可以检测certificate pinning和mutual authentication。

1 files changed, 247 insertions, 0 deletions

diff --git a/platform/src/ssl_service_cache.cpp b/platform/src/ssl_service_cache.cpp
new file mode 100644
index 0000000..633361b
--- /dev/null
+++ b/platform/src/ssl_service_cache.cpp
@@ -0,0 +1,247 @@
+#include <ssl_service_cache.h>
+#include <tfe_utils.h>
+#include <MESA/MESA_htable.h>
+#include <stdlib.h>
+#include <string.h>
+
+#define	FAIL_AS_PINNING_COUNT	4
+#define	FAIL_AS_PINNING_TIME	30
+struct ssl_service_client_st
+{
+	time_t last_update_time;
+	unsigned int fail_count;
+	char is_mutual_auth;
+};
+struct ssl_service_server_st
+{
+	char is_ev;
+	char is_ct;
+	long long ev_st_switched;
+	long long ct_st_switched;
+};
+struct ssl_service_cache
+{
+	MESA_htable_handle cli_st_hash;
+	MESA_htable_handle srv_st_hash;
+	long long pinning_cli_cnt, mutual_auth_cli_cnt, ev_srv_cnt, ct_srv_cnt;
+};
+struct ssl_service_write_args
+{
+	struct ssl_service_cache* cache;
+	const struct ssl_service_status* status;
+};
+static size_t ssl_service_client_st_mk_key(const struct ssl_chello* chello, char* key_buff, size_t sz)
+{
+	size_t key_sz=0;
+	key_sz=snprintf(key_buff, sz, "%d.%d-%d.%d:%s:%s:%s:%s", chello->min_version.major, chello->min_version.minor,
+													chello->max_version.major, chello->max_version.minor,
+													chello->sni, chello->alpn, chello->cipher_suites, chello->cipher_suites_tls13);
+	return key_sz;
+}
+static long cli_st_read_cb(void * data, const uchar * key, uint size, void * user_arg)
+{
+	struct ssl_service_client_st* cli_st=(struct ssl_service_client_st*)data;
+	struct ssl_service_status* result=(struct ssl_service_status*)user_arg;
+	
+	if (cli_st == NULL)
+	{
+		return 0;
+	}
+	if(cli_st->fail_count==0)
+	{		
+		result->pinning_status=PINNING_ST_NOT_PINNING;
+	}
+	else if(cli_st->fail_count<FAIL_AS_PINNING_COUNT)
+	{
+		result->pinning_status=PINNING_ST_MAYBE_PINNING;
+	}
+	else
+	{
+		result->pinning_status=PINNING_ST_PINNING;
+	}
+	result->is_mutual_auth=cli_st->is_mutual_auth;
+	return 1;
+}
+static long cli_st_write_cb(void * data, const uchar * key, uint size, void * user_arg)
+{
+	struct ssl_service_client_st* cli_st=(struct ssl_service_client_st*)data;
+	struct ssl_service_write_args* args=(struct ssl_service_write_args*)user_arg;
+	const struct ssl_service_status* status=args->status;
+	struct ssl_service_cache* cache=args->cache;
+	UNUSED int ret = 0;
+	time_t now=time(NULL);
+	if(cli_st==NULL)
+	{
+		cli_st=ALLOC(struct ssl_service_client_st, 1);
+		ret = MESA_htable_add(cache->cli_st_hash, key, size, cli_st);
+		assert(ret >= 0);
+	}
+	if(cli_st->fail_count<FAIL_AS_PINNING_COUNT && cli_st->last_update_time-now>FAIL_AS_PINNING_TIME)
+	{
+		cli_st->fail_count=0;
+	}
+	if(status->pinning_status!=PINNING_ST_NOT_PINNING && cli_st->fail_count<FAIL_AS_PINNING_COUNT)
+	{
+		if(status->pinning_status==PINNING_ST_PINNING)
+		{
+			cli_st->fail_count=FAIL_AS_PINNING_COUNT;
+		}
+		else
+		{
+			cli_st->fail_count++;
+		}
+		cli_st->last_update_time=now;
+		if(cli_st->fail_count==FAIL_AS_PINNING_COUNT)
+		{
+			cache->pinning_cli_cnt++;
+		}
+	}
+	else if(status->pinning_status==PINNING_ST_PINNING)
+	{
+		cli_st->fail_count=FAIL_AS_PINNING_COUNT;
+		cli_st->last_update_time=now;
+	}
+
+	if(status->is_mutual_auth==1&&cli_st->is_mutual_auth==0)
+	{
+		cache->mutual_auth_cli_cnt++;	
+		cli_st->is_mutual_auth=1;
+	}
+	return 1;
+}
+
+static long srv_st_read_cb(void * data, const uchar * key, uint size, void * user_arg)
+{
+	struct ssl_service_server_st* srv_st=(struct ssl_service_server_st*)data;
+	struct ssl_service_status* result=(struct ssl_service_status*)user_arg;
+	if (srv_st == NULL)
+	{
+		return 0;
+	}
+	result->is_ct=srv_st->is_ct;
+	result->is_ev=srv_st->is_ev;
+	return 1;
+}
+static long srv_st_write_cb(void * data, const uchar * key, uint size, void * user_arg)
+{
+	struct ssl_service_server_st* srv_st=(struct ssl_service_server_st*)data;
+	struct ssl_service_write_args* args=(struct ssl_service_write_args*)user_arg;
+	const struct ssl_service_status* status=args->status;
+	struct ssl_service_cache* cache=args->cache;
+	UNUSED int ret = 0;
+	if(srv_st==NULL)
+	{
+		srv_st=ALLOC(struct ssl_service_server_st, 1);
+		ret = MESA_htable_add(cache->srv_st_hash, key, size, srv_st);
+		assert(ret >= 0);
+	}
+	if(status->is_ev==1&&srv_st->is_ev==0)
+	{
+		srv_st->is_ev=1;
+		cache->ev_srv_cnt++;
+	}
+	if(status->is_ev!=srv_st->is_ev)
+	{
+		srv_st->ev_st_switched++;
+	}
+	if(status->is_ct==1&&srv_st->is_ct==0)
+	{
+		srv_st->is_ct=1;
+		cache->ct_srv_cnt++;
+	}
+	if(status->is_ct!=srv_st->is_ct)
+	{
+		srv_st->ct_st_switched++;
+	}
+	assert(srv_st->ev_st_switched<2&&srv_st->ct_st_switched<2);
+	return 1;
+}
+
+int ssl_service_cache_read(struct ssl_service_cache* svc_cache, const struct ssl_chello* chello, struct ssl_service_status* result)
+{
+	long cli_st_cb_ret=0, svr_st_cb_ret=0;
+	char cli_st_key[2048];
+	size_t cli_st_key_sz=0;
+	if(chello->sni==NULL)
+	{
+		return 0;
+	}
+	cli_st_key_sz=ssl_service_client_st_mk_key(chello, cli_st_key, sizeof(cli_st_key));
+	MESA_htable_search_cb(svc_cache->cli_st_hash, (unsigned char*) cli_st_key, (unsigned int) cli_st_key_sz, cli_st_read_cb, result, &cli_st_cb_ret);	
+	MESA_htable_search_cb(svc_cache->srv_st_hash, (unsigned char*) chello->sni, (unsigned int) strlen(chello->sni), srv_st_read_cb, result, &svr_st_cb_ret);
+	if(cli_st_cb_ret||svr_st_cb_ret)
+	{
+		return 1;
+	}
+	else
+	{
+		return 0;
+	}
+}
+
+void ssl_service_cache_write(struct ssl_service_cache* svc_cache, const struct ssl_chello* chello, const struct ssl_service_status* status)
+{
+	long cli_st_cb_ret=0, svr_st_cb_ret=0;
+	char cli_st_key[2048];
+	size_t cli_st_key_sz=0;
+	if(chello->sni==NULL)
+	{
+		return;
+	}
+	struct ssl_service_write_args write_args={svc_cache, status};
+	if(status->is_mutual_auth||status->pinning_status!=PINNING_ST_NOT_PINNING)
+	{
+		cli_st_key_sz=ssl_service_client_st_mk_key(chello, cli_st_key, sizeof(cli_st_key));
+		MESA_htable_search_cb(svc_cache->cli_st_hash, (unsigned char*)cli_st_key, (unsigned int) cli_st_key_sz, cli_st_write_cb, &write_args, &cli_st_cb_ret);	
+	}
+	if(status->is_ct||status->is_ev)
+	{
+		MESA_htable_search_cb(svc_cache->srv_st_hash, (unsigned char*)chello->sni, (unsigned int) strlen(chello->sni), srv_st_write_cb, &write_args, &svr_st_cb_ret);
+	}
+}
+struct ssl_service_cache* ssl_service_cache_create(unsigned int slot_size, unsigned int expire_seconds)
+{
+	struct ssl_service_cache * cache = ALLOC(struct ssl_service_cache, 1);
+	unsigned max_num = slot_size * 4;
+	UNUSED int ret = 0;
+	MESA_htable_handle htable=NULL, saved[2];
+	int i=0, opt_val=0;
+	for(i=0; i<2; i++)
+	{
+		htable = MESA_htable_born();
+		opt_val=0;
+		ret = MESA_htable_set_opt(htable, MHO_SCREEN_PRINT_CTRL, &opt_val, sizeof(opt_val));
+		opt_val=1;
+		ret = MESA_htable_set_opt(htable, MHO_THREAD_SAFE, &opt_val, sizeof(opt_val));
+		opt_val=16;
+		ret = MESA_htable_set_opt(htable, MHO_MUTEX_NUM, &opt_val, sizeof(opt_val));
+		ret = MESA_htable_set_opt(htable, MHO_HASH_SLOT_SIZE, &slot_size, sizeof(slot_size));
+		ret = MESA_htable_set_opt(htable, MHO_HASH_MAX_ELEMENT_NUM, &max_num, sizeof(max_num));
+		ret = MESA_htable_set_opt(htable, MHO_EXPIRE_TIME, &expire_seconds, sizeof(expire_seconds));
+		
+		opt_val=HASH_ELIMINATE_ALGO_LRU;
+		ret = MESA_htable_set_opt(htable, MHO_ELIMIMINATE_TYPE,
+			&opt_val, sizeof(int));
+		ret = MESA_htable_set_opt(htable, MHO_CBFUN_DATA_FREE,
+			(void *)free, sizeof(&free));
+		
+		ret = MESA_htable_mature(htable);
+		assert(ret == 0);
+		saved[i]=htable;
+	}
+	cache->cli_st_hash=saved[0];
+	cache->srv_st_hash=saved[1];
+	
+	return cache;
+}
+void ssl_service_cache_destroy(struct ssl_service_cache* cache)
+{
+	MESA_htable_destroy(cache->cli_st_hash, NULL);
+	cache->cli_st_hash=NULL;
+	MESA_htable_destroy(cache->srv_st_hash, NULL);
+	cache->srv_st_hash=NULL;
+	free(cache);
+	return;
+}
+
+