Index: net/base/cert_verifier.cc |
=================================================================== |
--- net/base/cert_verifier.cc (revision 128056) |
+++ net/base/cert_verifier.cc (working copy) |
@@ -4,499 +4,12 @@ |
#include "net/base/cert_verifier.h" |
-#include "base/bind.h" |
-#include "base/bind_helpers.h" |
-#include "base/compiler_specific.h" |
-#include "base/message_loop.h" |
-#include "base/metrics/histogram.h" |
-#include "base/stl_util.h" |
-#include "base/synchronization/lock.h" |
-#include "base/time.h" |
-#include "base/threading/worker_pool.h" |
-#include "net/base/crl_set.h" |
-#include "net/base/net_errors.h" |
-#include "net/base/net_log.h" |
-#include "net/base/x509_certificate.h" |
-#include "net/base/x509_certificate_net_log_param.h" |
+#include "net/base/multi_threaded_cert_verifier.h" |
-#if defined(USE_NSS) |
-#include <private/pprthred.h> // PR_DetachThread |
-#endif |
- |
namespace net { |
-//////////////////////////////////////////////////////////////////////////// |
- |
-// Life of a request: |
-// |
-// CertVerifier CertVerifierJob CertVerifierWorker Request |
-// | (origin loop) (worker loop) |
-// | |
-// Verify() |
-// |---->-------------------<creates> |
-// | |
-// |---->----<creates> |
-// | |
-// |---->---------------------------------------------------<creates> |
-// | |
-// |---->--------------------Start |
-// | | |
-// | PostTask |
-// | |
-// | <starts verifying> |
-// |---->-----AddRequest | |
-// | |
-// | |
-// | |
-// Finish |
-// | |
-// PostTask |
-// |
-// | |
-// DoReply |
-// |----<-----------------------| |
-// HandleResult |
-// | |
-// |---->-----HandleResult |
-// | |
-// |------>-----------------------------------Post |
-// |
-// |
-// |
-// On a cache hit, CertVerifier::Verify() returns synchronously without |
-// posting a task to a worker thread. |
- |
-namespace { |
- |
-// The default value of max_cache_entries_. |
-const unsigned kMaxCacheEntries = 256; |
- |
-// The number of seconds for which we'll cache a cache entry. |
-const unsigned kTTLSecs = 1800; // 30 minutes. |
- |
-} // namespace |
- |
-CertVerifier::CachedResult::CachedResult() : error(ERR_FAILED) {} |
- |
-CertVerifier::CachedResult::~CachedResult() {} |
- |
-// Represents the output and result callback of a request. |
-class CertVerifierRequest { |
- public: |
- CertVerifierRequest(const CompletionCallback& callback, |
- CertVerifyResult* verify_result, |
- const BoundNetLog& net_log) |
- : callback_(callback), |
- verify_result_(verify_result), |
- net_log_(net_log) { |
- net_log_.BeginEvent(NetLog::TYPE_CERT_VERIFIER_REQUEST, NULL); |
- } |
- |
- ~CertVerifierRequest() { |
- } |
- |
- // Ensures that the result callback will never be made. |
- void Cancel() { |
- callback_.Reset(); |
- verify_result_ = NULL; |
- net_log_.AddEvent(NetLog::TYPE_CANCELLED, NULL); |
- net_log_.EndEvent(NetLog::TYPE_CERT_VERIFIER_REQUEST, NULL); |
- } |
- |
- // Copies the contents of |verify_result| to the caller's |
- // CertVerifyResult and calls the callback. |
- void Post(const CertVerifier::CachedResult& verify_result) { |
- if (!callback_.is_null()) { |
- net_log_.EndEvent(NetLog::TYPE_CERT_VERIFIER_REQUEST, NULL); |
- *verify_result_ = verify_result.result; |
- callback_.Run(verify_result.error); |
- } |
- delete this; |
- } |
- |
- bool canceled() const { return callback_.is_null(); } |
- |
- const BoundNetLog& net_log() const { return net_log_; } |
- |
- private: |
- CompletionCallback callback_; |
- CertVerifyResult* verify_result_; |
- const BoundNetLog net_log_; |
-}; |
- |
- |
-// CertVerifierWorker runs on a worker thread and takes care of the blocking |
-// process of performing the certificate verification. Deletes itself |
-// eventually if Start() succeeds. |
-class CertVerifierWorker { |
- public: |
- CertVerifierWorker(X509Certificate* cert, |
- const std::string& hostname, |
- int flags, |
- CRLSet* crl_set, |
- CertVerifier* cert_verifier) |
- : cert_(cert), |
- hostname_(hostname), |
- flags_(flags), |
- crl_set_(crl_set), |
- origin_loop_(MessageLoop::current()), |
- cert_verifier_(cert_verifier), |
- canceled_(false), |
- error_(ERR_FAILED) { |
- } |
- |
- // Returns the certificate being verified. May only be called /before/ |
- // Start() is called. |
- X509Certificate* certificate() const { return cert_; } |
- |
- bool Start() { |
- DCHECK_EQ(MessageLoop::current(), origin_loop_); |
- |
- return base::WorkerPool::PostTask( |
- FROM_HERE, base::Bind(&CertVerifierWorker::Run, base::Unretained(this)), |
- true /* task is slow */); |
- } |
- |
- // Cancel is called from the origin loop when the CertVerifier is getting |
- // deleted. |
- void Cancel() { |
- DCHECK_EQ(MessageLoop::current(), origin_loop_); |
- base::AutoLock locked(lock_); |
- canceled_ = true; |
- } |
- |
- private: |
- void Run() { |
- // Runs on a worker thread. |
- error_ = cert_->Verify(hostname_, flags_, crl_set_, &verify_result_); |
-#if defined(USE_NSS) |
- // Detach the thread from NSPR. |
- // Calling NSS functions attaches the thread to NSPR, which stores |
- // the NSPR thread ID in thread-specific data. |
- // The threads in our thread pool terminate after we have called |
- // PR_Cleanup. Unless we detach them from NSPR, net_unittests gets |
- // segfaults on shutdown when the threads' thread-specific data |
- // destructors run. |
- PR_DetachThread(); |
-#endif |
- Finish(); |
- } |
- |
- // DoReply runs on the origin thread. |
- void DoReply() { |
- DCHECK_EQ(MessageLoop::current(), origin_loop_); |
- { |
- // We lock here because the worker thread could still be in Finished, |
- // after the PostTask, but before unlocking |lock_|. If we do not lock in |
- // this case, we will end up deleting a locked Lock, which can lead to |
- // memory leaks or worse errors. |
- base::AutoLock locked(lock_); |
- if (!canceled_) { |
- cert_verifier_->HandleResult(cert_, hostname_, flags_, |
- error_, verify_result_); |
- } |
- } |
- delete this; |
- } |
- |
- void Finish() { |
- // Runs on the worker thread. |
- // We assume that the origin loop outlives the CertVerifier. If the |
- // CertVerifier is deleted, it will call Cancel on us. If it does so |
- // before the Acquire, we'll delete ourselves and return. If it's trying to |
- // do so concurrently, then it'll block on the lock and we'll call PostTask |
- // while the CertVerifier (and therefore the MessageLoop) is still alive. |
- // If it does so after this function, we assume that the MessageLoop will |
- // process pending tasks. In which case we'll notice the |canceled_| flag |
- // in DoReply. |
- |
- bool canceled; |
- { |
- base::AutoLock locked(lock_); |
- canceled = canceled_; |
- if (!canceled) { |
- origin_loop_->PostTask( |
- FROM_HERE, base::Bind( |
- &CertVerifierWorker::DoReply, base::Unretained(this))); |
- } |
- } |
- |
- if (canceled) |
- delete this; |
- } |
- |
- scoped_refptr<X509Certificate> cert_; |
- const std::string hostname_; |
- const int flags_; |
- scoped_refptr<CRLSet> crl_set_; |
- MessageLoop* const origin_loop_; |
- CertVerifier* const cert_verifier_; |
- |
- // lock_ protects canceled_. |
- base::Lock lock_; |
- |
- // If canceled_ is true, |
- // * origin_loop_ cannot be accessed by the worker thread, |
- // * cert_verifier_ cannot be accessed by any thread. |
- bool canceled_; |
- |
- int error_; |
- CertVerifyResult verify_result_; |
- |
- DISALLOW_COPY_AND_ASSIGN(CertVerifierWorker); |
-}; |
- |
-// A CertVerifierJob is a one-to-one counterpart of a CertVerifierWorker. It |
-// lives only on the CertVerifier's origin message loop. |
-class CertVerifierJob { |
- public: |
- CertVerifierJob(CertVerifierWorker* worker, |
- const BoundNetLog& net_log) |
- : start_time_(base::TimeTicks::Now()), |
- worker_(worker), |
- net_log_(net_log) { |
- scoped_refptr<NetLog::EventParameters> params( |
- new X509CertificateNetLogParam(worker_->certificate())); |
- net_log_.BeginEvent(NetLog::TYPE_CERT_VERIFIER_JOB, params); |
- } |
- |
- ~CertVerifierJob() { |
- if (worker_) { |
- net_log_.AddEvent(NetLog::TYPE_CANCELLED, NULL); |
- net_log_.EndEvent(NetLog::TYPE_CERT_VERIFIER_JOB, NULL); |
- worker_->Cancel(); |
- DeleteAllCanceled(); |
- } |
- } |
- |
- void AddRequest(CertVerifierRequest* request) { |
- request->net_log().AddEvent( |
- NetLog::TYPE_CERT_VERIFIER_REQUEST_BOUND_TO_JOB, |
- make_scoped_refptr(new NetLogSourceParameter( |
- "source_dependency", net_log_.source()))); |
- |
- requests_.push_back(request); |
- } |
- |
- void HandleResult(const CertVerifier::CachedResult& verify_result) { |
- worker_ = NULL; |
- net_log_.EndEvent(NetLog::TYPE_CERT_VERIFIER_JOB, NULL); |
- UMA_HISTOGRAM_CUSTOM_TIMES("Net.CertVerifier_Job_Latency", |
- base::TimeTicks::Now() - start_time_, |
- base::TimeDelta::FromMilliseconds(1), |
- base::TimeDelta::FromMinutes(10), |
- 100); |
- PostAll(verify_result); |
- } |
- |
- private: |
- void PostAll(const CertVerifier::CachedResult& verify_result) { |
- std::vector<CertVerifierRequest*> requests; |
- requests_.swap(requests); |
- |
- for (std::vector<CertVerifierRequest*>::iterator |
- i = requests.begin(); i != requests.end(); i++) { |
- (*i)->Post(verify_result); |
- // Post() causes the CertVerifierRequest to delete itself. |
- } |
- } |
- |
- void DeleteAllCanceled() { |
- for (std::vector<CertVerifierRequest*>::iterator |
- i = requests_.begin(); i != requests_.end(); i++) { |
- if ((*i)->canceled()) { |
- delete *i; |
- } else { |
- LOG(DFATAL) << "CertVerifierRequest leaked!"; |
- } |
- } |
- } |
- |
- const base::TimeTicks start_time_; |
- std::vector<CertVerifierRequest*> requests_; |
- CertVerifierWorker* worker_; |
- const BoundNetLog net_log_; |
-}; |
- |
-CertVerifier::CertVerifier() |
- : cache_(kMaxCacheEntries), |
- requests_(0), |
- cache_hits_(0), |
- inflight_joins_(0) { |
- CertDatabase::AddObserver(this); |
+CertVerifier* CertVerifier::CreateDefault() { |
+ return new MultiThreadedCertVerifier(); |
} |
-CertVerifier::~CertVerifier() { |
- STLDeleteValues(&inflight_); |
- |
- CertDatabase::RemoveObserver(this); |
-} |
- |
-int CertVerifier::Verify(X509Certificate* cert, |
- const std::string& hostname, |
- int flags, |
- CRLSet* crl_set, |
- CertVerifyResult* verify_result, |
- const CompletionCallback& callback, |
- RequestHandle* out_req, |
- const BoundNetLog& net_log) { |
- DCHECK(CalledOnValidThread()); |
- |
- if (callback.is_null() || !verify_result || hostname.empty()) { |
- *out_req = NULL; |
- return ERR_INVALID_ARGUMENT; |
- } |
- |
- requests_++; |
- |
- const RequestParams key(cert->fingerprint(), cert->ca_fingerprint(), |
- hostname, flags); |
- const CertVerifierCache::value_type* cached_entry = |
- cache_.Get(key, base::TimeTicks::Now()); |
- if (cached_entry) { |
- ++cache_hits_; |
- *out_req = NULL; |
- *verify_result = cached_entry->result; |
- return cached_entry->error; |
- } |
- |
- // No cache hit. See if an identical request is currently in flight. |
- CertVerifierJob* job; |
- std::map<RequestParams, CertVerifierJob*>::const_iterator j; |
- j = inflight_.find(key); |
- if (j != inflight_.end()) { |
- // An identical request is in flight already. We'll just attach our |
- // callback. |
- inflight_joins_++; |
- job = j->second; |
- } else { |
- // Need to make a new request. |
- CertVerifierWorker* worker = new CertVerifierWorker(cert, hostname, flags, |
- crl_set, this); |
- job = new CertVerifierJob( |
- worker, |
- BoundNetLog::Make(net_log.net_log(), NetLog::SOURCE_CERT_VERIFIER_JOB)); |
- if (!worker->Start()) { |
- delete job; |
- delete worker; |
- *out_req = NULL; |
- // TODO(wtc): log to the NetLog. |
- LOG(ERROR) << "CertVerifierWorker couldn't be started."; |
- return ERR_INSUFFICIENT_RESOURCES; // Just a guess. |
- } |
- inflight_.insert(std::make_pair(key, job)); |
- } |
- |
- CertVerifierRequest* request = |
- new CertVerifierRequest(callback, verify_result, net_log); |
- job->AddRequest(request); |
- *out_req = request; |
- return ERR_IO_PENDING; |
-} |
- |
-void CertVerifier::CancelRequest(RequestHandle req) { |
- DCHECK(CalledOnValidThread()); |
- CertVerifierRequest* request = reinterpret_cast<CertVerifierRequest*>(req); |
- request->Cancel(); |
-} |
- |
-// HandleResult is called by CertVerifierWorker on the origin message loop. |
-// It deletes CertVerifierJob. |
-void CertVerifier::HandleResult(X509Certificate* cert, |
- const std::string& hostname, |
- int flags, |
- int error, |
- const CertVerifyResult& verify_result) { |
- DCHECK(CalledOnValidThread()); |
- |
- const RequestParams key(cert->fingerprint(), cert->ca_fingerprint(), |
- hostname, flags); |
- |
- CachedResult cached_result; |
- cached_result.error = error; |
- cached_result.result = verify_result; |
- cache_.Put(key, cached_result, base::TimeTicks::Now(), |
- base::TimeDelta::FromSeconds(kTTLSecs)); |
- |
- std::map<RequestParams, CertVerifierJob*>::iterator j; |
- j = inflight_.find(key); |
- if (j == inflight_.end()) { |
- NOTREACHED(); |
- return; |
- } |
- CertVerifierJob* job = j->second; |
- inflight_.erase(j); |
- |
- job->HandleResult(cached_result); |
- delete job; |
-} |
- |
-void CertVerifier::OnCertTrustChanged(const X509Certificate* cert) { |
- DCHECK(CalledOnValidThread()); |
- |
- ClearCache(); |
-} |
- |
-///////////////////////////////////////////////////////////////////// |
- |
-SingleRequestCertVerifier::SingleRequestCertVerifier( |
- CertVerifier* cert_verifier) |
- : cert_verifier_(cert_verifier), |
- cur_request_(NULL) { |
- DCHECK(cert_verifier_ != NULL); |
-} |
- |
-SingleRequestCertVerifier::~SingleRequestCertVerifier() { |
- if (cur_request_) { |
- cert_verifier_->CancelRequest(cur_request_); |
- cur_request_ = NULL; |
- } |
-} |
- |
-int SingleRequestCertVerifier::Verify(X509Certificate* cert, |
- const std::string& hostname, |
- int flags, |
- CRLSet* crl_set, |
- CertVerifyResult* verify_result, |
- const CompletionCallback& callback, |
- const BoundNetLog& net_log) { |
- // Should not be already in use. |
- DCHECK(!cur_request_ && cur_request_callback_.is_null()); |
- |
- // Do a synchronous verification. |
- if (callback.is_null()) |
- return cert->Verify(hostname, flags, crl_set, verify_result); |
- |
- CertVerifier::RequestHandle request = NULL; |
- |
- // We need to be notified of completion before |callback| is called, so that |
- // we can clear out |cur_request_*|. |
- int rv = cert_verifier_->Verify( |
- cert, hostname, flags, crl_set, verify_result, |
- base::Bind(&SingleRequestCertVerifier::OnVerifyCompletion, |
- base::Unretained(this)), |
- &request, net_log); |
- |
- if (rv == ERR_IO_PENDING) { |
- // Cleared in OnVerifyCompletion(). |
- cur_request_ = request; |
- cur_request_callback_ = callback; |
- } |
- |
- return rv; |
-} |
- |
-void SingleRequestCertVerifier::OnVerifyCompletion(int result) { |
- DCHECK(cur_request_ && !cur_request_callback_.is_null()); |
- |
- CompletionCallback callback = cur_request_callback_; |
- |
- // Clear the outstanding request information. |
- cur_request_ = NULL; |
- cur_request_callback_.Reset(); |
- |
- // Call the user's original callback. |
- callback.Run(result); |
-} |
- |
} // namespace net |