blob: 4bd65c7e7d508fd21557b9fe2dd28acba0b7e295 [file] [log] [blame]
// Copyright 2019 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "net/cert/coalescing_cert_verifier.h"
#include <algorithm>
#include "base/bind.h"
#include "base/containers/linked_list.h"
#include "base/containers/unique_ptr_adapters.h"
#include "base/memory/weak_ptr.h"
#include "base/metrics/histogram_macros.h"
#include "base/strings/string_number_conversions.h"
#include "base/time/time.h"
#include "net/base/net_errors.h"
#include "net/cert/cert_verify_result.h"
#include "net/cert/crl_set.h"
#include "net/cert/pem.h"
#include "net/cert/x509_certificate_net_log_param.h"
#include "net/log/net_log_event_type.h"
#include "net/log/net_log_source.h"
#include "net/log/net_log_source_type.h"
#include "net/log/net_log_values.h"
#include "net/log/net_log_with_source.h"
namespace net {
// The CoalescingCertVerifier implements an algorithm to group multiple calls
// to Verify() into a single Job. This avoids overloading the underlying
// CertVerifier, particularly those that are expensive to talk to (e.g.
// talking to the system verifier or across processes), batching multiple
// requests to CoaleacingCertVerifier::Verify() into a single underlying call.
// However, this makes lifetime management a bit more complex.
// - The Job object represents all of the state for a single verification to
// the CoalescingCertVerifier's underlying CertVerifier.
// * It keeps the CertVerifyResult alive, which is required as long as
// there is a pending verification.
// * It keeps the CertVerify::Request to the underlying verifier alive,
// as long as there is a pending Request attached to the Job.
// * It keeps track of every CoalescingCertVerifier::Request that is
// interested in receiving notification. However, it does NOT own
// these objects, and thus needs to coordinate with the Request (via
// AddRequest/AbortRequest) to make sure it never has a stale
// pointer.
// NB: It would have also been possible for the Job to only
// hold WeakPtr<Request>s, rather than Request*, but that seemed less
// clear as to the lifetime invariants, even if it was more clear
// about how the pointers are used.
// - The Job object is always owned by the CoalescingCertVerifier. If the
// CoalescingCertVerifier is deleted, all in-flight requests to the
// underlying verifier should be cancelled. When the Job goes away, all the
// Requests will be orphaned.
// - The Request object is always owned by the CALLER. It is a handle to
// allow a caller to cancel a request, per the CertVerifier interface. If
// the Request goes away, no caller callbacks should be invoked if the Job
// it was (previously) attached to completes.
// - Per the CertVerifier interface, when the CoalescingCertVerifier is
// deleted, then regardless of there being any live Requests, none of those
// caller callbacks should be invoked.
// Finally, to add to the complexity, it's possible that, during the handling
// of a result from the underlying CertVerifier, a Job may begin dispatching
// to its Requests. The Request may delete the CoalescingCertVerifier. If that
// happens, then the Job being processed is also deleted, and none of the
// other Requests should be notified.
namespace {
base::Value CertVerifierParams(const CertVerifier::RequestParams& params) {
base::Value dict(base::Value::Type::DICTIONARY);
if (!params.ocsp_response().empty()) {
dict.SetStringPath("ocsp_response", PEMEncode(params.ocsp_response(),
if (!params.sct_list().empty()) {
PEMEncode(params.sct_list(), "NETLOG SCT LIST"));
dict.SetPath("host", NetLogStringValue(params.hostname()));
dict.SetIntPath("verifier_flags", params.flags());
return dict;
} // namespace
// Job contains all the state for a single verification using the underlying
// verifier.
class CoalescingCertVerifier::Job {
Job(CoalescingCertVerifier* parent,
const CertVerifier::RequestParams& params,
NetLog* net_log,
bool is_first_job);
const CertVerifier::RequestParams& params() const { return params_; }
const CertVerifyResult& verify_result() const { return verify_result_; }
// Attaches |request|, causing it to be notified once this Job completes.
void AddRequest(CoalescingCertVerifier::Request* request);
// Stops |request| from being notified. If there are no Requests remaining,
// the Job will be cancelled.
// NOTE: It's only necessary to call this if the Job has not yet completed.
// If the Request has been notified of completion, this should not be called.
void AbortRequest(CoalescingCertVerifier::Request* request);
// Starts a verification using |underlying_verifier|. If this completes
// synchronously, returns the result code, with the associated result being
// available via |verify_result()|. Otherwise, it will complete
// asynchronously, notifying any Requests associated via |AttachRequest|.
int Start(CertVerifier* underlying_verifier);
void OnVerifyComplete(int result);
void LogMetrics();
CoalescingCertVerifier* parent_verifier_;
const CertVerifier::RequestParams params_;
const NetLogWithSource net_log_;
bool is_first_job_ = false;
CertVerifyResult verify_result_;
base::TimeTicks start_time_;
std::unique_ptr<CertVerifier::Request> pending_request_;
base::LinkedList<CoalescingCertVerifier::Request> attached_requests_;
base::WeakPtrFactory<Job> weak_ptr_factory_{this};
// Tracks the state associated with a single CoalescingCertVerifier::Verify
// request.
// There are two ways for requests to be cancelled:
// - The caller of Verify() can delete the Request object, indicating
// they are no longer interested in this particular request.
// - The caller can delete the CoalescingCertVerifier, which should cause
// all in-process Jobs to be aborted and deleted. Any Requests attached to
// Jobs should be orphaned, and do nothing when the Request is (eventually)
// deleted.
class CoalescingCertVerifier::Request
: public base::LinkNode<CoalescingCertVerifier::Request>,
public CertVerifier::Request {
// Create a request that will be attached to |job|, and will notify
// |callback| and fill |verify_result| if the Job completes successfully.
// If the Request is deleted, or the Job is deleted, |callback| will not
// be notified.
Request(CoalescingCertVerifier::Job* job,
CertVerifyResult* verify_result,
CompletionOnceCallback callback,
const NetLogWithSource& net_log);
~Request() override;
const NetLogWithSource& net_log() const { return net_log_; }
// Called by Job to complete the requests (either successfully or as a sign
// that the underlying Job is going away).
void Complete(int result);
// Called when |job_| is being deleted, to ensure that the Request does not
// attempt to access the Job further. No callbacks will be invoked,
// consistent with the CoalescingCertVerifier's contract.
void OnJobAbort();
CoalescingCertVerifier::Job* job_;
CertVerifyResult* verify_result_;
CompletionOnceCallback callback_;
const NetLogWithSource net_log_;
CoalescingCertVerifier::Job::Job(CoalescingCertVerifier* parent,
const CertVerifier::RequestParams& params,
NetLog* net_log,
bool is_first_job)
: parent_verifier_(parent),
NetLogWithSource::Make(net_log, NetLogSourceType::CERT_VERIFIER_JOB)),
is_first_job_(is_first_job) {}
CoalescingCertVerifier::Job::~Job() {
// If there was at least one outstanding Request still pending, then this
// Job was aborted, rather than being completed normally and cleaned up.
if (!attached_requests_.empty() && pending_request_) {
while (!attached_requests_.empty()) {
auto* link_node = attached_requests_.head();
void CoalescingCertVerifier::Job::AddRequest(
CoalescingCertVerifier::Request* request) {
// There must be a pending asynchronous verification in process.
NetLogEventType::CERT_VERIFIER_REQUEST_BOUND_TO_JOB, net_log_.source());
void CoalescingCertVerifier::Job::AbortRequest(
CoalescingCertVerifier::Request* request) {
// Check to make sure |request| hasn't already been removed.
DCHECK(request->previous() || request->next());
// If there are no more pending requests, abort. This isn't strictly
// necessary; the request could be allowed to run to completion (and
// potentially to allow later Requests to join in), but in keeping with the
// idea of providing more stable guarantees about resources, clean up early.
if (attached_requests_.empty()) {
// If this was the last Request, then the Job had not yet completed; this
// matches the logic in the dtor, which handles when it's the Job that is
// deleted first, rather than the last Request.
// DANGER: This will cause |this_| to be deleted!
int CoalescingCertVerifier::Job::Start(CertVerifier* underlying_verifier) {
// Requests are only attached for asynchronous completion, so they must
// always be attached after Start() has been called.
// There should not be a pending request already started (e.g. Start called
// multiple times).
[&] { return CertVerifierParams(params_); });
start_time_ = base::TimeTicks::Now();
int result = underlying_verifier->Verify(
params_, &verify_result_,
// Safe, because |verify_request_| is self-owned and guarantees the
// callback won't be called if |this| is deleted.
&pending_request_, net_log_);
if (result != ERR_IO_PENDING) {
[&] { return verify_result_.NetLogParams(result); });
return result;
void CoalescingCertVerifier::Job::OnVerifyComplete(int result) {
pending_request_.reset(); // Reset to signal clean completion.
[&] { return verify_result_.NetLogParams(result); });
// It's possible that during the process of invoking a callback for a
// Request, |this| may get deleted (along with the associated parent). If
// that happens, it's important to ensure that processing of the Job is
// stopped - i.e. no other callbacks are invoked for other Requests, nor is
// |this| accessed.
// To help detect and protect against this, a WeakPtr to |this| is taken. If
// |this| is deleted, the destructor will have invalidated the WeakPtr.
// Note that if a Job had already been deleted, this method would not have
// been invoked in the first place, as the Job (via |pending_request_|) owns
// the underlying CertVerifier::Request that this method was bound to as a
// callback. This is why it's OK to grab the WeakPtr from |this| initially.
base::WeakPtr<Job> weak_this = weak_ptr_factory_.GetWeakPtr();
while (!attached_requests_.empty()) {
// Note: It's also possible for additional Requests to be attached to the
// current Job while processing a Request.
auto* link_node = attached_requests_.head();
// Note: |this| MAY be deleted here.
// - If the CoalescingCertVerifier is deleted, it will delete the
// Jobs (including |this|)
// - If this is the second-to-last Request, and the completion of this
// event causes the other Request to be deleted, detaching that Request
// from this Job will lead to this Job being deleted (via
// Job::AbortRequest())
// Check if |this| has been deleted (which implicitly includes
// |parent_verifier_|), and abort if so, since no further cleanup is
// needed.
if (!weak_this)
// DANGER: |this| will be invalidated (deleted) after this point.
return parent_verifier_->RemoveJob(this);
void CoalescingCertVerifier::Job::LogMetrics() {
base::TimeDelta latency = base::TimeTicks::Now() - start_time_;
UMA_HISTOGRAM_CUSTOM_TIMES("Net.CertVerifier_Job_Latency", latency,
base::TimeDelta::FromMinutes(10), 100);
if (is_first_job_) {
UMA_HISTOGRAM_CUSTOM_TIMES("Net.CertVerifier_First_Job_Latency", latency,
base::TimeDelta::FromMinutes(10), 100);
CoalescingCertVerifier::Request::Request(CoalescingCertVerifier::Job* job,
CertVerifyResult* verify_result,
CompletionOnceCallback callback,
const NetLogWithSource& net_log)
: job_(job),
net_log_(net_log) {
CoalescingCertVerifier::Request::~Request() {
if (job_) {
// If the Request is deleted before the Job, then detach from the Job.
// Note: This may cause |job_| to be deleted.
job_ = nullptr;
void CoalescingCertVerifier::Request::Complete(int result) {
DCHECK(job_); // There must be a pending/non-aborted job to complete.
*verify_result_ = job_->verify_result();
// On successful completion, the Job removes the Request from its set;
// similarly, break the association here so that when the Request is
// deleted, it does not try to abort the (now-completed) Job.
job_ = nullptr;
// Run |callback_|, which may delete |this|.
void CoalescingCertVerifier::Request::OnJobAbort() {
DCHECK(job_); // There must be a pending job to abort.
// If the Job is deleted before the Request, just clean up. The Request will
// eventually be deleted by the caller.
job_ = nullptr;
// Note: May delete |this|, if the caller made |callback_| own the Request.
std::unique_ptr<CertVerifier> verifier)
: verifier_(std::move(verifier)),
inflight_joins_(0) {}
CoalescingCertVerifier::~CoalescingCertVerifier() = default;
int CoalescingCertVerifier::Verify(
const RequestParams& params,
CertVerifyResult* verify_result,
CompletionOnceCallback callback,
std::unique_ptr<CertVerifier::Request>* out_req,
const NetLogWithSource& net_log) {
Job* job = FindJob(params);
if (job) {
// An identical request is in-flight and joinable, so just attach the
// callback.
} else {
// No existing Jobs can be used. Create and start a new one.
std::unique_ptr<Job> new_job =
std::make_unique<Job>(this, params, net_log.net_log(), requests_ == 1);
int result = new_job->Start(verifier_.get());
if (result != ERR_IO_PENDING) {
*verify_result = new_job->verify_result();
return result;
job = new_job.get();
joinable_jobs_[params] = std::move(new_job);
std::unique_ptr<CoalescingCertVerifier::Request> request =
job, verify_result, std::move(callback), net_log);
*out_req = std::move(request);
void CoalescingCertVerifier::SetConfig(const CertVerifier::Config& config) {
for (auto& job : joinable_jobs_) {
CoalescingCertVerifier::Job* CoalescingCertVerifier::FindJob(
const RequestParams& params) {
auto it = joinable_jobs_.find(params);
if (it != joinable_jobs_.end())
return it->second.get();
return nullptr;
void CoalescingCertVerifier::RemoveJob(Job* job) {
// See if this was a job from the current configuration generation.
// Note: It's also necessary to compare that the underlying pointer is the
// same, and not merely a Job with the same parameters.
auto joinable_it = joinable_jobs_.find(job->params());
if (joinable_it != joinable_jobs_.end() && joinable_it->second.get() == job) {
// Otherwise, it MUST have been a job from a previous generation.
auto inflight_it = std::find_if(inflight_jobs_.begin(), inflight_jobs_.end(),
DCHECK(inflight_it != inflight_jobs_.end());
} // namespace net