Commit Graph

642 Commits

Author SHA1 Message Date
Daniel Roethlisberger
d404063eab Attempt at fixing TravisCI ::1 resolution 2016-03-16 11:32:40 +01:00
Daniel Roethlisberger
b3b7a7ab17 Merge branch 'develop' into feature/autossl 2016-03-15 20:13:12 +01:00
Daniel Roethlisberger
43b697d875 Initialize proxy before daemonizing
Issue:		#104
2016-03-15 19:57:14 +01:00
Daniel Roethlisberger
b3a3c36b70 Fix the SSL session timeout calculation
Issue:		#115
Reported by:	Eun Soo Park
2016-03-15 19:45:58 +01:00
Daniel Roethlisberger
73324dcd7b Update NEWS.md 2016-03-15 19:27:46 +01:00
Daniel Roethlisberger
88973e1757 Add support for XNU 3247.1.106, 3247.10.11 and 3248.20.55
Add XNU headers for OS X 10.11, 10.11.1 and 10.11.2.
2016-03-15 18:59:46 +01:00
Daniel Roethlisberger
ba2f451f5e Fix bev write handler for other->closed case
When other->closed is set, the bufferevent write handler accesses
other->bev even though it is invalid.  Fix this access, and as added
layer of defense against future bugs, set ->bev to NULL whenever
invalidating it, except where the connection is torn down completely.

Reported by:	Eun Soo Park
Introduced in:	2bcfaf4 17d753f
Issue:		#109
2015-11-08 15:44:02 +01:00
Daniel Roethlisberger
17d753fc2d Fix NULL pointer dereference in bev write handler
Only manipulate other->bev if it is not NULL to avoid a NULL pointer
dereference in the proxy bufferevent write handler when only one
direction is fully established, for example during connection shutdown.

Reported by:	@david-holonet
Introduced in:	2bcfaf4
Issue:		#109
2015-11-01 17:56:57 +01:00
Daniel Roethlisberger
2bcfaf4b44 Re-enable EV_READ if disabled and outbuf empty
The event buffer write handler failes to re-enable the corresponding
read event of the opposite connection if the buffer is not only down to
less than half the limit, but completely emptied.  In that case, the
read event would never be re-enabled and the connection would stall and
time out.

Issue:		#109
Patch by:	Eun Soo Park
2015-10-25 17:54:27 +01:00
Daniel Roethlisberger
02ab680b34 Add log to PCAP conversion script
Add contributed python script for parsing the output of sslsplit -L
from a log file or named pipe and converting the log entries to an
emulated PCAP format.  Information not contained in the log, such as
sequence numbers, IP IDs etc is emulated and does not correspond to the
original packets on the network.

Issue:		#27
Contributed by:	Maciej Kotowicz
2015-10-09 11:12:59 +02:00
Daniel Roethlisberger
ceffe7a676 Add log parsing script for sslsplit -L
Add contributed script to read and parse the output of sslsplit -L from
a named pipe or log file and post-process the logged connection data
programmatically from python.

Issue:		#27
Contributed by:	Maciej Kotowicz
2015-09-28 20:32:35 +02:00
Daniel Roethlisberger
b95f46b8bd Add XNU headers for OS X 10.10.3, 10.10.4 and 10.10.5
Add pf ioctl API headers for XNU releases 2782.20.48 (10.10.3),
2782.30.5 (10.10.4) and 2782.40.9 (10.10.5).
2015-09-28 01:11:08 +02:00
Daniel Roethlisberger
0e2b748bba Only init DNS when DNS is required by proxy specs
Only initialize evdns if DNS lookups are actually required by the loaded
proxy specifications.  This allows sslsplit to work in non-DNS modes in
situations where the local DNS resolver does not work, such as for local
use on a system without network connectivity.  Currently, only SNI based
proxy specs require DNS.  On systems without network connectivity, DNS
subsystem init may fail due to /etc/resolv.conf being (temporarily)
unavailable.

Issue:		#104
2015-09-27 16:39:24 +02:00
Daniel Roethlisberger
0d38bca4e0 Add XNU 2782.10.72 headers for OS X 10.10.2 2015-08-10 23:18:33 +02:00
Daniel Roethlisberger
d0d3ca9d21 Update docs and -V for LibreSSL and BoringSSL 2015-08-02 22:06:51 +02:00
Daniel Roethlisberger
79d570fe2e Use direct access workaround with LibreSSL
LibreSSL defines OPENSSL_VERSION_NUMBER == 0x20000000L and therefore
needs special treatment when detecting OpenSSL API features based on
OPENSSL_VERSION_NUMBER.  LibreSSL currently does not seem to implement
SSL_CTX_get0_chain_certs().  Once it does, there will be a need for a
specific version check on LIBRESSL_VERSION_NUMBER.

Reported by:		Jérémie Courrèges-Anglas
2015-08-02 21:34:43 +02:00
Daniel Roethlisberger
a084aa62ec Update NEWS.md 2015-07-28 23:58:57 +02:00
Daniel Roethlisberger
57a2ab8588 Rewrite protocol version macros and refactoring
Introduce HAVE_SSLV2, HAVE_SSLV3, HAVE_TLSV10, HAVE_TLSV11 and
HAVE_TLSV12 to indicate that support for the respective protocol is
available in OpenSSL.  This was necessary due to the increased
complexity of testing version support following the phasing out of SSLv2
and SSLv3 from OpenSSL implementations.  This fixes the build with
OpenSSL versions which have SSLv3 support removed.

While here, de-duplicate code for setting SSL_CTX options and do not set
SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION anymore; it has no benefit
in the context of splitting SSL/TLS for analysis.

Reported by:	Jérémie Courrèges-Anglas
2015-07-28 23:39:51 +02:00
Daniel Roethlisberger
769da7565e Style fix 2015-07-28 22:02:04 +02:00
Daniel Roethlisberger
a08a7233ab Move free() to the else branch where it belongs
This prevents free(NULL) in case of failures in ssl_x509_fingerprint().

Issue:		#103
Reported by:	@david-stratusee
2015-07-10 12:01:52 +02:00
Daniel Roethlisberger
f12dd5bb92 Fix debug mode memory leak of cert fingerprint
Issue:		#103
Reported by:	Scot Loach
2015-07-07 18:12:32 +02:00
Daniel Roethlisberger
3f39f589f2 Warn on OpenSSL version mismatch in debug mode
Issue:		#88
2015-06-23 19:07:23 +02:00
Daniel Roethlisberger
74f62c3e5e Refactor and unify ClientHello parsers
Refactor and unify ssl_tls_clienthello_identify() and the earlier
ssl_tls_clienthello_parse_sni() into a single
ssl_tls_clienthello_parse() function that handles parsing ClientHello
messages for different purposes.  As a result, rename the debug knob
DEBUG_SNI_PARSER into DEBUG_CLIENTHELLO_PARSER.
2015-05-17 20:27:58 +02:00
Daniel Roethlisberger
558ffb8d33 List the dependencies in the install notes 2015-05-02 12:52:37 +02:00
Daniel Roethlisberger
29f7ae7bb4 Add a note that pkg-config is used when available 2015-05-02 12:47:10 +02:00
Daniel Roethlisberger
64cc8ffcde Fix lib search w/o pkg-config w/multiple instances
Fix automatic search for dependencies when multiple instances of the
same library are installed in different prefixes that we search, by
using the first one found.  Automatic search is only used when
pkg-config was not found.  This fixes compiler errors caused by spurious
path names within compiler or linker flags, such as

    ld: can't map file, errno=22 file '/usr/lib' for architecture x86_64
    clang: error: linker command failed with exit code 1 (use -v to see
    invocation)

While here, also make XNU header version fallback more robust and add
(diabled) version mappings for 10.10.2 and 10.10.3 which are not
published by Apple yet.

Issue:		#96
Reported by:	Jan Vilhuber
2015-05-02 12:23:14 +02:00
Daniel Roethlisberger
ad5de848c7 Refrain from naming a specific OpenSSL release 2015-05-01 12:13:12 +02:00
Daniel Roethlisberger
bbbeb7c3a4 Further improve wording for clarity 2015-05-01 12:11:44 +02:00
Daniel Roethlisberger
a0a27742dc Rewrite description for clarity
Issue:		#60, #93
2015-05-01 11:59:59 +02:00
Daniel Roethlisberger
b765cb7e0f Update NEWS.md for #92 2015-04-30 17:00:06 +02:00
Daniel Roethlisberger
95d4a9bc35 Explicitly initialize OpenSSL with SSL proxy specs
Make sure we always initialize OpenSSL explicitly, even if there are no
certificates or keys loaded or generated.  Previously, OpenSSL would
only have been initialized if the configuration actually uses
certificates or keys, which is not always the case, e.g. with -t
pointing to an empty directory.

Issue:		#92
Reported by:	xelalexv
2015-04-30 16:58:35 +02:00
Daniel Roethlisberger
dd0d3238ca Add sha1(NEWS.md) to BUILD_INFO when VERSION from dir
Issue:		#85
2015-04-22 23:12:03 +02:00
Daniel Roethlisberger
6671a82aed Rename genericstarttls to autossl and improve docs
Issue:		#87
2015-04-21 16:00:55 +02:00
Daniel Roethlisberger
d7cccacc05 Move ssl_tls_clienthello_identify out of !OPENSSL_NO_TLSEXT
Issue:		#87
2015-04-21 15:52:39 +02:00
Daniel Roethlisberger
96b038ef9b Merge branch 'feature/starttls' of https://github.com/RichardPoole42/sslsplit into feature/autossl 2015-04-21 15:09:31 +02:00
Daniel Roethlisberger
c28ca34fe1 Revert "bugfix: actually parse resolv.conf at startup"
This reverts commit aaa4e94f84.

The initialize_nameservers argument to evdns_base_new was deliberately
not set to 1 because we call evdns_resolv_conf_parse manually later, as
we want more differentiated error reporting.

Issue:		#86
2015-04-21 13:42:29 +02:00
Daniel Roethlisberger
a9863c012b Add Richard Poole to contributor lists 2015-04-21 11:53:39 +02:00
Daniel Roethlisberger
c7ba155ce9 Merge branch 'issue/86' into develop
Issue:		#86
Reported by:	Richard Poole
2015-04-21 11:51:42 +02:00
Richard Poole
5c8b5e30d5 connection upgrade feature: upgrade tcp to ssl on client hello
This code looks at the beginning of each read from the src for something
that looks like an ssl client hello message; if it finds one it tries to
upgrade the connection to proxied ssl. So it works only in the simple
case where the connection has no binary data before the upgrade attempt
(so there are no false positives), and where the client hello comes at
the beginning of a packet from the source.
2015-04-18 13:34:04 +01:00
Richard Poole
aaa4e94f84 bugfix: actually parse resolv.conf at startup 2015-04-18 13:02:33 +01:00
Richard Poole
0f2714ed8a spelling fix 2015-04-18 11:51:28 +01:00
Richard Poole
1f1f7b5559 bugfix: correct calls to log_dbg_printf 2015-04-18 11:50:26 +01:00
Daniel Roethlisberger
330ea4a74c Clarify explanation of -t
Issue:		#84
2015-03-29 14:19:39 +02:00
Daniel Roethlisberger
62b4848998 Add debug mode output to list of things to provide 2015-03-26 09:39:24 +01:00
Daniel Roethlisberger
7badc2fc13 Move all test RSA keys from 1024 bit to 2048 bit
Issue:		#83
2015-03-24 20:40:15 +01:00
Daniel Roethlisberger
77109df8d2 Improve docs on autogenerated 1024 bit RSA leaf key
Issue:		#83
2015-03-24 20:33:38 +01:00
Daniel Roethlisberger
6e53e93d0f Move from sha1 to sha256 in examples and tests
Note that OpenSSL may not support -sha256 on all platforms so we
actually check for support before using it in `make test`.  For the
examples, a modern version of OpenSSL that supports -sha256 is assumed.

Issue:		#83
2015-03-24 20:33:09 +01:00
Daniel Roethlisberger
35dae31624 Rename badly named local var to avoid grep FPs
Issue:		#83
2015-03-24 20:28:40 +01:00
Daniel Roethlisberger
9b5006d6f7 Add PCFLAGS for additional pkg-config flags
Allow for additional flags to pkg-config by means of a PCFLAGS variable.
This e.g. allows to set PCFLAGS='--static' for static builds in
combination with CFLAGS='-static' and LDFLAGS='-static'.

Issue:		#82
Reported by:	@kickwindbg
2015-03-23 22:10:00 +01:00
Daniel Roethlisberger
a14354d18b Allow uid, gid and mode of installed files to be tuned
Introducing the overridable variables INSTALLUID, INSTALLGID, BINUID,
BINGID, BINMODE, MANUID, MANGID, MANMODE that allow overriding of uid,
gid and mode of installed files.  Note that this solution still has the
limitation that uid, gid and mode of created directories cannot be set.

Issue:		#81
Reported by:	Shiloh Heurich
2015-03-17 00:09:19 +01:00