Bodo Moeller wrote:
>
> Ben Laurie <[EMAIL PROTECTED]>:
>
> >> [...] the call to s->ctx->get_session_cb is
> >> immediately followed by a call to SSL_CTX_add_session. If we want to
> >> test only sessions retrieved from the external cache, the proper place
> >> for the test is between these two calls.
>
> > No, the point is that having passed the test once, it is then in the
> > internal cache, so the internal cache has been "polluted" with an
> > external session. So, we have to test the context on the internal cache,
> > too.
>
> I fail to see the problem. A session from the external cache, if one
> is used, should be included in the internal (per SSL_CTX) cache only
> if it has the correct session_id_context. If it passes this test
> once, then why wouldn't it pass the next time, too? In no case you
> will be able to use an external cache for SSL_CTXs that don't have an
> sid_ctx but require client authentication, of course.
Doh. Yes, you are right.
Cheers,
Ben.
--
http://www.apache-ssl.org/ben.html
"My grandfather once told me that there are two kinds of people: those
who work and those who take the credit. He told me to try to be in the
first group; there was less competition there."
- Indira Gandhi
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
