From 597ba51815466a0c0b68243c28b1a9c71dba5035 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Mon, 14 Jul 2014 12:29:22 +0000 Subject: [PATCH] Merge 1610311 from trunk: Extend the scope of SSLSessionCacheTimeout to sessions resumed by TLS session resumption (RFC 5077). Submitted by: rjung Reviewed by: rjung, ylavic, jorton git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1610399 13f79535-47bb-0310-9956-ffa450edef68 --- CHANGES | 3 +++ docs/manual/mod/mod_ssl.xml | 3 ++- modules/ssl/ssl_engine_init.c | 4 ++++ 3 files changed, 9 insertions(+), 1 deletion(-) diff --git a/CHANGES b/CHANGES index de28fc55af..8aedf75d1e 100644 --- a/CHANGES +++ b/CHANGES @@ -2,6 +2,9 @@ Changes with Apache 2.4.10 + *) mod_ssl: Extend the scope of SSLSessionCacheTimeout to sessions + resumed by TLS session resumption (RFC 5077). [Rainer Jung] + *) mod_deflate: Don't fail when flushing inflated data to the user-agent and that coincides with the end of stream ("Zlib error flushing inflate buffer"). PR 56196. [Christoph Fausak ] diff --git a/docs/manual/mod/mod_ssl.xml b/docs/manual/mod/mod_ssl.xml index 799e77404f..f60f5bcaa6 100644 --- a/docs/manual/mod/mod_ssl.xml +++ b/docs/manual/mod/mod_ssl.xml @@ -505,7 +505,8 @@ in the Session Cache

This directive sets the timeout in seconds for the information stored in the -global/inter-process SSL Session Cache and the OpenSSL internal memory cache. +global/inter-process SSL Session Cache, the OpenSSL internal memory cache and +for sessions resumed by TLS session resumption (RFC 5077). It can be set as low as 15 for testing, but should be set to higher values like 300 in real life.

Example diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c index d47317e633..ef2185d26c 100644 --- a/modules/ssl/ssl_engine_init.c +++ b/modules/ssl/ssl_engine_init.c @@ -1443,6 +1443,10 @@ static apr_status_t ssl_init_server_ctx(server_rec *s, } #endif + SSL_CTX_set_timeout(sc->server->ssl_ctx, + sc->session_cache_timeout == UNSET ? + SSL_SESSION_CACHE_TIMEOUT : sc->session_cache_timeout); + return APR_SUCCESS; } -- 2.40.0