BUG/MEDIUM: ssl: subsequent handshakes fail after server configuration changes

On server's configuration change, if the previously used
cipher is disabled, all subsequent connect attempts fail.

Fix consists in freeing cached session on handshake failure.

diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index 88a5adb7d9c5554ad41602ab5084227fca1ed3ea..9f611986556111eca6724b046bab4c167f559316 100644 (file)
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -747,6 +747,12 @@ int ssl_sock_handshake(struct connection *conn, unsigned int flag)
        return 1;
 
  out_error:
+       /* free resumed session if exists */
+       if (target_srv(&conn->target) && target_srv(&conn->target)->ssl_ctx.reused_sess) {
+               SSL_SESSION_free(target_srv(&conn->target)->ssl_ctx.reused_sess);
+               target_srv(&conn->target)->ssl_ctx.reused_sess = NULL;
+       }
+
        /* Fail on all other handshake errors */
        conn->flags |= CO_FL_ERROR;
        conn->flags &= ~flag;