Revert changes in rev.14726

diff --git a/src/CachePeer.cc b/src/CachePeer.cc
index 964948ad5b15e3df0d6e2db69f84b6ce0b299f74..fac6a3e5ba1da99042476ce452b7db4b798e58ba 100644 (file)
--- a/src/CachePeer.cc
+++ b/src/CachePeer.cc
@@ -42,6 +42,7 @@ CachePeer::CachePeer() :
     domain(NULL),
 #if USE_OPENSSL
     sslContext(NULL),
+    sslSession(NULL),
 #endif
     front_end_https(0),
     connection_auth(2 /* auto */)
@@ -101,6 +102,9 @@ CachePeer::~CachePeer()
 #if USE_OPENSSL
     if (sslContext)
         SSL_CTX_free(sslContext);
+
+    if (sslSession)
+        SSL_SESSION_free(sslSession);
 #endif
 }
 

diff --git a/src/CachePeer.h b/src/CachePeer.h
index 67a6302ae399c53d83c0da696c3a2404ebda120b..848150df31fa8e97c9547029f49b635af64d8361 100644 (file)
--- a/src/CachePeer.h
+++ b/src/CachePeer.h
@@ -184,7 +184,9 @@ public:
     /// security settings for peer connection
     Security::PeerOptions secure;
     Security::ContextPtr sslContext;
-    Security::SessionStatePointer sslSession;
+#if USE_OPENSSL
+    SSL_SESSION *sslSession;
+#endif
 
     int front_end_https;
     int connection_auth;

diff --git a/src/adaptation/icap/ServiceRep.cc b/src/adaptation/icap/ServiceRep.cc
index 14996a7fa8226e92bd305353b4c7c8cfc97df78d..7aec5ca4f2f623f7a076f7bb8518d80aab71a8f1 100644 (file)
--- a/src/adaptation/icap/ServiceRep.cc
+++ b/src/adaptation/icap/ServiceRep.cc
@@ -34,6 +34,9 @@ CBDATA_NAMESPACED_CLASS_INIT(Adaptation::Icap, ServiceRep);
 Adaptation::Icap::ServiceRep::ServiceRep(const ServiceConfigPointer &svcCfg):
     AsyncJob("Adaptation::Icap::ServiceRep"), Adaptation::Service(svcCfg),
     sslContext(NULL),
+#if USE_OPENSSL
+    sslSession(NULL),
+#endif
     theOptions(NULL), theOptionsFetcher(0), theLastUpdate(0),
     theBusyConns(0),
     theAllWaiters(0),

diff --git a/src/adaptation/icap/ServiceRep.h b/src/adaptation/icap/ServiceRep.h
index 579bfbd574f84126b97d6f65493cf09c717a5bfc..39e9bf57b02d0a84477b55c31b271019c302c212 100644 (file)
--- a/src/adaptation/icap/ServiceRep.h
+++ b/src/adaptation/icap/ServiceRep.h
@@ -111,7 +111,9 @@ public: // treat these as private, they are for callbacks only
     virtual void noteAdaptationAnswer(const Answer &answer);
 
     Security::ContextPtr sslContext;
-    Security::SessionStatePointer sslSession;
+#if USE_OPENSSL
+    SSL_SESSION *sslSession;
+#endif
 
 private:
     // stores Prepare() callback info

diff --git a/src/adaptation/icap/Xaction.cc b/src/adaptation/icap/Xaction.cc
index 05eb212eabbf7cb85f0f7a8a34af570714d892ea..d91818065c0b0563032597e3518aa6d97b639b3f 100644 (file)
--- a/src/adaptation/icap/Xaction.cc
+++ b/src/adaptation/icap/Xaction.cc
@@ -724,7 +724,9 @@ Ssl::IcapPeerConnector::initializeTls(Security::SessionPointer &serverSession)
     if (check)
         check->dst_peer_name = *host;
 
-    Security::GetSessionResumeData(serverSession, icapService->sslSession);
+    if (icapService->sslSession)
+        SSL_set_session(serverSession.get(), icapService->sslSession);
+
     return true;
 }
 
@@ -735,7 +737,13 @@ Ssl::IcapPeerConnector::noteNegotiationDone(ErrorState *error)
         return;
 
     const int fd = serverConnection()->fd;
-    Security::GetSessionResumeData(fd_table[fd].ssl, icapService->sslSession);
+    auto ssl = fd_table[fd].ssl.get();
+    assert(ssl);
+    if (!SSL_session_reused(ssl)) {
+        if (icapService->sslSession)
+            SSL_SESSION_free(icapService->sslSession);
+        icapService->sslSession = SSL_get1_session(ssl);
+    }
 }
 
 void

diff --git a/src/client_side.cc b/src/client_side.cc
index 9b2329517c37eb877bfdcd0d7d1e25be5916b43f..2caf7687bdb546838478b7844ef5a90eaa5cc6ba 100644 (file)
--- a/src/client_side.cc
+++ b/src/client_side.cc
@@ -2653,7 +2653,7 @@ clientNegotiateSSL(int fd, void *data)
         return;
     }
 
-    if (Security::SessionIsResumed(fd_table[fd].ssl)) {
+    if (SSL_session_reused(ssl)) {
         debugs(83, 2, "clientNegotiateSSL: Session " << SSL_get_session(ssl) <<
                " reused on FD " << fd << " (" << fd_table[fd].ipaddr << ":" << (int)fd_table[fd].remote_port << ")");
     } else {

diff --git a/src/security/Session.cc b/src/security/Session.cc
index e9f1efeacdc91854e3cf31bd8edc2cf074db09e0..38480c14385b0f560c5b517e5ba149eeb440ee4f 100644 (file)
--- a/src/security/Session.cc
+++ b/src/security/Session.cc
@@ -16,52 +16,6 @@
 #define SSL_SESSION_ID_SIZE 32
 #define SSL_SESSION_MAX_SIZE 10*1024
 
-#if USE_GNUTLS
-void
-squid_datum_free(gnutls_datum_t *D) {
-    gnutls_free(D);
-}
-#endif
-
-bool
-Security::SessionIsResumed(const Security::SessionPointer &s)
-{
-    return
-#if USE_OPENSSL
-        SSL_session_reused(s.get()) == 1;
-#elif USE_GNUTLS
-        gnutls_session_is_resumed(s.get()) != 0;
-#else
-        false;
-#endif
-}
-
-void
-Security::GetSessionResumeData(const Security::SessionPointer &s, Security::SessionStatePointer &data)
-{
-    if (!SessionIsResumed(s)) {
-#if USE_OPENSSL
-        data.reset(SSL_get1_session(s.get()));
-#elif USE_GNUTLS
-        gnutls_datum_t *tmp = nullptr;
-        (void)gnutls_session_get_data2(s.get(), tmp);
-        data.reset(tmp);
-#endif
-    }
-}
-
-void
-Security::SetSessionResumeData(const Security::SessionPtr &s, const Security::SessionStatePointer &data)
-{
-    if (s) {
-#if USE_OPENSSL
-        (void)SSL_set_session(s, data.get());
-#elif USE_GNUTLS
-        (void)gnutls_session_set_data(s, data->data, data->size);
-#endif
-    }
-}
-
 static bool
 isTlsServer()
 {

diff --git a/src/security/Session.h b/src/security/Session.h
index fae3b4c247f53f4bb0be7fa7d2b1bf7d45657d5c..de9c3b785d494ccab838ffe36de797d623a9c058 100644 (file)
--- a/src/security/Session.h
+++ b/src/security/Session.h
@@ -32,8 +32,6 @@ typedef SSL* SessionPtr;
 CtoCpp1(SSL_free, SSL *);
 typedef LockingPointer<SSL, Security::SSL_free_cpp, CRYPTO_LOCK_SSL> SessionPointer;
 
-typedef std::unique_ptr<SSL_SESSION, std::function<decltype(SSL_SESSION_free)>> SessionStatePointer;
-
 #elif USE_GNUTLS
 typedef gnutls_session_t SessionPtr;
 // Locks can be implemented attaching locks counter to gnutls_session_t
@@ -42,30 +40,14 @@ typedef gnutls_session_t SessionPtr;
 CtoCpp1(gnutls_deinit, gnutls_session_t);
 typedef LockingPointer<struct gnutls_session_int, gnutls_deinit_cpp, -1> SessionPointer;
 
-/// wrapper function to avoid compile errors with gnutls_free() being a typedef.
-void squid_datum_free(gnutls_datum_t *D);
-typedef std::unique_ptr<gnutls_datum_t, std::function<decltype(squid_datum_free)>> SessionStatePointer;
-
 #else
 // use void* so we can check against NULL
 typedef void* SessionPtr;
 CtoCpp1(xfree, SessionPtr);
 typedef LockingPointer<void, xfree_cpp, -1> SessionPointer;
 
-typedef std::unique_ptr<int> SessionStatePointer;
-
 #endif
 
-/// whether the session is a resumed one
-bool SessionIsResumed(const Security::SessionPointer &);
-
-/// Retrieve the data needed to resume this session on a later connection
-void GetSessionResumeData(const Security::SessionPointer &, Security::SessionStatePointer &);
-
-/// Set the data for resuming a previous session.
-/// Needs to be done before using the SessionPointer for a handshake.
-void SetSessionResumeData(const Security::SessionPtr &, const Security::SessionStatePointer &);
-
 } // namespace Security
 
 #endif /* SQUID_SRC_SECURITY_SESSION_H */

diff --git a/src/ssl/BlindPeerConnector.cc b/src/ssl/BlindPeerConnector.cc
index 28734b64babe25e53f2e62ef21a4c9618f9bde52..1bc9f9762951ead42d3bd07cef2ccca3aba34a72 100644 (file)
--- a/src/ssl/BlindPeerConnector.cc
+++ b/src/ssl/BlindPeerConnector.cc
@@ -45,7 +45,8 @@ Ssl::BlindPeerConnector::initializeTls(Security::SessionPointer &serverSession)
         SBuf *host = new SBuf(peer->secure.sslDomain);
         SSL_set_ex_data(serverSession.get(), ssl_ex_index_server, host);
 
-        Security::SetSessionResumeData(serverSession.get(), peer->sslSession);
+        if (peer->sslSession)
+            SSL_set_session(serverSession.get(), peer->sslSession);
     } else {
         SBuf *hostName = new SBuf(request->url.host());
         SSL_set_ex_data(serverSession.get(), ssl_ex_index_server, (void*)hostName);
@@ -68,9 +69,13 @@ Ssl::BlindPeerConnector::noteNegotiationDone(ErrorState *error)
         return;
     }
 
-    if (auto *peer = serverConnection()->getPeer()) {
-        const int fd = serverConnection()->fd;
-        Security::GetSessionResumeData(fd_table[fd].ssl, peer->sslSession);
+    const int fd = serverConnection()->fd;
+    Security::SessionPtr ssl = fd_table[fd].ssl.get();
+    if (serverConnection()->getPeer() && !SSL_session_reused(ssl)) {
+        if (serverConnection()->getPeer()->sslSession)
+            SSL_SESSION_free(serverConnection()->getPeer()->sslSession);
+
+        serverConnection()->getPeer()->sslSession = SSL_get1_session(ssl);
     }
 }
 

diff --git a/src/tests/stub_libsecurity.cc b/src/tests/stub_libsecurity.cc
index ba40c5591a21eb4e2d1183f71be261c0efd0a639..1875e2aee2ff132272b299695919ac21b2728a52 100644 (file)
--- a/src/tests/stub_libsecurity.cc
+++ b/src/tests/stub_libsecurity.cc
@@ -48,10 +48,3 @@ const char *Security::NegotiationHistory::printTlsVersion(AnyP::ProtocolVersion
 Security::HandshakeParser::HandshakeParser() STUB
 bool Security::HandshakeParser::parseHello(const SBuf &) STUB_RETVAL(false)
 
-#include "security/Session.h"
-namespace Security {
-bool SessionIsResumed(const Security::SessionPointer &) STUB_RETVAL(false)
-void GetSessionResumeData(const Security::SessionPointer &, Security::SessionStatePointer &) STUB
-void SetSessionResumeData(const Security::SessionPtr &, const Security::SessionStatePointer &) STUB
-} // namespace Security
-