274989 - SSL session client cache can grow without bounds

Status: RESOLVED DUPLICATE of bug 300043

(NSS :: Libraries, defect, P2)

Description

[Julien Pierre]

Unlike the SSL server , which has a limited number of slots, configured at
initialization time, the SSL client cache knows no such bounds .
The only way SSL sessions get expunged from the client cache is when a restart
handshake happens, during which libssl inspects all the sessions in the cache
and frees all the ones that are expired or without a reference .

I think there should be limits on this cache as well. In a server application,
which talks to other servers, the memory growth from the unbounded client cache
can be a problem, since SSL sessions default to 24 hours expiration.

Comment 1

[Nelson Bolyard (seldom reads bugmail)]

It is not true that the only way that sessions are removed from the cache is
when attempting restarts.  However, I agree that the client cache could and
should be redesigned to bound session cache growth and to organize the cache
so that the entries to be deleted are LRU.

Comment 2

[Nelson Bolyard (seldom reads bugmail)]

I'd like to be able to improve this for 3.11, but 3.12 is probably the soonest
I can get to it.

Comment 3

[Julien Pierre]

This is a duplicate. I'm leaving the bug with the most information open .

*** This bug has been marked as a duplicate of 300043 ***