gfwleak/tango-tfe
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

1、使用服务器IP+端口+sni生成服务端状态 #141，使用客户端IP+Client hello特征生成客户端状态。2、pinning detection的相关阈值可从tfe.conf中配置。

Browse Source
This commit is contained in:
zhengchao
2019-06-10 18:39:01 +08:00
parent b612ef2507
commit f18c5efdb1
3 changed files with 70 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
platform/src/ssl_stream.cpp
View File

@@ -131,7 +131,9 @@ struct ssl_mgr
unsigned int svc_cache_slots;
unsigned int svc_expire_seconds;
unsigned int svc_fail_as_pinning_cnt;
unsigned int svc_fail_as_proto_err_cnt;
unsigned int svc_cnt_time_window;
struct sess_cache * down_sess_cache;
struct sess_cache * up_sess_cache;
@@ -683,8 +685,17 @@ struct ssl_mgr * ssl_manager_init(const char * ini_profile, const char * section
&(mgr->svc_cache_slots), 4 * 1024 * 1024);
MESA_load_profile_uint_def(ini_profile, section, "service_cache_expire_seconds",
&(mgr->svc_expire_seconds), 5 * 60);
MESA_load_profile_uint_def(ini_profile, section, "service_cache_fail_as_pinning_cnt",
&(mgr->svc_fail_as_pinning_cnt), 4);
MESA_load_profile_uint_def(ini_profile, section, "service_cache_fail_as_proto_err_cnt",
&(mgr->svc_fail_as_proto_err_cnt), 5);
MESA_load_profile_uint_def(ini_profile, section, "service_cache_fail_time_window",
&(mgr->svc_cnt_time_window), 30);
mgr->svc_cache=ssl_service_cache_create(mgr->svc_cache_slots, mgr->svc_expire_seconds);
mgr->svc_cache=ssl_service_cache_create(mgr->svc_cache_slots, mgr->svc_expire_seconds,
mgr->svc_fail_as_pinning_cnt,
mgr->svc_fail_as_proto_err_cnt,
mgr->svc_cnt_time_window);
mgr->key_keeper = key_keeper_init(ini_profile, "key_keeper", logger);
if (mgr->key_keeper == NULL)
@@ -855,7 +866,7 @@ int ossl_client_cert_cb(SSL *ssl, X509 **x509, EVP_PKEY **pkey)
struct ssl_stream* s_upstream=NULL;
s_upstream=(struct ssl_stream*)SSL_get_ex_data(ssl, SSL_EX_DATA_IDX_SSLSTREAM);
s_upstream->up_parts.svc_status.is_mutual_auth=1;
ssl_service_cache_write(s_upstream->mgr->svc_cache, s_upstream->up_parts.client_hello, &s_upstream->up_parts.svc_status);
ssl_service_cache_write(s_upstream->mgr->svc_cache, s_upstream->up_parts.client_hello, s_upstream->tcp_stream->addr, &s_upstream->up_parts.svc_status);
return 0;
}
@@ -1163,7 +1174,7 @@ static void ssl_server_connected_eventcb(struct bufferevent * bev, short events,
if(sslerr)
{
s_upstream->svc_status.has_protocol_errors=1;
ssl_service_cache_write(mgr->svc_cache, s_stream->up_parts.client_hello, &(s_stream->up_parts.svc_status));
ssl_service_cache_write(mgr->svc_cache, s_stream->up_parts.client_hello, s_stream->tcp_stream->addr, &(s_stream->up_parts.svc_status));
}
s_stream->error=SSL_STREAM_R_SERVER_PROTOCOL_ERROR;
}
@@ -1203,7 +1214,7 @@ static void ssl_server_connected_eventcb(struct bufferevent * bev, short events,
error_str, sizeof(error_str), &(s_stream->up_parts.verify_result));
s_upstream->svc_status.is_ct=s_upstream->verify_result.is_ct;
s_upstream->svc_status.is_ev=s_upstream->verify_result.is_ev;
ssl_service_cache_write(mgr->svc_cache, s_upstream->client_hello, &(s_upstream->svc_status));
ssl_service_cache_write(mgr->svc_cache, s_upstream->client_hello, s_stream->tcp_stream->addr, &(s_upstream->svc_status));
TFE_LOG_DEBUG(mgr->logger, "stream:%s sni:%s hostmatch:%d, ct:%d, ev:%d",
s_stream->tcp_stream->str_stream_info,
s_upstream->client_hello->sni,
@@ -1292,7 +1303,7 @@ static void peek_chello_on_succ(future_result_t * result, void * user)
clock_gettime(CLOCK_MONOTONIC, &(ctx->start));
s_stream= ssl_stream_new(ctx->mgr, ctx->fd_upstream, CONN_DIR_UPSTREAM, chello, NULL, NULL, ctx->tcp_stream);
svc_status=&s_stream->up_parts.svc_status;
ret=ssl_service_cache_read(ctx->mgr->svc_cache, chello, svc_status);
ret=ssl_service_cache_read(ctx->mgr->svc_cache, chello, s_stream->tcp_stream->addr, svc_status);
if(ret==1)
{
TFE_LOG_DEBUG(ctx->mgr->logger, "SNI: %s service status pinning:%d, mauth:%d, err:%d, ct:%d, ev:%d",
@@ -1751,12 +1762,12 @@ static void ssl_client_connected_eventcb(struct bufferevent * bev, short events,
{
s_upstream->svc_status.pinning_status=PINNING_ST_PINNING;
ssl_stream_set_cmsg_integer(s_stream, TFE_CMSG_SSL_PINNING_STATE, PINNING_ST_PINNING);
ssl_service_cache_write(mgr->svc_cache, s_upstream->client_hello, &s_upstream->svc_status);
ssl_service_cache_write(mgr->svc_cache, s_upstream->client_hello, s_stream->tcp_stream->addr, &s_upstream->svc_status);
}
else if(sslerr>0 && sslerr!=SSL_R_SSLV3_ALERT_CERTIFICATE_UNKNOWN)
{
s_upstream->svc_status.has_protocol_errors=1;
ssl_service_cache_write(mgr->svc_cache, s_upstream->client_hello, &s_upstream->svc_status);
ssl_service_cache_write(mgr->svc_cache, s_upstream->client_hello, s_stream->tcp_stream->addr, &s_upstream->svc_status);
}
s_stream->error=SSL_STREAM_R_CLIENT_PROTOCOL_ERROR;
}
@@ -1767,7 +1778,7 @@ static void ssl_client_connected_eventcb(struct bufferevent * bev, short events,
{
s_upstream->svc_status.pinning_status=PINNING_ST_MAYBE_PINNING;
ssl_stream_set_cmsg_integer(s_stream, TFE_CMSG_SSL_PINNING_STATE, PINNING_ST_MAYBE_PINNING);
ssl_service_cache_write(mgr->svc_cache, s_stream->peer->up_parts.client_hello, &(s_stream->peer->up_parts.svc_status));
ssl_service_cache_write(mgr->svc_cache, s_stream->peer->up_parts.client_hello, s_stream->tcp_stream->addr, &(s_stream->peer->up_parts.svc_status));
}
s_stream->error=SSL_STREAM_R_CLIENT_CLOSED;
}