gfwleak/tango-tfe
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'feature-root-cert-not-installed-is-not-pinning' into develop-tfe4a

Browse Source 
增加 not install root cert not pinning 功能
当开启 dynamic bypass pinning 时，未安装根证书的客户端会被 bypass
This commit is contained in:
luwenpeng
2019-09-04 13:46:51 +08:00
parent 1e3241899b f41c68e8a8
commit cd67f0edb7
4 changed files with 229 additions and 61 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
conf/tfe/tfe.conf
View File

@@ -21,6 +21,7 @@ key_log_file=log/sslkeylog.log
no_alpn=0
stek_group_num=4
stek_rotation_time=3600
service_cache_succ_as_app_not_pinning_cnt=3
[key_keeper]
#Mode: debug - generate cert with ca_path, normal - generate cert with cert store

6
platform/include/internal/ssl_service_cache.h
View File

@@ -9,7 +9,8 @@
#define PINNING_ST_MAYBE_PINNING 2
struct ssl_service_status
{
char pinning_status;
char cli_pinning_status;
char is_app_not_pinning;
char is_ev;
char is_ct;
char is_mutual_auth;
@@ -17,7 +18,7 @@ struct ssl_service_status
};
struct ssl_service_cache;
struct ssl_service_cache* ssl_service_cache_create(unsigned int slot_size, unsigned int expire_seconds, int fail_as_pinning_cnt, int fail_as_proto_err_cnt, int fail_time_win);
struct ssl_service_cache* ssl_service_cache_create(unsigned int slot_size, unsigned int expire_seconds, int fail_as_pinning_cnt, int fail_as_proto_err_cnt, int succ_as_app_not_pinning_cnt, int fail_time_win);
void ssl_service_cache_destroy(struct ssl_service_cache* cache);
int ssl_service_cache_read(struct ssl_service_cache* svc_cache, const struct ssl_chello* chello, const struct tfe_stream_addr * addr, struct ssl_service_status* result);
@@ -29,5 +30,6 @@ struct ssl_service_cache_statistics
long long proto_err_cli_cnt;
long long ev_srv_cnt;
long long ct_srv_cnt;
long long app_not_pinning_cnt;
};
void ssl_service_cache_stat(struct ssl_service_cache* svc_cache, struct ssl_service_cache_statistics* result);

223
platform/src/ssl_service_cache.cpp
View File

@@ -4,9 +4,6 @@
#include <stdlib.h>
#include <string.h>
#define FAIL_AS_PINNING_COUNT 4
#define FAIL_TIME_WINDOW 30
#define FAIL_AS_PROTO_ERR_COUNT 5
struct ssl_svc_client_st
{
time_t last_update_time;
@@ -23,14 +20,22 @@ struct ssl_svc_server_st
long long ct_st_switched;
struct ssl_service_cache* ref_svc_cache;
};
struct ssl_svc_app_st
{
unsigned int down_ssl_success_cnt;
struct ssl_service_cache* ref_svc_cache;
};
struct ssl_service_cache
{
MESA_htable_handle cli_st_hash;
MESA_htable_handle srv_st_hash;
MESA_htable_handle app_st_hash;
struct ssl_service_cache_statistics stat;
unsigned int fail_as_pinning_count;
unsigned int fail_as_cli_pinning_count;
unsigned int fail_as_proto_err_count;
unsigned int fail_time_window;
unsigned int succ_as_app_not_pinning_count;
};
struct ssl_service_write_args
{
@@ -45,10 +50,16 @@ static void ssl_svc_free_client_st(void * data)
{
svc_cache->stat.mutual_auth_cli_cnt--;
}
if(p->suspect_pinning_count>=FAIL_AS_PINNING_COUNT)
if(p->suspect_pinning_count>=svc_cache->fail_as_cli_pinning_count)
{
svc_cache->stat.pinning_cli_cnt--;
}
if (p->protocol_error_count >= svc_cache->fail_as_proto_err_count)
{
svc_cache->stat.proto_err_cli_cnt--;
}
free(p);
return;
}
@@ -67,7 +78,17 @@ static void ssl_svc_free_server_st(void * data)
free(p);
return;
}
static size_t ssl_svc_server_st_mk_key(const struct ssl_chello* chello, const struct tfe_stream_addr * addr, char* key_buff, size_t sz)
static void ssl_svc_free_app_st(void* data)
{
struct ssl_svc_app_st* p= (struct ssl_svc_app_st*)data;
struct ssl_service_cache* svc_cache=p->ref_svc_cache;
if(p->down_ssl_success_cnt>svc_cache->succ_as_app_not_pinning_count)
{
svc_cache->stat.app_not_pinning_cnt--;
}
free(p);
}
static size_t ssl_svc_server_st_mk_key(const struct ssl_chello* chello, const struct tfe_stream_addr * addr, char* key_buff, size_t sz)
{
size_t key_len=0;
const char* sip=NULL, *sport=NULL, *dip=NULL, *dport=NULL;
@@ -77,17 +98,17 @@ static size_t ssl_svc_server_st_mk_key(const struct ssl_chello* chello, const st
free(addr_str);
return key_len;
}
static size_t ssl_svc_client_st_mk_key(const struct ssl_chello* chello, const struct tfe_stream_addr * addr, char* key_buff, size_t sz)
static size_t ssl_svc_app_st_mk_key(const struct ssl_chello* chello, const struct tfe_stream_addr * addr, char* key_buff, size_t sz)
{
size_t key_len=0;
const char* sip=NULL, *sport=NULL, *dip=NULL, *dport=NULL;
char * addr_str= tfe_stream_addr_to_str(addr);
tfe_stream_addr_str_split(addr_str, &sip, &sport, &dip, &dport);
key_len=snprintf(key_buff, sz, "%s:%d:%d:%s:%s", sip,
chello->min_version.ossl_format,
chello->max_version.ossl_format,
chello->sni?chello->sni: dip ,
chello->alpn?chello->alpn:"null");
key_len=snprintf(key_buff, sz, "%d:%d:%s:%s", chello->min_version.ossl_format,
chello->max_version.ossl_format,
chello->sni?chello->sni: dip ,
chello->alpn?chello->alpn:"null");
if(chello->cipher_suites && sz-key_len>chello->cipher_suites_len)
{
memcpy(key_buff+key_len, chello->cipher_suites, chello->cipher_suites_len);
@@ -102,7 +123,24 @@ static size_t ssl_svc_client_st_mk_key(const struct ssl_chello* chello, const st
{
memcpy(key_buff+key_len, chello->supported_groups, chello->supported_groups_len);
key_len+=chello->supported_groups_len;
}
}
free(addr_str);
return key_len;
}
static size_t ssl_svc_client_st_mk_key(const struct ssl_chello* chello, const struct tfe_stream_addr * addr, char* key_buff, size_t sz)
{
size_t key_len=0;
const char* sip=NULL, *sport=NULL, *dip=NULL, *dport=NULL;
char * addr_str= tfe_stream_addr_to_str(addr);
tfe_stream_addr_str_split(addr_str, &sip, &sport, &dip, &dport);
char chello_id_buff[sz];
size_t chello_id_len=0;
key_len=snprintf(key_buff, sz, "%s:", sip);
chello_id_len=ssl_svc_app_st_mk_key(chello, addr, chello_id_buff, sizeof(chello_id_buff));
memcpy(key_buff+key_len, chello_id_buff, MIN(chello_id_len, sz-key_len));
key_len += MIN(chello_id_len, sz-key_len);
free(addr_str);
return key_len;
}
@@ -115,19 +153,20 @@ static long cli_st_read_cb(void * data, const uchar * key, uint size, void * use
{
return 0;
}
struct ssl_service_cache* svc_cache=cli_st->ref_svc_cache;
if(cli_st->suspect_pinning_count==0)
{
result->pinning_status=PINNING_ST_NOT_PINNING;
result->cli_pinning_status=PINNING_ST_NOT_PINNING;
}
else if(cli_st->suspect_pinning_count<FAIL_AS_PINNING_COUNT)
else if(cli_st->suspect_pinning_count<svc_cache->fail_as_cli_pinning_count)
{
result->pinning_status=PINNING_ST_MAYBE_PINNING;
result->cli_pinning_status=PINNING_ST_MAYBE_PINNING;
}
else
{
result->pinning_status=PINNING_ST_PINNING;
result->cli_pinning_status=PINNING_ST_PINNING;
}
if(cli_st->protocol_error_count>=FAIL_AS_PROTO_ERR_COUNT)
if(cli_st->protocol_error_count>=svc_cache->fail_as_proto_err_count)
{
result->has_protocol_errors=1;
}
@@ -152,27 +191,27 @@ static long cli_st_write_cb(void * data, const uchar * key, uint size, void * us
}
if (now - cli_st->last_update_time > cache->fail_time_window)
{
if(cli_st->suspect_pinning_count<cache->fail_as_pinning_count) cli_st->suspect_pinning_count=0;
if(cli_st->suspect_pinning_count<cache->fail_as_cli_pinning_count) cli_st->suspect_pinning_count=0;
if(cli_st->protocol_error_count<cache->fail_as_proto_err_count) cli_st->protocol_error_count=0;
}
if(status->pinning_status!=PINNING_ST_NOT_PINNING && cli_st->suspect_pinning_count<cache->fail_as_pinning_count)
if(status->cli_pinning_status!=PINNING_ST_NOT_PINNING && cli_st->suspect_pinning_count<cache->fail_as_cli_pinning_count)
{
if(status->pinning_status==PINNING_ST_PINNING)
if(status->cli_pinning_status==PINNING_ST_PINNING)
{
cli_st->suspect_pinning_count=cache->fail_as_pinning_count;
cli_st->suspect_pinning_count=cache->fail_as_cli_pinning_count;
}
else
{
cli_st->suspect_pinning_count++;
}
if(cli_st->suspect_pinning_count==cache->fail_as_pinning_count)
if(cli_st->suspect_pinning_count==cache->fail_as_cli_pinning_count)
{
cache->stat.pinning_cli_cnt++;
}
}
else if(status->pinning_status==PINNING_ST_PINNING)
else if(status->cli_pinning_status==PINNING_ST_PINNING)
{
cli_st->suspect_pinning_count=cache->fail_as_pinning_count;
cli_st->suspect_pinning_count=cache->fail_as_cli_pinning_count;
}
if(status->has_protocol_errors)
{
@@ -238,21 +277,77 @@ static long srv_st_write_cb(void * data, const uchar * key, uint size, void * us
// assert(srv_st->ev_st_switched<2&&srv_st->ct_st_switched<2);
return 1;
}
static long app_st_read_cb(void * data, const uchar * key, uint size, void * user_arg)
{
struct ssl_svc_app_st* app_st=(struct ssl_svc_app_st*)data;
struct ssl_service_status* result=(struct ssl_service_status*)user_arg;
if (app_st == NULL)
{
return 0;
}
if(app_st->down_ssl_success_cnt>app_st->ref_svc_cache->succ_as_app_not_pinning_count)
{
result->is_app_not_pinning=1;
}
return 1;
}
static long app_st_write_cb(void * data, const uchar * key, uint size, void * user_arg)
{
struct ssl_svc_app_st* app_st=(struct ssl_svc_app_st*)data;
struct ssl_service_write_args* args=(struct ssl_service_write_args*)user_arg;
const struct ssl_service_status* status=args->status;
struct ssl_service_cache* cache=args->cache;
UNUSED int ret = 0;
if(app_st==NULL)
{
app_st=ALLOC(struct ssl_svc_app_st, 1);
app_st->ref_svc_cache=cache;
ret = MESA_htable_add(cache->app_st_hash, key, size, app_st);
assert(ret >= 0);
}
if(status->is_app_not_pinning)
{
app_st->down_ssl_success_cnt++;
}
if(app_st->down_ssl_success_cnt>cache->succ_as_app_not_pinning_count)
{
cache->stat.app_not_pinning_cnt++;
}
return 1;
}
int ssl_service_cache_read(struct ssl_service_cache* svc_cache, const struct ssl_chello* chello, const struct tfe_stream_addr * addr, struct ssl_service_status* result)
{
long cli_st_cb_ret=0, svr_st_cb_ret=0;
char hash_key[2048];
long cli_st_cb_ret=0, svr_st_cb_ret=0, app_st_cb_ret=0;
char temp_key[2048];
unsigned char hash_key[4096]; // Size must be twice the size of temp_key
size_t temp_key_sz=0;
size_t hash_key_sz=0;
if(chello->sni==NULL)
{
return 0;
}
hash_key_sz=ssl_svc_client_st_mk_key(chello, addr, hash_key, sizeof(hash_key));
MESA_htable_search_cb(svc_cache->cli_st_hash, (unsigned char*) hash_key, (unsigned int) hash_key_sz, cli_st_read_cb, result, &cli_st_cb_ret);
hash_key_sz=ssl_svc_server_st_mk_key(chello, addr, hash_key, sizeof(hash_key));
MESA_htable_search_cb(svc_cache->srv_st_hash, (unsigned char*) hash_key, (unsigned int) hash_key_sz, srv_st_read_cb, result, &svr_st_cb_ret);
if(cli_st_cb_ret||svr_st_cb_ret)
memset(hash_key, 0, sizeof(hash_key));
temp_key_sz = ssl_svc_client_st_mk_key(chello, addr, temp_key, sizeof(temp_key));
hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
MESA_htable_search_cb(svc_cache->cli_st_hash, hash_key, (unsigned int) hash_key_sz, cli_st_read_cb, result, &cli_st_cb_ret);
TFE_LOG_DEBUG(g_default_logger, "ssl svc read client table, hash:%s, found:%d, sni:%s", hash_key, cli_st_cb_ret, chello->sni);
memset(hash_key, 0, sizeof(hash_key));
temp_key_sz = ssl_svc_server_st_mk_key(chello, addr, temp_key, sizeof(temp_key));
hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
MESA_htable_search_cb(svc_cache->srv_st_hash, hash_key, (unsigned int) hash_key_sz, srv_st_read_cb, result, &svr_st_cb_ret);
TFE_LOG_DEBUG(g_default_logger, "ssl svc read server table, hash:%s, found:%d, sni:%s", hash_key, svr_st_cb_ret, chello->sni);
memset(hash_key, 0, sizeof(hash_key));
temp_key_sz = ssl_svc_app_st_mk_key(chello, addr, temp_key, sizeof(temp_key));
hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
MESA_htable_search_cb(svc_cache->app_st_hash, hash_key, (unsigned int) hash_key_sz, app_st_read_cb, result, &app_st_cb_ret);
TFE_LOG_DEBUG(g_default_logger, "ssl svc read app table, hash:%s, found:%d, sni:%s", hash_key, app_st_cb_ret, chello->sni);
if(cli_st_cb_ret||svr_st_cb_ret||app_st_cb_ret)
{
return 1;
}
@@ -265,7 +360,9 @@ int ssl_service_cache_read(struct ssl_service_cache* svc_cache, const struct ssl
void ssl_service_cache_write(struct ssl_service_cache* svc_cache, const struct ssl_chello* chello, const struct tfe_stream_addr * addr, const struct ssl_service_status* status)
{
long cli_st_cb_ret=0, svr_st_cb_ret=0;
char hash_key[2048];
char temp_key[2048];
unsigned char hash_key[4096]; // Size must be twice the size of temp_key
size_t temp_key_sz=0;
size_t hash_key_sz=0;
if(chello == NULL || chello->sni==NULL)
@@ -273,29 +370,44 @@ void ssl_service_cache_write(struct ssl_service_cache* svc_cache, const struct s
return;
}
struct ssl_service_write_args write_args={svc_cache, status};
if(status->is_mutual_auth||status->pinning_status!=PINNING_ST_NOT_PINNING||status->has_protocol_errors)
if(status->is_mutual_auth||status->cli_pinning_status!=PINNING_ST_NOT_PINNING||status->has_protocol_errors)
{
hash_key_sz=ssl_svc_client_st_mk_key(chello, addr, hash_key, sizeof(hash_key));
MESA_htable_search_cb(svc_cache->cli_st_hash, (unsigned char*)hash_key, (unsigned int) hash_key_sz, cli_st_write_cb, &write_args, &cli_st_cb_ret);
memset(hash_key, 0, sizeof(hash_key));
temp_key_sz = ssl_svc_client_st_mk_key(chello, addr, temp_key, sizeof(temp_key));
hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
TFE_LOG_DEBUG(g_default_logger, "ssl svc write client table, hash:%s, sni:%s", hash_key, chello->sni);
MESA_htable_search_cb(svc_cache->cli_st_hash, hash_key, (unsigned int) hash_key_sz, cli_st_write_cb, &write_args, &cli_st_cb_ret);
}
if(status->is_ct||status->is_ev)
{
hash_key_sz=ssl_svc_server_st_mk_key(chello, addr, hash_key, sizeof(hash_key));
MESA_htable_search_cb(svc_cache->srv_st_hash, (unsigned char*)hash_key, (unsigned int) hash_key_sz, srv_st_write_cb, &write_args, &svr_st_cb_ret);
memset(hash_key, 0, sizeof(hash_key));
temp_key_sz = ssl_svc_server_st_mk_key(chello, addr, temp_key, sizeof(temp_key));
hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
TFE_LOG_DEBUG(g_default_logger, "ssl svc write server table, hash:%s, sni:%s", hash_key, chello->sni);
MESA_htable_search_cb(svc_cache->srv_st_hash, hash_key, (unsigned int) hash_key_sz, srv_st_write_cb, &write_args, &svr_st_cb_ret);
}
if(status->is_app_not_pinning)
{
memset(hash_key, 0, sizeof(hash_key));
temp_key_sz = ssl_svc_app_st_mk_key(chello, addr, temp_key, sizeof(temp_key));
hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
TFE_LOG_DEBUG(g_default_logger, "ssl svc write app table, hash:%s, sni:%s", hash_key, chello->sni);
MESA_htable_search_cb(svc_cache->app_st_hash, hash_key, (unsigned int) hash_key_sz, app_st_write_cb, &write_args, &svr_st_cb_ret);
}
}
struct ssl_service_cache* ssl_service_cache_create(unsigned int slot_size, unsigned int expire_seconds, int fail_as_pinning_cnt, int fail_as_proto_err_cnt, int fail_time_win)
struct ssl_service_cache* ssl_service_cache_create(unsigned int slot_size, unsigned int expire_seconds, int fail_as_pinning_cnt, int fail_as_proto_err_cnt, int succ_as_app_not_pinning_cnt, int fail_time_win)
{
struct ssl_service_cache * cache = ALLOC(struct ssl_service_cache, 1);
unsigned max_num = slot_size * 4;
UNUSED int ret = 0;
MESA_htable_handle htable=NULL, saved[2];
MESA_htable_handle htable=NULL, saved[3];
int i=0, opt_val=0;
cache->fail_as_pinning_count=fail_as_pinning_cnt;
cache->fail_as_cli_pinning_count=fail_as_pinning_cnt;
cache->fail_as_proto_err_count=fail_as_proto_err_cnt;
cache->fail_time_window=fail_time_win;
void (*free_func[])(void *)={ssl_svc_free_client_st, ssl_svc_free_server_st};
for(i=0; i<2; i++)
cache->succ_as_app_not_pinning_count = succ_as_app_not_pinning_cnt;
void (*free_func[])(void *)={ssl_svc_free_client_st, ssl_svc_free_server_st, ssl_svc_free_app_st};
for(i=0; i<3; i++)
{
htable = MESA_htable_born();
opt_val=0;
@@ -306,11 +418,22 @@ struct ssl_service_cache* ssl_service_cache_create(unsigned int slot_size, unsig
ret = MESA_htable_set_opt(htable, MHO_MUTEX_NUM, &opt_val, sizeof(opt_val));
ret = MESA_htable_set_opt(htable, MHO_HASH_SLOT_SIZE, &slot_size, sizeof(slot_size));
ret = MESA_htable_set_opt(htable, MHO_HASH_MAX_ELEMENT_NUM, &max_num, sizeof(max_num));
ret = MESA_htable_set_opt(htable, MHO_EXPIRE_TIME, &expire_seconds, sizeof(expire_seconds));
opt_val=HASH_ELIMINATE_ALGO_FIFO;
ret = MESA_htable_set_opt(htable, MHO_ELIMIMINATE_TYPE,
&opt_val, sizeof(int));
// for app table
if (i == 2)
{
unsigned int app_expire_seconds = 2 * expire_seconds;
ret = MESA_htable_set_opt(htable, MHO_EXPIRE_TIME, &app_expire_seconds, sizeof(app_expire_seconds));
opt_val = HASH_ELIMINATE_ALGO_LRU;
ret = MESA_htable_set_opt(htable, MHO_ELIMIMINATE_TYPE, &opt_val, sizeof(int));
}
// for client table and server table
else
{
ret = MESA_htable_set_opt(htable, MHO_EXPIRE_TIME, &expire_seconds, sizeof(expire_seconds));
opt_val = HASH_ELIMINATE_ALGO_FIFO;
ret = MESA_htable_set_opt(htable, MHO_ELIMIMINATE_TYPE, &opt_val, sizeof(int));
}
ret = MESA_htable_set_opt(htable, MHO_CBFUN_DATA_FREE,
(void*)free_func[i], sizeof(free_func[i]));
@@ -320,7 +443,7 @@ struct ssl_service_cache* ssl_service_cache_create(unsigned int slot_size, unsig
}
cache->cli_st_hash=saved[0];
cache->srv_st_hash=saved[1];
cache->app_st_hash=saved[2];
return cache;
}
void ssl_service_cache_destroy(struct ssl_service_cache* cache)
@@ -329,6 +452,8 @@ void ssl_service_cache_destroy(struct ssl_service_cache* cache)
cache->cli_st_hash=NULL;
MESA_htable_destroy(cache->srv_st_hash, NULL);
cache->srv_st_hash=NULL;
MESA_htable_destroy(cache->app_st_hash, NULL);
cache->app_st_hash=NULL;
free(cache);
return;
}

60
platform/src/ssl_stream.cpp
View File

@@ -104,7 +104,7 @@ enum ssl_stream_stat
SSL_SVC_MAUTH,
SSL_SVC_CT_CERT,
SSL_SVC_EV_CERT,
SSL_SVC_APP_NOT_PINNING,
SSL_STAT_MAX
};
@@ -121,6 +121,7 @@ struct ssl_mgr
unsigned int no_alpn;
unsigned int no_cert_verify;
unsigned int no_mirror_client_cipher_suite;
unsigned int root_cert_not_installed_is_not_pinning;
CONST_SSL_METHOD * (* sslmethod)(void); //Parameter of SSL_CTX_new
int ssl_min_version, ssl_max_version;
@@ -133,6 +134,7 @@ struct ssl_mgr
unsigned int svc_expire_seconds;
unsigned int svc_fail_as_pinning_cnt;
unsigned int svc_fail_as_proto_err_cnt;
unsigned int svc_succ_as_app_not_pinning_cnt;
unsigned int svc_cnt_time_window;
struct sess_cache * down_sess_cache;
@@ -358,7 +360,7 @@ ssl_stream_gc_cb(evutil_socket_t fd, short what, void * arg)
mgr->stat_val[SSL_SVC_MAUTH]=svc_stat.mutual_auth_cli_cnt;
mgr->stat_val[SSL_SVC_CT_CERT]=svc_stat.ct_srv_cnt;
mgr->stat_val[SSL_SVC_EV_CERT]=svc_stat.ev_srv_cnt;
mgr->stat_val[SSL_SVC_APP_NOT_PINNING]=svc_stat.app_not_pinning_cnt;
for(i=0;i<SSL_STAT_MAX;i++)
{
FS_operate(mgr->fs_handle, mgr->fs_id[i], 0, FS_OP_SET, ATOMIC_READ(&(mgr->stat_val[i])));
@@ -414,7 +416,8 @@ void ssl_stat_init(struct ssl_mgr * mgr)
spec[SSL_SVC_MAUTH]="ssl_mauth";
spec[SSL_SVC_CT_CERT]="ssl_ct_crt";
spec[SSL_SVC_EV_CERT]="ssl_ev_crt";
spec[SSL_SVC_APP_NOT_PINNING]="app_no_pinning";
for(i=0;i<SSL_STAT_MAX;i++)
{
@@ -682,7 +685,8 @@ struct ssl_mgr * ssl_manager_init(const char * ini_profile, const char * section
{
mgr->down_stek_box = sess_ticket_box_create(ev_base_gc, stek_group_num, stek_rotation_time, logger);
}
MESA_load_profile_uint_def(ini_profile, section, "root_cert_not_installed_is_not_pinning",
&(mgr->root_cert_not_installed_is_not_pinning), 1);
MESA_load_profile_uint_def(ini_profile, section, "service_cache_slots",
&(mgr->svc_cache_slots), 4 * 1024 * 1024);
MESA_load_profile_uint_def(ini_profile, section, "service_cache_expire_seconds",
@@ -691,12 +695,15 @@ struct ssl_mgr * ssl_manager_init(const char * ini_profile, const char * section
&(mgr->svc_fail_as_pinning_cnt), 4);
MESA_load_profile_uint_def(ini_profile, section, "service_cache_fail_as_proto_err_cnt",
&(mgr->svc_fail_as_proto_err_cnt), 5);
MESA_load_profile_uint_def(ini_profile, section, "service_cache_succ_as_app_not_pinning_cnt",
&(mgr->svc_succ_as_app_not_pinning_cnt), 0);
MESA_load_profile_uint_def(ini_profile, section, "service_cache_fail_time_window",
&(mgr->svc_cnt_time_window), 30);
mgr->svc_cache=ssl_service_cache_create(mgr->svc_cache_slots, mgr->svc_expire_seconds,
mgr->svc_fail_as_pinning_cnt,
mgr->svc_fail_as_proto_err_cnt,
mgr->svc_succ_as_app_not_pinning_cnt,
mgr->svc_cnt_time_window);
mgr->key_keeper = key_keeper_init(ini_profile, "key_keeper", logger);
@@ -1185,7 +1192,7 @@ void ssl_stream_process_error(struct ssl_stream * s_stream, unsigned long sslerr
&& s_upstream->is_server_cert_verify_passed
&& s_upstream->verify_result.is_hostmatched)
{
s_upstream->svc_status.pinning_status=PINNING_ST_PINNING;
s_upstream->svc_status.cli_pinning_status=PINNING_ST_PINNING;
ssl_stream_set_cmsg_integer(s_stream, TFE_CMSG_SSL_PINNING_STATE, PINNING_ST_PINNING);
ssl_service_cache_write(mgr->svc_cache, s_upstream->client_hello, s_stream->tcp_stream->addr, &s_upstream->svc_status);
}
@@ -1217,7 +1224,7 @@ void ssl_stream_process_zero_eof(struct ssl_stream * s_stream, struct ssl_mgr* m
s_upstream=&s_stream->peer->up_parts;
if(s_upstream->verify_result.is_hostmatched && s_upstream->is_server_cert_verify_passed )
{
s_upstream->svc_status.pinning_status=PINNING_ST_MAYBE_PINNING;
s_upstream->svc_status.cli_pinning_status=PINNING_ST_MAYBE_PINNING;
ssl_stream_set_cmsg_integer(s_stream, TFE_CMSG_SSL_PINNING_STATE, PINNING_ST_MAYBE_PINNING);
ssl_service_cache_write(mgr->svc_cache, s_stream->peer->up_parts.client_hello, s_stream->tcp_stream->addr, &(s_stream->peer->up_parts.svc_status));
}
@@ -1389,7 +1396,7 @@ static void peek_chello_on_succ(future_result_t * result, void * user)
TFE_LOG_DEBUG(ctx->mgr->logger, "%s %s service status pinning:%d, mauth:%d, err:%d, ct:%d, ev:%d",
addr_string,
chello->sni,
svc_status->pinning_status,
svc_status->cli_pinning_status,
svc_status->is_mutual_auth,
svc_status->has_protocol_errors,
svc_status->is_ct,
@@ -1397,7 +1404,7 @@ static void peek_chello_on_succ(future_result_t * result, void * user)
free(addr_string);
addr_string=NULL;
}
ssl_stream_set_cmsg_integer(s_stream, TFE_CMSG_SSL_PINNING_STATE, svc_status->pinning_status);
ssl_stream_set_cmsg_integer(s_stream, TFE_CMSG_SSL_PINNING_STATE, svc_status->cli_pinning_status);
if(ctx->mgr->on_new_upstream_cb)
{
s_stream->up_parts.action=ctx->mgr->on_new_upstream_cb(s_stream, ctx->mgr->upstream_cb_param);
@@ -1851,7 +1858,7 @@ static void ssl_client_connected_eventcb(struct bufferevent * bev, short events,
}
else if(events & BEV_EVENT_EOF)
{
ATOMIC_INC(&(mgr->stat_val[SSL_DOWN_ERR]));
ATOMIC_INC(&(mgr->stat_val[SSL_DOWN_ERR]));
ssl_stream_process_zero_eof(s_stream, mgr);
}
else if(events & BEV_EVENT_TIMEOUT)
@@ -1882,6 +1889,10 @@ static void ssl_client_connected_eventcb(struct bufferevent * bev, short events,
}
s_stream->negotiated_version=SSL_version(s_stream->ssl);
ssl_stream_set_cmsg_string(s_stream, TFE_CMSG_SSL_CLIENT_SIDE_VERSION, SSL_get_version(s_stream->ssl));
// struct ssl_service_status svc_status;
// memset(&svc_status, 0, sizeof(svc_status));
// svc_status.is_app_not_pinning=1;
// ssl_service_cache_write(mgr->svc_cache, s_upstream->client_hello, s_stream->tcp_stream->addr, &svc_status);
promise_success(p, ctx);
}
@@ -2117,6 +2128,22 @@ void ssl_stream_free_and_close_fd(struct ssl_stream * s_stream, struct event_bas
fd=bufferevent_getfd(bev);
assert(fd==s_stream->_do_not_use.fd);
unsigned long sslerr=0;
if (s_stream->dir == CONN_DIR_UPSTREAM)
{
size_t rx_offset_this_time = 0;
int ret = tfe_stream_info_get(s_stream->tcp_stream, INFO_FROM_UPSTREAM_RX_OFFSET, &rx_offset_this_time, sizeof(rx_offset_this_time));
if (ret >= 0 && rx_offset_this_time > 100)
{
struct ssl_service_status svc_status;
memset(&svc_status, 0, sizeof(svc_status));
svc_status.is_app_not_pinning = 1;
ssl_service_cache_write(s_stream->mgr->svc_cache, s_stream->up_parts.client_hello, s_stream->tcp_stream->addr, &svc_status);
}
const char * sni = (s_stream->up_parts.client_hello && s_stream->up_parts.client_hello->sni) ? s_stream->up_parts.client_hello->sni : "null";
TFE_LOG_DEBUG(g_default_logger, "ssl up stream close, rx_offset:%d, sni:%s", rx_offset_this_time, sni);
}
if(errno)
{
sslerr=ssl_stream_log_error(bev, s_stream->dir, s_stream->mgr);
@@ -2205,7 +2232,9 @@ int ssl_stream_set_integer_opt(struct ssl_stream *upstream, enum SSL_STREAM_OPT
}
int ssl_stream_get_integer_opt(struct ssl_stream *upstream, enum SSL_STREAM_OPT opt_type, int *opt_val)
{
const char * sni = (upstream->up_parts.client_hello->sni) ? (upstream->up_parts.client_hello->sni) : "null";
struct ssl_service_status* svc=&upstream->up_parts.svc_status;
struct ssl_mgr* mgr=upstream->mgr;
struct tfe_cmsg *cmsg=NULL;
UNUSED int ret=0;
uint16_t out_size=0;
@@ -2221,7 +2250,18 @@ int ssl_stream_get_integer_opt(struct ssl_stream *upstream, enum SSL_STREAM_OPT
*opt_val=svc->is_mutual_auth;
break;
case SSL_STREAM_OPT_PINNING_STATUS:
*opt_val=svc->pinning_status;
if(mgr->root_cert_not_installed_is_not_pinning && svc->is_app_not_pinning)
{
TFE_LOG_DEBUG(g_default_logger, "ssl svc client root_cert_not_installed_is_not_pinning:%d, is_app_not_pinning:%d, cli_pinning_status:%d, mod pinning:%d, sni:%s",
mgr->root_cert_not_installed_is_not_pinning, svc->is_app_not_pinning, svc->cli_pinning_status, PINNING_ST_NOT_PINNING, sni);
*opt_val=PINNING_ST_NOT_PINNING;
}
else
{
TFE_LOG_DEBUG(g_default_logger, "ssl svc client root_cert_not_installed_is_not_pinning:%d, is_app_not_pinning:%d, cli_pinning_status:%d, set pinning:%d, sni:%s",
mgr->root_cert_not_installed_is_not_pinning, svc->is_app_not_pinning, svc->cli_pinning_status, svc->cli_pinning_status, sni);
*opt_val=svc->cli_pinning_status;
}
break;
case SSL_STREAM_OPT_HAS_PROTOCOL_ERRORS:
*opt_val=svc->has_protocol_errors;