<html><head></head><body><div style="font-family: Verdana;font-size: 12.0px;"><div>
<pre>> Objects are copied and ref-counted when an SSL is created from an SSL_CTX...</pre>
<div>
<div>To me this seems is only half-true. In SSL_new() we see that only the own certificate/key gets duplicated with ssl_cert_dup(ctx->cert), as for the trusted stuff in X509_STORE only the pointer is copied.<br/>
Inside ssl_verify_cert_chain() when a temporary X509_STORE_CTX is created it will share the X509_STORE instance with all other connections.</div>
<div>Therefore we must assume that replacing the X509_STORE instance from an other thread during running connections is definitely unsafe.<br/>
Alternatively, do you think the reference counter system is able to correctly handle additions/removals to/from the existing X509_STORE obj list instead of replacing it? </div>
<div> </div>
<div>Fabrizio</div>
<div> </div>
<div name="quote" style="margin:10px 5px 5px 10px; padding: 10px 0 10px 10px; border-left:2px solid #C3D9E5; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div style="margin:0 0 10px 0;"><b>Gesendet:</b> Mittwoch, 12. August 2015 um 15:38 Uhr<br/>
<b>Von:</b> "Salz, Rich" <rsalz@akamai.com><br/>
<b>An:</b> "openssl-users@openssl.org" <openssl-users@openssl.org><br/>
<b>Betreff:</b> Re: [openssl-users] X509_STORE manipulations and thread-safety</div>
<div name="quoted-content">> Is it safe to have a thread reload trusted certificates and crls into a SSL_CTX's X509_STORE while connections are running in other threads, especially when considering renegotiations?<br/>
<br/>
As a general rule, multi-thread simultaneous access doesn't work and will often make things go ka-boom. But generally ongoing connections use SSL objects, not SSL_CTX, so a brief locking scheme should be okay. Objects are copied and ref-counted when an SSL is created from an SSL_CTX...<br/>
<br/>
--<br/>
Senior Architect, Akamai Technologies<br/>
IM: richsalz@jabber.at Twitter: RichSalz<br/>
_______________________________________________<br/>
openssl-users mailing list<br/>
To unsubscribe: <a href="https://mta.openssl.org/mailman/listinfo/openssl-users" target="_blank">https://mta.openssl.org/mailman/listinfo/openssl-users</a></div>
</div>
</div>
</div></div></body></html>