#ifdef FEATURE_HTTPS_INSPECTION
privoxy_mutex_t certificate_mutex;
-privoxy_mutex_t rng_mutex;
+privoxy_mutex_t ssl_init_mutex;
#endif
#ifdef FEATURE_EXTERNAL_FILTERS
#ifdef FEATURE_CLIENT_TAGS
privoxy_mutex_t client_tags_mutex;
#endif
+#ifdef FEATURE_EXTENDED_STATISTICS
+privoxy_mutex_t filter_statistics_mutex;
+privoxy_mutex_t block_statistics_mutex;
+#endif
#if !defined(HAVE_GETHOSTBYADDR_R) || !defined(HAVE_GETHOSTBYNAME_R)
privoxy_mutex_t resolver_mutex;
#ifdef FEATURE_HTTPS_INSPECTION
if (client_use_ssl(csp))
{
- ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl),
+ ssl_send_data_delayed(&(csp->ssl_client_attr),
(const unsigned char *)response, strlen(response),
get_write_delay(csp));
}
}
else if (JB_ERR_OK == get_destination_from_headers(headers, csp->http))
{
-#ifndef FEATURE_EXTENDED_HOST_PATTERNS
/* Split the domain we just got for pattern matching */
init_domain_components(csp->http);
-#endif
return JB_ERR_OK;
}
#ifdef FEATURE_HTTPS_INSPECTION
if (client_use_ssl(csp))
{
- if ((ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl),
+ if ((ssl_send_data_delayed(&(csp->ssl_client_attr),
(const unsigned char *)rsp->head, rsp->head_length,
get_write_delay(csp)) < 0)
- || (ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl),
+ || (ssl_send_data_delayed(&(csp->ssl_client_attr),
(const unsigned char *)rsp->body, rsp->content_length,
get_write_delay(csp)) < 0))
{
{
int content_length_known = csp->expected_client_content_length != 0;
- while (is_ssl_pending(&(csp->mbedtls_client_attr.ssl))
+ while (is_ssl_pending(&(csp->ssl_client_attr))
|| (content_length_known && csp->expected_client_content_length != 0))
{
unsigned char buf[BUFFER_SIZE];
log_error(LOG_LEVEL_CONNECT,
"Waiting for up to %d bytes of POST data from the client.",
max_bytes_to_read);
- len = ssl_recv_data(&(csp->mbedtls_client_attr.ssl), buf,
+ len = ssl_recv_data(&(csp->ssl_client_attr), buf,
(unsigned)max_bytes_to_read);
if (len == -1)
{
}
log_error(LOG_LEVEL_CONNECT, "Forwarding %d bytes of encrypted POST data",
len);
- len = ssl_send_data(&(csp->mbedtls_server_attr.ssl), buf, (size_t)len);
+ len = ssl_send_data(&(csp->ssl_server_attr), buf, (size_t)len);
if (len == -1)
{
return 1;
* Write the client's (modified) header to the server
* (along with anything else that may be in the buffer)
*/
- ret = ssl_send_data(&(csp->mbedtls_server_attr.ssl),
+ ret = ssl_send_data(&(csp->ssl_server_attr),
(const unsigned char *)hdr, strlen(hdr));
freez(hdr);
}
if (((csp->flags & CSP_FLAG_PIPELINED_REQUEST_WAITING) == 0)
- && ((flushed = ssl_flush_socket(&(csp->mbedtls_server_attr.ssl),
+ && ((flushed = ssl_flush_socket(&(csp->ssl_server_attr),
csp->client_iob)) < 0))
{
log_error(LOG_LEVEL_CONNECT, "Failed sending request body to: %s: %E",
do
{
log_error(LOG_LEVEL_HEADER, "Reading encrypted headers");
- if (!data_is_available(csp->cfd, (int)csp->config->keep_alive_timeout))
+ if (!is_ssl_pending(&(csp->ssl_client_attr)) &&
+ !data_is_available(csp->cfd, csp->config->socket_timeout))
{
log_error(LOG_LEVEL_CONNECT,
"Socket %d timed out while waiting for client headers", csp->cfd);
return JB_ERR_PARSE;
}
- len = ssl_recv_data(&(csp->mbedtls_client_attr.ssl),
+ len = ssl_recv_data(&(csp->ssl_client_attr),
(unsigned char *)buf, sizeof(buf));
if (len == -1)
{
/* XXX: Also used for JB_ERR_MEMORY */
log_error(LOG_LEVEL_ERROR, "Failed to receive encrypted request: %s",
jb_err_to_string(err));
- ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl),
+ ssl_send_data_delayed(&(csp->ssl_client_attr),
(const unsigned char *)CHEADER, strlen(CHEADER), get_write_delay(csp));
return err;
}
if (request_line == NULL)
{
log_error(LOG_LEVEL_ERROR, "Failed to get the encrypted request line");
- ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl),
+ ssl_send_data_delayed(&(csp->ssl_client_attr),
(const unsigned char *)CHEADER, strlen(CHEADER), get_write_delay(csp));
return JB_ERR_PARSE;
}
freez(request_line);
if (JB_ERR_OK != err)
{
- ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl),
+ ssl_send_data_delayed(&(csp->ssl_client_attr),
(const unsigned char *)CHEADER, strlen(CHEADER), get_write_delay(csp));
/* XXX: Use correct size */
log_error(LOG_LEVEL_CLF, "%s - - [%T] \"Invalid request\" 400 0", csp->ip_addr_str);
*/
log_error(LOG_LEVEL_ERROR,
"Failed to get the encrypted request destination");
- ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl),
+ ssl_send_data_delayed(&(csp->ssl_client_attr),
(const unsigned char *)CHEADER, strlen(CHEADER), get_write_delay(csp));
return JB_ERR_PARSE;
}
-#ifndef FEATURE_EXTENDED_HOST_PATTERNS
/* Split the domain we just got for pattern matching */
init_domain_components(csp->http);
-#endif
#ifdef FEATURE_TOGGLE
if ((csp->flags & CSP_FLAG_TOGGLED_ON) != 0)
err = sed_https(csp);
if (JB_ERR_OK != err)
{
- ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl),
+ ssl_send_data_delayed(&(csp->ssl_client_attr),
(const unsigned char *)CHEADER, strlen(CHEADER), get_write_delay(csp));
log_error(LOG_LEVEL_ERROR, "Failed to parse client request from %s.",
csp->ip_addr_str);
*/
if (server_use_ssl(csp))
{
- len = ssl_recv_data(&(csp->mbedtls_server_attr.ssl),
+ len = ssl_recv_data(&(csp->ssl_server_attr),
(unsigned char *)csp->receive_buffer, csp->receive_buffer_size);
}
else
*/
if (client_use_ssl(csp))
{
- if ((ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl),
+ if ((ssl_send_data_delayed(&(csp->ssl_client_attr),
(const unsigned char *)hdr, strlen(hdr),
get_write_delay(csp)) < 0)
- || (ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl),
+ || (ssl_send_data_delayed(&(csp->ssl_client_attr),
(const unsigned char *) ((p != NULL) ? p : csp->iob->cur),
csp->content_length, get_write_delay(csp)) < 0))
{
*/
if (client_use_ssl(csp))
{
- if ((ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl),
+ if ((ssl_send_data_delayed(&(csp->ssl_client_attr),
(const unsigned char *)hdr, hdrlen, get_write_delay(csp)) < 0)
- || ((flushed = ssl_flush_socket(&(csp->mbedtls_client_attr.ssl),
+ || ((flushed = ssl_flush_socket(&(csp->ssl_client_attr),
csp->iob)) < 0)
- || (ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl),
+ || (ssl_send_data_delayed(&(csp->ssl_client_attr),
(const unsigned char *)csp->receive_buffer, (size_t)len,
get_write_delay(csp)) < 0))
{
*/
if (client_use_ssl(csp))
{
- ret = ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl),
+ ret = ssl_send_data_delayed(&(csp->ssl_client_attr),
(const unsigned char *)csp->receive_buffer, (size_t)len,
get_write_delay(csp));
if (ret < 0)
*/
if (client_use_ssl(csp))
{
- ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl),
+ ssl_send_data_delayed(&(csp->ssl_client_attr),
(const unsigned char *)INVALID_SERVER_HEADERS_RESPONSE,
strlen(INVALID_SERVER_HEADERS_RESPONSE), get_write_delay(csp));
}
*/
if (client_use_ssl(csp))
{
- ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl),
+ ssl_send_data_delayed(&(csp->ssl_client_attr),
(const unsigned char *)INVALID_SERVER_HEADERS_RESPONSE,
strlen(INVALID_SERVER_HEADERS_RESPONSE),
get_write_delay(csp));
*/
if (client_use_ssl(csp))
{
- ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl),
+ ssl_send_data_delayed(&(csp->ssl_client_attr),
(const unsigned char *)INVALID_SERVER_HEADERS_RESPONSE,
strlen(INVALID_SERVER_HEADERS_RESPONSE),
get_write_delay(csp));
#ifdef FEATURE_HTTPS_INSPECTION
if (client_use_ssl(csp))
{
- if ((ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl),
+ if ((ssl_send_data_delayed(&(csp->ssl_client_attr),
(const unsigned char *)hdr, strlen(hdr),
get_write_delay(csp)) < 0)
- || (len = ssl_flush_socket(&(csp->mbedtls_client_attr.ssl),
+ || (len = ssl_flush_socket(&(csp->ssl_client_attr),
csp->iob) < 0))
{
log_error(LOG_LEVEL_CONNECT, "Write header to client failed");
*/
if (client_use_ssl(csp))
{
- ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl),
+ ssl_send_data_delayed(&(csp->ssl_client_attr),
(const unsigned char *)INVALID_SERVER_HEADERS_RESPONSE,
strlen(INVALID_SERVER_HEADERS_RESPONSE),
get_write_delay(csp));
{
return;
}
-#ifdef FEATURE_HTTPS_INSPECTION
- /*
- * Log the request unless we're https inspecting
- * in which case we don't have the path yet and
- * will log the request later.
- */
- if (!client_use_ssl(csp))
-#endif
- {
- log_error(LOG_LEVEL_REQUEST, "%s%s", http->hostport, http->path);
- }
/* decide how to route the HTTP request */
fwd = forward_url(csp, http);
}
#endif
+#ifdef FEATURE_HTTPS_INSPECTION
+ /*
+ * Log the request unless we're https inspecting
+ * in which case we don't have the path yet and
+ * will log the request later.
+ */
+ if (!client_use_ssl(csp))
+#endif
+ {
+ log_error(LOG_LEVEL_REQUEST, "%s%s", http->hostport, http->path);
+ }
+
if (http->ssl && connect_port_is_forbidden(csp))
{
const char *acceptable_connect_ports =
}
/*
- * Test if connection with destination server was established
- * successfully by parent proxy. Then we can send response to
- * the client and continue or stop.
+ * Test if the connection to the destination server was
+ * established successfully by the parent proxy.
*/
if (!tunnel_established_successfully(server_response, (unsigned int)len))
{
- log_error(LOG_LEVEL_ERROR, "Forwarder hasn't established "
- "connection with destination server.");
-
- write_socket(csp->cfd, server_response, (size_t)len);
+ log_error(LOG_LEVEL_ERROR,
+ "The forwarder %s failed to establish a connection with %s",
+ fwd->forward_host, http->host);
+ rsp = error_response(csp, "connect-failed");
+ if (rsp)
+ {
+ send_crunch_response(csp, rsp);
+ }
mark_server_socket_tainted(csp);
close_client_ssl_connection(csp);
return;
}
+ } /* -END- if (fwd->forward_host != NULL) */
- /*
- * Parent proxy has established connection with destination server.
- * Now we must create TLS/SSL connection with parent proxy.
- */
- ret = create_server_ssl_connection(csp);
-
- /*
- * If TLS/SSL connection wasn't created and invalid certificate
- * wasn't detected, we can interrupt this function. Otherwise, we
- * must inform the client about invalid server certificate.
- */
- if (ret != 0
- && (csp->server_cert_verification_result == SSL_CERT_NOT_VERIFIED
- || csp->server_cert_verification_result == SSL_CERT_VALID))
+ /*
+ * We can now create the TLS/SSL connection with the destination server.
+ */
+ int ret = create_server_ssl_connection(csp);
+ if (ret != 0)
+ {
+ if (csp->server_cert_verification_result != SSL_CERT_VALID &&
+ csp->server_cert_verification_result != SSL_CERT_NOT_VERIFIED)
+ {
+ /*
+ * If the server certificate is invalid, we must inform
+ * the client and then close connection to the client.
+ */
+ ssl_send_certificate_error(csp);
+ close_client_and_server_ssl_connections(csp);
+ return;
+ }
+ if (csp->server_cert_verification_result == SSL_CERT_NOT_VERIFIED
+ || csp->server_cert_verification_result == SSL_CERT_VALID)
{
+ /*
+ * The TLS/SSL connection wasn't created but an invalid
+ * certificate wasn't detected. Report it as connection
+ * failure.
+ */
rsp = error_response(csp, "connect-failed");
if (rsp)
{
send_crunch_response(csp, rsp);
}
+ close_client_and_server_ssl_connections(csp);
return;
}
- }/* -END- if (fwd->forward_host != NULL) */
- else
- {
- /*
- * Parent proxy is not used, we can just create TLS/SSL connection
- * with destination server
- */
- int ret = create_server_ssl_connection(csp);
- if (ret != 0)
- {
- if (csp->server_cert_verification_result != SSL_CERT_VALID &&
- csp->server_cert_verification_result != SSL_CERT_NOT_VERIFIED)
- {
- /*
- * If the server certificate is invalid, we must inform
- * the client and then close connection to the client.
- */
- ssl_send_certificate_error(csp);
- close_client_and_server_ssl_connections(csp);
- return;
- }
- if (csp->server_cert_verification_result == SSL_CERT_NOT_VERIFIED
- || csp->server_cert_verification_result == SSL_CERT_VALID)
- {
- /*
- * The TLS/SSL connection wasn't created but an invalid
- * certificate wasn't detected. Report it as connection
- * failure.
- */
- rsp = error_response(csp, "connect-failed");
- if (rsp)
- {
- send_crunch_response(csp, rsp);
- }
- close_client_and_server_ssl_connections(csp);
- return;
- }
- }
}
}/* -END- if (http->ssl) */
#endif /* def FEATURE_HTTPS_INSPECTION */
if (strcmp(fuzz_input_file, "-") == 0)
{
- /* XXX: Doesn'T work yet. */
+ /* XXX: Doesn't work yet. */
csp->server_connection.sfd = 0;
}
else
{
log_error(LOG_LEVEL_CONNECT,
"Closing server socket %d connected to %s. "
- "Keep-alive %u. Tainted: %u. Socket alive %u. Timeout: %u.",
+ "Keep-alive: %u. Tainted: %u. Socket alive: %u. Timeout: %u.",
csp->server_connection.sfd, csp->server_connection.host,
0 != (csp->flags & CSP_FLAG_SERVER_CONNECTION_KEEP_ALIVE),
0 != (csp->flags & CSP_FLAG_SERVER_SOCKET_TAINTED),
#ifdef FEATURE_HTTPS_INSPECTION
privoxy_mutex_init(&certificate_mutex);
- privoxy_mutex_init(&rng_mutex);
+ privoxy_mutex_init(&ssl_init_mutex);
#endif
privoxy_mutex_init(&log_mutex);
#ifdef FEATURE_CLIENT_TAGS
privoxy_mutex_init(&client_tags_mutex);
#endif
+#ifdef FEATURE_EXTENDED_STATISTICS
+ privoxy_mutex_init(&filter_statistics_mutex);
+ privoxy_mutex_init(&block_statistics_mutex);
+#endif
/*
* XXX: The assumptions below are a bit naive
#ifdef FEATURE_HTTPS_INSPECTION
/* Clean up. Aim: free all memory (no leaks) */
- if (rng_seeded == 1)
- {
- mbedtls_ctr_drbg_free(&ctr_drbg);
- mbedtls_entropy_free(&entropy);
- }
+ ssl_release();
#endif
#ifdef FEATURE_GRACEFUL_TERMINATION
- log_error(LOG_LEVEL_ERROR, "Graceful termination requested");
+ log_error(LOG_LEVEL_INFO, "Graceful termination requested");
unload_current_config_file();
unload_current_actions_file();
projects / privoxy.git / blobdiff