On Mon, Jan 22, 2001 at 11:05:11AM +0100, Patrick CHEMLA wrote:
> Lutz Jaenicke wrote:
> >............ the session must be selected by the application.
>
> So I did it using SSL_get0_session() after the first SSL_connect() and
> SSL_set_session() for all subsequent ones (you can see my code extract
> in my last posted email).
The memory management in OpenSSL tends to be a bit confusing at this
point. (I also tend to be confused. :-)
SSL_get0_session() returns a pointer to the session being in use. At some
point in time, the OpenSSL library may decide to remove the session. This
will e.g. happen, when the SSL object, to which the session belongs is
SSL_free()'ed. You then keep a dangling pointer...
By calling SSL_get1_session() the usage counter is incremented and the
session will stay even when SSL_free() is called.
BTW. I am lucky: since Postfix/TLS has to share the session between several
processes I have to keep them in an external database anyway, so I remove
them from memory and don't have to care about the automatic removal feature :-)
Best regards,
Lutz
--
Lutz Jaenicke [EMAIL PROTECTED]
BTU Cottbus http://www.aet.TU-Cottbus.DE/personen/jaenicke/
Lehrstuhl Allgemeine Elektrotechnik Tel. +49 355 69-4129
Universitaetsplatz 3-4, D-03044 Cottbus Fax. +49 355 69-4153
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
