+static void
+ssl_delete_session(struct shash_node *node)
+{
+ SSL_SESSION *session = node->data;
+ SSL_SESSION_free(session);
+ shash_delete(&client_sessions, node);
+}
+
+/* Find and free any previously cached session for 'stream''s target. */
+static void
+ssl_flush_session(struct stream *stream)
+{
+ struct shash_node *node;
+
+ node = shash_find(&client_sessions, stream_get_name(stream));
+ if (node) {
+ ssl_delete_session(node);
+ }
+}
+
+/* Add 'stream''s session to the cache for its target, so that it will be
+ * reused for future SSL connections to the same target. */
+static void
+ssl_cache_session(struct stream *stream)
+{
+ struct ssl_stream *sslv = ssl_stream_cast(stream);
+ SSL_SESSION *session;
+
+ /* Statistics. */
+ COVERAGE_INC(ssl_session);
+ if (SSL_session_reused(sslv->ssl)) {
+ COVERAGE_INC(ssl_session_reused);
+ }
+
+ /* Get session from stream. */
+ session = SSL_get1_session(sslv->ssl);
+ if (session) {
+ SSL_SESSION *old_session;
+
+ old_session = shash_replace(&client_sessions, stream_get_name(stream),
+ session);
+ if (old_session) {
+ /* Free the session that we replaced. (We might actually have
+ * session == old_session, but either way we have to free it to
+ * avoid leaking a reference.) */
+ SSL_SESSION_free(old_session);
+ } else if (shash_count(&client_sessions) > MAX_CLIENT_SESSION_CACHE) {
+ for (;;) {
+ struct shash_node *node = shash_random_node(&client_sessions);
+ if (node->data != session) {
+ ssl_delete_session(node);
+ break;
+ }
+ }
+ }
+ } else {
+ /* There is no new session. This doesn't really make sense because
+ * this function is only called upon successful connection and there
+ * should always be a new session in that case. But I don't trust
+ * OpenSSL so I'd rather handle this case anyway. */
+ ssl_flush_session(stream);
+ }
+}
+