git ssb

0+

cel / sslh



Commit 8fdaf6eb08555e01c9993ffbf52f7e4ac40c3d15

Browse Files

changed configuration file to accomodate SNI in a cleaner way

Yves Rutschle committed on 7/17/2015, 1:04:04 PM
Parent: 77ef29358d7cfb5962cab175995e9e48399a991d

Files changed

ChangeLogchanged
basic.cfgchanged
example.cfgchanged
probe.cchanged
sslh-main.cchanged
sslh.podchanged
ChangeLogView
@@ -4,8 +4,13 @@
44
55 Added support for RFC4366 SNI
66 (Travis Burtrum)
77
8+ Changed configuration file format: 'probe' field is
9+ no longer required, 'name' field can now contain
10+ 'sni' or 'regex', with corresponding options (see
11+ example.org)
12+
813 v1.17: 09MAR2015
914 Support RFC5952-style IPv6 addresses, e.g. [::]:443.
1015
1116 Transparant proxy support for FreeBSD.
basic.cfgView
@@ -18,12 +18,12 @@
1818 );
1919
2020 protocols:
2121 (
22- { name: "ssh"; service: "ssh"; host: "localhost"; port: "22"; probe: "builtin"; },
23- { name: "openvpn"; host: "localhost"; port: "1194"; probe: "builtin"; },
24- { name: "xmpp"; host: "localhost"; port: "5222"; probe: "builtin"; },
25- { name: "http"; host: "localhost"; port: "80"; probe: "builtin"; },
26- { name: "ssl"; host: "localhost"; port: "443"; probe: "builtin"; },
27- { name: "anyprot"; host: "localhost"; port: "443"; probe: "builtin"; }
22+ { name: "ssh"; service: "ssh"; host: "localhost"; port: "22"; },
23+ { name: "openvpn"; host: "localhost"; port: "1194"; },
24+ { name: "xmpp"; host: "localhost"; port: "5222"; },
25+ { name: "http"; host: "localhost"; port: "80"; },
26+ { name: "ssl"; host: "localhost"; port: "443"; },
27+ { name: "anyprot"; host: "localhost"; port: "443"; }
2828 );
2929
example.cfgView
@@ -22,33 +22,50 @@
2222
2323 # List of protocols
2424 #
2525 # Each protocol entry consists of:
26-# name: name of the protocol
26+# name: name of the probe. These are listed on the command
27+# line (ssh -?), plus 'regex', 'sni' and 'timeout'.
28+
2729 # service: (optional) libwrap service name (see hosts_access(5))
28-# host: host name to connect that protocol
29-# port: port number to connect that protocol
30-# probe: "builtin" or a list of regular expressions
31-# (can be left out, e.g. to use with on-timeout)
30+# host, port: where to connect when this probe succeeds
31+#
32+# Probe-specific options:
33+# sni:
34+# sni_hotnames: list of FQDN for that target
35+# regex:
36+# regex_patterns: list of patterns to match for
37+# that target.
3238 #
3339 # sslh will try each probe in order they are declared, and
3440 # connect to the first that matches.
35-
41+#
42+# You can specify several of 'regex' and 'sni'.
43+
3644 protocols:
3745 (
38- { name: "ssh"; service: "ssh"; host: "localhost"; port: "22"; probe: "builtin"; },
39- { name: "sni"; host: "localhost"; port: "993"; probe: "builtin"; sni_hostnames: [ "imap.example.org", "imap.example.com" ]; },
40- { name: "openvpn"; host: "localhost"; port: "1194"; probe: [ "^\x00[\x0D-\xFF]$", "^\x00[\x0D-\xFF]\x38" ]; },
41- { name: "xmpp"; host: "localhost"; port: "5222"; probe: [ "jabber" ]; },
42- { name: "http"; host: "localhost"; port: "80"; probe: "builtin"; },
43- { name: "ssl"; host: "localhost"; port: "443"; probe: [ "" ]; },
46+ { name: "ssh"; service: "ssh"; host: "localhost"; port: "22"; },
47+ { name: "http"; host: "localhost"; port: "80"; },
48+
49+ { name: "sni"; host: "localhost"; port: "993"; sni_hostnames: [ "mail.rutschle.net", "mail.englishintoulouse.com" ]; },
50+ { name: "sni"; host: "localhost"; port: "xmpp-client"; sni_hostnames: [ "im.rutschle.net", "im.englishintoulouse.com" ]; },
51+
52+# OpenVPN
53+ { name: "regex"; host: "localhost"; port: "1194"; regex_patterns: [ "^\x00[\x0D-\xFF]$", "^\x00[\x0D-\xFF]\x38" ]; },
54+# Jabber
55+ { name: "regex"; host: "localhost"; port: "5222"; regex_patterns: [ "jabber" ]; },
56+
57+# Catch-all
58+ { name: "regex"; host: "localhost"; port: "443"; regex_patterns: [ "" ]; },
59+
60+# Where to connect in case of timeout (defaults to ssh)
4461 { name: "timeout"; service: "daytime"; host: "localhost"; port: "daytime"; }
4562 );
4663
4764 # Optionally, specify to which protocol to connect in case
4865 # of timeout (defaults to "ssh").
49-# You can timeout to any arbitrary address by setting a
50-# protocol with no probe, as is the case with this example.
66+# You can timeout to any arbitrary address by setting an
67+# entry in 'protocols' named "timeout".
5168 # This enables you to set a tcpd service name for this
5269 # protocol too.
5370 on-timeout: "timeout";
5471
probe.cView
@@ -232,13 +232,15 @@
232232
233233 /* Assume does not match */
234234 valid_tls = PROBE_NEXT;
235235
236- for (sni_hostname = proto->data; *sni_hostname; sni_hostname++)
236+ for (sni_hostname = proto->data; *sni_hostname; sni_hostname++) {
237+ fprintf(stderr, "matching [%s] with [%s]\n", hostname, *sni_hostname);
237238 if(!strcmp(hostname, *sni_hostname)) {
238239 valid_tls = PROBE_MATCH;
239240 break;
240241 }
242+ }
241243
242244 free(hostname);
243245 return valid_tls;
244246 }
@@ -364,8 +366,13 @@
364366 /* Special case of "sni" probe for same reason as above*/
365367 if (!strcmp(description, "sni"))
366368 return is_sni_protocol;
367369
370+ /* Special case of "timeout" is allowed as a probe name in the
371+ * configuration file even though it's not really a probe */
372+ if (!strcmp(description, "timeout"))
373+ return is_true;
374+
368375 return NULL;
369376 }
370377
371378
sslh-main.cView
@@ -248,9 +248,9 @@
248248 */
249249 #ifdef LIBCONFIG
250250 static int config_protocols(config_t *config, struct proto **prots)
251251 {
252- config_setting_t *setting, *prot, *probes, *sni_hostnames;
252+ config_setting_t *setting, *prot, *patterns, *sni_hostnames;
253253 const char *hostname, *port, *name;
254254 int i, num_prots;
255255 struct proto *p, *prev = NULL;
256256
@@ -272,36 +272,28 @@
272272 config_setting_lookup_string(prot, "service", &(p->service));
273273
274274 resolve_split_name(&(p->saddr), hostname, port);
275275
276+ p->probe = get_probe(name);
277+ if (!p->probe) {
278+ fprintf(stderr, "line %d: %s: probe unknown\n", config_setting_source_line(prot), name);
279+ exit(1);
280+ }
276281
277- probes = config_setting_get_member(prot, "probe");
278- if (probes) {
279- if (config_setting_is_array(probes)) {
280- /* If 'probe' is an array, setup a regex probe using the
281- * array of strings as pattern */
282-
283- setup_regex_probe(p, probes);
284-
285- } else {
286- /* if 'probe' is 'builtin', set the probe to the
287- * appropriate builtin protocol */
288- if (!strcmp(config_setting_get_string(probes), "builtin")) {
289- p->probe = get_probe(name);
290- if (!p->probe) {
291- fprintf(stderr, "%s: no builtin probe for this protocol\n", name);
292- exit(1);
293- }
294- } else {
295- fprintf(stderr, "%s: illegal probe name\n", name);
296- exit(1);
297- }
282+ /* Probe-specific options: regex patterns */
283+ if (!strcmp(name, "regex")) {
284+ patterns = config_setting_get_member(prot, "regex_patterns");
285+ if (patterns && config_setting_is_array(patterns)) {
286+ setup_regex_probe(p, patterns);
298287 }
299288 }
300289
301- sni_hostnames = config_setting_get_member(prot, "sni_hostnames");
302- if (sni_hostnames && config_setting_is_array(sni_hostnames)) {
303- setup_sni_hostnames(p, sni_hostnames);
290+ /* Probe-specific options: SNI hostnames */
291+ if (!strcmp(name, "sni")) {
292+ sni_hostnames = config_setting_get_member(prot, "sni_hostnames");
293+ if (sni_hostnames && config_setting_is_array(sni_hostnames)) {
294+ setup_sni_hostnames(p, sni_hostnames);
295+ }
304296 }
305297 }
306298 }
307299 }
sslh.podView
@@ -50,16 +50,12 @@
5050 and the list of protocols).
5151
5252 The configuration file makes it possible to specify
5353 protocols using regular expressions: a list of regular
54-expressions is given as the I<probe> parameter, and if the
54+expressions is given as the I<regex_patterns> parameter, and if the
5555 first packet received from the client matches any of these
5656 expressions, B<sslh> connects to that protocol.
5757
58-Alternatively, the I<probe> parameter can be set to
59-"builtin", to use the compiled probes which are much faster
60-than regular expressions.
61-
6258 =head2 Probing protocols
6359
6460 When receiving an incoming connection, B<sslh> will read the
6561 first bytes sent be the connecting client. It will then

Built with git-ssb-web