%s: no probes specified\n", p->description);
-        exit(1);
-    }
+    num_patterns = p->regex_patterns_len;
 
-    p->probe = get_probe("regex");
-    probe_list = calloc(num_probes + 1, sizeof(*probe_list));
-    p->data = (void*)probe_list;
+    pattern_list = calloc(num_patterns + 1, sizeof(*pattern_list));
+    CHECK_ALLOC(pattern_list, "calloc");
+    p->data = (void*)pattern_list;
 
-    for (i = 0; i < num_probes; i++) {
-        probe_list[i] = malloc(sizeof(*(probe_list[i])));
-        expr = config_setting_get_string_elem(probes, i);
-        res = regcomp(probe_list[i], expr, REG_EXTENDED);
+    for (i = 0; i < num_patterns; i++) {
+        pattern_list[i] = malloc(sizeof(*(pattern_list[i])));
+        CHECK_ALLOC(pattern_list[i], "malloc");
+        res = regcomp(pattern_list[i], p->regex_patterns[i], REG_EXTENDED);
         if (res) {
-            err = malloc(errsize = regerror(res, probe_list[i], NULL, 0));
-            regerror(res, probe_list[i], err, errsize);
-            fprintf(stderr, "%s:%s\n", expr, err);
+            err = malloc(errsize = regerror(res, pattern_list[i], NULL, 0));
+            CHECK_ALLOC(err, "malloc");
+            regerror(res, pattern_list[i], err, errsize);
+            fprintf(stderr, "%s:%s\n", p->regex_patterns[i], err);
             free(err);
             exit(1);
         }
     }
-#else
-    fprintf(stderr, "line %d: regex probe specified but not compiled in\n", config_setting_source_line(probes));
-    exit(5);
-#endif
 }
 #endif
 
-#ifdef LIBCONFIG
-static void setup_sni_alpn_list(struct proto *p, config_setting_t* config_items, const char* name, int alpn)
-{
-    int num_probes, i, max_server_name_len, server_name_len;
-    const char * config_item;
-    char** sni_hostname_list;
-
-    num_probes = config_setting_length(config_items);
-    if (!num_probes) {
-        fprintf(stderr, "%s: no %s specified\n", p->description, name);
-        return;
-    }
-
-    max_server_name_len = 0;
-    for (i = 0; i < num_probes; i++) {
-        server_name_len = strlen(config_setting_get_string_elem(config_items, i));
-        if(server_name_len > max_server_name_len)
-            max_server_name_len = server_name_len;
-    }
-
-    sni_hostname_list = calloc(num_probes + 1, ++max_server_name_len);
-
-    for (i = 0; i < num_probes; i++) {
-        config_item = config_setting_get_string_elem(config_items, i);
-        sni_hostname_list[i] = malloc(max_server_name_len);
-        strcpy (sni_hostname_list[i], config_item);
-        if(verbose) fprintf(stderr, "%s: %s[%d]: %s\n", p->description, name, i, sni_hostname_list[i]);
-    }
-
-    p->data = (void*)tls_data_set_list(p->data, alpn, sni_hostname_list);
-}
-
-static void setup_sni_alpn(struct proto *p, config_setting_t* prot)
-{
-    config_setting_t *sni_hostnames, *alpn_protocols;
-
-    p->data = (void*)new_tls_data();
-    sni_hostnames = config_setting_get_member(prot, "sni_hostnames");
-    alpn_protocols = config_setting_get_member(prot, "alpn_protocols");
-
-    if(sni_hostnames && config_setting_is_array(sni_hostnames)) {
-        p->probe = get_probe("sni_alpn");
-        setup_sni_alpn_list(p, sni_hostnames, "sni_hostnames", 0);
-    }
-    if(alpn_protocols && config_setting_is_array(alpn_protocols)) {
-        p->probe = get_probe("sni_alpn");
-        setup_sni_alpn_list(p, alpn_protocols, "alpn_protocols", 1);
-    }
-}
-#endif
-
-/* Extract configuration for protocols to connect to.
- * out: newly-allocated list of protocols
+/* For each protocol in the configuration, resolve address and set up protocol
+ * options if required
  */
-#ifdef LIBCONFIG
-static int config_protocols(config_t *config, struct proto **prots)
+static void config_protocols()
 {
-    config_setting_t *setting, *prot, *patterns;
-    const char *hostname, *port, *name;
-    int i, num_prots;
-    struct proto *p, *prev = NULL;
-
-    setting = config_lookup(config, "protocols");
-    if (setting) {
-        num_prots = config_setting_length(setting);
-        for (i = 0; i < num_prots; i++) {
-            p = calloc(1, sizeof(*p));
-            if (i == 0) *prots = p;
-            if (prev) prev->next = p;
-            prev = p;
-
-            prot = config_setting_get_elem(setting, i);
-            if ((config_setting_lookup_string(prot, "name", &name) &&
-                 config_setting_lookup_string(prot, "host", &hostname) &&
-                 config_setting_lookup_string(prot, "port", &port)
-                )) {
-                p->description = name;
-                config_setting_lookup_string(prot, "service", &(p->service));
-                config_setting_lookup_bool(prot, "keepalive", &p->keepalive);
-                config_setting_lookup_bool(prot, "fork", &p->fork);
-
-                if (config_setting_lookup_int(prot, "log_level", &p->log_level) == CONFIG_FALSE) {
-                    p->log_level = 1;
-                }
-
-                if (resolve_split_name(&(p->saddr), hostname, port)) {
-                    fprintf(stderr, "line %d: cannot resolve %s:%s\n", config_setting_source_line(prot), hostname, port);
-                    exit(1);
-                }
-
-                p->probe = get_probe(name);
-                if (!p->probe || !strcmp(name, "sni_alpn")) {
-                    fprintf(stderr, "line %d: %s: probe unknown\n", config_setting_source_line(prot), name);
-                    exit(1);
-                }
-
-                /* Probe-specific options: regex patterns */
-                if (!strcmp(name, "regex")) {
-                    patterns = config_setting_get_member(prot, "regex_patterns");
-                    if (patterns && config_setting_is_array(patterns)) {
-                        setup_regex_probe(p, patterns);
-                    }
-                }
-
-                /* Probe-specific options: SNI/ALPN */
-                if (!strcmp(name, "tls")) {
-                    setup_sni_alpn(p, prot);
-                }
-
-            } else {
-                fprintf(stderr, "line %d: Illegal protocol description (missing name, host or port)\n", config_setting_source_line(prot));
-                exit(1);
-            }
-        }
-    }
-
-    return 0;
-}
-#endif
-
-/* Parses a config file
- * in: *filename
- * out: *listen, a newly-allocated linked list of listen addrinfo
- *      *prots, a newly-allocated linked list of protocols
- *      1 on error, 0 on success
- */
-#ifdef LIBCONFIG
-static int config_parse(char *filename, struct addrinfo **listen, struct proto **prots)
-{
-    config_t config;
-    int timeout;
-    const char* str;
-
-    config_init(&config);
-    if (config_read_file(&config, filename) == CONFIG_FALSE) {
-        /* If it's a parse error then there will be a line number for the failure
-         * an I/O error (such as non-existent file) will have the error line as 0
-         */
-        if (config_error_line(&config) != 0) {
-            fprintf(stderr, "%s:%d:%s\n", 
-                    filename,
-                    config_error_line(&config),
-                    config_error_text(&config));
+    int i;
+    for (i = 0; i < cfg.protocols_len; i++) {
+        struct sslhcfg_protocols_item* p = &(cfg.protocols[i]);
+        if (resolve_split_name(&(p->saddr), p->host, p->port)) {
+            fprintf(stderr, "cannot resolve %s:%s\n", p->host, p->port);
             exit(1);
         }
-        fprintf(stderr, "%s:%s\n", 
-                filename,
-                config_error_text(&config));
-        return 1;
-    }
 
-    if(config_lookup_bool(&config, "verbose", &verbose) == CONFIG_FALSE) {
-	config_lookup_int(&config, "verbose", &verbose);
-    }
-
-    config_lookup_bool(&config, "inetd", &inetd);
-    config_lookup_bool(&config, "foreground", &foreground);
-    config_lookup_bool(&config, "numeric", &numeric);
-    config_lookup_bool(&config, "transparent", &transparent);
-
-    if (config_lookup_int(&config, "timeout", (int *)&timeout) == CONFIG_TRUE) {
-        probing_timeout = timeout;
-    }
-
-    if (config_lookup_string(&config, "on-timeout", &str)) {
-        set_ontimeout(str);
-    }
-
-    config_lookup_string(&config, "user", &user_name);
-    config_lookup_string(&config, "pidfile", &pid_file);
-    config_lookup_string(&config, "chroot", &chroot_path);
-
-    config_lookup_string(&config, "syslog_facility", &facility);
-
-    config_listen(&config, listen);
-    config_protocols(&config, prots);
-
-    return 0;
-}
-#endif
-
-/* Adds protocols to the list of options, so command-line parsing uses the
- * protocol definition array 
- * options: array of options to add to; must be big enough
- * n_opts: number of options in *options before calling (i.e. where to append)
- * prot: array of protocols
- * n_prots: number of protocols in *prot
- * */
-static void append_protocols(struct option *options, int n_opts, struct proto *prot , int n_prots)
-{
-    int o, p;
-
-    for (o = n_opts, p = 0; p < n_prots; o++, p++) {
-        options[o].name = prot[p].description;
-        options[o].has_arg = required_argument;
-        options[o].flag = 0;
-        options[o].val = p + PROT_SHIFT;
-    }
-}
-
-static void make_alloptions(void)
-{
-    builtins = get_builtins();
-
-    /* Create all_options, composed of const_options followed by one option per
-     * known protocol */
-    all_options = calloc(ARRAY_SIZE(const_options) + get_num_builtins(), sizeof(struct option));
-    memcpy(all_options, const_options, sizeof(const_options));
-    append_protocols(all_options, ARRAY_SIZE(const_options) - 1, builtins, get_num_builtins());
-}
-
-/* Performs a first scan of command line options to see if a configuration file
- * is specified. If there is one, parse it now before all other options (so
- * configuration file settings can be overridden from the command line).
- *
- * prots: newly-allocated list of configured protocols, if any.
- */
-static void cmdline_config(int argc, char* argv[], struct proto** prots)
-{
-#ifdef LIBCONFIG
-    int c, res;
-    char *config_filename;
-#endif
-
-    make_alloptions();
-
-#ifdef LIBCONFIG
-    optind = 1;
-    opterr = 0; /* we're missing protocol options at this stage so don't output errors */
-    while ((c = getopt_long_only(argc, argv, optstr, all_options, NULL)) != -1) {
-        if (c == 'v') {
-            verbose++;
-        }
-        if (c == 'F') {
-            config_filename = optarg;
-            if (config_filename) {
-                res = config_parse(config_filename, &addr_listen, prots);
-            } else {
-                /* No configuration file specified -- try default file locations */
-                res = config_parse("/etc/sslh/sslh.cfg", &addr_listen, prots);
-                if (!res && verbose) fprintf(stderr, "Using /etc/sslh/sslh.cfg\n");
-                if (res) {
-                    res = config_parse("/etc/sslh.cfg", &addr_listen, prots);
-                    if (!res && verbose) fprintf(stderr, "Using /etc/sslh.cfg\n");
-                }
-            }
-            if (res)
-                exit(4);
-            break;
-        }
-    }
-#endif
-}
-
-
-/* Parse command-line options. prots points to a list of configured protocols,
- * potentially non-allocated */
-static void parse_cmdline(int argc, char* argv[], struct proto* prots)
-{
-    int c;
-    struct addrinfo **a;
-    struct proto *p;
-
-    optind = 1;
-    opterr = 1;
-next_arg:
-    while ((c = getopt_long_only(argc, argv, optstr, all_options, NULL)) != -1) {
-        if (c == 0) continue;
-
-        if (c >= PROT_SHIFT) {
-            if (prots)
-                for (p = prots; p && p->next; p = p->next) {
-                    /* override if protocol was already defined by config file 
-                     * (note it only overrides address and use builtin probe) */
-                    if (!strcmp(p->description, builtins[c-PROT_SHIFT].description)) {
-                        resolve_name(&(p->saddr), optarg);
-                        p->probe = builtins[c-PROT_SHIFT].probe;
-                        goto next_arg;
-                    }
-                }
-            /* At this stage, it's a new protocol: add it to the end of the
-             * list */
-            if (!prots) {
-                /* No protocols yet -- create the list */
-                p = prots = calloc(1, sizeof(*p));
-            } else {
-                p->next = calloc(1, sizeof(*p));
-                p = p->next;
-            }
-            memcpy(p, &builtins[c-PROT_SHIFT], sizeof(*p));
-            resolve_name(&(p->saddr), optarg);
-            continue;
-        }
-
-        switch (c) {
-
-        case 'F':
-            /* Legal option, but do nothing, it was already processed in
-             * cmdline_config() */
-#ifndef LIBCONFIG
-            fprintf(stderr, "Built without libconfig support: configuration file not available.\n");
+        p->probe = get_probe(p->name);
+        if (!p->probe) {
+            fprintf(stderr, "%s: probe unknown\n", p->name);
             exit(1);
-#endif
-            break;
+        }
 
-        case 't':
-             probing_timeout = atoi(optarg);
-            break;
+        if (!strcmp(cfg.protocols[i].name, "regex")) {
+            setup_regex_probe(&cfg.protocols[i]);
+        }
 
-        case OPT_ONTIMEOUT:
-            set_ontimeout(optarg);
-            break;
-
-        case 'p':
-            /* find the end of the listen list */
-            for (a = &addr_listen; *a; a = &((*a)->ai_next));
-            /* append the specified addresses */
-            resolve_name(a, optarg);
-            
-            break;
-
-        case 'V':
-            printf("%s %s\n", server_type, VERSION);
-            exit(0);
-
-        case 'u':
-            user_name = optarg;
-            break;
-
-        case 'P':
-            pid_file = optarg;
-            break;
-
-        case 'C':
-            chroot_path = optarg;
-            break;
-
-        case 'v':
-            verbose++;
-            break;
-
-        default:
-            print_usage();
-            exit(2);
+        if (!strcmp(cfg.protocols[i].name, "tls")) {
+            cfg.protocols[i].data = (void*)new_tls_data();
+            if (cfg.protocols[i].sni_hostnames_len)
+                tls_data_set_list(cfg.protocols[i].data, 0,
+                                  (const char**) cfg.protocols[i].sni_hostnames,
+                                  cfg.protocols[i].sni_hostnames_len);
+            if (cfg.protocols[i].alpn_protocols_len)
+                tls_data_set_list(cfg.protocols[i].data, 1, 
+                                  (const char**) cfg.protocols[i].alpn_protocols,
+                                  cfg.protocols[i].alpn_protocols_len);
         }
     }
+}
 
-    if (!prots) {
+
+void config_sanity_check(struct sslhcfg_item* cfg) {
+    if (!cfg->protocols_len) {
         fprintf(stderr, "At least one target protocol must be specified.\n");
         exit(2);
     }
 
-    set_protocol_list(prots);
-
 /* If compiling with systemd socket support no need to require listen address */
 #ifndef SYSTEMD
-    if (!addr_listen && !inetd) {
+    if (!addr_listen && !cfg->inetd) {
         fprintf(stderr, "No listening address specified; use at least one -p option\n");
         exit(1);
     }
 #endif
-
-    /* Did command-line override foreground setting? */
-    if (background)
-        foreground = 0;
-
 }
 
-int main(int argc, char *argv[])
+
+int main(int argc, char *argv[], char* envp[])
 {
 
    extern char *optarg;
    extern int optind;
    int res, num_addr_listen;
-   struct proto* protocols = NULL;
-
    int *listen_sockets;
 
-   /* Init defaults */
-   pid_file = NULL;
-   user_name = NULL;
-   chroot_path = NULL;
+#ifdef LIBBSD
+   setproctitle_init(argc, argv, envp);
+#endif
 
-   cmdline_config(argc, argv, &protocols);
-   parse_cmdline(argc, argv, protocols);
+   memset(&cfg, 0, sizeof(cfg));
+   res = sslhcfg_cl_parse(argc, argv, &cfg);
+   if (!res) exit(1);
+   if (cfg.verbose > 3)
+       sslhcfg_fprint(stderr, &cfg, 0);
+   res = config_resolve_listen(&addr_listen);
+   if (res) exit(4);
+   config_protocols();
+   config_sanity_check(&cfg);
 
-   if (inetd)
+   if (cfg.inetd)
    {
-       verbose = 0;
+       cfg.verbose = 0;
        start_shoveler(0);
        exit(0);
    }
 
-   if (verbose)
+   if (cfg.verbose)
        printsettings();
 
    num_addr_listen = start_listen_sockets(&listen_sockets, addr_listen);
@@ -636,7 +293,7 @@ int main(int argc, char *argv[])
     }
 #endif
 
-   if (!foreground) {
+   if (!cfg.foreground) {
        if (fork() > 0) exit(0); /* Detach */
 
        /* New session -- become group leader */
@@ -648,16 +305,16 @@ int main(int argc, char *argv[])
 
    setup_signals();
 
-   if (pid_file)
-       write_pid_file(pid_file);
+   if (cfg.pidfile)
+       write_pid_file(cfg.pidfile);
 
    /* Open syslog connection before we drop privs/chroot */
    setup_syslog(argv[0]);
 
-   if (user_name || chroot_path)
-       drop_privileges(user_name, chroot_path);
+   if (cfg.user || cfg.chroot)
+       drop_privileges(cfg.user, cfg.chroot);
 
-   if (verbose)
+   if (cfg.verbose)
        printcaps();
 
    main_loop(listen_sockets, num_addr_listen);

sslh-select.c

@@ -44,12 +44,12 @@ int set_nonblock(int fd)
     int flags;
 
     flags = fcntl(fd, F_GETFL);
-    CHECK_RES_RETURN(flags, "fcntl");
+    CHECK_RES_RETURN(flags, "fcntl", -1);
 
     flags |= O_NONBLOCK;
 
     flags = fcntl(fd, F_SETFL, flags);
-    CHECK_RES_RETURN(flags, "fcntl");
+    CHECK_RES_RETURN(flags, "fcntl", -1);
 
     return flags;
 }
@@ -60,7 +60,7 @@ int tidy_connection(struct connection *cnx, fd_set *fds, fd_set *fds2)
 
     for (i = 0; i < 2; i++) {
         if (cnx->q[i].fd != -1) {
-            if (verbose)
+            if (cfg.verbose)
                 fprintf(stderr, "closing fd %d\n", cnx->q[i].fd);
 
             FD_CLR(cnx->q[i].fd, fds);
@@ -93,7 +93,7 @@ int accept_new_connection(int listen_socket, struct connection *cnx[], int* cnx_
     struct connection *new;
 
     in_socket = accept(listen_socket, 0, 0);
-    CHECK_RES_RETURN(in_socket, "accept");
+    CHECK_RES_RETURN(in_socket, "accept", -1);
 
     if (!fd_is_in_range(in_socket)) {
         close(in_socket);
@@ -111,7 +111,7 @@ int accept_new_connection(int listen_socket, struct connection *cnx[], int* cnx_
         /* nothing */
     }
     if (free >= *cnx_size)  {
-        if (verbose)
+        if (cfg.verbose)
             fprintf(stderr, "buying more slots from the slot machine.\n");
         new = realloc(*cnx, (*cnx_size + cnx_num_alloc) * sizeof((*cnx)[0]));
         if (!new) {
@@ -127,9 +127,9 @@ int accept_new_connection(int listen_socket, struct connection *cnx[], int* cnx_
     }
     (*cnx)[free].q[0].fd = in_socket;
     (*cnx)[free].state = ST_PROBING;
-    (*cnx)[free].probe_timeout = time(NULL) + probing_timeout;
+    (*cnx)[free].probe_timeout = time(NULL) + cfg.timeout;
 
-    if (verbose) 
+    if (cfg.verbose) 
         fprintf(stderr, "accepted fd %d on slot %d\n", in_socket, free);
 
     return in_socket;
@@ -143,7 +143,7 @@ int connect_queue(struct connection *cnx, fd_set *fds_r, fd_set *fds_w)
 
     q->fd = connect_addr(cnx, cnx->q[0].fd);
     if ((q->fd != -1) && fd_is_in_range(q->fd)) {
-        log_connection(cnx);
+        log_connection(NULL, cnx);
         set_nonblock(q->fd);
         flush_deferred(q);
         if (q->deferred_data) {
@@ -169,7 +169,7 @@ void shovel(struct connection *cnx, int active_fd,
     read_q = &cnx->q[active_fd];
     write_q = &cnx->q[1-active_fd];
 
-    if (verbose)
+    if (cfg.verbose)
         fprintf(stderr, "activity on fd%d\n", read_q->fd);
 
     switch(fd2fd(write_q, read_q)) {
@@ -223,7 +223,7 @@ void shovel_single(struct connection *cnx)
           if (FD_ISSET(cnx->q[i].fd, &fds_w)) {
               res = flush_deferred(&cnx->q[i]);
               if ((res == -1) && ((errno == EPIPE) || (errno == ECONNRESET))) {
-                  if (verbose)
+                  if (cfg.verbose)
                       fprintf(stderr, "%s socket closed\n", i ? "server" : "client");
                   return;
               }
@@ -231,7 +231,7 @@ void shovel_single(struct connection *cnx)
           if (FD_ISSET(cnx->q[i].fd, &fds_r)) {
               res = fd2fd(&cnx->q[1-i], &cnx->q[i]);
               if (!res) {
-                  if (verbose)
+                  if (cfg.verbose)
                       fprintf(stderr, "socket closed\n");
                   return;
               }
@@ -262,14 +262,14 @@ void connect_proxy(struct connection *cnx)
 
     cnx->q[1].fd = out_socket;
 
-    log_connection(cnx);
+    log_connection(NULL, cnx);
 
     shovel_single(cnx);
 
     close(in_socket);
     close(out_socket);
 
-    if (verbose)
+    if (cfg.verbose)
         fprintf(stderr, "connection closed down\n");
 
     exit(0);
@@ -301,7 +301,8 @@ void main_loop(int listen_sockets[], int num_addr_listen)
     fd_set fds_r, fds_w;  /* reference fd sets (used to init the next 2) */
     fd_set readfds, writefds; /* working read and write fd sets */
     struct timeval tv;
-    int max_fd, in_socket, i, j, res;
+    int max_fd, i, j, res;
+    int in_socket = 0;
     struct connection *cnx;
     int num_cnx;  /* Number of connections in *cnx */
     int num_probing = 0; /* Number of connections currently probing 
@@ -321,18 +322,19 @@ void main_loop(int listen_sockets[], int num_addr_listen)
 
     num_cnx = cnx_num_alloc; /* Start with a set pool of slots */
     cnx = malloc(num_cnx * sizeof(struct connection));
+    CHECK_ALLOC(cnx, "malloc");
     for (i = 0; i < num_cnx; i++)
         init_cnx(&cnx[i]);
 
     while (1)
     {
         memset(&tv, 0, sizeof(tv));
-        tv.tv_sec = probing_timeout;
+        tv.tv_sec = cfg.timeout;
 
         memcpy(&readfds, &fds_r, sizeof(readfds));
         memcpy(&writefds, &fds_w, sizeof(writefds));
 
-        if (verbose)
+        if (cfg.verbose)
             fprintf(stderr, "selecting... max_fd=%d num_probing=%d\n", max_fd, num_probing);
         res = select(max_fd, &readfds, &writefds, NULL, num_probing ? &tv : NULL);
         if (res < 0)
@@ -361,7 +363,7 @@ void main_loop(int listen_sockets[], int num_addr_listen)
                         if ((res == -1) && ((errno == EPIPE) || (errno == ECONNRESET))) {
                             if (cnx[i].state == ST_PROBING) num_probing--;
                             tidy_connection(&cnx[i], &fds_r, &fds_w);
-                            if (verbose)
+                            if (cfg.verbose)
                                 fprintf(stderr, "closed slot %d\n", i);
                         } else {
                             /* If no deferred data is left, stop monitoring the fd 
@@ -381,7 +383,7 @@ void main_loop(int listen_sockets[], int num_addr_listen)
             for (j = 0; j < 2; j++) {
                 if (is_fd_active(cnx[i].q[j].fd, &readfds) || 
                     ((cnx[i].state == ST_PROBING) && (cnx[i].probe_timeout < time(NULL)))) {
-                    if (verbose)
+                    if (cfg.verbose)
                         fprintf(stderr, "processing fd%d slot %d\n", j, i);
 
                     switch (cnx[i].state) {
@@ -397,10 +399,10 @@ void main_loop(int listen_sockets[], int num_addr_listen)
                          * data so probe the protocol */
                         if ((cnx[i].probe_timeout < time(NULL))) {
                             cnx[i].proto = timeout_protocol();
-                            if (verbose) 
+                            if (cfg.verbose) 
                                 log_message(LOG_INFO, 
                                             "timed out, connect to %s\n", 
-                                            cnx[i].proto->description);
+                                            cnx[i].proto->name);
                         } else {
                             res = probe_client_protocol(&cnx[i]);
                             if (res == PROBE_AGAIN)

sslh.pod

@@ -95,7 +95,11 @@ protocol (which should usually be SSH). Default is 2s.
 =item B<--on-timeout> I<protocol name>
 
 Name of the protocol to connect to after the timeout period
-is over. Default is 'ssh'.
+is over. Default is to forward to the first specified
+protocol. It usually makes sense to specify 'ssh' as the
+timeout protocol, as the SSH specification does not tell
+who is supposed to speak first and a large number of SSH
+clients wait for the server to send its banner.
 
 =item B<--transparent>
 
@@ -127,7 +131,7 @@ inside your network to just connect directly to B<httpd>.
 Also, B<sslh> probes for SSLv3 (or TLSv1) handshake and will
 reject connections from clients requesting SSLv2. This is
 compliant with RFC6176 which prohibits the usage of SSLv2. If
-you wish to accept SSLv2, use B<--default> instead.
+you wish to accept SSLv2, use B<--anyprot> instead.
 
 =item B<--ssh> I<target address>
 

sslhconf.cfg

@@ -0,0 +1,216 @@
+# This is a configuration file for the configuration
+# generator: it is used by
+# conf2struct(http://www.rutschle.net/tech/conf2struct/README.html)
+# to generate the config file and command line parser in
+# sslh-conf.c
+
+header: "sslh-conf.h";
+parser: "sslh-conf.c";
+
+printer: true;
+
+conffile_option: ("F", "conffile");
+
+# List of includes to define runtime types
+# (bug in libconfig? if swallows the brackets if they start
+# the string)
+includes: (
+           "probe.h",
+           " <sys/types.h>",
+           " <sys/socket.h>",
+           " <netdb.h>"
+          );
+
+config: {
+         name : "sslhcfg",
+         type: "list",
+         items: (
+            { name: "verbose"; type: "int"; default: 0; short: "v"; },
+            { name: "foreground"; type: "bool"; default: false;
+              short: "f";
+              description: "Run in foreground instead of as a daemon"; },
+            { name: "inetd"; type: "bool"; default: false;
+              short: "i";
+              description: "Run in inetd mode: use stdin/stdout instead of network listen"; },
+            { name: "numeric"; type: "bool"; default: false;
+              short: "n";
+              description: "Print IP addresses and ports as numbers"; },
+            { name: "transparent"; type: "bool"; default: false;
+              description: "Set up as a transparent proxy"; },
+            { name: "timeout"; type: "int"; default: 5; 
+              short: "t";
+              description: "Set up timeout before connecting to default target"; },
+            { name: "user"; type: "string"; optional: true; 
+              short: "u";
+              description: "Username to change to after set-up"; },
+            { name: "pidfile"; type: "string"; optional: true; 
+              short: "P"; argdesc: "<file>";
+              description: "Path to file to store PID of current instance"; },
+            { name: "chroot"; type: "string"; optional: true;
+              short: "C"; argdesc: "<path>";
+              description: "Root to change to after set-up"; },
+            { name: "syslog_facility"; type: "string"; default: "auth"; 
+              description: "Facility to syslog to"; },
+
+            { name: "on-timeout"; type: "string"; default: "ssh"; 
+              description: "Target to connect to when timing out"; },
+
+            { name: "listen", 
+                no_cl_accessors: true;  # disable generation of individual cl options for each group element (we create a specific --listen option further below)
+                type: "list", 
+                items: (
+                    { name: "host"; type: "string"; var: true; },
+                    { name: "port"; type: "string"; var: true; },
+                    { name: "keepalive"; type: "bool"; default: false; }
+                )
+            },
+
+            { name: "protocols",
+                no_cl_accessors: true;
+                type: "list",
+                items: (
+                    { name: "name"; type: "string"; },
+                    { name: "host"; type: "string"; var: true; },
+                    { name: "port"; type: "string"; var: true; },
+                    { name: "service"; type: "string"; optional: true; },
+                    { name: "fork"; type: "bool"; default: false },
+                    { name: "tfo_ok"; type: "bool"; default: false;
+                        description: "Set to true if this protocol supports TCP FAST OPEN" },
+                    { name: "log_level"; type: "int"; default: 1 },
+                    { name: "keepalive"; type: "bool"; default: false },
+                    { name: "sni_hostnames",
+                        type: "array", 
+                        element_type: "string"
+                    },
+                    { name: "alpn_protocols",
+                    type: "array",
+                    element_type: "string" 
+                    },
+                    { name: "regex_patterns",
+                    type: "array",
+                    element_type: "string"
+                    },
+                    { name: "minlength"; type: "int"; optional: true },
+
+                    # Runtime data
+                    { name: "probe"; type: "runtime"; c_type: "T_PROBE*" },
+                    { name: "saddr"; type: "runtime"; c_type: "struct addrinfo*" },
+                    { name: "data"; type: "runtime"; c_type: "void*" }
+                )
+            }
+        )
+}
+
+# Command line for list settings: additional options that
+# can set up several settings at once. Each option will
+# create a new group setting entry if required (with
+# defaults set up)
+# This only works with string targets
+# This may not be the right abstraction at all and way too
+# sslh-centric
+cl_groups: (
+    { name: "listen"; pattern: "(.+):(\w+)"; description: "Listen on host:port";
+      short: "p"; argdesc: "<host:port>";
+        list: "listen";
+        # no override, this just adds to the list (and thus can be specified several times)
+        targets: (
+        { path: "host"; value: "$1" },
+        { path: "port"; value: "$2" }
+        );
+    },
+    { name: "ssh"; pattern: "(.+):(\w+)";  description: "Set up ssh target";
+        list: "protocols"; # List name that we're defining with this command line option
+        override: "name";  # Field in the group to override.  If not found in list, add an item
+                           # (it's mandatory to have that field as one of the targets
+                           # below)
+        argdesc: "<host:port>";
+        targets: (
+        { path: "name"; value: "ssh" },
+        { path: "host"; value: "$1" },
+        { path: "port"; value: "$2" },
+        { path: "fork"; value: 1 },
+        { path: "log_level"; value: 1 },
+        { path: "tfo_ok"; value: 1 }
+        );
+    },
+    { name: "tls"; pattern: "(.+):(\w+)"; description: "Set up TLS/SSL target";
+        list: "protocols";
+        override: "name";
+        argdesc: "<host:port>";
+        targets: (
+        { path: "name"; value: "tls" },
+        { path: "host"; value: "$1" },
+        { path: "port"; value: "$2" },
+        { path: "log_level"; value: 1 },
+        { path: "tfo_ok"; value: 1 }
+        );
+    },
+    { name: "openvpn"; pattern: "(.+):(\w+)"; description: "Set up OpenVPN target";
+        list: "protocols";
+        override: "name";
+        argdesc: "<host:port>";
+        targets: (
+        { path: "name"; value: "openvpn" },
+        { path: "host"; value: "$1" },
+        { path: "port"; value: "$2" },
+        { path: "log_level"; value: 1 },
+        { path: "tfo_ok"; value: 1 }
+        );
+    },
+    { name: "tinc"; pattern: "(.+):(\w+)"; description: "Set up tinc target";
+        list: "protocols";
+        override: "name";
+        argdesc: "<host:port>";
+        targets: (
+        { path: "name"; value: "openvpn" },
+        { path: "host"; value: "$1" },
+        { path: "port"; value: "$2" },
+        { path: "log_level"; value: 1 },
+        { path: "tfo_ok"; value: 1 }
+        );
+    },
+    { name: "xmpp"; pattern: "(.+):(\w+)"; description: "Set up XMPP target";
+        list: "protocols";
+        override: "name";
+        argdesc: "<host:port>";
+        targets: (
+        { path: "name"; value: "xmpp" },
+        { path: "host"; value: "$1" },
+        { path: "port"; value: "$2" },
+        { path: "log_level"; value: 1 }
+        );
+    },
+    { name: "http"; pattern: "(.+):(\w+)"; description: "Set up HTTP (plain) target";
+        list: "protocols";
+        override: "name";
+        argdesc: "<host:port>";
+        targets: (
+        { path: "name"; value: "http" },
+        { path: "host"; value: "$1" },
+        { path: "port"; value: "$2" },
+        { path: "log_level"; value: 1 }
+        );
+    },
+    { name: "adb"; pattern: "(.+):(\w+)"; description: "Set up ADB (Android Debug) target";
+        list: "protocols";
+        override: "name";
+        argdesc: "<host:port>";
+        targets: (
+        { path: "name"; value: "adb" },
+        { path: "host"; value: "$1" },
+        { path: "port"; value: "$2" },
+        { path: "log_level"; value: 1 }
+        );
+    },
+    { name: "socks5"; pattern: "(.+):(\w+)"; description: "Set up socks5 target";
+        list: "protocols";
+        override: "name";
+        argdesc: "<host:port>";
+        targets: (
+        { path: "name"; value: "socks5" },
+        { path: "host"; value: "$1" },
+        { path: "port"; value: "$2" },
+        { path: "log_level"; value: 1 }
+        );
+    }
+)

systemd-sslh-generator.c

@@ -2,12 +2,14 @@
 #include <stdio.h>
 #include <string.h>
 #include <stdlib.h>
+#include "common.h"
 
 
 static char* resolve_listen(const char *hostname, const char *port) {
     /* Need room in the strcat for \0 and :
      * the format in the socket unit file is hostname:port */
-    char *conn = (char*)malloc(strlen(hostname)+strlen(port)+2);
+    char *conn = malloc(strlen(hostname)+strlen(port)+2);
+    CHECK_ALLOC(conn, "malloc");
     strcpy(conn, hostname);
     strcat(conn, ":");
     strcat(conn, port);
@@ -41,6 +43,7 @@ static int get_listen_from_conf(const char *filename, char **listen[]) {
 	    int i;
             len = config_setting_length(setting);
             *listen = malloc(len * sizeof(**listen));
+            CHECK_ALLOC(*listen, "malloc");
             for (i = 0; i < len; i++) {
                 addr = config_setting_get_elem(setting, i);
                 if (! (config_setting_lookup_string(addr, "host", &hostname) &&
@@ -51,6 +54,7 @@ static int get_listen_from_conf(const char *filename, char **listen[]) {
                     return -1;
                 } else {
                     (*listen)[i] = malloc(strlen(resolve_listen(hostname, port)));
+                    CHECK_ALLOC((*listen)[i], "malloc");
                     strcpy((*listen)[i], resolve_listen(hostname, port));
                 }
             }
@@ -115,6 +119,7 @@ static int gen_sslh_config(char *runtime_unit_dir) {
         size_t uf_len = strlen(unit_file);
         size_t runtime_len = strlen(runtime_unit_dir) + uf_len + 1;
         char *runtime_conf = malloc(runtime_len);
+        CHECK_ALLOC(runtime_conf, "malloc");
         strcpy(runtime_conf, runtime_unit_dir);
         strcat(runtime_conf, unit_file);
         runtime_conf_fd = fopen(runtime_conf, "w");

t

@@ -2,27 +2,30 @@
 
 # Test script for sslh
 
+# Uses Conf::Libconfig to read sslh config file: install
+# with:
+# cpan Conf::Libconfig
+
 use strict;
 use IO::Socket::INET6;
 use Test::More qw/no_plan/;
+use Conf::Libconfig;
 
-# We use ports 9000, 9001 and 9002 -- hope that won't clash
-# with anything...
-my $ssh_address = "ip6-localhost:9000";
-my $ssl_address = "ip6-localhost:9001";
-my $sslh_port = 9002;
-my $no_listen = 9003;  # Port on which no-one listens
-my $pidfile = "/tmp/sslh_test.pid";
+my $conf = new Conf::Libconfig;
+$conf->read_file("test.cfg");
+
+
+my $no_listen = 8083;  # Port on which no-one listens
+my $pidfile = $conf->lookup_value("pidfile");
+my $sslh_port = $conf->fetch_array("listen")->[0]->{port};
+my $user = (getpwuid $<)[0]; # Run under current username
 
 # Which tests do we run
-my $SSL_CNX =           1;
 my $SSH_SHY_CNX =       1;
-my $SSH_BOLD_CNX =      1;
-my $SSH_PROBE_AGAIN =   1;
+my $PROBES_NOFRAG =     1;
+my $PROBES_AGAIN =      1;
 my $SSL_MIX_SSH =       1;
 my $SSH_MIX_SSL =       1;
-my $BIG_MSG =           0; # This test is unreliable
-my $STALL_CNX =         0; # This test needs fixing
 
 # Robustness tests. These are mostly to achieve full test
 # coverage, but do not necessarily result in an actual test
@@ -32,56 +35,199 @@ my $RB_CNX_NOSERVER =           1;
 my $RB_PARAM_NOHOST =           1;
 my $RB_WRONG_USERNAME =         1;
 my $RB_OPEN_PID_FILE =          1;
-my $RB_BIND_ADDRESS =           1;
 my $RB_RESOLVE_ADDRESS =        1;
 
 `lcov --directory . --zerocounters`;
 
+sub verbose_exec
+{
+    my ($cmd) = @_;
 
-my ($ssh_pid, $ssl_pid);
-
-if (!($ssh_pid = fork)) {
-    exec "./echosrv --listen $ssh_address --prefix 'ssh: '";
+    warn "$cmd\n";
+    if (!fork) {
+        exec $cmd;
+    }
 }
 
-if (!($ssl_pid = fork)) {
-    exec "./echosrv --listen $ssl_address --prefix 'ssl: '";
+# We want to keep track of tests to print a report at the
+# end, so we centralise all calls to Test::More::is here
+my $cnt = 1;   # test counter
+my @results;
+sub my_is {
+    my ($a, $b, $desc) = @_;
+
+    my $res =  is($a, $b, $desc);
+    push @results, [$cnt++, $desc, $res];
 }
 
+
+
+# For SNI/ALPN, build a protocol name as such:
+# tls:sni1,sni2,...;alpn1,alpn2,...
+# input: a protocol entry from Libconfig
+sub make_sni_alpn_name {
+    my ($prot) = @_;
+
+   return "tls:" . (join ",", @{$prot->{sni_hostnames} // []})
+           . ";" . (join ",", @{$prot->{alpn_protocols} // [] });
+}
+
+
+# Tests one probe: given input data, connect, verify we get
+# the expected server, verify shoveling works
+# Named options:
+# data: what to write
+# expected: expected protocol prefix
+# no_frag: don't print byte-per-byte
+sub test_probe {
+    my (%opts) = @_;
+
+    my $cnx = new IO::Socket::INET(PeerHost => "localhost:$sslh_port");
+    warn "$!\n" unless $cnx;
+    return unless $cnx;
+
+    my $pattern = $opts{data};
+    if ($opts{no_frag}) {
+        syswrite $cnx, $pattern;
+    } else {
+        while (length $pattern) {
+            syswrite $cnx, (substr $pattern, 0, 1, '');
+            select undef, undef, undef, .01;
+        }
+    }
+
+    my $data;
+    my $n = sysread $cnx, $data, 1024;
+    $data =~ /^(.*?): /;
+    my $prefix = $1;
+    $data =~ s/$prefix: //g;
+    print "Received $n bytes: protocol $prefix data [$data]\n";
+    close $cnx;
+
+    $opts{expected} =~ s/^ssl/tls/; # to remove in 1.21
+    my_is($prefix, $opts{expected}, "$opts{binary}:$opts{expected}: probe connected correctly");
+    my_is($data, $opts{data}, "$opts{binary}:$opts{expected}: data shoveled correctly");
+}
+
+# Test all probes, with or without fragmentation
+# options:
+#     no_frag: write test patterns all at once (also
+#     available per-protocol as some probes don't support
+#     fragmentation)
+sub test_probes {
+    my (%in_opts) = @_;
+
+    my @probes = @{$conf->fetch_array("protocols")};
+    foreach my $p (@probes) {
+        my %protocols = (
+            'ssh' => { data => "SSH-2.0 tester" },
+            'socks5' => { data => "\x05\x04\x01\x02\x03\x04" },
+            'http' => { 
+                data => "GET index.html HTTP/1.1",
+                no_frag => 1 },
+            'ssl' => {
+                data => "\x16\x03\x01\x00\xab\x01\x00\x00\xa7\x03\x03\x89\x22\x33\x95\x43\x7a\xc3\x89\x45\x51\x12\x3c\x28\x24\x1b\x6a\x78\xbf\xbe\x95\xd8\x90\x58\xd7\x65\xf7\xbb\x2d\xb2\x8d\xa0\x75\x00\x00\x38\xc0\x2c\xc0\x30\x00\x9f\xcc\xa9\xcc\xa8\xcc\xaa\xc0\x2b\xc0\x2f\x00\x9e\xc0\x24\xc0\x28\x00\x6b\xc0\x23\xc0\x27\x00\x67\xc0\x0a\xc0\x14\x00\x39\xc0\x09\xc0\x13\x00\x33\x00\x9d\x00\x9c\x00\x3d\x00\x3c\x00\x35\x00\x2f\x00\xff\x01\x00\x00\x46\x00\x0b\x00\x04\x03\x00\x01\x02\x00\x0a\x00\x0a\x00\x08\x00\x1d\x00\x17\x00\x19\x00\x18\x00\x23\x00\x00\x00\x0d\x00\x20\x00\x1e\x06\x01\x06\x02\x06\x03\x05\x01\x05\x02\x05\x03\x04\x01\x04\x02\x04\x03\x03\x01\x03\x02\x03\x03\x02\x01\x02\x02\x02\x03\x00\x16\x00\x00\x00\x17\x00\x00hello ssl alone"
+            },
+            'tls' => { 
+                # Packet with SNI and ALPN (`openssl s_client -connect localhost:443 -alpn alpn1 -servername sni1`)
+                data_sni_alpn => "\x16\x03\x01\x00\xc4\x01\x00\x00\xc0\x03\x03\x03\x19\x01\x00\x40\x14\x13\xcc\x1b\x94\xad\x20\x5d\x13\x1a\x8d\xd2\x65\x23\x70\xde\xd1\x3c\x5d\x05\x19\xcb\x27\x0d\x7c\x2c\x89\x00\x00\x38\xc0\x2c\xc0\x30\x00\x9f\xcc\xa9\xcc\xa8\xcc\xaa\xc0\x2b\xc0\x2f\x00\x9e\xc0\x24\xc0\x28\x00\x6b\xc0\x23\xc0\x27\x00\x67\xc0\x0a\xc0\x14\x00\x39\xc0\x09\xc0\x13\x00\x33\x00\x9d\x00\x9c\x00\x3d\x00\x3c\x00\x35\x00\x2f\x00\xff\x01\x00\x00\x5f\x00\x00\x00\x09\x00\x07\x00\x00\x04\$sni\x00\x0b\x00\x04\x03\x00\x01\x02\x00\x0a\x00\x0a\x00\x08\x00\x1d\x00\x17\x00\x19\x00\x18\x00\x23\x00\x00\x00\x0d\x00\x20\x00\x1e\x06\x01\x06\x02\x06\x03\x05\x01\x05\x02\x05\x03\x04\x01\x04\x02\x04\x03\x03\x01\x03\x02\x03\x03\x02\x01\x02\x02\x02\x03\x00\x10\x00\x08\x00\x06\x05\$alpn\x00\x16\x00\x00\x00\x17\x00\x00hello sni/alpn",
+                # Packet with SNI alone
+                data_sni => "\x16\x03\x01\x00\xb8\x01\x00\x00\xb4\x03\x03\x97\xe4\xe9\xad\x86\xe1\x21\xfd\xc4\x5b\x27\x0e\xad\x4b\x55\xc2\x50\xe4\x1c\x86\x2f\x37\x25\xde\xe8\x9c\x59\xfc\x1b\xa9\x37\x32\x00\x00\x38\xc0\x2c\xc0\x30\x00\x9f\xcc\xa9\xcc\xa8\xcc\xaa\xc0\x2b\xc0\x2f\x00\x9e\xc0\x24\xc0\x28\x00\x6b\xc0\x23\xc0\x27\x00\x67\xc0\x0a\xc0\x14\x00\x39\xc0\x09\xc0\x13\x00\x33\x00\x9d\x00\x9c\x00\x3d\x00\x3c\x00\x35\x00\x2f\x00\xff\x01\x00\x00\x53\x00\x00\x00\x09\x00\x07\x00\x00\x04\$sni\x00\x0b\x00\x04\x03\x00\x01\x02\x00\x0a\x00\x0a\x00\x08\x00\x1d\x00\x17\x00\x19\x00\x18\x00\x23\x00\x00\x00\x0d\x00\x20\x00\x1e\x06\x01\x06\x02\x06\x03\x05\x01\x05\x02\x05\x03\x04\x01\x04\x02\x04\x03\x03\x01\x03\x02\x03\x03\x02\x01\x02\x02\x02\x03\x00\x16\x00\x00\x00\x17\x00\x00hello sni",
+                # packet with ALPN alone
+                data_alpn => "\x16\x03\x01\x00\xb7\x01\x00\x00\xb3\x03\x03\xe2\x90\xa2\x29\x03\x31\xad\x98\x44\x51\x54\x90\x5b\xd9\x51\x0e\x66\xb5\x3f\xe8\x8b\x09\xc9\xe4\x2b\x97\x24\xef\xad\x56\x06\xc9\x00\x00\x38\xc0\x2c\xc0\x30\x00\x9f\xcc\xa9\xcc\xa8\xcc\xaa\xc0\x2b\xc0\x2f\x00\x9e\xc0\x24\xc0\x28\x00\x6b\xc0\x23\xc0\x27\x00\x67\xc0\x0a\xc0\x14\x00\x39\xc0\x09\xc0\x13\x00\x33\x00\x9d\x00\x9c\x00\x3d\x00\x3c\x00\x35\x00\x2f\x00\xff\x01\x00\x00\x52\x00\x0b\x00\x04\x03\x00\x01\x02\x00\x0a\x00\x0a\x00\x08\x00\x1d\x00\x17\x00\x19\x00\x18\x00\x23\x00\x00\x00\x0d\x00\x20\x00\x1e\x06\x01\x06\x02\x06\x03\x05\x01\x05\x02\x05\x03\x04\x01\x04\x02\x04\x03\x03\x01\x03\x02\x03\x03\x02\x01\x02\x02\x02\x03\x00\x10\x00\x08\x00\x06\x05\$alpn\x00\x16\x00\x00\x00\x17\x00\x00hello alpn",
+                # packet with no SNI, no ALPN
+                data => "\x16\x03\x01\x00\xab\x01\x00\x00\xa7\x03\x03\x89\x22\x33\x95\x43\x7a\xc3\x89\x45\x51\x12\x3c\x28\x24\x1b\x6a\x78\xbf\xbe\x95\xd8\x90\x58\xd7\x65\xf7\xbb\x2d\xb2\x8d\xa0\x75\x00\x00\x38\xc0\x2c\xc0\x30\x00\x9f\xcc\xa9\xcc\xa8\xcc\xaa\xc0\x2b\xc0\x2f\x00\x9e\xc0\x24\xc0\x28\x00\x6b\xc0\x23\xc0\x27\x00\x67\xc0\x0a\xc0\x14\x00\x39\xc0\x09\xc0\x13\x00\x33\x00\x9d\x00\x9c\x00\x3d\x00\x3c\x00\x35\x00\x2f\x00\xff\x01\x00\x00\x46\x00\x0b\x00\x04\x03\x00\x01\x02\x00\x0a\x00\x0a\x00\x08\x00\x1d\x00\x17\x00\x19\x00\x18\x00\x23\x00\x00\x00\x0d\x00\x20\x00\x1e\x06\x01\x06\x02\x06\x03\x05\x01\x05\x02\x05\x03\x04\x01\x04\x02\x04\x03\x03\x01\x03\x02\x03\x03\x02\x01\x02\x02\x02\x03\x00\x16\x00\x00\x00\x17\x00\x00hello tls alone"
+            },
+            'openvpn' => { data => "\x00\x00" },
+            'tinc' => { data => "0 hello" },
+            'xmpp' => {data => "I should get a real jabber connection initialisation here" },
+            'adb' => { data => "CNXN....................host:..." },
+            'anyprot' => {data => "hello anyprot this needs to be longer than xmpp and adb which expect about 50 characters, which I all have to write before the timeout!" },
+        );
+
+        my $pattern = $protocols{$p->{name}}->{data};
+
+        my %opts = %in_opts;
+        $opts{no_frag} = 1 if $protocols{$p->{name}}->{no_frag};
+
+        if ($p->{sni_hostnames} or $p->{alpn_protocols}) {
+            my $pname = make_sni_alpn_name($p);
+
+            my @sni = @{$p->{sni_hostnames} // [""] };
+            my @alpn = @{$p->{alpn_protocols} // [""] };
+
+            foreach my $sni ( @sni ) {
+                foreach my $alpn ( @alpn ) {
+                    print "sni: $sni\nalpn: $alpn\n";
+                    $pattern = $protocols{tls}->{
+                        "data". ($sni ?  "_sni" : "") . 
+                                ($alpn ?  "_alpn": "")
+                    };
+                    $pattern =~ s/(\$\w+)/$1/eeg;
+
+                    test_probe(
+                        data => $pattern,
+                        expected => $pname,
+                        %opts
+                    );
+                }
+            }
+        } elsif ($p->{name} eq 'regex') {
+            foreach my $test (@{$p->{test_patterns}}) {
+                test_probe(
+                    data => $test->{pattern},
+                    expected => $test->{result},
+                    %opts
+                );
+            }
+        } else {
+            test_probe(
+                data => $pattern,
+                expected => $p->{name},
+                %opts
+            );
+
+        }
+    }
+}
+
+
+
+# Start an echoserver for each service
+foreach my $s (@{$conf->fetch_array("protocols")}) {
+    my $prefix = $s->{name};
+
+    $prefix =~ s/^ssl/tls/; # To remove in 1.21
+
+    if ($s->{sni_hostnames} or $s->{alpn_protocols}) {
+        $prefix = make_sni_alpn_name($s);
+    }
+
+    verbose_exec "./echosrv --listen $s->{host}:$s->{port} --prefix '$prefix: '";
+}
+
+
 my @binaries = ('sslh-select', 'sslh-fork');
+
 for my $binary (@binaries) {
     warn "Testing $binary\n";
 
 # Start sslh with the right plumbing
-    my $sslh_pid;
+    my ($sslh_pid, $valgrind);
     if (!($sslh_pid = fork)) {
         my $user = (getpwuid $<)[0]; # Run under current username
-        my $cmd = "./$binary -v -f -u $user --listen localhost:$sslh_port --ssh $ssh_address --ssl $ssl_address -P $pidfile";
-        warn "$cmd\n";
-        #exec $cmd;
-        exec "valgrind --leak-check=full ./$binary -v -f -u $user --listen localhost:$sslh_port --ssh $ssh_address -ssl $ssl_address -P $pidfile";
+        my $cmd = "./$binary -v 4 -f -u $user -Ftest.cfg";
+        verbose_exec $cmd;
+        #$valgrind = 1;
+        #exec "valgrind --leak-check=full ./$binary -v 3 -f -u $user --listen localhost:$sslh_port --ssh $ssh_address -ssl $ssl_address -P $pidfile";
         exit 0;
     }
     warn "spawned $sslh_pid\n";
-    sleep 5;  # valgrind can be heavy -- wait 5 seconds
+    sleep 5 if $valgrind;  # valgrind can be heavy -- wait 5 seconds
 
 
     my $test_data = "hello world\n";
-#    my $ssl_test_data = (pack 'n', ((length $test_data) + 2)) .  $test_data;
-    my $ssl_test_data = "\x16\x03\x03$test_data\n";
-
-# Test: SSL connection
-    if ($SSL_CNX) {
-        print "***Test: SSL connection\n";
-        my $cnx_l = new IO::Socket::INET(PeerHost => "localhost:$sslh_port");
-        warn "$!\n" unless $cnx_l;
-        if (defined $cnx_l) {
-            print $cnx_l $ssl_test_data;
-            my $data;
-            my $n = sysread $cnx_l, $data, 1024;
-            is($data, "ssl: $ssl_test_data", "SSL connection");
-        }
-    }
+    my $ssl_test_data =  "\x16\x03\x01\x00\xab\x01\x00\x00\xa7\x03\x03\x89\x22\x33\x95\x43\x7a\xc3\x89\x45\x51\x12\x3c\x28\x24\x1b\x6a\x78\xbf\xbe\x95\xd8\x90\x58\xd7\x65\xf7\xbb\x2d\xb2\x8d\xa0\x75\x00\x00\x38\xc0\x2c\xc0\x30\x00\x9f\xcc\xa9\xcc\xa8\xcc\xaa\xc0\x2b\xc0\x2f\x00\x9e\xc0\x24\xc0\x28\x00\x6b\xc0\x23\xc0\x27\x00\x67\xc0\x0a\xc0\x14\x00\x39\xc0\x09\xc0\x13\x00\x33\x00\x9d\x00\x9c\x00\x3d\x00\x3c\x00\x35\x00\x2f\x00\xff\x01\x00\x00\x46\x00\x0b\x00\x04\x03\x00\x01\x02\x00\x0a\x00\x0a\x00\x08\x00\x1d\x00\x17\x00\x19\x00\x18\x00\x23\x00\x00\x00\x0d\x00\x20\x00\x1e\x06\x01\x06\x02\x06\x03\x05\x01\x05\x02\x05\x03\x04\x01\x04\x02\x04\x03\x03\x01\x03\x02\x03\x03\x02\x01\x02\x02\x02\x03\x00\x16\x00\x00\x00\x17\x00\x00hello tls alone";
 
 # Test: Shy SSH connection
     if ($SSH_SHY_CNX) {
@@ -89,42 +235,13 @@ for my $binary (@binaries) {
         my $cnx_h = new IO::Socket::INET(PeerHost => "localhost:$sslh_port");
         warn "$!\n" unless $cnx_h;
         if (defined $cnx_h) {
-            sleep 3;
+            sleep 13;
             print $cnx_h $test_data;
             my $data = <$cnx_h>;
-            is($data, "ssh: $test_data", "Shy SSH connection");
+            my_is($data, "ssh: $test_data", "$binary: Shy SSH connection");
         }
     }
 
-# Test: Bold SSH connection
-    if ($SSH_BOLD_CNX) {
-        print "***Test: Bold SSH connection\n";
-        my $cnx_h = new IO::Socket::INET(PeerHost => "localhost:$sslh_port");
-        warn "$!\n" unless $cnx_h;
-        if (defined $cnx_h) {
-            my $td = "SSH-2.0 testsuite\t$test_data";
-            print $cnx_h $td;
-            my $data = <$cnx_h>;
-            is($data, "ssh: $td", "Bold SSH connection");
-        }
-    }
-
-# Test: PROBE_AGAIN, incomplete first frame
-    if ($SSH_PROBE_AGAIN) {
-        print "***Test: incomplete SSH first frame\n";
-        my $cnx_h = new IO::Socket::INET(PeerHost => "localhost:$sslh_port");
-        warn "$!\n" unless $cnx_h;
-        if (defined $cnx_h) {
-            my $td = "SSH-2.0 testsuite\t$test_data";
-            print $cnx_h substr $td, 0, 2;
-            sleep 1;
-            print $cnx_h substr $td, 2;
-            my $data = <$cnx_h>;
-            is($data, "ssh: $td", "Incomplete first SSH frame");
-        }
-    }
-
-
 # Test: One SSL half-started then one SSH
     if ($SSL_MIX_SSH) {
         print "***Test: One SSL half-started then one SSH\n";
@@ -138,11 +255,11 @@ for my $binary (@binaries) {
                 sleep 3;
                 print $cnx_h $test_data;
                 my $data_h = <$cnx_h>;
-                is($data_h, "ssh: $test_data", "SSH during SSL being established");
+                my_is($data_h, "ssh: $test_data", "$binary: SSH during SSL being established");
             }
             my $data;
             my $n = sysread $cnx_l, $data, 1024;
-            is($data, "ssl: $ssl_test_data", "SSL connection interrupted by SSH");
+            my_is($data, "tls: $ssl_test_data", "$binary: SSL connection interrupted by SSH");
         }
     }
 
@@ -159,62 +276,21 @@ for my $binary (@binaries) {
                 print $cnx_l $ssl_test_data;
                 my $data;
                 my $n = sysread $cnx_l, $data, 1024;
-                is($data, "ssl: $ssl_test_data", "SSL during SSH being established");
+                my_is($data, "tls: $ssl_test_data", "$binary: SSL during SSH being established");
             }
             print $cnx_h $test_data;
             my $data = <$cnx_h>;
-            is($data, "ssh: $test_data", "SSH connection interrupted by SSL");
+            my_is($data, "ssh: $test_data", "$binary: SSH connection interrupted by SSL");
         }
     }
 
 
-# Test: Big messages (careful: don't go over echosrv's buffer limit (1M))
-    if ($BIG_MSG) {
-        print "***Test: big message\n";
-        my $cnx_l = new IO::Socket::INET(PeerHost => "localhost:$sslh_port");
-        warn "$!\n" unless $cnx_l;
-        my $rept = 1000;
-        my $test_data2 = $ssl_test_data . ("helloworld"x$rept);
-        if (defined $cnx_l) {
-            my $n = syswrite $cnx_l, $test_data2;
-            my ($data);
-            $n = sysread $cnx_l, $data, 1 << 20;
-            is($data, "ssl: ". $test_data2, "Big message");
-        }
+    if ($PROBES_NOFRAG) {
+        test_probes(no_frag => 1, binary => $binary);
     }
 
-# Test: Stalled connection
-# Create two connections, stall one, check the other one
-# works, unstall first and check it works fine
-# This test needs fixing.
-# Now that echosrv no longer works on "lines" (finishing
-# with '\n'), it may cut blocks randomly with prefixes.
-# The whole thing needs to be re-thought as it'll only
-# work by chance.
-    if ($STALL_CNX) {
-        print "***Test: Stalled connection\n";
-        my $cnx_1 = new IO::Socket::INET(PeerHost => "localhost:$sslh_port");
-        warn "$!\n" unless defined $cnx_1;
-        my $cnx_2 = new IO::Socket::INET(PeerHost => "localhost:$sslh_port");
-        warn "$!\n" unless defined $cnx_2;
-        my $test_data2 = "helloworld";
-        sleep 4;
-        my $rept = 1000;
-        if (defined $cnx_1 and defined $cnx_2) {
-            print $cnx_1 ($test_data2 x $rept);
-            print $cnx_1 "\n";
-            print $cnx_2 ($test_data2 x $rept);
-            print $cnx_2 "\n";
-            my $data = <$cnx_2>;
-            is($data, "ssh: " . ($test_data2 x $rept) . "\n", "Stalled connection (1)");
-            print $cnx_2 ($test_data2 x $rept);
-            print $cnx_2 "\n";
-            $data = <$cnx_2>;
-            is($data, "ssh: " . ($test_data2 x $rept) . "\n", "Stalled connection (2)");
-            $data = <$cnx_1>;
-            is($data, "ssh: " . ($test_data2 x $rept) . "\n", "Stalled connection (3)");
-
-        }
+    if ($PROBES_AGAIN) {
+        test_probes(binary => $binary);
     }
 
     my $pid = `cat $pidfile`;
@@ -228,8 +304,7 @@ if ($RB_CNX_NOSERVER) {
     print "***Test: Connecting to non-existant server\n";
     my $sslh_pid;
     if (!($sslh_pid = fork)) {
-        my $user = (getpwuid $<)[0]; # Run under current username
-        exec "./sslh-select -v -f -u $user --listen localhost:$sslh_port --ssh localhost:$no_listen --ssl localhost:$no_listen -P $pidfile";
+        exec "./sslh-select -v 3 -f -u $user --listen localhost:$sslh_port --ssh localhost:$no_listen --tls localhost:$no_listen -P $pidfile";
     }
     warn "spawned $sslh_pid\n";
 
@@ -249,19 +324,26 @@ if ($RB_CNX_NOSERVER) {
 }
 
 
+my $ssh_conf = (grep { $_->{name} eq "ssh" } @{$conf->fetch_array("protocols")})[0];
+my $ssh_address = $ssh_conf->{host} . ":" .  $ssh_conf->{port};
+
+# Use the last TLS echoserv (no SNI/ALPN)
+my $ssl_conf = (grep { $_->{name} eq "tls" } @{$conf->fetch_array("protocols")})[-1];
+my $ssl_address = $ssl_conf->{host} . ":" .  $ssl_conf->{port};
+
+
 # Robustness: No hostname in address
 if ($RB_PARAM_NOHOST) {
     print "***Test: No hostname in address\n";
     my $sslh_pid;
     if (!($sslh_pid = fork)) {
-        my $user = (getpwuid $<)[0]; # Run under current username
-        exec "./sslh-select -v -f -u $user --listen $sslh_port --ssh $ssh_address --ssl $ssl_address -P $pidfile";
+        exec "./sslh-select -v 3 -f -u $user --listen $sslh_port --ssh $ssh_address --tls $ssl_address -P $pidfile";
     }
     warn "spawned $sslh_pid\n";
     waitpid $sslh_pid, 0;
     my $code = $? >> 8;
     warn "exited with $code\n";
-    is($code, 1, "Exit status on illegal option");
+    my_is($code, 1, "Exit status on illegal option");
 }
 
 # Robustness: User does not exist
@@ -269,14 +351,13 @@ if ($RB_WRONG_USERNAME) {
     print "***Test: Changing to non-existant username\n";
     my $sslh_pid;
     if (!($sslh_pid = fork)) {
-        my $user = (getpwuid $<)[0]; # Run under current username
-        exec "./sslh-select -v -f -u ${user}_doesnt_exist --listen localhost:$sslh_port --ssh $ssh_address --ssl $ssl_address -P $pidfile";
+        exec "./sslh-select -v 3 -f -u ${user}_doesnt_exist --listen localhost:$no_listen --ssh $ssh_address --tls $ssl_address -P $pidfile";
     }
     warn "spawned $sslh_pid\n";
     waitpid $sslh_pid, 0;
     my $code = $? >> 8;
     warn "exited with $code\n";
-    is($code, 2, "Exit status on non-existant username");
+    my_is($code, 2, "Exit status on non-existant username");
 }
 
 # Robustness: Can't open PID file
@@ -284,15 +365,14 @@ if ($RB_OPEN_PID_FILE) {
     print "***Test: Can't open PID file\n";
     my $sslh_pid;
     if (!($sslh_pid = fork)) {
-        my $user = (getpwuid $<)[0]; # Run under current username
-        exec "./sslh-select -v -f -u $user --listen localhost:$sslh_port --ssh $ssh_address --ssl $ssl_address -P /dont_exist/$pidfile";
+        exec "./sslh-select -v 3 -f -u $user --listen localhost:$no_listen --ssh $ssh_address --tls $ssl_address -P /dont_exist/$pidfile";
         # You don't have a /dont_exist/ directory, do you?!
     }
     warn "spawned $sslh_pid\n";
     waitpid $sslh_pid, 0;
     my $code = $? >> 8;
     warn "exited with $code\n";
-    is($code, 3, "Exit status if can't open PID file");
+    my_is($code, 3, "Exit status if can't open PID file");
 }
 
 # Robustness: Can't resolve address
@@ -301,13 +381,13 @@ if ($RB_RESOLVE_ADDRESS) {
     my $sslh_pid;
     if (!($sslh_pid = fork)) {
         my $user = (getpwuid $<)[0]; # Run under current username
-        exec "./sslh-select -v -f -u $user --listen blahblah.dontexist:9000 --ssh $ssh_address --ssl $ssl_address -P $pidfile";
+        exec "./sslh-select -v 3 -f -u $user --listen blahblah.dontexist:9000 --ssh $ssh_address --tls $ssl_address -P $pidfile";
     }
     warn "spawned $sslh_pid\n";
     waitpid $sslh_pid, 0;
     my $code = $? >> 8;
     warn "exited with $code\n";
-    is($code, 4, "Exit status if can't resolve address");
+    my_is($code, 4, "Exit status if can't resolve address");
 }
 
 `lcov --directory . --capture --output-file sslh_cov.info`;
@@ -315,3 +395,17 @@ if ($RB_RESOLVE_ADDRESS) {
 
 `killall echosrv`;
 
+
+format test_results_top =
+ID  | Description                                                       | Status
+----+-------------------------------------------------------------------+-------
+.
+
+format test_results = 
+@>> | @<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< |   @>>
+$_->[0], $_->[1], $_->[2] ? "OK" : "NOK"
+.
+
+format_name STDOUT "test_results";
+format_top_name STDOUT "test_results_top";
+map { write; } @results;

test.cfg

@@ -0,0 +1,53 @@
+# Configuration file for testing (use both by sslh under
+# test and the test script `t`)
+
+verbose: 2;
+foreground: true;
+inetd: false;
+numeric: false;
+transparent: false;
+timeout: 10;   # Probe test writes slowly
+pidfile: "/tmp/sslh_test.pid";
+
+syslog_facility: "auth"; 
+
+
+# List of interfaces on which we should listen
+# Options:
+listen:
+(
+    { host: "localhost"; port: "8080"; keepalive: true; },
+    { host: "localhost"; port: "8081"; keepalive: true; }
+);
+
+ 
+protocols:
+(
+     { name: "ssh";  host: "localhost"; port: "9000"; fork: true; },
+     { name: "socks5";  host: "localhost"; port: "9001";  },
+     { name: "http";  host: "localhost"; port: "9002";  },
+     { name: "tinc";  host: "localhost"; port: "9003"; },
+     { name: "openvpn";  host: "localhost"; port: "9004"; },
+     { name: "xmpp";  host: "localhost"; port: "9009"; },
+     { name: "adb";  host: "localhost"; port: "9010"; },
+     { name: "regex"; host: "localhost"; port: "9011";
+        regex_patterns: [ "^foo", "^bar" ];
+        minlength: 4; 
+        test_patterns: (
+            { pattern: "foo"; result: "ssh"; },  # After timeout
+            { pattern: "fooo"; result: "regex"; },
+            { pattern: "bar"; result: "ssh"; },
+            { pattern: "barr"; result: "regex"; },
+            { pattern: "barrrr"; result: "regex"; }
+        );
+     },
+     { name: "tls"; host: "localhost"; port: "9021"; alpn_protocols: [ "alpn1", "alpn2" ]; sni_hostnames: [ "sni1" ]; },
+     { name: "tls"; host: "localhost"; port: "9022"; alpn_protocols: [ "alpn1", "alpn2" ]; sni_hostnames: [ "sni2", "sni3" ]; },
+     { name: "tls"; host: "localhost"; port: "9023"; alpn_protocols: [ "alpn3" ]; },
+     { name: "tls"; host: "localhost"; port: "9024"; sni_hostnames: [ "sni3" ]; },
+     { name: "tls"; host: "localhost"; port: "9025"; },
+     { name: "anyprot";  host: "localhost"; port: "9099";  }
+);
+
+on_timeout: "ssh";
+

tls.c

@@ -32,6 +32,7 @@
 #include <stdlib.h> /* malloc() */
 #include <fnmatch.h> /* fnmatch() */
 #include "tls.h"
+#include "sslh-conf.h"
 
 #define TLS_HEADER_LEN 5
 #define TLS_HANDSHAKE_CONTENT_TYPE 0x16
@@ -41,28 +42,31 @@
 #define MIN(X, Y) ((X) < (Y) ? (X) : (Y))
 #endif
 
+typedef struct {
+    int tls_match_sni : 1;
+    int tls_match_alpn : 1;
+} TLS_MATCHMODE;
 
 struct TLSProtocol {
-    int use_alpn;
-    char** sni_hostname_list;
-    char** alpn_protocol_list;
+    TLS_MATCHMODE match_mode;
+    int sni_list_len;
+    const char** sni_hostname_list;
+    int alpn_list_len;
+    const char** alpn_protocol_list;
 };
 
 static int parse_extensions(const struct TLSProtocol *, const char *, size_t);
 static int parse_server_name_extension(const struct TLSProtocol *, const char *, size_t);
 static int parse_alpn_extension(const struct TLSProtocol *, const char *, size_t);
-static int has_match(char**, const char*, size_t);
+static int has_match(const char**, size_t, const char*, size_t);
 
 /* Parse a TLS packet for the Server Name Indication and ALPN extension in the client
  * hello handshake, returning a status code
  *
  * Returns:
- *  >=0  - length of the hostname and updates *hostname
- *         caller is responsible for freeing *hostname
- *  -1   - Incomplete request
- *  -2   - No Host header included in this request
- *  -3   - Invalid hostname pointer
- *  < -4 - Invalid TLS client hello
+ * 0: no match
+ * 1: match
+ *  < 0:  error code (see tls.h)
  */
 int
 parse_tls_header(const struct TLSProtocol *tls_data, const char *data, size_t data_len) {
@@ -74,21 +78,21 @@ parse_tls_header(const struct TLSProtocol *tls_data, const char *data, size_t da
 
     /* Check that our TCP payload is at least large enough for a TLS header */
     if (data_len < TLS_HEADER_LEN)
-        return -1;
+        return TLS_ELENGTH;
 
     tls_content_type = data[0];
     if (tls_content_type != TLS_HANDSHAKE_CONTENT_TYPE) {
-        if (verbose) fprintf(stderr, "Request did not begin with TLS handshake.\n");
-        return -5;
+        if (cfg.verbose) fprintf(stderr, "Request did not begin with TLS handshake.\n");
+        return TLS_EPROTOCOL;
     }
 
     tls_version_major = data[1];
     tls_version_minor = data[2];
     if (tls_version_major < 3) {
-        if (verbose) fprintf(stderr, "Received SSL %d.%d handshake which cannot be parsed.\n",
+        if (cfg.verbose) fprintf(stderr, "Received SSL %d.%d handshake which cannot be parsed.\n",
               tls_version_major, tls_version_minor);
 
-        return -2;
+        return TLS_EVERSION;
     }
 
     /* TLS record length */
@@ -98,18 +102,18 @@ parse_tls_header(const struct TLSProtocol *tls_data, const char *data, size_t da
 
     /* Check we received entire TLS record length */
     if (data_len < len)
-        return -1;
+        return TLS_ELENGTH;
 
     /*
      * Handshake
      */
     if (pos + 1 > data_len) {
-        return -5;
+        return TLS_EPROTOCOL;
     }
     if (data[pos] != TLS_HANDSHAKE_TYPE_CLIENT_HELLO) {
-        if (verbose) fprintf(stderr, "Not a client hello\n");
+        if (cfg.verbose) fprintf(stderr, "Not a client hello\n");
 
-        return -5;
+        return TLS_EPROTOCOL;
     }
 
     /* Skip past fixed length records:
@@ -123,46 +127,54 @@ parse_tls_header(const struct TLSProtocol *tls_data, const char *data, size_t da
 
     /* Session ID */
     if (pos + 1 > data_len)
-        return -5;
+        return TLS_EPROTOCOL;
     len = (unsigned char)data[pos];
     pos += 1 + len;
 
     /* Cipher Suites */
     if (pos + 2 > data_len)
-        return -5;
+        return TLS_EPROTOCOL;
     len = ((unsigned char)data[pos] << 8) + (unsigned char)data[pos + 1];
     pos += 2 + len;
 
     /* Compression Methods */
     if (pos + 1 > data_len)
-        return -5;
+        return TLS_EPROTOCOL;
     len = (unsigned char)data[pos];
     pos += 1 + len;
 
     if (pos == data_len && tls_version_major == 3 && tls_version_minor == 0) {
-        if (verbose) fprintf(stderr, "Received SSL 3.0 handshake without extensions\n");
-        return -2;
+        if (cfg.verbose) fprintf(stderr, "Received SSL 3.0 handshake without extensions\n");
+        return TLS_EVERSION;
     }
 
     /* Extensions */
     if (pos + 2 > data_len)
-        return -5;
+        return TLS_EPROTOCOL;
     len = ((unsigned char)data[pos] << 8) + (unsigned char)data[pos + 1];
     pos += 2;
 
     if (pos + len > data_len)
-        return -5;
-    return parse_extensions(tls_data, data + pos, len);
+        return TLS_EPROTOCOL;
+
+    /* By now we know it's TLS. if SNI or ALPN is set, parse extensions to see if
+     * they match. Otherwise, it's a match already */
+    if (tls_data && 
+        (tls_data->match_mode.tls_match_alpn || tls_data->match_mode.tls_match_sni)) {
+        return parse_extensions(tls_data, data + pos, len);
+    } else {
+        return TLS_MATCH;
+    }
 }
 
 static int
 parse_extensions(const struct TLSProtocol *tls_data, const char *data, size_t data_len) {
     size_t pos = 0;
     size_t len;
-    int last_matched = 0;
+    int sni_match = 0, alpn_match = 0;
 
     if (tls_data == NULL)
-        return -3;
+        return TLS_EINVAL;
 
     /* Parse each 4 bytes for the extension header */
     while (pos + 4 <= data_len) {
@@ -171,54 +183,17 @@ parse_extensions(const struct TLSProtocol *tls_data, const char *data, size_t da
               (unsigned char) data[pos + 3];
 
         if (pos + 4 + len > data_len)
-            return -5;
+            return TLS_EPROTOCOL;
 
         size_t extension_type = ((unsigned char) data[pos] << 8) +
                                 (unsigned char) data[pos + 1];
 
-
-        /* Check if it's a server name extension */
-        /* There can be only one extension of each type, so we break
-           our state and move pos to beginning of the extension here */
-        if (tls_data->use_alpn == 2) {
-            /* we want BOTH alpn and sni to match */
-            if (extension_type == 0x00) { /* Server Name */
-                if (parse_server_name_extension(tls_data, data + pos + 4, len)) {
-                    /* SNI matched */
-                    if(last_matched) {
-                        /* this is only true if ALPN matched, so return true */
-                        return last_matched;
-                    } else {
-                        /* otherwise store that SNI matched */
-                        last_matched = 1;
-                    }
-                } else {
-                    /* both can't match */
-                    return -2;
-                }
-            } else if (extension_type == 0x10) { /* ALPN */
-                if (parse_alpn_extension(tls_data, data + pos + 4, len)) {
-                    /* ALPN matched */
-                    if(last_matched) {
-                        /* this is only true if SNI matched, so return true */
-                        return last_matched;
-                    } else {
-                        /* otherwise store that ALPN matched */
-                        last_matched = 1;
-                    }
-                } else {
-                    /* both can't match */
-                    return -2;
-                }
-            }
-
-        } else if (extension_type == 0x00 && tls_data->use_alpn == 0) { /* Server Name */
-            return parse_server_name_extension(tls_data, data + pos + 4, len);
-        } else if (extension_type == 0x10 && tls_data->use_alpn == 1) { /* ALPN */
-            if (parse_alpn_extension(tls_data, data + pos + 4, len) > 0) {
-                return 1;
-            }
-            return parse_alpn_extension(tls_data, data + pos + 4, len);
+        if (extension_type == 0x00 && tls_data->match_mode.tls_match_sni) { /* Server Name */
+            sni_match = parse_server_name_extension(tls_data, data + pos + 4, len);
+            if (sni_match < 0) return sni_match;
+        } else if (extension_type == 0x10 && tls_data->match_mode.tls_match_alpn) { /* ALPN */
+            alpn_match = parse_alpn_extension(tls_data, data + pos + 4, len);
+            if (alpn_match < 0) return alpn_match;
         }
 
         pos += 4 + len; /* Advance to the next extension header */
@@ -226,9 +201,11 @@ parse_extensions(const struct TLSProtocol *tls_data, const char *data, size_t da
 
     /* Check we ended where we expected to */
     if (pos != data_len)
-        return -5;
+        return TLS_EPROTOCOL;
 
-    return -2;
+    return (sni_match && alpn_match) 
+        || (!tls_data->match_mode.tls_match_sni && alpn_match)
+        || (!tls_data->match_mode.tls_match_alpn && sni_match);
 }
 
 static int
@@ -241,26 +218,26 @@ parse_server_name_extension(const struct TLSProtocol *tls_data, const char *data
               (unsigned char)data[pos + 2];
 
         if (pos + 3 + len > data_len)
-            return -5;
+            return TLS_EPROTOCOL;
 
         switch (data[pos]) { /* name type */
             case 0x00: /* host_name */
-                if(has_match(tls_data->sni_hostname_list, data + pos + 3, len)) {
+                if(has_match(tls_data->sni_hostname_list, tls_data->sni_list_len, data + pos + 3, len)) {
                     return len;
                 } else {
-                    return -2;
+                    return TLS_ENOEXT;
                 }
             default:
-                if (verbose) fprintf(stderr, "Unknown server name extension name type: %d\n",
+                if (cfg.verbose) fprintf(stderr, "Unknown server name extension name type: %d\n",
                       data[pos]);
         }
         pos += 3 + len;
     }
     /* Check we ended where we expected to */
     if (pos != data_len)
-        return -5;
+        return TLS_EPROTOCOL;
 
-    return -2;
+    return TLS_ENOEXT;
 }
 
 static int
@@ -272,31 +249,34 @@ parse_alpn_extension(const struct TLSProtocol *tls_data, const char *data, size_
         len = (unsigned char)data[pos];
 
         if (pos + 1 + len > data_len)
-            return -5;
+            return TLS_EPROTOCOL;
 
-        if (len > 0 && has_match(tls_data->alpn_protocol_list, data + pos + 1, len)) {
+        if (len > 0 && has_match(tls_data->alpn_protocol_list, tls_data->alpn_list_len, data + pos + 1, len)) {
             return len;
         } else if (len > 0) {
-            if (verbose) fprintf(stderr, "Unknown ALPN name: %.*s\n", (int)len, data + pos + 1);
+            if (cfg.verbose) fprintf(stderr, "Unknown ALPN name: %.*s\n", (int)len, data + pos + 1);
         }
         pos += 1 + len;
     }
     /* Check we ended where we expected to */
     if (pos != data_len)
-        return -5;
+        return TLS_EPROTOCOL;
 
-    return -2;
+    return TLS_ENOEXT;
 }
 
 static int
-has_match(char** list, const char* name, size_t name_len) {
-    char **item;
+has_match(const char** list, size_t list_len, const char* name, size_t name_len) {
+    const char **item;
+    int i;
     char *name_nullterminated = malloc(name_len+1);
+    CHECK_ALLOC(name_nullterminated, "malloc");
     memcpy(name_nullterminated, name, name_len);
     name_nullterminated[name_len]='\0';
 
-    for (item = list; *item; item++) {
-        if (verbose) fprintf(stderr, "matching [%.*s] with [%s]\n", (int)name_len, name, *item);
+    for (i = 0; i < list_len; i++) {
+        item = &list[i];
+        if (cfg.verbose) fprintf(stderr, "matching [%.*s] with [%s]\n", (int)name_len, name, *item);
         if(!fnmatch(*item, name_nullterminated, 0)) {
             free(name_nullterminated);
             return 1;
@@ -309,27 +289,23 @@ has_match(char** list, const char* name, size_t name_len) {
 struct TLSProtocol *
 new_tls_data() {
     struct TLSProtocol *tls_data = malloc(sizeof(struct TLSProtocol));
-    if (tls_data != NULL) {
-        tls_data->use_alpn = -1;
-    }
+    CHECK_ALLOC(tls_data, "malloc");
+
+    memset(tls_data, 0, sizeof(*tls_data));
 
     return tls_data;
 }
 
 struct TLSProtocol *
-tls_data_set_list(struct TLSProtocol *tls_data, int alpn, char** list) {
+tls_data_set_list(struct TLSProtocol *tls_data, int alpn, const char** list, size_t list_len) {
     if (alpn) {
         tls_data->alpn_protocol_list = list;
-        if(tls_data->use_alpn == 0)
-            tls_data->use_alpn = 2;
-        else
-            tls_data->use_alpn = 1;
+        tls_data->alpn_list_len = list_len;
+        tls_data->match_mode.tls_match_alpn = 1;
     } else {
         tls_data->sni_hostname_list = list;
-        if(tls_data->use_alpn == 1)
-            tls_data->use_alpn = 2;
-        else
-            tls_data->use_alpn = 0;
+        tls_data->sni_list_len = list_len;
+        tls_data->match_mode.tls_match_sni = 1;
     }
 
     return tls_data;

tls.h

@@ -33,6 +33,16 @@ struct TLSProtocol;
 int parse_tls_header(const struct TLSProtocol *tls_data, const char *data, size_t data_len);
 
 struct TLSProtocol *new_tls_data();
-struct TLSProtocol *tls_data_set_list(struct TLSProtocol *, int, char**);
+struct TLSProtocol *tls_data_set_list(struct TLSProtocol *, int, const char**, size_t);
+
+#define TLS_MATCH       1
+#define TLS_NOMATCH     0
+
+#define TLS_EINVAL      -1 /* Invalid parameter (NULL data pointer) */
+#define TLS_ELENGTH     -2 /* Incomplete request */
+#define TLS_EVERSION    -3 /* TLS version that cannot be parsed */
+#define TLS_ENOEXT      -4 /* No ALPN or SNI extension found */
+#define TLS_EPROTOCOL   -5 /* Protocol error */
+
 
 #endif