Chromium Code Reviews| OLD | NEW |
|---|---|
| 1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/socket/ssl_session_cache_openssl.h" | 5 #include "net/socket/ssl_session_cache_openssl.h" |
| 6 | 6 |
| 7 #include <list> | 7 #include <list> |
| 8 #include <map> | 8 #include <map> |
| 9 | 9 |
| 10 #include <openssl/rand.h> | 10 #include <openssl/rand.h> |
| (...skipping 218 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 229 return false; // Session has not yet been marked good. Treat as a miss. | 229 return false; // Session has not yet been marked good. Treat as a miss. |
| 230 | 230 |
| 231 // Move to front of MRU list. | 231 // Move to front of MRU list. |
| 232 ordering_.push_front(session); | 232 ordering_.push_front(session); |
| 233 ordering_.erase(it->second); | 233 ordering_.erase(it->second); |
| 234 it->second = ordering_.begin(); | 234 it->second = ordering_.begin(); |
| 235 | 235 |
| 236 return SSL_set_session(ssl, session) == 1; | 236 return SSL_set_session(ssl, session) == 1; |
| 237 } | 237 } |
| 238 | 238 |
| 239 bool SSLSessionIsInCache(const std::string& cache_key) const { | |
| 240 base::AutoLock locked(lock_); | |
| 241 KeyIndex::const_iterator it = key_index_.find(cache_key); | |
| 242 if (it == key_index_.end()) | |
| 243 return false; | |
| 244 return true; | |
|
wtc
2014/07/11 00:48:55
The last three lines are equivalent to:
return i
mshelley
2014/07/11 23:26:28
Done.
| |
| 245 } | |
| 246 | |
| 247 void RegisterSessionAddedCallback(SSL* ssl, const base::Closure& callback) { | |
| 248 // Add this SSL* to the SSLtoCallbackMap. | |
| 249 ssl_to_callback_map_.insert(SSLToCallbackMap::value_type( | |
| 250 ssl, CallbackAndCompletionCount(callback, 0))); | |
| 251 } | |
| 252 | |
| 253 // Determines if the session for |ssl| is in the cache, and calls the | |
| 254 // appropriate callback if that is the case. | |
| 255 void CheckIfSessionAdded(SSL* ssl) { | |
| 256 SSLToCallbackMap::iterator it = ssl_to_callback_map_.find(ssl); | |
| 257 if (it == ssl_to_callback_map_.end()) | |
| 258 return; | |
| 259 // Increment the session's completion count. | |
| 260 it->second.count++; | |
| 261 if (it->second.count == 2) { | |
|
wtc
2014/07/11 00:48:56
Nit: this is often done like this:
// Increment
mshelley
2014/07/11 23:26:28
Done.
| |
| 262 // The session has been MarkedAsGood and Added, so it can be used. | |
| 263 // These two events can occur in either order. | |
| 264 it->second.callback.Run(); | |
| 265 RemoveFromSSLToCallbackMap(ssl); | |
|
wtc
2014/07/11 00:48:55
It is more efficient to just do
ssl_to_callback_
mshelley
2014/07/11 23:26:28
Done.
| |
| 266 } | |
| 267 } | |
| 268 | |
| 269 void RemoveFromSSLToCallbackMap(SSL* ssl) { ssl_to_callback_map_.erase(ssl); } | |
| 270 | |
| 239 void MarkSSLSessionAsGood(SSL* ssl) { | 271 void MarkSSLSessionAsGood(SSL* ssl) { |
| 240 SSL_SESSION* session = SSL_get_session(ssl); | 272 SSL_SESSION* session = SSL_get_session(ssl); |
| 241 if (!session) | 273 if (!session) |
| 242 return; | 274 return; |
| 243 | 275 |
| 244 // Mark the session as good, allowing it to be used for future connections. | 276 // Mark the session as good, allowing it to be used for future connections. |
| 245 SSL_SESSION_set_ex_data( | 277 SSL_SESSION_set_ex_data( |
| 246 session, GetSSLSessionExIndex(), reinterpret_cast<void*>(1)); | 278 session, GetSSLSessionExIndex(), reinterpret_cast<void*>(1)); |
| 279 | |
| 280 CheckIfSessionAdded(ssl); | |
| 247 } | 281 } |
| 248 | 282 |
| 249 // Flush all entries from the cache. | 283 // Flush all entries from the cache. |
| 250 void Flush() { | 284 void Flush() { |
| 251 base::AutoLock lock(lock_); | 285 base::AutoLock lock(lock_); |
| 252 id_index_.clear(); | 286 id_index_.clear(); |
| 253 key_index_.clear(); | 287 key_index_.clear(); |
| 254 while (!ordering_.empty()) { | 288 while (!ordering_.empty()) { |
| 255 SSL_SESSION* session = ordering_.front(); | 289 SSL_SESSION* session = ordering_.front(); |
| 256 ordering_.pop_front(); | 290 ordering_.pop_front(); |
| 257 SSL_SESSION_free(session); | 291 SSL_SESSION_free(session); |
| 258 } | 292 } |
| 259 } | 293 } |
| 260 | 294 |
| 261 private: | 295 private: |
| 296 struct CallbackAndCompletionCount { | |
|
wtc
2014/07/11 00:48:56
Document this struct.
mshelley
2014/07/11 23:26:28
Done.
| |
| 297 base::Closure callback; | |
|
wtc
2014/07/11 00:48:55
Nit: you can declare this field as const to preven
mshelley
2014/07/11 23:26:28
Done.
| |
| 298 int count; | |
|
wtc
2014/07/11 00:48:56
Document the |count| field.
mshelley
2014/07/11 23:26:28
Done.
| |
| 299 | |
| 300 CallbackAndCompletionCount(base::Closure completion_callback, | |
| 301 int completion_count) | |
| 302 : callback(completion_callback), count(completion_count) {} | |
|
wtc
2014/07/11 00:48:55
List methods (including constructors) before data
mshelley
2014/07/11 23:26:28
Done.
| |
| 303 }; | |
| 304 | |
| 262 // Type for list of SSL_SESSION handles, ordered in MRU order. | 305 // Type for list of SSL_SESSION handles, ordered in MRU order. |
| 263 typedef std::list<SSL_SESSION*> MRUSessionList; | 306 typedef std::list<SSL_SESSION*> MRUSessionList; |
| 264 // Type for a dictionary from unique cache keys to session list nodes. | 307 // Type for a dictionary from unique cache keys to session list nodes. |
| 265 typedef base::hash_map<std::string, MRUSessionList::iterator> KeyIndex; | 308 typedef base::hash_map<std::string, MRUSessionList::iterator> KeyIndex; |
| 266 // Type for a dictionary from SessionId values to key index nodes. | 309 // Type for a dictionary from SessionId values to key index nodes. |
| 267 typedef base::hash_map<SessionId, KeyIndex::iterator> SessionIdIndex; | 310 typedef base::hash_map<SessionId, KeyIndex::iterator> SessionIdIndex; |
| 311 // Type for a map from SSL* to associated callbacks | |
| 312 typedef std::map<SSL*, CallbackAndCompletionCount> SSLToCallbackMap; | |
| 268 | 313 |
| 269 // Return the key associated with a given session, or the empty string if | 314 // Return the key associated with a given session, or the empty string if |
| 270 // none exist. This shall only be used for debugging. | 315 // none exist. This shall only be used for debugging. |
| 271 std::string SessionKey(SSL_SESSION* session) { | 316 std::string SessionKey(SSL_SESSION* session) { |
| 272 if (!session) | 317 if (!session) |
| 273 return std::string("<null-session>"); | 318 return std::string("<null-session>"); |
| 274 | 319 |
| 275 if (session->session_id_length == 0) | 320 if (session->session_id_length == 0) |
| 276 return std::string("<empty-session-id>"); | 321 return std::string("<empty-session-id>"); |
| 277 | 322 |
| (...skipping 58 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 336 return reinterpret_cast<SSLSessionCacheOpenSSLImpl*>(result); | 381 return reinterpret_cast<SSLSessionCacheOpenSSLImpl*>(result); |
| 337 } | 382 } |
| 338 | 383 |
| 339 // Called by OpenSSL when a new |session| was created and added to a given | 384 // Called by OpenSSL when a new |session| was created and added to a given |
| 340 // |ssl| connection. Note that the session's reference count was already | 385 // |ssl| connection. Note that the session's reference count was already |
| 341 // incremented before the function is entered. The function must return 1 | 386 // incremented before the function is entered. The function must return 1 |
| 342 // to indicate that it took ownership of the session, i.e. that the caller | 387 // to indicate that it took ownership of the session, i.e. that the caller |
| 343 // should not decrement its reference count after completion. | 388 // should not decrement its reference count after completion. |
| 344 static int NewSessionCallbackStatic(SSL* ssl, SSL_SESSION* session) { | 389 static int NewSessionCallbackStatic(SSL* ssl, SSL_SESSION* session) { |
| 345 GetCache(ssl->ctx)->OnSessionAdded(ssl, session); | 390 GetCache(ssl->ctx)->OnSessionAdded(ssl, session); |
| 391 GetCache(ssl->ctx)->CheckIfSessionAdded(ssl); | |
| 346 return 1; | 392 return 1; |
| 347 } | 393 } |
| 348 | 394 |
| 349 // Called by OpenSSL to indicate that a session must be removed from the | 395 // Called by OpenSSL to indicate that a session must be removed from the |
| 350 // cache. This happens when SSL_CTX is destroyed. | 396 // cache. This happens when SSL_CTX is destroyed. |
| 351 static void RemoveSessionCallbackStatic(SSL_CTX* ctx, SSL_SESSION* session) { | 397 static void RemoveSessionCallbackStatic(SSL_CTX* ctx, SSL_SESSION* session) { |
| 352 GetCache(ctx)->OnSessionRemoved(session); | 398 GetCache(ctx)->OnSessionRemoved(session); |
| 353 } | 399 } |
| 354 | 400 |
| 355 // Called by OpenSSL to generate a new session ID. This happens during a | 401 // Called by OpenSSL to generate a new session ID. This happens during a |
| (...skipping 103 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 459 if (id_index_.find(SessionId(id, id_len)) == id_index_.end()) | 505 if (id_index_.find(SessionId(id, id_len)) == id_index_.end()) |
| 460 return true; | 506 return true; |
| 461 } | 507 } |
| 462 DLOG(ERROR) << "Couldn't generate unique session ID of " << id_len | 508 DLOG(ERROR) << "Couldn't generate unique session ID of " << id_len |
| 463 << "bytes after " << kMaxTries << " tries."; | 509 << "bytes after " << kMaxTries << " tries."; |
| 464 return false; | 510 return false; |
| 465 } | 511 } |
| 466 | 512 |
| 467 SSL_CTX* ctx_; | 513 SSL_CTX* ctx_; |
| 468 SSLSessionCacheOpenSSL::Config config_; | 514 SSLSessionCacheOpenSSL::Config config_; |
| 515 SSLToCallbackMap ssl_to_callback_map_; | |
| 469 | 516 |
| 470 // method to get the index which can later be used with SSL_CTX_get_ex_data() | 517 // method to get the index which can later be used with SSL_CTX_get_ex_data() |
| 471 // or SSL_CTX_set_ex_data(). | 518 // or SSL_CTX_set_ex_data(). |
| 472 base::Lock lock_; // Protects access to containers below. | 519 mutable base::Lock lock_; // Protects access to containers below. |
| 473 | 520 |
| 474 MRUSessionList ordering_; | 521 MRUSessionList ordering_; |
| 475 KeyIndex key_index_; | 522 KeyIndex key_index_; |
| 476 SessionIdIndex id_index_; | 523 SessionIdIndex id_index_; |
| 477 | 524 |
| 478 size_t expiration_check_; | 525 size_t expiration_check_; |
| 479 }; | 526 }; |
| 480 | 527 |
| 481 SSLSessionCacheOpenSSL::~SSLSessionCacheOpenSSL() { delete impl_; } | 528 SSLSessionCacheOpenSSL::~SSLSessionCacheOpenSSL() { delete impl_; } |
| 482 | 529 |
| 483 size_t SSLSessionCacheOpenSSL::size() const { return impl_->size(); } | 530 size_t SSLSessionCacheOpenSSL::size() const { return impl_->size(); } |
| 484 | 531 |
| 485 void SSLSessionCacheOpenSSL::Reset(SSL_CTX* ctx, const Config& config) { | 532 void SSLSessionCacheOpenSSL::Reset(SSL_CTX* ctx, const Config& config) { |
| 486 if (impl_) | 533 if (impl_) |
| 487 delete impl_; | 534 delete impl_; |
| 488 | 535 |
| 489 impl_ = new SSLSessionCacheOpenSSLImpl(ctx, config); | 536 impl_ = new SSLSessionCacheOpenSSLImpl(ctx, config); |
| 490 } | 537 } |
| 491 | 538 |
| 492 bool SSLSessionCacheOpenSSL::SetSSLSession(SSL* ssl) { | 539 bool SSLSessionCacheOpenSSL::SetSSLSession(SSL* ssl) { |
| 493 return impl_->SetSSLSession(ssl); | 540 return impl_->SetSSLSession(ssl); |
| 494 } | 541 } |
| 495 | 542 |
| 496 bool SSLSessionCacheOpenSSL::SetSSLSessionWithKey( | 543 bool SSLSessionCacheOpenSSL::SetSSLSessionWithKey( |
| 497 SSL* ssl, | 544 SSL* ssl, |
| 498 const std::string& cache_key) { | 545 const std::string& cache_key) { |
| 499 return impl_->SetSSLSessionWithKey(ssl, cache_key); | 546 return impl_->SetSSLSessionWithKey(ssl, cache_key); |
| 500 } | 547 } |
| 501 | 548 |
| 549 bool SSLSessionCacheOpenSSL::SSLSessionIsInCache( | |
| 550 const std::string& cache_key) const { | |
| 551 return impl_->SSLSessionIsInCache(cache_key); | |
| 552 } | |
| 553 | |
| 554 void SSLSessionCacheOpenSSL::RemoveFromSSLToCallbackMap(SSL* ssl) { | |
| 555 impl_->RemoveFromSSLToCallbackMap(ssl); | |
| 556 } | |
| 557 | |
| 558 void SSLSessionCacheOpenSSL::RegisterSessionAddedCallback( | |
| 559 SSL* ssl, | |
| 560 const base::Closure& cb) { | |
| 561 impl_->RegisterSessionAddedCallback(ssl, cb); | |
| 562 } | |
| 563 | |
| 502 void SSLSessionCacheOpenSSL::MarkSSLSessionAsGood(SSL* ssl) { | 564 void SSLSessionCacheOpenSSL::MarkSSLSessionAsGood(SSL* ssl) { |
| 503 return impl_->MarkSSLSessionAsGood(ssl); | 565 return impl_->MarkSSLSessionAsGood(ssl); |
| 504 } | 566 } |
| 505 | 567 |
| 506 void SSLSessionCacheOpenSSL::Flush() { impl_->Flush(); } | 568 void SSLSessionCacheOpenSSL::Flush() { impl_->Flush(); } |
| 507 | 569 |
| 508 } // namespace net | 570 } // namespace net |
| OLD | NEW |