2008-04-11 03:46:11 +04:00
|
|
|
/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
|
|
|
|
/* ***** BEGIN LICENSE BLOCK *****
|
|
|
|
* Version: MPL 1.1/GPL 2.0/LGPL 2.1
|
|
|
|
*
|
|
|
|
* The contents of this file are subject to the Mozilla Public License Version
|
|
|
|
* 1.1 (the "License"); you may not use this file except in compliance with
|
|
|
|
* the License. You may obtain a copy of the License at
|
|
|
|
* http://www.mozilla.org/MPL/
|
|
|
|
*
|
|
|
|
* Software distributed under the License is distributed on an "AS IS" basis,
|
|
|
|
* WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
|
|
|
|
* for the specific language governing rights and limitations under the
|
|
|
|
* License.
|
|
|
|
*
|
|
|
|
* The Original Code is Mozilla test code
|
|
|
|
*
|
|
|
|
* The Initial Developer of the Original Code is
|
|
|
|
* Mozilla Foundation
|
|
|
|
* Portions created by the Initial Developer are Copyright (C) 2008
|
|
|
|
* the Initial Developer. All Rights Reserved.
|
|
|
|
*
|
|
|
|
* Contributor(s):
|
2009-01-15 23:17:34 +03:00
|
|
|
* Ted Mielczarek <ted.mielczarek@gmail.com>
|
|
|
|
* Honza Bambas <honzab@firemni.cz>
|
2008-04-11 03:46:11 +04:00
|
|
|
*
|
|
|
|
* Alternatively, the contents of this file may be used under the terms of
|
|
|
|
* either the GNU General Public License Version 2 or later (the "GPL"), or
|
|
|
|
* the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
|
|
|
|
* in which case the provisions of the GPL or the LGPL are applicable instead
|
|
|
|
* of those above. If you wish to allow use of your version of this file only
|
|
|
|
* under the terms of either the GPL or the LGPL, and not to allow others to
|
|
|
|
* use your version of this file under the terms of the MPL, indicate your
|
|
|
|
* decision by deleting the provisions above and replace them with the notice
|
|
|
|
* and other provisions required by the GPL or the LGPL. If you do not delete
|
|
|
|
* the provisions above, a recipient may use your version of this file under
|
|
|
|
* the terms of any one of the MPL, the GPL or the LGPL.
|
|
|
|
*
|
|
|
|
* ***** END LICENSE BLOCK ***** */
|
|
|
|
|
2009-01-15 23:17:34 +03:00
|
|
|
/*
|
|
|
|
* WARNING: DO NOT USE THIS CODE IN PRODUCTION SYSTEMS. It is highly likely to
|
|
|
|
* be plagued with the usual problems endemic to C (buffer overflows
|
|
|
|
* and the like). We don't especially care here (but would accept
|
|
|
|
* patches!) because this is only intended for use in our test
|
|
|
|
* harnesses in controlled situations where input is guaranteed not to
|
|
|
|
* be malicious.
|
|
|
|
*/
|
|
|
|
|
|
|
|
#include <assert.h>
|
2008-04-11 03:46:11 +04:00
|
|
|
#include <stdio.h>
|
|
|
|
#include <string>
|
|
|
|
#include <vector>
|
|
|
|
#include <algorithm>
|
2010-10-25 20:47:23 +04:00
|
|
|
#include <stdarg.h>
|
2008-04-11 03:46:11 +04:00
|
|
|
#include "prinit.h"
|
|
|
|
#include "prerror.h"
|
2010-10-25 20:47:23 +04:00
|
|
|
#include "prenv.h"
|
2008-04-11 03:46:11 +04:00
|
|
|
#include "prio.h"
|
|
|
|
#include "prnetdb.h"
|
|
|
|
#include "prtpool.h"
|
2009-05-18 02:29:02 +04:00
|
|
|
#include "prtypes.h"
|
2011-06-25 18:06:02 +04:00
|
|
|
#include "nsAlgorithm.h"
|
2008-04-11 03:46:11 +04:00
|
|
|
#include "nss.h"
|
|
|
|
#include "pk11func.h"
|
|
|
|
#include "key.h"
|
|
|
|
#include "keyt.h"
|
|
|
|
#include "ssl.h"
|
2008-09-05 17:35:58 +04:00
|
|
|
#include "plhash.h"
|
2008-04-11 03:46:11 +04:00
|
|
|
|
|
|
|
using std::string;
|
|
|
|
using std::vector;
|
|
|
|
|
2010-01-26 16:33:03 +03:00
|
|
|
#define IS_DELIM(m, c) ((m)[(c) >> 3] & (1 << ((c) & 7)))
|
|
|
|
#define SET_DELIM(m, c) ((m)[(c) >> 3] |= (1 << ((c) & 7)))
|
|
|
|
#define DELIM_TABLE_SIZE 32
|
|
|
|
|
2010-10-25 20:47:23 +04:00
|
|
|
// You can set the level of logging by env var SSLTUNNEL_LOG_LEVEL=n, where n
|
|
|
|
// is 0 through 3. The default is 1, INFO level logging.
|
|
|
|
enum LogLevel {
|
|
|
|
LEVEL_DEBUG = 0,
|
|
|
|
LEVEL_INFO = 1,
|
|
|
|
LEVEL_ERROR = 2,
|
|
|
|
LEVEL_SILENT = 3
|
|
|
|
} gLogLevel, gLastLogLevel;
|
|
|
|
|
|
|
|
#define _LOG_OUTPUT(level, func, params) \
|
|
|
|
PR_BEGIN_MACRO \
|
|
|
|
if (level >= gLogLevel) { \
|
|
|
|
gLastLogLevel = level; \
|
|
|
|
func params;\
|
|
|
|
} \
|
|
|
|
PR_END_MACRO
|
|
|
|
|
|
|
|
// The most verbose output
|
|
|
|
#define LOG_DEBUG(params) \
|
|
|
|
_LOG_OUTPUT(LEVEL_DEBUG, printf, params)
|
|
|
|
|
|
|
|
// Top level informative messages
|
|
|
|
#define LOG_INFO(params) \
|
|
|
|
_LOG_OUTPUT(LEVEL_INFO, printf, params)
|
|
|
|
|
|
|
|
// Serious errors that must be logged always until completely gag
|
|
|
|
#define LOG_ERROR(params) \
|
|
|
|
_LOG_OUTPUT(LEVEL_ERROR, eprintf, params)
|
|
|
|
|
|
|
|
// Same as LOG_ERROR, but when logging is set to LEVEL_DEBUG, the message
|
|
|
|
// will be put to the stdout instead of stderr to keep continuity with other
|
|
|
|
// LOG_DEBUG message output
|
|
|
|
#define LOG_ERRORD(params) \
|
|
|
|
PR_BEGIN_MACRO \
|
|
|
|
if (gLogLevel == LEVEL_DEBUG) \
|
|
|
|
_LOG_OUTPUT(LEVEL_ERROR, printf, params); \
|
|
|
|
else \
|
|
|
|
_LOG_OUTPUT(LEVEL_ERROR, eprintf, params); \
|
|
|
|
PR_END_MACRO
|
|
|
|
|
|
|
|
// If there is any output written between LOG_BEGIN_BLOCK() and
|
|
|
|
// LOG_END_BLOCK() then a new line will be put to the proper output (out/err)
|
|
|
|
#define LOG_BEGIN_BLOCK() \
|
|
|
|
gLastLogLevel = LEVEL_SILENT;
|
|
|
|
|
|
|
|
#define LOG_END_BLOCK() \
|
|
|
|
PR_BEGIN_MACRO \
|
|
|
|
if (gLastLogLevel == LEVEL_ERROR) \
|
|
|
|
LOG_ERROR(("\n")); \
|
|
|
|
if (gLastLogLevel < LEVEL_ERROR) \
|
|
|
|
_LOG_OUTPUT(gLastLogLevel, printf, ("\n")); \
|
|
|
|
PR_END_MACRO
|
|
|
|
|
|
|
|
int eprintf(const char* str, ...)
|
|
|
|
{
|
|
|
|
va_list ap;
|
|
|
|
va_start(ap, str);
|
|
|
|
int result = vfprintf(stderr, str, ap);
|
|
|
|
va_end(ap);
|
|
|
|
return result;
|
|
|
|
}
|
|
|
|
|
2010-01-26 16:33:03 +03:00
|
|
|
// Copied from nsCRT
|
|
|
|
char* strtok2(char* string, const char* delims, char* *newStr)
|
|
|
|
{
|
|
|
|
PR_ASSERT(string);
|
|
|
|
|
|
|
|
char delimTable[DELIM_TABLE_SIZE];
|
|
|
|
PRUint32 i;
|
|
|
|
char* result;
|
|
|
|
char* str = string;
|
|
|
|
|
|
|
|
for (i = 0; i < DELIM_TABLE_SIZE; i++)
|
|
|
|
delimTable[i] = '\0';
|
|
|
|
|
|
|
|
for (i = 0; delims[i]; i++) {
|
|
|
|
SET_DELIM(delimTable, static_cast<PRUint8>(delims[i]));
|
|
|
|
}
|
|
|
|
|
|
|
|
// skip to beginning
|
|
|
|
while (*str && IS_DELIM(delimTable, static_cast<PRUint8>(*str))) {
|
|
|
|
str++;
|
|
|
|
}
|
|
|
|
result = str;
|
|
|
|
|
|
|
|
// fix up the end of the token
|
|
|
|
while (*str) {
|
|
|
|
if (IS_DELIM(delimTable, static_cast<PRUint8>(*str))) {
|
|
|
|
*str++ = '\0';
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
str++;
|
|
|
|
}
|
|
|
|
*newStr = str;
|
|
|
|
|
|
|
|
return str == result ? NULL : result;
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
2009-01-15 22:19:15 +03:00
|
|
|
enum client_auth_option {
|
|
|
|
caNone = 0,
|
|
|
|
caRequire = 1,
|
|
|
|
caRequest = 2
|
|
|
|
};
|
|
|
|
|
2008-04-11 03:46:11 +04:00
|
|
|
// Structs for passing data into jobs on the thread pool
|
|
|
|
typedef struct {
|
|
|
|
PRInt32 listen_port;
|
|
|
|
string cert_nickname;
|
2008-09-05 17:35:58 +04:00
|
|
|
PLHashTable* host_cert_table;
|
2009-01-15 22:19:15 +03:00
|
|
|
PLHashTable* host_clientauth_table;
|
2011-11-03 01:43:27 +04:00
|
|
|
PLHashTable* host_redir_table;
|
2008-04-11 03:46:11 +04:00
|
|
|
} server_info_t;
|
|
|
|
|
|
|
|
typedef struct {
|
|
|
|
PRFileDesc* client_sock;
|
|
|
|
PRNetAddr client_addr;
|
|
|
|
server_info_t* server_info;
|
2010-07-28 21:55:36 +04:00
|
|
|
// the original host in the Host: header for this connection is
|
|
|
|
// stored here, for proxied connections
|
|
|
|
string original_host;
|
|
|
|
// true if no SSL should be used for this connection
|
|
|
|
bool http_proxy_only;
|
|
|
|
// true if this connection is for a WebSocket
|
|
|
|
bool iswebsocket;
|
2008-04-11 03:46:11 +04:00
|
|
|
} connection_info_t;
|
|
|
|
|
2010-07-28 21:55:36 +04:00
|
|
|
typedef struct {
|
|
|
|
string fullHost;
|
|
|
|
bool matched;
|
|
|
|
} server_match_t;
|
|
|
|
|
2009-01-15 23:17:34 +03:00
|
|
|
const PRInt32 BUF_SIZE = 16384;
|
|
|
|
const PRInt32 BUF_MARGIN = 1024;
|
|
|
|
const PRInt32 BUF_TOTAL = BUF_SIZE + BUF_MARGIN;
|
|
|
|
|
|
|
|
struct relayBuffer
|
|
|
|
{
|
|
|
|
char *buffer, *bufferhead, *buffertail, *bufferend;
|
|
|
|
|
|
|
|
relayBuffer()
|
|
|
|
{
|
|
|
|
// Leave 1024 bytes more for request line manipulations
|
|
|
|
bufferhead = buffertail = buffer = new char[BUF_TOTAL];
|
|
|
|
bufferend = buffer + BUF_SIZE;
|
|
|
|
}
|
|
|
|
|
|
|
|
~relayBuffer()
|
|
|
|
{
|
|
|
|
delete [] buffer;
|
|
|
|
}
|
|
|
|
|
|
|
|
void compact() {
|
|
|
|
if (buffertail == bufferhead)
|
|
|
|
buffertail = bufferhead = buffer;
|
|
|
|
}
|
|
|
|
|
|
|
|
bool empty() { return bufferhead == buffertail; }
|
2011-06-25 18:06:02 +04:00
|
|
|
size_t areafree() { return bufferend - buffertail; }
|
|
|
|
size_t margin() { return areafree() + BUF_MARGIN; }
|
2009-01-15 23:17:34 +03:00
|
|
|
size_t present() { return buffertail - bufferhead; }
|
|
|
|
};
|
|
|
|
|
2008-04-11 03:46:11 +04:00
|
|
|
// A couple of stack classes for managing NSS/NSPR resources
|
|
|
|
class AutoCert {
|
|
|
|
public:
|
|
|
|
AutoCert(CERTCertificate* cert) { cert_ = cert; }
|
|
|
|
~AutoCert() { if (cert_) CERT_DestroyCertificate(cert_); }
|
|
|
|
operator CERTCertificate*() { return cert_; }
|
|
|
|
private:
|
|
|
|
CERTCertificate* cert_;
|
|
|
|
};
|
|
|
|
|
|
|
|
class AutoKey {
|
|
|
|
public:
|
|
|
|
AutoKey(SECKEYPrivateKey* key) { key_ = key; }
|
|
|
|
~AutoKey() { if (key_) SECKEY_DestroyPrivateKey(key_); }
|
|
|
|
operator SECKEYPrivateKey*() { return key_; }
|
|
|
|
private:
|
|
|
|
SECKEYPrivateKey* key_;
|
|
|
|
};
|
|
|
|
|
|
|
|
class AutoFD {
|
|
|
|
public:
|
|
|
|
AutoFD(PRFileDesc* fd) { fd_ = fd; }
|
|
|
|
~AutoFD() {
|
|
|
|
if (fd_) {
|
|
|
|
PR_Shutdown(fd_, PR_SHUTDOWN_BOTH);
|
|
|
|
PR_Close(fd_);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
operator PRFileDesc*() { return fd_; }
|
|
|
|
PRFileDesc* reset(PRFileDesc* newfd) {
|
|
|
|
PRFileDesc* oldfd = fd_;
|
|
|
|
fd_ = newfd;
|
|
|
|
return oldfd;
|
|
|
|
}
|
|
|
|
private:
|
|
|
|
PRFileDesc* fd_;
|
|
|
|
};
|
|
|
|
|
2011-08-04 01:36:49 +04:00
|
|
|
// These numbers are multiplied by the number of listening ports (actual
|
|
|
|
// servers running). According the thread pool implementation there is no
|
|
|
|
// need to limit the number of threads initially, threads are allocated
|
|
|
|
// dynamically and stored in a linked list. Initial number of 2 is chosen
|
|
|
|
// to allocate a thread for socket accept and preallocate one for the first
|
|
|
|
// connection that is with high probability expected to come.
|
|
|
|
const PRUint32 INITIAL_THREADS = 2;
|
|
|
|
const PRUint32 MAX_THREADS = 100;
|
2009-06-25 00:16:00 +04:00
|
|
|
const PRUint32 DEFAULT_STACKSIZE = (512 * 1024);
|
2008-04-11 03:46:11 +04:00
|
|
|
|
|
|
|
// global data
|
2008-09-05 17:35:58 +04:00
|
|
|
string nssconfigdir;
|
|
|
|
vector<server_info_t> servers;
|
|
|
|
PRNetAddr remote_addr;
|
2010-07-28 21:55:36 +04:00
|
|
|
PRNetAddr websocket_server;
|
2008-04-11 03:46:11 +04:00
|
|
|
PRThreadPool* threads = NULL;
|
|
|
|
PRLock* shutdown_lock = NULL;
|
|
|
|
PRCondVar* shutdown_condvar = NULL;
|
|
|
|
// Not really used, unless something fails to start
|
|
|
|
bool shutdown_server = false;
|
2008-09-05 17:35:58 +04:00
|
|
|
bool do_http_proxy = false;
|
2009-01-15 22:19:15 +03:00
|
|
|
bool any_host_spec_config = false;
|
|
|
|
|
|
|
|
PR_CALLBACK PRIntn ClientAuthValueComparator(const void *v1, const void *v2)
|
|
|
|
{
|
|
|
|
int a = *static_cast<const client_auth_option*>(v1) -
|
|
|
|
*static_cast<const client_auth_option*>(v2);
|
|
|
|
if (a == 0)
|
|
|
|
return 0;
|
|
|
|
if (a > 0)
|
|
|
|
return 1;
|
|
|
|
else // (a < 0)
|
|
|
|
return -1;
|
|
|
|
}
|
2008-04-11 03:46:11 +04:00
|
|
|
|
2010-07-28 21:55:36 +04:00
|
|
|
static PRIntn match_hostname(PLHashEntry *he, PRIntn index, void* arg)
|
|
|
|
{
|
|
|
|
server_match_t *match = (server_match_t*)arg;
|
|
|
|
if (match->fullHost.find((char*)he->key) != string::npos)
|
|
|
|
match->matched = true;
|
|
|
|
return HT_ENUMERATE_NEXT;
|
|
|
|
}
|
|
|
|
|
2008-04-11 03:46:11 +04:00
|
|
|
/*
|
|
|
|
* Signal the main thread that the application should shut down.
|
|
|
|
*/
|
|
|
|
void SignalShutdown()
|
|
|
|
{
|
|
|
|
PR_Lock(shutdown_lock);
|
|
|
|
PR_NotifyCondVar(shutdown_condvar);
|
|
|
|
PR_Unlock(shutdown_lock);
|
|
|
|
}
|
|
|
|
|
2008-09-05 17:35:58 +04:00
|
|
|
bool ReadConnectRequest(server_info_t* server_info,
|
2009-01-15 23:17:34 +03:00
|
|
|
relayBuffer& buffer, PRInt32* result, string& certificate,
|
2011-11-03 01:43:27 +04:00
|
|
|
client_auth_option* clientauth, string& host, string& location)
|
2008-09-05 17:35:58 +04:00
|
|
|
{
|
2010-01-16 18:29:59 +03:00
|
|
|
if (buffer.present() < 4) {
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_DEBUG((" !! only %d bytes present in the buffer", (int)buffer.present()));
|
2008-09-05 17:35:58 +04:00
|
|
|
return false;
|
2010-01-16 18:29:59 +03:00
|
|
|
}
|
|
|
|
if (strncmp(buffer.buffertail-4, "\r\n\r\n", 4)) {
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_ERRORD((" !! request is not tailed with CRLFCRLF but with %x %x %x %x",
|
|
|
|
*(buffer.buffertail-4),
|
|
|
|
*(buffer.buffertail-3),
|
|
|
|
*(buffer.buffertail-2),
|
|
|
|
*(buffer.buffertail-1)));
|
2008-09-05 17:35:58 +04:00
|
|
|
return false;
|
2010-01-16 18:29:59 +03:00
|
|
|
}
|
2010-06-17 09:38:55 +04:00
|
|
|
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_DEBUG((" parsing initial connect request, dump:\n%.*s\n", (int)buffer.present(), buffer.bufferhead));
|
2008-09-05 17:35:58 +04:00
|
|
|
|
|
|
|
*result = 400;
|
|
|
|
|
|
|
|
char* token;
|
2010-01-26 16:33:03 +03:00
|
|
|
char* _caret;
|
|
|
|
token = strtok2(buffer.bufferhead, " ", &_caret);
|
2010-01-18 22:58:59 +03:00
|
|
|
if (!token) {
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_ERRORD((" no space found"));
|
2008-09-05 17:35:58 +04:00
|
|
|
return true;
|
2010-01-18 22:58:59 +03:00
|
|
|
}
|
|
|
|
if (strcmp(token, "CONNECT")) {
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_ERRORD((" not CONNECT request but %s", token));
|
2008-09-05 17:35:58 +04:00
|
|
|
return true;
|
2010-01-18 22:58:59 +03:00
|
|
|
}
|
2008-09-05 17:35:58 +04:00
|
|
|
|
2010-01-26 16:33:03 +03:00
|
|
|
token = strtok2(_caret, " ", &_caret);
|
2008-09-05 17:35:58 +04:00
|
|
|
void* c = PL_HashTableLookup(server_info->host_cert_table, token);
|
|
|
|
if (c)
|
2009-01-15 23:17:34 +03:00
|
|
|
certificate = static_cast<char*>(c);
|
|
|
|
|
|
|
|
host = "https://";
|
|
|
|
host += token;
|
2009-01-12 22:14:40 +03:00
|
|
|
|
2009-01-15 22:19:15 +03:00
|
|
|
c = PL_HashTableLookup(server_info->host_clientauth_table, token);
|
|
|
|
if (c)
|
|
|
|
*clientauth = *static_cast<client_auth_option*>(c);
|
|
|
|
else
|
|
|
|
*clientauth = caNone;
|
|
|
|
|
2011-11-03 01:43:27 +04:00
|
|
|
void *redir = PL_HashTableLookup(server_info->host_redir_table, token);
|
|
|
|
if (redir)
|
|
|
|
location = static_cast<char*>(redir);
|
|
|
|
|
2010-01-26 16:33:03 +03:00
|
|
|
token = strtok2(_caret, "/", &_caret);
|
2010-01-18 22:58:59 +03:00
|
|
|
if (strcmp(token, "HTTP")) {
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_ERRORD((" not tailed with HTTP but with %s", token));
|
2008-09-05 17:35:58 +04:00
|
|
|
return true;
|
2010-01-18 22:58:59 +03:00
|
|
|
}
|
2008-09-05 17:35:58 +04:00
|
|
|
|
2011-11-03 01:43:27 +04:00
|
|
|
*result = (redir) ? 302 : 200;
|
2008-09-05 17:35:58 +04:00
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
2009-01-15 22:19:15 +03:00
|
|
|
bool ConfigureSSLServerSocket(PRFileDesc* socket, server_info_t* si, string &certificate, client_auth_option clientAuth)
|
2008-09-05 17:35:58 +04:00
|
|
|
{
|
|
|
|
const char* certnick = certificate.empty() ?
|
|
|
|
si->cert_nickname.c_str() : certificate.c_str();
|
|
|
|
|
|
|
|
AutoCert cert(PK11_FindCertFromNickname(
|
|
|
|
certnick, NULL));
|
|
|
|
if (!cert) {
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_ERROR(("Failed to find cert %s\n", certnick));
|
2008-09-05 17:35:58 +04:00
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
AutoKey privKey(PK11_FindKeyByAnyCert(cert, NULL));
|
|
|
|
if (!privKey) {
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_ERROR(("Failed to find private key\n"));
|
2008-09-05 17:35:58 +04:00
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
PRFileDesc* ssl_socket = SSL_ImportFD(NULL, socket);
|
|
|
|
if (!ssl_socket) {
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_ERROR(("Error importing SSL socket\n"));
|
2008-09-05 17:35:58 +04:00
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
SSLKEAType certKEA = NSS_FindCertKEAType(cert);
|
|
|
|
if (SSL_ConfigSecureServer(ssl_socket, cert, privKey, certKEA)
|
|
|
|
!= SECSuccess) {
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_ERROR(("Error configuring SSL server socket\n"));
|
2008-09-05 17:35:58 +04:00
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
2011-10-17 18:59:28 +04:00
|
|
|
SSL_OptionSet(ssl_socket, SSL_SECURITY, true);
|
|
|
|
SSL_OptionSet(ssl_socket, SSL_HANDSHAKE_AS_CLIENT, false);
|
|
|
|
SSL_OptionSet(ssl_socket, SSL_HANDSHAKE_AS_SERVER, true);
|
2009-01-15 22:19:15 +03:00
|
|
|
|
|
|
|
if (clientAuth != caNone)
|
|
|
|
{
|
2011-10-17 18:59:28 +04:00
|
|
|
SSL_OptionSet(ssl_socket, SSL_REQUEST_CERTIFICATE, true);
|
2009-01-15 22:19:15 +03:00
|
|
|
SSL_OptionSet(ssl_socket, SSL_REQUIRE_CERTIFICATE, clientAuth == caRequire);
|
|
|
|
}
|
|
|
|
|
2011-10-17 18:59:28 +04:00
|
|
|
SSL_ResetHandshake(ssl_socket, true);
|
2008-09-05 17:35:58 +04:00
|
|
|
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
2010-06-17 09:38:55 +04:00
|
|
|
/**
|
2011-05-22 05:27:52 +04:00
|
|
|
* This function examines the buffer for a Sec-WebSocket-Location: field,
|
2010-06-17 09:38:55 +04:00
|
|
|
* and if it's present, it replaces the hostname in that field with the
|
|
|
|
* value in the server's original_host field. This function works
|
2010-07-28 21:55:36 +04:00
|
|
|
* in the reverse direction as AdjustWebSocketHost(), replacing the real
|
|
|
|
* hostname of a response with the potentially fake hostname that is expected
|
2010-06-17 09:38:55 +04:00
|
|
|
* by the browser (e.g., mochi.test).
|
|
|
|
*
|
|
|
|
* @return true if the header was adjusted successfully, or not found, false
|
|
|
|
* if the header is present but the url is not, which should indicate
|
|
|
|
* that more data needs to be read from the socket
|
|
|
|
*/
|
2010-07-28 21:55:36 +04:00
|
|
|
bool AdjustWebSocketLocation(relayBuffer& buffer, connection_info_t *ci)
|
2010-06-17 09:38:55 +04:00
|
|
|
{
|
|
|
|
assert(buffer.margin());
|
|
|
|
buffer.buffertail[1] = '\0';
|
|
|
|
|
|
|
|
char* wsloc = strstr(buffer.bufferhead, "Sec-WebSocket-Location:");
|
|
|
|
if (!wsloc)
|
|
|
|
return true;
|
2010-07-30 00:13:11 +04:00
|
|
|
// advance pointer to the start of the hostname
|
2010-06-17 09:38:55 +04:00
|
|
|
wsloc = strstr(wsloc, "ws://");
|
|
|
|
if (!wsloc)
|
|
|
|
return false;
|
2010-07-30 00:13:11 +04:00
|
|
|
wsloc += 5;
|
2010-06-17 09:38:55 +04:00
|
|
|
// find the end of the hostname
|
2010-07-30 00:13:11 +04:00
|
|
|
char* wslocend = strchr(wsloc + 1, '/');
|
2010-06-17 09:38:55 +04:00
|
|
|
if (!wslocend)
|
|
|
|
return false;
|
|
|
|
char *crlf = strstr(wsloc, "\r\n");
|
|
|
|
if (!crlf)
|
|
|
|
return false;
|
2010-07-28 21:55:36 +04:00
|
|
|
if (ci->original_host.empty())
|
2010-06-17 09:38:55 +04:00
|
|
|
return true;
|
|
|
|
|
2010-07-30 00:13:11 +04:00
|
|
|
int diff = ci->original_host.length() - (wslocend-wsloc);
|
2010-06-17 09:38:55 +04:00
|
|
|
if (diff > 0)
|
|
|
|
assert(size_t(diff) <= buffer.margin());
|
|
|
|
memmove(wslocend + diff, wslocend, buffer.buffertail - wsloc - diff);
|
|
|
|
buffer.buffertail += diff;
|
|
|
|
|
2010-07-30 00:13:11 +04:00
|
|
|
memcpy(wsloc, ci->original_host.c_str(), ci->original_host.length());
|
2010-06-17 09:38:55 +04:00
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* This function examines the buffer for a Host: field, and if it's present,
|
|
|
|
* it replaces the hostname in that field with the hostname in the server's
|
|
|
|
* remote_addr field. This is needed because proxy requests may be coming
|
|
|
|
* from mochitest with fake hosts, like mochi.test, and these need to be
|
|
|
|
* replaced with the host that the destination server is actually running
|
|
|
|
* on.
|
|
|
|
*/
|
2010-07-28 21:55:36 +04:00
|
|
|
bool AdjustWebSocketHost(relayBuffer& buffer, connection_info_t *ci)
|
2010-06-17 09:38:55 +04:00
|
|
|
{
|
2010-07-28 21:55:36 +04:00
|
|
|
const char HEADER_UPGRADE[] = "Upgrade:";
|
|
|
|
const char HEADER_HOST[] = "Host:";
|
|
|
|
|
|
|
|
PRNetAddr inet_addr = (websocket_server.inet.port ? websocket_server :
|
|
|
|
remote_addr);
|
2010-06-17 09:38:55 +04:00
|
|
|
|
|
|
|
assert(buffer.margin());
|
|
|
|
|
|
|
|
// Cannot use strnchr so add a null char at the end. There is always some
|
|
|
|
// space left because we preserve a margin.
|
|
|
|
buffer.buffertail[1] = '\0';
|
|
|
|
|
2010-07-28 21:55:36 +04:00
|
|
|
// Verify this is a WebSocket header.
|
|
|
|
char* h1 = strstr(buffer.bufferhead, HEADER_UPGRADE);
|
|
|
|
if (!h1)
|
|
|
|
return false;
|
|
|
|
h1 += strlen(HEADER_UPGRADE);
|
|
|
|
h1 += strspn(h1, " \t");
|
|
|
|
char* h2 = strstr(h1, "WebSocket\r\n");
|
2011-05-22 05:27:52 +04:00
|
|
|
if (!h2) h2 = strstr(h1, "websocket\r\n");
|
|
|
|
if (!h2) h2 = strstr(h1, "Websocket\r\n");
|
2010-07-28 21:55:36 +04:00
|
|
|
if (!h2)
|
|
|
|
return false;
|
|
|
|
|
2010-06-17 09:38:55 +04:00
|
|
|
char* host = strstr(buffer.bufferhead, HEADER_HOST);
|
|
|
|
if (!host)
|
|
|
|
return false;
|
|
|
|
// advance pointer to beginning of hostname
|
|
|
|
host += strlen(HEADER_HOST);
|
|
|
|
host += strspn(host, " \t");
|
|
|
|
|
|
|
|
char* endhost = strstr(host, "\r\n");
|
|
|
|
if (!endhost)
|
|
|
|
return false;
|
|
|
|
|
|
|
|
// Save the original host, so we can use it later on responses from the
|
|
|
|
// server.
|
2010-07-28 21:55:36 +04:00
|
|
|
ci->original_host.assign(host, endhost-host);
|
2010-06-17 09:38:55 +04:00
|
|
|
|
|
|
|
char newhost[40];
|
2010-07-28 21:55:36 +04:00
|
|
|
PR_NetAddrToString(&inet_addr, newhost, sizeof(newhost));
|
2010-06-17 09:38:55 +04:00
|
|
|
assert(strlen(newhost) < sizeof(newhost) - 7);
|
2010-07-28 21:55:36 +04:00
|
|
|
sprintf(newhost, "%s:%d", newhost, PR_ntohs(inet_addr.inet.port));
|
2010-06-17 09:38:55 +04:00
|
|
|
|
|
|
|
int diff = strlen(newhost) - (endhost-host);
|
|
|
|
if (diff > 0)
|
|
|
|
assert(size_t(diff) <= buffer.margin());
|
|
|
|
memmove(endhost + diff, endhost, buffer.buffertail - host - diff);
|
|
|
|
buffer.buffertail += diff;
|
|
|
|
|
|
|
|
memcpy(host, newhost, strlen(newhost));
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
2009-01-15 23:17:34 +03:00
|
|
|
/**
|
|
|
|
* This function prefixes Request-URI path with a full scheme-host-port
|
|
|
|
* string.
|
|
|
|
*/
|
|
|
|
bool AdjustRequestURI(relayBuffer& buffer, string *host)
|
|
|
|
{
|
|
|
|
assert(buffer.margin());
|
|
|
|
|
|
|
|
// Cannot use strnchr so add a null char at the end. There is always some space left
|
|
|
|
// because we preserve a margin.
|
|
|
|
buffer.buffertail[1] = '\0';
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_DEBUG((" incoming request to adjust:\n%s\n", buffer.bufferhead));
|
2009-01-15 23:17:34 +03:00
|
|
|
|
|
|
|
char *token, *path;
|
|
|
|
path = strchr(buffer.bufferhead, ' ') + 1;
|
|
|
|
if (!path)
|
|
|
|
return false;
|
|
|
|
|
|
|
|
// If the path doesn't start with a slash don't change it, it is probably '*' or a full
|
|
|
|
// path already. Return true, we are done with this request adjustment.
|
|
|
|
if (*path != '/')
|
|
|
|
return true;
|
|
|
|
|
|
|
|
token = strchr(path, ' ') + 1;
|
|
|
|
if (!token)
|
|
|
|
return false;
|
|
|
|
|
|
|
|
if (strncmp(token, "HTTP/", 5))
|
|
|
|
return false;
|
|
|
|
|
|
|
|
size_t hostlength = host->length();
|
|
|
|
assert(hostlength <= buffer.margin());
|
|
|
|
|
|
|
|
memmove(path + hostlength, path, buffer.buffertail - path);
|
|
|
|
memcpy(path, host->c_str(), hostlength);
|
|
|
|
buffer.buffertail += hostlength;
|
|
|
|
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
2008-09-05 17:35:58 +04:00
|
|
|
bool ConnectSocket(PRFileDesc *fd, const PRNetAddr *addr, PRIntervalTime timeout)
|
|
|
|
{
|
|
|
|
PRStatus stat = PR_Connect(fd, addr, timeout);
|
|
|
|
if (stat != PR_SUCCESS)
|
|
|
|
return false;
|
|
|
|
|
|
|
|
PRSocketOptionData option;
|
|
|
|
option.option = PR_SockOpt_Nonblocking;
|
2011-10-17 18:59:28 +04:00
|
|
|
option.value.non_blocking = true;
|
2008-09-05 17:35:58 +04:00
|
|
|
PR_SetSocketOption(fd, &option);
|
|
|
|
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
2008-04-11 03:46:11 +04:00
|
|
|
/*
|
|
|
|
* Handle an incoming client connection. The server thread has already
|
|
|
|
* accepted the connection, so we just need to connect to the remote
|
|
|
|
* port and then proxy data back and forth.
|
|
|
|
* The data parameter is a connection_info_t*, and must be deleted
|
|
|
|
* by this function.
|
|
|
|
*/
|
2008-10-10 19:04:34 +04:00
|
|
|
void HandleConnection(void* data)
|
2008-04-11 03:46:11 +04:00
|
|
|
{
|
|
|
|
connection_info_t* ci = static_cast<connection_info_t*>(data);
|
2010-05-22 00:43:09 +04:00
|
|
|
PRIntervalTime connect_timeout = PR_SecondsToInterval(30);
|
2008-04-11 03:46:11 +04:00
|
|
|
|
|
|
|
AutoFD other_sock(PR_NewTCPSocket());
|
|
|
|
bool client_done = false;
|
|
|
|
bool client_error = false;
|
2008-09-05 17:35:58 +04:00
|
|
|
bool connect_accepted = !do_http_proxy;
|
|
|
|
bool ssl_updated = !do_http_proxy;
|
2009-01-15 23:17:34 +03:00
|
|
|
bool expect_request_start = do_http_proxy;
|
2008-09-05 17:35:58 +04:00
|
|
|
string certificateToUse;
|
2011-11-03 01:43:27 +04:00
|
|
|
string locationHeader;
|
2009-01-15 22:19:15 +03:00
|
|
|
client_auth_option clientAuth;
|
2009-01-15 23:17:34 +03:00
|
|
|
string fullHost;
|
2008-09-05 17:35:58 +04:00
|
|
|
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_DEBUG(("SSLTUNNEL(%p)): incoming connection csock(0)=%p, ssock(1)=%p\n",
|
2010-02-03 03:29:19 +03:00
|
|
|
static_cast<void*>(data),
|
|
|
|
static_cast<void*>(ci->client_sock),
|
2010-10-25 20:47:23 +04:00
|
|
|
static_cast<void*>(other_sock)));
|
2008-09-05 17:35:58 +04:00
|
|
|
if (other_sock)
|
|
|
|
{
|
|
|
|
PRInt32 numberOfSockets = 1;
|
|
|
|
|
2009-01-15 23:17:34 +03:00
|
|
|
relayBuffer buffers[2];
|
2008-09-05 17:35:58 +04:00
|
|
|
|
|
|
|
if (!do_http_proxy)
|
|
|
|
{
|
2010-07-28 21:55:36 +04:00
|
|
|
if (!ci->http_proxy_only &&
|
2010-06-17 09:38:55 +04:00
|
|
|
!ConfigureSSLServerSocket(ci->client_sock, ci->server_info, certificateToUse, caNone))
|
2008-09-05 17:35:58 +04:00
|
|
|
client_error = true;
|
|
|
|
else if (!ConnectSocket(other_sock, &remote_addr, connect_timeout))
|
|
|
|
client_error = true;
|
|
|
|
else
|
|
|
|
numberOfSockets = 2;
|
|
|
|
}
|
|
|
|
|
|
|
|
PRPollDesc sockets[2] =
|
|
|
|
{
|
|
|
|
{ci->client_sock, PR_POLL_READ, 0},
|
|
|
|
{other_sock, PR_POLL_READ, 0}
|
|
|
|
};
|
2011-09-29 10:19:26 +04:00
|
|
|
bool socketErrorState[2] = {false, false};
|
2008-09-05 17:35:58 +04:00
|
|
|
|
|
|
|
while (!((client_error||client_done) && buffers[0].empty() && buffers[1].empty()))
|
|
|
|
{
|
|
|
|
sockets[0].in_flags |= PR_POLL_EXCEPT;
|
|
|
|
sockets[1].in_flags |= PR_POLL_EXCEPT;
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_DEBUG(("SSLTUNNEL(%p)): polling flags csock(0)=%c%c, ssock(1)=%c%c\n",
|
|
|
|
static_cast<void*>(data),
|
|
|
|
sockets[0].in_flags & PR_POLL_READ ? 'R' : '-',
|
|
|
|
sockets[0].in_flags & PR_POLL_WRITE ? 'W' : '-',
|
|
|
|
sockets[1].in_flags & PR_POLL_READ ? 'R' : '-',
|
|
|
|
sockets[1].in_flags & PR_POLL_WRITE ? 'W' : '-'));
|
2008-09-05 17:35:58 +04:00
|
|
|
PRInt32 pollStatus = PR_Poll(sockets, numberOfSockets, PR_MillisecondsToInterval(1000));
|
|
|
|
if (pollStatus < 0)
|
|
|
|
{
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_DEBUG(("SSLTUNNEL(%p)): pollStatus=%d, exiting\n",
|
|
|
|
static_cast<void*>(data), pollStatus));
|
2008-09-05 17:35:58 +04:00
|
|
|
client_error = true;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (pollStatus == 0)
|
2009-12-28 21:50:34 +03:00
|
|
|
{
|
2008-09-05 17:35:58 +04:00
|
|
|
// timeout
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_DEBUG(("SSLTUNNEL(%p)): poll timeout, looping\n",
|
|
|
|
static_cast<void*>(data)));
|
2008-09-05 17:35:58 +04:00
|
|
|
continue;
|
2009-12-28 21:50:34 +03:00
|
|
|
}
|
2008-09-05 17:35:58 +04:00
|
|
|
|
|
|
|
for (PRInt32 s = 0; s < numberOfSockets; ++s)
|
|
|
|
{
|
|
|
|
PRInt32 s2 = s == 1 ? 0 : 1;
|
|
|
|
PRInt16 out_flags = sockets[s].out_flags;
|
|
|
|
PRInt16 &in_flags = sockets[s].in_flags;
|
|
|
|
PRInt16 &in_flags2 = sockets[s2].in_flags;
|
|
|
|
sockets[s].out_flags = 0;
|
|
|
|
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_BEGIN_BLOCK();
|
|
|
|
LOG_DEBUG(("SSLTUNNEL(%p)): %csock(%d)=%p out_flags=%d",
|
|
|
|
static_cast<void*>(data),
|
|
|
|
s == 0 ? 'c' : 's',
|
|
|
|
s,
|
|
|
|
static_cast<void*>(sockets[s].fd),
|
|
|
|
out_flags));
|
2009-08-17 20:41:27 +04:00
|
|
|
if (out_flags & (PR_POLL_EXCEPT | PR_POLL_ERR | PR_POLL_HUP))
|
2008-09-05 17:35:58 +04:00
|
|
|
{
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_DEBUG((" :exception\n"));
|
2008-04-11 03:46:11 +04:00
|
|
|
client_error = true;
|
2011-10-17 18:59:28 +04:00
|
|
|
socketErrorState[s] = true;
|
2009-08-17 20:41:27 +04:00
|
|
|
// We got a fatal error state on the socket. Clear the output buffer
|
|
|
|
// for this socket to break the main loop, we will never more be able
|
|
|
|
// to send those data anyway.
|
|
|
|
buffers[s2].bufferhead = buffers[s2].buffertail = buffers[s2].buffer;
|
2008-09-05 17:35:58 +04:00
|
|
|
continue;
|
2009-08-17 21:25:35 +04:00
|
|
|
} // PR_POLL_EXCEPT, PR_POLL_ERR, PR_POLL_HUP handling
|
2008-09-05 17:35:58 +04:00
|
|
|
|
2011-06-25 18:06:02 +04:00
|
|
|
if (out_flags & PR_POLL_READ && !buffers[s].areafree())
|
2009-12-28 21:50:34 +03:00
|
|
|
{
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_DEBUG((" no place in read buffer but got read flag, dropping it now!"));
|
2010-02-03 03:29:19 +03:00
|
|
|
in_flags &= ~PR_POLL_READ;
|
2009-12-28 21:50:34 +03:00
|
|
|
}
|
|
|
|
|
2011-06-25 18:06:02 +04:00
|
|
|
if (out_flags & PR_POLL_READ && buffers[s].areafree())
|
2008-09-05 17:35:58 +04:00
|
|
|
{
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_DEBUG((" :reading"));
|
2008-09-05 17:35:58 +04:00
|
|
|
PRInt32 bytesRead = PR_Recv(sockets[s].fd, buffers[s].buffertail,
|
2011-06-25 18:06:02 +04:00
|
|
|
buffers[s].areafree(), 0, PR_INTERVAL_NO_TIMEOUT);
|
2008-09-05 17:35:58 +04:00
|
|
|
|
|
|
|
if (bytesRead == 0)
|
|
|
|
{
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_DEBUG((" socket gracefully closed"));
|
2008-09-05 17:35:58 +04:00
|
|
|
client_done = true;
|
|
|
|
in_flags &= ~PR_POLL_READ;
|
|
|
|
}
|
|
|
|
else if (bytesRead < 0)
|
|
|
|
{
|
|
|
|
if (PR_GetError() != PR_WOULD_BLOCK_ERROR)
|
2009-10-31 15:53:54 +03:00
|
|
|
{
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_DEBUG((" error=%d", PR_GetError()));
|
2009-10-31 15:53:54 +03:00
|
|
|
// We are in error state, indicate that the connection was
|
|
|
|
// not closed gracefully
|
2008-09-05 17:35:58 +04:00
|
|
|
client_error = true;
|
2011-10-17 18:59:28 +04:00
|
|
|
socketErrorState[s] = true;
|
2009-10-31 15:53:54 +03:00
|
|
|
// Wipe out our send buffer, we cannot send it anyway.
|
|
|
|
buffers[s2].bufferhead = buffers[s2].buffertail = buffers[s2].buffer;
|
|
|
|
}
|
2009-12-28 21:50:34 +03:00
|
|
|
else
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_DEBUG((" would block"));
|
2008-09-05 17:35:58 +04:00
|
|
|
}
|
|
|
|
else
|
|
|
|
{
|
2009-10-31 15:53:54 +03:00
|
|
|
// If the other socket is in error state (unable to send/receive)
|
|
|
|
// throw this data away and continue loop
|
|
|
|
if (socketErrorState[s2])
|
2009-12-28 21:50:34 +03:00
|
|
|
{
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_DEBUG((" have read but other socket is in error state\n"));
|
2009-10-31 15:53:54 +03:00
|
|
|
continue;
|
2009-12-28 21:50:34 +03:00
|
|
|
}
|
2009-10-31 15:53:54 +03:00
|
|
|
|
2008-09-05 17:35:58 +04:00
|
|
|
buffers[s].buffertail += bytesRead;
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_DEBUG((", read %d bytes", bytesRead));
|
2008-09-05 17:35:58 +04:00
|
|
|
|
|
|
|
// We have to accept and handle the initial CONNECT request here
|
|
|
|
PRInt32 response;
|
2009-01-15 23:17:34 +03:00
|
|
|
if (!connect_accepted && ReadConnectRequest(ci->server_info, buffers[s],
|
2011-11-03 01:43:27 +04:00
|
|
|
&response, certificateToUse, &clientAuth, fullHost, locationHeader))
|
2008-09-05 17:35:58 +04:00
|
|
|
{
|
2010-07-28 21:55:36 +04:00
|
|
|
// Mark this as a proxy-only connection (no SSL) if the CONNECT
|
|
|
|
// request didn't come for port 443 or from any of the server's
|
|
|
|
// cert or clientauth hostnames.
|
|
|
|
if (fullHost.find(":443") == string::npos)
|
|
|
|
{
|
|
|
|
server_match_t match;
|
|
|
|
match.fullHost = fullHost;
|
|
|
|
match.matched = false;
|
|
|
|
PL_HashTableEnumerateEntries(ci->server_info->host_cert_table,
|
|
|
|
match_hostname,
|
|
|
|
&match);
|
|
|
|
PL_HashTableEnumerateEntries(ci->server_info->host_clientauth_table,
|
|
|
|
match_hostname,
|
|
|
|
&match);
|
|
|
|
ci->http_proxy_only = !match.matched;
|
|
|
|
}
|
|
|
|
else
|
|
|
|
{
|
|
|
|
ci->http_proxy_only = false;
|
|
|
|
}
|
|
|
|
|
2008-09-05 17:35:58 +04:00
|
|
|
// Clean the request as it would be read
|
|
|
|
buffers[s].bufferhead = buffers[s].buffertail = buffers[s].buffer;
|
2010-01-26 16:33:03 +03:00
|
|
|
in_flags |= PR_POLL_WRITE;
|
|
|
|
connect_accepted = true;
|
2008-09-05 17:35:58 +04:00
|
|
|
|
2010-07-27 03:01:06 +04:00
|
|
|
// Store response to the oposite buffer
|
2011-11-03 01:43:27 +04:00
|
|
|
if (response == 200)
|
|
|
|
{
|
|
|
|
LOG_DEBUG((" accepted CONNECT request, connected to the server, sending OK to the client\n"));
|
|
|
|
strcpy(buffers[s2].buffer, "HTTP/1.1 200 Connected\r\nConnection: keep-alive\r\n\r\n");
|
|
|
|
}
|
|
|
|
else if (response == 302)
|
|
|
|
{
|
|
|
|
LOG_DEBUG((" accepted CONNECT request with redirection, "
|
|
|
|
"sending location and 302 to the client\n"));
|
|
|
|
client_done = true;
|
|
|
|
sprintf(buffers[s2].buffer,
|
|
|
|
"HTTP/1.1 302 Moved\r\n"
|
|
|
|
"Location: https://%s/\r\n"
|
|
|
|
"Connection: close\r\n\r\n",
|
|
|
|
locationHeader.c_str());
|
|
|
|
}
|
|
|
|
else
|
2008-09-05 17:35:58 +04:00
|
|
|
{
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_ERRORD((" could not read the connect request, closing connection with %d", response));
|
2008-09-05 17:35:58 +04:00
|
|
|
client_done = true;
|
|
|
|
sprintf(buffers[s2].buffer, "HTTP/1.1 %d ERROR\r\nConnection: close\r\n\r\n", response);
|
2011-11-03 01:43:27 +04:00
|
|
|
|
2008-09-05 17:35:58 +04:00
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
buffers[s2].buffertail = buffers[s2].buffer + strlen(buffers[s2].buffer);
|
|
|
|
|
|
|
|
// Send the response to the client socket
|
2008-04-11 03:46:11 +04:00
|
|
|
break;
|
2008-09-05 17:35:58 +04:00
|
|
|
} // end of CONNECT handling
|
|
|
|
|
2011-06-25 18:06:02 +04:00
|
|
|
if (!buffers[s].areafree())
|
2009-12-28 21:50:34 +03:00
|
|
|
{
|
|
|
|
// Do not poll for read when the buffer is full
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_DEBUG((" no place in our read buffer, stop reading"));
|
2008-09-05 17:35:58 +04:00
|
|
|
in_flags &= ~PR_POLL_READ;
|
2009-12-28 21:50:34 +03:00
|
|
|
}
|
2008-09-05 17:35:58 +04:00
|
|
|
|
|
|
|
if (ssl_updated)
|
2009-01-15 23:17:34 +03:00
|
|
|
{
|
2010-06-17 09:38:55 +04:00
|
|
|
if (s == 0 && expect_request_start)
|
|
|
|
{
|
2010-07-28 21:55:36 +04:00
|
|
|
if (!strstr(buffers[s].bufferhead, "\r\n\r\n"))
|
|
|
|
{
|
|
|
|
// We haven't received the complete header yet, so wait.
|
|
|
|
continue;
|
|
|
|
}
|
2010-06-17 09:38:55 +04:00
|
|
|
else
|
2010-07-28 21:55:36 +04:00
|
|
|
{
|
|
|
|
ci->iswebsocket = AdjustWebSocketHost(buffers[s], ci);
|
|
|
|
expect_request_start = !(ci->iswebsocket ||
|
|
|
|
AdjustRequestURI(buffers[s], &fullHost));
|
|
|
|
PRNetAddr* addr = &remote_addr;
|
|
|
|
if (ci->iswebsocket && websocket_server.inet.port)
|
|
|
|
addr = &websocket_server;
|
|
|
|
if (!ConnectSocket(other_sock, addr, connect_timeout))
|
|
|
|
{
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_ERRORD((" could not open connection to the real server\n"));
|
2010-07-28 21:55:36 +04:00
|
|
|
client_error = true;
|
|
|
|
break;
|
|
|
|
}
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_DEBUG(("\n connected to remote server\n"));
|
2010-07-28 21:55:36 +04:00
|
|
|
numberOfSockets = 2;
|
|
|
|
}
|
2010-06-17 09:38:55 +04:00
|
|
|
}
|
2010-07-28 21:55:36 +04:00
|
|
|
else if (s == 1 && ci->iswebsocket)
|
2010-06-17 09:38:55 +04:00
|
|
|
{
|
2010-07-28 21:55:36 +04:00
|
|
|
if (!AdjustWebSocketLocation(buffers[s], ci))
|
2010-06-17 09:38:55 +04:00
|
|
|
continue;
|
|
|
|
}
|
2009-01-15 23:17:34 +03:00
|
|
|
|
2008-09-05 17:35:58 +04:00
|
|
|
in_flags2 |= PR_POLL_WRITE;
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_DEBUG((" telling the other socket to write"));
|
2009-01-15 23:17:34 +03:00
|
|
|
}
|
2009-12-28 21:50:34 +03:00
|
|
|
else
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_DEBUG((" we have something for the other socket to write, but ssl has not been administered on it"));
|
2008-04-11 03:46:11 +04:00
|
|
|
}
|
2008-09-05 17:35:58 +04:00
|
|
|
} // PR_POLL_READ handling
|
|
|
|
|
|
|
|
if (out_flags & PR_POLL_WRITE)
|
|
|
|
{
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_DEBUG((" :writing"));
|
2008-09-05 17:35:58 +04:00
|
|
|
PRInt32 bytesWrite = PR_Send(sockets[s].fd, buffers[s2].bufferhead,
|
|
|
|
buffers[s2].present(), 0, PR_INTERVAL_NO_TIMEOUT);
|
|
|
|
|
|
|
|
if (bytesWrite < 0)
|
|
|
|
{
|
2009-08-06 18:29:26 +04:00
|
|
|
if (PR_GetError() != PR_WOULD_BLOCK_ERROR) {
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_DEBUG((" error=%d", PR_GetError()));
|
2008-09-05 17:35:58 +04:00
|
|
|
client_error = true;
|
2011-10-17 18:59:28 +04:00
|
|
|
socketErrorState[s] = true;
|
2009-08-06 18:29:26 +04:00
|
|
|
// We got a fatal error while writting the buffer. Clear it to break
|
|
|
|
// the main loop, we will never more be able to send it.
|
|
|
|
buffers[s2].bufferhead = buffers[s2].buffertail = buffers[s2].buffer;
|
|
|
|
}
|
2009-12-28 21:50:34 +03:00
|
|
|
else
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_DEBUG((" would block"));
|
2008-04-11 03:46:11 +04:00
|
|
|
}
|
2008-09-05 17:35:58 +04:00
|
|
|
else
|
|
|
|
{
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_DEBUG((", written %d bytes", bytesWrite));
|
2010-01-16 18:29:59 +03:00
|
|
|
buffers[s2].buffertail[1] = '\0';
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_DEBUG((" dump:\n%.*s\n", bytesWrite, buffers[s2].bufferhead));
|
2010-01-16 18:29:59 +03:00
|
|
|
|
2008-09-05 17:35:58 +04:00
|
|
|
buffers[s2].bufferhead += bytesWrite;
|
|
|
|
if (buffers[s2].present())
|
2009-12-28 21:50:34 +03:00
|
|
|
{
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_DEBUG((" still have to write %d bytes", (int)buffers[s2].present()));
|
2009-12-28 21:50:34 +03:00
|
|
|
in_flags |= PR_POLL_WRITE;
|
|
|
|
}
|
2008-09-05 17:35:58 +04:00
|
|
|
else
|
|
|
|
{
|
|
|
|
if (!ssl_updated)
|
|
|
|
{
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_DEBUG((" proxy response sent to the client"));
|
2008-09-05 17:35:58 +04:00
|
|
|
// Proxy response has just been writen, update to ssl
|
|
|
|
ssl_updated = true;
|
2010-07-28 21:55:36 +04:00
|
|
|
if (!ci->http_proxy_only &&
|
2010-06-17 09:38:55 +04:00
|
|
|
!ConfigureSSLServerSocket(ci->client_sock, ci->server_info, certificateToUse, clientAuth))
|
2008-09-05 17:35:58 +04:00
|
|
|
{
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_ERRORD((" failed to config server socket\n"));
|
2008-09-05 17:35:58 +04:00
|
|
|
client_error = true;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_DEBUG((" client socket updated to SSL"));
|
2008-09-05 17:35:58 +04:00
|
|
|
} // sslUpdate
|
|
|
|
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_DEBUG((" dropping our write flag and setting other socket read flag"));
|
2009-12-28 21:50:34 +03:00
|
|
|
in_flags &= ~PR_POLL_WRITE;
|
2008-09-05 17:35:58 +04:00
|
|
|
in_flags2 |= PR_POLL_READ;
|
|
|
|
buffers[s2].compact();
|
|
|
|
}
|
2008-04-11 03:46:11 +04:00
|
|
|
}
|
2008-09-05 17:35:58 +04:00
|
|
|
} // PR_POLL_WRITE handling
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_END_BLOCK(); // end the log
|
2008-09-05 17:35:58 +04:00
|
|
|
} // for...
|
|
|
|
} // while, poll
|
2008-04-11 03:46:11 +04:00
|
|
|
}
|
2008-09-05 17:35:58 +04:00
|
|
|
else
|
|
|
|
client_error = true;
|
|
|
|
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_DEBUG(("SSLTUNNEL(%p)): exiting root function for csock=%p, ssock=%p\n",
|
|
|
|
static_cast<void*>(data),
|
|
|
|
static_cast<void*>(ci->client_sock),
|
|
|
|
static_cast<void*>(other_sock)));
|
2008-04-11 03:46:11 +04:00
|
|
|
if (!client_error)
|
2008-09-05 17:35:58 +04:00
|
|
|
PR_Shutdown(ci->client_sock, PR_SHUTDOWN_SEND);
|
2008-04-11 03:46:11 +04:00
|
|
|
PR_Close(ci->client_sock);
|
|
|
|
|
|
|
|
delete ci;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Start listening for SSL connections on a specified port, handing
|
|
|
|
* them off to client threads after accepting the connection.
|
|
|
|
* The data parameter is a server_info_t*, owned by the calling
|
|
|
|
* function.
|
|
|
|
*/
|
2008-10-10 19:04:34 +04:00
|
|
|
void StartServer(void* data)
|
2008-04-11 03:46:11 +04:00
|
|
|
{
|
|
|
|
server_info_t* si = static_cast<server_info_t*>(data);
|
|
|
|
|
|
|
|
//TODO: select ciphers?
|
|
|
|
AutoFD listen_socket(PR_NewTCPSocket());
|
|
|
|
if (!listen_socket) {
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_ERROR(("failed to create socket\n"));
|
2008-04-11 03:46:11 +04:00
|
|
|
SignalShutdown();
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
2010-01-06 08:10:47 +03:00
|
|
|
// In case the socket is still open in the TIME_WAIT state from a previous
|
|
|
|
// instance of ssltunnel we ask to reuse the port.
|
|
|
|
PRSocketOptionData socket_option;
|
|
|
|
socket_option.option = PR_SockOpt_Reuseaddr;
|
2011-10-17 18:59:28 +04:00
|
|
|
socket_option.value.reuse_addr = true;
|
2010-01-06 08:10:47 +03:00
|
|
|
PR_SetSocketOption(listen_socket, &socket_option);
|
|
|
|
|
2008-04-11 03:46:11 +04:00
|
|
|
PRNetAddr server_addr;
|
|
|
|
PR_InitializeNetAddr(PR_IpAddrAny, si->listen_port, &server_addr);
|
|
|
|
if (PR_Bind(listen_socket, &server_addr) != PR_SUCCESS) {
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_ERROR(("failed to bind socket\n"));
|
2008-04-11 03:46:11 +04:00
|
|
|
SignalShutdown();
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (PR_Listen(listen_socket, 1) != PR_SUCCESS) {
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_ERROR(("failed to listen on socket\n"));
|
2008-04-11 03:46:11 +04:00
|
|
|
SignalShutdown();
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_INFO(("Server listening on port %d with cert %s\n", si->listen_port,
|
|
|
|
si->cert_nickname.c_str()));
|
2008-04-11 03:46:11 +04:00
|
|
|
|
|
|
|
while (!shutdown_server) {
|
|
|
|
connection_info_t* ci = new connection_info_t();
|
|
|
|
ci->server_info = si;
|
|
|
|
// block waiting for connections
|
|
|
|
ci->client_sock = PR_Accept(listen_socket, &ci->client_addr,
|
|
|
|
PR_INTERVAL_NO_TIMEOUT);
|
2008-09-05 17:35:58 +04:00
|
|
|
|
|
|
|
PRSocketOptionData option;
|
|
|
|
option.option = PR_SockOpt_Nonblocking;
|
2011-10-17 18:59:28 +04:00
|
|
|
option.value.non_blocking = true;
|
2008-09-05 17:35:58 +04:00
|
|
|
PR_SetSocketOption(ci->client_sock, &option);
|
|
|
|
|
2008-04-11 03:46:11 +04:00
|
|
|
if (ci->client_sock)
|
|
|
|
// Not actually using this PRJob*...
|
|
|
|
//PRJob* job =
|
2011-10-17 18:59:28 +04:00
|
|
|
PR_QueueJob(threads, HandleConnection, ci, true);
|
2008-04-11 03:46:11 +04:00
|
|
|
else
|
|
|
|
delete ci;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// bogus password func, just don't use passwords. :-P
|
|
|
|
char* password_func(PK11SlotInfo* slot, PRBool retry, void* arg)
|
|
|
|
{
|
|
|
|
if (retry)
|
|
|
|
return NULL;
|
|
|
|
|
2008-12-22 21:58:09 +03:00
|
|
|
return PL_strdup("");
|
2008-04-11 03:46:11 +04:00
|
|
|
}
|
|
|
|
|
2008-09-05 17:35:58 +04:00
|
|
|
server_info_t* findServerInfo(int portnumber)
|
2008-04-11 03:46:11 +04:00
|
|
|
{
|
2008-09-05 17:35:58 +04:00
|
|
|
for (vector<server_info_t>::iterator it = servers.begin();
|
|
|
|
it != servers.end(); it++)
|
|
|
|
{
|
|
|
|
if (it->listen_port == portnumber)
|
|
|
|
return &(*it);
|
2008-04-11 03:46:11 +04:00
|
|
|
}
|
|
|
|
|
2008-09-05 17:35:58 +04:00
|
|
|
return NULL;
|
|
|
|
}
|
2008-04-11 03:46:11 +04:00
|
|
|
|
2008-09-05 17:35:58 +04:00
|
|
|
int processConfigLine(char* configLine)
|
|
|
|
{
|
|
|
|
if (*configLine == 0 || *configLine == '#')
|
|
|
|
return 0;
|
|
|
|
|
2010-01-26 16:33:03 +03:00
|
|
|
char* _caret;
|
|
|
|
char* keyword = strtok2(configLine, ":", &_caret);
|
2008-09-05 17:35:58 +04:00
|
|
|
|
|
|
|
// Configure usage of http/ssl tunneling proxy behavior
|
|
|
|
if (!strcmp(keyword, "httpproxy"))
|
|
|
|
{
|
2010-01-26 16:33:03 +03:00
|
|
|
char* value = strtok2(_caret, ":", &_caret);
|
2008-09-05 17:35:58 +04:00
|
|
|
if (!strcmp(value, "1"))
|
|
|
|
do_http_proxy = true;
|
|
|
|
|
|
|
|
return 0;
|
2008-04-11 03:46:11 +04:00
|
|
|
}
|
|
|
|
|
2010-07-28 21:55:36 +04:00
|
|
|
if (!strcmp(keyword, "websocketserver"))
|
2008-09-05 17:35:58 +04:00
|
|
|
{
|
2010-01-26 16:33:03 +03:00
|
|
|
char* ipstring = strtok2(_caret, ":", &_caret);
|
2010-07-28 21:55:36 +04:00
|
|
|
if (PR_StringToNetAddr(ipstring, &websocket_server) != PR_SUCCESS) {
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_ERROR(("Invalid IP address in proxy config: %s\n", ipstring));
|
2008-09-05 17:35:58 +04:00
|
|
|
return 1;
|
|
|
|
}
|
2010-07-28 21:55:36 +04:00
|
|
|
char* remoteport = strtok2(_caret, ":", &_caret);
|
|
|
|
int port = atoi(remoteport);
|
2008-09-05 17:35:58 +04:00
|
|
|
if (port <= 0) {
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_ERROR(("Invalid remote port in proxy config: %s\n", remoteport));
|
2008-09-05 17:35:58 +04:00
|
|
|
return 1;
|
|
|
|
}
|
2010-07-28 21:55:36 +04:00
|
|
|
websocket_server.inet.port = PR_htons(port);
|
2008-09-05 17:35:58 +04:00
|
|
|
return 0;
|
2008-04-11 03:46:11 +04:00
|
|
|
}
|
2008-09-05 17:35:58 +04:00
|
|
|
|
2010-07-28 21:55:36 +04:00
|
|
|
// Configure the forward address of the target server
|
|
|
|
if (!strcmp(keyword, "forward"))
|
2010-06-17 09:38:55 +04:00
|
|
|
{
|
|
|
|
char* ipstring = strtok2(_caret, ":", &_caret);
|
2010-07-28 21:55:36 +04:00
|
|
|
if (PR_StringToNetAddr(ipstring, &remote_addr) != PR_SUCCESS) {
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_ERROR(("Invalid remote IP address: %s\n", ipstring));
|
2010-06-17 09:38:55 +04:00
|
|
|
return 1;
|
|
|
|
}
|
2010-07-28 21:55:36 +04:00
|
|
|
char* serverportstring = strtok2(_caret, ":", &_caret);
|
|
|
|
int port = atoi(serverportstring);
|
2010-06-17 09:38:55 +04:00
|
|
|
if (port <= 0) {
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_ERROR(("Invalid remote port: %s\n", serverportstring));
|
2010-06-17 09:38:55 +04:00
|
|
|
return 1;
|
|
|
|
}
|
2010-07-28 21:55:36 +04:00
|
|
|
remote_addr.inet.port = PR_htons(port);
|
|
|
|
|
2010-06-17 09:38:55 +04:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-09-05 17:35:58 +04:00
|
|
|
// Configure all listen sockets and port+certificate bindings
|
|
|
|
if (!strcmp(keyword, "listen"))
|
|
|
|
{
|
2010-01-26 16:33:03 +03:00
|
|
|
char* hostname = strtok2(_caret, ":", &_caret);
|
2008-09-05 17:35:58 +04:00
|
|
|
char* hostportstring = NULL;
|
|
|
|
if (strcmp(hostname, "*"))
|
|
|
|
{
|
2009-01-15 22:19:15 +03:00
|
|
|
any_host_spec_config = true;
|
2010-01-26 16:33:03 +03:00
|
|
|
hostportstring = strtok2(_caret, ":", &_caret);
|
2008-09-05 17:35:58 +04:00
|
|
|
}
|
|
|
|
|
2010-01-26 16:33:03 +03:00
|
|
|
char* serverportstring = strtok2(_caret, ":", &_caret);
|
|
|
|
char* certnick = strtok2(_caret, ":", &_caret);
|
2008-09-05 17:35:58 +04:00
|
|
|
|
2009-01-15 22:19:15 +03:00
|
|
|
int port = atoi(serverportstring);
|
2008-04-11 03:46:11 +04:00
|
|
|
if (port <= 0) {
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_ERROR(("Invalid port specified: %s\n", serverportstring));
|
2008-04-11 03:46:11 +04:00
|
|
|
return 1;
|
|
|
|
}
|
2008-09-05 17:35:58 +04:00
|
|
|
|
|
|
|
if (server_info_t* existingServer = findServerInfo(port))
|
|
|
|
{
|
|
|
|
char *certnick_copy = new char[strlen(certnick)+1];
|
|
|
|
char *hostname_copy = new char[strlen(hostname)+strlen(hostportstring)+2];
|
|
|
|
|
|
|
|
strcpy(hostname_copy, hostname);
|
|
|
|
strcat(hostname_copy, ":");
|
|
|
|
strcat(hostname_copy, hostportstring);
|
|
|
|
strcpy(certnick_copy, certnick);
|
|
|
|
|
2009-01-15 22:19:15 +03:00
|
|
|
PLHashEntry* entry = PL_HashTableAdd(existingServer->host_cert_table, hostname_copy, certnick_copy);
|
|
|
|
if (!entry) {
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_ERROR(("Out of memory"));
|
2009-01-15 22:19:15 +03:00
|
|
|
return 1;
|
|
|
|
}
|
2008-09-05 17:35:58 +04:00
|
|
|
}
|
|
|
|
else
|
|
|
|
{
|
|
|
|
server_info_t server;
|
|
|
|
server.cert_nickname = certnick;
|
|
|
|
server.listen_port = port;
|
|
|
|
server.host_cert_table = PL_NewHashTable(0, PL_HashString, PL_CompareStrings, PL_CompareStrings, NULL, NULL);
|
|
|
|
if (!server.host_cert_table)
|
|
|
|
{
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_ERROR(("Internal, could not create hash table\n"));
|
2008-09-05 17:35:58 +04:00
|
|
|
return 1;
|
|
|
|
}
|
2009-01-15 22:19:15 +03:00
|
|
|
server.host_clientauth_table = PL_NewHashTable(0, PL_HashString, PL_CompareStrings, ClientAuthValueComparator, NULL, NULL);
|
|
|
|
if (!server.host_clientauth_table)
|
|
|
|
{
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_ERROR(("Internal, could not create hash table\n"));
|
2009-01-15 22:19:15 +03:00
|
|
|
return 1;
|
|
|
|
}
|
2011-11-03 01:43:27 +04:00
|
|
|
server.host_redir_table = PL_NewHashTable(0, PL_HashString, PL_CompareStrings, PL_CompareStrings, NULL, NULL);
|
|
|
|
if (!server.host_redir_table)
|
|
|
|
{
|
|
|
|
LOG_ERROR(("Internal, could not create hash table\n"));
|
|
|
|
return 1;
|
|
|
|
}
|
2008-09-05 17:35:58 +04:00
|
|
|
servers.push_back(server);
|
|
|
|
}
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2009-01-15 22:19:15 +03:00
|
|
|
if (!strcmp(keyword, "clientauth"))
|
|
|
|
{
|
2010-01-26 16:33:03 +03:00
|
|
|
char* hostname = strtok2(_caret, ":", &_caret);
|
|
|
|
char* hostportstring = strtok2(_caret, ":", &_caret);
|
|
|
|
char* serverportstring = strtok2(_caret, ":", &_caret);
|
2009-01-15 22:19:15 +03:00
|
|
|
|
|
|
|
int port = atoi(serverportstring);
|
|
|
|
if (port <= 0) {
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_ERROR(("Invalid port specified: %s\n", serverportstring));
|
2009-01-15 22:19:15 +03:00
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (server_info_t* existingServer = findServerInfo(port))
|
|
|
|
{
|
2010-01-26 16:33:03 +03:00
|
|
|
char* authoptionstring = strtok2(_caret, ":", &_caret);
|
2009-01-15 22:19:15 +03:00
|
|
|
client_auth_option* authoption = new client_auth_option;
|
|
|
|
if (!authoption) {
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_ERROR(("Out of memory"));
|
2009-01-15 22:19:15 +03:00
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!strcmp(authoptionstring, "require"))
|
|
|
|
*authoption = caRequire;
|
|
|
|
else if (!strcmp(authoptionstring, "request"))
|
|
|
|
*authoption = caRequest;
|
|
|
|
else if (!strcmp(authoptionstring, "none"))
|
|
|
|
*authoption = caNone;
|
|
|
|
else
|
|
|
|
{
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_ERROR(("Incorrect client auth option modifier for host '%s'", hostname));
|
2009-01-15 22:19:15 +03:00
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
any_host_spec_config = true;
|
|
|
|
|
|
|
|
char *hostname_copy = new char[strlen(hostname)+strlen(hostportstring)+2];
|
|
|
|
if (!hostname_copy) {
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_ERROR(("Out of memory"));
|
2009-01-15 22:19:15 +03:00
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
strcpy(hostname_copy, hostname);
|
|
|
|
strcat(hostname_copy, ":");
|
|
|
|
strcat(hostname_copy, hostportstring);
|
|
|
|
|
|
|
|
PLHashEntry* entry = PL_HashTableAdd(existingServer->host_clientauth_table, hostname_copy, authoption);
|
|
|
|
if (!entry) {
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_ERROR(("Out of memory"));
|
2009-01-15 22:19:15 +03:00
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
else
|
|
|
|
{
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_ERROR(("Server on port %d for client authentication option is not defined, use 'listen' option first", port));
|
2009-01-15 22:19:15 +03:00
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2011-11-03 01:43:27 +04:00
|
|
|
if (!strcmp(keyword, "redirhost"))
|
|
|
|
{
|
|
|
|
char* hostname = strtok2(_caret, ":", &_caret);
|
|
|
|
char* hostportstring = strtok2(_caret, ":", &_caret);
|
|
|
|
char* serverportstring = strtok2(_caret, ":", &_caret);
|
|
|
|
|
|
|
|
int port = atoi(serverportstring);
|
|
|
|
if (port <= 0) {
|
|
|
|
LOG_ERROR(("Invalid port specified: %s\n", serverportstring));
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (server_info_t* existingServer = findServerInfo(port))
|
|
|
|
{
|
|
|
|
char* redirhoststring = strtok2(_caret, ":", &_caret);
|
|
|
|
|
|
|
|
any_host_spec_config = true;
|
|
|
|
|
|
|
|
char *hostname_copy = new char[strlen(hostname)+strlen(hostportstring)+2];
|
|
|
|
if (!hostname_copy) {
|
|
|
|
LOG_ERROR(("Out of memory"));
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
strcpy(hostname_copy, hostname);
|
|
|
|
strcat(hostname_copy, ":");
|
|
|
|
strcat(hostname_copy, hostportstring);
|
|
|
|
|
|
|
|
char *redir_copy = new char[strlen(redirhoststring)+1];
|
|
|
|
strcpy(redir_copy, redirhoststring);
|
|
|
|
PLHashEntry* entry = PL_HashTableAdd(existingServer->host_redir_table, hostname_copy, redir_copy);
|
|
|
|
if (!entry) {
|
|
|
|
LOG_ERROR(("Out of memory"));
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
else
|
|
|
|
{
|
|
|
|
LOG_ERROR(("Server on port %d for redirhost option is not defined, use 'listen' option first", port));
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-09-05 17:35:58 +04:00
|
|
|
// Configure the NSS certificate database directory
|
|
|
|
if (!strcmp(keyword, "certdbdir"))
|
|
|
|
{
|
2010-01-26 16:33:03 +03:00
|
|
|
nssconfigdir = strtok2(_caret, "\n", &_caret);
|
2008-09-05 17:35:58 +04:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_ERROR(("Error: keyword \"%s\" unexpected\n", keyword));
|
2008-09-05 17:35:58 +04:00
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
int parseConfigFile(const char* filePath)
|
|
|
|
{
|
|
|
|
FILE* f = fopen(filePath, "r");
|
|
|
|
if (!f)
|
|
|
|
return 1;
|
|
|
|
|
|
|
|
char buffer[1024], *b = buffer;
|
|
|
|
while (!feof(f))
|
|
|
|
{
|
|
|
|
char c;
|
|
|
|
fscanf(f, "%c", &c);
|
|
|
|
switch (c)
|
|
|
|
{
|
|
|
|
case '\n':
|
|
|
|
*b++ = 0;
|
|
|
|
if (processConfigLine(buffer))
|
|
|
|
return 1;
|
|
|
|
b = buffer;
|
|
|
|
case '\r':
|
|
|
|
continue;
|
|
|
|
default:
|
|
|
|
*b++ = c;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
fclose(f);
|
|
|
|
|
|
|
|
// Check mandatory items
|
|
|
|
if (nssconfigdir.empty())
|
|
|
|
{
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_ERROR(("Error: missing path to NSS certification database\n,use certdbdir:<path> in the config file\n"));
|
2008-09-05 17:35:58 +04:00
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
2009-01-15 22:19:15 +03:00
|
|
|
if (any_host_spec_config && !do_http_proxy)
|
2008-09-05 17:35:58 +04:00
|
|
|
{
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_ERROR(("Warning: any host-specific configurations are ignored, add httpproxy:1 to allow them\n"));
|
2008-09-05 17:35:58 +04:00
|
|
|
}
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2009-01-15 22:19:15 +03:00
|
|
|
PRIntn freeHostCertHashItems(PLHashEntry *he, PRIntn i, void *arg)
|
2008-09-05 17:35:58 +04:00
|
|
|
{
|
|
|
|
delete [] (char*)he->key;
|
|
|
|
delete [] (char*)he->value;
|
|
|
|
return HT_ENUMERATE_REMOVE;
|
|
|
|
}
|
|
|
|
|
2011-11-03 01:43:27 +04:00
|
|
|
PRIntn freeHostRedirHashItems(PLHashEntry *he, PRIntn i, void *arg)
|
|
|
|
{
|
|
|
|
delete [] (char*)he->key;
|
|
|
|
delete [] (char*)he->value;
|
|
|
|
return HT_ENUMERATE_REMOVE;
|
|
|
|
}
|
|
|
|
|
2009-01-15 22:19:15 +03:00
|
|
|
PRIntn freeClientAuthHashItems(PLHashEntry *he, PRIntn i, void *arg)
|
|
|
|
{
|
|
|
|
delete [] (char*)he->key;
|
|
|
|
delete (client_auth_option*)he->value;
|
|
|
|
return HT_ENUMERATE_REMOVE;
|
|
|
|
}
|
|
|
|
|
2008-09-05 17:35:58 +04:00
|
|
|
int main(int argc, char** argv)
|
|
|
|
{
|
2009-05-26 12:53:15 +04:00
|
|
|
const char* configFilePath;
|
2010-10-25 20:47:23 +04:00
|
|
|
|
|
|
|
const char* logLevelEnv = PR_GetEnv("SSLTUNNEL_LOG_LEVEL");
|
|
|
|
gLogLevel = logLevelEnv ? (LogLevel)atoi(logLevelEnv) : LEVEL_INFO;
|
|
|
|
|
2008-09-05 17:35:58 +04:00
|
|
|
if (argc == 1)
|
|
|
|
configFilePath = "ssltunnel.cfg";
|
|
|
|
else
|
|
|
|
configFilePath = argv[1];
|
|
|
|
|
2010-07-28 21:55:36 +04:00
|
|
|
memset(&websocket_server, 0, sizeof(PRNetAddr));
|
|
|
|
|
2008-09-05 17:35:58 +04:00
|
|
|
if (parseConfigFile(configFilePath)) {
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_ERROR(("Error: config file \"%s\" missing or formating incorrect\n"
|
2008-09-05 17:35:58 +04:00
|
|
|
"Specify path to the config file as parameter to ssltunnel or \n"
|
|
|
|
"create ssltunnel.cfg in the working directory.\n\n"
|
|
|
|
"Example format of the config file:\n\n"
|
|
|
|
" # Enable http/ssl tunneling proxy-like behavior.\n"
|
|
|
|
" # If not specified ssltunnel simply does direct forward.\n"
|
|
|
|
" httpproxy:1\n\n"
|
|
|
|
" # Specify path to the certification database used.\n"
|
|
|
|
" certdbdir:/path/to/certdb\n\n"
|
|
|
|
" # Forward/proxy all requests in raw to 127.0.0.1:8888.\n"
|
|
|
|
" forward:127.0.0.1:8888\n\n"
|
|
|
|
" # Accept connections on port 4443 or 5678 resp. and authenticate\n"
|
|
|
|
" # to any host ('*') using the 'server cert' or 'server cert 2' resp.\n"
|
|
|
|
" listen:*:4443:server cert\n"
|
|
|
|
" listen:*:5678:server cert 2\n\n"
|
|
|
|
" # Accept connections on port 4443 and authenticate using\n"
|
|
|
|
" # 'a different cert' when target host is 'my.host.name:443'.\n"
|
2009-01-15 22:19:15 +03:00
|
|
|
" # This only works in httpproxy mode and has higher priority\n"
|
|
|
|
" # than the previous option.\n"
|
|
|
|
" listen:my.host.name:443:4443:a different cert\n\n"
|
|
|
|
" # To make a specific host require or just request a client certificate\n"
|
|
|
|
" # to authenticate use the following options. This can only be used\n"
|
|
|
|
" # in httpproxy mode and only after the 'listen' option has been\n"
|
|
|
|
" # specified. You also have to specify the tunnel listen port.\n"
|
|
|
|
" clientauth:requesting-client-cert.host.com:443:4443:request\n"
|
2010-06-17 09:38:55 +04:00
|
|
|
" clientauth:requiring-client-cert.host.com:443:4443:require\n"
|
2010-07-28 21:55:36 +04:00
|
|
|
" # Proxy WebSocket traffic to the server at 127.0.0.1:9999,\n"
|
|
|
|
" # instead of the server specified in the 'forward' option.\n"
|
|
|
|
" websocketserver:127.0.0.1:9999\n",
|
2010-10-25 20:47:23 +04:00
|
|
|
configFilePath));
|
2008-09-05 17:35:58 +04:00
|
|
|
return 1;
|
2008-04-11 03:46:11 +04:00
|
|
|
}
|
|
|
|
|
|
|
|
// create a thread pool to handle connections
|
2011-08-04 01:36:49 +04:00
|
|
|
threads = PR_CreateThreadPool(INITIAL_THREADS * servers.size(),
|
|
|
|
MAX_THREADS * servers.size(),
|
2008-04-11 03:46:11 +04:00
|
|
|
DEFAULT_STACKSIZE);
|
|
|
|
if (!threads) {
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_ERROR(("Failed to create thread pool\n"));
|
2008-04-11 03:46:11 +04:00
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
shutdown_lock = PR_NewLock();
|
|
|
|
if (!shutdown_lock) {
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_ERROR(("Failed to create lock\n"));
|
2008-04-11 03:46:11 +04:00
|
|
|
PR_ShutdownThreadPool(threads);
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
shutdown_condvar = PR_NewCondVar(shutdown_lock);
|
|
|
|
if (!shutdown_condvar) {
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_ERROR(("Failed to create condvar\n"));
|
2008-04-11 03:46:11 +04:00
|
|
|
PR_ShutdownThreadPool(threads);
|
|
|
|
PR_DestroyLock(shutdown_lock);
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
PK11_SetPasswordFunc(password_func);
|
|
|
|
|
|
|
|
// Initialize NSS
|
2008-09-05 17:35:58 +04:00
|
|
|
if (NSS_Init(nssconfigdir.c_str()) != SECSuccess) {
|
2008-04-11 03:46:11 +04:00
|
|
|
PRInt32 errorlen = PR_GetErrorTextLength();
|
|
|
|
char* err = new char[errorlen+1];
|
|
|
|
PR_GetErrorText(err);
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_ERROR(("Failed to init NSS: %s", err));
|
2008-04-11 03:46:11 +04:00
|
|
|
delete[] err;
|
|
|
|
PR_ShutdownThreadPool(threads);
|
|
|
|
PR_DestroyCondVar(shutdown_condvar);
|
|
|
|
PR_DestroyLock(shutdown_lock);
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (NSS_SetDomesticPolicy() != SECSuccess) {
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_ERROR(("NSS_SetDomesticPolicy failed\n"));
|
2008-04-11 03:46:11 +04:00
|
|
|
PR_ShutdownThreadPool(threads);
|
|
|
|
PR_DestroyCondVar(shutdown_condvar);
|
|
|
|
PR_DestroyLock(shutdown_lock);
|
|
|
|
NSS_Shutdown();
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
// these values should make NSS use the defaults
|
|
|
|
if (SSL_ConfigServerSessionIDCache(0, 0, 0, NULL) != SECSuccess) {
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_ERROR(("SSL_ConfigServerSessionIDCache failed\n"));
|
2008-04-11 03:46:11 +04:00
|
|
|
PR_ShutdownThreadPool(threads);
|
|
|
|
PR_DestroyCondVar(shutdown_condvar);
|
|
|
|
PR_DestroyLock(shutdown_lock);
|
|
|
|
NSS_Shutdown();
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
for (vector<server_info_t>::iterator it = servers.begin();
|
|
|
|
it != servers.end(); it++) {
|
|
|
|
// Not actually using this PRJob*...
|
|
|
|
// PRJob* server_job =
|
2011-10-17 18:59:28 +04:00
|
|
|
PR_QueueJob(threads, StartServer, &(*it), true);
|
2008-04-11 03:46:11 +04:00
|
|
|
}
|
|
|
|
// now wait for someone to tell us to quit
|
|
|
|
PR_Lock(shutdown_lock);
|
|
|
|
PR_WaitCondVar(shutdown_condvar, PR_INTERVAL_NO_TIMEOUT);
|
|
|
|
PR_Unlock(shutdown_lock);
|
|
|
|
shutdown_server = true;
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_INFO(("Shutting down...\n"));
|
2008-04-11 03:46:11 +04:00
|
|
|
// cleanup
|
|
|
|
PR_ShutdownThreadPool(threads);
|
|
|
|
PR_JoinThreadPool(threads);
|
|
|
|
PR_DestroyCondVar(shutdown_condvar);
|
|
|
|
PR_DestroyLock(shutdown_lock);
|
|
|
|
if (NSS_Shutdown() == SECFailure) {
|
2010-10-25 20:47:23 +04:00
|
|
|
LOG_DEBUG(("Leaked NSS objects!\n"));
|
2008-04-11 03:46:11 +04:00
|
|
|
}
|
2008-09-05 17:35:58 +04:00
|
|
|
|
|
|
|
for (vector<server_info_t>::iterator it = servers.begin();
|
|
|
|
it != servers.end(); it++)
|
|
|
|
{
|
2009-01-15 22:19:15 +03:00
|
|
|
PL_HashTableEnumerateEntries(it->host_cert_table, freeHostCertHashItems, NULL);
|
|
|
|
PL_HashTableEnumerateEntries(it->host_clientauth_table, freeClientAuthHashItems, NULL);
|
2011-11-03 01:43:27 +04:00
|
|
|
PL_HashTableEnumerateEntries(it->host_redir_table, freeHostRedirHashItems, NULL);
|
2008-09-05 17:35:58 +04:00
|
|
|
PL_HashTableDestroy(it->host_cert_table);
|
2009-01-15 22:19:15 +03:00
|
|
|
PL_HashTableDestroy(it->host_clientauth_table);
|
2011-11-03 01:43:27 +04:00
|
|
|
PL_HashTableDestroy(it->host_redir_table);
|
2008-09-05 17:35:58 +04:00
|
|
|
}
|
|
|
|
|
2008-04-11 03:46:11 +04:00
|
|
|
PR_Cleanup();
|
|
|
|
return 0;
|
|
|
|
}
|