Chromium Code Reviews| OLD | NEW |
|---|---|
| 1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/socket/ssl_session_cache_openssl.h" | 5 #include "net/socket/ssl_session_cache_openssl.h" |
| 6 | 6 |
| 7 #include <list> | 7 #include <list> |
| 8 #include <map> | 8 #include <map> |
| 9 | 9 |
| 10 #include <openssl/rand.h> | 10 #include <openssl/rand.h> |
| 11 #include <openssl/ssl.h> | 11 #include <openssl/ssl.h> |
| 12 | 12 |
| 13 #include "base/callback.h" | 13 #include "base/callback.h" |
|
wtc
2014/08/07 20:04:04
Delete this.
| |
| 14 #include "base/containers/hash_tables.h" | 14 #include "base/containers/hash_tables.h" |
| 15 #include "base/lazy_instance.h" | 15 #include "base/lazy_instance.h" |
| 16 #include "base/logging.h" | 16 #include "base/logging.h" |
| 17 #include "base/synchronization/lock.h" | 17 #include "base/synchronization/lock.h" |
| 18 | 18 |
| 19 namespace net { | 19 namespace net { |
| 20 | 20 |
| 21 namespace { | 21 namespace { |
| 22 | 22 |
| 23 // A helper class to lazily create a new EX_DATA index to map SSL_CTX handles | 23 // A helper class to lazily create a new EX_DATA index to map SSL_CTX handles |
| (...skipping 222 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 246 | 246 |
| 247 SSL_SESSION* session = *it->second; | 247 SSL_SESSION* session = *it->second; |
| 248 DCHECK(session); | 248 DCHECK(session); |
| 249 | 249 |
| 250 void* session_is_good = | 250 void* session_is_good = |
| 251 SSL_SESSION_get_ex_data(session, GetSSLSessionExIndex()); | 251 SSL_SESSION_get_ex_data(session, GetSSLSessionExIndex()); |
| 252 | 252 |
| 253 return session_is_good; | 253 return session_is_good; |
| 254 } | 254 } |
| 255 | 255 |
| 256 void SetSessionAddedCallback(SSL* ssl, const base::Closure& callback) { | |
| 257 // Add |ssl| to the SSLToCallbackMap. | |
| 258 ssl_to_callback_map_.insert(SSLToCallbackMap::value_type( | |
| 259 ssl, CallbackAndCompletionCount(callback, 0))); | |
| 260 } | |
| 261 | |
| 262 // Determines if the session for |ssl| is in the cache, and calls the | |
| 263 // appropriate callback if that is the case. | |
| 264 // | |
| 265 // The session must be both MarkedAsGood and Added in order for the | |
| 266 // callback to be run. These two events can occur in either order. | |
| 267 void CheckIfSessionFinished(SSL* ssl) { | |
| 268 SSLToCallbackMap::iterator it = ssl_to_callback_map_.find(ssl); | |
| 269 if (it == ssl_to_callback_map_.end()) | |
| 270 return; | |
| 271 // Increment the session's completion count. | |
| 272 if (++it->second.count == 2) { | |
| 273 base::Closure callback = it->second.callback; | |
| 274 ssl_to_callback_map_.erase(it); | |
| 275 callback.Run(); | |
| 276 } | |
| 277 } | |
| 278 | |
| 279 void RemoveSessionAddedCallback(SSL* ssl) { ssl_to_callback_map_.erase(ssl); } | |
| 280 | |
| 281 void MarkSSLSessionAsGood(SSL* ssl) { | 256 void MarkSSLSessionAsGood(SSL* ssl) { |
| 282 SSL_SESSION* session = SSL_get_session(ssl); | 257 SSL_SESSION* session = SSL_get_session(ssl); |
| 283 CHECK(session); | 258 CHECK(session); |
| 284 | 259 |
| 285 // Mark the session as good, allowing it to be used for future connections. | 260 // Mark the session as good, allowing it to be used for future connections. |
| 286 SSL_SESSION_set_ex_data( | 261 SSL_SESSION_set_ex_data( |
| 287 session, GetSSLSessionExIndex(), reinterpret_cast<void*>(1)); | 262 session, GetSSLSessionExIndex(), reinterpret_cast<void*>(1)); |
| 288 | |
| 289 CheckIfSessionFinished(ssl); | |
| 290 } | 263 } |
| 291 | 264 |
| 292 // Flush all entries from the cache. | 265 // Flush all entries from the cache. |
| 293 void Flush() { | 266 void Flush() { |
| 294 base::AutoLock lock(lock_); | 267 base::AutoLock lock(lock_); |
| 295 id_index_.clear(); | 268 id_index_.clear(); |
| 296 key_index_.clear(); | 269 key_index_.clear(); |
| 297 while (!ordering_.empty()) { | 270 while (!ordering_.empty()) { |
| 298 SSL_SESSION* session = ordering_.front(); | 271 SSL_SESSION* session = ordering_.front(); |
| 299 ordering_.pop_front(); | 272 ordering_.pop_front(); |
| 300 SSL_SESSION_free(session); | 273 SSL_SESSION_free(session); |
| 301 } | 274 } |
| 302 } | 275 } |
| 303 | 276 |
| 304 private: | 277 private: |
| 305 // CallbackAndCompletionCounts are used to group a callback that should be | |
| 306 // run when a certain sesssion is added to the session cache with an integer | |
| 307 // indicating the status of that session. | |
| 308 struct CallbackAndCompletionCount { | |
| 309 CallbackAndCompletionCount(const base::Closure& completion_callback, | |
| 310 int completion_count) | |
| 311 : callback(completion_callback), count(completion_count) {} | |
| 312 | |
| 313 const base::Closure callback; | |
| 314 // |count| < 2 means that the ssl session associated with this object | |
| 315 // has not been added to the session cache or has not been marked as good. | |
| 316 // |count| is incremented when a session is added to the cache or marked as | |
| 317 // good, thus |count| == 2 means that the session is ready for use. | |
| 318 int count; | |
| 319 }; | |
| 320 | |
| 321 // Type for list of SSL_SESSION handles, ordered in MRU order. | 278 // Type for list of SSL_SESSION handles, ordered in MRU order. |
| 322 typedef std::list<SSL_SESSION*> MRUSessionList; | 279 typedef std::list<SSL_SESSION*> MRUSessionList; |
| 323 // Type for a dictionary from unique cache keys to session list nodes. | 280 // Type for a dictionary from unique cache keys to session list nodes. |
| 324 typedef base::hash_map<std::string, MRUSessionList::iterator> KeyIndex; | 281 typedef base::hash_map<std::string, MRUSessionList::iterator> KeyIndex; |
| 325 // Type for a dictionary from SessionId values to key index nodes. | 282 // Type for a dictionary from SessionId values to key index nodes. |
| 326 typedef base::hash_map<SessionId, KeyIndex::iterator> SessionIdIndex; | 283 typedef base::hash_map<SessionId, KeyIndex::iterator> SessionIdIndex; |
| 327 // Type for a map from SSL* to associated callbacks | |
| 328 typedef std::map<SSL*, CallbackAndCompletionCount> SSLToCallbackMap; | |
| 329 | 284 |
| 330 // Return the key associated with a given session, or the empty string if | 285 // Return the key associated with a given session, or the empty string if |
| 331 // none exist. This shall only be used for debugging. | 286 // none exist. This shall only be used for debugging. |
| 332 std::string SessionKey(SSL_SESSION* session) { | 287 std::string SessionKey(SSL_SESSION* session) { |
| 333 if (!session) | 288 if (!session) |
| 334 return std::string("<null-session>"); | 289 return std::string("<null-session>"); |
| 335 | 290 |
| 336 if (session->session_id_length == 0) | 291 if (session->session_id_length == 0) |
| 337 return std::string("<empty-session-id>"); | 292 return std::string("<empty-session-id>"); |
| 338 | 293 |
| (...skipping 59 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 398 } | 353 } |
| 399 | 354 |
| 400 // Called by OpenSSL when a new |session| was created and added to a given | 355 // Called by OpenSSL when a new |session| was created and added to a given |
| 401 // |ssl| connection. Note that the session's reference count was already | 356 // |ssl| connection. Note that the session's reference count was already |
| 402 // incremented before the function is entered. The function must return 1 | 357 // incremented before the function is entered. The function must return 1 |
| 403 // to indicate that it took ownership of the session, i.e. that the caller | 358 // to indicate that it took ownership of the session, i.e. that the caller |
| 404 // should not decrement its reference count after completion. | 359 // should not decrement its reference count after completion. |
| 405 static int NewSessionCallbackStatic(SSL* ssl, SSL_SESSION* session) { | 360 static int NewSessionCallbackStatic(SSL* ssl, SSL_SESSION* session) { |
| 406 SSLSessionCacheOpenSSLImpl* cache = GetCache(ssl->ctx); | 361 SSLSessionCacheOpenSSLImpl* cache = GetCache(ssl->ctx); |
| 407 cache->OnSessionAdded(ssl, session); | 362 cache->OnSessionAdded(ssl, session); |
| 408 cache->CheckIfSessionFinished(ssl); | |
| 409 return 1; | 363 return 1; |
| 410 } | 364 } |
| 411 | 365 |
| 412 // Called by OpenSSL to indicate that a session must be removed from the | 366 // Called by OpenSSL to indicate that a session must be removed from the |
| 413 // cache. This happens when SSL_CTX is destroyed. | 367 // cache. This happens when SSL_CTX is destroyed. |
| 414 static void RemoveSessionCallbackStatic(SSL_CTX* ctx, SSL_SESSION* session) { | 368 static void RemoveSessionCallbackStatic(SSL_CTX* ctx, SSL_SESSION* session) { |
| 415 GetCache(ctx)->OnSessionRemoved(session); | 369 GetCache(ctx)->OnSessionRemoved(session); |
| 416 } | 370 } |
| 417 | 371 |
| 418 // Called by OpenSSL to generate a new session ID. This happens during a | 372 // Called by OpenSSL to generate a new session ID. This happens during a |
| (...skipping 103 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 522 if (id_index_.find(SessionId(id, id_len)) == id_index_.end()) | 476 if (id_index_.find(SessionId(id, id_len)) == id_index_.end()) |
| 523 return true; | 477 return true; |
| 524 } | 478 } |
| 525 DLOG(ERROR) << "Couldn't generate unique session ID of " << id_len | 479 DLOG(ERROR) << "Couldn't generate unique session ID of " << id_len |
| 526 << "bytes after " << kMaxTries << " tries."; | 480 << "bytes after " << kMaxTries << " tries."; |
| 527 return false; | 481 return false; |
| 528 } | 482 } |
| 529 | 483 |
| 530 SSL_CTX* ctx_; | 484 SSL_CTX* ctx_; |
| 531 SSLSessionCacheOpenSSL::Config config_; | 485 SSLSessionCacheOpenSSL::Config config_; |
| 532 SSLToCallbackMap ssl_to_callback_map_; | |
| 533 | 486 |
| 534 // method to get the index which can later be used with SSL_CTX_get_ex_data() | 487 // method to get the index which can later be used with SSL_CTX_get_ex_data() |
| 535 // or SSL_CTX_set_ex_data(). | 488 // or SSL_CTX_set_ex_data(). |
| 536 mutable base::Lock lock_; // Protects access to containers below. | 489 mutable base::Lock lock_; // Protects access to containers below. |
| 537 | 490 |
| 538 MRUSessionList ordering_; | 491 MRUSessionList ordering_; |
| 539 KeyIndex key_index_; | 492 KeyIndex key_index_; |
| 540 SessionIdIndex id_index_; | 493 SessionIdIndex id_index_; |
| 541 | 494 |
| 542 size_t expiration_check_; | 495 size_t expiration_check_; |
| (...skipping 18 matching lines...) Expand all Loading... | |
| 561 SSL* ssl, | 514 SSL* ssl, |
| 562 const std::string& cache_key) { | 515 const std::string& cache_key) { |
| 563 return impl_->SetSSLSessionWithKey(ssl, cache_key); | 516 return impl_->SetSSLSessionWithKey(ssl, cache_key); |
| 564 } | 517 } |
| 565 | 518 |
| 566 bool SSLSessionCacheOpenSSL::SSLSessionIsInCache( | 519 bool SSLSessionCacheOpenSSL::SSLSessionIsInCache( |
| 567 const std::string& cache_key) const { | 520 const std::string& cache_key) const { |
| 568 return impl_->SSLSessionIsInCache(cache_key); | 521 return impl_->SSLSessionIsInCache(cache_key); |
| 569 } | 522 } |
| 570 | 523 |
| 571 void SSLSessionCacheOpenSSL::RemoveSessionAddedCallback(SSL* ssl) { | |
| 572 impl_->RemoveSessionAddedCallback(ssl); | |
| 573 } | |
| 574 | |
| 575 void SSLSessionCacheOpenSSL::SetSessionAddedCallback(SSL* ssl, | |
| 576 const base::Closure& cb) { | |
| 577 impl_->SetSessionAddedCallback(ssl, cb); | |
| 578 } | |
| 579 | |
| 580 void SSLSessionCacheOpenSSL::MarkSSLSessionAsGood(SSL* ssl) { | 524 void SSLSessionCacheOpenSSL::MarkSSLSessionAsGood(SSL* ssl) { |
| 581 return impl_->MarkSSLSessionAsGood(ssl); | 525 return impl_->MarkSSLSessionAsGood(ssl); |
| 582 } | 526 } |
| 583 | 527 |
| 584 void SSLSessionCacheOpenSSL::Flush() { impl_->Flush(); } | 528 void SSLSessionCacheOpenSSL::Flush() { impl_->Flush(); } |
| 585 | 529 |
| 586 } // namespace net | 530 } // namespace net |
| OLD | NEW |