ssl: TLS-1.2 session reuse and client certs

Make session_reuse disabled by default when client certificates
are requierd, until extend master secret can be implemented.
But best option is to run TLS-1.3.

Author: IngelaAndin

lib/ssl/src/ssl.erl

@@ -4630,7 +4630,16 @@ opt_reuse_sessions(UserOpts, #{versions := Versions} = Opts, #{role := client})
     assert_version_dep(Where2 =:= new, reuse_session, Versions, ['tlsv1','tlsv1.1','tlsv1.2']),
     Opts#{reuse_sessions => RUSS, reuse_session => RS};
 opt_reuse_sessions(UserOpts, #{versions := Versions} = Opts, #{role := server}) ->
-    {Where1, RUSS} = get_opt_bool(reuse_sessions, true, UserOpts, Opts),
+    %% Disable reuse_sessions when client cert verify_peer
+    %% verification is required, until Extended Master Secret is implemented.
+    ReuseDefault = case maps:get(verify, Opts) of
+                       verify_peer ->
+                           false;
+                       verify_none ->
+                           true
+                   end,
+
+    {Where1, RUSS} = get_opt_bool(reuse_sessions, ReuseDefault, UserOpts, Opts),
 
     DefRS = fun(_, _, _, _) -> true end,
     {Where2, RS} = get_opt_fun(reuse_session, 4, DefRS, UserOpts, Opts),

lib/ssl/src/ssl_config.erl

@@ -380,7 +380,7 @@ dh_file(DbHandle, DHParamFile) ->
         end
     catch
         _:Reason ->
-            file_error(DHParamFile, {dhfile, Reason}) 
+            file_error(DHParamFile, {dhfile, Reason})
     end.
 
 session_cb_init_args(client) ->

lib/ssl/test/ssl_session_SUITE.erl

@@ -199,7 +199,7 @@ reuse_session_expired(Config) when is_list(Config) ->
 				   {from, self()},
 				   {mfa, {ssl_test_lib, no_result, []}},
 				   {tcp_options, [{active, false}]},
-				   {options, ServerOpts}]),
+                                   {options, [{reuse_sessions, true}| ServerOpts]}]),
     Port0 = ssl_test_lib:inet_port(Server0),
 
     Client0 = ssl_test_lib:start_client([{node, ClientNode},
@@ -328,7 +328,7 @@ explicit_session_reuse(Config) when is_list(Config) ->
 	ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
                                    {from, self()},
                                    {mfa, {ssl_test_lib, no_result, []}},
-                                   {options, ServerOpts}]),
+                                   {options, [{reuse_sessions, true} | ServerOpts]}]),
     Port = ssl_test_lib:inet_port(Server),
     {Client0, Client0Sock} =
 	ssl_test_lib:start_client([{node, ClientNode},
@@ -367,7 +367,7 @@ explicit_session_reuse_expired(Config) when is_list(Config) ->
 	ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
                                    {from, self()},
                                    {mfa, {ssl_test_lib, no_result, []}},
-                                   {options, ServerOpts}]),
+                                   {options, [{reuse_sessions, true} | ServerOpts]}]),
     Port = ssl_test_lib:inet_port(Server),
     {Client0, Client0Sock} =
 	ssl_test_lib:start_client([{node, ClientNode},
@@ -471,8 +471,9 @@ no_reuses_session_server_restart_new_cert() ->
     [{doc,"Check that a session is not reused if the server is restarted with a new cert."}].
 no_reuses_session_server_restart_new_cert(Config) when is_list(Config) ->
     ClientOpts = ssl_test_lib:ssl_options(client_rsa_der_opts, Config),
-    ServerOpts = ssl_test_lib:ssl_options(server_rsa_der_verify_opts, Config),
-    POpts = proplists:get_value(protocol_opts, Config, []),
+    ServerOpts = [{reuse_sessions, true} |
+                  ssl_test_lib:ssl_options(server_rsa_der_verify_opts, Config)],
+    POpts = proplists:get_value(group_opts, Config, []),
 
     #{client_config := NewCOpts,
       server_config := NewSOpts} = ssl_test_lib:make_cert_chains_der(rsa,
@@ -483,16 +484,17 @@ no_reuses_session_server_restart_new_cert(Config) when is_list(Config) ->
     {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
 
     Server0 =
-	ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
-				   {from, self()},
+        ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
+                                   {from, self()},
                                    {mfa, {ssl_test_lib, session_info_result, []}},
-				   {options, ServerOpts}]),
+                                   {options, ServerOpts}]),
     Port = ssl_test_lib:inet_port(Server0),
     Client0 =
 	ssl_test_lib:start_client([{node, ClientNode},
                                    {port, Port}, {host, Hostname},
                                    {mfa, {ssl_test_lib, session_info_result, []}},
-                                   {from, self()},  {options, [{reuse_sessions, save} | ClientOpts]}]),
+                                   {from, self()},
+                                   {options, [{reuse_sessions, save} | ClientOpts]}]),
     Info0 = receive {Server0, Info00} -> Info00 end,
     Info0 = receive {Client0, Info01} -> Info01 end,
 
@@ -597,7 +599,8 @@ client_max_session_table(Config) when is_list(Config)->
     ClientOpts = ssl_test_lib:ssl_options(client_rsa_verify_opts, Config),
     ServerOpts = ssl_test_lib:ssl_options(server_rsa_verify_opts, Config),
     {ClientNode, ServerNode, HostName} = ssl_test_lib:run_where(Config),
-    test_max_session_limit(ClientOpts,ServerOpts,ClientNode, ServerNode, HostName),    
+    test_max_session_limit(ClientOpts,[{reuse_sessions, true} | ServerOpts],
+                           ClientNode, ServerNode, HostName),
     %% Explicit check table size
     {status, _, _, StatusInfo} = sys:get_status(whereis(ssl_manager)),
     [_, _,_, _, Prop] = StatusInfo,
@@ -612,7 +615,8 @@ server_max_session_table(Config) when is_list(Config)->
     ClientOpts = ssl_test_lib:ssl_options(client_rsa_verify_opts, Config),
     ServerOpts = ssl_test_lib:ssl_options(server_rsa_verify_opts, Config),
     {ClientNode, ServerNode, HostName} = ssl_test_lib:run_where(Config),
-    test_max_session_limit(ClientOpts,ServerOpts,ClientNode, ServerNode, HostName),
+    test_max_session_limit(ClientOpts,[{reuse_sessions, true} | ServerOpts],
+                           ClientNode, ServerNode, HostName),
     %% Explicit check table size
     SupName = sup_name(ServerOpts),
     Sup = whereis(SupName),
@@ -648,7 +652,6 @@ session_table_stable_size_on_tcp_close(Config) when is_list(Config)->
     faulty_client(Hostname, Port),
     check_table_did_not_grow(SessionCachePid, N).
 
-
 %%--------------------------------------------------------------------
 %% Internal functions ------------------------------------------------
 %%--------------------------------------------------------------------

lib/ssl/test/ssl_test_lib.erl

@@ -3958,7 +3958,7 @@ reuse_session(ClientOpts, ServerOpts, Config) ->
                       {from, self()},
                       {mfa, {ssl_test_lib, no_result, []}},
                       {tcp_options, [{active, false}]},
-                      {options, ServerOpts}]),
+                      {options, [{reuse_sessions, true} | ServerOpts]}]),
     Port0 = inet_port(Server0),
 
     Client0 = start_client([{node, ClientNode},