X-Git-Url: http://www.privoxy.org/gitweb/?p=privoxy.git;a=blobdiff_plain;f=jcc.c;h=1bca54f7bec720f752ac211dd14f151ba95aa5e5;hp=46ff1a28c1c859516fa90ffad6086e66eedd880c;hb=da6d6e7115b36cd4e03460c9c49a212edacb159a;hpb=9ca4d4015e89dcbe69c79bb60bc81ad9dc1b0b98 diff --git a/jcc.c b/jcc.c index 46ff1a28..1bca54f7 100644 --- a/jcc.c +++ b/jcc.c @@ -146,7 +146,7 @@ int g_terminate = 0; #if !defined(_WIN32) && !defined(__OS2__) static void sig_handler(int the_signal); #endif -static int client_protocol_is_unsupported(const struct client_state *csp, char *req); +static int client_protocol_is_unsupported(struct client_state *csp, char *req); static jb_err get_request_destination_elsewhere(struct client_state *csp, struct list *headers); static jb_err get_server_headers(struct client_state *csp); static const char *crunch_reason(const struct http_response *rsp); @@ -445,7 +445,7 @@ static unsigned int get_write_delay(const struct client_state *csp) * FALSE if the request doesn't look invalid. * *********************************************************************/ -static int client_protocol_is_unsupported(const struct client_state *csp, char *req) +static int client_protocol_is_unsupported(struct client_state *csp, char *req) { /* * If it's a FTP or gopher request, we don't support it. @@ -481,8 +481,19 @@ static int client_protocol_is_unsupported(const struct client_state *csp, char * log_error(LOG_LEVEL_CLF, "%s - - [%T] \"%s\" 400 0", csp->ip_addr_str, req); freez(req); - write_socket_delayed(csp->cfd, response, strlen(response), - get_write_delay(csp)); + +#ifdef FEATURE_HTTPS_INSPECTION + if (client_use_ssl(csp)) + { + ssl_send_data(&(csp->mbedtls_client_attr.ssl), + (const unsigned char *)response, strlen(response)); + } + else +#endif + { + write_socket_delayed(csp->cfd, response, strlen(response), + get_write_delay(csp)); + } return TRUE; } @@ -837,10 +848,22 @@ static void send_crunch_response(struct client_state *csp, struct http_response /* Log that the request was crunched and why. */ log_applied_actions(csp->action); - log_error(LOG_LEVEL_CRUNCH, "%s: %s", crunch_reason(rsp), http->url); - log_error(LOG_LEVEL_CLF, "%s - - [%T] \"%s\" %s %u", - csp->ip_addr_str, http->ocmd, status_code, rsp->content_length); - +#ifdef FEATURE_HTTPS_INSPECTION + if (client_use_ssl(csp)) + { + log_error(LOG_LEVEL_CRUNCH, "%s: https://%s%s", crunch_reason(rsp), + http->hostport, http->path); + log_error(LOG_LEVEL_CLF, "%s - - [%T] \"%s https://%s%s %s\" %s %llu", + csp->ip_addr_str, http->gpc, http->hostport, http->path, + http->version, status_code, rsp->content_length); + } + else +#endif + { + log_error(LOG_LEVEL_CRUNCH, "%s: %s", crunch_reason(rsp), http->url); + log_error(LOG_LEVEL_CLF, "%s - - [%T] \"%s\" %s %u", + csp->ip_addr_str, http->ocmd, status_code, rsp->content_length); + } /* Write the answer to the client */ #ifdef FEATURE_HTTPS_INSPECTION if (client_use_ssl(csp)) @@ -974,10 +997,10 @@ static void build_request_line(struct client_state *csp, const struct forward_sp * if +downgrade action applies. */ if ((csp->action->flags & ACTION_DOWNGRADE) - && (!strcmpic(http->ver, "HTTP/1.1"))) + && (!strcmpic(http->version, "HTTP/1.1"))) { - freez(http->ver); - http->ver = strdup_or_die("HTTP/1.0"); + freez(http->version); + http->version = strdup_or_die("HTTP/1.0"); } /* @@ -996,7 +1019,7 @@ static void build_request_line(struct client_state *csp, const struct forward_sp string_append(request_line, http->path); } string_append(request_line, " "); - string_append(request_line, http->ver); + string_append(request_line, http->version); if (*request_line == NULL) { @@ -1596,7 +1619,7 @@ extern int fuzz_client_request(struct client_state *csp, char *fuzz_input_file) if (strcmp(fuzz_input_file, "-") != 0) { log_error(LOG_LEVEL_FATAL, - "Fuzzed client requests can currenty only be read from stdin (-)."); + "Fuzzed client requests can currently only be read from stdin (-)."); } err = receive_client_request(csp); if (err != JB_ERR_OK) @@ -1887,7 +1910,7 @@ static jb_err parse_client_request(struct client_state *csp) #ifdef FEATURE_CONNECTION_KEEP_ALIVE if ((csp->config->feature_flags & RUNTIME_FEATURE_CONNECTION_KEEP_ALIVE) - && (!strcmpic(csp->http->ver, "HTTP/1.1")) + && (!strcmpic(csp->http->version, "HTTP/1.1")) && (csp->http->ssl == 0)) { /* Assume persistence until further notice */ @@ -2026,11 +2049,12 @@ static int send_http_request(struct client_state *csp) * Returns : 0 on success, anything else is an error. * *********************************************************************/ -static jb_err receive_and_send_encrypted_post_data(struct client_state *csp) +static int receive_and_send_encrypted_post_data(struct client_state *csp) { int content_length_known = csp->expected_client_content_length != 0; - while (is_ssl_pending(&(csp->mbedtls_client_attr.ssl))) + while (is_ssl_pending(&(csp->mbedtls_client_attr.ssl)) + || (content_length_known && csp->expected_client_content_length != 0)) { unsigned char buf[BUFFER_SIZE]; int len; @@ -2054,7 +2078,7 @@ static jb_err receive_and_send_encrypted_post_data(struct client_state *csp) /* XXX: Does this actually happen? */ break; } - log_error(LOG_LEVEL_HEADER, "Forwarding %d bytes of encrypted POST data", + log_error(LOG_LEVEL_CONNECT, "Forwarding %d bytes of encrypted POST data", len); len = ssl_send_data(&(csp->mbedtls_server_attr.ssl), buf, (size_t)len); if (len == -1) @@ -2264,8 +2288,11 @@ static jb_err process_encrypted_request(struct client_state *csp) if (client_protocol_is_unsupported(csp, request_line)) { - ssl_send_data(&(csp->mbedtls_client_attr.ssl), - (const unsigned char *)CHEADER, strlen(CHEADER)); + /* + * If the protocol is unsupported we're done here. + * client_protocol_is_unsupported() took care of sending + * the error response and logging the error message. + */ return JB_ERR_PARSE; } @@ -2370,6 +2397,8 @@ static jb_err process_encrypted_request(struct client_state *csp) log_error(LOG_LEVEL_HEADER, "Encrypted request processed"); log_applied_actions(csp->action); + log_error(LOG_LEVEL_GPC, "https://%s%s", csp->http->hostport, + csp->http->path); return err; @@ -2652,35 +2681,10 @@ static void handle_established_connection(struct client_state *csp) #endif /* def FEATURE_CONNECTION_KEEP_ALIVE */ #ifdef FEATURE_HTTPS_INSPECTION - /* - * Reading data from standard or secured connection (HTTP/HTTPS) - */ if (client_use_ssl(csp)) { - /* - * Receiving HTTP request from client over TLS/SSL and sending - * it to server over TLS/SSL. - */ - len = ssl_recv_data(&(csp->mbedtls_client_attr.ssl), - (unsigned char *)csp->receive_buffer, (size_t)max_bytes_to_read); - - if (len <= 0) - { - mark_server_socket_tainted(csp); - break; - } - - ret = ssl_send_data(&(csp->mbedtls_server_attr.ssl), - (const unsigned char *)csp->receive_buffer, (size_t)len); - - if (ret < 0) - { - log_error(LOG_LEVEL_ERROR, - "Send request over TLS/SSL to: %s failed", http->host); - mark_server_socket_tainted(csp); - close_client_and_server_ssl_connections(csp); - return; - } + log_error(LOG_LEVEL_CONNECT, "Breaking with TLS/SSL."); + break; } else #endif /* def FEATURE_HTTPS_INSPECTION */ @@ -3451,9 +3455,19 @@ static void handle_established_connection(struct client_state *csp) } #endif - log_error(LOG_LEVEL_CLF, "%s - - [%T] \"%s\" 200 %llu", - csp->ip_addr_str, http->ocmd, csp->content_length); - +#ifdef FEATURE_HTTPS_INSPECTION + if (client_use_ssl(csp)) + { + log_error(LOG_LEVEL_CLF, "%s - - [%T] \"%s https://%s%s %s\" 200 %llu", + csp->ip_addr_str, http->gpc, http->hostport, http->path, + http->version, csp->content_length); + } + else +#endif + { + log_error(LOG_LEVEL_CLF, "%s - - [%T] \"%s\" 200 %llu", + csp->ip_addr_str, http->ocmd, csp->content_length); + } csp->server_connection.timestamp = time(NULL); } @@ -3624,8 +3638,17 @@ static void chat(struct client_state *csp) } log_applied_actions(csp->action); - log_error(LOG_LEVEL_GPC, "%s%s", http->hostport, http->path); - +#ifdef FEATURE_HTTPS_INSPECTION + /* + * Log the request unless we're https inspecting + * in which case we don't have the path yet and + * will log the request later. + */ + if (!client_use_ssl(csp)) +#endif + { + log_error(LOG_LEVEL_GPC, "%s%s", http->hostport, http->path); + } if (fwd->forward_host) { log_error(LOG_LEVEL_CONNECT, "via [%s]:%d to: %s", @@ -3675,7 +3698,7 @@ static void chat(struct client_state *csp) int ret; /* * Creating an SSL proxy. If forwarding is disabled, we must send - * CSUCCEED mesage to client. Then TLS/SSL connection with client + * CSUCCEED message to client. Then TLS/SSL connection with client * is created. */ @@ -3762,6 +3785,9 @@ static void chat(struct client_state *csp) * client body in the buffer (if there is one) and to * continue parsing the bytes that follow. */ +#ifdef FEATURE_HTTPS_INSPECTION + close_client_ssl_connection(csp); +#endif drain_and_close_socket(csp->cfd); csp->cfd = JB_INVALID_SOCKET;