X-Git-Url: https://ruderich.org/simon/gitweb/?a=blobdiff_plain;f=src%2Fconnection.c;h=ac3bc21cb5db457f0553566e23cda32a690d4750;hb=2768e020f19f47e0d31ed883698a5aba1ad9d3a8;hp=513be7e6d7a2d3012ae7fa1770feb16cdc0df591;hpb=80e82203daef6daf7a16219876fc404e12f82c8a;p=tlsproxy%2Ftlsproxy.git diff --git a/src/connection.c b/src/connection.c index 513be7e..ac3bc21 100644 --- a/src/connection.c +++ b/src/connection.c @@ -1,7 +1,7 @@ /* * Handle connections. * - * Copyright (C) 2011 Simon Ruderich + * Copyright (C) 2011-2013 Simon Ruderich * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -31,11 +31,28 @@ #include -/* Maximum line of a HTTP request line. Longer request lines are aborted with - * an error. The standard doesn't specify a maximum line length but this - * should be a good limit to make processing simpler. */ +/* Maximum length of a HTTP request line. Longer request lines are aborted + * with an error. The standard doesn't specify a maximum line length but this + * should be a good limit to make processing simpler. As HTTPS is used this + * doesn't limit long GET requests. */ #define MAX_REQUEST_LINE 4096 +/* Format string used to send HTTP/1.0 error responses to the client. + * + * %s is used 4 times, first three are the error code (no %n$s!), the last is + * the message. */ +#define HTTP_RESPONSE_FORMAT "HTTP/1.0 %s\r\n\ +Content-Type: text/html; charset=US-ASCII\r\n\ +\r\n\ +\n\ +\n\ +%s\n\ +\n\ +

%s

\n\ +

\n\ +\n\ +\n" + static int initialize_tls_session_client(int peer_socket, const char *hostname, @@ -55,7 +72,8 @@ static int read_from_write_to(int from, int to); static void transfer_data_tls(int client, int server, gnutls_session_t client_session, gnutls_session_t server_session); -static int read_from_write_to_tls(gnutls_session_t from, gnutls_session_t to); +static int read_from_write_to_tls(gnutls_session_t from, gnutls_session_t to, + size_t buffer_size); static int connect_to_host(const char *hostname, const char *port); @@ -71,7 +89,7 @@ void handle_connection(int client_socket) { char host[MAX_REQUEST_LINE]; char port[5 + 1]; - int version_minor; + int version_minor; /* HTTP/1.x */ int result; /* client_x509_cred is used when talking to the client (acting as a TSL @@ -181,10 +199,10 @@ void handle_connection(int client_socket) { * certificate then just pass through the connection and let the client * verify the server certificate. */ if (global_passthrough_unknown) { - char path[1024]; + char path[TLSPROXY_MAX_PATH_LENGTH]; FILE *file = NULL; - if (-2 == server_certificate_path(&file, host, path, sizeof(path))) { + if (-2 == server_certificate_file(&file, host, path, sizeof(path))) { /* We've established a connection, tell the client. */ fprintf(client_fd, "HTTP/1.0 200 Connection established\r\n"); fprintf(client_fd, "\r\n"); @@ -192,7 +210,7 @@ void handle_connection(int client_socket) { LOG(LOG_DEBUG, "transferring data"); - /* Proxy data between client and server until one suite is done + /* Proxy data between client and server until one side is done * (EOF or error). */ transfer_data(client_socket, server_socket); @@ -200,15 +218,15 @@ void handle_connection(int client_socket) { goto out; } - /* server_certificate_path() may open the file, close it. */ + /* server_certificate_file() may have opened the file, close it. */ if (NULL != file) { fclose(file); } } + /* Initialize TLS client credentials to talk to the server. */ result = initialize_tls_session_server(server_socket, &server_session, &server_x509_cred); - /* Initialize TLS client credentials to talk to the server. */ if (0 != result) { LOG(LOG_WARNING, "initialize_tls_session_server() failed"); send_forwarding_failure(client_fd); @@ -234,13 +252,14 @@ void handle_connection(int client_socket) { if (0 != verify_tls_connection(server_session, host)) { LOG(LOG_ERROR, "server certificate validation failed!"); /* We send the error message over our TLS connection to the client, - * but with an invalid certificate. */ + * but with an invalid certificate. No data is transfered from/to the + * target server. */ validation_failed = 1; } /* Initialize TLS server credentials to talk to the client. */ result = initialize_tls_session_client(client_socket, - /* use special host if the server + /* use a special host if the server * certificate was invalid */ (validation_failed) ? "invalid" : host, @@ -282,7 +301,7 @@ void handle_connection(int client_socket) { LOG(LOG_DEBUG, "transferring TLS data"); - /* Proxy data between client and server until one suite is done (EOF or + /* Proxy data between client and server until one side is done (EOF or * error). */ transfer_data_tls(client_socket, server_socket, client_session, server_session); @@ -334,27 +353,18 @@ static int initialize_tls_session_client(int peer_socket, gnutls_certificate_credentials_t *x509_cred) { int result; int use_invalid_cert; - char path[1024]; + char path[TLSPROXY_MAX_PATH_LENGTH]; /* The "invalid" hostname is special. If it's used we send an invalid * certificate to let the client know something is wrong. */ - use_invalid_cert = 0 == strcmp(hostname, "invalid"); + use_invalid_cert = (0 == strcmp(hostname, "invalid")); - /* Hostname too long. */ - if (sizeof(path) - strlen(PROXY_SERVER_CERT_FORMAT) <= strlen(hostname)) { - LOG(LOG_WARNING, - "initialize_tls_session_client(): hostname too long: '%s'", - hostname); - return -1; - } - /* Try to prevent path traversals in hostnames. */ - if (NULL != strstr(hostname, "..")) { - LOG(LOG_WARNING, - "initialize_tls_session_client(): possible path traversal: '%s'", - hostname); + if (0 != proxy_certificate_path(hostname, path, sizeof(path))) { + LOG(LOG_ERROR, + "initialize_tls_session_client(): \ +failed to get proxy certificate path"); return -1; } - snprintf(path, sizeof(path), PROXY_SERVER_CERT_FORMAT, hostname); result = gnutls_certificate_allocate_credentials(x509_cred); if (GNUTLS_E_SUCCESS != result) { @@ -370,18 +380,17 @@ gnutls_certificate_allocate_credentials(): %s", result = gnutls_certificate_set_x509_trust_file(*x509_cred, PROXY_CA_FILE, GNUTLS_X509_FMT_PEM); + if (0 >= result) { + LOG(LOG_ERROR, + "initialize_tls_session_client(): can't read CA file: '%s'", + PROXY_CA_FILE); + gnutls_certificate_free_credentials(*x509_cred); + return -1; + } + } /* If the invalid hostname was specified do nothing, we use a self-signed * certificate in this case. */ - } else { - result = 1; - } - if (0 >= result) { - LOG(LOG_ERROR, - "initialize_tls_session_client(): can't read CA file: '%s'", - PROXY_CA_FILE); - gnutls_certificate_free_credentials(*x509_cred); - return -1; - } + /* And certificate for this website and proxy's private key. */ if (!use_invalid_cert) { result = gnutls_certificate_set_x509_key_file(*x509_cred, @@ -405,7 +414,7 @@ can't read server certificate ('%s') or key file ('%s'): %s", return -2; } - gnutls_certificate_set_dh_params(*x509_cred, tls_dh_params); + gnutls_certificate_set_dh_params(*x509_cred, global_tls_dh_params); result = gnutls_init(session, GNUTLS_SERVER); if (GNUTLS_E_SUCCESS != result) { @@ -415,7 +424,7 @@ can't read server certificate ('%s') or key file ('%s'): %s", gnutls_certificate_free_credentials(*x509_cred); return -1; } - result = gnutls_priority_set(*session, tls_priority_cache); + result = gnutls_priority_set(*session, global_tls_priority_cache); if (GNUTLS_E_SUCCESS != result) { LOG(LOG_ERROR, "initialize_tls_session_client(): gnutls_priority_set(): %s", @@ -461,7 +470,7 @@ gnutls_certificate_allocate_credentials(): %s", gnutls_certificate_free_credentials(*x509_cred); return -1; } - gnutls_priority_set(*session, tls_priority_cache); + result = gnutls_priority_set(*session, global_tls_priority_cache); if (GNUTLS_E_SUCCESS != result) { LOG(LOG_ERROR, "initialize_tls_session_server(): gnutls_priority_set(): %s", @@ -503,7 +512,7 @@ static int read_http_request(FILE *client_fd, char *request, size_t length) { return -2; } - while (NULL != fgets(buffer, MAX_REQUEST_LINE, client_fd)) { + while (NULL != fgets(buffer, sizeof(buffer), client_fd)) { /* End of header. */ if (0 == strcmp(buffer, "\n") || 0 == strcmp(buffer, "\r\n")) { break; @@ -518,16 +527,52 @@ static int read_http_request(FILE *client_fd, char *request, size_t length) { } static void send_bad_request(FILE *client_fd) { - fprintf(client_fd, "HTTP/1.0 400 Bad Request\r\n"); - fprintf(client_fd, "\r\n"); +#define RESPONSE_ERROR "400 Bad Request" +#define RESPONSE_MSG "Your browser sent an invalid request." + fprintf(client_fd, HTTP_RESPONSE_FORMAT, + RESPONSE_ERROR, RESPONSE_ERROR, RESPONSE_ERROR, + RESPONSE_MSG); +#undef RESPONSE_ERROR +#undef RESPONSE_MSG } static void send_forwarding_failure(FILE *client_fd) { - fprintf(client_fd, "HTTP/1.0 503 Forwarding failure\r\n"); - fprintf(client_fd, "\r\n"); +#define RESPONSE_ERROR "503 Forwarding failure" +#define RESPONSE_MSG "Failed to connect to server, check logs." + fprintf(client_fd, HTTP_RESPONSE_FORMAT, + RESPONSE_ERROR, RESPONSE_ERROR, RESPONSE_ERROR, + RESPONSE_MSG); +#undef RESPONSE_ERROR +#undef RESPONSE_MSG } static void tls_send_invalid_cert_message(gnutls_session_t session) { - gnutls_record_send(session, "HTTP/1.0 500 Internal Server Error\r\n", 36); - gnutls_record_send(session, "\r\n", 2); +#define RESPONSE_ERROR "500 Internal Server Error" +#define RESPONSE_MSG "Server certificate validation failed, check logs." + + int result; + char buffer[sizeof(HTTP_RESPONSE_FORMAT) - 1 /* '\0' */ + - 4 * 2 /* four %s */ + + (sizeof(RESPONSE_ERROR) - 1 /* '\0' */) * 3 + + sizeof(RESPONSE_MSG) - 1 /* '\0' */ + + 1 /* '\0' */]; + + result = snprintf(buffer, sizeof(buffer), + HTTP_RESPONSE_FORMAT, + RESPONSE_ERROR, RESPONSE_ERROR, RESPONSE_ERROR, + RESPONSE_MSG); + if (result < 0) { + LOG_PERROR(LOG_ERROR, + "tls_send_invalid_cert_message(): snprintf failed"); + return; + } else if ((size_t)result >= sizeof(buffer)) { + LOG(LOG_ERROR, + "tls_send_invalid_cert_message(): snprintf buffer too short"); + return; + } + + gnutls_record_send(session, buffer, sizeof(buffer) - 1); + /* don't send trailing '\0' */ +#undef RESPONSE_ERROR +#undef RESPONSE_MSG } @@ -613,6 +658,8 @@ static int read_from_write_to(int from, int to) { static void transfer_data_tls(int client, int server, gnutls_session_t client_session, gnutls_session_t server_session) { + size_t buffer_size; + struct pollfd fds[2]; fds[0].fd = client; fds[0].events = POLLIN | POLLPRI | POLLHUP | POLLERR; @@ -621,6 +668,14 @@ static void transfer_data_tls(int client, int server, fds[1].events = POLLIN | POLLPRI | POLLHUP | POLLERR; fds[1].revents = 0; + /* Get maximum possible buffer size. */ + buffer_size = gnutls_record_get_max_size(client_session); + if (buffer_size > gnutls_record_get_max_size(server_session)) { + buffer_size = gnutls_record_get_max_size(server_session); + } + LOG(LOG_DEBUG, "transfer_data_tls(): suggested buffer size: %ld", + (long int)buffer_size); + for (;;) { int result = poll(fds, 2, -1 /* no timeout */); if (result < 0) { @@ -630,14 +685,16 @@ static void transfer_data_tls(int client, int server, /* Data available from client. */ if (fds[0].revents & POLLIN || fds[0].revents & POLLPRI) { - if (0 != read_from_write_to_tls(client_session, server_session)) { + if (0 != read_from_write_to_tls(client_session, server_session, + buffer_size)) { /* EOF (or other error) */ break; } } /* Data available from server. */ if (fds[1].revents & POLLIN || fds[1].revents & POLLPRI) { - if (0 != read_from_write_to_tls(server_session, client_session)) { + if (0 != read_from_write_to_tls(server_session, client_session, + buffer_size)) { /* EOF (or other error) */ break; } @@ -656,26 +713,19 @@ static void transfer_data_tls(int client, int server, /* Read available data from session from and write to session to. */ static int read_from_write_to_tls(gnutls_session_t from, - gnutls_session_t to) { - size_t size; + gnutls_session_t to, + size_t buffer_size) { ssize_t size_read; ssize_t size_written; char buffer[16384]; - /* Get maximum possible buffer size. */ - size = gnutls_record_get_max_size(from); - LOG(LOG_DEBUG, "read_from_write_to_tls(): suggested buffer size: %ld", - (long int)size); - if (size > gnutls_record_get_max_size(to)) { - size = gnutls_record_get_max_size(to); - } - if (size > sizeof(buffer)) { - size = sizeof(buffer); + if (buffer_size > sizeof(buffer)) { + buffer_size = sizeof(buffer); } LOG(LOG_DEBUG, "read_from_write_to_tls(): used buffer size: %ld", - (long int)size); + (long int)buffer_size); - size_read = gnutls_record_recv(from, buffer, size); + size_read = gnutls_record_recv(from, buffer, buffer_size); if (0 > size_read) { LOG(LOG_WARNING, "read_from_write_to_tls(): gnutls_record_recv(): %s", gnutls_strerror((int)size_read));