X-Git-Url: http://www.privoxy.org/gitweb/?p=privoxy.git;a=blobdiff_plain;f=jcc.c;h=2389a8dbb44ff95afb0530489ff847f0a73b6bb3;hp=28e797b84e1d0f73712399a3fe17a9152cb55922;hb=525e474e017c91ab9619d503ff537ca44825f428;hpb=11d053d32f4666e1ee0acdaa65b88ff57e553da6 diff --git a/jcc.c b/jcc.c index 28e797b8..2389a8db 100644 --- a/jcc.c +++ b/jcc.c @@ -146,7 +146,7 @@ int g_terminate = 0; #if !defined(_WIN32) && !defined(__OS2__) static void sig_handler(int the_signal); #endif -static int client_protocol_is_unsupported(const struct client_state *csp, char *req); +static int client_protocol_is_unsupported(struct client_state *csp, char *req); static jb_err get_request_destination_elsewhere(struct client_state *csp, struct list *headers); static jb_err get_server_headers(struct client_state *csp); static const char *crunch_reason(const struct http_response *rsp); @@ -445,7 +445,7 @@ static unsigned int get_write_delay(const struct client_state *csp) * FALSE if the request doesn't look invalid. * *********************************************************************/ -static int client_protocol_is_unsupported(const struct client_state *csp, char *req) +static int client_protocol_is_unsupported(struct client_state *csp, char *req) { /* * If it's a FTP or gopher request, we don't support it. @@ -481,8 +481,20 @@ static int client_protocol_is_unsupported(const struct client_state *csp, char * log_error(LOG_LEVEL_CLF, "%s - - [%T] \"%s\" 400 0", csp->ip_addr_str, req); freez(req); - write_socket_delayed(csp->cfd, response, strlen(response), - get_write_delay(csp)); + +#ifdef FEATURE_HTTPS_INSPECTION + if (client_use_ssl(csp)) + { + ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl), + (const unsigned char *)response, strlen(response), + get_write_delay(csp)); + } + else +#endif + { + write_socket_delayed(csp->cfd, response, strlen(response), + get_write_delay(csp)); + } return TRUE; } @@ -837,18 +849,32 @@ static void send_crunch_response(struct client_state *csp, struct http_response /* Log that the request was crunched and why. */ log_applied_actions(csp->action); - log_error(LOG_LEVEL_CRUNCH, "%s: %s", crunch_reason(rsp), http->url); - log_error(LOG_LEVEL_CLF, "%s - - [%T] \"%s\" %s %u", - csp->ip_addr_str, http->ocmd, status_code, rsp->content_length); - +#ifdef FEATURE_HTTPS_INSPECTION + if (client_use_ssl(csp)) + { + log_error(LOG_LEVEL_CRUNCH, "%s: https://%s%s", crunch_reason(rsp), + http->hostport, http->path); + log_error(LOG_LEVEL_CLF, "%s - - [%T] \"%s https://%s%s %s\" %s %llu", + csp->ip_addr_str, http->gpc, http->hostport, http->path, + http->version, status_code, rsp->content_length); + } + else +#endif + { + log_error(LOG_LEVEL_CRUNCH, "%s: %s", crunch_reason(rsp), http->url); + log_error(LOG_LEVEL_CLF, "%s - - [%T] \"%s\" %s %u", + csp->ip_addr_str, http->ocmd, status_code, rsp->content_length); + } /* Write the answer to the client */ #ifdef FEATURE_HTTPS_INSPECTION if (client_use_ssl(csp)) { - if ((ssl_send_data(&(csp->mbedtls_client_attr.ssl), - (const unsigned char *)rsp->head, rsp->head_length) < 0) - || (ssl_send_data(&(csp->mbedtls_client_attr.ssl), - (const unsigned char *)rsp->body, rsp->content_length) < 0)) + if ((ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl), + (const unsigned char *)rsp->head, rsp->head_length, + get_write_delay(csp)) < 0) + || (ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl), + (const unsigned char *)rsp->body, rsp->content_length, + get_write_delay(csp)) < 0)) { /* There is nothing we can do about it. */ log_error(LOG_LEVEL_CONNECT, "Couldn't deliver the error message " @@ -974,10 +1000,10 @@ static void build_request_line(struct client_state *csp, const struct forward_sp * if +downgrade action applies. */ if ((csp->action->flags & ACTION_DOWNGRADE) - && (!strcmpic(http->ver, "HTTP/1.1"))) + && (!strcmpic(http->version, "HTTP/1.1"))) { - freez(http->ver); - http->ver = strdup_or_die("HTTP/1.0"); + freez(http->version); + http->version = strdup_or_die("HTTP/1.0"); } /* @@ -996,7 +1022,7 @@ static void build_request_line(struct client_state *csp, const struct forward_sp string_append(request_line, http->path); } string_append(request_line, " "); - string_append(request_line, http->ver); + string_append(request_line, http->version); if (*request_line == NULL) { @@ -1596,7 +1622,7 @@ extern int fuzz_client_request(struct client_state *csp, char *fuzz_input_file) if (strcmp(fuzz_input_file, "-") != 0) { log_error(LOG_LEVEL_FATAL, - "Fuzzed client requests can currenty only be read from stdin (-)."); + "Fuzzed client requests can currently only be read from stdin (-)."); } err = receive_client_request(csp); if (err != JB_ERR_OK) @@ -1887,7 +1913,7 @@ static jb_err parse_client_request(struct client_state *csp) #ifdef FEATURE_CONNECTION_KEEP_ALIVE if ((csp->config->feature_flags & RUNTIME_FEATURE_CONNECTION_KEEP_ALIVE) - && (!strcmpic(csp->http->ver, "HTTP/1.1")) + && (!strcmpic(csp->http->version, "HTTP/1.1")) && (csp->http->ssl == 0)) { /* Assume persistence until further notice */ @@ -2026,11 +2052,12 @@ static int send_http_request(struct client_state *csp) * Returns : 0 on success, anything else is an error. * *********************************************************************/ -static jb_err receive_and_send_encrypted_post_data(struct client_state *csp) +static int receive_and_send_encrypted_post_data(struct client_state *csp) { int content_length_known = csp->expected_client_content_length != 0; - while (is_ssl_pending(&(csp->mbedtls_client_attr.ssl))) + while (is_ssl_pending(&(csp->mbedtls_client_attr.ssl)) + || (content_length_known && csp->expected_client_content_length != 0)) { unsigned char buf[BUFFER_SIZE]; int len; @@ -2054,7 +2081,7 @@ static jb_err receive_and_send_encrypted_post_data(struct client_state *csp) /* XXX: Does this actually happen? */ break; } - log_error(LOG_LEVEL_HEADER, "Forwarding %d bytes of encrypted POST data", + log_error(LOG_LEVEL_CONNECT, "Forwarding %d bytes of encrypted POST data", len); len = ssl_send_data(&(csp->mbedtls_server_attr.ssl), buf, (size_t)len); if (len == -1) @@ -2069,13 +2096,13 @@ static jb_err receive_and_send_encrypted_post_data(struct client_state *csp) } if (csp->expected_client_content_length == 0) { - log_error(LOG_LEVEL_HEADER, "Forwarded the last %d bytes", len); + log_error(LOG_LEVEL_CONNECT, "Forwarded the last %d bytes", len); break; } } } - log_error(LOG_LEVEL_HEADER, "Done forwarding encrypted POST data"); + log_error(LOG_LEVEL_CONNECT, "Done forwarding encrypted POST data"); return 0; @@ -2123,7 +2150,6 @@ static int send_https_request(struct client_state *csp) "Failed sending encrypted request headers to: %s: %E", csp->http->hostport); mark_server_socket_tainted(csp); - close_client_and_server_ssl_connections(csp); return 1; } @@ -2245,8 +2271,10 @@ static jb_err process_encrypted_request(struct client_state *csp) if (err != JB_ERR_OK) { /* XXX: Also used for JB_ERR_MEMORY */ - ssl_send_data(&(csp->mbedtls_client_attr.ssl), - (const unsigned char *)CHEADER, strlen(CHEADER)); + log_error(LOG_LEVEL_ERROR, "Failed to receive encrypted request: %s", + jb_err_to_string(err)); + ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl), + (const unsigned char *)CHEADER, strlen(CHEADER), get_write_delay(csp)); return err; } @@ -2254,16 +2282,20 @@ static jb_err process_encrypted_request(struct client_state *csp) request_line = get_header(csp->client_iob); if (request_line == NULL) { - ssl_send_data(&(csp->mbedtls_client_attr.ssl), - (const unsigned char *)CHEADER, strlen(CHEADER)); + log_error(LOG_LEVEL_ERROR, "Failed to get the encrypted request line"); + ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl), + (const unsigned char *)CHEADER, strlen(CHEADER), get_write_delay(csp)); return JB_ERR_PARSE; } assert(*request_line != '\0'); if (client_protocol_is_unsupported(csp, request_line)) { - ssl_send_data(&(csp->mbedtls_client_attr.ssl), - (const unsigned char *)CHEADER, strlen(CHEADER)); + /* + * If the protocol is unsupported we're done here. + * client_protocol_is_unsupported() took care of sending + * the error response and logging the error message. + */ return JB_ERR_PARSE; } @@ -2284,8 +2316,8 @@ static jb_err process_encrypted_request(struct client_state *csp) freez(request_line); if (JB_ERR_OK != err) { - ssl_send_data(&(csp->mbedtls_client_attr.ssl), - (const unsigned char *)CHEADER, strlen(CHEADER)); + ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl), + (const unsigned char *)CHEADER, strlen(CHEADER), get_write_delay(csp)); /* XXX: Use correct size */ log_error(LOG_LEVEL_CLF, "%s - - [%T] \"Invalid request\" 400 0", csp->ip_addr_str); log_error(LOG_LEVEL_ERROR, @@ -2317,8 +2349,10 @@ static jb_err process_encrypted_request(struct client_state *csp) * Our attempts to get the request destination * elsewhere failed. */ - ssl_send_data(&(csp->mbedtls_client_attr.ssl), - (const unsigned char *)CHEADER, strlen(CHEADER)); + log_error(LOG_LEVEL_ERROR, + "Failed to get the encrypted request destination"); + ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl), + (const unsigned char *)CHEADER, strlen(CHEADER), get_write_delay(csp)); return JB_ERR_PARSE; } @@ -2355,8 +2389,8 @@ static jb_err process_encrypted_request(struct client_state *csp) err = sed_https(csp); if (JB_ERR_OK != err) { - ssl_send_data(&(csp->mbedtls_client_attr.ssl), - (const unsigned char *)CHEADER, strlen(CHEADER)); + ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl), + (const unsigned char *)CHEADER, strlen(CHEADER), get_write_delay(csp)); log_error(LOG_LEVEL_ERROR, "Failed to parse client request from %s.", csp->ip_addr_str); log_error(LOG_LEVEL_CLF, "%s - - [%T] \"%s\" 400 0", @@ -2366,10 +2400,39 @@ static jb_err process_encrypted_request(struct client_state *csp) log_error(LOG_LEVEL_HEADER, "Encrypted request processed"); log_applied_actions(csp->action); + log_error(LOG_LEVEL_REQUEST, "https://%s%s", csp->http->hostport, + csp->http->path); return err; } + +/********************************************************************* + * + * Function : cgi_page_requested + * + * Description : Checks if a request is for an internal CGI page. + * + * Parameters : + * 1 : host = The host requested by the client. + * + * Returns : 1 if a CGI page has been requested, 0 otherwise + * + *********************************************************************/ +static int cgi_page_requested(const char *host) +{ + if ((0 == strcmpic(host, CGI_SITE_1_HOST)) + || (0 == strcmpic(host, CGI_SITE_1_HOST ".")) + || (0 == strcmpic(host, CGI_SITE_2_HOST)) + || (0 == strcmpic(host, CGI_SITE_2_HOST "."))) + { + return 1; + } + + return 0; + +} + #endif @@ -2410,13 +2473,6 @@ static void handle_established_connection(struct client_state *csp) int use_ssl_tunnel = 0; csp->dont_verify_certificate = 0; - /* - * Preset flags informing if SSL connections with server or client - * are opened or closed - */ - csp->ssl_with_server_is_opened = 0; - csp->ssl_with_client_is_opened = 0; - if (csp->http->ssl && !(csp->action->flags & ACTION_HTTPS_INSPECTION)) { /* Pass encrypted content without filtering. */ @@ -2528,112 +2584,62 @@ static void handle_established_connection(struct client_state *csp) } #endif /* FEATURE_CONNECTION_KEEP_ALIVE */ -#ifdef FEATURE_HTTPS_INSPECTION - /* - * Test if some data from client or destination server are pending - * on TLS/SSL. We must work with them preferably. TLS/SSL data can - * be pending because of maximal fragment size. - */ - int read_ssl_server = 0; - int read_ssl_client = 0; - - if (client_use_ssl(csp)) - { - read_ssl_client = is_ssl_pending(&(csp->mbedtls_client_attr.ssl)) != 0; - } - - if (server_use_ssl(csp)) +#ifdef HAVE_POLL + poll_fds[0].fd = csp->cfd; +#ifdef FEATURE_CONNECTION_KEEP_ALIVE + if (!watch_client_socket) { - read_ssl_server = is_ssl_pending(&(csp->mbedtls_server_attr.ssl)) != 0; + /* + * Ignore incoming data, but still watch out + * for disconnects etc. These flags are always + * implied anyway but explicitly setting them + * doesn't hurt. + */ + poll_fds[0].events = POLLERR|POLLHUP; } - - if (!read_ssl_server && !read_ssl_client) + else #endif { -#ifdef HAVE_POLL - poll_fds[0].fd = csp->cfd; -#ifdef FEATURE_CONNECTION_KEEP_ALIVE - if (!watch_client_socket) - { - /* - * Ignore incoming data, but still watch out - * for disconnects etc. These flags are always - * implied anyway but explicitly setting them - * doesn't hurt. - */ - poll_fds[0].events = POLLERR|POLLHUP; - } - else -#endif - { - poll_fds[0].events = POLLIN; - } - poll_fds[1].fd = csp->server_connection.sfd; - poll_fds[1].events = POLLIN; - n = poll(poll_fds, 2, csp->config->socket_timeout * 1000); + poll_fds[0].events = POLLIN; + } + poll_fds[1].fd = csp->server_connection.sfd; + poll_fds[1].events = POLLIN; + n = poll(poll_fds, 2, csp->config->socket_timeout * 1000); #else - timeout.tv_sec = csp->config->socket_timeout; - timeout.tv_usec = 0; - n = select((int)maxfd + 1, &rfds, NULL, NULL, &timeout); + timeout.tv_sec = csp->config->socket_timeout; + timeout.tv_usec = 0; + n = select((int)maxfd + 1, &rfds, NULL, NULL, &timeout); #endif /* def HAVE_POLL */ - /*server or client not responding in timeout */ - if (n == 0) + /*server or client not responding in timeout */ + if (n == 0) + { + log_error(LOG_LEVEL_CONNECT, "Socket timeout %d reached: %s", + csp->config->socket_timeout, http->url); + if ((byte_count == 0) && (http->ssl == 0)) { - log_error(LOG_LEVEL_CONNECT, "Socket timeout %d reached: %s", - csp->config->socket_timeout, http->url); - if ((byte_count == 0) && (http->ssl == 0)) - { - send_crunch_response(csp, error_response(csp, "connection-timeout")); - } - mark_server_socket_tainted(csp); -#ifdef FEATURE_HTTPS_INSPECTION - close_client_and_server_ssl_connections(csp); -#endif - return; + send_crunch_response(csp, error_response(csp, "connection-timeout")); } - else if (n < 0) - { -#ifdef HAVE_POLL - log_error(LOG_LEVEL_ERROR, "poll() failed!: %E"); -#else - log_error(LOG_LEVEL_ERROR, "select() failed!: %E"); -#endif - mark_server_socket_tainted(csp); + mark_server_socket_tainted(csp); #ifdef FEATURE_HTTPS_INSPECTION - close_client_and_server_ssl_connections(csp); + close_client_and_server_ssl_connections(csp); #endif - return; - } + return; } -#ifdef FEATURE_HTTPS_INSPECTION - else + else if (n < 0) { - /* set FD if some data are pending on TLS/SSL connections */ -#ifndef HAVE_POLL - FD_ZERO(&rfds); -#endif - if (read_ssl_client) - { #ifdef HAVE_POLL - poll_fds[0].fd = csp->cfd; - poll_fds[0].events = POLLIN; + log_error(LOG_LEVEL_ERROR, "poll() failed!: %E"); #else - FD_SET(csp->cfd, &rfds); + log_error(LOG_LEVEL_ERROR, "select() failed!: %E"); #endif - } - - if (read_ssl_server) - { -#ifdef HAVE_POLL - poll_fds[1].fd = csp->server_connection.sfd; - poll_fds[1].events = POLLIN; -#else - FD_SET(csp->server_connection.sfd, &rfds); + mark_server_socket_tainted(csp); +#ifdef FEATURE_HTTPS_INSPECTION + close_client_and_server_ssl_connections(csp); #endif - } + return; } -#endif + /* * This is the body of the browser's request, * just read and write it. @@ -2705,35 +2711,10 @@ static void handle_established_connection(struct client_state *csp) #endif /* def FEATURE_CONNECTION_KEEP_ALIVE */ #ifdef FEATURE_HTTPS_INSPECTION - /* - * Reading data from standard or secured connection (HTTP/HTTPS) - */ if (client_use_ssl(csp)) { - /* - * Receiving HTTP request from client over TLS/SSL and sending - * it to server over TLS/SSL. - */ - len = ssl_recv_data(&(csp->mbedtls_client_attr.ssl), - (unsigned char *)csp->receive_buffer, (size_t)max_bytes_to_read); - - if (len <= 0) - { - mark_server_socket_tainted(csp); - break; - } - - ret = ssl_send_data(&(csp->mbedtls_server_attr.ssl), - (const unsigned char *)csp->receive_buffer, (size_t)len); - - if (ret < 0) - { - log_error(LOG_LEVEL_ERROR, - "Send request over TLS/SSL to: %s failed", http->host); - mark_server_socket_tainted(csp); - close_client_and_server_ssl_connections(csp); - return; - } + log_error(LOG_LEVEL_CONNECT, "Breaking with TLS/SSL."); + break; } else #endif /* def FEATURE_HTTPS_INSPECTION */ @@ -2769,9 +2750,6 @@ static void handle_established_connection(struct client_state *csp) { log_error(LOG_LEVEL_ERROR, "write to: %s failed: %E", http->host); mark_server_socket_tainted(csp); -#ifdef FEATURE_HTTPS_INSPECTION - close_client_and_server_ssl_connections(csp); -#endif return; } } @@ -2986,11 +2964,12 @@ static void handle_established_connection(struct client_state *csp) */ if (client_use_ssl(csp)) { - if ((ssl_send_data(&(csp->mbedtls_client_attr.ssl), - (const unsigned char *)hdr, strlen(hdr)) < 0) - || (ssl_send_data(&(csp->mbedtls_client_attr.ssl), + if ((ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl), + (const unsigned char *)hdr, strlen(hdr), + get_write_delay(csp)) < 0) + || (ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl), (const unsigned char *) ((p != NULL) ? p : csp->iob->cur), - csp->content_length) < 0)) + csp->content_length, get_write_delay(csp)) < 0)) { log_error(LOG_LEVEL_ERROR, "write modified content to " "client over TLS/SSL failed"); @@ -3012,9 +2991,6 @@ static void handle_established_connection(struct client_state *csp) freez(hdr); freez(p); mark_server_socket_tainted(csp); -#ifdef FEATURE_HTTPS_INSPECTION - close_client_and_server_ssl_connections(csp); -#endif return; } } @@ -3091,12 +3067,13 @@ static void handle_established_connection(struct client_state *csp) */ if (client_use_ssl(csp)) { - if ((ssl_send_data(&(csp->mbedtls_client_attr.ssl), - (const unsigned char *)hdr, hdrlen) < 0) + if ((ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl), + (const unsigned char *)hdr, hdrlen, get_write_delay(csp)) < 0) || ((flushed = ssl_flush_socket(&(csp->mbedtls_client_attr.ssl), csp->iob)) < 0) - || (ssl_send_data(&(csp->mbedtls_client_attr.ssl), - (const unsigned char *)csp->receive_buffer, (size_t)len) < 0)) + || (ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl), + (const unsigned char *)csp->receive_buffer, (size_t)len, + get_write_delay(csp)) < 0)) { log_error(LOG_LEVEL_CONNECT, "Flush header and buffers to client failed"); @@ -3118,9 +3095,6 @@ static void handle_established_connection(struct client_state *csp) "Flush header and buffers to client failed: %E"); freez(hdr); mark_server_socket_tainted(csp); -#ifdef FEATURE_HTTPS_INSPECTION - close_client_and_server_ssl_connections(csp); -#endif return; } } @@ -3144,8 +3118,9 @@ static void handle_established_connection(struct client_state *csp) */ if (client_use_ssl(csp)) { - ret = ssl_send_data(&(csp->mbedtls_client_attr.ssl), - (const unsigned char *)csp->receive_buffer, (size_t)len); + ret = ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl), + (const unsigned char *)csp->receive_buffer, (size_t)len, + get_write_delay(csp)); if (ret < 0) { log_error(LOG_LEVEL_ERROR, @@ -3163,9 +3138,6 @@ static void handle_established_connection(struct client_state *csp) { log_error(LOG_LEVEL_ERROR, "write to client failed: %E"); mark_server_socket_tainted(csp); -#ifdef FEATURE_HTTPS_INSPECTION - close_client_and_server_ssl_connections(csp); -#endif return; } } @@ -3212,9 +3184,9 @@ static void handle_established_connection(struct client_state *csp) */ if (client_use_ssl(csp)) { - ssl_send_data(&(csp->mbedtls_client_attr.ssl), + ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl), (const unsigned char *)INVALID_SERVER_HEADERS_RESPONSE, - strlen(INVALID_SERVER_HEADERS_RESPONSE)); + strlen(INVALID_SERVER_HEADERS_RESPONSE), get_write_delay(csp)); } else #endif /* def FEATURE_HTTPS_INSPECTION */ @@ -3306,9 +3278,10 @@ static void handle_established_connection(struct client_state *csp) */ if (client_use_ssl(csp)) { - ssl_send_data(&(csp->mbedtls_client_attr.ssl), + ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl), (const unsigned char *)INVALID_SERVER_HEADERS_RESPONSE, - strlen(INVALID_SERVER_HEADERS_RESPONSE)); + strlen(INVALID_SERVER_HEADERS_RESPONSE), + get_write_delay(csp)); } else #endif /* def FEATURE_HTTPS_INSPECTION */ @@ -3338,9 +3311,10 @@ static void handle_established_connection(struct client_state *csp) */ if (client_use_ssl(csp)) { - ssl_send_data(&(csp->mbedtls_client_attr.ssl), + ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl), (const unsigned char *)INVALID_SERVER_HEADERS_RESPONSE, - strlen(INVALID_SERVER_HEADERS_RESPONSE)); + strlen(INVALID_SERVER_HEADERS_RESPONSE), + get_write_delay(csp)); } else #endif @@ -3407,8 +3381,9 @@ static void handle_established_connection(struct client_state *csp) #ifdef FEATURE_HTTPS_INSPECTION if (client_use_ssl(csp)) { - if ((ssl_send_data(&(csp->mbedtls_client_attr.ssl), - (const unsigned char *)hdr, strlen(hdr)) < 0) + if ((ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl), + (const unsigned char *)hdr, strlen(hdr), + get_write_delay(csp)) < 0) || (len = ssl_flush_socket(&(csp->mbedtls_client_attr.ssl), csp->iob) < 0)) { @@ -3440,9 +3415,6 @@ static void handle_established_connection(struct client_state *csp) */ freez(hdr); mark_server_socket_tainted(csp); -#ifdef FEATURE_HTTPS_INSPECTION - close_client_and_server_ssl_connections(csp); -#endif return; } } @@ -3471,9 +3443,10 @@ static void handle_established_connection(struct client_state *csp) */ if (client_use_ssl(csp)) { - ssl_send_data(&(csp->mbedtls_client_attr.ssl), + ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl), (const unsigned char *)INVALID_SERVER_HEADERS_RESPONSE, - strlen(INVALID_SERVER_HEADERS_RESPONSE)); + strlen(INVALID_SERVER_HEADERS_RESPONSE), + get_write_delay(csp)); } else #endif /* def FEATURE_HTTPS_INSPECTION */ @@ -3519,9 +3492,19 @@ static void handle_established_connection(struct client_state *csp) } #endif - log_error(LOG_LEVEL_CLF, "%s - - [%T] \"%s\" 200 %llu", - csp->ip_addr_str, http->ocmd, csp->content_length); - +#ifdef FEATURE_HTTPS_INSPECTION + if (client_use_ssl(csp)) + { + log_error(LOG_LEVEL_CLF, "%s - - [%T] \"%s https://%s%s %s\" 200 %llu", + csp->ip_addr_str, http->gpc, http->hostport, http->path, + http->version, csp->content_length); + } + else +#endif + { + log_error(LOG_LEVEL_CLF, "%s - - [%T] \"%s\" 200 %llu", + csp->ip_addr_str, http->ocmd, csp->content_length); + } csp->server_connection.timestamp = time(NULL); } @@ -3570,6 +3553,17 @@ static void chat(struct client_state *csp) { return; } +#ifdef FEATURE_HTTPS_INSPECTION + /* + * Log the request unless we're https inspecting + * in which case we don't have the path yet and + * will log the request later. + */ + if (!client_use_ssl(csp)) +#endif + { + log_error(LOG_LEVEL_REQUEST, "%s%s", http->hostport, http->path); + } /* decide how to route the HTTP request */ fwd = forward_url(csp, http); @@ -3583,9 +3577,10 @@ static void chat(struct client_state *csp) #ifdef FEATURE_HTTPS_INSPECTION /* * Setting flags to use old solution with SSL tunnel and to disable - * certificates verification. + * certificate verification. */ - if (csp->http->ssl && !(csp->action->flags & ACTION_HTTPS_INSPECTION)) + if (csp->http->ssl && !(csp->action->flags & ACTION_HTTPS_INSPECTION) + && !cgi_page_requested(csp->http->host)) { use_ssl_tunnel = 1; } @@ -3692,8 +3687,6 @@ static void chat(struct client_state *csp) } log_applied_actions(csp->action); - log_error(LOG_LEVEL_GPC, "%s%s", http->hostport, http->path); - if (fwd->forward_host) { log_error(LOG_LEVEL_CONNECT, "via [%s]:%d to: %s", @@ -3742,32 +3735,25 @@ static void chat(struct client_state *csp) { int ret; /* - * Creating an SSL proxy. If forwarding is disabled, we must send - * CSUCCEED mesage to client. Then TLS/SSL connection with client - * is created. + * Creating a SSL proxy. + * + * By sending the CSUCCEED message we're lying to the client as + * the connection hasn't actually been established yet. We don't + * establish the connection until we have seen and parsed the + * encrypted client headers. */ - - if (fwd->forward_host == NULL) + if (write_socket_delayed(csp->cfd, CSUCCEED, + strlen(CSUCCEED), get_write_delay(csp)) != 0) { - /* - * We're lying to the client as the connection hasn't actually - * been established yet. We don't establish the connection until - * we have seen and parsed the encrypted client headers. - */ - if (write_socket_delayed(csp->cfd, CSUCCEED, - strlen(CSUCCEED), get_write_delay(csp)) != 0) - { - log_error(LOG_LEVEL_ERROR, "Sending SUCCEED to client failed"); - return; - } + log_error(LOG_LEVEL_ERROR, "Sending SUCCEED to client failed"); + return; } ret = create_client_ssl_connection(csp); if (ret != 0) { log_error(LOG_LEVEL_ERROR, - "Can't open secure connection with client"); - close_client_ssl_connection(csp); /* XXX: Is this needed? */ + "Failed to open a secure connection with the client"); return; } if (JB_ERR_OK != process_encrypted_request(csp)) @@ -3830,6 +3816,9 @@ static void chat(struct client_state *csp) * client body in the buffer (if there is one) and to * continue parsing the bytes that follow. */ +#ifdef FEATURE_HTTPS_INSPECTION + close_client_ssl_connection(csp); +#endif drain_and_close_socket(csp->cfd); csp->cfd = JB_INVALID_SOCKET; @@ -3895,9 +3884,8 @@ static void chat(struct client_state *csp) } /* - * Test if connection with destination server was established - * successfully by parent proxy. Then we can send response to - * the client and continue or stop. + * Test if the connection to the destination server was + * established successfully by the parent proxy. */ if (!tunnel_established_successfully(server_response, (unsigned int)len)) { @@ -3909,80 +3897,41 @@ static void chat(struct client_state *csp) close_client_ssl_connection(csp); return; } + } /* -END- if (fwd->forward_host != NULL) */ - /* - * Parent proxy has established connection with destination server. - * Now we must create TLS/SSL connection with parent proxy. - */ - ret = create_server_ssl_connection(csp); - - /* - * If TLS/SSL connection wasn't created and invalid certificate - * wasn't detected, we can interrupt this function. Otherwise, we - * must inform the client about invalid server certificate. - */ - if (ret != 0 - && (csp->server_cert_verification_result == SSL_CERT_NOT_VERIFIED - || csp->server_cert_verification_result == SSL_CERT_VALID)) + /* + * We can now create the TLS/SSL connection with the destination server. + */ + int ret = create_server_ssl_connection(csp); + if (ret != 0) + { + if (csp->server_cert_verification_result != SSL_CERT_VALID && + csp->server_cert_verification_result != SSL_CERT_NOT_VERIFIED) { + /* + * If the server certificate is invalid, we must inform + * the client and then close connection to the client. + */ + ssl_send_certificate_error(csp); + close_client_and_server_ssl_connections(csp); + return; + } + if (csp->server_cert_verification_result == SSL_CERT_NOT_VERIFIED + || csp->server_cert_verification_result == SSL_CERT_VALID) + { + /* + * The TLS/SSL connection wasn't created but an invalid + * certificate wasn't detected. Report it as connection + * failure. + */ rsp = error_response(csp, "connect-failed"); if (rsp) { send_crunch_response(csp, rsp); } + close_client_and_server_ssl_connections(csp); return; } - - /* - * TLS/SSL connection with parent proxy is established, we can - * inform client about success. - */ - ret = write_socket(csp->cfd, server_response, (size_t)len); - if (ret != 0) - { - log_error(LOG_LEVEL_ERROR, - "Sending parent proxy response to client failed"); - mark_server_socket_tainted(csp); - close_client_ssl_connection(csp); - return; - } - }/* -END- if (fwd->forward_host != NULL) */ - else - { - /* - * Parent proxy is not used, we can just create TLS/SSL connection - * with destination server - */ - int ret = create_server_ssl_connection(csp); - if (ret != 0) - { - if (csp->server_cert_verification_result != SSL_CERT_VALID && - csp->server_cert_verification_result != SSL_CERT_NOT_VERIFIED) - { - /* - * If the server certificate is invalid, we must inform - * the client and then close connection to the client. - */ - ssl_send_certificate_error(csp); - close_client_and_server_ssl_connections(csp); - return; - } - if (csp->server_cert_verification_result == SSL_CERT_NOT_VERIFIED - || csp->server_cert_verification_result == SSL_CERT_VALID) - { - /* - * The TLS/SSL connection wasn't created but an invalid - * certificate wasn't detected. Report it as connection - * failure. - */ - rsp = error_response(csp, "connect-failed"); - if (rsp) - { - send_crunch_response(csp, rsp); - } - return; - } - } } }/* -END- if (http->ssl) */ #endif /* def FEATURE_HTTPS_INSPECTION */