gfwleak/tango-tfe
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

TSG-2967 TFE 使用 JA3 优化 SSL pinning

Browse Source
This commit is contained in:
luwenpeng
2020-08-24 17:52:55 +08:00
parent 1e5b2ceaed
commit 9d15d655ed
8 changed files with 717 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files

106
platform/src/ssl_service_cache.cpp
View File

@@ -86,14 +86,38 @@ static size_t ssl_svc_server_st_mk_key(const struct ssl_chello* chello, const s
free(addr_str);
return key_len;
}
static size_t ssl_svc_app_st_mk_key(const struct ssl_chello* chello, const struct tfe_stream_addr * addr, char* key_buff, size_t sz)
static size_t ssl_svc_app_st_mk_key(const struct ssl_chello *chello, const struct tfe_stream *tcp_stream, char *key_buff, size_t sz)
{
size_t key_len=0;
const char* sip=NULL, *sport=NULL, *dip=NULL, *dport=NULL;
char * addr_str= tfe_stream_addr_to_str(addr);
tfe_stream_addr_str_split(addr_str, &sip, &sport, &dip, &dport);
char ja3_val[64] = {0};
uint16_t ja3_len = 0;
size_t key_len = 0;
const char *sip = NULL, *sport = NULL, *dip = NULL, *dport = NULL;
char *addr_str = tfe_stream_addr_to_str(tcp_stream->addr);
struct tfe_cmsg *cmsg = tfe_stream_get0_cmsg(tcp_stream);
if (cmsg != NULL)
{
int ret = tfe_cmsg_get_value(cmsg, TFE_CMSG_SSL_CLIENT_JA3_FINGERPRINT, (unsigned char *)ja3_val, sizeof(ja3_val), &ja3_len);
if (ret != 0)
{
TFE_LOG_ERROR(g_default_logger, "failed at fetch ssl client ja3 fingerprint from cmsg: %s, %s", strerror(-ret), addr_str);
}
else
{
TFE_LOG_DEBUG(g_default_logger, "fetch ssl client ja3 fingerprint:%s addr: %s", ja3_val, addr_str);
}
}
tfe_stream_addr_str_split(addr_str, &sip, &sport, &dip, &dport);
key_len=snprintf(key_buff, sz, "%d:%d:%s:%s", chello->min_version.ossl_format,
// If ja3 is successfully obtained, use ja3 to generate hashkey
if (strlen(ja3_val))
{
key_len = snprintf(key_buff, sz, "%s:%s", ja3_val, chello->sni ? chello->sni : dip);
free(addr_str);
return key_len;
}
// otherwise, splicing ssl attributes to generate hashkey
key_len=snprintf(key_buff, sz, "%d:%d:%s:%s", chello->min_version.ossl_format,
chello->max_version.ossl_format,
chello->sni?chello->sni: dip ,
chello->alpn?chello->alpn:"null");
@@ -115,18 +139,18 @@ static size_t ssl_svc_app_st_mk_key(const struct ssl_chello* chello, const stru
free(addr_str);
return key_len;
}
static size_t ssl_svc_client_st_mk_key(const struct ssl_chello* chello, const struct tfe_stream_addr * addr, char* key_buff, size_t sz)
static size_t ssl_svc_client_st_mk_key(const struct ssl_chello *chello, const struct tfe_stream *tcp_stream, char *key_buff, size_t sz)
{
size_t key_len=0;
const char* sip=NULL, *sport=NULL, *dip=NULL, *dport=NULL;
char * addr_str= tfe_stream_addr_to_str(addr);
tfe_stream_addr_str_split(addr_str, &sip, &sport, &dip, &dport);
char *addr_str = tfe_stream_addr_to_str(tcp_stream->addr);
tfe_stream_addr_str_split(addr_str, &sip, &sport, &dip, &dport);
char chello_id_buff[sz];
size_t chello_id_len=0;
key_len=snprintf(key_buff, sz, "%s:", sip);
chello_id_len=ssl_svc_app_st_mk_key(chello, addr, chello_id_buff, sizeof(chello_id_buff));
memcpy(key_buff+key_len, chello_id_buff, MIN(chello_id_len, sz-key_len));
chello_id_len = ssl_svc_app_st_mk_key(chello, tcp_stream, chello_id_buff, sizeof(chello_id_buff));
memcpy(key_buff+key_len, chello_id_buff, MIN(chello_id_len, sz-key_len));
key_len += MIN(chello_id_len, sz-key_len);
free(addr_str);
@@ -305,7 +329,7 @@ static long app_st_write_cb(void * data, const uchar * key, uint size, void * us
return 1;
}
int ssl_service_cache_read(struct ssl_service_cache* svc_cache, const struct ssl_chello* chello, const struct tfe_stream_addr * addr, struct ssl_service_status* result)
int ssl_service_cache_read(struct ssl_service_cache *svc_cache, const struct ssl_chello *chello, const struct tfe_stream *tcp_stream, struct ssl_service_status *result)
{
long cli_st_cb_ret=0, svr_st_cb_ret=0, app_st_cb_ret=0;
char temp_key[2048];
@@ -317,26 +341,29 @@ int ssl_service_cache_read(struct ssl_service_cache* svc_cache, const struct ssl
return 0;
}
char * addr_str= tfe_stream_addr_to_str(addr);
char * addr_str= tfe_stream_addr_to_str(tcp_stream->addr);
memset(hash_key, 0, sizeof(hash_key));
temp_key_sz = ssl_svc_client_st_mk_key(chello, addr, temp_key, sizeof(temp_key));
hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
temp_key_sz = ssl_svc_client_st_mk_key(chello, tcp_stream, temp_key, sizeof(temp_key));
hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
MESA_htable_search_cb(svc_cache->cli_st_hash, hash_key, (unsigned int) hash_key_sz, cli_st_read_cb, result, &cli_st_cb_ret);
TFE_LOG_DEBUG(g_default_logger, "ssl svc read client table, hash:%s, found:%d, sni:%s, addr:%s", hash_key, cli_st_cb_ret, chello->sni, addr_str);
TFE_LOG_DEBUG(g_default_logger, "client table, hash:%s, found:%d, sni:%s, addr:%s, mutual:%d, pinning:%d, err:%d",
hash_key, cli_st_cb_ret, chello->sni, addr_str, result->is_mutual_auth, result->cli_pinning_status, result->has_protocol_errors);
memset(hash_key, 0, sizeof(hash_key));
temp_key_sz = ssl_svc_server_st_mk_key(chello, addr, temp_key, sizeof(temp_key));
hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
temp_key_sz = ssl_svc_server_st_mk_key(chello, tcp_stream->addr, temp_key, sizeof(temp_key));
hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
MESA_htable_search_cb(svc_cache->srv_st_hash, hash_key, (unsigned int) hash_key_sz, srv_st_read_cb, result, &svr_st_cb_ret);
TFE_LOG_DEBUG(g_default_logger, "ssl svc read server table, hash:%s, found:%d, sni:%s, addr:%s", hash_key, svr_st_cb_ret, chello->sni, addr_str);
TFE_LOG_DEBUG(g_default_logger, "server table, hash:%s, found:%d, sni:%s, addr:%s, ct:%d, ev:%d",
hash_key, svr_st_cb_ret, chello->sni, addr_str, result->is_ct, result->is_ev);
memset(hash_key, 0, sizeof(hash_key));
temp_key_sz = ssl_svc_app_st_mk_key(chello, addr, temp_key, sizeof(temp_key));
hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
temp_key_sz = ssl_svc_app_st_mk_key(chello, tcp_stream, temp_key, sizeof(temp_key));
hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
MESA_htable_search_cb(svc_cache->app_st_hash, hash_key, (unsigned int) hash_key_sz, app_st_read_cb, result, &app_st_cb_ret);
TFE_LOG_DEBUG(g_default_logger, "ssl svc read app table, hash:%s, found:%d, sni:%s, addr:%s", hash_key, app_st_cb_ret, chello->sni, addr_str);
TFE_LOG_DEBUG(g_default_logger, "app table, hash:%s, found:%d, sni:%s, addr:%s, app_not_pinning:%d",
hash_key, app_st_cb_ret, chello->sni, addr_str, result->is_app_not_pinning);
free(addr_str);
free(addr_str);
if(cli_st_cb_ret||svr_st_cb_ret||app_st_cb_ret)
{
@@ -348,7 +375,7 @@ int ssl_service_cache_read(struct ssl_service_cache* svc_cache, const struct ssl
}
}
void ssl_service_cache_write(struct ssl_service_cache* svc_cache, const struct ssl_chello* chello, const struct tfe_stream_addr * addr, const struct ssl_service_status* status)
void ssl_service_cache_write(struct ssl_service_cache *svc_cache, const struct ssl_chello *chello, const struct tfe_stream *tcp_stream, const struct ssl_service_status *status)
{
long cli_st_cb_ret=0, svr_st_cb_ret=0;
char temp_key[2048];
@@ -360,31 +387,34 @@ void ssl_service_cache_write(struct ssl_service_cache* svc_cache, const struct s
{
return;
}
char * addr_str= tfe_stream_addr_to_str(addr);
struct ssl_service_write_args write_args={svc_cache, status};
char *addr_str = tfe_stream_addr_to_str(tcp_stream->addr);
struct ssl_service_write_args write_args={svc_cache, status};
if(status->is_mutual_auth||status->cli_pinning_status!=PINNING_ST_NOT_PINNING||status->has_protocol_errors)
{
memset(hash_key, 0, sizeof(hash_key));
temp_key_sz = ssl_svc_client_st_mk_key(chello, addr, temp_key, sizeof(temp_key));
hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
TFE_LOG_DEBUG(g_default_logger, "ssl svc write client table, hash:%s, sni:%s, addr:%s", hash_key, chello->sni, addr_str);
MESA_htable_search_cb(svc_cache->cli_st_hash, hash_key, (unsigned int) hash_key_sz, cli_st_write_cb, &write_args, &cli_st_cb_ret);
temp_key_sz = ssl_svc_client_st_mk_key(chello, tcp_stream, temp_key, sizeof(temp_key));
hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
TFE_LOG_DEBUG(g_default_logger, "client table, hash:%s, sni:%s, addr:%s, mutual:%d, pinning:%d, err:%d",
hash_key, chello->sni, addr_str, status->is_mutual_auth, status->cli_pinning_status, status->has_protocol_errors);
MESA_htable_search_cb(svc_cache->cli_st_hash, hash_key, (unsigned int) hash_key_sz, cli_st_write_cb, &write_args, &cli_st_cb_ret);
}
if(status->is_ct||status->is_ev)
{
memset(hash_key, 0, sizeof(hash_key));
temp_key_sz = ssl_svc_server_st_mk_key(chello, addr, temp_key, sizeof(temp_key));
hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
TFE_LOG_DEBUG(g_default_logger, "ssl svc write server table, hash:%s, sni:%s, addr:%s", hash_key, chello->sni, addr_str);
MESA_htable_search_cb(svc_cache->srv_st_hash, hash_key, (unsigned int) hash_key_sz, srv_st_write_cb, &write_args, &svr_st_cb_ret);
temp_key_sz = ssl_svc_server_st_mk_key(chello, tcp_stream->addr, temp_key, sizeof(temp_key));
hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
TFE_LOG_DEBUG(g_default_logger, "server table, hash:%s, sni:%s, addr:%s, ct:%d, ev:%d",
hash_key, chello->sni, addr_str, status->is_ct, status->is_ev);
MESA_htable_search_cb(svc_cache->srv_st_hash, hash_key, (unsigned int) hash_key_sz, srv_st_write_cb, &write_args, &svr_st_cb_ret);
}
if(status->is_app_not_pinning)
{
memset(hash_key, 0, sizeof(hash_key));
temp_key_sz = ssl_svc_app_st_mk_key(chello, addr, temp_key, sizeof(temp_key));
hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
TFE_LOG_DEBUG(g_default_logger, "ssl svc write app table, hash:%s, sni:%s, addr:%s", hash_key, chello->sni, addr_str);
MESA_htable_search_cb(svc_cache->app_st_hash, hash_key, (unsigned int) hash_key_sz, app_st_write_cb, &write_args, &svr_st_cb_ret);
temp_key_sz = ssl_svc_app_st_mk_key(chello, tcp_stream, temp_key, sizeof(temp_key));
hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
TFE_LOG_DEBUG(g_default_logger, "app table, hash:%s, sni:%s, addr:%s, app_not_pinning:%d",
hash_key, chello->sni, addr_str, status->is_app_not_pinning);
MESA_htable_search_cb(svc_cache->app_st_hash, hash_key, (unsigned int) hash_key_sz, app_st_write_cb, &write_args, &svr_st_cb_ret);
}
free(addr_str);