gfwleak/tango-tfe
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix memory leak bugs

Browse Source
This commit is contained in:
崔一鸣
2018-09-07 17:42:57 +08:00
parent b6a2250786
commit b5a937bad6
10 changed files with 804 additions and 506 deletions
Download Patch File Download Diff File Expand all files Collapse all files

450
platform/src/key_keeper.cpp
View File

@@ -6,15 +6,20 @@
#include "MESA/MESA_prof_load.h"
#include "tfe_rpc.h"
#include "event2/http.h"
#include "cjson/cJSON.h"
#define HTABLE_MAX_KEY_LEN 256
#define KEYRING_EXSITED 0
#define KEYRING_NOT_EXSITED -1
struct key_keeper
{
unsigned int mode;
char mode[TFE_STRING_MAX];
char ca_path[TFE_STRING_MAX];
char untrusted_ca_path[TFE_STRING_MAX];
char cert_store_host[TFE_STRING_MAX];
unsigned int cert_store_port;
unsigned int hash_slot_size;
unsigned int hash_expire_seconds;
MESA_htable_handle htable;
void* logger;
};
@@ -35,11 +40,18 @@ struct key_keeper_promise_ctx
{
void* logger;
MESA_htable_handle htable;
const uchar* key;
uchar* key;
struct future* f_certstore_rpc;
unsigned int key_len;
};
static const uchar* get_key_by_cert(X509* cert, int keyring_id, unsigned int* len);
static void key_keeper_promise_free_ctx(void* ctx)
{
struct key_keeper_promise_ctx* _ctx = (struct key_keeper_promise_ctx*)ctx;
free(_ctx->key);
_ctx->key = NULL;
free(_ctx);
}
static struct keyring_private* keyring_new(void)
{
@@ -60,7 +72,7 @@ static struct keyring_private* keyring_new(void)
* Passed OpenSSL objects are owned by cert_t; refcount will not be
* incremented, stack will not be duplicated.
*/
struct keyring* keyring_new3(EVP_PKEY *key, X509 *cert, STACK_OF(X509) *chain)
static struct keyring* keyring_new3(EVP_PKEY *key, X509 *cert, STACK_OF(X509) *chain)
{
struct keyring_private* kyr=NULL;
kyr=keyring_new();
@@ -88,7 +100,7 @@ struct keyring* keyring_new3(EVP_PKEY *key, X509 *cert, STACK_OF(X509) *chain)
}
// Increment reference count.
void keyring_ref_inc(struct keyring_private* kyr)
static void keyring_ref_inc(struct keyring_private* kyr)
{
pthread_mutex_lock(&kyr->mutex);
kyr->references++;
@@ -183,9 +195,116 @@ void key_keeper_free_keyring(struct keyring *kyr)
free(_kyr);
}
static X509* transform_cert_to_x509(const char* str)
{
BIO *bio;
X509 *cert;
bio = BIO_new(BIO_s_mem());
BIO_write(bio, (const void*)str, strnlen(str, TFE_STRING_MAX));
cert = PEM_read_bio_X509(bio, NULL, NULL, NULL);
BIO_free_all(bio);
return cert;
}
static EVP_PKEY* transform_key_to_EVP(const char* str)
{
BIO *mem;
mem = BIO_new_mem_buf(str, -1);
EVP_PKEY* key = PEM_read_bio_PrivateKey(mem, NULL, NULL, 0);
BIO_free(mem);
return key;
}
static void err_out(X509* cert, EVP_PKEY* key, STACK_OF(X509)* chain)
{
if(cert)
{
X509_free(cert);
}
if(key)
{
EVP_PKEY_free(key);
}
if(chain)
{
sk_X509_pop_free(chain, X509_free);
}
return;
}
static struct keyring* get_keyring_from_response(const char* data)
{
X509* cert = NULL;
EVP_PKEY* key = NULL;
STACK_OF(X509)* chain = NULL;
if(data == NULL)
{
return NULL;
}
cJSON* data_json = cJSON_Parse(data);
if(data_json == NULL)
{
return NULL;
}
cJSON* cert_json = NULL;
cJSON* key_json = NULL;
cJSON* chain_json = NULL;
cert_json = cJSON_GetObjectItemCaseSensitive(data_json, "CERTIFICATE");
key_json = cJSON_GetObjectItemCaseSensitive(data_json, "PRIVATE_KEY");
chain_json = cJSON_GetObjectItemCaseSensitive(data_json, "CERTIFICATE_CHAIN");
if (cert_json && cert_json->valuestring != NULL)
{
cert = transform_cert_to_x509(cert_json->valuestring);
}
if(cert == NULL)
{
err_out(cert, key, chain);
return NULL;
}
if (key_json && key_json->valuestring != NULL)
{
key = transform_key_to_EVP(key_json->valuestring);
}
if(key == NULL)
{
err_out(cert, key, chain);
return NULL;
}
if(chain_json == NULL)
{
err_out(cert, key, chain);
return NULL;
}
cJSON* chain_cert_json = NULL;
chain = sk_X509_new_null();
cJSON_ArrayForEach(chain_cert_json, chain_json)
{
X509* chain_cert = NULL;
if (chain_cert_json && chain_cert_json->valuestring != NULL)
{
chain_cert = transform_cert_to_x509(chain_cert_json->valuestring);
}
if(chain_cert == NULL)
{
err_out(cert, key, chain);
return NULL;
}
sk_X509_push(chain, chain_cert);
}
struct keyring_private* _kyr= keyring_new();
keyring_set_cert(_kyr, cert);
keyring_set_key(_kyr, key);
keyring_set_chain(_kyr, chain);
X509_free(cert);
EVP_PKEY_free(key);
sk_X509_pop_free(chain, X509_free);
return &(_kyr->head);
}
static long keyring_local_cache_query_cb(void * data, const uchar * key, uint size, void * user_arg)
{
//data is (struct keyring*)
struct keyring_private* kyr=(struct keyring_private*)data;
if(kyr == NULL)
{
@@ -198,11 +317,8 @@ static long keyring_local_cache_query_cb(void * data, const uchar * key, uint si
return KEYRING_EXSITED;
}
}
static void certstore_rpc_on_fail(enum e_future_error err, const char * what, void * user)
{
struct promise * p = (struct promise *) user;
promise_failed(p, err, what);
}
static struct keyring_private* generate_x509_keyring(X509* origin_cert, int keyring_id, const char* filename)
{
X509* ca = ssl_x509_load(filename);
@@ -212,198 +328,64 @@ static struct keyring_private* generate_x509_keyring(X509* origin_cert, int keyr
STACK_OF(X509)* chain = sk_X509_new_null();
sk_X509_push(chain, ca);
sk_X509_push(chain, forge_cert);
struct keyring_private* ring= keyring_new();
keyring_set_key(ring, forge_key);
keyring_set_cert(ring, forge_cert);
keyring_set_chain(ring, chain);
return ring;
}
//how to free
static X509* get_cert_from_response(const char* data, int len, void* logger)
{
BIO *bio;
X509 *cert;
bio = BIO_new(BIO_s_mem());
BIO_write(bio, (const void*)data, len);
cert = PEM_read_bio_X509(bio, NULL, NULL, NULL);
return cert;
}
static EVP_PKEY* get_key_from_response(const char* data, int len, void* logger)
{
return NULL;
}
static STACK_OF(X509)* get_chain_from_response(const char* data, int len, void* logger)
{
return NULL;
struct keyring_private* _kyr= keyring_new();
keyring_set_key(_kyr, forge_key);
keyring_set_cert(_kyr, forge_cert);
keyring_set_chain(_kyr, chain);
X509_free(ca);
EVP_PKEY_free(cakey);
X509_free(forge_cert);
EVP_PKEY_free(forge_key);
sk_X509_pop_free(chain, X509_free);
return _kyr;
}
static void certstore_rpc_on_succ(void* result, void* user)
{
//printf("call certstore_rpc_on_succ\n");
struct promise * p = (struct promise *) user;
struct key_keeper_promise_ctx* ctx = (struct key_keeper_promise_ctx*)promise_get_ctx(p);
MESA_htable_handle htable= ctx->htable;
const uchar* key = ctx->key;
unsigned int key_len = ctx->key_len;
//transform to x509
struct tfe_rpc_response_result* response = tfe_rpc_release(result);
int status_code = response->status_code;
const char* status_msg = response->status_msg;
const char* data = response->data;
char* data = response->data;
int len = response->len;
if(status_code == HTTP_OK)
{
struct keyring_private* ring= keyring_new();
X509* forge_cert = get_cert_from_response(data, len, NULL);
EVP_PKEY* forge_key = get_key_from_response(data, len, NULL);
STACK_OF(X509)* chain = get_chain_from_response(data, len, NULL);
keyring_set_key(ring, forge_key);
keyring_set_cert(ring, forge_cert);
keyring_set_chain(ring, chain);
promise_success(p, (void*)ring);
int ret = MESA_htable_add(htable, key, key_len, (void*)ring);
*(data+len) = '\0';
struct keyring* kyr= get_keyring_from_response(data);
promise_success(p, (void*)kyr);
int ret = MESA_htable_add(htable, key, key_len, (void*)kyr);
if(ret<0)
{
key_keeper_free_keyring((struct keyring*)ring);
key_keeper_free_keyring((struct keyring*)kyr);
}
}
else
{
promise_failed(p, FUTURE_ERROR_EXCEPTION, status_msg);
}
future_destroy(ctx->f_certstore_rpc);
//promise_dettach_ctx(p);
//ctx_destroy_cb((void*)ctx);
}
static void certstore_rpc_on_fail(enum e_future_error err, const char * what, void * user)
{
struct promise * p = (struct promise *) user;
promise_failed(p, err, what);
struct key_keeper_promise_ctx* ctx= (struct key_keeper_promise_ctx*)promise_get_ctx(p);
future_destroy(ctx->f_certstore_rpc);
//promise_dettach_ctx(p);
//ctx_destroy_cb((void*)ctx);
}
static int __wrapper_MESA_htable_set_opt(MESA_htable_handle table, enum MESA_htable_opt opt_type, unsigned int value);
static MESA_htable_handle create_hash_table(unsigned int slot_size, unsigned int expire_seconds);
static STACK_OF(X509)* get_chain_from_response(const char* data, int len, void* logger);
/*
* Certificate, including private key and keyring chain.
*/
struct key_keeper* key_keeper_init(const char * profile, const char* section, void* logger)
{
//load conf
//TODO free
struct key_keeper* keeper = ALLOC(struct key_keeper, 1);
keeper->logger = logger;
MESA_load_profile_uint_def(profile, section, "mode", &(keeper->mode), 1);
MESA_load_profile_string_def(profile, section, "cert_store_host", keeper->cert_store_host, sizeof(keeper->cert_store_host), "xxxxx");
MESA_load_profile_uint_def(profile, section, "cert_store_port", &(keeper->cert_store_port), 80);
//TODO: argument
keeper->htable = create_hash_table(16,16);
return keeper;
}
void key_keeper_destroy(struct key_keeper *keeper)
{
free(keeper);
keeper = NULL;
return;
}
struct keyring* key_keeper_release_keyring(future_result_t* result)
{
struct keyring_private* kyr=(struct keyring_private*)result;
keyring_ref_inc(kyr);
return &(kyr->head);
}
static void ctx_destory_cb(struct promise* p)
{
}
//TODO: cert_not_valid
void key_keeper_async_ask(struct future * f, struct key_keeper * keeper, const char* sni, int keyring_id, X509 * origin_cert, int is_cert_valid, struct event_base * evbase)
{
//get subject name from cert
//current promise, belong to key_keeper
struct promise* p = future_to_promise(f);
struct key_keeper_promise_ctx* ctx = ALLOC(struct key_keeper_promise_ctx, 1);
//TODO free ctx!!
unsigned int len = 0;
const uchar* key = get_key_by_cert(origin_cert, keyring_id, &len);
ctx->logger = keeper->logger;
ctx->htable = keeper->htable;
ctx->key = key;
ctx->key_len = len;
promise_set_ctx(p, (void*)ctx, ctx_destory_cb);
long int cb_rtn = 0;
MESA_htable_search_cb(ctx->htable, (const unsigned char*)(ctx->key), ctx->key_len, keyring_local_cache_query_cb, p, &cb_rtn);
printf(cb_rtn == KEYRING_EXSITED ? "KEYRING_EXSITED\n": "KEYRING_NOT_EXSITED\n");
if(cb_rtn == KEYRING_EXSITED)
{
return;
}
int mode = keeper->mode;
printf("mode is %s", mode == NORMAL ? "normal\n":"debug\n");
switch(mode){
case NORMAL:
{
struct future* f_tfe_rpc = future_create("tfe_rpc", certstore_rpc_on_succ, certstore_rpc_on_fail, p);
//TODO: init in main()? store in ctx
struct tfe_rpc* rpc = tfe_rpc_init(NULL, NULL, keeper->logger);
char url[TFE_STRING_MAX];
const char host[] = "www.baidu.com";
snprintf(url, TFE_STRING_MAX, "%s:%d?host=%s&flag=1&valid=1&kering_id=%d", keeper->cert_store_host, keeper->cert_store_port, host, keyring_id);
tfe_rpc_async_ask(f_tfe_rpc, rpc, url, GET, DONE_CB, NULL, 0, evbase);
break;
}
case DEBUG:
{
//TOOD: generate X509 cert
const char* filename = "./conf/mesalab-ca.pem";
struct keyring_private* ring = generate_x509_keyring(origin_cert, keyring_id, filename);
if(ring)
{
promise_success(p, (void*)ring);
int ret = MESA_htable_add(ctx->htable, ctx->key, ctx->key_len, (void*)ring);
if(ret<0)
{
key_keeper_free_keyring((struct keyring*)ring);
}
else
{
printf("key %s is added to hash table\n", ctx->key);
}
}
else
{
promise_failed(p, FUTURE_ERROR_EXCEPTION, "generate X509 cert failed");
}
break;
}
}
return;
}
static const uchar*
get_key_by_cert(X509* cert, int keyring_id, unsigned int* len)
{
char* cert_fgr = NULL;
cert_fgr = ssl_x509_fingerprint(cert, 0);
char* key = (char*)malloc(HTABLE_MAX_KEY_LEN);
*key = '\0';
if(cert == NULL)
{
return NULL;
}
snprintf(key, HTABLE_MAX_KEY_LEN, "%d:", keyring_id);
strncat(key, cert_fgr, HTABLE_MAX_KEY_LEN);
*len = strnlen(key, HTABLE_MAX_KEY_LEN);
return (const uchar*)key;
}
static int __wrapper_MESA_htable_set_opt(MESA_htable_handle table, enum MESA_htable_opt opt_type, unsigned int value)
{
int ret = MESA_htable_set_opt(table, opt_type, &value, (int)(sizeof(value)));
@@ -411,8 +393,7 @@ static int __wrapper_MESA_htable_set_opt(MESA_htable_handle table, enum MESA_hta
return ret;
}
static MESA_htable_handle
create_hash_table(unsigned int slot_size, unsigned int expire_seconds)
static MESA_htable_handle create_hash_table(unsigned int slot_size, unsigned int expire_seconds)
{
int ret = 0;
unsigned max_num = slot_size * 4;
@@ -435,5 +416,122 @@ create_hash_table(unsigned int slot_size, unsigned int expire_seconds)
return htable;
}
struct key_keeper* key_keeper_init(const char * profile, const char* section, void* logger)
{
struct key_keeper* keeper = ALLOC(struct key_keeper, 1);
keeper->logger = logger;
MESA_load_profile_string_def(profile, section, "mode", keeper->mode, sizeof(keeper->mode), "debug");
MESA_load_profile_string_def(profile, section, "ca_path", keeper->ca_path, sizeof(keeper->ca_path), "./conf/mesalab-ca.pem");
MESA_load_profile_string_def(profile, section, "untrusted_ca_path", keeper->untrusted_ca_path, sizeof(keeper->untrusted_ca_path), "./conf/mesalab-ca.pem");
MESA_load_profile_string_def(profile, section, "cert_store_host", keeper->cert_store_host, sizeof(keeper->cert_store_host), "xxxxx");
MESA_load_profile_uint_def(profile, section, "cert_store_port", &(keeper->cert_store_port), 80);
MESA_load_profile_uint_def(profile, section, "hash_slot_size", &(keeper->hash_slot_size), 16);
MESA_load_profile_uint_def(profile, section, "hash_expire_seconds", &(keeper->hash_expire_seconds), 16);
keeper->htable = create_hash_table(keeper->hash_slot_size, keeper->hash_expire_seconds);
return keeper;
}
void key_keeper_destroy(struct key_keeper *keeper)
{
MESA_htable_destroy(keeper->htable, NULL);
free(keeper);
keeper = NULL;
return;
}
struct keyring* key_keeper_release_keyring(future_result_t* result)
{
struct keyring_private* kyr=(struct keyring_private*)result;
keyring_ref_inc(kyr);
return &(kyr->head);
}
static uchar* get_key_by_cert(X509* cert, int keyring_id, unsigned int* len)
{
char* cert_fgr = NULL;
cert_fgr = ssl_x509_fingerprint(cert, 0);
char* key = (char*)malloc(HTABLE_MAX_KEY_LEN);
*key = '\0';
if(cert == NULL)
{
return NULL;
}
snprintf(key, HTABLE_MAX_KEY_LEN, "%d:", keyring_id);
strncat(key, cert_fgr, HTABLE_MAX_KEY_LEN);
*len = strnlen(key, HTABLE_MAX_KEY_LEN);
free(cert_fgr);
return (uchar*)key;
}
void key_keeper_async_ask(struct future * f, struct key_keeper * keeper, const char* sni, int keyring_id, X509 * origin_cert, int is_cert_valid, struct event_base * evbase)
{
struct promise* p = future_to_promise(f);
struct key_keeper_promise_ctx* ctx = ALLOC(struct key_keeper_promise_ctx, 1);
unsigned int len = 0;
uchar* key = get_key_by_cert(origin_cert, keyring_id, &len);
ctx->logger = keeper->logger;
ctx->htable = keeper->htable;
ctx->key = key;
ctx->key_len = len;
promise_set_ctx(p, (void*)ctx, key_keeper_promise_free_ctx);
long int cb_rtn = 0;
MESA_htable_search_cb(ctx->htable, (const unsigned char*)(ctx->key), ctx->key_len, keyring_local_cache_query_cb, p, &cb_rtn);
if(cb_rtn == KEYRING_EXSITED)
{
printf("KEYRING_EXSITED\n");
return;
}
int mode = 0;
if(strncmp(keeper->mode, "debug", TFE_STRING_MAX) == 0)
{
mode = 1;
}
switch(mode){
case NORMAL:
{
struct future* f_certstore_rpc = future_create("tfe_rpc", certstore_rpc_on_succ, certstore_rpc_on_fail, p);
ctx->f_certstore_rpc = f_certstore_rpc;
char url[TFE_STRING_MAX];
char _sni[TFE_STRING_MAX] = "www.baidu.com";
if(sni)
{
strncpy(_sni, sni, TFE_STRING_MAX);
}
snprintf(url, TFE_STRING_MAX, "http://%s:%d/ca?host=%s&flag=1&valid=1&keyring_id=%d", keeper->cert_store_host, keeper->cert_store_port, _sni, keyring_id);
printf("url is %s\n", url);
tfe_rpc_async_ask(f_certstore_rpc, url, GET, DONE_CB, NULL, 0, evbase);
break;
}
case DEBUG:
{
//TOOD: generate X509 cert
char* filename = NULL;
if(is_cert_valid == 1)
{
filename = keeper->ca_path;
}
else
{
filename = keeper->untrusted_ca_path;
}
struct keyring_private* ring = generate_x509_keyring(origin_cert, keyring_id, filename);
if(ring)
{
promise_success(p, (void*)ring);
int ret = MESA_htable_add(ctx->htable, ctx->key, ctx->key_len, (void*)ring);
if(ret<0)
{
key_keeper_free_keyring((struct keyring*)ring);
}
}
else
{
promise_failed(p, FUTURE_ERROR_EXCEPTION, "generate X509 cert failed");
}
break;
}
}
return;
}