blob: 1c285ec3c3a120ee3d050d715a3121ea15c446b0 [file] [log] [blame]
Paul Bakker0a597072012-09-25 21:55:46 +00001/*
2 * SSL session cache implementation
3 *
Bence Szépkúti1e148272020-08-07 13:07:28 +02004 * Copyright The Mbed TLS Contributors
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +02005 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
Paul Bakker0a597072012-09-25 21:55:46 +000018 */
19/*
20 * These session callbacks use a simple chained list
21 * to store and retrieve the session information.
22 */
23
Gilles Peskinedb09ef62020-06-03 01:43:33 +020024#include "common.h"
Paul Bakker0a597072012-09-25 21:55:46 +000025
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020026#if defined(MBEDTLS_SSL_CACHE_C)
Paul Bakker0a597072012-09-25 21:55:46 +000027
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000028#include "mbedtls/platform.h"
Paul Bakker6e339b52013-07-03 13:37:05 +020029
SimonBd5800b72016-04-26 07:43:27 +010030#include "mbedtls/ssl_cache.h"
Chris Jones84a773f2021-03-05 18:38:47 +000031#include "ssl_misc.h"
Pengyu Lvb1895892023-03-16 11:38:43 +080032#include "mbedtls/error.h"
SimonBd5800b72016-04-26 07:43:27 +010033
34#include <string.h>
35
Gilles Peskine449bd832023-01-11 14:50:10 +010036void mbedtls_ssl_cache_init(mbedtls_ssl_cache_context *cache)
Paul Bakker0a597072012-09-25 21:55:46 +000037{
Gilles Peskine449bd832023-01-11 14:50:10 +010038 memset(cache, 0, sizeof(mbedtls_ssl_cache_context));
Paul Bakker0a597072012-09-25 21:55:46 +000039
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020040 cache->timeout = MBEDTLS_SSL_CACHE_DEFAULT_TIMEOUT;
41 cache->max_entries = MBEDTLS_SSL_CACHE_DEFAULT_MAX_ENTRIES;
Paul Bakkerc5598842013-09-28 15:01:27 +020042
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020043#if defined(MBEDTLS_THREADING_C)
Gilles Peskine449bd832023-01-11 14:50:10 +010044 mbedtls_mutex_init(&cache->mutex);
Paul Bakkerc5598842013-09-28 15:01:27 +020045#endif
Paul Bakker0a597072012-09-25 21:55:46 +000046}
47
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +020048MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +010049static int ssl_cache_find_entry(mbedtls_ssl_cache_context *cache,
50 unsigned char const *session_id,
51 size_t session_id_len,
52 mbedtls_ssl_cache_entry **dst)
Hanno Beckerf938c432021-04-15 10:17:53 +010053{
Pengyu Lve3746d72023-04-10 14:40:03 +080054 int ret = MBEDTLS_ERR_SSL_CACHE_ENTRY_NOT_FOUND;
Hanno Beckerf938c432021-04-15 10:17:53 +010055#if defined(MBEDTLS_HAVE_TIME)
Gilles Peskine449bd832023-01-11 14:50:10 +010056 mbedtls_time_t t = mbedtls_time(NULL);
Hanno Beckerf938c432021-04-15 10:17:53 +010057#endif
58 mbedtls_ssl_cache_entry *cur;
59
Gilles Peskine449bd832023-01-11 14:50:10 +010060 for (cur = cache->chain; cur != NULL; cur = cur->next) {
Hanno Beckerf938c432021-04-15 10:17:53 +010061#if defined(MBEDTLS_HAVE_TIME)
Gilles Peskine449bd832023-01-11 14:50:10 +010062 if (cache->timeout != 0 &&
63 (int) (t - cur->timestamp) > cache->timeout) {
Hanno Beckerf938c432021-04-15 10:17:53 +010064 continue;
Gilles Peskine449bd832023-01-11 14:50:10 +010065 }
Hanno Beckerf938c432021-04-15 10:17:53 +010066#endif
67
Gilles Peskine449bd832023-01-11 14:50:10 +010068 if (session_id_len != cur->session_id_len ||
69 memcmp(session_id, cur->session_id,
70 cur->session_id_len) != 0) {
Hanno Beckerf938c432021-04-15 10:17:53 +010071 continue;
72 }
73
74 break;
75 }
76
Gilles Peskine449bd832023-01-11 14:50:10 +010077 if (cur != NULL) {
Hanno Beckerf938c432021-04-15 10:17:53 +010078 *dst = cur;
79 ret = 0;
80 }
81
Gilles Peskine449bd832023-01-11 14:50:10 +010082 return ret;
Hanno Beckerf938c432021-04-15 10:17:53 +010083}
84
85
Gilles Peskine449bd832023-01-11 14:50:10 +010086int mbedtls_ssl_cache_get(void *data,
87 unsigned char const *session_id,
88 size_t session_id_len,
89 mbedtls_ssl_session *session)
Paul Bakker0a597072012-09-25 21:55:46 +000090{
Pengyu Lv5038a382023-03-23 15:49:52 +080091 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020092 mbedtls_ssl_cache_context *cache = (mbedtls_ssl_cache_context *) data;
Hanno Beckerf938c432021-04-15 10:17:53 +010093 mbedtls_ssl_cache_entry *entry;
Paul Bakker0a597072012-09-25 21:55:46 +000094
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020095#if defined(MBEDTLS_THREADING_C)
Pengyu Lv0b9c0122023-03-15 14:37:32 +080096 if ((ret = mbedtls_mutex_lock(&cache->mutex)) != 0) {
97 return ret;
Gilles Peskine449bd832023-01-11 14:50:10 +010098 }
Paul Bakkerc5598842013-09-28 15:01:27 +020099#endif
100
Gilles Peskine449bd832023-01-11 14:50:10 +0100101 ret = ssl_cache_find_entry(cache, session_id, session_id_len, &entry);
102 if (ret != 0) {
Hanno Beckerf938c432021-04-15 10:17:53 +0100103 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +0100104 }
Paul Bakker0a597072012-09-25 21:55:46 +0000105
Gilles Peskine449bd832023-01-11 14:50:10 +0100106 ret = mbedtls_ssl_session_load(session,
107 entry->session,
108 entry->session_len);
109 if (ret != 0) {
Hanno Beckerf938c432021-04-15 10:17:53 +0100110 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +0100111 }
Hanno Beckerf938c432021-04-15 10:17:53 +0100112
Hanno Beckerf938c432021-04-15 10:17:53 +0100113 ret = 0;
Paul Bakker0a597072012-09-25 21:55:46 +0000114
Paul Bakkerc5598842013-09-28 15:01:27 +0200115exit:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200116#if defined(MBEDTLS_THREADING_C)
Gilles Peskine449bd832023-01-11 14:50:10 +0100117 if (mbedtls_mutex_unlock(&cache->mutex) != 0) {
Pengyu Lv0b9c0122023-03-15 14:37:32 +0800118 ret = MBEDTLS_ERR_THREADING_MUTEX_ERROR;
Gilles Peskine449bd832023-01-11 14:50:10 +0100119 }
Paul Bakkerc5598842013-09-28 15:01:27 +0200120#endif
121
Gilles Peskine449bd832023-01-11 14:50:10 +0100122 return ret;
Paul Bakker0a597072012-09-25 21:55:46 +0000123}
124
Pengyu Lv744b5072023-03-15 12:17:14 +0800125/* zeroize a cache entry */
126static void ssl_cache_entry_zeroize(mbedtls_ssl_cache_entry *entry)
127{
128 if (entry == NULL) {
129 return;
130 }
131
132 /* zeroize and free session structure */
133 if (entry->session != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +0100134 mbedtls_zeroize_and_free(entry->session, entry->session_len);
Pengyu Lv744b5072023-03-15 12:17:14 +0800135 }
136
137 /* zeroize the whole entry structure */
138 mbedtls_platform_zeroize(entry, sizeof(mbedtls_ssl_cache_entry));
139}
140
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200141MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +0100142static int ssl_cache_pick_writing_slot(mbedtls_ssl_cache_context *cache,
143 unsigned char const *session_id,
144 size_t session_id_len,
145 mbedtls_ssl_cache_entry **dst)
Paul Bakker0a597072012-09-25 21:55:46 +0000146{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200147#if defined(MBEDTLS_HAVE_TIME)
Gilles Peskine449bd832023-01-11 14:50:10 +0100148 mbedtls_time_t t = mbedtls_time(NULL), oldest = 0;
Hanno Becker006f2cc2021-05-14 04:55:35 +0100149#endif /* MBEDTLS_HAVE_TIME */
150
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200151 mbedtls_ssl_cache_entry *old = NULL;
Paul Bakkerba26e9e2012-10-23 22:18:28 +0000152 int count = 0;
Hanno Becker466ed6f2021-05-14 14:54:00 +0100153 mbedtls_ssl_cache_entry *cur, *last;
Paul Bakkerc5598842013-09-28 15:01:27 +0200154
Hanno Becker845ceb72021-05-13 07:05:07 +0100155 /* Check 1: Is there already an entry with the given session ID?
156 *
157 * If yes, overwrite it.
158 *
159 * If not, `count` will hold the size of the session cache
Hanno Becker466ed6f2021-05-14 14:54:00 +0100160 * at the end of this loop, and `last` will point to the last
Hanno Becker845ceb72021-05-13 07:05:07 +0100161 * entry, both of which will be used later. */
162
Hanno Becker78196e32021-05-14 14:45:38 +0100163 last = NULL;
Gilles Peskine449bd832023-01-11 14:50:10 +0100164 for (cur = cache->chain; cur != NULL; cur = cur->next) {
Paul Bakkerba26e9e2012-10-23 22:18:28 +0000165 count++;
Gilles Peskine449bd832023-01-11 14:50:10 +0100166 if (session_id_len == cur->session_id_len &&
167 memcmp(session_id, cur->session_id, cur->session_id_len) == 0) {
Hanno Becker845ceb72021-05-13 07:05:07 +0100168 goto found;
Hanno Beckerccdaf6e2021-04-15 09:26:17 +0100169 }
Hanno Becker78196e32021-05-14 14:45:38 +0100170 last = cur;
Paul Bakker0a597072012-09-25 21:55:46 +0000171 }
172
Hanno Becker845ceb72021-05-13 07:05:07 +0100173 /* Check 2: Is there an outdated entry in the cache?
174 *
175 * If so, overwrite it.
176 *
177 * If not, remember the oldest entry in `old` for later.
178 */
179
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200180#if defined(MBEDTLS_HAVE_TIME)
Gilles Peskine449bd832023-01-11 14:50:10 +0100181 for (cur = cache->chain; cur != NULL; cur = cur->next) {
182 if (cache->timeout != 0 &&
183 (int) (t - cur->timestamp) > cache->timeout) {
Hanno Becker845ceb72021-05-13 07:05:07 +0100184 goto found;
Paul Bakkerba26e9e2012-10-23 22:18:28 +0000185 }
Hanno Becker845ceb72021-05-13 07:05:07 +0100186
Gilles Peskine449bd832023-01-11 14:50:10 +0100187 if (oldest == 0 || cur->timestamp < oldest) {
Hanno Becker845ceb72021-05-13 07:05:07 +0100188 oldest = cur->timestamp;
189 old = cur;
Paul Bakkerfa9b1002013-07-03 15:31:03 +0200190 }
Hanno Becker845ceb72021-05-13 07:05:07 +0100191 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200192#endif /* MBEDTLS_HAVE_TIME */
Paul Bakkerba26e9e2012-10-23 22:18:28 +0000193
Hanno Becker845ceb72021-05-13 07:05:07 +0100194 /* Check 3: Is there free space in the cache? */
195
Gilles Peskine449bd832023-01-11 14:50:10 +0100196 if (count < cache->max_entries) {
Hanno Becker845ceb72021-05-13 07:05:07 +0100197 /* Create new entry */
Gilles Peskine449bd832023-01-11 14:50:10 +0100198 cur = mbedtls_calloc(1, sizeof(mbedtls_ssl_cache_entry));
199 if (cur == NULL) {
Pengyu Lv5038a382023-03-23 15:49:52 +0800200 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
Gilles Peskine449bd832023-01-11 14:50:10 +0100201 }
Hanno Becker845ceb72021-05-13 07:05:07 +0100202
203 /* Append to the end of the linked list. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100204 if (last == NULL) {
Hanno Becker845ceb72021-05-13 07:05:07 +0100205 cache->chain = cur;
Gilles Peskine449bd832023-01-11 14:50:10 +0100206 } else {
Hanno Becker466ed6f2021-05-14 14:54:00 +0100207 last->next = cur;
Gilles Peskine449bd832023-01-11 14:50:10 +0100208 }
Hanno Becker845ceb72021-05-13 07:05:07 +0100209
210 goto found;
211 }
212
213 /* Last resort: The cache is full and doesn't contain any outdated
214 * elements. In this case, we evict the oldest one, judged by timestamp
215 * (if present) or cache-order. */
Paul Bakker0a597072012-09-25 21:55:46 +0000216
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200217#if defined(MBEDTLS_HAVE_TIME)
Gilles Peskine449bd832023-01-11 14:50:10 +0100218 if (old == NULL) {
Hanno Becker845ceb72021-05-13 07:05:07 +0100219 /* This should only happen on an ill-configured cache
220 * with max_entries == 0. */
Pengyu Lv5038a382023-03-23 15:49:52 +0800221 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
Hanno Becker845ceb72021-05-13 07:05:07 +0100222 }
223#else /* MBEDTLS_HAVE_TIME */
224 /* Reuse first entry in chain, but move to last place. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100225 if (cache->chain == NULL) {
Pengyu Lv5038a382023-03-23 15:49:52 +0800226 /* This should never happen */
227 return MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskine449bd832023-01-11 14:50:10 +0100228 }
Hanno Becker02a68eb2021-04-15 09:57:17 +0100229
Hanno Becker845ceb72021-05-13 07:05:07 +0100230 old = cache->chain;
231 cache->chain = old->next;
Hanno Becker5cf6f7e2021-05-14 14:45:04 +0100232 old->next = NULL;
Hanno Becker466ed6f2021-05-14 14:54:00 +0100233 last->next = old;
Hanno Becker845ceb72021-05-13 07:05:07 +0100234#endif /* MBEDTLS_HAVE_TIME */
Hanno Becker02a68eb2021-04-15 09:57:17 +0100235
Hanno Becker845ceb72021-05-13 07:05:07 +0100236 /* Now `old` points to the oldest entry to be overwritten. */
237 cur = old;
238
239found:
240
Pengyu Lv744b5072023-03-15 12:17:14 +0800241 /* If we're reusing an entry, free it first. */
242 if (cur->session != NULL) {
243 /* `ssl_cache_entry_zeroize` would break the chain,
244 * so we reuse `old` to record `next` temporarily. */
245 old = cur->next;
246 ssl_cache_entry_zeroize(cur);
247 cur->next = old;
248 }
249
Hanno Becker845ceb72021-05-13 07:05:07 +0100250#if defined(MBEDTLS_HAVE_TIME)
251 cur->timestamp = t;
252#endif
253
Hanno Becker845ceb72021-05-13 07:05:07 +0100254 *dst = cur;
Gilles Peskine449bd832023-01-11 14:50:10 +0100255 return 0;
Hanno Becker02a68eb2021-04-15 09:57:17 +0100256}
257
Gilles Peskine449bd832023-01-11 14:50:10 +0100258int mbedtls_ssl_cache_set(void *data,
259 unsigned char const *session_id,
260 size_t session_id_len,
261 const mbedtls_ssl_session *session)
Hanno Becker02a68eb2021-04-15 09:57:17 +0100262{
Pengyu Lv5038a382023-03-23 15:49:52 +0800263 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Becker02a68eb2021-04-15 09:57:17 +0100264 mbedtls_ssl_cache_context *cache = (mbedtls_ssl_cache_context *) data;
265 mbedtls_ssl_cache_entry *cur;
266
Hanno Becker7e6eb9f2021-04-15 10:26:06 +0100267 size_t session_serialized_len;
268 unsigned char *session_serialized = NULL;
269
Hanno Becker02a68eb2021-04-15 09:57:17 +0100270#if defined(MBEDTLS_THREADING_C)
Gilles Peskine449bd832023-01-11 14:50:10 +0100271 if ((ret = mbedtls_mutex_lock(&cache->mutex)) != 0) {
272 return ret;
273 }
Hanno Becker02a68eb2021-04-15 09:57:17 +0100274#endif
275
Gilles Peskine449bd832023-01-11 14:50:10 +0100276 ret = ssl_cache_pick_writing_slot(cache,
277 session_id, session_id_len,
278 &cur);
279 if (ret != 0) {
Hanno Becker02a68eb2021-04-15 09:57:17 +0100280 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +0100281 }
Manuel Pégourié-Gonnard84c30c72014-02-26 17:38:55 +0100282
Hanno Becker7e6eb9f2021-04-15 10:26:06 +0100283 /* Check how much space we need to serialize the session
284 * and allocate a sufficiently large buffer. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100285 ret = mbedtls_ssl_session_save(session, NULL, 0, &session_serialized_len);
286 if (ret != MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL) {
Hanno Beckeraee87172019-02-06 14:53:19 +0000287 goto exit;
288 }
289
Gilles Peskine449bd832023-01-11 14:50:10 +0100290 session_serialized = mbedtls_calloc(1, session_serialized_len);
291 if (session_serialized == NULL) {
Hanno Becker7e6eb9f2021-04-15 10:26:06 +0100292 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
293 goto exit;
Paul Bakkere81beda2013-03-06 17:40:46 +0100294 }
Hanno Becker7e6eb9f2021-04-15 10:26:06 +0100295
296 /* Now serialize the session into the allocated buffer. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100297 ret = mbedtls_ssl_session_save(session,
298 session_serialized,
299 session_serialized_len,
300 &session_serialized_len);
301 if (ret != 0) {
Hanno Becker7e6eb9f2021-04-15 10:26:06 +0100302 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +0100303 }
Hanno Becker7e6eb9f2021-04-15 10:26:06 +0100304
Gilles Peskine449bd832023-01-11 14:50:10 +0100305 if (session_id_len > sizeof(cur->session_id)) {
Pengyu Lv5038a382023-03-23 15:49:52 +0800306 ret = MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
Hanno Becker7e6eb9f2021-04-15 10:26:06 +0100307 goto exit;
308 }
309 cur->session_id_len = session_id_len;
Gilles Peskine449bd832023-01-11 14:50:10 +0100310 memcpy(cur->session_id, session_id, session_id_len);
Hanno Becker7e6eb9f2021-04-15 10:26:06 +0100311
312 cur->session = session_serialized;
313 cur->session_len = session_serialized_len;
314 session_serialized = NULL;
Paul Bakker0a597072012-09-25 21:55:46 +0000315
Paul Bakkerc5598842013-09-28 15:01:27 +0200316 ret = 0;
317
318exit:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200319#if defined(MBEDTLS_THREADING_C)
Gilles Peskine449bd832023-01-11 14:50:10 +0100320 if (mbedtls_mutex_unlock(&cache->mutex) != 0) {
Pengyu Lv0b9c0122023-03-15 14:37:32 +0800321 ret = MBEDTLS_ERR_THREADING_MUTEX_ERROR;
Gilles Peskine449bd832023-01-11 14:50:10 +0100322 }
Paul Bakkerc5598842013-09-28 15:01:27 +0200323#endif
324
Gilles Peskine449bd832023-01-11 14:50:10 +0100325 if (session_serialized != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +0100326 mbedtls_zeroize_and_free(session_serialized, session_serialized_len);
Leonid Rozenboim116f50c2022-04-21 13:05:10 -0700327 session_serialized = NULL;
328 }
Hanno Becker7e6eb9f2021-04-15 10:26:06 +0100329
Gilles Peskine449bd832023-01-11 14:50:10 +0100330 return ret;
Paul Bakker0a597072012-09-25 21:55:46 +0000331}
332
Pengyu Lv7b6299b2023-03-07 14:38:45 +0800333int mbedtls_ssl_cache_remove(void *data,
334 unsigned char const *session_id,
335 size_t session_id_len)
336{
Pengyu Lv5038a382023-03-23 15:49:52 +0800337 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Pengyu Lv7b6299b2023-03-07 14:38:45 +0800338 mbedtls_ssl_cache_context *cache = (mbedtls_ssl_cache_context *) data;
339 mbedtls_ssl_cache_entry *entry;
340 mbedtls_ssl_cache_entry *prev;
341
342#if defined(MBEDTLS_THREADING_C)
Pengyu Lv0b9c0122023-03-15 14:37:32 +0800343 if ((ret = mbedtls_mutex_lock(&cache->mutex)) != 0) {
344 return ret;
Pengyu Lv7b6299b2023-03-07 14:38:45 +0800345 }
346#endif
347
348 ret = ssl_cache_find_entry(cache, session_id, session_id_len, &entry);
349 /* No valid entry found, exit with success */
350 if (ret != 0) {
351 ret = 0;
352 goto exit;
353 }
354
355 /* Now we remove the entry from the chain */
356 if (entry == cache->chain) {
357 cache->chain = entry->next;
358 goto free;
359 }
360 for (prev = cache->chain; prev->next != NULL; prev = prev->next) {
361 if (prev->next == entry) {
362 prev->next = entry->next;
363 break;
364 }
365 }
366
367free:
Pengyu Lv744b5072023-03-15 12:17:14 +0800368 ssl_cache_entry_zeroize(entry);
Pengyu Lv7b6299b2023-03-07 14:38:45 +0800369 mbedtls_free(entry);
370 ret = 0;
371
372exit:
373#if defined(MBEDTLS_THREADING_C)
374 if (mbedtls_mutex_unlock(&cache->mutex) != 0) {
Pengyu Lv0b9c0122023-03-15 14:37:32 +0800375 ret = MBEDTLS_ERR_THREADING_MUTEX_ERROR;
Pengyu Lv7b6299b2023-03-07 14:38:45 +0800376 }
377#endif
378
379 return ret;
380}
381
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200382#if defined(MBEDTLS_HAVE_TIME)
Gilles Peskine449bd832023-01-11 14:50:10 +0100383void mbedtls_ssl_cache_set_timeout(mbedtls_ssl_cache_context *cache, int timeout)
Paul Bakker0a597072012-09-25 21:55:46 +0000384{
Gilles Peskine449bd832023-01-11 14:50:10 +0100385 if (timeout < 0) {
386 timeout = 0;
387 }
Paul Bakker0a597072012-09-25 21:55:46 +0000388
389 cache->timeout = timeout;
390}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200391#endif /* MBEDTLS_HAVE_TIME */
Paul Bakker0a597072012-09-25 21:55:46 +0000392
Gilles Peskine449bd832023-01-11 14:50:10 +0100393void mbedtls_ssl_cache_set_max_entries(mbedtls_ssl_cache_context *cache, int max)
Paul Bakkerba26e9e2012-10-23 22:18:28 +0000394{
Gilles Peskine449bd832023-01-11 14:50:10 +0100395 if (max < 0) {
396 max = 0;
397 }
Paul Bakkerba26e9e2012-10-23 22:18:28 +0000398
399 cache->max_entries = max;
400}
401
Gilles Peskine449bd832023-01-11 14:50:10 +0100402void mbedtls_ssl_cache_free(mbedtls_ssl_cache_context *cache)
Paul Bakker0a597072012-09-25 21:55:46 +0000403{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200404 mbedtls_ssl_cache_entry *cur, *prv;
Paul Bakker0a597072012-09-25 21:55:46 +0000405
406 cur = cache->chain;
407
Gilles Peskine449bd832023-01-11 14:50:10 +0100408 while (cur != NULL) {
Paul Bakker0a597072012-09-25 21:55:46 +0000409 prv = cur;
410 cur = cur->next;
411
Pengyu Lv744b5072023-03-15 12:17:14 +0800412 ssl_cache_entry_zeroize(prv);
Gilles Peskine449bd832023-01-11 14:50:10 +0100413 mbedtls_free(prv);
Paul Bakker0a597072012-09-25 21:55:46 +0000414 }
Paul Bakkerc5598842013-09-28 15:01:27 +0200415
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200416#if defined(MBEDTLS_THREADING_C)
Gilles Peskine449bd832023-01-11 14:50:10 +0100417 mbedtls_mutex_free(&cache->mutex);
Paul Bakkerc5598842013-09-28 15:01:27 +0200418#endif
Ron Eldor22360822017-10-29 17:53:52 +0200419 cache->chain = NULL;
Paul Bakker0a597072012-09-25 21:55:46 +0000420}
421
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200422#endif /* MBEDTLS_SSL_CACHE_C */