SSLClientSessionCache: Log number of times Lookup is called per Session.

net/socket/ssl_client_socket_impl.cc

Index: net/socket/ssl_client_socket_impl.cc
diff --git a/net/socket/ssl_client_socket_impl.cc b/net/socket/ssl_client_socket_impl.cc
index 4e3f71311c7c2a4974e2337bc0f583724f3b8a46..4aae5548c7bdf98ac253b72a598b09a03c2cba9b 100644
--- a/net/socket/ssl_client_socket_impl.cc
+++ b/net/socket/ssl_client_socket_impl.cc
@@ -944,8 +944,8 @@ int SSLClientSocketImpl::Init() {
     return ERR_UNEXPECTED;
   }
 
-  bssl::UniquePtr<SSL_SESSION> session =
-      context->session_cache()->Lookup(GetSessionCacheKey());
+  bssl::UniquePtr<SSL_SESSION> session = context->session_cache()->Lookup(
+      GetSessionCacheKey(), &ssl_session_cache_lookup_count_);
   if (session)
     SSL_set_session(ssl_.get(), session.get());
 
@@ -1146,6 +1146,15 @@ int SSLClientSocketImpl::DoHandshakeComplete(int result) {
   if (result < 0)
     return result;
 
+  if (ssl_session_cache_lookup_count_) {
+    SSLContext::GetInstance()->session_cache()->ResetLookupCount(
+        GetSessionCacheKey(), SSL_get_session(ssl_.get()));

[davidben, 2017/01/19 20:29:34]

Doesn't this want to be reset regardless of whether
ssl_session_cache_lookup_count_ is set and regardless of whether the sessions
are the same? We expect to get a fresh session from the server in all cases.

(SSL_get_session is also really Weird(TM). It doesn't return the offered session
in TLS 1.3 because 1.3 resumption.)

[nharper, 2017/01/19 21:50:35]

Yes, that sounds right. We're modelling the server sending infinite
NewSessionTickets, so it doesn't matter whether this session was resumed, or
with which session.

+    if (negotiated_protocol_ == kProtoHTTP2 && SSL_session_reused(ssl_.get())) {
+      UMA_HISTOGRAM_EXACT_LINEAR("Net.SSLSessionConcurrentLookupCount",
+                                 ssl_session_cache_lookup_count_, 20);

[davidben, 2017/01/19 20:29:34]

This should probably have a comment for what's going on here.

[nharper, 2017/01/19 21:50:35]

Done.

+    }
+  }
+
   // DHE is offered on the deprecated cipher fallback and then rejected
   // afterwards. This is to aid in diagnosing connection failures because a
   // server requires DHE ciphers.