Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Check verify policy and properties #7559

Merged
merged 1 commit into from
Feb 25, 2021
Merged

Check verify policy and properties #7559

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions iocore/net/P_SSLUtils.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -144,6 +144,10 @@ void setTLSValidProtocols(SSL *ssl, unsigned long proto_mask, unsigned long max_
// Used as part of the lookup key into the origin server session cache
std::string get_sni_addr(SSL *ssl);

// Helper functions to retrieve server verify policy and properties from a SSL object
// Used as part of the lookup key into the origin server session cache
std::string get_verify_str(SSL *ssl);

namespace ssl
{
namespace detail
Expand Down
5 changes: 1 addition & 4 deletions iocore/net/SSLClientUtils.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -161,11 +161,8 @@ ssl_new_session_callback(SSL *ssl, SSL_SESSION *sess)
{
std::string sni_addr = get_sni_addr(ssl);
if (!sni_addr.empty()) {
SSL_CTX *ctx = SSL_get_SSL_CTX(ssl);
std::stringstream ctx_ss;
ctx_ss << static_cast<const void *>(ctx);
std::string lookup_key;
ts::bwprint(lookup_key, "{}:{}", sni_addr.c_str(), ctx_ss.str().c_str());
ts::bwprint(lookup_key, "{}:{}:{}", sni_addr.c_str(), SSL_get_SSL_CTX(ssl), get_verify_str(ssl));
origin_sess_cache->insert_session(lookup_key, sess);
return 1;
} else {
Expand Down
53 changes: 49 additions & 4 deletions iocore/net/SSLUtils.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1997,11 +1997,8 @@ SSLConnect(SSL *ssl)
if (!sess && SSLConfigParams::origin_session_cache == 1 && SSLConfigParams::origin_session_cache_size > 0) {
std::string sni_addr = get_sni_addr(ssl);
if (!sni_addr.empty()) {
SSL_CTX *ctx = SSL_get_SSL_CTX(ssl);
std::stringstream ctx_ss;
ctx_ss << static_cast<const void *>(ctx);
std::string lookup_key;
ts::bwprint(lookup_key, "{}:{}", sni_addr.c_str(), ctx_ss.str().c_str());
ts::bwprint(lookup_key, "{}:{}:{}", sni_addr.c_str(), SSL_get_SSL_CTX(ssl), get_verify_str(ssl));

Debug("ssl.origin_session_cache", "origin session cache lookup key = %s", lookup_key.c_str());

Expand Down Expand Up @@ -2065,6 +2062,54 @@ get_sni_addr(SSL *ssl)
return sni_addr;
}

std::string
get_verify_str(SSL *ssl)
{
std::string verify_str;

SSLNetVConnection *netvc = SSLNetVCAccess(ssl);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SSLNetVCAccess 😞 I don't see it as a blocker because QUIC connection to origin is probably years away, but we should try to avoid using it for new stuff.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, we probably could store something in the ex_data of the SSL object.

if (netvc != nullptr) {
std::string policy_str;
switch (netvc->options.verifyServerPolicy) {
case YamlSNIConfig::Policy::DISABLED:
policy_str.assign("DISABLED");
break;
case YamlSNIConfig::Policy::PERMISSIVE:
policy_str.assign("PERMISSIVE");
break;
case YamlSNIConfig::Policy::ENFORCED:
policy_str.assign("ENFORCED");
break;
case YamlSNIConfig::Policy::UNSET:
policy_str.assign("UNSET");
break;
}

std::string property_str;
switch (netvc->options.verifyServerProperties) {
case YamlSNIConfig::Property::NONE:
property_str.assign("NONE");
break;
case YamlSNIConfig::Property::SIGNATURE_MASK:
property_str.assign("SIGNATURE_MASK");
break;
case YamlSNIConfig::Property::NAME_MASK:
property_str.assign("NAME_MASK");
break;
case YamlSNIConfig::Property::ALL_MASK:
property_str.assign("ALL_MASK");
break;
case YamlSNIConfig::Property::UNSET:
property_str.assign("UNSET");
break;
}

ts::bwprint(verify_str, "{}:{}", policy_str.c_str(), property_str.c_str());
}

return verify_str;
}

/**
* Process the config to pull out the list of file names, and process the certs to get the list
* of subject and sni names. Thanks to dual cert configurations, there may be mulitple files of each type.
Expand Down