tlsproxy's Introduction

tlsproxy

tlsproxy is a TLS proxy written with GnuTLS. It is mostly designed as an example of how to use asynchronous (non-blocking) I/O with GnuTLS. More accurately, it was designed so I could learn how to do it. I think I've got it right.

To that end, it's been divided up as follows:

crypto.c does all the crypto, and tlssession_mainloop() does the hard work.
buffer.c provides ring buffer support.
tlsproxy.c deals with command line options and connecting sockets.

It can be used in two modes:

Client mode (default). Listens on an unencrypted port, connects to an encrypted port.
Server mode (run with -s). Listens on an encrypted port, connects to an unencrypted port.

Usage

tlsproxy

Usage:
     tlsproxy [OPTIONS]

A TLS client or server proxy

Options:
     -c, --connect ADDRRESS    Connect to ADDRESS
     -l, --listen ADDRESS      Listen on ADDRESS
     -K, --key FILE            Use FILE as private key
     -C, --cert FILE           Use FILE as public key
     -A, --cacert FILE         Use FILE as public CA cert file
     -H, --hostname HOSTNAME   Use HOSTNAME to validate the CN of the peer
                               rather than hostname extracted from -C option
     -s, --server              Run the listen port encrypted rather than the
                               connect port
     -i, --insecure            Do not validate certificates
     -n, --nofork              Do not fork off (aids debugging); specify twice
                               to stop forking on accept as well
     -d, --debug               Turn on debugging
     -h, --help                Show this usage message

License

MIT

tlsproxy's People

Contributors

Stargazers

Watchers

Forkers

nmav

tlsproxy's Issues

Error with gnutls_record_send() and GNUTLS_E_AGAIN

Instead of using len to mark part of the buffer as "sent" you are using negative value of ret at https://github.com/abligh/tlsproxy/blob/master/crypto-gnutls.c#L607.
Code can be simplified:

          do
            {
              ret = gnutls_record_send (s->session, addr, len);
            }
          while (ret == GNUTLS_E_INTERRUPTED && !quit (s));
          if (quit (s))
            break;
          if (ret < 0)
            {
              if (ret != GNUTLS_E_AGAIN)
                {
                  errout (s, "Error on write to crypto socket: %s\n",
                      gnutls_strerror (ret));
                  goto error;
                }
            }
          else
            bufDoneRead (plainToCrypt, ret);  /* mark ret bytes as read from the buffer */

Recommend Projects