Commit Graph

936 Commits (6a4a70bb06a7081b9c6983c84949bbd8b092704c)
 

Author SHA1 Message Date
Soner Tari 6a4a70bb06 Avoid strdup() and simplify passsite search
Also, improve code, tests, and documentation
3 years ago
Soner Tari 982880ccfe Restructure passsite filter data structure
Now we don't go over all of the passsite rules in a linked list trying
to apply passsite to the sni or common names of a conn. Instead, we now
have user+keyword, keyword, ip, and all lists. For example, if we find
the conn user in the user+keyword list and a passsite in that list
matches, we don't look into other lists.

This change is expected to improve the performance of passsite
processing considerably, because in the earlier implementation we had to
go over all of the passsite rules trying to match passsite.

And this solution uses a correct data structure, even if not the best.
For example, each user or keyword in passsite rules is strdup()'ed only
once.

Note that a better solution could use, say, a hash table for users,
instead of a linked list. But hash tables are not suitable for keywords
or sites, because we search for substring matches with them, not exact
matches.

Also, this fixes passsite rules without any filters defined, i.e. to be
applied to all connections.

Also, now e2e tests error exit if WITHOUT_USERAUTH is enabled. E2e tests
require UserAuth enabled.
3 years ago
Soner Tari 56237558cd Refactor protossl_pass_site() to reduce and decouple code for substring and exact search 3 years ago
Soner Tari f2d4ef61c9 Add support for passsite substring match
Now the site field in PassSite option can have an '*' suffix to search
for a match anywhere in sni or common names. Note that this is not a
regex or wildcard search.

Previously, we only supported exact matches in sni and between slashes
in common names. This change makes it possible to cover multiple sites
in one PassSite option. In fact, without this change, certain sites
could not be added as passsite, because it was impossible to know their
subdomain names beforehand, for example *.fbcdn.net, which may have many
subdomain names in place of asterisk.

So to use substring match, append an '*' to a site name in PassSite
option (the asterisk is removed before substring search). For example,
use ".fbcdn.net*" to match all subdomains of fbcdn.net, notice the
asterisk at the end.

We also add a warning log starting with "Closing on ssl error without
passsite match" to report sites that can be added as passsite, which is
expected to help in writing PassSite rules.

Also, we now set dstaddr_str earlier in conn handling, so we can print
it in debug logs. This also helps in IDLE and EXPIRED conn logs.
3 years ago
Soner Tari 9a7e2c35f3 Avoid multithreading issues by duping the site arg as a local var
If more than one thread enters protossl_pass_site() with the same
proxyspec, they all use spec->opts->passsites->site. Since
protossl_pass_site() modifies the site arg, spec->opts->passsites->site
may be broken. For example, /example.org/ may become /example.or//,
which really happened.
3 years ago
Soner Tari d26c3fd079 Fix passsite in split mode
We should identify conn user before setting dst up in split mode.
Because in split mode dst setup also sets src up too, which tries to
apply passsite rules and switch to passthrough mode. But since user
identification has not run yet, we don't know the user owner of the
conn, which fails passsite rules.
3 years ago
Soner Tari 45b34678de Prepend sslproxy line using evbuffer_add_printf() in non-debug mode for non-http protos
This prevents unnecessary malloc and memmove calls in non-debug mode.
This change is for correctness not for speed, because it improves
conn handling only of the first packet and for non-http protos.
3 years ago
Soner Tari 74cf3800f2 Fix passthrough in split mode 3 years ago
Soner Tari 9123732739 Fix possible segfaults with srvdst_xferred, autossl and passthrough
- Fix segfault introduced in previous commit to prevent extra eof event.
We should NULL srvdst.bev after terminating child dst xferred from
srvdst of parent, so that we don't try to access srvdst.bev. This
happens if child conn with dst xferred from parent srvdst is terminated
before parent conn.

- Fix autossl crash trying to engage passthrough mode. We cannot engage
passthrough mode in autossl, because src is already enabled. But we
shouldn't crash either. These changes are expected to fix other possible
segfaults if passthrough is engaged on eventcb of a child conn.
3 years ago
Soner Tari de9c85f65e Fix signal 11/10 crash due to a second eof event for srvdst in split mode
We reuse srvdst as dst or child dst, so srvdst == dst or child_dst.
But if we don't NULL the callbacks of srvdst in split mode,
we randomly but rarely get a second eof event for srvdst during conn
termination (especially on arm64), which crashes us with signal 11 or
10, because the first eof event for dst frees the ctx.
Note that we don't free anything here, but just disable callbacks and
events.
This does not seem to happen with srvdst_xferred, but just to be safe we
do the same for it too.
This seems to be an issue with libevent.

TODO: Why does libevent raise the same event again for an already
disabled and freed conn end? Note again that srvdst == dst or child_dst
here.
3 years ago
Soner Tari 3a9e77524e Report autossl in CONN logging not tcp at unencrypted stage of autossl
Currently, an autossl conn writes 3x CONN lines in connection logs,
when:

1. tcp srvdst connects (before ssl upgrade)
2. ssl dst connects (src ssl is not complete yet)
3. ssl src connects

This causes misleading connection statistics, as in UTMFW.

TODO: We should write CONN logs at conn termination times, for all
protos not just autossl, not tcp or ssl connect times, so that we don't
write multiple CONN logs for a single conn.
3 years ago
Soner Tari 69753b250c Add split mode of operation similar to SSLsplit
The -n command line option enables split mode for all proxyspecs,
effectively making sslproxy behave like sslsplit.
Divert option can be set/unset globally and per-proxyspec.
Add e2e tests for split mode, and update make file for tests
accordingly.
Update documentation accordingly.
Improve code reuse, remove duplicate functions.

This change deserves a release of its own, hence v0.8.4.
3 years ago
Soner Tari a6cf55cffe Refactor ifdef directive for get_client_ether() call 3 years ago
Soner Tari f8ada5100a Fix initialization of content logging in lp (issue #30)
readcb fires before connect eventcb, so we enable it in readcb now. But
perhaps lp should behave like sslproxy and not enable readcb until after
connect eventcb.

Note that there is no problem with sslproxy, it's just lp.
3 years ago
Soner Tari 1bb5bd2398 Improve UserAuth documentation 3 years ago
Soner Tari 41ec0045f5 Disable osx build on travis until xcode/xnu version fixed 3 years ago
Soner Tari 2b9cb937fd Improve documentation 3 years ago
Soner Tari 0bd1a414cb Fix libpcap install on macOS 10.13 3 years ago
Soner Tari 7ed4748d96 Fix clang warning due to -Wpointer-bool-conversion, remove NONNULL for list
pxyconn.c:1590:9: warning: comparison of nonnull parameter 'list' not
equal to a null pointer is 'true' on first encounter
3 years ago
Soner Tari 596aebb2f3 Update version to 0.8.3 and copyright year to 2021 3 years ago
Soner Tari 6b2072dc94 Fix formatting for -A option
Reported on sslsplit as https://github.com/droe/sslsplit/issues/287
3 years ago
Soner Tari 10f753c012 Remove delimiters around user names
Delimiter can be either or all of ",", " ", and "\t", and we don't allow
spaces in user names now
4 years ago
Soner Tari cb28a1e12a Do not debug print proxyspecs in proxy_new() 4 years ago
Soner Tari 65b7fb9847 Reduce code for user lists 4 years ago
Soner Tari 66dddf2cdb Add info on IPv4-only features 4 years ago
Soner Tari 255cd1cd88 Separate make test as unit and e2e 4 years ago
Soner Tari 9c76563cee Fix mistake: return address -> divert address 4 years ago
Soner Tari 177f6a3b52 Improve overview 4 years ago
Soner Tari def65e195c Update man page with README
Improve README
4 years ago
Soner Tari f1e9de7386 Improve documentation 4 years ago
Soner Tari f254ac1586 Add info on DivertUsers and PassUsers options 4 years ago
Soner Tari aded848043 Release v0.8.2 4 years ago
Soner Tari e2bf278933 Allow mirroring without explicit target
Allow omitting the -T option, indicating the target is irrelevant.

The use case is an IDS sensor listening on a dummy interface for the
packets sslsplit produces. The IDS will listen in promisc mode, so the
target is irrelevant.

Copied from sslsplit.
4 years ago
Soner Tari 463aa1a71e Fix doc typo 4 years ago
Soner Tari 151b305c2f Do not pass null arg to log_*_printf()
vfprintf %s NULL in "Error from bufferevent: %i:%s %lu:%i:%s:%i:%s:%i:%s
"
Error from bufferevent: 32:Broken pipe 50327584:32:Broken pipe:2:system
library:4095:(null)
4 years ago
Soner Tari 4c94853fc5 Disable UserAuth in main.mk if we are not on OpenBSD or Linux
Fixes osx build after updates to userauth
4 years ago
Soner Tari 80d10a94c3 Move classify_user into identify_user
Otherwise, we cannot classify user if we need to issue identify_user
events, in case database is busy or locked. We should call classify_user
callback right after the user is identified.
So we introduce classify_user callback to achieve that, which fixes the
classify_user behavior for autssl proto too.

Return void in pxy_userauth
Fix typo in clasify
4 years ago
Soner Tari 4f3ce763ac Add DivertUsers and PassUsers options
Update documentation
4 years ago
Soner Tari 6c0b981831 Update version to 0.8.1
Update TLS 1.3 documentation.
4 years ago
Soner Tari 4ee7bbcf15 Fix whitespace 4 years ago
Soner Tari e209a04268 Fix line_num reported if conf file contains structured proxyspecs 4 years ago
Soner Tari 6f5a7ceeb1 Add WITHOUT_USERAUTH switch 4 years ago
Soner Tari ca79405769 Fix doc for MaxSSLProto default as tls13 4 years ago
Soner Tari e51afcfe4a Fix default CipherSuites 4 years ago
Soner Tari 176570c4a4 Silence warning about <sys/sysctl.h> deprecated on Linux
/usr/include/x86_64-linux-gnu/sys/sysctl.h:21:2: warning: #warning "The
<sys/sysctl.h> header is deprecated and will be removed." [-Wcpp]
4 years ago
Soner Tari b679439c9f Silence warning about output truncated before terminating nul by gcc 9.3.0
/usr/include/x86_64-linux-gnu/bits/string_fortified.h:106:10: warning:
‘__builtin_strncpy’ output truncated before terminating nul copying as
many bytes from a string as its length [-Wstringop-truncation]
4 years ago
Soner Tari 25ec9d58bc Silence alignment warning by gcc 9.3.0
logpkt.c:351:3: warning: converting a packed ‘ip4_hdr_t’ {aka ‘struct
<anonymous>’} pointer (alignment 1) to a ‘uint16_t’ {aka ‘short unsigned
int’} pointer (alignment 2) may result in an unaligned pointer value
[-Waddress-of-packed-member]
4 years ago
Soner Tari ad21615dbe Add -U to getopt() shortopts 4 years ago
Soner Tari af27340889 Add -U CipherSuites option 4 years ago
Soner Tari 3f2d0d56d6 Fix debug dump for no_tls12/no_tls13 4 years ago