Esercizio - Proxy HTTP con filtro degli host (sul modello della prova pratica)

 client ──► proxy ──► server di origine
  GET http://example.com:8081/p?q=1 HTTP/1.1          GET /p?q=1 HTTP/1.1
  Host: wrong                                         Host: example.com:8081
  Connection: keep-alive            ───►              Accept: */*
  Accept: */*                                         Via: 1.1 mini-proxy
  Proxy-Connection: keep-alive                        X-Forwarded-For: 10.0.0.7
  Keep-Alive: 5                                       Connection: close

/* http_proxy.c - proxy HTTP (forward proxy) semplice: GET, HEAD e POST con Content-Length, con lista di host vietati.
 *
 * Il client scrive la richiesta con URL ASSOLUTO ("GET http://host/percorso HTTP/1.1"); il proxy si connette
 * all'host, manda la richiesta in forma normale ("GET /percorso HTTP/1.1"), e gira la risposta al client.
 *
 * Compilare:  gcc -Wall -Wextra -o http_proxy http_proxy.c
 * Avviare:    ./http_proxy 8888 [host_vietato ...]
 * Provare:    curl -x http://127.0.0.1:8888 http://example.com/          (curl -x usa il proxy)
 *             curl -x http://127.0.0.1:8888 -I http://example.com/       (HEAD)
 *             printf 'GET http://example.com/ HTTP/1.0\r\n\r\n' | nc 127.0.0.1 8888
 */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <strings.h>
#include <errno.h>
#include <signal.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netdb.h>

#define MAX_LINE 4096
#define MAX_HEADERS 64

static char **blocked;                             /* host vietati (da argv) */
static int nblocked;

static int write_all(int fd, const char *buf, size_t n)
{
    while (n > 0) {
        ssize_t w = write(fd, buf, n);
        if (w < 0) {
            if (errno == EINTR)
                continue;
            return -1;
        }
        buf += w;
        n -= (size_t)w;
    }
    return 0;
}

/* ---------- lettore con buffer ---------- */
struct rbuf {
    int fd;
    char buf[4096];
    size_t pos, len;
};

static int rb_fill(struct rbuf *r)
{
    while (r->pos == r->len) {
        ssize_t k = read(r->fd, r->buf, sizeof r->buf);
        if (k < 0 && errno == EINTR)
            continue;
        if (k <= 0)
            return -1;
        r->pos = 0;
        r->len = (size_t)k;
    }
    return 0;
}

static int rb_line(struct rbuf *r, char *line, size_t max)
{
    size_t n = 0;
    for (;;) {
        if (rb_fill(r) < 0)
            return -1;
        char c = r->buf[r->pos++];
        if (c == '\n') {
            if (n > 0 && line[n - 1] == '\r')
                n--;
            line[n] = '\0';
            return (int)n;
        }
        if (n + 1 >= max)
            return -2;
        line[n++] = c;
    }
}

/* Inoltra n byte dal lettore src al socket dst. */
static int rb_copy(struct rbuf *src, int dst, long n)
{
    while (n > 0) {
        if (rb_fill(src) < 0)
            return -1;
        size_t avail = src->len - src->pos;
        size_t take = ((long)avail < n) ? avail : (size_t)n;
        if (write_all(dst, src->buf + src->pos, take) < 0)
            return -1;
        src->pos += take;
        n -= (long)take;
    }
    return 0;
}

/* ---------- URL assoluto ---------- */
static int parse_url(const char *url, char *host, size_t hsize, char *port, size_t psize, char *path, size_t pathsize)
{
    if (strncasecmp(url, "http://", 7) != 0)
        return -1;
    const char *h = url + 7;
    const char *slash = strchr(h, '/');
    size_t alen = slash ? (size_t)(slash - h) : strlen(h);
    char auth[256];
    if (alen == 0 || alen >= sizeof auth)
        return -1;
    memcpy(auth, h, alen);
    auth[alen] = '\0';
    char *colon = strrchr(auth, ':');
    if (colon != NULL) {
        *colon = '\0';
        snprintf(port, psize, "%s", colon + 1);
        if (atoi(port) < 1 || atoi(port) > 65535)
            return -1;
    } else {
        snprintf(port, psize, "80");
    }
    snprintf(host, hsize, "%s", auth);
    snprintf(path, pathsize, "%s", slash ? slash : "/");
    return host[0] ? 0 : -1;
}

static int connect_to(const char *host, const char *port)
{
    struct addrinfo hints, *res, *p;
    memset(&hints, 0, sizeof hints);
    hints.ai_family = AF_UNSPEC;
    hints.ai_socktype = SOCK_STREAM;
    if (getaddrinfo(host, port, &hints, &res) != 0)
        return -1;
    int fd = -1;
    for (p = res; p != NULL; p = p->ai_next) {
        fd = socket(p->ai_family, p->ai_socktype, p->ai_protocol);
        if (fd < 0)
            continue;
        if (connect(fd, p->ai_addr, p->ai_addrlen) == 0)
            break;
        close(fd);
        fd = -1;
    }
    freeaddrinfo(res);
    return fd;
}

static void send_error(int fd, int code, const char *reason)
{
    char msg[512];
    int blen = snprintf(msg, sizeof msg, "%d %s\n", code, reason);
    char head[512];
    int n = snprintf(head, sizeof head,
                     "HTTP/1.1 %d %s\r\nContent-Type: text/plain\r\nContent-Length: %d\r\nConnection: close\r\n\r\n",
                     code, reason, blen);
    write_all(fd, head, (size_t)n);
    write_all(fd, msg, (size_t)blen);
}

/* Header "hop-by-hop": riguardano solo la connessione fra due nodi e un proxy NON li inoltra (RFC 9110 7.6.1). */
static int is_hop_by_hop(const char *name)
{
    static const char *hop[] = {"Connection", "Proxy-Connection", "Keep-Alive", "Proxy-Authenticate",
                                "Proxy-Authorization", "TE", "Trailer", "Transfer-Encoding", "Upgrade"};
    for (size_t i = 0; i < sizeof hop / sizeof hop[0]; i++)
        if (strcasecmp(name, hop[i]) == 0)
            return 1;
    return 0;
}

static void handle(int cfd, const char *peer)
{
    struct rbuf cl = {.fd = cfd};
    char line[MAX_LINE], method[16], target[MAX_LINE], ver[16];

    /* ---- richiesta del client ---- */
    int len = rb_line(&cl, line, sizeof line);
    if (len < 0 || sscanf(line, "%15s %4095s %15s", method, target, ver) != 3 || strncmp(ver, "HTTP/1.", 7) != 0) {
        send_error(cfd, 400, "Bad Request");
        return;
    }
    static char names[MAX_HEADERS][64], values[MAX_HEADERS][1024];
    int nh = 0;
    long clen = 0;
    for (;;) {
        len = rb_line(&cl, line, sizeof line);
        if (len < 0) {
            send_error(cfd, 400, "Bad Request");
            return;
        }
        if (len == 0)
            break;
        char *colon = strchr(line, ':');
        if (colon == NULL || nh >= MAX_HEADERS) {
            send_error(cfd, 400, "Bad Request");
            return;
        }
        *colon = '\0';
        const char *v = colon + 1;
        while (*v == ' ' || *v == '\t')
            v++;
        snprintf(names[nh], sizeof names[0], "%s", line);
        snprintf(values[nh], sizeof values[0], "%s", v);
        if (strcasecmp(line, "Content-Length") == 0)
            clen = atol(v);
        if (strcasecmp(line, "Transfer-Encoding") == 0) {
            send_error(cfd, 501, "Not Implemented");   /* corpo chunked dal client: non gestito */
            return;
        }
        nh++;
    }

    if (strcmp(method, "CONNECT") == 0) {
        send_error(cfd, 501, "Not Implemented");   /* i tunnel CONNECT sono nell'esercizio dedicato */
        return;
    }
    if (strcmp(method, "GET") != 0 && strcmp(method, "HEAD") != 0 && strcmp(method, "POST") != 0) {
        send_error(cfd, 405, "Method Not Allowed");
        return;
    }
    char host[256], port[16], path[MAX_LINE];
    if (parse_url(target, host, sizeof host, port, sizeof port, path, sizeof path) < 0) {
        /* forma "origin" (/percorso): il client crede di parlare con un server, non con un proxy */
        send_error(cfd, 400, "Bad Request: serve un URL assoluto http://...");
        return;
    }
    for (int i = 0; i < nblocked; i++)
        if (strcasecmp(host, blocked[i]) == 0) {
            fprintf(stderr, "%s %s %s -> 403 (host vietato)\n", peer, method, target);
            send_error(cfd, 403, "Forbidden");
            return;
        }

    /* ---- connessione al server di origine ---- */
    int sfd = connect_to(host, port);
    if (sfd < 0) {
        fprintf(stderr, "%s %s %s -> 502 (connessione a %s:%s fallita)\n", peer, method, target, host, port);
        send_error(cfd, 502, "Bad Gateway");
        return;
    }

    /* ---- richiesta inoltrata ---- */
    char req[16384];
    int n = snprintf(req, sizeof req, "%s %s HTTP/1.1\r\n", method, path);   /* da URL assoluto a origin-form */
    int is_default_port = strcmp(port, "80") == 0;
    n += snprintf(req + n, sizeof req - (size_t)n, is_default_port ? "Host: %s\r\n" : "Host: %s:%s\r\n", host, port);
    for (int i = 0; i < nh; i++) {
        if (is_hop_by_hop(names[i]) || strcasecmp(names[i], "Host") == 0)
            continue;                              /* Host rifatto sopra; hop-by-hop non inoltrati */
        n += snprintf(req + n, sizeof req - (size_t)n, "%s: %s\r\n", names[i], values[i]);
        if ((size_t)n >= sizeof req - 256) {
            send_error(cfd, 431, "Request Header Fields Too Large");
            close(sfd);
            return;
        }
    }
    n += snprintf(req + n, sizeof req - (size_t)n,
                  "Via: 1.1 mini-proxy\r\nX-Forwarded-For: %s\r\nConnection: close\r\n\r\n", peer);
    if (write_all(sfd, req, (size_t)n) < 0 || (clen > 0 && rb_copy(&cl, sfd, clen) < 0)) {
        send_error(cfd, 502, "Bad Gateway");
        close(sfd);
        return;
    }

    /* ---- risposta: si legge la status-line per il log, poi si gira tutto com'e' ---- */
    struct rbuf up = {.fd = sfd};
    len = rb_line(&up, line, sizeof line);
    if (len < 0) {
        send_error(cfd, 502, "Bad Gateway");       /* il server ha chiuso senza rispondere */
        close(sfd);
        return;
    }
    fprintf(stderr, "%s %s %s -> %s\n", peer, method, target, line);
    write_all(cfd, line, strlen(line));
    write_all(cfd, "\r\n", 2);
    if (up.pos < up.len)                           /* byte gia' letti oltre la status-line */
        write_all(cfd, up.buf + up.pos, up.len - up.pos);
    char buf[8192];
    ssize_t r;
    while ((r = read(sfd, buf, sizeof buf)) > 0)   /* il server chiude (Connection: close): la risposta e' finita */
        if (write_all(cfd, buf, (size_t)r) < 0)
            break;
    close(sfd);
}

int main(int argc, char **argv)
{
    if (argc < 2) {
        fprintf(stderr, "uso: %s porta [host_vietato ...]\n", argv[0]);
        return 1;
    }
    blocked = argv + 2;
    nblocked = argc - 2;
    signal(SIGPIPE, SIG_IGN);
    int lfd = socket(AF_INET, SOCK_STREAM, 0);
    if (lfd < 0) {
        perror("socket");
        return 1;
    }
    int yes = 1;
    setsockopt(lfd, SOL_SOCKET, SO_REUSEADDR, &yes, sizeof yes);
    struct sockaddr_in addr;
    memset(&addr, 0, sizeof addr);
    addr.sin_family = AF_INET;
    addr.sin_addr.s_addr = htonl(INADDR_ANY);
    addr.sin_port = htons((unsigned short)atoi(argv[1]));
    if (bind(lfd, (struct sockaddr *)&addr, sizeof addr) < 0 || listen(lfd, 16) < 0) {
        perror("bind/listen");
        return 1;
    }
    fprintf(stderr, "proxy in ascolto sulla porta %s\n", argv[1]);
    for (;;) {
        struct sockaddr_in cli;
        socklen_t clen = sizeof cli;
        int cfd = accept(lfd, (struct sockaddr *)&cli, &clen);
        if (cfd < 0) {
            if (errno == EINTR)
                continue;
            perror("accept");
            break;
        }
        char peer[INET_ADDRSTRLEN];
        inet_ntop(AF_INET, &cli.sin_addr, peer, sizeof peer);
        handle(cfd, peer);
        close(cfd);
    }
    return 0;
}

$ gcc -Wall -Wextra -o http_proxy http_proxy.c
$ (cd www && python3 -m http.server 8000 --bind 127.0.0.1) &          # un server di origine
$ ./http_proxy 8888 &                                                 # il proxy
proxy in ascolto sulla porta 8888

$ curl -i -x http://127.0.0.1:8888 http://127.0.0.1:8000/index.html   # curl -x usa il proxy
HTTP/1.0 200 OK
Server: SimpleHTTP/0.6 Python/3.12.10
Content-Type: text/html
Content-Length: 40
...
<html><body><h1>Ciao</h1></body></html>

127.0.0.1 GET http://127.0.0.1:8000/index.html -> HTTP/1.0 200 OK

$ curl -x http://127.0.0.1:8888 http://127.0.0.1:8000/p?q=1 -H 'Proxy-Connection: keep-alive'
(sul terminale di nc -l 8000)
GET /p?q=1 HTTP/1.1
Host: 127.0.0.1:8000
User-Agent: curl/8.5.0
Accept: */*
Via: 1.1 mini-proxy
X-Forwarded-For: 127.0.0.1
Connection: close

$ ./http_proxy 8888 bad.example.com &                                  # host vietato
$ curl -i -x http://127.0.0.1:8888 http://bad.example.com/              # 403 Forbidden
$ printf 'GET /x HTTP/1.1\r\nHost: x\r\n\r\n' | nc 127.0.0.1 8888       # forma origin: 400 "serve un URL assoluto"
$ curl -i -x http://127.0.0.1:8888 http://127.0.0.1:9/                  # porta chiusa: 502 Bad Gateway
$ curl -x http://127.0.0.1:8888 -d "a=1" http://127.0.0.1:8000/          # POST: corpo inoltrato (Python risponde 501, ma il corpo è arrivato)
$ curl -I -x http://127.0.0.1:8888 http://127.0.0.1:8000/index.html      # HEAD: solo header