[glib-networking/mcatanzaro/tls1.2] gnutls: enable session tickets on server side

[Michael Catanzaro <mcatanzaro src gnome org>]

commit 91c598fa16faa7d48432653784ea2c6cb283b4be
Author: Michael Catanzaro <mcatanzaro gnome org>
Date:   Wed Aug 14 11:15:30 2019 -0500

    gnutls: enable session tickets on server side
    
    Session resumption is now compatible with both TLS 1.2 and TLS 1.3. The
    only configuration no longer supported is older TLS clients that only
    support session identifiers stored by the server, not session tickets.
    In practice, that should be almost nothing.

 tls/gnutls/gtlsserverconnection-gnutls.c | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)
---
diff --git a/tls/gnutls/gtlsserverconnection-gnutls.c b/tls/gnutls/gtlsserverconnection-gnutls.c
index 18a97da..2bd9317 100644
--- a/tls/gnutls/gtlsserverconnection-gnutls.c
+++ b/tls/gnutls/gtlsserverconnection-gnutls.c
@@ -49,6 +49,8 @@ struct _GTlsServerConnectionGnutls
   gnutls_pcert_st *pcert;
   unsigned int pcert_length;
   gnutls_privkey_t pkey;
+
+  gnutls_datum_t session_ticket_key;
 };
 
 static void     g_tls_server_connection_gnutls_initable_interface_init (GInitableIface  *iface);
@@ -97,6 +99,12 @@ g_tls_server_connection_gnutls_finalize (GObject *object)
 
   clear_gnutls_certificate_copy (gnutls);
 
+  if (gnutls->session_ticket_key.data)
+    {
+      gnutls_memset (gnutls->session_ticket_key.data, 0, gnutls->session_ticket_key.size);
+      gnutls_free (gnutls->session_ticket_key.data);
+    }
+
   G_OBJECT_CLASS (g_tls_server_connection_gnutls_parent_class)->finalize (object);
 }
 
@@ -105,9 +113,10 @@ g_tls_server_connection_gnutls_initable_init (GInitable       *initable,
                                               GCancellable    *cancellable,
                                               GError         **error)
 {
-  GTlsConnectionGnutls *gnutls = G_TLS_CONNECTION_GNUTLS (initable);
+  GTlsServerConnectionGnutls *gnutls = G_TLS_SERVER_CONNECTION_GNUTLS (initable);
   GTlsCertificate *cert;
   gnutls_certificate_credentials_t creds;
+  int ret;
 
   if (!g_tls_server_connection_gnutls_parent_initable_iface->init (initable, cancellable, error))
     return FALSE;
@@ -123,6 +132,18 @@ g_tls_server_connection_gnutls_initable_init (GInitable       *initable,
       return FALSE;
     }
 
+  ret = gnutls_session_ticket_key_generate (&gnutls->session_ticket_key);
+  if (ret != GNUTLS_E_SUCCESS)
+    {
+      g_warning ("Failed to generate session ticket key, session resumption will not work: %s", 
gnutls_strerror (ret));
+    }
+  else
+    {
+      ret = gnutls_session_ticket_enable_server (session, &gnutls->session_ticket_key);
+      if (ret != GNUTLS_E_SUCCESS)
+        g_warning ("Failed to enable session tickets, session resumption will not work: %s", gnutls_strerror 
(ret));
+    }
+
   return TRUE;
 }