X-Git-Url: http://www.privoxy.org/gitweb/?p=privoxy.git;a=blobdiff_plain;f=jcc.c;h=93af90148b5f077df29a41e1b17dcfe71cd112cf;hp=a76851cabbd0c1409b41d9aa1b2233415511c6d6;hb=6256dd56aac5a17fe320624845f36a7b363e92bf;hpb=6ef3171f6930c7c375a5667221d554c6f1d21729 diff --git a/jcc.c b/jcc.c index a76851ca..93af9014 100644 --- a/jcc.c +++ b/jcc.c @@ -195,7 +195,7 @@ privoxy_mutex_t connection_reuse_mutex; #ifdef FEATURE_HTTPS_INSPECTION privoxy_mutex_t certificate_mutex; -privoxy_mutex_t rng_mutex; +privoxy_mutex_t ssl_init_mutex; #endif #ifdef FEATURE_EXTERNAL_FILTERS @@ -204,6 +204,10 @@ privoxy_mutex_t external_filter_mutex; #ifdef FEATURE_CLIENT_TAGS privoxy_mutex_t client_tags_mutex; #endif +#ifdef FEATURE_EXTENDED_STATISTICS +privoxy_mutex_t filter_statistics_mutex; +privoxy_mutex_t block_statistics_mutex; +#endif #if !defined(HAVE_GETHOSTBYADDR_R) || !defined(HAVE_GETHOSTBYNAME_R) privoxy_mutex_t resolver_mutex; @@ -485,7 +489,7 @@ static int client_protocol_is_unsupported(struct client_state *csp, char *req) #ifdef FEATURE_HTTPS_INSPECTION if (client_use_ssl(csp)) { - ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl), + ssl_send_data_delayed(&(csp->ssl_client_attr), (const unsigned char *)response, strlen(response), get_write_delay(csp)); } @@ -587,10 +591,8 @@ static jb_err get_request_destination_elsewhere(struct client_state *csp, struct } else if (JB_ERR_OK == get_destination_from_headers(headers, csp->http)) { -#ifndef FEATURE_EXTENDED_HOST_PATTERNS /* Split the domain we just got for pattern matching */ init_domain_components(csp->http); -#endif return JB_ERR_OK; } @@ -869,10 +871,10 @@ static void send_crunch_response(struct client_state *csp, struct http_response #ifdef FEATURE_HTTPS_INSPECTION if (client_use_ssl(csp)) { - if ((ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl), + if ((ssl_send_data_delayed(&(csp->ssl_client_attr), (const unsigned char *)rsp->head, rsp->head_length, get_write_delay(csp)) < 0) - || (ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl), + || (ssl_send_data_delayed(&(csp->ssl_client_attr), (const unsigned char *)rsp->body, rsp->content_length, get_write_delay(csp)) < 0)) { @@ -2056,7 +2058,7 @@ static int receive_and_send_encrypted_post_data(struct client_state *csp) { int content_length_known = csp->expected_client_content_length != 0; - while (is_ssl_pending(&(csp->mbedtls_client_attr.ssl)) + while (is_ssl_pending(&(csp->ssl_client_attr)) || (content_length_known && csp->expected_client_content_length != 0)) { unsigned char buf[BUFFER_SIZE]; @@ -2070,7 +2072,7 @@ static int receive_and_send_encrypted_post_data(struct client_state *csp) log_error(LOG_LEVEL_CONNECT, "Waiting for up to %d bytes of POST data from the client.", max_bytes_to_read); - len = ssl_recv_data(&(csp->mbedtls_client_attr.ssl), buf, + len = ssl_recv_data(&(csp->ssl_client_attr), buf, (unsigned)max_bytes_to_read); if (len == -1) { @@ -2083,7 +2085,7 @@ static int receive_and_send_encrypted_post_data(struct client_state *csp) } log_error(LOG_LEVEL_CONNECT, "Forwarding %d bytes of encrypted POST data", len); - len = ssl_send_data(&(csp->mbedtls_server_attr.ssl), buf, (size_t)len); + len = ssl_send_data(&(csp->ssl_server_attr), buf, (size_t)len); if (len == -1) { return 1; @@ -2140,7 +2142,7 @@ static int send_https_request(struct client_state *csp) * Write the client's (modified) header to the server * (along with anything else that may be in the buffer) */ - ret = ssl_send_data(&(csp->mbedtls_server_attr.ssl), + ret = ssl_send_data(&(csp->ssl_server_attr), (const unsigned char *)hdr, strlen(hdr)); freez(hdr); @@ -2154,7 +2156,7 @@ static int send_https_request(struct client_state *csp) } if (((csp->flags & CSP_FLAG_PIPELINED_REQUEST_WAITING) == 0) - && ((flushed = ssl_flush_socket(&(csp->mbedtls_server_attr.ssl), + && ((flushed = ssl_flush_socket(&(csp->ssl_server_attr), csp->client_iob)) < 0)) { log_error(LOG_LEVEL_CONNECT, "Failed sending request body to: %s: %E", @@ -2220,13 +2222,14 @@ static jb_err receive_encrypted_request(struct client_state *csp) do { log_error(LOG_LEVEL_HEADER, "Reading encrypted headers"); - if (!data_is_available(csp->cfd, (int)csp->config->keep_alive_timeout)) + if (!is_ssl_pending(&(csp->ssl_client_attr)) && + !data_is_available(csp->cfd, csp->config->socket_timeout)) { log_error(LOG_LEVEL_CONNECT, "Socket %d timed out while waiting for client headers", csp->cfd); return JB_ERR_PARSE; } - len = ssl_recv_data(&(csp->mbedtls_client_attr.ssl), + len = ssl_recv_data(&(csp->ssl_client_attr), (unsigned char *)buf, sizeof(buf)); if (len == -1) { @@ -2273,7 +2276,7 @@ static jb_err process_encrypted_request(struct client_state *csp) /* XXX: Also used for JB_ERR_MEMORY */ log_error(LOG_LEVEL_ERROR, "Failed to receive encrypted request: %s", jb_err_to_string(err)); - ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl), + ssl_send_data_delayed(&(csp->ssl_client_attr), (const unsigned char *)CHEADER, strlen(CHEADER), get_write_delay(csp)); return err; } @@ -2283,7 +2286,7 @@ static jb_err process_encrypted_request(struct client_state *csp) if (request_line == NULL) { log_error(LOG_LEVEL_ERROR, "Failed to get the encrypted request line"); - ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl), + ssl_send_data_delayed(&(csp->ssl_client_attr), (const unsigned char *)CHEADER, strlen(CHEADER), get_write_delay(csp)); return JB_ERR_PARSE; } @@ -2316,7 +2319,7 @@ static jb_err process_encrypted_request(struct client_state *csp) freez(request_line); if (JB_ERR_OK != err) { - ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl), + ssl_send_data_delayed(&(csp->ssl_client_attr), (const unsigned char *)CHEADER, strlen(CHEADER), get_write_delay(csp)); /* XXX: Use correct size */ log_error(LOG_LEVEL_CLF, "%s - - [%T] \"Invalid request\" 400 0", csp->ip_addr_str); @@ -2351,15 +2354,13 @@ static jb_err process_encrypted_request(struct client_state *csp) */ log_error(LOG_LEVEL_ERROR, "Failed to get the encrypted request destination"); - ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl), + ssl_send_data_delayed(&(csp->ssl_client_attr), (const unsigned char *)CHEADER, strlen(CHEADER), get_write_delay(csp)); return JB_ERR_PARSE; } -#ifndef FEATURE_EXTENDED_HOST_PATTERNS /* Split the domain we just got for pattern matching */ init_domain_components(csp->http); -#endif #ifdef FEATURE_TOGGLE if ((csp->flags & CSP_FLAG_TOGGLED_ON) != 0) @@ -2389,7 +2390,7 @@ static jb_err process_encrypted_request(struct client_state *csp) err = sed_https(csp); if (JB_ERR_OK != err) { - ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl), + ssl_send_data_delayed(&(csp->ssl_client_attr), (const unsigned char *)CHEADER, strlen(CHEADER), get_write_delay(csp)); log_error(LOG_LEVEL_ERROR, "Failed to parse client request from %s.", csp->ip_addr_str); @@ -2798,7 +2799,7 @@ static void handle_established_connection(struct client_state *csp) */ if (server_use_ssl(csp)) { - len = ssl_recv_data(&(csp->mbedtls_server_attr.ssl), + len = ssl_recv_data(&(csp->ssl_server_attr), (unsigned char *)csp->receive_buffer, csp->receive_buffer_size); } else @@ -2964,10 +2965,10 @@ static void handle_established_connection(struct client_state *csp) */ if (client_use_ssl(csp)) { - if ((ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl), + if ((ssl_send_data_delayed(&(csp->ssl_client_attr), (const unsigned char *)hdr, strlen(hdr), get_write_delay(csp)) < 0) - || (ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl), + || (ssl_send_data_delayed(&(csp->ssl_client_attr), (const unsigned char *) ((p != NULL) ? p : csp->iob->cur), csp->content_length, get_write_delay(csp)) < 0)) { @@ -3067,11 +3068,11 @@ static void handle_established_connection(struct client_state *csp) */ if (client_use_ssl(csp)) { - if ((ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl), + if ((ssl_send_data_delayed(&(csp->ssl_client_attr), (const unsigned char *)hdr, hdrlen, get_write_delay(csp)) < 0) - || ((flushed = ssl_flush_socket(&(csp->mbedtls_client_attr.ssl), + || ((flushed = ssl_flush_socket(&(csp->ssl_client_attr), csp->iob)) < 0) - || (ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl), + || (ssl_send_data_delayed(&(csp->ssl_client_attr), (const unsigned char *)csp->receive_buffer, (size_t)len, get_write_delay(csp)) < 0)) { @@ -3118,7 +3119,7 @@ static void handle_established_connection(struct client_state *csp) */ if (client_use_ssl(csp)) { - ret = ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl), + ret = ssl_send_data_delayed(&(csp->ssl_client_attr), (const unsigned char *)csp->receive_buffer, (size_t)len, get_write_delay(csp)); if (ret < 0) @@ -3184,7 +3185,7 @@ static void handle_established_connection(struct client_state *csp) */ if (client_use_ssl(csp)) { - ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl), + ssl_send_data_delayed(&(csp->ssl_client_attr), (const unsigned char *)INVALID_SERVER_HEADERS_RESPONSE, strlen(INVALID_SERVER_HEADERS_RESPONSE), get_write_delay(csp)); } @@ -3278,7 +3279,7 @@ static void handle_established_connection(struct client_state *csp) */ if (client_use_ssl(csp)) { - ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl), + ssl_send_data_delayed(&(csp->ssl_client_attr), (const unsigned char *)INVALID_SERVER_HEADERS_RESPONSE, strlen(INVALID_SERVER_HEADERS_RESPONSE), get_write_delay(csp)); @@ -3311,7 +3312,7 @@ static void handle_established_connection(struct client_state *csp) */ if (client_use_ssl(csp)) { - ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl), + ssl_send_data_delayed(&(csp->ssl_client_attr), (const unsigned char *)INVALID_SERVER_HEADERS_RESPONSE, strlen(INVALID_SERVER_HEADERS_RESPONSE), get_write_delay(csp)); @@ -3381,10 +3382,10 @@ static void handle_established_connection(struct client_state *csp) #ifdef FEATURE_HTTPS_INSPECTION if (client_use_ssl(csp)) { - if ((ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl), + if ((ssl_send_data_delayed(&(csp->ssl_client_attr), (const unsigned char *)hdr, strlen(hdr), get_write_delay(csp)) < 0) - || (len = ssl_flush_socket(&(csp->mbedtls_client_attr.ssl), + || (len = ssl_flush_socket(&(csp->ssl_client_attr), csp->iob) < 0)) { log_error(LOG_LEVEL_CONNECT, "Write header to client failed"); @@ -3443,7 +3444,7 @@ static void handle_established_connection(struct client_state *csp) */ if (client_use_ssl(csp)) { - ssl_send_data_delayed(&(csp->mbedtls_client_attr.ssl), + ssl_send_data_delayed(&(csp->ssl_client_attr), (const unsigned char *)INVALID_SERVER_HEADERS_RESPONSE, strlen(INVALID_SERVER_HEADERS_RESPONSE), get_write_delay(csp)); @@ -3553,17 +3554,6 @@ static void chat(struct client_state *csp) { return; } -#ifdef FEATURE_HTTPS_INSPECTION - /* - * Log the request unless we're https inspecting - * in which case we don't have the path yet and - * will log the request later. - */ - if (!client_use_ssl(csp)) -#endif - { - log_error(LOG_LEVEL_REQUEST, "%s%s", http->hostport, http->path); - } /* decide how to route the HTTP request */ fwd = forward_url(csp, http); @@ -3648,6 +3638,18 @@ static void chat(struct client_state *csp) } #endif +#ifdef FEATURE_HTTPS_INSPECTION + /* + * Log the request unless we're https inspecting + * in which case we don't have the path yet and + * will log the request later. + */ + if (!client_use_ssl(csp)) +#endif + { + log_error(LOG_LEVEL_REQUEST, "%s%s", http->hostport, http->path); + } + if (http->ssl && connect_port_is_forbidden(csp)) { const char *acceptable_connect_ports = @@ -3884,16 +3886,19 @@ static void chat(struct client_state *csp) } /* - * Test if connection with destination server was established - * successfully by parent proxy. Then we can send response to - * the client and continue or stop. + * Test if the connection to the destination server was + * established successfully by the parent proxy. */ if (!tunnel_established_successfully(server_response, (unsigned int)len)) { - log_error(LOG_LEVEL_ERROR, "Forwarder hasn't established " - "connection with destination server."); - - write_socket(csp->cfd, server_response, (size_t)len); + log_error(LOG_LEVEL_ERROR, + "The forwarder %s failed to establish a connection with %s", + fwd->forward_host, http->host); + rsp = error_response(csp, "connect-failed"); + if (rsp) + { + send_crunch_response(csp, rsp); + } mark_server_socket_tainted(csp); close_client_ssl_connection(csp); return; @@ -4237,7 +4242,7 @@ static void serve(struct client_state *csp) { log_error(LOG_LEVEL_CONNECT, "Closing server socket %d connected to %s. " - "Keep-alive %u. Tainted: %u. Socket alive %u. Timeout: %u.", + "Keep-alive: %u. Tainted: %u. Socket alive: %u. Timeout: %u.", csp->server_connection.sfd, csp->server_connection.host, 0 != (csp->flags & CSP_FLAG_SERVER_CONNECTION_KEEP_ALIVE), 0 != (csp->flags & CSP_FLAG_SERVER_SOCKET_TAINTED), @@ -4554,7 +4559,7 @@ static void initialize_mutexes(void) #ifdef FEATURE_HTTPS_INSPECTION privoxy_mutex_init(&certificate_mutex); - privoxy_mutex_init(&rng_mutex); + privoxy_mutex_init(&ssl_init_mutex); #endif privoxy_mutex_init(&log_mutex); @@ -4566,6 +4571,10 @@ static void initialize_mutexes(void) #ifdef FEATURE_CLIENT_TAGS privoxy_mutex_init(&client_tags_mutex); #endif +#ifdef FEATURE_EXTENDED_STATISTICS + privoxy_mutex_init(&filter_statistics_mutex); + privoxy_mutex_init(&block_statistics_mutex); +#endif /* * XXX: The assumptions below are a bit naive @@ -5594,11 +5603,7 @@ static void listen_loop(void) #ifdef FEATURE_HTTPS_INSPECTION /* Clean up. Aim: free all memory (no leaks) */ - if (rng_seeded == 1) - { - mbedtls_ctr_drbg_free(&ctr_drbg); - mbedtls_entropy_free(&entropy); - } + ssl_release(); #endif #ifdef FEATURE_GRACEFUL_TERMINATION