X-Git-Url: http://www.privoxy.org/gitweb/?p=privoxy.git;a=blobdiff_plain;f=project.h;h=528ab24a462d2b821e4099a148d2a2250fa50077;hp=2b0c606955879cf4ec656ee462acffd052c64d9a;hb=da6d6e7115b36cd4e03460c9c49a212edacb159a;hpb=67632125b235891a578acd268f540cd1ac07e98e diff --git a/project.h b/project.h index 2b0c6069..528ab24a 100644 --- a/project.h +++ b/project.h @@ -1,7 +1,5 @@ #ifndef PROJECT_H_INCLUDED #define PROJECT_H_INCLUDED -/** Version string. */ -#define PROJECT_H_VERSION "$Id: project.h,v 1.206 2014/06/02 06:22:21 fabiankeil Exp $" /********************************************************************* * * File : $Source: /cvsroot/ijbswa/current/project.h,v $ @@ -11,7 +9,7 @@ * (though it does declare some macros). * * Copyright : Written by and Copyright (C) 2001-2014 the - * Privoxy team. http://www.privoxy.org/ + * Privoxy team. https://www.privoxy.org/ * * Based on the Internet Junkbuster originally written * by and Copyright (C) 1997 Anonymous Coders and @@ -46,6 +44,34 @@ /* Needed for pcre choice */ #include "config.h" +#ifdef FEATURE_HTTPS_INSPECTION +#ifdef FEATURE_PTHREAD +# include + typedef pthread_mutex_t privoxy_mutex_t; +#else +# ifdef _WIN32 +# include +# endif + typedef CRITICAL_SECTION privoxy_mutex_t; +#endif + +#include "mbedtls/net_sockets.h" +#include "mbedtls/entropy.h" +#include "mbedtls/ctr_drbg.h" + +#if defined(MBEDTLS_SSL_CACHE_C) +#include "mbedtls/ssl_cache.h" +#endif + +/* +* Macros for SSL structures +*/ +#define CERT_INFO_BUF_SIZE 4096 +#define CERT_FILE_BUF_SIZE 16384 +#define ISSUER_NAME_BUF_SIZE 2048 +#define HASH_OF_HOST_BUF_SIZE 16 +#endif + /* Need for struct sockaddr_storage */ #ifdef HAVE_RFC2553 # ifndef _WIN32 @@ -53,7 +79,6 @@ # include # else # include -# include # include typedef unsigned short in_port_t; # endif @@ -92,10 +117,6 @@ # endif #endif -#ifdef AMIGA -#include "amiga.h" -#endif /* def AMIGA */ - #ifdef _WIN32 /* * I don't want to have to #include all this just for the declaration @@ -266,6 +287,23 @@ struct map struct map_entry *last; }; +#ifdef FEATURE_HTTPS_INSPECTION +/* + * Struct of attributes necessary for TLS/SSL connection + */ +typedef struct { + mbedtls_ssl_context ssl; + mbedtls_ssl_config conf; + mbedtls_net_context socket_fd; + mbedtls_x509_crt server_cert; + mbedtls_x509_crt ca_cert; + mbedtls_pk_context prim_key; + + #if defined(MBEDTLS_SSL_CACHE_C) + mbedtls_ssl_cache_context cache; + #endif +} mbedtls_connection_attr; +#endif /** * A HTTP request. This includes the method (GET, POST) and @@ -281,7 +319,7 @@ struct http_request char *ocmd; /**< Backup of original cmd for CLF logging */ char *gpc; /**< HTTP method: GET, POST, ... */ char *url; /**< The URL */ - char *ver; /**< Protocol version */ + char *version; /**< Protocol version */ int status; /**< HTTP Status */ char *host; /**< Host part of URL */ @@ -298,8 +336,27 @@ struct http_request char **dvec; /**< List of pointers to the strings in dbuffer. */ int dcount; /**< How many parts to this domain? (length of dvec) */ #endif /* ndef FEATURE_EXTENDED_HOST_PATTERNS */ + +#ifdef FEATURE_HTTPS_INSPECTION + int client_ssl; /**< Flag if we should comunicate with slient over ssl */ + int server_ssl; /**< Flag if we should comunicate with server over ssl */ + unsigned char hash_of_host_hex[(HASH_OF_HOST_BUF_SIZE * 2) + 1]; /**< chars for hash in hex string and one for '\0' */ + unsigned char hash_of_host[HASH_OF_HOST_BUF_SIZE+1]; /**< chars for bytes of hash and one for '\0' */ +#endif }; + +#ifdef FEATURE_HTTPS_INSPECTION +/* + * Struct for linked list containing certificates + */ +typedef struct certs_chain { + char text_buf[CERT_INFO_BUF_SIZE]; /* text info about properties of certificate */ + char file_buf[CERT_FILE_BUF_SIZE]; /* buffer for whole certificate - format to save in file */ + struct certs_chain *next; /* next certificate in chain of trust */ +} certs_chain_t; +#endif + /** * Reasons for generating a http_response instead of delivering * the requested resource. Mostly ordered the way they are checked @@ -400,6 +457,9 @@ struct pattern_spec /** Pattern spec bitmap: It's a NO-RESPONSE-TAG pattern. */ #define PATTERN_SPEC_NO_RESPONSE_TAG_PATTERN 0x00000008UL +/** Pattern spec bitmap: It's a CLIENT-TAG pattern. */ +#define PATTERN_SPEC_CLIENT_TAG_PATTERN 0x00000010UL + /** * An I/O buffer. Holds a string which can be appended to, and can have data * removed from the beginning. @@ -495,7 +555,7 @@ struct iob #define ACTION_CRUNCH_CLIENT_HEADER 0x00200000UL /** Action bitmap: Enable text mode by force */ #define ACTION_FORCE_TEXT_MODE 0x00400000UL -/** Action bitmap: Enable text mode by force */ +/** Action bitmap: Remove the "If-None-Match" header. */ #define ACTION_CRUNCH_IF_NONE_MATCH 0x00800000UL /** Action bitmap: Enable content-disposition crunching */ #define ACTION_HIDE_CONTENT_DISPOSITION 0x01000000UL @@ -505,7 +565,12 @@ struct iob #define ACTION_HIDE_ACCEPT_LANGUAGE 0x04000000UL /** Action bitmap: Limit the cookie lifetime */ #define ACTION_LIMIT_COOKIE_LIFETIME 0x08000000UL - +/** Action bitmap: Delay writes */ +#define ACTION_DELAY_RESPONSE 0x10000000UL +/** Action bitmap: Turn https inspection on */ +#define ACTION_HTTPS_INSPECTION 0x20000000UL +/** Action bitmap: Turn certificates verification off */ +#define ACTION_IGNORE_CERTIFICATE_ERRORS 0x40000000UL /** Action string index: How to deanimate GIFs */ #define ACTION_STRING_DEANIMATE 0 @@ -545,8 +610,10 @@ struct iob #define ACTION_STRING_CHANGE_X_FORWARDED_FOR 17 /** Action string index: how many minutes cookies should be valid. */ #define ACTION_STRING_LIMIT_COOKIE_LIFETIME 18 +/** Action string index: how many milliseconds writes should be delayed. */ +#define ACTION_STRING_DELAY_RESPONSE 19 /** Number of string actions. */ -#define ACTION_STRING_COUNT 19 +#define ACTION_STRING_COUNT 20 /* To make the ugly hack in sed easier to understand */ @@ -642,7 +709,7 @@ struct url_actions }; enum forwarder_type { - /**< Don't use a SOCKS server */ + /**< Don't use a SOCKS server, forward to a HTTP proxy directly */ SOCKS_NONE = 0, /**< original SOCKS 4 protocol */ SOCKS_4 = 40, @@ -652,6 +719,12 @@ enum forwarder_type { SOCKS_5 = 50, /**< Like SOCKS5, but uses non-standard Tor extensions (currently only optimistic data) */ SOCKS_5T, + /**< + * Don't use a SOCKS server, forward to the specified webserver. + * The difference to SOCKS_NONE is that a request line without + * full URL is sent. + */ + FORWARD_WEBSERVER, }; /* @@ -726,11 +799,6 @@ struct reusable_connection */ #define CSP_FLAG_TOGGLED_ON 0x20U -/** - * Flag for csp->flags: Set if we answered the request ourselve. - */ -#define CSP_FLAG_CRUNCHED 0x40U - /** * Flag for csp->flags: Set if an acceptable Connection header * has already been set by the client. @@ -853,18 +921,30 @@ struct reusable_connection */ #define CSP_FLAG_UNSUPPORTED_CLIENT_EXPECTATION 0x02000000U +/** + * Flag for csp->flags: Set if we answered the request ourselve. + */ +#define CSP_FLAG_CRUNCHED 0x04000000U + +#ifdef FUZZ +/** + * Flag for csp->flags: Set if we are working with fuzzed input + */ +#define CSP_FLAG_FUZZED_INPUT 0x08000000U +#endif + /* * Flags for use in return codes of child processes */ /** - * Flag for process return code: Set if exiting porcess has been toggled + * Flag for process return code: Set if exiting process has been toggled * during its lifetime. */ #define RC_FLAG_TOGGLED 0x10 /** - * Flag for process return code: Set if exiting porcess has blocked its + * Flag for process return code: Set if exiting process has blocked its * request. */ #define RC_FLAG_BLOCKED 0x20 @@ -873,7 +953,7 @@ struct reusable_connection * Maximum number of actions/filter files. This limit is arbitrary - it's just used * to size an array. */ -#define MAX_AF_FILES 30 +#define MAX_AF_FILES 100 /** * Maximum number of sockets to listen to. This limit is arbitrary - it's just used @@ -917,6 +997,10 @@ struct client_state unsigned long ip_addr_long; #endif /* def HAVE_RFC2553 */ + /** The host name and port (as a string of the form ':') + of the server socket to which the client connected. */ + char *listen_addr_str; + /** The URL that was requested */ struct http_request http[1]; @@ -931,15 +1015,42 @@ struct client_state /* XXX: should be renamed to server_iob */ struct iob iob[1]; +#ifdef FEATURE_HTTPS_INSPECTION + mbedtls_connection_attr mbedtls_server_attr; /* attributes for connection to server */ + mbedtls_connection_attr mbedtls_client_attr; /* attributes for connection to client */ +#endif + /** An I/O buffer used for buffering data read from the client */ struct iob client_iob[1]; + /** Buffer used to briefly store data read from the network + * before forwarding or processing it. + */ + char *receive_buffer; + size_t receive_buffer_size; + /** List of all headers for this request */ struct list headers[1]; +#ifdef FEATURE_HTTPS_INSPECTION + /** List of all encrypted headers for this request */ + struct list https_headers[1]; +#endif + /** List of all tags that apply to this request */ struct list tags[1]; +#ifdef FEATURE_CLIENT_TAGS + /** List of all tags that apply to this client (assigned based on address) */ + struct list client_tags[1]; + /** The address of the client the request (presumably) came from. + * Either the address returned by accept(), or the address provided + * with the X-Forwarded-For header, provided Privoxy has been configured + * to use it. + */ + char *client_address; +#endif + /** MIME-Type key, see CT_* above */ unsigned int content_type; @@ -976,6 +1087,28 @@ struct client_state * or NULL. Currently only used for socks errors. */ char *error_message; + +#ifdef FEATURE_HTTPS_INSPECTION + /* Result of server certificate verification */ + uint32_t server_cert_verification_result; + + /* Flag for certificate validity checking */ + int dont_verify_certificate; + + /* + * Flags if SSL connection with server or client is opened. + * Thanks to this flags, we can call function to close both connections + * and we don't have to care about more details. + */ + int ssl_with_server_is_opened; + int ssl_with_client_is_opened; + + /* + * Server certificate chain of trust including strings with certificates + * informations and string with whole certificate file + */ + struct certs_chain server_certs_chain; +#endif }; /** @@ -1102,6 +1235,12 @@ struct forward_spec /** SOCKS server port. */ int gateway_port; + /** SOCKS5 username. */ + char *auth_username; + + /** SOCKS5 password. */ + char *auth_password; + /** Parent HTTP proxy hostname, or NULL for none. */ char *forward_host; @@ -1195,6 +1334,15 @@ struct access_control_list /** Maximum number of loaders (actions, re_filter, ...) */ #define NLOADERS 8 +/** + * This struct represents a client-spcific-tag and it's description + */ +struct client_tag_spec +{ + char *name; /**< Name from "client-specific-tag bla" directive */ + char *description; /**< Description from "client-specific-tag-description " directive */ + struct client_tag_spec *next; /**< The pointer for chaining. */ +}; /** configuration_spec::feature_flags: CGI actions editor. */ #define RUNTIME_FEATURE_CGI_EDIT_ACTIONS 1U @@ -1260,6 +1408,9 @@ struct configuration_spec /** The directory for customized CGI templates. */ const char *templdir; + /** "Cross-origin resource sharing" (CORS) allowed origin */ + const char *cors_allowed_origin; + #ifdef FEATURE_EXTERNAL_FILTERS /** The template used to create temporary files. */ const char *temporary_directory; @@ -1298,12 +1449,26 @@ struct configuration_spec /** IP addresses to bind to. Defaults to HADDR_DEFAULT == 127.0.0.1. */ const char *haddr[MAX_LISTENING_SOCKETS]; + /** Trusted referring site that can be used to reach CGI + * pages that aren't marked as harmful. + */ + const char *trusted_cgi_referrer; + /** Ports to bind to. Defaults to HADDR_PORT == 8118. */ int hport[MAX_LISTENING_SOCKETS]; /** Size limit for IOB */ size_t buffer_limit; + /** Size of the receive buffer */ + size_t receive_buffer_size; + + /** Use accf_http(4) if available */ + int enable_accept_filter; + + /** Backlog passed to listen() */ + int listen_backlog; + #ifdef FEATURE_TRUST /** The file name of the trust file. */ @@ -1317,6 +1482,14 @@ struct configuration_spec #endif /* def FEATURE_TRUST */ +#ifdef FEATURE_CLIENT_TAGS + struct client_tag_spec client_tags[1]; + + /* Maximum number of seconds a temporarily enabled tag stays enabled. */ + unsigned int client_tag_lifetime; +#endif /* def FEATURE_CLIENT_TAGS */ + int trust_x_forwarded_for; + #ifdef FEATURE_ACL /** The access control list (ACL). */ @@ -1359,15 +1532,34 @@ struct configuration_spec /** Nonzero if we need to bind() to the new port. */ int need_bind; + +#ifdef FEATURE_HTTPS_INSPECTION + /** Password for proxy ca file **/ + char * ca_password; + + /** Directory with files of ca **/ + char *ca_directory; + + /** Filename of ca certificate **/ + char * ca_cert_file; + + /** Filename of ca key **/ + char * ca_key_file; + + /** Directory for saving certificates and keys for each webpage **/ + char *certificate_directory; + + /** Filename of trusted CAs certificates **/ + char * trusted_cas_file; +#endif }; /** Calculates the number of elements in an array, using sizeof. */ #define SZ(X) (sizeof(X) / sizeof(*X)) -#ifdef FEATURE_FORCE_LOAD -/** The force load URL prefix. */ +/** The force load URL prefix. Not behind an ifdef because + * it's always used for the show-status page. */ #define FORCE_PREFIX "/PRIVOXY-FORCE" -#endif /* def FEATURE_FORCE_LOAD */ #ifdef FEATURE_NO_GIFS /** The MIME type for images ("image/png" or "image/gif"). */ @@ -1382,7 +1574,7 @@ struct configuration_spec */ /** URL for the Privoxy home page. */ -#define HOME_PAGE_URL "http://www.privoxy.org/" +#define HOME_PAGE_URL "https://www.privoxy.org/" /** URL for the Privoxy user manual. */ #define USER_MANUAL_URL HOME_PAGE_URL VERSION "/user-manual/"