Skip to content

Commit c00c7de

Browse files
kosmas-valianoskosmas-valianos
authored
Merge pull request #6 from kosmas-valianos/parseSSL
Add support for parsing all SSL TLvs
2 parents b4e3719 + 269f83c commit c00c7de

2 files changed

Lines changed: 85 additions & 14 deletions

File tree

‎src/proxy_protocol.c‎

Lines changed: 10 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -723,18 +723,15 @@ static int32_t ppv2_parse(uint8_t *pkt, uint32_t pktlen, pp_info_t *pp_info)
723723
case PP2_TYPE_SSL:
724724
{
725725
pp2_tlv_ssl_t *pp2_tlv_ssl = (pp2_tlv_ssl_t*)pp2_tlv->value;
726+
/* TODO save client, verify in pp_info_t */
727+
/*if (!(pp2_tlv_ssl->client & PP2_CLIENT_SSL || pp2_tlv_ssl->client & PP2_CLIENT_CERT_CONN || pp2_tlv_ssl->client & PP2_CLIENT_CERT_SESS))
728+
{
729+
break;
730+
}*/
726731
uint16_t pp2_tlvs_ssl_len = pp2_tlv_len - sizeof(pp2_tlv_ssl->client) - sizeof(pp2_tlv_ssl->verify);
727732
uint16_t pp2_sub_tlv_offset = 0;
728-
while (pp2_tlvs_ssl_len)
733+
while (pp2_sub_tlv_offset < pp2_tlvs_ssl_len)
729734
{
730-
if (!(pp2_tlv_ssl->client & PP2_CLIENT_SSL || pp2_tlv_ssl->client & PP2_CLIENT_CERT_CONN || pp2_tlv_ssl->client & PP2_CLIENT_CERT_SESS))
731-
{
732-
break;
733-
}
734-
if (pp2_sub_tlv_offset > pp2_tlvs_ssl_len)
735-
{
736-
return ERR_PP2_TYPE_SSL;
737-
}
738735
pp2_tlv_t *pp2_sub_tlv_ssl = (pp2_tlv_t * )((uint8_t*) pp2_tlv_ssl->sub_tlv + pp2_sub_tlv_offset);
739736
uint16_t pp2_sub_tlv_ssl_len = pp2_sub_tlv_ssl->length_hi << 8 | pp2_sub_tlv_ssl->length_lo;
740737
switch (pp2_sub_tlv_ssl->type)
@@ -743,14 +740,12 @@ static int32_t ppv2_parse(uint8_t *pkt, uint32_t pktlen, pp_info_t *pp_info)
743740
case PP2_SUBTYPE_SSL_CIPHER: /* US-ASCII */
744741
case PP2_SUBTYPE_SSL_SIG_ALG: /* US-ASCII */
745742
case PP2_SUBTYPE_SSL_KEY_ALG: /* US-ASCII */
746-
{
747743
/* +1 to save it as a string */
748744
if (!tlv_array_append_tlv_new_usascii(&pp_info->tlv_array, pp2_sub_tlv_ssl->type, pp2_sub_tlv_ssl_len, pp2_sub_tlv_ssl->value))
749745
{
750746
return ERR_HEAP_ALLOC;
751747
}
752748
break;
753-
}
754749
case PP2_SUBTYPE_SSL_CN: /* UTF8 */
755750
if (!tlv_array_append_tlv_new(&pp_info->tlv_array, pp2_sub_tlv_ssl->type, pp2_sub_tlv_ssl_len, pp2_sub_tlv_ssl->value))
756751
{
@@ -761,9 +756,12 @@ static int32_t ppv2_parse(uint8_t *pkt, uint32_t pktlen, pp_info_t *pp_info)
761756
return ERR_PP2_TYPE_SSL;
762757
}
763758

764-
pp2_tlvs_ssl_len = pp2_tlvs_ssl_len - 3 - pp2_sub_tlv_ssl_len;
765759
pp2_sub_tlv_offset += 3 + pp2_sub_tlv_ssl_len;
766760
}
761+
if (pp2_sub_tlv_offset > pp2_tlvs_ssl_len)
762+
{
763+
return ERR_PP2_TYPE_SSL;
764+
}
767765
break;
768766
}
769767
case PP2_TYPE_NETNS: /* US-ASCII */

‎tests/test.c‎

Lines changed: 75 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,38 @@ uint8_t pp2_hdr_vpce[] = {
7474
0x00, 0x00, 0x00, 0x00, /* NOOP TLV end */
7575
};
7676

77+
uint8_t pp2_hdr_ssl[] = {
78+
0x0d, 0x0a, 0x0d, 0x0a, /* Start of v2 signature */
79+
0x00, 0x0d, 0x0a, 0x51,
80+
0x55, 0x49, 0x54, 0x0a, /* End of v2 signature */
81+
0x21, 0x11, 0x00, 0x64, /* ver_cmd, fam and len */
82+
0xc0, 0xa8, 0x0a, 0x64, /* Source IP */
83+
0xc0, 0xa8, 0x0b, 0x5a, /* Destination IP */
84+
0xa5, 0x5c, 0x1f, 0x90, /* Source port, Destination port */
85+
0x20, 0x00, 0x4e, 0x07, /* PP2_TYPE_SSL begin */
86+
0x00, 0x00, 0x00, 0x00,
87+
0x21, 0x00, 0x07, 0x54, /* PP2_SUBTYPE_SSL_VERSION begin */
88+
0x4c, 0x53, 0x76, 0x31,
89+
0x2e, 0x32, 0x22, 0x00, /* PP2_SUBTYPE_SSL_VERSION end, PP2_SUBTYPE_SSL_CN begin */
90+
0x0b, 0x65, 0x78, 0x61,
91+
0x6d, 0x70, 0x6c, 0x65,
92+
0x2e, 0x63, 0x6f, 0x6d, /* PP2_SUBTYPE_SSL_CN end */
93+
0x23, 0x00, 0x1b, 0x45, /* PP2_SUBTYPE_SSL_CIPHER begin */
94+
0x43, 0x44, 0x48, 0x45,
95+
0x2d, 0x52, 0x53, 0x41,
96+
0x2d, 0x41, 0x45, 0x53,
97+
0x31, 0x32, 0x38, 0x2d,
98+
0x47, 0x43, 0x4d, 0x2d,
99+
0x53, 0x48, 0x41, 0x32,
100+
0x35, 0x36, 0x24, 0x00, /* PP2_SUBTYPE_SSL_CIPHER end, PP2_SUBTYPE_SSL_SIG_ALG begin */
101+
0x06, 0x53, 0x48, 0x41,
102+
0x32, 0x35, 0x36, 0x25, /* PP2_SUBTYPE_SSL_SIG_ALG end, PP2_SUBTYPE_SSL_KEY_ALG begin */
103+
0x00, 0x07, 0x52, 0x53,
104+
0x41, 0x32, 0x30, 0x34,
105+
0x38, 0x04, 0x00, 0x04, /* PP2_SUBTYPE_SSL_KEY_ALG end, PP2_SUBTYPE_SSL_VERSION end, PP2_TYPE_NOOP begin */
106+
0x00, 0x00, 0x00, 0x00 /* PP2_TYPE_NOOP end */
107+
};
108+
77109
static uint8_t pp_verify_tlvs(const pp_info_t *pp_info, const test_tlv_t (*expected_tlvs)[10])
78110
{
79111
uint8_t i;
@@ -135,7 +167,7 @@ int main()
135167
.rc_expected = strlen((char *) tests[1].raw_bytes_in),
136168
},
137169
{
138-
.name = "v2 PROXY protocol header: PROXY, TCP over IPv4, PP2_TYPE_CRC32C, PP2_TYPE_AWS(PP2_SUBTYPE_AWS_VPCE_ID)",
170+
.name = "v2 PROXY protocol header: PROXY, TCP over IPv4. TLVs: PP2_TYPE_CRC32C, PP2_TYPE_AWS(PP2_SUBTYPE_AWS_VPCE_ID)",
139171
.raw_bytes_in = pp2_hdr_vpce,
140172
.raw_bytes_in_length = sizeof(pp2_hdr_vpce),
141173
.rc_expected = sizeof(pp2_hdr_vpce),
@@ -224,6 +256,47 @@ int main()
224256
},
225257
.pp_info_out_expected = tests[8].pp_info_in,
226258
},
259+
{
260+
.name = "v2 PROXY protocol header: PROXY, TCP over IPv4. TLVs: "
261+
"PP2_TYPE_SSL, PP2_SUBTYPE_SSL_VERSION, PP2_SUBTYPE_SSL_CN, PP2_SUBTYPE_SSL_CIPHER, PP2_SUBTYPE_SSL_SIG_ALG, PP2_SUBTYPE_SSL_KEY_ALG ",
262+
.raw_bytes_in = pp2_hdr_ssl,
263+
.raw_bytes_in_length = sizeof(pp2_hdr_ssl),
264+
.rc_expected = sizeof(pp2_hdr_ssl),
265+
.pp_info_out_expected = {
266+
.src_addr = "192.168.10.100",
267+
.dst_addr = "192.168.11.90",
268+
.src_port = 42332,
269+
.dst_port = 8080
270+
},
271+
.expected_tlvs = {
272+
{
273+
.type = PP2_SUBTYPE_SSL_VERSION,
274+
.value_len = 8,
275+
.value = (uint8_t*)"TLSv1.2"
276+
},
277+
{
278+
.type = PP2_SUBTYPE_SSL_CN,
279+
.value_len = 11,
280+
/* example.com */
281+
.value = (uint8_t*)"\x65\x78\x61\x6d\x70\x6c\x65\x2e\x63\x6f\x6d"
282+
},
283+
{
284+
.type = PP2_SUBTYPE_SSL_CIPHER,
285+
.value_len = 28,
286+
.value = (uint8_t*)"ECDHE-RSA-AES128-GCM-SHA256"
287+
},
288+
{
289+
.type = PP2_SUBTYPE_SSL_SIG_ALG,
290+
.value_len = 7,
291+
.value = (uint8_t*)"SHA256"
292+
},
293+
{
294+
.type = PP2_SUBTYPE_SSL_KEY_ALG,
295+
.value_len = 8,
296+
.value = (uint8_t*)"RSA2048"
297+
},
298+
},
299+
},
227300
};
228301

229302
/* Run tests */
@@ -267,7 +340,7 @@ int main()
267340
printf("Running test: pp_strerror()...");
268341
if (strcmp("No error", pp_strerror(ERR_NULL))
269342
|| strcmp("v1 PROXY protocol header: invalid dst port", pp_strerror(ERR_PP1_DST_PORT))
270-
|| pp_strerror(-26) || pp_strerror(1))
343+
|| pp_strerror(-28) || pp_strerror(1))
271344
{
272345
printf("FAILED\n");
273346
return EXIT_FAILURE;

0 commit comments

Comments
 (0)