Update SSL_CTX_set0_buffer_pool reflecting CRYPTO_BUFFER_POOL changes After https://boringssl-review.googlesource.com/c/boringssl/+/90154, the rules are more lax, but ones does still need to be aware of SSL_CTX vs SSL lifetimes. Change-Id: I20b7516f99ab1f896ae0b46411cd284eea4546a2 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/92987 Commit-Queue: Xiangfei Ding <xfding@google.com> Auto-Submit: David Benjamin <davidben@google.com> Presubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Xiangfei Ding <xfding@google.com>
diff --git a/include/openssl/ssl.h b/include/openssl/ssl.h index e3421f0..3a2e6dc 100644 --- a/include/openssl/ssl.h +++ b/include/openssl/ssl.h
@@ -734,9 +734,12 @@ // store certificates. This can allow multiple connections to share // certificates and thus save memory. // -// The SSL_CTX does not take ownership of |pool| and the caller must ensure -// that |pool| outlives |ctx| and all objects linked to it, including |SSL|, -// |X509| and |SSL_SESSION| objects. Basically, don't ever free |pool|. +// |ctx| does not take ownership of |pool|. The caller must ensure that |pool| +// outlives |ctx|, as well as any |SSL| objects referencing |ctx|. (|SSL| +// objects will increment an |SSL_CTX|'s reference count.) It is not necessary +// for |pool| to outlive any |CRYPTO_BUFFER|s derived from it, so there is no +// lifetime constraint on |X509| or |SSL_SESSION| objects created from the +// connection. OPENSSL_EXPORT void SSL_CTX_set0_buffer_pool(SSL_CTX *ctx, CRYPTO_BUFFER_POOL *pool);