Ben Laurie <[EMAIL PROTECTED]>:
> Bodo Moeller:
[...]
>> The test in ssl_sess.c (function ssl_get_prev_session) is a little
>> more paranoid than is usually necessary -- if the SSL_CTX-internal
>> cache is used, usually one wouldn't really have to care about these,
>> as the SSL_CTX is enough of a context then.
> Are you sure a session from an external cache can't get recached in the
> internal cache (I haven't checked)?
This can currently happen, because the call to s->ctx->get_session_cb is
immediately followed by a call to SSL_CTX_add_session. If we want to
test only sessions retrieved from the external cache, the proper place
for the test is between these two calls.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
