/*- * SSLsplit - transparent SSL/TLS interception * https://www.roe.ch/SSLsplit * * Copyright (c) 2009-2018, Daniel Roethlisberger . * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are met: * 1. Redistributions of source code must retain the above copyright notice, * this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright notice, * this list of conditions and the following disclaimer in the documentation * and/or other materials provided with the distribution. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER AND CONTRIBUTORS ``AS IS'' * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE * POSSIBILITY OF SUCH DAMAGE. */ #ifndef PXYCONN_H #define PXYCONN_H #include "proxy.h" #include "opts.h" #include "attrib.h" #include "pxythrmgr.h" #include "log.h" #include #include #include #include #include /* * Print helper for logging code. */ #define STRORDASH(x) (((x)&&*(x))?(x):"-") #define STRORNONE(x) (((x)&&*(x))?(x):"") #define WANT_CONNECT_LOG(ctx) ((ctx)->opts->connectlog||!(ctx)->opts->detach) #define WANT_CONTENT_LOG(ctx) ((ctx)->opts->contentlog&&!(ctx)->passthrough) #define SSLPROXY_KEY "SSLproxy:" #define SSLPROXY_KEY_LEN strlen(SSLPROXY_KEY) typedef void (*fd_readcb_func_t)(evutil_socket_t, short, void *); typedef void (*conn_connect_func_t)(pxy_conn_ctx_t *); typedef void (*bufferevent_setcb_func_t)(pxy_conn_ctx_t *); typedef void (*proto_free_func_t)(pxy_conn_ctx_t *); typedef struct pxy_conn_child_ctx pxy_conn_child_ctx_t; /* single socket bufferevent descriptor */ typedef struct pxy_conn_desc { struct bufferevent *bev; SSL *ssl; unsigned int closed : 1; } pxy_conn_desc_t; enum protocol { PROTO_ERROR = -1, PROTO_PASSTHROUGH = 0, PROTO_HTTP, PROTO_HTTPS, PROTO_POP3, PROTO_POP3S, PROTO_SMTP, PROTO_SMTPS, PROTO_AUTOSSL, PROTO_TCP, PROTO_SSL, }; typedef struct proto_ctx proto_ctx_t; struct proto_ctx { enum protocol proto; conn_connect_func_t conn_connectcb; fd_readcb_func_t fd_readcb; bufferevent_setcb_func_t bev_setcb_src; bufferevent_setcb_func_t bev_setcb_dst; bufferevent_setcb_func_t bev_setcb_srv_dst; proto_free_func_t proto_free; // For protocol specific fields, if any void *arg; }; /* parent connection state consisting of three connection descriptors, * connection-wide state and the specs and options */ struct pxy_conn_ctx { // Common properties // @attention The order of these common vars should match with their order in children pxy_conn_ctx_t *conn; /* parent's conn ctx is itself */ enum protocol proto; /* per-connection state */ struct pxy_conn_desc src; struct pxy_conn_desc dst; /* status flags */ unsigned int connected : 1; /* 0 until both ends are connected */ unsigned int enomem : 1; /* 1 if out of memory */ /* log strings from socket */ char *srchost_str; char *srcport_str; char *dsthost_str; char *dstport_str; /* log strings related to SSL */ char *ssl_names; char *origcrtfpr; char *usedcrtfpr; /* store fd and fd event while connected is 0 */ evutil_socket_t fd; proto_ctx_t *proto_ctx; // End of common properties /* content log context */ log_content_ctx_t *logctx; unsigned int srv_dst_connected : 1; /* 0 until server is connected */ unsigned int dst_connected : 1; /* 0 until dst is connected */ /* ssl */ unsigned int sni_peek_retries : 6; /* max 64 SNI parse retries */ unsigned int immutable_cert : 1; /* 1 if the cert cannot be changed */ unsigned int generated_cert : 1; /* 1 if we generated a new cert */ unsigned int passthrough : 1; /* 1 if SSL passthrough is active */ /* autossl */ unsigned int clienthello_search : 1; /* 1 if waiting for hello */ unsigned int clienthello_found : 1; /* 1 if conn upgrade to SSL */ struct pxy_conn_desc srv_dst; char *srv_dst_ssl_version; char *srv_dst_ssl_cipher; struct event *ev; /* original destination address, family and certificate */ struct sockaddr_storage addr; socklen_t addrlen; int af; X509 *origcrt; // Thread that the conn is attached to pxy_thr_ctx_t *thr; // Unique id of the conn long long unsigned int id; pxy_thrmgr_ctx_t *thrmgr; proxyspec_t *spec; opts_t *opts; struct event_base *evbase; struct evdns_base *dnsbase; evutil_socket_t dst_fd; evutil_socket_t srv_dst_fd; // Priv sep socket to obtain a socket for children evutil_socket_t clisock; // Fd of the listener event for the children evutil_socket_t child_fd; struct evconnlistener *child_evcl; // SSL proxy specific info: The IP:port address the children are listening on, orig client addr, and orig target addr char *header_str; size_t header_len; int sent_header; // Child list of the conn pxy_conn_child_ctx_t *children; // Number of children, active or closed unsigned int child_count; evutil_socket_t child_src_fd; evutil_socket_t child_dst_fd; /* server name indicated by client in SNI TLS extension */ char *sni; // Conn create time time_t ctime; // Conn last access time, to determine expired conns // Updated on entry to callback functions, parent or child time_t atime; // Per-thread conn list pxy_conn_ctx_t *next; // Expired conns are link-listed using this pointer pxy_conn_ctx_t *next_expired; #ifdef HAVE_LOCAL_PROCINFO /* local process information */ pxy_conn_lproc_desc_t lproc; #endif /* HAVE_LOCAL_PROCINFO */ }; /* child connection state consisting of two connection descriptors, * connection-wide state */ struct pxy_conn_child_ctx { // Common properties // @attention The order of these common vars should match with their order in parent pxy_conn_ctx_t *conn; /* parent context */ enum protocol proto; /* per-connection state */ struct pxy_conn_desc src; struct pxy_conn_desc dst; /* status flags */ unsigned int connected : 1; /* 0 until both ends are connected */ unsigned int enomem : 1; /* 1 if out of memory */ /* log strings from socket */ char *srchost_str; char *srcport_str; char *dsthost_str; char *dstport_str; /* log strings related to SSL */ char *ssl_names; char *origcrtfpr; char *usedcrtfpr; /* store fd and fd event while connected is 0 */ evutil_socket_t fd; proto_ctx_t *proto_ctx; // End of common properties evutil_socket_t src_fd; evutil_socket_t dst_fd; // Child index unsigned int idx; // Children of the conn are link-listed using this pointer pxy_conn_child_ctx_t *next; }; void pxy_close_dst(pxy_conn_ctx_t *); void pxy_discard_inbuf(struct bufferevent *); int pxy_log_content_inbuf(pxy_conn_ctx_t *, struct evbuffer *, int); int pxy_log_content_buf(pxy_conn_ctx_t *, unsigned char *, size_t sz, int); void pxy_set_watermark(struct bufferevent *, pxy_conn_ctx_t *, struct bufferevent *); void pxy_bev_eventcb_connected_src(struct bufferevent *, pxy_conn_ctx_t *); void pxy_bev_eventcb_eof_src(struct bufferevent *, pxy_conn_ctx_t *); void pxy_bev_eventcb_error_src(struct bufferevent *, pxy_conn_ctx_t *); void pxy_bev_eventcb_connected_dst(struct bufferevent *, pxy_conn_ctx_t *); void pxy_bev_eventcb_eof_dst(struct bufferevent *, pxy_conn_ctx_t *); void pxy_bev_eventcb_error_dst(struct bufferevent *, pxy_conn_ctx_t *); void pxy_bev_eventcb_connected_srv_dst(struct bufferevent *, pxy_conn_ctx_t *); void pxy_bev_eventcb_eof_srv_dst(struct bufferevent *, pxy_conn_ctx_t *); void pxy_bev_eventcb_error_srv_dst(struct bufferevent *, pxy_conn_ctx_t *); void pxy_bev_writecb_src(struct bufferevent *, void *); void pxy_bev_writecb_dst(struct bufferevent *, void *); void pxy_bev_writecb_srv_dst(struct bufferevent *, void *); void pxy_conn_connect_tcp(pxy_conn_ctx_t *); void pxy_fd_readcb_tcp(evutil_socket_t, short, void *); void pxy_fd_readcb_ssl(evutil_socket_t, short, void *); void pxy_conn_setup(evutil_socket_t, struct sockaddr *, int, pxy_thrmgr_ctx_t *, proxyspec_t *, opts_t *, evutil_socket_t) NONNULL(2,4,5,6); void pxy_conn_free(pxy_conn_ctx_t *ctx, int) NONNULL(1); #endif /* !PXYCONN_H */ /* vim: set noet ft=c: */