fix

o Especially important is the OpenSSL fix.

.gitignore

@@ -9,6 +9,7 @@ aclocal.m4
 autom4te.cache
 certificate.pem
 compile
+config.cache
 config.guess
 config.h
 config.h.in

INSTALL.Debian

@@ -41,7 +41,7 @@ you point your browser to the site.
 
 At the very least, you need a file called "certificate.pem" that includes
 both the private key and the public certificate in PEM (i.e. ASCII) format.
-Additionally, you should create files for each of the publically visible
+Additionally, you should create files for each of the publicly visible
 hostnames that your machine has. These are named "certificate-${FQDN}.pem".
 You probably also want "certificate-localhost.pem".
 

Makefile.am

@@ -127,6 +127,8 @@ BUILT_SOURCES        = shellinabox/beep.h                                     \
 shellinaboxd_LDADD   = liblogging.la                                          \
                        libhttp.la
 shellinaboxd_LDFLAGS = -static
+## Added this for compatibility with older versions of autoconf/automake
+docdir               = ${datadir}/doc/${PACKAGE}
 
 symbolname           =                                                        \
   sed -e 's/.*\/\([^.]*\)[.].*/\1/'                                           \
@@ -240,7 +242,8 @@ shellinaboxd.1: ${top_srcdir}/shellinabox/shellinaboxd.man.in                 \
 
 clean-local: clean-demo
 	-rm -rf shellinaboxd.1                                                \
-	        shellinaboxd.ps
+	        shellinaboxd.ps                                               \
+	        shellinaboxd.pdf
 	-rm -rf debian/shellinabox                                            \
 	        debian/shellinabox*.debhelper*                                \
 	        debian/shellinabox.substvars                                  \
@@ -362,3 +365,9 @@ clean-demo:
 	           "(int)sizeof($${sym}Start);";                              \
 	 } >"$@"
 
+shellinaboxd.ps: shellinaboxd.1
+	groff -man -T ps $^ >$@
+
+shellinaboxd.pdf: shellinaboxd.ps
+	ps2pdf $^ $@
+

README.md

@@ -6,16 +6,16 @@ shellinabox
 [![Join the chat at https://gitter.im/shellinabox/shellinabox](https://badges.gitter.im/Join%20Chat.svg)](https://gitter.im/shellinabox/shellinabox?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
 
 
-This is unofficial fork of project **Shell In A Box**. Fork was created because
+This is an unofficial fork of the project **Shell In A Box**. The fork was created because
-original project is not maintained anymore and we cannot contact original
+the original project was not maintained anymore and we cannot contact the original
 repository owners.
 
-Our aim is to continue with maintanince of shellinabox project. For list of
+Our aim is to continue with maintenance of the shellinabox project. For a list of
-recent changes please see [CHANGELOG.md](/CHANGELOG.md).
+recent changes, please see [CHANGELOG.md](/CHANGELOG.md).
 
-If you have any questions, issues or patches, please fell free to submit pull
+If you have any questions, issues, or patches, please feel free to submit a pull
-request or report an issue. You can also drop an email to original project
+request or report an issue. You can also drop an email to the original project
-[issue #261](https://code.google.com/p/shellinabox/issues/detail?id=261) discusion
+[issue #261](https://code.google.com/p/shellinabox/issues/detail?id=261) discussion
 from where this fork started.
 
 
@@ -27,7 +27,7 @@ tools to a web based terminal emulator. This emulator is accessible to any
 JavaScript and CSS enabled web browser and does not require any additional
 browser plugins.
 
-![Shell In A Box preview](/misc/preview.png?raw=true)
+![Shell In A Box preview](/misc/preview.gif?raw=true)
 
 More information:
 
@@ -42,34 +42,17 @@ Build
 For building **shellinabox** from source on Debian or RHEL based systems use commands
 listed below. This will create executable file `shellinaboxd` in project directory.
 
-1. Install dependencies
+1. Clone the autotools
 
    ```
-    apt-get install git libssl-dev libpam0g-dev zlib1g-dev dh-autoreconf
+    wget https://raw.githubusercontent.com/simono41/shellinabox/master/auto.sh
    ```
 
-   or
+3. Run autotools 
 
    ```
-   yum install git openssl-devel pam-devel zlib-devel autoconf automake libtool
+    chmod +x auto.sh
-   ```
+    ./auto.sh
-
-2. Clone source files and move to project directory
-
-   ```
-    git clone https://github.com/shellinabox/shellinabox.git && cd shellinabox
-   ```
-
-3. Run autotools in project directory
-
-   ```
-    autoreconf -i
-   ```
-
-4. Run configure and make in project directory
-
-   ```
-    ./configure && make
    ```
 
 #### Debian package
@@ -103,5 +86,19 @@ created from our sources. In new issue report please include following things:
 * Version of shellinabox
 * Steps to reproduce the problem
 
-Also feel free to post any questions or comments in [shellianbox chat room](https://gitter.im/shellinabox/shellinabox)
+Also feel free to post any questions or comments in [shellinabox chat room](https://gitter.im/shellinabox/shellinabox)
 on Gitter.
+
+
+Known Issues
+------------
+
+* The openssl package is required for HTTP/SSL support.
+  Shell-in-a-box may be used without SSL such that the login session
+  is not encrypted.  To enable automatic creation of self-signed
+  certificates or to use a generated certificate, install openssl.
+
+* On Debian Jessie, the default openssl package does not include the
+  utilities necessary for Shell-in-a-box to generate self-signed
+  certificates.  Upgrade openssl to install a version of the tools
+  that support certificate creation.

auto.sh

@@ -0,0 +1,56 @@
+#!/bin/bash
+
+set -ex
+
+if [[ $EUID -ne 0 ]]; then
+   echo "This script must be run as root" 1>&2
+   exit 1
+fi
+  echo "Als root Angemeldet"
+
+if [ -f /usr/bin/apt ]; then
+  apt update
+
+  apt install git libssl-dev libpam0g-dev zlib1g-dev dh-autoreconf
+fi
+
+if [ -f /usr/bin/pacman ]; then
+  pacman -Sy git openssl autoconf automake make gcc
+fi
+
+cd /opt/
+
+git clone https://github.com/simono41/shellinabox.git
+
+cd shellinabox
+
+autoreconf -i
+
+./configure && make
+
+cp shellinabox.service /etc/systemd/system/
+
+systemctl daemon-reload
+
+systemctl enable shellinabox.service
+
+# adduser
+
+echo adduser webssh
+
+useradd webssh
+
+mkdir /home/webssh
+
+cp shellinabox_sshwrapper.sh /home/webssh/
+
+chmod 770 -R /home/webssh/
+
+chown -cR webssh:webssh /home/webssh/
+
+passwd webssh <<EOT
+webssh
+webssh
+EOT
+
+systemctl start shellinabox.service &

configure.ac

@@ -1,7 +1,8 @@
 AC_PREREQ(2.57)
 
-dnl This is the one location where the authoritative version number is stored
+dnl This is one of the locations where the authoritative version
-AC_INIT(shellinabox, 2.15, markus@shellinabox.com)
+dnl  number is stored.  The other is in the debian/changelog.
+AC_INIT(shellinabox, 2.20, markus@shellinabox.com)
 if test -e .git; then
 VCS_REVISION=" (revision `cd $srcdir && git log -1 --format=format:%h`)"
 else
@@ -16,6 +17,8 @@ CFLAGS="${CFLAGS:--Os}"
 AM_INIT_AUTOMAKE([subdir-objects])
 AM_CONFIG_HEADER(config.h)
 AC_PROG_CC
+dnl Added this for compatibility with older versions of autoconf/automake
+AM_PROG_CC_C_O
 AC_LANG_WERROR
 AC_PROG_INSTALL
 AC_PROG_LIBTOOL
@@ -24,9 +27,12 @@ AC_C_CONST
 AC_PROG_GCC_TRADITIONAL
 AC_CONFIG_MACRO_DIR([m4])
 
+dnl Overwrite default archiver flags.
+AC_SUBST(AR_FLAGS, [cr])
+
 dnl Check for header files that do not exist on all platforms
-AC_CHECK_HEADERS([libutil.h pthread.h pty.h strings.h sys/prctl.h sys/uio.h  \
+AC_CHECK_HEADERS([libutil.h pthread.h pty.h strings.h syslog.h sys/prctl.h \
-                  util.h utmp.h utmpx.h])
+                  sys/uio.h util.h])
 
 dnl Most systems require linking against libutil.so in order to get login_tty()
 AC_CHECK_FUNCS(login_tty, [],
@@ -37,6 +43,9 @@ AC_CHECK_FUNCS(login_tty, [],
 dnl Use strlcat() instead of strncat() to avoid spurious warnings
 AC_CHECK_FUNCS([strlcat])
 
+dnl Use vsyslog() for logging important error messages
+AC_CHECK_FUNCS([vsyslog])
+
 dnl Prefer thread-safe functions, if available
 AC_CHECK_FUNCS([getgrgid_r getgrnam_r gethostbyname_r getpwnam_r getpwuid_r  \
                 openpty strcasestr getresuid getresgid setresuid setresgid ])
@@ -66,15 +75,6 @@ AC_TRY_LINK([#include <math.h>],
             [AC_DEFINE(HAVE_ISNAN, 1,
                        Define to 1 if you have support for isnan)])
 
-dnl Even if utmpx.h exists, not all systems have support for updwtmpx()
-AC_TRY_LINK([#include <utmp.h>],
-            [updwtmp(0, 0);],
-            [AC_DEFINE(HAVE_UPDWTMP, 1,
-                       Define to 1 if you have support for updwtmp)])
-AC_TRY_LINK([#include <utmpx.h>],
-            [updwtmpx(0, 0);],
-            [AC_DEFINE(HAVE_UPDWTMPX, 1,
-                       Define to 1 if you have support for updwtmpx)])
 
 dnl Check if the compiler supports aliasing of symbols
 AC_TRY_LINK([void x(void) { };
@@ -138,6 +138,28 @@ AC_ARG_ENABLE(runtime-loading,
                             these libraries into the binary, thus making them a
                             hard dependency, then disable runtime-loading.])
 
+dnl This is feature is not suported in some standard C libs. So users can use
+dnl this switch to avoid compile and runtime problems. Note that utmp must
+dnl disabled on systems with musl libc.
+AC_ARG_ENABLE(utmp,
+              [  --disable-utmp            Disable support for login records. Note
+                                           that for systems with musl libc utmp must
+                                           be disabled.])
+
+if test "x$enable_utmp" != xno; then
+  AC_CHECK_HEADERS([utmp.h utmpx.h])
+
+  dnl Even if utmpx.h exists, not all systems have support for updwtmpx()
+  AC_TRY_LINK([#include <utmp.h>],
+              [updwtmp(0, 0);],
+              [AC_DEFINE(HAVE_UPDWTMP, 1,
+                         Define to 1 if you have support for updwtmp)])
+  AC_TRY_LINK([#include <utmpx.h>],
+              [updwtmpx(0, 0);],
+              [AC_DEFINE(HAVE_UPDWTMPX, 1,
+                         Define to 1 if you have support for updwtmpx)])
+fi
+
 dnl Only test for OpenSSL headers, if not explicitly disabled
 if test "x$enable_ssl" != xno; then
   AC_CHECK_HEADERS([openssl/bio.h openssl/err.h openssl/ssl.h])

debian/changelog

@@ -1,3 +1,68 @@
+shellinabox (2.20) unstable; urgency=medium
+
+  * Fixed issue #222, LOGIN service
+  * Fixed issue #360, ignore escape sequences to fix dir listing
+  * Fix for function key presses
+  * Adjusting scale on IE
+  * New option to disable peer check (#364)
+  * Add option for custom SSH port
+  * Support for APL characters
+  * PDF documentation
+  * Fix for BSD build
+  * New ready event support
+  * OpenSSL 1.1 fixes  (Closes: #828542)
+  * May build with MUSL library
+  * Documentation added that SSL support is optional and requires
+    installation of openssl on Debian. (Closes: #839067)
+  * Jessie requires explicit installation of openssl because the default
+    package does not include the necessary utilities to support creation
+    of certificates. (Closes: #839066)
+
+ -- Marc Singer <elf@debian.org>  Wed, 09 Nov 2016 09:52:24 -0800
+
+shellinabox (2.19) unstable; urgency=high
+
+  * Added support for middle-click paste, #350.
+  * Improved iOS support, #354.
+  * New logic to enable soft keyboard icon, #119, #321, #354.
+  * Disable HTTP fallback using the URL /plain.  Consequently disables
+    automatic upgrades from HTTP to HTTPS, #355. (CVE-2015-8400).
+
+ -- Marc Singer <elf@debian.org>  Sat, 05 Dec 2015 10:24:12 -0800
+
+shellinabox (2.18) unstable; urgency=low
+
+  * Fixed reverse vide rendering, #341.
+  * Using stdout for version information, #344.
+  * Added CGI session key in HTTP response.
+  * Child process cleanup, #103.
+  * Merged #340.
+  * Autoconf updates.
+  * Disabled utmp logging.
+  * Merge #338, killing children with HUP.
+  * Fixed handling of large HTTP requests.
+  * Enhanced logging clarity with prefix.
+
+ -- Marc Singer <elf@debian.org>  Sat, 10 Oct 2015 10:53:38 -0700
+
+shellinabox (2.17) unstable; urgency=medium
+
+  * Generally, SSL updates.
+  * Disabling secure client-initiated renegotiation, an abused and
+    unnecessary feature.
+  * Added support for PFS using ECDHE.
+  * Guarding build against old versions of SSL.
+
+ -- Marc Singer <elf@debian.org>  Fri, 07 Aug 2015 20:48:33 -0700
+
+shellinabox (2.16) unstable; urgency=low
+
+  * New release to guarantee upgrades for people who had installed a
+    2.15-1 release candidate.
+  * Update to About dialog to use GitHub URLs.
+
+ -- Marc Singer <elf@debian.org>  Fri, 24 Jul 2015 11:45:22 -0700
+
 shellinabox (2.15) unstable; urgency=low
 
   * Improved clean-liness so that source archive is clean.

debian/control

@@ -16,5 +16,7 @@ Suggests: openssl
 Description: publish command line shell through AJAX interface
  Shellinabox can export arbitrary command line programs to any JavaScript
  enabled web browser. By default, it prompts for username and password
- and then exports a SSL/TLS encrypted login shell. Shellinabox provides
+ and then exports a login shell. Shellinabox provides a VT100
- a VT100 compatible terminal emulator that runs within any modern browser.
+ compatible terminal emulator that runs within any modern
+ browser. Support for HTTPS protocol (SSL/TLS encryption) is optional
+ and requires installation of openssl.

debian/watch

@@ -1,2 +0,0 @@
-version=3
-https://github.com/shellinabox/shellinabox/tags .*/v?(\d\S*)\.tar\.gz

libhttp/http.h

@@ -102,7 +102,7 @@ short serverConnectionSetEvents(Server *server, ServerConnection *connection,
 void serverExitLoop(Server *server, int exitAll);
 void serverLoop(Server *server);
 int  serverSupportsSSL();
-void serverEnableSSL(Server *server, int flag);
+void serverSetupSSL(Server *server, int enable, int force);
 void serverSetCertificate(Server *server, const char *filename,
                           int autoGenerateMissing);
 void serverSetCertificateFd(Server *server, int fd);

libhttp/httpconnection.c

@@ -88,7 +88,7 @@
 static int httpPromoteToSSL(struct HttpConnection *http, const char *buf,
                             int len) {
   if (http->ssl->enabled && !http->sslHndl) {
-    debug("Switching to SSL (replaying %d+%d bytes)",
+    debug("[ssl] Switching to SSL (replaying %d+%d bytes)...",
           http->partialLength, len);
     if (http->partial && len > 0) {
       check(http->partial  = realloc(http->partial,
@@ -102,6 +102,8 @@ static int httpPromoteToSSL(struct HttpConnection *http, const char *buf,
                                     http->partial ? http->partialLength : len);
     if (http->sslHndl) {
       check(!rc);
+      // Reset renegotiations count for connections promoted to SSL.
+      http->ssl->renegotiationCount = 0;
       SSL_set_app_data(http->sslHndl, http);
     }
     free(http->partial);
@@ -138,6 +140,13 @@ static ssize_t httpRead(struct HttpConnection *http, char *buf, ssize_t len) {
       break;
     }
     dcheck(!ERR_peek_error());
+
+    // Shutdown SSL connection, if client initiated renegotiation.
+    if (http->ssl->renegotiationCount > 1) {
+      debug("[ssl] Connection shutdown due to client initiated renegotiation!");
+      rc                     = 0;
+      errno                  = EINVAL;
+    }
   } else {
     rc = NOINTR(read(http->fd, buf, len));
   }
@@ -264,7 +273,7 @@ static int httpFinishCommand(struct HttpConnection *http) {
         *lengthBuf  = '\000';
         strncat(lengthBuf, "-", sizeof(lengthBuf)-1);
       }
-      info("%s - - %s \"%s %s %s\" %d %s",
+      info("[http] %s - - %s \"%s %s %s\" %d %s",
            http->peerName, timeBuf, http->method, http->path, http->version,
            http->code, lengthBuf);
     }
@@ -396,7 +405,7 @@ void initHttpConnection(struct HttpConnection *http, struct Server *server,
   http->sslHndl            = NULL;
   http->lastError          = 0;
   if (logIsInfo()) {
-    debug("Accepted connection from %s:%d",
+    debug("[http] Accepted connection from %s:%d",
           http->peerName ? http->peerName : "???", http->peerPort);
   }
 }
@@ -417,11 +426,11 @@ void destroyHttpConnection(struct HttpConnection *http) {
     }
     httpSetState(http, COMMAND);
     if (logIsInfo()) {
-      debug("Closing connection to %s:%d",
+      debug("[http] Closing connection to %s:%d",
             http->peerName ? http->peerName : "???", http->peerPort);
     }
     httpShutdown(http, http->closed ? SHUT_WR : SHUT_RDWR);
-    dcheck(!close(http->fd));
+    dcheck(!close(http->fd) || errno != EBADF);
     free(http->peerName);
     free(http->url);
     free(http->method);
@@ -600,7 +609,7 @@ void httpTransfer(struct HttpConnection *http, char *msg, int len) {
         // Found the end of the headers.
 
         // Check that we don't send any data with HEAD requests
-        int isHead          = !strcmp(http->method, "HEAD");
+        int isHead          = http->method && !strcmp(http->method, "HEAD");
         check(l == 2 || !isHead);
 
         #ifdef HAVE_ZLIB
@@ -652,7 +661,7 @@ void httpTransfer(struct HttpConnection *http, char *msg, int len) {
                        31, 8, Z_DEFAULT_STRATEGY) == Z_OK) {
         if (deflate(&strm, Z_FINISH) == Z_STREAM_END) {
           // Compression was successful and resulted in reduction in size
-          debug("Compressed response from %d to %d", len, len-strm.avail_out);
+          debug("[http] Compressed response from %d to %d", len, len-strm.avail_out);
           free(msg);
           msg               = compressed;
           len              -= strm.avail_out;
@@ -748,7 +757,7 @@ void httpTransfer(struct HttpConnection *http, char *msg, int len) {
     if (!http->isPartialReply) {
       if (http->expecting < 0) {
         // If we do not know the length of the content, close the connection.
-        debug("Closing previously suspended connection");
+        debug("[http] Closing previously suspended connection!");
         httpCloseRead(http);
         httpSetState(http, DISCARD_PAYLOAD);
       } else if (http->expecting == 0) {
@@ -777,7 +786,7 @@ void httpTransferPartialReply(struct HttpConnection *http, char *msg, int len){
 
 static int httpHandleCommand(struct HttpConnection *http,
                              const struct Trie *handlers) {
-  debug("Handling \"%s\" \"%s\"", http->method, http->path);
+  debug("[http] Handling \"%s\" \"%s\"", http->method, http->path);
   const char *contentLength                  = getFromHashMap(&http->header,
                                                              "content-length");
   if (contentLength != NULL && *contentLength) {
@@ -892,7 +901,7 @@ static int httpHandleCommand(struct HttpConnection *http,
               protocol ? protocol : "",
               protocol ? "\r\n" : "");
             free(port);
-            debug("Switching to WebSockets");
+            debug("[http] Switching to WebSockets");
             httpTransfer(http, response, strlen(response));
             if (http->expecting < 0) {
               http->expecting                = 0;
@@ -1149,7 +1158,7 @@ static int httpParseHeaders(struct HttpConnection *http,
     }
     value[j]               = '\000';
     if (getRefFromHashMap(&http->header, http->key)) {
-      debug("Dropping duplicate header \"%s\"", http->key);
+      debug("[http] Dropping duplicate header \"%s\"", http->key);
       free(http->key);
       free(value);
       http->key            = NULL;
@@ -1412,6 +1421,7 @@ int httpHandleConnection(struct ServerConnection *connection, void *http_,
       if (bytes > 0) {
         http->headerLength          += bytes;
         if (http->headerLength > MAX_HEADER_LENGTH) {
+          debug("[http] Connection closed due to exceeded header size!");
           httpSendReply(http, 413, "Header too big", NO_MSG);
           bytes                      = 0;
           eof                        = 1;
@@ -1470,6 +1480,13 @@ int httpHandleConnection(struct ServerConnection *connection, void *http_,
           *events                   |= POLLIN;
           continue;
         }
+      } else {
+        if (http->ssl && http->ssl->enabled && http->ssl->force) {
+          debug("[http] Non-SSL connections not allowed!");
+          httpCloseRead(http);
+          bytes                      = 0;
+          eof                        = 1;
+        }
       }
     }
 
@@ -1773,7 +1790,7 @@ void httpSendReply(struct HttpConnection *http, int code,
                                 code != 200 ? "Connection: close\r\n" : "",
                                 (long)strlen(body));
   }
-  int isHead     = !strcmp(http->method, "HEAD");
+  int isHead     = http->method && !strcmp(http->method, "HEAD");
   if (!isHead) {
     response     = stringPrintf(response, "%s", body);
   }

libhttp/server.c

@@ -309,19 +309,20 @@ void initServer(struct Server *server, int localhostOnly, int portMin,
                                     + strlen(unixDomainPath);
 
     if (bind(server->serverFd, (struct sockaddr *)&serverAddr, servlen)) {
-      fatal("Failed to bind to unix socket! [%d: %s]", errno, strerror(errno));
+      fatal("[server] Failed to bind to unix socket! [%d: %s]",
+            errno, strerror(errno));
     }
     if (chown(unixDomainPath, unixDomainUser, unixDomainGroup)) {
-      fatal("Unable to change ownership on unix socket! [%d: %s]",
+      fatal("[server] Unable to change ownership on unix socket! [%d: %s]",
             errno, strerror(errno));
     }
     if (chmod(unixDomainPath, unixDomainChmod)) {
-      fatal("Unable to change premission on unix socket! [%d: %s)",
+      fatal("[server] Unable to change permission on unix socket! [%d: %s]",
             errno, strerror(errno));
     }
 
     check(!listen(server->serverFd, SOMAXCONN));
-    info("Listening on unix domain socket %s", unixDomainPath);
+    info("[server] Listening on unix domain socket %s...", unixDomainPath);
     check(server->pollFds         = malloc(sizeof(struct pollfd)));
     server->pollFds->fd           = server->serverFd;
     server->pollFds->events       = POLLIN;
@@ -362,7 +363,7 @@ void initServer(struct Server *server, int localhostOnly, int portMin,
       serverAddr.sin_port       = 0;
     }
     if (!serverAddr.sin_port) {
-      fatal("Failed to find any available port");
+      fatal("[server] Failed to find any available port!");
     }
   }
 
@@ -372,7 +373,7 @@ void initServer(struct Server *server, int localhostOnly, int portMin,
                      &socklen));
   check(socklen == sizeof(serverAddr));
   server->port                  = ntohs(serverAddr.sin_port);
-  info("Listening on port %d", server->port);
+  info("[server] Listening on port %d...", server->port);
 
   check(server->pollFds         = malloc(sizeof(struct pollfd)));
   server->pollFds->fd           = server->serverFd;
@@ -386,7 +387,7 @@ void initServer(struct Server *server, int localhostOnly, int portMin,
 void destroyServer(struct Server *server) {
   if (server) {
     if (server->serverFd >= 0) {
-      info("Shutting down server");
+      info("[server] Shutting down server");
       NOINTR(close(server->serverFd));
     }
     for (int i = 0; i < server->numConnections; i++) {
@@ -669,11 +670,12 @@ void serverLoop(struct Server *server) {
   server->looping                         = loopDepth - 1;
 }
 
-void serverEnableSSL(struct Server *server, int flag) {
+void serverSetupSSL(struct Server *server, int enable, int force) {
-  if (flag) {
+  if (enable) {
     check(serverSupportsSSL());
   }
-  sslEnable(&server->ssl, flag);
+  sslEnable(&server->ssl, enable);
+  sslForce(&server->ssl, force);
 }
 
 void serverSetCertificate(struct Server *server, const char *filename,

libhttp/server.h

@@ -118,7 +118,7 @@ short serverConnectionSetEvents(struct Server *server,
                                 short events);
 void serverExitLoop(struct Server *server, int exitAll);
 void serverLoop(struct Server *server);
-void serverEnableSSL(struct Server *server, int flag);
+void serverSetupSSL(struct Server *server, int enable, int force);
 void serverSetCertificate(struct Server *server, const char *filename,
                           int autoGenerateMissing);
 void serverSetCertificateFd(struct Server *server, int fd);

libhttp/ssl.c

@@ -100,17 +100,23 @@ BIO_METHOD *  (*BIO_f_buffer)(void);
 void          (*BIO_free_all)(BIO *);
 BIO *         (*BIO_new)(BIO_METHOD *);
 BIO *         (*BIO_new_socket)(int, int);
+BIO *         (*BIO_next)(BIO *);
 BIO *         (*BIO_pop)(BIO *);
 BIO *         (*BIO_push)(BIO *, BIO *);
+#if defined(HAVE_OPENSSL_EC)
+void          (*EC_KEY_free)(EC_KEY *);
+EC_KEY *      (*EC_KEY_new_by_curve_name)(int);
+#endif
 void          (*ERR_clear_error)(void);
-void          (*ERR_clear_error)(void);
-unsigned long (*ERR_peek_error)(void);
 unsigned long (*ERR_peek_error)(void);
 long          (*SSL_CTX_callback_ctrl)(SSL_CTX *, int, void (*)(void));
 int           (*SSL_CTX_check_private_key)(const SSL_CTX *);
 long          (*SSL_CTX_ctrl)(SSL_CTX *, int, long, void *);
 void          (*SSL_CTX_free)(SSL_CTX *);
 SSL_CTX *     (*SSL_CTX_new)(SSL_METHOD *);
+int           (*SSL_CTX_set_cipher_list)(SSL_CTX *, const char *);
+void          (*SSL_CTX_set_info_callback)(SSL_CTX *,
+                                           void (*)(const SSL *, int, int));
 int           (*SSL_CTX_use_PrivateKey_file)(SSL_CTX *, const char *, int);
 int           (*SSL_CTX_use_PrivateKey_ASN1)(int, SSL_CTX *,
                                              const unsigned char *, long);
@@ -136,7 +142,6 @@ int           (*SSL_write)(SSL *, const void *, int);
 SSL_METHOD *  (*SSLv23_server_method)(void);
 X509 *        (*d2i_X509)(X509 **px, const unsigned char **in, int len);
 void          (*X509_free)(X509 *a);
-int           (*x_SSL_CTX_set_cipher_list)(SSL_CTX *ctx, const char *str);
 void          (*x_sk_zero)(void *st);
 void *        (*x_SSL_COMP_get_compression_methods)(void);
 #endif
@@ -163,9 +168,11 @@ struct SSLSupport *newSSL(void) {
 
 void initSSL(struct SSLSupport *ssl) {
   ssl->enabled               = serverSupportsSSL();
+  ssl->force                 = 0;
   ssl->sslContext            = NULL;
   ssl->sniCertificatePattern = NULL;
   ssl->generateMissing       = 0;
+  ssl->renegotiationCount    = 0;
   initTrie(&ssl->sniContexts, sslDestroyCachedContext, ssl);
 }
 
@@ -274,17 +281,24 @@ static void loadSSL(void) {
     { { &BIO_free_all },                "BIO_free_all" },
     { { &BIO_new },                     "BIO_new" },
     { { &BIO_new_socket },              "BIO_new_socket" },
+    { { &BIO_next },                    "BIO_next" },
     { { &BIO_pop },                     "BIO_pop" },
     { { &BIO_push },                    "BIO_push" },
     { { &ERR_clear_error },             "ERR_clear_error" },
     { { &ERR_clear_error },             "ERR_clear_error" },
     { { &ERR_peek_error },              "ERR_peek_error" },
     { { &ERR_peek_error },              "ERR_peek_error" },
+#ifdef HAVE_OPENSSL_EC
+    { { &EC_KEY_free },                 "EC_KEY_free" },
+    { { &EC_KEY_new_by_curve_name },    "EC_KEY_new_by_curve_name" },
+#endif
     { { &SSL_CTX_callback_ctrl },       "SSL_CTX_callback_ctrl" },
     { { &SSL_CTX_check_private_key },   "SSL_CTX_check_private_key" },
     { { &SSL_CTX_ctrl },                "SSL_CTX_ctrl" },
     { { &SSL_CTX_free },                "SSL_CTX_free" },
     { { &SSL_CTX_new },                 "SSL_CTX_new" },
+    { { &SSL_CTX_set_cipher_list },     "SSL_CTX_set_cipher_list" },
+    { { &SSL_CTX_set_info_callback },   "SSL_CTX_set_info_callback" },
     { { &SSL_CTX_use_PrivateKey_file }, "SSL_CTX_use_PrivateKey_file" },
     { { &SSL_CTX_use_PrivateKey_ASN1 }, "SSL_CTX_use_PrivateKey_ASN1" },
     { { &SSL_CTX_use_certificate_file },"SSL_CTX_use_certificate_file"},
@@ -312,12 +326,11 @@ static void loadSSL(void) {
     { { &SSLv23_server_method },        "SSLv23_server_method" },
     { { &d2i_X509 },                    "d2i_X509" },
     { { &X509_free },                   "X509_free" },
-    { { &x_SSL_CTX_set_cipher_list },   "SSL_CTX_set_cipher_list" },
     { { &x_sk_zero },                   "sk_zero" }
   };
   for (unsigned i = 0; i < sizeof(symbols)/sizeof(symbols[0]); i++) {
     if (!(*symbols[i].var = loadSymbol(path_libssl, symbols[i].fn))) {
-      debug("Failed to load SSL support. Could not find \"%s\"",
+      debug("[ssl] Failed to load SSL support. Could not find \"%s\"!",
             symbols[i].fn);
       for (unsigned j = 0; j < sizeof(symbols)/sizeof(symbols[0]); j++) {
         *symbols[j].var = NULL;
@@ -329,9 +342,10 @@ static void loadSSL(void) {
   x_SSL_COMP_get_compression_methods = loadSymbol(path_libssl, "SSL_COMP_get_compression_methods");
   // ends
 
+
   SSL_library_init();
   dcheck(!ERR_peek_error());
-  debug("Loaded SSL suppport");
+  debug("[ssl] Loaded SSL suppport...");
 }
 #endif
 
@@ -368,12 +382,12 @@ int serverSupportsSSL(void) {
 #if defined(HAVE_OPENSSL)
 static void sslGenerateCertificate(const char *certificate,
                                    const char *serverName) {
-  debug("Auto-generating missing certificate \"%s\" for \"%s\"",
+  info("[ssl] Auto-generating missing certificate \"%s\" for \"%s\"...",
         certificate, serverName);
 
   pid_t pid       = fork();
   if (pid == -1) {
-    warn("Failed to generate self-signed certificate \"%s\"", certificate);
+    warn("[ssl] Failed to generate self-signed certificate \"%s\"!", certificate);
   } else if (pid == 0) {
     int fd        = NOINTR(open("/dev/null", O_RDONLY));
     check(fd != -1);
@@ -390,14 +404,16 @@ static void sslGenerateCertificate(const char *certificate,
     if (execlp("openssl", "openssl", "req", "-x509", "-nodes", "-days", "7300",
                "-newkey", "rsa:2048", "-keyout", certificate, "-out", certificate,
                "-subj", subject, (char *)NULL) < 0) {
-      warn("Failed to generate self-signed certificate \"%s\"", certificate);
+      warn("[ssl] Failed to generate self-signed certificate \"%s\"!", certificate);
       free(subject);
     }
   } else {
     int status;
     check(NOINTR(waitpid(pid, &status, 0)) == pid);
     if (!WIFEXITED(status) || WEXITSTATUS(status) != 0) {
-      warn("Failed to generate self-signed certificate \"%s\"", certificate);
+      warn("[ssl] Failed to generate self-signed certificate \"%s\"!", certificate);
+    } else {
+      info("[ssl] Certificate successfully generated.");
     }
   }
 }
@@ -595,29 +611,73 @@ static int sslSetCertificateFromFile(SSL_CTX *context,
   return rc;
 }
 
+static void sslInfoCallback(const SSL *sslHndl, int type, int val) {
+  // Count the number of renegotiations for each SSL session.
+  if (type & SSL_CB_HANDSHAKE_START) {
+    struct HttpConnection *http    =
+                          (struct HttpConnection *) SSL_get_app_data(sslHndl);
+    http->ssl->renegotiationCount += 1;
+  }
+}
+
 static SSL_CTX *sslMakeContext(void) {
+
   SSL_CTX *context;
   check(context = SSL_CTX_new(SSLv23_server_method()));
-  SSL_CTX_set_options(context, SSL_OP_ALL);
+
-  SSL_CTX_set_options(context, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3);
+  long options  = SSL_OP_ALL;
+  options      |= SSL_OP_NO_SSLv2;
+  options      |= SSL_OP_NO_SSLv3;
+  options      |= SSL_OP_SINGLE_DH_USE;
+
 #ifdef SSL_OP_NO_COMPRESSION
-  SSL_CTX_set_options(context, SSL_OP_NO_COMPRESSION);
+  options      |= SSL_OP_NO_COMPRESSION;
 #endif
-#if defined(HAVE_DLOPEN)
+
+#ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
+  options      |= SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION;
+#endif
+
+  // Set default SSL options.
+  SSL_CTX_set_options(context, options);
+
+  // Workaround for SSL_OP_NO_COMPRESSION with older OpenSSL versions.
+#ifdef HAVE_DLOPEN
   if (SSL_COMP_get_compression_methods) {
     sk_SSL_COMP_zero(SSL_COMP_get_compression_methods());
   }
 #elif OPENSSL_VERSION_NUMBER >= 0x00908000L
   sk_SSL_COMP_zero(SSL_COMP_get_compression_methods());
 #endif
-  SSL_CTX_set_options(context, SSL_OP_SINGLE_DH_USE);
+
-#ifdef SSL_OP_SINGLE_ECDH_USE
+  // For Perfect Forward Secrecy (PFS) support we need to enable some additional
+  // SSL options, provide eliptic curve key object for handshake and add chipers
+  // suits with ECDHE handshake on top of the ciper list.
+#ifdef HAVE_OPENSSL_EC
   SSL_CTX_set_options(context, SSL_OP_SINGLE_ECDH_USE);
+  SSL_CTX_set_options(context, SSL_OP_CIPHER_SERVER_PREFERENCE);
+
+  EC_KEY *ecKey;
+  check(ecKey   = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1));
+  SSL_CTX_set_tmp_ecdh(context, ecKey);
+  EC_KEY_free(ecKey);
+
+  debug("[ssl] Support for PFS enabled...");
 #endif
-#ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
+
-  SSL_CTX_set_options(context, SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION);
+  check(SSL_CTX_set_cipher_list(context,
-#endif
+    "ECDHE-RSA-AES256-GCM-SHA384:"
-  check(SSL_CTX_set_cipher_list(context, "HIGH:MEDIUM:!aNULL:!MD5"));
+    "ECDHE-RSA-AES128-GCM-SHA256:"
+    "ECDHE-RSA-AES256-SHA384:"
+    "ECDHE-RSA-AES128-SHA256:"
+    "ECDHE-RSA-AES256-SHA:"
+    "ECDHE-RSA-AES128-SHA:"
+    "ECDHE-RSA-DES-CBC3-SHA:"
+    "HIGH:MEDIUM:!RC4:!aNULL:!MD5"));
+
+  SSL_CTX_set_info_callback(context, sslInfoCallback);
+
+  debug("[ssl] Server context successfully initialized...");
   return context;
 }
 #endif
@@ -634,7 +694,7 @@ static int sslSNICallback(SSL *sslHndl, int *al ATTR_UNUSED,
   }
   struct HttpConnection *http =
                             (struct HttpConnection *)SSL_get_app_data(sslHndl);
-  debug("Received SNI callback for virtual host \"%s\" from \"%s:%d\"",
+  debug("[ssl] Received SNI callback for virtual host \"%s\" from \"%s:%d\"...",
         name, httpGetPeerName(http), httpGetPort(http));
   char *serverName;
   check(serverName        = malloc(strlen(name)+2));
@@ -671,7 +731,7 @@ static int sslSNICallback(SSL *sslHndl, int *al ATTR_UNUSED,
         // the default certificate, instead.
         sslSetCertificateFromFile(context, certificate);
       } else {
-        warn("Could not find matching certificate \"%s\" for \"%s\"",
+        warn("[ssl] Could not find matching certificate \"%s\" for \"%s\"",
              certificate, serverName + 1);
         SSL_CTX_free(context);
         context           = ssl->sslContext;
@@ -748,7 +808,7 @@ void sslSetCertificate(struct SSLSupport *ssl, const char *filename,
         sslGenerateCertificate(defaultCertificate, he->h_name);
       } else {
         if (h_err) {
-          warn("Error getting host information: \"%s\".", hstrerror(h_err));
+          warn("[ssl] Error getting host information: \"%s\".", hstrerror(h_err));
         }
         sslGenerateCertificate(defaultCertificate, hostname);
       }
@@ -757,7 +817,7 @@ void sslSetCertificate(struct SSLSupport *ssl, const char *filename,
     }
   }
   if (sslSetCertificateFromFile(ssl->sslContext, defaultCertificate) < 0) {
-    fatal("Cannot read valid certificate from \"%s\". "
+    fatal("[ssl] Cannot read valid certificate from \"%s\"! "
           "Check file permissions and file format.", defaultCertificate);
   }
  valid_certificate:
@@ -823,7 +883,7 @@ void sslSetCertificateFd(struct SSLSupport *ssl, int fd) {
   ssl->sslContext = sslMakeContext();
   char *filename = sslFdToFilename(fd);
   if (!sslSetCertificateFromFd(ssl->sslContext, fd)) {
-    fatal("Cannot read valid certificate from %s. Check file format.",
+    fatal("[ssl] Cannot read valid certificate from %s. Check file format.",
           filename);
   }
   free(filename);
@@ -837,6 +897,12 @@ int sslEnable(struct SSLSupport *ssl, int enabled) {
   return old;
 }
 
+int sslForce(struct SSLSupport *ssl, int force) {
+  int old      = ssl->force;
+  ssl->force   = force;
+  return old;
+}
+
 void sslBlockSigPipe(void) {
   sigset_t set;
   sigemptyset(&set);
@@ -949,6 +1015,14 @@ int sslPromoteToSSL(struct SSLSupport *ssl, SSL **sslHndl, int fd,
 #endif
 }
 
+BIO *sslGetNextBIO(BIO *b) {
+#if OPENSSL_VERSION_NUMBER <= 0x10100000L
+  return b->next_bio;
+#else
+  return BIO_next(b);
+#endif
+}
+
 void sslFreeHndl(SSL **sslHndl) {
 #if defined(HAVE_OPENSSL)
   if (*sslHndl) {
@@ -956,24 +1030,23 @@ void sslFreeHndl(SSL **sslHndl) {
     // BIOs. This is particularly a problem if an SSL connection has two
     // different BIOs for the read and the write end, with one being a stacked
     // derivative of the other. Unfortunately, this is exactly the scenario
-    // that we set up.
+    // that we set up with call to "BIO_push(readBIO, writeBIO)" in function
+    // "sslPromoteToSSL()".
     // As a work-around, we un-stack the BIOs prior to freeing the SSL
     // connection.
+    debug("[ssl] Freeing SSL handle.");
     ERR_clear_error();
     BIO *writeBIO, *readBIO;
     check(writeBIO    = SSL_get_wbio(*sslHndl));
     check(readBIO     = SSL_get_rbio(*sslHndl));
     if (writeBIO != readBIO) {
-      if (readBIO->next_bio == writeBIO) {
+      if (sslGetNextBIO(readBIO) == writeBIO) {
-        // OK, that's exactly the bug we are looking for. We know how to
+        // OK, that's exactly the bug we are looking for. We know that
-        // fix it.
+        // writeBIO needs to be removed from readBIO chain.
+        debug("[ssl] Removing stacked write BIO!");
         check(BIO_pop(readBIO) == writeBIO);
-        check(readBIO->references == 1);
+        check(!sslGetNextBIO(readBIO));
-        check(writeBIO->references == 1);
+      } else if (sslGetNextBIO(readBIO) == sslGetNextBIO(writeBIO)) {
-        check(!readBIO->next_bio);
-        check(!writeBIO->prev_bio);
-      } else if (readBIO->next_bio == writeBIO->next_bio &&
-                 writeBIO->next_bio->prev_bio == writeBIO) {
         // Things get even more confused, if the SSL handshake is aborted
         // prematurely.
         // OpenSSL appears to internally stack a BIO onto the read end that
@@ -982,21 +1055,19 @@ void sslFreeHndl(SSL **sslHndl) {
         // reading and one for writing). In this case, not only is the
         // reference count wrong, but the chain of next_bio/prev_bio pairs
         // is corrupted, too.
+        warn("[ssl] Removing stacked socket BIO!");
         BIO *sockBIO;
         check(sockBIO = BIO_pop(readBIO));
         check(sockBIO == BIO_pop(writeBIO));
-        check(readBIO->references == 1);
+        check(!sslGetNextBIO(readBIO));
-        check(writeBIO->references == 1);
+        check(!sslGetNextBIO(writeBIO));
-        check(sockBIO->references == 1);
+        check(!sslGetNextBIO(sockBIO));
-        check(!readBIO->next_bio);
-        check(!writeBIO->next_bio);
-        check(!sockBIO->prev_bio);
         BIO_free_all(sockBIO);
       } else {
         // We do not know, how to fix this situation. Something must have
         // changed in the OpenSSL internals. Either, this is a new bug, or
         // somebody fixed the code in a way that we did not anticipate.
-        fatal("Unexpected corruption of OpenSSL data structures");
+        fatal("[ssl] Unexpected corruption of OpenSSL data structures");
       }
     }
     SSL_free(*sslHndl);

libhttp/ssl.h

@@ -61,6 +61,7 @@
 #undef HAVE_OPENSSL
 typedef struct BIO        BIO;
 typedef struct BIO_METHOD BIO_METHOD;
+typedef struct EC_KEY     EC_KEY;
 typedef struct SSL        SSL;
 typedef struct SSL_CTX    SSL_CTX;
 typedef struct SSL_METHOD SSL_METHOD;
@@ -69,23 +70,35 @@ typedef struct X509       X509;
 #define SSL_ERROR_WANT_WRITE 3
 #endif
 
+// EC support was added to OpenSSL in 0.9.8, but it can be disabled in some
+// distributions.
+#if OPENSSL_VERSION_NUMBER >= 0x0090800fL && !defined(OPENSSL_NO_EC)
+# define HAVE_OPENSSL_EC
+#endif
+
 #if defined(HAVE_DLOPEN)
 extern long    (*x_BIO_ctrl)(BIO *, int, long, void *);
 extern BIO_METHOD *(*x_BIO_f_buffer)(void);
 extern void    (*x_BIO_free_all)(BIO *);
 extern BIO    *(*x_BIO_new)(BIO_METHOD *);
 extern BIO    *(*x_BIO_new_socket)(int, int);
+extern BIO    *(*x_BIO_next)(BIO *);
 extern BIO    *(*x_BIO_pop)(BIO *);
 extern BIO    *(*x_BIO_push)(BIO *, BIO *);
+#if defined(HAVE_OPENSSL_EC)
+extern void    (*x_EC_KEY_free)(EC_KEY *);
+extern EC_KEY *(*x_EC_KEY_new_by_curve_name)(int);
+#endif
 extern void    (*x_ERR_clear_error)(void);
-extern void    (*x_ERR_clear_error)(void);
-extern unsigned long (*x_ERR_peek_error)(void);
 extern unsigned long (*x_ERR_peek_error)(void);
 extern long    (*x_SSL_CTX_callback_ctrl)(SSL_CTX *, int, void (*)(void));
 extern int     (*x_SSL_CTX_check_private_key)(const SSL_CTX *);
 extern long    (*x_SSL_CTX_ctrl)(SSL_CTX *, int, long, void *);
 extern void    (*x_SSL_CTX_free)(SSL_CTX *);
 extern SSL_CTX*(*x_SSL_CTX_new)(SSL_METHOD *);
+extern int     (*x_SSL_CTX_set_cipher_list)(SSL_CTX *, const char *);
+extern void    (*x_SSL_CTX_set_info_callback)(SSL_CTX *,
+                                              void (*)(const SSL *, int, int));
 extern int     (*x_SSL_CTX_use_PrivateKey_file)(SSL_CTX *, const char *, int);
 extern int     (*x_SSL_CTX_use_PrivateKey_ASN1)(int, SSL_CTX *,
                                                 const unsigned char *, long);
@@ -111,7 +124,6 @@ extern int     (*x_SSL_write)(SSL *, const void *, int);
 extern SSL_METHOD *(*x_SSLv23_server_method)(void);
 extern X509 *  (*x_d2i_X509)(X509 **px, const unsigned char **in, int len);
 extern void    (*x_X509_free)(X509 *a);
-extern int     (*x_SSL_CTX_set_cipher_list)(SSL_CTX *ctx, const char *str);
 extern void    (*x_sk_zero)(void *st);
 extern void   *(*x_SSL_COMP_get_compression_methods)(void);
 
@@ -120,17 +132,20 @@ extern void   *(*x_SSL_COMP_get_compression_methods)(void);
 #define BIO_free_all                 x_BIO_free_all
 #define BIO_new                      x_BIO_new
 #define BIO_new_socket               x_BIO_new_socket
+#define BIO_next                     x_BIO_next
 #define BIO_pop                      x_BIO_pop
 #define BIO_push                     x_BIO_push
+#define EC_KEY_free                  x_EC_KEY_free
+#define EC_KEY_new_by_curve_name     x_EC_KEY_new_by_curve_name
 #define ERR_clear_error              x_ERR_clear_error
-#define ERR_clear_error              x_ERR_clear_error
-#define ERR_peek_error               x_ERR_peek_error
 #define ERR_peek_error               x_ERR_peek_error
 #define SSL_CTX_callback_ctrl        x_SSL_CTX_callback_ctrl
 #define SSL_CTX_check_private_key    x_SSL_CTX_check_private_key
 #define SSL_CTX_ctrl                 x_SSL_CTX_ctrl
 #define SSL_CTX_free                 x_SSL_CTX_free
 #define SSL_CTX_new                  x_SSL_CTX_new
+#define SSL_CTX_set_cipher_list      x_SSL_CTX_set_cipher_list
+#define SSL_CTX_set_info_callback    x_SSL_CTX_set_info_callback
 #define SSL_CTX_use_PrivateKey_file  x_SSL_CTX_use_PrivateKey_file
 #define SSL_CTX_use_PrivateKey_ASN1  x_SSL_CTX_use_PrivateKey_ASN1
 #define SSL_CTX_use_certificate_file x_SSL_CTX_use_certificate_file
@@ -154,13 +169,13 @@ extern void   *(*x_SSL_COMP_get_compression_methods)(void);
 #define SSLv23_server_method         x_SSLv23_server_method
 #define d2i_X509                     x_d2i_X509
 #define X509_free                    x_X509_free
-#define SSL_CTX_set_cipher_list      x_SSL_CTX_set_cipher_list
 #define sk_zero                      x_sk_zero
 #define SSL_COMP_get_compression_methods    x_SSL_COMP_get_compression_methods
 
 #undef  BIO_set_buffer_read_data
 #undef  SSL_CTX_set_tlsext_servername_arg
 #undef  SSL_CTX_set_tlsext_servername_callback
+#undef  SSL_CTX_set_tmp_ecdh
 #undef  SSL_get_app_data
 #undef  SSL_set_app_data
 #undef  SSL_set_mode
@@ -175,6 +190,9 @@ extern void   *(*x_SSL_COMP_get_compression_methods)(void);
                                  (x_SSL_CTX_callback_ctrl(ctx,                \
                                            SSL_CTRL_SET_TLSEXT_SERVERNAME_CB, \
                                            (void (*)(void))cb))
+#define SSL_CTX_set_tmp_ecdh(ctx, ecdh)                                       \
+                                 (x_SSL_CTX_ctrl(ctx, SSL_CTRL_SET_TMP_ECDH,  \
+                                                 0, (char *)ecdh))
 #define SSL_get_app_data(s)      (x_SSL_get_ex_data(s, 0))
 #define SSL_set_app_data(s, arg) (x_SSL_set_ex_data(s, 0, (char *)arg))
 #define SSL_set_mode(ssl, op)    (x_SSL_ctrl((ssl), SSL_CTRL_MODE, (op), NULL))
@@ -182,9 +200,11 @@ extern void   *(*x_SSL_COMP_get_compression_methods)(void);
 
 struct SSLSupport {
   int         enabled;
+  int         force;
   SSL_CTX     *sslContext;
   char        *sniCertificatePattern;
   int         generateMissing;
+  int         renegotiationCount;
   struct Trie sniContexts;
 };
 
@@ -197,6 +217,7 @@ void sslSetCertificate(struct SSLSupport *ssl, const char *filename,
                        int autoGenerateMissing);
 void sslSetCertificateFd(struct SSLSupport *ssl, int fd);
 int  sslEnable(struct SSLSupport *ssl, int enabled);
+int  sslForce(struct SSLSupport *ssl, int force);
 void sslBlockSigPipe();
 int  sslUnblockSigPipe();
 int  sslPromoteToSSL(struct SSLSupport *ssl, SSL **sslHndl, int fd,

libhttp/url.c

@@ -82,10 +82,10 @@ static char *urlUnescape(char *s) {
           ch    = (ch << 4) + c2 - (c2 > '9' ? 'A' - 10 : '0');
           ++u;
         } else if (!warned++) {
-          warn("Malformed URL encoded data \"%s\"", r);
+          warn("[http] Malformed URL encoded data \"%s\"!", r);
         }
       } else if (!warned++) {
-        warn("Malformed URL encoded data \"%s\"", r);
+        warn("[http] Malformed URL encoded data \"%s\"!", r);
       }
     }
     *s++        = ch;
@@ -297,7 +297,7 @@ static void urlParsePostBody(struct URL *url,
                 urlParsePart(url, lastPart, ptr - lastPart);
               } else {
                 if (ptr != buf) {
-                  info("Ignoring prologue before \"multipart/form-data\"");
+                  info("[http] Ignoring prologue before \"multipart/form-data\"!");
                 }
               }
               lastPart     = part;
@@ -307,18 +307,18 @@ static void urlParsePostBody(struct URL *url,
               urlParsePart(url, lastPart, ptr - lastPart);
               lastPart     = NULL;
               if (len > 0) {
-                info("Ignoring epilogue past end of \"multipart/"
+                info("[http] Ignoring epilogue past end of \"multipart/"
-                     "form-data\"");
+				     "form-data\"!");
               }
             }
           }
         }
       }
       if (lastPart) {
-        warn("Missing final \"boundary\" for \"multipart/form-data\"");
+        warn("[http] Missing final \"boundary\" for \"multipart/form-data\"!");
       }
     } else {
-      warn("Missing \"boundary\" information for \"multipart/form-data\"");
+      warn("[http] Missing \"boundary\" information for \"multipart/form-data\"!");
     }
   }
   destroyHashMap(&contentType);

logging/logging.c

@@ -52,6 +52,19 @@
 
 #include "logging/logging.h"
 
+#ifdef HAVE_SYSLOG_H
+# include <syslog.h>
+# ifndef HAVE_VSYSLOG
+static void vsyslog(int priority, const char *fmt, va_list ap) {
+  char *s = vStringPrintf(NULL, fmt, ap);
+  if (s) {
+    syslog(priority, "%s", s);
+    free(s);
+  }
+}
+# endif
+#endif
+
 static int verbosity = MSG_DEFAULT;
 
 static void debugMsg(int level, const char *fmt, va_list ap) {
@@ -86,6 +99,13 @@ void error(const char *fmt, ...) {
   va_list ap;
   va_start(ap, fmt);
   debugMsg(MSG_ERROR, fmt, ap);
+#ifdef HAVE_SYSLOG_H
+  va_list apSyslog;
+  va_copy(apSyslog, ap);
+  va_start(apSyslog, fmt);
+  vsyslog(LOG_ERR, fmt, apSyslog);
+  va_end(apSyslog);
+#endif
   va_end(ap);
 }
 
@@ -100,6 +120,14 @@ void fatal(const char *fmt, ...) {
   va_list ap;
   va_start(ap, fmt);
   debugMsg(MSG_QUIET, fmt, ap);
+#ifdef HAVE_SYSLOG_H
+  va_list apSyslog;
+  va_copy(apSyslog, ap);
+  va_start(apSyslog, fmt);
+  vsyslog(LOG_CRIT, fmt, apSyslog);
+  va_end(apSyslog);
+  syslog(LOG_CRIT, "[server] Aborting...");
+#endif
   va_end(ap);
   _exit(1);
 }

misc/embedded.html

@@ -14,7 +14,7 @@
 
 	For communication with Shell In A Box we need to set '-m' (messages-origin)
 	command line option with appropriate messages origin. Origin should be set to
-	URL of parent (this) window. If origin is set to '*' Shell In A Box won't checki
+	URL of parent (this) window. If origin is set to '*' Shell In A Box won't check
 	origin on received messages. This is usually unsafe option.
 
 	Command line example:
@@ -25,7 +25,7 @@
 	# Client Side
 	#
 
-	Shell In A Box accepts messages formated as JSON strings with 'type' and 'data'
+	Shell In A Box accepts messages formatted as JSON strings with 'type' and 'data'
 	fields. Messages with same format can be passed back to parent (this) window.
 
 	Message example:
@@ -59,6 +59,9 @@
 
 	Following types of messages can be received from shellinabox:
 
+	* ready
+		signals that shellinabox is ready to send and receive messages
+
 	* output
 		data field contains terminal output
 
@@ -140,10 +143,6 @@
 		var output  = document.getElementById("output");
 		var session = document.getElementById("session");
 
-		// Add url to our iframe. We do this, only that variable 'url' can be used
-		// throughout the whole code where needed.
-		iframe.src = url;
-
 		document.getElementById("execute").addEventListener("click", function() {
 			// Send input to shellinabox
 			var message = JSON.stringify({
@@ -209,6 +208,15 @@
 			// Handle response according to response type
 			var decoded = JSON.parse(message.data);
 			switch (decoded.type) {
+			case "ready":
+				// Shellinabox is ready to communicate and we will enable console output
+				// by default.
+				var message = JSON.stringify({
+					type : 'output',
+					data : 'enable'
+				});
+				iframe.contentWindow.postMessage(message, url);
+				break;
 			case "output" :
 				// Append new output
 				output.innerHTML = output.innerHTML + decoded.data;
@@ -220,6 +228,9 @@
 			}
 		}, false);
 
+		// Add url to our iframe after the event listener is installed.
+		iframe.src = url;
+
 	</script>
 
 </body>

sgit

@@ -0,0 +1,22 @@
+#!/bin/bash
+
+set -ex
+
+if [[ "--help" == "${1}" ]]; then
+echo "bash ./sgit user.email commit"
+fi
+
+if [[ -z "${2}" ]]; then
+echo "Bitte email und commit angeben!!!"
+exit 1
+fi
+
+git config --global user.email "${1}"
+git config --global user.name "${1}"
+git status
+git pull
+git add --all
+git commit --all -m "${2}"
+git show
+git push
+git status

shellinabox.service

@@ -0,0 +1,9 @@
+[Unit]
+Description=shellinabox
+
+[Service]
+Type=oneshot
+ExecStart=/opt/shellinabox/shellinaboxd -t --service=/:webssh:webssh:HOME:'/home/webssh/shellinabox_sshwrapper.sh'
+
+[Install]
+WantedBy=multi-user.target

shellinabox/black-on-white.css

@@ -0,0 +1,16 @@
+#vt100 .ansiDefR {
+  color:            #ffffff;
+}
+
+#vt100 .bgAnsiDefR {
+  background-color: #000000;
+}
+
+#vt100 #scrollable.inverted .ansiDefR {
+  color:            #000000;
+}
+
+#vt100 #scrollable.inverted .bgAnsiDefR {
+  background-color: #ffffff;
+}
+

shellinabox/color.css

@@ -2,6 +2,7 @@
 
 /* SYSTEM colors */
 #vt100 .ansiDef   {                            }
+#vt100 .ansiDefR  {                            }
 
 #vt100 .ansi0     { color:            #000000; }
 #vt100 .ansi1     { color:            #cd0000; }
@@ -264,6 +265,7 @@
 
 /* SYSTEM colors */
 #vt100 .bgAnsiDef {                            }
+#vt100 .bgAnsiDefR {                            }
 
 #vt100 .bgAnsi0   { background-color: #000000; }
 #vt100 .bgAnsi1   { background-color: #cd0000; }

shellinabox/launcher.c

@@ -63,6 +63,7 @@
 #include <sys/socket.h>
 #include <sys/stat.h>
 #include <sys/time.h>
+#include <sys/ttydefaults.h>
 #include <sys/types.h>
 #include <sys/wait.h>
 #include <sys/utsname.h>
@@ -128,6 +129,8 @@ typedef struct pam_handle pam_handle_t;
 #define UNUSED(x)    do { (void)(x); } while (0)
 #endif
 
+#define UNUSED_RETURN(x) do { (void)((x)+1); } while (0)
+
 #undef pthread_once
 #undef execle
 int execle(const char *, const char *, ...);
@@ -170,6 +173,13 @@ static int (*x_misc_conv)(int, const struct pam_message **,
 static int   launcher = -1;
 static uid_t restricted;
 
+// From shellinabox/shellinaboxd.c
+extern int enableUtmpLogging;
+
+#if defined(HAVE_SECURITY_PAM_APPL_H)
+static int pamSessionSighupFlag;
+#endif
+
 // MacOS X has a somewhat unusual definition of getgrouplist() which can
 // trigger a compile warning.
 #if defined(HAVE_GETGROUPLIST_TAKES_INTS)
@@ -428,7 +438,7 @@ static void loadPAM(void) {
         *symbols[i].var = (void *)my_misc_conv;
         continue;
       }
-      debug("Failed to load PAM support. Could not find \"%s\"",
+      debug("[server] Failed to load PAM support. Could not find \"%s\"!",
             symbols[i].fn);
       for (unsigned j = 0; j < sizeof(symbols)/sizeof(symbols[0]); j++) {
         *symbols[j].var = NULL;
@@ -436,7 +446,7 @@ static void loadPAM(void) {
       return;
     }
   }
-  debug("Loaded PAM suppport");
+  debug("[server] Loaded PAM suppport");
 }
 #endif
 
@@ -564,7 +574,7 @@ int terminateChild(struct Session *session) {
   }
 
   if (session->pid < 1) {
-    debug("Child pid for termination not valid!");
+    debug("[server] Child pid for termination not valid!");
     return -1;
   }
 
@@ -574,7 +584,7 @@ int terminateChild(struct Session *session) {
   check(request        = calloc(len, 1));
   request->terminate   = session->pid;
   if (NOINTR(write(launcher, request, len)) != len) {
-    debug("Child %d termination request failed!", request->terminate);
+    debug("[server] Child %d termination request failed!", request->terminate);
     free(request);
     return -1;
   }
@@ -668,9 +678,10 @@ void destroyUtmp(struct Utmp *utmp) {
       uid_t r_gid, e_gid, s_gid;
       check(!getresuid(&r_uid, &e_uid, &s_uid));
       check(!getresgid(&r_gid, &e_gid, &s_gid));
-      setresuid(0, 0, 0);
+      UNUSED_RETURN(setresuid(0, 0, 0));
-      setresgid(0, 0, 0);
+      UNUSED_RETURN(setresgid(0, 0, 0));
 
+      if (enableUtmpLogging) {
         setutxent();
         pututxline(&utmp->utmpx);
         endutxent();
@@ -680,6 +691,7 @@ void destroyUtmp(struct Utmp *utmp) {
           updwtmpx("/var/log/wtmp", &utmp->utmpx);
         }
 #endif
+      }
 
       // Switch back to the lower privileges
       check(!setresgid(r_gid, e_gid, s_gid));
@@ -848,7 +860,7 @@ static int forkPty(int *pty, int useLogin, struct Utmp **utmp,
           ptyPath[5]        = 't';
         }
         if ((slave          = NOINTR(open(ptyPath, O_RDWR|O_NOCTTY))) >= 0) {
-          debug("Opened old-style pty: %s", ptyPath);
+          debug("[server] Opened old-style pty: %s", ptyPath);
           goto success;
         }
         NOINTR(close(*pty));
@@ -1228,7 +1240,7 @@ static pam_handle_t *internalLogin(struct Service *service, struct Utmp *utmp,
 
   // Update utmp/wtmp entries
 #ifdef HAVE_UTMPX_H
-  if (service->authUser != 2 /* SSH */) {
+  if (enableUtmpLogging && service->authUser != 2 /* SSH */) {
     memset(&utmp->utmpx.ut_user, 0, sizeof(utmp->utmpx.ut_user));
     strncat(&utmp->utmpx.ut_user[0], service->user,
             sizeof(utmp->utmpx.ut_user) - 1);
@@ -1488,6 +1500,17 @@ void setWindowSize(int pty, int width, int height) {
   }
 }
 
+#if defined(HAVE_SECURITY_PAM_APPL_H)
+static void pamSessionSighupHandler(int sig ATTR_UNUSED,
+                                    siginfo_t *info ATTR_UNUSED,
+                                    void *unused ATTR_UNUSED) {
+  UNUSED(sig);
+  UNUSED(info);
+  UNUSED(unused);
+  pamSessionSighupFlag = 1;
+}
+#endif
+
 static void childProcess(struct Service *service, int width, int height,
                          struct Utmp *utmp, const char *peerName, const char *realIP,
                          const char *url) {
@@ -1543,10 +1566,12 @@ static void childProcess(struct Service *service, int width, int height,
   cfsetospeed(&tt, B38400);
   tcsetattr(0, TCSAFLUSH, &tt);
 
-  // Assert root privileges in order to update utmp entry.
+  // Assert root privileges in order to update utmp entry. We can only do that,
-  setresuid(0, 0, 0);
+  // if we have root permissions otherwise this fails.
-  setresgid(0, 0, 0);
+  UNUSED_RETURN(setresuid(0, 0, 0));
+  UNUSED_RETURN(setresgid(0, 0, 0));
 #ifdef HAVE_UTMPX_H
+  if (enableUtmpLogging) {
     setutxent();
     struct utmpx utmpx            = utmp->utmpx;
     if (service->useLogin || service->authUser) {
@@ -1563,6 +1588,7 @@ static void childProcess(struct Service *service, int width, int height,
       updwtmpx("/var/log/wtmp", &utmpx);
     }
 #endif
+  }
 #endif
 
   // Create session. We might have to fork another process as PAM wants us
@@ -1575,7 +1601,7 @@ static void childProcess(struct Service *service, int width, int height,
 #if defined(HAVE_SECURITY_PAM_APPL_H)
     if (pam && !geteuid()) {
       if (pam_open_session(pam, PAM_SILENT) != PAM_SUCCESS) {
-        fprintf(stderr, "Access denied.\n");
+        fprintf(stderr, "[server] Unable to open PAM session!\n");
         _exit(1);
       }
       pid_t pid                 = fork();
@@ -1585,9 +1611,26 @@ static void childProcess(struct Service *service, int width, int height,
       case 0:
         break;
       default:;
-        // Finish all pending PAM operations.
+        // This process is used for finishing all pending PAM operations.
+        struct sigaction sa;
+        memset(&sa, 0, sizeof(sa));
+        sa.sa_flags             = SA_NOCLDSTOP | SA_SIGINFO;
+        sa.sa_sigaction         = pamSessionSighupHandler;
+        check(!sigaction(SIGHUP, &sa, NULL));
         int status, rc;
-        check(NOINTR(waitpid(pid, &status, 0)) == pid);
+        while (1) {
+          pamSessionSighupFlag  = 0;
+          int val               = waitpid(pid, &status, 0);
+          if (val < 0 && errno == EINTR) {
+            if (pamSessionSighupFlag) {
+              // If SIGHUP signal is received it needs to be forwarded to child
+              // process, which is acctual service process.
+              kill(pid, SIGHUP);
+            }
+          } else {
+            break;
+          }
+        }
         rc                      = pam_close_session(pam, PAM_SILENT);
         pam_end(pam, rc | PAM_DATA_SILENT);
         _exit(WIFEXITED(status) ? WEXITSTATUS(status) : -WTERMSIG(status));
@@ -1626,6 +1669,10 @@ static void childProcess(struct Service *service, int width, int height,
     }
   }
 
+  // Reset the sigaction for HUP to the default, so the child does not inherit the action of SIG_IGN from us.
+  // We need the child to be able to get HUP's because we send HUP if the session times out/closes.
+  signal(SIGHUP, SIG_DFL);
+
   // Finally, launch the child process.
   if (service->useLogin == 1) {
     // At login service launch, we try to pass real IP in '-h' parameter. Real
@@ -1669,7 +1716,7 @@ static void launcherDaemon(int fd) {
     int len                   = read(fd, &request, sizeof(request));
     if (len != sizeof(request) && errno != EINTR) {
       if (len) {
-        debug("Failed to read launch request");
+        debug("[server] Failed to read launch request!");
       }
       break;
     }
@@ -1679,7 +1726,8 @@ static void launcherDaemon(int fd) {
     int   status;
     pid_t pid;
     while (NOINTR(pid = waitpid(-1, &status, WNOHANG)) > 0) {
-      debug("Child %d exited with exit code %d", pid, WEXITSTATUS(status));
+      debug("[server] Child %d exited with exit code %d.",
+            pid, WEXITSTATUS(status));
       if (WIFEXITED(status) || WIFSIGNALED(status)) {
         char key[32];
         snprintf(&key[0], sizeof(key), "%d", pid);
@@ -1696,10 +1744,10 @@ static void launcherDaemon(int fd) {
       errno = 0;
       NOINTR(pid = waitpid(request.terminate, &status, WNOHANG));
       if (pid == 0 && errno == 0) {
-        if (kill(request.terminate, SIGTERM) == 0) {
+        if (kill(request.terminate, SIGHUP) == 0) {
-          debug("Terminating child %d (kill)", request.terminate);
+          debug("[server] Terminating child %d! [HUP]", request.terminate);
         } else {
-          debug("Terminating child %d failed [%s]", request.terminate,
+          debug("[server] Terminating child %d failed! [%s]", request.terminate,
                 strerror(errno));
         }
       }
@@ -1711,12 +1759,13 @@ static void launcherDaemon(int fd) {
   readURL:
     len                       = read(fd, url, request.urlLength + 1);
     if (len != request.urlLength + 1 && errno != EINTR) {
-      debug("Failed to read URL");
+      debug("[server] Failed to read URL!");
       free(url);
       break;
     }
     while (NOINTR(pid = waitpid(-1, &status, WNOHANG)) > 0) {
-      debug("Child %d exited with exit code %d", pid, WEXITSTATUS(status));
+      debug("[server] Child %d exited with exit code %d.", pid,
+            WEXITSTATUS(status));
       if (WIFEXITED(status) || WIFSIGNALED(status)) {
         char key[32];
         snprintf(&key[0], sizeof(key), "%d", pid);
@@ -1773,7 +1822,7 @@ static void launcherDaemon(int fd) {
           childProcesses      = newHashMap(destroyUtmpHashEntry, NULL);
         }
         addToHashMap(childProcesses, utmp->pid, (char *)utmp);
-        debug("Child %d launched", pid);
+        debug("[server] Child %d launched", pid);
       } else {
         int fds[2];
         if (!pipe(fds)) {
@@ -1827,9 +1876,9 @@ int forkLauncher(void) {
     lowerPrivileges();
     closeAllFds((int []){ pair[1], 2 }, 2);
     launcherDaemon(pair[1]);
-    fatal("exit() failed!");
+    fatal("[server] Launcher exit() failed!");
   case -1:
-    fatal("fork() failed!");
+    fatal("[server] Launcher fork() failed!");
   default:
     NOINTR(close(pair[1]));
     launcher = pair[0];

shellinabox/privileges.c

@@ -59,10 +59,11 @@
 #include "shellinabox/privileges.h"
 #include "logging/logging.h"
 
+#define UNUSED_RETURN(x) do { (void)((x)+1); } while (0)
+
 int   runAsUser  = -1;
 int   runAsGroup = -1;
 
-
 #ifndef HAVE_GETRESUID
 int getresuid(uid_t *ruid, uid_t *euid, uid_t *suid) {
   *ruid = getuid();
@@ -109,7 +110,7 @@ static void removeGroupPrivileges(int showError) {
     if ((ru && runAsGroup != (int)rg) ||
         setresgid(runAsGroup, runAsGroup, runAsGroup)) {
       if (showError) {
-        fatal("Only privileged users can change their group memberships");
+        fatal("[server] Only privileged users can change their group membership!");
       } else {
         _exit(1);
       }
@@ -136,12 +137,12 @@ void lowerPrivileges(void) {
 
   // Temporarily lower user privileges. If we used to have "root" privileges,
   // we can later still regain them.
-  setresuid(-1, -1, 0);
+  UNUSED_RETURN(setresuid(-1, -1, 0));
 
   if (runAsUser >= 0) {
     // Try to switch to the user-provided user id.
     if (r && runAsUser != (int)r) {
-      fatal("Only privileged users can change their user id");
+      fatal("[server] Only privileged users can change their user id!");
     }
     check(!setresuid(runAsUser, runAsUser, -1));
   } else {
@@ -168,7 +169,7 @@ void dropPrivileges(void) {
     // Try to switch to the user-provided user id.
     if ((r && runAsUser != (int)r) ||
         setresuid(runAsUser, runAsUser, runAsUser)) {
-      fatal("Only privileged users can change their user id.");
+      fatal("[server] Only privileged users can change their user id!");
     }
   } else {
     if (r) {
@@ -267,7 +268,7 @@ uid_t getUserId(const char *name) {
   #endif
   check(buf = malloc(len));
   if (getpwnam_r(name, &pwbuf, buf, len, &pw) || !pw) {
-    fatal("Cannot look up user id \"%s\"", name);
+    fatal("[server] Cannot look up user id \"%s\"!", name);
   }
   uid_t uid = pw->pw_uid;
   free(buf);
@@ -401,16 +402,16 @@ gid_t getGroupId(const char *name) {
           check(buf = realloc(buf, pw_len));
         }
         if (!getpwnam_r("nobody", &pwbuf, buf, pw_len, &pw) && pw) {
-          debug("Substituting \"nobody's\" primary group for \"nogroup\"");
+          debug("[server] Substituting \"nobody\"'s primary group for \"nogroup\"");
           gid_t gid = pw->pw_gid;
           free(buf);
           return gid;
         }
       }
     }
-    if(ret && errno == ERANGE) {
+    if (ret && errno == ERANGE) {
       if ((gr_len + gr_baselen) < gr_len || (gr_len + gr_baselen) > gr_max) {
-        fatal("Cannot look up group \"%s\": buffer limit reached", name);
+        fatal("[server] Cannot look up group \"%s\"! [buffer limit reached]", name);
         break;
       }
       // grow the buffer by 'gr_baselen' each time getgrnam_r fails
@@ -419,7 +420,7 @@ gid_t getGroupId(const char *name) {
       buf = temp;
       continue;
     }
-    fatal("Cannot look up group \"%s\"", name);
+    fatal("[server] Cannot look up group \"%s\"", name);
   }
   gid_t gid = gr->gr_gid;
   free(buf);

shellinabox/service.c

@@ -78,7 +78,7 @@ void initService(struct Service *service, const char *arg) {
   char *ptr;
   if ((ptr = strchr(arg, ':')) == NULL) {
   error:
-    fatal("Syntax error in service description \"%s\".", desc);
+    fatal("[config] Syntax error in service description \"%s\"!", desc);
   }
   service->id                               = -1;
   check(service->path                       = malloc(ptr - arg + 2));
@@ -95,8 +95,7 @@ void initService(struct Service *service, const char *arg) {
   // application definition.
   if (!strcmp(arg, "LOGIN")) {
     if (geteuid()) {
-      fatal("Must be \"root\" to invoke \"/bin/login\". Maybe, change "
+      fatal("[config] Must be \"root\" to invoke LOGIN service!");
-            "--service definitions?");
     }
     service->useLogin                       = 1;
     service->useHomeDir                     = 0;
@@ -122,18 +121,29 @@ void initService(struct Service *service, const char *arg) {
     service->group                          = NULL;
     check(service->cwd                      = strdup("/"));
     char *host;
+    char *sshPort;
     check(host                              = strdup("localhost"));
+    check(sshPort                           = strdup("22"));
+
     if ((ptr                                = strchr(arg, ':')) != NULL) {
-      check(ptr                             = strdup(ptr + 1));
+      ptr                                   = ptr + 1;
-      char *end;
-      if ((end                              = strchr(ptr, ':')) != NULL) {
-        *end                                = '\000';
-      }
       if (*ptr) {
+        char *tmp                           = strchr(ptr, ':');
+        if (tmp == NULL) {
+          // If the second ":" is not found, keep as host whatever is after first ":".
           free(host);
-        host                                = ptr;
+          check(host                        = strdup(ptr));
         } else {
-        free(ptr);
+          // If we find a second ":", keep as a host whatever is in between first ":"
+          // and second ":" and as sshPort whatever is after second ":".
+          int size                          = (tmp - ptr + 1);
+          free(host);
+          free(sshPort);
+          check(host                        = malloc(size));
+          memset(host, 0, size);
+          memcpy(host, ptr, size - 1);
+          check(sshPort                     = strdup(tmp + 1));
+        }
       }
     }
 
@@ -145,7 +155,16 @@ void initService(struct Service *service, const char *arg) {
             (ch >= 'A' && ch <= 'Z') ||
             (ch >= 'a' && ch <= 'z') ||
             ch == '-' || ch == '.')) {
-        fatal("Invalid hostname \"%s\" in service definition", host);
+        fatal("[config] Invalid hostname \"%s\" in service definition!", host);
+      }
+    }
+
+    // Don't allow manipulation of the SSH command line through "creative" use
+    // of the port.
+    for (char *h = sshPort; *h; h++) {
+      char ch                               = *h;
+      if (!(ch >= '0' && ch <= '9')) {
+        fatal("[config] Invalid port \"%s\" in service definition!", sshPort);
       }
     }
 
@@ -163,8 +182,9 @@ void initService(struct Service *service, const char *arg) {
 //          feature, we cannot be sure that it is available on the
 //          target server.  Removing it for the sake of Centos.
 //          "-oVisualHostKey=no"
-          " -oLogLevel=FATAL %%s@%s", host);
+          " -oLogLevel=FATAL -p%s %%s@%s",sshPort,  host);
     free(host);
+    free(sshPort);
   } else {
     service->useLogin                       = 0;
 
@@ -210,7 +230,7 @@ void initService(struct Service *service, const char *arg) {
       service->cwd                          = NULL;
     } else {
       if (*arg != '/') {
-        fatal("Working directories must have absolute paths");
+        fatal("[config] Working directories must have absolute paths!");
       }
       service->useHomeDir                   = 0;
       check(service->cwd                    = strdup(arg));

shellinabox/session.c

@@ -116,9 +116,11 @@ void initSession(struct Session *session, const char *sessionKey,
   session->http           = NULL;
   session->done           = 0;
   session->pty            = -1;
+  session->ptyFirstRead   = 1;
   session->width          = 0;
   session->height         = 0;
   session->buffered       = NULL;
+  session->useLogin       = 0;
   session->len            = 0;
   session->pid            = 0;
   session->cleanup        = 0;
@@ -224,7 +226,7 @@ struct Session *findSession(const char *sessionKey, const char *cgiSessionKey,
       *sessionIsNew      = 0;
     } else if (!cgiSessionKey && sessionKey && *sessionKey) {
       *sessionIsNew      = 0;
-      debug("Failed to find session: %s", sessionKey);
+      debug("[server] Failed to find session: %s", sessionKey);
     } else {
       // First contact. Create session, now.
       check(sessionKey   = cgiSessionKey ? strdup(cgiSessionKey)
@@ -232,7 +234,7 @@ struct Session *findSession(const char *sessionKey, const char *cgiSessionKey,
       session            = newSession(sessionKey, httpGetServer(http),
                                       httpGetPeerName(http));
       addToHashMap(sessions, sessionKey, (const char *)session);
-      debug("Creating a new session: %s", sessionKey);
+      debug("[server] Creating a new session: %s", sessionKey);
     }
   }
   return session;

shellinabox/session.h

@@ -58,9 +58,11 @@ struct Session {
   HttpConnection   *http;
   int              done;
   int              pty;
+  int              ptyFirstRead;
   int              width;
   int              height;
   char             *buffered;
+  int              useLogin;
   int              len;
   pid_t            pid;
   int              cleanup;

shellinabox/shell_in_a_box.jspp

@@ -406,6 +406,9 @@ ShellInABox.prototype.messageInit = function() {
     }
   }
 
+  // After message mechanisms are in place "ready" message is sent to parent
+  // window.
+  parent.postMessage(JSON.stringify({type : 'ready', data : ''}), '*');
 };
 
 ShellInABox.prototype.messageReceive = function (message) {
@@ -464,16 +467,17 @@ ShellInABox.prototype.messageReplay = function(type, data) {
 };
 
 ShellInABox.prototype.about = function() {
-  alert("Shell In A Box version " + VERSION +
+  alert("Shell In A Box " + VERSION +
-        "\nCopyright 2008-2010 by Markus Gutschke\n" +
+        "\n\n" +
-        "For more information check http://shellinabox.com" +
+        "Copyright 2008-2015 by Markus Gutschke. For more information visit\n" +
+        "http://shellinabox.com or http://github.com/shellinabox/." +
         (typeof serverSupportsSSL != 'undefined' && serverSupportsSSL ?
          "\n\n" +
-         "This product includes software developed by the OpenSSL Project\n" +
+         "This product includes software developed by the OpenSSL Project for\n" +
-         "for use in the OpenSSL Toolkit. (http://www.openssl.org/)\n" +
+         "use in the OpenSSL Toolkit. (http://www.openssl.org/)" +
-         "\n" +
+         "\n\n" +
-         "This product includes cryptographic software written by " +
+         "This product includes cryptographic software written by Eric Young\n" +
-         "Eric Young\n(eay@cryptsoft.com)" :
+         "(eay@cryptsoft.com)" :
          ""));
 };
 

shellinabox/shellinaboxd.c

@@ -63,7 +63,7 @@
 #include <sys/stat.h>
 #include <sys/socket.h>
 #include <sys/un.h>
-
+#include <time.h>
 #include <unistd.h>
 
 #ifdef HAVE_SYS_PRCTL_H
@@ -110,8 +110,11 @@ static int            portMax;
 static int            localhostOnly     = 0;
 static int            noBeep            = 0;
 static int            numericHosts      = 0;
+static int            peerCheckEnabled  = 1;
 static int            enableSSL         = 1;
 static int            enableSSLMenu     = 1;
+static int            forceSSL          = 1; // TODO enable http fallback with commandline option
+int                   enableUtmpLogging = 1;
 static char           *messagesOrigin   = NULL;
 static int            linkifyURLs       = 1;
 static char           *certificateDir;
@@ -280,7 +283,7 @@ static int completePendingRequest(struct Session *session,
 
 static void sessionDone(void *arg) {
   struct Session *session = (struct Session *)arg;
-  debug("Session %s done", session->sessionKey);
+  debug("[server] Session %s done.", session->sessionKey);
   if (session->cleanup) {
     terminateChild(session);
   }
@@ -289,6 +292,13 @@ static void sessionDone(void *arg) {
   completePendingRequest(session, "", 0, INT_MAX);
 }
 
+static void delaySession(void) {
+  struct timespec ts;
+  ts.tv_sec              = 0;
+  ts.tv_nsec             = 200 * 1000; // Delay for 0.2 ms
+  nanosleep(&ts, NULL);
+}
+
 static int handleSession(struct ServerConnection *connection, void *arg,
                          short *events, short revents) {
   struct Session *session       = (struct Session *)arg;
@@ -308,7 +318,7 @@ static int handleSession(struct ServerConnection *connection, void *arg,
   int timedOut                  = serverGetTimeout(connection) < 0;
   if (bytes || timedOut) {
     if (!session->http && timedOut) {
-      debug("Timeout. Closing session.");
+      debug("[server] Timeout. Closing session %s!", session->sessionKey);
       session->cleanup = 1;
       return 0;
     }
@@ -322,8 +332,26 @@ static int handleSession(struct ServerConnection *connection, void *arg,
       *events                   = 0;
     }
     serverSetTimeout(connection, AJAX_TIMEOUT);
+    session->ptyFirstRead       = 0;
     return 1;
   } else {
+    if (revents & POLLHUP) {
+      if (session->useLogin && session->ptyFirstRead) {
+        // Workaround for random "Session closed" issues related to /bin/login
+        // closing and reopening our pty during initialization. This happens only
+        // on some systems like Fedora for example.
+        // Here we allow that our pty is closed by ignoring POLLHUP on first read.
+        // Delay is also needed so that login process has some time to reopen pty.
+        // Note that the issue may occur anyway but with workaround we reduce the
+        // chances.
+        debug("[server] POLLHUP received on login PTY first read!");
+        session->ptyFirstRead   = 0;
+        delaySession();
+        return 1;
+      }
+      debug("[server] POLLHUP received on PTY! Closing session %s!",
+            session->sessionKey);
+    }
     return 0;
   }
 }
@@ -332,7 +360,7 @@ static int invalidatePendingHttpSession(void *arg, const char *key,
                                         char **value) {
   struct Session *session = *(struct Session **)value;
   if (session->http && session->http == (HttpConnection *)arg) {
-    debug("Clearing pending HTTP connection for session %s", key);
+    debug("[server] Clearing pending HTTP connection for session %s!", key);
     session->http         = NULL;
     serverDeleteConnection(session->server, session->pty);
 
@@ -366,8 +394,8 @@ static int dataHandler(HttpConnection *http, struct Service *service,
   }
 
   // Sanity check
-  if (!sessionIsNew && strcmp(session->peerName, httpGetPeerName(http))) {
+  if (!sessionIsNew && peerCheckEnabled && strcmp(session->peerName, httpGetPeerName(http))) {
-    error("Peername changed from %s to %s",
+    error("[server] Peername changed from %s to %s",
           session->peerName, httpGetPeerName(http));
     httpSendReply(http, 400, "Bad Request", NO_MSG);
     return HTTP_DONE;
@@ -400,6 +428,7 @@ static int dataHandler(HttpConnection *http, struct Service *service,
       goto bad_new_session;
     }
     session->http         = http;
+    session->useLogin     = service->useLogin;
     if (launchChild(service->id, session,
                     rootURL && *rootURL ? rootURL : urlGetURL(url)) < 0) {
       abandonSession(session);
@@ -418,7 +447,8 @@ static int dataHandler(HttpConnection *http, struct Service *service,
   // Reset window dimensions of the pseudo TTY, if changed since last time set.
   if (session->width > 0 && session->height > 0 &&
       (session->width != oldWidth || session->height != oldHeight)) {
-    debug("Window size changed to %dx%d", session->width, session->height);
+    debug("[server] Window size changed to %dx%d", session->width,
+          session->height);
     setWindowSize(session->pty, session->width, session->height);
   }
 
@@ -746,11 +776,11 @@ static int shellInABoxHttpHandler(HttpConnection *http, void *arg,
 static int strtoint(const char *s, int minVal, int maxVal) {
   char *ptr;
   if (!*s) {
-    fatal("Missing numeric value.");
+    fatal("[config] Missing numeric value!");
   }
   long l = strtol(s, &ptr, 10);
   if (*ptr || l < minVal || l > maxVal) {
-    fatal("Range error on numeric value \"%s\".", s);
+    fatal("[config] Range error on numeric value \"%s\"!", s);
   }
   return l;
 }
@@ -766,7 +796,7 @@ static void usage(void) {
   const char *user  = getUserName(r_uid);
   const char *group = getGroupName(r_gid);
 
-  message("Usage: shellinaboxd [OPTIONS]...\n"
+  printf("Usage: shellinaboxd [OPTIONS]...\n"
           "Starts an HTTP server that serves terminal emulators to AJAX "
           "enabled browsers.\n"
           "\n"
@@ -779,7 +809,7 @@ static void usage(void) {
           "  -f, --static-file=URL:FILE  serve static file from URL path\n"
           "  -g, --group=GID             switch to this group (default: %s)\n"
           "  -h, --help                  print this message\n"
-          "      --linkify=[none|normal|agressive] default is \"normal\"\n"
+          "      --linkify=[none|normal|aggressive] default is \"normal\"\n"
           "      --localhost-only        only listen on 127.0.0.1\n"
           "      --no-beep               suppress all audio output\n"
           "  -n, --numeric               do not resolve hostnames\n"
@@ -788,12 +818,14 @@ static void usage(void) {
           "  -p, --port=PORT             select a port (default: %d)\n"
           "  -s, --service=SERVICE       define one or more services\n"
           "%s"
+          "      --disable-utmp-logging  disable logging to utmp and wtmp\n"
           "  -q, --quiet                 turn off all messages\n"
           "      --unixdomain-only=PATH:USER:GROUP:CHMOD listen on unix socket\n"
           "  -u, --user=UID              switch to this user (default: %s)\n"
           "      --user-css=STYLES       defines user-selectable CSS options\n"
           "  -v, --verbose               enable logging messages\n"
           "      --version               prints version information\n"
+          "      --disable-peer-check    disable peer check on a session\n"
           "\n"
           "Debug, quiet, and verbose are mutually exclusive.\n"
           "\n"
@@ -832,7 +864,8 @@ static void usage(void) {
           "\n"
           "OPTIONs that make up a GROUP are mutually exclusive. But "
           "individual GROUPs are\n"
-          "independent of each other.\n",
+          "independent of each other.\n"
+          "\n",
           !serverSupportsSSL() ? "" :
           "  -c, --cert=CERTDIR          set certificate dir "
           "(default: $PWD)\n"
@@ -864,6 +897,7 @@ static void parseArgs(int argc, char * const argv[]) {
   int hasSSL               = serverSupportsSSL();
   if (!hasSSL) {
     enableSSL              = 0;
+    forceSSL               = 0;
   }
   int demonize             = 0;
   int cgi                  = 0;
@@ -895,12 +929,14 @@ static void parseArgs(int argc, char * const argv[]) {
       { "service",              1, 0, 's' },
       { "disable-ssl",          0, 0, 't' },
       { "disable-ssl-menu",     0, 0,  0  },
+      { "disable-utmp-logging", 0, 0,  0  },
       { "quiet",                0, 0, 'q' },
       { "unixdomain-only",      1, 0,  0, },
       { "user",                 1, 0, 'u' },
       { "user-css",             1, 0,  0  },
       { "verbose",              0, 0, 'v' },
       { "version",              0, 0,  0  },
+      { "disable-peer-check",   0, 0,  0  },
       { 0,                  0, 0,  0  } };
     int idx                = -1;
     int c                  = getopt_long(argc, argv, optstring, options, &idx);
@@ -916,19 +952,20 @@ static void parseArgs(int argc, char * const argv[]) {
     }
     if (idx-- <= 0) {
       // Help (or invalid argument)
-      usage();
       if (idx < -1) {
-        fatal("Failed to parse command line");
+        fatal("[server] Failed to parse command line!");
+      } else {
+        usage();
       }
       exit(0);
     } else if (!idx--) {
       // Background
       if (cgi) {
-        fatal("CGI and background operations are mutually exclusive");
+        fatal("[config] CGI and background operations are mutually exclusive!");
       }
       demonize            = 1;
       if (optarg && pidfile) {
-        fatal("Only one pidfile can be given");
+        fatal("[config] Only one pidfile can be given!");
       }
       if (optarg && *optarg) {
         check(pidfile     = strdup(optarg));
@@ -936,55 +973,55 @@ static void parseArgs(int argc, char * const argv[]) {
     } else if (!idx--) {
       // Certificate
       if (!hasSSL) {
-        warn("Ignoring certificate directory, as SSL support is unavailable");
+        warn("[config] Ignoring certificate directory, as SSL support is unavailable.");
       }
       if (certificateFd >= 0) {
-        fatal("Cannot set both a certificate directory and file handle");
+        fatal("[config] Cannot set both a certificate directory and file handle!");
       }
       if (certificateDir) {
-        fatal("Only one certificate directory can be selected");
+        fatal("[config] Only one certificate directory can be selected!");
       }
       struct stat st;
       if (!optarg || !*optarg || stat(optarg, &st) || !S_ISDIR(st.st_mode)) {
-        fatal("\"--cert\" expects a directory name");
+        fatal("[config] Option --cert expects a directory name!");
       }
       check(certificateDir = strdup(optarg));
     } else if (!idx--) {
       // Certificate file descriptor
       if (!hasSSL) {
-        warn("Ignoring certificate directory, as SSL support is unavailable");
+        warn("[config] Ignoring certificate directory, as SSL support is unavailable.");
       }
       if (certificateDir) {
-        fatal("Cannot set both a certificate directory and file handle");
+        fatal("[config] Cannot set both a certificate directory and file handle!");
       }
       if (certificateFd >= 0) {
-        fatal("Only one certificate file handle can be provided");
+        fatal("[config] Only one certificate file handle can be provided!");
       }
       if (!optarg || *optarg < '0' || *optarg > '9') {
-        fatal("Option \"--cert-fd\" expects a valid file handle.");
+        fatal("[config] Option --cert-fd expects a valid file handle.");
       }
       int tmpFd            = strtoint(optarg, 3, INT_MAX);
       certificateFd        = dup(tmpFd);
       if (certificateFd < 0) {
-        fatal("Invalid certificate file handle");
+        fatal("[config] Invalid certificate file handle!");
       }
       check(!NOINTR(close(tmpFd)));
     } else if (!idx--) {
       // CSS
       struct stat st;
       if (!optarg || !*optarg || stat(optarg, &st) || !S_ISREG(st.st_mode)) {
-        fatal("Option \"--css\" expects a file name.");
+        fatal("[config] Option --css expects a file name!");
       }
       FILE *css            = fopen(optarg, "r");
       if (!css) {
-        fatal("Cannot read style sheet \"%s\"", optarg);
+        fatal("[config] Cannot read style sheet \"%s\"!", optarg);
       } else {
         check(cssStyleSheet= realloc(cssStyleSheet, strlen(cssStyleSheet) +
                                      st.st_size + 2));
         char *newData      = strrchr(cssStyleSheet, '\000');
         *newData++         = '\n';
         if (fread(newData, st.st_size, 1, css) != 1) {
-          fatal("Failed to read style sheet \"%s\"", optarg);
+          fatal("[config] Failed to read style sheet \"%s\"!", optarg);
         }
         newData[st.st_size]= '\000';
         fclose(css);
@@ -992,19 +1029,19 @@ static void parseArgs(int argc, char * const argv[]) {
     } else if (!idx--) {
       // CGI
       if (demonize) {
-        fatal("CGI and background operations are mutually exclusive");
+        fatal("[config] CGI and background operations are mutually exclusive!");
       }
       if (pidfile) {
-        fatal("CGI operation and --pidfile= are mutually exclusive");
+        fatal("[config] CGI operation and --pidfile are mutually exclusive!");
       }
       if (port) {
-        fatal("Cannot specify a port for CGI operation");
+        fatal("[config] Cannot specify a port for CGI operation!");
       }
       cgi                  = 1;
       if (optarg && *optarg) {
         char *ptr          = strchr(optarg, '-');
         if (!ptr) {
-          fatal("Syntax error in port range specification");
+          fatal("[config] Syntax error in port range specification!");
         }
         *ptr               = '\000';
         portMin            = strtoint(optarg, 1, 65535);
@@ -1014,40 +1051,41 @@ static void parseArgs(int argc, char * const argv[]) {
     } else if (!idx--) {
       // Debug
       if (!logIsDefault() && !logIsDebug()) {
-        fatal("--debug is mutually exclusive with --quiet and --verbose.");
+        fatal("[config] Option --debug is mutually exclusive with --quiet and --verbose!");
       }
       verbosity            = MSG_DEBUG;
       logSetLogLevel(verbosity);
     } else if (!idx--) {
       // Static file
       if (!optarg || !*optarg) {
-	    fatal("Option \"--static-file\" expects an argument.");
+	    fatal("[config] Option --static-file expects an argument!");
       }
       char *ptr, *path, *file;
       if ((ptr             = strchr(optarg, ':')) == NULL) {
-        fatal("Syntax error in static-file definition \"%s\".", optarg);
+        fatal("[config] Syntax error in static-file definition \"%s\"!",
+              optarg);
       }
       check(path           = malloc(ptr - optarg + 1));
       memcpy(path, optarg, ptr - optarg);
       path[ptr - optarg]   = '\000';
       check(file           = strdup(ptr + 1));
       if (getRefFromHashMap(externalFiles, path)) {
-        fatal("Duplicate static-file definition for \"%s\".", path);
+        fatal("[config] Duplicate static-file definition for \"%s\"!", path);
       }
       addToHashMap(externalFiles, path, file);
     } else if (!idx--) {
       // Group
       if (runAsGroup >= 0) {
-        fatal("Duplicate --group option.");
+        fatal("[config] Duplicate --group option.");
       }
       if (!optarg || !*optarg) {
-        fatal("Option \"--group\" expects a group name.");
+        fatal("[config] Option --group expects a group name.");
       }
       runAsGroup           = parseGroupArg(optarg, NULL);
     } else if (!idx--) {
       // Linkify
       if (!optarg || !*optarg) {
-        fatal("Option \"--linkify\" expects an argument.");
+        fatal("[config] Option --linkify expects an argument.");
       }
       if (!strcmp(optarg, "none")) {
         linkifyURLs        = 0;
@@ -1056,8 +1094,8 @@ static void parseArgs(int argc, char * const argv[]) {
       } else if (!strcmp(optarg, "aggressive")) {
         linkifyURLs        = 2;
       } else {
-        fatal("Invalid argument for --linkify. Must be "
+        fatal("[config] Invalid argument for --linkify. Must be \"none\", \"normal\", "
-              "\"none\", \"normal\", or \"aggressive\".");
+              "or \"aggressive\".");
       }
     } else if (!idx--) {
       // Localhost Only
@@ -1071,71 +1109,74 @@ static void parseArgs(int argc, char * const argv[]) {
     } else if (!idx--) {
       // Messages origin
       if (messagesOrigin) {
-        fatal("Duplicated \"--messages-origin\" option.");
+        fatal("[config] Duplicated --messages-origin option.");
       }
       if (!optarg || !*optarg) {
-        fatal("Option \"--messages-origin\" expects an argument.");
+        fatal("[config] Option --messages-origin expects an argument.");
       }
       check(messagesOrigin = strdup(optarg));
     } else if (!idx--) {
       // Pidfile
       if (cgi) {
-        fatal("CGI operation and --pidfile= are mutually exclusive");
+        fatal("[config] CGI operation and --pidfile are mutually exclusive");
       }
       if (!optarg || !*optarg) {
-        fatal("Must specify a filename for --pidfile= option");
+        fatal("[config] Must specify a filename for --pidfile option");
       }
       if (pidfile) {
-        fatal("Only one pidfile can be given");
+        fatal("[config] Only one pidfile can be given");
       }
       check(pidfile        = strdup(optarg));
     } else if (!idx--) {
       // Port
       if (port) {
-        fatal("Duplicate --port option");
+        fatal("[config] Duplicate --port option!");
       }
       if (cgi) {
-        fatal("Cannot specifiy a port for CGI operation");
+        fatal("[config] Cannot specifiy a port for CGI operation");
       }
       if (!optarg || *optarg < '0' || *optarg > '9') {
-        fatal("Option \"--port\" expects a port number.");
+        fatal("[config] Option --port expects a port number.");
       }
       port = strtoint(optarg, 1, 65535);
     } else if (!idx--) {
       // Service
       if (!optarg || !*optarg) {
-        fatal("Option \"--service\" expects an argument.");
+        fatal("[config] Option \"--service\" expects an argument.");
       }
       struct Service *service;
       service              = newService(optarg);
       if (getRefFromHashMap(serviceTable, service->path)) {
-        fatal("Duplicate service description for \"%s\".", service->path);
+        fatal("[config] Duplicate service description for \"%s\".", service->path);
       }
       addToHashMap(serviceTable, service->path, (char *)service);
     } else if (!idx--) {
       // Disable SSL
       if (!hasSSL) {
-        warn("Ignoring disable-ssl option, as SSL support is unavailable");
+        warn("[config] Ignoring disable-ssl option, as SSL support is unavailable.");
       }
       enableSSL            = 0;
+      forceSSL             = 0;
     } else if (!idx--) {
       // Disable SSL Menu
       if (!hasSSL) {
-        warn("Ignoring disable-ssl-menu option, as SSL support is "
+        warn("[config] Ignoring disable-ssl-menu option, as SSL support is unavailable.");
-             "unavailable");
       }
       enableSSLMenu        = 0;
+    } else if (!idx--) {
+      // Disable UTMP logging
+      enableUtmpLogging    = 0;
     } else if (!idx--) {
       // Quiet
       if (!logIsDefault() && !logIsQuiet()) {
-        fatal("--quiet is mutually exclusive with --debug and --verbose.");
+         fatal("[config] Option --quiet is mutually exclusive with --debug and --verbose!");
       }
       verbosity            = MSG_QUIET;
       logSetLogLevel(verbosity);
     } else if (!idx--) {
       // Unix domain only
       if (!optarg || !*optarg) {
-        fatal("Option \"--unixdomain-only\" expects an argument.");
+        fatal("[config] Option --unixdomain-only expects an argument!");
       }
       char *ptr, *s, *tmp;
 
@@ -1143,7 +1184,8 @@ static void parseArgs(int argc, char * const argv[]) {
       s                    = optarg;
       ptr                  = strchr(s, ':');
       if (ptr == NULL || ptr == s || ptr - s >= UNIX_PATH_MAX) {
-        fatal("Syntax error in unixdomain-only path definition \"%s\".", optarg);
+        fatal("[config] Syntax error in unixdomain-only path definition \"%s\".",
+		      optarg);
       }
       check(unixDomainPath = strndup(s, ptr - s));
 
@@ -1151,7 +1193,8 @@ static void parseArgs(int argc, char * const argv[]) {
       s                    = ptr + 1;
       ptr                  = strchr(s, ':');
       if (ptr == NULL || ptr == s) {
-        fatal("Syntax error in unixdomain-only user definition \"%s\".", optarg);
+        fatal("[config] Syntax error in unixdomain-only user definition \"%s\".",
+              optarg);
       }
       check(tmp            = strndup(s, ptr - s));
       unixDomainUser       = parseUserArg(tmp, NULL);
@@ -1161,7 +1204,8 @@ static void parseArgs(int argc, char * const argv[]) {
       s                    = ptr + 1;
       ptr                  = strchr(s, ':');
       if (ptr == NULL || ptr == s) {
-        fatal("Syntax error in unixdomain-only group definition \"%s\".", optarg);
+        fatal("[config] Syntax error in unixdomain-only group definition \"%s\".",
+		      optarg);
       }
       check(tmp            = strndup(s, ptr - s));
       unixDomainGroup      = parseGroupArg(tmp, NULL);
@@ -1170,48 +1214,54 @@ static void parseArgs(int argc, char * const argv[]) {
       // Unix domain chmod
       s                    = ptr + 1;
       if (strlen(ptr) == 1) {
-        fatal("Syntax error in unixdomain-only chmod definition \"%s\".", optarg);
+        fatal("[config] Syntax error in unixdomain-only chmod definition \"%s\".",
+              optarg);
       }
       unixDomainChmod      = strtol(s, NULL, 8);
 
     } else if (!idx--) {
       // User
       if (runAsUser >= 0) {
-        fatal("Duplicate --user option.");
+        fatal("[config] Duplicate --user option.");
       }
       if (!optarg || !*optarg) {
-        fatal("Option \"--user\" expects a user name.");
+        fatal("[config] Option --user expects a user name.");
       }
       runAsUser            = parseUserArg(optarg, NULL);
     } else if (!idx--) {
       // User CSS
       if (!optarg || !*optarg) {
-        fatal("Option \"--user-css\" expects a list of styles sheets and labels");
+        fatal("[config] Option --user-css expects a list of styles sheets "
+              "and labels!");
       }
       parseUserCSS(&userCSSList, optarg);
     } else if (!idx--) {
       // Verbose
       if (!logIsDefault() && (!logIsInfo() || logIsDebug())) {
-        fatal("--verbose is mutually exclusive with --debug and --quiet");
+         fatal("[config] Option --verbose is mutually exclusive with --debug and --quiet!");
       }
       verbosity            = MSG_INFO;
       logSetLogLevel(verbosity);
     } else if (!idx--) {
       // Version
-      message("ShellInABox version " VERSION VCS_REVISION);
+      printf("ShellInABox version " VERSION VCS_REVISION "\n");
       exit(0);
+    } else if (!idx--) {
+      // disable-peer-check
+      peerCheckEnabled = 0;
     }
   }
   if (optind != argc) {
-    usage();
+    fatal("[config] Failed to parse command line!");
-    fatal("Failed to parse command line");
   }
   char *buf                = NULL;
   check(argc >= 1);
+
+  info("[server] Version " VERSION VCS_REVISION);
   for (int i = 0; i < argc; i++) {
-    buf                    = stringPrintf(buf, " %s", argv[i]);
+    buf                    = stringPrintf(buf, "%s ", argv[i]);
   }
-  info("Command line:%s", buf);
+  info("[server] Command line: %s", buf);
   free(buf);
 
   // If the user did not specify a port, use the default one
@@ -1237,7 +1287,7 @@ static void parseArgs(int argc, char * const argv[]) {
   if (cgi) {
     for (int i = 0; i < numServices; i++) {
       if (strcmp(services[i]->path, "/")) {
-        fatal("Non-root service URLs are incompatible with CGI operation");
+        fatal("[config] Non-root service URLs are incompatible with CGI operation");
       }
     }
     check(cgiSessionKey    = newSessionKey());
@@ -1287,7 +1337,8 @@ static void removeLimits() {
 }
 
 static void setUpSSL(Server *server) {
-  serverEnableSSL(server, enableSSL);
+
+  serverSetupSSL(server, enableSSL, forceSSL);
 
   // Enable SSL support (if available)
   if (enableSSL) {
@@ -1297,7 +1348,7 @@ static void setUpSSL(Server *server) {
     } else if (certificateDir) {
       char *tmp;
       if (strchr(certificateDir, '%')) {
-        fatal("Invalid certificate directory name \"%s\".", certificateDir);
+        fatal("[ssl] Invalid certificate directory name \"%s\".", certificateDir);
       }
       check(tmp = stringPrintf(NULL, "%s/certificate%%s.pem", certificateDir));
       serverSetCertificate(server, tmp, 1);
@@ -1359,8 +1410,9 @@ int main(int argc, char * const argv[]) {
     check(port    = serverGetListeningPort(server));
     printf("X-ShellInABox-Port: %d\r\n"
            "X-ShellInABox-Pid: %d\r\n"
+           "X-ShellInABox-Session: %s\r\n"
            "Content-type: text/html; charset=utf-8\r\n\r\n",
-           port, getpid());
+           port, getpid(), cgiSessionKey);
     UNUSED(cgiRootSize);
     printfUnchecked(cgiRootStart, port, cgiSessionKey);
     fflush(stdout);
@@ -1433,6 +1485,6 @@ int main(int argc, char * const argv[]) {
     }
     free((char *)pidfile);
   }
-  info("Done");
+  info("[server] Done");
   _exit(0);
 }

shellinabox/shellinaboxd.man.in

@@ -282,7 +282,7 @@ Display a brief usage message showing the valid command line parameters.
 .TP
 \fB--linkify\fP=[\fBnone\fP|\fBnormal\fP|\fBaggressive\fP]
 the daemon attempts to recognize URLs in the terminal output and makes them
-clickable. This is not neccessarily a fool-proof process and both false
+clickable. This is not necessarily a fool-proof process and both false
 negatives and false positives are possible. By default, only URLs starting
 with a well known protocol of
 .BR http:// ,\  https:// ,\  ftp:// ,\ or\  mailto:

shellinabox/styles.css

@@ -243,6 +243,12 @@
 [else DEFINES_COLORS]
 /* SYSTEM colors */
 #vt100 .ansiDef   { color:            #000000; }
+#vt100 .ansiDefR  { color:            #ffffff; }
+
+#vt100 #scrollable.inverted .ansiDef
+                  { color:            #ffffff; }
+#vt100 #scrollable.inverted .ansiDefR
+                  { color:            #000000; }
 
 #vt100 .ansi0     { color:            #000000; }
 #vt100 .ansi1     { color:            #cd0000; }
@@ -505,6 +511,13 @@
 
 /* SYSTEM colors */
 #vt100 .bgAnsiDef { background-color: #ffffff; }
+#vt100 .bgAnsiDefR
+                  { background-color: #000000; }
+
+#vt100 #scrollable.inverted .bgAnsiDef
+                  { background-color: #000000; }
+#vt100 #scrollable.inverted .bgAnsiDefR
+                  { background-color: #ffffff; }
 
 #vt100 .bgAnsi0   { background-color: #000000; }
 #vt100 .bgAnsi1   { background-color: #cd0000; }

shellinabox/usercss.c

@@ -80,7 +80,7 @@ static void readStylesheet(struct UserCSS *userCSS, const char *filename,
   int fd                  = open(filename, O_RDONLY);
   struct stat st;
   if (fd < 0 || fstat(fd, &st)) {
-    fatal("Cannot access style sheet \"%s\"", filename);
+    fatal("[config] Cannot access style sheet \"%s\"!", filename);
   }
   FILE *fp;
   check(fp                = fdopen(fd, "r"));
@@ -114,7 +114,7 @@ void initUserCSS(struct UserCSS *userCSS, const char *arg) {
   for (;;) {
     const char *colon                     = strchr(arg, ':');
     if (!colon) {
-      fatal("Incomplete user CSS definition: \"%s\"", arg);
+      fatal("[config] Incomplete user CSS definition: \"%s\"!", arg);
     }
 
     check(userCSS->label                  = malloc(6*(colon - arg) + 1));
@@ -153,15 +153,14 @@ void initUserCSS(struct UserCSS *userCSS, const char *arg) {
         break;
       case '+':
         if (hasActiveMember) {
-          fatal("There can only be one active style option per group. Maybe "
+          fatal("[config] Only one default active style allowed per group!");
-                "use ';' instead of ',' to start a new group.");
         }
         hasActiveMember                   = 1;
         userCSS->isActivated              = 1;
         break;
       default:
-        fatal("Must indicate with '+' or '-' whether the style option is "
+        fatal("[config] Must indicate with '+' or '-' whether the style option "
-              "active by default");
+              "is active by default!");
     }
 
     readStylesheet(userCSS, filename + 1, (char **)&userCSS->style,
@@ -188,9 +187,7 @@ void initUserCSS(struct UserCSS *userCSS, const char *arg) {
     }
   }
   if (!hasActiveMember && numMembers > 1) {
-    fatal("Each group of style options must have exactly one style that is "
+    fatal("[config] Only one default active style allowed per group!");
-          "active by\n"
-          "default.");
   }
 }
 

shellinabox/vt100.jspp

@@ -83,6 +83,7 @@
 #define EStitle        17
 #define ESss2          18
 #define ESss3          19
+#define ESVTEtitle     20
 
 #define ATTR_DEFAULT   0x60F0
 #define ATTR_REVERSE   0x0100
@@ -297,6 +298,12 @@ VT100.prototype.getUserSettings = function() {
     this.disableAlt         = true;
   }
 
+  // Enable soft keyboard icon on some clients by default.
+  if (navigator.userAgent.match(/iPad|iPhone|iPod/i) != null ||
+      navigator.userAgent.match(/PlayStation Vita|Kindle/i) != null) {
+    this.softKeyboard       = true;
+  }
+
   if (this.visualBell) {
     this.signature          = Math.floor(16807*this.signature + 1) %
                                          ((1 << 31) - 1);
@@ -1198,8 +1205,8 @@ VT100.prototype.resizer = function() {
                                      document.documentElement.clientHeight ||
                                      document.body.clientHeight))-1;
 
-  // Prevent ever growing consoles on iPad.
+  // Prevent ever growing console on some iOS clients.
-  if (navigator.userAgent.match(/iPad/i) != null) {
+  if (navigator.userAgent.match(/iPad|iPhone|iPod/i) != null) {
     height                    -= 1;
   }
 
@@ -1429,6 +1436,25 @@ VT100.prototype.mouseEvent = function(event, type) {
     return this.cancelEvent(event);
   }
 
+  // Simulate middle click pasting from inside of current window. Note that
+  // pasting content from other programs will not work in this way, since we
+  // don't have access to native clipboard.
+  if ((event.which || event.button) == 2 && selection.length) {
+    if (type == MOUSE_UP) {
+      // Use timeout to prevent double paste on Chrome/Linux.
+      setTimeout(function (vt100) {
+        return function() {
+          vt100.keysPressed(selection);
+          vt100.input.focus();
+        }
+      }(this), 10);
+    }
+    if (type == MOUSE_DOWN) {
+      // Prevent middle click scroll on Windows systems.
+      return this.cancelEvent(event);
+    }
+  }
+
   if (this.mouseReporting) {
     try {
       event.shiftKey         = false;
@@ -1578,6 +1604,9 @@ VT100.prototype.updateWidth = function() {
       this.terminalWidth = Math.floor(this.console[this.currentScreen].offsetWidth/this.cursorWidth*this.scale);
     }
   } else {
+    if ("ActiveXObject" in window)
+      this.terminalWidth = Math.floor(this.console[this.currentScreen].offsetWidth/this.cursorWidth*this.scale*0.95);
+    else
       this.terminalWidth = Math.floor(this.console[this.currentScreen].offsetWidth/this.cursorWidth*this.scale);
   }
 
@@ -2815,7 +2844,7 @@ VT100.prototype.handleKey = function(event) {
       ch                              = part1                                 +
                                        ((event.shiftKey             ? 1 : 0)  +
                                         (event.altKey|event.metaKey ? 2 : 0)  +
-                                        (event.ctrlKey              ? 4 : 0)) +
+                                        (event.ctrlKey              ? 4 : 0) + 1) +
                                         part2;
     } else if (ch.length == 1 && (event.altKey || event.metaKey)
                && !this.disableAlt) {
@@ -2885,9 +2914,9 @@ VT100.prototype.fixEvent = function(event) {
   // Some browsers fail to translate keys, if both shift and alt/meta is
   // pressed at the same time. We try to translate those cases, but that
   // only works for US keyboard layouts.
-  if (event.shiftKey) {
   var u                   = undefined;
   var s                   = undefined;
+  if (event.shiftKey) {
     switch (this.lastNormalKeyDownEvent.keyCode) {
     case  39: /* ' -> " */ u = 39; s =  34; break;
     case  44: /* , -> < */ u = 44; s =  60; break;
@@ -2928,6 +2957,13 @@ VT100.prototype.fixEvent = function(event) {
     case 222: /* ' -> " */ u = 39; s =  34; break;
     default:                                break;
     }
+  } else {
+    var c = this.lastNormalKeyDownEvent.keyCode;
+    if (c >= 65 && c <= 90) {
+      u = c;
+      s = u | 32;
+    }
+  }
   if (s && (event.charCode == u || event.charCode == 0)) {
     var fake              = [ ];
     fake.charCode         = s;
@@ -2938,7 +2974,6 @@ VT100.prototype.fixEvent = function(event) {
     fake.metaKey          = event.metaKey;
     return fake;
   }
-  }
   return event;
 };
 
@@ -3023,10 +3058,8 @@ VT100.prototype.keyDown = function(event) {
     } else {
       fake.charCode             = 0;
       fake.keyCode              = event.keyCode;
-      if (!alphNumKey && event.shiftKey) {
+    }
     fake                        = this.fixEvent(fake);
-      }
-    }
 
     this.handleKey(fake);
     this.lastNormalKeyDownEvent = undefined;
@@ -3141,9 +3174,9 @@ VT100.prototype.keyUp = function(event) {
       } else {
         fake.charCode             = 0;
         fake.keyCode              = event.keyCode;
-        if (!alphNumKey && (event.ctrlKey || event.altKey || event.metaKey)) {
-          fake                    = this.fixEvent(fake);
       }
+      if (event.ctrlKey || event.altKey || event.metaKey) {
+        fake                      = this.fixEvent(fake);
       }
       this.lastNormalKeyDownEvent = undefined;
       this.handleKey(fake);
@@ -3351,41 +3384,47 @@ VT100.prototype.respondSecondaryDA = function() {
 
 
 VT100.prototype.updateStyle = function() {
+  var fg          = '';
+  var bg          = '';
   this.style      = '';
+
   if (this.attr & ATTR_UNDERLINE) {
-    this.style = 'text-decoration: underline;';
+    this.style   += 'text-decoration: underline;';
-  }
-  var bg       = (this.attr >> 4) & 0xF;
-  var fg       =  this.attr       & 0xF;
-  if (this.attr & ATTR_REVERSE) {
-    var tmp    = bg;
-    bg         = fg;
-    fg         = tmp;
-  }
-  if ((this.attr & (ATTR_REVERSE | ATTR_DIM)) == ATTR_DIM) {
-    fg         = 8; // Dark grey
-  } else if (this.attr & ATTR_BRIGHT) {
-    fg        |= 8;
-    this.style = 'font-weight: bold;';
   }
   if (this.attr & ATTR_BLINK) {
-    this.style = 'text-decoration: blink;';
+    this.style   += 'text-decoration: blink;';
   }
 
-  // Default colors
+  // Forground color
-  if (this.attr & ATTR_DEF_FG) {
-    fg         = 'Def';
-  }
-  if (this.attr & ATTR_DEF_BG) {
-    bg         = 'Def';
-  }
-
-  // Extended color mode support (256 colors).
   if (this.attrFg) {
-    fg         = this.attrFg;
+    // 256 color mode
+    fg            = this.attrFg
+  } else if (this.attr & ATTR_DEF_FG) {
+    fg            = 'Def';
+  } else {
+    fg            = this.attr & 0xF;
+    if (this.attr & ATTR_BRIGHT) {
+      fg         |= 8;
+      this.style += 'font-weight: bold;';
     }
+  }
+
+  // Background color
   if (this.attrBg) {
-    bg         = this.attrBg;
+    // 256 color mode
+    bg            = this.attrBg
+  } else if (this.attr & ATTR_DEF_BG) {
+    bg            = 'Def';
+  } else {
+    bg            = (this.attr >> 4) & 0xF;
+  }
+
+  // Reverse colors
+  if (this.attr & ATTR_REVERSE) {
+    var tmpFg     = fg;
+    var tmpBg     = bg;
+    fg            = (tmpBg == 'Def') ? 'DefR' : tmpBg;
+    bg            = (tmpFg == 'Def') ? 'DefR' : tmpFg;
   }
 
   this.color      = 'ansi' + fg + ' bgAnsi' + bg;
@@ -3869,7 +3908,7 @@ VT100.prototype.csim = function() {
     case 27: this.attr &= ~ ATTR_REVERSE;                              break;
     case 38:
       if (this.npar >= (i+2) && this.par[i+1] == 5) {
-        // Foreground color for extended color mode (256 colors). Escape code is formated
+        // Foreground color for extended color mode (256 colors). Escape code is formatted
         // as: ESC 38; 5; 0-255. Last parameter is color code in range [0-255]. This is
         // not VT100 standard.
         this.attrFg     = (this.par[i+2] >= 0 && this.par[i+2] <= 255) ? this.par[i+2] : false;
@@ -3885,7 +3924,7 @@ VT100.prototype.csim = function() {
       break;
     case 48:
       if (this.npar >= (i+2) && this.par[i+1] == 5) {
-        // Background color for extended color mode (256 colors). Escape code is formated
+        // Background color for extended color mode (256 colors). Escape code is formatted
         // as: ESC 48; 5; 0-255. Last parameter is color code in range [0-255]. This is
         // not VT100 standard.
         this.attrBg     = (this.par[i+2] >= 0 && this.par[i+2] <= 255) ? this.par[i+2] : false;
@@ -4015,6 +4054,8 @@ VT100.prototype.doControl = function(ch) {
 /*0*/ case 0x30:
 /*1*/ case 0x31:
 /*2*/ case 0x32: this.isEsc   = EStitle; this.titleString = '';         break;
+/*6*/ case 0x36: this.isEsc   = ESVTEtitle;                             break;
+/*7*/ case 0x37: this.isEsc   = ESVTEtitle;                             break;
 /*P*/ case 0x50: this.npar    = 0; this.par = [ 0, 0, 0, 0, 0, 0, 0 ];
                  this.isEsc   = ESpalette;                              break;
 /*R*/ case 0x52: // Palette support is not implemented
@@ -4242,6 +4283,13 @@ VT100.prototype.doControl = function(ch) {
       this.lastCharacter      = String.fromCharCode(ch);
       lineBuf                += this.lastCharacter;
       this.isEsc              = ESnormal;                               break;
+    case ESVTEtitle:
+      // Ignores VTE escape sequences for current directory (OSC6) and current
+      // file (OSC7).
+      if (ch == 0x07 || ch == 0x5C) {
+        this.isEsc            = ESnormal;
+      }
+      break;
     default:
       this.isEsc              = ESnormal;                               break;
     }

shellinabox/white-on-black.css

@@ -24,14 +24,30 @@
   color:            #ffffff;
 }
 
+#vt100 .ansiDefR {
+  color:            #000000;
+}
+
 #vt100 .bgAnsiDef {
   background-color: #000000;
 }
 
+#vt100 .bgAnsiDefR {
+  background-color: #ffffff;
+}
+
 #vt100 #scrollable.inverted .ansiDef {
   color:            #000000;
 }
 
+#vt100 #scrollable.inverted .ansiDefR {
+  color:            #ffffff;
+}
+
 #vt100 #scrollable.inverted .bgAnsiDef {
   background-color: #ffffff;
 }
+
+#vt100 #scrollable.inverted .bgAnsiDefR {
+  background-color: #000000;
+}

shellinabox_sshwrapper.sh

@@ -0,0 +1,32 @@
+#!/bin/bash
+#
+set -ex
+# 
+read -p "SSH remote host (hostname or ip address) [localhost] : " host;
+[[ -z "${host}" ]] && host=localhost;
+#
+read -p "If a puplic_key authentification?: [y/N] : " puplic;
+#
+read -p "SSH remote port [22] : " port;
+[[ -z "${port}" ]] && port=22;
+#
+read -p "SSH remote username [pi] : " username;
+[[ -z "${username}" ]] && username=pi;
+#
+if [ "$puplic" == "y" ];
+  then
+    read -p "How is your public_key?: " key;
+    echo $key > ~/.ssh/id_rsa.pub;
+
+    rm ~/.ssh/id_rsa;
+    echo "Enter your private id here and press the enter key for a new line !!!";
+    id=null
+    while [ "$id" != "" ];
+      do
+      read -p "How is your id_rsa key?: " id;
+      echo $id >> ~/.ssh/id_rsa;
+    done
+    exec ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -p $port $username@$host;
+  else
+    exec ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -p $port $username@$host;
+fi