From 1ad46b5cd0fcac0d3224d37d555092258593eabd Mon Sep 17 00:00:00 2001
From: Roxie Linden <roxie@lindenlab.com>
Date: Mon, 24 May 2010 13:59:10 -0700
Subject: DEV-50173 - investigate certificate code performance DEV-50166 -
 LLBasicCertificateChain::validate calls in log Added caching of certificates
 that have been validated. The sha1 hash for the certificate is stored and is
 associated with the from and to times.  When the certificate is validated,
 the code determines whether the certificate has successfully been validated
 before by looking for it in the cache, and then checks the date of the cert. 
 If that is successful, the validation calls with success.

Otherwise, it proceeds to do a full validation of the certificate.
---
 indra/newview/llsechandler_basic.h | 23 ++++++++++++++++-------
 1 file changed, 16 insertions(+), 7 deletions(-)

(limited to 'indra/newview/llsechandler_basic.h')

diff --git a/indra/newview/llsechandler_basic.h b/indra/newview/llsechandler_basic.h
index 4bbb73f062..3ddd36a81a 100644
--- a/indra/newview/llsechandler_basic.h
+++ b/indra/newview/llsechandler_basic.h
@@ -59,12 +59,13 @@ public:
 	
 	virtual std::string getPem() const;
 	virtual std::vector<U8> getBinary() const;
-	virtual LLSD getLLSD() const;
+	virtual void getLLSD(LLSD &llsd);
 
 	virtual X509* getOpenSSLX509() const;
 	
 	// set llsd elements for testing
 	void setLLSD(const std::string name, const LLSD& value) { mLLSDInfo[name] = value; }
+
 protected:
 
 	// certificates are stored as X509 objects, as validation and
@@ -173,8 +174,21 @@ public:
 	// return the store id
 	virtual std::string storeId() const;
 	
+	// validate a certificate chain against a certificate store, using the
+	// given validation policy.
+	virtual void validate(int validation_policy,
+						  LLPointer<LLCertificateChain> ca_chain,
+						  const LLSD& validation_params);
+	
 protected:
-	std::vector<LLPointer<LLCertificate> >mCerts;
+	std::vector<LLPointer<LLCertificate> >            mCerts;
+	
+	// cache of cert sha1 hashes to from/to date pairs, to improve
+	// performance of cert trust.  Note, these are not the CA certs,
+	// but the certs that have been validated against this store.
+	typedef std::map<std::string, std::pair<LLDate, LLDate> > t_cert_cache;
+	t_cert_cache mTrustedCertCache;
+	
 	std::string mFilename;
 };
 
@@ -189,11 +203,6 @@ public:
 	
 	virtual ~LLBasicCertificateChain() {}
 	
-	// validate a certificate chain against a certificate store, using the
-	// given validation policy.
-	virtual void validate(int validation_policy,
-						  LLPointer<LLCertificateStore> ca_store,
-						  const LLSD& validation_params);
 };
 
 
-- 
cgit v1.2.3


From 58fb834a6ea3698ec6d89cb07e543d088dc69c00 Mon Sep 17 00:00:00 2001
From: Tofu Linden <tofu.linden@lindenlab.com>
Date: Fri, 28 May 2010 12:46:31 +0100
Subject: CID-443

Checker: FORWARD_NULL
Function: LLBasicCertificateVector::BasicIteratorImpl::equals(const LLPointer<LLCertificateVector::iterator_impl> &) const
File: /indra/newview/llsechandler_basic.h
---
 indra/newview/llsechandler_basic.h | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'indra/newview/llsechandler_basic.h')

diff --git a/indra/newview/llsechandler_basic.h b/indra/newview/llsechandler_basic.h
index 4bbb73f062..407e74ad00 100644
--- a/indra/newview/llsechandler_basic.h
+++ b/indra/newview/llsechandler_basic.h
@@ -116,6 +116,8 @@ public:
 		virtual bool equals(const LLPointer<iterator_impl>& _iter) const
 		{
 			const BasicIteratorImpl *rhs_iter = dynamic_cast<const BasicIteratorImpl *>(_iter.get());
+			llassert(rhs_iter);
+			if (!rhs_iter) return 0;
 			return (mIter == rhs_iter->mIter);
 		}
 		virtual LLPointer<LLCertificate> get()
-- 
cgit v1.2.3