From 30fd8889a82be87fae2bb401692da12513b3ea65 Mon Sep 17 00:00:00 2001 From: zhengchao Date: Fri, 26 Jul 2019 12:28:17 +0600 Subject: [PATCH 01/18] =?UTF-8?q?=E5=8C=BA=E5=88=86=E6=9C=AA=E5=AE=89?= =?UTF-8?q?=E8=A3=85=E8=AF=81=E4=B9=A6=E7=9A=84=E5=AE=A2=E6=88=B7=E7=AB=AF?= =?UTF-8?q?=E5=92=8Cpinning=E7=9A=84=E5=AE=A2=E6=88=B7=E7=AB=AF=E3=80=82?= =?UTF-8?q?=E8=8B=A5=E5=BC=80=E5=90=AFtfe.conf=E4=B8=AD[SSL]root=5Fcert=5F?= =?UTF-8?q?not=5Finstalled=5Fis=5Fnot=5Fpinning=3D1=EF=BC=8C=E5=88=99?= =?UTF-8?q?=E6=9C=AA=E5=AE=89=E8=A3=85=E8=AF=81=E4=B9=A6=E7=9A=84=E5=AE=A2?= =?UTF-8?q?=E6=88=B7=E7=AB=AF=E4=B8=8D=E5=86=8D=E8=A7=86=E4=B8=BApinning?= =?UTF-8?q?=E3=80=82?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- platform/include/internal/ssl_service_cache.h | 4 +- platform/src/ssl_service_cache.cpp | 145 ++++++++++++++---- platform/src/ssl_stream.cpp | 26 +++- 3 files changed, 138 insertions(+), 37 deletions(-) diff --git a/platform/include/internal/ssl_service_cache.h b/platform/include/internal/ssl_service_cache.h index be84dd3..56d2a20 100644 --- a/platform/include/internal/ssl_service_cache.h +++ b/platform/include/internal/ssl_service_cache.h @@ -9,7 +9,8 @@ #define PINNING_ST_MAYBE_PINNING 2 struct ssl_service_status { - char pinning_status; + char cli_pinning_status; + char is_app_not_pinning; char is_ev; char is_ct; char is_mutual_auth; @@ -29,5 +30,6 @@ struct ssl_service_cache_statistics long long proto_err_cli_cnt; long long ev_srv_cnt; long long ct_srv_cnt; + long long app_not_pinning_cnt; }; void ssl_service_cache_stat(struct ssl_service_cache* svc_cache, struct ssl_service_cache_statistics* result); diff --git a/platform/src/ssl_service_cache.cpp b/platform/src/ssl_service_cache.cpp index e005450..b7f464c 100644 --- a/platform/src/ssl_service_cache.cpp +++ b/platform/src/ssl_service_cache.cpp @@ -7,6 +7,7 @@ #define FAIL_AS_PINNING_COUNT 4 #define FAIL_TIME_WINDOW 30 #define FAIL_AS_PROTO_ERR_COUNT 5 +#define SUCC_AS_APP_NOT_PINNING 3 struct ssl_svc_client_st { time_t last_update_time; @@ -23,14 +24,22 @@ struct ssl_svc_server_st long long ct_st_switched; struct ssl_service_cache* ref_svc_cache; }; +struct ssl_svc_app_st +{ + unsigned int down_ssl_success_cnt; + struct ssl_service_cache* ref_svc_cache; +}; struct ssl_service_cache { MESA_htable_handle cli_st_hash; MESA_htable_handle srv_st_hash; + MESA_htable_handle app_st_hash; + struct ssl_service_cache_statistics stat; - unsigned int fail_as_pinning_count; + unsigned int fail_as_cli_pinning_count; unsigned int fail_as_proto_err_count; unsigned int fail_time_window; + unsigned int succ_as_app_not_pinning_count; }; struct ssl_service_write_args { @@ -45,7 +54,7 @@ static void ssl_svc_free_client_st(void * data) { svc_cache->stat.mutual_auth_cli_cnt--; } - if(p->suspect_pinning_count>=FAIL_AS_PINNING_COUNT) + if(p->suspect_pinning_count>=svc_cache->fail_as_cli_pinning_count) { svc_cache->stat.pinning_cli_cnt--; } @@ -67,7 +76,17 @@ static void ssl_svc_free_server_st(void * data) free(p); return; } -static size_t ssl_svc_server_st_mk_key(const struct ssl_chello* chello, const struct tfe_stream_addr * addr, char* key_buff, size_t sz) +static void ssl_svc_free_app_st(void* data) +{ + struct ssl_svc_app_st* p= (struct ssl_svc_app_st*)data; + struct ssl_service_cache* svc_cache=p->ref_svc_cache; + if(p->down_ssl_success_cnt>svc_cache->succ_as_app_not_pinning_count) + { + svc_cache->stat.app_not_pinning_cnt--; + } + free(p); +} +static size_t ssl_svc_server_st_mk_key(const struct ssl_chello* chello, const struct tfe_stream_addr * addr, char* key_buff, size_t sz) { size_t key_len=0; const char* sip=NULL, *sport=NULL, *dip=NULL, *dport=NULL; @@ -77,17 +96,17 @@ static size_t ssl_svc_server_st_mk_key(const struct ssl_chello* chello, const st free(addr_str); return key_len; } -static size_t ssl_svc_client_st_mk_key(const struct ssl_chello* chello, const struct tfe_stream_addr * addr, char* key_buff, size_t sz) +static size_t ssl_svc_app_st_mk_key(const struct ssl_chello* chello, const struct tfe_stream_addr * addr, char* key_buff, size_t sz) { size_t key_len=0; const char* sip=NULL, *sport=NULL, *dip=NULL, *dport=NULL; char * addr_str= tfe_stream_addr_to_str(addr); tfe_stream_addr_str_split(addr_str, &sip, &sport, &dip, &dport); - key_len=snprintf(key_buff, sz, "%s:%d:%d:%s:%s", sip, - chello->min_version.ossl_format, - chello->max_version.ossl_format, - chello->sni?chello->sni: dip , - chello->alpn?chello->alpn:"null"); + + key_len=snprintf(key_buff, sz, "%d:%d:%s:%s", chello->min_version.ossl_format, + chello->max_version.ossl_format, + chello->sni?chello->sni: dip , + chello->alpn?chello->alpn:"null"); if(chello->cipher_suites && sz-key_len>chello->cipher_suites_len) { memcpy(key_buff+key_len, chello->cipher_suites, chello->cipher_suites_len); @@ -102,13 +121,31 @@ static size_t ssl_svc_client_st_mk_key(const struct ssl_chello* chello, const st { memcpy(key_buff+key_len, chello->supported_groups, chello->supported_groups_len); key_len+=chello->supported_groups_len; - } + } + free(addr_str); + return key_len; +} +static size_t ssl_svc_client_st_mk_key(const struct ssl_chello* chello, const struct tfe_stream_addr * addr, char* key_buff, size_t sz) +{ + size_t key_len=0; + const char* sip=NULL, *sport=NULL, *dip=NULL, *dport=NULL; + char * addr_str= tfe_stream_addr_to_str(addr); + tfe_stream_addr_str_split(addr_str, &sip, &sport, &dip, &dport); + char chello_id_buff[sz]; + size_t chello_id_len=0; + + key_len=snprintf(key_buff, sz, "%s:", sip); + chello_id_len=ssl_svc_app_st_mk_key(chello, addr, chello_id_buff, sizeof(chello_id_buff)); + memcpy(key_buff+key_len, chello_id_buff, MIN(chello_id_len, sz-key_len)); + key_len+=chello_id_len; + free(addr_str); return key_len; } static long cli_st_read_cb(void * data, const uchar * key, uint size, void * user_arg) { struct ssl_svc_client_st* cli_st=(struct ssl_svc_client_st*)data; + struct ssl_service_cache* svc_cache=cli_st->ref_svc_cache; struct ssl_service_status* result=(struct ssl_service_status*)user_arg; if (cli_st == NULL) @@ -117,17 +154,17 @@ static long cli_st_read_cb(void * data, const uchar * key, uint size, void * use } if(cli_st->suspect_pinning_count==0) { - result->pinning_status=PINNING_ST_NOT_PINNING; + result->cli_pinning_status=PINNING_ST_NOT_PINNING; } - else if(cli_st->suspect_pinning_countsuspect_pinning_countfail_as_cli_pinning_count) { - result->pinning_status=PINNING_ST_MAYBE_PINNING; + result->cli_pinning_status=PINNING_ST_MAYBE_PINNING; } else { - result->pinning_status=PINNING_ST_PINNING; + result->cli_pinning_status=PINNING_ST_PINNING; } - if(cli_st->protocol_error_count>=FAIL_AS_PROTO_ERR_COUNT) + if(cli_st->protocol_error_count>=svc_cache->fail_as_proto_err_count) { result->has_protocol_errors=1; } @@ -152,27 +189,27 @@ static long cli_st_write_cb(void * data, const uchar * key, uint size, void * us } if (now - cli_st->last_update_time > cache->fail_time_window) { - if(cli_st->suspect_pinning_countfail_as_pinning_count) cli_st->suspect_pinning_count=0; + if(cli_st->suspect_pinning_countfail_as_cli_pinning_count) cli_st->suspect_pinning_count=0; if(cli_st->protocol_error_countfail_as_proto_err_count) cli_st->protocol_error_count=0; } - if(status->pinning_status!=PINNING_ST_NOT_PINNING && cli_st->suspect_pinning_countfail_as_pinning_count) + if(status->cli_pinning_status!=PINNING_ST_NOT_PINNING && cli_st->suspect_pinning_countfail_as_cli_pinning_count) { - if(status->pinning_status==PINNING_ST_PINNING) + if(status->cli_pinning_status==PINNING_ST_PINNING) { - cli_st->suspect_pinning_count=cache->fail_as_pinning_count; + cli_st->suspect_pinning_count=cache->fail_as_cli_pinning_count; } else { cli_st->suspect_pinning_count++; } - if(cli_st->suspect_pinning_count==cache->fail_as_pinning_count) + if(cli_st->suspect_pinning_count==cache->fail_as_cli_pinning_count) { cache->stat.pinning_cli_cnt++; } } - else if(status->pinning_status==PINNING_ST_PINNING) + else if(status->cli_pinning_status==PINNING_ST_PINNING) { - cli_st->suspect_pinning_count=cache->fail_as_pinning_count; + cli_st->suspect_pinning_count=cache->fail_as_cli_pinning_count; } if(status->has_protocol_errors) { @@ -238,10 +275,49 @@ static long srv_st_write_cb(void * data, const uchar * key, uint size, void * us // assert(srv_st->ev_st_switched<2&&srv_st->ct_st_switched<2); return 1; } +static long app_st_read_cb(void * data, const uchar * key, uint size, void * user_arg) +{ + struct ssl_svc_app_st* app_st=(struct ssl_svc_app_st*)data; + struct ssl_service_status* result=(struct ssl_service_status*)user_arg; + if (app_st == NULL) + { + return 0; + } + if(app_st->down_ssl_success_cnt>app_st->ref_svc_cache->succ_as_app_not_pinning_count) + { + result->is_app_not_pinning=1; + } + return 1; + +} +static long app_st_write_cb(void * data, const uchar * key, uint size, void * user_arg) +{ + struct ssl_svc_app_st* app_st=(struct ssl_svc_app_st*)data; + struct ssl_service_write_args* args=(struct ssl_service_write_args*)user_arg; + const struct ssl_service_status* status=args->status; + struct ssl_service_cache* cache=args->cache; + UNUSED int ret = 0; + if(app_st==NULL) + { + app_st=ALLOC(struct ssl_svc_app_st, 1); + app_st->ref_svc_cache=cache; + ret = MESA_htable_add(cache->srv_st_hash, key, size, app_st); + assert(ret >= 0); + } + if(status->is_app_not_pinning) + { + app_st->down_ssl_success_cnt++; + } + if(app_st->down_ssl_success_cnt>cache->succ_as_app_not_pinning_count) + { + cache->stat.app_not_pinning_cnt++; + } + return 1; +} int ssl_service_cache_read(struct ssl_service_cache* svc_cache, const struct ssl_chello* chello, const struct tfe_stream_addr * addr, struct ssl_service_status* result) { - long cli_st_cb_ret=0, svr_st_cb_ret=0; + long cli_st_cb_ret=0, svr_st_cb_ret=0, app_st_cb_ret=0; char hash_key[2048]; size_t hash_key_sz=0; if(chello->sni==NULL) @@ -252,7 +328,10 @@ int ssl_service_cache_read(struct ssl_service_cache* svc_cache, const struct ssl MESA_htable_search_cb(svc_cache->cli_st_hash, (unsigned char*) hash_key, (unsigned int) hash_key_sz, cli_st_read_cb, result, &cli_st_cb_ret); hash_key_sz=ssl_svc_server_st_mk_key(chello, addr, hash_key, sizeof(hash_key)); MESA_htable_search_cb(svc_cache->srv_st_hash, (unsigned char*) hash_key, (unsigned int) hash_key_sz, srv_st_read_cb, result, &svr_st_cb_ret); - if(cli_st_cb_ret||svr_st_cb_ret) + hash_key_sz=ssl_svc_app_st_mk_key(chello, addr, hash_key, sizeof(hash_key)); + MESA_htable_search_cb(svc_cache->srv_st_hash, (unsigned char*) hash_key, (unsigned int) hash_key_sz, app_st_read_cb, result, &app_st_cb_ret); + + if(cli_st_cb_ret||svr_st_cb_ret||app_st_cb_ret) { return 1; } @@ -273,7 +352,7 @@ void ssl_service_cache_write(struct ssl_service_cache* svc_cache, const struct s return; } struct ssl_service_write_args write_args={svc_cache, status}; - if(status->is_mutual_auth||status->pinning_status!=PINNING_ST_NOT_PINNING||status->has_protocol_errors) + if(status->is_mutual_auth||status->cli_pinning_status!=PINNING_ST_NOT_PINNING||status->has_protocol_errors) { hash_key_sz=ssl_svc_client_st_mk_key(chello, addr, hash_key, sizeof(hash_key)); MESA_htable_search_cb(svc_cache->cli_st_hash, (unsigned char*)hash_key, (unsigned int) hash_key_sz, cli_st_write_cb, &write_args, &cli_st_cb_ret); @@ -283,19 +362,25 @@ void ssl_service_cache_write(struct ssl_service_cache* svc_cache, const struct s hash_key_sz=ssl_svc_server_st_mk_key(chello, addr, hash_key, sizeof(hash_key)); MESA_htable_search_cb(svc_cache->srv_st_hash, (unsigned char*)hash_key, (unsigned int) hash_key_sz, srv_st_write_cb, &write_args, &svr_st_cb_ret); } + if(status->is_app_not_pinning) + { + hash_key_sz=ssl_svc_app_st_mk_key(chello, addr, hash_key, sizeof(hash_key)); + MESA_htable_search_cb(svc_cache->app_st_hash, (unsigned char*)hash_key, (unsigned int) hash_key_sz, app_st_write_cb, &write_args, &svr_st_cb_ret); + } } struct ssl_service_cache* ssl_service_cache_create(unsigned int slot_size, unsigned int expire_seconds, int fail_as_pinning_cnt, int fail_as_proto_err_cnt, int fail_time_win) { struct ssl_service_cache * cache = ALLOC(struct ssl_service_cache, 1); unsigned max_num = slot_size * 4; UNUSED int ret = 0; - MESA_htable_handle htable=NULL, saved[2]; + MESA_htable_handle htable=NULL, saved[3]; int i=0, opt_val=0; - cache->fail_as_pinning_count=fail_as_pinning_cnt; + cache->fail_as_cli_pinning_count=fail_as_pinning_cnt; cache->fail_as_proto_err_count=fail_as_proto_err_cnt; cache->fail_time_window=fail_time_win; - void (*free_func[])(void *)={ssl_svc_free_client_st, ssl_svc_free_server_st}; - for(i=0; i<2; i++) + cache->succ_as_app_not_pinning_count=4;//TODO: read from profile. + void (*free_func[])(void *)={ssl_svc_free_client_st, ssl_svc_free_server_st, ssl_svc_free_app_st}; + for(i=0; i<3; i++) { htable = MESA_htable_born(); opt_val=0; @@ -320,7 +405,7 @@ struct ssl_service_cache* ssl_service_cache_create(unsigned int slot_size, unsig } cache->cli_st_hash=saved[0]; cache->srv_st_hash=saved[1]; - + cache->app_st_hash=saved[3]; return cache; } void ssl_service_cache_destroy(struct ssl_service_cache* cache) diff --git a/platform/src/ssl_stream.cpp b/platform/src/ssl_stream.cpp index 947d6fb..4f27613 100644 --- a/platform/src/ssl_stream.cpp +++ b/platform/src/ssl_stream.cpp @@ -121,6 +121,7 @@ struct ssl_mgr unsigned int no_alpn; unsigned int no_cert_verify; unsigned int no_mirror_client_cipher_suite; + unsigned int root_cert_not_installed_is_not_pinning; CONST_SSL_METHOD * (* sslmethod)(void); //Parameter of SSL_CTX_new int ssl_min_version, ssl_max_version; @@ -682,7 +683,8 @@ struct ssl_mgr * ssl_manager_init(const char * ini_profile, const char * section { mgr->down_stek_box = sess_ticket_box_create(ev_base_gc, stek_group_num, stek_rotation_time, logger); } - + MESA_load_profile_uint_def(ini_profile, section, "root_cert_not_installed_is_not_pinning", + &(mgr->root_cert_not_installed_is_not_pinning), 0); MESA_load_profile_uint_def(ini_profile, section, "service_cache_slots", &(mgr->svc_cache_slots), 4 * 1024 * 1024); MESA_load_profile_uint_def(ini_profile, section, "service_cache_expire_seconds", @@ -1173,7 +1175,7 @@ void ssl_stream_process_error(struct ssl_stream * s_stream, unsigned long sslerr && s_upstream->is_server_cert_verify_passed && s_upstream->verify_result.is_hostmatched) { - s_upstream->svc_status.pinning_status=PINNING_ST_PINNING; + s_upstream->svc_status.cli_pinning_status=PINNING_ST_PINNING; ssl_stream_set_cmsg_integer(s_stream, TFE_CMSG_SSL_PINNING_STATE, PINNING_ST_PINNING); ssl_service_cache_write(mgr->svc_cache, s_upstream->client_hello, s_stream->tcp_stream->addr, &s_upstream->svc_status); } @@ -1205,7 +1207,7 @@ void ssl_stream_process_zero_eof(struct ssl_stream * s_stream, struct ssl_mgr* m s_upstream=&s_stream->peer->up_parts; if(s_upstream->verify_result.is_hostmatched && s_upstream->is_server_cert_verify_passed ) { - s_upstream->svc_status.pinning_status=PINNING_ST_MAYBE_PINNING; + s_upstream->svc_status.cli_pinning_status=PINNING_ST_MAYBE_PINNING; ssl_stream_set_cmsg_integer(s_stream, TFE_CMSG_SSL_PINNING_STATE, PINNING_ST_MAYBE_PINNING); ssl_service_cache_write(mgr->svc_cache, s_stream->peer->up_parts.client_hello, s_stream->tcp_stream->addr, &(s_stream->peer->up_parts.svc_status)); } @@ -1377,7 +1379,7 @@ static void peek_chello_on_succ(future_result_t * result, void * user) TFE_LOG_DEBUG(ctx->mgr->logger, "%s %s service status pinning:%d, mauth:%d, err:%d, ct:%d, ev:%d", addr_string, chello->sni, - svc_status->pinning_status, + svc_status->cli_pinning_status, svc_status->is_mutual_auth, svc_status->has_protocol_errors, svc_status->is_ct, @@ -1385,7 +1387,7 @@ static void peek_chello_on_succ(future_result_t * result, void * user) free(addr_string); addr_string=NULL; } - ssl_stream_set_cmsg_integer(s_stream, TFE_CMSG_SSL_PINNING_STATE, svc_status->pinning_status); + ssl_stream_set_cmsg_integer(s_stream, TFE_CMSG_SSL_PINNING_STATE, svc_status->cli_pinning_status); if(ctx->mgr->on_new_upstream_cb) { s_stream->up_parts.action=ctx->mgr->on_new_upstream_cb(s_stream, ctx->mgr->upstream_cb_param); @@ -1864,6 +1866,10 @@ static void ssl_client_connected_eventcb(struct bufferevent * bev, short events, } s_stream->negotiated_version=SSL_version(s_stream->ssl); ssl_stream_set_cmsg_string(s_stream, TFE_CMSG_SSL_CLIENT_SIDE_VERSION, SSL_get_version(s_stream->ssl)); + struct ssl_service_status svc_status; + memset(&svc_status, 0, sizeof(svc_status)); + svc_status.is_app_not_pinning=1; + ssl_service_cache_write(mgr->svc_cache, s_upstream->client_hello, s_stream->tcp_stream->addr, &svc_status); promise_success(p, ctx); } @@ -2188,6 +2194,7 @@ int ssl_stream_set_integer_opt(struct ssl_stream *upstream, enum SSL_STREAM_OPT int ssl_stream_get_integer_opt(struct ssl_stream *upstream, enum SSL_STREAM_OPT opt_type, int *opt_val) { struct ssl_service_status* svc=&upstream->up_parts.svc_status; + struct ssl_mgr* mgr=upstream->mgr; struct tfe_cmsg *cmsg=NULL; UNUSED int ret=0; uint16_t out_size=0; @@ -2203,7 +2210,14 @@ int ssl_stream_get_integer_opt(struct ssl_stream *upstream, enum SSL_STREAM_OPT *opt_val=svc->is_mutual_auth; break; case SSL_STREAM_OPT_PINNING_STATUS: - *opt_val=svc->pinning_status; + if(mgr->root_cert_not_installed_is_not_pinning && svc->is_app_not_pinning) + { + *opt_val=PINNING_ST_NOT_PINNING; + } + else + { + *opt_val=svc->cli_pinning_status; + } break; case SSL_STREAM_OPT_HAS_PROTOCOL_ERRORS: *opt_val=svc->has_protocol_errors; From 7c12f06b29a497c6a90ccee501faab2c35f527cd Mon Sep 17 00:00:00 2001 From: zhengchao Date: Fri, 26 Jul 2019 13:55:50 +0600 Subject: [PATCH 02/18] =?UTF-8?q?=E4=BF=AE=E6=AD=A3=E7=AC=94=E8=AF=AF?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- platform/src/ssl_service_cache.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/platform/src/ssl_service_cache.cpp b/platform/src/ssl_service_cache.cpp index b7f464c..4b9e987 100644 --- a/platform/src/ssl_service_cache.cpp +++ b/platform/src/ssl_service_cache.cpp @@ -405,7 +405,7 @@ struct ssl_service_cache* ssl_service_cache_create(unsigned int slot_size, unsig } cache->cli_st_hash=saved[0]; cache->srv_st_hash=saved[1]; - cache->app_st_hash=saved[3]; + cache->app_st_hash=saved[2]; return cache; } void ssl_service_cache_destroy(struct ssl_service_cache* cache) From 63bcc591a7bb866a4476c7ad60f6d9fdd821844c Mon Sep 17 00:00:00 2001 From: zhengchao Date: Fri, 26 Jul 2019 14:16:07 +0600 Subject: [PATCH 03/18] =?UTF-8?q?=E5=A2=9E=E5=8A=A0app=20not=20pinning?= =?UTF-8?q?=E7=9A=84=E7=BB=9F=E8=AE=A1=E4=BF=A1=E6=81=AF=EF=BC=8C=E4=BF=AE?= =?UTF-8?q?=E5=A4=8D=E5=88=A4=E7=A9=BA=E3=80=82?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- platform/src/ssl_service_cache.cpp | 4 +++- platform/src/ssl_stream.cpp | 7 ++++--- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/platform/src/ssl_service_cache.cpp b/platform/src/ssl_service_cache.cpp index 4b9e987..03c5f54 100644 --- a/platform/src/ssl_service_cache.cpp +++ b/platform/src/ssl_service_cache.cpp @@ -145,13 +145,13 @@ static size_t ssl_svc_client_st_mk_key(const struct ssl_chello* chello, const st static long cli_st_read_cb(void * data, const uchar * key, uint size, void * user_arg) { struct ssl_svc_client_st* cli_st=(struct ssl_svc_client_st*)data; - struct ssl_service_cache* svc_cache=cli_st->ref_svc_cache; struct ssl_service_status* result=(struct ssl_service_status*)user_arg; if (cli_st == NULL) { return 0; } + struct ssl_service_cache* svc_cache=cli_st->ref_svc_cache; if(cli_st->suspect_pinning_count==0) { result->cli_pinning_status=PINNING_ST_NOT_PINNING; @@ -414,6 +414,8 @@ void ssl_service_cache_destroy(struct ssl_service_cache* cache) cache->cli_st_hash=NULL; MESA_htable_destroy(cache->srv_st_hash, NULL); cache->srv_st_hash=NULL; + MESA_htable_destroy(cache->app_st_hash, NULL); + cache->app_st_hash=NULL; free(cache); return; } diff --git a/platform/src/ssl_stream.cpp b/platform/src/ssl_stream.cpp index 4f27613..ab3ba64 100644 --- a/platform/src/ssl_stream.cpp +++ b/platform/src/ssl_stream.cpp @@ -104,7 +104,7 @@ enum ssl_stream_stat SSL_SVC_MAUTH, SSL_SVC_CT_CERT, SSL_SVC_EV_CERT, - + SSL_SVC_APP_NOT_PINNING, SSL_STAT_MAX }; @@ -359,7 +359,7 @@ ssl_stream_gc_cb(evutil_socket_t fd, short what, void * arg) mgr->stat_val[SSL_SVC_MAUTH]=svc_stat.mutual_auth_cli_cnt; mgr->stat_val[SSL_SVC_CT_CERT]=svc_stat.ct_srv_cnt; mgr->stat_val[SSL_SVC_EV_CERT]=svc_stat.ev_srv_cnt; - + mgr->stat_val[SSL_SVC_APP_NOT_PINNING]=svc_stat.app_not_pinning_cnt; for(i=0;ifs_handle, mgr->fs_id[i], 0, FS_OP_SET, ATOMIC_READ(&(mgr->stat_val[i]))); @@ -415,7 +415,8 @@ void ssl_stat_init(struct ssl_mgr * mgr) spec[SSL_SVC_MAUTH]="ssl_mauth"; spec[SSL_SVC_CT_CERT]="ssl_ct_crt"; spec[SSL_SVC_EV_CERT]="ssl_ev_crt"; - + spec[SSL_SVC_APP_NOT_PINNING]="app_no_pinning"; + for(i=0;i Date: Fri, 26 Jul 2019 14:21:51 +0600 Subject: [PATCH 04/18] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=E8=AF=BB=E5=8F=96app?= =?UTF-8?q?=20state=E6=97=B6=E7=9A=84=E7=AC=94=E8=AF=AF=E3=80=82?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- platform/src/ssl_service_cache.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/platform/src/ssl_service_cache.cpp b/platform/src/ssl_service_cache.cpp index 03c5f54..960611f 100644 --- a/platform/src/ssl_service_cache.cpp +++ b/platform/src/ssl_service_cache.cpp @@ -301,7 +301,7 @@ static long app_st_write_cb(void * data, const uchar * key, uint size, void * us { app_st=ALLOC(struct ssl_svc_app_st, 1); app_st->ref_svc_cache=cache; - ret = MESA_htable_add(cache->srv_st_hash, key, size, app_st); + ret = MESA_htable_add(cache->app_st_hash, key, size, app_st); assert(ret >= 0); } if(status->is_app_not_pinning) From 9c8bc53d284ea2d2242255c5e641447d6ea5ab22 Mon Sep 17 00:00:00 2001 From: zhengchao Date: Sat, 27 Jul 2019 16:00:22 +0600 Subject: [PATCH 05/18] =?UTF-8?q?=E4=BF=AE=E6=AD=A3=E6=9F=A5=E8=AF=A2app?= =?UTF-8?q?=5Fst=E6=97=B6=EF=BC=8C=E4=BD=BF=E7=94=A8=E4=BA=86=E9=94=99?= =?UTF-8?q?=E8=AF=AF=E7=9A=84=E5=93=88=E5=B8=8C=E8=A1=A8=E3=80=82?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- platform/src/ssl_service_cache.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/platform/src/ssl_service_cache.cpp b/platform/src/ssl_service_cache.cpp index 960611f..994b816 100644 --- a/platform/src/ssl_service_cache.cpp +++ b/platform/src/ssl_service_cache.cpp @@ -329,7 +329,7 @@ int ssl_service_cache_read(struct ssl_service_cache* svc_cache, const struct ssl hash_key_sz=ssl_svc_server_st_mk_key(chello, addr, hash_key, sizeof(hash_key)); MESA_htable_search_cb(svc_cache->srv_st_hash, (unsigned char*) hash_key, (unsigned int) hash_key_sz, srv_st_read_cb, result, &svr_st_cb_ret); hash_key_sz=ssl_svc_app_st_mk_key(chello, addr, hash_key, sizeof(hash_key)); - MESA_htable_search_cb(svc_cache->srv_st_hash, (unsigned char*) hash_key, (unsigned int) hash_key_sz, app_st_read_cb, result, &app_st_cb_ret); + MESA_htable_search_cb(svc_cache->app_st_hash, (unsigned char*) hash_key, (unsigned int) hash_key_sz, app_st_read_cb, result, &app_st_cb_ret); if(cli_st_cb_ret||svr_st_cb_ret||app_st_cb_ret) { From 1f7a32f7f51eeef45bb58dde4e7d5d9d060ff932 Mon Sep 17 00:00:00 2001 From: luwenpeng Date: Thu, 15 Aug 2019 13:15:54 +0800 Subject: [PATCH 06/18] =?UTF-8?q?=E4=BF=AE=E6=AD=A3=20ssl=5Fsvc=5Fclient?= =?UTF-8?q?=5Fst=5Fmk=5Fkey()=20=E8=BF=94=E5=9B=9E=E7=9A=84=20hash=5Fkey?= =?UTF-8?q?=5Fsz?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- platform/src/ssl_service_cache.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/platform/src/ssl_service_cache.cpp b/platform/src/ssl_service_cache.cpp index 994b816..1bc3442 100644 --- a/platform/src/ssl_service_cache.cpp +++ b/platform/src/ssl_service_cache.cpp @@ -137,7 +137,7 @@ static size_t ssl_svc_client_st_mk_key(const struct ssl_chello* chello, const st key_len=snprintf(key_buff, sz, "%s:", sip); chello_id_len=ssl_svc_app_st_mk_key(chello, addr, chello_id_buff, sizeof(chello_id_buff)); memcpy(key_buff+key_len, chello_id_buff, MIN(chello_id_len, sz-key_len)); - key_len+=chello_id_len; + key_len += MIN(chello_id_len, sz-key_len); free(addr_str); return key_len; @@ -378,7 +378,7 @@ struct ssl_service_cache* ssl_service_cache_create(unsigned int slot_size, unsig cache->fail_as_cli_pinning_count=fail_as_pinning_cnt; cache->fail_as_proto_err_count=fail_as_proto_err_cnt; cache->fail_time_window=fail_time_win; - cache->succ_as_app_not_pinning_count=4;//TODO: read from profile. + cache->succ_as_app_not_pinning_count=SUCC_AS_APP_NOT_PINNING;//TODO: read from profile. void (*free_func[])(void *)={ssl_svc_free_client_st, ssl_svc_free_server_st, ssl_svc_free_app_st}; for(i=0; i<3; i++) { From f589f0e4331a4b02eb42818a8b93e34502253a71 Mon Sep 17 00:00:00 2001 From: lwp Date: Fri, 16 Aug 2019 14:51:43 +0800 Subject: [PATCH 07/18] =?UTF-8?q?=E4=B8=BA=E4=BA=86=E4=BE=BF=E4=BA=8E?= =?UTF-8?q?=E8=B0=83=E8=AF=95=EF=BC=8C=20=E5=B0=86=20ssl=20service=20cache?= =?UTF-8?q?=20=E7=9A=84=20hash=20key=20=E9=83=BD=E8=BD=AC=E5=8C=96?= =?UTF-8?q?=E6=88=90=2016=20=E8=BF=9B=E5=88=B6=E6=A0=BC=E5=BC=8F=EF=BC=8C?= =?UTF-8?q?=E5=B9=B6=E5=A2=9E=E5=8A=A0=20debug=20=E6=97=A5=E5=BF=97?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- platform/src/ssl_service_cache.cpp | 53 ++++++++++++++++++++++-------- 1 file changed, 39 insertions(+), 14 deletions(-) diff --git a/platform/src/ssl_service_cache.cpp b/platform/src/ssl_service_cache.cpp index 1bc3442..11f845c 100644 --- a/platform/src/ssl_service_cache.cpp +++ b/platform/src/ssl_service_cache.cpp @@ -318,18 +318,32 @@ static long app_st_write_cb(void * data, const uchar * key, uint size, void * us int ssl_service_cache_read(struct ssl_service_cache* svc_cache, const struct ssl_chello* chello, const struct tfe_stream_addr * addr, struct ssl_service_status* result) { long cli_st_cb_ret=0, svr_st_cb_ret=0, app_st_cb_ret=0; - char hash_key[2048]; + char temp_key[2048]; + unsigned char hash_key[4096]; // Size must be twice the size of temp_key + size_t temp_key_sz=0; size_t hash_key_sz=0; if(chello->sni==NULL) { return 0; } - hash_key_sz=ssl_svc_client_st_mk_key(chello, addr, hash_key, sizeof(hash_key)); - MESA_htable_search_cb(svc_cache->cli_st_hash, (unsigned char*) hash_key, (unsigned int) hash_key_sz, cli_st_read_cb, result, &cli_st_cb_ret); - hash_key_sz=ssl_svc_server_st_mk_key(chello, addr, hash_key, sizeof(hash_key)); - MESA_htable_search_cb(svc_cache->srv_st_hash, (unsigned char*) hash_key, (unsigned int) hash_key_sz, srv_st_read_cb, result, &svr_st_cb_ret); - hash_key_sz=ssl_svc_app_st_mk_key(chello, addr, hash_key, sizeof(hash_key)); - MESA_htable_search_cb(svc_cache->app_st_hash, (unsigned char*) hash_key, (unsigned int) hash_key_sz, app_st_read_cb, result, &app_st_cb_ret); + + memset(hash_key, 0, sizeof(hash_key)); + temp_key_sz = ssl_svc_client_st_mk_key(chello, addr, temp_key, sizeof(temp_key)); + hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key; + TFE_LOG_DEBUG(g_default_logger, "ssl svc read client table, hash:%s, ori_len:%lu hash_len:%lu\n", hash_key, temp_key_sz, hash_key_sz); + MESA_htable_search_cb(svc_cache->cli_st_hash, hash_key, (unsigned int) hash_key_sz, cli_st_read_cb, result, &cli_st_cb_ret); + + memset(hash_key, 0, sizeof(hash_key)); + temp_key_sz = ssl_svc_server_st_mk_key(chello, addr, temp_key, sizeof(temp_key)); + hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key; + TFE_LOG_DEBUG(g_default_logger, "ssl svc read server table, hash:%s, ori_len:%lu hash_len:%lu\n", hash_key, temp_key_sz, hash_key_sz); + MESA_htable_search_cb(svc_cache->srv_st_hash, hash_key, (unsigned int) hash_key_sz, srv_st_read_cb, result, &svr_st_cb_ret); + + memset(hash_key, 0, sizeof(hash_key)); + temp_key_sz = ssl_svc_app_st_mk_key(chello, addr, temp_key, sizeof(temp_key)); + hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key; + TFE_LOG_DEBUG(g_default_logger, "ssl svc read app table, hash:%s, ori_len:%lu hash_len:%lu\n", hash_key, temp_key_sz, hash_key_sz); + MESA_htable_search_cb(svc_cache->app_st_hash, hash_key, (unsigned int) hash_key_sz, app_st_read_cb, result, &app_st_cb_ret); if(cli_st_cb_ret||svr_st_cb_ret||app_st_cb_ret) { @@ -344,7 +358,9 @@ int ssl_service_cache_read(struct ssl_service_cache* svc_cache, const struct ssl void ssl_service_cache_write(struct ssl_service_cache* svc_cache, const struct ssl_chello* chello, const struct tfe_stream_addr * addr, const struct ssl_service_status* status) { long cli_st_cb_ret=0, svr_st_cb_ret=0; - char hash_key[2048]; + char temp_key[2048]; + unsigned char hash_key[4096]; // Size must be twice the size of temp_key + size_t temp_key_sz=0; size_t hash_key_sz=0; if(chello == NULL || chello->sni==NULL) @@ -354,18 +370,27 @@ void ssl_service_cache_write(struct ssl_service_cache* svc_cache, const struct s struct ssl_service_write_args write_args={svc_cache, status}; if(status->is_mutual_auth||status->cli_pinning_status!=PINNING_ST_NOT_PINNING||status->has_protocol_errors) { - hash_key_sz=ssl_svc_client_st_mk_key(chello, addr, hash_key, sizeof(hash_key)); - MESA_htable_search_cb(svc_cache->cli_st_hash, (unsigned char*)hash_key, (unsigned int) hash_key_sz, cli_st_write_cb, &write_args, &cli_st_cb_ret); + memset(hash_key, 0, sizeof(hash_key)); + temp_key_sz = ssl_svc_client_st_mk_key(chello, addr, temp_key, sizeof(temp_key)); + hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key; + TFE_LOG_DEBUG(g_default_logger, "ssl svc write client table, hash:%s, ori_len:%lu hash_len:%lu\n", hash_key, temp_key_sz, hash_key_sz); + MESA_htable_search_cb(svc_cache->cli_st_hash, hash_key, (unsigned int) hash_key_sz, cli_st_write_cb, &write_args, &cli_st_cb_ret); } if(status->is_ct||status->is_ev) { - hash_key_sz=ssl_svc_server_st_mk_key(chello, addr, hash_key, sizeof(hash_key)); - MESA_htable_search_cb(svc_cache->srv_st_hash, (unsigned char*)hash_key, (unsigned int) hash_key_sz, srv_st_write_cb, &write_args, &svr_st_cb_ret); + memset(hash_key, 0, sizeof(hash_key)); + temp_key_sz = ssl_svc_server_st_mk_key(chello, addr, temp_key, sizeof(temp_key)); + hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key; + TFE_LOG_DEBUG(g_default_logger, "ssl svc write server table, hash:%s, ori_len:%lu hash_len:%lu\n", hash_key, temp_key_sz, hash_key_sz); + MESA_htable_search_cb(svc_cache->srv_st_hash, hash_key, (unsigned int) hash_key_sz, srv_st_write_cb, &write_args, &svr_st_cb_ret); } if(status->is_app_not_pinning) { - hash_key_sz=ssl_svc_app_st_mk_key(chello, addr, hash_key, sizeof(hash_key)); - MESA_htable_search_cb(svc_cache->app_st_hash, (unsigned char*)hash_key, (unsigned int) hash_key_sz, app_st_write_cb, &write_args, &svr_st_cb_ret); + memset(hash_key, 0, sizeof(hash_key)); + temp_key_sz = ssl_svc_app_st_mk_key(chello, addr, temp_key, sizeof(temp_key)); + hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key; + TFE_LOG_DEBUG(g_default_logger, "ssl svc write app table, hash:%s, ori_len:%lu hash_len:%lu\n", hash_key, temp_key_sz, hash_key_sz); + MESA_htable_search_cb(svc_cache->app_st_hash, hash_key, (unsigned int) hash_key_sz, app_st_write_cb, &write_args, &svr_st_cb_ret); } } struct ssl_service_cache* ssl_service_cache_create(unsigned int slot_size, unsigned int expire_seconds, int fail_as_pinning_cnt, int fail_as_proto_err_cnt, int fail_time_win) From 90e6ec4fdc9a2c94b807fbef78a1a4d7c5ebaf2f Mon Sep 17 00:00:00 2001 From: luwenpeng Date: Mon, 26 Aug 2019 14:56:47 +0800 Subject: [PATCH 08/18] =?UTF-8?q?ssl=5Fsvc=5Ffree=5Fclient=5Fst()=20?= =?UTF-8?q?=E4=B8=AD=E6=9B=B4=E6=96=B0=20proto=5Ferr=5Fcli=5Fcnt=20?= =?UTF-8?q?=E7=9A=84=E5=80=BC?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- platform/src/ssl_service_cache.cpp | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/platform/src/ssl_service_cache.cpp b/platform/src/ssl_service_cache.cpp index 11f845c..f8ae994 100644 --- a/platform/src/ssl_service_cache.cpp +++ b/platform/src/ssl_service_cache.cpp @@ -58,6 +58,12 @@ static void ssl_svc_free_client_st(void * data) { svc_cache->stat.pinning_cli_cnt--; } + + if (p->protocol_error_count >= svc_cache->fail_as_proto_err_count) + { + svc_cache->stat.proto_err_cli_cnt--; + } + free(p); return; } From f9420b16bb7845bd829160f333d3103a2a66316a Mon Sep 17 00:00:00 2001 From: luwenpeng Date: Mon, 26 Aug 2019 15:28:04 +0800 Subject: [PATCH 09/18] =?UTF-8?q?=E5=A2=9E=E5=8A=A0=E4=BB=8E=E9=85=8D?= =?UTF-8?q?=E7=BD=AE=E6=96=87=E4=BB=B6=E8=AF=BB=E5=8F=96=20service=5Fcache?= =?UTF-8?q?=5Fsucc=5Fas=5Fapp=5Fnot=5Fpinning=5Fcnt=20=E9=85=8D=E7=BD=AE?= =?UTF-8?q?=E9=A1=B9=E7=9A=84=E5=8A=9F=E8=83=BD?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- conf/tfe/tfe.conf | 1 + platform/include/internal/ssl_service_cache.h | 2 +- platform/src/ssl_service_cache.cpp | 8 ++------ platform/src/ssl_stream.cpp | 4 ++++ 4 files changed, 8 insertions(+), 7 deletions(-) diff --git a/conf/tfe/tfe.conf b/conf/tfe/tfe.conf index 3dccb37..fe27597 100644 --- a/conf/tfe/tfe.conf +++ b/conf/tfe/tfe.conf @@ -21,6 +21,7 @@ key_log_file=log/sslkeylog.log no_alpn=0 stek_group_num=4 stek_rotation_time=3600 +service_cache_succ_as_app_not_pinning_cnt=3 [key_keeper] #Mode: debug - generate cert with ca_path, normal - generate cert with cert store diff --git a/platform/include/internal/ssl_service_cache.h b/platform/include/internal/ssl_service_cache.h index 56d2a20..fe6c09a 100644 --- a/platform/include/internal/ssl_service_cache.h +++ b/platform/include/internal/ssl_service_cache.h @@ -18,7 +18,7 @@ struct ssl_service_status }; struct ssl_service_cache; -struct ssl_service_cache* ssl_service_cache_create(unsigned int slot_size, unsigned int expire_seconds, int fail_as_pinning_cnt, int fail_as_proto_err_cnt, int fail_time_win); +struct ssl_service_cache* ssl_service_cache_create(unsigned int slot_size, unsigned int expire_seconds, int fail_as_pinning_cnt, int fail_as_proto_err_cnt, int succ_as_app_not_pinning_cnt, int fail_time_win); void ssl_service_cache_destroy(struct ssl_service_cache* cache); int ssl_service_cache_read(struct ssl_service_cache* svc_cache, const struct ssl_chello* chello, const struct tfe_stream_addr * addr, struct ssl_service_status* result); diff --git a/platform/src/ssl_service_cache.cpp b/platform/src/ssl_service_cache.cpp index f8ae994..3ab0461 100644 --- a/platform/src/ssl_service_cache.cpp +++ b/platform/src/ssl_service_cache.cpp @@ -4,10 +4,6 @@ #include #include -#define FAIL_AS_PINNING_COUNT 4 -#define FAIL_TIME_WINDOW 30 -#define FAIL_AS_PROTO_ERR_COUNT 5 -#define SUCC_AS_APP_NOT_PINNING 3 struct ssl_svc_client_st { time_t last_update_time; @@ -399,7 +395,7 @@ void ssl_service_cache_write(struct ssl_service_cache* svc_cache, const struct s MESA_htable_search_cb(svc_cache->app_st_hash, hash_key, (unsigned int) hash_key_sz, app_st_write_cb, &write_args, &svr_st_cb_ret); } } -struct ssl_service_cache* ssl_service_cache_create(unsigned int slot_size, unsigned int expire_seconds, int fail_as_pinning_cnt, int fail_as_proto_err_cnt, int fail_time_win) +struct ssl_service_cache* ssl_service_cache_create(unsigned int slot_size, unsigned int expire_seconds, int fail_as_pinning_cnt, int fail_as_proto_err_cnt, int succ_as_app_not_pinning_cnt, int fail_time_win) { struct ssl_service_cache * cache = ALLOC(struct ssl_service_cache, 1); unsigned max_num = slot_size * 4; @@ -409,7 +405,7 @@ struct ssl_service_cache* ssl_service_cache_create(unsigned int slot_size, unsig cache->fail_as_cli_pinning_count=fail_as_pinning_cnt; cache->fail_as_proto_err_count=fail_as_proto_err_cnt; cache->fail_time_window=fail_time_win; - cache->succ_as_app_not_pinning_count=SUCC_AS_APP_NOT_PINNING;//TODO: read from profile. + cache->succ_as_app_not_pinning_count = succ_as_app_not_pinning_cnt; void (*free_func[])(void *)={ssl_svc_free_client_st, ssl_svc_free_server_st, ssl_svc_free_app_st}; for(i=0; i<3; i++) { diff --git a/platform/src/ssl_stream.cpp b/platform/src/ssl_stream.cpp index ab3ba64..c600614 100644 --- a/platform/src/ssl_stream.cpp +++ b/platform/src/ssl_stream.cpp @@ -134,6 +134,7 @@ struct ssl_mgr unsigned int svc_expire_seconds; unsigned int svc_fail_as_pinning_cnt; unsigned int svc_fail_as_proto_err_cnt; + unsigned int svc_succ_as_app_not_pinning_cnt; unsigned int svc_cnt_time_window; struct sess_cache * down_sess_cache; @@ -694,12 +695,15 @@ struct ssl_mgr * ssl_manager_init(const char * ini_profile, const char * section &(mgr->svc_fail_as_pinning_cnt), 4); MESA_load_profile_uint_def(ini_profile, section, "service_cache_fail_as_proto_err_cnt", &(mgr->svc_fail_as_proto_err_cnt), 5); + MESA_load_profile_uint_def(ini_profile, section, "service_cache_succ_as_app_not_pinning_cnt", + &(mgr->svc_succ_as_app_not_pinning_cnt), 3); MESA_load_profile_uint_def(ini_profile, section, "service_cache_fail_time_window", &(mgr->svc_cnt_time_window), 30); mgr->svc_cache=ssl_service_cache_create(mgr->svc_cache_slots, mgr->svc_expire_seconds, mgr->svc_fail_as_pinning_cnt, mgr->svc_fail_as_proto_err_cnt, + mgr->svc_succ_as_app_not_pinning_cnt, mgr->svc_cnt_time_window); mgr->key_keeper = key_keeper_init(ini_profile, "key_keeper", logger); From 73fe38b7d58b9c923b1fdbc5dee86d7f616d5cf0 Mon Sep 17 00:00:00 2001 From: luwenpeng Date: Wed, 28 Aug 2019 14:30:24 +0800 Subject: [PATCH 10/18] =?UTF-8?q?=E4=BF=AE=E6=94=B9=20ss=20svc=20=E6=97=A5?= =?UTF-8?q?=E5=BF=97=E6=A0=BC=E5=BC=8F?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- platform/src/ssl_service_cache.cpp | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/platform/src/ssl_service_cache.cpp b/platform/src/ssl_service_cache.cpp index 3ab0461..062bb43 100644 --- a/platform/src/ssl_service_cache.cpp +++ b/platform/src/ssl_service_cache.cpp @@ -332,20 +332,20 @@ int ssl_service_cache_read(struct ssl_service_cache* svc_cache, const struct ssl memset(hash_key, 0, sizeof(hash_key)); temp_key_sz = ssl_svc_client_st_mk_key(chello, addr, temp_key, sizeof(temp_key)); hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key; - TFE_LOG_DEBUG(g_default_logger, "ssl svc read client table, hash:%s, ori_len:%lu hash_len:%lu\n", hash_key, temp_key_sz, hash_key_sz); - MESA_htable_search_cb(svc_cache->cli_st_hash, hash_key, (unsigned int) hash_key_sz, cli_st_read_cb, result, &cli_st_cb_ret); + MESA_htable_search_cb(svc_cache->cli_st_hash, hash_key, (unsigned int) hash_key_sz, cli_st_read_cb, result, &cli_st_cb_ret); + TFE_LOG_DEBUG(g_default_logger, "ssl svc read client table, hash:%s, found:%d", hash_key, cli_st_cb_ret); memset(hash_key, 0, sizeof(hash_key)); temp_key_sz = ssl_svc_server_st_mk_key(chello, addr, temp_key, sizeof(temp_key)); hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key; - TFE_LOG_DEBUG(g_default_logger, "ssl svc read server table, hash:%s, ori_len:%lu hash_len:%lu\n", hash_key, temp_key_sz, hash_key_sz); MESA_htable_search_cb(svc_cache->srv_st_hash, hash_key, (unsigned int) hash_key_sz, srv_st_read_cb, result, &svr_st_cb_ret); + TFE_LOG_DEBUG(g_default_logger, "ssl svc read server table, hash:%s, found:%d", hash_key, srv_st_cb_ret); memset(hash_key, 0, sizeof(hash_key)); temp_key_sz = ssl_svc_app_st_mk_key(chello, addr, temp_key, sizeof(temp_key)); hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key; - TFE_LOG_DEBUG(g_default_logger, "ssl svc read app table, hash:%s, ori_len:%lu hash_len:%lu\n", hash_key, temp_key_sz, hash_key_sz); MESA_htable_search_cb(svc_cache->app_st_hash, hash_key, (unsigned int) hash_key_sz, app_st_read_cb, result, &app_st_cb_ret); + TFE_LOG_DEBUG(g_default_logger, "ssl svc read app table, hash:%s, found:%d", hash_key, app_st_cb_ret); if(cli_st_cb_ret||svr_st_cb_ret||app_st_cb_ret) { @@ -375,7 +375,7 @@ void ssl_service_cache_write(struct ssl_service_cache* svc_cache, const struct s memset(hash_key, 0, sizeof(hash_key)); temp_key_sz = ssl_svc_client_st_mk_key(chello, addr, temp_key, sizeof(temp_key)); hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key; - TFE_LOG_DEBUG(g_default_logger, "ssl svc write client table, hash:%s, ori_len:%lu hash_len:%lu\n", hash_key, temp_key_sz, hash_key_sz); + TFE_LOG_DEBUG(g_default_logger, "ssl svc write client table, hash:%s", hash_key); MESA_htable_search_cb(svc_cache->cli_st_hash, hash_key, (unsigned int) hash_key_sz, cli_st_write_cb, &write_args, &cli_st_cb_ret); } if(status->is_ct||status->is_ev) @@ -383,7 +383,7 @@ void ssl_service_cache_write(struct ssl_service_cache* svc_cache, const struct s memset(hash_key, 0, sizeof(hash_key)); temp_key_sz = ssl_svc_server_st_mk_key(chello, addr, temp_key, sizeof(temp_key)); hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key; - TFE_LOG_DEBUG(g_default_logger, "ssl svc write server table, hash:%s, ori_len:%lu hash_len:%lu\n", hash_key, temp_key_sz, hash_key_sz); + TFE_LOG_DEBUG(g_default_logger, "ssl svc write server table, hash:%s", hash_key,); MESA_htable_search_cb(svc_cache->srv_st_hash, hash_key, (unsigned int) hash_key_sz, srv_st_write_cb, &write_args, &svr_st_cb_ret); } if(status->is_app_not_pinning) @@ -391,7 +391,7 @@ void ssl_service_cache_write(struct ssl_service_cache* svc_cache, const struct s memset(hash_key, 0, sizeof(hash_key)); temp_key_sz = ssl_svc_app_st_mk_key(chello, addr, temp_key, sizeof(temp_key)); hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key; - TFE_LOG_DEBUG(g_default_logger, "ssl svc write app table, hash:%s, ori_len:%lu hash_len:%lu\n", hash_key, temp_key_sz, hash_key_sz); + TFE_LOG_DEBUG(g_default_logger, "ssl svc write app table, hash:%s", hash_key); MESA_htable_search_cb(svc_cache->app_st_hash, hash_key, (unsigned int) hash_key_sz, app_st_write_cb, &write_args, &svr_st_cb_ret); } } From f687369db738995cffe4334688ca024c95251bbf Mon Sep 17 00:00:00 2001 From: luwenpeng Date: Wed, 28 Aug 2019 14:41:38 +0800 Subject: [PATCH 11/18] =?UTF-8?q?=E5=BB=B6=E9=95=BF=20app=5Fst=20=E8=A1=A8?= =?UTF-8?q?=E4=B8=AD=E6=95=B0=E6=8D=AE=E7=9A=84=E7=94=9F=E5=AD=98=E6=97=B6?= =?UTF-8?q?=E9=97=B4=EF=BC=881=EF=BC=8C=E5=BB=B6=E9=95=BF=20app=5Fst=20?= =?UTF-8?q?=E8=A1=A8=E7=9A=84=E8=B6=85=E6=97=B6=E6=97=B6=E9=97=B4=EF=BC=9B?= =?UTF-8?q?2.=E5=B9=B6=E8=AE=BE=E7=BD=AE=20lru=20=E6=B7=98=E6=B1=B0?= =?UTF-8?q?=E7=AD=96=E7=95=A5=EF=BC=89?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- platform/src/ssl_service_cache.cpp | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/platform/src/ssl_service_cache.cpp b/platform/src/ssl_service_cache.cpp index 062bb43..eb92cc8 100644 --- a/platform/src/ssl_service_cache.cpp +++ b/platform/src/ssl_service_cache.cpp @@ -418,11 +418,21 @@ struct ssl_service_cache* ssl_service_cache_create(unsigned int slot_size, unsig ret = MESA_htable_set_opt(htable, MHO_MUTEX_NUM, &opt_val, sizeof(opt_val)); ret = MESA_htable_set_opt(htable, MHO_HASH_SLOT_SIZE, &slot_size, sizeof(slot_size)); ret = MESA_htable_set_opt(htable, MHO_HASH_MAX_ELEMENT_NUM, &max_num, sizeof(max_num)); - ret = MESA_htable_set_opt(htable, MHO_EXPIRE_TIME, &expire_seconds, sizeof(expire_seconds)); - - opt_val=HASH_ELIMINATE_ALGO_FIFO; - ret = MESA_htable_set_opt(htable, MHO_ELIMIMINATE_TYPE, - &opt_val, sizeof(int)); + // for app table + if (i == 2) + { + unsigned int app_expire_seconds = 2 * expire_seconds; + ret = MESA_htable_set_opt(htable, MHO_EXPIRE_TIME, &app_expire_seconds, sizeof(app_expire_seconds)); + opt_val = HASH_ELIMINATE_ALGO_LRU; + ret = MESA_htable_set_opt(htable, MHO_ELIMIMINATE_TYPE, &opt_val, sizeof(int)); + } + // for client table and server table + else + { + ret = MESA_htable_set_opt(htable, MHO_EXPIRE_TIME, &expire_seconds, sizeof(expire_seconds)); + opt_val = HASH_ELIMINATE_ALGO_FIFO; + ret = MESA_htable_set_opt(htable, MHO_ELIMIMINATE_TYPE, &opt_val, sizeof(int)); + } ret = MESA_htable_set_opt(htable, MHO_CBFUN_DATA_FREE, (void*)free_func[i], sizeof(free_func[i])); From 4a8a7d95ce71f837c8c14bde32236a9ce74ec2a6 Mon Sep 17 00:00:00 2001 From: luwenpeng Date: Wed, 28 Aug 2019 14:52:17 +0800 Subject: [PATCH 12/18] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=E7=AC=94=E8=AF=AF?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- platform/src/ssl_service_cache.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/platform/src/ssl_service_cache.cpp b/platform/src/ssl_service_cache.cpp index eb92cc8..3105f9b 100644 --- a/platform/src/ssl_service_cache.cpp +++ b/platform/src/ssl_service_cache.cpp @@ -339,7 +339,7 @@ int ssl_service_cache_read(struct ssl_service_cache* svc_cache, const struct ssl temp_key_sz = ssl_svc_server_st_mk_key(chello, addr, temp_key, sizeof(temp_key)); hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key; MESA_htable_search_cb(svc_cache->srv_st_hash, hash_key, (unsigned int) hash_key_sz, srv_st_read_cb, result, &svr_st_cb_ret); - TFE_LOG_DEBUG(g_default_logger, "ssl svc read server table, hash:%s, found:%d", hash_key, srv_st_cb_ret); + TFE_LOG_DEBUG(g_default_logger, "ssl svc read server table, hash:%s, found:%d", hash_key, svr_st_cb_ret); memset(hash_key, 0, sizeof(hash_key)); temp_key_sz = ssl_svc_app_st_mk_key(chello, addr, temp_key, sizeof(temp_key)); @@ -383,7 +383,7 @@ void ssl_service_cache_write(struct ssl_service_cache* svc_cache, const struct s memset(hash_key, 0, sizeof(hash_key)); temp_key_sz = ssl_svc_server_st_mk_key(chello, addr, temp_key, sizeof(temp_key)); hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key; - TFE_LOG_DEBUG(g_default_logger, "ssl svc write server table, hash:%s", hash_key,); + TFE_LOG_DEBUG(g_default_logger, "ssl svc write server table, hash:%s", hash_key); MESA_htable_search_cb(svc_cache->srv_st_hash, hash_key, (unsigned int) hash_key_sz, srv_st_write_cb, &write_args, &svr_st_cb_ret); } if(status->is_app_not_pinning) From 3e7d7ea7a3d84e542893e5346a9b6a1823d606b7 Mon Sep 17 00:00:00 2001 From: luwenpeng Date: Fri, 30 Aug 2019 21:14:47 +0800 Subject: [PATCH 13/18] =?UTF-8?q?=E4=BF=AE=E6=94=B9=E6=97=A5=E5=BF=97?= =?UTF-8?q?=EF=BC=8C=E8=BE=93=E5=87=BA=20sni?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- platform/src/ssl_service_cache.cpp | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/platform/src/ssl_service_cache.cpp b/platform/src/ssl_service_cache.cpp index 3105f9b..e1d5667 100644 --- a/platform/src/ssl_service_cache.cpp +++ b/platform/src/ssl_service_cache.cpp @@ -333,19 +333,19 @@ int ssl_service_cache_read(struct ssl_service_cache* svc_cache, const struct ssl temp_key_sz = ssl_svc_client_st_mk_key(chello, addr, temp_key, sizeof(temp_key)); hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key; MESA_htable_search_cb(svc_cache->cli_st_hash, hash_key, (unsigned int) hash_key_sz, cli_st_read_cb, result, &cli_st_cb_ret); - TFE_LOG_DEBUG(g_default_logger, "ssl svc read client table, hash:%s, found:%d", hash_key, cli_st_cb_ret); + TFE_LOG_DEBUG(g_default_logger, "ssl svc read client table, hash:%s, found:%d, sni:%s", hash_key, cli_st_cb_ret, chello->sni); memset(hash_key, 0, sizeof(hash_key)); temp_key_sz = ssl_svc_server_st_mk_key(chello, addr, temp_key, sizeof(temp_key)); hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key; MESA_htable_search_cb(svc_cache->srv_st_hash, hash_key, (unsigned int) hash_key_sz, srv_st_read_cb, result, &svr_st_cb_ret); - TFE_LOG_DEBUG(g_default_logger, "ssl svc read server table, hash:%s, found:%d", hash_key, svr_st_cb_ret); + TFE_LOG_DEBUG(g_default_logger, "ssl svc read server table, hash:%s, found:%d, sni:%s", hash_key, svr_st_cb_ret, chello->sni); memset(hash_key, 0, sizeof(hash_key)); temp_key_sz = ssl_svc_app_st_mk_key(chello, addr, temp_key, sizeof(temp_key)); hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key; MESA_htable_search_cb(svc_cache->app_st_hash, hash_key, (unsigned int) hash_key_sz, app_st_read_cb, result, &app_st_cb_ret); - TFE_LOG_DEBUG(g_default_logger, "ssl svc read app table, hash:%s, found:%d", hash_key, app_st_cb_ret); + TFE_LOG_DEBUG(g_default_logger, "ssl svc read app table, hash:%s, found:%d, sni:%s", hash_key, app_st_cb_ret, chello->sni); if(cli_st_cb_ret||svr_st_cb_ret||app_st_cb_ret) { @@ -375,7 +375,7 @@ void ssl_service_cache_write(struct ssl_service_cache* svc_cache, const struct s memset(hash_key, 0, sizeof(hash_key)); temp_key_sz = ssl_svc_client_st_mk_key(chello, addr, temp_key, sizeof(temp_key)); hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key; - TFE_LOG_DEBUG(g_default_logger, "ssl svc write client table, hash:%s", hash_key); + TFE_LOG_DEBUG(g_default_logger, "ssl svc write client table, hash:%s, sni:%s", hash_key, chello->sni); MESA_htable_search_cb(svc_cache->cli_st_hash, hash_key, (unsigned int) hash_key_sz, cli_st_write_cb, &write_args, &cli_st_cb_ret); } if(status->is_ct||status->is_ev) @@ -383,7 +383,7 @@ void ssl_service_cache_write(struct ssl_service_cache* svc_cache, const struct s memset(hash_key, 0, sizeof(hash_key)); temp_key_sz = ssl_svc_server_st_mk_key(chello, addr, temp_key, sizeof(temp_key)); hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key; - TFE_LOG_DEBUG(g_default_logger, "ssl svc write server table, hash:%s", hash_key); + TFE_LOG_DEBUG(g_default_logger, "ssl svc write server table, hash:%s, sni:%s", hash_key, chello->sni); MESA_htable_search_cb(svc_cache->srv_st_hash, hash_key, (unsigned int) hash_key_sz, srv_st_write_cb, &write_args, &svr_st_cb_ret); } if(status->is_app_not_pinning) @@ -391,7 +391,7 @@ void ssl_service_cache_write(struct ssl_service_cache* svc_cache, const struct s memset(hash_key, 0, sizeof(hash_key)); temp_key_sz = ssl_svc_app_st_mk_key(chello, addr, temp_key, sizeof(temp_key)); hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key; - TFE_LOG_DEBUG(g_default_logger, "ssl svc write app table, hash:%s", hash_key); + TFE_LOG_DEBUG(g_default_logger, "ssl svc write app table, hash:%s, sni:%s", hash_key, chello->sni); MESA_htable_search_cb(svc_cache->app_st_hash, hash_key, (unsigned int) hash_key_sz, app_st_write_cb, &write_args, &svr_st_cb_ret); } } @@ -423,16 +423,16 @@ struct ssl_service_cache* ssl_service_cache_create(unsigned int slot_size, unsig { unsigned int app_expire_seconds = 2 * expire_seconds; ret = MESA_htable_set_opt(htable, MHO_EXPIRE_TIME, &app_expire_seconds, sizeof(app_expire_seconds)); - opt_val = HASH_ELIMINATE_ALGO_LRU; - ret = MESA_htable_set_opt(htable, MHO_ELIMIMINATE_TYPE, &opt_val, sizeof(int)); } // for client table and server table else { ret = MESA_htable_set_opt(htable, MHO_EXPIRE_TIME, &expire_seconds, sizeof(expire_seconds)); - opt_val = HASH_ELIMINATE_ALGO_FIFO; - ret = MESA_htable_set_opt(htable, MHO_ELIMIMINATE_TYPE, &opt_val, sizeof(int)); } + + opt_val = HASH_ELIMINATE_ALGO_FIFO; + ret = MESA_htable_set_opt(htable, MHO_ELIMIMINATE_TYPE, &opt_val, sizeof(int)); + ret = MESA_htable_set_opt(htable, MHO_CBFUN_DATA_FREE, (void*)free_func[i], sizeof(free_func[i])); From 3f2c1cd9697301890ad666e1866ac4d8c5d08da9 Mon Sep 17 00:00:00 2001 From: luwenpeng Date: Tue, 3 Sep 2019 11:05:50 +0800 Subject: [PATCH 14/18] =?UTF-8?q?=E9=87=8D=E7=BD=AE=20app=5Fst=20=E7=9A=84?= =?UTF-8?q?=E6=B7=98=E6=B1=B0=E7=AD=96=E7=95=A5=E4=B8=BA=20lru?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- platform/src/ssl_service_cache.cpp | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/platform/src/ssl_service_cache.cpp b/platform/src/ssl_service_cache.cpp index e1d5667..b6e5a66 100644 --- a/platform/src/ssl_service_cache.cpp +++ b/platform/src/ssl_service_cache.cpp @@ -423,16 +423,17 @@ struct ssl_service_cache* ssl_service_cache_create(unsigned int slot_size, unsig { unsigned int app_expire_seconds = 2 * expire_seconds; ret = MESA_htable_set_opt(htable, MHO_EXPIRE_TIME, &app_expire_seconds, sizeof(app_expire_seconds)); + opt_val = HASH_ELIMINATE_ALGO_LRU; + ret = MESA_htable_set_opt(htable, MHO_ELIMIMINATE_TYPE, &opt_val, sizeof(int)); } // for client table and server table else { ret = MESA_htable_set_opt(htable, MHO_EXPIRE_TIME, &expire_seconds, sizeof(expire_seconds)); + opt_val = HASH_ELIMINATE_ALGO_FIFO; + ret = MESA_htable_set_opt(htable, MHO_ELIMIMINATE_TYPE, &opt_val, sizeof(int)); } - opt_val = HASH_ELIMINATE_ALGO_FIFO; - ret = MESA_htable_set_opt(htable, MHO_ELIMIMINATE_TYPE, &opt_val, sizeof(int)); - ret = MESA_htable_set_opt(htable, MHO_CBFUN_DATA_FREE, (void*)free_func[i], sizeof(free_func[i])); From f92b7098da98a916e9ebbebd4bca965778e17315 Mon Sep 17 00:00:00 2001 From: luwenpeng Date: Tue, 3 Sep 2019 11:07:09 +0800 Subject: [PATCH 15/18] =?UTF-8?q?=E4=BF=AE=E6=94=B9=20is=5Fapp=5Fnot=5Fpin?= =?UTF-8?q?ning=20=E7=9A=84=E5=88=A4=E5=AE=9A=E6=9D=A1=E4=BB=B6=EF=BC=9A?= =?UTF-8?q?=E5=8E=9F=E6=9D=A5=E5=9C=A8=20client=20connected=20=E4=B9=8B?= =?UTF-8?q?=E5=90=8E=E5=88=A4=E5=AE=9A=EF=BC=8C=E7=8E=B0=E5=9C=A8=E5=9C=A8?= =?UTF-8?q?=20ssl=20stream=20free=20=E4=B9=8B=E5=89=8D=E5=88=A4=E5=AE=9A?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- platform/src/ssl_stream.cpp | 24 ++++++++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-) diff --git a/platform/src/ssl_stream.cpp b/platform/src/ssl_stream.cpp index c600614..b9601c5 100644 --- a/platform/src/ssl_stream.cpp +++ b/platform/src/ssl_stream.cpp @@ -1871,10 +1871,10 @@ static void ssl_client_connected_eventcb(struct bufferevent * bev, short events, } s_stream->negotiated_version=SSL_version(s_stream->ssl); ssl_stream_set_cmsg_string(s_stream, TFE_CMSG_SSL_CLIENT_SIDE_VERSION, SSL_get_version(s_stream->ssl)); - struct ssl_service_status svc_status; - memset(&svc_status, 0, sizeof(svc_status)); - svc_status.is_app_not_pinning=1; - ssl_service_cache_write(mgr->svc_cache, s_upstream->client_hello, s_stream->tcp_stream->addr, &svc_status); + // struct ssl_service_status svc_status; + // memset(&svc_status, 0, sizeof(svc_status)); + // svc_status.is_app_not_pinning=1; + // ssl_service_cache_write(mgr->svc_cache, s_upstream->client_hello, s_stream->tcp_stream->addr, &svc_status); promise_success(p, ctx); } @@ -2110,6 +2110,17 @@ void ssl_stream_free_and_close_fd(struct ssl_stream * s_stream, struct event_bas fd=bufferevent_getfd(bev); assert(fd==s_stream->_do_not_use.fd); unsigned long sslerr=0; + + size_t rx_offset_this_time = 0; + int ret = tfe_stream_info_get(s_stream->tcp_stream, INFO_FROM_DOWNSTREAM_RX_OFFSET, &rx_offset_this_time, sizeof(rx_offset_this_time)); + if (ret >= 0 && rx_offset_this_time > 0) + { + struct ssl_service_status svc_status; + memset(&svc_status, 0, sizeof(svc_status)); + svc_status.is_app_not_pinning=1; + ssl_service_cache_write(s_stream->mgr->svc_cache, s_stream->up_parts.client_hello, s_stream->tcp_stream->addr, &svc_status); + } + if(errno) { sslerr=ssl_stream_log_error(bev, s_stream->dir, s_stream->mgr); @@ -2198,6 +2209,7 @@ int ssl_stream_set_integer_opt(struct ssl_stream *upstream, enum SSL_STREAM_OPT } int ssl_stream_get_integer_opt(struct ssl_stream *upstream, enum SSL_STREAM_OPT opt_type, int *opt_val) { + const char * sni = (upstream->up_parts.client_hello->sni) ? (upstream->up_parts.client_hello->sni) : "null"; struct ssl_service_status* svc=&upstream->up_parts.svc_status; struct ssl_mgr* mgr=upstream->mgr; struct tfe_cmsg *cmsg=NULL; @@ -2217,10 +2229,14 @@ int ssl_stream_get_integer_opt(struct ssl_stream *upstream, enum SSL_STREAM_OPT case SSL_STREAM_OPT_PINNING_STATUS: if(mgr->root_cert_not_installed_is_not_pinning && svc->is_app_not_pinning) { + TFE_LOG_DEBUG(g_default_logger, "ssl svc client root_cert_not_installed_is_not_pinning:%d, is_app_not_pinning:%d, cli_pinning_status:%d, mod pinning:%d, sni:%s", + mgr->root_cert_not_installed_is_not_pinning, svc->is_app_not_pinning, svc->cli_pinning_status, PINNING_ST_NOT_PINNING, sni); *opt_val=PINNING_ST_NOT_PINNING; } else { + TFE_LOG_DEBUG(g_default_logger, "ssl svc client root_cert_not_installed_is_not_pinning:%d, is_app_not_pinning:%d, cli_pinning_status:%d, set pinning:%d, sni:%s", + mgr->root_cert_not_installed_is_not_pinning, svc->is_app_not_pinning, svc->cli_pinning_status, svc->cli_pinning_status, sni); *opt_val=svc->cli_pinning_status; } break; From 8a2a866688ce29c81b38091668acf2e8e9edddb4 Mon Sep 17 00:00:00 2001 From: luwenpeng Date: Tue, 3 Sep 2019 19:00:54 +0800 Subject: [PATCH 16/18] =?UTF-8?q?=E4=BF=AE=E6=94=B9=20is=5Fapp=5Fnot=5Fpin?= =?UTF-8?q?ning=20=E7=9A=84=E5=88=A4=E5=AE=9A=E6=9D=A1=E4=BB=B6=EF=BC=9A?= =?UTF-8?q?=E5=9C=A8=20ssl=20up=20stream=20free=20=E4=B9=8B=E5=89=8D?= =?UTF-8?q?=E5=88=A4=E5=AE=9A?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- platform/src/ssl_stream.cpp | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/platform/src/ssl_stream.cpp b/platform/src/ssl_stream.cpp index b9601c5..80bd88c 100644 --- a/platform/src/ssl_stream.cpp +++ b/platform/src/ssl_stream.cpp @@ -1840,7 +1840,7 @@ static void ssl_client_connected_eventcb(struct bufferevent * bev, short events, } else if(events & BEV_EVENT_EOF) { - ATOMIC_INC(&(mgr->stat_val[SSL_DOWN_ERR])); + ATOMIC_INC(&(mgr->stat_val[SSL_DOWN_ERR])); ssl_stream_process_zero_eof(s_stream, mgr); } else if(events & BEV_EVENT_TIMEOUT) @@ -2111,14 +2111,19 @@ void ssl_stream_free_and_close_fd(struct ssl_stream * s_stream, struct event_bas assert(fd==s_stream->_do_not_use.fd); unsigned long sslerr=0; - size_t rx_offset_this_time = 0; - int ret = tfe_stream_info_get(s_stream->tcp_stream, INFO_FROM_DOWNSTREAM_RX_OFFSET, &rx_offset_this_time, sizeof(rx_offset_this_time)); - if (ret >= 0 && rx_offset_this_time > 0) + if (s_stream->dir == CONN_DIR_UPSTREAM) { - struct ssl_service_status svc_status; - memset(&svc_status, 0, sizeof(svc_status)); - svc_status.is_app_not_pinning=1; - ssl_service_cache_write(s_stream->mgr->svc_cache, s_stream->up_parts.client_hello, s_stream->tcp_stream->addr, &svc_status); + size_t rx_offset_this_time = 0; + int ret = tfe_stream_info_get(s_stream->tcp_stream, INFO_FROM_UPSTREAM_RX_OFFSET, &rx_offset_this_time, sizeof(rx_offset_this_time)); + if (ret >= 0 && rx_offset_this_time > 100) + { + struct ssl_service_status svc_status; + memset(&svc_status, 0, sizeof(svc_status)); + svc_status.is_app_not_pinning = 1; + ssl_service_cache_write(s_stream->mgr->svc_cache, s_stream->up_parts.client_hello, s_stream->tcp_stream->addr, &svc_status); + } + const char * sni = (s_stream->up_parts.client_hello && s_stream->up_parts.client_hello->sni) ? s_stream->up_parts.client_hello->sni : "null"; + TFE_LOG_DEBUG(g_default_logger, "ssl up stream close, rx_offset:%d, sni:%s", rx_offset_this_time, sni); } if(errno) From 32ae3e678d334a89d1b5b8a000e53877da59d052 Mon Sep 17 00:00:00 2001 From: luwenpeng Date: Wed, 4 Sep 2019 10:16:05 +0800 Subject: [PATCH 17/18] =?UTF-8?q?root=5Fcert=5Fnot=5Finstalled=5Fis=5Fnot?= =?UTF-8?q?=5Fpinning=20=E9=BB=98=E8=AE=A4=E5=BC=80=E5=90=AF=20service=5Fc?= =?UTF-8?q?ache=5Fsucc=5Fas=5Fapp=5Fnot=5Fpinning=5Fcnt=20=E9=BB=98?= =?UTF-8?q?=E8=AE=A4=E8=AE=BE=E7=BD=AE=E4=B8=BA=201?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- platform/src/ssl_stream.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/platform/src/ssl_stream.cpp b/platform/src/ssl_stream.cpp index 80bd88c..387a562 100644 --- a/platform/src/ssl_stream.cpp +++ b/platform/src/ssl_stream.cpp @@ -686,7 +686,7 @@ struct ssl_mgr * ssl_manager_init(const char * ini_profile, const char * section mgr->down_stek_box = sess_ticket_box_create(ev_base_gc, stek_group_num, stek_rotation_time, logger); } MESA_load_profile_uint_def(ini_profile, section, "root_cert_not_installed_is_not_pinning", - &(mgr->root_cert_not_installed_is_not_pinning), 0); + &(mgr->root_cert_not_installed_is_not_pinning), 1); MESA_load_profile_uint_def(ini_profile, section, "service_cache_slots", &(mgr->svc_cache_slots), 4 * 1024 * 1024); MESA_load_profile_uint_def(ini_profile, section, "service_cache_expire_seconds", @@ -696,7 +696,7 @@ struct ssl_mgr * ssl_manager_init(const char * ini_profile, const char * section MESA_load_profile_uint_def(ini_profile, section, "service_cache_fail_as_proto_err_cnt", &(mgr->svc_fail_as_proto_err_cnt), 5); MESA_load_profile_uint_def(ini_profile, section, "service_cache_succ_as_app_not_pinning_cnt", - &(mgr->svc_succ_as_app_not_pinning_cnt), 3); + &(mgr->svc_succ_as_app_not_pinning_cnt), 1); MESA_load_profile_uint_def(ini_profile, section, "service_cache_fail_time_window", &(mgr->svc_cnt_time_window), 30); From f41c68e8a8362920f54cb0117efc384906c98fce Mon Sep 17 00:00:00 2001 From: luwenpeng Date: Wed, 4 Sep 2019 13:44:09 +0800 Subject: [PATCH 18/18] =?UTF-8?q?service=5Fcache=5Fsucc=5Fas=5Fapp=5Fnot?= =?UTF-8?q?=5Fpinning=5Fcnt=20=E9=BB=98=E8=AE=A4=E8=AE=BE=E7=BD=AE?= =?UTF-8?q?=E4=B8=BA=200?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- platform/src/ssl_stream.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/platform/src/ssl_stream.cpp b/platform/src/ssl_stream.cpp index 387a562..e1e49d5 100644 --- a/platform/src/ssl_stream.cpp +++ b/platform/src/ssl_stream.cpp @@ -696,7 +696,7 @@ struct ssl_mgr * ssl_manager_init(const char * ini_profile, const char * section MESA_load_profile_uint_def(ini_profile, section, "service_cache_fail_as_proto_err_cnt", &(mgr->svc_fail_as_proto_err_cnt), 5); MESA_load_profile_uint_def(ini_profile, section, "service_cache_succ_as_app_not_pinning_cnt", - &(mgr->svc_succ_as_app_not_pinning_cnt), 1); + &(mgr->svc_succ_as_app_not_pinning_cnt), 0); MESA_load_profile_uint_def(ini_profile, section, "service_cache_fail_time_window", &(mgr->svc_cnt_time_window), 30);