make TLS tickets assign sessions

Author: Snawoot

auth/auth.go

@@ -41,8 +41,8 @@ func NewAuth(paramstr string, logger *clog.CondLogger) (Auth, error) {
 		return NewRejectHTTPAuth(url, logger)
 	case "reject-static":
 		return NewStaticRejectAuth(url, logger)
-	case "tlsticket":
-		return NewTLSTicketAuth(url, logger)
+	case "tlscookie":
+		return NewTLSCookieAuth(url, logger)
 	default:
 		return nil, errors.New("Unknown auth scheme")
 	}

auth/ticket.go auth/tlscookie.goauth/ticket.go renamed to auth/tlscookie.go

@@ -2,6 +2,8 @@ package auth
 
 import (
 	"context"
+	"encoding/hex"
+	"errors"
 	"fmt"
 	"net/http"
 	"net/url"
@@ -13,21 +15,39 @@ import (
 	"github.com/SenseUnit/dumbproxy/tlsutil"
 )
 
-type TLSTicketAuth struct {
+type sessionValidator interface {
+	Valid(sessionID, _, userAddr string) bool
+}
+
+type TLSCookieAuth struct {
 	logger   *clog.CondLogger
 	stopOnce sync.Once
 	next     Auth
 	reject   Auth
+	lookup   sessionValidator
 }
 
-func NewTLSTicketAuth(param_url *url.URL, logger *clog.CondLogger) (*TLSTicketAuth, error) {
+func NewTLSCookieAuth(param_url *url.URL, logger *clog.CondLogger) (*TLSCookieAuth, error) {
 	values, err := url.ParseQuery(param_url.RawQuery)
 	if err != nil {
 		return nil, err
 	}
-	auth := &TLSTicketAuth{
+	auth := &TLSCookieAuth{
 		logger: logger,
 	}
+	if lookupURL := values.Get("lookup"); lookupURL == "" {
+		return nil, errors.New("\"lookup\" parameter is mandatory for TLS cookie auth provider")
+	} else {
+		lookupAuth, err := NewAuth(lookupURL, logger)
+		if err != nil {
+			return nil, fmt.Errorf("unable to construct lookup provider for TLS cookie auth provider: %w", err)
+		}
+		lookup, ok := lookupAuth.(sessionValidator)
+		if !ok {
+			return nil, fmt.Errorf("unable to construct TLS cookie auth provider: provided lookup provider %q is not suitable for session validation", lookupURL)
+		}
+		auth.lookup = lookup
+	}
 	if nextAuth := values.Get("next"); nextAuth != "" {
 		nap, err := NewAuth(nextAuth, logger)
 		if err != nil {
@@ -45,25 +65,31 @@ func NewTLSTicketAuth(param_url *url.URL, logger *clog.CondLogger) (*TLSTicketAu
 	return auth, nil
 }
 
-func (auth *TLSTicketAuth) Validate(ctx context.Context, wr http.ResponseWriter, req *http.Request) (string, bool) {
-	if !tlsutil.NonDefaultKeyUsedFromContext(ctx) {
+func (auth *TLSCookieAuth) Validate(ctx context.Context, wr http.ResponseWriter, req *http.Request) (string, bool) {
+	sessionID, ok := tlsutil.TLSSessionIDFromContext(ctx)
+	if !ok {
+		auth.logger.Debug("tlscookie: no session extracted for %s", req.RemoteAddr)
+		return auth.handleReject(ctx, wr, req)
+	}
+	if !auth.lookup.Valid(hex.EncodeToString(sessionID[:]), "", req.RemoteAddr) {
+		auth.logger.Info("tlscookie: session ID %x from %s is not permitted", sessionID, req.RemoteAddr)
 		return auth.handleReject(ctx, wr, req)
 	}
 	if auth.next != nil {
 		return auth.next.Validate(ctx, wr, req)
 	}
-	return "", true
+	return fmt.Sprintf("tlscookie:%x", sessionID), true
 }
 
-func (auth *TLSTicketAuth) handleReject(ctx context.Context, wr http.ResponseWriter, req *http.Request) (string, bool) {
+func (auth *TLSCookieAuth) handleReject(ctx context.Context, wr http.ResponseWriter, req *http.Request) (string, bool) {
 	if auth.reject != nil {
 		return auth.reject.Validate(ctx, wr, req)
 	}
 	http.Error(wr, BAD_REQ_MSG, http.StatusBadRequest)
 	return "", false
 }
 
-func (auth *TLSTicketAuth) Close() error {
+func (auth *TLSCookieAuth) Close() error {
 	var err error
 	auth.stopOnce.Do(func() {
 		if auth.next != nil {

main.go

@@ -314,7 +314,7 @@ type CLIArgs struct {
 	maxTLSVersion            TLSVersionArg
 	tlsALPNEnabled           bool
 	tlsSessionKeys           [][32]byte
-	tlsSameSessionKey        bool
+	tlsCookies               bool
 	bwLimit                  forward.LimitSpec
 	bwBurst                  int64
 	bwSeparate               bool
@@ -506,7 +506,7 @@ func parse_args() *CLIArgs {
 		args.tlsSessionKeys = append(args.tlsSessionKeys, [32]byte(key))
 		return nil
 	})
-	flag.BoolVar(&args.tlsSameSessionKey, "tls-same-session-key", true, "issue new TLS session tickets with the same key used for previous ticket")
+	flag.BoolVar(&args.tlsCookies, "tls-cookies", true, "mark TLS sessions with cookie-like unique session IDs")
 	flag.Func("config", "read configuration from file with space-separated keys and values", readConfig)
 	flag.Parse()
 	// pull up remaining parameters from other BW-related arguments
@@ -897,7 +897,7 @@ func run() int {
 				return stopContext
 			},
 			ConnContext: func(ctx context.Context, conn net.Conn) context.Context {
-				return tlsutil.NonDefaultKeyUsedToContext(ctx, conn)
+				return tlsutil.TLSSessionIDToContext(ctx, conn)
 			},
 		}
 		if args.disableHTTP2 {
@@ -1051,8 +1051,8 @@ func makeServerTLSConfig(args *CLIArgs, logger *clog.CondLogger) (*tls.Config, e
 	}
 	if len(args.tlsSessionKeys) > 0 {
 		cfg.SetSessionTicketKeys(args.tlsSessionKeys)
-		if args.tlsSameSessionKey {
-			cfg = tlsutil.PreserveSessionKeys(cfg, args.tlsSessionKeys, logger)
+		if args.tlsCookies {
+			cfg = tlsutil.EnableTLSCookies(cfg, logger)
 		}
 	}
 	return cfg, nil