Ben Laurie <[EMAIL PROTECTED]>:
>> [...] the call to s->ctx->get_session_cb is
>> immediately followed by a call to SSL_CTX_add_session. If we want to
>> test only sessions retrieved from the external cache, the proper place
>> for the test is between these two calls.
> No, the point is that having passed the test once, it is then in the
> internal cache, so the internal cache has been "polluted" with an
> external session. So, we have to test the context on the internal cache,
> too.
I fail to see the problem. A session from the external cache, if one
is used, should be included in the internal (per SSL_CTX) cache only
if it has the correct session_id_context. If it passes this test
once, then why wouldn't it pass the next time, too? In no case you
will be able to use an external cache for SSL_CTXs that don't have an
sid_ctx but require client authentication, of course.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
