Bodo Moeller wrote:
>
> Ben Laurie <[EMAIL PROTECTED]>:
> > Bodo Moeller:
>
> [...]
> >> The test in ssl_sess.c (function ssl_get_prev_session) is a little
> >> more paranoid than is usually necessary -- if the SSL_CTX-internal
> >> cache is used, usually one wouldn't really have to care about these,
> >> as the SSL_CTX is enough of a context then.
>
> > Are you sure a session from an external cache can't get recached in the
> > internal cache (I haven't checked)?
>
> This can currently happen, because the call to s->ctx->get_session_cb is
> immediately followed by a call to SSL_CTX_add_session. If we want to
> test only sessions retrieved from the external cache, the proper place
> for the test is between these two calls.
No, the point is that having passed the test once, it is then in the
internal cache, so the internal cache has been "polluted" with an
external session. So, we have to test the context on the internal cache,
too.
Or, not store the external cache in the internal cache.
Cheers,
Ben.
--
http://www.apache-ssl.org/ben.html
"My grandfather once told me that there are two kinds of people: those
who work and those who take the credit. He told me to try to be in the
first group; there was less competition there."
- Indira Gandhi
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
