tls: refactor cipher_suites to be shared_ptr instead of copied strings (#44793)

Refactoring the cipher_suites in the TLS `ContextConfigImpl` object, so
that if there are multiple TLS objects with the same `cipher_suites`
these will be shared instead of copied.
The PR introduces a SharedObjectPool of the cipher_suites strings, that
the `ContextConfigImpl` have shared-pointers to.

Signed-off-by: Adi Suissa-Peleg <adip@google.com>

Author: adisuissa

source/common/tls/context_config_impl.cc

@@ -13,6 +13,7 @@
 #include "source/common/protobuf/message_validator_impl.h"
 #include "source/common/protobuf/utility.h"
 #include "source/common/secret/sds_api.h"
+#include "source/common/shared_pool/shared_pool.h"
 #include "source/common/ssl/certificate_validation_context_config_impl.h"
 #include "source/common/tls/ssl_handshaker.h"
 
@@ -24,6 +25,8 @@ namespace Extensions {
 namespace TransportSockets {
 namespace Tls {
 
+SINGLETON_MANAGER_REGISTRATION(cipher_suites_pool);
+
 namespace {
 
 std::string generateCertificateHash(const std::string& cert_data) {
@@ -179,6 +182,14 @@ compliancePolicyFromProto(
   }
 }
 
+std::shared_ptr<SharedPool::ObjectSharedPool<std::string>>
+getCipherSuitesPool(Singleton::Manager& singleton_manager, Event::Dispatcher& dispatcher) {
+  return singleton_manager.getTyped<SharedPool::ObjectSharedPool<std::string>>(
+      SINGLETON_MANAGER_REGISTERED_NAME(cipher_suites_pool), [&dispatcher] {
+        return std::make_shared<SharedPool::ObjectSharedPool<std::string>>(dispatcher);
+      });
+}
+
 } // namespace
 
 ContextConfigImpl::ContextConfigImpl(
@@ -194,8 +205,12 @@ ContextConfigImpl::ContextConfigImpl(
       lifecycle_notifier_(factory_context.serverFactoryContext().lifecycleNotifier()),
       auto_sni_san_match_(auto_sni_san_match),
       alpn_protocols_(RepeatedPtrUtil::join(config.alpn_protocols(), ",")),
-      cipher_suites_(StringUtil::nonEmptyStringOrDefault(
-          RepeatedPtrUtil::join(config.tls_params().cipher_suites(), ":"), default_cipher_suites)),
+      cipher_suites_(
+          getCipherSuitesPool(factory_context.serverFactoryContext().singletonManager(),
+                              factory_context.serverFactoryContext().mainThreadDispatcher())
+              ->getObject(StringUtil::nonEmptyStringOrDefault(
+                  RepeatedPtrUtil::join(config.tls_params().cipher_suites(), ":"),
+                  default_cipher_suites))),
       ecdh_curves_(StringUtil::nonEmptyStringOrDefault(
           RepeatedPtrUtil::join(config.tls_params().ecdh_curves(), ":"), default_curves)),
       signature_algorithms_(RepeatedPtrUtil::join(config.tls_params().signature_algorithms(), ":")),

source/common/tls/context_config_impl.h

@@ -1,5 +1,6 @@
 #pragma once
 
+#include <memory>
 #include <string>
 #include <vector>
 
@@ -35,7 +36,7 @@ class ContextConfigImpl : public virtual Ssl::ContextConfig,
 public:
   // Ssl::ContextConfig
   const std::string& alpnProtocols() const override { return alpn_protocols_; }
-  const std::string& cipherSuites() const override { return cipher_suites_; }
+  const std::string& cipherSuites() const override { return *cipher_suites_; }
   const std::string& ecdhCurves() const override { return ecdh_curves_; }
   const std::string& signatureAlgorithms() const override { return signature_algorithms_; }
   absl::optional<envoy::extensions::transport_sockets::tls::v3::TlsParameters::CompliancePolicy>
@@ -104,7 +105,7 @@ class ContextConfigImpl : public virtual Ssl::ContextConfig,
       unsigned default_version);
 
   const std::string alpn_protocols_;
-  const std::string cipher_suites_;
+  const std::shared_ptr<const std::string> cipher_suites_;
   const std::string ecdh_curves_;
   const std::string signature_algorithms_;
 

test/common/tls/context_impl_test.cc

@@ -148,6 +148,30 @@ TEST_F(SslContextImplTest, TestCipherSuites) {
             "ciphers were rejected when tried individually: BOGUS1-SHA256, BOGUS2-SHA");
 }
 
+// Validates that multiple cipher-suites with the same contents are still equal
+// after dedup.
+TEST_F(SslContextImplTest, TestCipherSuitesDeduplication) {
+  const std::string yaml = R"EOF(
+  common_tls_context:
+    tls_params:
+      cipher_suites: "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256"
+  )EOF";
+
+  envoy::extensions::transport_sockets::tls::v3::UpstreamTlsContext tls_context1;
+  TestUtility::loadFromYaml(TestEnvironment::substitute(yaml), tls_context1);
+  auto cfg1 = *ClientContextConfigImpl::create(tls_context1, factory_context_);
+
+  envoy::extensions::transport_sockets::tls::v3::UpstreamTlsContext tls_context2;
+  TestUtility::loadFromYaml(TestEnvironment::substitute(yaml), tls_context2);
+  auto cfg2 = *ClientContextConfigImpl::create(tls_context2, factory_context_);
+
+  EXPECT_EQ(cfg1->cipherSuites(), "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256");
+  EXPECT_EQ(cfg2->cipherSuites(), "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256");
+
+  EXPECT_TRUE(manager_.createSslClientContext(*store_.rootScope(), *cfg1).ok());
+  EXPECT_TRUE(manager_.createSslClientContext(*store_.rootScope(), *cfg2).ok());
+}
+
 // Envoy's default cipher preference is server's.
 TEST_F(SslContextImplTest, TestServerCipherPreference) {
   const std::string yaml = R"EOF(