src/connection.c

   1 /*
   2  * Handle connections.
   3  *
   4  * Copyright (C) 2011-2013  Simon Ruderich
   5  *
   6  * This program is free software: you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License as published by
   8  * the Free Software Foundation, either version 3 of the License, or
   9  * (at your option) any later version.
  10  *
  11  * This program is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  * GNU General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 #include "tlsproxy.h"
  21 #include "connection.h"
  22 #include "verify.h"
  23
  24 #include <errno.h>
  25 #include <netdb.h>
  26 #include <poll.h>
  27 #include <unistd.h>
  28
  29
  30 /* Maximum length of a HTTP request line. Longer request lines are aborted
  31  * with an error. The standard doesn't specify a maximum line length but this
  32  * should be a good limit to make processing simpler. As HTTPS is used this
  33  * doesn't limit long GET requests. */
  34 #define MAX_REQUEST_LINE 4096
  35
  36 /* Format string used to send HTTP/1.0 error responses to the client.
  37  *
  38  * %s is used 4 times, first three are the error code (no %n$s!), the last is
  39  * the message. */
  40 #define HTTP_RESPONSE_FORMAT "HTTP/1.0 %s\r\n\
  41 Content-Type: text/html; charset=US-ASCII\r\n\
  42 \r\n\
  43 <!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">\n\
  44 <html>\n\
  45 <head><title>%s</title></head>\n\
  46 <body>\n\
  47 <h1>%s</h1>\n\
  48 <p>%s</p>\n\
  49 </body>\n\
  50 </html>\n"
  51
  52
  53 static int initialize_tls_session_client(int peer_socket,
  54         const char *hostname,
  55         gnutls_session_t *session,
  56         gnutls_certificate_credentials_t *x509_cred);
  57 static int initialize_tls_session_server(int peer_socket,
  58         gnutls_session_t *session,
  59         gnutls_certificate_credentials_t *x509_cred);
  60
  61 static int fdopen_read_write(int socket, FILE **read_fd, FILE **write_fd);
  62 static int read_http_request(FILE *client_fd, char *request, size_t length);
  63 static void send_bad_request(FILE *client_fd);
  64 static void send_forwarding_failure(FILE *client_fd);
  65 static void tls_send_invalid_cert_message(gnutls_session_t session);
  66
  67 static void transfer_data(int client, int server);
  68 static int read_from_write_to(int from, int to);
  69 static void transfer_data_tls(int client, int server,
  70                               gnutls_session_t client_session,
  71                               gnutls_session_t server_session);
  72 static int read_from_write_to_tls(gnutls_session_t from, gnutls_session_t to,
  73                                   size_t buffer_size);
  74
  75 static int connect_to_host(const char *hostname, const char *port);
  76
  77 static int parse_request(const char *buffer, char *host, char *port,
  78                                              int *version_minor);
  79
  80
  81 void handle_connection(int client_socket) {
  82     int server_socket;
  83     FILE *client_fd_read, *client_fd_write, *server_fd_read, *server_fd_write;
  84
  85     char buffer[MAX_REQUEST_LINE];
  86     char host[MAX_REQUEST_LINE];
  87     char port[5 + 1];
  88
  89     int version_minor; /* x in HTTP/1.x */
  90     int result;
  91
  92     /* client_x509_cred is used when talking to the client (acting as a TSL
  93      * server), server_x509_cred is used when talking to the server (acting as
  94      * a TSL client). */
  95     gnutls_certificate_credentials_t client_x509_cred, server_x509_cred;
  96
  97     gnutls_session_t client_session, server_session;
  98     /* initialize_tls_session_*() called? - used for goto out */
  99     int client_session_init, server_session_init;
 100     /* gnutls_handshake() called? - used for goto out */
 101     int client_session_started, server_session_started;
 102     /* Validation failed? If yes we need to send the special "invalid"
 103      * certificate. */
 104     int validation_failed;
 105
 106     LOG(DEBUG, "new connection");
 107
 108     server_socket = -1;
 109     client_fd_read = NULL;
 110     client_fd_write = NULL;
 111     server_fd_read = NULL;
 112     server_fd_write = NULL;
 113     client_session_init = 0;
 114     server_session_init = 0;
 115     client_session_started = 0;
 116     server_session_started = 0;
 117     validation_failed = 0;
 118
 119     if (fdopen_read_write(client_socket, &client_fd_read,
 120                                          &client_fd_write) != 0) {
 121         goto out;
 122     }
 123
 124     /* Read request line (CONNECT ..) and headers (they are discarded). */
 125     result = read_http_request(client_fd_read, buffer, sizeof(buffer));
 126     if (result == -1) {
 127         LOG(WARNING, "read_http_request(): client read error");
 128         goto out;
 129     } else if (result == -2) {
 130         LOG(WARNING, "read_http_request(): client EOF");
 131         send_bad_request(client_fd_write);
 132         goto out;
 133     }
 134
 135     if (parse_request(buffer, host, port, &version_minor) != 0) {
 136         LOG(WARNING, "bad request: %s", buffer);
 137         send_bad_request(client_fd_write);
 138         goto out;
 139     }
 140
 141     LOG(DEBUG, "target: %s:%s (HTTP 1.%d)", host, port, version_minor);
 142
 143     /* Connect to proxy server or directly to server. */
 144     if (global_proxy_host != NULL && global_proxy_port != NULL) {
 145         LOG(DEBUG, "connecting to %s:%s", global_proxy_host,
 146                                               global_proxy_port);
 147         server_socket = connect_to_host(global_proxy_host, global_proxy_port);
 148     } else {
 149         LOG(DEBUG, "connecting to %s:%s", host, port);
 150         server_socket = connect_to_host(host, port);
 151     }
 152
 153     if (server_socket == -1) {
 154         LOG(WARNING, "failed to connect to server");
 155         send_forwarding_failure(client_fd_write);
 156         goto out;
 157     }
 158     if (fdopen_read_write(server_socket, &server_fd_read,
 159                                          &server_fd_write) != 0) {
 160         send_forwarding_failure(client_fd_write);
 161         goto out;
 162     }
 163
 164     /* Connect to proxy if requested (command line option). */
 165     if (global_proxy_host != NULL && global_proxy_port != NULL) {
 166         fprintf(server_fd_write, "CONNECT %s:%s HTTP/1.0\r\n", host, port);
 167         fprintf(server_fd_write, "\r\n");
 168         fflush(server_fd_write);
 169
 170         /* Read response line from proxy server. */
 171         result = read_http_request(server_fd_read, buffer, sizeof(buffer));
 172         if (result == -1) {
 173             LOG(WARNING, "read_http_request(): proxy read error");
 174             send_forwarding_failure(client_fd_write);
 175             goto out;
 176         } else if (result == -2) {
 177             LOG(WARNING, "read_http_request(): proxy EOF");
 178             send_forwarding_failure(client_fd_write);
 179             goto out;
 180         }
 181
 182         /* Check response of proxy server. */
 183         if (strncmp(buffer, "HTTP/1.0 200", 12)) {
 184             LOG(WARNING, "bad proxy response: %s", buffer);
 185             send_forwarding_failure(client_fd_write);
 186             goto out;
 187         }
 188     }
 189
 190     LOG(DEBUG, "connection to server established");
 191
 192     /* If the -u option is used and we don't know this hostname's server
 193      * certificate then just pass through the connection and let the client
 194      * verify the server certificate. */
 195     if (global_passthrough_unknown) {
 196         char path[TLSPROXY_MAX_PATH_LENGTH];
 197         FILE *file = NULL;
 198
 199         if (server_certificate_file(&file, host, path, sizeof(path)) == -2) {
 200             /* We've established a connection, tell the client. */
 201             fprintf(client_fd_write, "HTTP/1.0 200 Connection established\r\n");
 202             fprintf(client_fd_write, "\r\n");
 203             fflush(client_fd_write);
 204
 205             LOG(DEBUG, "transferring data");
 206
 207             /* Proxy data between client and server until one side is done
 208              * (EOF or error). */
 209             transfer_data(client_socket, server_socket);
 210
 211             LOG(DEBUG, "finished transferring data");
 212
 213             goto out;
 214         }
 215         /* server_certificate_file() may have opened the file, close it. */
 216         if (file != NULL) {
 217             fclose(file);
 218         }
 219     }
 220
 221     /* Initialize TLS client credentials to talk to the server. */
 222     result = initialize_tls_session_server(server_socket, &server_session,
 223                                                           &server_x509_cred);
 224     if (result != 0) {
 225         LOG(WARNING, "initialize_tls_session_server() failed");
 226         send_forwarding_failure(client_fd_write);
 227         goto out;
 228     }
 229     server_session_init = 1;
 230
 231     LOG(DEBUG, "starting server TLS handshake");
 232
 233     /* Try to establish TLS handshake between us and server. */
 234     result = gnutls_handshake(server_session);
 235     if (result != GNUTLS_E_SUCCESS) {
 236         LOG(WARNING, "server TLS handshake failed: %s",
 237                          gnutls_strerror(result));
 238         send_forwarding_failure(client_fd_write);
 239         goto out;
 240     }
 241     server_session_started = 1;
 242
 243     LOG(DEBUG, "server TLS handshake finished");
 244
 245     /* Make sure the server certificate is valid and known. */
 246     if (verify_tls_connection(server_session, host) != 0) {
 247         LOG(ERROR, "server certificate validation failed!");
 248         /* We'll send the error message over our TLS connection to the client,
 249          * but with an invalid certificate. No data is transfered from/to the
 250          * target server. */
 251         validation_failed = 1;
 252     }
 253
 254     /* Initialize TLS server credentials to talk to the client. */
 255     result = initialize_tls_session_client(client_socket,
 256                                            /* use a special host if the server
 257                                             * certificate was invalid */
 258                                            (validation_failed) ? "invalid"
 259                                                                : host,
 260                                            &client_session,
 261                                            &client_x509_cred);
 262     if (result != 0) {
 263         LOG(WARNING, "initialize_tls_session_client() failed");
 264         send_forwarding_failure(client_fd_write);
 265         goto out;
 266     }
 267     client_session_init = 1;
 268
 269     /* We've established a connection, tell the client. */
 270     fprintf(client_fd_write, "HTTP/1.0 200 Connection established\r\n");
 271     fprintf(client_fd_write, "\r\n");
 272     fflush(client_fd_write);
 273
 274     LOG(DEBUG, "starting client TLS handshake");
 275
 276     /* Try to establish TLS handshake between client and us. */
 277     result = gnutls_handshake(client_session);
 278     if (result != GNUTLS_E_SUCCESS) {
 279         LOG(WARNING, "client TLS handshake failed: %s",
 280                          gnutls_strerror(result));
 281         send_forwarding_failure(client_fd_write);
 282         goto out;
 283     }
 284     client_session_started = 1;
 285
 286     LOG(DEBUG, "client TLS handshake finished");
 287
 288     /* Tell the client that the verification failed. Shouldn't be necessary as
 289      * the client should terminate the connection because he received the
 290      * invalid certificate but better be sure. */
 291     if (validation_failed) {
 292         tls_send_invalid_cert_message(client_session);
 293         goto out;
 294     }
 295
 296     LOG(DEBUG, "transferring TLS data");
 297
 298     /* Proxy data between client and server until one side is done (EOF or
 299      * error). */
 300     transfer_data_tls(client_socket, server_socket,
 301                       client_session, server_session);
 302
 303     LOG(DEBUG, "finished transferring TLS data");
 304
 305 out:
 306     /* Close TLS sessions if necessary. Use GNUTLS_SHUT_RDWR so the data is
 307      * reliable transmitted. */
 308     if (server_session_started) {
 309         gnutls_bye(server_session, GNUTLS_SHUT_RDWR);
 310     }
 311     if (client_session_started) {
 312         gnutls_bye(client_session, GNUTLS_SHUT_RDWR);
 313     }
 314     if (server_session_init) {
 315         gnutls_deinit(server_session);
 316         gnutls_certificate_free_credentials(server_x509_cred);
 317     }
 318     if (client_session_init) {
 319         gnutls_deinit(client_session);
 320         gnutls_certificate_free_cas(client_x509_cred);
 321         gnutls_certificate_free_keys(client_x509_cred);
 322         gnutls_certificate_free_credentials(client_x509_cred);
 323     }
 324
 325     /* Close connection to server/proxy. */
 326     if (server_fd_read != NULL) {
 327         if (server_fd_write != NULL) {
 328             fclose(server_fd_write);
 329         }
 330         fclose(server_fd_read);
 331     } else if (server_socket != -1) {
 332         close(server_socket);
 333     }
 334     LOG(DEBUG, "connection to server closed");
 335     /* Close connection to client. */
 336     if (client_fd_read != NULL) {
 337         if (client_fd_write != NULL) {
 338             fclose(client_fd_write);
 339         }
 340         fclose(client_fd_read);
 341     } else {
 342         close(client_socket);
 343     }
 344     LOG(DEBUG, "connection to client closed");
 345
 346     LOG(DEBUG, "connection finished");
 347 }
 348
 349
 350 static int initialize_tls_session_client(int peer_socket,
 351         const char *hostname,
 352         gnutls_session_t *session,
 353         gnutls_certificate_credentials_t *x509_cred) {
 354     int result;
 355     int use_invalid_cert;
 356     char path[TLSPROXY_MAX_PATH_LENGTH];
 357
 358     /* The "invalid" hostname is special. If it's used we send an invalid
 359      * certificate to let the client know something is wrong. */
 360     use_invalid_cert = (!strcmp(hostname, "invalid"));
 361
 362     if (proxy_certificate_path(hostname, path, sizeof(path)) != 0) {
 363         LOG(ERROR,
 364             "initialize_tls_session_client(): \
 365 failed to get proxy certificate path");
 366         return -1;
 367     }
 368
 369     result = gnutls_certificate_allocate_credentials(x509_cred);
 370     if (result != GNUTLS_E_SUCCESS) {
 371         LOG(ERROR,
 372             "initialize_tls_session_client(): \
 373 gnutls_certificate_allocate_credentials(): %s",
 374             gnutls_strerror(result));
 375         return -1;
 376     }
 377
 378     /* Load proxy CA file, this CA "list" is send to the client. */
 379     if (!use_invalid_cert) {
 380         result = gnutls_certificate_set_x509_trust_file(*x509_cred,
 381                                                         PROXY_CA_FILE,
 382                                                         GNUTLS_X509_FMT_PEM);
 383         if (result <= 0) {
 384             LOG(ERROR,
 385                 "initialize_tls_session_client(): can't read CA file: '%s'",
 386                 PROXY_CA_FILE);
 387             gnutls_certificate_free_credentials(*x509_cred);
 388             return -1;
 389         }
 390     }
 391     /* If the invalid hostname was specified do nothing, we use a self-signed
 392      * certificate in this case. */
 393
 394     /* And certificate for this website and proxy's private key. */
 395     if (!use_invalid_cert) {
 396         result = gnutls_certificate_set_x509_key_file(*x509_cred,
 397                                                       path, PROXY_KEY_FILE,
 398                                                       GNUTLS_X509_FMT_PEM);
 399     /* If the invalid hostname was specified load our special "invalid"
 400      * certificate. */
 401     } else {
 402         result = gnutls_certificate_set_x509_key_file(*x509_cred,
 403                                                       PROXY_INVALID_CERT_FILE,
 404                                                       PROXY_KEY_FILE,
 405                                                       GNUTLS_X509_FMT_PEM);
 406     }
 407     if (result != GNUTLS_E_SUCCESS) {
 408         LOG(ERROR,
 409             "initialize_tls_session_client(): \
 410 can't read server certificate ('%s') or key file ('%s'): %s",
 411             path, PROXY_KEY_FILE, gnutls_strerror(result));
 412         gnutls_certificate_free_credentials(*x509_cred);
 413         /* Could be a missing certificate. */
 414         return -2;
 415     }
 416
 417     gnutls_certificate_set_dh_params(*x509_cred, global_tls_dh_params);
 418
 419     result = gnutls_init(session, GNUTLS_SERVER);
 420     if (result != GNUTLS_E_SUCCESS) {
 421         LOG(ERROR,
 422             "initialize_tls_session_client(): gnutls_init(): %s",
 423             gnutls_strerror(result));
 424         gnutls_certificate_free_credentials(*x509_cred);
 425         return -1;
 426     }
 427     result = gnutls_priority_set(*session, global_tls_priority_cache);
 428     if (result != GNUTLS_E_SUCCESS) {
 429         LOG(ERROR,
 430             "initialize_tls_session_client(): gnutls_priority_set(): %s",
 431             gnutls_strerror(result));
 432         gnutls_deinit(*session);
 433         gnutls_certificate_free_credentials(*x509_cred);
 434         return -1;
 435     }
 436     result = gnutls_credentials_set(*session,
 437                                     GNUTLS_CRD_CERTIFICATE, *x509_cred);
 438     if (result != GNUTLS_E_SUCCESS) {
 439         LOG(ERROR,
 440             "initialize_tls_session_client(): gnutls_credentials_set(): %s",
 441             gnutls_strerror(result));
 442         gnutls_deinit(*session);
 443         gnutls_certificate_free_credentials(*x509_cred);
 444         return -1;
 445     }
 446
 447     gnutls_transport_set_ptr(*session, (gnutls_transport_ptr_t)peer_socket);
 448
 449     return 0;
 450 }
 451 static int initialize_tls_session_server(int peer_socket,
 452         gnutls_session_t *session,
 453         gnutls_certificate_credentials_t *x509_cred) {
 454     int result;
 455
 456     result = gnutls_certificate_allocate_credentials(x509_cred);
 457     if (result != GNUTLS_E_SUCCESS) {
 458         LOG(ERROR,
 459             "initialize_tls_session_server(): \
 460 gnutls_certificate_allocate_credentials(): %s",
 461             gnutls_strerror(result));
 462         return -1;
 463     }
 464
 465     result = gnutls_init(session, GNUTLS_CLIENT);
 466     if (result != GNUTLS_E_SUCCESS) {
 467         LOG(ERROR,
 468             "initialize_tls_session_server(): gnutls_init(): %s",
 469             gnutls_strerror(result));
 470         gnutls_certificate_free_credentials(*x509_cred);
 471         return -1;
 472     }
 473     result = gnutls_priority_set(*session, global_tls_priority_cache);
 474     if (result != GNUTLS_E_SUCCESS) {
 475         LOG(ERROR,
 476             "initialize_tls_session_server(): gnutls_priority_set(): %s",
 477             gnutls_strerror(result));
 478         gnutls_deinit(*session);
 479         gnutls_certificate_free_credentials(*x509_cred);
 480         return -1;
 481     }
 482     result = gnutls_credentials_set(*session,
 483                                     GNUTLS_CRD_CERTIFICATE, *x509_cred);
 484     if (result != GNUTLS_E_SUCCESS) {
 485         LOG(ERROR,
 486             "initialize_tls_session_server(): gnutls_credentials_set(): %s",
 487             gnutls_strerror(result));
 488         gnutls_deinit(*session);
 489         gnutls_certificate_free_credentials(*x509_cred);
 490         return -1;
 491     }
 492
 493     gnutls_transport_set_ptr(*session, (gnutls_transport_ptr_t)peer_socket);
 494
 495     return 0;
 496 }
 497
 498
 499 static int fdopen_read_write(int socket, FILE **read_fd, FILE **write_fd) {
 500     *read_fd = fdopen(socket, "r");
 501     if (*read_fd == NULL) {
 502         LOG_PERROR(WARNING, "fdopen_read_write(): fdopen(\"r\") failed");
 503         return -1;
 504     }
 505
 506     *write_fd = fdopen(dup(socket), "w");
 507     if (*write_fd == NULL) {
 508         LOG_PERROR(WARNING, "fdopen_read_write(): fdopen(\"w\") failed");
 509         fclose(*read_fd);
 510         *read_fd = NULL; /* "tell" caller read_fd is already closed */
 511         return -1;
 512     }
 513
 514     return 0;
 515 }
 516
 517 /* Read HTTP request line and headers (ignored).
 518  *
 519  * On success 0 is returned, -1 on client error, -2 on unexpected EOF.
 520  */
 521 static int read_http_request(FILE *client_fd, char *request, size_t length) {
 522     char buffer[MAX_REQUEST_LINE];
 523
 524     if (fgets(request, (int)length, client_fd) == NULL) {
 525         if (ferror(client_fd)) {
 526             LOG_PERROR(WARNING, "read_http_request(): fgets()");
 527             return -1;
 528         }
 529         /* EOF */
 530         return -2;
 531     }
 532
 533     while (fgets(buffer, sizeof(buffer), client_fd) != NULL) {
 534         /* End of header. */
 535         if (!strcmp(buffer, "\n") || !strcmp(buffer, "\r\n")) {
 536             break;
 537         }
 538     }
 539     if (ferror(client_fd)) {
 540         LOG_PERROR(WARNING, "read_http_request(): fgets()");
 541         return -1;
 542     }
 543
 544     return 0;
 545 }
 546
 547 static void send_bad_request(FILE *client_fd) {
 548 #define RESPONSE_ERROR "400 Bad Request"
 549 #define RESPONSE_MSG   "Your browser sent an invalid request."
 550     fprintf(client_fd, HTTP_RESPONSE_FORMAT,
 551                        RESPONSE_ERROR, RESPONSE_ERROR, RESPONSE_ERROR,
 552                        RESPONSE_MSG);
 553     fflush(client_fd);
 554 #undef RESPONSE_ERROR
 555 #undef RESPONSE_MSG
 556 }
 557 static void send_forwarding_failure(FILE *client_fd) {
 558 #define RESPONSE_ERROR "503 Forwarding failure"
 559 #define RESPONSE_MSG   "Failed to connect to server, check logs."
 560     fprintf(client_fd, HTTP_RESPONSE_FORMAT,
 561                        RESPONSE_ERROR, RESPONSE_ERROR, RESPONSE_ERROR,
 562                        RESPONSE_MSG);
 563     fflush(client_fd);
 564 #undef RESPONSE_ERROR
 565 #undef RESPONSE_MSG
 566 }
 567 static void tls_send_invalid_cert_message(gnutls_session_t session) {
 568 #define RESPONSE_ERROR "500 Internal Server Error"
 569 #define RESPONSE_MSG   "Server certificate validation failed, check logs."
 570
 571     int result;
 572     char buffer[sizeof(HTTP_RESPONSE_FORMAT) - 1 /* '\0' */
 573                                              - 4 * 2 /* four %s */
 574                 + (sizeof(RESPONSE_ERROR) - 1 /* '\0' */) * 3
 575                 + sizeof(RESPONSE_MSG)    - 1 /* '\0' */
 576                 + 1 /* '\0' */];
 577
 578     result = snprintf(buffer, sizeof(buffer),
 579                       HTTP_RESPONSE_FORMAT,
 580                       RESPONSE_ERROR, RESPONSE_ERROR, RESPONSE_ERROR,
 581                       RESPONSE_MSG);
 582     if (result < 0) {
 583         LOG_PERROR(ERROR,
 584                    "tls_send_invalid_cert_message(): snprintf failed");
 585         return;
 586     } else if ((size_t)result >= sizeof(buffer)) {
 587         LOG(ERROR,
 588             "tls_send_invalid_cert_message(): snprintf buffer too short");
 589         return;
 590     }
 591
 592     gnutls_record_send(session, buffer, sizeof(buffer) - 1);
 593                                         /* don't send trailing '\0' */
 594 #undef RESPONSE_ERROR
 595 #undef RESPONSE_MSG
 596 }
 597
 598
 599 /* Transfer data between client and server sockets until one closes the
 600  * connection. */
 601 static void transfer_data(int client, int server) {
 602     struct pollfd fds[2];
 603     fds[0].fd      = client;
 604     fds[0].events  = POLLIN | POLLPRI | POLLHUP | POLLERR;
 605     fds[0].revents = 0;
 606     fds[1].fd      = server;
 607     fds[1].events  = POLLIN | POLLPRI | POLLHUP | POLLERR;
 608     fds[1].revents = 0;
 609
 610     for (;;) {
 611         int result = poll(fds, 2 /* fd count */, -1 /* no timeout */);
 612         if (result < 0) {
 613             LOG_PERROR(ERROR, "transfer_data(): poll()");
 614             return;
 615         }
 616
 617         /* Data available from client. */
 618         if (fds[0].revents & POLLIN || fds[0].revents & POLLPRI) {
 619             if (read_from_write_to(client, server) != 0) {
 620                 /* EOF (or other error) */
 621                 break;
 622             }
 623         }
 624         /* Data available from server. */
 625         if (fds[1].revents & POLLIN || fds[1].revents & POLLPRI) {
 626             if (read_from_write_to(server, client) != 0) {
 627                 /* EOF (or other error) */
 628                 break;
 629             }
 630         }
 631
 632         /* Client closed connection. */
 633         if (fds[0].revents & POLLERR || fds[0].revents & POLLHUP) {
 634             break;
 635         }
 636         /* Server closed connection. */
 637         if (fds[1].revents & POLLERR || fds[1].revents & POLLHUP) {
 638             break;
 639         }
 640     }
 641 }
 642
 643 /* Read available data from socket from and write it to socket to. At maximum
 644  * 4096 bytes are read/written. */
 645 static int read_from_write_to(int from, int to) {
 646     ssize_t size_read;
 647     ssize_t size_written;
 648     char buffer[4096];
 649
 650     LOG(DEBUG, "read_from_write_to(): %d -> %d", from, to);
 651
 652     size_read = read(from, buffer, sizeof(buffer));
 653     if (size_read < 0) {
 654         LOG_PERROR(WARNING, "read_from_write_to(): read()");
 655         return -1;
 656     /* EOF */
 657     } else if (size_read == 0) {
 658         return -1;
 659     }
 660
 661     size_written = write(to, buffer, (size_t)size_read);
 662     if (size_written < 0) {
 663         LOG_PERROR(WARNING, "read_from_write_to(): write()");
 664         return -1;
 665     }
 666     if (size_read != size_written) {
 667         LOG(ERROR, "read_from_write_to(): only written %ld of %ld bytes!",
 668                        (long int)size_written, (long int)size_read);
 669         return -1;
 670     }
 671
 672     return 0;
 673 }
 674
 675 /* Transfer data between client and server TLS connection until one closes the
 676  * connection. */
 677 static void transfer_data_tls(int client, int server,
 678                               gnutls_session_t client_session,
 679                               gnutls_session_t server_session) {
 680     size_t buffer_size;
 681
 682     struct pollfd fds[2];
 683     fds[0].fd      = client;
 684     fds[0].events  = POLLIN | POLLPRI | POLLHUP | POLLERR;
 685     fds[0].revents = 0;
 686     fds[1].fd      = server;
 687     fds[1].events  = POLLIN | POLLPRI | POLLHUP | POLLERR;
 688     fds[1].revents = 0;
 689
 690     /* Get maximum possible buffer size. */
 691     buffer_size = gnutls_record_get_max_size(client_session);
 692     if (gnutls_record_get_max_size(server_session) < buffer_size) {
 693         buffer_size = gnutls_record_get_max_size(server_session);
 694     }
 695     LOG(DEBUG, "transfer_data_tls(): suggested buffer size: %ld",
 696                    (long int)buffer_size);
 697
 698     for (;;) {
 699         int result = poll(fds, 2 /* fd count */, -1 /* no timeout */);
 700         if (result < 0) {
 701             LOG_PERROR(ERROR, "transfer_data(): poll()");
 702             return;
 703         }
 704
 705         /* Data available from client. */
 706         if (fds[0].revents & POLLIN || fds[0].revents & POLLPRI) {
 707             if (read_from_write_to_tls(client_session, server_session,
 708                                        buffer_size) != 0) {
 709                 /* EOF (or other error) */
 710                 break;
 711             }
 712         }
 713         /* Data available from server. */
 714         if (fds[1].revents & POLLIN || fds[1].revents & POLLPRI) {
 715             if (read_from_write_to_tls(server_session, client_session,
 716                                        buffer_size) != 0) {
 717                 /* EOF (or other error) */
 718                 break;
 719             }
 720         }
 721
 722         /* Client closed connection. */
 723         if (fds[0].revents & POLLERR || fds[0].revents & POLLHUP) {
 724             break;
 725         }
 726         /* Server closed connection. */
 727         if (fds[1].revents & POLLERR || fds[1].revents & POLLHUP) {
 728             break;
 729         }
 730     }
 731 }
 732
 733 /* Read available data from session from and write to session to. */
 734 static int read_from_write_to_tls(gnutls_session_t from,
 735                                   gnutls_session_t to,
 736                                   size_t buffer_size) {
 737     ssize_t size_read;
 738     ssize_t size_written;
 739     char buffer[16384];
 740
 741     if (buffer_size > sizeof(buffer)) {
 742         buffer_size = sizeof(buffer);
 743     }
 744     LOG(DEBUG, "read_from_write_to_tls(): used buffer size: %ld",
 745                    (long int)buffer_size);
 746
 747     size_read = gnutls_record_recv(from, buffer, buffer_size);
 748     if (size_read < 0) {
 749         LOG(WARNING, "read_from_write_to_tls(): gnutls_record_recv(): %s",
 750                          gnutls_strerror((int)size_read));
 751         return -1;
 752     /* EOF */
 753     } else if (size_read == 0) {
 754         return -1;
 755     }
 756
 757     size_written = gnutls_record_send(to, buffer, (size_t)size_read);
 758     if (size_written < 0) {
 759         LOG(WARNING, "read_from_write_to_tls(): gnutls_record_send(): %s",
 760                          gnutls_strerror((int)size_written));
 761         return -1;
 762     }
 763     if (size_read != size_written) {
 764         LOG(ERROR, "read_from_write_to_tls(): only written %ld of %ld bytes!",
 765                        (long int)size_written, (long int)size_read);
 766         return -1;
 767     }
 768
 769     return 0;
 770 }
 771
 772
 773 static int connect_to_host(const char *hostname, const char *port) {
 774     struct addrinfo gai_hints;
 775     struct addrinfo *gai_result;
 776     int gai_return;
 777
 778     int server_socket;
 779     struct addrinfo *server;
 780
 781     if (hostname == NULL || port == NULL) {
 782         return -1;
 783     }
 784
 785     /* Get IP of hostname server. */
 786     memset(&gai_hints, 0, sizeof(gai_hints));
 787     gai_hints.ai_family   = AF_UNSPEC;
 788     gai_hints.ai_socktype = SOCK_STREAM;
 789     gai_hints.ai_protocol = 0;
 790     gai_hints.ai_flags    = AI_NUMERICSERV /* given port is numeric */
 791                           | AI_ADDRCONFIG  /* supported by this computer */
 792                           | AI_V4MAPPED;   /* support IPv4 through IPv6 */
 793     gai_return = getaddrinfo(hostname, port, &gai_hints, &gai_result);
 794     if (gai_return != 0) {
 795         if (gai_return == EAI_SYSTEM) {
 796             LOG_PERROR(WARNING, "connect_to_host(): getaddrinfo()");
 797         } else {
 798             LOG(WARNING, "connect_to_host(): getaddrinfo(): %s",
 799                              gai_strerror(gai_return));
 800         }
 801         return -1;
 802     }
 803
 804     /* Now try to connect to each server returned by getaddrinfo(), use the
 805      * first successful connect. */
 806     for (server = gai_result; server != NULL; server = server->ai_next) {
 807         server_socket = socket(server->ai_family,
 808                                server->ai_socktype,
 809                                server->ai_protocol);
 810         if (server_socket == -1) {
 811             LOG_PERROR(DEBUG, "connect_to_host(): socket(), trying next");
 812             continue;
 813         }
 814
 815         if (connect(server_socket, server->ai_addr, server->ai_addrlen) != -1) {
 816             break;
 817         }
 818         LOG_PERROR(DEBUG, "connect_to_host(): connect(), trying next");
 819
 820         close(server_socket);
 821     }
 822     /* Make sure we free the result from getaddrinfo(). */
 823     freeaddrinfo(gai_result);
 824
 825     if (server == NULL) {
 826         LOG_PERROR(WARNING, "connect_to_host(): no server found, abort");
 827         return -1;
 828     }
 829
 830     return server_socket;
 831 }
 832
 833
 834 /* Parse HTTP CONNECT request string and save its parameters.
 835  *
 836  * The following format is expected: "CONNECT host:port HTTP/1.x".
 837  *
 838  * request and host must have the same size! port must be at least 6 bytes
 839  * long (5 + '\0').
 840  */
 841 static int parse_request(const char *request, char *host, char *port,
 842                                               int *version_minor) {
 843     int port_unused; /* just used to verify the port is numeric */
 844     char *position;
 845
 846     /* scanf() doesn't check spaces. */
 847     if (strncmp(request, "CONNECT ", 8)) {
 848         return -1;
 849     }
 850     /* Check request and extract data, "host:port" is not yet separated. */
 851     if (sscanf(request, "CONNECT %s HTTP/1.%d", host, version_minor) != 2) {
 852         return -1;
 853     }
 854     /* Make sure ":port" is there. */
 855     if ((position = strchr(host, ':')) == NULL) {
 856         return -1;
 857     }
 858     /* Make sure port is numeric. */
 859     if (sscanf(position + 1, "%d", &port_unused) != 1) {
 860         return -1;
 861     }
 862     /* Store it in *port. */
 863     strncpy(port, position + 1, 5);
 864     port[5] = '\0';
 865     /* And remove port from host. */
 866     *position = '\0';
 867
 868     return 0;
 869 }