Archives
/
SSLproxy
mirror of https://github.com/sonertari/SSLproxy
2
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
1,109 Commits
2 Branches
25 Tags
3.7 MiB
develop
master
v0.5.0
v0.5.1
v0.5.2
v0.5.3
v0.5.4
v0.5.5
v0.5.6
v0.5.7
v0.5.8
v0.5.9
v0.6.0
v0.7.0
v0.8.0
v0.8.1
v0.8.2
v0.8.3
v0.8.4
v0.8.5
v0.8.6
v0.9.0
v0.9.1
v0.9.2
v0.9.3
v0.9.4
v0.9.5
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from 'master'
${ noResults }
Commit Graph

1109 Commits (master)
 

Author SHA1 Message Date
Soner Tari 59c28f6ad9 Fix enabling pcap and mirror logging, issue #37 
Reported by @Leonschmitt
 2 years ago
Soner Tari 7033afced1 Improve documentation 3 years ago
Soner Tari 7654f5e7b3 Fix unit tests with libressl 2.2.7 
OPENSSL_VERSION_NUMBER in libressl 2.2.7 is 20000000, which is >=
0x10100000L.
 3 years ago
Soner Tari 923bea195a Fix unit tests with libressl 3.4.1 3 years ago
Soner Tari fe3bdc5dac Migrate to travis-ci.com 3 years ago
Soner Tari 8b2860b0b3 Fix unit tests with WITHOUT_USERAUTH enabled 3 years ago
Soner Tari 6bd0dea851 Disable travis e2e tests 3 years ago
Soner Tari 49c58048f6 Disable travis build with WITHOUT_MIRROR 
We cannot run unit tests with WITHOUT_MIRROR enabled, debug output for
filter rules have mirror logging
 3 years ago
Soner Tari 3f3c3623ad Fix unit tests for openssl-1.0.0s 3 years ago
Soner Tari 90b32e0595 Fix unit tests for openssl and libressl versions in travis config 3 years ago
Soner Tari 0600a5c2ea Do not verify server cert due to expired Let's Encrypt cert 3 years ago
Soner Tari 5bc6933f79 Fix unit tests for libressl-2.2.7, libressl-2.7.4, and openssl-1.1.0 3 years ago
Soner Tari b3be019ffa Fix travis unit tests with max ssl proto 3 years ago
Soner Tari c90f71f5ef Bump version to 0.9.2 3 years ago
Soner Tari eba4eb3ea6 Fix syntax documentation for Log actions in struct filtering rules 
And clean up
 3 years ago
Soner Tari 677178c2d9 Fix use of uninitialised value error by valgrind 3 years ago
Soner Tari 2f2dd468f2 Free macros after setting filter rules during startup 3 years ago
Soner Tari d876710acf Add the full text of the GPL and LGPL licenses 
This is required for complying with the LGPL license of the aho corasick
library.
 3 years ago
Soner Tari 3003d237c7 Reflect the license change of aho corasick library to LGPL 
Laurent Farhi, @farhiongit, the developer of the Aho Corasick library
has changed the license of the library to the LGPL. Thanks Laurent.
 3 years ago
Soner Tari e05dd2b884 Update release date 3 years ago
Soner Tari 3e55d4820e Release v0.9.1 3 years ago
Soner Tari 700a901e29 Add missing FilterRule option to proxyspec documentation 3 years ago
Soner Tari dd4975690e Check if userdb file can be opened before setting userdb_path option 3 years ago
Soner Tari 5877e81301 Improve proxyspec documentation 3 years ago
Soner Tari 79bacaeff3 Fix definitely lost memleaks reported by valgrind 
Fix a major memset() mistake leaking memory and possibly breaking CA
chains for proxyspecs and struct filtering rules.
Fix wrong memset size.
Fix redundant WUNRES attrib, MALLOC attrib has WUNRES already.
And fix param names.
 3 years ago
Soner Tari d07606b586 Add support for multi-site struct filtering rules 
Now we can specify multiple sites in one struct rule: SNI, CN, Host,
URI, and DstIp destination sites. We create a new rule for each
destination site type specified. Struct rules can be complicated and
long, so this is expected to help with rule reuse.
 3 years ago
Soner Tari 12f09dbb87 Add ReconnectSSL to debug logs 3 years ago
Soner Tari 45a4015707 Add checks for multiple or not allowed specs in struct filtering rules 3 years ago
Soner Tari add8bcda09 Add line_num to filtering rules with DEBUG_PROXY 
Error out unit tests if DEBUG_PROXY enabled, because we debug print
line_num if DEBUG_PROXY enabled. We cannot support line_num in expected
debug output, it would make things complicated with very little benefit.
 3 years ago
Soner Tari 77df635afa Change line_num type to unsigned int 3 years ago
Soner Tari feb673e8fa Add unit tests for struct proxyspecs 3 years ago
Soner Tari 2f8575d7c0 Add unit tests for struct filtering rules 
And clean up whitespace
 3 years ago
Soner Tari eccd46dc0e Add support for multiple log actions on Log lines 
But we don't support $macros within multi valued Log lines, i.e. cannot
mix log actions with $macros, use either log actions concat with spaces
or just a $macro, and no point trying to support it either.
 3 years ago
Soner Tari 9708225bb1 Rename LogAction to Log 3 years ago
Soner Tari a3c89fc931 Set conn_opts only if struct filtering rule specifies any conn option 
Otherwise, we use the global or proxyspec conn options, so we should not
waste memory for duplicate conn_opts structs.
 3 years ago
Soner Tari 8e00f94ccd Fix user/desc precedence in struct filtering rules 
Don't forget tot increment precedence if only Desc is used.
But do not increment precedence twice for both User and Desc.
Note that the ordering of User and Desc in the rule is not known.
 3 years ago
Soner Tari 775ae774ea Set conn term flag only, do not free conn in eventcb 
Rename reconnected_ssl flag to reconnected
Improve e2e tests
 3 years ago
Soner Tari 8f63ec7f82 Add ReconnectSSL option to enforce SSL options in struct filtering rules 
The ReconnectSSL option allows rule developers to write struct filtering
rules using SNI and CN SSL specifications to override the SSL
configuration of a connection.

Otherwise, without this new option, filtering rules cannot change SSL
options using SSL filtering fields to match connections (the SSL config
in the rule would not have any effect on the server side of the matching
connection). Without ReconnectSSL, only DstIP and DstPort fields can be
used to override the SSL config of a connection.

If the ReconnectSSL option in a struct filtering rule is set, we
disconnect and free the server side of the matching SSL connection, and
reconnect it with the SSL options in the matching struct filtering rule.
This enforces the SSL config in the rule.

Do not use the ReconnectSSL option if server disconnect is not desirable
or acceptable in your case.
 3 years ago
Soner Tari f744c2c77a Fix check build with LibreSSL 3.4.1 on OpenBSD 7.0 3 years ago
Soner Tari e8f35ce587 Reapply dsthost filter after user auth 
We have to apply the DstHost filter both (1) as early as in
pxy_conn_connect() and also (2) after user owner of the conn is
determined in srvdst connected callback functions for tcp and ssl.

Otherwise, we cannot override SSL options of conns if we don't apply it
before SSL establishment (1), and we cannot apply user auth filtering
rules if we don't apply after determining the user owner of conn (2).

This commit actually adds the same calls in the same places as they were
before the structured filtering rules were introduced.

So for example, now we have to apply filters 4x for an HTTPS conn: 2x
dsthost, 1x ssl, and 1x http.
 3 years ago
Soner Tari 05d5412515 Fix warning for unused ctx debug param in pxy_conn_set_filter_action() 3 years ago
Soner Tari 98d9a05eac Add documentation for structured filtering rules 3 years ago
Soner Tari 6c586bb4a4 Add e2e tests for struct filtering rules, and add -B EnableSSLProto option 
The EnableSSLProto option is useful with structured proxyspecs and
filtering rules.
 3 years ago
Soner Tari 1485fa1dfb Fix copying of SSL options in tmp_opts 
And clean up whitspace
 3 years ago
Soner Tari a3222ee2c1 Increment rule precedence only once for multiple LogAction specs 
We allow for multiple LogAction lines in the same structured filtering
rule.
 3 years ago
Soner Tari 18fb6f4dd7 Apply dstip filter before ssl server conn setup 
So that we can replace the SSL/TLS configuration of the conn with the
one in the matching filtering rule. Otherwise, once the server conn is
established, we cannot change the SSL config, or would risk confusing
the SSL routines.
 3 years ago
Soner Tari 6c988b0f4a Add structured filtering rules to specify conn options 
Now all connection oriented proxy options possible to specify
per-proxyspec or globally can be specified in structured filtering rules
to be selectively applied to connections too. One line filtering rules
can specify filter and log actions only.

For example, we can enable/disable user authentication, protocol
validation, server ssl verification, and many other options
per-connection, or configure SSL/TLS connection options per-connection.

So, now we replace the conn_opts struct of a connection's ctx with the
conn_opts struct of the matching structured filtering rule. (One line
filtering rules have a NULL conn_opts, so we first check if the
conn_opts is not NULL.)
 3 years ago
Soner Tari 14c8d417c9 Move connection oriented options to a new conn_opts struct 3 years ago
Soner Tari 396db70a87 Rename parent/child dst/src addrs to divert and return addrs 3 years ago
Soner Tari 07c3f08584 Release v0.9.0 3 years ago