X-Git-Url: https://ruderich.org/simon/gitweb/?a=blobdiff_plain;f=src%2Ftlsproxy.c;h=17c49e971b6a27d1e7c096c2a85977256265d1de;hb=946885b04de70f8481f58160de12f3ee3b0b380a;hp=70cf49d8b85b545bfe85c3aeddf1bf0729d2e7e2;hpb=643caf202af98fa5ebe83f642db459a04067e92f;p=tlsproxy%2Ftlsproxy.git diff --git a/src/tlsproxy.c b/src/tlsproxy.c index 70cf49d..17c49e9 100644 --- a/src/tlsproxy.c +++ b/src/tlsproxy.c @@ -1,5 +1,7 @@ /* - * tlsproxy is a transparent TLS proxy for HTTPS connections. + * tlsproxy is a TLS proxy for HTTPS which intercepts the connections and + * ensures the server certificate doesn't change. Normally this isn't detected + * if a trusted CA for the new server certificate is installed. * * Copyright (C) 2011 Simon Ruderich * @@ -35,15 +37,33 @@ /* pthread_*() */ #include +/* For GnuTLS. */ +#include + +GCRY_THREAD_OPTION_PTHREAD_IMPL; + + /* Size of ringbuffer. */ #define RINGBUFFER_SIZE 10 +/* Bit size of Diffie-Hellman key exchange parameters. */ +#define DH_SIZE 1024 + + +/* For gnutls_*() functions. */ +#define GNUTLS_ERROR_EXIT(error, message) \ + if (GNUTLS_E_SUCCESS != error) { \ + fprintf(stderr, "%s: %s\n", message, gnutls_strerror(error)); \ + exit(EXIT_FAILURE); \ + } + /* Server should shut down. Set by SIGINT handler. */ static volatile int done; /* Number of threads. */ static size_t thread_count; + /* Synchronized ring buffer storing accept()ed client sockets. */ static int ringbuffer[RINGBUFFER_SIZE]; static int ringbuffer_read; @@ -58,6 +78,9 @@ static void sigint_handler(int signal); static void parse_arguments(int argc, char **argv); static void print_usage(const char *argv); +static void initialize_gnutls(void); +static void deinitialize_gnutls(void); + static void worker_thread(void); @@ -76,7 +99,7 @@ int main(int argc, char **argv) { port = atoi(argv[argc - 1]); if (0 >= port || 0xffff < port) { print_usage(argv[0]); - fprintf(stderr, "\ninvalid port"); + fprintf(stderr, "\ninvalid port\n"); return EXIT_FAILURE; } @@ -86,6 +109,9 @@ int main(int argc, char **argv) { action.sa_handler = sigint_handler; action.sa_flags = 0; sigaction(SIGINT, &action, NULL); + /* Ignore SIGPIPEs. */ + action.sa_handler = SIG_IGN; + sigaction(SIGPIPE, &action, NULL); /* Initialize ring buffer. */ ringbuffer_read = 0; @@ -100,6 +126,8 @@ int main(int argc, char **argv) { return EXIT_FAILURE; } + initialize_gnutls(); + /* Spawn worker threads to handle requests. */ threads = (pthread_t *)malloc(thread_count * sizeof(pthread_t)); if (NULL == threads) { @@ -152,13 +180,14 @@ int main(int argc, char **argv) { return EXIT_FAILURE; } -#ifdef DEBUG - printf("Listening for connections on port %d.\n", port); + if (LOG_DEBUG <= global_log_level) { + printf("Listening for connections on port %d.\n", port); - if (NULL != use_proxy_host && NULL != use_proxy_port) { - printf("Using proxy: %s:%s.\n", use_proxy_host, use_proxy_port); + if (NULL != global_proxy_host && NULL != global_proxy_port) { + printf("Using proxy: %s:%s.\n", global_proxy_host, + global_proxy_port); + } } -#endif while (!done) { /* Accept new connection. */ @@ -198,8 +227,10 @@ int main(int argc, char **argv) { free(threads); - free(use_proxy_host); - free(use_proxy_port); + deinitialize_gnutls(); + + free(global_proxy_host); + free(global_proxy_port); return EXIT_FAILURE; } @@ -215,9 +246,23 @@ static void parse_arguments(int argc, char **argv) { /* Default values. */ thread_count = 10; +#ifdef DEBUG + global_log_level = LOG_DEBUG; +#else + global_log_level = LOG_WARNING; +#endif - while (-1 != (option = getopt(argc, argv, "p:t:h?"))) { + while (-1 != (option = getopt(argc, argv, "d:p:t:h?"))) { switch (option) { + case 'd': { + if (0 > atoi(optarg)) { + print_usage(argv[0]); + fprintf(stderr, "\n-d positive number required\n"); + exit(EXIT_FAILURE); + } + global_log_level = atoi(optarg); + break; + } case 'p': { char *position; @@ -227,30 +272,32 @@ static void parse_arguments(int argc, char **argv) { || 0 == strlen(position + 1) || 0 >= atoi(position + 1) || 0xffff < atoi(position + 1)) { - fprintf(stderr, "-p host:port\n"); + print_usage(argv[0]); + fprintf(stderr, "\ninvalid -p, format host:port\n"); exit(EXIT_FAILURE); } - use_proxy_host = malloc((size_t)(position - optarg) + 1); - if (NULL == use_proxy_host) { + global_proxy_host = malloc((size_t)(position - optarg) + 1); + if (NULL == global_proxy_host) { perror("malloc()"); exit(EXIT_FAILURE); } - memcpy(use_proxy_host, optarg, (size_t)(position - optarg)); - use_proxy_host[position - optarg] = '\0'; + memcpy(global_proxy_host, optarg, (size_t)(position - optarg)); + global_proxy_host[position - optarg] = '\0'; - use_proxy_port = malloc(strlen(position + 1) + 1); - if (NULL == use_proxy_port) { + global_proxy_port = malloc(strlen(position + 1) + 1); + if (NULL == global_proxy_port) { perror("malloc()"); exit(EXIT_FAILURE); } - strcpy(use_proxy_port, position + 1); + strcpy(global_proxy_port, position + 1); break; } case 't': { if (0 >= atoi(optarg)) { - fprintf(stderr, "-t positive number required\n"); + print_usage(argv[0]); + fprintf(stderr, "\n-t positive number required\n"); exit(EXIT_FAILURE); } thread_count = (size_t)atoi(optarg); @@ -265,16 +312,59 @@ static void parse_arguments(int argc, char **argv) { if (optind >= argc) { print_usage(argv[0]); + fprintf(stderr, "\nport missing\n"); exit(EXIT_FAILURE); } } static void print_usage(const char *argv) { - fprintf(stderr, "Usage: %s [-p host:port] port\n", argv); + fprintf(stderr, "Usage: %s [-d level] [-p host:port] [-t count] port\n", + argv); fprintf(stderr, "\n"); + fprintf(stderr, "-d debug level: 0=errors only, 2=debug [default: 1]\n"); fprintf(stderr, "-p proxy hostname and port\n"); fprintf(stderr, "-t number of threads [default: 10]\n"); } +static void initialize_gnutls(void) { + int result; + gcry_error_t error = 0; + + /* Thread safe setup. Must be called before gnutls_global_init(). */ + error = gcry_control(GCRYCTL_SET_THREAD_CBS, &gcry_threads_pthread); + if (error) { + fprintf(stderr, "gcry_control(): %s/%s\n", gcry_strsource(error), + gcry_strerror(error)); + exit(EXIT_FAILURE); + } + /* Prevent usage of blocking /dev/random. */ + error = gcry_control(GCRYCTL_ENABLE_QUICK_RANDOM, 0); + if (error) { + fprintf(stderr, "gcry_control(): %s/%s\n", gcry_strsource(error), + gcry_strerror(error)); + exit(EXIT_FAILURE); + } + + /* Initialize GnuTLS. */ + result = gnutls_global_init(); + GNUTLS_ERROR_EXIT(result, "gnutls_global_init()"); + + /* Setup GnuTLS cipher suites. */ + result = gnutls_priority_init(&tls_priority_cache, "NORMAL", NULL); + GNUTLS_ERROR_EXIT(result, "gnutls_priority_init()"); + + /* Generate Diffie-Hellman parameters. */ + result = gnutls_dh_params_init(&tls_dh_params); + GNUTLS_ERROR_EXIT(result, "gnutls_dh_params_init()"); + result = gnutls_dh_params_generate2(tls_dh_params, DH_SIZE); + GNUTLS_ERROR_EXIT(result, "gnutls_dh_params_generate2()"); +} +static void deinitialize_gnutls(void) { + gnutls_dh_params_deinit(tls_dh_params); + gnutls_priority_deinit(tls_priority_cache); + + gnutls_global_deinit(); +} + static void worker_thread(void) { int client_socket; @@ -288,7 +378,7 @@ static void worker_thread(void) { V(ringbuffer_free); /* Negative value indicates we should shut down our thread. */ - if (client_socket < 0) { + if (0 > client_socket) { break; }