Archives
/
SSLproxy
mirror of https://github.com/sonertari/SSLproxy
2
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
974 Commits
2 Branches
26 Tags
3.1 MiB
develop
master
v0.5.0
v0.5.1
v0.5.2
v0.5.3
v0.5.4
v0.5.5
v0.5.6
v0.5.7
v0.5.8
v0.5.9
v0.6.0
v0.7.0
v0.8.0
v0.8.1
v0.8.2
v0.8.3
v0.8.4
v0.8.5
v0.8.6
v0.9.0
v0.9.1
v0.9.2
v0.9.3
v0.9.4
v0.9.5
v0.9.6
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '712733b329'
${ noResults }
Commit Graph

72 Commits (712733b329410eb59efcc7ea3d22bad514893fb0)

Author SHA1 Message Date
Soner Tari 8d752b4d31 Add documentation for filtering rules 
Also bump version to 0.8.7
 3 years ago
Soner Tari 982880ccfe Restructure passsite filter data structure 
Now we don't go over all of the passsite rules in a linked list trying
to apply passsite to the sni or common names of a conn. Instead, we now
have user+keyword, keyword, ip, and all lists. For example, if we find
the conn user in the user+keyword list and a passsite in that list
matches, we don't look into other lists.

This change is expected to improve the performance of passsite
processing considerably, because in the earlier implementation we had to
go over all of the passsite rules trying to match passsite.

And this solution uses a correct data structure, even if not the best.
For example, each user or keyword in passsite rules is strdup()'ed only
once.

Note that a better solution could use, say, a hash table for users,
instead of a linked list. But hash tables are not suitable for keywords
or sites, because we search for substring matches with them, not exact
matches.

Also, this fixes passsite rules without any filters defined, i.e. to be
applied to all connections.

Also, now e2e tests error exit if WITHOUT_USERAUTH is enabled. E2e tests
require UserAuth enabled.
 3 years ago
Soner Tari 69753b250c Add split mode of operation similar to SSLsplit 
The -n command line option enables split mode for all proxyspecs,
effectively making sslproxy behave like sslsplit.
Divert option can be set/unset globally and per-proxyspec.
Add e2e tests for split mode, and update make file for tests
accordingly.
Update documentation accordingly.
Improve code reuse, remove duplicate functions.

This change deserves a release of its own, hence v0.8.4.
 3 years ago
Soner Tari f8ada5100a Fix initialization of content logging in lp (issue #30) 
readcb fires before connect eventcb, so we enable it in readcb now. But
perhaps lp should behave like sslproxy and not enable readcb until after
connect eventcb.

Note that there is no problem with sslproxy, it's just lp.
 3 years ago
Soner Tari 596aebb2f3 Update version to 0.8.3 and copyright year to 2021 4 years ago
Soner Tari aded848043 Release v0.8.2 4 years ago
Soner Tari 6c0b981831 Update version to 0.8.1 
Update TLS 1.3 documentation.
 4 years ago
Soner Tari 6f5a7ceeb1 Add WITHOUT_USERAUTH switch 4 years ago
Soner Tari ca79405769 Fix doc for MaxSSLProto default as tls13 4 years ago
Soner Tari af27340889 Add -U CipherSuites option 4 years ago
Soner Tari fade72ec0d Move main.mk under Mk folder and improve make files 4 years ago
Soner Tari 2f89a27551 Use Testproxy v0.0.3 4 years ago
Soner Tari 8989873332 Add sni assertions to testproxy e2e tests for tls12 and tls13 4 years ago
Soner Tari 1403c4eda1 Fix travis for ssl libs without tls13, add no_tls13 e2e tests 4 years ago
Soner Tari ee41c72666 Add tls13 support 
Add e2e tests for tls13 too
 4 years ago
Soner Tari 9da7437919 Release v0.8.0 4 years ago
Soner Tari 826b612c1e Fix build version 
Improve documentation
 4 years ago
Soner Tari 3fe0e5f1eb Move tmp global opts vars to new tmp struct 
The global opts strings in this new tmp struct are used while cloning
global opts into proxyspec opts. A var of this type is passed around as
a flag to indicate if these opts are global (if non-NULL), so should be
stored in that struct and used as such, or proxyspec specific (if NULL),
so should not be used as global. This var is temporary, hence freed
immediately after configuration is complete.
Also improve and clean up.
 4 years ago
Soner Tari e3b0ba94d8 Accept space, tab, cr, and nl chars after POP3 and SMTP commands 
POP3 clients may and do append CRLF to commands.
So use the new util_get_first_word_len() function.
 4 years ago
Soner Tari ef2edff60a Improve string comparisons 
We need case-insensitive comparison validating POP3 and SMTP commands.
Define macro function to check string equality.
 4 years ago
Soner Tari ac4285cef1 Fix POP3 and SMTP protocol validation, thanks to the new testproxy e2e tests 
Add testproxy e2e tests for POP3 and SMTP protocol validation.

We have detected that POP3 and SMTP protocol validation was broken
thanks to these new testproxy e2e tests. This is yet another example why
e2e tests are important.
 4 years ago
Soner Tari 313da5cfca Add -A DefaultLeafCert option 
Rename LeafCerts to LeafKey, TargetCertDir to LeafCertDir, CRL to
LeafCRLURL
 4 years ago
Soner Tari aba07a53ee Disable conn ids unless debugging 
We don't need parent or child ids unless debugging. IDLE and EXPIRED
conn logs do not need to report ids either. Ids are useful only in
detailed debug logs.
 4 years ago
Soner Tari 5285b9e433 Fix valgrind REDIR warning about strncpy(), use memcpy() instead 
REDIR: 0x562c100 (libc.so.6:__strncpy_ssse3) redirected to 0x4c32fb0
(strncpy)
The src strings are not NULL terminated at the correct positions.
 4 years ago
Soner Tari be80523036 Use the new inline max() function instead of MAX() macro function in sslproxy 
Do not pass pxy_thr_print_children() or bufferevent_getfd() to MAX() or
util_max() macro functions as params, or else they are called twice.
Since MAX() macro call duplicates params, do not call it nested either,
or else we get very long macro expansions.
 4 years ago
Soner Tari e63d6dd3aa Remove BEV_OPT_THREADSAFE in lp too 
thrmgr and conn handling threads in lp are cleanly decoupled now.
 4 years ago
Soner Tari 8a96565d99 Zero out msg buf as in sslsplit 
ce5f409dbe
("Zero all bytes when passing file descriptors over AF_UNIX sockets",
2018-11-12)

Also, bufferevent_getfd() returns -1 if no file descriptor is associated
with the bufferevent.
 4 years ago
Soner Tari 128838c70f Fix -g flag for lp, use Mk/buildinfo.mk of sslproxy 
This is necessary to detect the .git folder at the project root. So
remove Mk/buildinfo.mk of lp.
 4 years ago
Soner Tari 3e706ea022 Fix leaks and errors reported by valgrind 
Free vars.
Finalize sqlite3 statements.
Close sqlite3 db.
Init memory.
Do not close fd -1.

Some of these may be harmless, but we fix them anyway. Now valgrind
reports 0 "lost" memory, but some "still reachable", both for sslproxy
and lp.
 4 years ago
Soner Tari 1d75bfb17f Fix a possible sync issue between thr load and conn children list on error 
Refactor and rename functions, struct fields, and vars
Simplify if conditions and fix/improve logs
Clean up
 4 years ago
Soner Tari 14cfd3286b Update ctime and first atime on conn handling thr, not on thrmgr 
This offloads the thrmgr by saving a time() call.
Also remove an unnecessary NULL assignment.
 4 years ago
Soner Tari 71dff82305 Terminate conn on socket connect error 
And rename a function.
 4 years ago
Soner Tari 18c882ad37 Refactor and rename assign/attach conn to thr functions 
And fix comments.
 4 years ago
Soner Tari f069637fda Include errno.h in pxyconn.c too to fix travis issue 4 years ago
Soner Tari 61edeeedb1 Include errno.h, revert log.h to fix travis issue 4 years ago
Soner Tari 906d961168 Fix travis issue due to errno 
errno and EMFILE are provided by <unistd.h>, but we need log.h anyway,
which includes logger.h, and which includes <unistd.h> in turn.
 4 years ago
Soner Tari 6c5165fa6e Update lp with sslproxy changes and clean up 4 years ago
Soner Tari 05654e3bee Avoid possible crashes caused by passing NULL pointers to str*() functions 5 years ago
Soner Tari a1f24e26d0 Clean up 5 years ago
Soner Tari fd3aa5a394 Update lp with sslproxy changes, fix dst events 
Enable dst r/w events before socket connect.
Improve verbose debug logs using common header fields to better identify
connections.
Create function macros for fine* debug logs.
 5 years ago
Soner Tari 554fd3bd3a Improve code reuse, reduce code, clean up whitespace 5 years ago
Soner Tari 2b702495b0 Remove comixwall.org 5 years ago
Soner Tari 64c0078ecb Update comments about writecb before connected 5 years ago
Soner Tari a0d74baa43 Update copyright year to 2020 5 years ago
Soner Tari c3c228d8ce Remove ssl_shutdown_retry_delay and SSLShutdownRetryDelay, not used anymore 5 years ago
Soner Tari 10573a1b7c Copy BSDmakefile to subfolders 
So we can individually make clean them
 5 years ago
Soner Tari 4503203c1b Remove MEDIUM ciphers 
Cipher assertions become useless if we set ciphers to MEDIUM:HIGH, too
many ciphers would be possible
 5 years ago
Soner Tari c2e93dbbc0 Remove NO_TLS10 test case 
The problem with LibreSSL 2.7.4 was not that it didn't support tls10,
but that MEDIUM and HIGH cipher definitions were different from the
openssl version of testproxy, hence tests were failing due to no shared
ciphers
 5 years ago
Soner Tari f1c2e9e881 Detect tls protos using output of sslproxy -V 
But this is not going to work, because LibreSSL 2.7.4 says it supports
tls10, but SSL handshake fails if testproxy e2e tests for tls10 are
enabled.
 5 years ago
Soner Tari 73724bd673 Fix assertions for tls10 tests, TLSv1.0 == SSLv3 5 years ago