Re: OpenSSL session cache

On Mon, 22 Sep 2003, Michel Arboi wrote:

> > We should be careful when we test problems with SSL implementation
> > itself. 
> 
> Those plugins should be written directly in C, or handle the SSL
> protocol by themselves by setting the "protocol" to ENCAPS_IP

Yes.

> > It should be harmless for problems in layers above SSL...
> > of course as long as the tested service is sane enough not behave
> > differently when a short-cut SSL handshake is used...
> 
> But are there such brain damaged services?

I do not know of any such service.
But who knows where we will go tomorrow? ;)

> > As far I can tell it appears the session cache does not work for
> > clients
> 
> I read that somewhere. Maybe here:
> http://www.linuxjournal.com/article.php?sid=5487

Hm...that article proves my point. When you want to reuse session info
on the client side, you must do one of two things:
  1. reuse SSL structure,
  2. do manual SSL_set_session().
Automatic caching in SSL_CTX works for the server side only (SSL_accept).

> But my server (Apache + mod_ssl) is supposed to cache sessions, and
> this does not work.

Try openssl -connect x:y -reconnect.

> I know it works in simple cases, but we have to be very careful: I got
> kazillons of errors in ssl_error_log (on the Apache side) when trying
> an old version of this quick & dirty code in nessusd.

Strange. I don't get any errors with your simple program.

--Pavel Kankovsky aka Peak  [ Boycott Microsoft--http://www.vcnet.com/bms ]
"Resistance is futile. Open your source code and prepare for assimilation."