]> ruderich.org/simon Gitweb - tlsproxy/tlsproxy.git/log
tlsproxy/tlsproxy.git
11 years agotests/tests.sh: Remove.
Simon Ruderich [Fri, 12 Jul 2013 14:11:36 +0000 (16:11 +0200)]
tests/tests.sh: Remove.

Just run `make check`.

11 years agotests: Cleanup.
Simon Ruderich [Fri, 12 Jul 2013 14:07:25 +0000 (16:07 +0200)]
tests: Cleanup.

11 years agotests/common.sh: Abort on errors.
Simon Ruderich [Fri, 12 Jul 2013 14:06:48 +0000 (16:06 +0200)]
tests/common.sh: Abort on errors.

11 years agoconfigure.ac: Cleanup.
Simon Ruderich [Fri, 12 Jul 2013 14:04:09 +0000 (16:04 +0200)]
configure.ac: Cleanup.

Also replace old AC_HELP_STRING() with AS_HELP_STRING().

11 years agotlsproxy-setup: Fix --sec-param for older certtool versions.
Simon Ruderich [Fri, 12 Jul 2013 13:47:26 +0000 (15:47 +0200)]
tlsproxy-setup: Fix --sec-param for older certtool versions.

11 years agosrc/tlsproxy-setup: Use --sec-param=high.
Simon Ruderich [Fri, 12 Apr 2013 14:51:52 +0000 (16:51 +0200)]
src/tlsproxy-setup: Use --sec-param=high.

This creates a bigger RSA key. Not really relevant in our case because
the connection stays local (proxy to client), but it's a good example.

11 years agosrc/tlsproxy-add,src/tlsproxy-setup: Increase expiry date.
Simon Ruderich [Fri, 12 Apr 2013 14:49:39 +0000 (16:49 +0200)]
src/tlsproxy-add,src/tlsproxy-setup: Increase expiry date.

11 years agosrc/tlsproxy-add,src/tlsproxy-setup: Cleanup.
Simon Ruderich [Fri, 12 Apr 2013 14:47:42 +0000 (16:47 +0200)]
src/tlsproxy-add,src/tlsproxy-setup: Cleanup.

11 years agotests/common.sh: Simplify error redirection.
Simon Ruderich [Tue, 26 Feb 2013 23:42:42 +0000 (00:42 +0100)]
tests/common.sh: Simplify error redirection.

11 years agolog.c: Use one printf() instead of two in log_message().
Simon Ruderich [Tue, 26 Feb 2013 23:41:14 +0000 (00:41 +0100)]
log.c: Use one printf() instead of two in log_message().

11 years agosrc/*,tests/*: Update copyright year.
Simon Ruderich [Tue, 15 Jan 2013 19:59:36 +0000 (20:59 +0100)]
src/*,tests/*: Update copyright year.

11 years agoconfigure.ac: Remove --param=ssp-buffer-size=1.
Simon Ruderich [Tue, 15 Jan 2013 19:56:34 +0000 (20:56 +0100)]
configure.ac: Remove --param=ssp-buffer-size=1.

-fstack-protector-all already protects all functions.

12 years agoconfigure.ac: Cleanup hardening flags.
Simon Ruderich [Tue, 31 Jul 2012 22:15:34 +0000 (00:15 +0200)]
configure.ac: Cleanup hardening flags.

12 years agoconfigure.ac: Use $CPPFLAGS for preprocessor flags.
Simon Ruderich [Tue, 31 Jul 2012 22:12:05 +0000 (00:12 +0200)]
configure.ac: Use $CPPFLAGS for preprocessor flags.

12 years agoNEWS: Use complete sentences.
Simon Ruderich [Tue, 31 Jul 2012 21:59:13 +0000 (23:59 +0200)]
NEWS: Use complete sentences.

12 years agoNEWS: Put latest versions on top.
Simon Ruderich [Tue, 31 Jul 2012 21:55:54 +0000 (23:55 +0200)]
NEWS: Put latest versions on top.

12 years agosrc/connection.c: Fix error check for gnutls_priority_set().
Simon Ruderich [Sun, 22 Jul 2012 01:26:45 +0000 (03:26 +0200)]
src/connection.c: Fix error check for gnutls_priority_set().

12 years agosrc/tlsproxy.c: Display value of invalid options.
Simon Ruderich [Sun, 11 Mar 2012 22:06:09 +0000 (23:06 +0100)]
src/tlsproxy.c: Display value of invalid options.

12 years agosrc/connection.c,src/verify.c: Use a constant for path length.
Simon Ruderich [Sun, 11 Mar 2012 22:01:04 +0000 (23:01 +0100)]
src/connection.c,src/verify.c: Use a constant for path length.

12 years agosrc/tlsproxy.c: Display version in help and debug startup message.
Simon Ruderich [Sun, 11 Mar 2012 21:58:51 +0000 (22:58 +0100)]
src/tlsproxy.c: Display version in help and debug startup message.

12 years agosrc/tlsproxy.c: Minor documentation update.
Simon Ruderich [Sun, 11 Mar 2012 21:51:16 +0000 (22:51 +0100)]
src/tlsproxy.c: Minor documentation update.

12 years agosrc/sem.c,src/tlsproxy.c: Minor cleanup.
Simon Ruderich [Sun, 11 Mar 2012 21:50:59 +0000 (22:50 +0100)]
src/sem.c,src/tlsproxy.c: Minor cleanup.

12 years agosrc/*,test/*: Add missing quotes to shell scripts.
Simon Ruderich [Sun, 11 Mar 2012 21:48:16 +0000 (22:48 +0100)]
src/*,test/*: Add missing quotes to shell scripts.

12 years agoREADME: Minor update.
Simon Ruderich [Sun, 11 Mar 2012 21:47:31 +0000 (22:47 +0100)]
README: Minor update.

12 years agosrc/*,tests/*: Update copyright year.
Simon Ruderich [Sun, 11 Mar 2012 21:46:51 +0000 (22:46 +0100)]
src/*,tests/*: Update copyright year.

12 years agoconfigure.ac: Add missing license.
Simon Ruderich [Sun, 11 Mar 2012 21:44:56 +0000 (22:44 +0100)]
configure.ac: Add missing license.

12 years agoconfigure.ac: Add more hardening flags for GCC.
Simon Ruderich [Tue, 15 Nov 2011 14:31:51 +0000 (15:31 +0100)]
configure.ac: Add more hardening flags for GCC.

Also move -pie to LDFLAGS, it's a linker flag.

13 years agosrc/verify.c: Better handle a missing proxy certificate.
Simon Ruderich [Sat, 17 Sep 2011 20:42:56 +0000 (22:42 +0200)]
src/verify.c: Better handle a missing proxy certificate.

If the server certificate exists but the proxy certificate is missing no
TLS connection to the client was established at all (only an unencrypted
connection). Now use the "invalid" certificate to send the message to
the client as it should be.

13 years agotests/tests-*.sh: Remove unnecessary calls to tlsproxy-add.
Simon Ruderich [Sat, 17 Sep 2011 20:30:50 +0000 (22:30 +0200)]
tests/tests-*.sh: Remove unnecessary calls to tlsproxy-add.

13 years agotests/tests.sh: If the first test fails abort.
Simon Ruderich [Sat, 17 Sep 2011 20:07:20 +0000 (22:07 +0200)]
tests/tests.sh: If the first test fails abort.

A failure in the first test was ignored until now!

13 years agosrc/connection.c: Minor cleanup.
Simon Ruderich [Sat, 17 Sep 2011 19:42:52 +0000 (21:42 +0200)]
src/connection.c: Minor cleanup.

13 years agoRename server_certificate_path() to server_certificate_file().
Simon Ruderich [Sat, 17 Sep 2011 19:33:52 +0000 (21:33 +0200)]
Rename server_certificate_path() to server_certificate_file().

13 years agosrc/connection.c: Correctly log suggested buffer size.
Simon Ruderich [Sat, 17 Sep 2011 19:30:17 +0000 (21:30 +0200)]
src/connection.c: Correctly log suggested buffer size.

13 years agosrc/verify.c: Remove duplicated code.
Simon Ruderich [Sat, 17 Sep 2011 19:26:21 +0000 (21:26 +0200)]
src/verify.c: Remove duplicated code.

Moved to new helper function get_certificate_path().

13 years agosrc/connection.c: Move code to get proxy certificate path to verify.c.
Simon Ruderich [Sat, 17 Sep 2011 18:59:01 +0000 (20:59 +0200)]
src/connection.c: Move code to get proxy certificate path to verify.c.

Moved to new function proxy_certificate_path() in verify.c.

13 years agosrc/connection.c: Reduce calls to gnutls_record_get_max_size().
Simon Ruderich [Thu, 8 Sep 2011 13:55:58 +0000 (15:55 +0200)]
src/connection.c: Reduce calls to gnutls_record_get_max_size().

Calling it once per connection is sufficient.

13 years agosrc/*.c: Minor documentation updates.
Simon Ruderich [Tue, 6 Sep 2011 14:31:11 +0000 (16:31 +0200)]
src/*.c: Minor documentation updates.

13 years agoREADME: Minor documentation updates.
Simon Ruderich [Tue, 6 Sep 2011 14:30:01 +0000 (16:30 +0200)]
README: Minor documentation updates.

13 years agosrc/log.c: Fix build without DEBUG.
Simon Ruderich [Tue, 6 Sep 2011 14:20:09 +0000 (16:20 +0200)]
src/log.c: Fix build without DEBUG.

Broken in 64bfebde76d568808b6fa8a8d09b4b5afe13dc15.

13 years agoCheck return value of snprintf().
Simon Ruderich [Tue, 6 Sep 2011 14:13:12 +0000 (16:13 +0200)]
Check return value of snprintf().

13 years agoconfigure.ac: Compile with additional security features if GCC is used.
Simon Ruderich [Fri, 19 Aug 2011 00:14:00 +0000 (02:14 +0200)]
configure.ac: Compile with additional security features if GCC is used.

See http://wiki.debian.org/Hardening for more information.

13 years agoImplement cleaner logging approach.
Simon Ruderich [Thu, 18 Aug 2011 23:53:52 +0000 (01:53 +0200)]
Implement cleaner logging approach.

13 years agoRelease 0.2. 0.2
Simon Ruderich [Wed, 23 Mar 2011 22:42:28 +0000 (23:42 +0100)]
Release 0.2.

13 years agosrc/verify.c: Print server certificate in case of an error.
Simon Ruderich [Wed, 23 Mar 2011 22:34:52 +0000 (23:34 +0100)]
src/verify.c: Print server certificate in case of an error.

13 years agoREADME: Fix typo.
Simon Ruderich [Wed, 23 Mar 2011 22:34:13 +0000 (23:34 +0100)]
README: Fix typo.

13 years agosrc/connection.c: Remove unnecessary check.
Simon Ruderich [Tue, 22 Mar 2011 16:09:32 +0000 (17:09 +0100)]
src/connection.c: Remove unnecessary check.

13 years agosrc/tlsproxy.c: Initialize done with 0 for clarity.
Simon Ruderich [Tue, 22 Mar 2011 16:09:15 +0000 (17:09 +0100)]
src/tlsproxy.c: Initialize done with 0 for clarity.

13 years agoMinor whitespace fixes.
Simon Ruderich [Tue, 22 Mar 2011 16:08:02 +0000 (17:08 +0100)]
Minor whitespace fixes.

13 years agoMinor source comment fixes.
Simon Ruderich [Tue, 22 Mar 2011 16:07:44 +0000 (17:07 +0100)]
Minor source comment fixes.

13 years agoREADME: Add KNOWN ISSUES with a minor Firefox problem.
Simon Ruderich [Wed, 16 Mar 2011 21:29:10 +0000 (22:29 +0100)]
README: Add KNOWN ISSUES with a minor Firefox problem.

13 years agosrc/tlsproxy.h: Prepend global_ to tls_priority_cache and tls_dh_params.
Simon Ruderich [Wed, 16 Mar 2011 21:26:37 +0000 (22:26 +0100)]
src/tlsproxy.h: Prepend global_ to tls_priority_cache and tls_dh_params.

13 years agosrc/connection.c: Send HTML in error messages.
Simon Ruderich [Wed, 16 Mar 2011 16:58:42 +0000 (17:58 +0100)]
src/connection.c: Send HTML in error messages.

13 years agoREADME: Improve -u description.
Simon Ruderich [Wed, 16 Mar 2011 13:25:45 +0000 (14:25 +0100)]
README: Improve -u description.

13 years agoREADME: Add information about -u option.
Simon Ruderich [Tue, 15 Mar 2011 21:31:50 +0000 (22:31 +0100)]
README: Add information about -u option.

13 years agotests/test-*.sh: Minor comment update.
Simon Ruderich [Tue, 15 Mar 2011 21:01:28 +0000 (22:01 +0100)]
tests/test-*.sh: Minor comment update.

13 years agoAdd -u option to pass through unknown hostnames.
Simon Ruderich [Tue, 15 Mar 2011 20:52:43 +0000 (21:52 +0100)]
Add -u option to pass through unknown hostnames.

Also add tests.

If -d 2 is used then use SO_REUSEADDR, necessary for the test suite as
we have to restart the proxy and otherwise we have to wait for the
timeout.

13 years agotests/client.c: Exit with EXIT_FAILURE if hostname doesn't match.
Simon Ruderich [Tue, 15 Mar 2011 20:35:21 +0000 (21:35 +0100)]
tests/client.c: Exit with EXIT_FAILURE if hostname doesn't match.

13 years agotests: Correctly handle cleanup of (temporary) files.
Simon Ruderich [Tue, 15 Mar 2011 20:34:33 +0000 (21:34 +0100)]
tests: Correctly handle cleanup of (temporary) files.

13 years agotests: Separate common test data, move tests in tests-normal.sh.
Simon Ruderich [Tue, 15 Mar 2011 20:27:49 +0000 (21:27 +0100)]
tests: Separate common test data, move tests in tests-normal.sh.

13 years agoREADME: Clarify use of `proxy-invalid.pem`.
Simon Ruderich [Tue, 15 Mar 2011 18:05:26 +0000 (19:05 +0100)]
README: Clarify use of `proxy-invalid.pem`.

No client data is sent to the server in case of an error.

13 years agosrc/tlsproxy.c: Add missing htonl() for INADDR_ANY.
Simon Ruderich [Tue, 15 Mar 2011 16:12:11 +0000 (17:12 +0100)]
src/tlsproxy.c: Add missing htonl() for INADDR_ANY.

Not really necessary as INADDR_ANY is normally 0.

13 years agoAdd ./configure --disable-ipv6 to use IPv4 only.
Simon Ruderich [Tue, 15 Mar 2011 16:01:29 +0000 (17:01 +0100)]
Add ./configure --disable-ipv6 to use IPv4 only.

For networks stacks which don't support any IPv6.

13 years ago.gitignore: Sort.
Simon Ruderich [Sun, 13 Mar 2011 16:14:55 +0000 (17:14 +0100)]
.gitignore: Sort.

13 years agoNEWS: Add. 0.1
Simon Ruderich [Fri, 11 Mar 2011 23:55:51 +0000 (00:55 +0100)]
NEWS: Add.

13 years agoREADME: Add.
Simon Ruderich [Fri, 11 Mar 2011 23:49:34 +0000 (00:49 +0100)]
README: Add.

13 years agotests/tests.sh: Add missing license.
Simon Ruderich [Fri, 11 Mar 2011 23:21:33 +0000 (00:21 +0100)]
tests/tests.sh: Add missing license.

13 years ago.gitignore: Ignore .o files.
Simon Ruderich [Fri, 11 Mar 2011 23:15:47 +0000 (00:15 +0100)]
.gitignore: Ignore .o files.

13 years ago.gitignore: Ignore files created by tests/.
Simon Ruderich [Fri, 11 Mar 2011 23:15:27 +0000 (00:15 +0100)]
.gitignore: Ignore files created by tests/.

13 years ago.gitignore: Use absolute paths, starting from repository root.
Simon Ruderich [Fri, 11 Mar 2011 23:13:30 +0000 (00:13 +0100)]
.gitignore: Use absolute paths, starting from repository root.

13 years agotests: Add. Test basic behavior.
Simon Ruderich [Fri, 11 Mar 2011 23:12:29 +0000 (00:12 +0100)]
tests: Add. Test basic behavior.

13 years agosrc/tlsproxy.c: Only handle SIGINT in DEBUG mode.
Simon Ruderich [Fri, 11 Mar 2011 21:46:55 +0000 (22:46 +0100)]
src/tlsproxy.c: Only handle SIGINT in DEBUG mode.

It's useful for valgrind in DEBUG mode, but makes it more difficult to
terminate tlsproxy (Ctrl-C no longer works) in case of a
stalled/unfinished connection.

13 years agosrc/tlsproxy-add: Add, adds server certificates to tlsproxy.
Simon Ruderich [Fri, 11 Mar 2011 21:37:54 +0000 (22:37 +0100)]
src/tlsproxy-add: Add, adds server certificates to tlsproxy.

13 years agosrc/tlsproxy-setup: Print message when done.
Simon Ruderich [Fri, 11 Mar 2011 21:37:34 +0000 (22:37 +0100)]
src/tlsproxy-setup: Print message when done.

13 years agosrc/Makefile.am: Distribute tlsproxy-setup.
Simon Ruderich [Fri, 11 Mar 2011 02:42:42 +0000 (03:42 +0100)]
src/Makefile.am: Distribute tlsproxy-setup.

13 years agosrc/tlsproxy-setup.sh: Rename to tlsproxy-setup.
Simon Ruderich [Fri, 11 Mar 2011 02:41:13 +0000 (03:41 +0100)]
src/tlsproxy-setup.sh: Rename to tlsproxy-setup.

13 years agosrc/tlsproxy.c: Fix error message.
Simon Ruderich [Fri, 11 Mar 2011 02:26:36 +0000 (03:26 +0100)]
src/tlsproxy.c: Fix error message.

13 years agosrc/connection.c: Fix memory leak in initialize_tls_session_*().
Simon Ruderich [Fri, 11 Mar 2011 02:22:29 +0000 (03:22 +0100)]
src/connection.c: Fix memory leak in initialize_tls_session_*().

13 years agosrc/tlsproxy-setup.sh: Add. Creates files to use tlsproxy.
Simon Ruderich [Fri, 11 Mar 2011 02:03:50 +0000 (03:03 +0100)]
src/tlsproxy-setup.sh: Add. Creates files to use tlsproxy.

13 years agosrc/connection.c: Use "invalid" certificate when the server certificate changes.
Simon Ruderich [Fri, 11 Mar 2011 02:02:00 +0000 (03:02 +0100)]
src/connection.c: Use "invalid" certificate when the server certificate changes.

This special "invalid" certificate lets the client know there was a
problem.

13 years agoVerify the server certificate against a stored copy.
Simon Ruderich [Thu, 10 Mar 2011 23:26:08 +0000 (00:26 +0100)]
Verify the server certificate against a stored copy.

13 years agosrc/connection.c: Finish the TLS connection instead of closing it.
Simon Ruderich [Thu, 10 Mar 2011 23:20:06 +0000 (00:20 +0100)]
src/connection.c: Finish the TLS connection instead of closing it.

This ensures the transmission was complete.

13 years agosrc/connection.c: Move path related defines to tlsproxy.h.
Simon Ruderich [Thu, 10 Mar 2011 23:18:36 +0000 (00:18 +0100)]
src/connection.c: Move path related defines to tlsproxy.h.

Thus all file constants are stored in one place.

13 years agosrc/: Move log related functions/defines to log.[hc].
Simon Ruderich [Thu, 10 Mar 2011 22:17:49 +0000 (23:17 +0100)]
src/: Move log related functions/defines to log.[hc].

13 years agoIntercept TLS connections between client and server.
Simon Ruderich [Tue, 8 Mar 2011 02:47:29 +0000 (03:47 +0100)]
Intercept TLS connections between client and server.

Talk to the client as TLS server and to the server as TLS client and
transferring data transparently between them.

_No_ fingerprint validation of the server certificate is done yet!

13 years agosrc/tlsproxy.c: Ignore SIGPIPEs.
Simon Ruderich [Tue, 8 Mar 2011 02:17:14 +0000 (03:17 +0100)]
src/tlsproxy.c: Ignore SIGPIPEs.

13 years agosrc/connection.c: Align WARNING (now "WARN ") in log_message().
Simon Ruderich [Mon, 7 Mar 2011 20:30:09 +0000 (21:30 +0100)]
src/connection.c: Align WARNING (now "WARN ") in log_message().

13 years agosrc/connection.c: Close connections only in one place.
Simon Ruderich [Mon, 7 Mar 2011 20:29:05 +0000 (21:29 +0100)]
src/connection.c: Close connections only in one place.

13 years agosrc/: Improve debug output/logging.
Simon Ruderich [Mon, 7 Mar 2011 19:59:29 +0000 (20:59 +0100)]
src/: Improve debug output/logging.

13 years agosrc/: Prefix all global variables with global_.
Simon Ruderich [Mon, 7 Mar 2011 17:06:56 +0000 (18:06 +0100)]
src/: Prefix all global variables with global_.

13 years agosrc/tlsproxy.c: Fix missing -t in print_usage().
Simon Ruderich [Mon, 7 Mar 2011 17:05:17 +0000 (18:05 +0100)]
src/tlsproxy.c: Fix missing -t in print_usage().

13 years agosrc/connection.c: Fix switched variables in read_from_write_to().
Simon Ruderich [Mon, 7 Mar 2011 16:47:05 +0000 (17:47 +0100)]
src/connection.c: Fix switched variables in read_from_write_to().

13 years agosrc/connection.c: Add missing close() in handle_connection().
Simon Ruderich [Mon, 7 Mar 2011 16:46:07 +0000 (17:46 +0100)]
src/connection.c: Add missing close() in handle_connection().

13 years agosrc/connection.c: Minor source comment fixes.
Simon Ruderich [Mon, 7 Mar 2011 16:45:10 +0000 (17:45 +0100)]
src/connection.c: Minor source comment fixes.

13 years agosrc/*.c: Always use constants on the left in comparisons.
Simon Ruderich [Mon, 7 Mar 2011 05:52:41 +0000 (06:52 +0100)]
src/*.c: Always use constants on the left in comparisons.

13 years agosrc/tlsproxy.c: Improve command line argument error messages.
Simon Ruderich [Mon, 7 Mar 2011 05:33:05 +0000 (06:33 +0100)]
src/tlsproxy.c: Improve command line argument error messages.

13 years agosrc/*: Cleanup includes.
Simon Ruderich [Mon, 7 Mar 2011 00:41:06 +0000 (01:41 +0100)]
src/*: Cleanup includes.

13 years agosrc/*: Split src/tlsproxy.c in several files.
Simon Ruderich [Mon, 7 Mar 2011 00:31:16 +0000 (01:31 +0100)]
src/*: Split src/tlsproxy.c in several files.

13 years agoconfigure.ac: Simpler check for libraries.
Simon Ruderich [Sun, 6 Mar 2011 15:21:22 +0000 (16:21 +0100)]
configure.ac: Simpler check for libraries.

13 years agosrc/tlsproxy.c: Add thread support.
Simon Ruderich [Sun, 6 Mar 2011 01:39:05 +0000 (02:39 +0100)]
src/tlsproxy.c: Add thread support.

By default 10 threads are spawned.

13 years agosrc/tlsproxy.c: Fix wrong timeout for poll(), -1 is infinity.
Simon Ruderich [Sun, 6 Mar 2011 00:34:55 +0000 (01:34 +0100)]
src/tlsproxy.c: Fix wrong timeout for poll(), -1 is infinity.