gfwleak/tango-tfe
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

TSG-22752 Delete SSL Fingerprints, use is_app_not_pinning to determine Certificate Not Installed or Certificate Pinning

Browse Source
This commit is contained in:
luwenpeng
2024-10-15 16:18:34 +08:00
parent b7fb2d8a42
commit 8e38bbcf48
12 changed files with 136 additions and 918 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
common/include/ssl_stream.h
View File

@@ -18,7 +18,7 @@ enum SSL_STREAM_OPT
SSL_STREAM_OPT_IS_CT_CERT, //0:FALSE, 1:TRUE.
SSL_STREAM_OPT_IS_MUTUAL_AUTH, //0:FALSE, 1:TRUE.
SSL_STREAM_OPT_PINNING_STATUS, //0:FALSE, 1:TRUE.
SSL_STREAM_OPT_JA3_PINNING_STATUS, //0:FALSE, 1:TRUE.
SSL_STREAM_OPT_APP_STATUS, //0:FALSE, 1:TRUE.
SSL_STREAM_OPT_HAS_PROTOCOL_ERRORS, //0:FALSE, 1:TRUE.
SSL_STREAM_OPT_NO_VERIFY_SELF_SIGNED, //VALUE is an interger, SIZE=sizeof(int). 1:ON, 0:OFF. DEFAULT:0.
SSL_STREAM_OPT_NO_VERIFY_COMMON_NAME, //VALUE is an interger, SIZE=sizeof(int). 1:ON, 0:OFF. DEFAULT:1.

1
conf/tfe/tfe.conf
View File

@@ -85,6 +85,7 @@ service_cache_expire_seconds=300
service_cache_fail_as_pinning_cnt=4
service_cache_fail_as_proto_err_cnt=5
service_cache_fail_time_window=30
service_cache_succ_as_app_not_pinning_cnt=1
# cert
check_cert_crl=0

2
platform/CMakeLists.txt
View File

@@ -6,7 +6,7 @@ add_executable(tfe
src/acceptor_kni_v4.cpp src/ssl_stream.cpp src/key_keeper.cpp src/ssl_fetch_cert.cpp
src/ssl_sess_cache.cpp src/ssl_sess_ticket.cpp src/ssl_service_cache.cpp
src/ssl_trusted_cert_storage.cpp src/ev_root_ca_metadata.cpp src/ssl_utils.cpp
src/tcp_stream.cpp src/main.cpp src/proxy.cpp src/sender_scm.cpp src/watchdog_kni.cpp src/watchdog_tfe.cpp src/ssl_ja3.cpp src/watchdog_3rd_device.cpp)
src/tcp_stream.cpp src/main.cpp src/proxy.cpp src/sender_scm.cpp src/watchdog_kni.cpp src/watchdog_tfe.cpp src/watchdog_3rd_device.cpp)
target_include_directories(tfe PUBLIC ${CMAKE_CURRENT_LIST_DIR}/include/external)
target_include_directories(tfe PRIVATE ${CMAKE_CURRENT_LIST_DIR}/include/internal)

10
platform/include/internal/ssl_ja3.h
View File

@@ -1,10 +0,0 @@
#pragma once
struct ssl_ja3 {
char *ja3;
char *ja3_hash;
};
struct ssl_ja3 *ssl_ja3_generate_fingerprint(const unsigned char *data, int len);
void ssl_ja3_free(struct ssl_ja3 *fingerprint);

6
platform/include/internal/ssl_service_cache.h
View File

@@ -13,7 +13,7 @@
struct ssl_service_status
{
char cli_pinning_status;
char ja3_pinning_status;
char is_app_not_pinning;
char is_ev;
char is_ct;
char is_mutual_auth;
@@ -31,6 +31,7 @@ struct ssl_service_cache_statistics
};
struct ssl_service_cache
{
MESA_htable_handle app_st_hash;
MESA_htable_handle cli_st_hash;
MESA_htable_handle srv_st_hash;
@@ -38,8 +39,9 @@ struct ssl_service_cache
unsigned int fail_as_cli_pinning_count;
unsigned int fail_as_proto_err_count;
unsigned int fail_time_window;
unsigned int succ_as_app_not_pinning_count;
};
struct ssl_service_cache* ssl_service_cache_create(unsigned int slot_size, unsigned int expire_seconds, int fail_as_pinning_cnt, int fail_as_proto_err_cnt, int fail_time_win);
struct ssl_service_cache *ssl_service_cache_create(unsigned int slot_size, unsigned int expire_seconds, int fail_as_pinning_cnt, int fail_as_proto_err_cnt, int fail_time_win, int succ_as_app_not_pinning_cnt);
void ssl_service_cache_destroy(struct ssl_service_cache* cache);
int ssl_service_cache_read(struct ssl_service_cache *svc_cache, const struct ssl_chello *chello, const struct tfe_stream *tcp_stream, struct ssl_service_status *result);

603
platform/src/ssl_ja3.cpp
View File

@@ -1,603 +0,0 @@
#include <openssl/md5.h>
#include <stdio.h>
#include <stdlib.h>
#include <ssl_ja3.h>
#ifndef MIN
#define MIN(a, b) ((a) > (b) ? (b) : (a))
#endif
#define BSB_INIT(b, buffer, size) \
do \
{ \
(b).buf = (unsigned char *)buffer; \
(b).ptr = (unsigned char *)buffer; \
int s = (int)size; \
if ((buffer == NULL) || (s < 0)) \
(b).end = 0; \
else \
(b).end = (unsigned char *)buffer + size; \
} while (0)
#define BSB_SET_ERROR(b) ((b).end = NULL)
#define BSB_IS_ERROR(b) ((b).end == NULL)
#define BSB_NOT_ERROR(b) ((b).end != NULL)
#define BSB_LENGTH(b) ((b).ptr - (b).buf)
#define BSB_POSITION BSB_LENGTH
#define BSB_SIZE(b) ((b).end - (b).buf)
#define BSB_REMAINING(b) ((b).end ? (b).end - (b).ptr : 0)
#define BSB_WORK_PTR(b) ((b).ptr)
#define BSB_EXPORT_u08(b, x) \
do \
{ \
if ((b).ptr && (b).ptr + 1 <= (b).end) \
{ \
*(((b).ptr)++) = (unsigned char)x; \
} \
else \
BSB_SET_ERROR(b); \
} while (0)
#define BSB_EXPORT_u16(b, x) \
do \
{ \
if ((b).ptr && (b).ptr + 2 <= (b).end) \
{ \
uint16_t t = (uint16_t)x; \
*(((b).ptr)++) = (t & 0xff00) >> 8; \
*(((b).ptr)++) = (t & 0x00ff); \
} \
else \
BSB_SET_ERROR(b); \
} while (0)
#define BSB_EXPORT_u32(b, x) \
do \
{ \
if ((b).ptr && (b).ptr + 4 <= (b).end) \
{ \
uint32_t t = x; \
*(((b).ptr)++) = (t & 0xff000000) >> 24; \
*(((b).ptr)++) = (t & 0x00ff0000) >> 16; \
*(((b).ptr)++) = (t & 0x0000ff00) >> 8; \
*(((b).ptr)++) = (t & 0x000000ff); \
} \
else \
BSB_SET_ERROR(b); \
} while (0)
#define BSB_EXPORT_ptr(b, x, size) \
do \
{ \
if ((x || size == 0) && \
(b).ptr + size <= (b).end && \
(b).ptr + size >= (b).buf) \
{ \
memcpy((b).ptr, x, size); \
(b).ptr += size; \
} \
else \
BSB_SET_ERROR(b); \
} while (0)
#define BSB_EXPORT_ptr_some(b, x, size) \
do \
{ \
if ((b).ptr + size <= (b).end) \
{ \
memcpy((b).ptr, x, size); \
(b).ptr += size; \
} \
else if (BSB_NOT_ERROR(b)) \
{ \
memcpy((b).ptr, x, BSB_REMAINING(b)); \
(b).ptr += BSB_REMAINING(b); \
} \
} while (0)
#define BSB_EXPORT_cstr(b, x) \
do \
{ \
const int size = sizeof x - 1; \
if ((b).ptr + size <= (b).end) \
{ \
memcpy((b).ptr, x, size); \
(b).ptr += size; \
} \
else \
BSB_SET_ERROR(b); \
} while (0)
#define BSB_EXPORT_skip(b, size) \
do \
{ \
if ((b).ptr + size <= (b).end && \
(b).ptr + size >= (b).buf) \
{ \
(b).ptr += size; \
if ((b).ptr < (b).buf) \
(b).end = 0; \
} \
else \
BSB_SET_ERROR(b); \
} while (0)
#define BSB_EXPORT_rewind(b, size) \
do \
{ \
if ((b).ptr - size <= (b).end && \
(b).ptr - size >= (b).buf) \
{ \
(b).ptr -= size; \
if ((b).ptr < (b).buf) \
(b).end = 0; \
} \
else \
{ \
BSB_SET_ERROR(b); \
} \
} while (0)
#if defined(C9X)
#define BSB_EXPORT_sprintf(b, ...) \
do \
{ \
if ((b).end != 0) \
{ \
int l = snprintf((char *)(b).ptr, \
(b).end - (b).ptr, \
__VA_ARGS__); \
if (l <= (b).end - (b).ptr) \
{ \
(b).ptr += l; \
} \
else \
{ \
BSB_SET_ERROR(b); \
} \
} \
} while (0)
#else
#define BSB_EXPORT_sprintf(b, args...) \
do \
{ \
if ((b).end != 0) \
{ \
int l = snprintf((char *)(b).ptr, \
(b).end - (b).ptr, \
##args); \
if (l <= (b).end - (b).ptr) \
{ \
(b).ptr += l; \
} \
else \
{ \
BSB_SET_ERROR(b); \
} \
} \
} while (0)
#endif
#define BSB_IMPORT_u08(b, x) \
do \
{ \
if ((b).ptr && (b).ptr + 1 <= (b).end) \
{ \
x = *(((b).ptr)++); \
} \
else \
BSB_SET_ERROR(b); \
} while (0)
#define BSB_IMPORT_u16(b, x) \
do \
{ \
if ((b).ptr && (b).ptr + 2 <= (b).end) \
{ \
x = ((uint16_t)((b).ptr)[0]) << 8 | \
((uint16_t)((b).ptr)[1]); \
(b).ptr += 2; \
} \
else \
BSB_SET_ERROR(b); \
} while (0)
#define BSB_IMPORT_u24(b, x) \
do \
{ \
if ((b).ptr && (b).ptr + 3 <= (b).end) \
{ \
x = ((uint32_t)((b).ptr)[0]) << 16 | \
((uint32_t)((b).ptr)[1]) << 8 | \
((uint32_t)((b).ptr)[2]); \
(b).ptr += 3; \
} \
else \
BSB_SET_ERROR(b); \
} while (0)
#define BSB_IMPORT_u32(b, x) \
do \
{ \
if ((b).ptr && (b).ptr + 4 <= (b).end) \
{ \
x = ((uint32_t)((b).ptr)[0]) << 24 | \
((uint32_t)((b).ptr)[1]) << 16 | \
((uint32_t)((b).ptr)[2]) << 8 | \
((uint32_t)((b).ptr)[3]); \
(b).ptr += 4; \
} \
else \
BSB_SET_ERROR(b); \
} while (0)
#define BSB_LEXPORT_u08(b, x) BSB_EXPORT_u08(b, x)
#define BSB_LEXPORT_u16(b, x) \
do \
{ \
if ((b).ptr + 2 <= (b).end) \
{ \
uint16_t t = (uint16_t)x; \
*(((b).ptr)++) = (t & 0x00ff); \
*(((b).ptr)++) = (t & 0xff00) >> 8; \
} \
else \
BSB_SET_ERROR(b); \
} while (0)
#define BSB_LEXPORT_u32(b, x) \
do \
{ \
if ((b).ptr + 4 <= (b).end) \
{ \
uint32_t t = x; \
*(((b).ptr)++) = (t & 0x000000ff); \
*(((b).ptr)++) = (t & 0x0000ff00) >> 8; \
*(((b).ptr)++) = (t & 0x00ff0000) >> 16; \
*(((b).ptr)++) = (t & 0xff000000) >> 24; \
} \
else \
BSB_SET_ERROR(b); \
} while (0)
#define BSB_LIMPORT_u08(b, x) BSB_IMPORT_u08(b, x)
#define BSB_LIMPORT_u16(b, x) \
do \
{ \
if ((b).ptr + 2 <= (b).end) \
{ \
x = ((uint16_t)((b).ptr)[1]) << 8 | \
((uint16_t)((b).ptr)[0]); \
(b).ptr += 2; \
} \
else \
BSB_SET_ERROR(b); \
} while (0)
#define BSB_LIMPORT_u24(b, x) \
do \
{ \
if ((b).ptr + 3 <= (b).end) \
{ \
x = ((uint32_t)((b).ptr)[2]) << 16 | \
((uint32_t)((b).ptr)[1]) << 8 | \
((uint32_t)((b).ptr)[0]); \
(b).ptr += 3; \
} \
else \
BSB_SET_ERROR(b); \
} while (0)
#define BSB_LIMPORT_u32(b, x) \
do \
{ \
if ((b).ptr + 4 <= (b).end) \
{ \
x = ((uint32_t)((b).ptr)[3]) << 24 | \
((uint32_t)((b).ptr)[2]) << 16 | \
((uint32_t)((b).ptr)[1]) << 8 | \
((uint32_t)((b).ptr)[0]); \
(b).ptr += 4; \
} \
else \
BSB_SET_ERROR(b); \
} while (0)
#define BSB_IMPORT_ptr(b, x, size) \
do \
{ \
if ((b).ptr + size <= (b).end && \
(b).ptr + size >= (b).buf) \
{ \
(x) = (b).ptr; \
(b).ptr += size; \
} \
else \
{ \
BSB_SET_ERROR(b); \
x = 0; \
} \
} while (0)
#define BSB_LIMPORT_ptr BSB_IMPORT_ptr
#define BSB_IMPORT_skip BSB_EXPORT_skip
#define BSB_LIMPORT_skip BSB_EXPORT_skip
#define BSB_IMPORT_rewind BSB_EXPORT_rewind
#define BSB_LIMPORT_rewind BSB_EXPORT_rewind
#define BSB_memchr(b, ch, pos) \
do \
{ \
if (BSB_IS_ERROR(b)) \
{ \
pos = 0; \
break; \
} \
char *s = memchr((char *)b.ptr, ch, BSB_REMAINING(b)); \
if (s) \
pos = (char *)s - (char *)b.ptr; \
else \
pos = 0; \
} while (0)
#define BSB_memcmp(str, b, len) ((b).ptr + len <= (b).end ? memcmp(str, b.ptr, len) : -1)
#define BSB_PEEK(b) ((b).ptr + 1 <= (b).end ? *b.ptr : -1)
#define BSB_IMPORT_zbyte(b, x, size) \
do \
{ \
if ((b).ptr + size <= (b).end) \
{ \
memcpy(x, b, size); \
(x)[size] = 0; \
(b).ptr += size; \
} \
else \
{ \
BSB_SET_ERROR(b); \
(x)[0] = 0; \
} \
} while (0)
/* Private data structure */
typedef struct bsb
{
unsigned char *buf;
unsigned char *ptr;
unsigned char *end;
} BSB;
// https://tools.ietf.org/html/draft-davidben-tls-grease-00
static int tls_is_grease_value(uint32_t val)
{
if ((val & 0x0f) != 0x0a)
return 0;
if ((val & 0xff) != ((val >> 8) & 0xff))
return 0;
return 1;
}
static int md5sum(const char *str, int len, char *buf, int size)
{
int n;
int ret = 0;
MD5_CTX ctx;
unsigned char tmp[MD5_DIGEST_LENGTH];
MD5_Init(&ctx);
MD5_Update(&ctx, str, len);
MD5_Final(tmp, &ctx);
for (n = 0; n < MD5_DIGEST_LENGTH; n++)
{
ret += snprintf(buf + ret, size - ret, "%.2x", tmp[n]);
}
return ret;
}
void ssl_ja3_free(struct ssl_ja3 *fingerprint)
{
if (fingerprint)
{
if (fingerprint->ja3)
{
free(fingerprint->ja3);
fingerprint->ja3 = NULL;
}
if (fingerprint->ja3_hash)
{
free(fingerprint->ja3_hash);
fingerprint->ja3_hash = NULL;
}
free(fingerprint);
fingerprint = NULL;
}
}
/******************************************************************************
* JA3 generation algorithm refers to tls_process_client() in
* https://github.com/aol/moloch.
******************************************************************************/
struct ssl_ja3 *ssl_ja3_generate_fingerprint(const unsigned char *data, int len)
{
BSB sslbsb;
char ja3[30000];
BSB ja3bsb;
char ecfja3[1000];
BSB ecfja3bsb;
char eja3[10000];
BSB eja3bsb;
char ecja3[10000];
BSB ecja3bsb;
BSB_INIT(sslbsb, data, len);
BSB_INIT(ja3bsb, ja3, sizeof(ja3));
BSB_INIT(ecja3bsb, ecja3, sizeof(ecja3));
BSB_INIT(ecfja3bsb, ecfja3, sizeof(ecfja3));
BSB_INIT(eja3bsb, eja3, sizeof(eja3));
if (BSB_REMAINING(sslbsb) > 5)
{
unsigned char *ssldata = BSB_WORK_PTR(sslbsb);
int ssllen = MIN(BSB_REMAINING(sslbsb) - 5, ssldata[3] << 8 | ssldata[4]);
BSB pbsb;
BSB_INIT(pbsb, ssldata + 5, ssllen);
if (BSB_REMAINING(pbsb) > 7)
{
unsigned char *pdata = BSB_WORK_PTR(pbsb);
int plen = MIN(BSB_REMAINING(pbsb) - 4, pdata[2] << 8 | pdata[3]);
uint16_t ver = 0;
BSB_IMPORT_skip(pbsb, 4); // type + len
BSB_IMPORT_u16(pbsb, ver);
BSB_EXPORT_sprintf(ja3bsb, "%d,", ver);
BSB cbsb;
BSB_INIT(cbsb, pdata + 6, plen - 2); // The - 4 for plen is done above, confusing
if (BSB_REMAINING(cbsb) > 32)
{
BSB_IMPORT_skip(cbsb, 32); // Random
int skiplen = 0;
BSB_IMPORT_u08(cbsb, skiplen); // Session Id Length
if (skiplen > 0 && BSB_REMAINING(cbsb) > skiplen)
{
// Remove unnecessary code
}
BSB_IMPORT_skip(cbsb, skiplen); // Session Id
BSB_IMPORT_u16(cbsb, skiplen); // Ciper Suites Length
while (BSB_NOT_ERROR(cbsb) && skiplen > 0)
{
uint16_t c = 0;
BSB_IMPORT_u16(cbsb, c);
if (!tls_is_grease_value(c))
{
BSB_EXPORT_sprintf(ja3bsb, "%d-", c);
}
skiplen -= 2;
}
BSB_EXPORT_rewind(ja3bsb, 1); // Remove last -
BSB_EXPORT_u08(ja3bsb, ',');
BSB_IMPORT_u08(cbsb, skiplen); // Compression Length
BSB_IMPORT_skip(cbsb, skiplen); // Compressions
if (BSB_REMAINING(cbsb) > 6)
{
int etotlen = 0;
BSB_IMPORT_u16(cbsb, etotlen); // Extensions Length
etotlen = MIN(etotlen, BSB_REMAINING(cbsb));
BSB ebsb;
BSB_INIT(ebsb, BSB_WORK_PTR(cbsb), etotlen);
while (BSB_REMAINING(ebsb) > 4)
{
uint16_t etype = 0, elen = 0;
BSB_IMPORT_u16(ebsb, etype);
BSB_IMPORT_u16(ebsb, elen);
if (!tls_is_grease_value(etype))
BSB_EXPORT_sprintf(eja3bsb, "%d-", etype);
if (elen > BSB_REMAINING(ebsb))
break;
if (etype == 0)
{ // SNI
BSB snibsb;
BSB_INIT(snibsb, BSB_WORK_PTR(ebsb), elen);
BSB_IMPORT_skip(ebsb, elen);
int sni = 0;
BSB_IMPORT_u16(snibsb, sni); // list len
if (sni != BSB_REMAINING(snibsb))
continue;
BSB_IMPORT_u08(snibsb, sni); // type
if (sni != 0)
continue;
BSB_IMPORT_u16(snibsb, sni); // len
if (sni != BSB_REMAINING(snibsb))
continue;
}
else if (etype == 0x000a)
{ // Elliptic Curves
BSB bsb;
BSB_INIT(bsb, BSB_WORK_PTR(ebsb), elen);
BSB_IMPORT_skip(ebsb, elen);
uint16_t llen = 0;
BSB_IMPORT_u16(bsb, llen); // list len
while (llen > 0 && !BSB_IS_ERROR(bsb))
{
uint16_t c = 0;
BSB_IMPORT_u16(bsb, c);
if (!tls_is_grease_value(c))
{
BSB_EXPORT_sprintf(ecja3bsb, "%d-", c);
}
llen -= 2;
}
BSB_EXPORT_rewind(ecja3bsb, 1); // Remove last -
}
else if (etype == 0x000b)
{ // Elliptic Curves point formats
BSB bsb;
BSB_INIT(bsb, BSB_WORK_PTR(ebsb), elen);
BSB_IMPORT_skip(ebsb, elen);
uint16_t llen = 0;
BSB_IMPORT_u08(bsb, llen); // list len
while (llen > 0 && !BSB_IS_ERROR(bsb))
{
uint8_t c = 0;
BSB_IMPORT_u08(bsb, c);
BSB_EXPORT_sprintf(ecfja3bsb, "%d-", c);
llen -= 1;
}
BSB_EXPORT_rewind(ecfja3bsb, 1); // Remove last -
}
else
{
BSB_IMPORT_skip(ebsb, elen);
}
}
BSB_EXPORT_rewind(eja3bsb, 1); // Remove last -
}
}
}
BSB_IMPORT_skip(sslbsb, ssllen + 5);
if (BSB_LENGTH(ja3bsb) > 0 && BSB_NOT_ERROR(ja3bsb) && BSB_NOT_ERROR(ecja3bsb) && BSB_NOT_ERROR(eja3bsb) && BSB_NOT_ERROR(ecfja3bsb))
{
BSB_EXPORT_sprintf(ja3bsb, "%.*s,%.*s,%.*s", (int)BSB_LENGTH(eja3bsb), eja3, (int)BSB_LENGTH(ecja3bsb), ecja3, (int)BSB_LENGTH(ecfja3bsb), ecfja3);
char md5[64] = {0};
int len = md5sum(ja3, BSB_LENGTH(ja3bsb), md5, sizeof(md5));
struct ssl_ja3 *result = (struct ssl_ja3 *)calloc(sizeof(struct ssl_ja3), 1);
asprintf(&(result->ja3), "%.*s", (int)BSB_LENGTH(ja3bsb), ja3);
asprintf(&(result->ja3_hash), "%.*s", len, md5);
return result;
}
}
return NULL;
}

344
platform/src/ssl_service_cache.cpp
View File

@@ -1,17 +1,8 @@
#include <ssl_service_cache.h>
#include <MESA/maat.h>
#include <tfe_resource.h>
#include <ssl_stream.h>
#include <cjson/cJSON.h>
struct ssl_svc_ja3
{
uuid_t uuid;
char ja3_hash[33];
int pinning_state;
int ref_cnt;
};
struct ssl_svc_addr
{
const char *sip;
@@ -20,170 +11,6 @@ struct ssl_svc_addr
const char *dport;
};
static void ssl_svc_ja3_param_dup_cb(const char *table_name, void **to, void **from, long argl, void *argp)
{
struct ssl_svc_ja3 *param = (struct ssl_svc_ja3 *)*from;
if (param)
{
__sync_add_and_fetch(&(param->ref_cnt), 1);
*to = param;
}
else
{
*to = NULL;
}
return;
}
// NOTE: key is ja3_hash
static void ssl_svc_ja3_param_new_cb(const char *table_name, const char *key, const char *table_line, void **ad, long argl, void *argp)
{
cJSON *json = NULL;
cJSON *item = NULL;
struct ssl_svc_ja3 *param = NULL;
char *json_str = strdup(table_line);
json = cJSON_Parse(json_str);
if (json == NULL)
{
TFE_LOG_ERROR(g_default_logger, "Invalid JA3 policy: (invalid json format) %s", table_line);
goto error_out;
}
param = ALLOC(struct ssl_svc_ja3, 1);
param->ref_cnt = 1;
// uuid
item = cJSON_GetObjectItem(json, "uuid");
if (!item || !cJSON_IsString(item))
{
TFE_LOG_ERROR(g_default_logger, "Invalid JA3 policy: (invalid uuid param) %s", table_line);
goto error_out;
}
uuid_parse(item->valuestring, param->uuid);
// ja3_hash
item = cJSON_GetObjectItem(json, "ja3_hash");
if (!item || !cJSON_IsString(item))
{
TFE_LOG_ERROR(g_default_logger, "Invalid JA3 policy: (invalid ja3_hash param) %s", table_line);
goto error_out;
}
strncpy(param->ja3_hash, item->valuestring, 32);
// pinning_state
item = cJSON_GetObjectItem(json, "pinning_state");
if (!item || !cJSON_IsNumber(item))
{
TFE_LOG_ERROR(g_default_logger, "Invalid JA3 policy: (invalid pinning_state param) %s", table_line);
goto error_out;
}
param->pinning_state = item->valueint;
*ad = param;
TFE_LOG_INFO(g_default_logger, "Add JA3 policy: uuid:%s, ja3_hash:%s, pinning_state:%d",
key, param->ja3_hash, param->pinning_state);
cJSON_Delete(json);
free(json_str);
return;
error_out:
if (json)
{
cJSON_Delete(json);
}
if (json_str)
{
free(json_str);
}
if (param)
{
free(param);
}
*ad = NULL;
return;
}
static void ssl_svc_ja3_param_free_cb(const char *table_name, void **ad, long argl, void *argp)
{
struct ssl_svc_ja3 *param = (struct ssl_svc_ja3 *)*ad;
if (param == NULL)
{
return;
}
if ((__sync_sub_and_fetch(&param->ref_cnt, 1) == 0))
{
char uuid_str[UUID_STRING_SIZE] = {0};
uuid_unparse(param->uuid, uuid_str);
TFE_LOG_INFO(g_default_logger, "Del JA3 policy: id:%s", uuid_str);
free(param);
*ad = NULL;
}
}
static void ssl_svc_ja3_param_free(struct ssl_svc_ja3 *param)
{
ssl_svc_ja3_param_free_cb(NULL, (void **)&param, 0, NULL);
}
static int ssl_svc_ja3_init()
{
if (maat_plugin_table_ex_schema_register(tfe_get_maat_handle(),
"PXY_SSL_FINGERPRINT",
ssl_svc_ja3_param_new_cb,
ssl_svc_ja3_param_free_cb,
ssl_svc_ja3_param_dup_cb,
0,
NULL) != 0)
{
TFE_LOG_ERROR(g_default_logger, "failed at Maat_plugin_EX_register(PXY_SSL_FINGERPRINT)");
return -1;
}
else
{
return 0;
}
}
enum ssl_ja3_pinning_status ssl_svc_ja3_scan(char *ja3_hash, const char *addr_str)
{
enum ssl_ja3_pinning_status ret = JA3_PINNING_STATUS_UNKNOWN;
struct ssl_svc_ja3 *param = NULL;
char uuid_str[UUID_STRING_SIZE] = {0};
param = (struct ssl_svc_ja3 *)maat_plugin_table_get_ex_data(tfe_get_maat_handle(), "PXY_SSL_FINGERPRINT", ja3_hash, strlen(ja3_hash));
if (param == NULL)
{
ret = JA3_PINNING_STATUS_UNKNOWN;
goto end;
}
uuid_unparse(param->uuid, uuid_str);
TFE_LOG_INFO(g_default_logger, "Hit JA3 policy: uuid:%s, ja3_hash:%s, pinning_state:%d, addr:%s",
uuid_str, param->ja3_hash, param->pinning_state, addr_str);
// 1 - pinning
if (param->pinning_state)
{
ret = JA3_PINNING_STATUS_IS_PINNING;
}
// 0 - not pinning
else
{
ret = JA3_PINNING_STATUS_NOT_PINNING;
}
end:
if (param)
{
ssl_svc_ja3_param_free(param);
param = NULL;
}
return ret;
}
struct ssl_svc_client_st
{
time_t last_update_time;
@@ -200,6 +27,11 @@ struct ssl_svc_server_st
long long ct_st_switched;
struct ssl_service_cache* ref_svc_cache;
};
struct ssl_svc_app_st
{
unsigned int down_ssl_success_cnt;
struct ssl_service_cache *ref_svc_cache;
};
struct ssl_service_write_args
{
struct ssl_service_cache* cache;
@@ -241,40 +73,26 @@ static void ssl_svc_free_server_st(void * data)
free(p);
return;
}
static size_t ssl_svc_server_st_mk_key(struct ssl_svc_addr *addr_info, const struct ssl_chello* chello, const struct tfe_stream *tcp_stream, char* key_buff, size_t sz)
static void ssl_svc_free_app_st(void *data)
{
struct ssl_svc_app_st *p = (struct ssl_svc_app_st *)data;
struct ssl_service_cache *svc_cache = p->ref_svc_cache;
if (p->down_ssl_success_cnt > svc_cache->succ_as_app_not_pinning_count)
{
svc_cache->stat.app_not_pinning_cnt--;
}
free(p);
}
static size_t ssl_svc_server_st_mk_key(struct ssl_svc_addr *addr_info, const struct ssl_chello* chello, char* key_buff, size_t sz)
{
size_t key_len=0;
key_len=snprintf(key_buff, sz, "%s:%s:%s:", addr_info->dip, addr_info->dport, chello->sni ? chello->sni : "null");
return key_len;
}
static size_t ssl_svc_app_st_mk_key(struct ssl_svc_addr *addr_info, const struct ssl_chello *chello, const struct tfe_stream *tcp_stream, char *key_buff, size_t sz)
static size_t ssl_svc_app_st_mk_key(struct ssl_svc_addr *addr_info, const struct ssl_chello *chello, char *key_buff, size_t sz)
{
char ja3_val[64] = {0};
uint16_t ja3_len = 0;
size_t key_len = 0;
struct tfe_cmsg *cmsg = tfe_stream_get0_cmsg(tcp_stream);
if (cmsg != NULL)
{
int ret = tfe_cmsg_get_value(cmsg, TFE_CMSG_SSL_CLIENT_JA3_FINGERPRINT, (unsigned char *)ja3_val, sizeof(ja3_val), &ja3_len);
if (ret != 0)
{
TFE_LOG_ERROR(g_default_logger, "failed at fetch ssl client ja3 fingerprint from cmsg: %s, %s", strerror(-ret), tcp_stream->str_stream_info);
}
else
{
TFE_LOG_DEBUG(g_default_logger, "fetch ssl client ja3 fingerprint:%s addr: %s", ja3_val, tcp_stream->str_stream_info);
}
}
// If ja3 is successfully obtained, use ja3 to generate hashkey
if (strlen(ja3_val))
{
key_len = snprintf(key_buff, sz, "%s:%s", ja3_val, chello->sni ? chello->sni : addr_info->dip);
return key_len;
}
// otherwise, splicing ssl attributes to generate hashkey
key_len=snprintf(key_buff, sz, "%d:%d:%s:%s", chello->min_version.ossl_format,
// splicing ssl attributes to generate hashkey
size_t key_len=snprintf(key_buff, sz, "%d:%d:%s:%s", chello->min_version.ossl_format,
chello->max_version.ossl_format,
chello->sni?chello->sni: addr_info->dip ,
chello->alpn?chello->alpn:"null");
@@ -295,14 +113,14 @@ static size_t ssl_svc_app_st_mk_key(struct ssl_svc_addr *addr_info, const struct
}
return key_len;
}
static size_t ssl_svc_client_st_mk_key(struct ssl_svc_addr *addr_info, const struct ssl_chello *chello, const struct tfe_stream *tcp_stream, char *key_buff, size_t sz)
static size_t ssl_svc_client_st_mk_key(struct ssl_svc_addr *addr_info, const struct ssl_chello *chello, char *key_buff, size_t sz)
{
size_t key_len=0;
char chello_id_buff[sz];
size_t chello_id_len=0;
key_len=snprintf(key_buff, sz, "%s:", addr_info->sip);
chello_id_len = ssl_svc_app_st_mk_key(addr_info, chello, tcp_stream, chello_id_buff, sizeof(chello_id_buff));
chello_id_len = ssl_svc_app_st_mk_key(addr_info, chello, chello_id_buff, sizeof(chello_id_buff));
memcpy(key_buff+key_len, chello_id_buff, MIN(chello_id_len, sz-key_len));
key_len += MIN(chello_id_len, sz-key_len);
@@ -407,6 +225,7 @@ static long srv_st_read_cb(void * data, const uchar * key, uint size, void * use
result->is_ev=srv_st->is_ev;
return 1;
}
static long srv_st_write_cb(void * data, const uchar * key, uint size, void * user_arg)
{
struct ssl_svc_server_st* srv_st=(struct ssl_svc_server_st*)data;
@@ -443,6 +262,46 @@ static long srv_st_write_cb(void * data, const uchar * key, uint size, void * us
return 1;
}
static long app_st_read_cb(void *data, const uchar *key, uint size, void *user_arg)
{
struct ssl_svc_app_st *app_st = (struct ssl_svc_app_st *)data;
struct ssl_service_status *result = (struct ssl_service_status *)user_arg;
if (app_st == NULL)
{
return 0;
}
if (app_st->down_ssl_success_cnt > app_st->ref_svc_cache->succ_as_app_not_pinning_count)
{
result->is_app_not_pinning = 1;
}
return 1;
}
static long app_st_write_cb(void *data, const uchar *key, uint size, void *user_arg)
{
struct ssl_svc_app_st *app_st = (struct ssl_svc_app_st *)data;
struct ssl_service_write_args *args = (struct ssl_service_write_args *)user_arg;
const struct ssl_service_status *status = args->status;
struct ssl_service_cache *cache = args->cache;
UNUSED int ret = 0;
if (app_st == NULL)
{
app_st = ALLOC(struct ssl_svc_app_st, 1);
app_st->ref_svc_cache = cache;
ret = MESA_htable_add(cache->app_st_hash, key, size, app_st);
assert(ret >= 0);
}
if (status->is_app_not_pinning)
{
app_st->down_ssl_success_cnt++;
}
if (app_st->down_ssl_success_cnt > cache->succ_as_app_not_pinning_count)
{
cache->stat.app_not_pinning_cnt++;
}
return 1;
}
int ssl_service_cache_read(struct ssl_service_cache *svc_cache, const struct ssl_chello *chello, const struct tfe_stream *tcp_stream, struct ssl_service_status *result)
{
long cli_st_cb_ret=0, svr_st_cb_ret=0, app_st_cb_ret=0;
@@ -460,39 +319,27 @@ int ssl_service_cache_read(struct ssl_service_cache *svc_cache, const struct ssl
tfe_stream_addr_str_split(addr_str, &(addr_info.sip), &(addr_info.sport), &(addr_info.dip), &(addr_info.dport));
memset(hash_key, 0, sizeof(hash_key));
temp_key_sz = ssl_svc_client_st_mk_key(&addr_info, chello, tcp_stream, temp_key, sizeof(temp_key));
temp_key_sz = ssl_svc_client_st_mk_key(&addr_info, chello, temp_key, sizeof(temp_key));
hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
MESA_htable_search_cb(svc_cache->cli_st_hash, hash_key, (unsigned int) hash_key_sz, cli_st_read_cb, result, &cli_st_cb_ret);
TFE_LOG_DEBUG(g_default_logger, "client table, hash:%s, found:%ld, sni:%s, addr:%s, mutual:%d, pinning:%d, err:%d",
hash_key, cli_st_cb_ret, chello->sni, tcp_stream->str_stream_info, result->is_mutual_auth, result->cli_pinning_status, result->has_protocol_errors);
memset(hash_key, 0, sizeof(hash_key));
temp_key_sz = ssl_svc_server_st_mk_key(&addr_info, chello, tcp_stream, temp_key, sizeof(temp_key));
temp_key_sz = ssl_svc_server_st_mk_key(&addr_info, chello, temp_key, sizeof(temp_key));
hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
MESA_htable_search_cb(svc_cache->srv_st_hash, hash_key, (unsigned int) hash_key_sz, srv_st_read_cb, result, &svr_st_cb_ret);
TFE_LOG_DEBUG(g_default_logger, "server table, hash:%s, found:%ld, sni:%s, addr:%s, ct:%d, ev:%d",
hash_key, svr_st_cb_ret, chello->sni, tcp_stream->str_stream_info, result->is_ct, result->is_ev);
char ja3_hash[64] = {0};
uint16_t ja3_len = 0;
result->ja3_pinning_status = JA3_PINNING_STATUS_UNKNOWN;
struct tfe_cmsg *cmsg = tfe_stream_get0_cmsg(tcp_stream);
if (cmsg)
{
int ret = tfe_cmsg_get_value(cmsg, TFE_CMSG_SSL_CLIENT_JA3_FINGERPRINT, (unsigned char *)ja3_hash, sizeof(ja3_hash), &ja3_len);
if (ret == 0)
{
result->ja3_pinning_status = ssl_svc_ja3_scan(ja3_hash, tcp_stream->str_stream_info);
if (result->ja3_pinning_status != JA3_PINNING_STATUS_UNKNOWN)
{
app_st_cb_ret = 1;
}
}
}
TFE_LOG_DEBUG(g_default_logger, "app table, hash:%s, found:%ld, sni:%s, addr:%s, ja3_pinning_status:%d",
ja3_hash, app_st_cb_ret, chello->sni, tcp_stream->str_stream_info, result->ja3_pinning_status);
memset(hash_key, 0, sizeof(hash_key));
temp_key_sz = ssl_svc_app_st_mk_key(&addr_info, chello, temp_key, sizeof(temp_key));
hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
MESA_htable_search_cb(svc_cache->app_st_hash, hash_key, (unsigned int)hash_key_sz, app_st_read_cb, result, &app_st_cb_ret);
TFE_LOG_DEBUG(g_default_logger, "app table, hash:%s, found:%ld, sni:%s, addr:%s, app_not_pinning:%d",
hash_key, app_st_cb_ret, chello->sni, addr_str, result->is_app_not_pinning);
free(addr_str);
free(addr_str);
if(cli_st_cb_ret||svr_st_cb_ret||app_st_cb_ret)
{
@@ -525,7 +372,7 @@ void ssl_service_cache_write(struct ssl_service_cache *svc_cache, const struct s
if(status->is_mutual_auth||status->cli_pinning_status!=PINNING_ST_NOT_PINNING||status->has_protocol_errors)
{
memset(hash_key, 0, sizeof(hash_key));
temp_key_sz = ssl_svc_client_st_mk_key(&addr_info, chello, tcp_stream, temp_key, sizeof(temp_key));
temp_key_sz = ssl_svc_client_st_mk_key(&addr_info, chello, temp_key, sizeof(temp_key));
hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
TFE_LOG_DEBUG(g_default_logger, "client table, hash:%s, sni:%s, addr:%s, mutual:%d, pinning:%d, err:%d",
hash_key, chello->sni, tcp_stream->str_stream_info, status->is_mutual_auth, status->cli_pinning_status, status->has_protocol_errors);
@@ -534,23 +381,27 @@ void ssl_service_cache_write(struct ssl_service_cache *svc_cache, const struct s
if(status->is_ct||status->is_ev)
{
memset(hash_key, 0, sizeof(hash_key));
temp_key_sz = ssl_svc_server_st_mk_key(&addr_info, chello, tcp_stream, temp_key, sizeof(temp_key));
temp_key_sz = ssl_svc_server_st_mk_key(&addr_info, chello, temp_key, sizeof(temp_key));
hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
TFE_LOG_DEBUG(g_default_logger, "server table, hash:%s, sni:%s, addr:%s, ct:%d, ev:%d",
hash_key, chello->sni, tcp_stream->str_stream_info, status->is_ct, status->is_ev);
MESA_htable_search_cb(svc_cache->srv_st_hash, hash_key, (unsigned int) hash_key_sz, srv_st_write_cb, &write_args, &svr_st_cb_ret);
}
if (status->is_app_not_pinning)
{
memset(hash_key, 0, sizeof(hash_key));
temp_key_sz = ssl_svc_app_st_mk_key(&addr_info, chello, temp_key, sizeof(temp_key));
hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
TFE_LOG_DEBUG(g_default_logger, "app table, hash:%s, sni:%s, addr:%s, app_not_pinning:%d",
hash_key, chello->sni, addr_str, status->is_app_not_pinning);
MESA_htable_search_cb(svc_cache->app_st_hash, hash_key, (unsigned int)hash_key_sz, app_st_write_cb, &write_args, &svr_st_cb_ret);
}
free(addr_str);
}
struct ssl_service_cache *ssl_service_cache_create(unsigned int slot_size, unsigned int expire_seconds, int fail_as_pinning_cnt, int fail_as_proto_err_cnt, int fail_time_win)
struct ssl_service_cache *ssl_service_cache_create(unsigned int slot_size, unsigned int expire_seconds, int fail_as_pinning_cnt, int fail_as_proto_err_cnt, int fail_time_win, int succ_as_app_not_pinning_cnt)
{
if (ssl_svc_ja3_init() != 0)
{
return NULL;
}
struct ssl_service_cache * cache = ALLOC(struct ssl_service_cache, 1);
struct ssl_service_cache * cache = ALLOC(struct ssl_service_cache, 1);
unsigned max_num = slot_size * 4;
UNUSED int ret = 0;
MESA_htable_handle htable=NULL, saved[3];
@@ -558,8 +409,9 @@ struct ssl_service_cache *ssl_service_cache_create(unsigned int slot_size, unsig
cache->fail_as_cli_pinning_count=fail_as_pinning_cnt;
cache->fail_as_proto_err_count=fail_as_proto_err_cnt;
cache->fail_time_window=fail_time_win;
void (*free_func[])(void *)={ssl_svc_free_client_st, ssl_svc_free_server_st};
for(i=0; i<2; i++)
cache->succ_as_app_not_pinning_count = succ_as_app_not_pinning_cnt;
void (*free_func[])(void *)={ssl_svc_free_client_st, ssl_svc_free_server_st, ssl_svc_free_app_st};
for(i=0; i<3; i++)
{
htable = MESA_htable_born();
opt_val=0;
@@ -570,10 +422,21 @@ struct ssl_service_cache *ssl_service_cache_create(unsigned int slot_size, unsig
ret = MESA_htable_set_opt(htable, MHO_MUTEX_NUM, &opt_val, sizeof(opt_val));
ret = MESA_htable_set_opt(htable, MHO_HASH_SLOT_SIZE, &slot_size, sizeof(slot_size));
ret = MESA_htable_set_opt(htable, MHO_HASH_MAX_ELEMENT_NUM, &max_num, sizeof(max_num));
// for app table
if (i == 2)
{
unsigned int app_expire_seconds = 2 * expire_seconds;
ret = MESA_htable_set_opt(htable, MHO_EXPIRE_TIME, &app_expire_seconds, sizeof(app_expire_seconds));
opt_val = HASH_ELIMINATE_ALGO_LRU;
ret = MESA_htable_set_opt(htable, MHO_ELIMIMINATE_TYPE, &opt_val, sizeof(int));
}
// for client table and server table
ret = MESA_htable_set_opt(htable, MHO_EXPIRE_TIME, &expire_seconds, sizeof(expire_seconds));
opt_val = HASH_ELIMINATE_ALGO_FIFO;
ret = MESA_htable_set_opt(htable, MHO_ELIMIMINATE_TYPE, &opt_val, sizeof(int));
else
{
ret = MESA_htable_set_opt(htable, MHO_EXPIRE_TIME, &expire_seconds, sizeof(expire_seconds));
opt_val = HASH_ELIMINATE_ALGO_FIFO;
ret = MESA_htable_set_opt(htable, MHO_ELIMIMINATE_TYPE, &opt_val, sizeof(int));
}
ret = MESA_htable_set_opt(htable, MHO_CBFUN_DATA_FREE,
(void*)free_func[i], sizeof(free_func[i]));
@@ -584,8 +447,9 @@ struct ssl_service_cache *ssl_service_cache_create(unsigned int slot_size, unsig
}
cache->cli_st_hash=saved[0];
cache->srv_st_hash=saved[1];
cache->app_st_hash=saved[2];
return cache;
return cache;
}
void ssl_service_cache_destroy(struct ssl_service_cache* cache)
{
@@ -593,6 +457,8 @@ void ssl_service_cache_destroy(struct ssl_service_cache* cache)
cache->cli_st_hash=NULL;
MESA_htable_destroy(cache->srv_st_hash, NULL);
cache->srv_st_hash=NULL;
MESA_htable_destroy(cache->app_st_hash, NULL);
cache->app_st_hash=NULL;
free(cache);
return;
}

47
platform/src/ssl_stream.cpp
View File

@@ -43,7 +43,6 @@
#include <ssl_utils.h>
#include <ssl_service_cache.h>
#include <platform.h>
#include <ssl_ja3.h>
static int SSL_CTX_EX_DATA_IDX_SSLMGR;
static int SSL_EX_DATA_IDX_SSLSTREAM;
@@ -709,11 +708,14 @@ struct ssl_mgr * ssl_manager_init(const char * ini_profile, const char * section
&(mgr->svc_fail_as_proto_err_cnt), 5);
MESA_load_profile_uint_def(ini_profile, section, "service_cache_fail_time_window",
&(mgr->svc_cnt_time_window), 30);
MESA_load_profile_uint_def(ini_profile, section, "service_cache_succ_as_app_not_pinning_cnt",
&(mgr->svc_succ_as_app_not_pinning_cnt), 1);
mgr->svc_cache = ssl_service_cache_create(mgr->svc_cache_slots, mgr->svc_expire_seconds,
mgr->svc_fail_as_pinning_cnt,
mgr->svc_fail_as_proto_err_cnt,
mgr->svc_cnt_time_window);
mgr->svc_cnt_time_window,
mgr->svc_succ_as_app_not_pinning_cnt);
if (mgr->svc_cache == NULL)
{
TFE_LOG_ERROR(logger, "Failed to create service cache");
@@ -820,15 +822,6 @@ static void peek_client_hello_cb(evutil_socket_t fd, short what, void * arg)
{
case CHELLO_PARSE_SUCCESS:
{
if (is_ssl_debug())
{
char *addr = tfe_string_addr_create_by_fd(fd, CONN_DIR_DOWNSTREAM);
struct ssl_ja3 *fingerprint = ssl_ja3_generate_fingerprint(buf, n);
TFE_LOG_INFO(ctx->logger, "ja3:%s, hash:%s addr:%s\n", fingerprint ? fingerprint->ja3 : "null", fingerprint ? fingerprint->ja3_hash : "null", addr);
ssl_ja3_free(fingerprint);
free(addr);
}
promise_dettach_ctx(promise);
ctx->chello=chello;
promise_success(promise, ctx);
@@ -1439,7 +1432,7 @@ static void peek_chello_on_succ(future_result_t * result, void * user)
ret=ssl_service_cache_read(ctx->mgr->svc_cache, chello, s_stream->tcp_stream, svc_status);
if(ret==1)
{
TFE_LOG_DEBUG(ctx->mgr->logger, "%s %s service status pinning:%d, mauth:%d, err:%d, ct:%d, ev:%d, ja3_pinning_status:%d",
TFE_LOG_DEBUG(ctx->mgr->logger, "%s %s service status pinning:%d, mauth:%d, err:%d, ct:%d, ev:%d, is_app_not_pinning: %d",
s_stream->tcp_stream->str_stream_info,
chello->sni,
svc_status->cli_pinning_status,
@@ -1447,24 +1440,18 @@ static void peek_chello_on_succ(future_result_t * result, void * user)
svc_status->has_protocol_errors,
svc_status->is_ct,
svc_status->is_ev,
svc_status->ja3_pinning_status);
}
switch (svc_status->ja3_pinning_status)
{
case JA3_PINNING_STATUS_NOT_PINNING:
ctx->mgr->svc_cache->stat.app_not_pinning_cnt++;
ssl_stream_set_cmsg_uint8(s_stream, TFE_CMSG_SSL_PINNING_STATE, PINNING_ST_NOT_PINNING);
break;
case JA3_PINNING_STATUS_IS_PINNING:
ssl_stream_set_cmsg_uint8(s_stream, TFE_CMSG_SSL_PINNING_STATE, PINNING_ST_PINNING);
break;
case JA3_PINNING_STATUS_UNKNOWN:
/* fall through */
default:
ssl_stream_set_cmsg_uint8(s_stream, TFE_CMSG_SSL_PINNING_STATE, svc_status->cli_pinning_status);
break;
svc_status->is_app_not_pinning
);
}
if (svc_status->is_app_not_pinning)
{
ssl_stream_set_cmsg_integer(s_stream, TFE_CMSG_SSL_PINNING_STATE, PINNING_ST_NOT_PINNING);
}
else
{
ssl_stream_set_cmsg_integer(s_stream, TFE_CMSG_SSL_PINNING_STATE, svc_status->cli_pinning_status);
}
if(ctx->mgr->on_new_upstream_cb)
{
s_stream->up_parts.action=ctx->mgr->on_new_upstream_cb(s_stream, ctx->mgr->upstream_cb_param);
@@ -2187,8 +2174,8 @@ int ssl_stream_get_integer_opt(struct ssl_stream *upstream, enum SSL_STREAM_OPT
case SSL_STREAM_OPT_PINNING_STATUS:
*opt_val=svc->cli_pinning_status;
break;
case SSL_STREAM_OPT_JA3_PINNING_STATUS:
*opt_val=svc->ja3_pinning_status;
case SSL_STREAM_OPT_APP_STATUS:
*opt_val=svc->is_app_not_pinning;
break;
case SSL_STREAM_OPT_HAS_PROTOCOL_ERRORS:
*opt_val=svc->has_protocol_errors;

8
plugin/business/ssl-policy/src/ssl_policy.cpp
View File

@@ -279,7 +279,7 @@ enum ssl_stream_action ssl_policy_enforce(struct ssl_stream *upstream, void *u_p
ssl_stream_set_cmsg_string(upstream, TFE_CMSG_SSL_PASSTHROUGH_REASON, "Invalid Decryption Param");
return SSL_ACTION_PASSTHROUGH;
}
int pinning_staus = 0, is_ev = 0, is_ct = 0, is_mauth = 0, has_error = 0, ja3_pinning_status = 0;
int pinning_staus = 0, is_ev = 0, is_ct = 0, is_mauth = 0, has_error = 0, is_app_not_pinning = 0;
if (!profile_param->mirror_client_version)
{
ret = ssl_stream_set_integer_opt(upstream, SSL_STREAM_OPT_PROTOCOL_MIN_VERSION, profile_param->ssl_min_version);
@@ -311,7 +311,7 @@ enum ssl_stream_action ssl_policy_enforce(struct ssl_stream *upstream, void *u_p
assert(ret == 0);
ret = ssl_stream_get_integer_opt(upstream, SSL_STREAM_OPT_PINNING_STATUS, &pinning_staus);
assert(ret == 0);
ret = ssl_stream_get_integer_opt(upstream, SSL_STREAM_OPT_JA3_PINNING_STATUS, &ja3_pinning_status);
ret = ssl_stream_get_integer_opt(upstream, SSL_STREAM_OPT_APP_STATUS, &is_app_not_pinning);
assert(ret == 0);
ret = ssl_stream_get_integer_opt(upstream, SSL_STREAM_OPT_IS_EV_CERT, &is_ev);
assert(ret == 0);
@@ -322,13 +322,13 @@ enum ssl_stream_action ssl_policy_enforce(struct ssl_stream *upstream, void *u_p
ret = ssl_stream_get_integer_opt(upstream, SSL_STREAM_OPT_HAS_PROTOCOL_ERRORS, &has_error);
assert(ret == 0);
if (pinning_staus == 1 && ja3_pinning_status == JA3_PINNING_STATUS_NOT_PINNING && profile_param->bypass_uninstall_cert_traffic)
if (pinning_staus == 1 && is_app_not_pinning == 1 && profile_param->bypass_uninstall_cert_traffic)
{
action = SSL_ACTION_PASSTHROUGH;
ssl_stream_set_cmsg_string(upstream, TFE_CMSG_SSL_PASSTHROUGH_REASON, "Certificate Not Installed");
TFE_LOG_DEBUG(g_default_logger, "%s %s enforce policy %s, action PASSTHROUGH due to Certificate Not Installed", addr_string, sni, rule_uuid_str);
}
else if ((pinning_staus == 1 || ja3_pinning_status == JA3_PINNING_STATUS_IS_PINNING) && ja3_pinning_status != JA3_PINNING_STATUS_NOT_PINNING && profile_param->bypass_pinning)
else if (pinning_staus == 1 && is_app_not_pinning == 0 && profile_param->bypass_pinning)
{
action = SSL_ACTION_PASSTHROUGH;
ssl_stream_set_cmsg_string(upstream, TFE_CMSG_SSL_PASSTHROUGH_REASON, "Certificate Pinning");

8
resource/pangu/doh.json
View File

@@ -111,14 +111,6 @@
"table_content": [
{"uuid":"TCPOPT00-0000-0000-0000-000000000001","tcp_passthrough":0,"bypass_duplicated_packet":0,"client_side_conn_param":{"tcp_maxseg":{"enable":0,"maxseg":1500},"nodelay":1,"keep_alive":{"enable":1,"tcp_keepcnt":8,"tcp_keepidle":30,"tcp_keepintvl":15},"ttl":70,"user_timeout":{"enable":1,"timeout_ms":600}},"server_side_conn_param":{"tcp_maxseg":{"enable":0,"maxseg":1500},"nodelay":1,"keep_alive":{"enable":1,"tcp_keepcnt":8,"tcp_keepidle":30,"tcp_keepintvl":15},"ttl":70,"user_timeout":{"enable":1,"timeout_ms":600}},"is_valid":1}
]
},
{
"table_name": "PXY_SSL_FINGERPRINT",
"table_content": [
{"uuid":"JA300000-0000-0000-0000-000000000001","ja3_hash":"599f223c2c9ee5702f5762913889dc21","pinning_state":1,"is_valid":1},
{"uuid":"JA300000-0000-0000-0000-000000000002","ja3_hash":"eb149984fc9c44d85ed7f12c90d818be","pinning_state":1,"is_valid":1},
{"uuid":"JA300000-0000-0000-0000-000000000003","ja3_hash":"e6573e91e6eb777c0933c5b8f97f10cd","pinning_state":1,"is_valid":1}
]
},
{
"table_name": "APP_ID_DICT",

10
resource/pangu/pangu_http.json
View File

@@ -43,7 +43,7 @@
"action": "manipulate",
"blacklist_option": 1,
"log_option": "all",
"action_parameter": {"protocol":"http","method":"replace","rules":[{"search_in":"http_resp_body","find":"<22><><EFBFBD><EFBFBD>","replace_with":"test"}]},
"action_parameter": {"protocol":"http","method":"replace","rules":[{"search_in":"http_resp_body","find":"<22><><EFBFBD><EFBFBD>","replace_with":"test"}]},
"is_valid": "yes",
"conditions": [
{
@@ -191,14 +191,6 @@
"table_content": [
{"uuid":"TCPOPT00-0000-0000-0000-000000000001","tcp_passthrough":0,"bypass_duplicated_packet":0,"client_side_conn_param":{"tcp_maxseg":{"enable":0,"maxseg":1500},"nodelay":1,"keep_alive":{"enable":1,"tcp_keepcnt":8,"tcp_keepidle":30,"tcp_keepintvl":15},"ttl":70,"user_timeout":{"enable":1,"timeout_ms":600}},"server_side_conn_param":{"tcp_maxseg":{"enable":0,"maxseg":1500},"nodelay":1,"keep_alive":{"enable":1,"tcp_keepcnt":8,"tcp_keepidle":30,"tcp_keepintvl":15},"ttl":70,"user_timeout":{"enable":1,"timeout_ms":600}},"is_valid":1}
]
},
{
"table_name": "PXY_SSL_FINGERPRINT",
"table_content": [
{"uuid":"JA300000-0000-0000-0000-000000000001","ja3_hash":"599f223c2c9ee5702f5762913889dc21","pinning_state":1,"is_valid":1},
{"uuid":"JA300000-0000-0000-0000-000000000002","ja3_hash":"eb149984fc9c44d85ed7f12c90d818be","pinning_state":1,"is_valid":1},
{"uuid":"JA300000-0000-0000-0000-000000000003","ja3_hash":"e6573e91e6eb777c0933c5b8f97f10cd","pinning_state":1,"is_valid":1}
]
},
{
"table_name": "APP_ID_DICT",

9
resource/pangu/table_info.conf
View File

@@ -154,15 +154,6 @@
"key_type":"pointer",
"key_name":"uuid"
}
},
{
"table_id":22,
"table_name":"PXY_SSL_FINGERPRINT",
"table_type":"plugin",
"custom": {
"key_type":"pointer",
"key_name":"ja3_hash"
}
},
{
"table_id":23,