+++ /dev/null
-commit 0022167d80725513d95b38aaebc90086fc0b6938 (tag: refs/tags/M-staged-PR331, refs/remotes/origin/v4)
-Author: Christos Tsantilas <christos@chtsanti.net>
-Date: 2018-11-14 15:17:06 +0000
-
- The %>handshake logformat code (#331)
-
- Logging client "handshake" bytes is useful in at least two contexts:
-
- * Runtime traffic bypass and bumping/splicing decisions. Identifying
- popular clients like Skype for Business (that uses a TLS handshake but
- then may not speak TLS) is critical for handling their traffic
- correctly. Squid does not have enough ACLs to interrogate most TLS
- handshake aspects. Adding more ACLs may still be a good idea, but
- initial sketches for SfB handshakes showed rather complex
- ACLs/configurations, _and_ no reasonable ACLs would be able to handle
- non-TLS handshakes. An external ACL receiving the handshake is in a
- much better position to analyze/fingerprint it according to custom
- admin needs.
-
- * A logged handshake can be used to analyze new/unusual traffic or even
- trigger security-related alarms.
-
- The current support is limited to cases where Squid was saving handshake
- for other reasons. With enough demand, this initial support can be
- extended to all protocols and port configurations.
-
- This is a Measurement Factory project.
-
-diff --git a/src/cf.data.pre b/src/cf.data.pre
-index fa8af56..a8ca587 100644
---- a/src/cf.data.pre
-+++ b/src/cf.data.pre
-@@ -4394,6 +4394,37 @@ DOC_START
- <qos Server connection TOS/DSCP value set by Squid
- <nfmark Server connection netfilter mark set by Squid
-
-+ >handshake Raw client handshake
-+ Initial client bytes received by Squid on a newly
-+ accepted TCP connection or inside a just established
-+ CONNECT tunnel. Squid stops accumulating handshake
-+ bytes as soon as the handshake parser succeeds or
-+ fails (determining whether the client is using the
-+ expected protocol).
-+
-+ For HTTP clients, the handshake is the request line.
-+ For TLS clients, the handshake consists of all TLS
-+ records up to and including the TLS record that
-+ contains the last byte of the first ClientHello
-+ message. For clients using an unsupported protocol,
-+ this field contains the bytes received by Squid at the
-+ time of the handshake parsing failure.
-+
-+ See the on_unsupported_protocol directive for more
-+ information on Squid handshake traffic expectations.
-+
-+ Current support is limited to these contexts:
-+ - http_port connections, but only when the
-+ on_unsupported_protocol directive is in use.
-+ - https_port connections (and CONNECT tunnels) that
-+ are subject to the ssl_bump peek or stare action.
-+
-+ To protect binary handshake data, this field is always
-+ base64-encoded (RFC 4648 Section 4). If logformat
-+ field encoding is configured, that encoding is applied
-+ on top of base64. Otherwise, the computed base64 value
-+ is recorded as is.
-+
- Time related format codes:
-
- ts Seconds since epoch
-diff --git a/src/format/ByteCode.h b/src/format/ByteCode.h
-index ad230bb..a6f8fd9 100644
---- a/src/format/ByteCode.h
-+++ b/src/format/ByteCode.h
-@@ -46,6 +46,8 @@ typedef enum {
- LFT_CLIENT_LOCAL_TOS,
- LFT_CLIENT_LOCAL_NFMARK,
-
-+ LFT_CLIENT_HANDSHAKE,
-+
- /* client connection local squid.conf details */
- LFT_LOCAL_LISTENING_IP,
- LFT_LOCAL_LISTENING_PORT,
-diff --git a/src/format/Format.cc b/src/format/Format.cc
-index c1e19b4..8fd6720 100644
---- a/src/format/Format.cc
-+++ b/src/format/Format.cc
-@@ -8,6 +8,7 @@
-
- #include "squid.h"
- #include "AccessLogEntry.h"
-+#include "base64.h"
- #include "client_side.h"
- #include "comm/Connection.h"
- #include "err_detail_type.h"
-@@ -547,6 +548,24 @@ Format::Format::assemble(MemBuf &mb, const AccessLogEntry::Pointer &al, int logS
- }
- break;
-
-+ case LFT_CLIENT_HANDSHAKE:
-+ if (al->request && al->request->clientConnectionManager.valid()) {
-+ const auto &handshake = al->request->clientConnectionManager->preservedClientData;
-+ if (const auto rawLength = handshake.length()) {
-+ // add 1 byte to optimize the c_str() conversion below
-+ char *buf = sb.rawAppendStart(base64_encode_len(rawLength) + 1);
-+
-+ struct base64_encode_ctx ctx;
-+ base64_encode_init(&ctx);
-+ auto encLength = base64_encode_update(&ctx, buf, rawLength, reinterpret_cast<const uint8_t*>(handshake.rawContent()));
-+ encLength += base64_encode_final(&ctx, buf + encLength);
-+
-+ sb.rawAppendFinish(buf, encLength);
-+ out = sb.c_str();
-+ }
-+ }
-+ break;
-+
- case LFT_TIME_SECONDS_SINCE_EPOCH:
- // some platforms store time in 32-bit, some 64-bit...
- outoff = static_cast<int64_t>(current_time.tv_sec);
-diff --git a/src/format/Token.cc b/src/format/Token.cc
-index 186ade5..06c60cf 100644
---- a/src/format/Token.cc
-+++ b/src/format/Token.cc
-@@ -141,6 +141,7 @@ static TokenTableEntry TokenTableMisc[] = {
- TokenTableEntry("<qos", LFT_SERVER_LOCAL_TOS),
- TokenTableEntry(">nfmark", LFT_CLIENT_LOCAL_NFMARK),
- TokenTableEntry("<nfmark", LFT_SERVER_LOCAL_NFMARK),
-+ TokenTableEntry(">handshake", LFT_CLIENT_HANDSHAKE),
- TokenTableEntry("err_code", LFT_SQUID_ERROR ),
- TokenTableEntry("err_detail", LFT_SQUID_ERROR_DETAIL ),
- TokenTableEntry("note", LFT_NOTE ),
projects / ipfire-2.x.git / blobdiff