1、使用服务器IP+端口+sni生成服务端状态 #141，使用客户端IP+Client hello特征生成客户端状态。2、pinning detection的相关阈值可从tfe.conf中配置。

1 files changed, 47 insertions, 25 deletions

diff --git a/platform/src/ssl_service_cache.cpp b/platform/src/ssl_service_cache.cpp
index 3937486..55e1aee 100644
--- a/platform/src/ssl_service_cache.cpp
+++ b/platform/src/ssl_service_cache.cpp
@@ -28,6 +28,9 @@ struct ssl_service_cache
 	MESA_htable_handle cli_st_hash;
 	MESA_htable_handle srv_st_hash;
 	struct ssl_service_cache_statistics stat;
+	unsigned int fail_as_pinning_count;
+	unsigned int fail_as_proto_err_count;
+	unsigned int fail_time_window;
 };
 struct ssl_service_write_args
 {
@@ -64,11 +67,24 @@ static void ssl_svc_free_server_st(void * data)
 	free(p);
 	return;
 }
-
-static size_t ssl_svc_client_st_mk_key(const struct ssl_chello* chello, char* key_buff, size_t sz)
+static size_t ssl_svc_server_st_mk_key(const struct ssl_chello* chello, const struct tfe_stream_addr * addr, char* key_buff, size_t sz)
+{
+	size_t key_len=0;
+	const char* sip=NULL, *sport=NULL, *dip=NULL, *dport=NULL;
+	char * addr_str= tfe_stream_addr_to_str(addr);
+	tfe_stream_addr_str_split(addr_str, &sip, &sport, &dip, &dport);
+	key_len=snprintf(key_buff, sz, "%s:%s:%s:", dip, dport, chello->sni);
+	free(addr_str);
+	return key_len;
+}
+static size_t ssl_svc_client_st_mk_key(const struct ssl_chello* chello, const struct tfe_stream_addr * addr, char* key_buff, size_t sz)
 {
 	size_t key_len=0;
-	key_len=snprintf(key_buff, sz, "%d:%d:%s:%s:", chello->min_version.ossl_format, 
+	const char* sip=NULL, *sport=NULL, *dip=NULL, *dport=NULL;
+	char * addr_str= tfe_stream_addr_to_str(addr);
+	tfe_stream_addr_str_split(addr_str, &sip, &sport, &dip, &dport);
+	key_len=snprintf(key_buff, sz, "%s:%d:%d:%s:%s:", sip, 
+													chello->min_version.ossl_format, 
 													chello->max_version.ossl_format,
 													chello->sni, chello->alpn?chello->alpn:"null");
 	if(chello->cipher_suites && sz-key_len>chello->cipher_suites_len)
@@ -86,6 +102,7 @@ static size_t ssl_svc_client_st_mk_key(const struct ssl_chello* chello, char* ke
 		memcpy(key_buff+key_len, chello->supported_groups, chello->supported_groups_len);
 		key_len+=chello->supported_groups_len;
 	}
+	free(addr_str);
 	return key_len;
 }
 static long cli_st_read_cb(void * data, const uchar * key, uint size, void * user_arg)
@@ -131,34 +148,34 @@ static long cli_st_write_cb(void * data, const uchar * key, uint size, void * us
 		ret = MESA_htable_add(cache->cli_st_hash, key, size, cli_st);
 		assert(ret >= 0);
 	}
-	if(cli_st->last_update_time-now>FAIL_TIME_WINDOW)
+	if(cli_st->last_update_time-now>cache->fail_time_window)
 	{
-		if(cli_st->suspect_pinning_count<FAIL_AS_PINNING_COUNT)		cli_st->suspect_pinning_count=0;
-		if(cli_st->protocol_error_count<FAIL_AS_PROTO_ERR_COUNT)	cli_st->protocol_error_count=0;
+		if(cli_st->suspect_pinning_count<cache->fail_as_pinning_count)	cli_st->suspect_pinning_count=0;
+		if(cli_st->protocol_error_count<cache->fail_as_proto_err_count)	cli_st->protocol_error_count=0;
 	}
-	if(status->pinning_status!=PINNING_ST_NOT_PINNING && cli_st->suspect_pinning_count<FAIL_AS_PINNING_COUNT)
+	if(status->pinning_status!=PINNING_ST_NOT_PINNING && cli_st->suspect_pinning_count<cache->fail_as_pinning_count)
 	{
 		if(status->pinning_status==PINNING_ST_PINNING)
 		{
-			cli_st->suspect_pinning_count=FAIL_AS_PINNING_COUNT;
+			cli_st->suspect_pinning_count=cache->fail_as_pinning_count;
 		}
 		else
 		{
 			cli_st->suspect_pinning_count++;
 		}
-		if(cli_st->suspect_pinning_count==FAIL_AS_PINNING_COUNT)
+		if(cli_st->suspect_pinning_count==cache->fail_as_pinning_count)
 		{
 			cache->stat.pinning_cli_cnt++;
 		}
 	}
 	else if(status->pinning_status==PINNING_ST_PINNING)
 	{
-		cli_st->suspect_pinning_count=FAIL_AS_PINNING_COUNT;
+		cli_st->suspect_pinning_count=cache->fail_as_pinning_count;
 	}
 	if(status->has_protocol_errors)
 	{
 		cli_st->protocol_error_count++;
-		if(cli_st->protocol_error_count==FAIL_AS_PROTO_ERR_COUNT)
+		if(cli_st->protocol_error_count==cache->fail_as_proto_err_count)
 		{
 			cache->stat.proto_err_cli_cnt++;
 		}
@@ -220,18 +237,19 @@ static long srv_st_write_cb(void * data, const uchar * key, uint size, void * us
 	return 1;
 }
 
-int ssl_service_cache_read(struct ssl_service_cache* svc_cache, const struct ssl_chello* chello, struct ssl_service_status* result)
+int ssl_service_cache_read(struct ssl_service_cache* svc_cache, const struct ssl_chello* chello, const struct tfe_stream_addr * addr, struct ssl_service_status* result)
 {
 	long cli_st_cb_ret=0, svr_st_cb_ret=0;
-	char cli_st_key[2048];
-	size_t cli_st_key_sz=0;
+	char hash_key[2048];
+	size_t hash_key_sz=0;
 	if(chello->sni==NULL)
 	{
 		return 0;
 	}
-	cli_st_key_sz=ssl_svc_client_st_mk_key(chello, cli_st_key, sizeof(cli_st_key));
-	MESA_htable_search_cb(svc_cache->cli_st_hash, (unsigned char*) cli_st_key, (unsigned int) cli_st_key_sz, cli_st_read_cb, result, &cli_st_cb_ret);	
-	MESA_htable_search_cb(svc_cache->srv_st_hash, (unsigned char*) chello->sni, (unsigned int) strlen(chello->sni), srv_st_read_cb, result, &svr_st_cb_ret);
+	hash_key_sz=ssl_svc_client_st_mk_key(chello, addr, hash_key, sizeof(hash_key));
+	MESA_htable_search_cb(svc_cache->cli_st_hash, (unsigned char*) hash_key, (unsigned int) hash_key_sz, cli_st_read_cb, result, &cli_st_cb_ret);	
+	hash_key_sz=ssl_svc_server_st_mk_key(chello, addr, hash_key, sizeof(hash_key));
+	MESA_htable_search_cb(svc_cache->srv_st_hash, (unsigned char*) hash_key, (unsigned int) hash_key_sz, srv_st_read_cb, result, &svr_st_cb_ret);
 	if(cli_st_cb_ret||svr_st_cb_ret)
 	{
 		return 1;
@@ -242,11 +260,11 @@ int ssl_service_cache_read(struct ssl_service_cache* svc_cache, const struct ssl
 	}
 }
 
-void ssl_service_cache_write(struct ssl_service_cache* svc_cache, const struct ssl_chello* chello, const struct ssl_service_status* status)
+void ssl_service_cache_write(struct ssl_service_cache* svc_cache, const struct ssl_chello* chello, const struct tfe_stream_addr * addr, const struct ssl_service_status* status)
 {
 	long cli_st_cb_ret=0, svr_st_cb_ret=0;
-	char cli_st_key[2048];
-	size_t cli_st_key_sz=0;
+	char hash_key[2048];
+	size_t hash_key_sz=0;
 	if(chello->sni==NULL)
 	{
 		return;
@@ -254,21 +272,25 @@ void ssl_service_cache_write(struct ssl_service_cache* svc_cache, const struct s
 	struct ssl_service_write_args write_args={svc_cache, status};
 	if(status->is_mutual_auth||status->pinning_status!=PINNING_ST_NOT_PINNING||status->has_protocol_errors)
 	{
-		cli_st_key_sz=ssl_svc_client_st_mk_key(chello, cli_st_key, sizeof(cli_st_key));
-		MESA_htable_search_cb(svc_cache->cli_st_hash, (unsigned char*)cli_st_key, (unsigned int) cli_st_key_sz, cli_st_write_cb, &write_args, &cli_st_cb_ret);	
+		hash_key_sz=ssl_svc_client_st_mk_key(chello, addr, hash_key, sizeof(hash_key));
+		MESA_htable_search_cb(svc_cache->cli_st_hash, (unsigned char*)hash_key, (unsigned int) hash_key_sz, cli_st_write_cb, &write_args, &cli_st_cb_ret);	
 	}
 	if(status->is_ct||status->is_ev)
-	{
-		MESA_htable_search_cb(svc_cache->srv_st_hash, (unsigned char*)chello->sni, (unsigned int) strlen(chello->sni), srv_st_write_cb, &write_args, &svr_st_cb_ret);
+	{	
+		hash_key_sz=ssl_svc_server_st_mk_key(chello, addr, hash_key, sizeof(hash_key));
+		MESA_htable_search_cb(svc_cache->srv_st_hash, (unsigned char*)hash_key, (unsigned int) hash_key_sz, srv_st_write_cb, &write_args, &svr_st_cb_ret);
 	}
 }
-struct ssl_service_cache* ssl_service_cache_create(unsigned int slot_size, unsigned int expire_seconds)
+struct ssl_service_cache* ssl_service_cache_create(unsigned int slot_size, unsigned int expire_seconds, int fail_as_pinning_cnt, int fail_as_proto_err_cnt, int fail_time_win)
 {
 	struct ssl_service_cache * cache = ALLOC(struct ssl_service_cache, 1);
 	unsigned max_num = slot_size * 4;
 	UNUSED int ret = 0;
 	MESA_htable_handle htable=NULL, saved[2];
 	int i=0, opt_val=0;
+	cache->fail_as_pinning_count=fail_as_pinning_cnt;
+	cache->fail_as_proto_err_count=fail_as_proto_err_cnt;
+	cache->fail_time_window=fail_time_win;
 	void (*free_func[])(void *)={ssl_svc_free_client_st, ssl_svc_free_server_st};
 	for(i=0; i<2; i++)
 	{