TlsIntercept Namespace Reference

Namespaces
namespace	detail

Functions
static void	set_no_expiry (X509 *cert)
static void	set_realistic_validity (X509 *cert)
static std::string	extract_path_from_request (const std::string &raw)
static std::shared_ptr< asio::ssl::context >	make_stealth_upstream_ctx (const std::string &host)
static std::string	lower_ascii (std::string v)
static std::string	trim_ascii (std::string v)
static std::string	request_method_from_raw (const std::string &raw)
static std::string	header_value_ci (const std::string &raw, const std::string &wanted)
static bool	is_stateful_method (const std::string &method_l)
static bool	is_speculative_request (const std::string &raw)
static bool	should_passthrough_transaction (const std::string &raw)
static void	send_speculative_no_content (asio::ssl::stream< tcp::socket > &tls)
static bool	parse_content_length (const std::string &raw, std::size_t &out_len)
static bool	is_chunked_request (const std::string &raw)
static bool	read_more (asio::ssl::stream< tcp::socket > &tls, std::string &raw, std::size_t min_total, std::size_t max_total)
static bool	read_complete_chunked (asio::ssl::stream< tcp::socket > &tls, std::string &raw, std::size_t body_start, std::size_t max_total)
static bool	read_complete_http1_request (asio::ssl::stream< tcp::socket > &tls, std::string &raw)
static std::string	force_connection_close (const std::string &raw)
static bool	forward_transaction_https (asio::ssl::stream< tcp::socket > &client_tls, const std::string &host, std::string raw_request)
static void	send_passthrough_failure (asio::ssl::stream< tcp::socket > &tls)
static void	do_intercept (tcp::socket sock, const std::string &host, const std::string &type, std::function< void(const std::string &)> on_url_ready=nullptr)

Variables
static constexpr long	CTX_CACHE_TTL_SEC = 30L * 24 * 3600

Function Documentation

do_intercept()

void TlsIntercept::do_intercept ( tcp::socket sock, const std::string & host, const std::string & type, std::function< void(const std::string &)> on_url_ready = nullptr )

inlinestatic

Definition at line 827 of file tls_intercept.hpp.

{
    std::cerr << "[tls-intercept] intercepting " << host << "\n";
 
    auto ssl_ctx = detail::get_or_create_ctx(host);
    if (!ssl_ctx) {
        std::cerr << "[tls-intercept] ctx setup failed for " << host << "\n";
        boost::system::error_code ignore;
        sock.close(ignore);
        return;
    }
 
    try {
        asio::ssl::stream<tcp::socket> tls(std::move(sock), *ssl_ctx);
 
        boost::system::error_code hs_ec;
        tls.handshake(asio::ssl::stream_base::server, hs_ec);
        if (hs_ec) {
            std::cerr << "[tls-intercept] handshake failed for " << host
                      << ": " << hs_ec.message() << "\n";
            boost::system::error_code ignore;
            tls.lowest_layer().close(ignore);
            return;
        }
 
        std::cerr << "[tls-intercept] handshake ok for " << host << "\n";
 
        asio::streambuf rbuf;
        boost::system::error_code read_ec;
        asio::read_until(tls, rbuf, "\r\n\r\n", read_ec);
        if (read_ec) {
            std::cerr << "[tls-intercept] request header read failed for " << host
                      << ": " << read_ec.message() << "\n";
            boost::system::error_code ignore;
            tls.lowest_layer().close(ignore);
            return;
        }
 
        const std::string raw{
            asio::buffers_begin(rbuf.data()),
            asio::buffers_end(rbuf.data())
        };
 
        // Le richieste speculative non devono neppure raggiungere il sito:
        // non aprono CEF e non consumano una challenge/controllo anti-abuso.
        // La navigazione reale successiva (con user activation) verra' gestita
        // normalmente.
        if (is_speculative_request(raw)) {
            const std::string method = request_method_from_raw(raw);
            const std::string dest = lower_ascii(header_value_ci(raw, "sec-fetch-dest"));
            std::cerr << "[tls-intercept] speculative request suppressed: host=" << host
                      << " method=" << method << " dest=" << dest << "\n";
            send_speculative_no_content(tls);
 
            boost::system::error_code sd_ec;
            tls.shutdown(sd_ec);
            boost::system::error_code ignore;
            tls.lowest_layer().close(ignore);
            return;
        }
 
        if (should_passthrough_transaction(raw)) {
            const std::string method = request_method_from_raw(raw);
            const std::string dest = lower_ascii(header_value_ci(raw, "sec-fetch-dest"));
            const std::string mode = lower_ascii(header_value_ci(raw, "sec-fetch-mode"));
            const std::string user = trim_ascii(header_value_ci(raw, "sec-fetch-user"));
            std::cerr << "[tls-intercept] passthrough (subresource/stateful/automatic): host=" << host
                      << " method=" << method
                      << " dest=" << dest
                      << " mode=" << mode
                      << " user=" << (user.empty() ? "<none>" : user)
                      << "\n";
            if (!forward_transaction_https(tls, host, raw))
                send_passthrough_failure(tls);
 
            boost::system::error_code sd_ec;
            tls.shutdown(sd_ec);
            boost::system::error_code ignore;
            tls.lowest_layer().close(ignore);
            return;
        }
 
        // Solo una vera navigazione top-level GET/HEAD viene trasformata in
        // apertura SecureBrowser. Il callback NON viene chiamato per iframe,
        // fetch/XHR o POST, quindi nessuna sessione/gate fittizia viene creata.
        if (on_url_ready) {
            const std::string path = extract_path_from_request(raw);
            const std::string full_url = "https://" + host + path;
            std::cerr << "[tls-intercept] top-level secure URL: " << full_url << "\n";
            on_url_ready(full_url);
        }
 
        const std::string resp = detail::make_tls_response(host, type);
        boost::system::error_code write_ec;
        asio::write(tls, asio::buffer(resp), write_ec);
 
        if (write_ec)
            std::cerr << "[tls-intercept] write error for " << host
                      << ": " << write_ec.message() << "\n";
        else
            std::cerr << "[tls-intercept] page served for " << host << "\n";
 
        boost::system::error_code sd_ec;
        tls.shutdown(sd_ec);
        boost::system::error_code ignore;
        tls.lowest_layer().close(ignore);
 
    } catch (const std::exception& e) {
        std::cerr << "[tls-intercept] exception for " << host
                  << ": " << e.what() << "\n";
        boost::system::error_code ignore;
        sock.close(ignore);
    }
}

References do_intercept(), extract_path_from_request(), forward_transaction_https(), TlsIntercept::detail::get_or_create_ctx(), header_value_ci(), is_speculative_request(), lower_ascii(), TlsIntercept::detail::make_tls_response(), request_method_from_raw(), send_passthrough_failure(), send_speculative_no_content(), should_passthrough_transaction(), and trim_ascii().

Referenced by do_intercept().

extract_path_from_request()

std::string TlsIntercept::extract_path_from_request ( const std::string & raw )

inlinestatic

Definition at line 389 of file tls_intercept.hpp.

                                                                        {
    // Cerca la prima riga (fino a \r\n o \n)
    const auto eol = raw.find('\n');
    const std::string line = (eol != std::string::npos)
        ? raw.substr(0, eol) : raw;
 
 
    const auto s1 = line.find(' ');
    if (s1 == std::string::npos) return "/";
    const auto s2 = line.find(' ', s1 + 1);
    const std::string path = (s2 != std::string::npos)
        ? line.substr(s1 + 1, s2 - s1 - 1)
        : line.substr(s1 + 1);
 
    if (!path.empty() && path.back() == '\r')
        return path.substr(0, path.size() - 1);
 
    return path.empty() ? "/" : path;
}

References extract_path_from_request().

Referenced by do_intercept(), and extract_path_from_request().

force_connection_close()

std::string TlsIntercept::force_connection_close ( const std::string & raw )

inlinestatic

Definition at line 716 of file tls_intercept.hpp.

                                                                     {
    const auto hdr_end = raw.find("\r\n\r\n");
    if (hdr_end == std::string::npos) return raw;
 
    const std::string headers = raw.substr(0, hdr_end);
    const std::string body = raw.substr(hdr_end + 4);
    std::istringstream in(headers);
    std::ostringstream out;
    std::string line;
    bool first = true;
    while (std::getline(in, line)) {
        if (!line.empty() && line.back() == '\r') line.pop_back();
        if (first) {
            out << line << "\r\n";
            first = false;
            continue;
        }
        const auto colon = line.find(':');
        const std::string name = colon == std::string::npos
            ? std::string{} : lower_ascii(trim_ascii(line.substr(0, colon)));
        if (name == "connection" || name == "proxy-connection" || name == "keep-alive")
            continue;
        out << line << "\r\n";
    }
    out << "Connection: close\r\n\r\n";
    out << body;
    return out.str();
}

References force_connection_close(), lower_ascii(), and trim_ascii().

Referenced by force_connection_close(), and forward_transaction_https().

forward_transaction_https()

bool TlsIntercept::forward_transaction_https ( asio::ssl::stream< tcp::socket > & client_tls, const std::string & host, std::string raw_request )

inlinestatic

Definition at line 745 of file tls_intercept.hpp.

                                                                    {
    if (!read_complete_http1_request(client_tls, raw_request)) {
        std::cerr << "[tls-intercept] transaction request incomplete/too large for "
                  << host << "\n";
        return false;
    }
 
    raw_request = force_connection_close(raw_request);
 
    try {
        asio::io_context io;
        tcp::resolver resolver(io);
        auto endpoints = resolver.resolve(host, "443");
        tcp::socket upstream_socket(io);
        asio::connect(upstream_socket, endpoints);
 
        auto upstream_ctx = make_stealth_upstream_ctx(host);
        asio::ssl::stream<tcp::socket> upstream(std::move(upstream_socket), *upstream_ctx);
 
        SSL* ssl = upstream.native_handle();
        if (SSL_set_tlsext_host_name(ssl, host.c_str()) != 1) {
            std::cerr << "[tls-intercept] SNI setup failed for " << host << "\n";
            return false;
        }
        X509_VERIFY_PARAM* param = SSL_get0_param(ssl);
        X509_VERIFY_PARAM_set_hostflags(param, X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);
        if (X509_VERIFY_PARAM_set1_host(param, host.c_str(), 0) != 1) {
            std::cerr << "[tls-intercept] hostname verification setup failed for "
                      << host << "\n";
            return false;
        }
 
        upstream.set_verify_mode(asio::ssl::verify_peer);
        upstream.handshake(asio::ssl::stream_base::client);
 
        asio::write(upstream, asio::buffer(raw_request));
 
        std::array<char, 64 * 1024> buf{};
        for (;;) {
            boost::system::error_code rec;
            const std::size_t n = upstream.read_some(asio::buffer(buf), rec);
            if (n) {
                boost::system::error_code wec;
                asio::write(client_tls, asio::buffer(buf.data(), n), wec);
                if (wec) return false;
            }
            if (rec) {
                if (rec != asio::error::eof &&
                    rec != asio::ssl::error::stream_truncated) {
                    std::cerr << "[tls-intercept] upstream read failed for " << host
                              << ": " << rec.message() << "\n";
                }
                break;
            }
        }
 
        boost::system::error_code sd_ec;
        upstream.shutdown(sd_ec);
        return true;
    } catch (const std::exception& e) {
        std::cerr << "[tls-intercept] transaction passthrough failed for " << host
                  << ": " << e.what() << "\n";
        return false;
    }
}

References force_connection_close(), forward_transaction_https(), make_stealth_upstream_ctx(), and read_complete_http1_request().

Referenced by do_intercept(), and forward_transaction_https().

header_value_ci()

std::string TlsIntercept::header_value_ci ( const std::string & raw, const std::string & wanted )

inlinestatic

Definition at line 497 of file tls_intercept.hpp.

                                                                   {
    const std::string wanted_l = lower_ascii(wanted);
    const auto first_eol = raw.find("\r\n");
    if (first_eol == std::string::npos) return {};
    std::size_t pos = first_eol + 2;
 
    while (pos < raw.size()) {
        const auto eol = raw.find("\r\n", pos);
        if (eol == std::string::npos || eol == pos) break;
        const auto colon = raw.find(':', pos);
        if (colon != std::string::npos && colon < eol) {
            std::string name = lower_ascii(raw.substr(pos, colon - pos));
            if (name == wanted_l)
                return trim_ascii(raw.substr(colon + 1, eol - colon - 1));
        }
        pos = eol + 2;
    }
    return {};
}

References header_value_ci(), lower_ascii(), and trim_ascii().

Referenced by do_intercept(), header_value_ci(), is_chunked_request(), is_speculative_request(), parse_content_length(), and should_passthrough_transaction().

is_chunked_request()

bool TlsIntercept::is_chunked_request ( const std::string & raw )

inlinestatic

Definition at line 619 of file tls_intercept.hpp.

                                                            {
    const std::string te = lower_ascii(header_value_ci(raw, "transfer-encoding"));
    return te.find("chunked") != std::string::npos;
}

References header_value_ci(), is_chunked_request(), and lower_ascii().

Referenced by is_chunked_request(), and read_complete_http1_request().

is_speculative_request()

bool TlsIntercept::is_speculative_request ( const std::string & raw )

inlinestatic

Definition at line 526 of file tls_intercept.hpp.

                                                                {
    const std::string purpose = lower_ascii(header_value_ci(raw, "purpose"));
    const std::string sec_purpose = lower_ascii(header_value_ci(raw, "sec-purpose"));
    return purpose.find("prefetch") != std::string::npos ||
           sec_purpose.find("prefetch") != std::string::npos ||
           purpose.find("prerender") != std::string::npos ||
           sec_purpose.find("prerender") != std::string::npos;
}

References header_value_ci(), is_speculative_request(), and lower_ascii().

Referenced by do_intercept(), is_speculative_request(), and should_passthrough_transaction().

is_stateful_method()

bool TlsIntercept::is_stateful_method ( const std::string & method_l )

inlinestatic

Definition at line 518 of file tls_intercept.hpp.

                                                                 {
    return !(method_l == "get" || method_l == "head" || method_l == "options");
}

References is_stateful_method().

Referenced by is_stateful_method(), and should_passthrough_transaction().

lower_ascii()

std::string TlsIntercept::lower_ascii ( std::string v )

inlinestatic

Definition at line 475 of file tls_intercept.hpp.

                                                 {
    std::transform(v.begin(), v.end(), v.begin(),
        [](unsigned char c) { return static_cast<char>(std::tolower(c)); });
    return v;
}

References lower_ascii().

Referenced by do_intercept(), force_connection_close(), header_value_ci(), is_chunked_request(), is_speculative_request(), lower_ascii(), request_method_from_raw(), and should_passthrough_transaction().

make_stealth_upstream_ctx()

std::shared_ptr< asio::ssl::context > TlsIntercept::make_stealth_upstream_ctx ( const std::string & host )

inlinestatic

Definition at line 410 of file tls_intercept.hpp.

{
    auto ctx = std::make_shared<asio::ssl::context>(asio::ssl::context::tls_client);
    SSL_CTX* native = ctx->native_handle();
 
    // Disabilita protocolli obsoleti e opzioni che non usa Chrome
    SSL_CTX_set_options(native,
        SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 |
        SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1 |
        SSL_OP_NO_COMPRESSION);
 
    SSL_CTX_set_min_proto_version(native, TLS1_2_VERSION);
 
    SSL_CTX_set_cipher_list(native,
        "TLS_AES_128_GCM_SHA256:"
        "TLS_AES_256_GCM_SHA384:"
        "TLS_CHACHA20_POLY1305_SHA256:"
        "ECDHE-ECDSA-AES128-GCM-SHA256:"
        "ECDHE-RSA-AES128-GCM-SHA256:"
        "ECDHE-ECDSA-AES256-GCM-SHA384:"
        "ECDHE-RSA-AES256-GCM-SHA384:"
        "ECDHE-ECDSA-CHACHA20-POLY1305:"
        "ECDHE-RSA-CHACHA20-POLY1305:"
        "ECDHE-RSA-AES128-SHA:"
        "ECDHE-RSA-AES256-SHA:"
        "AES128-GCM-SHA256:"
        "AES256-GCM-SHA384:"
        "AES128-SHA:"
        "AES256-SHA");
 
#ifdef TLS1_3_VERSION
    SSL_CTX_set_ciphersuites(native,
        "TLS_AES_128_GCM_SHA256:"
        "TLS_AES_256_GCM_SHA384:"
        "TLS_CHACHA20_POLY1305_SHA256");
#endif
    // Il proxy trasparente sotto usa HTTP/1.1 byte-for-byte. Non negoziare
    // h2 upstream: inviare una request HTTP/1.1 su una connessione ALPN h2
    // corromperebbe il flusso.
    static const unsigned char alpn[] = "\x08http/1.1";
    SSL_CTX_set_alpn_protos(native, alpn, sizeof(alpn) - 1);
    SSL_CTX_set_default_verify_paths(native);
    SSL_CTX_set_verify(native, SSL_VERIFY_PEER, nullptr);
    (void)host;
 
    return ctx;
}

References make_stealth_upstream_ctx().

Referenced by forward_transaction_https(), and make_stealth_upstream_ctx().

parse_content_length()

bool TlsIntercept::parse_content_length ( const std::string & raw, std::size_t & out_len )

inlinestatic

Definition at line 604 of file tls_intercept.hpp.

                                                            {
    const std::string v = trim_ascii(header_value_ci(raw, "content-length"));
    if (v.empty()) return false;
    errno = 0;
    char* end = nullptr;
    const unsigned long long n = std::strtoull(v.c_str(), &end, 10);
    if (errno != 0 || end == v.c_str() || (end && *end != '\0') ||
        n > std::numeric_limits<std::size_t>::max()) {
        return false;
    }
    out_len = static_cast<std::size_t>(n);
    return true;
}

References header_value_ci(), parse_content_length(), and trim_ascii().

Referenced by parse_content_length(), and read_complete_http1_request().

read_complete_chunked()

bool TlsIntercept::read_complete_chunked ( asio::ssl::stream< tcp::socket > & tls, std::string & raw, std::size_t body_start, std::size_t max_total )

inlinestatic

Definition at line 640 of file tls_intercept.hpp.

                                                              {
    std::size_t cur = body_start;
    std::array<char, 16 * 1024> buf{};
 
    auto ensure_line = [&](std::size_t from, std::size_t& eol) -> bool {
        for (;;) {
            eol = raw.find("\r\n", from);
            if (eol != std::string::npos) return true;
            if (raw.size() >= max_total) return false;
            boost::system::error_code ec;
            const std::size_t room = std::min<std::size_t>(buf.size(), max_total - raw.size());
            const std::size_t n = tls.read_some(asio::buffer(buf.data(), room), ec);
            if (n) raw.append(buf.data(), n);
            if (ec) return false;
        }
    };
 
    for (;;) {
        std::size_t eol = 0;
        if (!ensure_line(cur, eol)) return false;
        std::string size_line = raw.substr(cur, eol - cur);
        const auto semi = size_line.find(';');
        if (semi != std::string::npos) size_line.erase(semi);
        size_line = trim_ascii(size_line);
        if (size_line.empty()) return false;
 
        errno = 0;
        char* end = nullptr;
        const unsigned long long chunk = std::strtoull(size_line.c_str(), &end, 16);
        if (errno != 0 || end == size_line.c_str() || (end && *end != '\0') ||
            chunk > max_total) {
            return false;
        }
 
        cur = eol + 2;
        if (chunk == 0) {
            // Trailer section: zero o piu' header, terminati da una riga vuota.
            for (;;) {
                if (!ensure_line(cur, eol)) return false;
                if (eol == cur) return true;
                cur = eol + 2;
            }
        }
 
        const std::size_t need = cur + static_cast<std::size_t>(chunk) + 2;
        if (need < cur || need > max_total) return false;
        if (!read_more(tls, raw, need, max_total)) return false;
        if (raw.compare(cur + static_cast<std::size_t>(chunk), 2, "\r\n") != 0)
            return false;
        cur = need;
    }
}

References read_complete_chunked(), read_more(), and trim_ascii().

Referenced by read_complete_chunked(), and read_complete_http1_request().

read_complete_http1_request()

bool TlsIntercept::read_complete_http1_request ( asio::ssl::stream< tcp::socket > & tls, std::string & raw )

inlinestatic

Definition at line 696 of file tls_intercept.hpp.

                                                               {
    static constexpr std::size_t MAX_REQUEST = 32u * 1024u * 1024u;
    const auto hdr_end_pos = raw.find("\r\n\r\n");
    if (hdr_end_pos == std::string::npos) return false;
    const std::size_t body_start = hdr_end_pos + 4;
 
    std::size_t content_len = 0;
    if (parse_content_length(raw, content_len)) {
        if (content_len > MAX_REQUEST || body_start > MAX_REQUEST - content_len)
            return false;
        return read_more(tls, raw, body_start + content_len, MAX_REQUEST);
    }
 
    if (is_chunked_request(raw))
        return read_complete_chunked(tls, raw, body_start, MAX_REQUEST);
 
    return true;
}

References is_chunked_request(), parse_content_length(), read_complete_chunked(), read_complete_http1_request(), and read_more().

Referenced by forward_transaction_https(), and read_complete_http1_request().

read_more()

bool TlsIntercept::read_more ( asio::ssl::stream< tcp::socket > & tls, std::string & raw, std::size_t min_total, std::size_t max_total )

inlinestatic

Definition at line 624 of file tls_intercept.hpp.

                                                  {
    std::array<char, 16 * 1024> buf{};
    while (raw.size() < min_total) {
        if (raw.size() >= max_total) return false;
        boost::system::error_code ec;
        const std::size_t room = std::min<std::size_t>(buf.size(), max_total - raw.size());
        const std::size_t n = tls.read_some(asio::buffer(buf.data(), room), ec);
        if (n) raw.append(buf.data(), n);
        if (ec) return false;
    }
    return true;
}

References read_more().

Referenced by read_complete_chunked(), read_complete_http1_request(), and read_more().

request_method_from_raw()

std::string TlsIntercept::request_method_from_raw ( const std::string & raw )

inlinestatic

Definition at line 489 of file tls_intercept.hpp.

                                                                      {
    const auto eol = raw.find("\r\n");
    const std::string line = raw.substr(0, eol);
    const auto sp = line.find(' ');
    if (sp == std::string::npos) return {};
    return lower_ascii(line.substr(0, sp));
}

References lower_ascii(), and request_method_from_raw().

Referenced by do_intercept(), request_method_from_raw(), and should_passthrough_transaction().

send_passthrough_failure()

void TlsIntercept::send_passthrough_failure ( asio::ssl::stream< tcp::socket > & tls )

inlinestatic

Definition at line 813 of file tls_intercept.hpp.

                                                                           {
    static constexpr char body[] = "BastionGuard: upstream secure transaction failed\n";
    std::ostringstream oss;
    oss << "HTTP/1.1 502 Bad Gateway\r\n"
        << "Content-Type: text/plain; charset=UTF-8\r\n"
        << "Content-Length: " << (sizeof(body) - 1) << "\r\n"
        << "Cache-Control: no-store\r\n"
        << "Connection: close\r\n\r\n"
        << body;
    const std::string resp = oss.str();
    boost::system::error_code ec;
    asio::write(tls, asio::buffer(resp), ec);
}

References send_passthrough_failure().

Referenced by do_intercept(), and send_passthrough_failure().

send_speculative_no_content()

void TlsIntercept::send_speculative_no_content ( asio::ssl::stream< tcp::socket > & tls )

inlinestatic

Definition at line 590 of file tls_intercept.hpp.

                                                                              {
    static const char kResponse[] =
        "HTTP/1.1 204 No Content\r\n"
        "Cache-Control: no-store\r\n"
        "Content-Length: 0\r\n"
        "Connection: close\r\n"
        "\r\n";
    boost::system::error_code ec;
    asio::write(tls, asio::buffer(kResponse, sizeof(kResponse) - 1), ec);
    if (ec)
        std::cerr << "[tls-intercept] speculative response write failed: "
                  << ec.message() << "\n";
}

References send_speculative_no_content().

Referenced by do_intercept(), and send_speculative_no_content().

set_no_expiry()

void TlsIntercept::set_no_expiry ( X509 * cert )

inlinestatic

Definition at line 65 of file tls_intercept.hpp.

                                             {
    ASN1_TIME* not_after = X509_getm_notAfter(cert);
    ASN1_GENERALIZEDTIME_set_string(not_after, "99991231235959Z");
}

References set_no_expiry().

Referenced by TlsIntercept::detail::generate_ca(), and set_no_expiry().

set_realistic_validity()

void TlsIntercept::set_realistic_validity ( X509 * cert )

inlinestatic

Definition at line 70 of file tls_intercept.hpp.

                                                      {
    X509_gmtime_adj(X509_getm_notBefore(cert), -43200L);
    X509_gmtime_adj(X509_getm_notAfter(cert), 397L * 24 * 3600);
}

References set_realistic_validity().

Referenced by TlsIntercept::detail::make_ssl_ctx_for_host(), and set_realistic_validity().

should_passthrough_transaction()

bool TlsIntercept::should_passthrough_transaction ( const std::string & raw )

inlinestatic

Definition at line 535 of file tls_intercept.hpp.

                                                                        {
    const std::string method = request_method_from_raw(raw);
    if (method.empty()) return false; // fail verso il comportamento storico
 
    // Mai trasformare una POST/PUT/PATCH/DELETE in una GET dentro un altro
    // browser: perderemmo i dati della transazione.
    if (is_stateful_method(method)) return true;
 
    const std::string dest = lower_ascii(header_value_ci(raw, "sec-fetch-dest"));
    if (dest == "iframe" || dest == "frame" || dest == "embed" ||
        dest == "object" || dest == "empty" || dest == "script" ||
        dest == "style" || dest == "image" || dest == "font" ||
        dest == "audio" || dest == "video" || dest == "track" ||
        dest == "worker" || dest == "sharedworker" ||
        dest == "serviceworker" || dest == "manifest") {
        return true;
    }
 
    const std::string mode = lower_ascii(header_value_ci(raw, "sec-fetch-mode"));
    if (mode == "cors" || mode == "no-cors" || mode == "same-origin" ||
        mode == "websocket") {
        return true;
    }
 
    // Difesa in profondita': nel path normale queste richieste vengono
    // soppresse prima di arrivare qui. Se la funzione viene riusata altrove,
    // restano comunque non eleggibili per l'apertura CEF.
    if (is_speculative_request(raw))
        return true;
 
    // Una vera apertura automatica del Secure Browser deve corrispondere a
    // una navigazione top-level iniziata dall'utente. I browser moderni
    // aggiungono `Sec-Fetch-User: ?1` solo quando la navigazione deriva da
    // user activation (click, invio esplicito, barra indirizzi, bookmark).
    //
    // Se Fetch Metadata e' presente ma Sec-Fetch-User manca, si tratta di una
    // navigazione automatica (redirect/script/meta refresh/autosubmit GET):
    // non generiamo una seconda sessione CEF. La richiesta resta nel contesto
    // del browser che l'ha originata e mantiene cookie/sessione/redirect chain.
    //
    // Compatibilita': se Fetch Metadata manca completamente, manteniamo il
    // comportamento storico e lasciamo che la navigazione apra CEF. Questo
    // evita di rompere client/browser che non implementano Sec-Fetch-*.
    const bool has_fetch_metadata = !dest.empty() || !mode.empty();
    if (has_fetch_metadata && dest == "document" && mode == "navigate") {
        const std::string user = trim_ascii(header_value_ci(raw, "sec-fetch-user"));
        if (user != "?1")
            return true;
    }
 
    // document+navigate+Sec-Fetch-User:?1, oppure header Fetch Metadata
    // completamente assenti: conserva il comportamento top-level esistente.
    return false;
}

References header_value_ci(), is_speculative_request(), is_stateful_method(), lower_ascii(), request_method_from_raw(), should_passthrough_transaction(), and trim_ascii().

Referenced by do_intercept(), and should_passthrough_transaction().

trim_ascii()

std::string TlsIntercept::trim_ascii ( std::string v )

inlinestatic

Definition at line 481 of file tls_intercept.hpp.

                                                {
    while (!v.empty() && std::isspace(static_cast<unsigned char>(v.front())))
        v.erase(v.begin());
    while (!v.empty() && std::isspace(static_cast<unsigned char>(v.back())))
        v.pop_back();
    return v;
}

References trim_ascii().

Referenced by do_intercept(), force_connection_close(), header_value_ci(), parse_content_length(), read_complete_chunked(), should_passthrough_transaction(), and trim_ascii().

Variable Documentation

CTX_CACHE_TTL_SEC

long TlsIntercept::CTX_CACHE_TTL_SEC = 30L * 24 * 3600

staticconstexpr

Definition at line 63 of file tls_intercept.hpp.

Referenced by TlsIntercept::detail::get_or_create_ctx().