Instrument SSL sockets using MemoryDumpProvider

net/socket/ssl_client_socket_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/socket/ssl_client_socket_impl.h"
 
 #include <errno.h>
 #include <string.h>
 
 #include <utility>
 
 #include "base/bind.h"
 #include "base/callback_helpers.h"
 #include "base/feature_list.h"
 #include "base/lazy_instance.h"
 #include "base/macros.h"
 #include "base/memory/singleton.h"
 #include "base/metrics/field_trial.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/metrics/sparse_histogram.h"
 #include "base/profiler/scoped_tracker.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_piece.h"
+#include "base/strings/stringprintf.h"
 #include "base/synchronization/lock.h"
 #include "base/threading/thread_local.h"
+#include "base/trace_event/memory_allocator_dump.h"
+#include "base/trace_event/process_memory_dump.h"
 #include "base/trace_event/trace_event.h"
 #include "base/values.h"
 #include "crypto/ec_private_key.h"
 #include "crypto/openssl_util.h"
 #include "net/base/ip_address.h"
 #include "net/base/net_errors.h"
 #include "net/cert/cert_verifier.h"
 #include "net/cert/ct_ev_whitelist.h"
 #include "net/cert/ct_policy_enforcer.h"
 #include "net/cert/ct_policy_status.h"
@@ skipping 759 matching lines @@
 }
 
 void SSLClientSocketImpl::GetConnectionAttempts(ConnectionAttempts* out) const {
   out->clear();
 }
 
 int64_t SSLClientSocketImpl::GetTotalReceivedBytes() const {
   return transport_->socket()->GetTotalReceivedBytes();
 }
 
+void SSLClientSocketImpl::DumpMemoryStats(
+    base::trace_event::ProcessMemoryDump* pmd,
+    const std::string& parent_dump_absolute_name) const {
+  size_t total_size = 0;
+  base::trace_event::MemoryAllocatorDump* socket_dump =
+      pmd->CreateAllocatorDump(base::StringPrintf(
+          "%s/ssl_socket_%p", parent_dump_absolute_name.c_str(), this));
+  if (transport_adapter_) {
+    size_t bio_buffers_size = transport_adapter_->GetAllocationSize();
+    socket_dump->AddScalar("buffer_size",
+                           base::trace_event::MemoryAllocatorDump::kUnitsBytes,
+                           bio_buffers_size);
+    total_size += bio_buffers_size;
+  }
+  size_t total_cert_size = 0;
+  size_t certs_count = 0;
+  if (server_cert_chain_) {
+    certs_count = server_cert_chain_->size();
+    for (size_t i = 0; i < certs_count; ++i) {
+      X509* cert = server_cert_chain_->Get(i);
+      total_cert_size += i2d_X509(cert, nullptr);
+    }
+  }
+  total_size += total_cert_size;
+  socket_dump->AddScalar("cert_size",
+                         base::trace_event::MemoryAllocatorDump::kUnitsBytes,
+                         total_cert_size);

[davidben, 2016/12/06 01:02:07]

Just to confirm: this will not measure the amount of memory used by the
certificate, but the lower bound size of the serialized certificate itself. Is
this what you want? (As we just chatted about out-of-band, OpenSSL's X.509
representation blows it up by around 4x.) You're only going to record the lower
bound number, not the 4x number (which is probably a nuisance to record).

Assuming you're okay with what this is measuring, probably still worth a comment
about this. You can cite https://crbug.com/671420 if you like.

(I wonder if this should be named serialized_cert_size or something to be
clearer?)

[xunjieli, 2016/12/06 18:36:08]

Done.  That's a very important distinction -- thanks for bring it up. I don't
think we can easily measure the actual allocation incurred for the X509, can we?
We don't want to spend much overhead when MemoryDumpProvider is not enabled. If
there's a more accurate way with minimum overhead, I'd like to explore that. 

+  socket_dump->AddScalar("cert_count",
+                         base::trace_event::MemoryAllocatorDump::kUnitsObjects,
+                         certs_count);
+  socket_dump->AddScalar(base::trace_event::MemoryAllocatorDump::kNameSize,
+                         base::trace_event::MemoryAllocatorDump::kUnitsBytes,
+                         total_size);
+}
+
+// static
+void SSLClientSocketImpl::DumpSSLClientSessionMemoryStats(
+    base::trace_event::ProcessMemoryDump* pmd) {
+  SSLContext::GetInstance()->session_cache()->DumpMemoryStats(pmd);
+}
+
 int SSLClientSocketImpl::Read(IOBuffer* buf,
                               int buf_len,
                               const CompletionCallback& callback) {
   user_read_buf_ = buf;
   user_read_buf_len_ = buf_len;
 
   int rv = DoPayloadRead();
 
   if (rv == ERR_IO_PENDING) {
     user_read_callback_ = callback;
@@ skipping 1204 matching lines @@
     if (ERR_GET_REASON(info->error_code) == SSL_R_TLSV1_ALERT_ACCESS_DENIED &&
         !certificate_requested_) {
       net_error = ERR_SSL_PROTOCOL_ERROR;
     }
   }
 
   return net_error;
 }
 
 }  // namespace net