Skip to content
  • Apollon Oikonomopoulos's avatar
    http.client: Disable SSL session ID cache · 4ba4fe14
    Apollon Oikonomopoulos authored
    
    
    This patch disables the SSL session ID cache for all cURL operations.
    This is needed because http.HttpBase's PyOpenSSL implementation does not
    currently set a context using SSL_set_session_id_context(3SSL), cURL
    tries to re-use the session ID and, according to
    SSL_set_session_id_context(3SSL):
    
     If the session id context is not set on an SSL/TLS server and client
     certificates are used, stored sessions will not be reused but a fatal
     error will be flagged and the handshake will fail.
    
    Ideally, session caching should be either controlled, or disabled in
    HttpBase, however PyOpenSSL does not seem to implement
    SSL_CTX_set_session_cache_mode nor SSL_CTX_set_session_id_context which
    are used for these purposes (it seems that only M2Crypto's SSL module
    supports these).
    
    Signed-off-by: default avatarApollon Oikonomopoulos <apollon@noc.grnet.gr>
    Signed-off-by: default avatarMichael Hanselmann <hansmi@google.com>
    Reviewed-by: default avatarMichael Hanselmann <hansmi@google.com>
    4ba4fe14