check accept actually succeeded

ChangeLog

@@ -1,3 +1,17 @@
+
+v1.23.x:
+	Obsolete. Please use v2.0 or above. This is a branch
+	where no new features will be introduced, only
+	bugfixes to versions below 1.22.
+
+v1.23.1:
+	Check accept() for failure in sslh-fork. Aborted
+	connections otherwise result in crashes.
+
+v1.23.0:
+	Reintroduce --ssl as alias to --tls.
+
+
 v1.22: 17AUG2021
 	sslh-select now supports UDP protocols.
 	Probes specified in the `protocols`

common.c

@@ -188,7 +188,7 @@ int start_listen_sockets(struct listen_endpoint *sockfd[])
 
         for (addr = start_addr; addr; addr = addr->ai_next) {
             num_addr++;
-            *sockfd = realloc(*sockfd, num_addr * sizeof(*sockfd));
+            *sockfd = realloc(*sockfd, num_addr * sizeof(*sockfd[0]));
             (*sockfd)[num_addr-1].socketfd = listen_single_addr(addr, keepalive, udp);
             (*sockfd)[num_addr-1].type = udp ? SOCK_DGRAM : SOCK_STREAM;
             if (cfg.verbose)

sslh-conf.c

@@ -1,5 +1,5 @@
 /* Generated by conf2struct (https://www.rutschle.net/tech/conf2struct/README)
- * on Tue Aug 24 13:53:04 2021. 
+ * on Tue Jan  2 21:42:30 2024. 
 
 # conf2struct: generate libconf parsers that read to structs
 # Copyright (C) 2018-2021  Yves Rutschle
@@ -459,6 +459,7 @@ struct arg_file* sslhcfg_conffile;
  	struct arg_str* sslhcfg_listen;
  	struct arg_str* sslhcfg_ssh;
  	struct arg_str* sslhcfg_tls;
+ 	struct arg_str* sslhcfg_ssl;
  	struct arg_str* sslhcfg_openvpn;
  	struct arg_str* sslhcfg_tinc;
  	struct arg_str* sslhcfg_xmpp;
@@ -1094,6 +1095,15 @@ static struct compound_cl_target sslhcfg_openvpn_targets [] = {
 	{ 0 }
 };
 
+static struct compound_cl_target sslhcfg_ssl_targets [] = {
+	{ & table_sslhcfg_protocols[0], 0, .value.def_string = "tls" },
+	{ & table_sslhcfg_protocols[1], 1, .value.def_string = "0" },
+	{ & table_sslhcfg_protocols[2], 2, .value.def_string = "0" },
+	{ & table_sslhcfg_protocols[9], 0, .value.def_int = 1 },
+	{ & table_sslhcfg_protocols[7], 0, .value.def_bool = 1 },
+	{ 0 }
+};
+
 static struct compound_cl_target sslhcfg_tls_targets [] = {
 	{ & table_sslhcfg_protocols[0], 0, .value.def_string = "tls" },
 	{ & table_sslhcfg_protocols[1], 1, .value.def_string = "0" },
@@ -1156,6 +1166,18 @@ static struct compound_cl_arg compound_cl_args[] = {
             .override_const = "tls",
         },
 
+        {   /* arg: ssl */
+            .regex =           "(.+):(\\w+)",
+            .arg_cl =          & sslhcfg_ssl,
+            .base_entry =      & table_sslhcfg [14],
+            .targets =         sslhcfg_ssl_targets,
+
+
+            .override_desc =   & table_sslhcfg_protocols [0],
+            .override_matchindex = 0,
+            .override_const = "tls",
+        },
+
         {   /* arg: openvpn */
             .regex =           "(.+):(\\w+)",
             .arg_cl =          & sslhcfg_openvpn,
@@ -1924,6 +1946,7 @@ int sslhcfg_cl_parse(int argc, char* argv[], struct sslhcfg_item* cfg)
  	sslhcfg_listen = arg_strn("p", "listen", "<host:port>", 0, 10, "Listen on host:port"),
  	sslhcfg_ssh = arg_strn(NULL, "ssh", "<host:port>", 0, 10, "Set up ssh target"),
  	sslhcfg_tls = arg_strn(NULL, "tls", "<host:port>", 0, 10, "Set up TLS/SSL target"),
+ 	sslhcfg_ssl = arg_strn(NULL, "ssl", "<host:port>", 0, 10, "Set up TLS/SSL target"),
  	sslhcfg_openvpn = arg_strn(NULL, "openvpn", "<host:port>", 0, 10, "Set up OpenVPN target"),
  	sslhcfg_tinc = arg_strn(NULL, "tinc", "<host:port>", 0, 10, "Set up tinc target"),
  	sslhcfg_xmpp = arg_strn(NULL, "xmpp", "<host:port>", 0, 10, "Set up XMPP target"),

sslh-conf.h

@@ -1,5 +1,5 @@
 /* Generated by conf2struct (https://www.rutschle.net/tech/conf2struct/README)
- * on Tue Aug 24 13:53:04 2021. 
+ * on Tue Jan  2 21:42:30 2024. 
 
 # conf2struct: generate libconf parsers that read to structs
 # Copyright (C) 2018-2021  Yves Rutschle

sslh-fork.c

@@ -179,6 +179,7 @@ void tcp_listener(struct listen_endpoint* endpoint, int num_endpoints, int activ
 
     while (1) {
         in_socket = accept(endpoint[active_endpoint].socketfd, 0, 0);
+        if (in_socket == -1) continue;
         if (cfg.verbose) fprintf(stderr, "accepted fd %d\n", in_socket);
 
         switch(fork()) {

sslhconf.cfg

@@ -155,6 +155,19 @@ cl_groups: (
         { path: "tfo_ok"; value: 1 }
         );
     },
+    # Redundant with the --tls setting before, for backwards compatibility
+    { name: "ssl"; pattern: "(.+):(\w+)"; description: "Set up TLS/SSL target";
+        list: "protocols";
+        override: "name";
+        argdesc: "<host:port>";
+        targets: (
+        { path: "name"; value: "tls" },
+        { path: "host"; value: "$1" },
+        { path: "port"; value: "$2" },
+        { path: "log_level"; value: 1 },
+        { path: "tfo_ok"; value: 1 }
+        );
+    },
     { name: "openvpn"; pattern: "(.+):(\w+)"; description: "Set up OpenVPN target";
         list: "protocols";
         override: "name";

t

@@ -26,6 +26,7 @@ my $PROBES_NOFRAG =     1;
 my $PROBES_AGAIN =      1;
 my $SSL_MIX_SSH =       1;
 my $SSH_MIX_SSL =       1;
+my $DROP_CNX =          1;
 
 # Robustness tests. These are mostly to achieve full test
 # coverage, but do not necessarily result in an actual test
@@ -285,6 +286,19 @@ for my $binary (@binaries) {
         }
     }
 
+# Test: Drop connection without writing anything
+    if ($DROP_CNX) {
+        print "***Test: Connect but don't write anything\n";
+        my $cnx_h = new IO::Socket::INET(PeerHost => "localhost:$sslh_port");
+        warn "$!\n" unless $cnx_h;
+        if ($cnx_h) {
+            close $cnx_h;
+            my_is(1, "$binary: Connect and write nothing");
+            # The goal of the test is to check sslh doesn't
+            # crash
+        }
+    }
+
 
     if ($PROBES_NOFRAG) {
         test_probes(no_frag => 1, binary => $binary);