src/connection.c: Use "invalid" certificate when the server certificate changes.

This special "invalid" certificate lets the client know there was a
problem.

diff --git a/src/connection.c b/src/connection.c
index 1421afa0c384073e51776b5bda129f031d1fcf29..2732f30caa9b700e3d6664262312c14a46afd8d5 100644 (file)
--- a/src/connection.c
+++ b/src/connection.c
@@ -48,7 +48,7 @@ static int initialize_tls_session_server(int peer_socket,
 static int read_http_request(FILE *client_fd, char *request, size_t length);
 static void send_bad_request(FILE *client_fd);
 static void send_forwarding_failure(FILE *client_fd);
-static void tls_send_server_error(gnutls_session_t session);
+static void tls_send_invalid_cert_message(gnutls_session_t session);
 
 #if 0
 static void transfer_data(int client, int server);
@@ -86,6 +86,9 @@ void handle_connection(int client_socket) {
     int client_session_init, server_session_init;
     /* gnutls_handshake() called? - used for goto out */
     int client_session_started, server_session_started;
+    /* Validation failed? If yes we need to send the special "invalid"
+     * certificate. */
+    int validation_failed;
 
     LOG(LOG_DEBUG, "new connection");
 
@@ -96,6 +99,7 @@ void handle_connection(int client_socket) {
     server_session_init = 0;
     client_session_started = 0;
     server_session_started = 0;
+    validation_failed = 0;
 
     client_fd = fdopen(client_socket, "a+");
     if (NULL == client_fd) {
@@ -175,36 +179,6 @@ void handle_connection(int client_socket) {
 
     LOG(LOG_DEBUG, "connection to server established");
 
-    /* We've established a connection, tell the client. */
-    fprintf(client_fd, "HTTP/1.0 200 Connection established\r\n");
-    fprintf(client_fd, "\r\n");
-    fflush(client_fd);
-
-    /* Initialize TLS server credentials to talk to the client. */
-    result = initialize_tls_session_client(client_socket, host,
-                                           &client_session,
-                                           &client_x509_cred);
-    if (0 != result) {
-        LOG(LOG_WARNING, "initialize_tls_session_client() failed");
-        send_forwarding_failure(client_fd);
-        goto out;
-    }
-    client_session_init = 1;
-
-    LOG(LOG_DEBUG, "starting client TLS handshake");
-
-    /* Try to establish TLS handshake between client and us. */
-    result = gnutls_handshake(client_session);
-    if (GNUTLS_E_SUCCESS != result) {
-        LOG(LOG_WARNING, "client TLS handshake failed: %s",
-                         gnutls_strerror(result));
-        send_forwarding_failure(client_fd);
-        goto out;
-    }
-    client_session_started = 1;
-
-    LOG(LOG_DEBUG, "client TLS handshake finished");
-
     result = initialize_tls_session_server(server_socket, &server_session,
                                                           &server_x509_cred);
     /* Initialize TLS client credentials to talk to the server. */
@@ -227,14 +201,59 @@ void handle_connection(int client_socket) {
     }
     server_session_started = 1;
 
-    LOG(LOG_DEBUG, "server TLS handshake finished, transferring data");
+    LOG(LOG_DEBUG, "server TLS handshake finished");
 
     /* Make sure the server certificate is valid and known. */
     if (0 != verify_tls_connection(server_session, host)) {
         LOG(LOG_ERROR, "server certificate validation failed!");
-        tls_send_server_error(client_session);
+        /* We send the error message over our TLS connection to the client,
+         * but with an invalid certificate. */
+        validation_failed = 1;
+    }
+
+    /* Initialize TLS server credentials to talk to the client. */
+    result = initialize_tls_session_client(client_socket,
+                                           /* use special host if the server
+                                            * certificate was invalid */
+                                           (validation_failed) ? "invalid"
+                                                               : host,
+                                           &client_session,
+                                           &client_x509_cred);
+    if (0 != result) {
+        LOG(LOG_WARNING, "initialize_tls_session_client() failed");
+        send_forwarding_failure(client_fd);
         goto out;
     }
+    client_session_init = 1;
+
+    /* We've established a connection, tell the client. */
+    fprintf(client_fd, "HTTP/1.0 200 Connection established\r\n");
+    fprintf(client_fd, "\r\n");
+    fflush(client_fd);
+
+    LOG(LOG_DEBUG, "starting client TLS handshake");
+
+    /* Try to establish TLS handshake between client and us. */
+    result = gnutls_handshake(client_session);
+    if (GNUTLS_E_SUCCESS != result) {
+        LOG(LOG_WARNING, "client TLS handshake failed: %s",
+                         gnutls_strerror(result));
+        send_forwarding_failure(client_fd);
+        goto out;
+    }
+    client_session_started = 1;
+
+    LOG(LOG_DEBUG, "client TLS handshake finished");
+
+    /* Tell the client that the verification failed. Shouldn't be necessary as
+     * the client should terminate the connection because he received the
+     * invalid certificate but better be sure. */
+    if (validation_failed) {
+        tls_send_invalid_cert_message(client_session);
+        goto out;
+    }
+
+    LOG(LOG_DEBUG, "transferring data");
 
     /* Proxy data between client and server until one suite is done (EOF or
      * error). */
@@ -287,8 +306,13 @@ static int initialize_tls_session_client(int peer_socket,
         gnutls_session_t *session,
         gnutls_certificate_credentials_t *x509_cred) {
     int result;
+    int use_invalid_cert;
     char path[1024];
 
+    /* The "invalid" hostname is special. If it's used we send an invalid
+     * certificate to let the client know something is wrong. */
+    use_invalid_cert = 0 == strcmp(hostname, "invalid");
+
     /* Hostname too long. */
     if (sizeof(path) - strlen(PROXY_SERVER_CERT_FORMAT) <= strlen(hostname)) {
         LOG(LOG_WARNING,
@@ -315,9 +339,15 @@ gnutls_certificate_allocate_credentials(): %s",
     }
 
     /* Load proxy CA file, this CA "list" is send to the client. */
-    result = gnutls_certificate_set_x509_trust_file(*x509_cred,
-                                                    PROXY_CA_FILE,
-                                                    GNUTLS_X509_FMT_PEM);
+    if (!use_invalid_cert) {
+        result = gnutls_certificate_set_x509_trust_file(*x509_cred,
+                                                        PROXY_CA_FILE,
+                                                        GNUTLS_X509_FMT_PEM);
+    /* If the invalid hostname was specified do nothing, we use a self-signed
+     * certificate in this case. */
+    } else {
+        result = 1;
+    }
     if (0 >= result) {
         LOG(LOG_ERROR,
             "initialize_tls_session_client(): can't read CA file: '%s'",
@@ -325,9 +355,18 @@ gnutls_certificate_allocate_credentials(): %s",
         return -1;
     }
     /* And certificate for this website and proxy's private key. */
-    result = gnutls_certificate_set_x509_key_file(*x509_cred,
-                                                  path, PROXY_KEY_FILE,
-                                                  GNUTLS_X509_FMT_PEM);
+    if (!use_invalid_cert) {
+        result = gnutls_certificate_set_x509_key_file(*x509_cred,
+                                                      path, PROXY_KEY_FILE,
+                                                      GNUTLS_X509_FMT_PEM);
+    /* If the invalid hostname was specified load our special "invalid"
+     * certificate. */
+    } else {
+        result = gnutls_certificate_set_x509_key_file(*x509_cred,
+                                                      PROXY_INVALID_CERT_FILE,
+                                                      PROXY_KEY_FILE,
+                                                      GNUTLS_X509_FMT_PEM);
+    }
     if (GNUTLS_E_SUCCESS != result) {
         LOG(LOG_ERROR,
             "initialize_tls_session_client(): \
@@ -447,7 +486,7 @@ static void send_forwarding_failure(FILE *client_fd) {
     fprintf(client_fd, "HTTP/1.0 503 Forwarding failure\r\n");
     fprintf(client_fd, "\r\n");
 }
-static void tls_send_server_error(gnutls_session_t session) {
+static void tls_send_invalid_cert_message(gnutls_session_t session) {
     gnutls_record_send(session, "HTTP/1.0 500 Internal Server Error\r\n", 36);
     gnutls_record_send(session, "\r\n", 2);
 }

diff --git a/src/tlsproxy.h b/src/tlsproxy.h
index c151344db84753e3b4a02119cfc2e003465973ac..bcb9c2d34255245e2918c5d492396b51ccd9e870 100644 (file)
--- a/src/tlsproxy.h
+++ b/src/tlsproxy.h
@@ -35,6 +35,9 @@
 /* Paths to necessary TLS files: the CA and the server key. */
 #define PROXY_CA_FILE  "proxy-ca.pem"
 #define PROXY_KEY_FILE "proxy-key.pem"
+/* Path to special "invalid" certificate send to the client when an error
+ * occurs. */
+#define PROXY_INVALID_CERT_FILE "proxy-invalid.pem"
 /* The server certificate for the given hostname is stored in
  * "./certificate-hostname-proxy.pem" - we use this for the connection to the
  * client. */