[NOT FOR REVIEW] Profile DERCache

net/cert/x509_util_openssl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/x509_util_openssl.h"
 
 #include <limits.h>
 #include <openssl/asn1.h>
 #include <openssl/digest.h>
 #include <openssl/mem.h>
 
 #include <algorithm>
 #include <memory>
+#include <map>
 
 #include "base/lazy_instance.h"
 #include "base/logging.h"
 #include "base/macros.h"
 #include "base/strings/string_piece.h"
 #include "base/strings/string_util.h"
 #include "crypto/ec_private_key.h"
 #include "crypto/openssl_util.h"
 #include "crypto/rsa_private_key.h"
 #include "crypto/scoped_openssl_types.h"
 #include "net/cert/internal/parse_certificate.h"
 #include "net/cert/internal/signature_algorithm.h"
 #include "net/cert/x509_cert_types.h"
 #include "net/cert/x509_certificate.h"
 #include "net/cert/x509_util.h"
 #include "net/ssl/scoped_openssl_types.h"
 
+#if defined(OS_ANDROID)
+#include <android/log.h>
+#define PRINTF(format, arguments...) \
+    __android_log_print(ANDROID_LOG_WARN, "PRINTF", format, ##arguments)
+#else
+#define PRINTF printf
+#endif
+
 namespace net {
 
 namespace {
 
 using ScopedASN1_INTEGER =
     crypto::ScopedOpenSSL<ASN1_INTEGER, ASN1_INTEGER_free>;
 using ScopedASN1_OCTET_STRING =
     crypto::ScopedOpenSSL<ASN1_OCTET_STRING, ASN1_OCTET_STRING_free>;
 using ScopedASN1_STRING = crypto::ScopedOpenSSL<ASN1_STRING, ASN1_STRING_free>;
 using ScopedASN1_TIME = crypto::ScopedOpenSSL<ASN1_TIME, ASN1_TIME_free>;
@@ skipping 124 matching lines @@
   // Sign it with the private key.
   if (!X509_sign(cert, key, md)) {
     LOG(ERROR) << "Could not sign certificate with key.";
     return false;
   }
 
   // Convert it into a DER-encoded string copied to |der_encoded|.
   return DerEncodeCert(cert, der_encoded);
 }
 
+struct {
+  pthread_mutex_t lock;
+  size_t hits;
+  size_t misses;
+  size_t count;
+  size_t total_size;
+  size_t total_unique_size;
+  std::map<std::string, size_t>* uniques;
+} g_der_cache_stats = {PTHREAD_MUTEX_INITIALIZER};
+
+enum DERCacheAction {
+  DER_HIT,
+  DER_MISS,
+  DER_REMOVE
+};
+
+void UpdateDERCacheStats(DERCacheAction action, const std::string* data) {
+  auto& stats = g_der_cache_stats;
+  pthread_mutex_lock(&stats.lock);
+  switch (action) {
+    case DER_HIT: {
+      stats.hits++;
+      break;
+    }
+    case DER_MISS: {
+      stats.misses++;
+      stats.count++;
+      stats.total_size += data->capacity();
+      if (!stats.uniques) {
+        stats.uniques = new std::map<std::string, size_t>();
+      }
+      auto insert_result = stats.uniques->emplace(*data, 0);
+      auto unique_iter = insert_result.first;
+      bool inserted = insert_result.second;
+      if (inserted) {
+        stats.total_unique_size += unique_iter->first.capacity();
+      }
+      unique_iter->second++;
+      break;
+    }
+    case DER_REMOVE: {
+      stats.count -= 1;
+      stats.total_size -= data->capacity();
+      auto unique_iter = stats.uniques->find(*data);
+      CHECK(unique_iter != stats.uniques->end());
+      unique_iter->second--;
+      if (unique_iter->second == 0) {
+        stats.total_unique_size -= unique_iter->first.capacity();
+        stats.uniques->erase(unique_iter);
+      }
+      break;
+    }
+  }
+  if (action != DER_HIT) {
+    PRINTF("DERCache: %zu KiB @ %zu instances (%zu KiB @ %zu unique), "
+           "hit rate: %.1f%% (%zu/%zu)\n",
+           stats.total_size / 1024, stats.count,
+           stats.total_unique_size / 1024, stats.uniques->size(),
+           stats.hits * 100.0 / (stats.hits + stats.misses),
+           stats.hits, stats.misses);
+  }
+  pthread_mutex_unlock(&stats.lock);
+}
+
 struct DERCache {
   std::string data;
+
+  ~DERCache() {
+    UpdateDERCacheStats(DER_REMOVE, &data);
+  }
 };
 
 void DERCache_free(void* parent, void* ptr, CRYPTO_EX_DATA* ad, int idx,
                    long argl, void* argp) {
   DERCache* der_cache = static_cast<DERCache*>(ptr);
   delete der_cache;
 }
 
 class DERCacheInitSingleton {
  public:
@@ skipping 107 matching lines @@
   // Re-encoding the DER data via i2d_X509 is an expensive operation,
   // but it's necessary for comparing two certificates. Re-encode at
   // most once per certificate and cache the data within the X509 cert
   // using X509_set_ex_data.
   DERCache* internal_cache = static_cast<DERCache*>(
       X509_get_ex_data(x509, x509_der_cache_index));
   if (!internal_cache) {
     std::unique_ptr<DERCache> new_cache(new DERCache);
     if (!DerEncodeCert(x509, &new_cache->data))
       return false;
+    UpdateDERCacheStats(DER_MISS, &new_cache->data);
     internal_cache = new_cache.get();
     X509_set_ex_data(x509, x509_der_cache_index, new_cache.release());
+  } else {
+    UpdateDERCacheStats(DER_HIT, nullptr);
   }
   *der_cache = base::StringPiece(internal_cache->data);
   return true;
 }
 
 bool GetTLSServerEndPointChannelBinding(const X509Certificate& certificate,
                                         std::string* token) {
   static const char kChannelBindingPrefix[] = "tls-server-end-point:";
 
   std::string der_encoded_certificate;
@@ skipping 41 matching lines @@
 
   digest.resize(out_size);
   token->assign(kChannelBindingPrefix);
   token->append(digest.begin(), digest.end());
   return true;
 }
 
 }  // namespace x509_util
 
 }  // namespace net