TLS/SNI matching - unsuccessful matching is printed as well?

[onehalf3570]

I'm trying to reduce the log clutter (main thing was to change the verbose* values from 3 to 2 in order to not have log entries coming both from syslog and from stdout redirection to syslog by systemd(?))

However, I still get a sort of duplicated 'matching' entries. I have two web servers behind the sslh - one which responds to fqdn.name and another - to www.fqdn.name
However, when I open the connection to www.fqdn.name and gets routed correctly (port 80, config is below), I still see the request getting matched with fqdn.name 🤔

Does it mean that it got matched somehow (despite working properly) or is it just a debug print (how to turn it off? verbose-connections? I would still like to see the third print, which is 'connection from ... forwarded ..')

Feb 07 23:44:13 fqdn.name sslh-ev[54711]: matching [www.fqdn.name] with [fqdn.name]
Feb 07 23:44:13 fqdn.name sslh-ev[54711]: matching [www.fqdn.name] with [www.fqdn.name]
Feb 07 23:44:13 fqdn.name sslh-ev[54711]: tls:connection from client_ip:45172 to server_ip:443 forwarded from client_ip:45172 to 192.168.31.254:80
Feb 07 23:44:13 fqdn.name sslh-ev[54711]: matching [www.fqdn.name] with [fqdn.name]
Feb 07 23:44:13 fqdn.name sslh-ev[54711]: matching [www.fqdn.name] with [www.fqdn.name]
Feb 07 23:44:13 fqdn.name sslh-ev[54711]: tls:connection from client_ip:45170 to server_ip:443 forwarded from client_ip:45170 to 192.168.31.254:80
Feb 07 23:44:14 fqdn.name sslh-ev[54711]: matching [www.fqdn.name] with [fqdn.name]
Feb 07 23:44:14 fqdn.name sslh-ev[54711]: matching [www.fqdn.name] with [www.fqdn.name]
Feb 07 23:44:14 fqdn.name sslh-ev[54711]: tls:connection from client_ip:45188 to server_ip:443 forwarded from client_ip:45188 to 192.168.31.254:80

listen:
(
    { host: "server_ip"; port: "443"; }
);

protocols: (
    {   name: "tls";
        host: "192.168.31.254";
        port: "443";
        sni_hostnames: [ "fqdn.name" ];
    },
    {   name: "tls";
        host: "192.168.31.254";
        port: "80";
        sni_hostnames: [ "www.fqdn.name" ];
    },
    {   name: "ssh";
        service: "ssh";
        host: "192.168.31.254";
        port: "22";
    }
);

[onehalf3570]

ok, it was quicker to check the code - https://github.com/yrutschle/sslh/blob/e5d7cd0575d61bfe4d7687018432d60976f45e2f/tls.c#L280C41-L280C49

so it is

print_message(msg_probe_error, "matching [%.*s] with [%s]\n", (int)name_len, name, *item);

so

verbose-probe-error: 0;

fixed this.

But I'd suggest changing the log level to msg_probe_info, as matcher iteration is basically info, not an error

[yrutschle]

Indeed -- I changed it in ecc7607