ssl_client_session_cache.cc 5.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201
  1. // Copyright 2015 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "net/ssl/ssl_client_session_cache.h"
  5. #include <tuple>
  6. #include <utility>
  7. #include "base/containers/flat_set.h"
  8. #include "base/time/clock.h"
  9. #include "base/time/default_clock.h"
  10. #include "third_party/boringssl/src/include/openssl/ssl.h"
  11. namespace net {
  12. namespace {
  13. // Returns a tuple of references to fields of |key|, for comparison purposes.
  14. auto TieKeyFields(const SSLClientSessionCache::Key& key) {
  15. return std::tie(key.server, key.dest_ip_addr, key.network_isolation_key,
  16. key.privacy_mode, key.disable_legacy_crypto);
  17. }
  18. } // namespace
  19. SSLClientSessionCache::Key::Key() = default;
  20. SSLClientSessionCache::Key::Key(const Key& other) = default;
  21. SSLClientSessionCache::Key::Key(Key&& other) = default;
  22. SSLClientSessionCache::Key::~Key() = default;
  23. SSLClientSessionCache::Key& SSLClientSessionCache::Key::operator=(
  24. const Key& other) = default;
  25. SSLClientSessionCache::Key& SSLClientSessionCache::Key::operator=(Key&& other) =
  26. default;
  27. bool SSLClientSessionCache::Key::operator==(const Key& other) const {
  28. return TieKeyFields(*this) == TieKeyFields(other);
  29. }
  30. bool SSLClientSessionCache::Key::operator<(const Key& other) const {
  31. return TieKeyFields(*this) < TieKeyFields(other);
  32. }
  33. SSLClientSessionCache::SSLClientSessionCache(const Config& config)
  34. : clock_(base::DefaultClock::GetInstance()),
  35. config_(config),
  36. cache_(config.max_entries) {
  37. memory_pressure_listener_ = std::make_unique<base::MemoryPressureListener>(
  38. FROM_HERE, base::BindRepeating(&SSLClientSessionCache::OnMemoryPressure,
  39. base::Unretained(this)));
  40. }
  41. SSLClientSessionCache::~SSLClientSessionCache() {
  42. Flush();
  43. }
  44. size_t SSLClientSessionCache::size() const {
  45. return cache_.size();
  46. }
  47. bssl::UniquePtr<SSL_SESSION> SSLClientSessionCache::Lookup(
  48. const Key& cache_key) {
  49. // Expire stale sessions.
  50. lookups_since_flush_++;
  51. if (lookups_since_flush_ >= config_.expiration_check_count) {
  52. lookups_since_flush_ = 0;
  53. FlushExpiredSessions();
  54. }
  55. auto iter = cache_.Get(cache_key);
  56. if (iter == cache_.end())
  57. return nullptr;
  58. time_t now = clock_->Now().ToTimeT();
  59. bssl::UniquePtr<SSL_SESSION> session = iter->second.Pop();
  60. if (iter->second.ExpireSessions(now))
  61. cache_.Erase(iter);
  62. if (IsExpired(session.get(), now))
  63. session = nullptr;
  64. return session;
  65. }
  66. void SSLClientSessionCache::Insert(const Key& cache_key,
  67. bssl::UniquePtr<SSL_SESSION> session) {
  68. auto iter = cache_.Get(cache_key);
  69. if (iter == cache_.end())
  70. iter = cache_.Put(cache_key, Entry());
  71. iter->second.Push(std::move(session));
  72. }
  73. void SSLClientSessionCache::ClearEarlyData(const Key& cache_key) {
  74. auto iter = cache_.Get(cache_key);
  75. if (iter != cache_.end()) {
  76. for (auto& session : iter->second.sessions) {
  77. if (session) {
  78. session.reset(SSL_SESSION_copy_without_early_data(session.get()));
  79. }
  80. }
  81. }
  82. }
  83. void SSLClientSessionCache::FlushForServer(const HostPortPair& server) {
  84. auto iter = cache_.begin();
  85. while (iter != cache_.end()) {
  86. if (iter->first.server == server) {
  87. iter = cache_.Erase(iter);
  88. } else {
  89. ++iter;
  90. }
  91. }
  92. }
  93. void SSLClientSessionCache::Flush() {
  94. cache_.Clear();
  95. }
  96. void SSLClientSessionCache::SetClockForTesting(base::Clock* clock) {
  97. clock_ = clock;
  98. }
  99. bool SSLClientSessionCache::IsExpired(SSL_SESSION* session, time_t now) {
  100. if (now < 0)
  101. return true;
  102. uint64_t now_u64 = static_cast<uint64_t>(now);
  103. // now_u64 may be slightly behind because of differences in how
  104. // time is calculated at this layer versus BoringSSL.
  105. // Add a second of wiggle room to account for this.
  106. return now_u64 < SSL_SESSION_get_time(session) - 1 ||
  107. now_u64 >=
  108. SSL_SESSION_get_time(session) + SSL_SESSION_get_timeout(session);
  109. }
  110. SSLClientSessionCache::Entry::Entry() = default;
  111. SSLClientSessionCache::Entry::Entry(Entry&&) = default;
  112. SSLClientSessionCache::Entry::~Entry() = default;
  113. void SSLClientSessionCache::Entry::Push(bssl::UniquePtr<SSL_SESSION> session) {
  114. if (sessions[0] != nullptr &&
  115. SSL_SESSION_should_be_single_use(sessions[0].get())) {
  116. sessions[1] = std::move(sessions[0]);
  117. }
  118. sessions[0] = std::move(session);
  119. }
  120. bssl::UniquePtr<SSL_SESSION> SSLClientSessionCache::Entry::Pop() {
  121. if (sessions[0] == nullptr)
  122. return nullptr;
  123. bssl::UniquePtr<SSL_SESSION> session = bssl::UpRef(sessions[0]);
  124. if (SSL_SESSION_should_be_single_use(session.get())) {
  125. sessions[0] = std::move(sessions[1]);
  126. sessions[1] = nullptr;
  127. }
  128. return session;
  129. }
  130. bool SSLClientSessionCache::Entry::ExpireSessions(time_t now) {
  131. if (sessions[0] == nullptr)
  132. return true;
  133. if (SSLClientSessionCache::IsExpired(sessions[0].get(), now)) {
  134. return true;
  135. }
  136. if (sessions[1] != nullptr &&
  137. SSLClientSessionCache::IsExpired(sessions[1].get(), now)) {
  138. sessions[1] = nullptr;
  139. }
  140. return false;
  141. }
  142. void SSLClientSessionCache::FlushExpiredSessions() {
  143. time_t now = clock_->Now().ToTimeT();
  144. auto iter = cache_.begin();
  145. while (iter != cache_.end()) {
  146. if (iter->second.ExpireSessions(now)) {
  147. iter = cache_.Erase(iter);
  148. } else {
  149. ++iter;
  150. }
  151. }
  152. }
  153. void SSLClientSessionCache::OnMemoryPressure(
  154. base::MemoryPressureListener::MemoryPressureLevel memory_pressure_level) {
  155. switch (memory_pressure_level) {
  156. case base::MemoryPressureListener::MEMORY_PRESSURE_LEVEL_NONE:
  157. break;
  158. case base::MemoryPressureListener::MEMORY_PRESSURE_LEVEL_MODERATE:
  159. FlushExpiredSessions();
  160. break;
  161. case base::MemoryPressureListener::MEMORY_PRESSURE_LEVEL_CRITICAL:
  162. Flush();
  163. break;
  164. }
  165. }
  166. } // namespace net