Merged from v5 r14954

diff --cc src/client_side.cc
Simple merge

diff --cc src/security/PeerConnector.cc
index e04c654996d2dea08731434e332417a76a622e69,14bbbcd07a04185ca401a45dc86c855a70857dd6..a7d256686cb28ec9f3eba1cb732897d1c449100b
--- 1/src/security/PeerConnector.cc
--- 2/src/security/PeerConnector.cc
+++ b/src/security/PeerConnector.cc
@@@ -99,14 -99,16 +99,15 @@@ Security::PeerConnector::prepareSocket(
  bool
  Security::PeerConnector::initialize(Security::SessionPointer &serverSession)
  {
 -#if USE_OPENSSL
      Security::ContextPointer ctx(getTlsContext());
 -    assert(ctx);
  
 -    if (!Ssl::CreateClient(ctx, serverConnection(), "server https start")) {
 +    if (!ctx || !Security::CreateClientSession(ctx, serverConnection(), "server https start")) {
+         const auto xerrno = errno;
 -        const auto ssl_error = ERR_get_error();
 +        if (!ctx) {
 +            debugs(83, DBG_IMPORTANT, "Error initializing TLS connection: No security context.");
 +        } // else CreateClientSession() did the appropriate debugs() already
          ErrorState *anErr = new ErrorState(ERR_SOCKET_FAILURE, Http::scInternalServerError, request.getRaw());
-         anErr->xerrno = errno;
+         anErr->xerrno = xerrno;
 -        debugs(83, DBG_IMPORTANT, "Error allocating TLS handle: " << Security::ErrorString(ssl_error));
          noteNegotiationDone(anErr);
          bail(anErr);
          return false;

diff --cc src/security/Session.cc
index c1f62b0a93971e6dc7c8f3d070da2e6faf1f9321,1d4f6bc767d7b33cd722911362ac16a579ea2874..e8c24e8d1426da91387630a4f224f0698acebfa2
--- 1/src/security/Session.cc
--- 2/src/security/Session.cc
+++ b/src/security/Session.cc
@@@ -21,56 -19,6 +21,54 @@@
  #define SSL_SESSION_ID_SIZE 32
  #define SSL_SESSION_MAX_SIZE 10*1024
  
- #if USE_OPENSSL
 +static bool
 +CreateSession(const Security::ContextPointer &ctx, const Comm::ConnectionPointer &conn, Security::Io::Type type, const char *squidCtx)
 +{
 +    if (!Comm::IsConnOpen(conn)) {
 +        debugs(83, DBG_IMPORTANT, "Gone connection");
 +        return false;
 +    }
 +
 +    const char *errAction = "with no TLS/SSL library";
-     debugs(83, DBG_IMPORTANT, "ERROR: " << squidCtx << ' ' << errAction <<
-            ": " << ERR_error_string(errCode, nullptr));
- #else
-     debugs(83, DBG_IMPORTANT, "ERROR: " << squidCtx << ' ' << errAction);
 +    int errCode = 0;
++#if USE_OPENSSL
 +    Security::SessionPointer ssl(SSL_new(ctx.get()));
 +    if (ssl) {
 +        const int fd = conn->fd;
 +        // without BIO, we would call SSL_set_fd(ssl.get(), fd) instead
 +        if (BIO *bio = Ssl::Bio::Create(fd, type)) {
 +            Ssl::Bio::Link(ssl.get(), bio); // cannot fail
 +
 +            fd_table[fd].ssl = ssl;
 +            fd_table[fd].read_method = &ssl_read_method;
 +            fd_table[fd].write_method = &ssl_write_method;
 +            fd_note(fd, squidCtx);
 +            return true;
 +        }
 +        errCode = ERR_get_error();
 +        errAction = "failed to initialize I/O";
 +    } else {
 +        errCode = ERR_get_error();
 +        errAction = "failed to allocate handle";
 +    }
 +#endif
++    debugs(83, DBG_IMPORTANT, "ERROR: " << squidCtx << ' ' << errAction <<
++           ": " << (errCode != 0 ? Security::ErrorString(errCode) : ""));
 +    return false;
 +}
 +
 +bool
 +Security::CreateClientSession(const Security::ContextPointer &ctx, const Comm::ConnectionPointer &c, const char *squidCtx)
 +{
 +    return CreateSession(ctx, c, Security::Io::BIO_TO_SERVER, squidCtx);
 +}
 +
 +bool
 +Security::CreateServerSession(const Security::ContextPointer &ctx, const Comm::ConnectionPointer &c, const char *squidCtx)
 +{
 +    return CreateSession(ctx, c, Security::Io::BIO_TO_CLIENT, squidCtx);
 +}
 +
  bool
  Security::SessionIsResumed(const Security::SessionPointer &s)
  {

diff --cc src/security/Session.h
index 5f477e5bee0e9900961e40bbd597f722dc0c561b,0df481ffd60cca2201e9ad1121505da72ed3f343..50a5062d1986bf6e6517be2f49810b1bef32ef6e
--- 1/src/security/Session.h
--- 2/src/security/Session.h
+++ b/src/security/Session.h
@@@ -29,17 -27,12 +29,20 @@@
  
  namespace Security {
  
 +/// Creates TLS Client connection structure (aka 'session' state) and initializes TLS/SSL I/O (Comm and BIO).
 +/// On errors, emits DBG_IMPORTANT with details and returns false.
 +bool CreateClientSession(const Security::ContextPointer &, const Comm::ConnectionPointer &, const char *squidCtx);
 +
 +/// Creates TLS Server connection structure (aka 'session' state) and initializes TLS/SSL I/O (Comm and BIO).
 +/// On errors, emits DBG_IMPORTANT with details and returns false.
 +bool CreateServerSession(const Security::ContextPointer &, const Comm::ConnectionPointer &, const char *squidCtx);
 +
  #if USE_OPENSSL
  CtoCpp1(SSL_free, SSL *);
- typedef LockingPointer<SSL, Security::SSL_free_cpp, CRYPTO_LOCK_SSL> SessionPointer;
+ #if defined(CRYPTO_LOCK_SSL) // OpenSSL 1.0
+ inline int SSL_up_ref(SSL *t) {if (t) CRYPTO_add(&t->references, 1, CRYPTO_LOCK_SSL); return 0;}
+ #endif
+ typedef Security::LockingPointer<SSL, Security::SSL_free_cpp, HardFun<int, SSL *, SSL_up_ref> > SessionPointer;
  
  typedef std::unique_ptr<SSL_SESSION, HardFun<void, SSL_SESSION*, &SSL_SESSION_free>> SessionStatePointer;
  

diff --cc src/security/forward.h
Simple merge

diff --cc src/ssl/bio.cc
index 221b8756a7baccf94a6f4f71d45dea64bd4c7170,dac9d26debe1653e488f95c14987ed7b9e9ab5a6..dbc882579681cf3b5e66212a6e74eba655b3571f
--- 1/src/ssl/bio.cc
--- 2/src/ssl/bio.cc
+++ b/src/ssl/bio.cc
@@@ -56,10 -57,14 +57,14 @@@ static BIO_METHOD SquidMethods = 
      squid_bio_destroy,
      NULL // squid_callback_ctrl not supported
  };
+ #else
+ static BIO_METHOD *SquidMethods = NULL;
+ #endif
  
  BIO *
 -Ssl::Bio::Create(const int fd, Ssl::Bio::Type type)
 +Ssl::Bio::Create(const int fd, Security::Io::Type type)
  {
+ #if (OPENSSL_VERSION_NUMBER < 0x10100000L)
      if (BIO *bio = BIO_new(&SquidMethods)) {
          BIO_int_ctrl(bio, BIO_C_SET_FD, type, fd);
          return bio;

diff --cc src/ssl/bio.h
index 3fcc8c03011c5ea83ed3b9334f9fb36918d41b20,f0112fe011c848a4769d308a682892572a9d46cd..ac08aaebf098c1d0a88c5478c6b94236edba8a8d
--- 1/src/ssl/bio.h
--- 2/src/ssl/bio.h
+++ b/src/ssl/bio.h
@@@ -193,6 -194,13 +191,14 @@@ private
  void
  applyTlsDetailsToSSL(SSL *ssl, Security::TlsDetails::Pointer const &details, Ssl::BumpMode bumpMode);
  
+ #if (OPENSSL_VERSION_NUMBER < 0x10100000L)
+ // OpenSSL v1.0 bio compatibility functions
+ inline void *BIO_get_data(BIO *table) { return table->ptr; }
+ inline void BIO_set_data(BIO *table, void *data) { table->ptr = data; }
+ inline int BIO_get_init(BIO *table) { return table->init; }
+ inline void BIO_set_init(BIO *table, int init) { table->init = init; }
+ #endif
+ 
 +#endif /* USE_OPENSSL */
  #endif /* SQUID_SSL_BIO_H */
  

diff --cc src/ssl/support.cc
Simple merge

diff --cc src/ssl/support.h
Simple merge