Skip to content

Commit c7e8291

Browse files
cookpatecookpate
committed
Add HTTP proxy support to iotcored
Allows MQTT connections on networks where all outbound communication is gated by a proxy server. Tested by running a deployment to a remote tinyproxy server. Configure the network proxy by writing the following configuration object to services/aws.greengrass.NucleusLite/configuration/networkProxy: networkProxy: { noproxy: "192.168.1.1,*.example.com:80", proxy: { url: "http://www.myproxy.io:8888" } } These settings are equivalent to setting no_proxy and https_proxy environment variables for OpenSSl
1 parent 61a7501 commit c7e8291

File tree

3 files changed

+89
-90
lines changed

3 files changed

+89
-90
lines changed

‎bins/iotcored/bin/iotcored.c

-16
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,7 @@
55
#include "iotcored.h"
66
#include <argp.h>
77
#include <ggl/error.h>
8-
#include <ggl/log.h>
98
#include <ggl/version.h>
10-
#include <stdlib.h>
119

1210
__attribute__((visibility("default"))) const char *argp_program_version
1311
= GGL_VERSION;
@@ -59,20 +57,6 @@ static struct argp argp = { opts, arg_parser, 0, doc, 0, 0, 0 };
5957
int main(int argc, char **argv) {
6058
static IotcoredArgs args = { 0 };
6159

62-
// NOLINTBEGIN(concurrency-mt-unsafe)
63-
char *proxy_uri = proxy_uri = getenv("https_proxy");
64-
if (proxy_uri == NULL) {
65-
proxy_uri = getenv("HTTPS_PROXY");
66-
}
67-
args.proxy_uri = proxy_uri;
68-
69-
char *no_proxy = getenv("no_proxy");
70-
if (no_proxy == NULL) {
71-
no_proxy = getenv("NO_PROXY");
72-
}
73-
args.no_proxy = no_proxy;
74-
// NOLINTEND(concurrency-mt-unsafe)
75-
7660
// NOLINTNEXTLINE(concurrency-mt-unsafe)
7761
argp_parse(&argp, argc, argv, 0, 0, &args);
7862

‎bins/iotcored/src/entry.c

+82-67
Original file line numberDiff line numberDiff line change
@@ -19,21 +19,89 @@
1919
#define MAX_ENDPOINT_LEN 128
2020
#define MAX_THINGNAME_LEN 128
2121

22-
static bool getenv_copy(char *name, GglBuffer *destination) {
23-
// NOLINTNEXTLINE(concurrency-mt-unsafe)
24-
char *value = getenv(name);
25-
if (value == NULL) {
26-
return false;
22+
static bool get_proxy_variable(GglBufList aliases, GglBuffer *destination) {
23+
for (size_t i = 0; i < aliases.len; ++i) {
24+
char *name = (char *) aliases.bufs[i].data;
25+
if (name == NULL) {
26+
continue;
27+
}
28+
// This is safe as long as getenv is reentrant
29+
// and no other threads call setenv.
30+
// NOLINTNEXTLINE(concurrency-mt-unsafe)
31+
char *value = getenv(name);
32+
if (value == NULL) {
33+
continue;
34+
}
35+
GglBuffer source = ggl_buffer_from_null_term(value);
36+
if (source.len >= destination->len) {
37+
GGL_LOGW("%s too long.", name);
38+
continue;
39+
}
40+
memcpy(destination->data, source.data, source.len);
41+
destination->len = source.len;
42+
destination->data[destination->len] = '\0';
43+
return true;
2744
}
28-
GglBuffer source = ggl_buffer_from_null_term(value);
29-
if (source.len >= destination->len) {
30-
GGL_LOGW("%s too long.", name);
31-
return false;
45+
return false;
46+
}
47+
48+
static void set_proxy_args(IotcoredArgs *args) {
49+
static uint8_t proxy_uri_mem[PATH_MAX] = { 0 };
50+
if (args->proxy_uri == NULL) {
51+
GglBuffer proxy_uri = GGL_BUF(proxy_uri_mem);
52+
if (get_proxy_variable(
53+
GGL_BUF_LIST(GGL_STR("https_proxy"), GGL_STR("HTTPS_PROXY")),
54+
&proxy_uri
55+
)) {
56+
args->proxy_uri = (char *) proxy_uri_mem;
57+
}
58+
}
59+
if (args->proxy_uri == NULL) {
60+
GglBuffer proxy_uri = GGL_BUF(proxy_uri_mem);
61+
proxy_uri.len -= 1;
62+
GglError ret = ggl_gg_config_read_str(
63+
GGL_BUF_LIST(
64+
GGL_STR("services"),
65+
GGL_STR("aws.greengrass.NucleusLite"),
66+
GGL_STR("configuration"),
67+
GGL_STR("networkProxy"),
68+
GGL_STR("proxy"),
69+
GGL_STR("url")
70+
),
71+
&proxy_uri
72+
);
73+
if (ret == GGL_ERR_OK) {
74+
args->proxy_uri = (char *) proxy_uri_mem;
75+
}
76+
}
77+
78+
static uint8_t no_proxy_mem[PATH_MAX] = { 0 };
79+
if (args->no_proxy == NULL) {
80+
GglBuffer no_proxy = GGL_BUF(no_proxy_mem);
81+
if (get_proxy_variable(
82+
GGL_BUF_LIST(GGL_STR("no_proxy"), GGL_STR("NO_PROXY")),
83+
&no_proxy
84+
)) {
85+
args->no_proxy = (char *) no_proxy_mem;
86+
}
87+
}
88+
if (args->no_proxy == NULL) {
89+
GglBuffer no_proxy = GGL_BUF(no_proxy_mem);
90+
no_proxy.len -= 1;
91+
GglError ret = ggl_gg_config_read_str(
92+
GGL_BUF_LIST(
93+
GGL_STR("services"),
94+
GGL_STR("aws.greengrass.NucleusLite"),
95+
GGL_STR("configuration"),
96+
GGL_STR("networkProxy"),
97+
GGL_STR("noproxy"),
98+
),
99+
&no_proxy
100+
);
101+
if (ret == GGL_ERR_OK) {
102+
args->no_proxy = (char *) no_proxy_mem;
103+
}
32104
}
33-
memcpy(destination->data, source.data, source.len);
34-
destination->len = source.len;
35-
destination->data[destination->len] = '\0';
36-
return true;
37105
}
38106

39107
GglError run_iotcored(IotcoredArgs *args) {
@@ -114,60 +182,7 @@ GglError run_iotcored(IotcoredArgs *args) {
114182
args->rootca = (char *) rootca_mem;
115183
}
116184

117-
static uint8_t proxy_uri_mem[PATH_MAX] = { 0 };
118-
if (args->proxy_uri == NULL) {
119-
GglBuffer proxy_uri = GGL_BUF(proxy_uri_mem);
120-
if (getenv_copy("https_proxy", &proxy_uri)) {
121-
args->proxy_uri = (char *) proxy_uri_mem;
122-
} else if (getenv_copy("HTTPS_PROXY", &proxy_uri)) {
123-
args->proxy_uri = (char *) proxy_uri_mem;
124-
}
125-
}
126-
if (args->proxy_uri == NULL) {
127-
GglBuffer proxy_uri = GGL_BUF(proxy_uri_mem);
128-
proxy_uri.len -= 1;
129-
GglError ret = ggl_gg_config_read_str(
130-
GGL_BUF_LIST(
131-
GGL_STR("services"),
132-
GGL_STR("aws.greengrass.NucleusLite"),
133-
GGL_STR("configuration"),
134-
GGL_STR("networkProxy"),
135-
GGL_STR("proxy"),
136-
GGL_STR("url")
137-
),
138-
&proxy_uri
139-
);
140-
if (ret == GGL_ERR_OK) {
141-
args->proxy_uri = (char *) proxy_uri_mem;
142-
}
143-
}
144-
145-
static uint8_t no_proxy_mem[PATH_MAX] = { 0 };
146-
if (args->no_proxy == NULL) {
147-
GglBuffer no_proxy = GGL_BUF(no_proxy_mem);
148-
if (getenv_copy("no_proxy", &no_proxy)) {
149-
args->no_proxy = (char *) no_proxy_mem;
150-
} else if (getenv_copy("NO_PROXY", &no_proxy)) {
151-
args->no_proxy = (char *) no_proxy_mem;
152-
}
153-
}
154-
if (args->no_proxy == NULL) {
155-
GglBuffer no_proxy = GGL_BUF(no_proxy_mem);
156-
no_proxy.len -= 1;
157-
GglError ret = ggl_gg_config_read_str(
158-
GGL_BUF_LIST(
159-
GGL_STR("services"),
160-
GGL_STR("aws.greengrass.NucleusLite"),
161-
GGL_STR("configuration"),
162-
GGL_STR("networkProxy"),
163-
GGL_STR("noproxy"),
164-
),
165-
&no_proxy
166-
);
167-
if (ret == GGL_ERR_OK) {
168-
args->no_proxy = (char *) no_proxy_mem;
169-
}
170-
}
185+
set_proxy_args(args);
171186

172187
GglError ret = iotcored_mqtt_connect(args);
173188
if (ret != GGL_ERR_OK) {

‎bins/iotcored/src/tls.c

+7-7
Original file line numberDiff line numberDiff line change
@@ -7,14 +7,11 @@
77
#include "ggl/log.h"
88
#include "iotcored.h"
99
#include <assert.h>
10-
#include <core_mqtt_serializer.h>
1110
#include <ggl/buffer.h>
1211
#include <ggl/bump_alloc.h>
13-
#include <ggl/cleanup.h>
1412
#include <ggl/object.h>
1513
#include <ggl/uri.h>
16-
#include <ggl/vector.h>
17-
#include <linux/limits.h>
14+
#include <limits.h>
1815
#include <openssl/bio.h>
1916
#include <openssl/err.h>
2017
#include <openssl/http.h>
@@ -23,7 +20,6 @@
2320
#include <openssl/x509.h>
2421
#include <string.h>
2522
#include <stdbool.h>
26-
#include <stddef.h>
2723
#include <stdint.h>
2824

2925
// RFC 1035 specifies 255 max octets.
@@ -276,7 +272,6 @@ static GglError iotcored_tls_connect_http_proxy(
276272
GGL_LOGE("Failed to create openssl BIO.");
277273
return GGL_ERR_FATAL;
278274
}
279-
BIO_set_shutdown(mqtt_bio, BIO_NOCLOSE);
280275

281276
// default fallback
282277
if (info.port.len == 0) {
@@ -429,13 +424,18 @@ GglError iotcored_tls_write(IotcoredTlsCtx *ctx, GglBuffer buf) {
429424
void iotcored_tls_cleanup(IotcoredTlsCtx *ctx) {
430425
assert(ctx != NULL);
431426

427+
// Freeing the SSL buffer may attempt to send the shutdown message
428+
// over a closed connection. This may happen when the buffer
429+
// is not the source/sink for network bytes (i.e. running through a proxy)
430+
// This results in an error we will just ignore for now...
431+
ERR_set_mark();
432432
if (ctx->bio != NULL) {
433433
BIO_free_all(ctx->bio);
434434
}
435435
if (ctx->ssl_ctx != NULL) {
436436
SSL_CTX_free(ctx->ssl_ctx);
437437
}
438-
ERR_print_errors_cb(ssl_error_callback, NULL);
438+
ERR_clear_last_mark();
439439

440440
(*ctx) = (IotcoredTlsCtx) { 0 };
441441
}

0 commit comments

Comments
 (0)