Fix session resumption with OpenSSL 1.1

OpenSSL 1.1.0 and higher requires SSL_shutdown to mark a
session as resumable.

QHttpNetworkConnection/Channel tries to re-use one shared SSL
context (and the session) for its 'channels'. The session is
marked as non-resumable without shutdown sent/received.
This makes it useless for QHttpNetworkConnection.

See: https://github.com/openssl/openssl/issues/1550
Fixes: QTBUG-71967
Change-Id: Iaaceb18c4c5a090f997f9850981a27f04f1f8b06
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
Reviewed-by: Timur Pocheptsov <timur.pocheptsov@qt.io>
bb10
André Klitzing 2018-11-28 14:03:02 +01:00
parent 8915904e2a
commit 93a803a6de
1 changed files with 4 additions and 0 deletions

View File

@ -418,6 +418,10 @@ bool QSslSocketBackendPrivate::initSslContext()
void QSslSocketBackendPrivate::destroySslContext()
{
if (ssl) {
// We do not send a shutdown alert here. Just mark the session as
// resumable for qhttpnetworkconnection's "optimization", otherwise
// OpenSSL won't start a session resumption.
q_SSL_shutdown(ssl);
q_SSL_free(ssl);
ssl = nullptr;
}