Disabled TLSGuard handshake rewrites and passed through resumed encrypted sessions.

TODO

@@ -3,7 +3,9 @@ fw-daemon:
 
 	remove all stale references to SANDBOX: rules/policyForPathAndSandbox()
 
-	TLSGuard needs a lot of stuff removed
+	TLSGuard needs to handle unexpected SSL3_MT_HELLO_REQUEST properly - make expectations a slice
+
+	GetPendingRequests Dbus method should send a bunch of DBus requests
 
 
 fw-prompt:

sgfw/tlsguard.go

@@ -3,7 +3,7 @@ package sgfw
 import (
 	"crypto/x509"
 	"encoding/binary"
-	"encoding/hex"
+	//	"encoding/hex"
 	"errors"
 	"fmt"
 	"io"
@@ -11,7 +11,7 @@ import (
 	"time"
 )
 
-const TLSGUARD_READ_TIMEOUT = 10 * time.Second
+const TLSGUARD_READ_TIMEOUT = 8 * time.Second
 const TLSGUARD_MIN_TLS_VER_MAJ = 3
 const TLSGUARD_MIN_TLS_VER_MIN = 1
 
@@ -305,6 +305,9 @@ func connectionReader(conn net.Conn, is_client bool, c chan connReader, done cha
 				} else if int(header[2]) < TLSGUARD_MIN_TLS_VER_MIN {
 					ret_error = errors.New("TLS protocol minor version less than expected minimum")
 					continue
+				} else if int(header[1]) > 3 {
+					ret_error = errors.New("TLS protocol major version was larger than expected; maybe not TLS handshake?")
+					continue
 				}
 
 				rtype = int(header[0])
@@ -366,6 +369,11 @@ func TLSGuard(conn, conn2 net.Conn, fqdn string) error {
 	client_expected := SSL3_MT_CLIENT_HELLO
 	server_expected := SSL3_MT_SERVER_HELLO
 
+	client_sess := false
+	server_sess := false
+	client_change_cipher := false
+	server_change_cipher := false
+
 select_loop:
 	for {
 		if ndone == 2 {
@@ -404,6 +412,12 @@ select_loop:
 						if cr.data[TLS_RECORD_HDR_LEN] != 1 {
 							return errors.New(fmt.Sprintf("TLSGuard dropped connection with strange change cipher spec data (%#x bytes)", cr.data[TLS_RECORD_HDR_LEN]))
 						}
+
+						if cr.client {
+							client_change_cipher = true
+						} else {
+							server_change_cipher = true
+						}
 					} else if cr.rtype == SSL3_RT_ALERT {
 						if cr.data[TLS_RECORD_HDR_LEN] == SSL3_AL_WARNING {
 							fmt.Println("SSL ALERT TYPE: warning")
@@ -423,32 +437,29 @@ select_loop:
 						}
 
 					}
-
-					// fmt.Println("OTHER DATA; PASSING THRU")
-					if cr.rtype == SSL3_RT_ALERT {
-						fmt.Println("ALERT = ", cr.data)
-					}
 					other.Write(cr.data)
 					continue
-				} else if cr.client {
-					//					other.Write(cr.data)
-					//					continue
 				} else if cr.rtype != SSL3_RT_HANDSHAKE {
 					return errors.New(fmt.Sprintf("Expected TLS server handshake byte was not received [%#x vs 0x16]", cr.rtype))
 				}
 
-				if cr.rtype < SSL3_RT_CHANGE_CIPHER_SPEC || cr.rtype > SSL3_RT_APPLICATION_DATA {
-					return errors.New(fmt.Sprintf("TLSGuard dropping connection with unknown content type: %#x", cr.rtype))
-				}
-
 				handshakeMsg := cr.data[TLS_RECORD_HDR_LEN:]
 				s := uint(handshakeMsg[0])
-				fmt.Printf("s = %#x\n", s)
-				// Message len, 3 bytes
-				if cr.rtype == SSL3_RT_HANDSHAKE {
 				handshakeMessageLen := handshakeMsg[1:4]
 				handshakeMessageLenInt := int(int(handshakeMessageLen[0])<<16 | int(handshakeMessageLen[1])<<8 | int(handshakeMessageLen[2]))
-					fmt.Println("lenint = ", handshakeMessageLenInt)
+				fmt.Printf("s = %#x, lenint = %v, total = %d\n", s, handshakeMessageLenInt, len(cr.data))
+
+				if (client_sess || server_sess) && (client_change_cipher || server_change_cipher) {
+
+					if handshakeMessageLenInt > len(cr.data)+9 {
+						log.Notice("TLSGuard saw what looks like a resumed encrypted session... passing connection through")
+						other.Write(cr.data)
+						dChan <- true
+						dChan2 <- true
+						x509Valid = true
+						break select_loop
+					}
+
 				}
 
 				if cr.client && s != uint(client_expected) {
@@ -458,8 +469,8 @@ select_loop:
 				}
 
 				if (cr.client && s == SSL3_MT_CLIENT_HELLO) || (!cr.client && s == SSL3_MT_SERVER_HELLO) {
-					rewrite := false
+					//					rewrite := false
-					rewrite_buf := []byte{}
+					//					rewrite_buf := []byte{}
 					SRC := ""
 
 					if s == SSL3_MT_CLIENT_HELLO {
@@ -484,7 +495,13 @@ select_loop:
 					sess_len := uint(handshakeMsg[hello_offset])
 					fmt.Println(SRC, "HELLO SESSION ID = ", sess_len)
 
-					if sess_len != 0 {
+					if cr.client && sess_len > 0 {
+						client_sess = true
+					} else {
+						server_sess = true
+					}
+
+					/*					if sess_len != 0 {
 											fmt.Printf("ALERT: %v attempting to resume session; intercepting request\n", SRC)
 											rewrite = true
 											dcopy := make([]byte, len(cr.data))
@@ -567,12 +584,6 @@ select_loop:
 												ext_ctr += 2
 												//							fmt.Printf("PROGRESS: %v of %v, %v of %v\n", ext_ctr, extlen, hello_offset, len(handshakeMsg))
 												fmt.Printf("EXTTYPE = %#x (%s)\n", exttype, gettlsExtensionName(uint(exttype)))
-
-							// Should only apply to extensions returned by server
-							/*							if exttype != TLSEXT_TYPE_signature_algorithms {
-														fmt.Println("WTF")
-													}*/
-
 												inner_len := binary.BigEndian.Uint16(handshakeMsg[hello_offset : hello_offset+2])
 												hello_offset += int(inner_len) + 2
 												ext_ctr += int(inner_len) + 2
@@ -580,6 +591,7 @@ select_loop:
 
 										}
 
+					/*
 										if extlen > 0 {
 											fmt.Printf("ALERT: %v attempting to send extensions; intercepting request\n", SRC)
 											rewrite = true
@@ -606,11 +618,11 @@ select_loop:
 											// Write session length 0 at the end
 											rewrite_buf[len(rewrite_buf)-1] = 0
 											rewrite_buf[len(rewrite_buf)-2] = 0
-					}
+										} */
 
 					sendbuf := cr.data
 
-					if rewrite {
+					/*					if rewrite {
 											sendbuf = rewrite_buf
 										}
 
@@ -637,7 +649,7 @@ select_loop:
 											fmt.Println("TLSGuard writing back modified handshake data to server")
 											fmt.Printf("ORIGINAL[%d]: %v\n", len(cr.data), hex.Dump(cr.data))
 											fmt.Printf("NEW[%d]: %v\n", len(rewrite_buf), hex.Dump(rewrite_buf))
-					}
+										} */
 
 					other.Write(sendbuf)
 					continue
@@ -661,10 +673,6 @@ select_loop:
 					fmt.Println("WTF: ", cr.data)
 				}
 
-				// Message len, 3 bytes
-				handshakeMessageLen := handshakeMsg[1:4]
-				handshakeMessageLenInt := int(int(handshakeMessageLen[0])<<16 | int(handshakeMessageLen[1])<<8 | int(handshakeMessageLen[2]))
-
 				if s == SSL3_MT_CERTIFICATE {
 					fmt.Println("HMM")
 					// fmt.Printf("chunk len = %v, handshakeMsgLen = %v, slint = %v\n", len(chunk), len(handshakeMsg), handshakeMessageLenInt)