Re: OpenSSL session cache

On Mon, 22 Sep 2003, Michel Arboi wrote:

> In a desperate attempt to save CPU time, I'm playing with OpenSSL
> "cache". 
> My first question is if there could be any bad side effect that could
> make Nessus miss vulnerabilities.

We should be careful when we test problems with SSL implementation
itself. It should be harmless for problems in layers above SSL...
of course as long as the tested service is sane enough not behave
differently when a short-cut SSL handshake is used...

> The second point is simply: "does this *ing thing work??"
> This code does not reuse sessions and I don't see where the problem is.

As far I can tell it appears the session cache does not work for clients
and anyone who wants to cache sessions in the client is supposed to manage
his own cache. In fact, you have already got a kind of poor man's cache in
your code (sess = SSL_get1_session(ssl)) but it is ifdef'ed out. It worked
for me when I "ifdef'ed it in" (nevertheless, such a code might leak
memory because sess's ref count grows ad infinitum being increased by both
SSL_get1_session() and SSL_set_session()). Why did you ifdef it out?

--Pavel Kankovsky aka Peak  [ Boycott Microsoft--http://www.vcnet.com/bms ]
"Resistance is futile. Open your source code and prepare for assimilation."