5230455705

Committed 10 Jun 2023 02:30PM UTC coverage: 91.715% (-0.03%) from 91.746%

Build # 5230455705

Build Type

push

github

Committed by

randombit

Commit Message

Merge GH #3584 Change clang-format AllowShortFunctionsOnASingleLine config from All to Inline

Run Details

77182 of 84154 relevant lines covered (91.72%)

11975295.43 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

84.16

/src/cli/tls_proxy.cpp

/*
* TLS Server Proxy
* (C) 2014,2015,2019 Jack Lloyd
* (C) 2016 Matthias Gierlings
* (C) 2023 René Meusel, Rohde & Schwarz Cybersecurity
*
* Botan is released under the Simplified BSD License (see license.txt)
*/

#include "cli.h"

#if defined(BOTAN_HAS_TLS) && defined(BOTAN_HAS_BOOST_ASIO) && defined(BOTAN_TARGET_OS_HAS_FILESYSTEM)

   #include <atomic>
   #include <iostream>
   #include <string>
   #include <thread>
   #include <vector>

   #define _GLIBCXX_HAVE_GTHR_DEFAULT
   #include <botan/internal/os_utils.h>
   #include <boost/asio.hpp>
   #include <boost/bind.hpp>

   #include <botan/hex.h>
   #include <botan/pkcs8.h>
   #include <botan/rng.h>
   #include <botan/tls_server.h>
   #include <botan/tls_session_manager_memory.h>
   #include <botan/x509cert.h>

   #if defined(BOTAN_HAS_TLS_SQLITE3_SESSION_MANAGER)
      #include <botan/tls_session_manager_sqlite.h>
   #endif

   #include "tls_helpers.h"

   #if BOOST_VERSION >= 107000
      #define GET_IO_SERVICE(s) (static_cast<boost::asio::io_context&>((s).get_executor().context()))
   #else
      #define GET_IO_SERVICE(s) ((s).get_io_service())
   #endif

namespace Botan_CLI {

namespace {

using boost::asio::ip::tcp;

void log_exception(const char* where, const std::exception& e) {
   std::cout << where << ' ' << e.what() << std::endl;
}

void log_error(const char* where, const boost::system::error_code& error) {
   std::cout << where << ' ' << error.message() << std::endl;
}

void log_error(const char* msg) {
   std::cout << msg << std::endl;
}

void log_binary_message(const char* where, const uint8_t buf[], size_t buf_len) {
   BOTAN_UNUSED(where, buf, buf_len);
   //std::cout << where << ' ' << Botan::hex_encode(buf, buf_len) << std::endl;
}

void log_text_message(const char* where, const uint8_t buf[], size_t buf_len) {
   BOTAN_UNUSED(where, buf, buf_len);
   //const char* c = reinterpret_cast<const char*>(buf);
   //std::cout << where << ' ' << std::string(c, c + buf_len)  << std::endl;
}

class ServerStatus {
   public:
      ServerStatus(size_t max_clients) : m_max_clients(max_clients), m_clients_serviced(0) {}

      bool should_exit() const {
         if(m_max_clients == 0)
            return false;

         return clients_serviced() >= m_max_clients;
      }

      void client_serviced() { m_clients_serviced++; }

      size_t clients_serviced() const { return m_clients_serviced.load(); }

   private:
      size_t m_max_clients;
      std::atomic<size_t> m_clients_serviced;
};

class tls_proxy_session final : public std::enable_shared_from_this<tls_proxy_session>,
                                public Botan::TLS::Callbacks {
   public:
      enum { readbuf_size = 17 * 1024 };

      typedef std::shared_ptr<tls_proxy_session> pointer;

      static pointer create(boost::asio::io_service& io,
                            std::shared_ptr<Botan::TLS::Session_Manager> session_manager,
                            std::shared_ptr<Botan::Credentials_Manager> credentials,
                            std::shared_ptr<Botan::TLS::Policy> policy,
                            tcp::resolver::iterator endpoints) {
         auto session = std::make_shared<tls_proxy_session>(io, endpoints);

         // Defer the setup of the TLS server to make use of
         // shared_from_this() which wouldn't work in the c'tor.
         session->setup(session_manager, credentials, policy);

         return session;
      }

      tcp::socket& client_socket() { return m_client_socket; }

      void start() {
         m_c2p.resize(readbuf_size);
         client_read(boost::system::error_code(), 0);  // start read loop
      }

      void stop() {
         if(m_is_closed == false) {
            /*
            Don't need to talk to the server anymore
            Client socket is closed during write callback
            */
            m_server_socket.close();
            m_tls->close();

            // Need to explicitly destroy the TLS::Server object to break the
            // circular ownership of shared_from_this() and the shared_ptr of
            // this kept inside the TLS::Channel.
            m_tls.reset();
            m_is_closed = true;
         }
      }

      tls_proxy_session(boost::asio::io_service& io, tcp::resolver::iterator endpoints) :
            m_strand(io),
            m_server_endpoints(endpoints),
            m_client_socket(io),
            m_server_socket(io),
            m_rng(cli_make_rng()) {}

   private:
      void setup(std::shared_ptr<Botan::TLS::Session_Manager> session_manager,
                 std::shared_ptr<Botan::Credentials_Manager> credentials,
                 std::shared_ptr<Botan::TLS::Policy> policy) {
         m_tls = std::make_unique<Botan::TLS::Server>(shared_from_this(), session_manager, credentials, policy, m_rng);
      }

      void client_read(const boost::system::error_code& error, size_t bytes_transferred) {
         if(error) {
            log_error("Read failed", error);
            stop();
            return;
         }

         if(m_is_closed) {
            log_error("Received client data after close");
            return;
         }

         try {
            if(!m_tls->is_active()) {
               log_binary_message("From client", &m_c2p[0], bytes_transferred);
            }
            m_tls->received_data(&m_c2p[0], bytes_transferred);
         } catch(Botan::Exception& e) {
            log_exception("TLS connection failed", e);
            stop();
            return;
         }

         m_client_socket.async_read_some(boost::asio::buffer(&m_c2p[0], m_c2p.size()),
                                         m_strand.wrap(boost::bind(&tls_proxy_session::client_read,
                                                                   shared_from_this(),
                                                                   boost::asio::placeholders::error,
                                                                   boost::asio::placeholders::bytes_transferred)));
      }

      void handle_client_write_completion(const boost::system::error_code& error) {
         if(error) {
            log_error("Client write", error);
            stop();
            return;
         }

         m_p2c.clear();

         if(m_p2c_pending.empty() && (!m_tls || m_tls->is_closed())) {
            m_client_socket.close();
         }
         tls_emit_data({});  // initiate another write if needed
      }

      void handle_server_write_completion(const boost::system::error_code& error) {
         if(error) {
            log_error("Server write", error);
            stop();
            return;
         }

         m_p2s.clear();
         proxy_write_to_server({});  // initiate another write if needed
      }

      void tls_record_received(uint64_t /*rec_no*/, std::span<const uint8_t> buf) override {
         // Immediately bounce message to server
         proxy_write_to_server(buf);
      }

      void tls_emit_data(std::span<const uint8_t> buf) override {
         if(!buf.empty()) {
            m_p2c_pending.insert(m_p2c_pending.end(), buf.begin(), buf.end());
         }

         // no write now active and we still have output pending
         if(m_p2c.empty() && !m_p2c_pending.empty()) {
            std::swap(m_p2c_pending, m_p2c);

            log_binary_message("To Client", &m_p2c[0], m_p2c.size());

            boost::asio::async_write(m_client_socket,
                                     boost::asio::buffer(&m_p2c[0], m_p2c.size()),
                                     m_strand.wrap(boost::bind(&tls_proxy_session::handle_client_write_completion,
                                                               shared_from_this(),
                                                               boost::asio::placeholders::error)));
         }
      }

      void proxy_write_to_server(std::span<const uint8_t> buf) {
         if(!buf.empty()) {
            m_p2s_pending.insert(m_p2s_pending.end(), buf.begin(), buf.end());
         }

         // no write now active and we still have output pending
         if(m_p2s.empty() && !m_p2s_pending.empty()) {
            std::swap(m_p2s_pending, m_p2s);

            log_text_message("To Server", &m_p2s[0], m_p2s.size());

            boost::asio::async_write(m_server_socket,
                                     boost::asio::buffer(&m_p2s[0], m_p2s.size()),
                                     m_strand.wrap(boost::bind(&tls_proxy_session::handle_server_write_completion,
                                                               shared_from_this(),
                                                               boost::asio::placeholders::error)));
         }
      }

      void server_read(const boost::system::error_code& error, size_t bytes_transferred) {
         if(error) {
            log_error("Server read failed", error);
            stop();
            return;
         }

         try {
            if(bytes_transferred) {
               log_text_message("Server to client", &m_s2p[0], m_s2p.size());
               log_binary_message("Server to client", &m_s2p[0], m_s2p.size());
               m_tls->send(&m_s2p[0], bytes_transferred);
            }
         } catch(Botan::Exception& e) {
            log_exception("TLS connection failed", e);
            stop();
            return;
         }

         m_s2p.resize(readbuf_size);

         m_server_socket.async_read_some(boost::asio::buffer(&m_s2p[0], m_s2p.size()),
                                         m_strand.wrap(boost::bind(&tls_proxy_session::server_read,
                                                                   shared_from_this(),
                                                                   boost::asio::placeholders::error,
                                                                   boost::asio::placeholders::bytes_transferred)));
      }

      void tls_session_activated() override {
         auto onConnect = [this](boost::system::error_code ec, tcp::resolver::iterator /*endpoint*/) {
            if(ec) {
               log_error("Server connection", ec);
               return;
            }
            server_read(boost::system::error_code(), 0);  // start read loop
            proxy_write_to_server({});
         };
         async_connect(m_server_socket, m_server_endpoints, onConnect);
      }

      void tls_session_established(const Botan::TLS::Session_Summary& session) override {
         m_hostname = session.server_info().hostname();
      }

      void tls_alert(Botan::TLS::Alert alert) override {
         if(alert.type() == Botan::TLS::Alert::CloseNotify) {
            m_tls->close();
            return;
         }
      }

      boost::asio::io_service::strand m_strand;

      tcp::resolver::iterator m_server_endpoints;

      tcp::socket m_client_socket;
      tcp::socket m_server_socket;

      std::shared_ptr<Botan::RandomNumberGenerator> m_rng;
      std::unique_ptr<Botan::TLS::Server> m_tls;
      std::string m_hostname;

      std::vector<uint8_t> m_c2p;
      std::vector<uint8_t> m_p2c;
      std::vector<uint8_t> m_p2c_pending;

      std::vector<uint8_t> m_s2p;
      std::vector<uint8_t> m_p2s;
      std::vector<uint8_t> m_p2s_pending;

      bool m_is_closed = false;
};

class tls_proxy_server final {
   public:
      typedef tls_proxy_session session;

      tls_proxy_server(boost::asio::io_service& io,
                       unsigned short port,
                       tcp::resolver::iterator endpoints,
                       std::shared_ptr<Botan::Credentials_Manager> creds,
                       std::shared_ptr<Botan::TLS::Policy> policy,
                       std::shared_ptr<Botan::TLS::Session_Manager> session_mgr,
                       size_t max_clients) :
            m_acceptor(io, tcp::endpoint(tcp::v4(), port)),
            m_server_endpoints(endpoints),
            m_creds(creds),
            m_policy(policy),
            m_session_manager(session_mgr),
            m_status(max_clients) {
         session::pointer new_session = make_session();

         m_acceptor.async_accept(
            new_session->client_socket(),
            boost::bind(&tls_proxy_server::handle_accept, this, new_session, boost::asio::placeholders::error));
      }

   private:
      session::pointer make_session() {
         return session::create(GET_IO_SERVICE(m_acceptor), m_session_manager, m_creds, m_policy, m_server_endpoints);
      }

      void serve_one_session() {
         session::pointer new_session = make_session();

         m_acceptor.async_accept(
            new_session->client_socket(),
            boost::bind(&tls_proxy_server::handle_accept, this, new_session, boost::asio::placeholders::error));
      }

      void handle_accept(session::pointer new_session, const boost::system::error_code& error) {
         if(!error) {
            new_session->start();
            m_status.client_serviced();

            if(!m_status.should_exit()) {
               serve_one_session();
            }
         }
      }

      tcp::acceptor m_acceptor;
      tcp::resolver::iterator m_server_endpoints;

      std::shared_ptr<Botan::Credentials_Manager> m_creds;
      std::shared_ptr<Botan::TLS::Policy> m_policy;
      std::shared_ptr<Botan::TLS::Session_Manager> m_session_manager;
      ServerStatus m_status;
};

}  // namespace

class TLS_Proxy final : public Command {
   public:
      TLS_Proxy() :
            Command(
               "tls_proxy listen_port target_host target_port server_cert server_key "
               "--policy=default --threads=0 --max-clients=0 --session-db= --session-db-pass=") {}

      std::string group() const override { return "tls"; }

      std::string description() const override { return "Proxies requests between a TLS client and a TLS server"; }

      size_t thread_count() const {
         if(size_t t = get_arg_sz("threads"))
            return t;
         if(size_t t = Botan::OS::get_cpu_available())
            return t;
         return 2;
      }

      void go() override {
         const uint16_t listen_port = get_arg_u16("listen_port");
         const std::string target = get_arg("target_host");
         const std::string target_port = get_arg("target_port");

         const std::string server_crt = get_arg("server_cert");
         const std::string server_key = get_arg("server_key");

         const size_t num_threads = thread_count();
         const size_t max_clients = get_arg_sz("max-clients");

         auto creds = std::make_shared<Basic_Credentials_Manager>(server_crt, server_key);

         auto policy = load_tls_policy(get_arg("policy"));

         boost::asio::io_service io;

         tcp::resolver resolver(io);
         auto server_endpoint_iterator = resolver.resolve({target, target_port});

         std::shared_ptr<Botan::TLS::Session_Manager> session_mgr;

   #if defined(BOTAN_HAS_TLS_SQLITE3_SESSION_MANAGER)
         const std::string sessions_passphrase = get_passphrase_arg("Session DB passphrase", "session-db-pass");
         const std::string sessions_db = get_arg("session-db");

         if(!sessions_db.empty()) {
            session_mgr.reset(
               new Botan::TLS::Session_Manager_SQLite(sessions_passphrase, rng_as_shared(), sessions_db));
         }
   #endif
         if(!session_mgr) {
            session_mgr.reset(new Botan::TLS::Session_Manager_In_Memory(rng_as_shared()));
         }

         tls_proxy_server server(io, listen_port, server_endpoint_iterator, creds, policy, session_mgr, max_clients);

         std::vector<std::shared_ptr<std::thread>> threads;

         // run forever... first thread is main calling io.run below
         for(size_t i = 2; i <= num_threads; ++i) {
            threads.push_back(std::make_shared<std::thread>([&io]() { io.run(); }));
         }

         io.run();

         for(size_t i = 0; i < threads.size(); ++i) {
            threads[i]->join();
         }
      }
};

BOTAN_REGISTER_COMMAND("tls_proxy", TLS_Proxy);

}  // namespace Botan_CLI

#endif

1	/*
2	* TLS Server Proxy
3	* (C) 2014,2015,2019 Jack Lloyd
4	* (C) 2016 Matthias Gierlings
5	* (C) 2023 René Meusel, Rohde & Schwarz Cybersecurity
6	*
7	* Botan is released under the Simplified BSD License (see license.txt)
8	*/
9
10	#include "cli.h"
11
12	#if defined(BOTAN_HAS_TLS) && defined(BOTAN_HAS_BOOST_ASIO) && defined(BOTAN_TARGET_OS_HAS_FILESYSTEM)
13
14	#include <atomic>
15	#include <iostream>
16	#include <string>
17	#include <thread>
18	#include <vector>
19
20	#define _GLIBCXX_HAVE_GTHR_DEFAULT
21	#include <botan/internal/os_utils.h>
22	#include <boost/asio.hpp>
23	#include <boost/bind.hpp>
24
25	#include <botan/hex.h>
26	#include <botan/pkcs8.h>
27	#include <botan/rng.h>
28	#include <botan/tls_server.h>
29	#include <botan/tls_session_manager_memory.h>
30	#include <botan/x509cert.h>
31
32	#if defined(BOTAN_HAS_TLS_SQLITE3_SESSION_MANAGER)
33	#include <botan/tls_session_manager_sqlite.h>
34	#endif
35
36	#include "tls_helpers.h"
37
38	#if BOOST_VERSION >= 107000
39	#define GET_IO_SERVICE(s) (static_cast<boost::asio::io_context&>((s).get_executor().context()))
40	#else
41	#define GET_IO_SERVICE(s) ((s).get_io_service())
42	#endif
43
44	namespace Botan_CLI {
45
46	namespace {
47
48	using boost::asio::ip::tcp;
49
50	void log_exception(const char* where, const std::exception& e) {	×
51	std::cout << where << ' ' << e.what() << std::endl;	×
52	}	×
53
54	void log_error(const char* where, const boost::system::error_code& error) {	8✔
55	std::cout << where << ' ' << error.message() << std::endl;	8✔
56	}	8✔
57
58	void log_error(const char* msg) {	×
59	std::cout << msg << std::endl;	×
60	}
61
62	void log_binary_message(const char* where, const uint8_t buf[], size_t buf_len) {
63	BOTAN_UNUSED(where, buf, buf_len);
64	//std::cout << where << ' ' << Botan::hex_encode(buf, buf_len) << std::endl;
65	}
66
67	void log_text_message(const char* where, const uint8_t buf[], size_t buf_len) {
68	BOTAN_UNUSED(where, buf, buf_len);
69	//const char* c = reinterpret_cast<const char*>(buf);
70	//std::cout << where << ' ' << std::string(c, c + buf_len) << std::endl;
71	}
72
73	class ServerStatus {
74	public:
75	ServerStatus(size_t max_clients) : m_max_clients(max_clients), m_clients_serviced(0) {}	1✔
76
77	bool should_exit() const {	4✔
78	if(m_max_clients == 0)	4✔
79	return false;
80
81	return clients_serviced() >= m_max_clients;	4✔
82	}
83
84	void client_serviced() { m_clients_serviced++; }	4✔
85
86	size_t clients_serviced() const { return m_clients_serviced.load(); }	4✔
87
88	private:
89	size_t m_max_clients;
90	std::atomic<size_t> m_clients_serviced;
91	};
92
93	class tls_proxy_session final : public std::enable_shared_from_this<tls_proxy_session>,
94	public Botan::TLS::Callbacks {
95	public:
96	enum { readbuf_size = 17 * 1024 };
97
98	typedef std::shared_ptr<tls_proxy_session> pointer;
99
100	static pointer create(boost::asio::io_service& io,	4✔
101	std::shared_ptr<Botan::TLS::Session_Manager> session_manager,
102	std::shared_ptr<Botan::Credentials_Manager> credentials,
103	std::shared_ptr<Botan::TLS::Policy> policy,
104	tcp::resolver::iterator endpoints) {
105	auto session = std::make_shared<tls_proxy_session>(io, endpoints);	4✔
106
107	// Defer the setup of the TLS server to make use of
108	// shared_from_this() which wouldn't work in the c'tor.
109	session->setup(session_manager, credentials, policy);	12✔
110
111	return session;	4✔
112	}	×
113
114	tcp::socket& client_socket() { return m_client_socket; }	1✔
115
116	void start() {	4✔
117	m_c2p.resize(readbuf_size);	4✔
118	client_read(boost::system::error_code(), 0); // start read loop	4✔
119	}	4✔
120
121	void stop() {	8✔
122	if(m_is_closed == false) {	8✔
123	/*
124	Don't need to talk to the server anymore
125	Client socket is closed during write callback
126	*/
127	m_server_socket.close();	4✔
128	m_tls->close();	4✔
129
130	// Need to explicitly destroy the TLS::Server object to break the
131	// circular ownership of shared_from_this() and the shared_ptr of
132	// this kept inside the TLS::Channel.
133	m_tls.reset();	4✔
134	m_is_closed = true;	4✔
135	}
136	}	8✔
137
138	tls_proxy_session(boost::asio::io_service& io, tcp::resolver::iterator endpoints) :	4✔
139	m_strand(io),	4✔
140	m_server_endpoints(endpoints),	4✔
141	m_client_socket(io),	4✔
142	m_server_socket(io),	8✔
143	m_rng(cli_make_rng()) {}	12✔
144
145	private:
146	void setup(std::shared_ptr<Botan::TLS::Session_Manager> session_manager,	4✔
147	std::shared_ptr<Botan::Credentials_Manager> credentials,
148	std::shared_ptr<Botan::TLS::Policy> policy) {
149	m_tls = std::make_unique<Botan::TLS::Server>(shared_from_this(), session_manager, credentials, policy, m_rng);	4✔
150	}	4✔
151
152	void client_read(const boost::system::error_code& error, size_t bytes_transferred) {	20✔
153	if(error) {	20✔
154	log_error("Read failed", error);	4✔
155	stop();	4✔
156	return;	4✔
157	}
158
159	if(m_is_closed) {	16✔
160	log_error("Received client data after close");	×
161	return;	×
162	}
163
164	try {	16✔
165	if(!m_tls->is_active()) {	16✔
166	log_binary_message("From client", &m_c2p[0], bytes_transferred);
167	}
168	m_tls->received_data(&m_c2p[0], bytes_transferred);	16✔
169	} catch(Botan::Exception& e) {	×
170	log_exception("TLS connection failed", e);	×
171	stop();	×
172	return;	×
173	}	×
174
175	m_client_socket.async_read_some(boost::asio::buffer(&m_c2p[0], m_c2p.size()),	32✔
176	m_strand.wrap(boost::bind(&tls_proxy_session::client_read,	32✔
177	shared_from_this(),	32✔
178	boost::asio::placeholders::error,
179	boost::asio::placeholders::bytes_transferred)));
180	}
181
182	void handle_client_write_completion(const boost::system::error_code& error) {	20✔
183	if(error) {	20✔
184	log_error("Client write", error);	×
185	stop();	×
186	return;	×
187	}
188
189	m_p2c.clear();	20✔
190
191	if(m_p2c_pending.empty() && (!m_tls \|\| m_tls->is_closed())) {	20✔
192	m_client_socket.close();	4✔
193	}
194	tls_emit_data({}); // initiate another write if needed	20✔
195	}
196
197	void handle_server_write_completion(const boost::system::error_code& error) {	4✔
198	if(error) {	4✔
199	log_error("Server write", error);	×
200	stop();	×
201	return;	×
202	}
203
204	m_p2s.clear();	4✔
205	proxy_write_to_server({}); // initiate another write if needed	4✔
206	}
207
208	void tls_record_received(uint64_t /rec_no/, std::span<const uint8_t> buf) override {	4✔
209	// Immediately bounce message to server
210	proxy_write_to_server(buf);	4✔
211	}	4✔
212
213	void tls_emit_data(std::span<const uint8_t> buf) override {	46✔
214	if(!buf.empty()) {	46✔
215	m_p2c_pending.insert(m_p2c_pending.end(), buf.begin(), buf.end());	26✔
216	}
217
218	// no write now active and we still have output pending
219	if(m_p2c.empty() && !m_p2c_pending.empty()) {	46✔
220	std::swap(m_p2c_pending, m_p2c);	20✔
221
222	log_binary_message("To Client", &m_p2c[0], m_p2c.size());	20✔
223
224	boost::asio::async_write(m_client_socket,	20✔
225	boost::asio::buffer(&m_p2c[0], m_p2c.size()),	20✔
226	m_strand.wrap(boost::bind(&tls_proxy_session::handle_client_write_completion,	40✔
227	shared_from_this(),	40✔
228	boost::asio::placeholders::error)));
229	}
230	}	46✔
231
232	void proxy_write_to_server(std::span<const uint8_t> buf) {	12✔
233	if(!buf.empty()) {	12✔
234	m_p2s_pending.insert(m_p2s_pending.end(), buf.begin(), buf.end());	4✔
235	}
236
237	// no write now active and we still have output pending
238	if(m_p2s.empty() && !m_p2s_pending.empty()) {	12✔
239	std::swap(m_p2s_pending, m_p2s);	4✔
240
241	log_text_message("To Server", &m_p2s[0], m_p2s.size());	4✔
242
243	boost::asio::async_write(m_server_socket,	4✔
244	boost::asio::buffer(&m_p2s[0], m_p2s.size()),	4✔
245	m_strand.wrap(boost::bind(&tls_proxy_session::handle_server_write_completion,	8✔
246	shared_from_this(),	8✔
247	boost::asio::placeholders::error)));
248	}
249	}	12✔
250
251	void server_read(const boost::system::error_code& error, size_t bytes_transferred) {	12✔
252	if(error) {	12✔
253	log_error("Server read failed", error);	4✔
254	stop();	4✔
255	return;	4✔
256	}
257
258	try {	8✔
259	if(bytes_transferred) {	8✔
260	log_text_message("Server to client", &m_s2p[0], m_s2p.size());	4✔
261	log_binary_message("Server to client", &m_s2p[0], m_s2p.size());	4✔
262	m_tls->send(&m_s2p[0], bytes_transferred);	4✔
263	}
264	} catch(Botan::Exception& e) {	×
265	log_exception("TLS connection failed", e);	×
266	stop();	×
267	return;	×
268	}	×
269
270	m_s2p.resize(readbuf_size);	8✔
271
272	m_server_socket.async_read_some(boost::asio::buffer(&m_s2p[0], m_s2p.size()),	16✔
273	m_strand.wrap(boost::bind(&tls_proxy_session::server_read,	16✔
274	shared_from_this(),	16✔
275	boost::asio::placeholders::error,
276	boost::asio::placeholders::bytes_transferred)));
277	}
278
279	void tls_session_activated() override {	4✔
280	auto onConnect = [this](boost::system::error_code ec, tcp::resolver::iterator /endpoint/) {	16✔
281	if(ec) {	4✔
282	log_error("Server connection", ec);	×
283	return;	×
284	}
285	server_read(boost::system::error_code(), 0); // start read loop	4✔
286	proxy_write_to_server({});	4✔
287	};	4✔
288	async_connect(m_server_socket, m_server_endpoints, onConnect);	4✔
289	}	4✔
290
291	void tls_session_established(const Botan::TLS::Session_Summary& session) override {	4✔
292	m_hostname = session.server_info().hostname();	4✔
293	}	4✔
294
295	void tls_alert(Botan::TLS::Alert alert) override {	×
296	if(alert.type() == Botan::TLS::Alert::CloseNotify) {	×
297	m_tls->close();	×
298	return;	×
299	}
300	}
301
302	boost::asio::io_service::strand m_strand;
303
304	tcp::resolver::iterator m_server_endpoints;
305
306	tcp::socket m_client_socket;
307	tcp::socket m_server_socket;
308
309	std::shared_ptr<Botan::RandomNumberGenerator> m_rng;
310	std::unique_ptr<Botan::TLS::Server> m_tls;
311	std::string m_hostname;
312
313	std::vector<uint8_t> m_c2p;
314	std::vector<uint8_t> m_p2c;
315	std::vector<uint8_t> m_p2c_pending;
316
317	std::vector<uint8_t> m_s2p;
318	std::vector<uint8_t> m_p2s;
319	std::vector<uint8_t> m_p2s_pending;
320
321	bool m_is_closed = false;
322	};
323
324	class tls_proxy_server final {
325	public:
326	typedef tls_proxy_session session;
327
328	tls_proxy_server(boost::asio::io_service& io,	1✔
329	unsigned short port,
330	tcp::resolver::iterator endpoints,
331	std::shared_ptr<Botan::Credentials_Manager> creds,
332	std::shared_ptr<Botan::TLS::Policy> policy,
333	std::shared_ptr<Botan::TLS::Session_Manager> session_mgr,
334	size_t max_clients) :	1✔
335	m_acceptor(io, tcp::endpoint(tcp::v4(), port)),	1✔
336	m_server_endpoints(endpoints),	1✔
337	m_creds(creds),	1✔
338	m_policy(policy),	1✔
339	m_session_manager(session_mgr),	1✔
340	m_status(max_clients) {	1✔
341	session::pointer new_session = make_session();	1✔
342
343	m_acceptor.async_accept(	2✔
344	new_session->client_socket(),	1✔
345	boost::bind(&tls_proxy_server::handle_accept, this, new_session, boost::asio::placeholders::error));	3✔
346	}	1✔
347
348	private:
349	session::pointer make_session() {	4✔
350	return session::create(GET_IO_SERVICE(m_acceptor), m_session_manager, m_creds, m_policy, m_server_endpoints);	28✔
351	}
352
353	void serve_one_session() {	3✔
354	session::pointer new_session = make_session();	3✔
355
356	m_acceptor.async_accept(	6✔
357	new_session->client_socket(),	3✔
358	boost::bind(&tls_proxy_server::handle_accept, this, new_session, boost::asio::placeholders::error));	9✔
359	}	3✔
360
361	void handle_accept(session::pointer new_session, const boost::system::error_code& error) {	4✔
362	if(!error) {	4✔
363	new_session->start();	4✔
364	m_status.client_serviced();	4✔
365
366	if(!m_status.should_exit()) {	4✔
367	serve_one_session();	3✔
368	}
369	}
370	}	4✔
371
372	tcp::acceptor m_acceptor;
373	tcp::resolver::iterator m_server_endpoints;
374
375	std::shared_ptr<Botan::Credentials_Manager> m_creds;
376	std::shared_ptr<Botan::TLS::Policy> m_policy;
377	std::shared_ptr<Botan::TLS::Session_Manager> m_session_manager;
378	ServerStatus m_status;
379	};
380
381	} // namespace
382
383	class TLS_Proxy final : public Command {
384	public:
385	TLS_Proxy() :	2✔
386	Command(
387	"tls_proxy listen_port target_host target_port server_cert server_key "
388	"--policy=default --threads=0 --max-clients=0 --session-db= --session-db-pass=") {}	4✔
389
390	std::string group() const override { return "tls"; }	1✔
391
392	std::string description() const override { return "Proxies requests between a TLS client and a TLS server"; }	1✔
393
394	size_t thread_count() const {	1✔
395	if(size_t t = get_arg_sz("threads"))	1✔
396	return t;
397	if(size_t t = Botan::OS::get_cpu_available())	1✔
398	return t;	1✔
399	return 2;
400	}
401
402	void go() override {	1✔
403	const uint16_t listen_port = get_arg_u16("listen_port");	1✔
404	const std::string target = get_arg("target_host");	1✔
405	const std::string target_port = get_arg("target_port");	1✔
406
407	const std::string server_crt = get_arg("server_cert");	1✔
408	const std::string server_key = get_arg("server_key");	1✔
409
410	const size_t num_threads = thread_count();	1✔
411	const size_t max_clients = get_arg_sz("max-clients");	1✔
412
413	auto creds = std::make_shared<Basic_Credentials_Manager>(server_crt, server_key);	1✔
414
415	auto policy = load_tls_policy(get_arg("policy"));	2✔
416
417	boost::asio::io_service io;	1✔
418
419	tcp::resolver resolver(io);	1✔
420	auto server_endpoint_iterator = resolver.resolve({target, target_port});	1✔
421
422	std::shared_ptr<Botan::TLS::Session_Manager> session_mgr;	1✔
423
424	#if defined(BOTAN_HAS_TLS_SQLITE3_SESSION_MANAGER)
425	const std::string sessions_passphrase = get_passphrase_arg("Session DB passphrase", "session-db-pass");	2✔
426	const std::string sessions_db = get_arg("session-db");	1✔
427
428	if(!sessions_db.empty()) {	1✔
429	session_mgr.reset(	×
430	new Botan::TLS::Session_Manager_SQLite(sessions_passphrase, rng_as_shared(), sessions_db));	×
431	}
432	#endif
433	if(!session_mgr) {	1✔
434	session_mgr.reset(new Botan::TLS::Session_Manager_In_Memory(rng_as_shared()));	2✔
435	}
436
437	tls_proxy_server server(io, listen_port, server_endpoint_iterator, creds, policy, session_mgr, max_clients);	4✔
438
439	std::vector<std::shared_ptr<std::thread>> threads;	1✔
440
441	// run forever... first thread is main calling io.run below
442	for(size_t i = 2; i <= num_threads; ++i) {	2✔
443	threads.push_back(std::make_shared<std::thread>([&io]() { io.run(); }));	2✔
444	}
445
446	io.run();	1✔
447
448	for(size_t i = 0; i < threads.size(); ++i) {	2✔
449	threads[i]->join();	1✔
450	}
451	}	7✔
452	};
453
454	BOTAN_REGISTER_COMMAND("tls_proxy", TLS_Proxy);	2✔
455
456	} // namespace Botan_CLI
457
458	#endif

randombit / botan / 5230455705

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous