vtls: TLS session storage overhaul

- add session with destructor callback
- remove vtls `session_free` method
- let `Curl_ssl_addsessionid()` take ownership
  of session object, freeing it also on failures
- change tls backend use
- test_17, add tests for SSL session resumption

Closes #13386

tests/http/test_17_ssl_use.py

@@ -0,0 +1,104 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+#***************************************************************************
+#                                  _   _ ____  _
+#  Project                     ___| | | |  _ \| |
+#                             / __| | | | |_) | |
+#                            | (__| |_| |  _ <| |___
+#                             \___|\___/|_| \_\_____|
+#
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# This software is licensed as described in the file COPYING, which
+# you should have received as part of this distribution. The terms
+# are also available at https://curl.se/docs/copyright.html.
+#
+# You may opt to use, copy, modify, merge, publish, distribute and/or sell
+# copies of the Software, and permit persons to whom the Software is
+# furnished to do so, under the terms of the COPYING file.
+#
+# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+# KIND, either express or implied.
+#
+# SPDX-License-Identifier: curl
+#
+###########################################################################
+#
+import difflib
+import filecmp
+import json
+import logging
+import os
+from datetime import timedelta
+import pytest
+
+from testenv import Env, CurlClient, LocalClient, ExecResult
+
+
+log = logging.getLogger(__name__)
+
+
+class TestSSLUse:
+
+    @pytest.fixture(autouse=True, scope='class')
+    def _class_scope(self, env, httpd, nghttpx):
+        if env.have_h3():
+            nghttpx.start_if_needed()
+        httpd.clear_extra_configs()
+        httpd.reload()
+
+    def test_17_01_sslinfo_plain(self, env: Env, httpd, nghttpx, repeat):
+        proto = 'http/1.1'
+        curl = CurlClient(env=env)
+        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/sslinfo'
+        r = curl.http_get(url=url, alpn_proto=proto)
+        assert r.json['HTTPS'] == 'on', f'{r.json}'
+        assert 'SSL_SESSION_ID' in r.json, f'{r.json}'
+        assert 'SSL_SESSION_RESUMED' in r.json, f'{r.json}'
+        assert r.json['SSL_SESSION_RESUMED'] == 'Initial', f'{r.json}'
+
+    @pytest.mark.parametrize("tls_max", ['1.2', '1.3'])
+    def test_17_02_sslinfo_reconnect(self, env: Env, httpd, nghttpx, tls_max, repeat):
+        proto = 'http/1.1'
+        count = 3
+        exp_resumed = 'Resumed'
+        xargs = ['--sessionid', '--tls-max', tls_max, f'--tlsv{tls_max}']
+        if env.curl_uses_lib('gnutls'):
+            if tls_max == '1.3':
+                exp_resumed = 'Initial'  # 1.2 works in gnutls, but 1.3 does not, TODO
+        if env.curl_uses_lib('libressl'):
+            if tls_max == '1.3':
+                exp_resumed = 'Initial'  # 1.2 works in libressl, but 1.3 does not, TODO
+        if env.curl_uses_lib('wolfssl'):
+            xargs = ['--sessionid', f'--tlsv{tls_max}']
+            if tls_max == '1.3':
+                exp_resumed = 'Initial'  # 1.2 works in wolfssl, but 1.3 does not, TODO
+        if env.curl_uses_lib('rustls-ffi'):
+            exp_resumed = 'Initial'  # rustls does not support sessions, TODO
+        if env.curl_uses_lib('bearssl') and tls_max == '1.3':
+            pytest.skip('BearSSL does not support TLSv1.3')
+        if env.curl_uses_lib('mbedtls') and tls_max == '1.3':
+            pytest.skip('mbedtls does not support TLSv1.3')
+
+        curl = CurlClient(env=env)
+        # tell the server to close the connection after each request
+        urln = f'https://{env.authority_for(env.domain1, proto)}/curltest/sslinfo?'\
+               f'id=[0-{count-1}]&close'
+        r = curl.http_download(urls=[urln], alpn_proto=proto, with_stats=True,
+                               extra_args=xargs)
+        r.check_response(count=count, http_status=200)
+        # should have used one connection for each request, sessions after
+        # first should have been resumed
+        assert r.total_connects == count, r.dump_logs()
+        for i in range(count):
+            dfile = curl.download_file(i)
+            assert os.path.exists(dfile)
+            with open(dfile) as f:
+                djson = json.load(f)
+            assert djson['HTTPS'] == 'on', f'{i}: {djson}'
+            if i == 0:
+                assert djson['SSL_SESSION_RESUMED'] == 'Initial', f'{i}: {djson}'
+            else:
+                assert djson['SSL_SESSION_RESUMED'] == exp_resumed, f'{i}: {djson}'
+
+

tests/http/testenv/curl.py

@@ -415,9 +415,15 @@ class CurlClient:
         return xargs
 
     def http_get(self, url: str, extra_args: Optional[List[str]] = None,
-                 def_tracing: bool = True, with_profile: bool = False):
-        return self._raw(url, options=extra_args, with_stats=False,
-                         def_tracing=def_tracing, with_profile=with_profile)
+                 alpn_proto: Optional[str] = None,
+                 def_tracing: bool = True,
+                 with_stats: bool = False,
+                 with_profile: bool = False):
+        return self._raw(url, options=extra_args,
+                         with_stats=with_stats,
+                         alpn_proto=alpn_proto,
+                         def_tracing=def_tracing,
+                         with_profile=with_profile)
 
     def http_download(self, urls: List[str],
                       alpn_proto: Optional[str] = None,

tests/http/testenv/httpd.py

@@ -397,6 +397,10 @@ class Httpd:
                 f'    Redirect 302 /curltest/echo302 /curltest/echo',
                 f'    Redirect 303 /curltest/echo303 /curltest/echo',
                 f'    Redirect 307 /curltest/echo307 /curltest/echo',
+                f'    <Location /curltest/sslinfo>',
+                f'      SSLOptions StdEnvVars',
+                f'      SetHandler curltest-sslinfo',
+                f'    </Location>',
                 f'    <Location /curltest/echo>',
                 f'      SetHandler curltest-echo',
                 f'    </Location>',

tests/http/testenv/mod_curltest/mod_curltest.c

@@ -40,6 +40,7 @@ static int curltest_echo_handler(request_rec *r);
 static int curltest_put_handler(request_rec *r);
 static int curltest_tweak_handler(request_rec *r);
 static int curltest_1_1_required(request_rec *r);
+static int curltest_sslinfo_handler(request_rec *r);
 
 AP_DECLARE_MODULE(curltest) = {
   STANDARD20_MODULE_STUFF,
@@ -88,6 +89,7 @@ static void curltest_hooks(apr_pool_t *pool)
   ap_hook_handler(curltest_put_handler, NULL, NULL, APR_HOOK_MIDDLE);
   ap_hook_handler(curltest_tweak_handler, NULL, NULL, APR_HOOK_MIDDLE);
   ap_hook_handler(curltest_1_1_required, NULL, NULL, APR_HOOK_MIDDLE);
+  ap_hook_handler(curltest_sslinfo_handler, NULL, NULL, APR_HOOK_MIDDLE);
 }
 
 #define SECS_PER_HOUR      (60*60)
@@ -628,3 +630,113 @@ cleanup:
   }
   return DECLINED;
 }
+
+static int brigade_env_var(request_rec *r, apr_bucket_brigade *bb,
+                           const char *name)
+{
+  const char *s;
+  s = apr_table_get(r->subprocess_env, name);
+  if(s)
+    return apr_brigade_printf(bb, NULL, NULL, ",\n  \"%s\": \"%s\"", name, s);
+  return 0;
+}
+
+static int curltest_sslinfo_handler(request_rec *r)
+{
+  conn_rec *c = r->connection;
+  apr_bucket_brigade *bb;
+  apr_bucket *b;
+  apr_status_t rv;
+  apr_array_header_t *args = NULL;
+  const char *request_id = NULL;
+  int close_conn = 0;
+  long l;
+  int i;
+
+  if(strcmp(r->handler, "curltest-sslinfo")) {
+    return DECLINED;
+  }
+  if(r->method_number != M_GET) {
+    return DECLINED;
+  }
+
+  if(r->args) {
+    apr_array_header_t *args = apr_cstr_split(r->args, "&", 1, r->pool);
+    for(i = 0; i < args->nelts; ++i) {
+      char *s, *val, *arg = APR_ARRAY_IDX(args, i, char*);
+      s = strchr(arg, '=');
+      if(s) {
+        *s = '\0';
+        val = s + 1;
+        if(!strcmp("id", arg)) {
+          /* just an id for repeated requests with curl's url globbing */
+          request_id = val;
+          continue;
+        }
+      }
+      else if(!strcmp("close", arg)) {
+        /* we are asked to close the connection */
+        close_conn = 1;
+        continue;
+      }
+      ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, "query parameter not "
+                    "understood: '%s' in %s",
+                    arg, r->args);
+      ap_die(HTTP_BAD_REQUEST, r);
+      return OK;
+    }
+  }
+
+  ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r, "sslinfo: processing");
+  r->status = 200;
+  r->clength = -1;
+  r->chunked = 1;
+  apr_table_unset(r->headers_out, "Content-Length");
+  /* Discourage content-encodings */
+  apr_table_unset(r->headers_out, "Content-Encoding");
+  apr_table_setn(r->subprocess_env, "no-brotli", "1");
+  apr_table_setn(r->subprocess_env, "no-gzip", "1");
+
+  ap_set_content_type(r, "application/json");
+
+  bb = apr_brigade_create(r->pool, c->bucket_alloc);
+
+  apr_brigade_puts(bb, NULL, NULL, "{\n  \"Name\": \"SSL-Information\"");
+  brigade_env_var(r, bb, "HTTPS");
+  brigade_env_var(r, bb, "SSL_PROTOCOL");
+  brigade_env_var(r, bb, "SSL_CIPHER");
+  brigade_env_var(r, bb, "SSL_SESSION_ID");
+  brigade_env_var(r, bb, "SSL_SESSION_RESUMED");
+  brigade_env_var(r, bb, "SSL_SRP_USER");
+  brigade_env_var(r, bb, "SSL_SRP_USERINFO");
+  apr_brigade_puts(bb, NULL, NULL, "}\n");
+
+  /* flush response */
+  b = apr_bucket_flush_create(c->bucket_alloc);
+  APR_BRIGADE_INSERT_TAIL(bb, b);
+  rv = ap_pass_brigade(r->output_filters, bb);
+  if (APR_SUCCESS != rv) goto cleanup;
+
+  /* we are done */
+  b = apr_bucket_eos_create(c->bucket_alloc);
+  APR_BRIGADE_INSERT_TAIL(bb, b);
+  ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r, "1_1_handler: request read");
+
+  rv = ap_pass_brigade(r->output_filters, bb);
+
+cleanup:
+  if(close_conn)
+    r->connection->keepalive = AP_CONN_CLOSE;
+  if(rv == APR_SUCCESS
+     || r->status != HTTP_OK
+     || c->aborted) {
+    ap_log_rerror(APLOG_MARK, APLOG_TRACE1, rv, r, "1_1_handler: done");
+    return OK;
+  }
+  else {
+    /* no way to know what type of error occurred */
+    ap_log_rerror(APLOG_MARK, APLOG_TRACE1, rv, r, "1_1_handler failed");
+    return AP_FILTER_ERROR;
+  }
+  return DECLINED;
+}