From ba4fb703a5c20ed26186d5ae968020819c1d8780 Mon Sep 17 00:00:00 2001
From: Ingela Anderton Andin <ingela@erlang.org>
Date: Fri, 4 Jan 2019 11:01:21 +0100
Subject: ssl: Add value 'save' to reuse_sessions and reuse_session client
 option

We want to be able to save a specific session to reuse, and make sure
it is reusable immediatly when the connection has been established.

Add client option {reuse_session, SessionID::binary()}

We also do not want clients to save sessions that it did not verify.

Additionaly change behaviour of the client and server to not save sessions
if reuse_session is set to false.
---
 lib/ssl/src/ssl.erl | 34 ++++++++++++++++++++++++++++------
 1 file changed, 28 insertions(+), 6 deletions(-)

(limited to 'lib/ssl/src/ssl.erl')

diff --git a/lib/ssl/src/ssl.erl b/lib/ssl/src/ssl.erl
index 03a1e40bfc..29129d4b6c 100644
--- a/lib/ssl/src/ssl.erl
+++ b/lib/ssl/src/ssl.erl
@@ -891,8 +891,6 @@ handle_options(Opts0, Role, Host) ->
 			     {list, [{mode, list}]}], Opts0),
     assert_proplist(Opts),
     RecordCb = record_cb(Opts),
-
-    ReuseSessionFun = fun(_, _, _, _) -> true end,
     CaCerts = handle_option(cacerts, Opts, undefined),
 
     {Verify, FailIfNoPeerCert, CaCertDefault, VerifyFun, PartialChainHanlder, VerifyClientOnce} =
@@ -945,9 +943,8 @@ handle_options(Opts0, Role, Host) ->
 									     default_option_role(server, 
 												 tls_v1:default_signature_algs(Versions), Role)),
 							 tls_version(RecordCb:highest_protocol_version(Versions))), 
-		    %% Server side option
-		    reuse_session = handle_option(reuse_session, Opts, ReuseSessionFun),
-		    reuse_sessions = handle_option(reuse_sessions, Opts, true),
+                    reuse_sessions = handle_reuse_sessions_option(reuse_sessions, Opts, Role),
+		    reuse_session = handle_reuse_session_option(reuse_session, Opts, Role),
 		    secure_renegotiate = handle_option(secure_renegotiate, Opts, true),
 		    client_renegotiation = handle_option(client_renegotiation, Opts, 
 							 default_option_role(server, true, Role), 
@@ -1138,11 +1135,16 @@ validate_option(srp_identity, {Username, Password})
     {unicode:characters_to_binary(Username),
      unicode:characters_to_binary(Password)};
 
+validate_option(reuse_session, undefined) ->
+    undefined;
 validate_option(reuse_session, Value) when is_function(Value) ->
     Value;
+validate_option(reuse_session, Value) when is_binary(Value) ->
+    Value;
 validate_option(reuse_sessions, Value) when is_boolean(Value) ->
     Value;
-
+validate_option(reuse_sessions, save = Value) ->
+    Value;
 validate_option(secure_renegotiate, Value) when is_boolean(Value) ->
     Value;
 validate_option(client_renegotiation, Value) when is_boolean(Value) ->
@@ -1265,6 +1267,26 @@ handle_hashsigns_option(_, Version) when Version >= {3, 3} ->
 handle_hashsigns_option(_, _Version) ->
     undefined.
 
+handle_reuse_sessions_option(Key, Opts, client) ->
+    Value = proplists:get_value(Key, Opts, true),
+    validate_option(Key, Value),
+    Value;
+handle_reuse_sessions_option(Key, Opts0, server) ->
+    Opts = proplists:delete({Key, save}, Opts0),
+    Value = proplists:get_value(Key, Opts, true),
+    validate_option(Key, Value),
+    Value.
+
+handle_reuse_session_option(Key, Opts, client) ->
+    Value = proplists:get_value(Key, Opts, undefined),
+    validate_option(Key, Value),
+    Value;
+handle_reuse_session_option(Key, Opts, server) ->
+    ReuseSessionFun = fun(_, _, _, _) -> true end,
+    Value = proplists:get_value(Key, Opts, ReuseSessionFun),
+    validate_option(Key, Value),
+    Value.
+
 validate_options([]) ->
 	[];
 validate_options([{Opt, Value} | Tail]) ->
-- 
cgit v1.2.3