vtls: TLS session storage overhaul

- add session with destructor callback
- remove vtls `session_free` method
- let `Curl_ssl_addsessionid()` take ownership
  of session object, freeing it also on failures
- change tls backend use
- test_17, add tests for SSL session resumption

Closes #13386

tests/http/testenv/curl.py

@@ -415,9 +415,15 @@ class CurlClient:
         return xargs
 
     def http_get(self, url: str, extra_args: Optional[List[str]] = None,
-                 def_tracing: bool = True, with_profile: bool = False):
-        return self._raw(url, options=extra_args, with_stats=False,
-                         def_tracing=def_tracing, with_profile=with_profile)
+                 alpn_proto: Optional[str] = None,
+                 def_tracing: bool = True,
+                 with_stats: bool = False,
+                 with_profile: bool = False):
+        return self._raw(url, options=extra_args,
+                         with_stats=with_stats,
+                         alpn_proto=alpn_proto,
+                         def_tracing=def_tracing,
+                         with_profile=with_profile)
 
     def http_download(self, urls: List[str],
                       alpn_proto: Optional[str] = None,

tests/http/testenv/httpd.py

@@ -397,6 +397,10 @@ class Httpd:
                 f'    Redirect 302 /curltest/echo302 /curltest/echo',
                 f'    Redirect 303 /curltest/echo303 /curltest/echo',
                 f'    Redirect 307 /curltest/echo307 /curltest/echo',
+                f'    <Location /curltest/sslinfo>',
+                f'      SSLOptions StdEnvVars',
+                f'      SetHandler curltest-sslinfo',
+                f'    </Location>',
                 f'    <Location /curltest/echo>',
                 f'      SetHandler curltest-echo',
                 f'    </Location>',

tests/http/testenv/mod_curltest/mod_curltest.c

@@ -40,6 +40,7 @@ static int curltest_echo_handler(request_rec *r);
 static int curltest_put_handler(request_rec *r);
 static int curltest_tweak_handler(request_rec *r);
 static int curltest_1_1_required(request_rec *r);
+static int curltest_sslinfo_handler(request_rec *r);
 
 AP_DECLARE_MODULE(curltest) = {
   STANDARD20_MODULE_STUFF,
@@ -88,6 +89,7 @@ static void curltest_hooks(apr_pool_t *pool)
   ap_hook_handler(curltest_put_handler, NULL, NULL, APR_HOOK_MIDDLE);
   ap_hook_handler(curltest_tweak_handler, NULL, NULL, APR_HOOK_MIDDLE);
   ap_hook_handler(curltest_1_1_required, NULL, NULL, APR_HOOK_MIDDLE);
+  ap_hook_handler(curltest_sslinfo_handler, NULL, NULL, APR_HOOK_MIDDLE);
 }
 
 #define SECS_PER_HOUR      (60*60)
@@ -628,3 +630,113 @@ cleanup:
   }
   return DECLINED;
 }
+
+static int brigade_env_var(request_rec *r, apr_bucket_brigade *bb,
+                           const char *name)
+{
+  const char *s;
+  s = apr_table_get(r->subprocess_env, name);
+  if(s)
+    return apr_brigade_printf(bb, NULL, NULL, ",\n  \"%s\": \"%s\"", name, s);
+  return 0;
+}
+
+static int curltest_sslinfo_handler(request_rec *r)
+{
+  conn_rec *c = r->connection;
+  apr_bucket_brigade *bb;
+  apr_bucket *b;
+  apr_status_t rv;
+  apr_array_header_t *args = NULL;
+  const char *request_id = NULL;
+  int close_conn = 0;
+  long l;
+  int i;
+
+  if(strcmp(r->handler, "curltest-sslinfo")) {
+    return DECLINED;
+  }
+  if(r->method_number != M_GET) {
+    return DECLINED;
+  }
+
+  if(r->args) {
+    apr_array_header_t *args = apr_cstr_split(r->args, "&", 1, r->pool);
+    for(i = 0; i < args->nelts; ++i) {
+      char *s, *val, *arg = APR_ARRAY_IDX(args, i, char*);
+      s = strchr(arg, '=');
+      if(s) {
+        *s = '\0';
+        val = s + 1;
+        if(!strcmp("id", arg)) {
+          /* just an id for repeated requests with curl's url globbing */
+          request_id = val;
+          continue;
+        }
+      }
+      else if(!strcmp("close", arg)) {
+        /* we are asked to close the connection */
+        close_conn = 1;
+        continue;
+      }
+      ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, "query parameter not "
+                    "understood: '%s' in %s",
+                    arg, r->args);
+      ap_die(HTTP_BAD_REQUEST, r);
+      return OK;
+    }
+  }
+
+  ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r, "sslinfo: processing");
+  r->status = 200;
+  r->clength = -1;
+  r->chunked = 1;
+  apr_table_unset(r->headers_out, "Content-Length");
+  /* Discourage content-encodings */
+  apr_table_unset(r->headers_out, "Content-Encoding");
+  apr_table_setn(r->subprocess_env, "no-brotli", "1");
+  apr_table_setn(r->subprocess_env, "no-gzip", "1");
+
+  ap_set_content_type(r, "application/json");
+
+  bb = apr_brigade_create(r->pool, c->bucket_alloc);
+
+  apr_brigade_puts(bb, NULL, NULL, "{\n  \"Name\": \"SSL-Information\"");
+  brigade_env_var(r, bb, "HTTPS");
+  brigade_env_var(r, bb, "SSL_PROTOCOL");
+  brigade_env_var(r, bb, "SSL_CIPHER");
+  brigade_env_var(r, bb, "SSL_SESSION_ID");
+  brigade_env_var(r, bb, "SSL_SESSION_RESUMED");
+  brigade_env_var(r, bb, "SSL_SRP_USER");
+  brigade_env_var(r, bb, "SSL_SRP_USERINFO");
+  apr_brigade_puts(bb, NULL, NULL, "}\n");
+
+  /* flush response */
+  b = apr_bucket_flush_create(c->bucket_alloc);
+  APR_BRIGADE_INSERT_TAIL(bb, b);
+  rv = ap_pass_brigade(r->output_filters, bb);
+  if (APR_SUCCESS != rv) goto cleanup;
+
+  /* we are done */
+  b = apr_bucket_eos_create(c->bucket_alloc);
+  APR_BRIGADE_INSERT_TAIL(bb, b);
+  ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r, "1_1_handler: request read");
+
+  rv = ap_pass_brigade(r->output_filters, bb);
+
+cleanup:
+  if(close_conn)
+    r->connection->keepalive = AP_CONN_CLOSE;
+  if(rv == APR_SUCCESS
+     || r->status != HTTP_OK
+     || c->aborted) {
+    ap_log_rerror(APLOG_MARK, APLOG_TRACE1, rv, r, "1_1_handler: done");
+    return OK;
+  }
+  else {
+    /* no way to know what type of error occurred */
+    ap_log_rerror(APLOG_MARK, APLOG_TRACE1, rv, r, "1_1_handler failed");
+    return AP_FILTER_ERROR;
+  }
+  return DECLINED;
+}