mirror of
https://github.com/proxytunnel/proxytunnel.git
synced 2026-07-17 16:34:53 +00:00
16d400b636
At least with Cygwin, and consequently with Msys, a macro 'initsetproctitle' exists leading to builds failing without this change if SETPROCTITLE is defined. This measure simplifies source code and Makefile allowing setproctitle functionality also for Cygwin and Msys builds, although it's of limited use there.
517 lines
13 KiB
C
517 lines
13 KiB
C
/* Proxytunnel - (C) 2001-2020 Jos Visser / Mark Janssen */
|
|
/* Contact: josv@osp.nl / maniac@maniac.nl */
|
|
|
|
/*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation; either version 2 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this program; if not, write to the Free Software
|
|
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
|
*/
|
|
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <ctype.h>
|
|
#include <errno.h>
|
|
#include <unistd.h>
|
|
#include <string.h>
|
|
#include <sys/types.h>
|
|
#include <netinet/tcp.h>
|
|
#include <netinet/in.h>
|
|
#include <sys/socket.h>
|
|
#include <netinet/in.h>
|
|
#include <arpa/inet.h>
|
|
#include <net/if.h>
|
|
#include <netdb.h>
|
|
#include <signal.h>
|
|
#include <syslog.h>
|
|
#include <stdarg.h>
|
|
|
|
#include "proxytunnel.h"
|
|
#include "io.h"
|
|
#include "config.h"
|
|
#include "cmdline.h"
|
|
#include "basicauth.h"
|
|
#include "ntlm.h"
|
|
|
|
/* Define DARWIN if compiling on MacOS-X (Darwin), to work around some
|
|
* inconsistencies. (Darwin doesn't know socklen_t) */
|
|
#ifdef DARWIN
|
|
#define socklen_t int
|
|
#endif /* DARWIN */
|
|
|
|
/* Globals */
|
|
int read_fd=0; /* The file descriptor to read from */
|
|
int write_fd=1; /* The file destriptor to write to */
|
|
|
|
/*
|
|
* Kill the program (signal handler)
|
|
*/
|
|
void signal_handler( int signal ) {
|
|
if( args_info.verbose_flag )
|
|
message( "Tunnel received signal %d. Ignoring signal.\n", signal );
|
|
// closeall();
|
|
}
|
|
|
|
/*
|
|
* Create and connect the socket that connects to the proxy. Returns
|
|
* the socket that is connected to the proxy
|
|
*/
|
|
int tunnel_connect() {
|
|
struct addrinfo hints = {
|
|
.ai_family = AF_UNSPEC,
|
|
.ai_socktype = SOCK_STREAM,
|
|
.ai_flags = AI_ADDRCONFIG | AI_NUMERICSERV,
|
|
.ai_protocol = 0
|
|
};
|
|
struct addrinfo * result, * rp;
|
|
int rc;
|
|
char service[6];
|
|
int sd;
|
|
|
|
if ( args_info.enforceipv4_flag )
|
|
hints.ai_family = AF_INET;
|
|
else if ( args_info.enforceipv6_flag )
|
|
hints.ai_family = AF_INET6;
|
|
rc = snprintf( service, sizeof(service), "%d", args_info.proxyport_arg );
|
|
if( ( rc < 0 ) || ( rc >= sizeof(service) ) ) {
|
|
/* this should never happen */
|
|
message( "snprintf() failed" );
|
|
exit(1);
|
|
}
|
|
rc = getaddrinfo( args_info.proxyhost_arg, service, &hints, &result );
|
|
if( rc != 0 ) {
|
|
message( "getaddrinfo() failed to resolve local proxy \"%s:%s\": %s\n",
|
|
args_info.proxyhost_arg,
|
|
service,
|
|
gai_strerror( rc ) );
|
|
exit(1);
|
|
}
|
|
for (rp = result; rp != NULL; rp = rp->ai_next) {
|
|
sd = socket( rp->ai_family, rp->ai_socktype, rp->ai_protocol );
|
|
if( sd < 0 ) {
|
|
continue;
|
|
}
|
|
if( connect( sd, rp->ai_addr, rp->ai_addrlen ) == 0 ) {
|
|
break;
|
|
}
|
|
close(sd);
|
|
}
|
|
if( rp == NULL ) {
|
|
my_perror( "failed to connect to local proxy" );
|
|
exit(1);
|
|
}
|
|
freeaddrinfo(result);
|
|
|
|
/* Increase interactivity of tunnel, patch by Ingo Molnar */
|
|
int flag = 1;
|
|
setsockopt( sd, IPPROTO_TCP, TCP_NODELAY, (char *)&flag, sizeof(int));
|
|
|
|
/* Make sure we get warned when someone hangs up on us */
|
|
signal(SIGHUP,signal_handler);
|
|
|
|
if( ! args_info.quiet_flag ) {
|
|
if ( ! args_info.verbose_flag ) {
|
|
if ( args_info.remproxy_given ) {
|
|
message( "Via %s -> %s -> %s\n",
|
|
args_info.proxy_arg,
|
|
args_info.remproxy_arg,
|
|
args_info.dest_arg );
|
|
} else {
|
|
message( "Via %s -> %s\n",
|
|
args_info.proxy_arg,
|
|
args_info.dest_arg );
|
|
}
|
|
} else {
|
|
message( "Connected to %s (local proxy)\n", args_info.proxy_arg );
|
|
}
|
|
}
|
|
|
|
/* Return the socket */
|
|
return sd;
|
|
}
|
|
|
|
|
|
/* Leave a goodbye message */
|
|
void closeall() {
|
|
#ifndef CYGWIN
|
|
closelog();
|
|
#endif /* CYGWIN */
|
|
|
|
/* Close all streams */
|
|
if (stunnel) {
|
|
stream_close(stunnel);
|
|
stunnel = NULL;
|
|
}
|
|
|
|
if (std) {
|
|
stream_close(std);
|
|
std = NULL;
|
|
}
|
|
if( args_info.verbose_flag ) {
|
|
message( "Tunnel closed.\n" );
|
|
}
|
|
}
|
|
|
|
/* Get the filled in sockaddr structure to the standalone daemon */
|
|
void get_sa_serv(struct sockaddr **sa_serv_pp, socklen_t *sa_serv_len_p)
|
|
{
|
|
static union {
|
|
struct sockaddr_in v4;
|
|
struct sockaddr_in6 v6;
|
|
} sa_serv;
|
|
int set_addr_result = 1;
|
|
|
|
memset( &sa_serv, '\0', sizeof( sa_serv ) );
|
|
|
|
/* In case a standalone address has been specified ... */
|
|
if ( args_info.standalone_addr_given ) {
|
|
/* ... and it looks like a IPv6 address ... */
|
|
if ( strchr( args_info.standalone_addr, ':' ) ){
|
|
/* ... set IPv6 address family and port, ... */
|
|
sa_serv.v6.sin6_family = AF_INET6;
|
|
sa_serv.v6.sin6_port = htons( args_info.standalone_port );
|
|
/* ... in case a standalone interface has been specified ... */
|
|
if ( args_info.standalone_iface_given ) {
|
|
/* ... try to get and set the interface's index */
|
|
if ( !(sa_serv.v6.sin6_scope_id = if_nametoindex(args_info.standalone_iface)) ) {
|
|
set_addr_result = -2;
|
|
}
|
|
}
|
|
/* If no error happened regarding the interface ... */
|
|
if ( set_addr_result != -2 ) {
|
|
/* ... try to set the presumed IPv6 address. */
|
|
set_addr_result =
|
|
inet_pton(AF_INET6,
|
|
args_info.standalone_addr,
|
|
&sa_serv.v6.sin6_addr);
|
|
}
|
|
/* ... otherwise (if it does not look like a IPv6 address) ... */
|
|
} else {
|
|
/* ... set IPv4 address family and port, ... */
|
|
sa_serv.v4.sin_family = AF_INET;
|
|
sa_serv.v4.sin_port = htons( args_info.standalone_port );
|
|
/* ... try to set the presumed IPv4 address. */
|
|
set_addr_result =
|
|
inet_pton(AF_INET,
|
|
args_info.standalone_addr,
|
|
&sa_serv.v4.sin_addr);
|
|
}
|
|
/* In case no standalone address has been specified ... */
|
|
} else {
|
|
/* ... set IPv6 family, port and any address */
|
|
sa_serv.v6.sin6_family = AF_INET6;
|
|
sa_serv.v6.sin6_port = htons( args_info.standalone_port );
|
|
sa_serv.v6.sin6_addr = in6addr_any;
|
|
}
|
|
|
|
/* Bail out on errors */
|
|
switch (set_addr_result) {
|
|
case 0:
|
|
my_perror("Setting server socket IP address failed, possibly malformed");
|
|
exit(1);
|
|
case -1:
|
|
my_perror("Setting server socket address family failed.");
|
|
exit(1);
|
|
case -2:
|
|
my_perror("Setting server socket interface failed, possibly mis-spelled");
|
|
exit(1);
|
|
}
|
|
|
|
/* Return pointer to sockaddr struct and its size */
|
|
*sa_serv_pp = (struct sockaddr *)&sa_serv;
|
|
*sa_serv_len_p = sizeof( sa_serv );
|
|
return;
|
|
}
|
|
|
|
/* Log pid and IP address of client */
|
|
void log_client(int pid, struct sockaddr_storage *ss_client_p)
|
|
{
|
|
char buf[40];
|
|
|
|
inet_ntop(ss_client_p->ss_family,
|
|
ss_client_p->ss_family == AF_INET ?
|
|
(void *)&(((struct sockaddr_in *)ss_client_p)->sin_addr) :
|
|
(void *)&(((struct sockaddr_in6 *)ss_client_p)->sin6_addr),
|
|
buf,
|
|
sizeof(buf));
|
|
message( "Started tunnel pid=%d for connection from %s\n", pid, buf );
|
|
return;
|
|
}
|
|
|
|
/* Run as a standalone daemon */
|
|
void do_daemon()
|
|
{
|
|
int listen_sd;
|
|
int one = 1;
|
|
struct sockaddr *sa_serv_p;
|
|
socklen_t sa_serv_len;
|
|
struct sockaddr_storage sa_cli;
|
|
socklen_t client_len;
|
|
int pid = 0;
|
|
int sd_client;
|
|
|
|
/* Socket descriptor */
|
|
int sd;
|
|
|
|
get_sa_serv(&sa_serv_p, &sa_serv_len);
|
|
|
|
if ( ( listen_sd = socket( sa_serv_p->sa_family, SOCK_STREAM, IPPROTO_TCP ) ) < 0 ) {
|
|
my_perror( "Server socket creation failed" );
|
|
exit(1);
|
|
}
|
|
|
|
#ifdef SO_REUSEPORT /* doesnt exist everywhere... */
|
|
setsockopt(listen_sd, SOL_SOCKET, SO_REUSEPORT, &one, sizeof(one));
|
|
#endif /* SO_REUSEPORT */
|
|
setsockopt(listen_sd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one));
|
|
|
|
if ( bind( listen_sd, sa_serv_p, sa_serv_len ) < 0) {
|
|
my_perror("Server socket bind failed");
|
|
exit(1);
|
|
}
|
|
|
|
signal(SIGHUP,SIG_IGN);
|
|
signal(SIGCHLD,SIG_IGN);
|
|
|
|
#ifdef SETPROCTITLE
|
|
if( ! args_info.proctitle_given )
|
|
setproctitle( "[daemon]" );
|
|
else
|
|
setproctitle( "" );
|
|
#else
|
|
if( args_info.proctitle_given )
|
|
message( "Setting process-title is not supported in this build\n");
|
|
#endif /* SETPROCTITLE */
|
|
|
|
/* For the moment, turn of forking into background on the cygwin platform
|
|
* so users can run it in a command window and ctrl-c it to cancel.
|
|
* Also so we can put logging there, since there's no syslog on cygwin (AFAIK)
|
|
* -- Maniac
|
|
*/
|
|
#ifndef CYGWIN
|
|
/*
|
|
if ( ( pid = fork( ) ) < 0 ) {
|
|
my_perror( "Cannot fork into the background" );
|
|
exit(1);
|
|
} else if ( pid > 0 ) {
|
|
message( "Forked into the background with pid %d\n", pid );
|
|
exit(0);
|
|
}
|
|
*/
|
|
|
|
openlog( program_name, LOG_CONS|LOG_PID,LOG_DAEMON );
|
|
i_am_daemon = 1;
|
|
#endif /* CYGWIN */
|
|
|
|
atexit( closeall );
|
|
listen( listen_sd, 8 );
|
|
|
|
while (1==1) {
|
|
/* 2002/04/21
|
|
*
|
|
* Workaround a CYGWIN bug, see:
|
|
* http://www.gnu.org/software/serveez/manual/BUGS
|
|
* for bug #B0007
|
|
*
|
|
* 2004/06/23: Apparently Solaris needs this too, so
|
|
* we'll do it by default, can't hurt
|
|
*
|
|
* -- Maniac
|
|
*
|
|
* 2024/01/21: Not sure what makes up the workaround
|
|
*
|
|
* -- Sven
|
|
*/
|
|
|
|
client_len = sizeof( sa_cli );
|
|
|
|
sd_client = accept( listen_sd,
|
|
(struct sockaddr *)&sa_cli, &client_len );
|
|
|
|
if ( sd_client < 0 ) {
|
|
my_perror( "accept() failed. Bailing out..." );
|
|
exit(1);
|
|
}
|
|
|
|
if ( ( pid = fork() ) < 0 ) {
|
|
my_perror( "Cannot fork worker" );
|
|
} else if ( pid == 0 ) {
|
|
/* As worker, we do not need to listen for new connections */
|
|
close(listen_sd);
|
|
|
|
read_fd = write_fd = sd_client;
|
|
|
|
/* Create a stdin/out stream */
|
|
std = stream_open(read_fd, write_fd);
|
|
|
|
/* Create a tunnel stream */
|
|
sd = tunnel_connect();
|
|
stunnel = stream_open(sd, sd);
|
|
|
|
#ifdef USE_SSL
|
|
/* If --encrypt-proxy is specified, connect to the proxy using SSL */
|
|
if ( args_info.encryptproxy_flag )
|
|
stream_enable_ssl(stunnel, args_info.proxy_arg);
|
|
#endif /* USE_SSL */
|
|
|
|
/* Open the tunnel */
|
|
proxy_protocol(stunnel);
|
|
|
|
#ifdef USE_SSL
|
|
/* If --encrypt is specified, wrap all traffic after the proxy handoff in SSL */
|
|
if( args_info.encrypt_flag )
|
|
stream_enable_ssl(stunnel, args_info.dest_arg);
|
|
#endif /* USE_SSL */
|
|
|
|
#ifdef SETPROCTITLE
|
|
if( ! args_info.proctitle_given )
|
|
setproctitle( "[cpio]" );
|
|
else
|
|
setproctitle( "" );
|
|
#else
|
|
if( args_info.proctitle_given )
|
|
message( "Setting process-title is not supported in this build\n");
|
|
#endif /* SETPROCTITLE */
|
|
|
|
/* Run the tunnel - we should stay here indefinitely */
|
|
cpio(std, stunnel);
|
|
exit( 0 );
|
|
}
|
|
|
|
log_client(pid, &sa_cli);
|
|
close( sd_client );
|
|
}
|
|
}
|
|
|
|
|
|
/* We begin at the beginning */
|
|
int main( int argc, char *argv[] ) {
|
|
/* Socket descriptor */
|
|
int sd;
|
|
|
|
/* Clear all stream variables (so we know whether we need to clear up) */
|
|
stunnel = NULL;
|
|
std = NULL;
|
|
|
|
program_name = argv[0];
|
|
|
|
cmdline_parser( argc, argv, &args_info );
|
|
#ifdef SETPROCTITLE
|
|
pt_initsetproctitle( argc, argv );
|
|
#endif
|
|
|
|
/*
|
|
* This is what we do:
|
|
* - Check if we need to run as a daemon. If so, a completely
|
|
* different mainline is needed...
|
|
* - Set a signal for the hangup (HUP) signal
|
|
* - Optionally create the proxy basic authentication cookie
|
|
* - Connect to the proxy
|
|
* - Execute the proxy protocol to connect it to the origin server
|
|
* - Enter copy in-out mode to channel data hence and forth
|
|
*/
|
|
|
|
signal( SIGHUP, signal_handler );
|
|
|
|
/* Initialize the NTLM module, if needed. */
|
|
if (args_info.ntlm_flag) {
|
|
init_ntlm();
|
|
}
|
|
|
|
/* If the usename is given, but password is not, prompt for it */
|
|
if( args_info.user_given && !args_info.pass_given ) {
|
|
char *cp;
|
|
cp = getpass_x ("Enter local proxy password for user %s: ", args_info.user_arg);
|
|
if (cp != NULL && strlen (cp) > 0) {
|
|
args_info.pass_arg = strdup (cp);
|
|
args_info.pass_given = 1;
|
|
memset (cp, 0, strlen(cp));
|
|
}
|
|
}
|
|
|
|
if( args_info.remuser_given && !args_info.rempass_given ) {
|
|
char *cp;
|
|
cp = getpass_x ("Enter remote proxy password for user %s: ", args_info.remuser_arg);
|
|
if (cp != NULL && strlen (cp) > 0) {
|
|
args_info.rempass_arg = strdup (cp);
|
|
args_info.rempass_given = 1;
|
|
memset (cp, 0, strlen(cp));
|
|
}
|
|
}
|
|
|
|
if( args_info.user_given && args_info.pass_given ) {
|
|
if (args_info.ntlm_flag) {
|
|
build_type1();
|
|
if ( args_info.verbose_flag )
|
|
message("Build Type 1 NTLM Message : %s\n", ntlm_type1_buf);
|
|
}
|
|
}
|
|
|
|
/* Only one of -E/-e/-R can be specified. */
|
|
if ((args_info.encrypt_flag ? 1 : 0) +
|
|
(args_info.encryptproxy_flag ? 1 : 0) +
|
|
(args_info.encryptremproxy_flag ? 1 : 0) > 1)
|
|
{
|
|
message("Error: only one of --encrypt-proxy, --encrypt-remproxy and --encrypt can be specified for a tunnel\n");
|
|
exit( 1 );
|
|
}
|
|
|
|
/* Do we need to run as a standalone daemon? */
|
|
if ( args_info.standalone_arg > 0 ) {
|
|
/* Do processing in the other mainline... */
|
|
do_daemon();
|
|
} else {
|
|
/* Inetd trick */
|
|
if( args_info.inetd_flag ) {
|
|
write_fd=0;
|
|
}
|
|
|
|
/* Create a stdin/out stream */
|
|
std = stream_open(read_fd, write_fd);
|
|
|
|
/* Create a tunnel stream */
|
|
sd = tunnel_connect();
|
|
stunnel = stream_open(sd, sd);
|
|
|
|
/* If --encrypt-proxy is specified, connect to the proxy using SSL */
|
|
#ifdef USE_SSL
|
|
if ( args_info.encryptproxy_flag )
|
|
stream_enable_ssl(stunnel, args_info.proxy_arg);
|
|
#endif /* USE_SSL */
|
|
|
|
/* Open the tunnel */
|
|
proxy_protocol(stunnel);
|
|
|
|
/* If --encrypt is specified, wrap all traffic after the proxy handoff in SSL */
|
|
#ifdef USE_SSL
|
|
if( args_info.encrypt_flag )
|
|
stream_enable_ssl(stunnel, args_info.dest_arg);
|
|
#endif /* USE_SSL */
|
|
|
|
#ifdef SETPROCTITLE
|
|
if( ! args_info.proctitle_given )
|
|
setproctitle( "[cpio]" );
|
|
else
|
|
setproctitle( "" );
|
|
#else
|
|
if( args_info.proctitle_given )
|
|
message( "Setting process-title is not supported in this build\n");
|
|
#endif /* SETPROCTITLE */
|
|
|
|
/* Run the tunnel - we should stay here indefinitely */
|
|
cpio(std, stunnel);
|
|
}
|
|
|
|
exit( 0 );
|
|
}
|
|
|
|
// vim:noexpandtab:ts=4
|