git ssb

0+

cel / sslh



Tree: 1b9937b293a932bf394da6623075b35b5e7bd9d2

Files: 1b9937b293a932bf394da6623075b35b5e7bd9d2 / sslh-main.c

19636 bytesRaw
1/*
2# main: processing of config file, command line options and start the main
3# loop.
4#
5# Copyright (C) 2007-2016  Yves Rutschle
6# 
7# This program is free software; you can redistribute it
8# and/or modify it under the terms of the GNU General Public
9# License as published by the Free Software Foundation; either
10# version 2 of the License, or (at your option) any later
11# version.
12# 
13# This program is distributed in the hope that it will be
14# useful, but WITHOUT ANY WARRANTY; without even the implied
15# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
16# PURPOSE.  See the GNU General Public License for more
17# details.
18# 
19# The full text for the General Public License is here:
20# http://www.gnu.org/licenses/gpl.html
21
22*/
23
24#define _GNU_SOURCE
25#ifdef LIBCONFIG
26#include <libconfig.h>
27#endif
28#ifdef ENABLE_REGEX
29#ifdef LIBPCRE
30#include <pcreposix.h>
31#else
32#include <regex.h>
33#endif
34#endif
35
36#include "common.h"
37#include "probe.h"
38
39const char* USAGE_STRING =
40"sslh " VERSION "\n" \
41"usage:\n" \
42"\tsslh  [-v] [-i] [-V] [-f] [-n] [--transparent] [-F <file>]\n"
43"\t[-t <timeout>] [-P <pidfile>] -u <username> -p <add> [-p <addr> ...] \n" \
44"%s\n\n" /* Dynamically built list of builtin protocols */  \
45"\t[--on-timeout <addr>]\n" \
46"-v: verbose\n" \
47"-V: version\n" \
48"-f: foreground\n" \
49"-n: numeric output\n" \
50"-u: specify under which user to run\n" \
51"--transparent: behave as a transparent proxy\n" \
52"-F: use configuration file\n" \
53"--on-timeout: connect to specified address upon timeout (default: ssh address)\n" \
54"-t: seconds to wait before connecting to --on-timeout address.\n" \
55"-p: address and port to listen on.\n    Can be used several times to bind to several addresses.\n" \
56"--[ssh,ssl,...]: where to connect connections from corresponding protocol.\n" \
57"-P: PID file.\n" \
58"-i: Run as a inetd service.\n" \
59"";
60
61/* Constants for options that have no one-character shorthand */
62#define OPT_ONTIMEOUT   257
63
64static struct option const_options[] = {
65    { "inetd",      no_argument,            &inetd,         1 },
66    { "foreground", no_argument,            &foreground,    1 },
67    { "background", no_argument,            &background,    1 },
68    { "transparent", no_argument,           &transparent,   1 },
69    { "numeric",    no_argument,            &numeric,       1 },
70    { "verbose",    no_argument,            &verbose,       1 },
71    { "user",       required_argument,      0,              'u' },
72    { "config",     optional_argument,      0,              'F' },
73    { "pidfile",    required_argument,      0,              'P' },
74    { "timeout",    required_argument,      0,              't' },
75    { "on-timeout", required_argument,      0,              OPT_ONTIMEOUT },
76    { "listen",     required_argument,      0,              'p' },
77    {}
78};
79static struct option* all_options;
80static struct proto* builtins;
81static const char *optstr = "vt:T:p:VP:F::";
82
83
84
85static void print_usage(void)
86{
87    struct proto *p;
88    int i;
89    int res;
90    char *prots = "";
91
92    p = get_builtins();
93    for (i = 0; i < get_num_builtins(); i++) {
94        res = asprintf(&prots, "%s\t[--%s <addr>]\n", prots, p[i].description);
95        CHECK_RES_DIE(res, "asprintf");
96    }
97
98    fprintf(stderr, USAGE_STRING, prots);
99}
100
101static void printcaps(void) {
102#ifdef LIBCAP
103    cap_t caps;
104    char* desc;
105    ssize_t len;
106
107    caps = cap_get_proc();
108
109    desc = cap_to_text(caps, &len);
110
111    fprintf(stderr, "capabilities: %s\n", desc);
112
113    cap_free(caps);
114    cap_free(desc);
115#endif
116}
117
118static void printsettings(void)
119{
120    char buf[NI_MAXHOST];
121    struct addrinfo *a;
122    struct proto *p;
123    
124    for (p = get_first_protocol(); p; p = p->next) {
125        fprintf(stderr,
126                "%s addr: %s. libwrap service: %s log_level: %d family %d %d\n", 
127                p->description, 
128                sprintaddr(buf, sizeof(buf), p->saddr), 
129                p->service,
130                p->log_level,
131                p->saddr->ai_family,
132                p->saddr->ai_addr->sa_family);
133    }
134    fprintf(stderr, "listening on:\n");
135    for (a = addr_listen; a; a = a->ai_next) {
136        fprintf(stderr, 
137                "\t%s\t[keepalive: %d]\n", 
138                sprintaddr(buf, sizeof(buf), a), 
139                a->ai_flags & SO_KEEPALIVE ? 1 : 0);
140    }
141    fprintf(stderr, "timeout: %d\non-timeout: %s\n", probing_timeout,
142            timeout_protocol()->description);
143}
144
145
146/* Extract configuration on addresses and ports on which to listen.
147 * out: newly allocated list of addrinfo to listen to
148 */
149#ifdef LIBCONFIG
150static int config_listen(config_t *config, struct addrinfo **listen) 
151{
152    config_setting_t *setting, *addr;
153    int len, i, keepalive;
154    const char *hostname, *port;
155
156    setting = config_lookup(config, "listen");
157    if (setting) {
158        len = config_setting_length(setting);
159        for (i = 0; i < len; i++) {
160            addr = config_setting_get_elem(setting, i);
161            if (! (config_setting_lookup_string(addr, "host", &hostname) &&
162                   config_setting_lookup_string(addr, "port", &port))) {
163                fprintf(stderr,
164                            "line %d:Incomplete specification (hostname and port required)\n",
165                            config_setting_source_line(addr));
166                return -1;
167            }
168
169            keepalive = 0;
170            config_setting_lookup_bool(addr, "keepalive", &keepalive);
171
172            resolve_split_name(listen, hostname, port);
173
174            /* getaddrinfo returned a list of addresses corresponding to the
175             * specification; move the pointer to the end of that list before
176             * processing the next specification, while setting flags for
177             * start_listen_sockets() through ai_flags (which is not meant for
178             * that, but is only used as hint in getaddrinfo, so it's OK) */
179            for (; *listen; listen = &((*listen)->ai_next)) {
180                if (keepalive)
181                    (*listen)->ai_flags = SO_KEEPALIVE;
182            }
183        }
184    }
185
186    return 0;
187}
188#endif
189
190
191
192#ifdef LIBCONFIG
193static void setup_regex_probe(struct proto *p, config_setting_t* probes)
194{
195#ifdef ENABLE_REGEX
196    int num_probes, errsize, i, res;
197    char *err;
198    const char * expr;
199    regex_t** probe_list;
200
201    num_probes = config_setting_length(probes);
202    if (!num_probes) {
203        fprintf(stderr, "%s: no probes specified\n", p->description);
204        exit(1);
205    }
206
207    p->probe = get_probe("regex");
208    probe_list = calloc(num_probes + 1, sizeof(*probe_list));
209    p->data = (void*)probe_list;
210
211    for (i = 0; i < num_probes; i++) {
212        probe_list[i] = malloc(sizeof(*(probe_list[i])));
213        expr = config_setting_get_string_elem(probes, i);
214        res = regcomp(probe_list[i], expr, 0);
215        if (res) {
216            err = malloc(errsize = regerror(res, probe_list[i], NULL, 0));
217            regerror(res, probe_list[i], err, errsize);
218            fprintf(stderr, "%s:%s\n", expr, err);
219            free(err);
220            exit(1);
221        }
222    }
223#else
224    fprintf(stderr, "line %d: regex probe specified but not compiled in\n", config_setting_source_line(probes));
225    exit(5);
226#endif
227}
228#endif
229
230#ifdef LIBCONFIG
231static void setup_sni_alpn_list(struct proto *p, config_setting_t* config_items, const char* name, int alpn)
232{
233    int num_probes, i, max_server_name_len, server_name_len;
234    const char * config_item;
235    char** sni_hostname_list;
236
237    if(!config_items || !config_setting_is_array(config_items)) {
238        fprintf(stderr, "%s: no %s specified\n", p->description, name);
239        return;
240    }
241    num_probes = config_setting_length(config_items);
242    if (!num_probes) {
243        fprintf(stderr, "%s: no %s specified\n", p->description, name);
244        return;
245    }
246
247    max_server_name_len = 0;
248    for (i = 0; i < num_probes; i++) {
249        server_name_len = strlen(config_setting_get_string_elem(config_items, i));
250        if(server_name_len > max_server_name_len)
251            max_server_name_len = server_name_len;
252    }
253
254    sni_hostname_list = calloc(num_probes + 1, ++max_server_name_len);
255
256    for (i = 0; i < num_probes; i++) {
257        config_item = config_setting_get_string_elem(config_items, i);
258        sni_hostname_list[i] = malloc(max_server_name_len);
259        strcpy (sni_hostname_list[i], config_item);
260        if(verbose) fprintf(stderr, "%s: %s[%d]: %s\n", p->description, name, i, sni_hostname_list[i]);
261    }
262
263    p->data = (void*)tls_data_set_list(p->data, alpn, sni_hostname_list);
264}
265
266static void setup_sni_alpn(struct proto *p, config_setting_t* sni_hostnames, config_setting_t* alpn_protocols)
267{
268    p->data = (void*)new_tls_data();
269    p->probe = get_probe("sni_alpn");
270    setup_sni_alpn_list(p, sni_hostnames, "sni_hostnames", 0);
271    setup_sni_alpn_list(p, alpn_protocols, "alpn_protocols", 1);
272}
273#endif
274
275/* Extract configuration for protocols to connect to.
276 * out: newly-allocated list of protocols
277 */
278#ifdef LIBCONFIG
279static int config_protocols(config_t *config, struct proto **prots)
280{
281    config_setting_t *setting, *prot, *patterns, *sni_hostnames, *alpn_protocols;
282    const char *hostname, *port, *name;
283    int i, num_prots;
284    struct proto *p, *prev = NULL;
285
286    setting = config_lookup(config, "protocols");
287    if (setting) {
288        num_prots = config_setting_length(setting);
289        for (i = 0; i < num_prots; i++) {
290            p = calloc(1, sizeof(*p));
291            if (i == 0) *prots = p;
292            if (prev) prev->next = p;
293            prev = p;
294
295            prot = config_setting_get_elem(setting, i);
296            if ((config_setting_lookup_string(prot, "name", &name) &&
297                 config_setting_lookup_string(prot, "host", &hostname) &&
298                 config_setting_lookup_string(prot, "port", &port)
299                )) {
300                p->description = name;
301                config_setting_lookup_string(prot, "service", &(p->service));
302
303                if (config_setting_lookup_int(prot, "log_level", &p->log_level) == CONFIG_FALSE) {
304                    p->log_level = 1;
305                }
306
307                resolve_split_name(&(p->saddr), hostname, port);
308
309                p->probe = get_probe(name);
310                if (!p->probe || !strcmp(name, "sni_alpn")) {
311                    fprintf(stderr, "line %d: %s: probe unknown\n", config_setting_source_line(prot), name);
312                    exit(1);
313                }
314
315                /* Probe-specific options: regex patterns */
316                if (!strcmp(name, "regex")) {
317                    patterns = config_setting_get_member(prot, "regex_patterns");
318                    if (patterns && config_setting_is_array(patterns)) {
319                        setup_regex_probe(p, patterns);
320                    }
321                }
322
323                /* Probe-specific options: SNI/ALPN */
324                if (!strcmp(name, "tls")) {
325                    sni_hostnames = config_setting_get_member(prot, "sni_hostnames");
326                    alpn_protocols = config_setting_get_member(prot, "alpn_protocols");
327
328                    if((sni_hostnames && config_setting_is_array(sni_hostnames)) || (alpn_protocols && config_setting_is_array(alpn_protocols))) {
329                        setup_sni_alpn(p, sni_hostnames, alpn_protocols);
330                    }
331                }
332
333            }
334        }
335    }
336
337    return 0;
338}
339#endif
340
341/* Parses a config file
342 * in: *filename
343 * out: *listen, a newly-allocated linked list of listen addrinfo
344 *      *prots, a newly-allocated linked list of protocols
345 *      1 on error, 0 on success
346 */
347#ifdef LIBCONFIG
348static int config_parse(char *filename, struct addrinfo **listen, struct proto **prots)
349{
350    config_t config;
351    int timeout;
352    const char* str;
353
354    config_init(&config);
355    if (config_read_file(&config, filename) == CONFIG_FALSE) {
356        /* If it's a parse error then there will be a line number for the failure
357         * an I/O error (such as non-existent file) will have the error line as 0
358         */
359        if (config_error_line(&config) != 0) {
360            fprintf(stderr, "%s:%d:%s\n", 
361                    filename,
362                    config_error_line(&config),
363                    config_error_text(&config));
364            exit(1);
365        }
366        fprintf(stderr, "%s:%s\n", 
367                filename,
368                config_error_text(&config));
369        return 1;
370    }
371
372    config_lookup_bool(&config, "verbose", &verbose);
373    config_lookup_bool(&config, "inetd", &inetd);
374    config_lookup_bool(&config, "foreground", &foreground);
375    config_lookup_bool(&config, "numeric", &numeric);
376    config_lookup_bool(&config, "transparent", &transparent);
377
378    if (config_lookup_int(&config, "timeout", (int *)&timeout) == CONFIG_TRUE) {
379        probing_timeout = timeout;
380    }
381
382    if (config_lookup_string(&config, "on-timeout", &str)) {
383        set_ontimeout(str);
384    }
385
386    config_lookup_string(&config, "user", &user_name);
387    config_lookup_string(&config, "pidfile", &pid_file);
388
389    config_listen(&config, listen);
390    config_protocols(&config, prots);
391
392    return 0;
393}
394#endif
395
396/* Adds protocols to the list of options, so command-line parsing uses the
397 * protocol definition array 
398 * options: array of options to add to; must be big enough
399 * n_opts: number of options in *options before calling (i.e. where to append)
400 * prot: array of protocols
401 * n_prots: number of protocols in *prot
402 * */
403static void append_protocols(struct option *options, int n_opts, struct proto *prot , int n_prots)
404{
405    int o, p;
406
407    for (o = n_opts, p = 0; p < n_prots; o++, p++) {
408        options[o].name = prot[p].description;
409        options[o].has_arg = required_argument;
410        options[o].flag = 0;
411        options[o].val = p + PROT_SHIFT;
412    }
413}
414
415static void make_alloptions(void)
416{
417    builtins = get_builtins();
418
419    /* Create all_options, composed of const_options followed by one option per
420     * known protocol */
421    all_options = calloc(ARRAY_SIZE(const_options) + get_num_builtins(), sizeof(struct option));
422    memcpy(all_options, const_options, sizeof(const_options));
423    append_protocols(all_options, ARRAY_SIZE(const_options) - 1, builtins, get_num_builtins());
424}
425
426/* Performs a first scan of command line options to see if a configuration file
427 * is specified. If there is one, parse it now before all other options (so
428 * configuration file settings can be overridden from the command line).
429 *
430 * prots: newly-allocated list of configured protocols, if any.
431 */
432static void cmdline_config(int argc, char* argv[], struct proto** prots)
433{
434#ifdef LIBCONFIG
435    int c, res;
436    char *config_filename;
437#endif
438
439    make_alloptions();
440
441#ifdef LIBCONFIG
442    optind = 1;
443    opterr = 0; /* we're missing protocol options at this stage so don't output errors */
444    while ((c = getopt_long_only(argc, argv, optstr, all_options, NULL)) != -1) {
445        if (c == 'v') {
446            verbose++;
447        }
448        if (c == 'F') {
449            config_filename = optarg;
450            if (config_filename) {
451                res = config_parse(config_filename, &addr_listen, prots);
452            } else {
453                /* No configuration file specified -- try default file locations */
454                res = config_parse("/etc/sslh/sslh.cfg", &addr_listen, prots);
455                if (!res && verbose) fprintf(stderr, "Using /etc/sslh/sslh.cfg\n");
456                if (res) {
457                    res = config_parse("/etc/sslh.cfg", &addr_listen, prots);
458                    if (!res && verbose) fprintf(stderr, "Using /etc/sslh.cfg\n");
459                }
460            }
461            if (res)
462                exit(4);
463            break;
464        }
465    }
466#endif
467}
468
469
470/* Parse command-line options. prots points to a list of configured protocols,
471 * potentially non-allocated */
472static void parse_cmdline(int argc, char* argv[], struct proto* prots)
473{
474    int c;
475    struct addrinfo **a;
476    struct proto *p;
477
478    optind = 1;
479    opterr = 1;
480next_arg:
481    while ((c = getopt_long_only(argc, argv, optstr, all_options, NULL)) != -1) {
482        if (c == 0) continue;
483
484        if (c >= PROT_SHIFT) {
485            if (prots)
486                for (p = prots; p && p->next; p = p->next) {
487                    /* override if protocol was already defined by config file 
488                     * (note it only overrides address and use builtin probe) */
489                    if (!strcmp(p->description, builtins[c-PROT_SHIFT].description)) {
490                        resolve_name(&(p->saddr), optarg);
491                        p->probe = builtins[c-PROT_SHIFT].probe;
492                        goto next_arg;
493                    }
494                }
495            /* At this stage, it's a new protocol: add it to the end of the
496             * list */
497            if (!prots) {
498                /* No protocols yet -- create the list */
499                p = prots = calloc(1, sizeof(*p));
500            } else {
501                p->next = calloc(1, sizeof(*p));
502                p = p->next;
503            }
504            memcpy(p, &builtins[c-PROT_SHIFT], sizeof(*p));
505            resolve_name(&(p->saddr), optarg);
506            continue;
507        }
508
509        switch (c) {
510
511        case 'F':
512            /* Legal option, but do nothing, it was already processed in
513             * cmdline_config() */
514#ifndef LIBCONFIG
515            fprintf(stderr, "Built without libconfig support: configuration file not available.\n");
516            exit(1);
517#endif
518            break;
519
520        case 't':
521             probing_timeout = atoi(optarg);
522            break;
523
524        case OPT_ONTIMEOUT:
525            set_ontimeout(optarg);
526            break;
527
528        case 'p':
529            /* find the end of the listen list */
530            for (a = &addr_listen; *a; a = &((*a)->ai_next));
531            /* append the specified addresses */
532            resolve_name(a, optarg);
533            
534            break;
535
536        case 'V':
537            printf("%s %s\n", server_type, VERSION);
538            exit(0);
539
540        case 'u':
541            user_name = optarg;
542            break;
543
544        case 'P':
545            pid_file = optarg;
546            break;
547
548        case 'v':
549            verbose++;
550            break;
551
552        default:
553            print_usage();
554            exit(2);
555        }
556    }
557
558    if (!prots) {
559        fprintf(stderr, "At least one target protocol must be specified.\n");
560        exit(2);
561    }
562
563    set_protocol_list(prots);
564
565    if (!addr_listen && !inetd) {
566        fprintf(stderr, "No listening address specified; use at least one -p option\n");
567        exit(1);
568    }
569
570    /* Did command-line override foreground setting? */
571    if (background)
572        foreground = 0;
573
574}
575
576int main(int argc, char *argv[])
577{
578
579   extern char *optarg;
580   extern int optind;
581   int res, num_addr_listen;
582   struct proto* protocols = NULL;
583
584   int *listen_sockets;
585
586   /* Init defaults */
587   pid_file = NULL;
588   user_name = NULL;
589
590   cmdline_config(argc, argv, &protocols);
591   parse_cmdline(argc, argv, protocols);
592
593   if (inetd)
594   {
595       verbose = 0;
596       start_shoveler(0);
597       exit(0);
598   }
599
600   if (verbose)
601       printsettings();
602
603   num_addr_listen = start_listen_sockets(&listen_sockets, addr_listen);
604
605   if (!foreground) {
606       if (fork() > 0) exit(0); /* Detach */
607
608       /* New session -- become group leader */
609       if (getuid() == 0) {
610           res = setsid();
611           CHECK_RES_DIE(res, "setsid: already process leader");
612       }
613   }
614
615   setup_signals();
616
617   if (pid_file)
618       write_pid_file(pid_file);
619
620   if (user_name)
621       drop_privileges(user_name);
622
623
624   /* Open syslog connection */
625   setup_syslog(argv[0]);
626
627   if (verbose)
628       printcaps();
629
630   main_loop(listen_sockets, num_addr_listen);
631
632   return 0;
633}
634

Built with git-ssb-web