Skip to content

Client-side SSL_SESSION not working after SSL_free() or SSL_set_session(ssl, NULL) #1550

@tiran

Description

@tiran

With OpenSSL 1.1.0 I can no longer copy SSL_SESSION from one client-side connection to another

Pseudo-code:

ctx = SSL_CTX_new(TLSv1_2_method())
ssl1 = SSL_new(ctx)
// connect and perform handshake
sess = SSL_get1_session(ssl1);
SSL_shutdown(ssl1)
SSL_free(ssl1)

ssl2 = SSL_new(ctx)
SSL_set_session(ssl2, sess)
// connect and perform handshake

This approach works perfectly fine in OpenSSL 1.0.2 and earlier. I'm using it in my patch for Python 3.6
https://bugs.python.org/issue19500. With OpenSSL 1.1.0 the feature is broken. Wireshark shows that the second connection does not send a session id and session id length of 0. PyOpenSSL is also affected, pyca/pyopenssl#528

Session resumption works correctly when I either

  • delay or omit SSL_free() calls
  • dump the session with PEM_write_bio_SSL_SESSION and reload it with PEM_read_bio_SSL_SESSION.

As soon as I use SSL_set_session(ssl, NULL) or SSL_free(ssl) with an SSL object, its session can no longer be used to resume another client session.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions