OpenSSL session cache

Michel Arboi <[email protected]>
Newsgroups gmane.comp.security.nessus.devel
Message-ID <[email protected]>
In a desperate attempt to save CPU time, I'm playing with OpenSSL
"cache". 
My first question is if there could be any bad side effect that could
make Nessus miss vulnerabilities.
The second point is simply: "does this *ing thing work??"

This code does not reuse sessions and I don't see where the problem is.

#include <openssl/bio.h>
#include <openssl/err.h>
#include <openssl/rand.h>

#include <openssl/ssl.h>

#include <netinet/in.h>


void sslerror2(txt, err)
     char	*txt;
     int	err;
{
  char string[120];

  ERR_error_string(err, string);
  fprintf(stderr, "%s: %s\n", txt, string);
}

void
sslerror(txt)
     char	*txt;
{
  sslerror2(txt, ERR_get_error());
}

static int
pouet(const struct sockaddr_in *paddr)
{
  int		s, i;
  SSL_CTX	*ctx;
  SSL_METHOD	*mt;
  SSL		*ssl;
  SSL_SESSION	*sess = NULL;

  mt = SSLv23_client_method();
  if (mt == NULL)
    {
      sslerror("SSLv23_client_method");
      return -1;
    }
  ctx = SSL_CTX_new(mt);
  if (ctx == NULL)
    {
      sslerror("SSL_CTX_new");
      return -1;
    }

  if (! SSL_CTX_set_session_id_context(ctx, "tagada", 6))
    sslerror("SSL_CTX_set_session_id_context");
  if (!SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_SERVER))
    sslerror("SSL_CTX_set_session_cache_mode");
  /* Using BOTH or CLIENT does not change anything to the result!*/

  if (! SSL_CTX_set_options(ctx, SSL_OP_ALL))
    sslerror("SSL_CTX_set_options(SSL_OP_ALL)");
  
  for (i = 0; i < 3; i ++)
    {
      printf(">>> %d\n", i);

      s = socket(AF_INET, SOCK_STREAM,IPPROTO_TCP);
      if (s < 0)
	{
	  perror("socket");
	  return -1;
	}
      if (connect(s, paddr, sizeof(*paddr)) < 0)
	{
	  perror("connect");
	  return -1;
	}

      ssl = SSL_new(ctx);
      if (ssl == NULL)
	{
	  sslerror("SSL_new");
	  return -1;
	}

      if (sess != NULL)
	if (! SSL_set_session(ssl, sess))
	  sslerror("SSL_set_session");

      if (! SSL_set_fd(ssl, s))
	{
	  sslerror("SSL_set_fd");
	  return -1;
	}

      if (SSL_connect(ssl) <= 0)
	{
	  sslerror("SSL_connect");
	  return -1;
	}

      fprintf(stderr, "open_SSL_connection: SSL_session_reused=%d\n",
	      SSL_session_reused(ssl));
  
#if 0
      sess = SSL_get1_session(ssl);
      if (sess == NULL)
	sslerror("SSL_get1_session");
#else
      sess = NULL;
#endif

      SSL_shutdown(ssl);
      SSL_free(ssl);
      close(s);
    }

  return 0;
}

int
main(int argc, char* argv[])
{
  int		fd;
  struct sockaddr_in	addr;
  unsigned short	port;

  if (argc != 3)
    {
      fprintf(stderr, "Usage: s IP port\n");
      exit(1);
    }

  SSL_library_init();
  SSL_load_error_strings();

  port = atoi(argv[2]);
  bzero(&addr, sizeof(addr));
  if (! inet_aton(argv[1], &addr.sin_addr))
    {
      fprintf(stderr, "Invalid address %s\n", argv[1]);
      exit(1);
    }
  addr.sin_family = AF_INET;
  addr.sin_port = htons(port);
  pouet(&addr);
  exit(0);
}
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.