1use pki_types::ServerName;
2
3use crate::enums::SignatureScheme;
4use crate::msgs::persist;
5use crate::sync::Arc;
6use crate::{NamedGroup, client, sign};
7
8/// An implementer of `ClientSessionStore` which does nothing.
9#[derive(Debug)]
10pub(super) struct NoClientSessionStorage;
11
12impl client::ClientSessionStore for NoClientSessionStorage {
13 fn set_kx_hint(&self, _: ServerName<'static>, _: NamedGroup) {}
14
15 fn kx_hint(&self, _: &ServerName<'_>) -> Option<NamedGroup> {
16 None
17 }
18
19 fn set_tls12_session(&self, _: ServerName<'static>, _: persist::Tls12ClientSessionValue) {}
20
21 fn tls12_session(&self, _: &ServerName<'_>) -> Option<persist::Tls12ClientSessionValue> {
22 None
23 }
24
25 fn remove_tls12_session(&self, _: &ServerName<'_>) {}
26
27 fn insert_tls13_ticket(&self, _: ServerName<'static>, _: persist::Tls13ClientSessionValue) {}
28
29 fn take_tls13_ticket(&self, _: &ServerName<'_>) -> Option<persist::Tls13ClientSessionValue> {
30 None
31 }
32}
33
34#[cfg(any(feature = "std", feature = "hashbrown"))]
35mod cache {
36 use alloc::collections::VecDeque;
37 use core::fmt;
38
39 use pki_types::ServerName;
40
41 use crate::lock::Mutex;
42 use crate::msgs::persist;
43 use crate::{NamedGroup, limited_cache};
44
45 const MAX_TLS13_TICKETS_PER_SERVER: usize = 8;
46
47 struct ServerData {
48 kx_hint: Option<NamedGroup>,
49
50 // Zero or one TLS1.2 sessions.
51 #[cfg(feature = "tls12")]
52 tls12: Option<persist::Tls12ClientSessionValue>,
53
54 // Up to MAX_TLS13_TICKETS_PER_SERVER TLS1.3 tickets, oldest first.
55 tls13: VecDeque<persist::Tls13ClientSessionValue>,
56 }
57
58 impl Default for ServerData {
59 fn default() -> Self {
60 Self {
61 kx_hint: None,
62 #[cfg(feature = "tls12")]
63 tls12: None,
64 tls13: VecDeque::with_capacity(MAX_TLS13_TICKETS_PER_SERVER),
65 }
66 }
67 }
68
69 /// An implementer of `ClientSessionStore` that stores everything
70 /// in memory.
71 ///
72 /// It enforces a limit on the number of entries to bound memory usage.
73 pub struct ClientSessionMemoryCache {
74 servers: Mutex<limited_cache::LimitedCache<ServerName<'static>, ServerData>>,
75 }
76
77 impl ClientSessionMemoryCache {
78 /// Make a new ClientSessionMemoryCache. `size` is the
79 /// maximum number of stored sessions.
80 #[cfg(feature = "std")]
81 pub fn new(size: usize) -> Self {
82 let max_servers = size.saturating_add(MAX_TLS13_TICKETS_PER_SERVER - 1)
83 / MAX_TLS13_TICKETS_PER_SERVER;
84 Self {
85 servers: Mutex::new(limited_cache::LimitedCache::new(max_servers)),
86 }
87 }
88
89 /// Make a new ClientSessionMemoryCache. `size` is the
90 /// maximum number of stored sessions.
91 #[cfg(not(feature = "std"))]
92 pub fn new<M: crate::lock::MakeMutex>(size: usize) -> Self {
93 let max_servers = size.saturating_add(MAX_TLS13_TICKETS_PER_SERVER - 1)
94 / MAX_TLS13_TICKETS_PER_SERVER;
95 Self {
96 servers: Mutex::new::<M>(limited_cache::LimitedCache::new(max_servers)),
97 }
98 }
99 }
100
101 impl super::client::ClientSessionStore for ClientSessionMemoryCache {
102 fn set_kx_hint(&self, server_name: ServerName<'static>, group: NamedGroup) {
103 self.servers
104 .lock()
105 .unwrap()
106 .get_or_insert_default_and_edit(server_name, |data| data.kx_hint = Some(group));
107 }
108
109 fn kx_hint(&self, server_name: &ServerName<'_>) -> Option<NamedGroup> {
110 self.servers
111 .lock()
112 .unwrap()
113 .get(server_name)
114 .and_then(|sd| sd.kx_hint)
115 }
116
117 fn set_tls12_session(
118 &self,
119 _server_name: ServerName<'static>,
120 _value: persist::Tls12ClientSessionValue,
121 ) {
122 #[cfg(feature = "tls12")]
123 self.servers
124 .lock()
125 .unwrap()
126 .get_or_insert_default_and_edit(_server_name.clone(), |data| {
127 data.tls12 = Some(_value)
128 });
129 }
130
131 fn tls12_session(
132 &self,
133 _server_name: &ServerName<'_>,
134 ) -> Option<persist::Tls12ClientSessionValue> {
135 #[cfg(not(feature = "tls12"))]
136 return None;
137
138 #[cfg(feature = "tls12")]
139 self.servers
140 .lock()
141 .unwrap()
142 .get(_server_name)
143 .and_then(|sd| sd.tls12.as_ref().cloned())
144 }
145
146 fn remove_tls12_session(&self, _server_name: &ServerName<'static>) {
147 #[cfg(feature = "tls12")]
148 self.servers
149 .lock()
150 .unwrap()
151 .get_mut(_server_name)
152 .and_then(|data| data.tls12.take());
153 }
154
155 fn insert_tls13_ticket(
156 &self,
157 server_name: ServerName<'static>,
158 value: persist::Tls13ClientSessionValue,
159 ) {
160 self.servers
161 .lock()
162 .unwrap()
163 .get_or_insert_default_and_edit(server_name.clone(), |data| {
164 if data.tls13.len() == data.tls13.capacity() {
165 data.tls13.pop_front();
166 }
167 data.tls13.push_back(value);
168 });
169 }
170
171 fn take_tls13_ticket(
172 &self,
173 server_name: &ServerName<'static>,
174 ) -> Option<persist::Tls13ClientSessionValue> {
175 self.servers
176 .lock()
177 .unwrap()
178 .get_mut(server_name)
179 .and_then(|data| data.tls13.pop_back())
180 }
181 }
182
183 impl fmt::Debug for ClientSessionMemoryCache {
184 fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
185 // Note: we omit self.servers as it may contain sensitive data.
186 f.debug_struct("ClientSessionMemoryCache")
187 .finish()
188 }
189 }
190}
191
192#[cfg(any(feature = "std", feature = "hashbrown"))]
193pub use cache::ClientSessionMemoryCache;
194
195#[derive(Debug)]
196pub(super) struct FailResolveClientCert {}
197
198impl client::ResolvesClientCert for FailResolveClientCert {
199 fn resolve(
200 &self,
201 _root_hint_subjects: &[&[u8]],
202 _sigschemes: &[SignatureScheme],
203 ) -> Option<Arc<sign::CertifiedKey>> {
204 None
205 }
206
207 fn has_certs(&self) -> bool {
208 false
209 }
210}
211
212/// An exemplar `ResolvesClientCert` implementation that always resolves to a single
213/// [RFC 7250] raw public key.
214///
215/// [RFC 7250]: https://tools.ietf.org/html/rfc7250
216#[derive(Clone, Debug)]
217pub struct AlwaysResolvesClientRawPublicKeys(Arc<sign::CertifiedKey>);
218impl AlwaysResolvesClientRawPublicKeys {
219 /// Create a new `AlwaysResolvesClientRawPublicKeys` instance.
220 pub fn new(certified_key: Arc<sign::CertifiedKey>) -> Self {
221 Self(certified_key)
222 }
223}
224
225impl client::ResolvesClientCert for AlwaysResolvesClientRawPublicKeys {
226 fn resolve(
227 &self,
228 _root_hint_subjects: &[&[u8]],
229 _sigschemes: &[SignatureScheme],
230 ) -> Option<Arc<sign::CertifiedKey>> {
231 Some(Arc::clone(&self.0))
232 }
233
234 fn only_raw_public_keys(&self) -> bool {
235 true
236 }
237
238 /// Returns true if the resolver is ready to present an identity.
239 ///
240 /// Even though the function is called `has_certs`, it returns true
241 /// although only an RPK (Raw Public Key) is available, not an actual certificate.
242 fn has_certs(&self) -> bool {
243 true
244 }
245}
246
247#[cfg(test)]
248#[macro_rules_attribute::apply(test_for_each_provider)]
249mod tests {
250 use std::prelude::v1::*;
251
252 use pki_types::{ServerName, UnixTime};
253
254 use super::NoClientSessionStorage;
255 use super::provider::cipher_suite;
256 use crate::client::danger::{HandshakeSignatureValid, ServerCertVerified, ServerCertVerifier};
257 use crate::client::{ClientSessionStore, ResolvesClientCert};
258 use crate::msgs::base::PayloadU16;
259 use crate::msgs::enums::NamedGroup;
260 use crate::msgs::handshake::CertificateChain;
261 #[cfg(feature = "tls12")]
262 use crate::msgs::handshake::SessionId;
263 use crate::msgs::persist::Tls13ClientSessionValue;
264 use crate::pki_types::CertificateDer;
265 use crate::suites::SupportedCipherSuite;
266 use crate::sync::Arc;
267 use crate::{DigitallySignedStruct, Error, SignatureScheme, sign};
268
269 #[test]
270 fn test_noclientsessionstorage_does_nothing() {
271 let c = NoClientSessionStorage {};
272 let name = ServerName::try_from("example.com").unwrap();
273 let now = UnixTime::now();
274 let server_cert_verifier: Arc<dyn ServerCertVerifier> = Arc::new(DummyServerCertVerifier);
275 let resolves_client_cert: Arc<dyn ResolvesClientCert> = Arc::new(DummyResolvesClientCert);
276
277 c.set_kx_hint(name.clone(), NamedGroup::X25519);
278 assert_eq!(None, c.kx_hint(&name));
279
280 #[cfg(feature = "tls12")]
281 {
282 use crate::msgs::persist::Tls12ClientSessionValue;
283 let SupportedCipherSuite::Tls12(tls12_suite) =
284 cipher_suite::TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
285 else {
286 unreachable!()
287 };
288
289 c.set_tls12_session(
290 name.clone(),
291 Tls12ClientSessionValue::new(
292 tls12_suite,
293 SessionId::empty(),
294 Arc::new(PayloadU16::empty()),
295 &[],
296 CertificateChain::default(),
297 &server_cert_verifier,
298 &resolves_client_cert,
299 now,
300 0,
301 true,
302 ),
303 );
304 assert!(c.tls12_session(&name).is_none());
305 c.remove_tls12_session(&name);
306 }
307
308 let SupportedCipherSuite::Tls13(tls13_suite) = cipher_suite::TLS13_AES_256_GCM_SHA384
309 else {
310 unreachable!();
311 };
312 c.insert_tls13_ticket(
313 name.clone(),
314 Tls13ClientSessionValue::new(
315 tls13_suite,
316 Arc::new(PayloadU16::empty()),
317 &[],
318 CertificateChain::default(),
319 &server_cert_verifier,
320 &resolves_client_cert,
321 now,
322 0,
323 0,
324 0,
325 ),
326 );
327 assert!(c.take_tls13_ticket(&name).is_none());
328 }
329
330 #[derive(Debug)]
331 struct DummyServerCertVerifier;
332
333 impl ServerCertVerifier for DummyServerCertVerifier {
334 #[cfg_attr(coverage_nightly, coverage(off))]
335 fn verify_server_cert(
336 &self,
337 _end_entity: &CertificateDer<'_>,
338 _intermediates: &[CertificateDer<'_>],
339 _server_name: &ServerName<'_>,
340 _ocsp_response: &[u8],
341 _now: UnixTime,
342 ) -> Result<ServerCertVerified, Error> {
343 unreachable!()
344 }
345
346 #[cfg_attr(coverage_nightly, coverage(off))]
347 fn verify_tls12_signature(
348 &self,
349 _message: &[u8],
350 _cert: &CertificateDer<'_>,
351 _dss: &DigitallySignedStruct,
352 ) -> Result<HandshakeSignatureValid, Error> {
353 unreachable!()
354 }
355
356 #[cfg_attr(coverage_nightly, coverage(off))]
357 fn verify_tls13_signature(
358 &self,
359 _message: &[u8],
360 _cert: &CertificateDer<'_>,
361 _dss: &DigitallySignedStruct,
362 ) -> Result<HandshakeSignatureValid, Error> {
363 unreachable!()
364 }
365
366 #[cfg_attr(coverage_nightly, coverage(off))]
367 fn supported_verify_schemes(&self) -> Vec<SignatureScheme> {
368 unreachable!()
369 }
370 }
371
372 #[derive(Debug)]
373 struct DummyResolvesClientCert;
374
375 impl ResolvesClientCert for DummyResolvesClientCert {
376 #[cfg_attr(coverage_nightly, coverage(off))]
377 fn resolve(
378 &self,
379 _root_hint_subjects: &[&[u8]],
380 _sigschemes: &[SignatureScheme],
381 ) -> Option<Arc<sign::CertifiedKey>> {
382 unreachable!()
383 }
384
385 #[cfg_attr(coverage_nightly, coverage(off))]
386 fn has_certs(&self) -> bool {
387 unreachable!()
388 }
389 }
390}
391