OLD | NEW |
1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "net/socket/ssl_session_cache_openssl.h" | 5 #include "net/socket/ssl_session_cache_openssl.h" |
6 | 6 |
7 #include <list> | 7 #include <list> |
8 #include <map> | 8 #include <map> |
9 | 9 |
10 #include <openssl/rand.h> | 10 #include <openssl/rand.h> |
11 #include <openssl/ssl.h> | 11 #include <openssl/ssl.h> |
12 | 12 |
| 13 #include "base/callback.h" |
13 #include "base/containers/hash_tables.h" | 14 #include "base/containers/hash_tables.h" |
14 #include "base/lazy_instance.h" | 15 #include "base/lazy_instance.h" |
15 #include "base/logging.h" | 16 #include "base/logging.h" |
16 #include "base/synchronization/lock.h" | 17 #include "base/synchronization/lock.h" |
17 | 18 |
18 namespace net { | 19 namespace net { |
19 | 20 |
20 namespace { | 21 namespace { |
21 | 22 |
22 // A helper class to lazily create a new EX_DATA index to map SSL_CTX handles | 23 // A helper class to lazily create a new EX_DATA index to map SSL_CTX handles |
(...skipping 206 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
229 return false; // Session has not yet been marked good. Treat as a miss. | 230 return false; // Session has not yet been marked good. Treat as a miss. |
230 | 231 |
231 // Move to front of MRU list. | 232 // Move to front of MRU list. |
232 ordering_.push_front(session); | 233 ordering_.push_front(session); |
233 ordering_.erase(it->second); | 234 ordering_.erase(it->second); |
234 it->second = ordering_.begin(); | 235 it->second = ordering_.begin(); |
235 | 236 |
236 return SSL_set_session(ssl, session) == 1; | 237 return SSL_set_session(ssl, session) == 1; |
237 } | 238 } |
238 | 239 |
| 240 bool SSLSessionIsInCache(const std::string& cache_key) const { |
| 241 SSL_SESSION* session = *it->second; |
| 242 DCHECK(session); |
| 243 DVLOG(2) << "Lookup session: " << session << " for " << cache_key; |
| 244 |
| 245 void* session_is_good = |
| 246 SSL_SESSION_get_ex_data(session, GetSSLSessionExIndex()); |
| 247 |
| 248 if (!session_is_good) |
| 249 return false; // Session has not yet been marked good. Treat as a miss. |
| 250 |
| 251 base::AutoLock locked(lock_); |
| 252 KeyIndex::const_iterator it = key_index_.find(cache_key); |
| 253 return it != key_index_.end(); |
| 254 } |
| 255 |
| 256 void SetSessionAddedCallback(SSL* ssl, const base::Closure& callback) { |
| 257 // Add this SSL* to the SSLtoCallbackMap. |
| 258 ssl_to_callback_map_[ssl] = CallbackAndCompletionCount(callback, 0); |
| 259 } |
| 260 |
| 261 // Determines if the session for |ssl| is in the cache, and calls the |
| 262 // appropriate callback if that is the case. |
| 263 void CheckIfSessionAdded(SSL* ssl) { |
| 264 SSLToCallbackMap::iterator it = ssl_to_callback_map_.find(ssl); |
| 265 if (it == ssl_to_callback_map_.end()) |
| 266 return; |
| 267 // Increment the session's completion count. |
| 268 if (++it->second.count == 2) { |
| 269 // The session has been MarkedAsGood and Added, so it can be used. |
| 270 // These two events can occur in either order. |
| 271 base::Closure callback = it->second.callback; |
| 272 ssl_to_callback_map_.erase(it); |
| 273 callback.Run(); |
| 274 } |
| 275 } |
| 276 |
| 277 void RemoveSessionAddedCallback(SSL* ssl) { ssl_to_callback_map_.erase(ssl); } |
| 278 |
239 void MarkSSLSessionAsGood(SSL* ssl) { | 279 void MarkSSLSessionAsGood(SSL* ssl) { |
240 SSL_SESSION* session = SSL_get_session(ssl); | 280 SSL_SESSION* session = SSL_get_session(ssl); |
241 if (!session) | 281 if (!session) |
242 return; | 282 return; |
243 | 283 |
244 // Mark the session as good, allowing it to be used for future connections. | 284 // Mark the session as good, allowing it to be used for future connections. |
245 SSL_SESSION_set_ex_data( | 285 SSL_SESSION_set_ex_data( |
246 session, GetSSLSessionExIndex(), reinterpret_cast<void*>(1)); | 286 session, GetSSLSessionExIndex(), reinterpret_cast<void*>(1)); |
| 287 |
| 288 CheckIfSessionAdded(ssl); |
247 } | 289 } |
248 | 290 |
249 // Flush all entries from the cache. | 291 // Flush all entries from the cache. |
250 void Flush() { | 292 void Flush() { |
251 base::AutoLock lock(lock_); | 293 base::AutoLock lock(lock_); |
252 id_index_.clear(); | 294 id_index_.clear(); |
253 key_index_.clear(); | 295 key_index_.clear(); |
254 while (!ordering_.empty()) { | 296 while (!ordering_.empty()) { |
255 SSL_SESSION* session = ordering_.front(); | 297 SSL_SESSION* session = ordering_.front(); |
256 ordering_.pop_front(); | 298 ordering_.pop_front(); |
257 SSL_SESSION_free(session); | 299 SSL_SESSION_free(session); |
258 } | 300 } |
259 } | 301 } |
260 | 302 |
261 private: | 303 private: |
| 304 // CallbackAndCompletionCounts are used to group callback a callback |
| 305 // that should be run when a certian sesssion is added to the session |
| 306 // cache with an integer indicating the status of that session. |
| 307 struct CallbackAndCompletionCount { |
| 308 CallbackAndCompletionCount(base::Closure completion_callback, |
| 309 int completion_count) |
| 310 : callback(completion_callback), count(completion_count) {} |
| 311 |
| 312 const base::Closure callback; |
| 313 // |count| < 2 means that the ssl session associated with this object |
| 314 // has not been added to the session cache. |count| == 2 means that the |
| 315 // session has been added to the cache and is ready for use. |
| 316 int count; |
| 317 }; |
| 318 |
262 // Type for list of SSL_SESSION handles, ordered in MRU order. | 319 // Type for list of SSL_SESSION handles, ordered in MRU order. |
263 typedef std::list<SSL_SESSION*> MRUSessionList; | 320 typedef std::list<SSL_SESSION*> MRUSessionList; |
264 // Type for a dictionary from unique cache keys to session list nodes. | 321 // Type for a dictionary from unique cache keys to session list nodes. |
265 typedef base::hash_map<std::string, MRUSessionList::iterator> KeyIndex; | 322 typedef base::hash_map<std::string, MRUSessionList::iterator> KeyIndex; |
266 // Type for a dictionary from SessionId values to key index nodes. | 323 // Type for a dictionary from SessionId values to key index nodes. |
267 typedef base::hash_map<SessionId, KeyIndex::iterator> SessionIdIndex; | 324 typedef base::hash_map<SessionId, KeyIndex::iterator> SessionIdIndex; |
| 325 // Type for a map from SSL* to associated callbacks |
| 326 typedef std::map<SSL*, CallbackAndCompletionCount> SSLToCallbackMap; |
268 | 327 |
269 // Return the key associated with a given session, or the empty string if | 328 // Return the key associated with a given session, or the empty string if |
270 // none exist. This shall only be used for debugging. | 329 // none exist. This shall only be used for debugging. |
271 std::string SessionKey(SSL_SESSION* session) { | 330 std::string SessionKey(SSL_SESSION* session) { |
272 if (!session) | 331 if (!session) |
273 return std::string("<null-session>"); | 332 return std::string("<null-session>"); |
274 | 333 |
275 if (session->session_id_length == 0) | 334 if (session->session_id_length == 0) |
276 return std::string("<empty-session-id>"); | 335 return std::string("<empty-session-id>"); |
277 | 336 |
(...skipping 57 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
335 DCHECK(result); | 394 DCHECK(result); |
336 return reinterpret_cast<SSLSessionCacheOpenSSLImpl*>(result); | 395 return reinterpret_cast<SSLSessionCacheOpenSSLImpl*>(result); |
337 } | 396 } |
338 | 397 |
339 // Called by OpenSSL when a new |session| was created and added to a given | 398 // Called by OpenSSL when a new |session| was created and added to a given |
340 // |ssl| connection. Note that the session's reference count was already | 399 // |ssl| connection. Note that the session's reference count was already |
341 // incremented before the function is entered. The function must return 1 | 400 // incremented before the function is entered. The function must return 1 |
342 // to indicate that it took ownership of the session, i.e. that the caller | 401 // to indicate that it took ownership of the session, i.e. that the caller |
343 // should not decrement its reference count after completion. | 402 // should not decrement its reference count after completion. |
344 static int NewSessionCallbackStatic(SSL* ssl, SSL_SESSION* session) { | 403 static int NewSessionCallbackStatic(SSL* ssl, SSL_SESSION* session) { |
345 GetCache(ssl->ctx)->OnSessionAdded(ssl, session); | 404 SSLSessionCacheOpenSSLImpl* cache = GetCache(ssl->ctx); |
| 405 cache->OnSessionAdded(ssl, session); |
| 406 cache->CheckIfSessionAdded(ssl); |
346 return 1; | 407 return 1; |
347 } | 408 } |
348 | 409 |
349 // Called by OpenSSL to indicate that a session must be removed from the | 410 // Called by OpenSSL to indicate that a session must be removed from the |
350 // cache. This happens when SSL_CTX is destroyed. | 411 // cache. This happens when SSL_CTX is destroyed. |
351 static void RemoveSessionCallbackStatic(SSL_CTX* ctx, SSL_SESSION* session) { | 412 static void RemoveSessionCallbackStatic(SSL_CTX* ctx, SSL_SESSION* session) { |
352 GetCache(ctx)->OnSessionRemoved(session); | 413 GetCache(ctx)->OnSessionRemoved(session); |
353 } | 414 } |
354 | 415 |
355 // Called by OpenSSL to generate a new session ID. This happens during a | 416 // Called by OpenSSL to generate a new session ID. This happens during a |
(...skipping 103 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
459 if (id_index_.find(SessionId(id, id_len)) == id_index_.end()) | 520 if (id_index_.find(SessionId(id, id_len)) == id_index_.end()) |
460 return true; | 521 return true; |
461 } | 522 } |
462 DLOG(ERROR) << "Couldn't generate unique session ID of " << id_len | 523 DLOG(ERROR) << "Couldn't generate unique session ID of " << id_len |
463 << "bytes after " << kMaxTries << " tries."; | 524 << "bytes after " << kMaxTries << " tries."; |
464 return false; | 525 return false; |
465 } | 526 } |
466 | 527 |
467 SSL_CTX* ctx_; | 528 SSL_CTX* ctx_; |
468 SSLSessionCacheOpenSSL::Config config_; | 529 SSLSessionCacheOpenSSL::Config config_; |
| 530 SSLToCallbackMap ssl_to_callback_map_; |
469 | 531 |
470 // method to get the index which can later be used with SSL_CTX_get_ex_data() | 532 // method to get the index which can later be used with SSL_CTX_get_ex_data() |
471 // or SSL_CTX_set_ex_data(). | 533 // or SSL_CTX_set_ex_data(). |
472 base::Lock lock_; // Protects access to containers below. | 534 mutable base::Lock lock_; // Protects access to containers below. |
473 | 535 |
474 MRUSessionList ordering_; | 536 MRUSessionList ordering_; |
475 KeyIndex key_index_; | 537 KeyIndex key_index_; |
476 SessionIdIndex id_index_; | 538 SessionIdIndex id_index_; |
477 | 539 |
478 size_t expiration_check_; | 540 size_t expiration_check_; |
479 }; | 541 }; |
480 | 542 |
481 SSLSessionCacheOpenSSL::~SSLSessionCacheOpenSSL() { delete impl_; } | 543 SSLSessionCacheOpenSSL::~SSLSessionCacheOpenSSL() { delete impl_; } |
482 | 544 |
483 size_t SSLSessionCacheOpenSSL::size() const { return impl_->size(); } | 545 size_t SSLSessionCacheOpenSSL::size() const { return impl_->size(); } |
484 | 546 |
485 void SSLSessionCacheOpenSSL::Reset(SSL_CTX* ctx, const Config& config) { | 547 void SSLSessionCacheOpenSSL::Reset(SSL_CTX* ctx, const Config& config) { |
486 if (impl_) | 548 if (impl_) |
487 delete impl_; | 549 delete impl_; |
488 | 550 |
489 impl_ = new SSLSessionCacheOpenSSLImpl(ctx, config); | 551 impl_ = new SSLSessionCacheOpenSSLImpl(ctx, config); |
490 } | 552 } |
491 | 553 |
492 bool SSLSessionCacheOpenSSL::SetSSLSession(SSL* ssl) { | 554 bool SSLSessionCacheOpenSSL::SetSSLSession(SSL* ssl) { |
493 return impl_->SetSSLSession(ssl); | 555 return impl_->SetSSLSession(ssl); |
494 } | 556 } |
495 | 557 |
496 bool SSLSessionCacheOpenSSL::SetSSLSessionWithKey( | 558 bool SSLSessionCacheOpenSSL::SetSSLSessionWithKey( |
497 SSL* ssl, | 559 SSL* ssl, |
498 const std::string& cache_key) { | 560 const std::string& cache_key) { |
499 return impl_->SetSSLSessionWithKey(ssl, cache_key); | 561 return impl_->SetSSLSessionWithKey(ssl, cache_key); |
500 } | 562 } |
501 | 563 |
| 564 bool SSLSessionCacheOpenSSL::SSLSessionIsInCache( |
| 565 const std::string& cache_key) const { |
| 566 return impl_->SSLSessionIsInCache(cache_key); |
| 567 } |
| 568 |
| 569 void SSLSessionCacheOpenSSL::RemoveSessionAddedCallback(SSL* ssl) { |
| 570 impl_->RemoveSessionAddedCallback(ssl); |
| 571 } |
| 572 |
| 573 void SSLSessionCacheOpenSSL::SetSessionAddedCallback(SSL* ssl, |
| 574 const base::Closure& cb) { |
| 575 impl_->SetSessionAddedCallback(ssl, cb); |
| 576 } |
| 577 |
502 void SSLSessionCacheOpenSSL::MarkSSLSessionAsGood(SSL* ssl) { | 578 void SSLSessionCacheOpenSSL::MarkSSLSessionAsGood(SSL* ssl) { |
503 return impl_->MarkSSLSessionAsGood(ssl); | 579 return impl_->MarkSSLSessionAsGood(ssl); |
504 } | 580 } |
505 | 581 |
506 void SSLSessionCacheOpenSSL::Flush() { impl_->Flush(); } | 582 void SSLSessionCacheOpenSSL::Flush() { impl_->Flush(); } |
507 | 583 |
508 } // namespace net | 584 } // namespace net |
OLD | NEW |