2 This example code shows how to write an (optionally encrypting) SSL proxy
3 with Libevent's bufferevent layer.
5 XXX It's a little ugly and should probably be cleaned up.
18 #include <sys/socket.h>
19 #include <netinet/in.h>
22 #include <event2/bufferevent_ssl.h>
23 #include <event2/bufferevent.h>
24 #include <event2/buffer.h>
25 #include <event2/listener.h>
26 #include <event2/util.h>
28 #include <openssl/ssl.h>
29 #include <openssl/err.h>
30 #include <openssl/rand.h>
32 static struct event_base
*base
;
33 static struct sockaddr_storage listen_on_addr
;
34 static struct sockaddr_storage connect_to_addr
;
35 static int connect_to_addrlen
;
36 static int use_wrapper
= 1;
38 static SSL_CTX
*ssl_ctx
= NULL
;
40 #define MAX_OUTPUT (512*1024)
42 static void drained_writecb(struct bufferevent
*bev
, void *ctx
);
43 static void eventcb(struct bufferevent
*bev
, short what
, void *ctx
);
46 readcb(struct bufferevent
*bev
, void *ctx
)
48 struct bufferevent
*partner
= ctx
;
49 struct evbuffer
*src
, *dst
;
51 src
= bufferevent_get_input(bev
);
52 len
= evbuffer_get_length(src
);
54 evbuffer_drain(src
, len
);
57 dst
= bufferevent_get_output(partner
);
58 evbuffer_add_buffer(dst
, src
);
60 if (evbuffer_get_length(dst
) >= MAX_OUTPUT
) {
61 /* We're giving the other side data faster than it can
62 * pass it on. Stop reading here until we have drained the
63 * other side to MAX_OUTPUT/2 bytes. */
64 bufferevent_setcb(partner
, readcb
, drained_writecb
,
66 bufferevent_setwatermark(partner
, EV_WRITE
, MAX_OUTPUT
/2,
68 bufferevent_disable(bev
, EV_READ
);
73 drained_writecb(struct bufferevent
*bev
, void *ctx
)
75 struct bufferevent
*partner
= ctx
;
77 /* We were choking the other side until we drained our outbuf a bit.
78 * Now it seems drained. */
79 bufferevent_setcb(bev
, readcb
, NULL
, eventcb
, partner
);
80 bufferevent_setwatermark(bev
, EV_WRITE
, 0, 0);
82 bufferevent_enable(partner
, EV_READ
);
86 close_on_finished_writecb(struct bufferevent
*bev
, void *ctx
)
88 struct evbuffer
*b
= bufferevent_get_output(bev
);
90 if (evbuffer_get_length(b
) == 0) {
91 bufferevent_free(bev
);
96 eventcb(struct bufferevent
*bev
, short what
, void *ctx
)
98 struct bufferevent
*partner
= ctx
;
100 if (what
& (BEV_EVENT_EOF
|BEV_EVENT_ERROR
)) {
101 if (what
& BEV_EVENT_ERROR
) {
103 while ((err
= (bufferevent_get_openssl_error(bev
)))) {
104 const char *msg
= (const char*)
105 ERR_reason_error_string(err
);
106 const char *lib
= (const char*)
107 ERR_lib_error_string(err
);
108 const char *func
= (const char*)
109 ERR_func_error_string(err
);
111 "%s in %s %s\n", msg
, lib
, func
);
114 perror("connection error");
118 /* Flush all pending data */
121 if (evbuffer_get_length(
122 bufferevent_get_output(partner
))) {
123 /* We still have to flush data from the other
124 * side, but when that's done, close the other
126 bufferevent_setcb(partner
,
127 NULL
, close_on_finished_writecb
,
129 bufferevent_disable(partner
, EV_READ
);
131 /* We have nothing left to say to the other
133 bufferevent_free(partner
);
136 bufferevent_free(bev
);
143 fputs("Syntax:\n", stderr
);
144 fputs(" le-proxy [-s] [-W] <listen-on-addr> <connect-to-addr>\n", stderr
);
145 fputs("Example:\n", stderr
);
146 fputs(" le-proxy 127.0.0.1:8888 1.2.3.4:80\n", stderr
);
152 accept_cb(struct evconnlistener
*listener
, evutil_socket_t fd
,
153 struct sockaddr
*a
, int slen
, void *p
)
155 struct bufferevent
*b_out
, *b_in
;
156 /* Create two linked bufferevent objects: one to connect, one for the
158 b_in
= bufferevent_socket_new(base
, fd
,
159 BEV_OPT_CLOSE_ON_FREE
|BEV_OPT_DEFER_CALLBACKS
);
161 if (!ssl_ctx
|| use_wrapper
)
162 b_out
= bufferevent_socket_new(base
, -1,
163 BEV_OPT_CLOSE_ON_FREE
|BEV_OPT_DEFER_CALLBACKS
);
165 SSL
*ssl
= SSL_new(ssl_ctx
);
166 b_out
= bufferevent_openssl_socket_new(base
, -1, ssl
,
167 BUFFEREVENT_SSL_CONNECTING
,
168 BEV_OPT_CLOSE_ON_FREE
|BEV_OPT_DEFER_CALLBACKS
);
171 assert(b_in
&& b_out
);
173 if (bufferevent_socket_connect(b_out
,
174 (struct sockaddr
*)&connect_to_addr
, connect_to_addrlen
)<0) {
175 perror("bufferevent_socket_connect");
176 bufferevent_free(b_out
);
177 bufferevent_free(b_in
);
181 if (ssl_ctx
&& use_wrapper
) {
182 struct bufferevent
*b_ssl
;
183 SSL
*ssl
= SSL_new(ssl_ctx
);
184 b_ssl
= bufferevent_openssl_filter_new(base
,
185 b_out
, ssl
, BUFFEREVENT_SSL_CONNECTING
,
186 BEV_OPT_CLOSE_ON_FREE
|BEV_OPT_DEFER_CALLBACKS
);
188 perror("Bufferevent_openssl_new");
189 bufferevent_free(b_out
);
190 bufferevent_free(b_in
);
195 bufferevent_setcb(b_in
, readcb
, NULL
, eventcb
, b_out
);
196 bufferevent_setcb(b_out
, readcb
, NULL
, eventcb
, b_in
);
198 bufferevent_enable(b_in
, EV_READ
|EV_WRITE
);
199 bufferevent_enable(b_out
, EV_READ
|EV_WRITE
);
203 main(int argc
, char **argv
)
209 struct evconnlistener
*listener
;
214 for (i
=1; i
< argc
; ++i
) {
215 if (!strcmp(argv
[i
], "-s")) {
217 } else if (!strcmp(argv
[i
], "-W")) {
219 } else if (argv
[i
][0] == '-') {
228 memset(&listen_on_addr
, 0, sizeof(listen_on_addr
));
229 socklen
= sizeof(listen_on_addr
);
230 if (evutil_parse_sockaddr_port(argv
[i
],
231 (struct sockaddr
*)&listen_on_addr
, &socklen
)<0) {
232 int p
= atoi(argv
[i
]);
233 struct sockaddr_in
*sin
= (struct sockaddr_in
*)&listen_on_addr
;
234 if (p
< 1 || p
> 65535)
236 sin
->sin_port
= htons(p
);
237 sin
->sin_addr
.s_addr
= htonl(0x7f000001);
238 sin
->sin_family
= AF_INET
;
239 socklen
= sizeof(struct sockaddr_in
);
242 memset(&connect_to_addr
, 0, sizeof(connect_to_addr
));
243 connect_to_addrlen
= sizeof(connect_to_addr
);
244 if (evutil_parse_sockaddr_port(argv
[i
+1],
245 (struct sockaddr
*)&connect_to_addr
, &connect_to_addrlen
)<0)
248 base
= event_base_new();
250 perror("event_base_new()");
257 ERR_load_crypto_strings();
258 SSL_load_error_strings();
259 OpenSSL_add_all_algorithms();
262 fprintf(stderr
, "RAND_poll() failed.\n");
265 ssl_ctx
= SSL_CTX_new(SSLv23_method());
268 listener
= evconnlistener_new_bind(base
, accept_cb
, NULL
,
269 LEV_OPT_CLOSE_ON_FREE
|LEV_OPT_CLOSE_ON_EXEC
|LEV_OPT_REUSEABLE
,
270 -1, (struct sockaddr
*)&listen_on_addr
, socklen
);
272 event_base_dispatch(base
);
274 evconnlistener_free(listener
);
275 event_base_free(base
);