1 /*
2 * SSL session cache implementation
3 *
4 * Copyright The Mbed TLS Contributors
5 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
18 */
19 /*
20 * These session callbacks use a simple chained list
21 * to store and retrieve the session information.
22 */
23
24 #include "common.h"
25
26 #if defined(MBEDTLS_SSL_CACHE_C)
27
28 #if defined(MBEDTLS_PLATFORM_C)
29 #include "mbedtls/platform.h"
30 #else
31 #include <stdlib.h>
32 #define mbedtls_calloc calloc
33 #define mbedtls_free free
34 #endif
35
36 #include "mbedtls/ssl_cache.h"
37 #include "mbedtls/ssl_internal.h"
38
39 #include <string.h>
40
mbedtls_ssl_cache_init(mbedtls_ssl_cache_context * cache)41 void mbedtls_ssl_cache_init( mbedtls_ssl_cache_context *cache )
42 {
43 memset( cache, 0, sizeof( mbedtls_ssl_cache_context ) );
44
45 cache->timeout = MBEDTLS_SSL_CACHE_DEFAULT_TIMEOUT;
46 cache->max_entries = MBEDTLS_SSL_CACHE_DEFAULT_MAX_ENTRIES;
47
48 #if defined(MBEDTLS_THREADING_C)
49 mbedtls_mutex_init( &cache->mutex );
50 #endif
51 }
52
mbedtls_ssl_cache_get(void * data,mbedtls_ssl_session * session)53 int mbedtls_ssl_cache_get( void *data, mbedtls_ssl_session *session )
54 {
55 int ret = 1;
56 #if defined(MBEDTLS_HAVE_TIME)
57 mbedtls_time_t t = mbedtls_time( NULL );
58 #endif
59 mbedtls_ssl_cache_context *cache = (mbedtls_ssl_cache_context *) data;
60 mbedtls_ssl_cache_entry *cur, *entry;
61
62 #if defined(MBEDTLS_THREADING_C)
63 if( mbedtls_mutex_lock( &cache->mutex ) != 0 )
64 return( 1 );
65 #endif
66
67 cur = cache->chain;
68 entry = NULL;
69
70 while( cur != NULL )
71 {
72 entry = cur;
73 cur = cur->next;
74
75 #if defined(MBEDTLS_HAVE_TIME)
76 if( cache->timeout != 0 &&
77 (int) ( t - entry->timestamp ) > cache->timeout )
78 continue;
79 #endif
80
81 if( session->id_len != entry->session.id_len ||
82 memcmp( session->id, entry->session.id,
83 entry->session.id_len ) != 0 )
84 {
85 continue;
86 }
87
88 ret = mbedtls_ssl_session_copy( session, &entry->session );
89 if( ret != 0 )
90 {
91 ret = 1;
92 goto exit;
93 }
94
95 #if defined(MBEDTLS_X509_CRT_PARSE_C) && \
96 defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
97 /*
98 * Restore peer certificate (without rest of the original chain)
99 */
100 if( entry->peer_cert.p != NULL )
101 {
102 /* `session->peer_cert` is NULL after the call to
103 * mbedtls_ssl_session_copy(), because cache entries
104 * have the `peer_cert` field set to NULL. */
105
106 if( ( session->peer_cert = mbedtls_calloc( 1,
107 sizeof(mbedtls_x509_crt) ) ) == NULL )
108 {
109 ret = 1;
110 goto exit;
111 }
112
113 mbedtls_x509_crt_init( session->peer_cert );
114 if( mbedtls_x509_crt_parse( session->peer_cert, entry->peer_cert.p,
115 entry->peer_cert.len ) != 0 )
116 {
117 mbedtls_free( session->peer_cert );
118 session->peer_cert = NULL;
119 ret = 1;
120 goto exit;
121 }
122 }
123 #endif /* MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
124
125 ret = 0;
126 goto exit;
127 }
128
129 exit:
130 #if defined(MBEDTLS_THREADING_C)
131 if( mbedtls_mutex_unlock( &cache->mutex ) != 0 )
132 ret = 1;
133 #endif
134
135 return( ret );
136 }
137
mbedtls_ssl_cache_set(void * data,const mbedtls_ssl_session * session)138 int mbedtls_ssl_cache_set( void *data, const mbedtls_ssl_session *session )
139 {
140 int ret = 1;
141 #if defined(MBEDTLS_HAVE_TIME)
142 mbedtls_time_t t = mbedtls_time( NULL ), oldest = 0;
143 mbedtls_ssl_cache_entry *old = NULL;
144 #endif
145 mbedtls_ssl_cache_context *cache = (mbedtls_ssl_cache_context *) data;
146 mbedtls_ssl_cache_entry *cur, *prv;
147 int count = 0;
148
149 #if defined(MBEDTLS_THREADING_C)
150 if( ( ret = mbedtls_mutex_lock( &cache->mutex ) ) != 0 )
151 return( ret );
152 #endif
153
154 cur = cache->chain;
155 prv = NULL;
156
157 while( cur != NULL )
158 {
159 count++;
160
161 #if defined(MBEDTLS_HAVE_TIME)
162 if( cache->timeout != 0 &&
163 (int) ( t - cur->timestamp ) > cache->timeout )
164 {
165 cur->timestamp = t;
166 break; /* expired, reuse this slot, update timestamp */
167 }
168 #endif
169
170 if( memcmp( session->id, cur->session.id, cur->session.id_len ) == 0 )
171 break; /* client reconnected, keep timestamp for session id */
172
173 #if defined(MBEDTLS_HAVE_TIME)
174 if( oldest == 0 || cur->timestamp < oldest )
175 {
176 oldest = cur->timestamp;
177 old = cur;
178 }
179 #endif
180
181 prv = cur;
182 cur = cur->next;
183 }
184
185 if( cur == NULL )
186 {
187 #if defined(MBEDTLS_HAVE_TIME)
188 /*
189 * Reuse oldest entry if max_entries reached
190 */
191 if( count >= cache->max_entries )
192 {
193 if( old == NULL )
194 {
195 ret = 1;
196 goto exit;
197 }
198
199 cur = old;
200 }
201 #else /* MBEDTLS_HAVE_TIME */
202 /*
203 * Reuse first entry in chain if max_entries reached,
204 * but move to last place
205 */
206 if( count >= cache->max_entries )
207 {
208 if( cache->chain == NULL )
209 {
210 ret = 1;
211 goto exit;
212 }
213
214 cur = cache->chain;
215 cache->chain = cur->next;
216 cur->next = NULL;
217 prv->next = cur;
218 }
219 #endif /* MBEDTLS_HAVE_TIME */
220 else
221 {
222 /*
223 * max_entries not reached, create new entry
224 */
225 cur = mbedtls_calloc( 1, sizeof(mbedtls_ssl_cache_entry) );
226 if( cur == NULL )
227 {
228 ret = 1;
229 goto exit;
230 }
231
232 if( prv == NULL )
233 cache->chain = cur;
234 else
235 prv->next = cur;
236 }
237
238 #if defined(MBEDTLS_HAVE_TIME)
239 cur->timestamp = t;
240 #endif
241 }
242
243 #if defined(MBEDTLS_X509_CRT_PARSE_C) && \
244 defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
245 /*
246 * If we're reusing an entry, free its certificate first
247 */
248 if( cur->peer_cert.p != NULL )
249 {
250 mbedtls_free( cur->peer_cert.p );
251 memset( &cur->peer_cert, 0, sizeof(mbedtls_x509_buf) );
252 }
253 #endif /* MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
254
255 /* Copy the entire session; this temporarily makes a copy of the
256 * X.509 CRT structure even though we only want to store the raw CRT.
257 * This inefficiency will go away as soon as we implement on-demand
258 * parsing of CRTs, in which case there's no need for the `peer_cert`
259 * field anymore in the first place, and we're done after this call. */
260 ret = mbedtls_ssl_session_copy( &cur->session, session );
261 if( ret != 0 )
262 {
263 ret = 1;
264 goto exit;
265 }
266
267 #if defined(MBEDTLS_X509_CRT_PARSE_C) && \
268 defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
269 /* If present, free the X.509 structure and only store the raw CRT data. */
270 if( cur->session.peer_cert != NULL )
271 {
272 cur->peer_cert.p =
273 mbedtls_calloc( 1, cur->session.peer_cert->raw.len );
274 if( cur->peer_cert.p == NULL )
275 {
276 ret = 1;
277 goto exit;
278 }
279
280 memcpy( cur->peer_cert.p,
281 cur->session.peer_cert->raw.p,
282 cur->session.peer_cert->raw.len );
283 cur->peer_cert.len = session->peer_cert->raw.len;
284
285 mbedtls_x509_crt_free( cur->session.peer_cert );
286 mbedtls_free( cur->session.peer_cert );
287 cur->session.peer_cert = NULL;
288 }
289 #endif /* MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
290
291 ret = 0;
292
293 exit:
294 #if defined(MBEDTLS_THREADING_C)
295 if( mbedtls_mutex_unlock( &cache->mutex ) != 0 )
296 ret = 1;
297 #endif
298
299 return( ret );
300 }
301
302 #if defined(MBEDTLS_HAVE_TIME)
mbedtls_ssl_cache_set_timeout(mbedtls_ssl_cache_context * cache,int timeout)303 void mbedtls_ssl_cache_set_timeout( mbedtls_ssl_cache_context *cache, int timeout )
304 {
305 if( timeout < 0 ) timeout = 0;
306
307 cache->timeout = timeout;
308 }
309 #endif /* MBEDTLS_HAVE_TIME */
310
mbedtls_ssl_cache_set_max_entries(mbedtls_ssl_cache_context * cache,int max)311 void mbedtls_ssl_cache_set_max_entries( mbedtls_ssl_cache_context *cache, int max )
312 {
313 if( max < 0 ) max = 0;
314
315 cache->max_entries = max;
316 }
317
mbedtls_ssl_cache_free(mbedtls_ssl_cache_context * cache)318 void mbedtls_ssl_cache_free( mbedtls_ssl_cache_context *cache )
319 {
320 mbedtls_ssl_cache_entry *cur, *prv;
321
322 cur = cache->chain;
323
324 while( cur != NULL )
325 {
326 prv = cur;
327 cur = cur->next;
328
329 mbedtls_ssl_session_free( &prv->session );
330
331 #if defined(MBEDTLS_X509_CRT_PARSE_C) && \
332 defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
333 mbedtls_free( prv->peer_cert.p );
334 #endif /* MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
335
336 mbedtls_free( prv );
337 }
338
339 #if defined(MBEDTLS_THREADING_C)
340 mbedtls_mutex_free( &cache->mutex );
341 #endif
342 cache->chain = NULL;
343 }
344
345 #endif /* MBEDTLS_SSL_CACHE_C */
346