In the newer versions of OpenSSL, the flag SSL_SESS_CACHE_NO_INTERNAL_LOOKUP

just prevents the internal lookup but does not prevent the caching.
OpenSSL 0.9.6h onwards has a new flag 'SSL_SESS_CACHE_NO_INTERNAL' to
prevent OpenSSL from both lookup and caching the sessions internally.

PR: 26562
Reviewed by: Geoff Thorpe, Joe Orton

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@103165 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index 8087f16ef4e12317fb70f168bd26d608e5915764..c7650f91433b499cd7a82953c09846fec3970ac1 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -2,6 +2,9 @@ Changes with Apache 2.1.0-dev
 
   [Remove entries to the current 2.0 section below, when backported]
 
+  *) mod_ssl: Disable the extra session caching in OpenSSL to prevent memory
+     leak. PR 26562. [Madhusudan Mathihalli] 
+
   *) work around MSIE Digest auth bug - if AuthDigestEnableQueryStringHack
      is set in r->subprocess_env allow mismatched query strings to pass.
      PR 27758.  [Paul Querna <chip force-elite.com>, Geoffrey Young]

diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
index 95d3b5be588231371c9534fbb0d7943f635aa602..e2c29b448b5ba5d0ecc620707e147aa1882e2fec 100644 (file)
--- a/modules/ssl/ssl_engine_init.c
+++ b/modules/ssl/ssl_engine_init.c
@@ -446,11 +446,11 @@ static void ssl_init_ctx_session_cache(server_rec *s,
     long cache_mode = SSL_SESS_CACHE_OFF;
 
     if (mc->nSessionCacheMode != SSL_SCMODE_NONE) {
-        /* SSL_SESS_CACHE_NO_INTERNAL_LOOKUP will force OpenSSL
+        /* SSL_SESS_CACHE_NO_INTERNAL will force OpenSSL
          * to ignore process local-caching and
          * to always get/set/delete sessions using mod_ssl's callbacks.
          */
-        cache_mode = SSL_SESS_CACHE_SERVER|SSL_SESS_CACHE_NO_INTERNAL_LOOKUP;
+        cache_mode = SSL_SESS_CACHE_SERVER|SSL_SESS_CACHE_NO_INTERNAL;
     }
 
     SSL_CTX_set_session_cache_mode(ctx, cache_mode);

diff --git a/modules/ssl/ssl_toolkit_compat.h b/modules/ssl/ssl_toolkit_compat.h
index 8e140429900203bba64d468eba65ea7521db1641..367e12e60dfc8a67b96e4d65283f21c81b4759e0 100644 (file)
--- a/modules/ssl/ssl_toolkit_compat.h
+++ b/modules/ssl/ssl_toolkit_compat.h
@@ -223,4 +223,8 @@ typedef void (*modssl_popfree_fn)(char *data);
     SSL_set_verify(ssl, verify, cb)
 #endif
 
+#ifndef SSL_SESS_CACHE_NO_INTERNAL
+#define SSL_SESS_CACHE_NO_INTERNAL  SSL_SESS_CACHE_NO_INTERNAL_LOOKUP
+#endif
+
 #endif /* SSL_TOOLKIT_COMPAT_H */