<div dir="ltr"><div>Hi,</div><div><br></div>I keep seeing growth in memory usage.. suspecting a leak. Want to disable reference counting as well as stop caches so that i can isolate the issue.<div><br></div><div>It's all happening on client side. I will try disabling cache..</div><div><br></div><div>Mean while if any other inputs/pointers would be helpful.</div><div><br></div><div>-thanks</div><div>harish</div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Jan 27, 2021 at 3:32 PM Matt Caswell <<a href="mailto:matt@openssl.org">matt@openssl.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><br>
<br>
On 26/01/2021 18:13, Harish Kulkarni wrote:<br>
> Thank you both for bringing this to my attention, your points are<br>
> invaluable.<br>
> <br>
> If this is something which gets set from server on client side. can<br>
> client override this?. Can i change this to something less and try?. Has<br>
> anyone tried?.<br>
> <br>
> Whats the option in openssl.conf or some other place?.<br>
<br>
The session timeout is something entirely controlled by the server. The<br>
client has no influence on this*. If the server is using session tickets<br>
for its sessions then it provides a lifetime hint to the client to say<br>
how long the client can expect the session to be good for. The client<br>
can query this using SSL_SESSION_get_ticket_lifetime_hint().<br>
<br>
On the server the timeout can be configured using SSL_CTX_set_timeout().<br>
I don't think this is possible to change via openssl.conf.<br>
<br>
Matt<br>
<br>
<br>
* Note that the client may be managing a cache of sessions provided by<br>
servers. That's not something that happens by default in OpenSSL but can<br>
be configured using SSL_CTX_set_session_cache_mode(). In that case there<br>
will be separate timeouts associated with the life of the session in the<br>
client cache. Those timeouts may not be the same as the server's timeouts.<br>
<br>
> <br>
> -thanks<br>
> harish<br>
> <br>
> <br>
> On Mon, Jan 25, 2021 at 11:08 PM Matt Caswell <<a href="mailto:matt@openssl.org" target="_blank">matt@openssl.org</a><br>
> <mailto:<a href="mailto:matt@openssl.org" target="_blank">matt@openssl.org</a>>> wrote:<br>
> <br>
> <br>
> <br>
> On 23/01/2021 15:22, John Thoe wrote:<br>
> > Hi list,<br>
> ><br>
> > The session reuse question posted on the mailing list earlier<br>
> ><br>
> (<a href="https://mta.openssl.org/pipermail/openssl-users/2021-January/013360.html" rel="noreferrer" target="_blank">https://mta.openssl.org/pipermail/openssl-users/2021-January/013360.html</a>)<br>
> > reminded of a somewhat similar question I have.<br>
> ><br>
> > As per the docs,<br>
> ><br>
> <a href="https://www.openssl.org/docs/man1.0.2/man3/SSL_get_default_timeout.html" rel="noreferrer" target="_blank">https://www.openssl.org/docs/man1.0.2/man3/SSL_get_default_timeout.html</a>,<br>
> > it says the default value is 300 seconds for which a session resuse<br>
> > will be accepted. The docs say that it is the same for all<br>
> > protocols.<br>
> ><br>
> > However I tried it with my setup where I didn't explicitly set the<br>
> > timeout and I am getting 7200 seconds as the default value. s_client<br>
> > output: TLS session ticket lifetime hint: 7200 (seconds). My client<br>
> > openssl.conf has no setting override (not that it should matter<br>
> > because this is a server preference). No OpenSSL settings on the<br>
> > server have been modified as well.<br>
> <br>
> Looks to me like the docs are wrong. They probably should say 7200.<br>
> <br>
> <br>
> ><br>
> > In ssl/ssl_sess.c#L80, the code matches the document: ss->timeout =<br>
> > 60 * 5 + 4; /* 5 minute timeout by default */ ... (with additional<br>
> > four seconds?)<br>
> <br>
> <br>
> This gets set during construction and then later overwritten when we<br>
> actually get a new session via "ssl_get_new_session":<br>
> <br>
> /* If the context has a default timeout, use it */<br>
> if (s->session_ctx->session_timeout == 0)<br>
> ss->timeout = SSL_get_default_timeout(s);<br>
> else<br>
> ss->timeout = s->session_ctx->session_timeout;<br>
> <br>
> In most cases SSL_get_default_timeout() calls tls1_default_timeout() (it<br>
> can end up somewhere different for certain protocol versions - but all<br>
> the different variants are the same!):<br>
> <br>
> long tls1_default_timeout(void)<br>
> {<br>
> /*<br>
> * 2 hours, the 24 hours mentioned in the TLSv1 spec is way too<br>
> long for<br>
> * http, the cache would over fill<br>
> */<br>
> return (60 * 60 * 2);<br>
> }<br>
> <br>
> 60 * 60 * 2 = 7200<br>
> <br>
> <br>
> Matt<br>
> <br>
</blockquote></div>