Files: e6cb3596d1648f39df425c24d44f211017c90203 / sslh-main.c
20047 bytesRaw
1 | /* |
2 | # main: processing of config file, command line options and start the main |
3 | # loop. |
4 | # |
5 | # Copyright (C) 2007-2016 Yves Rutschle |
6 | # |
7 | # This program is free software; you can redistribute it |
8 | # and/or modify it under the terms of the GNU General Public |
9 | # License as published by the Free Software Foundation; either |
10 | # version 2 of the License, or (at your option) any later |
11 | # version. |
12 | # |
13 | # This program is distributed in the hope that it will be |
14 | # useful, but WITHOUT ANY WARRANTY; without even the implied |
15 | # warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR |
16 | # PURPOSE. See the GNU General Public License for more |
17 | # details. |
18 | # |
19 | # The full text for the General Public License is here: |
20 | # http://www.gnu.org/licenses/gpl.html |
21 | |
22 | */ |
23 | |
24 | |
25 | |
26 | |
27 | |
28 | |
29 | |
30 | |
31 | |
32 | |
33 | |
34 | |
35 | |
36 | |
37 | |
38 | |
39 | const char* USAGE_STRING = |
40 | "sslh " VERSION "\n" \ |
41 | "usage:\n" \ |
42 | "\tsslh [-v] [-i] [-V] [-f] [-n] [--transparent] [-F <file>]\n" |
43 | "\t[-t <timeout>] [-P <pidfile>] -u <username> -p <add> [-p <addr> ...] \n" \ |
44 | "%s\n\n" /* Dynamically built list of builtin protocols */ \ |
45 | "\t[--on-timeout <addr>]\n" \ |
46 | "-v: verbose\n" \ |
47 | "-V: version\n" \ |
48 | "-f: foreground\n" \ |
49 | "-n: numeric output\n" \ |
50 | "-u: specify under which user to run\n" \ |
51 | "--transparent: behave as a transparent proxy\n" \ |
52 | "-F: use configuration file\n" \ |
53 | "--on-timeout: connect to specified address upon timeout (default: ssh address)\n" \ |
54 | "-t: seconds to wait before connecting to --on-timeout address.\n" \ |
55 | "-p: address and port to listen on.\n Can be used several times to bind to several addresses.\n" \ |
56 | "--[ssh,ssl,...]: where to connect connections from corresponding protocol.\n" \ |
57 | "-P: PID file.\n" \ |
58 | "-i: Run as a inetd service.\n" \ |
59 | ""; |
60 | |
61 | /* Constants for options that have no one-character shorthand */ |
62 | |
63 | |
64 | static struct option const_options[] = { |
65 | { "inetd", no_argument, &inetd, 1 }, |
66 | { "foreground", no_argument, &foreground, 1 }, |
67 | { "background", no_argument, &background, 1 }, |
68 | { "transparent", no_argument, &transparent, 1 }, |
69 | { "numeric", no_argument, &numeric, 1 }, |
70 | { "verbose", no_argument, &verbose, 1 }, |
71 | { "user", required_argument, 0, 'u' }, |
72 | { "config", optional_argument, 0, 'F' }, |
73 | { "pidfile", required_argument, 0, 'P' }, |
74 | { "timeout", required_argument, 0, 't' }, |
75 | { "on-timeout", required_argument, 0, OPT_ONTIMEOUT }, |
76 | { "listen", required_argument, 0, 'p' }, |
77 | {} |
78 | }; |
79 | static struct option* all_options; |
80 | static struct proto* builtins; |
81 | static const char *optstr = "vt:T:p:VP:F::"; |
82 | |
83 | |
84 | |
85 | static void print_usage(void) |
86 | { |
87 | struct proto *p; |
88 | int i; |
89 | int res; |
90 | char *prots = ""; |
91 | |
92 | p = get_builtins(); |
93 | for (i = 0; i < get_num_builtins(); i++) { |
94 | res = asprintf(&prots, "%s\t[--%s <addr>]\n", prots, p[i].description); |
95 | CHECK_RES_DIE(res, "asprintf"); |
96 | } |
97 | |
98 | fprintf(stderr, USAGE_STRING, prots); |
99 | } |
100 | |
101 | static void printcaps(void) { |
102 | |
103 | cap_t caps; |
104 | char* desc; |
105 | ssize_t len; |
106 | |
107 | caps = cap_get_proc(); |
108 | |
109 | desc = cap_to_text(caps, &len); |
110 | |
111 | fprintf(stderr, "capabilities: %s\n", desc); |
112 | |
113 | cap_free(caps); |
114 | cap_free(desc); |
115 | |
116 | } |
117 | |
118 | static void printsettings(void) |
119 | { |
120 | char buf[NI_MAXHOST]; |
121 | struct addrinfo *a; |
122 | struct proto *p; |
123 | |
124 | for (p = get_first_protocol(); p; p = p->next) { |
125 | fprintf(stderr, |
126 | "%s addr: %s. libwrap service: %s log_level: %d family %d %d [%s]\n", |
127 | p->description, |
128 | sprintaddr(buf, sizeof(buf), p->saddr), |
129 | p->service, |
130 | p->log_level, |
131 | p->saddr->ai_family, |
132 | p->saddr->ai_addr->sa_family, |
133 | p->keepalive ? "keepalive" : ""); |
134 | } |
135 | fprintf(stderr, "listening on:\n"); |
136 | for (a = addr_listen; a; a = a->ai_next) { |
137 | fprintf(stderr, |
138 | "\t%s\t[%s]\n", |
139 | sprintaddr(buf, sizeof(buf), a), |
140 | a->ai_flags & SO_KEEPALIVE ? "keepalive" : ""); |
141 | } |
142 | fprintf(stderr, "timeout: %d\non-timeout: %s\n", probing_timeout, |
143 | timeout_protocol()->description); |
144 | } |
145 | |
146 | |
147 | /* Extract configuration on addresses and ports on which to listen. |
148 | * out: newly allocated list of addrinfo to listen to |
149 | */ |
150 | |
151 | static int config_listen(config_t *config, struct addrinfo **listen) |
152 | { |
153 | config_setting_t *setting, *addr; |
154 | int len, i, keepalive; |
155 | const char *hostname, *port; |
156 | |
157 | setting = config_lookup(config, "listen"); |
158 | if (setting) { |
159 | len = config_setting_length(setting); |
160 | for (i = 0; i < len; i++) { |
161 | addr = config_setting_get_elem(setting, i); |
162 | if (! (config_setting_lookup_string(addr, "host", &hostname) && |
163 | config_setting_lookup_string(addr, "port", &port))) { |
164 | fprintf(stderr, |
165 | "line %d:Incomplete specification (hostname and port required)\n", |
166 | config_setting_source_line(addr)); |
167 | return -1; |
168 | } |
169 | |
170 | keepalive = 0; |
171 | config_setting_lookup_bool(addr, "keepalive", &keepalive); |
172 | |
173 | resolve_split_name(listen, hostname, port); |
174 | |
175 | /* getaddrinfo returned a list of addresses corresponding to the |
176 | * specification; move the pointer to the end of that list before |
177 | * processing the next specification, while setting flags for |
178 | * start_listen_sockets() through ai_flags (which is not meant for |
179 | * that, but is only used as hint in getaddrinfo, so it's OK) */ |
180 | for (; *listen; listen = &((*listen)->ai_next)) { |
181 | if (keepalive) |
182 | (*listen)->ai_flags = SO_KEEPALIVE; |
183 | } |
184 | } |
185 | } |
186 | |
187 | return 0; |
188 | } |
189 | |
190 | |
191 | |
192 | |
193 | |
194 | static void setup_regex_probe(struct proto *p, config_setting_t* probes) |
195 | { |
196 | |
197 | int num_probes, errsize, i, res; |
198 | char *err; |
199 | const char * expr; |
200 | regex_t** probe_list; |
201 | |
202 | num_probes = config_setting_length(probes); |
203 | if (!num_probes) { |
204 | fprintf(stderr, "%s: no probes specified\n", p->description); |
205 | exit(1); |
206 | } |
207 | |
208 | p->probe = get_probe("regex"); |
209 | probe_list = calloc(num_probes + 1, sizeof(*probe_list)); |
210 | p->data = (void*)probe_list; |
211 | |
212 | for (i = 0; i < num_probes; i++) { |
213 | probe_list[i] = malloc(sizeof(*(probe_list[i]))); |
214 | expr = config_setting_get_string_elem(probes, i); |
215 | res = regcomp(probe_list[i], expr, 0); |
216 | if (res) { |
217 | err = malloc(errsize = regerror(res, probe_list[i], NULL, 0)); |
218 | regerror(res, probe_list[i], err, errsize); |
219 | fprintf(stderr, "%s:%s\n", expr, err); |
220 | free(err); |
221 | exit(1); |
222 | } |
223 | } |
224 | |
225 | fprintf(stderr, "line %d: regex probe specified but not compiled in\n", config_setting_source_line(probes)); |
226 | exit(5); |
227 | |
228 | } |
229 | |
230 | |
231 | |
232 | static void setup_sni_alpn_list(struct proto *p, config_setting_t* config_items, const char* name, int alpn) |
233 | { |
234 | int num_probes, i, max_server_name_len, server_name_len; |
235 | const char * config_item; |
236 | char** sni_hostname_list; |
237 | |
238 | if(!config_items || !config_setting_is_array(config_items)) { |
239 | fprintf(stderr, "%s: no %s specified\n", p->description, name); |
240 | return; |
241 | } |
242 | num_probes = config_setting_length(config_items); |
243 | if (!num_probes) { |
244 | fprintf(stderr, "%s: no %s specified\n", p->description, name); |
245 | return; |
246 | } |
247 | |
248 | max_server_name_len = 0; |
249 | for (i = 0; i < num_probes; i++) { |
250 | server_name_len = strlen(config_setting_get_string_elem(config_items, i)); |
251 | if(server_name_len > max_server_name_len) |
252 | max_server_name_len = server_name_len; |
253 | } |
254 | |
255 | sni_hostname_list = calloc(num_probes + 1, ++max_server_name_len); |
256 | |
257 | for (i = 0; i < num_probes; i++) { |
258 | config_item = config_setting_get_string_elem(config_items, i); |
259 | sni_hostname_list[i] = malloc(max_server_name_len); |
260 | strcpy (sni_hostname_list[i], config_item); |
261 | if(verbose) fprintf(stderr, "%s: %s[%d]: %s\n", p->description, name, i, sni_hostname_list[i]); |
262 | } |
263 | |
264 | p->data = (void*)tls_data_set_list(p->data, alpn, sni_hostname_list); |
265 | } |
266 | |
267 | static void setup_sni_alpn(struct proto *p, config_setting_t* sni_hostnames, config_setting_t* alpn_protocols) |
268 | { |
269 | p->data = (void*)new_tls_data(); |
270 | p->probe = get_probe("sni_alpn"); |
271 | setup_sni_alpn_list(p, sni_hostnames, "sni_hostnames", 0); |
272 | setup_sni_alpn_list(p, alpn_protocols, "alpn_protocols", 1); |
273 | } |
274 | |
275 | |
276 | /* Extract configuration for protocols to connect to. |
277 | * out: newly-allocated list of protocols |
278 | */ |
279 | |
280 | static int config_protocols(config_t *config, struct proto **prots) |
281 | { |
282 | config_setting_t *setting, *prot, *patterns, *sni_hostnames, *alpn_protocols; |
283 | const char *hostname, *port, *name; |
284 | int i, num_prots; |
285 | struct proto *p, *prev = NULL; |
286 | |
287 | setting = config_lookup(config, "protocols"); |
288 | if (setting) { |
289 | num_prots = config_setting_length(setting); |
290 | for (i = 0; i < num_prots; i++) { |
291 | p = calloc(1, sizeof(*p)); |
292 | if (i == 0) *prots = p; |
293 | if (prev) prev->next = p; |
294 | prev = p; |
295 | |
296 | prot = config_setting_get_elem(setting, i); |
297 | if ((config_setting_lookup_string(prot, "name", &name) && |
298 | config_setting_lookup_string(prot, "host", &hostname) && |
299 | config_setting_lookup_string(prot, "port", &port) |
300 | )) { |
301 | p->description = name; |
302 | config_setting_lookup_string(prot, "service", &(p->service)); |
303 | config_setting_lookup_bool(prot, "keepalive", &p->keepalive); |
304 | |
305 | if (config_setting_lookup_int(prot, "log_level", &p->log_level) == CONFIG_FALSE) { |
306 | p->log_level = 1; |
307 | } |
308 | |
309 | resolve_split_name(&(p->saddr), hostname, port); |
310 | |
311 | p->probe = get_probe(name); |
312 | if (!p->probe || !strcmp(name, "sni_alpn")) { |
313 | fprintf(stderr, "line %d: %s: probe unknown\n", config_setting_source_line(prot), name); |
314 | exit(1); |
315 | } |
316 | |
317 | /* Probe-specific options: regex patterns */ |
318 | if (!strcmp(name, "regex")) { |
319 | patterns = config_setting_get_member(prot, "regex_patterns"); |
320 | if (patterns && config_setting_is_array(patterns)) { |
321 | setup_regex_probe(p, patterns); |
322 | } |
323 | } |
324 | |
325 | /* Probe-specific options: SNI/ALPN */ |
326 | if (!strcmp(name, "tls")) { |
327 | sni_hostnames = config_setting_get_member(prot, "sni_hostnames"); |
328 | alpn_protocols = config_setting_get_member(prot, "alpn_protocols"); |
329 | |
330 | if((sni_hostnames && config_setting_is_array(sni_hostnames)) || (alpn_protocols && config_setting_is_array(alpn_protocols))) { |
331 | setup_sni_alpn(p, sni_hostnames, alpn_protocols); |
332 | } |
333 | } |
334 | |
335 | } |
336 | } |
337 | } |
338 | |
339 | return 0; |
340 | } |
341 | |
342 | |
343 | /* Parses a config file |
344 | * in: *filename |
345 | * out: *listen, a newly-allocated linked list of listen addrinfo |
346 | * *prots, a newly-allocated linked list of protocols |
347 | * 1 on error, 0 on success |
348 | */ |
349 | |
350 | static int config_parse(char *filename, struct addrinfo **listen, struct proto **prots) |
351 | { |
352 | config_t config; |
353 | int timeout; |
354 | const char* str; |
355 | |
356 | config_init(&config); |
357 | if (config_read_file(&config, filename) == CONFIG_FALSE) { |
358 | /* If it's a parse error then there will be a line number for the failure |
359 | * an I/O error (such as non-existent file) will have the error line as 0 |
360 | */ |
361 | if (config_error_line(&config) != 0) { |
362 | fprintf(stderr, "%s:%d:%s\n", |
363 | filename, |
364 | config_error_line(&config), |
365 | config_error_text(&config)); |
366 | exit(1); |
367 | } |
368 | fprintf(stderr, "%s:%s\n", |
369 | filename, |
370 | config_error_text(&config)); |
371 | return 1; |
372 | } |
373 | |
374 | config_lookup_bool(&config, "verbose", &verbose); |
375 | config_lookup_bool(&config, "inetd", &inetd); |
376 | config_lookup_bool(&config, "foreground", &foreground); |
377 | config_lookup_bool(&config, "numeric", &numeric); |
378 | config_lookup_bool(&config, "transparent", &transparent); |
379 | |
380 | if (config_lookup_int(&config, "timeout", (int *)&timeout) == CONFIG_TRUE) { |
381 | probing_timeout = timeout; |
382 | } |
383 | |
384 | if (config_lookup_string(&config, "on-timeout", &str)) { |
385 | set_ontimeout(str); |
386 | } |
387 | |
388 | config_lookup_string(&config, "user", &user_name); |
389 | config_lookup_string(&config, "pidfile", &pid_file); |
390 | |
391 | config_listen(&config, listen); |
392 | config_protocols(&config, prots); |
393 | |
394 | return 0; |
395 | } |
396 | |
397 | |
398 | /* Adds protocols to the list of options, so command-line parsing uses the |
399 | * protocol definition array |
400 | * options: array of options to add to; must be big enough |
401 | * n_opts: number of options in *options before calling (i.e. where to append) |
402 | * prot: array of protocols |
403 | * n_prots: number of protocols in *prot |
404 | * */ |
405 | static void append_protocols(struct option *options, int n_opts, struct proto *prot , int n_prots) |
406 | { |
407 | int o, p; |
408 | |
409 | for (o = n_opts, p = 0; p < n_prots; o++, p++) { |
410 | options[o].name = prot[p].description; |
411 | options[o].has_arg = required_argument; |
412 | options[o].flag = 0; |
413 | options[o].val = p + PROT_SHIFT; |
414 | } |
415 | } |
416 | |
417 | static void make_alloptions(void) |
418 | { |
419 | builtins = get_builtins(); |
420 | |
421 | /* Create all_options, composed of const_options followed by one option per |
422 | * known protocol */ |
423 | all_options = calloc(ARRAY_SIZE(const_options) + get_num_builtins(), sizeof(struct option)); |
424 | memcpy(all_options, const_options, sizeof(const_options)); |
425 | append_protocols(all_options, ARRAY_SIZE(const_options) - 1, builtins, get_num_builtins()); |
426 | } |
427 | |
428 | /* Performs a first scan of command line options to see if a configuration file |
429 | * is specified. If there is one, parse it now before all other options (so |
430 | * configuration file settings can be overridden from the command line). |
431 | * |
432 | * prots: newly-allocated list of configured protocols, if any. |
433 | */ |
434 | static void cmdline_config(int argc, char* argv[], struct proto** prots) |
435 | { |
436 | |
437 | int c, res; |
438 | char *config_filename; |
439 | |
440 | |
441 | make_alloptions(); |
442 | |
443 | |
444 | optind = 1; |
445 | opterr = 0; /* we're missing protocol options at this stage so don't output errors */ |
446 | while ((c = getopt_long_only(argc, argv, optstr, all_options, NULL)) != -1) { |
447 | if (c == 'v') { |
448 | verbose++; |
449 | } |
450 | if (c == 'F') { |
451 | config_filename = optarg; |
452 | if (config_filename) { |
453 | res = config_parse(config_filename, &addr_listen, prots); |
454 | } else { |
455 | /* No configuration file specified -- try default file locations */ |
456 | res = config_parse("/etc/sslh/sslh.cfg", &addr_listen, prots); |
457 | if (!res && verbose) fprintf(stderr, "Using /etc/sslh/sslh.cfg\n"); |
458 | if (res) { |
459 | res = config_parse("/etc/sslh.cfg", &addr_listen, prots); |
460 | if (!res && verbose) fprintf(stderr, "Using /etc/sslh.cfg\n"); |
461 | } |
462 | } |
463 | if (res) |
464 | exit(4); |
465 | break; |
466 | } |
467 | } |
468 | |
469 | } |
470 | |
471 | |
472 | /* Parse command-line options. prots points to a list of configured protocols, |
473 | * potentially non-allocated */ |
474 | static void parse_cmdline(int argc, char* argv[], struct proto* prots) |
475 | { |
476 | int c; |
477 | struct addrinfo **a; |
478 | struct proto *p; |
479 | |
480 | optind = 1; |
481 | opterr = 1; |
482 | next_arg: |
483 | while ((c = getopt_long_only(argc, argv, optstr, all_options, NULL)) != -1) { |
484 | if (c == 0) continue; |
485 | |
486 | if (c >= PROT_SHIFT) { |
487 | if (prots) |
488 | for (p = prots; p && p->next; p = p->next) { |
489 | /* override if protocol was already defined by config file |
490 | * (note it only overrides address and use builtin probe) */ |
491 | if (!strcmp(p->description, builtins[c-PROT_SHIFT].description)) { |
492 | resolve_name(&(p->saddr), optarg); |
493 | p->probe = builtins[c-PROT_SHIFT].probe; |
494 | goto next_arg; |
495 | } |
496 | } |
497 | /* At this stage, it's a new protocol: add it to the end of the |
498 | * list */ |
499 | if (!prots) { |
500 | /* No protocols yet -- create the list */ |
501 | p = prots = calloc(1, sizeof(*p)); |
502 | } else { |
503 | p->next = calloc(1, sizeof(*p)); |
504 | p = p->next; |
505 | } |
506 | memcpy(p, &builtins[c-PROT_SHIFT], sizeof(*p)); |
507 | resolve_name(&(p->saddr), optarg); |
508 | continue; |
509 | } |
510 | |
511 | switch (c) { |
512 | |
513 | case 'F': |
514 | /* Legal option, but do nothing, it was already processed in |
515 | * cmdline_config() */ |
516 | |
517 | fprintf(stderr, "Built without libconfig support: configuration file not available.\n"); |
518 | exit(1); |
519 | |
520 | break; |
521 | |
522 | case 't': |
523 | probing_timeout = atoi(optarg); |
524 | break; |
525 | |
526 | case OPT_ONTIMEOUT: |
527 | set_ontimeout(optarg); |
528 | break; |
529 | |
530 | case 'p': |
531 | /* find the end of the listen list */ |
532 | for (a = &addr_listen; *a; a = &((*a)->ai_next)); |
533 | /* append the specified addresses */ |
534 | resolve_name(a, optarg); |
535 | |
536 | break; |
537 | |
538 | case 'V': |
539 | printf("%s %s\n", server_type, VERSION); |
540 | exit(0); |
541 | |
542 | case 'u': |
543 | user_name = optarg; |
544 | break; |
545 | |
546 | case 'P': |
547 | pid_file = optarg; |
548 | break; |
549 | |
550 | case 'v': |
551 | verbose++; |
552 | break; |
553 | |
554 | default: |
555 | print_usage(); |
556 | exit(2); |
557 | } |
558 | } |
559 | |
560 | if (!prots) { |
561 | fprintf(stderr, "At least one target protocol must be specified.\n"); |
562 | exit(2); |
563 | } |
564 | |
565 | set_protocol_list(prots); |
566 | |
567 | /* If compiling with systemd socket support no need to require listen address */ |
568 | |
569 | if (!addr_listen && !inetd) { |
570 | fprintf(stderr, "No listening address specified; use at least one -p option\n"); |
571 | exit(1); |
572 | } |
573 | |
574 | |
575 | /* Did command-line override foreground setting? */ |
576 | if (background) |
577 | foreground = 0; |
578 | |
579 | } |
580 | |
581 | int main(int argc, char *argv[]) |
582 | { |
583 | |
584 | extern char *optarg; |
585 | extern int optind; |
586 | int res, num_addr_listen; |
587 | struct proto* protocols = NULL; |
588 | |
589 | int *listen_sockets; |
590 | |
591 | /* Init defaults */ |
592 | pid_file = NULL; |
593 | user_name = NULL; |
594 | |
595 | cmdline_config(argc, argv, &protocols); |
596 | parse_cmdline(argc, argv, protocols); |
597 | |
598 | if (inetd) |
599 | { |
600 | verbose = 0; |
601 | start_shoveler(0); |
602 | exit(0); |
603 | } |
604 | |
605 | if (verbose) |
606 | printsettings(); |
607 | |
608 | num_addr_listen = start_listen_sockets(&listen_sockets, addr_listen); |
609 | |
610 | |
611 | if (num_addr_listen < 1) { |
612 | fprintf(stderr, "No listening sockets found, restart sockets or specify addresses in config\n"); |
613 | exit(1); |
614 | } |
615 | |
616 | |
617 | if (!foreground) { |
618 | if (fork() > 0) exit(0); /* Detach */ |
619 | |
620 | /* New session -- become group leader */ |
621 | if (getuid() == 0) { |
622 | res = setsid(); |
623 | CHECK_RES_DIE(res, "setsid: already process leader"); |
624 | } |
625 | } |
626 | |
627 | setup_signals(); |
628 | |
629 | if (pid_file) |
630 | write_pid_file(pid_file); |
631 | |
632 | if (user_name) |
633 | drop_privileges(user_name); |
634 | |
635 | |
636 | /* Open syslog connection */ |
637 | setup_syslog(argv[0]); |
638 | |
639 | if (verbose) |
640 | printcaps(); |
641 | |
642 | main_loop(listen_sockets, num_addr_listen); |
643 | |
644 | return 0; |
645 | } |
646 |
Built with git-ssb-web