downgrade TLS error to info (fix #367)

Fix typo

ChangeLog

@@ -25,6 +25,8 @@ v2.0:
 	connection instead of at startup. Useful for dynamic
 	DNS situations. (Paul Schroeder/milkpirate)
 
+	New probe for MSRDP (akappner).
+
 v1.22: 17AUG2021
 	sslh-select now supports UDP protocols.
 	Probes specified in the `protocols`

Makefile

@@ -29,13 +29,15 @@ ifneq ($(strip $(COV_TEST)),)
 endif
 
 CC ?= gcc
+AR ?= ar
 CFLAGS ?=-Wall -O2 -DLIBPCRE -g $(CFLAGS_COV) $(CFLAGS_SAN)
 
 LIBS=-lm -lpcre2-8
 OBJS=sslh-conf.o common.o log.o sslh-main.o probe.o tls.o argtable3.o collection.o gap.o tcp-probe.o
-FORK_OBJS=$(OBJS) sslh-fork.o
-SELECT_OBJS=$(OBJS) processes.o udp-listener.o sslh-select.o hash.o tcp-listener.o
-EV_OBJS=$(OBJS) processes.o udp-listener.o sslh-ev.o hash.o tcp-listener.o
+OBJS_A=libsslh.a
+FORK_OBJS=sslh-fork.o $(OBJS_A)
+SELECT_OBJS=processes.o udp-listener.o sslh-select.o hash.o tcp-listener.o $(OBJS_A)
+EV_OBJS=processes.o udp-listener.o sslh-ev.o hash.o tcp-listener.o $(OBJS_A)
 
 CONDITIONAL_TARGETS=
 
@@ -72,8 +74,11 @@ endif
 
 all: sslh $(MAN) echosrv $(CONDITIONAL_TARGETS)
 
-.c.o: *.h version.h
-	$(CC) $(CFLAGS) $(CPPFLAGS) -c $<
+%.o: %.c %.h version.h
+	$(CC) $(CFLAGS) $(CPPFLAGS) -c $< -o $@
+
+$(OBJS_A): $(OBJS)
+	$(AR) rcs $(OBJS_A) $(OBJS)
 
 version.h:
 	./genver.sh >version.h
@@ -82,20 +87,18 @@ sslh: sslh-fork sslh-select sslh-ev
 
 $(OBJS) $(FORK_OBJS) $(SELECT_OBJS) $(EV_OBJS): argtable3.h collection.h common.h gap.h hash.h log.h probe.h processes.h sslh-conf.h tcp-listener.h tcp-probe.h tls.h udp-listener.h version.h
 
+
 sslh-conf.c sslh-conf.h: sslhconf.cfg
 	conf2struct sslhconf.cfg
 
 sslh-fork: version.h Makefile $(FORK_OBJS)
 	$(CC) $(CFLAGS) $(LDFLAGS) -o sslh-fork $(FORK_OBJS) $(LIBS)
-	#strip sslh-fork
 
 sslh-select: version.h $(SELECT_OBJS) Makefile
 	$(CC) $(CFLAGS) $(LDFLAGS) -o sslh-select $(SELECT_OBJS) $(LIBS)
-	#strip sslh-select
 
 sslh-ev: version.h $(EV_OBJS) Makefile
 	$(CC) $(CFLAGS) $(LDFLAGS) -o sslh-ev $(EV_OBJS) $(LIBS) -lev
-	#strip sslh-ev
 
 systemd-sslh-generator: systemd-sslh-generator.o
 	$(CC) $(CFLAGS) $(LDFLAGS) -o systemd-sslh-generator systemd-sslh-generator.o -lconfig
@@ -145,7 +148,7 @@ distclean: clean
 	rm -f tags sslh-conf.[ch] echosrv-conf.[ch] cscope.*
 
 clean:
-	rm -f sslh-fork sslh-select echosrv version.h $(MAN) systemd-sslh-generator *.o *.gcov *.gcno *.gcda *.png *.html *.css *.info
+	rm -f sslh-fork sslh-select sslh-ev echosrv version.h $(MAN) systemd-sslh-generator *.o *.gcov *.gcno *.gcda *.png *.html *.css *.info
 
 tags:
 	ctags --globals -T *.[ch]

basic.cfg

@@ -1,23 +1,25 @@
 # This is a basic configuration file that should provide
 # sensible values for "standard" setup.
 
-verbose: 0;
-foreground: false;
-inetd: false;
-numeric: false;
-transparent: false;
+# You will find extensive examples with explanations in
+# example.cfg
+
 timeout: 2;
 user: "nobody";
 pidfile: "/var/run/sslh.pid";
-chroot: "/var/empty";
 
 
-# Change hostname with your external address name.
+# Change hostname with your external address name, or the IP
+# of the interface that receives connections
 listen:
 (
     { host: "thelonious"; port: "443"; }
 );
 
+
+# Change to the protocols you want to forward to. The
+# defaults here are sensible for services running on
+# localhost
 protocols:
 (
      { name: "ssh"; service: "ssh"; host: "localhost"; port: "22"; fork: true; },

doc/INSTALL.md

@@ -7,7 +7,7 @@ Dependencies
 `sslh` uses:
 
 * [libconfig](http://www.hyperrealm.com/libconfig/). For
-  Debian this is contained in package `libconfig8-dev`. You
+  Debian this is contained in package `libconfig-dev`. You
 can compile with or without it using USELIBCONFIG in the
 Makefile.
 
@@ -29,6 +29,13 @@ Makefile.
 which requires `libbsd` at runtime, and `libbsd-dev` at
 compile-time.
 
+* libpcre2, in package `libpcre-dev`. You can compile
+  with or without it using ENABLE_REGEX in the Makefile.
+
+* libev-dev, in package `libev-dev`. If you build a binary
+  specifically and do not build `sslh-ev`, you don't need
+  this.
+
 
 For OpenSUSE, these are contained in packages libconfig9 and
 libconfig-dev in repository
@@ -44,6 +51,10 @@ distclean` for example), you will also need to add
 [conf2struct](https://www.rutschle.net/tech/conf2struct/README.html)
 (v1.5) to your path.
 
+
+The test scripts are written in Perl, and will require
+IO::Socket::INET6 (libio-socket-inet6-perl in Debian).
+
 Compilation
 -----------
 
@@ -71,8 +82,8 @@ of the Makefile:
 Binaries
 --------
 
-The Makefile produces two different executables: `sslh-fork`
-and `sslh-select`:
+The Makefile produces three different executables: `sslh-fork`,
+`sslh-select` and `sslh-ev`:
 
 * `sslh-fork` forks a new process for each incoming connection.
 It is well-tested and very reliable, but incurs the overhead
@@ -81,18 +92,17 @@ If you are going to use `sslh` for a "small" setup (less than
 a dozen ssh connections and a low-traffic https server) then
 `sslh-fork` is probably more suited for you. 
 
-* `sslh-select` uses only one thread, which monitors all connections
-at once. It is more recent and less tested, but only incurs a 16
-byte overhead per connection. Also, if it stops, you'll lose all
-connections, which means you can't upgrade it remotely.  
-If you are going to use `sslh` on a "medium" setup (a few thousand ssh
-connections, and another few thousand ssl connections),
-`sslh-select` will be better.
-
-If you have a very large site (tens of thousands of connections),
-you'll need a vapourware version that would use libevent or
-something like that.
+* `sslh-select` uses only one thread, which monitors all
+  connections at once. It only incurs a 16 byte overhead per
+connection.  Also, if it stops, you'll lose all connections,
+which means you can't upgrade it remotely.  If you are going
+to use `sslh` on a "medium" setup (a few hundreds of
+connections), or if you are on a system where forking is
+expensive (e.g. Windows), `sslh-select` will be better.
 
+* `sslh-ev` is similar to `sslh-select`, but uses `libev` as
+  a backend. This allows using specific kernel APIs that
+allow to manage thousands of connections concurrently.
 
 Installation
 ------------

doc/config.md

@@ -65,13 +65,13 @@ Configuration goes like this on the server side, using `stunnel3`:
   * `-f` for foreground/debugging
   * `-p` for specifying the key and certificate
   * `-d` for specifying which interface and port
-	we're listening to for incoming connexions
+	we're listening to for incoming connections
   * `-l` summons `sslh` in inetd mode.
 
 * sslh options:
   * `-i` for inetd mode
-  * `--http` to forward HTTP connexions to port 80,
-	and SSH connexions to port 22.
+  * `--http` to forward HTTP connections to port 80,
+	and SSH connections to port 22.
 
 Capabilities support
 --------------------
@@ -189,7 +189,7 @@ UDP
 ---
 
 `sslh` can perform demultiplexing on UDP packets as well.
-This only works with `sslh-select` (it is not possible to
+This does not work with `sslh-fork` (it is not possible to
 support UDP with a forking model). Specify a listening
 address and target protocols with `is_udp: true`. `sslh`
 will wait for incoming UDP packets, run the probes in the

example.cfg

@@ -123,7 +123,7 @@ protocols:
                       udp_timeout: 20;  # Time after which the "connection" is forgotten
                       regex_patterns: [ "hello" ]; },
 # Forward Teamspeak3 (Voice only)
-     { name: "regex"; host: "localhost"; is_udp: true; port: "9987"; regex_patterns: [ "TS3INIT1" ]; },
+     { name: "teamspeak"; host: "localhost"; is_udp: true; port: "9987"; },
 # Forward IETF QUIC-50 ("Q050" -> "\x51\x30\x35\x30")
 # Remember that the regex needs to be adjusted for every supported QUIC version.
      { name: "regex"; host: "localhost"; is_udp: true; port: "4433"; regex_patterns: [ "\x51\x30\x35\x30" ]; },

probe.c

@@ -33,6 +33,7 @@
 
 static int is_ssh_protocol(const char *p, ssize_t len, struct sslhcfg_protocols_item*);
 static int is_openvpn_protocol(const char *p, ssize_t len, struct sslhcfg_protocols_item*);
+static int is_wireguard_protocol(const char *p, ssize_t len, struct sslhcfg_protocols_item*);
 static int is_tinc_protocol(const char *p, ssize_t len, struct sslhcfg_protocols_item*);
 static int is_xmpp_protocol(const char *p, ssize_t len, struct sslhcfg_protocols_item*);
 static int is_http_protocol(const char *p, ssize_t len, struct sslhcfg_protocols_item*);
@@ -40,6 +41,8 @@ static int is_tls_protocol(const char *p, ssize_t len, struct sslhcfg_protocols_
 static int is_adb_protocol(const char *p, ssize_t len, struct sslhcfg_protocols_item*);
 static int is_socks5_protocol(const char *p, ssize_t len, struct sslhcfg_protocols_item*);
 static int is_syslog_protocol(const char *p, ssize_t len, struct sslhcfg_protocols_item*);
+static int is_teamspeak_protocol(const char *p, ssize_t len, struct sslhcfg_protocols_item*);
+static int is_msrdp_protocol(const char *p, ssize_t len, struct sslhcfg_protocols_item*);
 static int is_true(const char *p, ssize_t len, struct sslhcfg_protocols_item* proto) { return 1; }
 
 /* Table of protocols that have a built-in probe
@@ -48,6 +51,7 @@ static struct protocol_probe_desc builtins[] = {
     /* description  probe  */
     { "ssh",        is_ssh_protocol},
     { "openvpn",    is_openvpn_protocol },
+    { "wireguard",  is_wireguard_protocol },
     { "tinc",       is_tinc_protocol },
     { "xmpp",       is_xmpp_protocol },
     { "http",       is_http_protocol },
@@ -55,6 +59,8 @@ static struct protocol_probe_desc builtins[] = {
     { "adb",        is_adb_protocol },
     { "socks5",     is_socks5_protocol },
     { "syslog",     is_syslog_protocol },
+    { "teamspeak",  is_teamspeak_protocol },
+    { "msrdp",      is_msrdp_protocol },
     { "anyprot",    is_true }
 };
 
@@ -112,7 +118,7 @@ void hexdump(msg_info msg_info, const char *mem, unsigned int len)
             }
             str[c++] = '\n';
             str[c++] = 0;
-            print_message(msg_info, str);
+            print_message(msg_info, "%s", str);
             c = 0;
         }
     }
@@ -137,15 +143,66 @@ static int is_ssh_protocol(const char *p, ssize_t len, struct sslhcfg_protocols_
  * http://www.fengnet.com/book/vpns%20illustrated%20tunnels%20%20vpnsand%20ipsec/ch08lev1sec5.html
  * and OpenVPN ssl.c, ssl.h and options.c
  */
+#define OVPN_OPCODE_MASK 0xF8
+#define OVPN_CONTROL_HARD_RESET_CLIENT_V1  (0x01 << 3)
+#define OVPN_CONTROL_HARD_RESET_CLIENT_V2  (0x07 << 3)
+#define OVPN_HMAC_128 16
+#define OVPN_HMAC_160 20
+#define OVPN_HARD_RESET_PACKET_ID_OFFSET(hmac_size) (9 + hmac_size)
 static int is_openvpn_protocol (const char*p,ssize_t len, struct sslhcfg_protocols_item* proto)
 {
     int packet_len;
 
-    if (len < 2)
-        return PROBE_AGAIN;
+    if (proto->is_udp == 0)
+    {
+        if (len < 2)
+            return PROBE_AGAIN;
 
-    packet_len = ntohs(*(uint16_t*)p);
-    return packet_len == len - 2;
+        packet_len = ntohs(*(uint16_t*)p);
+        return packet_len == len - 2;
+    } else {
+        if (len < 1)
+            return PROBE_NEXT;
+
+        if ((p[0] & OVPN_OPCODE_MASK) != OVPN_CONTROL_HARD_RESET_CLIENT_V1 &&
+            (p[0] & OVPN_OPCODE_MASK) != OVPN_CONTROL_HARD_RESET_CLIENT_V2)
+            return PROBE_NEXT;
+
+        /* The detection pattern above may not be reliable enough.
+         * Check the packet id: OpenVPN sents five initial packets
+         * whereas the packet id is increased with every transmitted datagram.
+         */
+
+        if (len <= OVPN_HARD_RESET_PACKET_ID_OFFSET(OVPN_HMAC_128))
+            return PROBE_NEXT;
+
+        if (ntohl(*(uint32_t*)(p + OVPN_HARD_RESET_PACKET_ID_OFFSET(OVPN_HMAC_128))) <= 5u)
+            return PROBE_MATCH;
+
+        if (len <= OVPN_HARD_RESET_PACKET_ID_OFFSET(OVPN_HMAC_160))
+            return PROBE_NEXT;
+
+        if (ntohl(*(uint32_t*)(p + OVPN_HARD_RESET_PACKET_ID_OFFSET(OVPN_HMAC_160))) <= 5u)
+            return PROBE_MATCH;
+
+        return PROBE_NEXT;
+    }
+}
+
+static int is_wireguard_protocol(const char *p, ssize_t len, struct sslhcfg_protocols_item* proto)
+{
+    if (proto->is_udp == 0)
+        return PROBE_NEXT;
+
+    // Handshake Init: 148 bytes
+    if (len != 148)
+        return PROBE_NEXT;
+
+    // Handshake Init: p[0] = 0x01, p[1..3] = 0x000000 (reserved)
+    if (ntohl(*(uint32_t*)p) != 0x01000000)
+        return PROBE_NEXT;
+
+    return PROBE_MATCH;
 }
 
 /* Is the buffer the beginning of a tinc connections?
@@ -318,6 +375,27 @@ static int is_syslog_protocol(const char *p, ssize_t len, struct sslhcfg_protoco
     return 0;
 }
 
+static int is_teamspeak_protocol(const char *p, ssize_t len, struct sslhcfg_protocols_item* proto)
+{
+    if (len < 8)
+        return PROBE_NEXT;
+
+    return !strncmp(p, "TS3INIT1", len);
+}
+
+static int is_msrdp_protocol(const char *p, ssize_t len, struct sslhcfg_protocols_item* proto)
+{
+    char version;
+    char packet_len;
+    if (len < 7)
+        return PROBE_NEXT;
+    version=*p;
+    if (version!=0x03)
+        return 0;
+    packet_len = ntohs(*(uint16_t*)(p+2));
+    return packet_len == len;
+}
+
 static int regex_probe(const char *p, ssize_t len, struct sslhcfg_protocols_item* proto)
 {
 #ifdef ENABLE_REGEX
@@ -395,6 +473,13 @@ int probe_buffer(char* buf, int len,
         return PROBE_AGAIN;
 
     /* Everything failed: match the last one */
+
+    if (proto_len == 0) {
+        /* This should be caught by configuration sanity checks, but just in
+         * case, die gracefully rather than segfaulting */
+        print_message(msg_int_error, "Received traffic on transport that has no target\n");
+        exit(0);
+    }
     *proto_out = proto_in[proto_len-1];
     return PROBE_MATCH;
 }

scripts/fail2ban/sslh-ssh.conf

@@ -16,7 +16,7 @@
 
 [Definition]
 
-failregex = ^.+ sslh\[.+\]: connection from <HOST>:.+ to .+ forwarded
+failregex = ^.+ sslh\[.+\]: ssh:connection from <HOST>:.+ to .+ forwarded
 from .+ to .+:ssh\s*$
 
 ignoreregex =

sslh-conf.c

@@ -1,5 +1,5 @@
 /* Generated by conf2struct (https://www.rutschle.net/tech/conf2struct/README)
- * on Sat Apr 30 09:55:01 2022. 
+ * on Sun Sep 11 21:43:25 2022. 
 
 # conf2struct: generate libconf parsers that read to structs
 # Copyright (C) 2018-2021  Yves Rutschle
@@ -473,11 +473,13 @@ struct arg_file* sslhcfg_conffile;
  	struct arg_str* sslhcfg_tls;
  	struct arg_str* sslhcfg_openvpn;
  	struct arg_str* sslhcfg_tinc;
+ 	struct arg_str* sslhcfg_wireguard;
  	struct arg_str* sslhcfg_xmpp;
  	struct arg_str* sslhcfg_http;
  	struct arg_str* sslhcfg_adb;
  	struct arg_str* sslhcfg_socks5;
  	struct arg_str* sslhcfg_syslog;
+ 	struct arg_str* sslhcfg_msrdp;
  	struct arg_str* sslhcfg_anyprot;
  struct arg_end* sslhcfg_end;
 
@@ -1256,6 +1258,14 @@ static struct compound_cl_target sslhcfg_anyprot_targets [] = {
 	{ 0 }
 };
 
+static struct compound_cl_target sslhcfg_msrdp_targets [] = {
+	{ & table_sslhcfg_protocols[0], 0, .value.def_string = "msrdp" },
+	{ & table_sslhcfg_protocols[1], 1, .value.def_string = "0" },
+	{ & table_sslhcfg_protocols[2], 2, .value.def_string = "0" },
+	{ & table_sslhcfg_protocols[10], 0, .value.def_int = 1 },
+	{ 0 }
+};
+
 static struct compound_cl_target sslhcfg_syslog_targets [] = {
 	{ & table_sslhcfg_protocols[0], 0, .value.def_string = "syslog" },
 	{ & table_sslhcfg_protocols[1], 1, .value.def_string = "0" },
@@ -1296,6 +1306,15 @@ static struct compound_cl_target sslhcfg_xmpp_targets [] = {
 	{ 0 }
 };
 
+static struct compound_cl_target sslhcfg_wireguard_targets [] = {
+	{ & table_sslhcfg_protocols[0], 0, .value.def_string = "wireguard" },
+	{ & table_sslhcfg_protocols[1], 1, .value.def_string = "0" },
+	{ & table_sslhcfg_protocols[2], 2, .value.def_string = "0" },
+	{ & table_sslhcfg_protocols[10], 0, .value.def_int = 1 },
+	{ & table_sslhcfg_protocols[7], 0, .value.def_bool = 1 },
+	{ 0 }
+};
+
 static struct compound_cl_target sslhcfg_tinc_targets [] = {
 	{ & table_sslhcfg_protocols[0], 0, .value.def_string = "tinc" },
 	{ & table_sslhcfg_protocols[1], 1, .value.def_string = "0" },
@@ -1400,6 +1419,18 @@ static struct compound_cl_arg compound_cl_args[] = {
             .override_const = "tinc",
         },
 
+        {   /* arg: wireguard */
+            .regex =           "(.+):(\\w+)",
+            .arg_cl =          & sslhcfg_wireguard,
+            .base_entry =      & table_sslhcfg [26],
+            .targets =         sslhcfg_wireguard_targets,
+
+
+            .override_desc =   & table_sslhcfg_protocols [0],
+            .override_matchindex = 0,
+            .override_const = "wireguard",
+        },
+
         {   /* arg: xmpp */
             .regex =           "(.+):(\\w+)",
             .arg_cl =          & sslhcfg_xmpp,
@@ -1460,6 +1491,18 @@ static struct compound_cl_arg compound_cl_args[] = {
             .override_const = "syslog",
         },
 
+        {   /* arg: msrdp */
+            .regex =           "(.+):(\\w+)",
+            .arg_cl =          & sslhcfg_msrdp,
+            .base_entry =      & table_sslhcfg [26],
+            .targets =         sslhcfg_msrdp_targets,
+
+
+            .override_desc =   & table_sslhcfg_protocols [0],
+            .override_matchindex = 0,
+            .override_const = "msrdp",
+        },
+
         {   /* arg: anyprot */
             .regex =           "(.+):(\\w+)",
             .arg_cl =          & sslhcfg_anyprot,
@@ -2158,11 +2201,13 @@ int sslhcfg_cl_parse(int argc, char* argv[], struct sslhcfg_item* cfg)
  	sslhcfg_tls = arg_strn(NULL, "tls", "<host:port>", 0, 10, "Set up TLS/SSL target"),
  	sslhcfg_openvpn = arg_strn(NULL, "openvpn", "<host:port>", 0, 10, "Set up OpenVPN target"),
  	sslhcfg_tinc = arg_strn(NULL, "tinc", "<host:port>", 0, 10, "Set up tinc target"),
+ 	sslhcfg_wireguard = arg_strn(NULL, "wireguard", "<host:port>", 0, 10, "Set up WireGuard target"),
  	sslhcfg_xmpp = arg_strn(NULL, "xmpp", "<host:port>", 0, 10, "Set up XMPP target"),
  	sslhcfg_http = arg_strn(NULL, "http", "<host:port>", 0, 10, "Set up HTTP (plain) target"),
  	sslhcfg_adb = arg_strn(NULL, "adb", "<host:port>", 0, 10, "Set up ADB (Android Debug) target"),
  	sslhcfg_socks5 = arg_strn(NULL, "socks5", "<host:port>", 0, 10, "Set up socks5 target"),
  	sslhcfg_syslog = arg_strn(NULL, "syslog", "<host:port>", 0, 10, "Set up syslog target"),
+ 	sslhcfg_msrdp = arg_strn(NULL, "msrdp", "<host:port>", 0, 10, "Set up msrdp target"),
  	sslhcfg_anyprot = arg_strn(NULL, "anyprot", "<host:port>", 0, 10, "Set up default target"),
  	sslhcfg_end = arg_end(10)
 

sslh-conf.h

@@ -1,5 +1,5 @@
 /* Generated by conf2struct (https://www.rutschle.net/tech/conf2struct/README)
- * on Sat Apr 30 09:55:01 2022. 
+ * on Sun Sep 11 21:43:25 2022. 
 
 # conf2struct: generate libconf parsers that read to structs
 # Copyright (C) 2018-2021  Yves Rutschle

sslh-main.c

@@ -167,11 +167,9 @@ static void config_protocols()
 }
 
 
-void config_sanity_check(struct sslhcfg_item* cfg) {
-    if (!cfg->protocols_len) {
-        print_message(msg_config_error, "At least one target protocol must be specified.\n");
-        exit(2);
-    }
+void config_sanity_check(struct sslhcfg_item* cfg)
+{
+    size_t i;
 
 /* If compiling with systemd socket support no need to require listen address */
 #ifndef SYSTEMD
@@ -180,6 +178,37 @@ void config_sanity_check(struct sslhcfg_item* cfg) {
         exit(1);
     }
 #endif
+
+    for (i = 0; i < cfg->protocols_len; ++i) {
+        if (strcmp(cfg->protocols[i].name, "tls")) {
+            if (cfg->protocols[i].sni_hostnames_len) {
+                print_message(msg_config_error, "name: \"%s\"; host: \"%s\"; port: \"%s\": "
+                              "Config option sni_hostnames is only applicable for tls\n",
+                              cfg->protocols[i].name, cfg->protocols[i].host, cfg->protocols[i].port);
+                exit(1);
+            }
+            if (cfg->protocols[i].alpn_protocols_len) {
+                print_message(msg_config_error, "name: \"%s\"; host: \"%s\"; port: \"%s\": "
+                              "Config option alpn_protocols is only applicable for tls\n",
+                              cfg->protocols[i].name, cfg->protocols[i].host, cfg->protocols[i].port);
+                exit(1);
+            }
+        }
+
+        if (cfg->protocols[i].is_udp) {
+            if (cfg->protocols[i].tfo_ok) {
+                print_message(msg_config_error, "name: \"%s\"; host: \"%s\"; port: \"%s\": "
+                              "Config option tfo_ok is not applicable for udp connections\n",
+                              cfg->protocols[i].name, cfg->protocols[i].host, cfg->protocols[i].port);
+                exit(1);
+            }
+        } else {
+            if (!strcmp(cfg->protocols[i].name, "wireguard")) {
+                print_message(msg_config_error, "Wireguard works only with UDP\n");
+                exit(1);
+            }
+        }
+    }
 }
 
 

sslh-select.c

@@ -52,6 +52,9 @@ static void watchers_init(watchers** w, struct listen_endpoint* listen_sockets,
                           int num_addr_listen)
 {
     *w = malloc(sizeof(**w));
+    CHECK_ALLOC(*w, "malloc");
+
+    memset(*w, 0, sizeof(**w));
     FD_ZERO(&(*w)->fds_r);
     FD_ZERO(&(*w)->fds_w);
 
@@ -143,9 +146,9 @@ void main_loop(struct listen_endpoint listen_sockets[], int num_addr_listen)
         memcpy(&readfds, &fd_info.watchers->fds_r, sizeof(readfds));
         memcpy(&writefds, &fd_info.watchers->fds_w, sizeof(writefds));
 
-        print_message(msg_fd, "selecting... max_fd=%d num_probing=%d\n", 
+        print_message(msg_fd, "selecting... max_fd=%d num_probing=%d\n",
                                           fd_info.watchers->max_fd, fd_info.num_probing);
-        res = select(fd_info.watchers->max_fd, &readfds, &writefds, 
+        res = select(fd_info.watchers->max_fd + 1, &readfds, &writefds,
                      NULL, fd_info.num_probing ? &tv : NULL);
         if (res < 0)
             perror("select");
@@ -165,7 +168,10 @@ void main_loop(struct listen_endpoint listen_sockets[], int num_addr_listen)
 
         /* Check all sockets for write activity */
         for (i = 0; i < fd_info.watchers->max_fd; i++) {
-            if (FD_ISSET(i, &writefds)) {
+            /* Check if it's active AND currently monitored (if a connection
+             * died, it gets tidied, which closes both sockets, but writefs does
+             * not know about that */
+            if (FD_ISSET(i, &writefds) && FD_ISSET(i, &fd_info.watchers->fds_w)) {
                 cnx_write_process(&fd_info, i);
             }
         }

sslhconf.cfg

@@ -210,6 +210,18 @@ cl_groups: (
         { path: "tfo_ok"; value: 1 }
         );
     },
+    { name: "wireguard"; pattern: "(.+):(\w+)"; description: "Set up WireGuard target";
+        list: "protocols";
+        override: "name";
+        argdesc: "<host:port>";
+        targets: (
+        { path: "name"; value: "wireguard" },
+        { path: "host"; value: "$1" },
+        { path: "port"; value: "$2" },
+        { path: "log_level"; value: 1 },
+        { path: "tfo_ok"; value: 1 }
+        );
+    },
     { name: "xmpp"; pattern: "(.+):(\w+)"; description: "Set up XMPP target";
         list: "protocols";
         override: "name";
@@ -265,6 +277,17 @@ cl_groups: (
         { path: "log_level"; value: 1 }
         );
     },
+    { name: "msrdp"; pattern: "(.+):(\w+)"; description: "Set up msrdp target";
+        list: "protocols";
+        override: "name";
+        argdesc: "<host:port>";
+        targets: (
+        { path: "name"; value: "msrdp" },
+        { path: "host"; value: "$1" },
+        { path: "port"; value: "$2" },
+        { path: "log_level"; value: 1 }
+        );
+    },
     { name: "anyprot"; pattern: "(.+):(\w+)"; description: "Set up default target";
         list: "protocols";
         override: "name";

tcp-listener.c

@@ -83,6 +83,11 @@ void tcp_read_process(struct loop_info* fd_info,
 {
     cnx_collection* collection = fd_info->collection;
     struct connection* cnx = collection_get_cnx_from_fd(collection, fd);
+
+    /* connection can get tidied if there is an error on the other file
+     * descriptor -- then cnx is NULL */
+    if (!cnx) return;
+
     /* Determine active queue (0 or 1): if fd is that of q[1], active_q = 1,
      * otherwise it's 0 */
     int active_q = active_queue(cnx, fd);
@@ -306,6 +311,11 @@ void probing_read_process(struct connection* cnx,
 void cnx_write_process(struct loop_info* fd_info, int fd)
 {
     struct connection* cnx = collection_get_cnx_from_fd(fd_info->collection, fd);
+
+    /* connection can get tidied if there is an error on the other file
+     * descriptor -- then cnx is NULL */
+    if (!cnx) return;
+
     int res;
     int queue = active_queue(cnx, fd);
 

tcp-probe.c

@@ -70,7 +70,29 @@ static void tcp_protocol_list_init(void)
     }
 }
 
+/* Configuration sanity check for TCP:
+ * - If there is a listening socket, there must be at least one target
+ */
+static void tcp_sanity_check(void)
+{
+    int tcp_present = 0;
+
+    for (int i = 0; i < cfg.listen_len; i++) {
+        struct sslhcfg_listen_item* p = &cfg.listen[i];
+        if (!p->is_udp) {
+            tcp_present = 1;
+            break;
+        }
+    }
+
+    if (tcp_present && !tcp_protocols_len) {
+        print_message(msg_config_error, "At least one TCP target protocol must be specified.\n");
+        exit(2);
+    }
+}
+
 void tcp_init(void)
 {
     tcp_protocol_list_init();
+    tcp_sanity_check();
 }

tls.c

@@ -83,7 +83,7 @@ parse_tls_header(const struct TLSProtocol *tls_data, const char *data, size_t da
 
     tls_content_type = data[0];
     if (tls_content_type != TLS_HANDSHAKE_CONTENT_TYPE) {
-        print_message(msg_probe_error, "Request did not begin with TLS handshake.\n");
+        print_message(msg_probe_info, "Request did not begin with TLS handshake.\n");
         return TLS_EPROTOCOL;
     }
 

udp-listener.c

@@ -91,6 +91,27 @@ static void udp_protocol_list_init(void)
     }
 }
 
+/* Configuration sanity check for UDP:
+ * - If there is a listening addres, there must be at least one target
+ */
+static void udp_sanity_check(void)
+{
+    int udp_present = 0;
+
+    for (int i = 0; i < cfg.listen_len; i++) {
+        struct sslhcfg_listen_item* p = &cfg.listen[i];
+        if (p->is_udp) {
+            udp_present = 1;
+            break;
+        }
+    }
+
+    if (udp_present && !udp_protocols_len) {
+        print_message(msg_config_error, "At least one UDP target protocol must be specified.\n");
+        exit(2);
+    }
+}
+
 /* Init the UDP subsystem.
  * - Initialise the hash
  * - that's all, folks
@@ -100,6 +121,7 @@ void udp_init(struct loop_info* fd_info)
     fd_info->hash_sources = hash_init(cfg.udp_max_connections, &hash_make_key, &cnx_cmp);
 
     udp_protocol_list_init();
+    udp_sanity_check();
 }