// Copyright 2015 The Chromium Authors. All rights reserved. // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. #include "net/ssl/ssl_client_session_cache.h" #include #include #include "base/containers/flat_set.h" #include "base/time/clock.h" #include "base/time/default_clock.h" #include "third_party/boringssl/src/include/openssl/ssl.h" namespace net { namespace { // Returns a tuple of references to fields of |key|, for comparison purposes. auto TieKeyFields(const SSLClientSessionCache::Key& key) { return std::tie(key.server, key.dest_ip_addr, key.network_isolation_key, key.privacy_mode, key.disable_legacy_crypto); } } // namespace SSLClientSessionCache::Key::Key() = default; SSLClientSessionCache::Key::Key(const Key& other) = default; SSLClientSessionCache::Key::Key(Key&& other) = default; SSLClientSessionCache::Key::~Key() = default; SSLClientSessionCache::Key& SSLClientSessionCache::Key::operator=( const Key& other) = default; SSLClientSessionCache::Key& SSLClientSessionCache::Key::operator=(Key&& other) = default; bool SSLClientSessionCache::Key::operator==(const Key& other) const { return TieKeyFields(*this) == TieKeyFields(other); } bool SSLClientSessionCache::Key::operator<(const Key& other) const { return TieKeyFields(*this) < TieKeyFields(other); } SSLClientSessionCache::SSLClientSessionCache(const Config& config) : clock_(base::DefaultClock::GetInstance()), config_(config), cache_(config.max_entries) { memory_pressure_listener_ = std::make_unique( FROM_HERE, base::BindRepeating(&SSLClientSessionCache::OnMemoryPressure, base::Unretained(this))); } SSLClientSessionCache::~SSLClientSessionCache() { Flush(); } size_t SSLClientSessionCache::size() const { return cache_.size(); } bssl::UniquePtr SSLClientSessionCache::Lookup( const Key& cache_key) { // Expire stale sessions. lookups_since_flush_++; if (lookups_since_flush_ >= config_.expiration_check_count) { lookups_since_flush_ = 0; FlushExpiredSessions(); } auto iter = cache_.Get(cache_key); if (iter == cache_.end()) return nullptr; time_t now = clock_->Now().ToTimeT(); bssl::UniquePtr session = iter->second.Pop(); if (iter->second.ExpireSessions(now)) cache_.Erase(iter); if (IsExpired(session.get(), now)) session = nullptr; return session; } void SSLClientSessionCache::Insert(const Key& cache_key, bssl::UniquePtr session) { auto iter = cache_.Get(cache_key); if (iter == cache_.end()) iter = cache_.Put(cache_key, Entry()); iter->second.Push(std::move(session)); } void SSLClientSessionCache::ClearEarlyData(const Key& cache_key) { auto iter = cache_.Get(cache_key); if (iter != cache_.end()) { for (auto& session : iter->second.sessions) { if (session) { session.reset(SSL_SESSION_copy_without_early_data(session.get())); } } } } void SSLClientSessionCache::FlushForServer(const HostPortPair& server) { auto iter = cache_.begin(); while (iter != cache_.end()) { if (iter->first.server == server) { iter = cache_.Erase(iter); } else { ++iter; } } } void SSLClientSessionCache::Flush() { cache_.Clear(); } void SSLClientSessionCache::SetClockForTesting(base::Clock* clock) { clock_ = clock; } bool SSLClientSessionCache::IsExpired(SSL_SESSION* session, time_t now) { if (now < 0) return true; uint64_t now_u64 = static_cast(now); // now_u64 may be slightly behind because of differences in how // time is calculated at this layer versus BoringSSL. // Add a second of wiggle room to account for this. return now_u64 < SSL_SESSION_get_time(session) - 1 || now_u64 >= SSL_SESSION_get_time(session) + SSL_SESSION_get_timeout(session); } SSLClientSessionCache::Entry::Entry() = default; SSLClientSessionCache::Entry::Entry(Entry&&) = default; SSLClientSessionCache::Entry::~Entry() = default; void SSLClientSessionCache::Entry::Push(bssl::UniquePtr session) { if (sessions[0] != nullptr && SSL_SESSION_should_be_single_use(sessions[0].get())) { sessions[1] = std::move(sessions[0]); } sessions[0] = std::move(session); } bssl::UniquePtr SSLClientSessionCache::Entry::Pop() { if (sessions[0] == nullptr) return nullptr; bssl::UniquePtr session = bssl::UpRef(sessions[0]); if (SSL_SESSION_should_be_single_use(session.get())) { sessions[0] = std::move(sessions[1]); sessions[1] = nullptr; } return session; } bool SSLClientSessionCache::Entry::ExpireSessions(time_t now) { if (sessions[0] == nullptr) return true; if (SSLClientSessionCache::IsExpired(sessions[0].get(), now)) { return true; } if (sessions[1] != nullptr && SSLClientSessionCache::IsExpired(sessions[1].get(), now)) { sessions[1] = nullptr; } return false; } void SSLClientSessionCache::FlushExpiredSessions() { time_t now = clock_->Now().ToTimeT(); auto iter = cache_.begin(); while (iter != cache_.end()) { if (iter->second.ExpireSessions(now)) { iter = cache_.Erase(iter); } else { ++iter; } } } void SSLClientSessionCache::OnMemoryPressure( base::MemoryPressureListener::MemoryPressureLevel memory_pressure_level) { switch (memory_pressure_level) { case base::MemoryPressureListener::MEMORY_PRESSURE_LEVEL_NONE: break; case base::MemoryPressureListener::MEMORY_PRESSURE_LEVEL_MODERATE: FlushExpiredSessions(); break; case base::MemoryPressureListener::MEMORY_PRESSURE_LEVEL_CRITICAL: Flush(); break; } } } // namespace net