From f18c5efdb173da7b8dbff72aa19b461d87970132 Mon Sep 17 00:00:00 2001 From: zhengchao Date: Mon, 10 Jun 2019 18:39:01 +0800 Subject: [PATCH] =?UTF-8?q?1=E3=80=81=E4=BD=BF=E7=94=A8=E6=9C=8D=E5=8A=A1?= =?UTF-8?q?=E5=99=A8IP+=E7=AB=AF=E5=8F=A3+sni=E7=94=9F=E6=88=90=E6=9C=8D?= =?UTF-8?q?=E5=8A=A1=E7=AB=AF=E7=8A=B6=E6=80=81=20#141=EF=BC=8C=E4=BD=BF?= =?UTF-8?q?=E7=94=A8=E5=AE=A2=E6=88=B7=E7=AB=AFIP+Client=20hello=E7=89=B9?= =?UTF-8?q?=E5=BE=81=E7=94=9F=E6=88=90=E5=AE=A2=E6=88=B7=E7=AB=AF=E7=8A=B6?= =?UTF-8?q?=E6=80=81=E3=80=822=E3=80=81pinning=20detection=E7=9A=84?= =?UTF-8?q?=E7=9B=B8=E5=85=B3=E9=98=88=E5=80=BC=E5=8F=AF=E4=BB=8Etfe.conf?= =?UTF-8?q?=E4=B8=AD=E9=85=8D=E7=BD=AE=E3=80=82?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- platform/include/internal/ssl_service_cache.h | 6 +- platform/src/ssl_service_cache.cpp | 72 ++++++++++++------- platform/src/ssl_stream.cpp | 29 +++++--- 3 files changed, 70 insertions(+), 37 deletions(-) diff --git a/platform/include/internal/ssl_service_cache.h b/platform/include/internal/ssl_service_cache.h index 938535e..be84dd3 100644 --- a/platform/include/internal/ssl_service_cache.h +++ b/platform/include/internal/ssl_service_cache.h @@ -17,11 +17,11 @@ struct ssl_service_status }; struct ssl_service_cache; -struct ssl_service_cache* ssl_service_cache_create(unsigned int slot_size, unsigned int expire_seconds); +struct ssl_service_cache* ssl_service_cache_create(unsigned int slot_size, unsigned int expire_seconds, int fail_as_pinning_cnt, int fail_as_proto_err_cnt, int fail_time_win); void ssl_service_cache_destroy(struct ssl_service_cache* cache); -int ssl_service_cache_read(struct ssl_service_cache* svc_cache, const struct ssl_chello* chello, struct ssl_service_status* result); -void ssl_service_cache_write(struct ssl_service_cache* svc_cache, const struct ssl_chello* chello, const struct ssl_service_status* status); +int ssl_service_cache_read(struct ssl_service_cache* svc_cache, const struct ssl_chello* chello, const struct tfe_stream_addr * addr, struct ssl_service_status* result); +void ssl_service_cache_write(struct ssl_service_cache* svc_cache, const struct ssl_chello* chello, const struct tfe_stream_addr * addr, const struct ssl_service_status* status); struct ssl_service_cache_statistics { long long pinning_cli_cnt; diff --git a/platform/src/ssl_service_cache.cpp b/platform/src/ssl_service_cache.cpp index 3937486..55e1aee 100644 --- a/platform/src/ssl_service_cache.cpp +++ b/platform/src/ssl_service_cache.cpp @@ -28,6 +28,9 @@ struct ssl_service_cache MESA_htable_handle cli_st_hash; MESA_htable_handle srv_st_hash; struct ssl_service_cache_statistics stat; + unsigned int fail_as_pinning_count; + unsigned int fail_as_proto_err_count; + unsigned int fail_time_window; }; struct ssl_service_write_args { @@ -64,11 +67,24 @@ static void ssl_svc_free_server_st(void * data) free(p); return; } - -static size_t ssl_svc_client_st_mk_key(const struct ssl_chello* chello, char* key_buff, size_t sz) +static size_t ssl_svc_server_st_mk_key(const struct ssl_chello* chello, const struct tfe_stream_addr * addr, char* key_buff, size_t sz) { size_t key_len=0; - key_len=snprintf(key_buff, sz, "%d:%d:%s:%s:", chello->min_version.ossl_format, + const char* sip=NULL, *sport=NULL, *dip=NULL, *dport=NULL; + char * addr_str= tfe_stream_addr_to_str(addr); + tfe_stream_addr_str_split(addr_str, &sip, &sport, &dip, &dport); + key_len=snprintf(key_buff, sz, "%s:%s:%s:", dip, dport, chello->sni); + free(addr_str); + return key_len; +} +static size_t ssl_svc_client_st_mk_key(const struct ssl_chello* chello, const struct tfe_stream_addr * addr, char* key_buff, size_t sz) +{ + size_t key_len=0; + const char* sip=NULL, *sport=NULL, *dip=NULL, *dport=NULL; + char * addr_str= tfe_stream_addr_to_str(addr); + tfe_stream_addr_str_split(addr_str, &sip, &sport, &dip, &dport); + key_len=snprintf(key_buff, sz, "%s:%d:%d:%s:%s:", sip, + chello->min_version.ossl_format, chello->max_version.ossl_format, chello->sni, chello->alpn?chello->alpn:"null"); if(chello->cipher_suites && sz-key_len>chello->cipher_suites_len) @@ -86,6 +102,7 @@ static size_t ssl_svc_client_st_mk_key(const struct ssl_chello* chello, char* ke memcpy(key_buff+key_len, chello->supported_groups, chello->supported_groups_len); key_len+=chello->supported_groups_len; } + free(addr_str); return key_len; } static long cli_st_read_cb(void * data, const uchar * key, uint size, void * user_arg) @@ -131,34 +148,34 @@ static long cli_st_write_cb(void * data, const uchar * key, uint size, void * us ret = MESA_htable_add(cache->cli_st_hash, key, size, cli_st); assert(ret >= 0); } - if(cli_st->last_update_time-now>FAIL_TIME_WINDOW) + if(cli_st->last_update_time-now>cache->fail_time_window) { - if(cli_st->suspect_pinning_countsuspect_pinning_count=0; - if(cli_st->protocol_error_countprotocol_error_count=0; + if(cli_st->suspect_pinning_countfail_as_pinning_count) cli_st->suspect_pinning_count=0; + if(cli_st->protocol_error_countfail_as_proto_err_count) cli_st->protocol_error_count=0; } - if(status->pinning_status!=PINNING_ST_NOT_PINNING && cli_st->suspect_pinning_countpinning_status!=PINNING_ST_NOT_PINNING && cli_st->suspect_pinning_countfail_as_pinning_count) { if(status->pinning_status==PINNING_ST_PINNING) { - cli_st->suspect_pinning_count=FAIL_AS_PINNING_COUNT; + cli_st->suspect_pinning_count=cache->fail_as_pinning_count; } else { cli_st->suspect_pinning_count++; } - if(cli_st->suspect_pinning_count==FAIL_AS_PINNING_COUNT) + if(cli_st->suspect_pinning_count==cache->fail_as_pinning_count) { cache->stat.pinning_cli_cnt++; } } else if(status->pinning_status==PINNING_ST_PINNING) { - cli_st->suspect_pinning_count=FAIL_AS_PINNING_COUNT; + cli_st->suspect_pinning_count=cache->fail_as_pinning_count; } if(status->has_protocol_errors) { cli_st->protocol_error_count++; - if(cli_st->protocol_error_count==FAIL_AS_PROTO_ERR_COUNT) + if(cli_st->protocol_error_count==cache->fail_as_proto_err_count) { cache->stat.proto_err_cli_cnt++; } @@ -220,18 +237,19 @@ static long srv_st_write_cb(void * data, const uchar * key, uint size, void * us return 1; } -int ssl_service_cache_read(struct ssl_service_cache* svc_cache, const struct ssl_chello* chello, struct ssl_service_status* result) +int ssl_service_cache_read(struct ssl_service_cache* svc_cache, const struct ssl_chello* chello, const struct tfe_stream_addr * addr, struct ssl_service_status* result) { long cli_st_cb_ret=0, svr_st_cb_ret=0; - char cli_st_key[2048]; - size_t cli_st_key_sz=0; + char hash_key[2048]; + size_t hash_key_sz=0; if(chello->sni==NULL) { return 0; } - cli_st_key_sz=ssl_svc_client_st_mk_key(chello, cli_st_key, sizeof(cli_st_key)); - MESA_htable_search_cb(svc_cache->cli_st_hash, (unsigned char*) cli_st_key, (unsigned int) cli_st_key_sz, cli_st_read_cb, result, &cli_st_cb_ret); - MESA_htable_search_cb(svc_cache->srv_st_hash, (unsigned char*) chello->sni, (unsigned int) strlen(chello->sni), srv_st_read_cb, result, &svr_st_cb_ret); + hash_key_sz=ssl_svc_client_st_mk_key(chello, addr, hash_key, sizeof(hash_key)); + MESA_htable_search_cb(svc_cache->cli_st_hash, (unsigned char*) hash_key, (unsigned int) hash_key_sz, cli_st_read_cb, result, &cli_st_cb_ret); + hash_key_sz=ssl_svc_server_st_mk_key(chello, addr, hash_key, sizeof(hash_key)); + MESA_htable_search_cb(svc_cache->srv_st_hash, (unsigned char*) hash_key, (unsigned int) hash_key_sz, srv_st_read_cb, result, &svr_st_cb_ret); if(cli_st_cb_ret||svr_st_cb_ret) { return 1; @@ -242,11 +260,11 @@ int ssl_service_cache_read(struct ssl_service_cache* svc_cache, const struct ssl } } -void ssl_service_cache_write(struct ssl_service_cache* svc_cache, const struct ssl_chello* chello, const struct ssl_service_status* status) +void ssl_service_cache_write(struct ssl_service_cache* svc_cache, const struct ssl_chello* chello, const struct tfe_stream_addr * addr, const struct ssl_service_status* status) { long cli_st_cb_ret=0, svr_st_cb_ret=0; - char cli_st_key[2048]; - size_t cli_st_key_sz=0; + char hash_key[2048]; + size_t hash_key_sz=0; if(chello->sni==NULL) { return; @@ -254,21 +272,25 @@ void ssl_service_cache_write(struct ssl_service_cache* svc_cache, const struct s struct ssl_service_write_args write_args={svc_cache, status}; if(status->is_mutual_auth||status->pinning_status!=PINNING_ST_NOT_PINNING||status->has_protocol_errors) { - cli_st_key_sz=ssl_svc_client_st_mk_key(chello, cli_st_key, sizeof(cli_st_key)); - MESA_htable_search_cb(svc_cache->cli_st_hash, (unsigned char*)cli_st_key, (unsigned int) cli_st_key_sz, cli_st_write_cb, &write_args, &cli_st_cb_ret); + hash_key_sz=ssl_svc_client_st_mk_key(chello, addr, hash_key, sizeof(hash_key)); + MESA_htable_search_cb(svc_cache->cli_st_hash, (unsigned char*)hash_key, (unsigned int) hash_key_sz, cli_st_write_cb, &write_args, &cli_st_cb_ret); } if(status->is_ct||status->is_ev) - { - MESA_htable_search_cb(svc_cache->srv_st_hash, (unsigned char*)chello->sni, (unsigned int) strlen(chello->sni), srv_st_write_cb, &write_args, &svr_st_cb_ret); + { + hash_key_sz=ssl_svc_server_st_mk_key(chello, addr, hash_key, sizeof(hash_key)); + MESA_htable_search_cb(svc_cache->srv_st_hash, (unsigned char*)hash_key, (unsigned int) hash_key_sz, srv_st_write_cb, &write_args, &svr_st_cb_ret); } } -struct ssl_service_cache* ssl_service_cache_create(unsigned int slot_size, unsigned int expire_seconds) +struct ssl_service_cache* ssl_service_cache_create(unsigned int slot_size, unsigned int expire_seconds, int fail_as_pinning_cnt, int fail_as_proto_err_cnt, int fail_time_win) { struct ssl_service_cache * cache = ALLOC(struct ssl_service_cache, 1); unsigned max_num = slot_size * 4; UNUSED int ret = 0; MESA_htable_handle htable=NULL, saved[2]; int i=0, opt_val=0; + cache->fail_as_pinning_count=fail_as_pinning_cnt; + cache->fail_as_proto_err_count=fail_as_proto_err_cnt; + cache->fail_time_window=fail_time_win; void (*free_func[])(void *)={ssl_svc_free_client_st, ssl_svc_free_server_st}; for(i=0; i<2; i++) { diff --git a/platform/src/ssl_stream.cpp b/platform/src/ssl_stream.cpp index a3208cb..b23ba21 100644 --- a/platform/src/ssl_stream.cpp +++ b/platform/src/ssl_stream.cpp @@ -131,7 +131,9 @@ struct ssl_mgr unsigned int svc_cache_slots; unsigned int svc_expire_seconds; - + unsigned int svc_fail_as_pinning_cnt; + unsigned int svc_fail_as_proto_err_cnt; + unsigned int svc_cnt_time_window; struct sess_cache * down_sess_cache; struct sess_cache * up_sess_cache; @@ -683,8 +685,17 @@ struct ssl_mgr * ssl_manager_init(const char * ini_profile, const char * section &(mgr->svc_cache_slots), 4 * 1024 * 1024); MESA_load_profile_uint_def(ini_profile, section, "service_cache_expire_seconds", &(mgr->svc_expire_seconds), 5 * 60); + MESA_load_profile_uint_def(ini_profile, section, "service_cache_fail_as_pinning_cnt", + &(mgr->svc_fail_as_pinning_cnt), 4); + MESA_load_profile_uint_def(ini_profile, section, "service_cache_fail_as_proto_err_cnt", + &(mgr->svc_fail_as_proto_err_cnt), 5); + MESA_load_profile_uint_def(ini_profile, section, "service_cache_fail_time_window", + &(mgr->svc_cnt_time_window), 30); - mgr->svc_cache=ssl_service_cache_create(mgr->svc_cache_slots, mgr->svc_expire_seconds); + mgr->svc_cache=ssl_service_cache_create(mgr->svc_cache_slots, mgr->svc_expire_seconds, + mgr->svc_fail_as_pinning_cnt, + mgr->svc_fail_as_proto_err_cnt, + mgr->svc_cnt_time_window); mgr->key_keeper = key_keeper_init(ini_profile, "key_keeper", logger); if (mgr->key_keeper == NULL) @@ -855,7 +866,7 @@ int ossl_client_cert_cb(SSL *ssl, X509 **x509, EVP_PKEY **pkey) struct ssl_stream* s_upstream=NULL; s_upstream=(struct ssl_stream*)SSL_get_ex_data(ssl, SSL_EX_DATA_IDX_SSLSTREAM); s_upstream->up_parts.svc_status.is_mutual_auth=1; - ssl_service_cache_write(s_upstream->mgr->svc_cache, s_upstream->up_parts.client_hello, &s_upstream->up_parts.svc_status); + ssl_service_cache_write(s_upstream->mgr->svc_cache, s_upstream->up_parts.client_hello, s_upstream->tcp_stream->addr, &s_upstream->up_parts.svc_status); return 0; } @@ -1163,7 +1174,7 @@ static void ssl_server_connected_eventcb(struct bufferevent * bev, short events, if(sslerr) { s_upstream->svc_status.has_protocol_errors=1; - ssl_service_cache_write(mgr->svc_cache, s_stream->up_parts.client_hello, &(s_stream->up_parts.svc_status)); + ssl_service_cache_write(mgr->svc_cache, s_stream->up_parts.client_hello, s_stream->tcp_stream->addr, &(s_stream->up_parts.svc_status)); } s_stream->error=SSL_STREAM_R_SERVER_PROTOCOL_ERROR; } @@ -1203,7 +1214,7 @@ static void ssl_server_connected_eventcb(struct bufferevent * bev, short events, error_str, sizeof(error_str), &(s_stream->up_parts.verify_result)); s_upstream->svc_status.is_ct=s_upstream->verify_result.is_ct; s_upstream->svc_status.is_ev=s_upstream->verify_result.is_ev; - ssl_service_cache_write(mgr->svc_cache, s_upstream->client_hello, &(s_upstream->svc_status)); + ssl_service_cache_write(mgr->svc_cache, s_upstream->client_hello, s_stream->tcp_stream->addr, &(s_upstream->svc_status)); TFE_LOG_DEBUG(mgr->logger, "stream:%s sni:%s hostmatch:%d, ct:%d, ev:%d", s_stream->tcp_stream->str_stream_info, s_upstream->client_hello->sni, @@ -1292,7 +1303,7 @@ static void peek_chello_on_succ(future_result_t * result, void * user) clock_gettime(CLOCK_MONOTONIC, &(ctx->start)); s_stream= ssl_stream_new(ctx->mgr, ctx->fd_upstream, CONN_DIR_UPSTREAM, chello, NULL, NULL, ctx->tcp_stream); svc_status=&s_stream->up_parts.svc_status; - ret=ssl_service_cache_read(ctx->mgr->svc_cache, chello, svc_status); + ret=ssl_service_cache_read(ctx->mgr->svc_cache, chello, s_stream->tcp_stream->addr, svc_status); if(ret==1) { TFE_LOG_DEBUG(ctx->mgr->logger, "SNI: %s service status pinning:%d, mauth:%d, err:%d, ct:%d, ev:%d", @@ -1751,12 +1762,12 @@ static void ssl_client_connected_eventcb(struct bufferevent * bev, short events, { s_upstream->svc_status.pinning_status=PINNING_ST_PINNING; ssl_stream_set_cmsg_integer(s_stream, TFE_CMSG_SSL_PINNING_STATE, PINNING_ST_PINNING); - ssl_service_cache_write(mgr->svc_cache, s_upstream->client_hello, &s_upstream->svc_status); + ssl_service_cache_write(mgr->svc_cache, s_upstream->client_hello, s_stream->tcp_stream->addr, &s_upstream->svc_status); } else if(sslerr>0 && sslerr!=SSL_R_SSLV3_ALERT_CERTIFICATE_UNKNOWN) { s_upstream->svc_status.has_protocol_errors=1; - ssl_service_cache_write(mgr->svc_cache, s_upstream->client_hello, &s_upstream->svc_status); + ssl_service_cache_write(mgr->svc_cache, s_upstream->client_hello, s_stream->tcp_stream->addr, &s_upstream->svc_status); } s_stream->error=SSL_STREAM_R_CLIENT_PROTOCOL_ERROR; } @@ -1767,7 +1778,7 @@ static void ssl_client_connected_eventcb(struct bufferevent * bev, short events, { s_upstream->svc_status.pinning_status=PINNING_ST_MAYBE_PINNING; ssl_stream_set_cmsg_integer(s_stream, TFE_CMSG_SSL_PINNING_STATE, PINNING_ST_MAYBE_PINNING); - ssl_service_cache_write(mgr->svc_cache, s_stream->peer->up_parts.client_hello, &(s_stream->peer->up_parts.svc_status)); + ssl_service_cache_write(mgr->svc_cache, s_stream->peer->up_parts.client_hello, s_stream->tcp_stream->addr, &(s_stream->peer->up_parts.svc_status)); } s_stream->error=SSL_STREAM_R_CLIENT_CLOSED; }