mirrors/openssl
0
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2024-12-18 22:43:41 +08:00
Code Issues Packages Projects Releases Wiki Activity

Ensure SSL_set_session clears the old session from cache if it is bad

Browse Source 
SSL_clear() and SSL_free() will remove a session from the cache if it is
considered "bad". However SSL_set_session() does not do this for the session
it is replacing.

SSL_clear() clears an SSL object ready for reuse. It does not clear the
session though. This means that:

  SSL_clear(s)
  SSL_set_session(s, sess);

and
  SSL_set_session(s, sess);
  SSL_clear(s);

do not do the same thing, although logically you would expect that they
would.

The failure of SSL_set_session() to remove bad sessions from the cache
should be considered a bug, so this commit fixes it.

RT#597

Reviewed-by: Rich Salz <rsalz@openssl.org>
This commit is contained in:
Matt Caswell 2016-06-09 13:24:54 +01:00
parent b02929802c
commit e70656cf1c
1 changed files with 13 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
ssl/ssl_sess.c
View File

@ -774,28 +774,20 @@ int SSL_SESSION_up_ref(SSL_SESSION *ss)
int SSL_set_session(SSL *s, SSL_SESSION *session)
{
int ret = 0;
if (session != NULL) {
if (s->ctx->method != s->method) {
if (!SSL_set_ssl_method(s, s->ctx->method))
return (0);
}
SSL_SESSION_up_ref(session);
SSL_SESSION_free(s->session);
s->session = session;
s->verify_result = s->session->verify_result;
ret = 1;
} else {
SSL_SESSION_free(s->session);
s->session = NULL;
if (s->ctx->method != s->method) {
if (!SSL_set_ssl_method(s, s->ctx->method))
return (0);
}
ret = 1;
ssl_clear_bad_session(s);
if (s->ctx->method != s->method) {
if (!SSL_set_ssl_method(s, s->ctx->method))
return 0;
}
return (ret);
if (session != NULL) {
SSL_SESSION_up_ref(session);
s->verify_result = session->verify_result;
}
SSL_SESSION_free(s->session);
s->session = session;
return 1;
}
long SSL_SESSION_set_timeout(SSL_SESSION *s, long t)