caching_cert_verifier.h 5.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141
  1. // Copyright 2016 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef NET_CERT_CACHING_CERT_VERIFIER_H_
  5. #define NET_CERT_CACHING_CERT_VERIFIER_H_
  6. #include <memory>
  7. #include "base/gtest_prod_util.h"
  8. #include "base/time/time.h"
  9. #include "net/base/completion_once_callback.h"
  10. #include "net/base/expiring_cache.h"
  11. #include "net/base/net_export.h"
  12. #include "net/cert/cert_database.h"
  13. #include "net/cert/cert_verifier.h"
  14. #include "net/cert/cert_verify_result.h"
  15. namespace net {
  16. // CertVerifier that caches the results of certificate verifications.
  17. //
  18. // In general, certificate verification results will vary on only three
  19. // parameters:
  20. // - The time of validation (as certificates are only valid for a period of
  21. // time)
  22. // - The revocation status (a certificate may be revoked at any time, but
  23. // revocation statuses themselves have validity period, so a 'good' result
  24. // may be reused for a period of time)
  25. // - The trust settings (a user may change trust settings at any time)
  26. //
  27. // This class tries to optimize by allowing certificate verification results
  28. // to be cached for a limited amount of time (presently, 30 minutes), which
  29. // tries to balance the implementation complexity of needing to monitor the
  30. // above for meaningful changes and the practical utility of being able to
  31. // cache results when they're not expected to change.
  32. class NET_EXPORT CachingCertVerifier : public CertVerifier,
  33. public CertDatabase::Observer {
  34. public:
  35. // Creates a CachingCertVerifier that will use |verifier| to perform the
  36. // actual verifications if they're not already cached or if the cached
  37. // item has expired.
  38. explicit CachingCertVerifier(std::unique_ptr<CertVerifier> verifier);
  39. CachingCertVerifier(const CachingCertVerifier&) = delete;
  40. CachingCertVerifier& operator=(const CachingCertVerifier&) = delete;
  41. ~CachingCertVerifier() override;
  42. // CertVerifier implementation:
  43. int Verify(const RequestParams& params,
  44. CertVerifyResult* verify_result,
  45. CompletionOnceCallback callback,
  46. std::unique_ptr<Request>* out_req,
  47. const NetLogWithSource& net_log) override;
  48. void SetConfig(const Config& config) override;
  49. private:
  50. FRIEND_TEST_ALL_PREFIXES(CachingCertVerifierTest, CacheHit);
  51. FRIEND_TEST_ALL_PREFIXES(CachingCertVerifierTest, CacheHitCTResultsCached);
  52. FRIEND_TEST_ALL_PREFIXES(CachingCertVerifierTest, Visitor);
  53. FRIEND_TEST_ALL_PREFIXES(CachingCertVerifierTest, AddsEntries);
  54. FRIEND_TEST_ALL_PREFIXES(CachingCertVerifierTest, DifferentCACerts);
  55. // CachedResult contains the result of a certificate verification.
  56. struct NET_EXPORT_PRIVATE CachedResult {
  57. CachedResult();
  58. ~CachedResult();
  59. int error = ERR_FAILED; // The return value of CertVerifier::Verify.
  60. CertVerifyResult result; // The output of CertVerifier::Verify.
  61. };
  62. // Rather than having a single validity point along a monotonically increasing
  63. // timeline, certificate verification is based on falling within a range of
  64. // the certificate's NotBefore and NotAfter and based on what the current
  65. // system clock says (which may advance forwards or backwards as users correct
  66. // clock skew). CacheValidityPeriod and CacheExpirationFunctor are helpers to
  67. // ensure that expiration is measured both by the 'general' case (now + cache
  68. // TTL) and by whether or not significant enough clock skew was introduced
  69. // since the last verification.
  70. struct CacheValidityPeriod {
  71. explicit CacheValidityPeriod(base::Time now);
  72. CacheValidityPeriod(base::Time now, base::Time expiration);
  73. base::Time verification_time;
  74. base::Time expiration_time;
  75. };
  76. struct CacheExpirationFunctor {
  77. // Returns true iff |now| is within the validity period of |expiration|.
  78. bool operator()(const CacheValidityPeriod& now,
  79. const CacheValidityPeriod& expiration) const;
  80. };
  81. using CertVerificationCache = ExpiringCache<RequestParams,
  82. CachedResult,
  83. CacheValidityPeriod,
  84. CacheExpirationFunctor>;
  85. // Handles completion of the request matching |params|, which started at
  86. // |start_time| and with config |config_id|, completing. |verify_result| and
  87. // |result| are added to the cache, and then |callback| (the original caller's
  88. // callback) is invoked.
  89. void OnRequestFinished(uint32_t config_id,
  90. const RequestParams& params,
  91. base::Time start_time,
  92. CompletionOnceCallback callback,
  93. CertVerifyResult* verify_result,
  94. int error);
  95. // Adds |verify_result| and |error| to the cache for |params|, whose
  96. // verification attempt began at |start_time| with config |config_id|. See the
  97. // implementation for more details about the necessity of |start_time|.
  98. void AddResultToCache(uint32_t config_id,
  99. const RequestParams& params,
  100. base::Time start_time,
  101. const CertVerifyResult& verify_result,
  102. int error);
  103. // CertDatabase::Observer methods:
  104. void OnCertDBChanged() override;
  105. // For unit testing.
  106. void ClearCache();
  107. size_t GetCacheSize() const;
  108. uint64_t cache_hits() const { return cache_hits_; }
  109. uint64_t requests() const { return requests_; }
  110. std::unique_ptr<CertVerifier> verifier_;
  111. uint32_t config_id_ = 0u;
  112. CertVerificationCache cache_;
  113. uint64_t requests_ = 0u;
  114. uint64_t cache_hits_ = 0u;
  115. };
  116. } // namespace net
  117. #endif // NET_CERT_CACHING_CERT_VERIFIER_H_