Changes to updated cached server connections at five minute intervals

Source/GSTLS.h

@@ -192,6 +192,7 @@ typedef ssize_t (*GSTLSIOW)(gnutls_transport_ptr_t, const void *, size_t);
   BOOL                                  handshake;
   BOOL                                  setup;
   BOOL                                  debug;
+  NSTimeInterval                        created;
 @public
   gnutls_session_t                      session;
 }
@@ -212,6 +213,10 @@ typedef ssize_t (*GSTLSIOW)(gnutls_transport_ptr_t, const void *, size_t);
  */
 - (BOOL) active;
 
+/** Returns the age of this instance (how long since it was created).
+ */
+- (NSTimeInterval) age;
+
 /* Returns the credentials object ofr this session.
  */
 - (GSTLSCredentials*) credentials;

Source/GSTLS.m

@@ -1421,6 +1421,11 @@ retrieve_callback(gnutls_session_t session,
   return active;
 }
 
+- (NSTimeInterval) age
+{
+  return [NSDate timeIntervalSinceReferenceDate] - created;
+}
+
 - (GSTLSCredentials*) credentials
 {
   return credentials;
@@ -1504,6 +1509,7 @@ retrieve_callback(gnutls_session_t session,
       BOOL      trust;
       BOOL      verify;
 
+      created = [NSDate timeIntervalSinceReferenceDate];
       opts = [options copy];
       outgoing = isOutgoing ? YES : NO;
 

Source/NSFileHandle.m

@@ -982,6 +982,20 @@ GSTLSHandlePush(gnutls_transport_ptr_t handle, const void *buffer, size_t len)
   return [super read: buf length: len];
 }
 
+- (BOOL) sslAccept
+{
+  /* If a server session is over five minutes old, destroy it so that
+   * we create a new one to accept the incoming connection.  This is
+   * needed in case the certificate files associated with a long running
+   * server have been updated and we need to load/use the new certificate.
+   */
+  if (session != nil && [session age] >= 300.0)
+    {
+      DESTROY(session);
+    }
+  return [super sslAccept];
+}
+
 - (void) sslDisconnect
 {
   [self setNonBlocking: NO];