TSG-2967 TFE 使用 JA3 优化 SSL pinning

1 files changed, 68 insertions, 38 deletions

diff --git a/platform/src/ssl_service_cache.cpp b/platform/src/ssl_service_cache.cpp
index f4c9690..1327a16 100644
--- a/platform/src/ssl_service_cache.cpp
+++ b/platform/src/ssl_service_cache.cpp
@@ -86,14 +86,38 @@ static size_t ssl_svc_server_st_mk_key(const struct ssl_chello* chello,  const s
 	free(addr_str);
 	return key_len;
 }
-static size_t ssl_svc_app_st_mk_key(const struct ssl_chello* chello,  const struct tfe_stream_addr * addr, char* key_buff, size_t sz)
+static size_t ssl_svc_app_st_mk_key(const struct ssl_chello *chello, const struct tfe_stream *tcp_stream, char *key_buff, size_t sz)
 {
-	size_t key_len=0;
-	const char* sip=NULL, *sport=NULL, *dip=NULL, *dport=NULL;
-	char * addr_str= tfe_stream_addr_to_str(addr);
-	tfe_stream_addr_str_split(addr_str, &sip, &sport, &dip, &dport);
+    char ja3_val[64] = {0};
+    uint16_t ja3_len = 0;
+    size_t key_len = 0;
+    const char *sip = NULL, *sport = NULL, *dip = NULL, *dport = NULL;
+    char *addr_str = tfe_stream_addr_to_str(tcp_stream->addr);
+    struct tfe_cmsg *cmsg = tfe_stream_get0_cmsg(tcp_stream);
+    if (cmsg != NULL)
+    {
+        int ret = tfe_cmsg_get_value(cmsg, TFE_CMSG_SSL_CLIENT_JA3_FINGERPRINT, (unsigned char *)ja3_val, sizeof(ja3_val), &ja3_len);
+        if (ret != 0)
+        {
+            TFE_LOG_ERROR(g_default_logger, "failed at fetch ssl client ja3 fingerprint from cmsg: %s, %s", strerror(-ret), addr_str);
+        }
+		else
+		{
+            TFE_LOG_DEBUG(g_default_logger, "fetch ssl client ja3 fingerprint:%s addr: %s", ja3_val, addr_str);
+        }	
+    }
+    tfe_stream_addr_str_split(addr_str, &sip, &sport, &dip, &dport);
 
-	key_len=snprintf(key_buff, sz, "%d:%d:%s:%s", chello->min_version.ossl_format, 
+    // If ja3 is successfully obtained, use ja3 to generate hashkey
+    if (strlen(ja3_val))
+    {
+        key_len = snprintf(key_buff, sz, "%s:%s", ja3_val, chello->sni ? chello->sni : dip);
+        free(addr_str);
+        return key_len;
+    }
+
+    // otherwise, splicing ssl attributes to generate hashkey
+    key_len=snprintf(key_buff, sz, "%d:%d:%s:%s", chello->min_version.ossl_format, 
 												chello->max_version.ossl_format,
 												chello->sni?chello->sni: dip ,
 												chello->alpn?chello->alpn:"null");
@@ -115,18 +139,18 @@ static size_t ssl_svc_app_st_mk_key(const struct ssl_chello* chello,  const stru
 	free(addr_str);
 	return key_len;
 }
-static size_t ssl_svc_client_st_mk_key(const struct ssl_chello* chello, const struct tfe_stream_addr * addr, char* key_buff, size_t sz)
+static size_t ssl_svc_client_st_mk_key(const struct ssl_chello *chello, const struct tfe_stream *tcp_stream, char *key_buff, size_t sz)
 {
 	size_t key_len=0;
 	const char* sip=NULL, *sport=NULL, *dip=NULL, *dport=NULL;
-	char * addr_str= tfe_stream_addr_to_str(addr);
-	tfe_stream_addr_str_split(addr_str, &sip, &sport, &dip, &dport);
+    char *addr_str = tfe_stream_addr_to_str(tcp_stream->addr);
+    tfe_stream_addr_str_split(addr_str, &sip, &sport, &dip, &dport);
 	char chello_id_buff[sz];
 	size_t chello_id_len=0;
 
 	key_len=snprintf(key_buff, sz, "%s:", sip);
-	chello_id_len=ssl_svc_app_st_mk_key(chello, addr, chello_id_buff, sizeof(chello_id_buff));
-	memcpy(key_buff+key_len, chello_id_buff, MIN(chello_id_len, sz-key_len));
+    chello_id_len = ssl_svc_app_st_mk_key(chello, tcp_stream, chello_id_buff, sizeof(chello_id_buff));
+    memcpy(key_buff+key_len, chello_id_buff, MIN(chello_id_len, sz-key_len));
 	key_len += MIN(chello_id_len, sz-key_len);
 
 	free(addr_str);
@@ -305,7 +329,7 @@ static long app_st_write_cb(void * data, const uchar * key, uint size, void * us
 	return 1;
 }
 
-int ssl_service_cache_read(struct ssl_service_cache* svc_cache, const struct ssl_chello* chello, const struct tfe_stream_addr * addr, struct ssl_service_status* result)
+int ssl_service_cache_read(struct ssl_service_cache *svc_cache, const struct ssl_chello *chello, const struct tfe_stream *tcp_stream, struct ssl_service_status *result)
 {
 	long cli_st_cb_ret=0, svr_st_cb_ret=0, app_st_cb_ret=0;
 	char temp_key[2048];
@@ -317,26 +341,29 @@ int ssl_service_cache_read(struct ssl_service_cache* svc_cache, const struct ssl
 		return 0;
 	}
 
-	char * addr_str= tfe_stream_addr_to_str(addr);
+	char * addr_str= tfe_stream_addr_to_str(tcp_stream->addr);
 	memset(hash_key, 0, sizeof(hash_key));
-	temp_key_sz = ssl_svc_client_st_mk_key(chello, addr, temp_key, sizeof(temp_key));
-	hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
+    temp_key_sz = ssl_svc_client_st_mk_key(chello, tcp_stream, temp_key, sizeof(temp_key));
+    hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
 	MESA_htable_search_cb(svc_cache->cli_st_hash, hash_key, (unsigned int) hash_key_sz, cli_st_read_cb, result, &cli_st_cb_ret);
-	TFE_LOG_DEBUG(g_default_logger, "ssl svc read client table, hash:%s, found:%d, sni:%s, addr:%s", hash_key, cli_st_cb_ret, chello->sni, addr_str);
+	TFE_LOG_DEBUG(g_default_logger, "client table, hash:%s, found:%d, sni:%s, addr:%s, mutual:%d, pinning:%d, err:%d",
+				hash_key, cli_st_cb_ret, chello->sni, addr_str, result->is_mutual_auth, result->cli_pinning_status, result->has_protocol_errors);
 
 	memset(hash_key, 0, sizeof(hash_key));
-	temp_key_sz = ssl_svc_server_st_mk_key(chello, addr, temp_key, sizeof(temp_key));
-	hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
+    temp_key_sz = ssl_svc_server_st_mk_key(chello, tcp_stream->addr, temp_key, sizeof(temp_key));
+    hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
 	MESA_htable_search_cb(svc_cache->srv_st_hash, hash_key, (unsigned int) hash_key_sz, srv_st_read_cb, result, &svr_st_cb_ret);
-	TFE_LOG_DEBUG(g_default_logger, "ssl svc read server table, hash:%s, found:%d, sni:%s, addr:%s", hash_key, svr_st_cb_ret, chello->sni, addr_str);
+	TFE_LOG_DEBUG(g_default_logger, "server table, hash:%s, found:%d, sni:%s, addr:%s, ct:%d, ev:%d",
+				hash_key, svr_st_cb_ret, chello->sni, addr_str, result->is_ct, result->is_ev);
 
 	memset(hash_key, 0, sizeof(hash_key));
-	temp_key_sz = ssl_svc_app_st_mk_key(chello, addr, temp_key, sizeof(temp_key));
-	hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
+    temp_key_sz = ssl_svc_app_st_mk_key(chello, tcp_stream, temp_key, sizeof(temp_key));
+    hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
 	MESA_htable_search_cb(svc_cache->app_st_hash, hash_key, (unsigned int) hash_key_sz, app_st_read_cb, result, &app_st_cb_ret);
-	TFE_LOG_DEBUG(g_default_logger, "ssl svc read app table, hash:%s, found:%d, sni:%s, addr:%s", hash_key, app_st_cb_ret, chello->sni, addr_str);
+    TFE_LOG_DEBUG(g_default_logger, "app table, hash:%s, found:%d, sni:%s, addr:%s, app_not_pinning:%d",
+				hash_key, app_st_cb_ret, chello->sni, addr_str, result->is_app_not_pinning);
 
-	free(addr_str);
+    free(addr_str);
 
 	if(cli_st_cb_ret||svr_st_cb_ret||app_st_cb_ret)
 	{
@@ -348,7 +375,7 @@ int ssl_service_cache_read(struct ssl_service_cache* svc_cache, const struct ssl
 	}
 }
 
-void ssl_service_cache_write(struct ssl_service_cache* svc_cache, const struct ssl_chello* chello, const struct tfe_stream_addr * addr, const struct ssl_service_status* status)
+void ssl_service_cache_write(struct ssl_service_cache *svc_cache, const struct ssl_chello *chello, const struct tfe_stream *tcp_stream, const struct ssl_service_status *status)
 {
 	long cli_st_cb_ret=0, svr_st_cb_ret=0;
 	char temp_key[2048];
@@ -360,31 +387,34 @@ void ssl_service_cache_write(struct ssl_service_cache* svc_cache, const struct s
 	{
 		return;
 	}
-	char * addr_str= tfe_stream_addr_to_str(addr);
-	struct ssl_service_write_args write_args={svc_cache, status};
+    char *addr_str = tfe_stream_addr_to_str(tcp_stream->addr);
+    struct ssl_service_write_args write_args={svc_cache, status};
 	if(status->is_mutual_auth||status->cli_pinning_status!=PINNING_ST_NOT_PINNING||status->has_protocol_errors)
 	{
 		memset(hash_key, 0, sizeof(hash_key));
-		temp_key_sz = ssl_svc_client_st_mk_key(chello, addr, temp_key, sizeof(temp_key));
-		hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
-		TFE_LOG_DEBUG(g_default_logger, "ssl svc write client table, hash:%s, sni:%s, addr:%s", hash_key, chello->sni, addr_str);
-		MESA_htable_search_cb(svc_cache->cli_st_hash, hash_key, (unsigned int) hash_key_sz, cli_st_write_cb, &write_args, &cli_st_cb_ret);	
+        temp_key_sz = ssl_svc_client_st_mk_key(chello, tcp_stream, temp_key, sizeof(temp_key));
+        hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
+        TFE_LOG_DEBUG(g_default_logger, "client table, hash:%s, sni:%s, addr:%s, mutual:%d, pinning:%d, err:%d",
+                      hash_key, chello->sni, addr_str, status->is_mutual_auth, status->cli_pinning_status, status->has_protocol_errors);
+        MESA_htable_search_cb(svc_cache->cli_st_hash, hash_key, (unsigned int) hash_key_sz, cli_st_write_cb, &write_args, &cli_st_cb_ret);	
 	}
 	if(status->is_ct||status->is_ev)
 	{	
 		memset(hash_key, 0, sizeof(hash_key));
-		temp_key_sz = ssl_svc_server_st_mk_key(chello, addr, temp_key, sizeof(temp_key));
-		hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
-		TFE_LOG_DEBUG(g_default_logger, "ssl svc write server table, hash:%s, sni:%s, addr:%s", hash_key, chello->sni, addr_str);
-		MESA_htable_search_cb(svc_cache->srv_st_hash, hash_key, (unsigned int) hash_key_sz, srv_st_write_cb, &write_args, &svr_st_cb_ret);
+        temp_key_sz = ssl_svc_server_st_mk_key(chello, tcp_stream->addr, temp_key, sizeof(temp_key));
+        hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
+        TFE_LOG_DEBUG(g_default_logger, "server table, hash:%s, sni:%s, addr:%s, ct:%d, ev:%d",
+                      hash_key, chello->sni, addr_str, status->is_ct, status->is_ev);
+        MESA_htable_search_cb(svc_cache->srv_st_hash, hash_key, (unsigned int) hash_key_sz, srv_st_write_cb, &write_args, &svr_st_cb_ret);
 	}
 	if(status->is_app_not_pinning)
 	{
 		memset(hash_key, 0, sizeof(hash_key));
-		temp_key_sz = ssl_svc_app_st_mk_key(chello, addr, temp_key, sizeof(temp_key));
-		hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
-		TFE_LOG_DEBUG(g_default_logger, "ssl svc write app table, hash:%s, sni:%s, addr:%s", hash_key, chello->sni, addr_str);
-		MESA_htable_search_cb(svc_cache->app_st_hash, hash_key, (unsigned int) hash_key_sz, app_st_write_cb, &write_args, &svr_st_cb_ret);
+        temp_key_sz = ssl_svc_app_st_mk_key(chello, tcp_stream, temp_key, sizeof(temp_key));
+        hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key;
+        TFE_LOG_DEBUG(g_default_logger, "app table, hash:%s, sni:%s, addr:%s, app_not_pinning:%d",
+					hash_key, chello->sni, addr_str, status->is_app_not_pinning);
+        MESA_htable_search_cb(svc_cache->app_st_hash, hash_key, (unsigned int) hash_key_sz, app_st_write_cb, &write_args, &svr_st_cb_ret);
 	}
 
 	free(addr_str);