Add -u option to pass through unknown hostnames.

[tlsproxy/tlsproxy.git] / src / tlsproxy.c

diff --git a/src/tlsproxy.c b/src/tlsproxy.c
index 0e095689374b7cae7e4ce51546491d1e9ade25d4..25f37043394518b1c02184fb775925ef1564d4f2 100644 (file)
--- a/src/tlsproxy.c
+++ b/src/tlsproxy.c
@@ -1,5 +1,7 @@
 /*
- * tlsproxy is a transparent TLS proxy for HTTPS connections.
+ * tlsproxy is a TLS proxy for HTTPS which intercepts the connections and
+ * ensures the server certificate doesn't change. Normally this isn't detected
+ * if a trusted CA for the new server certificate is installed.
  *
  * Copyright (C) 2011  Simon Ruderich
  *
@@ -48,6 +50,14 @@ GCRY_THREAD_OPTION_PTHREAD_IMPL;
 #define DH_SIZE 1024
 
 
+/* For gnutls_*() functions. */
+#define GNUTLS_ERROR_EXIT(error, message) \
+    if (GNUTLS_E_SUCCESS != error) { \
+        fprintf(stderr, "%s: %s\n", message, gnutls_strerror(error)); \
+        exit(EXIT_FAILURE); \
+    }
+
+
 /* Server should shut down. Set by SIGINT handler. */
 static volatile int done;
 
@@ -63,7 +73,9 @@ static SEM *ringbuffer_free; /* Space for another element in the buffer? */
 static SEM *ringbuffer_lock; /* Read lock. */
 
 
+#ifdef DEBUG
 static void sigint_handler(int signal);
+#endif
 
 static void parse_arguments(int argc, char **argv);
 static void print_usage(const char *argv);
@@ -77,7 +89,11 @@ static void worker_thread(void);
 int main(int argc, char **argv) {
     int port;
     int client_socket, server_socket;
+#ifdef USE_IPV4_ONLY
+    struct sockaddr_in server_in;
+#else
     struct sockaddr_in6 server_in;
+#endif
 
     size_t i;
     pthread_t *threads;
@@ -94,11 +110,13 @@ int main(int argc, char **argv) {
     }
 
     /* Setup our SIGINT signal handler which allows a "normal" termination of
-     * the server. */
+     * the server in DEBUG mode. */
     sigemptyset(&action.sa_mask);
-    action.sa_handler = sigint_handler;
     action.sa_flags   = 0;
+#ifdef DEBUG
+    action.sa_handler = sigint_handler;
     sigaction(SIGINT, &action, NULL);
+#endif
     /* Ignore SIGPIPEs. */
     action.sa_handler = SIG_IGN;
     sigaction(SIGPIPE, &action, NULL);
@@ -132,33 +150,42 @@ int main(int argc, char **argv) {
                                 (void * (*)(void *))&worker_thread,
                                 NULL);
         if (0 != result) {
-            printf("failed to create worker thread: %s\n", strerror(result));
+            fprintf(stderr, "failed to create worker thread: %s\n",
+                            strerror(result));
             return EXIT_FAILURE;
         }
 
         threads[i] = thread;
     }
 
+#ifdef USE_IPV4_ONLY
+    server_socket = socket(PF_INET, SOCK_STREAM, 0);
+#else
     server_socket = socket(PF_INET6, SOCK_STREAM, 0);
+#endif
     if (-1 == server_socket) {
         perror("socket()");
         return EXIT_FAILURE;
     }
 
-#ifdef DEBUG
     /* Fast rebinding for debug mode, could cause invalid packets. */
-    {
+    if (LOG_DEBUG <= global_log_level) {
         int socket_option = 1;
         setsockopt(server_socket, SOL_SOCKET, SO_REUSEADDR,
                    &socket_option, sizeof(socket_option));
     }
-#endif
 
     /* Bind to the listen socket. */
     memset(&server_in, 0, sizeof(server_in));
+#ifdef USE_IPV4_ONLY
+    server_in.sin_family      = AF_INET;               /* IPv4 only */
+    server_in.sin_addr.s_addr = htonl(INADDR_ANY);     /* bind to any address */
+    server_in.sin_port        = htons((uint16_t)port); /* port to bind to */
+#else
     server_in.sin6_family = AF_INET6;              /* IPv6 (and IPv4) */
     server_in.sin6_addr   = in6addr_any;           /* bind to any address */
     server_in.sin6_port   = htons((uint16_t)port); /* port to bind to */
+#endif
     if (-1 == bind(server_socket, (struct sockaddr *)&server_in,
                                   sizeof(server_in))) {
         perror("bind()");
@@ -225,11 +252,13 @@ int main(int argc, char **argv) {
     return EXIT_FAILURE;
 }
 
+#ifdef DEBUG
 static void sigint_handler(int signal_number) {
     (void)signal_number;
 
     done = 1;
 }
+#endif
 
 static void parse_arguments(int argc, char **argv) {
     int option;
@@ -241,8 +270,9 @@ static void parse_arguments(int argc, char **argv) {
 #else
     global_log_level = LOG_WARNING;
 #endif
+    global_passthrough_unknown = 0;
 
-    while (-1 != (option = getopt(argc, argv, "d:p:t:h?"))) {
+    while (-1 != (option = getopt(argc, argv, "d:p:t:uh?"))) {
         switch (option) {
             case 'd': {
                 if (0 > atoi(optarg)) {
@@ -293,6 +323,10 @@ static void parse_arguments(int argc, char **argv) {
                 thread_count = (size_t)atoi(optarg);
                 break;
             }
+            case 'u': {
+                global_passthrough_unknown = 1;
+                break;
+            }
             case 'h':
             default: /* '?' */
                 print_usage(argv[0]);
@@ -307,12 +341,15 @@ static void parse_arguments(int argc, char **argv) {
     }
 }
 static void print_usage(const char *argv) {
-    fprintf(stderr, "Usage: %s [-d level] [-p host:port] [-t count] port\n",
+    fprintf(stderr, "Usage: %s [-d level] [-p host:port] [-t count] [-u] port\n",
                     argv);
     fprintf(stderr, "\n");
     fprintf(stderr, "-d debug level: 0=errors only, 2=debug [default: 1]\n");
     fprintf(stderr, "-p proxy hostname and port\n");
     fprintf(stderr, "-t number of threads [default: 10]\n");
+    fprintf(stderr, "-u passthrough connection if no certificate is stored \
+[default: error]\n");
+    fprintf(stderr, "   WARNING: might be a security problem!\n");
 }
 
 static void initialize_gnutls(void) {