区分未安装证书的客户端和pinning的客户端。若开启tfe.conf中[SSL]root_cert_not_installed_is_not_pinning=1，则未安装证书的客户端不再视为pinning。

1 files changed, 115 insertions, 30 deletions

diff --git a/platform/src/ssl_service_cache.cpp b/platform/src/ssl_service_cache.cpp
index e005450..b7f464c 100644
--- a/platform/src/ssl_service_cache.cpp
+++ b/platform/src/ssl_service_cache.cpp
@@ -7,6 +7,7 @@
 #define	FAIL_AS_PINNING_COUNT	4
 #define	FAIL_TIME_WINDOW		30
 #define	FAIL_AS_PROTO_ERR_COUNT	5
+#define	SUCC_AS_APP_NOT_PINNING	3
 struct ssl_svc_client_st
 {
 	time_t last_update_time;
@@ -23,14 +24,22 @@ struct ssl_svc_server_st
 	long long ct_st_switched;
 	struct ssl_service_cache* ref_svc_cache;
 };
+struct ssl_svc_app_st
+{
+	unsigned int down_ssl_success_cnt;
+	struct ssl_service_cache* ref_svc_cache;
+};
 struct ssl_service_cache
 {
 	MESA_htable_handle cli_st_hash;
 	MESA_htable_handle srv_st_hash;
+	MESA_htable_handle app_st_hash;
+	
 	struct ssl_service_cache_statistics stat;
-	unsigned int fail_as_pinning_count;
+	unsigned int fail_as_cli_pinning_count;
 	unsigned int fail_as_proto_err_count;
 	unsigned int fail_time_window;
+	unsigned int succ_as_app_not_pinning_count;
 };
 struct ssl_service_write_args
 {
@@ -45,7 +54,7 @@ static void ssl_svc_free_client_st(void * data)
 	{
 		svc_cache->stat.mutual_auth_cli_cnt--;
 	}
-	if(p->suspect_pinning_count>=FAIL_AS_PINNING_COUNT)
+	if(p->suspect_pinning_count>=svc_cache->fail_as_cli_pinning_count)
 	{
 		svc_cache->stat.pinning_cli_cnt--;
 	}
@@ -67,7 +76,17 @@ static void ssl_svc_free_server_st(void * data)
 	free(p);
 	return;
 }
-static size_t ssl_svc_server_st_mk_key(const struct ssl_chello* chello, const struct tfe_stream_addr * addr, char* key_buff, size_t sz)
+static void ssl_svc_free_app_st(void* data)
+{
+	struct ssl_svc_app_st* p= (struct ssl_svc_app_st*)data;
+	struct ssl_service_cache* svc_cache=p->ref_svc_cache;
+	if(p->down_ssl_success_cnt>svc_cache->succ_as_app_not_pinning_count)
+	{
+		svc_cache->stat.app_not_pinning_cnt--;
+	}
+	free(p);
+}
+static size_t ssl_svc_server_st_mk_key(const struct ssl_chello* chello,  const struct tfe_stream_addr * addr, char* key_buff, size_t sz)
 {
 	size_t key_len=0;
 	const char* sip=NULL, *sport=NULL, *dip=NULL, *dport=NULL;
@@ -77,17 +96,17 @@ static size_t ssl_svc_server_st_mk_key(const struct ssl_chello* chello, const st
 	free(addr_str);
 	return key_len;
 }
-static size_t ssl_svc_client_st_mk_key(const struct ssl_chello* chello, const struct tfe_stream_addr * addr, char* key_buff, size_t sz)
+static size_t ssl_svc_app_st_mk_key(const struct ssl_chello* chello,  const struct tfe_stream_addr * addr, char* key_buff, size_t sz)
 {
 	size_t key_len=0;
 	const char* sip=NULL, *sport=NULL, *dip=NULL, *dport=NULL;
 	char * addr_str= tfe_stream_addr_to_str(addr);
 	tfe_stream_addr_str_split(addr_str, &sip, &sport, &dip, &dport);
-	key_len=snprintf(key_buff, sz, "%s:%d:%d:%s:%s", sip, 
-													chello->min_version.ossl_format, 
-													chello->max_version.ossl_format,
-													chello->sni?chello->sni: dip ,
-													chello->alpn?chello->alpn:"null");
+
+	key_len=snprintf(key_buff, sz, "%d:%d:%s:%s", chello->min_version.ossl_format, 
+												chello->max_version.ossl_format,
+												chello->sni?chello->sni: dip ,
+												chello->alpn?chello->alpn:"null");
 	if(chello->cipher_suites && sz-key_len>chello->cipher_suites_len)
 	{
 		memcpy(key_buff+key_len, chello->cipher_suites, chello->cipher_suites_len);
@@ -102,13 +121,31 @@ static size_t ssl_svc_client_st_mk_key(const struct ssl_chello* chello, const st
 	{
 		memcpy(key_buff+key_len, chello->supported_groups, chello->supported_groups_len);
 		key_len+=chello->supported_groups_len;
-	}
+	}	
+	free(addr_str);
+	return key_len;
+}
+static size_t ssl_svc_client_st_mk_key(const struct ssl_chello* chello, const struct tfe_stream_addr * addr, char* key_buff, size_t sz)
+{
+	size_t key_len=0;
+	const char* sip=NULL, *sport=NULL, *dip=NULL, *dport=NULL;
+	char * addr_str= tfe_stream_addr_to_str(addr);
+	tfe_stream_addr_str_split(addr_str, &sip, &sport, &dip, &dport);
+	char chello_id_buff[sz];
+	size_t chello_id_len=0;
+
+	key_len=snprintf(key_buff, sz, "%s:", sip);
+	chello_id_len=ssl_svc_app_st_mk_key(chello, addr, chello_id_buff, sizeof(chello_id_buff));
+	memcpy(key_buff+key_len, chello_id_buff, MIN(chello_id_len, sz-key_len));
+	key_len+=chello_id_len;
+
 	free(addr_str);
 	return key_len;
 }
 static long cli_st_read_cb(void * data, const uchar * key, uint size, void * user_arg)
 {
 	struct ssl_svc_client_st* cli_st=(struct ssl_svc_client_st*)data;
+	struct ssl_service_cache* svc_cache=cli_st->ref_svc_cache;
 	struct ssl_service_status* result=(struct ssl_service_status*)user_arg;
 	
 	if (cli_st == NULL)
@@ -117,17 +154,17 @@ static long cli_st_read_cb(void * data, const uchar * key, uint size, void * use
 	}
 	if(cli_st->suspect_pinning_count==0)
 	{		
-		result->pinning_status=PINNING_ST_NOT_PINNING;
+		result->cli_pinning_status=PINNING_ST_NOT_PINNING;
 	}
-	else if(cli_st->suspect_pinning_count<FAIL_AS_PINNING_COUNT)
+	else if(cli_st->suspect_pinning_count<svc_cache->fail_as_cli_pinning_count)
 	{
-		result->pinning_status=PINNING_ST_MAYBE_PINNING;
+		result->cli_pinning_status=PINNING_ST_MAYBE_PINNING;
 	}
 	else
 	{
-		result->pinning_status=PINNING_ST_PINNING;
+		result->cli_pinning_status=PINNING_ST_PINNING;
 	}
-	if(cli_st->protocol_error_count>=FAIL_AS_PROTO_ERR_COUNT)
+	if(cli_st->protocol_error_count>=svc_cache->fail_as_proto_err_count)
 	{
 		result->has_protocol_errors=1;
 	}
@@ -152,27 +189,27 @@ static long cli_st_write_cb(void * data, const uchar * key, uint size, void * us
 	}
 	if (now - cli_st->last_update_time > cache->fail_time_window)
 	{
-		if(cli_st->suspect_pinning_count<cache->fail_as_pinning_count)	cli_st->suspect_pinning_count=0;
+		if(cli_st->suspect_pinning_count<cache->fail_as_cli_pinning_count)	cli_st->suspect_pinning_count=0;
 		if(cli_st->protocol_error_count<cache->fail_as_proto_err_count)	cli_st->protocol_error_count=0;
 	}
-	if(status->pinning_status!=PINNING_ST_NOT_PINNING && cli_st->suspect_pinning_count<cache->fail_as_pinning_count)
+	if(status->cli_pinning_status!=PINNING_ST_NOT_PINNING && cli_st->suspect_pinning_count<cache->fail_as_cli_pinning_count)
 	{
-		if(status->pinning_status==PINNING_ST_PINNING)
+		if(status->cli_pinning_status==PINNING_ST_PINNING)
 		{
-			cli_st->suspect_pinning_count=cache->fail_as_pinning_count;
+			cli_st->suspect_pinning_count=cache->fail_as_cli_pinning_count;
 		}
 		else
 		{
 			cli_st->suspect_pinning_count++;
 		}
-		if(cli_st->suspect_pinning_count==cache->fail_as_pinning_count)
+		if(cli_st->suspect_pinning_count==cache->fail_as_cli_pinning_count)
 		{
 			cache->stat.pinning_cli_cnt++;
 		}
 	}
-	else if(status->pinning_status==PINNING_ST_PINNING)
+	else if(status->cli_pinning_status==PINNING_ST_PINNING)
 	{
-		cli_st->suspect_pinning_count=cache->fail_as_pinning_count;
+		cli_st->suspect_pinning_count=cache->fail_as_cli_pinning_count;
 	}
 	if(status->has_protocol_errors)
 	{
@@ -238,10 +275,49 @@ static long srv_st_write_cb(void * data, const uchar * key, uint size, void * us
 //	assert(srv_st->ev_st_switched<2&&srv_st->ct_st_switched<2);
 	return 1;
 }
+static long app_st_read_cb(void * data, const uchar * key, uint size, void * user_arg)
+{
+	struct ssl_svc_app_st* app_st=(struct ssl_svc_app_st*)data;
+	struct ssl_service_status* result=(struct ssl_service_status*)user_arg;
+	if (app_st == NULL)
+	{
+		return 0;
+	}
+	if(app_st->down_ssl_success_cnt>app_st->ref_svc_cache->succ_as_app_not_pinning_count)
+	{
+		result->is_app_not_pinning=1;
+	}
+	return 1;
+
+}
+static long app_st_write_cb(void * data, const uchar * key, uint size, void * user_arg)
+{
+	struct ssl_svc_app_st* app_st=(struct ssl_svc_app_st*)data;
+	struct ssl_service_write_args* args=(struct ssl_service_write_args*)user_arg;
+	const struct ssl_service_status* status=args->status;
+	struct ssl_service_cache* cache=args->cache;
+	UNUSED int ret = 0;
+	if(app_st==NULL)
+	{
+		app_st=ALLOC(struct ssl_svc_app_st, 1);
+		app_st->ref_svc_cache=cache;
+		ret = MESA_htable_add(cache->srv_st_hash, key, size, app_st);
+		assert(ret >= 0);
+	}
+	if(status->is_app_not_pinning)
+	{
+		app_st->down_ssl_success_cnt++;
+	}
+	if(app_st->down_ssl_success_cnt>cache->succ_as_app_not_pinning_count)
+	{
+		cache->stat.app_not_pinning_cnt++;
+	}
+	return 1;
+}
 
 int ssl_service_cache_read(struct ssl_service_cache* svc_cache, const struct ssl_chello* chello, const struct tfe_stream_addr * addr, struct ssl_service_status* result)
 {
-	long cli_st_cb_ret=0, svr_st_cb_ret=0;
+	long cli_st_cb_ret=0, svr_st_cb_ret=0, app_st_cb_ret=0;
 	char hash_key[2048];
 	size_t hash_key_sz=0;
 	if(chello->sni==NULL)
@@ -252,7 +328,10 @@ int ssl_service_cache_read(struct ssl_service_cache* svc_cache, const struct ssl
 	MESA_htable_search_cb(svc_cache->cli_st_hash, (unsigned char*) hash_key, (unsigned int) hash_key_sz, cli_st_read_cb, result, &cli_st_cb_ret);	
 	hash_key_sz=ssl_svc_server_st_mk_key(chello, addr, hash_key, sizeof(hash_key));
 	MESA_htable_search_cb(svc_cache->srv_st_hash, (unsigned char*) hash_key, (unsigned int) hash_key_sz, srv_st_read_cb, result, &svr_st_cb_ret);
-	if(cli_st_cb_ret||svr_st_cb_ret)
+	hash_key_sz=ssl_svc_app_st_mk_key(chello, addr, hash_key, sizeof(hash_key));
+	MESA_htable_search_cb(svc_cache->srv_st_hash, (unsigned char*) hash_key, (unsigned int) hash_key_sz, app_st_read_cb, result, &app_st_cb_ret);
+
+	if(cli_st_cb_ret||svr_st_cb_ret||app_st_cb_ret)
 	{
 		return 1;
 	}
@@ -273,7 +352,7 @@ void ssl_service_cache_write(struct ssl_service_cache* svc_cache, const struct s
 		return;
 	}
 	struct ssl_service_write_args write_args={svc_cache, status};
-	if(status->is_mutual_auth||status->pinning_status!=PINNING_ST_NOT_PINNING||status->has_protocol_errors)
+	if(status->is_mutual_auth||status->cli_pinning_status!=PINNING_ST_NOT_PINNING||status->has_protocol_errors)
 	{
 		hash_key_sz=ssl_svc_client_st_mk_key(chello, addr, hash_key, sizeof(hash_key));
 		MESA_htable_search_cb(svc_cache->cli_st_hash, (unsigned char*)hash_key, (unsigned int) hash_key_sz, cli_st_write_cb, &write_args, &cli_st_cb_ret);	
@@ -283,19 +362,25 @@ void ssl_service_cache_write(struct ssl_service_cache* svc_cache, const struct s
 		hash_key_sz=ssl_svc_server_st_mk_key(chello, addr, hash_key, sizeof(hash_key));
 		MESA_htable_search_cb(svc_cache->srv_st_hash, (unsigned char*)hash_key, (unsigned int) hash_key_sz, srv_st_write_cb, &write_args, &svr_st_cb_ret);
 	}
+	if(status->is_app_not_pinning)
+	{
+		hash_key_sz=ssl_svc_app_st_mk_key(chello, addr, hash_key, sizeof(hash_key));
+		MESA_htable_search_cb(svc_cache->app_st_hash, (unsigned char*)hash_key, (unsigned int) hash_key_sz, app_st_write_cb, &write_args, &svr_st_cb_ret);
+	}
 }
 struct ssl_service_cache* ssl_service_cache_create(unsigned int slot_size, unsigned int expire_seconds, int fail_as_pinning_cnt, int fail_as_proto_err_cnt, int fail_time_win)
 {
 	struct ssl_service_cache * cache = ALLOC(struct ssl_service_cache, 1);
 	unsigned max_num = slot_size * 4;
 	UNUSED int ret = 0;
-	MESA_htable_handle htable=NULL, saved[2];
+	MESA_htable_handle htable=NULL, saved[3];
 	int i=0, opt_val=0;
-	cache->fail_as_pinning_count=fail_as_pinning_cnt;
+	cache->fail_as_cli_pinning_count=fail_as_pinning_cnt;
 	cache->fail_as_proto_err_count=fail_as_proto_err_cnt;
 	cache->fail_time_window=fail_time_win;
-	void (*free_func[])(void *)={ssl_svc_free_client_st, ssl_svc_free_server_st};
-	for(i=0; i<2; i++)
+	cache->succ_as_app_not_pinning_count=4;//TODO: read from profile.
+	void (*free_func[])(void *)={ssl_svc_free_client_st, ssl_svc_free_server_st, ssl_svc_free_app_st};
+	for(i=0; i<3; i++)
 	{
 		htable = MESA_htable_born();
 		opt_val=0;
@@ -320,7 +405,7 @@ struct ssl_service_cache* ssl_service_cache_create(unsigned int slot_size, unsig
 	}
 	cache->cli_st_hash=saved[0];
 	cache->srv_st_hash=saved[1];
-	
+	cache->app_st_hash=saved[3];
 	return cache;
 }
 void ssl_service_cache_destroy(struct ssl_service_cache* cache)