Add global site passthrough to ignore pinning

opts.c

@@ -191,6 +191,12 @@ opts_free(opts_t *opts)
 		free(opts->mirrortarget);
 	}
 #endif /* !WITHOUT_MIRROR */
+	passsite_t *passsite = opts->passsites;
+	while (passsite) {
+		passsite_t *next = passsite->next;
+		free(passsite->site);
+		passsite = next;
+	}
 	memset(opts, 0, sizeof(opts_t));
 	free(opts);
 }
@@ -1348,6 +1354,55 @@ opts_unset_allow_wrong_host(opts_t *opts)
 	opts->allow_wrong_host = 0;
 }
 
+void
+opts_set_pass_site(opts_t *opts, char *value, int line_num)
+{
+	// site [(clientaddr|(user|*) [description keyword])]
+	char *argv[sizeof(char *) * 3];
+	int argc = 0;
+	char *p, *last = NULL;
+
+	for ((p = strtok_r(value, " ", &last));
+		 p;
+		 (p = strtok_r(NULL, " ", &last))) {
+		if (argc < 3) {
+			argv[argc++] = p;
+		} else {
+			break;
+		}
+	}
+	if (!argc) {
+		fprintf(stderr, "PassSite requires at least one parameter on line %d\n", line_num);
+		exit(EXIT_FAILURE);
+	}
+	passsite_t *ps = malloc(sizeof(passsite_t));
+	memset(ps, 0, sizeof(passsite_t));
+	size_t len = strlen(argv[0]);
+	// Common names are separated by slashes
+	char s[len + 3];
+	memcpy(s + 1, argv[0], len);
+	s[0] = '/';
+	s[len + 1] = '/';
+	s[len + 2] = '\0';
+	ps->site = strdup(s);
+
+	if (argc > 1) {
+			ps->ip = strdup(argv[1]);
+	}
+	if (argc > 2) {
+		if (ps->ip) {
+			fprintf(stderr, "PassSite client ip cannot define keyword filter on line %d\n", line_num);
+			exit(EXIT_FAILURE);
+		}
+	}
+	ps->next = opts->passsites;
+	opts->passsites = ps;
+#ifdef DEBUG_OPTS
+	log_dbg_printf("PassSite: %s, %s\n", ps->site, STRORDASH(ps->ip));
+#endif /* DEBUG_OPTS */
+}
+
+
 static int
 check_value_yesno(const char *value, const char *name, int line_num)
 {
@@ -1549,6 +1604,8 @@ set_option(opts_t *opts, const char *argv0,
 		log_dbg_printf("AddSNIToCertificate: %u\n",
 		               opts->allow_wrong_host);
 #endif /* DEBUG_OPTS */
+	} else if (!strncmp(name, "PassSite", 9)) {
+		opts_set_pass_site(opts, value, line_num);
 	} else {
 		fprintf(stderr, "Error in conf: Unknown option "
 		                "'%s' at line %d\n", name, line_num);

opts.h

@@ -54,6 +54,18 @@ typedef struct proxyspec {
 	struct proxyspec *next;
 } proxyspec_t;
 
+// typedef struct passsite {
+// 	char *site;
+// 	struct passsite *next;
+// } passsite_t;
+
+typedef struct passsite {
+	char *site;
+	// Filter definition fields
+	char *ip;
+	struct passsite *next;
+} passsite_t;
+
 typedef struct opts {
 	unsigned int debug : 1;
 	unsigned int detach : 1;
@@ -125,6 +137,7 @@ typedef struct opts {
 	proxyspec_t *spec;
 	unsigned int verify_peer: 1;
 	unsigned int allow_wrong_host: 1;
+	struct passsite *passsites; 
 } opts_t;
 
 void NORET oom_die(const char *) NONNULL(1);

pxyconn.c

@@ -983,6 +983,74 @@ pxy_srccert_create(pxy_conn_ctx_t *ctx)
 	return cert;
 }
 
+
+static int NONNULL(1,2)
+pxy_pass_site(pxy_conn_ctx_t *ctx, char *site)
+{
+	log_dbg_printf("ENTER, %s, %s, %s", site, STRORDASH(ctx->sni), STRORDASH(ctx->ssl_names));
+
+	int rv = 0;
+
+	// site has surrounding slashes: "/example.com/"
+	size_t len = strlen(site);
+
+	// Replace slash with null
+	site[len - 1] = '\0';
+	// Skip the first slash
+	char *s = site + 1;
+
+	// @attention Make sure sni is not null
+	// SNI: "example.com"
+	if (ctx->sni && !strcmp(ctx->sni, s)) {
+		log_dbg_printf("Match with sni: %s", ctx->sni);
+		rv = 1;
+		goto out2;
+	}
+
+	// @attention Make sure ssl_names is not null
+	if (!ctx->ssl_names) {
+		goto out2;
+	}
+
+	// Single common name: "example.com"
+	if (!strcmp(ctx->ssl_names, s)) {
+		log_dbg_printf("Match with single common name: %s", ctx->ssl_names);
+		rv = 1;
+		goto out2;
+	}
+
+	// Insert slash at the end
+	site[len - 1] = '/';
+
+	// First common name: "example.com/"
+	if (strstr(ctx->ssl_names, s) == ctx->ssl_names) {
+		log_dbg_printf("Match with the first common name: %s, %s", ctx->ssl_names, s);
+		rv = 1;
+		goto out;
+	}
+
+	// Middle common name: "/example.com/"
+	if (strstr(ctx->ssl_names, site)) {
+		log_dbg_printf("Match with a middle common name: %s, %s", ctx->ssl_names, site);
+		rv = 1;
+		goto out;
+	}
+
+	// Replace slash with null
+	site[len - 1] = '\0';
+
+	// Last common name: "/example.com"
+	if (strstr(ctx->ssl_names, site) == ctx->ssl_names + strlen(ctx->ssl_names) - strlen(site)) {
+		log_dbg_printf("Match with the last common name: %s, %s", ctx->ssl_names, site);
+		rv = 1;
+	}
+out2:
+	// Restore the last modification
+	site[len - 1] = '/';
+out:
+	return rv;
+}
+
 /*
  * Create new SSL context for the incoming connection, based on the original
  * destination SSL certificate.
@@ -1025,6 +1093,18 @@ pxy_srcssl_create(pxy_conn_ctx_t *ctx, SSL *origssl)
 			ctx->enomem = 1;
 	}
 
+	if (ctx->opts->passthrough) {
+		passsite_t *passsite = ctx->opts->passsites;
+		while (passsite) {
+			if (pxy_pass_site(ctx, passsite->site)) {
+				log_dbg_printf("Found pass site; switching to passthrough\n");
+				cert_free(cert);
+				return NULL;
+			}
+			passsite = passsite->next;
+		}
+	}
+
 	SSL_CTX *sslctx = pxy_srcsslctx_create(ctx, cert->crt, cert->chain,
 	                                       cert->key);
 	cert_free(cert);