src/net/http/disk_based_cert_cache.cc

   1 // Copyright (c) 2014 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "net/http/disk_based_cert_cache.h"
   6
   7 #include <vector>
   8
   9 #include "base/bind.h"
  10 #include "base/callback_helpers.h"
  11 #include "base/memory/ref_counted.h"
  12 #include "base/metrics/histogram.h"
  13 #include "base/stl_util.h"
  14 #include "base/strings/string_number_conversions.h"
  15 #include "net/base/io_buffer.h"
  16 #include "net/base/net_errors.h"
  17 #include "net/disk_cache/disk_cache.h"
  18
  19 namespace net {
  20
  21 namespace {
  22
  23 // TODO(brandonsalmon): change this number to improve performance.
  24 const size_t kMemoryCacheMaxSize = 30;
  25
  26 // Used to obtain a unique cache key for a certificate in the form of
  27 // "cert:<hash>".
  28 std::string GetCacheKeyForCert(
  29     const X509Certificate::OSCertHandle cert_handle) {
  30   SHA1HashValue fingerprint =
  31       X509Certificate::CalculateFingerprint(cert_handle);
  32
  33   return "cert:" +
  34          base::HexEncode(fingerprint.data, arraysize(fingerprint.data));
  35 }
  36
  37 enum CacheResult {
  38   MEMORY_CACHE_HIT = 0,
  39   DISK_CACHE_HIT,
  40   DISK_CACHE_ENTRY_CORRUPT,
  41   DISK_CACHE_ERROR,
  42   CACHE_RESULT_MAX
  43 };
  44
  45 void RecordCacheResult(CacheResult result) {
  46   UMA_HISTOGRAM_ENUMERATION(
  47       "DiskBasedCertCache.CertIoCacheResult", result, CACHE_RESULT_MAX);
  48 }
  49
  50 }  // namespace
  51
  52 // WriteWorkers represent pending SetCertificate jobs in the DiskBasedCertCache.
  53 // Each certificate requested to be stored is assigned a WriteWorker.
  54 // The same certificate should not have multiple WriteWorkers at the same
  55 // time; instead, add a user callback to the existing WriteWorker.
  56 class DiskBasedCertCache::WriteWorker {
  57  public:
  58   // |backend| is the backend to store |certificate| in, using
  59   // |key| as the key for the disk_cache::Entry.
  60   // |cleanup_callback| is called to clean up this ReadWorker,
  61   // regardless of success or failure.
  62   WriteWorker(disk_cache::Backend* backend,
  63               const std::string& key,
  64               X509Certificate::OSCertHandle cert_handle,
  65               const base::Closure& cleanup_callback);
  66
  67   ~WriteWorker();
  68
  69   // Writes the given certificate to the cache. On completion, will invoke all
  70   // user callbacks.
  71   void Start();
  72
  73   // Adds a callback to the set of callbacks to be run when this
  74   // WriteWorker finishes processing.
  75   void AddCallback(const SetCallback& user_callback);
  76
  77   // Signals the WriteWorker to abort early. The WriteWorker will be destroyed
  78   // upon the completion of any pending callbacks. User callbacks will be
  79   // invoked with an empty string.
  80   void Cancel();
  81
  82  private:
  83   enum State {
  84     STATE_OPEN,
  85     STATE_OPEN_COMPLETE,
  86     STATE_CREATE,
  87     STATE_CREATE_COMPLETE,
  88     STATE_WRITE,
  89     STATE_WRITE_COMPLETE,
  90     STATE_NONE
  91   };
  92
  93   void OnIOComplete(int rv);
  94   int DoLoop(int rv);
  95
  96   int DoOpen();
  97   int DoOpenComplete(int rv);
  98   int DoCreate();
  99   int DoCreateComplete(int rv);
 100   int DoWrite();
 101   int DoWriteComplete(int rv);
 102
 103   void Finish(int rv);
 104
 105   // Invokes all of the |user_callbacks_|
 106   void RunCallbacks(int rv);
 107
 108   disk_cache::Backend* backend_;
 109   const X509Certificate::OSCertHandle cert_handle_;
 110   std::string key_;
 111   bool canceled_;
 112
 113   disk_cache::Entry* entry_;
 114   State next_state_;
 115   scoped_refptr<IOBuffer> buffer_;
 116   int io_buf_len_;
 117
 118   base::Closure cleanup_callback_;
 119   std::vector<SetCallback> user_callbacks_;
 120   CompletionCallback io_callback_;
 121 };
 122
 123 DiskBasedCertCache::WriteWorker::WriteWorker(
 124     disk_cache::Backend* backend,
 125     const std::string& key,
 126     X509Certificate::OSCertHandle cert_handle,
 127     const base::Closure& cleanup_callback)
 128     : backend_(backend),
 129       cert_handle_(X509Certificate::DupOSCertHandle(cert_handle)),
 130       key_(key),
 131       canceled_(false),
 132       entry_(NULL),
 133       next_state_(STATE_NONE),
 134       io_buf_len_(0),
 135       cleanup_callback_(cleanup_callback),
 136       io_callback_(
 137           base::Bind(&WriteWorker::OnIOComplete, base::Unretained(this))) {
 138 }
 139
 140 DiskBasedCertCache::WriteWorker::~WriteWorker() {
 141   if (cert_handle_)
 142     X509Certificate::FreeOSCertHandle(cert_handle_);
 143   if (entry_)
 144     entry_->Close();
 145 }
 146
 147 void DiskBasedCertCache::WriteWorker::Start() {
 148   DCHECK_EQ(STATE_NONE, next_state_);
 149
 150   next_state_ = STATE_OPEN;
 151   int rv = DoLoop(OK);
 152
 153   if (rv == ERR_IO_PENDING)
 154     return;
 155
 156   Finish(rv);
 157 }
 158
 159 void DiskBasedCertCache::WriteWorker::AddCallback(
 160     const SetCallback& user_callback) {
 161   user_callbacks_.push_back(user_callback);
 162 }
 163
 164 void DiskBasedCertCache::WriteWorker::Cancel() {
 165   canceled_ = true;
 166 }
 167
 168 void DiskBasedCertCache::WriteWorker::OnIOComplete(int rv) {
 169   if (canceled_) {
 170     Finish(ERR_FAILED);
 171     return;
 172   }
 173
 174   rv = DoLoop(rv);
 175
 176   if (rv == ERR_IO_PENDING)
 177     return;
 178
 179   Finish(rv);
 180 }
 181
 182 int DiskBasedCertCache::WriteWorker::DoLoop(int rv) {
 183   do {
 184     State state = next_state_;
 185     next_state_ = STATE_NONE;
 186     switch (state) {
 187       case STATE_OPEN:
 188         rv = DoOpen();
 189         break;
 190       case STATE_OPEN_COMPLETE:
 191         rv = DoOpenComplete(rv);
 192         break;
 193       case STATE_CREATE:
 194         rv = DoCreate();
 195         break;
 196       case STATE_CREATE_COMPLETE:
 197         rv = DoCreateComplete(rv);
 198         break;
 199       case STATE_WRITE:
 200         rv = DoWrite();
 201         break;
 202       case STATE_WRITE_COMPLETE:
 203         rv = DoWriteComplete(rv);
 204         break;
 205       case STATE_NONE:
 206         NOTREACHED();
 207         break;
 208     }
 209   } while (rv != ERR_IO_PENDING && next_state_ != STATE_NONE);
 210
 211   return rv;
 212 }
 213
 214 int DiskBasedCertCache::WriteWorker::DoOpen() {
 215   next_state_ = STATE_OPEN_COMPLETE;
 216   return backend_->OpenEntry(key_, &entry_, io_callback_);
 217 }
 218
 219 int DiskBasedCertCache::WriteWorker::DoOpenComplete(int rv) {
 220   // The entry doesn't exist yet, so we should create it.
 221   if (rv < 0) {
 222     next_state_ = STATE_CREATE;
 223     return OK;
 224   }
 225
 226   next_state_ = STATE_WRITE;
 227   return OK;
 228 }
 229
 230 int DiskBasedCertCache::WriteWorker::DoCreate() {
 231   next_state_ = STATE_CREATE_COMPLETE;
 232   return backend_->CreateEntry(key_, &entry_, io_callback_);
 233 }
 234
 235 int DiskBasedCertCache::WriteWorker::DoCreateComplete(int rv) {
 236   if (rv < 0)
 237     return rv;
 238
 239   next_state_ = STATE_WRITE;
 240   return OK;
 241 }
 242
 243 int DiskBasedCertCache::WriteWorker::DoWrite() {
 244   std::string write_data;
 245   bool encoded = X509Certificate::GetDEREncoded(cert_handle_, &write_data);
 246
 247   if (!encoded)
 248     return ERR_FAILED;
 249
 250   buffer_ = new IOBuffer(write_data.size());
 251   io_buf_len_ = write_data.size();
 252   memcpy(buffer_->data(), write_data.data(), io_buf_len_);
 253
 254   next_state_ = STATE_WRITE_COMPLETE;
 255
 256   return entry_->WriteData(0 /* index */,
 257                            0 /* offset */,
 258                            buffer_.get(),
 259                            write_data.size(),
 260                            io_callback_,
 261                            true /* truncate */);
 262 }
 263
 264 int DiskBasedCertCache::WriteWorker::DoWriteComplete(int rv) {
 265   if (rv < io_buf_len_)
 266     return ERR_FAILED;
 267
 268   return OK;
 269 }
 270
 271 void DiskBasedCertCache::WriteWorker::Finish(int rv) {
 272   cleanup_callback_.Run();
 273   cleanup_callback_.Reset();
 274   RunCallbacks(rv);
 275   delete this;
 276 }
 277
 278 void DiskBasedCertCache::WriteWorker::RunCallbacks(int rv) {
 279   std::string key;
 280   if (rv >= 0)
 281     key = key_;
 282
 283   for (std::vector<SetCallback>::const_iterator it = user_callbacks_.begin();
 284        it != user_callbacks_.end();
 285        ++it) {
 286     it->Run(key);
 287   }
 288   user_callbacks_.clear();
 289 }
 290
 291 // ReadWorkers represent pending GetCertificate jobs in the DiskBasedCertCache.
 292 // Each certificate requested to be retrieved from the cache is assigned a
 293 // ReadWorker. The same |key| should not have multiple ReadWorkers at the
 294 // same time; instead, call AddCallback to add a user callback to the
 295 // existing ReadWorker.
 296 class DiskBasedCertCache::ReadWorker {
 297  public:
 298   // |backend| is the backend to read |certificate| from, using
 299   // |key| as the key for the disk_cache::Entry.
 300   // |cleanup_callback| is called to clean up this ReadWorker,
 301   // regardless of success or failure.
 302   ReadWorker(disk_cache::Backend* backend,
 303              const std::string& key,
 304              const GetCallback& cleanup_callback);
 305
 306   ~ReadWorker();
 307
 308   // Reads the given certificate from the cache. On completion, will invoke all
 309   // user callbacks.
 310   void Start();
 311
 312   // Adds a callback to the set of callbacks to be run when this
 313   // ReadWorker finishes processing.
 314   void AddCallback(const GetCallback& user_callback);
 315
 316   // Signals the ReadWorker to abort early. The ReadWorker will be destroyed
 317   // upon the completion of any pending callbacks. User callbacks will be
 318   // invoked with a NULL cert handle.
 319   void Cancel();
 320
 321  private:
 322   enum State {
 323     STATE_OPEN,
 324     STATE_OPEN_COMPLETE,
 325     STATE_READ,
 326     STATE_READ_COMPLETE,
 327     STATE_NONE
 328   };
 329
 330   void OnIOComplete(int rv);
 331   int DoLoop(int rv);
 332   int DoOpen();
 333   int DoOpenComplete(int rv);
 334   int DoRead();
 335   int DoReadComplete(int rv);
 336   void Finish(int rv);
 337
 338   // Invokes all of |user_callbacks_|
 339   void RunCallbacks();
 340
 341   disk_cache::Backend* backend_;
 342   X509Certificate::OSCertHandle cert_handle_;
 343   std::string key_;
 344   bool canceled_;
 345
 346   disk_cache::Entry* entry_;
 347
 348   State next_state_;
 349   scoped_refptr<IOBuffer> buffer_;
 350   int io_buf_len_;
 351
 352   GetCallback cleanup_callback_;
 353   std::vector<GetCallback> user_callbacks_;
 354   CompletionCallback io_callback_;
 355 };
 356
 357 DiskBasedCertCache::ReadWorker::ReadWorker(disk_cache::Backend* backend,
 358                                            const std::string& key,
 359                                            const GetCallback& cleanup_callback)
 360     : backend_(backend),
 361       cert_handle_(NULL),
 362       key_(key),
 363       canceled_(false),
 364       entry_(NULL),
 365       next_state_(STATE_NONE),
 366       io_buf_len_(0),
 367       cleanup_callback_(cleanup_callback),
 368       io_callback_(
 369           base::Bind(&ReadWorker::OnIOComplete, base::Unretained(this))) {
 370 }
 371
 372 DiskBasedCertCache::ReadWorker::~ReadWorker() {
 373   if (entry_)
 374     entry_->Close();
 375   if (cert_handle_)
 376     X509Certificate::FreeOSCertHandle(cert_handle_);
 377 }
 378
 379 void DiskBasedCertCache::ReadWorker::Start() {
 380   DCHECK_EQ(STATE_NONE, next_state_);
 381   next_state_ = STATE_OPEN;
 382   int rv = DoLoop(OK);
 383
 384   if (rv == ERR_IO_PENDING)
 385     return;
 386
 387   Finish(rv);
 388 }
 389
 390 void DiskBasedCertCache::ReadWorker::AddCallback(
 391     const GetCallback& user_callback) {
 392   user_callbacks_.push_back(user_callback);
 393 }
 394
 395 void DiskBasedCertCache::ReadWorker::Cancel() {
 396   canceled_ = true;
 397 }
 398
 399 void DiskBasedCertCache::ReadWorker::OnIOComplete(int rv) {
 400   if (canceled_) {
 401     Finish(ERR_FAILED);
 402     return;
 403   }
 404
 405   rv = DoLoop(rv);
 406
 407   if (rv == ERR_IO_PENDING)
 408     return;
 409
 410   Finish(rv);
 411 }
 412
 413 int DiskBasedCertCache::ReadWorker::DoLoop(int rv) {
 414   do {
 415     State state = next_state_;
 416     next_state_ = STATE_NONE;
 417     switch (state) {
 418       case STATE_OPEN:
 419         rv = DoOpen();
 420         break;
 421       case STATE_OPEN_COMPLETE:
 422         rv = DoOpenComplete(rv);
 423         break;
 424       case STATE_READ:
 425         rv = DoRead();
 426         break;
 427       case STATE_READ_COMPLETE:
 428         rv = DoReadComplete(rv);
 429         break;
 430       case STATE_NONE:
 431         NOTREACHED();
 432         break;
 433     }
 434   } while (rv != ERR_IO_PENDING && next_state_ != STATE_NONE);
 435
 436   return rv;
 437 }
 438
 439 int DiskBasedCertCache::ReadWorker::DoOpen() {
 440   next_state_ = STATE_OPEN_COMPLETE;
 441   return backend_->OpenEntry(key_, &entry_, io_callback_);
 442 }
 443
 444 int DiskBasedCertCache::ReadWorker::DoOpenComplete(int rv) {
 445   if (rv < 0) {
 446     RecordCacheResult(DISK_CACHE_ERROR);
 447     return rv;
 448   }
 449
 450   next_state_ = STATE_READ;
 451   return OK;
 452 }
 453
 454 int DiskBasedCertCache::ReadWorker::DoRead() {
 455   next_state_ = STATE_READ_COMPLETE;
 456   io_buf_len_ = entry_->GetDataSize(0 /* index */);
 457   buffer_ = new IOBuffer(io_buf_len_);
 458   return entry_->ReadData(
 459       0 /* index */, 0 /* offset */, buffer_.get(), io_buf_len_, io_callback_);
 460 }
 461
 462 int DiskBasedCertCache::ReadWorker::DoReadComplete(int rv) {
 463   // The cache should return the entire buffer length. If it does not,
 464   // it is probably indicative of an issue other than corruption.
 465   if (rv < io_buf_len_) {
 466     RecordCacheResult(DISK_CACHE_ERROR);
 467     return ERR_FAILED;
 468   }
 469   cert_handle_ = X509Certificate::CreateOSCertHandleFromBytes(buffer_->data(),
 470                                                               io_buf_len_);
 471   if (!cert_handle_) {
 472     RecordCacheResult(DISK_CACHE_ENTRY_CORRUPT);
 473     return ERR_FAILED;
 474   }
 475
 476   RecordCacheResult(DISK_CACHE_HIT);
 477   return OK;
 478 }
 479
 480 void DiskBasedCertCache::ReadWorker::Finish(int rv) {
 481   cleanup_callback_.Run(cert_handle_);
 482   cleanup_callback_.Reset();
 483   RunCallbacks();
 484   delete this;
 485 }
 486
 487 void DiskBasedCertCache::ReadWorker::RunCallbacks() {
 488   for (std::vector<GetCallback>::const_iterator it = user_callbacks_.begin();
 489        it != user_callbacks_.end();
 490        ++it) {
 491     it->Run(cert_handle_);
 492   }
 493   user_callbacks_.clear();
 494 }
 495
 496 void DiskBasedCertCache::CertFree::operator()(
 497     X509Certificate::OSCertHandle cert_handle) {
 498   X509Certificate::FreeOSCertHandle(cert_handle);
 499 }
 500
 501 DiskBasedCertCache::DiskBasedCertCache(disk_cache::Backend* backend)
 502     : backend_(backend),
 503       mru_cert_cache_(kMemoryCacheMaxSize),
 504       mem_cache_hits_(0),
 505       mem_cache_misses_(0),
 506       weak_factory_(this) {
 507   DCHECK(backend_);
 508 }
 509
 510 DiskBasedCertCache::~DiskBasedCertCache() {
 511   for (WriteWorkerMap::iterator it = write_worker_map_.begin();
 512        it != write_worker_map_.end();
 513        ++it) {
 514     it->second->Cancel();
 515   }
 516   for (ReadWorkerMap::iterator it = read_worker_map_.begin();
 517        it != read_worker_map_.end();
 518        ++it) {
 519     it->second->Cancel();
 520   }
 521 }
 522
 523 void DiskBasedCertCache::GetCertificate(const std::string& key,
 524                                         const GetCallback& cb) {
 525   DCHECK(!key.empty());
 526
 527   // If the handle is already in the MRU cache, just return that (via callback).
 528   // Note, this will also bring the cert_handle to the front of the recency
 529   // list in the MRU cache.
 530   MRUCertCache::iterator mru_it = mru_cert_cache_.Get(key);
 531   if (mru_it != mru_cert_cache_.end()) {
 532     RecordCacheResult(MEMORY_CACHE_HIT);
 533     ++mem_cache_hits_;
 534     cb.Run(mru_it->second);
 535     return;
 536   }
 537   ++mem_cache_misses_;
 538
 539   ReadWorkerMap::iterator it = read_worker_map_.find(key);
 540
 541   if (it == read_worker_map_.end()) {
 542     ReadWorker* worker =
 543         new ReadWorker(backend_,
 544                        key,
 545                        base::Bind(&DiskBasedCertCache::FinishedReadOperation,
 546                                   weak_factory_.GetWeakPtr(),
 547                                   key));
 548     read_worker_map_[key] = worker;
 549     worker->AddCallback(cb);
 550     worker->Start();
 551   } else {
 552     it->second->AddCallback(cb);
 553   }
 554 }
 555
 556 void DiskBasedCertCache::SetCertificate(
 557     const X509Certificate::OSCertHandle cert_handle,
 558     const SetCallback& cb) {
 559   DCHECK(!cb.is_null());
 560   DCHECK(cert_handle);
 561   std::string key = GetCacheKeyForCert(cert_handle);
 562
 563   WriteWorkerMap::iterator it = write_worker_map_.find(key);
 564
 565   if (it == write_worker_map_.end()) {
 566     WriteWorker* worker =
 567         new WriteWorker(backend_,
 568                         key,
 569                         cert_handle,
 570                         base::Bind(&DiskBasedCertCache::FinishedWriteOperation,
 571                                    weak_factory_.GetWeakPtr(),
 572                                    key,
 573                                    cert_handle));
 574     write_worker_map_[key] = worker;
 575     worker->AddCallback(cb);
 576     worker->Start();
 577   } else {
 578     it->second->AddCallback(cb);
 579   }
 580 }
 581
 582 void DiskBasedCertCache::FinishedReadOperation(
 583     const std::string& key,
 584     X509Certificate::OSCertHandle cert_handle) {
 585   if (cert_handle)
 586     mru_cert_cache_.Put(key, X509Certificate::DupOSCertHandle(cert_handle));
 587   read_worker_map_.erase(key);
 588 }
 589
 590 void DiskBasedCertCache::FinishedWriteOperation(
 591     const std::string& key,
 592     X509Certificate::OSCertHandle cert_handle) {
 593   write_worker_map_.erase(key);
 594   if (!key.empty())
 595     mru_cert_cache_.Put(key, X509Certificate::DupOSCertHandle(cert_handle));
 596 }
 597
 598 }  // namespace net