1 /*
2 * SSL session cache implementation
3 *
4 * Copyright The Mbed TLS Contributors
5 * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
6 *
7 * This file is provided under the Apache License 2.0, or the
8 * GNU General Public License v2.0 or later.
9 *
10 * **********
11 * Apache License 2.0:
12 *
13 * Licensed under the Apache License, Version 2.0 (the "License"); you may
14 * not use this file except in compliance with the License.
15 * You may obtain a copy of the License at
16 *
17 * http://www.apache.org/licenses/LICENSE-2.0
18 *
19 * Unless required by applicable law or agreed to in writing, software
20 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
21 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
22 * See the License for the specific language governing permissions and
23 * limitations under the License.
24 *
25 * **********
26 *
27 * **********
28 * GNU General Public License v2.0 or later:
29 *
30 * This program is free software; you can redistribute it and/or modify
31 * it under the terms of the GNU General Public License as published by
32 * the Free Software Foundation; either version 2 of the License, or
33 * (at your option) any later version.
34 *
35 * This program is distributed in the hope that it will be useful,
36 * but WITHOUT ANY WARRANTY; without even the implied warranty of
37 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
38 * GNU General Public License for more details.
39 *
40 * You should have received a copy of the GNU General Public License along
41 * with this program; if not, write to the Free Software Foundation, Inc.,
42 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
43 *
44 * **********
45 */
46 /*
47 * These session callbacks use a simple chained list
48 * to store and retrieve the session information.
49 */
50
51 #if !defined(MBEDTLS_CONFIG_FILE)
52 #include "mbedtls/config.h"
53 #else
54 #include MBEDTLS_CONFIG_FILE
55 #endif
56
57 #if defined(MBEDTLS_SSL_CACHE_C)
58
59 #if defined(MBEDTLS_PLATFORM_C)
60 #include "mbedtls/platform.h"
61 #else
62 #include <stdlib.h>
63 #define mbedtls_calloc calloc
64 #define mbedtls_free free
65 #endif
66
67 #include "mbedtls/ssl_cache.h"
68
69 #include <string.h>
70
mbedtls_ssl_cache_init(mbedtls_ssl_cache_context * cache)71 void mbedtls_ssl_cache_init( mbedtls_ssl_cache_context *cache )
72 {
73 memset( cache, 0, sizeof( mbedtls_ssl_cache_context ) );
74
75 cache->timeout = MBEDTLS_SSL_CACHE_DEFAULT_TIMEOUT;
76 cache->max_entries = MBEDTLS_SSL_CACHE_DEFAULT_MAX_ENTRIES;
77
78 #if defined(MBEDTLS_THREADING_C)
79 mbedtls_mutex_init( &cache->mutex );
80 #endif
81 }
82
mbedtls_ssl_cache_get(void * data,mbedtls_ssl_session * session)83 int mbedtls_ssl_cache_get( void *data, mbedtls_ssl_session *session )
84 {
85 int ret = 1;
86 #if defined(MBEDTLS_HAVE_TIME)
87 mbedtls_time_t t = mbedtls_time( NULL );
88 #endif
89 mbedtls_ssl_cache_context *cache = (mbedtls_ssl_cache_context *) data;
90 mbedtls_ssl_cache_entry *cur, *entry;
91
92 #if defined(MBEDTLS_THREADING_C)
93 if( mbedtls_mutex_lock( &cache->mutex ) != 0 )
94 return( 1 );
95 #endif
96
97 cur = cache->chain;
98 entry = NULL;
99
100 while( cur != NULL )
101 {
102 entry = cur;
103 cur = cur->next;
104
105 #if defined(MBEDTLS_HAVE_TIME)
106 if( cache->timeout != 0 &&
107 (int) ( t - entry->timestamp ) > cache->timeout )
108 continue;
109 #endif
110
111 if( session->ciphersuite != entry->session.ciphersuite ||
112 session->compression != entry->session.compression ||
113 session->id_len != entry->session.id_len )
114 continue;
115
116 if( memcmp( session->id, entry->session.id,
117 entry->session.id_len ) != 0 )
118 continue;
119
120 memcpy( session->master, entry->session.master, 48 );
121
122 session->verify_result = entry->session.verify_result;
123
124 #if defined(MBEDTLS_X509_CRT_PARSE_C)
125 /*
126 * Restore peer certificate (without rest of the original chain)
127 */
128 if( entry->peer_cert.p != NULL )
129 {
130 if( ( session->peer_cert = mbedtls_calloc( 1,
131 sizeof(mbedtls_x509_crt) ) ) == NULL )
132 {
133 ret = 1;
134 goto exit;
135 }
136
137 mbedtls_x509_crt_init( session->peer_cert );
138 if( mbedtls_x509_crt_parse( session->peer_cert, entry->peer_cert.p,
139 entry->peer_cert.len ) != 0 )
140 {
141 mbedtls_free( session->peer_cert );
142 session->peer_cert = NULL;
143 ret = 1;
144 goto exit;
145 }
146 }
147 #endif /* MBEDTLS_X509_CRT_PARSE_C */
148
149 ret = 0;
150 goto exit;
151 }
152
153 exit:
154 #if defined(MBEDTLS_THREADING_C)
155 if( mbedtls_mutex_unlock( &cache->mutex ) != 0 )
156 ret = 1;
157 #endif
158
159 return( ret );
160 }
161
mbedtls_ssl_cache_set(void * data,const mbedtls_ssl_session * session)162 int mbedtls_ssl_cache_set( void *data, const mbedtls_ssl_session *session )
163 {
164 int ret = 1;
165 #if defined(MBEDTLS_HAVE_TIME)
166 mbedtls_time_t t = mbedtls_time( NULL ), oldest = 0;
167 mbedtls_ssl_cache_entry *old = NULL;
168 #endif
169 mbedtls_ssl_cache_context *cache = (mbedtls_ssl_cache_context *) data;
170 mbedtls_ssl_cache_entry *cur, *prv;
171 int count = 0;
172
173 #if defined(MBEDTLS_THREADING_C)
174 if( ( ret = mbedtls_mutex_lock( &cache->mutex ) ) != 0 )
175 return( ret );
176 #endif
177
178 cur = cache->chain;
179 prv = NULL;
180
181 while( cur != NULL )
182 {
183 count++;
184
185 #if defined(MBEDTLS_HAVE_TIME)
186 if( cache->timeout != 0 &&
187 (int) ( t - cur->timestamp ) > cache->timeout )
188 {
189 cur->timestamp = t;
190 break; /* expired, reuse this slot, update timestamp */
191 }
192 #endif
193
194 if( memcmp( session->id, cur->session.id, cur->session.id_len ) == 0 )
195 break; /* client reconnected, keep timestamp for session id */
196
197 #if defined(MBEDTLS_HAVE_TIME)
198 if( oldest == 0 || cur->timestamp < oldest )
199 {
200 oldest = cur->timestamp;
201 old = cur;
202 }
203 #endif
204
205 prv = cur;
206 cur = cur->next;
207 }
208
209 if( cur == NULL )
210 {
211 #if defined(MBEDTLS_HAVE_TIME)
212 /*
213 * Reuse oldest entry if max_entries reached
214 */
215 if( count >= cache->max_entries )
216 {
217 if( old == NULL )
218 {
219 ret = 1;
220 goto exit;
221 }
222
223 cur = old;
224 }
225 #else /* MBEDTLS_HAVE_TIME */
226 /*
227 * Reuse first entry in chain if max_entries reached,
228 * but move to last place
229 */
230 if( count >= cache->max_entries )
231 {
232 if( cache->chain == NULL )
233 {
234 ret = 1;
235 goto exit;
236 }
237
238 cur = cache->chain;
239 cache->chain = cur->next;
240 cur->next = NULL;
241 prv->next = cur;
242 }
243 #endif /* MBEDTLS_HAVE_TIME */
244 else
245 {
246 /*
247 * max_entries not reached, create new entry
248 */
249 cur = mbedtls_calloc( 1, sizeof(mbedtls_ssl_cache_entry) );
250 if( cur == NULL )
251 {
252 ret = 1;
253 goto exit;
254 }
255
256 if( prv == NULL )
257 cache->chain = cur;
258 else
259 prv->next = cur;
260 }
261
262 #if defined(MBEDTLS_HAVE_TIME)
263 cur->timestamp = t;
264 #endif
265 }
266
267 memcpy( &cur->session, session, sizeof( mbedtls_ssl_session ) );
268
269 #if defined(MBEDTLS_X509_CRT_PARSE_C)
270 /*
271 * If we're reusing an entry, free its certificate first
272 */
273 if( cur->peer_cert.p != NULL )
274 {
275 mbedtls_free( cur->peer_cert.p );
276 memset( &cur->peer_cert, 0, sizeof(mbedtls_x509_buf) );
277 }
278
279 /*
280 * Store peer certificate
281 */
282 if( session->peer_cert != NULL )
283 {
284 cur->peer_cert.p = mbedtls_calloc( 1, session->peer_cert->raw.len );
285 if( cur->peer_cert.p == NULL )
286 {
287 ret = 1;
288 goto exit;
289 }
290
291 memcpy( cur->peer_cert.p, session->peer_cert->raw.p,
292 session->peer_cert->raw.len );
293 cur->peer_cert.len = session->peer_cert->raw.len;
294
295 cur->session.peer_cert = NULL;
296 }
297 #endif /* MBEDTLS_X509_CRT_PARSE_C */
298
299 ret = 0;
300
301 exit:
302 #if defined(MBEDTLS_THREADING_C)
303 if( mbedtls_mutex_unlock( &cache->mutex ) != 0 )
304 ret = 1;
305 #endif
306
307 return( ret );
308 }
309
310 #if defined(MBEDTLS_HAVE_TIME)
mbedtls_ssl_cache_set_timeout(mbedtls_ssl_cache_context * cache,int timeout)311 void mbedtls_ssl_cache_set_timeout( mbedtls_ssl_cache_context *cache, int timeout )
312 {
313 if( timeout < 0 ) timeout = 0;
314
315 cache->timeout = timeout;
316 }
317 #endif /* MBEDTLS_HAVE_TIME */
318
mbedtls_ssl_cache_set_max_entries(mbedtls_ssl_cache_context * cache,int max)319 void mbedtls_ssl_cache_set_max_entries( mbedtls_ssl_cache_context *cache, int max )
320 {
321 if( max < 0 ) max = 0;
322
323 cache->max_entries = max;
324 }
325
mbedtls_ssl_cache_free(mbedtls_ssl_cache_context * cache)326 void mbedtls_ssl_cache_free( mbedtls_ssl_cache_context *cache )
327 {
328 mbedtls_ssl_cache_entry *cur, *prv;
329
330 cur = cache->chain;
331
332 while( cur != NULL )
333 {
334 prv = cur;
335 cur = cur->next;
336
337 mbedtls_ssl_session_free( &prv->session );
338
339 #if defined(MBEDTLS_X509_CRT_PARSE_C)
340 mbedtls_free( prv->peer_cert.p );
341 #endif /* MBEDTLS_X509_CRT_PARSE_C */
342
343 mbedtls_free( prv );
344 }
345
346 #if defined(MBEDTLS_THREADING_C)
347 mbedtls_mutex_free( &cache->mutex );
348 #endif
349 cache->chain = NULL;
350 }
351
352 #endif /* MBEDTLS_SSL_CACHE_C */
353