diff options
Diffstat (limited to 'platform')
| -rw-r--r-- | platform/CMakeLists.txt | 2 | ||||
| -rw-r--r-- | platform/include/internal/ssl_ja3.h | 10 | ||||
| -rw-r--r-- | platform/include/internal/ssl_service_cache.h | 6 | ||||
| -rw-r--r-- | platform/src/ssl_ja3.cpp | 603 | ||||
| -rw-r--r-- | platform/src/ssl_service_cache.cpp | 346 | ||||
| -rw-r--r-- | platform/src/ssl_stream.cpp | 47 |
6 files changed, 128 insertions, 886 deletions
diff --git a/platform/CMakeLists.txt b/platform/CMakeLists.txt index 79481ef..d7bfdd4 100644 --- a/platform/CMakeLists.txt +++ b/platform/CMakeLists.txt @@ -6,7 +6,7 @@ add_executable(tfe src/acceptor_kni_v4.cpp src/ssl_stream.cpp src/key_keeper.cpp src/ssl_fetch_cert.cpp src/ssl_sess_cache.cpp src/ssl_sess_ticket.cpp src/ssl_service_cache.cpp src/ssl_trusted_cert_storage.cpp src/ev_root_ca_metadata.cpp src/ssl_utils.cpp - src/tcp_stream.cpp src/main.cpp src/proxy.cpp src/sender_scm.cpp src/watchdog_kni.cpp src/watchdog_tfe.cpp src/ssl_ja3.cpp src/watchdog_3rd_device.cpp) + src/tcp_stream.cpp src/main.cpp src/proxy.cpp src/sender_scm.cpp src/watchdog_kni.cpp src/watchdog_tfe.cpp src/watchdog_3rd_device.cpp) target_include_directories(tfe PUBLIC ${CMAKE_CURRENT_LIST_DIR}/include/external) target_include_directories(tfe PRIVATE ${CMAKE_CURRENT_LIST_DIR}/include/internal) diff --git a/platform/include/internal/ssl_ja3.h b/platform/include/internal/ssl_ja3.h deleted file mode 100644 index be14463..0000000 --- a/platform/include/internal/ssl_ja3.h +++ /dev/null @@ -1,10 +0,0 @@ -#pragma once - - -struct ssl_ja3 { - char *ja3; - char *ja3_hash; -}; - -struct ssl_ja3 *ssl_ja3_generate_fingerprint(const unsigned char *data, int len); -void ssl_ja3_free(struct ssl_ja3 *fingerprint);
\ No newline at end of file diff --git a/platform/include/internal/ssl_service_cache.h b/platform/include/internal/ssl_service_cache.h index be74d27..ec425ec 100644 --- a/platform/include/internal/ssl_service_cache.h +++ b/platform/include/internal/ssl_service_cache.h @@ -13,7 +13,7 @@ struct ssl_service_status { char cli_pinning_status; - char ja3_pinning_status; + char is_app_not_pinning; char is_ev; char is_ct; char is_mutual_auth; @@ -31,6 +31,7 @@ struct ssl_service_cache_statistics }; struct ssl_service_cache { + MESA_htable_handle app_st_hash; MESA_htable_handle cli_st_hash; MESA_htable_handle srv_st_hash; @@ -38,8 +39,9 @@ struct ssl_service_cache unsigned int fail_as_cli_pinning_count; unsigned int fail_as_proto_err_count; unsigned int fail_time_window; + unsigned int succ_as_app_not_pinning_count; }; -struct ssl_service_cache* ssl_service_cache_create(unsigned int slot_size, unsigned int expire_seconds, int fail_as_pinning_cnt, int fail_as_proto_err_cnt, int fail_time_win); +struct ssl_service_cache *ssl_service_cache_create(unsigned int slot_size, unsigned int expire_seconds, int fail_as_pinning_cnt, int fail_as_proto_err_cnt, int fail_time_win, int succ_as_app_not_pinning_cnt); void ssl_service_cache_destroy(struct ssl_service_cache* cache); int ssl_service_cache_read(struct ssl_service_cache *svc_cache, const struct ssl_chello *chello, const struct tfe_stream *tcp_stream, struct ssl_service_status *result); diff --git a/platform/src/ssl_ja3.cpp b/platform/src/ssl_ja3.cpp deleted file mode 100644 index 457c332..0000000 --- a/platform/src/ssl_ja3.cpp +++ /dev/null @@ -1,603 +0,0 @@ -#include <openssl/md5.h> -#include <stdio.h> -#include <stdlib.h> -#include <ssl_ja3.h> - -#ifndef MIN -#define MIN(a, b) ((a) > (b) ? (b) : (a)) -#endif - -#define BSB_INIT(b, buffer, size) \ - do \ - { \ - (b).buf = (unsigned char *)buffer; \ - (b).ptr = (unsigned char *)buffer; \ - int s = (int)size; \ - if ((buffer == NULL) || (s < 0)) \ - (b).end = 0; \ - else \ - (b).end = (unsigned char *)buffer + size; \ - } while (0) - -#define BSB_SET_ERROR(b) ((b).end = NULL) -#define BSB_IS_ERROR(b) ((b).end == NULL) -#define BSB_NOT_ERROR(b) ((b).end != NULL) -#define BSB_LENGTH(b) ((b).ptr - (b).buf) -#define BSB_POSITION BSB_LENGTH -#define BSB_SIZE(b) ((b).end - (b).buf) -#define BSB_REMAINING(b) ((b).end ? (b).end - (b).ptr : 0) -#define BSB_WORK_PTR(b) ((b).ptr) - -#define BSB_EXPORT_u08(b, x) \ - do \ - { \ - if ((b).ptr && (b).ptr + 1 <= (b).end) \ - { \ - *(((b).ptr)++) = (unsigned char)x; \ - } \ - else \ - BSB_SET_ERROR(b); \ - } while (0) - -#define BSB_EXPORT_u16(b, x) \ - do \ - { \ - if ((b).ptr && (b).ptr + 2 <= (b).end) \ - { \ - uint16_t t = (uint16_t)x; \ - *(((b).ptr)++) = (t & 0xff00) >> 8; \ - *(((b).ptr)++) = (t & 0x00ff); \ - } \ - else \ - BSB_SET_ERROR(b); \ - } while (0) - -#define BSB_EXPORT_u32(b, x) \ - do \ - { \ - if ((b).ptr && (b).ptr + 4 <= (b).end) \ - { \ - uint32_t t = x; \ - *(((b).ptr)++) = (t & 0xff000000) >> 24; \ - *(((b).ptr)++) = (t & 0x00ff0000) >> 16; \ - *(((b).ptr)++) = (t & 0x0000ff00) >> 8; \ - *(((b).ptr)++) = (t & 0x000000ff); \ - } \ - else \ - BSB_SET_ERROR(b); \ - } while (0) - -#define BSB_EXPORT_ptr(b, x, size) \ - do \ - { \ - if ((x || size == 0) && \ - (b).ptr + size <= (b).end && \ - (b).ptr + size >= (b).buf) \ - { \ - memcpy((b).ptr, x, size); \ - (b).ptr += size; \ - } \ - else \ - BSB_SET_ERROR(b); \ - } while (0) - -#define BSB_EXPORT_ptr_some(b, x, size) \ - do \ - { \ - if ((b).ptr + size <= (b).end) \ - { \ - memcpy((b).ptr, x, size); \ - (b).ptr += size; \ - } \ - else if (BSB_NOT_ERROR(b)) \ - { \ - memcpy((b).ptr, x, BSB_REMAINING(b)); \ - (b).ptr += BSB_REMAINING(b); \ - } \ - } while (0) - -#define BSB_EXPORT_cstr(b, x) \ - do \ - { \ - const int size = sizeof x - 1; \ - if ((b).ptr + size <= (b).end) \ - { \ - memcpy((b).ptr, x, size); \ - (b).ptr += size; \ - } \ - else \ - BSB_SET_ERROR(b); \ - } while (0) - -#define BSB_EXPORT_skip(b, size) \ - do \ - { \ - if ((b).ptr + size <= (b).end && \ - (b).ptr + size >= (b).buf) \ - { \ - (b).ptr += size; \ - if ((b).ptr < (b).buf) \ - (b).end = 0; \ - } \ - else \ - BSB_SET_ERROR(b); \ - } while (0) - -#define BSB_EXPORT_rewind(b, size) \ - do \ - { \ - if ((b).ptr - size <= (b).end && \ - (b).ptr - size >= (b).buf) \ - { \ - (b).ptr -= size; \ - if ((b).ptr < (b).buf) \ - (b).end = 0; \ - } \ - else \ - { \ - BSB_SET_ERROR(b); \ - } \ - } while (0) - -#if defined(C9X) - -#define BSB_EXPORT_sprintf(b, ...) \ - do \ - { \ - if ((b).end != 0) \ - { \ - int l = snprintf((char *)(b).ptr, \ - (b).end - (b).ptr, \ - __VA_ARGS__); \ - if (l <= (b).end - (b).ptr) \ - { \ - (b).ptr += l; \ - } \ - else \ - { \ - BSB_SET_ERROR(b); \ - } \ - } \ - } while (0) - -#else - -#define BSB_EXPORT_sprintf(b, args...) \ - do \ - { \ - if ((b).end != 0) \ - { \ - int l = snprintf((char *)(b).ptr, \ - (b).end - (b).ptr, \ - ##args); \ - if (l <= (b).end - (b).ptr) \ - { \ - (b).ptr += l; \ - } \ - else \ - { \ - BSB_SET_ERROR(b); \ - } \ - } \ - } while (0) -#endif - -#define BSB_IMPORT_u08(b, x) \ - do \ - { \ - if ((b).ptr && (b).ptr + 1 <= (b).end) \ - { \ - x = *(((b).ptr)++); \ - } \ - else \ - BSB_SET_ERROR(b); \ - } while (0) - -#define BSB_IMPORT_u16(b, x) \ - do \ - { \ - if ((b).ptr && (b).ptr + 2 <= (b).end) \ - { \ - x = ((uint16_t)((b).ptr)[0]) << 8 | \ - ((uint16_t)((b).ptr)[1]); \ - (b).ptr += 2; \ - } \ - else \ - BSB_SET_ERROR(b); \ - } while (0) - -#define BSB_IMPORT_u24(b, x) \ - do \ - { \ - if ((b).ptr && (b).ptr + 3 <= (b).end) \ - { \ - x = ((uint32_t)((b).ptr)[0]) << 16 | \ - ((uint32_t)((b).ptr)[1]) << 8 | \ - ((uint32_t)((b).ptr)[2]); \ - (b).ptr += 3; \ - } \ - else \ - BSB_SET_ERROR(b); \ - } while (0) - -#define BSB_IMPORT_u32(b, x) \ - do \ - { \ - if ((b).ptr && (b).ptr + 4 <= (b).end) \ - { \ - x = ((uint32_t)((b).ptr)[0]) << 24 | \ - ((uint32_t)((b).ptr)[1]) << 16 | \ - ((uint32_t)((b).ptr)[2]) << 8 | \ - ((uint32_t)((b).ptr)[3]); \ - (b).ptr += 4; \ - } \ - else \ - BSB_SET_ERROR(b); \ - } while (0) - -#define BSB_LEXPORT_u08(b, x) BSB_EXPORT_u08(b, x) - -#define BSB_LEXPORT_u16(b, x) \ - do \ - { \ - if ((b).ptr + 2 <= (b).end) \ - { \ - uint16_t t = (uint16_t)x; \ - *(((b).ptr)++) = (t & 0x00ff); \ - *(((b).ptr)++) = (t & 0xff00) >> 8; \ - } \ - else \ - BSB_SET_ERROR(b); \ - } while (0) - -#define BSB_LEXPORT_u32(b, x) \ - do \ - { \ - if ((b).ptr + 4 <= (b).end) \ - { \ - uint32_t t = x; \ - *(((b).ptr)++) = (t & 0x000000ff); \ - *(((b).ptr)++) = (t & 0x0000ff00) >> 8; \ - *(((b).ptr)++) = (t & 0x00ff0000) >> 16; \ - *(((b).ptr)++) = (t & 0xff000000) >> 24; \ - } \ - else \ - BSB_SET_ERROR(b); \ - } while (0) - -#define BSB_LIMPORT_u08(b, x) BSB_IMPORT_u08(b, x) - -#define BSB_LIMPORT_u16(b, x) \ - do \ - { \ - if ((b).ptr + 2 <= (b).end) \ - { \ - x = ((uint16_t)((b).ptr)[1]) << 8 | \ - ((uint16_t)((b).ptr)[0]); \ - (b).ptr += 2; \ - } \ - else \ - BSB_SET_ERROR(b); \ - } while (0) - -#define BSB_LIMPORT_u24(b, x) \ - do \ - { \ - if ((b).ptr + 3 <= (b).end) \ - { \ - x = ((uint32_t)((b).ptr)[2]) << 16 | \ - ((uint32_t)((b).ptr)[1]) << 8 | \ - ((uint32_t)((b).ptr)[0]); \ - (b).ptr += 3; \ - } \ - else \ - BSB_SET_ERROR(b); \ - } while (0) - -#define BSB_LIMPORT_u32(b, x) \ - do \ - { \ - if ((b).ptr + 4 <= (b).end) \ - { \ - x = ((uint32_t)((b).ptr)[3]) << 24 | \ - ((uint32_t)((b).ptr)[2]) << 16 | \ - ((uint32_t)((b).ptr)[1]) << 8 | \ - ((uint32_t)((b).ptr)[0]); \ - (b).ptr += 4; \ - } \ - else \ - BSB_SET_ERROR(b); \ - } while (0) - -#define BSB_IMPORT_ptr(b, x, size) \ - do \ - { \ - if ((b).ptr + size <= (b).end && \ - (b).ptr + size >= (b).buf) \ - { \ - (x) = (b).ptr; \ - (b).ptr += size; \ - } \ - else \ - { \ - BSB_SET_ERROR(b); \ - x = 0; \ - } \ - } while (0) - -#define BSB_LIMPORT_ptr BSB_IMPORT_ptr -#define BSB_IMPORT_skip BSB_EXPORT_skip -#define BSB_LIMPORT_skip BSB_EXPORT_skip -#define BSB_IMPORT_rewind BSB_EXPORT_rewind -#define BSB_LIMPORT_rewind BSB_EXPORT_rewind - -#define BSB_memchr(b, ch, pos) \ - do \ - { \ - if (BSB_IS_ERROR(b)) \ - { \ - pos = 0; \ - break; \ - } \ - char *s = memchr((char *)b.ptr, ch, BSB_REMAINING(b)); \ - if (s) \ - pos = (char *)s - (char *)b.ptr; \ - else \ - pos = 0; \ - } while (0) - -#define BSB_memcmp(str, b, len) ((b).ptr + len <= (b).end ? memcmp(str, b.ptr, len) : -1) - -#define BSB_PEEK(b) ((b).ptr + 1 <= (b).end ? *b.ptr : -1) - -#define BSB_IMPORT_zbyte(b, x, size) \ - do \ - { \ - if ((b).ptr + size <= (b).end) \ - { \ - memcpy(x, b, size); \ - (x)[size] = 0; \ - (b).ptr += size; \ - } \ - else \ - { \ - BSB_SET_ERROR(b); \ - (x)[0] = 0; \ - } \ - } while (0) - -/* Private data structure */ -typedef struct bsb -{ - unsigned char *buf; - unsigned char *ptr; - unsigned char *end; -} BSB; - -// https://tools.ietf.org/html/draft-davidben-tls-grease-00 -static int tls_is_grease_value(uint32_t val) -{ - if ((val & 0x0f) != 0x0a) - return 0; - - if ((val & 0xff) != ((val >> 8) & 0xff)) - return 0; - - return 1; -} - -static int md5sum(const char *str, int len, char *buf, int size) -{ - int n; - int ret = 0; - MD5_CTX ctx; - unsigned char tmp[MD5_DIGEST_LENGTH]; - - MD5_Init(&ctx); - MD5_Update(&ctx, str, len); - MD5_Final(tmp, &ctx); - - for (n = 0; n < MD5_DIGEST_LENGTH; n++) - { - ret += snprintf(buf + ret, size - ret, "%.2x", tmp[n]); - } - - return ret; -} - -void ssl_ja3_free(struct ssl_ja3 *fingerprint) -{ - if (fingerprint) - { - if (fingerprint->ja3) - { - free(fingerprint->ja3); - fingerprint->ja3 = NULL; - } - if (fingerprint->ja3_hash) - { - free(fingerprint->ja3_hash); - fingerprint->ja3_hash = NULL; - } - free(fingerprint); - fingerprint = NULL; - } -} - - /****************************************************************************** - * JA3 generation algorithm refers to tls_process_client() in - * https://github.com/aol/moloch. - ******************************************************************************/ -struct ssl_ja3 *ssl_ja3_generate_fingerprint(const unsigned char *data, int len) -{ - BSB sslbsb; - char ja3[30000]; - BSB ja3bsb; - char ecfja3[1000]; - BSB ecfja3bsb; - char eja3[10000]; - BSB eja3bsb; - char ecja3[10000]; - BSB ecja3bsb; - - BSB_INIT(sslbsb, data, len); - BSB_INIT(ja3bsb, ja3, sizeof(ja3)); - BSB_INIT(ecja3bsb, ecja3, sizeof(ecja3)); - BSB_INIT(ecfja3bsb, ecfja3, sizeof(ecfja3)); - BSB_INIT(eja3bsb, eja3, sizeof(eja3)); - - if (BSB_REMAINING(sslbsb) > 5) - { - unsigned char *ssldata = BSB_WORK_PTR(sslbsb); - int ssllen = MIN(BSB_REMAINING(sslbsb) - 5, ssldata[3] << 8 | ssldata[4]); - - BSB pbsb; - BSB_INIT(pbsb, ssldata + 5, ssllen); - - if (BSB_REMAINING(pbsb) > 7) - { - unsigned char *pdata = BSB_WORK_PTR(pbsb); - int plen = MIN(BSB_REMAINING(pbsb) - 4, pdata[2] << 8 | pdata[3]); - - uint16_t ver = 0; - BSB_IMPORT_skip(pbsb, 4); // type + len - BSB_IMPORT_u16(pbsb, ver); - - BSB_EXPORT_sprintf(ja3bsb, "%d,", ver); - - BSB cbsb; - BSB_INIT(cbsb, pdata + 6, plen - 2); // The - 4 for plen is done above, confusing - - if (BSB_REMAINING(cbsb) > 32) - { - BSB_IMPORT_skip(cbsb, 32); // Random - - int skiplen = 0; - BSB_IMPORT_u08(cbsb, skiplen); // Session Id Length - if (skiplen > 0 && BSB_REMAINING(cbsb) > skiplen) - { - // Remove unnecessary code - } - BSB_IMPORT_skip(cbsb, skiplen); // Session Id - - BSB_IMPORT_u16(cbsb, skiplen); // Ciper Suites Length - while (BSB_NOT_ERROR(cbsb) && skiplen > 0) - { - uint16_t c = 0; - BSB_IMPORT_u16(cbsb, c); - if (!tls_is_grease_value(c)) - { - BSB_EXPORT_sprintf(ja3bsb, "%d-", c); - } - skiplen -= 2; - } - BSB_EXPORT_rewind(ja3bsb, 1); // Remove last - - BSB_EXPORT_u08(ja3bsb, ','); - - BSB_IMPORT_u08(cbsb, skiplen); // Compression Length - BSB_IMPORT_skip(cbsb, skiplen); // Compressions - - if (BSB_REMAINING(cbsb) > 6) - { - int etotlen = 0; - BSB_IMPORT_u16(cbsb, etotlen); // Extensions Length - - etotlen = MIN(etotlen, BSB_REMAINING(cbsb)); - - BSB ebsb; - BSB_INIT(ebsb, BSB_WORK_PTR(cbsb), etotlen); - - while (BSB_REMAINING(ebsb) > 4) - { - uint16_t etype = 0, elen = 0; - - BSB_IMPORT_u16(ebsb, etype); - BSB_IMPORT_u16(ebsb, elen); - - if (!tls_is_grease_value(etype)) - BSB_EXPORT_sprintf(eja3bsb, "%d-", etype); - - if (elen > BSB_REMAINING(ebsb)) - break; - - if (etype == 0) - { // SNI - BSB snibsb; - BSB_INIT(snibsb, BSB_WORK_PTR(ebsb), elen); - BSB_IMPORT_skip(ebsb, elen); - - int sni = 0; - BSB_IMPORT_u16(snibsb, sni); // list len - if (sni != BSB_REMAINING(snibsb)) - continue; - - BSB_IMPORT_u08(snibsb, sni); // type - if (sni != 0) - continue; - - BSB_IMPORT_u16(snibsb, sni); // len - if (sni != BSB_REMAINING(snibsb)) - continue; - } - else if (etype == 0x000a) - { // Elliptic Curves - BSB bsb; - BSB_INIT(bsb, BSB_WORK_PTR(ebsb), elen); - BSB_IMPORT_skip(ebsb, elen); - - uint16_t llen = 0; - BSB_IMPORT_u16(bsb, llen); // list len - while (llen > 0 && !BSB_IS_ERROR(bsb)) - { - uint16_t c = 0; - BSB_IMPORT_u16(bsb, c); - if (!tls_is_grease_value(c)) - { - BSB_EXPORT_sprintf(ecja3bsb, "%d-", c); - } - llen -= 2; - } - BSB_EXPORT_rewind(ecja3bsb, 1); // Remove last - - } - else if (etype == 0x000b) - { // Elliptic Curves point formats - BSB bsb; - BSB_INIT(bsb, BSB_WORK_PTR(ebsb), elen); - BSB_IMPORT_skip(ebsb, elen); - - uint16_t llen = 0; - BSB_IMPORT_u08(bsb, llen); // list len - while (llen > 0 && !BSB_IS_ERROR(bsb)) - { - uint8_t c = 0; - BSB_IMPORT_u08(bsb, c); - BSB_EXPORT_sprintf(ecfja3bsb, "%d-", c); - llen -= 1; - } - BSB_EXPORT_rewind(ecfja3bsb, 1); // Remove last - - } - else - { - BSB_IMPORT_skip(ebsb, elen); - } - } - BSB_EXPORT_rewind(eja3bsb, 1); // Remove last - - } - } - } - BSB_IMPORT_skip(sslbsb, ssllen + 5); - - if (BSB_LENGTH(ja3bsb) > 0 && BSB_NOT_ERROR(ja3bsb) && BSB_NOT_ERROR(ecja3bsb) && BSB_NOT_ERROR(eja3bsb) && BSB_NOT_ERROR(ecfja3bsb)) - { - BSB_EXPORT_sprintf(ja3bsb, "%.*s,%.*s,%.*s", (int)BSB_LENGTH(eja3bsb), eja3, (int)BSB_LENGTH(ecja3bsb), ecja3, (int)BSB_LENGTH(ecfja3bsb), ecfja3); - char md5[64] = {0}; - int len = md5sum(ja3, BSB_LENGTH(ja3bsb), md5, sizeof(md5)); - struct ssl_ja3 *result = (struct ssl_ja3 *)calloc(sizeof(struct ssl_ja3), 1); - asprintf(&(result->ja3), "%.*s", (int)BSB_LENGTH(ja3bsb), ja3); - asprintf(&(result->ja3_hash), "%.*s", len, md5); - return result; - } - } - - return NULL; -}
\ No newline at end of file diff --git a/platform/src/ssl_service_cache.cpp b/platform/src/ssl_service_cache.cpp index 2a9f59d..fccabfa 100644 --- a/platform/src/ssl_service_cache.cpp +++ b/platform/src/ssl_service_cache.cpp @@ -1,17 +1,8 @@ #include <ssl_service_cache.h> #include <MESA/maat.h> -#include <tfe_resource.h> #include <ssl_stream.h> #include <cjson/cJSON.h> -struct ssl_svc_ja3 -{ - uuid_t uuid; - char ja3_hash[33]; - int pinning_state; - int ref_cnt; -}; - struct ssl_svc_addr { const char *sip; @@ -20,170 +11,6 @@ struct ssl_svc_addr const char *dport; }; -static void ssl_svc_ja3_param_dup_cb(const char *table_name, void **to, void **from, long argl, void *argp) -{ - struct ssl_svc_ja3 *param = (struct ssl_svc_ja3 *)*from; - if (param) - { - __sync_add_and_fetch(&(param->ref_cnt), 1); - *to = param; - } - else - { - *to = NULL; - } - return; -} - -// NOTE: key is ja3_hash -static void ssl_svc_ja3_param_new_cb(const char *table_name, const char *key, const char *table_line, void **ad, long argl, void *argp) -{ - cJSON *json = NULL; - cJSON *item = NULL; - struct ssl_svc_ja3 *param = NULL; - - char *json_str = strdup(table_line); - json = cJSON_Parse(json_str); - if (json == NULL) - { - TFE_LOG_ERROR(g_default_logger, "Invalid JA3 policy: (invalid json format) %s", table_line); - goto error_out; - } - - param = ALLOC(struct ssl_svc_ja3, 1); - param->ref_cnt = 1; - - // uuid - item = cJSON_GetObjectItem(json, "uuid"); - if (!item || !cJSON_IsString(item)) - { - TFE_LOG_ERROR(g_default_logger, "Invalid JA3 policy: (invalid uuid param) %s", table_line); - goto error_out; - } - uuid_parse(item->valuestring, param->uuid); - - // ja3_hash - item = cJSON_GetObjectItem(json, "ja3_hash"); - if (!item || !cJSON_IsString(item)) - { - TFE_LOG_ERROR(g_default_logger, "Invalid JA3 policy: (invalid ja3_hash param) %s", table_line); - goto error_out; - } - strncpy(param->ja3_hash, item->valuestring, 32); - - // pinning_state - item = cJSON_GetObjectItem(json, "pinning_state"); - if (!item || !cJSON_IsNumber(item)) - { - TFE_LOG_ERROR(g_default_logger, "Invalid JA3 policy: (invalid pinning_state param) %s", table_line); - goto error_out; - } - param->pinning_state = item->valueint; - - *ad = param; - TFE_LOG_INFO(g_default_logger, "Add JA3 policy: uuid:%s, ja3_hash:%s, pinning_state:%d", - key, param->ja3_hash, param->pinning_state); - - cJSON_Delete(json); - free(json_str); - return; - -error_out: - if (json) - { - cJSON_Delete(json); - } - if (json_str) - { - free(json_str); - } - if (param) - { - free(param); - } - *ad = NULL; - return; -} - -static void ssl_svc_ja3_param_free_cb(const char *table_name, void **ad, long argl, void *argp) -{ - struct ssl_svc_ja3 *param = (struct ssl_svc_ja3 *)*ad; - if (param == NULL) - { - return; - } - - if ((__sync_sub_and_fetch(¶m->ref_cnt, 1) == 0)) - { - char uuid_str[UUID_STRING_SIZE] = {0}; - uuid_unparse(param->uuid, uuid_str); - TFE_LOG_INFO(g_default_logger, "Del JA3 policy: id:%s", uuid_str); - free(param); - *ad = NULL; - } -} - -static void ssl_svc_ja3_param_free(struct ssl_svc_ja3 *param) -{ - ssl_svc_ja3_param_free_cb(NULL, (void **)¶m, 0, NULL); -} - -static int ssl_svc_ja3_init() -{ - if (maat_plugin_table_ex_schema_register(tfe_get_maat_handle(), - "PXY_SSL_FINGERPRINT", - ssl_svc_ja3_param_new_cb, - ssl_svc_ja3_param_free_cb, - ssl_svc_ja3_param_dup_cb, - 0, - NULL) != 0) - { - TFE_LOG_ERROR(g_default_logger, "failed at Maat_plugin_EX_register(PXY_SSL_FINGERPRINT)"); - return -1; - } - else - { - return 0; - } -} - -enum ssl_ja3_pinning_status ssl_svc_ja3_scan(char *ja3_hash, const char *addr_str) -{ - enum ssl_ja3_pinning_status ret = JA3_PINNING_STATUS_UNKNOWN; - struct ssl_svc_ja3 *param = NULL; - char uuid_str[UUID_STRING_SIZE] = {0}; - - param = (struct ssl_svc_ja3 *)maat_plugin_table_get_ex_data(tfe_get_maat_handle(), "PXY_SSL_FINGERPRINT", ja3_hash, strlen(ja3_hash)); - if (param == NULL) - { - ret = JA3_PINNING_STATUS_UNKNOWN; - goto end; - } - uuid_unparse(param->uuid, uuid_str); - TFE_LOG_INFO(g_default_logger, "Hit JA3 policy: uuid:%s, ja3_hash:%s, pinning_state:%d, addr:%s", - uuid_str, param->ja3_hash, param->pinning_state, addr_str); - - // 1 - pinning - if (param->pinning_state) - { - ret = JA3_PINNING_STATUS_IS_PINNING; - } - // 0 - not pinning - else - { - ret = JA3_PINNING_STATUS_NOT_PINNING; - } - -end: - if (param) - { - ssl_svc_ja3_param_free(param); - param = NULL; - } - - return ret; -} - struct ssl_svc_client_st { time_t last_update_time; @@ -200,6 +27,11 @@ struct ssl_svc_server_st long long ct_st_switched; struct ssl_service_cache* ref_svc_cache; }; +struct ssl_svc_app_st +{ + unsigned int down_ssl_success_cnt; + struct ssl_service_cache *ref_svc_cache; +}; struct ssl_service_write_args { struct ssl_service_cache* cache; @@ -241,40 +73,26 @@ static void ssl_svc_free_server_st(void * data) free(p); return; } -static size_t ssl_svc_server_st_mk_key(struct ssl_svc_addr *addr_info, const struct ssl_chello* chello, const struct tfe_stream *tcp_stream, char* key_buff, size_t sz) +static void ssl_svc_free_app_st(void *data) +{ + struct ssl_svc_app_st *p = (struct ssl_svc_app_st *)data; + struct ssl_service_cache *svc_cache = p->ref_svc_cache; + if (p->down_ssl_success_cnt > svc_cache->succ_as_app_not_pinning_count) + { + svc_cache->stat.app_not_pinning_cnt--; + } + free(p); +} +static size_t ssl_svc_server_st_mk_key(struct ssl_svc_addr *addr_info, const struct ssl_chello* chello, char* key_buff, size_t sz) { size_t key_len=0; key_len=snprintf(key_buff, sz, "%s:%s:%s:", addr_info->dip, addr_info->dport, chello->sni ? chello->sni : "null"); return key_len; } -static size_t ssl_svc_app_st_mk_key(struct ssl_svc_addr *addr_info, const struct ssl_chello *chello, const struct tfe_stream *tcp_stream, char *key_buff, size_t sz) +static size_t ssl_svc_app_st_mk_key(struct ssl_svc_addr *addr_info, const struct ssl_chello *chello, char *key_buff, size_t sz) { - char ja3_val[64] = {0}; - uint16_t ja3_len = 0; - size_t key_len = 0; - struct tfe_cmsg *cmsg = tfe_stream_get0_cmsg(tcp_stream); - if (cmsg != NULL) - { - int ret = tfe_cmsg_get_value(cmsg, TFE_CMSG_SSL_CLIENT_JA3_FINGERPRINT, (unsigned char *)ja3_val, sizeof(ja3_val), &ja3_len); - if (ret != 0) - { - TFE_LOG_ERROR(g_default_logger, "failed at fetch ssl client ja3 fingerprint from cmsg: %s, %s", strerror(-ret), tcp_stream->str_stream_info); - } - else - { - TFE_LOG_DEBUG(g_default_logger, "fetch ssl client ja3 fingerprint:%s addr: %s", ja3_val, tcp_stream->str_stream_info); - } - } - - // If ja3 is successfully obtained, use ja3 to generate hashkey - if (strlen(ja3_val)) - { - key_len = snprintf(key_buff, sz, "%s:%s", ja3_val, chello->sni ? chello->sni : addr_info->dip); - return key_len; - } - - // otherwise, splicing ssl attributes to generate hashkey - key_len=snprintf(key_buff, sz, "%d:%d:%s:%s", chello->min_version.ossl_format, + // splicing ssl attributes to generate hashkey + size_t key_len=snprintf(key_buff, sz, "%d:%d:%s:%s", chello->min_version.ossl_format, chello->max_version.ossl_format, chello->sni?chello->sni: addr_info->dip , chello->alpn?chello->alpn:"null"); @@ -295,14 +113,14 @@ static size_t ssl_svc_app_st_mk_key(struct ssl_svc_addr *addr_info, const struct } return key_len; } -static size_t ssl_svc_client_st_mk_key(struct ssl_svc_addr *addr_info, const struct ssl_chello *chello, const struct tfe_stream *tcp_stream, char *key_buff, size_t sz) +static size_t ssl_svc_client_st_mk_key(struct ssl_svc_addr *addr_info, const struct ssl_chello *chello, char *key_buff, size_t sz) { size_t key_len=0; char chello_id_buff[sz]; size_t chello_id_len=0; key_len=snprintf(key_buff, sz, "%s:", addr_info->sip); - chello_id_len = ssl_svc_app_st_mk_key(addr_info, chello, tcp_stream, chello_id_buff, sizeof(chello_id_buff)); + chello_id_len = ssl_svc_app_st_mk_key(addr_info, chello, chello_id_buff, sizeof(chello_id_buff)); memcpy(key_buff+key_len, chello_id_buff, MIN(chello_id_len, sz-key_len)); key_len += MIN(chello_id_len, sz-key_len); @@ -407,6 +225,7 @@ static long srv_st_read_cb(void * data, const uchar * key, uint size, void * use result->is_ev=srv_st->is_ev; return 1; } + static long srv_st_write_cb(void * data, const uchar * key, uint size, void * user_arg) { struct ssl_svc_server_st* srv_st=(struct ssl_svc_server_st*)data; @@ -443,6 +262,46 @@ static long srv_st_write_cb(void * data, const uchar * key, uint size, void * us return 1; } +static long app_st_read_cb(void *data, const uchar *key, uint size, void *user_arg) +{ + struct ssl_svc_app_st *app_st = (struct ssl_svc_app_st *)data; + struct ssl_service_status *result = (struct ssl_service_status *)user_arg; + if (app_st == NULL) + { + return 0; + } + if (app_st->down_ssl_success_cnt > app_st->ref_svc_cache->succ_as_app_not_pinning_count) + { + result->is_app_not_pinning = 1; + } + return 1; +} + +static long app_st_write_cb(void *data, const uchar *key, uint size, void *user_arg) +{ + struct ssl_svc_app_st *app_st = (struct ssl_svc_app_st *)data; + struct ssl_service_write_args *args = (struct ssl_service_write_args *)user_arg; + const struct ssl_service_status *status = args->status; + struct ssl_service_cache *cache = args->cache; + UNUSED int ret = 0; + if (app_st == NULL) + { + app_st = ALLOC(struct ssl_svc_app_st, 1); + app_st->ref_svc_cache = cache; + ret = MESA_htable_add(cache->app_st_hash, key, size, app_st); + assert(ret >= 0); + } + if (status->is_app_not_pinning) + { + app_st->down_ssl_success_cnt++; + } + if (app_st->down_ssl_success_cnt > cache->succ_as_app_not_pinning_count) + { + cache->stat.app_not_pinning_cnt++; + } + return 1; +} + int ssl_service_cache_read(struct ssl_service_cache *svc_cache, const struct ssl_chello *chello, const struct tfe_stream *tcp_stream, struct ssl_service_status *result) { long cli_st_cb_ret=0, svr_st_cb_ret=0, app_st_cb_ret=0; @@ -460,39 +319,27 @@ int ssl_service_cache_read(struct ssl_service_cache *svc_cache, const struct ssl tfe_stream_addr_str_split(addr_str, &(addr_info.sip), &(addr_info.sport), &(addr_info.dip), &(addr_info.dport)); memset(hash_key, 0, sizeof(hash_key)); - temp_key_sz = ssl_svc_client_st_mk_key(&addr_info, chello, tcp_stream, temp_key, sizeof(temp_key)); + temp_key_sz = ssl_svc_client_st_mk_key(&addr_info, chello, temp_key, sizeof(temp_key)); hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key; MESA_htable_search_cb(svc_cache->cli_st_hash, hash_key, (unsigned int) hash_key_sz, cli_st_read_cb, result, &cli_st_cb_ret); TFE_LOG_DEBUG(g_default_logger, "client table, hash:%s, found:%ld, sni:%s, addr:%s, mutual:%d, pinning:%d, err:%d", hash_key, cli_st_cb_ret, chello->sni, tcp_stream->str_stream_info, result->is_mutual_auth, result->cli_pinning_status, result->has_protocol_errors); memset(hash_key, 0, sizeof(hash_key)); - temp_key_sz = ssl_svc_server_st_mk_key(&addr_info, chello, tcp_stream, temp_key, sizeof(temp_key)); + temp_key_sz = ssl_svc_server_st_mk_key(&addr_info, chello, temp_key, sizeof(temp_key)); hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key; MESA_htable_search_cb(svc_cache->srv_st_hash, hash_key, (unsigned int) hash_key_sz, srv_st_read_cb, result, &svr_st_cb_ret); TFE_LOG_DEBUG(g_default_logger, "server table, hash:%s, found:%ld, sni:%s, addr:%s, ct:%d, ev:%d", hash_key, svr_st_cb_ret, chello->sni, tcp_stream->str_stream_info, result->is_ct, result->is_ev); - char ja3_hash[64] = {0}; - uint16_t ja3_len = 0; - result->ja3_pinning_status = JA3_PINNING_STATUS_UNKNOWN; - struct tfe_cmsg *cmsg = tfe_stream_get0_cmsg(tcp_stream); - if (cmsg) - { - int ret = tfe_cmsg_get_value(cmsg, TFE_CMSG_SSL_CLIENT_JA3_FINGERPRINT, (unsigned char *)ja3_hash, sizeof(ja3_hash), &ja3_len); - if (ret == 0) - { - result->ja3_pinning_status = ssl_svc_ja3_scan(ja3_hash, tcp_stream->str_stream_info); - if (result->ja3_pinning_status != JA3_PINNING_STATUS_UNKNOWN) - { - app_st_cb_ret = 1; - } - } - } - TFE_LOG_DEBUG(g_default_logger, "app table, hash:%s, found:%ld, sni:%s, addr:%s, ja3_pinning_status:%d", - ja3_hash, app_st_cb_ret, chello->sni, tcp_stream->str_stream_info, result->ja3_pinning_status); + memset(hash_key, 0, sizeof(hash_key)); + temp_key_sz = ssl_svc_app_st_mk_key(&addr_info, chello, temp_key, sizeof(temp_key)); + hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key; + MESA_htable_search_cb(svc_cache->app_st_hash, hash_key, (unsigned int)hash_key_sz, app_st_read_cb, result, &app_st_cb_ret); + TFE_LOG_DEBUG(g_default_logger, "app table, hash:%s, found:%ld, sni:%s, addr:%s, app_not_pinning:%d", + hash_key, app_st_cb_ret, chello->sni, addr_str, result->is_app_not_pinning); - free(addr_str); + free(addr_str); if(cli_st_cb_ret||svr_st_cb_ret||app_st_cb_ret) { @@ -525,7 +372,7 @@ void ssl_service_cache_write(struct ssl_service_cache *svc_cache, const struct s if(status->is_mutual_auth||status->cli_pinning_status!=PINNING_ST_NOT_PINNING||status->has_protocol_errors) { memset(hash_key, 0, sizeof(hash_key)); - temp_key_sz = ssl_svc_client_st_mk_key(&addr_info, chello, tcp_stream, temp_key, sizeof(temp_key)); + temp_key_sz = ssl_svc_client_st_mk_key(&addr_info, chello, temp_key, sizeof(temp_key)); hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key; TFE_LOG_DEBUG(g_default_logger, "client table, hash:%s, sni:%s, addr:%s, mutual:%d, pinning:%d, err:%d", hash_key, chello->sni, tcp_stream->str_stream_info, status->is_mutual_auth, status->cli_pinning_status, status->has_protocol_errors); @@ -534,23 +381,27 @@ void ssl_service_cache_write(struct ssl_service_cache *svc_cache, const struct s if(status->is_ct||status->is_ev) { memset(hash_key, 0, sizeof(hash_key)); - temp_key_sz = ssl_svc_server_st_mk_key(&addr_info, chello, tcp_stream, temp_key, sizeof(temp_key)); + temp_key_sz = ssl_svc_server_st_mk_key(&addr_info, chello, temp_key, sizeof(temp_key)); hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key; TFE_LOG_DEBUG(g_default_logger, "server table, hash:%s, sni:%s, addr:%s, ct:%d, ev:%d", hash_key, chello->sni, tcp_stream->str_stream_info, status->is_ct, status->is_ev); MESA_htable_search_cb(svc_cache->srv_st_hash, hash_key, (unsigned int) hash_key_sz, srv_st_write_cb, &write_args, &svr_st_cb_ret); } + if (status->is_app_not_pinning) + { + memset(hash_key, 0, sizeof(hash_key)); + temp_key_sz = ssl_svc_app_st_mk_key(&addr_info, chello, temp_key, sizeof(temp_key)); + hash_key_sz = tfe_hexdump(hash_key, (unsigned char *)temp_key, temp_key_sz) - hash_key; + TFE_LOG_DEBUG(g_default_logger, "app table, hash:%s, sni:%s, addr:%s, app_not_pinning:%d", + hash_key, chello->sni, addr_str, status->is_app_not_pinning); + MESA_htable_search_cb(svc_cache->app_st_hash, hash_key, (unsigned int)hash_key_sz, app_st_write_cb, &write_args, &svr_st_cb_ret); + } free(addr_str); } -struct ssl_service_cache *ssl_service_cache_create(unsigned int slot_size, unsigned int expire_seconds, int fail_as_pinning_cnt, int fail_as_proto_err_cnt, int fail_time_win) +struct ssl_service_cache *ssl_service_cache_create(unsigned int slot_size, unsigned int expire_seconds, int fail_as_pinning_cnt, int fail_as_proto_err_cnt, int fail_time_win, int succ_as_app_not_pinning_cnt) { - if (ssl_svc_ja3_init() != 0) - { - return NULL; - } - - struct ssl_service_cache * cache = ALLOC(struct ssl_service_cache, 1); + struct ssl_service_cache * cache = ALLOC(struct ssl_service_cache, 1); unsigned max_num = slot_size * 4; UNUSED int ret = 0; MESA_htable_handle htable=NULL, saved[3]; @@ -558,8 +409,9 @@ struct ssl_service_cache *ssl_service_cache_create(unsigned int slot_size, unsig cache->fail_as_cli_pinning_count=fail_as_pinning_cnt; cache->fail_as_proto_err_count=fail_as_proto_err_cnt; cache->fail_time_window=fail_time_win; - void (*free_func[])(void *)={ssl_svc_free_client_st, ssl_svc_free_server_st}; - for(i=0; i<2; i++) + cache->succ_as_app_not_pinning_count = succ_as_app_not_pinning_cnt; + void (*free_func[])(void *)={ssl_svc_free_client_st, ssl_svc_free_server_st, ssl_svc_free_app_st}; + for(i=0; i<3; i++) { htable = MESA_htable_born(); opt_val=0; @@ -570,10 +422,21 @@ struct ssl_service_cache *ssl_service_cache_create(unsigned int slot_size, unsig ret = MESA_htable_set_opt(htable, MHO_MUTEX_NUM, &opt_val, sizeof(opt_val)); ret = MESA_htable_set_opt(htable, MHO_HASH_SLOT_SIZE, &slot_size, sizeof(slot_size)); ret = MESA_htable_set_opt(htable, MHO_HASH_MAX_ELEMENT_NUM, &max_num, sizeof(max_num)); + // for app table + if (i == 2) + { + unsigned int app_expire_seconds = 2 * expire_seconds; + ret = MESA_htable_set_opt(htable, MHO_EXPIRE_TIME, &app_expire_seconds, sizeof(app_expire_seconds)); + opt_val = HASH_ELIMINATE_ALGO_LRU; + ret = MESA_htable_set_opt(htable, MHO_ELIMIMINATE_TYPE, &opt_val, sizeof(int)); + } // for client table and server table - ret = MESA_htable_set_opt(htable, MHO_EXPIRE_TIME, &expire_seconds, sizeof(expire_seconds)); - opt_val = HASH_ELIMINATE_ALGO_FIFO; - ret = MESA_htable_set_opt(htable, MHO_ELIMIMINATE_TYPE, &opt_val, sizeof(int)); + else + { + ret = MESA_htable_set_opt(htable, MHO_EXPIRE_TIME, &expire_seconds, sizeof(expire_seconds)); + opt_val = HASH_ELIMINATE_ALGO_FIFO; + ret = MESA_htable_set_opt(htable, MHO_ELIMIMINATE_TYPE, &opt_val, sizeof(int)); + } ret = MESA_htable_set_opt(htable, MHO_CBFUN_DATA_FREE, (void*)free_func[i], sizeof(free_func[i])); @@ -584,8 +447,9 @@ struct ssl_service_cache *ssl_service_cache_create(unsigned int slot_size, unsig } cache->cli_st_hash=saved[0]; cache->srv_st_hash=saved[1]; - - return cache; + cache->app_st_hash=saved[2]; + + return cache; } void ssl_service_cache_destroy(struct ssl_service_cache* cache) { @@ -593,6 +457,8 @@ void ssl_service_cache_destroy(struct ssl_service_cache* cache) cache->cli_st_hash=NULL; MESA_htable_destroy(cache->srv_st_hash, NULL); cache->srv_st_hash=NULL; + MESA_htable_destroy(cache->app_st_hash, NULL); + cache->app_st_hash=NULL; free(cache); return; } diff --git a/platform/src/ssl_stream.cpp b/platform/src/ssl_stream.cpp index f1d9d74..720d161 100644 --- a/platform/src/ssl_stream.cpp +++ b/platform/src/ssl_stream.cpp @@ -43,7 +43,6 @@ #include <ssl_utils.h> #include <ssl_service_cache.h> #include <platform.h> -#include <ssl_ja3.h> static int SSL_CTX_EX_DATA_IDX_SSLMGR; static int SSL_EX_DATA_IDX_SSLSTREAM; @@ -709,11 +708,14 @@ struct ssl_mgr * ssl_manager_init(const char * ini_profile, const char * section &(mgr->svc_fail_as_proto_err_cnt), 5); MESA_load_profile_uint_def(ini_profile, section, "service_cache_fail_time_window", &(mgr->svc_cnt_time_window), 30); + MESA_load_profile_uint_def(ini_profile, section, "service_cache_succ_as_app_not_pinning_cnt", + &(mgr->svc_succ_as_app_not_pinning_cnt), 1); mgr->svc_cache = ssl_service_cache_create(mgr->svc_cache_slots, mgr->svc_expire_seconds, mgr->svc_fail_as_pinning_cnt, mgr->svc_fail_as_proto_err_cnt, - mgr->svc_cnt_time_window); + mgr->svc_cnt_time_window, + mgr->svc_succ_as_app_not_pinning_cnt); if (mgr->svc_cache == NULL) { TFE_LOG_ERROR(logger, "Failed to create service cache"); @@ -820,15 +822,6 @@ static void peek_client_hello_cb(evutil_socket_t fd, short what, void * arg) { case CHELLO_PARSE_SUCCESS: { - if (is_ssl_debug()) - { - char *addr = tfe_string_addr_create_by_fd(fd, CONN_DIR_DOWNSTREAM); - struct ssl_ja3 *fingerprint = ssl_ja3_generate_fingerprint(buf, n); - TFE_LOG_INFO(ctx->logger, "ja3:%s, hash:%s addr:%s\n", fingerprint ? fingerprint->ja3 : "null", fingerprint ? fingerprint->ja3_hash : "null", addr); - ssl_ja3_free(fingerprint); - free(addr); - } - promise_dettach_ctx(promise); ctx->chello=chello; promise_success(promise, ctx); @@ -1439,7 +1432,7 @@ static void peek_chello_on_succ(future_result_t * result, void * user) ret=ssl_service_cache_read(ctx->mgr->svc_cache, chello, s_stream->tcp_stream, svc_status); if(ret==1) { - TFE_LOG_DEBUG(ctx->mgr->logger, "%s %s service status pinning:%d, mauth:%d, err:%d, ct:%d, ev:%d, ja3_pinning_status:%d", + TFE_LOG_DEBUG(ctx->mgr->logger, "%s %s service status pinning:%d, mauth:%d, err:%d, ct:%d, ev:%d, is_app_not_pinning: %d", s_stream->tcp_stream->str_stream_info, chello->sni, svc_status->cli_pinning_status, @@ -1447,24 +1440,18 @@ static void peek_chello_on_succ(future_result_t * result, void * user) svc_status->has_protocol_errors, svc_status->is_ct, svc_status->is_ev, - svc_status->ja3_pinning_status); + svc_status->is_app_not_pinning + ); } - switch (svc_status->ja3_pinning_status) - { - case JA3_PINNING_STATUS_NOT_PINNING: - ctx->mgr->svc_cache->stat.app_not_pinning_cnt++; - ssl_stream_set_cmsg_uint8(s_stream, TFE_CMSG_SSL_PINNING_STATE, PINNING_ST_NOT_PINNING); - break; - case JA3_PINNING_STATUS_IS_PINNING: - ssl_stream_set_cmsg_uint8(s_stream, TFE_CMSG_SSL_PINNING_STATE, PINNING_ST_PINNING); - break; - case JA3_PINNING_STATUS_UNKNOWN: - /* fall through */ - default: - ssl_stream_set_cmsg_uint8(s_stream, TFE_CMSG_SSL_PINNING_STATE, svc_status->cli_pinning_status); - break; + + if (svc_status->is_app_not_pinning) + { + ssl_stream_set_cmsg_integer(s_stream, TFE_CMSG_SSL_PINNING_STATE, PINNING_ST_NOT_PINNING); + } + else + { + ssl_stream_set_cmsg_integer(s_stream, TFE_CMSG_SSL_PINNING_STATE, svc_status->cli_pinning_status); } - if(ctx->mgr->on_new_upstream_cb) { s_stream->up_parts.action=ctx->mgr->on_new_upstream_cb(s_stream, ctx->mgr->upstream_cb_param); @@ -2187,8 +2174,8 @@ int ssl_stream_get_integer_opt(struct ssl_stream *upstream, enum SSL_STREAM_OPT case SSL_STREAM_OPT_PINNING_STATUS: *opt_val=svc->cli_pinning_status; break; - case SSL_STREAM_OPT_JA3_PINNING_STATUS: - *opt_val=svc->ja3_pinning_status; + case SSL_STREAM_OPT_APP_STATUS: + *opt_val=svc->is_app_not_pinning; break; case SSL_STREAM_OPT_HAS_PROTOCOL_ERRORS: *opt_val=svc->has_protocol_errors; |