Cert - protobufs to serialize and deserialize CertVerifierCache.

net/cert/multi_threaded_cert_verifier.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/multi_threaded_cert_verifier.h"
 
 #include <algorithm>
 #include <memory>
 #include <utility>
 
@@ skipping 99 matching lines @@
        ++it) {
     hashes->AppendString(it->ToString());
   }
   results->Set("public_key_hashes", std::move(hashes));
 
   return std::move(results);
 }
 
 }  // namespace
 
+MultiThreadedCertVerifier::RequestParams::RequestParams(
+    const SHA1HashValue& cert_fingerprint_arg,
+    const SHA1HashValue& ca_fingerprint_arg,
+    const std::string& hostname_arg,
+    const std::string& ocsp_response_arg,
+    int flags_arg,
+    const CertificateList& additional_trust_anchors)
+    : hostname(hostname_arg), flags(flags_arg), start_time(base::Time::Now()) {
+  hash_values.reserve(3 + additional_trust_anchors.size());
+  SHA1HashValue ocsp_hash;
+  base::SHA1HashBytes(
+      reinterpret_cast<const unsigned char*>(ocsp_response_arg.data()),
+      ocsp_response_arg.size(), ocsp_hash.data);
+  hash_values.push_back(ocsp_hash);
+  hash_values.push_back(cert_fingerprint_arg);
+  hash_values.push_back(ca_fingerprint_arg);
+  for (size_t i = 0; i < additional_trust_anchors.size(); ++i)
+    hash_values.push_back(additional_trust_anchors[i]->fingerprint());
+}
+
+MultiThreadedCertVerifier::RequestParams::RequestParams(
+    const RequestParams& other) = default;
+
+MultiThreadedCertVerifier::RequestParams::RequestParams(
+    const std::string& hostname_arg,
+    int flags_arg,
+    const std::vector<SHA1HashValue>& hash_values_arg,
+    const base::Time& start_time_arg) {
+  hostname = hostname_arg;
+  flags = flags_arg;
+  hash_values = std::move(hash_values_arg);
+  start_time = start_time_arg;
+}
+
+MultiThreadedCertVerifier::RequestParams::~RequestParams() {}
+
+bool MultiThreadedCertVerifier::RequestParams::operator<(
+    const RequestParams& other) const {
+  // |flags| is compared before |cert_fingerprint|, |ca_fingerprint|,
+  // |hostname|, and |ocsp_response|, under assumption that integer comparisons
+  // are faster than memory and string comparisons.
+  if (flags != other.flags)
+    return flags < other.flags;
+  if (hostname != other.hostname)
+    return hostname < other.hostname;
+  return std::lexicographical_compare(
+      hash_values.begin(), hash_values.end(), other.hash_values.begin(),
+      other.hash_values.end(), SHA1HashValueLessThan());
+}
+
 MultiThreadedCertVerifier::CachedResult::CachedResult() : error(ERR_FAILED) {}
 
+MultiThreadedCertVerifier::CachedResult::CachedResult(
+    int error_arg,
+    CertVerifyResult result_arg)
+    : error(error_arg) {
+  result.CopyFrom(result_arg);
+}
+
 MultiThreadedCertVerifier::CachedResult::~CachedResult() {}
 
 MultiThreadedCertVerifier::CacheValidityPeriod::CacheValidityPeriod(
     const base::Time& now)
     : verification_time(now),
       expiration_time(now) {
 }
 
 MultiThreadedCertVerifier::CacheValidityPeriod::CacheValidityPeriod(
     const base::Time& now,
@@ skipping 30 matching lines @@
   // This algorithm is only problematic if the user consistently keeps
   // adjusting their clock backwards in increments smaller than the expiration
   // TTL, in which case, cached elements continue to be added. However,
   // because the cache has a fixed upper bound, if no entries are expired, a
   // 'random' entry will be, thus keeping the memory constraints bounded over
   // time.
   return now.verification_time >= expiration.verification_time &&
          now.verification_time < expiration.expiration_time;
 };
 
+MultiThreadedCertVerifier::Iterator::Iterator(
+    const MultiThreadedCertVerifier& verifier)
+    : iterator_(verifier.cache_) {}
+
+MultiThreadedCertVerifier::Iterator::~Iterator() {}
+
 // Represents the output and result callback of a request. The
 // CertVerifierRequest is owned by the caller that initiated the call to
 // CertVerifier::Verify().
 class CertVerifierRequest : public base::LinkNode<CertVerifierRequest>,
                             public CertVerifier::Request {
  public:
   CertVerifierRequest(CertVerifierJob* job,
                       const CompletionCallback& callback,
                       CertVerifyResult* verify_result,
                       const BoundNetLog& net_log)
@@ skipping 294 matching lines @@
   std::unique_ptr<CertVerifierRequest> request =
       job->CreateRequest(callback, verify_result, net_log);
   *out_req = std::move(request);
   return ERR_IO_PENDING;
 }
 
 bool MultiThreadedCertVerifier::SupportsOCSPStapling() {
   return verify_proc_->SupportsOCSPStapling();
 }
 
-MultiThreadedCertVerifier::RequestParams::RequestParams(
-    const SHA1HashValue& cert_fingerprint_arg,
-    const SHA1HashValue& ca_fingerprint_arg,
-    const std::string& hostname_arg,
-    const std::string& ocsp_response_arg,
-    int flags_arg,
-    const CertificateList& additional_trust_anchors)
-    : hostname(hostname_arg), flags(flags_arg), start_time(base::Time::Now()) {
-  hash_values.reserve(3 + additional_trust_anchors.size());
-  SHA1HashValue ocsp_hash;
-  base::SHA1HashBytes(
-      reinterpret_cast<const unsigned char*>(ocsp_response_arg.data()),
-      ocsp_response_arg.size(), ocsp_hash.data);
-  hash_values.push_back(ocsp_hash);
-  hash_values.push_back(cert_fingerprint_arg);
-  hash_values.push_back(ca_fingerprint_arg);
-  for (size_t i = 0; i < additional_trust_anchors.size(); ++i)
-    hash_values.push_back(additional_trust_anchors[i]->fingerprint());
-}
+bool MultiThreadedCertVerifier::AddCertResult(
+    const std::string& hostname,
+    int flags,
+    const std::vector<SHA1HashValue>& hash_values,
+    const base::Time& start_time,
+    int error,
+    const CertVerifyResult& result,
+    const base::Time& verification_time,
+    const base::Time& expiration_time) {
+  base::Time now = base::Time::Now();
+  if (hostname.empty() || hash_values.size() == 0 ||

[Ryan Sleevi, 2016/05/13 20:18:12]

.empty()

+      start_time != verification_time || start_time >= now ||
+      expiration_time <= now ||
+      (expiration_time !=
+       start_time + base::TimeDelta::FromSeconds(kTTLSecs))) {
+    DVLOG(1) << "Invalid data for: " << hostname;

[Ryan Sleevi, 2016/05/13 20:18:13]

Why DVLOG? Is it a programmer error? If so, why not DCHECK? If it's an
acceptable condition, why DVLOG?

+    return false;
+  }
 
-MultiThreadedCertVerifier::RequestParams::RequestParams(
-    const RequestParams& other) = default;
+  // If cache is already full, then don't replace the current entries.
+  if (cache_.size() >= kMaxCacheEntries) {
+    DVLOG(1) << "Cache is full";

[Ryan Sleevi, 2016/05/13 20:18:12]

Necessary?

+    return false;
+  }
 
-MultiThreadedCertVerifier::RequestParams::~RequestParams() {}
+  // Don't overwrite existing entry.
+  RequestParams key(hostname, flags, hash_values, start_time);
+  CacheValidityPeriod expiration(now);
+  if (cache_.Get(key, expiration)) {
+    DVLOG(1) << "Already exists in the cache for " << key.hostname;

[Ryan Sleevi, 2016/05/13 20:18:13]

Necessary?

+    return false;
+  }
 
-bool MultiThreadedCertVerifier::RequestParams::operator<(
-    const RequestParams& other) const {
-  // |flags| is compared before |cert_fingerprint|, |ca_fingerprint|,
-  // |hostname|, and |ocsp_response|, under assumption that integer comparisons
-  // are faster than memory and string comparisons.
-  if (flags != other.flags)
-    return flags < other.flags;
-  if (hostname != other.hostname)
-    return hostname < other.hostname;
-  return std::lexicographical_compare(
-      hash_values.begin(), hash_values.end(), other.hash_values.begin(),
-      other.hash_values.end(), SHA1HashValueLessThan());
+  // Add a new entry.
+  CachedResult value(error, result);
+  cache_.Put(key, value, CacheValidityPeriod(verification_time),
+             CacheValidityPeriod(verification_time, expiration_time));
+  return true;
 }
 
 bool MultiThreadedCertVerifier::JobComparator::operator()(
     const CertVerifierJob* job1,
     const CertVerifierJob* job2) const {
   return job1->key() < job2->key();
 }
 
 void MultiThreadedCertVerifier::SaveResultToCache(const RequestParams& key,
                                                   const CachedResult& result) {
@@ skipping 57 matching lines @@
   // The JobSet is kept in sorted order so items can be found using binary
   // search.
   auto it = std::lower_bound(inflight_.begin(), inflight_.end(), key,
                              JobToRequestParamsComparator());
   if (it != inflight_.end() && !(key < (*it)->key()))
     return *it;
   return nullptr;
 }
 
 }  // namespace net