Esercizio - Proxy con tunnel CONNECT (sul modello della prova pratica)

 browser                       proxy                              server:443
   |-- CONNECT www.example.com:443 HTTP/1.1 -->|
   |                                            |------- connect() -------->|
   |<-- HTTP/1.1 200 Connection established ----|
   |============== da qui il proxy copia i byte nei due versi ==============|
   |-- ClientHello (TLS) ---------------------->|-------------------------->|
   |<-- ServerHello, certificato ---------------|<--------------------------|
   |== richiesta HTTP cifrata =================>|==========================>|

/* connect_proxy.c - proxy che accetta SOLO il metodo CONNECT e apre un tunnel TCP verso host:porta.
 * Dopo "200 Connection established" il proxy inoltra i byte in entrambe le direzioni senza guardarli
 * (e' cosi' che passa HTTPS: il TLS e' fra browser e server, il proxy vede solo byte cifrati).
 * Un processo figlio per ogni tunnel.
 *
 * Compilare:  gcc -Wall -Wextra -o connect_proxy connect_proxy.c
 * Avviare:    ./connect_proxy 8889 [porta_consentita ...]       (senza argomenti: solo la 443)
 * Provare:    curl -x http://127.0.0.1:8889 https://example.com/          (HTTPS attraverso il tunnel)
 *             curl -p -x http://127.0.0.1:8889 http://127.0.0.1:8000/ -v    (-p: forza CONNECT anche per http; avviare con 8000)
 */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>
#include <signal.h>
#include <poll.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netdb.h>

#define MAX_LINE 2048

static int allowed[16] = {443};
static int nallowed = 1;

static int write_all(int fd, const char *buf, size_t n)
{
    while (n > 0) {
        ssize_t w = write(fd, buf, n);
        if (w < 0) {
            if (errno == EINTR)
                continue;
            return -1;
        }
        buf += w;
        n -= (size_t)w;
    }
    return 0;
}

struct rbuf {
    int fd;
    char buf[4096];
    size_t pos, len;
};

static int rb_line(struct rbuf *r, char *line, size_t max)
{
    size_t n = 0;
    for (;;) {
        if (r->pos == r->len) {
            ssize_t k = read(r->fd, r->buf, sizeof r->buf);
            if (k < 0 && errno == EINTR)
                continue;
            if (k <= 0)
                return -1;
            r->pos = 0;
            r->len = (size_t)k;
        }
        char c = r->buf[r->pos++];
        if (c == '\n') {
            if (n > 0 && line[n - 1] == '\r')
                n--;
            line[n] = '\0';
            return (int)n;
        }
        if (n + 1 >= max)
            return -2;
        line[n++] = c;
    }
}

static int connect_to(const char *host, const char *port)
{
    struct addrinfo hints, *res, *p;
    memset(&hints, 0, sizeof hints);
    hints.ai_family = AF_UNSPEC;
    hints.ai_socktype = SOCK_STREAM;
    if (getaddrinfo(host, port, &hints, &res) != 0)
        return -1;
    int fd = -1;
    for (p = res; p != NULL; p = p->ai_next) {
        fd = socket(p->ai_family, p->ai_socktype, p->ai_protocol);
        if (fd < 0)
            continue;
        if (connect(fd, p->ai_addr, p->ai_addrlen) == 0)
            break;
        close(fd);
        fd = -1;
    }
    freeaddrinfo(res);
    return fd;
}

static void send_status(int fd, int code, const char *reason)
{
    char head[256];
    int n = snprintf(head, sizeof head, "HTTP/1.1 %d %s\r\nContent-Length: 0\r\nConnection: close\r\n\r\n", code, reason);
    write_all(fd, head, (size_t)n);
}

/* Il cuore del tunnel: poll aspetta dati su uno qualunque dei due socket e li gira all'altro.
 * Quando un lato finisce di scrivere (read == 0) si fa shutdown(SHUT_WR) sull'altro (half-close):
 * il flusso opposto puo' continuare finche' anche l'altro lato non ha finito. */
static void tunnel(int a, int b)
{
    struct pollfd pf[2];
    int open_dir[2] = {1, 1};                      /* open_dir[0]: a -> b ancora aperta; open_dir[1]: b -> a */
    char buf[8192];
    while (open_dir[0] || open_dir[1]) {
        pf[0].fd = open_dir[0] ? a : -1;           /* poll ignora i descrittori negativi */
        pf[1].fd = open_dir[1] ? b : -1;
        pf[0].events = pf[1].events = POLLIN;
        pf[0].revents = pf[1].revents = 0;
        int rc = poll(pf, 2, 60000);
        if (rc < 0) {
            if (errno == EINTR)
                continue;
            return;
        }
        if (rc == 0)
            return;                                /* 60 secondi di silenzio: tunnel inattivo, si chiude */
        for (int i = 0; i < 2; i++) {
            if (!(pf[i].revents & (POLLIN | POLLHUP | POLLERR)))
                continue;
            int from = (i == 0) ? a : b, to = (i == 0) ? b : a;
            ssize_t r = read(from, buf, sizeof buf);
            if (r < 0 && errno == EINTR)
                continue;
            if (r <= 0) {
                shutdown(to, SHUT_WR);             /* EOF o errore: si comunica la fine all'altro lato */
                open_dir[i] = 0;
            } else if (write_all(to, buf, (size_t)r) < 0) {
                return;                            /* l'altro lato non c'e' piu' */
            }
        }
    }
}

static void handle(int cfd)
{
    struct rbuf cl = {.fd = cfd};
    char line[MAX_LINE], method[16], target[MAX_LINE], ver[16];

    if (rb_line(&cl, line, sizeof line) < 0 || sscanf(line, "%15s %2047s %15s", method, target, ver) != 3) {
        send_status(cfd, 400, "Bad Request");
        return;
    }
    for (;;) {                                     /* header: letti e scartati (qui si potrebbe controllare Proxy-Authorization) */
        int len = rb_line(&cl, line, sizeof line);
        if (len < 0) {
            send_status(cfd, 400, "Bad Request");
            return;
        }
        if (len == 0)
            break;
    }
    if (strcmp(method, "CONNECT") != 0) {
        send_status(cfd, 405, "Method Not Allowed");
        return;
    }

    /* il target di CONNECT e' "host:porta" (la porta e' obbligatoria; per IPv6 "[::1]:443") */
    char host[256], *colon = strrchr(target, ':');
    if (colon == NULL || colon == target || colon[1] == '\0') {
        send_status(cfd, 400, "Bad Request");
        return;
    }
    *colon = '\0';
    char *portstr = colon + 1, *end;
    long port = strtol(portstr, &end, 10);
    if (*end != '\0' || port < 1 || port > 65535) {
        send_status(cfd, 400, "Bad Request");
        return;
    }
    const char *h = target;
    if (h[0] == '[') {                             /* IPv6 fra parentesi quadre */
        size_t l = strlen(h);
        if (h[l - 1] != ']') {
            send_status(cfd, 400, "Bad Request");
            return;
        }
        target[l - 1] = '\0';
        h++;
    }
    snprintf(host, sizeof host, "%s", h);

    /* Un CONNECT verso porte qualsiasi trasformerebbe il proxy in un ponte verso SMTP, SSH, servizi interni... */
    int ok = 0;
    for (int i = 0; i < nallowed; i++)
        if (allowed[i] == port)
            ok = 1;
    if (!ok) {
        fprintf(stderr, "CONNECT %s:%ld -> 403 (porta non consentita)\n", host, port);
        send_status(cfd, 403, "Forbidden");
        return;
    }

    int sfd = connect_to(host, portstr);
    if (sfd < 0) {
        fprintf(stderr, "CONNECT %s:%ld -> 502\n", host, port);
        send_status(cfd, 502, "Bad Gateway");
        return;
    }
    /* Risposta di successo: da qui in poi la connessione e' un tunnel di byte (niente Content-Length). */
    const char *ok_resp = "HTTP/1.1 200 Connection established\r\n\r\n";
    write_all(cfd, ok_resp, strlen(ok_resp));
    fprintf(stderr, "CONNECT %s:%ld -> tunnel aperto\n", host, port);

    if (cl.pos < cl.len)                           /* byte del client gia' arrivati dopo la richiesta: vanno al server */
        write_all(sfd, cl.buf + cl.pos, cl.len - cl.pos);
    tunnel(cfd, sfd);
    close(sfd);
    fprintf(stderr, "CONNECT %s:%ld -> tunnel chiuso\n", host, port);
}

static void on_sigchld(int sig)
{
    (void)sig;
    int saved = errno;
    while (waitpid(-1, NULL, WNOHANG) > 0)
        ;
    errno = saved;
}

int main(int argc, char **argv)
{
    if (argc < 2) {
        fprintf(stderr, "uso: %s porta [porta_consentita ...]\n", argv[0]);
        return 1;
    }
    if (argc > 2) {
        nallowed = 0;
        for (int i = 2; i < argc && nallowed < 16; i++)
            allowed[nallowed++] = atoi(argv[i]);
    }
    signal(SIGPIPE, SIG_IGN);
    struct sigaction sa;
    memset(&sa, 0, sizeof sa);
    sa.sa_handler = on_sigchld;
    sigemptyset(&sa.sa_mask);
    sa.sa_flags = SA_RESTART | SA_NOCLDSTOP;
    sigaction(SIGCHLD, &sa, NULL);

    int lfd = socket(AF_INET, SOCK_STREAM, 0);
    if (lfd < 0) {
        perror("socket");
        return 1;
    }
    int yes = 1;
    setsockopt(lfd, SOL_SOCKET, SO_REUSEADDR, &yes, sizeof yes);
    struct sockaddr_in addr;
    memset(&addr, 0, sizeof addr);
    addr.sin_family = AF_INET;
    addr.sin_addr.s_addr = htonl(INADDR_ANY);
    addr.sin_port = htons((unsigned short)atoi(argv[1]));
    if (bind(lfd, (struct sockaddr *)&addr, sizeof addr) < 0 || listen(lfd, 32) < 0) {
        perror("bind/listen");
        return 1;
    }
    fprintf(stderr, "proxy CONNECT in ascolto sulla porta %s\n", argv[1]);
    for (;;) {
        int cfd = accept(lfd, NULL, NULL);
        if (cfd < 0) {
            if (errno == EINTR)
                continue;
            perror("accept");
            continue;
        }
        pid_t pid = fork();
        if (pid == 0) {
            close(lfd);                            /* il figlio non accetta connessioni */
            handle(cfd);
            close(cfd);
            _exit(0);
        }
        close(cfd);                                /* il padre non usa questa connessione */
    }
}

$ gcc -Wall -Wextra -o connect_proxy connect_proxy.c
$ (cd www && python3 -m http.server 8000 --bind 127.0.0.1) &
$ ./connect_proxy 8889 443 8000 &            # porte consentite: 443 e 8000 (solo per la prova locale)
proxy CONNECT in ascolto sulla porta 8889

$ (printf 'CONNECT 127.0.0.1:8000 HTTP/1.1\r\nHost: 127.0.0.1:8000\r\n\r\nGET /index.html HTTP/1.0\r\n\r\n'; sleep 1) | nc 127.0.0.1 8889
HTTP/1.1 200 Connection established

HTTP/1.0 200 OK
Server: SimpleHTTP/0.6 Python/3.12.10
...
<html><body><h1>Ciao</h1></body></html>

CONNECT 127.0.0.1:8000 -> tunnel aperto
CONNECT 127.0.0.1:8000 -> tunnel chiuso

$ curl -v -p -x http://127.0.0.1:8889 http://127.0.0.1:8000/index.html
* Establish HTTP proxy tunnel to 127.0.0.1:8000
> CONNECT 127.0.0.1:8000 HTTP/1.1
> Host: 127.0.0.1:8000
...
< HTTP/1.1 200 Connection established
* Proxy replied 200 to CONNECT request
> GET /index.html HTTP/1.1
...
<html><body><h1>Ciao</h1></body></html>

$ printf 'CONNECT example.com:25 HTTP/1.1\r\nHost: x\r\n\r\n' | nc 127.0.0.1 8889     # porta non consentita
HTTP/1.1 403 Forbidden
$ printf 'CONNECT example.com HTTP/1.1\r\nHost: x\r\n\r\n' | nc 127.0.0.1 8889        # manca la porta
HTTP/1.1 400 Bad Request
$ printf 'GET http://example.com/ HTTP/1.1\r\n\r\n' | nc 127.0.0.1 8889                # non e' CONNECT
HTTP/1.1 405 Method Not Allowed
$ printf 'CONNECT 127.0.0.1:9 HTTP/1.1\r\nHost: x\r\n\r\n' | nc 127.0.0.1 8889          # se il proxy e' avviato con la porta 9 consentita ma nessuno ascolta: 502

pf[0].fd = open_dir[0] ? a : -1;      pf[1].fd = open_dir[1] ? b : -1;   /* poll ignora i descrittori negativi */
poll(pf, 2, 60000);                    /* aspetta dati da a o da b, al massimo 60 s */
/* per ogni lato pronto: */
r = read(from, buf, sizeof buf);
if (r <= 0) { shutdown(to, SHUT_WR); open_dir[i] = 0; }       /* EOF: si propaga la chiusura all'altro lato */
else if (write_all(to, buf, r) < 0) return;                    /* l'altro lato non c'e' piu' */