[RFC PATCH] HTTPS connection reuse with SNI

[Joshua Knox]

A github issue was filed at https://github.com/haproxy/haproxy/issues/371

The CONTRIBUTING guidelines requested discussion on the list, I believe the
included diff would address that issue and arguably be less surprising
behavior.

The comment from ehocdet on the issue indicated that connection reuse could
be reused if SNI was incorporated into connection selection criteria.  I
think that that larger change would make sense for reuse in "http-reuse
safe" mode.

There are currently a number of explicit checks for "http-reuse never" that
set the private connection flag (CO_FL_PRIVATE), I think that failing to
set it in this case is the logical counterpart.

Thanks in advance,
Josh

diff --git a/doc/configuration.txt b/doc/configuration.txt
index fdcdb04fa..3d00ecbd9 100644
--- a/doc/configuration.txt
+++ b/doc/configuration.txt
@@ -5266,7 +5266,7 @@ http-reuse { never | safe | aggressive | always }
       ("client", "clientip", "hdr_ip") are marked private and never shared;

     - connections sent to a server with a TLS SNI extension are marked
private
-      and are never shared;
+      and are never shared unless the mode is "always";

     - connections with certain bogus authentication schemes (relying on the
       connection) like NTLM are detected, marked private and are never
shared;
diff --git a/src/backend.c b/src/backend.c
index ebc5050cb..5cc866d27 100644
--- a/src/backend.c
+++ b/src/backend.c
@@ -1581,7 +1581,10 @@ int connect_server(struct stream *s)
                        if (smp_make_safe(smp)) {
                                ssl_sock_set_servername(srv_conn,

smp->data.u.str.area);
-                               srv_conn->flags |= CO_FL_PRIVATE;
+
+                               if ((s->be->options & PR_O_REUSE_MASK) !=
PR_O_REUSE_ALWS) {
+                                       srv_conn->flags |= CO_FL_PRIVATE;
+                               }
                        }
                }
 #endif /* USE_OPENSSL */