Merge branch 'ia/ssl/bottlenecks/OTP-10113' into maint

* ia/ssl/bottlenecks/OTP-10113:
  ssl: Test case fixes
  ssl: Avoid second bottleneck in supervisor
  ssl: File handling optimization
  ssl: Simpler PEM cache
  ssl: Refactored for readability
  ssl: Use md5 as file ref id instead of filenames
  ssl: Move ets:select bottleneck in server
  ssl: Renegotiate updates session id in gen_fsm state
  ssl: Use ordered_set in cache
  ssl: Move and avoid ets:select bottleneck in client
  ssl: Reuse session check optimization
  ssl: Avoid supervior bottleneck

1 files changed, 48 insertions, 72 deletions

diff --git a/lib/ssl/src/ssl_session.erl b/lib/ssl/src/ssl_session.erl
index df5d7e0146..2ad422fc03 100644
--- a/lib/ssl/src/ssl_session.erl
+++ b/lib/ssl/src/ssl_session.erl
@@ -1,7 +1,7 @@
 %%
 %% %CopyrightBegin%
 %% 
-%% Copyright Ericsson AB 2007-2011. All Rights Reserved.
+%% Copyright Ericsson AB 2007-2012. All Rights Reserved.
 %% 
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
@@ -28,9 +28,9 @@
 -include("ssl_internal.hrl").
 
 %% Internal application API
--export([is_new/2, id/4, id/7, valid_session/2]).
+-export([is_new/2, client_id/4, server_id/6, valid_session/2]).
 
--define(GEN_UNIQUE_ID_MAX_TRIES, 10).
+-define('24H_in_sec', 8640).
 
 -type seconds()   :: integer(). 
 
@@ -48,13 +48,13 @@ is_new(_ClientSuggestion, _ServerDecision) ->
     true.
 
 %%--------------------------------------------------------------------
--spec id({host(), inet:port_number(), #ssl_options{}}, db_handle(), atom(),
+-spec client_id({host(), inet:port_number(), #ssl_options{}}, db_handle(), atom(),
 	 undefined | binary()) -> binary().
 %%
-%% Description: Should be called by the client side to get an id 
+%% Description: Should be called by the client side to get an id
 %%              for the client hello message.
 %%--------------------------------------------------------------------
-id(ClientInfo, Cache, CacheCb, OwnCert) ->
+client_id(ClientInfo, Cache, CacheCb, OwnCert) ->
     case select_session(ClientInfo, Cache, CacheCb, OwnCert) of
 	no_session ->
 	    <<>>;
@@ -62,27 +62,6 @@ id(ClientInfo, Cache, CacheCb, OwnCert) ->
 	    SessionId
     end.
 
-%%--------------------------------------------------------------------
--spec id(inet:port_number(), binary(), #ssl_options{}, db_handle(),
-	 atom(), seconds(), binary()) -> binary().
-%%
-%% Description: Should be called by the server side to get an id 
-%%              for the server hello message.
-%%--------------------------------------------------------------------
-id(Port, <<>>, _, Cache, CacheCb, _, _) ->
-    new_id(Port, ?GEN_UNIQUE_ID_MAX_TRIES, Cache, CacheCb);
-
-id(Port, SuggestedSessionId, #ssl_options{reuse_sessions = ReuseEnabled,
-					  reuse_session = ReuseFun}, 
-   Cache, CacheCb, SecondLifeTime, OwnCert) ->
-    case is_resumable(SuggestedSessionId, Port, ReuseEnabled, 
-		      ReuseFun, Cache, CacheCb, SecondLifeTime, OwnCert) of
-	true ->
-	    SuggestedSessionId;
-	false ->
-	    new_id(Port, ?GEN_UNIQUE_ID_MAX_TRIES, Cache, CacheCb)
-    end.
-%%--------------------------------------------------------------------
 -spec valid_session(#session{}, seconds()) -> boolean().
 %%
 %% Description: Check that the session has not expired
@@ -91,57 +70,51 @@ valid_session(#session{time_stamp = TimeStamp}, LifeTime) ->
     Now =  calendar:datetime_to_gregorian_seconds({date(), time()}),
     Now - TimeStamp < LifeTime.
 
+server_id(Port, <<>>, _SslOpts, _Cert, _, _) ->
+    {ssl_manager:new_session_id(Port), undefined};
+server_id(Port, SuggestedId,
+	  #ssl_options{reuse_sessions = ReuseEnabled,
+		       reuse_session = ReuseFun},
+	  Cert, Cache, CacheCb) ->
+    LifeTime = case application:get_env(ssl, session_lifetime) of
+		   {ok, Time} when is_integer(Time) -> Time;
+		   _ -> ?'24H_in_sec'
+	       end,
+    case is_resumable(SuggestedId, Port, ReuseEnabled,ReuseFun,
+		      Cache, CacheCb, LifeTime, Cert)
+    of
+	{true, Resumed} ->
+	    {SuggestedId, Resumed};
+	{false, undefined} ->
+	    {ssl_manager:new_session_id(Port), undefined}
+    end.
+
 %%--------------------------------------------------------------------
 %%% Internal functions
 %%--------------------------------------------------------------------
+select_session({_, _, #ssl_options{reuse_sessions=false}}, _Cache, _CacheCb, _OwnCert) ->
+    no_session;
 select_session({HostIP, Port, SslOpts}, Cache, CacheCb, OwnCert) ->
     Sessions = CacheCb:select_session(Cache, {HostIP, Port}),
     select_session(Sessions, SslOpts, OwnCert).
 
 select_session([], _, _) ->
     no_session;
-
-select_session(Sessions, #ssl_options{ciphers = Ciphers,
-				      reuse_sessions = ReuseSession}, OwnCert) ->
-    IsResumable =
-	fun(Session) ->
-		ReuseSession andalso resumable(Session#session.is_resumable) andalso
- 		    lists:member(Session#session.cipher_suite, Ciphers)
-		    andalso (OwnCert == Session#session.own_certificate)
+select_session(Sessions, #ssl_options{ciphers = Ciphers}, OwnCert) ->
+    IsNotResumable =
+	fun([_Id, Session]) ->
+		not (resumable(Session#session.is_resumable) andalso
+		     lists:member(Session#session.cipher_suite, Ciphers)
+		     andalso (OwnCert == Session#session.own_certificate))
  	end,
-    case [Id || [Id, Session] <- Sessions, IsResumable(Session)] of
- 	[] ->
- 	    no_session;
- 	List ->
- 	    hd(List)
-    end.
-
-%% If we can not generate a not allready in use session ID in
-%% ?GEN_UNIQUE_ID_MAX_TRIES we make the new session uncacheable The
-%% value of ?GEN_UNIQUE_ID_MAX_TRIES is stolen from open SSL which
-%% states : "If we can not find a session id in
-%% ?GEN_UNIQUE_ID_MAX_TRIES either the RAND code is broken or someone
-%% is trying to open roughly very close to 2^128 (or 2^256) SSL
-%% sessions to our server"
-new_id(_, 0, _, _) ->
-    <<>>;
-new_id(Port, Tries, Cache, CacheCb) ->
-    Id = crypto:rand_bytes(?NUM_OF_SESSION_ID_BYTES),
-    case CacheCb:lookup(Cache, {Port, Id}) of
-	undefined ->
-	    Now =  calendar:datetime_to_gregorian_seconds({date(), time()}),
-	    %% New sessions can not be set to resumable
-	    %% until handshake is compleate and the
-	    %% other session values are set.
-	    CacheCb:update(Cache, {Port, Id}, #session{session_id = Id,
-						       is_resumable = false,
-						       time_stamp = Now}),
-	    Id;
-	_ ->
-	    new_id(Port, Tries - 1, Cache, CacheCb)
+    case lists:dropwhile(IsNotResumable, Sessions) of
+	[] ->   no_session;
+	[[Id, _]|_] -> Id
     end.
 
-is_resumable(SuggestedSessionId, Port, ReuseEnabled, ReuseFun, Cache, 
+is_resumable(_, _, false, _, _, _, _, _) ->
+    {false, undefined};
+is_resumable(SuggestedSessionId, Port, true, ReuseFun, Cache,
 	     CacheCb, SecondLifeTime, OwnCert) ->
     case CacheCb:lookup(Cache, {Port, SuggestedSessionId}) of
 	#session{cipher_suite = CipherSuite,
@@ -149,14 +122,17 @@ is_resumable(SuggestedSessionId, Port, ReuseEnabled, ReuseFun, Cache,
 		 compression_method = Compression,
 		 is_resumable = IsResumable,
 		 peer_certificate = PeerCert} = Session ->
-	    ReuseEnabled 
-		andalso resumable(IsResumable)
+	    case resumable(IsResumable)
 		andalso (OwnCert == SessionOwnCert)
-		andalso valid_session(Session, SecondLifeTime) 
-		andalso ReuseFun(SuggestedSessionId, PeerCert, 
-				 Compression, CipherSuite);
+		andalso valid_session(Session, SecondLifeTime)
+		andalso ReuseFun(SuggestedSessionId, PeerCert,
+				 Compression, CipherSuite)
+	    of
+		true  -> {true, Session};
+		false -> {false, undefined}
+	    end;
 	undefined ->
-	    false
+	    {false, undefined}
     end.
 
 resumable(new) ->