1 /* 2 * SSL session cache implementation 3 * 4 * Copyright The Mbed TLS Contributors 5 * SPDX-License-Identifier: Apache-2.0 6 * 7 * Licensed under the Apache License, Version 2.0 (the "License"); you may 8 * not use this file except in compliance with the License. 9 * You may obtain a copy of the License at 10 * 11 * http://www.apache.org/licenses/LICENSE-2.0 12 * 13 * Unless required by applicable law or agreed to in writing, software 14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT 15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 16 * See the License for the specific language governing permissions and 17 * limitations under the License. 18 */ 19 /* 20 * These session callbacks use a simple chained list 21 * to store and retrieve the session information. 22 */ 23 24 #include "common.h" 25 26 #if defined(MBEDTLS_SSL_CACHE_C) 27 28 #if defined(MBEDTLS_PLATFORM_C) 29 #include "mbedtls/platform.h" 30 #else 31 #include <stdlib.h> 32 #define mbedtls_calloc calloc 33 #define mbedtls_free free 34 #endif 35 36 #include "mbedtls/ssl_cache.h" 37 #include "mbedtls/ssl_internal.h" 38 39 #include <string.h> 40 41 void mbedtls_ssl_cache_init( mbedtls_ssl_cache_context *cache ) 42 { 43 memset( cache, 0, sizeof( mbedtls_ssl_cache_context ) ); 44 45 cache->timeout = MBEDTLS_SSL_CACHE_DEFAULT_TIMEOUT; 46 cache->max_entries = MBEDTLS_SSL_CACHE_DEFAULT_MAX_ENTRIES; 47 48 #if defined(MBEDTLS_THREADING_C) 49 mbedtls_mutex_init( &cache->mutex ); 50 #endif 51 } 52 53 int mbedtls_ssl_cache_get( void *data, mbedtls_ssl_session *session ) 54 { 55 int ret = 1; 56 #if defined(MBEDTLS_HAVE_TIME) 57 mbedtls_time_t t = mbedtls_time( NULL ); 58 #endif 59 mbedtls_ssl_cache_context *cache = (mbedtls_ssl_cache_context *) data; 60 mbedtls_ssl_cache_entry *cur, *entry; 61 62 #if defined(MBEDTLS_THREADING_C) 63 if( mbedtls_mutex_lock( &cache->mutex ) != 0 ) 64 return( 1 ); 65 #endif 66 67 cur = cache->chain; 68 entry = NULL; 69 70 while( cur != NULL ) 71 { 72 entry = cur; 73 cur = cur->next; 74 75 #if defined(MBEDTLS_HAVE_TIME) 76 if( cache->timeout != 0 && 77 (int) ( t - entry->timestamp ) > cache->timeout ) 78 continue; 79 #endif 80 81 if( session->id_len != entry->session.id_len || 82 memcmp( session->id, entry->session.id, 83 entry->session.id_len ) != 0 ) 84 { 85 continue; 86 } 87 88 ret = mbedtls_ssl_session_copy( session, &entry->session ); 89 if( ret != 0 ) 90 { 91 ret = 1; 92 goto exit; 93 } 94 95 #if defined(MBEDTLS_X509_CRT_PARSE_C) && \ 96 defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) 97 /* 98 * Restore peer certificate (without rest of the original chain) 99 */ 100 if( entry->peer_cert.p != NULL ) 101 { 102 /* `session->peer_cert` is NULL after the call to 103 * mbedtls_ssl_session_copy(), because cache entries 104 * have the `peer_cert` field set to NULL. */ 105 106 if( ( session->peer_cert = mbedtls_calloc( 1, 107 sizeof(mbedtls_x509_crt) ) ) == NULL ) 108 { 109 ret = 1; 110 goto exit; 111 } 112 113 mbedtls_x509_crt_init( session->peer_cert ); 114 if( mbedtls_x509_crt_parse( session->peer_cert, entry->peer_cert.p, 115 entry->peer_cert.len ) != 0 ) 116 { 117 mbedtls_free( session->peer_cert ); 118 session->peer_cert = NULL; 119 ret = 1; 120 goto exit; 121 } 122 } 123 #endif /* MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ 124 125 ret = 0; 126 goto exit; 127 } 128 129 exit: 130 #if defined(MBEDTLS_THREADING_C) 131 if( mbedtls_mutex_unlock( &cache->mutex ) != 0 ) 132 ret = 1; 133 #endif 134 135 return( ret ); 136 } 137 138 int mbedtls_ssl_cache_set( void *data, const mbedtls_ssl_session *session ) 139 { 140 int ret = 1; 141 #if defined(MBEDTLS_HAVE_TIME) 142 mbedtls_time_t t = mbedtls_time( NULL ), oldest = 0; 143 mbedtls_ssl_cache_entry *old = NULL; 144 #endif 145 mbedtls_ssl_cache_context *cache = (mbedtls_ssl_cache_context *) data; 146 mbedtls_ssl_cache_entry *cur, *prv; 147 int count = 0; 148 149 #if defined(MBEDTLS_THREADING_C) 150 if( ( ret = mbedtls_mutex_lock( &cache->mutex ) ) != 0 ) 151 return( ret ); 152 #endif 153 154 cur = cache->chain; 155 prv = NULL; 156 157 while( cur != NULL ) 158 { 159 count++; 160 161 #if defined(MBEDTLS_HAVE_TIME) 162 if( cache->timeout != 0 && 163 (int) ( t - cur->timestamp ) > cache->timeout ) 164 { 165 cur->timestamp = t; 166 break; /* expired, reuse this slot, update timestamp */ 167 } 168 #endif 169 170 if( memcmp( session->id, cur->session.id, cur->session.id_len ) == 0 ) 171 break; /* client reconnected, keep timestamp for session id */ 172 173 #if defined(MBEDTLS_HAVE_TIME) 174 if( oldest == 0 || cur->timestamp < oldest ) 175 { 176 oldest = cur->timestamp; 177 old = cur; 178 } 179 #endif 180 181 prv = cur; 182 cur = cur->next; 183 } 184 185 if( cur == NULL ) 186 { 187 #if defined(MBEDTLS_HAVE_TIME) 188 /* 189 * Reuse oldest entry if max_entries reached 190 */ 191 if( count >= cache->max_entries ) 192 { 193 if( old == NULL ) 194 { 195 ret = 1; 196 goto exit; 197 } 198 199 cur = old; 200 } 201 #else /* MBEDTLS_HAVE_TIME */ 202 /* 203 * Reuse first entry in chain if max_entries reached, 204 * but move to last place 205 */ 206 if( count >= cache->max_entries ) 207 { 208 if( cache->chain == NULL ) 209 { 210 ret = 1; 211 goto exit; 212 } 213 214 cur = cache->chain; 215 cache->chain = cur->next; 216 cur->next = NULL; 217 prv->next = cur; 218 } 219 #endif /* MBEDTLS_HAVE_TIME */ 220 else 221 { 222 /* 223 * max_entries not reached, create new entry 224 */ 225 cur = mbedtls_calloc( 1, sizeof(mbedtls_ssl_cache_entry) ); 226 if( cur == NULL ) 227 { 228 ret = 1; 229 goto exit; 230 } 231 232 if( prv == NULL ) 233 cache->chain = cur; 234 else 235 prv->next = cur; 236 } 237 238 #if defined(MBEDTLS_HAVE_TIME) 239 cur->timestamp = t; 240 #endif 241 } 242 243 #if defined(MBEDTLS_X509_CRT_PARSE_C) && \ 244 defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) 245 /* 246 * If we're reusing an entry, free its certificate first 247 */ 248 if( cur->peer_cert.p != NULL ) 249 { 250 mbedtls_free( cur->peer_cert.p ); 251 memset( &cur->peer_cert, 0, sizeof(mbedtls_x509_buf) ); 252 } 253 #endif /* MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ 254 255 /* Copy the entire session; this temporarily makes a copy of the 256 * X.509 CRT structure even though we only want to store the raw CRT. 257 * This inefficiency will go away as soon as we implement on-demand 258 * parsing of CRTs, in which case there's no need for the `peer_cert` 259 * field anymore in the first place, and we're done after this call. */ 260 ret = mbedtls_ssl_session_copy( &cur->session, session ); 261 if( ret != 0 ) 262 { 263 ret = 1; 264 goto exit; 265 } 266 267 #if defined(MBEDTLS_X509_CRT_PARSE_C) && \ 268 defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) 269 /* If present, free the X.509 structure and only store the raw CRT data. */ 270 if( cur->session.peer_cert != NULL ) 271 { 272 cur->peer_cert.p = 273 mbedtls_calloc( 1, cur->session.peer_cert->raw.len ); 274 if( cur->peer_cert.p == NULL ) 275 { 276 ret = 1; 277 goto exit; 278 } 279 280 memcpy( cur->peer_cert.p, 281 cur->session.peer_cert->raw.p, 282 cur->session.peer_cert->raw.len ); 283 cur->peer_cert.len = session->peer_cert->raw.len; 284 285 mbedtls_x509_crt_free( cur->session.peer_cert ); 286 mbedtls_free( cur->session.peer_cert ); 287 cur->session.peer_cert = NULL; 288 } 289 #endif /* MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ 290 291 ret = 0; 292 293 exit: 294 #if defined(MBEDTLS_THREADING_C) 295 if( mbedtls_mutex_unlock( &cache->mutex ) != 0 ) 296 ret = 1; 297 #endif 298 299 return( ret ); 300 } 301 302 #if defined(MBEDTLS_HAVE_TIME) 303 void mbedtls_ssl_cache_set_timeout( mbedtls_ssl_cache_context *cache, int timeout ) 304 { 305 if( timeout < 0 ) timeout = 0; 306 307 cache->timeout = timeout; 308 } 309 #endif /* MBEDTLS_HAVE_TIME */ 310 311 void mbedtls_ssl_cache_set_max_entries( mbedtls_ssl_cache_context *cache, int max ) 312 { 313 if( max < 0 ) max = 0; 314 315 cache->max_entries = max; 316 } 317 318 void mbedtls_ssl_cache_free( mbedtls_ssl_cache_context *cache ) 319 { 320 mbedtls_ssl_cache_entry *cur, *prv; 321 322 cur = cache->chain; 323 324 while( cur != NULL ) 325 { 326 prv = cur; 327 cur = cur->next; 328 329 mbedtls_ssl_session_free( &prv->session ); 330 331 #if defined(MBEDTLS_X509_CRT_PARSE_C) && \ 332 defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) 333 mbedtls_free( prv->peer_cert.p ); 334 #endif /* MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ 335 336 mbedtls_free( prv ); 337 } 338 339 #if defined(MBEDTLS_THREADING_C) 340 mbedtls_mutex_free( &cache->mutex ); 341 #endif 342 cache->chain = NULL; 343 } 344 345 #endif /* MBEDTLS_SSL_CACHE_C */ 346