[glib-networking/mcatanzaro/session-resumption: 1/2] gnutls: enable session tickets on server side

[Michael Catanzaro <mcatanzaro src gnome org>]

commit ebe07c1be903e88a7596fb7bba8d250bab2e1b30
Author: Michael Catanzaro <mcatanzaro gnome org>
Date:   Wed Aug 14 11:15:30 2019 -0500

    gnutls: enable session tickets on server side
    
    Session resumption is now compatible with both TLS 1.2 and TLS 1.3. The
    only configuration no longer supported is older TLS clients that only
    support session identifiers stored by the server, not session tickets.
    In practice, that should be almost nothing.

 tls/gnutls/gtlsserverconnection-gnutls.c | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)
---
diff --git a/tls/gnutls/gtlsserverconnection-gnutls.c b/tls/gnutls/gtlsserverconnection-gnutls.c
index c925c78..b1df42d 100644
--- a/tls/gnutls/gtlsserverconnection-gnutls.c
+++ b/tls/gnutls/gtlsserverconnection-gnutls.c
@@ -49,6 +49,8 @@ struct _GTlsServerConnectionGnutls
   gnutls_pcert_st *pcert;
   unsigned int pcert_length;
   gnutls_privkey_t pkey;
+
+  gnutls_datum_t session_ticket_key;
 };
 
 static void     g_tls_server_connection_gnutls_initable_interface_init (GInitableIface  *iface);
@@ -97,6 +99,12 @@ g_tls_server_connection_gnutls_finalize (GObject *object)
 
   clear_gnutls_certificate_copy (gnutls);
 
+  if (gnutls->session_ticket_key.data)
+    {
+      gnutls_memset (gnutls->session_ticket_key.data, 0, gnutls->session_ticket_key.size);
+      gnutls_free (gnutls->session_ticket_key.data);
+    }
+
   G_OBJECT_CLASS (g_tls_server_connection_gnutls_parent_class)->finalize (object);
 }
 
@@ -105,10 +113,11 @@ g_tls_server_connection_gnutls_initable_init (GInitable       *initable,
                                               GCancellable    *cancellable,
                                               GError         **error)
 {
-  GTlsConnectionGnutls *gnutls = G_TLS_CONNECTION_GNUTLS (initable);
+  GTlsServerConnectionGnutls *gnutls = G_TLS_SERVER_CONNECTION_GNUTLS (initable);
   GTlsCertificate *cert;
   gnutls_session_t session;
   gnutls_certificate_credentials_t creds;
+  int ret;
 
   if (!g_tls_server_connection_gnutls_parent_initable_iface->init (initable, cancellable, error))
     return FALSE;
@@ -126,6 +135,18 @@ g_tls_server_connection_gnutls_initable_init (GInitable       *initable,
       return FALSE;
     }
 
+  ret = gnutls_session_ticket_key_generate (&gnutls->session_ticket_key);
+  if (ret != GNUTLS_E_SUCCESS)
+    {
+      g_warning ("Failed to generate session ticket key, session resumption will not work: %s", 
gnutls_strerror (ret));
+    }
+  else
+    {
+      ret = gnutls_session_ticket_enable_server (session, &gnutls->session_ticket_key);
+      if (ret != GNUTLS_E_SUCCESS)
+        g_warning ("Failed to enable session tickets, session resumption will not work: %s", gnutls_strerror 
(ret));
+    }
+
   return TRUE;
 }