From: Matt Caswell <matt@openssl.org>
Date: Wed, 26 Apr 2017 14:16:18 +0000 (+0100)
Subject: Clarify that SSL_CTX_remove_session() marks a session as non-resumable
X-Git-Tag: OpenSSL_1_1_1-pre1~1655
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=b89646684d920d3014979f8a73b96aecb61c7b1f;p=oweals%2Fopenssl.git

Clarify that SSL_CTX_remove_session() marks a session as non-resumable

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3008)
---

diff --git a/doc/man3/SSL_CTX_add_session.pod b/doc/man3/SSL_CTX_add_session.pod
index dd92c3a231..02d93b8b1d 100644
--- a/doc/man3/SSL_CTX_add_session.pod
+++ b/doc/man3/SSL_CTX_add_session.pod
@@ -21,8 +21,8 @@ reference count for session B<c> is incremented by 1. If a session with
 the same session id already exists, the old session is removed by calling
 L<SSL_SESSION_free(3)>.
 
-SSL_CTX_remove_session() removes the session B<c> from the context B<ctx>.
-L<SSL_SESSION_free(3)> is called once for B<c>.
+SSL_CTX_remove_session() removes the session B<c> from the context B<ctx> and
+marks it as non-resumable. L<SSL_SESSION_free(3)> is called once for B<c>.
 
 SSL_add_session() and SSL_remove_session() are synonyms for their
 SSL_CTX_*() counterparts.
diff --git a/doc/man3/SSL_CTX_sess_set_get_cb.pod b/doc/man3/SSL_CTX_sess_set_get_cb.pod
index 55edd1c1a6..65f1e4e7c5 100644
--- a/doc/man3/SSL_CTX_sess_set_get_cb.pod
+++ b/doc/man3/SSL_CTX_sess_set_get_cb.pod
@@ -67,7 +67,8 @@ be established with a single connection. In these case the new_session_cb()
 function will be invoked multiple times.
 
 In TLSv1.3 it is recommended that each SSL_SESSION object is only used for
-resumption once.
+resumption once. One way of enforcing that is for applications to call
+L<SSL_CTX_remove_session(3)> after a session has been used.
 
 The remove_session_cb() is called, whenever the SSL engine removes a session
 from the internal cache. This happens when the session is removed because