Re: OpenSSL session cache

Pavel Kankovsky <[email protected]> writes:

> We should be careful when we test problems with SSL implementation
> itself. 

Those plugins should be written directly in C, or handle the SSL
protocol by themselves by setting the "protocol" to ENCAPS_IP

> It should be harmless for problems in layers above SSL...
> of course as long as the tested service is sane enough not behave
> differently when a short-cut SSL handshake is used...

But are there such brain damaged services?

> As far I can tell it appears the session cache does not work for
> clients

I read that somewhere. Maybe here:
http://www.linuxjournal.com/article.php?sid=5487

But my server (Apache + mod_ssl) is supposed to cache sessions, and
this does not work.

> and anyone who wants to cache sessions in the client is supposed to manage
> his own cache. In fact, you have already got a kind of poor man's cache in
> your code (sess = SSL_get1_session(ssl)) but it is ifdef'ed out.

I removed it when I tested the other way to do it (OpenSSL own cache)
I know it works in simple cases, but we have to be very careful: I got
kazillons of errors in ssl_error_log (on the Apache side) when trying
an old version of this quick & dirty code in nessusd.