Document when a session gets removed from cache

Document the fact that if a session is not closed down cleanly then the
session gets removed from the cache and marked as non-resumable.

Fixes #4720

Reviewed-by: Rich Salz <rsalz@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/6053)
This commit is contained in:
Matt Caswell 2018-04-23 11:23:43 +01:00
parent 22eb2d1c80
commit 4753ad858c

View File

@ -48,6 +48,11 @@ SSL_SESSION object that cannot be used for resumption in TLSv1.3. It also
enables applications to obtain information about all sessions sent by the
server.
A session will be automatically removed from the session cache and marked as
non-resumable if the connection is not closed down cleanly, e.g. if a fatal
error occurs on the connection or L<SSL_shutdown(3)> is not called prior to
L<SSL_free(3)>.
In TLSv1.3 it is recommended that each SSL_SESSION object is only used for
resumption once.