gfwleak/tango-tfe
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

TSG-6228 修复 ATCA 性能测试时 perf 火焰图显示 tfe_stream_addr_to_str 耗时较高的问题

Browse Source
This commit is contained in:
luwenpeng
2021-04-28 18:01:32 +08:00
parent 68a8b6c94e
commit 19a3fe9217
7 changed files with 112 additions and 131 deletions
Download Patch File Download Diff File Expand all files Collapse all files

76
platform/src/ssl_service_cache.cpp
View File

@@ -18,6 +18,14 @@ struct ssl_svc_ja3
int ref_cnt;
};
struct ssl_svc_addr
{
const char *sip;
const char *sport;
const char *dip;
const char *dport;
};
static struct ssl_ja3_enforcer g_static_enforcer = {0};
static void ssl_svc_ja3_param_dup_cb(int table_id, MAAT_PLUGIN_EX_DATA *to, MAAT_PLUGIN_EX_DATA *from, long argl, void *argp)
@@ -110,7 +118,7 @@ static int ssl_svc_ja3_init(const char *table_name)
return 1;
}
enum ssl_ja3_pinning_status ssl_svc_ja3_scan(char *ja3_hash, char *addr_str)
enum ssl_ja3_pinning_status ssl_svc_ja3_scan(char *ja3_hash, const char *addr_str)
{
enum ssl_ja3_pinning_status ret = JA3_PINNING_STATUS_UNKNOWN;
struct ssl_svc_ja3 *param = NULL;
@@ -207,50 +215,42 @@ static void ssl_svc_free_server_st(void * data)
free(p);
return;
}
static size_t ssl_svc_server_st_mk_key(const struct ssl_chello* chello, const struct tfe_stream_addr * addr, char* key_buff, size_t sz)
static size_t ssl_svc_server_st_mk_key(struct ssl_svc_addr *addr_info, const struct ssl_chello* chello, const struct tfe_stream *tcp_stream, char* key_buff, size_t sz)
{
size_t key_len=0;
const char* sip=NULL, *sport=NULL, *dip=NULL, *dport=NULL;
char * addr_str= tfe_stream_addr_to_str(addr);
tfe_stream_addr_str_split(addr_str, &sip, &sport, &dip, &dport);
key_len=snprintf(key_buff, sz, "%s:%s:%s:", dip, dport, chello->sni?chello->sni:"null");
free(addr_str);
key_len=snprintf(key_buff, sz, "%s:%s:%s:", addr_info->dip, addr_info->dport, chello->sni ? chello->sni : "null");
return key_len;
}
static size_t ssl_svc_app_st_mk_key(const struct ssl_chello *chello, const struct tfe_stream *tcp_stream, char *key_buff, size_t sz)
static size_t ssl_svc_app_st_mk_key(struct ssl_svc_addr *addr_info, const struct ssl_chello *chello, const struct tfe_stream *tcp_stream, char *key_buff, size_t sz)
{
char ja3_val[64] = {0};
uint16_t ja3_len = 0;
size_t key_len = 0;
const char *sip = NULL, *sport = NULL, *dip = NULL, *dport = NULL;
char *addr_str = tfe_stream_addr_to_str(tcp_stream->addr);
struct tfe_cmsg *cmsg = tfe_stream_get0_cmsg(tcp_stream);
if (cmsg != NULL)
{
int ret = tfe_cmsg_get_value(cmsg, TFE_CMSG_SSL_CLIENT_JA3_FINGERPRINT, (unsigned char *)ja3_val, sizeof(ja3_val), &ja3_len);
if (ret != 0)
{
TFE_LOG_ERROR(g_default_logger, "failed at fetch ssl client ja3 fingerprint from cmsg: %s, %s", strerror(-ret), addr_str);
TFE_LOG_ERROR(g_default_logger, "failed at fetch ssl client ja3 fingerprint from cmsg: %s, %s", strerror(-ret), tcp_stream->str_stream_info);
}
else
{
TFE_LOG_DEBUG(g_default_logger, "fetch ssl client ja3 fingerprint:%s addr: %s", ja3_val, addr_str);
TFE_LOG_DEBUG(g_default_logger, "fetch ssl client ja3 fingerprint:%s addr: %s", ja3_val, tcp_stream->str_stream_info);
}
}
tfe_stream_addr_str_split(addr_str, &sip, &sport, &dip, &dport);
// If ja3 is successfully obtained, use ja3 to generate hashkey
if (strlen(ja3_val))
{
key_len = snprintf(key_buff, sz, "%s:%s", ja3_val, chello->sni ? chello->sni : dip);
free(addr_str);
key_len = snprintf(key_buff, sz, "%s:%s", ja3_val, chello->sni ? chello->sni : addr_info->dip);
return key_len;
}
// otherwise, splicing ssl attributes to generate hashkey
key_len=snprintf(key_buff, sz, "%d:%d:%s:%s", chello->min_version.ossl_format,
chello->max_version.ossl_format,
chello->sni?chello->sni: dip ,
chello->sni?chello->sni: addr_info->dip ,
chello->alpn?chello->alpn:"null");
if(chello->cipher_suites && sz-key_len>chello->cipher_suites_len)
{
@@ -266,25 +266,20 @@ static size_t ssl_svc_app_st_mk_key(const struct ssl_chello *chello, const struc
{
memcpy(key_buff+key_len, chello->supported_groups, chello->supported_groups_len);
key_len+=chello->supported_groups_len;
}
free(addr_str);
}
return key_len;
}
static size_t ssl_svc_client_st_mk_key(const struct ssl_chello *chello, const struct tfe_stream *tcp_stream, char *key_buff, size_t sz)
static size_t ssl_svc_client_st_mk_key(struct ssl_svc_addr *addr_info, const struct ssl_chello *chello, const struct tfe_stream *tcp_stream, char *key_buff, size_t sz)
{
size_t key_len=0;
const char* sip=NULL, *sport=NULL, *dip=NULL, *dport=NULL;
char *addr_str = tfe_stream_addr_to_str(tcp_stream->addr);
tfe_stream_addr_str_split(addr_str, &sip, &sport, &dip, &dport);
char chello_id_buff[sz];
size_t chello_id_len=0;
key_len=snprintf(key_buff, sz, "%s:", sip);
chello_id_len = ssl_svc_app_st_mk_key(chello, tcp_stream, chello_id_buff, sizeof(chello_id_buff));
key_len=snprintf(key_buff, sz, "%s:", addr_info->sip);
chello_id_len = ssl_svc_app_st_mk_key(addr_info, chello, tcp_stream, chello_id_buff, sizeof(chello_id_buff));
memcpy(key_buff+key_len, chello_id_buff, MIN(chello_id_len, sz-key_len));
key_len += MIN(chello_id_len, sz-key_len);
free(addr_str);
return key_len;
}
static long cli_st_read_cb(void * data, const uchar * key, uint size, void * user_arg)
@@ -433,20 +428,23 @@ int ssl_service_cache_read(struct ssl_service_cache *svc_cache, const struct ssl
return 0;
}
char * addr_str= tfe_stream_addr_to_str(tcp_stream->addr);
struct ssl_svc_addr addr_info = { NULL, NULL, NULL, NULL};
char *addr_str = tfe_strdup(tcp_stream->str_stream_info);
tfe_stream_addr_str_split(addr_str, &(addr_info.sip), &(addr_info.sport), &(addr_info.dip), &(addr_info.dport));
memset(hash_key, 0, sizeof(hash_key));
temp_key_sz = ssl_svc_client_st_mk_key(chello, tcp_stream, temp_key, sizeof(temp_key));
temp_key_sz = ssl_svc_client_st_mk_key(&addr_info, chello, tcp_stream, temp_key, sizeof(temp_key));
hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
MESA_htable_search_cb(svc_cache->cli_st_hash, hash_key, (unsigned int) hash_key_sz, cli_st_read_cb, result, &cli_st_cb_ret);
TFE_LOG_DEBUG(g_default_logger, "client table, hash:%s, found:%d, sni:%s, addr:%s, mutual:%d, pinning:%d, err:%d",
hash_key, cli_st_cb_ret, chello->sni, addr_str, result->is_mutual_auth, result->cli_pinning_status, result->has_protocol_errors);
hash_key, cli_st_cb_ret, chello->sni, tcp_stream->str_stream_info, result->is_mutual_auth, result->cli_pinning_status, result->has_protocol_errors);
memset(hash_key, 0, sizeof(hash_key));
temp_key_sz = ssl_svc_server_st_mk_key(chello, tcp_stream->addr, temp_key, sizeof(temp_key));
temp_key_sz = ssl_svc_server_st_mk_key(&addr_info, chello, tcp_stream, temp_key, sizeof(temp_key));
hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
MESA_htable_search_cb(svc_cache->srv_st_hash, hash_key, (unsigned int) hash_key_sz, srv_st_read_cb, result, &svr_st_cb_ret);
TFE_LOG_DEBUG(g_default_logger, "server table, hash:%s, found:%d, sni:%s, addr:%s, ct:%d, ev:%d",
hash_key, svr_st_cb_ret, chello->sni, addr_str, result->is_ct, result->is_ev);
hash_key, svr_st_cb_ret, chello->sni, tcp_stream->str_stream_info, result->is_ct, result->is_ev);
char ja3_hash[64] = {0};
uint16_t ja3_len = 0;
@@ -457,7 +455,7 @@ int ssl_service_cache_read(struct ssl_service_cache *svc_cache, const struct ssl
int ret = tfe_cmsg_get_value(cmsg, TFE_CMSG_SSL_CLIENT_JA3_FINGERPRINT, (unsigned char *)ja3_hash, sizeof(ja3_hash), &ja3_len);
if (ret == 0)
{
result->ja3_pinning_status = ssl_svc_ja3_scan(ja3_hash, addr_str);
result->ja3_pinning_status = ssl_svc_ja3_scan(ja3_hash, tcp_stream->str_stream_info);
if (result->ja3_pinning_status != JA3_PINNING_STATUS_UNKNOWN)
{
app_st_cb_ret = 1;
@@ -465,7 +463,7 @@ int ssl_service_cache_read(struct ssl_service_cache *svc_cache, const struct ssl
}
}
TFE_LOG_DEBUG(g_default_logger, "app table, hash:%s, found:%d, sni:%s, addr:%s, ja3_pinning_status:%d",
ja3_hash, app_st_cb_ret, chello->sni, addr_str, result->ja3_pinning_status);
ja3_hash, app_st_cb_ret, chello->sni, tcp_stream->str_stream_info, result->ja3_pinning_status);
free(addr_str);
@@ -491,24 +489,28 @@ void ssl_service_cache_write(struct ssl_service_cache *svc_cache, const struct s
{
return;
}
char *addr_str = tfe_stream_addr_to_str(tcp_stream->addr);
struct ssl_svc_addr addr_info = { NULL, NULL, NULL, NULL};
char *addr_str = tfe_strdup(tcp_stream->str_stream_info);
tfe_stream_addr_str_split(addr_str, &(addr_info.sip), &(addr_info.sport), &(addr_info.dip), &(addr_info.dport));
struct ssl_service_write_args write_args={svc_cache, status};
if(status->is_mutual_auth||status->cli_pinning_status!=PINNING_ST_NOT_PINNING||status->has_protocol_errors)
{
memset(hash_key, 0, sizeof(hash_key));
temp_key_sz = ssl_svc_client_st_mk_key(chello, tcp_stream, temp_key, sizeof(temp_key));
temp_key_sz = ssl_svc_client_st_mk_key(&addr_info, chello, tcp_stream, temp_key, sizeof(temp_key));
hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
TFE_LOG_DEBUG(g_default_logger, "client table, hash:%s, sni:%s, addr:%s, mutual:%d, pinning:%d, err:%d",
hash_key, chello->sni, addr_str, status->is_mutual_auth, status->cli_pinning_status, status->has_protocol_errors);
hash_key, chello->sni, tcp_stream->str_stream_info, status->is_mutual_auth, status->cli_pinning_status, status->has_protocol_errors);
MESA_htable_search_cb(svc_cache->cli_st_hash, hash_key, (unsigned int) hash_key_sz, cli_st_write_cb, &write_args, &cli_st_cb_ret);
}
if(status->is_ct||status->is_ev)
{
memset(hash_key, 0, sizeof(hash_key));
temp_key_sz = ssl_svc_server_st_mk_key(chello, tcp_stream->addr, temp_key, sizeof(temp_key));
temp_key_sz = ssl_svc_server_st_mk_key(&addr_info, chello, tcp_stream, temp_key, sizeof(temp_key));
hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
TFE_LOG_DEBUG(g_default_logger, "server table, hash:%s, sni:%s, addr:%s, ct:%d, ev:%d",
hash_key, chello->sni, addr_str, status->is_ct, status->is_ev);
hash_key, chello->sni, tcp_stream->str_stream_info, status->is_ct, status->is_ev);
MESA_htable_search_cb(svc_cache->srv_st_hash, hash_key, (unsigned int) hash_key_sz, srv_st_write_cb, &write_args, &svr_st_cb_ret);
}