From ssl-2.5 2004/10/22 14:52:33

NO_SESSION_REUSE https_port ssl flag, disabling the SSL session reuse /
resumption support.

diff --git a/src/cf.data.pre b/src/cf.data.pre
index 9650ff587067d745fe51484e271d1be448120684..6068cfa60136f2c6403b06caea04b541c7ddceeb 100644 (file)
--- a/src/cf.data.pre
+++ b/src/cf.data.pre
@@ -1,6 +1,6 @@
 
 #
-# $Id: cf.data.pre,v 1.381 2005/03/18 15:36:07 hno Exp $
+# $Id: cf.data.pre,v 1.382 2005/03/18 16:32:37 hno Exp $
 #
 #
 # SQUID Web Proxy Cache          http://www.squid-cache.org/
@@ -197,6 +197,9 @@ DOC_START
                            NO_DEFAULT_CA
                                Don't use the default CA list built in
                                to OpenSSL
+                           NO_SESSION_REUSE
+                               Don't allow for session reuse. Each connection
+                               will result in a new SSL session.
 
           sslcontext=  SSL session ID context identifier.
 

diff --git a/src/ssl_support.cc b/src/ssl_support.cc
index 96880763babbfefe9ddd9ebd106172f0b92d58b8..3e3cbd63ecae3b5dc0d2f8c4e74a5b60b794ae03 100644 (file)
--- a/src/ssl_support.cc
+++ b/src/ssl_support.cc
@@ -1,6 +1,6 @@
 
 /*
- * $Id: ssl_support.cc,v 1.25 2005/03/18 16:06:11 hno Exp $
+ * $Id: ssl_support.cc,v 1.26 2005/03/18 16:32:37 hno Exp $
  *
  * AUTHOR: Benno Rice
  * DEBUG: section 83    SSL accelerator support
@@ -411,6 +411,7 @@ no_options:
 #define SSL_FLAG_DELAYED_AUTH          (1<<1)
 #define SSL_FLAG_DONT_VERIFY_PEER      (1<<2)
 #define SSL_FLAG_DONT_VERIFY_DOMAIN    (1<<3)
+#define SSL_FLAG_NO_SESSION_REUSE      (1<<4)
 
 static long
 ssl_parse_flags(const char *flags)
@@ -435,6 +436,8 @@ ssl_parse_flags(const char *flags)
             fl |= SSL_FLAG_DONT_VERIFY_PEER;
         else if (strcmp(flag, "DONT_VERIFY_DOMAIN") == 0)
             fl |= SSL_FLAG_DONT_VERIFY_DOMAIN;
+        else if (strcmp(flag, "NO_SESSION_REUSE") == 0)
+            fl |= SSL_FLAG_NO_SESSION_REUSE;
         else
             fatalf("Unknown ssl flag '%s'", flag);
 
@@ -543,6 +546,10 @@ sslCreateServerContext(const char *certfile, const char *keyfile, int version, c
         SSL_CTX_set_session_id_context(sslContext, context, strlen(context));
     }
 
+    if (fl & SSL_FLAG_NO_SESSION_REUSE) {
+        SSL_CTX_set_session_cache_mode(sslContext, SSL_SESS_CACHE_OFF);
+    }
+
     if (Config.SSL.unclean_shutdown) {
         debug(83, 5) ("Enabling quiet SSL shutdowns (RFC violation).\n");