git ssb

Files: e5cb33fcb7d6781e4017c3aecaee52e2aa8c2916 / sslh-main.c

19142 bytesRaw

1 /*
2 # main: processing of config file, command line options and start the main
3 # loop.
4 #
5 # Copyright (C) 2007-2014  Yves Rutschle
6 # 
7 # This program is free software; you can redistribute it
8 # and/or modify it under the terms of the GNU General Public
9 # License as published by the Free Software Foundation; either
10 # version 2 of the License, or (at your option) any later
11 # version.
12 # 
13 # This program is distributed in the hope that it will be
14 # useful, but WITHOUT ANY WARRANTY; without even the implied
15 # warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
16 # PURPOSE.  See the GNU General Public License for more
17 # details.
18 # 
19 # The full text for the General Public License is here:
20 # http://www.gnu.org/licenses/gpl.html
21 
22 */
23 
24 #define _GNU_SOURCE
25 #ifdef LIBCONFIG
26 #include <libconfig.h>
27 #endif
28 #ifdef ENABLE_REGEX
29 #ifdef LIBPCRE
30 #include <pcreposix.h>
31 #else
32 #include <regex.h>
33 #endif
34 #endif
35 
36 #include "common.h"
37 #include "probe.h"
38 
39 const char* USAGE_STRING =
40 "sslh " VERSION "\n" \
41 "usage:\n" \
42 "\tsslh  [-v] [-i] [-V] [-f] [-n] [--transparent] [-F <file>]\n"
43 "\t[-t <timeout>] [-P <pidfile>] -u <username> -p <add> [-p <addr> ...] \n" \
44 "%s\n\n" /* Dynamically built list of builtin protocols */  \
45 "\t[--on-timeout <addr>]\n" \
46 "-v: verbose\n" \
47 "-V: version\n" \
48 "-f: foreground\n" \
49 "-n: numeric output\n" \
50 "-u: specify under which user to run\n" \
51 "--transparent: behave as a transparent proxy\n" \
52 "-F: use configuration file\n" \
53 "--on-timeout: connect to specified address upon timeout (default: ssh address)\n" \
54 "-t: seconds to wait before connecting to --on-timeout address.\n" \
55 "-p: address and port to listen on.\n    Can be used several times to bind to several addresses.\n" \
56 "--[ssh,ssl,...]: where to connect connections from corresponding protocol.\n" \
57 "-P: PID file.\n" \
58 "-i: Run as a inetd service.\n" \
59 "";
60 
61 /* Constants for options that have no one-character shorthand */
62 #define OPT_ONTIMEOUT   257
63 
64 static struct option const_options[] = {
65     { "inetd",      no_argument,            &inetd,         1 },
66     { "foreground", no_argument,            &foreground,    1 },
67     { "background", no_argument,            &background,    1 },
68     { "transparent", no_argument,           &transparent,   1 },
69     { "numeric",    no_argument,            &numeric,       1 },
70     { "verbose",    no_argument,            &verbose,       1 },
71     { "user",       required_argument,      0,              'u' },
72     { "config",     optional_argument,      0,              'F' },
73     { "pidfile",    required_argument,      0,              'P' },
74     { "timeout",    required_argument,      0,              't' },
75     { "on-timeout", required_argument,      0,              OPT_ONTIMEOUT },
76     { "listen",     required_argument,      0,              'p' },
77     {}
78 };
79 static struct option* all_options;
80 static struct proto* builtins;
81 static const char *optstr = "vt:T:p:VP:F::";
82 
83 
84 
85 static void print_usage(void)
86 {
87     struct proto *p;
88     int i;
89     int res;
90     char *prots = "";
91 
92     p = get_builtins();
93     for (i = 0; i < get_num_builtins(); i++) {
94         res = asprintf(&prots, "%s\t[--%s <addr>]\n", prots, p[i].description);
95         CHECK_RES_DIE(res, "asprintf");
96     }
97 
98     fprintf(stderr, USAGE_STRING, prots);
99 }
100 
101 static void printcaps(void) {
102 #ifdef LIBCAP
103     cap_t caps;
104     char* desc;
105     ssize_t len;
106 
107     caps = cap_get_proc();
108 
109     desc = cap_to_text(caps, &len);
110 
111     fprintf(stderr, "capabilities: %s\n", desc);
112 
113     cap_free(caps);
114     cap_free(desc);
115 #endif
116 }
117 
118 static void printsettings(void)
119 {
120     char buf[NI_MAXHOST];
121     struct addrinfo *a;
122     struct proto *p;
123     
124     for (p = get_first_protocol(); p; p = p->next) {
125         fprintf(stderr,
126                 "%s addr: %s. libwrap service: %s log_level: %d family %d %d\n", 
127                 p->description, 
128                 sprintaddr(buf, sizeof(buf), p->saddr), 
129                 p->service,
130                 p->log_level,
131                 p->saddr->ai_family,
132                 p->saddr->ai_addr->sa_family);
133     }
134     fprintf(stderr, "listening on:\n");
135     for (a = addr_listen; a; a = a->ai_next) {
136         fprintf(stderr, "\t%s\n", sprintaddr(buf, sizeof(buf), a));
137     }
138     fprintf(stderr, "timeout: %d\non-timeout: %s\n", probing_timeout,
139             timeout_protocol()->description);
140 }
141 
142 
143 /* Extract configuration on addresses and ports on which to listen.
144  * out: newly allocated list of addrinfo to listen to
145  */
146 #ifdef LIBCONFIG
147 static int config_listen(config_t *config, struct addrinfo **listen) 
148 {
149     config_setting_t *setting, *addr;
150     int len, i;
151     const char *hostname, *port;
152 
153     setting = config_lookup(config, "listen");
154     if (setting) {
155         len = config_setting_length(setting);
156         for (i = 0; i < len; i++) {
157             addr = config_setting_get_elem(setting, i);
158             if (! (config_setting_lookup_string(addr, "host", &hostname) &&
159                    config_setting_lookup_string(addr, "port", &port))) {
160                 fprintf(stderr,
161                             "line %d:Incomplete specification (hostname and port required)\n",
162                             config_setting_source_line(addr));
163                 return -1;
164             }
165 
166             resolve_split_name(listen, hostname, port);
167 
168             /* getaddrinfo returned a list of addresses corresponding to the
169              * specification; move the pointer to the end of that list before
170              * processing the next specification */
171             for (; *listen; listen = &((*listen)->ai_next));
172         }
173     }
174 
175     return 0;
176 }
177 #endif
178 
179 
180 
181 #ifdef LIBCONFIG
182 static void setup_regex_probe(struct proto *p, config_setting_t* probes)
183 {
184 #ifdef ENABLE_REGEX
185     int num_probes, errsize, i, res;
186     char *err;
187     const char * expr;
188     regex_t** probe_list;
189 
190     num_probes = config_setting_length(probes);
191     if (!num_probes) {
192         fprintf(stderr, "%s: no probes specified\n", p->description);
193         exit(1);
194     }
195 
196     p->probe = get_probe("regex");
197     probe_list = calloc(num_probes + 1, sizeof(*probe_list));
198     p->data = (void*)probe_list;
199 
200     for (i = 0; i < num_probes; i++) {
201         probe_list[i] = malloc(sizeof(*(probe_list[i])));
202         expr = config_setting_get_string_elem(probes, i);
203         res = regcomp(probe_list[i], expr, 0);
204         if (res) {
205             err = malloc(errsize = regerror(res, probe_list[i], NULL, 0));
206             regerror(res, probe_list[i], err, errsize);
207             fprintf(stderr, "%s:%s\n", expr, err);
208             free(err);
209             exit(1);
210         }
211     }
212 #else
213     fprintf(stderr, "line %d: regex probe specified but not compiled in\n", config_setting_source_line(probes));
214     exit(5);
215 #endif
216 }
217 #endif
218 
219 #ifdef LIBCONFIG
220 static void setup_sni_alpn_list(struct proto *p, config_setting_t* config_items, const char* name, int alpn)
221 {
222     int num_probes, i, max_server_name_len, server_name_len;
223     const char * config_item;
224     char** sni_hostname_list;
225 
226     if(!config_items || !config_setting_is_array(config_items)) {
227         fprintf(stderr, "%s: no %s specified\n", p->description, name);
228         return;
229     }
230     num_probes = config_setting_length(config_items);
231     if (!num_probes) {
232         fprintf(stderr, "%s: no %s specified\n", p->description, name);
233         return;
234     }
235 
236     max_server_name_len = 0;
237     for (i = 0; i < num_probes; i++) {
238         server_name_len = strlen(config_setting_get_string_elem(config_items, i));
239         if(server_name_len > max_server_name_len)
240             max_server_name_len = server_name_len;
241     }
242 
243     sni_hostname_list = calloc(num_probes + 1, ++max_server_name_len);
244 
245     for (i = 0; i < num_probes; i++) {
246         config_item = config_setting_get_string_elem(config_items, i);
247         sni_hostname_list[i] = malloc(max_server_name_len);
248         strcpy (sni_hostname_list[i], config_item);
249         if(verbose) fprintf(stderr, "%s: %s[%d]: %s\n", p->description, name, i, sni_hostname_list[i]);
250     }
251 
252     p->data = (void*)tls_data_set_list(p->data, alpn, sni_hostname_list);
253 }
254 
255 static void setup_sni_alpn(struct proto *p, config_setting_t* sni_hostnames, config_setting_t* alpn_protocols)
256 {
257     p->data = (void*)new_tls_data();
258     p->probe = get_probe("sni_alpn");
259     setup_sni_alpn_list(p, sni_hostnames, "sni_hostnames", 0);
260     setup_sni_alpn_list(p, alpn_protocols, "alpn_protocols", 1);
261 }
262 #endif
263 
264 /* Extract configuration for protocols to connect to.
265  * out: newly-allocated list of protocols
266  */
267 #ifdef LIBCONFIG
268 static int config_protocols(config_t *config, struct proto **prots)
269 {
270     config_setting_t *setting, *prot, *patterns, *sni_hostnames, *alpn_protocols;
271     const char *hostname, *port, *name;
272     int i, num_prots;
273     struct proto *p, *prev = NULL;
274 
275     setting = config_lookup(config, "protocols");
276     if (setting) {
277         num_prots = config_setting_length(setting);
278         for (i = 0; i < num_prots; i++) {
279             p = calloc(1, sizeof(*p));
280             if (i == 0) *prots = p;
281             if (prev) prev->next = p;
282             prev = p;
283 
284             prot = config_setting_get_elem(setting, i);
285             if ((config_setting_lookup_string(prot, "name", &name) &&
286                  config_setting_lookup_string(prot, "host", &hostname) &&
287                  config_setting_lookup_string(prot, "port", &port)
288                 )) {
289                 p->description = name;
290                 config_setting_lookup_string(prot, "service", &(p->service));
291 
292                 if (config_setting_lookup_int(prot, "log_level", &p->log_level) == CONFIG_FALSE) {
293                     p->log_level = 1;
294                 }
295 
296                 resolve_split_name(&(p->saddr), hostname, port);
297 
298                 p->probe = get_probe(name);
299                 if (!p->probe || !strcmp(name, "sni_alpn")) {
300                     fprintf(stderr, "line %d: %s: probe unknown\n", config_setting_source_line(prot), name);
301                     exit(1);
302                 }
303 
304                 /* Probe-specific options: regex patterns */
305                 if (!strcmp(name, "regex")) {
306                     patterns = config_setting_get_member(prot, "regex_patterns");
307                     if (patterns && config_setting_is_array(patterns)) {
308                         setup_regex_probe(p, patterns);
309                     }
310                 }
311 
312                 /* Probe-specific options: SNI/ALPN */
313                 if (!strcmp(name, "tls")) {
314                     sni_hostnames = config_setting_get_member(prot, "sni_hostnames");
315                     alpn_protocols = config_setting_get_member(prot, "alpn_protocols");
316 
317                     if((sni_hostnames && config_setting_is_array(sni_hostnames)) || (alpn_protocols && config_setting_is_array(alpn_protocols))) {
318                         setup_sni_alpn(p, sni_hostnames, alpn_protocols);
319                     }
320                 }
321 
322             }
323         }
324     }
325 
326     return 0;
327 }
328 #endif
329 
330 /* Parses a config file
331  * in: *filename
332  * out: *listen, a newly-allocated linked list of listen addrinfo
333  *      *prots, a newly-allocated linked list of protocols
334  *      1 on error, 0 on success
335  */
336 #ifdef LIBCONFIG
337 static int config_parse(char *filename, struct addrinfo **listen, struct proto **prots)
338 {
339     config_t config;
340     int timeout;
341     const char* str;
342 
343     config_init(&config);
344     if (config_read_file(&config, filename) == CONFIG_FALSE) {
345         /* If it's a parse error then there will be a line number for the failure
346          * an I/O error (such as non-existent file) will have the error line as 0
347          */
348         if (config_error_line(&config) != 0) {
349             fprintf(stderr, "%s:%d:%s\n", 
350                     filename,
351                     config_error_line(&config),
352                     config_error_text(&config));
353             exit(1);
354         }
355         fprintf(stderr, "%s:%s\n", 
356                 filename,
357                 config_error_text(&config));
358         return 1;
359     }
360 
361     config_lookup_bool(&config, "verbose", &verbose);
362     config_lookup_bool(&config, "inetd", &inetd);
363     config_lookup_bool(&config, "foreground", &foreground);
364     config_lookup_bool(&config, "numeric", &numeric);
365     config_lookup_bool(&config, "transparent", &transparent);
366 
367     if (config_lookup_int(&config, "timeout", (int *)&timeout) == CONFIG_TRUE) {
368         probing_timeout = timeout;
369     }
370 
371     if (config_lookup_string(&config, "on-timeout", &str)) {
372         set_ontimeout(str);
373     }
374 
375     config_lookup_string(&config, "user", &user_name);
376     config_lookup_string(&config, "pidfile", &pid_file);
377 
378     config_listen(&config, listen);
379     config_protocols(&config, prots);
380 
381     return 0;
382 }
383 #endif
384 
385 /* Adds protocols to the list of options, so command-line parsing uses the
386  * protocol definition array 
387  * options: array of options to add to; must be big enough
388  * n_opts: number of options in *options before calling (i.e. where to append)
389  * prot: array of protocols
390  * n_prots: number of protocols in *prot
391  * */
392 static void append_protocols(struct option *options, int n_opts, struct proto *prot , int n_prots)
393 {
394     int o, p;
395 
396     for (o = n_opts, p = 0; p < n_prots; o++, p++) {
397         options[o].name = prot[p].description;
398         options[o].has_arg = required_argument;
399         options[o].flag = 0;
400         options[o].val = p + PROT_SHIFT;
401     }
402 }
403 
404 static void make_alloptions(void)
405 {
406     builtins = get_builtins();
407 
408     /* Create all_options, composed of const_options followed by one option per
409      * known protocol */
410     all_options = calloc(ARRAY_SIZE(const_options) + get_num_builtins(), sizeof(struct option));
411     memcpy(all_options, const_options, sizeof(const_options));
412     append_protocols(all_options, ARRAY_SIZE(const_options) - 1, builtins, get_num_builtins());
413 }
414 
415 /* Performs a first scan of command line options to see if a configuration file
416  * is specified. If there is one, parse it now before all other options (so
417  * configuration file settings can be overridden from the command line).
418  *
419  * prots: newly-allocated list of configured protocols, if any.
420  */
421 static void cmdline_config(int argc, char* argv[], struct proto** prots)
422 {
423 #ifdef LIBCONFIG
424     int c, res;
425     char *config_filename;
426 #endif
427 
428     make_alloptions();
429 
430 #ifdef LIBCONFIG
431     optind = 1;
432     opterr = 0; /* we're missing protocol options at this stage so don't output errors */
433     while ((c = getopt_long_only(argc, argv, optstr, all_options, NULL)) != -1) {
434         if (c == 'v') {
435             verbose++;
436         }
437         if (c == 'F') {
438             config_filename = optarg;
439             if (config_filename) {
440                 res = config_parse(config_filename, &addr_listen, prots);
441             } else {
442                 /* No configuration file specified -- try default file locations */
443                 res = config_parse("/etc/sslh/sslh.cfg", &addr_listen, prots);
444                 if (!res && verbose) fprintf(stderr, "Using /etc/sslh/sslh.cfg\n");
445                 if (res) {
446                     res = config_parse("/etc/sslh.cfg", &addr_listen, prots);
447                     if (!res && verbose) fprintf(stderr, "Using /etc/sslh.cfg\n");
448                 }
449             }
450             if (res)
451                 exit(4);
452             break;
453         }
454     }
455 #endif
456 }
457 
458 
459 /* Parse command-line options. prots points to a list of configured protocols,
460  * potentially non-allocated */
461 static void parse_cmdline(int argc, char* argv[], struct proto* prots)
462 {
463     int c;
464     struct addrinfo **a;
465     struct proto *p;
466 
467     optind = 1;
468     opterr = 1;
469 next_arg:
470     while ((c = getopt_long_only(argc, argv, optstr, all_options, NULL)) != -1) {
471         if (c == 0) continue;
472 
473         if (c >= PROT_SHIFT) {
474             if (prots)
475                 for (p = prots; p && p->next; p = p->next) {
476                     /* override if protocol was already defined by config file 
477                      * (note it only overrides address and use builtin probe) */
478                     if (!strcmp(p->description, builtins[c-PROT_SHIFT].description)) {
479                         resolve_name(&(p->saddr), optarg);
480                         p->probe = builtins[c-PROT_SHIFT].probe;
481                         goto next_arg;
482                     }
483                 }
484             /* At this stage, it's a new protocol: add it to the end of the
485              * list */
486             if (!prots) {
487                 /* No protocols yet -- create the list */
488                 p = prots = calloc(1, sizeof(*p));
489             } else {
490                 p->next = calloc(1, sizeof(*p));
491                 p = p->next;
492             }
493             memcpy(p, &builtins[c-PROT_SHIFT], sizeof(*p));
494             resolve_name(&(p->saddr), optarg);
495             continue;
496         }
497 
498         switch (c) {
499 
500         case 'F':
501             /* Legal option, but do nothing, it was already processed in
502              * cmdline_config() */
503 #ifndef LIBCONFIG
504             fprintf(stderr, "Built without libconfig support: configuration file not available.\n");
505             exit(1);
506 #endif
507             break;
508 
509         case 't':
510              probing_timeout = atoi(optarg);
511             break;
512 
513         case OPT_ONTIMEOUT:
514             set_ontimeout(optarg);
515             break;
516 
517         case 'p':
518             /* find the end of the listen list */
519             for (a = &addr_listen; *a; a = &((*a)->ai_next));
520             /* append the specified addresses */
521             resolve_name(a, optarg);
522             
523             break;
524 
525         case 'V':
526             printf("%s %s\n", server_type, VERSION);
527             exit(0);
528 
529         case 'u':
530             user_name = optarg;
531             break;
532 
533         case 'P':
534             pid_file = optarg;
535             break;
536 
537         case 'v':
538             verbose++;
539             break;
540 
541         default:
542             print_usage();
543             exit(2);
544         }
545     }
546 
547     if (!prots) {
548         fprintf(stderr, "At least one target protocol must be specified.\n");
549         exit(2);
550     }
551 
552     set_protocol_list(prots);
553 
554     if (!addr_listen && !inetd) {
555         fprintf(stderr, "No listening address specified; use at least one -p option\n");
556         exit(1);
557     }
558 
559     /* Did command-line override foreground setting? */
560     if (background)
561         foreground = 0;
562 
563 }
564 
565 int main(int argc, char *argv[])
566 {
567 
568    extern char *optarg;
569    extern int optind;
570    int res, num_addr_listen;
571    struct proto* protocols = NULL;
572 
573    int *listen_sockets;
574 
575    /* Init defaults */
576    pid_file = NULL;
577    user_name = NULL;
578 
579    cmdline_config(argc, argv, &protocols);
580    parse_cmdline(argc, argv, protocols);
581 
582    if (inetd)
583    {
584        verbose = 0;
585        start_shoveler(0);
586        exit(0);
587    }
588 
589    if (verbose)
590        printsettings();
591 
592    num_addr_listen = start_listen_sockets(&listen_sockets, addr_listen);
593 
594    if (!foreground) {
595        if (fork() > 0) exit(0); /* Detach */
596 
597        /* New session -- become group leader */
598        if (getuid() == 0) {
599            res = setsid();
600            CHECK_RES_DIE(res, "setsid: already process leader");
601        }
602    }
603 
604    setup_signals();
605 
606    if (pid_file)
607        write_pid_file(pid_file);
608 
609    if (user_name)
610        drop_privileges(user_name);
611 
612 
613    /* Open syslog connection */
614    setup_syslog(argv[0]);
615 
616    if (verbose)
617        printcaps();
618 
619    main_loop(listen_sockets, num_addr_listen);
620 
621    return 0;
622 }
623

Built with git-ssb-web

cel / sslh

Tree: e5cb33fcb7d6781e4017c3aecaee52e2aa8c2916

Files: e5cb33fcb7d6781e4017c3aecaee52e2aa8c2916 / sslh-main.c

1	/*
2	# main: processing of config file, command line options and start the main
3	# loop.
4	#
5	# Copyright (C) 2007-2014 Yves Rutschle
6	#
7	# This program is free software; you can redistribute it
8	# and/or modify it under the terms of the GNU General Public
9	# License as published by the Free Software Foundation; either
10	# version 2 of the License, or (at your option) any later
11	# version.
12	#
13	# This program is distributed in the hope that it will be
14	# useful, but WITHOUT ANY WARRANTY; without even the implied
15	# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
16	# PURPOSE. See the GNU General Public License for more
17	# details.
18	#
19	# The full text for the General Public License is here:
20	# http://www.gnu.org/licenses/gpl.html
21
22	*/
23
24	#define _GNU_SOURCE
25	#ifdef LIBCONFIG
26	#include <libconfig.h>
27	#endif
28	#ifdef ENABLE_REGEX
29	#ifdef LIBPCRE
30	#include <pcreposix.h>
31	#else
32	#include <regex.h>
33	#endif
34	#endif
35
36	#include "common.h"
37	#include "probe.h"
38
39	const char* USAGE_STRING =
40	"sslh " VERSION "\n" \
41	"usage:\n" \
42	"\tsslh [-v] [-i] [-V] [-f] [-n] [--transparent] [-F <file>]\n"
43	"\t[-t <timeout>] [-P <pidfile>] -u <username> -p <add> [-p <addr> ...] \n" \
44	"%s\n\n" /* Dynamically built list of builtin protocols */ \
45	"\t[--on-timeout <addr>]\n" \
46	"-v: verbose\n" \
47	"-V: version\n" \
48	"-f: foreground\n" \
49	"-n: numeric output\n" \
50	"-u: specify under which user to run\n" \
51	"--transparent: behave as a transparent proxy\n" \
52	"-F: use configuration file\n" \
53	"--on-timeout: connect to specified address upon timeout (default: ssh address)\n" \
54	"-t: seconds to wait before connecting to --on-timeout address.\n" \
55	"-p: address and port to listen on.\n Can be used several times to bind to several addresses.\n" \
56	"--[ssh,ssl,...]: where to connect connections from corresponding protocol.\n" \
57	"-P: PID file.\n" \
58	"-i: Run as a inetd service.\n" \
59	"";
60
61	/* Constants for options that have no one-character shorthand */
62	#define OPT_ONTIMEOUT 257
63
64	static struct option const_options[] = {
65	{ "inetd", no_argument, &inetd, 1 },
66	{ "foreground", no_argument, &foreground, 1 },
67	{ "background", no_argument, &background, 1 },
68	{ "transparent", no_argument, &transparent, 1 },
69	{ "numeric", no_argument, &numeric, 1 },
70	{ "verbose", no_argument, &verbose, 1 },
71	{ "user", required_argument, 0, 'u' },
72	{ "config", optional_argument, 0, 'F' },
73	{ "pidfile", required_argument, 0, 'P' },
74	{ "timeout", required_argument, 0, 't' },
75	{ "on-timeout", required_argument, 0, OPT_ONTIMEOUT },
76	{ "listen", required_argument, 0, 'p' },
77	{}
78	};
79	static struct option* all_options;
80	static struct proto* builtins;
81	static const char *optstr = "vt:T:p:VP:F::";
82
83
84
85	static void print_usage(void)
86	{
87	struct proto *p;
88	int i;
89	int res;
90	char *prots = "";
91
92	p = get_builtins();
93	for (i = 0; i < get_num_builtins(); i++) {
94	res = asprintf(&prots, "%s\t[--%s <addr>]\n", prots, p[i].description);
95	CHECK_RES_DIE(res, "asprintf");
96	}
97
98	fprintf(stderr, USAGE_STRING, prots);
99	}
100
101	static void printcaps(void) {
102	#ifdef LIBCAP
103	cap_t caps;
104	char* desc;
105	ssize_t len;
106
107	caps = cap_get_proc();
108
109	desc = cap_to_text(caps, &len);
110
111	fprintf(stderr, "capabilities: %s\n", desc);
112
113	cap_free(caps);
114	cap_free(desc);
115	#endif
116	}
117
118	static void printsettings(void)
119	{
120	char buf[NI_MAXHOST];
121	struct addrinfo *a;
122	struct proto *p;
123
124	for (p = get_first_protocol(); p; p = p->next) {
125	fprintf(stderr,
126	"%s addr: %s. libwrap service: %s log_level: %d family %d %d\n",
127	p->description,
128	sprintaddr(buf, sizeof(buf), p->saddr),
129	p->service,
130	p->log_level,
131	p->saddr->ai_family,
132	p->saddr->ai_addr->sa_family);
133	}
134	fprintf(stderr, "listening on:\n");
135	for (a = addr_listen; a; a = a->ai_next) {
136	fprintf(stderr, "\t%s\n", sprintaddr(buf, sizeof(buf), a));
137	}
138	fprintf(stderr, "timeout: %d\non-timeout: %s\n", probing_timeout,
139	timeout_protocol()->description);
140	}
141
142
143	/* Extract configuration on addresses and ports on which to listen.
144	* out: newly allocated list of addrinfo to listen to
145	*/
146	#ifdef LIBCONFIG
147	static int config_listen(config_t config, struct addrinfo *listen)
148	{
149	config_setting_t setting, addr;
150	int len, i;
151	const char hostname, port;
152
153	setting = config_lookup(config, "listen");
154	if (setting) {
155	len = config_setting_length(setting);
156	for (i = 0; i < len; i++) {
157	addr = config_setting_get_elem(setting, i);
158	if (! (config_setting_lookup_string(addr, "host", &hostname) &&
159	config_setting_lookup_string(addr, "port", &port))) {
160	fprintf(stderr,
161	"line %d:Incomplete specification (hostname and port required)\n",
162	config_setting_source_line(addr));
163	return -1;
164	}
165
166	resolve_split_name(listen, hostname, port);
167
168	/* getaddrinfo returned a list of addresses corresponding to the
169	* specification; move the pointer to the end of that list before
170	* processing the next specification */
171	for (; listen; listen = &((listen)->ai_next));
172	}
173	}
174
175	return 0;
176	}
177	#endif
178
179
180
181	#ifdef LIBCONFIG
182	static void setup_regex_probe(struct proto p, config_setting_t probes)
183	{
184	#ifdef ENABLE_REGEX
185	int num_probes, errsize, i, res;
186	char *err;
187	const char * expr;
188	regex_t** probe_list;
189
190	num_probes = config_setting_length(probes);
191	if (!num_probes) {
192	fprintf(stderr, "%s: no probes specified\n", p->description);
193	exit(1);
194	}
195
196	p->probe = get_probe("regex");
197	probe_list = calloc(num_probes + 1, sizeof(*probe_list));
198	p->data = (void*)probe_list;
199
200	for (i = 0; i < num_probes; i++) {
201	probe_list[i] = malloc(sizeof(*(probe_list[i])));
202	expr = config_setting_get_string_elem(probes, i);
203	res = regcomp(probe_list[i], expr, 0);
204	if (res) {
205	err = malloc(errsize = regerror(res, probe_list[i], NULL, 0));
206	regerror(res, probe_list[i], err, errsize);
207	fprintf(stderr, "%s:%s\n", expr, err);
208	free(err);
209	exit(1);
210	}
211	}
212	#else
213	fprintf(stderr, "line %d: regex probe specified but not compiled in\n", config_setting_source_line(probes));
214	exit(5);
215	#endif
216	}
217	#endif
218
219	#ifdef LIBCONFIG
220	static void setup_sni_alpn_list(struct proto p, config_setting_t config_items, const char* name, int alpn)
221	{
222	int num_probes, i, max_server_name_len, server_name_len;
223	const char * config_item;
224	char** sni_hostname_list;
225
226	if(!config_items \|\| !config_setting_is_array(config_items)) {
227	fprintf(stderr, "%s: no %s specified\n", p->description, name);
228	return;
229	}
230	num_probes = config_setting_length(config_items);
231	if (!num_probes) {
232	fprintf(stderr, "%s: no %s specified\n", p->description, name);
233	return;
234	}
235
236	max_server_name_len = 0;
237	for (i = 0; i < num_probes; i++) {
238	server_name_len = strlen(config_setting_get_string_elem(config_items, i));
239	if(server_name_len > max_server_name_len)
240	max_server_name_len = server_name_len;
241	}
242
243	sni_hostname_list = calloc(num_probes + 1, ++max_server_name_len);
244
245	for (i = 0; i < num_probes; i++) {
246	config_item = config_setting_get_string_elem(config_items, i);
247	sni_hostname_list[i] = malloc(max_server_name_len);
248	strcpy (sni_hostname_list[i], config_item);
249	if(verbose) fprintf(stderr, "%s: %s[%d]: %s\n", p->description, name, i, sni_hostname_list[i]);
250	}
251
252	p->data = (void*)tls_data_set_list(p->data, alpn, sni_hostname_list);
253	}
254
255	static void setup_sni_alpn(struct proto p, config_setting_t sni_hostnames, config_setting_t* alpn_protocols)
256	{
257	p->data = (void*)new_tls_data();
258	p->probe = get_probe("sni_alpn");
259	setup_sni_alpn_list(p, sni_hostnames, "sni_hostnames", 0);
260	setup_sni_alpn_list(p, alpn_protocols, "alpn_protocols", 1);
261	}
262	#endif
263
264	/* Extract configuration for protocols to connect to.
265	* out: newly-allocated list of protocols
266	*/
267	#ifdef LIBCONFIG
268	static int config_protocols(config_t config, struct proto *prots)
269	{
270	config_setting_t setting, prot, patterns, sni_hostnames, *alpn_protocols;
271	const char hostname, port, *name;
272	int i, num_prots;
273	struct proto p, prev = NULL;
274
275	setting = config_lookup(config, "protocols");
276	if (setting) {
277	num_prots = config_setting_length(setting);
278	for (i = 0; i < num_prots; i++) {
279	p = calloc(1, sizeof(*p));
280	if (i == 0) *prots = p;
281	if (prev) prev->next = p;
282	prev = p;
283
284	prot = config_setting_get_elem(setting, i);
285	if ((config_setting_lookup_string(prot, "name", &name) &&
286	config_setting_lookup_string(prot, "host", &hostname) &&
287	config_setting_lookup_string(prot, "port", &port)
288	)) {
289	p->description = name;
290	config_setting_lookup_string(prot, "service", &(p->service));
291
292	if (config_setting_lookup_int(prot, "log_level", &p->log_level) == CONFIG_FALSE) {
293	p->log_level = 1;
294	}
295
296	resolve_split_name(&(p->saddr), hostname, port);
297
298	p->probe = get_probe(name);
299	if (!p->probe \|\| !strcmp(name, "sni_alpn")) {
300	fprintf(stderr, "line %d: %s: probe unknown\n", config_setting_source_line(prot), name);
301	exit(1);
302	}
303
304	/* Probe-specific options: regex patterns */
305	if (!strcmp(name, "regex")) {
306	patterns = config_setting_get_member(prot, "regex_patterns");
307	if (patterns && config_setting_is_array(patterns)) {
308	setup_regex_probe(p, patterns);
309	}
310	}
311
312	/* Probe-specific options: SNI/ALPN */
313	if (!strcmp(name, "tls")) {
314	sni_hostnames = config_setting_get_member(prot, "sni_hostnames");
315	alpn_protocols = config_setting_get_member(prot, "alpn_protocols");
316
317	if((sni_hostnames && config_setting_is_array(sni_hostnames)) \|\| (alpn_protocols && config_setting_is_array(alpn_protocols))) {
318	setup_sni_alpn(p, sni_hostnames, alpn_protocols);
319	}
320	}
321
322	}
323	}
324	}
325
326	return 0;
327	}
328	#endif
329
330	/* Parses a config file
331	* in: *filename
332	* out: *listen, a newly-allocated linked list of listen addrinfo
333	* *prots, a newly-allocated linked list of protocols
334	* 1 on error, 0 on success
335	*/
336	#ifdef LIBCONFIG
337	static int config_parse(char filename, struct addrinfo listen, struct proto *prots)
338	{
339	config_t config;
340	int timeout;
341	const char* str;
342
343	config_init(&config);
344	if (config_read_file(&config, filename) == CONFIG_FALSE) {
345	/* If it's a parse error then there will be a line number for the failure
346	* an I/O error (such as non-existent file) will have the error line as 0
347	*/
348	if (config_error_line(&config) != 0) {
349	fprintf(stderr, "%s:%d:%s\n",
350	filename,
351	config_error_line(&config),
352	config_error_text(&config));
353	exit(1);
354	}
355	fprintf(stderr, "%s:%s\n",
356	filename,
357	config_error_text(&config));
358	return 1;
359	}
360
361	config_lookup_bool(&config, "verbose", &verbose);
362	config_lookup_bool(&config, "inetd", &inetd);
363	config_lookup_bool(&config, "foreground", &foreground);
364	config_lookup_bool(&config, "numeric", &numeric);
365	config_lookup_bool(&config, "transparent", &transparent);
366
367	if (config_lookup_int(&config, "timeout", (int *)&timeout) == CONFIG_TRUE) {
368	probing_timeout = timeout;
369	}
370
371	if (config_lookup_string(&config, "on-timeout", &str)) {
372	set_ontimeout(str);
373	}
374
375	config_lookup_string(&config, "user", &user_name);
376	config_lookup_string(&config, "pidfile", &pid_file);
377
378	config_listen(&config, listen);
379	config_protocols(&config, prots);
380
381	return 0;
382	}
383	#endif
384
385	/* Adds protocols to the list of options, so command-line parsing uses the
386	* protocol definition array
387	* options: array of options to add to; must be big enough
388	* n_opts: number of options in *options before calling (i.e. where to append)
389	* prot: array of protocols
390	* n_prots: number of protocols in *prot
391	* */
392	static void append_protocols(struct option options, int n_opts, struct proto prot , int n_prots)
393	{
394	int o, p;
395
396	for (o = n_opts, p = 0; p < n_prots; o++, p++) {
397	options[o].name = prot[p].description;
398	options[o].has_arg = required_argument;
399	options[o].flag = 0;
400	options[o].val = p + PROT_SHIFT;
401	}
402	}
403
404	static void make_alloptions(void)
405	{
406	builtins = get_builtins();
407
408	/* Create all_options, composed of const_options followed by one option per
409	* known protocol */
410	all_options = calloc(ARRAY_SIZE(const_options) + get_num_builtins(), sizeof(struct option));
411	memcpy(all_options, const_options, sizeof(const_options));
412	append_protocols(all_options, ARRAY_SIZE(const_options) - 1, builtins, get_num_builtins());
413	}
414
415	/* Performs a first scan of command line options to see if a configuration file
416	* is specified. If there is one, parse it now before all other options (so
417	* configuration file settings can be overridden from the command line).
418	*
419	* prots: newly-allocated list of configured protocols, if any.
420	*/
421	static void cmdline_config(int argc, char* argv[], struct proto** prots)
422	{
423	#ifdef LIBCONFIG
424	int c, res;
425	char *config_filename;
426	#endif
427
428	make_alloptions();
429
430	#ifdef LIBCONFIG
431	optind = 1;
432	opterr = 0; /* we're missing protocol options at this stage so don't output errors */
433	while ((c = getopt_long_only(argc, argv, optstr, all_options, NULL)) != -1) {
434	if (c == 'v') {
435	verbose++;
436	}
437	if (c == 'F') {
438	config_filename = optarg;
439	if (config_filename) {
440	res = config_parse(config_filename, &addr_listen, prots);
441	} else {
442	/* No configuration file specified -- try default file locations */
443	res = config_parse("/etc/sslh/sslh.cfg", &addr_listen, prots);
444	if (!res && verbose) fprintf(stderr, "Using /etc/sslh/sslh.cfg\n");
445	if (res) {
446	res = config_parse("/etc/sslh.cfg", &addr_listen, prots);
447	if (!res && verbose) fprintf(stderr, "Using /etc/sslh.cfg\n");
448	}
449	}
450	if (res)
451	exit(4);
452	break;
453	}
454	}
455	#endif
456	}
457
458
459	/* Parse command-line options. prots points to a list of configured protocols,
460	* potentially non-allocated */
461	static void parse_cmdline(int argc, char* argv[], struct proto* prots)
462	{
463	int c;
464	struct addrinfo **a;
465	struct proto *p;
466
467	optind = 1;
468	opterr = 1;
469	next_arg:
470	while ((c = getopt_long_only(argc, argv, optstr, all_options, NULL)) != -1) {
471	if (c == 0) continue;
472
473	if (c >= PROT_SHIFT) {
474	if (prots)
475	for (p = prots; p && p->next; p = p->next) {
476	/* override if protocol was already defined by config file
477	* (note it only overrides address and use builtin probe) */
478	if (!strcmp(p->description, builtins[c-PROT_SHIFT].description)) {
479	resolve_name(&(p->saddr), optarg);
480	p->probe = builtins[c-PROT_SHIFT].probe;
481	goto next_arg;
482	}
483	}
484	/* At this stage, it's a new protocol: add it to the end of the
485	* list */
486	if (!prots) {
487	/* No protocols yet -- create the list */
488	p = prots = calloc(1, sizeof(*p));
489	} else {
490	p->next = calloc(1, sizeof(*p));
491	p = p->next;
492	}
493	memcpy(p, &builtins[c-PROT_SHIFT], sizeof(*p));
494	resolve_name(&(p->saddr), optarg);
495	continue;
496	}
497
498	switch (c) {
499
500	case 'F':
501	/* Legal option, but do nothing, it was already processed in
502	* cmdline_config() */
503	#ifndef LIBCONFIG
504	fprintf(stderr, "Built without libconfig support: configuration file not available.\n");
505	exit(1);
506	#endif
507	break;
508
509	case 't':
510	probing_timeout = atoi(optarg);
511	break;
512
513	case OPT_ONTIMEOUT:
514	set_ontimeout(optarg);
515	break;
516
517	case 'p':
518	/* find the end of the listen list */
519	for (a = &addr_listen; a; a = &((a)->ai_next));
520	/* append the specified addresses */
521	resolve_name(a, optarg);
522
523	break;
524
525	case 'V':
526	printf("%s %s\n", server_type, VERSION);
527	exit(0);
528
529	case 'u':
530	user_name = optarg;
531	break;
532
533	case 'P':
534	pid_file = optarg;
535	break;
536
537	case 'v':
538	verbose++;
539	break;
540
541	default:
542	print_usage();
543	exit(2);
544	}
545	}
546
547	if (!prots) {
548	fprintf(stderr, "At least one target protocol must be specified.\n");
549	exit(2);
550	}
551
552	set_protocol_list(prots);
553
554	if (!addr_listen && !inetd) {
555	fprintf(stderr, "No listening address specified; use at least one -p option\n");
556	exit(1);
557	}
558
559	/* Did command-line override foreground setting? */
560	if (background)
561	foreground = 0;
562
563	}
564
565	int main(int argc, char *argv[])
566	{
567
568	extern char *optarg;
569	extern int optind;
570	int res, num_addr_listen;
571	struct proto* protocols = NULL;
572
573	int *listen_sockets;
574
575	/* Init defaults */
576	pid_file = NULL;
577	user_name = NULL;
578
579	cmdline_config(argc, argv, &protocols);
580	parse_cmdline(argc, argv, protocols);
581
582	if (inetd)
583	{
584	verbose = 0;
585	start_shoveler(0);
586	exit(0);
587	}
588
589	if (verbose)
590	printsettings();
591
592	num_addr_listen = start_listen_sockets(&listen_sockets, addr_listen);
593
594	if (!foreground) {
595	if (fork() > 0) exit(0); /* Detach */
596
597	/* New session -- become group leader */
598	if (getuid() == 0) {
599	res = setsid();
600	CHECK_RES_DIE(res, "setsid: already process leader");
601	}
602	}
603
604	setup_signals();
605
606	if (pid_file)
607	write_pid_file(pid_file);
608
609	if (user_name)
610	drop_privileges(user_name);
611
612
613	/* Open syslog connection */
614	setup_syslog(argv[0]);
615
616	if (verbose)
617	printcaps();
618
619	main_loop(listen_sockets, num_addr_listen);
620
621	return 0;
622	}
623

cel / sslh

Tree: e5cb33fcb7d6781e4017c3aecaee52e2aa8c2916 shsmasterv1.9v1.8v1.7v1.6v1.5v1.3v1.2v1.18v1.17v1.16v1.15v1.14v1.13v1.12v1.11v1.10v1.1v1.0 <input type="submit" value="Go"/>

Files: e5cb33fcb7d6781e4017c3aecaee52e2aa8c2916 / sslh-main.c

Tree: e5cb33fcb7d6781e4017c3aecaee52e2aa8c2916