gfwleak/tango-tfe
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

1、使用服务器IP+端口+sni生成服务端状态 #141，使用客户端IP+Client hello特征生成客户端状态。2、pinning detection的相关阈值可从tfe.conf中配置。

Browse Source
This commit is contained in:
zhengchao
2019-06-10 18:39:01 +08:00
parent b612ef2507
commit f18c5efdb1
3 changed files with 70 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
platform/include/internal/ssl_service_cache.h
View File

@@ -17,11 +17,11 @@ struct ssl_service_status
};
struct ssl_service_cache;
struct ssl_service_cache* ssl_service_cache_create(unsigned int slot_size, unsigned int expire_seconds);
struct ssl_service_cache* ssl_service_cache_create(unsigned int slot_size, unsigned int expire_seconds, int fail_as_pinning_cnt, int fail_as_proto_err_cnt, int fail_time_win);
void ssl_service_cache_destroy(struct ssl_service_cache* cache);
int ssl_service_cache_read(struct ssl_service_cache* svc_cache, const struct ssl_chello* chello, struct ssl_service_status* result);
void ssl_service_cache_write(struct ssl_service_cache* svc_cache, const struct ssl_chello* chello, const struct ssl_service_status* status);
int ssl_service_cache_read(struct ssl_service_cache* svc_cache, const struct ssl_chello* chello, const struct tfe_stream_addr * addr, struct ssl_service_status* result);
void ssl_service_cache_write(struct ssl_service_cache* svc_cache, const struct ssl_chello* chello, const struct tfe_stream_addr * addr, const struct ssl_service_status* status);
struct ssl_service_cache_statistics
{
long long pinning_cli_cnt;

70
platform/src/ssl_service_cache.cpp
View File

@@ -28,6 +28,9 @@ struct ssl_service_cache
MESA_htable_handle cli_st_hash;
MESA_htable_handle srv_st_hash;
struct ssl_service_cache_statistics stat;
unsigned int fail_as_pinning_count;
unsigned int fail_as_proto_err_count;
unsigned int fail_time_window;
};
struct ssl_service_write_args
{
@@ -64,11 +67,24 @@ static void ssl_svc_free_server_st(void * data)
free(p);
return;
}
static size_t ssl_svc_client_st_mk_key(const struct ssl_chello* chello, char* key_buff, size_t sz)
static size_t ssl_svc_server_st_mk_key(const struct ssl_chello* chello, const struct tfe_stream_addr * addr, char* key_buff, size_t sz)
{
size_t key_len=0;
key_len=snprintf(key_buff, sz, "%d:%d:%s:%s:", chello->min_version.ossl_format,
const char* sip=NULL, *sport=NULL, *dip=NULL, *dport=NULL;
char * addr_str= tfe_stream_addr_to_str(addr);
tfe_stream_addr_str_split(addr_str, &sip, &sport, &dip, &dport);
key_len=snprintf(key_buff, sz, "%s:%s:%s:", dip, dport, chello->sni);
free(addr_str);
return key_len;
}
static size_t ssl_svc_client_st_mk_key(const struct ssl_chello* chello, const struct tfe_stream_addr * addr, char* key_buff, size_t sz)
{
size_t key_len=0;
const char* sip=NULL, *sport=NULL, *dip=NULL, *dport=NULL;
char * addr_str= tfe_stream_addr_to_str(addr);
tfe_stream_addr_str_split(addr_str, &sip, &sport, &dip, &dport);
key_len=snprintf(key_buff, sz, "%s:%d:%d:%s:%s:", sip,
chello->min_version.ossl_format,
chello->max_version.ossl_format,
chello->sni, chello->alpn?chello->alpn:"null");
if(chello->cipher_suites && sz-key_len>chello->cipher_suites_len)
@@ -86,6 +102,7 @@ static size_t ssl_svc_client_st_mk_key(const struct ssl_chello* chello, char* ke
memcpy(key_buff+key_len, chello->supported_groups, chello->supported_groups_len);
key_len+=chello->supported_groups_len;
}
free(addr_str);
return key_len;
}
static long cli_st_read_cb(void * data, const uchar * key, uint size, void * user_arg)
@@ -131,34 +148,34 @@ static long cli_st_write_cb(void * data, const uchar * key, uint size, void * us
ret = MESA_htable_add(cache->cli_st_hash, key, size, cli_st);
assert(ret >= 0);
}
if(cli_st->last_update_time-now>FAIL_TIME_WINDOW)
if(cli_st->last_update_time-now>cache->fail_time_window)
{
if(cli_st->suspect_pinning_count<FAIL_AS_PINNING_COUNT) cli_st->suspect_pinning_count=0;
if(cli_st->protocol_error_count<FAIL_AS_PROTO_ERR_COUNT) cli_st->protocol_error_count=0;
if(cli_st->suspect_pinning_count<cache->fail_as_pinning_count) cli_st->suspect_pinning_count=0;
if(cli_st->protocol_error_count<cache->fail_as_proto_err_count) cli_st->protocol_error_count=0;
}
if(status->pinning_status!=PINNING_ST_NOT_PINNING && cli_st->suspect_pinning_count<FAIL_AS_PINNING_COUNT)
if(status->pinning_status!=PINNING_ST_NOT_PINNING && cli_st->suspect_pinning_count<cache->fail_as_pinning_count)
{
if(status->pinning_status==PINNING_ST_PINNING)
{
cli_st->suspect_pinning_count=FAIL_AS_PINNING_COUNT;
cli_st->suspect_pinning_count=cache->fail_as_pinning_count;
}
else
{
cli_st->suspect_pinning_count++;
}
if(cli_st->suspect_pinning_count==FAIL_AS_PINNING_COUNT)
if(cli_st->suspect_pinning_count==cache->fail_as_pinning_count)
{
cache->stat.pinning_cli_cnt++;
}
}
else if(status->pinning_status==PINNING_ST_PINNING)
{
cli_st->suspect_pinning_count=FAIL_AS_PINNING_COUNT;
cli_st->suspect_pinning_count=cache->fail_as_pinning_count;
}
if(status->has_protocol_errors)
{
cli_st->protocol_error_count++;
if(cli_st->protocol_error_count==FAIL_AS_PROTO_ERR_COUNT)
if(cli_st->protocol_error_count==cache->fail_as_proto_err_count)
{
cache->stat.proto_err_cli_cnt++;
}
@@ -220,18 +237,19 @@ static long srv_st_write_cb(void * data, const uchar * key, uint size, void * us
return 1;
}
int ssl_service_cache_read(struct ssl_service_cache* svc_cache, const struct ssl_chello* chello, struct ssl_service_status* result)
int ssl_service_cache_read(struct ssl_service_cache* svc_cache, const struct ssl_chello* chello, const struct tfe_stream_addr * addr, struct ssl_service_status* result)
{
long cli_st_cb_ret=0, svr_st_cb_ret=0;
char cli_st_key[2048];
size_t cli_st_key_sz=0;
char hash_key[2048];
size_t hash_key_sz=0;
if(chello->sni==NULL)
{
return 0;
}
cli_st_key_sz=ssl_svc_client_st_mk_key(chello, cli_st_key, sizeof(cli_st_key));
MESA_htable_search_cb(svc_cache->cli_st_hash, (unsigned char*) cli_st_key, (unsigned int) cli_st_key_sz, cli_st_read_cb, result, &cli_st_cb_ret);
MESA_htable_search_cb(svc_cache->srv_st_hash, (unsigned char*) chello->sni, (unsigned int) strlen(chello->sni), srv_st_read_cb, result, &svr_st_cb_ret);
hash_key_sz=ssl_svc_client_st_mk_key(chello, addr, hash_key, sizeof(hash_key));
MESA_htable_search_cb(svc_cache->cli_st_hash, (unsigned char*) hash_key, (unsigned int) hash_key_sz, cli_st_read_cb, result, &cli_st_cb_ret);
hash_key_sz=ssl_svc_server_st_mk_key(chello, addr, hash_key, sizeof(hash_key));
MESA_htable_search_cb(svc_cache->srv_st_hash, (unsigned char*) hash_key, (unsigned int) hash_key_sz, srv_st_read_cb, result, &svr_st_cb_ret);
if(cli_st_cb_ret||svr_st_cb_ret)
{
return 1;
@@ -242,11 +260,11 @@ int ssl_service_cache_read(struct ssl_service_cache* svc_cache, const struct ssl
}
}
void ssl_service_cache_write(struct ssl_service_cache* svc_cache, const struct ssl_chello* chello, const struct ssl_service_status* status)
void ssl_service_cache_write(struct ssl_service_cache* svc_cache, const struct ssl_chello* chello, const struct tfe_stream_addr * addr, const struct ssl_service_status* status)
{
long cli_st_cb_ret=0, svr_st_cb_ret=0;
char cli_st_key[2048];
size_t cli_st_key_sz=0;
char hash_key[2048];
size_t hash_key_sz=0;
if(chello->sni==NULL)
{
return;
@@ -254,21 +272,25 @@ void ssl_service_cache_write(struct ssl_service_cache* svc_cache, const struct s
struct ssl_service_write_args write_args={svc_cache, status};
if(status->is_mutual_auth||status->pinning_status!=PINNING_ST_NOT_PINNING||status->has_protocol_errors)
{
cli_st_key_sz=ssl_svc_client_st_mk_key(chello, cli_st_key, sizeof(cli_st_key));
MESA_htable_search_cb(svc_cache->cli_st_hash, (unsigned char*)cli_st_key, (unsigned int) cli_st_key_sz, cli_st_write_cb, &write_args, &cli_st_cb_ret);
hash_key_sz=ssl_svc_client_st_mk_key(chello, addr, hash_key, sizeof(hash_key));
MESA_htable_search_cb(svc_cache->cli_st_hash, (unsigned char*)hash_key, (unsigned int) hash_key_sz, cli_st_write_cb, &write_args, &cli_st_cb_ret);
}
if(status->is_ct||status->is_ev)
{
MESA_htable_search_cb(svc_cache->srv_st_hash, (unsigned char*)chello->sni, (unsigned int) strlen(chello->sni), srv_st_write_cb, &write_args, &svr_st_cb_ret);
hash_key_sz=ssl_svc_server_st_mk_key(chello, addr, hash_key, sizeof(hash_key));
MESA_htable_search_cb(svc_cache->srv_st_hash, (unsigned char*)hash_key, (unsigned int) hash_key_sz, srv_st_write_cb, &write_args, &svr_st_cb_ret);
}
}
struct ssl_service_cache* ssl_service_cache_create(unsigned int slot_size, unsigned int expire_seconds)
struct ssl_service_cache* ssl_service_cache_create(unsigned int slot_size, unsigned int expire_seconds, int fail_as_pinning_cnt, int fail_as_proto_err_cnt, int fail_time_win)
{
struct ssl_service_cache * cache = ALLOC(struct ssl_service_cache, 1);
unsigned max_num = slot_size * 4;
UNUSED int ret = 0;
MESA_htable_handle htable=NULL, saved[2];
int i=0, opt_val=0;
cache->fail_as_pinning_count=fail_as_pinning_cnt;
cache->fail_as_proto_err_count=fail_as_proto_err_cnt;
cache->fail_time_window=fail_time_win;
void (*free_func[])(void *)={ssl_svc_free_client_st, ssl_svc_free_server_st};
for(i=0; i<2; i++)
{

29
platform/src/ssl_stream.cpp
View File

@@ -131,7 +131,9 @@ struct ssl_mgr
unsigned int svc_cache_slots;
unsigned int svc_expire_seconds;
unsigned int svc_fail_as_pinning_cnt;
unsigned int svc_fail_as_proto_err_cnt;
unsigned int svc_cnt_time_window;
struct sess_cache * down_sess_cache;
struct sess_cache * up_sess_cache;
@@ -683,8 +685,17 @@ struct ssl_mgr * ssl_manager_init(const char * ini_profile, const char * section
&(mgr->svc_cache_slots), 4 * 1024 * 1024);
MESA_load_profile_uint_def(ini_profile, section, "service_cache_expire_seconds",
&(mgr->svc_expire_seconds), 5 * 60);
MESA_load_profile_uint_def(ini_profile, section, "service_cache_fail_as_pinning_cnt",
&(mgr->svc_fail_as_pinning_cnt), 4);
MESA_load_profile_uint_def(ini_profile, section, "service_cache_fail_as_proto_err_cnt",
&(mgr->svc_fail_as_proto_err_cnt), 5);
MESA_load_profile_uint_def(ini_profile, section, "service_cache_fail_time_window",
&(mgr->svc_cnt_time_window), 30);
mgr->svc_cache=ssl_service_cache_create(mgr->svc_cache_slots, mgr->svc_expire_seconds);
mgr->svc_cache=ssl_service_cache_create(mgr->svc_cache_slots, mgr->svc_expire_seconds,
mgr->svc_fail_as_pinning_cnt,
mgr->svc_fail_as_proto_err_cnt,
mgr->svc_cnt_time_window);
mgr->key_keeper = key_keeper_init(ini_profile, "key_keeper", logger);
if (mgr->key_keeper == NULL)
@@ -855,7 +866,7 @@ int ossl_client_cert_cb(SSL *ssl, X509 **x509, EVP_PKEY **pkey)
struct ssl_stream* s_upstream=NULL;
s_upstream=(struct ssl_stream*)SSL_get_ex_data(ssl, SSL_EX_DATA_IDX_SSLSTREAM);
s_upstream->up_parts.svc_status.is_mutual_auth=1;
ssl_service_cache_write(s_upstream->mgr->svc_cache, s_upstream->up_parts.client_hello, &s_upstream->up_parts.svc_status);
ssl_service_cache_write(s_upstream->mgr->svc_cache, s_upstream->up_parts.client_hello, s_upstream->tcp_stream->addr, &s_upstream->up_parts.svc_status);
return 0;
}
@@ -1163,7 +1174,7 @@ static void ssl_server_connected_eventcb(struct bufferevent * bev, short events,
if(sslerr)
{
s_upstream->svc_status.has_protocol_errors=1;
ssl_service_cache_write(mgr->svc_cache, s_stream->up_parts.client_hello, &(s_stream->up_parts.svc_status));
ssl_service_cache_write(mgr->svc_cache, s_stream->up_parts.client_hello, s_stream->tcp_stream->addr, &(s_stream->up_parts.svc_status));
}
s_stream->error=SSL_STREAM_R_SERVER_PROTOCOL_ERROR;
}
@@ -1203,7 +1214,7 @@ static void ssl_server_connected_eventcb(struct bufferevent * bev, short events,
error_str, sizeof(error_str), &(s_stream->up_parts.verify_result));
s_upstream->svc_status.is_ct=s_upstream->verify_result.is_ct;
s_upstream->svc_status.is_ev=s_upstream->verify_result.is_ev;
ssl_service_cache_write(mgr->svc_cache, s_upstream->client_hello, &(s_upstream->svc_status));
ssl_service_cache_write(mgr->svc_cache, s_upstream->client_hello, s_stream->tcp_stream->addr, &(s_upstream->svc_status));
TFE_LOG_DEBUG(mgr->logger, "stream:%s sni:%s hostmatch:%d, ct:%d, ev:%d",
s_stream->tcp_stream->str_stream_info,
s_upstream->client_hello->sni,
@@ -1292,7 +1303,7 @@ static void peek_chello_on_succ(future_result_t * result, void * user)
clock_gettime(CLOCK_MONOTONIC, &(ctx->start));
s_stream= ssl_stream_new(ctx->mgr, ctx->fd_upstream, CONN_DIR_UPSTREAM, chello, NULL, NULL, ctx->tcp_stream);
svc_status=&s_stream->up_parts.svc_status;
ret=ssl_service_cache_read(ctx->mgr->svc_cache, chello, svc_status);
ret=ssl_service_cache_read(ctx->mgr->svc_cache, chello, s_stream->tcp_stream->addr, svc_status);
if(ret==1)
{
TFE_LOG_DEBUG(ctx->mgr->logger, "SNI: %s service status pinning:%d, mauth:%d, err:%d, ct:%d, ev:%d",
@@ -1751,12 +1762,12 @@ static void ssl_client_connected_eventcb(struct bufferevent * bev, short events,
{
s_upstream->svc_status.pinning_status=PINNING_ST_PINNING;
ssl_stream_set_cmsg_integer(s_stream, TFE_CMSG_SSL_PINNING_STATE, PINNING_ST_PINNING);
ssl_service_cache_write(mgr->svc_cache, s_upstream->client_hello, &s_upstream->svc_status);
ssl_service_cache_write(mgr->svc_cache, s_upstream->client_hello, s_stream->tcp_stream->addr, &s_upstream->svc_status);
}
else if(sslerr>0 && sslerr!=SSL_R_SSLV3_ALERT_CERTIFICATE_UNKNOWN)
{
s_upstream->svc_status.has_protocol_errors=1;
ssl_service_cache_write(mgr->svc_cache, s_upstream->client_hello, &s_upstream->svc_status);
ssl_service_cache_write(mgr->svc_cache, s_upstream->client_hello, s_stream->tcp_stream->addr, &s_upstream->svc_status);
}
s_stream->error=SSL_STREAM_R_CLIENT_PROTOCOL_ERROR;
}
@@ -1767,7 +1778,7 @@ static void ssl_client_connected_eventcb(struct bufferevent * bev, short events,
{
s_upstream->svc_status.pinning_status=PINNING_ST_MAYBE_PINNING;
ssl_stream_set_cmsg_integer(s_stream, TFE_CMSG_SSL_PINNING_STATE, PINNING_ST_MAYBE_PINNING);
ssl_service_cache_write(mgr->svc_cache, s_stream->peer->up_parts.client_hello, &(s_stream->peer->up_parts.svc_status));
ssl_service_cache_write(mgr->svc_cache, s_stream->peer->up_parts.client_hello, s_stream->tcp_stream->addr, &(s_stream->peer->up_parts.svc_status));
}
s_stream->error=SSL_STREAM_R_CLIENT_CLOSED;
}