src/*.c: Minor documentation updates.

[tlsproxy/tlsproxy.git] / src / connection.c

diff --git a/src/connection.c b/src/connection.c
index af14477cb71592c9dd1dcc90d75ef71d37e75db2..bfdac1c6db59df105ae2ac9fdc659be004da9e3a 100644 (file)
--- a/src/connection.c
+++ b/src/connection.c
@@ -31,9 +31,10 @@
 #include <errno.h>
 
 
-/* Maximum line of a HTTP request line. Longer request lines are aborted with
- * an error. The standard doesn't specify a maximum line length but this
- * should be a good limit to make processing simpler. */
+/* Maximum length of a HTTP request line. Longer request lines are aborted
+ * with an error. The standard doesn't specify a maximum line length but this
+ * should be a good limit to make processing simpler. As HTTPS is used this
+ * doesn't limit long GET requests. */
 #define MAX_REQUEST_LINE 4096
 
 /* Format string used to send HTTP/1.0 error responses to the client.
@@ -87,7 +88,7 @@ void handle_connection(int client_socket) {
     char host[MAX_REQUEST_LINE];
     char port[5 + 1];
 
-    int version_minor;
+    int version_minor; /* HTTP/1.x */
     int result;
 
     /* client_x509_cred is used when talking to the client (acting as a TSL
@@ -208,7 +209,7 @@ void handle_connection(int client_socket) {
 
             LOG(LOG_DEBUG, "transferring data");
 
-            /* Proxy data between client and server until one suite is done
+            /* Proxy data between client and server until one side is done
              * (EOF or error). */
             transfer_data(client_socket, server_socket);
 
@@ -216,15 +217,15 @@ void handle_connection(int client_socket) {
 
             goto out;
         }
-        /* server_certificate_path() may open the file, close it. */
+        /* server_certificate_path() may have opened the file, close it. */
         if (NULL != file) {
             fclose(file);
         }
     }
 
+    /* Initialize TLS client credentials to talk to the server. */
     result = initialize_tls_session_server(server_socket, &server_session,
                                                           &server_x509_cred);
-    /* Initialize TLS client credentials to talk to the server. */
     if (0 != result) {
         LOG(LOG_WARNING, "initialize_tls_session_server() failed");
         send_forwarding_failure(client_fd);
@@ -250,13 +251,14 @@ void handle_connection(int client_socket) {
     if (0 != verify_tls_connection(server_session, host)) {
         LOG(LOG_ERROR, "server certificate validation failed!");
         /* We send the error message over our TLS connection to the client,
-         * but with an invalid certificate. */
+         * but with an invalid certificate. No data is transfered from/to the
+         * target server. */
         validation_failed = 1;
     }
 
     /* Initialize TLS server credentials to talk to the client. */
     result = initialize_tls_session_client(client_socket,
-                                           /* use special host if the server
+                                           /* use a special host if the server
                                             * certificate was invalid */
                                            (validation_failed) ? "invalid"
                                                                : host,
@@ -298,7 +300,7 @@ void handle_connection(int client_socket) {
 
     LOG(LOG_DEBUG, "transferring TLS data");
 
-    /* Proxy data between client and server until one suite is done (EOF or
+    /* Proxy data between client and server until one side is done (EOF or
      * error). */
     transfer_data_tls(client_socket, server_socket,
                       client_session, server_session);
@@ -370,7 +372,16 @@ static int initialize_tls_session_client(int peer_socket,
             hostname);
         return -1;
     }
-    snprintf(path, sizeof(path), PROXY_SERVER_CERT_FORMAT, hostname);
+    result = snprintf(path, sizeof(path), PROXY_SERVER_CERT_FORMAT, hostname);
+    if (result < 0) {
+        LOG_PERROR(LOG_ERROR,
+                   "initialize_tls_session_client(): snprintf failed");
+        return -1;
+    } else if ((size_t)result >= sizeof(path)) {
+        LOG(LOG_ERROR,
+            "initialize_tls_session_client(): snprintf buffer too short");
+        return -1;
+    }
 
     result = gnutls_certificate_allocate_credentials(x509_cred);
     if (GNUTLS_E_SUCCESS != result) {
@@ -386,18 +397,17 @@ gnutls_certificate_allocate_credentials(): %s",
         result = gnutls_certificate_set_x509_trust_file(*x509_cred,
                                                         PROXY_CA_FILE,
                                                         GNUTLS_X509_FMT_PEM);
+        if (0 >= result) {
+            LOG(LOG_ERROR,
+                "initialize_tls_session_client(): can't read CA file: '%s'",
+                PROXY_CA_FILE);
+            gnutls_certificate_free_credentials(*x509_cred);
+            return -1;
+        }
+    }
     /* If the invalid hostname was specified do nothing, we use a self-signed
      * certificate in this case. */
-    } else {
-        result = 1;
-    }
-    if (0 >= result) {
-        LOG(LOG_ERROR,
-            "initialize_tls_session_client(): can't read CA file: '%s'",
-            PROXY_CA_FILE);
-        gnutls_certificate_free_credentials(*x509_cred);
-        return -1;
-    }
+
     /* And certificate for this website and proxy's private key. */
     if (!use_invalid_cert) {
         result = gnutls_certificate_set_x509_key_file(*x509_cred,
@@ -421,7 +431,7 @@ can't read server certificate ('%s') or key file ('%s'): %s",
         return -2;
     }
 
-    gnutls_certificate_set_dh_params(*x509_cred, tls_dh_params);
+    gnutls_certificate_set_dh_params(*x509_cred, global_tls_dh_params);
 
     result = gnutls_init(session, GNUTLS_SERVER);
     if (GNUTLS_E_SUCCESS != result) {
@@ -431,7 +441,7 @@ can't read server certificate ('%s') or key file ('%s'): %s",
         gnutls_certificate_free_credentials(*x509_cred);
         return -1;
     }
-    result = gnutls_priority_set(*session, tls_priority_cache);
+    result = gnutls_priority_set(*session, global_tls_priority_cache);
     if (GNUTLS_E_SUCCESS != result) {
         LOG(LOG_ERROR,
             "initialize_tls_session_client(): gnutls_priority_set(): %s",
@@ -477,7 +487,7 @@ gnutls_certificate_allocate_credentials(): %s",
         gnutls_certificate_free_credentials(*x509_cred);
         return -1;
     }
-    gnutls_priority_set(*session, tls_priority_cache);
+    gnutls_priority_set(*session, global_tls_priority_cache);
     if (GNUTLS_E_SUCCESS != result) {
         LOG(LOG_ERROR,
             "initialize_tls_session_server(): gnutls_priority_set(): %s",
@@ -555,15 +565,26 @@ static void tls_send_invalid_cert_message(gnutls_session_t session) {
 #define RESPONSE_ERROR "500 Internal Server Error"
 #define RESPONSE_MSG   "Server certificate validation failed, check logs."
 
+    int result;
     char buffer[sizeof(HTTP_RESPONSE_FORMAT) - 1 /* '\0' */
                                              - 4 * 2 /* four %s */
                 + (sizeof(RESPONSE_ERROR) - 1 /* '\0' */) * 3
                 + sizeof(RESPONSE_MSG)    - 1 /* '\0' */
                 + 1 /* '\0' */];
 
-    snprintf(buffer, sizeof(buffer),
-             HTTP_RESPONSE_FORMAT,
-             RESPONSE_ERROR, RESPONSE_ERROR, RESPONSE_ERROR, RESPONSE_MSG);
+    result = snprintf(buffer, sizeof(buffer),
+                      HTTP_RESPONSE_FORMAT,
+                      RESPONSE_ERROR, RESPONSE_ERROR, RESPONSE_ERROR,
+                      RESPONSE_MSG);
+    if (result < 0) {
+        LOG_PERROR(LOG_ERROR,
+                   "tls_send_invalid_cert_message(): snprintf failed");
+        return;
+    } else if ((size_t)result >= sizeof(buffer)) {
+        LOG(LOG_ERROR,
+            "tls_send_invalid_cert_message(): snprintf buffer too short");
+        return;
+    }
 
     gnutls_record_send(session, buffer, sizeof(buffer) - 1);
                                         /* don't send trailing '\0' */