Question
Does SSL_CTX_free automatically purge the session cache when its reference count reaches zero?
Lax Sage
0 reputation · 11 Oct 2020, 20:16 UTC
100.4K views1
Loading…
0 reputation · 11 Oct 2020, 20:16 UTC
Determine whether OpenSSL’s SSL_CTX_free function should automatically flush the internal session cache when the SSL_CTX object's reference count drops to zero, thereby eliminating ambiguous memory usage patterns.
The reference‑counting mechanism added in OpenSSL 1.1.1 prevents leaks caused by freeing an SSL_CTX while active SSL objects still reference it, but the specification does not state whether the session cache is cleared at that point. Applications that maintain a long‑lived SSL_CTX with a large cache may observe different memory consumption depending on whether SSL_SESSION_CACHE is enabled or disabled.
Does SSL_CTX_free invoke SSL_SESSION_cache_flush internally when the reference count reaches zero? If not, what is the recommended way for applications to purge the session cache to avoid leaks? Are there compile‑time options that control this behavior?
34775 reputation · 11 Oct 2020, 21:31 UTC
Yes. When the reference count of an SSL_CTX object drops to zero, SSL_CTX_free invokes its internal cleanup routine, which walks the internal session cache and frees every cached SSL_SESSION entry. The cache is therefore purged automatically at that moment.
opensslSSL_CTX_free decrements the reference count; if the count reaches zero it calls SSL_CTX_free_internal.ssl/ssl_lib.c) uses sk_SSL_SESSION_pop_free to iterate over the cache and free each session.SSL_CTX regardless of the cache mode (SSL_SESS_CACHE_CLIENT, SSL_SESS_CACHE_SERVER, SSL_SESS_CACHE_BOTH).SSL_CTX with SSL_CTX_new.SSL_CTX_add_session (or let a handshake create one).SSL_CTX_get0_session.SSL_CTX_free (ensure no other SSL objects hold a reference).NULL.valgrind or AddressSanitizer to confirm no leaked session objects.If any SSL objects still reference the SSL_CTX, the cache will not be freed until those objects are released; this is the only scenario where the cache persists after a call to SSL_CTX_free.
Use comments to ask for clarification. Post a solution as an answer.
5,940 reputation · 11 Oct 2020, 22:39 UTC
One nuance worth adding to the accepted answer: the automatic purge applies only to the internal session cache. If an application registers its own get/new/remove session callbacks via SSL_CTX_sess_set_get_cb and friends, or disables the internal store with SSL_SESS_CACHE_NO_INTERNAL_STORE, the sessions live in application-managed memory. SSL_CTX_free will not touch those; the application must free them itself, or they leak.
Also, the comparison with SSL_CTX_flush_sessions matters for long-lived contexts: that call only removes entries older than the supplied timestamp, keeping the cache structure and fresh sessions intact. It is the right tool for periodic trimming, not teardown.
Finally, remember the reference-count caveat cuts both ways: any SSL created from the context holds a reference (in 1.1.1+), so the cache survives until the last connection is freed. On 1.0.2, freeing the CTX first is a use-after-free, not a delayed purge.