On Wed, Oct 13, 2021 at 11:57:14PM +, Jason Schultz wrote:
> I'm somewhat familiar with the reference count stuff from reading the
> doc on these (and other) functions. But it sounds like the behavior
> I'm seeing is expected, and OpenSSL is doing the actual free of the
> SSL_SESSION when the
OpenSSL SSL_SESSSIONS are reference-counted. This is typical of a
number of similar sufficiently complex structures for which it makes
more sense to bump a reference counter than to make a copy.
The SSL_SESSION_free(3), X509_free(), and various other calls just
decrement the reference counter, wi
On Wed, Oct 13, 2021 at 02:32:10PM +, Jason Schultz wrote:
> The confusing part is that given everything above, when I free the
> SSL_CTX associated with these connections/sessions, I see the remove
> callback function get called again for client-side sessions that I
> already called SSL_SESSI
I’m not sure I fully understand client-side sessions in OpenSSL. My
understanding is that on the server side, OpenSSL internally handles managing
sessions. On the client side, they need to be handled by the application. This
is true for both TLS 1.3 and TLS 1.2 (and prior), even though both prot
