net/cert/multi_threaded_cert_verifier.h

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #ifndef NET_CERT_MULTI_THREADED_CERT_VERIFIER_H_
   6 #define NET_CERT_MULTI_THREADED_CERT_VERIFIER_H_
   7
   8 #include <stdint.h>
   9 #include <set>
  10 #include <string>
  11 #include <vector>
  12
  13 #include "base/gtest_prod_util.h"
  14 #include "base/macros.h"
  15 #include "base/memory/ref_counted.h"
  16 #include "base/threading/non_thread_safe.h"
  17 #include "net/base/completion_callback.h"
  18 #include "net/base/expiring_cache.h"
  19 #include "net/base/hash_value.h"
  20 #include "net/base/net_export.h"
  21 #include "net/cert/cert_database.h"
  22 #include "net/cert/cert_verifier.h"
  23 #include "net/cert/cert_verify_result.h"
  24 #include "net/cert/x509_cert_types.h"
  25
  26 namespace net {
  27
  28 class CertTrustAnchorProvider;
  29 class CertVerifierJob;
  30 class CertVerifierRequest;
  31 class CertVerifierWorker;
  32 class CertVerifyProc;
  33
  34 // MultiThreadedCertVerifier is a CertVerifier implementation that runs
  35 // synchronous CertVerifier implementations on worker threads.
  36 class NET_EXPORT_PRIVATE MultiThreadedCertVerifier
  37     : public CertVerifier,
  38       NON_EXPORTED_BASE(public base::NonThreadSafe),
  39       public CertDatabase::Observer {
  40  public:
  41   explicit MultiThreadedCertVerifier(CertVerifyProc* verify_proc);
  42
  43   // When the verifier is destroyed, all certificate verifications requests are
  44   // canceled, and their completion callbacks will not be called.
  45   ~MultiThreadedCertVerifier() override;
  46
  47   // Configures a source of additional certificates that should be treated as
  48   // trust anchors during verification, provided that the underlying
  49   // CertVerifyProc supports additional trust beyond the default implementation.
  50   // The CertTrustAnchorProvider will only be accessed on the same
  51   // thread that Verify() is called on; that is, it will not be
  52   // accessed from worker threads.
  53   // It must outlive the MultiThreadedCertVerifier.
  54   void SetCertTrustAnchorProvider(
  55       CertTrustAnchorProvider* trust_anchor_provider);
  56
  57   // CertVerifier implementation
  58   int Verify(X509Certificate* cert,
  59              const std::string& hostname,
  60              const std::string& ocsp_response,
  61              int flags,
  62              CRLSet* crl_set,
  63              CertVerifyResult* verify_result,
  64              const CompletionCallback& callback,
  65              scoped_ptr<Request>* out_req,
  66              const BoundNetLog& net_log) override;
  67
  68   bool SupportsOCSPStapling() override;
  69
  70  private:
  71   struct JobToRequestParamsComparator;
  72   friend class CertVerifierRequest;
  73   friend class CertVerifierJob;
  74   friend class MultiThreadedCertVerifierTest;
  75   FRIEND_TEST_ALL_PREFIXES(MultiThreadedCertVerifierTest, CacheHit);
  76   FRIEND_TEST_ALL_PREFIXES(MultiThreadedCertVerifierTest, DifferentCACerts);
  77   FRIEND_TEST_ALL_PREFIXES(MultiThreadedCertVerifierTest, InflightJoin);
  78   FRIEND_TEST_ALL_PREFIXES(MultiThreadedCertVerifierTest, MultipleInflightJoin);
  79   FRIEND_TEST_ALL_PREFIXES(MultiThreadedCertVerifierTest, CancelRequest);
  80   FRIEND_TEST_ALL_PREFIXES(MultiThreadedCertVerifierTest,
  81                            RequestParamsComparators);
  82   FRIEND_TEST_ALL_PREFIXES(MultiThreadedCertVerifierTest,
  83                            CertTrustAnchorProvider);
  84
  85   // Input parameters of a certificate verification request.
  86   struct NET_EXPORT_PRIVATE RequestParams {
  87     RequestParams(const SHA1HashValue& cert_fingerprint_arg,
  88                   const SHA1HashValue& ca_fingerprint_arg,
  89                   const std::string& hostname_arg,
  90                   const std::string& ocsp_response_arg,
  91                   int flags_arg,
  92                   const CertificateList& additional_trust_anchors);
  93     ~RequestParams();
  94
  95     bool operator<(const RequestParams& other) const;
  96
  97     std::string hostname;
  98     int flags;
  99     std::vector<SHA1HashValue> hash_values;
 100   };
 101
 102   // CachedResult contains the result of a certificate verification.
 103   struct NET_EXPORT_PRIVATE CachedResult {
 104     CachedResult();
 105     ~CachedResult();
 106
 107     int error;  // The return value of CertVerifier::Verify.
 108     CertVerifyResult result;  // The output of CertVerifier::Verify.
 109   };
 110
 111   // Rather than having a single validity point along a monotonically increasing
 112   // timeline, certificate verification is based on falling within a range of
 113   // the certificate's NotBefore and NotAfter and based on what the current
 114   // system clock says (which may advance forwards or backwards as users correct
 115   // clock skew). CacheValidityPeriod and CacheExpirationFunctor are helpers to
 116   // ensure that expiration is measured both by the 'general' case (now + cache
 117   // TTL) and by whether or not significant enough clock skew was introduced
 118   // since the last verification.
 119   struct CacheValidityPeriod {
 120     explicit CacheValidityPeriod(const base::Time& now);
 121     CacheValidityPeriod(const base::Time& now, const base::Time& expiration);
 122
 123     base::Time verification_time;
 124     base::Time expiration_time;
 125   };
 126
 127   struct CacheExpirationFunctor {
 128     // Returns true iff |now| is within the validity period of |expiration|.
 129     bool operator()(const CacheValidityPeriod& now,
 130                     const CacheValidityPeriod& expiration) const;
 131   };
 132
 133   struct JobComparator {
 134     bool operator()(const CertVerifierJob* job1,
 135                     const CertVerifierJob* job2) const;
 136   };
 137
 138   using JobSet = std::set<CertVerifierJob*, JobComparator>;
 139
 140   typedef ExpiringCache<RequestParams, CachedResult, CacheValidityPeriod,
 141                         CacheExpirationFunctor> CertVerifierCache;
 142
 143   // Saves |result| into the cache, keyed by |key|.
 144   void SaveResultToCache(const RequestParams& key, const CachedResult& result);
 145
 146   // CertDatabase::Observer methods:
 147   void OnCACertChanged(const X509Certificate* cert) override;
 148
 149   // Returns an inflight job for |key|. If there is no such job then returns
 150   // null.
 151   CertVerifierJob* FindJob(const RequestParams& key);
 152
 153   // Removes |job| from the inflight set, and passes ownership back to the
 154   // caller. |job| must already be |inflight_|.
 155   scoped_ptr<CertVerifierJob> RemoveJob(CertVerifierJob* job);
 156
 157   // For unit testing.
 158   void ClearCache() { cache_.Clear(); }
 159   size_t GetCacheSize() const { return cache_.size(); }
 160   uint64_t cache_hits() const { return cache_hits_; }
 161   uint64_t requests() const { return requests_; }
 162   uint64_t inflight_joins() const { return inflight_joins_; }
 163
 164   // cache_ maps from a request to a cached result.
 165   CertVerifierCache cache_;
 166
 167   // inflight_ holds the jobs for which an active verification is taking place.
 168   JobSet inflight_;
 169
 170   uint64_t requests_;
 171   uint64_t cache_hits_;
 172   uint64_t inflight_joins_;
 173
 174   scoped_refptr<CertVerifyProc> verify_proc_;
 175
 176   CertTrustAnchorProvider* trust_anchor_provider_;
 177
 178   DISALLOW_COPY_AND_ASSIGN(MultiThreadedCertVerifier);
 179 };
 180
 181 }  // namespace net
 182
 183 #endif  // NET_CERT_MULTI_THREADED_CERT_VERIFIER_H_