1、将dynamic bypass 从tsg_entry.cpp 拆分出来 2、使用ja3信息代替chello信息做bypass ssl信息 3、增加获取ja3流标签，通过cmsg发送给tfe 4、增加dynamic bypass 配置文件开关

2020-09-22 18:16:19 +08:00
parent 5f3a73a096
commit 9a48841641
9 changed files with 443 additions and 1096 deletions
--- a/entry/src/kni_dynamic_bypass.cpp
+++ b/entry/src/kni_dynamic_bypass.cpp
@@ -0,0 +1,368 @@
+#include "kni_dynamic_bypass.h"
+
+#define SSL_INFO_LEN 512
+
+struct dynamic_bypass_ssl_feature{
+	size_t vlen;
+	char value[SSL_INFO_LEN];
+};
+
+extern struct kni_handle *g_kni_handle;
+extern struct kni_field_stat_handle *g_kni_fs_handle;
+
+char * stream_addr_to_str(struct pme_info *pmeinfo,struct pkt_info *pktinfo)
+{
+	char * __str_ret = NULL;
+	if(pmeinfo==NULL || pktinfo == NULL) return NULL;
+	if (pmeinfo->addr_type == ADDR_TYPE_IPV4)
+	{
+		char __src_addr[INET_ADDRSTRLEN];
+		char __dst_addr[INET_ADDRSTRLEN];
+		uint16_t __src_port;
+		uint16_t __dst_port;
+		if(pktinfo->iphdr.v4->saddr < pktinfo->iphdr.v4->daddr){
+			__src_port = ntohs((uint16_t) pmeinfo->stream->addr.tuple4_v4->source);
+			__dst_port = ntohs((uint16_t) pmeinfo->stream->addr.tuple4_v4->dest);
+			inet_ntop(AF_INET, &(pmeinfo->stream->addr.tuple4_v4->saddr), __src_addr, sizeof(__src_addr));
+			inet_ntop(AF_INET, &(pmeinfo->stream->addr.tuple4_v4->daddr), __dst_addr, sizeof(__dst_addr));
+		}
+		else
+		{
+			__src_port = ntohs((uint16_t) pmeinfo->stream->addr.tuple4_v4->dest);
+			__dst_port = ntohs((uint16_t) pmeinfo->stream->addr.tuple4_v4->source);
+			inet_ntop(AF_INET, &(pmeinfo->stream->addr.tuple4_v4->daddr), __src_addr, sizeof(__src_addr));
+			inet_ntop(AF_INET, &(pmeinfo->stream->addr.tuple4_v4->saddr), __dst_addr, sizeof(__dst_addr));
+		}
+		asprintf(&__str_ret, "%s %u %s %u", __src_addr, __src_port, __dst_addr, __dst_port);
+	}
+
+	if (pmeinfo->addr_type == ADDR_TYPE_IPV6)
+	{
+		char __src_addr[INET6_ADDRSTRLEN];
+		char __dst_addr[INET6_ADDRSTRLEN];
+		uint16_t __src_port;
+		uint16_t __dst_port;
+		if(memcmp((void*)&(pktinfo->iphdr.v6->ip6_src), (void*)&(pktinfo->iphdr.v6->ip6_dst), IPV6_ADDR_LEN) < 0){
+			__src_port = ntohs((uint16_t) pktinfo->tcphdr->source);
+			__dst_port = ntohs((uint16_t) pktinfo->tcphdr->dest);
+			memcpy(__src_addr, &(pktinfo->iphdr.v6->ip6_src), sizeof(__src_addr));
+			memcpy(__dst_addr, &(pktinfo->iphdr.v6->ip6_dst), sizeof(__dst_addr));
+		}
+		else
+		{
+			__src_port = ntohs((uint16_t) pktinfo->tcphdr->dest);
+			__dst_port = ntohs((uint16_t) pktinfo->tcphdr->source);
+			memcpy(__src_addr, &(pktinfo->iphdr.v6->ip6_dst), sizeof(__src_addr));
+			memcpy(__dst_addr, &(pktinfo->iphdr.v6->ip6_src), sizeof(__dst_addr));
+		}
+		asprintf(&__str_ret, "%s %u %s %u", __src_addr, __src_port, __dst_addr, __dst_port);
+	}
+
+	return __str_ret;
+}
+
+int stream_addr_str_split(char* addr_str, const char** sip, const char** sport, const char** dip, const char** dport)
+{
+	const char* seps=" ";
+	char* saveptr=NULL, *subtoken=NULL, *str=NULL;
+	int i=0;
+	for (str = addr_str, i=0; ; str = NULL, i++)
+	{
+		subtoken = strtok_r(str, seps, &saveptr);
+		if (subtoken == NULL)
+			break;
+		switch(i)
+		{
+			case 0:
+				if(sip!=NULL) *sip=subtoken;
+				break;
+			case 1:
+				if(sport!=NULL) *sport=subtoken;
+				break;
+			case 2:
+				if(dip!=NULL) *dip=subtoken;
+				break;
+			case 3:
+				if(dport!=NULL)	*dport=subtoken;
+				break;
+			default:
+				return -1;
+				break;
+		}
+	}
+	return 0;
+
+}
+
+static long sslinfo2bypass_htable_search_cb(void *data, const uchar *key, uint size, void *user_args){
+	if(data != NULL)
+		return 0;
+	else
+		return -1;
+}
+
+static int sslinfo2bypass_htable_search(MESA_htable_handle htable,char *key, int klen,  struct pme_info *pmeinfo)
+{
+	void *logger = g_kni_handle->local_logger;
+    long cb_ret = -1;
+	void *value;
+    value = MESA_htable_search_cb(htable, (const unsigned char *)key, (unsigned int )klen, sslinfo2bypass_htable_search_cb, NULL, &cb_ret);
+	if(cb_ret == 0)
+	{
+		pmeinfo->ssl_pinningst = *((uint64_t *)value);
+		KNI_LOG_DEBUG(logger, "MESA_htable: success to search, table = sslinfo2bypass_htable,key = %s, key_size = %d, ret =%d", key, klen,cb_ret);
+	}
+	else
+	{
+		KNI_LOG_DEBUG(logger, "MESA_htable:Search result value is null, table = sslinfo2bypass_htable,key = %s, key_size = %d, ret =%d", key, klen,cb_ret);
+	}
+	return cb_ret;
+}
+
+static int traceid2sslinfo_htable_add(char *key, uint klen, void * value,int thread_seq)
+{
+	void *logger = g_kni_handle->local_logger;
+	int ret;
+	MESA_htable_handle traceid2sslinfo_htable = g_kni_handle->threads_handle[thread_seq].traceid2sslinfo_htable;
+	ret = MESA_htable_add(traceid2sslinfo_htable, (const unsigned char *)key, klen, (const void*)value);
+	if(ret >= 0)
+	{
+		FS_operate(g_kni_fs_handle->handle, g_kni_fs_handle->fields[KNI_FIELD_ID2SSL_ADD_SUCC], 0, FS_OP_ADD, 1);
+		FS_operate(g_kni_fs_handle->handle, g_kni_fs_handle->fields[KNI_FIELD_ID2SSL_CNT], 0, FS_OP_ADD, 1);
+		KNI_LOG_DEBUG(logger, "MESA_htable:Success to add, table = traceid2sslinfo_htable,key = %s, key_size = %d, ret =%d , thread_seq=%d", key, klen,ret, thread_seq);
+	}
+	else
+	{
+		KNI_LOG_ERROR(logger, "MESA_htable:Fail to add, table = traceid2sslinfo_htable,key = %s, key_size = %d, ret =%d , thread_seq=%d", key, klen,ret, thread_seq);
+	}
+	return ret;
+}
+
+
+static int sslinfo2bypass_htable_add(char *key, uint klen, void * value, void *logger)
+{
+	int ret = -1;
+	MESA_htable_handle sslinfo2bypass_htable = g_kni_handle->sslinfo2bypass_htable;
+	ret = MESA_htable_add(sslinfo2bypass_htable, (const unsigned char *)key, klen, (const void*)value);
+	if(ret < 0)
+	{
+		KNI_LOG_ERROR(logger, "MESA_htable: Failed at add, table = sslinfo2bypass_htable, key = %s, key_size = %d, ret = %d",key, klen, ret);
+	}
+	else
+	{
+		KNI_LOG_DEBUG(logger, "MESA_htable: Success at add, table = sslinfo2bypass_htable, key = %s, key_size = %d, ret = %d",key, klen, ret);
+		FS_operate(g_kni_fs_handle->handle, g_kni_fs_handle->fields[KNI_FIELD_SSL2PASS_ADD_SUCC], 0, FS_OP_ADD, 1);
+		FS_operate(g_kni_fs_handle->handle, g_kni_fs_handle->fields[KNI_FIELD_SSL2PASS_CNT], 0, FS_OP_ADD, 1);
+
+	}
+	return ret;
+}
+
+static long traceid2sslinfo_htable_search_cb(void *data, const uchar *key, uint size, void *user_args)
+{
+	struct dynamic_bypass_ssl_feature * ssl_feature = (struct dynamic_bypass_ssl_feature *)data;
+	void *logger = g_kni_handle->local_logger;
+	uint64_t * p_ssl_pinningst = (uint64_t *)user_args;
+	uint64_t *value = NULL;
+	long cb_ret = -1;
+
+	if(ssl_feature != NULL)
+	{
+		value = ALLOC(uint64_t, 1);
+		*value = *p_ssl_pinningst;
+		if(sslinfo2bypass_htable_add(ssl_feature->value, ssl_feature->vlen, (void *)value, logger) < 0)
+		{
+			KNI_LOG_ERROR(logger, "Dynamic bypass, fail add to table = sslinfo2bypass_htable, key = %s, key_size = %d",
+						ssl_feature->value, ssl_feature->vlen);
+		}
+		cb_ret = 0;
+	} 
+	return cb_ret;
+}
+
+
+static int traceid2sslinfo_htable_search(MESA_htable_handle htable,char *key, int klen, int thread_seq,uint64_t ssl_pinningst)
+{
+    long cb_ret = -1;
+	void *logger = g_kni_handle->local_logger;
+    MESA_htable_search_cb(htable, (const unsigned char *)key, (unsigned int )klen, traceid2sslinfo_htable_search_cb, &ssl_pinningst, &cb_ret);
+	if(cb_ret >= 0)
+	{
+		KNI_LOG_DEBUG(logger, "MESA_htable: success to search, table = traceid2sslinfo_htable,thread_seq = %d,key = %s, key_size = %d, ret = %d", 
+							thread_seq, key, klen,cb_ret);
+	}
+	else
+	{
+		KNI_LOG_ERROR(logger, "MESA_htable: Fail to search, table = traceid2sslinfo_htable,thread_seq = %d,key = %s, key_size = %d, ret = %d", 
+							thread_seq, key, klen,cb_ret);
+	}
+	
+	return cb_ret;
+}
+
+static void traceid2sslinfo_htable_data_free_cb(void *data){
+	FREE(&data);
+}
+
+static void sslinfo2bypass_htable_data_free_cb(void *data){
+	FREE(&data);
+}
+
+static int traceid2sslinfo_htable_expire_notify_cb(void *data, int eliminate_type)
+{
+	FS_operate(g_kni_fs_handle->handle, g_kni_fs_handle->fields[KNI_FIELD_ID2SSL_DEL_SUCC], 0, FS_OP_ADD, 1);
+	FS_operate(g_kni_fs_handle->handle, g_kni_fs_handle->fields[KNI_FIELD_ID2SSL_CNT], 0, FS_OP_ADD, -1);
+	return 1;
+}
+
+static int sslinfo2bypass_htable_expire_notify_cb(void *data, int eliminate_type)
+{
+	FS_operate(g_kni_fs_handle->handle, g_kni_fs_handle->fields[KNI_FIELD_SSL2PASS_DEL_SUCC], 0, FS_OP_ADD, 1);
+	FS_operate(g_kni_fs_handle->handle, g_kni_fs_handle->fields[KNI_FIELD_SSL2PASS_CNT], 0, FS_OP_ADD, -1);
+	return 1;
+}
+
+
+
+static int get_ssl_conn_info(struct pme_info *pmeinfo,struct pkt_info *pktinfo, struct dynamic_bypass_ssl_feature *ssl_feature)
+{
+	void *logger = g_kni_handle->local_logger;
+
+	const char *sip=NULL, *sport=NULL, *dip=NULL, *dport=NULL;
+	char *addr_str = NULL;
+
+	if(pmeinfo->session_attribute_label->ja3_fingerprint == NULL)
+	{
+		KNI_LOG_DEBUG(logger, "Dynamic bypass:get stream label ja3_fingerprint is null, stream traceid = %s", pmeinfo->stream_traceid);
+		return 1;
+	}
+
+	addr_str = stream_addr_to_str(pmeinfo,pktinfo);
+	stream_addr_str_split(addr_str, &sip, &sport, &dip, &dport);
+
+
+	ssl_feature->vlen = snprintf(ssl_feature->value, SSL_INFO_LEN, "%s:%s:%s",
+																	pmeinfo->session_attribute_label->ja3_fingerprint,sip,
+																	pmeinfo->domain_len > 0 ? (char*)&(pmeinfo->domain): dip);
+
+	FREE(&addr_str);
+	return 0;
+}
+
+
+int first_data_ssl_dynamic_bypass(struct streaminfo *stream, struct pme_info *pmeinfo, struct pkt_info *pktinfo, int thread_seq)
+{
+	struct dynamic_bypass_ssl_feature *ssl_feature = NULL;
+	void *logger = g_kni_handle->local_logger;
+
+	int ret = -1;
+	if(pmeinfo->protocol != PROTO_SSL){
+		KNI_LOG_DEBUG(logger, "Dynamic bypass: stream protocol is not ssl: stream traceid = %s, protocol = %d", pmeinfo->stream_traceid,pmeinfo->protocol);
+		return ret;
+	}
+
+	ssl_feature = ALLOC(struct dynamic_bypass_ssl_feature,1);
+ 	if(get_ssl_conn_info(pmeinfo,pktinfo, ssl_feature) == 1){
+		FREE(&ssl_feature);
+	 	return ret;
+	}
+	
+	KNI_LOG_DEBUG(logger, "Dynamic bypass: ssl_info: %s, ssl_info len:%d, stream traceid = %s", ssl_feature->value, ssl_feature->vlen, pmeinfo->stream_traceid);
+
+	if(sslinfo2bypass_htable_search(g_kni_handle->sslinfo2bypass_htable,ssl_feature->value, ssl_feature->vlen,pmeinfo) == 0)
+	{
+		KNI_LOG_DEBUG(logger, "Dynamic bypass: passthrough ok, stream traceid = %s,ssl_pinningst = %d", pmeinfo->stream_traceid, pmeinfo->ssl_pinningst);
+		FREE(&ssl_feature);
+		ret = 0; 
+	}
+	else
+	{
+		KNI_LOG_DEBUG(logger, "Dynamic bypass: not passthrough, stream traceid = %s", pmeinfo->stream_traceid);
+		if(traceid2sslinfo_htable_add(pmeinfo->stream_traceid, strlen(pmeinfo->stream_traceid),ssl_feature,thread_seq) >=0)
+		{
+			ret = 1;
+		}
+		else
+		{
+			FREE(&ssl_feature);
+		}
+	}
+
+	return ret;
+}
+
+
+void next_data_ssl_dynamic_bypass(struct pkt_info *pktinfo)
+{
+	FS_operate(g_kni_fs_handle->handle, g_kni_fs_handle->fields[KNI_FIELD_INTCP_BYTE], 0, FS_OP_ADD, pktinfo->ip_totlen);
+
+}
+
+
+int ssl_dynamic_bypass_htable_add(struct pme_info *pmeinfo)
+{
+	void *logger = g_kni_handle->local_logger;
+	long cb_ret;
+	int ret = -1;
+	MESA_htable_handle traceid2sslinfo_htable = g_kni_handle->threads_handle[pmeinfo->thread_seq].traceid2sslinfo_htable;
+	if(pmeinfo->ssl_intercept_state == 0)
+	{
+		cb_ret = traceid2sslinfo_htable_search(traceid2sslinfo_htable,pmeinfo->stream_traceid, strlen(pmeinfo->stream_traceid), pmeinfo->thread_seq, pmeinfo->ssl_pinningst);
+		if(cb_ret >= 0)
+		{
+			cb_ret = MESA_htable_del(traceid2sslinfo_htable, (const unsigned char *)pmeinfo->stream_traceid, strlen(pmeinfo->stream_traceid), NULL);
+			if(cb_ret < 0)
+			{
+				KNI_LOG_ERROR(logger, "Delete traceid2sslinfo_htable fail,key=%s",pmeinfo->stream_traceid);
+			}
+			else
+			{
+				FS_operate(g_kni_fs_handle->handle, g_kni_fs_handle->fields[KNI_FIELD_ID2SSL_DEL_SUCC], 0, FS_OP_ADD, 1);
+				FS_operate(g_kni_fs_handle->handle, g_kni_fs_handle->fields[KNI_FIELD_ID2SSL_CNT], 0, FS_OP_ADD, -1);
+			}
+			ret = 0;
+		}
+	}
+	return ret;		
+}
+
+
+int ssl_dynamic_bypass_htable_init(const char *profile,void *local_logger)
+{
+	struct kni_htable_opt opt;
+	MESA_htable_handle sslinfo2bypass_htable = NULL;
+	int ret = 0;
+	int ssl_dynamic_bypass_enable = 1;
+
+	MESA_load_profile_int_def(profile, "ssl_dynamic_bypass", "enabled", &ssl_dynamic_bypass_enable, 1);
+    KNI_LOG_ERROR(local_logger, "Dynamic bypass: MESA_prof_load, [%s]:\n enabled: %d", "ssl_dynamic_bypass",ssl_dynamic_bypass_enable);
+	g_kni_handle->ssl_dynamic_bypass_enable = ssl_dynamic_bypass_enable;
+
+	if(ssl_dynamic_bypass_enable == 1){
+		//init traceid2sslinfo_htable
+		memset(&opt, 0, sizeof(opt));
+		kni_get_htable_opt(&opt, profile, "traceid2sslinfo_htable", (void*)traceid2sslinfo_htable_data_free_cb, (void *)traceid2sslinfo_htable_expire_notify_cb, local_logger);
+		for(int i = 0; i < g_kni_handle->thread_count; i++){
+			MESA_htable_handle traceid2sslinfo_htable = kni_create_htable((char*)"traceid2sslinfo_htable", &opt, local_logger);
+			if(traceid2sslinfo_htable == NULL){
+				KNI_LOG_ERROR(local_logger, "Failed at kni_create_htable, table = traceid2sslinfo_htable");
+				ret = -1;
+				return ret;
+			}
+			g_kni_handle->threads_handle[i].traceid2sslinfo_htable = traceid2sslinfo_htable;
+		}
+		
+		//init sslinfo2bypass_htable
+		memset(&opt, 0, sizeof(opt));
+		kni_get_htable_opt(&opt, profile, "sslinfo2bypass_htable", (void*)sslinfo2bypass_htable_data_free_cb, (void *)sslinfo2bypass_htable_expire_notify_cb, local_logger);
+		sslinfo2bypass_htable = kni_create_htable((char*)"sslinfo2bypass_htable", &opt, local_logger);
+		if(sslinfo2bypass_htable == NULL){
+			KNI_LOG_ERROR(local_logger, "Failed at create sslinfo2bypass_htable");
+			ret = -2;
+			return ret;
+		}
+		g_kni_handle->sslinfo2bypass_htable = sslinfo2bypass_htable;
+	}
+	return ret;
+
+}