gfwleak/tango-tfe
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

1. 客户端报SSL_R_SSLV3_ALERT_CERTIFICATE_UNKNOWN错误时，不作为maybe pinning; 2. ssl policy中增加protocol_errors的bypass开关。

Browse Source
This commit is contained in:
zhengchao
2019-05-21 11:47:09 +08:00
parent 1f73b4832d
commit 4cd42b9f95
5 changed files with 68 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
platform/src/ssl_stream.cpp
View File

@@ -1000,10 +1000,10 @@ unsigned long ssl_stream_log_error(struct bufferevent * bev, enum tfe_conn_dir d
default:
fs_id=-1;
}
ret_sslerr=ERR_GET_REASON(sslerr);
if(fs_id>=0)
{
mgr->stat_val[fs_id]++;
ret_sslerr=ERR_GET_REASON(sslerr);
}
if (!errno && !sslerr)
{
@@ -1099,11 +1099,17 @@ static void ssl_server_connected_eventcb(struct bufferevent * bev, short events,
char error_str[TFE_STRING_MAX];
const char* sni=s_upstream->client_hello->sni?s_upstream->client_hello->sni:"null";
long jiffies_ms;
char* addr_string=NULL;
char* addr_string=NULL;
unsigned long sslerr=0;
if (events & BEV_EVENT_ERROR)
{
ATOMIC_INC(&(ctx->mgr->stat_val[SSL_UP_ERR]));
ssl_stream_log_error(bev, CONN_DIR_UPSTREAM, ctx->mgr);
sslerr=ssl_stream_log_error(bev, CONN_DIR_UPSTREAM, ctx->mgr);
if(sslerr)
{
s_stream->up_parts.svc_status.has_protocol_errors=1;
ssl_service_cache_write(mgr->svc_cache, s_stream->up_parts.client_hello, &(s_stream->up_parts.svc_status));
}
snprintf(error_str, sizeof(error_str), "connect to original server failed : sni=%s", sni);
promise_failed(p, FUTURE_ERROR_EXCEPTION, error_str);
}
@@ -1229,10 +1235,11 @@ static void peek_chello_on_succ(future_result_t * result, void * user)
ret=ssl_service_cache_read(ctx->mgr->svc_cache, chello, svc_status);
if(ret==1)
{
TFE_LOG_DEBUG(ctx->mgr->logger, "SNI: %s service status pinning:%d, mauth:%d, ct:%d, ev:%d",
TFE_LOG_DEBUG(ctx->mgr->logger, "SNI: %s service status pinning:%d, mauth:%d, err:%d, ct:%d, ev:%d",
chello->sni,
svc_status->pinning_status,
svc_status->is_mutual_auth,
svc_status->has_protocol_errors,
svc_status->is_ct,
svc_status->is_ev);
}
@@ -1672,19 +1679,29 @@ static void ssl_client_connected_eventcb(struct bufferevent * bev, short events,
{
ATOMIC_INC(&(mgr->stat_val[SSL_DOWN_ERR]));
sslerr=ssl_stream_log_error(bev, CONN_DIR_DOWNSTREAM, mgr);
if(sslerr==SSL_R_SSLV3_ALERT_CERTIFICATE_UNKNOWN)
if(sslerr==SSL_R_SSLV3_ALERT_CERTIFICATE_UNKNOWN &&
s_upstream->is_server_cert_verify_passed &&
s_upstream->verify_result.is_hostmatched)
{
s_upstream->svc_status.pinning_status=PINNING_ST_PINNING;
ssl_service_cache_write(mgr->svc_cache, s_upstream->client_hello, &s_upstream->svc_status);
}
else if(sslerr>0 && sslerr!=SSL_R_SSLV3_ALERT_CERTIFICATE_UNKNOWN)
{
s_upstream->svc_status.has_protocol_errors=1;
ssl_service_cache_write(mgr->svc_cache, s_upstream->client_hello, &s_upstream->svc_status);
}
snprintf(error_str, sizeof(error_str), "connect to client failed : sni=%s", sni);
promise_failed(p, FUTURE_ERROR_EXCEPTION, error_str);
}
else if(events & BEV_EVENT_EOF)
{
ATOMIC_INC(&(mgr->stat_val[SSL_DOWN_ERR]));
s_stream->peer->up_parts.svc_status.pinning_status=PINNING_ST_MAYBE_PINNING;
ssl_service_cache_write(mgr->svc_cache, s_stream->peer->up_parts.client_hello, &(s_stream->peer->up_parts.svc_status));
if(!s_upstream->verify_result.is_hostmatched || !s_upstream->is_server_cert_verify_passed )
{
s_upstream->svc_status.pinning_status=PINNING_ST_MAYBE_PINNING;
ssl_service_cache_write(mgr->svc_cache, s_stream->peer->up_parts.client_hello, &(s_stream->peer->up_parts.svc_status));
}
snprintf(error_str, sizeof(error_str), "client side closed : sni=%s", sni);
promise_failed(p, FUTURE_ERROR_EXCEPTION, error_str);
}
@@ -2010,6 +2027,10 @@ int ssl_stream_get_integer_opt(struct ssl_stream *upstream, enum SSL_STREAM_OPT
case SSL_STREAM_OPT_PINNING_STATUS:
*opt_val=svc->pinning_status;
break;
case SSL_STREAM_OPT_HAS_PROTOCOL_ERRORS:
*opt_val=svc->has_protocol_errors;
break;
default:
return 0;
}