Improved ncrypt/TLS error breporting

* add hostname/DNS resolve for nDPId/nDPIsrvd/examples
 * remove hardcoded collector path in nDPId systemd unit

Signed-off-by: Toni Uhlig <matzeton@googlemail.com>

dependencies/nDPIsrvd.h

@@ -2,9 +2,9 @@
 #define NDPISRVD_H 1
 
 #include <arpa/inet.h>
-#include <ctype.h>
 #include <errno.h>
 #include <fcntl.h>
+#include <netdb.h>
 #include <netinet/in.h>
 #include <stdarg.h>
 #include <stdint.h>
@@ -14,6 +14,7 @@
 #include <sys/socket.h>
 #include <sys/time.h>
 #include <sys/un.h>
+#include <time.h>
 #include <unistd.h>
 
 #ifndef JSMN_PARENT_LINKS
@@ -653,6 +654,59 @@ static inline void nDPIsrvd_socket_free(struct nDPIsrvd_socket ** const sock)
     *sock = NULL;
 }
 
+static inline int nDPIsrvd_resolve_host(struct nDPIsrvd_address * const address,
+                                        char const * const host, in_port_t const port)
+{
+    struct addrinfo hints;
+    struct addrinfo *result;
+    struct addrinfo *rp;
+
+    memset(&hints, 0, sizeof(hints));
+    hints.ai_family = AF_UNSPEC;
+    hints.ai_socktype = SOCK_STREAM;
+
+    int ret = getaddrinfo(host, NULL, &hints, &result);
+    if (ret != 0) {
+        //printf("GAI Error: %s (`%s')\n", gai_strerror(ret), host);
+        return 1;
+    }
+
+    static const size_t max_results = 8;
+    size_t result_count = 0;
+    struct {
+        socklen_t size;
+        struct sockaddr address;
+    } result_addrs[max_results];
+    for (rp = result; rp != NULL; rp = rp->ai_next) {
+        if (result_count >= max_results)
+            break;
+
+        if (rp->ai_family != AF_INET &&
+            rp->ai_family != AF_INET6)
+        {
+            continue;
+        }
+
+        result_addrs[result_count].address = *rp->ai_addr;
+        result_addrs[result_count].size = rp->ai_addrlen;
+        result_count++;
+    }
+
+    if (result_count > 0) {
+        size_t result_index = (time(NULL) % result_count);
+        address->raw = result_addrs[result_index].address;
+        address->size = result_addrs[result_index].size;
+        if (address->raw.sa_family == AF_INET) {
+            address->in.sin_port = port;
+        } else {
+            address->in6.sin6_port = port;
+        }
+    }
+
+    freeaddrinfo(result);
+    return (result_count > 0 ? 0 : 1);
+}
+
 static inline int nDPIsrvd_setup_address(struct nDPIsrvd_address * const address, char const * const destination)
 {
     if (address == NULL || destination == NULL)
@@ -722,7 +776,9 @@ static inline int nDPIsrvd_setup_address(struct nDPIsrvd_address * const address
         }
         if (inet_pton(address->raw.sa_family, addr_buf, sock_addr) != 1)
         {
-            return 1;
+            char buf[512];
+            snprintf(buf, sizeof(buf), "%.*s", (int)(last_colon - destination), destination);
+            return nDPIsrvd_resolve_host(address, buf, (in_port_t)htons(atoi(last_colon + 1)));
         }
     }
 

ncrypt.c

@@ -9,6 +9,8 @@
 #include <openssl/x509v3.h>
 #include <unistd.h>
 
+#include "utils.h"
+
 int ncrypt_init(void)
 {
     SSL_load_error_strings();
@@ -47,14 +49,33 @@ static int ncrypt_load_pems(struct ncrypt_ctx * const ctx,
                             char const * const privkey_pem_path,
                             char const * const cert_pem_path)
 {
-    if (SSL_CTX_use_certificate_file(ctx->ssl_ctx, cert_pem_path, SSL_FILETYPE_PEM) <= 0 ||
-        SSL_CTX_use_PrivateKey_file(ctx->ssl_ctx, privkey_pem_path, SSL_FILETYPE_PEM) <= 0 ||
-        SSL_CTX_load_verify_locations(ctx->ssl_ctx, ca_path, NULL) <= 0)
+    char err_buf[256];
+
+    err_buf[0] = '\0';
+    if (SSL_CTX_use_certificate_file(ctx->ssl_ctx, cert_pem_path, SSL_FILETYPE_PEM) <= 0) {
+        ERR_error_string_n(ERR_get_error(), err_buf, sizeof(err_buf));
+        logger_early(1, "Failed to load Certificate `%s': %s", cert_pem_path, err_buf);
+        while (ERR_get_error() != 0) {}
+    }
+    if (SSL_CTX_use_PrivateKey_file(ctx->ssl_ctx, privkey_pem_path, SSL_FILETYPE_PEM) <= 0) {
+        ERR_error_string_n(ERR_get_error(), err_buf, sizeof(err_buf));
+        logger_early(1, "Failed to load Private Key `%s': %s", privkey_pem_path, err_buf);
+        while (ERR_get_error() != 0) {}
+    }
+    if (SSL_CTX_load_verify_locations(ctx->ssl_ctx, ca_path, NULL) <= 0)
     {
+        ERR_error_string_n(ERR_get_error(), err_buf, sizeof(err_buf));
+        logger_early(1, "Failed to load CA File `%s': %s", ca_path, err_buf);
+        while (ERR_get_error() != 0) {}
+    }
+    if (err_buf[0] != '\0') {
         return NCRYPT_PEM_LOAD_FAILED;
     }
 
     if (SSL_CTX_check_private_key(ctx->ssl_ctx) != 1) {
+        ERR_error_string_n(ERR_get_error(), err_buf, sizeof(err_buf));
+        logger_early(1, "Private Key Verification failed: %s", err_buf);
+        while (ERR_get_error() != 0) {}
         return NCRYPT_PEM_LOAD_FAILED;
     }
 

ndpid.conf.example

@@ -21,7 +21,7 @@
 #sha1        = /path/to/libnDPI/example/sha1_fingerprints.csv
 
 # Collector endpoint as UNIX socket (usually nDPIsrvd)
-#collector   = /run/nDPIsrvd/collector
+collector   = /run/nDPIsrvd/collector
 # Collector endpoint as TCP socket (usually nDPIsrvd or a custom application)
 #collector   = 127.0.0.1:7777
 

packages/systemd/ndpid@.service.in

@@ -6,7 +6,7 @@ Requires=ndpisrvd.service
 [Service]
 Type=simple
 ExecStartPre=/bin/sh -c 'test -r "@CMAKE_INSTALL_PREFIX@/etc/nDPId/%i.conf" || cp -v "@CMAKE_INSTALL_PREFIX@/share/nDPId/ndpid.conf.example" "@CMAKE_INSTALL_PREFIX@/etc/nDPId/%i.conf"'
-ExecStart=@CMAKE_INSTALL_PREFIX@/sbin/nDPId -f @CMAKE_INSTALL_PREFIX@/etc/nDPId/%i.conf -i %i -u ndpid -c /run/nDPIsrvd/collector
+ExecStart=@CMAKE_INSTALL_PREFIX@/sbin/nDPId -f @CMAKE_INSTALL_PREFIX@/etc/nDPId/%i.conf -i %i -u ndpid
 Restart=on-failure
 Environment="NDPID_STARTED_BY_SYSTEMD="