Merge branch 'tlsproxyhelper'

diff --git a/NEWS b/NEWS
index 3f3c66399e1542a28d592d0d374be246c570ded1..3078a208bb2529cb4f210d879438d26a40d5ffad 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -11,12 +11,13 @@ NEWS
 
     certtool --generate-dh-params --sec-param high --outfile proxy-dh.pem
 
-- Use "SECURE" as GnuTLS priority string which disallows insecure algorithms.
+- Use "SECURE" (replacing "NORMAL") as GnuTLS priority string which disallows
+  insecure algorithms.
 - Add -a option, authentication for tlsproxy via basic digest authentication.
 - Add new debug level (-d 3) for even more debug output, including information
   about the current TLS session.
 - Allow rehandshakes for server connections (%SAFE_RENEGOTIATION is forced to
-  prevent issues).
+  prevent security issues).
 - Use pre-generated Diffie-Hellman parameters in proxy-dh.pem.
 - Code cleanup.
 - Better error handling.

diff --git a/README b/README
index b0124c1279b961ebf6bdf064ff8f28ee3780296d..1e1efa7f76e8c90808fc5f1a6d419da3f806d88d 100644 (file)
--- a/README
+++ b/README
@@ -91,6 +91,11 @@ If you always verify the authentication of the connection this isn't a
 problem, but if you only check if it's a HTTPS connection then this attack is
 possible.
 
+Another issue is embedded active content, like JavaScript. If the website
+includes data from a different host (e.g. a different sub-domain), for which
+tlsproxy has no certificate, then an attacker can MITM that connection and
+inject JavaScript with unknown consequences into the browser.
+
 
 KNOWN ISSUES
 ------------

diff --git a/man/tlsproxy-add.txt b/man/tlsproxy-add.txt
index a89cda4b0b03fb1fe1c7846abded9998dfe7e1cb..fe697bb9f5bb000e4c5a9032ed2c5c6ede74f36e 100644 (file)
--- a/man/tlsproxy-add.txt
+++ b/man/tlsproxy-add.txt
@@ -25,6 +25,10 @@ the specified hostname).
 - certificate-'hostname'-proxy.pem
 - certificate-'hostname'-server.pem
 
+Be careful: The hostname must match exactly, i.e. `www.example.org` and
+`example.org` are treated differently by *tlsproxy*. This might be an issue,
+especiall when '-u' is used!
+
 Requires GnuTLS' *certtool*.
 
 

diff --git a/man/tlsproxy-setup.txt b/man/tlsproxy-setup.txt
index 9e482f3f7e7626f3079593851e406bd34c0a262b..f5cf5110df203c027296438f8bc4ef83f8ad9f59 100644 (file)
--- a/man/tlsproxy-setup.txt
+++ b/man/tlsproxy-setup.txt
@@ -10,7 +10,7 @@ tlsproxy-setup - create necessary files for tlsproxy
 SYNOPSIS
 --------
 
-*tlsproxy-setup*
+*tlsproxy-setup* ['--force']
 
 
 DESCRIPTION
@@ -21,11 +21,13 @@ empty directory.
 
 It creates the following files in the current directory:
 
-- proxy-ca.pem
-- proxy-ca-key.pem
-- proxy-dh.pem
-- proxy-key.pem
-- proxy-invalid.pem
+- `proxy-ca.pem`
+- `proxy-ca-key.pem`
+- `proxy-dh.pem`
+- `proxy-key.pem`
+- `proxy-invalid.pem`
+
+If any of these files exist, the program is aborted.
 
 Requires GnuTLS' *certtool*.
 

diff --git a/src/connection.c b/src/connection.c
index 4538f7532fd5681bf49c775c80ee36dd00f817c5..2c70b7d4f082f8fa9de3b256685e91ec23be3fc9 100644 (file)
--- a/src/connection.c
+++ b/src/connection.c
@@ -207,7 +207,7 @@ void handle_connection(int client_socket) {
     LOG(DEBUG1, "connection to server established");
 
     /* If the -u option is used and we don't know this hostname's server
-     * certificate then just pass through the connection and let the client
+     * certificate, then just pass through the connection and let the client
      * verify the server certificate. */
     if (global_passthrough_unknown) {
         char path[TLSPROXY_MAX_PATH_LENGTH];

diff --git a/src/tlsproxy-setup b/src/tlsproxy-setup
index d76c998689454c38d004a93d304f00aa932302ee..155b8c90786c9aff26a520b0d9caad45dfbec69d 100755 (executable)
--- a/src/tlsproxy-setup
+++ b/src/tlsproxy-setup
@@ -23,11 +23,23 @@
 set -e
 
 
-if test "$#" -ne 0; then
-    echo "Usage: $0"
+if test "$#" -ge 1 && test x"$*" != 'x--force'; then
+    echo "Usage: $0 [--force]" >&2
     exit 1
 fi
 
+# Prevent accidental overwrites.
+if test x"$1" != 'x--force'; then
+    for x in proxy-ca-key.pem proxy-ca.pem \
+             proxy-key.pem proxy-invalid.pem proxy-dh.pem; do
+        if test -f "$x"; then
+            echo "File '$x' already exists. Use --force to overwrite." >&2
+            exit 2
+        fi
+    done
+fi
+
+
 tempfile=`mktemp`
 trap 'rm -f "$tempfile"' EXIT
 

diff --git a/src/tlsproxy.h b/src/tlsproxy.h
index 15c5a51b8fcdfbcd6f0d230ed653f478f2db7a3b..692278e7fa4e0b5184fe19c6d38d631af69ca2cc 100644 (file)
--- a/src/tlsproxy.h
+++ b/src/tlsproxy.h
@@ -35,7 +35,7 @@
 /* Length for path arrays. */
 #define TLSPROXY_MAX_PATH_LENGTH 1024
 
-/* Paths to necessary TLS files: the CA, the server key and DH parameters. */
+/* Paths to proxy files: the CA, the server key and DH parameters. */
 #define PROXY_CA_PATH  "proxy-ca.pem"
 #define PROXY_KEY_PATH "proxy-key.pem"
 #define PROXY_DH_PATH  "proxy-dh.pem"

diff --git a/tests/tests-normal.sh b/tests/tests-normal.sh
index c16de5144b9bc0d75b9064a80a03b8ca0859565a..843b246585152e8bd0381f3db411e5f3c1247da9 100755 (executable)
--- a/tests/tests-normal.sh
+++ b/tests/tests-normal.sh
@@ -54,9 +54,9 @@ test_proxy_successful
 test_invalid_certificate
 
 echo missing proxy certificate
-mv certificate-localhost-proxy.pem .pem
+mv certificate-localhost-proxy.pem certificate-www.localhost-proxy.pem
 client localhost 4712 invalid || abort 'client localhost 4712 invalid'
-mv .pem certificate-localhost-proxy.pem
+mv certificate-www.localhost-proxy.pem certificate-localhost-proxy.pem
 test_proxy_successful
 test_invalid_certificate
 
@@ -91,16 +91,16 @@ test_invalid_certificate
 tlsproxy_add localhost server.pem
 
 echo mitm missing server certificate
-mv certificate-localhost-server.pem .pem
+mv certificate-localhost-server.pem certificate-www.localhost-server.pem
 client localhost 4712 invalid || abort 'client localhost 4712 invalid'
-mv .pem certificate-localhost-server.pem
+mv certificate-www.localhost-server.pem certificate-localhost-server.pem
 test_proxy_successful
 test_invalid_certificate
 
 echo mitm missing proxy certificate
-mv certificate-localhost-proxy.pem .pem
+mv certificate-localhost-proxy.pem certificate-www.localhost-proxy.pem
 client localhost 4712 invalid || abort 'client localhost 4712 invalid'
-mv .pem certificate-localhost-proxy.pem
+mv certificate-www.localhost-proxy.pem certificate-localhost-proxy.pem
 test_proxy_successful
 test_invalid_certificate
 

diff --git a/tests/tests-passthrough.sh b/tests/tests-passthrough.sh
index 1a94f387f1f6ab73ff73b2e2591cebfaaab09d1d..39f3d01f0165612567ac8807b2208770b7331019 100755 (executable)
--- a/tests/tests-passthrough.sh
+++ b/tests/tests-passthrough.sh
@@ -54,11 +54,11 @@ test_proxy_successful
 test_invalid_certificate
 
 echo missing proxy certificate
-mv certificate-localhost-proxy.pem .pem
+mv certificate-localhost-proxy.pem certificate-www.localhost-proxy.pem
 # "invalid" to prevent user error if the proxy certificate gets deleted (but
 # the server certificate is still readable).
 client localhost 4712 invalid || abort 'client localhost 4712 invalid'
-mv .pem certificate-localhost-proxy.pem
+mv certificate-www.localhost-proxy.pem certificate-localhost-proxy.pem
 test_proxy_successful
 test_invalid_certificate
 
@@ -93,18 +93,18 @@ test_invalid_certificate
 tlsproxy_add localhost server.pem
 
 echo mitm missing server certificate
-mv certificate-localhost-server.pem .pem
+mv certificate-localhost-server.pem certificate-www.localhost-server.pem
 client localhost 4712 'test server bad' || abort 'client localhost 4712 test server bad'
-mv .pem certificate-localhost-server.pem
+mv certificate-www.localhost-server.pem certificate-localhost-server.pem
 test_proxy_successful
 test_invalid_certificate
 
 echo mitm missing proxy certificate
-mv certificate-localhost-proxy.pem .pem
+mv certificate-localhost-proxy.pem certificate-www.localhost-proxy.pem
 # "invalid" to prevent user error if the proxy certificate gets deleted (but
 # the server certificate is still readable).
 client localhost 4712 invalid || abort 'client localhost 4712 invalid'
-mv .pem certificate-localhost-proxy.pem
+mv certificate-www.localhost-proxy.pem certificate-localhost-proxy.pem
 test_proxy_successful
 test_invalid_certificate