Skip to content

Commit 35e7fc1

Browse files
f0sself0ssel
committed
handle errors
1 parent b6271c3 commit 35e7fc1

File tree

3 files changed

+115
-31
lines changed

3 files changed

+115
-31
lines changed

‎jail/macos.go‎

Lines changed: 13 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -266,7 +266,6 @@ func (n *MacOSJail) setupPFRules() error {
266266
cmd := exec.Command("pfctl", "-a", pfAnchorName, "-f", n.pfRulesPath)
267267
err = cmd.Run()
268268
if err != nil {
269-
n.logger.Error("Failed to load PF rules", "error", err, "rules_file", n.pfRulesPath)
270269
return fmt.Errorf("failed to load PF rules: %v", err)
271270
}
272271

@@ -318,17 +317,26 @@ anchor "%s"
318317
func (n *MacOSJail) removePFRules() error {
319318
// Flush the anchor
320319
cmd := exec.Command("pfctl", "-a", pfAnchorName, "-F", "all")
321-
_ = cmd.Run() // Ignore errors during cleanup
320+
err := cmd.Run()
321+
if err != nil {
322+
return fmt.Errorf("failed to flush PF anchor: %v", err)
323+
}
322324

323325
return nil
324326
}
325327

326328
// cleanupTempFiles removes temporary rule files
327329
func (n *MacOSJail) cleanupTempFiles() {
328330
if n.pfRulesPath != "" {
329-
_ = os.Remove(n.pfRulesPath)
331+
err := os.Remove(n.pfRulesPath)
332+
if err != nil {
333+
n.logger.Error("Failed to remove temporary PF rules file", "file", n.pfRulesPath, "error", err)
334+
}
330335
}
331336
if n.mainRulesPath != "" {
332-
_ = os.Remove(n.mainRulesPath)
337+
err := os.Remove(n.mainRulesPath)
338+
if err != nil {
339+
n.logger.Error("Failed to remove temporary main PF rules file", "file", n.mainRulesPath, "error", err)
340+
}
333341
}
334-
}
342+
}

‎proxy/proxy.go‎

Lines changed: 81 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,10 @@ func (p *Server) Start(ctx context.Context) error {
7171
if err != nil {
7272
select {
7373
case <-ctx.Done():
74-
_ = listener.Close()
74+
err = listener.Close()
75+
if err != nil {
76+
p.logger.Error("Failed to close listener", "error", err)
77+
}
7578
return
7679
default:
7780
p.logger.Error("Failed to accept connection", "error", err)
@@ -290,7 +293,12 @@ func (p *Server) handleConnect(w http.ResponseWriter, r *http.Request) {
290293
p.logger.Error("Failed to hijack connection", "error", err)
291294
return
292295
}
293-
defer func() { _ = conn.Close() }()
296+
defer func() {
297+
err := conn.Close()
298+
if err != nil {
299+
p.logger.Error("Failed to close connection", "error", err)
300+
}
301+
}()
294302

295303
// Send 200 Connection established response manually
296304
_, err = conn.Write([]byte("HTTP/1.1 200 Connection established\r\n\r\n"))
@@ -416,7 +424,12 @@ func (p *Server) handleDecryptedHTTPS(w http.ResponseWriter, r *http.Request) {
416424

417425
// handleConnectionWithTLSDetection detects TLS vs HTTP and handles appropriately
418426
func (p *Server) handleConnectionWithTLSDetection(conn net.Conn) {
419-
defer func() { _ = conn.Close() }()
427+
defer func() {
428+
err := conn.Close()
429+
if err != nil {
430+
p.logger.Error("Failed to close connection", "error", err)
431+
}
432+
}()
420433

421434
// Peek at first byte to detect protocol
422435
buf := make([]byte, 1)
@@ -442,15 +455,25 @@ func (p *Server) handleConnectionWithTLSDetection(conn net.Conn) {
442455
p.logger.Debug("TLS handshake successful")
443456
// Use HTTP server with TLS connection
444457
listener := newSingleConnectionListener(tlsConn)
445-
defer func() { _ = listener.Close() }()
458+
defer func() {
459+
err := listener.Close()
460+
if err != nil {
461+
p.logger.Error("Failed to close connection", "error", err)
462+
}
463+
}()
446464
err = http.Serve(listener, http.HandlerFunc(p.handleDecryptedHTTPS))
447465
p.logger.Debug("http.Serve completed for HTTPS", "error", err)
448466
} else {
449467
p.logger.Debug("Detected HTTP request, handling normally")
450468
// Use HTTP server with regular connection
451469
p.logger.Debug("About to call http.Serve for HTTP connection")
452470
listener := newSingleConnectionListener(connWrapper)
453-
defer func() { _ = listener.Close() }()
471+
defer func() {
472+
err := listener.Close()
473+
if err != nil {
474+
p.logger.Error("Failed to close connection", "error", err)
475+
}
476+
}()
454477
err = http.Serve(listener, http.HandlerFunc(p.handleHTTP))
455478
p.logger.Debug("http.Serve completed", "error", err)
456479
}
@@ -519,7 +542,10 @@ func (sl *singleConnectionListener) Close() error {
519542
}
520543

521544
if sl.conn != nil {
522-
_ = sl.conn.Close()
545+
err := sl.conn.Close()
546+
if err != nil {
547+
return fmt.Errorf("failed to close connection: %w", err)
548+
}
523549
sl.conn = nil
524550
}
525551
return nil
@@ -625,51 +651,76 @@ func (p *Server) streamRequestToTarget(clientConn *tls.Conn, bufReader *bufio.Re
625651
if err != nil {
626652
return fmt.Errorf("failed to connect to target %s: %v", hostname, err)
627653
}
628-
defer func() { _ = targetConn.Close() }()
654+
defer func() {
655+
err := targetConn.Close()
656+
if err != nil {
657+
p.logger.Error("Failed to close target connection", "error", err)
658+
}
659+
}()
629660

630661
// Send HTTP request headers to target
631662
reqLine := fmt.Sprintf("%s %s %s\r\n", req.Method, req.URL.RequestURI(), req.Proto)
632-
_, _ = targetConn.Write([]byte(reqLine))
663+
_, err = targetConn.Write([]byte(reqLine))
664+
if err != nil {
665+
return fmt.Errorf("failed to write request line to target: %v", err)
666+
}
633667

634668
// Send headers
635669
for name, values := range req.Header {
636670
for _, value := range values {
637671
headerLine := fmt.Sprintf("%s: %s\r\n", name, value)
638-
_, _ = targetConn.Write([]byte(headerLine))
672+
_, err = targetConn.Write([]byte(headerLine))
673+
if err != nil {
674+
return fmt.Errorf("failed to write header to target: %v", err)
675+
}
639676
}
640677
}
641-
_, _ = targetConn.Write([]byte("\r\n")) // End of headers
678+
_, err = targetConn.Write([]byte("\r\n")) // End of headers
679+
if err != nil {
680+
return fmt.Errorf("failed to write headers to target: %v", err)
681+
}
642682

643683
// Stream request body and response bidirectionally
644684
go func() {
645685
// Stream request body: client -> target
646-
_, _ = io.Copy(targetConn, bufReader)
686+
_, err := io.Copy(targetConn, bufReader)
687+
if err != nil {
688+
p.logger.Error("Error copying request body to target", "error", err)
689+
}
647690
}()
648691

649692
// Stream response: target -> client
650-
_, _ = io.Copy(clientConn, targetConn)
693+
_, err = io.Copy(clientConn, targetConn)
694+
if err != nil {
695+
p.logger.Error("Error copying response from target to client", "error", err)
696+
}
697+
651698
return nil
652699
}
653700

654701
// handleConnectStreaming handles CONNECT requests with streaming TLS termination
655702
func (p *Server) handleConnectStreaming(tlsConn *tls.Conn, req *http.Request, hostname string) {
656703
p.logger.Debug("Handling CONNECT request with streaming", "hostname", hostname)
657-
704+
658705
// For CONNECT, we need to establish a tunnel but still maintain TLS termination
659706
// This is the tricky part - we're already inside a TLS connection from the client
660707
// The client is asking us to CONNECT to another server, but we want to intercept that too
661-
708+
662709
// Send CONNECT response
663710
response := "HTTP/1.1 200 Connection established\r\n\r\n"
664-
_, _ = tlsConn.Write([]byte(response))
665-
711+
_, err := tlsConn.Write([]byte(response))
712+
if err != nil {
713+
p.logger.Error("Failed to send CONNECT response", "error", err)
714+
return
715+
}
716+
666717
// Now the client will try to do TLS handshake for the target server
667718
// But we want to intercept and terminate it
668719
// This means we need to do another level of TLS termination
669-
720+
670721
// For now, let's create a simple tunnel and log that we're not inspecting
671722
p.logger.Warn("CONNECT tunnel established - content not inspected", "hostname", hostname)
672-
723+
673724
// Create connection to real target
674725
targetConn, err := net.Dial("tcp", req.Host)
675726
if err != nil {
@@ -679,6 +730,15 @@ func (p *Server) handleConnectStreaming(tlsConn *tls.Conn, req *http.Request, ho
679730
defer func() { _ = targetConn.Close() }()
680731

681732
// Bidirectional copy
682-
go func() { _, _ = io.Copy(targetConn, tlsConn) }()
683-
_, _ = io.Copy(tlsConn, targetConn)
684-
}
733+
go func() {
734+
_, err := io.Copy(targetConn, tlsConn)
735+
if err != nil {
736+
p.logger.Error("Error copying from client to target", "error", err)
737+
}
738+
}()
739+
_, err = io.Copy(tlsConn, targetConn)
740+
if err != nil {
741+
p.logger.Error("Error copying from target to client", "error", err)
742+
}
743+
p.logger.Debug("CONNECT tunnel closed", "hostname", hostname)
744+
}

‎tls/tls.go‎

Lines changed: 21 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -229,24 +229,40 @@ func (cm *CertificateManager) generateCA(keyPath, certPath string) error {
229229
if err != nil {
230230
return fmt.Errorf("failed to create key file: %v", err)
231231
}
232-
defer func() { _ = keyFile.Close() }()
233-
234-
_ = pem.Encode(keyFile, &pem.Block{
232+
defer func() {
233+
err := keyFile.Close()
234+
if err != nil {
235+
cm.logger.Error("Failed to close key file", "error", err)
236+
}
237+
}()
238+
239+
err = pem.Encode(keyFile, &pem.Block{
235240
Type: "RSA PRIVATE KEY",
236241
Bytes: x509.MarshalPKCS1PrivateKey(privateKey),
237242
})
243+
if err != nil {
244+
return fmt.Errorf("failed to write key to file: %v", err)
245+
}
238246

239247
// Save certificate
240248
certFile, err := os.OpenFile(certPath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0644)
241249
if err != nil {
242250
return fmt.Errorf("failed to create cert file: %v", err)
243251
}
244-
defer func() { _ = certFile.Close() }()
252+
defer func() {
253+
err := certFile.Close()
254+
if err != nil {
255+
cm.logger.Error("Failed to close cert file", "error", err)
256+
}
257+
}()
245258

246-
_ = pem.Encode(certFile, &pem.Block{
259+
err = pem.Encode(certFile, &pem.Block{
247260
Type: "CERTIFICATE",
248261
Bytes: certDER,
249262
})
263+
if err != nil {
264+
return fmt.Errorf("failed to write cert to file: %v", err)
265+
}
250266

251267
cm.caKey = privateKey
252268
cm.caCert = cert

0 commit comments

Comments
 (0)