1 // Copyright 2015 The Chromium Authors 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #ifndef NET_SSL_SSL_CLIENT_SESSION_CACHE_H_ 6 #define NET_SSL_SSL_CLIENT_SESSION_CACHE_H_ 7 8 #include <stddef.h> 9 #include <time.h> 10 11 #include <memory> 12 #include <string> 13 14 #include "base/containers/flat_set.h" 15 #include "base/containers/lru_cache.h" 16 #include "base/functional/bind.h" 17 #include "base/memory/memory_pressure_monitor.h" 18 #include "base/memory/raw_ptr.h" 19 #include "net/base/host_port_pair.h" 20 #include "net/base/ip_address.h" 21 #include "net/base/net_export.h" 22 #include "net/base/network_anonymization_key.h" 23 #include "net/base/privacy_mode.h" 24 #include "third_party/abseil-cpp/absl/types/optional.h" 25 #include "third_party/boringssl/src/include/openssl/base.h" 26 27 namespace base { 28 class Clock; 29 } 30 31 namespace net { 32 33 class NET_EXPORT SSLClientSessionCache { 34 public: 35 struct Config { 36 // The maximum number of entries in the cache. 37 size_t max_entries = 1024; 38 // The number of calls to Lookup before a new check for expired sessions. 39 size_t expiration_check_count = 256; 40 }; 41 42 struct NET_EXPORT Key { 43 Key(); 44 Key(const Key& other); 45 Key(Key&& other); 46 ~Key(); 47 Key& operator=(const Key& other); 48 Key& operator=(Key&& other); 49 50 bool operator==(const Key& other) const; 51 bool operator<(const Key& other) const; 52 53 HostPortPair server; 54 absl::optional<IPAddress> dest_ip_addr; 55 NetworkAnonymizationKey network_anonymization_key; 56 PrivacyMode privacy_mode = PRIVACY_MODE_DISABLED; 57 bool disable_legacy_crypto = false; 58 }; 59 60 explicit SSLClientSessionCache(const Config& config); 61 62 SSLClientSessionCache(const SSLClientSessionCache&) = delete; 63 SSLClientSessionCache& operator=(const SSLClientSessionCache&) = delete; 64 65 ~SSLClientSessionCache(); 66 67 // Returns true if |entry| is expired as of |now|. 68 static bool IsExpired(SSL_SESSION* session, time_t now); 69 70 size_t size() const; 71 72 // Returns the session associated with |cache_key| and moves it to the front 73 // of the MRU list. Returns nullptr if there is none. 74 bssl::UniquePtr<SSL_SESSION> Lookup(const Key& cache_key); 75 76 // Inserts |session| into the cache at |cache_key|. If there is an existing 77 // one, it is released. Every |expiration_check_count| calls, the cache is 78 // checked for stale entries. 79 void Insert(const Key& cache_key, bssl::UniquePtr<SSL_SESSION> session); 80 81 // Clears early data support for all current sessions associated with 82 // |cache_key|. This may be used after a 0-RTT reject to avoid unnecessarily 83 // offering 0-RTT data on retries. See https://crbug.com/1066623. 84 void ClearEarlyData(const Key& cache_key); 85 86 // Removes all entries associated with items in |servers|. 87 void FlushForServers(const base::flat_set<HostPortPair>& servers); 88 89 // Removes all entries from the cache. 90 void Flush(); 91 92 void SetClockForTesting(base::Clock* clock); 93 94 private: 95 struct Entry { 96 Entry(); 97 Entry(Entry&&); 98 ~Entry(); 99 100 // Adds a new session onto this entry, dropping the oldest one if two are 101 // already stored. 102 void Push(bssl::UniquePtr<SSL_SESSION> session); 103 104 // Retrieves the latest session from the entry, removing it if its 105 // single-use. 106 bssl::UniquePtr<SSL_SESSION> Pop(); 107 108 // Removes any expired sessions, returning true if this entry can be 109 // deleted. 110 bool ExpireSessions(time_t now); 111 112 bssl::UniquePtr<SSL_SESSION> sessions[2]; 113 }; 114 115 // Removes all expired sessions from the cache. 116 void FlushExpiredSessions(); 117 118 // Clear cache on low memory notifications callback. 119 void OnMemoryPressure( 120 base::MemoryPressureListener::MemoryPressureLevel memory_pressure_level); 121 122 raw_ptr<base::Clock, DanglingUntriaged> clock_; 123 Config config_; 124 base::LRUCache<Key, Entry> cache_; 125 size_t lookups_since_flush_ = 0; 126 std::unique_ptr<base::MemoryPressureListener> memory_pressure_listener_; 127 }; 128 129 } // namespace net 130 131 #endif // NET_SSL_SSL_CLIENT_SESSION_CACHE_H_ 132