X-Git-Url: https://ruderich.org/simon/gitweb/?a=blobdiff_plain;f=src%2Ftlsproxy.c;h=5fed55427ae95468c88bed20b615472ba2bf8625;hb=3c4d48bc9f6d8228b4eb61ef7920bdc64fc2eec1;hp=2a35eaefc6b45e3d4e6b35a62c32d5a8407a8aac;hpb=396fd6126020e409a21ed0d8bb327d6ee0211e04;p=tlsproxy%2Ftlsproxy.git

diff --git a/src/tlsproxy.c b/src/tlsproxy.c
index 2a35eae..5fed554 100644
--- a/src/tlsproxy.c
+++ b/src/tlsproxy.c
@@ -1,5 +1,7 @@
 /*
- * tlsproxy is a transparent TLS proxy for HTTPS connections.
+ * tlsproxy is a TLS proxy for HTTPS which intercepts the connections and
+ * ensures the server certificate doesn't change. Normally this isn't detected
+ * if a trusted CA for the new server certificate is installed.
  *
  * Copyright (C) 2011  Simon Ruderich
  *
@@ -35,15 +37,33 @@
 /* pthread_*() */
 #include <pthread.h>
 
+/* For GnuTLS. */
+#include <gcrypt.h>
+
+GCRY_THREAD_OPTION_PTHREAD_IMPL;
+
+
 /* Size of ringbuffer. */
 #define RINGBUFFER_SIZE 10
 
+/* Bit size of Diffie-Hellman key exchange parameters. */
+#define DH_SIZE 1024
+
+
+/* For gnutls_*() functions. */
+#define GNUTLS_ERROR_EXIT(error, message) \
+    if (GNUTLS_E_SUCCESS != error) { \
+        fprintf(stderr, "%s: %s\n", message, gnutls_strerror(error)); \
+        exit(EXIT_FAILURE); \
+    }
+
 
 /* Server should shut down. Set by SIGINT handler. */
 static volatile int done;
 
 /* Number of threads. */
 static size_t thread_count;
+
 /* Synchronized ring buffer storing accept()ed client sockets. */
 static int ringbuffer[RINGBUFFER_SIZE];
 static int ringbuffer_read;
@@ -53,11 +73,16 @@ static SEM *ringbuffer_free; /* Space for another element in the buffer? */
 static SEM *ringbuffer_lock; /* Read lock. */
 
 
+#ifdef DEBUG
 static void sigint_handler(int signal);
+#endif
 
 static void parse_arguments(int argc, char **argv);
 static void print_usage(const char *argv);
 
+static void initialize_gnutls(void);
+static void deinitialize_gnutls(void);
+
 static void worker_thread(void);
 
 
@@ -81,11 +106,13 @@ int main(int argc, char **argv) {
     }
 
     /* Setup our SIGINT signal handler which allows a "normal" termination of
-     * the server. */
+     * the server in DEBUG mode. */
     sigemptyset(&action.sa_mask);
-    action.sa_handler = sigint_handler;
     action.sa_flags   = 0;
+#ifdef DEBUG
+    action.sa_handler = sigint_handler;
     sigaction(SIGINT, &action, NULL);
+#endif
     /* Ignore SIGPIPEs. */
     action.sa_handler = SIG_IGN;
     sigaction(SIGPIPE, &action, NULL);
@@ -103,6 +130,8 @@ int main(int argc, char **argv) {
         return EXIT_FAILURE;
     }
 
+    initialize_gnutls();
+
     /* Spawn worker threads to handle requests. */
     threads = (pthread_t *)malloc(thread_count * sizeof(pthread_t));
     if (NULL == threads) {
@@ -117,7 +146,8 @@ int main(int argc, char **argv) {
                                 (void * (*)(void *))&worker_thread,
                                 NULL);
         if (0 != result) {
-            printf("failed to create worker thread: %s\n", strerror(result));
+            fprintf(stderr, "failed to create worker thread: %s\n",
+                            strerror(result));
             return EXIT_FAILURE;
         }
 
@@ -202,17 +232,21 @@ int main(int argc, char **argv) {
 
     free(threads);
 
+    deinitialize_gnutls();
+
     free(global_proxy_host);
     free(global_proxy_port);
 
     return EXIT_FAILURE;
 }
 
+#ifdef DEBUG
 static void sigint_handler(int signal_number) {
     (void)signal_number;
 
     done = 1;
 }
+#endif
 
 static void parse_arguments(int argc, char **argv) {
     int option;
@@ -298,6 +332,46 @@ static void print_usage(const char *argv) {
     fprintf(stderr, "-t number of threads [default: 10]\n");
 }
 
+static void initialize_gnutls(void) {
+    int result;
+    gcry_error_t error = 0;
+
+    /* Thread safe setup. Must be called before gnutls_global_init(). */
+    error = gcry_control(GCRYCTL_SET_THREAD_CBS, &gcry_threads_pthread);
+    if (error) {
+        fprintf(stderr, "gcry_control(): %s/%s\n", gcry_strsource(error),
+                                                   gcry_strerror(error));
+        exit(EXIT_FAILURE);
+    }
+    /* Prevent usage of blocking /dev/random. */
+    error = gcry_control(GCRYCTL_ENABLE_QUICK_RANDOM, 0);
+    if (error) {
+        fprintf(stderr, "gcry_control(): %s/%s\n", gcry_strsource(error),
+                                                   gcry_strerror(error));
+        exit(EXIT_FAILURE);
+    }
+
+    /* Initialize GnuTLS. */
+    result = gnutls_global_init();
+    GNUTLS_ERROR_EXIT(result, "gnutls_global_init()");
+
+    /* Setup GnuTLS cipher suites. */
+    result = gnutls_priority_init(&tls_priority_cache, "NORMAL", NULL);
+    GNUTLS_ERROR_EXIT(result, "gnutls_priority_init()");
+
+    /* Generate Diffie-Hellman parameters. */
+    result = gnutls_dh_params_init(&tls_dh_params);
+    GNUTLS_ERROR_EXIT(result, "gnutls_dh_params_init()");
+    result = gnutls_dh_params_generate2(tls_dh_params, DH_SIZE);
+    GNUTLS_ERROR_EXIT(result, "gnutls_dh_params_generate2()");
+}
+static void deinitialize_gnutls(void) {
+    gnutls_dh_params_deinit(tls_dh_params);
+    gnutls_priority_deinit(tls_priority_cache);
+
+    gnutls_global_deinit();
+}
+
 static void worker_thread(void) {
     int client_socket;