sessions reuse in openssl

[Harish Kulkarni]

I am working on memory analysis of openssl. One of the observation is the
memory allocated by d2i_X509() API (returned in x) is not being freed after
the connection is closed.. and this memory is stored as part of session.. i
want to limit number of sessions which we cache for re-use.. or if possible
completely avoid session caching.


Using TLS 1.3


-thanks

harish


        x = d2i_X509(NULL, &q, l); //// <<<<<<< memory allocated HERE (HVK)

        if (x == NULL) {

            al = SSL_AD_BAD_CERTIFICATE;

            SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE, ERR_R_ASN1_LIB);

            goto f_err;

        }

        if (q != (p + l)) {

            al = SSL_AD_DECODE_ERROR;

            SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,

                   SSL_R_CERT_LENGTH_MISMATCH);

            goto f_err;

        }

        if (!sk_X509_push(sk, x)) { ////// STORED IN LIST HERE (HVK)

            SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE, ERR_R_MALLOC_FAILURE);

            goto err;

        }

        x = NULL;

        nc += l + 3;

        p = q;

    }


    i = ssl_verify_cert_chain(s, sk);

    if ((s->verify_mode != SSL_VERIFY_NONE) && (i <= 0)

#ifndef OPENSSL_NO_KRB5

        && !((s->s3->tmp.new_cipher->algorithm_mkey & SSL_kKRB5) &&

             (s->s3->tmp.new_cipher->algorithm_auth & SSL_aKRB5))

#endif                          /* OPENSSL_NO_KRB5 */

        ) {

        al = ssl_verify_alarm_type(s->verify_result);

        SSLerr(SSL_F_SSL3_GET_SERVER_CERTIFICATE,

               SSL_R_CERTIFICATE_VERIFY_FAILED);

        goto f_err;

    }

    ERR_clear_error();          /* but we keep s->verify_result */


    sc = ssl_sess_cert_new();

    if (sc == NULL)

        goto err;


    if (s->session->sess_cert)

        ssl_sess_cert_free(s->session->sess_cert);

    s->session->sess_cert = sc;


    sc->cert_chain = sk; ///// (HVK) THE CHAIN IS STORED HERE.. as part of
session struct.. not freed.

    /*

     * Inconsistency alert: cert_chain does include the peer's certificate,

     * which we don't include in s3_srvr.c

     */

    x = sk_X509_value(sk, 0);

    sk = NULL;

On Wed, Jan 20, 2021 at 10:26 AM Viktor Dukhovni <openssl-users at dukhovni.org>
wrote:

> On Wed, Jan 20, 2021 at 08:55:13AM +0530, Harish Kulkarni wrote:
>
> > For some experiments i want to stop session re-use in openssl.. is there
> a
> > way to stop reusing of same session?.
>
> Your question is not sufficiently specific.  Are you looking to not
> reuse a session in an client or a server?  Is the server issuing
> stateless session tickets or doing fully stateful resumption with
> an in memory session cache?  Are you using TLS 1.2 or TLS 1.3?
>
> Post a reasonable level of detail outlining where the decision
> to reuse or not reuse the session is going to be made, and how
> session resumption is performed when not disabled.
>
> --
>     Viktor.
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mta.openssl.org/pipermail/openssl-users/attachments/20210120/84eb4c1a/attachment-0001.html>