Bug 1397365

Description of problem:
When NSS acts as a server, session resumption using session ID does not work for ciphersuites using DHE-DSS algorithm. Even though this behavior is expected for the ticket based resumption, the session ID resumption should work.

Version-Release number of selected component (if applicable):
nss-3.21.0-17.el7.x86_64

How reproducible:
always

Steps to Reproduce:
# NSS_CIPHER="0032"
# OPENSSL_CIPHER="DHE-DSS-AES128-SHA"
# openssl dsaparam 2048 < /dev/random > dsaparam.pem
# openssl req -x509 -newkey dsa:dsaparam.pem -keyout dsa-key.pem -out dsa-cert.pem -days 3650 -subj "/CN=localhost" -nodes
# openssl pkcs12 -name dsa -export -inkey dsa-key.pem -out dsa-key.p12 -in dsa-cert.pem -passout "pass:"
# mkdir nssdb
# certutil -N --empty-password -d sql:./nssdb
# certutil -A -d sql:./nssdb/ -n dsa -t ',,' -a -i dsa-cert.pem
# pk12util -i dsa-key.p12 -d sql:./nssdb -W ''
# /usr/lib64/nss/unsupported-tools/selfserv -d sql:./nssdb/ -p 4433 -V tls1.0: -H 1 -S dsa -c :$NSS_CIPHER -u &
# sleep 3
# openssl s_client -connect localhost:4433 -CAfile dsa-cert.pem -cipher $OPENSSL_CIPHER -no_ticket -sess_out sess.pem > full.log < /dev/null
# grep "New, TLSv1/SSLv3" full.log || echo "ERROR: HANDSHAKE ERROR"
# openssl s_client -connect localhost:4433 -CAfile dsa-cert.pem -cipher $OPENSSL_CIPHER -no_ticket -sess_in sess.pem > resumption.log < /dev/null
# grep "Reused, TLSv1/SSLv3" resumption.log || echo "ERROR: RESUMPTION EXPECTED"

Actual results:
# openssl s_client -connect localhost:4433 -CAfile dsa-cert.pem -cipher $OPENSSL_CIPHER -no_ticket -sess_out sess.pem > full.log < /dev/null
depth=0 CN = localhost
verify return:1
DONE
# grep "New, TLSv1/SSLv3" full.log || echo "ERROR: HANDSHAKE ERROR"
New, TLSv1/SSLv3, Cipher is DHE-DSS-AES128-SHA
# openssl s_client -connect localhost:4433 -CAfile dsa-cert.pem -cipher $OPENSSL_CIPHER -no_ticket -sess_in sess.pem > resumption.log < /dev/null
depth=0 CN = localhost
verify return:1
DONE
# grep "Reused, TLSv1/SSLv3" resumption.log || echo "ERROR: RESUMPTION EXPECTED"
ERROR: RESUMPTION EXPECTED
# cat full.log
<...snip...>
SSL handshake has read 1896 bytes and written 437 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-DSS-AES128-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
<...snip...>

Expected results:
The session should be resumed:
# NSS_CIPHER="003D"
# OPENSSL_CIPHER="AES256-SHA256"
<...snip...>
# /usr/lib64/nss/unsupported-tools/selfserv -d sql:./nssdb/ -p 4433 -V tls1.0: -H 1 -n rsa -c :$NSS_CIPHER -u &
# openssl s_client -connect localhost:4433 -CAfile rsa-cert.pem -cipher $OPENSSL_CIPHER -no_ticket -sess_out sess.pem > full.log < /dev/null
depth=0 CN = localhost
verify return:1
DONE
# grep "New, TLSv1/SSLv3" full.log || echo "ERROR: HANDSHAKE ERROR"
New, TLSv1/SSLv3, Cipher is AES256-SHA256
# openssl s_client -connect localhost:4433 -CAfile rsa-cert.pem -cipher $OPENSSL_CIPHER -no_ticket -sess_in sess.pem > resumption.log < /dev/null
DONE
# grep "Reused, TLSv1/SSLv3" resumption.log || echo "ERROR: RESUMPTION EXPECTED"
Reused, TLSv1/SSLv3, Cipher is AES256-SHA256

Additional info:
Problematic ciphersuites (openssl/nss):
DHE-DSS-AES128-SHA/0032
DHE-DSS-AES256-SHA256/006A
DHE-DSS-AES128-GCM-SHA256/00A2
DHE-DSS-AES256-GCM-SHA384/00A3