1 // Copyright 2015 The Chromium Authors
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "net/ssl/ssl_client_session_cache.h"
6
7 #include <tuple>
8 #include <utility>
9
10 #include "base/containers/flat_set.h"
11 #include "base/time/clock.h"
12 #include "base/time/default_clock.h"
13 #include "third_party/boringssl/src/include/openssl/ssl.h"
14
15 namespace net {
16
17 namespace {
18
19 // Returns a tuple of references to fields of |key|, for comparison purposes.
TieKeyFields(const SSLClientSessionCache::Key & key)20 auto TieKeyFields(const SSLClientSessionCache::Key& key) {
21 return std::tie(key.server, key.dest_ip_addr, key.network_anonymization_key,
22 key.privacy_mode);
23 }
24
25 } // namespace
26
27 SSLClientSessionCache::Key::Key() = default;
28 SSLClientSessionCache::Key::Key(const Key& other) = default;
29 SSLClientSessionCache::Key::Key(Key&& other) = default;
30 SSLClientSessionCache::Key::~Key() = default;
31 SSLClientSessionCache::Key& SSLClientSessionCache::Key::operator=(
32 const Key& other) = default;
33 SSLClientSessionCache::Key& SSLClientSessionCache::Key::operator=(Key&& other) =
34 default;
35
operator ==(const Key & other) const36 bool SSLClientSessionCache::Key::operator==(const Key& other) const {
37 return TieKeyFields(*this) == TieKeyFields(other);
38 }
39
operator <(const Key & other) const40 bool SSLClientSessionCache::Key::operator<(const Key& other) const {
41 return TieKeyFields(*this) < TieKeyFields(other);
42 }
43
SSLClientSessionCache(const Config & config)44 SSLClientSessionCache::SSLClientSessionCache(const Config& config)
45 : clock_(base::DefaultClock::GetInstance()),
46 config_(config),
47 cache_(config.max_entries) {
48 memory_pressure_listener_ = std::make_unique<base::MemoryPressureListener>(
49 FROM_HERE, base::BindRepeating(&SSLClientSessionCache::OnMemoryPressure,
50 base::Unretained(this)));
51 }
52
~SSLClientSessionCache()53 SSLClientSessionCache::~SSLClientSessionCache() {
54 Flush();
55 }
56
size() const57 size_t SSLClientSessionCache::size() const {
58 return cache_.size();
59 }
60
Lookup(const Key & cache_key)61 bssl::UniquePtr<SSL_SESSION> SSLClientSessionCache::Lookup(
62 const Key& cache_key) {
63 // Expire stale sessions.
64 lookups_since_flush_++;
65 if (lookups_since_flush_ >= config_.expiration_check_count) {
66 lookups_since_flush_ = 0;
67 FlushExpiredSessions();
68 }
69
70 auto iter = cache_.Get(cache_key);
71 if (iter == cache_.end())
72 return nullptr;
73
74 time_t now = clock_->Now().ToTimeT();
75 bssl::UniquePtr<SSL_SESSION> session = iter->second.Pop();
76 if (iter->second.ExpireSessions(now))
77 cache_.Erase(iter);
78
79 if (IsExpired(session.get(), now))
80 session = nullptr;
81
82 return session;
83 }
84
Insert(const Key & cache_key,bssl::UniquePtr<SSL_SESSION> session)85 void SSLClientSessionCache::Insert(const Key& cache_key,
86 bssl::UniquePtr<SSL_SESSION> session) {
87 auto iter = cache_.Get(cache_key);
88 if (iter == cache_.end())
89 iter = cache_.Put(cache_key, Entry());
90 iter->second.Push(std::move(session));
91 }
92
ClearEarlyData(const Key & cache_key)93 void SSLClientSessionCache::ClearEarlyData(const Key& cache_key) {
94 auto iter = cache_.Get(cache_key);
95 if (iter != cache_.end()) {
96 for (auto& session : iter->second.sessions) {
97 if (session) {
98 session.reset(SSL_SESSION_copy_without_early_data(session.get()));
99 }
100 }
101 }
102 }
103
FlushForServers(const base::flat_set<HostPortPair> & servers)104 void SSLClientSessionCache::FlushForServers(
105 const base::flat_set<HostPortPair>& servers) {
106 auto iter = cache_.begin();
107 while (iter != cache_.end()) {
108 if (servers.contains(iter->first.server)) {
109 iter = cache_.Erase(iter);
110 } else {
111 ++iter;
112 }
113 }
114 }
115
Flush()116 void SSLClientSessionCache::Flush() {
117 cache_.Clear();
118 }
119
SetClockForTesting(base::Clock * clock)120 void SSLClientSessionCache::SetClockForTesting(base::Clock* clock) {
121 clock_ = clock;
122 }
123
IsExpired(SSL_SESSION * session,time_t now)124 bool SSLClientSessionCache::IsExpired(SSL_SESSION* session, time_t now) {
125 if (now < 0)
126 return true;
127 uint64_t now_u64 = static_cast<uint64_t>(now);
128
129 // now_u64 may be slightly behind because of differences in how
130 // time is calculated at this layer versus BoringSSL.
131 // Add a second of wiggle room to account for this.
132 return now_u64 < SSL_SESSION_get_time(session) - 1 ||
133 now_u64 >=
134 SSL_SESSION_get_time(session) + SSL_SESSION_get_timeout(session);
135 }
136
137 SSLClientSessionCache::Entry::Entry() = default;
138 SSLClientSessionCache::Entry::Entry(Entry&&) = default;
139 SSLClientSessionCache::Entry::~Entry() = default;
140
Push(bssl::UniquePtr<SSL_SESSION> session)141 void SSLClientSessionCache::Entry::Push(bssl::UniquePtr<SSL_SESSION> session) {
142 if (sessions[0] != nullptr &&
143 SSL_SESSION_should_be_single_use(sessions[0].get())) {
144 sessions[1] = std::move(sessions[0]);
145 }
146 sessions[0] = std::move(session);
147 }
148
Pop()149 bssl::UniquePtr<SSL_SESSION> SSLClientSessionCache::Entry::Pop() {
150 if (sessions[0] == nullptr)
151 return nullptr;
152 bssl::UniquePtr<SSL_SESSION> session = bssl::UpRef(sessions[0]);
153 if (SSL_SESSION_should_be_single_use(session.get())) {
154 sessions[0] = std::move(sessions[1]);
155 sessions[1] = nullptr;
156 }
157 return session;
158 }
159
ExpireSessions(time_t now)160 bool SSLClientSessionCache::Entry::ExpireSessions(time_t now) {
161 if (sessions[0] == nullptr)
162 return true;
163
164 if (SSLClientSessionCache::IsExpired(sessions[0].get(), now)) {
165 return true;
166 }
167
168 if (sessions[1] != nullptr &&
169 SSLClientSessionCache::IsExpired(sessions[1].get(), now)) {
170 sessions[1] = nullptr;
171 }
172
173 return false;
174 }
175
FlushExpiredSessions()176 void SSLClientSessionCache::FlushExpiredSessions() {
177 time_t now = clock_->Now().ToTimeT();
178 auto iter = cache_.begin();
179 while (iter != cache_.end()) {
180 if (iter->second.ExpireSessions(now)) {
181 iter = cache_.Erase(iter);
182 } else {
183 ++iter;
184 }
185 }
186 }
187
OnMemoryPressure(base::MemoryPressureListener::MemoryPressureLevel memory_pressure_level)188 void SSLClientSessionCache::OnMemoryPressure(
189 base::MemoryPressureListener::MemoryPressureLevel memory_pressure_level) {
190 switch (memory_pressure_level) {
191 case base::MemoryPressureListener::MEMORY_PRESSURE_LEVEL_NONE:
192 break;
193 case base::MemoryPressureListener::MEMORY_PRESSURE_LEVEL_MODERATE:
194 FlushExpiredSessions();
195 break;
196 case base::MemoryPressureListener::MEMORY_PRESSURE_LEVEL_CRITICAL:
197 Flush();
198 break;
199 }
200 }
201
202 } // namespace net
203