removed obsolete support for . Use instead

Always initialize config_t structure, fixes #270

ChangeLog

@@ -1,4 +1,12 @@
 v1.21: 11JUL2020
+	WARNING:
+	Moved configuration and command-line management to
+	use conf2struct. Changes are:
+	* `--ssl` and using `name: 'ssl'` in config file is no longer supported, use `tls` instead.
+	* command line option <-F|--config> no longer defaults to /etc/sslh.cfg, so you have to
+	specify it explicitly.
+	* command line option <-v|--verbose> takes a mandatory integer parameter
+
 	Added TCP_FASTOPEN support for client sockets (if
 	tfo_ok is specified in their configuration) and for
 	listenint socket, if all client protocols support it.
@@ -8,10 +16,6 @@ v1.21: 11JUL2020
 	than that many bytes have been received (mostly for
 	regex)
 
-	Moved configuration and command-line management to
-	use conf2struct. Hopefully this should be transparent
-	to users.
-
 	Update Let's Encrypt entry in example.cfg for tls-alpn-01
 	challenges; tls-sni-* challenges are now deprecated.
 
@@ -21,6 +25,9 @@ v1.21: 11JUL2020
 	Use syslog_facility: "none" to disable syslog
 	output.
 
+	Changed exit code for illegal command line parameter
+	from 1 to 6 (for testing purposes)
+
 v1.20: 20NOV2018
 	Added support for socks5 protocol (Eugene Protozanov)
 

Makefile

@@ -1,6 +1,8 @@
-# Configuration
 
 VERSION=$(shell ./genver.sh -r)
+
+# Configuration -- you probably need to `make clean` if you
+# change any of these
 ENABLE_REGEX=1  # Enable regex probes
 USELIBCONFIG=1	# Use libconfig? (necessary to use configuration files)
 USELIBPCRE=1	# Use libpcre? (needed for regex on musl)
@@ -102,6 +104,7 @@ $(MAN): sslh.pod Makefile
 # configuration
 release:
 	git archive master --prefix="sslh-$(VERSION)/" | gzip > /tmp/sslh-$(VERSION).tar.gz
+	gpg --detach-sign --armor /tmp/sslh-$(VERSION).tar.gz
 
 # generic install: install binary and man page
 install: sslh $(MAN)

doc/INSTALL.md

@@ -42,7 +42,7 @@ For Fedora, you'll need packages `libconfig` and
 If you want to rebuild `sslh-conf.c` (after a `make
 distclean` for example), you will also need to add
 [conf2struct](https://www.rutschle.net/tech/conf2struct/README.html)
-(v1.1) to your path.
+(v1.4) to your path.
 
 Compilation
 -----------

probe.c

@@ -53,7 +53,6 @@ static struct protocol_probe_desc builtins[] = {
     { "xmpp",       is_xmpp_protocol },
     { "http",       is_http_protocol },
     { "tls",        is_tls_protocol },
-    { "ssl",        is_tls_protocol },
     { "adb",        is_adb_protocol },
     { "socks5",     is_socks5_protocol },
     { "anyprot",    is_true }

sslh-conf.c

@@ -1,5 +1,5 @@
 /* Generated by conf2struct (https://www.rutschle.net/tech/conf2struct/README)
- * on Fri Jun 19 23:36:04 2020. 
+ * on Wed Jul 29 22:51:16 2020. 
 
 # conf2struct: generate libconf parsers that read to structs
 # Copyright (C) 2018-2019  Yves Rutschle
@@ -30,9 +30,12 @@
 
 #define _GNU_SOURCE
 #include <string.h>
-#include <libconfig.h>
+#ifdef LIBCONFIG
+#    include <libconfig.h>
+#endif
 #include <stdlib.h>
 #include <stddef.h>
+#include <stdio.h>
 #include "sslh-conf.h"
 #include "argtable3.h"
 #ifdef LIBPCRE
@@ -56,6 +59,105 @@ typedef enum {
     CFG_ARRAY,
     CFG_LIST,
 } config_type;
+/* /config_type */
+
+const char* type2str[] = {
+    "boolean",
+    "int",
+    "int64",
+    "float",
+    "string",
+    "group",
+    "array",
+    "list",
+};
+
+typedef union {
+    int def_bool;
+    int def_int;
+    long long def_int64;
+    double def_float;
+    char* def_string;
+} any_val;
+
+struct config_desc {
+    const char* name;
+    int type;
+    struct config_desc * sub_group; /* Table for compound types (list and group) */
+    void* arg_cl; /* command-line argument for this setting */
+    void* base_addr; /* Base of the structure (filled at runtime). Probably not useable for list elements */
+    size_t offset;  /* Offset of setting in the structure */
+    size_t offset_len; /* Offset of *_len field, for arrays and lists */
+    size_t offset_present; /* offset of *_is_present field, for optional settings */
+    size_t size;   /* Size of element, or size of group for groups and lists */
+    int array_type; /* type of array elements, when type == CFG_ARRAY */
+    int mandatory;
+    int optional;
+    any_val default_val;
+};
+
+#ifndef LIBCONFIG
+/* Stubs in case you don't want libconfig */
+
+typedef void config_setting_t;
+typedef int config_t;
+#define CONFIG_TRUE 1
+#define CONFIG_FALSE 0
+
+#define make_config_setting_lookup(type) \
+    int config_setting_lookup_##type(const config_setting_t* a, const char* b, void* c) { \
+        return 0; \
+    }
+
+#define make_config_setting_get(type, ret_type) \
+    ret_type config_setting_get_##type(const config_setting_t* a) { \
+        return 0; \
+    }
+
+make_config_setting_lookup(bool);
+make_config_setting_lookup(int);
+make_config_setting_lookup(int64);
+make_config_setting_lookup(float);
+make_config_setting_lookup(string);
+
+make_config_setting_get(bool, int);
+make_config_setting_get(int, int);
+make_config_setting_get(int64, int);
+make_config_setting_get(float, double);
+make_config_setting_get(string, char*);
+
+config_setting_t* config_lookup(config_t* c, const char* b) {
+    return NULL;
+}
+
+void config_init(config_t* c) {
+    return;
+}
+
+config_setting_t* config_setting_lookup(config_setting_t* a, char* b) {
+    return NULL;
+}
+
+int config_setting_length(config_setting_t* a) {
+    return 0;
+}
+
+config_setting_t* config_setting_get_elem(config_setting_t* a, int i) {
+    return NULL;
+}
+
+int config_read_file(config_t* a, const char* b) {
+    return CONFIG_TRUE;
+}
+
+int config_error_line(config_t* c) {
+    return 0;
+}
+
+char* config_error_text(config_t* c) {
+    return NULL;
+}
+#endif
 
 typedef int (*lookup_fn)(const config_setting_t*, const char*, void*);
 lookup_fn lookup_fns[] = {
@@ -69,29 +171,10 @@ lookup_fn lookup_fns[] = {
     NULL,  /* CFG_LIST */
 };
 
-const char* type2str[] = {
-    "boolean",
-    "int",
-    "int64",
-    "float",
-    "string",
-    "group",
-    "array",
-    "list",
-};
-
-/* /config_type */
-
-typedef union {
-    int def_bool;
-    int def_int;
-    long long def_int64;
-    double def_float;
-    char* def_string;
-} any_val;
-
 /* Copy an any_val to arbitrary memory location */
-static void any_valcpy(config_type type, void* target, any_val val)
+/* 0: success
+ * <0: error */
+static int any_valcpy(config_type type, void* target, any_val val)
 {
     switch(type) {
     case CFG_BOOL:
@@ -116,14 +199,17 @@ static void any_valcpy(config_type type, void* target, any_val val)
 
     default:
         fprintf(stderr, "Unknown type specification %d\n", type);
-        exit(1);
+        return -1;
     }
+    return 1;
 }
 
 
 /* Copy the value of a setting to an arbitrary memory that
 * must be large enough */
-static void settingcpy(config_type type, void* target, const config_setting_t* setting)
+/* 0: success
+ * <0: error */
+static int settingcpy(config_type type, void* target, const config_setting_t* setting)
 {
     any_val val;
     char* str;
@@ -157,13 +243,16 @@ static void settingcpy(config_type type, void* target, const config_setting_t* s
 
     default:
         fprintf(stderr, "Unknown type specification %d\n", type);
-        exit(1);
+        return -1;
     }
+    return 0;
 }
 
 /* Copy the value of a command line arg to arbitrary memory
 * that must be large enough for the type */
-static void clcpy(config_type type, void* target, const void* cl_arg)
+/* 0: success
+ * <0: error */
+static int clcpy(config_type type, void* target, const void* cl_arg)
 {
     any_val val;
     char* str;
@@ -197,14 +286,17 @@ static void clcpy(config_type type, void* target, const void* cl_arg)
 
     default:
         fprintf(stderr, "Unknown type specification %d\n", type);
-        exit(1);
+        return -1;
     }
+    return 0;
 }
 
 /* Copy the value of a string argument to arbitary memory
 * location that must be large enough, converting on the way
 * (i.e. CFG_INT gets atoi() and so on) */
-static void stringcpy(config_type type, void* target, char* from)
+/* 0: success
+ * <0: error */
+static int stringcpy(config_type type, void* target, char* from)
 {
     any_val val;
     
@@ -236,27 +328,12 @@ static void stringcpy(config_type type, void* target, char* from)
 
     default:
         fprintf(stderr, "Unknown type specification %d\n", type);
-        exit(1);
+        return -1;
     }
+    return 0;
 }
 
 
-struct config_desc {
-    const char* name;
-    int type;
-    struct config_desc * sub_group; /* Table for compound types (list and group) */
-    void* arg_cl; /* command-line argument for this setting */
-    void* base_addr; /* Base of the structure (filled at runtime). Probably not useable for list elements */
-    size_t offset;  /* Offset of setting in the structure */
-    size_t offset_len; /* Offset of *_len field, for arrays and lists */
-    size_t offset_present; /* offset of *_is_present field, for optional settings */
-    size_t size;   /* Size of element, or size of group for groups and lists */
-    int array_type; /* type of array elements, when type == CFG_ARRAY */
-    int mandatory;
-    int optional;
-    any_val default_val;
-};
-
 /* Element to describe the target of a compound element
 * element: which config entry is being changed
 * match: if >0, index in pmatch to set
@@ -312,6 +389,7 @@ struct arg_file* sslhcfg_conffile;
  	struct arg_str* sslhcfg_http;
  	struct arg_str* sslhcfg_adb;
  	struct arg_str* sslhcfg_socks5;
+ 	struct arg_str* sslhcfg_anyprot;
  struct arg_end* sslhcfg_end;
 
                                                                                                                     
@@ -777,6 +855,14 @@ static struct config_desc table_sslhcfg[] = {
         },
 	{ 0 }
 };
+static struct compound_cl_target sslhcfg_anyprot_targets [] = {
+	{ & table_sslhcfg_protocols[0], 0, .value.def_string = "anyprot" },
+	{ & table_sslhcfg_protocols[1], 1, .value.def_string = "0" },
+	{ & table_sslhcfg_protocols[2], 2, .value.def_string = "0" },
+	{ & table_sslhcfg_protocols[6], 0, .value.def_int = 1 },
+	{ 0 }
+};
+
 static struct compound_cl_target sslhcfg_socks5_targets [] = {
 	{ & table_sslhcfg_protocols[0], 0, .value.def_string = "socks5" },
 	{ & table_sslhcfg_protocols[1], 1, .value.def_string = "0" },
@@ -810,7 +896,7 @@ static struct compound_cl_target sslhcfg_xmpp_targets [] = {
 };
 
 static struct compound_cl_target sslhcfg_tinc_targets [] = {
-	{ & table_sslhcfg_protocols[0], 0, .value.def_string = "openvpn" },
+	{ & table_sslhcfg_protocols[0], 0, .value.def_string = "tinc" },
 	{ & table_sslhcfg_protocols[1], 1, .value.def_string = "0" },
 	{ & table_sslhcfg_protocols[2], 2, .value.def_string = "0" },
 	{ & table_sslhcfg_protocols[6], 0, .value.def_int = 1 },
@@ -910,7 +996,7 @@ static struct compound_cl_arg compound_cl_args[] = {
 
             .override_desc =   & table_sslhcfg_protocols [0],
             .override_matchindex = 0,
-            .override_const = "openvpn",
+            .override_const = "tinc",
         },
 
         {   /* arg: xmpp */
@@ -961,6 +1047,18 @@ static struct compound_cl_arg compound_cl_args[] = {
             .override_const = "socks5",
         },
 
+        {   /* arg: anyprot */
+            .regex =           "(.+):(\\w+)",
+            .arg_cl =          & sslhcfg_anyprot,
+            .base_entry =      & table_sslhcfg [12],
+            .targets =         sslhcfg_anyprot_targets,
+
+
+            .override_desc =   & table_sslhcfg_protocols [0],
+            .override_matchindex = 0,
+            .override_const = "anyprot",
+        },
+
 	{ 0 }
 };
 
@@ -1066,7 +1164,7 @@ static void read_block_init(void* target, config_setting_t* cfg, struct config_d
             if (setting)
                 len = config_setting_length(setting);
         } 
-        block = malloc(desc->size * len);
+        block = calloc(len, desc->size);
 
         *(size_t*)(((char*)target) + desc->offset_len) = len;
         *(void**)(((char*)target) + desc->offset) = block;
@@ -1074,7 +1172,7 @@ static void read_block_init(void* target, config_setting_t* cfg, struct config_d
         break;
 
     case CFG_GROUP:
-        block = malloc(desc->size);
+        block = calloc(1, desc->size);
         *(void**)(((char*)target) + desc->offset) = block;
         TRACE_READ((" sizing for %zu elems ", len));
         break;
@@ -1432,7 +1530,6 @@ static int read_compounds(config_setting_t* cfg,
 static int c2s_parse_file(const char* filename, config_t* c, char**errmsg)
 {
     /* Read config file */
-    config_init(c);
     if (config_read_file(c, filename) == CONFIG_FALSE) {
         if (config_error_line(c) != 0) {
            asprintf(errmsg, "%s:%d:%s", 
@@ -1447,6 +1544,8 @@ static int c2s_parse_file(const char* filename, config_t* c, char**errmsg)
     return 1;
 }
 
+/* 0: success
+   <0: error */
 int sslhcfg_cl_parse(int argc, char* argv[], struct sslhcfg_item* cfg)
 {
     int nerrors, res;
@@ -1454,7 +1553,9 @@ int sslhcfg_cl_parse(int argc, char* argv[], struct sslhcfg_item* cfg)
     char* errmsg;
     config_setting_t* s;
     void* argtable[] = {
-                sslhcfg_conffile = arg_filen("F", "conffile", "<file>", 0, 1, "Specify configuration file"),
+            #ifdef LIBCONFIG
+        sslhcfg_conffile = arg_filen("F", "config", "<file>", 0, 1, "Specify configuration file"),
+    #endif
          sslhcfg_verbose = arg_intn("v", "verbose", "<n>", 0, 1, ""),
          sslhcfg_foreground = arg_litn("f", "foreground", 0, 1, "Run in foreground instead of as a daemon"),
          sslhcfg_inetd = arg_litn("i", "inetd", 0, 1, "Run in inetd mode: use stdin/stdout instead of network listen"),
@@ -1475,6 +1576,7 @@ int sslhcfg_cl_parse(int argc, char* argv[], struct sslhcfg_item* cfg)
  	sslhcfg_http = arg_strn(NULL, "http", "<host:port>", 0, 10, "Set up HTTP (plain) target"),
  	sslhcfg_adb = arg_strn(NULL, "adb", "<host:port>", 0, 10, "Set up ADB (Android Debug) target"),
  	sslhcfg_socks5 = arg_strn(NULL, "socks5", "<host:port>", 0, 10, "Set up socks5 target"),
+ 	sslhcfg_anyprot = arg_strn(NULL, "anyprot", "<host:port>", 0, 10, "Set up default target"),
  	sslhcfg_end = arg_end(10)
 
     };
@@ -1483,16 +1585,17 @@ int sslhcfg_cl_parse(int argc, char* argv[], struct sslhcfg_item* cfg)
     nerrors = arg_parse(argc, argv, argtable);
     if (nerrors) {
         arg_print_errors(stdout, sslhcfg_end, "sslhcfg"); 
-        arg_print_syntax(stdout, argtable, "\\n");
+        arg_print_syntax(stdout, argtable, "\n");
         arg_print_glossary(stdout, argtable, "  %-25s\t%s\n");
-        return 0;
+        return -1;
     }
 
 
+    config_init(&c);
     if (sslhcfg_conffile->count) {
         if (!c2s_parse_file(sslhcfg_conffile->filename[0], &c, &errmsg)) {
             fprintf(stderr, "%s\n", errmsg);
-            exit(1);
+            return -1;
         }
     }
 
@@ -1501,16 +1604,16 @@ int sslhcfg_cl_parse(int argc, char* argv[], struct sslhcfg_item* cfg)
     res = read_block(s, cfg, table_sslhcfg, &errmsg);
     if (!res) {
         fprintf(stderr, "%s\n", errmsg);
-        return res;
+        return -1;
     }
 
     res = read_compounds(s, cfg, compound_cl_args, &errmsg);
     if (!res) {
         fprintf(stderr, "%s\n", errmsg);
-        return res;
+        return -1;
     }
 
-    return res;
+    return 0;
 }
 
 

sslh-conf.h

@@ -1,5 +1,5 @@
 /* Generated by conf2struct (https://www.rutschle.net/tech/conf2struct/README)
- * on Fri Jun 19 23:36:04 2020. 
+ * on Wed Jul 29 22:51:16 2020. 
 
 # conf2struct: generate libconf parsers that read to structs
 # Copyright (C) 2018-2019  Yves Rutschle
@@ -30,7 +30,9 @@
  
 #ifndef C2S_SSLHCFG_H
 #define C2S_SSLHCFG_H
-#include <libconfig.h>
+#ifdef LIBCONFIG
+#    include <libconfig.h>
+#endif
 
 
 #include "probe.h"

sslh-main.c

@@ -115,36 +115,9 @@ static void printsettings(void)
 }
 
 
-/* To be removed in v1.21 */
-const char* ssl_err_msg = "Usage of 'ssl' setting is deprecated and will be removed in v1.21. Please use 'tls' instead\n";
-void ssl_to_tls(char* setting)
-{
-    if (!strcmp(setting, "ssl")) {
-        strcpy(setting, "tls"); /* legacy configuration */
-        log_message(LOG_INFO, ssl_err_msg);
-    }
-}
-
-
-/* Turn 'ssl' command line option to 'tls'. To be removed in v1.21 */
-void cmd_ssl_to_tls(int argc, char* argv[])
-{
-    int i;
-    for (i = 0; i < argc; i++) {
-        if (!strcmp(argv[i], "--ssl")) {
-            strcpy(argv[i], "--tls");
-            /* foreground option not parsed yet, syslog not open, just print on
-             * stderr and hope for the best */
-            fprintf(stderr, "%s", ssl_err_msg);
-        }
-    }
-}
-
-
 /* Extract configuration on addresses and ports on which to listen.
  * out: newly allocated list of addrinfo to listen to
  */
-#ifdef LIBCONFIG
 static int config_resolve_listen(struct addrinfo **listen)
 {
     int i, res;
@@ -164,12 +137,11 @@ static int config_resolve_listen(struct addrinfo **listen)
     }
     return 0;
 }
-#endif
 
 
 
-#ifdef LIBCONFIG
 static void setup_regex_probe(struct sslhcfg_protocols_item *p)
+#ifdef LIBCONFIG
 {
     int num_patterns, i, res;
     regex_t** pattern_list;
@@ -196,6 +168,10 @@ static void setup_regex_probe(struct sslhcfg_protocols_item *p)
         }
     }
 }
+#else
+{
+    return;
+}
 #endif
 
 /* For each protocol in the configuration, resolve address and set up protocol
@@ -266,7 +242,7 @@ int main(int argc, char *argv[], char* envp[])
 
    memset(&cfg, 0, sizeof(cfg));
    res = sslhcfg_cl_parse(argc, argv, &cfg);
-   if (!res) exit(1);
+   if (res) exit(6);
    if (cfg.verbose > 3)
        sslhcfg_fprint(stderr, &cfg, 0);
    res = config_resolve_listen(&addr_listen);

sslh.pod

@@ -84,9 +84,6 @@ Uses I<filename> as configuration file. If other
 command-line options are specified, they will override the
 configuration file's settings.
 
-When using the shorthand version, make sure there should be
-no space between B<-F> and the I<filename>.
-
 =item B<-t> I<num>, B<--timeout> I<num>
 
 Timeout before forwarding the connection to the timeout

sslhconf.cfg

@@ -9,7 +9,7 @@ parser: "sslh-conf.c";
 
 printer: true;
 
-conffile_option: ("F", "conffile");
+conffile_option: ("F", "config");
 
 # List of includes to define runtime types
 # (bug in libconfig? if swallows the brackets if they start
@@ -162,7 +162,7 @@ cl_groups: (
         override: "name";
         argdesc: "<host:port>";
         targets: (
-        { path: "name"; value: "openvpn" },
+        { path: "name"; value: "tinc" },
         { path: "host"; value: "$1" },
         { path: "port"; value: "$2" },
         { path: "log_level"; value: 1 },
@@ -212,5 +212,16 @@ cl_groups: (
         { path: "port"; value: "$2" },
         { path: "log_level"; value: 1 }
         );
+    },
+    { name: "anyprot"; pattern: "(.+):(\w+)"; description: "Set up default target";
+        list: "protocols";
+        override: "name";
+        argdesc: "<host:port>";
+        targets: (
+        { path: "name"; value: "anyprot" },
+        { path: "host"; value: "$1" },
+        { path: "port"; value: "$2" },
+        { path: "log_level"; value: 1 }
+        );
     }
 )

t

@@ -36,6 +36,7 @@ my $RB_PARAM_NOHOST =           1;
 my $RB_WRONG_USERNAME =         1;
 my $RB_OPEN_PID_FILE =          1;
 my $RB_RESOLVE_ADDRESS =        1;
+my $RB_CL_PARAMS =              1;
 
 `lcov --directory . --zerocounters`;
 
@@ -343,7 +344,7 @@ if ($RB_PARAM_NOHOST) {
     waitpid $sslh_pid, 0;
     my $code = $? >> 8;
     warn "exited with $code\n";
-    my_is($code, 1, "Exit status on illegal option");
+    my_is($code, 6, "Exit status on illegal option");
 }
 
 # Robustness: User does not exist
@@ -390,6 +391,55 @@ if ($RB_RESOLVE_ADDRESS) {
     my_is($code, 4, "Exit status if can't resolve address");
 }
 
+# Robustness: verify all command line options work
+if ($RB_CL_PARAMS) {
+    print "***Test: Command line parameters\n";
+    my $sslh_pid;
+    if (!($sslh_pid = fork)) {
+        my $user = (getpwuid $<)[0]; # Run under current username
+        # This doesn't test --inetd
+        exec "./sslh-select -v 3 -f -u $user -P $pidfile".
+        " -n --transparent --timeout 10 -C /tmp".
+        " --syslog-facility auth --on-timeout ssh".
+        " --listen localhost:$no_listen --ssh $ssh_address --tls $ssl_address".
+        " --openvpn localhost:$no_listen".
+        " --tinc localhost:$no_listen".
+        " --xmpp localhost:$no_listen".
+        " --http localhost:$no_listen".
+        " --adb localhost:$no_listen".
+        " --socks5 localhost:$no_listen".
+        " --anyprot localhost:$no_listen";
+        exit 0;
+    }
+    warn "spawned $sslh_pid\n";
+    # It will die soon because $user cannot chroot (you
+    # don't test as root, do you?)
+
+    waitpid $sslh_pid, 0;
+    my $code = $? >> 8;
+    warn "exited with $code\n";
+    my_is($code, 1, "Command line arguments");
+
+
+    print "***Test: Bad command line parameters\n";
+    my $sslh_pid;
+    if (!($sslh_pid = fork)) {
+        my $user = (getpwuid $<)[0]; # Run under current username
+        # This doesn't test --inetd
+        exec "./sslh-select -v 3 -f -u $user -P $pidfile".
+        " -n --transparent --timeout 10 -C /tmp".
+        " --fakeoption".
+        " --anyprot localhost:$no_listen";
+        exit 0;
+    }
+    warn "spawned $sslh_pid\n";
+
+    waitpid $sslh_pid, 0;
+    my $code = $? >> 8;
+    warn "exited with $code\n";
+    my_is($code, 6, "Bad command line parameters");
+}
+
 `lcov --directory . --capture --output-file sslh_cov.info`;
 `genhtml sslh_cov.info`;